                    1.3.8 Release Notes
                  ------------------------

This file contains a description of the major changes to ProFTPD for the
1.3.8 release cycle, from the 1.3.8rc1 release to the 1.3.8 maintenance
releases.  More information on these changes can be found in the NEWS and
ChangeLog files.

1.3.8c
------

  + Fixed segfault when TLSOptions StdEnvVars is used in conjunction with
    an FTPS session.

  + Properly use all configured ECDSA SSH hostkeys, not just the first
    configured ECSA SSH hostkey.

  + Fixed issue with RADIUS authentication when using mod_radius and newer
    FreeRADIUS, due to BlastRadius mitigation.


1.3.8b
------

  + Implemented mitigations for "Terrapin" SSH attack (CVE-2023-48795).


1.3.8a
------

  + Fixed builds when using OpenSSL 3.x


1.3.8
------

  + Implement support for the CSID FTP command, from an IETF Draft.

  + The mod_auth_otp module improperly allowed keyboard-interactive
    authentication to succeed for users lacking OTP entries.


  + Changed Directives

    FSCachePolicy

      The default value for FSCachePolicy is now "off".


1.3.8rc4
---------

  + Ensure that mod_sftp algorithms work properly when OpenSSL 3.x is used.


  + New Directives

    SFTPHostKeys

      This directive for the mod_sftp module can be used to specify
      the list of SSH host key algorithms that will be presented to
      clients; see doc/contrib/mod_sftp.html#SFTPHostKeys for more
      information.


  + Changed Directives

    SFTPClientMatch

      The SFTPClientMatch directive has been expanded to allow setting
      some SSH algorithms based on the matched client banner, including
      encryption and signature algorithms.  See
      doc/contrib/mod_sftp.html#SFTPClientMatch for details.

    SFTPKeyExchanges

      The mod_sftp module now supports the "curve448-sha512" key
      exchange algorithm, and the SFTPKeyExchanges directive has been
      updated accordingly.  See
      doc/contrib/mod_sftp.html#SFTPKeyExchanges.


1.3.8rc3
---------

  + Improved consistency/support for name-based virtual hosts.

  + Support for the AES-GCM ciphers "aes128-gcm@openssh.com" and
    "aes256-gcm@openssh.com" have been added to mod_sftp.

  + Support SSH hostkey rotation via OpenSSH "hostkeys-00@openssh.com" and
    "hostkeys-prove-00@openssh.com" extensions.

  + Support for the "home-directory" SFTP extenssion.

  + Support use of PCRE2, rather than PCRE, via the `--enable-pcre2` configure
    option.


  + New Directives

    FactsDefault

      This directive can be used to explicitly configure the list of "facts"
      returned, per path, in the MLSD/MLSD FTP responses.
      See doc/modules/mod_facts.html#FactsDefault for more details.

    LDAPConnectTimeout

      When connecting to LDAP servers, use this directive to configure
      a longer timeout, if necessary.  See
      doc/contrib/mod_ldap.html#LDAPConnectTimeout for more information.


  + Changed Directives

    RegexOptions

      With the additional support for the PCRE2 library, the RegexOptions
      directive now supports explicitly selecting that as the regex "engine";
      see doc/modules/mod_core.html#RegexOptions for details.

    SFTPCiphers

      The OpenSSH-specific AES GCM ciphers are now implemented; see
      doc/contrib/mod_sftp.html#SFTPCiphers.

    SFTPDigests

      The OpenSSH-specific Encrypt-Then-MAC (ETM) digests are now supported;
      see doc/contrib/mod_sftp.html#SFTPDigests.

    SFTPExtensions homeDirectory

      The `mod_sftp` module supports the SFTP extension for querying a
      user's home directory (once the client has authenticated).  Use
      the SFTPExtensions directive to disable support for this extension if
      necessary.

    SFTPOptions NoHostkeyRotation

      The `mod_sftp` module now supports the OpenSSH-specific "hostkey"
      extensions, for hostkey rotation.  Use this option to disable support
      for those extensions where needed; see
      doc/contrib/mod_sftp.html#SFTPOptions.

    SocketOptions ReusePort

      The SocketOptions directive now support configuring the `SO_REUSEPORT`
      socket option, for cases where this is useful, such as specific
      ProFTPD + Docker networking situations.

    TransferOptions AllowSymlinkUpload

      In past releases, ProFTPD allows uploads to symlinks; this was
      inadvertently broken at some point.  Such uploading to symlinks is
      possible once more, using this new TransferOption.
      See doc/modules/mod_xfer.html#TransferOptions.


1.3.8rc2
---------

  + Fix memory disclosure to RADIUS servers by mod_radius (Issue #1284).

  + PCRE expressions with capture groups were not being handled properly
    (Issue #1300).

  + Add support for the libidn2 library, over libidn, for e.g. mod_rewrite
    mappings (Issue #1286).


  + Changed Directives

    RegexOptions Engine

      The RegexOptions directive now supports explicitly configuring which
      regular expression "engine" to use, POSIX or PCRE.  Thus ProFTPD
      installations with PCRE support enabled (via the --enable-pcre configure
      option) can be told to treat all regular expressions as POSIX expressions
      at run-time.

    TLSRenegotiate default behavior

      The TLSRenegotiate directive configures when the mod_tls module requests
      TLS renegotations on both control and data connections.  TLS
      renegotiations, as a protocol feature, have a long and sordid history
      of abuse; many TLS libraries/clients no longer implement them, or
      disable support for renegotiation by default.  Thus mod_tls will no
      longer request TLS renegotations by default now, either.


  + Developer Notes

    The generated Make.rules file will now be installed alongside the
    installed ProFTPD headers.  It contains build rules used by third-party
    modules that use multiple source files.


1.3.8rc1
---------

  + Minimum DH parameter size for TLS has been raised from 1024 to 2048.

  + Passive transfers fail unexpectedly due to use of SO_REUSEPORT socket
    option (Issue #1171).

  + Fixed occasional segfaults with FTPS data transfers using TLSv1.3, when
    session tickets cannot be decrypted (Issue #1063).

  + Fixed "Corrupted MAC on inptut" errors when SFTP uses the
    umac-64@openssh.com digest (Issue #1111).

  + Fixed memory use-after-free issue in mod_sftp which can cause unexpected
    login/authentication issues.

  + Fixed speed regression for logins, directory listings when AuthUserFile
    is used.

  + ftpasswd now generates SHA256 password hashes by default, rather than MD5.

  * Set the `OPENSSL_API_COMPAT` API version compatibility macro.  We currently
    set our OpenSSL API version to 1.0.0 and later; code which uses an OpenSSL
    API earlier than 1.0.0 will cause the build to fail.  Use the new
    `--disable-openssl-api-compat` configure option to disable use of this
    macro.

  + Fixed SQL syntax regression for some generated SQL statements
    (Issue #1149).


  + Deprecated Directives

    MultilineRFC2228
      This directive has caused many issues unexpectedly, particularly for
      responses of the FEAT command, and is not necessary.


  + New Directives

    ListStyle
      This directive is used to emit Windows-style directory listings, for
      compatibility with certain FTP clients.  See
      doc/modules/mod_ls.html#ListStyle for more information.

    RedisLogFormatExtra
      This directive supports adding custom key/values to the JSON logging
      done by the RedisLogOnCommand, RedisLogOnEvent directives.  See
      doc/modules/mod_redis.html#RedisLogFormatExtra for details.


  + Changed Directives

    AuthFileOptions SyntaxCheck
      Syntax checks of configured AuthUserFile, AuthGroupFile can now be
      performed, at startup time, via this option.  See
      doc/modules/mod_auth_file.html#AuthFileOptions for more information.

    BanOnEvent MaxLoginAttemptsFromUser
      The mod_ban module now supports bans for a given user/IP address
      combination; see Issue #1170 for details.

    RedisSentinel
      Support for using TLS when connecting to Redis Sentinels has been
      implemented; see doc/modules/mod_redis.html#RedisSentinel for details.

    RedisServer
      Redis 6.x changed its AUTH command, due to the Redis ACL system, for
      supporting multiple users.  Thus the `RedisServer` directive now takes
      a username, as well as a password.  The Redis server version is auto-
      detected; the configured username will be ignored for Redis servers
      older than Redis 6.x.

      Support for using TLS when connecting to Redis servers has been
      implemented; see doc/modules/mod_redis.html#RedisServer for details.

    SFTPKeyExchanges

      "curve25519-sha256" has been added as an alias/synonym for
      "curve25519-sha256@libssh.org".

    TLSCipherSuite
      TLSv1.3 ciphersuites have different names, and are configured differently
      in OpenSSL.  To support configuration of TLSv1.3 ciphersuites, the
      `TLSCipherSuite` directive takes an optional protocol specifier; see
      the documentation for details.

    TLSOptions
      Support for the long-deprecated `NoCertRequest` TLSOption has been
      removed.

      AllowWeakSecurity TLSOption added, for cases where interacting with
      "insecure" (by system OpenSSL policy) clients is required; see
      doc/contrib/mod_tls.html#TLSOptions for more details.

    Wrap2Tables
      The mod_wrap2 module now supports including additional files for
      its allow/deny tables; see Issue #1133.


  + Developer Notes

    The new `pr_pool_debug_memory2` function uses a visitor pattern to walk
    the memory pools, and provides the pool data to the callback via
    structure, allowing the callback to format/use the memory pool information
    as needed, including emitting the data as JSON.

    The "make install" target now will _only_ try to install existing
    code/binaries, and will no longer attempt to recompile existing binaries.
    That is, this sequence will no longer work:

      $ ./configure
      $ make install

    Instead, the officially documented and supported sequence is now required:

      $ ./configure
      $ make
      $ make install

    This ensures that no unexpected recompilation occurs; see Issue #548.
