nodogsplash

This is a bugfix release.

• Fix crash if query string is too long.

This release has the following fixes and enhancements:

• reset upload/download counter when a client has been authenticated a second time [mwarning]
• print session duration as 0 in "ndsctl json" and "ndsctl clients" output when a session has not been started [mwarning]
• rework html templater to speed up splash page generation [mwarning]
• FAS documentation updates [bluewavenet]...

This is meant as a bugfix release for CVE-2023-39120

• fix path traversal security issue
• add session_limit_block feature The session_limit_block is similiar to session_timeout_block, but instead of limiting the time, it limits the traffic. The session_limit_block allows to limit a user to a certain amount of traffic before the user will be blocked from applying again. *...

Version 5.0.0 has been forked from 3.3.2 in order to remove the FAS in a clean way. All patches from 4.5.1 has been backported.

• Remove the FAS (forward authentication service)
• ndsctl status: show Session Timeout
• debian: use native format
• common.h: increase QUERYMAXLEN to 4k
• ndsctl_auth(): ensure client->id does not change between search and modify
• fw_iptables: fix...

Security release

• Fix a path traversal attack