./security/stunnel, Universal SSL tunnel

[ CVSweb ] [ Homepage ] [ RSS ] [ Required by ] [ Add to tracker ]

Branch: CURRENT, Version: 5.07, Package name: stunnel-5.07, Maintainer: jym

The stunnel program is designed to work as SSL encryption wrapper
between remote client and local (inetd-startable) or remote server.
The concept is that having non-SSL aware daemons running on your
system you can easily setup them to communicate with clients over
secure SSL channel.

stunnel can be used to add SSL functionality to commonly used inetd
daemons like POP-2, POP-3 and IMAP servers without any changes in
the program code.

Required to run:

Package options: inet6, tcpwrappers, threads

Master sites:

SHA1: 006002eec15881214257e50a967422318720c501
RMD160: dee4871b98082d0baa9d5527dc4770ef20f096f6
Filesize: 585.069 KB

Version history: (Expand)

CVS history: (Expand)

   2014-11-07 12:30:47 by Amitai Schlair | Files touched by this commit (4) | Package updated
Log message:
Update to 5.07. From the changelog:

Version 5.07, 2014.11.01, urgency: MEDIUM:
* New features
  - Several SMTP server protocol negotiation improvements.
  - Added UTF-8 byte order marks to stunnel.conf templates.
  - DH parameters are no longer generated by "make cert".
    The hardcoded DH parameters are sufficiently secure,
    and modern TLS implementations will use ECDH anyway.
  - Updated manual for the "options" configuration file option.
  - Added support for systemd 209 or later.
  - New --disable-systemd ./configure option.
  - setuid/setgid commented out in stunnel.conf-sample.
* Bugfixes
  - Added support for UTF-8 byte order mark in stunnel.conf.
  - Compilation fix for OpenSSL with disabled SSLv2 or SSLv3.
  - Non-blocking mode set on inetd and systemd descriptors.
  - shfolder.h replaced with shlobj.h for compatibility
    with modern Microsoft compilers.

Version 5.06, 2014.10.15, urgency: HIGH:
* Security bugfixes
  - OpenSSL DLLs updated to version 1.0.1j.
  - The insecure SSLv2 protocol is now disabled by default.
    It can be enabled with "options = -NO_SSLv2".
  - The insecure SSLv3 protocol is now disabled by default.
    It can be enabled with "options = -NO_SSLv3".
  - Default sslVersion changed to "all" (also in FIPS mode)
    to autonegotiate the highest supported TLS version.
* New features
  - Added missing SSL options to match OpenSSL 1.0.1j.
  - New "-options" commandline option to display the list
    of supported SSL options.
* Bugfixes
  - Fixed FORK threading build regression bug.
  - Fixed missing periodic Win32 GUI log updates.

Version 5.05, 2014.10.10, urgency: MEDIUM:
* New features
  - Asynchronous communication with the GUI thread for faster
    logging on Win32.
  - systemd socket activation (thx to Mark Theunissen).
  - The parameter of "options" can now be prefixed with "-"
    to clear an SSL option, for example:
    "options = -LEGACY_SERVER_CONNECT".
  - Improved "transparent = destination" manual page (thx to
    Vadim Penzin).
* Bugfixes
  - Fixed POLLIN|POLLHUP condition handling error resulting
    in prematurely closed (truncated) connection.
  - Fixed a null pointer dereference regression bug in the
    "transparent = destination" functionality (thx to
    Vadim Penzin). This bug was introduced in stunnel 5.00.
  - Fixed startup thread synchronization with Win32 GUI.
  - Fixed erroneously closed stdin/stdout/stderr if specified
    as the -fd commandline option parameter.
  - A number of minor Win32 GUI bugfixes and improvements.
  - Merged most of the Windows CE patches (thx to Pierre Delaage).
  - Fixed incorrect CreateService() error message on Win32.
  - Implemented a workaround for defective Cygwin file
    descriptor passing breaking the libwrap support:
    http://wiki.osdev.org/Cygwin_Issues#Pas … escriptors

Version 5.04, 2014.09.21, urgency: LOW:
* New features
  - Support for local mode ("exec" option) on Win32.
  - Support for UTF-8 config file and log file.
  - Win32 UTF-16 build (thx to Pierre Delaage for support).
  - Support for Unicode file names on Win32.
  - A more explicit service description provided for the
    Windows SCM (thx to Pierre Delaage).
  - TCP/IP dependency added for NT service in order to prevent
    initialization failure at boot time.
  - FIPS canister updated to version 2.0.8 in the Win32 binary
* Bugfixes
  - load_icon_default() modified to return copies of default icons
    instead of the original resources to prevent the resources
    from being destroyed.
  - Partially merged Windows CE patches (thx to Pierre Delaage).
  - Fixed typos in stunnel.init.in and vc.mak.
  - Fixed incorrect memory allocation statistics update in
  - Missing REMOTE_PORT environmental variable is provided to
    processes spawned with "exec" on Unix platforms.
  - Taskbar icon is no longer disabled for NT service.
  - Fixed taskbar icon initialization when commandline options are
  - Reportedly more compatible values used for the dwDesiredAccess
    parameter of the CreateFile() function (thx to Pierre Delaage).
  - A number of minor Win32 GUI bugfixes and improvements.
   2014-08-10 16:54:12 by Thomas Klausner | Files touched by this commit (2) | Package updated
Log message:
Update to 5.03:

Version 5.03, 2014.08.07, urgency: HIGH:
* Security bugfixes
  - OpenSSL DLLs updated to version 1.0.1i.
    See https://www.openssl.org/news/secadv_20140806.txt
* New features
  - FIPS autoconfiguration cleanup.
  - FIPS canister updated to version 2.0.6.
  - Improved SNI diagnostic logging.
* Bugfixes
  - Compilation fixes for old versions of OpenSSL.
  - Fixed whitespace handling in the stunnel.init script.

Version 5.02, 2014.06.09, urgency: HIGH:
* Security bugfixes
  - OpenSSL DLLs updated to version 1.0.1h.
    See https://www.openssl.org/news/secadv_20140605.txt
* New features
  - Major rewrite of the protocol.c interface: it is now possible to add
    protocol negotiations at multiple connection phases, protocols can
    individually decide whether the remote connection will be
    established before or after SSL/TLS is negotiated.
  - Heap memory blocks are wiped before release.  This only works for
    block allocated by stunnel, and not by OpenSSL or other libraries.
  - The safe_memcmp() function implemented with execution time not
    dependent on the compared data.
  - Updated the stunnel.conf and stunnel.init templates.
  - Added a client-mode example to the manual.
* Bugfixes
  - Fixed "failover = rr" broken since version 5.00.
  - Fixed "taskbar = no" broken since version 5.00.
  - Compilation fix for missing SSL_OP_MSIE_SSLV2_RSA_PADDING option.
   2014-05-30 01:38:20 by Thomas Klausner | Files touched by this commit (3049)
Log message:
Bump for perl-5.20.0.
Do it for all packages that
* mention perl, or
* have a directory name starting with p5-*, or
* depend on a package starting with p5-
like last time, for 5.18, where this didn't lead to complaints.
Let me know if you have any this time.
   2014-04-29 15:47:45 by Ryo ONODERA | Files touched by this commit (2) | Package updated
Log message:
Update to 5.01

Version 5.01, unreleased, urgency: HIGH:
* Security bugfixes
  - OpenSSL DLLs updated to version 1.0.1g.
    This version mitigates TLS heartbeat read overrun (CVE-2014-0160).
* New features
  - X.509 extensions added to the created self-signed stunnel.pem.
  - "FIPS = no" also allowed in non-FIPS builds of stunnel.
  - Search all certificates with the same subject name for a matching
    public key rather than only the first one (thx to Leon Winter).
  - Create logs in the local application data folder if stunnel folder
    is not writable on Win32.
* Bugfixes
  - close_notify not sent when SSL still has some data buffered.
  - Protocol negotiation with server-side SNI fixed.
  - A Mac OS X missing symbols fixed.
  - Win32 configuration file reload crash fixed.
  - Added s_pool_free() on exec+connect service retires.
  - Line-buffering enforced on stderr output.
   2014-03-12 01:24:35 by Jean-Yves Migeon | Files touched by this commit (3) | Package updated
Log message:
Update stunnel to 5.00.

Of utmost importance: it fixes CVE 2014-0016.

Thanks to jgw (Jeff W) _AT_ sdf.org for working on the same patch

In before the freeze! Changelog follows.

    Security bugfixes
        Added PRNG state update in fork threading (CVE-2014-0016).
    New global configuration file defaults
        Default "fips" option value is now "no", as FIPS \ 
mode is only helpful for compliance, and never for actual security.
        Default "pid" is now "", i.e. not to create a pid \ 
file at startup.
    New service-level configuration file defaults
        Default "ciphers" updated to \ 
"HIGH:MEDIUM:+3DES:+DH:!aNULL:!SSLv2" due to AlFBPPS attack and bad \ 
performance of DH ciphersuites.
        Default "libwrap" setting is now "no" to improve \ 
    New features
        OpenSSL DLLs updated to version 1.0.1f.
        zlib DLL updated to version 1.2.8.
        autoconf scripts upgraded to version 2.69.
        TLS 1.1 and TLS 1.2 are now allowed in the FIPS mode.
        New service-level option "redirect" to redirect SSL client \ 
connections on authentication failures instead of rejecting them.
        New global "engineDefault" configuration file option to \ 
control which OpenSSL tasks are delegated to the current engine. Available \ 
        New service-level configuration file option "engineId" to \ 
select the engine by identifier, e.g. "engineId = capi".
        New global configuration file option "log" to control whether \ 
to append (the default), or to overwrite log file while (re)opening.
        Different taskbar icon colors to indicate the service state.
        New global configuration file options "iconIdle", \ 
"iconActive", and "iconError" to select status icon on GUI \ 
        Removed the limit of 63 stunnel.conf sections on Win32 platform.
        Installation of a sample certificate was moved to a separate \ 
"cert" target in order to allow unattended (e.g. scripted) \ 
        Reduced length of the logged thread identifier. It is still based on the \ 
OS thread ID, and thus not unique over long periods of time.
        Improved readability of error messages printed when stunnel refuses to \ 
start due to a critical error.
        LD_PRELOAD Solaris compatibility bug fixed (thx to Norm Jacobs).
        CRYPTO_NUM_LOCKS replaced with CRYPTO_num_locks() to improve binary \ 
compatibility with diverse builds of OpenSSL (thx to Norm Jacobs).
        Corrected round-robin failover behavior under heavy load.
        Numerous fixes in the engine support code.
        On Win32 platform .rnd file moved from c:\ to the stunnel folder.
   2014-03-11 15:05:19 by Jonathan Perkin | Files touched by this commit (350)
Log message:
Remove example rc.d scripts from PLISTs.

These are now handled dynamically if INIT_SYSTEM is set to "rc.d", or
ignored otherwise.
   2014-02-13 00:18:57 by Matthias Scheler | Files touched by this commit (1568)
Log message:
Recursive PKGREVISION bump for OpenSSL API version bump.
   2014-01-26 17:59:13 by Matthias Scheler | Files touched by this commit (2) | Package updated
Log message:
Update "stunnel" package to version 4.56. Changes since 4.55:
- Fixed a regression bug introduced in version 4.55 causing random
  crashes on several platforms, including Windows 7.
- Fixed incorrect "stunnel -exit" process synchronisation.
- Fixed FIPS detection with new versions of the OpenSSL library.
- Failure to open the log file at startup is no longer ignored.