Enhancements Added support for VLProxy thread dumps in support bundles. Requires VersaLex or later.

Transcription

1 * RELEASE /11/14 * - Added support for VLProxy thread dumps in support bundles. Requires VersaLex or later. - VLProxy takes approximately 90 seconds to recognize that a VLTrader has abnormally ended. During this time, any inbound reverse proxy requests sent to this VLTrader will get connection failures. Instead of letting the inbound request fail when this happens, VLProxy can now attempt to divert the request to one of the other synchronized VLTraders, which avoids client-side errors. The new Reverse Proxy Retry option offers four different settings: Prefer Active, Prefer Backup, Only Active, and Only Backup. Please refer to the documentation for descriptions of each of these settings. - Will no longer send alert if the reason for a reverse proxy failure is because VersaLex timed out (based on the setting of the Local Listener Connection Timeout advanced property). - Modified so that Operator Audit Trail and VLPortal can log the correct external IP address. ** * RELEASE /07/08 * ** - Added support for a configurable SSH FTP reverse proxy window size via the VLTrader ( or later) Local Listener advanced property 'SSHFTP Window Size'. - When forward proxying and any type of IOException occurs while transferring data to the receiver, the exception is now reported immediately instead of first reading (and throwing away) the entire content stream from the sender. - Now protect against EOFExceptions when processing a HEAD responses which contain Content-Length headers used to signify the number of bytes already received, not the number of bytes in the response message. ** * RELEASE /04/27 * **

2 - VLProxy SSL server ports now default to not including the anonymous (DH_anon) and non-encrypting (NULL) ciphers unless the VLTrader/LexiCom Local Listener advanced property "SSL Ciphers" has been set to "All Implemented". - Fixed problem when running VLPortal through VLProxy where the Manual File Transfer and File Transfer History pages were timing out when going through certain firewalls. Note that VLTrader is also needed to address this problem. Related incidents #92378, ** * RELEASE /03/28 * ** - Added support for RosettaNet Implementation Framework (RNIF) reverse proxying. - Fixed SSH FTP reverse proxy issue with server initiated key exchange which resulted in timeout errors. - Fixed null pointer exception when no reverse tunnel ports are available. - In the FTP Server, reduce CPU load when all ports in the passive port range are in use and a request for an open passive port has been made. ** * RELEASE /03/08 * ** - Added support for StartTLS connections for s (e.g. On Fail). StartTLS will be used when the server supports this mode. Related incident # Fixed SSH FTP reverse proxy issue with duplicate key exchange which resulted in timeout errors. ** * RELEASE /02/07 * ** - SSH FTP reverse proxy errors are now suppressed during version negotiation phase to prevent repetitive logging when simple port monitors are used.

3 * RELEASE /01/31 * - Added support for OFTP and OFTPs reverse proxying. - Added support for AS2 Restart HEAD requests. - Fixed null pointer exception at the end of an FTP session. - For SSH FTP reverse proxying, changed default idle timeout to match VLTrader default. Added check for common issue where FTP Idle timeout is default in VLTrader to prevent logging this exception to debug. ** * RELEASE /10/04 * ** - Added support for HTTP basicauth=... parameter in place of HTTP Authorization: Basic... header for incoming requests. Parameter value is in the same format as normal Basic authentication, but can be either clear text or base64 encoded. - Fixed problem where HTTP digest user authentication was not working inbound through VLProxy. - For SSH FTP reverse proxying to VLTrader, fixed problem where VLProxy would cause the connection on VLTrader to disconnect after configured VersaLex Read Timeout seconds of inactivity regardless of what the FTP Idle Timeout property was set to. * RELEASE /07/26 * - Added support for SSH FTP DSA server keys larger than 1024 bits. - VLTrader only: VLProxy now supports SSL client authentication for HTTP users configured in VLTrader. - and execute on failure updated to cover additional reverse proxy failures.

4 - Fixed issues with FTP connections remaining active after backend server had disconnected (and different connection counts). - Fixed problem with reverse forward FTP and SSH FTP connections where logins were attempted with a VLTrader which was not communicating. - Fixed memory leak associated with forward proxy HTTP connections (where HTTP CONNECT was used). ** * RELEASE /04/06 * ** - VLTrader only: VLProxy now supports interfacing with an LDAP server via VLTrader to authenticate external users inbound thru FTP, HTTP (including VLPortal), and SSH FTP. Go to Configure>Options>LDAP Server on VLTrader. VLTrader v or later is required. - VLTrader only: Prevent repeated logging of SSH_MS_IGNORE messages sent by PuTTY clients. Content will be logged to debug if debug level is sufficient. - Fixed issue where no attempt was ever made to use the VersaLex secondary IP address (sent in header from VersaLex) * RELEASE /12/09 * - So that an inbound port does not need to be opened through the firewall, VLProxy can now reverse proxy forward connections from VLTrader/LexiCom. This is enabled in VLTrader by checking "Reverse forward connections" in the VLProxy configuration. The VLTrader/LexiCom "Incoming Connection Backlog Size" advanced property dictates how many forward connections VLProxy will pool for inbound request processing. - Log archive file names now include a date/time range for the log entries within the archive. - Reverse proxy FTP SSL sessions may be reused when requested by client based on the client IP address (not dependent on both IP address and port).

5 - Fixed issue with client attack via disconnect message which could lead to out-of-memory errors. Related incident # Changed logging of SSH FTP disconnect message from error to warning for transport IOExceptions. - The configured Remote Read Timeout is now applied to writes as well as reads. Forward proxy writes will now timeout if the trading partner's server stops reading the sent payload. Before this change, connections would hang until the socket was eventually closed by the server. - Fixed problem with reverse proxy load balancing with SSH FTP users using public key authentication (PKA). * RELEASE /06/15 * - Added logic to cycle through available ports before attempting alternate IP address when connection exceptions occur during reverse proxy connections. - Added "REST STREAM" extension for FTP reverse proxy to support restarting failed transfers. - Fixed problem where inbound WWW digest authentication would always fail. - Fixed problem where active mode FTP into VLTrader FTP server using a specific source data port (e.g. 20) would occasionally cause socket bind exceptions. - Fixed FTP and SSH FTP reverse proxy login problems when the password began with a "*". - Changed memory monitoring message logic to include the amount of free memory available to avoid false indications when actual usage is much different than the maximum available. - Improved handling of SSH FTP reverse proxy connections (HTTP/s) to VLTrader when outbound network address translation is being used. * RELEASE /11/12 *

6 - When a GET method is made to either a known AS2 or ebxml resource, now allow the message to pass through to the first available VersaLex so the appropriate "Welcome" message is displayed. - Memory usage monitor will now log an error instead of a warning and send an when the total memory usage transitions above the maximum memory. - HTTP, FTP and SSH FTP reverse proxy welcome and banner messages may be configured by entering the desired text in the VLTrader Local Listener Responses panel. If configured in multiple VLTraders, these messages must be identical. - Added ability to use SMTP authentication usernames and passwords for outbound alerts. - Internal Address and Internal Network IDs settings now also apply when forward proxying an active (i.e. port) mode FTP client request out through VLProxy. Related incident # Added processing for FTP FEAT command. Requires VLTrader 4.0. Related incident # Fixed problem in version with updating security provider list which would cause OutOfMemory errors. - If Mail Server Password is configured, it will be shown as "**********" in the configuration display. - Corrected problem with blank line displayed in configuration after SMTP Mail Server Password. ** * RELEASE /08/06 * ** Major Added FIPS edition with support for using a FIPS approved security provider when used with VLTrader FIPS edition. The VLProxy FIPS edition is only compatible with VLTrader version [3.6.20] or better and has additional license restrictions. If multiple VLTraders are used with VLProxy, the VLTraders must have identical FIPS Mode settings. - SSH FTP: Corrected problem with unsupported implementation specific channel requests (i.e. simple@putty.projects.tartarus.org sent by PuTTY or FileZilla) which are now ignored or a SSH_MSG_CHANNEL_FAILURE message is returned if a reply is requested. Related incident # **

7 * RELEASE /06/18 * ** - Internal Address and Internal Network IDs settings now also apply when forward proxying an active (i.e. port) mode FTP client request out through VLProxy. Related incident # * RELEASE /04/15 * Major VLTrader only: Added support in VLProxy/VLTrader for reverse proxying SSH FTP client connections. See VLProxy documentation for details. - Corrected issue which may cause VLProxy to stop when the log file is restarted after archiving. - Fixed problem where a request from LexiCom/VLTrader was being rejected when LexiCom/VLTrader was running under JRE 1.5. * RELEASE /01/07 * Major Added Reverse Proxy Load Balancing configuration item. When this is "Yes" (default is "No"), reverse proxy connections will be balanced between any non-backup VersaLexes based on the number of current VLProxy connections with that VersaLex. - Changed the default setting for the java.security networkaddress.cache.ttl which indicates the caching policy for successful name lookups from the name service. When running as a service, the setting is changed from the default (-1, forever) to 5 minutes. Enhancement does not apply for JRE Added memory usage monitor which checks every 60 seconds and logs a message when the total memory transitions above or below the maximum memory. Enhancement does not apply for JRE Fixed problems with "service,stop" command-line not completing successfully if more than one forward port or multiple VersaLex serial numbers were defined.

8 ** * RELEASE /11/02 * ** - Added usage of Local FTP User mailbox advanced property "Active Mode Source Data Port" which can be used to specify the FTP server source data port for Active Mode when set to a value > 0. Default value is 0 where the data port is unspecified. Related incident # Fixed problem where VLProxy would periodically log IO exceptions while sending messages to VLTrader or LexiCom for viewing. ** * RELEASE /08/21 * ** - Fixed problem where VLProxy would freeze if exception occurred while sending messages to VLTrader or LexiCom for viewing. - Fixed FTP forward proxy issue to format the VLProxy external address correctly for Active FTP. ** * RELEASE /07/29 * ** - When accessing a VersaLex web GUI via VLProxy, added ability to specify required serial number concatenated to the resource (e.g. This helps to alleviate issues where the wrong VersaLex can be accessed because of cached information in the web browser. It is still strongly recommended that multiple VersaLexes not be accessed in the same web browser session. - Added wildcard (*) for Internal Network IDs which allows the Internal Address to always be returned in a passive FTP response - related incident Fixed FTP Server problem when an exception occured while creating a connection where server would stop listening on the port caused by cancelling a connection on a FTP (clear) client and where port on server was FTPs Implicit. Related incident

9 - Fixed problem causing out of memory errors due to tracking of each active forward-proxy connection. Connection was being tracked after it was no longer active. ** * RELEASE /07/02 * ** - Added alert when unable to start a reverse proxy port. - Added stop (service,stop) command-line option. - Added Internal Address and Internal Network ID's configuration for use with FTP server when both internal and external network access is needed. - Fixed problem where VLProxy was stripping an ending "/" off of the HTTP resource before forwarding. - Corrected issue where FTP reverse proxy ports were not being started on VLTrader restart or if no FTPs reverse proxy ports were defined. - Fixed problem where if the connection to VLTrader is unexpectedly reset for some reason during a reverse proxy FTP session request, subsequent requests would result in a NullPointerException. * RELEASE /04/30 * - Added support for inbound chunked HTTP messages. - For FTP reverse proxying to VLTrader, fixed problem where VLProxy would cause the FTP connection on VLTrader to disconnect after 60 seconds of inactivity regardless of what the Connection and FTP Idle Timeout properties were set to. * RELEASE /01/29 * - Upgraded each platform JRE (Java Runtime Environment) to a version which supports new 2007 US and Canada Daylight Savings Times. Please note that if you are currently using JRE 1.3 and choose during the installation to continue using JRE 1.3 rather than upgrading to JRE 1.4, you will NOT be using a JRE with the new DST changes. To obtain a JRE

10 1.3 with the new DST changes, use the following link to download the JRE 1.3 installer: XXXXXX&OS=Windows Linux AIX HPUX Solaris&PROD=VLProxy&JRE=1.3 - Now accept HttpOnly parameter in Set-Cookie header. * RELEASE /12/04 * - If connected to LexiCom/VLTrader version [3.2], VLProxy now sends its active messages (up to 200) to LexiCom/VLTrader in one group when View>VLProxy>Messages is first activated. This improves how quickly it takes LexiCom/VLTrader to display this initial set of messages. - Fixed problem where incoming ebms messages would be rejected with a "501 Not Implemented" because the CPA Id was not being extracted correctly from the SOAP message. * RELEASE /10/05 * - Added support for both a fully-qualified domain name for AS2 and an external IP address for FTP server as a comma separated External Address. - Corrected an issue in the mailing feature where when a mail server was undefined and s were being sent to multiple recipients at the same mail host, the process would hang indefinitely. - When any of the response codes that do not return content (i.e., < 200, 204, 205 and 304) are processed by VLProxy, it no longer returns a "Transfer-Encoding: chunked" header as part of the response. (This header may be rejected by HTTP/1.0 clients.) * RELEASE /08/08 *

11 - Added a new mailing feature that does not require that a mail server be defined. - Improved how VLProxy reverse proxys connections back to LexiCom/VLTrader to allow for only an outbound network address translation (NAT). * RELEASE /01/31 * - Added support for SSH FTP tunnelling. - Fixed problem where VLProxy was double encoding outbound request parameters. If the request included a space or other special characters, this would result in incorrect parameter names or values. - Fixed problem where VLProxy was not detecting an abrupt shutdown of a connected LexiCom/VLTrader. This was inhibiting VLProxy's ability to forward inbound requests to a backup VersaLex. * RELEASE /09/15 * - VLProxy now supports redundant LexiCom/VLTrader hot backups. Based solely on the order in which the VersaLex serial numbers are configured, primary and backup VersaLexes can both be live and attached to VLProxy. Only if and when the primary VersaLex is down will a backup VersaLex be forwarded inbound requests. Even within distributed VersaLex systems, each VersaLex sector of trading partners can have redundant, live backups through VLProxy. - Fixed problem where VLProxy would try to bind listening ports twice if two VersaLexes connected and sent initialization requests to VLProxy at the same time. - Fixed problem where VLproxy was not using the configured external address in responses to FTP PASV requests. - Fixed problem where reverse FTP requests were not being routed to the correct VersaLex when VLProxy was configured for more than one VLTrader/LexiCom.

12 - VLProxy configuration (VLProxyc -p) no longer writes to the logs/vlproxy.xml file. * RELEASE /05/05 * Major VLTrader only: Added support in VLProxy/VLTrader for reverse proxying FTP client connections. See VLProxy documentation for details. - Added support for forward proxying active mode FTP. - When forward proxying, fixed problem where VLProxy was consuming WWW authentication headers. * RELEASE /03/01 * Major Added support for the ebms protocol. - Keep track of AS2 relationships of active VersaLexes that have become inactive. If a message is sent for an inactive VersaLex, return "503 Service Unavailable". Previously this would perform the 'Unknown Partner Message Action'. - Added an additional configuration parameter (15. Unknown Partner Message Action). The valid values are (D)efer, (I)gnore, (R)eject, and (F)orward. See documentation for further details. - Do not timeout when reading from VersaLex. - Allow the HTTP reverse proxy ports to start without the HTTP/s reverse proxy ports. - Fixed problem where VLProxy would stop responding during an archive of the log file. - Fixed problem where all the return content data was not sent to the originating host. * RELEASE /08/16 *

13 Major Added support for Web-GUI access through VLProxy. - Added support for multiple non-redundant VersaLexes. - If configuration data was entered, display message stating the VLProxy service must be stopped and restarted. - When forwarding data to VersaLex from the reverse proxy, use the IP address that sent configuration data instead of the Local Listener's configured Local Host Address. - Added VLProxy version number to s generated by VLProxy. - Added checking of AS2 resource (new feature in VersaLex). - If a reverse proxy connection problem arises, read all content sent so that the remote host will read the "### Reason" response. - When using "VLProxyc -m" to watch the messages, the user can just press ENTER to stop watching messages. - Check that the user has read/write permission to the configuration file when going into configuration mode. Display an error and exit if the current user cannot write to the configuraiton file. - If a forward proxy connection problem arises, read all content sent so that VersaLex will read the "403 Forbidden" reason being sent. - Fixed problem when "Unknown Partner Action" was set to "Ignore" the entire input stream was not being read. - Fixed problem where incoming HTTP/1.0 would never be a keep-alive connection. * RELEASE /04/12 * Major Original release