开源软件构建与测试

_service:tar_scm:stunnel.spec Changed

_service Changed

_service:tar_scm:stunnel-5.69.tar.gz.asc Deleted

_service:tar_scm:stunnel-5.69.tar.gz/tests/certs/openssltest.cnf Deleted

@@ -1,58 +0,0 @@
-# OpenSSL root CA configuration file
-
- ca 
-default_ca                      = CA_default
-
- CA_default 
-# Directory and file locations.
-dir                             = .
-certs                           = $dir/demoCA
-crl_dir                         = $dir/demoCA
-new_certs_dir                   = $dir/demoCA
-database                        = $dir/demoCA/index.txt
-serial                          = $dir/demoCA/serial
-crl_extensions                  = crl_ext
-default_md                      = sha256
-preserve                        = no
-policy                          = policy_match
-x509_extensions                 = usr_cert
-private_key                     = $dir/demoCA/CA.key
-certificate                     = $dir/tmp/CACert.pem
-
- req 
-encrypt_key                     = no
-default_bits                    = 2048
-default_md                      = sha256
-string_mask                     = utf8only
-x509_extensions                 = ca_extensions
-distinguished_name              = req_distinguished_name
-
- crl_ext 
-authorityKeyIdentifier          = keyid:always
-
- usr_cert 
-basicConstraints                = CA:FALSE
-subjectKeyIdentifier            = hash
-authorityKeyIdentifier          = keyid, issuer
-
- ca_extensions 
-basicConstraints                = critical, CA:true
-subjectKeyIdentifier            = hash
-authorityKeyIdentifier          = keyid:always,issuer
-keyUsage                        = critical, digitalSignature, cRLSign, keyCertSign
-
- policy_match 
-countryName                     = match
-organizationName                = match
-organizationalUnitName          = optional
-commonName                      = supplied
-emailAddress                    = optional
-
- req_distinguished_name 
-countryName                     = Country Name (2 letter code)
-stateOrProvinceName             = State or Province Name
-localityName                    = Locality Name
-0.organizationName              = Organization Name
-organizationalUnitName          = Organizational Unit Name
-commonName                      = Common Name
-emailAddress                    = Email Address

_service:tar_scm:stunnel-5.69.tar.gz/tools/stunnel.spec Deleted

@@ -1,126 +0,0 @@
-Name: stunnel
-Version: 5.69
-Release: 1%{?dist}
-Summary: An TLS-encrypting socket wrapper
-Group: Applications/Internet
-License: GPLv2
-URL: https://www.stunnel.org/
-Source0: https://www.stunnel.org/downloads/stunnel-%{version}.tar.gz
-BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
-# util-linux is needed for rename
-BuildRequires: openssl-devel, util-linux
-%if 0%{?fedora} >= 15 || 0%{?rhel} >= 7
-BuildRequires: systemd-units
-Requires(post): systemd-units
-Requires(preun): systemd-units
-Requires(postun): systemd-units
-%endif
-
-%description
-Stunnel is a socket wrapper which can provide TLS (Transport Layer Security) support to ordinary applications. For example, it can be used
-in conjunction with imapd to create an TLS secure IMAP server.
-
-# Do not generate provides for private libraries
-%global __provides_exclude_from ^%{_libdir}/stunnel/.*$
-
-%prep
-%setup -q
-
-%build
-%configure --enable-fips --enable-ipv6 --with-ssl=%{_prefix} \
- CPPFLAGS="-UPIDFILE -DPIDFILE='\"%{_localstatedir}/run/stunnel.pid\"'"
-make V=1
-
-%install
-make install DESTDIR=%{buildroot}
-# Move the translated man pages to the right subdirectories, and strip off the
-# language suffixes.
-for lang in pl ; do
- mkdir -p %{buildroot}/%{_mandir}/${lang}/man8
- mv %{buildroot}/%{_mandir}/man8/*.${lang}.8* %{buildroot}/%{_mandir}/${lang}/man8/
- rename ".${lang}" "" %{buildroot}/%{_mandir}/${lang}/man8/*
-done
-%if 0%{?fedora} >= 15 || 0%{?rhel} >= 7
-mkdir -p %{buildroot}%{_unitdir}
-cp tools/%{name}.service %{buildroot}%{_unitdir}/%{name}.service
-mkdir -p %{buildroot}%{_datadir}/bash-completion/completions
-cp tools/%{name}.bash %{buildroot}%{_datadir}/bash-completion/completions/%{name}.bash
-%endif
-
-%post
-/sbin/ldconfig
-%if 0%{?fedora} >= 15 || 0%{?rhel} >= 7
-%systemd_post %{name}.service
-%endif
-
-%preun
-%if 0%{?fedora} >= 15 || 0%{?rhel} >= 7
-%systemd_preun %{name}.service
-%endif
-
-%postun
-/sbin/ldconfig
-%if 0%{?fedora} >= 15 || 0%{?rhel} >= 7
-%systemd_postun_with_restart %{name}.service
-%endif
-
-%files
-%{!?_licensedir:%global license %%doc}
-%doc COPYING.md COPYRIGHT.md README.md NEWS.md AUTHORS.md BUGS.md CREDITS.md PORTS.md TODO.md
-%license COPY*
-%lang(en) %doc doc/en/*
-%lang(pl) %doc doc/pl/*
-%{_bindir}/stunnel
-%exclude %{_bindir}/stunnel3
-%exclude %{_datadir}/doc/stunnel
-%{_libdir}/stunnel
-%exclude %{_libdir}/stunnel/libstunnel.la
-%{_mandir}/man8/stunnel.8*
-%lang(pl) %{_mandir}/pl/man8/stunnel.8*
-%dir %{_sysconfdir}/%{name}
-%config %{_sysconfdir}/%{name}/*-sample
-%if 0%{?fedora} >= 15 || 0%{?rhel} >= 7
-%{_unitdir}/%{name}*.service
-%endif
-%config(noreplace) %{_datarootdir}/bash-completion/*
-
-%changelog
-* Fri Feb 24 2023 Małgorzata Olszówka <Malgorzata.Olszowka@stunnel.org>
-- Fixed bash completion support
-- Removed excluding pem files
-
-* Wed Mar 02 2022 Małgorzata Olszówka <Malgorzata.Olszowka@stunnel.org>
-- bash completion support
-
-* Fri Sep 24 2021 Michał Trojnara <Michal.Trojnara@stunnel.org>
-- Added systemd startup for Fedora >= 15 or RHEL >= 7
-- Removed obsolete init startup
-- Removed obsolete logrotate configuration (replaced with journalctl)
-- Removed obsolete tcp_wrappers-devel support
-- Removed creating a dedicated user
-- Simplified the .spec file
-
-* Wed Apr 27 2016 Andrew Colin Kissa <andrew@topdog.za.net> - 5.32-1
-- Added init script that actually works on Redhat
-- Lots of changes and cleanup to improve spec
-
-* Tue May 26 2015 Bill Quayle <Bill.Quayle@citadel.com>
-- updated license specification
-- the manual page is no longer marked as compressed
-- removed outdated documentation files
-- updated minimum required version of OpenSSL
-
-* Fri Sep 09 2005 neeo <neeo@irc.pl>
-- lots of changes and cleanups
-
-* Wed Mar 17 2004 neeo <neeo@irc.pl>
-- updated for 4.05
-
-* Sat Jun 24 2000 Brian Hatch <bri@stunnel.org>
-- updated for 3.8p3
-
-* Wed Jul 14 1999 Dirk O. Siebnich <dok@vossnet.de>
-- updated for 3.5.
-
-* Mon Jun 07 1999 Dirk O. Siebnich <dok@vossnet.de>
-- adapted from sslwrap RPM spec file

_service:tar_scm:stunnel-5.72.tar.gz.asc Added

_service:tar_scm:stunnel-5.69.tar.gz/COPYING.md -> _service:tar_scm:stunnel-5.72.tar.gz/COPYING.md Changed

_service:tar_scm:stunnel-5.69.tar.gz/Makefile.am -> _service:tar_scm:stunnel-5.72.tar.gz/Makefile.am Changed

_service:tar_scm:stunnel-5.69.tar.gz/Makefile.in -> _service:tar_scm:stunnel-5.72.tar.gz/Makefile.in Changed

@@ -14,7 +14,7 @@
 
 @SET_MAKE@
 
-# by Michal Trojnara 1998-2023
+# by Michal Trojnara 1998-2024
 
 VPATH = @srcdir@
 am__is_gnu_make = { \
@@ -192,8 +192,8 @@
 	$(top_srcdir)/auto/config.guess $(top_srcdir)/auto/config.sub \
 	$(top_srcdir)/auto/install-sh $(top_srcdir)/auto/ltmain.sh \
 	$(top_srcdir)/auto/missing AUTHORS.md NEWS.md README.md \
-	auto/compile auto/config.guess auto/config.sub auto/install-sh \
-	auto/ltmain.sh auto/missing
+	auto/compile auto/config.guess auto/config.sub auto/depcomp \
+	auto/install-sh auto/ltmain.sh auto/missing
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
 distdir = $(PACKAGE)-$(VERSION)
 top_distdir = $(distdir)
@@ -266,6 +266,7 @@
 ETAGS = @ETAGS@
 EXEEXT = @EXEEXT@
 FGREP = @FGREP@
+FILECMD = @FILECMD@
 GREP = @GREP@
 INSTALL = @INSTALL@
 INSTALL_DATA = @INSTALL_DATA@
@@ -879,7 +880,7 @@
 	$(SHELL) ./config.status libtool
 
 distclean-local:
-	rm -rf autom4te.cache
+	rm -rf autom4te.cache version.txt
 
 sign:
 	cp -f $(distdir).tar.gz $(distdir)-win64-installer.exe $(distdir)-android.zip ../dist

_service:tar_scm:stunnel-5.69.tar.gz/NEWS.md -> _service:tar_scm:stunnel-5.72.tar.gz/NEWS.md Changed

@@ -1,6 +1,46 @@
 # stunnel change log
 
 
+### Version 5.72, 2024.02.04, urgency: MEDIUM
+* Security bugfixes
+  - OpenSSL DLLs updated to version 3.2.1.
+* Bugfixes
+  - Fixed SSL_CTX_new() errors handling.
+  - Fixed OPENSSL_NO_PSK builds.
+  - Android build updated for NDK r23c.
+  - stunnel.nsi updated for Debian 12.
+  - Fixed tests with OpenSSL older than 1.0.2.
+
+### Version 5.71, 2023.09.19, urgency: MEDIUM
+* Security bugfixes
+  - OpenSSL DLLs updated to version 3.1.3.
+* Bugfixes
+  - Fixed the console output of tstunnel.exe.
+* Features sponsored by SAE IT-systems
+  - OCSP stapling is requested and verified in the client mode.
+  - Using "verifyChain" automatically enables OCSP
+    stapling in the client mode.
+  - OCSP stapling is always available in the server mode.
+  - An inconclusive OCSP verification breaks TLS negotiation.
+    This can be disabled with "OCSPrequire = no".
+  - Added the "TIMEOUTocsp" option to control the maximum
+    time allowed for connecting an OCSP responder.
+* Features
+  - Added support for Red Hat OpenSSL 3.x patches.
+
+### Version 5.70, 2023.07.12, urgency: HIGH
+* Security bugfixes
+  - OpenSSL DLLs updated to version 3.0.9.
+  - OpenSSL FIPS Provider updated to version 3.0.8.
+* Bugfixes
+  - Fixed TLS socket EOF handling with OpenSSL 3.x.
+    This bug caused major interoperability issues between
+    stunnel built with OpenSSL 3.x and Microsoft's
+    Schannel Security Support Provider (SSP).
+  - Fixed reading certificate chains from PKCS#12 files.
+* Features
+  - Added configurable delay for the "retry" option.
+
 ### Version 5.69, 2023.03.04, urgency: MEDIUM
 * New features
   - Improved logging performance with the "output" option.

_service:tar_scm:stunnel-5.69.tar.gz/TODO.md -> _service:tar_scm:stunnel-5.72.tar.gz/TODO.md Changed

_service:tar_scm:stunnel-5.69.tar.gz/auto/ltmain.sh -> _service:tar_scm:stunnel-5.72.tar.gz/auto/ltmain.sh Changed

@@ -1,12 +1,12 @@
-#! /bin/sh
+#! /usr/bin/env sh
 ## DO NOT EDIT - This file generated from ./build-aux/ltmain.in
-## by inline-source v2014-01-03.01
+## by inline-source v2019-02-19.15
 
-# libtool (GNU libtool) 2.4.6
+# libtool (GNU libtool) 2.4.7
 # Provide generalized library-building support services.
 # Written by Gordon Matzigkeit <gord@gnu.ai.mit.edu>, 1996
 
-# Copyright (C) 1996-2015 Free Software Foundation, Inc.
+# Copyright (C) 1996-2019, 2021-2022 Free Software Foundation, Inc.
 # This is free software; see the source for copying conditions. There is NO
 # warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 
@@ -31,8 +31,8 @@
 
 PROGRAM=libtool
 PACKAGE=libtool
-VERSION="2.4.6 Debian-2.4.6-15build2"
-package_revision=2.4.6
+VERSION="2.4.7 Debian-2.4.7-5"
+package_revision=2.4.7
 
 
 ## ------ ##
@@ -64,34 +64,25 @@
 # libraries, which are installed to $pkgauxdir.
 
 # Set a version string for this script.
-scriptversion=2015-01-20.17; # UTC
+scriptversion=2019-02-19.15; # UTC
 
 # General shell script boiler plate, and helper functions.
 # Written by Gary V. Vaughan, 2004
 
-# Copyright (C) 2004-2015 Free Software Foundation, Inc.
-# This is free software; see the source for copying conditions. There is NO
-# warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
-
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 3 of the License, or
-# (at your option) any later version.
-
-# As a special exception to the GNU General Public License, if you distribute
-# this file as part of a program or library that is built using GNU Libtool,
-# you may include this file under the same distribution terms that you use
-# for the rest of that program.
-
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNES FOR A PARTICULAR PURPOSE. See the GNU
-# General Public License for more details.
-
-# You should have received a copy of the GNU General Public License
-# along with this program. If not, see <http://www.gnu.org/licenses/>.
+# This is free software. There is NO warranty; not even for
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+#
+# Copyright (C) 2004-2019, 2021 Bootstrap Authors
+#
+# This file is dual licensed under the terms of the MIT license
+# <https://opensource.org/license/MIT>, and GPL version 2 or later
+# <http://www.gnu.org/licenses/gpl-2.0.html>. You must apply one of
+# these licenses when using or redistributing this software or any of
+# the files within it. See the URLs above, or the file `LICENSE`
+# included in the Bootstrap distribution for the full license texts.
 
-# Please report bugs or propose patches to gary@gnu.org.
+# Please report bugs or propose patches to:
+# <https://github.com/gnulib-modules/bootstrap/issues>
 
 
 ## ------ ##
@@ -139,9 +130,12 @@
 	 _G_safe_locale=\"$_G_var=C; \$_G_safe_locale\"
 	fi"
 done
-
-# CDPATH.
-(unset CDPATH) >/dev/null 2>&1 && unset CDPATH
+# These NLS vars are set unconditionally (bootstrap issue #24). Unset those
+# in case the environment reset is needed later and the $save_* variant is not
+# defined (see the code above).
+LC_ALL=C
+LANGUAGE=C
+export LANGUAGE LC_ALL
 
 # Make sure IFS has a sensible default
 sp=' '
@@ -159,6 +153,26 @@
 fi
 
 
+# func_unset VAR
+# --------------
+# Portably unset VAR.
+# In some shells, an 'unset VAR' statement leaves a non-zero return
+# status if VAR is already unset, which might be problematic if the
+# statement is used at the end of a function (thus poisoning its return
+# value) or when 'set -e' is active (causing even a spurious abort of
+# the script in this case).
+func_unset ()
+{
+ { eval $1=; (eval unset $1) >/dev/null 2>&1 && eval unset $1 || : ; }
+}
+
+
+# Make sure CDPATH doesn't cause `cd` commands to output the target dir.
+func_unset CDPATH
+
+# Make sure ${,E,F}GREP behave sanely.
+func_unset GREP_OPTIONS
+
 
 ## ------------------------- ##
 ## Locate command utilities. ##
@@ -259,7 +273,7 @@
 rm -f conftest.in conftest.tmp conftest.nl conftest.out
 }
 
- func_path_progs "sed gsed" func_check_prog_sed $PATH:/usr/xpg4/bin
+ func_path_progs "sed gsed" func_check_prog_sed "$PATH:/usr/xpg4/bin"
 rm -f conftest.sed
 SED=$func_path_progs_result
 }
@@ -295,7 +309,7 @@
 rm -f conftest.in conftest.tmp conftest.nl conftest.out
 }
 
- func_path_progs "grep ggrep" func_check_prog_grep $PATH:/usr/xpg4/bin
+ func_path_progs "grep ggrep" func_check_prog_grep "$PATH:/usr/xpg4/bin"
 GREP=$func_path_progs_result
 }
 
@@ -360,6 +374,35 @@
 s/\$^$_G_bs\$$_G_bs2$_G_dollar/\\1$_G_bs2$_G_bs$_G_dollar/g
 s/\n//g"
 
+# require_check_ifs_backslash
+# ---------------------------
+# Check if we can use backslash as IFS='\' separator, and set
+# $check_ifs_backshlash_broken to ':' or 'false'.
+require_check_ifs_backslash=func_require_check_ifs_backslash
+func_require_check_ifs_backslash ()
+{
+ _G_save_IFS=$IFS
+ IFS='\'
+ _G_check_ifs_backshlash='a\\b'
+ for _G_i in $_G_check_ifs_backshlash
+ do
+ case $_G_i in
+ a)
+ check_ifs_backshlash_broken=false
+ ;;
+ '')
+ break
+ ;;
+ *)
+ check_ifs_backshlash_broken=:
+ break
+ ;;
+ esac
+ done
+ IFS=$_G_save_IFS
+ require_check_ifs_backslash=:
+}
+
 
 ## ----------------- ##
 ## Global variables. ##
@@ -580,16 +623,16 @@
 {
 $debug_cmd
 
- func_quote_for_eval "$2"
- eval "$1+=\\ \$func_quote_for_eval_result"
+ func_quote_arg pretty "$2"
+ eval "$1+=\\ \$func_quote_arg_result"
 }'
 else
 func_append_quoted ()
 {
 $debug_cmd
 
- func_quote_for_eval "$2"
- eval "$1=\$$1\\ \$func_quote_for_eval_result"
+ func_quote_arg pretty "$2"
+ eval "$1=\$$1\\ \$func_quote_arg_result"
 }
 fi
 
@@ -1091,85 +1134,203 @@
 }
 
 
-# func_quote_for_eval ARG...

_service:tar_scm:stunnel-5.69.tar.gz/configure -> _service:tar_scm:stunnel-5.72.tar.gz/configure Changed

@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.71 for stunnel 5.69.
+# Generated by GNU Autoconf 2.71 for stunnel 5.72.
 #
 #
 # Copyright (C) 1992-1996, 1998-2017, 2020-2021 Free Software Foundation,
@@ -618,8 +618,8 @@
 # Identity of this package.
 PACKAGE_NAME='stunnel'
 PACKAGE_TARNAME='stunnel'
-PACKAGE_VERSION='5.69'
-PACKAGE_STRING='stunnel 5.69'
+PACKAGE_VERSION='5.72'
+PACKAGE_STRING='stunnel 5.72'
 PACKAGE_BUGREPORT=''
 PACKAGE_URL=''
 
@@ -676,6 +676,7 @@
 AR
 DLLTOOL
 OBJDUMP
+FILECMD
 LN_S
 NM
 ac_ct_DUMPBIN
@@ -1369,7 +1370,7 @@
 # Omit some internal or obsolete options to make the list less imposing.
 # This message is too long to be a string in the A/UX 3.1 sh.
 cat <<_ACEOF
-\`configure' configures stunnel 5.69 to adapt to many kinds of systems.
+\`configure' configures stunnel 5.72 to adapt to many kinds of systems.
 
 Usage: $0 OPTION... VAR=VALUE...
 
@@ -1440,7 +1441,7 @@
 
 if test -n "$ac_init_help"; then
 case $ac_init_help in
- short | recursive ) echo "Configuration of stunnel 5.69:";;
+ short | recursive ) echo "Configuration of stunnel 5.72:";;
 esac
 cat <<\_ACEOF
 
@@ -1561,7 +1562,7 @@
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
 cat <<\_ACEOF
-stunnel configure 5.69
+stunnel configure 5.72
 generated by GNU Autoconf 2.71
 
 Copyright (C) 2021 Free Software Foundation, Inc.
@@ -2071,7 +2072,7 @@
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by stunnel $as_me 5.69, which was
+It was created by stunnel $as_me 5.72, which was
 generated by GNU Autoconf 2.71. Invocation command line was
 
 $ $0$ac_configure_args_raw
@@ -3347,7 +3348,7 @@
 
 # Define the identity of the package.
 PACKAGE='stunnel'
- VERSION='5.69'
+ VERSION='5.72'
 
 
 printf "%s\n" "#define PACKAGE \"$PACKAGE\"" >>confdefs.h
@@ -3528,23 +3529,23 @@
 
 
 
-printf "%s\n" "#define HOST \"$host\"" >>confdefs.h
+printf "%s\n" "#define HOST \"${host}\"" >>confdefs.h
 
 
 cat >>confdefs.h <<_ACEOF
-#define `echo CPU_$host_cpu | tr abcdefghijklmnopqrstuvwxyz.- ABCDEFGHIJKLMNOPQRSTUVWXYZ__ | tr -dc ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890_` 1
+#define `echo CPU_${host_cpu} | tr abcdefghijklmnopqrstuvwxyz.- ABCDEFGHIJKLMNOPQRSTUVWXYZ__ | tr -dc ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890_` 1
 _ACEOF
 
 cat >>confdefs.h <<_ACEOF
-#define `echo VENDOR_$host_vendor | tr abcdefghijklmnopqrstuvwxyz.- ABCDEFGHIJKLMNOPQRSTUVWXYZ__ | tr -dc ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890_` 1
+#define `echo VENDOR_${host_vendor} | tr abcdefghijklmnopqrstuvwxyz.- ABCDEFGHIJKLMNOPQRSTUVWXYZ__ | tr -dc ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890_` 1
 _ACEOF
 
 cat >>confdefs.h <<_ACEOF
-#define `echo OS_$host_os | tr abcdefghijklmnopqrstuvwxyz.- ABCDEFGHIJKLMNOPQRSTUVWXYZ__ | tr -dc ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890_` 1
+#define `echo OS_${host_os} | tr abcdefghijklmnopqrstuvwxyz.- ABCDEFGHIJKLMNOPQRSTUVWXYZ__ | tr -dc ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890_` 1
 _ACEOF
 
 
-case "$host_os" in
+case "${host_os}" in
 *darwin*)
 # OSX does not declare ucontext without _XOPEN_SOURCE
 
@@ -4588,9 +4589,9 @@
 
 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for bashcompdir" >&5
 printf %s "checking for bashcompdir... " >&6; }
-{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $with_bashcompdir" >&5
-printf "%s\n" "$with_bashcompdir" >&6; }
-bashcompdir=$with_bashcompdir
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: ${with_bashcompdir}" >&5
+printf "%s\n" "${with_bashcompdir}" >&6; }
+bashcompdir=${with_bashcompdir}
 
 
 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: **************************************** thread model" >&5
@@ -4953,7 +4954,7 @@
 if test ${with_threads+y}
 then :
 withval=$with_threads;
- case "$withval" in
+ case "${withval}" in
 ucontext)
 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: UCONTEXT mode selected" >&5
 printf "%s\n" "$as_me: UCONTEXT mode selected" >&6;}
@@ -5727,9 +5728,9 @@
 ac_compiler_gnu=$ac_cv_c_compiler_gnu
 
 
- LIBS="$PTHREAD_LIBS $LIBS"
- CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
- CC="$PTHREAD_CC"
+ LIBS="${PTHREAD_LIBS} ${LIBS}"
+ CFLAGS="${CFLAGS} ${PTHREAD_CFLAGS}"
+ CC="${PTHREAD_CC}"
 
 printf "%s\n" "#define USE_PTHREAD 1" >>confdefs.h
 
@@ -6500,9 +6501,9 @@
 
 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: PTHREAD thread model detected" >&5
 printf "%s\n" "$as_me: PTHREAD thread model detected" >&6;}
- LIBS="$PTHREAD_LIBS $LIBS"
- CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
- CC="$PTHREAD_CC"
+ LIBS="${PTHREAD_LIBS} ${LIBS}"
+ CFLAGS="${CFLAGS} ${PTHREAD_CFLAGS}"
+ CC="${PTHREAD_CC}"
 
 printf "%s\n" "#define USE_PTHREAD 1" >>confdefs.h
 
@@ -6531,7 +6532,7 @@
 
 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: **************************************** compiler/linker flags" >&5
 printf "%s\n" "$as_me: **************************************** compiler/linker flags" >&6;}
-if test "$GCC" = yes; then
+if test "${GCC}" = yes; then
 
 
 
@@ -6931,85 +6932,6 @@
 
 
 
-for flag in -Wno-long-long; do
- as_CACHEVAR=`printf "%s\n" "ax_cv_check_cflags__$flag" | $as_tr_sh`
-{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts $flag" >&5
-printf %s "checking whether C compiler accepts $flag... " >&6; }
-if eval test \${$as_CACHEVAR+y}
-then :
- printf %s "(cached) " >&6
-else $as_nop
-
- ax_check_save_flags=$CFLAGS
- CFLAGS="$CFLAGS $flag"
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h. */
-
-int
-main (void)
-{
-
- ;
- return 0;
-}
-_ACEOF
-if ac_fn_c_try_compile "$LINENO"
-then :
- eval "$as_CACHEVAR=yes"
-else $as_nop
- eval "$as_CACHEVAR=no"
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
- CFLAGS=$ax_check_save_flags
-fi
-eval ac_res=\$$as_CACHEVAR
-	 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-printf "%s\n" "$ac_res" >&6; }
-if eval test \"x\$"$as_CACHEVAR"\" = x"yes"
-then :
-
-if test ${CFLAGS+y}

_service:tar_scm:stunnel-5.69.tar.gz/configure.ac -> _service:tar_scm:stunnel-5.72.tar.gz/configure.ac Changed

@@ -1,6 +1,6 @@
 # Process this file with autoconf to produce a configure script.
 
-AC_INIT(stunnel,5.69)
+AC_INIT(stunnel,5.72)
 AC_MSG_NOTICE(**************************************** initialization)
 AC_CONFIG_AUX_DIR(auto)
 AC_CONFIG_MACRO_DIR(m4)
@@ -10,13 +10,13 @@
 
 AC_CANONICAL_HOST
 AC_SUBST(host)
-AC_DEFINE_UNQUOTED(HOST, "$host", Host description)
+AC_DEFINE_UNQUOTED(HOST, "${host}", Host description)
 define(esc, `echo $1 | tr abcdefghijklmnopqrstuvwxyz.- ABCDEFGHIJKLMNOPQRSTUVWXYZ__ | tr -dc ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890_`)
-AC_DEFINE_UNQUOTED(esc(CPU_$host_cpu))
-AC_DEFINE_UNQUOTED(esc(VENDOR_$host_vendor))
-AC_DEFINE_UNQUOTED(esc(OS_$host_os))
+AC_DEFINE_UNQUOTED(esc(CPU_${host_cpu}))
+AC_DEFINE_UNQUOTED(esc(VENDOR_${host_vendor}))
+AC_DEFINE_UNQUOTED(esc(OS_${host_os}))
 
-case "$host_os" in
+case "${host_os}" in
 *darwin*)
 # OSX does not declare ucontext without _XOPEN_SOURCE
 AC_DEFINE(_XOPEN_SOURCE, 500, Use X/Open 5 with POSIX 1995)
@@ -44,8 +44,8 @@
 PKG_CHECK_VAR(with_bashcompdir, bash-completion, completionsdir, ,
 with_bashcompdir="${datarootdir}/bash-completion/completions"))
 AC_MSG_CHECKING(for bashcompdir)
-AC_MSG_RESULT($with_bashcompdir)
-AC_SUBST(bashcompdir, $with_bashcompdir)
+AC_MSG_RESULT(${with_bashcompdir})
+AC_SUBST(bashcompdir, ${with_bashcompdir})
 
 AC_MSG_NOTICE(**************************************** thread model)
 # thread detection should be done first, as it may change the CC variable
@@ -53,7 +53,7 @@
 AC_ARG_WITH(threads,
 --with-threads=model select threading model (ucontext/pthread/fork),
 
- case "$withval" in
+ case "${withval}" in
 ucontext)
 AC_MSG_NOTICE(UCONTEXT mode selected)
 AC_DEFINE(USE_UCONTEXT, 1, Define to 1 to select UCONTEXT mode)
@@ -61,9 +61,9 @@
 pthread)
 AC_MSG_NOTICE(PTHREAD mode selected)
 AX_PTHREAD()
- LIBS="$PTHREAD_LIBS $LIBS"
- CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
- CC="$PTHREAD_CC"
+ LIBS="${PTHREAD_LIBS} ${LIBS}"
+ CFLAGS="${CFLAGS} ${PTHREAD_CFLAGS}"
+ CC="${PTHREAD_CC}"
 AC_DEFINE(USE_PTHREAD, 1, Define to 1 to select PTHREAD mode)
 ;;
 fork)
@@ -71,16 +71,16 @@
 AC_DEFINE(USE_FORK, 1, Define to 1 to select FORK mode)
 ;;
 *)
- AC_MSG_ERROR(Unknown thread model \"${withval}\")
+ AC_MSG_ERROR(Unknown thread model "${withval}")
 ;;
 esac
 , 
 # do not attempt to autodetect UCONTEXT threading
 AX_PTHREAD(
 AC_MSG_NOTICE(PTHREAD thread model detected)
- LIBS="$PTHREAD_LIBS $LIBS"
- CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
- CC="$PTHREAD_CC"
+ LIBS="${PTHREAD_LIBS} ${LIBS}"
+ CFLAGS="${CFLAGS} ${PTHREAD_CFLAGS}"
+ CC="${PTHREAD_CC}"
 AC_DEFINE(USE_PTHREAD, 1, Define to 1 to select PTHREAD mode)
 , 
 AC_MSG_NOTICE(FORK thread model detected)
@@ -89,13 +89,12 @@
 )
 
 AC_MSG_NOTICE(**************************************** compiler/linker flags)
-if test "$GCC" = yes; then
+if test "${GCC}" = yes; then
 AX_APPEND_COMPILE_FLAGS(-Wall)
 AX_APPEND_COMPILE_FLAGS(-Wextra)
 AX_APPEND_COMPILE_FLAGS(-Wpedantic)
 AX_APPEND_COMPILE_FLAGS(-Wformat=2)
 AX_APPEND_COMPILE_FLAGS(-Wconversion)
- AX_APPEND_COMPILE_FLAGS(-Wno-long-long)
 AX_APPEND_COMPILE_FLAGS(-Wno-deprecated-declarations)
 AX_APPEND_COMPILE_FLAGS(-fPIE)
 case "${host}" in
@@ -137,7 +136,7 @@
 AC_CHECK_TYPES(struct addrinfo, , , #include <netdb.h>)
 
 AC_MSG_NOTICE(**************************************** PTY device files)
-if test "x$cross_compiling" = "xno"; then
+if test "x${cross_compiling}" = "xno"; then
 AC_CHECK_FILE("/dev/ptmx", AC_DEFINE(HAVE_DEV_PTMX, 1,
 Define to 1 if you have '/dev/ptmx' device.))
 AC_CHECK_FILE("/dev/ptc", AC_DEFINE(HAVE_DEV_PTS_AND_PTC, 1,
@@ -148,28 +147,28 @@
 
 AC_MSG_NOTICE(**************************************** entropy sources)
 
-if test "x$cross_compiling" = "xno"; then
+if test "x${cross_compiling}" = "xno"; then
 AC_ARG_WITH(egd-socket,
 --with-egd-socket=FILE Entropy Gathering Daemon socket path,
- EGD_SOCKET="$withval"
+ EGD_SOCKET="${withval}"
 )
- if test -n "$EGD_SOCKET"; then
- AC_DEFINE_UNQUOTED(EGD_SOCKET, "$EGD_SOCKET",
+ if test -n "${EGD_SOCKET}"; then
+ AC_DEFINE_UNQUOTED(EGD_SOCKET, "${EGD_SOCKET}",
 Entropy Gathering Daemon socket path)
 fi
 
 # Check for user-specified random device
 AC_ARG_WITH(random,
 --with-random=FILE read randomness from file (default=/dev/urandom),
- RANDOM_FILE="$withval",
+ RANDOM_FILE="${withval}",
 
 # Check for random device
 AC_CHECK_FILE("/dev/urandom", RANDOM_FILE="/dev/urandom")
 
 )
- if test -n "$RANDOM_FILE"; then
+ if test -n "${RANDOM_FILE}"; then
 AC_SUBST(RANDOM_FILE)
- AC_DEFINE_UNQUOTED(RANDOM_FILE, "$RANDOM_FILE", Random file path)
+ AC_DEFINE_UNQUOTED(RANDOM_FILE, "${RANDOM_FILE}", Random file path)
 fi
 else
 AC_MSG_WARN(cross-compilation: assuming entropy sources are not available)
@@ -177,13 +176,13 @@
 
 AC_MSG_NOTICE(**************************************** default group)
 DEFAULT_GROUP=nobody
-if test "x$cross_compiling" = "xno"; then
+if test "x${cross_compiling}" = "xno"; then
 grep '^nogroup:' /etc/group >/dev/null && DEFAULT_GROUP=nogroup
 else
 AC_MSG_WARN(cross-compilation: assuming nogroup is not available)
 fi
 AC_MSG_CHECKING(for default group)
-AC_MSG_RESULT($DEFAULT_GROUP)
+AC_MSG_RESULT(${DEFAULT_GROUP})
 AC_SUBST(DEFAULT_GROUP)
 
 AC_SYS_LARGEFILE
@@ -223,8 +222,8 @@
 AC_SEARCH_LIBS(shl_load, dld)
 
 # Add BeOS libraries
-if test "x$host_os" = "xbeos"; then
- LIBS="$LIBS -lbe -lroot -lbind"
+if test "x${host_os}" = "xbeos"; then
+ LIBS="${LIBS} -lbe -lroot -lbind"
 fi
 
 AC_MSG_NOTICE(**************************************** library functions)
@@ -243,7 +242,7 @@
 # sockets
 AC_CHECK_FUNCS(poll gethostbyname2 endhostent getnameinfo)
 AC_MSG_CHECKING(for getaddrinfo)
-case "$host_os" in
+case "${host_os}" in
 *androideabi*)
 # http://stackoverflow.com/questions/7818246/segmentation-fault-in-getaddrinfo
 AC_MSG_RESULT(no (buggy Android implementation))
@@ -268,7 +267,7 @@
 esac
 # poll() is not recommended on Mac OS X <= 10.3 and broken on Mac OS X 10.4
 AC_MSG_CHECKING(for broken poll() implementation)
-case "$host_os" in
+case "${host_os}" in
 darwin0-8.*)
 AC_MSG_RESULT(yes (poll() disabled))
 AC_DEFINE(BROKEN_POLL, 1, Define to 1 if you have a broken 'poll' implementation.)
@@ -286,7 +285,7 @@
 AC_ARG_ENABLE(ipv6,
 --disable-ipv6 disable IPv6 support,
 
- case "$enableval" in
+ case "${enableval}" in
 yes) AC_MSG_RESULT(yes)
 AC_DEFINE(USE_IPv6, 1,
 Define to 1 to enable IPv6 support)
@@ -294,7 +293,7 @@
 no) AC_MSG_RESULT(no)
 ;;
 *) AC_MSG_RESULT(error)
- AC_MSG_ERROR(bad value \"${enableval}\")

_service:tar_scm:stunnel-5.69.tar.gz/doc/Makefile.am -> _service:tar_scm:stunnel-5.72.tar.gz/doc/Makefile.am Changed

_service:tar_scm:stunnel-5.69.tar.gz/doc/Makefile.in -> _service:tar_scm:stunnel-5.72.tar.gz/doc/Makefile.in Changed

_service:tar_scm:stunnel-5.72.tar.gz/doc/en/PKCS#11-notes.txt Added

_service:tar_scm:stunnel-5.69.tar.gz/doc/stunnel.8.in -> _service:tar_scm:stunnel-5.72.tar.gz/doc/stunnel.8.in Changed

@@ -1,4 +1,4 @@
-.\" Automatically generated by Pod::Man 4.14 (Pod::Simple 3.42)
+.\" Automatically generated by Pod::Man 4.14 (Pod::Simple 3.43)
 .\"
 .\" Standard preamble:
 .\" ========================================================================
@@ -71,7 +71,7 @@
 .\" ========================================================================
 .\"
 .IX Title "stunnel 8"
-.TH stunnel 8 "2023.02.07" "5.69" "stunnel TLS Proxy"
+.TH stunnel 8 "2024.01.16" "5.72" "stunnel TLS Proxy"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
@@ -163,7 +163,8 @@
 .IP "\(bu" 4
 A port number.
 .IP "\(bu" 4
-A colon-separated pair of \s-1IP\s0 address (either IPv4, IPv6, or domain name) and port number.
+A colon-separated pair of \s-1IP\s0 address (either IPv4, IPv6, or domain name) and
+port number.
 .IP "\(bu" 4
 A Unix socket path (Unix only).
 .SS "\s-1GLOBAL OPTIONS\s0"
@@ -176,7 +177,8 @@
 and \fIexec\fR are located inside the jail and the patches have to be relative
 to the directory specified with \fBchroot\fR.
 .Sp
-Several functions of the operating system also need their files to be located within the chroot jail, e.g.:
+Several functions of the operating system also need their files to be located
+within the chroot jail, e.g.:
 .RS 4
 .IP "\(bu" 4
 Delayed resolver typically needs /etc/nsswitch.conf and /etc/resolv.conf.
@@ -225,7 +227,8 @@
 .Sp
 default: software-only cryptography
 .Sp
-See Examples section for an engine configuration to use the certificate and the corresponding private key from a cryptographic device.
+See Examples section for an engine configuration to use the certificate and the
+corresponding private key from a cryptographic device.
 .IP "\fBengineCtrl\fR = COMMAND:PARAMETER" 4
 .IX Item "engineCtrl = COMMAND:PARAMETER"
 control hardware engine
@@ -278,8 +281,8 @@
 .IX Item "log = append | overwrite"
 log file handling
 .Sp
-This option allows you to choose whether the log file (specified with the \fIoutput\fR
-option) is appended or overwritten when opened or re-opened.
+This option allows you to choose whether the log file (specified with the
+\&\fIoutput\fR option) is appended or overwritten when opened or re-opened.
 .Sp
 default: append
 .IP "\fBoutput\fR = \s-1FILE\s0" 4
@@ -395,32 +398,33 @@
 engine is enabled.
 .IP "\fBcheckEmail\fR = \s-1EMAIL\s0" 4
 .IX Item "checkEmail = EMAIL"
-email address of the peer certificate subject
+verify the email address of the end-entity (leaf) peer certificate subject
 .Sp
 Certificates are accepted if no subject checks were specified, or the email
-address of the peer certificate matches any of the email addresses specified
-with \fIcheckEmail\fR.
+address of the end-entity (leaf) peer certificate matches any of the email
+addresses specified with \fIcheckEmail\fR.
 .Sp
 Multiple \fIcheckEmail\fR options are allowed in a single service section.
 .Sp
 This option requires OpenSSL 1.0.2 or later.
 .IP "\fBcheckHost\fR = \s-1HOST\s0" 4
 .IX Item "checkHost = HOST"
-host of the peer certificate subject
+verify the host of the end-entity (leaf) peer certificate subject
 .Sp
 Certificates are accepted if no subject checks were specified, or the host name
-of the peer certificate matches any of the hosts specified with \fIcheckHost\fR.
+of the end-entity (leaf) peer certificate matches any of the hosts specified
+with \fIcheckHost\fR.
 .Sp
 Multiple \fIcheckHost\fR options are allowed in a single service section.
 .Sp
 This option requires OpenSSL 1.0.2 or later.
 .IP "\fBcheckIP\fR = \s-1IP\s0" 4
 .IX Item "checkIP = IP"
-\&\s-1IP\s0 address of the peer certificate subject
+verify the \s-1IP\s0 address of the end-entity (leaf) peer certificate subject
 .Sp
 Certificates are accepted if no subject checks were specified, or the \s-1IP\s0
-address of the peer certificate matches any of the \s-1IP\s0 addresses specified with
-\&\fIcheckIP\fR.
+address of the end-entity (leaf) peer certificate matches any of the \s-1IP\s0
+addresses specified with \fIcheckIP\fR.
 .Sp
 Multiple \fIcheckIP\fR options are allowed in a single service section.
 .Sp
@@ -458,7 +462,8 @@
 .Sp
 Several \fIconfig\fR lines can be used to specify multiple configuration commands.
 .Sp
-Use \fIcurves\fR option instead of enabling \fIconfig = Curves:list_curves\fR to support elliptic curves.
+Use \fIcurves\fR option instead of enabling \fIconfig = Curves:list_curves\fR to
+support elliptic curves.
 .Sp
 This option requires OpenSSL 1.0.2 or later.
 .IP "\fBconnect\fR = \s-1HOST:\s0PORT" 4
@@ -610,7 +615,8 @@
 .IX Item "include = DIRECTORY"
 include all configuration file parts located in \s-1DIRECTORY\s0
 .Sp
-The files are included in the ascending alphabetical order of their names. The recommended filename convention is
+The files are included in the ascending alphabetical order of their names. The
+recommended filename convention is
 .Sp
 for global options:
 .Sp
@@ -652,7 +658,7 @@
 remote connections.  Use this option to bind a static local \s-1IP\s0 address instead.
 .IP "\fB\s-1OCSP\s0\fR = \s-1URL\s0" 4
 .IX Item "OCSP = URL"
-select \s-1OCSP\s0 responder for certificate verification
+select \s-1OCSP\s0 responder for the end-entity (leaf) peer certificate verification
 .IP "\fBOCSPaia\fR = yes | no" 4
 .IX Item "OCSPaia = yes | no"
 validate certificates with their \s-1AIA OCSP\s0 responders
@@ -675,6 +681,15 @@
 This option protects the \s-1OCSP\s0 protocol against replay attacks.  Due to its
 computational overhead, the nonce extension is usually only supported on
 internal (e.g. corporate) responders, and not on public \s-1OCSP\s0 responders.
+.IP "\fBOCSPrequire\fR = yes | no" 4
+.IX Item "OCSPrequire = yes | no"
+require a conclusive \s-1OCSP\s0 response
+.Sp
+Disable this option to allow a connection even though no conclusive \s-1OCSP\s0
+response was retrieved from stapling and a direct request to the \s-1OCSP\s0
+responder.
+.Sp
+default: yes
 .IP "\fBoptions\fR = \s-1SSL_OPTIONS\s0" 4
 .IX Item "options = SSL_OPTIONS"
 \&\fBOpenSSL\fR library options
@@ -702,8 +717,8 @@
 \&    options = NO_SSLv3
 .Ve
 .Sp
-Use \fIsslVersionMax\fR or \fIsslVersionMin\fR option instead of disabling specific \s-1TLS\s0 protocol
-versions when compiled with \fBOpenSSL 1.1.0\fR or later.
+Use \fIsslVersionMax\fR or \fIsslVersionMin\fR option instead of disabling specific
+\&\s-1TLS\s0 protocol versions when compiled with \fBOpenSSL 1.1.0\fR or later.
 .IP "\fBprotocol\fR = \s-1PROTO\s0" 4
 .IX Item "protocol = PROTO"
 application protocol to negotiate \s-1TLS\s0
@@ -872,10 +887,13 @@
 This option is not supported on some platforms.
 .Sp
 default: yes
-.IP "\fBretry\fR = yes | no" 4
-.IX Item "retry = yes | no"
+.IP "\fBretry\fR = yes | no | \s-1DELAY\s0" 4
+.IX Item "retry = yes | no | DELAY"
 reconnect a connect+exec section after it was disconnected
 .Sp
+The \s-1DELAY\s0 value specifies the number of milliseconds before retrying.
+\&\*(L"retry = yes\*(R" has the same effect as \*(L"retry = 1000\*(R".
+.Sp
 default: no
 .IP "\fBsecurityLevel\fR = \s-1LEVEL\s0" 4
 .IX Item "securityLevel = LEVEL"
@@ -888,19 +906,35 @@
 Everything is permitted.
 .IP "level 1" 4
 .IX Item "level 1"
-The security level corresponds to a minimum of 80 bits of security. Any parameters offering below 80 bits of security are excluded. As a result \s-1RSA, DSA\s0 and \s-1DH\s0 keys shorter than 1024 bits and \s-1ECC\s0 keys shorter than 160 bits are prohibited. All export cipher suites are prohibited since they all offer less than 80 bits of security. \s-1SSL\s0 version 2 is prohibited. Any cipher suite using \s-1MD5\s0 for the \s-1MAC\s0 is also prohibited.
+The security level corresponds to a minimum of 80 bits of security. Any
+parameters offering below 80 bits of security are excluded. As a result \s-1RSA,
+DSA\s0 and \s-1DH\s0 keys shorter than 1024 bits and \s-1ECC\s0 keys shorter than 160 bits are
+prohibited. All export cipher suites are prohibited since they all offer less
+than 80 bits of security. \s-1SSL\s0 version 2 is prohibited. Any cipher suite using
+\&\s-1MD5\s0 for the \s-1MAC\s0 is also prohibited.
 .IP "level 2" 4
 .IX Item "level 2"
-Security level set to 112 bits of security. As a result \s-1RSA, DSA\s0 and \s-1DH\s0 keys shorter than 2048 bits and \s-1ECC\s0 keys shorter than 224 bits are prohibited. In addition to the level 1 exclusions any cipher suite using \s-1RC4\s0 is also prohibited. \s-1SSL\s0 version 3 is also not allowed. Compression is disabled.
+Security level set to 112 bits of security. As a result \s-1RSA, DSA\s0 and \s-1DH\s0 keys
+shorter than 2048 bits and \s-1ECC\s0 keys shorter than 224 bits are prohibited. In
+addition to the level 1 exclusions any cipher suite using \s-1RC4\s0 is also
+prohibited. \s-1SSL\s0 version 3 is also not allowed. Compression is disabled.
 .IP "level 3" 4
 .IX Item "level 3"
-Security level set to 128 bits of security. As a result \s-1RSA, DSA\s0 and \s-1DH\s0 keys shorter than 3072 bits and \s-1ECC\s0 keys shorter than 256 bits are prohibited. In addition to the level 2 exclusions cipher suites not offering forward secrecy are prohibited. \s-1TLS\s0 versions below 1.1 are not permitted. Session tickets are disabled.
+Security level set to 128 bits of security. As a result \s-1RSA, DSA\s0 and \s-1DH\s0 keys
+shorter than 3072 bits and \s-1ECC\s0 keys shorter than 256 bits are prohibited. In
+addition to the level 2 exclusions cipher suites not offering forward secrecy
+are prohibited. \s-1TLS\s0 versions below 1.1 are not permitted. Session tickets are
+disabled.
 .IP "level 4" 4
 .IX Item "level 4"
-Security level set to 192 bits of security. As a result \s-1RSA, DSA\s0 and \s-1DH\s0 keys shorter than 7680 bits and \s-1ECC\s0 keys shorter than 384 bits are prohibited. Cipher suites using \s-1SHA1\s0 for the \s-1MAC\s0 are prohibited. \s-1TLS\s0 versions below 1.2 are not permitted.
+Security level set to 192 bits of security. As a result \s-1RSA, DSA\s0 and \s-1DH\s0 keys

_service:tar_scm:stunnel-5.69.tar.gz/doc/stunnel.html.in -> _service:tar_scm:stunnel-5.72.tar.gz/doc/stunnel.html.in Changed

@@ -478,9 +478,9 @@
 <dt id="checkEmail-EMAIL">checkEmail = EMAIL</dt>
 <dd>
 
-email address of the peer certificate subject
+verify the email address of the end-entity (leaf) peer certificate subject
 
-Certificates are accepted if no subject checks were specified, or the email address of the peer certificate matches any of the email addresses specified with checkEmail.
+Certificates are accepted if no subject checks were specified, or the email address of the end-entity (leaf) peer certificate matches any of the email addresses specified with checkEmail.
 
 Multiple checkEmail options are allowed in a single service section.
 
@@ -490,9 +490,9 @@
 <dt id="checkHost-HOST">checkHost = HOST</dt>
 <dd>
 
-host of the peer certificate subject
+verify the host of the end-entity (leaf) peer certificate subject
 
-Certificates are accepted if no subject checks were specified, or the host name of the peer certificate matches any of the hosts specified with checkHost.
+Certificates are accepted if no subject checks were specified, or the host name of the end-entity (leaf) peer certificate matches any of the hosts specified with checkHost.
 
 Multiple checkHost options are allowed in a single service section.
 
@@ -502,9 +502,9 @@
 <dt id="checkIP-IP">checkIP = IP</dt>
 <dd>
 
-IP address of the peer certificate subject
+verify the IP address of the end-entity (leaf) peer certificate subject
 
-Certificates are accepted if no subject checks were specified, or the IP address of the peer certificate matches any of the IP addresses specified with checkIP.
+Certificates are accepted if no subject checks were specified, or the IP address of the end-entity (leaf) peer certificate matches any of the IP addresses specified with checkIP.
 
 Multiple checkIP options are allowed in a single service section.
 
@@ -778,7 +778,7 @@
 <dt id="OCSP-URL">OCSP = URL</dt>
 <dd>
 
-select OCSP responder for certificate verification
+select OCSP responder for the end-entity (leaf) peer certificate verification
 
 </dd>
 <dt id="OCSPaia-yes-no">OCSPaia = yes | no</dt>
@@ -807,6 +807,16 @@
 This option protects the OCSP protocol against replay attacks. Due to its computational overhead, the nonce extension is usually only supported on internal (e.g. corporate) responders, and not on public OCSP responders.
 
 </dd>
+<dt id="OCSPrequire-yes-no">OCSPrequire = yes | no</dt>
+<dd>
+
+require a conclusive OCSP response
+
+Disable this option to allow a connection even though no conclusive OCSP response was retrieved from stapling and a direct request to the OCSP responder.
+
+default: yes
+
+</dd>
 <dt id="options-SSL_OPTIONS">options = SSL_OPTIONS</dt>
 <dd>
 
@@ -1044,11 +1054,13 @@
 default: yes
 
 </dd>
-<dt id="retry-yes-no">retry = yes | no</dt>
+<dt id="retry-yes-no-DELAY">retry = yes | no | DELAY</dt>
 <dd>
 
 reconnect a connect+exec section after it was disconnected
 
+The DELAY value specifies the number of milliseconds before retrying. &quot;retry = yes&quot; has the same effect as &quot;retry = 1000&quot;.
+
 default: no
 
 </dd>
@@ -1326,7 +1338,7 @@
 <dt id="TIMEOUTconnect-SECONDS">TIMEOUTconnect = SECONDS</dt>
 <dd>
 
-time to wait to connect to a remote host
+time to wait to connect a remote host
 
 </dd>
 <dt id="TIMEOUTidle-SECONDS">TIMEOUTidle = SECONDS</dt>
@@ -1335,6 +1347,12 @@
 time to keep an idle connection
 
 </dd>
+<dt id="TIMEOUTocsp-SECONDS">TIMEOUTocsp = SECONDS</dt>
+<dd>
+
+time to wait to connect an OCSP responder
+
+</dd>
 <dt id="transparent-none-source-destination-both-Unix-only">transparent = none | source | destination | both (Unix only)</dt>
 <dd>
 
@@ -1468,31 +1486,31 @@
 <dt id="level-01">level 0</dt>
 <dd>
 
-Request and ignore the peer certificate.
+Request and ignore the peer certificate chain.
 
 </dd>
 <dt id="level-11">level 1</dt>
 <dd>
 
-Verify the peer certificate if present.
+Verify the peer certificate chain if present.
 
 </dd>
 <dt id="level-21">level 2</dt>
 <dd>
 
-Verify the peer certificate.
+Verify the peer certificate chain.
 
 </dd>
 <dt id="level-31">level 3</dt>
 <dd>
 
-Verify the peer against a locally installed certificate.
+Verify the peer certificate chain and the end-entity (leaf) peer certificate against a locally installed certificate.
 
 </dd>
 <dt id="level-41">level 4</dt>
 <dd>
 
-Ignore the chain and only verify the peer certificate.
+Ignore the peer certificate chain and only verify the end-entity (leaf) peer certificate against a locally installed certificate.
 
 </dd>
 <dt id="default">default</dt>
@@ -1519,9 +1537,9 @@
 <dt id="verifyPeer-yes-no">verifyPeer = yes | no</dt>
 <dd>
 
-verify the peer certificate
+verify the end-entity (leaf) peer certificate
 
-The peer certificate needs to be stored either in the file specified with CAfile, or in the directory specified with CApath.
+The end-entity (leaf) peer certificate needs to be stored either in the file specified with CAfile, or in the directory specified with CApath.
 
 default: no

_service:tar_scm:stunnel-5.69.tar.gz/doc/stunnel.pl.8.in -> _service:tar_scm:stunnel-5.72.tar.gz/doc/stunnel.pl.8.in Changed

@@ -1,4 +1,4 @@
-.\" Automatically generated by Pod::Man 4.14 (Pod::Simple 3.42)
+.\" Automatically generated by Pod::Man 4.14 (Pod::Simple 3.43)
 .\"
 .\" Standard preamble:
 .\" ========================================================================
@@ -71,7 +71,7 @@
 .\" ========================================================================
 .\"
 .IX Title "stunnel 8"
-.TH stunnel 8 "2023.02.07" "5.69" "stunnel TLS Proxy"
+.TH stunnel 8 "2024.01.16" "5.72" "stunnel TLS Proxy"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
@@ -664,7 +664,7 @@
 serwera, do którego nawiązywane jest połączenie.
 .IP "\fB\s-1OCSP\s0\fR = \s-1URL\s0" 4
 .IX Item "OCSP = URL"
-responder \s-1OCSP\s0 do weryfikacji certyfikatów
+responder \s-1OCSP\s0 do weryfikacji certyfikatu drugiej strony połączenia
 .IP "\fBOCSPaia\fR = yes | no" 4
 .IX Item "OCSPaia = yes | no"
 weryfikuj certyfikaty przy użyciu respondertów \s-1AIA\s0
@@ -687,6 +687,18 @@
 Ze względu na złożoność obliczeniową rozszerzenie nonce jest zwykle wspierane
 jedynie przez wewnętrzne (np. korporacyjne), a nie przez publiczne respondery
 \&\s-1OCSP.\s0
+.IP "\fBOCSPrequire\fR = yes | no" 4
+.IX Item "OCSPrequire = yes | no"
+wymagaj  rozstrzygającej odpowiedzi respondera \s-1OCSP\s0
+.IP "\fBOCSPrequire\fR = yes | no" 4
+.IX Item "OCSPrequire = yes | no"
+Wyłączenie tej opcji pozwala na zaakceptowanie połączenia pomimo braku
+otrzymania rozstrzygającej odpowiedzi \s-1OCSP\s0 ze staplingu i bezpośredniego
+żądania wysłanego do respondera.
+.Sp
+default: yes
+.Sp
+domyślnie: yes
 .IP "\fBoptions\fR = \s-1OPCJE_SSL\s0" 4
 .IX Item "options = OPCJE_SSL"
 opcje biblioteki \fBOpenSSL\fR
@@ -879,10 +891,14 @@
 Opcja nie jest wspierana na niektórych platformach.
 .Sp
 domyślnie: yes
-.IP "\fBretry\fR = yes | no" 4
-.IX Item "retry = yes | no"
+.IP "\fBretry\fR = yes | no | OPÓŹNIENIE" 4
+.IX Item "retry = yes | no | OPÓŹNIENIE"
 połącz ponownie sekcję connect+exec po rozłączeniu
 .Sp
+Wartość parametru OPÓŹNIENIE określa liczbę milisekund oczekiwania
+przed wykonaniem ponownego połączenia.
+\&\*(L"retry = yes\*(R" jest synonimem dla \*(L"retry = 1000\*(R".
+.Sp
 domyślnie: no
 .IP "\fBsecurityLevel\fR = \s-1POZIOM\s0" 4
 .IX Item "securityLevel = POZIOM"
@@ -1128,6 +1144,9 @@
 .IP "\fBTIMEOUTidle\fR = \s-1LICZBA_SEKUND\s0" 4
 .IX Item "TIMEOUTidle = LICZBA_SEKUND"
 maksymalny czas utrzymywania bezczynnego połączenia
+.IP "\fBTIMEOUTocsp\fR = \s-1LICZBA_SEKUND\s0" 4
+.IX Item "TIMEOUTocsp = LICZBA_SEKUND"
+czas oczekiwania na nawiązanie połączenia z serwerem \s-1OCSP\s0
 .IP "\fBtransparent\fR = none | source | destination | both (tylko Unix)" 4
 .IX Item "transparent = none | source | destination | both (tylko Unix)"
 tryb przezroczystego proxy na wspieranych platformach

_service:tar_scm:stunnel-5.69.tar.gz/doc/stunnel.pl.html.in -> _service:tar_scm:stunnel-5.72.tar.gz/doc/stunnel.pl.html.in Changed

@@ -768,7 +768,7 @@
 <dt id="OCSP-URL">OCSP = URL</dt>
 <dd>
 
-responder OCSP do weryfikacji certyfikat&oacute;w
+responder OCSP do weryfikacji certyfikatu drugiej strony poł&#x105;czenia
 
 </dd>
 <dt id="OCSPaia-yes-no">OCSPaia = yes | no</dt>
@@ -797,6 +797,22 @@
 Opcja OCSPnonce zabezpiecza protok&oacute;ł OCSP przed atakami powt&oacute;rzeniowymi. Ze wzgl&#x119;du na zło&#x17C;ono&#x15B;&#x107; obliczeniow&#x105; rozszerzenie nonce jest zwykle wspierane jedynie przez wewn&#x119;trzne (np. korporacyjne), a nie przez publiczne respondery OCSP.
 
 </dd>
+<dt id="OCSPrequire-yes-no">OCSPrequire = yes | no</dt>
+<dd>
+
+wymagaj rozstrzygaj&#x105;cej odpowiedzi respondera OCSP
+
+</dd>
+<dt id="OCSPrequire-yes-no1">OCSPrequire = yes | no</dt>
+<dd>
+
+Wył&#x105;czenie tej opcji pozwala na zaakceptowanie poł&#x105;czenia pomimo braku otrzymania rozstrzygaj&#x105;cej odpowiedzi OCSP ze staplingu i bezpo&#x15B;redniego &#x17C;&#x105;dania wysłanego do respondera.
+
+default: yes
+
+domy&#x15B;lnie: yes
+
+</dd>
 <dt id="options-OPCJE_SSL">options = OPCJE_SSL</dt>
 <dd>
 
@@ -1034,11 +1050,13 @@
 domy&#x15B;lnie: yes
 
 </dd>
-<dt id="retry-yes-no">retry = yes | no</dt>
+<dt id="retry-yes-no-OPNIENIE">retry = yes | no | OP&Oacute;&#x179;NIENIE</dt>
 <dd>
 
 poł&#x105;cz ponownie sekcj&#x119; connect+exec po rozł&#x105;czeniu
 
+Warto&#x15B;&#x107; parametru OP&Oacute;&#x179;NIENIE okre&#x15B;la liczb&#x119; milisekund oczekiwania przed wykonaniem ponownego poł&#x105;czenia. &quot;retry = yes&quot; jest synonimem dla &quot;retry = 1000&quot;.
+
 domy&#x15B;lnie: no
 
 </dd>
@@ -1327,6 +1345,12 @@
 maksymalny czas utrzymywania bezczynnego poł&#x105;czenia
 
 </dd>
+<dt id="TIMEOUTocsp-LICZBA_SEKUND">TIMEOUTocsp = LICZBA_SEKUND</dt>
+<dd>
+
+czas oczekiwania na nawi&#x105;zanie poł&#x105;czenia z serwerem OCSP
+
+</dd>
 <dt id="transparent-none-source-destination-both-tylko-Unix">transparent = none | source | destination | both (tylko Unix)</dt>
 <dd>

_service:tar_scm:stunnel-5.69.tar.gz/doc/stunnel.pl.pod.in -> _service:tar_scm:stunnel-5.72.tar.gz/doc/stunnel.pl.pod.in Changed

@@ -698,7 +698,7 @@
 
 =item B<OCSP> = URL
 
-responder OCSP do weryfikacji certyfikatów
+responder OCSP do weryfikacji certyfikatu drugiej strony połączenia
 
 =item B<OCSPaia> = yes | no
 
@@ -725,6 +725,20 @@
 jedynie przez wewnętrzne (np. korporacyjne), a nie przez publiczne respondery
 OCSP.
 
+=item B<OCSPrequire> = yes | no
+
+wymagaj rozstrzygającej odpowiedzi respondera OCSP
+
+=item B<OCSPrequire> = yes | no
+
+Wyłączenie tej opcji pozwala na zaakceptowanie połączenia pomimo braku
+otrzymania rozstrzygającej odpowiedzi OCSP ze staplingu i bezpośredniego
+żądania wysłanego do respondera.
+
+default: yes
+
+domyślnie: yes
+
 =item B<options> = OPCJE_SSL
 
 opcje biblioteki B<OpenSSL>
@@ -937,10 +951,14 @@
 
 domyślnie: yes
 
-=item B<retry> = yes | no
+=item B<retry> = yes | no | OPÓŹNIENIE
 
 połącz ponownie sekcję connect+exec po rozłączeniu
 
+Wartość parametru OPÓŹNIENIE określa liczbę milisekund oczekiwania
+przed wykonaniem ponownego połączenia.
+"retry = yes" jest synonimem dla "retry = 1000".
+
 domyślnie: no
 
 =item B<securityLevel> = POZIOM
@@ -1208,6 +1226,10 @@
 
 maksymalny czas utrzymywania bezczynnego połączenia
 
+=item B<TIMEOUTocsp> = LICZBA_SEKUND
+
+czas oczekiwania na nawiązanie połączenia z serwerem OCSP
+
 =item B<transparent> = none | source | destination | both (tylko Unix)
 
 tryb przezroczystego proxy na wspieranych platformach

_service:tar_scm:stunnel-5.69.tar.gz/doc/stunnel.pod.in -> _service:tar_scm:stunnel-5.72.tar.gz/doc/stunnel.pod.in Changed

@@ -136,7 +136,8 @@
 
 =item *
 
-A colon-separated pair of IP address (either IPv4, IPv6, or domain name) and port number.
+A colon-separated pair of IP address (either IPv4, IPv6, or domain name) and
+port number.
 
 =item *
 
@@ -156,7 +157,8 @@
 and I<exec> are located inside the jail and the patches have to be relative
 to the directory specified with B<chroot>.
 
-Several functions of the operating system also need their files to be located within the chroot jail, e.g.:
+Several functions of the operating system also need their files to be located
+within the chroot jail, e.g.:
 
 =over 4
 
@@ -215,7 +217,8 @@
 
 default: software-only cryptography
 
-See Examples section for an engine configuration to use the certificate and the corresponding private key from a cryptographic device.
+See Examples section for an engine configuration to use the certificate and the
+corresponding private key from a cryptographic device.
 
 =item B<engineCtrl> = COMMAND:PARAMETER
 
@@ -276,8 +279,8 @@
 
 log file handling
 
-This option allows you to choose whether the log file (specified with the I<output>
-option) is appended or overwritten when opened or re-opened.
+This option allows you to choose whether the log file (specified with the
+I<output> option) is appended or overwritten when opened or re-opened.
 
 default: append
 
@@ -412,11 +415,11 @@
 
 =item B<checkEmail> = EMAIL
 
-email address of the peer certificate subject
+verify the email address of the end-entity (leaf) peer certificate subject
 
 Certificates are accepted if no subject checks were specified, or the email
-address of the peer certificate matches any of the email addresses specified
-with I<checkEmail>.
+address of the end-entity (leaf) peer certificate matches any of the email
+addresses specified with I<checkEmail>.
 
 Multiple I<checkEmail> options are allowed in a single service section.
 
@@ -424,10 +427,11 @@
 
 =item B<checkHost> = HOST
 
-host of the peer certificate subject
+verify the host of the end-entity (leaf) peer certificate subject
 
 Certificates are accepted if no subject checks were specified, or the host name
-of the peer certificate matches any of the hosts specified with I<checkHost>.
+of the end-entity (leaf) peer certificate matches any of the hosts specified
+with I<checkHost>.
 
 Multiple I<checkHost> options are allowed in a single service section.
 
@@ -435,11 +439,11 @@
 
 =item B<checkIP> = IP
 
-IP address of the peer certificate subject
+verify the IP address of the end-entity (leaf) peer certificate subject
 
 Certificates are accepted if no subject checks were specified, or the IP
-address of the peer certificate matches any of the IP addresses specified with
-I<checkIP>.
+address of the end-entity (leaf) peer certificate matches any of the IP
+addresses specified with I<checkIP>.
 
 Multiple I<checkIP> options are allowed in a single service section.
 
@@ -481,7 +485,8 @@
 
 Several I<config> lines can be used to specify multiple configuration commands.
 
-Use I<curves> option instead of enabling I<config = Curves:list_curves> to support elliptic curves.
+Use I<curves> option instead of enabling I<config = Curves:list_curves> to
+support elliptic curves.
 
 This option requires OpenSSL 1.0.2 or later.
 
@@ -648,7 +653,8 @@
 
 include all configuration file parts located in DIRECTORY
 
-The files are included in the ascending alphabetical order of their names. The recommended filename convention is
+The files are included in the ascending alphabetical order of their names. The
+recommended filename convention is
 
 for global options:
 
@@ -688,7 +694,7 @@
 
 =item B<OCSP> = URL
 
-select OCSP responder for certificate verification
+select OCSP responder for the end-entity (leaf) peer certificate verification
 
 =item B<OCSPaia> = yes | no
 
@@ -715,6 +721,16 @@
 computational overhead, the nonce extension is usually only supported on
 internal (e.g. corporate) responders, and not on public OCSP responders.
 
+=item B<OCSPrequire> = yes | no
+
+require a conclusive OCSP response
+
+Disable this option to allow a connection even though no conclusive OCSP
+response was retrieved from stapling and a direct request to the OCSP
+responder.
+
+default: yes
+
 =item B<options> = SSL_OPTIONS
 
 B<OpenSSL> library options
@@ -738,8 +754,8 @@
 options = NO_SSLv2
 options = NO_SSLv3
 
-Use I<sslVersionMax> or I<sslVersionMin> option instead of disabling specific TLS protocol
-versions when compiled with B<OpenSSL 1.1.0> or later.
+Use I<sslVersionMax> or I<sslVersionMin> option instead of disabling specific
+TLS protocol versions when compiled with B<OpenSSL 1.1.0> or later.
 
 =item B<protocol> = PROTO
 
@@ -932,10 +948,13 @@
 
 default: yes
 
-=item B<retry> = yes | no
+=item B<retry> = yes | no | DELAY
 
 reconnect a connect+exec section after it was disconnected
 
+The DELAY value specifies the number of milliseconds before retrying.
+"retry = yes" has the same effect as "retry = 1000".
+
 default: no
 
 =item B<securityLevel> = LEVEL
@@ -952,23 +971,39 @@
 
 =item level 1
 
-The security level corresponds to a minimum of 80 bits of security. Any parameters offering below 80 bits of security are excluded. As a result RSA, DSA and DH keys shorter than 1024 bits and ECC keys shorter than 160 bits are prohibited. All export cipher suites are prohibited since they all offer less than 80 bits of security. SSL version 2 is prohibited. Any cipher suite using MD5 for the MAC is also prohibited.
+The security level corresponds to a minimum of 80 bits of security. Any
+parameters offering below 80 bits of security are excluded. As a result RSA,
+DSA and DH keys shorter than 1024 bits and ECC keys shorter than 160 bits are
+prohibited. All export cipher suites are prohibited since they all offer less
+than 80 bits of security. SSL version 2 is prohibited. Any cipher suite using
+MD5 for the MAC is also prohibited.
 
 =item level 2
 
-Security level set to 112 bits of security. As a result RSA, DSA and DH keys shorter than 2048 bits and ECC keys shorter than 224 bits are prohibited. In addition to the level 1 exclusions any cipher suite using RC4 is also prohibited. SSL version 3 is also not allowed. Compression is disabled.
+Security level set to 112 bits of security. As a result RSA, DSA and DH keys
+shorter than 2048 bits and ECC keys shorter than 224 bits are prohibited. In
+addition to the level 1 exclusions any cipher suite using RC4 is also
+prohibited. SSL version 3 is also not allowed. Compression is disabled.
 
 =item level 3
 
-Security level set to 128 bits of security. As a result RSA, DSA and DH keys shorter than 3072 bits and ECC keys shorter than 256 bits are prohibited. In addition to the level 2 exclusions cipher suites not offering forward secrecy are prohibited. TLS versions below 1.1 are not permitted. Session tickets are disabled.
+Security level set to 128 bits of security. As a result RSA, DSA and DH keys
+shorter than 3072 bits and ECC keys shorter than 256 bits are prohibited. In
+addition to the level 2 exclusions cipher suites not offering forward secrecy
+are prohibited. TLS versions below 1.1 are not permitted. Session tickets are
+disabled.
 
 =item level 4
 
-Security level set to 192 bits of security. As a result RSA, DSA and DH keys shorter than 7680 bits and ECC keys shorter than 384 bits are prohibited. Cipher suites using SHA1 for the MAC are prohibited. TLS versions below 1.2 are not permitted.
+Security level set to 192 bits of security. As a result RSA, DSA and DH keys
+shorter than 7680 bits and ECC keys shorter than 384 bits are prohibited.
+Cipher suites using SHA1 for the MAC are prohibited. TLS versions below 1.2 are
+not permitted.
 
 =item level 5
 
-Security level set to 256 bits of security. As a result RSA, DSA and DH keys shorter than 15360 bits and ECC keys shorter than 512 bits are prohibited.
+Security level set to 256 bits of security. As a result RSA, DSA and DH keys
+shorter than 15360 bits and ECC keys shorter than 512 bits are prohibited.

_service:tar_scm:stunnel-5.69.tar.gz/m4/libtool.m4 -> _service:tar_scm:stunnel-5.72.tar.gz/m4/libtool.m4 Changed

@@ -1,6 +1,7 @@
 # libtool.m4 - Configure libtool for the host system. -*-Autoconf-*-
 #
-# Copyright (C) 1996-2001, 2003-2015 Free Software Foundation, Inc.
+# Copyright (C) 1996-2001, 2003-2019, 2021-2022 Free Software
+# Foundation, Inc.
 # Written by Gordon Matzigkeit, 1996
 #
 # This file is free software; the Free Software Foundation gives
@@ -31,7 +32,7 @@
 # along with this program. If not, see <http://www.gnu.org/licenses/>.
 )
 
-# serial 58 LT_INIT
+# serial 59 LT_INIT
 
 
 # LT_PREREQ(VERSION)
@@ -181,6 +182,7 @@
 m4_require(_LT_CHECK_SHELL_FEATURES)dnl
 m4_require(_LT_PATH_CONVERSION_FUNCTIONS)dnl
 m4_require(_LT_CMD_RELOAD)dnl
+m4_require(_LT_DECL_FILECMD)dnl
 m4_require(_LT_CHECK_MAGIC_METHOD)dnl
 m4_require(_LT_CHECK_SHAREDLIB_FROM_LINKLIB)dnl
 m4_require(_LT_CMD_OLD_ARCHIVE)dnl
@@ -219,8 +221,8 @@
 ofile=libtool
 can_build_shared=yes
 
-# All known linkers require a '.a' archive for static linking (except MSVC,
-# which needs '.lib').
+# All known linkers require a '.a' archive for static linking (except MSVC and
+# ICC, which need '.lib').
 libext=a
 
 with_gnu_ld=$lt_cv_prog_gnu_ld
@@ -777,7 +779,7 @@
 # if finds mixed CR/LF and LF-only lines. Since sed operates in
 # text mode, it properly converts lines to CR/LF. This bash problem
 # is reportedly fixed, but why not run on old versions too?
- sed '$q' "$ltmain" >> "$cfgfile" \
+ $SED '$q' "$ltmain" >> "$cfgfile" \
 || (rm -f "$cfgfile"; exit 1)
 
 mv -f "$cfgfile" "$ofile" ||
@@ -1041,8 +1043,8 @@
 _LT_EOF
 echo "$LTCC $LTCFLAGS -c -o conftest.o conftest.c" >&AS_MESSAGE_LOG_FD
 $LTCC $LTCFLAGS -c -o conftest.o conftest.c 2>&AS_MESSAGE_LOG_FD
- echo "$AR cr libconftest.a conftest.o" >&AS_MESSAGE_LOG_FD
- $AR cr libconftest.a conftest.o 2>&AS_MESSAGE_LOG_FD
+ echo "$AR $AR_FLAGS libconftest.a conftest.o" >&AS_MESSAGE_LOG_FD
+ $AR $AR_FLAGS libconftest.a conftest.o 2>&AS_MESSAGE_LOG_FD
 echo "$RANLIB libconftest.a" >&AS_MESSAGE_LOG_FD
 $RANLIB libconftest.a 2>&AS_MESSAGE_LOG_FD
 cat > conftest.c << _LT_EOF
@@ -1066,17 +1068,12 @@
 _lt_dar_allow_undefined='$wl-undefined ${wl}suppress' ;;
 darwin1.*)
 _lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;;
- darwin*) # darwin 5.x on
- # if running on 10.5 or later, the deployment target defaults
- # to the OS version, if on x86, and 10.4, the deployment
- # target defaults to 10.4. Don't you love it?
- case ${MACOSX_DEPLOYMENT_TARGET-10.0},$host in
-	10.0,*86*-darwin8*|10.0,*-darwin912*)
-	 _lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;;
-	10.012,.*)
-	 _lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;;
-	10.*|11.*)
-	 _lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;;
+ darwin*)
+ case $MACOSX_DEPLOYMENT_TARGET,$host in
+ 10.012,*|,*powerpc*-darwin5-8*)
+ _lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;;
+ *)
+ _lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;;
 esac
 ;;
 esac
@@ -1125,12 +1122,12 @@
 output_verbose_link_cmd=func_echo_all
 _LT_TAGVAR(archive_cmds, $1)="\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$libobjs \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring $_lt_dar_single_mod$_lt_dsymutil"
 _LT_TAGVAR(module_cmds, $1)="\$CC \$allow_undefined_flag -o \$lib -bundle \$libobjs \$deplibs \$compiler_flags$_lt_dsymutil"
- _LT_TAGVAR(archive_expsym_cmds, $1)="sed 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$libobjs \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring $_lt_dar_single_mod$_lt_dar_export_syms$_lt_dsymutil"
- _LT_TAGVAR(module_expsym_cmds, $1)="sed -e 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC \$allow_undefined_flag -o \$lib -bundle \$libobjs \$deplibs \$compiler_flags$_lt_dar_export_syms$_lt_dsymutil"
+ _LT_TAGVAR(archive_expsym_cmds, $1)="$SED 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$libobjs \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring $_lt_dar_single_mod$_lt_dar_export_syms$_lt_dsymutil"
+ _LT_TAGVAR(module_expsym_cmds, $1)="$SED -e 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC \$allow_undefined_flag -o \$lib -bundle \$libobjs \$deplibs \$compiler_flags$_lt_dar_export_syms$_lt_dsymutil"
 m4_if($1, CXX,
 if test yes != "$lt_cv_apple_cc_single_mod"; then
 _LT_TAGVAR(archive_cmds, $1)="\$CC -r -keep_private_externs -nostdlib -o \$lib-master.o \$libobjs~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$lib-master.o \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring$_lt_dsymutil"
- _LT_TAGVAR(archive_expsym_cmds, $1)="sed 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -r -keep_private_externs -nostdlib -o \$lib-master.o \$libobjs~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$lib-master.o \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring$_lt_dar_export_syms$_lt_dsymutil"
+ _LT_TAGVAR(archive_expsym_cmds, $1)="$SED 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -r -keep_private_externs -nostdlib -o \$lib-master.o \$libobjs~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$lib-master.o \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring$_lt_dar_export_syms$_lt_dsymutil"
 fi
 ,)
 else
@@ -1244,7 +1241,8 @@
 # _LT_WITH_SYSROOT
 # ----------------
 AC_DEFUN(_LT_WITH_SYSROOT,
-AC_MSG_CHECKING(for sysroot)
+m4_require(_LT_DECL_SED)dnl
+AC_MSG_CHECKING(for sysroot)
 AC_ARG_WITH(sysroot,
 AS_HELP_STRING(--with-sysroot@<:@=DIR@:>@,
 Search for dependent libraries within DIR (or the compiler's sysroot
@@ -1261,7 +1259,7 @@
 fi
 ;; #(
 /*)
- lt_sysroot=`echo "$with_sysroot" | sed -e "$sed_quote_subst"`
+ lt_sysroot=`echo "$with_sysroot" | $SED -e "$sed_quote_subst"`
 ;; #(
 no|'')
 ;; #(
@@ -1291,7 +1289,7 @@
 # options accordingly.
 echo 'int i;' > conftest.$ac_ext
 if AC_TRY_EVAL(ac_compile); then
- case `/usr/bin/file conftest.$ac_objext` in
+ case `$FILECMD conftest.$ac_objext` in
 *ELF-32*)
 	HPUX_IA64_MODE=32
 	;;
@@ -1308,7 +1306,7 @@
 echo '#line '$LINENO' "configure"' > conftest.$ac_ext
 if AC_TRY_EVAL(ac_compile); then
 if test yes = "$lt_cv_prog_gnu_ld"; then
- case `/usr/bin/file conftest.$ac_objext` in
+ case `$FILECMD conftest.$ac_objext` in
 	*32-bit*)
 	 LD="${LD-ld} -melf32bsmip"
 	 ;;
@@ -1320,7 +1318,7 @@
 	;;
 esac
 else
- case `/usr/bin/file conftest.$ac_objext` in
+ case `$FILECMD conftest.$ac_objext` in
 	*32-bit*)
 	 LD="${LD-ld} -32"
 	 ;;
@@ -1342,7 +1340,7 @@
 echo '#line '$LINENO' "configure"' > conftest.$ac_ext
 if AC_TRY_EVAL(ac_compile); then
 emul=elf
- case `/usr/bin/file conftest.$ac_objext` in
+ case `$FILECMD conftest.$ac_objext` in
 *32-bit*)
 	emul="${emul}32"
 	;;
@@ -1350,7 +1348,7 @@
 	emul="${emul}64"
 	;;
 esac
- case `/usr/bin/file conftest.$ac_objext` in
+ case `$FILECMD conftest.$ac_objext` in
 *MSB*)
 	emul="${emul}btsmip"
 	;;
@@ -1358,7 +1356,7 @@
 	emul="${emul}ltsmip"
 	;;
 esac
- case `/usr/bin/file conftest.$ac_objext` in
+ case `$FILECMD conftest.$ac_objext` in
 *N32*)
 	emul="${emul}n32"
 	;;
@@ -1378,14 +1376,14 @@
 # not appear in the list.
 echo 'int i;' > conftest.$ac_ext
 if AC_TRY_EVAL(ac_compile); then
- case `/usr/bin/file conftest.o` in
+ case `$FILECMD conftest.o` in
 *32-bit*)
 	case $host in
 	 x86_64-*kfreebsd*-gnu)
 	 LD="${LD-ld} -m elf_i386_fbsd"
 	 ;;
 	 x86_64-*linux*)
-	 case `/usr/bin/file conftest.o` in
+	 case `$FILECMD conftest.o` in
 	 *x86-64*)
 		LD="${LD-ld} -m elf32_x86_64"
 		;;
@@ -1453,7 +1451,7 @@
 # options accordingly.
 echo 'int i;' > conftest.$ac_ext
 if AC_TRY_EVAL(ac_compile); then
- case `/usr/bin/file conftest.o` in
+ case `$FILECMD conftest.o` in
 *64-bit*)
 case $lt_cv_prog_gnu_ld in
 yes*)
@@ -1492,9 +1490,22 @@
 m4_defun(_LT_PROG_AR,
 AC_CHECK_TOOLS(AR, ar, false)
 : ${AR=ar}

_service:tar_scm:stunnel-5.69.tar.gz/m4/ltoptions.m4 -> _service:tar_scm:stunnel-5.72.tar.gz/m4/ltoptions.m4 Changed

_service:tar_scm:stunnel-5.69.tar.gz/m4/ltsugar.m4 -> _service:tar_scm:stunnel-5.72.tar.gz/m4/ltsugar.m4 Changed

_service:tar_scm:stunnel-5.69.tar.gz/m4/ltversion.m4 -> _service:tar_scm:stunnel-5.72.tar.gz/m4/ltversion.m4 Changed

_service:tar_scm:stunnel-5.69.tar.gz/m4/lt~obsolete.m4 -> _service:tar_scm:stunnel-5.72.tar.gz/m4/lt~obsolete.m4 Changed

_service:tar_scm:stunnel-5.69.tar.gz/src/Makefile.am -> _service:tar_scm:stunnel-5.72.tar.gz/src/Makefile.am Changed

@@ -1,5 +1,5 @@
 ## Process this file with automake to produce Makefile.in
-# by Michal Trojnara 1998-2023
+# by Michal Trojnara 1998-2024
 
 ###############################################################################
 # File lists                                                                  #
@@ -8,7 +8,7 @@
 common_headers = common.h prototypes.h version.h
 common_sources = tls.c str.c file.c client.c log.c options.c protocol.c
 common_sources += network.c resolver.c ssl.c ctx.c verify.c sthreads.c
-common_sources += fd.c dhparam.c cron.c stunnel.c
+common_sources += ocsp.c fd.c dhparam.c cron.c stunnel.c
 unix_sources = pty.c libwrap.c ui_unix.c
 shared_sources = env.c
 win32_gui_sources = ui_win_gui.c resources.h resources.rc
@@ -37,12 +37,14 @@
 # TLS library
 stunnel_LDFLAGS = -L$(SSLDIR)/lib64 -L$(SSLDIR)/lib -lssl -lcrypto
 
-# stunnel3 script
+# Apply substitutions
 edit = sed \
-	-e 's|@bindir@|$(bindir)|g'
-stunnel3: Makefile
+	-e 's|@bindir@|$(bindir)|g' \
+	-e 's|@PACKAGE_VERSION@|$(PACKAGE_VERSION)|g'
+stunnel3 os2.mak: Makefile
 	$(edit) '$(srcdir)/$@.in' >$@
 stunnel3: $(srcdir)/stunnel3.in
+os2.mak: $(srcdir)/os2.mak.in
 
 # Unix shared library
 pkglib_LTLIBRARIES = libstunnel.la
@@ -64,7 +66,14 @@
 clean-local:
 	rm -rf ../obj ../bin
 
-# Remaining files to be included
+###############################################################################
+# Remaining files to be included                                              #
+###############################################################################
+
+dist_noinst_DATA = os2.mak
+EXTRA_DIST += os2.mak.in
+CLEANFILES += os2.mak
+
 EXTRA_DIST += $(win32_gui_sources) $(win32_cli_sources)
 EXTRA_DIST += make.bat makece.bat makew32.bat
-EXTRA_DIST += mingw.mk mingw.mak evc.mak vc.mak os2.mak
+EXTRA_DIST += mingw.mk mingw.mak evc.mak vc.mak

_service:tar_scm:stunnel-5.69.tar.gz/src/Makefile.in -> _service:tar_scm:stunnel-5.72.tar.gz/src/Makefile.in Changed

@@ -14,7 +14,7 @@
 
 @SET_MAKE@
 
-# by Michal Trojnara 1998-2023
+# by Michal Trojnara 1998-2024
 
 ###############################################################################
 # File lists                                                                  #
@@ -22,6 +22,7 @@
 
 
 
+
 VPATH = @srcdir@
 am__is_gnu_make = { \
   if test -z '$(MAKELEVEL)'; then \
@@ -105,7 +106,8 @@
 	$(top_srcdir)/configure.ac
 am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
 	$(ACLOCAL_M4)
-DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
+DIST_COMMON = $(srcdir)/Makefile.am $(dist_noinst_DATA) \
+	$(am__DIST_COMMON)
 mkinstalldirs = $(install_sh) -d
 CONFIG_HEADER = config.h
 CONFIG_CLEAN_FILES =
@@ -159,9 +161,9 @@
 	stunnel-protocol.$(OBJEXT) stunnel-network.$(OBJEXT) \
 	stunnel-resolver.$(OBJEXT) stunnel-ssl.$(OBJEXT) \
 	stunnel-ctx.$(OBJEXT) stunnel-verify.$(OBJEXT) \
-	stunnel-sthreads.$(OBJEXT) stunnel-fd.$(OBJEXT) \
-	stunnel-dhparam.$(OBJEXT) stunnel-cron.$(OBJEXT) \
-	stunnel-stunnel.$(OBJEXT)
+	stunnel-sthreads.$(OBJEXT) stunnel-ocsp.$(OBJEXT) \
+	stunnel-fd.$(OBJEXT) stunnel-dhparam.$(OBJEXT) \
+	stunnel-cron.$(OBJEXT) stunnel-stunnel.$(OBJEXT)
 am__objects_4 = stunnel-pty.$(OBJEXT) stunnel-libwrap.$(OBJEXT) \
 	stunnel-ui_unix.$(OBJEXT)
 am_stunnel_OBJECTS = $(am__objects_2) $(am__objects_3) \
@@ -192,12 +194,13 @@
 	./$(DEPDIR)/stunnel-ctx.Po ./$(DEPDIR)/stunnel-dhparam.Po \
 	./$(DEPDIR)/stunnel-fd.Po ./$(DEPDIR)/stunnel-file.Po \
 	./$(DEPDIR)/stunnel-libwrap.Po ./$(DEPDIR)/stunnel-log.Po \
-	./$(DEPDIR)/stunnel-network.Po ./$(DEPDIR)/stunnel-options.Po \
-	./$(DEPDIR)/stunnel-protocol.Po ./$(DEPDIR)/stunnel-pty.Po \
-	./$(DEPDIR)/stunnel-resolver.Po ./$(DEPDIR)/stunnel-ssl.Po \
-	./$(DEPDIR)/stunnel-sthreads.Po ./$(DEPDIR)/stunnel-str.Po \
-	./$(DEPDIR)/stunnel-stunnel.Po ./$(DEPDIR)/stunnel-tls.Po \
-	./$(DEPDIR)/stunnel-ui_unix.Po ./$(DEPDIR)/stunnel-verify.Po
+	./$(DEPDIR)/stunnel-network.Po ./$(DEPDIR)/stunnel-ocsp.Po \
+	./$(DEPDIR)/stunnel-options.Po ./$(DEPDIR)/stunnel-protocol.Po \
+	./$(DEPDIR)/stunnel-pty.Po ./$(DEPDIR)/stunnel-resolver.Po \
+	./$(DEPDIR)/stunnel-ssl.Po ./$(DEPDIR)/stunnel-sthreads.Po \
+	./$(DEPDIR)/stunnel-str.Po ./$(DEPDIR)/stunnel-stunnel.Po \
+	./$(DEPDIR)/stunnel-tls.Po ./$(DEPDIR)/stunnel-ui_unix.Po \
+	./$(DEPDIR)/stunnel-verify.Po
 am__mv = mv -f
 COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
 	$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
@@ -224,6 +227,7 @@
     n|no|NO) false;; \
     *) (install-info --version) >/dev/null 2>&1;; \
   esac
+DATA = $(dist_noinst_DATA)
 am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP) \
 	config.h.in
 # Read a list of newline-separated strings from the standard input,
@@ -274,6 +278,7 @@
 ETAGS = @ETAGS@
 EXEEXT = @EXEEXT@
 FGREP = @FGREP@
+FILECMD = @FILECMD@
 GREP = @GREP@
 INSTALL = @INSTALL@
 INSTALL_DATA = @INSTALL_DATA@
@@ -377,7 +382,7 @@
 common_headers = common.h prototypes.h version.h
 common_sources = tls.c str.c file.c client.c log.c options.c \
 	protocol.c network.c resolver.c ssl.c ctx.c verify.c \
-	sthreads.c fd.c dhparam.c cron.c stunnel.c
+	sthreads.c ocsp.c fd.c dhparam.c cron.c stunnel.c
 unix_sources = pty.c libwrap.c ui_unix.c
 shared_sources = env.c
 win32_gui_sources = ui_win_gui.c resources.h resources.rc stunnel.ico \
@@ -385,12 +390,10 @@
 win32_cli_sources = ui_win_cli.c
 stunnel_SOURCES = $(common_headers) $(common_sources) $(unix_sources)
 bin_SCRIPTS = stunnel3
-
-# Remaining files to be included
-EXTRA_DIST = stunnel3.in $(win32_gui_sources) $(win32_cli_sources) \
-	make.bat makece.bat makew32.bat mingw.mk mingw.mak evc.mak \
-	vc.mak os2.mak
-CLEANFILES = stunnel3
+EXTRA_DIST = stunnel3.in os2.mak.in $(win32_gui_sources) \
+	$(win32_cli_sources) make.bat makece.bat makew32.bat mingw.mk \
+	mingw.mak evc.mak vc.mak
+CLEANFILES = stunnel3 os2.mak
 
 # Red Hat "by design" bug #82369
 
@@ -402,15 +405,21 @@
 # TLS library
 stunnel_LDFLAGS = -L$(SSLDIR)/lib64 -L$(SSLDIR)/lib -lssl -lcrypto
 
-# stunnel3 script
+# Apply substitutions
 edit = sed \
-	-e 's|@bindir@|$(bindir)|g'
+	-e 's|@bindir@|$(bindir)|g' \
+	-e 's|@PACKAGE_VERSION@|$(PACKAGE_VERSION)|g'
 
 
 # Unix shared library
 pkglib_LTLIBRARIES = libstunnel.la
 libstunnel_la_SOURCES = $(shared_sources)
 libstunnel_la_LDFLAGS = -avoid-version
+
+###############################################################################
+# Remaining files to be included                                              #
+###############################################################################
+dist_noinst_DATA = os2.mak
 all: config.h
 	$(MAKE) $(AM_MAKEFLAGS) all-am
 
@@ -603,6 +612,7 @@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-libwrap.Po@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-log.Po@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-network.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-ocsp.Po@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-options.Po@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-protocol.Po@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-pty.Po@am__quote@ # am--include-marker
@@ -824,6 +834,20 @@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(stunnel_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o stunnel-sthreads.obj `if test -f 'sthreads.c'; then $(CYGPATH_W) 'sthreads.c'; else $(CYGPATH_W) '$(srcdir)/sthreads.c'; fi`
 
+stunnel-ocsp.o: ocsp.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(stunnel_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT stunnel-ocsp.o -MD -MP -MF $(DEPDIR)/stunnel-ocsp.Tpo -c -o stunnel-ocsp.o `test -f 'ocsp.c' || echo '$(srcdir)/'`ocsp.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/stunnel-ocsp.Tpo $(DEPDIR)/stunnel-ocsp.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='ocsp.c' object='stunnel-ocsp.o' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(stunnel_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o stunnel-ocsp.o `test -f 'ocsp.c' || echo '$(srcdir)/'`ocsp.c
+
+stunnel-ocsp.obj: ocsp.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(stunnel_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT stunnel-ocsp.obj -MD -MP -MF $(DEPDIR)/stunnel-ocsp.Tpo -c -o stunnel-ocsp.obj `if test -f 'ocsp.c'; then $(CYGPATH_W) 'ocsp.c'; else $(CYGPATH_W) '$(srcdir)/ocsp.c'; fi`
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/stunnel-ocsp.Tpo $(DEPDIR)/stunnel-ocsp.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='ocsp.c' object='stunnel-ocsp.obj' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(stunnel_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o stunnel-ocsp.obj `if test -f 'ocsp.c'; then $(CYGPATH_W) 'ocsp.c'; else $(CYGPATH_W) '$(srcdir)/ocsp.c'; fi`
+
 stunnel-fd.o: fd.c
 @am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(stunnel_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT stunnel-fd.o -MD -MP -MF $(DEPDIR)/stunnel-fd.Tpo -c -o stunnel-fd.o `test -f 'fd.c' || echo '$(srcdir)/'`fd.c
 @am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/stunnel-fd.Tpo $(DEPDIR)/stunnel-fd.Po
@@ -1014,7 +1038,8 @@
 	done
 check-am: all-am
 check: check-am
-all-am: Makefile $(PROGRAMS) $(LTLIBRARIES) $(SCRIPTS) config.h
+all-am: Makefile $(PROGRAMS) $(LTLIBRARIES) $(SCRIPTS) $(DATA) \
+		config.h
 installdirs:
 	for dir in "$(DESTDIR)$(bindir)" "$(DESTDIR)$(pkglibdir)" "$(DESTDIR)$(bindir)"; do \
 	  test -z "$$dir" || $(MKDIR_P) "$$dir"; \
@@ -1066,6 +1091,7 @@
 	-rm -f ./$(DEPDIR)/stunnel-libwrap.Po
 	-rm -f ./$(DEPDIR)/stunnel-log.Po
 	-rm -f ./$(DEPDIR)/stunnel-network.Po
+	-rm -f ./$(DEPDIR)/stunnel-ocsp.Po
 	-rm -f ./$(DEPDIR)/stunnel-options.Po
 	-rm -f ./$(DEPDIR)/stunnel-protocol.Po
 	-rm -f ./$(DEPDIR)/stunnel-pty.Po
@@ -1133,6 +1159,7 @@
 	-rm -f ./$(DEPDIR)/stunnel-libwrap.Po
 	-rm -f ./$(DEPDIR)/stunnel-log.Po
 	-rm -f ./$(DEPDIR)/stunnel-network.Po
+	-rm -f ./$(DEPDIR)/stunnel-ocsp.Po
 	-rm -f ./$(DEPDIR)/stunnel-options.Po
 	-rm -f ./$(DEPDIR)/stunnel-protocol.Po
 	-rm -f ./$(DEPDIR)/stunnel-pty.Po
@@ -1184,9 +1211,10 @@
 
 .PRECIOUS: Makefile
 
-stunnel3: Makefile
+stunnel3 os2.mak: Makefile
 	$(edit) '$(srcdir)/$@.in' >$@
 stunnel3: $(srcdir)/stunnel3.in
+os2.mak: $(srcdir)/os2.mak.in
 
 ###############################################################################
 # Win32 executables                                                           #

_service:tar_scm:stunnel-5.69.tar.gz/src/client.c -> _service:tar_scm:stunnel-5.72.tar.gz/src/client.c Changed

@@ -1,6 +1,6 @@
 /*
 * stunnel TLS offloading and load-balancing proxy
- * Copyright (C) 1998-2023 Michal Trojnara <Michal.Trojnara@stunnel.org>
+ * Copyright (C) 1998-2024 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
@@ -60,7 +60,6 @@
 #endif
 NOEXPORT void print_cipher(CLI *);
 NOEXPORT void transfer(CLI *);
-NOEXPORT int parse_socket_error(CLI *, const char *);
 
 NOEXPORT void auth_user(CLI *);
 NOEXPORT SOCKET connect_local(CLI *);
@@ -176,7 +175,7 @@
 void client_main(CLI *c) {
 s_log(LOG_DEBUG, "Service %s started", c->opt->servname);
 if(c->opt->exec_name && c->opt->connect_addr.names) {
- if(c->opt->option.retry)
+ if(c->opt->retry >= 0)
 exec_connect_loop(c);
 else
 exec_connect_once(c);
@@ -202,7 +201,7 @@
 NOEXPORT void exec_connect_loop(CLI *c) {
 unsigned long long seq=0;
 const char *fresh_id=c->tls->id;
- unsigned retry;
+ long retry;
 
 do {
 /* make sure c->tls->id is valid in str_printf() */
@@ -213,19 +212,20 @@
 exec_connect_once(c);
 /* retry is asynchronously changed in the main thread,
 * so we make sure to use the same value for both checks */
- retry=c->opt->option.retry;
- if(retry) {
+ retry=c->opt->retry;
+ if(retry >= 0) {
 s_log(LOG_INFO, "Retrying an exec+connect section");
 /* c and id are detached, so it is safe to call str_stats() */
 str_stats(); /* client thread allocation tracking */
- s_poll_sleep(1, 0);
+ if(retry)
+ s_poll_sleep((int)(retry/1000), (int)(retry%1000));
 c->rr++;
 }
 
 /* make sure c->tls->id is valid in str_free() */
 c->tls->id=fresh_id;
 str_free(id);
- } while(retry); /* retry is disabled on config reload */
+ } while(retry >= 0); /* retry is disabled on config reload */
 }
 #ifdef __GNUC__
 #if __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 6)
@@ -415,17 +415,21 @@
 
 NOEXPORT void client_try(CLI *c) {
 local_start(c);
- protocol(c, c->opt, PROTOCOL_EARLY);
+ if(c->opt->protocol_early)
+ c->opt->protocol_early(c);
 if(c->opt->option.connect_before_ssl) {
 remote_start(c);
- protocol(c, c->opt, PROTOCOL_MIDDLE);
+ if(c->opt->protocol_middle)
+ c->opt->protocol_middle(c);
 ssl_start(c);
 } else {
 ssl_start(c);
- protocol(c, c->opt, PROTOCOL_MIDDLE);
+ if(c->opt->protocol_middle)
+ c->opt->protocol_middle(c);
 remote_start(c);
 }
- protocol(c, c->opt, PROTOCOL_LATE);
+ if(c->opt->protocol_late)
+ c->opt->protocol_late(c);
 transfer(c);
 }
 
@@ -549,6 +553,12 @@
 }
 if(c->opt->option.client) {
 #ifndef OPENSSL_NO_TLSEXT
+#ifndef OPENSSL_NO_OCSP
+ if(!SSL_set_tlsext_status_type(c->ssl, TLSEXT_STATUSTYPE_ocsp)) {
+ sslerror("OCSP: SSL_set_tlsext_status_type");
+ throw_exception(c, 1);
+ }
+#endif /* !defined(OPENSSL_NO_OCSP) */
 /* c->opt->sni should always be initialized at this point,
 * either explicitly with "sni"
 * or implicitly with "protocolHost" or "connect" */
@@ -659,7 +669,7 @@
 }
 }
 if(SSL_session_reused(c->ssl)) {
- print_session_id(sess);
+ print_session_id(sess); /* otherwise printed from sess_new_cb() */
 } else { /* a new session was negotiated */
 /* SSL_SESS_CACHE_NO_INTERNAL_STORE prevented automatic caching */
 if(!c->opt->option.client)
@@ -682,7 +692,7 @@
 if(c->opt->connect_session) {
 sess=c->opt->connect_sessionc->idx;
 } else {
- s_log(LOG_ERR, "INTERNAL ERROR: Uninitialized client session cache");
+ s_log(LOG_ERR, "INTERNAL ERROR: Uninitialized client session cache (retrieve)");
 sess=NULL;
 }
 }
@@ -746,12 +756,21 @@
 if(c->opt->log_level<LOG_INFO) /* performance optimization */
 return;
 
- s_log(LOG_INFO, "TLS %s: %s",
- c->opt->option.client ? "connected" : "accepted",
- SSL_session_reused(c->ssl) && !c->flag.psk ?
- "previous session reused" : "new session negotiated");
+#ifndef OPENSSL_NO_PSK
+ if(c->flag.psk_found) {
+ if(c->opt->option.client) {
+ s_log(LOG_ERR, "INTERNAL ERROR: PSK found on a client");
+ } else {
+ s_log(LOG_INFO, "TLS accepted: PSK");
+ }
+ } else
+#endif /* !defined(OPENSSL_NO_PSK) */
+ s_log(LOG_INFO, "TLS %s: %s",
+ c->opt->option.client ? "connected" : "accepted",
+ SSL_session_reused(c->ssl) ?
+ "previous session reused" : "new session negotiated");
 
- cipher=SSL_get_current_cipher(c->ssl);
+ cipher=(SSL_CIPHER *)SSL_get_current_cipher(c->ssl);
 s_log(LOG_INFO, "%s ciphersuite: %s (%d-bit encryption)",
 SSL_get_version(c->ssl), SSL_CIPHER_get_name(cipher),
 SSL_CIPHER_get_bits(cipher, NULL));
@@ -971,7 +990,7 @@
 shutdown_wants_read=shutdown_wants_write=0;
 break;
 case SSL_ERROR_SYSCALL: /* socket error */
- if(parse_socket_error(c, "SSL_shutdown"))
+ if(socket_needs_retry(c, "transfer: SSL_shutdown"))
 break; /* a non-critical error: retry */
 SSL_set_shutdown(c->ssl, SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
 shutdown_wants_read=shutdown_wants_write=0;
@@ -987,7 +1006,7 @@
 ssize_t num=writesocket(c->sock_wfd->fd, c->ssl_buff, c->ssl_ptr);
 switch(num) {
 case -1: /* error */
- if(parse_socket_error(c, "writesocket"))
+ if(socket_needs_retry(c, "transfer: writesocket"))
 break; /* a non-critical error: retry */
 sock_open_rd=sock_open_wr=0;
 break;
@@ -1009,7 +1028,7 @@
 c->sock_buff+c->sock_ptr, BUFFSIZE-c->sock_ptr);
 switch(num) {
 case -1:
- if(parse_socket_error(c, "readsocket"))
+ if(socket_needs_retry(c, "transfer: readsocket"))
 break; /* a non-critical error: retry */
 sock_open_rd=sock_open_wr=0;
 break;
@@ -1067,7 +1086,7 @@
 case SSL_ERROR_ZERO_RETURN: /* a buffered close_notify alert */
 /* fall through */
 case SSL_ERROR_SYSCALL: /* socket error */
- if(parse_socket_error(c, "SSL_write") && num) /* always log the error */
+ if(socket_needs_retry(c, "transfer: SSL_write") && num)
 break; /* a non-critical error: retry */
 /* EOF -> buggy (e.g. Microsoft) peer:
 * TLS socket closed without close_notify alert */
@@ -1118,6 +1137,24 @@
 "SSL_read returned WANT_X509_LOOKUP: retrying");
 break;
 case SSL_ERROR_SSL:
+#ifdef SSL_R_UNEXPECTED_EOF_WHILE_READING
+ /* OpenSSL 3.0 changed the method of reporting socket EOF */
+ if(ERR_GET_REASON(ERR_peek_error())==
+ SSL_R_UNEXPECTED_EOF_WHILE_READING) {
+ /* EOF -> buggy (e.g. Microsoft) peer:
+ * TLS socket closed without close_notify alert */
+ if(c->sock_ptr || write_wants_write) {
+ s_log(LOG_ERR,
+ "TLS socket closed (SSL_read) with %ld unsent byte(s)",
+ (long)c->sock_ptr);
+ throw_exception(c, 1); /* reset the sockets */
+ }
+ s_log(LOG_INFO, "TLS socket closed (SSL_read)");
+ SSL_set_shutdown(c->ssl,
+ SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
+ break;
+ }

_service:tar_scm:stunnel-5.69.tar.gz/src/common.h -> _service:tar_scm:stunnel-5.72.tar.gz/src/common.h Changed

_service:tar_scm:stunnel-5.69.tar.gz/src/cron.c -> _service:tar_scm:stunnel-5.72.tar.gz/src/cron.c Changed

_service:tar_scm:stunnel-5.69.tar.gz/src/ctx.c -> _service:tar_scm:stunnel-5.72.tar.gz/src/ctx.c Changed

@@ -1,6 +1,6 @@
 /*
 * stunnel TLS offloading and load-balancing proxy
- * Copyright (C) 1998-2023 Michal Trojnara <Michal.Trojnara@stunnel.org>
+ * Copyright (C) 1998-2024 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
@@ -140,18 +140,29 @@
 #endif
 
 int context_init(SERVICE_OPTIONS *section) { /* init TLS context */
+ s_log(LOG_DEBUG, "Initializing context %s", section->servname);
+
 /* create a new TLS context */
-#if OPENSSL_VERSION_NUMBER>=0x10100000L
 #if OPENSSL_VERSION_NUMBER>=0x30000000L
 section->ctx=SSL_CTX_new_ex(NULL,
 EVP_default_properties_is_fips_enabled(NULL) ?
 "fips=yes" : "provider!=fips",
 section->option.client ?
 TLS_client_method() : TLS_server_method());
-#else /* OPENSSL_VERSION_NUMBER<0x30000000L */
+#elif OPENSSL_VERSION_NUMBER>=0x10100000L
 section->ctx=SSL_CTX_new(section->option.client ?
 TLS_client_method() : TLS_server_method());
-#endif /* OPENSSL_VERSION_NUMBER>=0x30000000L */
+#else /* OPENSSL_VERSION_NUMBER<0x10100000L */
+ section->ctx=SSL_CTX_new(section->option.client ?
+ section->client_method : section->server_method);
+#endif
+ if(!section->ctx) {
+ sslerror("SSL_CTX_new");
+ return 1; /* FAILED */
+ }
+
+ /* set supported protocol versions */
+#if OPENSSL_VERSION_NUMBER>=0x10100000L
 if(section->min_proto_version &&
 !SSL_CTX_set_min_proto_version(section->ctx,
 section->min_proto_version)) {
@@ -166,16 +177,7 @@
 section->max_proto_version);
 return 1; /* FAILED */
 }
-#else /* OPENSSL_VERSION_NUMBER<0x10100000L */
- if(section->option.client)
- section->ctx=SSL_CTX_new(section->client_method);
- else /* server mode */
- section->ctx=SSL_CTX_new(section->server_method);
-#endif /* OPENSSL_VERSION_NUMBER<0x10100000L */
- if(!section->ctx) {
- sslerror("SSL_CTX_new");
- return 1; /* FAILED */
- }
+#endif /* OPENSSL_VERSION_NUMBER>=0x10100000L */
 
 /* allow callbacks to access their SERVICE_OPTIONS structure */
 if(!SSL_CTX_set_ex_data(section->ctx, index_ssl_ctx_opt, section)) {
@@ -325,6 +327,12 @@
 if(verify_init(section))
 return 1; /* FAILED */
 
+ /* OCSP stapling */
+#ifndef OPENSSL_NO_OCSP
+ if(ocsp_init(section))
+ return 1; /* FAILED */
+#endif /* OPENSSL_NO_OCSP */
+
 /* initialize the DH/ECDH key agreement */
 #ifndef OPENSSL_NO_TLSEXT
 if(!section->option.client)
@@ -341,6 +349,25 @@
 return 0; /* OK */
 }
 
+/**************************************** cleanup TLS context */
+
+/*
+ * free anything allocate from context_init() and callbacks
+ * also free any cached data allocated in client.c
+ */
+void context_cleanup(SERVICE_OPTIONS *section) {
+ s_log(LOG_DEBUG, "Cleaning up context %s", section->servname);
+
+#ifndef OPENSSL_NO_OCSP
+ ocsp_cleanup(section);
+#endif /* !defined(OPENSSL_NO_OCSP) */
+ str_free(section->chain);
+ if(section->session)
+ SSL_SESSION_free(section->session);
+ if(section->ctx)
+ SSL_CTX_free(section->ctx);
+}
+
 /**************************************** SNI callback */
 
 #ifndef OPENSSL_NO_TLSEXT
@@ -713,7 +740,13 @@
 c=SSL_get_ex_data(ssl, index_ssl_cli);
 found=psk_find(&c->opt->psk_sorted, identity);
 if(!found) {
- s_log(LOG_INFO, "PSK identity not found (session resumption?)");
+ const char *c=identity;
+ while(*c && isprint(*c))
+ c++;
+ if(*c)
+ s_log(LOG_INFO, "PSK identity not found (session resumption?)");
+ else
+ s_log(LOG_INFO, "PSK identity not found: %s", identity);
 return 0;
 }
 if(found->key_len>max_psk_len) {
@@ -722,7 +755,7 @@
 }
 memcpy(psk, found->key_val, found->key_len);
 s_log(LOG_NOTICE, "Key configured for PSK identity \"%s\"", identity);
- c->flag.psk=1;
+ c->flag.psk_found=1;
 return found->key_len;
 }
 
@@ -841,6 +874,21 @@
 sslerror("SSL_CTX_use_PrivateKey");
 return 1; /* FAILED */
 }
+#if OPENSSL_VERSION_NUMBER>=0x10002000L
+ if(!SSL_CTX_set0_chain(section->ctx, ca)) {
+ sslerror("SSL_CTX_set0_chain");
+ return 1; /* FAILED */
+ }
+#else /* OPENSSL_VERSION_NUMBER>=0x10002000L */
+ /* FIXME: implement for OpenSSL older than 1.0.2 */
+#if 0
+ /* struct cert_st is private, so the following code won't build */
+ if(section->ctx->cert->key->chain)
+ sk_X509_pop_free(section->ctx->cert->key->chain, X509_free);
+ section->ctx->cert->key->chain=ca;
+#endif
+ sk_X509_pop_free(ca, X509_free); /* just free the memory */
+#endif /* OPENSSL_VERSION_NUMBER>=0x10002000L */
 s_log(LOG_INFO, "Certificate and private key loaded from file: %s",
 section->cert);
 return 0; /* OK */
@@ -1359,7 +1407,7 @@
 old=c->opt->connect_sessionc->idx;
 c->opt->connect_sessionc->idx=sess;
 } else {
- s_log(LOG_ERR, "INTERNAL ERROR: Uninitialized client session cache");
+ s_log(LOG_ERR, "INTERNAL ERROR: Uninitialized client session cache (save)");
 old=NULL;
 }
 }

_service:tar_scm:stunnel-5.69.tar.gz/src/dhparam.c -> _service:tar_scm:stunnel-5.72.tar.gz/src/dhparam.c Changed

@@ -4,28 +4,28 @@
 #define DN_new DH_new
 DH *get_dh2048(void) {
     static unsigned char dhp_2048 = {
-        0x9f, 0x7e, 0x7a, 0xda, 0x97, 0xce, 0x22, 0xe2, 0x35, 0x68, 0xc9, 0xe9,
-        0xc8, 0xe7, 0x19, 0x11, 0x02, 0xbe, 0x30, 0x88, 0x48, 0x89, 0xf1, 0x7d,
-        0x0b, 0xcc, 0xc7, 0x38, 0x58, 0x16, 0xb3, 0xca, 0xd3, 0xd0, 0x45, 0xd4,
-        0x36, 0x50, 0x25, 0xb3, 0x7e, 0xf8, 0x24, 0x29, 0x7c, 0x4a, 0xbc, 0xee,
-        0xe5, 0x1d, 0x2f, 0xef, 0xf3, 0x07, 0xd1, 0x2a, 0x3f, 0xec, 0x31, 0x91,
-        0xb2, 0x80, 0xda, 0x96, 0x59, 0x7d, 0xe6, 0x7d, 0x4d, 0x38, 0x40, 0x4a,
-        0x00, 0x50, 0x64, 0x96, 0x47, 0x90, 0x4c, 0xc8, 0xe1, 0x3c, 0x1f, 0xda,
-        0xb4, 0x89, 0x56, 0x99, 0x1d, 0xff, 0x82, 0xc5, 0x1f, 0x41, 0xfd, 0x1f,
-        0xb3, 0xf1, 0x4f, 0xb0, 0x8c, 0xde, 0xda, 0xee, 0xba, 0x3b, 0x25, 0x32,
-        0x7a, 0x04, 0x26, 0x7a, 0x44, 0xf2, 0x46, 0xd9, 0xb7, 0x28, 0xa3, 0xdc,
-        0xe9, 0x50, 0x00, 0xe7, 0x92, 0x94, 0x5a, 0xe1, 0x4e, 0xc6, 0xc8, 0x82,
-        0x42, 0xe2, 0xf1, 0x21, 0x8f, 0xcf, 0xcc, 0x56, 0xff, 0xba, 0x8c, 0xc3,
-        0xc8, 0xd8, 0xfe, 0x09, 0x63, 0x2f, 0x33, 0x8f, 0x95, 0xf8, 0x5b, 0x44,
-        0xfb, 0xdd, 0x81, 0x67, 0x02, 0x9d, 0xe3, 0x47, 0xf4, 0x93, 0x3d, 0xe5,
-        0x34, 0x09, 0xa5, 0x77, 0x2e, 0x92, 0x0f, 0x97, 0x83, 0x71, 0xff, 0xa7,
-        0x51, 0x95, 0x4e, 0x4f, 0x28, 0xcf, 0x47, 0x45, 0xe0, 0xe8, 0x3d, 0x7a,
-        0x9c, 0xdf, 0x50, 0x2d, 0x91, 0x64, 0x8c, 0xba, 0x5e, 0x1a, 0x11, 0xa2,
-        0xd8, 0x26, 0x67, 0x78, 0x61, 0xa1, 0x44, 0x2a, 0xfb, 0xcb, 0xfa, 0x6f,
-        0x4f, 0x01, 0x80, 0x5e, 0x00, 0x45, 0x0d, 0x50, 0x1e, 0xaf, 0xd9, 0xf4,
-        0x9c, 0x92, 0x1d, 0x6e, 0x64, 0xd3, 0x4d, 0xbd, 0xd3, 0x15, 0xaf, 0x64,
-        0x3c, 0x00, 0xf1, 0x89, 0x8f, 0xa5, 0x13, 0xa7, 0x06, 0x92, 0x05, 0xdd,
-        0x10, 0x92, 0x61, 0xc7
+        0xeb, 0x81, 0x74, 0xe2, 0x58, 0x37, 0x8a, 0x6d, 0x69, 0x9a, 0xcf, 0x9c,
+        0xae, 0xd5, 0xc0, 0x80, 0xf9, 0x1b, 0xf8, 0x6e, 0xbf, 0x2f, 0x41, 0x0c,
+        0xba, 0x30, 0x29, 0x60, 0x8f, 0x2c, 0xa8, 0x6a, 0x09, 0xb3, 0xd3, 0x65,
+        0xba, 0x65, 0x78, 0xf8, 0x78, 0x30, 0x00, 0xa2, 0xc9, 0xff, 0x92, 0x37,
+        0xbb, 0x31, 0x3a, 0x18, 0xd3, 0x8d, 0xf7, 0x54, 0xc0, 0x96, 0xfb, 0xd7,
+        0x38, 0xb3, 0x5e, 0xe1, 0xdf, 0x2b, 0xca, 0xbf, 0xa5, 0xce, 0x5d, 0x64,
+        0xb4, 0xaa, 0xf0, 0x5a, 0x95, 0xdb, 0xc6, 0x27, 0x28, 0x72, 0xcc, 0x3e,
+        0xaf, 0x37, 0xb8, 0x43, 0x07, 0x5b, 0xf8, 0x11, 0x07, 0xb0, 0xd1, 0xb3,
+        0x83, 0x69, 0x89, 0x35, 0xa3, 0xb0, 0x04, 0xf4, 0x20, 0x55, 0x7f, 0xd4,
+        0xb3, 0xac, 0x5e, 0x91, 0x1d, 0x18, 0x44, 0x83, 0x0b, 0xef, 0x1a, 0xa5,
+        0x8c, 0xf9, 0x5a, 0xd3, 0x58, 0x09, 0x4b, 0x07, 0x18, 0x85, 0x6f, 0x32,
+        0xe8, 0xc9, 0x2c, 0xa9, 0x99, 0x91, 0xb4, 0x3b, 0x84, 0x2e, 0xb9, 0x27,
+        0xd7, 0xe9, 0x3f, 0xe2, 0xa6, 0xb4, 0xfc, 0x9b, 0x1b, 0x07, 0xa9, 0x2f,
+        0xc3, 0xc9, 0x4b, 0xc4, 0x77, 0x46, 0x55, 0x75, 0x45, 0x4e, 0xd1, 0x73,
+        0xb8, 0x9b, 0x15, 0xd4, 0xb6, 0x49, 0x98, 0x1a, 0x0d, 0xd8, 0x1f, 0x6a,
+        0xea, 0x3f, 0xe4, 0x63, 0x01, 0x85, 0x53, 0x40, 0xb1, 0xad, 0xe0, 0x1b,
+        0x29, 0x1f, 0x5f, 0xe4, 0x0b, 0x41, 0x7f, 0x9a, 0x5c, 0x8e, 0xa5, 0x6d,
+        0xc8, 0xc4, 0xd3, 0x58, 0x81, 0x06, 0x2d, 0x35, 0xac, 0x5e, 0xc4, 0xd9,
+        0x65, 0x4b, 0xe7, 0x6b, 0x9d, 0x89, 0x48, 0x6b, 0x04, 0x5f, 0x98, 0xca,
+        0xf2, 0x82, 0xc5, 0xdb, 0x38, 0xa3, 0x89, 0x46, 0x7f, 0x08, 0x41, 0x21,
+        0xd2, 0x48, 0x03, 0xea, 0x07, 0xb5, 0x1e, 0x9a, 0xf8, 0xca, 0x85, 0xa9,
+        0x90, 0xbd, 0x10, 0x7f
     };
     static unsigned char dhg_2048 = {
         0x02
@@ -47,4 +47,4 @@
     return dh;
 }
 #endif /* OPENSSL_NO_DH */
-/* built for stunnel 5.69 */
+/* built for stunnel 5.72 */

_service:tar_scm:stunnel-5.69.tar.gz/src/env.c -> _service:tar_scm:stunnel-5.72.tar.gz/src/env.c Changed

_service:tar_scm:stunnel-5.69.tar.gz/src/evc.mak -> _service:tar_scm:stunnel-5.72.tar.gz/src/evc.mak Changed

_service:tar_scm:stunnel-5.69.tar.gz/src/fd.c -> _service:tar_scm:stunnel-5.72.tar.gz/src/fd.c Changed

_service:tar_scm:stunnel-5.69.tar.gz/src/file.c -> _service:tar_scm:stunnel-5.72.tar.gz/src/file.c Changed

_service:tar_scm:stunnel-5.69.tar.gz/src/libwrap.c -> _service:tar_scm:stunnel-5.72.tar.gz/src/libwrap.c Changed

_service:tar_scm:stunnel-5.69.tar.gz/src/log.c -> _service:tar_scm:stunnel-5.72.tar.gz/src/log.c Changed

@@ -1,6 +1,6 @@
 /*
 * stunnel TLS offloading and load-balancing proxy
- * Copyright (C) 1998-2023 Michal Trojnara <Michal.Trojnara@stunnel.org>
+ * Copyright (C) 1998-2024 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
@@ -198,11 +198,7 @@
 len=vsnprintf(NULL, 0, format, ap);
 if(len>1024)
 len=1024;
-#ifdef USE_WIN32
- text=_alloca((size_t)len+1);
-#else
 text=alloca((size_t)len+1);
-#endif
 len=vsnprintf(text, (size_t)len+1, format, aq);
 va_end(aq);
 while(len>0 && textlen-1=='\n')
@@ -288,11 +284,7 @@
 switch(log_mode) {
 case LOG_MODE_CONFIGURED:
 size=strlen(stamp)+strlen(id)+strlen(text)+4;
-#ifdef USE_WIN32
- line=_alloca(size);
-#else
 line=alloca(size);
-#endif
 snprintf(line, size, "%s %s: %s", stamp, id, text);
 if(level<=opt->log_level) {
 #if !defined(USE_WIN32) && !defined(__vms)
@@ -310,11 +302,7 @@
 case LOG_MODE_ERROR:
 /* don't log the id or the time stamp */
 size=strlen(text)+5;
-#ifdef USE_WIN32
- line=_alloca(size);
-#else
 line=alloca(size);
-#endif
 if(level>=0 && level<=7) /* just in case */
 snprintf(line, size, "%c %s", "***!:. "level, text);
 else

_service:tar_scm:stunnel-5.69.tar.gz/src/mingw.mak -> _service:tar_scm:stunnel-5.72.tar.gz/src/mingw.mak Changed

_service:tar_scm:stunnel-5.69.tar.gz/src/mingw.mk -> _service:tar_scm:stunnel-5.72.tar.gz/src/mingw.mk Changed

_service:tar_scm:stunnel-5.69.tar.gz/src/network.c -> _service:tar_scm:stunnel-5.72.tar.gz/src/network.c Changed

@@ -1,6 +1,6 @@
 /*
 * stunnel TLS offloading and load-balancing proxy
- * Copyright (C) 1998-2023 Michal Trojnara <Michal.Trojnara@stunnel.org>
+ * Copyright (C) 1998-2024 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
@@ -597,7 +597,7 @@
 
 /**************************************** simulate blocking I/O */
 
-int s_connect(CLI *c, SOCKADDR_UNION *addr, socklen_t addrlen) {
+int s_connect(CLI *c, SOCKADDR_UNION *addr, socklen_t addrlen, int timeout) {
 int error;
 char *dst;
 
@@ -618,11 +618,11 @@
 }
 
 s_log(LOG_DEBUG, "s_connect: s_poll_wait %s: waiting %d seconds",
- dst, c->opt->timeout_connect);
+ dst, timeout);
 s_poll_init(c->fds, 0);
 s_poll_add(c->fds, c->fd, 1, 1);
 s_poll_dump(c->fds, LOG_DEBUG);
- switch(s_poll_wait(c->fds, c->opt->timeout_connect, 0)) {
+ switch(s_poll_wait(c->fds, timeout, 0)) {
 case -1:
 error=get_last_socket_error();
 s_log(LOG_ERR, "s_connect: s_poll_wait %s: %s (%d)",
@@ -679,22 +679,13 @@
 }
 
 num=writesocket(fd, (const void *)ptr, len);
- if(num==-1) { /* error */
- int error=get_last_socket_error();
- if(error==S_EINPROGRESS) {
- s_log(LOG_DEBUG, "s_write: EINPROGRESS: Retrying");
- continue; /* retry */
- }
- if(error==S_EWOULDBLOCK) {
- s_log(LOG_DEBUG, "s_write: EWOULDBLOCK: Retrying");
- continue; /* retry */
- }
- s_log(LOG_ERR, "s_write: writesocket: %s (%d)",
- s_strerror(error), error);
- throw_exception(c, 1);
+ if(num>=0) {
+ ptr+=(size_t)num;
+ len-=(size_t)num;
+ } else { /* error */
+ if(!socket_needs_retry(c, "s_write: writesocket"))
+ throw_exception(c, 1);
 }
- ptr+=(size_t)num;
- len-=(size_t)num;
 }
 }
 
@@ -724,26 +715,16 @@
 }
 
 num=readsocket(fd, (char *)ptr+total, len);
- if(num==-1) { /* error */
- int error=get_last_socket_error();
- if(error==S_EINPROGRESS) {
- s_log(LOG_DEBUG, "s_read_eof: EINPROGRESS: Retrying");
- continue; /* retry */
- }
- if(error==S_EWOULDBLOCK) {
- s_log(LOG_DEBUG, "s_ssl_eof: EWOULDBLOCK: Retrying");
- continue; /* retry */
- }
- s_log(LOG_ERR, "s_read_eof: readsocket: %s (%d)",
- s_strerror(error), error);
- throw_exception(c, 1);
- }
- if(num==0) { /* EOF */
+ if(num>0) {
+ total+=(size_t)num;
+ len-=(size_t)num;
+ } else if(num==0) { /* EOF */
 s_log(LOG_DEBUG, "s_read_eof: EOF");
- break;
+ break; /* EOF */
+ } else { /* error */
+ if(!socket_needs_retry(c, "s_read_eof: readsocket"))
+ break; /* EOF */
 }
- total+=(size_t)num;
- len-=(size_t)num;
 }
 return total;
 }
@@ -751,8 +732,10 @@
 void s_read(CLI *c, SOCKET fd, void *ptr, size_t len) {
 /* simulate a blocking read */
 /* throw an exception on EOF */
- if(s_read_eof(c, fd, ptr, len)!=len) {
- s_log(LOG_ERR, "s_read: Unexpected socket close");
+ size_t received=s_read_eof(c, fd, ptr, len);
+ if(received!=len) {
+ s_log(LOG_ERR, "s_read: Received %llu out of requested %llu byte(s)",
+ (unsigned long long)received, (unsigned long long)len);
 throw_exception(c, 1);
 }
 }
@@ -848,18 +831,11 @@
 sslerror("s_ssl_write: SSL_write");
 throw_exception(c, 1);
 } else if(err==SSL_ERROR_SYSCALL) {
- int error=get_last_socket_error();
- if(error==S_EINPROGRESS) {
- s_log(LOG_DEBUG, "s_ssl_write: EINPROGRESS: Retrying");
- continue; /* retry */
+ if(!socket_needs_retry(c, "s_ssl_write: SSL_write")) {
+ SSL_set_shutdown(c->ssl,
+ SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
+ break; /* EOF */
 }
- if(error==S_EWOULDBLOCK) {
- s_log(LOG_DEBUG, "s_ssl_write: EWOULDBLOCK: Retrying");
- continue; /* retry */
- }
- s_log(LOG_ERR, "s_ssl_write: SSL_write: %s (%d)",
- s_strerror(error), error);
- throw_exception(c, 1);
 } else {
 s_log(LOG_ERR, "s_ssl_write: Unhandled error %d", err);
 throw_exception(c, 1);
@@ -905,21 +881,26 @@
 } else if(err==SSL_ERROR_WANT_READ) {
 s_log(LOG_DEBUG, "s_ssl_read_eof: SSL_ERROR_WANT_READ: Retrying");
 } else if(err==SSL_ERROR_SSL) {
+#ifdef SSL_R_UNEXPECTED_EOF_WHILE_READING
+ /* OpenSSL 3.0 changed the method of reporting socket EOF */
+ if(ERR_GET_REASON(ERR_peek_error())==
+ SSL_R_UNEXPECTED_EOF_WHILE_READING) {
+ /* EOF -> buggy (e.g. Microsoft) peer:
+ * TLS socket closed without close_notify alert */
+ s_log(LOG_DEBUG, "s_ssl_read_eof: TLS socket closed");
+ SSL_set_shutdown(c->ssl,
+ SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
+ break; /* EOF */
+ }
+#endif /* SSL_R_UNEXPECTED_EOF_WHILE_READING */
 sslerror("s_ssl_read_eof: SSL_read");
 throw_exception(c, 1);
 } else if(err==SSL_ERROR_SYSCALL) {
- int error=get_last_socket_error();
- if(error==S_EINPROGRESS) {
- s_log(LOG_DEBUG, "s_ssl_read_eof: EINPROGRESS: Retrying");
- continue; /* retry */
- }
- if(error==S_EWOULDBLOCK) {
- s_log(LOG_DEBUG, "s_ssl_read_eof: EWOULDBLOCK: Retrying");
- continue; /* retry */
+ if(!socket_needs_retry(c, "s_ssl_read_eof: SSL_read")) {
+ SSL_set_shutdown(c->ssl,
+ SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
+ break; /* EOF */
 }
- s_log(LOG_ERR, "s_ssl_read_eof: SSL_read: %s (%d)",
- s_strerror(error), error);
- throw_exception(c, 1);
 } else {
 s_log(LOG_ERR, "s_ssl_read_oef: Unhandled error %d", err);
 throw_exception(c, 1);
@@ -931,8 +912,10 @@
 void s_ssl_read(CLI *c, void *ptr, int len) {
 /* simulate a blocking SSL_read */
 /* throw an exception on EOF */
- if(s_ssl_read_eof(c, ptr, len)!=(size_t)len) {
- s_log(LOG_ERR, "s_ssl_read: Unexpected socket close");
+ size_t received=s_ssl_read_eof(c, ptr, len);
+ if(received!=(size_t)len) {
+ s_log(LOG_ERR, "s_ssl_read: Received %llu out of requested %d byte(s)",
+ (unsigned long long)received, len);
 throw_exception(c, 1);
 }
 }
@@ -1108,4 +1091,46 @@
 return -1; /* failed */
 }
 
+ /* returns 0 on close and 1 on non-critical errors */
+int socket_needs_retry(CLI *c, const char *text) {
+ switch(get_last_socket_error()) {
+ /* http://tangentsoft.net/wskfaq/articles/bsd-compatibility.html */
+ case 0: /* close on read, or close on write on WIN32 */
+ /* fall through */
+#ifndef USE_WIN32
+ case EPIPE: /* close on write on Unix */
+ /* fall through */
+#endif
+ case S_ECONNABORTED:
+ s_log(LOG_INFO, "%s: Socket is closed", text);
+ return 0;
+ case S_EINTR:

_service:tar_scm:stunnel-5.72.tar.gz/src/ocsp.c Added

@@ -0,0 +1,913 @@
+/*
+ * stunnel TLS offloading and load-balancing proxy
+ * Copyright (C) 1998-2024 Michal Trojnara <Michal.Trojnara@stunnel.org>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ * See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses>.
+ *
+ * Linking stunnel statically or dynamically with other modules is making
+ * a combined work based on stunnel. Thus, the terms and conditions of
+ * the GNU General Public License cover the whole combination.
+ *
+ * In addition, as a special exception, the copyright holder of stunnel
+ * gives you permission to combine stunnel with free software programs or
+ * libraries that are released under the GNU LGPL and with code included
+ * in the standard release of OpenSSL under the OpenSSL License (or
+ * modified versions of such code, with unchanged license). You may copy
+ * and distribute such a system following the terms of the GNU GPL for
+ * stunnel and the licenses of the other code concerned.
+ *
+ * Note that people who make modified versions of stunnel are not obligated
+ * to grant this special exception for their modified versions; it is their
+ * choice whether to do so. The GNU General Public License gives permission
+ * to release a modified version without this exception; this exception
+ * also makes it possible to release a modified version which carries
+ * forward this exception.
+ */
+
+#include "prototypes.h"
+
+#ifndef OPENSSL_NO_OCSP
+
+#define INVALID_TIME ((time_t)-1)
+#ifdef DEFINE_STACK_OF
+/* defined in openssl/safestack.h:
+ * DEFINE_SPECIAL_STACK_OF(OPENSSL_STRING, char) */
+#else /* DEFINE_STACK_OF */
+#ifndef sk_OPENSSL_STRING_num
+#define sk_OPENSSL_STRING_num(st) sk_num(st)
+#endif /* sk_OPENSSL_STRING_num */
+#ifndef sk_OPENSSL_STRING_value
+#define sk_OPENSSL_STRING_value(st, i) sk_value((st),(i))
+#endif /* sk_OPENSSL_STRING_value */
+#endif /* DEFINE_STACK_OF */
+
+typedef struct {
+ /* OCSP request and validation parameters */
+ int depth;
+ int nonce;
+ int aia;
+ long leeway;
+ unsigned long flags;
+ char *url;
+ STACK_OF(X509) *chain_to_verify;
+ X509 *root_ca;
+ OCSP_CERTID *cert_id;
+
+ /* OCSP validation results */
+ int requested;
+ int callback_ctx_error;
+
+ /* OCSP single request and result */
+ OCSP_REQUEST *request;
+ OCSP_RESPONSE *response;
+ ASN1_GENERALIZEDTIME *revoked_at, *this_update, *next_update;
+} OCSP_PARAMS;
+
+/**************************************** OCSP stapling callbacks */
+
+NOEXPORT int ocsp_client_cb(SSL *, void *);
+#if OPENSSL_VERSION_NUMBER>=0x10002000L
+NOEXPORT int ocsp_server_cb(SSL *, void *);
+#endif /* OpenSSL version 1.0.2 or later */
+
+/**************************************** OCSP utility functions */
+
+NOEXPORT void ocsp_params_free(OCSP_PARAMS *);
+NOEXPORT void ocsp_params_cleanup(OCSP_PARAMS *);
+NOEXPORT int ocsp_verify(CLI *, OCSP_PARAMS *);
+NOEXPORT int check_aia(CLI *, OCSP_PARAMS *);
+NOEXPORT int ocsp_request(CLI *, OCSP_PARAMS *);
+NOEXPORT int ocsp_get_response(CLI *, OCSP_PARAMS *);
+NOEXPORT int ocsp_response_validate(CLI *, OCSP_PARAMS *);
+NOEXPORT void ocsp_params_setup_cert_id(OCSP_PARAMS *);
+NOEXPORT int ocsp_params_append_root_ca(CLI *, OCSP_PARAMS *);
+NOEXPORT void log_time(const int, const char *, ASN1_GENERALIZEDTIME *);
+#if OPENSSL_VERSION_NUMBER>=0x10101000L
+NOEXPORT time_t time_t_get_asn1_time(const ASN1_TIME *);
+#endif /* OpenSSL version 1.1.1 or later */
+
+/**************************************** OCSP initialization */
+
+int ocsp_init(SERVICE_OPTIONS *section) {
+ section->ocsp_response_lock=CRYPTO_THREAD_lock_new();
+ if(section->option.client) {
+ if(!SSL_CTX_set_tlsext_status_cb(section->ctx, ocsp_client_cb)) {
+ sslerror("OCSP: SSL_CTX_set_tlsext_status_cb");
+ return 1; /* FAILED */
+ }
+ s_log(LOG_DEBUG, "OCSP: Client OCSP stapling enabled");
+ } else {
+#if OPENSSL_VERSION_NUMBER>=0x10002000L
+#if !defined(OPENSSL_NO_PSK)
+ if(!section->psk_keys) {
+#endif /* !defined(OPENSSL_NO_PSK) */
+ if(SSL_CTX_set_tlsext_status_cb(section->ctx, ocsp_server_cb)==TLSEXT_STATUSTYPE_ocsp)
+ s_log(LOG_DEBUG, "OCSP: Server OCSP stapling enabled");
+#if !defined(OPENSSL_NO_PSK)
+ } else {
+ s_log(LOG_NOTICE, "OCSP: Server OCSP stapling is incompatible with PSK");
+ }
+#endif /* !defined(OPENSSL_NO_PSK) */
+#else /* OpenSSL version 1.0.2 or later */
+ s_log(LOG_NOTICE, "OCSP: Server OCSP stapling not supported");
+#endif /* OpenSSL version 1.0.2 or later */
+ }
+
+ return 0; /* OK */
+}
+
+/* free all of the OCSP_PARAMS values */
+NOEXPORT void ocsp_params_free(OCSP_PARAMS *params) {
+ ocsp_params_cleanup(params);
+ if(params->chain_to_verify) {
+ sk_X509_free(params->chain_to_verify);
+ params->chain_to_verify=NULL;
+ }
+ if(params->root_ca) {
+ X509_free(params->root_ca);
+ params->root_ca=NULL;
+ }
+ if(params->cert_id) {
+ OCSP_CERTID_free(params->cert_id);
+ params->cert_id=NULL;
+ }
+}
+
+/* free the OCSP_PARAMS values required to reuse it for a next request */
+NOEXPORT void ocsp_params_cleanup(OCSP_PARAMS *params) {
+ if(params->response) {
+ OCSP_RESPONSE_free(params->response);
+ params->response=NULL;
+ }
+ if(params->request) {
+ OCSP_REQUEST_free(params->request);
+ params->request=NULL;
+ }
+ params->revoked_at=NULL;
+ params->this_update=NULL;
+ params->next_update=NULL;
+}
+
+/**************************************** OCSP cleanup */
+
+void ocsp_cleanup(SERVICE_OPTIONS *section) {
+ if(section->ocsp_response_len) {
+ OPENSSL_free(section->ocsp_response_der);
+ section->ocsp_response_len=0;
+ }
+ if(section->ocsp_response_lock)
+ CRYPTO_THREAD_lock_free(section->ocsp_response_lock);
+}
+
+/**************************************** OCSP verify.c callback */
+
+int ocsp_check(CLI *c, X509_STORE_CTX *callback_ctx) {
+ OCSP_PARAMS params;
+ int ret=0; /* failed */
+
+ /* initial checks */
+ if(!c->opt->option.verify_chain) {
+ s_log(LOG_INFO, "OCSP: Certificate chain verification disabled");
+ return 1; /* accept */
+ }
+ if(c->opt->option.client &&
+ !X509_STORE_CTX_get_error_depth(callback_ctx) &&
+ !c->opt->stapling_cb_flag) {
+ /* for client peer certificate verification,
+ * tlsext_status_ocsp_resp is needed for oscp_verify_ssl() */
+ c->opt->verify_cb_flag=1;
+ /* ocsp_verify() will be invoked from ocsp_client_cb() */
+ s_log(LOG_DEBUG, "OCSP: Waiting for OCSP stapling response");
+ return 1; /* accept */
+ }
+
+ /* initialize the OCSP_PARAMS structure */
+ memset(&params, 0, sizeof(OCSP_PARAMS));
+ params.depth=X509_STORE_CTX_get_error_depth(callback_ctx);
+ params.nonce=c->opt->option.nonce;
+ params.aia=c->opt->option.aia;

_service:tar_scm:stunnel-5.69.tar.gz/src/options.c -> _service:tar_scm:stunnel-5.72.tar.gz/src/options.c Changed

@@ -1,6 +1,6 @@
 /*
 * stunnel TLS offloading and load-balancing proxy
- * Copyright (C) 1998-2023 Michal Trojnara <Michal.Trojnara@stunnel.org>
+ * Copyright (C) 1998-2024 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
@@ -39,8 +39,14 @@
 
 #if OPENSSL_VERSION_NUMBER >= 0x10101000L
 #define DEFAULT_CURVES "X25519:P-256:X448:P-521:P-384"
+#ifdef SSL_SYSTEM_DEFAULT_CIPHER_LIST /* Red Hat OpenSSL */
+#define DEFAULT_CURVES_FIPS "P-256:P-521:P-384"
+#else /* standard OpenSSL */
+#define DEFAULT_CURVES_FIPS DEFAULT_CURVES
+#endif /* Red Hat OpenSSL */
 #else /* OpenSSL version < 1.1.1 */
 #define DEFAULT_CURVES "prime256v1"
+#define DEFAULT_CURVES_FIPS DEFAULT_CURVES
 #endif /* OpenSSL version >= 1.1.1 */
 
 #if defined(_WIN32_WCE) && !defined(CONFDIR)
@@ -696,8 +702,9 @@
 #endif
 if(ref<0)
 fatal("Negative section reference counter");
- if(ref==0)
+ if(ref==0) {
 parse_service_option(CMD_FREE, &section, NULL, NULL);
+ }
 }
 
 /**************************************** global options */
@@ -1929,7 +1936,7 @@
 /* curves */
 switch(cmd) {
 case CMD_SET_DEFAULTS:
- section->curves=str_dup_detached(DEFAULT_CURVES);
+ section->curves = NULL;
 break;
 case CMD_SET_COPY:
 section->curves=str_dup_detached(new_service_options.curves);
@@ -1944,9 +1951,26 @@
 section->curves=str_dup_detached(arg);
 return NULL; /* OK */
 case CMD_INITIALIZE:
+ if(!section->curves) {
+ /* this is only executed for global options, because
+ * section->curves is no longer NULL in sections */
+#ifdef USE_FIPS
+ if(new_global_options.option.fips)
+ section->curves=str_dup_detached(DEFAULT_CURVES_FIPS);
+ else
+#endif /* USE_FIPS */
+ section->curves=str_dup_detached(DEFAULT_CURVES);
+ }
 break;
 case CMD_PRINT_DEFAULTS:
- s_log(LOG_NOTICE, "%-22s = %s", "curves", DEFAULT_CURVES);
+ if(fips_available()) {
+ s_log(LOG_NOTICE, "%-22s = %s %s", "curves",
+ DEFAULT_CURVES_FIPS, "(with \"fips = yes\")");
+ s_log(LOG_NOTICE, "%-22s = %s %s", "curves",
+ DEFAULT_CURVES, "(with \"fips = no\")");
+ } else {
+ s_log(LOG_NOTICE, "%-22s = %s", "curves", DEFAULT_CURVES);
+ }
 break;
 case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = ECDH curve names", "curves");
@@ -2387,6 +2411,9 @@
 section->ocsp_url=str_dup_detached(arg);
 return NULL; /* OK */
 case CMD_INITIALIZE:
+ if((section->ocsp_url || section->option.aia) &&
+ !section->option.verify_chain)
+ return "\"verifyChain\" has to be enabled for OCSP support";
 break;
 case CMD_PRINT_DEFAULTS:
 break;
@@ -2486,6 +2513,37 @@
 break;
 }
 
+ /* OCSPrequire */
+ switch(cmd) {
+ case CMD_SET_DEFAULTS:
+ section->option.ocsp_require=1; /* enabled by default */
+ break;
+ case CMD_SET_COPY:
+ section->option.ocsp_require=new_service_options.option.ocsp_require;
+ break;
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
+ if(strcasecmp(opt, "OCSPrequire"))
+ break;
+ if(!strcasecmp(arg, "yes"))
+ section->option.ocsp_require=1;
+ else if(!strcasecmp(arg, "no"))
+ section->option.ocsp_require=0;
+ else
+ return "The argument needs to be either 'yes' or 'no'";
+ return NULL; /* OK */
+ case CMD_INITIALIZE:
+ break;
+ case CMD_PRINT_DEFAULTS:
+ break;
+ case CMD_PRINT_HELP:
+ s_log(LOG_NOTICE,
+ "%-22s = yes|no require a conclusive OCSP response",
+ "OCSPrequire");
+ break;
+ }
+
 #endif /* !defined(OPENSSL_NO_OCSP) */
 
 /* options */
@@ -2552,11 +2610,11 @@
 section->protocol=str_dup_detached(arg);
 return NULL; /* OK */
 case CMD_INITIALIZE:
- /* PROTOCOL_CHECK also initializes:
+ /* protocol_init() also initializes:
 section->option.connect_before_ssl
 section->option.protocol_endpoint */
 {
- const char *tmp_str=protocol(NULL, section, PROTOCOL_CHECK);
+ const char *tmp_str=protocol_init(section);
 if(tmp_str)
 return tmp_str;
 }
@@ -2993,22 +3051,26 @@
 /* retry */
 switch(cmd) {
 case CMD_SET_DEFAULTS:
- section->option.retry=0;
+ section->retry=-1;
 break;
 case CMD_SET_COPY:
- section->option.retry=new_service_options.option.retry;
+ section->retry=new_service_options.retry;
 break;
 case CMD_FREE:
 break;
 case CMD_SET_VALUE:
 if(strcasecmp(opt, "retry"))
 break;
- if(!strcasecmp(arg, "yes"))
- section->option.retry=1;
- else if(!strcasecmp(arg, "no"))
- section->option.retry=0;
- else
- return "The argument needs to be either 'yes' or 'no'";
+ if(!strcasecmp(arg, "yes")) {
+ section->retry=1000; /* 1 second */
+ } else if(!strcasecmp(arg, "no")) {
+ section->retry=-1; /* disabled */
+ } else {
+ char *tmp_str;
+ section->retry=(long)strtol(arg, &tmp_str, 10);
+ if(tmp_str==arg || *tmp_str || section->retry < 0)
+ return "Illegal retry delay";
+ }
 return NULL; /* OK */
 case CMD_INITIALIZE:
 break;
@@ -3714,6 +3776,36 @@
 break;
 }
 
+ /* TIMEOUTocsp */
+ switch(cmd) {
+ case CMD_SET_DEFAULTS:
+ section->timeout_ocsp=5; /* 5 seconds */
+ break;
+ case CMD_SET_COPY:
+ section->timeout_ocsp=new_service_options.timeout_ocsp;
+ break;
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
+ if(strcasecmp(opt, "TIMEOUTocsp"))
+ break;
+ {
+ char *tmp_str;
+ section->timeout_ocsp=(int)strtol(arg, &tmp_str, 5);
+ if(tmp_str==arg || *tmp_str) /* not a number */
+ return "Illegal OCSP connect timeout";
+ }
+ return NULL; /* OK */
+ case CMD_INITIALIZE:
+ break;
+ case CMD_PRINT_DEFAULTS:
+ s_log(LOG_NOTICE, "%-22s = %d seconds", "TIMEOUTocsp", 5);
+ break;
+ case CMD_PRINT_HELP:
+ s_log(LOG_NOTICE, "%-22s = seconds to connect OCSP responder", "TIMEOUTocsp");
+ break;

_service:tar_scm:stunnel-5.69.tar.gz/src/os2.mak -> _service:tar_scm:stunnel-5.72.tar.gz/src/os2.mak Changed

@@ -1,11 +1,11 @@
 prefix=.
 DEFS = -DPACKAGE_NAME=\"stunnel\" \
 	-DPACKAGE_TARNAME=\"stunnel\" \
-	-DPACKAGE_VERSION=\"5.69\" \
-	-DPACKAGE_STRING=\"stunnel\ 5.69\" \
+	-DPACKAGE_VERSION=\"5.72\" \
+	-DPACKAGE_STRING=\"stunnel\ 5.72\" \
 	-DPACKAGE_BUGREPORT=\"\" \
 	-DPACKAGE=\"stunnel\" \
-	-DVERSION=\"5.69\" \
+	-DVERSION=\"5.72\" \
 	-DSTDC_HEADERS=1 \
 	-DHAVE_SYS_TYPES_H=1 \
 	-DHAVE_SYS_STAT_H=1 \
@@ -41,7 +41,7 @@
 #SYSLOGDIR = /unixos2/workdir/syslog
 INCLUDES = -I$(OPENSSLDIR)/outinc
 LIBS = -lsocket -L$(OPENSSLDIR)/out -lssl -lcrypto -lz -lsyslog
-OBJS = file.o client.o log.o options.o protocol.o network.o ssl.o ctx.o verify.o sthreads.o stunnel.o pty.o resolver.o str.o tls.o fd.o dhparam.o cron.o
+OBJS = file.o client.o log.o options.o protocol.o network.o ssl.o ctx.o verify.o ocsp.o sthreads.o stunnel.o pty.o resolver.o str.o tls.o fd.o dhparam.o cron.o
 LIBDIR = .
 CFLAGS = -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith
 
@@ -64,6 +64,7 @@
 ssl.o: ssl.c common.h prototypes.h
 ctx.o: ctx.c common.h prototypes.h
 verify.o: verify.c common.h prototypes.h
+ocsp.o: ocsp.c common.h prototypes.h
 sthreads.o: sthreads.c common.h prototypes.h
 stunnel.o: stunnel.c common.h prototypes.h
 resolver.o: resolver.c common.h prototypes.h

_service:tar_scm:stunnel-5.72.tar.gz/src/os2.mak.in Added

@@ -0,0 +1,78 @@
+prefix=.
+DEFS = -DPACKAGE_NAME=\"stunnel\" \
+	-DPACKAGE_TARNAME=\"stunnel\" \
+	-DPACKAGE_VERSION=\"@PACKAGE_VERSION@\" \
+	-DPACKAGE_STRING=\"stunnel\ @PACKAGE_VERSION@\" \
+	-DPACKAGE_BUGREPORT=\"\" \
+	-DPACKAGE=\"stunnel\" \
+	-DVERSION=\"@PACKAGE_VERSION@\" \
+	-DSTDC_HEADERS=1 \
+	-DHAVE_SYS_TYPES_H=1 \
+	-DHAVE_SYS_STAT_H=1 \
+	-DHAVE_STDLIB_H=1 \
+	-DHAVE_STRING_H=1 \
+	-DHAVE_MEMORY_H=1 \
+	-DHAVE_STRINGS_H=1 \
+	-DHAVE_UNISTD_H=1 \
+	-DSSLDIR=\"/usr\" \
+	-DHOST=\"i386-pc-os2-emx\" \
+	-DHAVE_LIBSOCKET=1 \
+	-DHAVE_GRP_H=1 \
+	-DHAVE_UNISTD_H=1 \
+	-DHAVE_SYS_SELECT_H=1 \
+	-DHAVE_SYS_IOCTL_H=1 \
+	-DHAVE_SYS_RESOURCE_H=1 \
+	-DHAVE_SNPRINTF=1 \
+	-DHAVE_VSNPRINTF=1 \
+	-DHAVE_WAITPID=1 \
+	-DHAVE_SYSCONF=1 \
+	-DHAVE_ENDHOSTENT=1 \
+ -DUSE_OS2=1 \
+	-DSIZEOF_UNSIGNED_CHAR=1 \
+	-DSIZEOF_UNSIGNED_SHORT=2 \
+	-DSIZEOF_UNSIGNED_INT=4 \
+	-DSIZEOF_UNSIGNED_LONG=4 \
+ 	-DLIBDIR=\"$(prefix)/lib\" \
+ -DCONFDIR=\"$(prefix)/etc\"
+
+CC = gcc
+.SUFFIXES = .c .o
+OPENSSLDIR = u:/extras
+#SYSLOGDIR = /unixos2/workdir/syslog
+INCLUDES = -I$(OPENSSLDIR)/outinc
+LIBS = -lsocket -L$(OPENSSLDIR)/out -lssl -lcrypto -lz -lsyslog
+OBJS = file.o client.o log.o options.o protocol.o network.o ssl.o ctx.o verify.o ocsp.o sthreads.o stunnel.o pty.o resolver.o str.o tls.o fd.o dhparam.o cron.o
+LIBDIR = .
+CFLAGS = -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith
+
+all: stunnel.exe
+
+stunnel.exe: $(OBJS)
+	$(CC) -Zmap $(CFLAGS) -o $@ $(OBJS) $(LIBS)
+
+.c.o:
+	$(CC) $(CFLAGS) $(DEFS) $(INCLUDES) -o $@ -c $<
+
+client.o: client.c common.h prototypes.h
+#env.o: env.c common.h prototypes.h
+#gui.o: gui.c common.h prototypes.h
+file.o: file.c common.h prototypes.h
+network.o: network.c common.h prototypes.h
+options.o: options.c common.h prototypes.h
+protocol.o: protocol.c common.h prototypes.h
+pty.o: pty.c common.h prototypes.h
+ssl.o: ssl.c common.h prototypes.h
+ctx.o: ctx.c common.h prototypes.h
+verify.o: verify.c common.h prototypes.h
+ocsp.o: ocsp.c common.h prototypes.h
+sthreads.o: sthreads.c common.h prototypes.h
+stunnel.o: stunnel.c common.h prototypes.h
+resolver.o: resolver.c common.h prototypes.h
+str.o: str.c common.h prototypes.h
+tls.o: tls.c common.h prototypes.h
+fd.o: fd.c common.h prototypes.h
+dhparam.o: dhparam.c common.h prototypes.h
+cron.o: cron.c common.h prototypes.h
+
+clean:
+	rm -f *.o *.exe

_service:tar_scm:stunnel-5.69.tar.gz/src/protocol.c -> _service:tar_scm:stunnel-5.72.tar.gz/src/protocol.c Changed

@@ -1,6 +1,6 @@
 /*
 * stunnel TLS offloading and load-balancing proxy
- * Copyright (C) 1998-2023 Michal Trojnara <Michal.Trojnara@stunnel.org>
+ * Copyright (C) 1998-2024 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
@@ -40,42 +40,63 @@
 #define CAPWIN_BUFFER_SIZE 100
 
 /* protocol-specific function prototypes */
-NOEXPORT char *socks_client(CLI *, SERVICE_OPTIONS *, const PHASE);
+NOEXPORT void socks_client_late(CLI *);
 NOEXPORT void socks5_client_method(CLI *);
 NOEXPORT void socks5_client_address(CLI *);
-NOEXPORT char *socks_server(CLI *, SERVICE_OPTIONS *, const PHASE);
+NOEXPORT const char *socks_server_init(SERVICE_OPTIONS *);
+NOEXPORT void socks_server_middle(CLI *);
+NOEXPORT void socks_server_late(CLI *);
 NOEXPORT void socks4_server(CLI *);
 NOEXPORT void socks5_server_method(CLI *);
 NOEXPORT void socks5_server(CLI *);
-NOEXPORT int validate(CLI *);
-NOEXPORT char *proxy_server(CLI *, SERVICE_OPTIONS *, const PHASE);
-NOEXPORT char *cifs_client(CLI *, SERVICE_OPTIONS *, const PHASE);
-NOEXPORT char *cifs_server(CLI *, SERVICE_OPTIONS *, const PHASE);
-NOEXPORT char *pgsql_client(CLI *, SERVICE_OPTIONS *, const PHASE);
-NOEXPORT char *pgsql_server(CLI *, SERVICE_OPTIONS *, const PHASE);
-NOEXPORT char *smtp_client(CLI *, SERVICE_OPTIONS *, const PHASE);
+NOEXPORT int validate_connect_addr(CLI *);
+
+NOEXPORT void proxy_server_late(CLI *);
+
+NOEXPORT void cifs_client_middle(CLI *);
+NOEXPORT void cifs_server_early(CLI *);
+
+NOEXPORT void pgsql_client_middle(CLI *);
+NOEXPORT void pgsql_server_early(CLI *);
+
+NOEXPORT void smtp_client_middle(CLI *);
+NOEXPORT void smtp_client_late(CLI *);
 NOEXPORT void smtp_client_negotiate(CLI *);
 NOEXPORT void smtp_client_plain(CLI *, const char *, const char *);
 NOEXPORT void smtp_client_login(CLI *, const char *, const char *);
-NOEXPORT char *smtp_server(CLI *, SERVICE_OPTIONS *, const PHASE);
-NOEXPORT char *pop3_client(CLI *, SERVICE_OPTIONS *, const PHASE);
-NOEXPORT char *pop3_server(CLI *, SERVICE_OPTIONS *, const PHASE);
-NOEXPORT char *imap_client(CLI *, SERVICE_OPTIONS *, const PHASE);
-NOEXPORT char *imap_server(CLI *, SERVICE_OPTIONS *, const PHASE);
-NOEXPORT char *nntp_client(CLI *, SERVICE_OPTIONS *, const PHASE);
-NOEXPORT char *ldap_client(CLI *, SERVICE_OPTIONS *, const PHASE);
-NOEXPORT char *connect_server(CLI *, SERVICE_OPTIONS *, const PHASE);
-NOEXPORT char *connect_client(CLI *, SERVICE_OPTIONS *, const PHASE);
+NOEXPORT const char *smtp_server_init(SERVICE_OPTIONS *);
+NOEXPORT void smtp_server_middle(CLI *);
+
+NOEXPORT void pop3_client_middle(CLI *);
+NOEXPORT const char *pop3_server_init(SERVICE_OPTIONS *);
+NOEXPORT void pop3_server_middle(CLI *);
+
+NOEXPORT void imap_client_middle(CLI *);
+NOEXPORT const char *imap_server_init(SERVICE_OPTIONS *);
+NOEXPORT void imap_server_middle(CLI *);
+
+NOEXPORT void nntp_client_middle(CLI *);
+
+NOEXPORT void ldap_client_middle(CLI *);
+
+NOEXPORT void connect_server_early(CLI *);
+NOEXPORT void connect_client_middle(CLI *);
 #ifndef OPENSSL_NO_MD4
-NOEXPORT void ntlm(CLI *, SERVICE_OPTIONS *);
+NOEXPORT void ntlm(CLI *);
 NOEXPORT char *ntlm1(void);
 NOEXPORT char *ntlm3(char *, char *, char *, char *);
-NOEXPORT void crypt_DES(DES_cblock, DES_cblock, unsigned char7);
+NOEXPORT void crypt_DES(DES_cblock, const_DES_cblock, unsigned char7);
 #endif
 NOEXPORT char *base64(int, const char *, int);
-NOEXPORT char *capwin_server(CLI *, SERVICE_OPTIONS *, const PHASE);
-NOEXPORT char *capwin_client(CLI *, SERVICE_OPTIONS *, const PHASE);
-NOEXPORT char *capwinctrl_client(CLI *, SERVICE_OPTIONS *, const PHASE);
+
+NOEXPORT void capwin_server_middle(CLI *);
+NOEXPORT void capwin_server_late(CLI *);
+NOEXPORT void capwin_client_late(CLI *);
+NOEXPORT const char *capwinctrl_client_init(SERVICE_OPTIONS *);
+NOEXPORT void capwinctrl_client_early(CLI *);
+NOEXPORT int capwin_decode(const char *, char **, char **, char **, char **);
+NOEXPORT int ldap_auth(CLI *, const char *, const char *);
+NOEXPORT char *ldap_escape_dn(const char *);
 
 /* global state */
 NOEXPORT char capwin_authCAPWIN_BUFFER_SIZE={0};
@@ -84,61 +105,87 @@
 LONG capwin_connectivity=0;
 #endif
 
-/**************************************** framework */
-
-const char *protocol(CLI *c, SERVICE_OPTIONS *opt, const PHASE phase) {
- if(phase==PROTOCOL_CHECK) /* default to be overridden by protocols */
- opt->option.connect_before_ssl=opt->option.client;
- if(!opt->protocol) /* no protocol specified */
- return NULL; /* skip further actions */
- if(!strcasecmp(opt->protocol, "socks"))
- return opt->option.client ?
- socks_client(c, opt, phase) :
- socks_server(c, opt, phase);
- if(!strcasecmp(opt->protocol, "proxy"))
- return opt->option.client ?
- "The 'proxy' protocol is not supported in the client mode" :
- proxy_server(c, opt, phase);
- if(!strcasecmp(opt->protocol, "cifs"))
- return opt->option.client ?
- cifs_client(c, opt, phase) :
- cifs_server(c, opt, phase);
- if(!strcasecmp(opt->protocol, "pgsql"))
- return opt->option.client ?
- pgsql_client(c, opt, phase) :
- pgsql_server(c, opt, phase);
- if(!strcasecmp(opt->protocol, "smtp"))
- return opt->option.client ?
- smtp_client(c, opt, phase) :
- smtp_server(c, opt, phase);
- if(!strcasecmp(opt->protocol, "pop3"))
- return opt->option.client ?
- pop3_client(c, opt, phase) :
- pop3_server(c, opt, phase);
- if(!strcasecmp(opt->protocol, "imap"))
- return opt->option.client ?
- imap_client(c, opt, phase) :
- imap_server(c, opt, phase);
- if(!strcasecmp(opt->protocol, "nntp"))
- return opt->option.client ?
- nntp_client(c, opt, phase) :
- "The 'nntp' protocol is not supported in the server mode";
- if(!strcasecmp(opt->protocol, "ldap"))
- return opt->option.client ?
- ldap_client(c, opt, phase) :
- "The 'ldap' protocol is not supported in the server mode";
- if(!strcasecmp(opt->protocol, "connect"))
- return opt->option.client ?
- connect_client(c, opt, phase) :
- connect_server(c, opt, phase);
- if(!strcasecmp(opt->protocol, "capwin"))
- return opt->option.client ?
- capwin_client(c, opt, phase) :
- capwin_server(c, opt, phase);
- if(!strcasecmp(opt->protocol, "capwinctrl"))
- return opt->option.client ?
- capwinctrl_client(c, opt, phase) :
- "The 'capwinctrl' protocol is not supported in the server mode";
+/**************************************** public interface */
+
+const char *protocol_init(SERVICE_OPTIONS *opt) {
+ typedef struct {
+ const char *(*init)(SERVICE_OPTIONS *);
+ void (*early)(CLI *);
+ void (*middle)(CLI *);
+ void (*late)(CLI *);
+ } MODE;
+ typedef struct {
+ const char *name;
+ MODE client, server;
+ } PROTOCOLS;
+ const PROTOCOLS protocols = {
+ {.name="socks",
+ .client={.late=socks_client_late},
+ .server={.init=socks_server_init, .middle=socks_server_middle, .late=socks_server_late}},
+ {.name="proxy",
+ .server={.late=proxy_server_late}},
+ {.name="cifs",
+ .client={.middle=cifs_client_middle},
+ .server={.early=cifs_server_early}},
+ {.name="pgsql",
+ .client={.middle=pgsql_client_middle},
+ .server={.early=pgsql_server_early}},
+ {.name="smtp",
+ .client={.middle=smtp_client_middle, .late=smtp_client_late},
+ .server={.init=smtp_server_init, .middle=smtp_server_middle}},
+ {.name="pop3",
+ .client={.middle=pop3_client_middle},
+ .server={.init=pop3_server_init, .middle=pop3_server_middle}},
+ {.name="imap",
+ .client={.middle=imap_client_middle},
+ .server={.init=imap_server_init, .middle=imap_server_middle}},
+ {.name="nntp",
+ .client={.middle=nntp_client_middle}},
+ {.name="ldap",
+ .client={.middle=ldap_client_middle}},
+ {.name="connect",
+ .client={.middle=connect_client_middle},
+ .server={.early=connect_server_early}},
+ {.name="capwin",
+ .client={.late=capwin_client_late},
+ .server={.middle=capwin_server_middle, .late=capwin_server_late}},
+ {.name="capwinctrl",
+ .client={.init=capwinctrl_client_init, .early=capwinctrl_client_early}},

_service:tar_scm:stunnel-5.69.tar.gz/src/prototypes.h -> _service:tar_scm:stunnel-5.72.tar.gz/src/prototypes.h Changed

@@ -1,6 +1,6 @@
 /*
 * stunnel TLS offloading and load-balancing proxy
- * Copyright (C) 1998-2023 Michal Trojnara <Michal.Trojnara@stunnel.org>
+ * Copyright (C) 1998-2024 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
@@ -56,6 +56,12 @@
 
 typedef struct tls_data_struct TLS_DATA;
 typedef struct sock_opt_struct SOCK_OPT;
+typedef struct client_data_struct CLI;
+typedef struct global_options_struct GLOBAL_OPTIONS;
+typedef struct service_options_struct SERVICE_OPTIONS;
+#ifndef OPENSSL_NO_TLSEXT
+typedef struct servername_list_struct SERVERNAME_LIST;
+#endif /* !defined(OPENSSL_NO_TLSEXT) */
 
 /**************************************** data structures */
 
@@ -66,6 +72,55 @@
 typedef HANDLE THREAD_ID;
 #endif
 
+#if OPENSSL_VERSION_NUMBER<0x10100004L
+
+#ifdef USE_OS_THREADS
+
+struct CRYPTO_dynlock_value {
+#ifdef USE_PTHREAD
+ pthread_rwlock_t rwlock;
+#endif
+#ifdef USE_WIN32
+ CRITICAL_SECTION critical_section;
+#endif
+#ifdef DEBUG_LOCKS
+ const char *init_file, *read_lock_file, *write_lock_file,
+ *unlock_file, *destroy_file;
+ int init_line, read_lock_line, write_lock_line, unlock_line, destroy_line;
+#endif
+};
+
+typedef struct CRYPTO_dynlock_value CRYPTO_RWLOCK;
+
+#else /* USE_OS_THREADS */
+
+typedef void CRYPTO_RWLOCK;
+
+#endif /* USE_OS_THREADS */
+
+#endif /* OPENSSL_VERSION_NUMBER<0x10100004L */
+
+typedef enum {
+ LOCK_THREAD_LIST, /* sthreads.c */
+ LOCK_SESSION, LOCK_ADDR,
+ LOCK_CLIENTS, LOCK_SSL, /* client.c */
+ LOCK_REF, /* options.c */
+ LOCK_INET, /* resolver.c */
+#ifndef USE_WIN32
+ LOCK_LIBWRAP, /* libwrap.c */
+#endif
+ LOCK_LOG_BUFFER, LOCK_LOG_MODE, /* log.c */
+ LOCK_LEAK_HASH, LOCK_LEAK_RESULTS, /* str.c */
+#ifndef OPENSSL_NO_DH
+ LOCK_DH, /* ctx.c */
+#endif /* OPENSSL_NO_DH */
+#ifdef USE_WIN32
+ LOCK_WIN_LOG, /* ui_win_gui.c */
+#endif
+ LOCK_SECTIONS, /* traversing section list */
+ STUNNEL_LOCKS /* number of locks */
+} LOCK_TYPE;
+
 #if defined (USE_WIN32)
 #define ICON_IMAGE HICON
 #elif defined(__APPLE__)
@@ -124,6 +179,7 @@
 NAME_LIST *names; /* a list of unresolved names */
 } SOCKADDR_LIST;
 
+extern GLOBAL_OPTIONS global_options;
 #ifndef OPENSSL_NO_COMP
 typedef enum {
 COMP_NONE, /* empty compression algorithms set */
@@ -133,7 +189,7 @@
 } COMP_TYPE;
 #endif /* !defined(OPENSSL_NO_COMP) */
 
-typedef struct {
+struct global_options_struct {
 /* some data for TLS initialization in ssl.c */
 #ifndef OPENSSL_NO_COMP
 COMP_TYPE compression; /* compression type */
@@ -176,13 +232,7 @@
 unsigned fips:1; /* enable FIPS 140-2 mode */
 #endif
 } option;
-} GLOBAL_OPTIONS;
-
-extern GLOBAL_OPTIONS global_options;
-
-#ifndef OPENSSL_NO_TLSEXT
-typedef struct servername_list_struct SERVERNAME_LIST;/* forward declaration */
-#endif /* !defined(OPENSSL_NO_TLSEXT) */
+};
 
 #ifndef OPENSSL_NO_PSK
 typedef struct psk_keys_struct {
@@ -204,7 +254,7 @@
 } TICKET_KEY;
 #endif /* OpenSSL 1.0.0 or later */
 
-typedef struct service_options_struct {
+struct service_options_struct {
 struct service_options_struct *next; /* next node in the services list */
 SSL_CTX *ctx; /* TLS context */
 char *servname; /* service name for logging & permission checking */
@@ -240,6 +290,11 @@
 #ifndef OPENSSL_NO_OCSP
 char *ocsp_url;
 unsigned long ocsp_flags;
+ CRYPTO_RWLOCK *ocsp_response_lock; /* protect the OCSP response cache */
+ unsigned char *ocsp_response_der; /* OCSP response data */
+ int ocsp_response_len; /* OCSP response length */
+ unsigned stapling_cb_flag:1; /* OCSP stapling callback executed */
+ unsigned verify_cb_flag:1; /* verify callback executed at depth 0 */
 #endif /* !defined(OPENSSL_NO_OCSP) */
 #if OPENSSL_VERSION_NUMBER>=0x10002000L
 NAME_LIST *check_host, *check_email, *check_ip; /* cert subject checks */
@@ -301,14 +356,19 @@
 SSL_SESSION *session; /* previous client session for delayed resolver */
 int timeout_busy; /* maximum waiting for data time */
 int timeout_close; /* maximum close_notify time */
- int timeout_connect; /* maximum connect() time */
+ int timeout_connect; /* maximum s_connect() time */
 int timeout_idle; /* maximum idle connection time */
+ int timeout_ocsp; /* maximum s_connect() time for OCSP */
 enum {FAILOVER_RR, FAILOVER_PRIO} failover; /* failover strategy */
 unsigned rr; /* per-service sequential number for round-robin failover */
- char *username;
+ char *username; /* ident client username */
+ long retry; /* retry delay for remote+program loop or -1 if disabled */
 
 /* service-specific data for protocol.c */
 char *protocol;
+ void (*protocol_early)(CLI *);
+ void (*protocol_middle)(CLI *);
+ void (*protocol_late)(CLI *);
 NAME_LIST *protocol_header;
 char *protocol_host;
 char *protocol_domain;
@@ -336,7 +396,6 @@
 unsigned libwrap:1;
 #endif
 unsigned local:1; /* outgoing interface specified */
- unsigned retry:1; /* loop remote+program */
 unsigned session_resume:1; /* enable session resumption */
 unsigned sessiond:1;
 #ifndef USE_WIN32
@@ -351,6 +410,7 @@
 #ifndef OPENSSL_NO_OCSP
 unsigned aia:1; /* Authority Information Access */
 unsigned nonce:1; /* send and verify OCSP nonce */
+ unsigned ocsp_require:1; /* require a conclusive OCSP response */
 #endif /* !defined(OPENSSL_NO_OCSP) */
 #ifndef OPENSSL_NO_DH
 unsigned dh_temp_params:1;
@@ -359,7 +419,7 @@
 unsigned log_stderr:1; /* a copy of the global switch */
 #endif /* USE_WIN32 */
 } option;
-} SERVICE_OPTIONS;
+};
 
 extern SERVICE_OPTIONS service_options;
 
@@ -430,7 +490,7 @@
 RENEG_DETECTED /* renegotiation detected */
 } RENEG_STATE;
 
-typedef struct client_data_struct {
+struct client_data_struct {
 jmp_buf *exception_pointer;
 
 SSL *ssl; /* TLS connection */
@@ -467,10 +527,12 @@
 FD *ssl_rfd, *ssl_wfd; /* read and write TLS descriptors */
 uint64_t sock_bytes, ssl_bytes; /* bytes written to socket and TLS */
 s_poll_set *fds; /* file descriptors */
+#ifndef OPENSSL_NO_PSK
 struct {
- unsigned psk:1; /* PSK identity was found */
+ unsigned psk_found:1; /* PSK identity was found */
 } flag;
-} CLI;
+#endif /* !defined(OPENSSL_NO_PSK) */
+};
 
 /**************************************** prototypes for stunnel.c */

_service:tar_scm:stunnel-5.69.tar.gz/src/pty.c -> _service:tar_scm:stunnel-5.72.tar.gz/src/pty.c Changed

_service:tar_scm:stunnel-5.69.tar.gz/src/resolver.c -> _service:tar_scm:stunnel-5.72.tar.gz/src/resolver.c Changed

_service:tar_scm:stunnel-5.69.tar.gz/src/resources.rc -> _service:tar_scm:stunnel-5.72.tar.gz/src/resources.rc Changed

@@ -19,7 +19,7 @@
             VALUE "FileDescription",    "stunnel - TLS offloading and load-balancing proxy"
             VALUE "FileVersion",        STUNNEL_VERSION
             VALUE "InternalName",       "stunnel"
-            VALUE "LegalCopyright",     "© by Michal Trojnara, 1998-2023"
+            VALUE "LegalCopyright",     "© by Michal Trojnara, 1998-2024"
             VALUE "OriginalFilename",   "stunnel.exe"
             VALUE "ProductName",        STUNNEL_PRODUCTNAME
             VALUE "ProductVersion",     STUNNEL_VERSION
@@ -107,7 +107,7 @@
     ICON            IDI_STUNNEL_MAIN, -1,                        6,  6,  20, 20
     LTEXT           "stunnel version", -1,                      30,  4,  49,  8
     LTEXT           STUNNEL_VERSION, -1,                        79,  4,  57,  8
-    LTEXT           "© by Michal Trojnara, 1998-2023", -1,      30, 12, 106,  8
+    LTEXT           "© by Michal Trojnara, 1998-2024", -1,      30, 12, 106,  8
     LTEXT           "All Rights Reserved", -1,                  30, 20, 106,  8
     LTEXT           "Licensed under the GNU GPL version 2", -1,  4, 28, 132,  8
     LTEXT           "with a special exception for OpenSSL", -1,  4, 36, 132,  8

_service:tar_scm:stunnel-5.69.tar.gz/src/ssl.c -> _service:tar_scm:stunnel-5.72.tar.gz/src/ssl.c Changed

@@ -1,6 +1,6 @@
 /*
 * stunnel TLS offloading and load-balancing proxy
- * Copyright (C) 1998-2023 Michal Trojnara <Michal.Trojnara@stunnel.org>
+ * Copyright (C) 1998-2024 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
@@ -38,8 +38,13 @@
 #include "prototypes.h"
 
 /* global OpenSSL initialization: compression, engine, entropy */
+#if OPENSSL_VERSION_NUMBER>=0x10100000L
 NOEXPORT void cb_new_auth(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
 int idx, long argl, void *argp);
+#else /* OPENSSL_VERSION_NUMBER>=0x10100000L */
+NOEXPORT int cb_new_auth(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
+ int idx, long argl, void *argp);
+#endif /* OPENSSL_VERSION_NUMBER>=0x10100000L */
 #if OPENSSL_VERSION_NUMBER>=0x30000000L
 NOEXPORT int cb_dup_addr(CRYPTO_EX_DATA *to, const CRYPTO_EX_DATA *from,
 void **from_d, int idx, long argl, void *argp);
@@ -232,8 +237,13 @@
 #endif
 #endif
 
+#if OPENSSL_VERSION_NUMBER>=0x10100000L
 NOEXPORT void cb_new_auth(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
 int idx, long argl, void *argp) {
+#else /* OPENSSL_VERSION_NUMBER>=0x10100000L */
+NOEXPORT int cb_new_auth(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
+ int idx, long argl, void *argp) {
+#endif /* OPENSSL_VERSION_NUMBER>=0x10100000L */
 (void)parent; /* squash the unused parameter warning */
 (void)ptr; /* squash the unused parameter warning */
 (void)argl; /* squash the unused parameter warning */
@@ -241,6 +251,9 @@
 (char *)argp);
 if(!CRYPTO_set_ex_data(ad, idx, (void *)(-1)))
 sslerror("CRYPTO_set_ex_data");
+#if OPENSSL_VERSION_NUMBER<0x10100000L
+ return 1; /* success */
+#endif /* OPENSSL_VERSION_NUMBER<0x10100000L */
 }
 
 #if OPENSSL_VERSION_NUMBER>=0x30000000L

_service:tar_scm:stunnel-5.69.tar.gz/src/sthreads.c -> _service:tar_scm:stunnel-5.72.tar.gz/src/sthreads.c Changed

_service:tar_scm:stunnel-5.69.tar.gz/src/str.c -> _service:tar_scm:stunnel-5.72.tar.gz/src/str.c Changed

@@ -1,6 +1,6 @@
 /*
 * stunnel TLS offloading and load-balancing proxy
- * Copyright (C) 1998-2023 Michal Trojnara <Michal.Trojnara@stunnel.org>
+ * Copyright (C) 1998-2024 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
@@ -107,7 +107,9 @@
 NOEXPORT void str_leak_debug(const ALLOC_LIST *, int);
 
 NOEXPORT LEAK_ENTRY *leak_search(const ALLOC_LIST *);
+#if OPENSSL_VERSION_NUMBER >= 0x10101000L
 NOEXPORT int leak_cmp(const LEAK_ENTRY *const *, const LEAK_ENTRY *const *);
+#endif /* OpenSSL version >= 1.1.1 */
 NOEXPORT void leak_report(void);
 NOEXPORT long leak_threshold(void);
 
@@ -163,6 +165,7 @@
 for(;;) {
 va_copy(ap, start_ap);
 n=vsnprintf(p, size, format, ap);
+ va_end(ap);
 if(n>-1 && n<(int)size)
 return p;
 if(n>-1) /* glibc 2.1 */
@@ -589,6 +592,7 @@
 #endif /* OpenSSL version >= 1.1.1 */
 }
 
+#if OPENSSL_VERSION_NUMBER >= 0x10101000L
 NOEXPORT int leak_cmp(const LEAK_ENTRY *const *a, const LEAK_ENTRY *const *b) {
 int64_t d = (*a)->total - (*b)->total;
 if(d>0)
@@ -597,6 +601,7 @@
 return -1;
 return 0;
 }
+#endif /* OpenSSL version >= 1.1.1 */
 
 /* report identified leaks */
 NOEXPORT void leak_report() {

_service:tar_scm:stunnel-5.69.tar.gz/src/stunnel.c -> _service:tar_scm:stunnel-5.72.tar.gz/src/stunnel.c Changed

_service:tar_scm:stunnel-5.69.tar.gz/src/tls.c -> _service:tar_scm:stunnel-5.72.tar.gz/src/tls.c Changed

_service:tar_scm:stunnel-5.69.tar.gz/src/ui_unix.c -> _service:tar_scm:stunnel-5.72.tar.gz/src/ui_unix.c Changed

_service:tar_scm:stunnel-5.69.tar.gz/src/ui_win_cli.c -> _service:tar_scm:stunnel-5.72.tar.gz/src/ui_win_cli.c Changed

_service:tar_scm:stunnel-5.69.tar.gz/src/ui_win_gui.c -> _service:tar_scm:stunnel-5.72.tar.gz/src/ui_win_gui.c Changed

_service:tar_scm:stunnel-5.69.tar.gz/src/vc.mak -> _service:tar_scm:stunnel-5.72.tar.gz/src/vc.mak Changed

_service:tar_scm:stunnel-5.69.tar.gz/src/verify.c -> _service:tar_scm:stunnel-5.72.tar.gz/src/verify.c Changed

@@ -1,6 +1,6 @@
 /*
 * stunnel TLS offloading and load-balancing proxy
- * Copyright (C) 1998-2023 Michal Trojnara <Michal.Trojnara@stunnel.org>
+ * Copyright (C) 1998-2024 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
@@ -55,26 +55,19 @@
 #endif /* OPENSSL_VERSION_NUMBER>=0x10002000L */
 NOEXPORT int cert_check_local(X509_STORE_CTX *);
 NOEXPORT int compare_pubkeys(X509 *, X509 *);
-#ifndef OPENSSL_NO_OCSP
-NOEXPORT int ocsp_check(CLI *, X509_STORE_CTX *);
-NOEXPORT int ocsp_request(CLI *, X509_STORE_CTX *, OCSP_CERTID *, char *);
-NOEXPORT OCSP_RESPONSE *ocsp_get_response(CLI *, OCSP_REQUEST *, char *);
-#endif
-
-/* utility functions */
-#ifndef OPENSSL_NO_OCSP
-NOEXPORT X509 *get_current_issuer(X509_STORE_CTX *);
-NOEXPORT void log_time(const int, const char *, ASN1_TIME *);
-#endif
 
 /**************************************** verify initialization */
 
 int verify_init(SERVICE_OPTIONS *section) {
 int verify_mode=0;
 
- if(init_ca(section))
- if(section->option.verify_chain || section->option.verify_peer)
+ if(init_ca(section)) {
+ if(section->option.verify_chain || section->option.verify_peer) {
+ s_log(LOG_ERR, "No trusted certificates found");
 return 1; /* FAILED */
+ }
+ s_log(LOG_INFO, "No trusted certificates found");
+ }
 if(init_crl(section))
 return 1; /* FAILED */
 
@@ -97,6 +90,14 @@
 NAME_LIST *ptr;
 #endif
 
+ /* CA initialization with the file and/or directory */
+ if(section->ca_file || section->ca_dir) {
+ if(!SSL_CTX_load_verify_locations(section->ctx,
+ section->ca_file, section->ca_dir)) {
+ sslerror("SSL_CTX_load_verify_locations");
+ }
+ }
+
 ca_dn=sk_X509_NAME_new_null();
 
 #ifndef OPENSSL_NO_ENGINE
@@ -121,7 +122,6 @@
 SSL_add_dir_cert_subjects_to_stack(ca_dn, section->ca_dir);
 
 if(!sk_X509_NAME_num(ca_dn)) {
- s_log(LOG_ERR, "No trusted certificates found");
 sk_X509_NAME_pop_free(ca_dn, X509_NAME_free);
 return 1; /* FAILED */
 }
@@ -134,14 +134,6 @@
 SSL_CTX_set_client_CA_list(section->ctx, ca_dn);
 }
 
- /* CA initialization with the file and/or directory */
- if(section->ca_file || section->ca_dir) {
- if(!SSL_CTX_load_verify_locations(section->ctx,
- section->ca_file, section->ca_dir)) {
- sslerror("SSL_CTX_load_verify_locations");
- }
- }
-
 return 0; /* OK */
 }
 
@@ -248,7 +240,7 @@
 c=SSL_get_ex_data(ssl, index_ssl_cli);
 
 if(!c->opt->option.verify_chain && !c->opt->option.verify_peer) {
- s_log(LOG_INFO, "Certificate verification disabled");
+ s_log(LOG_INFO, "CERT: Certificate verification disabled");
 return 1; /* accept */
 }
 if(verify_checks(c, preverify_ok, callback_ctx))
@@ -289,8 +281,7 @@
 return 0; /* reject */
 }
 #ifndef OPENSSL_NO_OCSP
- if((c->opt->ocsp_url || c->opt->option.aia) &&
- !ocsp_check(c, callback_ctx)) {
+ if(!ocsp_check(c, callback_ctx)) {
 s_log(LOG_WARNING, "Rejected by OCSP at depth=%d: %s", depth, subject);
 str_free(subject);
 return 0; /* reject */
@@ -449,331 +440,6 @@
 return 1; /* accept */
 }
 
-/**************************************** OCSP checking */
-
-#ifndef OPENSSL_NO_OCSP
-
-#ifdef DEFINE_STACK_OF
-/* defined in openssl/safestack.h:
- * DEFINE_SPECIAL_STACK_OF(OPENSSL_STRING, char) */
-#else /* DEFINE_STACK_OF */
-#ifndef sk_OPENSSL_STRING_num
-#define sk_OPENSSL_STRING_num(st) sk_num(st)
-#endif /* sk_OPENSSL_STRING_num */
-#ifndef sk_OPENSSL_STRING_value
-#define sk_OPENSSL_STRING_value(st, i) sk_value((st),(i))
-#endif /* sk_OPENSSL_STRING_value */
-#endif /* DEFINE_STACK_OF */
-
-NOEXPORT int ocsp_check(CLI *c, X509_STORE_CTX *callback_ctx) {
- X509 *cert;
- OCSP_CERTID *cert_id;
- STACK_OF(OPENSSL_STRING) *aia;
- int i, ocsp_status=V_OCSP_CERTSTATUS_UNKNOWN, saved_error;
- char *url;
-
- /* the original error code is restored unless we report our own error */
- saved_error=X509_STORE_CTX_get_error(callback_ctx);
-
- /* get the current certificate ID */
- cert=X509_STORE_CTX_get_current_cert(callback_ctx);
- if(!cert) {
- s_log(LOG_ERR, "OCSP: Failed to get the current certificate");
- X509_STORE_CTX_set_error(callback_ctx,
- X509_V_ERR_APPLICATION_VERIFICATION);
- return 0; /* reject */
- }
- if(!X509_NAME_cmp(X509_get_subject_name(cert),
- X509_get_issuer_name(cert))) {
- s_log(LOG_DEBUG, "OCSP: Ignoring root certificate");
- return 1; /* accept */
- }
- cert_id=OCSP_cert_to_id(NULL, cert, get_current_issuer(callback_ctx));
- if(!cert_id) {
- sslerror("OCSP: OCSP_cert_to_id");
- X509_STORE_CTX_set_error(callback_ctx,
- X509_V_ERR_APPLICATION_VERIFICATION);
- return 0; /* reject */
- }
-
- /* use the responder specified in the configuration file */
- if(c->opt->ocsp_url) {
- s_log(LOG_NOTICE, "OCSP: Connecting the configured responder \"%s\"",
- c->opt->ocsp_url);
- if(ocsp_request(c, callback_ctx, cert_id, c->opt->ocsp_url)!=
- V_OCSP_CERTSTATUS_GOOD) {
- OCSP_CERTID_free(cert_id);
- return 0; /* reject */
- }
- }
-
- /* use the responder from AIA (Authority Information Access) */
- if(c->opt->option.aia && (aia=X509_get1_ocsp(cert))!=NULL) {
- for(i=0; i<sk_OPENSSL_STRING_num(aia); i++) {
- url=sk_OPENSSL_STRING_value(aia, i);
- s_log(LOG_NOTICE, "OCSP: Connecting the AIA responder \"%s\"", url);
- ocsp_status=ocsp_request(c, callback_ctx, cert_id, url);
- if(ocsp_status!=V_OCSP_CERTSTATUS_UNKNOWN)
- break; /* we received a definitive response */
- }
- X509_email_free(aia);
- if(ocsp_status!=V_OCSP_CERTSTATUS_GOOD) {
- OCSP_CERTID_free(cert_id);
- return 0; /* reject */
- }
- }
-
- OCSP_CERTID_free(cert_id);
- X509_STORE_CTX_set_error(callback_ctx, saved_error);
- return 1; /* accept */
-}
-
-/* returns one of:
- * V_OCSP_CERTSTATUS_GOOD
- * V_OCSP_CERTSTATUS_REVOKED
- * V_OCSP_CERTSTATUS_UNKNOWN */
-NOEXPORT int ocsp_request(CLI *c, X509_STORE_CTX *callback_ctx,
- OCSP_CERTID *cert_id, char *url) {
- int ocsp_status=V_OCSP_CERTSTATUS_UNKNOWN;
- int response_status;
- int reason;
- int ctx_err=X509_V_ERR_APPLICATION_VERIFICATION;
- OCSP_REQUEST *request=NULL;
- OCSP_RESPONSE *response=NULL;
- OCSP_BASICRESP *basic_response=NULL;
- ASN1_GENERALIZEDTIME *revoked_at=NULL,
- *this_update=NULL, *next_update=NULL;
-
- /* build request */
- request=OCSP_REQUEST_new();
- if(!request) {

_service:tar_scm:stunnel-5.69.tar.gz/src/version.h -> _service:tar_scm:stunnel-5.72.tar.gz/src/version.h Changed

_service:tar_scm:stunnel-5.69.tar.gz/tests/Makefile.am -> _service:tar_scm:stunnel-5.72.tar.gz/tests/Makefile.am Changed

_service:tar_scm:stunnel-5.69.tar.gz/tests/Makefile.in -> _service:tar_scm:stunnel-5.72.tar.gz/tests/Makefile.in Changed

_service:tar_scm:stunnel-5.69.tar.gz/tests/certs/Makefile.am -> _service:tar_scm:stunnel-5.72.tar.gz/tests/certs/Makefile.am Changed

_service:tar_scm:stunnel-5.69.tar.gz/tests/certs/Makefile.in -> _service:tar_scm:stunnel-5.72.tar.gz/tests/certs/Makefile.in Changed

_service:tar_scm:stunnel-5.69.tar.gz/tests/certs/maketestcert.sh -> _service:tar_scm:stunnel-5.72.tar.gz/tests/certs/maketestcert.sh Changed

@@ -1,15 +1,14 @@
-#!/bin/sh
+# How to run mini OCSP servers:
+# openssl ocsp -index tests/certs/index.txt -port 19253 -rsigner tests/certs/inter_ocsp.pem -CA tests/certs/CACert.pem
+# openssl ocsp -index tests/certs/index.txt -port 19254 -rsigner tests/certs/leaf_ocsp.pem -CA tests/certs/intermediateCA.pem
 
-ddays=1461
+#!/bin/sh
 
 result_path=$(pwd)
 cd $(dirname "$0")
 script_path=$(pwd)
 cd "${result_path}"
 
-mkdir "tmp/"
-
-# create new psk secrets
 gen_psk () {
 tr -c -d 'A-Za-z0-9' </dev/urandom 2>> "maketestcert.log" | head -c 50 > tmp/psk.txt
 if -s tmp/psk.txt 
@@ -21,84 +20,195 @@
 rm -f tmp/psk.txt
 }
 
+
+################################################################################
+# OpenSSL settings
+################################################################################
+TEMP_LD_LIBRARY_PATH=$LD_LIBRARY_PATH
+LD_LIBRARY_PATH=""
+OPENSSL=openssl
+
+mkdir "tmp/"
 export LC_ALL=C
+mkdir "CA/" 2>> "maketestcert.log" 1>&2
+touch "CA/index.txt"
+echo -n "unique_subject = no" > "CA/index.txt.attr"
+"$OPENSSL" rand -hex 16 > "CA/serial"
+echo 1001 > "CA/crlnumber"
+date > "maketestcert.log"
+"$OPENSSL" version 2>> "maketestcert.log" 1>&2
+
+
+################################################################################
+# Create new psk secrets
+################################################################################
 gen_psk 1
 cat tmp/psk1.txt > tmp/secrets.txt 2>> "maketestcert.log"
 gen_psk 2
 cat tmp/psk2.txt >> tmp/secrets.txt 2>> "maketestcert.log"
 gen_psk 2
 
-# OpenSSL settings
-TEMP_LD_LIBRARY_PATH=$LD_LIBRARY_PATH
-LD_LIBRARY_PATH=""
-OPENSSL=openssl
-CONF="${script_path}/openssltest.cnf"
-
-mkdir "demoCA/"
-touch "demoCA/index.txt"
-touch "demoCA/index.txt.attr"
-echo 1000 > "demoCA/serial"
 
-# generate a self-signed certificate
-$OPENSSL req -config $CONF -new -x509 -days $ddays -keyout tmp/stunnel.pem -out tmp/stunnel.pem \
+################################################################################
+# self-signed certificate
+################################################################################
+CONF="${script_path}/openssl_root.cnf"
+"$OPENSSL" req -config $CONF -new -x509 -keyout tmp/stunnel.pem -out tmp/stunnel.pem \
 -subj "/C=PL/ST=Mazovia Province/L=Warsaw/O=Stunnel Developers/OU=Provisional CA/CN=localhost/emailAddress=stunnel@example.com" \
- 1>&2 2>> "maketestcert.log"
+ 2>> "maketestcert.log" 1>&2
 
-# generate root CA certificate
-$OPENSSL genrsa -out demoCA/CA.key 1>&2 2>> "maketestcert.log"
-$OPENSSL req -config $CONF -new -x509 -days $ddays -key demoCA/CA.key -out tmp/CACert.pem \
- -subj "/C=PL/O=Stunnel Developers/OU=Root CA/CN=CA/emailAddress=CA@example.com" \
- 1>&2 2>> "maketestcert.log"
 
-# generate a certificate to revoke
-$OPENSSL genrsa -out demoCA/revoked.key 1>&2 2>> "maketestcert.log"
-$OPENSSL req -config $CONF -new -key demoCA/revoked.key -out demoCA/revoked.csr \
+################################################################################
+# Root CA certificate
+################################################################################
+"$OPENSSL" genrsa -out CA/CA.key \
+ 2>> "maketestcert.log" 1>&2
+"$OPENSSL" req -config $CONF -new -x509 -days 3600 -key CA/CA.key -out tmp/CACert.pem \
+ -subj "/C=PL/O=Stunnel Developers/OU=Root CA/CN=CA/emailAddress=CA@example.com" \
+ 2>> "maketestcert.log" 1>&2
+
+
+################################################################################
+# Intermediate CA certificate
+################################################################################
+CONF="${script_path}/openssl_intermediate.cnf"
+"$OPENSSL" genrsa -out CA/intermediateCA.key \
+ 2>> "maketestcert.log" 1>&2
+"$OPENSSL" req -config "$CONF" -new -key CA/intermediateCA.key -out CA/intermediateCA.csr \
+ -subj "/C=PL/O=Stunnel Developers/OU=Intermediate CA/CN=Intermediate CA" \
+ 2>> "maketestcert.log" 1>&2
+
+CONF="${script_path}/openssl_root.cnf"
+"$OPENSSL" ca -config "$CONF" -batch -in CA/intermediateCA.csr -out CA/intermediateCA.cer \
+ 2>> "maketestcert.log" 1>&2
+"$OPENSSL" x509 -in CA/intermediateCA.cer -out tmp/intermediateCA.pem \
+ 2>> "maketestcert.log" 1>&2
+
+
+################################################################################
+# Revoked certificate chain
+################################################################################
+CONF="${script_path}/openssl_intermediate.cnf"
+"$OPENSSL" genrsa -out CA/revoked.key \
+ 2>> "maketestcert.log" 1>&2
+"$OPENSSL" req -config $CONF -new -key CA/revoked.key -out CA/revoked.csr \
 -subj "/C=PL/O=Stunnel Developers/OU=revoked/CN=revoked/emailAddress=revoked@example.com" \
- 1>&2 2>> "maketestcert.log"
-
-$OPENSSL ca -config $CONF -batch -days $ddays -in demoCA/revoked.csr -out demoCA/revoked.cer 1>&2 2>> "maketestcert.log"
-
-$OPENSSL x509 -in demoCA/revoked.cer -out tmp/revoked_cert.pem 1>&2 2>> "maketestcert.log"
-cat demoCA/revoked.key >> tmp/revoked_cert.pem 2>> "maketestcert.log"
+ 2>> "maketestcert.log" 1>&2
+"$OPENSSL" ca -config $CONF -batch -in CA/revoked.csr -out CA/revoked.cer \
+ 2>> "maketestcert.log" 1>&2
+"$OPENSSL" x509 -in CA/revoked.cer -out tmp/revoked_cert.pem \
+ 2>> "maketestcert.log" 1>&2
+cat CA/revoked.key >> tmp/revoked_cert.pem 2>> "maketestcert.log"
+cat tmp/intermediateCA.pem >> tmp/revoked_cert.pem 2>> "maketestcert.log"
 
 # revoke above certificate and generate CRL file
-$OPENSSL ca -config $CONF -revoke demoCA/1000.pem 1>&2 2>> "maketestcert.log"
-$OPENSSL ca -config $CONF -gencrl -crldays $ddays -out tmp/CACertCRL.pem 1>&2 2>> "maketestcert.log"
-
-# generate a client certificate
-$OPENSSL genrsa -out demoCA/client.key 1>&2 2>> "maketestcert.log"
-$OPENSSL req -config $CONF -new -key demoCA/client.key -out demoCA/client.csr \
- -subj "/C=PL/O=Stunnel Developers/OU=client/CN=client/emailAddress=client@example.com" \
- 1>&2 2>> "maketestcert.log"
-
-$OPENSSL ca -config $CONF -batch -days $ddays -in demoCA/client.csr -out demoCA/client.cer 1>&2 2>> "maketestcert.log"
-
-$OPENSSL x509 -in demoCA/client.cer -out tmp/client_cert.pem 1>&2 2>> "maketestcert.log"
-cat tmp/client_cert.pem > tmp/PeerCerts.pem 2>> "maketestcert.log"
-cat demoCA/client.key >> tmp/client_cert.pem 2>> "maketestcert.log"
-
-# generate a server certificate
-$OPENSSL genrsa -out demoCA/server.key 1>&2 2>> "maketestcert.log"
-$OPENSSL req -config $CONF -new -key demoCA/server.key -out demoCA/server.csr \
+"$OPENSSL" ca -config $CONF -revoke CA/revoked.cer \
+ 2>> "maketestcert.log" 1>&2
+"$OPENSSL" ca -config $CONF -gencrl -crldays 1461 -out tmp/CACertCRL.pem \
+ 2>> "maketestcert.log" 1>&2
+
+
+################################################################################
+# Server certificate chain
+################################################################################
+"$OPENSSL" genrsa -out CA/server.key \
+ 2>> "maketestcert.log" 1>&2
+"$OPENSSL" req -config $CONF -new -key CA/server.key -out CA/server.csr \
 -subj "/C=PL/O=Stunnel Developers/OU=server/CN=server/emailAddress=server@example.com" \
- 1>&2 2>> "maketestcert.log"
-
-$OPENSSL ca -config $CONF -batch -days $ddays -in demoCA/server.csr -out demoCA/server.cer 1>&2 2>> "maketestcert.log"
-
-$OPENSSL x509 -in demoCA/server.cer -out tmp/server_cert.pem 1>&2 2>> "maketestcert.log"
+ 2>> "maketestcert.log" 1>&2
+"$OPENSSL" ca -config $CONF -batch -in CA/server.csr -out CA/server.cer \
+ 2>> "maketestcert.log" 1>&2
+"$OPENSSL" x509 -in CA/server.cer -out tmp/server_cert.pem \
+ 2>> "maketestcert.log" 1>&2
 cat tmp/server_cert.pem >> tmp/PeerCerts.pem 2>> "maketestcert.log"
-cat demoCA/server.key >> tmp/server_cert.pem 2>> "maketestcert.log"
+cat CA/server.key >> tmp/server_cert.pem 2>> "maketestcert.log"
+cat tmp/intermediateCA.pem >> tmp/server_cert.pem 2>> "maketestcert.log"
 
-# create a PKCS#12 file with a server certificate
-$OPENSSL pkcs12 -export -certpbe pbeWithSHA1And3-KeyTripleDES-CBC -in tmp/server_cert.pem -out tmp/server_cert.p12 -passout pass: 1>&2 2>> "maketestcert.log"
+# create a PKCS#12 file with a server certificate chain
+"$OPENSSL" pkcs12 -export -certpbe pbeWithSHA1And3-KeyTripleDES-CBC \
+ -in tmp/server_cert.pem -out tmp/server_cert.p12 -passout pass: \
+ 2>> "maketestcert.log" 1>&2
 
-# copy new files
-if -s tmp/stunnel.pem && -s tmp/CACert.pem && -s tmp/CACertCRL.pem && \
- -s tmp/revoked_cert.pem && -s tmp/client_cert.pem && -s tmp/server_cert.pem && \
- -s tmp/PeerCerts.pem && -s tmp/server_cert.p12 && \
- -s tmp/psk1.txt && -s tmp/psk2.txt && -s tmp/secrets.txt 
+
+################################################################################
+# Client certificate chain
+################################################################################
+"$OPENSSL" genrsa -out CA/client.key \
+ 2>> "maketestcert.log" 1>&2
+"$OPENSSL" req -config $CONF -new -key CA/client.key -out CA/client.csr \
+ -subj "/C=PL/O=Stunnel Developers/OU=client/CN=client/emailAddress=client@example.com" \
+ 2>> "maketestcert.log" 1>&2

_service:tar_scm:stunnel-5.72.tar.gz/tests/certs/openssl_intermediate.cnf Added

@@ -0,0 +1,74 @@
+# OpenSSL intermediate CA configuration file
+
+ default 
+name                            = intermediateCA
+default_ca                      = CA_default
+
+ CA_default 
+# Directory and file locations.
+dir                             = .
+certs                           = $dir/CA
+crl_dir                         = $dir/CA
+new_certs_dir                   = $dir/CA
+database                        = $dir/CA/index.txt
+serial                          = $dir/CA/serial
+rand_serial                     = yes
+private_key                     = $dir/CA/$name.key
+certificate                     = $dir/tmp/$name.pem
+crlnumber                       = $dir/CA/crlnumber
+crl_extensions                  = crl_ext
+default_md                      = sha256
+preserve                        = no
+policy                          = policy_loose
+default_days                    = 2200
+x509_extensions                 = usr_cert
+
+ crl_ext 
+authorityKeyIdentifier          = keyid:always
+
+ v3_OCSP 
+basicConstraints                = CA:FALSE
+keyUsage                        = nonRepudiation, digitalSignature, keyEncipherment
+extendedKeyUsage                = OCSPSigning
+
+ req 
+# Options for the `req` tool
+encrypt_key                     = no
+default_bits                    = 2048
+default_md                      = sha256
+string_mask                     = utf8only
+x509_extensions                 = usr_extensions
+distinguished_name              = req_distinguished_name
+
+ usr_cert 
+basicConstraints                = CA:FALSE
+subjectKeyIdentifier            = hash
+authorityKeyIdentifier          = keyid, issuer
+authorityInfoAccess             = OCSP;URI:http://127.0.0.1:19254/ocsp
+
+ usr_extensions 
+# Extension to add when the -x509 option is used
+basicConstraints                = CA:FALSE
+subjectKeyIdentifier            = hash
+authorityKeyIdentifier          = keyid:always,issuer
+keyUsage                        = critical, digitalSignature, keyCertSign
+
+ policy_loose 
+# Allow the intermediate CA to sign a more diverse range of certificates.
+# See the POLICY FORMAT section of the `ca` man page.
+countryName                     = optional
+stateOrProvinceName             = optional
+localityName                    = optional
+organizationName                = optional
+organizationalUnitName          = optional
+commonName                      = supplied
+emailAddress                    = optional
+
+ req_distinguished_name 
+countryName                     = Country Name (2 letter code)
+stateOrProvinceName             = State or Province Name
+localityName                    = Locality Name
+0.organizationName              = Organization Name
+organizationalUnitName          = Organizational Unit Name
+commonName                      = Common Name
+emailAddress                    = Email Address

_service:tar_scm:stunnel-5.72.tar.gz/tests/certs/openssl_root.cnf Added

@@ -0,0 +1,70 @@
+# OpenSSL root CA configuration file
+
+ ca 
+default_ca                      = CA_default
+
+ CA_default 
+# Directory and file locations.
+dir                             = .
+certs                           = $dir/CA
+crl_dir                         = $dir/CA
+new_certs_dir                   = $dir/CA
+database                        = $dir/CA/index.txt
+serial                          = $dir/CA/serial
+rand_serial                     = yes
+private_key                     = $dir/CA/CA.key
+certificate                     = $dir/tmp/CACert.pem
+crl_extensions                  = crl_ext
+default_md                      = sha256
+preserve                        = no
+policy                          = policy_match
+default_days                    = 3000
+x509_extensions                 = v3_intermediate_ca
+
+ crl_ext 
+authorityKeyIdentifier          = keyid:always
+
+ v3_OCSP 
+basicConstraints                = CA:FALSE
+keyUsage                        = nonRepudiation, digitalSignature, keyEncipherment
+extendedKeyUsage                = OCSPSigning
+
+ req 
+# Options for the `req` tool
+encrypt_key                     = no
+default_bits                    = 2048
+default_md                      = sha256
+string_mask                     = utf8only
+x509_extensions                 = ca_extensions
+distinguished_name              = req_distinguished_name
+
+ ca_extensions 
+# Extension to add when the -x509 option is used
+basicConstraints                = critical, CA:true
+subjectKeyIdentifier            = hash
+authorityKeyIdentifier          = keyid:always,issuer
+keyUsage                        = critical, digitalSignature, cRLSign, keyCertSign
+
+ v3_intermediate_ca 
+# Extensions for a typical intermediate CA (`man x509v3_config`)
+basicConstraints                = critical, CA:true, pathlen:0
+subjectKeyIdentifier            = hash
+authorityKeyIdentifier          = keyid:always,issuer
+keyUsage                        = critical, digitalSignature, cRLSign, keyCertSign
+authorityInfoAccess             = OCSP;URI:http://127.0.0.1:19254/ocsp
+
+ policy_match 
+countryName                     = match
+organizationName                = match
+organizationalUnitName          = optional
+commonName                      = supplied
+emailAddress                    = optional
+
+ req_distinguished_name 
+countryName                     = Country Name (2 letter code)
+stateOrProvinceName             = State or Province Name
+localityName                    = Locality Name
+0.organizationName              = Organization Name
+organizationalUnitName          = Organizational Unit Name
+commonName                      = Common Name
+emailAddress                    = Email Address

_service:tar_scm:stunnel-5.69.tar.gz/tests/maketest.py -> _service:tar_scm:stunnel-5.72.tar.gz/tests/maketest.py Changed

@@ -7,6 +7,7 @@
 import asyncio
 import contextlib
 import dataclasses
+import http.client
 import logging
 import os
 import pathlib
@@ -17,6 +18,7 @@
 import subprocess
 import sys
 import tempfile
+import threading
 
 from typing import (
 Any,
@@ -28,7 +30,13 @@
 Optional,
 TypeVar
 )
-
+from datetime import datetime, timedelta, timezone
+from functools import partial
+from urllib.parse import urlparse
+from http.server import SimpleHTTPRequestHandler, ThreadingHTTPServer
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.x509 import load_pem_x509_certificate, ocsp, ReasonFlags
+from cryptography.x509 import SubjectKeyIdentifier, ExtensionNotFound, OCSPNonce
 from plugin_collection import PluginCollection
 
 EXIT_SUCCESS = 0
@@ -39,6 +47,8 @@
 DEFAULT_CERTS = os.path.join(RESULT_PATH, "certs")
 DEFAULT_LOGS = os.path.join(RESULT_PATH, "logs")
 DEFAULT_LEVEL = logging.INFO
+DEFAULT_PORT = 19254
+OCSP_INDEX=os.path.join(DEFAULT_CERTS, "index.txt")
 
 RE_STUNNEL_VERSION = re.compile(
 r""" ^
@@ -61,8 +71,18 @@
 RE_LINE_IDX = re.compile(r" ^ Hello \s+ (?P<idx> 0 | 1-90-9* ) $ ", re.X)
 
 
-class UnsupportedOpenSSL(Exception):
- """Unsupported version of OpenSSL"""
+class UnsupportedVersion(Exception):
+ """Unsupported version"""
+
+
+class OutputError(Exception):
+ """Output error
+ Logging: Something went wrong
+ """
+
+
+class UnexpectedWarning(Exception):
+ """Unexpected warning"""
 
 
 @dataclasses.dataclass(frozen=True)
@@ -73,7 +93,7 @@
 log: str
 
 
-TLogEvent = TypeVar("TEvent", bound=LogEvent)
+TypeLogEvent = TypeVar("TypeLogEvent", bound=LogEvent)
 
 
 @dataclasses.dataclass(frozen=True)
@@ -175,6 +195,7 @@
 results: pathlib.Path
 summary: pathlib.Path
 debug: int
+ port: int
 
 
 class TestConnections(NamedTuple):
@@ -245,17 +266,17 @@
 if evt.etype == "client_send_data":
 conn = conns.by_id.get(evt.idx)
 if conn is None:
- raise Exception("Listener reported unknown connection")
+ raise OutputError("Listener reported unknown connection")
 if conn.peer is not None:
- raise Exception(f"Listener reported bad conn {conn!r}")
+ raise OutputError(f"Listener reported bad conn {conn!r}")
 conn.peer = peer
 return
 
 if evt.etype != "client_connected":
- raise Exception(f"Expected 'client connected' first, got {evt.etype}")
+ raise OutputError(f"Expected 'client connected' first, got {evt.etype}")
 conns.pendingpeer = evt
 
- except Exception as err: # pylint: disable=broad-except
+ except OutputError as err:
 await self.cfg.mainq.put(
 LogEvent(
 etype="fatal_event",
@@ -272,7 +293,7 @@
 conns = evt.conns
 conn = conns.by_id.get(evt.idx)
 if conn is None:
- raise Exception("No connection")
+ raise OutputError("No connection")
 del conns.by_idevt.idx
 if conn.peer is None:
 await self.cfg.mainq.put(
@@ -305,7 +326,7 @@
 )
 return num
 
- except Exception as err: # pylint: disable=broad-except
+ except OutputError as err:
 await self.cfg.mainq.put(
 LogEvent(
 etype="fatal_event",
@@ -326,14 +347,11 @@
 while True:
 evt = await self.cfg.mainq.get()
 self.log_event(evt, logger)
- if evt.etype == "cleanup_event" or evt.etype == "output_event" \
- or evt.etype == "fatal_event":
+ if evt.etype in "cleanup_event", "output_event", "fatal_event":
 await self.cfg.resq.put(evt)
- elif evt.etype == "stunnel_event" or evt.etype == "result_event" \
- or evt.etype == "all_connections_event":
+ elif evt.etype in "stunnel_event", "result_event", "all_connections_event":
 await self.cfg.logsq.put(evt)
- elif evt.etype == "client_connected" or evt.etype == "client_send_data" \
- or evt.etype == "client_done":
+ elif evt.etype in "client_connected", "client_send_data", "client_done":
 await self.process_client(evt)
 elif evt.etype == "connection_done_event":
 await self.cfg.logsq.put(evt)
@@ -353,7 +371,7 @@
 tag = "check_version"
 lines = p_err.splitlines()
 if not lines:
- raise Exception(f"Expected at least one line of output from `{cmd_str}`")
+ raise OutputError(f"Expected at least one line of output from `{cmd_str}`")
 openssl_version = None
 stunnel_version = None
 for line in lines:
@@ -364,15 +382,16 @@
 if match:
 openssl_version = match.group("version")
 if not openssl_version:
- raise Exception("Stunnel was compiled and run with different OpenSSL versions")
- """TLSv1.1 and TLSv1.2 available only with OpenSSL version 1.0.1 and later"""
+ raise UnsupportedVersion("Stunnel was compiled and run with different OpenSSL versions")
+ #TLSv1.1 and TLSv1.2 available only with OpenSSL version 1.0.1 and later
 if openssl_version < "1.0.1":
- raise UnsupportedOpenSSL(f"OpenSSL version {openssl_version} is deprecated and not supported")
+ raise UnsupportedVersion(
+ f"OpenSSL version {openssl_version} is deprecated and not supported")
 if not (sys.version_info.major == 3 and sys.version_info.minor >= 7):
- raise Exception("Python 3.7 or higher is required.\n"
- + "You are using Python {}.{}.".format(sys.version_info.major, sys.version_info.minor))
+ raise UnsupportedVersion("Python 3.7 or higher is required.\n"
+ + "You are using Python {sys.version_info.major}.{sys.version_info.minor}.")
 if not stunnel_version:
- raise Exception(
+ raise UnsupportedVersion(
 f"Could not find the version line in the `{cmd_str}` output:\n"
 + "\n".join(lines)
 )
@@ -422,16 +441,16 @@
 )
 b_out, b_err = await proc.communicate()
 if b_out is None or b_err is None:
- raise Exception("proc.communicate() failed")
+ raise OutputError("proc.communicate() failed")
 p_out, p_err = b_out.decode("UTF-8"), b_err.decode("UTF-8")
 logger.info(p_err)
 rcode = await proc.wait()
 if rcode != 0:
 print(b_out.decode("UTF-8"))
 print(b_err.decode("UTF-8"), file=sys.stderr)
- raise Exception(f"`{cmd_str}` exited with code {rcode}")
+ raise OutputError(f"`{cmd_str}` exited with code {rcode}")
 if p_out:
- raise Exception(f"`{cmd_str}` produced output on its stdout stream:\n{p_out}")
+ raise OutputError(f"`{cmd_str}` produced output on its stdout stream:\n{p_out}")
 await self.check_version(cmd_str, p_err)
 await self.cfg.mainq.put(
 LogEvent(
@@ -479,7 +498,7 @@
 result = "UNKNOWN"
 while True:
 evt = await self.cfg.resq.get()
- if evt.etype == "output_event" or evt.etype == "fatal_event":
+ if evt.etype in "output_event", "fatal_event":
 if result != "skipped":
 parsed = await self.parse_event(evt)
 if result == "UNKNOWN":
@@ -523,11 +542,11 @@
 )

_service:tar_scm:stunnel-5.69.tar.gz/tests/plugins/p14_resume_ticket.py -> _service:tar_scm:stunnel-5.72.tar.gz/tests/plugins/p14_resume_ticket.py Changed

_service:tar_scm:stunnel-5.69.tar.gz/tests/plugins/p15_resume_secret.py -> _service:tar_scm:stunnel-5.72.tar.gz/tests/plugins/p15_resume_secret.py Changed

_service:tar_scm:stunnel-5.69.tar.gz/tests/plugins/p24_delay.py -> _service:tar_scm:stunnel-5.72.tar.gz/tests/plugins/p24_delay.py Changed

_service:tar_scm:stunnel-5.72.tar.gz/tests/plugins/p27_ocsp.py Added

@@ -0,0 +1,339 @@
+"""stunnel client-server tests"""
+
+import logging
+import os
+import pathlib
+from plugin_collection import Plugin, ERR_CONN_RESET
+from maketest import (
+    Config,
+    StunnelAcceptConnect
+)
+
+
+class StunnelTest(StunnelAcceptConnect):
+    """Base class for stunnel client-server tests."""
+    # pylint: disable=too-few-public-methods
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.services = 'server', 'client'
+
+
+class VerifyOCSPStapling(StunnelTest):
+    """ Checking OCSP stapling certificate verification.
+        OCSP stapling is always available in the server mode.
+        Server OCSP stapling is supported in OpenSSL version 1.0.2 or later.
+        Using "verifyChain" automatically enables OCSP stapling in the client mode.
+        The success is expected because the server presents a valid certificate.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '271. Test OCSP stapling'
+        self.events.skip = 
+            "Server OCSP stapling not supported"
+        
+        self.events.count = 1
+        self.events.success = 
+            r"OCSP: Accepted $good$"
+        
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            "Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_client_cfgfile(
+        self, cfg: Config, ports: list, service: str
+    ) -> (pathlib.Path, pathlib.Path):
+        """Create a configuration file for a stunnel client."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    client = yes
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{ports1}
+    CAfile = {cfg.certdir}/CACert.pem
+    verifyChain = yes
+    """
+        cfgfile = cfg.tempd / "stunnel_client.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile, os.devnull
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{port}
+    cert = {cfg.certdir}/server_cert.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class VerifyOCSPClientDriven(StunnelTest):
+    """ Checking OCSP stapling certificate verification.
+        Using "OCSPaia" enables stunnel to validate certificates with the list of OCSP
+        responder URLs retrieved from their AIA (Authority Information Access) extension.
+        The success is expected because the client presents a valid certificate.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '272. Test OCSP client-driven'
+        self.events.count = 1
+        self.events.success = 
+            r"OCSP: Accepted $good$"
+        
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            "Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_client_cfgfile(
+        self, cfg: Config, ports: list, service: str
+    ) -> (pathlib.Path, pathlib.Path):
+        """Create a configuration file for a stunnel client."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    client = yes
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{ports1}
+    cert = {cfg.certdir}/client_cert.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_client.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile, os.devnull
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{port}
+    cert = {cfg.certdir}/server_cert.pem
+    CAfile = {cfg.certdir}/CACert.pem
+    verifyChain = yes
+    OCSPaia = yes
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class FailureVerifyOCSPStapling(StunnelTest):
+    """ Checking OCSP stapling certificate verification.
+        OCSP stapling is always available in the server mode.
+        Server OCSP stapling is supported in OpenSSL version 1.0.2 or later.
+        Using "verifyChain" automatically enables OCSP stapling in the client mode.
+        The failure is expected because the server presents a revoked certificate.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '273. Failure test OCSP stapling'
+        self.events.skip = 
+            "Server OCSP stapling not supported"
+        
+        self.events.count = 1
+        self.events.success = 
+            r"OCSP: Rejected $revoked$"
+        
+        self.events.failure = 
+            "peer did not return a certificate",
+            #"bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            "Redirecting connection",
+            #ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+

_service:tar_scm:stunnel-5.69.tar.gz/tools/Makefile.am -> _service:tar_scm:stunnel-5.72.tar.gz/tools/Makefile.am Changed

@@ -1,10 +1,10 @@
 ## Process this file with automake to produce Makefile.in
-# by Michal Trojnara 1998-2023
+# by Michal Trojnara 1998-2024
 
 EXTRA_DIST = ca.html ca.pl importCA.html importCA.sh script.sh makecert.sh
 EXTRA_DIST += openssl.cnf stunnel.nsi ReplaceInFile3.nsh stunnel.license stunnel.conf
 EXTRA_DIST += stunnel.conf-sample.in stunnel.init.in stunnel.service.in
-EXTRA_DIST += stunnel.logrotate stunnel.rh.init stunnel.spec
+EXTRA_DIST += stunnel.logrotate stunnel.rh.init stunnel.spec.in
 EXTRA_DIST += ca-certs.pem
 
 confdir = $(sysconfdir)/stunnel
@@ -20,7 +20,7 @@
 bashcompdir = @bashcompdir@
 dist_bashcomp_DATA = stunnel.bash
 
-CLEANFILES = stunnel.conf-sample stunnel.init stunnel.service
+CLEANFILES = stunnel.conf-sample stunnel.init stunnel.service stunnel.spec
 
 install-data-local:
 	${INSTALL} -d -m 1770 $(DESTDIR)$(localstatedir)/lib/stunnel
@@ -36,11 +36,13 @@
 	-e 's|@bindir@|$(bindir)|g' \
 	-e 's|@localstatedir@|$(localstatedir)|g' \
 	-e 's|@sysconfdir@|$(sysconfdir)|g' \
-	-e 's|@DEFAULT_GROUP@|$(DEFAULT_GROUP)|g'
+	-e 's|@DEFAULT_GROUP@|$(DEFAULT_GROUP)|g' \
+	-e 's|@PACKAGE_VERSION@|$(PACKAGE_VERSION)|g'
 
-stunnel.conf-sample stunnel.init stunnel.service: Makefile
+stunnel.conf-sample stunnel.init stunnel.service stunnel.spec: Makefile
 	$(edit) '$(srcdir)/$@.in' >$@
 
 stunnel.conf-sample: $(srcdir)/stunnel.conf-sample.in
 stunnel.init: $(srcdir)/stunnel.init.in
 stunnel.service: $(srcdir)/stunnel.service.in
+stunnel.spec: $(srcdir)/stunnel.spec.in

_service:tar_scm:stunnel-5.69.tar.gz/tools/Makefile.in -> _service:tar_scm:stunnel-5.72.tar.gz/tools/Makefile.in Changed

@@ -14,7 +14,7 @@
 
 @SET_MAKE@
 
-# by Michal Trojnara 1998-2023
+# by Michal Trojnara 1998-2024
 
 VPATH = @srcdir@
 am__is_gnu_make = { \
@@ -185,6 +185,7 @@
 ETAGS = @ETAGS@
 EXEEXT = @EXEEXT@
 FGREP = @FGREP@
+FILECMD = @FILECMD@
 GREP = @GREP@
 INSTALL = @INSTALL@
 INSTALL_DATA = @INSTALL_DATA@
@@ -291,7 +292,7 @@
 	makecert.sh openssl.cnf stunnel.nsi ReplaceInFile3.nsh \
 	stunnel.license stunnel.conf stunnel.conf-sample.in \
 	stunnel.init.in stunnel.service.in stunnel.logrotate \
-	stunnel.rh.init stunnel.spec ca-certs.pem
+	stunnel.rh.init stunnel.spec.in ca-certs.pem
 confdir = $(sysconfdir)/stunnel
 conf_DATA = stunnel.conf-sample
 examplesdir = $(docdir)/examples
@@ -299,13 +300,14 @@
 	stunnel.rh.init stunnel.spec ca.html ca.pl importCA.html \
 	importCA.sh script.sh
 dist_bashcomp_DATA = stunnel.bash
-CLEANFILES = stunnel.conf-sample stunnel.init stunnel.service
+CLEANFILES = stunnel.conf-sample stunnel.init stunnel.service stunnel.spec
 edit = sed \
 	-e 's|@prefix@|$(prefix)|g' \
 	-e 's|@bindir@|$(bindir)|g' \
 	-e 's|@localstatedir@|$(localstatedir)|g' \
 	-e 's|@sysconfdir@|$(sysconfdir)|g' \
-	-e 's|@DEFAULT_GROUP@|$(DEFAULT_GROUP)|g'
+	-e 's|@DEFAULT_GROUP@|$(DEFAULT_GROUP)|g' \
+	-e 's|@PACKAGE_VERSION@|$(PACKAGE_VERSION)|g'
 
 all: all-am
 
@@ -582,12 +584,13 @@
 	${INSTALL} -b -m 600 stunnel.pem $(DESTDIR)$(confdir)/stunnel.pem
 	rm -f stunnel.pem
 
-stunnel.conf-sample stunnel.init stunnel.service: Makefile
+stunnel.conf-sample stunnel.init stunnel.service stunnel.spec: Makefile
 	$(edit) '$(srcdir)/$@.in' >$@
 
 stunnel.conf-sample: $(srcdir)/stunnel.conf-sample.in
 stunnel.init: $(srcdir)/stunnel.init.in
 stunnel.service: $(srcdir)/stunnel.service.in
+stunnel.spec: $(srcdir)/stunnel.spec.in
 
 # Tell versions 3.59,3.63) of GNU make to not export all variables.
 # Otherwise a system limit (for SysV at least) may be exceeded.

_service:tar_scm:stunnel-5.69.tar.gz/tools/ca-certs.pem -> _service:tar_scm:stunnel-5.72.tar.gz/tools/ca-certs.pem Changed

@@ -1,4 +1,84 @@
 -----BEGIN CERTIFICATE-----
+MIIF6zCCA9OgAwIBAgIIVrYpzTS8ePYwDQYJKoZIhvcNAQELBQAwgYIxCzAJBgNV
+BAYTAlVTMQ4wDAYDVQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3RvbjEYMBYGA1UE
+CgwPU1NMIENvcnBvcmF0aW9uMTcwNQYDVQQDDC5TU0wuY29tIEVWIFJvb3QgQ2Vy
+dGlmaWNhdGlvbiBBdXRob3JpdHkgUlNBIFIyMB4XDTE3MDUzMTE4MTQzN1oXDTQy
+MDUzMDE4MTQzN1owgYIxCzAJBgNVBAYTAlVTMQ4wDAYDVQQIDAVUZXhhczEQMA4G
+A1UEBwwHSG91c3RvbjEYMBYGA1UECgwPU1NMIENvcnBvcmF0aW9uMTcwNQYDVQQD
+DC5TU0wuY29tIEVWIFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgUlNBIFIy
+MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAjzZlQOHWTcDXtOlG2mvq
+M0fNTPl9fb69LT3w23jhhqXZuglXaO1XPqDQCEGD5yhBJB/jchXQARr7XnAjssuf
+OePPxU7Gkm0mxnu7s9onnQqG6YE3Bf7wcXHswxzpY6IXFJ3vG2fThVUCAtZJycxa
+4bH3bzKfydQ7iEGonL3Lq9ttewkfokxykNorCPzPPFTOZw+oz12WGQvE43LrrdF9
+HSfvkusQv1vrO6/PgN3B0pYEW3p+pKk8OHakYo6gOV7qd89dAFmPZiw+B6KjBSYR
+aZfqhbcPlgtLyEDhULouisv3D5oi53+aNxPN8k0TayHRwMwi8qFG9kRpnMphNQcA
+b9ZhCBHqurj26bNg5U257J8UZslXWNvNh2n4ioYSA0e/ZhN2rHd9NCSFg83XqpyQ
+Gp8hLH94t2S42Oim9HizVcuE0jLEeK6jj2HdzghTreyI/BXkmg3mnxp3zkyPuBQV
+PWKchjgGAGYS5Fl2WlPAApiiECtoRHuOec4zSnaqW4EWG7WK2NAAe15itAnWhmMO
+pgWVSbooi4iTsjQc2KRVbrcc0N6ZVTsj9CLg+SlmJuwgUHfbSguPvuUCYHBBXtSu
+UDkiFCbLsjtzdFVHB3mBOagwE0TlBIqulhMlQg+5U8Sb/M3kHN48+qvWBkofZ6aY
+MBzdLNvcGJVXZsb/XItW9XcCAwEAAaNjMGEwDwYDVR0TAQH/BAUwAwEB/zAfBgNV
+HSMEGDAWgBT5YLvU49U09rj1BoAlp3PbRmmonjAdBgNVHQ4EFgQU+WC71OPVNPa4
+9QaAJadz20ZpqJ4wDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4ICAQBW
+s47LCp1Jjr+kxJG7ZhcFUZh1++VQLHqe8RT6q9OKPv+RKY9ji9i0qVQBDb6Thi/5
+Sm3HXvVX+cpVHBK+Rw82xd9qt9t1wkclf7nxY/hoLVUE0fKNsKTPvDxeH3jnpaAg
+cLAExbf3cqfeIg29MyVGjGSSJuM+LmOW2puMPfgYCdcDzH2GguDKBAdRUNf/ktUM
+79qGn5nX67evaOI5JpS6aLe/g9Pqemc9YmeuJeVy6OLk7K4S9ksrPJ/psEDzOFSz
+/bdoyNrGj1E8svuR3Bznm53htw1yj+KkxKl4+esUrMZDBcJlOSgYAsOCsp0FvmXt
+ll9ldDz7CTUue5wT/RsPXcdtgTpWD8w74a8CLyKsRspGPKAcTNZEtF4uXBVmCeEm
+Kf7GUmG6sXP/wwyc5WxqlD8UykAWlYTzWamsX0xhk23RO8yilQwipmdnRC652dKK
+QbNmC1r7fSOl8hqw/96bg5Qu0T/fkreRrwU7ZcegbLHNYhLDkBvjJc40vG93drEQ
+w/cFGsDWr3RiSBd3kmmQYRzelYB0VI8YHMPzA9C/pEN1hlMYegouCRw2n5H9gooi
+S9EOUCXdywMMF8mDAAhONU2Ki+3wApRmLER/y5UnlhetCTCstnEXbosX9hwJ1C07
+mKVx01QT2WDz9UtmT/rx7iASjbSsV7FFY6GsdqnC+w==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICaTCCAe+gAwIBAgIQISpWDK7aDKtARb8roi066jAKBggqhkjOPQQDAzBtMQsw
+CQYDVQQGEwJDSDEQMA4GA1UEChMHV0lTZUtleTEiMCAGA1UECxMZT0lTVEUgRm91
+bmRhdGlvbiBFbmRvcnNlZDEoMCYGA1UEAxMfT0lTVEUgV0lTZUtleSBHbG9iYWwg
+Um9vdCBHQyBDQTAeFw0xNzA1MDkwOTQ4MzRaFw00MjA1MDkwOTU4MzNaMG0xCzAJ
+BgNVBAYTAkNIMRAwDgYDVQQKEwdXSVNlS2V5MSIwIAYDVQQLExlPSVNURSBGb3Vu
+ZGF0aW9uIEVuZG9yc2VkMSgwJgYDVQQDEx9PSVNURSBXSVNlS2V5IEdsb2JhbCBS
+b290IEdDIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAETOlQwMYPchi82PG6s4ni
+eUqjFqdrVCTbUf/q9Akkwwsin8tqJ4KBDdLArzHkdIJuyiXZjHWd8dvQmqJLIX4W
+p2OQ0jnUsYd4XxiWD1AbNTcPasbc2RNNpI6QN+a9WzGRo1QwUjAOBgNVHQ8BAf8E
+BAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUSIcUrOPDnpBgOtfKie7T
+rYy0UGYwEAYJKwYBBAGCNxUBBAMCAQAwCgYIKoZIzj0EAwMDaAAwZQIwJsdpW9zV
+57LnyAyMjMPdeYwbY9XJUpROTYJKcx6ygISpJcBMWm1JKWB4E+J+SOtkAjEA2zQg
+Mgj/mkkCtojeFK9dbJlxjRo/i9fgojaGHAeCOnZT/cKi7e97sIBPWA9LUzm9
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFRzCCAy+gAwIBAgIJEQA0tk7GNi02MA0GCSqGSIb3DQEBCwUAMEExCzAJBgNV
+BAYTAlJPMRQwEgYDVQQKEwtDRVJUU0lHTiBTQTEcMBoGA1UECxMTY2VydFNJR04g
+Uk9PVCBDQSBHMjAeFw0xNzAyMDYwOTI3MzVaFw00MjAyMDYwOTI3MzVaMEExCzAJ
+BgNVBAYTAlJPMRQwEgYDVQQKEwtDRVJUU0lHTiBTQTEcMBoGA1UECxMTY2VydFNJ
+R04gUk9PVCBDQSBHMjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMDF
+dRmRfUR0dIf+DjuW3NgBFszuY5HnC2/OOwppGnzC46+CjobXXo9X69MhWf05N0Iw
+vlDqtg+piNguLWkh59E3GE59kdUWX2tbAMI5Qw02hVK5U2UPHULlj88F0+7cDBrZ
+uIt4ImfkabBoxTzkbFpG583H+u/E7Eu9aqSs/cwoUe+StCmrqzWaTOTECMYmzPhp
+n+Sc8CnTXPnGFiWeI8MgwT0PPzhAsP6CRDiqWhqKa2NYOLQV07YRaXseVO6MGiKs
+cpc/I1mbySKEwQdPzH/iV8oScLumZfNpdWO9lfsbl83kqK/20U6o2YpxJM02PbyW
+xPFsqa7lzw1uKA2wDrXKUXt4FMMgL3/7FFXhEZn91QqhngLjYl/rNUssuHLoPj1P
+rCy7Lobio3aP5ZMqz6WryFyNSwb/EkaseMsUBzXgqd+L6a8VTxaJW732jcZZroiF
+DsGJ6x9nxUWO/203Nit4ZoORUSs9/1F3dmKh7Gc+PoGD4FapUB8fepmrY7+EF3fx
+DTvf95xhszWYijqy7DwaNz9+j5LP2RIUZNoQAhVB/0/E6xyjyfqZ90bp4RjZsbgy
+LcsUDFDYg2WD7rlcz8sFWkz6GZdr1l0T08JcVLwyc6B49fFtHsufpaafItzRUZ6C
+eWRgKRM+o/1Pcmqr4tTluCRVLERLiohEnMqE0yo7AgMBAAGjQjBAMA8GA1UdEwEB
+/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBSCIS1mxteg4BXrzkwJ
+d8RgnlRuAzANBgkqhkiG9w0BAQsFAAOCAgEAYN4auOfyYILVAzOBywaK8SJJ6ejq
+kX/GM15oGQOGO0MBzwdw5AgeZYWR5hEit/UCI46uuR59H35s5r0l1ZUa8gWmr4UC
+b6741jH/JclKyMeKqdmfS0mbEVeZkkMR3rYzpMzXjWR91M08KCy0mpbqTfXERMQl
+qiCA2ClV9+BB/AYm/7k29UMUA2Z44RGx2iBfRgB4ACGlHgAoYXhvqAEBj500mv/0
+OJD7uNGzcgbJceaBxXntC6Z58hMLnPddDnskk7RI24Zf3lCGeOdA5jGokHZwYa+c
+NywRtYK3qq4kNFtyDGkNzVmf9nGvnAvRCjj5BiKDUyUM/FHE5r7iOZULJK2v0ZXk
+ltd0ZGtxTgI8qoXzIKNDOXZbbFD+mpwUHmUUihW9o4JFWklWatKcsWMy5WHgUyIO
+pwpJ6st+H6jiYoD2EEVSmAYY3qXNL3+q1Ok+CHLsIwMCPKaq2LxndD0UF/tUSxfj
+03k9bWtJySgOLnRQvwzZRjoQhsmnP+mg7H/rpXdYaXHmgwo38oZJar55CJD2AhZk
+PuXaTH4MNMn5X7azKFGnpyuqSfqNZSlO42sTp5SjLVFteAxEy9/eCG/Oo2Sr05WE
+1LlSVHJ7liXMvGnjSG4N0MedJ5qq+BOS3R7fY581qRY27Iy4g/Q9iY/NtBde17MX
+QRBdJ3NghVdJIgc=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
 MIIGSzCCBDOgAwIBAgIRANm1Q3+vqTkPAAAAAFVlrVgwDQYJKoZIhvcNAQELBQAw
 gb4xCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1FbnRydXN0LCBJbmMuMSgwJgYDVQQL
 Ex9TZWUgd3d3LmVudHJ1c3QubmV0L2xlZ2FsLXRlcm1zMTkwNwYDVQQLEzAoYykg
@@ -107,35 +187,53 @@
 0wD8ofzkpf9/rdcw0Md3f76BB1UwUCAU9Vc4CqgxUQ==
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
-MIIFRzCCAy+gAwIBAgIJEQA0tk7GNi02MA0GCSqGSIb3DQEBCwUAMEExCzAJBgNV
-BAYTAlJPMRQwEgYDVQQKEwtDRVJUU0lHTiBTQTEcMBoGA1UECxMTY2VydFNJR04g
-Uk9PVCBDQSBHMjAeFw0xNzAyMDYwOTI3MzVaFw00MjAyMDYwOTI3MzVaMEExCzAJ
-BgNVBAYTAlJPMRQwEgYDVQQKEwtDRVJUU0lHTiBTQTEcMBoGA1UECxMTY2VydFNJ
-R04gUk9PVCBDQSBHMjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMDF
-dRmRfUR0dIf+DjuW3NgBFszuY5HnC2/OOwppGnzC46+CjobXXo9X69MhWf05N0Iw
-vlDqtg+piNguLWkh59E3GE59kdUWX2tbAMI5Qw02hVK5U2UPHULlj88F0+7cDBrZ
-uIt4ImfkabBoxTzkbFpG583H+u/E7Eu9aqSs/cwoUe+StCmrqzWaTOTECMYmzPhp
-n+Sc8CnTXPnGFiWeI8MgwT0PPzhAsP6CRDiqWhqKa2NYOLQV07YRaXseVO6MGiKs
-cpc/I1mbySKEwQdPzH/iV8oScLumZfNpdWO9lfsbl83kqK/20U6o2YpxJM02PbyW
-xPFsqa7lzw1uKA2wDrXKUXt4FMMgL3/7FFXhEZn91QqhngLjYl/rNUssuHLoPj1P
-rCy7Lobio3aP5ZMqz6WryFyNSwb/EkaseMsUBzXgqd+L6a8VTxaJW732jcZZroiF
-DsGJ6x9nxUWO/203Nit4ZoORUSs9/1F3dmKh7Gc+PoGD4FapUB8fepmrY7+EF3fx
-DTvf95xhszWYijqy7DwaNz9+j5LP2RIUZNoQAhVB/0/E6xyjyfqZ90bp4RjZsbgy
-LcsUDFDYg2WD7rlcz8sFWkz6GZdr1l0T08JcVLwyc6B49fFtHsufpaafItzRUZ6C
-eWRgKRM+o/1Pcmqr4tTluCRVLERLiohEnMqE0yo7AgMBAAGjQjBAMA8GA1UdEwEB
-/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBSCIS1mxteg4BXrzkwJ
-d8RgnlRuAzANBgkqhkiG9w0BAQsFAAOCAgEAYN4auOfyYILVAzOBywaK8SJJ6ejq
-kX/GM15oGQOGO0MBzwdw5AgeZYWR5hEit/UCI46uuR59H35s5r0l1ZUa8gWmr4UC
-b6741jH/JclKyMeKqdmfS0mbEVeZkkMR3rYzpMzXjWR91M08KCy0mpbqTfXERMQl
-qiCA2ClV9+BB/AYm/7k29UMUA2Z44RGx2iBfRgB4ACGlHgAoYXhvqAEBj500mv/0
-OJD7uNGzcgbJceaBxXntC6Z58hMLnPddDnskk7RI24Zf3lCGeOdA5jGokHZwYa+c
-NywRtYK3qq4kNFtyDGkNzVmf9nGvnAvRCjj5BiKDUyUM/FHE5r7iOZULJK2v0ZXk
-ltd0ZGtxTgI8qoXzIKNDOXZbbFD+mpwUHmUUihW9o4JFWklWatKcsWMy5WHgUyIO
-pwpJ6st+H6jiYoD2EEVSmAYY3qXNL3+q1Ok+CHLsIwMCPKaq2LxndD0UF/tUSxfj
-03k9bWtJySgOLnRQvwzZRjoQhsmnP+mg7H/rpXdYaXHmgwo38oZJar55CJD2AhZk
-PuXaTH4MNMn5X7azKFGnpyuqSfqNZSlO42sTp5SjLVFteAxEy9/eCG/Oo2Sr05WE
-1LlSVHJ7liXMvGnjSG4N0MedJ5qq+BOS3R7fY581qRY27Iy4g/Q9iY/NtBde17MX
-QRBdJ3NghVdJIgc=
+MIIFzzCCA7egAwIBAgIUCBZfikyl7ADJk0DfxMauI7gcWqQwDQYJKoZIhvcNAQEL
+BQAwbzELMAkGA1UEBhMCSEsxEjAQBgNVBAgTCUhvbmcgS29uZzESMBAGA1UEBxMJ
+SG9uZyBLb25nMRYwFAYDVQQKEw1Ib25na29uZyBQb3N0MSAwHgYDVQQDExdIb25n
+a29uZyBQb3N0IFJvb3QgQ0EgMzAeFw0xNzA2MDMwMjI5NDZaFw00MjA2MDMwMjI5
+NDZaMG8xCzAJBgNVBAYTAkhLMRIwEAYDVQQIEwlIb25nIEtvbmcxEjAQBgNVBAcT
+CUhvbmcgS29uZzEWMBQGA1UEChMNSG9uZ2tvbmcgUG9zdDEgMB4GA1UEAxMXSG9u
+Z2tvbmcgUG9zdCBSb290IENBIDMwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK
+AoICAQCziNfqzg8gTr7m1gNt7ln8wlffKWihgw4+aMdoWJwcYEuJQwy51BWy7sFO
+dem1p+/l6TWZ5Mwc50tfjTMwIDNT2aa71T4Tjukfh0mtUC1Qyhi+AViiE3CWu4mI
+VoBc+L0sPOFMV4i707mV78vH9toxdCim5lSJ9UExyuUmGs2C4HDaOym71QP1mbpV
+9WTRYA6ziUm4ii8F0oRFKHyPaFASePwLtVPLwpgchKOesL4jpNrcyCse2m5FHomY
+2vkALgbpDDtw1VAliJnLzXNg99X/NWfFobxeq81KuEXryGgeDQ0URhLj0mRiikKY
+vLTGCAj4/ahMZJx2Ab0vqWwzD9g/KLg8aQFChn5pwckGyuV6RmXpwtZQQS4/t+Tt
+bNe/JgERohYpSms0BpDsE9K2+2p20jzt8NYt3eEV7KObLyzJPivkaTv/ciWxNoZb
+x39ri1UbSsUgYT2uy1DhCDq+sI9jQVMwCFk8mB13umOResoQUGC/8Ne8lYePl8X+
+l2oBlKN8W4UdKjk60FSh0Tlxnf0h+bV78OLgAo9uliQlLKAeLKjEiafv7ZkGL7YK
+TE/bosw3Gq9HhS2KX8Q0NEwA/RiTZxPRN+ZItIsGxVd7GYYKecsAyVKvQv83j+Gj
+Hno9UKtjBucVtT+2RTeUN7F+8kjDf8V1/peNRY8apxpyKBpADwIDAQABo2MwYTAP
+BgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAfBgNVHSMEGDAWgBQXnc0e
+i9Y5K3DTXNSguB+wAPzFYTAdBgNVHQ4EFgQUF53NHovWOStw01zUoLgfsAD8xWEw
+DQYJKoZIhvcNAQELBQADggIBAFbVe27mIgHSQpsY1Q7XZiNc4/6gx5LS6ZStS6LG
+7BJ8dNVI0lkUmcDrudHr9EgwW62nV3OZqdPlt9EuWSRY3GguLmLYauRwCy0gUCCk
+MpXRAJi70/33MvJJrsZ64Ee+bs7Lo3I6LWldy8joRTnU+kLBEUx3XZL7av9YROXr
+gZ6voJmtvqkBZss4HTzfQx/0TW60uhdG/H39h4F5ag0zD/ov+BS5gLNdTaqX4fnk
+GMX41TiMJjz98iji7lpJiCzfeT2OnpA8vUFKOt1b9pq0zj8lMH8yfaIDlNDceqFS
+3m6TjRgm/VWsvY+b0s+v54Ysyx8Jb6NvqYTUc79NoXQbTiNg8swOqn+knEwlqLJm
+Ozj/2ZQw9nKEvmhVEA/GcywWaZMH/rFF7buiVWqw2rVKAiUnhde3t4ZEFolsgCs+
+l6mc1X5VTMbeRRAc6uk7nwNT7u56AQIWeNTowr5GdogTPyK7SBIdUgC0An4hGh6c
+JfTzPV4e0hz5sy229zdcxsshTrD3mUcYhcErulWuBurQB7Lcq9CClnXO0lD+mefP
+L5/ndtFhKvshuzHQqp9HpLIiyhY6UFfEW0NnxWViA0kB60PZ2Pierc+xYw5F9KBa
+LJstxabArahH9CdMOA0uG0k7UvToiIMrVCjU8jVStDKDYmlkDJGcn5fqdBb9HxEG
+mpv0
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICQDCCAeWgAwIBAgIMAVRI7yH9l1kN9QQKMAoGCCqGSM49BAMCMHExCzAJBgNV
+BAYTAkhVMREwDwYDVQQHDAhCdWRhcGVzdDEWMBQGA1UECgwNTWljcm9zZWMgTHRk
+LjEXMBUGA1UEYQwOVkFUSFUtMjM1ODQ0OTcxHjAcBgNVBAMMFWUtU3ppZ25vIFJv
+b3QgQ0EgMjAxNzAeFw0xNzA4MjIxMjA3MDZaFw00MjA4MjIxMjA3MDZaMHExCzAJ
+BgNVBAYTAkhVMREwDwYDVQQHDAhCdWRhcGVzdDEWMBQGA1UECgwNTWljcm9zZWMg
+THRkLjEXMBUGA1UEYQwOVkFUSFUtMjM1ODQ0OTcxHjAcBgNVBAMMFWUtU3ppZ25v
+IFJvb3QgQ0EgMjAxNzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABJbcPYrYsHtv
+xie+RJCxs1YVe45DJH0ahFnuY2iyxl6H0BVIHqiQrb1TotreOpCmYF9oMrWGQd+H
+Wyx7xf58etqjYzBhMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0G
+A1UdDgQWBBSHERUI0arBeAyxr87GyZDvvzAEwDAfBgNVHSMEGDAWgBSHERUI0arB
+eAyxr87GyZDvvzAEwDAKBggqhkjOPQQDAgNJADBGAiEAtVfd14pVCzbhhkT61Nlo
+jbjcI4qKDdQvfepz7L9NbKgCIQDLpbQS+ue16M9+k/zzNY9vTlp8tLxOsvxyqltZ
++efcMQ==
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
 MIIGFDCCA/ygAwIBAgIIG3Dp0v+ubHEwDQYJKoZIhvcNAQELBQAwUTELMAkGA1UE
@@ -173,6 +271,39 @@
 GbqEZycPvEJdvSRUDewdcAZfpLz6IHxV
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
+MIIFojCCA4qgAwIBAgIUAZQwHqIL3fXFMyqxQ0Rx+NZQTQ0wDQYJKoZIhvcNAQEM
+BQAwaTELMAkGA1UEBhMCS1IxJjAkBgNVBAoMHU5BVkVSIEJVU0lORVNTIFBMQVRG
+T1JNIENvcnAuMTIwMAYDVQQDDClOQVZFUiBHbG9iYWwgUm9vdCBDZXJ0aWZpY2F0
+aW9uIEF1dGhvcml0eTAeFw0xNzA4MTgwODU4NDJaFw0zNzA4MTgyMzU5NTlaMGkx
+CzAJBgNVBAYTAktSMSYwJAYDVQQKDB1OQVZFUiBCVVNJTkVTUyBQTEFURk9STSBD
+b3JwLjEyMDAGA1UEAwwpTkFWRVIgR2xvYmFsIFJvb3QgQ2VydGlmaWNhdGlvbiBB
+dXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC21PGTXLVA
+iQqrDZBbUGOukJR0F0Vy1ntlWilLp1agS7gvQnXp2XskWjFlqxcX0TM62RHcQDaH
+38dq6SZeWYp34+hInDEW+j6RscrJo+KfziFTowI2MMtSAuXaMl3Dxeb57hHHi8lE
+HoSTGEq0n+USZGnQJoViAbbJAh2+g1G7XNr4rRVqmfeSVPc0W+m/6imBEtRTkZaz
+kVrd/pBzKPswRrXKCAfHcXLJZtM0l/aM9BhK4dA9WkW2aacp+yPOiNgSnABIqKYP
+szuSjXEOdMWLyEz59JuOuDxp7W87UC9Y7cSw0BwbagzivESq2M0UXZR4Yb8Obtoq
+vC8MC3GmsxY/nOb5zJ9TNeIDoKAYv7vxvvTWjIcNQvcGufFt7QSUqP620wbGQGHf
+nZ3zVHbOUzoBppJB7ASjjw2i1QnK1sua8e9DXcCrpUHPXFNwcMmIpi3Ua2FzUCaG
+YQ5fG8Ir4ozVu53BA0K6lNpfqbDKzE0K70dpAy8i+/Eozr9dUGWokG2zdLAIx6yo
+0es+nPxdGoMuK8u180SdOqcXYZaicdNwlhVNt0xz7hlcxVs+Qf6sdWA7G2POAN3a
+CJBitOUt7kinaxeZVL6HSuOpXgRM6xBtVNbv8ejyYhbLgGvtPe31HzClrkvJE+2K
+AQHJuFFYwGY6sWZLxNUxAmLpdIQM201GLQIDAQABo0IwQDAdBgNVHQ4EFgQU0p+I
+36HNLL3s9TsBAZMzJ7LrYEswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMB
+Af8wDQYJKoZIhvcNAQEMBQADggIBADLKgLOdPVQG3dLSLvCkASELZ0jKbY7gyKoN
+qo0hV4/GPnrK21HUUrPUloSlWGB/5QuOH/XcChWB5Tu2tyIvCZwTFrFsDDUIbatj
+cu3cvuzHV+YwIHHW1xDBE1UBjCpD5EHxzzp6U5LOogMFDTjfArsQLtk70pt6wKGm
++LUx5vR1yblTmXVHIloUFcd4G7ad6Qz4G3bxhYTeodoS76TiEJd6eN4MUZeoIUCL
+hr0N8F5OSza7OyAfikJW4Qsav3vQIkMsRIz75Sq0bBwcupTgE34h5prCy8VCZLQe
+lHsIJchxzIdFV4XTnyliIoNRlwAYl3dqmJLJfGBs32x9SuRwTMKeuB330DTHD8z7
+p/8Dvq1wkNoL3chtl1+afwkyQf3NosxabUzyqkn+Zvjp2DXrDige7kgvOtB5CTh8
+piKCk5XQA76+AqAF3SAi428diDRgxuYKuQl1C/AH6GmWNcf7I4GOODm4RStDeKLR
+LBT/DShycpWbXgnbiUSYqqFJu3FS8r/2/yehNq+4tneI3TqkbZs0kNwUXTC/t+sX

_service:tar_scm:stunnel-5.69.tar.gz/tools/openssl.cnf -> _service:tar_scm:stunnel-5.72.tar.gz/tools/openssl.cnf Changed

_service:tar_scm:stunnel-5.69.tar.gz/tools/stunnel.bash -> _service:tar_scm:stunnel-5.72.tar.gz/tools/stunnel.bash Changed

_service:tar_scm:stunnel-5.69.tar.gz/tools/stunnel.conf -> _service:tar_scm:stunnel-5.72.tar.gz/tools/stunnel.conf Changed

_service:tar_scm:stunnel-5.69.tar.gz/tools/stunnel.conf-sample.in -> _service:tar_scm:stunnel-5.72.tar.gz/tools/stunnel.conf-sample.in Changed

_service:tar_scm:stunnel-5.69.tar.gz/tools/stunnel.license -> _service:tar_scm:stunnel-5.72.tar.gz/tools/stunnel.license Changed

_service:tar_scm:stunnel-5.69.tar.gz/tools/stunnel.nsi -> _service:tar_scm:stunnel-5.72.tar.gz/tools/stunnel.nsi Changed

@@ -1,4 +1,4 @@
-# NSIS stunnel installer by Michal Trojnara 1998-2023
+# NSIS stunnel installer by Michal Trojnara 1998-2024
 
 !define /ifndef VERSION testing
 !define /ifndef ARCH win32
@@ -365,6 +365,9 @@
   !if /FileExists "/usr/i686-w64-mingw32/bin/libssp-0.dll"
   File "/usr/i686-w64-mingw32/bin/libssp-0.dll"
   !else
+  !if /FileExists "/usr/lib/gcc/i686-w64-mingw32/12-win32/libssp-0.dll"
+  File "/usr/lib/gcc/i686-w64-mingw32/12-win32/libssp-0.dll"
+  !else
   !if /FileExists "/usr/lib/gcc/i686-w64-mingw32/10-win32/libssp-0.dll"
   File "/usr/lib/gcc/i686-w64-mingw32/10-win32/libssp-0.dll"
   !else
@@ -376,6 +379,9 @@
   !else
   !if /FileExists "/usr/i686-w64-mingw32/sys-root/mingw/bin/libssp-0.dll"
   File "/usr/i686-w64-mingw32/sys-root/mingw/bin/libssp-0.dll"
+  !else
+  !error "32-bit libssp-0.dll not found"
+  !endif
   !endif
   !endif
   !endif
@@ -387,6 +393,9 @@
   !if /FileExists "/usr/x86_64-w64-mingw32/bin/libssp-0.dll"
   File "/usr/x86_64-w64-mingw32/bin/libssp-0.dll"
   !else
+  !if /FileExists "/usr/lib/gcc/x86_64-w64-mingw32/12-win32/libssp-0.dll"
+  File "/usr/lib/gcc/x86_64-w64-mingw32/12-win32/libssp-0.dll"
+  !else
   !if /FileExists "/usr/lib/gcc/x86_64-w64-mingw32/10-win32/libssp-0.dll"
   File "/usr/lib/gcc/x86_64-w64-mingw32/10-win32/libssp-0.dll"
   !else
@@ -398,6 +407,9 @@
   !else
   !if /FileExists "/usr/x86_64-w64-mingw32/sys-root/mingw/bin/libssp-0.dll"
   File "/usr/x86_64-w64-mingw32/sys-root/mingw/bin/libssp-0.dll"
+  !else
+  !error "64-bit libssp-0.dll not found"
+  !endif
   !endif
   !endif
   !endif

_service:tar_scm:stunnel-5.72.tar.gz/tools/stunnel.spec.in Added

@@ -0,0 +1,126 @@
+Name: stunnel
+Version: @PACKAGE_VERSION@
+Release: 1%{?dist}
+Summary: An TLS-encrypting socket wrapper
+Group: Applications/Internet
+License: GPLv2
+URL: https://www.stunnel.org/
+Source0: https://www.stunnel.org/downloads/stunnel-%{version}.tar.gz
+BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
+# util-linux is needed for rename
+BuildRequires: openssl-devel, util-linux
+%if 0%{?fedora} >= 15 || 0%{?rhel} >= 7
+BuildRequires: systemd-units
+Requires(post): systemd-units
+Requires(preun): systemd-units
+Requires(postun): systemd-units
+%endif
+
+%description
+Stunnel is a socket wrapper which can provide TLS (Transport Layer Security) support to ordinary applications. For example, it can be used
+in conjunction with imapd to create an TLS secure IMAP server.
+
+# Do not generate provides for private libraries
+%global __provides_exclude_from ^%{_libdir}/stunnel/.*$
+
+%prep
+%setup -q
+
+%build
+%configure --enable-fips --enable-ipv6 --with-ssl=%{_prefix} \
+ CPPFLAGS="-UPIDFILE -DPIDFILE='\"%{_localstatedir}/run/stunnel.pid\"'"
+make V=1
+
+%install
+make install DESTDIR=%{buildroot}
+# Move the translated man pages to the right subdirectories, and strip off the
+# language suffixes.
+for lang in pl ; do
+ mkdir -p %{buildroot}/%{_mandir}/${lang}/man8
+ mv %{buildroot}/%{_mandir}/man8/*.${lang}.8* %{buildroot}/%{_mandir}/${lang}/man8/
+ rename ".${lang}" "" %{buildroot}/%{_mandir}/${lang}/man8/*
+done
+%if 0%{?fedora} >= 15 || 0%{?rhel} >= 7
+mkdir -p %{buildroot}%{_unitdir}
+cp tools/%{name}.service %{buildroot}%{_unitdir}/%{name}.service
+mkdir -p %{buildroot}%{_datadir}/bash-completion/completions
+cp tools/%{name}.bash %{buildroot}%{_datadir}/bash-completion/completions/%{name}.bash
+%endif
+
+%post
+/sbin/ldconfig
+%if 0%{?fedora} >= 15 || 0%{?rhel} >= 7
+%systemd_post %{name}.service
+%endif
+
+%preun
+%if 0%{?fedora} >= 15 || 0%{?rhel} >= 7
+%systemd_preun %{name}.service
+%endif
+
+%postun
+/sbin/ldconfig
+%if 0%{?fedora} >= 15 || 0%{?rhel} >= 7
+%systemd_postun_with_restart %{name}.service
+%endif
+
+%files
+%{!?_licensedir:%global license %%doc}
+%doc COPYING.md COPYRIGHT.md README.md NEWS.md AUTHORS.md BUGS.md CREDITS.md PORTS.md TODO.md
+%license COPY*
+%lang(en) %doc doc/en/*
+%lang(pl) %doc doc/pl/*
+%{_bindir}/stunnel
+%exclude %{_bindir}/stunnel3
+%exclude %{_datadir}/doc/stunnel
+%{_libdir}/stunnel
+%exclude %{_libdir}/stunnel/libstunnel.la
+%{_mandir}/man8/stunnel.8*
+%lang(pl) %{_mandir}/pl/man8/stunnel.8*
+%dir %{_sysconfdir}/%{name}
+%config %{_sysconfdir}/%{name}/*-sample
+%if 0%{?fedora} >= 15 || 0%{?rhel} >= 7
+%{_unitdir}/%{name}*.service
+%endif
+%config(noreplace) %{_datarootdir}/bash-completion/*
+
+%changelog
+* Fri Feb 24 2023 Małgorzata Olszówka <Malgorzata.Olszowka@stunnel.org>
+- Fixed bash completion support
+- Removed excluding pem files
+
+* Wed Mar 02 2022 Małgorzata Olszówka <Malgorzata.Olszowka@stunnel.org>
+- bash completion support
+
+* Fri Sep 24 2021 Michał Trojnara <Michal.Trojnara@stunnel.org>
+- Added systemd startup for Fedora >= 15 or RHEL >= 7
+- Removed obsolete init startup
+- Removed obsolete logrotate configuration (replaced with journalctl)
+- Removed obsolete tcp_wrappers-devel support
+- Removed creating a dedicated user
+- Simplified the .spec file
+
+* Wed Apr 27 2016 Andrew Colin Kissa <andrew@topdog.za.net> - 5.32-1
+- Added init script that actually works on Redhat
+- Lots of changes and cleanup to improve spec
+
+* Tue May 26 2015 Bill Quayle <Bill.Quayle@citadel.com>
+- updated license specification
+- the manual page is no longer marked as compressed
+- removed outdated documentation files
+- updated minimum required version of OpenSSL
+
+* Fri Sep 09 2005 neeo <neeo@irc.pl>
+- lots of changes and cleanups
+
+* Wed Mar 17 2004 neeo <neeo@irc.pl>
+- updated for 4.05
+
+* Sat Jun 24 2000 Brian Hatch <bri@stunnel.org>
+- updated for 3.8p3
+
+* Wed Jul 14 1999 Dirk O. Siebnich <dok@vossnet.de>
+- updated for 3.5.
+
+* Mon Jun 07 1999 Dirk O. Siebnich <dok@vossnet.de>
+- adapted from sslwrap RPM spec file

Changes of Revision 2