* Relicensing from LGPL-3.0+ (with custom exceptions) to MPL-2.0 is now complete.
libzmq is now distributed under the Mozilla Public License 2.0. Relicensing
grants have been collected from all relevant authors, and some functionality
has been clean-room reimplemented where that was not possible. In layman terms,
the new license provides the same rights and obligations as before. Source
files are now tagged using the SPDX license identifier format.
Details of the relicensing process can be seen at: #2376
Relicensing grants have been archived at:
https://github.com/rlenferink/libzmq-relicense
A special thanks to everybody who helped with this long and difficult task,
with the process, the reimplementations, the collections and everything else.
* New DRAFT (see NEWS for 4.2.0) socket options:
ZMQ_BUSY_POLL will set the SO_BUSY_POLL socket option on the underlying
sockets, if it is supported.
ZMQ_HICCUP_MSG will send a message when the peer has been disconnected.
ZMQ_XSUB_VERBOSE_UNSUBSCRIBE will configure a socket to pass all
unsubscription messages, including duplicated ones.
ZMQ_TOPICS_COUNT will return the number of subscribed topics on a
PUB/SUB socket.
ZMQ_NORM_MODE, ZMQ_NORM_UNICAST_NACK, ZMQ_NORM_BUFFER_SIZE,
ZMQ_NORM_SEGMENT_SIZE, ZMQ_NORM_BLOCK_SIZE, ZMQ_NORM_NUM_PARITY,
ZMQ_NORM_NUM_AUTOPARITY and ZMQ_NORM_PUSH to control various aspect of
NORM sockets.
See doc/zmq_setsockopt.txt and doc/zmq_getsockopt.txt for details.
* New DRAFT (see NEWS for 4.2.0) zmq_ppoll APIs was added that differs from
zmq_poll in the same way that ppoll differs from poll.
See doc/zmq_ppoll.txt for details.
* Various bug fixes and performance improvements.
OBS-URL: https://build.opensuse.org/package/show/devel:libraries:c_c++/zeromq?expand=0&rev=84
- update to 4.3.4:
* ZMQ_PRIORITY will set the SO_PRIORITY socket option on the underlying
sockets. Only supported on Linux.
* Fixed compilation errors on kFreeBSD and GNU/Hurd
* Fixed excessive amount of socket files left behind in Windows TMP
* Fixed regression that breaks using IPv6 link-local addresses on Linux
* Fixed compilation errors on Android
* Fixed compilation error with ulibc and libbsd
* Fixed stack overflow on Windows x64
* Fixed various compilation errors on Windows ARM 32bit
* Fixed various compilation warnings with XCode
* Fixed return value of zmq_ctx_get changed unintentionally
OBS-URL: https://build.opensuse.org/request/show/866413
OBS-URL: https://build.opensuse.org/package/show/devel:libraries:c_c++/zeromq?expand=0&rev=77
* Denial-of-Service on CURVE/ZAP-protected servers by
unauthenticated clients. (CVE-2020-15166, bsc#1176116)
If a raw TCP socket is opened and connected to an endpoint that is fully
configured with CURVE/ZAP, legitimate clients will not be able to exchange
any message. Handshakes complete successfully, and messages are delivered to
the library, but the server application never receives them.
For more information see the security advisory:
https://github.com/zeromq/libzmq/security/advisories/GHSA-25wp-cf8g-938m
* Stack overflow on server running PUB/XPUB socket (CURVE disabled).
The PUB/XPUB subscription store (mtrie) is traversed using recursive
function calls. In the remove (unsubscription) case, the recursive calls are
NOT tail calls, so even with optimizations the stack grows linearly with the
length of a subscription topic. Topics are under the control of remote
clients - they can send a subscription to arbitrary length topics. An
attacker can thus cause a server to create an mtrie sufficiently large such
that, when unsubscribing, traversal will cause a stack overflow.
For more information see the security advisory:
https://github.com/zeromq/libzmq/security/advisories/GHSA-qq65-x72m-9wr8
* Memory leak in PUB server induced by malicious client(s) without CURVE/ZAP.
Messages with metadata are never processed by PUB sockets, but the metadata
is kept referenced in the PUB object and never freed.
For more information see the security advisory:
https://github.com/zeromq/libzmq/security/advisories/GHSA-4p5v-h92w-6wxw
* Memory leak in client induced by malicious server(s) without CURVE/ZAP.
When a pipe processes a delimiter and is already not in active state but
still has an unfinished message, the message is leaked.
For more information see the security advisory:
https://github.com/zeromq/libzmq/security/advisories/GHSA-wfr2-29gj-5w87
* Heap overflow when receiving malformed ZMTP v1 packets (CURVE disabled).
OBS-URL: https://build.opensuse.org/package/show/devel:libraries:c_c++/zeromq?expand=0&rev=74
- New upstream version 4.3.2:
* CVE-2019-13132: a remote, unauthenticated client connecting to a
libzmq application, running with a socket listening with CURVE
encryption/authentication enabled, may cause a stack overflow and
overwrite the stack with arbitrary data, due to a buffer overflow in
the library. Users running public servers with the above configuration
are highly encouraged to upgrade as soon as possible, as there are no
known mitigations. (bsc#1140255)
* New DRAFT (see NEWS for 4.2.0) zmq_socket_monitor_versioned API that supports
a versioned monitoring events protocol as a parameter. Passing 1 results in
the same behaviour as zmq_socket_monitor.
* New DRAFT (see NEWS for 4.2.0) zmq_socket_monitor_pipes_stats that triggers
a new ZMQ_EVENT_PIPES_STATS to be delivered via zmq_socket_monitor_versioned
v2 API, which contains the current status of all the queues owned by the
monitored socket. See doc/zmq_socket_monitor_versioned.txt for details.
* New DRAFT (see NEWS for 4.2.0) zmq_poller_fd that returns the FD of a thread
safe socket.
* New DRAFT (see NEWS for 4.2.0) socket options:
ZMQ_XPUB_MANUAL_LAST_VALUE is similar to ZMQ_XPUB_MANUAL but allows to avoid
duplicates when using last value caching.
ZMQ_SOCKS_USERNAME and ZMQ_SOCKS_PASSWORD that implement SOCKS5 proxy
authentication.
- For complete set of changes, see
https://github.com/zeromq/libzmq/releases/tag/v4.3.2
OBS-URL: https://build.opensuse.org/request/show/714173
OBS-URL: https://build.opensuse.org/package/show/devel:libraries:c_c++/zeromq?expand=0&rev=72
- New upstream version 4.2.4
* New DRAFT (see NEWS for 4.2.0) socket options:
- ZMQ_LOOPBACK_FASTPATH to enable faster TCP loopback on Windows
- ZMQ_METADATA to set application-specific metadata on a socket
See doc/zmq_setsockopt.txt and doc/zmq_getsockopt.txt for details.
* New DRAFT (see NEWS for 4.2.0) context options:
- ZMQ_ZERO_COPY_RECV to disable zero-copy receive to save memory
at the expense of slower performance
See doc/zmq_ctx_set.txt and doc/zmq_ctx_get.txt for details.
* New DRAFT API zmq_stopwatch_intermediate which returns the time
elapsed without stopping the stopwatch.
* TIPC: support addressing TIPC Port Identity addresses.
* fix ZMQ_DISH over UDP triggers errno_assert() after watermark
* fix ZMQ_PUB crash when due to high volume of subscribe and
unsubscribe messages, an unmatched unsubscribe message is
received in certain conditions
* see NEWS and ChangeLog for additional details
- install licenses correctly and update SPDX license to version 3
OBS-URL: https://build.opensuse.org/request/show/589935
OBS-URL: https://build.opensuse.org/package/show/devel:libraries:c_c++/zeromq?expand=0&rev=64
- New upstream version 4.2.3
* API change: previously ZMQ_POLLOUT on a ZMQ_ROUTER socket
returned always true due to how the type works. When
ZMQ_ROUTER_MANDATORY is set, sending fails when the peer is
not available, but ZMQ_POLLOUT always returns true anyway,
which does not make sense. Now when ZMQ_ROUTER_MANDATORY is
set, ZMQ_POLLOUT on a ZMQ_ROUTER will return true only if
at least one peer is available.
Given ZMQ_POLLOUT with ZMQ_ROUTER was not usable at all
previously, we do not consider this a breakage warranting a
major or minor version increase.
* ZMQ_IDENTITY has been renamed to ZMQ_ROUTING_ID and
ZMQ_CONNECT_RID has been renamed to ZMQ_CONNTECT_ROUTING_ID
to disambiguate. ZMQ_IDENTITY and ZMQ_CONNECT_RID are still
available to keep backward compatibility, and will be
removed in a future release after further advance notice.
* DRAFT API change: zmq_poller_wait, zmq_poller_wait_all and
zmq_poller_poll have been changed to be inline with other
existing APIs that have a timeout to return EAGAIN instead
of ETIMEDOUT as the errno value.
* Existing non-DRAFT socket types ZMQ_REP/REQ, ZMQ_ROUTER/DEALER
and ZMQPUB/SUB, that were previously declared deprecated, have
been reinstated as stable and supported
* Curve: all remaining traces of debug output to console are now
removed, and new DRAFT events are available to properly debug
CURVE, PLAIN, GSSAPI and ZAP events and failures.
* for compelete changelog see
https://github.com/zeromq/libzmq/releases/tag/v4.2.3
- drop remove_werror.patch: can now be disabled at configure time,
if needed.
OBS-URL: https://build.opensuse.org/request/show/556904
OBS-URL: https://build.opensuse.org/package/show/devel:libraries:c_c++/zeromq?expand=0&rev=62
- New upstream version 4.2.0
* For Pieter. Thanks for making all of this possible.
* This release introduces new APIs, but it is ABI compatible with
libzmq 4.1.2 and up.
* Fixed alignment problem on arm and sparc, need to rebuild
against 4.2.0
* New Context option ZMQ_MAX_MSGSZ
* New Socket options:
- ZMQ_HANDSHAKE_IVL
- ZMQ_SOCKS_PROXY
- ZMQ_XPUB_NODROP
- ZMQ_BLOCKY
- ZMQ_XPUB_MANUAL
- ZMQ_XPUB_WELCOME_MSG
- ZMQ_STREAM_NOTIFY
- ZMQ_INVERT_MATCHING
- ZMQ_HEARTBEAT_IVL
- ZMQ_HEARTBEAT_TTL
- ZMQ_HEARTBEAT_TIMEOUT
....
* see NEWS for all changes
- Packaging
* add --with-libsodium to link against libsodium and not internal
tweetnacl
* remove disable-silent-rules
* add --enable-curve to build curve_keygen tool
https://github.com/zeromq/libzmq/pull/2195
* add libunwind to build dependencies
OBS-URL: https://build.opensuse.org/request/show/438778
OBS-URL: https://build.opensuse.org/package/show/devel:libraries:c_c++/zeromq?expand=0&rev=51
- Added patch 3ad076.patch
* based on https://github.com/zeromq/zeromq4-1/commit/3ad076.patch
* refreshed and removed NEWS section
* fixes unbinding when IPv6 is available
- Add '--disable-dependency-tracking' since we are not rebuilding
- Re-enable concurrent check target, but fall back to sequential on
failure. This allows quick test building, while allows
sequential unit test run. Run tests 3x before 'official' failure as
some are a little flaky (upstream acknowledges this)
- Append test_log in build output if there are failures
- Update to 4.1.4
* fixed build failure with latest libsodium
* handle IPv6 link local addresses
* fixed assertion failure in msg.cpp:390 on STREAM sockets
* fixed assertion failure in tcp.cpp after network reconnect
* fixed socket monitor hang
- Remove libsodium-init.patch - upstreamed
- Run %check rule sequentially to prevent assert failures
OBS-URL: https://build.opensuse.org/request/show/399056
OBS-URL: https://build.opensuse.org/package/show/devel:libraries:c_c++/zeromq?expand=0&rev=43
* Added explicit reference to static link exception in every source file.
* Bumped ABI version to 5:0:0 since 4.1.x changed the ABI.
* Fixed STDINT event interface macros to work with CZMQ 3.0.
* Fixed installation of man pages when BUILD_DOC is not set.
* Fixed#1428 - regression on single-socket proxies.
OBS-URL: https://build.opensuse.org/package/show/devel:libraries:c_c++/zeromq?expand=0&rev=33
- Add libsodium dep for testsuite where possible
- Version bump to 4.0.5 fixes bnc#898917 CVE-2014-7202 and
CVE-2014-7203:
* Fixed#1191; CURVE mechanism does not verify short term nonces.
* Fixed#1190; stream_engine is vulnerable to downgrade attacks.
* Fixed#1088; assertion failure for WSAENOTSOCK on Windows.
* Fixed#1015; race condition while connecting inproc sockets.
* Fixed#994; bump so library number to 4.0.0
* Fixed#939, assertion failed: !more (fq.cpp:99) after many ZAP requests.
* Fixed#872; lost first part of message over inproc://.
* Fixed#797, keep-alive on Windows.
OBS-URL: https://build.opensuse.org/package/show/devel:libraries:c_c++/zeromq?expand=0&rev=19
