# changelog

author: mardnh@gmx.de
changelog:
  - update to version 1.6.0
  - if possible use /run instead of /var/run for the runtimedir
  - removed patch: bird-1.5.0-rip_auth_bufferoverflow.patch
    A similar issue still exists but it's a false positive.


author: mrueckert@suse.de
changelog:
  - update to 1.6.3
    - Large BGP communities
    - BFD authentication (MD5, SHA1)
    - SHA1 and SHA2 authentication for RIP and OSPF
    - Improved documentation
    - Several bug fixes
  - changes from version 1.6.2
    - Fixes serious bug introduced in the previous version
  - changes from version 1.6.1
    - Support for IPv6 ECMP
    - Better handling of IPv6 tentative addresses
    - Several updates and fixes in Babel protocol
    - Filter: New !~ operator
    - Filter: ASN ranges in bgpmask
    - KRT: New kernel protocol option 'metric'
    - KRT: New route attribute 'krt_scope'
    - Improved BIRD help messages
    - Fixes memory leak in BGP multipath
    - Fixes handling of empty path segments in BGP AS_PATH
    - Several bug fixes
  - drop bird-1.5.0-rip_auth_bufferoverflow.patch


author: mrueckert@suse.de
changelog:
  - added bird-1.6.3_verbose.build.patch:
    - no longer print false CC lines
    - print the actuall gcc calls instead
  - properly fix the FORTIFY_SOURCE fix from the earlier commit.
    - we just replace the -D_FORTIFY_SOURCE value with what we want
      instead of appending another value which leads to warnings


author: mrueckert@suse.de
changelog:
  - added potential fix for the bufferoverflow issue
    bufferoverflow.patch
    We will keep fortify_source 0 until the patch was discussed with
    upstream.


author: James Oakley <james.oakley@multapplied.net>
changelog:
  - Added support for RHEL
  - Update to 2.0.4:
    o OSPF: Opaque LSAs (RFC 5250)
    o OSPF: DN-bit handling (RFC 4576)
    o Preferred route counters are back
    o Important BGP bugfix
    o some minor bugfixes
  - Changes from 2.0.3:
    o MRT table dumps (RFC 6396)
    o BGP Long-lived graceful restart
    o BGP: Optional import table (Adj-RIB-In)
    o BGP: Extend 'next hop keep' and 'next hop self' options
    o BGP: Improved VRF support
    o OSPF: Authentication trailer for OSPFv3 (RFC 7166)
    o Babel: New option to randomize router ID
    o Filter: Custom route attributes
    o Filter: Support for src accessor to SADR source prefix
    o Filter: Support for VPN_RD sets
    o Filter: Make ifname attribute modifiable
    o Perf: Protocol to measure BIRD performance internally
    o More verbose error messages in config processing
    o Log file size limit / log rotation
    o Many bugfixes


author: mpluskal@suse.com
changelog:
  - Update to 1.23.2
    * for a full list of changes see http://www.busybox.net/news.html
  - Cleaned up spec file with spec-cleaner
  - Refreshed patches


author: p.drouand@gmail.com
changelog:
  - Update to version 1.24.1
    * for a full list of changes see http://www.busybox.net/news.html
  - Refresh busybox.install.patch


author: astieger@suse.com
changelog:
  - update to 1.25.1:
    * fixes for hush, gunzip, ip route, ntpd
  - includes changes from 1.25.0:
    * many added and expanded implementations of command options
  - includes changes from 1.24.2:
    * fixes for build system (static build with glibc fixed),
      truncate, gunzip and unzip.


author: jjolly@suse.com
changelog:
  - Enabled functionality within busybox for warewulf compatibility
    * CONFIG_FEATURE_REMOTE_LOG
    * CONFIG_DEPMOD
    * CONFIG_TAC


author: kukuk@suse.de
changelog:
  - update to 1.30.1
    * many bugfixes and new features
  - obsolete busybox-1.18.3-libarchive.patch
  - obsolete busybox-resource.patch
  - Update busybox*.config
  - Merge busybox.spec and busybox-static.spec and build the static
    binary as subpackage


author: kukuk@suse.de
changelog:
  - Implement rpm -E %_dbpath for kiwi (busybox-rpm-E.patch)
  - Don't require /bin/sh, be self contained


author: Björn Esser <besser82@fedoraproject.org> - 5.8.1-2
changelog:
  - Rebuilt for libcrypt.so.2 (#1666033)
  - Add upstream patch to remove upper limit of SENSORS_API_VERSION


author: Phil Sutter <psutter@redhat.com> - 2.0.10-32
changelog:
  - Add upstream changes since last release
  - Rename package to ebtables-legacy
  - Split systemd service into services sub-package
  - Rewrite systemd unit helper script for compatibility with ebtables-nft
  - Drop module unloading on service stop, this causes more harm than good
  - Remove save format settings, they are not effective anymore
  - Remove save on restart setting, restart is merely stop && start
  - Complete integration into alternatives
  - Remove needless ldconfig calls


author: Jon Schlueter <jschluet@redhat> - 1.51-10
changelog:
  - Rebaseline using github which is new home of fdupes
  - source tarball has unusual folder naming of fdupes-fdupes-1.51 instead of normal fdupes-1.51


author: Björn Esser <besser82@fedoraproject.org> - 1:1.6.1-1
changelog:
  - Updated to new upstream-release
  - Upstream changed versioning-scheme, Epoch is needed
  - Drop old patches, applied upstream
  - Update spec-file to recent guidelines
  - Drop el5-bits


author: jchaloup <jchaloup@redhat.com> - 1-11
changelog:
  - Reduce build section after update of go-srpm-macros
  - BUILD_ID for debug is needed only for golang compiler
    related: #1222796


author: jchaloup <jchaloup@redhat.com> - 1-12
changelog:
  - Change deps on compiler(go-compiler)
  - Update %build, %test and main section accordingaly
    related: #1222796


author: Felix Kaechele <heffer@fedoraproject.org> - 1.5.0-4
changelog:
  - Update to 1.3.0 release version
  - fix PID file path in service files
  - clean up spec file
  - switched to openssl-devel, now builds with openssl 1.1
  - install systemd units manually instead of patching the souce to do it
  - enable kea-shell
  - add boost patch
  - add kea-ctrl-agent unit
  - change postgresql-devel to postgresql-server-devel
  - update to 1.4.0


author: Phil Sutter <psutter@redhat.com> [1.1.1-1.el8]
changelog:
  - Rebase onto upstream version 1.1.1
  - Sync spec file with RHEL7
  - Disable JSON parsing, deprecated by upstream
  - Make use of builtin testsuite


author: Phil Sutter <psutter@redhat.com> [1.1.1-2.el8]
changelog:
  - chain: Hash chain list by name (Phil Sutter) [1658533]
  - chain: Add lookup functions for chain list and rules in chain (Phil Sutter) [1658533]
  - chain: Support per chain rules list (Phil Sutter) [1658533]
  - src: remove nftnl_rule_cmp() and nftnl_expr_cmp() (Phil Sutter) [1658533]


author: Phil Sutter <psutter@redhat.com> [1.1.1-3.el8]
changelog:
  - src: chain: Fix nftnl_chain_rule_insert_at() (Phil Sutter) [1666495]
  - src: chain: Add missing nftnl_chain_rule_del() (Phil Sutter) [1666495]
  - flowtable: Fix for reading garbage (Phil Sutter) [1661327]
  - flowtable: Fix memleak in nftnl_flowtable_parse_devs() (Phil Sutter) [1661327]
  - flowtable: Fix use after free in two spots (Phil Sutter) [1661327]
  - flowtable: Add missing break (Phil Sutter) [1661327]
  - object: Avoid obj_ops array overrun (Phil Sutter) [1661327]


author: Iryna Shcherbina <ishcherb@redhat.com> - 5.2.122-12
changelog:
  - Update Python 2 dependency declarations to new packaging standards
    (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)


author: David Sommerseth <dazo@eurephia.org> - 2.4.4-1
changelog:
  - Update to upstream openvpn-2.4.4
  - Includes fix for possible stack overflow if --key-method 1 is used {CVE-2017-12166}


author: David Sommerseth <dazo@eurephia.org> - 2.4.5-1
changelog:
  - Updating to upstream, openvpn-2.4.5
  - Package upstream ChangeLog, which contains a bit more details than Changes.rst
  - Cleaned up spec file further, removed Group: tag, trimmed changelog section,
    added gcc to BuildRequires.
  - Excluded not relevant file, README.mbedtls
  - Package upstream version of README.systemd
  - Fix wrong group owner of /etc/openvpn/{client,server} (rhbz#1526743)
  - Changed crypto self-test to test AES-{128,256}-{CBC,GCM} instead of only BF-CBC (deprecated)
  - Change /run/openvpn-{client,server} permissions to be 0750 instead of 0710, with group set to openvpn


author: David Sommerseth <dazo@eurephia.org> - 2.4.6-3
changelog:
  - Enable the asynchronous push feature, which can improve connect speeds with slow authentication backends


author: mardnh@gmx.de
changelog:
  - update to version 1.6.2
    + BGP, BMP daemons: introduced support for BGP Large Communities IETF
      draft (draft-ietf-idr-large-community). Large Communities are stored
      in a variable-length field. Thanks to Job Snijders ( @job ) for his
      support.
    + BGP daemon: implemented draft-ietf-idr-shutdown. The draft defines a
      mechanism to transmit a short freeform UTF-8 message as part of a
      Cease NOTIFICATION message to inform the peer why the BGP session is
      being shutdown or reset. Thanks to Job Snijders ( @job ) for his
      support.
    + tee plugin, pre_tag_map: introduced support for inspetion of specific
      flow primitives and selective replication over them. The primitives
      supported are: input and output interfaces, source and destination
      MAC addresses, VLAN ID. The feature is now limited to sFlow v5 only.
      Thanks to Nick Hilliard and Barry O'Donovan for their support.
    + Added src_host_pocode and dst_host_pocode primitives, pocode being a
      compact and (de-)aggregatable (easy to identify districts, cities,
      metro areas, etc.) geographical representation, based on the Maxmind
      v2 City Database. Thanks to Jerred Horsman for his support.
    + Kafka support: introduced support for user-defined (librdkafka) config
      file via the new *_kafka_config_file config directives. Full pathname
      to a file containing directives to configure librdkafka is expected.
      All knobs whose values are string, integer, boolean are supported.
    + AMQP, Kafka plugins: introduced new directives kafka_avro_schema_topic,
      amqp_avro_schema_routing_key to transmit Apache Avro schemas at regular
      time intervals. The routing key/topic can overlap with the one used to
      send actual data.
    + AMQP, Kafka plugins: introduced support for start/stop markers when
      encoding is set to Avro (ie. 'kafka_output: avro'); also Avro schema
      is now embedded in a JSON envelope when sending it via a topic/routing
      key (ie. kafka_avro_schema_topic).
    + print plugin: introduced new config directive avro_schema_output_file
      to save the Apache Avro schema in a separate file (it was only possible
      to have it combined at the beginning of the data file).
    + BGP daemon: introduced a new bgp_daemon_as config directive to set a
      LocalAS which could be different from the remote peer one. This is to
      establish an eBGP session instead of a iBGP one (default).
    + flow_to_rd_map: introduced support for mpls_vpn_id. In NetFlow/IPFIX
      this is compared against Field Types #234 and #235.
    + sfacctd: introduced support for sFlow v2/v4 counter samples (generic,
      ethernet, vlan). This is in addition to existing support for sFlow v5
      counters.
    + BGP, BMP and Streming Telemetry daemons: added writer_id field when
      writing to Kafka and/or RabbitMQ. The field reports the configured
      core_proc_name and the actual PID of the writer process (so, while
      being able to correlate writes to the same daemon, it's also possible
      to distinguish among overlapping writes).
    + amqp, kafka, print plugins: harmonized JSON output to the above: added
      event_type field, writer_id field with plugin name and PID.
    + BGP, BMP daemons: added AFI, SAFI information to log and dump outputs;
      also show VPN Label if SAFI is MPLS VPN.
    + pmbgpd, pmbmpd: added logics to bypass building RIBs if only logging
      BGP/BMP data real-time.
    + BMP daemon: added BMP peer TCP port to log and dump outputs (for NAT
      traversal scenarios). Contextually, multiple TCP sessions per IP are
      now supported for the same reason.
    + SQL plugins: ported (from print, etc. plugins) the 1.6.1 re-working of
      the max_writers feature.
    + uacctd: use current time when we don't have a timestamp from netlink.
      We only get a timestamp when there is a timestamp in the skb. Notably,
      locally generated packets don't get a timestamp. The patch is courtesy
      by Vincent Bernat ( @vincentbernat ).
    + build system: added configure options for partial linking of binaries
      with any selection/combination of IPv4/IPv6 accounting daemons, BGP
      daemon, BMP daemon and Streaming Telemetry daemon possible. By default
      all are compiled in.
    + BMP daemon: internal code changes to pass additional info from BMP
      per-peer header to bgp_parse_update_msg(). Goal is to expose further
      info, ie. pre- vs post- policy, when logging or dumping BMP info.
    ! fix, BGP daemon: introduced parsing of IPv6 MPLS VPN (vpnv6) NLRIs.
      Thanks to Alberto Santos ( @m4ccbr ) for reporting the issue.
    ! fix, BGP daemon: upon doing routes lookup, now correctly honouring
      the case of BGP-LU (SAFI_MPLS_LABEL).
    ! fix, BGP daemon: send BGP NOTIFICATION out in case of known failures
      in bgp_parse_msg().
    ! fix, kafka_partition, *_kafka_partition: default value changed from 0
      (partition zero) to -1 (RD_KAFKA_PARTITION_UA, partition unassigned).
      Thanks to Johan van den Dorpe ( @johanek ) for his support.
    ! fix, pre_tag_map: removed constraint for 'ip' keyword for nfacctd and
      sfacctd maps. While this is equivalent syntax to specifying rules with
      'ip=0.0.0.0/0', it allows for map indexing (maps_index: true).
    ! fix, bgp_agent_map: improved sanity check against bgp_ip for IPv6
      addresses (ie. an issue appeared for the case of '::1' where the first
      64 bits are zeroed out). Thanks to Charlie Smurthwaite ( @catphish )
      for reporting the issue.
    ! fix, maps_index: indexing now correctly works for IPv6 pre_tag_map
      entries. That is, those where 'ip', the IP address of the NetFlow/
      IPFIX/sFlow exporter, is an IPv6 address.
    ! fix, pre_tag_map: if mpls_vpn_rd matching condition is specified and
      maps_index is enabled, PT_map_index_fdata_mpls_vpn_rd_handler() now
      picks the right (and expected) info.
    ! fix, pkt_handlers.c: improved definition and condition to free() in
      bgp_ext_handler() in order to prevent SEGVs. Thanks to Paul Mabey for
      his support.
    ! fix, kafka_common.c: removed waiting time from p_kafka_set_topic().
      Added docs advicing to create in advance Kafka topics.
    ! fix, sfacctd, sfprobe: tag and tag2 are now correctly re-defined as
      64 bits long.
    ! fix, sfprobe plugin, sfacctd: tags and class primitives are now being
      encoded/decoded using enterprise #43874, legit, instead of #8800, that
      was squatted back in the times. See issue #71 on GiHub for more info.
    ! fix, sfacctd: lengthCheck() + skipBytes() were producing an incorrect
      jump in case of unknown flow samples. Replaced by skipBytesAndCheck().
      Thanks to Elisa Jasinska ( @fooelisa ) for her support.
    ! fix, pretag_handlers.c: in bgp_agent_map added case for 'vlan and ...'
      filter values.
    ! fix, BGP daemon: multiple issues of partial visibility of the stored
      RIBs and SEGVs when bgp_table_per_peer_buckets was not left default:
      don't mess with bms->table_per_peer_buckets given the multi-threaded
      scenario. Thanks to Dan Berger ( @dfberger ) for his support.
    ! fix, BGP, BMP daemons: bgp_process_withdraw() function init aligned to
      bgp_process_update() in order to prevent SEGVs. Thanks to Yuri Lachin
      for his support.
    ! fix, bgp_msg.c: Route Distinguisher was stored and printed incorrectly
      when of type RD_TYPE_IP. Thanks to Alberto Santos ( @m4ccbr ) for
      reporting the issue.
    ! fix, bgp_logdump.c: p_kafka_set_topic() was being wrongly applied to
      an amqp_host structure (instead of a kafka_host structure). Thanks to
      Corentin Neau ( @weyfonk ) for reporting the issue.
    ! fix, BGP daemon: improved BGP next-hop setting and comparison in cases
      of MP_REACH_NLRI and MPLS VPNs. Many thanks to both Catalin Petrescu
      ( @cpmarvin ) and Alberto Santos ( @m4ccbr ) for their support.
    ! fix, pmbgpd, pmbmpd: pidfile was not written even if configured. Thanks
      to Aaron Glenn ( @aaglenn ) for reporting the issue.
    ! fix, tee plugin: tee_max_receiver_pools is now correctly honoured and
      debug message shows the replicatd protocol, ie. NetFlow/IPFIX vs sFlow.
    ! AMQP, Kafka plugins: separate JSON objects, newline separated, are
      preferred to JSON arrays when buffering of output is enabled (ie.
      kafka_multi_values) and output is set to JSON. This is due to quicker
      serialisation performance shown by the Jansson library.
    ! build system: switched to enable IPv6 support by default (while the
    - -disable-ipv6 knob can be used to reverse the behaviour). Patch is
      courtesy by Elisa Jasinska ( @fooelisa ).
    ! build system: given visibility, ie. via -V CL option, into compile
      options enabled by default (ie. IPv6, threads, 64bit counters, etc.).
    ! fix, nfprobe: free expired records when exporting to an unavailable
      collector in order to prevent a memory leak. Patch is courtersy by
      Vladimir Kunschikov ( @kunschikov ).
    ! fix, AMQP plugin: set content type to binary in case of Apache Avro
      output.
    ! fix, AMQP, Kafka plugins: optimized amqp_avro_schema_routing_key and
      kafka_avro_schema_topic. Avro schema is built only once at startup.
    ! fix, cfg.c: improved parsing of config key-values where squared brakets
      appear in the value part. Thanks to Brad Hein ( @regulatre ) for
      reporting the issue. Also, detection of duplicates among plugin and
      core process names was improved.
    ! fix, misc: compiler warnings: fix up missing includes and prototypes;
      the patch is courtesy by Tim LaBerge ( @tlaberge ).
    ! kafka_consumer.py, amqp_receiver.py: Kafka, RabbitMQ consumer example
      scripts have been greatly expanded to support posting to a REST API or
      to a new Kafka topic, including some stats. Also conversion of multiple
      newline-separated JSON objects to a JSON array has been added. Misc
      bugs were fixed.
  - remove patcch: pmacct-fix-implicit-pointer-decl.diff


author: mardnh@gmx.de
changelog:
  - update to version 1.7.0
    + ZeroMQ integration: by defining plugin_pipe_zmq to 'true', ZeroMQ is
      used for queueing between the Core Process and plugins. This is in
      alternative to the home-grown circular queue implementation (ie.
      plugin_pipe_size). plugin_pipe_zmq_profile can be set to one value
      of { micro, small, medium, large, xlarge } and allows to select
      among a few standard buffering profiles without having to fiddle
      with plugin_buffer_size. How to compile, install and operate ZeroMQ
      is documented in the "Internal buffering and queueing" section of
      the QUICKSTART document.
    + nDPI integration: enables packet classification, replacing existing
      L7-layer project integration, and is available for pmacctd and
      uacctd. The feature, once nDPI is compiled in, is simply enabled by
      specifying 'class' as part of the aggregation method. How to compile
      install and operate nDPI is documented in the "Quickstart guide to
      packet classification" section of the QUICKSTART document.
    + nfacctd: introduced nfacctd_templates_file so that NetFlow v9/IPFIX
      templates can be cached to disk to limit the amount of lost packets
      due to unknown templates when nfacctd (re)starts. The implementation
      is courtesy by Codethink Ltd.
    + nfacctd: introduced support for PEN on IPFIX option templates. This
      is in addition to already supported PEN for data templates. Thanks
      to Gilad Zamoshinski ( @zamog ) for his support.
    + sfacctd: introduced new aggregation primitives (tunnel_src_host,
      tunnel_dst_host, tunnel_proto, tunnel_tos) to support inner L3
      layers. Thanks to Kaname Nishizuka ( @__kaname__ ) for his support.
    + nfacctd, sfacctd: pcap_savefile and pcap_savefile_wait were ported
      from pmacctd. They allow to process NetFlow/IPFIX and sFlow data
      from previously captured packets; these also ease some debugging by
      not having to resort anymore to tcpreplay for most cases.
    + pmacctd, sfacctd: nfacctd_time_new feature has been ported so, when
      historical accounting is enabled, to allow to choose among capture
      time and time of receipt at the collector for time-binning.
    + nfacctd: added support for NetFlow v9/IPFIX field types #130/#131,
      respectively the IPv4/IPv6 address of the element exporter.
    + nfacctd: introduced nfacctd_disable_opt_scope_check: mainly a work
      around to implementations not encoding NetFlow v9/IPIFX option scope
      correctly, this knob allows to disable option scope checking. Thanks
      to Gilad Zamoshinski ( @zamog ) for his support.
    + pre_tag_map: added 'source_id' key for tagging on NetFlow v9/IPFIX
      source_id field. Added also 'fwdstatus' for tagging on NetFlow v9/
      IPFIX information element #89: this implementation is courtesy by
      Emil Palm ( @mrevilme ).
    + tee plugin: tagging is now possible on NetFlow v5-v8 engine_type/
      engine_id, NetFlow v9/IPFIX source_id and sFlow AgentId.
    + tee plugin: added support for 'src_port' in tee_receivers map. When
      in non-transparent replication mode, use the specified UDP port to
      send data to receiver(s). This is in addition to tee_source_ip,
      which allows to set a configured IP address as source.
    + networks_no_mask_if_zero: a new knob so that IP prefixes with zero
      mask - that is, unknown ones or those hitting a default route - are
      not masked. The feature applies to *_net aggregation primitives and
      makes sure individual IP addresses belonging to unknown IP prefixes
      are not zeroed out.
    + networks_file: hooked up networks_file_no_lpm feature to peer and
      origin ASNs and (BGP) next-hop fields.
    + pmacctd: added support for calling pcap_set_protocol() if supported
      by libpcap. Patch is courtesy by Lennert Buytenhek ( @buytenh ).
    + pmbgpd, pmbmpd, pmtelemetryd: added a few CL options to ease output
      of BGP, BMP and Streaming Telemetry data, for example: -o supplies
      a b[gm]p_daemon_msglog_file, -O supplies a b[gm]p_dump_file and -i
      supplies b[gm]p_dump_refresh_time.
    + kafka plugin: in the examples section, added a Kafka consumer script
      using the performing confluent-kafka-python module.
    ! fix, BGP daemon: segfault with add-path enabled peers as per issue
      [#128]. Patch is courtesy by Markus Weber ( @FvDxxx ).
    ! fix, print plugin: do not update link to latest file if cause of
      purging is a safe action (ie. cache space is finished. Thanks to
      Camilo Cardona ( @jccardonar ) for reporting the issue. Also, for
      the same reason, do not execute triggers (ie. print_trigger_exec).
    ! fix, nfacctd: improved IP protocol check in NF_evaluate_flow_type()
      A missing length check was causing, under certain conditions, some
      flows to be marked as IPv6. Many thanks to Yann Belin for his
      support resolving the issue.
    ! fix, print and SQL plugins: optimized the cases when the dynamic
      filename/table has to be re-evaluated. This results in purge speed
      gains when the dynamic part is time-related and nfacctd_time_new is
      set to true.
    ! fix, bgp_daemon_md5_file: if the server socket is AF_INET and the
      compared peer address in MD5 file is AF_INET6 (v4-mapped v6), pass
      it through ipv4_mapped_to_ipv4(). Also if the server socket is
      AF_INET6 and the compared peer addess in MD5 file is AF_INET, pass
      it through ipv4_to_ipv4_mapped(). Thanks to Paul Mabey for reporting
      the issue.
    ! fix, nfacctd: improved length checks in resolve_vlen_template() to
      prevent SEGVs. Thanks to Josh Suhr and Levi Mason for their support.
    ! fix, nfacctd: flow stitching, improved flow end time checks. Thanks
      to Fabio Bindi ( @FabioLiv ) for his support resolving the issue.
    ! fix, amqp_common.c: amqp_persistent_msg now declares the RabbitMQ
      exchange as durable in addition to marking messages as persistent;
      this is related to issue #148.
    ! fix, nfacctd: added flowset count check to existing length checks
      for NetFlow v9/IPFIX datagrams. This is to avoid logs flooding in
      case of padding. Thanks to Steffen Plotner for reporting the issue.
    ! fix, BGP daemon: when dumping BGP data at regular time intervals,
      dump_close message contained wrongly formatted timestamp. Thanks to
      Yuri Lachin for reporting the issue.
    ! fix, MySQL plugin: if --enable-ipv6 and sql_num_hosts set to true,
      use INET6_ATON for both v4 and v6 addresses. Thanks to Guy Lowe
      ( @gunkaaa ) for reporting the issue and his support resolving it.
    ! fix, 'flows' primitive: it has been wired to sFlow so to count Flow
      Samples received. This is to support Q21 in FAQS document.
    ! fix, BGP daemon: Extended Communities value was printed with %d
      (signed) format string instead of %u (unsigned), causing issue on
      large values.
    ! fix, aggregate_primitives: improved support of 'u_int' semantics for
      8 bytes integers. This is in addition to already supported 1, 2 and
      4 bytes integers.
    ! fix, pidfile: pidfile created by plugin processes was not removed.
      Thanks to Yuri Lachin for reporting the issue.
    ! fix, print plugin: checking non-null file descriptor before setvbuf
      in order to prevent SEGV. Similar checks were added to prevent nulls
      be input to libavro calls when Apache Avro output is selected.
    ! fix, SQL plugins: MPLS aggregation primitives were not correctly
      activated in case sql_optimize_clauses was set to false.
    ! fix, building system: reviewed minimum requirement for libraries,
      removed unused m4 macros, split features in plugins (ie. MySQL) and
      supports (ie. JSON).
    ! fix, sql_history: it now correctly honors periods expressed is 's'
      seconds.
    ! fix, BGP daemon: rewritten bgp_peer_print() to be thread safe.
    ! fix, pretag.h: addressed compiler warning on 32-bit architectures,
      integer constant is too large for "long" type. Thanks to Stephen
      Clark ( @sclark46 ) for reporting the issue.
    - MongoDB plugin: it is being discontinued since the old Mongo API is
      not supported anymore and there has never been enough push from the
      community to transition to the new/current API (which would require
      a rewrite of most of the plugin). In this phase-1 the existing
      MongoDB plugin is still available using 'plugins: mongodb_legacy'
      in the configuration.
    - Packet classification basing on the L7-filter project is being
      discontinued (ie. 'classifiers' directive). This is being replaced
      by an implementation basing on the nDPI project. As part of this
      also the sql_aggressive_classification knob has been discontinued.
    - tee_receiver was part of the original implementation of the tee
      plugin, allowing to forward to a single target and hence requiring
      multiple plugins instantiated, one per target. Since 0.14.3 this
      directive was effectively outdated by tee_receivers.
    - tmp_net_own_field: the knob has been discontinued and was allowing
      to revert to backward compatible behaviour of IP prefixes (ie.
      src_net) being written in the same field as IP addresses (ie.
      src_host).
    - tmp_comms_same_field: the knob has been discontinued and was
      allowing to revert to backward compatible behaviour of BGP
      communities (standard and extended) being writeen all in the same
      field.
    - plugin_pipe_amqp and plugin_pipe_kafka features were meant as an
      alternative to the homegrown queue solution for internal messaging,
      ie. passing data from the Core Process to Plugins, and are being
      discontinued. They are being replaced by a new implementation,
      plugin_pipe_zmq, basing on ZeroMQ.
    - plugin_pipe_backlog was allowing to keep an artificial backlog of
      data in the Core Process so to maximise bypass poll() syscalls in
      plugins. If home-grown queueing is found limiting, instead of
      falling back to such strategies, ZeroMQ queueing should be used.
    - pmacctd: deprecated support for legacy link layers: FDDI, Token Ring
      and HDLC.


author: mardnh@gmx.de
changelog:
  - update to version 1.7.1
    + pmbgpd: introduced a BGP connect feature meant to map BGP peers
      (ie. PE routers) to BGP collectors (ie. nfacctd, sfacctd) via a
      standalone BGP daemon (pmbgpd). The aim is to facilitate operations
      when re-sizing/re-balancing the collection infrastructure without
      impacting (ie. re-configuring) BGP peers. bgp_daemon_xconnect_map
      expects full pathname to a file where cross-connects are defined;
      mapping works only against the IP source address and not the BGP
      Router ID, only 1:1 relationships can be formed (ie. this is about
      cross-connecting, not replication) and only one session per BGP
      peer is supported (ie. multiple BGP agents are running on the same
      IP address or NAT traversal scenarios are not supported [yet]).
      A sample map is provided in 'examples/bgp_xconnects.map.example'.
    + pmbgpd: introduced a BGP Looking Glass server allowing to perform
      queries, ie. lookup of IP addresses/prefixes or get the list of BGP
      peers, against available BGP RIBs. The server is asyncronous and
      uses ZeroMQ as transport layer to serve incoming queries. Sample
      C/Python LG clients are available in 'examples/lg'. A sample LG
      server config is available in QUICKSTART. Request/Reply Looking
      Glass formats are documented in 'docs/LOOKING_GLASS_FORMAT'.
    + pmacctd: a single daemon can now listen for traffic on multiple
      interfaces via a polling mechanism. This can be configured via a
      pcap_interfaces_map feature (interface/pcap_interface can still be
      used for backward compatiblity to listen on a single interface). The
      map allows to define also ifindex mapping and capturing direction on
      a per-interface basis. The map can be reloaded at runtime via a USR2
      signal and a sample map is in examples/pcap_interfaces.map.example.
    + Kafka plugin: dynamic partitioning via kafka_partition_dynamic and
      kafka_partition_key knobs is introduced. The Kafka topic can contain
      variables, ie. $peer_src_ip, $src_host, $dst_port, $tag, etc., which
      are all computed when data is purged to the backend. This feature is
      in addition to the existing kafka_partition feature which allows to
      rely on the built-in Kafka partitioning to assign data statically to
      one partition or rely dynamically on the default partitioner. The
      feature is courtesy by Corentin Neau / Codethink ( @weyfonk ).
    + Introduced rfc3339 formatted timestamps: in logs, ie. UTC timezone
      represented as yyyy-MM-ddTHH:mm:ss(.ss)Z; for aggregation primitives
      the timestamps_rfc3339 knob can be used to enable this feature (left
      disabled by default for backward compatibility).
    + timestamps_utc: new knob to decode timestamps to UTC timezone even
      if the Operating System is set to a different timezone. On the goods
      of running a system set to UTC please read Q18 of FAQS.
    + sfacctd: implemented mpls_label_top, mpls_label_bottom and
      mpls_stack_depth primitives decoded from sFlow flow sample headers.
      Thanks to David Barroso ( @dbarrosop ) for his support.
    + nfacctd: added support for IEs 130 (exporterIPv4Address) and 131
      (exporterIPv6Address) when passed as part of NetFlow v9/IPFIX
      option packets (these IEs were already supported when passed in flow
      data). Also added support for IE 351 (dataLinkFrameSection) which
      carries the initial portion of a sampled raw packet headers (a-la
      sFlow). This was tested working against a Cisco NCS 5k platform.
    + nfprobe plugin: added a new nfprobe_dont_cache knob allowing to
      disable caching and summarisation of flows (essentially letting the
      NetFlow/IPFIX probe behave like a sFlow probe).
    + nfprobe plugin: added support for MPLS_LABEL_1, NetFlow v9/IPFIX IE
      70; improved support for BGP next-hop IE 18 and 63. Also support for
      IE 130/131 vi NetFlow v9/IPFIX Options was added.
    + sfprobe plugin: added sfprobe_source_ip knob to define the local IP
      address from which sFlow datagrams are exported; improved support
      for BGP next-hop.
    + nfacctd, sfacctd, BGP, BMP, Streaming Telemetry daemons: on Linux,
      if supported, use SO_REUSEPORT for the listening socket (added to
      existing SO_REUSEADDR option).
    + nfacctd, sfacctd: introduced new 'export_proto_sysid' primitive to
      give visibility to NetFlow v5/v8 engine_id / NetFlow v9 source ID /
      IPFIX Obs Domain ID / sFlow agentSubID.
    + nfacctd, sfacctd: extended nDPI support to NetFlow v9/IPFIX packets
      with IE 315 (dataLinkFrameSection) and sFlow v5 packets with header
      section.
    + nfacctd, sfacctd: extended custom primitives definition framework,
      aggregate_primitives, to NetFlow v9/IPFIX packets with IE 315
      (dataLinkFrameSection) and sFlow v5 sampled headers section.
    + nfacctd, sfacctd: added per-collector packets and bytes counts to
      stats emitted via SIGUSR1. Also the output was made more formal (so
      to be more easily parsed) and is documented in the UPGRADE notes.
    + nfacctd, pmacctd, sfacctd: pcap_savefile_delay feature introduced
      to sleep for the supplied amount of seconds before playing a given
      pcap_savefile. Useful, for example, to let BGP/BMP sessions come up
      so that routing data is available for correlation when processing
      data in the trace.
    + Kafka plugin: configuring statistics.interval.ms to a positive value
      in a kafka_config_file makes now librdkafka log plenty of internal
      metrics.
    + BGP daemon: added support for Extended BGP Administrative Shutdown
      Communication (draft-snijders-idr-rfc8203bis-00).
    + BMP daemon: added support for draft-ietf-grow-bmp-adj-rib-out-01 and
      draft-ietf-grow-bmp-loc-rib-01. As a result of that, Route Monitor
      log messages now contain indication of is_out and is_filtered.
    + BMP daemon: added support for stats reports 9, 10, 11, 12 and 13 and
      descriptions for the different Peer Types and and Peer Down reasons.
      Finally, indication of is_post is now making to Route Monitor log
      messages.
    + plugin_pipe_zmq: introduced plugin_pipe_zmq_hwm (high water mark)
      knob to control the maximum amount of messages than can be stored in
      the ZeroMQ queue.
    + [ns]facctd_allow_file: the map is now made reloadable at runtime via
      SIGUSR2 and accepts IPv4/IPv6 prefixes increasing its scale (before
      it was only accepting individual IP addresses).
    + pmacctd: added support for IPv6, MPLS for DLT_LINUX_SLL captures.
      Thanks to David Barroso ( @dbarrosop ) for his support.
    + uacctd: added a global 'direction' knob to give visibility of data
      capturing direction, ie. in/out. Useful for pre_tag_map use.
    + MySQL plugin: added sql_port knob in order to specify non-default
      ports for connecting to the database. Patch is courtesy by Vadim
      Tkachenko ( @vadimtk ).
    ! fix, plugins: getppid() parent process health check improved so
      to work in Docker environments not assuming anymore parent PID is
      1. Patch is courtesy by Hidde van der Heide ( @hvanderheide ).
    ! fix, plugins: imposing a budget for received messages (100) so to
      preserve fairness of other operations (ie. time keeping, bucketing,
      reloading maps, etc.) and prevent starvations.
    ! fix, zmq_common.c: retry if zmq_getsockopt() for ZMQ_EVENTS returns
      EINTR. Thanks to Wouter de Jong for his support solving the issue.
    ! fix, plugins: when executing triggers, the first argument passed to
      execv() should be the path to the invoked executable to prevent
      execv(3) to fail and return EFAULT on OpenBSD. Patch is courtesy
      by @higgsd.
    ! fix, BGP daemon: improved support of multiple capabilities per
      optional parameter in the OPEN message. Also add-path capability is
      now advertised if neighbor supports send/receive (previously it was
      sent back on send only) of such capability. Thanks to Radu Anghel
      ( @cozonac ) for his support.
    ! fix, BGP daemon: upon route lookup, don't perform ADD-PATH logics if
      no PATH-ID (even if ADD-PATH capability is announced by the peer).
      Thanks to Camilo Cardona ( @jccardonar ) for his support solving the
      issue.
    ! fix, BGP daemon: wrong type 2 32-bit ASN Route Distinguisher was
      defined in network.h. Thanks to Thomas Graf for reporting the issue.
    ! fix, BGP, BMP daemons: lookup of BGP-LU entries is now performed
      against the correct RIB.
    ! fix, BMP daemon: the BMP thread is now made mutually exclusive with
      the BGP one (until an use-case needs to run them both). This is to
      potentially prevent BGP and BMP information to interfere with each
      other when correlated. Also the 'bmp' keyword was added for *_as and
    * _net config directives (ie. nfacctd_as, nfacctd_net). Thanks to
      Juan Camilo Cardona ( @jccardonar ) for his support.
    ! fix, BMP daemon: improved correlation of BMP data with traffic data
      by supporting a replication use-case (the BMP exporter is a route
    - server rather than an actual Edge Router) upon lookup. Thanks to
      Juan Camilo Cardona ( @jccardonar ) for his support.
    ! fix, BMP daemon: in bgp_peer_cmp() and bgp_peer_host_addr_cmp() the
      comparison function has been changed from generic memcmp() to a more
      specific host_addr_cmp() as paddings were giving issues. Thanks to
      Juan Camilo Cardona ( @jccardonar ) for reporting the issue.
    ! fix, BMP daemon: a pm_tdestroy call in bmp_peer_close() was leading
      to SEGV under certain conditions by not NULL'ing all pointers. Thanks
      to Juan Camilo Cardona ( @jccardonar ) for reporting the issue.
    ! fix, nfacctd: prevent time calculations to underflow in cases in
      which sysUptime < first or last flow switched timestamps in NetFlow
      v5. Patch is courtesy by David Steinn Geirsson ( @dsgwork ).
    ! fix, nfacctd: in the context of aggregate_primitives, now enforcing
      terminating the zero when decoding variable-length IEs when applying
      string semantics.
    ! fix, nfprobe: changed ifIndex fields from u_int16_t to u_int32_t in
      order to prevent overflows and aligning to the rest of structs.
    ! fix, MySQL plugin: minor code revisions to restore compiling against
      MariaDB 10.2.
    ! fix, sql_common.c: increased read_SQLquery_from_file() buffer size
      so that sql_table_schema can be fed with longer CREATE TABLE
      statements.
    ! fix, print, SQL plugins: post_tag, post_tag2 support was added to
      sql_table and print_output_file. Also for Kafka, RabbitMQ plugins
      kafka_topic and amqp_routing_key variables support was harmonized
      with print and SQL plugins (ie. $pre_tag renamed to $tag), see
      UPGRADE notes.
    ! fix, SQL plugins: sql_startup_delay was not being honored when
      sql_trigger_exec was defined without a sql_trigger_time resulting
      in empty environment variables being passed to the triggered script.
      Thanks to Johannes Maybaum for his support resolving the issue.
    ! fix, pkt_handlers.c: tmp_asa_bi_flow value was ignored when applied
      to a specific plugin.
    ! fix, util.c: when data timestamp is not available, dynamic file and
      table names variables were populated with a 1-Jan-1970 date. Now the
      current timestamp is used instead as last resort. Patch is courtesy
      by Ivan F. Martinez ( @ivanfmartinez ).
    ! fix, addr.c: host_addr_mask_sa_cmp() and str_to_addr_mask() network
      mask computation for IPv6 addresses was wrong. allow_file feature
      was affected.
    ! fix, build system: several patches committed to the build system to
      simplify libraries probing, make sure to bail out upon error. Also
      now a minimum required version is imposed to almost all libraries.
    - --enable-threads / --disable-threads: removed the configure switch
      that was allowing to compile pmacct even when no pthreads library was
      available on a system. From now on support for threads is mandatory.
    - BGP daemon: offline code, ie. bgp_daemon_offline_* config directives,
      has been deprecated in favor of other approaches, ie. BGP Looking
      Glass and BGP Xconnects.
    - pkt_len_distrib: the primitive, which was meant to bucket packet /
      flow / sample lengths in a distribution has been obsoleted.
  - Remove patch:
    * pmacct-pgsql-fix-header-detection-without-autoreconf.diff


author: mardnh@gmx.de
changelog:
  - Drop support for older distributions
  - Update to version 1.7.2
    + nfacctd, sfacctd: added Kafka broker among the options to receive
      NetFlow/IPFIX, sFlow data from. Host, port and topic should all be
      specified along with an optional config file to pass to librdkafka.
    + nfacctd, sfacctd, pmtelemetryd: added ZeroMQ queue among the options
      to receive NetFlow/IPFIX, sFlow or Streaming Telemetry data from. An
      IP address and port should be specified.
    + nfacctd, sfacctd: added sampling_direction to the set of supported
      primitives, valid values being ingress, egress and unknown.
    + nfacctd, sfacctd: stats, ie. amount of NetFlow/IPFIX or sFlow packets
      received per router, are now available when in tee mode. Stats can be
      retrieved via a SIGUSR1 UNIX signal.
    + pcap_savefile_replay: a feature to replay content for the specified
      amounf of time when reading from a pcap_savefile.
    + pre_tag_map: added several new keys: src_net and dst_net (to tag on
      source and destination IP prefixes respectively), bgp_nexthop (to
      tag on BGP nexthop) and nat_event.
    + BGP daemon: added bgp_lrgcomm_pattern feature to filter large BGP
      communities (in addition to existing equivalent knobs to filter on
      standard and extended communities).
    + BMP, Streaming Telemetry daemons: msglog_file and dump_file config
      directives now offer $bmp_router, $bmp_router_port, $telemetry_node
      and $telemetry_node_port variables.
    + BGP, BMP, Streaming Telemetry daemons: added BGP, BMP and Streaming
      Telemetry exporter TCP/UDP port as variable for dump/log filenames
      (to better support NAT traversal scenarios).
    + BGP, BMP daemons: added message sequencing to both BGP and BMP dumps
      (bgp_table_dump_*, bmp_dump_*). If dumping and logging are enabled
      in parallel then sequencing the dumps allows for check pointing at
      regular time intervals.
    + BMP daemon: implemented draft-hsmit-bmp-extensible-routemon-msgs for
      a tlv-based encoding of route-monitoring messages with a new message
      type.
    + Streaming Telemetry daemon: added sample decoders for gRPC / GPB for
      Cisco and Huawei platforms, written in Python. Telemetry data is
      decoded using vendor-supplied proto files and output in JSON format
      in a ZeroMQ queue - suitable for ingestion in pmtelemetryd. Docs and
      sample code is available in the telemetry/ directory. This is all in
      addition to TCP/UDP transports and JSON encoding supported natively
      in pmtelemetryd.
    + kafka plugin: introduced support for Confluent Schema Registry via
      libserdes. A registry can be supplied via kafka_avro_schema_registry
      config directive; the schema is generated automatically. The feature
      enables validation of data passed through a Kafka broker and uses
      Avro encoding.
    + kafka plugin: added $in_iface key (input interface) to the set of
      variables supported by kafka_partition_key. Extremely useful when
      coupled to $peer_src_ip in some scenarios.
    + print, IMT plugins: separator for CSV format can now be space (\s)
      or tab (\t).
    + tee plugin: added Kafka broker among the emitters. kafka_broker and
      kafka_topic knobs are now available in the tee_receivers map and a
      tee_kafka_config_file directive allows to define a file with config
      to pass to librdkafka.
    + tee plugin: added ZeroMQ queue among the emitters. zmq_address knob
      defines the queue IP address and port to emit to.
    + tee plugin: introducing support for complex pre_tag_map when doing
      replication of NetFlow/IPFIX (sFlow replication had already this).
      With this feature flows are individually evaluated against supplied
      filters (input interface, BGP next-hop, etc.) and (not) replicated
      accordingly.
    + GeoIP v2: added support for latitude and longitude primitives via
      src_host_coords and dst_host_coords knobs. This is in addition to
      existing country and pocode supports.
    + files_uid, files_gid: now also user and group strings are accepted.
      This is in addition to user and group IDs.
    ! fix, nfacctd: NF_evaluate_flow_type() improved to not detect Cisco
      ASA flows (ie. those including initiator and responder octets) as
      events. Also improved sanity checking of received NetFlow v9/IPFIX
      data and options templates and reviwed modulo functions and improved
      template hashing.
    ! fix, BGP, BMP, Streaming Telemetry daemons: improved log sequencing
      by handling counter wrap-up more gracefully. Also a log sequencing
      API was developed to improve code re-use.
    ! fix, BGP daemon: added check for duplicate Router-IDs at BGP OPEN
      parsing time. If a duplicate is detected, the session BGP OPENing of
      the new session is dropped.
    ! fix, BGP daemon: ADD-PATH capability was checked only in the first
      AFI/SAFI and was being set in the reply for last AFI/SAFI RECEIVE(1)
      if first included SEND(2) or SEND-RECEIVE(3). Thanks to Markus Weber
      ( @FvDxxx ) for his patch.
    ! fix, BGP daemon: upon route lookup, don't perform ADD-PATH logics if
      no PATH-ID (even if ADD-PATH capability is announced by the peer).
      Thanks to Camilo Cardona ( @jccardonar ) for his support solving the
      issue.
    ! fix, BGP daemon: graceful handling of invalid AS-PATH segment types
      (ie. AS-PATH in BGP UPDATE inconsistent with capabilities passed in
      BGP OPEN) in order to avoid SEGVs.
    ! fix, pmtelemetryd: improved support for UDP timeouts. Also reviewed
      natively supported encodings: removed zjson and GPB was moved to pre-
      processors (with samples available in telemetry/decoders directory).
    ! fix, pmtelemetryd: no dump_init / dump_close events sequencing since
      all messages are sequenced anyway (consistency with other daemons).
    ! fix, kafka_common.c: now destroying both config and topic config as
      part of p_kafka_close() in order to avoid memory leaks. Also, port is
      omitted from broker string if not passed to p_kafka_set_broker(). And
      finally output queue length checks in p_kafka_check_outq_len() have
      been relaxed (to counter temporary hickups that need more patience).
    ! fix, kafka plugin: kafka_partition default was zero (that is, a valid
      partition number) instead of -1 (RD_KAFKA_PARTITION_UA or unassigned)
      which allows librdkafka to attach a partitioner.
    ! fix, SQL plugins: sql_table_schema is honoured even if sql_table_name
      is non-dynamic. This is to cover cases where the table is rotated
      externally.
    ! fix, mysql plugin: my_bool replaced with bool. The plugin now does
      compile against MySQL 8.0. Also added inclusion of stdbool.h as on
      some systems bool is not defined. Improved overall probing for MySQL
      headers.
    ! fix, pgsql plugin: sql_recovery_backup_host was not being honoured.
      PG_create_backend() now composes a proper conn_string.
    ! fix, print plugin: increase successful queries number, QN, only if
      the output file was successfully opened.
    ! fix, zmq_common.c: moved ZAP socket initialization inside the ZAP
      handler. See: https://github.com/zeromq/libzmq/issues/3313 .
    ! fix, util.c: length checks in handle_dynname_internal_strings() were
      reviewed. Existings were not working in absence of starting/trailing
      non-variable strings.
    ! fix, util.c: use lockf() instead of more problematic flock(). Thanks
      to Yuri Lachin ( @yuyutime ) and Miki Takata ( @mikiT ) for their
      support.
    ! fix, util.c: in compose_timestamp() pad usecs and use "%ld" since
      time fields are signed longs. Thanks to @raymondrussell for the
      patch.
    ! fix, ndpi_util.c: a protocol bitmask is now set in order to increase
      match rate. Patch is courtesy by @rsolsn.
    ! fix, compile time warnings: several warnings were addressed including
      but not restricted to -Wreturn-time, -Wunused-variable, implicit func
      declarations, -Wformat-extra-args, -Wunused-label, -Wunused-value,
    - Wunused-function, sbrk calls, -Wpointer-to-int-cast, -Wparentheses
      and -Wint-to-pointer-cast.
    ! fix, dangerous uninitialized values: net_aggr.c, pmacct.c: in merge()
      argument with non-NULL attribute could be passed NULL; bmp_msg.c: in
      bmp_process_msg_route_monitor() bdata.tstamp could be uninitialized;
      sfprobe_plugin.c: calloc() return value (possibly null) was not being
      checked; sflow_agent.c: uninitialized ret value in sfl_agent_init()
      could lead to undefined bind() error behaviour.
    ! fix, thread_pool.c: reviewed logics in deallocate_thread_pool() and
      solved a minor memory leak in allocate_thread_pool().
    - pmacctd: removed support for FDDI
    - nfacctd: discontinued support for NetFlow v1, v7 and v8 collection
      and replication.
    - pre_tag_map: matching on 'sampling_rate' is not supported anymore as
      a sampling_rate primitive is now available; the 'return' feature to
      return matched data before completing the map workflow has started
      being obsoleted (retired from docs but still available).
    - plugin_pipe_check_core_pid: deprecating feature given RabbitMQ and
      Kafka are not supported anymore for internal message delivery.
    - tee plugin: obsoleted tee_dissect_send_full_pkt knob, entire packets
      are now replicated only if no pre_tag_map or a simple pre_tag_map is
      defined.
    - nfprobe plugin: removed support for NetFlow v1 export.


author: Martin Hauke <mardnh@gmx.de>
changelog:
  - Update to version 1.7.3
    + Introduced the RPKI daemon to build a ROA database and check prefixes
      validation status and coverages. Resource Public Key Infrastructure
      (RPKI) is a specialized public key infrastructure (PKI) framework
      designed to secure the Internet routing. RPKI uses certificates to
      allow Local Internet Registries (LIRs) to list the Internet number
      resources they hold. These attestations are called Route Origination
      Authorizations (ROAs). ROA information can be acquired in one of the
      two following ways: 1) importing it using the rpki_roas_file config
      directive from a file in the RIPE Validator format or 2) connecting
      to a RPKI RTR Cache for live ROA updates; the cache IP address/port
      being defined by the rpki_rtr_cache config directive (and a few more
      optional rpki_rtr_* directives are available and can be reviwed in
      the CONFIG-KEYS doc). The ROA fields will be populated with one of
      these five values: 'u' Unknown, 'v' Valid, 'i' Invalid no overlaps,
      'V' Invalid with a covering Valid prefix, 'U' Invalid with a covering
      Unknown prefix.
    + Introducing pmgrpcd.py, written in Python, a daemon to handle gRPC-
      based Streaming Telemetry sessions and unmarshall GPB data. Code
      was mostly courtesy by Matthias Arnold ( @tbearma1 ). This is in
      addition (or feeding into) pmtelemetryd, written in C, a daemon to
      handle TCP/UDP-based Streaming Telemetry sessions with JSON-encoded
      data.
    + pmacctd, uacctd: added support for CFP (Cisco FabricPath) and Cisco
      Virtual Network Tag protocols.
    + print plugin: added 'custom' to print_output. This is to cover two
      main use-cases: 1) use JSON or Avro encodings but fix the format of
      the messages in a custom way and 2) use a different encoding than
      JSON or Avro. See also example in examples/custom and new directives
      print_output_custom_lib and print_output_custom_cfg_file. The patch
      was courtesy by Edge Intelligence ( @edge-intelligence ).
    + Introducing mpls_pw_id aggregation primitive and mpls_pw_id key in
      pre_tag_map to filter on signalled L2 MPLS VPN Pseudowire IDs.
    + BGP daemon: added bgp_disable_router_id knob to enable/disable BGP
      Router-ID check, both at BGP OPEN time and BGP lookup. Useful, for
      example, in scenarios with split BGP v4/v6 AFs over v4/v6 transports.
    + BGP, BMP daemons: translate origin attribute numeric value into IGP
      (i), EGP (e) and Incomplete (u) strings.
    + plugins: added new plugin_exit_any feature to make the daemon bail
      out if any (not all, which is the default behaviour) of the plugins
      exits.
    + maps_index: improved selection of buckets for index hash structure
      by picking the closest prime number to the double of the entries of
      the map to be indexed in order to achieve better elements dispersion
      and hence better performances.
    + nfacctd: added support for IPFIX templateId-scoped (IE 145) sampling
      information.
    + pmacctd, uacctd, sfacctd, nfacctd: added a -M command-line option to
      set *_markers (ie. print_markers) to true and fixed -A command-line
      option to set print_output_file_append to align to true/false.
    ! fix, BGP, BMP, Streaming Telemetry daemons: improved sequencing of
      dump events by assigning a single sequence number per event (ie. for
      streaming pipeline scenarios in order to reduce correlation with
      dump_init/dump_close messages). Also amount of record dumped was
      added to the close message.
    ! fix, BGP, BMP, Streaming Telemetry daemons: removed hierarchical
      json_decref() since json_object_get() borrows reference. This was
      occasionaly leading to SEGVs.
    ! fix, uacctd: dynamically allocate jumbo_container buffer size as
      packets larger than 10KB, previous static allocation, would lead to
      crashes.
    ! fix, nfacctd: wired (BGP, BMP, ISIS, etc.) lookups to the NEL/NSEL
      use-case.
    ! fix, nfacctd: search for IE 408 (dataLinkFrameType) was leading to
      SEGVs. Also improved handling of variable-length IPFIX templates.
    ! fix, BMP daemon: solved an occasional truncation of the last message
      in a packet.
    ! fix, BGP daemon: when processing bgp_daemon_md5_file, ipv4 addresses
      were incorrectly translated to ipv4-mapped ipv6 ones as a result of
      which TCP-MD5 hashes were not correctly bound to sockets.
    ! fix, BGP daemon: improved label-unicast and mpls-vpn SAFIs handling
      (some bogus messages, multiple labels, etc.).
    ! fix, BGP daemon: introduced PREFIX_STRLEN to make enough room for
      prefix2str() calls (before unsufficient INET6_ADDRSTRLEN was used).
    ! fix, BMP daemon: improved handling of ADD-PATH capability.
    ! fix, plugins: an incorrect evaluation in P_cache_attach_new_node did
      make possible to buffer overrun in plugins cache allocation. This was
      found related to a "[..]: Assertion `!cache_ptr->stitch' failed."
      daemon bail-out message.
    ! fix, plugins: if pidfile directive was enabled, exit_gracefully() was
      mistakenly deleting the plugin pidfile when called by a child process
      (ie. writer, dumper, etc.).
    ! fix, plugins: when taking exit_gracefully(), if the process is marked
      as 'is_forked', just exit and don't perform extra ops in exit_all()
      or exit_plugin().
    ! fix, plugins: re-evaluate dynamic tables/files name if *_refresh_time
      is different than *_history period.
    ! fix, SQL plugins: a missing 'AND' was making SQL statements related
      to src_host_coords and dst_host_coords fail.
    ! fix, GeoIPv2: if no match is returned by libmaxminddb, return O1 code
      (Other Country) instead of a null value.
    ! fix, flow_to_rd_map: mpls_vpn_id was not working when maps_index was
      enabled. Also partly re-written mpls_vpn_id handler.
    ! fix, nfprobe plugin: serialize_bin() function introduced for correct
      serialization of custom primitives defined with 'raw' semantics.
    ! fix, PostgreSQL plugin: testing for presence of PQlibVersion() in
      libpq to prevent compiling issues (ie. on CentOS 6).
    ! fix, MySQL plugin: including mysql_version.h to compile successfully
      against newer MariaDB releases.
    ! fix, nDPI classification: send log message if 'class' primitive is
      selected but nDPI is not compiled in; also updated code to follow
      API changes in versions >= 2.6 of the library. Dropped support for
      versions < 2.4.
    ! fix, sfprobe plugin: added (and documented) conditional for optional
      export of classification info.
    ! fix, aggregate_primitives: field_type is now also allowed for pmacctd
      and uaccd daemons so that it can be used for NetFlow v9/IPFIX export
      (nfprobe plugin) purposes.
    ! fix, pre_tag_map: if no 'ip' keyword is specified, an entry of the
      map gets recirculated in order to be set for both v4 and v6 maps. If
      a 'set_label' is also specified, it was causing a SEGV. Now the label
      is correctly copied in case of recirculation.
    ! fix, zmq_common.c: added option for non-blocking p_zmq_send_bin() as
      otherwise program would block in case of no consumers (main use-case:
      flow replication over ZeroMQ queues); as a result, a generous hwm
      value was added on both sides of these queues.
    ! fix, zmq_common.c: ZAP socket moved inside thread to prevent failed
      assert() when compiling with gcc7/gcc8. Also a single user/password
      auto-generated combination is used for all plugins.
    ! fix, signals.c: SIGUSR1 handler for nfacctd and nfacctd is changed to
      syncronous in order to prevent race conditions. Also, in pmacctd,
      upon sending SIGUSR1, stats were not printed when reading packets
      from a pcap_interfaaces_map.
    ! fix, plugin_cmn_json.c: if leaving protocols numerical (ie. proto,
      tunnel_proto primitives), convert them to string-represented numbers
      for data consistency for consumers.
    ! fix, util.c: open_output_file(), if file exists and it's a FIFO then
      set O_NONBLOCK when opening.
    ! fix, pretag.c: pretag_index_report() was reporting incorrect info of
      the hash structure built for the maps_index feature. Its format was
      has also changed to be better parseable.
    ! fix, compile time warnings: several warnings were addressed including
      but not restricted to -Wformat ones. Also an annotation was added to
      the Log function to inform the compiler it's a printf-style function,
      allowing it to give warnings for argument mismatches.
    - --enable-ipv6 configure script switch has been deprecated and, as a
      result, IPv6 support was made mandatory.
    - BGP daemon: removed unused pathlimit field from bgp_attr structure.
    - pmacct client: removed deprecated SYM field from from formatted and
      CSV headers.
  - Build with support for
    * ZeroMQ
    * Maxmind GeoIP DB v2


author: Martin Hauke <mardnh@gmx.de>
changelog:
  - Do not longer build with support for the obsolete GeoIP
    The GeoIP-interface has been discontinued by Maxmind. See
    https://support.maxmind.com/geolite-legacy-discontinuation-notice/
    for details. Without the database GeoIP is useless.
    pmacct is now build with support for libmaxminddb (GeoIPv2) that
    provides the same features but with a new supported interface.


author: Martin Hauke <mardnh@gmx.de>
changelog:
  - Update to version 1.7.4
    + Introduced support for the 'vxlan' VXLAN/VNI primitive in all
      traffic daemons
    + BMP daemon: added support for Peer Up message namespace for TLVs
    + sfprobe plugin: added support for IPv6 transport for sFlow export.
    See /usr/share/doc/packages/pmacct/ChangeLog for all changes


author: Martin Hauke <mardnh@gmx.de>
changelog:
  - Update to version 1.7.4p1
    fix, pre_tag_map: a memory leak in pretag_entry_process() has been
    introduced in 1.7.4.


author: Paul Howarth <paul@city-fan.org> - 2.6.1-22
changelog:
  - When creating ElGamal keys, the generator wasn't a square residue: ElGamal
    encryption done with those keys cannot be secure under the DDH assumption
    https://bugzilla.redhat.com/show_bug.cgi?id=1542313 (CVE-2018-6594)
    https://github.com/TElgamal/attack-on-pycrypto-elgamal
    https://github.com/Legrandin/pycryptodome/issues/90
    https://github.com/dlitz/pycrypto/issues/253
    https://github.com/dlitz/pycrypto/pull/256


author: Paul Howarth <paul@city-fan.org> - 2.6.1-26
changelog:
  - Replace the user-space RNG with a thin wrapper to os.urandom
    - Based on https://github.com/Legrandin/pycryptodome/commit/afd6328f
    - Fixes compatibility with Python 3.8 (#1718332)
  - Drop support for Python 2.1


author: Carl George <carl@george.computer> - 1.0.15-2
changelog:
  - Revert using a common documentation directory to avoid potential update issues
  - Change pygments to an optional dependency


author: Miro Hron?ok <mhroncok@redhat.com> - 0.5.4-2
changelog:
  - Subpackage python2-snappy has been removed
    See https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal


author: Lumír Balhar <lbalhar@redhat.com> - 5.1.1-2
changelog:
  - New patch to not turn DeprecationWarning in tornado module into Exception
  - Fixes FTBFS with Python 3.8


author: Miro Hron?ok <mhroncok@redhat.com> - 0.1.7-10
changelog:
  - Subpackage python2-wcwidth has been removed
    See https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal


author: Pablo Suárez Hernández <pablo.suarezhernandez@suse.com>
changelog:
  - Fix zypper pkg.list_pkgs test expectation and dpkg mocking
  - Added:
    * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch


author: Pablo Suárez Hernández <pablo.suarezhernandez@suse.com>
changelog:
  - Provide the missing features required for Yomi (Yet one more installer)
  - Added:
    * provide-the-missing-features-required-for-yomi-yet-o.patch


author: Pablo Suárez Hernández <pablo.suarezhernandez@suse.com>
changelog:
  - Do not make "ansiblegate" module to crash on Python3 minions (bsc#1139761)
  - Added:
    * do-not-make-ansiblegate-to-crash-on-python3-minions.patch


author: Pablo Suárez Hernández <pablo.suarezhernandez@suse.com>
changelog:
  - Allow passing kwargs to pkg.list_downloaded for Zypper (bsc#1140193)
  - Added:
    * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch


author: Pablo Suárez Hernández <pablo.suarezhernandez@suse.com>
changelog:
  - Prevent ansiblegate unit tests to fail on Ubuntu
  - Added:
    * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch


author: Pablo Suárez Hernández <pablo.suarezhernandez@suse.com>
changelog:
  - virt.volume_infos: don't raise an error if there is no VM
  - Added:
    * virt-1.volume_infos-fix-for-single-vm.patch


author: Mihai Dinc? <mihai.dinca@suse.com>
changelog:
  - Salt python client get_full_returns seems return data from incorrect jid (bsc#1131114)
  - Added:
    * checking-for-jid-before-returning-data.patch


author: Pablo Suárez Hernández <pablo.suarezhernandez@suse.com>
changelog:
  - Avoid traceback on http.query when there are errors with the requested URL (bsc#1128554)
  - Added:
    * avoid-traceback-when-http.query-request-cannot-be-pe.patch


author: Pablo Suárez Hernández <pablo.suarezhernandez@suse.com>
changelog:
  - Multiple fixes on cmdmod, chroot, freezer and zypperpkg needed for Yomi
    cmdmod: fix runas and group in run_chroot
    chroot: add missing sys directory
    chroot: change variable name to root
    chroot: fix bug in safe_kwargs iteration
    freezer: do not fail in cache dir is present
    freezer: clean freeze YAML profile on restore
    zypperpkg: fix pkg.list_pkgs cache
  - Added:
    * accumulated-changes-required-for-yomi-165.patch


author: Mihai Dinc? <mihai.dinca@suse.com>
changelog:
  - Move server_id deprecation warning to reduce log spamming (bsc#1135567) (bsc#1135732)
  - Added:
    * move-server_id-deprecation-warning-to-reduce-log-spa.patch


author: asarai@suse.com
changelog:
  - Add backport of https://github.com/openSUSE/umoci/pull/157, to fix i586
    builds.
      + i586-0001-fix-mis-usage-of-time.Unix.patch


author: asarai@suse.com
changelog:
  - Update to umoci v0.3.1. Upstream changelog:
    - Fix several minor bugs in `hack/release.sh` that caused the release artefacts
    to not match the intended style, as well as making it more generic so other
    projects can use it. openSUSE/umoci#155 openSUSE/umoci#163
    - A recent configuration issue caused `go vet` and `go lint` to not run as part
    of our CI jobs. This means that some of the information submitted as part of
    [CII best practices badging][cii] was not accurate. This has been corrected,
    and after review we concluded that only stylistic issues were discovered by
    static analysis. openSUSE/umoci#158
    - 32-bit unit test builds were broken in a refactor in [0.3.0]. This has been
    fixed, and we've added tests to our CI to ensure that something like this
    won't go unnoticed in the future. openSUSE/umoci#157
    - `umoci unpack` would not correctly preserve set{uid,gid} bits. While this
    would not cause issues when building an image (as we only create a manifest
    of the final extracted rootfs), it would cause issues for other users of
    `umoci`. openSUSE/umoci#166 openSUSE/umoci#169
    - Updated to [v0.4.1 of `go-mtree`][gomtree-v0.4.1], which fixes several minor
    bugs with manifest generation. openSUSE/umoci#176
    - `umoci unpack` would not handle "weird" tar archive layers previously (it
    would error out with DiffID errors). While this wouldn't cause issues for
    layers generated using Go's `archive/tar` implementation, it would cause
    issues for GNU gzip and other such tools.
    - `umoci unpack`'s mapping options (`--uid-map` and `--gid-map`) have had an
    interface change, to better match the [`user_namespaces(7)`][user_namespaces]
    interfaces. Note that this is a **breaking change**, but the workaround is to
    switch to the trivially different (but now more consistent) format.
    openSUSE/umoci#167
    - `umoci unpack` used to create the bundle and rootfs with world
    read-and-execute permissions by default. This could potentially result in an
    unsafe rootfs (containing dangerous setuid binaries for instance) being
    accessible by an unprivileged user. This has been fixed by always setting the
    mode of the bundle to `0700`, which requires a user to explicitly work around
    this basic protection. This scenario was documented in our security
    documentation previously, but has now been fixed. openSUSE/umoci#181
    openSUSE/umoci#182
    [cii]: https://bestpractices.coreinfrastructure.org/projects/1084
    [gomtree-v0.4.1]: https://github.com/vbatts/go-mtree/releases/tag/v0.4.1
    [user_namespaces]: http://man7.org/linux/man-pages/man7/user_namespaces.7.html
  - Remove patch that has been applied upstream.
    - i586-0001-fix-mis-usage-of-time.Unix.patch


author: asarai@suse.com
changelog:
  - Update to umoci v0.4.0. Upstream changelog:
    + `umoci repack` now supports `--refresh-bundle` which will update the
    OCI bundle's metadata (mtree and umoci-specific manifests) after packing
    the image tag. This means that the bundle can be used as a base layer for
    future diffs without needing to unpack the image again.
    openSUSE/umoci#196
    + Added a website, and reworked the documentation to be better structured.
    You can visit the website at [`umo.ci`][umo.ci]. openSUSE/umoci#188
    + Added support for the `user.rootlesscontainers` specification, which
    allows for persistent on-disk emulation of `chown(2)` inside rootless
    containers. This implementation is interoperable with [@AkihiroSuda's
    `PRoot` fork][as-proot-fork] (though we do not test its interoperability
    at the moment) as both tools use [the same protobuf
    specification][rootlesscontainers-proto]. openSUSE/umoci#227
    + `umoci unpack` now has support for opaque whiteouts (whiteouts which
    remove all children of a directory in the lower layer), though `umoci
    repack` does not currently have support for generating them. While this
    is technically a spec requirement, through testing we've never
    encountered an actual user of these whiteouts. openSUSE/umoci#224
    openSUSE/umoci#229
    + `umoci unpack` will now use some rootless tricks inside user namespaces
    for operations that are known to fail (such as `mknod(2)`) while other
    operations will be carried out as normal (such as `lchown(2)`). It should
    be noted that the `/proc/self/uid_map` checking we do can be tricked into
    not detecting user namespaces, but you would need to be trying to break
    it on purpose. openSUSE/umoci#171 openSUSE/umoci#230
    * Fix a bug in our "parent directory restore" code, which is responsible
    for ensuring that the mtime and other similar properties of a directory
    are not modified by extraction inside said directory. The bug would
    manifest as xattrs not being restored properly in certain edge-cases
    (which we incidentally hit in a test-case). openSUSE/umoci#161
    openSUSE/umoci#162
    * `umoci unpack` will now "clean up" the bundle generated if an error
    occurs during unpacking. Previously this didn't happen, which made
    cleaning up the responsibility of the caller (which was quite difficult
    if you were unprivileged). This is a breaking change, but is in the error
    path so it's not critical. openSUSE/umoci#174 openSUSE/umoci#187
    * `umoci gc` now will no longer remove unknown files and directories that
    aren't `flock(2)`ed, thus ensuring that any possible OCI image-spec
    extensions or other users of an image being operated on will no longer
    break. openSUSE/umoci#198
    * `umoci unpack --rootless` will now correctly handle regular file
    unpacking when overwriting a file that `umoci` doesn't have write access
    to. In addition, the semantics of pre-existing hardlinks to a clobbered
    file are clarified (the hard-links will not refer to the new layer's
    inode). openSUSE/umoci#222 openSUSE/umoci#223
    [as-proot-fork]: https://github.com/AkihiroSuda/runrootless
    [rootlesscontainers-proto]: https://rootlesscontaine.rs/proto/rootlesscontainers.proto
    [umo.ci]: https://umo.ci/


author: asarai@suse.com
changelog:
  - Update to umoci v0.4.1.
    * Support more tags (the valid set of characters in tags has expanded).
    * Add 'umoci insert' and 'umoci raw unpack'.
    * 'umoci unpack' correctly handles out-of-order whiteouts now.
    * 'umoci unpack' and 'umoci repack' make sure of a more optimised gzip
    implementation now -- in some benchmarks 'umoci repack' can have a speedup
    of up to 3x.
    * For details, see CHANGELOG.md in the package.


author: asarai@suse.com
changelog:
  - Update to umoci v0.4.2.
    * umoci now has an exposed Go API
    * Added `umoci unpack --keep-dirlinks`
    * `umoci insert` now supports whiteouts two ways.
    * For details, see CHANGELOG.md in the package.


author: asarai@suse.com
changelog:
  - Update to umoci v0.4.3.
    * Added --no-history to all commands with --history.* flags.
      Should only be used for umoci-config(1).
    * Added `umoci insert --tag` to allow non-destructive modifications.
    * For details, see packaged /usr/share/doc/packages/umoci/CHANGELOG.md.


author: Aleksa Sarai <asarai@suse.com>
changelog:
  - Update to umoci v0.4.4.
    * Added full-stack verification of blob hashes and descriptors for all
      operations (improving our hardening against bad images).
    * For details, see CHANGELOG.md in the package.


author: Joe Doss <joe@solidadmin.com> - 0.0.20191226-1
changelog:
  - Split wireguard-tools back out into it's own spec
  - Switch to https://git.zx2c4.com/wireguard-linux-compat repo
  - Move back to wireguard-dkms spec


author: Joe Doss <joe@solidadmin.com> - 0.0.20200215-2
changelog:
  - Apply patch: https://git.zx2c4.com/wireguard-linux-compat/patch/?id=27ce49e385a87cb784368a0995f8284fd6887d8c


author: Joe Doss <joe@solidadmin.com> - 1.0.20191226-1
changelog:
  - Update to 1.0.20191226
  - Split wireguard-tools back into it's own spec file
  - Add in patch to fix dns-hatchet path


author: Elliott Sales de Andrade <quantum.analyst@gmail.com> - 4.1.6-11
changelog:
  - Backport patches to fix test failures in build
  - Cleanup spec a little
  - Use explicit soname version in file list


