Total Network Tools 2002

home *** CD-ROM | disk | FTP | other *** search

/ Total Network Tools 2002 / NextStepPublishing-TotalNetworkTools2002-Win95.iso / Archive / FTP Server / WFTPD Pro.exe / WHATSNEW.TXT < prev

Wrap

Text File | 2000-09-19 | 17.5 KB | 303 lines

Changes logged from version 2.40 to 2.41 RC14: Key: N - New feature; I - Interface enhancement; B - Bug fixed; S - Security improvement; D - Design fixed Registry entries added: "<server>\Fatal Error" "<server>\FileBufferSize" "<server>\WindowSize" "<server>\ExternalDLL" "<server>\Hosts\WaitForName" WFTPD Pro Control Panel: ======================= N Added ability to connect to, and configure, a remote WFTPD Pro installation. Note, however, that you cannot currently view the remote site's list of connected users. N In an effort to provide some level of support for Windows 95/98, we allow the Control Panel to configure a WFTPD Pro system running as a regular app, rather than as an NT service: currently missing, however, is the ability to start and stop the service from this control panel. To request that WFTPD Pro running as a Window should refresh itself from the registry, find the window "WFTPD Service Control", and send it the registered Window message "WFTPD Service Refresh". I Accelerators added for more dialog buttons; some conflicting accelerators have been disambiguated. N When a server fails to start, we list it as 'dead', and when you select that server, the title of the User Frame displays the reason for the inability to start. [Stored in registry value: "<server>\Fatal Error"] I The control panel window can no longer be shrunk so small that buttons overlap or disappear. D Read-only sound files can be used for login/logout notice. S To allow validation of connecting hosts by name as well as IP address, we now offer the option to carry out a reverse DNS lookup. Since this lookup takes significant time on some systems, this is not enabled by default. [Registry value: "<server>\Hosts\WaitForName"] S We no longer validate IP addresses used for filtering in the "Network" page of configuring a server; we can now filter on names as well, so pretty much anything you enter is likely to be a valid filter. Any non-numeric filter will be ignored if you have not enabled reverse DNS lookups. B Correct support (including 3-D buttons) for Windows NT 3.51 is given, along with context-sensitive help. (Previous versions might crash in NT 3.51 with context-sensitive help) Context-sensitive help on the main dialog box means we must remove the minimise box. S If the user's home directory is on a case-sensitive file system (as reported by Windows NT to us), we do not force it into upper case. We recommend, however, that file systems exported for an NT system to connect to should use a case-preserving, but not case-sensitive, file system. There are many other applications that you will want to access that file system, and we cannot even remotely hope that all of them are capable of dealing with the difference between "readme" and "README" - many of your users, and their client FTP software, might have trouble making the same distinction. S We now ensure that long path names are used to store, and reference, all rights entries. If you have short pathnames in your rights database, they will be ignored when checking for rights. N Y2K code review carried out. B Conversions page should now correctly add new conversion names, rather than complaining that they've already been entered. D Browsing for the log file now displays "Save" instead of "Open". D Selecting servers with fatal errors now gives you the option to "Go" instead of having to "Stop" then "Go" - the server is, of course, already stopped. I* The main dialog now contains the version number - note that this is the version number of the Control Panel applet, not that of the underlying FTP engine. WFTPD Pro Setup Program ======================= N Copyright extended to 1999. I If the user requests to cancel the installation, we ask them if they are truly sure of this. N Files are now installed to the short-pathname of any directory entered - this allows the automated uninstall to work easily. I Dialogs are expanded to accomodate systems with peculiar font sizes. WFTPD / WFTPD Pro ================= D Files and disks of over 2GB in size are now supported in WFTPD (32-bit only) and WFTPD Pro. N New commands: FEAT - report on the post-RFC 959 features supported. MLST - new machine-readable listing format MLSD - similar to MLST OPTS - for setting feature options (currently only MLST) N New HOST command is recognised, but unimplemented as yet. S Dynamically sized command buffer, to accept even the most outrageous of FTP denial-of-service attempts without hiccuping. N Y2K code review carried out. D Cookies and responses that used angle brackets ("<>") now use curly braces ("{}") instead - Netscape threw up some interesting text when given an undefined 'HTML' value. D Better interaction with Nagle/Delayed Ack algorithms to improve command response time to well-behaved FTP clients. S Configurable whether to wait for a reverse DNS lookup or not. [Registry value: "<server>\Hosts\WaitForName"] WFTPD: on menu item "Security|Host/Net". S The PORT command can no longer be used to subvert restrictions to ports <1K. N Preparation for version 3.0 - we now impersonate NT users and revert back to our selves when appropriate. Currently, you can take advantage of this with the new external authenticate DLL function. ** Note to IE users - WFTPD and WFTPD Pro will log an unsuccessful transfer even when IE receives the file correctly, since IE appears to have been written by people who wouldn't recognise FTP if they had the initials branded on their retinas. D We now fully support even brain-dead FTP clients that send the transfer command _before_ completing the PASV connection to transfer the data on. Note - this is a hideously bad piece of security flaw [in the client], since it means that a hacker could hijack any incoming or outgoing data transfer if he knew something about the system. Workaround: require all data transfers to be reflexive, and beat the relevant FTP client authors over the head. B When a STOR fails, we log it as a Put, rather than a Get. D In case of a file error, we now log what the error code is. S Avoid potential denial-of-service attack caused by sending an option string to a LIST or NLST command longer than 30 characters. "dir -1234567890123456789012345678901234567890" for instance would cause a crash. S Any given short path names are always converted to long path names, to avoid somebody using short path names to evade the rights restrictions. N MLST and MLSD commands added in preparation for the release of the MLST/MLSD Internet-draft as an RFC. This is a big one, since it solves a major headache for FTP client and server authors, in that it provides a reliable machine-readable format for file listings. N Double-buffering for the transferred file is slightly altered, to allow the user to specify (in the registry or INI file) how much data to read from, or write to, the disk in each go. [Registry entry "<server>\FileBufferSize"] I When file transfer status is reported, we now correctly use a big 'B' to indicate 'bytes' - a little 'b' should mean 'bits'. I If the message.ftp file ends in a carriage return, we no longer take that as reason to send a blank line. B Removed a potential race condition and GPF in the multi-threaded listings. N New capability to set the TCP/IP buffer/window size, to allow for data transfer over a link where latency or bandwidth are large; on Windows 98 and 2000, this will set the large window scale option in connection negotiation. This may help those of you transferring files to and from orbiting space craft. Seriously. [Registry entry: "<server>\WindowSize"] D New ADMN RESU (resume) command to resume after ADMN STOP has been sent. D ADMN ADDU now checks to see if the user has rights before denying a new user creation; you shouldn't be trying to create the default or anonymous users. D ADMN MESS MCWD is now only accepted with a further argument (Y or N). D ADMN CHPW now checks to see if the user has a password (i.e. is not 'default' or 'anonymous') before changing passwords. N On Win32, we try to create temporary files (for listings) in memory, and only write them to disk when memory is exhausted. S We no longer validate IP address filters (e.g. 'allow/deny this host') to contain only numeric values, since we can now filter on names as well, if we are allowed to perform a reverse DNS lookup. N When a WFTPD Pro server fails to start, it will note its reason in the "Fatal Error" registry key. D If a data transfer times out, we don't automatically disconnect the control connection until it, too, times out. D Corrected error response number for "command recognised but not implemented" to 502. N Log format is changed on Win32 platforms, to use the local short date format - this avoids some user's Y2K gripes, since you can now specify that this should not use two digit dates. B Owner Email Address is now saved and read correctly in WFTPD, for the %E cookie. B When deleting a user from the registry, it should now delete all of that user's settings; same for deleting a server. N New external DLL functionality added; currently, the only supported external function is to authenticate a user, given his name and password; the DLL's function must then return his home directory, and may return an NT user handle for impersonation purposes. [Registry entry: "<server>\ExternalDLL" contains full path to DLL to be called.] See extrnls.h for the function prototype. B WFTPD Pro stops more cleanly as a service now. N On NT 3.51 and 4.0, we take NTFS rights into consideration as well as those defined in WFTPD/WFTPD Pro. N Unregistered version now displays a dialog when it starts to note that it is the unregistered version, and giving instructions on how to register; this dialog can be permanently dismissed by clicking on a check-box, so it's not a "Nag Screen" - it's an attempt to reduce the number of people who email me saying "How do I register this program?". N Copyright stretched to 1999; version number bumped up to 2,41,0,3 B When editing the user name using the arrow keys in WFTPD, the rest of the User Security dialog will update correctly. N WFTPD Pro, when run on a non-NT system, or run on NT with the '-s' flag, will now load as a [hidden] Window-based app, rather than a service. Support for this mode will be expanded in future, until we have what is essentially a Windows 9x version of WFTPD Pro. I A new, default, menu option is added to the WFTPD popup menu that is available when WFTPD is minimised to the system tray. This is the "Restore" command, so that a double-click will restore the program. D Browsing for the log file now displays "Save" instead of "Open". I Upper limit checked on the size of the disk read/write buffer. B Timeout on the data connection no longer causes timeout on the control connection. B Timeout on the control connection no longer causes GPF. I All paths displayed to the user should now be the _long_ form. B MLSD returns an error when used on a non-directory, or non-existent path. B Directory listings of volumes - i.e. root directories on local drives - should now come up properly, except for the modification time, which Win32 gives as 19800101. B Fixed an error in reporting large size files/disk space, whereby a high bit in the low order double word would cause erroneous calculation. B The group did not display in file listings if another owner in the list was longer than the current one. I Changed "{unknown}" into "noone", to allow for listing routines that expect alphanumeric owner/group identifiers. S If we are getting file access rights, and the OS won't allow us to list those rights, then we are not going to allow access to the file. B Early freeing of the pointer to a SID meant that owners and groups were not being listed. B Moved a function call to the top of the destructor, where the data contents will still be valid, thereby avoiding a GPF on logout or termination. B Fixed new MLSD / MLST functionality. S Removed code that listed the true (NTFS) owner and group of a file. B Fixed a buffer overflow bug reported by the bugtraq mailing list. B Fixed a potential (though unlikely) buffer overwrite found through code review. B A couple of GPFs fixed. N MLST / MLSD disabled unless a registry entry is set - see the help file for details. B Deny/Allow now works properly. B 16-bit WFTPD change directory bug fixed. D SIZE command now works with either List _or_ Read rights to the file. D File listing now lists to 8-column stops, much like BSD 'ls'. [Useful for clients such as machine tools that expect the listing is a fixed format.] B Fixed a bug in restricted-user file and wildcard listing. B Listings sometimes leaked memory - this is now fixed. B The elusive "last-known GPF" is fixed - if a client connects from a site that has no IP to name mapping, and the client disconnects before the DNS request completes, the server would GPF. This is now fixed. B Fixed a potential (though unlikely, and so far unreported) problem with socket handle values > 64k. B Fixed STOU, which was storing its files in the same directory as the executable is installed into - it now stores files into the correct directory. B Fixed unsightly GPF on stopping WFTPD Pro - was not damaging to data, but looks clumsy. B Fixed a GPF caused when security is disabled. B Fixed a GPF that could occur when a client connects and then disconnects before its name has been resolved through DNS. S 'Salt' characters in the password hash function are now restricted to only those that are allowed in Unix (where the hash function originated) S Altered disconnect functionality so that a user can be disconnected in the middle of a data transfer without waiting for the transfer to complete. D Don't respond with "MLST" to "FEAT" command unless MLST features have been enabled. S Zero out memory that holds the password entered by the user, just in case someone feels like examining core dumps. S If a password longer than eight characters fails, we retry with just the first eight characters, since the password algorithm was changed a couple of years ago to add handling for longer than eight characters of password. N Changed the method of creating uploaded files to try and get around a reported sharing problem with IIS (which maintains locks to files long after it's finished reading them). D Slight speed improvement on comparison of rights when listing files. B Fixed a minor bug in logging in when home directories end in a back- slash. B Prevent user from logging in if they have no rights to their home directory. B Fixed a bug where confusion could occur if the user's home directory ends in a slash or backslash. D Log the reason _why_ a user's home directory is not accessible to them. B Fixed an apparent hang at the end of directory listings. D Fixed an incompatibility with certain Unix FTP clients that expect the 226 response to come before they will acknowledge the FIN. This led to some FTP clients appearing to hang at the end of data transfers and/or file listings. B Due to poor behavior on the part of the GetFileSecurity call, we had been marking files and directories as inaccessible, when the truth was merely that the OS couldn't (or wouldn't) tell us what rights we had. This usually shows up when trying to access remote shares on non-NT systems through UNCs B "Blue Panda" reported a GPF caused when issuing the RNTO command with no previous RNFR command - this has been fixed. B Blue Panda has been busy again. GPFs on issuing a STOR, APPE or STOU after a REST marker is set past the end of the file, or when the file does not exist; and on entering the MLST / MLSD commands prior to logging in. Also, when we try to prevent people writing to / reading from device names such as LPT1, CON, etc, we missed a few device names - partly because they aren't documented anywhere. Since there is no programmatic way (that we know of) to get a listing of devices, we've allowed users to define their own device names in a new INI file entry / registry setting "General\DeviceNames" S Another Panda-ism or two - .LNK files could be downloaded, possibly revealing local directory structures - now .LNK files can neither be uploaded, nor downloaded (nor renamed, except to other link files). The "%C" cookie (current directory) also exposes local directory structure - this has now been corrected to respond with the same information as PWD gives. B Also from Blue Panda - a long command string consisting of characters in the range 128-255 may cause a GPF. B Corrected some instances where a closed socket was not decrementing the socket count. D* Increased length of usernames to 50 characters B* Fixed a problem where default rights were not appearing correctly in the interface for some users in WFTPD. B* Fixed a timeout problem, wherein users were quickly disconnected for the first few minutes after a system is booted. B* Fixed a problem that prevented the anonymous user from logging in. B* Fixed a GPF bug that occurs when disconnecting a timed-out user.