<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="39">
<package pkgid="f96edb02882f40b0e5362d242a72f30987d7ee253808fd1ff5da9cec0eba23868901478f25cbe05b0b45edac0ce9a0957691e35e0cc6ca2054b0345d702474bc" name="amavisd-milter" arch="aarch64">
  <version epoch="0" ver="1.6.0" rel="1.110"/>
  <changelog author="mkubecek@suse.cz" date="1419163200">- initial checkin of version 1.6.0</changelog>
</package>
<package pkgid="567b9cef53e155ac615fde244624cbcd04a0d5fe79b3d79d72c5a66a322de0c542488d4ebee944543ecfeb4df960ef62045ff97d05e1d41a93cd9565ed31b6e3" name="amavisd-milter" arch="src">
  <version epoch="0" ver="1.6.0" rel="1.110"/>
  <changelog author="mkubecek@suse.cz" date="1419163200">- initial checkin of version 1.6.0</changelog>
</package>
<package pkgid="72cc0bdd7cff67f5c67403bb97e772e7e2d01e801a7b7f34d206c4d59ae825094a947081d85ee4f5abaee0b35ae523d85d264d65fdfa19558da7ac075fea43e5" name="amavisd-milter-debuginfo" arch="aarch64">
  <version epoch="0" ver="1.6.0" rel="1.110"/>
  <changelog author="mkubecek@suse.cz" date="1419163200">- initial checkin of version 1.6.0</changelog>
</package>
<package pkgid="a823ff30c3d106d2e2d7ddd1131e5956856c765723310b287c789ddddf057e31a9163872e174205fc560c61ae51ca2ae6f0849981c9613ecbb4877312cc01bb8" name="amavisd-milter-debugsource" arch="aarch64">
  <version epoch="0" ver="1.6.0" rel="1.110"/>
  <changelog author="mkubecek@suse.cz" date="1419163200">- initial checkin of version 1.6.0</changelog>
</package>
<package pkgid="f39a20a9435af68107d3ec484290562916dd3912690c12728d3c7068ac02cf5d0600d0e021174ca563240b37de0ff333b92f5b3557d68f3811a220a5fb00271e" name="cronolog" arch="aarch64">
  <version epoch="0" ver="1.6.2" rel="2.91"/>
  <changelog author="mkubecek@suse.cz" date="1349179200">- move to OBS
- specfile cleanup
- start a changelog
- recompress source tarball using bzip2</changelog>
  <changelog author="mkubecek@suse.cz" date="1349179201">- move cronolog and cronosplit to /usr/bin</changelog>
</package>
<package pkgid="d1bedc0360946d181df16edac8216c62ef802f7beac889564f4709a7fa49d5d1a4bb12023069a5bde596edb4a84b7db8454095167f226dabd74ac323fcfd8909" name="cronolog" arch="src">
  <version epoch="0" ver="1.6.2" rel="2.91"/>
  <changelog author="mkubecek@suse.cz" date="1349179200">- move to OBS
- specfile cleanup
- start a changelog
- recompress source tarball using bzip2</changelog>
  <changelog author="mkubecek@suse.cz" date="1349179201">- move cronolog and cronosplit to /usr/bin</changelog>
</package>
<package pkgid="8e801b58e9dab91b91fad1c916e341592aa6fa276d6b7527511fc98862f5d95599a73b112c197c652ae6adf8701249844e90cdf941169db3b266ad70af5b3b50" name="cronolog-debuginfo" arch="aarch64">
  <version epoch="0" ver="1.6.2" rel="2.91"/>
  <changelog author="mkubecek@suse.cz" date="1349179200">- move to OBS
- specfile cleanup
- start a changelog
- recompress source tarball using bzip2</changelog>
  <changelog author="mkubecek@suse.cz" date="1349179201">- move cronolog and cronosplit to /usr/bin</changelog>
</package>
<package pkgid="30ecf87c2cdf6fbbc5dfddc3b19c478b9291e96412b9070991519fa1c90b56aa027af7a0a33bf437b4f78019c589934ce4bb820fb033b5001db3c6b27a33e5a0" name="cronolog-debugsource" arch="aarch64">
  <version epoch="0" ver="1.6.2" rel="2.91"/>
  <changelog author="mkubecek@suse.cz" date="1349179200">- move to OBS
- specfile cleanup
- start a changelog
- recompress source tarball using bzip2</changelog>
  <changelog author="mkubecek@suse.cz" date="1349179201">- move cronolog and cronosplit to /usr/bin</changelog>
</package>
<package pkgid="1400085fb17f7afac88c5e20741f2ff0b4fb10c60eca4b69246507000995285711ffbfabbd9c639cf5a994a17884861e304c3d4f2bc03e2a48296dea20bb2e0d" name="dhcpcd" arch="aarch64">
  <version epoch="0" ver="3.2.3" rel="47.9.22"/>
  <changelog author="varkoly@novell.com" date="1301572800">- bnc#675052 - discard string options such as host and domain names
  containing disallowed characters or beeing too long. This proctive
  patch limits root-path to a-zA-Z0-9, #%+-_:.,@~/\[]= and a space
  (CVE-2011-0997).
- fixed to read netbios scope from info file as string
- bnc#668194 - handle packets with xen partial UDP checksums
- bnc#657402 - send renew messages as unicast directly to the server</changelog>
  <changelog author="mt@suse.de" date="1303214400">- Fixed a bug causing a crash in the sip option check, when the
  option data can't be decoded (bnc#687850).
- Relaxed the check of the domain-name option causing a regression,
  when the server is misusing it to provide a domain list and does
  not provide it using the domain-search option (bnc#675052).</changelog>
  <changelog author="jengelh@medozas.de" date="1316347200">- Remove redundant tags/sections from specfile
  (cf. packaging guidelines)
- Use %_smp_mflags for parallel build</changelog>
  <changelog author="eich@suse.com" date="1319198400">- N_When-getting-a-new-lease-send-the-serverID-and-lease-addr-in-a-DHCP_REQUEST-package.patch
  When getting a new lease send the serverID and lease
  addr in a DHCP_REQUEST package (bnc #725856).</changelog>
  <changelog author="rschweikert@suse.com" date="1328702400">- place binary into /usr tree (UsrMerge project)</changelog>
  <changelog author="dvaleev@suse.com" date="1355832000">- dhcpcd-unused.patch fixes ppc build error. Where unused expects
  an argument</changelog>
  <changelog author="jengelh@inai.de" date="1410436800">- Update homepage URL</changelog>
  <changelog author="mkubecek@suse.cz" date="1489665600">- add explicit insserv requirements</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1613044800">- add rpmlintrc to suppress bogus build errors in Factory</changelog>
  <changelog author="Michal Kube&#x10D;ek &lt;mkubecek@suse.cz&gt;" date="1665662400">- fix build on UsrMerged systems
- drop insserv related stuff as it wasn't actually used</changelog>
</package>
<package pkgid="98f0ef55b104ab26fefea909931c408578bc5a588bca579d75e21a28267144922963bc46862a392acc2e2d0afadf5acba74af7875f3f11cc22472f598c318aa6" name="dhcpcd" arch="src">
  <version epoch="0" ver="3.2.3" rel="47.9.22"/>
  <changelog author="varkoly@suse.de" date="1259236800">- bnc#558744 dhcpcd-3.x does not provide DHCPGIADDR and DHCPSIADDR info
  file as dhcpcd-1.x did</changelog>
  <changelog author="varkoly@suse.de" date="1259323200">- bnc#552916 - dhcp client swamps network with dhcp requests although ip already obtained
- bnc#551376 - dhcpcd does not honor -p / --persistent option breaking nfs/iscsi root systems</changelog>
  <changelog author="mt@suse.de" date="1259582400">- bnc#518219 - call (/etc/sysconfig/network/scripts/dhcpcd-hook)
  dhcpcd script once again with "complete" when all configuration
  is done and hostname is set, to allow ifup-dhcp to synchronize
  using it and report correct status (bnc#518219).</changelog>
  <changelog author="jengelh@medozas.de" date="1261310400">- enable parallel build</changelog>
  <changelog author="varkoly@suse.de" date="1263297600">- bnc#569972 - dhcpcd sets bad routes
- bnc#556613 - hostname issues during installation from network</changelog>
  <changelog author="varkoly@suse.de" date="1263902400">- bnc#565030 - L3: dhcpcd not using router component of dhcp server
  option 33 (Static Route)</changelog>
  <changelog author="varkoly@novell.com" date="1265716800">- bnc#577402 - dhcpcp with Patch bnc#565030 has netlink error with /32 netmask</changelog>
  <changelog author="varkoly@novell.com" date="1270814400">- bnc#564441 - e1000 and dhcpd hickup</changelog>
  <changelog author="varkoly@novell.com" date="1277294400">- bnc#579438 dhcpcd sometime loops endless after adding wlan usb stick
  with dhcp ip lease time infinity</changelog>
  <changelog author="varkoly@novell.com" date="1291118400">- bnc#654649 - dhcpcd ignores -G (--nogateway) option and sets default route</changelog>
  <changelog author="varkoly@novell.com" date="1301572800">- bnc#675052 - discard string options such as host and domain names
  containing disallowed characters or beeing too long. This proctive
  patch limits root-path to a-zA-Z0-9, #%+-_:.,@~/\[]= and a space
  (CVE-2011-0997).
- fixed to read netbios scope from info file as string
- bnc#668194 - handle packets with xen partial UDP checksums
- bnc#657402 - send renew messages as unicast directly to the server</changelog>
  <changelog author="mt@suse.de" date="1303214400">- Fixed a bug causing a crash in the sip option check, when the
  option data can't be decoded (bnc#687850).
- Relaxed the check of the domain-name option causing a regression,
  when the server is misusing it to provide a domain list and does
  not provide it using the domain-search option (bnc#675052).</changelog>
  <changelog author="jengelh@medozas.de" date="1316347200">- Remove redundant tags/sections from specfile
  (cf. packaging guidelines)
- Use %_smp_mflags for parallel build</changelog>
  <changelog author="eich@suse.com" date="1319198400">- N_When-getting-a-new-lease-send-the-serverID-and-lease-addr-in-a-DHCP_REQUEST-package.patch
  When getting a new lease send the serverID and lease
  addr in a DHCP_REQUEST package (bnc #725856).</changelog>
  <changelog author="rschweikert@suse.com" date="1328702400">- place binary into /usr tree (UsrMerge project)</changelog>
  <changelog author="dvaleev@suse.com" date="1355832000">- dhcpcd-unused.patch fixes ppc build error. Where unused expects
  an argument</changelog>
  <changelog author="jengelh@inai.de" date="1410436800">- Update homepage URL</changelog>
  <changelog author="mkubecek@suse.cz" date="1489665600">- add explicit insserv requirements</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1613044800">- add rpmlintrc to suppress bogus build errors in Factory</changelog>
  <changelog author="Michal Kube&#x10D;ek &lt;mkubecek@suse.cz&gt;" date="1665662400">- fix build on UsrMerged systems
- drop insserv related stuff as it wasn't actually used</changelog>
</package>
<package pkgid="316bf3702e72e2a35d4757a5ac9cf66c4961580403fef17c1c27fbd3123de230fb538f365f5f043f34a861d199722c64789cf7a8fde1f7aee0e0997ee2fe02ac" name="dhcpcd-debuginfo" arch="aarch64">
  <version epoch="0" ver="3.2.3" rel="47.9.22"/>
  <changelog author="varkoly@novell.com" date="1301572800">- bnc#675052 - discard string options such as host and domain names
  containing disallowed characters or beeing too long. This proctive
  patch limits root-path to a-zA-Z0-9, #%+-_:.,@~/\[]= and a space
  (CVE-2011-0997).
- fixed to read netbios scope from info file as string
- bnc#668194 - handle packets with xen partial UDP checksums
- bnc#657402 - send renew messages as unicast directly to the server</changelog>
  <changelog author="mt@suse.de" date="1303214400">- Fixed a bug causing a crash in the sip option check, when the
  option data can't be decoded (bnc#687850).
- Relaxed the check of the domain-name option causing a regression,
  when the server is misusing it to provide a domain list and does
  not provide it using the domain-search option (bnc#675052).</changelog>
  <changelog author="jengelh@medozas.de" date="1316347200">- Remove redundant tags/sections from specfile
  (cf. packaging guidelines)
- Use %_smp_mflags for parallel build</changelog>
  <changelog author="eich@suse.com" date="1319198400">- N_When-getting-a-new-lease-send-the-serverID-and-lease-addr-in-a-DHCP_REQUEST-package.patch
  When getting a new lease send the serverID and lease
  addr in a DHCP_REQUEST package (bnc #725856).</changelog>
  <changelog author="rschweikert@suse.com" date="1328702400">- place binary into /usr tree (UsrMerge project)</changelog>
  <changelog author="dvaleev@suse.com" date="1355832000">- dhcpcd-unused.patch fixes ppc build error. Where unused expects
  an argument</changelog>
  <changelog author="jengelh@inai.de" date="1410436800">- Update homepage URL</changelog>
  <changelog author="mkubecek@suse.cz" date="1489665600">- add explicit insserv requirements</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1613044800">- add rpmlintrc to suppress bogus build errors in Factory</changelog>
  <changelog author="Michal Kube&#x10D;ek &lt;mkubecek@suse.cz&gt;" date="1665662400">- fix build on UsrMerged systems
- drop insserv related stuff as it wasn't actually used</changelog>
</package>
<package pkgid="9b2438cd94ef43c8aad10c55fdc8f0d9ebca526f90e3ad06b8e3d178301d5c981426b8d5b829904ed2dbeb4e4d6e3afcd942e3e9454383777dd4a6b1f402b057" name="dhcpcd-debugsource" arch="aarch64">
  <version epoch="0" ver="3.2.3" rel="47.9.22"/>
  <changelog author="varkoly@novell.com" date="1301572800">- bnc#675052 - discard string options such as host and domain names
  containing disallowed characters or beeing too long. This proctive
  patch limits root-path to a-zA-Z0-9, #%+-_:.,@~/\[]= and a space
  (CVE-2011-0997).
- fixed to read netbios scope from info file as string
- bnc#668194 - handle packets with xen partial UDP checksums
- bnc#657402 - send renew messages as unicast directly to the server</changelog>
  <changelog author="mt@suse.de" date="1303214400">- Fixed a bug causing a crash in the sip option check, when the
  option data can't be decoded (bnc#687850).
- Relaxed the check of the domain-name option causing a regression,
  when the server is misusing it to provide a domain list and does
  not provide it using the domain-search option (bnc#675052).</changelog>
  <changelog author="jengelh@medozas.de" date="1316347200">- Remove redundant tags/sections from specfile
  (cf. packaging guidelines)
- Use %_smp_mflags for parallel build</changelog>
  <changelog author="eich@suse.com" date="1319198400">- N_When-getting-a-new-lease-send-the-serverID-and-lease-addr-in-a-DHCP_REQUEST-package.patch
  When getting a new lease send the serverID and lease
  addr in a DHCP_REQUEST package (bnc #725856).</changelog>
  <changelog author="rschweikert@suse.com" date="1328702400">- place binary into /usr tree (UsrMerge project)</changelog>
  <changelog author="dvaleev@suse.com" date="1355832000">- dhcpcd-unused.patch fixes ppc build error. Where unused expects
  an argument</changelog>
  <changelog author="jengelh@inai.de" date="1410436800">- Update homepage URL</changelog>
  <changelog author="mkubecek@suse.cz" date="1489665600">- add explicit insserv requirements</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1613044800">- add rpmlintrc to suppress bogus build errors in Factory</changelog>
  <changelog author="Michal Kube&#x10D;ek &lt;mkubecek@suse.cz&gt;" date="1665662400">- fix build on UsrMerged systems
- drop insserv related stuff as it wasn't actually used</changelog>
</package>
<package pkgid="3a156de3d4a2eb77b7f40541ee6322b6a06b17a84e929ac750b596e0b71301266f0ea8f6b33335127db6b135d348931c0a4e3e073b1da6ae557b6d3e8478f2de" name="insserv-compat" arch="noarch">
  <version epoch="0" ver="0.1" rel="2.15"/>
  <changelog author="kukuk@suse.com" date="1490788800">- Add /etc/init.d hierachy from filesystem</changelog>
  <changelog author="arvidjaar@gmail.com" date="1493380800">- Also provide /etc/rc.d link which was provided by filesystem (bsc#1035062)</changelog>
  <changelog author="kukuk@suse.de" date="1517918400">- Own the lib/lsb directories, without this package, lsb init scripts
  are not supported and nobody else is using them.</changelog>
  <changelog author="lnussel@suse.de" date="1543924800">- drop insserv.conf, it's no longer useful (boo#1052837)</changelog>
  <changelog author="kukuk@suse.de" date="1555588800">- Add rc.status and rc.splash from aaa_base [bsc#1132738]</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1557403200">- fix handling of ,start= parameters (bsc#1133306)</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1580212800">- Add chkconfig from aaa_base</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.de&gt;" date="1606132800">- prepare usrmerge (boo#1029961)
- filter legacy init script warnings. The whole point of this
  package is to have them. So has to pass even when the check is
  switched to fatal.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.de&gt;" date="1615550400">- chkconfig needs to be in sbin even in usrmerge case</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1665662400">- more general rpmlintrc rules for bogus errrors
- drop %clean section</changelog>
</package>
<package pkgid="db9f6c37f029b21c20b9bd6a9b6d688847d7d9b7201d89e4511739d62f9eac93f6c9b6a67b18395c2f13fd42ddfd6a592d03de2a92daaf0137c100be23861aff" name="insserv-compat" arch="src">
  <version epoch="0" ver="0.1" rel="2.15"/>
  <changelog author="lnussel@suse.de" date="1358164800">- don't hard require Pod::Usage (bnc#798316)</changelog>
  <changelog author="lnussel@suse.de" date="1358596800">- strip off extra start/stop overrides</changelog>
  <changelog author="lnussel@suse.de" date="1359115200">- install compat insserv.conf (bnc#800477)</changelog>
  <changelog author="lnussel@suse.de" date="1373025600">- print warning if a sysv init script is masked by a systemd service
  (bnc#798510, bnc#804273)</changelog>
  <changelog author="jdelvare@suse.de" date="1395748800">- turn into a noarch package</changelog>
  <changelog author="lnussel@suse.de" date="1401796800">- remove reference to openSUSE 12.3
- add LSB init script header block as example (bnc#865018)
- support runlevel override (bnc#869260)</changelog>
  <changelog author="lnussel@suse.de" date="1410177600">- don't add dependency between named and $network as
  systemd-insserv-generator translates them to nss-lookup.target and
  network-online.target which results in an undesirable,
  unconditional dependency of multi-user.target on
  network-online.target (bnc#895611)</changelog>
  <changelog author="lnussel@suse.de" date="1433937600">- it's perl script so actually require perl(Getopt::Long)</changelog>
  <changelog author="lnussel@suse.de" date="1448971200">- fix directory argument parsing (bnc#944903)</changelog>
  <changelog author="lnussel@suse.de" date="1453118400">- ntp was renamed to ntpd at some point (bsc#960820)</changelog>
  <changelog author="kukuk@suse.com" date="1490788800">- Add /etc/init.d hierachy from filesystem</changelog>
  <changelog author="arvidjaar@gmail.com" date="1493380800">- Also provide /etc/rc.d link which was provided by filesystem (bsc#1035062)</changelog>
  <changelog author="kukuk@suse.de" date="1517918400">- Own the lib/lsb directories, without this package, lsb init scripts
  are not supported and nobody else is using them.</changelog>
  <changelog author="lnussel@suse.de" date="1543924800">- drop insserv.conf, it's no longer useful (boo#1052837)</changelog>
  <changelog author="kukuk@suse.de" date="1555588800">- Add rc.status and rc.splash from aaa_base [bsc#1132738]</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1557403200">- fix handling of ,start= parameters (bsc#1133306)</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1580212800">- Add chkconfig from aaa_base</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.de&gt;" date="1606132800">- prepare usrmerge (boo#1029961)
- filter legacy init script warnings. The whole point of this
  package is to have them. So has to pass even when the check is
  switched to fatal.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.de&gt;" date="1615550400">- chkconfig needs to be in sbin even in usrmerge case</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1665662400">- more general rpmlintrc rules for bogus errrors
- drop %clean section</changelog>
</package>
<package pkgid="c16d56fe4ade0a72666919bfdc48bceabe839e9b3350b6d3206888a86ae52ce96622235a2ccf765995c347823ceda076cd88215230e77180f5be681baa88976d" name="issue-generator" arch="noarch">
  <version epoch="0" ver="9999" rel="1.54"/>
  <changelog author="mkubecek@suse.cz" date="1498392000">- first (and hopefully also last) version of the package</changelog>
</package>
<package pkgid="6448beff2ac1930b7a200c1778d36cc24d5207a7cba9de5d85f325ef68e0b7809b0bdb3a7c9e81467e361c7e46dbeebc4e68aafa3bd7fa07af6c14ca18c48020" name="issue-generator" arch="src">
  <version epoch="0" ver="9999" rel="1.54"/>
  <changelog author="mkubecek@suse.cz" date="1498392000">- first (and hopefully also last) version of the package</changelog>
</package>
<package pkgid="f3dbfe57458c481543e3527271e1110d5bece15f144e43fdb0c701091c47230e95eea93bc0262902b7f8bd76954d648978acdf6af1bcbbf91340611dfcd4ad6c" name="knot-resolver" arch="aarch64">
  <version epoch="0" ver="5.7.6" rel="2.1"/>
  <changelog author="Jakub Ru&#x17E;i&#x10D;ka &lt;jakub.ruzicka@nic.cz&gt; - 5.7.6-1" date="1752753600">- upstream package
- see NEWS or https://www.knot-resolver.cz/</changelog>
</package>
<package pkgid="84ec1320ce4b8b108c747516f9570e0363ad5c4313ea4fc29f4d02ffcfc83b098da6ec11bbfdb0b0d33d019668659bfa8cc3425efbb1b18f979e9b98f7fd77a7" name="knot-resolver" arch="src">
  <version epoch="0" ver="5.7.6" rel="2.1"/>
  <changelog author="Jakub Ru&#x17E;i&#x10D;ka &lt;jakub.ruzicka@nic.cz&gt; - 5.7.6-1" date="1752753600">- upstream package
- see NEWS or https://www.knot-resolver.cz/</changelog>
</package>
<package pkgid="24b544512e307ccd01bac04e286dcb1443a4ba9e29497866ed8cb34bbc24b4e8331d95f2bd14707d0c88a5ae80f3c051b608ffdcaa9c4941b72a52f129125e31" name="knot-resolver-debuginfo" arch="aarch64">
  <version epoch="0" ver="5.7.6" rel="2.1"/>
  <changelog author="Jakub Ru&#x17E;i&#x10D;ka &lt;jakub.ruzicka@nic.cz&gt; - 5.7.6-1" date="1752753600">- upstream package
- see NEWS or https://www.knot-resolver.cz/</changelog>
</package>
<package pkgid="9b5b2fea925d736d73b688ac7d1d5707c883a1154735b5a9a9f431ff74ee0c4ddcaaf7687683dccd7cb1d4c4cf0d6db953cadf8e1c6b34c02173fc2a6f2a05d0" name="knot-resolver-debugsource" arch="aarch64">
  <version epoch="0" ver="5.7.6" rel="2.1"/>
  <changelog author="Jakub Ru&#x17E;i&#x10D;ka &lt;jakub.ruzicka@nic.cz&gt; - 5.7.6-1" date="1752753600">- upstream package
- see NEWS or https://www.knot-resolver.cz/</changelog>
</package>
<package pkgid="83928ba8a06f90e155062bbfe3452a07c389ef15feadd639ae579e33b09d5a14eb112d502ff33ab971d45c55ae08d7a1605d05b1c83a9b25d6873d0fbe1419d9" name="knot-resolver-devel" arch="aarch64">
  <version epoch="0" ver="5.7.6" rel="2.1"/>
  <changelog author="Jakub Ru&#x17E;i&#x10D;ka &lt;jakub.ruzicka@nic.cz&gt; - 5.7.6-1" date="1752753600">- upstream package
- see NEWS or https://www.knot-resolver.cz/</changelog>
</package>
<package pkgid="1fe1e78e5d6555fd62aa440d437d553e3b1168eabfe2b25f86b7b7b23207075e89a8248566b686d7550e3d019bc37106005d0c0c6c484955b8cf0ec4e692550b" name="packetdrill" arch="aarch64">
  <version epoch="0" ver="2.0" rel="2.1"/>
  <changelog author="mkubecek@suse.cz" date="1524657600">- initial import of 2.0 sources</changelog>
  <changelog author="mkubecek@suse.cz" date="1524657601">- make-build-more-consistent-with-openSUSE-packaging.patch:
  tweak the makefiles to be consistent with openSUSE policies</changelog>
  <changelog author="Michal Kube?ek &lt;mkubecek@suse.cz&gt;" date="1562846400">- suppress "address of packed member" gcc9 warning (fix Factory
  build)
- add useful post-2.0 upstream commits:
  net-test-packetdrill-allow-any-size-for-TCP_INFO-and.patch
  net-test-packetdrill-define-Linux-capability-symbols.patch
  net-test-packetdrill-loose-segmentation-checks-non-s.patch
  net-test-packetdrill-fix-error-msg-in-loose-segment-.patch
- no longer need to define CAP_BLOCK_SUSPEND for SLE11 build</changelog>
</package>
<package pkgid="7d128698cb8e53f6fa4f6dd01991fe76a91e8ce40a18d2364b02fc8a6f3dc2c166dc96c3890d824572078ae4ac641b2f2cecb91010968e2f1aa1bb9aa975f050" name="packetdrill" arch="src">
  <version epoch="0" ver="2.0" rel="2.1"/>
  <changelog author="mkubecek@suse.cz" date="1524657600">- initial import of 2.0 sources</changelog>
  <changelog author="mkubecek@suse.cz" date="1524657601">- make-build-more-consistent-with-openSUSE-packaging.patch:
  tweak the makefiles to be consistent with openSUSE policies</changelog>
  <changelog author="Michal Kube?ek &lt;mkubecek@suse.cz&gt;" date="1562846400">- suppress "address of packed member" gcc9 warning (fix Factory
  build)
- add useful post-2.0 upstream commits:
  net-test-packetdrill-allow-any-size-for-TCP_INFO-and.patch
  net-test-packetdrill-define-Linux-capability-symbols.patch
  net-test-packetdrill-loose-segmentation-checks-non-s.patch
  net-test-packetdrill-fix-error-msg-in-loose-segment-.patch
- no longer need to define CAP_BLOCK_SUSPEND for SLE11 build</changelog>
</package>
<package pkgid="f51d10e1a6571e53079f71078648ec23a861048abd2658ab0b2f67577ca67225177d58b7bf2a74977890a2173a0471547a7c03a58f8afb83d3d73ea295d43743" name="packetdrill-debuginfo" arch="aarch64">
  <version epoch="0" ver="2.0" rel="2.1"/>
  <changelog author="mkubecek@suse.cz" date="1524657600">- initial import of 2.0 sources</changelog>
  <changelog author="mkubecek@suse.cz" date="1524657601">- make-build-more-consistent-with-openSUSE-packaging.patch:
  tweak the makefiles to be consistent with openSUSE policies</changelog>
  <changelog author="Michal Kube?ek &lt;mkubecek@suse.cz&gt;" date="1562846400">- suppress "address of packed member" gcc9 warning (fix Factory
  build)
- add useful post-2.0 upstream commits:
  net-test-packetdrill-allow-any-size-for-TCP_INFO-and.patch
  net-test-packetdrill-define-Linux-capability-symbols.patch
  net-test-packetdrill-loose-segmentation-checks-non-s.patch
  net-test-packetdrill-fix-error-msg-in-loose-segment-.patch
- no longer need to define CAP_BLOCK_SUSPEND for SLE11 build</changelog>
</package>
<package pkgid="2a98b3bb21d824ffe33dbaba54f972b331c844ff31b3ef899b5a3e6a518070c7ec7f9e230a90035cbc91de421b3a67c43bcee54adc291357e6885aa4c08376b4" name="packetdrill-debugsource" arch="aarch64">
  <version epoch="0" ver="2.0" rel="2.1"/>
  <changelog author="mkubecek@suse.cz" date="1524657600">- initial import of 2.0 sources</changelog>
  <changelog author="mkubecek@suse.cz" date="1524657601">- make-build-more-consistent-with-openSUSE-packaging.patch:
  tweak the makefiles to be consistent with openSUSE policies</changelog>
  <changelog author="Michal Kube?ek &lt;mkubecek@suse.cz&gt;" date="1562846400">- suppress "address of packed member" gcc9 warning (fix Factory
  build)
- add useful post-2.0 upstream commits:
  net-test-packetdrill-allow-any-size-for-TCP_INFO-and.patch
  net-test-packetdrill-define-Linux-capability-symbols.patch
  net-test-packetdrill-loose-segmentation-checks-non-s.patch
  net-test-packetdrill-fix-error-msg-in-loose-segment-.patch
- no longer need to define CAP_BLOCK_SUSPEND for SLE11 build</changelog>
</package>
<package pkgid="99a9b661eb8bdc4c3ad471d26346c0df15230f9296b8fb1de87083161e5cf956e0acce8af46d5c1cc1aa76be9baa8e7e3ede21a487d3caef2f598a3574567fcd" name="packetdrill-tests" arch="noarch">
  <version epoch="0" ver="2.0" rel="2.1"/>
  <changelog author="mkubecek@suse.cz" date="1524657600">- initial import of 2.0 sources</changelog>
  <changelog author="mkubecek@suse.cz" date="1524657601">- make-build-more-consistent-with-openSUSE-packaging.patch:
  tweak the makefiles to be consistent with openSUSE policies</changelog>
  <changelog author="Michal Kube?ek &lt;mkubecek@suse.cz&gt;" date="1562846400">- suppress "address of packed member" gcc9 warning (fix Factory
  build)
- add useful post-2.0 upstream commits:
  net-test-packetdrill-allow-any-size-for-TCP_INFO-and.patch
  net-test-packetdrill-define-Linux-capability-symbols.patch
  net-test-packetdrill-loose-segmentation-checks-non-s.patch
  net-test-packetdrill-fix-error-msg-in-loose-segment-.patch
- no longer need to define CAP_BLOCK_SUSPEND for SLE11 build</changelog>
</package>
<package pkgid="4dd561de03668df6fd67578d033641967026715fc34f382bef158ce2f70802fb88a02e4ebb59891f50433b5d52e52904c71469825064c1fe93d9707b942366be" name="scponly" arch="aarch64">
  <version epoch="0" ver="4.8" rel="7.9"/>
  <changelog author="mike@mk-sys.cz" date="1258113600">- update to version 4.8</changelog>
  <changelog author="mike@mk-sys.cz" date="1303041600">- minor specfile cleanup
- repacked source using bzip2</changelog>
  <changelog author="mkubecek@suse.cz" date="1322222400">- moved to BuildService</changelog>
  <changelog author="mkubecek@suse.cz" date="1328184000">- update URL tag</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1613044800">- use SPDX license tag to silence post-build checks</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1613044801">- configure.in-add-another-possible-path-for-sftp-serv.patch:
  fix Factory build failure after sftp-server path change</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1746878400">- update specfile to "modern" %patch syntax</changelog>
</package>
<package pkgid="a0247986976a377689a1628b80d4fcbd05fa21d33cf251b20a402d0351b9dc1bf43a245f4f6e65fb9709d4ae18702bf1635ec98653d65677c3aff66d2b99582a" name="scponly" arch="src">
  <version epoch="0" ver="4.8" rel="7.9"/>
  <changelog author="mike@mk-sys.cz" date="1258113600">- update to version 4.8</changelog>
  <changelog author="mike@mk-sys.cz" date="1303041600">- minor specfile cleanup
- repacked source using bzip2</changelog>
  <changelog author="mkubecek@suse.cz" date="1322222400">- moved to BuildService</changelog>
  <changelog author="mkubecek@suse.cz" date="1328184000">- update URL tag</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1613044800">- use SPDX license tag to silence post-build checks</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1613044801">- configure.in-add-another-possible-path-for-sftp-serv.patch:
  fix Factory build failure after sftp-server path change</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1746878400">- update specfile to "modern" %patch syntax</changelog>
</package>
<package pkgid="c31dd1f8e6eefc0cfa6f741a6fa91d935e5bd358e5c216b90879ebb7f3c95a863996c5928aab5271a4bafe56d91f10806ac5f307f45e019ae524bc4ecb3df8c9" name="scponly-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.8" rel="7.9"/>
  <changelog author="mike@mk-sys.cz" date="1258113600">- update to version 4.8</changelog>
  <changelog author="mike@mk-sys.cz" date="1303041600">- minor specfile cleanup
- repacked source using bzip2</changelog>
  <changelog author="mkubecek@suse.cz" date="1322222400">- moved to BuildService</changelog>
  <changelog author="mkubecek@suse.cz" date="1328184000">- update URL tag</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1613044800">- use SPDX license tag to silence post-build checks</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1613044801">- configure.in-add-another-possible-path-for-sftp-serv.patch:
  fix Factory build failure after sftp-server path change</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1746878400">- update specfile to "modern" %patch syntax</changelog>
</package>
<package pkgid="bd55ca8f4708e7d07b958543754ef4a494f950e67ce7756c5bd5bbc5566081f517ac8e4521e176a1989d0fc695d7238cd69f2915dc0d186c4cd62eb8d2b06c26" name="scponly-debugsource" arch="aarch64">
  <version epoch="0" ver="4.8" rel="7.9"/>
  <changelog author="mike@mk-sys.cz" date="1258113600">- update to version 4.8</changelog>
  <changelog author="mike@mk-sys.cz" date="1303041600">- minor specfile cleanup
- repacked source using bzip2</changelog>
  <changelog author="mkubecek@suse.cz" date="1322222400">- moved to BuildService</changelog>
  <changelog author="mkubecek@suse.cz" date="1328184000">- update URL tag</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1613044800">- use SPDX license tag to silence post-build checks</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1613044801">- configure.in-add-another-possible-path-for-sftp-serv.patch:
  fix Factory build failure after sftp-server path change</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1746878400">- update specfile to "modern" %patch syntax</changelog>
</package>
<package pkgid="f58635826a477732a4284e021ec4fe11755723a0ce1002bbfcac14e5dd0cb8dbd4511791f736d1a507bcfee8be6caf403243898aab49ee220ab0dc6d076d44d2" name="stunnel" arch="aarch64">
  <version epoch="0" ver="5.57" rel="5.57"/>
  <changelog author="mkubecek@suse.cz" date="1452600000">- upgrade to upstream version 5.29
  * fix the "s_poll_wait returned 1, but no descriptor is ready"
    internal error
  * fix "exec" hangs due to incorrect thread-local storage handling
  * fix PRNG initialization
  * fix incomplete initialization
  * fix exit codes for information requests (as in "stunnel
  - version" or "stunnel -help")
  * fix configuration file reload for relative stunnel.conf path on
    Unix
  * fix ignoring CRLfile unless CAfile was also specified
  * setting socket options no longer performed on PTYs
  * SMTP client protocol negotiation support for
    "protocolUsername", "protocolPassword", and
    "protocolAuthentication"
  * new service-level option "config" to specify configuration
    commands introduced in OpenSSL 1.0.2
  * improved compatibility with the current OpenSSL 1.1.0-dev tree
  * added reading server certificates from hardware engines
  * performance improvement: rwlocks used for locking with pthreads</changelog>
  <changelog author="mkubecek@suse.cz" date="1474891200">- upgrade to upstream version 5.36
  * only reset the watchdog if some data was actually transferred
  * fixed logging an incorrect value of the round-robin starting
    point
  * fixed a TLS session caching memory leak; before stunnel 5.27
    this leak only emerged with sessiond enabled
  * fixed a FORK threading build regression bug
  * OPENSSL_NO_DH compilation fix
  * fixed malfunctioning "verify = 4"
  * fixed incorrectly enforced client certificate requests
  * fixed thread safety of the configuration file reopening
  * improved compatibility with the current OpenSSL 1.1.0-dev tree
  * added logging the list of client CAs requested by the server
  * new "socket = a:IPV6_V6ONLY=yes" option to only bind IPv6
  * memory leak detection
  * SNI support also enabled on OpenSSL 0.9.8f and later
  * added support for PKCS #12 (.p12/.pfx) certificates
  * added three new service-level options: requireCert,
    verifyChain, and verifyPeer for fine-grained certificate
    verification control
  * removed direct zlib dependency
- use original gzipped tarball again
- add tarball signature and public key
- specfile cleanup</changelog>
  <changelog author="mkubecek@suse.cz" date="1480075200">- upgrade to upstream version 5.38
  * the default SNI target (not handled by any slave service) is
    handled by the master service rather than rejected
  * removed thread synchronization in the FORK threading model</changelog>
  <changelog author="mkubecek@suse.cz" date="1517400000">- upgrade to upstream version 5.44
  * "sni=" can be used to prevent sending the SNI extension
  * the AI_ADDRCONFIG resolver flag is used when available
  * fixed a memory allocation bug causing crashes with OpenSSL
    1.1.0
  * fixed error handling for mixed IPv4/IPv6 destinations
  * per-destination TLS session cache added for the client mode
  * new "logId" parameter "process" added to log PID values
  * added support for the new SSL_set_options() values
  * fixed "logId" parameter to also work in inetd mode
  * "delay = yes" properly enforces "failover = prio"
  * fixed resolving addresses with unconfigured network interfaces
  * DH ciphersuites are now disabled by default
  * daily server DH parameter regeneration is only performed if DH
    ciphersuites are enabled in the configuration file
  * "checkHost" and "checkEmail" were modified to require either
    "verifyChain" or "verifyPeer"
  * fixed setting default ciphers
  * default engine UI set with ENGINE_CTRL_SET_USER_INTERFACE
  * key file name added into the passphrase console prompt
  * performance optimization in memory leak detection
  * fixed crashes with the OpenSSL 1.1.0 branch
  * fixed certificate verification with "verifyPeer = yes" and
    "verifyChain = no" (the default), while the peer only returns a
    single certificate
  * "redirect" also supports "exec" and not only "connect"
  * fixed premature cron thread initialization causing hangs
  * fixed "verifyPeer = yes" on OpenSSL &lt;= 1.0.1
  * allow for multiple "accept" ports per section
  * self-test framework (make check)
  * added config load before OpenSSL init
  * openSSL 1.1.1-dev compilation fixes
  * fixed round-robin failover in the FORK threading model
  * fixed handling SSL_ERROR_ZERO_RETURN in SSL_shutdown()
  * minor fixes of the logging subsystem
  * default accept address restored to INADDR_ANY
  * fixed removing the pid file after configuration reload
  * updated documentation
- adjust to new Factory checks</changelog>
  <changelog author="mkubecek@suse.cz" date="1517400001">- Factory build now requires us to use %{_fillupdir} macro but
  it's only defined in Factory... so let's jump through some more
  hoops to make people with "Factory only" thinking happy</changelog>
  <changelog author="mkubecek@suse.cz" date="1527422400">- upgrade to upstream version 5.45
  * delayed deallocation of service sections after configuration file reload
  * deprecated the sslVersion option
  * the "socket" option is now also available in service sections
  * implemented try-restart in the SysV init script
  * TLS 1.3 compliant session handling for OpenSSL 1.1.1
  * default "failover" value changed from "rr" to "prio"
  * new "make check" tests</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1556280000">- upgrade to upstream version 5.53
  * update default cipher list to a safer value
  * restore default accept address to INADDR_ANY
  * fix requesting client certificate when specified by global
    option
  * certificate subject checks modified to accept certificates if
    at least one of the specified checks matches
  * log negotiated or resumed TLS session IDs
  * check whether "output" is not a relative file name
  * add sslVersion, sslVersionMin and sslVersionMax for OpenSSL
    1.1.0 and later
  * automatically convert hex PSK keys to binary
  * SMTP HELO before authentication
  * new "curves" option to control the list of elliptic curves in
    openssl &gt;= 1.1.0
  * new "ciphersuites" option to control the list of permitted TLS
    1.3 ciphersuites
  * include file name and line number in OpenSSL errors
  * compatibility with the current OpenSSL 3.0.0-dev branch
  * various performance improvements
  * error message improvements</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1613044800">- add rpmlintrc to suppress bogus build errors in Factory</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1613044801">- update stunnel.keyring with new developer key
- upgrade to upstream version 5.57
  * new "ticketKeySecret" and "ticketMacSecret" options
  * add logging the list of active connections on SIGUSR2
  * logging of the assigned bind address instead of the requested
    bind address
  * terminate service threads before OpenSSL cleanup to prevent
    occasional stunnel crashes at shutdown
  * support for engines without PRNG seeding methods
  * retry unsuccessful port binding on configuration file reload
  * terminate clients on exit in the FORK threading model
  * fix "redirect" option to properly handle "verifyChain = yes"
  * new securityLevel configuration file option
  * support for modern PostgreSQL clients
  * TLS 1.3 configuration updated for better compatibility
  * various fixes</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1665662400">- rpmlintrc: more general filters for bogus check errors</changelog>
</package>
<package pkgid="e838ea3e73a2b9ea20160bc55e43591b1e32126f87311bf1ac9fd45e44d306c289c203ce4b4524cdeaa63b71c6ffa5c949b41ea44dccb25c2656932fa242a329" name="stunnel" arch="src">
  <version epoch="0" ver="5.57" rel="5.57"/>
  <changelog author="mkubecek@suse.cz" date="1350388800">- upgrade to upstream version 4.54
  * fixed "Application Failed to Initialize Properly (0xc0150002)"
    error
  * fixed missing SSL state debug log entries
  * fixed a race condition in libwrap code resulting in random
    stalls
  * session cache purged at configuration file reload to reduce
    memory leak
  * fixed bug in "transparent = destination" functionality
    (regression introduced in 4.51)
  * "transparent = destination" is now a valid endpoint in inetd
    mode
  * multiple "connect" targets fixed to also work with delayed
    resolver
  * the number of resolver retries of EAI_AGAIN error has been
    limited to 3 in order to prevent infinite loops
  * new service level options sessionCacheSize, reset and
    renegotiation
  * new parameters to configure TLS v1.1/v1.2 with OpenSSL version
    1.0.1 or higher
- really use more CPU's for build (fix typo in _smp_mflags)</changelog>
  <changelog author="mkubecek@suse.cz" date="1363608000">- upgrade to upstream version 4.55
  * Buffer overflow vulnerability fixed in the NTLM authentication
    of the CONNECT protocol negotiation (CVE-2013-1762)
  * Fixed write half-close handling in the transfer() function
  * Fixed EAGAIN error handling in the transfer() function
  * Restored default signal handlers before execvp()
  * Fixed memory leaks in protocol negotiation
  * Fixed a file descriptor leak during configuration file reload
  * Closed SSL sockets were removed from the the transfer() c-&gt;fds
    poll
  * Minor fix in handling exotic inetd-mode configurations
  * IPv6 compilation fix in protocol.c
  * Feature: SNI wildcard matching in server mode</changelog>
  <changelog author="mkubecek@suse.cz" date="1364990400">- upgrade to upstream version 4.56
  * Fixed a regression bug introduced in version 4.55 causing
    random crashes on several platforms
  * Fixed incorrect "stunnel -exit" process synchronisation
  * Fixed FIPS detection with new versions of the OpenSSL library
  * Failure to open the log file at startup is no longer ignored</changelog>
  <changelog author="mkubecek@suse.cz" date="1401278400">- upgrade to upstream version 5.01
  * Added PRNG state update in fork threading (CVE-2014-0016)
  * Default "fips" option value is now "no"
  * Default "pid" is now "", i.e. not to create a pid file at startup
  * Default "ciphers" updated to "HIGH:MEDIUM:+3DES:+DH:!aNULL:!SSLv2"
  * Default "libwrap" setting is now "no" to improve performance.
  * TLS 1.1 and TLS 1.2 are now allowed in the FIPS mode
  * New service-level option "redirect" to redirect SSL client
    connections on authentication failures instead of rejecting them
  * New global "engineDefault" configuration file option to control
    which OpenSSL tasks are delegated to the current engine
  * New service-level configuration file option "engineId" to
    select the engine by identifier
  * New global configuration file option "log" to control whether
    to append (the default), or to overwrite log file while
    (re)opening
  * Improved readability of error messages printed when stunnel
    refuses to start due to a critical error.
  * Search all certificates with the same subject name for a
    matching public key rather than only the first one
- stunnel-4.53-dont-generate-certificate.patch:
  deleted (no longer needed)</changelog>
  <changelog author="mkubecek@suse.cz" date="1409832000">- upgrade to upstream version 5.03
  * it is now possible to add protocol negotiations at multiple
    connection phases
  * protocols can individually decide whether the remote connection
    will be established before or after SSL/TLS is negotiated
  * heap memory blocks are wiped before release
  * safe_memcmp() function implemented with execution time not
    dependent on the compared data
  * fixed "failover = rr" broken since version 5.00
  * fixed "taskbar = no" broken since version 5.00
  * FIPS autoconfiguration cleanup
  * FIPS canister updated to version 2.0.6
  * improved SNI diagnostic logging
  * fixed whitespace handling in the stunnel.init script</changelog>
  <changelog author="mkubecek@suse.cz" date="1415102400">- upgrade to upstream version 5.07
  * support for UTF-8 config file and log file
  * missing REMOTE_PORT environmental variable is provided to
    processes spawned with "exec" on Unix platforms
  * The parameter of "options" can now be prefixed with "-" to
    clear an SSL option, for example:
    "options = -LEGACY_SERVER_CONNECT"
  * fixed POLLIN|POLLHUP condition handling error resulting in
    prematurely closed (truncated) connection
  * fixed a null pointer dereference regression bug in the
    "transparent = destination" functionality
  * fixed erroneously closed stdin/stdout/stderr if specified as
    the -fd commandline option parameter
  * the insecure SSLv2 protocol is now disabled by default.
    It can be enabled with "options = -NO_SSLv2".
  * the insecure SSLv3 protocol is now disabled by default.
    It can be enabled with "options = -NO_SSLv3".
  * default sslVersion changed to "all" (also in FIPS mode) to
    autonegotiate the highest supported TLS version.
  * added missing SSL options to match OpenSSL 1.0.1j
  * new "-options" commandline option to display the list of
    supported SSL options
  * fixed FORK threading build regression bug
  * several SMTP server protocol negotiation improvements
  * DH parameters are no longer generated by "make cert"
  * new --disable-systemd ./configure option
  * setuid/setgid commented out in stunnel.conf-sample
  * compilation fix for OpenSSL with disabled SSLv2 or SSLv3
  * non-blocking mode set on inetd and systemd descriptors</changelog>
  <changelog author="mkubecek@suse.cz" date="1415102401">- add missing tarball</changelog>
  <changelog author="mkubecek@suse.cz" date="1435579200">- upgrade to upstream version 5.19
  * add SOCKS 4/5 protocol support
  * fixed improper hangup condition handling
  * fixed missing -pic linker option
  * added PSK authentication with two new service-level
    configuration file options "PSKsecrets" and "PSKidentity"
  * added additional security checks to the OpenSSL memory
    management functions
  * added support for the OPENSSL_NO_OCSP and OPENSSL_NO_ENGINE
    OpenSSL configuration flags
  * added compatibility with the current OpenSSL 1.1.0-dev tree
  * removed defective s_poll_error() code occasionally causing
    connections to be prematurely closed (truncated)
  * fix OpenSSL compatibility
  * OCSP AIA (Authority Information Access) support
  * additional security features of the linker are enabled:
    "-z relro", "-z now", "-z noexecstack"
  * removed dereferences of internal OpenSSL data structures
  * PSK key lookup algorithm performance improved from O(N)
    (linear) to O(log N) (logarithmic)
  * new service-level option "logId" to specify the connection
    identifier type
  * new service-level option "debug" to individually control
    logging verbosity of defined services
  * the "service" option was modified to also control the syslog
    service name
  * the "redirect" option now also redirects clients on SSL session
    reuse
  * fixed a memory allocation error during Unix daemon shutdown
  * fixed handling multiple connect/redirect destinations
  * added new service-level options "checkHost", "checkEmail" and
    "checkIP" for additional checks of the peer certificate subject
  * added session persistence based on negotiated TLS sessions
  * MEDIUM ciphers (currently SEED and RC4) are removed from the
    default cipher list
  * the "redirect" option was improved to not only redirect
    sessions established with an untrusted certificate, but also
    sessions established without a client certificate
  * OpenSSL version checking modified to distinguish FIPS and
    non-FIPS builds
  * randomize the initial value of the round-robin counter
  * new stunnel.conf templates are provided
  * fixed memory leaks in certificate verification
  * fixed a NULL pointer dereference causing the service to crash
  * added "include" configuration file option to include all
    configuration file parts located in a specified directory
  * log file is reopened every 24 hours.  With "log = overwrite"
    this feature can be used to prevent filling up disk space
  * temporary DH parameters are refreshed every 24 hours, unless
    static DH parameters were provided in the certificate file
  * unique initial DH parameters are distributed with each release
  * warnings are logged on potentially insecure authentication
  * added a runtime check whether COMP_zlib() method is implemented
    in order to improve compatibility with the Debian OpenSSL build
  * improved socket error handling
  * fixed some typos in docs and scripts
  * fixed a log level check condition
- fix build on SLE11</changelog>
  <changelog author="mkubecek@suse.cz" date="1437998400">- upgrade to upstream version 5.20
  * The SSL library detection algorithm was made a bit smarter
  * warnings about insecure authentication were modified to include
    the name of the affected service section
  * a warning was added to stunnel.init if no pid file was
    specified in the configuration file
  * signal pipe reinitialization added to prevent turning the main
    accepting thread into a busy wait loop when an external
    condition breaks the signal pipe
  * generated temporary DH parameters are used for configuration
    reload instead of the static defaults
  * LSB compatibility fixes added to the stunnel.init script</changelog>
  <changelog author="mkubecek@suse.cz" date="1445515200">- upgrade to upstream version 5.24
  * fixed the FORK and UCONTEXT threading support
  * fixed "failover=prio" (broken since stunnel 5.15
  * added a retry when sleep(3) was interrupted by a signal in the
    cron thread scheduler
  * signal names are displayed instead of numbers
  * first resolve IPv4 addresses on passive resolver requests
  * fixed a number of OCSP bugs.  The most severe of those bugs
    caused stunnel to treat OCSP responses that failed
    OCSP_basic_verify() checks as if they were successful
  * "OCSPaia = yes" added to the configuration file templates
  * improved double free detection
  * client-side support for the SOCKS protocol
  * reject SOCKS requests to connect loopback addresses
  * new service-level option "OCSPnonce"
  * the ca-certs.pem file is now updated on stunnel upgrade
  * added IPv6 support to the transparent proxy code
  * fixed the RESOLVE [F0] TOR extension support in SOCKS5
  * fixed the error code reported on the failed bind() requests
  * fixed the sequential log id with the FORK threading
  * custom CRL verification was replaced with the internal OpenSSL
    functionality
  * added a new "protocolDomain" option for the NTLM authentication
  * improved compatibility of the NTLM phase 1 message
  * "setuid" and "setgid" options are now also available in service
    sections.  They can be used to set owner and group of the Unix
    socket specified with "accept"
  * added support for the new OpenSSL 1.0.2 SSL options
  * added OPENSSL_NO_EGD support</changelog>
  <changelog author="mkubecek@suse.cz" date="1452600000">- upgrade to upstream version 5.29
  * fix the "s_poll_wait returned 1, but no descriptor is ready"
    internal error
  * fix "exec" hangs due to incorrect thread-local storage handling
  * fix PRNG initialization
  * fix incomplete initialization
  * fix exit codes for information requests (as in "stunnel
  - version" or "stunnel -help")
  * fix configuration file reload for relative stunnel.conf path on
    Unix
  * fix ignoring CRLfile unless CAfile was also specified
  * setting socket options no longer performed on PTYs
  * SMTP client protocol negotiation support for
    "protocolUsername", "protocolPassword", and
    "protocolAuthentication"
  * new service-level option "config" to specify configuration
    commands introduced in OpenSSL 1.0.2
  * improved compatibility with the current OpenSSL 1.1.0-dev tree
  * added reading server certificates from hardware engines
  * performance improvement: rwlocks used for locking with pthreads</changelog>
  <changelog author="mkubecek@suse.cz" date="1474891200">- upgrade to upstream version 5.36
  * only reset the watchdog if some data was actually transferred
  * fixed logging an incorrect value of the round-robin starting
    point
  * fixed a TLS session caching memory leak; before stunnel 5.27
    this leak only emerged with sessiond enabled
  * fixed a FORK threading build regression bug
  * OPENSSL_NO_DH compilation fix
  * fixed malfunctioning "verify = 4"
  * fixed incorrectly enforced client certificate requests
  * fixed thread safety of the configuration file reopening
  * improved compatibility with the current OpenSSL 1.1.0-dev tree
  * added logging the list of client CAs requested by the server
  * new "socket = a:IPV6_V6ONLY=yes" option to only bind IPv6
  * memory leak detection
  * SNI support also enabled on OpenSSL 0.9.8f and later
  * added support for PKCS #12 (.p12/.pfx) certificates
  * added three new service-level options: requireCert,
    verifyChain, and verifyPeer for fine-grained certificate
    verification control
  * removed direct zlib dependency
- use original gzipped tarball again
- add tarball signature and public key
- specfile cleanup</changelog>
  <changelog author="mkubecek@suse.cz" date="1480075200">- upgrade to upstream version 5.38
  * the default SNI target (not handled by any slave service) is
    handled by the master service rather than rejected
  * removed thread synchronization in the FORK threading model</changelog>
  <changelog author="mkubecek@suse.cz" date="1517400000">- upgrade to upstream version 5.44
  * "sni=" can be used to prevent sending the SNI extension
  * the AI_ADDRCONFIG resolver flag is used when available
  * fixed a memory allocation bug causing crashes with OpenSSL
    1.1.0
  * fixed error handling for mixed IPv4/IPv6 destinations
  * per-destination TLS session cache added for the client mode
  * new "logId" parameter "process" added to log PID values
  * added support for the new SSL_set_options() values
  * fixed "logId" parameter to also work in inetd mode
  * "delay = yes" properly enforces "failover = prio"
  * fixed resolving addresses with unconfigured network interfaces
  * DH ciphersuites are now disabled by default
  * daily server DH parameter regeneration is only performed if DH
    ciphersuites are enabled in the configuration file
  * "checkHost" and "checkEmail" were modified to require either
    "verifyChain" or "verifyPeer"
  * fixed setting default ciphers
  * default engine UI set with ENGINE_CTRL_SET_USER_INTERFACE
  * key file name added into the passphrase console prompt
  * performance optimization in memory leak detection
  * fixed crashes with the OpenSSL 1.1.0 branch
  * fixed certificate verification with "verifyPeer = yes" and
    "verifyChain = no" (the default), while the peer only returns a
    single certificate
  * "redirect" also supports "exec" and not only "connect"
  * fixed premature cron thread initialization causing hangs
  * fixed "verifyPeer = yes" on OpenSSL &lt;= 1.0.1
  * allow for multiple "accept" ports per section
  * self-test framework (make check)
  * added config load before OpenSSL init
  * openSSL 1.1.1-dev compilation fixes
  * fixed round-robin failover in the FORK threading model
  * fixed handling SSL_ERROR_ZERO_RETURN in SSL_shutdown()
  * minor fixes of the logging subsystem
  * default accept address restored to INADDR_ANY
  * fixed removing the pid file after configuration reload
  * updated documentation
- adjust to new Factory checks</changelog>
  <changelog author="mkubecek@suse.cz" date="1517400001">- Factory build now requires us to use %{_fillupdir} macro but
  it's only defined in Factory... so let's jump through some more
  hoops to make people with "Factory only" thinking happy</changelog>
  <changelog author="mkubecek@suse.cz" date="1527422400">- upgrade to upstream version 5.45
  * delayed deallocation of service sections after configuration file reload
  * deprecated the sslVersion option
  * the "socket" option is now also available in service sections
  * implemented try-restart in the SysV init script
  * TLS 1.3 compliant session handling for OpenSSL 1.1.1
  * default "failover" value changed from "rr" to "prio"
  * new "make check" tests</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1556280000">- upgrade to upstream version 5.53
  * update default cipher list to a safer value
  * restore default accept address to INADDR_ANY
  * fix requesting client certificate when specified by global
    option
  * certificate subject checks modified to accept certificates if
    at least one of the specified checks matches
  * log negotiated or resumed TLS session IDs
  * check whether "output" is not a relative file name
  * add sslVersion, sslVersionMin and sslVersionMax for OpenSSL
    1.1.0 and later
  * automatically convert hex PSK keys to binary
  * SMTP HELO before authentication
  * new "curves" option to control the list of elliptic curves in
    openssl &gt;= 1.1.0
  * new "ciphersuites" option to control the list of permitted TLS
    1.3 ciphersuites
  * include file name and line number in OpenSSL errors
  * compatibility with the current OpenSSL 3.0.0-dev branch
  * various performance improvements
  * error message improvements</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1613044800">- add rpmlintrc to suppress bogus build errors in Factory</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1613044801">- update stunnel.keyring with new developer key
- upgrade to upstream version 5.57
  * new "ticketKeySecret" and "ticketMacSecret" options
  * add logging the list of active connections on SIGUSR2
  * logging of the assigned bind address instead of the requested
    bind address
  * terminate service threads before OpenSSL cleanup to prevent
    occasional stunnel crashes at shutdown
  * support for engines without PRNG seeding methods
  * retry unsuccessful port binding on configuration file reload
  * terminate clients on exit in the FORK threading model
  * fix "redirect" option to properly handle "verifyChain = yes"
  * new securityLevel configuration file option
  * support for modern PostgreSQL clients
  * TLS 1.3 configuration updated for better compatibility
  * various fixes</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1665662400">- rpmlintrc: more general filters for bogus check errors</changelog>
</package>
<package pkgid="2b45823870958c00f62a06869ea196b20b1cce991fa4a24ad4ca26305dac16fa6d647cfd8e87eda346ab404733f6f122faaf5457e064f3c968d508982705fb5a" name="stunnel-debuginfo" arch="aarch64">
  <version epoch="0" ver="5.57" rel="5.57"/>
  <changelog author="mkubecek@suse.cz" date="1452600000">- upgrade to upstream version 5.29
  * fix the "s_poll_wait returned 1, but no descriptor is ready"
    internal error
  * fix "exec" hangs due to incorrect thread-local storage handling
  * fix PRNG initialization
  * fix incomplete initialization
  * fix exit codes for information requests (as in "stunnel
  - version" or "stunnel -help")
  * fix configuration file reload for relative stunnel.conf path on
    Unix
  * fix ignoring CRLfile unless CAfile was also specified
  * setting socket options no longer performed on PTYs
  * SMTP client protocol negotiation support for
    "protocolUsername", "protocolPassword", and
    "protocolAuthentication"
  * new service-level option "config" to specify configuration
    commands introduced in OpenSSL 1.0.2
  * improved compatibility with the current OpenSSL 1.1.0-dev tree
  * added reading server certificates from hardware engines
  * performance improvement: rwlocks used for locking with pthreads</changelog>
  <changelog author="mkubecek@suse.cz" date="1474891200">- upgrade to upstream version 5.36
  * only reset the watchdog if some data was actually transferred
  * fixed logging an incorrect value of the round-robin starting
    point
  * fixed a TLS session caching memory leak; before stunnel 5.27
    this leak only emerged with sessiond enabled
  * fixed a FORK threading build regression bug
  * OPENSSL_NO_DH compilation fix
  * fixed malfunctioning "verify = 4"
  * fixed incorrectly enforced client certificate requests
  * fixed thread safety of the configuration file reopening
  * improved compatibility with the current OpenSSL 1.1.0-dev tree
  * added logging the list of client CAs requested by the server
  * new "socket = a:IPV6_V6ONLY=yes" option to only bind IPv6
  * memory leak detection
  * SNI support also enabled on OpenSSL 0.9.8f and later
  * added support for PKCS #12 (.p12/.pfx) certificates
  * added three new service-level options: requireCert,
    verifyChain, and verifyPeer for fine-grained certificate
    verification control
  * removed direct zlib dependency
- use original gzipped tarball again
- add tarball signature and public key
- specfile cleanup</changelog>
  <changelog author="mkubecek@suse.cz" date="1480075200">- upgrade to upstream version 5.38
  * the default SNI target (not handled by any slave service) is
    handled by the master service rather than rejected
  * removed thread synchronization in the FORK threading model</changelog>
  <changelog author="mkubecek@suse.cz" date="1517400000">- upgrade to upstream version 5.44
  * "sni=" can be used to prevent sending the SNI extension
  * the AI_ADDRCONFIG resolver flag is used when available
  * fixed a memory allocation bug causing crashes with OpenSSL
    1.1.0
  * fixed error handling for mixed IPv4/IPv6 destinations
  * per-destination TLS session cache added for the client mode
  * new "logId" parameter "process" added to log PID values
  * added support for the new SSL_set_options() values
  * fixed "logId" parameter to also work in inetd mode
  * "delay = yes" properly enforces "failover = prio"
  * fixed resolving addresses with unconfigured network interfaces
  * DH ciphersuites are now disabled by default
  * daily server DH parameter regeneration is only performed if DH
    ciphersuites are enabled in the configuration file
  * "checkHost" and "checkEmail" were modified to require either
    "verifyChain" or "verifyPeer"
  * fixed setting default ciphers
  * default engine UI set with ENGINE_CTRL_SET_USER_INTERFACE
  * key file name added into the passphrase console prompt
  * performance optimization in memory leak detection
  * fixed crashes with the OpenSSL 1.1.0 branch
  * fixed certificate verification with "verifyPeer = yes" and
    "verifyChain = no" (the default), while the peer only returns a
    single certificate
  * "redirect" also supports "exec" and not only "connect"
  * fixed premature cron thread initialization causing hangs
  * fixed "verifyPeer = yes" on OpenSSL &lt;= 1.0.1
  * allow for multiple "accept" ports per section
  * self-test framework (make check)
  * added config load before OpenSSL init
  * openSSL 1.1.1-dev compilation fixes
  * fixed round-robin failover in the FORK threading model
  * fixed handling SSL_ERROR_ZERO_RETURN in SSL_shutdown()
  * minor fixes of the logging subsystem
  * default accept address restored to INADDR_ANY
  * fixed removing the pid file after configuration reload
  * updated documentation
- adjust to new Factory checks</changelog>
  <changelog author="mkubecek@suse.cz" date="1517400001">- Factory build now requires us to use %{_fillupdir} macro but
  it's only defined in Factory... so let's jump through some more
  hoops to make people with "Factory only" thinking happy</changelog>
  <changelog author="mkubecek@suse.cz" date="1527422400">- upgrade to upstream version 5.45
  * delayed deallocation of service sections after configuration file reload
  * deprecated the sslVersion option
  * the "socket" option is now also available in service sections
  * implemented try-restart in the SysV init script
  * TLS 1.3 compliant session handling for OpenSSL 1.1.1
  * default "failover" value changed from "rr" to "prio"
  * new "make check" tests</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1556280000">- upgrade to upstream version 5.53
  * update default cipher list to a safer value
  * restore default accept address to INADDR_ANY
  * fix requesting client certificate when specified by global
    option
  * certificate subject checks modified to accept certificates if
    at least one of the specified checks matches
  * log negotiated or resumed TLS session IDs
  * check whether "output" is not a relative file name
  * add sslVersion, sslVersionMin and sslVersionMax for OpenSSL
    1.1.0 and later
  * automatically convert hex PSK keys to binary
  * SMTP HELO before authentication
  * new "curves" option to control the list of elliptic curves in
    openssl &gt;= 1.1.0
  * new "ciphersuites" option to control the list of permitted TLS
    1.3 ciphersuites
  * include file name and line number in OpenSSL errors
  * compatibility with the current OpenSSL 3.0.0-dev branch
  * various performance improvements
  * error message improvements</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1613044800">- add rpmlintrc to suppress bogus build errors in Factory</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1613044801">- update stunnel.keyring with new developer key
- upgrade to upstream version 5.57
  * new "ticketKeySecret" and "ticketMacSecret" options
  * add logging the list of active connections on SIGUSR2
  * logging of the assigned bind address instead of the requested
    bind address
  * terminate service threads before OpenSSL cleanup to prevent
    occasional stunnel crashes at shutdown
  * support for engines without PRNG seeding methods
  * retry unsuccessful port binding on configuration file reload
  * terminate clients on exit in the FORK threading model
  * fix "redirect" option to properly handle "verifyChain = yes"
  * new securityLevel configuration file option
  * support for modern PostgreSQL clients
  * TLS 1.3 configuration updated for better compatibility
  * various fixes</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1665662400">- rpmlintrc: more general filters for bogus check errors</changelog>
</package>
<package pkgid="652048b50c193556e18017ab90910deccec0ac8ac821c1c75ef4ba974cc9b418975c31908a0242a58d2dde27f96367ad20b681a53c15792d3bd57f01bf20a172" name="stunnel-debugsource" arch="aarch64">
  <version epoch="0" ver="5.57" rel="5.57"/>
  <changelog author="mkubecek@suse.cz" date="1452600000">- upgrade to upstream version 5.29
  * fix the "s_poll_wait returned 1, but no descriptor is ready"
    internal error
  * fix "exec" hangs due to incorrect thread-local storage handling
  * fix PRNG initialization
  * fix incomplete initialization
  * fix exit codes for information requests (as in "stunnel
  - version" or "stunnel -help")
  * fix configuration file reload for relative stunnel.conf path on
    Unix
  * fix ignoring CRLfile unless CAfile was also specified
  * setting socket options no longer performed on PTYs
  * SMTP client protocol negotiation support for
    "protocolUsername", "protocolPassword", and
    "protocolAuthentication"
  * new service-level option "config" to specify configuration
    commands introduced in OpenSSL 1.0.2
  * improved compatibility with the current OpenSSL 1.1.0-dev tree
  * added reading server certificates from hardware engines
  * performance improvement: rwlocks used for locking with pthreads</changelog>
  <changelog author="mkubecek@suse.cz" date="1474891200">- upgrade to upstream version 5.36
  * only reset the watchdog if some data was actually transferred
  * fixed logging an incorrect value of the round-robin starting
    point
  * fixed a TLS session caching memory leak; before stunnel 5.27
    this leak only emerged with sessiond enabled
  * fixed a FORK threading build regression bug
  * OPENSSL_NO_DH compilation fix
  * fixed malfunctioning "verify = 4"
  * fixed incorrectly enforced client certificate requests
  * fixed thread safety of the configuration file reopening
  * improved compatibility with the current OpenSSL 1.1.0-dev tree
  * added logging the list of client CAs requested by the server
  * new "socket = a:IPV6_V6ONLY=yes" option to only bind IPv6
  * memory leak detection
  * SNI support also enabled on OpenSSL 0.9.8f and later
  * added support for PKCS #12 (.p12/.pfx) certificates
  * added three new service-level options: requireCert,
    verifyChain, and verifyPeer for fine-grained certificate
    verification control
  * removed direct zlib dependency
- use original gzipped tarball again
- add tarball signature and public key
- specfile cleanup</changelog>
  <changelog author="mkubecek@suse.cz" date="1480075200">- upgrade to upstream version 5.38
  * the default SNI target (not handled by any slave service) is
    handled by the master service rather than rejected
  * removed thread synchronization in the FORK threading model</changelog>
  <changelog author="mkubecek@suse.cz" date="1517400000">- upgrade to upstream version 5.44
  * "sni=" can be used to prevent sending the SNI extension
  * the AI_ADDRCONFIG resolver flag is used when available
  * fixed a memory allocation bug causing crashes with OpenSSL
    1.1.0
  * fixed error handling for mixed IPv4/IPv6 destinations
  * per-destination TLS session cache added for the client mode
  * new "logId" parameter "process" added to log PID values
  * added support for the new SSL_set_options() values
  * fixed "logId" parameter to also work in inetd mode
  * "delay = yes" properly enforces "failover = prio"
  * fixed resolving addresses with unconfigured network interfaces
  * DH ciphersuites are now disabled by default
  * daily server DH parameter regeneration is only performed if DH
    ciphersuites are enabled in the configuration file
  * "checkHost" and "checkEmail" were modified to require either
    "verifyChain" or "verifyPeer"
  * fixed setting default ciphers
  * default engine UI set with ENGINE_CTRL_SET_USER_INTERFACE
  * key file name added into the passphrase console prompt
  * performance optimization in memory leak detection
  * fixed crashes with the OpenSSL 1.1.0 branch
  * fixed certificate verification with "verifyPeer = yes" and
    "verifyChain = no" (the default), while the peer only returns a
    single certificate
  * "redirect" also supports "exec" and not only "connect"
  * fixed premature cron thread initialization causing hangs
  * fixed "verifyPeer = yes" on OpenSSL &lt;= 1.0.1
  * allow for multiple "accept" ports per section
  * self-test framework (make check)
  * added config load before OpenSSL init
  * openSSL 1.1.1-dev compilation fixes
  * fixed round-robin failover in the FORK threading model
  * fixed handling SSL_ERROR_ZERO_RETURN in SSL_shutdown()
  * minor fixes of the logging subsystem
  * default accept address restored to INADDR_ANY
  * fixed removing the pid file after configuration reload
  * updated documentation
- adjust to new Factory checks</changelog>
  <changelog author="mkubecek@suse.cz" date="1517400001">- Factory build now requires us to use %{_fillupdir} macro but
  it's only defined in Factory... so let's jump through some more
  hoops to make people with "Factory only" thinking happy</changelog>
  <changelog author="mkubecek@suse.cz" date="1527422400">- upgrade to upstream version 5.45
  * delayed deallocation of service sections after configuration file reload
  * deprecated the sslVersion option
  * the "socket" option is now also available in service sections
  * implemented try-restart in the SysV init script
  * TLS 1.3 compliant session handling for OpenSSL 1.1.1
  * default "failover" value changed from "rr" to "prio"
  * new "make check" tests</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1556280000">- upgrade to upstream version 5.53
  * update default cipher list to a safer value
  * restore default accept address to INADDR_ANY
  * fix requesting client certificate when specified by global
    option
  * certificate subject checks modified to accept certificates if
    at least one of the specified checks matches
  * log negotiated or resumed TLS session IDs
  * check whether "output" is not a relative file name
  * add sslVersion, sslVersionMin and sslVersionMax for OpenSSL
    1.1.0 and later
  * automatically convert hex PSK keys to binary
  * SMTP HELO before authentication
  * new "curves" option to control the list of elliptic curves in
    openssl &gt;= 1.1.0
  * new "ciphersuites" option to control the list of permitted TLS
    1.3 ciphersuites
  * include file name and line number in OpenSSL errors
  * compatibility with the current OpenSSL 3.0.0-dev branch
  * various performance improvements
  * error message improvements</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1613044800">- add rpmlintrc to suppress bogus build errors in Factory</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1613044801">- update stunnel.keyring with new developer key
- upgrade to upstream version 5.57
  * new "ticketKeySecret" and "ticketMacSecret" options
  * add logging the list of active connections on SIGUSR2
  * logging of the assigned bind address instead of the requested
    bind address
  * terminate service threads before OpenSSL cleanup to prevent
    occasional stunnel crashes at shutdown
  * support for engines without PRNG seeding methods
  * retry unsuccessful port binding on configuration file reload
  * terminate clients on exit in the FORK threading model
  * fix "redirect" option to properly handle "verifyChain = yes"
  * new securityLevel configuration file option
  * support for modern PostgreSQL clients
  * TLS 1.3 configuration updated for better compatibility
  * various fixes</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1665662400">- rpmlintrc: more general filters for bogus check errors</changelog>
</package>
<package pkgid="3a70c0225fad5e1a28c881d1ab11e3fcd3537fe971b8dfc6ec8a355b49cd030242d7669c3f4af76a17f0f24f0703bd032e380127dc4a9d9060f9c77ad682d557" name="stunnel-doc" arch="noarch">
  <version epoch="0" ver="5.57" rel="5.57"/>
  <changelog author="mkubecek@suse.cz" date="1452600000">- upgrade to upstream version 5.29
  * fix the "s_poll_wait returned 1, but no descriptor is ready"
    internal error
  * fix "exec" hangs due to incorrect thread-local storage handling
  * fix PRNG initialization
  * fix incomplete initialization
  * fix exit codes for information requests (as in "stunnel
  - version" or "stunnel -help")
  * fix configuration file reload for relative stunnel.conf path on
    Unix
  * fix ignoring CRLfile unless CAfile was also specified
  * setting socket options no longer performed on PTYs
  * SMTP client protocol negotiation support for
    "protocolUsername", "protocolPassword", and
    "protocolAuthentication"
  * new service-level option "config" to specify configuration
    commands introduced in OpenSSL 1.0.2
  * improved compatibility with the current OpenSSL 1.1.0-dev tree
  * added reading server certificates from hardware engines
  * performance improvement: rwlocks used for locking with pthreads</changelog>
  <changelog author="mkubecek@suse.cz" date="1474891200">- upgrade to upstream version 5.36
  * only reset the watchdog if some data was actually transferred
  * fixed logging an incorrect value of the round-robin starting
    point
  * fixed a TLS session caching memory leak; before stunnel 5.27
    this leak only emerged with sessiond enabled
  * fixed a FORK threading build regression bug
  * OPENSSL_NO_DH compilation fix
  * fixed malfunctioning "verify = 4"
  * fixed incorrectly enforced client certificate requests
  * fixed thread safety of the configuration file reopening
  * improved compatibility with the current OpenSSL 1.1.0-dev tree
  * added logging the list of client CAs requested by the server
  * new "socket = a:IPV6_V6ONLY=yes" option to only bind IPv6
  * memory leak detection
  * SNI support also enabled on OpenSSL 0.9.8f and later
  * added support for PKCS #12 (.p12/.pfx) certificates
  * added three new service-level options: requireCert,
    verifyChain, and verifyPeer for fine-grained certificate
    verification control
  * removed direct zlib dependency
- use original gzipped tarball again
- add tarball signature and public key
- specfile cleanup</changelog>
  <changelog author="mkubecek@suse.cz" date="1480075200">- upgrade to upstream version 5.38
  * the default SNI target (not handled by any slave service) is
    handled by the master service rather than rejected
  * removed thread synchronization in the FORK threading model</changelog>
  <changelog author="mkubecek@suse.cz" date="1517400000">- upgrade to upstream version 5.44
  * "sni=" can be used to prevent sending the SNI extension
  * the AI_ADDRCONFIG resolver flag is used when available
  * fixed a memory allocation bug causing crashes with OpenSSL
    1.1.0
  * fixed error handling for mixed IPv4/IPv6 destinations
  * per-destination TLS session cache added for the client mode
  * new "logId" parameter "process" added to log PID values
  * added support for the new SSL_set_options() values
  * fixed "logId" parameter to also work in inetd mode
  * "delay = yes" properly enforces "failover = prio"
  * fixed resolving addresses with unconfigured network interfaces
  * DH ciphersuites are now disabled by default
  * daily server DH parameter regeneration is only performed if DH
    ciphersuites are enabled in the configuration file
  * "checkHost" and "checkEmail" were modified to require either
    "verifyChain" or "verifyPeer"
  * fixed setting default ciphers
  * default engine UI set with ENGINE_CTRL_SET_USER_INTERFACE
  * key file name added into the passphrase console prompt
  * performance optimization in memory leak detection
  * fixed crashes with the OpenSSL 1.1.0 branch
  * fixed certificate verification with "verifyPeer = yes" and
    "verifyChain = no" (the default), while the peer only returns a
    single certificate
  * "redirect" also supports "exec" and not only "connect"
  * fixed premature cron thread initialization causing hangs
  * fixed "verifyPeer = yes" on OpenSSL &lt;= 1.0.1
  * allow for multiple "accept" ports per section
  * self-test framework (make check)
  * added config load before OpenSSL init
  * openSSL 1.1.1-dev compilation fixes
  * fixed round-robin failover in the FORK threading model
  * fixed handling SSL_ERROR_ZERO_RETURN in SSL_shutdown()
  * minor fixes of the logging subsystem
  * default accept address restored to INADDR_ANY
  * fixed removing the pid file after configuration reload
  * updated documentation
- adjust to new Factory checks</changelog>
  <changelog author="mkubecek@suse.cz" date="1517400001">- Factory build now requires us to use %{_fillupdir} macro but
  it's only defined in Factory... so let's jump through some more
  hoops to make people with "Factory only" thinking happy</changelog>
  <changelog author="mkubecek@suse.cz" date="1527422400">- upgrade to upstream version 5.45
  * delayed deallocation of service sections after configuration file reload
  * deprecated the sslVersion option
  * the "socket" option is now also available in service sections
  * implemented try-restart in the SysV init script
  * TLS 1.3 compliant session handling for OpenSSL 1.1.1
  * default "failover" value changed from "rr" to "prio"
  * new "make check" tests</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1556280000">- upgrade to upstream version 5.53
  * update default cipher list to a safer value
  * restore default accept address to INADDR_ANY
  * fix requesting client certificate when specified by global
    option
  * certificate subject checks modified to accept certificates if
    at least one of the specified checks matches
  * log negotiated or resumed TLS session IDs
  * check whether "output" is not a relative file name
  * add sslVersion, sslVersionMin and sslVersionMax for OpenSSL
    1.1.0 and later
  * automatically convert hex PSK keys to binary
  * SMTP HELO before authentication
  * new "curves" option to control the list of elliptic curves in
    openssl &gt;= 1.1.0
  * new "ciphersuites" option to control the list of permitted TLS
    1.3 ciphersuites
  * include file name and line number in OpenSSL errors
  * compatibility with the current OpenSSL 3.0.0-dev branch
  * various performance improvements
  * error message improvements</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1613044800">- add rpmlintrc to suppress bogus build errors in Factory</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1613044801">- update stunnel.keyring with new developer key
- upgrade to upstream version 5.57
  * new "ticketKeySecret" and "ticketMacSecret" options
  * add logging the list of active connections on SIGUSR2
  * logging of the assigned bind address instead of the requested
    bind address
  * terminate service threads before OpenSSL cleanup to prevent
    occasional stunnel crashes at shutdown
  * support for engines without PRNG seeding methods
  * retry unsuccessful port binding on configuration file reload
  * terminate clients on exit in the FORK threading model
  * fix "redirect" option to properly handle "verifyChain = yes"
  * new securityLevel configuration file option
  * support for modern PostgreSQL clients
  * TLS 1.3 configuration updated for better compatibility
  * various fixes</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1665662400">- rpmlintrc: more general filters for bogus check errors</changelog>
</package>
<package pkgid="907e81e79dcecfd0716b56c51d9baa4bacc545f0f3dc7255181888f21a6161a4ea74df9b949ef01cf4dedfc4dd30c31fe27e47b917f42c5864bce1feca9ff9fe" name="tcpreplay" arch="aarch64">
  <version epoch="0" ver="4.6.1" rel="50.1"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1672660800">- update to 4.4.3:
  * upgrade autogen/libopts to version 5.18.16
  * avoid implicit int in configure.ac
  * remove invalid assert in tree
  * program exit after send error
  * make libpcap version test more robust
  * looping inflates some packet counters</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1689076800">- Update to 4.4.4:
  * overflow check fix for parse_mpls.
  * tcpreplay-edit: prevent L2 flooding of ipv6 unicast packets.
  * CVE-2023-27786: bugs caused by strtok_r. (boo#1209416)
  * CVE-2023-27783 reachable assert in tcpedit_dlt_cleanup
    (boo#1209413)
  * reachable assert in fast_edit_packet.</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1733832000">- Update to version 4.5.1:
  * AF_XDP socket support - if you have a newer Linux kernel, you will be able to transmit at line rates without having to install 3rd party kernel modules (e.g. netmap, PF_RING)
  * -w tcpreplay option - this overrides the -i option, and allows you to write to a PCAP file rather than an interface
  * --include and --exclude tcpreplay options - allows replay of a list of specific packet numbers to replay. This may slow things down, so consider using in combination with -w.
  * --fixhdrlen tcpreplay option - added to control action on packet length changes
  * -W tcpreplay option - suppress warnings when replaying
  * SLL2( Linux "cooked" capture encapsulation v2)
  * Haiku support</changelog>
  <changelog author="pgajdos@suse.com" date="1755518400">- build with gcc15</changelog>
  <changelog author="pgajdos@suse.com" date="1755604800">- security update
- added patches
  CVE-2025-8746 [bsc#1247917], improper input validation and memory bounds checking when processing certain malformed configuration files
  + tcpreplay-CVE-2025-8746.patch</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1762430400">- update to version 4.5.2:
  - bugfix release
  - see https://github.com/appneta/tcpreplay/compare/v4.5.1...v4.5.2
    for full list of changes since v4.5.1
  - includes fixes for
  - CVE-2025-9157 / bsc#1248322
  - CVE-2025-51006 / bsc#1250356
- drop build workarounds for SLE11; since %autosetup and %license
  were introduced into the specfile recently, the package would not
  build on SLE11 or older anyway</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1784548800">- Update to version 4.5.3:
  * tcpreplay: fix --multiplier timing drift and miscalibrated
    overflow guards in calc_sleep_time
  * sendpacket: retry EAGAIN/ENOBUFS a bounded number of times
    instead of retrying endlessly; warn when sending on a
    down/no-carrier interface on Linux
  * sendpacket: fix AF_XDP transmission by no longer inhibiting
    libbpf's default XDP program load; route "zc:" PF_RING ZC
    device names through libpcap
  * netmap: bound and make abortable the TX-ring drain wait;
    remove stray switch defaults in nm_do_ioctl() that broke
  - -netmap
  * tcprewrite: fix adding a VLAN tag with missing options;
    rewrite addresses embedded in ICMPv6 error messages
  * tcpprep: fix buffer overflow on truncated packets
  * tcpedit: fix wrong end-of-buffer pointer in TCP-sequence and
    portmap rewrite
  * tcpliveplay: call pcap_breakloop() from the SIGALRM handler so
    an unresponsive peer is reported promptly
  * fragroute: fix overflow on packets carrying too many MPLS
    labels; fix TAILQ_FOREACH_REVERSE portability across queue.h
    variants
  * tcpr_random: fix signed left-shift undefined behaviour
  * configure: stop --with-netmap from leaking -I&lt;DIR&gt;/sys into
    CFLAGS
- Convert BuildRequires to pkgconfig() style and drop the obsolete
  Group tag
- Add tcpreplay-fix-txring-includes.patch: fix the __GLIBC_MINOR
  typo in txring.h (the macro is __GLIBC_MINOR__, so the version
  check silently evaluated to 0) and include &lt;linux/if_packet.h&gt;,
  which is what actually defines the PACKET_TX_RING API - glibc's
  &lt;netpacket/packet.h&gt; never provided it, so correcting the typo
  alone does not compile.  Sent upstream
- Restore Linux TX_RING packet injection support, which was
  disabled by accident: configure probes it by including both
  &lt;netpacket/packet.h&gt; and &lt;linux/if_packet.h&gt;, and before C23
  those two collide on struct sockaddr_ll, so the probe always
  failed and tcpreplay fell back to the slower PF_PACKET send()
  path.  configure now reports "Linux TX_RING: yes"
- Narrow the -std=gnu11 pin to the bundled libopts directory
  rather than the whole tree.  The pin is still required there
  (autoopts is not C23-clean under gcc &gt;= 15), but applying it
  globally is what dragged the TX_RING probe below C23</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1784808000">- Update to version 4.5.4 (security-only release):
  * Fix heap buffer overflow in the tcprewrite fragroute
    tcp_opt module (GHSA-pfqg-243f-8q25, CWE-787, CVSS 8.4):
    tcp_opt_apply() passed sizeof(pkt-&gt;pkt_data) - ETH_HDR_LEN
    as the capacity bound, but pkt_data is a pointer so
    sizeof() was 8 and the subtraction underflowed size_t,
    disabling the bounds check and allowing an out-of-bounds
    heap write. Now bounded by the real buffer extent.
  * Fix heap buffer overflow in the tcprewrite fragroute
    ip6_opt module (GHSA-2wmf-4p77-784q, CWE-787): IPv6
    routing/extension-header insertion used memmove()/memcpy()
    without checking the inserted bytes fit the remaining
    buffer headroom.
  * Fix the same class of unchecked option-insertion overflow
    in the fragroute ip_opt module (src/fragroute/mod_ip_opt.c).
  * Fix SEGV in the tcpedit DLT_JUNIPER_ETHER plugin used as a
    decoder (GHSA-ww62-mxv7-pg55, CWE-704, CWE-843): the plugin
    read ctx-&gt;encoder-&gt;config although it only ever decodes,
    a type confusion that crashed tcpedit on DLT_JUNIPER_ETHER
    input (e.g. tcprewrite --dlt=enet); now reads
    ctx-&gt;decoder-&gt;config.
  * Fix crash in remove_settings() on failed text_mmap
    (GHSA-5cjx-62pj-pmgq, CVE-2025-8746, CWE-476): the
    AutoOpts option-file save/rewrite path dereferenced the
    text_mmap() result without checking for MAP_FAILED.
  * Fix buffer overflow in the KHIAL sendpacket() path
    (GHSA-pjh6-6hrw-vcwr, CWE-787, CVSS 6.6):
    buffer_payload_size added instead of subtracted the
    pcap_pkthdr size, overstating the send buffer by 48 bytes
    and overflowing it for packets &gt;= 10024 bytes.
- Drop tcpreplay-CVE-2025-8746.patch: the remove_settings()
  MAP_FAILED guard (CVE-2025-8746 / GHSA-5cjx-62pj-pmgq) is
  now fixed upstream in 4.5.4.</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1784980800">- Update to version 4.5.5 - a security release:
  * Fix heap buffer over-read in get_layer4_v6(), reachable by
    reading an untrusted pcap with any of the tools
    (GHSA-jj65-mrgg-f5fx)
  * Fix stack buffer overflow in the fragroute rules-file parser
    (GHSA-777w-9599-w8g4)
  * Fix out-of-bounds write on an empty fragroute rules file
    (GHSA-p7xp-4gj2-x56c)
  * Fix off-by-one heap overflows in the fragroute ip_chaff and
    tcp_chaff modules (GHSA-m655-53p4-6qm8, GHSA-v8c4-9w98-9v6v)
  * Fix heap overflow via negative fragment/segment sizes in the
    fragroute ip_frag and tcp_seg modules (GHSA-27v4-xhfx-g2rx)
  * Harden fragroute allocation-failure and rule-list cleanup
    paths and add the first fragroute test cases</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1785326400">- Update to 4.6.0:
  * Fixes three advisories reported by tinyb0y, none of which have a
    CVE assigned yet: GHSA-fwcr-mqg6-hqmx (stack buffer overflow in
    the tcpprep --services file parser), GHSA-m6w7-8497-g9c9 (heap
    out-of-bounds read via --pktlen with --preload-pcap) and
    GHSA-5q26-7fxx-v8fh (heap out-of-bounds access in ARP address
    rewriting)
  * Fix Linux TX_RING support, broken by a header and probe
    collision
  * Fix an out-of-bounds read in libopts --save-opts handling
  * Fix jumbo-frame truncation that silently mangled captures with
    frames larger than the MTU
  * AF_XDP and io_uring injection backends now reach line rate; new
  - -raw PF_INET/SOCK_RAW injection path and --loss option
  * CMake joins autotools as a supported build system; GNU AutoGen
    is no longer required and release tarballs ship pre-built files
    for both
  * Install the replay engine as a static C library
- Drop tcpreplay-fix-txring-includes.patch, merged upstream
- Do not ship the newly installed libtcpreplay: it is static-only,
  has no configure switch to disable it and nothing in Factory links
  against it, so the package stays a command-line tool set</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1786795200">- Update to 4.6.1:
  * Three new security advisories, none with a CVE assigned yet:
    heap out-of-bounds reads in tcpliveplay's pcap parsing, one
    of which could leak adjacent heap memory onto the live
    network (GHSA-4hqm-8v2c-9pwj); an inverted bounds check in
    the dlt_radiotap plugin, reachable only by third-party code
    linking libtcpedit directly (GHSA-pmmx-m8p5-969j); and a
    heap out-of-bounds read in tcpprep cache-file parsing
    (GHSA-p3f2-88rg-9mch)
  * Nine defects found by a new OSS-Fuzz pipeline, mostly in
    fragroute: a heap overflow write and a pointer corruption in
    ip_chaff_apply(), unbounded packet growth from stacked
    duplicating rules, a leaked rule chain and leaked rand_t
    handles, null dereferences in delay_apply() and
    raw_ip_opt_parse(), and exit() calls on two error paths
  * Fix an out-of-bounds write from an undersized struct
    bpf_program stub on libbpf builds, reached through tcpprep's
    and tcpbridge's -f option
  * Fix a use-after-free in fragroute's pkt_close() and an
    uninitialised-stack read in its --dbug logging
  * Fix TX_RING failing outright on interfaces with an MTU of
    about 1365 or less, such as the IPv6 minimum of 1280
  * Mark the wire-format header structs packed, fixing systemic
    misaligned access found by UBSan
  * Remove --xdp-batch-size: raising it above the default of 1
    showed no benefit on 100GigE
  * Ship a dependency-free unit test suite and a fuzz corpus
    replay, both wired into make check
- Run the new test suite in %check
- Drop the -std=gnu11 pin on the bundled libopts: it compiles
  clean under gcc 16's C23 default, and the build still detects
  Linux TX_RING support</changelog>
</package>
<package pkgid="959c7e8fb278661e27e50ed6efd96fe684e7085694d7aef80fa4b500d3ec6fc0a46e32f256ad95e3640b013eff9987780340ff798d1f3967209c96a3e21b1926" name="tcpreplay" arch="src">
  <version epoch="0" ver="4.6.1" rel="50.1"/>
  <changelog author="mpluskal@suse.com" date="1501502400">- Update to version 4.2.6:
  * Test fails on sparc64 (#393)
- Changes for version 4.2.5:
  * Fix issues found by scan-build (#384)
  * Improve --portmap help message (#381)
  * AFL detected security crash in fuzz feature (#380)
  * Coverity static scan detected issues (#374)
  * Fuzz should not be overwritting Layer 3 (#372)
  * Add --fuzz-factor option to specify fuzz ratio (#371)
  * Warnings when building on old distributions (#368)
  * Fix more Lintian detected spelling errors (#365)
  * Fuzz test failure on ARM and MIPS (#364)
- Changes for version 4.2.4:
  * Fix Lintian detected spelling errors (#362)
- Changes for version 4.2.3:
  * Archive (remove) QuickTX until maintainer found (#357)
  * Ubuntu precise 32bit_build (#356)
- Changes for version 4.2.2:
  * Archive (remove) QuickTX (#357)
  * Missing symbol pcap_version on macOS 10.12.4 (#356)
- Changes for version 4.2.1:
  * Fix reporting of rates &lt; 1Mbps (#348)
  * Option --unique-ip not working properly (#346)
- Changes for version 4.2.0:
  * MAC rewriting capabilities (#313)
  * Fix several issues identified by Coverity (#305)
  * Packet destortion --fuzz-seed option by Gabriel Ganne (#302)
  * Add --unique-ip-loops option to modify IPs every few loops
    (#296)
  * Netmap startup delay increase (#290)
  * tcpcapinfo buffer overflow vulnerablily (#278)
  * Update git-clone instructions by Kyle McDonald (#277)
  * Allow fractions for --pps option (#270)
  * Print per-loop stats with --stats=0 (#269)
  * Add protection against packet drift by Guillaume Scott (#268)
  * Print flow stats periodically with --stats output (#262)
  * Include Travis-CI build support by Ilya Shipitsin (#264) (#285)
  * tcpreplay won't replay all packets in a pcap file with --netmap
    (#255)
  * First and last packet times in --stats output (#239)
  * Switch to wire speed after 30 minutes at 6 Gbps (#210)
  * tcprewrite fix checksum properly for fragmented packets (#190)
- Drop no longer needed patch (already in upstream):
  * 278-fail-if-capture-has-a-packet-that-is-too-large.patch
- Use %make_install macro
- Update dependencies to support (libnl3 and dbus-1)</changelog>
  <changelog author="jengelh@inai.de" date="1505131200">- Trim history recap in description.</changelog>
  <changelog author="sean@suspend.net" date="1546257600">- Update to version 4.3.1:
  * Fix checkspell detected typos (#531)
  * Heap overflow packet2tree and get_l2len (#530)
- Update to version 4.3.0:
  * Fix TCP sequence edit seeding (#514)
  * Fix issues identified by Codacy (#493)
  * CVE-2018-18408 use-after-free in post_args (#489 bsc#1112354)
  * CVE-2018-18407 heap-buffer-overflow csum_replace4 (#488 bsc#1112355)
  * CVE-2018-17974 heap-buffer-overflow dlt_en10mb_encode (#486 bsc#1110786)
  * CVE-2018-17580 heap-buffer-overflow fast_edit_packet (#485 bsc#1110333)
  * CVE-2018-17582 heap-buffer-overflow in get_next_acket (#484 bsc#1110285)
  * Out-of-tree build (#483)
  * CVE-20180-13112 heap-buffer-overflow in get_l2len (#477)
  * Closing stdin on pipe (#479)
  * Second pcap file hangs on multiplier option (#466)
  * TCP sequence edit ACK corruption (#451)
  * TCP sequence number edit initial SYN packet should have 0 ACK (#450)
  * Travis CI build fails due to new build images (#432)
  * Upgrade libopts to 5.18.12 to address version build issues (#430)
  * Add ability to change tcp SEQ/ACK numbers (#425)
  * Hang using loop and netmap options (#424)
  * tcpprep -S not working for large cache files (#423)
  * Unable to tcprewrite range of ports with --portmap (#422)
  * --maxsleep broken for values less than 1000 (#421)
  * -T flag breaks traffic replay timing (#421)
  * Respect 2nd packet timing (#418)
  * Avoid non-blocking behaviour when using STDIN (#416)
  * pcap containing &gt;1020 packets produces invalid cache file (#415)
  * manpage typos (#413)
  * Fails to open tap0 on Zephyr (#411)
  * Heap-buffer-overflow in get_l2protocol (#410)
  * Heap-buffer-overflow in packet2tree (#409)
  * Heap-buffer-overflow in getl2len (#408)
  * Heap-buffer-overflow in flow_decode (#407)
  * Rewrite zero IP total length field to match packet length (#406)
  * Stack-buffer-overflow in tcapinfo (#405)
  * tcpprep --include option does not exclude (#404)
  * Negative-size-param memset in dlt_radiotap_get_80211 (#402)
  * tcpreplay --verbose option not working (#398)
  * Fix replay when using --with-testnic (#178)</changelog>
  <changelog author="seanlew@opensuse.org" date="1552564800">- Update to version 4.3.2
  * CVE-2019-8381 memory access in do_checksum() (#538 bsc#1125753)
  * CVE-2019-8376 NULL pointer dereference get_layer4_v6() (#517 bsc#1125755)
  * CVE-2019-8377 NULL points dereference get_ipv6_i4proto() (#536 bsc#1125754)
  * Rename Ethereal to Wireshark (#545)</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1591963200">- Fix building with gcc10</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1592222400">- Update to version 4.3.3:
  * Increase cache buffers size to accomodate VLAN edits (#594)
  * Correct L2 header length to correct IP header offset (#583)
  * Fix warnings from gcc version 10 (#580)
  * Heap Buffer Overflow in randomize_iparp (#579)
  * Use after free in get_ipv6_next (#578)
  * Heap Buffer Overflow in git_ipv6_next (#576)
  * Call pcap_freecode() on pcap_compile() (#572)
  * Increase max snaplen to 262144 (#571)
  * Fix divide by zero in fuzzing (#570)
  * Unique IP repeats at very high iteration counts (#566)
  * Fails to compile on FreeBSD amd64 13.0 (#558)
  * Heap Buffer Overflow in do_checksum (#556) (#577)
  * Attempt to correct corrupt pcap files, if possible (#557)
  * Fix GCC v10 warnings (#555)
  * Remove some duplicated SOURCES entries (#551)
  * Expand /dev/bpfX hard limit to fix macOS Mojave (#550)
  * Implement –loopdelay-ms when using –loop=0 (#546)
  * Heap overflow packet2tree and get_l2len (#530)</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1620475200">- Update to version 4.3.4
  * Fixes ASAN reports memory leaks while running tests
  * clean up new_cidr_map() string manipulation on error exit
  * Fixed invalid --pps value protection
  * Fixed packets slowly drift further and further behind when they
    should be sent
  * Fixed 64 bit rollover can cause pps replay issues after several
    hours
  * DLT_NULL/DLT_LOOP support for cross-platform PF_INET6
  * Fixed heap buffer overflow in tcpreplay fast_edit_packet
  * Fixed heap buffer overflow in tcpreplay get_next_packet
  * Fixed CVE-2020-24266 heap buffer overflow in tcpprep get_l2len
  * Fixed CVE-2020-24265 heap buffer overflow in tcpprep
  * handle malformed and unsupported packets as soft errors
  * Fixed tcprewrite --fixlen not working on DLT conversion
  * Fixed with multiplier option only first file can be sent and hang
  * do not create tap0 if device already exists</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1658059200">- update to 4.4.1:
  * fix support for feeding PCAP files from STDIN
  * fix Debian/kfreebsd build
  * fix typos
  * safeguard against corrupt packet lengths in checksum functions
  * fix double free in Juniper DLT
  * fix to flows.c, fix #665
  * update Travis CI to focal
  * LINUX installed netmap auto detection
  * Support for Q-in-Q VLAN tags
  * skipbroadcast
  * add security policy document
  * Directories of pcaps as arguments
  * stage PR from @halver94
  * fix PPS calc for long-running sessions
  * Improve SDK selection
  * fix directory include feature
  * mac os tests fail
  * Revert "send_packet: Avoid clock drift
  * mac update on multicast</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1670068800">- update to 4.4.2:
  * This is Tcpreplay suite 4.4.2
  * This release contains bug fixes only.
  * What's Changed
  * Bug #716 heap-buffer-overflow in get_l2len_protocol()
  * Bug #721 fixed typo in tcpliveplay.c
  * Bug #717 avoid assertion in get_layer4_v6
  * Bug #718 improved heap-overflow protection
  * Bug #719 better overflow protection in parse_mpls
  * Bug #725 FORCE_ALIGN on arm
  * Bug #729 tcpreplay_edit: disallow both -K and -l options
  * Bug #735 heap-overflow in get_l2len_protocol
  * Bug #745 remove autogen.sh from distribution tarballs</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1672660800">- update to 4.4.3:
  * upgrade autogen/libopts to version 5.18.16
  * avoid implicit int in configure.ac
  * remove invalid assert in tree
  * program exit after send error
  * make libpcap version test more robust
  * looping inflates some packet counters</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1689076800">- Update to 4.4.4:
  * overflow check fix for parse_mpls.
  * tcpreplay-edit: prevent L2 flooding of ipv6 unicast packets.
  * CVE-2023-27786: bugs caused by strtok_r. (boo#1209416)
  * CVE-2023-27783 reachable assert in tcpedit_dlt_cleanup
    (boo#1209413)
  * reachable assert in fast_edit_packet.</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1733832000">- Update to version 4.5.1:
  * AF_XDP socket support - if you have a newer Linux kernel, you will be able to transmit at line rates without having to install 3rd party kernel modules (e.g. netmap, PF_RING)
  * -w tcpreplay option - this overrides the -i option, and allows you to write to a PCAP file rather than an interface
  * --include and --exclude tcpreplay options - allows replay of a list of specific packet numbers to replay. This may slow things down, so consider using in combination with -w.
  * --fixhdrlen tcpreplay option - added to control action on packet length changes
  * -W tcpreplay option - suppress warnings when replaying
  * SLL2( Linux "cooked" capture encapsulation v2)
  * Haiku support</changelog>
  <changelog author="pgajdos@suse.com" date="1755518400">- build with gcc15</changelog>
  <changelog author="pgajdos@suse.com" date="1755604800">- security update
- added patches
  CVE-2025-8746 [bsc#1247917], improper input validation and memory bounds checking when processing certain malformed configuration files
  + tcpreplay-CVE-2025-8746.patch</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1762430400">- update to version 4.5.2:
  - bugfix release
  - see https://github.com/appneta/tcpreplay/compare/v4.5.1...v4.5.2
    for full list of changes since v4.5.1
  - includes fixes for
  - CVE-2025-9157 / bsc#1248322
  - CVE-2025-51006 / bsc#1250356
- drop build workarounds for SLE11; since %autosetup and %license
  were introduced into the specfile recently, the package would not
  build on SLE11 or older anyway</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1784548800">- Update to version 4.5.3:
  * tcpreplay: fix --multiplier timing drift and miscalibrated
    overflow guards in calc_sleep_time
  * sendpacket: retry EAGAIN/ENOBUFS a bounded number of times
    instead of retrying endlessly; warn when sending on a
    down/no-carrier interface on Linux
  * sendpacket: fix AF_XDP transmission by no longer inhibiting
    libbpf's default XDP program load; route "zc:" PF_RING ZC
    device names through libpcap
  * netmap: bound and make abortable the TX-ring drain wait;
    remove stray switch defaults in nm_do_ioctl() that broke
  - -netmap
  * tcprewrite: fix adding a VLAN tag with missing options;
    rewrite addresses embedded in ICMPv6 error messages
  * tcpprep: fix buffer overflow on truncated packets
  * tcpedit: fix wrong end-of-buffer pointer in TCP-sequence and
    portmap rewrite
  * tcpliveplay: call pcap_breakloop() from the SIGALRM handler so
    an unresponsive peer is reported promptly
  * fragroute: fix overflow on packets carrying too many MPLS
    labels; fix TAILQ_FOREACH_REVERSE portability across queue.h
    variants
  * tcpr_random: fix signed left-shift undefined behaviour
  * configure: stop --with-netmap from leaking -I&lt;DIR&gt;/sys into
    CFLAGS
- Convert BuildRequires to pkgconfig() style and drop the obsolete
  Group tag
- Add tcpreplay-fix-txring-includes.patch: fix the __GLIBC_MINOR
  typo in txring.h (the macro is __GLIBC_MINOR__, so the version
  check silently evaluated to 0) and include &lt;linux/if_packet.h&gt;,
  which is what actually defines the PACKET_TX_RING API - glibc's
  &lt;netpacket/packet.h&gt; never provided it, so correcting the typo
  alone does not compile.  Sent upstream
- Restore Linux TX_RING packet injection support, which was
  disabled by accident: configure probes it by including both
  &lt;netpacket/packet.h&gt; and &lt;linux/if_packet.h&gt;, and before C23
  those two collide on struct sockaddr_ll, so the probe always
  failed and tcpreplay fell back to the slower PF_PACKET send()
  path.  configure now reports "Linux TX_RING: yes"
- Narrow the -std=gnu11 pin to the bundled libopts directory
  rather than the whole tree.  The pin is still required there
  (autoopts is not C23-clean under gcc &gt;= 15), but applying it
  globally is what dragged the TX_RING probe below C23</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1784808000">- Update to version 4.5.4 (security-only release):
  * Fix heap buffer overflow in the tcprewrite fragroute
    tcp_opt module (GHSA-pfqg-243f-8q25, CWE-787, CVSS 8.4):
    tcp_opt_apply() passed sizeof(pkt-&gt;pkt_data) - ETH_HDR_LEN
    as the capacity bound, but pkt_data is a pointer so
    sizeof() was 8 and the subtraction underflowed size_t,
    disabling the bounds check and allowing an out-of-bounds
    heap write. Now bounded by the real buffer extent.
  * Fix heap buffer overflow in the tcprewrite fragroute
    ip6_opt module (GHSA-2wmf-4p77-784q, CWE-787): IPv6
    routing/extension-header insertion used memmove()/memcpy()
    without checking the inserted bytes fit the remaining
    buffer headroom.
  * Fix the same class of unchecked option-insertion overflow
    in the fragroute ip_opt module (src/fragroute/mod_ip_opt.c).
  * Fix SEGV in the tcpedit DLT_JUNIPER_ETHER plugin used as a
    decoder (GHSA-ww62-mxv7-pg55, CWE-704, CWE-843): the plugin
    read ctx-&gt;encoder-&gt;config although it only ever decodes,
    a type confusion that crashed tcpedit on DLT_JUNIPER_ETHER
    input (e.g. tcprewrite --dlt=enet); now reads
    ctx-&gt;decoder-&gt;config.
  * Fix crash in remove_settings() on failed text_mmap
    (GHSA-5cjx-62pj-pmgq, CVE-2025-8746, CWE-476): the
    AutoOpts option-file save/rewrite path dereferenced the
    text_mmap() result without checking for MAP_FAILED.
  * Fix buffer overflow in the KHIAL sendpacket() path
    (GHSA-pjh6-6hrw-vcwr, CWE-787, CVSS 6.6):
    buffer_payload_size added instead of subtracted the
    pcap_pkthdr size, overstating the send buffer by 48 bytes
    and overflowing it for packets &gt;= 10024 bytes.
- Drop tcpreplay-CVE-2025-8746.patch: the remove_settings()
  MAP_FAILED guard (CVE-2025-8746 / GHSA-5cjx-62pj-pmgq) is
  now fixed upstream in 4.5.4.</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1784980800">- Update to version 4.5.5 - a security release:
  * Fix heap buffer over-read in get_layer4_v6(), reachable by
    reading an untrusted pcap with any of the tools
    (GHSA-jj65-mrgg-f5fx)
  * Fix stack buffer overflow in the fragroute rules-file parser
    (GHSA-777w-9599-w8g4)
  * Fix out-of-bounds write on an empty fragroute rules file
    (GHSA-p7xp-4gj2-x56c)
  * Fix off-by-one heap overflows in the fragroute ip_chaff and
    tcp_chaff modules (GHSA-m655-53p4-6qm8, GHSA-v8c4-9w98-9v6v)
  * Fix heap overflow via negative fragment/segment sizes in the
    fragroute ip_frag and tcp_seg modules (GHSA-27v4-xhfx-g2rx)
  * Harden fragroute allocation-failure and rule-list cleanup
    paths and add the first fragroute test cases</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1785326400">- Update to 4.6.0:
  * Fixes three advisories reported by tinyb0y, none of which have a
    CVE assigned yet: GHSA-fwcr-mqg6-hqmx (stack buffer overflow in
    the tcpprep --services file parser), GHSA-m6w7-8497-g9c9 (heap
    out-of-bounds read via --pktlen with --preload-pcap) and
    GHSA-5q26-7fxx-v8fh (heap out-of-bounds access in ARP address
    rewriting)
  * Fix Linux TX_RING support, broken by a header and probe
    collision
  * Fix an out-of-bounds read in libopts --save-opts handling
  * Fix jumbo-frame truncation that silently mangled captures with
    frames larger than the MTU
  * AF_XDP and io_uring injection backends now reach line rate; new
  - -raw PF_INET/SOCK_RAW injection path and --loss option
  * CMake joins autotools as a supported build system; GNU AutoGen
    is no longer required and release tarballs ship pre-built files
    for both
  * Install the replay engine as a static C library
- Drop tcpreplay-fix-txring-includes.patch, merged upstream
- Do not ship the newly installed libtcpreplay: it is static-only,
  has no configure switch to disable it and nothing in Factory links
  against it, so the package stays a command-line tool set</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1786795200">- Update to 4.6.1:
  * Three new security advisories, none with a CVE assigned yet:
    heap out-of-bounds reads in tcpliveplay's pcap parsing, one
    of which could leak adjacent heap memory onto the live
    network (GHSA-4hqm-8v2c-9pwj); an inverted bounds check in
    the dlt_radiotap plugin, reachable only by third-party code
    linking libtcpedit directly (GHSA-pmmx-m8p5-969j); and a
    heap out-of-bounds read in tcpprep cache-file parsing
    (GHSA-p3f2-88rg-9mch)
  * Nine defects found by a new OSS-Fuzz pipeline, mostly in
    fragroute: a heap overflow write and a pointer corruption in
    ip_chaff_apply(), unbounded packet growth from stacked
    duplicating rules, a leaked rule chain and leaked rand_t
    handles, null dereferences in delay_apply() and
    raw_ip_opt_parse(), and exit() calls on two error paths
  * Fix an out-of-bounds write from an undersized struct
    bpf_program stub on libbpf builds, reached through tcpprep's
    and tcpbridge's -f option
  * Fix a use-after-free in fragroute's pkt_close() and an
    uninitialised-stack read in its --dbug logging
  * Fix TX_RING failing outright on interfaces with an MTU of
    about 1365 or less, such as the IPv6 minimum of 1280
  * Mark the wire-format header structs packed, fixing systemic
    misaligned access found by UBSan
  * Remove --xdp-batch-size: raising it above the default of 1
    showed no benefit on 100GigE
  * Ship a dependency-free unit test suite and a fuzz corpus
    replay, both wired into make check
- Run the new test suite in %check
- Drop the -std=gnu11 pin on the bundled libopts: it compiles
  clean under gcc 16's C23 default, and the build still detects
  Linux TX_RING support</changelog>
</package>
<package pkgid="ff506395e69734045fb03272f144a3d35cc784d18dd2910472aaf9dbbbc023e41531f5a881e265a49e6330c36d2eab31274f21a699ce3b68cc1d0d05a94f8386" name="tcpreplay-debuginfo" arch="aarch64">
  <version epoch="0" ver="4.6.1" rel="50.1"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1672660800">- update to 4.4.3:
  * upgrade autogen/libopts to version 5.18.16
  * avoid implicit int in configure.ac
  * remove invalid assert in tree
  * program exit after send error
  * make libpcap version test more robust
  * looping inflates some packet counters</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1689076800">- Update to 4.4.4:
  * overflow check fix for parse_mpls.
  * tcpreplay-edit: prevent L2 flooding of ipv6 unicast packets.
  * CVE-2023-27786: bugs caused by strtok_r. (boo#1209416)
  * CVE-2023-27783 reachable assert in tcpedit_dlt_cleanup
    (boo#1209413)
  * reachable assert in fast_edit_packet.</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1733832000">- Update to version 4.5.1:
  * AF_XDP socket support - if you have a newer Linux kernel, you will be able to transmit at line rates without having to install 3rd party kernel modules (e.g. netmap, PF_RING)
  * -w tcpreplay option - this overrides the -i option, and allows you to write to a PCAP file rather than an interface
  * --include and --exclude tcpreplay options - allows replay of a list of specific packet numbers to replay. This may slow things down, so consider using in combination with -w.
  * --fixhdrlen tcpreplay option - added to control action on packet length changes
  * -W tcpreplay option - suppress warnings when replaying
  * SLL2( Linux "cooked" capture encapsulation v2)
  * Haiku support</changelog>
  <changelog author="pgajdos@suse.com" date="1755518400">- build with gcc15</changelog>
  <changelog author="pgajdos@suse.com" date="1755604800">- security update
- added patches
  CVE-2025-8746 [bsc#1247917], improper input validation and memory bounds checking when processing certain malformed configuration files
  + tcpreplay-CVE-2025-8746.patch</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1762430400">- update to version 4.5.2:
  - bugfix release
  - see https://github.com/appneta/tcpreplay/compare/v4.5.1...v4.5.2
    for full list of changes since v4.5.1
  - includes fixes for
  - CVE-2025-9157 / bsc#1248322
  - CVE-2025-51006 / bsc#1250356
- drop build workarounds for SLE11; since %autosetup and %license
  were introduced into the specfile recently, the package would not
  build on SLE11 or older anyway</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1784548800">- Update to version 4.5.3:
  * tcpreplay: fix --multiplier timing drift and miscalibrated
    overflow guards in calc_sleep_time
  * sendpacket: retry EAGAIN/ENOBUFS a bounded number of times
    instead of retrying endlessly; warn when sending on a
    down/no-carrier interface on Linux
  * sendpacket: fix AF_XDP transmission by no longer inhibiting
    libbpf's default XDP program load; route "zc:" PF_RING ZC
    device names through libpcap
  * netmap: bound and make abortable the TX-ring drain wait;
    remove stray switch defaults in nm_do_ioctl() that broke
  - -netmap
  * tcprewrite: fix adding a VLAN tag with missing options;
    rewrite addresses embedded in ICMPv6 error messages
  * tcpprep: fix buffer overflow on truncated packets
  * tcpedit: fix wrong end-of-buffer pointer in TCP-sequence and
    portmap rewrite
  * tcpliveplay: call pcap_breakloop() from the SIGALRM handler so
    an unresponsive peer is reported promptly
  * fragroute: fix overflow on packets carrying too many MPLS
    labels; fix TAILQ_FOREACH_REVERSE portability across queue.h
    variants
  * tcpr_random: fix signed left-shift undefined behaviour
  * configure: stop --with-netmap from leaking -I&lt;DIR&gt;/sys into
    CFLAGS
- Convert BuildRequires to pkgconfig() style and drop the obsolete
  Group tag
- Add tcpreplay-fix-txring-includes.patch: fix the __GLIBC_MINOR
  typo in txring.h (the macro is __GLIBC_MINOR__, so the version
  check silently evaluated to 0) and include &lt;linux/if_packet.h&gt;,
  which is what actually defines the PACKET_TX_RING API - glibc's
  &lt;netpacket/packet.h&gt; never provided it, so correcting the typo
  alone does not compile.  Sent upstream
- Restore Linux TX_RING packet injection support, which was
  disabled by accident: configure probes it by including both
  &lt;netpacket/packet.h&gt; and &lt;linux/if_packet.h&gt;, and before C23
  those two collide on struct sockaddr_ll, so the probe always
  failed and tcpreplay fell back to the slower PF_PACKET send()
  path.  configure now reports "Linux TX_RING: yes"
- Narrow the -std=gnu11 pin to the bundled libopts directory
  rather than the whole tree.  The pin is still required there
  (autoopts is not C23-clean under gcc &gt;= 15), but applying it
  globally is what dragged the TX_RING probe below C23</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1784808000">- Update to version 4.5.4 (security-only release):
  * Fix heap buffer overflow in the tcprewrite fragroute
    tcp_opt module (GHSA-pfqg-243f-8q25, CWE-787, CVSS 8.4):
    tcp_opt_apply() passed sizeof(pkt-&gt;pkt_data) - ETH_HDR_LEN
    as the capacity bound, but pkt_data is a pointer so
    sizeof() was 8 and the subtraction underflowed size_t,
    disabling the bounds check and allowing an out-of-bounds
    heap write. Now bounded by the real buffer extent.
  * Fix heap buffer overflow in the tcprewrite fragroute
    ip6_opt module (GHSA-2wmf-4p77-784q, CWE-787): IPv6
    routing/extension-header insertion used memmove()/memcpy()
    without checking the inserted bytes fit the remaining
    buffer headroom.
  * Fix the same class of unchecked option-insertion overflow
    in the fragroute ip_opt module (src/fragroute/mod_ip_opt.c).
  * Fix SEGV in the tcpedit DLT_JUNIPER_ETHER plugin used as a
    decoder (GHSA-ww62-mxv7-pg55, CWE-704, CWE-843): the plugin
    read ctx-&gt;encoder-&gt;config although it only ever decodes,
    a type confusion that crashed tcpedit on DLT_JUNIPER_ETHER
    input (e.g. tcprewrite --dlt=enet); now reads
    ctx-&gt;decoder-&gt;config.
  * Fix crash in remove_settings() on failed text_mmap
    (GHSA-5cjx-62pj-pmgq, CVE-2025-8746, CWE-476): the
    AutoOpts option-file save/rewrite path dereferenced the
    text_mmap() result without checking for MAP_FAILED.
  * Fix buffer overflow in the KHIAL sendpacket() path
    (GHSA-pjh6-6hrw-vcwr, CWE-787, CVSS 6.6):
    buffer_payload_size added instead of subtracted the
    pcap_pkthdr size, overstating the send buffer by 48 bytes
    and overflowing it for packets &gt;= 10024 bytes.
- Drop tcpreplay-CVE-2025-8746.patch: the remove_settings()
  MAP_FAILED guard (CVE-2025-8746 / GHSA-5cjx-62pj-pmgq) is
  now fixed upstream in 4.5.4.</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1784980800">- Update to version 4.5.5 - a security release:
  * Fix heap buffer over-read in get_layer4_v6(), reachable by
    reading an untrusted pcap with any of the tools
    (GHSA-jj65-mrgg-f5fx)
  * Fix stack buffer overflow in the fragroute rules-file parser
    (GHSA-777w-9599-w8g4)
  * Fix out-of-bounds write on an empty fragroute rules file
    (GHSA-p7xp-4gj2-x56c)
  * Fix off-by-one heap overflows in the fragroute ip_chaff and
    tcp_chaff modules (GHSA-m655-53p4-6qm8, GHSA-v8c4-9w98-9v6v)
  * Fix heap overflow via negative fragment/segment sizes in the
    fragroute ip_frag and tcp_seg modules (GHSA-27v4-xhfx-g2rx)
  * Harden fragroute allocation-failure and rule-list cleanup
    paths and add the first fragroute test cases</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1785326400">- Update to 4.6.0:
  * Fixes three advisories reported by tinyb0y, none of which have a
    CVE assigned yet: GHSA-fwcr-mqg6-hqmx (stack buffer overflow in
    the tcpprep --services file parser), GHSA-m6w7-8497-g9c9 (heap
    out-of-bounds read via --pktlen with --preload-pcap) and
    GHSA-5q26-7fxx-v8fh (heap out-of-bounds access in ARP address
    rewriting)
  * Fix Linux TX_RING support, broken by a header and probe
    collision
  * Fix an out-of-bounds read in libopts --save-opts handling
  * Fix jumbo-frame truncation that silently mangled captures with
    frames larger than the MTU
  * AF_XDP and io_uring injection backends now reach line rate; new
  - -raw PF_INET/SOCK_RAW injection path and --loss option
  * CMake joins autotools as a supported build system; GNU AutoGen
    is no longer required and release tarballs ship pre-built files
    for both
  * Install the replay engine as a static C library
- Drop tcpreplay-fix-txring-includes.patch, merged upstream
- Do not ship the newly installed libtcpreplay: it is static-only,
  has no configure switch to disable it and nothing in Factory links
  against it, so the package stays a command-line tool set</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1786795200">- Update to 4.6.1:
  * Three new security advisories, none with a CVE assigned yet:
    heap out-of-bounds reads in tcpliveplay's pcap parsing, one
    of which could leak adjacent heap memory onto the live
    network (GHSA-4hqm-8v2c-9pwj); an inverted bounds check in
    the dlt_radiotap plugin, reachable only by third-party code
    linking libtcpedit directly (GHSA-pmmx-m8p5-969j); and a
    heap out-of-bounds read in tcpprep cache-file parsing
    (GHSA-p3f2-88rg-9mch)
  * Nine defects found by a new OSS-Fuzz pipeline, mostly in
    fragroute: a heap overflow write and a pointer corruption in
    ip_chaff_apply(), unbounded packet growth from stacked
    duplicating rules, a leaked rule chain and leaked rand_t
    handles, null dereferences in delay_apply() and
    raw_ip_opt_parse(), and exit() calls on two error paths
  * Fix an out-of-bounds write from an undersized struct
    bpf_program stub on libbpf builds, reached through tcpprep's
    and tcpbridge's -f option
  * Fix a use-after-free in fragroute's pkt_close() and an
    uninitialised-stack read in its --dbug logging
  * Fix TX_RING failing outright on interfaces with an MTU of
    about 1365 or less, such as the IPv6 minimum of 1280
  * Mark the wire-format header structs packed, fixing systemic
    misaligned access found by UBSan
  * Remove --xdp-batch-size: raising it above the default of 1
    showed no benefit on 100GigE
  * Ship a dependency-free unit test suite and a fuzz corpus
    replay, both wired into make check
- Run the new test suite in %check
- Drop the -std=gnu11 pin on the bundled libopts: it compiles
  clean under gcc 16's C23 default, and the build still detects
  Linux TX_RING support</changelog>
</package>
<package pkgid="f83982e696f21d77ff60338d635e5a6e6ab7b101b826fb5bcc2cf811f3a3e725709581baa33ae33b1aab4c32616fd5d1171241d0c5a3716ac64958bbf7f07c7e" name="tcpreplay-debugsource" arch="aarch64">
  <version epoch="0" ver="4.6.1" rel="50.1"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1672660800">- update to 4.4.3:
  * upgrade autogen/libopts to version 5.18.16
  * avoid implicit int in configure.ac
  * remove invalid assert in tree
  * program exit after send error
  * make libpcap version test more robust
  * looping inflates some packet counters</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1689076800">- Update to 4.4.4:
  * overflow check fix for parse_mpls.
  * tcpreplay-edit: prevent L2 flooding of ipv6 unicast packets.
  * CVE-2023-27786: bugs caused by strtok_r. (boo#1209416)
  * CVE-2023-27783 reachable assert in tcpedit_dlt_cleanup
    (boo#1209413)
  * reachable assert in fast_edit_packet.</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1733832000">- Update to version 4.5.1:
  * AF_XDP socket support - if you have a newer Linux kernel, you will be able to transmit at line rates without having to install 3rd party kernel modules (e.g. netmap, PF_RING)
  * -w tcpreplay option - this overrides the -i option, and allows you to write to a PCAP file rather than an interface
  * --include and --exclude tcpreplay options - allows replay of a list of specific packet numbers to replay. This may slow things down, so consider using in combination with -w.
  * --fixhdrlen tcpreplay option - added to control action on packet length changes
  * -W tcpreplay option - suppress warnings when replaying
  * SLL2( Linux "cooked" capture encapsulation v2)
  * Haiku support</changelog>
  <changelog author="pgajdos@suse.com" date="1755518400">- build with gcc15</changelog>
  <changelog author="pgajdos@suse.com" date="1755604800">- security update
- added patches
  CVE-2025-8746 [bsc#1247917], improper input validation and memory bounds checking when processing certain malformed configuration files
  + tcpreplay-CVE-2025-8746.patch</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1762430400">- update to version 4.5.2:
  - bugfix release
  - see https://github.com/appneta/tcpreplay/compare/v4.5.1...v4.5.2
    for full list of changes since v4.5.1
  - includes fixes for
  - CVE-2025-9157 / bsc#1248322
  - CVE-2025-51006 / bsc#1250356
- drop build workarounds for SLE11; since %autosetup and %license
  were introduced into the specfile recently, the package would not
  build on SLE11 or older anyway</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1784548800">- Update to version 4.5.3:
  * tcpreplay: fix --multiplier timing drift and miscalibrated
    overflow guards in calc_sleep_time
  * sendpacket: retry EAGAIN/ENOBUFS a bounded number of times
    instead of retrying endlessly; warn when sending on a
    down/no-carrier interface on Linux
  * sendpacket: fix AF_XDP transmission by no longer inhibiting
    libbpf's default XDP program load; route "zc:" PF_RING ZC
    device names through libpcap
  * netmap: bound and make abortable the TX-ring drain wait;
    remove stray switch defaults in nm_do_ioctl() that broke
  - -netmap
  * tcprewrite: fix adding a VLAN tag with missing options;
    rewrite addresses embedded in ICMPv6 error messages
  * tcpprep: fix buffer overflow on truncated packets
  * tcpedit: fix wrong end-of-buffer pointer in TCP-sequence and
    portmap rewrite
  * tcpliveplay: call pcap_breakloop() from the SIGALRM handler so
    an unresponsive peer is reported promptly
  * fragroute: fix overflow on packets carrying too many MPLS
    labels; fix TAILQ_FOREACH_REVERSE portability across queue.h
    variants
  * tcpr_random: fix signed left-shift undefined behaviour
  * configure: stop --with-netmap from leaking -I&lt;DIR&gt;/sys into
    CFLAGS
- Convert BuildRequires to pkgconfig() style and drop the obsolete
  Group tag
- Add tcpreplay-fix-txring-includes.patch: fix the __GLIBC_MINOR
  typo in txring.h (the macro is __GLIBC_MINOR__, so the version
  check silently evaluated to 0) and include &lt;linux/if_packet.h&gt;,
  which is what actually defines the PACKET_TX_RING API - glibc's
  &lt;netpacket/packet.h&gt; never provided it, so correcting the typo
  alone does not compile.  Sent upstream
- Restore Linux TX_RING packet injection support, which was
  disabled by accident: configure probes it by including both
  &lt;netpacket/packet.h&gt; and &lt;linux/if_packet.h&gt;, and before C23
  those two collide on struct sockaddr_ll, so the probe always
  failed and tcpreplay fell back to the slower PF_PACKET send()
  path.  configure now reports "Linux TX_RING: yes"
- Narrow the -std=gnu11 pin to the bundled libopts directory
  rather than the whole tree.  The pin is still required there
  (autoopts is not C23-clean under gcc &gt;= 15), but applying it
  globally is what dragged the TX_RING probe below C23</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1784808000">- Update to version 4.5.4 (security-only release):
  * Fix heap buffer overflow in the tcprewrite fragroute
    tcp_opt module (GHSA-pfqg-243f-8q25, CWE-787, CVSS 8.4):
    tcp_opt_apply() passed sizeof(pkt-&gt;pkt_data) - ETH_HDR_LEN
    as the capacity bound, but pkt_data is a pointer so
    sizeof() was 8 and the subtraction underflowed size_t,
    disabling the bounds check and allowing an out-of-bounds
    heap write. Now bounded by the real buffer extent.
  * Fix heap buffer overflow in the tcprewrite fragroute
    ip6_opt module (GHSA-2wmf-4p77-784q, CWE-787): IPv6
    routing/extension-header insertion used memmove()/memcpy()
    without checking the inserted bytes fit the remaining
    buffer headroom.
  * Fix the same class of unchecked option-insertion overflow
    in the fragroute ip_opt module (src/fragroute/mod_ip_opt.c).
  * Fix SEGV in the tcpedit DLT_JUNIPER_ETHER plugin used as a
    decoder (GHSA-ww62-mxv7-pg55, CWE-704, CWE-843): the plugin
    read ctx-&gt;encoder-&gt;config although it only ever decodes,
    a type confusion that crashed tcpedit on DLT_JUNIPER_ETHER
    input (e.g. tcprewrite --dlt=enet); now reads
    ctx-&gt;decoder-&gt;config.
  * Fix crash in remove_settings() on failed text_mmap
    (GHSA-5cjx-62pj-pmgq, CVE-2025-8746, CWE-476): the
    AutoOpts option-file save/rewrite path dereferenced the
    text_mmap() result without checking for MAP_FAILED.
  * Fix buffer overflow in the KHIAL sendpacket() path
    (GHSA-pjh6-6hrw-vcwr, CWE-787, CVSS 6.6):
    buffer_payload_size added instead of subtracted the
    pcap_pkthdr size, overstating the send buffer by 48 bytes
    and overflowing it for packets &gt;= 10024 bytes.
- Drop tcpreplay-CVE-2025-8746.patch: the remove_settings()
  MAP_FAILED guard (CVE-2025-8746 / GHSA-5cjx-62pj-pmgq) is
  now fixed upstream in 4.5.4.</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1784980800">- Update to version 4.5.5 - a security release:
  * Fix heap buffer over-read in get_layer4_v6(), reachable by
    reading an untrusted pcap with any of the tools
    (GHSA-jj65-mrgg-f5fx)
  * Fix stack buffer overflow in the fragroute rules-file parser
    (GHSA-777w-9599-w8g4)
  * Fix out-of-bounds write on an empty fragroute rules file
    (GHSA-p7xp-4gj2-x56c)
  * Fix off-by-one heap overflows in the fragroute ip_chaff and
    tcp_chaff modules (GHSA-m655-53p4-6qm8, GHSA-v8c4-9w98-9v6v)
  * Fix heap overflow via negative fragment/segment sizes in the
    fragroute ip_frag and tcp_seg modules (GHSA-27v4-xhfx-g2rx)
  * Harden fragroute allocation-failure and rule-list cleanup
    paths and add the first fragroute test cases</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1785326400">- Update to 4.6.0:
  * Fixes three advisories reported by tinyb0y, none of which have a
    CVE assigned yet: GHSA-fwcr-mqg6-hqmx (stack buffer overflow in
    the tcpprep --services file parser), GHSA-m6w7-8497-g9c9 (heap
    out-of-bounds read via --pktlen with --preload-pcap) and
    GHSA-5q26-7fxx-v8fh (heap out-of-bounds access in ARP address
    rewriting)
  * Fix Linux TX_RING support, broken by a header and probe
    collision
  * Fix an out-of-bounds read in libopts --save-opts handling
  * Fix jumbo-frame truncation that silently mangled captures with
    frames larger than the MTU
  * AF_XDP and io_uring injection backends now reach line rate; new
  - -raw PF_INET/SOCK_RAW injection path and --loss option
  * CMake joins autotools as a supported build system; GNU AutoGen
    is no longer required and release tarballs ship pre-built files
    for both
  * Install the replay engine as a static C library
- Drop tcpreplay-fix-txring-includes.patch, merged upstream
- Do not ship the newly installed libtcpreplay: it is static-only,
  has no configure switch to disable it and nothing in Factory links
  against it, so the package stays a command-line tool set</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1786795200">- Update to 4.6.1:
  * Three new security advisories, none with a CVE assigned yet:
    heap out-of-bounds reads in tcpliveplay's pcap parsing, one
    of which could leak adjacent heap memory onto the live
    network (GHSA-4hqm-8v2c-9pwj); an inverted bounds check in
    the dlt_radiotap plugin, reachable only by third-party code
    linking libtcpedit directly (GHSA-pmmx-m8p5-969j); and a
    heap out-of-bounds read in tcpprep cache-file parsing
    (GHSA-p3f2-88rg-9mch)
  * Nine defects found by a new OSS-Fuzz pipeline, mostly in
    fragroute: a heap overflow write and a pointer corruption in
    ip_chaff_apply(), unbounded packet growth from stacked
    duplicating rules, a leaked rule chain and leaked rand_t
    handles, null dereferences in delay_apply() and
    raw_ip_opt_parse(), and exit() calls on two error paths
  * Fix an out-of-bounds write from an undersized struct
    bpf_program stub on libbpf builds, reached through tcpprep's
    and tcpbridge's -f option
  * Fix a use-after-free in fragroute's pkt_close() and an
    uninitialised-stack read in its --dbug logging
  * Fix TX_RING failing outright on interfaces with an MTU of
    about 1365 or less, such as the IPv6 minimum of 1280
  * Mark the wire-format header structs packed, fixing systemic
    misaligned access found by UBSan
  * Remove --xdp-batch-size: raising it above the default of 1
    showed no benefit on 100GigE
  * Ship a dependency-free unit test suite and a fuzz corpus
    replay, both wired into make check
- Run the new test suite in %check
- Drop the -std=gnu11 pin on the bundled libopts: it compiles
  clean under gcc 16's C23 default, and the build still detects
  Linux TX_RING support</changelog>
</package>
</otherdata>