Shrew Soft VPN Client Changelog

What's new in Shrew Soft VPN Client 2.2.2

Jul 1, 2013

Update the documentation to reflect features offered in the 2.2.2 release. Modify the installer to reference the new chm file name.
Modify the Professional edition trial period logic. When a newer version of the VPN Client is installed, the trial period is now reset. This will occur once when a newer pre-release version is installed and once again when a newer release version is installed. This should allow users to evaluate the VPN Client professional edition features as new releases are made available but still require a license key for long term use.
Modify the VPN Connect program to correct poor behavior related to the auto reconnect feature. Previously when this feature was enabled, the client would attempt to reconnect even if user authentication failed. The client will now only attempt to reconnect after the initial connection succeeds.
Fix a problem that caused the Professional edition 14 day trial to start even when the Standard edition was installed. The trial period will now only start when the user chooses install the Professional version.
Modify the Professional version of the VPN Access Manager trial dialog. A new button has been added that opens a browser window displays the online Shrew Soft Shop.
Correct an issue that could cause incorrect detection of a professional vs standard install.
Correct an issue that could cause incorrect detection of a professional vs standard install.
Modify the NSIS installer script to fix issues related to silent installations. Also correct a bug that prevented a previous version of client components from being removed during a silent installation. While here, several additional command line options were added to allow for more flexible installation from the command line. These options are /STANDARD ( select the standard edition for installation instead of the professional ), /NODNS ( do not install the transparent DNS proxy daemon that provides split DNS support ), /NOSDL ( do not install the security credential provider that provides secure AD/Domain login support ), /NOMENU ( do not create start menu shortcuts ) and /NODESK ( do not create desktop icons ).
Modify the Access Manager and VPN Connect applications to allow for automatic reconnect to the vpn gateway.

New in Shrew Soft VPN Client 2.2.2 RC3 (Jun 28, 2013)

New in Shrew Soft VPN Client 2.2.2 RC2 (Jun 27, 2013)

New in Shrew Soft VPN Client 2.2.2 RC1 (Jun 17, 2013)

New in Shrew Soft VPN Client 2.2.1 (Jun 6, 2013)

New in Shrew Soft VPN Client 2.2.0 (Apr 24, 2013)

New in Shrew Soft VPN Client 2.2.0 RC 4 (Apr 8, 2013)

New in Shrew Soft VPN Client 2.2.0 RC 3 (Apr 8, 2013)

New in Shrew Soft VPN Client 2.2.0 RC 2 (Jan 3, 2013)

New in Shrew Soft VPN Client 2.2.0 Beta 2 (Sep 2, 2011)

New in Shrew Soft VPN Client 2.2.0 Beta 1 (Sep 2, 2011)

Modify the Security Credentials provider to provide a more concise error
message when a username or password is blank.
Modify the iked Windows platform specific client setup and cleanup
functions to manage virtual adapter and DNS proxy settings. These were
removed from the main client control code.
Modify the Windows VPN Connect application to catch up with the options
parser changes in the generic client control interface class. The
Application has gained the ability to resume tunnel control when a
Secure Domain Login control file is present.
Modify the Shrew Soft credential provider to allow a Domain name to be
specified at login time. If the Domain name field is left blank, the
local host name is used ( local login ). After a login succeeds, the
client tunnel control interface is suspended and a control file is
written.
Modify the NSIS installer to create a Startup shortcut for All Users
which launches the VPN Connect application in a mode that resumes tunnel
control when applicable.
Modify the new Windows Vista/7 security credentials provider to create
Shrew Soft VPN connections based on the information provided during the
login process. Before credentials are provided to the windows login
process, the connection is established to the selected site
configuration. All error feedback is buffered and displayed to the user
via the standard Windows login error screen. The VPN connection
currently dies after the Windows login is completed. Nor do we provide
the UI components required to support protected RSA keyfile passwords or
login banners. These remaining issues will be corrected in a follow-up
commit.
Modify a few more Windows projects to remove include directories and
library dependencies that are no longer required.
Modify the NSIS installer to only allow the security credentials
provider to be installed on Vista and later Windows platforms.
Modify the NSIS installation scripts to include a section for the
security credentials provider.
Move our copy of pfkeyv2.h file into the private project. It's only used
for Windows builds. Update the appropriate MSVC projects to include this
new path. The new SSH2 algorithms have been renamed to use the HMAC
suffix as this seems consistent with the other defined algorithm names.
Remove all unnecessary project dependencies now that liblog and libith
are not required for libidb.
Import the Shrew Soft Credentials Provider project. At the moment, it
only contains user interface customizations. It has yet to be integrated
with libike.
Correct a regression in the Windows VPN Connect application where the
username and password fields were being displayed when a non Xauth
enabled mode was in use. Thanks to Kevin on the vpn-help mailing list
for reporting this.
Correct a few issues with the Windows VPN Access Manager application
related to DNS configuration problems. Certain widgets were not being
enabled/disabled correctly based on the user selections.

New in Shrew Soft VPN Client 2.2.0 Alpha 11 (Sep 2, 2011)

Modify the Windows VPN Access Manager to support the creation and remove
of public site configs. A user with administrative privileges designates
a site configuration as public when they need it to be accessed by all
users on the host. The conflict dialog has also been removed in favor of
automatic name mangling to prevent duplicates, similar to the
Linux/BSD/OSX Access Manager.
Modify the Windows VPN Connect to save the user name when a successful
connection is made and the user preference requests it.
Modify the Windows VPN Access manager to not request updated site
configurations to be saved to the original file during import
operations.
Remove support for migrating site configurations from the registry to
files. This has been implemented in the libike site configuration
manager class.
Modify the Windows VPN Access Manager to store certificate and key data
directly in the site configuration. A user selects the file location for
the contents to be embedded instead of using a reference to the file
location.
Modify the Windows UI components to support dh groups 16, 17 and 18.
Remove the site configuration upgrade functionality from the Windows VPN
Access Manager application. This is now handled by the cross platform
configuration manager class.
Modify the Windows GUI components to track recent changes related to
client and site configuration management. Site configs are now stored as
files under the username "AppData\Shrew Soft VPN\sites" path. Also,
correct a few bugs related to renaming site configurations and sorting
operations.
Add a missing file to the Window VPN Access Manager project that was
missed in the last commit.
Perform a code cleanup of the VPN Access Manager in preparation for the
upcoming configuration storage changes. Fix a but in the VPN Connection
application that was preventing preferences from being applied
correctly.
Modify the Windows VPN Connect application to use the generic CLIENT
class. This unifies the connection code path for both Linux/BSD, OSX and
Windows platforms. Update all Windows application names to not be
prefixed with Shrew Soft. There was a request to shorten the names on
the mailing list so that the profile name could be seen.
Modify the VPN Access Manager and the VPN Connect applications to use
the config functions which now live in libike. Remove the ipsecp project
and related source code. Update the NSIS installer scripts to reflect
the absence of the library.
Move the dialog configuration helper functions from libipsecp to ipseca.
They were only use by the Access Manager. Introduce a new config manager
class that handles file and registry operations of the config class.
This is in preparation of migrating the config code into libike and
retiring libipsecp.
Modify the Windows GUI components and the IPsec daemon to support SHA2
algorithms. We now include hash and hmac options for the 256, 384 and
512 bit variants.
Modify the VPN Connect and VPN Access Manager programs to improve visual
style and handle keyboard navigation more properly. We now perform a
runtime check to see if the OS is Windows XP or later. If so, we enable
the theme dialog texture on our pages to use the appropriate styles and
color. We also manually set the dialog z-order so that keyboard
navigation is more natural between outer and inner dialog tabs.
Update the Windows GUI tools to fix some accessibility issues. The VPN
Access Manager now allows proper keyboard navigation to site
configuration icons and tab stops now work in the site properties
dialog. The foreground color for text has been changes to use the system
color in the VPN Connect and VPN trace application. This allows the test
to be viewable when high contrast color schemes are in use. These bugs
were reported by Aaron Howell and Joshua Hudson.
Modify the daemons and the kernel driver interface libraries to conform
to recent libith changes. This will help user land programs interact
with the drivers more correctly, especially when drivers try to unload
unexpectedly.
Update the copyright on the license text file to match the current year.
Update the NSIS installer to prefix the Start Menu short cut links with
VPN so they are more easily located. Suggested by Grant and Brian Mathis
on the vpn-devel list.

New in Shrew Soft VPN Client 2.1.7 (Sep 2, 2011)

New in Shrew Soft VPN Client 2.1.6 (Sep 2, 2011)

Generate HTML documents by topic name not by UID. This should prevent
links to the documentation from breaking every time its re-generated
from source.
Update the help documentation to reflect the policy level changes.
Modify iked to store a DHCP MAC address seed value in the Windows
registry. Another file storage mechanism will be used on Linux and BSD.
Modify ipsecd to not add padding to ESP payloads when the pad length
equals the block cipher size. Certain gateways drop the packets when
additional padding is optionally appended. Thanks to Andrew Langefeld at
Adtran for diagnosing the issue.
Modify ipsecd to avoid responding to ARP requests on the virtual adapter
when the ARP source and target match a NONE policy. This helps the
client work correctly when the local host network overlaps with a
tunneled network.
Modify the Windows NSIS installer script to be smarter about upgrading a
system. If removing components require a reboot, do this before we
install new components. The installer now prompts the user to reboot and
automatically restarts the installer.
Prepare for signed kernel driver releases. The source code has now been
relocated to a separate repository branch. The code is now common among
all releases. A subversion property is now used to point a vpn client
release at a particular kernel release branch bin folder that contains
the signed kernel drivers. Remove the kernel code source from this
branch and update the scripts to point to the new subversion external.
Fix another bug in the driver package build script.
Switch DNS proxy port to 4553. Using 50053 can cause conflicts if the OS
allocates that port for dynamic use.
Fix a bug in the driver package build script. This was preventing a
complete build of install package after a fresh checkout.
Modify the DNS proxy daemon to install DNS divert rules when an active
connection has proxy policies installed. The DNS divert rules are
removed when the proxy policy count reaches zero. Also switch the UDP
DNS proxy port from 8053 to 50053 to avoid any potential conflict with
other software that may use this port.
Modify the IPsec daemon to only install the ARP mirror rule when a pfkey
client has IPsec security policies installed. The ARP mirror rule is
removed when the security policy count reaches zero.
------------------------------------------------------------------------
r1417 | mgrooms | 2010-07-09 07:10:35 +0000 (Fri, 09 Jul 2010) | 1 line
Update documentation images and catch up with some feature changes.
Correct a regression in libvnet. When a iked attempts to acquire a
virtual adapter and none are available, libvnet creates a new device on
behalf of the caller. This process was broken on Windows Vista/7
platforms. To correct this, adapt the updated device creation code in
our installation helper application devcfg to work in libvnet. Device
creation now works correctly on all supported Windows platforms.
Use correct branch name.
Branch for 2.1.6 release.
Update dptd to specify larger packet buffer sizes for use with libike
packet read functions. Make sure we reset the IP packet buffer size
after every read. Simplify the DNS state handling code. The refcount
implementation was overkill considering how simple the locking
requirements are. We now use simple mutex locking to protect the state
list.
Update iked to use specify larger packet buffer sizes for use with
libike packet read functions. While here, normalize some common variable
name suffixes so they are more uniform.
Correct a regression in the iked socket wrapper code. After fixing
several bugs in the NDIS6 LWF driver, the client interface library now
honors an option that was previously being ignored. The socket wrapper
no longer requests that only a single packet be returned for each recv
call. This causes IP/UDP fragments to be dropped since the call would
overwrite any unread packet data that had been returned in a previous
call. To avoid this, a new libike member function has been added to
allow a caller to check to see if data is available in the recv buffer.
The recv function is now only called when the recv buffer is empty.
Correct an issue in iked related to registry address list handling. Make
sure we null the buffer before reading and parsing an address list.
Otherwise, we may believe we read an address from a zero data length
registry value. This leads to problems when we attempt to revert
temporary address modifications. Many thanks to St?\195?\169phane Daguet
for submitting the bug report and his before/during/after registry
screen shots.
Modify the Windows release build script to sign all executables. This
allows a descriptive name and the company name to be displayed when
prompted by UAC. Also juggle the VPN Trace application icon resources so
that they are used correctly by the Windows shell. Previously, the low
resolution icon was being displayed when the high resolution version
should have been.
Add Windows program manifest files for the IKE, IPSEC and DNS daemons as
well as the VPN Trace application. These manifests specify that
administrative privileges are required for proper operation. This should
avoid the issue where the VPN Trace application appears broken due to
insufficient execution privileges.
Modify the Windows IPsec daemon, VPN Connect and VPN Access Manager
applications to support the new IPsec policy level options. These
changes are compatible with Linux/BSD PF_KEY conventions.
Fix a bug in the NDIS6 LWF driver. When a Miniport indicates received
NBLs using the RESOURCES flag, make sure we revert any changes we made
to the linked list before returning. Otherwise, the calling driver may
fail to reclaim the associated NBLs resources and eventually stop
indicating traffic. Add send and receive NBL functions which are
equivalent to the Microsoft Passthrough samples. These will remain
commented out but could be useful for testing issues in the future.
While here, rewrite a user device handle NULL pointer check to be
correct.
Bump all driver versions for the next beta release.
When installing the NDIS5 filter drivers on 2K/XP, call DIFx pre-install
on both mfilter and pfilter INFs. An IM driver install doesn't appear to
be complete without calling pre-install on the miniport INF but the
driver isn't removed properly unless remove is also called on protocol
INF. This appears to leave systems cleaner after our software is removed
and also avoids a crash when the Novell client is installed. While here,
correct a drvcfg message box typo displayed during error conditions.
Modify the vvflt driver to avoid crashes when handling WANLINE UP/DOWN
notification messages. We now perform several sanity checks on the
message structure and avoid calls to RtlUnicodeStringToAnsiString which
should not be called at dispatch level. Many thanks to Joel Wener who
reported this issue, provided minidumps and tested several candidate
fixes before a correct solution could be found. Bump all driver versions
to reflect a new build number.
Modify the libup IPROUTE iface_2_addr member function to pass a gateway
address value. This allow us to use fuzzy matching to select the correct
address when multiple addresses exist for a single interface.
Update the internal driver version number. It was out of sync with the
inf version.
Update the internal driver version number. It was out of sync with the
inf version.
Modify the Windows VPN Connect application to blank the password once a
connection attempt is in flight. Also add an installation check to
ensure the software is not being installed with compatibility settings
enabled. This can have dire consequences as incorrect kernel drivers can
be installed as a result of the OS reporting an incorrect version during
install. The software also performs runtime checks to execute the
correct code path based on the OS version reported.
Modify iked to not hold a virtual network device handle open during the
life of the connection. Instead, we now open and close device handles as
needed during tunnel setup and teardown. This allows systems to easily
transition to a low power state without iked monitoring the handle for
errors.
Correct a regression in the flt drivers which was introduced recently.
After collecting a list of fragmented packets, recreate the test buffer
using the data from the lead packet. This fixes fragment processing in
the filter code path.
Keep track of the number of active adapters when NDIS6 filter adapter
bindings are being paused or restarted. We use this count to determine
when the system will potentially transition into a low power mode or a
system shutdown. When this occurs, all bindings are paused so we use
this opportunity to proactively free resources and fail certain client
requests.
Update driver inf and resource files to reflect a version and date
change.
Modify the NDIS5 and NDIS6.2 filter drivers to validate Ethernet packets
match the adapter Ethernet address before processing. This should allow
bridged networking services ( VMware and VirtualBox bridged networking )
to co-exist with the Shrew Soft VPN client on the host computer.
Correct a bug in the vflt interface library that did not classify an
error return code properly. This caused the driver unload process to
hang because a service would not close the handle after returning from a
select call general failure ( ie, device no longer available ).
Push down the select ioctl error handling into the select function call
on windows. We want to recycle the handle in the case of an unexpected
closure.
Update the NDIS6 LWF driver to NDIS6.1 and implement support for Windows
7 Mobile Broadband adapters. This change includes some fairly major
changes to the IPv4 fragmentation cache and packet filtering code.
Windows Mobile Broadband adapters pass raw IP frames with no Ethernet
headers so several key function were modified to bypass Ethernet header
processing to accommodate this. Several issues were also corrected where
an IPv6 frame could be evaluated as an IPv4 frame. This could cause
instability in some edge cases.
Update all driver inf and resource files to reflect a version change. We
now use the latest WDK to build the NDIS5 drivers using the WXP platform
type. Several tests were run to ensure the Windows 2K OS platforms were
unaffected.
Modify the windows access manager application to allow for 0.0.0.0/0
routes to be added as an include network. This will allow clients to
force all traffic across the tunnel even if a split network list is
received by the gateway. Fix a bug that caused pcf imports to be
incomplete when a group name was not specified. We now set a default
local identity type value of address for PSK authentication modes and
asn1dn for RSA modes. Fix a bug that caused pcf imports to fail when a
key name was specified with no value.
Rervert our change to the NDIS5 virtual network driver that removed
handling of OID_802_3_MAXIMUM_LIST_SIZE. Apparently it is required for
proper operation even if we don't support multicast addresses.
Correct a minor whitespace nit in NDIS6 virtual adapter driver.
Add a run time check in our NDIS5 driver to determine if we are running
on Windows 2000 or XP. Convert the statistics to return 32bit counter
values on 2000 and 64bit on XP. Use 64bit counters in our NDIS6 driver
for SentOk and RecvOk. All other NDIS6 counters already returned 64bit
values.
Remove handling of OID_802_3_MAXIMUM_LIST_SIZE in our NDIS5/6 drivers as we don't support multi-cast addresses.
Return NDIS_STATUS_NOT_SUPPORTED in our NDIS5 driver for all IODs that
we don't handle instead of NDIS_STATUS_INVALID_OID. This is what
examples in the WDK do.
Update the NDIS5/6 virutal adapter INFs to report NCF_VIRTUAL as
suggested by Thomas.
Modify libvnet and consumers to be more intelligent when opening device
handles. When read access is requested, the driver queues packets on the
send path on behalf of the consumer. This is undesirable unless we
really plan to read them.
Revert a minor change that was unnecessary for proper NDIS6 virtual
network adapter statistics gathering.
Update the test_vnet application to allow the adapter link state and
speed to be manually set.
Update both the NDIS5 and NDIS6 virtual network adapter drivers to
report statistics correctly.
Add the Visual Studio project I missed while adding test_vnet in a
previous commit.
Merge the filter and virtual adapter interface library code in from
head. This provides the appropriate control interfaces for the updated
kernel drivers. Modify consumers to honor these changes.
Bring in virtual network adapter changes from the private driver
development branch. The updated driver allows for functionality similar
to *nix tap devices. Also import a new vnet_test application which
creates a virtual Ethernet bridge between two systems using UDP socket
relay. This allows us to stress test the new features in a lab
environment.

Shrew Soft VPN Client Changelog

What's new in Shrew Soft VPN Client 2.2.2

New in Shrew Soft VPN Client 2.2.2 RC3 (Jun 28, 2013)

New in Shrew Soft VPN Client 2.2.2 RC2 (Jun 27, 2013)

New in Shrew Soft VPN Client 2.2.2 RC1 (Jun 17, 2013)

New in Shrew Soft VPN Client 2.2.1 (Jun 6, 2013)

New in Shrew Soft VPN Client 2.2.0 (Apr 24, 2013)

New in Shrew Soft VPN Client 2.2.0 RC 4 (Apr 8, 2013)

New in Shrew Soft VPN Client 2.2.0 RC 3 (Apr 8, 2013)

New in Shrew Soft VPN Client 2.2.0 RC 2 (Jan 3, 2013)

New in Shrew Soft VPN Client 2.2.0 Beta 2 (Sep 2, 2011)

New in Shrew Soft VPN Client 2.2.0 Beta 1 (Sep 2, 2011)

New in Shrew Soft VPN Client 2.2.0 Alpha 11 (Sep 2, 2011)

New in Shrew Soft VPN Client 2.1.7 (Sep 2, 2011)

New in Shrew Soft VPN Client 2.1.6 (Sep 2, 2011)

New in Shrew Soft VPN Client 2.1.5 Stable (Dec 14, 2009)

New in Shrew Soft VPN Client 2.2.0 Alpha 9 (Aug 7, 2009)

New in Shrew Soft VPN Client 2.1.4 (Nov 13, 2008)

New in Shrew Soft VPN Client 2.1.1 (Jul 9, 2008)

New in Shrew Soft VPN Client 2.0.0 (Aug 2, 2007)