./security/stunnel, Universal SSL tunnel

[ CVSweb ] [ Homepage ] [ RSS ] [ Required by ] [ Add to tracker ]


Branch: CURRENT, Version: 5.00, Package name: stunnel-5.00, Maintainer: jym

The stunnel program is designed to work as SSL encryption wrapper
between remote client and local (inetd-startable) or remote server.
The concept is that having non-SSL aware daemons running on your
system you can easily setup them to communicate with clients over
secure SSL channel.

stunnel can be used to add SSL functionality to commonly used inetd
daemons like POP-2, POP-3 and IMAP servers without any changes in
the program code.


Required to run:
[lang/perl5]


Package options: inet6, tcpwrappers, threads

Master sites:

SHA1: a048e24529e3b4cb787838ea6de5c6475746f197
RMD160: cd5efaec920529e65f5d233254110d5ae605535b
Filesize: 572.986 KB

Version history: (Expand)


CVS history: (Expand)


   2014-03-12 01:24:35 by Jean-Yves Migeon | Files touched by this commit (3) | Package updated
Log message:
Update stunnel to 5.00.

Of utmost importance: it fixes CVE 2014-0016.

Thanks to jgw (Jeff W) _AT_ sdf.org for working on the same patch
independently.

In before the freeze! Changelog follows.

    Security bugfixes
        Added PRNG state update in fork threading (CVE-2014-0016).
    New global configuration file defaults
        Default "fips" option value is now "no", as FIPS \ 
mode is only helpful for compliance, and never for actual security.
        Default "pid" is now "", i.e. not to create a pid \ 
file at startup.
    New service-level configuration file defaults
        Default "ciphers" updated to \ 
"HIGH:MEDIUM:+3DES:+DH:!aNULL:!SSLv2" due to AlFBPPS attack and bad \ 
performance of DH ciphersuites.
        Default "libwrap" setting is now "no" to improve \ 
performance.
    New features
        OpenSSL DLLs updated to version 1.0.1f.
        zlib DLL updated to version 1.2.8.
        autoconf scripts upgraded to version 2.69.
        TLS 1.1 and TLS 1.2 are now allowed in the FIPS mode.
        New service-level option "redirect" to redirect SSL client \ 
connections on authentication failures instead of rejecting them.
        New global "engineDefault" configuration file option to \ 
control which OpenSSL tasks are delegated to the current engine. Available \ 
tasks: ALL, RSA, DSA, ECDH, ECDSA, DH, RAND, CIPHERS, DIGESTS, PKEY, \ 
PKEY_CRYPTO, PKEY_ASN1.
        New service-level configuration file option "engineId" to \ 
select the engine by identifier, e.g. "engineId = capi".
        New global configuration file option "log" to control whether \ 
to append (the default), or to overwrite log file while (re)opening.
        Different taskbar icon colors to indicate the service state.
        New global configuration file options "iconIdle", \ 
"iconActive", and "iconError" to select status icon on GUI \ 
taskbar.
        Removed the limit of 63 stunnel.conf sections on Win32 platform.
        Installation of a sample certificate was moved to a separate \ 
"cert" target in order to allow unattended (e.g. scripted) \ 
installations.
        Reduced length of the logged thread identifier. It is still based on the \ 
OS thread ID, and thus not unique over long periods of time.
        Improved readability of error messages printed when stunnel refuses to \ 
start due to a critical error.
    Bugfixes
        LD_PRELOAD Solaris compatibility bug fixed (thx to Norm Jacobs).
        CRYPTO_NUM_LOCKS replaced with CRYPTO_num_locks() to improve binary \ 
compatibility with diverse builds of OpenSSL (thx to Norm Jacobs).
        Corrected round-robin failover behavior under heavy load.
        Numerous fixes in the engine support code.
        On Win32 platform .rnd file moved from c:\ to the stunnel folder.
   2014-03-11 15:05:19 by Jonathan Perkin | Files touched by this commit (350)
Log message:
Remove example rc.d scripts from PLISTs.

These are now handled dynamically if INIT_SYSTEM is set to "rc.d", or
ignored otherwise.
   2014-02-13 00:18:57 by Matthias Scheler | Files touched by this commit (1568)
Log message:
Recursive PKGREVISION bump for OpenSSL API version bump.
   2014-01-26 17:59:13 by Matthias Scheler | Files touched by this commit (2) | Package updated
Log message:
Update "stunnel" package to version 4.56. Changes since 4.55:
- Fixed a regression bug introduced in version 4.55 causing random
  crashes on several platforms, including Windows 7.
- Fixed incorrect "stunnel -exit" process synchronisation.
- Fixed FIPS detection with new versions of the OpenSSL library.
- Failure to open the log file at startup is no longer ignored.
   2014-01-26 16:51:54 by Matthias Scheler | Files touched by this commit (1)
Log message:
Fix permissions so taht "etc/stunnel" belongs to the actual \ 
"root" user
and not to the user that build the package. Bump package revision
because of this fix.
   2013-10-31 16:58:31 by Jonathan Perkin | Files touched by this commit (1)
Log message:
Fix PKG_USERS usage.
   2013-07-12 12:45:05 by Jonathan Perkin | Files touched by this commit (181) | Package updated
Log message:
Bump PKGREVISION of all packages which create users, to pick up change of
sysutils/user_* packages.
   2013-05-31 14:42:58 by Thomas Klausner | Files touched by this commit (2880)
Log message:
Bump all packages for perl-5.18, that
a) refer 'perl' in their Makefile, or
b) have a directory name of p5-*, or
c) have any dependency on any p5-* package

Like last time, where this caused no complaints.