开源软件构建与测试

_service:tar_scm:stunnel.spec Changed

@@ -1,14 +1,14 @@
 Name: stunnel
-Version: 5.48
-Release: 4
+Version: 5.69
+Release: 1
 Summary: Secure traffic running between a TCP client and server
 License: GPLv2
 URL: http://www.stunnel.org/
-Source0: https://www.usenix.org.uk/mirrors/stunnel/archive/5.x/stunnel-%{version}.tar.gz
-Source1: https://www.stunnel.org/downloads/stunnel-%{version}.tar.gz.asc
+Source0: https://www.usenix.org.uk/mirrors/stunnel/archive/5.x/%{name}-%{version}.tar.gz
+Source1: https://www.usenix.org.uk/mirrors/stunnel/archive/5.x/%{name}-%{version}.tar.gz.asc
 Source2: stunnel@.service
 
-BuildRequires: openssl-devel pkgconfig util-linux autoconf automake libtool
+BuildRequires: pkgconfig util-linux autoconf automake libtool compat-openssl11-devel
 BuildRequires: perl-podlators perl nmap-ncat lsof procps-ng systemd
 %{?systemd_requires}
 
@@ -38,7 +38,8 @@
 change_date=`date +%Y.%m.%d`
 sed -i "s/2018\.07\.02/${change_date}/g" `grep "2018\.07\.02" -lr ./`
 sed -i '/yes).*result: no/,+1{s/result: no/result: yes/;s/as_echo "no"/as_echo "yes"/}' configure
-sed -i '/client = yes/a \\ ciphers = PSK' tests/recipes/014_PSK_secrets
+sed -i 's/-fstack-protector/-fstack-protector-strong/' configure
+
 %build
 CFLAGS="$RPM_OPT_FLAGS -fPIC `pkg-config --cflags openssl`"; export CFLAGS
 LDFLAGS="`pkg-config --libs-only-L openssl`"; export LDFLAGS
@@ -68,7 +69,8 @@
 %systemd_postun_with_restart %{name}.service
 
 %files
-%doc COPY*
+%license COPY*
+%doc AUTHORS.md BUGS.md CREDITS.md PORTS.md README.md TODO.md
 %{_bindir}/stunnel
 %exclude %{_bindir}/stunnel3
 %{_libdir}/stunnel
@@ -86,6 +88,12 @@
 %exclude %{_datadir}/doc/stunnel
 
 %changelog
+* Wed Apr 19 2023 yaoxin <yao_xin001@hoperun.com> - 5.69-1
+- Update to 5.69
+
+* Tue Feb 07 2023 wulei <wulei80@h-partners.com> - 5.48-5
+- Fix undefined reference to 'FIPS_mode'
+
 * Thu Sep 10 2020 baizhonggui<baizhonggui@huawei.com> - 5.48-4
 - Modify source0

_service Changed

_service:tar_scm:stunnel-5.48.tar.gz.asc Deleted

_service:tar_scm:stunnel-5.48.tar.gz/AUTHORS Deleted

_service:tar_scm:stunnel-5.48.tar.gz/BUGS Deleted

_service:tar_scm:stunnel-5.48.tar.gz/COPYING Deleted

@@ -1,33 +0,0 @@
-stunnel license (see COPYRIGHT.GPL for detailed GPL conditions)
-
-Copyright (C) 1998-2018 Michal Trojnara
-
-This program is free software; you can redistribute it and/or modify it under
-the terms of the GNU General Public License as published by the Free Software
-Foundation; either version 2 of the License, or (at your option) any later
-version.
-
-This program is distributed in the hope that it will be useful, but WITHOUT
-ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
-FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
-
-You should have received a copy of the GNU General Public License along with
-this program; if not, see <http://www.gnu.org/licenses>.
-
-Linking stunnel statically or dynamically with other modules is making
-a combined work based on stunnel. Thus, the terms and conditions of the
-GNU General Public License cover the whole combination.
-
-In addition, as a special exception, the copyright holder of stunnel gives you
-permission to combine stunnel with free software programs or libraries that
-are released under the GNU LGPL and with code included in the standard release
-of OpenSSL under the OpenSSL License (or modified versions of such code, with
-unchanged license). You may copy and distribute such a system following the
-terms of the GNU GPL for stunnel and the licenses of the other code concerned.
-
-Note that people who make modified versions of stunnel are not obligated to
-grant this special exception for their modified versions; it is their choice
-whether to do so. The GNU General Public License gives permission to release
-a modified version without this exception; this exception also makes it
-possible to release a modified version which carries forward this exception.
-

_service:tar_scm:stunnel-5.48.tar.gz/COPYRIGHT.GPL Deleted

@@ -1,339 +0,0 @@
-		 GNU GENERAL PUBLIC LICENSE
-		 Version 2, June 1991
-
- Copyright (C) 1989, 1991 Free Software Foundation, Inc.
- 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA.
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
-
-			 Preamble
-
- The licenses for most software are designed to take away your
-freedom to share and change it. By contrast, the GNU General Public
-License is intended to guarantee your freedom to share and change free
-software--to make sure the software is free for all its users. This
-General Public License applies to most of the Free Software
-Foundation's software and to any other program whose authors commit to
-using it. (Some other Free Software Foundation software is covered by
-the GNU Library General Public License instead.) You can apply it to
-your programs, too.
-
- When we speak of free software, we are referring to freedom, not
-price. Our General Public Licenses are designed to make sure that you
-have the freedom to distribute copies of free software (and charge for
-this service if you wish), that you receive source code or can get it
-if you want it, that you can change the software or use pieces of it
-in new free programs; and that you know you can do these things.
-
- To protect your rights, we need to make restrictions that forbid
-anyone to deny you these rights or to ask you to surrender the rights.
-These restrictions translate to certain responsibilities for you if you
-distribute copies of the software, or if you modify it.
-
- For example, if you distribute copies of such a program, whether
-gratis or for a fee, you must give the recipients all the rights that
-you have. You must make sure that they, too, receive or can get the
-source code. And you must show them these terms so they know their
-rights.
-
- We protect your rights with two steps: (1) copyright the software, and
-(2) offer you this license which gives you legal permission to copy,
-distribute and/or modify the software.
-
- Also, for each author's protection and ours, we want to make certain
-that everyone understands that there is no warranty for this free
-software. If the software is modified by someone else and passed on, we
-want its recipients to know that what they have is not the original, so
-that any problems introduced by others will not reflect on the original
-authors' reputations.
-
- Finally, any free program is threatened constantly by software
-patents. We wish to avoid the danger that redistributors of a free
-program will individually obtain patent licenses, in effect making the
-program proprietary. To prevent this, we have made it clear that any
-patent must be licensed for everyone's free use or not licensed at all.
-
- The precise terms and conditions for copying, distribution and
-modification follow.
-&#xc;
-		 GNU GENERAL PUBLIC LICENSE
- TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
-
- 0. This License applies to any program or other work which contains
-a notice placed by the copyright holder saying it may be distributed
-under the terms of this General Public License. The "Program", below,
-refers to any such program or work, and a "work based on the Program"
-means either the Program or any derivative work under copyright law:
-that is to say, a work containing the Program or a portion of it,
-either verbatim or with modifications and/or translated into another
-language. (Hereinafter, translation is included without limitation in
-the term "modification".) Each licensee is addressed as "you".
-
-Activities other than copying, distribution and modification are not
-covered by this License; they are outside its scope. The act of
-running the Program is not restricted, and the output from the Program
-is covered only if its contents constitute a work based on the
-Program (independent of having been made by running the Program).
-Whether that is true depends on what the Program does.
-
- 1. You may copy and distribute verbatim copies of the Program's
-source code as you receive it, in any medium, provided that you
-conspicuously and appropriately publish on each copy an appropriate
-copyright notice and disclaimer of warranty; keep intact all the
-notices that refer to this License and to the absence of any warranty;
-and give any other recipients of the Program a copy of this License
-along with the Program.
-
-You may charge a fee for the physical act of transferring a copy, and
-you may at your option offer warranty protection in exchange for a fee.
-
- 2. You may modify your copy or copies of the Program or any portion
-of it, thus forming a work based on the Program, and copy and
-distribute such modifications or work under the terms of Section 1
-above, provided that you also meet all of these conditions:
-
- a) You must cause the modified files to carry prominent notices
- stating that you changed the files and the date of any change.
-
- b) You must cause any work that you distribute or publish, that in
- whole or in part contains or is derived from the Program or any
- part thereof, to be licensed as a whole at no charge to all third
- parties under the terms of this License.
-
- c) If the modified program normally reads commands interactively
- when run, you must cause it, when started running for such
- interactive use in the most ordinary way, to print or display an
- announcement including an appropriate copyright notice and a
- notice that there is no warranty (or else, saying that you provide
- a warranty) and that users may redistribute the program under
- these conditions, and telling the user how to view a copy of this
- License. (Exception: if the Program itself is interactive but
- does not normally print such an announcement, your work based on
- the Program is not required to print an announcement.)
-&#xc;
-These requirements apply to the modified work as a whole. If
-identifiable sections of that work are not derived from the Program,
-and can be reasonably considered independent and separate works in
-themselves, then this License, and its terms, do not apply to those
-sections when you distribute them as separate works. But when you
-distribute the same sections as part of a whole which is a work based
-on the Program, the distribution of the whole must be on the terms of
-this License, whose permissions for other licensees extend to the
-entire whole, and thus to each and every part regardless of who wrote it.
-
-Thus, it is not the intent of this section to claim rights or contest
-your rights to work written entirely by you; rather, the intent is to
-exercise the right to control the distribution of derivative or
-collective works based on the Program.
-
-In addition, mere aggregation of another work not based on the Program
-with the Program (or with a work based on the Program) on a volume of
-a storage or distribution medium does not bring the other work under
-the scope of this License.
-
- 3. You may copy and distribute the Program (or a work based on it,
-under Section 2) in object code or executable form under the terms of
-Sections 1 and 2 above provided that you also do one of the following:
-
- a) Accompany it with the complete corresponding machine-readable
- source code, which must be distributed under the terms of Sections
- 1 and 2 above on a medium customarily used for software interchange; or,
-
- b) Accompany it with a written offer, valid for at least three
- years, to give any third party, for a charge no more than your
- cost of physically performing source distribution, a complete
- machine-readable copy of the corresponding source code, to be
- distributed under the terms of Sections 1 and 2 above on a medium
- customarily used for software interchange; or,
-
- c) Accompany it with the information you received as to the offer
- to distribute corresponding source code. (This alternative is
- allowed only for noncommercial distribution and only if you
- received the program in object code or executable form with such
- an offer, in accord with Subsection b above.)
-
-The source code for a work means the preferred form of the work for
-making modifications to it. For an executable work, complete source
-code means all the source code for all modules it contains, plus any
-associated interface definition files, plus the scripts used to
-control compilation and installation of the executable. However, as a
-special exception, the source code distributed need not include
-anything that is normally distributed (in either source or binary
-form) with the major components (compiler, kernel, and so on) of the
-operating system on which the executable runs, unless that component
-itself accompanies the executable.
-
-If distribution of executable or object code is made by offering
-access to copy from a designated place, then offering equivalent
-access to copy the source code from the same place counts as
-distribution of the source code, even though third parties are not
-compelled to copy the source along with the object code.
-&#xc;
- 4. You may not copy, modify, sublicense, or distribute the Program
-except as expressly provided under this License. Any attempt
-otherwise to copy, modify, sublicense or distribute the Program is
-void, and will automatically terminate your rights under this License.
-However, parties who have received copies, or rights, from you under
-this License will not have their licenses terminated so long as such
-parties remain in full compliance.
-
- 5. You are not required to accept this License, since you have not
-signed it. However, nothing else grants you permission to modify or
-distribute the Program or its derivative works. These actions are
-prohibited by law if you do not accept this License. Therefore, by
-modifying or distributing the Program (or any work based on the
-Program), you indicate your acceptance of this License to do so, and
-all its terms and conditions for copying, distributing or modifying
-the Program or works based on it.
-
- 6. Each time you redistribute the Program (or any work based on the
-Program), the recipient automatically receives a license from the
-original licensor to copy, distribute or modify the Program subject to
-these terms and conditions. You may not impose any further
-restrictions on the recipients' exercise of the rights granted herein.
-You are not responsible for enforcing compliance by third parties to
-this License.
-
- 7. If, as a consequence of a court judgment or allegation of patent
-infringement or for any other reason (not limited to patent issues),
-conditions are imposed on you (whether by court order, agreement or
-otherwise) that contradict the conditions of this License, they do not
-excuse you from the conditions of this License. If you cannot
-distribute so as to satisfy simultaneously your obligations under this
-License and any other pertinent obligations, then as a consequence you
-may not distribute the Program at all. For example, if a patent
-license would not permit royalty-free redistribution of the Program by
-all those who receive copies directly or indirectly through you, then
-the only way you could satisfy both it and this License would be to
-refrain entirely from distribution of the Program.
-
-If any portion of this section is held invalid or unenforceable under
-any particular circumstance, the balance of the section is intended to
-apply and the section as a whole is intended to apply in other
-circumstances.
-
-It is not the purpose of this section to induce you to infringe any
-patents or other property right claims or to contest validity of any
-such claims; this section has the sole purpose of protecting the
-integrity of the free software distribution system, which is
-implemented by public license practices. Many people have made
-generous contributions to the wide range of software distributed
-through that system in reliance on consistent application of that
-system; it is up to the author/donor to decide if he or she is willing
-to distribute software through any other system and a licensee cannot
-impose that choice.
-
-This section is intended to make thoroughly clear what is believed to
-be a consequence of the rest of this License.
-&#xc;
- 8. If the distribution and/or use of the Program is restricted in
-certain countries either by patents or by copyrighted interfaces, the
-original copyright holder who places the Program under this License
-may add an explicit geographical distribution limitation excluding
-those countries, so that distribution is permitted only in or among
-countries not thus excluded. In such case, this License incorporates
-the limitation as if written in the body of this License.
-
- 9. The Free Software Foundation may publish revised and/or new versions
-of the General Public License from time to time. Such new versions will
-be similar in spirit to the present version, but may differ in detail to
-address new problems or concerns.
-
-Each version is given a distinguishing version number. If the Program
-specifies a version number of this License which applies to it and "any
-later version", you have the option of following the terms and conditions
-either of that version or of any later version published by the Free
-Software Foundation. If the Program does not specify a version number of
-this License, you may choose any version ever published by the Free Software
-Foundation.
-
- 10. If you wish to incorporate parts of the Program into other free
-programs whose distribution conditions are different, write to the author
-to ask for permission. For software which is copyrighted by the Free
-Software Foundation, write to the Free Software Foundation; we sometimes
-make exceptions for this. Our decision will be guided by the two goals
-of preserving the free status of all derivatives of our free software and
-of promoting the sharing and reuse of software generally.
-
-			 NO WARRANTY
-
- 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
-FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
-OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
-PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
-OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS
-TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE
-PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
-REPAIR OR CORRECTION.
-
- 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
-REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
-INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
-OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
-TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
-YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
-PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
-POSSIBILITY OF SUCH DAMAGES.
-
-		 END OF TERMS AND CONDITIONS
-&#xc;
-	Appendix: How to Apply These Terms to Your New Programs
-
- If you develop a new program, and you want it to be of the greatest
-possible use to the public, the best way to achieve this is to make it
-free software which everyone can redistribute and change under these terms.
-
- To do so, attach the following notices to the program. It is safest
-to attach them to the start of each source file to most effectively
-convey the exclusion of warranty; and each file should have at least
-the "copyright" line and a pointer to where the full notice is found.
-
- <one line to give the program's name and a brief idea of what it does.>
- Copyright (C) 19yy <name of author>
-
- This program is free software; you can redistribute it and/or modify
- it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
- (at your option) any later version.
-
- This program is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- GNU General Public License for more details.
-
- You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA.
-
-Also add information on how to contact you by electronic and paper mail.
-
-If the program is interactive, make it output a short notice like this
-when it starts in an interactive mode:
-
- Gnomovision version 69, Copyright (C) 19yy name of author
- Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
- This is free software, and you are welcome to redistribute it
- under certain conditions; type `show c' for details.
-
-The hypothetical commands `show w' and `show c' should show the appropriate
-parts of the General Public License. Of course, the commands you use may
-be called something other than `show w' and `show c'; they could even be
-mouse-clicks or menu items--whatever suits your program.
-
-You should also get your employer (if you work as a programmer) or your
-school, if any, to sign a "copyright disclaimer" for the program, if
-necessary. Here is a sample; alter the names:
-
- Yoyodyne, Inc., hereby disclaims all copyright interest in the program
- `Gnomovision' (which makes passes at compilers) written by James Hacker.
-
- <signature of Ty Coon>, 1 April 1989
- Ty Coon, President of Vice
-
-This General Public License does not permit incorporating your program into
-proprietary programs. If your program is a subroutine library, you may
-consider it more useful to permit linking proprietary applications with the
-library. If this is what you want to do, use the GNU Library General
-Public License instead of this License.

_service:tar_scm:stunnel-5.48.tar.gz/CREDITS Deleted

@@ -1,40 +0,0 @@
-stunnel code contributions
-
-
-The code contributions are licensed as public domain unless stated otherwise.
-
-Several Win32 and WCE improvements and bugfixes:
-* Pierre Delaage <delaage.pierre@free.fr>
-
-systemd socket activation in version 5.05:
-Copyright (c) 2014 Mark Theunissen
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of
-this software and associated documentation files (the "Software"), to deal in
-the Software without restriction, including without limitation the rights to
-use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
-of the Software, and to permit persons to whom the Software is furnished to do
-so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
-Several bugfixes and improvements mostly in versions 3.xx:
-* Brian Hatch <bri@stunnel.org>
-
-Initial PTY support in version 3.05:
-* Dirk O. Siebnich <dok@vossnet.de>
-
-Initial SSL support in versions 1.x:
-* Adam Hernik <adas@infocentrum.com>
-* Pawel Krawczyk <kravietz@ceti.com.pl>
-
-and many others...

_service:tar_scm:stunnel-5.48.tar.gz/ChangeLog Deleted

@@ -1,1973 +0,0 @@
-stunnel change log
-
-Version 5.48, 2018.07.02, urgency: HIGH
-* Security bugfixes
- - Fixed requesting client certificate when specified
- as a global option.
-* New features
- - Certificate subject checks modified to accept certificates
- if at least one of the specified checks matches.
-
-Version 5.47, 2018.06.23, urgency: HIGH
-* New features
- - Fast add_lock_callback for OpenSSL < 1.1.0.
- This largely improves performance on heavy load.
- - Automatic detection of Homebrew OpenSSL.
- - Clarified port binding error logs.
- - Various "make test" improvements.
-* Bugfixes
- - Fixed a crash on switching to SNI slave sections.
-
-Version 5.46, 2018.05.28, urgency: MEDIUM
-* New features
- - The default cipher list was updated to a safer value:
- "HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK".
-* Bugfixes
- - Default accept address restored to INADDR_ANY.
-
-Version 5.45, 2018.05.21, urgency: MEDIUM
-* New feature sponsored by https://loadbalancer.org/
- - Implemented delayed deallocation of service sections
- after configuration file reload.
-* Other new features
- - OpenSSL DLLs updated to version 1.0.2o.
- - Deprecated the sslVersion option.
- - The "socket" option is now also available in service sections.
- - Implemented try-restart in the SysV init script (thx to
- Peter Pentchev).
- - TLS 1.3 compliant session handling for OpenSSL 1.1.1.
- - Default "failover" value changed from "rr" to "prio".
- - New "make check" tests.
-* Bugfixes
- - A service no longer refuses to start if binding fails for
- some (but not all) addresses:ports.
- - Fixed compression handling with OpenSSL 1.1.0 and later.
- - _beginthread() replaced with safer _beginthreadex().
- - Fixed exception handling in libwrap.
- - Fixed exec+connect services.
- - Fixed automatic resolver delaying.
- - Fixed a Gentoo cross-compilation bug (thx to Joe Harvell).
- - A number of "make check" framework fixes.
- - Fixed false postive memory leak logs.
- - Build fixes for OpenSSL versions down to 0.9.7.
- - Fixed (again) round-robin failover in the FORK threading model.
-
-Version 5.44, 2017.11.26, urgency: MEDIUM
-* New features
- - Signed Win32 executables, libraries, and installer.
-* Bugfixes
- - Default accept address restored to INADDR_ANY.
- - Fixed a race condition in "make check".
- - Fixed removing the pid file after configuration reload.
-
-Version 5.43, 2017.11.05, urgency: LOW
-* New features
- - OpenSSL DLLs updated to version 1.0.2m.
- - Android build updated to OpenSSL 1.1.0g.
- - Allow for multiple "accept" ports per section.
- - Self-test framework (make check).
- - Added config load before OpenSSL init (thx to Dmitrii Pichulin).
- - OpenSSL 1.1.0 support for Travis CI.
- - OpenSSL 1.1.1-dev compilation fixes.
-* Bugfixes
- - Fixed a memory fault on Solaris.
- - Fixed round-robin failover in the FORK threading model.
- - Fixed handling SSL_ERROR_ZERO_RETURN in SSL_shutdown().
- - Minor fixes of the logging subsystem.
-
-Version 5.42, 2017.07.16, urgency: HIGH
-* New features
- - "redirect" also supports "exec" and not only "connect".
- - PKCS#11 engine DLL updated to version 0.4.7.
-* Bugfixes
- - Fixed premature cron thread initialization causing hangs.
- - Fixed "verifyPeer = yes" on OpenSSL <= 1.0.1.
- - Fixed pthreads support on OpenSolaris.
-
-Version 5.41, 2017.04.01, urgency: MEDIUM
-* New features
- - PKCS#11 engine DLL updated to version 0.4.5.
- - Default engine UI set with ENGINE_CTRL_SET_USER_INTERFACE.
- - Key file name added into the passphrase console prompt.
- - Performance optimization in memory leak detection.
-* Bugfixes
- - Fixed crashes with the OpenSSL 1.1.0 branch.
- - Fixed certificate verification with "verifyPeer = yes"
- and "verifyChain = no" (the default), while the peer
- only returns a single certificate.
-
-Version 5.40, 2017.01.28, urgency: HIGH
-* Security bugfixes
- - OpenSSL DLLs updated to version 1.0.2k.
- https://www.openssl.org/news/secadv/20170126.txt
-* New features
- - DH ciphersuites are now disabled by default.
- - The daily server DH parameter regeneration is only performed if
- DH ciphersuites are enabled in the configuration file.
- - "checkHost" and "checkEmail" were modified to require either
- "verifyChain" or "verifyPeer" (thx to Małorzata Olszówka).
-* Bugfixes
- - Fixed setting default ciphers.
-
-Version 5.39, 2017.01.01, urgency: LOW
-* New features
- - PKCS#11 engine (pkcs11.dll) added to the Win32 build.
- - Per-destination TLS session cache added for the client mode.
- - The new "logId" parameter "process" added to log PID values.
- - Added support for the new SSL_set_options() values.
- - Updated the manual page.
- - Obsolete references to "SSL" replaced with "TLS".
-* Bugfixes
- - Fixed "logId" parameter to also work in inetd mode.
- - "delay = yes" properly enforces "failover = prio".
- - Fixed fd_set allocation size on Win64.
- - Fixed reloading invalid configuration file on Win32.
- - Fixed resolving addresses with unconfigured network interfaces.
-
-Version 5.38, 2016.11.26, urgency: MEDIUM
-* New features
- - "sni=" can be used to prevent sending the SNI extension.
- - The AI_ADDRCONFIG resolver flag is used when available.
- - Merged Debian 06-lfs.patch (thx to Peter Pentchev).
-* Bugfixes
- - Fixed a memory allocation bug causing crashes with OpenSSL 1.1.0.
- - Fixed error handling for mixed IPv4/IPv6 destinations.
- - Merged Debian 08-typos.patch (thx to Peter Pentchev).
-
-Version 5.37, 2016.11.06, urgency: MEDIUM
-* Bugfixes
- - OpenSSL DLLs updated to version 1.0.2j (stops crashes).
- - The default SNI target (not handled by any slave service)
- is handled by the master service rather than rejected.
- - Removed thread synchronization in the FORK threading model.
-
-Version 5.36, 2016.09.22, urgency: HIGH
-* Security bugfixes
- - OpenSSL DLLs updated to version 1.0.2i.
- https://www.openssl.org/news/secadv_20160922.txt
-* New features
- - Added support for OpenSSL 1.1.0 built with "no-deprecated".
- - Removed direct zlib dependency.
-
-Version 5.35, 2016.07.18, urgency: HIGH
-* Bugfixes
- - Fixed incorrectly enforced client certificate requests.
- - Only default to SO_EXCLUSIVEADDRUSE on Vista and later.
- - Fixed thread safety of the configuration file reopening.
-
-Version 5.34, 2016.07.05, urgency: HIGH
-* Security bugfixes
- - Fixed malfunctioning "verify = 4".
-* New features
- - Bind sockets with SO_EXCLUSIVEADDRUSE on WIN32.
- - Added three new service-level options: requireCert, verifyChain,
- and verifyPeer for fine-grained certificate verification control.
- - Improved compatibility with the current OpenSSL 1.1.0-dev tree.
-
-Version 5.33, 2016.06.23, urgency: HIGH
-* New features
- - Improved memory leak detection performance and accuracy.
- - Improved compatibility with the current OpenSSL 1.1.0-dev tree.
- - SNI support also enabled on OpenSSL 0.9.8f and later (thx to
- Guillermo Rodriguez Garcia).
- - Added support for PKCS #12 (.p12/.pfx) certificates (thx to
- Dmitry Bakshaev).
-* Bugfixes
- - Fixed a TLS session caching memory leak (thx to Richard Kraemer).
- Before stunnel 5.27 this leak only emerged with sessiond enabled.
- - Yet another WinCE socket fix (thx to Richard Kraemer).
- - Fixed passphrase/pin dialogs in tstunnel.exe.
- - Fixed a FORK threading build regression bug.
- - OPENSSL_NO_DH compilation fix (thx to Brian Lin).
-
-Version 5.32, 2016.05.03, urgency: HIGH
-* Security bugfixes
- - OpenSSL DLLs updated to version 1.0.2h.
- https://www.openssl.org/news/secadv_20160503.txt
-* New features
- - New "socket = a:IPV6_V6ONLY=yes" option to only bind IPv6.
- - Memory leak detection.
- - Improved compatibility with the current OpenSSL 1.1.0-dev tree.
- - Added/fixed Red Hat scripts (thx to Andrew Colin Kissa).
-* Bugfixes
- - Workaround for a WinCE sockets quirk (thx to Richard Kraemer).
- - Fixed data alignment on 64-bit MSVC (thx to Yuris W. Auzins).
-
-Version 5.31, 2016.03.01, urgency: HIGH
-* Security bugfixes
- - OpenSSL DLLs updated to version 1.0.2g.
- https://www.openssl.org/news/secadv_20160301.txt
-* New features
- - Added logging the list of client CAs requested by the server.
- - Improved compatibility with the current OpenSSL 1.1.0-dev tree.
-* Bugfixes
- - Only reset the watchdog if some data was actually transferred.
- - A workaround implemented for the unexpected exceptfds set by
- select() on WinCE 6.0 (thx to Richard Kraemer).
- - Fixed logging an incorrect value of the round-robin starting
- point (thx to Jose Alf.).
-
-Version 5.30, 2016.01.28, urgency: HIGH
-* Security bugfixes
- - OpenSSL DLLs updated to version 1.0.2f.
- https://www.openssl.org/news/secadv_20160128.txt
-* New features
- - Improved compatibility with the current OpenSSL 1.1.0-dev tree.
- - Added OpenSSL autodetection for the recent versions of Xcode.
-* Bugfixes
- - Fixed references to /etc removed from stunnel.init.in.
- - Stopped even trying -fstack-protector on unsupported platforms
- (thx to Rob Lockhart).
-
-Version 5.29, 2016.01.08, urgency: LOW
-* New features
- - New WIN32 icons.
- - Performance improvement: rwlocks used for locking with pthreads.
-* Bugfixes
- - Compilation fix for *BSD.
- - Fixed configuration file reload for relative stunnel.conf path
- on Unix.
- - Fixed ignoring CRLfile unless CAfile was also specified (thx
- to Strukov Petr).
-
-Version 5.28, 2015.12.11, urgency: HIGH
-* New features
- - Build matrix (.travis.yml) extended with ./configure options.
- - mingw.mak updated to build tstunnel.exe (thx to Jose Alf.).
-* Bugfixes
- - Fixed incomplete initialization.
- - Fixed UCONTEXT threading on OSX.
- - Fixed exit codes for information requests (as
- in "stunnel -version" or "stunnel -help").
-
-Version 5.27, 2015.12.03, urgency: MEDIUM
-* Security bugfixes
- - OpenSSL DLLs updated to version 1.0.2e.
- https://www.openssl.org/news/secadv_20151203.txt
-* New features
- - Automated build testing configured with .travis.yml.
- - Added reading server certificates from hardware engines.
- For example: cert = id_45
- - Only attempt to use potentially harmful compiler or linker
- options if gcc was detected.
- - /opt/csw added to the OpenSSL directory lookup list.
- - mingw.mak updates (thx to Jose Alf.).
- - TODO list updated.
-
-Version 5.26, 2015.11.06, urgency: MEDIUM
-* Bugfixes
- - Compilation fixes for OSX, *BSD and Solaris.
-
-Version 5.25, 2015.11.02, urgency: MEDIUM
-* New features
- - SMTP client protocol negotiation support for
- "protocolUsername", "protocolPassword", and
- "protocolAuthentication" (thx to Douglas Harris).
- - New service-level option "config" to specify configuration
- commands introduced in OpenSSL 1.0.2 (thx to Stephen Wall).
- - The global option "foreground" now also accepts "quiet"
- parameter, which does not enable logging to stderr.
- - Manual page updated.
- - Obsolete OpenSSL engines removed from the Windows build:
- 4758cca, aep, atalla, cswift, nuron, sureware.
- - Improved compatibility with the current OpenSSL 1.1.0-dev tree:
- gracefully handle symbols renamed from SSLeay* to OpenSSL*.
-* Bugfixes
- - Fixed the "s_poll_wait returned 1, but no descriptor
- is ready" internal error.
- - Fixed "exec" hangs due to incorrect thread-local
- storage handling (thx to Philip Craig).
- - Fixed PRNG initialization (thx to Philip Craig).
- - Setting socket options no longer performed on PTYs.
- - Fixed 64-bit Windows build.
-
-Version 5.24, 2015.10.08, urgency: MEDIUM
-* New features
- - Custom CRL verification was replaced with the internal
- OpenSSL functionality.
- - *BSD support for "transparent = destination" and
- client-side "protocol = socks". This feature should
- work at least on FreeBSD, OpenBSD and OS X.
- - Added a new "protocolDomain" option for the NTLM
- authentication (thx to Andreas Botsikas).
- - Improved compatibility of the NTLM phase 1 message (thx
- to Andreas Botsikas).
- - "setuid" and "setgid" options are now also available
- in service sections. They can be used to set owner
- and group of the Unix socket specified with "accept".
- - Added support for the new OpenSSL 1.0.2 SSL options.
- - Added OPENSSL_NO_EGD support (thx to Bernard Spil).
- - VC autodetection added to makew32.bat (thx to Andreas
- Botsikas).
-* Bugfixes
- - Fixed the RESOLVE F0 TOR extension support in SOCKS5.
- - Fixed the error code reported on the failed bind()
- requests.
- - Fixed the sequential log id with the FORK threading.
- - Restored the missing Microsoft.VC90.CRT.manifest file.
-
-Version 5.23, 2015.09.02, urgency: LOW
-* New features
- - Client-side support for the SOCKS protocol.
- See https://www.stunnel.org/socksvpn.html for details.
- - Reject SOCKS requests to connect loopback addresses.
- - New service-level option "OCSPnonce".
- The default value is "OCSPnonce = no".
- - Win32 directory structure rearranged. The installer
- script provides automatic migration for common setups.
- - Added Win32 installer option to install stunnel for the
- current user only. This feature does not deploy the NT
- service, but it also does not require aministrative
- privileges to install and configure stunnel.
- - stunnel.cnf was renamed to openssl.cnf in order to
- to prevent users from mixing it up with stunnel.conf.
- - Win32 desktop is automatically refreshed when the icon
- is created or removed.
- - The ca-certs.pem file is now updated on stunnel upgrade.
- - Inactive ports were removed from the PORTS file.
- - Added IPv6 support to the transparent proxy code.
-* Bugfixes
- - Compilation fix for OpenSSL version older than 1.0.0.
- - Compilation fix for mingw.
-
-Version 5.22, 2015.07.30, urgency: HIGH
-* New features
- - "OCSPaia = yes" added to the configuration file templates.
- - Improved double free detection.
-* Bugfixes
- - Fixed a number of OCSP bugs. The most severe of those
- bugs caused stunnel to treat OCSP responses that failed
- OCSP_basic_verify() checks as if they were successful.
- - Fixed the passive IPv6 resolver (broken in stunnel 5.21).
-
-Version 5.21, 2015.07.27, urgency: MEDIUM
-* New features
- - Signal names are displayed instead of numbers.
- - First resolve IPv4 addresses on passive resolver requests.
- This speeds up stunnel startup on Win32 with a slow/defunct
- DNS service.
- - The "make check" target was modified to only build Win32
- executables when stunnel is built from a git repository (thx
- to Peter Pentchev).
- - More elaborate descriptions were added to the warning about
- using "verify = 2" without "checkHost" or "checkIP".
- - Performance optimization was performed on the debug code.
-* Bugfixes
- - Fixed the FORK and UCONTEXT threading support.
- - Fixed "failover=prio" (broken since stunnel 5.15).
- - Added a retry when sleep(3) was interrupted by a signal
- in the cron thread scheduler.
-
-Version 5.20, 2015.07.09, urgency: HIGH 
-* Security bugfixes
- - OpenSSL DLLs updated to version 1.0.2d.
- https://www.openssl.org/news/secadv_20150709.txt
-* New features
- - poll(2) re-enabled on MacOS X 10.5 and later.
- - Xcode SDK is automatically used on MacOS X if no other
- locally installed OpenSSL directory is found.
- - The SSL library detection algorithm was made a bit smarter.
- - Warnings about insecure authentication were modified to
- include the name of the affected service section.
- - A warning was added to stunnel.init if no pid file was
- specified in the configuration file (thx to Peter Pentchev).
- - Optional debugging symbols are included in the Win32 installer.
- - Documentation updates (closes Debian bug #781669).
-* Bugfixes
- - Signal pipe reinitialization added to prevent turning the
- main accepting thread into a busy wait loop when an external
- condition breaks the signal pipe. This bug was found to
- surface on Win32, but other platforms may also be affected.
- - Fixed removing the disabled taskbar icon.
- - Generated temporary DH parameters are used for configuration
- reload instead of the static defaults.
- - LSB compatibility fixes added to the stunnel.init script (thx
- to Peter Pentchev).
- - Fixed the manual page headers (thx to Gleydson Soares).
-
-Version 5.19, 2015.06.16, urgency: MEDIUM:
-* New features
- - OpenSSL DLLs updated to version 1.0.2c.
- - Added a runtime check whether COMP_zlib() method is implemented
- in order to improve compatibility with the Debian OpenSSL build.
-* Bugfixes
- - Improved socket error handling.
- - Cron thread priority on Win32 platform changed to
- THREAD_PRIORITY_LOWEST to improve portability.
- - Makefile bugfixes for stunnel 5.18 regressions.
- - Fixed some typos in docs and scripts (thx to Peter Pentchev).
- - Fixed a log level check condition (thx to Peter Pentchev).
-
-Version 5.18, 2015.06.12, urgency: MEDIUM:
-* New features
- - OpenSSL DLLs updated to version 1.0.2b.
- https://www.openssl.org/news/secadv_20150611.txt
- - Added "include" configuration file option to include all
- configuration file parts located in a specified directory.
- - Log file is reopened every 24 hours. With "log = overwrite"
- this feature can be used to prevent filling up disk space.
- - Temporary DH parameters are refreshed every 24 hours, unless
- static DH parameters were provided in the certificate file.
- - Unique initial DH parameters are distributed with each release.
- - Warnings are logged on potentially insecure authentication.
- - Improved compatibility with the current OpenSSL 1.1.0-dev tree:
- removed RLE compression support, etc.
- - Updated stunnel.spec (thx to Bill Quayle).
-* Bugfixes
- - Fixed handling of dynamic connect targets.
- - Fixed handling of trailing whitespaces in the Content-Length
- header of the NTLM authentication.
- - Fixed --sysconfdir and --localstatedir handling (thx to
- Dagobert Michelsen).
-
-Version 5.17, 2015.04.29, urgency: HIGH:
-* Bugfixes
- - Fixed a NULL pointer dereference causing the service to crash.
- This bug was introduced in stunnel 5.15.
-
-Version 5.16, 2015.04.19, urgency: MEDIUM:
-* Bugfixes
- - Fixed compilation with old versions of gcc.
-
-Version 5.15, 2015.04.16, urgency: LOW:
-* New features
- - Added new service-level options "checkHost", "checkEmail" and
- "checkIP" for additional checks of the peer certificate subject.
- These options require OpenSSL version 1.0.2 or higher.
- - Win32 binary distribution now ships with the Mozilla root CA
- bundle. This bundle is intended be used together with the new
- "checkHost" option to validate server certs accepted by Mozilla.
- - New commandline options "-reload" to reload the configuration
- file and "-reopen" to reopen the log file of stunnel running
- as a Windows service (thx to Marc McLaughlin).
- - Added session persistence based on negotiated TLS sessions.
- https://en.wikipedia.org/wiki/Load_balancing_%28computing%29#Persistence
- The current implementation does not support external TLS
- session caching with sessiond.
- - MEDIUM ciphers (currently SEED and RC4) are removed from the
- default cipher list.
- - The "redirect" option was improved to not only redirect sessions
- established with an untrusted certificate, but also sessions
- established without a client certificate.
- - OpenSSL version checking modified to distinguish FIPS and
- non-FIPS builds.
- - Improved compatibility with the current OpenSSL 1.1.0-dev tree.
- - Removed support for OpenSSL versions older than 0.9.7.
- The final update for the OpenSSL 0.9.6 branch was 17 Mar 2004.
- - "sessiond" support improved to also work in OpenSSL 0.9.7.
- - Randomize the initial value of the round-robin counter.
- - New stunnel.conf templates are provided for Windows and Unix.
-* Bugfixes
- - Fixed compilation against old versions of OpenSSL.
- - Fixed memory leaks in certificate verification.
-
-Version 5.14, 2015.03.25, urgency: HIGH:
-* Security bugfixes
- - The "redirect" option now also redirects clients on SSL session
- reuse. In stunnel versions 5.00 to 5.13 reused sessions were
- instead always connected hosts specified with the "connect"
- option regardless of their certificate verification result.
- This vulnerability was reported by Johan Olofsson.
-* New features
- - Windows service is automatically restarted after upgrade.
-* Bugfixes
- - Fixed a memory allocation error during Unix daemon shutdown.
- - Fixed handling multiple connect/redirect destinations.
- - OpenSSL FIPS builds are now correctly reported on startup.
-
-Version 5.13, 2015.03.20, urgency: MEDIUM:
-* New features
- - The "service" option was modified to also control the syslog
- service name.
-* Bugfixes
- - Fixed Windows service crash.
-
-Version 5.12, 2015.03.19, urgency: HIGH:
-* Security bugfixes
- - OpenSSL DLLs updated to version 1.0.2a.
- https://www.openssl.org/news/secadv_20150319.txt
-* New features
- - New service-level option "logId" to specify the
- connection identifier type. Currently supported types:
- "sequential" (default), "unique", and "thread".
- - New service-level option "debug" to individually control
- logging verbosity of defined services.
-* Bugfixes
- - OCSP fixed on Windows platform (thx to Alec Kosky).
-
-Version 5.11, 2015.03.11, urgency: LOW:
-* New features
- - OpenSSL DLLs updated to version 1.0.2.
- - Removed dereferences of internal OpenSSL data structures.
- - PSK key lookup algorithm performance improved from
- O(N) (linear) to O(log N) (logarithmic).
-* Bugfixes
- - Fixed peer certificate list in the main window on Win32
- (thx to @fyer for reporting it).
- - Fixed console logging in tstunnel.exe.
- - _tputenv_s() replaced with more portable _tputenv() on Win32.
-
-Version 5.10, 2015.01.22, urgency: LOW:
-* New features
- - OCSP AIA (Authority Information Access) support. This feature
- can be enabled with the new service-level option "OCSPaia".
- - Additional security features of the linker are enabled:
- "-z relro", "-z now", "-z noexecstack".
-* Bugfixes
- - OpenSSL DLLs updated to version 1.0.1l.
- https://www.openssl.org/news/secadv_20150108.txt
- - FIPS canister updated to version 2.0.9 in the Win32 binary
- build.
-
-Version 5.09, 2015.01.02, urgency: LOW:
-* New features
- - Added PSK authentication with two new service-level
- configuration file options "PSKsecrets" and "PSKidentity".
- - Added additional security checks to the OpenSSL memory
- management functions.
- - Added support for the OPENSSL_NO_OCSP and OPENSSL_NO_ENGINE
- OpenSSL configuration flags.
- - Added compatibility with the current OpenSSL 1.1.0-dev tree.
-* Bugfixes
- - Removed defective s_poll_error() code occasionally causing
- connections to be prematurely closed (truncated).
- This bug was introduced in stunnel 4.34.
- - Fixed ./configure systemd detection (thx to Kip Walraven).
- - Fixed ./configure sysroot detection (thx to Kip Walraven).
- - Fixed compilation against old versions of OpenSSL.
- - Removed outdated French manual page.
-
-Version 5.08, 2014.12.09, urgency: MEDIUM:
-* New features
- - Added SOCKS4/SOCKS4a protocol support.
- - Added SOCKS5 protocol support.
- - Added SOCKS RESOLVE F0 TOR extension support.
- - Updated automake to version 1.14.1.
- - OpenSSL directory searching is now relative to the sysroot.
-* Bugfixes
- - Fixed improper hangup condition handling.
- - Fixed missing -pic linker option. This is required for
- Android 5.0 and improves security.
-
-Version 5.07, 2014.11.01, urgency: MEDIUM:
-* New features
- - Several SMTP server protocol negotiation improvements.
- - Added UTF-8 byte order marks to stunnel.conf templates.
- - DH parameters are no longer generated by "make cert".
- The hardcoded DH parameters are sufficiently secure,
- and modern TLS implementations will use ECDH anyway.
- - Updated manual for the "options" configuration file option.
- - Added support for systemd 209 or later.
- - New --disable-systemd ./configure option.
- - setuid/setgid commented out in stunnel.conf-sample.
-* Bugfixes
- - Added support for UTF-8 byte order mark in stunnel.conf.
- - Compilation fix for OpenSSL with disabled SSLv2 or SSLv3.
- - Non-blocking mode set on inetd and systemd descriptors.
- - shfolder.h replaced with shlobj.h for compatibility
- with modern Microsoft compilers.
-
-Version 5.06, 2014.10.15, urgency: HIGH:
-* Security bugfixes
- - OpenSSL DLLs updated to version 1.0.1j.
- https://www.openssl.org/news/secadv_20141015.txt
- - The insecure SSLv2 protocol is now disabled by default.
- It can be enabled with "options = -NO_SSLv2".
- - The insecure SSLv3 protocol is now disabled by default.
- It can be enabled with "options = -NO_SSLv3".
- - Default sslVersion changed to "all" (also in FIPS mode)
- to autonegotiate the highest supported TLS version.
-* New features
- - Added missing SSL options to match OpenSSL 1.0.1j.
- - New "-options" commandline option to display the list
- of supported SSL options.
-* Bugfixes
- - Fixed FORK threading build regression bug.
- - Fixed missing periodic Win32 GUI log updates.
-
-Version 5.05, 2014.10.10, urgency: MEDIUM:
-* New features
- - Asynchronous communication with the GUI thread for faster
- logging on Win32.
- - systemd socket activation (thx to Mark Theunissen).
- - The parameter of "options" can now be prefixed with "-"
- to clear an SSL option, for example:
- "options = -LEGACY_SERVER_CONNECT".
- - Improved "transparent = destination" manual page (thx to
- Vadim Penzin).
-* Bugfixes
- - Fixed POLLIN|POLLHUP condition handling error resulting
- in prematurely closed (truncated) connection.
- - Fixed a null pointer dereference regression bug in the
- "transparent = destination" functionality (thx to
- Vadim Penzin). This bug was introduced in stunnel 5.00.
- - Fixed startup thread synchronization with Win32 GUI.
- - Fixed erroneously closed stdin/stdout/stderr if specified
- as the -fd commandline option parameter.
- - A number of minor Win32 GUI bugfixes and improvements.
- - Merged most of the Windows CE patches (thx to Pierre Delaage).
- - Fixed incorrect CreateService() error message on Win32.
- - Implemented a workaround for defective Cygwin file
- descriptor passing breaking the libwrap support:
- http://wiki.osdev.org/Cygwin_Issues#Passing_file_descriptors
-
-Version 5.04, 2014.09.21, urgency: LOW:
-* New features
- - Support for local mode ("exec" option) on Win32.
- - Support for UTF-8 config file and log file.
- - Win32 UTF-16 build (thx to Pierre Delaage for support).
- - Support for Unicode file names on Win32.
- - A more explicit service description provided for the
- Windows SCM (thx to Pierre Delaage).
- - TCP/IP dependency added for NT service in order to prevent
- initialization failure at boot time.
- - FIPS canister updated to version 2.0.8 in the Win32 binary
- build.
-* Bugfixes
- - load_icon_default() modified to return copies of default icons
- instead of the original resources to prevent the resources
- from being destroyed.
- - Partially merged Windows CE patches (thx to Pierre Delaage).
- - Fixed typos in stunnel.init.in and vc.mak.
- - Fixed incorrect memory allocation statistics update in
- str_realloc().
- - Missing REMOTE_PORT environmental variable is provided to
- processes spawned with "exec" on Unix platforms.
- - Taskbar icon is no longer disabled for NT service.
- - Fixed taskbar icon initialization when commandline options are
- specified.
- - Reportedly more compatible values used for the dwDesiredAccess
- parameter of the CreateFile() function (thx to Pierre Delaage).
- - A number of minor Win32 GUI bugfixes and improvements.
-
-Version 5.03, 2014.08.07, urgency: HIGH:
-* Security bugfixes
- - OpenSSL DLLs updated to version 1.0.1i.
- See https://www.openssl.org/news/secadv_20140806.txt
-* New features
- - FIPS autoconfiguration cleanup.
- - FIPS canister updated to version 2.0.6.
- - Improved SNI diagnostic logging.
-* Bugfixes
- - Compilation fixes for old versions of OpenSSL.
- - Fixed whitespace handling in the stunnel.init script.
-
-Version 5.02, 2014.06.09, urgency: HIGH:
-* Security bugfixes
- - OpenSSL DLLs updated to version 1.0.1h.
- See https://www.openssl.org/news/secadv_20140605.txt
-* New features
- - Major rewrite of the protocol.c interface: it is now possible to add
- protocol negotiations at multiple connection phases, protocols can
- individually decide whether the remote connection will be
- established before or after SSL/TLS is negotiated.
- - Heap memory blocks are wiped before release. This only works for
- block allocated by stunnel, and not by OpenSSL or other libraries.
- - The safe_memcmp() function implemented with execution time not
- dependent on the compared data.
- - Updated the stunnel.conf and stunnel.init templates.
- - Added a client-mode example to the manual.
-* Bugfixes
- - Fixed "failover = rr" broken since version 5.00.
- - Fixed "taskbar = no" broken since version 5.00.
- - Compilation fix for missing SSL_OP_MSIE_SSLV2_RSA_PADDING option.
-
-Version 5.01, 2014.04.08, urgency: HIGH:
-* Security bugfixes
- - OpenSSL DLLs updated to version 1.0.1g.
- This version mitigates TLS heartbeat read overrun (CVE-2014-0160).
-* New features
- - X.509 extensions added to the created self-signed stunnel.pem.
- - "FIPS = no" also allowed in non-FIPS builds of stunnel.
- - Search all certificates with the same subject name for a matching
- public key rather than only the first one (thx to Leon Winter).
- - Create logs in the local application data folder if stunnel folder
- is not writable on Win32.
-* Bugfixes
- - close_notify not sent when SSL still has some data buffered.
- - Protocol negotiation with server-side SNI fixed.
- - A Mac OS X missing symbols fixed.
- - Win32 configuration file reload crash fixed.
- - Added s_pool_free() on exec+connect service retires.
- - Line-buffering enforced on stderr output.
-
-stunnel 5.00 disables some features previously enabled by default.
-Users should review whether the new defaults are appropriate for their
-particular deployments. Packages maintainers may consider prepending
-the old defaults for "fips" (if supported by their OpenSSL library),
-"pid" and "libwrap" to stunnel.conf during automated updates.
-
-Version 5.00, 2014.03.06, urgency: HIGH:
-* Security bugfixes
- - Added PRNG state update in fork threading (CVE-2014-0016).
-* New global configuration file defaults
- - Default "fips" option value is now "no", as FIPS mode is only
- helpful for compliance, and never for actual security.
- - Default "pid" is now "", i.e. not to create a pid file at startup.
-* New service-level configuration file defaults
- - Default "ciphers" updated to "HIGH:MEDIUM:+3DES:+DH:!aNULL:!SSLv2"
- due to AlFBPPS attack and bad performance of DH ciphersuites.
- - Default "libwrap" setting is now "no" to improve performance.
-* New features
- - OpenSSL DLLs updated to version 1.0.1f.
- - zlib DLL updated to version 1.2.8.
- - autoconf scripts upgraded to version 2.69.
- - TLS 1.1 and TLS 1.2 are now allowed in the FIPS mode.
- - New service-level option "redirect" to redirect SSL client
- connections on authentication failures instead of rejecting them.
- - New global "engineDefault" configuration file option to control
- which OpenSSL tasks are delegated to the current engine.
- Available tasks: ALL, RSA, DSA, ECDH, ECDSA, DH, RAND, CIPHERS,
- DIGESTS, PKEY, PKEY_CRYPTO, PKEY_ASN1.
- - New service-level configuration file option "engineId" to select
- the engine by identifier, e.g. "engineId = capi".
- - New global configuration file option "log" to control whether to
- append (the default), or to overwrite log file while (re)opening.
- - Different taskbar icon colors to indicate the service state.
- - New global configuration file options "iconIdle", "iconActive",
- and "iconError" to select status icon on GUI taskbar.
- - Removed the limit of 63 stunnel.conf sections on Win32 platform.
- - Installation of a sample certificate was moved to a separate "cert"
- target in order to allow unattended (e.g. scripted) installations.
- - Reduced length of the logged thread identifier. It is still based
- on the OS thread ID, and thus not unique over long periods of time.
- - Improved readability of error messages printed when stunnel refuses
- to start due to a critical error.
-* Bugfixes
- - LD_PRELOAD Solaris compatibility bug fixed (thx to Norm Jacobs).
- - CRYPTO_NUM_LOCKS replaced with CRYPTO_num_locks() to improve binary
- compatibility with diverse builds of OpenSSL (thx to Norm Jacobs).
- - Corrected round-robin failover behavior under heavy load.
- - Numerous fixes in the engine support code.
- - On Win32 platform .rnd file moved from c:\ to the stunnel folder.
-
-Version 4.57, 2015.04.01, urgency: HIGH:
-* Security bugfixes
- - Added PRNG state update in fork threading (CVE-2014-0016).
-
-Version 4.56, 2013.03.22, urgency: HIGH:
-* New features
- - Win32 installer automatically configures firewall exceptions.
- - Win32 installer configures administrative shortcuts to invoke UAC.
- - Improved Win32 GUI shutdown time.
-* Bugfixes
- - Fixed a regression bug introduced in version 4.55 causing random
- crashes on several platforms, including Windows 7.
- - Fixed startup crashes on some Win32 systems.
- - Fixed incorrect "stunnel -exit" process synchronisation.
- - Fixed FIPS detection with new versions of the OpenSSL library.
- - Failure to open the log file at startup is no longer ignored.
-
-Version 4.55, 2013.03.03, urgency: HIGH:
-* Security bugfixes
- - Buffer overflow vulnerability fixed in the NTLM authentication
- of the CONNECT protocol negotiation.
- See https://www.stunnel.org/CVE-2013-1762.html for details.
- - OpenSSL updated to version 1.0.1e in Win32/Android builds.
-* New features
- - SNI wildcard matching in server mode.
- - Terminal version of stunnel (tstunnel.exe) build for Win32.
-* Bugfixes
- - Fixed write half-close handling in the transfer() function (thx to
- Dustin Lundquist).
- - Fixed EAGAIN error handling in the transfer() function (thx to Jan Bee).
- - Restored default signal handlers before execvp() (thx to Michael Weiser).
- - Fixed memory leaks in protocol negotiation (thx to Arthur Mesh).
- - Fixed a file descriptor leak during configuration file reload (thx to
- Arthur Mesh).
- - Closed SSL sockets were removed from the transfer() c->fds poll.
- - Minor fix in handling exotic inetd-mode configurations.
- - WCE compilation fixes.
- - IPv6 compilation fix in protocol.c.
- - Windows installer fixes.
-
-Version 4.54, 2012.10.09, urgency: MEDIUM:
-* New Win32 features
- - FIPS module updated to version 2.0.
- - OpenSSL DLLs updated to version 1.0.1c.
- - zlib DLL updated to version 1.2.7.
- - Engine DLLs added: 4758cca, aep, atalla, capi, chil, cswift, gmp, gost,
- nuron, padlock, sureware, ubsec.
-* Other new features
- - "session" option renamed to more readable "sessionCacheTimeout".
- The old name remains accepted for backward compatibility.
- - New service-level "sessionCacheSize" option to control session cache size.
- - New service-level option "reset" to control whether TCP RST flag is used
- to indicate errors. The default value is "reset = yes".
- - New service-level option "renegotiation" to disable SSL renegotiation.
- This feature is based on a public-domain patch by Janusz Dziemidowicz.
- - New FreeBSD socket options: IP_FREEBIND, IP_BINDANY, IPV6_BINDANY (thx
- to Janusz Dziemidowicz).
- - New parameters to configure TLS v1.1/v1.2 with OpenSSL version 1.0.1
- or higher (thx to Henrik Riomar).
-* Bugfixes
- - Fixed "Application Failed to Initialize Properly (0xc0150002)" error.
- - Fixed missing SSL state debug log entries.
- - Fixed a race condition in libwrap code resulting in random stalls (thx
- to Andrew Skalski).
- - Session cache purged at configuration file reload to reduce memory leak.
- Remaining leak of a few kilobytes per section is yet to be fixed.
- - Fixed a regression bug in "transparent = destination" functionality (thx
- to Stefan Lauterbach). This bug was introduced in stunnel 4.51.
- - "transparent = destination" is now a valid endpoint in inetd mode.
- - "delay = yes" fixed to work even if specified *after* "connect" option.
- - Multiple "connect" targets fixed to also work with delayed resolver.
- - The number of resolver retries of EAI_AGAIN error has been limited to 3
- in order to prevent infinite loops.
-
-Version 4.53, 2012.03.19, urgency: MEDIUM:
-* New features
- - Added client-mode "sni" option to directly control the value of
- TLS Server Name Indication (RFC 3546) extension.
- - Added support for IP_FREEBIND socket option with a pached Linux kernel.
- - Glibc-specific dynamic allocation tuning was applied to help unused memory
- deallocation.
- - Non-blocking OCSP implementation.
-* Bugfixes
- - Compilation fixes for old versions of OpenSSL (tested against 0.9.6).
- - Usage of uninitialized variables fixed in exec+connect services.
- - Occasional logging subsystem crash with exec+connect services.
- - OpenBSD compilation fix (thx to Michele Orru').
- - Session id context initialized with session name rather than a constant.
- - Fixed handling of a rare inetd mode use case, where either stdin or stdout
- is a socket, but not both of them at the same time.
- - Fixed missing OPENSSL_Applink http://www.openssl.org/support/faq.html#PROG2
- - Fixed crash on termination with FORK threading model.
- - Fixed dead canary after configuration reload with open connections.
- - Fixed missing file descriptors passed to local mode processes.
- - Fixed required jmp_buf alignment on Itanium platform.
- - Removed creating /dev/zero in the chroot jail on Solaris platform.
- - Fixed detection of WSAECONNREFUSED Winsock error.
- - Missing Microsoft.VC90.CRT.manifest added to Windows installer.
-
-Version 4.52, 2012.01.12, urgency: MEDIUM:
-* Bugfixes
- - Fixed write closure notification for non-socket file descriptors.
- - Removed a line logged to stderr in inetd mode.
- - Fixed "Socket operation on non-socket" error in inetd mode on Mac OS X
- platform.
- - Removed direct access to the fields of the X509_STORE_CTX data structure.
-
-Version 4.51, 2012.01.09, urgency: MEDIUM:
-* New features
- - Updated Win32 binary distribution OpenSSL DLLs to version 0.9.8s-fips.
- - Updated Android binary OpenSSL to version 1.0.0f.
- - Zlib support added to Win32 and Android binary builds.
- - New "compression = deflate" global option to enable RFC 2246 compresion.
- For compatibility with previous versions "compression = zlib" and
- "compression = rle" also enable the deflate (RFC 2246) compression.
- - Compression is disabled by default.
- - Separate default ciphers and sslVersion for "fips = yes" and "fips = no".
- - UAC support for editing configuration file with Windows GUI.
-* Bugfixes
- - Fixed exec+connect sections.
- - Added a workaround for broken Android getaddrinfo():
- http://stackoverflow.com/questions/7818246/segmentation-fault-in-getaddrinfo
-
-Version 4.50, 2011.12.03, urgency: MEDIUM:
-* New features
- - Added Android port.
- - Updated INSTALL.FIPS.
-* Bugfixes
- - Fixed internal memory allocation problem in inetd mode.
- - Fixed FIPS mode on Microsoft Vista, Server 2008, and Windows 7.
- This fix required to compile OpenSSL FIPS-compliant DLLs with MSVC 9.0,
- instead of MSVC 10.0. msvcr100.dll was replaced with msvcr90.dll.
- GPL compatibility issues are explained in the GPL FAQ:
- http://www.gnu.org/licenses/gpl-faq.html#WindowsRuntimeAndGPL
- - POP3 server-side protocol negotiation updated to report STLS
- capability (thx to Anthony Morgan).
-
-Version 4.49, 2011.11.28, urgency: MEDIUM:
-* Bugfixes
- - Missing Microsoft Visual C++ Redistributable (msvcr100.dll) required
- by FIPS-compliant OpenSSL library was added to the Windows installer.
- - A bug was fixed causing crashes on MacOS X and some other platforms.
-
-Version 4.48, 2011.11.26, urgency: MEDIUM:
-* New features
- - FIPS support on Win32 platform added. OpenSSL 0.9.8r DLLs based on
- FIPS 1.2.3 canister are included with this version of stunnel. FIPS
- mode can be disabled with "fips = no" configuration file option.
-* Bugfixes
- - Fixed canary initialization problem on Win32 platform.
-
-Version 4.47, 2011.11.21, urgency: MEDIUM:
-* Internal improvements
- - CVE-2010-3864 workaround improved to check runtime version of OpenSSL
- rather than compiled version, and to allow OpenSSL 0.x.x >= 0.9.8p.
- - Encoding of man page sources changed to UTF-8.
-* Bugfixes
- - Handling of socket/SSL close in transfer() function was fixed.
- - Logging was modified to save and restore system error codes.
- - Option "service" was restricted to Unix, as since stunnel 4.42 it
- wasn't doing anything useful on Windows platform.
-
-Version 4.46, 2011.11.04, urgency: LOW:
-* New features
- - Added Unix socket support (e.g. "connect = /var/run/stunnel/socket").
- - Added "verify = 4" mode to ignore CA chain and only verify peer certificate.
- - Removed the limit of 16 IP addresses for a single 'connect' option.
- - Removed the limit of 256 stunnel.conf sections in PTHREAD threading model.
- It is still not possible have more than 63 sections on Win32 platform.
- http://msdn.microsoft.com/en-us/library/windows/desktop/ms740141(v=vs.85).aspx
-* Optimizations
- - Reduced per-connection memory usage.
- - Performed a major refactoring of internal data structures. Extensive
- internal testing was performed, but some regression bugs are expected.
-* Bugfixes
- - Fixed Win32 compilation with Mingw32.
- - Fixed non-blocking API emulation layer in UCONTEXT threading model.
- - Fixed signal handling in UCONTEXT threading model.
-
-Version 4.45, 2011.10.24, urgency: LOW:
-* New features
- - "protocol = proxy" support to send original client IP address to haproxy:
- http://haproxy.1wt.eu/download/1.5/doc/proxy-protocol.txt
- This requires accept-proxy bind option of haproxy 1.5-dev3 or later.
- - Added Win32 configuration reload without a valid configuration loaded.
- - Added compatibility with LTS OpenSSL versions 0.9.6 and 0.9.7.
- Some features are only available in OpenSSL 1.0.0 and later.
-* Performance optimizations
- - Use SSL_MODE_RELEASE_BUFFERS if supported by the OpenSSL library.
- - Libwrap helper processes are no longer started if libwrap is disabled
- in all sections of the configuration file.
-* Internal improvements
- - Protocol negotiation framework was rewritten to support additional
- code to be executed after SSL_accept()/SSL_connect().
- - Handling of memory allocation errors was rewritten to gracefully
- terminate the process (thx to regenrecht for the idea).
-* Bugfixes
- - Fixed -l option handling in stunnel3 script (thx to Kai Gülzau).
- - Script to build default stunnel.pem was fixed (thx to Sebastian Kayser).
- - MinGW compilation script (mingw.mak) was fixed (thx to Jose Alf).
- - MSVC compilation script (vc.mak) was fixed.
- - A number of problems in WINSOCK error handling were fixed.
-
-Version 4.44, 2011.09.17, urgency: MEDIUM:
-* New features
- - Major automake/autoconf cleanup.
- - Heap buffer overflow protection with canaries.
- - Stack buffer overflow protection with -fstack-protector.
-* Bugfixes
- - Fixed garbled error messages on errors with setuid/setgid options.
- - SNI fixes (thx to Alexey Drozdov).
- - Use after free in fdprintf() (thx to Alexey Drozdov).
- This issue might cause GPF with "protocol" or "ident" options.
-
-Version 4.43, 2011.09.07, urgency: MEDIUM:
-* New features
- - Updated Win32 DLLs for OpenSSL 1.0.0e.
- - Major optimization of the logging subsystem.
- Benchmarks indicate up to 15% stunnel performance improvement.
-* Bugfixes
- - Fixed Win32 configuration file reload.
- - Fixed FORK and UCONTEXT threading models.
- - Corrected INSTALL.W32 file.
-
-Version 4.42, 2011.08.18, urgency: HIGH:
-* New features
- - New verify level 0 to request and ignore peer certificate. This
- feature is useful with the new Windows GUI menu to save cached peer
- certificate chains, as SSL client certificates are not sent by default.
- - Manual page has been updated.
- - Removed support for changing Windows Service name with "service" option.
-* Bugfixes
- - Fixed a heap corruption vulnerability in versions 4.40 and 4.41. It may
- possibly be leveraged to perform DoS or remote code execution attacks.
- - The -quiet commandline option was applied to *all* message boxes.
- - Silent install (/S option) no longer attempts to create stunnel.pem.
-
-Version 4.41, 2011.07.25, urgency: MEDIUM:
-* Bugfixes
- - Fixed Windows service crash of stunnel 4.40.
-
-Version 4.40, 2011.07.23, urgency: LOW:
-* New Win32 features
- - Added a GUI menu to save cached peer certificate chains.
- - Added comandline "-exit" option to stop stunnel *not* running
- as a service. This option may be useful for scripts.
- - Added file version information to stunnel.exe.
- - A number of other GUI improvements.
-* Other new features
- - Hardcoded 2048-bit DH parameters are used as a fallback if DH parameters
- are not provided in stunnel.pem.
- - Default "ciphers" value updated to prefer ECDH:
- "ALL:!SSLv2:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH".
- - Default ECDH curve updated to "prime256v1".
- - Removed support for temporary RSA keys (used in obsolete export ciphers).
-
-Version 4.39, 2011.07.06, urgency: LOW:
-* New features
- - New Win32 installer module to build self-signed stunnel.pem.
- - Added configuration file editing with Windows GUI.
- - Added log file reopening file editing with Windows GUI.
- It might be useful to also implement log file rotation.
- - Improved configuration file reload with Windows GUI.
-
-Version 4.38, 2011.06.28, urgency: MEDIUM:
-* New features
- - Server-side SNI implemented (RFC 3546 section 3.1) with a new
- service-level option "nsi".
- - "socket" option also accepts "yes" and "no" for flags.
- - Nagle's algorithm is now disabled by default for improved interactivity.
-* Bugfixes
- - A compilation fix was added for OpenSSL version < 1.0.0.
- - Signal pipe set to non-blocking mode. This bug caused hangs of stunnel
- features based on signals, e.g. local mode, FORK threading, or
- configuration file reload on Unix. Win32 platform was not affected.
-
-Version 4.37, 2011.06.17, urgency: MEDIUM:
-* New features
- - Client-side SNI implemented (RFC 3546 section 3.1).
- - Default "ciphers" changed from the OpenSSL default to a more secure
- and faster "RC4-MD5:HIGH:!aNULL:!SSLv2".
- A paranoid (and usually slower) setting would be "HIGH:!aNULL:!SSLv2".
- - Recommended "options = NO_SSLv2" added to the sample stunnel.conf file.
- - Default client method upgraded from SSLv3 to TLSv1.
- To connect servers without TLS support use "sslVersion = SSLv3" option.
- - Improved --enable-fips and --disable-fips ./configure option handling.
- - On startup stunnel now compares the compiled version of OpenSSL against
- the running version of OpenSSL. A warning is logged on mismatch.
-* Bugfixes
- - Non-blocking socket handling in local mode fixed (Debian bug #626856).
- - UCONTEXT threading mode fixed.
- - Removed the use of gcc Thread-Local Storage for improved portability.
- - va_copy macro defined for platforms that do not have it.
- - Fixed "local" option parsing on IPv4 systems.
- - Solaris compilation fix (redefinition of "STR").
-
-Version 4.36, 2011.05.03, urgency: LOW:
-* New features
- - Updated Win32 DLLs for OpenSSL 1.0.0d.
- - Dynamic memory management for strings manipulation:
- no more static STRLEN limit, lower stack footprint.
- - Strict public key comparison added for "verify = 3" certificate
- checking mode (thx to Philipp Hartwig).
- - Backlog parameter of listen(2) changed from 5 to SOMAXCONN:
- improved behavior on heavy load.
- - Example tools/stunnel.service file added for systemd service manager.
-* Bugfixes
- - Missing pthread_attr_destroy() added to fix memory leak (thx to
- Paul Allex and Peter Pentchev).
- - Fixed the incorrect way of setting FD_CLOEXEC flag.
- - Fixed --enable-libwrap option of ./configure script.
- - /opt/local added to OpenSSL search path for MacPorts compatibility.
- - Workaround implemented for signal handling on MacOS X.
- - A trivial bug fixed in the stunnel.init script.
- - Retry implemented on EAI_AGAIN error returned by resolver calls.
-
-Version 4.35, 2011.02.05, urgency: LOW:
-* New features
- - Updated Win32 DLLs for OpenSSL 1.0.0c.
- - Transparent source (non-local bind) added for FreeBSD 8.x.
- - Transparent destination ("transparent = destination") added for Linux.
-* Bugfixes
- - Fixed reload of FIPS-enabled stunnel.
- - Compiler options are now auto-detected by ./configure script
- in order to support obsolete versions of gcc.
- - Async-signal-unsafe s_log() removed from SIGTERM/SIGQUIT/SIGINT handler.
- - CLOEXEC file descriptor leaks fixed on Linux >= 2.6.28 with glibc >= 2.10.
- Irreparable race condition leaks remain on other Unix platforms.
- This issue may have security implications on some deployments:
- http://udrepper.livejournal.com/20407.html
- - Directory lib64 included in the OpenSSL library search path.
- - Windows CE compilation fixes (thx to Pierre Delaage).
- - Deprecated RSA_generate_key() replaced with RSA_generate_key_ex().
-* Domain name changes (courtesy of Bri Hatch)
- - http://stunnel.mirt.net/ --> http://www.stunnel.org/
- - ftp://stunnel.mirt.net/ --> http://ftp.stunnel.org/
- - stunnel.mirt.net::stunnel --> rsync.stunnel.org::stunnel
- - stunnel-users@mirt.net --> stunnel-users@stunnel.org
- - stunnel-announce@mirt.net --> stunnel-announce@stunnel.org
-
-Version 4.34, 2010.09.19, urgency: LOW:
-* New features
- - Updated Win32 DLLs for OpenSSL 1.0.0a.
- - Updated Win32 DLLs for zlib 1.2.5.
- - Updated automake to version 1.11.1
- - Updated libtool to version 2.2.6b
- - Added ECC support with a new service-level "curve" option.
- - DH support is now enabled by default.
- - Added support for OpenSSL builds with some algorithms disabled.
- - ./configure modified to support cross-compilation.
- - Sample stunnel.init updated based on Debian init script.
-* Bugfixes
- - Implemented fixes in user interface to enter engine PIN.
- - Fixed a transfer() loop issue on socket errors.
- - Fixed missing Win32 taskbar icon while displaying a global option error.
-
-Version 4.33, 2010.04.05, urgency: MEDIUM:
-* New features
- - Win32 DLLs for OpenSSL 1.0.0.
- This library requires to c_rehash CApath/CRLpath directories on upgrade.
- - Win32 DLLs for zlib 1.2.4.
- - Experimental support for local mode on Win32 platform.
- Try "exec = c:\windows\system32\cmd.exe".
-* Bugfixes
- - Inetd mode fixed.
-
-Version 4.32, 2010.03.24, urgency: MEDIUM:
-* New features
- - New service-level "libwrap" option for run-time control whether
- /etc/hosts.allow and /etc/hosts.deny are used for access control.
- Disabling libwrap significantly increases performance of stunnel.
- - Win32 DLLs for OpenSSL 0.9.8m.
-* Bugfixes
- - Fixed a transfer() loop issue with SSLv2 connections.
- - Fixed a "setsockopt IP_TRANSPARENT" warning with "local" option.
- - Logging subsystem bugfixes and cleanup.
- - Installer bugfixes for Vista and later versions of Windows.
- - FIPS mode can be enabled/disabled at runtime.
-
-Version 4.31, 2010.02.03, urgency: MEDIUM:
-* New features
- - Log file reopen on USR1 signal was added.
-* Bugfixes
- - Some regression issues introduced in 4.30 were fixed.
-
-Version 4.30, 2010.01.21, urgency: LOW/EXPERIMENTAL:
-* New features
- - Graceful configuration reload with HUP signal on Unix
- and with GUI on Windows.
-
-Version 4.29, 2009.12.02, urgency: MEDIUM:
-* New feature sponsored by Searchtech Limited http://www.astraweb.com/
- - sessiond, a high performance SSL session cache was built for stunnel.
- A new service-level "sessiond" option was added. sessiond is
- available for download on ftp://ftp.stunnel.org/stunnel/sessiond/ .
- stunnel clusters will be a lot faster, now!
-* Bugfixes
- - "execargs" defaults to the "exec" parameter (thx to Peter Pentchev).
- - Compilation fixes added for AIX and old versions of OpenSSL.
- - Missing "fips" option was added to the manual.
-
-Version 4.28, 2009.11.08, urgency: MEDIUM:
-* New features
- - Win32 DLLs for OpenSSL 0.9.8l.
- - Transparent proxy support on Linux kernels >=2.6.28.
- See the manual for details.
- - New socket options to control TCP keepalive on Linux:
- TCP_KEEPCNT, TCP_KEEPIDLE, TCP_KEEPINTVL.
- - SSL options updated for the recent version of OpenSSL library.
-* Bugfixes
- - A serious bug in asynchronous shutdown code fixed.
- - Data alignment updated in libwrap.c.
- - Polish manual encoding fixed.
- - Notes on compression implementation in OpenSSL added to the manual.
-
-Version 4.27, 2009.04.16, urgency: MEDIUM:
-* New features
- - Win32 DLLs for OpenSSL 0.9.8k.
- - FIPS support was updated for openssl-fips 1.2.
- - New priority failover strategy for multiple "connect" targets,
- controlled with "failover=rr" (default) or "failover=prio".
- - pgsql protocol negotiation by Marko Kreen <markokr@gmail.com>.
- - Building instructions were updated in INSTALL.W32 file.
-* Bugfixes
- - Libwrap helper processes fixed to close standard
- input/output/error file descriptors.
- - OS2 compilation fixes.
- - WCE fixes by Pierre Delaage <delaage.pierre@free.fr>.
-
-Version 4.26, 2008.09.20, urgency: MEDIUM:
-* New features
- - Win32 DLLs for OpenSSL 0.9.8i.
- - /etc/hosts.allow and /etc/hosts.deny no longer need to be
- copied to the chrooted directory, as the libwrap processes
- are no longer chrooted.
- - A more informative error messages for invalid port number
- specified in stunnel.conf file.
- - Support for Microsoft Visual C++ 9.0 Express Edition.
-* Bugfixes
- - Killing all libwrap processes at stunnel shutdown fixed.
- - A minor bug in stunnel.init sample SysV startup file fixed.
-
-Version 4.25, 2008.06.01, urgency: MEDIUM:
-* New features
- - Win32 DLLs for OpenSSL 0.9.8h.
-* Bugfixes
- - Spawning libwrap processes delayed until privileges are dropped.
- - Compilation fix for systems without struct msghdr.msg_control.
-
-Version 4.24, 2008.05.19, urgency: HIGH:
-* Bugfixes
- - OCSP code was fixed to properly reject revoked certificates.
-
-Version 4.23, 2008.05.03, urgency: HIGH:
-* Bugfixes
- - Local privilege escalation bug on Windows NT based
- systems fixed. A local user could exploit stunnel
- running as a service to gain localsystem privileges.
-
-Version 4.22, 2008.03.28, urgency: MEDIUM:
-* New features
- - Makefile was updated to use standard autoconf variables:
- sysconfdir, localstatedir and pkglibdir.
- - A new global option to control logging to syslog:
- syslog = yes|no
- Simultaneous logging to a file and the syslog is now possible.
- - A new service-level option to control stack size:
- stack = <number of bytes>
-* Bugfixes
- - Restored chroot() to be executed after decoding numerical
- userid and groupid values in drop_privileges().
- - A few bugs fixed the in the new libwrap support code.
- - TLSv1 method used by default in FIPS mode instead of
- SSLv3 client and SSLv23 server methods.
- - OpenSSL GPL license exception update based on
- http://www.gnu.org/licenses/gpl-faq.html#GPLIncompatibleLibs
-
-Version 4.21, 2007.10.27, urgency: LOW/EXPERIMENTAL:
-* New features sponsored by Open-Source Software Institute
- - Initial FIPS 140-2 support (see INSTALL.FIPS for details).
- Win32 platform is not currently supported.
-* New features
- - Experimental fast support for non-MT-safe libwrap is provided
- with pre-spawned processes.
- - Stunnel binary moved from /usr/local/sbin to /usr/local/bin
- in order to meet FHS and LSB requirements.
- Please delete the /usr/local/sbin/stunnel when upgrading.
- - Added code to disallow compiling stunnel with pthreads when
- OpenSSL is compiled without threads support.
- - Win32 DLLs for OpenSSL 0.9.8g.
- - Minor manual update.
- - TODO file updated.
-* Bugfixes
- - Dynamic locking callbacks added (needed by some engines to work).
- - AC_ARG_ENABLE fixed in configure.am to accept yes/no arguments.
- - On some systems libwrap requires yp_get_default_domain from libnsl,
- additional checking for libnsl was added to the ./configure script.
- - Sending a list of trusted CAs for the client to choose the right
- certificate restored.
- - Some compatibility issues with NTLM authentication fixed.
- - Taskbar icon (unless there is a config file parsing error) and
- "Save As" disabled in the service mode for local Win32 security
- (it's much like Yeti -- some people claim they have seen it).
-
-Version 4.20, 2006.11.30, urgency: MEDIUM:
-* Release notes
- - The new transfer() function has been well tested.
- I recommend upgrading any previous version with this one.
-* Bugfixes
- - Fixed support for encrypted passphrases on Unix (broken in 4.19).
- - Reduced amount of debug logs.
- - A minor man page update.
-
-Version 4.19, 2006.11.11, urgency: LOW/EXPERIMENTAL:
-* Release notes
- - There are a lot of new features in this version. I recommend
- to test it well before upgrading your mission-critical systems.
-* New features
- - New service-level option to specify an OCSP responder flag:
- OCSPflag = <flag>
- - "protocolCredentials" option changed to "protocolUsername"
- and "protocolPassword"
- - NTLM support to be enabled with the new service-level option:
- protocolAuthentication = NTLM
- - imap protocol negotiation support added.
- - Passphrase cache was added so the user does not need to reenter
- the same passphrase for each defined service any more.
- - New service-level option to retry exec+connect section:
- retry = yes|no
- - Local IP and port is logged for each established connection.
- - Win32 DLLs for OpenSSL 0.9.8d.
-* Bugfixes
- - Serious problem with SSL_WANT_* retries fixed.
- The new code requires extensive testing!
-
-Version 4.18, 2006.09.26, urgency: MEDIUM:
-* Bugfixes
- - GPF on entering private key pass phrase on Win32 fixed.
- - Updated OpenSSL Win32 DLLs.
- - Minor configure script update.
-
-Version 4.17, 2006.09.10, urgency: MEDIUM:
-* New features
- - Win32 DLLs for OpenSSL 0.9.8c.
-* Bugfixes
- - Problem with detecting getaddrinfo() in ./configure fixed.
- - Compilation problem due to misplaced #endif in ssl.c fixed.
- - Duplicate 220 in smtp_server() function in protocol.c fixed.
- - Minor os2.mak update.
- - Minor update of safestring()/safename() macros.
-
-Version 4.16, 2006.08.31, urgency: MEDIUM:
-* New features sponsored by Hewlett-Packard
- - A new global option to control engine:
- engineCtrl = <command>:<parameter>
- - A new service-level option to select engine to read private key:
- engineNum = <engine number>
- - OCSP support:
- ocsp = <URL>
-* New features
- - A new option to select version of SSL protocol:
- sslVersion = all|SSLv2|SSLv3|TLSv1
- - Visual Studio vc.mak by David Gillingham <dgillingham@gmail.com>.
- - OS2 support by Paul Smedley (http://smedley.info)
-* Bugfixes
- - An ordinary user can install stunnel again.
- - Compilation problem with --enable-dh fixed.
- - Some minor compilation warnings fixed.
- - Service-level CRL cert store implemented.
- - GPF on protocol negotiations fixed.
- - Problem detecting addrinfo() on Tru64 fixed.
- - Default group is now detected by configure script.
- - Check for maximum number of defined services added.
- - OpenSSL_add_all_algorithms() added to SSL initialization.
- - configure script sections reordered to detect pthread library functions.
- - RFC 2487 autodetection improved. High resolution s_poll_wait()
- not currently supported by UCONTEXT threading.
- - More precise description of cert directory file names (thx to Muhammad
- Muquit).
-* Other changes
- - Maximum number of services increased from 64 to 256 when poll() is used.
-
-Version 4.15, 2006.03.11, urgency: LOW:
-* Release notes
- - There are a lot of new features in this version. I recommend
- to test it well before upgrading your mission-critical systems.
-* Bugfixes
- - Fix for pthreads on Solaris 10.
- - Attempt to autodetect socklen_t type in configure script.
- - Default threading model changed to pthread for better portability.
- - DH parameters are not included in the certificate by default.
-* New features sponsored by Software House http://www.swhouse.com/
- - Most SSL-related options (including client, cert, key) are now
- available on service-level, so it is possible to have an SSL
- client and an SSL server in a single stunnel process.
- - Windows CE (version 3.0 and higher) support.
-* New features
- - Client mode CONNECT protocol support (RFC 2817 section 5.2).
- http://www.ietf.org/rfc/rfc2817.txt
- - Retrying exec+connect services added.
-* File locations are more compliant to Filesystem Hierarchy Standard 2.3
- - configuration and certificates are in $prefix/etc/stunnel/
- - binaries are in $prefix/sbin/
- - default pid file is $prefix/var/run/stunnel.pid
- - manual is $prefix/man/man8/stunnel.8
- - other docs are in $prefix/share/doc/stunnel/
- - libstunnel is in $prefix/lib
- - chroot directory is setup in $prefix/var/lib/stunnel/
- this directory is chmoded 1770 and group nogroup
-
-Version 4.14, 2005.11.02, urgency: HIGH:
-* Bugfixes
- - transfer() fixed to avoid random stalls introduced in version 4.12.
- - poll() error handing bug fixed.
- - Checking for dynamic loader libraries added again.
- - Default pidfile changed from $localstatedir/run/stunnel.pid
- to $localstatedir/stunnel/stunnel.pid.
- - Basic SSL library initialization moved to the beginning of execution.
-* Release notes
- - This is an important bugfix release. Upgrade is recommended.
-
-Version 4.13, 2005.10.21, urgency: MEDIUM:
-* DLLs for OpenSSL 0.9.7i included because protection faults were reported
- in 0.9.8 and 0.9.8a.
-* New features
- - Libwrap code is executed as a separate process (no more delays due
- to a global and potentially long critical section).
-* Bugfixes
- - Problem with zombies in UCONTEXT threading fixed.
- - Workaround for non-standard makecontext() uc_stack.ss_sp parameter
- semantics on SGI IRIX.
- - Protection fault in signals handling on IRIX fixed.
- - Problem finding pthread library on AIX fixed.
- - size_t printf() fixed in stack_info() (the previous fix didn't work).
- - socklen_t is used instead of int where required.
-
-Version 4.12, 2005.09.29, urgency: MEDIUM:
-* New features
- - Win32 installer added.
- - New Win32 commandline options: -start and -stop.
- - Log level and thread number are reported to syslog.
- - DLLs for OpenSSL 0.9.8.
- - stunnel.spec updated by neeo <neeo@irc.pl>.
-* Bugfixes
- - Use of broken poll() is disabled on Mac OS X.
- - Yet another transfer() infinite loop condition fixed.
- - Workaround for a serious M$ bug (KB177346).
- - IPv6 DLLs allocation problem resulting in GPF on W2K fixed.
- - zlib added to shared libraries (OpenSSL may need it).
- - size_t printf() fixed in stack_info().
-* Release notes
- - This is a bugfix release. Upgrade is recommended.
-
-Version 4.11, 2005.07.09, urgency: MEDIUM:
-* New features
- - New ./configure option --with-threads to select thread model.
- - ./configure option --with-tcp-wrappers renamed to --disable-libwrap.
- I hope the meaning of the option is much more clear, now.
-* Bugfixes
- - Workaround for non-standard makecontext() uc_stack.ss_sp parameter
- semantics on Sparc/Solaris 9 and earlier.
- - scan_waiting_queue() no longer drops contexts.
- - Inetd mode GPFs with UCONTEXT fixed.
- - Cleanup context is no longer used.
- - Releasing memory of the current context is delayed.
- - Win32 headers reordered for Visual Studio 7.
- - Some Solaris compilation warnings fixed.
- - Rejected inetd mode without 'connect' or 'exec'.
-* Release notes
- - UCONTEXT threading seems stable, now. Upgrade is recommended.
-
-Version 4.10, 2005.04.23, urgency: LOW/EXPERIMENTAL:
-* DLLs for OpenSSL 0.9.7g.
-* Bugfixes
- - Missing locking on Win32 platform was added (thx to Yi Lin
- <yi.lin@convergys.com>)
- - Some problems with closing SSL fixed.
-* New features
- - New UCONTEXT user-level non-preemptive threads model is used
- on systems that support SYSV-compatible ucontext.h.
- - Improved stunnel3 script with getopt-compatible syntax.
-* Release notes
- - This version should be thoroughly tested before using it in the
- mission-critical environment.
-
-Version 4.09, 2005.03.26, urgency: MEDIUM:
-* DLLs for OpenSSL 0.9.7f.
-* Bugfixes
- - Compilation problem with undeclared socklen_t fixed.
- - TIMEOUTclose is not used when there is any data in the buffers.
- - Stunnel no longer relies on close_notify with SSL 2.0 connections,
- since SSL 2.0 protocol does not have any alerts defined.
- - Closing SSL socket when there is some data in SSL output buffer
- is detected and reported as an error.
- - Install/chmod race condition when installing default certificate fixed.
- - Stunnel no longer installs signal_handler on ignored signals.
-
-Version 4.08, 2005.02.27, urgency: LOW:
-* New features
- - New -quiet option was added to install NT service without a message box.
-* Bugfixes
- - Using $(DESTDIR) in tools/Makefile.am.
- - Define NI_NUMERICHOST and NI_NUMERICSERV when needed.
- - Length of configuration file line increased from 256B to 16KB.
- - Stunnel sends close_notify when a close_notify is received from SSL
- peer and all remaining data is sent to SSL peer.
- - Some fixes for bugs detected by the watchdog.
-* Release notes
- - There were many changes in the transfer() function (the main loop).
- - This version should be thoroughly tested before using it in the
- mission-critical environment.
-
-Version 4.07, 2005.01.03, urgency: MEDIUM:
-* Bugfixes
- - Problem with infinite poll() timeout negative, but not equal to -1 fixed.
- - Problem with a file descriptor ready to be read just after a non-blocking
- connect call fixed.
- - Compile error with EAI_NODATA not defined or equal to EAI_NONAME fixed.
- - IP address and TCP port textual representation length (IPLEN) increased
- to 128 bytes.
- - OpenSSL engine support is only used if engine.h header file exists.
- - Broken NT Service mode on Win32 platform fixed.
- - Support for IPv4-only Win32 machines restored.
-
-Version 4.06, 2004.12.26, urgency: LOW:
-* New feature sponsored by SURFnet http://www.surfnet.nl/
- - IPv6 support (to be enabled with ./configure --enable-ipv6).
-* New features
- - poll() support - no more FD_SETSIZE limit!
- - Multiple connect=host:port options are allowed in a single service
- section. Remote hosts are connected using round-robin algorithm.
- This feature is not compatible with delayed resolver.
- - New 'compression' option to enable compression. To use zlib
- algorithm you have to enable it when building OpenSSL library.
- - New 'engine' option to select a hardware engine.
- - New 'TIMEOUTconnect' option with 10 seconds default added.
- - stunnel3 perl script to emulate version 3.x command line options.
- - French manual updated by Bernard Choppy <choppy AT free POINT fr>.
- - A watchdog to detect transfer() infinite loops added.
- - Configuration file comment character changed from '#' to ';'.
- '#' will still be recognized to keep compatibility.
- - MT-safe getaddrinfo() and getnameinfo() are used where available
- to get better performance on resolver calls.
- - Automake upgraded from 1.4-p4 to 1.7.9.
-* Bugfixes
- - log() changed to s_log() to avoid conflicts on some systems.
- - Common CRIT_INET critical section introduced instead of separate
- CRIT_NTOA and CRIT_RESOLVER to avoid potential problems with
- libwrap (TCP Wrappers) library.
- - CreateThread() finally replaced with _beginthread() on Win32.
- - make install creates $(localstatedir)/stunnel.
- $(localstatedir)/stunnel/dev/zero is also created on Solaris.
- - Race condition with client session cache fixed.
- - Other minor bugfixes.
-* Release notes
- - Win32 port requires Winsock2 to work.
- Some Win95 systems may need a free update from Microsoft.
- http://www.microsoft.com/windows95/downloads/
- - Default is *not* to use IPv6 '::' for accept and '::1' for
- connect. For example to accept pop3s on IPv6 you could use:
- 'accept = :::995'. I hope the new syntax is clear enough.
-
-Version 4.05, 2004.02.14, urgency: MEDIUM:
-* New feature sponsored by SURFnet http://www.surfnet.nl/
- - Support for CIFS aka SMB protocol SSL negotiation.
-* New features
- - CRL support with new CRLpath and CRLfile global options.
- - New 'taskbar' option on Win32 (thx to Ken Mattsen
- <ken.Mattsen@roxio.com>).
- - New -fd command line parameter to read configuration
- from a specified file descriptor instead of a file.
- - accept is reported as error when no 'section' is
- defined (in stunnel 4.04 it was silently ignored causing
- problems for lusers who did not read the fine manual).
- - Use fcntl() instead of ioctlsocket() to set socket
- nonblocking where it is supported.
- - Basic support for hardware engines with OpenSSL >= 0.9.7.
- - French manual by Bernard Choppy <choppy@imaginet.fr>.
- - Thread stack size reduced to 64KB for maximum scalability.
- - Added optional code to debug thread stack usage.
- - Support for nsr-tandem-nsk (thx to Tom Bates <tom.bates@hp.com>).
-* Bugfixes
- - TCP wrappers code moved to CRIT_NTOA critical section
- since it uses static inet_ntoa() result buffer.
- - SSL_ERROR_SYSCALL handling problems fixed.
- - added code to retry nonblocking SSL_shutdown() calls.
- - Use FD_SETSIZE instead of 16 file descriptors in inetd
- mode.
- - fdscanf groks lowercase protocol negotiation commands.
- - Win32 taskbar GDI objects leak fixed.
- - Libwrap detection bug in ./configure script fixed.
- - grp.h header detection fixed for NetBSD and possibly
- other systems.
- - Some other minor updates.
-
-Version 4.04, 2003.01.12, urgency: MEDIUM:
-* New feature sponsored by SURFnet http://www.surfnet.nl/
- - Encrypted private key can be used with Win32 GUI.
-* New features
- - New 'options' configuration option to setup
- OpenSSL library hacks with SSL_CTX_set_options().
- - 'service' option also changes the name for
- TCP Wrappers access control in inetd mode.
- - Support for BeOS (thx to Mike I. Kozin <mik@sbor.net>)
- - SSL is negotiated before connecting remote host
- or spawning local process whenever possible.
- - REMOTE_HOST variable is always placed in the
- enrivonment of a process spawned with 'exec'.
- - Whole SSL error stack is dumped on errors.
- - 'make cert' rule is back (was missing since 4.00).
- - Manual page updated (special thanks to Brian Hatch).
- - TODO updated.
-* Bugfixes
- - Major code cleanup (thx to Steve Grubb <linux_4ever@yahoo.com>).
- - Unsafe functions are removed from SIGCHLD handler.
- - Several bugs in auth_user() fixed.
- - Incorrect port when using 'local' option fixed.
- - OpenSSL tools '-rand' option is no longer directly
- used with a device (like '/dev/urandom').
- Temporary random file is created with 'dd' instead.
-* DLLs for OpenSSL 0.9.7.
-
-Version 4.03, 2002.10.27, urgency: HIGH:
-* NT Service (broken since 4.01) is operational again.
-* Memory leak in FORK environments fixed.
-* sigprocmask() mistake corrected.
-* struct timeval is reinitialized before select().
-* EAGAIN handled in client.c for AIX.
-* Manual page updated.
-
-Version 4.02, 2002.10.21, urgency: HIGH:
-* Serious bug in ECONNRESET handling fixed.
-
-Version 4.01, 2002.10.20, urgency: MEDIUM:
-* New features
- - OpenVMS support.
- - Polish manual and some manual updates.
- - 'service' option added on Win32 platform.
- - Obsolete FAQ has been removed.
- - Log file is created with 0640 mode.
- - exec->connect service sections (need more testing).
-* Bugfixes
- - EINTR ingored in main select() loop.
- - Fixed problem with stunnel closing connections on
- TIMEOUTclose before all the data is sent.
- - Fixed EWOULDBLOCK on writesocket problem.
- - Potential DOS in Win32 GUI fixed.
- - Solaris compilation problem fixed.
- - Libtool configuration problems fixed.
- - Signal mask is cleared just before exec in local mode.
- - Accepting sockets and log file descriptors are no longer
- leaked to the child processes.
-Special thanks to Steve Grubb for the source code audit.
-
-Version 4.00, 2002.08.30, urgency: LOW:
-* New features sponsored by MAXIMUS http://www.maximus.com/
- - New user interface (config file).
- - Single daemon can listen on multiple ports, now.
- - Native Win32 GUI added.
- - Native NT/2000/XP service added.
- - Delayed DNS lookup added.
-* Other new features
- - All the timeouts are now configurable including
- TIMEOUTclose that can be set to 0 for MSIE and other
- buggy clients that do not send close_notify.
- - Stunnel process can be chrooted in a specified directory.
- - Numerical values for setuid() and setgid() are allowed, now.
- - Confusing code for setting certificate defaults introduced in
- version 3.8p3 was removed to simplify stunnel setup.
- There are no built-in defaults for CApath and CAfile options.
- - Private key file for a certificate can be kept in a separate
- file. Default remains to keep it in the cert file.
- - Manual page updated.
- - New FHS-compatible build system based on automake and libtool.
-* Bugfixes
- - `SSL socket closed on SSL_write' problem fixed.
- - Problem with localtime() crashing Solaris 8 fixed.
- - Problem with tcp wrappers library detection fixed.
- - Cygwin (http://www.cygwin.com/) support added.
- - __svr4__ macro defined for Sun C/C++ compiler.
-* DLLs for OpenSSL 0.9.6g.
-
-Version 3.22, 2001.12.20, urgency: HIGH:
-* Format string bug fixed in protocol.c
- smtp, pop3 and nntp in client mode were affected.
- (stunnel clients could be attacked by malicious servers)
-* Certificate chain can be supplied with -p option or in stunnel.pem.
-* Problem with -r and -l options used together fixed.
-* memmove() instead of memcpy() is used to move data in buffers.
-* More detailed information about negotiated ciphers is printed.
-* New ./configure options: '--enable-no-rsa' and '--enable-dh'.
-
-Version 3.21c, 2001.11.11, urgency: LOW:
-* autoconf scripts upgraded to version 2.52.
-* Problem with pthread_sigmask on Darwin fixed (I hope).
-* Some documentation typos corrected.
-* Attempt to ignore EINTR in transfer().
-* Shared library version reported on startup.
-* DLLs for OpenSSL 0.9.6b.
-
-Version 3.21b, 2001.11.03, urgency: MEDIUM:
-* File descriptor leak on failed connect() fixed.
-
-Version 3.21a, 2001.10.31, urgency: MEDIUM:
-* Small bug in Makefile fixed.
-
-Version 3.21, 2001.10.31, urgency: MEDIUM:
-* Problem with errno and posix threads fixed.
-* It is assumed that system has getopt() if it has getopt.h header file.
-* SSL_CLIENT_DN and SSL_CLIENT_I_DN environment variables set in local mode
- (-l) process. This feature doesn't work if
- client mode (-c) or protocol negotiation (-n) is used.
-* Winsock error descriptions hardcoded (English version only).
-* SetConsoleCtrlHandler() used to handle CTRL+C, logoff and shutdown on Win32.
-* Stunnel always requests peer certificate with -v 0.
-* sysconf()/getrlimit() used to calculate number of clients allowed.
-* SSL mode changed for OpenSSL >= 0.9.6.
-* close-on-exec option used to avoid socket inheriting.
-* Buffer size increased from 8KB to 16KB.
-* fdscanf()/fdprintf() changes:
- - non-blocking socket support,
- - timeout after 1 minute of inactivity.
-* auth_user() redesigned to force 1 minute timeout.
-* Some source arrangement towards 4.x architecture.
-* No need for 'goto' any more.
-* New Makefile 'test' rule. It performs basic test of
- standalone/inetd, remote/local and server/client mode.
-* pop3 server mode support added.
-
-Version 3.20, 2001.08.15, urgency: LOW:
-* setsockopt() optlen set according to the optval for Solaris.
-* Minor NetBSD compatibility fixes by Martti Kuparinen.
-* Minor MSVC 6.0 compatibility fixes by Patrick Mayweg.
-* SSL close_notify timeout reduced to 10 seconds of inactivity.
-* Socket close instead of reset on close_notify timeout.
-* Some source arrangement and minor bugfixes.
-
-Version 3.19, 2001.08.10, urgency: MEDIUM:
-* Critical section added around non MT-safe TCP Wrappers code.
-* Problem with 'select: Interrupted system call' error fixed.
-* errno replaced with get_last_socket_error() for Win32.
-* Some FreeBSD/NetBSD patches to ./configure from Martti Kuparinen.
-* Local mode process pid logged.
-* Default FQDN (localhost) removed from stunnel.cnf
-* ./configure changed to recognize POSIX threads library on OSF.
-* New -O option to set socket options.
-
-Version 3.18, 2001.07.31, urgency: MEDIUM:
-* MAX_CLIENTS is calculated based on FD_SETSIZE, now.
-* Problems with closing SSL in transfer() fixed.
-* -I option to bind a static local IP address added.
-* Debug output of info_callback redesigned.
-
-Version 3.17, 2001.07.29, urgency: MEDIUM:
-* Problem with GPF on exit with active threads fixed.
-* Timeout for transfer() function added:
- - 1 hour if socket is open for read
- - 1 minute if socket is closed for read
-
-Version 3.16, 2001.07.22, urgency: MEDIUM:
-* Some transfer() bugfixes/improvements.
-* STDIN/STDOUT are no longer assumed to be non-socket descriptors.
-* Problem with --with-tcp-wrappers patch fixed.
-* pop3 and nntp support bug fixed by Martin Germann.
-* -o option to append log messages to a file added.
-* Changed error message for SSL error 0.
-
-Version 3.15, 2001.07.15, urgency: MEDIUM:
-* Serious bug resulting in random transfer() hangs fixed.
-* Separate file descriptors are used for inetd mode.
-* -f (foreground) logs are now stamped with time.
-* New ./configure option: --with-tcp-wrappers by Brian Hatch.
-* pop3 protocol client support (-n pop3) by Martin Germann.
-* nntp protocol client support (-n nntp) by Martin Germann.
-* RFC 2487 (smtp STARTTLS) client mode support.
-* Transparency support for Tru64 added.
-* Some #includes for AIX added.
-
-Version 3.14, 2001.02.21, urgency: LOW:
-* Pidfile creation algorithm has been changed.
-
-Version 3.13, 2001.01.25, urgency: MEDIUM:
-* pthread_sigmask() argument in sthreads.c corrected.
-* OOB data is now handled correctly.
-
-Version 3.12, 2001.01.24, urgency: LOW:
-* Attempted to fix problem with zombies in local mode.
-* Patch for 64-bit machines by Nalin Dahyabhai <nalin@redhat.com> applied.
-* Tiny bugfix for OSF cc by Dobrica Pavlinusic <dpavlin@rot13.org> added.
-* PORTS file updated.
-
-Version 3.11, 2000.12.21, urgency: MEDIUM:
-* New problem with zombies fixed.
-* Attempt to be integer-size independent.
-* SIGHUP handler added.
-
-Version 3.10, 2000.12.19, urgency: MEDIUM:
-* Internal thread synchronization code added.
-* libdl added to stunnel dependencies if it exists.
-* Manpage converted to sdf format.
-* stunnel deletes pid file before attempting to create it.
-* Documentation updates.
-* -D option now takes facility.level as argument. 0-7 still supported.
-* Problems with occasional zombies in FORK mode fixed.
-* 'stunnel.exe' rule added to Makefile.
- You can cross-compile stunnel.exe on Unix, now.
- I'd like to be able to compile OpenSSL this way, too...
-
-Version 3.9, 2000.12.13, urgency: HIGH:
-* Updated temporary key generation:
- - stunnel is now honoring requested key-lengths correctly,
- - temporary key is changed every hour.
-* transfer() no longer hangs on some platforms.
- Special thanks to Peter Wagemans for the patch.
-* Potential security problem with syslog() call fixed.
-
-Version 3.8p4, 2000.06.25 bri@stunnel.org:
-* fixes for Windows platform
-
-Version 3.8p3, 2000.06.24 bri@stunnel.org:
-* Compile time definitions for the following:
- --with-cert-dir
- --with-cert-file
- --with-pem-dir
- --enable-ssllib-cs
-* use daemon() function instead of daemonize, if available
-* fixed FreeBSD threads checking (patch from robertw@wojo.com)
-* added -S flag, allowing you to choose which default verify
- sources to use
-* relocated service name output logging until after log_open.
- (no longer outputs log info to inetd socket, causing bad SSL)
-* -V flag now outputs the default values used by stunnel
-* Removed DH param generation in Makefile.in
-* Moved stunnel.pem to sample.pem to keep people from blindly using it
-* Removed confusing stunnel.pem check from Makefile.
-
-* UPGRADE NOTE: this version seriously changes several previous stunnel
- default behaviours. There are no longer any default cert file/dirs
- compiled into stunnel, you must use the --with-cert-dir and
- --with-cert-file configure arguments to set these manually, if desired.
- Stunnel does not use the underlying ssl library defaults by default
- unless configured with --enable-ssllib-cs. Note that these can always
- be enabled at run time with the -A,-a, and -S flags.
- Additionally, unless --with-pem-dir is specified at compile time,
- stunnel will default to looking for stunnel.pem in the current directory.
-
-Version 3.8p2, 2000.06.13 bri@stunnel.org:
-* Fixes for Win32 platform
-* Minor output formatting changes
-* Fixed version number in files
-
-Version 3.8p1, 2000.06.11 bri@stunnel.org:
-* Added rigorous PRNG seeding
-* PID changes (and related security-fix)
-* Man page fixes
-* Client SSL Session-IDs now used
-* -N flag to specify tcpwrapper service name
-
-Version 3.8, 2000.02.24:
-* Checking for threads in c_r library for FreeBSD.
-* Some compatibility fixes for Ultrix.
-* configure.in has been cleaned up.
- Separate directories for SSL certs and SSL libraries/headers
- are no longer supported. SSL ports maintainers should create
- softlinks in the main openssl directory if necessary.
-* Added --with-ssl option to specify SSL directory.
-* Added setgid (-g) option.
- (Special thanks to Brian Hatch for his feedback and support)
-* Added pty.c based on a Public Domain code by Tatu Ylonen
-* Distribution files are now signed with GnuPG
-
-Version 3.7, 2000.02.10:
-* /usr/pkg added to list of possible SSL directories for pkgsrc installs
- of OpenSSL under NetBSD.
-* Added the -s option, which setuid()s to the specified user when running
- in daemon mode. Useful for cyrus imapd.
- (both based on patch by George Coulouris)
-* PTY code ported to Solaris. The port needs some more testing.
-* Added handler for SIGINT.
-* Added --with-random option to ./configure script.
-* Fixed some problems with autoconfiguration on Solaris and others.
- It doesn't use config.h any more.
-* /var/run changed to @localstatedir@/stunnel for better portability.
- The directory is chmoded a=rwx,+t.
-* FAQ has been updated.
-
-3.6 2000.02.03
-* Automatic RFC 2487 detection based on patch by Pascual Perez and Borja Perez.
-* Non-blocking sockets not used by default.
-* DH support is disabled by default.
-* (both can be enabled in ssl.c)
-
-3.5 2000.02.02
-* Support for openssl 0.9.4 added.
-* /usr/ssl added to configure by Christian Zuckschwerdt.
-* Added tunneling for PPP through the addition of PTY handling.
-* Added some documentation.
-
-3.4a 1999.07.13 (bugfix release)
-* Problem with cipher negotiation fixed.
-* setenv changed to putenv.
-
-3.4 1999.07.12
-* Local transparent proxy added with LD_PRELOADed shared library.
-* DH code rewritten.
-* Added -C option to set cipher list.
-* stderr fflushed after fprintf().
-* Minor portability bugfixes.
-* Manual updated (but still not perfect).
-
-3.3 1999.06.18
-* Support for openssl 0.9.3 added.
-* Generic support for protocol negotiation added (protocol.c).
-* SMTP protocol negotiation support for Netscape client added.
-* Transparent proxy mode (currently works on Linux only).
-* SO_REUSEADDR enabled on listening socket in daemon mode.
-* ./configure now accepts --prefix parameter.
-* -Wall is only used with gcc compiler.
-* Makefile.in and configure.in updated.
-* SSL-related functions moved to a separate file.
-* vsprintf changed to vsnprintf in log.c on systems have it.
-* Pidfile in /var/run added for daemon mode.
-* RSAref support fix (not tested).
-* Some compatibility fixes for Solaris and NetBSD added.
-
-3.2 1999.04.28
-* RSAref support (not tested).
-* Added full duplex with non-blocking sockets.
-* RST sent instead of FIN on peer error (on error peer
- socket is reset - not just closed).
-* RSA temporary key length changed back to 512 bits to fix
- a problem with Netscape.
-* Added NO_RSA for US citizens having problems with patents.
-
-3.1 1999.04.22
-* Changed -l syntax (first argument specified is now argv0).
-* Fixed problem with options passed to locally executed daemon.
-* Fixed problem with ':' passed to libwrap in a service name:
- - ':' has been changed to '.';
- - user can specify his own service name as an argument.
-* RSA temporary key length changed from 512 to 1024 bits.
-* Added safecopy to avoid buffer overflows in stunnel.c.
-* Fixed problems with GPF after unsuccessful resolver call
- and incorrect parameters passed to getopt() in Win32.
-* FAQ updated.
-
-3.0 1999.04.19
-* Some bugfixes.
-* FAQ added.
-
-3.0b7 1999.04.14
-* Win32 native port fixed (looks quite stable).
-* New transfer() function algorithm.
-* New 'make cert' to be compatible with openssl-0.9.2b.
-* Removed support for memory leaks debugging.
-
-3.0b6 1999.04.01
-* Fixed problems with session cache (by Adam).
-* Added client mode session cache.
-* Source structure, autoconf script and Makefile changed.
-* Added -D option to set debug level.
-* Added support for memory leaks debugging
- (SSL library needs to be compiled with -DMFUNC).
-
-3.0b5 1999.03.25
-* Lots of changes to make threads work.
-* Peer (client and server) authentication works!
-* Added -V option to display version.
-
-3.0b4 1999.03.22
-* Early POSIX threads implementation.
-* Work on porting to native Win32 application started.
-
-3.0b3 1999.03.05
-* Improved behavior on heavy load.
-
-3.0b2 1999.03.04
-* Fixed -v parsing bug.
-
-3.0b1 1999.01.18
-* New user interface.
-* Client mode added.
-* Peer certificate verification added (=strong authentication).
-* Win32 port added.
-* Other minor problems fixed.
-
-2.1 1998.06.01
-* Few bugs fixed.
-
-2.0 1998.05.25
-* Remote mode added!
-* Standalone mode added!
-* tcpd functionality added by libwrap utilization.
-* DH callbacks removed by kravietZ.
-* bind loopback on Intel and other bugs fixed by kravietZ.
-* New manual page by kravietZ & myself.
-
-1.6 1998.02.24
-* Linux bind fix.
-* New TODO ideas!
-
-1.5 1998.02.24
-* make_sockets() implemented with Internet sockets instead
- of Unix sockets for better compatibility.
- (i.e. to avoid random data returned by getpeername(2))
- This feature can be disabled in stunnel.c.
-
-1.4 1998.02.16
-* Ported to HP-UX, Solaris and probably other UNIXes.
-* Autoconfiguration added.
-
-1.3 1998.02.14
-* Man page by Pawel Krawczyk <kravietz@ceti.com.pl> added!
-* Copyrights added.
-* Minor errors corrected.
-
-1.2 1998.02.14
-* Separate certificate for each service added.
-* Connection logging support.
-
-1.1 1998.02.14
-* Callback functions added by Pawel Krawczyk <kravietz@ceti.com.pl>.
-
-1.0 1998.02.11
-* First version with SSL support
- - special thx to Adam Hernik <adas@infocentrum.com>.
-
-0.1 1998.02.10
-* Testing skeleton.
-

_service:tar_scm:stunnel-5.48.tar.gz/INSTALL Deleted

@@ -1,370 +0,0 @@
-Installation Instructions
-*************************
-
-Copyright (C) 1994-1996, 1999-2002, 2004-2013 Free Software Foundation,
-Inc.
-
- Copying and distribution of this file, with or without modification,
-are permitted in any medium without royalty provided the copyright
-notice and this notice are preserved. This file is offered as-is,
-without warranty of any kind.
-
-Basic Installation
-==================
-
- Briefly, the shell command `./configure && make && make install'
-should configure, build, and install this package. The following
-more-detailed instructions are generic; see the `README' file for
-instructions specific to this package. Some packages provide this
-`INSTALL' file but do not implement all of the features documented
-below. The lack of an optional feature in a given package is not
-necessarily a bug. More recommendations for GNU packages can be found
-in *note Makefile Conventions: (standards)Makefile Conventions.
-
- The `configure' shell script attempts to guess correct values for
-various system-dependent variables used during compilation. It uses
-those values to create a `Makefile' in each directory of the package.
-It may also create one or more `.h' files containing system-dependent
-definitions. Finally, it creates a shell script `config.status' that
-you can run in the future to recreate the current configuration, and a
-file `config.log' containing compiler output (useful mainly for
-debugging `configure').
-
- It can also use an optional file (typically called `config.cache'
-and enabled with `--cache-file=config.cache' or simply `-C') that saves
-the results of its tests to speed up reconfiguring. Caching is
-disabled by default to prevent problems with accidental use of stale
-cache files.
-
- If you need to do unusual things to compile the package, please try
-to figure out how `configure' could check whether to do them, and mail
-diffs or instructions to the address given in the `README' so they can
-be considered for the next release. If you are using the cache, and at
-some point `config.cache' contains results you don't want to keep, you
-may remove or edit it.
-
- The file `configure.ac' (or `configure.in') is used to create
-`configure' by a program called `autoconf'. You need `configure.ac' if
-you want to change it or regenerate `configure' using a newer version
-of `autoconf'.
-
- The simplest way to compile this package is:
-
- 1. `cd' to the directory containing the package's source code and type
- `./configure' to configure the package for your system.
-
- Running `configure' might take a while. While running, it prints
- some messages telling which features it is checking for.
-
- 2. Type `make' to compile the package.
-
- 3. Optionally, type `make check' to run any self-tests that come with
- the package, generally using the just-built uninstalled binaries.
-
- 4. Type `make install' to install the programs and any data files and
- documentation. When installing into a prefix owned by root, it is
- recommended that the package be configured and built as a regular
- user, and only the `make install' phase executed with root
- privileges.
-
- 5. Optionally, type `make installcheck' to repeat any self-tests, but
- this time using the binaries in their final installed location.
- This target does not install anything. Running this target as a
- regular user, particularly if the prior `make install' required
- root privileges, verifies that the installation completed
- correctly.
-
- 6. You can remove the program binaries and object files from the
- source code directory by typing `make clean'. To also remove the
- files that `configure' created (so you can compile the package for
- a different kind of computer), type `make distclean'. There is
- also a `make maintainer-clean' target, but that is intended mainly
- for the package's developers. If you use it, you may have to get
- all sorts of other programs in order to regenerate files that came
- with the distribution.
-
- 7. Often, you can also type `make uninstall' to remove the installed
- files again. In practice, not all packages have tested that
- uninstallation works correctly, even though it is required by the
- GNU Coding Standards.
-
- 8. Some packages, particularly those that use Automake, provide `make
- distcheck', which can by used by developers to test that all other
- targets like `make install' and `make uninstall' work correctly.
- This target is generally not run by end users.
-
-Compilers and Options
-=====================
-
- Some systems require unusual options for compilation or linking that
-the `configure' script does not know about. Run `./configure --help'
-for details on some of the pertinent environment variables.
-
- You can give `configure' initial values for configuration parameters
-by setting variables in the command line or in the environment. Here
-is an example:
-
- ./configure CC=c99 CFLAGS=-g LIBS=-lposix
-
- *Note Defining Variables::, for more details.
-
-Compiling For Multiple Architectures
-====================================
-
- You can compile the package for more than one kind of computer at the
-same time, by placing the object files for each architecture in their
-own directory. To do this, you can use GNU `make'. `cd' to the
-directory where you want the object files and executables to go and run
-the `configure' script. `configure' automatically checks for the
-source code in the directory that `configure' is in and in `..'. This
-is known as a "VPATH" build.
-
- With a non-GNU `make', it is safer to compile the package for one
-architecture at a time in the source code directory. After you have
-installed the package for one architecture, use `make distclean' before
-reconfiguring for another architecture.
-
- On MacOS X 10.5 and later systems, you can create libraries and
-executables that work on multiple system types--known as "fat" or
-"universal" binaries--by specifying multiple `-arch' options to the
-compiler but only a single `-arch' option to the preprocessor. Like
-this:
-
- ./configure CC="gcc -arch i386 -arch x86_64 -arch ppc -arch ppc64" \
- CXX="g++ -arch i386 -arch x86_64 -arch ppc -arch ppc64" \
- CPP="gcc -E" CXXCPP="g++ -E"
-
- This is not guaranteed to produce working output in all cases, you
-may have to build one architecture at a time and combine the results
-using the `lipo' tool if you have problems.
-
-Installation Names
-==================
-
- By default, `make install' installs the package's commands under
-`/usr/local/bin', include files under `/usr/local/include', etc. You
-can specify an installation prefix other than `/usr/local' by giving
-`configure' the option `--prefix=PREFIX', where PREFIX must be an
-absolute file name.
-
- You can specify separate installation prefixes for
-architecture-specific files and architecture-independent files. If you
-pass the option `--exec-prefix=PREFIX' to `configure', the package uses
-PREFIX as the prefix for installing programs and libraries.
-Documentation and other data files still use the regular prefix.
-
- In addition, if you use an unusual directory layout you can give
-options like `--bindir=DIR' to specify different values for particular
-kinds of files. Run `configure --help' for a list of the directories
-you can set and what kinds of files go in them. In general, the
-default for these options is expressed in terms of `${prefix}', so that
-specifying just `--prefix' will affect all of the other directory
-specifications that were not explicitly provided.
-
- The most portable way to affect installation locations is to pass the
-correct locations to `configure'; however, many packages provide one or
-both of the following shortcuts of passing variable assignments to the
-`make install' command line to change installation locations without
-having to reconfigure or recompile.
-
- The first method involves providing an override variable for each
-affected directory. For example, `make install
-prefix=/alternate/directory' will choose an alternate location for all
-directory configuration variables that were expressed in terms of
-`${prefix}'. Any directories that were specified during `configure',
-but not in terms of `${prefix}', must each be overridden at install
-time for the entire installation to be relocated. The approach of
-makefile variable overrides for each directory variable is required by
-the GNU Coding Standards, and ideally causes no recompilation.
-However, some platforms have known limitations with the semantics of
-shared libraries that end up requiring recompilation when using this
-method, particularly noticeable in packages that use GNU Libtool.
-
- The second method involves providing the `DESTDIR' variable. For
-example, `make install DESTDIR=/alternate/directory' will prepend
-`/alternate/directory' before all installation names. The approach of
-`DESTDIR' overrides is not required by the GNU Coding Standards, and
-does not work on platforms that have drive letters. On the other hand,
-it does better at avoiding recompilation issues, and works well even
-when some directory options were not specified in terms of `${prefix}'
-at `configure' time.
-
-Optional Features
-=================
-
- If the package supports it, you can cause programs to be installed
-with an extra prefix or suffix on their names by giving `configure' the
-option `--program-prefix=PREFIX' or `--program-suffix=SUFFIX'.
-
- Some packages pay attention to `--enable-FEATURE' options to
-`configure', where FEATURE indicates an optional part of the package.
-They may also pay attention to `--with-PACKAGE' options, where PACKAGE
-is something like `gnu-as' or `x' (for the X Window System). The
-`README' should mention any `--enable-' and `--with-' options that the
-package recognizes.
-
- For packages that use the X Window System, `configure' can usually
-find the X include and library files automatically, but if it doesn't,
-you can use the `configure' options `--x-includes=DIR' and
-`--x-libraries=DIR' to specify their locations.
-
- Some packages offer the ability to configure how verbose the
-execution of `make' will be. For these packages, running `./configure
---enable-silent-rules' sets the default to minimal output, which can be
-overridden with `make V=1'; while running `./configure
---disable-silent-rules' sets the default to verbose, which can be
-overridden with `make V=0'.
-
-Particular systems
-==================
-
- On HP-UX, the default C compiler is not ANSI C compatible. If GNU
-CC is not installed, it is recommended to use the following options in
-order to use an ANSI C compiler:
-
- ./configure CC="cc -Ae -D_XOPEN_SOURCE=500"
-
-and if that doesn't work, install pre-built binaries of GCC for HP-UX.
-
- HP-UX `make' updates targets which have the same time stamps as
-their prerequisites, which makes it generally unusable when shipped
-generated files such as `configure' are involved. Use GNU `make'
-instead.
-
- On OSF/1 a.k.a. Tru64, some versions of the default C compiler cannot
-parse its `<wchar.h>' header file. The option `-nodtk' can be used as
-a workaround. If GNU CC is not installed, it is therefore recommended
-to try
-
- ./configure CC="cc"
-
-and if that doesn't work, try
-
- ./configure CC="cc -nodtk"
-
- On Solaris, don't put `/usr/ucb' early in your `PATH'. This
-directory contains several dysfunctional programs; working variants of
-these programs are available in `/usr/bin'. So, if you need `/usr/ucb'
-in your `PATH', put it _after_ `/usr/bin'.
-
- On Haiku, software installed for all users goes in `/boot/common',
-not `/usr/local'. It is recommended to use the following options:
-
- ./configure --prefix=/boot/common
-
-Specifying the System Type
-==========================
-
- There may be some features `configure' cannot figure out
-automatically, but needs to determine by the type of machine the package
-will run on. Usually, assuming the package is built to be run on the
-_same_ architectures, `configure' can figure that out, but if it prints
-a message saying it cannot guess the machine type, give it the
-`--build=TYPE' option. TYPE can either be a short name for the system
-type, such as `sun4', or a canonical name which has the form:
-
- CPU-COMPANY-SYSTEM
-
-where SYSTEM can have one of these forms:
-
- OS
- KERNEL-OS
-
- See the file `config.sub' for the possible values of each field. If
-`config.sub' isn't included in this package, then this package doesn't
-need to know the machine type.
-
- If you are _building_ compiler tools for cross-compiling, you should
-use the option `--target=TYPE' to select the type of system they will
-produce code for.
-
- If you want to _use_ a cross compiler, that generates code for a
-platform different from the build platform, you should specify the
-"host" platform (i.e., that on which the generated programs will
-eventually be run) with `--host=TYPE'.
-
-Sharing Defaults
-================
-
- If you want to set default values for `configure' scripts to share,
-you can create a site shell script called `config.site' that gives
-default values for variables like `CC', `cache_file', and `prefix'.
-`configure' looks for `PREFIX/share/config.site' if it exists, then
-`PREFIX/etc/config.site' if it exists. Or, you can set the
-`CONFIG_SITE' environment variable to the location of the site script.
-A warning: not all `configure' scripts look for a site script.
-
-Defining Variables
-==================
-
- Variables not defined in a site shell script can be set in the
-environment passed to `configure'. However, some packages may run
-configure again during the build, and the customized values of these
-variables may be lost. In order to avoid this problem, you should set
-them in the `configure' command line, using `VAR=value'. For example:
-
- ./configure CC=/usr/local2/bin/gcc
-
-causes the specified `gcc' to be used as the C compiler (unless it is
-overridden in the site shell script).
-
-Unfortunately, this technique does not work for `CONFIG_SHELL' due to
-an Autoconf limitation. Until the limitation is lifted, you can use
-this workaround:
-
- CONFIG_SHELL=/bin/bash ./configure CONFIG_SHELL=/bin/bash
-
-`configure' Invocation
-======================
-
- `configure' recognizes the following options to control how it
-operates.
-
-`--help'
-`-h'
- Print a summary of all of the options to `configure', and exit.
-
-`--help=short'
-`--help=recursive'
- Print a summary of the options unique to this package's
- `configure', and exit. The `short' variant lists options used
- only in the top level, while the `recursive' variant lists options
- also present in any nested packages.
-
-`--version'
-`-V'
- Print the version of Autoconf used to generate the `configure'
- script, and exit.
-
-`--cache-file=FILE'
- Enable the cache: use and save the results of the tests in FILE,
- traditionally `config.cache'. FILE defaults to `/dev/null' to
- disable caching.
-
-`--config-cache'
-`-C'
- Alias for `--cache-file=config.cache'.
-
-`--quiet'
-`--silent'
-`-q'
- Do not print messages saying which checks are being made. To
- suppress all normal output, redirect it to `/dev/null' (any error
- messages will still be shown).
-
-`--srcdir=DIR'
- Look for the package's source code in directory DIR. Usually
- `configure' can determine that directory automatically.
-
-`--prefix=DIR'
- Use DIR as the installation prefix. *note Installation Names::
- for more details, including other options available for fine-tuning
- the installation locations.
-
-`--no-create'
-`-n'
- Run the configure checks, but stop before creating any output
- files.
-
-`configure' also accepts some other, not widely useful, options. Run
-`configure --help' for more details.

_service:tar_scm:stunnel-5.48.tar.gz/INSTALL.FIPS Deleted

@@ -1,25 +0,0 @@
-stunnel FIPS install notes
-
-
-Unix HOWTO:
-* Only dynamic linking of the FIPS-enabled OpenSSL is currently supported,
-  i.e. FIPS-enabled OpenSSL has to be configured with "shared" parameter.
-* FIPS mode is autodetected if possible.  It can be forced with:
-    ./configure --enable-fips
-  or disable with:
-    ./configure --disable-fips
-
-WIN32 HOWTO:
-* On 32-bit Windows install one of the following compilers:
-  - MSVC 8.0 (VS 2005) Standard or Professional Edition
-  - MSVC 9.0 (VS 2008) any edition including Express Edition
-* On 64-bit Windows install one of the following compilers:
-  - MSVC 8.0 (VS 2005) Standard or Professional Edition
-  - MSVC 9.0 (VS 2008) Standard or Professional Edition
-* Build FIPS-compliant OpenSSL DLLS according to:
-  https://www.openssl.org/docs/fips/UserGuide-2.0.pdf
-* Build stunnel normally with MSVC or Mingw.
-  Mingw build requires DLL stubs.  Stubs can be built with:
-  dlltool --def ms/libeay32.def --output-lib libcrypto.a
-  dlltool --def ms/ssleay32.def --output-lib libssl.a
-

_service:tar_scm:stunnel-5.48.tar.gz/INSTALL.W32 Deleted

@@ -1,76 +0,0 @@
-stunnel Windows install notes
-
-
-Cross-compiling stunnel from source with MinGW (optional):
-
- 1) Install the mingw32 cross-compiler on a Unix/Linux machine.
-    On Debian (and derivatives, including Ubuntu):
-      sudo apt-get install gcc-mingw-w64-i686
-    On Arch Linux:
-      sudo pacman -S mingw-w64-gcc
-
- 2) Download the recent OpenSSL and unpack it:
-      tar zvxf ~/openssl-(version).tar.gz
-      mv openssl-(version) openssl-(version)-i686
-      cd openssl-(version)-i686/
-
- 3) Build and install OpenSSL.
-    For 32-bit Windows:
-      ./Configure \
-        --cross-compile-prefix=i686-w64-mingw32- \
-        --prefix=/opt/openssl-mingw mingw shared
-      make
-      sudo make install
-      sudo cp ms/applink.c /opt/openssl-mingw/include/openssl/
-    For 64-bit Windows:
-      ./Configure \
-        --cross-compile-prefix=x86_64-w64-mingw32- \
-        --prefix=/opt/openssl-mingw64 mingw64 shared
-      make
-      sudo make install
-      sudo cp ms/applink.c /opt/openssl-mingw64/include/openssl/
-
- 4) Download and unpack stunnel-(version).tar.gz.
-
- 5) Configure stunnel.
-      cd stunnel-(version)
-      ./configure
-
- 6) Build Windows 32-bit and/or 64-bit executables.
-      cd src
-      make mingw
-      make mingw64
-
-
-Building stunnel from source with MinGW (optional):
-
- Building stunnel with MinGW on a Windows machine is possible,
- but not currently supported.
-
-
-Building stunnel from source with Visual Studio (optional):
-
- 1) Build your own or download pre-built OpenSSL library and headers.
-    TODO
-
- 2) Configure path to your OpenSSL in the src\vc.mak file.
-
- 3) Build stunnel in Visual Studio Command Prompt.
-      cd src
-      nmake -f vc.mak
-
-
-Installing stunnel:
-
- 1) Install stunnel.
-    Run installer to install the precompiled binaries.
-    Alternatively, copy the stunnel.exe and/or tstunnel.exe executable located in
-    /stunnel-(version)/bin/mingw/ or /stunnel-(version)/bin/mingw64/ directory
-    into the destination directory on a Windows machine.
-    Copy OpenSSL DLLs into the same directory if necessary.
-    For a MinGW build also copy libssp-0.dll.
-    For a Visual Studio build also install Microsoft Visual C++ Redistributable.
-
- 2) Read the manual (stunnel.html).
-
- 3) Create/edit the stunnel.conf configuration file.

_service:tar_scm:stunnel-5.48.tar.gz/INSTALL.WCE Deleted

@@ -1,45 +0,0 @@
-stunnel Windows CE install notes
-
-
-Two stunnel executables are available for Windows CE platform:
-
-  1) stunnel.exe - version with interactive GUI
-
-  2) tstunnel.exe - non-iteractive version for headless devices
-
-
-Building stunnel from source (optional):
-
-  1) install the following tools:
-     evt2002web_min.exe from http://www.microsoft.com/
-     ActivePerl from http://www.activestate.com/Products/ActivePerl/
-     unzip.exe (file needs to be renamed) from
-       http://www.mirrorservice.org/sites/ftp.info-zip.org/pub/infozip/WIN32/
-
-  2) download the OpenSSL source files (the whole directory):
-     ftp://ftp.stunnel.org/stunnel/openssl/ce/
-  
-  3) your directory should look like this:
-     build.bat
-     build.pl
-     unzip.exe
-     src\openssl-0.9.8a.zip
-     src\wcecompat-1.2.zip
-
-  4) type "build" to build OpenSSL
-
-  5) download and unpack stunnel-(version).tar.gz
-
-  4) enter "stunnel-(version)\src" subdirectory
-
-  5) type "makece" to build stunnel
-
-
-Installing stunnel:
-
-  1) copy OpenSSL DLLs and stunnel.exe or tstunnel.exe into \stunnel directory
-
-  2) read the manual (stunnel.html)
-
-  3) create/edit stunnel.conf configuration file
-

_service:tar_scm:stunnel-5.48.tar.gz/NEWS Deleted

_service:tar_scm:stunnel-5.48.tar.gz/PORTS Deleted

_service:tar_scm:stunnel-5.48.tar.gz/README Deleted

_service:tar_scm:stunnel-5.48.tar.gz/TODO Deleted

@@ -1,49 +0,0 @@
-stunnel TODO
-
-
-High priority features.  They will likely be supported some day.
-A sponsor could allocate my time to get them faster.
-* Extend session tickets and/or sessiond to also serialize application
-  data ("redirect" state and session persistence).
-* Add client certificate autoselection based on the list of accepted issuers:
-  SSL_CTX_set_client_cert_cb(), SSL_get_client_CA_list().
-* Add an Apparmor profile.
-* Optional line-buffering of the log file.
-* Log rotation on Windows.
-* Configuration file option to limit the number of concurrent connections.
-* Command-line server control interface on both Unix and Windows.
-* Separate GUI process running as the current user on Windows.
-* An Android GUI.
-* OCSP stapling (tlsext_status).
-* Indirect CRL support (RFC 3280, section 5).
-* Provide 64-bit Windows builds (besides 32-bit builds).
-  This requires either Microsoft Visual Studio Standard Edition or Microsoft
-  Visual Studio Professional Edition in order to retain FIPS compliance.
-* MSI installer for Windows.
-* Add user-defined headers to CONNECT proxy requests.
-  This can be used to impersonate other software (e.g. web browsers).
-
-Low priority features.  They will unlikely ever be supported.
-* Database and/or directory interface for retrieving PSK secrets.
-* Support static FIPS-enabled build.
-* Service-level logging destination.
-* Enforce key renegotiation (re-handshake) for long connections.
-* Logging to NT EventLog on Windows.
-* Internationalization of logged messages (i18n).
-* Generic scripting engine instead or static protocol.c.
-* Add 'leastconn' failover strategy to order defined 'connect' targets
-  by the number of active connections.
-* Add '-status' command line option reporting the number of clients
-  connected to each service.
-
-Features I won't support, unless convinced otherwise by a wealthy sponsor.
-* Support for adding X-Forwarded-For to HTTP request headers.
-  This feature is less useful since PROXY protocol support is available.
-* Support for adding X-Forwarded-For to SMTP email headers.
-  This feature is most likely to be implemented as a separate proxy.
-* Additional certificate checks (including wildcard comparison) based on:
-  - O (Organization), and
-  - OU (Organizational Unit).
-* Set processes title that appear on the ps(1) and top(1) commands.
-  I could not find a portable *and* non-copyleft library for it.
-

_service:tar_scm:stunnel-5.48.tar.gz/build-android.sh Deleted

_service:tar_scm:stunnel-5.48.tar.gz/tests/certs/CACert.pem Deleted

@@ -1,47 +0,0 @@
------BEGIN RSA PRIVATE KEY-----
-MIIEpQIBAAKCAQEAr8xh9XMrSTxiwLDWGw9eMtFJSAGyNTaoBKPgfuQd+cv+EQrD
-LrE+h0ywctdzBLooxyu0ZxMOXQV/Z726f8WJsEjWIUvoOnCs3OT1Q8PJV39z8Tuw
-5aWQRJ9uwyr1q+YV897NRCNeT8LrRFls9XZGsHz8Wd8glwwPQ67fR/bSeP3GvhHP
-JqGNh3QvybUbK52klUQMVN4MEtSNFFcxp6hwEWhuID12ychFUNVOL/FueCUjBUVu
-fREqs+iIbmgpLKLCPc9BULXhUY+O9DYP9ahjXikdtP5xQ9AqviossWLGubxNlYBO
-YOzpeZIZMZyyAHQ7oYBXtCJFyNMap0/2ABI1twIDAQABAoIBAQCcehGfhlm7IFLO
-LRkGkRFJrlvKCihzkSjQqIWErMu5ssd8p9W/0+hSSgKs1fT8+i6dydsT/DRGvEQB
-NTGx1USPcuWWUZhtnClhnTJqlPS8OygaSwVUA6B8VGUktzJhRbW4klKnGcwyts7u
-0aJYgmS9ZyK/ZAoAKK3VkuwPhDUnl1D41FAQ+5EVg9MMe8GOSKo/EdkPvOioY2hC
-ubDHjYeF4wUDdx6TZkazNB6kXavUTKZPkl2p2Ljdbuh1cEwwh0g+HvtUdwzHtnGN
-AgwwwXqHgkLdNpyynDJyP4IBtzHx8tzFREo9aSyBqLuY6kf3E0UpguEM/0snzMam
-SRG9G6NRAoGBAOTLaK9pNS4+vLFrF6QgyMFPAQMPdobTVJEpqNkIBtwo+f7yUl0I
-ZV9G3+CGxrl4SfmZYslWB/fpjjbjR7NfjcCEpdQbwxsDP9EH7IxxroemQZqxdV3H
-ujvjxfSB6rdc9Wh/w9MTNprKO34aLaQw6BZQpvE3HnLCZWXRXbqhRj6NAoGBAMSz
-v/v3wdV/TlVaZgmuIKPeyfTSihLwXad44wu0cu6ND1t/xcENZopma9cSKkssvWMs
-Y6UJllbCEXpzpRd4eUN1Ca60G8RIqZiABivG1QquFFEi3O6vnJyysXBTqQUUWGFF
-TZy6VKMFFaZzWPeQUiwflWA0W2jlp8X4/oLJzyZTAoGBAIGkHJJgS+kDVYo2g3PV
-u8uFR66DQYcOEjoa3/jySmjPszBaAH+EtWQyVcL0u3/2f/w1hLtOyz8XkSTazhL+
-juTKhOhWPsx8n9mC4u+Frv5gH4ZXDYjxFj6/RrjQML5rpwbqdnyQw30cIG/Ix5nk
-uG2Ej8PYlqEyM6Bo7PJGVfY1AoGAH6Dvm+poxpWj2OGiSqgvI2pteupnvUfdJ1Ku
-33Dykh0ofQP8nmAzPsndSUXoexIEme/HTgBOpkCqYtA5mZ6LkSc+mVLorBUrABSF
-6YAdPYxkQ++hKtgeDKxHD9LD+McetvVX1322okftBUjC43vXWrTxZfjFQga7hX/W
-HN2qa3UCgYEAzP4Ju+AUmiP7CMloUY+RfIreUGVbH4L8/pVWlkpv8M9a2OD7+BGw
-cQpHRpDUmpZT0TEZGSOsk1HzLQHducH8IXL7OqhJsciQuZ+4366usSu8f6m70Cld
-PYYP4hZTARDXQPyB6v0LNMM2y+E4dfI3FKnIFxzLuChfSuxoBZNaIZk=
------END RSA PRIVATE KEY-----
------BEGIN CERTIFICATE-----
-MIIDWTCCAkGgAwIBAgIBATANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJQTDEQ
-MA4GA1UECgwHQ0FfY2VydDEQMA4GA1UECwwHQ0FfY2VydDEQMA4GA1UEAwwHQ0Ff
-Y2VydDEiMCAGCSqGSIb3DQEJARYTQ0FfY2VydEBleGFtcGxlLmNvbTAeFw0xODA0
-MTMxNjM4MDBaFw0yOTA0MTMxNjM4MDBaMGcxCzAJBgNVBAYTAlBMMRAwDgYDVQQK
-DAdDQV9jZXJ0MRAwDgYDVQQLDAdDQV9jZXJ0MRAwDgYDVQQDDAdDQV9jZXJ0MSIw
-IAYJKoZIhvcNAQkBFhNDQV9jZXJ0QGV4YW1wbGUuY29tMIIBIjANBgkqhkiG9w0B
-AQEFAAOCAQ8AMIIBCgKCAQEAr8xh9XMrSTxiwLDWGw9eMtFJSAGyNTaoBKPgfuQd
-+cv+EQrDLrE+h0ywctdzBLooxyu0ZxMOXQV/Z726f8WJsEjWIUvoOnCs3OT1Q8PJ
-V39z8Tuw5aWQRJ9uwyr1q+YV897NRCNeT8LrRFls9XZGsHz8Wd8glwwPQ67fR/bS
-eP3GvhHPJqGNh3QvybUbK52klUQMVN4MEtSNFFcxp6hwEWhuID12ychFUNVOL/Fu
-eCUjBUVufREqs+iIbmgpLKLCPc9BULXhUY+O9DYP9ahjXikdtP5xQ9AqviossWLG
-ubxNlYBOYOzpeZIZMZyyAHQ7oYBXtCJFyNMap0/2ABI1twIDAQABoxAwDjAMBgNV
-HRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQBAGD1a9ytkn/EbNtewfEpZHMzf
-8rSFHhKLZG75BUXdyt8W9S+XGIYk/8c5qWZx+925XSk6pvCV5QvwPmVIs0c3BVjA
-NlOdnl/yCPv4VnTTgl+0T0XbnO51J4USyA/KIz71Z+/lpqJ3faKdNR5tgl+4rU8C
-bF7eimBUEOwcB4uBSerK+Rbb140K0lFDLigavKYTZGivK5+rm+Ua5o/mEI31CJ/9
-GCmIoizWh900Gfx8YVdxtoWIuD983VW0OJKmnNk2JJJbMpFsrYhuKIc01Fe/4/ZT
-8ESYzphSOoS8Tg1UrZvBwmb0WE8Q1md4lDomgpPjfLQ48ZYYstSrISshI1VQ
------END CERTIFICATE-----

_service:tar_scm:stunnel-5.48.tar.gz/tests/certs/CACertCRL.pem Deleted

_service:tar_scm:stunnel-5.48.tar.gz/tests/certs/PeerCerts.pem Deleted

@@ -1,43 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDZjCCAk6gAwIBAgIBAzANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJQTDEQ
-MA4GA1UECgwHQ0FfY2VydDEQMA4GA1UECwwHQ0FfY2VydDEQMA4GA1UEAwwHQ0Ff
-Y2VydDEiMCAGCSqGSIb3DQEJARYTQ0FfY2VydEBleGFtcGxlLmNvbTAeFw0xODA0
-MTMxNjQ3MDBaFw0yOTA0MTIxNjQ3MDBaMIGFMQswCQYDVQQGEwJQTDEPMA0GA1UE
-CBMGc2VydmVyMQ8wDQYDVQQHEwZzZXJ2ZXIxDzANBgNVBAoTBnNlcnZlcjEPMA0G
-A1UECxMGc2VydmVyMQ8wDQYDVQQDEwZzZXJ2ZXIxITAfBgkqhkiG9w0BCQEWEnNl
-cnZlckBleGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
-AO1ZKIzDV/cJnJyCbER4rLf6YTPVzeWORN8nz87jmI9mWgO8hMjLZfKjJ4ECQY2B
-IJARq9xg9Nl8/o/wgwGA+124nLssZ0dFB9XgA7CEKJPQEwgMqSyTDe8h4setAeth
-r3YllBUAtfCvJXYUd+Pe7g3+xVVMXChJxvqc/o0Vfp4w1GKhpQqaDQHzjfvSn/O6
-nVfjJMW/kbflbzSqs0o65LarRfZIwLNbImzgrmkKueR3TzSQ7kQE7ZJ8dY8MEZ41
-QDYq3WAJYA+SdKbCzOevAf3gYFZb+sJ1fkiQpTbqTbIV9xUKMb7lRDahhANnen1x
-6MlgQ/w8s+rE8Gx7LdeKfbcCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEAk3UOgNsr
-jiExjsZNRFVw57SCFmKIhhdd+z52xKI1McsWmIt3TMCrYWxQjshvQ4uoj4G59vyH
-AcocK0+CnArfJElrlv2VEgh7GENwQDJsfcxQ6MzIrVk1BfXFIoEBg4v3ItDMVBpn
-Lh2UW/SiuMhWwnV2mdEHmr9jsMYPxB790TceqkXb7K35ZkOsoaDqMXaA7zgfj6Td
-LZAXlcjcz+r/ddz0D98G3bkKCboojAmrGlWILZBSWPn5YPe55Barl93DKvvVECEI
-eLdOU3Oyg6jTF8LLKaDnhE2QMD/YOzDcyxahtuo6Bm3G/72pvBrVRKnBJ/Zf/XUo
-ouAIM28tacLmsw==
------END CERTIFICATE-----
-
------BEGIN CERTIFICATE-----
-MIIDZjCCAk6gAwIBAgIBAjANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJQTDEQ
-MA4GA1UECgwHQ0FfY2VydDEQMA4GA1UECwwHQ0FfY2VydDEQMA4GA1UEAwwHQ0Ff
-Y2VydDEiMCAGCSqGSIb3DQEJARYTQ0FfY2VydEBleGFtcGxlLmNvbTAeFw0xODA0
-MTMxNjQ1MDBaFw0yOTA0MTIxNjQ1MDBaMIGFMQswCQYDVQQGEwJQTDEPMA0GA1UE
-CBMGY2xpZW50MQ8wDQYDVQQHEwZjbGllbnQxDzANBgNVBAoTBmNsaWVudDEPMA0G
-A1UECxMGY2xpZW50MQ8wDQYDVQQDEwZjbGllbnQxITAfBgkqhkiG9w0BCQEWEmNs
-aWVudEBleGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
-ANmjtYUKRiuc9zrC3skW6m9AdHI7fnDt7E0OPilNOQTVoxl7KNysDfQcezcdE7u9
-1G9gnnlCpm3glmM7r28f3VHh9TXDjyJNO2h6se/Wmk7joZ6IBio5qtlHHQLZoS6P
-DkgZvTEqvlGBCAt0uHTGiAxxSFRCHI1FWIC2Cr9pOyUh/aFVVa5tD8SpKZwWV8eT
-hN46auWcvtcjELPhSc1X/fBa3swEEIqpSggwqVapJ2xoiZNF9pQ1nCJfJ6ppkr0n
-r69lOhoJ7tXeOzeoBF+QZxAbEQAW29bHa39fHGxT/g6tvOcpdcBQ5qtnOyswqHEA
-BE1CyWfUG5RuqpK7zK5ZqvkCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEASZiS2ASh
-h8Jccci5MPmsEOGK9ecwYI1LSgejgvtA88gQifgKUUzzIjrLnK0iA4OW/h4DxTJJ
-oVtnU3ISyTvIq9RqxbTLEab1H4uWvkBRlOcUfxCX1hJy3tp3DqrRtIWSl7dmqgtl
-9wt8LgHo9bOn/oSpJ27wxCmr3wgBbADvUe8tBeWFG0ttOTdgIK4DaDPQDKNf5ub7
-lAJdhuUjJ9EjzhTGppOTuqxtaWilyWF4uQwspdLQ1mjKNTjar/afbUXfzaNODJcz
-ngT+ZjQXqDB37DLM5ErWRNA73ew3YmRihje+JdtrpaxhTUPBWwHTyn9JfVRKl+e+
-0WMftCn2IAjxKQ==
------END CERTIFICATE-----

_service:tar_scm:stunnel-5.48.tar.gz/tests/certs/client_cert.pem Deleted

@@ -1,48 +0,0 @@
------BEGIN RSA PRIVATE KEY-----
-MIIEowIBAAKCAQEA2aO1hQpGK5z3OsLeyRbqb0B0cjt+cO3sTQ4+KU05BNWjGXso
-3KwN9Bx7Nx0Tu73Ub2CeeUKmbeCWYzuvbx/dUeH1NcOPIk07aHqx79aaTuOhnogG
-Kjmq2UcdAtmhLo8OSBm9MSq+UYEIC3S4dMaIDHFIVEIcjUVYgLYKv2k7JSH9oVVV
-rm0PxKkpnBZXx5OE3jpq5Zy+1yMQs+FJzVf98FrezAQQiqlKCDCpVqknbGiJk0X2
-lDWcIl8nqmmSvSevr2U6Ggnu1d47N6gEX5BnEBsRABbb1sdrf18cbFP+Dq285yl1
-wFDmq2c7KzCocQAETULJZ9QblG6qkrvMrlmq+QIDAQABAoIBACtVfloMDqa2bT+E
-94kAiBM4uTbZg7aGmQtKr7PXjWfaBcyYCi3OEEUvupThtEEobfjzOvqX+71a/3ao
-tqigppecLw/SbVh+GjsWWwGPMFBO4KpJGTklHFCA6VTc8kvr7gMLJPF6OkTONUTa
-q7OMqCAaGjW0qCy0xwdxt7gfAsjEmtLNH7rLocQFk56y0Nz68jWLIMjnRxAq3NaQ
-ZgGE0NRwxUPhgbYl0s3MmhDPulth8+FLryZ8pmIZkKphtIvSXSPQBivdLAUkkhFx
-elUu9xHHXbqHhnCGjPjwK4CUGGp2m6mlCev/OlcHkzKWcBOJZKaAoWAQMGqCg0bu
-OS0T79UCgYEA7279C7IW7EgI9co4exxZl41gMuZxEcQzXAaHwx2m//9sPm6CczZt
-5OIAsenFU7b8hWCO5hJro7hhbp2YBTqtfQNM6KaY33W8iH6k7JcO+HfpLGHcNz1P
-S4+31Kj4k5dnz1us90uv8A77Jji1OSTJTBCgyrgmfGhPzqQnbNWNV+8CgYEA6LKw
-cYmzBUL//H2Y5HYafqOYlsC5YVGZTm//mp7DpGXdi2twmATskcnQ8BR5WtZ5Ca+2
-VHEoEAUTRLbX+CoUKeE34mnIXTIEU0dzRmw3CMK4DZVRPnIYaqckJH6GLxwCEMZE
-zlI8Hks+OrCSVgKYsKqMiOdTDdNoX4/9WaQ9A5cCgYEA6r8IfXUHoHUnw8OWCK3M
-8Rd9H6prZR3VtP36EUR7PTYx7Cvw3gCZUfR69fPasa8Qebwnnk6lFglqDUeZilbz
-TUP1HYxpCX2ncLOqAwQ/e0AlbowrmkUT/2NSur9Hp3ykHNsnA/ZC8rvdZKXol7QH
-X/pViyttIEAtLs4mkT/2qiUCgYBJfbXQBecuMDzcp2YUMWCowk48vl1N6RF7/k9B
-rAap8yoHEEWdHWEBojWEvVKeZ8IOVxpEjQBUHuY4+242CEQZ/fFCZppLJLLNAnHb
-ue2frK+oSpJAIJSpimQVyofidPwKBDRS3RHzl1vt+ToeQ++pTBPaYQSQB0add8JR
-/1btvQKBgG2uNFimmJ29DKSt8nRXm7wUkdQNORTZa0wygZbDaQgHxyiHOY9TgfhF
-PQHI/7abb/9PrMhchTWjV7w/e0E6q9Sc4kG1tz5MV9pWreXY7Uolg532zUsYqZVW
-0tQbWQR2fk+3ZoN9qHYZqYE/coqNdbtpLUIVWh3Yrh3V6L9Xw0us
------END RSA PRIVATE KEY-----
------BEGIN CERTIFICATE-----
-MIIDZjCCAk6gAwIBAgIBAjANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJQTDEQ
-MA4GA1UECgwHQ0FfY2VydDEQMA4GA1UECwwHQ0FfY2VydDEQMA4GA1UEAwwHQ0Ff
-Y2VydDEiMCAGCSqGSIb3DQEJARYTQ0FfY2VydEBleGFtcGxlLmNvbTAeFw0xODA0
-MTMxNjQ1MDBaFw0yOTA0MTIxNjQ1MDBaMIGFMQswCQYDVQQGEwJQTDEPMA0GA1UE
-CBMGY2xpZW50MQ8wDQYDVQQHEwZjbGllbnQxDzANBgNVBAoTBmNsaWVudDEPMA0G
-A1UECxMGY2xpZW50MQ8wDQYDVQQDEwZjbGllbnQxITAfBgkqhkiG9w0BCQEWEmNs
-aWVudEBleGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
-ANmjtYUKRiuc9zrC3skW6m9AdHI7fnDt7E0OPilNOQTVoxl7KNysDfQcezcdE7u9
-1G9gnnlCpm3glmM7r28f3VHh9TXDjyJNO2h6se/Wmk7joZ6IBio5qtlHHQLZoS6P
-DkgZvTEqvlGBCAt0uHTGiAxxSFRCHI1FWIC2Cr9pOyUh/aFVVa5tD8SpKZwWV8eT
-hN46auWcvtcjELPhSc1X/fBa3swEEIqpSggwqVapJ2xoiZNF9pQ1nCJfJ6ppkr0n
-r69lOhoJ7tXeOzeoBF+QZxAbEQAW29bHa39fHGxT/g6tvOcpdcBQ5qtnOyswqHEA
-BE1CyWfUG5RuqpK7zK5ZqvkCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEASZiS2ASh
-h8Jccci5MPmsEOGK9ecwYI1LSgejgvtA88gQifgKUUzzIjrLnK0iA4OW/h4DxTJJ
-oVtnU3ISyTvIq9RqxbTLEab1H4uWvkBRlOcUfxCX1hJy3tp3DqrRtIWSl7dmqgtl
-9wt8LgHo9bOn/oSpJ27wxCmr3wgBbADvUe8tBeWFG0ttOTdgIK4DaDPQDKNf5ub7
-lAJdhuUjJ9EjzhTGppOTuqxtaWilyWF4uQwspdLQ1mjKNTjar/afbUXfzaNODJcz
-ngT+ZjQXqDB37DLM5ErWRNA73ew3YmRihje+JdtrpaxhTUPBWwHTyn9JfVRKl+e+
-0WMftCn2IAjxKQ==
------END CERTIFICATE-----

_service:tar_scm:stunnel-5.48.tar.gz/tests/certs/psk1.txt Deleted

_service:tar_scm:stunnel-5.48.tar.gz/tests/certs/psk2.txt Deleted

_service:tar_scm:stunnel-5.48.tar.gz/tests/certs/revoked_cert.pem Deleted

@@ -1,48 +0,0 @@
------BEGIN RSA PRIVATE KEY-----
-MIIEogIBAAKCAQEArdLSbjb/IGtK08jwDx5XSKB96G6kinSwN+3/MEB/SvtuDsDW
-sC4kuS6kh+boOdzT+8rjf+k7ysJNC7td/2ExfJBMvcevsJqaMAhMlDcJLBMFetZ+
-/DPOv6HZIbZToMoGH14GFvt/ed1VzAshzhYKMnLjmC/lxooX1FJhRhVK6fW1HNEj
-vESJIyZA9ssk3VYaw/2cgIV3g/aOP9womk/NTU7AR/hXrCbSx1nYQInyEbk+p8qX
-ELLVS1KnMxoVH7CoqTVG6PH2FH0LJxpE577QKyT3sOfKCKs0PpXrnW3O5OF4itwv
-m1YAhKFWDDF2KyLW6LybFJVS/pDoMcA8tzHv7QIDAQABAoIBAAbCvWaGAxRKuAVW
-umeMIY70lxEURJgSA8yZGCTTTWAoOVafj3oYwVrmgoW6qGufuCsB8ClIdAfl2MNN
-DVHigN88aY+0FZRD3x1hJUFahqPNNZhagWPjy/XOILjb85K8aNKNgKUiMQoXXr/p
-6u2uE8V0jH+d1U0Mj/K1JY1pRJmm4W7Tp366z3goibOK6tWwSbGGiPWXvfy8fZdz
-8Hs/pG3oGEciof5hg55wSfJ+XF24iu850GaIKSNAf6pLUoU6S4zKj01qpSOEY1vN
-Sv5r8/yd3VQzoxk6wVDQvo7qIS7zqvvUqw0iCf3JsWGnQmEGQqwWmLiT8yE1CxFy
-H8veha0CgYEA3lffU6HSXw5zHW3o3Bx6/pGGkPlNzUDi/NbOd2kr/wBOZvmJOR2d
-U0CKoqjJpBTs7CEnpvbSkz4Hit/Y00UgQS1Zvfqo5m1yhWl1jiiHqoe0Alc/P5fa
-YMkkV+++eUUQFNJCiQKMRElkEEEITw21EmflWW86/ln9GAO8YZ1Ne0cCgYEAyCK9
-J4plfXEyTJpltg/7z/0DMuJwc3qRLMicaXcHHWK+C6ZSFOn6rzx/1GWa25Z3sXT8
-XAe98ZCYDK2+twCLtM6z2uKj/xCkZWH8AmaKKbLsMYCHXkOi38EpuxT1uiXosjVf
-ArZoAL472X5d4Eg/szGsfeMmvPm52V7OM3tHbSsCgYBydtR/DqDp1NuIfAvUPUlI
-gwy+18mo8E2rEr7qFJfUyIiUVMTDRa63rFNy1+gu86LhEVSDjS/tI5LoeML8SOsJ
-Atrfhgqrzg6WBivByrXFIeWXCumByKBhEUwHhWIOtnJH9dLRDCHACfRctc4cPJdK
-aXhWKYA6b4NveITj0AKSgwKBgDYFen1j1AVKOsOGoZHFOrlnmCdyC9x/5xPpip7F
-LDx4XMgUOu++QJZwhCi2zFgdg215IG1PAaxk1UYG2AXZtdw2N0IMDyxYN6fODRIw
-z3Z1/19VTDTbmOlA4JzJCZMXjHoeAelfhy88KjeI7poNpnQeImtQlzJHTi0odAxd
-aGhFAoGAfxHh4GhsIpIwxQMKINUXvwQAI3rUph5gMv0MS3CAwoVAFNzKZeJQsRVW
-IsI830HC+sPEpekiGcYFsRIbZv+Eh/f4j9TJ7eqUrkxVluleFU6YFHuFepbmcH4L
-nZKr5bR+kg4g0g3iqNey5pJIfTj+GoLmnv6GakqQNUdFSBAJ98g=
------END RSA PRIVATE KEY-----
------BEGIN CERTIFICATE-----
-MIIDbDCCAlSgAwIBAgIBBDANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJQTDEQ
-MA4GA1UECgwHQ0FfY2VydDEQMA4GA1UECwwHQ0FfY2VydDEQMA4GA1UEAwwHQ0Ff
-Y2VydDEiMCAGCSqGSIb3DQEJARYTQ0FfY2VydEBleGFtcGxlLmNvbTAeFw0xODA0
-MTMxNjQ4MDBaFw0yOTA0MTIxNjQ4MDBaMIGLMQswCQYDVQQGEwJQTDEQMA4GA1UE
-CBMHcmV2b2tlZDEQMA4GA1UEBxMHcmV2b2tlZDEQMA4GA1UEChMHcmV2b2tlZDEQ
-MA4GA1UECxMHcmV2b2tlZDEQMA4GA1UEAxMHcmV2b2tlZDEiMCAGCSqGSIb3DQEJ
-ARYTcmV2b2tlZEBleGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
-AQoCggEBAK3S0m42/yBrStPI8A8eV0igfehupIp0sDft/zBAf0r7bg7A1rAuJLku
-pIfm6Dnc0/vK43/pO8rCTQu7Xf9hMXyQTL3Hr7CamjAITJQ3CSwTBXrWfvwzzr+h
-2SG2U6DKBh9eBhb7f3ndVcwLIc4WCjJy45gv5caKF9RSYUYVSun1tRzRI7xEiSMm
-QPbLJN1WGsP9nICFd4P2jj/cKJpPzU1OwEf4V6wm0sdZ2ECJ8hG5PqfKlxCy1UtS
-pzMaFR+wqKk1Rujx9hR9CycaROe+0Csk97DnygirND6V651tzuTheIrcL5tWAISh
-Vgwxdisi1ui8mxSVUv6Q6DHAPLcx7+0CAwEAATANBgkqhkiG9w0BAQUFAAOCAQEA
-OiOlgx+6k7MyFNuD3wckVCI0W/ZpNN4T/eqf7hNR7bRTsljsjFvrOUJRnndu4EHr
-z1Xca+tUfYa4t95ofJtIlYzz1zSpAWyZmH0nk92ncqCn368qVXP7xdNI2c96Iuvi
-jBJfOP44KqOm5ygY4ha8+jcRHQDAj8zNVF+f8DfkRd9kxzzXHfwurLBkS8Kh6T02
-cWV69cXD0YvTTW6TtK4QyW1bgHUG41VV79nEh+iRY8E7Z3jxivteUjeBqT9Py3mr
-NVlwBBEtmQ9w6Od1SV7VFRwJOlCx/F2rYgyxokRxl6ssuSyXhw1MeZ/A0ZCRvjRJ
-MmY+Ibf7poKPEDM2HcS1uA==
------END CERTIFICATE-----

_service:tar_scm:stunnel-5.48.tar.gz/tests/certs/secrets.txt Deleted

_service:tar_scm:stunnel-5.48.tar.gz/tests/certs/server_cert.p12 Deleted

_service:tar_scm:stunnel-5.48.tar.gz/tests/certs/server_cert.pem Deleted

@@ -1,48 +0,0 @@
------BEGIN RSA PRIVATE KEY-----
-MIIEogIBAAKCAQEA7VkojMNX9wmcnIJsRHist/phM9XN5Y5E3yfPzuOYj2ZaA7yE
-yMtl8qMngQJBjYEgkBGr3GD02Xz+j/CDAYD7XbicuyxnR0UH1eADsIQok9ATCAyp
-LJMN7yHix60B62GvdiWUFQC18K8ldhR3497uDf7FVUxcKEnG+pz+jRV+njDUYqGl
-CpoNAfON+9Kf87qdV+Mkxb+Rt+VvNKqzSjrktqtF9kjAs1sibOCuaQq55HdPNJDu
-RATtknx1jwwRnjVANirdYAlgD5J0psLM568B/eBgVlv6wnV+SJClNupNshX3FQox
-vuVENqGEA2d6fXHoyWBD/Dyz6sTwbHst14p9twIDAQABAoIBABL4S0tk2YT/GatQ
-qUKXuoZB1r8D2Z79TffgALXybuEXNx6RVLOPvig0bhXbjk23AllBcFD+1tMDMH1k
-pbPbETweYzh6hg6mL8giTWkwRuX5fWvpRyQu5LA2Lx/ybfLYLePtgPZkxiXkecQE
-QsjNqo0nzbHRlpQJwYOKRLYV/7a43PP6PVszOOz/gxHl4A5o2a6sDY8YDRbJz9BX
-w+PhuhtJMYaTIPnHYD+4zbi3szftkFH/AXyJmKWpusyBUuyAEh07fETAOA7FD7QQ
-TEg7vmLr50uNBt7+luVbfFTC156ehriU+/0DkEgnPORNLPfbv65iRoxAd+T6JxVj
-fbU76OECgYEA/ttZoE+5MyPO+drefjB5OC4sJI/rgf9v8xZdD9MoJNVl/ewst7Pk
-0gkW+t9mD9ZKyi5ecylU2U4vb/MGkrSzkimxEXMxGMMudmhjFcRvoDMBBj7klfsd
-EoQ0YVs5yyJkehGX3+8hSAyIbkrMLQtJrduPVy8qGV7qeupZfKIjCpkCgYEA7mm0
-D82FD2wl8ZqaTe44TNjkDQ6Nk6NmNPNprjwNeMSqNvHvF+irfLagSKAnQfkFs6vQ
-XjGB+3mnBkg+/8BndB5iEYJ41nMkPSNMPy0FYznmLwMFf11p7E6ncqrCLwOEQ3vi
-s3YONadV7ifv/MEBDlmJIgwq74QIAZo/QYu7zM8CgYBKPXWfWHn3pr+9Uv+rPM2j
-Cvg68l3FcbaX1nTnjjhMeomKbYkdPl8yvAkgrYEare79dIJ5A5o+7yKsdtv8Un1Y
-36JAFhFASGM5hPEQPzfRL+plel62Pf9bDH4BukRcozknwgY+6ncEePopPsq5eGdP
-KP1ZhVi7KUYe5jOJNeYFSQKBgGgJ2pi2z+T+BcTb+ZAeb5UhZMtJ2YBe4sAipLBy
-5lIYSEs34mVllEgVDfcDZH5GpDVWudQQ+K771GZKaquCk+K5S4RmkkLK9jpzx9cd
-12cIoilLwT9mTU3guPOyDpEjkLk+O5yi3OqO/lGyPejndIWFjvE7rBTfYfsJC6eX
-yblDAoGAWMZ3050vZXVOlaMJDVEBXT+TVm6lAS+GbAoW1A31Fv6fs+PSGgaRUz/l
-tc1Da39UEBBbX/pudD5XVShnXhR1KeBG9nPRaP70NSXOQjHh0W1OzL9viSMvUx3f
-EsK3y9WO1cr8C89e/9vNektU29irMzTwQQolb+tR9f9BIpae0XM=
------END RSA PRIVATE KEY-----
------BEGIN CERTIFICATE-----
-MIIDZjCCAk6gAwIBAgIBAzANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJQTDEQ
-MA4GA1UECgwHQ0FfY2VydDEQMA4GA1UECwwHQ0FfY2VydDEQMA4GA1UEAwwHQ0Ff
-Y2VydDEiMCAGCSqGSIb3DQEJARYTQ0FfY2VydEBleGFtcGxlLmNvbTAeFw0xODA0
-MTMxNjQ3MDBaFw0yOTA0MTIxNjQ3MDBaMIGFMQswCQYDVQQGEwJQTDEPMA0GA1UE
-CBMGc2VydmVyMQ8wDQYDVQQHEwZzZXJ2ZXIxDzANBgNVBAoTBnNlcnZlcjEPMA0G
-A1UECxMGc2VydmVyMQ8wDQYDVQQDEwZzZXJ2ZXIxITAfBgkqhkiG9w0BCQEWEnNl
-cnZlckBleGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
-AO1ZKIzDV/cJnJyCbER4rLf6YTPVzeWORN8nz87jmI9mWgO8hMjLZfKjJ4ECQY2B
-IJARq9xg9Nl8/o/wgwGA+124nLssZ0dFB9XgA7CEKJPQEwgMqSyTDe8h4setAeth
-r3YllBUAtfCvJXYUd+Pe7g3+xVVMXChJxvqc/o0Vfp4w1GKhpQqaDQHzjfvSn/O6
-nVfjJMW/kbflbzSqs0o65LarRfZIwLNbImzgrmkKueR3TzSQ7kQE7ZJ8dY8MEZ41
-QDYq3WAJYA+SdKbCzOevAf3gYFZb+sJ1fkiQpTbqTbIV9xUKMb7lRDahhANnen1x
-6MlgQ/w8s+rE8Gx7LdeKfbcCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEAk3UOgNsr
-jiExjsZNRFVw57SCFmKIhhdd+z52xKI1McsWmIt3TMCrYWxQjshvQ4uoj4G59vyH
-AcocK0+CnArfJElrlv2VEgh7GENwQDJsfcxQ6MzIrVk1BfXFIoEBg4v3ItDMVBpn
-Lh2UW/SiuMhWwnV2mdEHmr9jsMYPxB790TceqkXb7K35ZkOsoaDqMXaA7zgfj6Td
-LZAXlcjcz+r/ddz0D98G3bkKCboojAmrGlWILZBSWPn5YPe55Barl93DKvvVECEI
-eLdOU3Oyg6jTF8LLKaDnhE2QMD/YOzDcyxahtuo6Bm3G/72pvBrVRKnBJ/Zf/XUo
-ouAIM28tacLmsw==
------END CERTIFICATE-----

_service:tar_scm:stunnel-5.48.tar.gz/tests/certs/stunnel.pem Deleted

@@ -1,52 +0,0 @@
------BEGIN PRIVATE KEY-----
-MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQD5imOBeBXN5JOp
-pIRqWa5LmAIOzjA/bLLPwYZhHRPEZUBLECae0Fwc8BcPeN2sJKC+0pj4bYZ0KMsv
-tpIOwIdmBm7gj5OMoD+r0WZk0fbLbsvXsmKjQvvUrmLLq2UHAu0rnWr7XxrLoyQX
-A3zcy1ofcGu3ivpzAi3K5ZEGpIaQh7EW/HxuejlYUbNZAVZI8vRmHDKSSA9TrEYh
-CwPbdXqh0JwIVTrNw5zWvccNl2p6fo1B0vrvuz62Gf4x5iAt8sG5SR39Jxpoqx8S
-VBrRx0CgDkc5SY2gr+CrpwijZstFjSGjwKRAl/R3AoNMlUN/Dm4De1H/uVvbz6wU
-nnJnFjhvAgMBAAECggEBAIDUxLiz8bXhu6aKrF5nvIeEjBNuuhQUn2CJTkJXC7yK
-dZ4LUZUOh2/dOFqhkPht1JuQCK/Bg/f2k6gnftKk7YJr8dR367pfhV/EdTO5/sta
-gVzz2N7nFzLfcVwrObZb+WxaEkCDAkd+C4TiJRWs2vN+S+5vjwvPZSrqSGyAhoSY
-tIS6M0ba/2jmG4ZJCBLcSVRLaH1N43W687WaKQ6rRKsoQbSy9gs1JFG8JqOPxLT4
-+mqOcQndoH7Z2Cz7NOy125QxoKd4kZC3P3oMuk7TrKqou7v0Jt0i+Gcmw3P2kYNt
-ybk4FZCfiu5pSMyIcaBgY4Paa983+ZVoMQR5O1X3kNECgYEA/uCoxSUa5ykcRTUZ
-iVxC235kbnCKhEX1K24ZL+Bei7Fc/aoIyPjC86LcHrbH9pprGTiwIQZgso+o7yGQ
-SzzbzV8jOfbUUCTOBm0oCGy7wjbvfjq07Ux88yijZ8NGkycylWF+wXbJcXWUpBqK
-P8JX5kv+JfUmxwt/Xd0KrtXiy6kCgYEA+qO2ckSYlkm1fci22jv0m25+y3keaBQH
-pHV6d6UiyXQUhV7FLejcvZRFOZp4nyfQFs1CRNOBWAYCuMX+wvFLrFCLhxbUvPRB
-FrqNcAtHzLexBTNVHhk28um+7lMQEcngJkKAPXC45g/LrsYMwOwJ/jFlGUPPv1Ud
-uQXrNvbcMlcCgYEA33U0QnP/nD9My9h8JRPAghPUFYeRydpT0tnaN0FtYugDcVpM
-DXcb5OMaPctekXRdBWXP9YRT7vlI0S8KBQy8YNhSWBVxmzpJbxTwjkJWczYazv7F
-dW8j9UPhz61DCOzKynEJ4rA0eMbvpNin8LKAwiZKEhlXABeyeSa8oQBgsNECgYEA
-2aV8czHaBveu4LGBB3V07dw/wtVEcECkek2BsY/261Uf1Mj9FObXeNDeZC0dfaeG
-7aYEW9wGv7dIeceFeScr/VBcOUy8I/E+7EvHMnq5OK5yy/9NdLuUmdAc+ruqgqf5
-O4AX+EKAbVdeGkDlJkpSSyf9kLjwGEgDbX4USUCI6jUCgYA2FCQL3TnoHcHTaaMi
-Hg3yVgJTZpx5k8axAhm9oBxPuvPx3Kc87ZoWqBxWcVlpHvECNVje1pj0w/JRV3Ud
-mf/NPw2bY/dBvEsoDbYyn9sjhEZT3ObCLn26H2qwoLnC9PUsdIDlZOMsbjfeV532
-0DVJpR5pzWV1gfCJ3+766MXbkw==
------END PRIVATE KEY-----
------BEGIN CERTIFICATE-----
-MIIEDjCCAvagAwIBAgIUcXZKv8QQJcrnr7vne+ykKRz3LFwwDQYJKoZIhvcNAQEF
-BQAwgYMxCzAJBgNVBAYTAlBMMRkwFwYDVQQIDBBNYXpvdmlhIFByb3ZpbmNlMQ8w
-DQYDVQQHDAZXYXJzYXcxGzAZBgNVBAoMElN0dW5uZWwgRGV2ZWxvcGVyczEXMBUG
-A1UECwwOUHJvdmlzaW9uYWwgQ0ExEjAQBgNVBAMMCWxvY2FsaG9zdDAeFw0xODA0
-MTMxNzA2NDRaFw0yMjA0MTMxNzA2NDRaMIGDMQswCQYDVQQGEwJQTDEZMBcGA1UE
-CAwQTWF6b3ZpYSBQcm92aW5jZTEPMA0GA1UEBwwGV2Fyc2F3MRswGQYDVQQKDBJT
-dHVubmVsIERldmVsb3BlcnMxFzAVBgNVBAsMDlByb3Zpc2lvbmFsIENBMRIwEAYD
-VQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQD5
-imOBeBXN5JOppIRqWa5LmAIOzjA/bLLPwYZhHRPEZUBLECae0Fwc8BcPeN2sJKC+
-0pj4bYZ0KMsvtpIOwIdmBm7gj5OMoD+r0WZk0fbLbsvXsmKjQvvUrmLLq2UHAu0r
-nWr7XxrLoyQXA3zcy1ofcGu3ivpzAi3K5ZEGpIaQh7EW/HxuejlYUbNZAVZI8vRm
-HDKSSA9TrEYhCwPbdXqh0JwIVTrNw5zWvccNl2p6fo1B0vrvuz62Gf4x5iAt8sG5
-SR39Jxpoqx8SVBrRx0CgDkc5SY2gr+CrpwijZstFjSGjwKRAl/R3AoNMlUN/Dm4D
-e1H/uVvbz6wUnnJnFjhvAgMBAAGjeDB2MBEGCWCGSAGG+EIBAQQEAwIGQDAPBgNV
-HRMECDAGAQH/AgEAMAsGA1UdDwQEAwICBDATBgNVHSUEDDAKBggrBgEFBQcDATAu
-BglghkgBhvhCAQ0EIRYfc3R1bm5lbCBzZWxmLXNpZ25lZCBjZXJ0aWZpY2F0ZTAN
-BgkqhkiG9w0BAQUFAAOCAQEAKD36WKiv8HyTmKRU/L2ud1FJFs39TODpkiz+JbnN
-cf/KxmwKE7I3TCIIt68en9oA9XgBWMTLF0c3tSOP6pT/LK/UVfq1KXGAurm5M1aP
-3c1np95lbkZw/8OsEaXGvH3+cTnL6d3aWb1fVvAvRcCWpLROTQ8/9WLBqsfj/Q9f
-X4XcHp5qm3x3CxYJ5rFoY3cMqdUkEG4FMNducFfEYYAg7mU6x9MJUClJ+JbkpA8y
-TYFvzBYB2n3BT4SUXX5AWmo7hn8VISPrgnAbLAXo+t4UdP9RxqE2LKQb/de3KDaz
-McVAQJZ+/ImTUZNAq5buZg0hC84xHLYtqywmBBeixhQWng==
------END CERTIFICATE-----

_service:tar_scm:stunnel-5.48.tar.gz/tests/execute Deleted

_service:tar_scm:stunnel-5.48.tar.gz/tests/execute_read Deleted

_service:tar_scm:stunnel-5.48.tar.gz/tests/execute_write Deleted

_service:tar_scm:stunnel-5.48.tar.gz/tests/make_test Deleted

@@ -1,98 +0,0 @@
-#!/bin/sh
-
-result=0
-count=0
-fail=0
-skip=0
-
-result_path=$(pwd)
-cd $(dirname "$0")
-script_path=$(pwd)
-cd "${result_path}"
-result_path="${result_path}/logs"
-
-autodetection() {
-
-  result=0
-  if  -n "$(command -v ncat)" 
-    then # ncat
-      mynetcat="ncat"
-    elif  -n "$(command -v nc)" 
-      then # nc
-        mynetcat="nc"
-    else # netcat is required
-      printf "%s\n" "ncat / nc not found in \$PATH"
-      result=1
-  fi
-
-  if  -n "$(command -v netstat)"  && ! netstat -a -n 2>&1 | grep -q -e "usage" -e "invalid" -e "illegal" -e "command not found"
-    then
-      mynetstat="netstat"
-    elif  -n "$(command -v ss)"  && ! ss -a -n -l 2>&1 | grep -q -e "usage" -e "invalid" -e "illegal" -e "command not found"
-      then
-        mynetstat="ss"
-    elif  -n "$(command -v lsof)"  && ! lsof -i -n -P 2>&1 | grep -q -e "usage" -e "invalid" -e "illegal" -e "command not found"
-      then
-        mynetstat="lsof"
-    else # netstat / ss / lsof is required
-      printf "%s\n" "netstat / ss / lsof not found in \$PATH or some option error"
-      result=1
-   fi
-
-  if  -n "$(command -v stdbuf)" 
-    then
-      mybuffer="stdbuf"
-    elif  -n "$(command -v unbuffer)" 
-      then
-        mybuffer="unbuffer"
-    else
-      mybuffer=""
-    fi
-
-  return $result
-}
-
-if autodetection
-  then
-    rm -rf "${result_path}"
-    mkdir "${result_path}"
-    cd "${result_path}"
-    date > "results.log"
-    ../../src/stunnel -version 2>> "results.log"
-    printf "\n%s\n" "Testing..." >> "results.log"
-    head -n5 "results.log"
-    if ! grep -q "solaris" "results.log"
-      then
-        for plik in ${script_path}/recipes/*
-          do
-            /bin/sh $plik "$mynetcat" "$mynetstat" "$mybuffer"
-            state=$?
-            if  "$state" -eq 0 
-              then # $state=0
-                count=$((count + 1))
-              elif  "$state" -eq 125 
-                then # $state=125
-                  skip=$((skip + 1))
-              else # $state=1
-                fail=$((fail + 1))
-                result=1
-              fi
-          done
-        if  $count -eq 0 
-          then # no test was done
-            result=1
-          fi
-        printf "%s\n" "summary: success $count, skip $skip, fail $fail"
-        printf "%s\n" "summary: success $count, skip $skip, fail $fail" >> "results.log"
-        printf "%s\n" "./make_test finished"
-        cd ..
-      else # skip make test for solaris
-        printf "%s\n" "./make_test skipped"
-        printf "%s\n" "./make_test skipped" >> "results.log"
-        #result=125
-      fi
-  else # netcat not found
-    printf "%s\n" "./make_test skipped"
-    #result=125
-  fi
-exit $result

_service:tar_scm:stunnel-5.48.tar.gz/tests/recipes Deleted

_service:tar_scm:stunnel-5.48.tar.gz/tests/recipes/010_require_cert Deleted

_service:tar_scm:stunnel-5.48.tar.gz/tests/recipes/011_verify_peer Deleted

_service:tar_scm:stunnel-5.48.tar.gz/tests/recipes/012_verify_chain Deleted

_service:tar_scm:stunnel-5.48.tar.gz/tests/recipes/013_CRL_file Deleted

_service:tar_scm:stunnel-5.48.tar.gz/tests/recipes/014_PSK_secrets Deleted

_service:tar_scm:stunnel-5.48.tar.gz/tests/recipes/015_p12_cert Deleted

_service:tar_scm:stunnel-5.48.tar.gz/tests/recipes/020_IPv6 Deleted

_service:tar_scm:stunnel-5.48.tar.gz/tests/recipes/021_FIPS Deleted

_service:tar_scm:stunnel-5.48.tar.gz/tests/recipes/022_bind Deleted

_service:tar_scm:stunnel-5.48.tar.gz/tests/recipes/030_simple_execute Deleted

_service:tar_scm:stunnel-5.48.tar.gz/tests/recipes/031_redirect Deleted

@@ -1,52 +0,0 @@
-#!/bin/sh
-. $(dirname $0)/../test_library
-
-start() {
- ../../src/stunnel -fd 0 <<EOT
- debug = debug
- syslog = no
- pid = ${result_path}/stunnel.pid
- output = ${result_path}/stunnel.log
-
- client_1
- client = yes
- accept = 127.0.0.1:${http1}
- connect = 127.0.0.1:${https1}
- ;cert = ${script_path}/certs/client_cert.pem
-;wrong certificate
- cert = ${script_path}/certs/stunnel.pem
-
- client_2
- client = yes
- accept = 127.0.0.1:${http2}
- connect = 127.0.0.1:${https2}
-
- client_3
- client = yes
- accept = 127.0.0.1:${http3}
- connect = 127.0.0.1:${https3}
-
- server_1
- accept = 127.0.0.1:${https1}
- connect = 127.0.0.1:${http2}
- redirect = ${http3}
- cert = ${script_path}/certs/server_cert.pem
- verifyPeer = yes
- CAfile = ${script_path}/certs/PeerCerts.pem
-
- server_2
- accept = 127.0.0.1:${https2}
- cert = ${script_path}/certs/server_cert.pem
- exec = ${script_path}/execute
- execArgs = execute 031_redirect_error
-
- server_3
- accept = 127.0.0.1:${https3}
- cert = ${script_path}/certs/server_cert.pem
- exec = ${script_path}/execute
- execArgs = execute 031_redirect
-EOT
-}
-
-test_log_for "031_redirect" "execute" "0" "$1" "$2" "$3" 2>> "stderr.log"
-exit $?

_service:tar_scm:stunnel-5.48.tar.gz/tests/recipes/032_no_redirect Deleted

@@ -1,51 +0,0 @@
-#!/bin/sh
-. $(dirname $0)/../test_library
-
-start() {
- ../../src/stunnel -fd 0 <<EOT
- debug = debug
- syslog = no
- pid = ${result_path}/stunnel.pid
- output = ${result_path}/stunnel.log
-
- client_1
- client = yes
- accept = 127.0.0.1:${http1}
- connect = 127.0.0.1:${https1}
-;correct certificate
- cert = ${script_path}/certs/client_cert.pem
-
- client_2
- client = yes
- accept = 127.0.0.1:${http2}
- connect = 127.0.0.1:${https2}
-
- client_3
- client = yes
- accept = 127.0.0.1:${http3}
- connect = 127.0.0.1:${https3}
-
- server_1
- accept = 127.0.0.1:${https1}
- connect = 127.0.0.1:${http2}
- redirect = ${http3}
- cert = ${script_path}/certs/server_cert.pem
- verifyPeer = yes
- CAfile = ${script_path}/certs/PeerCerts.pem
-
- server_2
- accept = 127.0.0.1:${https2}
- cert = ${script_path}/certs/server_cert.pem
- exec = ${script_path}/execute
- execArgs = execute 032_no_redirect
-
- server_3
- accept = 127.0.0.1:${https3}
- cert = ${script_path}/certs/server_cert.pem
- exec = ${script_path}/execute
- execArgs = execute 032_no_redirect_error
-EOT
-}
-
-test_log_for "032_no_redirect" "execute" "0" "$1" "$2" "$3" 2>> "stderr.log"
-exit $?

_service:tar_scm:stunnel-5.48.tar.gz/tests/recipes/033_redirect_exec Deleted

@@ -1,42 +0,0 @@
-#!/bin/sh
-. $(dirname $0)/../test_library
-
-start() {
- ../../src/stunnel -fd 0 <<EOT
- debug = debug
- syslog = no
- pid = ${result_path}/stunnel.pid
- output = ${result_path}/stunnel.log
-
- client_1
- client = yes
- accept = 127.0.0.1:${http1}
- connect = 127.0.0.1:${https1}
- ;cert = ${script_path}/certs/client_cert.pem
-;wrong certificate
- cert = ${script_path}/certs/stunnel.pem
-
- client_2
- client = yes
- accept = 127.0.0.1:${http2}
- connect = 127.0.0.1:${https2}
-
- server_1
- accept = 127.0.0.1:${https1}
- exec = ${script_path}/execute
- execArgs = execute 033_redirect_exec_error
- redirect = ${http2}
- cert = ${script_path}/certs/server_cert.pem
- verifyPeer = yes
- CAfile = ${script_path}/certs/PeerCerts.pem
-
- server_2
- accept = 127.0.0.1:${https2}
- cert = ${script_path}/certs/server_cert.pem
- exec = ${script_path}/execute
- execArgs = execute 033_redirect_exec
-EOT
-}
-
-test_log_for "033_redirect_exec" "execute" "0" "$1" "$2" "$3" 2>> "stderr.log"
-exit $?

_service:tar_scm:stunnel-5.48.tar.gz/tests/recipes/034_no_redirect_exec Deleted

@@ -1,41 +0,0 @@
-#!/bin/sh
-. $(dirname $0)/../test_library
-
-start() {
- ../../src/stunnel -fd 0 <<EOT
- debug = debug
- syslog = no
- pid = ${result_path}/stunnel.pid
- output = ${result_path}/stunnel.log
-
- client_1
- client = yes
- accept = 127.0.0.1:${http1}
- connect = 127.0.0.1:${https1}
-;correct certificate
- cert = ${script_path}/certs/client_cert.pem
-
- client_2
- client = yes
- accept = 127.0.0.1:${http2}
- connect = 127.0.0.1:${https2}
-
- server_1
- accept = 127.0.0.1:${https1}
- exec = ${script_path}/execute
- execArgs = execute 034_no_redirect_exec
- redirect = ${http2}
- cert = ${script_path}/certs/server_cert.pem
- verifyPeer = yes
- CAfile = ${script_path}/certs/PeerCerts.pem
-
- server_2
- accept = 127.0.0.1:${https2}
- cert = ${script_path}/certs/server_cert.pem
- exec = ${script_path}/execute
- execArgs = execute 034_no_redirect_exec_error
-EOT
-}
-
-test_log_for "034_no_redirect_exec" "execute" "0" "$1" "$2" "$3" 2>> "stderr.log"
-exit $?

_service:tar_scm:stunnel-5.48.tar.gz/tests/recipes/035_SNI Deleted

_service:tar_scm:stunnel-5.48.tar.gz/tests/recipes/036_no_SNI Deleted

_service:tar_scm:stunnel-5.48.tar.gz/tests/recipes/037_failover_prio1 Deleted

_service:tar_scm:stunnel-5.48.tar.gz/tests/recipes/038_failover_prio2 Deleted

_service:tar_scm:stunnel-5.48.tar.gz/tests/recipes/039_failover_rr Deleted

_service:tar_scm:stunnel-5.48.tar.gz/tests/recipes/040_reload Deleted

@@ -1,51 +0,0 @@
-#!/bin/sh
-. $(dirname $0)/../test_library
-
-set_config() {
-  echo "
-  debug = debug
-  syslog = no
-  pid = ${result_path}/stunnel.pid
-  output = ${result_path}/stunnel.log
-
-  client_1
-  client = yes
-  accept = 127.0.0.1:${http2}
-  connect = 127.0.0.1:${https1}
-
-  server_1
-  accept = 127.0.0.1:${https1}
-  connect = 127.0.0.1:${http_nc}
-  cert = ${script_path}/certs/server_cert.pem" > "stunnel.conf"
-}
-
-change_config() {
-#  accept = 127.0.0.1:${http2} -> accept = 127.0.0.1:${http1}
-  echo "
-  debug = debug
-  syslog = no
-  pid = ${result_path}/stunnel.pid
-  output = ${result_path}/stunnel.log
-
-  client_2
-  client = yes
-  accept = 127.0.0.1:${http1}
-  connect = 127.0.0.1:${https1}
-
-  server_2
-  accept = 127.0.0.1:${https1}
-  connect = 127.0.0.1:${http_nc}
-  cert = ${script_path}/certs/server_cert.pem" > "stunnel.conf"
-}
-
-start() {
-  set_config
-  ../../src/stunnel stunnel.conf
-}
-
-myglobal "$1" "$2" "$3"
-check_ports "040_reload"
-start_stunnel "040_reload" 2> "error.log"
-reload_stunnel "040_reload" 2>> "error.log"
-test_log_for "040_reload" "success" "0" "$1" "$2" "$3" 2>> "stderr.log"
-exit $?

_service:tar_scm:stunnel-5.48.tar.gz/tests/recipes/041_exec_connect Deleted

_service:tar_scm:stunnel-5.48.tar.gz/tests/recipes/042_inetd Deleted

_service:tar_scm:stunnel-5.48.tar.gz/tests/recipes/043_session_delay Deleted

_service:tar_scm:stunnel-5.48.tar.gz/tests/recipes/044_session_nodelay Deleted

_service:tar_scm:stunnel-5.48.tar.gz/tests/recipes/110_failure_require_cert Deleted

_service:tar_scm:stunnel-5.48.tar.gz/tests/recipes/111_failure_verify_peer Deleted

_service:tar_scm:stunnel-5.48.tar.gz/tests/recipes/112_failure_verify_chain Deleted

_service:tar_scm:stunnel-5.48.tar.gz/tests/recipes/113_failure_CRL_file Deleted

_service:tar_scm:stunnel-5.48.tar.gz/tests/recipes/114_failure_PSK_secrets Deleted

_service:tar_scm:stunnel-5.48.tar.gz/tests/recipes/120_failure_no_cert Deleted

_service:tar_scm:stunnel-5.48.tar.gz/tests/recipes/121_failure_wrong_config Deleted

_service:tar_scm:stunnel-5.48.tar.gz/tests/test_library Deleted

@@ -1,720 +0,0 @@
-# this file is a library sourced from recipes/*
-
-result_path=$(pwd)
-cd $(dirname "$0")/../
-script_path=$(pwd)
-cd "${result_path}"
-
-result_logs() {
- # $1 = test name
- # $2 = status: "ok" / "failed" / "configuration failed" / "expected error"
- # "skipped" / "netcat failed" / "shouldn't work"
- # $3 = file name: "stunnel" / "error"
-
- if "$2" = "expected error" 
- then # expected error - it's ok
- printf "%-35s\t%s\n" "test $1" "ok"
- else
- printf "%-35s\t%s\n" "test $1" "$2"
- fi
- if "$2" != "ok" 
- then
- printf "%-35s\t%s\n" "test $1" "$2" >> "results.log"
- fi
- if "$2" = "failed" || "$2" = "configuration failed" || "$2" = "shouldn't work" 
- then # file with stunnel error logs
- printf "%-35s\t%s\n" "error logs" "logs/$1.log"
- cat "$3.log" > "$1.log"
- else
- cat "temp.log" 2>> "stderr_nc.log" | head -n1 >> "results.log"
- fi
- if "$2" = "netcat failed" 
- then
- printf "\n%s\n" "Netcat failed" >> "stderr_nc.log"
- fi
- return 0
-}
-
-exit_logs() {
- # $1 = test name
- # $2 = status
-
- case "$2" in
- "ok") result_logs "$1" "ok" "UNUSED PATTERN";;
- "failed") result_logs "$1" "failed" "stunnel";;
- "configuration failed") result_logs "$1" "configuration failed" "error";;
- "expected error") result_logs "$1" "expected error" "UNUSED PATTERN";;
- "skipped") result_logs "$1" "skipped" "error";;
- "netcat failed") result_logs "$1" "netcat failed" "stunnel";;
- "shouldn't work") result_logs "$1" "shouldn't work" "stunnel";;
- *) echo "$1 exit_logs error"
- esac
- return 0
-}
-
-clean_logs() {
- cat "stderr_nc.log" >> "stderr.log"
- rm -f "stderr_nc.log"
- rm -f "stunnel.log"
- rm -f "temp.log"
- rm -f "error.log"
- rm -f "stunnel.conf"
- rm -f "nodata"
- return 0
-}
-
-finding_text() {
- # $1 = to find (yes) or not to find (no)
- # $2 = pattern
- # $3 = file 1
- # $4 = file 2
-
- local result=0
- if grep -q "$2" "$3" "$4"
- then
- if $1 = "yes" 
- then # to find
- exit_code="ok"
- else # not to find
- exit_code="failed"
- result=1
- fi
- else # no matching
- if $1 = "yes" 
- then # to find
- exit_code="failed"
- result=1
- fi
- fi
- return $result
-}
-
-no_file() {
- # $1 = file
-
- local result=0
- if -s "$1" 
- then
- exit_code="configuration failed"
- result=1
- fi
- return $result
-}
-
-waiting_for() {
- # waiting for string $2 to appear in the file $1.log
-
- mkfifo "fifo" 2>> "stderr_nc.log"
- (cat "$1.log"; tail -f "$1.log") > "fifo" 2>> "stderr_nc.log" &
- pid_tail=$!
- (sleep 3; echo "TIMEOUT") > "fifo" &
- pid_timeout=$!
- grep -q -e "$2" -e "TIMEOUT" "fifo"
- pid_children=$(ps -o pid,ppid | \
- awk -v ppid1="${pid_tail}" -v ppid2="${pid_timeout}" \
- '{if ($2==ppid1 || $2==ppid2) print $1}')
- kill -TERM ${pid_tail} ${pid_timeout} ${pid_children} 2>> "stderr_nc.log"
- wait ${pid_tail} ${pid_timeout} 2>> "stderr_nc.log"
- rm -f "fifo"
- return 0
-}
-
-find_free() {
- # finding a free port
- # $1 = mynetstat name: "netstat -a -n" / "ss -a -n -l" / "lsof -i -n -P"
-
- while $mynetstat $opt_net | grep "$http_find" | grep "LISTEN" >> "stderr_nc.log"
- do
- http_find=$((http_find+1))
- done
- return 0
-}
-
-check_ports() {
- # seting the initial ports
- # $1 = test name
-
- result=0
- printf "\n%s\n" "test $1" >> "stderr_nc.log"
- http_find=8080
- find_free
- http_nc=$http_find
- http_find=4567
- find_free
- https_free=$http_find
-
- http1=$((http_nc+1))
- http2=$((http_nc+2))
- http3=$((http_nc+3))
- https1=4433
- https2=4434
- https3=4435
- return 0
-}
-
-bind_http_ports(){
- grep "Binding service \client.*to" "error.log" >> "stderr_nc.log"
- grep "Binding service \client.*failed" "error.log" >> "stderr_nc.log"
- while -s "error.log" && grep -q "Binding service \client.*failed" "error.log"
- do
- if $http_bind -eq $http1 
- then
- http1=$((http1+1))
- http2=$((http2+1))
- http3=$((http3+1))
- elif $http_bind -eq $http2 
- then
- http2=$((http2+1))
- http3=$((http3+1))
- else
- http3=$((http3+1))
- fi
- http_bind=$((http_bind+1))
- start 2> "error.log"
- grep "Binding service \client.*to" "error.log" >> "stderr_nc.log"
- grep "Binding service \client.*failed" "error.log" >> "stderr_nc.log"
- done
- return 0
-}
-
-bind_https_ports(){
- grep "Binding service \server.*to" "error.log" >> "stderr_nc.log"
- grep "Binding service \server.*failed" "error.log" >> "stderr_nc.log"
- while -s "error.log" && grep -q "Binding service \server.*failed" "error.log"
- do
- if $https_bind -eq $https1 
- then
- https1=$((https1+1))
- https2=$((https2+1))
- https3=$((https3+1))
- elif $https_bind -eq $https2 
- then
- https2=$((https2+1))
- https3=$((https3+1))
- else
- https3=$((https3+1))
- fi
- https_bind=$((https_bind+1))
- start 2> "error.log"
- grep "Binding service \server.*to" "error.log" >> "stderr_nc.log"
- grep "Binding service \server.*failed" "error.log" >> "stderr_nc.log"
- done
- return 0
-}
-
-start_stunnel() {
- # running stunnel until to bind free ports
- # $1 = test name
-
- start 2> "error.log"
- http_bind=$http1
- bind_http_ports
- http_bind=$http2
- bind_http_ports
- http_bind=$http3
- bind_http_ports
-
- https_bind=$https1
- bind_https_ports
- https_bind=$https2
- bind_https_ports
- https_bind=$https3
- bind_https_ports
-
- printf "\n%s %s %s %s %s %s %s\n" "test $1 ports: $http_nc $http1 $http2 $http3 $https1 $https2 $https3 $https_free" >> "stderr_nc.log"
- return 0
-}
-
-killing_stunnel() {
-
- local result=0
- if kill -TERM $(tail "stunnel.pid") 2>> "stderr_nc.log"
- then
- waiting_for "stunnel" "Removed pid file"
- else
- exit_code="failed"
- result=1
- fi
- return $result
-}
-
-reload_stunnel() {
- # $1 = test name
-
- local result=0
- printf "\n%s\n" "test $1 - reload stunnel" >> "stderr_nc.log"
- if ! -s "error.log" 
- then
- change_config
- waiting_for "stunnel" "stunnel.pid"
- kill -HUP $(tail "stunnel.pid") 2>> "stderr_nc.log"
- waiting_for "stunnel" "127.0.0.1:$http1"
- grep "Binding service \client.*$http1" "stunnel.log" >> "stderr_nc.log"
- grep "Binding service \client.*failed" "stunnel.log" >> "stderr_nc.log"
- while ! grep -q "Service \client.*bound to.*$http1" "stunnel.log"
- do
- http1=$((http1+1))
- change_config
- kill -HUP $(tail "stunnel.pid") 2>> "stderr_nc.log"
- waiting_for "stunnel" "127.0.0.1:$http1"
- grep "Binding service \client.*$http1" "stunnel.log" >> "stderr_nc.log"
- done
- printf "\n%s\n" "test $1 - accept port: $http1" >> "stderr_nc.log"
- else
- printf "\n%s" "$1 error: failed to reload the configuration file" >> "error.log"
- result=1
- fi
- return $result
-}
-
-check_listening() {
- # waiting for netcat listening on port
- # $1 = port number
-
- result=0
- while $result -eq 0 && ! $mynetstat $opt_net | grep "$1" | grep "LISTEN" >> "stderr_nc.log"
- do
- printf "\n%s\n" "waiting for netcat listening on $1" >> "stderr_nc.log"
- if grep -q -e "failed:" -e "usage" -e "QUITTING" -e "invalid" -e "command not found" "stderr_nc.log"
- then
- result=1
- fi
- done
- return $result
-}
-
-connecting_ncat() {
- # $1 = test name
- # $2 = string to send
-
- local result=0
- mkfifo "nodata" 2>> "stderr_nc.log"
- printf "\n%s\n" "test $1 - netcat connection" >> "stderr_nc.log"
- if "$mynetcat" = "nc" 
- then # nc
- if man "$mynetcat" | grep -q "error to use this option in conjunction"
- then # BSD nc
- cat "nodata" | $mybuffer $opt_buf $mynetcat -l "$http_nc" -vvv > "temp.log" 2>> "stderr_nc.log" &
- else # traditional nc
- cat "nodata" | $mybuffer $opt_buf $mynetcat -l -p "$http_nc" -vvv > "temp.log" 2>> "stderr_nc.log" &
- fi
- pid_nc=$!
- if check_listening "$http_nc"
- then
- printf "%-35s\t%s\n" "test $1" "$2" | $mynetcat 127.0.0.1 "$http1" -vv 1>&2 2>> "stderr_nc.log" &
- pid_nce=$!
- if "$2" = "shouldn't work" 
- then
- waiting_for "stunnel" "Service .* finished"
- else
- waiting_for "temp" "test $1"
- fi
- else # nc failed
- exit_code="netcat failed"
- result=1
- fi
- else # ncat
- cat "nodata" | $mybuffer $opt_buf $mynetcat -l -p $http_nc -vvv > temp.log 2>> stderr_nc.log &
- pid_nc=$!
- if check_listening "$http_nc"
- then
- if ncat --version 2>&1 | grep -q -e 'Version 0-5\.' -e 'Version 6\.0-1' -e 'Version 6\.20-4'
- then # ncat version < 6.25
- printf "%-35s\t%s\n" "test $1" "$2" | "$mynetcat" 127.0.0.1 "$http1" -vv 1>&2 2>> "stderr_nc.log" &
- else # ncat version >= 6.25
- printf "%-35s\t%s\n" "test $1" "$2" | "$mynetcat" 127.0.0.1 "$http1" -vv 1>&2 2>> "stderr_nc.log"
- fi
- pid_nce=$!
- if "$2" = "shouldn't work" 
- then
- waiting_for "stunnel" "Service .* finished"
- else
- waiting_for "temp" "test $1"
- fi
- else # ncat failed
- exit_code="netcat failed"
- result=1
- fi
- fi
- kill -TERM ${pid_nc} ${pid_nce} 2>> "stderr_nc.log"
- echo "somedata" > "nodata" 2>> "stderr_nc.log"
- rm -f "nodata"
- return $result
-}
-
-sending_ncat() {
- # starting netcat for execute tests
- # $1 = test name
-
- mkfifo "nodata" 2>> "stderr_nc.log"
- cat "nodata" | $mybuffer $opt_buf $mynetcat 127.0.0.1 "$http1" -vv >"temp.log" 2>> "stderr_nc.log" &
- pid_nce=$(pgrep -P $!)
- waiting_for "temp" "test $1"
- kill -TERM ${pid_nce} 2>> "stderr_nc.log"
- echo "somedata" > "nodata" 2>> "stderr_nc.log"
- rm -f "nodata"
- return 0
-}
-
-expected_success() {
- # expects to send the message using stunnel
- # $1 = test name
-
- local result=0
- if "$1" != "040_reload" 
- then
- check_ports "$1"
- start_stunnel "$1"
- fi
- if no_file "error.log"
- then
- if connecting_ncat "$1" "success"
- then
- finding_text "yes" "test $1.*success" "temp.log" "UNUSED PATTERN"
- result=$?
- else # ncat (nc) failed
- result=1
- fi
- if ! killing_stunnel
- then
- result=1
- fi
- else # configuration failed
- result=1
- fi
- if ! finding_text "no" "INTERNAL ERROR" "stunnel.log" "error.log"
- then
- result=1
- fi
- exit_logs "$1" "$exit_code"
- return $result
-}
-
-expected_failure() {
- # $1 = test name
-
- local result=0
- check_ports "$1"
- start_stunnel "$1"
- if no_file "error.log"
- then
- if connecting_ncat "$1" "shouldn't work"
- then
- if ! finding_text "no" "test $1.*shouldn't work" "temp.log" "UNUSED PATTERN"
- then # ops...stunnel works
- exit_code="shouldn't work"
- result=1
- else
- exit_code="expected error"
- fi
- else # ncat (nc) failed
- result=1
- fi
- if ! killing_stunnel
- then
- result=1
- fi
- else # configuration failed, but it is ok
- exit_code="expected error"
- fi
- if ! finding_text "no" "INTERNAL ERROR" "stunnel.log" "error.log"
- then
- result=1
- fi
- exit_logs "$1" "$exit_code"
- return $result
-}
-
-execute_program() {
- # $1 = test name
-
- local result=0
- check_ports "$1"
- start_stunnel "$1"
- if no_file "error.log"
- then
- sending_ncat "$1"
- if ! killing_stunnel
- then
- result=1
- fi
- if $result -eq 0 
- then
- if finding_text "yes" "test $1.*success" "temp.log" "UNUSED PATTERN"
- then
- finding_text "no" "$1_error" "temp.log" "UNUSED PATTERN"
- result=$?
- else
- result=1
- fi
- fi
- else # configuration failed
- result=1
- fi
- if ! finding_text "no" "INTERNAL ERROR" "stunnel.log" "error.log"
- then
- result=1
- fi
- exit_logs "$1" "$exit_code"
- return $result
-}
-
-execute_connect() {
- # $1 = test name
-
- local result=0
- check_ports "$1"
- start_stunnel "$1"
- if "$1" = "042_inetd" 
- then # inetd test
- start_inetd > "temp.log" 2>> "error.log"
- fi
- if no_file "error.log"
- then
- waiting_for "stunnel" "Service .* finished"
- if $1 = "042_inetd" 
- then # inetd test
- waiting_for "stunnel_0" "Service .* finished"
- fi
- finding_text "yes" "test $1.*success" "temp.log" "UNUSED PATTERN"
- result=$?
- if "$1" = "042_inetd" 
- then # inetd test
- printf "%s\n" "*** inetd mode ***" >> "stunnel.log"
- cat "stunnel_0.log" >> "stunnel.log"
- fi
- if ! killing_stunnel
- then
- result=1
- fi
- else # configuration failed
- result=1
- fi
- if ! finding_text "no" "INTERNAL ERROR" "stunnel.log" "error.log"
- then
- result=1
- fi
- rm -f "stunnel_0.log"
- exit_logs "$1" "$exit_code"
- return $result
-}
-
-loop_prio() {
- # $1 = test name
-
- local result=0
- local i=1
- local max=12
- if $1 = "037_failover_prio1" 
- then
- local serv="server_2\ accepted connection"
- else
- local serv="server_1\ accepted connection"
- fi
- check_ports "$1"
- start_stunnel "$1"
- if no_file "error.log"
- then
- waiting_for "stunnel" "Created pid file"
- mv "stunnel.log" "stunnel_0.log"
- kill -USR1 $(tail "stunnel.pid") 2>> "stderr_nc.log"
- while $i -le $max && $result -eq 0 
- do
- if connecting_ncat "$1" "success"
- then
- finding_text "yes" "test $1.*success" "temp.log" "UNUSED PATTERN"
- result=$?
- if $result -eq 0 && ! finding_text "no" "$serv" "stunnel.log" "UNUSED PATTERN"
- then # error - second server accepts a client
-		 result=1
- fi
- else # ncat (nc) failed
- result=1
- fi
- mv "stunnel.log" "stunnel_$i.log"
- kill -USR1 $(tail "stunnel.pid") 2>> "stderr_nc.log"
- i=$((i + 1))
- done
- cat "stunnel_0.log" > "stunnel_all.log"
- rm -f "stunnel_0.log"
- local j=1
- while $j -lt $i 
- do
- printf "%s\n" "*** connection $j ***" >> "stunnel_all.log"
- cat "stunnel_$j.log" >> "stunnel_all.log"
- rm -f "stunnel_$j.log"
- j=$((j + 1))
- done
- if ! killing_stunnel
- then
- result=1
- fi
- cat "stunnel.log" >> "stunnel_all.log"
- cat "stunnel_all.log" > "stunnel.log"
- rm -f "stunnel_all.log"
- else # configuration failed
- result=1
- fi
- if ! finding_text "no" "INTERNAL ERROR" "stunnel.log" "error.log"
- then
- result=1
- fi
- exit_logs "$1" "$exit_code"
- return $result
-}
-
-loop_rr() {
- # $1 = test name
-
- local result=0
- local i=1
- local max=3
- local first=0
- local second=0
- local third=0
- check_ports "$1"
- start_stunnel "$1"
- if no_file "error.log"
- then
- waiting_for "stunnel" "Created pid file"
- mv "stunnel.log" "stunnel_0.log"
- kill -USR1 $(tail "stunnel.pid") 2>> "stderr_nc.log"
- while $i -le $max && $result -eq 0 
- do
- if connecting_ncat "$1" "success"
- then
- finding_text "yes" "test $1.*success" "temp.log" "UNUSED PATTERN"
- result=$?
- else # ncat (nc) failed
- result=1
- fi
- mv "stunnel.log" "stunnel_$i.log"
- kill -USR1 $(tail "stunnel.pid") 2>> "stderr_nc.log"
- i=$((i + 1))
- done
- cat "stunnel_0.log" > "stunnel_all.log"
- rm -f "stunnel_0.log"
- j=1
- while $j -lt $i 
- do
- printf "%s\n" "*** connection $j ***" >> "stunnel_all.log"
- cat "stunnel_$j.log" >> "stunnel_all.log"
- rm -f "stunnel_$j.log"
- j=$((j + 1))
- done
- if ! killing_stunnel
- then
- result=1
- fi
- cat "stunnel.log" >> "stunnel_all.log"
- cat "stunnel_all.log" > "stunnel.log"
- rm -f "stunnel_all.log"
- if $result -eq 0 
- then
- first=$(grep -c "server_1\ accepted connection" "stunnel.log")
- second=$(grep -c "server_2\ accepted connection" "stunnel.log")
- third=$(grep -c "server_3\ accepted connection" "stunnel.log")
- product=$((first * second * third))
- if $product -ne 0 
- then # round robin
- printf "%-35s\t%s\n" "test $1: $first x $second x $third" "success" > "temp.log"
- else
- printf "%-35s\t%s\n" "test $1: $first x $second x $third" "failed" > "temp.log"
- exit_code="failed"
- result=1
- fi
- fi
- else # configuration failed
- result=1
- fi
- if ! finding_text "no" "INTERNAL ERROR" "stunnel.log" "error.log"
- then
- result=1
- fi
- exit_logs "$1" "$exit_code"
- return $result
-}
-
-loop_session() {
- # $1 = test name
- # $2 = number of connections
-
- local result=0
- local i=0
- local j=0
- local max=$((2*$2))
- check_ports "$1"
- start_stunnel "$1"
- if no_file "error.log"
- then
- waiting_for "stunnel" "Created pid file"
- while $i -lt $max 
- do
- i=$(grep -c "Retrying an exec+connect section" "stunnel.log")
- done
- if ! killing_stunnel stunnel
- then
- result=1
- fi
- finding_text "yes" "test $1.*success" "temp.log" "UNUSED PATTERN"
- result=$?
- j=$(grep -c "accepted: new session negotiated" "stunnel.log")
- if $result -eq 0 && $j -ne $2 
- then
- exit_code="failed"
- result=1
- fi
- else # configuration failed
- result=1
- fi
- if ! finding_text "no" "INTERNAL ERROR" "stunnel.log" "error.log"
- then
- result=1
- fi
- exit_logs "$1" "$exit_code"
- return $result
-}
-
-myglobal() {
- # $1 = mynetcat name: "ncat" / "nc"
- # $2 = mynetstat name: "netstat" / "ss" / "lsof"
- # $3 = mybuffer name: "stdbuf" / "unbuffer" / ""
-
- mynetcat="$1"
- mynetstat="$2"
- mybuffer="$3"
-
- case "$mynetstat" in
- "netstat") opt_net="-a -n";;
- "ss" ) opt_net="-a -n -l";;
- "lsof" ) opt_net="-i -n -P";;
- esac
-
- case "$mybuffer" in
- "stdbuf") opt_buf="-o0";;
- esac
- return 0
-}
-
-test_log_for() {
- # $1 = test name
- # $2 = function name
- # $3 = number of connections for loop_session
- # $4 = mynetcat name: "ncat" / "nc"
- # $5 = mynetstat name: "netstat" / "ss" / "lsof"
- # $6 = mybuffer name: "stdbuf" / "unbuffer" / ""
-
- myglobal "$4" "$5" "$6"
- case "$2" in
- "success") expected_success "$1";;
- "failure") expected_failure "$1";;
- "execute") execute_program "$1";;
- "exe_con") execute_connect "$1";;
- "prio") loop_prio "$1";;
- "rr") loop_rr "$1";;
- "session") loop_session "$1" "$3";;
- esac
- result=$?
- clean_logs
- return $result
-}

_service:tar_scm:stunnel-5.69.tar.gz.asc Added

_service:tar_scm:stunnel-5.69.tar.gz/AUTHORS.md Added

_service:tar_scm:stunnel-5.69.tar.gz/BUGS.md Added

_service:tar_scm:stunnel-5.69.tar.gz/COPYING.md Added

@@ -0,0 +1,34 @@
+# stunnel license (see COPYRIGHT.md for detailed GPL conditions)
+
+
+_Copyright (C) 1998-2023 Michal Trojnara_
+
+This program is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free Software
+Foundation; either version 2 of the License, or (at your option) any later
+version.
+
+This program is distributed in the hope that it will be useful, but WITHOUT
+ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License along with
+this program; if not, see <http://www.gnu.org/licenses>.
+
+Linking stunnel statically or dynamically with other modules is making
+a combined work based on stunnel. Thus, the terms and conditions of the
+GNU General Public License cover the whole combination.
+
+In addition, as a special exception, the copyright holder of stunnel gives you
+permission to combine stunnel with free software programs or libraries that
+are released under the GNU LGPL and with code included in the standard release
+of OpenSSL under the OpenSSL License (or modified versions of such code, with
+unchanged license). You may copy and distribute such a system following the
+terms of the GNU GPL for stunnel and the licenses of the other code concerned.
+
+Note that people who make modified versions of stunnel are not obligated to
+grant this special exception for their modified versions; it is their choice
+whether to do so. The GNU General Public License gives permission to release
+a modified version without this exception; this exception also makes it
+possible to release a modified version which carries forward this exception.
+

_service:tar_scm:stunnel-5.69.tar.gz/COPYRIGHT.md Added

@@ -0,0 +1,336 @@
+GNU General Public License
+==========================
+
+_Version 2, June 1991_ 
+_Copyright © 1989, 1991 Free Software Foundation, Inc.,_ 
+_51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA_
+
+Everyone is permitted to copy and distribute verbatim copies
+of this license document, but changing it is not allowed.
+
+### Preamble
+
+The licenses for most software are designed to take away your
+freedom to share and change it. By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users. This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it. (Some other Free Software Foundation software is covered by
+the GNU Lesser General Public License instead.) You can apply it to
+your programs, too.
+
+When we speak of free software, we are referring to freedom, not
+price. Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have. You must make sure that they, too, receive or can get the
+source code. And you must show them these terms so they know their
+rights.
+
+We protect your rights with two steps: **(1)** copyright the software, and
+**(2)** offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software. If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+Finally, any free program is threatened constantly by software
+patents. We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary. To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+The precise terms and conditions for copying, distribution and
+modification follow.
+
+### TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+**0.** This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License. The “Program”, below,
+refers to any such program or work, and a “work based on the Program”
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language. (Hereinafter, translation is included without limitation in
+the term “modification”.) Each licensee is addressed as “you”.
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope. The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+**1.** You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+**2.** You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+* **a)** You must cause the modified files to carry prominent notices
+stating that you changed the files and the date of any change.
+* **b)** You must cause any work that you distribute or publish, that in
+whole or in part contains or is derived from the Program or any
+part thereof, to be licensed as a whole at no charge to all third
+parties under the terms of this License.
+* **c)** If the modified program normally reads commands interactively
+when run, you must cause it, when started running for such
+interactive use in the most ordinary way, to print or display an
+announcement including an appropriate copyright notice and a
+notice that there is no warranty (or else, saying that you provide
+a warranty) and that users may redistribute the program under
+these conditions, and telling the user how to view a copy of this
+License. (Exception: if the Program itself is interactive but
+does not normally print such an announcement, your work based on
+the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole. If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works. But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+**3.** You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+* **a)** Accompany it with the complete corresponding machine-readable
+source code, which must be distributed under the terms of Sections
+1 and 2 above on a medium customarily used for software interchange; or,
+* **b)** Accompany it with a written offer, valid for at least three
+years, to give any third party, for a charge no more than your
+cost of physically performing source distribution, a complete
+machine-readable copy of the corresponding source code, to be
+distributed under the terms of Sections 1 and 2 above on a medium
+customarily used for software interchange; or,
+* **c)** Accompany it with the information you received as to the offer
+to distribute corresponding source code. (This alternative is
+allowed only for noncommercial distribution and only if you
+received the program in object code or executable form with such
+an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it. For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable. However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+**4.** You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License. Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+**5.** You are not required to accept this License, since you have not
+signed it. However, nothing else grants you permission to modify or
+distribute the Program or its derivative works. These actions are
+prohibited by law if you do not accept this License. Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+**6.** Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions. You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+**7.** If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License. If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all. For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices. Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+**8.** If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded. In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+**9.** The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time. Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number. If the Program
+specifies a version number of this License which applies to it and “any
+later version”, you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation. If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+**10.** If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission. For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this. Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+### NO WARRANTY
+
+**11.** BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+**12.** IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+END OF TERMS AND CONDITIONS
+
+### How to Apply These Terms to Your New Programs
+
+If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+To do so, attach the following notices to the program. It is safest
+to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least
+the “copyright” line and a pointer to where the full notice is found.
+
+ <one line to give the program's name and a brief idea of what it does.>
+ Copyright (C) <year> <name of author>
+ 
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 2 of the License, or
+ (at your option) any later version.
+ 
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+ 
+ You should have received a copy of the GNU General Public License along
+ with this program; if not, write to the Free Software Foundation, Inc.,
+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program is interactive, make it output a short notice like this
+when it starts in an interactive mode:
+
+ Gnomovision version 69, Copyright (C) year name of author
+ Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+ This is free software, and you are welcome to redistribute it
+ under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w` and `show c` should show the appropriate
+parts of the General Public License. Of course, the commands you use may
+be called something other than `show w` and `show c`; they could even be
+mouse-clicks or menu items--whatever suits your program.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a “copyright disclaimer” for the program, if
+necessary. Here is a sample; alter the names:
+
+ Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+ `Gnomovision' (which makes passes at compilers) written by James Hacker.
+ 
+ <signature of Ty Coon>, 1 April 1989
+ Ty Coon, President of Vice
+
+This General Public License does not permit incorporating your program into
+proprietary programs. If your program is a subroutine library, you may
+consider it more useful to permit linking proprietary applications with the
+library. If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.

_service:tar_scm:stunnel-5.69.tar.gz/CREDITS.md Added

@@ -0,0 +1,42 @@
+# stunnel code contributions
+
+
+The code contributions are licensed as public domain unless stated otherwise.
+
+* Several Win32 and WCE improvements and bugfixes
+ - Pierre Delaage <delaage.pierre@free.fr>
+
+* Systemd socket activation dded in version 5.05
+ - Mark Theunissen
+
+ > Copyright (c) 2014 Mark Theunissen
+ >
+ > Permission is hereby granted, free of charge, to any person obtaining a copy of
+ > this software and associated documentation files (the "Software"), to deal in
+ > the Software without restriction, including without limitation the rights to
+ > use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+ > of the Software, and to permit persons to whom the Software is furnished to do
+ > so, subject to the following conditions:
+ >
+ > The above copyright notice and this permission notice shall be included in all
+ > copies or substantial portions of the Software.
+ >
+ > THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ > IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ > FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ > AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ > LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ > OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ > SOFTWARE.
+
+* Several bugfixes and improvements mostly in versions 3.xx
+ - Brian Hatch <bri@stunnel.org>
+
+* Initial PTY support in version 3.05:
+ - Dirk O. Siebnich <dok@vossnet.de>
+
+* Initial SSL support in versions 1.x:
+ - Adam Hernik <adas@infocentrum.com>
+ - Pawel Krawczyk <kravietz@ceti.com.pl>
+
+and many others...

_service:tar_scm:stunnel-5.69.tar.gz/INSTALL.FIPS.md Added

@@ -0,0 +1,24 @@
+# stunnel FIPS install notes
+
+
+### Unix HOWTO
+* Only dynamic linking of the FIPS-enabled OpenSSL is currently supported,
+  i.e. FIPS-enabled OpenSSL has to be configured with "shared" parameter.
+* FIPS mode is autodetected if possible.  It can be forced with:
+    ./configure --enable-fips
+  or disable with:
+    ./configure --disable-fips
+
+### WIN32 HOWTO
+* On 32-bit Windows install one of the following compilers:
+  - MSVC 8.0 (VS 2005) Standard or Professional Edition
+  - MSVC 9.0 (VS 2008) any edition including Express Edition
+* On 64-bit Windows install one of the following compilers:
+  - MSVC 8.0 (VS 2005) Standard or Professional Edition
+  - MSVC 9.0 (VS 2008) Standard or Professional Edition
+* Build FIPS-compliant OpenSSL DLLS according to:
+  https://www.openssl.org/docs/fips/UserGuide-2.0.pdf
+* Build stunnel normally with MSVC or Mingw.
+  Mingw build requires DLL stubs.  Stubs can be built with:
+  dlltool --def ms/libeay32.def --output-lib libcrypto.a
+  dlltool --def ms/ssleay32.def --output-lib libssl.a

_service:tar_scm:stunnel-5.69.tar.gz/INSTALL.W32.md Added

@@ -0,0 +1,105 @@
+# stunnel Windows install notes
+
+
+### Cross-compiling 64-bit stunnel from source with MinGW (optional):
+
+ 1) Install the mingw64 cross-compiler on a Unix/Linux machine.
+    On Debian (and derivatives, including Ubuntu):
+      sudo apt install gcc-mingw-w64-x86-64
+    On Arch Linux:
+      aurman -S mingw-w64-gcc-bin
+
+ 2) Download the recent OpenSSL and unpack it:
+      tar zvxf ~/openssl-(version).tar.gz
+      mv openssl-(version) openssl-(version)-mingw64
+      cd openssl-(version)-mingw64/
+
+ 3) Build and install OpenSSL.
+      ./Configure \
+        --cross-compile-prefix=x86_64-w64-mingw32- \
+        --prefix=/opt/openssl-mingw64 mingw64 shared enable-capieng
+      sed -i 's/"\$(OPENSSLDIR)/"..\/config/' Makefile
+      sed -i 's/"\$(ENGINESDIR)/"..\/engines/' Makefile
+      sed -i 's/"\$(MODULESDIR)/"..\/ossl-modules/' Makefile
+      make
+      sudo make install
+      sudo cp ms/applink.c /opt/openssl-mingw64/include/openssl/
+
+ 4) Download and unpack stunnel-(version).tar.gz.
+
+ 5) Configure stunnel.
+      cd stunnel-(version)
+      ./configure
+
+ 6) Build 64-bit Windows executables.
+      cd src
+      make mingw64
+
+
+### Cross-compiling 32-bit stunnel from source with MinGW (optional):
+
+ 1) Install the mingw64 cross-compiler on a Unix/Linux machine.
+    On Debian (and derivatives, including Ubuntu):
+      sudo apt install gcc-mingw-w64-i686
+    On Arch Linux:
+      aurman -S mingw-w64-gcc-bin
+
+ 2) Download the recent OpenSSL and unpack it:
+      tar zvxf ~/openssl-(version).tar.gz
+      mv openssl-(version) openssl-(version)-mingw
+      cd openssl-(version)-mingw/
+
+ 3) Build and install OpenSSL.
+      ./Configure \
+        --cross-compile-prefix=i686-w64-mingw32- \
+        --prefix=/opt/openssl-mingw mingw shared enable-capieng
+      sed -i 's/"\$(OPENSSLDIR)/"..\/config/' Makefile
+      sed -i 's/"\$(ENGINESDIR)/"..\/engines/' Makefile
+      sed -i 's/"\$(MODULESDIR)/"..\/ossl-modules/' Makefile
+      make
+      sudo make install
+      sudo cp ms/applink.c /opt/openssl-mingw/include/openssl/
+
+ 4) Download and unpack stunnel-(version).tar.gz.
+
+ 5) Configure stunnel.
+      cd stunnel-(version)
+      ./configure
+
+ 6) Build 32-bit Windows executables.
+      cd src
+      make mingw
+
+
+### Building stunnel from source with MinGW (optional):
+
+ Building stunnel with MinGW on a Windows machine is possible,
+ but not currently supported.
+
+
+### Building stunnel from source with Visual Studio (optional):
+
+ 1) Build your own or download pre-built OpenSSL library and headers.
+    TODO
+
+ 2) Configure path to your OpenSSL in the src\vc.mak file.
+
+ 3) Build stunnel in Visual Studio Command Prompt.
+      cd src
+      nmake -f vc.mak
+
+
+### Installing stunnel:
+
+ 1) Install stunnel.
+    Run installer to install the precompiled binaries.
+    Alternatively, copy the stunnel.exe and/or tstunnel.exe executable located in
+    /stunnel-(version)/bin/mingw/ or /stunnel-(version)/bin/mingw64/ directory
+    into the destination directory on a Windows machine.
+    Copy OpenSSL DLLs into the same directory if necessary.
+    For a MinGW build also copy libssp-0.dll.
+    For a Visual Studio build also install Microsoft Visual C++ Redistributable.
+
+ 2) Read the manual (stunnel.html).
+
+ 3) Create/edit the stunnel.conf configuration file.

_service:tar_scm:stunnel-5.69.tar.gz/INSTALL.WCE.md Added

@@ -0,0 +1,44 @@
+# stunnel Windows CE install notes
+
+
+### Two stunnel executables are available for Windows CE platform:
+
+  1) stunnel.exe - version with interactive GUI
+
+  2) tstunnel.exe - non-iteractive version for headless devices
+
+
+### Building stunnel from source (optional):
+
+  1) install the following tools:
+     evt2002web_min.exe from http://www.microsoft.com/
+     ActivePerl from http://www.activestate.com/Products/ActivePerl/
+     unzip.exe (file needs to be renamed) from
+       http://www.mirrorservice.org/sites/ftp.info-zip.org/pub/infozip/WIN32/
+
+  2) download the OpenSSL source files (the whole directory):
+     ftp://ftp.stunnel.org/stunnel/openssl/ce/
+  
+  3) your directory should look like this:
+     build.bat
+     build.pl
+     unzip.exe
+     src\openssl-0.9.8a.zip
+     src\wcecompat-1.2.zip
+
+  4) type "build" to build OpenSSL
+
+  5) download and unpack stunnel-(version).tar.gz
+
+  4) enter "stunnel-(version)\src" subdirectory
+
+  5) type "makece" to build stunnel
+
+
+### Installing stunnel:
+
+  1) copy OpenSSL DLLs and stunnel.exe or tstunnel.exe into \stunnel directory
+
+  2) read the manual (stunnel.html)
+
+  3) create/edit stunnel.conf configuration file

_service:tar_scm:stunnel-5.48.tar.gz/Makefile.am -> _service:tar_scm:stunnel-5.69.tar.gz/Makefile.am Changed

@@ -1,5 +1,7 @@
 ## Process this file with automake to produce Makefile.in
-# by Michal Trojnara 1998-2018
+# by Michal Trojnara 1998-2023
+
+AM_DISTCHECK_CONFIGURE_FLAGS = --with-bashcompdir='$$(datarootdir)/bash-completion/completions'
 
 ACLOCAL_AMFLAGS = -I m4
 
@@ -9,41 +11,41 @@
 libtool: $(LIBTOOL_DEPS)
 	$(SHELL) ./config.status libtool
 
-EXTRA_DIST = PORTS BUGS COPYRIGHT.GPL CREDITS
-EXTRA_DIST += INSTALL.W32 INSTALL.WCE INSTALL.FIPS
-EXTRA_DIST += build-android.sh .travis.yml
-
 docdir = $(datadir)/doc/stunnel
-doc_DATA = INSTALL README TODO COPYING AUTHORS ChangeLog
-doc_DATA += PORTS BUGS COPYRIGHT.GPL CREDITS
-doc_DATA += INSTALL.W32 INSTALL.WCE INSTALL.FIPS
+doc_DATA = README.md TODO.md COPYING.md AUTHORS.md NEWS.md
+doc_DATA += PORTS.md BUGS.md COPYRIGHT.md CREDITS.md
+doc_DATA += INSTALL.W32.md INSTALL.WCE.md INSTALL.FIPS.md
 
-distcleancheck_listfiles = find -type f -exec sh -c 'test -f $(srcdir)/{} || echo {}' ';'
+EXTRA_DIST = .travis.yml makedh.sh $(doc_DATA)
+
+distcleancheck_listfiles = find . -type f -exec sh -c 'test -f $(srcdir)/{} || echo {}' ';'
 
 distclean-local:
 	rm -rf autom4te.cache
-#	rm -f $(distdir)-win32-installer.exe
-
-#dist-hook:
-#	makensis -NOCD -DVERSION=${VERSION} \
-#		-DSTUNNEL_DIR=$(srcdir) \
-#		-DROOT_DIR=/usr/src \
-#		$(srcdir)/tools/stunnel.nsi
 
-sign: dist
-	cp -f $(distdir).tar.gz $(distdir)-win32-installer.exe $(distdir)-android.zip ../dist
-	gpg-agent --daemon /bin/sh -c "cd ../dist; gpg --yes --armor --detach-sign --force-v3-sigs $(distdir).tar.gz; gpg --yes --armor --detach-sign --force-v3-sigs $(distdir)-win32-installer.exe; gpg --yes --armor --detach-sign --force-v3-sigs $(distdir)-android.zip"
+sign:
+	cp -f $(distdir).tar.gz $(distdir)-win64-installer.exe $(distdir)-android.zip ../dist
+	-gpg-agent --daemon
+	/bin/sh -c "cd ../dist; gpg --yes --armor --detach-sign --force-v3-sigs $(distdir).tar.gz; gpg --yes --armor --detach-sign --force-v3-sigs $(distdir)-win64-installer.exe; gpg --yes --armor --detach-sign --force-v3-sigs $(distdir)-android.zip"
 	sha256sum $(distdir).tar.gz >../dist/$(distdir).tar.gz.sha256
-	sha256sum $(distdir)-win32-installer.exe >../dist/$(distdir)-win32-installer.exe.sha256
+	sha256sum $(distdir)-win64-installer.exe >../dist/$(distdir)-win64-installer.exe.sha256
 	sha256sum $(distdir)-android.zip >../dist/$(distdir)-android.zip.sha256
 	cat ../dist/$(distdir)*.sha256 | tac
 
 cert:
 	$(MAKE) -C tools cert
 
+mingw:
+	$(MAKE) -C src mingw
+
+mingw64:
+	$(MAKE) -C src mingw64
+
 test: check
 
 install-data-hook:
 	@echo "*********************************************************"
 	@echo "* Type 'make cert' to also install a sample certificate *"
 	@echo "*********************************************************"
+
+.PHONY: sign cert mingw mingw64 test

_service:tar_scm:stunnel-5.48.tar.gz/Makefile.in -> _service:tar_scm:stunnel-5.69.tar.gz/Makefile.in Changed

@@ -1,7 +1,7 @@
-# Makefile.in generated by automake 1.15 from Makefile.am.
+# Makefile.in generated by automake 1.16.5 from Makefile.am.
 # @configure_input@
 
-# Copyright (C) 1994-2014 Free Software Foundation, Inc.
+# Copyright (C) 1994-2021 Free Software Foundation, Inc.
 
 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -14,7 +14,7 @@
 
 @SET_MAKE@
 
-# by Michal Trojnara 1998-2018
+# by Michal Trojnara 1998-2023
 
 VPATH = @srcdir@
 am__is_gnu_make = { \
@@ -169,7 +169,7 @@
   $(RECURSIVE_CLEAN_TARGETS) \
   $(am__extra_recursive_targets)
 AM_RECURSIVE_TARGETS = $(am__recursive_targets:-recursive=) TAGS CTAGS \
-	cscope distdir dist dist-all distcheck
+	cscope distdir distdir-am dist dist-all distcheck
 am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
 # Read a list of newline-separated strings from the standard input,
 # and print each of them once, without duplicates.  Input order is
@@ -187,17 +187,13 @@
   unique=`for i in $$list; do \
     if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
   done | $(am__uniquify_input)`
-ETAGS = etags
-CTAGS = ctags
-CSCOPE = cscope
 DIST_SUBDIRS = $(SUBDIRS)
 am__DIST_COMMON = $(srcdir)/Makefile.in $(top_srcdir)/auto/compile \
 	$(top_srcdir)/auto/config.guess $(top_srcdir)/auto/config.sub \
 	$(top_srcdir)/auto/install-sh $(top_srcdir)/auto/ltmain.sh \
-	$(top_srcdir)/auto/missing AUTHORS COPYING ChangeLog INSTALL \
-	NEWS README TODO auto/compile auto/config.guess \
-	auto/config.sub auto/depcomp auto/install-sh auto/ltmain.sh \
-	auto/missing
+	$(top_srcdir)/auto/missing AUTHORS.md NEWS.md README.md \
+	auto/compile auto/config.guess auto/config.sub auto/install-sh \
+	auto/ltmain.sh auto/missing
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
 distdir = $(PACKAGE)-$(VERSION)
 top_distdir = $(distdir)
@@ -236,6 +232,8 @@
 DIST_ARCHIVES = $(distdir).tar.gz
 GZIP_ENV = --best
 DIST_TARGETS = dist-gzip
+# Exists only to be overridden by the user if desired.
+AM_DISTCHECK_DVI_TARGET = dvi
 distuninstallcheck_listfiles = find . -type f -print
 am__distuninstallcheck_listfiles = $(distuninstallcheck_listfiles) \
   | sed 's|^\./|$(prefix)/|' | grep -v '$(infodir)/dir$$'
@@ -252,6 +250,8 @@
 CFLAGS = @CFLAGS@
 CPP = @CPP@
 CPPFLAGS = @CPPFLAGS@
+CSCOPE = @CSCOPE@
+CTAGS = @CTAGS@
 CYGPATH_W = @CYGPATH_W@
 DEFAULT_GROUP = @DEFAULT_GROUP@
 DEFS = @DEFS@
@@ -263,6 +263,7 @@
 ECHO_N = @ECHO_N@
 ECHO_T = @ECHO_T@
 EGREP = @EGREP@
+ETAGS = @ETAGS@
 EXEEXT = @EXEEXT@
 FGREP = @FGREP@
 GREP = @GREP@
@@ -300,6 +301,7 @@
 PATH_SEPARATOR = @PATH_SEPARATOR@
 PTHREAD_CC = @PTHREAD_CC@
 PTHREAD_CFLAGS = @PTHREAD_CFLAGS@
+PTHREAD_CXX = @PTHREAD_CXX@
 PTHREAD_LIBS = @PTHREAD_LIBS@
 RANDOM_FILE = @RANDOM_FILE@
 RANLIB = @RANLIB@
@@ -322,6 +324,7 @@
 am__tar = @am__tar@
 am__untar = @am__untar@
 ax_pthread_config = @ax_pthread_config@
+bashcompdir = @bashcompdir@
 bindir = @bindir@
 build = @build@
 build_alias = @build_alias@
@@ -363,13 +366,14 @@
 top_build_prefix = @top_build_prefix@
 top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
+AM_DISTCHECK_CONFIGURE_FLAGS = --with-bashcompdir='$$(datarootdir)/bash-completion/completions'
 ACLOCAL_AMFLAGS = -I m4
 SUBDIRS = src doc tools tests
-EXTRA_DIST = PORTS BUGS COPYRIGHT.GPL CREDITS INSTALL.W32 INSTALL.WCE \
-	INSTALL.FIPS build-android.sh .travis.yml
-doc_DATA = INSTALL README TODO COPYING AUTHORS ChangeLog PORTS BUGS \
-	COPYRIGHT.GPL CREDITS INSTALL.W32 INSTALL.WCE INSTALL.FIPS
-distcleancheck_listfiles = find -type f -exec sh -c 'test -f $(srcdir)/{} || echo {}' ';'
+doc_DATA = README.md TODO.md COPYING.md AUTHORS.md NEWS.md PORTS.md \
+	BUGS.md COPYRIGHT.md CREDITS.md INSTALL.W32.md INSTALL.WCE.md \
+	INSTALL.FIPS.md
+EXTRA_DIST = .travis.yml makedh.sh $(doc_DATA)
+distcleancheck_listfiles = find . -type f -exec sh -c 'test -f $(srcdir)/{} || echo {}' ';'
 all: all-recursive
 
 .SUFFIXES:
@@ -379,23 +383,23 @@
 	@for dep in $?; do \
 	  case '$(am__configure_deps)' in \
 	    *$$dep*) \
-	      echo ' cd $(srcdir) && $(AUTOMAKE) --gnu'; \
-	      $(am__cd) $(srcdir) && $(AUTOMAKE) --gnu \
+	      echo ' cd $(srcdir) && $(AUTOMAKE) --foreign'; \
+	      $(am__cd) $(srcdir) && $(AUTOMAKE) --foreign \
 		&& exit 0; \
 	      exit 1;; \
 	  esac; \
 	done; \
-	echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu Makefile'; \
+	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign Makefile'; \
 	$(am__cd) $(top_srcdir) && \
-	  $(AUTOMAKE) --gnu Makefile
+	  $(AUTOMAKE) --foreign Makefile
 Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
 	@case '$?' in \
 	  *config.status*) \
 	    echo ' $(SHELL) ./config.status'; \
 	    $(SHELL) ./config.status;; \
 	  *) \
-	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $@ $(am__depfiles_maybe)'; \
-	    cd $(top_builddir) && $(SHELL) ./config.status $@ $(am__depfiles_maybe);; \
+	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $@ $(am__maybe_remake_depfiles)'; \
+	    cd $(top_builddir) && $(SHELL) ./config.status $@ $(am__maybe_remake_depfiles);; \
 	esac;
 
 $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
@@ -542,8 +546,10 @@
 distclean-tags:
 	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
 	-rm -f cscope.out cscope.in.out cscope.po.out cscope.files
+distdir: $(BUILT_SOURCES)
+	$(MAKE) $(AM_MAKEFLAGS) distdir-am
 
-distdir: $(DISTFILES)
+distdir-am: $(DISTFILES)
 	$(am__remove_distdir)
 	test -d "$(distdir)" || mkdir "$(distdir)"
 	@srcdirstrip=`echo "$(srcdir)" | sed 's/.^$$\\*/\\\\&/g'`; \
@@ -608,7 +614,7 @@
 	  ! -type d ! -perm -444 -exec $(install_sh) -c -m a+r {} {} \; \
 	|| chmod -R a+r "$(distdir)"
 dist-gzip: distdir
-	tardir=$(distdir) && $(am__tar) | GZIP=$(GZIP_ENV) gzip -c >$(distdir).tar.gz
+	tardir=$(distdir) && $(am__tar) | eval GZIP= gzip $(GZIP_ENV) -c >$(distdir).tar.gz
 	$(am__post_remove_distdir)
 
 dist-bzip2: distdir
@@ -623,6 +629,10 @@
 	tardir=$(distdir) && $(am__tar) | XZ_OPT=$${XZ_OPT--e} xz -c >$(distdir).tar.xz
 	$(am__post_remove_distdir)
 
+dist-zstd: distdir
+	tardir=$(distdir) && $(am__tar) | zstd -c $${ZSTD_CLEVEL-$${ZSTD_OPT--19}} >$(distdir).tar.zst
+	$(am__post_remove_distdir)
+
 dist-tarZ: distdir
 	@echo WARNING: "Support for distribution archives compressed with" \
 		       "legacy program 'compress' is deprecated." >&2
@@ -634,7 +644,7 @@
 	@echo WARNING: "Support for shar distribution archives is" \
 	               "deprecated." >&2
 	@echo WARNING: "It will be removed altogether in Automake 2.0" >&2
-	shar $(distdir) | GZIP=$(GZIP_ENV) gzip -c >$(distdir).shar.gz
+	shar $(distdir) | eval GZIP= gzip $(GZIP_ENV) -c >$(distdir).shar.gz
 	$(am__post_remove_distdir)
 
 dist-zip: distdir
@@ -652,7 +662,7 @@
 distcheck: dist
 	case '$(DIST_ARCHIVES)' in \
 	*.tar.gz*) \
-	  GZIP=$(GZIP_ENV) gzip -dc $(distdir).tar.gz | $(am__untar) ;;\
+	  eval GZIP= gzip $(GZIP_ENV) -dc $(distdir).tar.gz | $(am__untar) ;;\
 	*.tar.bz2*) \
 	  bzip2 -dc $(distdir).tar.bz2 | $(am__untar) ;;\
 	*.tar.lz*) \
@@ -662,9 +672,11 @@
 	*.tar.Z*) \
 	  uncompress -c $(distdir).tar.Z | $(am__untar) ;;\
 	*.shar.gz*) \
-	  GZIP=$(GZIP_ENV) gzip -dc $(distdir).shar.gz | unshar ;;\
+	  eval GZIP= gzip $(GZIP_ENV) -dc $(distdir).shar.gz | unshar ;;\
 	*.zip*) \
 	  unzip $(distdir).zip ;;\
+	*.tar.zst*) \
+	  zstd -dc $(distdir).tar.zst | $(am__untar) ;;\
 	esac
 	chmod -R a-w $(distdir)
 	chmod u+w $(distdir)
@@ -680,7 +692,7 @@
 	    $(DISTCHECK_CONFIGURE_FLAGS) \
 	    --srcdir=../.. --prefix="$$dc_install_base" \
 	  && $(MAKE) $(AM_MAKEFLAGS) \
-	  && $(MAKE) $(AM_MAKEFLAGS) dvi \
+	  && $(MAKE) $(AM_MAKEFLAGS) $(AM_DISTCHECK_DVI_TARGET) \
 	  && $(MAKE) $(AM_MAKEFLAGS) check \
 	  && $(MAKE) $(AM_MAKEFLAGS) install \
 	  && $(MAKE) $(AM_MAKEFLAGS) installcheck \
@@ -847,18 +859,19 @@
 	am--refresh check check-am clean clean-cscope clean-generic \
 	clean-libtool cscope cscopelist-am ctags ctags-am dist \
 	dist-all dist-bzip2 dist-gzip dist-lzip dist-shar dist-tarZ \
-	dist-xz dist-zip distcheck distclean distclean-generic \
-	distclean-libtool distclean-local distclean-tags \
-	distcleancheck distdir distuninstallcheck dvi dvi-am html \
-	html-am info info-am install install-am install-data \
-	install-data-am install-data-hook install-docDATA install-dvi \
-	install-dvi-am install-exec install-exec-am install-html \
-	install-html-am install-info install-info-am install-man \
-	install-pdf install-pdf-am install-ps install-ps-am \
-	install-strip installcheck installcheck-am installdirs \
-	installdirs-am maintainer-clean maintainer-clean-generic \
-	mostlyclean mostlyclean-generic mostlyclean-libtool pdf pdf-am \
-	ps ps-am tags tags-am uninstall uninstall-am uninstall-docDATA
+	dist-xz dist-zip dist-zstd distcheck distclean \
+	distclean-generic distclean-libtool distclean-local \
+	distclean-tags distcleancheck distdir distuninstallcheck dvi \
+	dvi-am html html-am info info-am install install-am \
+	install-data install-data-am install-data-hook install-docDATA \
+	install-dvi install-dvi-am install-exec install-exec-am \
+	install-html install-html-am install-info install-info-am \
+	install-man install-pdf install-pdf-am install-ps \
+	install-ps-am install-strip installcheck installcheck-am \
+	installdirs installdirs-am maintainer-clean \
+	maintainer-clean-generic mostlyclean mostlyclean-generic \
+	mostlyclean-libtool pdf pdf-am ps ps-am tags tags-am uninstall \
+	uninstall-am uninstall-docDATA
 
 .PRECIOUS: Makefile
 
@@ -867,25 +880,25 @@
 
 distclean-local:
 	rm -rf autom4te.cache
-#	rm -f $(distdir)-win32-installer.exe
-
-#dist-hook:
-#	makensis -NOCD -DVERSION=${VERSION} \
-#		-DSTUNNEL_DIR=$(srcdir) \
-#		-DROOT_DIR=/usr/src \
-#		$(srcdir)/tools/stunnel.nsi
 
-sign: dist
-	cp -f $(distdir).tar.gz $(distdir)-win32-installer.exe $(distdir)-android.zip ../dist
-	gpg-agent --daemon /bin/sh -c "cd ../dist; gpg --yes --armor --detach-sign --force-v3-sigs $(distdir).tar.gz; gpg --yes --armor --detach-sign --force-v3-sigs $(distdir)-win32-installer.exe; gpg --yes --armor --detach-sign --force-v3-sigs $(distdir)-android.zip"
+sign:
+	cp -f $(distdir).tar.gz $(distdir)-win64-installer.exe $(distdir)-android.zip ../dist
+	-gpg-agent --daemon
+	/bin/sh -c "cd ../dist; gpg --yes --armor --detach-sign --force-v3-sigs $(distdir).tar.gz; gpg --yes --armor --detach-sign --force-v3-sigs $(distdir)-win64-installer.exe; gpg --yes --armor --detach-sign --force-v3-sigs $(distdir)-android.zip"
 	sha256sum $(distdir).tar.gz >../dist/$(distdir).tar.gz.sha256
-	sha256sum $(distdir)-win32-installer.exe >../dist/$(distdir)-win32-installer.exe.sha256
+	sha256sum $(distdir)-win64-installer.exe >../dist/$(distdir)-win64-installer.exe.sha256
 	sha256sum $(distdir)-android.zip >../dist/$(distdir)-android.zip.sha256
 	cat ../dist/$(distdir)*.sha256 | tac
 
 cert:
 	$(MAKE) -C tools cert
 
+mingw:
+	$(MAKE) -C src mingw
+
+mingw64:
+	$(MAKE) -C src mingw64
+
 test: check
 
 install-data-hook:
@@ -893,6 +906,8 @@
 	@echo "* Type 'make cert' to also install a sample certificate *"
 	@echo "*********************************************************"
 
+.PHONY: sign cert mingw mingw64 test
+
 # Tell versions 3.59,3.63) of GNU make to not export all variables.
 # Otherwise a system limit (for SysV at least) may be exceeded.
 .NOEXPORT:

_service:tar_scm:stunnel-5.69.tar.gz/NEWS.md Added

@@ -0,0 +1,2262 @@
+# stunnel change log
+
+
+### Version 5.69, 2023.03.04, urgency: MEDIUM
+* New features
+ - Improved logging performance with the "output" option.
+ - Improved file read performance on the WIN32 platform.
+ - DH and kDHEPSK ciphersuites removed from FIPS defaults.
+ - Set the LimitNOFILE ulimit in stunnel.service to allow
+ for up to 10,000 concurrent clients.
+* Bugfixes
+ - Fixed the "CApath" option on the WIN32 platform by
+ applying https://github.com/openssl/openssl/pull/20312.
+ - Fixed stunnel.spec used for building rpm packages.
+ - Fixed tests on some OSes and architectures by merging
+ Debian 07-tests-errmsg.patch (thx to Peter Pentchev).
+
+### Version 5.68, 2023.02.07, urgency: HIGH
+* Security bugfixes
+ - OpenSSL DLLs updated to version 3.0.8.
+* New features
+ - Added the new 'CAengine' service-level option
+ to load a trusted CA certificate from an engine.
+ - Added requesting client certificates in server
+ mode with 'CApath' besides 'CAfile'.
+ - Improved file read performance.
+ - Improved logging performance.
+* Bugfixes
+ - Fixed EWOULDBLOCK errors in protocol negotiation.
+ - Fixed handling TLS errors in protocol negotiation.
+ - Prevented following fatal TLS alerts with TCP resets.
+ - Improved OpenSSL initialization on WIN32.
+ - Improved testing suite stability.
+
+### Version 5.67, 2022.11.01, urgency: HIGH
+* Security bugfixes
+ - OpenSSL DLLs updated to version 3.0.7.
+* New features
+ - Provided a logging callback to custom engines.
+* Bugfixes
+ - Fixed "make cert" with OpenSSL older than 3.0.
+ - Fixed the code and the documentation to use conscious
+ language for SNI servers (thx to Clemens Lang).
+
+### Version 5.66, 2022.09.11, urgency: MEDIUM
+* New features
+ - OpenSSL 3.0 FIPS Provider support for Windows.
+* Bugfixes
+ - Fixed building on machines without pkg-config.
+ - Added the missing "environ" declaration for
+ BSD-based operating systems.
+ - Fixed the passphrase dialog with OpenSSL 3.0.
+
+### Version 5.65, 2022.07.17, urgency: HIGH
+* Security bugfixes
+ - OpenSSL DLLs updated to version 3.0.5.
+* Bugfixes
+ - Fixed handling globally enabled FIPS.
+ - Fixed openssl.cnf processing in WIN32 GUI.
+ - Fixed a number of compiler warnings.
+ - Fixed tests on older versions of OpenSSL.
+
+### Version 5.64, 2022.05.06, urgency: MEDIUM
+* Security bugfixes
+ - OpenSSL DLLs updated to version 3.0.3.
+* New features
+ - Updated the pkcs11 engine for Windows.
+* Bugfixes
+ - Removed the SERVICE_INTERACTIVE_PROCESS flag in
+ "stunnel -install".
+
+### Version 5.63, 2022.03.15, urgency: HIGH
+* Security bugfixes
+ - OpenSSL DLLs updated to version 3.0.2.
+* New features
+ - Updated stunnel.spec to support bash completion.
+* Bugfixes
+ - Fixed a PRNG initialization crash (thx to Gleydson Soares).
+
+### Version 5.62, 2022.01.17, urgency: MEDIUM
+* New features
+ - Added a bash completion script.
+* Bugfixes
+ - Fixed a transfer() loop bug.
+
+### Version 5.61, 2021.12.22, urgency: LOW
+* New features sponsored by the University of Maryland
+ - Added new "protocol = capwin" and "protocol = capwinctrl"
+ configuration file options.
+* New features for the Windows platform
+ - Added client mode allowing authenticated users to view
+ logs, reconfigure and terminate running stunnel services.
+ - Added support for multiple GUI and service instances
+ distinguised by the location of stunnel.conf.
+ - Improved log window scrolling.
+ - Added a new 'Pause auto-scroll' GUI checkbox.
+ - Double click on the icon tray replaced with single click.
+ - OpenSSL DLLs updated to version 3.0.1.
+* Other new features
+ - Rewritten the testing framework in python (thx to
+ Peter Pentchev for inspiration and initial framework).
+ - Added support for missing SSL_set_options() values.
+ - Updated stunnel.spec to support RHEL8.
+* Bugfixes
+ - Fixed OpenSSL 3.0 build.
+ - Fixed reloading configuration with
+ "systemctl reload stunnel.service".
+ - Fixed incorrect messages logged for OpenSSL errors.
+ - Fixed printing IPv6 socket option defaults on FreeBSD.
+
+### Version 5.60, 2021.08.16, urgency: LOW
+* New features
+ - New 'sessionResume' service-level option to allow
+ or disallow session resumption
+ - Added support for the new SSL_set_options() values.
+ - Download fresh ca-certs.pem for each new release.
+* Bugfixes
+ - Fixed 'redirect' with 'protocol'. This combination is
+ not supported by 'smtp', 'pop3' and 'imap' protocols.
+ - Enforced minimum WIN32 log window size.
+ - Fixed support for password-protected private keys with
+ OpenSSL 3.0 (thx to Dmitry Belyavskiy).
+
+### Version 5.59, 2021.04.05, urgency: HIGH
+* Security bugfixes
+ - OpenSSL DLLs updated to version 1.1.1k.
+* New features
+ - Client-side "protocol = ldap" support (thx to Bart
+ Dopheide and Seth Grover).
+* Bugfixes
+ - The test suite fixed not to require external connectivity.
+ - Fixed paths in generated manuals (thx to Tatsuki Makino).
+ - Fixed configuration reload when compression is used.
+ - Fixed compilation with early releases of OpenSSL 1.1.1.
+
+### Version 5.58, 2021.02.20, urgency: HIGH
+* Security bugfixes
+ - The "redirect" option was fixed to properly handle
+ unauthenticated requests (thx to Martin Stein).
+ - Fixed a double free with OpenSSL older than 1.1.0 (thx to
+ Petr Strukov).
+ - OpenSSL DLLs updated to version 1.1.1j.
+* New features
+ - New 'protocolHeader' service-level option to insert custom
+ 'connect' protocol negotiation headers. This feature can
+ be used to impersonate other software (e.g. web browsers).
+ - 'protocolHost' can also be used to control the client SMTP
+ protocol negotiation HELO/EHLO value.
+ - Initial FIPS 3.0 support.
+* Bugfixes
+ - X.509v3 extensions required by modern versions of OpenSSL
+ are added to generated self-signed test certificates.
+ - Fixed a tiny memory leak in configuration file reload
+ error handling (thx to Richard Könning).
+ - Merged Debian 05-typos.patch (thx to Peter Pentchev).
+ - Merged with minor changes Debian 06-hup-separate.patch
+ (thx to Peter Pentchev).
+ - Merged Debian 07-imap-capabilities.patch (thx to Ansgar).
+ - Merged Debian 08-addrconfig-workaround.patch (thx to Peter
+ Pentchev).
+ - Fixed tests on the WSL2 platform.
+ - NSIS installer updated to version 3.06 to fix a multiuser
+ installation bug on some platforms, including 64-bit XP.
+ - Fixed engine initialization (thx to Petr Strukov).
+ - FIPS TLS feature is reported when a provider or container
+ is available, and not when FIPS control API is available.
+
+### Version 5.57, 2020.10.11, urgency: HIGH
+* Security bugfixes
+ - The "redirect" option was fixed to properly
+ handle "verifyChain = yes" (thx to Rob Hoes).
+ - OpenSSL DLLs updated to version 1.1.1h.
+* New features
+ - New securityLevel configuration file option.
+ - FIPS support for RHEL-based distributions.
+ - Support for modern PostgreSQL clients (thx to Bram Geron).
+ - Windows tooltip texts updated to mention "stunnel".
+ - TLS 1.3 configuration updated for better compatibility.
+* Bugfixes
+ - Fixed a transfer() loop bug.
+ - Fixed memory leaks on configuration reloading errors.
+ - DH/ECDH initialization restored for client sections.
+ - Delay startup with systemd until network is online.
+ - bin\libssp-0.dll removed when uninstalling.
+ - A number of testing framework fixes and improvements.
+
+### Version 5.56, 2019.11.22, urgency: HIGH
+* New features
+ - Various text files converted to Markdown format.
+* Bugfixes
+ - Support for realpath(3) implementations incompatible
+ with POSIX.1-2008, such as 4.4BSD or Solaris.
+ - Support for engines without PRNG seeding methods (thx to
+ Petr Mikhalitsyn).
+ - Retry unsuccessful port binding on configuration
+ file reload.
+ - Thread safety fixes in SSL_SESSION object handling.
+ - Terminate clients on exit in the FORK threading model.
+
+### Version 5.55, 2019.06.10, urgency: HIGH
+* Security bugfixes
+ - Fixed a Windows local privilege escalation vulnerability
+ caused insecure OpenSSL cross-compilation defaults.
+ Successful exploitation requires stunnel to be deployed
+ as a Windows service, and user-writable C:\ folder. This
+ vulnerability was discovered and reported by Rich Mirch.
+ - OpenSSL DLLs updated to version 1.1.1c.
+* Bugfixes
+ - Implemented a workaround for Windows hangs caused by its
+ inability to the monitor the same socket descriptor from
+ multiple threads.
+ - Windows configuration (including cryptographic keys)
+ is now completely removed at uninstall.
+ - A number of testing framework fixes and improvements.
+
+### Version 5.54, 2019.05.15, urgency: LOW
+* New features
+ - New "ticketKeySecret" and "ticketMacSecret" options
+ to control confidentiality and integrity protection
+ of the issued session tickets. These options allow
+ for session resumption on other nodes in a cluster.
+ - Added logging the list of active connections on
+ SIGUSR2 or with Windows GUI.
+ - Logging of the assigned bind address instead of the
+ requested bind address.
+* Bugfixes
+ - Service threads are terminated before OpenSSL cleanup
+ to prevent occasional stunnel crashes at shutdown.
+
+### Version 5.53, 2019.04.10, urgency: HIGH
+* New features
+ - Android binary updated to support Android 4.x.
+* Bugfixes
+ - Fixed data transfer stalls introduced in stunnel 5.51.
+
+### Version 5.52, 2019.04.08, urgency: HIGH
+* Bugfixes
+ - Fixed a transfer() loop bug introduced in stunnel 5.51.
+
+### Version 5.51, 2019.04.04, urgency: MEDIUM
+* New features
+ - OpenSSL DLLs updated to version 1.1.1b.
+ - Hexadecimal PSK keys are automatically converted to binary.
+ - Session ticket support (requires OpenSSL 1.1.1 or later).
+ "connect" address persistence is currently unsupported
+ with session tickets.
+ - SMTP HELO before authentication (thx to Jacopo Giudici).
+ - New "curves" option to control the list of elliptic
+ curves in OpenSSL 1.1.0 and later.
+ - New "ciphersuites" option to control the list of
+ permitted TLS 1.3 ciphersuites.
+ - Include file name and line number in OpenSSL errors.
+ - Compatibility with the current OpenSSL 3.0.0-dev branch.
+ - Better performance with SSL_set_read_ahead()/SSL_pending().
+* Bugfixes
+ - Fixed PSKsecrets as a global option (thx to Teodor Robas).
+ - Fixed a memory allocation bug (thx to matanfih).
+
+### Version 5.50, 2018.12.02, urgency: MEDIUM
+* New features
+ - 32-bit Windows builds replaced with 64-bit builds.
+ - OpenSSL DLLs updated to version 1.1.1.
+ - Check whether "output" is not a relative file name.
+ - Added sslVersion, sslVersionMin and sslVersionMax
+ for OpenSSL 1.1.0 and later.
+* Bugfixes
+ - Fixed PSK session resumption with TLS 1.3.
+ - Fixed a memory leak in the WIN32 logging subsystem.
+ - Allow for zero value (ignored) TLS options.
+ - Partially refactored configuration file parsing and
+ logging subsystems for clearer code and minor bugfixes.
+* Caveats
+ - We removed FIPS support from our standard builds.
+ FIPS will still be available with custom builds.
+
+### Version 5.49, 2018.09.03, urgency: MEDIUM
+* New features
+ - Performance optimizations.
+ - Logging of negotiated or resumed TLS session IDs (thx
+ to ANSSI - National Cybersecurity Agency of France).
+ - Merged Debian 10-enabled.patch and 11-killproc.patch
+ (thx to Peter Pentchev).
+ - OpenSSL DLLs updated to version 1.0.2p.
+ - PKCS#11 engine DLL updated to version 0.4.9.
+* Bugfixes
+ - Fixed a crash in the session persistence implementation.
+ - Fixed syslog identifier after configuration file reload.
+ - Fixed non-interactive "make check" invocations.
+ - Fixed reloading syslog configuration.
+ - stunnel.pem created with SHA-256 instead of SHA-1.
+ - SHA-256 "make check" certificates.
+
+### Version 5.48, 2018.07.02, urgency: HIGH
+* Security bugfixes
+ - Fixed requesting client certificate when specified
+ as a global option.
+* New features
+ - Certificate subject checks modified to accept certificates
+ if at least one of the specified checks matches.
+
+### Version 5.47, 2018.06.23, urgency: HIGH
+* New features
+ - Fast add_lock_callback for OpenSSL < 1.1.0.
+ This largely improves performance on heavy load.
+ - Automatic detection of Homebrew OpenSSL.
+ - Clarified port binding error logs.
+ - Various "make test" improvements.
+* Bugfixes
+ - Fixed a crash on switching to SNI secondary sections.
+
+### Version 5.46, 2018.05.28, urgency: MEDIUM
+* New features
+ - The default cipher list was updated to a safer value:
+ "HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK".
+* Bugfixes
+ - Default accept address restored to INADDR_ANY.
+
+### Version 5.45, 2018.05.21, urgency: MEDIUM
+* New feature sponsored by https://loadbalancer.org/
+ - Implemented delayed deallocation of service sections
+ after configuration file reload.
+* Other new features
+ - OpenSSL DLLs updated to version 1.0.2o.
+ - Deprecated the sslVersion option.
+ - The "socket" option is now also available in service sections.
+ - Implemented try-restart in the SysV init script (thx to
+ Peter Pentchev).
+ - TLS 1.3 compliant session handling for OpenSSL 1.1.1.
+ - Default "failover" value changed from "rr" to "prio".
+ - New "make check" tests.
+* Bugfixes
+ - A service no longer refuses to start if binding fails for
+ some (but not all) addresses:ports.
+ - Fixed compression handling with OpenSSL 1.1.0 and later.
+ - _beginthread() replaced with safer _beginthreadex().
+ - Fixed exception handling in libwrap.
+ - Fixed exec+connect services.
+ - Fixed automatic resolver delaying.
+ - Fixed a Gentoo cross-compilation bug (thx to Joe Harvell).
+ - A number of "make check" framework fixes.
+ - Fixed false postive memory leak logs.
+ - Build fixes for OpenSSL versions down to 0.9.7.
+ - Fixed (again) round-robin failover in the FORK threading model.
+
+### Version 5.44, 2017.11.26, urgency: MEDIUM
+* New features
+ - Signed Win32 executables, libraries, and installer.
+* Bugfixes
+ - Default accept address restored to INADDR_ANY.
+ - Fixed a race condition in "make check".
+ - Fixed removing the pid file after configuration reload.
+
+### Version 5.43, 2017.11.05, urgency: LOW
+* New features
+ - OpenSSL DLLs updated to version 1.0.2m.
+ - Android build updated to OpenSSL 1.1.0g.
+ - Allow for multiple "accept" ports per section.
+ - Self-test framework (make check).
+ - Added config load before OpenSSL init (thx to Dmitrii Pichulin).
+ - OpenSSL 1.1.0 support for Travis CI.
+ - OpenSSL 1.1.1-dev compilation fixes.
+* Bugfixes
+ - Fixed a memory fault on Solaris.
+ - Fixed round-robin failover in the FORK threading model.
+ - Fixed handling SSL_ERROR_ZERO_RETURN in SSL_shutdown().
+ - Minor fixes of the logging subsystem.
+
+### Version 5.42, 2017.07.16, urgency: HIGH
+* New features
+ - "redirect" also supports "exec" and not only "connect".
+ - PKCS#11 engine DLL updated to version 0.4.7.
+* Bugfixes
+ - Fixed premature cron thread initialization causing hangs.
+ - Fixed "verifyPeer = yes" on OpenSSL <= 1.0.1.
+ - Fixed pthreads support on OpenSolaris.
+
+### Version 5.41, 2017.04.01, urgency: MEDIUM
+* New features
+ - PKCS#11 engine DLL updated to version 0.4.5.
+ - Default engine UI set with ENGINE_CTRL_SET_USER_INTERFACE.
+ - Key file name added into the passphrase console prompt.
+ - Performance optimization in memory leak detection.
+* Bugfixes
+ - Fixed crashes with the OpenSSL 1.1.0 branch.
+ - Fixed certificate verification with "verifyPeer = yes"
+ and "verifyChain = no" (the default), while the peer
+ only returns a single certificate.
+
+### Version 5.40, 2017.01.28, urgency: HIGH
+* Security bugfixes
+ - OpenSSL DLLs updated to version 1.0.2k.
+ https://www.openssl.org/news/secadv/20170126.txt
+* New features
+ - DH ciphersuites are now disabled by default.
+ - The daily server DH parameter regeneration is only performed if
+ DH ciphersuites are enabled in the configuration file.
+ - "checkHost" and "checkEmail" were modified to require either
+ "verifyChain" or "verifyPeer" (thx to Małorzata Olszówka).
+* Bugfixes
+ - Fixed setting default ciphers.
+
+### Version 5.39, 2017.01.01, urgency: LOW
+* New features
+ - PKCS#11 engine (pkcs11.dll) added to the Win32 build.
+ - Per-destination TLS session cache added for the client mode.
+ - The new "logId" parameter "process" added to log PID values.
+ - Added support for the new SSL_set_options() values.
+ - Updated the manual page.
+ - Obsolete references to "SSL" replaced with "TLS".
+* Bugfixes
+ - Fixed "logId" parameter to also work in inetd mode.
+ - "delay = yes" properly enforces "failover = prio".
+ - Fixed fd_set allocation size on Win64.
+ - Fixed reloading invalid configuration file on Win32.
+ - Fixed resolving addresses with unconfigured network interfaces.
+
+### Version 5.38, 2016.11.26, urgency: MEDIUM
+* New features
+ - "sni=" can be used to prevent sending the SNI extension.
+ - The AI_ADDRCONFIG resolver flag is used when available.
+ - Merged Debian 06-lfs.patch (thx to Peter Pentchev).
+* Bugfixes
+ - Fixed a memory allocation bug causing crashes with OpenSSL 1.1.0.
+ - Fixed error handling for mixed IPv4/IPv6 destinations.
+ - Merged Debian 08-typos.patch (thx to Peter Pentchev).
+
+### Version 5.37, 2016.11.06, urgency: MEDIUM
+* Bugfixes
+ - OpenSSL DLLs updated to version 1.0.2j (stops crashes).
+ - The default SNI target (not handled by any secondary service)
+ is handled by the primary service rather than rejected.
+ - Removed thread synchronization in the FORK threading model.
+
+### Version 5.36, 2016.09.22, urgency: HIGH
+* Security bugfixes
+ - OpenSSL DLLs updated to version 1.0.2i.
+ https://www.openssl.org/news/secadv_20160922.txt
+* New features
+ - Added support for OpenSSL 1.1.0 built with "no-deprecated".
+ - Removed direct zlib dependency.
+
+### Version 5.35, 2016.07.18, urgency: HIGH
+* Bugfixes
+ - Fixed incorrectly enforced client certificate requests.
+ - Only default to SO_EXCLUSIVEADDRUSE on Vista and later.
+ - Fixed thread safety of the configuration file reopening.
+
+### Version 5.34, 2016.07.05, urgency: HIGH
+* Security bugfixes
+ - Fixed malfunctioning "verify = 4".
+* New features
+ - Bind sockets with SO_EXCLUSIVEADDRUSE on WIN32.
+ - Added three new service-level options: requireCert, verifyChain,
+ and verifyPeer for fine-grained certificate verification control.
+ - Improved compatibility with the current OpenSSL 1.1.0-dev tree.
+
+### Version 5.33, 2016.06.23, urgency: HIGH
+* New features
+ - Improved memory leak detection performance and accuracy.
+ - Improved compatibility with the current OpenSSL 1.1.0-dev tree.
+ - SNI support also enabled on OpenSSL 0.9.8f and later (thx to
+ Guillermo Rodriguez Garcia).
+ - Added support for PKCS #12 (.p12/.pfx) certificates (thx to
+ Dmitry Bakshaev).
+* Bugfixes
+ - Fixed a TLS session caching memory leak (thx to Richard Kraemer).
+ Before stunnel 5.27 this leak only emerged with sessiond enabled.
+ - Yet another WinCE socket fix (thx to Richard Kraemer).
+ - Fixed passphrase/pin dialogs in tstunnel.exe.
+ - Fixed a FORK threading build regression bug.
+ - OPENSSL_NO_DH compilation fix (thx to Brian Lin).
+
+### Version 5.32, 2016.05.03, urgency: HIGH
+* Security bugfixes
+ - OpenSSL DLLs updated to version 1.0.2h.
+ https://www.openssl.org/news/secadv_20160503.txt
+* New features
+ - New "socket = a:IPV6_V6ONLY=yes" option to only bind IPv6.
+ - Memory leak detection.
+ - Improved compatibility with the current OpenSSL 1.1.0-dev tree.
+ - Added/fixed Red Hat scripts (thx to Andrew Colin Kissa).
+* Bugfixes
+ - Workaround for a WinCE sockets quirk (thx to Richard Kraemer).
+ - Fixed data alignment on 64-bit MSVC (thx to Yuris W. Auzins).
+
+### Version 5.31, 2016.03.01, urgency: HIGH
+* Security bugfixes
+ - OpenSSL DLLs updated to version 1.0.2g.
+ https://www.openssl.org/news/secadv_20160301.txt
+* New features
+ - Added logging the list of client CAs requested by the server.
+ - Improved compatibility with the current OpenSSL 1.1.0-dev tree.
+* Bugfixes
+ - Only reset the watchdog if some data was actually transferred.
+ - A workaround implemented for the unexpected exceptfds set by
+ select() on WinCE 6.0 (thx to Richard Kraemer).
+ - Fixed logging an incorrect value of the round-robin starting
+ point (thx to Jose Alf.).
+
+### Version 5.30, 2016.01.28, urgency: HIGH
+* Security bugfixes
+ - OpenSSL DLLs updated to version 1.0.2f.
+ https://www.openssl.org/news/secadv_20160128.txt
+* New features
+ - Improved compatibility with the current OpenSSL 1.1.0-dev tree.
+ - Added OpenSSL autodetection for the recent versions of Xcode.
+* Bugfixes
+ - Fixed references to /etc removed from stunnel.init.in.
+ - Stopped even trying -fstack-protector on unsupported platforms
+ (thx to Rob Lockhart).
+
+### Version 5.29, 2016.01.08, urgency: LOW
+* New features
+ - New WIN32 icons.
+ - Performance improvement: rwlocks used for locking with pthreads.
+* Bugfixes
+ - Compilation fix for *BSD.
+ - Fixed configuration file reload for relative stunnel.conf path
+ on Unix.
+ - Fixed ignoring CRLfile unless CAfile was also specified (thx
+ to Strukov Petr).
+
+### Version 5.28, 2015.12.11, urgency: HIGH
+* New features
+ - Build matrix (.travis.yml) extended with ./configure options.
+ - mingw.mak updated to build tstunnel.exe (thx to Jose Alf.).
+* Bugfixes
+ - Fixed incomplete initialization.
+ - Fixed UCONTEXT threading on OSX.
+ - Fixed exit codes for information requests (as
+ in "stunnel -version" or "stunnel -help").
+
+### Version 5.27, 2015.12.03, urgency: MEDIUM
+* Security bugfixes
+ - OpenSSL DLLs updated to version 1.0.2e.
+ https://www.openssl.org/news/secadv_20151203.txt
+* New features
+ - Automated build testing configured with .travis.yml.
+ - Added reading server certificates from hardware engines.
+ For example: cert = id_45
+ - Only attempt to use potentially harmful compiler or linker
+ options if gcc was detected.
+ - /opt/csw added to the OpenSSL directory lookup list.
+ - mingw.mak updates (thx to Jose Alf.).
+ - TODO list updated.
+
+### Version 5.26, 2015.11.06, urgency: MEDIUM
+* Bugfixes
+ - Compilation fixes for OSX, *BSD and Solaris.
+
+### Version 5.25, 2015.11.02, urgency: MEDIUM
+* New features
+ - SMTP client protocol negotiation support for
+ "protocolUsername", "protocolPassword", and
+ "protocolAuthentication" (thx to Douglas Harris).
+ - New service-level option "config" to specify configuration
+ commands introduced in OpenSSL 1.0.2 (thx to Stephen Wall).
+ - The global option "foreground" now also accepts "quiet"
+ parameter, which does not enable logging to stderr.
+ - Manual page updated.
+ - Obsolete OpenSSL engines removed from the Windows build:
+ 4758cca, aep, atalla, cswift, nuron, sureware.
+ - Improved compatibility with the current OpenSSL 1.1.0-dev tree:
+ gracefully handle symbols renamed from SSLeay* to OpenSSL*.
+* Bugfixes
+ - Fixed the "s_poll_wait returned 1, but no descriptor
+ is ready" internal error.
+ - Fixed "exec" hangs due to incorrect thread-local
+ storage handling (thx to Philip Craig).
+ - Fixed PRNG initialization (thx to Philip Craig).
+ - Setting socket options no longer performed on PTYs.
+ - Fixed 64-bit Windows build.
+
+### Version 5.24, 2015.10.08, urgency: MEDIUM
+* New features
+ - Custom CRL verification was replaced with the internal
+ OpenSSL functionality.
+ - *BSD support for "transparent = destination" and
+ client-side "protocol = socks". This feature should
+ work at least on FreeBSD, OpenBSD and OS X.
+ - Added a new "protocolDomain" option for the NTLM
+ authentication (thx to Andreas Botsikas).
+ - Improved compatibility of the NTLM phase 1 message (thx
+ to Andreas Botsikas).
+ - "setuid" and "setgid" options are now also available
+ in service sections. They can be used to set owner
+ and group of the Unix socket specified with "accept".
+ - Added support for the new OpenSSL 1.0.2 SSL options.
+ - Added OPENSSL_NO_EGD support (thx to Bernard Spil).
+ - VC autodetection added to makew32.bat (thx to Andreas
+ Botsikas).
+* Bugfixes
+ - Fixed the RESOLVE F0 TOR extension support in SOCKS5.
+ - Fixed the error code reported on the failed bind()
+ requests.
+ - Fixed the sequential log id with the FORK threading.
+ - Restored the missing Microsoft.VC90.CRT.manifest file.
+
+### Version 5.23, 2015.09.02, urgency: LOW
+* New features
+ - Client-side support for the SOCKS protocol.
+ See https://www.stunnel.org/socksvpn.html for details.
+ - Reject SOCKS requests to connect loopback addresses.
+ - New service-level option "OCSPnonce".
+ The default value is "OCSPnonce = no".
+ - Win32 directory structure rearranged. The installer
+ script provides automatic migration for common setups.
+ - Added Win32 installer option to install stunnel for the
+ current user only. This feature does not deploy the NT
+ service, but it also does not require aministrative
+ privileges to install and configure stunnel.
+ - stunnel.cnf was renamed to openssl.cnf in order to
+ to prevent users from mixing it up with stunnel.conf.
+ - Win32 desktop is automatically refreshed when the icon
+ is created or removed.
+ - The ca-certs.pem file is now updated on stunnel upgrade.
+ - Inactive ports were removed from the PORTS file.
+ - Added IPv6 support to the transparent proxy code.
+* Bugfixes
+ - Compilation fix for OpenSSL version older than 1.0.0.
+ - Compilation fix for mingw.
+
+### Version 5.22, 2015.07.30, urgency: HIGH
+* New features
+ - "OCSPaia = yes" added to the configuration file templates.
+ - Improved double free detection.
+* Bugfixes
+ - Fixed a number of OCSP bugs. The most severe of those
+ bugs caused stunnel to treat OCSP responses that failed
+ OCSP_basic_verify() checks as if they were successful.
+ - Fixed the passive IPv6 resolver (broken in stunnel 5.21).
+
+### Version 5.21, 2015.07.27, urgency: MEDIUM
+* New features
+ - Signal names are displayed instead of numbers.
+ - First resolve IPv4 addresses on passive resolver requests.
+ This speeds up stunnel startup on Win32 with a slow/defunct
+ DNS service.
+ - The "make check" target was modified to only build Win32
+ executables when stunnel is built from a git repository (thx
+ to Peter Pentchev).
+ - More elaborate descriptions were added to the warning about
+ using "verify = 2" without "checkHost" or "checkIP".
+ - Performance optimization was performed on the debug code.
+* Bugfixes
+ - Fixed the FORK and UCONTEXT threading support.
+ - Fixed "failover=prio" (broken since stunnel 5.15).
+ - Added a retry when sleep(3) was interrupted by a signal
+ in the cron thread scheduler.
+
+### Version 5.20, 2015.07.09, urgency: HIGH
+* Security bugfixes
+ - OpenSSL DLLs updated to version 1.0.2d.
+ https://www.openssl.org/news/secadv_20150709.txt
+* New features
+ - poll(2) re-enabled on MacOS X 10.5 and later.
+ - Xcode SDK is automatically used on MacOS X if no other
+ locally installed OpenSSL directory is found.
+ - The SSL library detection algorithm was made a bit smarter.
+ - Warnings about insecure authentication were modified to
+ include the name of the affected service section.
+ - A warning was added to stunnel.init if no pid file was
+ specified in the configuration file (thx to Peter Pentchev).
+ - Optional debugging symbols are included in the Win32 installer.
+ - Documentation updates (closes Debian bug #781669).
+* Bugfixes
+ - Signal pipe reinitialization added to prevent turning the
+ main accepting thread into a busy wait loop when an external
+ condition breaks the signal pipe. This bug was found to
+ surface on Win32, but other platforms may also be affected.
+ - Fixed removing the disabled taskbar icon.
+ - Generated temporary DH parameters are used for configuration
+ reload instead of the static defaults.
+ - LSB compatibility fixes added to the stunnel.init script (thx
+ to Peter Pentchev).
+ - Fixed the manual page headers (thx to Gleydson Soares).
+
+### Version 5.19, 2015.06.16, urgency: MEDIUM
+* New features
+ - OpenSSL DLLs updated to version 1.0.2c.
+ - Added a runtime check whether COMP_zlib() method is implemented
+ in order to improve compatibility with the Debian OpenSSL build.
+* Bugfixes
+ - Improved socket error handling.
+ - Cron thread priority on Win32 platform changed to
+ THREAD_PRIORITY_LOWEST to improve portability.
+ - Makefile bugfixes for stunnel 5.18 regressions.
+ - Fixed some typos in docs and scripts (thx to Peter Pentchev).
+ - Fixed a log level check condition (thx to Peter Pentchev).
+
+### Version 5.18, 2015.06.12, urgency: MEDIUM
+* New features
+ - OpenSSL DLLs updated to version 1.0.2b.
+ https://www.openssl.org/news/secadv_20150611.txt
+ - Added "include" configuration file option to include all
+ configuration file parts located in a specified directory.
+ - Log file is reopened every 24 hours. With "log = overwrite"
+ this feature can be used to prevent filling up disk space.
+ - Temporary DH parameters are refreshed every 24 hours, unless
+ static DH parameters were provided in the certificate file.
+ - Unique initial DH parameters are distributed with each release.
+ - Warnings are logged on potentially insecure authentication.
+ - Improved compatibility with the current OpenSSL 1.1.0-dev tree:
+ removed RLE compression support, etc.
+ - Updated stunnel.spec (thx to Bill Quayle).
+* Bugfixes
+ - Fixed handling of dynamic connect targets.
+ - Fixed handling of trailing whitespaces in the Content-Length
+ header of the NTLM authentication.
+ - Fixed --sysconfdir and --localstatedir handling (thx to
+ Dagobert Michelsen).
+
+### Version 5.17, 2015.04.29, urgency: HIGH
+* Bugfixes
+ - Fixed a NULL pointer dereference causing the service to crash.
+ This bug was introduced in stunnel 5.15.
+
+### Version 5.16, 2015.04.19, urgency: MEDIUM
+* Bugfixes
+ - Fixed compilation with old versions of gcc.
+
+### Version 5.15, 2015.04.16, urgency: LOW
+* New features
+ - Added new service-level options "checkHost", "checkEmail" and
+ "checkIP" for additional checks of the peer certificate subject.
+ These options require OpenSSL version 1.0.2 or higher.
+ - Win32 binary distribution now ships with the Mozilla root CA
+ bundle. This bundle is intended be used together with the new
+ "checkHost" option to validate server certs accepted by Mozilla.
+ - New commandline options "-reload" to reload the configuration
+ file and "-reopen" to reopen the log file of stunnel running
+ as a Windows service (thx to Marc McLaughlin).
+ - Added session persistence based on negotiated TLS sessions.
+ https://en.wikipedia.org/wiki/Load_balancing_%28computing%29#Persistence
+ The current implementation does not support external TLS
+ session caching with sessiond.
+ - MEDIUM ciphers (currently SEED and RC4) are removed from the
+ default cipher list.
+ - The "redirect" option was improved to not only redirect sessions
+ established with an untrusted certificate, but also sessions
+ established without a client certificate.
+ - OpenSSL version checking modified to distinguish FIPS and
+ non-FIPS builds.
+ - Improved compatibility with the current OpenSSL 1.1.0-dev tree.
+ - Removed support for OpenSSL versions older than 0.9.7.
+ The final update for the OpenSSL 0.9.6 branch was 17 Mar 2004.
+ - "sessiond" support improved to also work in OpenSSL 0.9.7.
+ - Randomize the initial value of the round-robin counter.
+ - New stunnel.conf templates are provided for Windows and Unix.
+* Bugfixes
+ - Fixed compilation against old versions of OpenSSL.
+ - Fixed memory leaks in certificate verification.
+
+### Version 5.14, 2015.03.25, urgency: HIGH
+* Security bugfixes
+ - The "redirect" option now also redirects clients on SSL session
+ reuse. In stunnel versions 5.00 to 5.13 reused sessions were
+ instead always connected hosts specified with the "connect"
+ option regardless of their certificate verification result.
+ This vulnerability was reported by Johan Olofsson.
+* New features
+ - Windows service is automatically restarted after upgrade.
+* Bugfixes
+ - Fixed a memory allocation error during Unix daemon shutdown.
+ - Fixed handling multiple connect/redirect destinations.
+ - OpenSSL FIPS builds are now correctly reported on startup.
+
+### Version 5.13, 2015.03.20, urgency: MEDIUM
+* New features
+ - The "service" option was modified to also control the syslog
+ service name.
+* Bugfixes
+ - Fixed Windows service crash.
+
+### Version 5.12, 2015.03.19, urgency: HIGH
+* Security bugfixes
+ - OpenSSL DLLs updated to version 1.0.2a.
+ https://www.openssl.org/news/secadv_20150319.txt
+* New features
+ - New service-level option "logId" to specify the
+ connection identifier type. Currently supported types:
+ "sequential" (default), "unique", and "thread".
+ - New service-level option "debug" to individually control
+ logging verbosity of defined services.
+* Bugfixes
+ - OCSP fixed on Windows platform (thx to Alec Kosky).
+
+### Version 5.11, 2015.03.11, urgency: LOW
+* New features
+ - OpenSSL DLLs updated to version 1.0.2.
+ - Removed dereferences of internal OpenSSL data structures.
+ - PSK key lookup algorithm performance improved from
+ O(N) (linear) to O(log N) (logarithmic).
+* Bugfixes
+ - Fixed peer certificate list in the main window on Win32
+ (thx to @fyer for reporting it).
+ - Fixed console logging in tstunnel.exe.
+ - _tputenv_s() replaced with more portable _tputenv() on Win32.
+
+### Version 5.10, 2015.01.22, urgency: LOW
+* New features
+ - OCSP AIA (Authority Information Access) support. This feature
+ can be enabled with the new service-level option "OCSPaia".
+ - Additional security features of the linker are enabled:
+ "-z relro", "-z now", "-z noexecstack".
+* Bugfixes
+ - OpenSSL DLLs updated to version 1.0.1l.
+ https://www.openssl.org/news/secadv_20150108.txt
+ - FIPS canister updated to version 2.0.9 in the Win32 binary
+ build.
+
+### Version 5.09, 2015.01.02, urgency: LOW
+* New features
+ - Added PSK authentication with two new service-level
+ configuration file options "PSKsecrets" and "PSKidentity".
+ - Added additional security checks to the OpenSSL memory
+ management functions.
+ - Added support for the OPENSSL_NO_OCSP and OPENSSL_NO_ENGINE
+ OpenSSL configuration flags.
+ - Added compatibility with the current OpenSSL 1.1.0-dev tree.
+* Bugfixes
+ - Removed defective s_poll_error() code occasionally causing
+ connections to be prematurely closed (truncated).
+ This bug was introduced in stunnel 4.34.
+ - Fixed ./configure systemd detection (thx to Kip Walraven).
+ - Fixed ./configure sysroot detection (thx to Kip Walraven).
+ - Fixed compilation against old versions of OpenSSL.
+ - Removed outdated French manual page.
+
+### Version 5.08, 2014.12.09, urgency: MEDIUM
+* New features
+ - Added SOCKS4/SOCKS4a protocol support.
+ - Added SOCKS5 protocol support.
+ - Added SOCKS RESOLVE F0 TOR extension support.
+ - Updated automake to version 1.14.1.
+ - OpenSSL directory searching is now relative to the sysroot.
+* Bugfixes
+ - Fixed improper hangup condition handling.
+ - Fixed missing -pic linker option. This is required for
+ Android 5.0 and improves security.
+
+### Version 5.07, 2014.11.01, urgency: MEDIUM
+* New features
+ - Several SMTP server protocol negotiation improvements.
+ - Added UTF-8 byte order marks to stunnel.conf templates.
+ - DH parameters are no longer generated by "make cert".
+ The hardcoded DH parameters are sufficiently secure,
+ and modern TLS implementations will use ECDH anyway.
+ - Updated manual for the "options" configuration file option.
+ - Added support for systemd 209 or later.
+ - New --disable-systemd ./configure option.
+ - setuid/setgid commented out in stunnel.conf-sample.
+* Bugfixes
+ - Added support for UTF-8 byte order mark in stunnel.conf.
+ - Compilation fix for OpenSSL with disabled SSLv2 or SSLv3.
+ - Non-blocking mode set on inetd and systemd descriptors.
+ - shfolder.h replaced with shlobj.h for compatibility
+ with modern Microsoft compilers.
+
+### Version 5.06, 2014.10.15, urgency: HIGH
+* Security bugfixes
+ - OpenSSL DLLs updated to version 1.0.1j.
+ https://www.openssl.org/news/secadv_20141015.txt
+ - The insecure SSLv2 protocol is now disabled by default.
+ It can be enabled with "options = -NO_SSLv2".
+ - The insecure SSLv3 protocol is now disabled by default.
+ It can be enabled with "options = -NO_SSLv3".
+ - Default sslVersion changed to "all" (also in FIPS mode)
+ to autonegotiate the highest supported TLS version.
+* New features
+ - Added missing SSL options to match OpenSSL 1.0.1j.
+ - New "-options" commandline option to display the list
+ of supported SSL options.
+* Bugfixes
+ - Fixed FORK threading build regression bug.
+ - Fixed missing periodic Win32 GUI log updates.
+
+### Version 5.05, 2014.10.10, urgency: MEDIUM
+* New features
+ - Asynchronous communication with the GUI thread for faster
+ logging on Win32.
+ - systemd socket activation (thx to Mark Theunissen).
+ - The parameter of "options" can now be prefixed with "-"
+ to clear an SSL option, for example:
+ "options = -LEGACY_SERVER_CONNECT".
+ - Improved "transparent = destination" manual page (thx to
+ Vadim Penzin).
+* Bugfixes
+ - Fixed POLLIN|POLLHUP condition handling error resulting
+ in prematurely closed (truncated) connection.
+ - Fixed a null pointer dereference regression bug in the
+ "transparent = destination" functionality (thx to
+ Vadim Penzin). This bug was introduced in stunnel 5.00.
+ - Fixed startup thread synchronization with Win32 GUI.
+ - Fixed erroneously closed stdin/stdout/stderr if specified
+ as the -fd commandline option parameter.
+ - A number of minor Win32 GUI bugfixes and improvements.
+ - Merged most of the Windows CE patches (thx to Pierre Delaage).
+ - Fixed incorrect CreateService() error message on Win32.
+ - Implemented a workaround for defective Cygwin file
+ descriptor passing breaking the libwrap support:
+ http://wiki.osdev.org/Cygwin_Issues#Passing_file_descriptors
+
+### Version 5.04, 2014.09.21, urgency: LOW
+* New features
+ - Support for local mode ("exec" option) on Win32.
+ - Support for UTF-8 config file and log file.
+ - Win32 UTF-16 build (thx to Pierre Delaage for support).
+ - Support for Unicode file names on Win32.
+ - A more explicit service description provided for the
+ Windows SCM (thx to Pierre Delaage).
+ - TCP/IP dependency added for NT service in order to prevent
+ initialization failure at boot time.
+ - FIPS canister updated to version 2.0.8 in the Win32 binary
+ build.
+* Bugfixes
+ - load_icon_default() modified to return copies of default icons
+ instead of the original resources to prevent the resources
+ from being destroyed.
+ - Partially merged Windows CE patches (thx to Pierre Delaage).
+ - Fixed typos in stunnel.init.in and vc.mak.
+ - Fixed incorrect memory allocation statistics update in
+ str_realloc().
+ - Missing REMOTE_PORT environmental variable is provided to
+ processes spawned with "exec" on Unix platforms.
+ - Taskbar icon is no longer disabled for NT service.
+ - Fixed taskbar icon initialization when commandline options are
+ specified.
+ - Reportedly more compatible values used for the dwDesiredAccess
+ parameter of the CreateFile() function (thx to Pierre Delaage).
+ - A number of minor Win32 GUI bugfixes and improvements.
+
+### Version 5.03, 2014.08.07, urgency: HIGH
+* Security bugfixes
+ - OpenSSL DLLs updated to version 1.0.1i.
+ See https://www.openssl.org/news/secadv_20140806.txt
+* New features
+ - FIPS autoconfiguration cleanup.
+ - FIPS canister updated to version 2.0.6.
+ - Improved SNI diagnostic logging.
+* Bugfixes
+ - Compilation fixes for old versions of OpenSSL.
+ - Fixed whitespace handling in the stunnel.init script.
+
+### Version 5.02, 2014.06.09, urgency: HIGH
+* Security bugfixes
+ - OpenSSL DLLs updated to version 1.0.1h.
+ See https://www.openssl.org/news/secadv_20140605.txt
+* New features
+ - Major rewrite of the protocol.c interface: it is now possible to add
+ protocol negotiations at multiple connection phases, protocols can
+ individually decide whether the remote connection will be
+ established before or after SSL/TLS is negotiated.
+ - Heap memory blocks are wiped before release. This only works for
+ block allocated by stunnel, and not by OpenSSL or other libraries.
+ - The safe_memcmp() function implemented with execution time not
+ dependent on the compared data.
+ - Updated the stunnel.conf and stunnel.init templates.
+ - Added a client-mode example to the manual.
+* Bugfixes
+ - Fixed "failover = rr" broken since version 5.00.
+ - Fixed "taskbar = no" broken since version 5.00.
+ - Compilation fix for missing SSL_OP_MSIE_SSLV2_RSA_PADDING option.
+
+### Version 5.01, 2014.04.08, urgency: HIGH
+* Security bugfixes
+ - OpenSSL DLLs updated to version 1.0.1g.
+ This version mitigates TLS heartbeat read overrun (CVE-2014-0160).
+* New features
+ - X.509 extensions added to the created self-signed stunnel.pem.
+ - "FIPS = no" also allowed in non-FIPS builds of stunnel.
+ - Search all certificates with the same subject name for a matching
+ public key rather than only the first one (thx to Leon Winter).
+ - Create logs in the local application data folder if stunnel folder
+ is not writable on Win32.
+* Bugfixes
+ - close_notify not sent when SSL still has some data buffered.
+ - Protocol negotiation with server-side SNI fixed.
+ - A Mac OS X missing symbols fixed.
+ - Win32 configuration file reload crash fixed.
+ - Added s_pool_free() on exec+connect service retires.
+ - Line-buffering enforced on stderr output.
+
+### stunnel 5.00 disables some features previously enabled by default.
+### Users should review whether the new defaults are appropriate for their
+### particular deployments. Packages maintainers may consider prepending
+### the old defaults for "fips" (if supported by their OpenSSL library),
+### "pid" and "libwrap" to stunnel.conf during automated updates.
+
+### Version 5.00, 2014.03.06, urgency: HIGH
+* Security bugfixes
+ - Added PRNG state update in fork threading (CVE-2014-0016).
+* New global configuration file defaults
+ - Default "fips" option value is now "no", as FIPS mode is only
+ helpful for compliance, and never for actual security.
+ - Default "pid" is now "", i.e. not to create a pid file at startup.
+* New service-level configuration file defaults
+ - Default "ciphers" updated to "HIGH:MEDIUM:+3DES:+DH:!aNULL:!SSLv2"
+ due to AlFBPPS attack and bad performance of DH ciphersuites.
+ - Default "libwrap" setting is now "no" to improve performance.
+* New features
+ - OpenSSL DLLs updated to version 1.0.1f.
+ - zlib DLL updated to version 1.2.8.
+ - autoconf scripts upgraded to version 2.69.
+ - TLS 1.1 and TLS 1.2 are now allowed in the FIPS mode.
+ - New service-level option "redirect" to redirect SSL client
+ connections on authentication failures instead of rejecting them.
+ - New global "engineDefault" configuration file option to control
+ which OpenSSL tasks are delegated to the current engine.
+ Available tasks: ALL, RSA, DSA, ECDH, ECDSA, DH, RAND, CIPHERS,
+ DIGESTS, PKEY, PKEY_CRYPTO, PKEY_ASN1.
+ - New service-level configuration file option "engineId" to select
+ the engine by identifier, e.g. "engineId = capi".
+ - New global configuration file option "log" to control whether to
+ append (the default), or to overwrite log file while (re)opening.
+ - Different taskbar icon colors to indicate the service state.
+ - New global configuration file options "iconIdle", "iconActive",
+ and "iconError" to select status icon on GUI taskbar.
+ - Removed the limit of 63 stunnel.conf sections on Win32 platform.
+ - Installation of a sample certificate was moved to a separate "cert"
+ target in order to allow unattended (e.g. scripted) installations.
+ - Reduced length of the logged thread identifier. It is still based
+ on the OS thread ID, and thus not unique over long periods of time.
+ - Improved readability of error messages printed when stunnel refuses
+ to start due to a critical error.
+* Bugfixes
+ - LD_PRELOAD Solaris compatibility bug fixed (thx to Norm Jacobs).
+ - CRYPTO_NUM_LOCKS replaced with CRYPTO_num_locks() to improve binary
+ compatibility with diverse builds of OpenSSL (thx to Norm Jacobs).
+ - Corrected round-robin failover behavior under heavy load.
+ - Numerous fixes in the engine support code.
+ - On Win32 platform .rnd file moved from c:\ to the stunnel folder.
+
+### Version 4.57, 2015.04.01, urgency: HIGH
+* Security bugfixes
+ - Added PRNG state update in fork threading (CVE-2014-0016).
+
+### Version 4.56, 2013.03.22, urgency: HIGH
+* New features
+ - Win32 installer automatically configures firewall exceptions.
+ - Win32 installer configures administrative shortcuts to invoke UAC.
+ - Improved Win32 GUI shutdown time.
+* Bugfixes
+ - Fixed a regression bug introduced in version 4.55 causing random
+ crashes on several platforms, including Windows 7.
+ - Fixed startup crashes on some Win32 systems.
+ - Fixed incorrect "stunnel -exit" process synchronisation.
+ - Fixed FIPS detection with new versions of the OpenSSL library.
+ - Failure to open the log file at startup is no longer ignored.
+
+### Version 4.55, 2013.03.03, urgency: HIGH
+* Security bugfixes
+ - Buffer overflow vulnerability fixed in the NTLM authentication
+ of the CONNECT protocol negotiation.
+ See https://www.stunnel.org/CVE-2013-1762.html for details.
+ - OpenSSL updated to version 1.0.1e in Win32/Android builds.
+* New features
+ - SNI wildcard matching in server mode.
+ - Terminal version of stunnel (tstunnel.exe) build for Win32.
+* Bugfixes
+ - Fixed write half-close handling in the transfer() function (thx to
+ Dustin Lundquist).
+ - Fixed EAGAIN error handling in the transfer() function (thx to Jan Bee).
+ - Restored default signal handlers before execvp() (thx to Michael Weiser).
+ - Fixed memory leaks in protocol negotiation (thx to Arthur Mesh).
+ - Fixed a file descriptor leak during configuration file reload (thx to
+ Arthur Mesh).
+ - Closed SSL sockets were removed from the transfer() c->fds poll.
+ - Minor fix in handling exotic inetd-mode configurations.
+ - WCE compilation fixes.
+ - IPv6 compilation fix in protocol.c.
+ - Windows installer fixes.
+
+### Version 4.54, 2012.10.09, urgency: MEDIUM
+* New Win32 features
+ - FIPS module updated to version 2.0.
+ - OpenSSL DLLs updated to version 1.0.1c.
+ - zlib DLL updated to version 1.2.7.
+ - Engine DLLs added: 4758cca, aep, atalla, capi, chil, cswift, gmp, gost,
+ nuron, padlock, sureware, ubsec.
+* Other new features
+ - "session" option renamed to more readable "sessionCacheTimeout".
+ The old name remains accepted for backward compatibility.
+ - New service-level "sessionCacheSize" option to control session cache size.
+ - New service-level option "reset" to control whether TCP RST flag is used
+ to indicate errors. The default value is "reset = yes".
+ - New service-level option "renegotiation" to disable SSL renegotiation.
+ This feature is based on a public-domain patch by Janusz Dziemidowicz.
+ - New FreeBSD socket options: IP_FREEBIND, IP_BINDANY, IPV6_BINDANY (thx
+ to Janusz Dziemidowicz).
+ - New parameters to configure TLS v1.1/v1.2 with OpenSSL version 1.0.1
+ or higher (thx to Henrik Riomar).
+* Bugfixes
+ - Fixed "Application Failed to Initialize Properly (0xc0150002)" error.
+ - Fixed missing SSL state debug log entries.
+ - Fixed a race condition in libwrap code resulting in random stalls (thx
+ to Andrew Skalski).
+ - Session cache purged at configuration file reload to reduce memory leak.
+ Remaining leak of a few kilobytes per section is yet to be fixed.
+ - Fixed a regression bug in "transparent = destination" functionality (thx
+ to Stefan Lauterbach). This bug was introduced in stunnel 4.51.
+ - "transparent = destination" is now a valid endpoint in inetd mode.
+ - "delay = yes" fixed to work even if specified *after* "connect" option.
+ - Multiple "connect" targets fixed to also work with delayed resolver.
+ - The number of resolver retries of EAI_AGAIN error has been limited to 3
+ in order to prevent infinite loops.
+
+### Version 4.53, 2012.03.19, urgency: MEDIUM
+* New features
+ - Added client-mode "sni" option to directly control the value of
+ TLS Server Name Indication (RFC 3546) extension.
+ - Added support for IP_FREEBIND socket option with a pached Linux kernel.
+ - Glibc-specific dynamic allocation tuning was applied to help unused memory
+ deallocation.
+ - Non-blocking OCSP implementation.
+* Bugfixes
+ - Compilation fixes for old versions of OpenSSL (tested against 0.9.6).
+ - Usage of uninitialized variables fixed in exec+connect services.
+ - Occasional logging subsystem crash with exec+connect services.
+ - OpenBSD compilation fix (thx to Michele Orru').
+ - Session id context initialized with session name rather than a constant.
+ - Fixed handling of a rare inetd mode use case, where either stdin or stdout
+ is a socket, but not both of them at the same time.
+ - Fixed missing OPENSSL_Applink http://www.openssl.org/support/faq.html#PROG2
+ - Fixed crash on termination with FORK threading model.
+ - Fixed dead canary after configuration reload with open connections.
+ - Fixed missing file descriptors passed to local mode processes.
+ - Fixed required jmp_buf alignment on Itanium platform.
+ - Removed creating /dev/zero in the chroot jail on Solaris platform.
+ - Fixed detection of WSAECONNREFUSED Winsock error.
+ - Missing Microsoft.VC90.CRT.manifest added to Windows installer.
+
+### Version 4.52, 2012.01.12, urgency: MEDIUM
+* Bugfixes
+ - Fixed write closure notification for non-socket file descriptors.
+ - Removed a line logged to stderr in inetd mode.
+ - Fixed "Socket operation on non-socket" error in inetd mode on Mac OS X
+ platform.
+ - Removed direct access to the fields of the X509_STORE_CTX data structure.
+
+### Version 4.51, 2012.01.09, urgency: MEDIUM
+* New features
+ - Updated Win32 binary distribution OpenSSL DLLs to version 0.9.8s-fips.
+ - Updated Android binary OpenSSL to version 1.0.0f.
+ - Zlib support added to Win32 and Android binary builds.
+ - New "compression = deflate" global option to enable RFC 2246 compresion.
+ For compatibility with previous versions "compression = zlib" and
+ "compression = rle" also enable the deflate (RFC 2246) compression.
+ - Compression is disabled by default.
+ - Separate default ciphers and sslVersion for "fips = yes" and "fips = no".
+ - UAC support for editing configuration file with Windows GUI.
+* Bugfixes
+ - Fixed exec+connect sections.
+ - Added a workaround for broken Android getaddrinfo():
+ http://stackoverflow.com/questions/7818246/segmentation-fault-in-getaddrinfo
+
+### Version 4.50, 2011.12.03, urgency: MEDIUM
+* New features
+ - Added Android port.
+ - Updated INSTALL.FIPS.
+* Bugfixes
+ - Fixed internal memory allocation problem in inetd mode.
+ - Fixed FIPS mode on Microsoft Vista, Server 2008, and Windows 7.
+ This fix required to compile OpenSSL FIPS-compliant DLLs with MSVC 9.0,
+ instead of MSVC 10.0. msvcr100.dll was replaced with msvcr90.dll.
+ GPL compatibility issues are explained in the GPL FAQ:
+ http://www.gnu.org/licenses/gpl-faq.html#WindowsRuntimeAndGPL
+ - POP3 server-side protocol negotiation updated to report STLS
+ capability (thx to Anthony Morgan).
+
+### Version 4.49, 2011.11.28, urgency: MEDIUM
+* Bugfixes
+ - Missing Microsoft Visual C++ Redistributable (msvcr100.dll) required
+ by FIPS-compliant OpenSSL library was added to the Windows installer.
+ - A bug was fixed causing crashes on MacOS X and some other platforms.
+
+### Version 4.48, 2011.11.26, urgency: MEDIUM
+* New features
+ - FIPS support on Win32 platform added. OpenSSL 0.9.8r DLLs based on
+ FIPS 1.2.3 canister are included with this version of stunnel. FIPS
+ mode can be disabled with "fips = no" configuration file option.
+* Bugfixes
+ - Fixed canary initialization problem on Win32 platform.
+
+### Version 4.47, 2011.11.21, urgency: MEDIUM
+* Internal improvements
+ - CVE-2010-3864 workaround improved to check runtime version of OpenSSL
+ rather than compiled version, and to allow OpenSSL 0.x.x >= 0.9.8p.
+ - Encoding of man page sources changed to UTF-8.
+* Bugfixes
+ - Handling of socket/SSL close in transfer() function was fixed.
+ - Logging was modified to save and restore system error codes.
+ - Option "service" was restricted to Unix, as since stunnel 4.42 it
+ wasn't doing anything useful on Windows platform.
+
+### Version 4.46, 2011.11.04, urgency: LOW
+* New features
+ - Added Unix socket support (e.g. "connect = /var/run/stunnel/socket").
+ - Added "verify = 4" mode to ignore CA chain and only verify peer certificate.
+ - Removed the limit of 16 IP addresses for a single 'connect' option.
+ - Removed the limit of 256 stunnel.conf sections in PTHREAD threading model.
+ It is still not possible have more than 63 sections on Win32 platform.
+ http://msdn.microsoft.com/en-us/library/windows/desktop/ms740141(v=vs.85).aspx
+* Optimizations
+ - Reduced per-connection memory usage.
+ - Performed a major refactoring of internal data structures. Extensive
+ internal testing was performed, but some regression bugs are expected.
+* Bugfixes
+ - Fixed Win32 compilation with Mingw32.
+ - Fixed non-blocking API emulation layer in UCONTEXT threading model.
+ - Fixed signal handling in UCONTEXT threading model.
+
+### Version 4.45, 2011.10.24, urgency: LOW
+* New features
+ - "protocol = proxy" support to send original client IP address to haproxy:
+ http://haproxy.1wt.eu/download/1.5/doc/proxy-protocol.txt
+ This requires accept-proxy bind option of haproxy 1.5-dev3 or later.
+ - Added Win32 configuration reload without a valid configuration loaded.
+ - Added compatibility with LTS OpenSSL versions 0.9.6 and 0.9.7.
+ Some features are only available in OpenSSL 1.0.0 and later.
+* Performance optimizations
+ - Use SSL_MODE_RELEASE_BUFFERS if supported by the OpenSSL library.
+ - Libwrap helper processes are no longer started if libwrap is disabled
+ in all sections of the configuration file.
+* Internal improvements
+ - Protocol negotiation framework was rewritten to support additional
+ code to be executed after SSL_accept()/SSL_connect().
+ - Handling of memory allocation errors was rewritten to gracefully
+ terminate the process (thx to regenrecht for the idea).
+* Bugfixes
+ - Fixed -l option handling in stunnel3 script (thx to Kai Gülzau).
+ - Script to build default stunnel.pem was fixed (thx to Sebastian Kayser).
+ - MinGW compilation script (mingw.mak) was fixed (thx to Jose Alf).
+ - MSVC compilation script (vc.mak) was fixed.
+ - A number of problems in WINSOCK error handling were fixed.
+
+### Version 4.44, 2011.09.17, urgency: MEDIUM
+* New features
+ - Major automake/autoconf cleanup.
+ - Heap buffer overflow protection with canaries.
+ - Stack buffer overflow protection with -fstack-protector.
+* Bugfixes
+ - Fixed garbled error messages on errors with setuid/setgid options.
+ - SNI fixes (thx to Alexey Drozdov).
+ - Use after free in fdprintf() (thx to Alexey Drozdov).
+ This issue might cause GPF with "protocol" or "ident" options.
+
+### Version 4.43, 2011.09.07, urgency: MEDIUM
+* New features
+ - Updated Win32 DLLs for OpenSSL 1.0.0e.
+ - Major optimization of the logging subsystem.
+ Benchmarks indicate up to 15% stunnel performance improvement.
+* Bugfixes
+ - Fixed Win32 configuration file reload.
+ - Fixed FORK and UCONTEXT threading models.
+ - Corrected INSTALL.W32 file.
+
+### Version 4.42, 2011.08.18, urgency: HIGH
+* New features
+ - New verify level 0 to request and ignore peer certificate. This
+ feature is useful with the new Windows GUI menu to save cached peer
+ certificate chains, as SSL client certificates are not sent by default.
+ - Manual page has been updated.
+ - Removed support for changing Windows Service name with "service" option.
+* Bugfixes
+ - Fixed a heap corruption vulnerability in versions 4.40 and 4.41. It may
+ possibly be leveraged to perform DoS or remote code execution attacks.
+ - The -quiet commandline option was applied to *all* message boxes.
+ - Silent install (/S option) no longer attempts to create stunnel.pem.
+
+### Version 4.41, 2011.07.25, urgency: MEDIUM
+* Bugfixes
+ - Fixed Windows service crash of stunnel 4.40.
+
+### Version 4.40, 2011.07.23, urgency: LOW
+* New Win32 features
+ - Added a GUI menu to save cached peer certificate chains.
+ - Added comandline "-exit" option to stop stunnel *not* running
+ as a service. This option may be useful for scripts.
+ - Added file version information to stunnel.exe.
+ - A number of other GUI improvements.
+* Other new features
+ - Hardcoded 2048-bit DH parameters are used as a fallback if DH parameters
+ are not provided in stunnel.pem.
+ - Default "ciphers" value updated to prefer ECDH:
+ "ALL:!SSLv2:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH".
+ - Default ECDH curve updated to "prime256v1".
+ - Removed support for temporary RSA keys (used in obsolete export ciphers).
+
+### Version 4.39, 2011.07.06, urgency: LOW
+* New features
+ - New Win32 installer module to build self-signed stunnel.pem.
+ - Added configuration file editing with Windows GUI.
+ - Added log file reopening file editing with Windows GUI.
+ It might be useful to also implement log file rotation.
+ - Improved configuration file reload with Windows GUI.
+
+### Version 4.38, 2011.06.28, urgency: MEDIUM
+* New features
+ - Server-side SNI implemented (RFC 3546 section 3.1) with a new
+ service-level option "nsi".
+ - "socket" option also accepts "yes" and "no" for flags.
+ - Nagle's algorithm is now disabled by default for improved interactivity.
+* Bugfixes
+ - A compilation fix was added for OpenSSL version < 1.0.0.
+ - Signal pipe set to non-blocking mode. This bug caused hangs of stunnel
+ features based on signals, e.g. local mode, FORK threading, or
+ configuration file reload on Unix. Win32 platform was not affected.
+
+### Version 4.37, 2011.06.17, urgency: MEDIUM
+* New features
+ - Client-side SNI implemented (RFC 3546 section 3.1).
+ - Default "ciphers" changed from the OpenSSL default to a more secure
+ and faster "RC4-MD5:HIGH:!aNULL:!SSLv2".
+ A paranoid (and usually slower) setting would be "HIGH:!aNULL:!SSLv2".
+ - Recommended "options = NO_SSLv2" added to the sample stunnel.conf file.
+ - Default client method upgraded from SSLv3 to TLSv1.
+ To connect servers without TLS support use "sslVersion = SSLv3" option.
+ - Improved --enable-fips and --disable-fips ./configure option handling.
+ - On startup stunnel now compares the compiled version of OpenSSL against
+ the running version of OpenSSL. A warning is logged on mismatch.
+* Bugfixes
+ - Non-blocking socket handling in local mode fixed (Debian bug #626856).
+ - UCONTEXT threading mode fixed.
+ - Removed the use of gcc Thread-Local Storage for improved portability.
+ - va_copy macro defined for platforms that do not have it.
+ - Fixed "local" option parsing on IPv4 systems.
+ - Solaris compilation fix (redefinition of "STR").
+
+### Version 4.36, 2011.05.03, urgency: LOW
+* New features
+ - Updated Win32 DLLs for OpenSSL 1.0.0d.
+ - Dynamic memory management for strings manipulation:
+ no more static STRLEN limit, lower stack footprint.
+ - Strict public key comparison added for "verify = 3" certificate
+ checking mode (thx to Philipp Hartwig).
+ - Backlog parameter of listen(2) changed from 5 to SOMAXCONN:
+ improved behavior on heavy load.
+ - Example tools/stunnel.service file added for systemd service manager.
+* Bugfixes
+ - Missing pthread_attr_destroy() added to fix memory leak (thx to
+ Paul Allex and Peter Pentchev).
+ - Fixed the incorrect way of setting FD_CLOEXEC flag.
+ - Fixed --enable-libwrap option of ./configure script.
+ - /opt/local added to OpenSSL search path for MacPorts compatibility.
+ - Workaround implemented for signal handling on MacOS X.
+ - A trivial bug fixed in the stunnel.init script.
+ - Retry implemented on EAI_AGAIN error returned by resolver calls.
+
+### Version 4.35, 2011.02.05, urgency: LOW
+* New features
+ - Updated Win32 DLLs for OpenSSL 1.0.0c.
+ - Transparent source (non-local bind) added for FreeBSD 8.x.
+ - Transparent destination ("transparent = destination") added for Linux.
+* Bugfixes
+ - Fixed reload of FIPS-enabled stunnel.
+ - Compiler options are now auto-detected by ./configure script
+ in order to support obsolete versions of gcc.
+ - Async-signal-unsafe s_log() removed from SIGTERM/SIGQUIT/SIGINT handler.
+ - CLOEXEC file descriptor leaks fixed on Linux >= 2.6.28 with glibc >= 2.10.
+ Irreparable race condition leaks remain on other Unix platforms.
+ This issue may have security implications on some deployments:
+ http://udrepper.livejournal.com/20407.html
+ - Directory lib64 included in the OpenSSL library search path.
+ - Windows CE compilation fixes (thx to Pierre Delaage).
+ - Deprecated RSA_generate_key() replaced with RSA_generate_key_ex().
+* Domain name changes (courtesy of Bri Hatch)
+ - http://stunnel.mirt.net/ --> http://www.stunnel.org/
+ - ftp://stunnel.mirt.net/ --> http://ftp.stunnel.org/
+ - stunnel.mirt.net::stunnel --> rsync.stunnel.org::stunnel
+ - stunnel-users@mirt.net --> stunnel-users@stunnel.org
+ - stunnel-announce@mirt.net --> stunnel-announce@stunnel.org
+
+### Version 4.34, 2010.09.19, urgency: LOW
+* New features
+ - Updated Win32 DLLs for OpenSSL 1.0.0a.
+ - Updated Win32 DLLs for zlib 1.2.5.
+ - Updated automake to version 1.11.1
+ - Updated libtool to version 2.2.6b
+ - Added ECC support with a new service-level "curve" option.
+ - DH support is now enabled by default.
+ - Added support for OpenSSL builds with some algorithms disabled.
+ - ./configure modified to support cross-compilation.
+ - Sample stunnel.init updated based on Debian init script.
+* Bugfixes
+ - Implemented fixes in user interface to enter engine PIN.
+ - Fixed a transfer() loop issue on socket errors.
+ - Fixed missing Win32 taskbar icon while displaying a global option error.
+
+### Version 4.33, 2010.04.05, urgency: MEDIUM
+* New features
+ - Win32 DLLs for OpenSSL 1.0.0.
+ This library requires to c_rehash CApath/CRLpath directories on upgrade.
+ - Win32 DLLs for zlib 1.2.4.
+ - Experimental support for local mode on Win32 platform.
+ Try "exec = c:\windows\system32\cmd.exe".
+* Bugfixes
+ - Inetd mode fixed.
+
+### Version 4.32, 2010.03.24, urgency: MEDIUM
+* New features
+ - New service-level "libwrap" option for run-time control whether
+ /etc/hosts.allow and /etc/hosts.deny are used for access control.
+ Disabling libwrap significantly increases performance of stunnel.
+ - Win32 DLLs for OpenSSL 0.9.8m.
+* Bugfixes
+ - Fixed a transfer() loop issue with SSLv2 connections.
+ - Fixed a "setsockopt IP_TRANSPARENT" warning with "local" option.
+ - Logging subsystem bugfixes and cleanup.
+ - Installer bugfixes for Vista and later versions of Windows.
+ - FIPS mode can be enabled/disabled at runtime.
+
+### Version 4.31, 2010.02.03, urgency: MEDIUM
+* New features
+ - Log file reopen on USR1 signal was added.
+* Bugfixes
+ - Some regression issues introduced in 4.30 were fixed.
+
+### Version 4.30, 2010.01.21, urgency: LOW/EXPERIMENTAL
+* New features
+ - Graceful configuration reload with HUP signal on Unix
+ and with GUI on Windows.
+
+### Version 4.29, 2009.12.02, urgency: MEDIUM
+* New feature sponsored by Searchtech Limited http://www.astraweb.com/
+ - sessiond, a high performance SSL session cache was built for stunnel.
+ A new service-level "sessiond" option was added. sessiond is
+ available for download on ftp://ftp.stunnel.org/stunnel/sessiond/ .
+ stunnel clusters will be a lot faster, now!
+* Bugfixes
+ - "execargs" defaults to the "exec" parameter (thx to Peter Pentchev).
+ - Compilation fixes added for AIX and old versions of OpenSSL.
+ - Missing "fips" option was added to the manual.
+
+### Version 4.28, 2009.11.08, urgency: MEDIUM
+* New features
+ - Win32 DLLs for OpenSSL 0.9.8l.
+ - Transparent proxy support on Linux kernels >=2.6.28.
+ See the manual for details.
+ - New socket options to control TCP keepalive on Linux:
+ TCP_KEEPCNT, TCP_KEEPIDLE, TCP_KEEPINTVL.
+ - SSL options updated for the recent version of OpenSSL library.
+* Bugfixes
+ - A serious bug in asynchronous shutdown code fixed.
+ - Data alignment updated in libwrap.c.
+ - Polish manual encoding fixed.
+ - Notes on compression implementation in OpenSSL added to the manual.
+
+### Version 4.27, 2009.04.16, urgency: MEDIUM
+* New features
+ - Win32 DLLs for OpenSSL 0.9.8k.
+ - FIPS support was updated for openssl-fips 1.2.
+ - New priority failover strategy for multiple "connect" targets,
+ controlled with "failover=rr" (default) or "failover=prio".
+ - pgsql protocol negotiation by Marko Kreen <markokr@gmail.com>.
+ - Building instructions were updated in INSTALL.W32 file.
+* Bugfixes
+ - Libwrap helper processes fixed to close standard
+ input/output/error file descriptors.
+ - OS2 compilation fixes.
+ - WCE fixes by Pierre Delaage <delaage.pierre@free.fr>.
+
+### Version 4.26, 2008.09.20, urgency: MEDIUM
+* New features
+ - Win32 DLLs for OpenSSL 0.9.8i.
+ - /etc/hosts.allow and /etc/hosts.deny no longer need to be
+ copied to the chrooted directory, as the libwrap processes
+ are no longer chrooted.
+ - A more informative error messages for invalid port number
+ specified in stunnel.conf file.
+ - Support for Microsoft Visual C++ 9.0 Express Edition.
+* Bugfixes
+ - Killing all libwrap processes at stunnel shutdown fixed.
+ - A minor bug in stunnel.init sample SysV startup file fixed.
+
+### Version 4.25, 2008.06.01, urgency: MEDIUM
+* New features
+ - Win32 DLLs for OpenSSL 0.9.8h.
+* Bugfixes
+ - Spawning libwrap processes delayed until privileges are dropped.
+ - Compilation fix for systems without struct msghdr.msg_control.
+
+### Version 4.24, 2008.05.19, urgency: HIGH
+* Bugfixes
+ - OCSP code was fixed to properly reject revoked certificates.
+
+### Version 4.23, 2008.05.03, urgency: HIGH
+* Bugfixes
+ - Local privilege escalation bug on Windows NT based
+ systems fixed. A local user could exploit stunnel
+ running as a service to gain localsystem privileges.
+
+### Version 4.22, 2008.03.28, urgency: MEDIUM
+* New features
+ - Makefile was updated to use standard autoconf variables:
+ sysconfdir, localstatedir and pkglibdir.
+ - A new global option to control logging to syslog:
+ syslog = yes|no
+ Simultaneous logging to a file and the syslog is now possible.
+ - A new service-level option to control stack size:
+ stack = <number of bytes>
+* Bugfixes
+ - Restored chroot() to be executed after decoding numerical
+ userid and groupid values in drop_privileges().
+ - A few bugs fixed the in the new libwrap support code.
+ - TLSv1 method used by default in FIPS mode instead of
+ SSLv3 client and SSLv23 server methods.
+ - OpenSSL GPL license exception update based on
+ http://www.gnu.org/licenses/gpl-faq.html#GPLIncompatibleLibs
+
+### Version 4.21, 2007.10.27, urgency: LOW/EXPERIMENTAL
+* New features sponsored by Open-Source Software Institute
+ - Initial FIPS 140-2 support (see INSTALL.FIPS for details).
+ Win32 platform is not currently supported.
+* New features
+ - Experimental fast support for non-MT-safe libwrap is provided
+ with pre-spawned processes.
+ - Stunnel binary moved from /usr/local/sbin to /usr/local/bin
+ in order to meet FHS and LSB requirements.
+ Please delete the /usr/local/sbin/stunnel when upgrading.
+ - Added code to disallow compiling stunnel with pthreads when
+ OpenSSL is compiled without threads support.
+ - Win32 DLLs for OpenSSL 0.9.8g.
+ - Minor manual update.
+ - TODO file updated.
+* Bugfixes
+ - Dynamic locking callbacks added (needed by some engines to work).
+ - AC_ARG_ENABLE fixed in configure.am to accept yes/no arguments.
+ - On some systems libwrap requires yp_get_default_domain from libnsl,
+ additional checking for libnsl was added to the ./configure script.
+ - Sending a list of trusted CAs for the client to choose the right
+ certificate restored.
+ - Some compatibility issues with NTLM authentication fixed.
+ - Taskbar icon (unless there is a config file parsing error) and
+ "Save As" disabled in the service mode for local Win32 security
+ (it's much like Yeti -- some people claim they have seen it).
+
+### Version 4.20, 2006.11.30, urgency: MEDIUM
+* Release notes
+ - The new transfer() function has been well tested.
+ I recommend upgrading any previous version with this one.
+* Bugfixes
+ - Fixed support for encrypted passphrases on Unix (broken in 4.19).
+ - Reduced amount of debug logs.
+ - A minor man page update.
+
+### Version 4.19, 2006.11.11, urgency: LOW/EXPERIMENTAL
+* Release notes
+ - There are a lot of new features in this version. I recommend
+ to test it well before upgrading your mission-critical systems.
+* New features
+ - New service-level option to specify an OCSP responder flag:
+ OCSPflag = <flag>
+ - "protocolCredentials" option changed to "protocolUsername"
+ and "protocolPassword"
+ - NTLM support to be enabled with the new service-level option:
+ protocolAuthentication = NTLM
+ - imap protocol negotiation support added.
+ - Passphrase cache was added so the user does not need to reenter
+ the same passphrase for each defined service any more.
+ - New service-level option to retry exec+connect section:
+ retry = yes|no
+ - Local IP and port is logged for each established connection.
+ - Win32 DLLs for OpenSSL 0.9.8d.
+* Bugfixes
+ - Serious problem with SSL_WANT_* retries fixed.
+ The new code requires extensive testing!
+
+### Version 4.18, 2006.09.26, urgency: MEDIUM
+* Bugfixes
+ - GPF on entering private key pass phrase on Win32 fixed.
+ - Updated OpenSSL Win32 DLLs.
+ - Minor configure script update.
+
+### Version 4.17, 2006.09.10, urgency: MEDIUM
+* New features
+ - Win32 DLLs for OpenSSL 0.9.8c.
+* Bugfixes
+ - Problem with detecting getaddrinfo() in ./configure fixed.
+ - Compilation problem due to misplaced #endif in ssl.c fixed.
+ - Duplicate 220 in smtp_server() function in protocol.c fixed.
+ - Minor os2.mak update.
+ - Minor update of safestring()/safename() macros.
+
+### Version 4.16, 2006.08.31, urgency: MEDIUM
+* New features sponsored by Hewlett-Packard
+ - A new global option to control engine:
+ engineCtrl = <command>:<parameter>
+ - A new service-level option to select engine to read private key:
+ engineNum = <engine number>
+ - OCSP support:
+ ocsp = <URL>
+* New features
+ - A new option to select version of SSL protocol:
+ sslVersion = all|SSLv2|SSLv3|TLSv1
+ - Visual Studio vc.mak by David Gillingham <dgillingham@gmail.com>.
+ - OS2 support by Paul Smedley (http://smedley.info)
+* Bugfixes
+ - An ordinary user can install stunnel again.
+ - Compilation problem with --enable-dh fixed.
+ - Some minor compilation warnings fixed.
+ - Service-level CRL cert store implemented.
+ - GPF on protocol negotiations fixed.
+ - Problem detecting addrinfo() on Tru64 fixed.
+ - Default group is now detected by configure script.
+ - Check for maximum number of defined services added.
+ - OpenSSL_add_all_algorithms() added to SSL initialization.
+ - configure script sections reordered to detect pthread library functions.
+ - RFC 2487 autodetection improved. High resolution s_poll_wait()
+ not currently supported by UCONTEXT threading.
+ - More precise description of cert directory file names (thx to Muhammad
+ Muquit).
+* Other changes
+ - Maximum number of services increased from 64 to 256 when poll() is used.
+
+### Version 4.15, 2006.03.11, urgency: LOW
+* Release notes
+ - There are a lot of new features in this version. I recommend
+ to test it well before upgrading your mission-critical systems.
+* Bugfixes
+ - Fix for pthreads on Solaris 10.
+ - Attempt to autodetect socklen_t type in configure script.
+ - Default threading model changed to pthread for better portability.
+ - DH parameters are not included in the certificate by default.
+* New features sponsored by Software House http://www.swhouse.com/
+ - Most SSL-related options (including client, cert, key) are now
+ available on service-level, so it is possible to have an SSL
+ client and an SSL server in a single stunnel process.
+ - Windows CE (version 3.0 and higher) support.
+* New features
+ - Client mode CONNECT protocol support (RFC 2817 section 5.2).
+ http://www.ietf.org/rfc/rfc2817.txt
+ - Retrying exec+connect services added.
+* File locations are more compliant to Filesystem Hierarchy Standard 2.3
+ - configuration and certificates are in $prefix/etc/stunnel/
+ - binaries are in $prefix/sbin/
+ - default pid file is $prefix/var/run/stunnel.pid
+ - manual is $prefix/man/man8/stunnel.8
+ - other docs are in $prefix/share/doc/stunnel/
+ - libstunnel is in $prefix/lib
+ - chroot directory is setup in $prefix/var/lib/stunnel/
+ this directory is chmoded 1770 and group nogroup
+
+### Version 4.14, 2005.11.02, urgency: HIGH
+* Bugfixes
+ - transfer() fixed to avoid random stalls introduced in version 4.12.
+ - poll() error handing bug fixed.
+ - Checking for dynamic loader libraries added again.
+ - Default pidfile changed from $localstatedir/run/stunnel.pid
+ to $localstatedir/stunnel/stunnel.pid.
+ - Basic SSL library initialization moved to the beginning of execution.
+* Release notes
+ - This is an important bugfix release. Upgrade is recommended.
+
+### Version 4.13, 2005.10.21, urgency: MEDIUM
+* DLLs for OpenSSL 0.9.7i included because protection faults were reported
+ in 0.9.8 and 0.9.8a.
+* New features
+ - Libwrap code is executed as a separate process (no more delays due
+ to a global and potentially long critical section).
+* Bugfixes
+ - Problem with zombies in UCONTEXT threading fixed.
+ - Workaround for non-standard makecontext() uc_stack.ss_sp parameter
+ semantics on SGI IRIX.
+ - Protection fault in signals handling on IRIX fixed.
+ - Problem finding pthread library on AIX fixed.
+ - size_t printf() fixed in stack_info() (the previous fix didn't work).
+ - socklen_t is used instead of int where required.
+
+### Version 4.12, 2005.09.29, urgency: MEDIUM
+* New features
+ - Win32 installer added.
+ - New Win32 commandline options: -start and -stop.
+ - Log level and thread number are reported to syslog.
+ - DLLs for OpenSSL 0.9.8.
+ - stunnel.spec updated by neeo <neeo@irc.pl>.
+* Bugfixes
+ - Use of broken poll() is disabled on Mac OS X.
+ - Yet another transfer() infinite loop condition fixed.
+ - Workaround for a serious M$ bug (KB177346).
+ - IPv6 DLLs allocation problem resulting in GPF on W2K fixed.
+ - zlib added to shared libraries (OpenSSL may need it).
+ - size_t printf() fixed in stack_info().
+* Release notes
+ - This is a bugfix release. Upgrade is recommended.
+
+### Version 4.11, 2005.07.09, urgency: MEDIUM
+* New features
+ - New ./configure option --with-threads to select thread model.
+ - ./configure option --with-tcp-wrappers renamed to --disable-libwrap.
+ I hope the meaning of the option is much more clear, now.
+* Bugfixes
+ - Workaround for non-standard makecontext() uc_stack.ss_sp parameter
+ semantics on Sparc/Solaris 9 and earlier.
+ - scan_waiting_queue() no longer drops contexts.
+ - Inetd mode GPFs with UCONTEXT fixed.
+ - Cleanup context is no longer used.
+ - Releasing memory of the current context is delayed.
+ - Win32 headers reordered for Visual Studio 7.
+ - Some Solaris compilation warnings fixed.
+ - Rejected inetd mode without 'connect' or 'exec'.
+* Release notes
+ - UCONTEXT threading seems stable, now. Upgrade is recommended.
+
+### Version 4.10, 2005.04.23, urgency: LOW/EXPERIMENTAL
+* DLLs for OpenSSL 0.9.7g.
+* Bugfixes
+ - Missing locking on Win32 platform was added (thx to Yi Lin
+ <yi.lin@convergys.com>)
+ - Some problems with closing SSL fixed.
+* New features
+ - New UCONTEXT user-level non-preemptive threads model is used
+ on systems that support SYSV-compatible ucontext.h.
+ - Improved stunnel3 script with getopt-compatible syntax.
+* Release notes
+ - This version should be thoroughly tested before using it in the
+ mission-critical environment.
+
+### Version 4.09, 2005.03.26, urgency: MEDIUM
+* DLLs for OpenSSL 0.9.7f.
+* Bugfixes
+ - Compilation problem with undeclared socklen_t fixed.
+ - TIMEOUTclose is not used when there is any data in the buffers.
+ - Stunnel no longer relies on close_notify with SSL 2.0 connections,
+ since SSL 2.0 protocol does not have any alerts defined.
+ - Closing SSL socket when there is some data in SSL output buffer
+ is detected and reported as an error.
+ - Install/chmod race condition when installing default certificate fixed.
+ - Stunnel no longer installs signal_handler on ignored signals.
+
+### Version 4.08, 2005.02.27, urgency: LOW
+* New features
+ - New -quiet option was added to install NT service without a message box.
+* Bugfixes
+ - Using $(DESTDIR) in tools/Makefile.am.
+ - Define NI_NUMERICHOST and NI_NUMERICSERV when needed.
+ - Length of configuration file line increased from 256B to 16KB.
+ - Stunnel sends close_notify when a close_notify is received from SSL
+ peer and all remaining data is sent to SSL peer.
+ - Some fixes for bugs detected by the watchdog.
+* Release notes
+ - There were many changes in the transfer() function (the main loop).
+ - This version should be thoroughly tested before using it in the
+ mission-critical environment.
+
+### Version 4.07, 2005.01.03, urgency: MEDIUM
+* Bugfixes
+ - Problem with infinite poll() timeout negative, but not equal to -1 fixed.
+ - Problem with a file descriptor ready to be read just after a non-blocking
+ connect call fixed.
+ - Compile error with EAI_NODATA not defined or equal to EAI_NONAME fixed.
+ - IP address and TCP port textual representation length (IPLEN) increased
+ to 128 bytes.
+ - OpenSSL engine support is only used if engine.h header file exists.
+ - Broken NT Service mode on Win32 platform fixed.
+ - Support for IPv4-only Win32 machines restored.
+
+### Version 4.06, 2004.12.26, urgency: LOW
+* New feature sponsored by SURFnet http://www.surfnet.nl/
+ - IPv6 support (to be enabled with ./configure --enable-ipv6).
+* New features
+ - poll() support - no more FD_SETSIZE limit!
+ - Multiple connect=host:port options are allowed in a single service
+ section. Remote hosts are connected using round-robin algorithm.
+ This feature is not compatible with delayed resolver.
+ - New 'compression' option to enable compression. To use zlib
+ algorithm you have to enable it when building OpenSSL library.
+ - New 'engine' option to select a hardware engine.
+ - New 'TIMEOUTconnect' option with 10 seconds default added.
+ - stunnel3 perl script to emulate version 3.x command line options.
+ - French manual updated by Bernard Choppy <choppy AT free POINT fr>.
+ - A watchdog to detect transfer() infinite loops added.
+ - Configuration file comment character changed from '#' to ';'.
+ '#' will still be recognized to keep compatibility.
+ - MT-safe getaddrinfo() and getnameinfo() are used where available
+ to get better performance on resolver calls.
+ - Automake upgraded from 1.4-p4 to 1.7.9.
+* Bugfixes
+ - log() changed to s_log() to avoid conflicts on some systems.
+ - Common CRIT_INET critical section introduced instead of separate
+ CRIT_NTOA and CRIT_RESOLVER to avoid potential problems with
+ libwrap (TCP Wrappers) library.
+ - CreateThread() finally replaced with _beginthread() on Win32.
+ - make install creates $(localstatedir)/stunnel.
+ $(localstatedir)/stunnel/dev/zero is also created on Solaris.
+ - Race condition with client session cache fixed.
+ - Other minor bugfixes.
+* Release notes
+ - Win32 port requires Winsock2 to work.
+ Some Win95 systems may need a free update from Microsoft.
+ http://www.microsoft.com/windows95/downloads/
+ - Default is *not* to use IPv6 '::' for accept and '::1' for
+ connect. For example to accept pop3s on IPv6 you could use:
+ 'accept = :::995'. I hope the new syntax is clear enough.
+
+### Version 4.05, 2004.02.14, urgency: MEDIUM
+* New feature sponsored by SURFnet http://www.surfnet.nl/
+ - Support for CIFS aka SMB protocol SSL negotiation.
+* New features
+ - CRL support with new CRLpath and CRLfile global options.
+ - New 'taskbar' option on Win32 (thx to Ken Mattsen
+ <ken.Mattsen@roxio.com>).
+ - New -fd command line parameter to read configuration
+ from a specified file descriptor instead of a file.
+ - accept is reported as error when no 'section' is
+ defined (in stunnel 4.04 it was silently ignored causing
+ problems for lusers who did not read the fine manual).
+ - Use fcntl() instead of ioctlsocket() to set socket
+ nonblocking where it is supported.
+ - Basic support for hardware engines with OpenSSL >= 0.9.7.
+ - French manual by Bernard Choppy <choppy@imaginet.fr>.
+ - Thread stack size reduced to 64KB for maximum scalability.
+ - Added optional code to debug thread stack usage.
+ - Support for nsr-tandem-nsk (thx to Tom Bates <tom.bates@hp.com>).
+* Bugfixes
+ - TCP wrappers code moved to CRIT_NTOA critical section
+ since it uses static inet_ntoa() result buffer.
+ - SSL_ERROR_SYSCALL handling problems fixed.
+ - added code to retry nonblocking SSL_shutdown() calls.
+ - Use FD_SETSIZE instead of 16 file descriptors in inetd
+ mode.
+ - fdscanf groks lowercase protocol negotiation commands.
+ - Win32 taskbar GDI objects leak fixed.
+ - Libwrap detection bug in ./configure script fixed.
+ - grp.h header detection fixed for NetBSD and possibly
+ other systems.
+ - Some other minor updates.
+
+### Version 4.04, 2003.01.12, urgency: MEDIUM
+* New feature sponsored by SURFnet http://www.surfnet.nl/
+ - Encrypted private key can be used with Win32 GUI.
+* New features
+ - New 'options' configuration option to setup
+ OpenSSL library hacks with SSL_CTX_set_options().
+ - 'service' option also changes the name for
+ TCP Wrappers access control in inetd mode.
+ - Support for BeOS (thx to Mike I. Kozin <mik@sbor.net>)
+ - SSL is negotiated before connecting remote host
+ or spawning local process whenever possible.
+ - REMOTE_HOST variable is always placed in the
+ enrivonment of a process spawned with 'exec'.
+ - Whole SSL error stack is dumped on errors.
+ - 'make cert' rule is back (was missing since 4.00).
+ - Manual page updated (special thanks to Brian Hatch).
+ - TODO updated.
+* Bugfixes
+ - Major code cleanup (thx to Steve Grubb <linux_4ever@yahoo.com>).
+ - Unsafe functions are removed from SIGCHLD handler.
+ - Several bugs in auth_user() fixed.
+ - Incorrect port when using 'local' option fixed.
+ - OpenSSL tools '-rand' option is no longer directly
+ used with a device (like '/dev/urandom').
+ Temporary random file is created with 'dd' instead.
+* DLLs for OpenSSL 0.9.7.
+
+### Version 4.03, 2002.10.27, urgency: HIGH
+* NT Service (broken since 4.01) is operational again.
+* Memory leak in FORK environments fixed.
+* sigprocmask() mistake corrected.
+* struct timeval is reinitialized before select().
+* EAGAIN handled in client.c for AIX.
+* Manual page updated.
+
+### Version 4.02, 2002.10.21, urgency: HIGH
+* Serious bug in ECONNRESET handling fixed.
+
+### Version 4.01, 2002.10.20, urgency: MEDIUM
+* New features
+ - OpenVMS support.
+ - Polish manual and some manual updates.
+ - 'service' option added on Win32 platform.
+ - Obsolete FAQ has been removed.
+ - Log file is created with 0640 mode.
+ - exec->connect service sections (need more testing).
+* Bugfixes
+ - EINTR ingored in main select() loop.
+ - Fixed problem with stunnel closing connections on
+ TIMEOUTclose before all the data is sent.
+ - Fixed EWOULDBLOCK on writesocket problem.
+ - Potential DOS in Win32 GUI fixed.
+ - Solaris compilation problem fixed.
+ - Libtool configuration problems fixed.
+ - Signal mask is cleared just before exec in local mode.
+ - Accepting sockets and log file descriptors are no longer
+ leaked to the child processes.
+### Special thanks to Steve Grubb for the source code audit.
+
+### Version 4.00, 2002.08.30, urgency: LOW
+* New features sponsored by MAXIMUS http://www.maximus.com/
+ - New user interface (config file).
+ - Single daemon can listen on multiple ports, now.
+ - Native Win32 GUI added.
+ - Native NT/2000/XP service added.
+ - Delayed DNS lookup added.
+* Other new features
+ - All the timeouts are now configurable including
+ TIMEOUTclose that can be set to 0 for MSIE and other
+ buggy clients that do not send close_notify.
+ - Stunnel process can be chrooted in a specified directory.
+ - Numerical values for setuid() and setgid() are allowed, now.
+ - Confusing code for setting certificate defaults introduced in
+ version 3.8p3 was removed to simplify stunnel setup.
+ There are no built-in defaults for CApath and CAfile options.
+ - Private key file for a certificate can be kept in a separate
+ file. Default remains to keep it in the cert file.
+ - Manual page updated.
+ - New FHS-compatible build system based on automake and libtool.
+* Bugfixes
+ - `SSL socket closed on SSL_write' problem fixed.
+ - Problem with localtime() crashing Solaris 8 fixed.
+ - Problem with tcp wrappers library detection fixed.
+ - Cygwin (http://www.cygwin.com/) support added.
+ - __svr4__ macro defined for Sun C/C++ compiler.
+* DLLs for OpenSSL 0.9.6g.
+
+### Version 3.22, 2001.12.20, urgency: HIGH
+* Format string bug fixed in protocol.c
+ smtp, pop3 and nntp in client mode were affected.
+ (stunnel clients could be attacked by malicious servers)
+* Certificate chain can be supplied with -p option or in stunnel.pem.
+* Problem with -r and -l options used together fixed.
+* memmove() instead of memcpy() is used to move data in buffers.
+* More detailed information about negotiated ciphers is printed.
+* New ./configure options: '--enable-no-rsa' and '--enable-dh'.
+
+### Version 3.21c, 2001.11.11, urgency: LOW
+* autoconf scripts upgraded to version 2.52.
+* Problem with pthread_sigmask on Darwin fixed (I hope).
+* Some documentation typos corrected.
+* Attempt to ignore EINTR in transfer().
+* Shared library version reported on startup.
+* DLLs for OpenSSL 0.9.6b.
+
+### Version 3.21b, 2001.11.03, urgency: MEDIUM
+* File descriptor leak on failed connect() fixed.
+
+### Version 3.21a, 2001.10.31, urgency: MEDIUM
+* Small bug in Makefile fixed.
+
+### Version 3.21, 2001.10.31, urgency: MEDIUM
+* Problem with errno and posix threads fixed.
+* It is assumed that system has getopt() if it has getopt.h header file.
+* SSL_CLIENT_DN and SSL_CLIENT_I_DN environment variables set in local mode
+ (-l) process. This feature doesn't work if
+ client mode (-c) or protocol negotiation (-n) is used.
+* Winsock error descriptions hardcoded (English version only).
+* SetConsoleCtrlHandler() used to handle CTRL+C, logoff and shutdown on Win32.
+* Stunnel always requests peer certificate with -v 0.
+* sysconf()/getrlimit() used to calculate number of clients allowed.
+* SSL mode changed for OpenSSL >= 0.9.6.
+* close-on-exec option used to avoid socket inheriting.
+* Buffer size increased from 8KB to 16KB.
+* fdscanf()/fdprintf() changes:
+ - non-blocking socket support,
+ - timeout after 1 minute of inactivity.
+* auth_user() redesigned to force 1 minute timeout.
+* Some source arrangement towards 4.x architecture.
+* No need for 'goto' any more.
+* New Makefile 'test' rule. It performs basic test of
+ standalone/inetd, remote/local and server/client mode.
+* pop3 server mode support added.
+
+### Version 3.20, 2001.08.15, urgency: LOW
+* setsockopt() optlen set according to the optval for Solaris.
+* Minor NetBSD compatibility fixes by Martti Kuparinen.
+* Minor MSVC 6.0 compatibility fixes by Patrick Mayweg.
+* SSL close_notify timeout reduced to 10 seconds of inactivity.
+* Socket close instead of reset on close_notify timeout.
+* Some source arrangement and minor bugfixes.
+
+### Version 3.19, 2001.08.10, urgency: MEDIUM
+* Critical section added around non MT-safe TCP Wrappers code.
+* Problem with 'select: Interrupted system call' error fixed.
+* errno replaced with get_last_socket_error() for Win32.
+* Some FreeBSD/NetBSD patches to ./configure from Martti Kuparinen.
+* Local mode process pid logged.
+* Default FQDN (localhost) removed from stunnel.cnf
+* ./configure changed to recognize POSIX threads library on OSF.
+* New -O option to set socket options.
+
+### Version 3.18, 2001.07.31, urgency: MEDIUM
+* MAX_CLIENTS is calculated based on FD_SETSIZE, now.
+* Problems with closing SSL in transfer() fixed.
+* -I option to bind a static local IP address added.
+* Debug output of info_callback redesigned.
+
+### Version 3.17, 2001.07.29, urgency: MEDIUM
+* Problem with GPF on exit with active threads fixed.
+* Timeout for transfer() function added:
+ - 1 hour if socket is open for read
+ - 1 minute if socket is closed for read
+
+### Version 3.16, 2001.07.22, urgency: MEDIUM
+* Some transfer() bugfixes/improvements.
+* STDIN/STDOUT are no longer assumed to be non-socket descriptors.
+* Problem with --with-tcp-wrappers patch fixed.
+* pop3 and nntp support bug fixed by Martin Germann.
+* -o option to append log messages to a file added.
+* Changed error message for SSL error 0.
+
+### Version 3.15, 2001.07.15, urgency: MEDIUM
+* Serious bug resulting in random transfer() hangs fixed.
+* Separate file descriptors are used for inetd mode.
+* -f (foreground) logs are now stamped with time.
+* New ./configure option: --with-tcp-wrappers by Brian Hatch.
+* pop3 protocol client support (-n pop3) by Martin Germann.
+* nntp protocol client support (-n nntp) by Martin Germann.
+* RFC 2487 (smtp STARTTLS) client mode support.
+* Transparency support for Tru64 added.
+* Some #includes for AIX added.
+
+### Version 3.14, 2001.02.21, urgency: LOW
+* Pidfile creation algorithm has been changed.
+
+### Version 3.13, 2001.01.25, urgency: MEDIUM
+* pthread_sigmask() argument in sthreads.c corrected.
+* OOB data is now handled correctly.
+
+### Version 3.12, 2001.01.24, urgency: LOW
+* Attempted to fix problem with zombies in local mode.
+* Patch for 64-bit machines by Nalin Dahyabhai <nalin@redhat.com> applied.
+* Tiny bugfix for OSF cc by Dobrica Pavlinusic <dpavlin@rot13.org> added.
+* PORTS file updated.
+
+### Version 3.11, 2000.12.21, urgency: MEDIUM
+* New problem with zombies fixed.
+* Attempt to be integer-size independent.
+* SIGHUP handler added.
+
+### Version 3.10, 2000.12.19, urgency: MEDIUM
+* Internal thread synchronization code added.
+* libdl added to stunnel dependencies if it exists.
+* Manpage converted to sdf format.
+* stunnel deletes pid file before attempting to create it.
+* Documentation updates.
+* -D option now takes facility.level as argument. 0-7 still supported.
+* Problems with occasional zombies in FORK mode fixed.
+* 'stunnel.exe' rule added to Makefile.
+ You can cross-compile stunnel.exe on Unix, now.
+ I'd like to be able to compile OpenSSL this way, too...
+
+### Version 3.9, 2000.12.13, urgency: HIGH
+* Updated temporary key generation:
+ - stunnel is now honoring requested key-lengths correctly,
+ - temporary key is changed every hour.
+* transfer() no longer hangs on some platforms.
+ Special thanks to Peter Wagemans for the patch.
+* Potential security problem with syslog() call fixed.
+
+### Version 3.8p4, 2000.06.25 bri@stunnel.org:
+* fixes for Windows platform
+
+### Version 3.8p3, 2000.06.24 bri@stunnel.org:
+* Compile time definitions for the following:
+ --with-cert-dir
+ --with-cert-file
+ --with-pem-dir
+ --enable-ssllib-cs
+* use daemon() function instead of daemonize, if available
+* fixed FreeBSD threads checking (patch from robertw@wojo.com)
+* added -S flag, allowing you to choose which default verify
+ sources to use
+* relocated service name output logging until after log_open.
+ (no longer outputs log info to inetd socket, causing bad SSL)
+* -V flag now outputs the default values used by stunnel
+* Removed DH param generation in Makefile.in
+* Moved stunnel.pem to sample.pem to keep people from blindly using it
+* Removed confusing stunnel.pem check from Makefile.
+
+* UPGRADE NOTE: this version seriously changes several previous stunnel
+ default behaviours. There are no longer any default cert file/dirs
+ compiled into stunnel, you must use the --with-cert-dir and
+ --with-cert-file configure arguments to set these manually, if desired.
+ Stunnel does not use the underlying ssl library defaults by default
+ unless configured with --enable-ssllib-cs. Note that these can always
+ be enabled at run time with the -A,-a, and -S flags.
+ Additionally, unless --with-pem-dir is specified at compile time,
+ stunnel will default to looking for stunnel.pem in the current directory.
+
+### Version 3.8p2, 2000.06.13 bri@stunnel.org:
+* Fixes for Win32 platform
+* Minor output formatting changes
+* Fixed version number in files
+
+### Version 3.8p1, 2000.06.11 bri@stunnel.org:
+* Added rigorous PRNG seeding
+* PID changes (and related security-fix)
+* Man page fixes
+* Client SSL Session-IDs now used
+* -N flag to specify tcpwrapper service name
+
+### Version 3.8, 2000.02.24:
+* Checking for threads in c_r library for FreeBSD.
+* Some compatibility fixes for Ultrix.
+* configure.in has been cleaned up.
+ Separate directories for SSL certs and SSL libraries/headers
+ are no longer supported. SSL ports maintainers should create
+ softlinks in the main openssl directory if necessary.
+* Added --with-ssl option to specify SSL directory.
+* Added setgid (-g) option.
+ (Special thanks to Brian Hatch for his feedback and support)
+* Added pty.c based on a Public Domain code by Tatu Ylonen
+* Distribution files are now signed with GnuPG
+
+### Version 3.7, 2000.02.10:
+* /usr/pkg added to list of possible SSL directories for pkgsrc installs
+ of OpenSSL under NetBSD.
+* Added the -s option, which setuid()s to the specified user when running
+ in daemon mode. Useful for cyrus imapd.
+ (both based on patch by George Coulouris)
+* PTY code ported to Solaris. The port needs some more testing.
+* Added handler for SIGINT.
+* Added --with-random option to ./configure script.
+* Fixed some problems with autoconfiguration on Solaris and others.
+ It doesn't use config.h any more.
+* /var/run changed to @localstatedir@/stunnel for better portability.
+ The directory is chmoded a=rwx,+t.
+* FAQ has been updated.
+
+### 3.6 2000.02.03
+* Automatic RFC 2487 detection based on patch by Pascual Perez and Borja Perez.
+* Non-blocking sockets not used by default.
+* DH support is disabled by default.
+* (both can be enabled in ssl.c)
+
+### 3.5 2000.02.02
+* Support for openssl 0.9.4 added.
+* /usr/ssl added to configure by Christian Zuckschwerdt.
+* Added tunneling for PPP through the addition of PTY handling.
+* Added some documentation.
+
+### 3.4a 1999.07.13 (bugfix release)
+* Problem with cipher negotiation fixed.
+* setenv changed to putenv.
+
+### 3.4 1999.07.12
+* Local transparent proxy added with LD_PRELOADed shared library.
+* DH code rewritten.
+* Added -C option to set cipher list.
+* stderr fflushed after fprintf().
+* Minor portability bugfixes.
+* Manual updated (but still not perfect).
+
+### 3.3 1999.06.18
+* Support for openssl 0.9.3 added.
+* Generic support for protocol negotiation added (protocol.c).
+* SMTP protocol negotiation support for Netscape client added.
+* Transparent proxy mode (currently works on Linux only).
+* SO_REUSEADDR enabled on listening socket in daemon mode.
+* ./configure now accepts --prefix parameter.
+* -Wall is only used with gcc compiler.
+* Makefile.in and configure.in updated.
+* SSL-related functions moved to a separate file.
+* vsprintf changed to vsnprintf in log.c on systems have it.
+* Pidfile in /var/run added for daemon mode.
+* RSAref support fix (not tested).
+* Some compatibility fixes for Solaris and NetBSD added.
+
+### 3.2 1999.04.28
+* RSAref support (not tested).
+* Added full duplex with non-blocking sockets.
+* RST sent instead of FIN on peer error (on error peer
+ socket is reset - not just closed).
+* RSA temporary key length changed back to 512 bits to fix
+ a problem with Netscape.
+* Added NO_RSA for US citizens having problems with patents.
+
+### 3.1 1999.04.22
+* Changed -l syntax (first argument specified is now argv0).
+* Fixed problem with options passed to locally executed daemon.
+* Fixed problem with ':' passed to libwrap in a service name:
+ - ':' has been changed to '.';
+ - user can specify his own service name as an argument.
+* RSA temporary key length changed from 512 to 1024 bits.
+* Added safecopy to avoid buffer overflows in stunnel.c.
+* Fixed problems with GPF after unsuccessful resolver call
+ and incorrect parameters passed to getopt() in Win32.
+* FAQ updated.
+
+### 3.0 1999.04.19
+* Some bugfixes.
+* FAQ added.
+
+### 3.0b7 1999.04.14
+* Win32 native port fixed (looks quite stable).
+* New transfer() function algorithm.
+* New 'make cert' to be compatible with openssl-0.9.2b.
+* Removed support for memory leaks debugging.
+
+### 3.0b6 1999.04.01
+* Fixed problems with session cache (by Adam).
+* Added client mode session cache.
+* Source structure, autoconf script and Makefile changed.
+* Added -D option to set debug level.
+* Added support for memory leaks debugging
+ (SSL library needs to be compiled with -DMFUNC).
+
+### 3.0b5 1999.03.25
+* Lots of changes to make threads work.
+* Peer (client and server) authentication works!
+* Added -V option to display version.
+
+### 3.0b4 1999.03.22
+* Early POSIX threads implementation.
+* Work on porting to native Win32 application started.
+
+### 3.0b3 1999.03.05
+* Improved behavior on heavy load.
+
+### 3.0b2 1999.03.04
+* Fixed -v parsing bug.
+
+### 3.0b1 1999.01.18
+* New user interface.
+* Client mode added.
+* Peer certificate verification added (=strong authentication).
+* Win32 port added.
+* Other minor problems fixed.
+
+### 2.1 1998.06.01
+* Few bugs fixed.
+
+### 2.0 1998.05.25
+* Remote mode added!
+* Standalone mode added!
+* tcpd functionality added by libwrap utilization.
+* DH callbacks removed by kravietZ.
+* bind loopback on Intel and other bugs fixed by kravietZ.
+* New manual page by kravietZ & myself.
+
+### 1.6 1998.02.24
+* Linux bind fix.
+* New TODO ideas!
+
+### 1.5 1998.02.24
+* make_sockets() implemented with Internet sockets instead
+ of Unix sockets for better compatibility.
+ (i.e. to avoid random data returned by getpeername(2))
+ This feature can be disabled in stunnel.c.
+
+### 1.4 1998.02.16
+* Ported to HP-UX, Solaris and probably other UNIXes.
+* Autoconfiguration added.
+
+### 1.3 1998.02.14
+* Man page by Pawel Krawczyk <kravietz@ceti.com.pl> added!
+* Copyrights added.
+* Minor errors corrected.
+
+### 1.2 1998.02.14
+* Separate certificate for each service added.
+* Connection logging support.
+
+### 1.1 1998.02.14
+* Callback functions added by Pawel Krawczyk <kravietz@ceti.com.pl>.
+
+### 1.0 1998.02.11
+* First version with SSL support
+ - special thx to Adam Hernik <adas@infocentrum.com>.
+
+### 0.1 1998.02.10
+* Testing skeleton.

_service:tar_scm:stunnel-5.69.tar.gz/PORTS.md Added

_service:tar_scm:stunnel-5.69.tar.gz/README.md Added

@@ -0,0 +1,33 @@
+# stunnel overview
+
+
+### Short description
+
+The stunnel program is designed to work as an SSL encryption
+wrapper between remote client and local (inetd-startable) or
+remote servers. The goal is to facilitate SSL encryption and
+authentication for non-SSL-aware programs.
+
+stunnel can be used to add  SSL  functionality  to  commonly
+used  inetd  daemons  like  POP-2,  POP-3  and  IMAP servers
+without any changes in the programs' code.
+
+### License
+
+* COPYING(COPYING.md) A short license overview
+* COPYRIGHT(COPYRIGHT.md) The complete terms and conditions
+* CREDITS(CREDITS.md) A list of major contributions
+
+### Other useful files
+
+* NEWS(NEWS.md) What I did
+* TODO(TODO.md) What I'm going to do
+* BUGS(BUGS.md) Known bugs
+* INSTALL.FIPS(INSTALL.FIPS.md), INSTALL.W32(INSTALL.W32.md) and
+  INSTALL.WCE(INSTALL.WCE.md) Additional installation notes
+* PORTS(PORTS.md) Known ports
+
+### Reporting problems and other contacts
+
+* Support(https://www.stunnel.org/support.html) options
+* Contacts(https://www.stunnel.org/contact.html)

_service:tar_scm:stunnel-5.69.tar.gz/TODO.md Added

@@ -0,0 +1,41 @@
+# stunnel TODO
+
+
+### High priority features
+These features will likely be supported some day.
+A sponsor could allocate my time to get them faster.
+
+* Add client certificate autoselection based on the list of accepted issuers:
+  SSL_CTX_set_client_cert_cb(), SSL_get_client_CA_list().
+* OCSP stapling (tlsext_status).
+* Indirect CRL support (RFC 3280, section 5).
+* Add an Apparmor profile.
+* Log rotation on Windows.
+* Configuration file option to limit the number of concurrent connections.
+* Command-line server control interface on Unix.
+* An Android GUI.
+* MSI installer for Windows.
+* Add 'leastconn' failover strategy to order defined 'connect' targets
+  by the number of active connections.
+
+### Low priority features
+These features will unlikely ever be supported.
+
+* Database and/or directory interface for retrieving PSK secrets.
+* Service-level logging destination.
+* Logging to NT EventLog on Windows.
+* Internationalization of logged messages (i18n).
+* Generic scripting engine instead or static protocol.c.
+
+### Rejected features
+Features I will not support, unless convinced otherwise by a wealthy sponsor.
+
+* Support for adding X-Forwarded-For to HTTP request headers.
+  This feature is less useful since PROXY protocol support is available.
+* Support for adding X-Forwarded-For to SMTP email headers.
+  This feature is most likely to be implemented as a separate proxy.
+* Additional certificate checks (including wildcard comparison) based on:
+  - O (Organization), and
+  - OU (Organizational Unit).
+* Set processes title that appear on the ps(1) and top(1) commands.
+  I could not find a portable *and* non-copyleft library for it.

_service:tar_scm:stunnel-5.48.tar.gz/aclocal.m4 -> _service:tar_scm:stunnel-5.69.tar.gz/aclocal.m4 Changed

@@ -1,6 +1,6 @@
-# generated automatically by aclocal 1.15 -*- Autoconf -*-
+# generated automatically by aclocal 1.16.5 -*- Autoconf -*-
 
-# Copyright (C) 1996-2014 Free Software Foundation, Inc.
+# Copyright (C) 1996-2021 Free Software Foundation, Inc.
 
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -14,15 +14,15 @@
 m4_ifndef(AC_CONFIG_MACRO_DIRS, m4_defun(_AM_CONFIG_MACRO_DIRS, )m4_defun(AC_CONFIG_MACRO_DIRS, _AM_CONFIG_MACRO_DIRS($@)))
 m4_ifndef(AC_AUTOCONF_VERSION,
 m4_copy(m4_PACKAGE_VERSION, AC_AUTOCONF_VERSION))dnl
-m4_if(m4_defn(AC_AUTOCONF_VERSION), 2.69,,
-m4_warning(this file was generated for autoconf 2.69.
+m4_if(m4_defn(AC_AUTOCONF_VERSION), 2.71,,
+m4_warning(this file was generated for autoconf 2.71.
 You have another version of autoconf. It may work, but is not guaranteed to.
 If you have problems, you may need to regenerate the build system entirely.
 To do so, use the procedure documented by the package, typically 'autoreconf'.))
 
-# ===========================================================================
-# http://www.gnu.org/software/autoconf-archive/ax_append_compile_flags.html
-# ===========================================================================
+# ============================================================================
+# https://www.gnu.org/software/autoconf-archive/ax_append_compile_flags.html
+# ============================================================================
 #
 # SYNOPSIS
 #
@@ -52,33 +52,12 @@
 #
 # Copyright (c) 2011 Maarten Bosmans <mkbosmans@gmail.com>
 #
-# This program is free software: you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by the
-# Free Software Foundation, either version 3 of the License, or (at your
-# option) any later version.
-#
-# This program is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
-# Public License for more details.
-#
-# You should have received a copy of the GNU General Public License along
-# with this program. If not, see <http://www.gnu.org/licenses/>.
-#
-# As a special exception, the respective Autoconf Macro's copyright owner
-# gives unlimited permission to copy, distribute and modify the configure
-# scripts that are the output of Autoconf when processing the Macro. You
-# need not follow the terms of the GNU General Public License when using
-# or distributing such scripts, even though portions of the text of the
-# Macro appear in them. The GNU General Public License (GPL) does govern
-# all other use of the material that constitutes the Autoconf Macro.
-#
-# This special exception to the GPL applies to versions of the Autoconf
-# Macro released by the Autoconf Archive. When you make and distribute a
-# modified version of the Autoconf Macro, you may extend this special
-# exception to the GPL to apply to your modified version as well.
+# Copying and distribution of this file, with or without modification, are
+# permitted in any medium without royalty provided the copyright notice
+# and this notice are preserved. This file is offered as-is, without any
+# warranty.
 
-#serial 5
+#serial 7
 
 AC_DEFUN(AX_APPEND_COMPILE_FLAGS,
 AX_REQUIRE_DEFINED(AX_CHECK_COMPILE_FLAG)
@@ -89,7 +68,7 @@
 )dnl AX_APPEND_COMPILE_FLAGS
 
 # ===========================================================================
-# http://www.gnu.org/software/autoconf-archive/ax_append_flag.html
+# https://www.gnu.org/software/autoconf-archive/ax_append_flag.html
 # ===========================================================================
 #
 # SYNOPSIS
@@ -113,33 +92,12 @@
 # Copyright (c) 2008 Guido U. Draheim <guidod@gmx.de>
 # Copyright (c) 2011 Maarten Bosmans <mkbosmans@gmail.com>
 #
-# This program is free software: you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by the
-# Free Software Foundation, either version 3 of the License, or (at your
-# option) any later version.
-#
-# This program is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
-# Public License for more details.
-#
-# You should have received a copy of the GNU General Public License along
-# with this program. If not, see <http://www.gnu.org/licenses/>.
-#
-# As a special exception, the respective Autoconf Macro's copyright owner
-# gives unlimited permission to copy, distribute and modify the configure
-# scripts that are the output of Autoconf when processing the Macro. You
-# need not follow the terms of the GNU General Public License when using
-# or distributing such scripts, even though portions of the text of the
-# Macro appear in them. The GNU General Public License (GPL) does govern
-# all other use of the material that constitutes the Autoconf Macro.
-#
-# This special exception to the GPL applies to versions of the Autoconf
-# Macro released by the Autoconf Archive. When you make and distribute a
-# modified version of the Autoconf Macro, you may extend this special
-# exception to the GPL to apply to your modified version as well.
+# Copying and distribution of this file, with or without modification, are
+# permitted in any medium without royalty provided the copyright notice
+# and this notice are preserved. This file is offered as-is, without any
+# warranty.
 
-#serial 6
+#serial 8
 
 AC_DEFUN(AX_APPEND_FLAG,
 dnl
@@ -161,7 +119,7 @@
 )dnl AX_APPEND_FLAG
 
 # ===========================================================================
-# http://www.gnu.org/software/autoconf-archive/ax_append_link_flags.html
+# https://www.gnu.org/software/autoconf-archive/ax_append_link_flags.html
 # ===========================================================================
 #
 # SYNOPSIS
@@ -190,33 +148,12 @@
 #
 # Copyright (c) 2011 Maarten Bosmans <mkbosmans@gmail.com>
 #
-# This program is free software: you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by the
-# Free Software Foundation, either version 3 of the License, or (at your
-# option) any later version.
-#
-# This program is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
-# Public License for more details.
-#
-# You should have received a copy of the GNU General Public License along
-# with this program. If not, see <http://www.gnu.org/licenses/>.
-#
-# As a special exception, the respective Autoconf Macro's copyright owner
-# gives unlimited permission to copy, distribute and modify the configure
-# scripts that are the output of Autoconf when processing the Macro. You
-# need not follow the terms of the GNU General Public License when using
-# or distributing such scripts, even though portions of the text of the
-# Macro appear in them. The GNU General Public License (GPL) does govern
-# all other use of the material that constitutes the Autoconf Macro.
-#
-# This special exception to the GPL applies to versions of the Autoconf
-# Macro released by the Autoconf Archive. When you make and distribute a
-# modified version of the Autoconf Macro, you may extend this special
-# exception to the GPL to apply to your modified version as well.
+# Copying and distribution of this file, with or without modification, are
+# permitted in any medium without royalty provided the copyright notice
+# and this notice are preserved. This file is offered as-is, without any
+# warranty.
 
-#serial 5
+#serial 7
 
 AC_DEFUN(AX_APPEND_LINK_FLAGS,
 AX_REQUIRE_DEFINED(AX_CHECK_LINK_FLAG)
@@ -227,7 +164,7 @@
 )dnl AX_APPEND_LINK_FLAGS
 
 # ===========================================================================
-# http://www.gnu.org/software/autoconf-archive/ax_check_compile_flag.html
+# https://www.gnu.org/software/autoconf-archive/ax_check_compile_flag.html
 # ===========================================================================
 #
 # SYNOPSIS
@@ -257,33 +194,12 @@
 # Copyright (c) 2008 Guido U. Draheim <guidod@gmx.de>
 # Copyright (c) 2011 Maarten Bosmans <mkbosmans@gmail.com>
 #
-# This program is free software: you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by the
-# Free Software Foundation, either version 3 of the License, or (at your
-# option) any later version.
-#
-# This program is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
-# Public License for more details.
-#
-# You should have received a copy of the GNU General Public License along
-# with this program. If not, see <http://www.gnu.org/licenses/>.
-#
-# As a special exception, the respective Autoconf Macro's copyright owner
-# gives unlimited permission to copy, distribute and modify the configure
-# scripts that are the output of Autoconf when processing the Macro. You
-# need not follow the terms of the GNU General Public License when using
-# or distributing such scripts, even though portions of the text of the
-# Macro appear in them. The GNU General Public License (GPL) does govern
-# all other use of the material that constitutes the Autoconf Macro.
-#
-# This special exception to the GPL applies to versions of the Autoconf
-# Macro released by the Autoconf Archive. When you make and distribute a
-# modified version of the Autoconf Macro, you may extend this special
-# exception to the GPL to apply to your modified version as well.
+# Copying and distribution of this file, with or without modification, are
+# permitted in any medium without royalty provided the copyright notice
+# and this notice are preserved. This file is offered as-is, without any
+# warranty.
 
-#serial 4
+#serial 6
 
 AC_DEFUN(AX_CHECK_COMPILE_FLAG,
 AC_PREREQ(2.64)dnl for _AC_LANG_PREFIX and AS_VAR_IF
@@ -302,7 +218,7 @@
 )dnl AX_CHECK_COMPILE_FLAGS
 
 # ===========================================================================
-# http://www.gnu.org/software/autoconf-archive/ax_check_link_flag.html
+# https://www.gnu.org/software/autoconf-archive/ax_check_link_flag.html
 # ===========================================================================
 #
 # SYNOPSIS
@@ -332,33 +248,12 @@
 # Copyright (c) 2008 Guido U. Draheim <guidod@gmx.de>
 # Copyright (c) 2011 Maarten Bosmans <mkbosmans@gmail.com>
 #
-# This program is free software: you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by the
-# Free Software Foundation, either version 3 of the License, or (at your
-# option) any later version.
-#
-# This program is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
-# Public License for more details.
-#
-# You should have received a copy of the GNU General Public License along
-# with this program. If not, see <http://www.gnu.org/licenses/>.
-#
-# As a special exception, the respective Autoconf Macro's copyright owner
-# gives unlimited permission to copy, distribute and modify the configure
-# scripts that are the output of Autoconf when processing the Macro. You
-# need not follow the terms of the GNU General Public License when using
-# or distributing such scripts, even though portions of the text of the
-# Macro appear in them. The GNU General Public License (GPL) does govern
-# all other use of the material that constitutes the Autoconf Macro.
-#
-# This special exception to the GPL applies to versions of the Autoconf
-# Macro released by the Autoconf Archive. When you make and distribute a
-# modified version of the Autoconf Macro, you may extend this special
-# exception to the GPL to apply to your modified version as well.
+# Copying and distribution of this file, with or without modification, are
+# permitted in any medium without royalty provided the copyright notice
+# and this notice are preserved. This file is offered as-is, without any
+# warranty.
 
-#serial 4
+#serial 6
 
 AC_DEFUN(AX_CHECK_LINK_FLAG,
 AC_PREREQ(2.64)dnl for _AC_LANG_PREFIX and AS_VAR_IF
@@ -377,7 +272,7 @@
 )dnl AX_CHECK_LINK_FLAGS
 
 # ===========================================================================
-# http://www.gnu.org/software/autoconf-archive/ax_pthread.html
+# https://www.gnu.org/software/autoconf-archive/ax_pthread.html
 # ===========================================================================
 #
 # SYNOPSIS
@@ -392,20 +287,24 @@
 # flags that are needed. (The user can also force certain compiler
 # flags/libs to be tested by setting these environment variables.)
 #
-# Also sets PTHREAD_CC to any special C compiler that is needed for
-# multi-threaded programs (defaults to the value of CC otherwise). (This
-# is necessary on AIX to use the special cc_r compiler alias.)
+# Also sets PTHREAD_CC and PTHREAD_CXX to any special C compiler that is
+# needed for multi-threaded programs (defaults to the value of CC
+# respectively CXX otherwise). (This is necessary on e.g. AIX to use the
+# special cc_r/CC_r compiler alias.)
 #
 # NOTE: You are assumed to not only compile your program with these flags,
 # but also to link with them as well. For example, you might link with
 # $PTHREAD_CC $CFLAGS $PTHREAD_CFLAGS $LDFLAGS ... $PTHREAD_LIBS $LIBS
+# $PTHREAD_CXX $CXXFLAGS $PTHREAD_CFLAGS $LDFLAGS ... $PTHREAD_LIBS $LIBS
 #
 # If you are only building threaded programs, you may wish to use these
 # variables in your default LIBS, CFLAGS, and CC:
 #
 # LIBS="$PTHREAD_LIBS $LIBS"
 # CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
+# CXXFLAGS="$CXXFLAGS $PTHREAD_CFLAGS"
 # CC="$PTHREAD_CC"
+# CXX="$PTHREAD_CXX"
 #
 # In addition, if the PTHREAD_CREATE_JOINABLE thread-attribute constant
 # has a nonstandard name, this macro defines PTHREAD_CREATE_JOINABLE to
@@ -433,6 +332,7 @@
 #
 # Copyright (c) 2008 Steven G. Johnson <stevenj@alum.mit.edu>
 # Copyright (c) 2011 Daniel Richard G. <skunk@iSKUNK.ORG>
+# Copyright (c) 2019 Marc Stevens <marc.stevens@cwi.nl>
 #
 # This program is free software: you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by the
@@ -445,7 +345,7 @@
 # Public License for more details.
 #
 # You should have received a copy of the GNU General Public License along
-# with this program. If not, see <http://www.gnu.org/licenses/>.
+# with this program. If not, see <https://www.gnu.org/licenses/>.
 #
 # As a special exception, the respective Autoconf Macro's copyright owner
 # gives unlimited permission to copy, distribute and modify the configure
@@ -460,7 +360,7 @@
 # modified version of the Autoconf Macro, you may extend this special
 # exception to the GPL to apply to your modified version as well.
 
-#serial 23
+#serial 31
 
 AU_ALIAS(ACX_PTHREAD, AX_PTHREAD)
 AC_DEFUN(AX_PTHREAD, 
@@ -482,6 +382,7 @@
 ax_pthread_save_CFLAGS="$CFLAGS"
 ax_pthread_save_LIBS="$LIBS"
 AS_IF(test "x$PTHREAD_CC" != "x", CC="$PTHREAD_CC")
+ AS_IF(test "x$PTHREAD_CXX" != "x", CXX="$PTHREAD_CXX")
 CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
 LIBS="$PTHREAD_LIBS $LIBS"
 AC_MSG_CHECKING(for pthread_join using $CC $PTHREAD_CFLAGS $PTHREAD_LIBS)
@@ -501,10 +402,12 @@
 # (e.g. DEC) have both -lpthread and -lpthreads, where one of the
 # libraries is broken (non-POSIX).
 
-# Create a list of thread flags to try. Items starting with a "-" are
-# C compiler flags, and other items are library names, except for "none"
-# which indicates that we try without any flags at all, and "pthread-config"
-# which is a program returning the flags for the Pth emulation library.
+# Create a list of thread flags to try. Items with a "," contain both
+# C compiler flags (before ",") and linker flags (after ","). Other items
+# starting with a "-" are C compiler flags, and remaining items are
+# library names, except for "none" which indicates that we try without
+# any flags at all, and "pthread-config" which is a program returning
+# the flags for the Pth emulation library.
 
 ax_pthread_flags="pthreads none -Kthread -pthread -pthreads -mthreads pthread --thread-safe -mt pthread-config"
 
@@ -572,14 +475,47 @@
 # that too in a future libc.) So we'll check first for the
 # standard Solaris way of linking pthreads (-mt -lpthread).
 
- ax_pthread_flags="-mt,pthread pthread $ax_pthread_flags"
+ ax_pthread_flags="-mt,-lpthread pthread $ax_pthread_flags"
 ;;
 esac
 
+# Are we compiling with Clang?
+
+AC_CACHE_CHECK(whether $CC is Clang,
+ ax_cv_PTHREAD_CLANG,
+ ax_cv_PTHREAD_CLANG=no
+ # Note that Autoconf sets GCC=yes for Clang as well as GCC
+ if test "x$GCC" = "xyes"; then
+ AC_EGREP_CPP(AX_PTHREAD_CC_IS_CLANG,
+ /* Note: Clang 2.7 lacks __clang_a-z+__ */
+# if defined(__clang__) && defined(__llvm__)
+ AX_PTHREAD_CC_IS_CLANG
+# endif
+ ,
+ ax_cv_PTHREAD_CLANG=yes)
+ fi
+ )
+ax_pthread_clang="$ax_cv_PTHREAD_CLANG"
+
+
 # GCC generally uses -pthread, or -pthreads on some platforms (e.g. SPARC)
 
+# Note that for GCC and Clang -pthread generally implies -lpthread,
+# except when -nostdlib is passed.
+# This is problematic using libtool to build C++ shared libraries with pthread:
+# 1 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=25460
+# 2 https://bugzilla.redhat.com/show_bug.cgi?id=661333
+# 3 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=468555
+# To solve this, first try -pthread together with -lpthread for GCC
+
 AS_IF(test "x$GCC" = "xyes",
- ax_pthread_flags="-pthread -pthreads $ax_pthread_flags")
+ ax_pthread_flags="-pthread,-lpthread -pthread -pthreads $ax_pthread_flags")
+
+# Clang takes -pthread (never supported any other flag), but we'll try with -lpthread first
+
+AS_IF(test "x$ax_pthread_clang" = "xyes",
+ ax_pthread_flags="-pthread,-lpthread -pthread")
+
 
 # The presence of a feature test macro requesting re-entrant function
 # definitions is, on some systems, a strong hint that pthreads support is
@@ -602,25 +538,86 @@
 ax_pthread_check_cond=0,
 ax_pthread_check_cond="!defined($ax_pthread_check_macro)")
 
-# Are we compiling with Clang?
 
-AC_CACHE_CHECK(whether $CC is Clang,
- ax_cv_PTHREAD_CLANG,
- ax_cv_PTHREAD_CLANG=no
- # Note that Autoconf sets GCC=yes for Clang as well as GCC
- if test "x$GCC" = "xyes"; then
- AC_EGREP_CPP(AX_PTHREAD_CC_IS_CLANG,
- /* Note: Clang 2.7 lacks __clang_a-z+__ */
-# if defined(__clang__) && defined(__llvm__)
- AX_PTHREAD_CC_IS_CLANG
-# endif
- ,
- ax_cv_PTHREAD_CLANG=yes)
- fi
- )
-ax_pthread_clang="$ax_cv_PTHREAD_CLANG"
+if test "x$ax_pthread_ok" = "xno"; then
+for ax_pthread_try_flag in $ax_pthread_flags; do
+
+ case $ax_pthread_try_flag in
+ none)
+ AC_MSG_CHECKING(whether pthreads work without any flags)
+ ;;
+
+ *,*)
+ PTHREAD_CFLAGS=`echo $ax_pthread_try_flag | sed "s/^$.*$,$.*$$/\1/"`
+ PTHREAD_LIBS=`echo $ax_pthread_try_flag | sed "s/^$.*$,$.*$$/\2/"`
+ AC_MSG_CHECKING(whether pthreads work with "$PTHREAD_CFLAGS" and "$PTHREAD_LIBS")
+ ;;
+
+ -*)
+ AC_MSG_CHECKING(whether pthreads work with $ax_pthread_try_flag)
+ PTHREAD_CFLAGS="$ax_pthread_try_flag"
+ ;;
+
+ pthread-config)
+ AC_CHECK_PROG(ax_pthread_config, pthread-config, yes, no)
+ AS_IF(test "x$ax_pthread_config" = "xno", continue)
+ PTHREAD_CFLAGS="`pthread-config --cflags`"
+ PTHREAD_LIBS="`pthread-config --ldflags` `pthread-config --libs`"
+ ;;
+
+ *)
+ AC_MSG_CHECKING(for the pthreads library -l$ax_pthread_try_flag)
+ PTHREAD_LIBS="-l$ax_pthread_try_flag"
+ ;;
+ esac
+
+ ax_pthread_save_CFLAGS="$CFLAGS"
+ ax_pthread_save_LIBS="$LIBS"
+ CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
+ LIBS="$PTHREAD_LIBS $LIBS"
+
+ # Check for various functions. We must include pthread.h,
+ # since some functions may be macros. (On the Sequent, we
+ # need a special flag -Kthread to make this header compile.)
+ # We check for pthread_join because it is in -lpthread on IRIX
+ # while pthread_create is in libc. We check for pthread_attr_init
+ # due to DEC craziness with -lpthreads. We check for
+ # pthread_cleanup_push because it is one of the few pthread
+ # functions on Solaris that doesn't have a non-functional libc stub.
+ # We try pthread_create on general principles.
+
+ AC_LINK_IFELSE(AC_LANG_PROGRAM(#include <pthread.h>
+# if $ax_pthread_check_cond
+# error "$ax_pthread_check_macro must be defined"
+# endif
+ static void *some_global = NULL;
+ static void routine(void *a)
+ {
+ /* To avoid any unused-parameter or
+ unused-but-set-parameter warning. */
+ some_global = a;
+ }
+ static void *start_routine(void *a) { return a; },
+ pthread_t th; pthread_attr_t attr;
+ pthread_create(&th, 0, start_routine, 0);
+ pthread_join(th, 0);
+ pthread_attr_init(&attr);
+ pthread_cleanup_push(routine, 0);
+ pthread_cleanup_pop(0) /* ; */),
+ ax_pthread_ok=yes,
+ )
+
+ CFLAGS="$ax_pthread_save_CFLAGS"
+ LIBS="$ax_pthread_save_LIBS"
+
+ AC_MSG_RESULT($ax_pthread_ok)
+ AS_IF(test "x$ax_pthread_ok" = "xyes", break)
+
+ PTHREAD_LIBS=""
+ PTHREAD_CFLAGS=""
+done
+fi
 
-ax_pthread_clang_warning=no
 
 # Clang needs special handling, because older versions handle the -pthread
 # option in a rather... idiosyncratic way
@@ -639,11 +636,6 @@
 # -pthread does define _REENTRANT, and while the Darwin headers
 # ignore this macro, third-party headers might not.)
 
- PTHREAD_CFLAGS="-pthread"
- PTHREAD_LIBS=
-
- ax_pthread_ok=yes
-
 # However, older versions of Clang make a point of warning the user
 # that, in an invocation where only linking and no compilation is
 # taking place, the -pthread option has no effect ("argument unused
@@ -672,7 +664,7 @@
 # step
 ax_pthread_save_ac_link="$ac_link"
 ax_pthread_sed='s/conftest\.\$ac_ext/conftest.$ac_objext/g'
- ax_pthread_link_step=`$as_echo "$ac_link" | sed "$ax_pthread_sed"`
+ ax_pthread_link_step=`AS_ECHO("$ac_link") | sed "$ax_pthread_sed"`
 ax_pthread_2step_ac_link="($ac_compile) && (echo ==== >&5) && ($ax_pthread_link_step)"
 ax_pthread_save_CFLAGS="$CFLAGS"
 for ax_pthread_try in '' -Qunused-arguments -Wno-unused-command-line-argument unknown; do
@@ -698,78 +690,7 @@
 
 fi # $ax_pthread_clang = yes
 
-if test "x$ax_pthread_ok" = "xno"; then
-for ax_pthread_try_flag in $ax_pthread_flags; do
 
- case $ax_pthread_try_flag in
- none)
- AC_MSG_CHECKING(whether pthreads work without any flags)
- ;;
-
- -mt,pthread)
- AC_MSG_CHECKING(whether pthreads work with -mt -lpthread)
- PTHREAD_CFLAGS="-mt"
- PTHREAD_LIBS="-lpthread"
- ;;
-
- -*)
- AC_MSG_CHECKING(whether pthreads work with $ax_pthread_try_flag)
- PTHREAD_CFLAGS="$ax_pthread_try_flag"
- ;;
-
- pthread-config)
- AC_CHECK_PROG(ax_pthread_config, pthread-config, yes, no)
- AS_IF(test "x$ax_pthread_config" = "xno", continue)
- PTHREAD_CFLAGS="`pthread-config --cflags`"
- PTHREAD_LIBS="`pthread-config --ldflags` `pthread-config --libs`"
- ;;
-
- *)
- AC_MSG_CHECKING(for the pthreads library -l$ax_pthread_try_flag)
- PTHREAD_LIBS="-l$ax_pthread_try_flag"
- ;;
- esac
-
- ax_pthread_save_CFLAGS="$CFLAGS"
- ax_pthread_save_LIBS="$LIBS"
- CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
- LIBS="$PTHREAD_LIBS $LIBS"
-
- # Check for various functions. We must include pthread.h,
- # since some functions may be macros. (On the Sequent, we
- # need a special flag -Kthread to make this header compile.)
- # We check for pthread_join because it is in -lpthread on IRIX
- # while pthread_create is in libc. We check for pthread_attr_init
- # due to DEC craziness with -lpthreads. We check for
- # pthread_cleanup_push because it is one of the few pthread
- # functions on Solaris that doesn't have a non-functional libc stub.
- # We try pthread_create on general principles.
-
- AC_LINK_IFELSE(AC_LANG_PROGRAM(#include <pthread.h>
-# if $ax_pthread_check_cond
-# error "$ax_pthread_check_macro must be defined"
-# endif
- static void routine(void *a) { a = 0; }
- static void *start_routine(void *a) { return a; },
- pthread_t th; pthread_attr_t attr;
- pthread_create(&th, 0, start_routine, 0);
- pthread_join(th, 0);
- pthread_attr_init(&attr);
- pthread_cleanup_push(routine, 0);
- pthread_cleanup_pop(0) /* ; */),
- ax_pthread_ok=yes,
- )
-
- CFLAGS="$ax_pthread_save_CFLAGS"
- LIBS="$ax_pthread_save_LIBS"
-
- AC_MSG_RESULT($ax_pthread_ok)
- AS_IF(test "x$ax_pthread_ok" = "xyes", break)
-
- PTHREAD_LIBS=""
- PTHREAD_CFLAGS=""
-done
-fi
 
 # Various other checks:
 if test "x$ax_pthread_ok" = "xyes"; then
@@ -816,7 +737,8 @@
 AC_CACHE_CHECK(for PTHREAD_PRIO_INHERIT,
 ax_cv_PTHREAD_PRIO_INHERIT,
 AC_LINK_IFELSE(AC_LANG_PROGRAM(#include <pthread.h>,
- int i = PTHREAD_PRIO_INHERIT;),
+ int i = PTHREAD_PRIO_INHERIT;
+ return i;),
 ax_cv_PTHREAD_PRIO_INHERIT=yes,
 ax_cv_PTHREAD_PRIO_INHERIT=no)
 )
@@ -838,18 +760,28 @@
 #handle absolute path differently from PATH based program lookup
 AS_CASE("x$CC",
 x/*,
- AS_IF(AS_EXECUTABLE_P(${CC}_r),PTHREAD_CC="${CC}_r"),
- AC_CHECK_PROGS(PTHREAD_CC,${CC}_r,$CC)))
+ 
+			 AS_IF(AS_EXECUTABLE_P(${CC}_r),PTHREAD_CC="${CC}_r")
+			 AS_IF(test "x${CXX}" != "x", AS_IF(AS_EXECUTABLE_P(${CXX}_r),PTHREAD_CXX="${CXX}_r"))
+			 ,
+ 
+			 AC_CHECK_PROGS(PTHREAD_CC,${CC}_r,$CC)
+			 AS_IF(test "x${CXX}" != "x", AC_CHECK_PROGS(PTHREAD_CXX,${CXX}_r,$CXX))
+			 
+ )
+ )
 ;;
 esac
 fi
 fi
 
 test -n "$PTHREAD_CC" || PTHREAD_CC="$CC"
+test -n "$PTHREAD_CXX" || PTHREAD_CXX="$CXX"
 
 AC_SUBST(PTHREAD_LIBS)
 AC_SUBST(PTHREAD_CFLAGS)
 AC_SUBST(PTHREAD_CC)
+AC_SUBST(PTHREAD_CXX)
 
 # Finally, execute ACTION-IF-FOUND/ACTION-IF-NOT-FOUND:
 if test "x$ax_pthread_ok" = "xyes"; then
@@ -863,7 +795,7 @@
 )dnl AX_PTHREAD
 
 # ===========================================================================
-# http://www.gnu.org/software/autoconf-archive/ax_require_defined.html
+# https://www.gnu.org/software/autoconf-archive/ax_require_defined.html
 # ===========================================================================
 #
 # SYNOPSIS
@@ -894,13 +826,13 @@
 # and this notice are preserved. This file is offered as-is, without any
 # warranty.
 
-#serial 1
+#serial 2
 
 AC_DEFUN(AX_REQUIRE_DEFINED, dnl
 m4_ifndef($1, m4_fatal(macro $1 is not defined; is a m4 file missing?))
 )dnl AX_REQUIRE_DEFINED
 
-# Copyright (C) 2002-2014 Free Software Foundation, Inc.
+# Copyright (C) 2002-2021 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -912,10 +844,10 @@
 # generated from the m4 files accompanying Automake X.Y.
 # (This private macro should not be called outside this file.)
 AC_DEFUN(AM_AUTOMAKE_VERSION,
-am__api_version='1.15'
+am__api_version='1.16'
 dnl Some users find AM_AUTOMAKE_VERSION and mistake it for a way to
 dnl require some minimum version. Point them to the right macro.
-m4_if($1, 1.15, ,
+m4_if($1, 1.16.5, ,
 AC_FATAL(Do not call $0, use AM_INIT_AUTOMAKE($1).))dnl
 )
 
@@ -931,14 +863,14 @@
 # Call AM_AUTOMAKE_VERSION and AM_AUTOMAKE_VERSION so they can be traced.
 # This function is AC_REQUIREd by AM_INIT_AUTOMAKE.
 AC_DEFUN(AM_SET_CURRENT_AUTOMAKE_VERSION,
-AM_AUTOMAKE_VERSION(1.15)dnl
+AM_AUTOMAKE_VERSION(1.16.5)dnl
 m4_ifndef(AC_AUTOCONF_VERSION,
 m4_copy(m4_PACKAGE_VERSION, AC_AUTOCONF_VERSION))dnl
 _AM_AUTOCONF_VERSION(m4_defn(AC_AUTOCONF_VERSION)))
 
 # AM_AUX_DIR_EXPAND -*- Autoconf -*-
 
-# Copyright (C) 2001-2014 Free Software Foundation, Inc.
+# Copyright (C) 2001-2021 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -990,7 +922,7 @@
 
 # AM_CONDITIONAL -*- Autoconf -*-
 
-# Copyright (C) 1997-2014 Free Software Foundation, Inc.
+# Copyright (C) 1997-2021 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -1021,7 +953,7 @@
 Usually this means the macro was only invoked conditionally.)
 fi))
 
-# Copyright (C) 1999-2014 Free Software Foundation, Inc.
+# Copyright (C) 1999-2021 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -1212,13 +1144,12 @@
 
 # Generate code to set up dependency tracking. -*- Autoconf -*-
 
-# Copyright (C) 1999-2014 Free Software Foundation, Inc.
+# Copyright (C) 1999-2021 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
 # with or without modifications, as long as this notice is preserved.
 
-
 # _AM_OUTPUT_DEPENDENCY_COMMANDS
 # ------------------------------
 AC_DEFUN(_AM_OUTPUT_DEPENDENCY_COMMANDS,
@@ -1226,49 +1157,43 @@
 # Older Autoconf quotes --file arguments for eval, but not when files
 # are listed without --file. Let's play safe and only enable the eval
 # if we detect the quoting.
- case $CONFIG_FILES in
- *\'*) eval set x "$CONFIG_FILES" ;;
- *) set x $CONFIG_FILES ;;
- esac
+ # TODO: see whether this extra hack can be removed once we start
+ # requiring Autoconf 2.70 or later.
+ AS_CASE($CONFIG_FILES,
+ *\'*, eval set x "$CONFIG_FILES",
+ *, set x $CONFIG_FILES)
 shift
- for mf
+ # Used to flag and report bootstrapping failures.
+ am_rc=0
+ for am_mf
 do
 # Strip MF so we end up with the name of the file.
- mf=`echo "$mf" | sed -e 's/:.*$//'`
- # Check whether this is an Automake generated Makefile or not.
- # We used to match only the files named 'Makefile.in', but
- # some people rename them; so instead we look at the file content.
- # Grep'ing the first line is not enough: some people post-process
- # each Makefile.in and add a new line on top of each file to say so.
- # Grep'ing the whole file is not good either: AIX grep has a line
+ am_mf=`AS_ECHO("$am_mf") | sed -e 's/:.*$//'`
+ # Check whether this is an Automake generated Makefile which includes
+ # dependency-tracking related rules and includes.
+ # Grep'ing the whole file directly is not great: AIX grep has a line
 # limit of 2048, but all sed's we know have understand at least 4000.
- if sed -n 's,^#.*generated by automake.*,X,p' "$mf" | grep X >/dev/null 2>&1; then
- dirpart=`AS_DIRNAME("$mf")`
- else
- continue
- fi
- # Extract the definition of DEPDIR, am__include, and am__quote
- # from the Makefile without running 'make'.
- DEPDIR=`sed -n 's/^DEPDIR = //p' < "$mf"`
- test -z "$DEPDIR" && continue
- am__include=`sed -n 's/^am__include = //p' < "$mf"`
- test -z "$am__include" && continue
- am__quote=`sed -n 's/^am__quote = //p' < "$mf"`
- # Find all dependency output files, they are included files with
- # $(DEPDIR) in their names. We invoke sed twice because it is the
- # simplest approach to changing $(DEPDIR) to its actual value in the
- # expansion.
- for file in `sed -n "
- s/^$am__include $am__quote$.*(DEPDIR).*$$am__quote"'$/\1/p' <"$mf" | \
-	 sed -e 's/\$(DEPDIR)/'"$DEPDIR"'/g'`; do
- # Make sure the directory exists.
- test -f "$dirpart/$file" && continue
- fdir=`AS_DIRNAME("$file")`
- AS_MKDIR_P($dirpart/$fdir)
- # echo "creating $dirpart/$file"
- echo '# dummy' > "$dirpart/$file"
- done
+ sed -n 's,^am--depfiles:.*,X,p' "$am_mf" | grep X >/dev/null 2>&1 \
+ || continue
+ am_dirpart=`AS_DIRNAME("$am_mf")`
+ am_filepart=`AS_BASENAME("$am_mf")`
+ AM_RUN_LOG(cd "$am_dirpart" \
+ && sed -e '/# am--include-marker/d' "$am_filepart" \
+ | $MAKE -f - am--depfiles) || am_rc=$?
 done
+ if test $am_rc -ne 0; then
+ AC_MSG_FAILURE(Something went wrong bootstrapping makefile fragments
+ for automatic dependency tracking. If GNU make was not used, consider
+ re-running the configure script with MAKE="gmake" (or whatever is
+ necessary). You can also try re-running configure with the
+ '--disable-dependency-tracking' option to at least be able to build
+ the package (albeit without support for automatic dependency tracking).)
+ fi
+ AS_UNSET(am_dirpart)
+ AS_UNSET(am_filepart)
+ AS_UNSET(am_mf)
+ AS_UNSET(am_rc)
+ rm -f conftest-deps.mk
 }
 )# _AM_OUTPUT_DEPENDENCY_COMMANDS
 
@@ -1277,18 +1202,17 @@
 # -----------------------------
 # This macro should only be invoked once -- use via AC_REQUIRE.
 #
-# This code is only required when automatic dependency tracking
-# is enabled. FIXME. This creates each '.P' file that we will
-# need in order to bootstrap the dependency handling code.
+# This code is only required when automatic dependency tracking is enabled.
+# This creates each '.Po' and '.Plo' makefile fragment that we'll need in
+# order to bootstrap the dependency handling code.
 AC_DEFUN(AM_OUTPUT_DEPENDENCY_COMMANDS,
 AC_CONFIG_COMMANDS(depfiles,
 test x"$AMDEP_TRUE" != x"" || _AM_OUTPUT_DEPENDENCY_COMMANDS,
- AMDEP_TRUE="$AMDEP_TRUE" ac_aux_dir="$ac_aux_dir")
-)
+ AMDEP_TRUE="$AMDEP_TRUE" MAKE="${MAKE-make}"))
 
 # Do all the work for Automake. -*- Autoconf -*-
 
-# Copyright (C) 1996-2014 Free Software Foundation, Inc.
+# Copyright (C) 1996-2021 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -1316,6 +1240,10 @@
 # release and drop the old call support.
 AC_DEFUN(AM_INIT_AUTOMAKE,
 AC_PREREQ(2.65)dnl
+m4_ifdef(_$0_ALREADY_INIT,
+ m4_fatal($0 expanded multiple times
+m4_defn(_$0_ALREADY_INIT)),
+ m4_define(_$0_ALREADY_INIT, m4_expansion_stack))dnl
 dnl Autoconf wants to disallow AM_ names. We explicitly allow
 dnl the ones we care about.
 m4_pattern_allow(^AM_A-Z+FLAGS$)dnl
@@ -1352,7 +1280,7 @@
 _AM_SET_OPTIONS($1)dnl
 dnl Diagnose old-style AC_INIT with new-style AM_AUTOMAKE_INIT.
 m4_if(
- m4_ifdef(AC_PACKAGE_NAME, ok):m4_ifdef(AC_PACKAGE_VERSION, ok),
+ m4_ifset(AC_PACKAGE_NAME, ok):m4_ifset(AC_PACKAGE_VERSION, ok),
 ok:ok,,
 m4_fatal(AC_INIT should be called with package and version arguments))dnl
 AC_SUBST(PACKAGE, 'AC_PACKAGE_TARNAME')dnl
@@ -1375,8 +1303,8 @@
 AC_REQUIRE(AC_PROG_MKDIR_P)dnl
 # For better backward compatibility. To be removed once Automake 1.9.x
 # dies out for good. For more background, see:
-# <http://lists.gnu.org/archive/html/automake/2012-07/msg00001.html>
-# <http://lists.gnu.org/archive/html/automake/2012-07/msg00014.html>
+# <https://lists.gnu.org/archive/html/automake/2012-07/msg00001.html>
+# <https://lists.gnu.org/archive/html/automake/2012-07/msg00014.html>
 AC_SUBST(mkdir_p, '$(MKDIR_P)')
 # We need awk for the "check" target (and possibly the TAP driver). The
 # system "awk" is bad on some platforms.
@@ -1404,6 +1332,20 @@
 		 m4_define(AC_PROG_OBJCXX,
 			 m4_defn(AC_PROG_OBJCXX)_AM_DEPENDENCIES(OBJCXX)))dnl
 )
+# Variables for tags utilities; see am/tags.am
+if test -z "$CTAGS"; then
+ CTAGS=ctags
+fi
+AC_SUBST(CTAGS)
+if test -z "$ETAGS"; then
+ ETAGS=etags
+fi
+AC_SUBST(ETAGS)
+if test -z "$CSCOPE"; then
+ CSCOPE=cscope
+fi
+AC_SUBST(CSCOPE)
+
 AC_REQUIRE(AM_SILENT_RULES)dnl
 dnl The testsuite driver may need to know about EXEEXT, so add the
 dnl 'am__EXEEXT' conditional if _AM_COMPILER_EXEEXT was seen. This
@@ -1443,7 +1385,7 @@
 Aborting the configuration process, to ensure you take notice of the issue.
 
 You can download and install GNU coreutils to get an 'rm' implementation
-that behaves properly: <http://www.gnu.org/software/coreutils/>.
+that behaves properly: <https://www.gnu.org/software/coreutils/>.
 
 If you want to complete the configuration process using your problematic
 'rm' anyway, export the environment variable ACCEPT_INFERIOR_RM_PROGRAM
@@ -1485,7 +1427,7 @@
 done
 echo "timestamp for $_am_arg" >`AS_DIRNAME("$_am_arg")`/stamp-h$_am_stamp_count)
 
-# Copyright (C) 2001-2014 Free Software Foundation, Inc.
+# Copyright (C) 2001-2021 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -1506,7 +1448,7 @@
 fi
 AC_SUBST(install_sh))
 
-# Copyright (C) 2003-2014 Free Software Foundation, Inc.
+# Copyright (C) 2003-2021 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -1527,7 +1469,7 @@
 
 # Check to see how 'make' treats includes.	 -*- Autoconf -*-
 
-# Copyright (C) 2001-2014 Free Software Foundation, Inc.
+# Copyright (C) 2001-2021 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -1535,49 +1477,42 @@
 
 # AM_MAKE_INCLUDE()
 # -----------------
-# Check to see how make treats includes.
+# Check whether make has an 'include' directive that can support all
+# the idioms we need for our automatic dependency tracking code.
 AC_DEFUN(AM_MAKE_INCLUDE,
-am_make=${MAKE-make}
-cat > confinc << 'END'
+AC_MSG_CHECKING(whether ${MAKE-make} supports the include directive)
+cat > confinc.mk << 'END'
 am__doit:
-	@echo this is the am__doit target
+	@echo this is the am__doit target >confinc.out
 .PHONY: am__doit
 END
-# If we don't find an include directive, just comment out the code.
-AC_MSG_CHECKING(for style of include used by $am_make)
 am__include="#"
 am__quote=
-_am_result=none
-# First try GNU make style include.
-echo "include confinc" > confmf
-# Ignore all kinds of additional output from 'make'.
-case `$am_make -s -f confmf 2> /dev/null` in #(
-*the\ am__doit\ target*)
- am__include=include
- am__quote=
- _am_result=GNU
- ;;
-esac
-# Now try BSD make style include.
-if test "$am__include" = "#"; then
- echo '.include "confinc"' > confmf
- case `$am_make -s -f confmf 2> /dev/null` in #(
- *the\ am__doit\ target*)
- am__include=.include
- am__quote="\""
- _am_result=BSD
- ;;
- esac
-fi
-AC_SUBST(am__include)
-AC_SUBST(am__quote)
-AC_MSG_RESULT($_am_result)
-rm -f confinc confmf
-)
+# BSD make does it like this.
+echo '.include "confinc.mk" # ignored' > confmf.BSD
+# Other make implementations (GNU, Solaris 10, AIX) do it like this.
+echo 'include confinc.mk # ignored' > confmf.GNU
+_am_result=no
+for s in GNU BSD; do
+ AM_RUN_LOG(${MAKE-make} -f confmf.$s && cat confinc.out)
+ AS_CASE($?:`cat confinc.out 2>/dev/null`,
+ '0:this is the am__doit target',
+ AS_CASE($s,
+ BSD, am__include='.include' am__quote='"',
+ am__include='include' am__quote=''))
+ if test "$am__include" != "#"; then
+ _am_result="yes ($s style)"
+ break
+ fi
+done
+rm -f confinc.* confmf.*
+AC_MSG_RESULT(${_am_result})
+AC_SUBST(am__include))
+AC_SUBST(am__quote))
 
 # Fake the existence of programs that GNU maintainers use. -*- Autoconf -*-
 
-# Copyright (C) 1997-2014 Free Software Foundation, Inc.
+# Copyright (C) 1997-2021 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -1598,12 +1533,7 @@
 AC_REQUIRE(AM_AUX_DIR_EXPAND)dnl
 AC_REQUIRE_AUX_FILE(missing)dnl
 if test x"${MISSING+set}" != xset; then
- case $am_aux_dir in
- *\ * | *\	*)
- MISSING="\${SHELL} \"$am_aux_dir/missing\"" ;;
- *)
- MISSING="\${SHELL} $am_aux_dir/missing" ;;
- esac
+ MISSING="\${SHELL} '$am_aux_dir/missing'"
 fi
 # Use eval to expand $SHELL
 if eval "$MISSING --is-lightweight"; then
@@ -1616,7 +1546,7 @@
 
 # Helper functions for option handling. -*- Autoconf -*-
 
-# Copyright (C) 2001-2014 Free Software Foundation, Inc.
+# Copyright (C) 2001-2021 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -1645,7 +1575,7 @@
 AC_DEFUN(_AM_IF_OPTION,
 m4_ifset(_AM_MANGLE_OPTION($1), $2, $3))
 
-# Copyright (C) 1999-2014 Free Software Foundation, Inc.
+# Copyright (C) 1999-2021 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -1692,7 +1622,7 @@
 # For backward compatibility.
 AC_DEFUN_ONCE(AM_PROG_CC_C_O, AC_REQUIRE(AC_PROG_CC))
 
-# Copyright (C) 2001-2014 Free Software Foundation, Inc.
+# Copyright (C) 2001-2021 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -1711,7 +1641,7 @@
 
 # Check to make sure that the build environment is sane. -*- Autoconf -*-
 
-# Copyright (C) 1996-2014 Free Software Foundation, Inc.
+# Copyright (C) 1996-2021 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -1792,7 +1722,7 @@
 rm -f conftest.file
 )
 
-# Copyright (C) 2009-2014 Free Software Foundation, Inc.
+# Copyright (C) 2009-2021 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -1852,7 +1782,7 @@
 _AM_SUBST_NOTMAKE(AM_BACKSLASH)dnl
 )
 
-# Copyright (C) 2001-2014 Free Software Foundation, Inc.
+# Copyright (C) 2001-2021 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -1880,7 +1810,7 @@
 INSTALL_STRIP_PROGRAM="\$(install_sh) -c -s"
 AC_SUBST(INSTALL_STRIP_PROGRAM))
 
-# Copyright (C) 2006-2014 Free Software Foundation, Inc.
+# Copyright (C) 2006-2021 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -1899,7 +1829,7 @@
 
 # Check how to create a tarball. -*- Autoconf -*-
 
-# Copyright (C) 2004-2014 Free Software Foundation, Inc.
+# Copyright (C) 2004-2021 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,

_service:tar_scm:stunnel-5.48.tar.gz/auto/compile -> _service:tar_scm:stunnel-5.69.tar.gz/auto/compile Changed

@@ -1,9 +1,9 @@
 #! /bin/sh
 # Wrapper for compilers which do not understand '-c -o'.
 
-scriptversion=2012-10-14.11; # UTC
+scriptversion=2018-03-07.03; # UTC
 
-# Copyright (C) 1999-2014 Free Software Foundation, Inc.
+# Copyright (C) 1999-2021 Free Software Foundation, Inc.
 # Written by Tom Tromey <tromey@cygnus.com>.
 #
 # This program is free software; you can redistribute it and/or modify
@@ -17,7 +17,7 @@
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
-# along with this program. If not, see <http://www.gnu.org/licenses/>.
+# along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 # As a special exception to the GNU General Public License, if you
 # distribute this file as part of a program that contains a
@@ -53,7 +53,7 @@
 	 MINGW*)
 	 file_conv=mingw
 	 ;;
-	 CYGWIN*)
+	 CYGWIN* | MSYS*)
 	 file_conv=cygwin
 	 ;;
 	 *)
@@ -67,7 +67,7 @@
 	mingw/*)
 	 file=`cmd //C echo "$file " | sed -e 's/"$.*$ " *$/\1/'`
 	 ;;
-	cygwin/*)
+	cygwin/* | msys/*)
 	 file=`cygpath -m "$file" || echo "$file"`
 	 ;;
 	wine/*)
@@ -255,7 +255,8 @@
 echo "compile $scriptversion"
 exit $?
 ;;
- cl | */\\cl | cl.exe | */\\cl.exe )
+ cl | */\\cl | cl.exe | */\\cl.exe | \
+ icl | */\\icl | icl.exe | */\\icl.exe )
 func_cl_wrapper "$@" # Doesn't return...
 ;;
 esac
@@ -339,9 +340,9 @@
 # Local Variables:
 # mode: shell-script
 # sh-indentation: 2
-# eval: (add-hook 'write-file-hooks 'time-stamp)
+# eval: (add-hook 'before-save-hook 'time-stamp)
 # time-stamp-start: "scriptversion="
 # time-stamp-format: "%:y-%02m-%02d.%02H"
-# time-stamp-time-zone: "UTC"
+# time-stamp-time-zone: "UTC0"
 # time-stamp-end: "; # UTC"
 # End:

_service:tar_scm:stunnel-5.48.tar.gz/auto/config.guess -> _service:tar_scm:stunnel-5.69.tar.gz/auto/config.guess Changed

@@ -1,12 +1,14 @@
 #! /bin/sh
 # Attempt to guess a canonical system name.
-# Copyright 1992-2016 Free Software Foundation, Inc.
+# Copyright 1992-2022 Free Software Foundation, Inc.
 
-timestamp='2016-10-02'
+# shellcheck disable=SC2006,SC2268 # see below for rationale
+
+timestamp='2022-01-09'
 
 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 3 of the License, or
+# the Free Software Foundation, either version 3 of the License, or
 # (at your option) any later version.
 #
 # This program is distributed in the hope that it will be useful, but
@@ -15,7 +17,7 @@
 # General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
-# along with this program; if not, see <http://www.gnu.org/licenses/>.
+# along with this program; if not, see <https://www.gnu.org/licenses/>.
 #
 # As a special exception to the GNU General Public License, if you
 # distribute this file as part of a program that contains a
@@ -27,11 +29,19 @@
 # Originally written by Per Bothner; maintained since 2000 by Ben Elliston.
 #
 # You can get the latest version of this script from:
-# http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess
+# https://git.savannah.gnu.org/cgit/config.git/plain/config.guess
 #
 # Please send patches to <config-patches@gnu.org>.
 
 
+# The "shellcheck disable" line above the timestamp inhibits complaints
+# about features and limitations of the classic Bourne shell that were
+# superseded or lifted in POSIX. However, this script identifies a wide
+# variety of pre-POSIX systems that do not have POSIX shells at all, and
+# even some reasonably current systems (Solaris 10 as case-in-point) still
+# have a pre-POSIX /bin/sh.
+
+
 me=`echo "$0" | sed -e 's,.*/,,'`
 
 usage="\
@@ -39,7 +49,7 @@
 
 Output the configuration name of the system \`$me' is run on.
 
-Operation modes:
+Options:
 -h, --help print this help, then exit
 -t, --time-stamp print date of last modification, then exit
 -v, --version print version number, then exit
@@ -50,7 +60,7 @@
 GNU config.guess ($timestamp)
 
 Originally written by Per Bothner.
-Copyright 1992-2016 Free Software Foundation, Inc.
+Copyright 1992-2022 Free Software Foundation, Inc.
 
 This is free software; see the source for copying conditions. There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -84,7 +94,8 @@
 exit 1
 fi
 
-trap 'exit 1' 1 2 15
+# Just in case it came from the environment.
+GUESS=
 
 # CC_FOR_BUILD -- compiler used by this script. Note that the use of a
 # compiler to aid in system detection is discouraged as it requires
@@ -96,66 +107,90 @@
 
 # Portable tmp directory creation inspired by the Autoconf team.
 
-set_cc_for_build='
-trap "exitcode=\$?; (rm -f \$tmpfiles 2>/dev/null; rmdir \$tmp 2>/dev/null) && exit \$exitcode" 0 ;
-trap "rm -f \$tmpfiles 2>/dev/null; rmdir \$tmp 2>/dev/null; exit 1" 1 2 13 15 ;
-: ${TMPDIR=/tmp} ;
- { tmp=`(umask 077 && mktemp -d "$TMPDIR/cgXXXXXX") 2>/dev/null` && test -n "$tmp" && test -d "$tmp" ; } ||
- { test -n "$RANDOM" && tmp=$TMPDIR/cg$$-$RANDOM && (umask 077 && mkdir $tmp) ; } ||
- { tmp=$TMPDIR/cg-$$ && (umask 077 && mkdir $tmp) && echo "Warning: creating insecure temp directory" >&2 ; } ||
- { echo "$me: cannot create a temporary directory in $TMPDIR" >&2 ; exit 1 ; } ;
-dummy=$tmp/dummy ;
-tmpfiles="$dummy.c $dummy.o $dummy.rel $dummy" ;
-case $CC_FOR_BUILD,$HOST_CC,$CC in
- ,,) echo "int x;" > $dummy.c ;
-	for c in cc gcc c89 c99 ; do
-	 if ($c -c -o $dummy.o $dummy.c) >/dev/null 2>&1 ; then
-	 CC_FOR_BUILD="$c"; break ;
-	 fi ;
-	done ;
-	if test x"$CC_FOR_BUILD" = x ; then
-	 CC_FOR_BUILD=no_compiler_found ;
-	fi
-	;;
- ,,*) CC_FOR_BUILD=$CC ;;
- ,*,*) CC_FOR_BUILD=$HOST_CC ;;
-esac ; set_cc_for_build= ;'
+tmp=
+# shellcheck disable=SC2172
+trap 'test -z "$tmp" || rm -fr "$tmp"' 0 1 2 13 15
+
+set_cc_for_build() {
+ # prevent multiple calls if $tmp is already set
+ test "$tmp" && return 0
+ : "${TMPDIR=/tmp}"
+ # shellcheck disable=SC2039,SC3028
+ { tmp=`(umask 077 && mktemp -d "$TMPDIR/cgXXXXXX") 2>/dev/null` && test -n "$tmp" && test -d "$tmp" ; } ||
+	{ test -n "$RANDOM" && tmp=$TMPDIR/cg$$-$RANDOM && (umask 077 && mkdir "$tmp" 2>/dev/null) ; } ||
+	{ tmp=$TMPDIR/cg-$$ && (umask 077 && mkdir "$tmp" 2>/dev/null) && echo "Warning: creating insecure temp directory" >&2 ; } ||
+	{ echo "$me: cannot create a temporary directory in $TMPDIR" >&2 ; exit 1 ; }
+ dummy=$tmp/dummy
+ case ${CC_FOR_BUILD-},${HOST_CC-},${CC-} in
+	,,) echo "int x;" > "$dummy.c"
+	 for driver in cc gcc c89 c99 ; do
+		 if ($driver -c -o "$dummy.o" "$dummy.c") >/dev/null 2>&1 ; then
+		 CC_FOR_BUILD=$driver
+		 break
+		 fi
+	 done
+	 if test x"$CC_FOR_BUILD" = x ; then
+		 CC_FOR_BUILD=no_compiler_found
+	 fi
+	 ;;
+	,,*) CC_FOR_BUILD=$CC ;;
+	,*,*) CC_FOR_BUILD=$HOST_CC ;;
+ esac
+}
 
 # This is needed to find uname on a Pyramid OSx when run in the BSD universe.
 # (ghazi@noc.rutgers.edu 1994-08-24)
-if (test -f /.attbin/uname) >/dev/null 2>&1 ; then
+if test -f /.attbin/uname ; then
 	PATH=$PATH:/.attbin ; export PATH
 fi
 
 UNAME_MACHINE=`(uname -m) 2>/dev/null` || UNAME_MACHINE=unknown
 UNAME_RELEASE=`(uname -r) 2>/dev/null` || UNAME_RELEASE=unknown
-UNAME_SYSTEM=`(uname -s) 2>/dev/null` || UNAME_SYSTEM=unknown
+UNAME_SYSTEM=`(uname -s) 2>/dev/null` || UNAME_SYSTEM=unknown
 UNAME_VERSION=`(uname -v) 2>/dev/null` || UNAME_VERSION=unknown
 
-case "${UNAME_SYSTEM}" in
+case $UNAME_SYSTEM in
 Linux|GNU|GNU/*)
-	# If the system lacks a compiler, then just pick glibc.
-	# We could probably try harder.
-	LIBC=gnu
+	LIBC=unknown
 
-	eval $set_cc_for_build
-	cat <<-EOF > $dummy.c
+	set_cc_for_build
+	cat <<-EOF > "$dummy.c"
 	#include <features.h>
 	#if defined(__UCLIBC__)
 	LIBC=uclibc
 	#elif defined(__dietlibc__)
 	LIBC=dietlibc
-	#else
+	#elif defined(__GLIBC__)
 	LIBC=gnu
+	#else
+	#include <stdarg.h>
+	/* First heuristic to detect musl libc. */
+	#ifdef __DEFINED_va_list
+	LIBC=musl
+	#endif
 	#endif
 	EOF
-	eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^LIBC' | sed 's, ,,g'`
+	cc_set_libc=`$CC_FOR_BUILD -E "$dummy.c" 2>/dev/null | grep '^LIBC' | sed 's, ,,g'`
+	eval "$cc_set_libc"
+
+	# Second heuristic to detect musl libc.
+	if "$LIBC" = unknown &&
+	 command -v ldd >/dev/null &&
+	 ldd --version 2>&1 | grep -q ^musl; then
+		LIBC=musl
+	fi
+
+	# If the system lacks a compiler, then just pick glibc.
+	# We could probably try harder.
+	if "$LIBC" = unknown ; then
+		LIBC=gnu
+	fi
 	;;
 esac
 
 # Note: order is significant - the case branches are not exclusive.
 
-case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
+case $UNAME_MACHINE:$UNAME_SYSTEM:$UNAME_RELEASE:$UNAME_VERSION in
 *:NetBSD:*:*)
 	# NetBSD (nbsd) targets should (where applicable) match one or
 	# more of the tuples: *-*-netbsdelf*, *-*-netbsdaout*,
@@ -167,32 +202,32 @@
 	#
 	# Note: NetBSD doesn't particularly care about the vendor
 	# portion of the name. We always set it to "unknown".
-	sysctl="sysctl -n hw.machine_arch"
 	UNAME_MACHINE_ARCH=`(uname -p 2>/dev/null || \
-	 /sbin/$sysctl 2>/dev/null || \
-	 /usr/sbin/$sysctl 2>/dev/null || \
+	 /sbin/sysctl -n hw.machine_arch 2>/dev/null || \
+	 /usr/sbin/sysctl -n hw.machine_arch 2>/dev/null || \
 	 echo unknown)`
-	case "${UNAME_MACHINE_ARCH}" in
+	case $UNAME_MACHINE_ARCH in
+	 aarch64eb) machine=aarch64_be-unknown ;;
 	 armeb) machine=armeb-unknown ;;
 	 arm*) machine=arm-unknown ;;
 	 sh3el) machine=shl-unknown ;;
 	 sh3eb) machine=sh-unknown ;;
 	 sh5el) machine=sh5le-unknown ;;
 	 earmv*)
-		arch=`echo ${UNAME_MACHINE_ARCH} | sed -e 's,^e$armv0-9$.*$,\1,'`
-		endian=`echo ${UNAME_MACHINE_ARCH} | sed -ne 's,^.*$eb$$,\1,p'`
+		arch=`echo "$UNAME_MACHINE_ARCH" | sed -e 's,^e$armv0-9$.*$,\1,'`
+		endian=`echo "$UNAME_MACHINE_ARCH" | sed -ne 's,^.*$eb$$,\1,p'`
 		machine=${arch}${endian}-unknown
 		;;
-	 *) machine=${UNAME_MACHINE_ARCH}-unknown ;;
+	 *) machine=$UNAME_MACHINE_ARCH-unknown ;;
 	esac
 	# The Operating System including object format, if it has switched
 	# to ELF recently (or will in the future) and ABI.
-	case "${UNAME_MACHINE_ARCH}" in
+	case $UNAME_MACHINE_ARCH in
 	 earm*)
 		os=netbsdelf
 		;;
 	 arm*|i386|m68k|ns32k|sh3*|sparc|vax)
-		eval $set_cc_for_build
+		set_cc_for_build
 		if echo __ELF__ | $CC_FOR_BUILD -E - 2>/dev/null \
 			| grep -q __ELF__
 		then
@@ -208,10 +243,10 @@
 		;;
 	esac
 	# Determine ABI tags.
-	case "${UNAME_MACHINE_ARCH}" in
+	case $UNAME_MACHINE_ARCH in
 	 earm*)
 		expr='s/^earmv0-9/-eabi/;s/eb$//'
-		abi=`echo ${UNAME_MACHINE_ARCH} | sed -e "$expr"`
+		abi=`echo "$UNAME_MACHINE_ARCH" | sed -e "$expr"`
 		;;
 	esac
 	# The OS release
@@ -219,47 +254,68 @@
 	# thus, need a distinct triplet. However, they do not need
 	# kernel version information, so it can be replaced with a
 	# suitable tag, in the style of linux-gnu.
-	case "${UNAME_VERSION}" in
+	case $UNAME_VERSION in
 	 Debian*)
 		release='-gnu'
 		;;
 	 *)
-		release=`echo ${UNAME_RELEASE} | sed -e 's/-_.*//' | cut -d. -f1,2`
+		release=`echo "$UNAME_RELEASE" | sed -e 's/-_.*//' | cut -d. -f1,2`
 		;;
 	esac
 	# Since CPU_TYPE-MANUFACTURER-KERNEL-OPERATING_SYSTEM:
 	# contains redundant information, the shorter form:
 	# CPU_TYPE-MANUFACTURER-OPERATING_SYSTEM is used.
-	echo "${machine}-${os}${release}${abi}"
-	exit ;;
+	GUESS=$machine-${os}${release}${abi-}
+	;;
 *:Bitrig:*:*)
 	UNAME_MACHINE_ARCH=`arch | sed 's/Bitrig.//'`
-	echo ${UNAME_MACHINE_ARCH}-unknown-bitrig${UNAME_RELEASE}
-	exit ;;
+	GUESS=$UNAME_MACHINE_ARCH-unknown-bitrig$UNAME_RELEASE
+	;;
 *:OpenBSD:*:*)
 	UNAME_MACHINE_ARCH=`arch | sed 's/OpenBSD.//'`
-	echo ${UNAME_MACHINE_ARCH}-unknown-openbsd${UNAME_RELEASE}
-	exit ;;
+	GUESS=$UNAME_MACHINE_ARCH-unknown-openbsd$UNAME_RELEASE
+	;;
+ *:SecBSD:*:*)
+	UNAME_MACHINE_ARCH=`arch | sed 's/SecBSD.//'`
+	GUESS=$UNAME_MACHINE_ARCH-unknown-secbsd$UNAME_RELEASE
+	;;
 *:LibertyBSD:*:*)
 	UNAME_MACHINE_ARCH=`arch | sed 's/^.*BSD\.//'`
-	echo ${UNAME_MACHINE_ARCH}-unknown-libertybsd${UNAME_RELEASE}
-	exit ;;
+	GUESS=$UNAME_MACHINE_ARCH-unknown-libertybsd$UNAME_RELEASE
+	;;
+ *:MidnightBSD:*:*)
+	GUESS=$UNAME_MACHINE-unknown-midnightbsd$UNAME_RELEASE
+	;;
 *:ekkoBSD:*:*)
-	echo ${UNAME_MACHINE}-unknown-ekkobsd${UNAME_RELEASE}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-ekkobsd$UNAME_RELEASE
+	;;
 *:SolidBSD:*:*)
-	echo ${UNAME_MACHINE}-unknown-solidbsd${UNAME_RELEASE}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-solidbsd$UNAME_RELEASE
+	;;
+ *:OS108:*:*)
+	GUESS=$UNAME_MACHINE-unknown-os108_$UNAME_RELEASE
+	;;
 macppc:MirBSD:*:*)
-	echo powerpc-unknown-mirbsd${UNAME_RELEASE}
-	exit ;;
+	GUESS=powerpc-unknown-mirbsd$UNAME_RELEASE
+	;;
 *:MirBSD:*:*)
-	echo ${UNAME_MACHINE}-unknown-mirbsd${UNAME_RELEASE}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-mirbsd$UNAME_RELEASE
+	;;
 *:Sortix:*:*)
-	echo ${UNAME_MACHINE}-unknown-sortix
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-sortix
+	;;
+ *:Twizzler:*:*)
+	GUESS=$UNAME_MACHINE-unknown-twizzler
+	;;
+ *:Redox:*:*)
+	GUESS=$UNAME_MACHINE-unknown-redox
+	;;
+ mips:OSF1:*.*)
+	GUESS=mips-dec-osf1
+	;;
 alpha:OSF1:*:*)
+	# Reset EXIT trap before exiting to avoid spurious non-zero exit code.
+	trap '' 0
 	case $UNAME_RELEASE in
 	*4.0)
 		UNAME_RELEASE=`/usr/sbin/sizer -v | awk '{print $3}'`
@@ -273,7 +329,7 @@
 	# covers most systems running today. This code pipes the CPU
 	# types through head -n 1, so we only detect the type of CPU 0.
 	ALPHA_CPU_TYPE=`/usr/sbin/psrinfo -v | sed -n -e 's/^ The alpha $.*$ processor.*$/\1/p' | head -n 1`
-	case "$ALPHA_CPU_TYPE" in
+	case $ALPHA_CPU_TYPE in
 	 "EV4 (21064)")
 		UNAME_MACHINE=alpha ;;
 	 "EV4.5 (21064)")
@@ -310,126 +366,121 @@
 	# A Tn.n version is a released field test version.
 	# A Xn.n version is an unreleased experimental baselevel.
 	# 1.2 uses "1.2" for uname -r.
-	echo ${UNAME_MACHINE}-dec-osf`echo ${UNAME_RELEASE} | sed -e 's/^PVTX//' | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz`
-	# Reset EXIT trap before exiting to avoid spurious non-zero exit code.
-	exitcode=$?
-	trap '' 0
-	exit $exitcode ;;
- Alpha\ *:Windows_NT*:*)
-	# How do we know it's Interix rather than the generic POSIX subsystem?
-	# Should we change UNAME_MACHINE based on the output of uname instead
-	# of the specific Alpha model?
-	echo alpha-pc-interix
-	exit ;;
- 21064:Windows_NT:50:3)
-	echo alpha-dec-winnt3.5
-	exit ;;
+	OSF_REL=`echo "$UNAME_RELEASE" | sed -e 's/^PVTX//' | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz`
+	GUESS=$UNAME_MACHINE-dec-osf$OSF_REL
+	;;
 Amiga*:UNIX_System_V:4.0:*)
-	echo m68k-unknown-sysv4
-	exit ;;
+	GUESS=m68k-unknown-sysv4
+	;;
 *:AamigaOoSs:*:*)
-	echo ${UNAME_MACHINE}-unknown-amigaos
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-amigaos
+	;;
 *:MmorphOoSs:*:*)
-	echo ${UNAME_MACHINE}-unknown-morphos
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-morphos
+	;;
 *:OS/390:*:*)
-	echo i370-ibm-openedition
-	exit ;;
+	GUESS=i370-ibm-openedition
+	;;
 *:z/VM:*:*)
-	echo s390-ibm-zvmoe
-	exit ;;
+	GUESS=s390-ibm-zvmoe
+	;;
 *:OS400:*:*)
-	echo powerpc-ibm-os400
-	exit ;;
+	GUESS=powerpc-ibm-os400
+	;;
 arm:RISC*:1.012*:*|arm:riscix:1.012*:*)
-	echo arm-acorn-riscix${UNAME_RELEASE}
-	exit ;;
+	GUESS=arm-acorn-riscix$UNAME_RELEASE
+	;;
 arm*:riscos:*:*|arm*:RISCOS:*:*)
-	echo arm-unknown-riscos
-	exit ;;
+	GUESS=arm-unknown-riscos
+	;;
 SR2?01:HI-UX/MPP:*:* | SR8000:HI-UX/MPP:*:*)
-	echo hppa1.1-hitachi-hiuxmpp
-	exit ;;
+	GUESS=hppa1.1-hitachi-hiuxmpp
+	;;
 Pyramid*:OSx*:*:* | MIS*:OSx*:*:* | MIS*:SMP_DC-OSx*:*:*)
 	# akee@wpdis03.wpafb.af.mil (Earle F. Ake) contributed MIS and NILE.
-	if test "`(/bin/universe) 2>/dev/null`" = att ; then
-		echo pyramid-pyramid-sysv3
-	else
-		echo pyramid-pyramid-bsd
-	fi
-	exit ;;
+	case `(/bin/universe) 2>/dev/null` in
+	 att) GUESS=pyramid-pyramid-sysv3 ;;
+	 *) GUESS=pyramid-pyramid-bsd ;;
+	esac
+	;;
 NILE*:*:*:dcosx)
-	echo pyramid-pyramid-svr4
-	exit ;;
+	GUESS=pyramid-pyramid-svr4
+	;;
 DRS?6000:unix:4.0:6*)
-	echo sparc-icl-nx6
-	exit ;;
+	GUESS=sparc-icl-nx6
+	;;
 DRS?6000:UNIX_SV:4.2*:7* | DRS?6000:isis:4.2*:7*)
 	case `/usr/bin/uname -p` in
-	 sparc) echo sparc-icl-nx7; exit ;;
-	esac ;;
+	 sparc) GUESS=sparc-icl-nx7 ;;
+	esac
+	;;
 s390x:SunOS:*:*)
-	echo ${UNAME_MACHINE}-ibm-solaris2`echo ${UNAME_RELEASE}|sed -e 's/^.*//'`
-	exit ;;
+	SUN_REL=`echo "$UNAME_RELEASE" | sed -e 's/^.*//'`
+	GUESS=$UNAME_MACHINE-ibm-solaris2$SUN_REL
+	;;
 sun4H:SunOS:5.*:*)
-	echo sparc-hal-solaris2`echo ${UNAME_RELEASE}|sed -e 's/^.*//'`
-	exit ;;
+	SUN_REL=`echo "$UNAME_RELEASE" | sed -e 's/^.*//'`
+	GUESS=sparc-hal-solaris2$SUN_REL
+	;;
 sun4*:SunOS:5.*:* | tadpole*:SunOS:5.*:*)
-	echo sparc-sun-solaris2`echo ${UNAME_RELEASE}|sed -e 's/^.*//'`
-	exit ;;
+	SUN_REL=`echo "$UNAME_RELEASE" | sed -e 's/^.*//'`
+	GUESS=sparc-sun-solaris2$SUN_REL
+	;;
 i86pc:AuroraUX:5.*:* | i86xen:AuroraUX:5.*:*)
-	echo i386-pc-auroraux${UNAME_RELEASE}
-	exit ;;
+	GUESS=i386-pc-auroraux$UNAME_RELEASE
+	;;
 i86pc:SunOS:5.*:* | i86xen:SunOS:5.*:*)
-	eval $set_cc_for_build
+	set_cc_for_build
 	SUN_ARCH=i386
 	# If there is a compiler, see if it is configured for 64-bit objects.
 	# Note that the Sun cc does not turn __LP64__ into 1 like gcc does.
 	# This test works for both compilers.
-	if "$CC_FOR_BUILD" != no_compiler_found ; then
+	if test "$CC_FOR_BUILD" != no_compiler_found; then
 	 if (echo '#ifdef __amd64'; echo IS_64BIT_ARCH; echo '#endif') | \
-		(CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) | \
+		(CCOPTS="" $CC_FOR_BUILD -m64 -E - 2>/dev/null) | \
 		grep IS_64BIT_ARCH >/dev/null
 	 then
 		SUN_ARCH=x86_64
 	 fi
 	fi
-	echo ${SUN_ARCH}-pc-solaris2`echo ${UNAME_RELEASE}|sed -e 's/^.*//'`
-	exit ;;
+	SUN_REL=`echo "$UNAME_RELEASE" | sed -e 's/^.*//'`
+	GUESS=$SUN_ARCH-pc-solaris2$SUN_REL
+	;;
 sun4*:SunOS:6*:*)
 	# According to config.sub, this is the proper way to canonicalize
 	# SunOS6. Hard to guess exactly what SunOS6 will be like, but
 	# it's likely to be more like Solaris than SunOS4.
-	echo sparc-sun-solaris3`echo ${UNAME_RELEASE}|sed -e 's/^.*//'`
-	exit ;;
+	SUN_REL=`echo "$UNAME_RELEASE" | sed -e 's/^.*//'`
+	GUESS=sparc-sun-solaris3$SUN_REL
+	;;
 sun4*:SunOS:*:*)
-	case "`/usr/bin/arch -k`" in
+	case `/usr/bin/arch -k` in
 	 Series*|S4*)
 		UNAME_RELEASE=`uname -v`
 		;;
 	esac
 	# Japanese Language versions have a version number like `4.1.3-JL'.
-	echo sparc-sun-sunos`echo ${UNAME_RELEASE}|sed -e 's/-/_/'`
-	exit ;;
+	SUN_REL=`echo "$UNAME_RELEASE" | sed -e 's/-/_/'`
+	GUESS=sparc-sun-sunos$SUN_REL
+	;;
 sun3*:SunOS:*:*)
-	echo m68k-sun-sunos${UNAME_RELEASE}
-	exit ;;
+	GUESS=m68k-sun-sunos$UNAME_RELEASE
+	;;
 sun*:*:4.2BSD:*)
 	UNAME_RELEASE=`(sed 1q /etc/motd | awk '{print substr($5,1,3)}') 2>/dev/null`
-	test "x${UNAME_RELEASE}" = x && UNAME_RELEASE=3
-	case "`/bin/arch`" in
+	test "x$UNAME_RELEASE" = x && UNAME_RELEASE=3
+	case `/bin/arch` in
 	 sun3)
-		echo m68k-sun-sunos${UNAME_RELEASE}
+		GUESS=m68k-sun-sunos$UNAME_RELEASE
 		;;
 	 sun4)
-		echo sparc-sun-sunos${UNAME_RELEASE}
+		GUESS=sparc-sun-sunos$UNAME_RELEASE
 		;;
 	esac
-	exit ;;
+	;;
 aushp:SunOS:*:*)
-	echo sparc-auspex-sunos${UNAME_RELEASE}
-	exit ;;
+	GUESS=sparc-auspex-sunos$UNAME_RELEASE
+	;;
 # The situation for MiNT is a little confusing. The machine name
 # can be virtually everything (everything which is not
 # "atarist" or "atariste" at least should have a processor
@@ -439,44 +490,44 @@
 # MiNT. But MiNT is downward compatible to TOS, so this should
 # be no problem.
 atariste:*MiNT:*:* | atariste:*mint:*:* | atariste:*TOS:*:*)
-	echo m68k-atari-mint${UNAME_RELEASE}
-	exit ;;
+	GUESS=m68k-atari-mint$UNAME_RELEASE
+	;;
 atari*:*MiNT:*:* | atari*:*mint:*:* | atariste:*TOS:*:*)
-	echo m68k-atari-mint${UNAME_RELEASE}
-	exit ;;
+	GUESS=m68k-atari-mint$UNAME_RELEASE
+	;;
 *falcon*:*MiNT:*:* | *falcon*:*mint:*:* | *falcon*:*TOS:*:*)
-	echo m68k-atari-mint${UNAME_RELEASE}
-	exit ;;
+	GUESS=m68k-atari-mint$UNAME_RELEASE
+	;;
 milan*:*MiNT:*:* | milan*:*mint:*:* | *milan*:*TOS:*:*)
-	echo m68k-milan-mint${UNAME_RELEASE}
-	exit ;;
+	GUESS=m68k-milan-mint$UNAME_RELEASE
+	;;
 hades*:*MiNT:*:* | hades*:*mint:*:* | *hades*:*TOS:*:*)
-	echo m68k-hades-mint${UNAME_RELEASE}
-	exit ;;
+	GUESS=m68k-hades-mint$UNAME_RELEASE
+	;;
 *:*MiNT:*:* | *:*mint:*:* | *:*TOS:*:*)
-	echo m68k-unknown-mint${UNAME_RELEASE}
-	exit ;;
+	GUESS=m68k-unknown-mint$UNAME_RELEASE
+	;;
 m68k:machten:*:*)
-	echo m68k-apple-machten${UNAME_RELEASE}
-	exit ;;
+	GUESS=m68k-apple-machten$UNAME_RELEASE
+	;;
 powerpc:machten:*:*)
-	echo powerpc-apple-machten${UNAME_RELEASE}
-	exit ;;
+	GUESS=powerpc-apple-machten$UNAME_RELEASE
+	;;
 RISC*:Mach:*:*)
-	echo mips-dec-mach_bsd4.3
-	exit ;;
+	GUESS=mips-dec-mach_bsd4.3
+	;;
 RISC*:ULTRIX:*:*)
-	echo mips-dec-ultrix${UNAME_RELEASE}
-	exit ;;
+	GUESS=mips-dec-ultrix$UNAME_RELEASE
+	;;
 VAX*:ULTRIX*:*:*)
-	echo vax-dec-ultrix${UNAME_RELEASE}
-	exit ;;
+	GUESS=vax-dec-ultrix$UNAME_RELEASE
+	;;
 2020:CLIX:*:* | 2430:CLIX:*:*)
-	echo clipper-intergraph-clix${UNAME_RELEASE}
-	exit ;;
+	GUESS=clipper-intergraph-clix$UNAME_RELEASE
+	;;
 mips:*:*:UMIPS | mips:*:*:RISCos)
-	eval $set_cc_for_build
-	sed 's/^	//' << EOF >$dummy.c
+	set_cc_for_build
+	sed 's/^	//' << EOF > "$dummy.c"
 #ifdef __cplusplus
 #include <stdio.h> /* for printf() prototype */
 	int main (int argc, char *argv) {
@@ -485,95 +536,96 @@
 #endif
 	#if defined (host_mips) && defined (MIPSEB)
 	#if defined (SYSTYPE_SYSV)
-	 printf ("mips-mips-riscos%ssysv\n", argv1); exit (0);
+	 printf ("mips-mips-riscos%ssysv\\n", argv1); exit (0);
 	#endif
 	#if defined (SYSTYPE_SVR4)
-	 printf ("mips-mips-riscos%ssvr4\n", argv1); exit (0);
+	 printf ("mips-mips-riscos%ssvr4\\n", argv1); exit (0);
 	#endif
 	#if defined (SYSTYPE_BSD43) || defined(SYSTYPE_BSD)
-	 printf ("mips-mips-riscos%sbsd\n", argv1); exit (0);
+	 printf ("mips-mips-riscos%sbsd\\n", argv1); exit (0);
 	#endif
 	#endif
 	 exit (-1);
 	}
 EOF
-	$CC_FOR_BUILD -o $dummy $dummy.c &&
-	 dummyarg=`echo "${UNAME_RELEASE}" | sed -n 's/$0-9*$.*/\1/p'` &&
-	 SYSTEM_NAME=`$dummy $dummyarg` &&
+	$CC_FOR_BUILD -o "$dummy" "$dummy.c" &&
+	 dummyarg=`echo "$UNAME_RELEASE" | sed -n 's/$0-9*$.*/\1/p'` &&
+	 SYSTEM_NAME=`"$dummy" "$dummyarg"` &&
 	 { echo "$SYSTEM_NAME"; exit; }
-	echo mips-mips-riscos${UNAME_RELEASE}
-	exit ;;
+	GUESS=mips-mips-riscos$UNAME_RELEASE
+	;;
 Motorola:PowerMAX_OS:*:*)
-	echo powerpc-motorola-powermax
-	exit ;;
+	GUESS=powerpc-motorola-powermax
+	;;
 Motorola:*:4.3:PL8-*)
-	echo powerpc-harris-powermax
-	exit ;;
+	GUESS=powerpc-harris-powermax
+	;;
 Night_Hawk:*:*:PowerMAX_OS | Synergy:PowerMAX_OS:*:*)
-	echo powerpc-harris-powermax
-	exit ;;
+	GUESS=powerpc-harris-powermax
+	;;
 Night_Hawk:Power_UNIX:*:*)
-	echo powerpc-harris-powerunix
-	exit ;;
+	GUESS=powerpc-harris-powerunix
+	;;
 m88k:CX/UX:7*:*)
-	echo m88k-harris-cxux7
-	exit ;;
+	GUESS=m88k-harris-cxux7
+	;;
 m88k:*:4*:R4*)
-	echo m88k-motorola-sysv4
-	exit ;;
+	GUESS=m88k-motorola-sysv4
+	;;
 m88k:*:3*:R3*)
-	echo m88k-motorola-sysv3
-	exit ;;
+	GUESS=m88k-motorola-sysv3
+	;;
 AViiON:dgux:*:*)
 	# DG/UX returns AViiON for all architectures
 	UNAME_PROCESSOR=`/usr/bin/uname -p`
-	if $UNAME_PROCESSOR = mc88100 || $UNAME_PROCESSOR = mc88110 
+	if test "$UNAME_PROCESSOR" = mc88100 || test "$UNAME_PROCESSOR" = mc88110
 	then
-	 if ${TARGET_BINARY_INTERFACE}x = m88kdguxelfx || \
-	 ${TARGET_BINARY_INTERFACE}x = x 
+	 if test "$TARGET_BINARY_INTERFACE"x = m88kdguxelfx || \
+	 test "$TARGET_BINARY_INTERFACE"x = x
 	 then
-		echo m88k-dg-dgux${UNAME_RELEASE}
+		GUESS=m88k-dg-dgux$UNAME_RELEASE
 	 else
-		echo m88k-dg-dguxbcs${UNAME_RELEASE}
+		GUESS=m88k-dg-dguxbcs$UNAME_RELEASE
 	 fi
 	else
-	 echo i586-dg-dgux${UNAME_RELEASE}
+	 GUESS=i586-dg-dgux$UNAME_RELEASE
 	fi
-	exit ;;
+	;;
 M88*:DolphinOS:*:*)	# DolphinOS (SVR3)
-	echo m88k-dolphin-sysv3
-	exit ;;
+	GUESS=m88k-dolphin-sysv3
+	;;
 M88*:*:R3*:*)
 	# Delta 88k system running SVR3
-	echo m88k-motorola-sysv3
-	exit ;;
+	GUESS=m88k-motorola-sysv3
+	;;
 XD88*:*:*:*) # Tektronix XD88 system running UTekV (SVR3)
-	echo m88k-tektronix-sysv3
-	exit ;;
+	GUESS=m88k-tektronix-sysv3
+	;;
 Tek430-90-9:UTek:*:*) # Tektronix 4300 system running UTek (BSD)
-	echo m68k-tektronix-bsd
-	exit ;;
+	GUESS=m68k-tektronix-bsd
+	;;
 *:IRIX*:*:*)
-	echo mips-sgi-irix`echo ${UNAME_RELEASE}|sed -e 's/-/_/g'`
-	exit ;;
+	IRIX_REL=`echo "$UNAME_RELEASE" | sed -e 's/-/_/g'`
+	GUESS=mips-sgi-irix$IRIX_REL
+	;;
 ????????:AIX?:12.1:2) # AIX 2.2.1 or AIX 2.1.1 is RT/PC AIX.
-	echo romp-ibm-aix # uname -m gives an 8 hex-code CPU id
-	exit ;; # Note that: echo "'`uname -s`'" gives 'AIX '
+	GUESS=romp-ibm-aix # uname -m gives an 8 hex-code CPU id
+	;; # Note that: echo "'`uname -s`'" gives 'AIX '
 i*86:AIX:*:*)
-	echo i386-ibm-aix
-	exit ;;
+	GUESS=i386-ibm-aix
+	;;
 ia64:AIX:*:*)
-	if -x /usr/bin/oslevel ; then
+	if test -x /usr/bin/oslevel ; then
 		IBM_REV=`/usr/bin/oslevel`
 	else
-		IBM_REV=${UNAME_VERSION}.${UNAME_RELEASE}
+		IBM_REV=$UNAME_VERSION.$UNAME_RELEASE
 	fi
-	echo ${UNAME_MACHINE}-ibm-aix${IBM_REV}
-	exit ;;
+	GUESS=$UNAME_MACHINE-ibm-aix$IBM_REV
+	;;
 *:AIX:2:3)
 	if grep bos325 /usr/include/stdio.h >/dev/null 2>&1; then
-		eval $set_cc_for_build
-		sed 's/^		//' << EOF >$dummy.c
+		set_cc_for_build
+		sed 's/^		//' << EOF > "$dummy.c"
 		#include <sys/systemcfg.h>
 
 		main()
@@ -584,77 +636,77 @@
 			exit(0);
 			}
 EOF
-		if $CC_FOR_BUILD -o $dummy $dummy.c && SYSTEM_NAME=`$dummy`
+		if $CC_FOR_BUILD -o "$dummy" "$dummy.c" && SYSTEM_NAME=`"$dummy"`
 		then
-			echo "$SYSTEM_NAME"
+			GUESS=$SYSTEM_NAME
 		else
-			echo rs6000-ibm-aix3.2.5
+			GUESS=rs6000-ibm-aix3.2.5
 		fi
 	elif grep bos324 /usr/include/stdio.h >/dev/null 2>&1; then
-		echo rs6000-ibm-aix3.2.4
+		GUESS=rs6000-ibm-aix3.2.4
 	else
-		echo rs6000-ibm-aix3.2
+		GUESS=rs6000-ibm-aix3.2
 	fi
-	exit ;;
+	;;
 *:AIX:*:4567)
 	IBM_CPU_ID=`/usr/sbin/lsdev -C -c processor -S available | sed 1q | awk '{ print $1 }'`
-	if /usr/sbin/lsattr -El ${IBM_CPU_ID} | grep ' POWER' >/dev/null 2>&1; then
+	if /usr/sbin/lsattr -El "$IBM_CPU_ID" | grep ' POWER' >/dev/null 2>&1; then
 		IBM_ARCH=rs6000
 	else
 		IBM_ARCH=powerpc
 	fi
-	if -x /usr/bin/lslpp ; then
-		IBM_REV=`/usr/bin/lslpp -Lqc bos.rte.libc |
+	if test -x /usr/bin/lslpp ; then
+		IBM_REV=`/usr/bin/lslpp -Lqc bos.rte.libc | \
 			 awk -F: '{ print $3 }' | sed s/0-9*$/0/`
 	else
-		IBM_REV=${UNAME_VERSION}.${UNAME_RELEASE}
+		IBM_REV=$UNAME_VERSION.$UNAME_RELEASE
 	fi
-	echo ${IBM_ARCH}-ibm-aix${IBM_REV}
-	exit ;;
+	GUESS=$IBM_ARCH-ibm-aix$IBM_REV
+	;;
 *:AIX:*:*)
-	echo rs6000-ibm-aix
-	exit ;;
- ibmrt:4.4BSD:*|romp-ibm:BSD:*)
-	echo romp-ibm-bsd4.4
-	exit ;;
+	GUESS=rs6000-ibm-aix
+	;;
+ ibmrt:4.4BSD:*|romp-ibm:4.4BSD:*)
+	GUESS=romp-ibm-bsd4.4
+	;;
 ibmrt:*BSD:*|romp-ibm:BSD:*) # covers RT/PC BSD and
-	echo romp-ibm-bsd${UNAME_RELEASE} # 4.3 with uname added to
-	exit ;; # report: romp-ibm BSD 4.3
+	GUESS=romp-ibm-bsd$UNAME_RELEASE # 4.3 with uname added to
+	;; # report: romp-ibm BSD 4.3
 *:BOSX:*:*)
-	echo rs6000-bull-bosx
-	exit ;;
+	GUESS=rs6000-bull-bosx
+	;;
 DPX/2?00:B.O.S.:*:*)
-	echo m68k-bull-sysv3
-	exit ;;
+	GUESS=m68k-bull-sysv3
+	;;
 9000/34??:4.3bsd:1.*:*)
-	echo m68k-hp-bsd
-	exit ;;
+	GUESS=m68k-hp-bsd
+	;;
 hp300:4.4BSD:*:* | 9000/34??:4.3bsd:2.*:*)
-	echo m68k-hp-bsd4.4
-	exit ;;
+	GUESS=m68k-hp-bsd4.4
+	;;
 9000/34678??:HP-UX:*:*)
-	HPUX_REV=`echo ${UNAME_RELEASE}|sed -e 's/^.*.0B*//'`
-	case "${UNAME_MACHINE}" in
-	 9000/31? ) HP_ARCH=m68000 ;;
-	 9000/34?? ) HP_ARCH=m68k ;;
+	HPUX_REV=`echo "$UNAME_RELEASE" | sed -e 's/^.*.0B*//'`
+	case $UNAME_MACHINE in
+	 9000/31?) HP_ARCH=m68000 ;;
+	 9000/34??) HP_ARCH=m68k ;;
 	 9000/6780-90-9)
-		if -x /usr/bin/getconf ; then
+		if test -x /usr/bin/getconf; then
 		 sc_cpu_version=`/usr/bin/getconf SC_CPU_VERSION 2>/dev/null`
 		 sc_kernel_bits=`/usr/bin/getconf SC_KERNEL_BITS 2>/dev/null`
-		 case "${sc_cpu_version}" in
+		 case $sc_cpu_version in
 		 523) HP_ARCH=hppa1.0 ;; # CPU_PA_RISC1_0
 		 528) HP_ARCH=hppa1.1 ;; # CPU_PA_RISC1_1
 		 532) # CPU_PA_RISC2_0
-			case "${sc_kernel_bits}" in
+			case $sc_kernel_bits in
 			 32) HP_ARCH=hppa2.0n ;;
 			 64) HP_ARCH=hppa2.0w ;;
 			 '') HP_ARCH=hppa2.0 ;; # HP-UX 10.20
 			esac ;;
 		 esac
 		fi
-		if "${HP_ARCH}" = "" ; then
-		 eval $set_cc_for_build
-		 sed 's/^		//' << EOF >$dummy.c
+		if test "$HP_ARCH" = ""; then
+		 set_cc_for_build
+		 sed 's/^		//' << EOF > "$dummy.c"
 
 		#define _HPUX_SOURCE
 		#include <stdlib.h>
@@ -687,13 +739,13 @@
 		 exit (0);
 		}
 EOF
-		 (CCOPTS="" $CC_FOR_BUILD -o $dummy $dummy.c 2>/dev/null) && HP_ARCH=`$dummy`
+		 (CCOPTS="" $CC_FOR_BUILD -o "$dummy" "$dummy.c" 2>/dev/null) && HP_ARCH=`"$dummy"`
 		 test -z "$HP_ARCH" && HP_ARCH=hppa
 		fi ;;
 	esac
-	if ${HP_ARCH} = hppa2.0w 
+	if test "$HP_ARCH" = hppa2.0w
 	then
-	 eval $set_cc_for_build
+	 set_cc_for_build
 
 	 # hppa2.0w-hp-hpux* has a 64-bit kernel and a compiler generating
 	 # 32-bit code. hppa64-hp-hpux* has the same kernel and a compiler
@@ -712,15 +764,15 @@
 		HP_ARCH=hppa64
 	 fi
 	fi
-	echo ${HP_ARCH}-hp-hpux${HPUX_REV}
-	exit ;;
+	GUESS=$HP_ARCH-hp-hpux$HPUX_REV
+	;;
 ia64:HP-UX:*:*)
-	HPUX_REV=`echo ${UNAME_RELEASE}|sed -e 's/^.*.0B*//'`
-	echo ia64-hp-hpux${HPUX_REV}
-	exit ;;
+	HPUX_REV=`echo "$UNAME_RELEASE" | sed -e 's/^.*.0B*//'`
+	GUESS=ia64-hp-hpux$HPUX_REV
+	;;
 3050*:HI-UX:*:*)
-	eval $set_cc_for_build
-	sed 's/^	//' << EOF >$dummy.c
+	set_cc_for_build
+	sed 's/^	//' << EOF > "$dummy.c"
 	#include <unistd.h>
 	int
 	main ()
@@ -745,38 +797,38 @@
 	 exit (0);
 	}
 EOF
-	$CC_FOR_BUILD -o $dummy $dummy.c && SYSTEM_NAME=`$dummy` &&
+	$CC_FOR_BUILD -o "$dummy" "$dummy.c" && SYSTEM_NAME=`"$dummy"` &&
 		{ echo "$SYSTEM_NAME"; exit; }
-	echo unknown-hitachi-hiuxwe2
-	exit ;;
- 9000/7??:4.3bsd:*:* | 9000/8?79:4.3bsd:*:* )
-	echo hppa1.1-hp-bsd
-	exit ;;
+	GUESS=unknown-hitachi-hiuxwe2
+	;;
+ 9000/7??:4.3bsd:*:* | 9000/8?79:4.3bsd:*:*)
+	GUESS=hppa1.1-hp-bsd
+	;;
 9000/8??:4.3bsd:*:*)
-	echo hppa1.0-hp-bsd
-	exit ;;
+	GUESS=hppa1.0-hp-bsd
+	;;
 *9??*:MPE/iX:*:* | *3000*:MPE/iX:*:*)
-	echo hppa1.0-hp-mpeix
-	exit ;;
- hp7??:OSF1:*:* | hp8?79:OSF1:*:* )
-	echo hppa1.1-hp-osf
-	exit ;;
+	GUESS=hppa1.0-hp-mpeix
+	;;
+ hp7??:OSF1:*:* | hp8?79:OSF1:*:*)
+	GUESS=hppa1.1-hp-osf
+	;;
 hp8??:OSF1:*:*)
-	echo hppa1.0-hp-osf
-	exit ;;
+	GUESS=hppa1.0-hp-osf
+	;;
 i*86:OSF1:*:*)
-	if -x /usr/sbin/sysversion ; then
-	 echo ${UNAME_MACHINE}-unknown-osf1mk
+	if test -x /usr/sbin/sysversion ; then
+	 GUESS=$UNAME_MACHINE-unknown-osf1mk
 	else
-	 echo ${UNAME_MACHINE}-unknown-osf1
+	 GUESS=$UNAME_MACHINE-unknown-osf1
 	fi
-	exit ;;
+	;;
 parisc*:Lites*:*:*)
-	echo hppa1.1-hp-lites
-	exit ;;
+	GUESS=hppa1.1-hp-lites
+	;;
 C1*:ConvexOS:*:* | convex:ConvexOS:C1*:*)
-	echo c1-convex-bsd
-	exit ;;
+	GUESS=c1-convex-bsd
+	;;
 C2*:ConvexOS:*:* | convex:ConvexOS:C2*:*)
 	if getsysinfo -f scalar_acc
 	then echo c32-convex-bsd
@@ -784,139 +836,148 @@
 	fi
 	exit ;;
 C34*:ConvexOS:*:* | convex:ConvexOS:C34*:*)
-	echo c34-convex-bsd
-	exit ;;
+	GUESS=c34-convex-bsd
+	;;
 C38*:ConvexOS:*:* | convex:ConvexOS:C38*:*)
-	echo c38-convex-bsd
-	exit ;;
+	GUESS=c38-convex-bsd
+	;;
 C4*:ConvexOS:*:* | convex:ConvexOS:C4*:*)
-	echo c4-convex-bsd
-	exit ;;
+	GUESS=c4-convex-bsd
+	;;
 CRAY*Y-MP:*:*:*)
-	echo ymp-cray-unicos${UNAME_RELEASE} | sed -e 's/\.^.*$/.X/'
-	exit ;;
+	CRAY_REL=`echo "$UNAME_RELEASE" | sed -e 's/\.^.*$/.X/'`
+	GUESS=ymp-cray-unicos$CRAY_REL
+	;;
 CRAY*A-Z90:*:*:*)
-	echo ${UNAME_MACHINE}-cray-unicos${UNAME_RELEASE} \
+	echo "$UNAME_MACHINE"-cray-unicos"$UNAME_RELEASE" \
 	| sed -e 's/CRAY.*$A-Z90$/\1/' \
 	 -e y/ABCDEFGHIJKLMNOPQRSTUVWXYZ/abcdefghijklmnopqrstuvwxyz/ \
 	 -e 's/\.^.*$/.X/'
 	exit ;;
 CRAY*TS:*:*:*)
-	echo t90-cray-unicos${UNAME_RELEASE} | sed -e 's/\.^.*$/.X/'
-	exit ;;
+	CRAY_REL=`echo "$UNAME_RELEASE" | sed -e 's/\.^.*$/.X/'`
+	GUESS=t90-cray-unicos$CRAY_REL
+	;;
 CRAY*T3E:*:*:*)
-	echo alphaev5-cray-unicosmk${UNAME_RELEASE} | sed -e 's/\.^.*$/.X/'
-	exit ;;
+	CRAY_REL=`echo "$UNAME_RELEASE" | sed -e 's/\.^.*$/.X/'`
+	GUESS=alphaev5-cray-unicosmk$CRAY_REL
+	;;
 CRAY*SV1:*:*:*)
-	echo sv1-cray-unicos${UNAME_RELEASE} | sed -e 's/\.^.*$/.X/'
-	exit ;;
+	CRAY_REL=`echo "$UNAME_RELEASE" | sed -e 's/\.^.*$/.X/'`
+	GUESS=sv1-cray-unicos$CRAY_REL
+	;;
 *:UNICOS/mp:*:*)
-	echo craynv-cray-unicosmp${UNAME_RELEASE} | sed -e 's/\.^.*$/.X/'
-	exit ;;
+	CRAY_REL=`echo "$UNAME_RELEASE" | sed -e 's/\.^.*$/.X/'`
+	GUESS=craynv-cray-unicosmp$CRAY_REL
+	;;
 F3001:UNIX_System_V:*:* | F700:UNIX_System_V:*:*)
 	FUJITSU_PROC=`uname -m | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz`
 	FUJITSU_SYS=`uname -p | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz | sed -e 's/\///'`
-	FUJITSU_REL=`echo ${UNAME_RELEASE} | sed -e 's/ /_/'`
-	echo "${FUJITSU_PROC}-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}"
-	exit ;;
+	FUJITSU_REL=`echo "$UNAME_RELEASE" | sed -e 's/ /_/'`
+	GUESS=${FUJITSU_PROC}-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}
+	;;
 5000:UNIX_System_V:4.*:*)
 	FUJITSU_SYS=`uname -p | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz | sed -e 's/\///'`
-	FUJITSU_REL=`echo ${UNAME_RELEASE} | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz | sed -e 's/ /_/'`
-	echo "sparc-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}"
-	exit ;;
+	FUJITSU_REL=`echo "$UNAME_RELEASE" | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz | sed -e 's/ /_/'`
+	GUESS=sparc-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}
+	;;
 i*86:BSD/386:*:* | i*86:BSD/OS:*:* | *:Ascend\ Embedded/OS:*:*)
-	echo ${UNAME_MACHINE}-pc-bsdi${UNAME_RELEASE}
-	exit ;;
+	GUESS=$UNAME_MACHINE-pc-bsdi$UNAME_RELEASE
+	;;
 sparc*:BSD/OS:*:*)
-	echo sparc-unknown-bsdi${UNAME_RELEASE}
-	exit ;;
+	GUESS=sparc-unknown-bsdi$UNAME_RELEASE
+	;;
 *:BSD/OS:*:*)
-	echo ${UNAME_MACHINE}-unknown-bsdi${UNAME_RELEASE}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-bsdi$UNAME_RELEASE
+	;;
+ arm:FreeBSD:*:*)
+	UNAME_PROCESSOR=`uname -p`
+	set_cc_for_build
+	if echo __ARM_PCS_VFP | $CC_FOR_BUILD -E - 2>/dev/null \
+	 | grep -q __ARM_PCS_VFP
+	then
+	 FREEBSD_REL=`echo "$UNAME_RELEASE" | sed -e 's/-(.*//'`
+	 GUESS=$UNAME_PROCESSOR-unknown-freebsd$FREEBSD_REL-gnueabi
+	else
+	 FREEBSD_REL=`echo "$UNAME_RELEASE" | sed -e 's/-(.*//'`
+	 GUESS=$UNAME_PROCESSOR-unknown-freebsd$FREEBSD_REL-gnueabihf
+	fi
+	;;
 *:FreeBSD:*:*)
 	UNAME_PROCESSOR=`/usr/bin/uname -p`
-	case ${UNAME_PROCESSOR} in
+	case $UNAME_PROCESSOR in
 	 amd64)
-		echo x86_64-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/-(.*//'` ;;
-	 *)
-		echo ${UNAME_PROCESSOR}-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/-(.*//'` ;;
+		UNAME_PROCESSOR=x86_64 ;;
+	 i386)
+		UNAME_PROCESSOR=i586 ;;
 	esac
-	exit ;;
+	FREEBSD_REL=`echo "$UNAME_RELEASE" | sed -e 's/-(.*//'`
+	GUESS=$UNAME_PROCESSOR-unknown-freebsd$FREEBSD_REL
+	;;
 i*:CYGWIN*:*)
-	echo ${UNAME_MACHINE}-pc-cygwin
-	exit ;;
+	GUESS=$UNAME_MACHINE-pc-cygwin
+	;;
 *:MINGW64*:*)
-	echo ${UNAME_MACHINE}-pc-mingw64
-	exit ;;
+	GUESS=$UNAME_MACHINE-pc-mingw64
+	;;
 *:MINGW*:*)
-	echo ${UNAME_MACHINE}-pc-mingw32
-	exit ;;
+	GUESS=$UNAME_MACHINE-pc-mingw32
+	;;
 *:MSYS*:*)
-	echo ${UNAME_MACHINE}-pc-msys
-	exit ;;
- i*:windows32*:*)
-	# uname -m includes "-pc" on this system.
-	echo ${UNAME_MACHINE}-mingw32
-	exit ;;
+	GUESS=$UNAME_MACHINE-pc-msys
+	;;
 i*:PW*:*)
-	echo ${UNAME_MACHINE}-pc-pw32
-	exit ;;
+	GUESS=$UNAME_MACHINE-pc-pw32
+	;;
+ *:SerenityOS:*:*)
+ GUESS=$UNAME_MACHINE-pc-serenity
+ ;;
 *:Interix*:*)
-	case ${UNAME_MACHINE} in
+	case $UNAME_MACHINE in
 	 x86)
-		echo i586-pc-interix${UNAME_RELEASE}
-		exit ;;
+		GUESS=i586-pc-interix$UNAME_RELEASE
+		;;
 	 authenticamd | genuineintel | EM64T)
-		echo x86_64-unknown-interix${UNAME_RELEASE}
-		exit ;;
+		GUESS=x86_64-unknown-interix$UNAME_RELEASE
+		;;
 	 IA64)
-		echo ia64-unknown-interix${UNAME_RELEASE}
-		exit ;;
+		GUESS=ia64-unknown-interix$UNAME_RELEASE
+		;;
 	esac ;;
- 34586:Windows_95:* | 34586:Windows_98:* | 34586:Windows_NT:*)
-	echo i${UNAME_MACHINE}-pc-mks
-	exit ;;
- 8664:Windows_NT:*)
-	echo x86_64-pc-mks
-	exit ;;
- i*:Windows_NT*:* | Pentium*:Windows_NT*:*)
-	# How do we know it's Interix rather than the generic POSIX subsystem?
-	# It also conflicts with pre-2.0 versions of AT&T UWIN. Should we
-	# UNAME_MACHINE based on the output of uname instead of i386?
-	echo i586-pc-interix
-	exit ;;
 i*:UWIN*:*)
-	echo ${UNAME_MACHINE}-pc-uwin
-	exit ;;
+	GUESS=$UNAME_MACHINE-pc-uwin
+	;;
 amd64:CYGWIN*:*:* | x86_64:CYGWIN*:*:*)
-	echo x86_64-unknown-cygwin
-	exit ;;
- p*:CYGWIN*:*)
-	echo powerpcle-unknown-cygwin
-	exit ;;
+	GUESS=x86_64-pc-cygwin
+	;;
 prep*:SunOS:5.*:*)
-	echo powerpcle-unknown-solaris2`echo ${UNAME_RELEASE}|sed -e 's/^.*//'`
-	exit ;;
+	SUN_REL=`echo "$UNAME_RELEASE" | sed -e 's/^.*//'`
+	GUESS=powerpcle-unknown-solaris2$SUN_REL
+	;;
 *:GNU:*:*)
 	# the GNU system
-	echo `echo ${UNAME_MACHINE}|sed -e 's,-/.*$,,'`-unknown-${LIBC}`echo ${UNAME_RELEASE}|sed -e 's,/.*$,,'`
-	exit ;;
+	GNU_ARCH=`echo "$UNAME_MACHINE" | sed -e 's,-/.*$,,'`
+	GNU_REL=`echo "$UNAME_RELEASE" | sed -e 's,/.*$,,'`
+	GUESS=$GNU_ARCH-unknown-$LIBC$GNU_REL
+	;;
 *:GNU/*:*:*)
 	# other systems with GNU libc and userland
-	echo ${UNAME_MACHINE}-unknown-`echo ${UNAME_SYSTEM} | sed 's,^^/*/,,' | tr ":upper:" ":lower:"``echo ${UNAME_RELEASE}|sed -e 's/-(.*//'`-${LIBC}
-	exit ;;
- i*86:Minix:*:*)
-	echo ${UNAME_MACHINE}-pc-minix
-	exit ;;
+	GNU_SYS=`echo "$UNAME_SYSTEM" | sed 's,^^/*/,,' | tr ":upper:" ":lower:"`
+	GNU_REL=`echo "$UNAME_RELEASE" | sed -e 's/-(.*//'`
+	GUESS=$UNAME_MACHINE-unknown-$GNU_SYS$GNU_REL-$LIBC
+	;;
+ *:Minix:*:*)
+	GUESS=$UNAME_MACHINE-unknown-minix
+	;;
 aarch64:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
 aarch64_be:Linux:*:*)
 	UNAME_MACHINE=aarch64_be
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
 alpha:Linux:*:*)
-	case `sed -n '/^cpu model/s/^.*: $.*$/\1/p' < /proc/cpuinfo` in
+	case `sed -n '/^cpu model/s/^.*: $.*$/\1/p' /proc/cpuinfo 2>/dev/null` in
 	 EV5) UNAME_MACHINE=alphaev5 ;;
 	 EV56) UNAME_MACHINE=alphaev56 ;;
 	 PCA56) UNAME_MACHINE=alphapca56 ;;
@@ -927,183 +988,225 @@
 	esac
 	objdump --private-headers /bin/sh | grep -q ld.so.1
 	if test "$?" = 0 ; then LIBC=gnulibc1 ; fi
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
-	exit ;;
- arc:Linux:*:* | arceb:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
+ arc:Linux:*:* | arceb:Linux:*:* | arc32:Linux:*:* | arc64:Linux:*:*)
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
 arm*:Linux:*:*)
-	eval $set_cc_for_build
+	set_cc_for_build
 	if echo __ARM_EABI__ | $CC_FOR_BUILD -E - 2>/dev/null \
 	 | grep -q __ARM_EABI__
 	then
-	 echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
+	 GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
 	else
 	 if echo __ARM_PCS_VFP | $CC_FOR_BUILD -E - 2>/dev/null \
 		| grep -q __ARM_PCS_VFP
 	 then
-		echo ${UNAME_MACHINE}-unknown-linux-${LIBC}eabi
+		GUESS=$UNAME_MACHINE-unknown-linux-${LIBC}eabi
 	 else
-		echo ${UNAME_MACHINE}-unknown-linux-${LIBC}eabihf
+		GUESS=$UNAME_MACHINE-unknown-linux-${LIBC}eabihf
 	 fi
 	fi
-	exit ;;
+	;;
 avr32*:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
 cris:Linux:*:*)
-	echo ${UNAME_MACHINE}-axis-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-axis-linux-$LIBC
+	;;
 crisv32:Linux:*:*)
-	echo ${UNAME_MACHINE}-axis-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-axis-linux-$LIBC
+	;;
 e2k:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
 frv:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
 hexagon:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
 i*86:Linux:*:*)
-	echo ${UNAME_MACHINE}-pc-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-pc-linux-$LIBC
+	;;
 ia64:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
 k1om:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
+ loongarch32:Linux:*:* | loongarch64:Linux:*:* | loongarchx32:Linux:*:*)
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
 m32r*:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
 m68*:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
 mips:Linux:*:* | mips64:Linux:*:*)
-	eval $set_cc_for_build
-	sed 's/^	//' << EOF >$dummy.c
+	set_cc_for_build
+	IS_GLIBC=0
+	test x"${LIBC}" = xgnu && IS_GLIBC=1
+	sed 's/^	//' << EOF > "$dummy.c"
 	#undef CPU
-	#undef ${UNAME_MACHINE}
-	#undef ${UNAME_MACHINE}el
+	#undef mips
+	#undef mipsel
+	#undef mips64
+	#undef mips64el
+	#if ${IS_GLIBC} && defined(_ABI64)
+	LIBCABI=gnuabi64
+	#else
+	#if ${IS_GLIBC} && defined(_ABIN32)
+	LIBCABI=gnuabin32
+	#else
+	LIBCABI=${LIBC}
+	#endif
+	#endif
+
+	#if ${IS_GLIBC} && defined(__mips64) && defined(__mips_isa_rev) && __mips_isa_rev>=6
+	CPU=mipsisa64r6
+	#else
+	#if ${IS_GLIBC} && !defined(__mips64) && defined(__mips_isa_rev) && __mips_isa_rev>=6
+	CPU=mipsisa32r6
+	#else
+	#if defined(__mips64)
+	CPU=mips64
+	#else
+	CPU=mips
+	#endif
+	#endif
+	#endif
+
 	#if defined(__MIPSEL__) || defined(__MIPSEL) || defined(_MIPSEL) || defined(MIPSEL)
-	CPU=${UNAME_MACHINE}el
+	MIPS_ENDIAN=el
 	#else
 	#if defined(__MIPSEB__) || defined(__MIPSEB) || defined(_MIPSEB) || defined(MIPSEB)
-	CPU=${UNAME_MACHINE}
+	MIPS_ENDIAN=
 	#else
-	CPU=
+	MIPS_ENDIAN=
 	#endif
 	#endif
 EOF
-	eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^CPU'`
-	test x"${CPU}" != x && { echo "${CPU}-unknown-linux-${LIBC}"; exit; }
+	cc_set_vars=`$CC_FOR_BUILD -E "$dummy.c" 2>/dev/null | grep '^CPU\|^MIPS_ENDIAN\|^LIBCABI'`
+	eval "$cc_set_vars"
+	test "x$CPU" != x && { echo "$CPU${MIPS_ENDIAN}-unknown-linux-$LIBCABI"; exit; }
 	;;
 mips64el:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
 openrisc*:Linux:*:*)
-	echo or1k-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=or1k-unknown-linux-$LIBC
+	;;
 or32:Linux:*:* | or1k*:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
 padre:Linux:*:*)
-	echo sparc-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=sparc-unknown-linux-$LIBC
+	;;
 parisc64:Linux:*:* | hppa64:Linux:*:*)
-	echo hppa64-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=hppa64-unknown-linux-$LIBC
+	;;
 parisc:Linux:*:* | hppa:Linux:*:*)
 	# Look for CPU level
 	case `grep '^cpu^a-z*:' /proc/cpuinfo 2>/dev/null | cut -d' ' -f2` in
-	 PA7*) echo hppa1.1-unknown-linux-${LIBC} ;;
-	 PA8*) echo hppa2.0-unknown-linux-${LIBC} ;;
-	 *) echo hppa-unknown-linux-${LIBC} ;;
+	 PA7*) GUESS=hppa1.1-unknown-linux-$LIBC ;;
+	 PA8*) GUESS=hppa2.0-unknown-linux-$LIBC ;;
+	 *) GUESS=hppa-unknown-linux-$LIBC ;;
 	esac
-	exit ;;
+	;;
 ppc64:Linux:*:*)
-	echo powerpc64-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=powerpc64-unknown-linux-$LIBC
+	;;
 ppc:Linux:*:*)
-	echo powerpc-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=powerpc-unknown-linux-$LIBC
+	;;
 ppc64le:Linux:*:*)
-	echo powerpc64le-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=powerpc64le-unknown-linux-$LIBC
+	;;
 ppcle:Linux:*:*)
-	echo powerpcle-unknown-linux-${LIBC}
-	exit ;;
- riscv32:Linux:*:* | riscv64:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=powerpcle-unknown-linux-$LIBC
+	;;
+ riscv32:Linux:*:* | riscv32be:Linux:*:* | riscv64:Linux:*:* | riscv64be:Linux:*:*)
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
 s390:Linux:*:* | s390x:Linux:*:*)
-	echo ${UNAME_MACHINE}-ibm-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-ibm-linux-$LIBC
+	;;
 sh64*:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
 sh*:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
 sparc:Linux:*:* | sparc64:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
 tile*:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
 vax:Linux:*:*)
-	echo ${UNAME_MACHINE}-dec-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-dec-linux-$LIBC
+	;;
 x86_64:Linux:*:*)
-	echo ${UNAME_MACHINE}-pc-linux-${LIBC}
-	exit ;;
+	set_cc_for_build
+	LIBCABI=$LIBC
+	if test "$CC_FOR_BUILD" != no_compiler_found; then
+	 if (echo '#ifdef __ILP32__'; echo IS_X32; echo '#endif') | \
+		(CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) | \
+		grep IS_X32 >/dev/null
+	 then
+		LIBCABI=${LIBC}x32
+	 fi
+	fi
+	GUESS=$UNAME_MACHINE-pc-linux-$LIBCABI
+	;;
 xtensa*:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
+	;;
 i*86:DYNIX/ptx:4*:*)
 	# ptx 4.0 does uname -s correctly, with DYNIX/ptx in there.
 	# earlier versions are messed up and put the nodename in both
 	# sysname and nodename.
-	echo i386-sequent-sysv4
-	exit ;;
+	GUESS=i386-sequent-sysv4
+	;;
 i*86:UNIX_SV:4.2MP:2.*)
 	# Unixware is an offshoot of SVR4, but it has its own version
 	# number series starting with 2...
 	# I am not positive that other SVR4 systems won't match this,
 	# I just have to hope. -- rms.
 	# Use sysv4.2uw... so that sysv4* matches it.
-	echo ${UNAME_MACHINE}-pc-sysv4.2uw${UNAME_VERSION}
-	exit ;;
+	GUESS=$UNAME_MACHINE-pc-sysv4.2uw$UNAME_VERSION
+	;;
 i*86:OS/2:*:*)
 	# If we were able to find `uname', then EMX Unix compatibility
 	# is probably installed.
-	echo ${UNAME_MACHINE}-pc-os2-emx
-	exit ;;
+	GUESS=$UNAME_MACHINE-pc-os2-emx
+	;;
 i*86:XTS-300:*:STOP)
-	echo ${UNAME_MACHINE}-unknown-stop
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-stop
+	;;
 i*86:atheos:*:*)
-	echo ${UNAME_MACHINE}-unknown-atheos
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-atheos
+	;;
 i*86:syllable:*:*)
-	echo ${UNAME_MACHINE}-pc-syllable
-	exit ;;
+	GUESS=$UNAME_MACHINE-pc-syllable
+	;;
 i*86:LynxOS:2.*:* | i*86:LynxOS:3.01*:* | i*86:LynxOS:4.02*:*)
-	echo i386-unknown-lynxos${UNAME_RELEASE}
-	exit ;;
+	GUESS=i386-unknown-lynxos$UNAME_RELEASE
+	;;
 i*86:*DOS:*:*)
-	echo ${UNAME_MACHINE}-pc-msdosdjgpp
-	exit ;;
- i*86:*:4.*:* | i*86:SYSTEM_V:4.*:*)
-	UNAME_REL=`echo ${UNAME_RELEASE} | sed 's/\/MP$//'`
+	GUESS=$UNAME_MACHINE-pc-msdosdjgpp
+	;;
+ i*86:*:4.*:*)
+	UNAME_REL=`echo "$UNAME_RELEASE" | sed 's/\/MP$//'`
 	if grep Novell /usr/include/link.h >/dev/null 2>/dev/null; then
-		echo ${UNAME_MACHINE}-univel-sysv${UNAME_REL}
+		GUESS=$UNAME_MACHINE-univel-sysv$UNAME_REL
 	else
-		echo ${UNAME_MACHINE}-pc-sysv${UNAME_REL}
+		GUESS=$UNAME_MACHINE-pc-sysv$UNAME_REL
 	fi
-	exit ;;
+	;;
 i*86:*:5:678*)
 	# UnixWare 7.x, OpenUNIX and OpenServer 6.
 	case `/bin/uname -X | grep "^Machine"` in
@@ -1111,12 +1214,12 @@
 	 *Pentium)	 UNAME_MACHINE=i586 ;;
 	 *Pent*|*Celeron) UNAME_MACHINE=i686 ;;
 	esac
-	echo ${UNAME_MACHINE}-unknown-sysv${UNAME_RELEASE}${UNAME_SYSTEM}${UNAME_VERSION}
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-sysv${UNAME_RELEASE}${UNAME_SYSTEM}${UNAME_VERSION}
+	;;
 i*86:*:3.2:*)
 	if test -f /usr/options/cb.name; then
 		UNAME_REL=`sed -n 's/.*Version //p' </usr/options/cb.name`
-		echo ${UNAME_MACHINE}-pc-isc$UNAME_REL
+		GUESS=$UNAME_MACHINE-pc-isc$UNAME_REL
 	elif /bin/uname -X 2>/dev/null >/dev/null ; then
 		UNAME_REL=`(/bin/uname -X|grep Release|sed -e 's/.*= //')`
 		(/bin/uname -X|grep i80486 >/dev/null) && UNAME_MACHINE=i486
@@ -1126,11 +1229,11 @@
 			&& UNAME_MACHINE=i686
 		(/bin/uname -X|grep '^Machine.*Pentium Pro' >/dev/null) \
 			&& UNAME_MACHINE=i686
-		echo ${UNAME_MACHINE}-pc-sco$UNAME_REL
+		GUESS=$UNAME_MACHINE-pc-sco$UNAME_REL
 	else
-		echo ${UNAME_MACHINE}-pc-sysv32
+		GUESS=$UNAME_MACHINE-pc-sysv32
 	fi
-	exit ;;
+	;;
 pc:*:*:*)
 	# Left here for compatibility:
 	# uname -m prints for DJGPP always 'pc', but it prints nothing about
@@ -1138,31 +1241,31 @@
 	# Note: whatever this is, it MUST be the same as what config.sub
 	# prints for the "djgpp" host, or else GDB configure will decide that
 	# this is a cross-build.
-	echo i586-pc-msdosdjgpp
-	exit ;;
+	GUESS=i586-pc-msdosdjgpp
+	;;
 Intel:Mach:3*:*)
-	echo i386-pc-mach3
-	exit ;;
+	GUESS=i386-pc-mach3
+	;;
 paragon:*:*:*)
-	echo i860-intel-osf1
-	exit ;;
+	GUESS=i860-intel-osf1
+	;;
 i860:*:4.*:*) # i860-SVR4
 	if grep Stardent /usr/include/sys/uadmin.h >/dev/null 2>&1 ; then
-	 echo i860-stardent-sysv${UNAME_RELEASE} # Stardent Vistra i860-SVR4
+	 GUESS=i860-stardent-sysv$UNAME_RELEASE # Stardent Vistra i860-SVR4
 	else # Add other i860-SVR4 vendors below as they are discovered.
-	 echo i860-unknown-sysv${UNAME_RELEASE} # Unknown i860-SVR4
+	 GUESS=i860-unknown-sysv$UNAME_RELEASE # Unknown i860-SVR4
 	fi
-	exit ;;
+	;;
 mini*:CTIX:SYS*5:*)
 	# "miniframe"
-	echo m68010-convergent-sysv
-	exit ;;
+	GUESS=m68010-convergent-sysv
+	;;
 mc68k:UNIX:SYSTEM5:3.51m)
-	echo m68k-convergent-sysv
-	exit ;;
+	GUESS=m68k-convergent-sysv
+	;;
 M680?0:D-NIX:5.3:*)
-	echo m68k-diab-dnix
-	exit ;;
+	GUESS=m68k-diab-dnix
+	;;
 M68*:*:R3V5678*:*)
 	test -r /sysV68 && { echo 'm68k-motorola-sysv'; exit; } ;;
 3345??:*:4.0:3.0 | 334??A:*:4.0:3.0 | 334??,*:*:4.0:3.0 | 334??/*:*:4.0:3.0 | 4400:*:4.0:3.0 | 4850:*:4.0:3.0 | SKA40:*:4.0:3.0 | SDS2:*:4.0:3.0 | SHG2:*:4.0:3.0 | S7501*:*:4.0:3.0)
@@ -1170,9 +1273,9 @@
 	test -r /etc/.relid \
 	&& OS_REL=.`sed -n 's/^ * ^ * $0-90-9$.*/\1/p' < /etc/.relid`
 	/bin/uname -p 2>/dev/null | grep 86 >/dev/null \
-	 && { echo i486-ncr-sysv4.3${OS_REL}; exit; }
+	 && { echo i486-ncr-sysv4.3"$OS_REL"; exit; }
 	/bin/uname -p 2>/dev/null | /bin/grep entium >/dev/null \
-	 && { echo i586-ncr-sysv4.3${OS_REL}; exit; } ;;
+	 && { echo i586-ncr-sysv4.3"$OS_REL"; exit; } ;;
 334??:*:4.0:* | 334??,*:*:4.0:*)
 	/bin/uname -p 2>/dev/null | grep 86 >/dev/null \
 	 && { echo i486-ncr-sysv4; exit; } ;;
@@ -1181,249 +1284,437 @@
 	test -r /etc/.relid \
 	 && OS_REL=.`sed -n 's/^ * ^ * $0-90-9$.*/\1/p' < /etc/.relid`
 	/bin/uname -p 2>/dev/null | grep 86 >/dev/null \
-	 && { echo i486-ncr-sysv4.3${OS_REL}; exit; }
+	 && { echo i486-ncr-sysv4.3"$OS_REL"; exit; }
 	/bin/uname -p 2>/dev/null | /bin/grep entium >/dev/null \
-	 && { echo i586-ncr-sysv4.3${OS_REL}; exit; }
+	 && { echo i586-ncr-sysv4.3"$OS_REL"; exit; }
 	/bin/uname -p 2>/dev/null | /bin/grep pteron >/dev/null \
-	 && { echo i586-ncr-sysv4.3${OS_REL}; exit; } ;;
+	 && { echo i586-ncr-sysv4.3"$OS_REL"; exit; } ;;
 m68*:LynxOS:2.*:* | m68*:LynxOS:3.0*:*)
-	echo m68k-unknown-lynxos${UNAME_RELEASE}
-	exit ;;
+	GUESS=m68k-unknown-lynxos$UNAME_RELEASE
+	;;
 mc68030:UNIX_System_V:4.*:*)
-	echo m68k-atari-sysv4
-	exit ;;
+	GUESS=m68k-atari-sysv4
+	;;
 TSUNAMI:LynxOS:2.*:*)
-	echo sparc-unknown-lynxos${UNAME_RELEASE}
-	exit ;;
+	GUESS=sparc-unknown-lynxos$UNAME_RELEASE
+	;;
 rs6000:LynxOS:2.*:*)
-	echo rs6000-unknown-lynxos${UNAME_RELEASE}
-	exit ;;
+	GUESS=rs6000-unknown-lynxos$UNAME_RELEASE
+	;;
 PowerPC:LynxOS:2.*:* | PowerPC:LynxOS:3.01*:* | PowerPC:LynxOS:4.02*:*)
-	echo powerpc-unknown-lynxos${UNAME_RELEASE}
-	exit ;;
+	GUESS=powerpc-unknown-lynxos$UNAME_RELEASE
+	;;
 SMBES:UNIX_SV:*:*)
-	echo mips-dde-sysv${UNAME_RELEASE}
-	exit ;;
+	GUESS=mips-dde-sysv$UNAME_RELEASE
+	;;
 RM*:ReliantUNIX-*:*:*)
-	echo mips-sni-sysv4
-	exit ;;
+	GUESS=mips-sni-sysv4
+	;;
 RM*:SINIX-*:*:*)
-	echo mips-sni-sysv4
-	exit ;;
+	GUESS=mips-sni-sysv4
+	;;
 *:SINIX-*:*:*)
 	if uname -p 2>/dev/null >/dev/null ; then
 		UNAME_MACHINE=`(uname -p) 2>/dev/null`
-		echo ${UNAME_MACHINE}-sni-sysv4
+		GUESS=$UNAME_MACHINE-sni-sysv4
 	else
-		echo ns32k-sni-sysv
+		GUESS=ns32k-sni-sysv
 	fi
-	exit ;;
+	;;
 PENTIUM:*:4.0*:*)	# Unisys `ClearPath HMP IX 4000' SVR4/MP effort
 			# says <Richard.M.Bartel@ccMail.Census.GOV>
-	echo i586-unisys-sysv4
-	exit ;;
+	GUESS=i586-unisys-sysv4
+	;;
 *:UNIX_System_V:4*:FTX*)
 	# From Gerald Hewes <hewes@openmarket.com>.
 	# How about differentiating between stratus architectures? -djm
-	echo hppa1.1-stratus-sysv4
-	exit ;;
+	GUESS=hppa1.1-stratus-sysv4
+	;;
 *:*:*:FTX*)
 	# From seanf@swdc.stratus.com.
-	echo i860-stratus-sysv4
-	exit ;;
+	GUESS=i860-stratus-sysv4
+	;;
 i*86:VOS:*:*)
 	# From Paul.Green@stratus.com.
-	echo ${UNAME_MACHINE}-stratus-vos
-	exit ;;
+	GUESS=$UNAME_MACHINE-stratus-vos
+	;;
 *:VOS:*:*)
 	# From Paul.Green@stratus.com.
-	echo hppa1.1-stratus-vos
-	exit ;;
+	GUESS=hppa1.1-stratus-vos
+	;;
 mc68*:A/UX:*:*)
-	echo m68k-apple-aux${UNAME_RELEASE}
-	exit ;;
+	GUESS=m68k-apple-aux$UNAME_RELEASE
+	;;
 news*:NEWS-OS:6*:*)
-	echo mips-sony-newsos6
-	exit ;;
+	GUESS=mips-sony-newsos6
+	;;
 R34000:*System_V*:*:* | R4000:UNIX_SYSV:*:* | R*000:UNIX_SV:*:*)
-	if -d /usr/nec ; then
-		echo mips-nec-sysv${UNAME_RELEASE}
+	if test -d /usr/nec; then
+		GUESS=mips-nec-sysv$UNAME_RELEASE
 	else
-		echo mips-unknown-sysv${UNAME_RELEASE}
+		GUESS=mips-unknown-sysv$UNAME_RELEASE
 	fi
-	exit ;;
+	;;
 BeBox:BeOS:*:*)	# BeOS running on hardware made by Be, PPC only.
-	echo powerpc-be-beos
-	exit ;;
+	GUESS=powerpc-be-beos
+	;;
 BeMac:BeOS:*:*)	# BeOS running on Mac or Mac clone, PPC only.
-	echo powerpc-apple-beos
-	exit ;;
+	GUESS=powerpc-apple-beos
+	;;
 BePC:BeOS:*:*)	# BeOS running on Intel PC compatible.
-	echo i586-pc-beos
-	exit ;;
+	GUESS=i586-pc-beos
+	;;
 BePC:Haiku:*:*)	# Haiku running on Intel PC compatible.
-	echo i586-pc-haiku
-	exit ;;
+	GUESS=i586-pc-haiku
+	;;
 x86_64:Haiku:*:*)
-	echo x86_64-unknown-haiku
-	exit ;;
+	GUESS=x86_64-unknown-haiku
+	;;
 SX-4:SUPER-UX:*:*)
-	echo sx4-nec-superux${UNAME_RELEASE}
-	exit ;;
+	GUESS=sx4-nec-superux$UNAME_RELEASE
+	;;
 SX-5:SUPER-UX:*:*)
-	echo sx5-nec-superux${UNAME_RELEASE}
-	exit ;;
+	GUESS=sx5-nec-superux$UNAME_RELEASE
+	;;
 SX-6:SUPER-UX:*:*)
-	echo sx6-nec-superux${UNAME_RELEASE}
-	exit ;;
+	GUESS=sx6-nec-superux$UNAME_RELEASE
+	;;
 SX-7:SUPER-UX:*:*)
-	echo sx7-nec-superux${UNAME_RELEASE}
-	exit ;;
+	GUESS=sx7-nec-superux$UNAME_RELEASE
+	;;
 SX-8:SUPER-UX:*:*)
-	echo sx8-nec-superux${UNAME_RELEASE}
-	exit ;;
+	GUESS=sx8-nec-superux$UNAME_RELEASE
+	;;
 SX-8R:SUPER-UX:*:*)
-	echo sx8r-nec-superux${UNAME_RELEASE}
-	exit ;;
+	GUESS=sx8r-nec-superux$UNAME_RELEASE
+	;;
 SX-ACE:SUPER-UX:*:*)
-	echo sxace-nec-superux${UNAME_RELEASE}
-	exit ;;
+	GUESS=sxace-nec-superux$UNAME_RELEASE
+	;;
 Power*:Rhapsody:*:*)
-	echo powerpc-apple-rhapsody${UNAME_RELEASE}
-	exit ;;
+	GUESS=powerpc-apple-rhapsody$UNAME_RELEASE
+	;;
 *:Rhapsody:*:*)
-	echo ${UNAME_MACHINE}-apple-rhapsody${UNAME_RELEASE}
-	exit ;;
+	GUESS=$UNAME_MACHINE-apple-rhapsody$UNAME_RELEASE
+	;;
+ arm64:Darwin:*:*)
+	GUESS=aarch64-apple-darwin$UNAME_RELEASE
+	;;
 *:Darwin:*:*)
-	UNAME_PROCESSOR=`uname -p` || UNAME_PROCESSOR=unknown
-	eval $set_cc_for_build
-	if test "$UNAME_PROCESSOR" = unknown ; then
-	 UNAME_PROCESSOR=powerpc
+	UNAME_PROCESSOR=`uname -p`
+	case $UNAME_PROCESSOR in
+	 unknown) UNAME_PROCESSOR=powerpc ;;
+	esac
+	if command -v xcode-select > /dev/null 2> /dev/null && \
+		! xcode-select --print-path > /dev/null 2> /dev/null ; then
+	 # Avoid executing cc if there is no toolchain installed as
+	 # cc will be a stub that puts up a graphical alert
+	 # prompting the user to install developer tools.
+	 CC_FOR_BUILD=no_compiler_found
+	else
+	 set_cc_for_build
 	fi
-	if test `echo "$UNAME_RELEASE" | sed -e 's/\..*//'` -le 10 ; then
-	 if "$CC_FOR_BUILD" != no_compiler_found ; then
-		if (echo '#ifdef __LP64__'; echo IS_64BIT_ARCH; echo '#endif') | \
-		 (CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) | \
-		 grep IS_64BIT_ARCH >/dev/null
-		then
-		 case $UNAME_PROCESSOR in
-			i386) UNAME_PROCESSOR=x86_64 ;;
-			powerpc) UNAME_PROCESSOR=powerpc64 ;;
-		 esac
-		fi
+	if test "$CC_FOR_BUILD" != no_compiler_found; then
+	 if (echo '#ifdef __LP64__'; echo IS_64BIT_ARCH; echo '#endif') | \
+		 (CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) | \
+		 grep IS_64BIT_ARCH >/dev/null
+	 then
+		case $UNAME_PROCESSOR in
+		 i386) UNAME_PROCESSOR=x86_64 ;;
+		 powerpc) UNAME_PROCESSOR=powerpc64 ;;
+		esac
+	 fi
+	 # On 10.4-10.6 one might compile for PowerPC via gcc -arch ppc
+	 if (echo '#ifdef __POWERPC__'; echo IS_PPC; echo '#endif') | \
+		 (CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) | \
+		 grep IS_PPC >/dev/null
+	 then
+		UNAME_PROCESSOR=powerpc
 	 fi
 	elif test "$UNAME_PROCESSOR" = i386 ; then
-	 # Avoid executing cc on OS X 10.9, as it ships with a stub
-	 # that puts up a graphical alert prompting to install
-	 # developer tools. Any system running Mac OS X 10.7 or
-	 # later (Darwin 11 and later) is required to have a 64-bit
-	 # processor. This is not true of the ARM version of Darwin
-	 # that Apple uses in portable devices.
-	 UNAME_PROCESSOR=x86_64
+	 # uname -m returns i386 or x86_64
+	 UNAME_PROCESSOR=$UNAME_MACHINE
 	fi
-	echo ${UNAME_PROCESSOR}-apple-darwin${UNAME_RELEASE}
-	exit ;;
+	GUESS=$UNAME_PROCESSOR-apple-darwin$UNAME_RELEASE
+	;;
 *:procnto*:*:* | *:QNX:0123456789*:*)
 	UNAME_PROCESSOR=`uname -p`
 	if test "$UNAME_PROCESSOR" = x86; then
 		UNAME_PROCESSOR=i386
 		UNAME_MACHINE=pc
 	fi
-	echo ${UNAME_PROCESSOR}-${UNAME_MACHINE}-nto-qnx${UNAME_RELEASE}
-	exit ;;
+	GUESS=$UNAME_PROCESSOR-$UNAME_MACHINE-nto-qnx$UNAME_RELEASE
+	;;
 *:QNX:*:4*)
-	echo i386-pc-qnx
-	exit ;;
- NEO-?:NONSTOP_KERNEL:*:*)
-	echo neo-tandem-nsk${UNAME_RELEASE}
-	exit ;;
+	GUESS=i386-pc-qnx
+	;;
+ NEO-*:NONSTOP_KERNEL:*:*)
+	GUESS=neo-tandem-nsk$UNAME_RELEASE
+	;;
 NSE-*:NONSTOP_KERNEL:*:*)
-	echo nse-tandem-nsk${UNAME_RELEASE}
-	exit ;;
- NSR-?:NONSTOP_KERNEL:*:*)
-	echo nsr-tandem-nsk${UNAME_RELEASE}
-	exit ;;
+	GUESS=nse-tandem-nsk$UNAME_RELEASE
+	;;
+ NSR-*:NONSTOP_KERNEL:*:*)
+	GUESS=nsr-tandem-nsk$UNAME_RELEASE
+	;;
+ NSV-*:NONSTOP_KERNEL:*:*)
+	GUESS=nsv-tandem-nsk$UNAME_RELEASE
+	;;
+ NSX-*:NONSTOP_KERNEL:*:*)
+	GUESS=nsx-tandem-nsk$UNAME_RELEASE
+	;;
 *:NonStop-UX:*:*)
-	echo mips-compaq-nonstopux
-	exit ;;
+	GUESS=mips-compaq-nonstopux
+	;;
 BS2000:POSIX*:*:*)
-	echo bs2000-siemens-sysv
-	exit ;;
+	GUESS=bs2000-siemens-sysv
+	;;
 DS/*:UNIX_System_V:*:*)
-	echo ${UNAME_MACHINE}-${UNAME_SYSTEM}-${UNAME_RELEASE}
-	exit ;;
+	GUESS=$UNAME_MACHINE-$UNAME_SYSTEM-$UNAME_RELEASE
+	;;
 *:Plan9:*:*)
 	# "uname -m" is not consistent, so use $cputype instead. 386
 	# is converted to i386 for consistency with other x86
 	# operating systems.
-	if test "$cputype" = 386; then
+	if test "${cputype-}" = 386; then
 	 UNAME_MACHINE=i386
-	else
-	 UNAME_MACHINE="$cputype"
+	elif test "x${cputype-}" != x; then
+	 UNAME_MACHINE=$cputype
 	fi
-	echo ${UNAME_MACHINE}-unknown-plan9
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-plan9
+	;;
 *:TOPS-10:*:*)
-	echo pdp10-unknown-tops10
-	exit ;;
+	GUESS=pdp10-unknown-tops10
+	;;
 *:TENEX:*:*)
-	echo pdp10-unknown-tenex
-	exit ;;
+	GUESS=pdp10-unknown-tenex
+	;;
 KS10:TOPS-20:*:* | KL10:TOPS-20:*:* | TYPE4:TOPS-20:*:*)
-	echo pdp10-dec-tops20
-	exit ;;
+	GUESS=pdp10-dec-tops20
+	;;
 XKL-1:TOPS-20:*:* | TYPE5:TOPS-20:*:*)
-	echo pdp10-xkl-tops20
-	exit ;;
+	GUESS=pdp10-xkl-tops20
+	;;
 *:TOPS-20:*:*)
-	echo pdp10-unknown-tops20
-	exit ;;
+	GUESS=pdp10-unknown-tops20
+	;;
 *:ITS:*:*)
-	echo pdp10-unknown-its
-	exit ;;
+	GUESS=pdp10-unknown-its
+	;;
 SEI:*:*:SEIUX)
-	echo mips-sei-seiux${UNAME_RELEASE}
-	exit ;;
+	GUESS=mips-sei-seiux$UNAME_RELEASE
+	;;
 *:DragonFly:*:*)
-	echo ${UNAME_MACHINE}-unknown-dragonfly`echo ${UNAME_RELEASE}|sed -e 's/-(.*//'`
-	exit ;;
+	DRAGONFLY_REL=`echo "$UNAME_RELEASE" | sed -e 's/-(.*//'`
+	GUESS=$UNAME_MACHINE-unknown-dragonfly$DRAGONFLY_REL
+	;;
 *:*VMS:*:*)
 	UNAME_MACHINE=`(uname -p) 2>/dev/null`
-	case "${UNAME_MACHINE}" in
-	 A*) echo alpha-dec-vms ; exit ;;
-	 I*) echo ia64-dec-vms ; exit ;;
-	 V*) echo vax-dec-vms ; exit ;;
+	case $UNAME_MACHINE in
+	 A*) GUESS=alpha-dec-vms ;;
+	 I*) GUESS=ia64-dec-vms ;;
+	 V*) GUESS=vax-dec-vms ;;
 	esac ;;
 *:XENIX:*:SysV)
-	echo i386-pc-xenix
-	exit ;;
+	GUESS=i386-pc-xenix
+	;;
 i*86:skyos:*:*)
-	echo ${UNAME_MACHINE}-pc-skyos`echo ${UNAME_RELEASE} | sed -e 's/ .*$//'`
-	exit ;;
+	SKYOS_REL=`echo "$UNAME_RELEASE" | sed -e 's/ .*$//'`
+	GUESS=$UNAME_MACHINE-pc-skyos$SKYOS_REL
+	;;
 i*86:rdos:*:*)
-	echo ${UNAME_MACHINE}-pc-rdos
-	exit ;;
- i*86:AROS:*:*)
-	echo ${UNAME_MACHINE}-pc-aros
-	exit ;;
+	GUESS=$UNAME_MACHINE-pc-rdos
+	;;
+ i*86:Fiwix:*:*)
+	GUESS=$UNAME_MACHINE-pc-fiwix
+	;;
+ *:AROS:*:*)
+	GUESS=$UNAME_MACHINE-unknown-aros
+	;;
 x86_64:VMkernel:*:*)
-	echo ${UNAME_MACHINE}-unknown-esx
-	exit ;;
+	GUESS=$UNAME_MACHINE-unknown-esx
+	;;
 amd64:Isilon\ OneFS:*:*)
-	echo x86_64-unknown-onefs
-	exit ;;
+	GUESS=x86_64-unknown-onefs
+	;;
+ *:Unleashed:*:*)
+	GUESS=$UNAME_MACHINE-unknown-unleashed$UNAME_RELEASE
+	;;
+esac
+
+# Do we have a guess based on uname results?
+if test "x$GUESS" != x; then
+ echo "$GUESS"
+ exit
+fi
+
+# No uname command or uname output not recognized.
+set_cc_for_build
+cat > "$dummy.c" <<EOF
+#ifdef _SEQUENT_
+#include <sys/types.h>
+#include <sys/utsname.h>
+#endif
+#if defined(ultrix) || defined(_ultrix) || defined(__ultrix) || defined(__ultrix__)
+#if defined (vax) || defined (__vax) || defined (__vax__) || defined(mips) || defined(__mips) || defined(__mips__) || defined(MIPS) || defined(__MIPS__)
+#include <signal.h>
+#if defined(_SIZE_T_) || defined(SIGLOST)
+#include <sys/utsname.h>
+#endif
+#endif
+#endif
+main ()
+{
+#if defined (sony)
+#if defined (MIPSEB)
+ /* BFD wants "bsd" instead of "newsos". Perhaps BFD should be changed,
+ I don't know.... */
+ printf ("mips-sony-bsd\n"); exit (0);
+#else
+#include <sys/param.h>
+ printf ("m68k-sony-newsos%s\n",
+#ifdef NEWSOS4
+ "4"
+#else
+ ""
+#endif
+ ); exit (0);
+#endif
+#endif
+
+#if defined (NeXT)
+#if !defined (__ARCHITECTURE__)
+#define __ARCHITECTURE__ "m68k"
+#endif
+ int version;
+ version=`(hostinfo | sed -n 's/.*NeXT Mach $0-9*$.*/\1/p') 2>/dev/null`;
+ if (version < 4)
+ printf ("%s-next-nextstep%d\n", __ARCHITECTURE__, version);
+ else
+ printf ("%s-next-openstep%d\n", __ARCHITECTURE__, version);
+ exit (0);
+#endif
+
+#if defined (MULTIMAX) || defined (n16)
+#if defined (UMAXV)
+ printf ("ns32k-encore-sysv\n"); exit (0);
+#else
+#if defined (CMU)
+ printf ("ns32k-encore-mach\n"); exit (0);
+#else
+ printf ("ns32k-encore-bsd\n"); exit (0);
+#endif
+#endif
+#endif
+
+#if defined (__386BSD__)
+ printf ("i386-pc-bsd\n"); exit (0);
+#endif
+
+#if defined (sequent)
+#if defined (i386)
+ printf ("i386-sequent-dynix\n"); exit (0);
+#endif
+#if defined (ns32000)
+ printf ("ns32k-sequent-dynix\n"); exit (0);
+#endif
+#endif
+
+#if defined (_SEQUENT_)
+ struct utsname un;
+
+ uname(&un);
+ if (strncmp(un.version, "V2", 2) == 0) {
+ printf ("i386-sequent-ptx2\n"); exit (0);
+ }
+ if (strncmp(un.version, "V1", 2) == 0) { /* XXX is V1 correct? */
+ printf ("i386-sequent-ptx1\n"); exit (0);
+ }
+ printf ("i386-sequent-ptx\n"); exit (0);
+#endif
+
+#if defined (vax)
+#if !defined (ultrix)
+#include <sys/param.h>
+#if defined (BSD)
+#if BSD == 43
+ printf ("vax-dec-bsd4.3\n"); exit (0);
+#else
+#if BSD == 199006
+ printf ("vax-dec-bsd4.3reno\n"); exit (0);
+#else
+ printf ("vax-dec-bsd\n"); exit (0);
+#endif
+#endif
+#else
+ printf ("vax-dec-bsd\n"); exit (0);
+#endif
+#else
+#if defined(_SIZE_T_) || defined(SIGLOST)
+ struct utsname un;
+ uname (&un);
+ printf ("vax-dec-ultrix%s\n", un.release); exit (0);
+#else
+ printf ("vax-dec-ultrix\n"); exit (0);
+#endif
+#endif
+#endif
+#if defined(ultrix) || defined(_ultrix) || defined(__ultrix) || defined(__ultrix__)
+#if defined(mips) || defined(__mips) || defined(__mips__) || defined(MIPS) || defined(__MIPS__)
+#if defined(_SIZE_T_) || defined(SIGLOST)
+ struct utsname *un;
+ uname (&un);
+ printf ("mips-dec-ultrix%s\n", un.release); exit (0);
+#else
+ printf ("mips-dec-ultrix\n"); exit (0);
+#endif
+#endif
+#endif
+
+#if defined (alliant) && defined (i860)
+ printf ("i860-alliant-bsd\n"); exit (0);
+#endif
+
+ exit (1);
+}
+EOF
+
+$CC_FOR_BUILD -o "$dummy" "$dummy.c" 2>/dev/null && SYSTEM_NAME=`"$dummy"` &&
+	{ echo "$SYSTEM_NAME"; exit; }
+
+# Apollos put the system type in the environment.
+test -d /usr/apollo && { echo "$ISP-apollo-$SYSTYPE"; exit; }
+
+echo "$0: unable to guess system type" >&2
+
+case $UNAME_MACHINE:$UNAME_SYSTEM in
+ mips:Linux | mips64:Linux)
+	# If we got here on MIPS GNU/Linux, output extra information.
+	cat >&2 <<EOF
+
+NOTE: MIPS GNU/Linux systems require a C compiler to fully recognize
+the system type. Please install a C compiler and try again.
+EOF
+	;;
 esac
 
 cat >&2 <<EOF
-$0: unable to guess system type
 
 This script (version $timestamp), has failed to recognize the
-operating system you are using. If your script is old, overwrite
-config.guess and config.sub with the latest versions from:
+operating system you are using. If your script is old, overwrite *all*
+copies of config.guess and config.sub with the latest versions from:
 
- http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess
+ https://git.savannah.gnu.org/cgit/config.git/plain/config.guess
 and
- http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub
+ https://git.savannah.gnu.org/cgit/config.git/plain/config.sub
+EOF
+
+our_year=`echo $timestamp | sed 's,-.*,,'`
+thisyear=`date +%Y`
+# shellcheck disable=SC2003
+script_age=`expr "$thisyear" - "$our_year"`
+if test "$script_age" -lt 3 ; then
+ cat >&2 <<EOF
 
 If $0 has already been updated, send the following data and any
 information you think might be pertinent to config-patches@gnu.org to
@@ -1446,16 +1737,17 @@
 /usr/bin/oslevel = `(/usr/bin/oslevel) 2>/dev/null`
 /usr/convex/getsysinfo = `(/usr/convex/getsysinfo) 2>/dev/null`
 
-UNAME_MACHINE = ${UNAME_MACHINE}
-UNAME_RELEASE = ${UNAME_RELEASE}
-UNAME_SYSTEM = ${UNAME_SYSTEM}
-UNAME_VERSION = ${UNAME_VERSION}
+UNAME_MACHINE = "$UNAME_MACHINE"
+UNAME_RELEASE = "$UNAME_RELEASE"
+UNAME_SYSTEM = "$UNAME_SYSTEM"
+UNAME_VERSION = "$UNAME_VERSION"
 EOF
+fi
 
 exit 1
 
 # Local variables:
-# eval: (add-hook 'write-file-hooks 'time-stamp)
+# eval: (add-hook 'before-save-hook 'time-stamp)
 # time-stamp-start: "timestamp='"
 # time-stamp-format: "%:y-%02m-%02d"
 # time-stamp-end: "'"

_service:tar_scm:stunnel-5.48.tar.gz/auto/config.sub -> _service:tar_scm:stunnel-5.69.tar.gz/auto/config.sub Changed

@@ -1,12 +1,14 @@
 #! /bin/sh
 # Configuration validation subroutine script.
-# Copyright 1992-2016 Free Software Foundation, Inc.
+# Copyright 1992-2022 Free Software Foundation, Inc.
 
-timestamp='2016-11-04'
+# shellcheck disable=SC2006,SC2268 # see below for rationale
+
+timestamp='2022-01-03'
 
 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 3 of the License, or
+# the Free Software Foundation, either version 3 of the License, or
 # (at your option) any later version.
 #
 # This program is distributed in the hope that it will be useful, but
@@ -15,7 +17,7 @@
 # General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
-# along with this program; if not, see <http://www.gnu.org/licenses/>.
+# along with this program; if not, see <https://www.gnu.org/licenses/>.
 #
 # As a special exception to the GNU General Public License, if you
 # distribute this file as part of a program that contains a
@@ -33,7 +35,7 @@
 # Otherwise, we print the canonical config type on stdout and succeed.
 
 # You can get the latest version of this script from:
-# http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub
+# https://git.savannah.gnu.org/cgit/config.git/plain/config.sub
 
 # This file is supposed to be the same for all GNU packages
 # and recognize all the CPU types, system types and aliases
@@ -50,6 +52,13 @@
 #	CPU_TYPE-MANUFACTURER-KERNEL-OPERATING_SYSTEM
 # It is wrong to echo any other type of specification.
 
+# The "shellcheck disable" line above the timestamp inhibits complaints
+# about features and limitations of the classic Bourne shell that were
+# superseded or lifted in POSIX. However, this script identifies a wide
+# variety of pre-POSIX systems that do not have POSIX shells at all, and
+# even some reasonably current systems (Solaris 10 as case-in-point) still
+# have a pre-POSIX /bin/sh.
+
 me=`echo "$0" | sed -e 's,.*/,,'`
 
 usage="\
@@ -57,7 +66,7 @@
 
 Canonicalize a configuration name.
 
-Operation modes:
+Options:
 -h, --help print this help, then exit
 -t, --time-stamp print date of last modification, then exit
 -v, --version print version number, then exit
@@ -67,7 +76,7 @@
 version="\
 GNU config.sub ($timestamp)
 
-Copyright 1992-2016 Free Software Foundation, Inc.
+Copyright 1992-2022 Free Software Foundation, Inc.
 
 This is free software; see the source for copying conditions. There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -89,12 +98,12 @@
 - )	# Use stdin as input.
 break ;;
 -* )
- echo "$me: invalid option $1$help"
+ echo "$me: invalid option $1$help" >&2
 exit 1 ;;
 
 *local*)
 # First pass through any local machine types.
- echo $1
+ echo "$1"
 exit ;;
 
 * )
@@ -110,1244 +119,1186 @@
 exit 1;;
 esac
 
-# Separate what the user gave into CPU-COMPANY and OS or KERNEL-OS (if any).
-# Here we must recognize all the valid KERNEL-OS combinations.
-maybe_os=`echo $1 | sed 's/^$.*$-$^-*-^-*$$/\2/'`
-case $maybe_os in
- nto-qnx* | linux-gnu* | linux-android* | linux-dietlibc | linux-newlib* | \
- linux-musl* | linux-uclibc* | uclinux-uclibc* | uclinux-gnu* | kfreebsd*-gnu* | \
- knetbsd*-gnu* | netbsd*-gnu* | netbsd*-eabi* | \
- kopensolaris*-gnu* | cloudabi*-eabi* | \
- storm-chaos* | os2-emx* | rtmk-nova*)
- os=-$maybe_os
- basic_machine=`echo $1 | sed 's/^$.*$-$^-*-^-*$$/\1/'`
- ;;
- android-linux)
- os=-linux-android
- basic_machine=`echo $1 | sed 's/^$.*$-$^-*-^-*$$/\1/'`-unknown
- ;;
- *)
- basic_machine=`echo $1 | sed 's/-^-*$//'`
- if $basic_machine != $1 
- then os=`echo $1 | sed 's/.*-/-/'`
- else os=; fi
- ;;
-esac
+# Split fields of configuration type
+# shellcheck disable=SC2162
+saved_IFS=$IFS
+IFS="-" read field1 field2 field3 field4 <<EOF
+$1
+EOF
+IFS=$saved_IFS
 
-### Let's recognize common machines as not being operating systems so
-### that things like config.sub decstation-3100 work. We also
-### recognize some manufacturers as not being operating systems, so we
-### can provide default operating systems below.
-case $os in
-	-sun*os*)
-		# Prevent following clause from handling this invalid input.
-		;;
-	-dec* | -mips* | -sequent* | -encore* | -pc532* | -sgi* | -sony* | \
-	-att* | -7300* | -3300* | -delta* | -motorola* | -sun234* | \
-	-unicom* | -ibm* | -next | -hp | -isi* | -apollo | -altos* | \
-	-convergent* | -ncr* | -news | -32* | -3600* | -3100* | -hitachi* |\
-	-c123* | -convex* | -sun | -crds | -omron* | -dg | -ultra | -tti* | \
-	-harris | -dolphin | -highlevel | -gould | -cbm | -ns | -masscomp | \
-	-apple | -axis | -knuth | -cray | -microblaze*)
-		os=
-		basic_machine=$1
-		;;
-	-bluegene*)
-		os=-cnk
-		;;
-	-sim | -cisco | -oki | -wec | -winbond)
-		os=
-		basic_machine=$1
-		;;
-	-scout)
-		;;
-	-wrs)
-		os=-vxworks
-		basic_machine=$1
-		;;
-	-chorusos*)
-		os=-chorusos
-		basic_machine=$1
-		;;
-	-chorusrdb)
-		os=-chorusrdb
-		basic_machine=$1
-		;;
-	-hiux*)
-		os=-hiuxwe2
-		;;
-	-sco6)
-		os=-sco5v6
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
-		;;
-	-sco5)
-		os=-sco3.2v5
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
-		;;
-	-sco4)
-		os=-sco3.2v4
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
-		;;
-	-sco3.2.4-9*)
-		os=`echo $os | sed -e 's/sco3.2./sco3.2v/'`
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
-		;;
-	-sco3.2v4-9*)
-		# Don't forget version if it is 3.2v4 or newer.
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
-		;;
-	-sco5v6*)
-		# Don't forget version if it is 3.2v4 or newer.
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
-		;;
-	-sco*)
-		os=-sco3.2v2
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
-		;;
-	-udk*)
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
-		;;
-	-isc)
-		os=-isc2.2
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
-		;;
-	-clix*)
-		basic_machine=clipper-intergraph
-		;;
-	-isc*)
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
-		;;
-	-lynx*178)
-		os=-lynxos178
-		;;
-	-lynx*5)
-		os=-lynxos5
-		;;
-	-lynx*)
-		os=-lynxos
+# Separate into logical components for further validation
+case $1 in
+	*-*-*-*-*)
+		echo Invalid configuration \`"$1"\': more than four components >&2
+		exit 1
 		;;
-	-ptx*)
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-sequent/'`
+	*-*-*-*)
+		basic_machine=$field1-$field2
+		basic_os=$field3-$field4
 		;;
-	-windowsnt*)
-		os=`echo $os | sed -e 's/windowsnt/winnt/'`
+	*-*-*)
+		# Ambiguous whether COMPANY is present, or skipped and KERNEL-OS is two
+		# parts
+		maybe_os=$field2-$field3
+		case $maybe_os in
+			nto-qnx* | linux-* | uclinux-uclibc* \
+			| uclinux-gnu* | kfreebsd*-gnu* | knetbsd*-gnu* | netbsd*-gnu* \
+			| netbsd*-eabi* | kopensolaris*-gnu* | cloudabi*-eabi* \
+			| storm-chaos* | os2-emx* | rtmk-nova*)
+				basic_machine=$field1
+				basic_os=$maybe_os
+				;;
+			android-linux)
+				basic_machine=$field1-unknown
+				basic_os=linux-android
+				;;
+			*)
+				basic_machine=$field1-$field2
+				basic_os=$field3
+				;;
+		esac
 		;;
-	-psos*)
-		os=-psos
+	*-*)
+		# A lone config we happen to match not fitting any pattern
+		case $field1-$field2 in
+			decstation-3100)
+				basic_machine=mips-dec
+				basic_os=
+				;;
+			*-*)
+				# Second component is usually, but not always the OS
+				case $field2 in
+					# Prevent following clause from handling this valid os
+					sun*os*)
+						basic_machine=$field1
+						basic_os=$field2
+						;;
+					zephyr*)
+						basic_machine=$field1-unknown
+						basic_os=$field2
+						;;
+					# Manufacturers
+					dec* | mips* | sequent* | encore* | pc533* | sgi* | sony* \
+					| att* | 7300* | 3300* | delta* | motorola* | sun234* \
+					| unicom* | ibm* | next | hp | isi* | apollo | altos* \
+					| convergent* | ncr* | news | 32* | 3600* | 3100* \
+					| hitachi* | c123* | convex* | sun | crds | omron* | dg \
+					| ultra | tti* | harris | dolphin | highlevel | gould \
+					| cbm | ns | masscomp | apple | axis | knuth | cray \
+					| microblaze* | sim | cisco \
+					| oki | wec | wrs | winbond)
+						basic_machine=$field1-$field2
+						basic_os=
+						;;
+					*)
+						basic_machine=$field1
+						basic_os=$field2
+						;;
+				esac
+			;;
+		esac
 		;;
-	-mint | -mint0-9*)
-		basic_machine=m68k-atari
-		os=-mint
+	*)
+		# Convert single-component short-hands not valid as part of
+		# multi-component configurations.
+		case $field1 in
+			386bsd)
+				basic_machine=i386-pc
+				basic_os=bsd
+				;;
+			a29khif)
+				basic_machine=a29k-amd
+				basic_os=udi
+				;;
+			adobe68k)
+				basic_machine=m68010-adobe
+				basic_os=scout
+				;;
+			alliant)
+				basic_machine=fx80-alliant
+				basic_os=
+				;;
+			altos | altos3068)
+				basic_machine=m68k-altos
+				basic_os=
+				;;
+			am29k)
+				basic_machine=a29k-none
+				basic_os=bsd
+				;;
+			amdahl)
+				basic_machine=580-amdahl
+				basic_os=sysv
+				;;
+			amiga)
+				basic_machine=m68k-unknown
+				basic_os=
+				;;
+			amigaos | amigados)
+				basic_machine=m68k-unknown
+				basic_os=amigaos
+				;;
+			amigaunix | amix)
+				basic_machine=m68k-unknown
+				basic_os=sysv4
+				;;
+			apollo68)
+				basic_machine=m68k-apollo
+				basic_os=sysv
+				;;
+			apollo68bsd)
+				basic_machine=m68k-apollo
+				basic_os=bsd
+				;;
+			aros)
+				basic_machine=i386-pc
+				basic_os=aros
+				;;
+			aux)
+				basic_machine=m68k-apple
+				basic_os=aux
+				;;
+			balance)
+				basic_machine=ns32k-sequent
+				basic_os=dynix
+				;;
+			blackfin)
+				basic_machine=bfin-unknown
+				basic_os=linux
+				;;
+			cegcc)
+				basic_machine=arm-unknown
+				basic_os=cegcc
+				;;
+			convex-c1)
+				basic_machine=c1-convex
+				basic_os=bsd
+				;;
+			convex-c2)
+				basic_machine=c2-convex
+				basic_os=bsd
+				;;
+			convex-c32)
+				basic_machine=c32-convex
+				basic_os=bsd
+				;;
+			convex-c34)
+				basic_machine=c34-convex
+				basic_os=bsd
+				;;
+			convex-c38)
+				basic_machine=c38-convex
+				basic_os=bsd
+				;;
+			cray)
+				basic_machine=j90-cray
+				basic_os=unicos
+				;;
+			crds | unos)
+				basic_machine=m68k-crds
+				basic_os=
+				;;
+			da30)
+				basic_machine=m68k-da30
+				basic_os=
+				;;
+			decstation | pmax | pmin | dec3100 | decstatn)
+				basic_machine=mips-dec
+				basic_os=
+				;;
+			delta88)
+				basic_machine=m88k-motorola
+				basic_os=sysv3
+				;;
+			dicos)
+				basic_machine=i686-pc
+				basic_os=dicos
+				;;
+			djgpp)
+				basic_machine=i586-pc
+				basic_os=msdosdjgpp
+				;;
+			ebmon29k)
+				basic_machine=a29k-amd
+				basic_os=ebmon
+				;;
+			es1800 | OSE68k | ose68k | ose | OSE)
+				basic_machine=m68k-ericsson
+				basic_os=ose
+				;;
+			gmicro)
+				basic_machine=tron-gmicro
+				basic_os=sysv
+				;;
+			go32)
+				basic_machine=i386-pc
+				basic_os=go32
+				;;
+			h8300hms)
+				basic_machine=h8300-hitachi
+				basic_os=hms
+				;;
+			h8300xray)
+				basic_machine=h8300-hitachi
+				basic_os=xray
+				;;
+			h8500hms)
+				basic_machine=h8500-hitachi
+				basic_os=hms
+				;;
+			harris)
+				basic_machine=m88k-harris
+				basic_os=sysv3
+				;;
+			hp300 | hp300hpux)
+				basic_machine=m68k-hp
+				basic_os=hpux
+				;;
+			hp300bsd)
+				basic_machine=m68k-hp
+				basic_os=bsd
+				;;
+			hppaosf)
+				basic_machine=hppa1.1-hp
+				basic_os=osf
+				;;
+			hppro)
+				basic_machine=hppa1.1-hp
+				basic_os=proelf
+				;;
+			i386mach)
+				basic_machine=i386-mach
+				basic_os=mach
+				;;
+			isi68 | isi)
+				basic_machine=m68k-isi
+				basic_os=sysv
+				;;
+			m68knommu)
+				basic_machine=m68k-unknown
+				basic_os=linux
+				;;
+			magnum | m3230)
+				basic_machine=mips-mips
+				basic_os=sysv
+				;;
+			merlin)
+				basic_machine=ns32k-utek
+				basic_os=sysv
+				;;
+			mingw64)
+				basic_machine=x86_64-pc
+				basic_os=mingw64
+				;;
+			mingw32)
+				basic_machine=i686-pc
+				basic_os=mingw32
+				;;
+			mingw32ce)
+				basic_machine=arm-unknown
+				basic_os=mingw32ce
+				;;
+			monitor)
+				basic_machine=m68k-rom68k
+				basic_os=coff
+				;;
+			morphos)
+				basic_machine=powerpc-unknown
+				basic_os=morphos
+				;;
+			moxiebox)
+				basic_machine=moxie-unknown
+				basic_os=moxiebox
+				;;
+			msdos)
+				basic_machine=i386-pc
+				basic_os=msdos
+				;;
+			msys)
+				basic_machine=i686-pc
+				basic_os=msys
+				;;
+			mvs)
+				basic_machine=i370-ibm
+				basic_os=mvs
+				;;
+			nacl)
+				basic_machine=le32-unknown
+				basic_os=nacl
+				;;
+			ncr3000)
+				basic_machine=i486-ncr
+				basic_os=sysv4
+				;;
+			netbsd386)
+				basic_machine=i386-pc
+				basic_os=netbsd
+				;;
+			netwinder)
+				basic_machine=armv4l-rebel
+				basic_os=linux
+				;;
+			news | news700 | news800 | news900)
+				basic_machine=m68k-sony
+				basic_os=newsos
+				;;
+			news1000)
+				basic_machine=m68030-sony
+				basic_os=newsos
+				;;
+			necv70)
+				basic_machine=v70-nec
+				basic_os=sysv
+				;;
+			nh3000)
+				basic_machine=m68k-harris
+				basic_os=cxux
+				;;
+			nh45000)
+				basic_machine=m88k-harris
+				basic_os=cxux
+				;;
+			nindy960)
+				basic_machine=i960-intel
+				basic_os=nindy
+				;;
+			mon960)
+				basic_machine=i960-intel
+				basic_os=mon960
+				;;
+			nonstopux)
+				basic_machine=mips-compaq
+				basic_os=nonstopux
+				;;
+			os400)
+				basic_machine=powerpc-ibm
+				basic_os=os400
+				;;
+			OSE68000 | ose68000)
+				basic_machine=m68000-ericsson
+				basic_os=ose
+				;;
+			os68k)
+				basic_machine=m68k-none
+				basic_os=os68k
+				;;
+			paragon)
+				basic_machine=i860-intel
+				basic_os=osf
+				;;
+			parisc)
+				basic_machine=hppa-unknown
+				basic_os=linux
+				;;
+			psp)
+				basic_machine=mipsallegrexel-sony
+				basic_os=psp
+				;;
+			pw32)
+				basic_machine=i586-unknown
+				basic_os=pw32
+				;;
+			rdos | rdos64)
+				basic_machine=x86_64-pc
+				basic_os=rdos
+				;;
+			rdos32)
+				basic_machine=i386-pc
+				basic_os=rdos
+				;;
+			rom68k)
+				basic_machine=m68k-rom68k
+				basic_os=coff
+				;;
+			sa29200)
+				basic_machine=a29k-amd
+				basic_os=udi
+				;;
+			sei)
+				basic_machine=mips-sei
+				basic_os=seiux
+				;;
+			sequent)
+				basic_machine=i386-sequent
+				basic_os=
+				;;
+			sps7)
+				basic_machine=m68k-bull
+				basic_os=sysv2
+				;;
+			st2000)
+				basic_machine=m68k-tandem
+				basic_os=
+				;;
+			stratus)
+				basic_machine=i860-stratus
+				basic_os=sysv4
+				;;
+			sun2)
+				basic_machine=m68000-sun
+				basic_os=
+				;;
+			sun2os3)
+				basic_machine=m68000-sun
+				basic_os=sunos3
+				;;
+			sun2os4)
+				basic_machine=m68000-sun
+				basic_os=sunos4
+				;;
+			sun3)
+				basic_machine=m68k-sun
+				basic_os=
+				;;
+			sun3os3)
+				basic_machine=m68k-sun
+				basic_os=sunos3
+				;;
+			sun3os4)
+				basic_machine=m68k-sun
+				basic_os=sunos4
+				;;
+			sun4)
+				basic_machine=sparc-sun
+				basic_os=
+				;;
+			sun4os3)
+				basic_machine=sparc-sun
+				basic_os=sunos3
+				;;
+			sun4os4)
+				basic_machine=sparc-sun
+				basic_os=sunos4
+				;;
+			sun4sol2)
+				basic_machine=sparc-sun
+				basic_os=solaris2
+				;;
+			sun386 | sun386i | roadrunner)
+				basic_machine=i386-sun
+				basic_os=
+				;;
+			sv1)
+				basic_machine=sv1-cray
+				basic_os=unicos
+				;;
+			symmetry)
+				basic_machine=i386-sequent
+				basic_os=dynix
+				;;
+			t3e)
+				basic_machine=alphaev5-cray
+				basic_os=unicos
+				;;
+			t90)
+				basic_machine=t90-cray
+				basic_os=unicos
+				;;
+			toad1)
+				basic_machine=pdp10-xkl
+				basic_os=tops20
+				;;
+			tpf)
+				basic_machine=s390x-ibm
+				basic_os=tpf
+				;;
+			udi29k)
+				basic_machine=a29k-amd
+				basic_os=udi
+				;;
+			ultra3)
+				basic_machine=a29k-nyu
+				basic_os=sym1
+				;;
+			v810 | necv810)
+				basic_machine=v810-nec
+				basic_os=none
+				;;
+			vaxv)
+				basic_machine=vax-dec
+				basic_os=sysv
+				;;
+			vms)
+				basic_machine=vax-dec
+				basic_os=vms
+				;;
+			vsta)
+				basic_machine=i386-pc
+				basic_os=vsta
+				;;
+			vxworks960)
+				basic_machine=i960-wrs
+				basic_os=vxworks
+				;;
+			vxworks68)
+				basic_machine=m68k-wrs
+				basic_os=vxworks
+				;;
+			vxworks29k)
+				basic_machine=a29k-wrs
+				basic_os=vxworks
+				;;
+			xbox)
+				basic_machine=i686-pc
+				basic_os=mingw32
+				;;
+			ymp)
+				basic_machine=ymp-cray
+				basic_os=unicos
+				;;
+			*)
+				basic_machine=$1
+				basic_os=
+				;;
+		esac
 		;;
 esac
 
-# Decode aliases for certain CPU-COMPANY combinations.
+# Decode 1-component or ad-hoc basic machines
 case $basic_machine in
-	# Recognize the basic CPU types without company name.
-	# Some are omitted here because they have special meanings below.
-	1750a | 580 \
-	| a29k \
-	| aarch64 | aarch64_be \
-	| alpha | alphaev4-8 | alphaev56 | alphaev678 | alphapca567 \
-	| alpha64 | alpha64ev4-8 | alpha64ev56 | alpha64ev678 | alpha64pca567 \
-	| am33_2.0 \
-	| arc | arceb \
-	| arm | armble | armelb | armv2-8 | armv3-8lb | armv7arm \
-	| avr | avr32 \
-	| ba \
-	| be32 | be64 \
-	| bfin \
-	| c4x | c8051 | clipper \
-	| d10v | d30v | dlx | dsp16xx \
-	| e2k | epiphany \
-	| fido | fr30 | frv | ft32 \
-	| h8300 | h8500 | hppa | hppa1.01 | hppa2.0 | hppa2.0nw | hppa64 \
-	| hexagon \
-	| i370 | i860 | i960 | ia64 \
-	| ip2k | iq2000 \
-	| k1om \
-	| le32 | le64 \
-	| lm32 \
-	| m32c | m32r | m32rle | m68000 | m68k | m88k \
-	| maxq | mb | microblaze | microblazeel | mcore | mep | metag \
-	| mips | mipsbe | mipseb | mipsel | mipsle \
-	| mips16 \
-	| mips64 | mips64el \
-	| mips64octeon | mips64octeonel \
-	| mips64orion | mips64orionel \
-	| mips64r5900 | mips64r5900el \
-	| mips64vr | mips64vrel \
-	| mips64vr4100 | mips64vr4100el \
-	| mips64vr4300 | mips64vr4300el \
-	| mips64vr5000 | mips64vr5000el \
-	| mips64vr5900 | mips64vr5900el \
-	| mipsisa32 | mipsisa32el \
-	| mipsisa32r2 | mipsisa32r2el \
-	| mipsisa32r6 | mipsisa32r6el \
-	| mipsisa64 | mipsisa64el \
-	| mipsisa64r2 | mipsisa64r2el \
-	| mipsisa64r6 | mipsisa64r6el \
-	| mipsisa64sb1 | mipsisa64sb1el \
-	| mipsisa64sr71k | mipsisa64sr71kel \
-	| mipsr5900 | mipsr5900el \
-	| mipstx39 | mipstx39el \
-	| mn10200 | mn10300 \
-	| moxie \
-	| mt \
-	| msp430 \
-	| nds32 | nds32le | nds32be \
-	| nios | nios2 | nios2eb | nios2el \
-	| ns16k | ns32k \
-	| open8 | or1k | or1knd | or32 \
-	| pdp10 | pdp11 | pj | pjl \
-	| powerpc | powerpc64 | powerpc64le | powerpcle \
-	| pru \
-	| pyramid \
-	| riscv32 | riscv64 \
-	| rl78 | rx \
-	| score \
-	| sh | sh1234 | sh24a | sh24aeb | sh23e | sh234eb | sheb | shbe | shle | sh1234le | sh3ele \
-	| sh64 | sh64le \
-	| sparc | sparc64 | sparc64b | sparc64v | sparc86x | sparclet | sparclite \
-	| sparcv8 | sparcv9 | sparcv9b | sparcv9v \
-	| spu \
-	| tahoe | tic4x | tic54x | tic55x | tic6x | tic80 | tron \
-	| ubicom32 \
-	| v850 | v850e | v850e1 | v850e2 | v850es | v850e2v3 \
-	| visium \
-	| we32k \
-	| x86 | xc16x | xstormy16 | xtensa \
-	| z8k | z80)
-		basic_machine=$basic_machine-unknown
-		;;
-	c54x)
-		basic_machine=tic54x-unknown
-		;;
-	c55x)
-		basic_machine=tic55x-unknown
-		;;
-	c6x)
-		basic_machine=tic6x-unknown
-		;;
-	leon|leon3-9)
-		basic_machine=sparc-$basic_machine
-		;;
-	m6811 | m68hc11 | m6812 | m68hc12 | m68hcs12x | nvptx | picochip)
-		basic_machine=$basic_machine-unknown
-		os=-none
+	# Here we handle the default manufacturer of certain CPU types. It is in
+	# some cases the only manufacturer, in others, it is the most popular.
+	w89k)
+		cpu=hppa1.1
+		vendor=winbond
 		;;
-	m88110 | m680123460 | m683?2 | m68360 | m5200 | v70 | w65 | z8k)
+	op50n)
+		cpu=hppa1.1
+		vendor=oki
 		;;
-	ms1)
-		basic_machine=mt-unknown
+	op60c)
+		cpu=hppa1.1
+		vendor=oki
 		;;
-
-	strongarm | thumb | xscale)
-		basic_machine=arm-unknown
+	ibm*)
+		cpu=i370
+		vendor=ibm
 		;;
-	xgate)
-		basic_machine=$basic_machine-unknown
-		os=-none
+	orion105)
+		cpu=clipper
+		vendor=highlevel
 		;;
-	xscaleeb)
-		basic_machine=armeb-unknown
+	mac | mpw | mac-mpw)
+		cpu=m68k
+		vendor=apple
 		;;
-
-	xscaleel)
-		basic_machine=armel-unknown
+	pmac | pmac-mpw)
+		cpu=powerpc
+		vendor=apple
 		;;
 
-	# We use `pc' rather than `unknown'
-	# because (1) that's what they normally are, and
-	# (2) the word "unknown" tends to confuse beginning users.
-	i*86 | x86_64)
-	 basic_machine=$basic_machine-pc
-	 ;;
-	# Object if more than one company name word.
-	*-*-*)
-		echo Invalid configuration \`$1\': machine \`$basic_machine\' not recognized 1>&2
-		exit 1
-		;;
-	# Recognize the basic CPU types with company name.
-	580-* \
-	| a29k-* \
-	| aarch64-* | aarch64_be-* \
-	| alpha-* | alphaev4-8-* | alphaev56-* | alphaev678-* \
-	| alpha64-* | alpha64ev4-8-* | alpha64ev56-* | alpha64ev678-* \
-	| alphapca567-* | alpha64pca567-* | arc-* | arceb-* \
-	| arm-* | armbe-* | armle-* | armeb-* | armv*-* \
-	| avr-* | avr32-* \
-	| ba-* \
-	| be32-* | be64-* \
-	| bfin-* | bs2000-* \
-	| c123* | c30-* | cjt90-* | c4x-* \
-	| c8051-* | clipper-* | craynv-* | cydra-* \
-	| d10v-* | d30v-* | dlx-* \
-	| e2k-* | elxsi-* \
-	| f3001-* | f700-* | fido-* | fr30-* | frv-* | fx80-* \
-	| h8300-* | h8500-* \
-	| hppa-* | hppa1.01-* | hppa2.0-* | hppa2.0nw-* | hppa64-* \
-	| hexagon-* \
-	| i*86-* | i860-* | i960-* | ia64-* \
-	| ip2k-* | iq2000-* \
-	| k1om-* \
-	| le32-* | le64-* \
-	| lm32-* \
-	| m32c-* | m32r-* | m32rle-* \
-	| m68000-* | m6800123460-* | m68360-* | m683?2-* | m68k-* \
-	| m88110-* | m88k-* | maxq-* | mcore-* | metag-* \
-	| microblaze-* | microblazeel-* \
-	| mips-* | mipsbe-* | mipseb-* | mipsel-* | mipsle-* \
-	| mips16-* \
-	| mips64-* | mips64el-* \
-	| mips64octeon-* | mips64octeonel-* \
-	| mips64orion-* | mips64orionel-* \
-	| mips64r5900-* | mips64r5900el-* \
-	| mips64vr-* | mips64vrel-* \
-	| mips64vr4100-* | mips64vr4100el-* \
-	| mips64vr4300-* | mips64vr4300el-* \
-	| mips64vr5000-* | mips64vr5000el-* \
-	| mips64vr5900-* | mips64vr5900el-* \
-	| mipsisa32-* | mipsisa32el-* \
-	| mipsisa32r2-* | mipsisa32r2el-* \
-	| mipsisa32r6-* | mipsisa32r6el-* \
-	| mipsisa64-* | mipsisa64el-* \
-	| mipsisa64r2-* | mipsisa64r2el-* \
-	| mipsisa64r6-* | mipsisa64r6el-* \
-	| mipsisa64sb1-* | mipsisa64sb1el-* \
-	| mipsisa64sr71k-* | mipsisa64sr71kel-* \
-	| mipsr5900-* | mipsr5900el-* \
-	| mipstx39-* | mipstx39el-* \
-	| mmix-* \
-	| mt-* \
-	| msp430-* \
-	| nds32-* | nds32le-* | nds32be-* \
-	| nios-* | nios2-* | nios2eb-* | nios2el-* \
-	| none-* | np1-* | ns16k-* | ns32k-* \
-	| open8-* \
-	| or1k*-* \
-	| orion-* \
-	| pdp10-* | pdp11-* | pj-* | pjl-* | pn-* | power-* \
-	| powerpc-* | powerpc64-* | powerpc64le-* | powerpcle-* \
-	| pru-* \
-	| pyramid-* \
-	| riscv32-* | riscv64-* \
-	| rl78-* | romp-* | rs6000-* | rx-* \
-	| sh-* | sh1234-* | sh24a-* | sh24aeb-* | sh23e-* | sh34eb-* | sheb-* | shbe-* \
-	| shle-* | sh1234le-* | sh3ele-* | sh64-* | sh64le-* \
-	| sparc-* | sparc64-* | sparc64b-* | sparc64v-* | sparc86x-* | sparclet-* \
-	| sparclite-* \
-	| sparcv8-* | sparcv9-* | sparcv9b-* | sparcv9v-* | sv1-* | sx*-* \
-	| tahoe-* \
-	| tic30-* | tic4x-* | tic54x-* | tic55x-* | tic6x-* | tic80-* \
-	| tile*-* \
-	| tron-* \
-	| ubicom32-* \
-	| v850-* | v850e-* | v850e1-* | v850es-* | v850e2-* | v850e2v3-* \
-	| vax-* \
-	| visium-* \
-	| we32k-* \
-	| x86-* | x86_64-* | xc16x-* | xps100-* \
-	| xstormy16-* | xtensa*-* \
-	| ymp-* \
-	| z8k-* | z80-*)
-		;;
-	# Recognize the basic CPU types without company name, with glob match.
-	xtensa*)
-		basic_machine=$basic_machine-unknown
-		;;
 	# Recognize the various machine names and aliases which stand
 	# for a CPU type and a company and sometimes even an OS.
-	386bsd)
-		basic_machine=i386-unknown
-		os=-bsd
-		;;
 	3b1 | 7300 | 7300-att | att-7300 | pc7300 | safari | unixpc)
-		basic_machine=m68000-att
+		cpu=m68000
+		vendor=att
 		;;
 	3b*)
-		basic_machine=we32k-att
-		;;
-	a29khif)
-		basic_machine=a29k-amd
-		os=-udi
-		;;
-	abacus)
-		basic_machine=abacus-unknown
-		;;
-	adobe68k)
-		basic_machine=m68010-adobe
-		os=-scout
-		;;
-	alliant | fx80)
-		basic_machine=fx80-alliant
-		;;
-	altos | altos3068)
-		basic_machine=m68k-altos
-		;;
-	am29k)
-		basic_machine=a29k-none
-		os=-bsd
-		;;
-	amd64)
-		basic_machine=x86_64-pc
-		;;
-	amd64-*)
-		basic_machine=x86_64-`echo $basic_machine | sed 's/^^-*-//'`
-		;;
-	amdahl)
-		basic_machine=580-amdahl
-		os=-sysv
-		;;
-	amiga | amiga-*)
-		basic_machine=m68k-unknown
-		;;
-	amigaos | amigados)
-		basic_machine=m68k-unknown
-		os=-amigaos
-		;;
-	amigaunix | amix)
-		basic_machine=m68k-unknown
-		os=-sysv4
-		;;
-	apollo68)
-		basic_machine=m68k-apollo
-		os=-sysv
-		;;
-	apollo68bsd)
-		basic_machine=m68k-apollo
-		os=-bsd
-		;;
-	aros)
-		basic_machine=i386-pc
-		os=-aros
-		;;
-	asmjs)
-		basic_machine=asmjs-unknown
-		;;
-	aux)
-		basic_machine=m68k-apple
-		os=-aux
-		;;
-	balance)
-		basic_machine=ns32k-sequent
-		os=-dynix
-		;;
-	blackfin)
-		basic_machine=bfin-unknown
-		os=-linux
-		;;
-	blackfin-*)
-		basic_machine=bfin-`echo $basic_machine | sed 's/^^-*-//'`
-		os=-linux
+		cpu=we32k
+		vendor=att
 		;;
 	bluegene*)
-		basic_machine=powerpc-ibm
-		os=-cnk
-		;;
-	c54x-*)
-		basic_machine=tic54x-`echo $basic_machine | sed 's/^^-*-//'`
-		;;
-	c55x-*)
-		basic_machine=tic55x-`echo $basic_machine | sed 's/^^-*-//'`
-		;;
-	c6x-*)
-		basic_machine=tic6x-`echo $basic_machine | sed 's/^^-*-//'`
-		;;
-	c90)
-		basic_machine=c90-cray
-		os=-unicos
-		;;
-	cegcc)
-		basic_machine=arm-unknown
-		os=-cegcc
-		;;
-	convex-c1)
-		basic_machine=c1-convex
-		os=-bsd
-		;;
-	convex-c2)
-		basic_machine=c2-convex
-		os=-bsd
-		;;
-	convex-c32)
-		basic_machine=c32-convex
-		os=-bsd
-		;;
-	convex-c34)
-		basic_machine=c34-convex
-		os=-bsd
-		;;
-	convex-c38)
-		basic_machine=c38-convex
-		os=-bsd
-		;;
-	cray | j90)
-		basic_machine=j90-cray
-		os=-unicos
-		;;
-	craynv)
-		basic_machine=craynv-cray
-		os=-unicosmp
-		;;
-	cr16 | cr16-*)
-		basic_machine=cr16-unknown
-		os=-elf
-		;;
-	crds | unos)
-		basic_machine=m68k-crds
-		;;
-	crisv32 | crisv32-* | etraxfs*)
-		basic_machine=crisv32-axis
-		;;
-	cris | cris-* | etrax*)
-		basic_machine=cris-axis
-		;;
-	crx)
-		basic_machine=crx-unknown
-		os=-elf
-		;;
-	da30 | da30-*)
-		basic_machine=m68k-da30
-		;;
-	decstation | decstation-3100 | pmax | pmax-* | pmin | dec3100 | decstatn)
-		basic_machine=mips-dec
+		cpu=powerpc
+		vendor=ibm
+		basic_os=cnk
 		;;
 	decsystem10* | dec10*)
-		basic_machine=pdp10-dec
-		os=-tops10
+		cpu=pdp10
+		vendor=dec
+		basic_os=tops10
 		;;
 	decsystem20* | dec20*)
-		basic_machine=pdp10-dec
-		os=-tops20
+		cpu=pdp10
+		vendor=dec
+		basic_os=tops20
 		;;
 	delta | 3300 | motorola-3300 | motorola-delta \
 	 | 3300-motorola | delta-motorola)
-		basic_machine=m68k-motorola
-		;;
-	delta88)
-		basic_machine=m88k-motorola
-		os=-sysv3
-		;;
-	dicos)
-		basic_machine=i686-pc
-		os=-dicos
+		cpu=m68k
+		vendor=motorola
 		;;
-	djgpp)
-		basic_machine=i586-pc
-		os=-msdosdjgpp
-		;;
-	dpx20 | dpx20-*)
-		basic_machine=rs6000-bull
-		os=-bosx
-		;;
-	dpx2* | dpx2*-bull)
-		basic_machine=m68k-bull
-		os=-sysv3
-		;;
-	e500v12)
-		basic_machine=powerpc-unknown
-		os=$os"spe"
-		;;
-	e500v12-*)
-		basic_machine=powerpc-`echo $basic_machine | sed 's/^^-*-//'`
-		os=$os"spe"
-		;;
-	ebmon29k)
-		basic_machine=a29k-amd
-		os=-ebmon
-		;;
-	elxsi)
-		basic_machine=elxsi-elxsi
-		os=-bsd
+	dpx2*)
+		cpu=m68k
+		vendor=bull
+		basic_os=sysv3
 		;;
 	encore | umax | mmax)
-		basic_machine=ns32k-encore
+		cpu=ns32k
+		vendor=encore
 		;;
-	es1800 | OSE68k | ose68k | ose | OSE)
-		basic_machine=m68k-ericsson
-		os=-ose
+	elxsi)
+		cpu=elxsi
+		vendor=elxsi
+		basic_os=${basic_os:-bsd}
 		;;
 	fx2800)
-		basic_machine=i860-alliant
+		cpu=i860
+		vendor=alliant
 		;;
 	genix)
-		basic_machine=ns32k-ns
-		;;
-	gmicro)
-		basic_machine=tron-gmicro
-		os=-sysv
-		;;
-	go32)
-		basic_machine=i386-pc
-		os=-go32
+		cpu=ns32k
+		vendor=ns
 		;;
 	h3050r* | hiux*)
-		basic_machine=hppa1.1-hitachi
-		os=-hiuxwe2
-		;;
-	h8300hms)
-		basic_machine=h8300-hitachi
-		os=-hms
-		;;
-	h8300xray)
-		basic_machine=h8300-hitachi
-		os=-xray
-		;;
-	h8500hms)
-		basic_machine=h8500-hitachi
-		os=-hms
-		;;
-	harris)
-		basic_machine=m88k-harris
-		os=-sysv3
-		;;
-	hp300-*)
-		basic_machine=m68k-hp
-		;;
-	hp300bsd)
-		basic_machine=m68k-hp
-		os=-bsd
-		;;
-	hp300hpux)
-		basic_machine=m68k-hp
-		os=-hpux
+		cpu=hppa1.1
+		vendor=hitachi
+		basic_os=hiuxwe2
 		;;
 	hp3k90-90-9 | hp90-90-9)
-		basic_machine=hppa1.0-hp
+		cpu=hppa1.0
+		vendor=hp
 		;;
 	hp9k20-90-9 | hp9k310-9)
-		basic_machine=m68000-hp
+		cpu=m68000
+		vendor=hp
 		;;
 	hp9k32-90-9)
-		basic_machine=m68k-hp
+		cpu=m68k
+		vendor=hp
 		;;
 	hp9k60-90-9 | hp60-90-9)
-		basic_machine=hppa1.0-hp
+		cpu=hppa1.0
+		vendor=hp
 		;;
 	hp9k70-790-9 | hp70-790-9)
-		basic_machine=hppa1.1-hp
+		cpu=hppa1.1
+		vendor=hp
 		;;
 	hp9k780-9 | hp780-9)
 		# FIXME: really hppa2.0-hp
-		basic_machine=hppa1.1-hp
+		cpu=hppa1.1
+		vendor=hp
 		;;
 	hp9k8671 | hp8671 | hp9k8024 | hp8024 | hp9k8789 | hp8789 | hp9k893 | hp893)
 		# FIXME: really hppa2.0-hp
-		basic_machine=hppa1.1-hp
+		cpu=hppa1.1
+		vendor=hp
 		;;
 	hp9k80-913679 | hp80-913679)
-		basic_machine=hppa1.1-hp
+		cpu=hppa1.1
+		vendor=hp
 		;;
 	hp9k80-90-9 | hp80-90-9)
-		basic_machine=hppa1.0-hp
-		;;
-	hppa-next)
-		os=-nextstep3
-		;;
-	hppaosf)
-		basic_machine=hppa1.1-hp
-		os=-osf
-		;;
-	hppro)
-		basic_machine=hppa1.1-hp
-		os=-proelf
-		;;
-	i370-ibm* | ibm*)
-		basic_machine=i370-ibm
+		cpu=hppa1.0
+		vendor=hp
 		;;
 	i*86v32)
-		basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'`
-		os=-sysv32
+		cpu=`echo "$1" | sed -e 's/86.*/86/'`
+		vendor=pc
+		basic_os=sysv32
 		;;
 	i*86v4*)
-		basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'`
-		os=-sysv4
+		cpu=`echo "$1" | sed -e 's/86.*/86/'`
+		vendor=pc
+		basic_os=sysv4
 		;;
 	i*86v)
-		basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'`
-		os=-sysv
+		cpu=`echo "$1" | sed -e 's/86.*/86/'`
+		vendor=pc
+		basic_os=sysv
 		;;
 	i*86sol2)
-		basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'`
-		os=-solaris2
+		cpu=`echo "$1" | sed -e 's/86.*/86/'`
+		vendor=pc
+		basic_os=solaris2
 		;;
-	i386mach)
-		basic_machine=i386-mach
-		os=-mach
-		;;
-	i386-vsta | vsta)
-		basic_machine=i386-unknown
-		os=-vsta
+	j90 | j90-cray)
+		cpu=j90
+		vendor=cray
+		basic_os=${basic_os:-unicos}
 		;;
 	iris | iris4d)
-		basic_machine=mips-sgi
-		case $os in
-		 -irix*)
+		cpu=mips
+		vendor=sgi
+		case $basic_os in
+		 irix*)
 			;;
 		 *)
-			os=-irix4
+			basic_os=irix4
 			;;
 		esac
 		;;
-	isi68 | isi)
-		basic_machine=m68k-isi
-		os=-sysv
-		;;
-	leon-*|leon3-9-*)
-		basic_machine=sparc-`echo $basic_machine | sed 's/-.*//'`
-		;;
-	m68knommu)
-		basic_machine=m68k-unknown
-		os=-linux
-		;;
-	m68knommu-*)
-		basic_machine=m68k-`echo $basic_machine | sed 's/^^-*-//'`
-		os=-linux
-		;;
-	m88k-omron*)
-		basic_machine=m88k-omron
-		;;
-	magnum | m3230)
-		basic_machine=mips-mips
-		os=-sysv
-		;;
-	merlin)
-		basic_machine=ns32k-utek
-		os=-sysv
-		;;
-	microblaze*)
-		basic_machine=microblaze-xilinx
-		;;
-	mingw64)
-		basic_machine=x86_64-pc
-		os=-mingw64
-		;;
-	mingw32)
-		basic_machine=i686-pc
-		os=-mingw32
-		;;
-	mingw32ce)
-		basic_machine=arm-unknown
-		os=-mingw32ce
-		;;
 	miniframe)
-		basic_machine=m68000-convergent
-		;;
-	*mint | -mint0-9* | *MiNT | *MiNT0-9*)
-		basic_machine=m68k-atari
-		os=-mint
-		;;
-	mips3*-*)
-		basic_machine=`echo $basic_machine | sed -e 's/mips3/mips64/'`
-		;;
-	mips3*)
-		basic_machine=`echo $basic_machine | sed -e 's/mips3/mips64/'`-unknown
-		;;
-	monitor)
-		basic_machine=m68k-rom68k
-		os=-coff
-		;;
-	morphos)
-		basic_machine=powerpc-unknown
-		os=-morphos
-		;;
-	moxiebox)
-		basic_machine=moxie-unknown
-		os=-moxiebox
-		;;
-	msdos)
-		basic_machine=i386-pc
-		os=-msdos
-		;;
-	ms1-*)
-		basic_machine=`echo $basic_machine | sed -e 's/ms1-/mt-/'`
-		;;
-	msys)
-		basic_machine=i686-pc
-		os=-msys
-		;;
-	mvs)
-		basic_machine=i370-ibm
-		os=-mvs
-		;;
-	nacl)
-		basic_machine=le32-unknown
-		os=-nacl
+		cpu=m68000
+		vendor=convergent
 		;;
-	ncr3000)
-		basic_machine=i486-ncr
-		os=-sysv4
-		;;
-	netbsd386)
-		basic_machine=i386-unknown
-		os=-netbsd
-		;;
-	netwinder)
-		basic_machine=armv4l-rebel
-		os=-linux
-		;;
-	news | news700 | news800 | news900)
-		basic_machine=m68k-sony
-		os=-newsos
-		;;
-	news1000)
-		basic_machine=m68030-sony
-		os=-newsos
+	*mint | mint0-9* | *MiNT | *MiNT0-9*)
+		cpu=m68k
+		vendor=atari
+		basic_os=mint
 		;;
 	news-3600 | risc-news)
-		basic_machine=mips-sony
-		os=-newsos
-		;;
-	necv70)
-		basic_machine=v70-nec
-		os=-sysv
-		;;
-	next | m*-next )
-		basic_machine=m68k-next
-		case $os in
-		 -nextstep* )
+		cpu=mips
+		vendor=sony
+		basic_os=newsos
+		;;
+	next | m*-next)
+		cpu=m68k
+		vendor=next
+		case $basic_os in
+		 openstep*)
+		 ;;
+		 nextstep*)
 			;;
-		 -ns2*)
-		 os=-nextstep2
+		 ns2*)
+		 basic_os=nextstep2
 			;;
 		 *)
-		 os=-nextstep3
+		 basic_os=nextstep3
 			;;
 		esac
 		;;
-	nh3000)
-		basic_machine=m68k-harris
-		os=-cxux
-		;;
-	nh45000)
-		basic_machine=m88k-harris
-		os=-cxux
-		;;
-	nindy960)
-		basic_machine=i960-intel
-		os=-nindy
-		;;
-	mon960)
-		basic_machine=i960-intel
-		os=-mon960
-		;;
-	nonstopux)
-		basic_machine=mips-compaq
-		os=-nonstopux
-		;;
 	np1)
-		basic_machine=np1-gould
-		;;
-	neo-tandem)
-		basic_machine=neo-tandem
-		;;
-	nse-tandem)
-		basic_machine=nse-tandem
-		;;
-	nsr-tandem)
-		basic_machine=nsr-tandem
+		cpu=np1
+		vendor=gould
 		;;
 	op50n-* | op60c-*)
-		basic_machine=hppa1.1-oki
-		os=-proelf
-		;;
-	openrisc | openrisc-*)
-		basic_machine=or32-unknown
-		;;
-	os400)
-		basic_machine=powerpc-ibm
-		os=-os400
-		;;
-	OSE68000 | ose68000)
-		basic_machine=m68000-ericsson
-		os=-ose
-		;;
-	os68k)
-		basic_machine=m68k-none
-		os=-os68k
+		cpu=hppa1.1
+		vendor=oki
+		basic_os=proelf
 		;;
 	pa-hitachi)
-		basic_machine=hppa1.1-hitachi
-		os=-hiuxwe2
-		;;
-	paragon)
-		basic_machine=i860-intel
-		os=-osf
-		;;
-	parisc)
-		basic_machine=hppa-unknown
-		os=-linux
-		;;
-	parisc-*)
-		basic_machine=hppa-`echo $basic_machine | sed 's/^^-*-//'`
-		os=-linux
+		cpu=hppa1.1
+		vendor=hitachi
+		basic_os=hiuxwe2
 		;;
 	pbd)
-		basic_machine=sparc-tti
+		cpu=sparc
+		vendor=tti
 		;;
 	pbb)
-		basic_machine=m68k-tti
-		;;
-	pc532 | pc532-*)
-		basic_machine=ns32k-pc532
-		;;
-	pc98)
-		basic_machine=i386-pc
+		cpu=m68k
+		vendor=tti
 		;;
-	pc98-*)
-		basic_machine=i386-`echo $basic_machine | sed 's/^^-*-//'`
-		;;
-	pentium | p5 | k5 | k6 | nexgen | viac3)
-		basic_machine=i586-pc
-		;;
-	pentiumpro | p6 | 6x86 | athlon | athlon_*)
-		basic_machine=i686-pc
-		;;
-	pentiumii | pentium2 | pentiumiii | pentium3)
-		basic_machine=i686-pc
-		;;
-	pentium4)
-		basic_machine=i786-pc
-		;;
-	pentium-* | p5-* | k5-* | k6-* | nexgen-* | viac3-*)
-		basic_machine=i586-`echo $basic_machine | sed 's/^^-*-//'`
-		;;
-	pentiumpro-* | p6-* | 6x86-* | athlon-*)
-		basic_machine=i686-`echo $basic_machine | sed 's/^^-*-//'`
-		;;
-	pentiumii-* | pentium2-* | pentiumiii-* | pentium3-*)
-		basic_machine=i686-`echo $basic_machine | sed 's/^^-*-//'`
-		;;
-	pentium4-*)
-		basic_machine=i786-`echo $basic_machine | sed 's/^^-*-//'`
+	pc532)
+		cpu=ns32k
+		vendor=pc532
 		;;
 	pn)
-		basic_machine=pn-gould
-		;;
-	power)	basic_machine=power-ibm
-		;;
-	ppc | ppcbe)	basic_machine=powerpc-unknown
+		cpu=pn
+		vendor=gould
 		;;
-	ppc-* | ppcbe-*)
-		basic_machine=powerpc-`echo $basic_machine | sed 's/^^-*-//'`
-		;;
-	ppcle | powerpclittle)
-		basic_machine=powerpcle-unknown
-		;;
-	ppcle-* | powerpclittle-*)
-		basic_machine=powerpcle-`echo $basic_machine | sed 's/^^-*-//'`
-		;;
-	ppc64)	basic_machine=powerpc64-unknown
-		;;
-	ppc64-*) basic_machine=powerpc64-`echo $basic_machine | sed 's/^^-*-//'`
-		;;
-	ppc64le | powerpc64little)
-		basic_machine=powerpc64le-unknown
-		;;
-	ppc64le-* | powerpc64little-*)
-		basic_machine=powerpc64le-`echo $basic_machine | sed 's/^^-*-//'`
+	power)
+		cpu=power
+		vendor=ibm
 		;;
 	ps2)
-		basic_machine=i386-ibm
-		;;
-	pw32)
-		basic_machine=i586-unknown
-		os=-pw32
-		;;
-	rdos | rdos64)
-		basic_machine=x86_64-pc
-		os=-rdos
-		;;
-	rdos32)
-		basic_machine=i386-pc
-		os=-rdos
-		;;
-	rom68k)
-		basic_machine=m68k-rom68k
-		os=-coff
+		cpu=i386
+		vendor=ibm
 		;;
 	rm4600)
-		basic_machine=mips-siemens
+		cpu=mips
+		vendor=siemens
 		;;
 	rtpc | rtpc-*)
-		basic_machine=romp-ibm
-		;;
-	s390 | s390-*)
-		basic_machine=s390-ibm
+		cpu=romp
+		vendor=ibm
 		;;
-	s390x | s390x-*)
-		basic_machine=s390x-ibm
-		;;
-	sa29200)
-		basic_machine=a29k-amd
-		os=-udi
+	sde)
+		cpu=mipsisa32
+		vendor=sde
+		basic_os=${basic_os:-elf}
 		;;
-	sb1)
-		basic_machine=mipsisa64sb1-unknown
+	simso-wrs)
+		cpu=sparclite
+		vendor=wrs
+		basic_os=vxworks
 		;;
-	sb1el)
-		basic_machine=mipsisa64sb1el-unknown
+	tower | tower-32)
+		cpu=m68k
+		vendor=ncr
 		;;
-	sde)
-		basic_machine=mipsisa32-sde
-		os=-elf
+	vpp*|vx|vx-*)
+		cpu=f301
+		vendor=fujitsu
 		;;
-	sei)
-		basic_machine=mips-sei
-		os=-seiux
+	w65)
+		cpu=w65
+		vendor=wdc
 		;;
-	sequent)
-		basic_machine=i386-sequent
+	w89k-*)
+		cpu=hppa1.1
+		vendor=winbond
+		basic_os=proelf
 		;;
-	sh)
-		basic_machine=sh-hitachi
-		os=-hms
+	none)
+		cpu=none
+		vendor=none
 		;;
-	sh5el)
-		basic_machine=sh5le-unknown
+	leon|leon3-9)
+		cpu=sparc
+		vendor=$basic_machine
 		;;
-	sh64)
-		basic_machine=sh64-unknown
+	leon-*|leon3-9-*)
+		cpu=sparc
+		vendor=`echo "$basic_machine" | sed 's/-.*//'`
 		;;
-	sparclite-wrs | simso-wrs)
-		basic_machine=sparclite-wrs
-		os=-vxworks
+
+	*-*)
+		# shellcheck disable=SC2162
+		saved_IFS=$IFS
+		IFS="-" read cpu vendor <<EOF
+$basic_machine
+EOF
+		IFS=$saved_IFS
 		;;
-	sps7)
-		basic_machine=m68k-bull
-		os=-sysv2
+	# We use `pc' rather than `unknown'
+	# because (1) that's what they normally are, and
+	# (2) the word "unknown" tends to confuse beginning users.
+	i*86 | x86_64)
+		cpu=$basic_machine
+		vendor=pc
 		;;
-	spur)
-		basic_machine=spur-unknown
+	# These rules are duplicated from below for sake of the special case above;
+	# i.e. things that normalized to x86 arches should also default to "pc"
+	pc98)
+		cpu=i386
+		vendor=pc
 		;;
-	st2000)
-		basic_machine=m68k-tandem
+	x64 | amd64)
+		cpu=x86_64
+		vendor=pc
 		;;
-	stratus)
-		basic_machine=i860-stratus
-		os=-sysv4
+	# Recognize the basic CPU types without company name.
+	*)
+		cpu=$basic_machine
+		vendor=unknown
 		;;
-	strongarm-* | thumb-*)
-		basic_machine=arm-`echo $basic_machine | sed 's/^^-*-//'`
+esac
+
+unset -v basic_machine
+
+# Decode basic machines in the full and proper CPU-Company form.
+case $cpu-$vendor in
+	# Here we handle the default manufacturer of certain CPU types in canonical form. It is in
+	# some cases the only manufacturer, in others, it is the most popular.
+	craynv-unknown)
+		vendor=cray
+		basic_os=${basic_os:-unicosmp}
 		;;
-	sun2)
-		basic_machine=m68000-sun
+	c90-unknown | c90-cray)
+		vendor=cray
+		basic_os=${Basic_os:-unicos}
 		;;
-	sun2os3)
-		basic_machine=m68000-sun
-		os=-sunos3
+	fx80-unknown)
+		vendor=alliant
 		;;
-	sun2os4)
-		basic_machine=m68000-sun
-		os=-sunos4
+	romp-unknown)
+		vendor=ibm
 		;;
-	sun3os3)
-		basic_machine=m68k-sun
-		os=-sunos3
+	mmix-unknown)
+		vendor=knuth
 		;;
-	sun3os4)
-		basic_machine=m68k-sun
-		os=-sunos4
+	microblaze-unknown | microblazeel-unknown)
+		vendor=xilinx
 		;;
-	sun4os3)
-		basic_machine=sparc-sun
-		os=-sunos3
+	rs6000-unknown)
+		vendor=ibm
 		;;
-	sun4os4)
-		basic_machine=sparc-sun
-		os=-sunos4
+	vax-unknown)
+		vendor=dec
 		;;
-	sun4sol2)
-		basic_machine=sparc-sun
-		os=-solaris2
+	pdp11-unknown)
+		vendor=dec
 		;;
-	sun3 | sun3-*)
-		basic_machine=m68k-sun
+	we32k-unknown)
+		vendor=att
 		;;
-	sun4)
-		basic_machine=sparc-sun
+	cydra-unknown)
+		vendor=cydrome
 		;;
-	sun386 | sun386i | roadrunner)
-		basic_machine=i386-sun
+	i370-ibm*)
+		vendor=ibm
 		;;
-	sv1)
-		basic_machine=sv1-cray
-		os=-unicos
+	orion-unknown)
+		vendor=highlevel
 		;;
-	symmetry)
-		basic_machine=i386-sequent
-		os=-dynix
+	xps-unknown | xps100-unknown)
+		cpu=xps100
+		vendor=honeywell
 		;;
-	t3e)
-		basic_machine=alphaev5-cray
-		os=-unicos
+
+	# Here we normalize CPU types with a missing or matching vendor
+	armh-unknown | armh-alt)
+		cpu=armv7l
+		vendor=alt
+		basic_os=${basic_os:-linux-gnueabihf}
 		;;
-	t90)
-		basic_machine=t90-cray
-		os=-unicos
+	dpx20-unknown | dpx20-bull)
+		cpu=rs6000
+		vendor=bull
+		basic_os=${basic_os:-bosx}
 		;;
-	tile*)
-		basic_machine=$basic_machine-unknown
-		os=-linux-gnu
+
+	# Here we normalize CPU types irrespective of the vendor
+	amd64-*)
+		cpu=x86_64
 		;;
-	tx39)
-		basic_machine=mipstx39-unknown
+	blackfin-*)
+		cpu=bfin
+		basic_os=linux
 		;;
-	tx39el)
-		basic_machine=mipstx39el-unknown
+	c54x-*)
+		cpu=tic54x
 		;;
-	toad1)
-		basic_machine=pdp10-xkl
-		os=-tops20
+	c55x-*)
+		cpu=tic55x
 		;;
-	tower | tower-32)
-		basic_machine=m68k-ncr
+	c6x-*)
+		cpu=tic6x
 		;;
-	tpf)
-		basic_machine=s390x-ibm
-		os=-tpf
+	e500v12-*)
+		cpu=powerpc
+		basic_os=${basic_os}"spe"
 		;;
-	udi29k)
-		basic_machine=a29k-amd
-		os=-udi
+	mips3*-*)
+		cpu=mips64
 		;;
-	ultra3)
-		basic_machine=a29k-nyu
-		os=-sym1
+	ms1-*)
+		cpu=mt
 		;;
-	v810 | necv810)
-		basic_machine=v810-nec
-		os=-none
+	m68knommu-*)
+		cpu=m68k
+		basic_os=linux
 		;;
-	vaxv)
-		basic_machine=vax-dec
-		os=-sysv
+	m9s12z-* | m68hcs12z-* | hcs12z-* | s12z-*)
+		cpu=s12z
 		;;
-	vms)
-		basic_machine=vax-dec
-		os=-vms
+	openrisc-*)
+		cpu=or32
 		;;
-	vpp*|vx|vx-*)
-		basic_machine=f301-fujitsu
+	parisc-*)
+		cpu=hppa
+		basic_os=linux
 		;;
-	vxworks960)
-		basic_machine=i960-wrs
-		os=-vxworks
+	pentium-* | p5-* | k5-* | k6-* | nexgen-* | viac3-*)
+		cpu=i586
 		;;
-	vxworks68)
-		basic_machine=m68k-wrs
-		os=-vxworks
+	pentiumpro-* | p6-* | 6x86-* | athlon-* | athalon_*-*)
+		cpu=i686
 		;;
-	vxworks29k)
-		basic_machine=a29k-wrs
-		os=-vxworks
+	pentiumii-* | pentium2-* | pentiumiii-* | pentium3-*)
+		cpu=i686
 		;;
-	w65*)
-		basic_machine=w65-wdc
-		os=-none
+	pentium4-*)
+		cpu=i786
 		;;
-	w89k-*)
-		basic_machine=hppa1.1-winbond
-		os=-proelf
+	pc98-*)
+		cpu=i386
 		;;
-	xbox)
-		basic_machine=i686-pc
-		os=-mingw32
+	ppc-* | ppcbe-*)
+		cpu=powerpc
 		;;
-	xps | xps100)
-		basic_machine=xps100-honeywell
+	ppcle-* | powerpclittle-*)
+		cpu=powerpcle
 		;;
-	xscale-* | xscaleebl-*)
-		basic_machine=`echo $basic_machine | sed 's/^xscale/arm/'`
+	ppc64-*)
+		cpu=powerpc64
 		;;
-	ymp)
-		basic_machine=ymp-cray
-		os=-unicos
+	ppc64le-* | powerpc64little-*)
+		cpu=powerpc64le
 		;;
-	z8k-*-coff)
-		basic_machine=z8k-unknown
-		os=-sim
+	sb1-*)
+		cpu=mipsisa64sb1
 		;;
-	z80-*-coff)
-		basic_machine=z80-unknown
-		os=-sim
+	sb1el-*)
+		cpu=mipsisa64sb1el
 		;;
-	none)
-		basic_machine=none-none
-		os=-none
+	sh5elb-*)
+		cpu=`echo "$cpu" | sed 's/^$sh.$e$.$$/\1\2e/'`
 		;;
-
-# Here we handle the default manufacturer of certain CPU types. It is in
-# some cases the only manufacturer, in others, it is the most popular.
-	w89k)
-		basic_machine=hppa1.1-winbond
+	spur-*)
+		cpu=spur
 		;;
-	op50n)
-		basic_machine=hppa1.1-oki
+	strongarm-* | thumb-*)
+		cpu=arm
 		;;
-	op60c)
-		basic_machine=hppa1.1-oki
+	tx39-*)
+		cpu=mipstx39
 		;;
-	romp)
-		basic_machine=romp-ibm
+	tx39el-*)
+		cpu=mipstx39el
 		;;
-	mmix)
-		basic_machine=mmix-knuth
+	x64-*)
+		cpu=x86_64
 		;;
-	rs6000)
-		basic_machine=rs6000-ibm
+	xscale-* | xscaleebl-*)
+		cpu=`echo "$cpu" | sed 's/^xscale/arm/'`
 		;;
-	vax)
-		basic_machine=vax-dec
+	arm64-* | aarch64le-*)
+		cpu=aarch64
 		;;
-	pdp10)
-		# there are many clones, so DEC is not a safe bet
-		basic_machine=pdp10-unknown
+
+	# Recognize the canonical CPU Types that limit and/or modify the
+	# company names they are paired with.
+	cr16-*)
+		basic_os=${basic_os:-elf}
 		;;
-	pdp11)
-		basic_machine=pdp11-dec
+	crisv32-* | etraxfs*-*)
+		cpu=crisv32
+		vendor=axis
 		;;
-	we32k)
-		basic_machine=we32k-att
+	cris-* | etrax*-*)
+		cpu=cris
+		vendor=axis
 		;;
-	sh1234 | sh24a | sh24aeb | sh34eb | sh1234le | sh23ele)
-		basic_machine=sh-unknown
+	crx-*)
+		basic_os=${basic_os:-elf}
 		;;
-	sparc | sparcv8 | sparcv9 | sparcv9b | sparcv9v)
-		basic_machine=sparc-sun
+	neo-tandem)
+		cpu=neo
+		vendor=tandem
 		;;
-	cydra)
-		basic_machine=cydra-cydrome
+	nse-tandem)
+		cpu=nse
+		vendor=tandem
 		;;
-	orion)
-		basic_machine=orion-highlevel
+	nsr-tandem)
+		cpu=nsr
+		vendor=tandem
 		;;
-	orion105)
-		basic_machine=clipper-highlevel
+	nsv-tandem)
+		cpu=nsv
+		vendor=tandem
 		;;
-	mac | mpw | mac-mpw)
-		basic_machine=m68k-apple
+	nsx-tandem)
+		cpu=nsx
+		vendor=tandem
 		;;
-	pmac | pmac-mpw)
-		basic_machine=powerpc-apple
+	mipsallegrexel-sony)
+		cpu=mipsallegrexel
+		vendor=sony
 		;;
-	*-unknown)
-		# Make sure to match an already-canonicalized machine name.
+	tile*-*)
+		basic_os=${basic_os:-linux-gnu}
 		;;
+
 	*)
-		echo Invalid configuration \`$1\': machine \`$basic_machine\' not recognized 1>&2
-		exit 1
+		# Recognize the canonical CPU types that are allowed with any
+		# company name.
+		case $cpu in
+			1750a | 580 \
+			| a29k \
+			| aarch64 | aarch64_be \
+			| abacus \
+			| alpha | alphaev4-8 | alphaev56 | alphaev678 \
+			| alpha64 | alpha64ev4-8 | alpha64ev56 | alpha64ev678 \
+			| alphapca567 | alpha64pca567 \
+			| am33_2.0 \
+			| amdgcn \
+			| arc | arceb | arc32 | arc64 \
+			| arm | armlbe | armelb | armv* \
+			| avr | avr32 \
+			| asmjs \
+			| ba \
+			| be32 | be64 \
+			| bfin | bpf | bs2000 \
+			| c123* | c30 | cjt90 | c4x \
+			| c8051 | clipper | craynv | csky | cydra \
+			| d10v | d30v | dlx | dsp16xx \
+			| e2k | elxsi | epiphany \
+			| f3001 | f700 | fido | fr30 | frv | ft32 | fx80 \
+			| h8300 | h8500 \
+			| hppa | hppa1.01 | hppa2.0 | hppa2.0nw | hppa64 \
+			| hexagon \
+			| i370 | i*86 | i860 | i960 | ia16 | ia64 \
+			| ip2k | iq2000 \
+			| k1om \
+			| le32 | le64 \
+			| lm32 \
+			| loongarch32 | loongarch64 | loongarchx32 \
+			| m32c | m32r | m32rle \
+			| m5200 | m68000 | m6800123460 | m68360 | m683?2 | m68k \
+			| m6811 | m68hc11 | m6812 | m68hc12 | m68hcs12x \
+			| m88110 | m88k | maxq | mb | mcore | mep | metag \
+			| microblaze | microblazeel \
+			| mips | mipsbe | mipseb | mipsel | mipsle \
+			| mips16 \
+			| mips64 | mips64eb | mips64el \
+			| mips64octeon | mips64octeonel \
+			| mips64orion | mips64orionel \
+			| mips64r5900 | mips64r5900el \
+			| mips64vr | mips64vrel \
+			| mips64vr4100 | mips64vr4100el \
+			| mips64vr4300 | mips64vr4300el \
+			| mips64vr5000 | mips64vr5000el \
+			| mips64vr5900 | mips64vr5900el \
+			| mipsisa32 | mipsisa32el \
+			| mipsisa32r2 | mipsisa32r2el \
+			| mipsisa32r3 | mipsisa32r3el \
+			| mipsisa32r5 | mipsisa32r5el \
+			| mipsisa32r6 | mipsisa32r6el \
+			| mipsisa64 | mipsisa64el \
+			| mipsisa64r2 | mipsisa64r2el \
+			| mipsisa64r3 | mipsisa64r3el \
+			| mipsisa64r5 | mipsisa64r5el \
+			| mipsisa64r6 | mipsisa64r6el \
+			| mipsisa64sb1 | mipsisa64sb1el \
+			| mipsisa64sr71k | mipsisa64sr71kel \
+			| mipsr5900 | mipsr5900el \
+			| mipstx39 | mipstx39el \
+			| mmix \
+			| mn10200 | mn10300 \
+			| moxie \
+			| mt \
+			| msp430 \
+			| nds32 | nds32le | nds32be \
+			| nfp \
+			| nios | nios2 | nios2eb | nios2el \
+			| none | np1 | ns16k | ns32k | nvptx \
+			| open8 \
+			| or1k* \
+			| or32 \
+			| orion \
+			| picochip \
+			| pdp10 | pdp11 | pj | pjl | pn | power \
+			| powerpc | powerpc64 | powerpc64le | powerpcle | powerpcspe \
+			| pru \
+			| pyramid \
+			| riscv | riscv32 | riscv32be | riscv64 | riscv64be \
+			| rl78 | romp | rs6000 | rx \
+			| s390 | s390x \
+			| score \
+			| sh | shl \
+			| sh1234 | sh24a | sh24aelb | sh23e | shelb | shlbe \
+			| sh1234elb | sh12345lbe | sh23ele | sh64 | sh64le \
+			| sparc | sparc64 | sparc64b | sparc64v | sparc86x | sparclet \
+			| sparclite \
+			| sparcv8 | sparcv9 | sparcv9b | sparcv9v | sv1 | sx* \
+			| spu \
+			| tahoe \
+			| thumbv7* \
+			| tic30 | tic4x | tic54x | tic55x | tic6x | tic80 \
+			| tron \
+			| ubicom32 \
+			| v70 | v850 | v850e | v850e1 | v850es | v850e2 | v850e2v3 \
+			| vax \
+			| visium \
+			| w65 \
+			| wasm32 | wasm64 \
+			| we32k \
+			| x86 | x86_64 | xc16x | xgate | xps100 \
+			| xstormy16 | xtensa* \
+			| ymp \
+			| z8k | z80)
+				;;
+
+			*)
+				echo Invalid configuration \`"$1"\': machine \`"$cpu-$vendor"\' not recognized 1>&2
+				exit 1
+				;;
+		esac
 		;;
 esac
 
 # Here we canonicalize certain aliases for manufacturers.
-case $basic_machine in
-	*-digital*)
-		basic_machine=`echo $basic_machine | sed 's/digital.*/dec/'`
+case $vendor in
+	digital*)
+		vendor=dec
 		;;
-	*-commodore*)
-		basic_machine=`echo $basic_machine | sed 's/commodore.*/cbm/'`
+	commodore*)
+		vendor=cbm
 		;;
 	*)
 		;;
@@ -1355,203 +1306,215 @@
 
 # Decode manufacturer-specific aliases for certain operating systems.
 
-if x"$os" != x"" 
+if test x$basic_os != x
 then
-case $os in
-	# First match some system type aliases
-	# that might get confused with valid system types.
-	# -solaris* is a basic system type, with this one exception.
-	-auroraux)
-		os=-auroraux
+
+# First recognize some ad-hoc cases, or perhaps split kernel-os, or else just
+# set os.
+case $basic_os in
+	gnu/linux*)
+		kernel=linux
+		os=`echo "$basic_os" | sed -e 's|gnu/linux|gnu|'`
+		;;
+	os2-emx)
+		kernel=os2
+		os=`echo "$basic_os" | sed -e 's|os2-emx|emx|'`
+		;;
+	nto-qnx*)
+		kernel=nto
+		os=`echo "$basic_os" | sed -e 's|nto-qnx|qnx|'`
+		;;
+	*-*)
+		# shellcheck disable=SC2162
+		saved_IFS=$IFS
+		IFS="-" read kernel os <<EOF
+$basic_os
+EOF
+		IFS=$saved_IFS
+		;;
+	# Default OS when just kernel was specified
+	nto*)
+		kernel=nto
+		os=`echo "$basic_os" | sed -e 's|nto|qnx|'`
+		;;
+	linux*)
+		kernel=linux
+		os=`echo "$basic_os" | sed -e 's|linux|gnu|'`
 		;;
-	-solaris1 | -solaris1.*)
-		os=`echo $os | sed -e 's|solaris1|sunos4|'`
+	*)
+		kernel=
+		os=$basic_os
+		;;
+esac
+
+# Now, normalize the OS (knowing we just have one component, it's not a kernel,
+# etc.)
+case $os in
+	# First match some system type aliases that might get confused
+	# with valid system types.
+	# solaris* is a basic system type, with this one exception.
+	auroraux)
+		os=auroraux
 		;;
-	-solaris)
-		os=-solaris2
+	bluegene*)
+		os=cnk
 		;;
-	-svr4*)
-		os=-sysv4
+	solaris1 | solaris1.*)
+		os=`echo "$os" | sed -e 's|solaris1|sunos4|'`
 		;;
-	-unixware*)
-		os=-sysv4.2uw
+	solaris)
+		os=solaris2
 		;;
-	-gnu/linux*)
-		os=`echo $os | sed -e 's|gnu/linux|linux-gnu|'`
+	unixware*)
+		os=sysv4.2uw
 		;;
-	# First accept the basic system types.
-	# The portable systems comes first.
-	# Each alternative MUST END IN A *, to match a version number.
-	# -sysv* is not here because it comes later, after sysvr4.
-	-gnu* | -bsd* | -mach* | -minix* | -genix* | -ultrix* | -irix* \
-	 | -*vms* | -sco* | -esix* | -isc* | -aix* | -cnk* | -sunos | -sunos34*\
-	 | -hpux* | -unos* | -osf* | -luna* | -dgux* | -auroraux* | -solaris* \
-	 | -sym* | -kopensolaris* | -plan9* \
-	 | -amigaos* | -amigados* | -msdos* | -newsos* | -unicos* | -aof* \
-	 | -aos* | -aros* | -cloudabi* | -sortix* \
-	 | -nindy* | -vxsim* | -vxworks* | -ebmon* | -hms* | -mvs* \
-	 | -clix* | -riscos* | -uniplus* | -iris* | -rtu* | -xenix* \
-	 | -hiux* | -386bsd* | -knetbsd* | -mirbsd* | -netbsd* \
-	 | -bitrig* | -openbsd* | -solidbsd* | -libertybsd* \
-	 | -ekkobsd* | -kfreebsd* | -freebsd* | -riscix* | -lynxos* \
-	 | -bosx* | -nextstep* | -cxux* | -aout* | -elf* | -oabi* \
-	 | -ptx* | -coff* | -ecoff* | -winnt* | -domain* | -vsta* \
-	 | -udi* | -eabi* | -lites* | -ieee* | -go32* | -aux* \
-	 | -chorusos* | -chorusrdb* | -cegcc* \
-	 | -cygwin* | -msys* | -pe* | -psos* | -moss* | -proelf* | -rtems* \
-	 | -midipix* | -mingw32* | -mingw64* | -linux-gnu* | -linux-android* \
-	 | -linux-newlib* | -linux-musl* | -linux-uclibc* \
-	 | -uxpv* | -beos* | -mpeix* | -udk* | -moxiebox* \
-	 | -interix* | -uwin* | -mks* | -rhapsody* | -darwin* | -opened* \
-	 | -openstep* | -oskit* | -conix* | -pw32* | -nonstopux* \
-	 | -storm-chaos* | -tops10* | -tenex* | -tops20* | -its* \
-	 | -os2* | -vos* | -palmos* | -uclinux* | -nucleus* \
-	 | -morphos* | -superux* | -rtmk* | -rtmk-nova* | -windiss* \
-	 | -powermax* | -dnix* | -nx6 | -nx7 | -sei* | -dragonfly* \
-	 | -skyos* | -haiku* | -rdos* | -toppers* | -drops* | -es* \
-	 | -onefs* | -tirtos* | -phoenix* | -fuchsia*)
-	# Remember, each alternative MUST END IN *, to match a version number.
-		;;
-	-qnx*)
-		case $basic_machine in
-		 x86-* | i*86-*)
-			;;
-		 *)
-			os=-nto$os
-			;;
-		esac
+	# es1800 is here to avoid being matched by es* (a different OS)
+	es1800*)
+		os=ose
 		;;
-	-nto-qnx*)
+	# Some version numbers need modification
+	chorusos*)
+		os=chorusos
 		;;
-	-nto*)
-		os=`echo $os | sed -e 's|nto|nto-qnx|'`
+	isc)
+		os=isc2.2
 		;;
-	-sim | -es1800* | -hms* | -xray | -os68k* | -none* | -v88r* \
-	 | -windows* | -osx | -abug | -netware* | -os9* | -beos* | -haiku* \
-	 | -macos* | -mpw* | -magic* | -mmixware* | -mon960* | -lnews*)
+	sco6)
+		os=sco5v6
 		;;
-	-mac*)
-		os=`echo $os | sed -e 's|mac|macos|'`
+	sco5)
+		os=sco3.2v5
 		;;
-	-linux-dietlibc)
-		os=-linux-dietlibc
+	sco4)
+		os=sco3.2v4
 		;;
-	-linux*)
-		os=`echo $os | sed -e 's|linux|linux-gnu|'`
+	sco3.2.4-9*)
+		os=`echo "$os" | sed -e 's/sco3.2./sco3.2v/'`
 		;;
-	-sunos5*)
-		os=`echo $os | sed -e 's|sunos5|solaris2|'`
+	sco*v* | scout)
+		# Don't match below
 		;;
-	-sunos6*)
-		os=`echo $os | sed -e 's|sunos6|solaris3|'`
+	sco*)
+		os=sco3.2v2
 		;;
-	-opened*)
-		os=-openedition
+	psos*)
+		os=psos
 		;;
-	-os400*)
-		os=-os400
+	qnx*)
+		os=qnx
 		;;
-	-wince*)
-		os=-wince
+	hiux*)
+		os=hiuxwe2
 		;;
-	-osfrose*)
-		os=-osfrose
+	lynx*178)
+		os=lynxos178
 		;;
-	-osf*)
-		os=-osf
+	lynx*5)
+		os=lynxos5
 		;;
-	-utek*)
-		os=-bsd
+	lynxos*)
+		# don't get caught up in next wildcard
 		;;
-	-dynix*)
-		os=-bsd
+	lynx*)
+		os=lynxos
 		;;
-	-acis*)
-		os=-aos
+	mac0-9*)
+		os=`echo "$os" | sed -e 's|mac|macos|'`
 		;;
-	-atheos*)
-		os=-atheos
+	opened*)
+		os=openedition
 		;;
-	-syllable*)
-		os=-syllable
+	os400*)
+		os=os400
 		;;
-	-386bsd)
-		os=-bsd
+	sunos5*)
+		os=`echo "$os" | sed -e 's|sunos5|solaris2|'`
 		;;
-	-ctix* | -uts*)
-		os=-sysv
+	sunos6*)
+		os=`echo "$os" | sed -e 's|sunos6|solaris3|'`
 		;;
-	-nova*)
-		os=-rtmk-nova
+	wince*)
+		os=wince
 		;;
-	-ns2 )
-		os=-nextstep2
+	utek*)
+		os=bsd
 		;;
-	-nsk*)
-		os=-nsk
+	dynix*)
+		os=bsd
 		;;
-	# Preserve the version number of sinix5.
-	-sinix5.*)
-		os=`echo $os | sed -e 's|sinix|sysv|'`
+	acis*)
+		os=aos
 		;;
-	-sinix*)
-		os=-sysv4
+	atheos*)
+		os=atheos
 		;;
-	-tpf*)
-		os=-tpf
+	syllable*)
+		os=syllable
 		;;
-	-triton*)
-		os=-sysv3
+	386bsd)
+		os=bsd
 		;;
-	-oss*)
-		os=-sysv3
+	ctix* | uts*)
+		os=sysv
 		;;
-	-svr4)
-		os=-sysv4
+	nova*)
+		os=rtmk-nova
 		;;
-	-svr3)
-		os=-sysv3
+	ns2)
+		os=nextstep2
 		;;
-	-sysvr4)
-		os=-sysv4
+	# Preserve the version number of sinix5.
+	sinix5.*)
+		os=`echo "$os" | sed -e 's|sinix|sysv|'`
 		;;
-	# This must come after -sysvr4.
-	-sysv*)
+	sinix*)
+		os=sysv4
 		;;
-	-ose*)
-		os=-ose
+	tpf*)
+		os=tpf
 		;;
-	-es1800*)
-		os=-ose
+	triton*)
+		os=sysv3
 		;;
-	-xenix)
-		os=-xenix
+	oss*)
+		os=sysv3
 		;;
-	-*mint | -mint0-9* | -*MiNT | -MiNT0-9*)
-		os=-mint
+	svr4*)
+		os=sysv4
 		;;
-	-aros*)
-		os=-aros
+	svr3)
+		os=sysv3
 		;;
-	-zvmoe)
-		os=-zvmoe
+	sysvr4)
+		os=sysv4
 		;;
-	-dicos*)
-		os=-dicos
+	ose*)
+		os=ose
 		;;
-	-nacl*)
+	*mint | mint0-9* | *MiNT | MiNT0-9*)
+		os=mint
 		;;
-	-ios)
+	dicos*)
+		os=dicos
 		;;
-	-none)
+	pikeos*)
+		# Until real need of OS specific support for
+		# particular features comes up, bare metal
+		# configurations are quite functional.
+		case $cpu in
+		 arm*)
+			os=eabi
+			;;
+		 *)
+			os=elf
+			;;
+		esac
 		;;
 	*)
-		# Get rid of the `-' at the beginning of $os.
-		os=`echo $os | sed 's/^-*-//'`
-		echo Invalid configuration \`$1\': system \`$os\' not recognized 1>&2
-		exit 1
+		# No normalization, but not necessarily accepted, that comes below.
 		;;
 esac
+
 else
 
 # Here we handle the default operating systems that come with various machines.
@@ -1564,261 +1527,363 @@
 # will signal an error saying that MANUFACTURER isn't an operating
 # system, and we'll never get to this point.
 
-case $basic_machine in
+kernel=
+case $cpu-$vendor in
 	score-*)
-		os=-elf
+		os=elf
 		;;
 	spu-*)
-		os=-elf
+		os=elf
 		;;
 	*-acorn)
-		os=-riscix1.2
+		os=riscix1.2
 		;;
 	arm*-rebel)
-		os=-linux
+		kernel=linux
+		os=gnu
 		;;
 	arm*-semi)
-		os=-aout
+		os=aout
 		;;
 	c4x-* | tic4x-*)
-		os=-coff
+		os=coff
 		;;
 	c8051-*)
-		os=-elf
+		os=elf
+		;;
+	clipper-intergraph)
+		os=clix
 		;;
 	hexagon-*)
-		os=-elf
+		os=elf
 		;;
 	tic54x-*)
-		os=-coff
+		os=coff
 		;;
 	tic55x-*)
-		os=-coff
+		os=coff
 		;;
 	tic6x-*)
-		os=-coff
+		os=coff
 		;;
 	# This must come before the *-dec entry.
 	pdp10-*)
-		os=-tops20
+		os=tops20
 		;;
 	pdp11-*)
-		os=-none
+		os=none
 		;;
 	*-dec | vax-*)
-		os=-ultrix4.2
+		os=ultrix4.2
 		;;
 	m68*-apollo)
-		os=-domain
+		os=domain
 		;;
 	i386-sun)
-		os=-sunos4.0.2
+		os=sunos4.0.2
 		;;
 	m68000-sun)
-		os=-sunos3
+		os=sunos3
 		;;
 	m68*-cisco)
-		os=-aout
+		os=aout
 		;;
 	mep-*)
-		os=-elf
+		os=elf
 		;;
 	mips*-cisco)
-		os=-elf
+		os=elf
 		;;
 	mips*-*)
-		os=-elf
+		os=elf
 		;;
 	or32-*)
-		os=-coff
+		os=coff
 		;;
 	*-tti)	# must be before sparc entry or we get the wrong os.
-		os=-sysv3
+		os=sysv3
 		;;
 	sparc-* | *-sun)
-		os=-sunos4.1.1
+		os=sunos4.1.1
 		;;
-	*-be)
-		os=-beos
+	pru-*)
+		os=elf
 		;;
-	*-haiku)
-		os=-haiku
+	*-be)
+		os=beos
 		;;
 	*-ibm)
-		os=-aix
+		os=aix
 		;;
 	*-knuth)
-		os=-mmixware
+		os=mmixware
 		;;
 	*-wec)
-		os=-proelf
+		os=proelf
 		;;
 	*-winbond)
-		os=-proelf
+		os=proelf
 		;;
 	*-oki)
-		os=-proelf
+		os=proelf
 		;;
 	*-hp)
-		os=-hpux
+		os=hpux
 		;;
 	*-hitachi)
-		os=-hiux
+		os=hiux
 		;;
 	i860-* | *-att | *-ncr | *-altos | *-motorola | *-convergent)
-		os=-sysv
+		os=sysv
 		;;
 	*-cbm)
-		os=-amigaos
+		os=amigaos
 		;;
 	*-dg)
-		os=-dgux
+		os=dgux
 		;;
 	*-dolphin)
-		os=-sysv3
+		os=sysv3
 		;;
 	m68k-ccur)
-		os=-rtu
+		os=rtu
 		;;
 	m88k-omron*)
-		os=-luna
+		os=luna
 		;;
-	*-next )
-		os=-nextstep
+	*-next)
+		os=nextstep
 		;;
 	*-sequent)
-		os=-ptx
+		os=ptx
 		;;
 	*-crds)
-		os=-unos
+		os=unos
 		;;
 	*-ns)
-		os=-genix
+		os=genix
 		;;
 	i370-*)
-		os=-mvs
-		;;
-	*-next)
-		os=-nextstep3
+		os=mvs
 		;;
 	*-gould)
-		os=-sysv
+		os=sysv
 		;;
 	*-highlevel)
-		os=-bsd
+		os=bsd
 		;;
 	*-encore)
-		os=-bsd
+		os=bsd
 		;;
 	*-sgi)
-		os=-irix
+		os=irix
 		;;
 	*-siemens)
-		os=-sysv4
+		os=sysv4
 		;;
 	*-masscomp)
-		os=-rtu
+		os=rtu
 		;;
 	f3001-fujitsu | f700-fujitsu)
-		os=-uxpv
+		os=uxpv
 		;;
 	*-rom68k)
-		os=-coff
+		os=coff
 		;;
 	*-*bug)
-		os=-coff
+		os=coff
 		;;
 	*-apple)
-		os=-macos
+		os=macos
 		;;
 	*-atari*)
-		os=-mint
+		os=mint
+		;;
+	*-wrs)
+		os=vxworks
 		;;
 	*)
-		os=-none
+		os=none
 		;;
 esac
+
 fi
 
+# Now, validate our (potentially fixed-up) OS.
+case $os in
+	# Sometimes we do "kernel-libc", so those need to count as OSes.
+	musl* | newlib* | relibc* | uclibc*)
+		;;
+	# Likewise for "kernel-abi"
+	eabi* | gnueabi*)
+		;;
+	# VxWorks passes extra cpu info in the 4th filed.
+	simlinux | simwindows | spe)
+		;;
+	# Now accept the basic system types.
+	# The portable systems comes first.
+	# Each alternative MUST end in a * to match a version number.
+	gnu* | android* | bsd* | mach* | minix* | genix* | ultrix* | irix* \
+	 | *vms* | esix* | aix* | cnk* | sunos | sunos34* \
+	 | hpux* | unos* | osf* | luna* | dgux* | auroraux* | solaris* \
+	 | sym* | plan9* | psp* | sim* | xray* | os68k* | v88r* \
+	 | hiux* | abug | nacl* | netware* | windows* \
+	 | os9* | macos* | osx* | ios* \
+	 | mpw* | magic* | mmixware* | mon960* | lnews* \
+	 | amigaos* | amigados* | msdos* | newsos* | unicos* | aof* \
+	 | aos* | aros* | cloudabi* | sortix* | twizzler* \
+	 | nindy* | vxsim* | vxworks* | ebmon* | hms* | mvs* \
+	 | clix* | riscos* | uniplus* | iris* | isc* | rtu* | xenix* \
+	 | mirbsd* | netbsd* | dicos* | openedition* | ose* \
+	 | bitrig* | openbsd* | secbsd* | solidbsd* | libertybsd* | os108* \
+	 | ekkobsd* | freebsd* | riscix* | lynxos* | os400* \
+	 | bosx* | nextstep* | cxux* | aout* | elf* | oabi* \
+	 | ptx* | coff* | ecoff* | winnt* | domain* | vsta* \
+	 | udi* | lites* | ieee* | go32* | aux* | hcos* \
+	 | chorusrdb* | cegcc* | glidix* | serenity* \
+	 | cygwin* | msys* | pe* | moss* | proelf* | rtems* \
+	 | midipix* | mingw32* | mingw64* | mint* \
+	 | uxpv* | beos* | mpeix* | udk* | moxiebox* \
+	 | interix* | uwin* | mks* | rhapsody* | darwin* \
+	 | openstep* | oskit* | conix* | pw32* | nonstopux* \
+	 | storm-chaos* | tops10* | tenex* | tops20* | its* \
+	 | os2* | vos* | palmos* | uclinux* | nucleus* | morphos* \
+	 | scout* | superux* | sysv* | rtmk* | tpf* | windiss* \
+	 | powermax* | dnix* | nx6 | nx7 | sei* | dragonfly* \
+	 | skyos* | haiku* | rdos* | toppers* | drops* | es* \
+	 | onefs* | tirtos* | phoenix* | fuchsia* | redox* | bme* \
+	 | midnightbsd* | amdhsa* | unleashed* | emscripten* | wasi* \
+	 | nsk* | powerunix* | genode* | zvmoe* | qnx* | emx* | zephyr* \
+	 | fiwix* )
+		;;
+	# This one is extra strict with allowed versions
+	sco3.2v2 | sco3.2v4-9* | sco5v6*)
+		# Don't forget version if it is 3.2v4 or newer.
+		;;
+	none)
+		;;
+	*)
+		echo Invalid configuration \`"$1"\': OS \`"$os"\' not recognized 1>&2
+		exit 1
+		;;
+esac
+
+# As a final step for OS-related things, validate the OS-kernel combination
+# (given a valid OS), if there is a kernel.
+case $kernel-$os in
+	linux-gnu* | linux-dietlibc* | linux-android* | linux-newlib* \
+		 | linux-musl* | linux-relibc* | linux-uclibc* )
+		;;
+	uclinux-uclibc* )
+		;;
+	-dietlibc* | -newlib* | -musl* | -relibc* | -uclibc* )
+		# These are just libc implementations, not actual OSes, and thus
+		# require a kernel.
+		echo "Invalid configuration \`$1': libc \`$os' needs explicit kernel." 1>&2
+		exit 1
+		;;
+	kfreebsd*-gnu* | kopensolaris*-gnu*)
+		;;
+	vxworks-simlinux | vxworks-simwindows | vxworks-spe)
+		;;
+	nto-qnx*)
+		;;
+	os2-emx)
+		;;
+	*-eabi* | *-gnueabi*)
+		;;
+	-*)
+		# Blank kernel with real OS is always fine.
+		;;
+	*-*)
+		echo "Invalid configuration \`$1': Kernel \`$kernel' not known to work with OS \`$os'." 1>&2
+		exit 1
+		;;
+esac
+
 # Here we handle the case where we know the os, and the CPU type, but not the
 # manufacturer. We pick the logical manufacturer.
-vendor=unknown
-case $basic_machine in
-	*-unknown)
-		case $os in
-			-riscix*)
+case $vendor in
+	unknown)
+		case $cpu-$os in
+			*-riscix*)
 				vendor=acorn
 				;;
-			-sunos*)
+			*-sunos*)
 				vendor=sun
 				;;
-			-cnk*|-aix*)
+			*-cnk* | *-aix*)
 				vendor=ibm
 				;;
-			-beos*)
+			*-beos*)
 				vendor=be
 				;;
-			-hpux*)
+			*-hpux*)
 				vendor=hp
 				;;
-			-mpeix*)
+			*-mpeix*)
 				vendor=hp
 				;;
-			-hiux*)
+			*-hiux*)
 				vendor=hitachi
 				;;
-			-unos*)
+			*-unos*)
 				vendor=crds
 				;;
-			-dgux*)
+			*-dgux*)
 				vendor=dg
 				;;
-			-luna*)
+			*-luna*)
 				vendor=omron
 				;;
-			-genix*)
+			*-genix*)
 				vendor=ns
 				;;
-			-mvs* | -opened*)
+			*-clix*)
+				vendor=intergraph
+				;;
+			*-mvs* | *-opened*)
+				vendor=ibm
+				;;
+			*-os400*)
 				vendor=ibm
 				;;
-			-os400*)
+			s390-* | s390x-*)
 				vendor=ibm
 				;;
-			-ptx*)
+			*-ptx*)
 				vendor=sequent
 				;;
-			-tpf*)
+			*-tpf*)
 				vendor=ibm
 				;;
-			-vxsim* | -vxworks* | -windiss*)
+			*-vxsim* | *-vxworks* | *-windiss*)
 				vendor=wrs
 				;;
-			-aux*)
+			*-aux*)
 				vendor=apple
 				;;
-			-hms*)
+			*-hms*)
 				vendor=hitachi
 				;;
-			-mpw* | -macos*)
+			*-mpw* | *-macos*)
 				vendor=apple
 				;;
-			-*mint | -mint0-9* | -*MiNT | -MiNT0-9*)
+			*-*mint | *-mint0-9* | *-*MiNT | *-MiNT0-9*)
 				vendor=atari
 				;;
-			-vos*)
+			*-vos*)
 				vendor=stratus
 				;;
 		esac
-		basic_machine=`echo $basic_machine | sed "s/unknown/$vendor/"`
 		;;
 esac
 
-echo $basic_machine$os
+echo "$cpu-$vendor-${kernel:+$kernel-}$os"
 exit
 
 # Local variables:
-# eval: (add-hook 'write-file-hooks 'time-stamp)
+# eval: (add-hook 'before-save-hook 'time-stamp)
 # time-stamp-start: "timestamp='"
 # time-stamp-format: "%:y-%02m-%02d"
 # time-stamp-end: "'"

_service:tar_scm:stunnel-5.48.tar.gz/auto/depcomp -> _service:tar_scm:stunnel-5.69.tar.gz/auto/depcomp Changed

@@ -1,9 +1,9 @@
 #! /bin/sh
 # depcomp - compile a program generating dependencies as side-effects
 
-scriptversion=2013-05-30.07; # UTC
+scriptversion=2018-03-07.03; # UTC
 
-# Copyright (C) 1999-2014 Free Software Foundation, Inc.
+# Copyright (C) 1999-2021 Free Software Foundation, Inc.
 
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -16,7 +16,7 @@
 # GNU General Public License for more details.
 
 # You should have received a copy of the GNU General Public License
-# along with this program. If not, see <http://www.gnu.org/licenses/>.
+# along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 # As a special exception to the GNU General Public License, if you
 # distribute this file as part of a program that contains a
@@ -783,9 +783,9 @@
 # Local Variables:
 # mode: shell-script
 # sh-indentation: 2
-# eval: (add-hook 'write-file-hooks 'time-stamp)
+# eval: (add-hook 'before-save-hook 'time-stamp)
 # time-stamp-start: "scriptversion="
 # time-stamp-format: "%:y-%02m-%02d.%02H"
-# time-stamp-time-zone: "UTC"
+# time-stamp-time-zone: "UTC0"
 # time-stamp-end: "; # UTC"
 # End:

_service:tar_scm:stunnel-5.48.tar.gz/auto/install-sh -> _service:tar_scm:stunnel-5.69.tar.gz/auto/install-sh Changed

@@ -1,7 +1,7 @@
 #!/bin/sh
 # install - install a program, script, or datafile
 
-scriptversion=2014-09-12.12; # UTC
+scriptversion=2020-11-14.01; # UTC
 
 # This originates from X11R5 (mit/util/scripts/install.sh), which was
 # later released in X11R6 (xc/config/util/install.sh) with the
@@ -69,6 +69,11 @@
 # Desired mode of installed file.
 mode=0755
 
+# Create dirs (including intermediate dirs) using mode 755.
+# This is like GNU 'install' as of coreutils 8.32 (2020).
+mkdir_umask=22
+
+backupsuffix=
 chgrpcmd=
 chmodcmd=$chmodprog
 chowncmd=
@@ -99,18 +104,28 @@
      --version  display version info and exit.
 
   -c            (ignored)
-  -C            install only if different (preserve the last data modification time)
+  -C            install only if different (preserve data modification time)
   -d            create directories instead of installing files.
   -g GROUP      $chgrpprog installed files to GROUP.
   -m MODE       $chmodprog installed files to MODE.
   -o USER       $chownprog installed files to USER.
+  -p            pass -p to $cpprog.
   -s            $stripprog installed files.
+  -S SUFFIX     attempt to back up existing files, with suffix SUFFIX.
   -t DIRECTORY  install into DIRECTORY.
   -T            report an error if DSTFILE is a directory.
 
 Environment variables override the default commands:
   CHGRPPROG CHMODPROG CHOWNPROG CMPPROG CPPROG MKDIRPROG MVPROG
   RMPROG STRIPPROG
+
+By default, rm is invoked with -f; when overridden with RMPROG,
+it's up to you to specify -f if you want it.
+
+If -S is not specified, no backups are attempted.
+
+Email bug reports to bug-automake@gnu.org.
+Automake home page: https://www.gnu.org/software/automake/
 "
 
 while test $# -ne 0; do
@@ -137,8 +152,13 @@
     -o) chowncmd="$chownprog $2"
         shift;;
 
+    -p) cpprog="$cpprog -p";;
+
     -s) stripcmd=$stripprog;;
 
+    -S) backupsuffix="$2"
+        shift;;
+
     -t)
         is_target_a_directory=always
         dst_arg=$2
@@ -255,6 +275,10 @@
     dstdir=$dst
     test -d "$dstdir"
     dstdir_status=$?
+    # Don't chown directories that already exist.
+    if test $dstdir_status = 0; then
+      chowncmd=""
+    fi
   else
 
     # Waiting for this to be detected by the "$cpprog $src $dsttmp" command
@@ -271,15 +295,18 @@
     fi
     dst=$dst_arg
 
-    # If destination is a directory, append the input filename; won't work
-    # if double slashes aren't ignored.
+    # If destination is a directory, append the input filename.
     if test -d "$dst"; then
       if test "$is_target_a_directory" = never; then
         echo "$0: $dst_arg: Is a directory" >&2
         exit 1
       fi
       dstdir=$dst
-      dst=$dstdir/`basename "$src"`
+      dstbase=`basename "$src"`
+      case $dst in
+	*/) dst=$dst$dstbase;;
+	*)  dst=$dst/$dstbase;;
+      esac
       dstdir_status=0
     else
       dstdir=`dirname "$dst"`
@@ -288,27 +315,16 @@
     fi
   fi
 
+  case $dstdir in
+    */) dstdirslash=$dstdir;;
+    *)  dstdirslash=$dstdir/;;
+  esac
+
   obsolete_mkdir_used=false
 
   if test $dstdir_status != 0; then
     case $posix_mkdir in
       '')
-        # Create intermediate dirs using mode 755 as modified by the umask.
-        # This is like FreeBSD 'install' as of 1997-10-28.
-        umask=`umask`
-        case $stripcmd.$umask in
-          # Optimize common cases.
-          *23672367) mkdir_umask=$umask;;
-          .*00202 | .0202 | .02) mkdir_umask=22;;
-
-          *0-7)
-            mkdir_umask=`expr $umask + 22 \
-              - $umask % 100 % 40 + $umask % 20 \
-              - $umask % 10 % 4 + $umask % 2
-            `;;
-          *) mkdir_umask=$umask,go-w;;
-        esac
-
         # With -d, create the new directory with the user-specified mode.
         # Otherwise, rely on $mkdir_umask.
         if test -n "$dir_arg"; then
@@ -318,50 +334,49 @@
         fi
 
         posix_mkdir=false
-        case $umask in
-          *1235670-70-7)
-            # POSIX mkdir -p sets u+wx bits regardless of umask, which
-            # is incompatible with FreeBSD 'install' when (umask & 300) != 0.
-            ;;
-          *)
-            # $RANDOM is not portable (e.g. dash);  use it when possible to
-            # lower collision chance
-            tmpdir=${TMPDIR-/tmp}/ins$RANDOM-$$
-            trap 'ret=$?; rmdir "$tmpdir/a/b" "$tmpdir/a" "$tmpdir" 2>/dev/null; exit $ret' 0
-
-            # As "mkdir -p" follows symlinks and we work in /tmp possibly;  so
-            # create the $tmpdir first (and fail if unsuccessful) to make sure
-            # that nobody tries to guess the $tmpdir name.
-            if (umask $mkdir_umask &&
-                $mkdirprog $mkdir_mode "$tmpdir" &&
-                exec $mkdirprog $mkdir_mode -p -- "$tmpdir/a/b") >/dev/null 2>&1
-            then
-              if test -z "$dir_arg" || {
-                   # Check for POSIX incompatibilities with -m.
-                   # HP-UX 11.23 and IRIX 6.5 mkdir -m -p sets group- or
-                   # other-writable bit of parent directory when it shouldn't.
-                   # FreeBSD 6.1 mkdir -m -p sets mode of existing directory.
-                   test_tmpdir="$tmpdir/a"
-                   ls_ld_tmpdir=`ls -ld "$test_tmpdir"`
-                   case $ls_ld_tmpdir in
-                     d????-?r-*) different_mode=700;;
-                     d????-?--*) different_mode=755;;
-                     *) false;;
-                   esac &&
-                   $mkdirprog -m$different_mode -p -- "$test_tmpdir" && {
-                     ls_ld_tmpdir_1=`ls -ld "$test_tmpdir"`
-                     test "$ls_ld_tmpdir" = "$ls_ld_tmpdir_1"
-                   }
-                 }
-              then posix_mkdir=:
-              fi
-              rmdir "$tmpdir/a/b" "$tmpdir/a" "$tmpdir"
-            else
-              # Remove any dirs left behind by ancient mkdir implementations.
-              rmdir ./$mkdir_mode ./-p ./-- "$tmpdir" 2>/dev/null
-            fi
-            trap '' 0;;
-        esac;;
+	# The $RANDOM variable is not portable (e.g., dash).  Use it
+	# here however when possible just to lower collision chance.
+	tmpdir=${TMPDIR-/tmp}/ins$RANDOM-$$
+
+	trap '
+	  ret=$?
+	  rmdir "$tmpdir/a/b" "$tmpdir/a" "$tmpdir" 2>/dev/null
+	  exit $ret
+	' 0
+
+	# Because "mkdir -p" follows existing symlinks and we likely work
+	# directly in world-writeable /tmp, make sure that the '$tmpdir'
+	# directory is successfully created first before we actually test
+	# 'mkdir -p'.
+	if (umask $mkdir_umask &&
+	    $mkdirprog $mkdir_mode "$tmpdir" &&
+	    exec $mkdirprog $mkdir_mode -p -- "$tmpdir/a/b") >/dev/null 2>&1
+	then
+	  if test -z "$dir_arg" || {
+	       # Check for POSIX incompatibilities with -m.
+	       # HP-UX 11.23 and IRIX 6.5 mkdir -m -p sets group- or
+	       # other-writable bit of parent directory when it shouldn't.
+	       # FreeBSD 6.1 mkdir -m -p sets mode of existing directory.
+	       test_tmpdir="$tmpdir/a"
+	       ls_ld_tmpdir=`ls -ld "$test_tmpdir"`
+	       case $ls_ld_tmpdir in
+		 d????-?r-*) different_mode=700;;
+		 d????-?--*) different_mode=755;;
+		 *) false;;
+	       esac &&
+	       $mkdirprog -m$different_mode -p -- "$test_tmpdir" && {
+		 ls_ld_tmpdir_1=`ls -ld "$test_tmpdir"`
+		 test "$ls_ld_tmpdir" = "$ls_ld_tmpdir_1"
+	       }
+	     }
+	  then posix_mkdir=:
+	  fi
+	  rmdir "$tmpdir/a/b" "$tmpdir/a" "$tmpdir"
+	else
+	  # Remove any dirs left behind by ancient mkdir implementations.
+	  rmdir ./$mkdir_mode ./-p ./-- "$tmpdir" 2>/dev/null
+	fi
+	trap '' 0;;
     esac
 
     if
@@ -372,7 +387,7 @@
     then :
     else
 
-      # The umask is ridiculous, or mkdir does not conform to POSIX,
+      # mkdir does not conform to POSIX,
       # or it failed possibly due to a race condition.  Create the
       # directory the slow way, step by step, checking for races as we go.
 
@@ -401,7 +416,7 @@
           prefixes=
         else
           if $posix_mkdir; then
-            (umask=$mkdir_umask &&
+            (umask $mkdir_umask &&
              $doit_exec $mkdirprog $mkdir_mode -p -- "$dstdir") && break
             # Don't fail if two instances are running concurrently.
             test -d "$prefix" || exit 1
@@ -434,14 +449,25 @@
   else
 
     # Make a couple of temp file names in the proper directory.
-    dsttmp=$dstdir/_inst.$$_
-    rmtmp=$dstdir/_rm.$$_
+    dsttmp=${dstdirslash}_inst.$$_
+    rmtmp=${dstdirslash}_rm.$$_
 
     # Trap to clean up those temp files at exit.
     trap 'ret=$?; rm -f "$dsttmp" "$rmtmp" && exit $ret' 0
 
     # Copy the file name to the temp name.
-    (umask $cp_umask && $doit_exec $cpprog "$src" "$dsttmp") &&
+    (umask $cp_umask &&
+     { test -z "$stripcmd" || {
+	 # Create $dsttmp read-write so that cp doesn't create it read-only,
+	 # which would cause strip to fail.
+	 if test -z "$doit"; then
+	   : >"$dsttmp" # No need to fork-exec 'touch'.
+	 else
+	   $doit touch "$dsttmp"
+	 fi
+       }
+     } &&
+     $doit_exec $cpprog "$src" "$dsttmp") &&
 
     # and set any options; do chmod last to preserve setuid bits.
     #
@@ -467,6 +493,13 @@
     then
       rm -f "$dsttmp"
     else
+      # If $backupsuffix is set, and the file being installed
+      # already exists, attempt a backup.  Don't worry if it fails,
+      # e.g., if mv doesn't support -f.
+      if test -n "$backupsuffix" && test -f "$dst"; then
+        $doit $mvcmd -f "$dst" "$dst$backupsuffix" 2>/dev/null
+      fi
+
       # Rename the file to the real destination.
       $doit $mvcmd -f "$dsttmp" "$dst" 2>/dev/null ||
 
@@ -481,9 +514,9 @@
         # file should still install successfully.
         {
           test ! -f "$dst" ||
-          $doit $rmcmd -f "$dst" 2>/dev/null ||
+          $doit $rmcmd "$dst" 2>/dev/null ||
           { $doit $mvcmd -f "$dst" "$rmtmp" 2>/dev/null &&
-            { $doit $rmcmd -f "$rmtmp" 2>/dev/null; :; }
+            { $doit $rmcmd "$rmtmp" 2>/dev/null; :; }
           } ||
           { echo "$0: cannot unlink or rename $dst" >&2
             (exit 1); exit 1
@@ -500,9 +533,9 @@
 done
 
 # Local variables:
-# eval: (add-hook 'write-file-hooks 'time-stamp)
+# eval: (add-hook 'before-save-hook 'time-stamp)
 # time-stamp-start: "scriptversion="
 # time-stamp-format: "%:y-%02m-%02d.%02H"
-# time-stamp-time-zone: "UTC"
+# time-stamp-time-zone: "UTC0"
 # time-stamp-end: "; # UTC"
 # End:

_service:tar_scm:stunnel-5.48.tar.gz/auto/ltmain.sh -> _service:tar_scm:stunnel-5.69.tar.gz/auto/ltmain.sh Changed

@@ -31,7 +31,7 @@
 
 PROGRAM=libtool
 PACKAGE=libtool
-VERSION="2.4.6 Debian-2.4.6-2"
+VERSION="2.4.6 Debian-2.4.6-15build2"
 package_revision=2.4.6
 
 
@@ -387,7 +387,7 @@
 # putting '$debug_cmd' at the start of all your functions, you can get
 # bash to show function call trace with:
 #
-# debug_cmd='eval echo "${FUNCNAME0} $*" >&2' bash your-script-name
+# debug_cmd='echo "${FUNCNAME0} $*" >&2' bash your-script-name
 debug_cmd=${debug_cmd-":"}
 exit_cmd=:
 
@@ -1370,7 +1370,7 @@
 #! /bin/sh
 
 # Set a version string for this script.
-scriptversion=2014-01-07.03; # UTC
+scriptversion=2015-10-07.11; # UTC
 
 # A portable, pluggable option parser for Bourne shell.
 # Written by Gary V. Vaughan, 2010
@@ -1530,6 +1530,8 @@
 {
 $debug_cmd
 
+ _G_rc_run_hooks=false
+
 case " $hookable_fns " in
 *" $1 "*) ;;
 *) func_fatal_error "'$1' does not support hook funcions.n" ;;
@@ -1538,16 +1540,16 @@
 eval _G_hook_fns=\$$1_hooks; shift
 
 for _G_hook in $_G_hook_fns; do
- eval $_G_hook '"$@"'
-
- # store returned options list back into positional
- # parameters for next 'cmd' execution.
- eval _G_hook_result=\$${_G_hook}_result
- eval set dummy "$_G_hook_result"; shift
+ if eval $_G_hook '"$@"'; then
+ # store returned options list back into positional
+ # parameters for next 'cmd' execution.
+ eval _G_hook_result=\$${_G_hook}_result
+ eval set dummy "$_G_hook_result"; shift
+ _G_rc_run_hooks=:
+ fi
 done
 
- func_quote_for_eval ${1+"$@"}
- func_run_hooks_result=$func_quote_for_eval_result
+ $_G_rc_run_hooks && func_run_hooks_result=$_G_hook_result
 }
 
 
@@ -1557,10 +1559,16 @@
 ## --------------- ##
 
 # In order to add your own option parsing hooks, you must accept the
-# full positional parameter list in your hook function, remove any
-# options that you action, and then pass back the remaining unprocessed
+# full positional parameter list in your hook function, you may remove/edit
+# any options that you action, and then pass back the remaining unprocessed
 # options in '<hooked_function_name>_result', escaped suitably for
-# 'eval'. Like this:
+# 'eval'. In this case you also must return $EXIT_SUCCESS to let the
+# hook's caller know that it should pay attention to
+# '<hooked_function_name>_result'. Returning $EXIT_FAILURE signalizes that
+# arguments are left untouched by the hook and therefore caller will ignore the
+# result variable.
+#
+# Like this:
 #
 # my_options_prep ()
 # {
@@ -1570,9 +1578,11 @@
 # usage_message=$usage_message'
 # -s, --silent don'\''t print informational messages
 # '
-#
-# func_quote_for_eval ${1+"$@"}
-# my_options_prep_result=$func_quote_for_eval_result
+# # No change in '$@' (ignored completely by this hook). There is
+# # no need to do the equivalent (but slower) action:
+# # func_quote_for_eval ${1+"$@"}
+# # my_options_prep_result=$func_quote_for_eval_result
+# false
 # }
 # func_add_hook func_options_prep my_options_prep
 #
@@ -1581,25 +1591,37 @@
 # {
 # $debug_cmd
 #
+# args_changed=false
+#
 # # Note that for efficiency, we parse as many options as we can
 # # recognise in a loop before passing the remainder back to the
 # # caller on the first unrecognised argument we encounter.
 # while test $# -gt 0; do
 # opt=$1; shift
 # case $opt in
-# --silent|-s) opt_silent=: ;;
+# --silent|-s) opt_silent=:
+# args_changed=:
+# ;;
 # # Separate non-argument short options:
 # -s*) func_split_short_opt "$_G_opt"
 # set dummy "$func_split_short_opt_name" \
 # "-$func_split_short_opt_arg" ${1+"$@"}
 # shift
+# args_changed=:
 # ;;
-# *) set dummy "$_G_opt" "$*"; shift; break ;;
+# *) # Make sure the first unrecognised option "$_G_opt"
+# # is added back to "$@", we could need that later
+# # if $args_changed is true.
+# set dummy "$_G_opt" ${1+"$@"}; shift; break ;;
 # esac
 # done
 #
-# func_quote_for_eval ${1+"$@"}
-# my_silent_option_result=$func_quote_for_eval_result
+# if $args_changed; then
+# func_quote_for_eval ${1+"$@"}
+# my_silent_option_result=$func_quote_for_eval_result
+# fi
+#
+# $args_changed
 # }
 # func_add_hook func_parse_options my_silent_option
 #
@@ -1611,16 +1633,32 @@
 # $opt_silent && $opt_verbose && func_fatal_help "\
 # '--silent' and '--verbose' options are mutually exclusive."
 #
-# func_quote_for_eval ${1+"$@"}
-# my_option_validation_result=$func_quote_for_eval_result
+# false
 # }
 # func_add_hook func_validate_options my_option_validation
 #
-# You'll alse need to manually amend $usage_message to reflect the extra
+# You'll also need to manually amend $usage_message to reflect the extra
 # options you parse. It's preferable to append if you can, so that
 # multiple option parsing hooks can be added safely.
 
 
+# func_options_finish ARG...
+# ----------------------------
+# Finishing the option parse loop (call 'func_options' hooks ATM).
+func_options_finish ()
+{
+ $debug_cmd
+
+ _G_func_options_finish_exit=false
+ if func_run_hooks func_options ${1+"$@"}; then
+ func_options_finish_result=$func_run_hooks_result
+ _G_func_options_finish_exit=:
+ fi
+
+ $_G_func_options_finish_exit
+}
+
+
 # func_options ARG...
 # ---------------------
 # All the functions called inside func_options are hookable. See the
@@ -1630,17 +1668,28 @@
 {
 $debug_cmd
 
- func_options_prep ${1+"$@"}
- eval func_parse_options \
- ${func_options_prep_result+"$func_options_prep_result"}
- eval func_validate_options \
- ${func_parse_options_result+"$func_parse_options_result"}
+ _G_rc_options=false
 
- eval func_run_hooks func_options \
- ${func_validate_options_result+"$func_validate_options_result"}
+ for my_func in options_prep parse_options validate_options options_finish
+ do
+ if eval func_$my_func '${1+"$@"}'; then
+ eval _G_res_var='$'"func_${my_func}_result"
+ eval set dummy "$_G_res_var" ; shift
+ _G_rc_options=:
+ fi
+ done
 
- # save modified positional parameters for caller
- func_options_result=$func_run_hooks_result
+ # Save modified positional parameters for caller. As a top-level
+ # options-parser function we always need to set the 'func_options_result'
+ # variable (regardless the $_G_rc_options value).
+ if $_G_rc_options; then
+ func_options_result=$_G_res_var
+ else
+ func_quote_for_eval ${1+"$@"}
+ func_options_result=$func_quote_for_eval_result
+ fi
+
+ $_G_rc_options
 }
 
 
@@ -1649,9 +1698,9 @@
 # All initialisations required before starting the option parse loop.
 # Note that when calling hook functions, we pass through the list of
 # positional parameters. If a hook function modifies that list, and
-# needs to propogate that back to rest of this script, then the complete
+# needs to propagate that back to rest of this script, then the complete
 # modified list must be put in 'func_run_hooks_result' before
-# returning.
+# returning $EXIT_SUCCESS (otherwise $EXIT_FAILURE is returned).
 func_hookable func_options_prep
 func_options_prep ()
 {
@@ -1661,10 +1710,14 @@
 opt_verbose=false
 opt_warning_types=
 
- func_run_hooks func_options_prep ${1+"$@"}
+ _G_rc_options_prep=false
+ if func_run_hooks func_options_prep ${1+"$@"}; then
+ _G_rc_options_prep=:
+ # save modified positional parameters for caller
+ func_options_prep_result=$func_run_hooks_result
+ fi
 
- # save modified positional parameters for caller
- func_options_prep_result=$func_run_hooks_result
+ $_G_rc_options_prep
 }
 
 
@@ -1678,18 +1731,20 @@
 
 func_parse_options_result=
 
+ _G_rc_parse_options=false
 # this just eases exit handling
 while test $# -gt 0; do
 # Defer to hook functions for initial option parsing, so they
 # get priority in the event of reusing an option name.
- func_run_hooks func_parse_options ${1+"$@"}
-
- # Adjust func_parse_options positional parameters to match
- eval set dummy "$func_run_hooks_result"; shift
+ if func_run_hooks func_parse_options ${1+"$@"}; then
+ eval set dummy "$func_run_hooks_result"; shift
+ _G_rc_parse_options=:
+ fi
 
 # Break out of the loop if we already parsed every option.
 test $# -gt 0 || break
 
+ _G_match_parse_options=:
 _G_opt=$1
 shift
 case $_G_opt in
@@ -1704,7 +1759,10 @@
 		 ;;
 
 --warnings|--warning|-W)
- test $# = 0 && func_missing_arg $_G_opt && break
+ if test $# = 0 && func_missing_arg $_G_opt; then
+ _G_rc_parse_options=:
+ break
+ fi
 case " $warning_categories $1" in
 *" $1 "*)
 # trailing space prevents matching last $1 above
@@ -1757,15 +1815,25 @@
 shift
 ;;
 
- --) break ;;
+ --) _G_rc_parse_options=: ; break ;;
 -*) func_fatal_help "unrecognised option: '$_G_opt'" ;;
- *) set dummy "$_G_opt" ${1+"$@"}; shift; break ;;
+ *) set dummy "$_G_opt" ${1+"$@"}; shift
+ _G_match_parse_options=false
+ break
+ ;;
 esac
+
+ $_G_match_parse_options && _G_rc_parse_options=:
 done
 
- # save modified positional parameters for caller
- func_quote_for_eval ${1+"$@"}
- func_parse_options_result=$func_quote_for_eval_result
+
+ if $_G_rc_parse_options; then
+ # save modified positional parameters for caller
+ func_quote_for_eval ${1+"$@"}
+ func_parse_options_result=$func_quote_for_eval_result
+ fi
+
+ $_G_rc_parse_options
 }
 
 
@@ -1778,16 +1846,21 @@
 {
 $debug_cmd
 
+ _G_rc_validate_options=false
+
 # Display all warnings if -W was not given.
 test -n "$opt_warning_types" || opt_warning_types=" $warning_categories"
 
- func_run_hooks func_validate_options ${1+"$@"}
+ if func_run_hooks func_validate_options ${1+"$@"}; then
+ # save modified positional parameters for caller
+ func_validate_options_result=$func_run_hooks_result
+ _G_rc_validate_options=:
+ fi
 
 # Bail if the options were screwed!
 $exit_cmd $EXIT_FAILURE
 
- # save modified positional parameters for caller
- func_validate_options_result=$func_run_hooks_result
+ $_G_rc_validate_options
 }
 
 
@@ -2068,7 +2141,7 @@
 compiler: $LTCC
 compiler flags: $LTCFLAGS
 linker: $LD (gnu? $with_gnu_ld)
- version: $progname $scriptversion Debian-2.4.6-2
+ version: $progname $scriptversion Debian-2.4.6-15build2
 automake: `($AUTOMAKE --version) 2>/dev/null |$SED 1q`
 autoconf: `($AUTOCONF --version) 2>/dev/null |$SED 1q`
 
@@ -2270,6 +2343,8 @@
 nonopt=
 preserve_args=
 
+ _G_rc_lt_options_prep=:
+
 # Shorthand for --mode=foo, only valid as the first argument
 case $1 in
 clean|clea|cle|cl)
@@ -2293,11 +2368,18 @@
 uninstall|uninstal|uninsta|uninst|unins|unin|uni|un|u)
 shift; set dummy --mode uninstall ${1+"$@"}; shift
 ;;
+ *)
+ _G_rc_lt_options_prep=false
+ ;;
 esac
 
- # Pass back the list of options.
- func_quote_for_eval ${1+"$@"}
- libtool_options_prep_result=$func_quote_for_eval_result
+ if $_G_rc_lt_options_prep; then
+ # Pass back the list of options.
+ func_quote_for_eval ${1+"$@"}
+ libtool_options_prep_result=$func_quote_for_eval_result
+ fi
+
+ $_G_rc_lt_options_prep
 }
 func_add_hook func_options_prep libtool_options_prep
 
@@ -2309,9 +2391,12 @@
 {
 $debug_cmd
 
+ _G_rc_lt_parse_options=false
+
 # Perform our own loop to consume as many options as possible in
 # each iteration.
 while test $# -gt 0; do
+ _G_match_lt_parse_options=:
 _G_opt=$1
 shift
 case $_G_opt in
@@ -2386,15 +2471,22 @@
 func_append preserve_args " $_G_opt"
 ;;
 
-	# An option not handled by this hook function:
- *)		set dummy "$_G_opt" ${1+"$@"};	shift; break ;;
+ # An option not handled by this hook function:
+ *) set dummy "$_G_opt" ${1+"$@"} ; shift
+ _G_match_lt_parse_options=false
+ break
+ ;;
 esac
+ $_G_match_lt_parse_options && _G_rc_lt_parse_options=:
 done
 
+ if $_G_rc_lt_parse_options; then
+ # save modified positional parameters for caller
+ func_quote_for_eval ${1+"$@"}
+ libtool_parse_options_result=$func_quote_for_eval_result
+ fi
 
- # save modified positional parameters for caller
- func_quote_for_eval ${1+"$@"}
- libtool_parse_options_result=$func_quote_for_eval_result
+ $_G_rc_lt_parse_options
 }
 func_add_hook func_parse_options libtool_parse_options
 
@@ -7275,10 +7367,13 @@
 # -specs=* GCC specs files
 # -stdlib=* select c++ std lib with clang
 # -fsanitize=* Clang/GCC memory and address sanitizer
+ # -fuse-ld=* Linker select flags for GCC
+ # -static-* direct GCC to link specific libraries statically
+ # -fcilkplus Cilk Plus language extension features for C/C++
 -64|-mips0-9|-r0-90-9*|-xarch=*|-xtarget=*|+DA*|+DD*|-q*|-m*| \
 -t45*|-txscale*|-p|-pg|--coverage|-fprofile-*|-F*|@*|-tp=*|--sysroot=*| \
 -O*|-g*|-flto*|-fwhopr*|-fuse-linker-plugin|-fstack-protector*|-stdlib=*| \
- -specs=*|-fsanitize=*)
+ -specs=*|-fsanitize=*|-fuse-ld=*|-static-*|-fcilkplus)
 func_quote_for_eval "$arg"
 	arg=$func_quote_for_eval_result
 func_append compile_command " $arg"

_service:tar_scm:stunnel-5.48.tar.gz/auto/missing -> _service:tar_scm:stunnel-5.69.tar.gz/auto/missing Changed

@@ -1,9 +1,9 @@
 #! /bin/sh
 # Common wrapper for a few potentially missing GNU programs.
 
-scriptversion=2013-10-28.13; # UTC
+scriptversion=2018-03-07.03; # UTC
 
-# Copyright (C) 1996-2014 Free Software Foundation, Inc.
+# Copyright (C) 1996-2021 Free Software Foundation, Inc.
 # Originally written by Fran,cois Pinard <pinard@iro.umontreal.ca>, 1996.
 
 # This program is free software; you can redistribute it and/or modify
@@ -17,7 +17,7 @@
 # GNU General Public License for more details.
 
 # You should have received a copy of the GNU General Public License
-# along with this program. If not, see <http://www.gnu.org/licenses/>.
+# along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 # As a special exception to the GNU General Public License, if you
 # distribute this file as part of a program that contains a
@@ -101,9 +101,9 @@
 exit $st
 fi
 
-perl_URL=http://www.perl.org/
-flex_URL=http://flex.sourceforge.net/
-gnu_software_URL=http://www.gnu.org/software
+perl_URL=https://www.perl.org/
+flex_URL=https://github.com/westes/flex
+gnu_software_URL=https://www.gnu.org/software
 
 program_details ()
 {
@@ -207,9 +207,9 @@
 exit $st
 
 # Local variables:
-# eval: (add-hook 'write-file-hooks 'time-stamp)
+# eval: (add-hook 'before-save-hook 'time-stamp)
 # time-stamp-start: "scriptversion="
 # time-stamp-format: "%:y-%02m-%02d.%02H"
-# time-stamp-time-zone: "UTC"
+# time-stamp-time-zone: "UTC0"
 # time-stamp-end: "; # UTC"
 # End:

_service:tar_scm:stunnel-5.48.tar.gz/configure -> _service:tar_scm:stunnel-5.69.tar.gz/configure Changed

@@ -1,9 +1,10 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for stunnel 5.48.
+# Generated by GNU Autoconf 2.71 for stunnel 5.69.
 #
 #
-# Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc.
+# Copyright (C) 1992-1996, 1998-2017, 2020-2021 Free Software Foundation,
+# Inc.
 #
 #
 # This configure script is free software; the Free Software Foundation
@@ -14,14 +15,16 @@
 
 # Be more Bourne compatible
 DUALCASE=1; export DUALCASE # for MKS sh
-if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then :
+as_nop=:
+if test ${ZSH_VERSION+y} && (emulate sh) >/dev/null 2>&1
+then :
 emulate sh
 NULLCMD=:
 # Pre-4.2 versions of Zsh do word splitting on ${1+"$@"}, which
 # is contrary to our usage. Disable this feature.
 alias -g '${1+"$@"}'='"$@"'
 setopt NO_GLOB_SUBST
-else
+else $as_nop
 case `(set -o) 2>/dev/null` in #(
 *posix*) :
 set -o posix ;; #(
@@ -31,46 +34,46 @@
 fi
 
 
+
+# Reset variables that may have inherited troublesome values from
+# the environment.
+
+# IFS needs to be set, to space, tab, and newline, in precisely that order.
+# (If _AS_PATH_WALK were called with IFS unset, it would have the
+# side effect of setting IFS to empty, thus disabling word splitting.)
+# Quoting is to prevent editors from complaining about space-tab.
 as_nl='
 '
 export as_nl
-# Printing a long string crashes Solaris 7 /usr/bin/printf.
-as_echo='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\'
-as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo
-as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo$as_echo
-# Prefer a ksh shell builtin over an external printf program on Solaris,
-# but without wasting forks for bash or zsh.
-if test -z "$BASH_VERSION$ZSH_VERSION" \
- && (test "X`print -r -- $as_echo`" = "X$as_echo") 2>/dev/null; then
- as_echo='print -r --'
- as_echo_n='print -rn --'
-elif (test "X`printf %s $as_echo`" = "X$as_echo") 2>/dev/null; then
- as_echo='printf %s\n'
- as_echo_n='printf %s'
-else
- if test "X`(/usr/ucb/echo -n -n $as_echo) 2>/dev/null`" = "X-n $as_echo"; then
- as_echo_body='eval /usr/ucb/echo -n "$1$as_nl"'
- as_echo_n='/usr/ucb/echo -n'
- else
- as_echo_body='eval expr "X$1" : "X\$.*\$"'
- as_echo_n_body='eval
- arg=$1;
- case $arg in #(
- *"$as_nl"*)
-	expr "X$arg" : "X\$.*\$$as_nl";
-	arg=`expr "X$arg" : ".*$as_nl\$.*\$"`;;
- esac;
- expr "X$arg" : "X\$.*\$" | tr -d "$as_nl"
- '
- export as_echo_n_body
- as_echo_n='sh -c $as_echo_n_body as_echo'
- fi
- export as_echo_body
- as_echo='sh -c $as_echo_body as_echo'
-fi
+IFS=" ""	$as_nl"
+
+PS1='$ '
+PS2='> '
+PS4='+ '
+
+# Ensure predictable behavior from utilities with locale-dependent output.
+LC_ALL=C
+export LC_ALL
+LANGUAGE=C
+export LANGUAGE
+
+# We cannot yet rely on "unset" to work, but we need these variables
+# to be unset--not just set to an empty or harmless value--now, to
+# avoid bugs in old shells (e.g. pre-3.0 UWIN ksh). This construct
+# also avoids known problems related to "unset" and subshell syntax
+# in other old shells (e.g. bash 2.01 and pdksh 5.2.14).
+for as_var in BASH_ENV ENV MAIL MAILPATH CDPATH
+do eval test \${$as_var+y} \
+ && ( (unset $as_var) || exit 1) >/dev/null 2>&1 && unset $as_var || :
+done
+
+# Ensure that fds 0, 1, and 2 are open.
+if (exec 3>&0) 2>/dev/null; then :; else exec 0</dev/null; fi
+if (exec 3>&1) 2>/dev/null; then :; else exec 1>/dev/null; fi
+if (exec 3>&2) ; then :; else exec 2>/dev/null; fi
 
 # The user is always right.
-if test "${PATH_SEPARATOR+set}" != set; then
+if ${PATH_SEPARATOR+false} :; then
 PATH_SEPARATOR=:
 (PATH='/bin;/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 && {
 (PATH='/bin:/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 ||
@@ -79,13 +82,6 @@
 fi
 
 
-# IFS
-# We need space, tab and new line, in precisely that order. Quoting is
-# there to prevent editors from complaining about space-tab.
-# (If _AS_PATH_WALK were called with IFS unset, it would disable word
-# splitting by setting IFS to empty value.)
-IFS=" ""	$as_nl"
-
 # Find who we are. Look in the path if we contain no directory separator.
 as_myself=
 case $0 in #((
@@ -94,8 +90,12 @@
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
- test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
+ test -r "$as_dir$0" && as_myself=$as_dir$0 && break
 done
 IFS=$as_save_IFS
 
@@ -107,30 +107,10 @@
 as_myself=$0
 fi
 if test ! -f "$as_myself"; then
- $as_echo "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2
+ printf "%s\n" "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2
 exit 1
 fi
 
-# Unset variables that we do not need and which cause bugs (e.g. in
-# pre-3.0 UWIN ksh). But do not cause bugs in bash 2.01; the "|| exit 1"
-# suppresses any "Segmentation fault" message there. '((' could
-# trigger a bug in pdksh 5.2.14.
-for as_var in BASH_ENV ENV MAIL MAILPATH
-do eval test x\${$as_var+set} = xset \
- && ( (unset $as_var) || exit 1) >/dev/null 2>&1 && unset $as_var || :
-done
-PS1='$ '
-PS2='> '
-PS4='+ '
-
-# NLS nuisances.
-LC_ALL=C
-export LC_ALL
-LANGUAGE=C
-export LANGUAGE
-
-# CDPATH.
-(unset CDPATH) >/dev/null 2>&1 && unset CDPATH
 
 # Use a proper internal environment variable to ensure we don't fall
 # into an infinite loop, continuously re-executing ourselves.
@@ -152,20 +132,22 @@
 exec $CONFIG_SHELL $as_opts "$as_myself" ${1+"$@"}
 # Admittedly, this is quite paranoid, since all the known shells bail
 # out after a failed `exec'.
-$as_echo "$0: could not re-execute with $CONFIG_SHELL" >&2
-as_fn_exit 255
+printf "%s\n" "$0: could not re-execute with $CONFIG_SHELL" >&2
+exit 255
 fi
 # We don't want this to propagate to other subprocesses.
 { _as_can_reexec=; unset _as_can_reexec;}
 if test "x$CONFIG_SHELL" = x; then
- as_bourne_compatible="if test -n \"\${ZSH_VERSION+set}\" && (emulate sh) >/dev/null 2>&1; then :
+ as_bourne_compatible="as_nop=:
+if test \${ZSH_VERSION+y} && (emulate sh) >/dev/null 2>&1
+then :
 emulate sh
 NULLCMD=:
 # Pre-4.2 versions of Zsh do word splitting on \${1+\"\$@\"}, which
 # is contrary to our usage. Disable this feature.
 alias -g '\${1+\"\$@\"}'='\"\$@\"'
 setopt NO_GLOB_SUBST
-else
+else \$as_nop
 case \`(set -o) 2>/dev/null\` in #(
 *posix*) :
 set -o posix ;; #(
@@ -185,12 +167,15 @@
 as_fn_failure && { exitcode=1; echo as_fn_failure succeeded.; }
 as_fn_ret_success || { exitcode=1; echo as_fn_ret_success failed.; }
 as_fn_ret_failure && { exitcode=1; echo as_fn_ret_failure succeeded.; }
-if ( set x; as_fn_ret_success y && test x = \"\$1\" ); then :
+if ( set x; as_fn_ret_success y && test x = \"\$1\" )
+then :
 
-else
+else \$as_nop
 exitcode=1; echo positional parameters were not saved.
 fi
 test x\$exitcode = x0 || exit 1
+blah=\$(echo \$(echo blah))
+test x\"\$blah\" = xblah || exit 1
 test -x / || exit 1"
 as_suggested=" as_lineno_1=";as_suggested=$as_suggested$LINENO;as_suggested=$as_suggested" as_lineno_1a=\$LINENO
 as_lineno_2=";as_suggested=$as_suggested$LINENO;as_suggested=$as_suggested" as_lineno_2a=\$LINENO
@@ -205,30 +190,38 @@
 PATH=/empty FPATH=/empty; export PATH FPATH
 test \"X\`printf %s \$ECHO\`\" = \"X\$ECHO\" \\
 || test \"X\`print -r -- \$ECHO\`\" = \"X\$ECHO\" ) || exit 1"
- if (eval "$as_required") 2>/dev/null; then :
+ if (eval "$as_required") 2>/dev/null
+then :
 as_have_required=yes
-else
+else $as_nop
 as_have_required=no
 fi
- if test x$as_have_required = xyes && (eval "$as_suggested") 2>/dev/null; then :
+ if test x$as_have_required = xyes && (eval "$as_suggested") 2>/dev/null
+then :
 
-else
+else $as_nop
 as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 as_found=false
 for as_dir in /bin$PATH_SEPARATOR/usr/bin$PATH_SEPARATOR$PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
 as_found=:
 case $as_dir in #(
 	 /*)
 	 for as_base in sh bash ksh sh5; do
 	 # Try only shells that exist, to save several forks.
-	 as_shell=$as_dir/$as_base
+	 as_shell=$as_dir$as_base
 	 if { test -f "$as_shell" || test -f "$as_shell.exe"; } &&
-		 { $as_echo "$as_bourne_compatible""$as_required" | as_run=a "$as_shell"; } 2>/dev/null; then :
+		 as_run=a "$as_shell" -c "$as_bourne_compatible""$as_required" 2>/dev/null
+then :
 CONFIG_SHELL=$as_shell as_have_required=yes
-		 if { $as_echo "$as_bourne_compatible""$as_suggested" | as_run=a "$as_shell"; } 2>/dev/null; then :
+		 if as_run=a "$as_shell" -c "$as_bourne_compatible""$as_suggested" 2>/dev/null
+then :
 break 2
 fi
 fi
@@ -236,14 +229,21 @@
 esac
 as_found=false
 done
-$as_found || { if { test -f "$SHELL" || test -f "$SHELL.exe"; } &&
-	 { $as_echo "$as_bourne_compatible""$as_required" | as_run=a "$SHELL"; } 2>/dev/null; then :
- CONFIG_SHELL=$SHELL as_have_required=yes
-fi; }
 IFS=$as_save_IFS
+if $as_found
+then :
+
+else $as_nop
+ if { test -f "$SHELL" || test -f "$SHELL.exe"; } &&
+	 as_run=a "$SHELL" -c "$as_bourne_compatible""$as_required" 2>/dev/null
+then :
+ CONFIG_SHELL=$SHELL as_have_required=yes
+fi
+fi
 
 
- if test "x$CONFIG_SHELL" != x; then :
+ if test "x$CONFIG_SHELL" != x
+then :
 export CONFIG_SHELL
 # We cannot yet assume a decent shell, so we have to provide a
 # neutralization value for shells without unset; and this also
@@ -261,18 +261,19 @@
 exec $CONFIG_SHELL $as_opts "$as_myself" ${1+"$@"}
 # Admittedly, this is quite paranoid, since all the known shells bail
 # out after a failed `exec'.
-$as_echo "$0: could not re-execute with $CONFIG_SHELL" >&2
+printf "%s\n" "$0: could not re-execute with $CONFIG_SHELL" >&2
 exit 255
 fi
 
- if test x$as_have_required = xno; then :
- $as_echo "$0: This script requires a shell more modern than all"
- $as_echo "$0: the shells that I found on your system."
- if test x${ZSH_VERSION+set} = xset ; then
- $as_echo "$0: In particular, zsh $ZSH_VERSION has bugs and should"
- $as_echo "$0: be upgraded to zsh 4.3.4 or later."
+ if test x$as_have_required = xno
+then :
+ printf "%s\n" "$0: This script requires a shell more modern than all"
+ printf "%s\n" "$0: the shells that I found on your system."
+ if test ${ZSH_VERSION+y} ; then
+ printf "%s\n" "$0: In particular, zsh $ZSH_VERSION has bugs and should"
+ printf "%s\n" "$0: be upgraded to zsh 4.3.4 or later."
 else
- $as_echo "$0: Please tell bug-autoconf@gnu.org about your system,
+ printf "%s\n" "$0: Please tell bug-autoconf@gnu.org about your system,
 $0: including any error possibly output before this
 $0: message. Then install a modern shell, or manually run
 $0: the script under such a shell if you do have one."
@@ -299,6 +300,7 @@
 }
 as_unset=as_fn_unset
 
+
 # as_fn_set_status STATUS
 # -----------------------
 # Set $? to STATUS, without forking.
@@ -316,6 +318,14 @@
 as_fn_set_status $1
 exit $1
 } # as_fn_exit
+# as_fn_nop
+# ---------
+# Do nothing but, unlike ":", preserve the value of $?.
+as_fn_nop ()
+{
+ return $?
+}
+as_nop=as_fn_nop
 
 # as_fn_mkdir_p
 # -------------
@@ -330,7 +340,7 @@
 as_dirs=
 while :; do
 case $as_dir in #(
- *\'*) as_qdir=`$as_echo "$as_dir" | sed "s/'/'\\\\\\\\''/g"`;; #'(
+ *\'*) as_qdir=`printf "%s\n" "$as_dir" | sed "s/'/'\\\\\\\\''/g"`;; #'(
 *) as_qdir=$as_dir;;
 esac
 as_dirs="'$as_qdir' $as_dirs"
@@ -339,7 +349,7 @@
 	 X"$as_dir" : 'X$//$^/' \| \
 	 X"$as_dir" : 'X$//$$' \| \
 	 X"$as_dir" : 'X$/$' \| . 2>/dev/null ||
-$as_echo X"$as_dir" |
+printf "%s\n" X"$as_dir" |
 sed '/^X$.*^/$\/\/*^/^/*\/*$/{
 	 s//\1/
 	 q
@@ -378,12 +388,13 @@
 # advantage of any shell optimizations that allow amortized linear growth over
 # repeated appends, instead of the typical quadratic growth present in naive
 # implementations.
-if (eval "as_var=1; as_var+=2; test x\$as_var = x12") 2>/dev/null; then :
+if (eval "as_var=1; as_var+=2; test x\$as_var = x12") 2>/dev/null
+then :
 eval 'as_fn_append ()
 {
 eval $1+=\$2
 }'
-else
+else $as_nop
 as_fn_append ()
 {
 eval $1=\$$1\$2
@@ -395,18 +406,27 @@
 # Perform arithmetic evaluation on the ARGs, and store the result in the
 # global $as_val. Take advantage of shells that can avoid forks. The arguments
 # must be portable across $(()) and expr.
-if (eval "test \$(( 1 + 1 )) = 2") 2>/dev/null; then :
+if (eval "test \$(( 1 + 1 )) = 2") 2>/dev/null
+then :
 eval 'as_fn_arith ()
 {
 as_val=$(( $* ))
 }'
-else
+else $as_nop
 as_fn_arith ()
 {
 as_val=`expr "$@" || test $? -eq 1`
 }
 fi # as_fn_arith
 
+# as_fn_nop
+# ---------
+# Do nothing but, unlike ":", preserve the value of $?.
+as_fn_nop ()
+{
+ return $?
+}
+as_nop=as_fn_nop
 
 # as_fn_error STATUS ERROR LINENO LOG_FD
 # ----------------------------------------
@@ -418,9 +438,9 @@
 as_status=$1; test $as_status -eq 0 && as_status=1
 if test "$4"; then
 as_lineno=${as_lineno-"$3"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
- $as_echo "$as_me:${as_lineno-$LINENO}: error: $2" >&$4
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: $2" >&$4
 fi
- $as_echo "$as_me: error: $2" >&2
+ printf "%s\n" "$as_me: error: $2" >&2
 as_fn_exit $as_status
 } # as_fn_error
 
@@ -447,7 +467,7 @@
 $as_expr X/"$0" : '.*/$^/^/*$/*$' \| \
 	 X"$0" : 'X$//$$' \| \
 	 X"$0" : 'X$/$' \| . 2>/dev/null ||
-$as_echo X/"$0" |
+printf "%s\n" X/"$0" |
 sed '/^.*\/$^/^/*$\/*$/{
 	 s//\1/
 	 q
@@ -491,7 +511,7 @@
 s/-\n.*//
 ' >$as_me.lineno &&
 chmod +x "$as_me.lineno" ||
- { $as_echo "$as_me: error: cannot create $as_me.lineno; rerun with a POSIX shell" >&2; as_fn_exit 1; }
+ { printf "%s\n" "$as_me: error: cannot create $as_me.lineno; rerun with a POSIX shell" >&2; as_fn_exit 1; }
 
 # If we had to re-execute with $CONFIG_SHELL, we're ensured to have
 # already done that, so ensure we don't try to do so again and fall
@@ -505,6 +525,10 @@
 exit
 }
 
+
+# Determine whether it's possible to make 'echo' print without a newline.
+# These variables are no longer used directly by Autoconf, but are AC_SUBSTed
+# for compatibility with existing Makefiles.
 ECHO_C= ECHO_N= ECHO_T=
 case `echo -n x` in #(((((
 -n*)
@@ -518,6 +542,13 @@
 ECHO_N='-n';;
 esac
 
+# For backward compatibility with old third-party macros, we provide
+# the shell variables $as_echo and $as_echo_n. New code should use
+# AS_ECHO("message") and AS_ECHO_N("message"), respectively.
+as_echo='printf %s\n'
+as_echo_n='printf %s'
+
+
 rm -f conf$$ conf$$.exe conf$$.file
 if test -d conf$$.dir; then
 rm -f conf$$.dir/conf$$.file
@@ -587,48 +618,44 @@
 # Identity of this package.
 PACKAGE_NAME='stunnel'
 PACKAGE_TARNAME='stunnel'
-PACKAGE_VERSION='5.48'
-PACKAGE_STRING='stunnel 5.48'
+PACKAGE_VERSION='5.69'
+PACKAGE_STRING='stunnel 5.69'
 PACKAGE_BUGREPORT=''
 PACKAGE_URL=''
 
 ac_unique_file="src/stunnel.c"
 # Factoring default headers for most tests.
 ac_includes_default="\
-#include <stdio.h>
-#ifdef HAVE_SYS_TYPES_H
-# include <sys/types.h>
-#endif
-#ifdef HAVE_SYS_STAT_H
-# include <sys/stat.h>
+#include <stddef.h>
+#ifdef HAVE_STDIO_H
+# include <stdio.h>
 #endif
-#ifdef STDC_HEADERS
+#ifdef HAVE_STDLIB_H
 # include <stdlib.h>
-# include <stddef.h>
-#else
-# ifdef HAVE_STDLIB_H
-# include <stdlib.h>
-# endif
 #endif
 #ifdef HAVE_STRING_H
-# if !defined STDC_HEADERS && defined HAVE_MEMORY_H
-# include <memory.h>
-# endif
 # include <string.h>
 #endif
-#ifdef HAVE_STRINGS_H
-# include <strings.h>
-#endif
 #ifdef HAVE_INTTYPES_H
 # include <inttypes.h>
 #endif
 #ifdef HAVE_STDINT_H
 # include <stdint.h>
 #endif
+#ifdef HAVE_STRINGS_H
+# include <strings.h>
+#endif
+#ifdef HAVE_SYS_TYPES_H
+# include <sys/types.h>
+#endif
+#ifdef HAVE_SYS_STAT_H
+# include <sys/stat.h>
+#endif
 #ifdef HAVE_UNISTD_H
 # include <unistd.h>
 #endif"
 
+ac_header_c_list=
 ac_subst_vars='am__EXEEXT_FALSE
 am__EXEEXT_TRUE
 LTLIBOBJS
@@ -658,12 +685,14 @@
 LIBTOOL
 PTHREAD_CFLAGS
 PTHREAD_LIBS
+PTHREAD_CXX
 PTHREAD_CC
 ax_pthread_config
 EGREP
 GREP
 CPP
 SED
+bashcompdir
 am__fastdepCC_FALSE
 am__fastdepCC_TRUE
 CCDEPMODE
@@ -671,7 +700,6 @@
 AMDEPBACKSLASH
 AMDEP_FALSE
 AMDEP_TRUE
-am__quote
 am__include
 DEPDIR
 OBJEXT
@@ -689,12 +717,13 @@
 build_vendor
 build_cpu
 build
-AUTHOR_TESTS_FALSE
-AUTHOR_TESTS_TRUE
 AM_BACKSLASH
 AM_DEFAULT_VERBOSITY
 AM_DEFAULT_V
 AM_V
+CSCOPE
+ETAGS
+CTAGS
 am__untar
 am__tar
 AMTAR
@@ -756,12 +785,14 @@
 PACKAGE_TARNAME
 PACKAGE_NAME
 PATH_SEPARATOR
-SHELL'
+SHELL
+am__quote'
 ac_subst_files=''
 ac_user_opts='
 enable_option_checking
 enable_silent_rules
 enable_dependency_tracking
+with_bashcompdir
 with_threads
 enable_static
 enable_shared
@@ -858,8 +889,6 @@
 *) ac_optarg=yes ;;
 esac
 
- # Accept the important Cygnus configure options, so we can diagnose typos.
-
 case $ac_dashdash$ac_option in
 --)
 ac_dashdash=yes ;;
@@ -900,9 +929,9 @@
 ac_useropt=`expr "x$ac_option" : 'x-*disable-$.*$'`
 # Reject names that are not valid shell variable names.
 expr "x$ac_useropt" : ".*^-+._$as_cr_alnum" >/dev/null &&
- as_fn_error $? "invalid feature name: $ac_useropt"
+ as_fn_error $? "invalid feature name: \`$ac_useropt'"
 ac_useropt_orig=$ac_useropt
- ac_useropt=`$as_echo "$ac_useropt" | sed 's/-+./_/g'`
+ ac_useropt=`printf "%s\n" "$ac_useropt" | sed 's/-+./_/g'`
 case $ac_user_opts in
 *"
 "enable_$ac_useropt"
@@ -926,9 +955,9 @@
 ac_useropt=`expr "x$ac_option" : 'x-*enable-$^=*$'`
 # Reject names that are not valid shell variable names.
 expr "x$ac_useropt" : ".*^-+._$as_cr_alnum" >/dev/null &&
- as_fn_error $? "invalid feature name: $ac_useropt"
+ as_fn_error $? "invalid feature name: \`$ac_useropt'"
 ac_useropt_orig=$ac_useropt
- ac_useropt=`$as_echo "$ac_useropt" | sed 's/-+./_/g'`
+ ac_useropt=`printf "%s\n" "$ac_useropt" | sed 's/-+./_/g'`
 case $ac_user_opts in
 *"
 "enable_$ac_useropt"
@@ -1139,9 +1168,9 @@
 ac_useropt=`expr "x$ac_option" : 'x-*with-$^=*$'`
 # Reject names that are not valid shell variable names.
 expr "x$ac_useropt" : ".*^-+._$as_cr_alnum" >/dev/null &&
- as_fn_error $? "invalid package name: $ac_useropt"
+ as_fn_error $? "invalid package name: \`$ac_useropt'"
 ac_useropt_orig=$ac_useropt
- ac_useropt=`$as_echo "$ac_useropt" | sed 's/-+./_/g'`
+ ac_useropt=`printf "%s\n" "$ac_useropt" | sed 's/-+./_/g'`
 case $ac_user_opts in
 *"
 "with_$ac_useropt"
@@ -1155,9 +1184,9 @@
 ac_useropt=`expr "x$ac_option" : 'x-*without-$.*$'`
 # Reject names that are not valid shell variable names.
 expr "x$ac_useropt" : ".*^-+._$as_cr_alnum" >/dev/null &&
- as_fn_error $? "invalid package name: $ac_useropt"
+ as_fn_error $? "invalid package name: \`$ac_useropt'"
 ac_useropt_orig=$ac_useropt
- ac_useropt=`$as_echo "$ac_useropt" | sed 's/-+./_/g'`
+ ac_useropt=`printf "%s\n" "$ac_useropt" | sed 's/-+./_/g'`
 case $ac_user_opts in
 *"
 "with_$ac_useropt"
@@ -1201,9 +1230,9 @@
 
 *)
 # FIXME: should be removed in autoconf 3.0.
- $as_echo "$as_me: WARNING: you should use --build, --host, --target" >&2
+ printf "%s\n" "$as_me: WARNING: you should use --build, --host, --target" >&2
 expr "x$ac_option" : ".*^-._$as_cr_alnum" >/dev/null &&
- $as_echo "$as_me: WARNING: invalid host type: $ac_option" >&2
+ printf "%s\n" "$as_me: WARNING: invalid host type: $ac_option" >&2
 : "${build_alias=$ac_option} ${host_alias=$ac_option} ${target_alias=$ac_option}"
 ;;
 
@@ -1219,7 +1248,7 @@
 case $enable_option_checking in
 no) ;;
 fatal) as_fn_error $? "unrecognized options: $ac_unrecognized_opts" ;;
- *) $as_echo "$as_me: WARNING: unrecognized options: $ac_unrecognized_opts" >&2 ;;
+ *) printf "%s\n" "$as_me: WARNING: unrecognized options: $ac_unrecognized_opts" >&2 ;;
 esac
 fi
 
@@ -1283,7 +1312,7 @@
 	 X"$as_myself" : 'X$//$^/' \| \
 	 X"$as_myself" : 'X$//$$' \| \
 	 X"$as_myself" : 'X$/$' \| . 2>/dev/null ||
-$as_echo X"$as_myself" |
+printf "%s\n" X"$as_myself" |
 sed '/^X$.*^/$\/\/*^/^/*\/*$/{
 	 s//\1/
 	 q
@@ -1340,7 +1369,7 @@
 # Omit some internal or obsolete options to make the list less imposing.
 # This message is too long to be a string in the A/UX 3.1 sh.
 cat <<_ACEOF
-\`configure' configures stunnel 5.48 to adapt to many kinds of systems.
+\`configure' configures stunnel 5.69 to adapt to many kinds of systems.
 
 Usage: $0 OPTION... VAR=VALUE...
 
@@ -1411,7 +1440,7 @@
 
 if test -n "$ac_init_help"; then
 case $ac_init_help in
- short | recursive ) echo "Configuration of stunnel 5.48:";;
+ short | recursive ) echo "Configuration of stunnel 5.69:";;
 esac
 cat <<\_ACEOF
 
@@ -1439,6 +1468,7 @@
 Optional Packages:
 --with-PACKAGE=ARG use PACKAGE ARG=yes
 --without-PACKAGE do not use PACKAGE (same as --with-PACKAGE=no)
+ --with-bashcompdir=DIR directory for bash completions
 --with-threads=model select threading model (ucontext/pthread/fork)
 --with-pic=PKGS try to use only PIC/non-PIC objects default=use
 both
@@ -1483,9 +1513,9 @@
 case "$ac_dir" in
 .) ac_dir_suffix= ac_top_builddir_sub=. ac_top_build_prefix= ;;
 *)
- ac_dir_suffix=/`$as_echo "$ac_dir" | sed 's|^\.\\/||'`
+ ac_dir_suffix=/`printf "%s\n" "$ac_dir" | sed 's|^\.\\/||'`
 # A ".." for each directory in $ac_dir_suffix.
- ac_top_builddir_sub=`$as_echo "$ac_dir_suffix" | sed 's|/^\\/*|/..|g;s|/||'`
+ ac_top_builddir_sub=`printf "%s\n" "$ac_dir_suffix" | sed 's|/^\\/*|/..|g;s|/||'`
 case $ac_top_builddir_sub in
 "") ac_top_builddir_sub=. ac_top_build_prefix= ;;
 *) ac_top_build_prefix=$ac_top_builddir_sub/ ;;
@@ -1513,7 +1543,8 @@
 ac_abs_srcdir=$ac_abs_top_srcdir$ac_dir_suffix
 
 cd "$ac_dir" || { ac_status=$?; continue; }
- # Check for guested configure.
+ # Check for configure.gnu first; this name is used for a wrapper for
+ # Metaconfig's "Configure" on case-insensitive file systems.
 if test -f "$ac_srcdir/configure.gnu"; then
 echo &&
 $SHELL "$ac_srcdir/configure.gnu" --help=recursive
@@ -1521,7 +1552,7 @@
 echo &&
 $SHELL "$ac_srcdir/configure" --help=recursive
 else
- $as_echo "$as_me: WARNING: no configuration information is in $ac_dir" >&2
+ printf "%s\n" "$as_me: WARNING: no configuration information is in $ac_dir" >&2
 fi || ac_status=$?
 cd "$ac_pwd" || { ac_status=$?; break; }
 done
@@ -1530,10 +1561,10 @@
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
 cat <<\_ACEOF
-stunnel configure 5.48
-generated by GNU Autoconf 2.69
+stunnel configure 5.69
+generated by GNU Autoconf 2.71
 
-Copyright (C) 2012 Free Software Foundation, Inc.
+Copyright (C) 2021 Free Software Foundation, Inc.
 This configure script is free software; the Free Software Foundation
 gives unlimited permission to copy, distribute and modify it.
 _ACEOF
@@ -1550,14 +1581,14 @@
 ac_fn_c_try_compile ()
 {
 as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
- rm -f conftest.$ac_objext
+ rm -f conftest.$ac_objext conftest.beam
 if { { ac_try="$ac_compile"
 case "(($ac_try" in
 *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
 *) ac_try_echo=$ac_try;;
 esac
 eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
-$as_echo "$ac_try_echo"; } >&5
+printf "%s\n" "$ac_try_echo"; } >&5
 (eval "$ac_compile") 2>conftest.err
 ac_status=$?
 if test -s conftest.err; then
@@ -1565,14 +1596,15 @@
 cat conftest.er1 >&5
 mv -f conftest.er1 conftest.err
 fi
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; } && {
 	 test -z "$ac_c_werror_flag" ||
 	 test ! -s conftest.err
- } && test -s conftest.$ac_objext; then :
+ } && test -s conftest.$ac_objext
+then :
 ac_retval=0
-else
- $as_echo "$as_me: failed program was:" >&5
+else $as_nop
+ printf "%s\n" "$as_me: failed program was:" >&5
 sed 's/^/| /' conftest.$ac_ext >&5
 
 	ac_retval=1
@@ -1588,14 +1620,14 @@
 ac_fn_c_try_link ()
 {
 as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
- rm -f conftest.$ac_objext conftest$ac_exeext
+ rm -f conftest.$ac_objext conftest.beam conftest$ac_exeext
 if { { ac_try="$ac_link"
 case "(($ac_try" in
 *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
 *) ac_try_echo=$ac_try;;
 esac
 eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
-$as_echo "$ac_try_echo"; } >&5
+printf "%s\n" "$ac_try_echo"; } >&5
 (eval "$ac_link") 2>conftest.err
 ac_status=$?
 if test -s conftest.err; then
@@ -1603,17 +1635,18 @@
 cat conftest.er1 >&5
 mv -f conftest.er1 conftest.err
 fi
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; } && {
 	 test -z "$ac_c_werror_flag" ||
 	 test ! -s conftest.err
 } && test -s conftest$ac_exeext && {
 	 test "$cross_compiling" = yes ||
 	 test -x conftest$ac_exeext
- }; then :
+ }
+then :
 ac_retval=0
-else
- $as_echo "$as_me: failed program was:" >&5
+else $as_nop
+ printf "%s\n" "$as_me: failed program was:" >&5
 sed 's/^/| /' conftest.$ac_ext >&5
 
 	ac_retval=1
@@ -1640,7 +1673,7 @@
 *) ac_try_echo=$ac_try;;
 esac
 eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
-$as_echo "$ac_try_echo"; } >&5
+printf "%s\n" "$ac_try_echo"; } >&5
 (eval "$ac_cpp conftest.$ac_ext") 2>conftest.err
 ac_status=$?
 if test -s conftest.err; then
@@ -1648,14 +1681,15 @@
 cat conftest.er1 >&5
 mv -f conftest.er1 conftest.err
 fi
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; } > conftest.i && {
 	 test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
 	 test ! -s conftest.err
- }; then :
+ }
+then :
 ac_retval=0
-else
- $as_echo "$as_me: failed program was:" >&5
+else $as_nop
+ printf "%s\n" "$as_me: failed program was:" >&5
 sed 's/^/| /' conftest.$ac_ext >&5
 
 ac_retval=1
@@ -1672,83 +1706,44 @@
 ac_fn_c_check_header_compile ()
 {
 as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5
-$as_echo_n "checking for $2... " >&6; }
-if eval \${$3+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $2" >&5
+printf %s "checking for $2... " >&6; }
+if eval test \${$3+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
 $4
 #include <$2>
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
 eval "$3=yes"
-else
+else $as_nop
 eval "$3=no"
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 fi
 eval ac_res=\$$3
-	 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
+	 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
+printf "%s\n" "$ac_res" >&6; }
 eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
 
 } # ac_fn_c_check_header_compile
 
-# ac_fn_c_try_run LINENO
-# ----------------------
-# Try to link conftest.$ac_ext, and return whether this succeeded. Assumes
-# that executables *can* be run.
-ac_fn_c_try_run ()
-{
- as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
- if { { ac_try="$ac_link"
-case "(($ac_try" in
- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
- *) ac_try_echo=$ac_try;;
-esac
-eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
-$as_echo "$ac_try_echo"; } >&5
- (eval "$ac_link") 2>&5
- ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
- test $ac_status = 0; } && { ac_try='./conftest$ac_exeext'
- { { case "(($ac_try" in
- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
- *) ac_try_echo=$ac_try;;
-esac
-eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
-$as_echo "$ac_try_echo"; } >&5
- (eval "$ac_try") 2>&5
- ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
- test $ac_status = 0; }; }; then :
- ac_retval=0
-else
- $as_echo "$as_me: program exited with status $ac_status" >&5
- $as_echo "$as_me: failed program was:" >&5
-sed 's/^/| /' conftest.$ac_ext >&5
-
- ac_retval=$ac_status
-fi
- rm -rf conftest.dSYM conftest_ipa8_conftest.oo
- eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
- as_fn_set_status $ac_retval
-
-} # ac_fn_c_try_run
-
 # ac_fn_c_check_func LINENO FUNC VAR
 # ----------------------------------
 # Tests whether FUNC exists, setting the cache variable VAR accordingly
 ac_fn_c_check_func ()
 {
 as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5
-$as_echo_n "checking for $2... " >&6; }
-if eval \${$3+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $2" >&5
+printf %s "checking for $2... " >&6; }
+if eval test \${$3+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
 /* Define $2 to an innocuous variant, in case <limits.h> declares $2.
@@ -1756,16 +1751,9 @@
 #define $2 innocuous_$2
 
 /* System header to define __stub macros and hopefully few prototypes,
- which can conflict with char $2 (); below.
- Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
- <limits.h> exists even on freestanding compilers. */
-
-#ifdef __STDC__
-# include <limits.h>
-#else
-# include <assert.h>
-#endif
+ which can conflict with char $2 (); below. */
 
+#include <limits.h>
 #undef $2
 
 /* Override any GCC internal prototype to avoid an error.
@@ -1783,24 +1771,25 @@
 #endif
 
 int
-main ()
+main (void)
 {
 return $2 ();
 ;
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
 eval "$3=yes"
-else
+else $as_nop
 eval "$3=no"
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
 conftest$ac_exeext conftest.$ac_ext
 fi
 eval ac_res=\$$3
-	 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
+	 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
+printf "%s\n" "$ac_res" >&6; }
 eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
 
 } # ac_fn_c_check_func
@@ -1812,11 +1801,12 @@
 ac_fn_c_find_intX_t ()
 {
 as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for int$2_t" >&5
-$as_echo_n "checking for int$2_t... " >&6; }
-if eval \${$3+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for int$2_t" >&5
+printf %s "checking for int$2_t... " >&6; }
+if eval test \${$3+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 eval "$3=no"
 # Order is important - never check a type that is potentially smaller
 # than half of the expected target width.
@@ -1827,7 +1817,7 @@
 $ac_includes_default
 	 enum { N = $2 / 2 - 1 };
 int
-main ()
+main (void)
 {
 static int test_array 1 - 2 * !(0 < ($ac_type) ((((($ac_type) 1 << N) << N) - 1) * 2 + 1));
 test_array 0 = 0;
@@ -1837,13 +1827,14 @@
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
 $ac_includes_default
 	 enum { N = $2 / 2 - 1 };
 int
-main ()
+main (void)
 {
 static int test_array 1 - 2 * !(($ac_type) ((((($ac_type) 1 << N) << N) - 1) * 2 + 1)
 		 < ($ac_type) ((((($ac_type) 1 << N) << N) - 1) * 2 + 2));
@@ -1854,9 +1845,10 @@
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
 
-else
+else $as_nop
 case $ac_type in #(
 int$2_t) :
 eval "$3=yes" ;; #(
@@ -1864,19 +1856,20 @@
 eval "$3=\$ac_type" ;;
 esac
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
- if eval test \"x\$"$3"\" = x"no"; then :
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
+ if eval test \"x\$"$3"\" = x"no"
+then :
 
-else
+else $as_nop
 break
 fi
 done
 fi
 eval ac_res=\$$3
-	 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
+	 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
+printf "%s\n" "$ac_res" >&6; }
 eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
 
 } # ac_fn_c_find_intX_t
@@ -1888,11 +1881,12 @@
 ac_fn_c_find_uintX_t ()
 {
 as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for uint$2_t" >&5
-$as_echo_n "checking for uint$2_t... " >&6; }
-if eval \${$3+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for uint$2_t" >&5
+printf %s "checking for uint$2_t... " >&6; }
+if eval test \${$3+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 eval "$3=no"
 # Order is important - never check a type that is potentially smaller
 # than half of the expected target width.
@@ -1902,7 +1896,7 @@
 /* end confdefs.h. */
 $ac_includes_default
 int
-main ()
+main (void)
 {
 static int test_array 1 - 2 * !((($ac_type) -1 >> ($2 / 2 - 1)) >> ($2 / 2 - 1) == 3);
 test_array 0 = 0;
@@ -1912,7 +1906,8 @@
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
 case $ac_type in #(
 uint$2_t) :
 eval "$3=yes" ;; #(
@@ -1920,17 +1915,18 @@
 eval "$3=\$ac_type" ;;
 esac
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
- if eval test \"x\$"$3"\" = x"no"; then :
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
+ if eval test \"x\$"$3"\" = x"no"
+then :
 
-else
+else $as_nop
 break
 fi
 done
 fi
 eval ac_res=\$$3
-	 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
+	 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
+printf "%s\n" "$ac_res" >&6; }
 eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
 
 } # ac_fn_c_find_uintX_t
@@ -1942,17 +1938,18 @@
 ac_fn_c_check_type ()
 {
 as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5
-$as_echo_n "checking for $2... " >&6; }
-if eval \${$3+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $2" >&5
+printf %s "checking for $2... " >&6; }
+if eval test \${$3+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 eval "$3=no"
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
 $4
 int
-main ()
+main (void)
 {
 if (sizeof ($2))
 	 return 0;
@@ -1960,12 +1957,13 @@
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
 $4
 int
-main ()
+main (void)
 {
 if (sizeof (($2)))
 	 return 0;
@@ -1973,109 +1971,23 @@
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
 
-else
+else $as_nop
 eval "$3=yes"
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 fi
 eval ac_res=\$$3
-	 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
+	 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
+printf "%s\n" "$ac_res" >&6; }
 eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
 
 } # ac_fn_c_check_type
 
-# ac_fn_c_check_header_mongrel LINENO HEADER VAR INCLUDES
-# -------------------------------------------------------
-# Tests whether HEADER exists, giving a warning if it cannot be compiled using
-# the include files in INCLUDES and setting the cache variable VAR
-# accordingly.
-ac_fn_c_check_header_mongrel ()
-{
- as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
- if eval \${$3+:} false; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5
-$as_echo_n "checking for $2... " >&6; }
-if eval \${$3+:} false; then :
- $as_echo_n "(cached) " >&6
-fi
-eval ac_res=\$$3
-	 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
-else
- # Is the header compilable?
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking $2 usability" >&5
-$as_echo_n "checking $2 usability... " >&6; }
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h. */
-$4
-#include <$2>
-_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
- ac_header_compiler=yes
-else
- ac_header_compiler=no
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_header_compiler" >&5
-$as_echo "$ac_header_compiler" >&6; }
-
-# Is the header present?
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking $2 presence" >&5
-$as_echo_n "checking $2 presence... " >&6; }
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h. */
-#include <$2>
-_ACEOF
-if ac_fn_c_try_cpp "$LINENO"; then :
- ac_header_preproc=yes
-else
- ac_header_preproc=no
-fi
-rm -f conftest.err conftest.i conftest.$ac_ext
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_header_preproc" >&5
-$as_echo "$ac_header_preproc" >&6; }
-
-# So? What about this header?
-case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in #((
- yes:no: )
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: accepted by the compiler, rejected by the preprocessor!" >&5
-$as_echo "$as_me: WARNING: $2: accepted by the compiler, rejected by the preprocessor!" >&2;}
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: proceeding with the compiler's result" >&5
-$as_echo "$as_me: WARNING: $2: proceeding with the compiler's result" >&2;}
- ;;
- no:yes:* )
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: present but cannot be compiled" >&5
-$as_echo "$as_me: WARNING: $2: present but cannot be compiled" >&2;}
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: check for missing prerequisite headers?" >&5
-$as_echo "$as_me: WARNING: $2: check for missing prerequisite headers?" >&2;}
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: see the Autoconf documentation" >&5
-$as_echo "$as_me: WARNING: $2: see the Autoconf documentation" >&2;}
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: section \"Present But Cannot Be Compiled\"" >&5
-$as_echo "$as_me: WARNING: $2: section \"Present But Cannot Be Compiled\"" >&2;}
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: proceeding with the compiler's result" >&5
-$as_echo "$as_me: WARNING: $2: proceeding with the compiler's result" >&2;}
- ;;
-esac
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5
-$as_echo_n "checking for $2... " >&6; }
-if eval \${$3+:} false; then :
- $as_echo_n "(cached) " >&6
-else
- eval "$3=\$ac_header_compiler"
-fi
-eval ac_res=\$$3
-	 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
-fi
- eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
-
-} # ac_fn_c_check_header_mongrel
-
 # ac_fn_c_check_member LINENO AGGR MEMBER VAR INCLUDES
 # ----------------------------------------------------
 # Tries to find if the field MEMBER exists in type AGGR, after including
@@ -2083,16 +1995,17 @@
 ac_fn_c_check_member ()
 {
 as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2.$3" >&5
-$as_echo_n "checking for $2.$3... " >&6; }
-if eval \${$4+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $2.$3" >&5
+printf %s "checking for $2.$3... " >&6; }
+if eval test \${$4+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
 $5
 int
-main ()
+main (void)
 {
 static $2 ac_aggr;
 if (ac_aggr.$3)
@@ -2101,14 +2014,15 @@
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
 eval "$4=yes"
-else
+else $as_nop
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
 $5
 int
-main ()
+main (void)
 {
 static $2 ac_aggr;
 if (sizeof ac_aggr.$3)
@@ -2117,29 +2031,50 @@
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
 eval "$4=yes"
-else
+else $as_nop
 eval "$4=no"
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 fi
 eval ac_res=\$$4
-	 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
+	 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
+printf "%s\n" "$ac_res" >&6; }
 eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
 
 } # ac_fn_c_check_member
+ac_configure_args_raw=
+for ac_arg
+do
+ case $ac_arg in
+ *\'*)
+ ac_arg=`printf "%s\n" "$ac_arg" | sed "s/'/'\\\\\\\\''/g"` ;;
+ esac
+ as_fn_append ac_configure_args_raw " '$ac_arg'"
+done
+
+case $ac_configure_args_raw in
+ *$as_nl*)
+ ac_safe_unquote= ;;
+ *)
+ ac_unsafe_z='|&;<>()$`\\"*? ''	' # This string ends in space, tab.
+ ac_unsafe_a="$ac_unsafe_z#~"
+ ac_safe_unquote="s/ '\$^$ac_unsafe_a^$ac_unsafe_z*\$'/ \\1/g"
+ ac_configure_args_raw=` printf "%s\n" "$ac_configure_args_raw" | sed "$ac_safe_unquote"`;;
+esac
+
 cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by stunnel $as_me 5.48, which was
-generated by GNU Autoconf 2.69. Invocation command line was
+It was created by stunnel $as_me 5.69, which was
+generated by GNU Autoconf 2.71. Invocation command line was
 
- $ $0 $@
+ $ $0$ac_configure_args_raw
 
 _ACEOF
 exec 5>>config.log
@@ -2172,8 +2107,12 @@
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
- $as_echo "PATH: $as_dir"
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
+ printf "%s\n" "PATH: $as_dir"
 done
 IFS=$as_save_IFS
 
@@ -2208,7 +2147,7 @@
 | -silent | --silent | --silen | --sile | --sil)
 continue ;;
 *\'*)
- ac_arg=`$as_echo "$ac_arg" | sed "s/'/'\\\\\\\\''/g"` ;;
+ ac_arg=`printf "%s\n" "$ac_arg" | sed "s/'/'\\\\\\\\''/g"` ;;
 esac
 case $ac_pass in
 1) as_fn_append ac_configure_args0 " '$ac_arg'" ;;
@@ -2243,11 +2182,13 @@
 # WARNING: Use '\'' to represent an apostrophe within the trap.
 # WARNING: Do not start the trap code with a newline, due to a FreeBSD 4.0 bug.
 trap 'exit_status=$?
+ # Sanitize IFS.
+ IFS=" ""	$as_nl"
 # Save into config.log some information that might help in debugging.
 {
 echo
 
- $as_echo "## ---------------- ##
+ printf "%s\n" "## ---------------- ##
 ## Cache variables. ##
 ## ---------------- ##"
 echo
@@ -2258,8 +2199,8 @@
 case $ac_val in #(
 *${as_nl}*)
 case $ac_var in #(
- *_cv_*) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cache variable $ac_var contains a newline" >&5
-$as_echo "$as_me: WARNING: cache variable $ac_var contains a newline" >&2;} ;;
+ *_cv_*) { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: cache variable $ac_var contains a newline" >&5
+printf "%s\n" "$as_me: WARNING: cache variable $ac_var contains a newline" >&2;} ;;
 esac
 case $ac_var in #(
 _ | IFS | as_nl) ;; #(
@@ -2283,7 +2224,7 @@
 )
 echo
 
- $as_echo "## ----------------- ##
+ printf "%s\n" "## ----------------- ##
 ## Output variables. ##
 ## ----------------- ##"
 echo
@@ -2291,14 +2232,14 @@
 do
 eval ac_val=\$$ac_var
 case $ac_val in
- *\'\''*) ac_val=`$as_echo "$ac_val" | sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;;
+ *\'\''*) ac_val=`printf "%s\n" "$ac_val" | sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;;
 esac
- $as_echo "$ac_var='\''$ac_val'\''"
+ printf "%s\n" "$ac_var='\''$ac_val'\''"
 done | sort
 echo
 
 if test -n "$ac_subst_files"; then
- $as_echo "## ------------------- ##
+ printf "%s\n" "## ------------------- ##
 ## File substitutions. ##
 ## ------------------- ##"
 echo
@@ -2306,15 +2247,15 @@
 do
 	eval ac_val=\$$ac_var
 	case $ac_val in
-	*\'\''*) ac_val=`$as_echo "$ac_val" | sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;;
+	*\'\''*) ac_val=`printf "%s\n" "$ac_val" | sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;;
 	esac
-	$as_echo "$ac_var='\''$ac_val'\''"
+	printf "%s\n" "$ac_var='\''$ac_val'\''"
 done | sort
 echo
 fi
 
 if test -s confdefs.h; then
- $as_echo "## ----------- ##
+ printf "%s\n" "## ----------- ##
 ## confdefs.h. ##
 ## ----------- ##"
 echo
@@ -2322,8 +2263,8 @@
 echo
 fi
 test "$ac_signal" != 0 &&
- $as_echo "$as_me: caught signal $ac_signal"
- $as_echo "$as_me: exit $exit_status"
+ printf "%s\n" "$as_me: caught signal $ac_signal"
+ printf "%s\n" "$as_me: exit $exit_status"
 } >&5
 rm -f core *.core core.conftest.* &&
 rm -f -r conftest* confdefs* conf$$* $ac_clean_files &&
@@ -2337,63 +2278,48 @@
 # confdefs.h avoids OS command line length limits that DEFS can exceed.
 rm -f -r conftest* confdefs.h
 
-$as_echo "/* confdefs.h */" > confdefs.h
+printf "%s\n" "/* confdefs.h */" > confdefs.h
 
 # Predefined preprocessor variables.
 
-cat >>confdefs.h <<_ACEOF
-#define PACKAGE_NAME "$PACKAGE_NAME"
-_ACEOF
+printf "%s\n" "#define PACKAGE_NAME \"$PACKAGE_NAME\"" >>confdefs.h
 
-cat >>confdefs.h <<_ACEOF
-#define PACKAGE_TARNAME "$PACKAGE_TARNAME"
-_ACEOF
+printf "%s\n" "#define PACKAGE_TARNAME \"$PACKAGE_TARNAME\"" >>confdefs.h
 
-cat >>confdefs.h <<_ACEOF
-#define PACKAGE_VERSION "$PACKAGE_VERSION"
-_ACEOF
+printf "%s\n" "#define PACKAGE_VERSION \"$PACKAGE_VERSION\"" >>confdefs.h
 
-cat >>confdefs.h <<_ACEOF
-#define PACKAGE_STRING "$PACKAGE_STRING"
-_ACEOF
+printf "%s\n" "#define PACKAGE_STRING \"$PACKAGE_STRING\"" >>confdefs.h
 
-cat >>confdefs.h <<_ACEOF
-#define PACKAGE_BUGREPORT "$PACKAGE_BUGREPORT"
-_ACEOF
+printf "%s\n" "#define PACKAGE_BUGREPORT \"$PACKAGE_BUGREPORT\"" >>confdefs.h
 
-cat >>confdefs.h <<_ACEOF
-#define PACKAGE_URL "$PACKAGE_URL"
-_ACEOF
+printf "%s\n" "#define PACKAGE_URL \"$PACKAGE_URL\"" >>confdefs.h
 
 
 # Let the site file select an alternate cache file if it wants to.
 # Prefer an explicitly selected file to automatically selected ones.
-ac_site_file1=NONE
-ac_site_file2=NONE
 if test -n "$CONFIG_SITE"; then
- # We do not want a PATH search for config.site.
- case $CONFIG_SITE in #((
- -*) ac_site_file1=./$CONFIG_SITE;;
- */*) ac_site_file1=$CONFIG_SITE;;
- *) ac_site_file1=./$CONFIG_SITE;;
- esac
+ ac_site_files="$CONFIG_SITE"
 elif test "x$prefix" != xNONE; then
- ac_site_file1=$prefix/share/config.site
- ac_site_file2=$prefix/etc/config.site
+ ac_site_files="$prefix/share/config.site $prefix/etc/config.site"
 else
- ac_site_file1=$ac_default_prefix/share/config.site
- ac_site_file2=$ac_default_prefix/etc/config.site
+ ac_site_files="$ac_default_prefix/share/config.site $ac_default_prefix/etc/config.site"
 fi
-for ac_site_file in "$ac_site_file1" "$ac_site_file2"
+
+for ac_site_file in $ac_site_files
 do
- test "x$ac_site_file" = xNONE && continue
- if test /dev/null != "$ac_site_file" && test -r "$ac_site_file"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: loading site script $ac_site_file" >&5
-$as_echo "$as_me: loading site script $ac_site_file" >&6;}
+ case $ac_site_file in #(
+ */*) :
+ ;; #(
+ *) :
+ ac_site_file=./$ac_site_file ;;
+esac
+ if test -f "$ac_site_file" && test -r "$ac_site_file"; then
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: loading site script $ac_site_file" >&5
+printf "%s\n" "$as_me: loading site script $ac_site_file" >&6;}
 sed 's/^/| /' "$ac_site_file" >&5
 . "$ac_site_file" \
- || { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
-$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
+ || { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;}
 as_fn_error $? "failed to load site script $ac_site_file
 See \`config.log' for more details" "$LINENO" 5; }
 fi
@@ -2403,19 +2329,434 @@
 # Some versions of bash will fail to source /dev/null (special files
 # actually), so we avoid doing that. DJGPP emulates it as a regular file.
 if test /dev/null != "$cache_file" && test -f "$cache_file"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: loading cache $cache_file" >&5
-$as_echo "$as_me: loading cache $cache_file" >&6;}
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: loading cache $cache_file" >&5
+printf "%s\n" "$as_me: loading cache $cache_file" >&6;}
 case $cache_file in
 \\/* | ?:\\/* ) . "$cache_file";;
 *) . "./$cache_file";;
 esac
 fi
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: creating cache $cache_file" >&5
-$as_echo "$as_me: creating cache $cache_file" >&6;}
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: creating cache $cache_file" >&5
+printf "%s\n" "$as_me: creating cache $cache_file" >&6;}
 >$cache_file
 fi
 
+# Test code for whether the C compiler supports C89 (global declarations)
+ac_c_conftest_c89_globals='
+/* Does the compiler advertise C89 conformance?
+ Do not test the value of __STDC__, because some compilers set it to 0
+ while being otherwise adequately conformant. */
+#if !defined __STDC__
+# error "Compiler does not advertise C89 conformance"
+#endif
+
+#include <stddef.h>
+#include <stdarg.h>
+struct stat;
+/* Most of the following tests are stolen from RCS 5.7 src/conf.sh. */
+struct buf { int x; };
+struct buf * (*rcsopen) (struct buf *, struct stat *, int);
+static char *e (p, i)
+ char **p;
+ int i;
+{
+ return pi;
+}
+static char *f (char * (*g) (char **, int), char **p, ...)
+{
+ char *s;
+ va_list v;
+ va_start (v,p);
+ s = g (p, va_arg (v,int));
+ va_end (v);
+ return s;
+}
+
+/* OSF 4.0 Compaq cc is some sort of almost-ANSI by default. It has
+ function prototypes and stuff, but not \xHH hex character constants.
+ These do not provoke an error unfortunately, instead are silently treated
+ as an "x". The following induces an error, until -std is added to get
+ proper ANSI mode. Curiously \x00 != x always comes out true, for an
+ array size at least. It is necessary to write \x00 == 0 to get something
+ that is true only with -std. */
+int osf4_cc_array '\''\x00'\'' == 0 ? 1 : -1;
+
+/* IBM C 6 for AIX is almost-ANSI by default, but it replaces macro parameters
+ inside strings and character constants. */
+#define FOO(x) '\''x'\''
+int xlc6_cc_arrayFOO(a) == '\''x'\'' ? 1 : -1;
+
+int test (int i, double x);
+struct s1 {int (*f) (int a);};
+struct s2 {int (*f) (double a);};
+int pairnames (int, char **, int *(*)(struct buf *, struct stat *, int),
+ int, int);'
+
+# Test code for whether the C compiler supports C89 (body of main).
+ac_c_conftest_c89_main='
+ok |= (argc == 0 || f (e, argv, 0) != argv0 || f (e, argv, 1) != argv1);
+'
+
+# Test code for whether the C compiler supports C99 (global declarations)
+ac_c_conftest_c99_globals='
+// Does the compiler advertise C99 conformance?
+#if !defined __STDC_VERSION__ || __STDC_VERSION__ < 199901L
+# error "Compiler does not advertise C99 conformance"
+#endif
+
+#include <stdbool.h>
+extern int puts (const char *);
+extern int printf (const char *, ...);
+extern int dprintf (int, const char *, ...);
+extern void *malloc (size_t);
+
+// Check varargs macros. These examples are taken from C99 6.10.3.5.
+// dprintf is used instead of fprintf to avoid needing to declare
+// FILE and stderr.
+#define debug(...) dprintf (2, __VA_ARGS__)
+#define showlist(...) puts (#__VA_ARGS__)
+#define report(test,...) ((test) ? puts (#test) : printf (__VA_ARGS__))
+static void
+test_varargs_macros (void)
+{
+ int x = 1234;
+ int y = 5678;
+ debug ("Flag");
+ debug ("X = %d\n", x);
+ showlist (The first, second, and third items.);
+ report (x>y, "x is %d but y is %d", x, y);
+}
+
+// Check long long types.
+#define BIG64 18446744073709551615ull
+#define BIG32 4294967295ul
+#define BIG_OK (BIG64 / BIG32 == 4294967297ull && BIG64 % BIG32 == 0)
+#if !BIG_OK
+ #error "your preprocessor is broken"
+#endif
+#if BIG_OK
+#else
+ #error "your preprocessor is broken"
+#endif
+static long long int bignum = -9223372036854775807LL;
+static unsigned long long int ubignum = BIG64;
+
+struct incomplete_array
+{
+ int datasize;
+ double data;
+};
+
+struct named_init {
+ int number;
+ const wchar_t *name;
+ double average;
+};
+
+typedef const char *ccp;
+
+static inline int
+test_restrict (ccp restrict text)
+{
+ // See if C++-style comments work.
+ // Iterate through items via the restricted pointer.
+ // Also check for declarations in for loops.
+ for (unsigned int i = 0; *(text+i) != '\''\0'\''; ++i)
+ continue;
+ return 0;
+}
+
+// Check varargs and va_copy.
+static bool
+test_varargs (const char *format, ...)
+{
+ va_list args;
+ va_start (args, format);
+ va_list args_copy;
+ va_copy (args_copy, args);
+
+ const char *str = "";
+ int number = 0;
+ float fnumber = 0;
+
+ while (*format)
+ {
+ switch (*format++)
+	{
+	case '\''s'\'': // string
+	 str = va_arg (args_copy, const char *);
+	 break;
+	case '\''d'\'': // int
+	 number = va_arg (args_copy, int);
+	 break;
+	case '\''f'\'': // float
+	 fnumber = va_arg (args_copy, double);
+	 break;
+	default:
+	 break;
+	}
+ }
+ va_end (args_copy);
+ va_end (args);
+
+ return *str && number && fnumber;
+}
+'
+
+# Test code for whether the C compiler supports C99 (body of main).
+ac_c_conftest_c99_main='
+ // Check bool.
+ _Bool success = false;
+ success |= (argc != 0);
+
+ // Check restrict.
+ if (test_restrict ("String literal") == 0)
+ success = true;
+ char *restrict newvar = "Another string";
+
+ // Check varargs.
+ success &= test_varargs ("s, d'\'' f .", "string", 65, 34.234);
+ test_varargs_macros ();
+
+ // Check flexible array members.
+ struct incomplete_array *ia =
+ malloc (sizeof (struct incomplete_array) + (sizeof (double) * 10));
+ ia->datasize = 10;
+ for (int i = 0; i < ia->datasize; ++i)
+ ia->datai = i * 1.234;
+
+ // Check named initializers.
+ struct named_init ni = {
+ .number = 34,
+ .name = L"Test wide string",
+ .average = 543.34343,
+ };
+
+ ni.number = 58;
+
+ int dynamic_arrayni.number;
+ dynamic_array0 = argv00;
+ dynamic_arrayni.number - 1 = 543;
+
+ // work around unused variable warnings
+ ok |= (!success || bignum == 0LL || ubignum == 0uLL || newvar0 == '\''x'\''
+	 || dynamic_arrayni.number - 1 != 543);
+'
+
+# Test code for whether the C compiler supports C11 (global declarations)
+ac_c_conftest_c11_globals='
+// Does the compiler advertise C11 conformance?
+#if !defined __STDC_VERSION__ || __STDC_VERSION__ < 201112L
+# error "Compiler does not advertise C11 conformance"
+#endif
+
+// Check _Alignas.
+char _Alignas (double) aligned_as_double;
+char _Alignas (0) no_special_alignment;
+extern char aligned_as_int;
+char _Alignas (0) _Alignas (int) aligned_as_int;
+
+// Check _Alignof.
+enum
+{
+ int_alignment = _Alignof (int),
+ int_array_alignment = _Alignof (int100),
+ char_alignment = _Alignof (char)
+};
+_Static_assert (0 < -_Alignof (int), "_Alignof is signed");
+
+// Check _Noreturn.
+int _Noreturn does_not_return (void) { for (;;) continue; }
+
+// Check _Static_assert.
+struct test_static_assert
+{
+ int x;
+ _Static_assert (sizeof (int) <= sizeof (long int),
+ "_Static_assert does not work in struct");
+ long int y;
+};
+
+// Check UTF-8 literals.
+#define u8 syntax error!
+char const utf8_literal = u8"happens to be ASCII" "another string";
+
+// Check duplicate typedefs.
+typedef long *long_ptr;
+typedef long int *long_ptr;
+typedef long_ptr long_ptr;
+
+// Anonymous structures and unions -- taken from C11 6.7.2.1 Example 1.
+struct anonymous
+{
+ union {
+ struct { int i; int j; };
+ struct { int k; long int l; } w;
+ };
+ int m;
+} v1;
+'
+
+# Test code for whether the C compiler supports C11 (body of main).
+ac_c_conftest_c11_main='
+ _Static_assert ((offsetof (struct anonymous, i)
+		 == offsetof (struct anonymous, w.k)),
+		 "Anonymous union alignment botch");
+ v1.i = 2;
+ v1.w.k = 5;
+ ok |= v1.i != 5;
+'
+
+# Test code for whether the C compiler supports C11 (complete).
+ac_c_conftest_c11_program="${ac_c_conftest_c89_globals}
+${ac_c_conftest_c99_globals}
+${ac_c_conftest_c11_globals}
+
+int
+main (int argc, char **argv)
+{
+ int ok = 0;
+ ${ac_c_conftest_c89_main}
+ ${ac_c_conftest_c99_main}
+ ${ac_c_conftest_c11_main}
+ return ok;
+}
+"
+
+# Test code for whether the C compiler supports C99 (complete).
+ac_c_conftest_c99_program="${ac_c_conftest_c89_globals}
+${ac_c_conftest_c99_globals}
+
+int
+main (int argc, char **argv)
+{
+ int ok = 0;
+ ${ac_c_conftest_c89_main}
+ ${ac_c_conftest_c99_main}
+ return ok;
+}
+"
+
+# Test code for whether the C compiler supports C89 (complete).
+ac_c_conftest_c89_program="${ac_c_conftest_c89_globals}
+
+int
+main (int argc, char **argv)
+{
+ int ok = 0;
+ ${ac_c_conftest_c89_main}
+ return ok;
+}
+"
+
+as_fn_append ac_header_c_list " stdio.h stdio_h HAVE_STDIO_H"
+as_fn_append ac_header_c_list " stdlib.h stdlib_h HAVE_STDLIB_H"
+as_fn_append ac_header_c_list " string.h string_h HAVE_STRING_H"
+as_fn_append ac_header_c_list " inttypes.h inttypes_h HAVE_INTTYPES_H"
+as_fn_append ac_header_c_list " stdint.h stdint_h HAVE_STDINT_H"
+as_fn_append ac_header_c_list " strings.h strings_h HAVE_STRINGS_H"
+as_fn_append ac_header_c_list " sys/stat.h sys_stat_h HAVE_SYS_STAT_H"
+as_fn_append ac_header_c_list " sys/types.h sys_types_h HAVE_SYS_TYPES_H"
+as_fn_append ac_header_c_list " unistd.h unistd_h HAVE_UNISTD_H"
+
+# Auxiliary files required by this configure script.
+ac_aux_files="ltmain.sh compile config.guess config.sub missing install-sh"
+
+# Locations in which to look for auxiliary files.
+ac_aux_dir_candidates="${srcdir}/auto"
+
+# Search for a directory containing all of the required auxiliary files,
+# $ac_aux_files, from the $PATH-style list $ac_aux_dir_candidates.
+# If we don't find one directory that contains all the files we need,
+# we report the set of missing files from the *first* directory in
+# $ac_aux_dir_candidates and give up.
+ac_missing_aux_files=""
+ac_first_candidate=:
+printf "%s\n" "$as_me:${as_lineno-$LINENO}: looking for aux files: $ac_aux_files" >&5
+as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+as_found=false
+for as_dir in $ac_aux_dir_candidates
+do
+ IFS=$as_save_IFS
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
+ as_found=:
+
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: trying $as_dir" >&5
+ ac_aux_dir_found=yes
+ ac_install_sh=
+ for ac_aux in $ac_aux_files
+ do
+ # As a special case, if "install-sh" is required, that requirement
+ # can be satisfied by any of "install-sh", "install.sh", or "shtool",
+ # and $ac_install_sh is set appropriately for whichever one is found.
+ if test x"$ac_aux" = x"install-sh"
+ then
+ if test -f "${as_dir}install-sh"; then
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: ${as_dir}install-sh found" >&5
+ ac_install_sh="${as_dir}install-sh -c"
+ elif test -f "${as_dir}install.sh"; then
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: ${as_dir}install.sh found" >&5
+ ac_install_sh="${as_dir}install.sh -c"
+ elif test -f "${as_dir}shtool"; then
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: ${as_dir}shtool found" >&5
+ ac_install_sh="${as_dir}shtool install -c"
+ else
+ ac_aux_dir_found=no
+ if $ac_first_candidate; then
+ ac_missing_aux_files="${ac_missing_aux_files} install-sh"
+ else
+ break
+ fi
+ fi
+ else
+ if test -f "${as_dir}${ac_aux}"; then
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: ${as_dir}${ac_aux} found" >&5
+ else
+ ac_aux_dir_found=no
+ if $ac_first_candidate; then
+ ac_missing_aux_files="${ac_missing_aux_files} ${ac_aux}"
+ else
+ break
+ fi
+ fi
+ fi
+ done
+ if test "$ac_aux_dir_found" = yes; then
+ ac_aux_dir="$as_dir"
+ break
+ fi
+ ac_first_candidate=false
+
+ as_found=false
+done
+IFS=$as_save_IFS
+if $as_found
+then :
+
+else $as_nop
+ as_fn_error $? "cannot find required auxiliary files:$ac_missing_aux_files" "$LINENO" 5
+fi
+
+
+# These three variables are undocumented and unsupported,
+# and are intended to be withdrawn in a future Autoconf release.
+# They can cause serious problems if a builder's source tree is in a directory
+# whose full name contains unusual characters.
+if test -f "${ac_aux_dir}config.guess"; then
+ ac_config_guess="$SHELL ${ac_aux_dir}config.guess"
+fi
+if test -f "${ac_aux_dir}config.sub"; then
+ ac_config_sub="$SHELL ${ac_aux_dir}config.sub"
+fi
+if test -f "$ac_aux_dir/configure"; then
+ ac_configure="$SHELL ${ac_aux_dir}configure"
+fi
+
 # Check that the precious variables saved in the cache have kept the same
 # value.
 ac_cache_corrupted=false
@@ -2426,12 +2767,12 @@
 eval ac_new_val=\$ac_env_${ac_var}_value
 case $ac_old_set,$ac_new_set in
 set,)
- { $as_echo "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&5
-$as_echo "$as_me: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&2;}
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&5
+printf "%s\n" "$as_me: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&2;}
 ac_cache_corrupted=: ;;
 ,set)
- { $as_echo "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' was not set in the previous run" >&5
-$as_echo "$as_me: error: \`$ac_var' was not set in the previous run" >&2;}
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' was not set in the previous run" >&5
+printf "%s\n" "$as_me: error: \`$ac_var' was not set in the previous run" >&2;}
 ac_cache_corrupted=: ;;
 ,);;
 *)
@@ -2440,24 +2781,24 @@
 	ac_old_val_w=`echo x $ac_old_val`
 	ac_new_val_w=`echo x $ac_new_val`
 	if test "$ac_old_val_w" != "$ac_new_val_w"; then
-	 { $as_echo "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' has changed since the previous run:" >&5
-$as_echo "$as_me: error: \`$ac_var' has changed since the previous run:" >&2;}
+	 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' has changed since the previous run:" >&5
+printf "%s\n" "$as_me: error: \`$ac_var' has changed since the previous run:" >&2;}
 	 ac_cache_corrupted=:
 	else
-	 { $as_echo "$as_me:${as_lineno-$LINENO}: warning: ignoring whitespace changes in \`$ac_var' since the previous run:" >&5
-$as_echo "$as_me: warning: ignoring whitespace changes in \`$ac_var' since the previous run:" >&2;}
+	 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: warning: ignoring whitespace changes in \`$ac_var' since the previous run:" >&5
+printf "%s\n" "$as_me: warning: ignoring whitespace changes in \`$ac_var' since the previous run:" >&2;}
 	 eval $ac_var=\$ac_old_val
 	fi
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: former value: \`$ac_old_val'" >&5
-$as_echo "$as_me: former value: \`$ac_old_val'" >&2;}
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: current value: \`$ac_new_val'" >&5
-$as_echo "$as_me: current value: \`$ac_new_val'" >&2;}
+	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: former value: \`$ac_old_val'" >&5
+printf "%s\n" "$as_me: former value: \`$ac_old_val'" >&2;}
+	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: current value: \`$ac_new_val'" >&5
+printf "%s\n" "$as_me: current value: \`$ac_new_val'" >&2;}
 fi;;
 esac
 # Pass precious variables to config.status.
 if test "$ac_new_set" = set; then
 case $ac_new_val in
- *\'*) ac_arg=$ac_var=`$as_echo "$ac_new_val" | sed "s/'/'\\\\\\\\''/g"` ;;
+ *\'*) ac_arg=$ac_var=`printf "%s\n" "$ac_new_val" | sed "s/'/'\\\\\\\\''/g"` ;;
 *) ac_arg=$ac_var=$ac_new_val ;;
 esac
 case " $ac_configure_args " in
@@ -2467,11 +2808,12 @@
 fi
 done
 if $ac_cache_corrupted; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
-$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
- { $as_echo "$as_me:${as_lineno-$LINENO}: error: changes in the environment can compromise the build" >&5
-$as_echo "$as_me: error: changes in the environment can compromise the build" >&2;}
- as_fn_error $? "run \`make distclean' and/or \`rm $cache_file' and start over" "$LINENO" 5
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;}
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: changes in the environment can compromise the build" >&5
+printf "%s\n" "$as_me: error: changes in the environment can compromise the build" >&2;}
+ as_fn_error $? "run \`${MAKE-make} distclean' and/or \`rm $cache_file'
+	 and start over" "$LINENO" 5
 fi
 ## -------------------- ##
 ## Main body of script. ##
@@ -2484,44 +2826,18 @@
 ac_compiler_gnu=$ac_cv_c_compiler_gnu
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: **************************************** initialization" >&5
-$as_echo "$as_me: **************************************** initialization" >&6;}
-ac_aux_dir=
-for ac_dir in auto "$srcdir"/auto; do
- if test -f "$ac_dir/install-sh"; then
- ac_aux_dir=$ac_dir
- ac_install_sh="$ac_aux_dir/install-sh -c"
- break
- elif test -f "$ac_dir/install.sh"; then
- ac_aux_dir=$ac_dir
- ac_install_sh="$ac_aux_dir/install.sh -c"
- break
- elif test -f "$ac_dir/shtool"; then
- ac_aux_dir=$ac_dir
- ac_install_sh="$ac_aux_dir/shtool install -c"
- break
- fi
-done
-if test -z "$ac_aux_dir"; then
- as_fn_error $? "cannot find install-sh, install.sh, or shtool in auto \"$srcdir\"/auto" "$LINENO" 5
-fi
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: **************************************** initialization" >&5
+printf "%s\n" "$as_me: **************************************** initialization" >&6;}
 
-# These three variables are undocumented and unsupported,
-# and are intended to be withdrawn in a future Autoconf release.
-# They can cause serious problems if a builder's source tree is in a directory
-# whose full name contains unusual characters.
-ac_config_guess="$SHELL $ac_aux_dir/config.guess" # Please don't use this var.
-ac_config_sub="$SHELL $ac_aux_dir/config.sub" # Please don't use this var.
-ac_configure="$SHELL $ac_aux_dir/configure" # Please don't use this var.
 
+ac_config_headers="$ac_config_headers src/config.h"
 
 
-ac_config_headers="$ac_config_headers src/config.h"
+am__api_version='1.16'
 
 
-am__api_version='1.15'
 
-# Find a good install program. We prefer a C program (faster),
+ # Find a good install program. We prefer a C program (faster),
 # so one script is as good as another. But avoid the broken or
 # incompatible versions:
 # SysV /etc/install, /usr/sbin/install
@@ -2535,20 +2851,25 @@
 # OS/2's system install, which has a completely different semantic
 # ./install, which can be erroneously created by make from ./install.sh.
 # Reject install programs that cannot install multiple files.
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for a BSD-compatible install" >&5
-$as_echo_n "checking for a BSD-compatible install... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for a BSD-compatible install" >&5
+printf %s "checking for a BSD-compatible install... " >&6; }
 if test -z "$INSTALL"; then
-if ${ac_cv_path_install+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+if test ${ac_cv_path_install+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
- # Account for people who put trailing slashes in PATH elements.
-case $as_dir/ in #((
- ./ | .// | /cC/* | \
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
+ # Account for fact that we put trailing slashes in our PATH walk.
+case $as_dir in #((
+ ./ | /cC/* | \
 /etc/* | /usr/sbin/* | /usr/etc/* | /sbin/* | /usr/afsws/bin/* | \
 ?:\\/os2\\/install\\/* | ?:\\/OS2\\/INSTALL\\/* | \
 /usr/ucb/* ) ;;
@@ -2558,13 +2879,13 @@
 # by default.
 for ac_prog in ginstall scoinst install; do
 for ac_exec_ext in '' $ac_executable_extensions; do
-	if as_fn_executable_p "$as_dir/$ac_prog$ac_exec_ext"; then
+	if as_fn_executable_p "$as_dir$ac_prog$ac_exec_ext"; then
 	 if test $ac_prog = install &&
-	 grep dspmsg "$as_dir/$ac_prog$ac_exec_ext" >/dev/null 2>&1; then
+	 grep dspmsg "$as_dir$ac_prog$ac_exec_ext" >/dev/null 2>&1; then
 	 # AIX install. It has an incompatible calling convention.
 	 :
 	 elif test $ac_prog = install &&
-	 grep pwplus "$as_dir/$ac_prog$ac_exec_ext" >/dev/null 2>&1; then
+	 grep pwplus "$as_dir$ac_prog$ac_exec_ext" >/dev/null 2>&1; then
 	 # program-specific install script used by HP pwplus--don't use.
 	 :
 	 else
@@ -2572,12 +2893,12 @@
 	 echo one > conftest.one
 	 echo two > conftest.two
 	 mkdir conftest.dir
-	 if "$as_dir/$ac_prog$ac_exec_ext" -c conftest.one conftest.two "`pwd`/conftest.dir" &&
+	 if "$as_dir$ac_prog$ac_exec_ext" -c conftest.one conftest.two "`pwd`/conftest.dir/" &&
 	 test -s conftest.one && test -s conftest.two &&
 	 test -s conftest.dir/conftest.one &&
 	 test -s conftest.dir/conftest.two
 	 then
-	 ac_cv_path_install="$as_dir/$ac_prog$ac_exec_ext -c"
+	 ac_cv_path_install="$as_dir$ac_prog$ac_exec_ext -c"
 	 break 3
 	 fi
 	 fi
@@ -2593,7 +2914,7 @@
 rm -rf conftest.one conftest.two conftest.dir
 
 fi
- if test "${ac_cv_path_install+set}" = set; then
+ if test ${ac_cv_path_install+y}; then
 INSTALL=$ac_cv_path_install
 else
 # As a last resort, use the slow shell script. Don't cache a
@@ -2603,8 +2924,8 @@
 INSTALL=$ac_install_sh
 fi
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $INSTALL" >&5
-$as_echo "$INSTALL" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $INSTALL" >&5
+printf "%s\n" "$INSTALL" >&6; }
 
 # Use test -z because SunOS4 sh mishandles braces in ${var-val}.
 # It thinks the first close brace ends the variable substitution.
@@ -2614,8 +2935,8 @@
 
 test -z "$INSTALL_DATA" && INSTALL_DATA='${INSTALL} -m 644'
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether build environment is sane" >&5
-$as_echo_n "checking whether build environment is sane... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether build environment is sane" >&5
+printf %s "checking whether build environment is sane... " >&6; }
 # Reject unsafe characters in $srcdir or the absolute working directory
 # name. Accept space and tab only in the latter.
 am_lf='
@@ -2669,8 +2990,8 @@
 as_fn_error $? "newly created file is older than distributed files!
 Check your system clock" "$LINENO" 5
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 # If we didn't sleep, we still need to ensure time stamps of config.status and
 # generated files are strictly newer.
 am_sleep_pid=
@@ -2689,26 +3010,23 @@
 # Double any \ or $.
 # By default was `s,x,x', remove it if useless.
 ac_script='s/\\$/&&/g;s/;s,x,x,$//'
-program_transform_name=`$as_echo "$program_transform_name" | sed "$ac_script"`
+program_transform_name=`printf "%s\n" "$program_transform_name" | sed "$ac_script"`
+
 
 # Expand $ac_aux_dir to an absolute path.
 am_aux_dir=`cd "$ac_aux_dir" && pwd`
 
-if test x"${MISSING+set}" != xset; then
- case $am_aux_dir in
- *\ * | *\	*)
- MISSING="\${SHELL} \"$am_aux_dir/missing\"" ;;
- *)
- MISSING="\${SHELL} $am_aux_dir/missing" ;;
- esac
+
+ if test x"${MISSING+set}" != xset; then
+ MISSING="\${SHELL} '$am_aux_dir/missing'"
 fi
 # Use eval to expand $SHELL
 if eval "$MISSING --is-lightweight"; then
 am_missing_run="$MISSING "
 else
 am_missing_run=
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: 'missing' script is too old or missing" >&5
-$as_echo "$as_me: WARNING: 'missing' script is too old or missing" >&2;}
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: 'missing' script is too old or missing" >&5
+printf "%s\n" "$as_me: WARNING: 'missing' script is too old or missing" >&2;}
 fi
 
 if test x"${install_sh+set}" != xset; then
@@ -2728,11 +3046,12 @@
 if test -n "$ac_tool_prefix"; then
 # Extract the first word of "${ac_tool_prefix}strip", so it can be a program name with args.
 set dummy ${ac_tool_prefix}strip; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_STRIP+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_STRIP+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if test -n "$STRIP"; then
 ac_cv_prog_STRIP="$STRIP" # Let the user override the test.
 else
@@ -2740,11 +3059,15 @@
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
 for ac_exec_ext in '' $ac_executable_extensions; do
- if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+ if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
 ac_cv_prog_STRIP="${ac_tool_prefix}strip"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
 break 2
 fi
 done
@@ -2755,11 +3078,11 @@
 fi
 STRIP=$ac_cv_prog_STRIP
 if test -n "$STRIP"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $STRIP" >&5
-$as_echo "$STRIP" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $STRIP" >&5
+printf "%s\n" "$STRIP" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -2768,11 +3091,12 @@
 ac_ct_STRIP=$STRIP
 # Extract the first word of "strip", so it can be a program name with args.
 set dummy strip; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_ac_ct_STRIP+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_ac_ct_STRIP+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if test -n "$ac_ct_STRIP"; then
 ac_cv_prog_ac_ct_STRIP="$ac_ct_STRIP" # Let the user override the test.
 else
@@ -2780,11 +3104,15 @@
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
 for ac_exec_ext in '' $ac_executable_extensions; do
- if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+ if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
 ac_cv_prog_ac_ct_STRIP="strip"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
 break 2
 fi
 done
@@ -2795,11 +3123,11 @@
 fi
 ac_ct_STRIP=$ac_cv_prog_ac_ct_STRIP
 if test -n "$ac_ct_STRIP"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_STRIP" >&5
-$as_echo "$ac_ct_STRIP" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_ct_STRIP" >&5
+printf "%s\n" "$ac_ct_STRIP" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 if test "x$ac_ct_STRIP" = x; then
@@ -2807,8 +3135,8 @@
 else
 case $cross_compiling:$ac_tool_warned in
 yes:)
-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
-$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
+printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
 ac_tool_warned=yes ;;
 esac
 STRIP=$ac_ct_STRIP
@@ -2820,25 +3148,31 @@
 fi
 INSTALL_STRIP_PROGRAM="\$(install_sh) -c -s"
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for a thread-safe mkdir -p" >&5
-$as_echo_n "checking for a thread-safe mkdir -p... " >&6; }
+
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for a race-free mkdir -p" >&5
+printf %s "checking for a race-free mkdir -p... " >&6; }
 if test -z "$MKDIR_P"; then
- if ${ac_cv_path_mkdir+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ if test ${ac_cv_path_mkdir+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
 for as_dir in $PATH$PATH_SEPARATOR/opt/sfw/bin
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
 for ac_prog in mkdir gmkdir; do
 	 for ac_exec_ext in '' $ac_executable_extensions; do
-	 as_fn_executable_p "$as_dir/$ac_prog$ac_exec_ext" || continue
-	 case `"$as_dir/$ac_prog$ac_exec_ext" --version 2>&1` in #(
-	 'mkdir (GNU coreutils) '* | \
-	 'mkdir (coreutils) '* | \
+	 as_fn_executable_p "$as_dir$ac_prog$ac_exec_ext" || continue
+	 case `"$as_dir$ac_prog$ac_exec_ext" --version 2>&1` in #(
+	 'mkdir ('*'coreutils) '* | \
+	 'BusyBox '* | \
 	 'mkdir (fileutils) '4.1*)
-	 ac_cv_path_mkdir=$as_dir/$ac_prog$ac_exec_ext
+	 ac_cv_path_mkdir=$as_dir$ac_prog$ac_exec_ext
 	 break 3;;
 	 esac
 	 done
@@ -2849,7 +3183,7 @@
 fi
 
 test -d ./--version && rmdir ./--version
- if test "${ac_cv_path_mkdir+set}" = set; then
+ if test ${ac_cv_path_mkdir+y}; then
 MKDIR_P="$ac_cv_path_mkdir -p"
 else
 # As a last resort, use the slow shell script. Don't cache a
@@ -2859,18 +3193,19 @@
 MKDIR_P="$ac_install_sh -d"
 fi
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $MKDIR_P" >&5
-$as_echo "$MKDIR_P" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $MKDIR_P" >&5
+printf "%s\n" "$MKDIR_P" >&6; }
 
 for ac_prog in gawk mawk nawk awk
 do
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_AWK+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_AWK+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if test -n "$AWK"; then
 ac_cv_prog_AWK="$AWK" # Let the user override the test.
 else
@@ -2878,11 +3213,15 @@
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
 for ac_exec_ext in '' $ac_executable_extensions; do
- if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+ if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
 ac_cv_prog_AWK="$ac_prog"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
 break 2
 fi
 done
@@ -2893,24 +3232,25 @@
 fi
 AWK=$ac_cv_prog_AWK
 if test -n "$AWK"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $AWK" >&5
-$as_echo "$AWK" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $AWK" >&5
+printf "%s\n" "$AWK" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
 test -n "$AWK" && break
 done
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether ${MAKE-make} sets \$(MAKE)" >&5
-$as_echo_n "checking whether ${MAKE-make} sets \$(MAKE)... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether ${MAKE-make} sets \$(MAKE)" >&5
+printf %s "checking whether ${MAKE-make} sets \$(MAKE)... " >&6; }
 set x ${MAKE-make}
-ac_make=`$as_echo "$2" | sed 's/+/p/g; s/^a-zA-Z0-9_/_/g'`
-if eval \${ac_cv_prog_make_${ac_make}_set+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ac_make=`printf "%s\n" "$2" | sed 's/+/p/g; s/^a-zA-Z0-9_/_/g'`
+if eval test \${ac_cv_prog_make_${ac_make}_set+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 cat >conftest.make <<\_ACEOF
 SHELL = /bin/sh
 all:
@@ -2926,12 +3266,12 @@
 rm -f conftest.make
 fi
 if eval test \$ac_cv_prog_make_${ac_make}_set = yes; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 SET_MAKE=
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 SET_MAKE="MAKE=${MAKE-make}"
 fi
 
@@ -2945,7 +3285,8 @@
 rmdir .tst 2>/dev/null
 
 # Check whether --enable-silent-rules was given.
-if test "${enable_silent_rules+set}" = set; then :
+if test ${enable_silent_rules+y}
+then :
 enableval=$enable_silent_rules;
 fi
 
@@ -2955,12 +3296,13 @@
 *) AM_DEFAULT_VERBOSITY=1;;
 esac
 am_make=${MAKE-make}
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $am_make supports nested variables" >&5
-$as_echo_n "checking whether $am_make supports nested variables... " >&6; }
-if ${am_cv_make_support_nested_variables+:} false; then :
- $as_echo_n "(cached) " >&6
-else
- if $as_echo 'TRUE=$(BAR$(V))
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether $am_make supports nested variables" >&5
+printf %s "checking whether $am_make supports nested variables... " >&6; }
+if test ${am_cv_make_support_nested_variables+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
+ if printf "%s\n" 'TRUE=$(BAR$(V))
 BAR0=false
 BAR1=true
 V=1
@@ -2972,8 +3314,8 @@
 am_cv_make_support_nested_variables=no
 fi
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $am_cv_make_support_nested_variables" >&5
-$as_echo "$am_cv_make_support_nested_variables" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $am_cv_make_support_nested_variables" >&5
+printf "%s\n" "$am_cv_make_support_nested_variables" >&6; }
 if test $am_cv_make_support_nested_variables = yes; then
 AM_V='$(V)'
 AM_DEFAULT_V='$(AM_DEFAULT_VERBOSITY)'
@@ -3005,17 +3347,13 @@
 
 # Define the identity of the package.
 PACKAGE='stunnel'
- VERSION='5.48'
+ VERSION='5.69'
 
 
-cat >>confdefs.h <<_ACEOF
-#define PACKAGE "$PACKAGE"
-_ACEOF
+printf "%s\n" "#define PACKAGE \"$PACKAGE\"" >>confdefs.h
 
 
-cat >>confdefs.h <<_ACEOF
-#define VERSION "$VERSION"
-_ACEOF
+printf "%s\n" "#define VERSION \"$VERSION\"" >>confdefs.h
 
 # Some tools Automake needs.
 
@@ -3035,8 +3373,8 @@
 
 # For better backward compatibility. To be removed once Automake 1.9.x
 # dies out for good. For more background, see:
-# <http://lists.gnu.org/archive/html/automake/2012-07/msg00001.html>
-# <http://lists.gnu.org/archive/html/automake/2012-07/msg00014.html>
+# <https://lists.gnu.org/archive/html/automake/2012-07/msg00001.html>
+# <https://lists.gnu.org/archive/html/automake/2012-07/msg00014.html>
 mkdir_p='$(MKDIR_P)'
 
 # We need awk for the "check" target (and possibly the TAP driver). The
@@ -3055,6 +3393,20 @@
 
 
 
+# Variables for tags utilities; see am/tags.am
+if test -z "$CTAGS"; then
+ CTAGS=ctags
+fi
+
+if test -z "$ETAGS"; then
+ ETAGS=etags
+fi
+
+if test -z "$CSCOPE"; then
+ CSCOPE=cscope
+fi
+
+
 
 # POSIX will say in a future version that running "rm -f" with no argument
 # is OK; and we want to be able to make that assumption in our Makefile
@@ -3087,7 +3439,7 @@
 Aborting the configuration process, to ensure you take notice of the issue.
 
 You can download and install GNU coreutils to get an 'rm' implementation
-that behaves properly: <http://www.gnu.org/software/coreutils/>.
+that behaves properly: <https://www.gnu.org/software/coreutils/>.
 
 If you want to complete the configuration process using your problematic
 'rm' anyway, export the environment variable ACCEPT_INFERIOR_RM_PROGRAM
@@ -3099,34 +3451,29 @@
 fi
 
 
- if test -d ".git"; then
- AUTHOR_TESTS_TRUE=
- AUTHOR_TESTS_FALSE='#'
-else
- AUTHOR_TESTS_TRUE='#'
- AUTHOR_TESTS_FALSE=
-fi
-
-# Make sure we can run config.sub.
-$SHELL "$ac_aux_dir/config.sub" sun4 >/dev/null 2>&1 ||
- as_fn_error $? "cannot run $SHELL $ac_aux_dir/config.sub" "$LINENO" 5
-
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking build system type" >&5
-$as_echo_n "checking build system type... " >&6; }
-if ${ac_cv_build+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+
+
+ # Make sure we can run config.sub.
+$SHELL "${ac_aux_dir}config.sub" sun4 >/dev/null 2>&1 ||
+ as_fn_error $? "cannot run $SHELL ${ac_aux_dir}config.sub" "$LINENO" 5
+
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking build system type" >&5
+printf %s "checking build system type... " >&6; }
+if test ${ac_cv_build+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 ac_build_alias=$build_alias
 test "x$ac_build_alias" = x &&
- ac_build_alias=`$SHELL "$ac_aux_dir/config.guess"`
+ ac_build_alias=`$SHELL "${ac_aux_dir}config.guess"`
 test "x$ac_build_alias" = x &&
 as_fn_error $? "cannot guess build type; you must specify one" "$LINENO" 5
-ac_cv_build=`$SHELL "$ac_aux_dir/config.sub" $ac_build_alias` ||
- as_fn_error $? "$SHELL $ac_aux_dir/config.sub $ac_build_alias failed" "$LINENO" 5
+ac_cv_build=`$SHELL "${ac_aux_dir}config.sub" $ac_build_alias` ||
+ as_fn_error $? "$SHELL ${ac_aux_dir}config.sub $ac_build_alias failed" "$LINENO" 5
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_build" >&5
-$as_echo "$ac_cv_build" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_build" >&5
+printf "%s\n" "$ac_cv_build" >&6; }
 case $ac_cv_build in
 *-*-*) ;;
 *) as_fn_error $? "invalid value of canonical build" "$LINENO" 5;;
@@ -3145,21 +3492,22 @@
 case $build_os in *\ *) build_os=`echo "$build_os" | sed 's/ /-/g'`;; esac
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking host system type" >&5
-$as_echo_n "checking host system type... " >&6; }
-if ${ac_cv_host+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking host system type" >&5
+printf %s "checking host system type... " >&6; }
+if test ${ac_cv_host+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if test "x$host_alias" = x; then
 ac_cv_host=$ac_cv_build
 else
- ac_cv_host=`$SHELL "$ac_aux_dir/config.sub" $host_alias` ||
- as_fn_error $? "$SHELL $ac_aux_dir/config.sub $host_alias failed" "$LINENO" 5
+ ac_cv_host=`$SHELL "${ac_aux_dir}config.sub" $host_alias` ||
+ as_fn_error $? "$SHELL ${ac_aux_dir}config.sub $host_alias failed" "$LINENO" 5
 fi
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_host" >&5
-$as_echo "$ac_cv_host" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_host" >&5
+printf "%s\n" "$ac_cv_host" >&6; }
 case $ac_cv_host in
 *-*-*) ;;
 *) as_fn_error $? "invalid value of canonical host" "$LINENO" 5;;
@@ -3180,9 +3528,7 @@
 
 
 
-cat >>confdefs.h <<_ACEOF
-#define HOST "$host"
-_ACEOF
+printf "%s\n" "#define HOST \"$host\"" >>confdefs.h
 
 
 cat >>confdefs.h <<_ACEOF
@@ -3202,225 +3548,45 @@
 *darwin*)
 # OSX does not declare ucontext without _XOPEN_SOURCE
 
-$as_echo "#define _XOPEN_SOURCE 500" >>confdefs.h
+printf "%s\n" "#define _XOPEN_SOURCE 500" >>confdefs.h
 
 # OSX does not declare chroot() without _DARWIN_C_SOURCE
 
-$as_echo "#define _DARWIN_C_SOURCE 1" >>confdefs.h
+printf "%s\n" "#define _DARWIN_C_SOURCE 1" >>confdefs.h
 
 ;;
 *)
 
-$as_echo "#define _GNU_SOURCE 1" >>confdefs.h
+printf "%s\n" "#define _GNU_SOURCE 1" >>confdefs.h
 
 ;;
 esac
 
-ac_ext=c
-ac_cpp='$CPP $CPPFLAGS'
-ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
-ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
-ac_compiler_gnu=$ac_cv_c_compiler_gnu
-if test -n "$ac_tool_prefix"; then
- # Extract the first word of "${ac_tool_prefix}gcc", so it can be a program name with args.
-set dummy ${ac_tool_prefix}gcc; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_CC+:} false; then :
- $as_echo_n "(cached) " >&6
-else
- if test -n "$CC"; then
- ac_cv_prog_CC="$CC" # Let the user override the test.
-else
-as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
-for as_dir in $PATH
-do
- IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
- for ac_exec_ext in '' $ac_executable_extensions; do
- if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
- ac_cv_prog_CC="${ac_tool_prefix}gcc"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
- break 2
- fi
-done
- done
-IFS=$as_save_IFS
 
-fi
-fi
-CC=$ac_cv_prog_CC
-if test -n "$CC"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
-$as_echo "$CC" >&6; }
-else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
-fi
 
 
-fi
-if test -z "$ac_cv_prog_CC"; then
- ac_ct_CC=$CC
- # Extract the first word of "gcc", so it can be a program name with args.
-set dummy gcc; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_ac_ct_CC+:} false; then :
- $as_echo_n "(cached) " >&6
-else
- if test -n "$ac_ct_CC"; then
- ac_cv_prog_ac_ct_CC="$ac_ct_CC" # Let the user override the test.
-else
-as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
-for as_dir in $PATH
-do
- IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
- for ac_exec_ext in '' $ac_executable_extensions; do
- if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
- ac_cv_prog_ac_ct_CC="gcc"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
- break 2
- fi
-done
- done
-IFS=$as_save_IFS
 
-fi
-fi
-ac_ct_CC=$ac_cv_prog_ac_ct_CC
-if test -n "$ac_ct_CC"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5
-$as_echo "$ac_ct_CC" >&6; }
-else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
-fi
 
- if test "x$ac_ct_CC" = x; then
- CC=""
- else
- case $cross_compiling:$ac_tool_warned in
-yes:)
-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
-$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
-ac_tool_warned=yes ;;
-esac
- CC=$ac_ct_CC
- fi
-else
- CC="$ac_cv_prog_CC"
-fi
 
-if test -z "$CC"; then
- if test -n "$ac_tool_prefix"; then
- # Extract the first word of "${ac_tool_prefix}cc", so it can be a program name with args.
-set dummy ${ac_tool_prefix}cc; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_CC+:} false; then :
- $as_echo_n "(cached) " >&6
-else
- if test -n "$CC"; then
- ac_cv_prog_CC="$CC" # Let the user override the test.
-else
-as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
-for as_dir in $PATH
-do
- IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
- for ac_exec_ext in '' $ac_executable_extensions; do
- if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
- ac_cv_prog_CC="${ac_tool_prefix}cc"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
- break 2
- fi
-done
- done
-IFS=$as_save_IFS
 
-fi
-fi
-CC=$ac_cv_prog_CC
-if test -n "$CC"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
-$as_echo "$CC" >&6; }
-else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
-fi
 
 
- fi
-fi
-if test -z "$CC"; then
- # Extract the first word of "cc", so it can be a program name with args.
-set dummy cc; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_CC+:} false; then :
- $as_echo_n "(cached) " >&6
-else
- if test -n "$CC"; then
- ac_cv_prog_CC="$CC" # Let the user override the test.
-else
- ac_prog_rejected=no
-as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
-for as_dir in $PATH
-do
- IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
- for ac_exec_ext in '' $ac_executable_extensions; do
- if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
- if test "$as_dir/$ac_word$ac_exec_ext" = "/usr/ucb/cc"; then
- ac_prog_rejected=yes
- continue
- fi
- ac_cv_prog_CC="cc"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
- break 2
- fi
-done
- done
-IFS=$as_save_IFS
-
-if test $ac_prog_rejected = yes; then
- # We found a bogon in the path, so make sure we never use it.
- set dummy $ac_cv_prog_CC
- shift
- if test $# != 0; then
- # We chose a different compiler from the bogus one.
- # However, it has the same basename, so the bogon will be chosen
- # first if we set CC to just the basename; use the full file name.
- shift
- ac_cv_prog_CC="$as_dir/$ac_word${1+' '}$@"
- fi
-fi
-fi
-fi
-CC=$ac_cv_prog_CC
-if test -n "$CC"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
-$as_echo "$CC" >&6; }
-else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
-fi
-
-
-fi
-if test -z "$CC"; then
- if test -n "$ac_tool_prefix"; then
- for ac_prog in cl.exe
+ac_ext=c
+ac_cpp='$CPP $CPPFLAGS'
+ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
+ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
+ac_compiler_gnu=$ac_cv_c_compiler_gnu
+if test -n "$ac_tool_prefix"; then
+ for ac_prog in gcc clang cl cc
 do
 # Extract the first word of "$ac_tool_prefix$ac_prog", so it can be a program name with args.
 set dummy $ac_tool_prefix$ac_prog; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_CC+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_CC+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if test -n "$CC"; then
 ac_cv_prog_CC="$CC" # Let the user override the test.
 else
@@ -3428,11 +3594,15 @@
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
 for ac_exec_ext in '' $ac_executable_extensions; do
- if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+ if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
 ac_cv_prog_CC="$ac_tool_prefix$ac_prog"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
 break 2
 fi
 done
@@ -3443,11 +3613,11 @@
 fi
 CC=$ac_cv_prog_CC
 if test -n "$CC"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
-$as_echo "$CC" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $CC" >&5
+printf "%s\n" "$CC" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -3456,15 +3626,16 @@
 fi
 if test -z "$CC"; then
 ac_ct_CC=$CC
- for ac_prog in cl.exe
+ for ac_prog in gcc clang cl cc
 do
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_ac_ct_CC+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_ac_ct_CC+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if test -n "$ac_ct_CC"; then
 ac_cv_prog_ac_ct_CC="$ac_ct_CC" # Let the user override the test.
 else
@@ -3472,11 +3643,15 @@
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
 for ac_exec_ext in '' $ac_executable_extensions; do
- if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+ if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
 ac_cv_prog_ac_ct_CC="$ac_prog"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
 break 2
 fi
 done
@@ -3487,11 +3662,11 @@
 fi
 ac_ct_CC=$ac_cv_prog_ac_ct_CC
 if test -n "$ac_ct_CC"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5
-$as_echo "$ac_ct_CC" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5
+printf "%s\n" "$ac_ct_CC" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -3503,34 +3678,32 @@
 else
 case $cross_compiling:$ac_tool_warned in
 yes:)
-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
-$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
+printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
 ac_tool_warned=yes ;;
 esac
 CC=$ac_ct_CC
 fi
 fi
 
-fi
-
 
-test -z "$CC" && { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
-$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
+test -z "$CC" && { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;}
 as_fn_error $? "no acceptable C compiler found in \$PATH
 See \`config.log' for more details" "$LINENO" 5; }
 
 # Provide some information about the compiler.
-$as_echo "$as_me:${as_lineno-$LINENO}: checking for C compiler version" >&5
+printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for C compiler version" >&5
 set X $ac_compile
 ac_compiler=$2
-for ac_option in --version -v -V -qversion; do
+for ac_option in --version -v -V -qversion -version; do
 { { ac_try="$ac_compiler $ac_option >&5"
 case "(($ac_try" in
 *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
 *) ac_try_echo=$ac_try;;
 esac
 eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
-$as_echo "$ac_try_echo"; } >&5
+printf "%s\n" "$ac_try_echo"; } >&5
 (eval "$ac_compiler $ac_option >&5") 2>conftest.err
 ac_status=$?
 if test -s conftest.err; then
@@ -3540,7 +3713,7 @@
 cat conftest.er1 >&5
 fi
 rm -f conftest.er1 conftest.err
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }
 done
 
@@ -3548,7 +3721,7 @@
 /* end confdefs.h. */
 
 int
-main ()
+main (void)
 {
 
 ;
@@ -3560,9 +3733,9 @@
 # Try to create an executable without -o first, disregard a.out.
 # It will help us diagnose broken compilers, and finding out an intuition
 # of exeext.
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the C compiler works" >&5
-$as_echo_n "checking whether the C compiler works... " >&6; }
-ac_link_default=`$as_echo "$ac_link" | sed 's/ -o *conftest^ *//'`
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the C compiler works" >&5
+printf %s "checking whether the C compiler works... " >&6; }
+ac_link_default=`printf "%s\n" "$ac_link" | sed 's/ -o *conftest^ *//'`
 
 # The possible output files:
 ac_files="a.out conftest.exe conftest a.exe a_out.exe b.out conftest.*"
@@ -3583,11 +3756,12 @@
 *) ac_try_echo=$ac_try;;
 esac
 eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
-$as_echo "$ac_try_echo"; } >&5
+printf "%s\n" "$ac_try_echo"; } >&5
 (eval "$ac_link_default") 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
- test $ac_status = 0; }; then :
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ test $ac_status = 0; }
+then :
 # Autoconf-2.13 could set the ac_cv_exeext variable to `no'.
 # So ignore a value of `no', otherwise this would lead to `EXEEXT = no'
 # in a Makefile. We should not override ac_cv_exeext if it was cached,
@@ -3604,7 +3778,7 @@
 	# certainly right.
 	break;;
 *.* )
-	if test "${ac_cv_exeext+set}" = set && test "$ac_cv_exeext" != no;
+	if test ${ac_cv_exeext+y} && test "$ac_cv_exeext" != no;
 	then :; else
 	 ac_cv_exeext=`expr "$ac_file" : '^.*$\..*$'`
 	fi
@@ -3620,44 +3794,46 @@
 done
 test "$ac_cv_exeext" = no && ac_cv_exeext=
 
-else
+else $as_nop
 ac_file=''
 fi
-if test -z "$ac_file"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
-$as_echo "$as_me: failed program was:" >&5
+if test -z "$ac_file"
+then :
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
+printf "%s\n" "$as_me: failed program was:" >&5
 sed 's/^/| /' conftest.$ac_ext >&5
 
-{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
-$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
+{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;}
 as_fn_error 77 "C compiler cannot create executables
 See \`config.log' for more details" "$LINENO" 5; }
-else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
-fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for C compiler default output file name" >&5
-$as_echo_n "checking for C compiler default output file name... " >&6; }
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_file" >&5
-$as_echo "$ac_file" >&6; }
+else $as_nop
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
+fi
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for C compiler default output file name" >&5
+printf %s "checking for C compiler default output file name... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_file" >&5
+printf "%s\n" "$ac_file" >&6; }
 ac_exeext=$ac_cv_exeext
 
 rm -f -r a.out a.out.dSYM a.exe conftest$ac_cv_exeext b.out
 ac_clean_files=$ac_clean_files_save
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for suffix of executables" >&5
-$as_echo_n "checking for suffix of executables... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for suffix of executables" >&5
+printf %s "checking for suffix of executables... " >&6; }
 if { { ac_try="$ac_link"
 case "(($ac_try" in
 *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
 *) ac_try_echo=$ac_try;;
 esac
 eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
-$as_echo "$ac_try_echo"; } >&5
+printf "%s\n" "$ac_try_echo"; } >&5
 (eval "$ac_link") 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
- test $ac_status = 0; }; then :
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ test $ac_status = 0; }
+then :
 # If both `conftest.exe' and `conftest' are `present' (well, observable)
 # catch `conftest.exe'. For instance with Cygwin, `ls conftest' will
 # work properly (i.e., refer to `conftest.exe'), while it won't with
@@ -3671,15 +3847,15 @@
 * ) break;;
 esac
 done
-else
- { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
-$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
+else $as_nop
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;}
 as_fn_error $? "cannot compute suffix of executables: cannot compile and link
 See \`config.log' for more details" "$LINENO" 5; }
 fi
 rm -f conftest conftest$ac_cv_exeext
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_exeext" >&5
-$as_echo "$ac_cv_exeext" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_exeext" >&5
+printf "%s\n" "$ac_cv_exeext" >&6; }
 
 rm -f conftest.$ac_ext
 EXEEXT=$ac_cv_exeext
@@ -3688,7 +3864,7 @@
 /* end confdefs.h. */
 #include <stdio.h>
 int
-main ()
+main (void)
 {
 FILE *f = fopen ("conftest.out", "w");
 return ferror (f) || fclose (f) != 0;
@@ -3700,8 +3876,8 @@
 ac_clean_files="$ac_clean_files conftest.out"
 # Check that the compiler produces executables we can run. If not, either
 # the compiler is broken, or we cross compile.
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we are cross compiling" >&5
-$as_echo_n "checking whether we are cross compiling... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether we are cross compiling" >&5
+printf %s "checking whether we are cross compiling... " >&6; }
 if test "$cross_compiling" != yes; then
 { { ac_try="$ac_link"
 case "(($ac_try" in
@@ -3709,10 +3885,10 @@
 *) ac_try_echo=$ac_try;;
 esac
 eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
-$as_echo "$ac_try_echo"; } >&5
+printf "%s\n" "$ac_try_echo"; } >&5
 (eval "$ac_link") 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }
 if { ac_try='./conftest$ac_cv_exeext'
 { { case "(($ac_try" in
@@ -3720,39 +3896,40 @@
 *) ac_try_echo=$ac_try;;
 esac
 eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
-$as_echo "$ac_try_echo"; } >&5
+printf "%s\n" "$ac_try_echo"; } >&5
 (eval "$ac_try") 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }; }; then
 cross_compiling=no
 else
 if test "$cross_compiling" = maybe; then
 	cross_compiling=yes
 else
-	{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
-$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
-as_fn_error $? "cannot run C compiled programs.
+	{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;}
+as_fn_error 77 "cannot run C compiled programs.
 If you meant to cross compile, use \`--host'.
 See \`config.log' for more details" "$LINENO" 5; }
 fi
 fi
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $cross_compiling" >&5
-$as_echo "$cross_compiling" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $cross_compiling" >&5
+printf "%s\n" "$cross_compiling" >&6; }
 
 rm -f conftest.$ac_ext conftest$ac_cv_exeext conftest.out
 ac_clean_files=$ac_clean_files_save
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for suffix of object files" >&5
-$as_echo_n "checking for suffix of object files... " >&6; }
-if ${ac_cv_objext+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for suffix of object files" >&5
+printf %s "checking for suffix of object files... " >&6; }
+if test ${ac_cv_objext+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
 
 int
-main ()
+main (void)
 {
 
 ;
@@ -3766,11 +3943,12 @@
 *) ac_try_echo=$ac_try;;
 esac
 eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
-$as_echo "$ac_try_echo"; } >&5
+printf "%s\n" "$ac_try_echo"; } >&5
 (eval "$ac_compile") 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
- test $ac_status = 0; }; then :
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ test $ac_status = 0; }
+then :
 for ac_file in conftest.o conftest.obj conftest.*; do
 test -f "$ac_file" || continue;
 case $ac_file in
@@ -3779,31 +3957,32 @@
 break;;
 esac
 done
-else
- $as_echo "$as_me: failed program was:" >&5
+else $as_nop
+ printf "%s\n" "$as_me: failed program was:" >&5
 sed 's/^/| /' conftest.$ac_ext >&5
 
-{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
-$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
+{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;}
 as_fn_error $? "cannot compute suffix of object files: cannot compile
 See \`config.log' for more details" "$LINENO" 5; }
 fi
 rm -f conftest.$ac_cv_objext conftest.$ac_ext
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_objext" >&5
-$as_echo "$ac_cv_objext" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_objext" >&5
+printf "%s\n" "$ac_cv_objext" >&6; }
 OBJEXT=$ac_cv_objext
 ac_objext=$OBJEXT
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we are using the GNU C compiler" >&5
-$as_echo_n "checking whether we are using the GNU C compiler... " >&6; }
-if ${ac_cv_c_compiler_gnu+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the compiler supports GNU C" >&5
+printf %s "checking whether the compiler supports GNU C... " >&6; }
+if test ${ac_cv_c_compiler_gnu+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
 
 int
-main ()
+main (void)
 {
 #ifndef __GNUC__
 choke me
@@ -3813,29 +3992,33 @@
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
 ac_compiler_gnu=yes
-else
+else $as_nop
 ac_compiler_gnu=no
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 ac_cv_c_compiler_gnu=$ac_compiler_gnu
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_compiler_gnu" >&5
-$as_echo "$ac_cv_c_compiler_gnu" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_compiler_gnu" >&5
+printf "%s\n" "$ac_cv_c_compiler_gnu" >&6; }
+ac_compiler_gnu=$ac_cv_c_compiler_gnu
+
 if test $ac_compiler_gnu = yes; then
 GCC=yes
 else
 GCC=
 fi
-ac_test_CFLAGS=${CFLAGS+set}
+ac_test_CFLAGS=${CFLAGS+y}
 ac_save_CFLAGS=$CFLAGS
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC accepts -g" >&5
-$as_echo_n "checking whether $CC accepts -g... " >&6; }
-if ${ac_cv_prog_cc_g+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether $CC accepts -g" >&5
+printf %s "checking whether $CC accepts -g... " >&6; }
+if test ${ac_cv_prog_cc_g+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 ac_save_c_werror_flag=$ac_c_werror_flag
 ac_c_werror_flag=yes
 ac_cv_prog_cc_g=no
@@ -3844,57 +4027,60 @@
 /* end confdefs.h. */
 
 int
-main ()
+main (void)
 {
 
 ;
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
 ac_cv_prog_cc_g=yes
-else
+else $as_nop
 CFLAGS=""
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
 
 int
-main ()
+main (void)
 {
 
 ;
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
 
-else
+else $as_nop
 ac_c_werror_flag=$ac_save_c_werror_flag
 	 CFLAGS="-g"
 	 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
 
 int
-main ()
+main (void)
 {
 
 ;
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
 ac_cv_prog_cc_g=yes
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 ac_c_werror_flag=$ac_save_c_werror_flag
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_g" >&5
-$as_echo "$ac_cv_prog_cc_g" >&6; }
-if test "$ac_test_CFLAGS" = set; then
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_g" >&5
+printf "%s\n" "$ac_cv_prog_cc_g" >&6; }
+if test $ac_test_CFLAGS; then
 CFLAGS=$ac_save_CFLAGS
 elif test $ac_cv_prog_cc_g = yes; then
 if test "$GCC" = yes; then
@@ -3909,94 +4095,144 @@
 CFLAGS=
 fi
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $CC option to accept ISO C89" >&5
-$as_echo_n "checking for $CC option to accept ISO C89... " >&6; }
-if ${ac_cv_prog_cc_c89+:} false; then :
- $as_echo_n "(cached) " >&6
-else
- ac_cv_prog_cc_c89=no
+ac_prog_cc_stdc=no
+if test x$ac_prog_cc_stdc = xno
+then :
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $CC option to enable C11 features" >&5
+printf %s "checking for $CC option to enable C11 features... " >&6; }
+if test ${ac_cv_prog_cc_c11+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
+ ac_cv_prog_cc_c11=no
 ac_save_CC=$CC
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
-#include <stdarg.h>
-#include <stdio.h>
-struct stat;
-/* Most of the following tests are stolen from RCS 5.7's src/conf.sh. */
-struct buf { int x; };
-FILE * (*rcsopen) (struct buf *, struct stat *, int);
-static char *e (p, i)
- char **p;
- int i;
-{
- return pi;
-}
-static char *f (char * (*g) (char **, int), char **p, ...)
-{
- char *s;
- va_list v;
- va_start (v,p);
- s = g (p, va_arg (v,int));
- va_end (v);
- return s;
-}
-
-/* OSF 4.0 Compaq cc is some sort of almost-ANSI by default. It has
- function prototypes and stuff, but not '\xHH' hex character constants.
- These don't provoke an error unfortunately, instead are silently treated
- as 'x'. The following induces an error, until -std is added to get
- proper ANSI mode. Curiously '\x00'!='x' always comes out true, for an
- array size at least. It's necessary to write '\x00'==0 to get something
- that's true only with -std. */
-int osf4_cc_array '\x00' == 0 ? 1 : -1;
+$ac_c_conftest_c11_program
+_ACEOF
+for ac_arg in '' -std=gnu11
+do
+ CC="$ac_save_CC $ac_arg"
+ if ac_fn_c_try_compile "$LINENO"
+then :
+ ac_cv_prog_cc_c11=$ac_arg
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam
+ test "x$ac_cv_prog_cc_c11" != "xno" && break
+done
+rm -f conftest.$ac_ext
+CC=$ac_save_CC
+fi
 
-/* IBM C 6 for AIX is almost-ANSI by default, but it replaces macro parameters
- inside strings and character constants. */
-#define FOO(x) 'x'
-int xlc6_cc_arrayFOO(a) == 'x' ? 1 : -1;
+if test "x$ac_cv_prog_cc_c11" = xno
+then :
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: unsupported" >&5
+printf "%s\n" "unsupported" >&6; }
+else $as_nop
+ if test "x$ac_cv_prog_cc_c11" = x
+then :
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: none needed" >&5
+printf "%s\n" "none needed" >&6; }
+else $as_nop
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_c11" >&5
+printf "%s\n" "$ac_cv_prog_cc_c11" >&6; }
+ CC="$CC $ac_cv_prog_cc_c11"
+fi
+ ac_cv_prog_cc_stdc=$ac_cv_prog_cc_c11
+ ac_prog_cc_stdc=c11
+fi
+fi
+if test x$ac_prog_cc_stdc = xno
+then :
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $CC option to enable C99 features" >&5
+printf %s "checking for $CC option to enable C99 features... " >&6; }
+if test ${ac_cv_prog_cc_c99+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
+ ac_cv_prog_cc_c99=no
+ac_save_CC=$CC
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h. */
+$ac_c_conftest_c99_program
+_ACEOF
+for ac_arg in '' -std=gnu99 -std=c99 -c99 -qlanglvl=extc1x -qlanglvl=extc99 -AC99 -D_STDC_C99=
+do
+ CC="$ac_save_CC $ac_arg"
+ if ac_fn_c_try_compile "$LINENO"
+then :
+ ac_cv_prog_cc_c99=$ac_arg
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam
+ test "x$ac_cv_prog_cc_c99" != "xno" && break
+done
+rm -f conftest.$ac_ext
+CC=$ac_save_CC
+fi
 
-int test (int i, double x);
-struct s1 {int (*f) (int a);};
-struct s2 {int (*f) (double a);};
-int pairnames (int, char **, FILE *(*)(struct buf *, struct stat *, int), int, int);
-int argc;
-char **argv;
-int
-main ()
-{
-return f (e, argv, 0) != argv0 || f (e, argv, 1) != argv1;
- ;
- return 0;
-}
+if test "x$ac_cv_prog_cc_c99" = xno
+then :
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: unsupported" >&5
+printf "%s\n" "unsupported" >&6; }
+else $as_nop
+ if test "x$ac_cv_prog_cc_c99" = x
+then :
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: none needed" >&5
+printf "%s\n" "none needed" >&6; }
+else $as_nop
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_c99" >&5
+printf "%s\n" "$ac_cv_prog_cc_c99" >&6; }
+ CC="$CC $ac_cv_prog_cc_c99"
+fi
+ ac_cv_prog_cc_stdc=$ac_cv_prog_cc_c99
+ ac_prog_cc_stdc=c99
+fi
+fi
+if test x$ac_prog_cc_stdc = xno
+then :
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $CC option to enable C89 features" >&5
+printf %s "checking for $CC option to enable C89 features... " >&6; }
+if test ${ac_cv_prog_cc_c89+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
+ ac_cv_prog_cc_c89=no
+ac_save_CC=$CC
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h. */
+$ac_c_conftest_c89_program
 _ACEOF
-for ac_arg in '' -qlanglvl=extc89 -qlanglvl=ansi -std \
-	-Ae "-Aa -D_HPUX_SOURCE" "-Xc -D__EXTENSIONS__"
+for ac_arg in '' -qlanglvl=extc89 -qlanglvl=ansi -std -Ae "-Aa -D_HPUX_SOURCE" "-Xc -D__EXTENSIONS__"
 do
 CC="$ac_save_CC $ac_arg"
- if ac_fn_c_try_compile "$LINENO"; then :
+ if ac_fn_c_try_compile "$LINENO"
+then :
 ac_cv_prog_cc_c89=$ac_arg
 fi
-rm -f core conftest.err conftest.$ac_objext
+rm -f core conftest.err conftest.$ac_objext conftest.beam
 test "x$ac_cv_prog_cc_c89" != "xno" && break
 done
 rm -f conftest.$ac_ext
 CC=$ac_save_CC
-
 fi
-# AC_CACHE_VAL
-case "x$ac_cv_prog_cc_c89" in
- x)
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: none needed" >&5
-$as_echo "none needed" >&6; } ;;
- xno)
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: unsupported" >&5
-$as_echo "unsupported" >&6; } ;;
- *)
- CC="$CC $ac_cv_prog_cc_c89"
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_c89" >&5
-$as_echo "$ac_cv_prog_cc_c89" >&6; } ;;
-esac
-if test "x$ac_cv_prog_cc_c89" != xno; then :
 
+if test "x$ac_cv_prog_cc_c89" = xno
+then :
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: unsupported" >&5
+printf "%s\n" "unsupported" >&6; }
+else $as_nop
+ if test "x$ac_cv_prog_cc_c89" = x
+then :
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: none needed" >&5
+printf "%s\n" "none needed" >&6; }
+else $as_nop
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_c89" >&5
+printf "%s\n" "$ac_cv_prog_cc_c89" >&6; }
+ CC="$CC $ac_cv_prog_cc_c89"
+fi
+ ac_cv_prog_cc_stdc=$ac_cv_prog_cc_c89
+ ac_prog_cc_stdc=c89
+fi
 fi
 
 ac_ext=c
@@ -4005,21 +4241,23 @@
 ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
 ac_compiler_gnu=$ac_cv_c_compiler_gnu
 
-ac_ext=c
+
+ ac_ext=c
 ac_cpp='$CPP $CPPFLAGS'
 ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
 ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
 ac_compiler_gnu=$ac_cv_c_compiler_gnu
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC understands -c and -o together" >&5
-$as_echo_n "checking whether $CC understands -c and -o together... " >&6; }
-if ${am_cv_prog_cc_c_o+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether $CC understands -c and -o together" >&5
+printf %s "checking whether $CC understands -c and -o together... " >&6; }
+if test ${am_cv_prog_cc_c_o+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
 
 int
-main ()
+main (void)
 {
 
 ;
@@ -4047,8 +4285,8 @@
 rm -f core conftest*
 unset am_i
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $am_cv_prog_cc_c_o" >&5
-$as_echo "$am_cv_prog_cc_c_o" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $am_cv_prog_cc_c_o" >&5
+printf "%s\n" "$am_cv_prog_cc_c_o" >&6; }
 if test "$am_cv_prog_cc_c_o" != yes; then
 # Losing compiler, so override with the script.
 # FIXME: It is wrong to rewrite CC.
@@ -4067,48 +4305,49 @@
 
 ac_config_commands="$ac_config_commands depfiles"
 
-
-am_make=${MAKE-make}
-cat > confinc << 'END'
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether ${MAKE-make} supports the include directive" >&5
+printf %s "checking whether ${MAKE-make} supports the include directive... " >&6; }
+cat > confinc.mk << 'END'
 am__doit:
-	@echo this is the am__doit target
+	@echo this is the am__doit target >confinc.out
 .PHONY: am__doit
 END
-# If we don't find an include directive, just comment out the code.
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for style of include used by $am_make" >&5
-$as_echo_n "checking for style of include used by $am_make... " >&6; }
 am__include="#"
 am__quote=
-_am_result=none
-# First try GNU make style include.
-echo "include confinc" > confmf
-# Ignore all kinds of additional output from 'make'.
-case `$am_make -s -f confmf 2> /dev/null` in #(
-*the\ am__doit\ target*)
- am__include=include
- am__quote=
- _am_result=GNU
- ;;
-esac
-# Now try BSD make style include.
-if test "$am__include" = "#"; then
- echo '.include "confinc"' > confmf
- case `$am_make -s -f confmf 2> /dev/null` in #(
- *the\ am__doit\ target*)
- am__include=.include
- am__quote="\""
- _am_result=BSD
+# BSD make does it like this.
+echo '.include "confinc.mk" # ignored' > confmf.BSD
+# Other make implementations (GNU, Solaris 10, AIX) do it like this.
+echo 'include confinc.mk # ignored' > confmf.GNU
+_am_result=no
+for s in GNU BSD; do
+ { echo "$as_me:$LINENO: ${MAKE-make} -f confmf.$s && cat confinc.out" >&5
+ (${MAKE-make} -f confmf.$s && cat confinc.out) >&5 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); }
+ case $?:`cat confinc.out 2>/dev/null` in #(
+ '0:this is the am__doit target') :
+ case $s in #(
+ BSD) :
+ am__include='.include' am__quote='"' ;; #(
+ *) :
+ am__include='include' am__quote='' ;;
+esac ;; #(
+ *) :
 ;;
- esac
-fi
-
-
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $_am_result" >&5
-$as_echo "$_am_result" >&6; }
-rm -f confinc confmf
+esac
+ if test "$am__include" != "#"; then
+ _am_result="yes ($s style)"
+ break
+ fi
+done
+rm -f confinc.* confmf.*
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: ${_am_result}" >&5
+printf "%s\n" "${_am_result}" >&6; }
 
 # Check whether --enable-dependency-tracking was given.
-if test "${enable_dependency_tracking+set}" = set; then :
+if test ${enable_dependency_tracking+y}
+then :
 enableval=$enable_dependency_tracking;
 fi
 
@@ -4129,11 +4368,12 @@
 
 depcc="$CC" am_compiler_list=
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking dependency style of $depcc" >&5
-$as_echo_n "checking dependency style of $depcc... " >&6; }
-if ${am_cv_CC_dependencies_compiler_type+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking dependency style of $depcc" >&5
+printf %s "checking dependency style of $depcc... " >&6; }
+if test ${am_cv_CC_dependencies_compiler_type+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if test -z "$AMDEP_TRUE" && test -f "$am_depcomp"; then
 # We make a subdir and do the tests there. Otherwise we can end up
 # making bogus files that we don't know about and never remove. For
@@ -4240,8 +4480,8 @@
 fi
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $am_cv_CC_dependencies_compiler_type" >&5
-$as_echo "$am_cv_CC_dependencies_compiler_type" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $am_cv_CC_dependencies_compiler_type" >&5
+printf "%s\n" "$am_cv_CC_dependencies_compiler_type" >&6; }
 CCDEPMODE=depmode=$am_cv_CC_dependencies_compiler_type
 
 if
@@ -4257,13 +4497,14 @@
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether ${MAKE-make} sets \$(MAKE)" >&5
-$as_echo_n "checking whether ${MAKE-make} sets \$(MAKE)... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether ${MAKE-make} sets \$(MAKE)" >&5
+printf %s "checking whether ${MAKE-make} sets \$(MAKE)... " >&6; }
 set x ${MAKE-make}
-ac_make=`$as_echo "$2" | sed 's/+/p/g; s/^a-zA-Z0-9_/_/g'`
-if eval \${ac_cv_prog_make_${ac_make}_set+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ac_make=`printf "%s\n" "$2" | sed 's/+/p/g; s/^a-zA-Z0-9_/_/g'`
+if eval test \${ac_cv_prog_make_${ac_make}_set+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 cat >conftest.make <<\_ACEOF
 SHELL = /bin/sh
 all:
@@ -4279,18 +4520,19 @@
 rm -f conftest.make
 fi
 if eval test \$ac_cv_prog_make_${ac_make}_set = yes; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 SET_MAKE=
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 SET_MAKE="MAKE=${MAKE-make}"
 fi
 
 # silent build by default
 # Check whether --enable-silent-rules was given.
-if test "${enable_silent_rules+set}" = set; then :
+if test ${enable_silent_rules+y}
+then :
 enableval=$enable_silent_rules;
 fi
 
@@ -4300,12 +4542,13 @@
 *) AM_DEFAULT_VERBOSITY=0;;
 esac
 am_make=${MAKE-make}
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $am_make supports nested variables" >&5
-$as_echo_n "checking whether $am_make supports nested variables... " >&6; }
-if ${am_cv_make_support_nested_variables+:} false; then :
- $as_echo_n "(cached) " >&6
-else
- if $as_echo 'TRUE=$(BAR$(V))
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether $am_make supports nested variables" >&5
+printf %s "checking whether $am_make supports nested variables... " >&6; }
+if test ${am_cv_make_support_nested_variables+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
+ if printf "%s\n" 'TRUE=$(BAR$(V))
 BAR0=false
 BAR1=true
 V=1
@@ -4317,8 +4560,8 @@
 am_cv_make_support_nested_variables=no
 fi
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $am_cv_make_support_nested_variables" >&5
-$as_echo "$am_cv_make_support_nested_variables" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $am_cv_make_support_nested_variables" >&5
+printf "%s\n" "$am_cv_make_support_nested_variables" >&6; }
 if test $am_cv_make_support_nested_variables = yes; then
 AM_V='$(V)'
 AM_DEFAULT_V='$(AM_DEFAULT_VERBOSITY)'
@@ -4329,15 +4572,37 @@
 AM_BACKSLASH='\'
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: **************************************** thread model" >&5
-$as_echo "$as_me: **************************************** thread model" >&6;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: **************************************** bash completion" >&5
+printf "%s\n" "$as_me: **************************************** bash completion" >&6;}
+# define a dummy PKG_CHECK_VAR if pkg-config is not installed
+
+
+
+# Check whether --with-bashcompdir was given.
+if test ${with_bashcompdir+y}
+then :
+ withval=$with_bashcompdir;
+else $as_nop
+ false
+fi
+
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for bashcompdir" >&5
+printf %s "checking for bashcompdir... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $with_bashcompdir" >&5
+printf "%s\n" "$with_bashcompdir" >&6; }
+bashcompdir=$with_bashcompdir
+
+
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: **************************************** thread model" >&5
+printf "%s\n" "$as_me: **************************************** thread model" >&6;}
 # thread detection should be done first, as it may change the CC variable
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for a sed that does not truncate output" >&5
-$as_echo_n "checking for a sed that does not truncate output... " >&6; }
-if ${ac_cv_path_SED+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for a sed that does not truncate output" >&5
+printf %s "checking for a sed that does not truncate output... " >&6; }
+if test ${ac_cv_path_SED+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 ac_script=s/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb/
 for ac_i in 1 2 3 4 5 6 7; do
 ac_script="$ac_script$as_nl$ac_script"
@@ -4351,10 +4616,15 @@
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
- for ac_prog in sed gsed; do
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
+ for ac_prog in sed gsed
+ do
 for ac_exec_ext in '' $ac_executable_extensions; do
- ac_path_SED="$as_dir/$ac_prog$ac_exec_ext"
+ ac_path_SED="$as_dir$ac_prog$ac_exec_ext"
 as_fn_executable_p "$ac_path_SED" || continue
 # Check for GNU ac_path_SED and select it if it is found.
 # Check for GNU $ac_path_SED
@@ -4363,13 +4633,13 @@
 ac_cv_path_SED="$ac_path_SED" ac_path_SED_found=:;;
 *)
 ac_count=0
- $as_echo_n 0123456789 >"conftest.in"
+ printf %s 0123456789 >"conftest.in"
 while :
 do
 cat "conftest.in" "conftest.in" >"conftest.tmp"
 mv "conftest.tmp" "conftest.in"
 cp "conftest.in" "conftest.nl"
- $as_echo '' >> "conftest.nl"
+ printf "%s\n" '' >> "conftest.nl"
 "$ac_path_SED" -f conftest.sed < "conftest.nl" >"conftest.out" 2>/dev/null || break
 diff "conftest.out" "conftest.nl" >/dev/null 2>&1 || break
 as_fn_arith $ac_count + 1 && ac_count=$as_val
@@ -4397,8 +4667,8 @@
 fi
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_SED" >&5
-$as_echo "$ac_cv_path_SED" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_SED" >&5
+printf "%s\n" "$ac_cv_path_SED" >&6; }
 SED="$ac_cv_path_SED"
 rm -f conftest.sed
 
@@ -4408,40 +4678,36 @@
 ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
 ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
 ac_compiler_gnu=$ac_cv_c_compiler_gnu
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking how to run the C preprocessor" >&5
-$as_echo_n "checking how to run the C preprocessor... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking how to run the C preprocessor" >&5
+printf %s "checking how to run the C preprocessor... " >&6; }
 # On Suns, sometimes $CPP names a directory.
 if test -n "$CPP" && test -d "$CPP"; then
 CPP=
 fi
 if test -z "$CPP"; then
- if ${ac_cv_prog_CPP+:} false; then :
- $as_echo_n "(cached) " >&6
-else
- # Double quotes because CPP needs to be expanded
- for CPP in "$CC -E" "$CC -E -traditional-cpp" "/lib/cpp"
+ if test ${ac_cv_prog_CPP+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
+ # Double quotes because $CC needs to be expanded
+ for CPP in "$CC -E" "$CC -E -traditional-cpp" cpp /lib/cpp
 do
 ac_preproc_ok=false
 for ac_c_preproc_warn_flag in '' yes
 do
 # Use a header file that comes with gcc, so configuring glibc
 # with a fresh cross-compiler works.
- # Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
- # <limits.h> exists even on freestanding compilers.
 # On the NeXT, cc -E runs the code through the compiler's parser,
 # not just through cpp. "Syntax error" is here to catch this case.
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
-#ifdef __STDC__
-# include <limits.h>
-#else
-# include <assert.h>
-#endif
+#include <limits.h>
 		 Syntax error
 _ACEOF
-if ac_fn_c_try_cpp "$LINENO"; then :
+if ac_fn_c_try_cpp "$LINENO"
+then :
 
-else
+else $as_nop
 # Broken: fails on valid input.
 continue
 fi
@@ -4453,10 +4719,11 @@
 /* end confdefs.h. */
 #include <ac_nonexistent.h>
 _ACEOF
-if ac_fn_c_try_cpp "$LINENO"; then :
+if ac_fn_c_try_cpp "$LINENO"
+then :
 # Broken: success on invalid input.
 continue
-else
+else $as_nop
 # Passes both tests.
 ac_preproc_ok=:
 break
@@ -4466,7 +4733,8 @@
 done
 # Because of `break', _AC_PREPROC_IFELSE's cleaning code was skipped.
 rm -f conftest.i conftest.err conftest.$ac_ext
-if $ac_preproc_ok; then :
+if $ac_preproc_ok
+then :
 break
 fi
 
@@ -4478,29 +4746,24 @@
 else
 ac_cv_prog_CPP=$CPP
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $CPP" >&5
-$as_echo "$CPP" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $CPP" >&5
+printf "%s\n" "$CPP" >&6; }
 ac_preproc_ok=false
 for ac_c_preproc_warn_flag in '' yes
 do
 # Use a header file that comes with gcc, so configuring glibc
 # with a fresh cross-compiler works.
- # Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
- # <limits.h> exists even on freestanding compilers.
 # On the NeXT, cc -E runs the code through the compiler's parser,
 # not just through cpp. "Syntax error" is here to catch this case.
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
-#ifdef __STDC__
-# include <limits.h>
-#else
-# include <assert.h>
-#endif
+#include <limits.h>
 		 Syntax error
 _ACEOF
-if ac_fn_c_try_cpp "$LINENO"; then :
+if ac_fn_c_try_cpp "$LINENO"
+then :
 
-else
+else $as_nop
 # Broken: fails on valid input.
 continue
 fi
@@ -4512,10 +4775,11 @@
 /* end confdefs.h. */
 #include <ac_nonexistent.h>
 _ACEOF
-if ac_fn_c_try_cpp "$LINENO"; then :
+if ac_fn_c_try_cpp "$LINENO"
+then :
 # Broken: success on invalid input.
 continue
-else
+else $as_nop
 # Passes both tests.
 ac_preproc_ok=:
 break
@@ -4525,11 +4789,12 @@
 done
 # Because of `break', _AC_PREPROC_IFELSE's cleaning code was skipped.
 rm -f conftest.i conftest.err conftest.$ac_ext
-if $ac_preproc_ok; then :
+if $ac_preproc_ok
+then :
 
-else
- { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
-$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
+else $as_nop
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;}
 as_fn_error $? "C preprocessor \"$CPP\" fails sanity check
 See \`config.log' for more details" "$LINENO" 5; }
 fi
@@ -4541,11 +4806,12 @@
 ac_compiler_gnu=$ac_cv_c_compiler_gnu
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for grep that handles long lines and -e" >&5
-$as_echo_n "checking for grep that handles long lines and -e... " >&6; }
-if ${ac_cv_path_GREP+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for grep that handles long lines and -e" >&5
+printf %s "checking for grep that handles long lines and -e... " >&6; }
+if test ${ac_cv_path_GREP+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if test -z "$GREP"; then
 ac_path_GREP_found=false
 # Loop through the user's path and test for each of PROGNAME-LIST
@@ -4553,10 +4819,15 @@
 for as_dir in $PATH$PATH_SEPARATOR/usr/xpg4/bin
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
- for ac_prog in grep ggrep; do
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
+ for ac_prog in grep ggrep
+ do
 for ac_exec_ext in '' $ac_executable_extensions; do
- ac_path_GREP="$as_dir/$ac_prog$ac_exec_ext"
+ ac_path_GREP="$as_dir$ac_prog$ac_exec_ext"
 as_fn_executable_p "$ac_path_GREP" || continue
 # Check for GNU ac_path_GREP and select it if it is found.
 # Check for GNU $ac_path_GREP
@@ -4565,13 +4836,13 @@
 ac_cv_path_GREP="$ac_path_GREP" ac_path_GREP_found=:;;
 *)
 ac_count=0
- $as_echo_n 0123456789 >"conftest.in"
+ printf %s 0123456789 >"conftest.in"
 while :
 do
 cat "conftest.in" "conftest.in" >"conftest.tmp"
 mv "conftest.tmp" "conftest.in"
 cp "conftest.in" "conftest.nl"
- $as_echo 'GREP' >> "conftest.nl"
+ printf "%s\n" 'GREP' >> "conftest.nl"
 "$ac_path_GREP" -e 'GREP$' -e '-(cannot match)-' < "conftest.nl" >"conftest.out" 2>/dev/null || break
 diff "conftest.out" "conftest.nl" >/dev/null 2>&1 || break
 as_fn_arith $ac_count + 1 && ac_count=$as_val
@@ -4599,16 +4870,17 @@
 fi
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_GREP" >&5
-$as_echo "$ac_cv_path_GREP" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_GREP" >&5
+printf "%s\n" "$ac_cv_path_GREP" >&6; }
 GREP="$ac_cv_path_GREP"
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for egrep" >&5
-$as_echo_n "checking for egrep... " >&6; }
-if ${ac_cv_path_EGREP+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for egrep" >&5
+printf %s "checking for egrep... " >&6; }
+if test ${ac_cv_path_EGREP+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if echo a | $GREP -E '(a|b)' >/dev/null 2>&1
 then ac_cv_path_EGREP="$GREP -E"
 else
@@ -4619,10 +4891,15 @@
 for as_dir in $PATH$PATH_SEPARATOR/usr/xpg4/bin
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
- for ac_prog in egrep; do
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
+ for ac_prog in egrep
+ do
 for ac_exec_ext in '' $ac_executable_extensions; do
- ac_path_EGREP="$as_dir/$ac_prog$ac_exec_ext"
+ ac_path_EGREP="$as_dir$ac_prog$ac_exec_ext"
 as_fn_executable_p "$ac_path_EGREP" || continue
 # Check for GNU ac_path_EGREP and select it if it is found.
 # Check for GNU $ac_path_EGREP
@@ -4631,13 +4908,13 @@
 ac_cv_path_EGREP="$ac_path_EGREP" ac_path_EGREP_found=:;;
 *)
 ac_count=0
- $as_echo_n 0123456789 >"conftest.in"
+ printf %s 0123456789 >"conftest.in"
 while :
 do
 cat "conftest.in" "conftest.in" >"conftest.tmp"
 mv "conftest.tmp" "conftest.in"
 cp "conftest.in" "conftest.nl"
- $as_echo 'EGREP' >> "conftest.nl"
+ printf "%s\n" 'EGREP' >> "conftest.nl"
 "$ac_path_EGREP" 'EGREP$' < "conftest.nl" >"conftest.out" 2>/dev/null || break
 diff "conftest.out" "conftest.nl" >/dev/null 2>&1 || break
 as_fn_arith $ac_count + 1 && ac_count=$as_val
@@ -4666,26 +4943,27 @@
 
 fi
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_EGREP" >&5
-$as_echo "$ac_cv_path_EGREP" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_EGREP" >&5
+printf "%s\n" "$ac_cv_path_EGREP" >&6; }
 EGREP="$ac_cv_path_EGREP"
 
 
 
 # Check whether --with-threads was given.
-if test "${with_threads+set}" = set; then :
+if test ${with_threads+y}
+then :
 withval=$with_threads;
 case "$withval" in
 ucontext)
- { $as_echo "$as_me:${as_lineno-$LINENO}: UCONTEXT mode selected" >&5
-$as_echo "$as_me: UCONTEXT mode selected" >&6;}
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: UCONTEXT mode selected" >&5
+printf "%s\n" "$as_me: UCONTEXT mode selected" >&6;}
 
-$as_echo "#define USE_UCONTEXT 1" >>confdefs.h
+printf "%s\n" "#define USE_UCONTEXT 1" >>confdefs.h
 
 ;;
 pthread)
- { $as_echo "$as_me:${as_lineno-$LINENO}: PTHREAD mode selected" >&5
-$as_echo "$as_me: PTHREAD mode selected" >&6;}
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: PTHREAD mode selected" >&5
+printf "%s\n" "$as_me: PTHREAD mode selected" >&6;}
 
 
 
@@ -4709,38 +4987,41 @@
 ax_pthread_save_CC="$CC"
 ax_pthread_save_CFLAGS="$CFLAGS"
 ax_pthread_save_LIBS="$LIBS"
- if test "x$PTHREAD_CC" != "x"; then :
+ if test "x$PTHREAD_CC" != "x"
+then :
 CC="$PTHREAD_CC"
 fi
+ if test "x$PTHREAD_CXX" != "x"
+then :
+ CXX="$PTHREAD_CXX"
+fi
 CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
 LIBS="$PTHREAD_LIBS $LIBS"
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for pthread_join using $CC $PTHREAD_CFLAGS $PTHREAD_LIBS" >&5
-$as_echo_n "checking for pthread_join using $CC $PTHREAD_CFLAGS $PTHREAD_LIBS... " >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for pthread_join using $CC $PTHREAD_CFLAGS $PTHREAD_LIBS" >&5
+printf %s "checking for pthread_join using $CC $PTHREAD_CFLAGS $PTHREAD_LIBS... " >&6; }
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
 
 /* Override any GCC internal prototype to avoid an error.
 Use char because int might match the return type of a GCC
 builtin and then its argument prototype would still apply. */
-#ifdef __cplusplus
-extern "C"
-#endif
 char pthread_join ();
 int
-main ()
+main (void)
 {
 return pthread_join ();
 ;
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
 ax_pthread_ok=yes
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
 conftest$ac_exeext conftest.$ac_ext
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ax_pthread_ok" >&5
-$as_echo "$ax_pthread_ok" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_pthread_ok" >&5
+printf "%s\n" "$ax_pthread_ok" >&6; }
 if test "x$ax_pthread_ok" = "xno"; then
 PTHREAD_LIBS=""
 PTHREAD_CFLAGS=""
@@ -4755,10 +5036,12 @@
 # (e.g. DEC) have both -lpthread and -lpthreads, where one of the
 # libraries is broken (non-POSIX).
 
-# Create a list of thread flags to try. Items starting with a "-" are
-# C compiler flags, and other items are library names, except for "none"
-# which indicates that we try without any flags at all, and "pthread-config"
-# which is a program returning the flags for the Pth emulation library.
+# Create a list of thread flags to try. Items with a "," contain both
+# C compiler flags (before ",") and linker flags (after ","). Other items
+# starting with a "-" are C compiler flags, and remaining items are
+# library names, except for "none" which indicates that we try without
+# any flags at all, and "pthread-config" which is a program returning
+# the flags for the Pth emulation library.
 
 ax_pthread_flags="pthreads none -Kthread -pthread -pthreads -mthreads pthread --thread-safe -mt pthread-config"
 
@@ -4816,11 +5099,12 @@
 
 _ACEOF
 if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
- $EGREP "AX_PTHREAD_ZOS_MISSING" >/dev/null 2>&1; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: IBM z/OS requires -D_OPEN_THREADS or -D_UNIX03_THREADS to enable pthreads support." >&5
-$as_echo "$as_me: WARNING: IBM z/OS requires -D_OPEN_THREADS or -D_UNIX03_THREADS to enable pthreads support." >&2;}
+ $EGREP "AX_PTHREAD_ZOS_MISSING" >/dev/null 2>&1
+then :
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: IBM z/OS requires -D_OPEN_THREADS or -D_UNIX03_THREADS to enable pthreads support." >&5
+printf "%s\n" "$as_me: WARNING: IBM z/OS requires -D_OPEN_THREADS or -D_UNIX03_THREADS to enable pthreads support." >&2;}
 fi
-rm -f conftest*
+rm -rf conftest*
 
 ;;
 
@@ -4834,46 +5118,18 @@
 # that too in a future libc.) So we'll check first for the
 # standard Solaris way of linking pthreads (-mt -lpthread).
 
- ax_pthread_flags="-mt,pthread pthread $ax_pthread_flags"
- ;;
-esac
-
-# GCC generally uses -pthread, or -pthreads on some platforms (e.g. SPARC)
-
-if test "x$GCC" = "xyes"; then :
- ax_pthread_flags="-pthread -pthreads $ax_pthread_flags"
-fi
-
-# The presence of a feature test macro requesting re-entrant function
-# definitions is, on some systems, a strong hint that pthreads support is
-# correctly enabled
-
-case $host_os in
- darwin* | hpux* | linux* | osf* | solaris*)
- ax_pthread_check_macro="_REENTRANT"
- ;;
-
- aix*)
- ax_pthread_check_macro="_THREAD_SAFE"
- ;;
-
- *)
- ax_pthread_check_macro="--"
+ ax_pthread_flags="-mt,-lpthread pthread $ax_pthread_flags"
 ;;
 esac
-if test "x$ax_pthread_check_macro" = "x--"; then :
- ax_pthread_check_cond=0
-else
- ax_pthread_check_cond="!defined($ax_pthread_check_macro)"
-fi
 
 # Are we compiling with Clang?
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC is Clang" >&5
-$as_echo_n "checking whether $CC is Clang... " >&6; }
-if ${ax_cv_PTHREAD_CLANG+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether $CC is Clang" >&5
+printf %s "checking whether $CC is Clang... " >&6; }
+if test ${ax_cv_PTHREAD_CLANG+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 ax_cv_PTHREAD_CLANG=no
 # Note that Autoconf sets GCC=yes for Clang as well as GCC
 if test "x$GCC" = "xyes"; then
@@ -4886,150 +5142,99 @@
 
 _ACEOF
 if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
- $EGREP "AX_PTHREAD_CC_IS_CLANG" >/dev/null 2>&1; then :
+ $EGREP "AX_PTHREAD_CC_IS_CLANG" >/dev/null 2>&1
+then :
 ax_cv_PTHREAD_CLANG=yes
 fi
-rm -f conftest*
+rm -rf conftest*
 
 fi
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ax_cv_PTHREAD_CLANG" >&5
-$as_echo "$ax_cv_PTHREAD_CLANG" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_PTHREAD_CLANG" >&5
+printf "%s\n" "$ax_cv_PTHREAD_CLANG" >&6; }
 ax_pthread_clang="$ax_cv_PTHREAD_CLANG"
 
-ax_pthread_clang_warning=no
 
-# Clang needs special handling, because older versions handle the -pthread
-# option in a rather... idiosyncratic way
-
-if test "x$ax_pthread_clang" = "xyes"; then
-
- # Clang takes -pthread; it has never supported any other flag
-
- # (Note 1: This will need to be revisited if a system that Clang
- # supports has POSIX threads in a separate library. This tends not
- # to be the way of modern systems, but it's conceivable.)
-
- # (Note 2: On some systems, notably Darwin, -pthread is not needed
- # to get POSIX threads support; the API is always present and
- # active. We could reasonably leave PTHREAD_CFLAGS empty. But
- # -pthread does define _REENTRANT, and while the Darwin headers
- # ignore this macro, third-party headers might not.)
+# GCC generally uses -pthread, or -pthreads on some platforms (e.g. SPARC)
 
- PTHREAD_CFLAGS="-pthread"
- PTHREAD_LIBS=
+# Note that for GCC and Clang -pthread generally implies -lpthread,
+# except when -nostdlib is passed.
+# This is problematic using libtool to build C++ shared libraries with pthread:
+# 1 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=25460
+# 2 https://bugzilla.redhat.com/show_bug.cgi?id=661333
+# 3 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=468555
+# To solve this, first try -pthread together with -lpthread for GCC
+
+if test "x$GCC" = "xyes"
+then :
+ ax_pthread_flags="-pthread,-lpthread -pthread -pthreads $ax_pthread_flags"
+fi
+
+# Clang takes -pthread (never supported any other flag), but we'll try with -lpthread first
+
+if test "x$ax_pthread_clang" = "xyes"
+then :
+ ax_pthread_flags="-pthread,-lpthread -pthread"
+fi
 
- ax_pthread_ok=yes
 
- # However, older versions of Clang make a point of warning the user
- # that, in an invocation where only linking and no compilation is
- # taking place, the -pthread option has no effect ("argument unused
- # during compilation"). They expect -pthread to be passed in only
- # when source code is being compiled.
- #
- # Problem is, this is at odds with the way Automake and most other
- # C build frameworks function, which is that the same flags used in
- # compilation (CFLAGS) are also used in linking. Many systems
- # supported by AX_PTHREAD require exactly this for POSIX threads
- # support, and in fact it is often not straightforward to specify a
- # flag that is used only in the compilation phase and not in
- # linking. Such a scenario is extremely rare in practice.
- #
- # Even though use of the -pthread flag in linking would only print
- # a warning, this can be a nuisance for well-run software projects
- # that build with -Werror. So if the active version of Clang has
- # this misfeature, we search for an option to squash it.
+# The presence of a feature test macro requesting re-entrant function
+# definitions is, on some systems, a strong hint that pthreads support is
+# correctly enabled
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether Clang needs flag to prevent \"argument unused\" warning when linking with -pthread" >&5
-$as_echo_n "checking whether Clang needs flag to prevent \"argument unused\" warning when linking with -pthread... " >&6; }
-if ${ax_cv_PTHREAD_CLANG_NO_WARN_FLAG+:} false; then :
- $as_echo_n "(cached) " >&6
-else
- ax_cv_PTHREAD_CLANG_NO_WARN_FLAG=unknown
- # Create an alternate version of $ac_link that compiles and
- # links in two steps (.c -> .o, .o -> exe) instead of one
- # (.c -> exe), because the warning occurs only in the second
- # step
- ax_pthread_save_ac_link="$ac_link"
- ax_pthread_sed='s/conftest\.\$ac_ext/conftest.$ac_objext/g'
- ax_pthread_link_step=`$as_echo "$ac_link" | sed "$ax_pthread_sed"`
- ax_pthread_2step_ac_link="($ac_compile) && (echo ==== >&5) && ($ax_pthread_link_step)"
- ax_pthread_save_CFLAGS="$CFLAGS"
- for ax_pthread_try in '' -Qunused-arguments -Wno-unused-command-line-argument unknown; do
- if test "x$ax_pthread_try" = "xunknown"; then :
- break
-fi
- CFLAGS="-Werror -Wunknown-warning-option $ax_pthread_try -pthread $ax_pthread_save_CFLAGS"
- ac_link="$ax_pthread_save_ac_link"
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h. */
-int main(void){return 0;}
-_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
- ac_link="$ax_pthread_2step_ac_link"
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h. */
-int main(void){return 0;}
-_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
- break
-fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+case $host_os in
+ darwin* | hpux* | linux* | osf* | solaris*)
+ ax_pthread_check_macro="_REENTRANT"
+ ;;
 
-fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
- done
- ac_link="$ax_pthread_save_ac_link"
- CFLAGS="$ax_pthread_save_CFLAGS"
- if test "x$ax_pthread_try" = "x"; then :
- ax_pthread_try=no
-fi
- ax_cv_PTHREAD_CLANG_NO_WARN_FLAG="$ax_pthread_try"
+ aix*)
+ ax_pthread_check_macro="_THREAD_SAFE"
+ ;;
 
+ *)
+ ax_pthread_check_macro="--"
+ ;;
+esac
+if test "x$ax_pthread_check_macro" = "x--"
+then :
+ ax_pthread_check_cond=0
+else $as_nop
+ ax_pthread_check_cond="!defined($ax_pthread_check_macro)"
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ax_cv_PTHREAD_CLANG_NO_WARN_FLAG" >&5
-$as_echo "$ax_cv_PTHREAD_CLANG_NO_WARN_FLAG" >&6; }
 
- case "$ax_cv_PTHREAD_CLANG_NO_WARN_FLAG" in
- no | unknown) ;;
- *) PTHREAD_CFLAGS="$ax_cv_PTHREAD_CLANG_NO_WARN_FLAG $PTHREAD_CFLAGS" ;;
- esac
-
-fi # $ax_pthread_clang = yes
 
 if test "x$ax_pthread_ok" = "xno"; then
 for ax_pthread_try_flag in $ax_pthread_flags; do
 
 case $ax_pthread_try_flag in
 none)
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether pthreads work without any flags" >&5
-$as_echo_n "checking whether pthreads work without any flags... " >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether pthreads work without any flags" >&5
+printf %s "checking whether pthreads work without any flags... " >&6; }
 ;;
 
- -mt,pthread)
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether pthreads work with -mt -lpthread" >&5
-$as_echo_n "checking whether pthreads work with -mt -lpthread... " >&6; }
- PTHREAD_CFLAGS="-mt"
- PTHREAD_LIBS="-lpthread"
+ *,*)
+ PTHREAD_CFLAGS=`echo $ax_pthread_try_flag | sed "s/^$.*$,$.*$$/\1/"`
+ PTHREAD_LIBS=`echo $ax_pthread_try_flag | sed "s/^$.*$,$.*$$/\2/"`
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether pthreads work with \"$PTHREAD_CFLAGS\" and \"$PTHREAD_LIBS\"" >&5
+printf %s "checking whether pthreads work with \"$PTHREAD_CFLAGS\" and \"$PTHREAD_LIBS\"... " >&6; }
 ;;
 
 -*)
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether pthreads work with $ax_pthread_try_flag" >&5
-$as_echo_n "checking whether pthreads work with $ax_pthread_try_flag... " >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether pthreads work with $ax_pthread_try_flag" >&5
+printf %s "checking whether pthreads work with $ax_pthread_try_flag... " >&6; }
 PTHREAD_CFLAGS="$ax_pthread_try_flag"
 ;;
 
 pthread-config)
 # Extract the first word of "pthread-config", so it can be a program name with args.
 set dummy pthread-config; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_ax_pthread_config+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_ax_pthread_config+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if test -n "$ax_pthread_config"; then
 ac_cv_prog_ax_pthread_config="$ax_pthread_config" # Let the user override the test.
 else
@@ -5037,11 +5242,15 @@
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
 for ac_exec_ext in '' $ac_executable_extensions; do
- if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+ if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
 ac_cv_prog_ax_pthread_config="yes"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
 break 2
 fi
 done
@@ -5053,15 +5262,16 @@
 fi
 ax_pthread_config=$ac_cv_prog_ax_pthread_config
 if test -n "$ax_pthread_config"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ax_pthread_config" >&5
-$as_echo "$ax_pthread_config" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_pthread_config" >&5
+printf "%s\n" "$ax_pthread_config" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
- if test "x$ax_pthread_config" = "xno"; then :
+ if test "x$ax_pthread_config" = "xno"
+then :
 continue
 fi
 PTHREAD_CFLAGS="`pthread-config --cflags`"
@@ -5069,8 +5279,8 @@
 ;;
 
 *)
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for the pthreads library -l$ax_pthread_try_flag" >&5
-$as_echo_n "checking for the pthreads library -l$ax_pthread_try_flag... " >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for the pthreads library -l$ax_pthread_try_flag" >&5
+printf %s "checking for the pthreads library -l$ax_pthread_try_flag... " >&6; }
 PTHREAD_LIBS="-l$ax_pthread_try_flag"
 ;;
 esac
@@ -5096,10 +5306,16 @@
 # if $ax_pthread_check_cond
 # error "$ax_pthread_check_macro must be defined"
 # endif
- static void routine(void *a) { a = 0; }
+ static void *some_global = NULL;
+ static void routine(void *a)
+ {
+ /* To avoid any unused-parameter or
+ unused-but-set-parameter warning. */
+ some_global = a;
+ }
 static void *start_routine(void *a) { return a; }
 int
-main ()
+main (void)
 {
 pthread_t th; pthread_attr_t attr;
 pthread_create(&th, 0, start_routine, 0);
@@ -5111,18 +5327,20 @@
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
 ax_pthread_ok=yes
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
 conftest$ac_exeext conftest.$ac_ext
 
 CFLAGS="$ax_pthread_save_CFLAGS"
 LIBS="$ax_pthread_save_LIBS"
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ax_pthread_ok" >&5
-$as_echo "$ax_pthread_ok" >&6; }
- if test "x$ax_pthread_ok" = "xyes"; then :
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_pthread_ok" >&5
+printf "%s\n" "$ax_pthread_ok" >&6; }
+ if test "x$ax_pthread_ok" = "xyes"
+then :
 break
 fi
 
@@ -5131,6 +5349,109 @@
 done
 fi
 
+
+# Clang needs special handling, because older versions handle the -pthread
+# option in a rather... idiosyncratic way
+
+if test "x$ax_pthread_clang" = "xyes"; then
+
+ # Clang takes -pthread; it has never supported any other flag
+
+ # (Note 1: This will need to be revisited if a system that Clang
+ # supports has POSIX threads in a separate library. This tends not
+ # to be the way of modern systems, but it's conceivable.)
+
+ # (Note 2: On some systems, notably Darwin, -pthread is not needed
+ # to get POSIX threads support; the API is always present and
+ # active. We could reasonably leave PTHREAD_CFLAGS empty. But
+ # -pthread does define _REENTRANT, and while the Darwin headers
+ # ignore this macro, third-party headers might not.)
+
+ # However, older versions of Clang make a point of warning the user
+ # that, in an invocation where only linking and no compilation is
+ # taking place, the -pthread option has no effect ("argument unused
+ # during compilation"). They expect -pthread to be passed in only
+ # when source code is being compiled.
+ #
+ # Problem is, this is at odds with the way Automake and most other
+ # C build frameworks function, which is that the same flags used in
+ # compilation (CFLAGS) are also used in linking. Many systems
+ # supported by AX_PTHREAD require exactly this for POSIX threads
+ # support, and in fact it is often not straightforward to specify a
+ # flag that is used only in the compilation phase and not in
+ # linking. Such a scenario is extremely rare in practice.
+ #
+ # Even though use of the -pthread flag in linking would only print
+ # a warning, this can be a nuisance for well-run software projects
+ # that build with -Werror. So if the active version of Clang has
+ # this misfeature, we search for an option to squash it.
+
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether Clang needs flag to prevent \"argument unused\" warning when linking with -pthread" >&5
+printf %s "checking whether Clang needs flag to prevent \"argument unused\" warning when linking with -pthread... " >&6; }
+if test ${ax_cv_PTHREAD_CLANG_NO_WARN_FLAG+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
+ ax_cv_PTHREAD_CLANG_NO_WARN_FLAG=unknown
+ # Create an alternate version of $ac_link that compiles and
+ # links in two steps (.c -> .o, .o -> exe) instead of one
+ # (.c -> exe), because the warning occurs only in the second
+ # step
+ ax_pthread_save_ac_link="$ac_link"
+ ax_pthread_sed='s/conftest\.\$ac_ext/conftest.$ac_objext/g'
+ ax_pthread_link_step=`printf "%s\n" "$ac_link" | sed "$ax_pthread_sed"`
+ ax_pthread_2step_ac_link="($ac_compile) && (echo ==== >&5) && ($ax_pthread_link_step)"
+ ax_pthread_save_CFLAGS="$CFLAGS"
+ for ax_pthread_try in '' -Qunused-arguments -Wno-unused-command-line-argument unknown; do
+ if test "x$ax_pthread_try" = "xunknown"
+then :
+ break
+fi
+ CFLAGS="-Werror -Wunknown-warning-option $ax_pthread_try -pthread $ax_pthread_save_CFLAGS"
+ ac_link="$ax_pthread_save_ac_link"
+ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h. */
+int main(void){return 0;}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"
+then :
+ ac_link="$ax_pthread_2step_ac_link"
+ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h. */
+int main(void){return 0;}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"
+then :
+ break
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
+ conftest$ac_exeext conftest.$ac_ext
+
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
+ conftest$ac_exeext conftest.$ac_ext
+ done
+ ac_link="$ax_pthread_save_ac_link"
+ CFLAGS="$ax_pthread_save_CFLAGS"
+ if test "x$ax_pthread_try" = "x"
+then :
+ ax_pthread_try=no
+fi
+ ax_cv_PTHREAD_CLANG_NO_WARN_FLAG="$ax_pthread_try"
+
+fi
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_PTHREAD_CLANG_NO_WARN_FLAG" >&5
+printf "%s\n" "$ax_cv_PTHREAD_CLANG_NO_WARN_FLAG" >&6; }
+
+ case "$ax_cv_PTHREAD_CLANG_NO_WARN_FLAG" in
+ no | unknown) ;;
+ *) PTHREAD_CFLAGS="$ax_cv_PTHREAD_CLANG_NO_WARN_FLAG $PTHREAD_CFLAGS" ;;
+ esac
+
+fi # $ax_pthread_clang = yes
+
+
+
 # Various other checks:
 if test "x$ax_pthread_ok" = "xyes"; then
 ax_pthread_save_CFLAGS="$CFLAGS"
@@ -5139,51 +5460,53 @@
 LIBS="$PTHREAD_LIBS $LIBS"
 
 # Detect AIX lossage: JOINABLE attribute is called UNDETACHED.
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for joinable pthread attribute" >&5
-$as_echo_n "checking for joinable pthread attribute... " >&6; }
-if ${ax_cv_PTHREAD_JOINABLE_ATTR+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for joinable pthread attribute" >&5
+printf %s "checking for joinable pthread attribute... " >&6; }
+if test ${ax_cv_PTHREAD_JOINABLE_ATTR+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 ax_cv_PTHREAD_JOINABLE_ATTR=unknown
 for ax_pthread_attr in PTHREAD_CREATE_JOINABLE PTHREAD_CREATE_UNDETACHED; do
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
 #include <pthread.h>
 int
-main ()
+main (void)
 {
 int attr = $ax_pthread_attr; return attr /* ; */
 ;
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
 ax_cv_PTHREAD_JOINABLE_ATTR=$ax_pthread_attr; break
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
 conftest$ac_exeext conftest.$ac_ext
 done
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ax_cv_PTHREAD_JOINABLE_ATTR" >&5
-$as_echo "$ax_cv_PTHREAD_JOINABLE_ATTR" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_PTHREAD_JOINABLE_ATTR" >&5
+printf "%s\n" "$ax_cv_PTHREAD_JOINABLE_ATTR" >&6; }
 if test "x$ax_cv_PTHREAD_JOINABLE_ATTR" != "xunknown" && \
 test "x$ax_cv_PTHREAD_JOINABLE_ATTR" != "xPTHREAD_CREATE_JOINABLE" && \
- test "x$ax_pthread_joinable_attr_defined" != "xyes"; then :
+ test "x$ax_pthread_joinable_attr_defined" != "xyes"
+then :
 
-cat >>confdefs.h <<_ACEOF
-#define PTHREAD_CREATE_JOINABLE $ax_cv_PTHREAD_JOINABLE_ATTR
-_ACEOF
+printf "%s\n" "#define PTHREAD_CREATE_JOINABLE $ax_cv_PTHREAD_JOINABLE_ATTR" >>confdefs.h
 
 ax_pthread_joinable_attr_defined=yes
 
 fi
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether more special flags are required for pthreads" >&5
-$as_echo_n "checking whether more special flags are required for pthreads... " >&6; }
-if ${ax_cv_PTHREAD_SPECIAL_FLAGS+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether more special flags are required for pthreads" >&5
+printf %s "checking whether more special flags are required for pthreads... " >&6; }
+if test ${ax_cv_PTHREAD_SPECIAL_FLAGS+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 ax_cv_PTHREAD_SPECIAL_FLAGS=no
 case $host_os in
 solaris*)
@@ -5192,45 +5515,50 @@
 esac
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ax_cv_PTHREAD_SPECIAL_FLAGS" >&5
-$as_echo "$ax_cv_PTHREAD_SPECIAL_FLAGS" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_PTHREAD_SPECIAL_FLAGS" >&5
+printf "%s\n" "$ax_cv_PTHREAD_SPECIAL_FLAGS" >&6; }
 if test "x$ax_cv_PTHREAD_SPECIAL_FLAGS" != "xno" && \
- test "x$ax_pthread_special_flags_added" != "xyes"; then :
+ test "x$ax_pthread_special_flags_added" != "xyes"
+then :
 PTHREAD_CFLAGS="$ax_cv_PTHREAD_SPECIAL_FLAGS $PTHREAD_CFLAGS"
 ax_pthread_special_flags_added=yes
 fi
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for PTHREAD_PRIO_INHERIT" >&5
-$as_echo_n "checking for PTHREAD_PRIO_INHERIT... " >&6; }
-if ${ax_cv_PTHREAD_PRIO_INHERIT+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for PTHREAD_PRIO_INHERIT" >&5
+printf %s "checking for PTHREAD_PRIO_INHERIT... " >&6; }
+if test ${ax_cv_PTHREAD_PRIO_INHERIT+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
 #include <pthread.h>
 int
-main ()
+main (void)
 {
 int i = PTHREAD_PRIO_INHERIT;
+ return i;
 ;
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
 ax_cv_PTHREAD_PRIO_INHERIT=yes
-else
+else $as_nop
 ax_cv_PTHREAD_PRIO_INHERIT=no
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
 conftest$ac_exeext conftest.$ac_ext
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ax_cv_PTHREAD_PRIO_INHERIT" >&5
-$as_echo "$ax_cv_PTHREAD_PRIO_INHERIT" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_PTHREAD_PRIO_INHERIT" >&5
+printf "%s\n" "$ax_cv_PTHREAD_PRIO_INHERIT" >&6; }
 if test "x$ax_cv_PTHREAD_PRIO_INHERIT" = "xyes" && \
- test "x$ax_pthread_prio_inherit_defined" != "xyes"; then :
+ test "x$ax_pthread_prio_inherit_defined" != "xyes"
+then :
 
-$as_echo "#define HAVE_PTHREAD_PRIO_INHERIT 1" >>confdefs.h
+printf "%s\n" "#define HAVE_PTHREAD_PRIO_INHERIT 1" >>confdefs.h
 
 ax_pthread_prio_inherit_defined=yes
 
@@ -5248,19 +5576,31 @@
 #handle absolute path differently from PATH based program lookup
 case "x$CC" in #(
 x/*) :
- if as_fn_executable_p ${CC}_r; then :
+
+			 if as_fn_executable_p ${CC}_r
+then :
 PTHREAD_CC="${CC}_r"
-fi ;; #(
+fi
+			 if test "x${CXX}" != "x"
+then :
+ if as_fn_executable_p ${CXX}_r
+then :
+ PTHREAD_CXX="${CXX}_r"
+fi
+fi
+			 ;; #(
 *) :
- for ac_prog in ${CC}_r
+
+			 for ac_prog in ${CC}_r
 do
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_PTHREAD_CC+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_PTHREAD_CC+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if test -n "$PTHREAD_CC"; then
 ac_cv_prog_PTHREAD_CC="$PTHREAD_CC" # Let the user override the test.
 else
@@ -5268,11 +5608,15 @@
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
 for ac_exec_ext in '' $ac_executable_extensions; do
- if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+ if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
 ac_cv_prog_PTHREAD_CC="$ac_prog"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
 break 2
 fi
 done
@@ -5283,19 +5627,73 @@
 fi
 PTHREAD_CC=$ac_cv_prog_PTHREAD_CC
 if test -n "$PTHREAD_CC"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $PTHREAD_CC" >&5
-$as_echo "$PTHREAD_CC" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $PTHREAD_CC" >&5
+printf "%s\n" "$PTHREAD_CC" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
 test -n "$PTHREAD_CC" && break
 done
 test -n "$PTHREAD_CC" || PTHREAD_CC="$CC"
- ;;
-esac ;; #(
+
+			 if test "x${CXX}" != "x"
+then :
+ for ac_prog in ${CXX}_r
+do
+ # Extract the first word of "$ac_prog", so it can be a program name with args.
+set dummy $ac_prog; ac_word=$2
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_PTHREAD_CXX+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
+ if test -n "$PTHREAD_CXX"; then
+ ac_cv_prog_PTHREAD_CXX="$PTHREAD_CXX" # Let the user override the test.
+else
+as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+for as_dir in $PATH
+do
+ IFS=$as_save_IFS
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
+ for ac_exec_ext in '' $ac_executable_extensions; do
+ if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
+ ac_cv_prog_PTHREAD_CXX="$ac_prog"
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
+ break 2
+ fi
+done
+ done
+IFS=$as_save_IFS
+
+fi
+fi
+PTHREAD_CXX=$ac_cv_prog_PTHREAD_CXX
+if test -n "$PTHREAD_CXX"; then
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $PTHREAD_CXX" >&5
+printf "%s\n" "$PTHREAD_CXX" >&6; }
+else
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
+fi
+
+
+ test -n "$PTHREAD_CXX" && break
+done
+test -n "$PTHREAD_CXX" || PTHREAD_CXX="$CXX"
+
+fi
+
+ ;;
+esac
+ ;; #(
 *) :
 ;;
 esac
@@ -5305,6 +5703,8 @@
 fi
 
 test -n "$PTHREAD_CC" || PTHREAD_CC="$CC"
+test -n "$PTHREAD_CXX" || PTHREAD_CXX="$CXX"
+
 
 
 
@@ -5313,7 +5713,7 @@
 # Finally, execute ACTION-IF-FOUND/ACTION-IF-NOT-FOUND:
 if test "x$ax_pthread_ok" = "xyes"; then
 
-$as_echo "#define HAVE_PTHREAD 1" >>confdefs.h
+printf "%s\n" "#define HAVE_PTHREAD 1" >>confdefs.h
 
 :
 else
@@ -5331,14 +5731,14 @@
 CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
 CC="$PTHREAD_CC"
 
-$as_echo "#define USE_PTHREAD 1" >>confdefs.h
+printf "%s\n" "#define USE_PTHREAD 1" >>confdefs.h
 
 ;;
 fork)
- { $as_echo "$as_me:${as_lineno-$LINENO}: FORK mode selected" >&5
-$as_echo "$as_me: FORK mode selected" >&6;}
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: FORK mode selected" >&5
+printf "%s\n" "$as_me: FORK mode selected" >&6;}
 
-$as_echo "#define USE_FORK 1" >>confdefs.h
+printf "%s\n" "#define USE_FORK 1" >>confdefs.h
 
 ;;
 *)
@@ -5346,7 +5746,7 @@
 ;;
 esac
 
-else
+else $as_nop
 
 # do not attempt to autodetect UCONTEXT threading
 
@@ -5372,38 +5772,41 @@
 ax_pthread_save_CC="$CC"
 ax_pthread_save_CFLAGS="$CFLAGS"
 ax_pthread_save_LIBS="$LIBS"
- if test "x$PTHREAD_CC" != "x"; then :
+ if test "x$PTHREAD_CC" != "x"
+then :
 CC="$PTHREAD_CC"
 fi
+ if test "x$PTHREAD_CXX" != "x"
+then :
+ CXX="$PTHREAD_CXX"
+fi
 CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
 LIBS="$PTHREAD_LIBS $LIBS"
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for pthread_join using $CC $PTHREAD_CFLAGS $PTHREAD_LIBS" >&5
-$as_echo_n "checking for pthread_join using $CC $PTHREAD_CFLAGS $PTHREAD_LIBS... " >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for pthread_join using $CC $PTHREAD_CFLAGS $PTHREAD_LIBS" >&5
+printf %s "checking for pthread_join using $CC $PTHREAD_CFLAGS $PTHREAD_LIBS... " >&6; }
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
 
 /* Override any GCC internal prototype to avoid an error.
 Use char because int might match the return type of a GCC
 builtin and then its argument prototype would still apply. */
-#ifdef __cplusplus
-extern "C"
-#endif
 char pthread_join ();
 int
-main ()
+main (void)
 {
 return pthread_join ();
 ;
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
 ax_pthread_ok=yes
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
 conftest$ac_exeext conftest.$ac_ext
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ax_pthread_ok" >&5
-$as_echo "$ax_pthread_ok" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_pthread_ok" >&5
+printf "%s\n" "$ax_pthread_ok" >&6; }
 if test "x$ax_pthread_ok" = "xno"; then
 PTHREAD_LIBS=""
 PTHREAD_CFLAGS=""
@@ -5418,10 +5821,12 @@
 # (e.g. DEC) have both -lpthread and -lpthreads, where one of the
 # libraries is broken (non-POSIX).
 
-# Create a list of thread flags to try. Items starting with a "-" are
-# C compiler flags, and other items are library names, except for "none"
-# which indicates that we try without any flags at all, and "pthread-config"
-# which is a program returning the flags for the Pth emulation library.
+# Create a list of thread flags to try. Items with a "," contain both
+# C compiler flags (before ",") and linker flags (after ","). Other items
+# starting with a "-" are C compiler flags, and remaining items are
+# library names, except for "none" which indicates that we try without
+# any flags at all, and "pthread-config" which is a program returning
+# the flags for the Pth emulation library.
 
 ax_pthread_flags="pthreads none -Kthread -pthread -pthreads -mthreads pthread --thread-safe -mt pthread-config"
 
@@ -5479,11 +5884,12 @@
 
 _ACEOF
 if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
- $EGREP "AX_PTHREAD_ZOS_MISSING" >/dev/null 2>&1; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: IBM z/OS requires -D_OPEN_THREADS or -D_UNIX03_THREADS to enable pthreads support." >&5
-$as_echo "$as_me: WARNING: IBM z/OS requires -D_OPEN_THREADS or -D_UNIX03_THREADS to enable pthreads support." >&2;}
+ $EGREP "AX_PTHREAD_ZOS_MISSING" >/dev/null 2>&1
+then :
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: IBM z/OS requires -D_OPEN_THREADS or -D_UNIX03_THREADS to enable pthreads support." >&5
+printf "%s\n" "$as_me: WARNING: IBM z/OS requires -D_OPEN_THREADS or -D_UNIX03_THREADS to enable pthreads support." >&2;}
 fi
-rm -f conftest*
+rm -rf conftest*
 
 ;;
 
@@ -5497,46 +5903,18 @@
 # that too in a future libc.) So we'll check first for the
 # standard Solaris way of linking pthreads (-mt -lpthread).
 
- ax_pthread_flags="-mt,pthread pthread $ax_pthread_flags"
+ ax_pthread_flags="-mt,-lpthread pthread $ax_pthread_flags"
 ;;
 esac
 
-# GCC generally uses -pthread, or -pthreads on some platforms (e.g. SPARC)
-
-if test "x$GCC" = "xyes"; then :
- ax_pthread_flags="-pthread -pthreads $ax_pthread_flags"
-fi
-
-# The presence of a feature test macro requesting re-entrant function
-# definitions is, on some systems, a strong hint that pthreads support is
-# correctly enabled
-
-case $host_os in
- darwin* | hpux* | linux* | osf* | solaris*)
- ax_pthread_check_macro="_REENTRANT"
- ;;
-
- aix*)
- ax_pthread_check_macro="_THREAD_SAFE"
- ;;
-
- *)
- ax_pthread_check_macro="--"
- ;;
-esac
-if test "x$ax_pthread_check_macro" = "x--"; then :
- ax_pthread_check_cond=0
-else
- ax_pthread_check_cond="!defined($ax_pthread_check_macro)"
-fi
-
 # Are we compiling with Clang?
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC is Clang" >&5
-$as_echo_n "checking whether $CC is Clang... " >&6; }
-if ${ax_cv_PTHREAD_CLANG+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether $CC is Clang" >&5
+printf %s "checking whether $CC is Clang... " >&6; }
+if test ${ax_cv_PTHREAD_CLANG+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 ax_cv_PTHREAD_CLANG=no
 # Note that Autoconf sets GCC=yes for Clang as well as GCC
 if test "x$GCC" = "xyes"; then
@@ -5549,150 +5927,99 @@
 
 _ACEOF
 if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
- $EGREP "AX_PTHREAD_CC_IS_CLANG" >/dev/null 2>&1; then :
+ $EGREP "AX_PTHREAD_CC_IS_CLANG" >/dev/null 2>&1
+then :
 ax_cv_PTHREAD_CLANG=yes
 fi
-rm -f conftest*
+rm -rf conftest*
 
 fi
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ax_cv_PTHREAD_CLANG" >&5
-$as_echo "$ax_cv_PTHREAD_CLANG" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_PTHREAD_CLANG" >&5
+printf "%s\n" "$ax_cv_PTHREAD_CLANG" >&6; }
 ax_pthread_clang="$ax_cv_PTHREAD_CLANG"
 
-ax_pthread_clang_warning=no
-
-# Clang needs special handling, because older versions handle the -pthread
-# option in a rather... idiosyncratic way
-
-if test "x$ax_pthread_clang" = "xyes"; then
-
- # Clang takes -pthread; it has never supported any other flag
-
- # (Note 1: This will need to be revisited if a system that Clang
- # supports has POSIX threads in a separate library. This tends not
- # to be the way of modern systems, but it's conceivable.)
 
- # (Note 2: On some systems, notably Darwin, -pthread is not needed
- # to get POSIX threads support; the API is always present and
- # active. We could reasonably leave PTHREAD_CFLAGS empty. But
- # -pthread does define _REENTRANT, and while the Darwin headers
- # ignore this macro, third-party headers might not.)
+# GCC generally uses -pthread, or -pthreads on some platforms (e.g. SPARC)
 
- PTHREAD_CFLAGS="-pthread"
- PTHREAD_LIBS=
+# Note that for GCC and Clang -pthread generally implies -lpthread,
+# except when -nostdlib is passed.
+# This is problematic using libtool to build C++ shared libraries with pthread:
+# 1 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=25460
+# 2 https://bugzilla.redhat.com/show_bug.cgi?id=661333
+# 3 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=468555
+# To solve this, first try -pthread together with -lpthread for GCC
+
+if test "x$GCC" = "xyes"
+then :
+ ax_pthread_flags="-pthread,-lpthread -pthread -pthreads $ax_pthread_flags"
+fi
+
+# Clang takes -pthread (never supported any other flag), but we'll try with -lpthread first
+
+if test "x$ax_pthread_clang" = "xyes"
+then :
+ ax_pthread_flags="-pthread,-lpthread -pthread"
+fi
 
- ax_pthread_ok=yes
 
- # However, older versions of Clang make a point of warning the user
- # that, in an invocation where only linking and no compilation is
- # taking place, the -pthread option has no effect ("argument unused
- # during compilation"). They expect -pthread to be passed in only
- # when source code is being compiled.
- #
- # Problem is, this is at odds with the way Automake and most other
- # C build frameworks function, which is that the same flags used in
- # compilation (CFLAGS) are also used in linking. Many systems
- # supported by AX_PTHREAD require exactly this for POSIX threads
- # support, and in fact it is often not straightforward to specify a
- # flag that is used only in the compilation phase and not in
- # linking. Such a scenario is extremely rare in practice.
- #
- # Even though use of the -pthread flag in linking would only print
- # a warning, this can be a nuisance for well-run software projects
- # that build with -Werror. So if the active version of Clang has
- # this misfeature, we search for an option to squash it.
+# The presence of a feature test macro requesting re-entrant function
+# definitions is, on some systems, a strong hint that pthreads support is
+# correctly enabled
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether Clang needs flag to prevent \"argument unused\" warning when linking with -pthread" >&5
-$as_echo_n "checking whether Clang needs flag to prevent \"argument unused\" warning when linking with -pthread... " >&6; }
-if ${ax_cv_PTHREAD_CLANG_NO_WARN_FLAG+:} false; then :
- $as_echo_n "(cached) " >&6
-else
- ax_cv_PTHREAD_CLANG_NO_WARN_FLAG=unknown
- # Create an alternate version of $ac_link that compiles and
- # links in two steps (.c -> .o, .o -> exe) instead of one
- # (.c -> exe), because the warning occurs only in the second
- # step
- ax_pthread_save_ac_link="$ac_link"
- ax_pthread_sed='s/conftest\.\$ac_ext/conftest.$ac_objext/g'
- ax_pthread_link_step=`$as_echo "$ac_link" | sed "$ax_pthread_sed"`
- ax_pthread_2step_ac_link="($ac_compile) && (echo ==== >&5) && ($ax_pthread_link_step)"
- ax_pthread_save_CFLAGS="$CFLAGS"
- for ax_pthread_try in '' -Qunused-arguments -Wno-unused-command-line-argument unknown; do
- if test "x$ax_pthread_try" = "xunknown"; then :
- break
-fi
- CFLAGS="-Werror -Wunknown-warning-option $ax_pthread_try -pthread $ax_pthread_save_CFLAGS"
- ac_link="$ax_pthread_save_ac_link"
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h. */
-int main(void){return 0;}
-_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
- ac_link="$ax_pthread_2step_ac_link"
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h. */
-int main(void){return 0;}
-_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
- break
-fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
+case $host_os in
+ darwin* | hpux* | linux* | osf* | solaris*)
+ ax_pthread_check_macro="_REENTRANT"
+ ;;
 
-fi
-rm -f core conftest.err conftest.$ac_objext \
- conftest$ac_exeext conftest.$ac_ext
- done
- ac_link="$ax_pthread_save_ac_link"
- CFLAGS="$ax_pthread_save_CFLAGS"
- if test "x$ax_pthread_try" = "x"; then :
- ax_pthread_try=no
-fi
- ax_cv_PTHREAD_CLANG_NO_WARN_FLAG="$ax_pthread_try"
+ aix*)
+ ax_pthread_check_macro="_THREAD_SAFE"
+ ;;
 
+ *)
+ ax_pthread_check_macro="--"
+ ;;
+esac
+if test "x$ax_pthread_check_macro" = "x--"
+then :
+ ax_pthread_check_cond=0
+else $as_nop
+ ax_pthread_check_cond="!defined($ax_pthread_check_macro)"
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ax_cv_PTHREAD_CLANG_NO_WARN_FLAG" >&5
-$as_echo "$ax_cv_PTHREAD_CLANG_NO_WARN_FLAG" >&6; }
 
- case "$ax_cv_PTHREAD_CLANG_NO_WARN_FLAG" in
- no | unknown) ;;
- *) PTHREAD_CFLAGS="$ax_cv_PTHREAD_CLANG_NO_WARN_FLAG $PTHREAD_CFLAGS" ;;
- esac
-
-fi # $ax_pthread_clang = yes
 
 if test "x$ax_pthread_ok" = "xno"; then
 for ax_pthread_try_flag in $ax_pthread_flags; do
 
 case $ax_pthread_try_flag in
 none)
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether pthreads work without any flags" >&5
-$as_echo_n "checking whether pthreads work without any flags... " >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether pthreads work without any flags" >&5
+printf %s "checking whether pthreads work without any flags... " >&6; }
 ;;
 
- -mt,pthread)
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether pthreads work with -mt -lpthread" >&5
-$as_echo_n "checking whether pthreads work with -mt -lpthread... " >&6; }
- PTHREAD_CFLAGS="-mt"
- PTHREAD_LIBS="-lpthread"
+ *,*)
+ PTHREAD_CFLAGS=`echo $ax_pthread_try_flag | sed "s/^$.*$,$.*$$/\1/"`
+ PTHREAD_LIBS=`echo $ax_pthread_try_flag | sed "s/^$.*$,$.*$$/\2/"`
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether pthreads work with \"$PTHREAD_CFLAGS\" and \"$PTHREAD_LIBS\"" >&5
+printf %s "checking whether pthreads work with \"$PTHREAD_CFLAGS\" and \"$PTHREAD_LIBS\"... " >&6; }
 ;;
 
 -*)
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether pthreads work with $ax_pthread_try_flag" >&5
-$as_echo_n "checking whether pthreads work with $ax_pthread_try_flag... " >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether pthreads work with $ax_pthread_try_flag" >&5
+printf %s "checking whether pthreads work with $ax_pthread_try_flag... " >&6; }
 PTHREAD_CFLAGS="$ax_pthread_try_flag"
 ;;
 
 pthread-config)
 # Extract the first word of "pthread-config", so it can be a program name with args.
 set dummy pthread-config; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_ax_pthread_config+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_ax_pthread_config+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if test -n "$ax_pthread_config"; then
 ac_cv_prog_ax_pthread_config="$ax_pthread_config" # Let the user override the test.
 else
@@ -5700,11 +6027,15 @@
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
 for ac_exec_ext in '' $ac_executable_extensions; do
- if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+ if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
 ac_cv_prog_ax_pthread_config="yes"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
 break 2
 fi
 done
@@ -5716,15 +6047,16 @@
 fi
 ax_pthread_config=$ac_cv_prog_ax_pthread_config
 if test -n "$ax_pthread_config"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ax_pthread_config" >&5
-$as_echo "$ax_pthread_config" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_pthread_config" >&5
+printf "%s\n" "$ax_pthread_config" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
- if test "x$ax_pthread_config" = "xno"; then :
+ if test "x$ax_pthread_config" = "xno"
+then :
 continue
 fi
 PTHREAD_CFLAGS="`pthread-config --cflags`"
@@ -5732,8 +6064,8 @@
 ;;
 
 *)
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for the pthreads library -l$ax_pthread_try_flag" >&5
-$as_echo_n "checking for the pthreads library -l$ax_pthread_try_flag... " >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for the pthreads library -l$ax_pthread_try_flag" >&5
+printf %s "checking for the pthreads library -l$ax_pthread_try_flag... " >&6; }
 PTHREAD_LIBS="-l$ax_pthread_try_flag"
 ;;
 esac
@@ -5759,10 +6091,16 @@
 # if $ax_pthread_check_cond
 # error "$ax_pthread_check_macro must be defined"
 # endif
- static void routine(void *a) { a = 0; }
+ static void *some_global = NULL;
+ static void routine(void *a)
+ {
+ /* To avoid any unused-parameter or
+ unused-but-set-parameter warning. */
+ some_global = a;
+ }
 static void *start_routine(void *a) { return a; }
 int
-main ()
+main (void)
 {
 pthread_t th; pthread_attr_t attr;
 pthread_create(&th, 0, start_routine, 0);
@@ -5774,18 +6112,20 @@
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
 ax_pthread_ok=yes
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
 conftest$ac_exeext conftest.$ac_ext
 
 CFLAGS="$ax_pthread_save_CFLAGS"
 LIBS="$ax_pthread_save_LIBS"
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ax_pthread_ok" >&5
-$as_echo "$ax_pthread_ok" >&6; }
- if test "x$ax_pthread_ok" = "xyes"; then :
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_pthread_ok" >&5
+printf "%s\n" "$ax_pthread_ok" >&6; }
+ if test "x$ax_pthread_ok" = "xyes"
+then :
 break
 fi
 
@@ -5794,6 +6134,109 @@
 done
 fi
 
+
+# Clang needs special handling, because older versions handle the -pthread
+# option in a rather... idiosyncratic way
+
+if test "x$ax_pthread_clang" = "xyes"; then
+
+ # Clang takes -pthread; it has never supported any other flag
+
+ # (Note 1: This will need to be revisited if a system that Clang
+ # supports has POSIX threads in a separate library. This tends not
+ # to be the way of modern systems, but it's conceivable.)
+
+ # (Note 2: On some systems, notably Darwin, -pthread is not needed
+ # to get POSIX threads support; the API is always present and
+ # active. We could reasonably leave PTHREAD_CFLAGS empty. But
+ # -pthread does define _REENTRANT, and while the Darwin headers
+ # ignore this macro, third-party headers might not.)
+
+ # However, older versions of Clang make a point of warning the user
+ # that, in an invocation where only linking and no compilation is
+ # taking place, the -pthread option has no effect ("argument unused
+ # during compilation"). They expect -pthread to be passed in only
+ # when source code is being compiled.
+ #
+ # Problem is, this is at odds with the way Automake and most other
+ # C build frameworks function, which is that the same flags used in
+ # compilation (CFLAGS) are also used in linking. Many systems
+ # supported by AX_PTHREAD require exactly this for POSIX threads
+ # support, and in fact it is often not straightforward to specify a
+ # flag that is used only in the compilation phase and not in
+ # linking. Such a scenario is extremely rare in practice.
+ #
+ # Even though use of the -pthread flag in linking would only print
+ # a warning, this can be a nuisance for well-run software projects
+ # that build with -Werror. So if the active version of Clang has
+ # this misfeature, we search for an option to squash it.
+
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether Clang needs flag to prevent \"argument unused\" warning when linking with -pthread" >&5
+printf %s "checking whether Clang needs flag to prevent \"argument unused\" warning when linking with -pthread... " >&6; }
+if test ${ax_cv_PTHREAD_CLANG_NO_WARN_FLAG+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
+ ax_cv_PTHREAD_CLANG_NO_WARN_FLAG=unknown
+ # Create an alternate version of $ac_link that compiles and
+ # links in two steps (.c -> .o, .o -> exe) instead of one
+ # (.c -> exe), because the warning occurs only in the second
+ # step
+ ax_pthread_save_ac_link="$ac_link"
+ ax_pthread_sed='s/conftest\.\$ac_ext/conftest.$ac_objext/g'
+ ax_pthread_link_step=`printf "%s\n" "$ac_link" | sed "$ax_pthread_sed"`
+ ax_pthread_2step_ac_link="($ac_compile) && (echo ==== >&5) && ($ax_pthread_link_step)"
+ ax_pthread_save_CFLAGS="$CFLAGS"
+ for ax_pthread_try in '' -Qunused-arguments -Wno-unused-command-line-argument unknown; do
+ if test "x$ax_pthread_try" = "xunknown"
+then :
+ break
+fi
+ CFLAGS="-Werror -Wunknown-warning-option $ax_pthread_try -pthread $ax_pthread_save_CFLAGS"
+ ac_link="$ax_pthread_save_ac_link"
+ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h. */
+int main(void){return 0;}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"
+then :
+ ac_link="$ax_pthread_2step_ac_link"
+ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h. */
+int main(void){return 0;}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"
+then :
+ break
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
+ conftest$ac_exeext conftest.$ac_ext
+
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
+ conftest$ac_exeext conftest.$ac_ext
+ done
+ ac_link="$ax_pthread_save_ac_link"
+ CFLAGS="$ax_pthread_save_CFLAGS"
+ if test "x$ax_pthread_try" = "x"
+then :
+ ax_pthread_try=no
+fi
+ ax_cv_PTHREAD_CLANG_NO_WARN_FLAG="$ax_pthread_try"
+
+fi
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_PTHREAD_CLANG_NO_WARN_FLAG" >&5
+printf "%s\n" "$ax_cv_PTHREAD_CLANG_NO_WARN_FLAG" >&6; }
+
+ case "$ax_cv_PTHREAD_CLANG_NO_WARN_FLAG" in
+ no | unknown) ;;
+ *) PTHREAD_CFLAGS="$ax_cv_PTHREAD_CLANG_NO_WARN_FLAG $PTHREAD_CFLAGS" ;;
+ esac
+
+fi # $ax_pthread_clang = yes
+
+
+
 # Various other checks:
 if test "x$ax_pthread_ok" = "xyes"; then
 ax_pthread_save_CFLAGS="$CFLAGS"
@@ -5802,51 +6245,53 @@
 LIBS="$PTHREAD_LIBS $LIBS"
 
 # Detect AIX lossage: JOINABLE attribute is called UNDETACHED.
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for joinable pthread attribute" >&5
-$as_echo_n "checking for joinable pthread attribute... " >&6; }
-if ${ax_cv_PTHREAD_JOINABLE_ATTR+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for joinable pthread attribute" >&5
+printf %s "checking for joinable pthread attribute... " >&6; }
+if test ${ax_cv_PTHREAD_JOINABLE_ATTR+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 ax_cv_PTHREAD_JOINABLE_ATTR=unknown
 for ax_pthread_attr in PTHREAD_CREATE_JOINABLE PTHREAD_CREATE_UNDETACHED; do
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
 #include <pthread.h>
 int
-main ()
+main (void)
 {
 int attr = $ax_pthread_attr; return attr /* ; */
 ;
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
 ax_cv_PTHREAD_JOINABLE_ATTR=$ax_pthread_attr; break
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
 conftest$ac_exeext conftest.$ac_ext
 done
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ax_cv_PTHREAD_JOINABLE_ATTR" >&5
-$as_echo "$ax_cv_PTHREAD_JOINABLE_ATTR" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_PTHREAD_JOINABLE_ATTR" >&5
+printf "%s\n" "$ax_cv_PTHREAD_JOINABLE_ATTR" >&6; }
 if test "x$ax_cv_PTHREAD_JOINABLE_ATTR" != "xunknown" && \
 test "x$ax_cv_PTHREAD_JOINABLE_ATTR" != "xPTHREAD_CREATE_JOINABLE" && \
- test "x$ax_pthread_joinable_attr_defined" != "xyes"; then :
+ test "x$ax_pthread_joinable_attr_defined" != "xyes"
+then :
 
-cat >>confdefs.h <<_ACEOF
-#define PTHREAD_CREATE_JOINABLE $ax_cv_PTHREAD_JOINABLE_ATTR
-_ACEOF
+printf "%s\n" "#define PTHREAD_CREATE_JOINABLE $ax_cv_PTHREAD_JOINABLE_ATTR" >>confdefs.h
 
 ax_pthread_joinable_attr_defined=yes
 
 fi
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether more special flags are required for pthreads" >&5
-$as_echo_n "checking whether more special flags are required for pthreads... " >&6; }
-if ${ax_cv_PTHREAD_SPECIAL_FLAGS+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether more special flags are required for pthreads" >&5
+printf %s "checking whether more special flags are required for pthreads... " >&6; }
+if test ${ax_cv_PTHREAD_SPECIAL_FLAGS+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 ax_cv_PTHREAD_SPECIAL_FLAGS=no
 case $host_os in
 solaris*)
@@ -5855,45 +6300,50 @@
 esac
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ax_cv_PTHREAD_SPECIAL_FLAGS" >&5
-$as_echo "$ax_cv_PTHREAD_SPECIAL_FLAGS" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_PTHREAD_SPECIAL_FLAGS" >&5
+printf "%s\n" "$ax_cv_PTHREAD_SPECIAL_FLAGS" >&6; }
 if test "x$ax_cv_PTHREAD_SPECIAL_FLAGS" != "xno" && \
- test "x$ax_pthread_special_flags_added" != "xyes"; then :
+ test "x$ax_pthread_special_flags_added" != "xyes"
+then :
 PTHREAD_CFLAGS="$ax_cv_PTHREAD_SPECIAL_FLAGS $PTHREAD_CFLAGS"
 ax_pthread_special_flags_added=yes
 fi
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for PTHREAD_PRIO_INHERIT" >&5
-$as_echo_n "checking for PTHREAD_PRIO_INHERIT... " >&6; }
-if ${ax_cv_PTHREAD_PRIO_INHERIT+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for PTHREAD_PRIO_INHERIT" >&5
+printf %s "checking for PTHREAD_PRIO_INHERIT... " >&6; }
+if test ${ax_cv_PTHREAD_PRIO_INHERIT+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
 #include <pthread.h>
 int
-main ()
+main (void)
 {
 int i = PTHREAD_PRIO_INHERIT;
+ return i;
 ;
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
 ax_cv_PTHREAD_PRIO_INHERIT=yes
-else
+else $as_nop
 ax_cv_PTHREAD_PRIO_INHERIT=no
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
 conftest$ac_exeext conftest.$ac_ext
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ax_cv_PTHREAD_PRIO_INHERIT" >&5
-$as_echo "$ax_cv_PTHREAD_PRIO_INHERIT" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ax_cv_PTHREAD_PRIO_INHERIT" >&5
+printf "%s\n" "$ax_cv_PTHREAD_PRIO_INHERIT" >&6; }
 if test "x$ax_cv_PTHREAD_PRIO_INHERIT" = "xyes" && \
- test "x$ax_pthread_prio_inherit_defined" != "xyes"; then :
+ test "x$ax_pthread_prio_inherit_defined" != "xyes"
+then :
 
-$as_echo "#define HAVE_PTHREAD_PRIO_INHERIT 1" >>confdefs.h
+printf "%s\n" "#define HAVE_PTHREAD_PRIO_INHERIT 1" >>confdefs.h
 
 ax_pthread_prio_inherit_defined=yes
 
@@ -5911,19 +6361,31 @@
 #handle absolute path differently from PATH based program lookup
 case "x$CC" in #(
 x/*) :
- if as_fn_executable_p ${CC}_r; then :
+
+			 if as_fn_executable_p ${CC}_r
+then :
 PTHREAD_CC="${CC}_r"
-fi ;; #(
+fi
+			 if test "x${CXX}" != "x"
+then :
+ if as_fn_executable_p ${CXX}_r
+then :
+ PTHREAD_CXX="${CXX}_r"
+fi
+fi
+			 ;; #(
 *) :
- for ac_prog in ${CC}_r
+
+			 for ac_prog in ${CC}_r
 do
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_PTHREAD_CC+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_PTHREAD_CC+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if test -n "$PTHREAD_CC"; then
 ac_cv_prog_PTHREAD_CC="$PTHREAD_CC" # Let the user override the test.
 else
@@ -5931,11 +6393,15 @@
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
 for ac_exec_ext in '' $ac_executable_extensions; do
- if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+ if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
 ac_cv_prog_PTHREAD_CC="$ac_prog"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
 break 2
 fi
 done
@@ -5946,19 +6412,73 @@
 fi
 PTHREAD_CC=$ac_cv_prog_PTHREAD_CC
 if test -n "$PTHREAD_CC"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $PTHREAD_CC" >&5
-$as_echo "$PTHREAD_CC" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $PTHREAD_CC" >&5
+printf "%s\n" "$PTHREAD_CC" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
 test -n "$PTHREAD_CC" && break
 done
 test -n "$PTHREAD_CC" || PTHREAD_CC="$CC"
- ;;
-esac ;; #(
+
+			 if test "x${CXX}" != "x"
+then :
+ for ac_prog in ${CXX}_r
+do
+ # Extract the first word of "$ac_prog", so it can be a program name with args.
+set dummy $ac_prog; ac_word=$2
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_PTHREAD_CXX+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
+ if test -n "$PTHREAD_CXX"; then
+ ac_cv_prog_PTHREAD_CXX="$PTHREAD_CXX" # Let the user override the test.
+else
+as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+for as_dir in $PATH
+do
+ IFS=$as_save_IFS
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
+ for ac_exec_ext in '' $ac_executable_extensions; do
+ if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
+ ac_cv_prog_PTHREAD_CXX="$ac_prog"
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
+ break 2
+ fi
+done
+ done
+IFS=$as_save_IFS
+
+fi
+fi
+PTHREAD_CXX=$ac_cv_prog_PTHREAD_CXX
+if test -n "$PTHREAD_CXX"; then
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $PTHREAD_CXX" >&5
+printf "%s\n" "$PTHREAD_CXX" >&6; }
+else
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
+fi
+
+
+ test -n "$PTHREAD_CXX" && break
+done
+test -n "$PTHREAD_CXX" || PTHREAD_CXX="$CXX"
+
+fi
+
+ ;;
+esac
+ ;; #(
 *) :
 ;;
 esac
@@ -5968,6 +6488,8 @@
 fi
 
 test -n "$PTHREAD_CC" || PTHREAD_CC="$CC"
+test -n "$PTHREAD_CXX" || PTHREAD_CXX="$CXX"
+
 
 
 
@@ -5976,23 +6498,23 @@
 # Finally, execute ACTION-IF-FOUND/ACTION-IF-NOT-FOUND:
 if test "x$ax_pthread_ok" = "xyes"; then
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: PTHREAD thread model detected" >&5
-$as_echo "$as_me: PTHREAD thread model detected" >&6;}
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: PTHREAD thread model detected" >&5
+printf "%s\n" "$as_me: PTHREAD thread model detected" >&6;}
 LIBS="$PTHREAD_LIBS $LIBS"
 CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
 CC="$PTHREAD_CC"
 
-$as_echo "#define USE_PTHREAD 1" >>confdefs.h
+printf "%s\n" "#define USE_PTHREAD 1" >>confdefs.h
 
 
 :
 else
 ax_pthread_ok=no
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: FORK thread model detected" >&5
-$as_echo "$as_me: FORK thread model detected" >&6;}
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: FORK thread model detected" >&5
+printf "%s\n" "$as_me: FORK thread model detected" >&6;}
 
-$as_echo "#define USE_FORK 1" >>confdefs.h
+printf "%s\n" "#define USE_FORK 1" >>confdefs.h
 
 
 fi
@@ -6007,20 +6529,21 @@
 fi
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: **************************************** compiler/linker flags" >&5
-$as_echo "$as_me: **************************************** compiler/linker flags" >&6;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: **************************************** compiler/linker flags" >&5
+printf "%s\n" "$as_me: **************************************** compiler/linker flags" >&6;}
 if test "$GCC" = yes; then
 
 
 
 
 for flag in -Wall; do
- as_CACHEVAR=`$as_echo "ax_cv_check_cflags__$flag" | $as_tr_sh`
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts $flag" >&5
-$as_echo_n "checking whether C compiler accepts $flag... " >&6; }
-if eval \${$as_CACHEVAR+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ as_CACHEVAR=`printf "%s\n" "ax_cv_check_cflags__$flag" | $as_tr_sh`
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts $flag" >&5
+printf %s "checking whether C compiler accepts $flag... " >&6; }
+if eval test \${$as_CACHEVAR+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 
 ax_check_save_flags=$CFLAGS
 CFLAGS="$CFLAGS $flag"
@@ -6028,58 +6551,61 @@
 /* end confdefs.h. */
 
 int
-main ()
+main (void)
 {
 
 ;
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
 eval "$as_CACHEVAR=yes"
-else
+else $as_nop
 eval "$as_CACHEVAR=no"
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 CFLAGS=$ax_check_save_flags
 fi
 eval ac_res=\$$as_CACHEVAR
-	 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
-if eval test \"x\$"$as_CACHEVAR"\" = x"yes"; then :
+	 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
+printf "%s\n" "$ac_res" >&6; }
+if eval test \"x\$"$as_CACHEVAR"\" = x"yes"
+then :
 
-if ${CFLAGS+:} false; then :
+if test ${CFLAGS+y}
+then :
 
 case " $CFLAGS " in #(
 *" $flag "*) :
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : CFLAGS already contains \$flag"; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CFLAGS already contains \$flag"; } >&5
 (: CFLAGS already contains $flag) 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; } ;; #(
 *) :
 
 as_fn_append CFLAGS " $flag"
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
 (: CFLAGS="$CFLAGS") 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }
 ;;
 esac
 
-else
+else $as_nop
 
 CFLAGS=$flag
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
 (: CFLAGS="$CFLAGS") 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }
 
 fi
 
-else
+else $as_nop
 :
 fi
 
@@ -6090,12 +6616,13 @@
 
 
 for flag in -Wextra; do
- as_CACHEVAR=`$as_echo "ax_cv_check_cflags__$flag" | $as_tr_sh`
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts $flag" >&5
-$as_echo_n "checking whether C compiler accepts $flag... " >&6; }
-if eval \${$as_CACHEVAR+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ as_CACHEVAR=`printf "%s\n" "ax_cv_check_cflags__$flag" | $as_tr_sh`
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts $flag" >&5
+printf %s "checking whether C compiler accepts $flag... " >&6; }
+if eval test \${$as_CACHEVAR+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 
 ax_check_save_flags=$CFLAGS
 CFLAGS="$CFLAGS $flag"
@@ -6103,58 +6630,61 @@
 /* end confdefs.h. */
 
 int
-main ()
+main (void)
 {
 
 ;
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
 eval "$as_CACHEVAR=yes"
-else
+else $as_nop
 eval "$as_CACHEVAR=no"
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 CFLAGS=$ax_check_save_flags
 fi
 eval ac_res=\$$as_CACHEVAR
-	 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
-if eval test \"x\$"$as_CACHEVAR"\" = x"yes"; then :
+	 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
+printf "%s\n" "$ac_res" >&6; }
+if eval test \"x\$"$as_CACHEVAR"\" = x"yes"
+then :
 
-if ${CFLAGS+:} false; then :
+if test ${CFLAGS+y}
+then :
 
 case " $CFLAGS " in #(
 *" $flag "*) :
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : CFLAGS already contains \$flag"; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CFLAGS already contains \$flag"; } >&5
 (: CFLAGS already contains $flag) 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; } ;; #(
 *) :
 
 as_fn_append CFLAGS " $flag"
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
 (: CFLAGS="$CFLAGS") 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }
 ;;
 esac
 
-else
+else $as_nop
 
 CFLAGS=$flag
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
 (: CFLAGS="$CFLAGS") 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }
 
 fi
 
-else
+else $as_nop
 :
 fi
 
@@ -6165,12 +6695,13 @@
 
 
 for flag in -Wpedantic; do
- as_CACHEVAR=`$as_echo "ax_cv_check_cflags__$flag" | $as_tr_sh`
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts $flag" >&5
-$as_echo_n "checking whether C compiler accepts $flag... " >&6; }
-if eval \${$as_CACHEVAR+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ as_CACHEVAR=`printf "%s\n" "ax_cv_check_cflags__$flag" | $as_tr_sh`
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts $flag" >&5
+printf %s "checking whether C compiler accepts $flag... " >&6; }
+if eval test \${$as_CACHEVAR+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 
 ax_check_save_flags=$CFLAGS
 CFLAGS="$CFLAGS $flag"
@@ -6178,58 +6709,61 @@
 /* end confdefs.h. */
 
 int
-main ()
+main (void)
 {
 
 ;
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
 eval "$as_CACHEVAR=yes"
-else
+else $as_nop
 eval "$as_CACHEVAR=no"
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 CFLAGS=$ax_check_save_flags
 fi
 eval ac_res=\$$as_CACHEVAR
-	 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
-if eval test \"x\$"$as_CACHEVAR"\" = x"yes"; then :
+	 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
+printf "%s\n" "$ac_res" >&6; }
+if eval test \"x\$"$as_CACHEVAR"\" = x"yes"
+then :
 
-if ${CFLAGS+:} false; then :
+if test ${CFLAGS+y}
+then :
 
 case " $CFLAGS " in #(
 *" $flag "*) :
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : CFLAGS already contains \$flag"; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CFLAGS already contains \$flag"; } >&5
 (: CFLAGS already contains $flag) 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; } ;; #(
 *) :
 
 as_fn_append CFLAGS " $flag"
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
 (: CFLAGS="$CFLAGS") 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }
 ;;
 esac
 
-else
+else $as_nop
 
 CFLAGS=$flag
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
 (: CFLAGS="$CFLAGS") 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }
 
 fi
 
-else
+else $as_nop
 :
 fi
 
@@ -6240,12 +6774,13 @@
 
 
 for flag in -Wformat=2; do
- as_CACHEVAR=`$as_echo "ax_cv_check_cflags__$flag" | $as_tr_sh`
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts $flag" >&5
-$as_echo_n "checking whether C compiler accepts $flag... " >&6; }
-if eval \${$as_CACHEVAR+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ as_CACHEVAR=`printf "%s\n" "ax_cv_check_cflags__$flag" | $as_tr_sh`
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts $flag" >&5
+printf %s "checking whether C compiler accepts $flag... " >&6; }
+if eval test \${$as_CACHEVAR+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 
 ax_check_save_flags=$CFLAGS
 CFLAGS="$CFLAGS $flag"
@@ -6253,58 +6788,61 @@
 /* end confdefs.h. */
 
 int
-main ()
+main (void)
 {
 
 ;
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
 eval "$as_CACHEVAR=yes"
-else
+else $as_nop
 eval "$as_CACHEVAR=no"
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 CFLAGS=$ax_check_save_flags
 fi
 eval ac_res=\$$as_CACHEVAR
-	 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
-if eval test \"x\$"$as_CACHEVAR"\" = x"yes"; then :
+	 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
+printf "%s\n" "$ac_res" >&6; }
+if eval test \"x\$"$as_CACHEVAR"\" = x"yes"
+then :
 
-if ${CFLAGS+:} false; then :
+if test ${CFLAGS+y}
+then :
 
 case " $CFLAGS " in #(
 *" $flag "*) :
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : CFLAGS already contains \$flag"; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CFLAGS already contains \$flag"; } >&5
 (: CFLAGS already contains $flag) 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; } ;; #(
 *) :
 
 as_fn_append CFLAGS " $flag"
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
 (: CFLAGS="$CFLAGS") 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }
 ;;
 esac
 
-else
+else $as_nop
 
 CFLAGS=$flag
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
 (: CFLAGS="$CFLAGS") 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }
 
 fi
 
-else
+else $as_nop
 :
 fi
 
@@ -6315,12 +6853,13 @@
 
 
 for flag in -Wconversion; do
- as_CACHEVAR=`$as_echo "ax_cv_check_cflags__$flag" | $as_tr_sh`
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts $flag" >&5
-$as_echo_n "checking whether C compiler accepts $flag... " >&6; }
-if eval \${$as_CACHEVAR+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ as_CACHEVAR=`printf "%s\n" "ax_cv_check_cflags__$flag" | $as_tr_sh`
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts $flag" >&5
+printf %s "checking whether C compiler accepts $flag... " >&6; }
+if eval test \${$as_CACHEVAR+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 
 ax_check_save_flags=$CFLAGS
 CFLAGS="$CFLAGS $flag"
@@ -6328,58 +6867,61 @@
 /* end confdefs.h. */
 
 int
-main ()
+main (void)
 {
 
 ;
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
 eval "$as_CACHEVAR=yes"
-else
+else $as_nop
 eval "$as_CACHEVAR=no"
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 CFLAGS=$ax_check_save_flags
 fi
 eval ac_res=\$$as_CACHEVAR
-	 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
-if eval test \"x\$"$as_CACHEVAR"\" = x"yes"; then :
+	 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
+printf "%s\n" "$ac_res" >&6; }
+if eval test \"x\$"$as_CACHEVAR"\" = x"yes"
+then :
 
-if ${CFLAGS+:} false; then :
+if test ${CFLAGS+y}
+then :
 
 case " $CFLAGS " in #(
 *" $flag "*) :
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : CFLAGS already contains \$flag"; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CFLAGS already contains \$flag"; } >&5
 (: CFLAGS already contains $flag) 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; } ;; #(
 *) :
 
 as_fn_append CFLAGS " $flag"
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
 (: CFLAGS="$CFLAGS") 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }
 ;;
 esac
 
-else
+else $as_nop
 
 CFLAGS=$flag
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
 (: CFLAGS="$CFLAGS") 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }
 
 fi
 
-else
+else $as_nop
 :
 fi
 
@@ -6390,12 +6932,13 @@
 
 
 for flag in -Wno-long-long; do
- as_CACHEVAR=`$as_echo "ax_cv_check_cflags__$flag" | $as_tr_sh`
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts $flag" >&5
-$as_echo_n "checking whether C compiler accepts $flag... " >&6; }
-if eval \${$as_CACHEVAR+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ as_CACHEVAR=`printf "%s\n" "ax_cv_check_cflags__$flag" | $as_tr_sh`
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts $flag" >&5
+printf %s "checking whether C compiler accepts $flag... " >&6; }
+if eval test \${$as_CACHEVAR+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 
 ax_check_save_flags=$CFLAGS
 CFLAGS="$CFLAGS $flag"
@@ -6403,58 +6946,61 @@
 /* end confdefs.h. */
 
 int
-main ()
+main (void)
 {
 
 ;
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
 eval "$as_CACHEVAR=yes"
-else
+else $as_nop
 eval "$as_CACHEVAR=no"
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 CFLAGS=$ax_check_save_flags
 fi
 eval ac_res=\$$as_CACHEVAR
-	 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
-if eval test \"x\$"$as_CACHEVAR"\" = x"yes"; then :
+	 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
+printf "%s\n" "$ac_res" >&6; }
+if eval test \"x\$"$as_CACHEVAR"\" = x"yes"
+then :
 
-if ${CFLAGS+:} false; then :
+if test ${CFLAGS+y}
+then :
 
 case " $CFLAGS " in #(
 *" $flag "*) :
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : CFLAGS already contains \$flag"; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CFLAGS already contains \$flag"; } >&5
 (: CFLAGS already contains $flag) 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; } ;; #(
 *) :
 
 as_fn_append CFLAGS " $flag"
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
 (: CFLAGS="$CFLAGS") 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }
 ;;
 esac
 
-else
+else $as_nop
 
 CFLAGS=$flag
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
 (: CFLAGS="$CFLAGS") 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }
 
 fi
 
-else
+else $as_nop
 :
 fi
 
@@ -6465,12 +7011,13 @@
 
 
 for flag in -Wno-deprecated-declarations; do
- as_CACHEVAR=`$as_echo "ax_cv_check_cflags__$flag" | $as_tr_sh`
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts $flag" >&5
-$as_echo_n "checking whether C compiler accepts $flag... " >&6; }
-if eval \${$as_CACHEVAR+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ as_CACHEVAR=`printf "%s\n" "ax_cv_check_cflags__$flag" | $as_tr_sh`
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts $flag" >&5
+printf %s "checking whether C compiler accepts $flag... " >&6; }
+if eval test \${$as_CACHEVAR+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 
 ax_check_save_flags=$CFLAGS
 CFLAGS="$CFLAGS $flag"
@@ -6478,58 +7025,61 @@
 /* end confdefs.h. */
 
 int
-main ()
+main (void)
 {
 
 ;
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
 eval "$as_CACHEVAR=yes"
-else
+else $as_nop
 eval "$as_CACHEVAR=no"
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 CFLAGS=$ax_check_save_flags
 fi
 eval ac_res=\$$as_CACHEVAR
-	 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
-if eval test \"x\$"$as_CACHEVAR"\" = x"yes"; then :
+	 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
+printf "%s\n" "$ac_res" >&6; }
+if eval test \"x\$"$as_CACHEVAR"\" = x"yes"
+then :
 
-if ${CFLAGS+:} false; then :
+if test ${CFLAGS+y}
+then :
 
 case " $CFLAGS " in #(
 *" $flag "*) :
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : CFLAGS already contains \$flag"; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CFLAGS already contains \$flag"; } >&5
 (: CFLAGS already contains $flag) 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; } ;; #(
 *) :
 
 as_fn_append CFLAGS " $flag"
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
 (: CFLAGS="$CFLAGS") 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }
 ;;
 esac
 
-else
+else $as_nop
 
 CFLAGS=$flag
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
 (: CFLAGS="$CFLAGS") 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }
 
 fi
 
-else
+else $as_nop
 :
 fi
 
@@ -6540,12 +7090,13 @@
 
 
 for flag in -fPIE; do
- as_CACHEVAR=`$as_echo "ax_cv_check_cflags__$flag" | $as_tr_sh`
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts $flag" >&5
-$as_echo_n "checking whether C compiler accepts $flag... " >&6; }
-if eval \${$as_CACHEVAR+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ as_CACHEVAR=`printf "%s\n" "ax_cv_check_cflags__$flag" | $as_tr_sh`
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts $flag" >&5
+printf %s "checking whether C compiler accepts $flag... " >&6; }
+if eval test \${$as_CACHEVAR+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 
 ax_check_save_flags=$CFLAGS
 CFLAGS="$CFLAGS $flag"
@@ -6553,58 +7104,61 @@
 /* end confdefs.h. */
 
 int
-main ()
+main (void)
 {
 
 ;
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
 eval "$as_CACHEVAR=yes"
-else
+else $as_nop
 eval "$as_CACHEVAR=no"
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 CFLAGS=$ax_check_save_flags
 fi
 eval ac_res=\$$as_CACHEVAR
-	 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
-if eval test \"x\$"$as_CACHEVAR"\" = x"yes"; then :
+	 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
+printf "%s\n" "$ac_res" >&6; }
+if eval test \"x\$"$as_CACHEVAR"\" = x"yes"
+then :
 
-if ${CFLAGS+:} false; then :
+if test ${CFLAGS+y}
+then :
 
 case " $CFLAGS " in #(
 *" $flag "*) :
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : CFLAGS already contains \$flag"; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CFLAGS already contains \$flag"; } >&5
 (: CFLAGS already contains $flag) 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; } ;; #(
 *) :
 
 as_fn_append CFLAGS " $flag"
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
 (: CFLAGS="$CFLAGS") 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }
 ;;
 esac
 
-else
+else $as_nop
 
 CFLAGS=$flag
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
 (: CFLAGS="$CFLAGS") 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }
 
 fi
 
-else
+else $as_nop
 :
 fi
 
@@ -6619,12 +7173,13 @@
 
 
 for flag in -fstack-protector; do
- as_CACHEVAR=`$as_echo "ax_cv_check_cflags__$flag" | $as_tr_sh`
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts $flag" >&5
-$as_echo_n "checking whether C compiler accepts $flag... " >&6; }
-if eval \${$as_CACHEVAR+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ as_CACHEVAR=`printf "%s\n" "ax_cv_check_cflags__$flag" | $as_tr_sh`
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts $flag" >&5
+printf %s "checking whether C compiler accepts $flag... " >&6; }
+if eval test \${$as_CACHEVAR+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 
 ax_check_save_flags=$CFLAGS
 CFLAGS="$CFLAGS $flag"
@@ -6632,58 +7187,61 @@
 /* end confdefs.h. */
 
 int
-main ()
+main (void)
 {
 
 ;
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
 eval "$as_CACHEVAR=yes"
-else
+else $as_nop
 eval "$as_CACHEVAR=no"
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 CFLAGS=$ax_check_save_flags
 fi
 eval ac_res=\$$as_CACHEVAR
-	 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
-if eval test \"x\$"$as_CACHEVAR"\" = x"yes"; then :
+	 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
+printf "%s\n" "$ac_res" >&6; }
+if eval test \"x\$"$as_CACHEVAR"\" = x"yes"
+then :
 
-if ${CFLAGS+:} false; then :
+if test ${CFLAGS+y}
+then :
 
 case " $CFLAGS " in #(
 *" $flag "*) :
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : CFLAGS already contains \$flag"; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CFLAGS already contains \$flag"; } >&5
 (: CFLAGS already contains $flag) 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; } ;; #(
 *) :
 
 as_fn_append CFLAGS " $flag"
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
 (: CFLAGS="$CFLAGS") 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }
 ;;
 esac
 
-else
+else $as_nop
 
 CFLAGS=$flag
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
 (: CFLAGS="$CFLAGS") 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }
 
 fi
 
-else
+else $as_nop
 :
 fi
 
@@ -6696,12 +7254,13 @@
 
 
 for flag in -fPIE -pie; do
- as_CACHEVAR=`$as_echo "ax_cv_check_ldflags__$flag" | $as_tr_sh`
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the linker accepts $flag" >&5
-$as_echo_n "checking whether the linker accepts $flag... " >&6; }
-if eval \${$as_CACHEVAR+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ as_CACHEVAR=`printf "%s\n" "ax_cv_check_ldflags__$flag" | $as_tr_sh`
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the linker accepts $flag" >&5
+printf %s "checking whether the linker accepts $flag... " >&6; }
+if eval test \${$as_CACHEVAR+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 
 ax_check_save_flags=$LDFLAGS
 LDFLAGS="$LDFLAGS $flag"
@@ -6709,59 +7268,62 @@
 /* end confdefs.h. */
 
 int
-main ()
+main (void)
 {
 
 ;
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
 eval "$as_CACHEVAR=yes"
-else
+else $as_nop
 eval "$as_CACHEVAR=no"
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
 conftest$ac_exeext conftest.$ac_ext
 LDFLAGS=$ax_check_save_flags
 fi
 eval ac_res=\$$as_CACHEVAR
-	 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
-if eval test \"x\$"$as_CACHEVAR"\" = x"yes"; then :
+	 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
+printf "%s\n" "$ac_res" >&6; }
+if eval test \"x\$"$as_CACHEVAR"\" = x"yes"
+then :
 
-if ${LDFLAGS+:} false; then :
+if test ${LDFLAGS+y}
+then :
 
 case " $LDFLAGS " in #(
 *" $flag "*) :
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : LDFLAGS already contains \$flag"; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : LDFLAGS already contains \$flag"; } >&5
 (: LDFLAGS already contains $flag) 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; } ;; #(
 *) :
 
 as_fn_append LDFLAGS " $flag"
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : LDFLAGS=\"\$LDFLAGS\""; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : LDFLAGS=\"\$LDFLAGS\""; } >&5
 (: LDFLAGS="$LDFLAGS") 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }
 ;;
 esac
 
-else
+else $as_nop
 
 LDFLAGS=$flag
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : LDFLAGS=\"\$LDFLAGS\""; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : LDFLAGS=\"\$LDFLAGS\""; } >&5
 (: LDFLAGS="$LDFLAGS") 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }
 
 fi
 
-else
+else $as_nop
 :
 fi
 
@@ -6772,12 +7334,13 @@
 
 
 for flag in -Wl,-z,relro; do
- as_CACHEVAR=`$as_echo "ax_cv_check_ldflags__$flag" | $as_tr_sh`
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the linker accepts $flag" >&5
-$as_echo_n "checking whether the linker accepts $flag... " >&6; }
-if eval \${$as_CACHEVAR+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ as_CACHEVAR=`printf "%s\n" "ax_cv_check_ldflags__$flag" | $as_tr_sh`
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the linker accepts $flag" >&5
+printf %s "checking whether the linker accepts $flag... " >&6; }
+if eval test \${$as_CACHEVAR+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 
 ax_check_save_flags=$LDFLAGS
 LDFLAGS="$LDFLAGS $flag"
@@ -6785,59 +7348,62 @@
 /* end confdefs.h. */
 
 int
-main ()
+main (void)
 {
 
 ;
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
 eval "$as_CACHEVAR=yes"
-else
+else $as_nop
 eval "$as_CACHEVAR=no"
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
 conftest$ac_exeext conftest.$ac_ext
 LDFLAGS=$ax_check_save_flags
 fi
 eval ac_res=\$$as_CACHEVAR
-	 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
-if eval test \"x\$"$as_CACHEVAR"\" = x"yes"; then :
+	 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
+printf "%s\n" "$ac_res" >&6; }
+if eval test \"x\$"$as_CACHEVAR"\" = x"yes"
+then :
 
-if ${LDFLAGS+:} false; then :
+if test ${LDFLAGS+y}
+then :
 
 case " $LDFLAGS " in #(
 *" $flag "*) :
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : LDFLAGS already contains \$flag"; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : LDFLAGS already contains \$flag"; } >&5
 (: LDFLAGS already contains $flag) 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; } ;; #(
 *) :
 
 as_fn_append LDFLAGS " $flag"
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : LDFLAGS=\"\$LDFLAGS\""; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : LDFLAGS=\"\$LDFLAGS\""; } >&5
 (: LDFLAGS="$LDFLAGS") 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }
 ;;
 esac
 
-else
+else $as_nop
 
 LDFLAGS=$flag
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : LDFLAGS=\"\$LDFLAGS\""; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : LDFLAGS=\"\$LDFLAGS\""; } >&5
 (: LDFLAGS="$LDFLAGS") 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }
 
 fi
 
-else
+else $as_nop
 :
 fi
 
@@ -6848,12 +7414,13 @@
 
 
 for flag in -Wl,-z,now; do
- as_CACHEVAR=`$as_echo "ax_cv_check_ldflags__$flag" | $as_tr_sh`
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the linker accepts $flag" >&5
-$as_echo_n "checking whether the linker accepts $flag... " >&6; }
-if eval \${$as_CACHEVAR+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ as_CACHEVAR=`printf "%s\n" "ax_cv_check_ldflags__$flag" | $as_tr_sh`
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the linker accepts $flag" >&5
+printf %s "checking whether the linker accepts $flag... " >&6; }
+if eval test \${$as_CACHEVAR+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 
 ax_check_save_flags=$LDFLAGS
 LDFLAGS="$LDFLAGS $flag"
@@ -6861,59 +7428,62 @@
 /* end confdefs.h. */
 
 int
-main ()
+main (void)
 {
 
 ;
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
 eval "$as_CACHEVAR=yes"
-else
+else $as_nop
 eval "$as_CACHEVAR=no"
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
 conftest$ac_exeext conftest.$ac_ext
 LDFLAGS=$ax_check_save_flags
 fi
 eval ac_res=\$$as_CACHEVAR
-	 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
-if eval test \"x\$"$as_CACHEVAR"\" = x"yes"; then :
+	 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
+printf "%s\n" "$ac_res" >&6; }
+if eval test \"x\$"$as_CACHEVAR"\" = x"yes"
+then :
 
-if ${LDFLAGS+:} false; then :
+if test ${LDFLAGS+y}
+then :
 
 case " $LDFLAGS " in #(
 *" $flag "*) :
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : LDFLAGS already contains \$flag"; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : LDFLAGS already contains \$flag"; } >&5
 (: LDFLAGS already contains $flag) 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; } ;; #(
 *) :
 
 as_fn_append LDFLAGS " $flag"
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : LDFLAGS=\"\$LDFLAGS\""; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : LDFLAGS=\"\$LDFLAGS\""; } >&5
 (: LDFLAGS="$LDFLAGS") 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }
 ;;
 esac
 
-else
+else $as_nop
 
 LDFLAGS=$flag
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : LDFLAGS=\"\$LDFLAGS\""; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : LDFLAGS=\"\$LDFLAGS\""; } >&5
 (: LDFLAGS="$LDFLAGS") 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }
 
 fi
 
-else
+else $as_nop
 :
 fi
 
@@ -6924,12 +7494,13 @@
 
 
 for flag in -Wl,-z,noexecstack; do
- as_CACHEVAR=`$as_echo "ax_cv_check_ldflags__$flag" | $as_tr_sh`
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the linker accepts $flag" >&5
-$as_echo_n "checking whether the linker accepts $flag... " >&6; }
-if eval \${$as_CACHEVAR+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ as_CACHEVAR=`printf "%s\n" "ax_cv_check_ldflags__$flag" | $as_tr_sh`
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the linker accepts $flag" >&5
+printf %s "checking whether the linker accepts $flag... " >&6; }
+if eval test \${$as_CACHEVAR+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 
 ax_check_save_flags=$LDFLAGS
 LDFLAGS="$LDFLAGS $flag"
@@ -6937,59 +7508,62 @@
 /* end confdefs.h. */
 
 int
-main ()
+main (void)
 {
 
 ;
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
 eval "$as_CACHEVAR=yes"
-else
+else $as_nop
 eval "$as_CACHEVAR=no"
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
 conftest$ac_exeext conftest.$ac_ext
 LDFLAGS=$ax_check_save_flags
 fi
 eval ac_res=\$$as_CACHEVAR
-	 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
-if eval test \"x\$"$as_CACHEVAR"\" = x"yes"; then :
+	 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
+printf "%s\n" "$ac_res" >&6; }
+if eval test \"x\$"$as_CACHEVAR"\" = x"yes"
+then :
 
-if ${LDFLAGS+:} false; then :
+if test ${LDFLAGS+y}
+then :
 
 case " $LDFLAGS " in #(
 *" $flag "*) :
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : LDFLAGS already contains \$flag"; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : LDFLAGS already contains \$flag"; } >&5
 (: LDFLAGS already contains $flag) 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; } ;; #(
 *) :
 
 as_fn_append LDFLAGS " $flag"
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : LDFLAGS=\"\$LDFLAGS\""; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : LDFLAGS=\"\$LDFLAGS\""; } >&5
 (: LDFLAGS="$LDFLAGS") 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }
 ;;
 esac
 
-else
+else $as_nop
 
 LDFLAGS=$flag
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : LDFLAGS=\"\$LDFLAGS\""; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : LDFLAGS=\"\$LDFLAGS\""; } >&5
 (: LDFLAGS="$LDFLAGS") 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }
 
 fi
 
-else
+else $as_nop
 :
 fi
 
@@ -7001,12 +7575,13 @@
 
 
 for flag in -D_FORTIFY_SOURCE=2; do
- as_CACHEVAR=`$as_echo "ax_cv_check_cflags__$flag" | $as_tr_sh`
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts $flag" >&5
-$as_echo_n "checking whether C compiler accepts $flag... " >&6; }
-if eval \${$as_CACHEVAR+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ as_CACHEVAR=`printf "%s\n" "ax_cv_check_cflags__$flag" | $as_tr_sh`
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts $flag" >&5
+printf %s "checking whether C compiler accepts $flag... " >&6; }
+if eval test \${$as_CACHEVAR+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 
 ax_check_save_flags=$CFLAGS
 CFLAGS="$CFLAGS $flag"
@@ -7014,70 +7589,73 @@
 /* end confdefs.h. */
 
 int
-main ()
+main (void)
 {
 
 ;
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
 eval "$as_CACHEVAR=yes"
-else
+else $as_nop
 eval "$as_CACHEVAR=no"
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 CFLAGS=$ax_check_save_flags
 fi
 eval ac_res=\$$as_CACHEVAR
-	 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
-if eval test \"x\$"$as_CACHEVAR"\" = x"yes"; then :
+	 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
+printf "%s\n" "$ac_res" >&6; }
+if eval test \"x\$"$as_CACHEVAR"\" = x"yes"
+then :
 
-if ${CFLAGS+:} false; then :
+if test ${CFLAGS+y}
+then :
 
 case " $CFLAGS " in #(
 *" $flag "*) :
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : CFLAGS already contains \$flag"; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CFLAGS already contains \$flag"; } >&5
 (: CFLAGS already contains $flag) 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; } ;; #(
 *) :
 
 as_fn_append CFLAGS " $flag"
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
 (: CFLAGS="$CFLAGS") 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }
 ;;
 esac
 
-else
+else $as_nop
 
 CFLAGS=$flag
- { { $as_echo "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: : CFLAGS=\"\$CFLAGS\""; } >&5
 (: CFLAGS="$CFLAGS") 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }
 
 fi
 
-else
+else $as_nop
 :
 fi
 
 done
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: **************************************** libtool" >&5
-$as_echo "$as_me: **************************************** libtool" >&6;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: **************************************** libtool" >&5
+printf "%s\n" "$as_me: **************************************** libtool" >&6;}
 case `pwd` in
 *\ * | *\	*)
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: Libtool does not cope well with whitespace in \`pwd\`" >&5
-$as_echo "$as_me: WARNING: Libtool does not cope well with whitespace in \`pwd\`" >&2;} ;;
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: Libtool does not cope well with whitespace in \`pwd\`" >&5
+printf "%s\n" "$as_me: WARNING: Libtool does not cope well with whitespace in \`pwd\`" >&2;} ;;
 esac
 
 
@@ -7097,6 +7675,7 @@
 
 
 
+
 ltmain=$ac_aux_dir/ltmain.sh
 
 # Backslashify metacharacters that are still active within
@@ -7120,8 +7699,8 @@
 ECHO=$ECHO$ECHO$ECHO$ECHO$ECHO
 ECHO=$ECHO$ECHO$ECHO$ECHO$ECHO$ECHO
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking how to print strings" >&5
-$as_echo_n "checking how to print strings... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking how to print strings" >&5
+printf %s "checking how to print strings... " >&6; }
 # Test print first, because it will be a builtin if present.
 if test "X`( print -r -- -n ) 2>/dev/null`" = X-n && \
 test "X`print -r -- $ECHO 2>/dev/null`" = "X$ECHO"; then
@@ -7147,12 +7726,12 @@
 }
 
 case $ECHO in
- printf*) { $as_echo "$as_me:${as_lineno-$LINENO}: result: printf" >&5
-$as_echo "printf" >&6; } ;;
- print*) { $as_echo "$as_me:${as_lineno-$LINENO}: result: print -r" >&5
-$as_echo "print -r" >&6; } ;;
- *) { $as_echo "$as_me:${as_lineno-$LINENO}: result: cat" >&5
-$as_echo "cat" >&6; } ;;
+ printf*) { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: printf" >&5
+printf "%s\n" "printf" >&6; } ;;
+ print*) { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: print -r" >&5
+printf "%s\n" "print -r" >&6; } ;;
+ *) { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: cat" >&5
+printf "%s\n" "cat" >&6; } ;;
 esac
 
 
@@ -7168,11 +7747,12 @@
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for a sed that does not truncate output" >&5
-$as_echo_n "checking for a sed that does not truncate output... " >&6; }
-if ${ac_cv_path_SED+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for a sed that does not truncate output" >&5
+printf %s "checking for a sed that does not truncate output... " >&6; }
+if test ${ac_cv_path_SED+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 ac_script=s/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb/
 for ac_i in 1 2 3 4 5 6 7; do
 ac_script="$ac_script$as_nl$ac_script"
@@ -7186,10 +7766,15 @@
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
- for ac_prog in sed gsed; do
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
+ for ac_prog in sed gsed
+ do
 for ac_exec_ext in '' $ac_executable_extensions; do
- ac_path_SED="$as_dir/$ac_prog$ac_exec_ext"
+ ac_path_SED="$as_dir$ac_prog$ac_exec_ext"
 as_fn_executable_p "$ac_path_SED" || continue
 # Check for GNU ac_path_SED and select it if it is found.
 # Check for GNU $ac_path_SED
@@ -7198,13 +7783,13 @@
 ac_cv_path_SED="$ac_path_SED" ac_path_SED_found=:;;
 *)
 ac_count=0
- $as_echo_n 0123456789 >"conftest.in"
+ printf %s 0123456789 >"conftest.in"
 while :
 do
 cat "conftest.in" "conftest.in" >"conftest.tmp"
 mv "conftest.tmp" "conftest.in"
 cp "conftest.in" "conftest.nl"
- $as_echo '' >> "conftest.nl"
+ printf "%s\n" '' >> "conftest.nl"
 "$ac_path_SED" -f conftest.sed < "conftest.nl" >"conftest.out" 2>/dev/null || break
 diff "conftest.out" "conftest.nl" >/dev/null 2>&1 || break
 as_fn_arith $ac_count + 1 && ac_count=$as_val
@@ -7232,8 +7817,8 @@
 fi
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_SED" >&5
-$as_echo "$ac_cv_path_SED" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_SED" >&5
+printf "%s\n" "$ac_cv_path_SED" >&6; }
 SED="$ac_cv_path_SED"
 rm -f conftest.sed
 
@@ -7250,11 +7835,12 @@
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for fgrep" >&5
-$as_echo_n "checking for fgrep... " >&6; }
-if ${ac_cv_path_FGREP+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for fgrep" >&5
+printf %s "checking for fgrep... " >&6; }
+if test ${ac_cv_path_FGREP+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if echo 'ab*c' | $GREP -F 'ab*c' >/dev/null 2>&1
 then ac_cv_path_FGREP="$GREP -F"
 else
@@ -7265,10 +7851,15 @@
 for as_dir in $PATH$PATH_SEPARATOR/usr/xpg4/bin
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
- for ac_prog in fgrep; do
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
+ for ac_prog in fgrep
+ do
 for ac_exec_ext in '' $ac_executable_extensions; do
- ac_path_FGREP="$as_dir/$ac_prog$ac_exec_ext"
+ ac_path_FGREP="$as_dir$ac_prog$ac_exec_ext"
 as_fn_executable_p "$ac_path_FGREP" || continue
 # Check for GNU ac_path_FGREP and select it if it is found.
 # Check for GNU $ac_path_FGREP
@@ -7277,13 +7868,13 @@
 ac_cv_path_FGREP="$ac_path_FGREP" ac_path_FGREP_found=:;;
 *)
 ac_count=0
- $as_echo_n 0123456789 >"conftest.in"
+ printf %s 0123456789 >"conftest.in"
 while :
 do
 cat "conftest.in" "conftest.in" >"conftest.tmp"
 mv "conftest.tmp" "conftest.in"
 cp "conftest.in" "conftest.nl"
- $as_echo 'FGREP' >> "conftest.nl"
+ printf "%s\n" 'FGREP' >> "conftest.nl"
 "$ac_path_FGREP" FGREP < "conftest.nl" >"conftest.out" 2>/dev/null || break
 diff "conftest.out" "conftest.nl" >/dev/null 2>&1 || break
 as_fn_arith $ac_count + 1 && ac_count=$as_val
@@ -7312,8 +7903,8 @@
 
 fi
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_FGREP" >&5
-$as_echo "$ac_cv_path_FGREP" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_FGREP" >&5
+printf "%s\n" "$ac_cv_path_FGREP" >&6; }
 FGREP="$ac_cv_path_FGREP"
 
 
@@ -7338,17 +7929,18 @@
 
 
 # Check whether --with-gnu-ld was given.
-if test "${with_gnu_ld+set}" = set; then :
+if test ${with_gnu_ld+y}
+then :
 withval=$with_gnu_ld; test no = "$withval" || with_gnu_ld=yes
-else
+else $as_nop
 with_gnu_ld=no
 fi
 
 ac_prog=ld
 if test yes = "$GCC"; then
 # Check if gcc -print-prog-name=ld gives a path.
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for ld used by $CC" >&5
-$as_echo_n "checking for ld used by $CC... " >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for ld used by $CC" >&5
+printf %s "checking for ld used by $CC... " >&6; }
 case $host in
 *-*-mingw*)
 # gcc leaves a trailing carriage return, which upsets mingw
@@ -7377,15 +7969,16 @@
 ;;
 esac
 elif test yes = "$with_gnu_ld"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for GNU ld" >&5
-$as_echo_n "checking for GNU ld... " >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for GNU ld" >&5
+printf %s "checking for GNU ld... " >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for non-GNU ld" >&5
-$as_echo_n "checking for non-GNU ld... " >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for non-GNU ld" >&5
+printf %s "checking for non-GNU ld... " >&6; }
 fi
-if ${lt_cv_path_LD+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+if test ${lt_cv_path_LD+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if test -z "$LD"; then
 lt_save_ifs=$IFS; IFS=$PATH_SEPARATOR
 for ac_dir in $PATH; do
@@ -7414,18 +8007,19 @@
 
 LD=$lt_cv_path_LD
 if test -n "$LD"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $LD" >&5
-$as_echo "$LD" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $LD" >&5
+printf "%s\n" "$LD" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 test -z "$LD" && as_fn_error $? "no acceptable ld found in \$PATH" "$LINENO" 5
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if the linker ($LD) is GNU ld" >&5
-$as_echo_n "checking if the linker ($LD) is GNU ld... " >&6; }
-if ${lt_cv_prog_gnu_ld+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking if the linker ($LD) is GNU ld" >&5
+printf %s "checking if the linker ($LD) is GNU ld... " >&6; }
+if test ${lt_cv_prog_gnu_ld+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 # I'd rather use --version here, but apparently some GNU lds only accept -v.
 case `$LD -v 2>&1 </dev/null` in
 *GNU* | *'with BFD'*)
@@ -7436,8 +8030,8 @@
 ;;
 esac
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_gnu_ld" >&5
-$as_echo "$lt_cv_prog_gnu_ld" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_gnu_ld" >&5
+printf "%s\n" "$lt_cv_prog_gnu_ld" >&6; }
 with_gnu_ld=$lt_cv_prog_gnu_ld
 
 
@@ -7448,11 +8042,12 @@
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for BSD- or MS-compatible name lister (nm)" >&5
-$as_echo_n "checking for BSD- or MS-compatible name lister (nm)... " >&6; }
-if ${lt_cv_path_NM+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for BSD- or MS-compatible name lister (nm)" >&5
+printf %s "checking for BSD- or MS-compatible name lister (nm)... " >&6; }
+if test ${lt_cv_path_NM+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if test -n "$NM"; then
 # Let the user override the test.
 lt_cv_path_NM=$NM
@@ -7502,8 +8097,8 @@
 : ${lt_cv_path_NM=no}
 fi
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_path_NM" >&5
-$as_echo "$lt_cv_path_NM" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_path_NM" >&5
+printf "%s\n" "$lt_cv_path_NM" >&6; }
 if test no != "$lt_cv_path_NM"; then
 NM=$lt_cv_path_NM
 else
@@ -7516,11 +8111,12 @@
 do
 # Extract the first word of "$ac_tool_prefix$ac_prog", so it can be a program name with args.
 set dummy $ac_tool_prefix$ac_prog; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_DUMPBIN+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_DUMPBIN+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if test -n "$DUMPBIN"; then
 ac_cv_prog_DUMPBIN="$DUMPBIN" # Let the user override the test.
 else
@@ -7528,11 +8124,15 @@
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
 for ac_exec_ext in '' $ac_executable_extensions; do
- if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+ if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
 ac_cv_prog_DUMPBIN="$ac_tool_prefix$ac_prog"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
 break 2
 fi
 done
@@ -7543,11 +8143,11 @@
 fi
 DUMPBIN=$ac_cv_prog_DUMPBIN
 if test -n "$DUMPBIN"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $DUMPBIN" >&5
-$as_echo "$DUMPBIN" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $DUMPBIN" >&5
+printf "%s\n" "$DUMPBIN" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -7560,11 +8160,12 @@
 do
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_ac_ct_DUMPBIN+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_ac_ct_DUMPBIN+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if test -n "$ac_ct_DUMPBIN"; then
 ac_cv_prog_ac_ct_DUMPBIN="$ac_ct_DUMPBIN" # Let the user override the test.
 else
@@ -7572,11 +8173,15 @@
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
 for ac_exec_ext in '' $ac_executable_extensions; do
- if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+ if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
 ac_cv_prog_ac_ct_DUMPBIN="$ac_prog"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
 break 2
 fi
 done
@@ -7587,11 +8192,11 @@
 fi
 ac_ct_DUMPBIN=$ac_cv_prog_ac_ct_DUMPBIN
 if test -n "$ac_ct_DUMPBIN"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_DUMPBIN" >&5
-$as_echo "$ac_ct_DUMPBIN" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_ct_DUMPBIN" >&5
+printf "%s\n" "$ac_ct_DUMPBIN" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -7603,8 +8208,8 @@
 else
 case $cross_compiling:$ac_tool_warned in
 yes:)
-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
-$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
+printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
 ac_tool_warned=yes ;;
 esac
 DUMPBIN=$ac_ct_DUMPBIN
@@ -7632,11 +8237,12 @@
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking the name lister ($NM) interface" >&5
-$as_echo_n "checking the name lister ($NM) interface... " >&6; }
-if ${lt_cv_nm_interface+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking the name lister ($NM) interface" >&5
+printf %s "checking the name lister ($NM) interface... " >&6; }
+if test ${lt_cv_nm_interface+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 lt_cv_nm_interface="BSD nm"
 echo "int some_variable = 0;" > conftest.$ac_ext
 (eval echo "\"\$as_me:$LINENO: $ac_compile\"" >&5)
@@ -7652,26 +8258,27 @@
 fi
 rm -f conftest*
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_nm_interface" >&5
-$as_echo "$lt_cv_nm_interface" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_nm_interface" >&5
+printf "%s\n" "$lt_cv_nm_interface" >&6; }
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether ln -s works" >&5
-$as_echo_n "checking whether ln -s works... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether ln -s works" >&5
+printf %s "checking whether ln -s works... " >&6; }
 LN_S=$as_ln_s
 if test "$LN_S" = "ln -s"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no, using $LN_S" >&5
-$as_echo "no, using $LN_S" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no, using $LN_S" >&5
+printf "%s\n" "no, using $LN_S" >&6; }
 fi
 
 # find the maximum length of command line arguments
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking the maximum length of command line arguments" >&5
-$as_echo_n "checking the maximum length of command line arguments... " >&6; }
-if ${lt_cv_sys_max_cmd_len+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking the maximum length of command line arguments" >&5
+printf %s "checking the maximum length of command line arguments... " >&6; }
+if test ${lt_cv_sys_max_cmd_len+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 i=0
 teststring=ABCD
 
@@ -7798,11 +8405,11 @@
 fi
 
 if test -n "$lt_cv_sys_max_cmd_len"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_sys_max_cmd_len" >&5
-$as_echo "$lt_cv_sys_max_cmd_len" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_sys_max_cmd_len" >&5
+printf "%s\n" "$lt_cv_sys_max_cmd_len" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: none" >&5
-$as_echo "none" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: none" >&5
+printf "%s\n" "none" >&6; }
 fi
 max_cmd_len=$lt_cv_sys_max_cmd_len
 
@@ -7846,11 +8453,12 @@
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking how to convert $build file names to $host format" >&5
-$as_echo_n "checking how to convert $build file names to $host format... " >&6; }
-if ${lt_cv_to_host_file_cmd+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking how to convert $build file names to $host format" >&5
+printf %s "checking how to convert $build file names to $host format... " >&6; }
+if test ${lt_cv_to_host_file_cmd+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 case $host in
 *-*-mingw* )
 case $build in
@@ -7886,18 +8494,19 @@
 fi
 
 to_host_file_cmd=$lt_cv_to_host_file_cmd
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_to_host_file_cmd" >&5
-$as_echo "$lt_cv_to_host_file_cmd" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_to_host_file_cmd" >&5
+printf "%s\n" "$lt_cv_to_host_file_cmd" >&6; }
 
 
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking how to convert $build file names to toolchain format" >&5
-$as_echo_n "checking how to convert $build file names to toolchain format... " >&6; }
-if ${lt_cv_to_tool_file_cmd+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking how to convert $build file names to toolchain format" >&5
+printf %s "checking how to convert $build file names to toolchain format... " >&6; }
+if test ${lt_cv_to_tool_file_cmd+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 #assume ordinary cross tools, or native build.
 lt_cv_to_tool_file_cmd=func_convert_file_noop
 case $host in
@@ -7913,22 +8522,23 @@
 fi
 
 to_tool_file_cmd=$lt_cv_to_tool_file_cmd
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_to_tool_file_cmd" >&5
-$as_echo "$lt_cv_to_tool_file_cmd" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_to_tool_file_cmd" >&5
+printf "%s\n" "$lt_cv_to_tool_file_cmd" >&6; }
 
 
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $LD option to reload object files" >&5
-$as_echo_n "checking for $LD option to reload object files... " >&6; }
-if ${lt_cv_ld_reload_flag+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $LD option to reload object files" >&5
+printf %s "checking for $LD option to reload object files... " >&6; }
+if test ${lt_cv_ld_reload_flag+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 lt_cv_ld_reload_flag='-r'
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_ld_reload_flag" >&5
-$as_echo "$lt_cv_ld_reload_flag" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_ld_reload_flag" >&5
+printf "%s\n" "$lt_cv_ld_reload_flag" >&6; }
 reload_flag=$lt_cv_ld_reload_flag
 case $reload_flag in
 "" | " "*) ;;
@@ -7961,11 +8571,12 @@
 if test -n "$ac_tool_prefix"; then
 # Extract the first word of "${ac_tool_prefix}objdump", so it can be a program name with args.
 set dummy ${ac_tool_prefix}objdump; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_OBJDUMP+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_OBJDUMP+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if test -n "$OBJDUMP"; then
 ac_cv_prog_OBJDUMP="$OBJDUMP" # Let the user override the test.
 else
@@ -7973,11 +8584,15 @@
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
 for ac_exec_ext in '' $ac_executable_extensions; do
- if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+ if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
 ac_cv_prog_OBJDUMP="${ac_tool_prefix}objdump"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
 break 2
 fi
 done
@@ -7988,11 +8603,11 @@
 fi
 OBJDUMP=$ac_cv_prog_OBJDUMP
 if test -n "$OBJDUMP"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $OBJDUMP" >&5
-$as_echo "$OBJDUMP" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $OBJDUMP" >&5
+printf "%s\n" "$OBJDUMP" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -8001,11 +8616,12 @@
 ac_ct_OBJDUMP=$OBJDUMP
 # Extract the first word of "objdump", so it can be a program name with args.
 set dummy objdump; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_ac_ct_OBJDUMP+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_ac_ct_OBJDUMP+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if test -n "$ac_ct_OBJDUMP"; then
 ac_cv_prog_ac_ct_OBJDUMP="$ac_ct_OBJDUMP" # Let the user override the test.
 else
@@ -8013,11 +8629,15 @@
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
 for ac_exec_ext in '' $ac_executable_extensions; do
- if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+ if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
 ac_cv_prog_ac_ct_OBJDUMP="objdump"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
 break 2
 fi
 done
@@ -8028,11 +8648,11 @@
 fi
 ac_ct_OBJDUMP=$ac_cv_prog_ac_ct_OBJDUMP
 if test -n "$ac_ct_OBJDUMP"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_OBJDUMP" >&5
-$as_echo "$ac_ct_OBJDUMP" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_ct_OBJDUMP" >&5
+printf "%s\n" "$ac_ct_OBJDUMP" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 if test "x$ac_ct_OBJDUMP" = x; then
@@ -8040,8 +8660,8 @@
 else
 case $cross_compiling:$ac_tool_warned in
 yes:)
-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
-$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
+printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
 ac_tool_warned=yes ;;
 esac
 OBJDUMP=$ac_ct_OBJDUMP
@@ -8060,11 +8680,12 @@
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking how to recognize dependent libraries" >&5
-$as_echo_n "checking how to recognize dependent libraries... " >&6; }
-if ${lt_cv_deplibs_check_method+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking how to recognize dependent libraries" >&5
+printf %s "checking how to recognize dependent libraries... " >&6; }
+if test ${lt_cv_deplibs_check_method+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 lt_cv_file_magic_cmd='$MAGIC_CMD'
 lt_cv_file_magic_test_file=
 lt_cv_deplibs_check_method='unknown'
@@ -8260,8 +8881,8 @@
 esac
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_deplibs_check_method" >&5
-$as_echo "$lt_cv_deplibs_check_method" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_deplibs_check_method" >&5
+printf "%s\n" "$lt_cv_deplibs_check_method" >&6; }
 
 file_magic_glob=
 want_nocaseglob=no
@@ -8305,11 +8926,12 @@
 if test -n "$ac_tool_prefix"; then
 # Extract the first word of "${ac_tool_prefix}dlltool", so it can be a program name with args.
 set dummy ${ac_tool_prefix}dlltool; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_DLLTOOL+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_DLLTOOL+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if test -n "$DLLTOOL"; then
 ac_cv_prog_DLLTOOL="$DLLTOOL" # Let the user override the test.
 else
@@ -8317,11 +8939,15 @@
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
 for ac_exec_ext in '' $ac_executable_extensions; do
- if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+ if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
 ac_cv_prog_DLLTOOL="${ac_tool_prefix}dlltool"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
 break 2
 fi
 done
@@ -8332,11 +8958,11 @@
 fi
 DLLTOOL=$ac_cv_prog_DLLTOOL
 if test -n "$DLLTOOL"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $DLLTOOL" >&5
-$as_echo "$DLLTOOL" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $DLLTOOL" >&5
+printf "%s\n" "$DLLTOOL" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -8345,11 +8971,12 @@
 ac_ct_DLLTOOL=$DLLTOOL
 # Extract the first word of "dlltool", so it can be a program name with args.
 set dummy dlltool; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_ac_ct_DLLTOOL+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_ac_ct_DLLTOOL+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if test -n "$ac_ct_DLLTOOL"; then
 ac_cv_prog_ac_ct_DLLTOOL="$ac_ct_DLLTOOL" # Let the user override the test.
 else
@@ -8357,11 +8984,15 @@
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
 for ac_exec_ext in '' $ac_executable_extensions; do
- if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+ if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
 ac_cv_prog_ac_ct_DLLTOOL="dlltool"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
 break 2
 fi
 done
@@ -8372,11 +9003,11 @@
 fi
 ac_ct_DLLTOOL=$ac_cv_prog_ac_ct_DLLTOOL
 if test -n "$ac_ct_DLLTOOL"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_DLLTOOL" >&5
-$as_echo "$ac_ct_DLLTOOL" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_ct_DLLTOOL" >&5
+printf "%s\n" "$ac_ct_DLLTOOL" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 if test "x$ac_ct_DLLTOOL" = x; then
@@ -8384,8 +9015,8 @@
 else
 case $cross_compiling:$ac_tool_warned in
 yes:)
-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
-$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
+printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
 ac_tool_warned=yes ;;
 esac
 DLLTOOL=$ac_ct_DLLTOOL
@@ -8405,11 +9036,12 @@
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking how to associate runtime and link libraries" >&5
-$as_echo_n "checking how to associate runtime and link libraries... " >&6; }
-if ${lt_cv_sharedlib_from_linklib_cmd+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking how to associate runtime and link libraries" >&5
+printf %s "checking how to associate runtime and link libraries... " >&6; }
+if test ${lt_cv_sharedlib_from_linklib_cmd+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 lt_cv_sharedlib_from_linklib_cmd='unknown'
 
 case $host_os in
@@ -8432,8 +9064,8 @@
 esac
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_sharedlib_from_linklib_cmd" >&5
-$as_echo "$lt_cv_sharedlib_from_linklib_cmd" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_sharedlib_from_linklib_cmd" >&5
+printf "%s\n" "$lt_cv_sharedlib_from_linklib_cmd" >&6; }
 sharedlib_from_linklib_cmd=$lt_cv_sharedlib_from_linklib_cmd
 test -z "$sharedlib_from_linklib_cmd" && sharedlib_from_linklib_cmd=$ECHO
 
@@ -8448,11 +9080,12 @@
 do
 # Extract the first word of "$ac_tool_prefix$ac_prog", so it can be a program name with args.
 set dummy $ac_tool_prefix$ac_prog; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_AR+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_AR+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if test -n "$AR"; then
 ac_cv_prog_AR="$AR" # Let the user override the test.
 else
@@ -8460,11 +9093,15 @@
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
 for ac_exec_ext in '' $ac_executable_extensions; do
- if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+ if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
 ac_cv_prog_AR="$ac_tool_prefix$ac_prog"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
 break 2
 fi
 done
@@ -8475,11 +9112,11 @@
 fi
 AR=$ac_cv_prog_AR
 if test -n "$AR"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $AR" >&5
-$as_echo "$AR" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $AR" >&5
+printf "%s\n" "$AR" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -8492,11 +9129,12 @@
 do
 # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_ac_ct_AR+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_ac_ct_AR+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if test -n "$ac_ct_AR"; then
 ac_cv_prog_ac_ct_AR="$ac_ct_AR" # Let the user override the test.
 else
@@ -8504,11 +9142,15 @@
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
 for ac_exec_ext in '' $ac_executable_extensions; do
- if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+ if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
 ac_cv_prog_ac_ct_AR="$ac_prog"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
 break 2
 fi
 done
@@ -8519,11 +9161,11 @@
 fi
 ac_ct_AR=$ac_cv_prog_ac_ct_AR
 if test -n "$ac_ct_AR"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_AR" >&5
-$as_echo "$ac_ct_AR" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_ct_AR" >&5
+printf "%s\n" "$ac_ct_AR" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -8535,8 +9177,8 @@
 else
 case $cross_compiling:$ac_tool_warned in
 yes:)
-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
-$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
+printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
 ac_tool_warned=yes ;;
 esac
 AR=$ac_ct_AR
@@ -8544,7 +9186,7 @@
 fi
 
 : ${AR=ar}
-: ${AR_FLAGS=cru}
+: ${AR_FLAGS=cr}
 
 
 
@@ -8556,30 +9198,32 @@
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for archiver @FILE support" >&5
-$as_echo_n "checking for archiver @FILE support... " >&6; }
-if ${lt_cv_ar_at_file+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for archiver @FILE support" >&5
+printf %s "checking for archiver @FILE support... " >&6; }
+if test ${lt_cv_ar_at_file+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 lt_cv_ar_at_file=no
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
 
 int
-main ()
+main (void)
 {
 
 ;
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
 echo conftest.$ac_objext > conftest.lst
 lt_ar_try='$AR $AR_FLAGS libconftest.a @conftest.lst >&5'
 { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$lt_ar_try\""; } >&5
 (eval $lt_ar_try) 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }
 if test 0 -eq "$ac_status"; then
 	# Ensure the archiver fails upon bogus file names.
@@ -8587,7 +9231,7 @@
 	{ { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$lt_ar_try\""; } >&5
 (eval $lt_ar_try) 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }
 	if test 0 -ne "$ac_status"; then
 lt_cv_ar_at_file=@
@@ -8596,11 +9240,11 @@
 rm -f conftest.* libconftest.a
 
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_ar_at_file" >&5
-$as_echo "$lt_cv_ar_at_file" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_ar_at_file" >&5
+printf "%s\n" "$lt_cv_ar_at_file" >&6; }
 
 if test no = "$lt_cv_ar_at_file"; then
 archiver_list_spec=
@@ -8617,11 +9261,12 @@
 if test -n "$ac_tool_prefix"; then
 # Extract the first word of "${ac_tool_prefix}strip", so it can be a program name with args.
 set dummy ${ac_tool_prefix}strip; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_STRIP+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_STRIP+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if test -n "$STRIP"; then
 ac_cv_prog_STRIP="$STRIP" # Let the user override the test.
 else
@@ -8629,11 +9274,15 @@
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
 for ac_exec_ext in '' $ac_executable_extensions; do
- if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+ if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
 ac_cv_prog_STRIP="${ac_tool_prefix}strip"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
 break 2
 fi
 done
@@ -8644,11 +9293,11 @@
 fi
 STRIP=$ac_cv_prog_STRIP
 if test -n "$STRIP"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $STRIP" >&5
-$as_echo "$STRIP" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $STRIP" >&5
+printf "%s\n" "$STRIP" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -8657,11 +9306,12 @@
 ac_ct_STRIP=$STRIP
 # Extract the first word of "strip", so it can be a program name with args.
 set dummy strip; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_ac_ct_STRIP+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_ac_ct_STRIP+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if test -n "$ac_ct_STRIP"; then
 ac_cv_prog_ac_ct_STRIP="$ac_ct_STRIP" # Let the user override the test.
 else
@@ -8669,11 +9319,15 @@
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
 for ac_exec_ext in '' $ac_executable_extensions; do
- if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+ if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
 ac_cv_prog_ac_ct_STRIP="strip"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
 break 2
 fi
 done
@@ -8684,11 +9338,11 @@
 fi
 ac_ct_STRIP=$ac_cv_prog_ac_ct_STRIP
 if test -n "$ac_ct_STRIP"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_STRIP" >&5
-$as_echo "$ac_ct_STRIP" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_ct_STRIP" >&5
+printf "%s\n" "$ac_ct_STRIP" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 if test "x$ac_ct_STRIP" = x; then
@@ -8696,8 +9350,8 @@
 else
 case $cross_compiling:$ac_tool_warned in
 yes:)
-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
-$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
+printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
 ac_tool_warned=yes ;;
 esac
 STRIP=$ac_ct_STRIP
@@ -8716,11 +9370,12 @@
 if test -n "$ac_tool_prefix"; then
 # Extract the first word of "${ac_tool_prefix}ranlib", so it can be a program name with args.
 set dummy ${ac_tool_prefix}ranlib; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_RANLIB+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_RANLIB+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if test -n "$RANLIB"; then
 ac_cv_prog_RANLIB="$RANLIB" # Let the user override the test.
 else
@@ -8728,11 +9383,15 @@
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
 for ac_exec_ext in '' $ac_executable_extensions; do
- if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+ if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
 ac_cv_prog_RANLIB="${ac_tool_prefix}ranlib"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
 break 2
 fi
 done
@@ -8743,11 +9402,11 @@
 fi
 RANLIB=$ac_cv_prog_RANLIB
 if test -n "$RANLIB"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $RANLIB" >&5
-$as_echo "$RANLIB" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $RANLIB" >&5
+printf "%s\n" "$RANLIB" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -8756,11 +9415,12 @@
 ac_ct_RANLIB=$RANLIB
 # Extract the first word of "ranlib", so it can be a program name with args.
 set dummy ranlib; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_ac_ct_RANLIB+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_ac_ct_RANLIB+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if test -n "$ac_ct_RANLIB"; then
 ac_cv_prog_ac_ct_RANLIB="$ac_ct_RANLIB" # Let the user override the test.
 else
@@ -8768,11 +9428,15 @@
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
 for ac_exec_ext in '' $ac_executable_extensions; do
- if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+ if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
 ac_cv_prog_ac_ct_RANLIB="ranlib"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
 break 2
 fi
 done
@@ -8783,11 +9447,11 @@
 fi
 ac_ct_RANLIB=$ac_cv_prog_ac_ct_RANLIB
 if test -n "$ac_ct_RANLIB"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_RANLIB" >&5
-$as_echo "$ac_ct_RANLIB" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_ct_RANLIB" >&5
+printf "%s\n" "$ac_ct_RANLIB" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 if test "x$ac_ct_RANLIB" = x; then
@@ -8795,8 +9459,8 @@
 else
 case $cross_compiling:$ac_tool_warned in
 yes:)
-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
-$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
+printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
 ac_tool_warned=yes ;;
 esac
 RANLIB=$ac_ct_RANLIB
@@ -8885,11 +9549,12 @@
 
 
 # Check for command to grab the raw symbol name followed by C symbol from nm.
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking command to parse $NM output from $compiler object" >&5
-$as_echo_n "checking command to parse $NM output from $compiler object... " >&6; }
-if ${lt_cv_sys_global_symbol_pipe+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking command to parse $NM output from $compiler object" >&5
+printf %s "checking command to parse $NM output from $compiler object... " >&6; }
+if test ${lt_cv_sys_global_symbol_pipe+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 
 # These are sane defaults that work on at least a few old systems.
 # They come from Ultrix. What could be older than Ultrix?!! ;)
@@ -9041,15 +9706,12 @@
 if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5
 (eval $ac_compile) 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }; then
 # Now try to grab the symbols.
 nlist=conftest.nm
- if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$NM conftest.$ac_objext \| "$lt_cv_sys_global_symbol_pipe" \> $nlist\""; } >&5
- (eval $NM conftest.$ac_objext \| "$lt_cv_sys_global_symbol_pipe" \> $nlist) 2>&5
- ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
- test $ac_status = 0; } && test -s "$nlist"; then
+ $ECHO "$as_me:$LINENO: $NM conftest.$ac_objext | $lt_cv_sys_global_symbol_pipe > $nlist" >&5
+ if eval "$NM" conftest.$ac_objext \| "$lt_cv_sys_global_symbol_pipe" \> $nlist 2>&5 && test -s "$nlist"; then
 # Try sorting and uniquifying the output.
 if sort "$nlist" | uniq > "$nlist"T; then
 	mv -f "$nlist"T "$nlist"
@@ -9117,7 +9779,7 @@
 	 if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_link\""; } >&5
 (eval $ac_link) 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; } && test -s conftest$ac_exeext; then
 	 pipe_works=yes
 	 fi
@@ -9152,11 +9814,11 @@
 lt_cv_sys_global_symbol_to_cdecl=
 fi
 if test -z "$lt_cv_sys_global_symbol_pipe$lt_cv_sys_global_symbol_to_cdecl"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: failed" >&5
-$as_echo "failed" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: failed" >&5
+printf "%s\n" "failed" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: ok" >&5
-$as_echo "ok" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: ok" >&5
+printf "%s\n" "ok" >&6; }
 fi
 
 # Response file support.
@@ -9202,13 +9864,14 @@
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for sysroot" >&5
-$as_echo_n "checking for sysroot... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for sysroot" >&5
+printf %s "checking for sysroot... " >&6; }
 
 # Check whether --with-sysroot was given.
-if test "${with_sysroot+set}" = set; then :
+if test ${with_sysroot+y}
+then :
 withval=$with_sysroot;
-else
+else $as_nop
 with_sysroot=no
 fi
 
@@ -9226,24 +9889,25 @@
 no|'')
 ;; #(
 *)
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $with_sysroot" >&5
-$as_echo "$with_sysroot" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $with_sysroot" >&5
+printf "%s\n" "$with_sysroot" >&6; }
 as_fn_error $? "The sysroot must be an absolute path." "$LINENO" 5
 ;;
 esac
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: ${lt_sysroot:-no}" >&5
-$as_echo "${lt_sysroot:-no}" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: ${lt_sysroot:-no}" >&5
+printf "%s\n" "${lt_sysroot:-no}" >&6; }
 
 
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for a working dd" >&5
-$as_echo_n "checking for a working dd... " >&6; }
-if ${ac_cv_path_lt_DD+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for a working dd" >&5
+printf %s "checking for a working dd... " >&6; }
+if test ${ac_cv_path_lt_DD+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 printf 0123456789abcdef0123456789abcdef >conftest.i
 cat conftest.i conftest.i >conftest2.i
 : ${lt_DD:=$DD}
@@ -9254,10 +9918,15 @@
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
- for ac_prog in dd; do
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
+ for ac_prog in dd
+ do
 for ac_exec_ext in '' $ac_executable_extensions; do
- ac_path_lt_DD="$as_dir/$ac_prog$ac_exec_ext"
+ ac_path_lt_DD="$as_dir$ac_prog$ac_exec_ext"
 as_fn_executable_p "$ac_path_lt_DD" || continue
 if "$ac_path_lt_DD" bs=32 count=1 <conftest2.i >conftest.out 2>/dev/null; then
 cmp -s conftest.i conftest.out \
@@ -9277,15 +9946,16 @@
 
 rm -f conftest.i conftest2.i conftest.out
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_lt_DD" >&5
-$as_echo "$ac_cv_path_lt_DD" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_lt_DD" >&5
+printf "%s\n" "$ac_cv_path_lt_DD" >&6; }
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking how to truncate binary pipes" >&5
-$as_echo_n "checking how to truncate binary pipes... " >&6; }
-if ${lt_cv_truncate_bin+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking how to truncate binary pipes" >&5
+printf %s "checking how to truncate binary pipes... " >&6; }
+if test ${lt_cv_truncate_bin+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 printf 0123456789abcdef0123456789abcdef >conftest.i
 cat conftest.i conftest.i >conftest2.i
 lt_cv_truncate_bin=
@@ -9296,8 +9966,8 @@
 rm -f conftest.i conftest2.i conftest.out
 test -z "$lt_cv_truncate_bin" && lt_cv_truncate_bin="$SED -e 4q"
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_truncate_bin" >&5
-$as_echo "$lt_cv_truncate_bin" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_truncate_bin" >&5
+printf "%s\n" "$lt_cv_truncate_bin" >&6; }
 
 
 
@@ -9320,7 +9990,8 @@
 }
 
 # Check whether --enable-libtool-lock was given.
-if test "${enable_libtool_lock+set}" = set; then :
+if test ${enable_libtool_lock+y}
+then :
 enableval=$enable_libtool_lock;
 fi
 
@@ -9336,7 +10007,7 @@
 if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5
 (eval $ac_compile) 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }; then
 case `/usr/bin/file conftest.$ac_objext` in
 *ELF-32*)
@@ -9356,7 +10027,7 @@
 if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5
 (eval $ac_compile) 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }; then
 if test yes = "$lt_cv_prog_gnu_ld"; then
 case `/usr/bin/file conftest.$ac_objext` in
@@ -9394,7 +10065,7 @@
 if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5
 (eval $ac_compile) 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }; then
 emul=elf
 case `/usr/bin/file conftest.$ac_objext` in
@@ -9435,7 +10106,7 @@
 if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5
 (eval $ac_compile) 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }; then
 case `/usr/bin/file conftest.o` in
 *32-bit*)
@@ -9498,11 +10169,12 @@
 # On SCO OpenServer 5, we need -belf to get full-featured binaries.
 SAVE_CFLAGS=$CFLAGS
 CFLAGS="$CFLAGS -belf"
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the C compiler needs -belf" >&5
-$as_echo_n "checking whether the C compiler needs -belf... " >&6; }
-if ${lt_cv_cc_needs_belf+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the C compiler needs -belf" >&5
+printf %s "checking whether the C compiler needs -belf... " >&6; }
+if test ${lt_cv_cc_needs_belf+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 ac_ext=c
 ac_cpp='$CPP $CPPFLAGS'
 ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
@@ -9513,19 +10185,20 @@
 /* end confdefs.h. */
 
 int
-main ()
+main (void)
 {
 
 ;
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
 lt_cv_cc_needs_belf=yes
-else
+else $as_nop
 lt_cv_cc_needs_belf=no
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
 conftest$ac_exeext conftest.$ac_ext
 ac_ext=c
 ac_cpp='$CPP $CPPFLAGS'
@@ -9534,8 +10207,8 @@
 ac_compiler_gnu=$ac_cv_c_compiler_gnu
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_cc_needs_belf" >&5
-$as_echo "$lt_cv_cc_needs_belf" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_cc_needs_belf" >&5
+printf "%s\n" "$lt_cv_cc_needs_belf" >&6; }
 if test yes != "$lt_cv_cc_needs_belf"; then
 # this is probably gcc 2.8.0, egcs 1.0 or newer; no need for -belf
 CFLAGS=$SAVE_CFLAGS
@@ -9548,7 +10221,7 @@
 if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5
 (eval $ac_compile) 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }; then
 case `/usr/bin/file conftest.o` in
 *64-bit*)
@@ -9585,11 +10258,12 @@
 if test -n "$ac_tool_prefix"; then
 # Extract the first word of "${ac_tool_prefix}mt", so it can be a program name with args.
 set dummy ${ac_tool_prefix}mt; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_MANIFEST_TOOL+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_MANIFEST_TOOL+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if test -n "$MANIFEST_TOOL"; then
 ac_cv_prog_MANIFEST_TOOL="$MANIFEST_TOOL" # Let the user override the test.
 else
@@ -9597,11 +10271,15 @@
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
 for ac_exec_ext in '' $ac_executable_extensions; do
- if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+ if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
 ac_cv_prog_MANIFEST_TOOL="${ac_tool_prefix}mt"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
 break 2
 fi
 done
@@ -9612,11 +10290,11 @@
 fi
 MANIFEST_TOOL=$ac_cv_prog_MANIFEST_TOOL
 if test -n "$MANIFEST_TOOL"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $MANIFEST_TOOL" >&5
-$as_echo "$MANIFEST_TOOL" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $MANIFEST_TOOL" >&5
+printf "%s\n" "$MANIFEST_TOOL" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -9625,11 +10303,12 @@
 ac_ct_MANIFEST_TOOL=$MANIFEST_TOOL
 # Extract the first word of "mt", so it can be a program name with args.
 set dummy mt; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_ac_ct_MANIFEST_TOOL+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_ac_ct_MANIFEST_TOOL+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if test -n "$ac_ct_MANIFEST_TOOL"; then
 ac_cv_prog_ac_ct_MANIFEST_TOOL="$ac_ct_MANIFEST_TOOL" # Let the user override the test.
 else
@@ -9637,11 +10316,15 @@
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
 for ac_exec_ext in '' $ac_executable_extensions; do
- if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+ if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
 ac_cv_prog_ac_ct_MANIFEST_TOOL="mt"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
 break 2
 fi
 done
@@ -9652,11 +10335,11 @@
 fi
 ac_ct_MANIFEST_TOOL=$ac_cv_prog_ac_ct_MANIFEST_TOOL
 if test -n "$ac_ct_MANIFEST_TOOL"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_MANIFEST_TOOL" >&5
-$as_echo "$ac_ct_MANIFEST_TOOL" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_ct_MANIFEST_TOOL" >&5
+printf "%s\n" "$ac_ct_MANIFEST_TOOL" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 if test "x$ac_ct_MANIFEST_TOOL" = x; then
@@ -9664,8 +10347,8 @@
 else
 case $cross_compiling:$ac_tool_warned in
 yes:)
-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
-$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
+printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
 ac_tool_warned=yes ;;
 esac
 MANIFEST_TOOL=$ac_ct_MANIFEST_TOOL
@@ -9675,11 +10358,12 @@
 fi
 
 test -z "$MANIFEST_TOOL" && MANIFEST_TOOL=mt
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if $MANIFEST_TOOL is a manifest tool" >&5
-$as_echo_n "checking if $MANIFEST_TOOL is a manifest tool... " >&6; }
-if ${lt_cv_path_mainfest_tool+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking if $MANIFEST_TOOL is a manifest tool" >&5
+printf %s "checking if $MANIFEST_TOOL is a manifest tool... " >&6; }
+if test ${lt_cv_path_mainfest_tool+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 lt_cv_path_mainfest_tool=no
 echo "$as_me:$LINENO: $MANIFEST_TOOL '-?'" >&5
 $MANIFEST_TOOL '-?' 2>conftest.err > conftest.out
@@ -9689,8 +10373,8 @@
 fi
 rm -f conftest*
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_path_mainfest_tool" >&5
-$as_echo "$lt_cv_path_mainfest_tool" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_path_mainfest_tool" >&5
+printf "%s\n" "$lt_cv_path_mainfest_tool" >&6; }
 if test yes != "$lt_cv_path_mainfest_tool"; then
 MANIFEST_TOOL=:
 fi
@@ -9705,11 +10389,12 @@
 if test -n "$ac_tool_prefix"; then
 # Extract the first word of "${ac_tool_prefix}dsymutil", so it can be a program name with args.
 set dummy ${ac_tool_prefix}dsymutil; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_DSYMUTIL+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_DSYMUTIL+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if test -n "$DSYMUTIL"; then
 ac_cv_prog_DSYMUTIL="$DSYMUTIL" # Let the user override the test.
 else
@@ -9717,11 +10402,15 @@
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
 for ac_exec_ext in '' $ac_executable_extensions; do
- if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+ if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
 ac_cv_prog_DSYMUTIL="${ac_tool_prefix}dsymutil"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
 break 2
 fi
 done
@@ -9732,11 +10421,11 @@
 fi
 DSYMUTIL=$ac_cv_prog_DSYMUTIL
 if test -n "$DSYMUTIL"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $DSYMUTIL" >&5
-$as_echo "$DSYMUTIL" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $DSYMUTIL" >&5
+printf "%s\n" "$DSYMUTIL" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -9745,11 +10434,12 @@
 ac_ct_DSYMUTIL=$DSYMUTIL
 # Extract the first word of "dsymutil", so it can be a program name with args.
 set dummy dsymutil; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_ac_ct_DSYMUTIL+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_ac_ct_DSYMUTIL+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if test -n "$ac_ct_DSYMUTIL"; then
 ac_cv_prog_ac_ct_DSYMUTIL="$ac_ct_DSYMUTIL" # Let the user override the test.
 else
@@ -9757,11 +10447,15 @@
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
 for ac_exec_ext in '' $ac_executable_extensions; do
- if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+ if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
 ac_cv_prog_ac_ct_DSYMUTIL="dsymutil"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
 break 2
 fi
 done
@@ -9772,11 +10466,11 @@
 fi
 ac_ct_DSYMUTIL=$ac_cv_prog_ac_ct_DSYMUTIL
 if test -n "$ac_ct_DSYMUTIL"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_DSYMUTIL" >&5
-$as_echo "$ac_ct_DSYMUTIL" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_ct_DSYMUTIL" >&5
+printf "%s\n" "$ac_ct_DSYMUTIL" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 if test "x$ac_ct_DSYMUTIL" = x; then
@@ -9784,8 +10478,8 @@
 else
 case $cross_compiling:$ac_tool_warned in
 yes:)
-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
-$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
+printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
 ac_tool_warned=yes ;;
 esac
 DSYMUTIL=$ac_ct_DSYMUTIL
@@ -9797,11 +10491,12 @@
 if test -n "$ac_tool_prefix"; then
 # Extract the first word of "${ac_tool_prefix}nmedit", so it can be a program name with args.
 set dummy ${ac_tool_prefix}nmedit; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_NMEDIT+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_NMEDIT+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if test -n "$NMEDIT"; then
 ac_cv_prog_NMEDIT="$NMEDIT" # Let the user override the test.
 else
@@ -9809,11 +10504,15 @@
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
 for ac_exec_ext in '' $ac_executable_extensions; do
- if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+ if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
 ac_cv_prog_NMEDIT="${ac_tool_prefix}nmedit"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
 break 2
 fi
 done
@@ -9824,11 +10523,11 @@
 fi
 NMEDIT=$ac_cv_prog_NMEDIT
 if test -n "$NMEDIT"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $NMEDIT" >&5
-$as_echo "$NMEDIT" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $NMEDIT" >&5
+printf "%s\n" "$NMEDIT" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -9837,11 +10536,12 @@
 ac_ct_NMEDIT=$NMEDIT
 # Extract the first word of "nmedit", so it can be a program name with args.
 set dummy nmedit; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_ac_ct_NMEDIT+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_ac_ct_NMEDIT+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if test -n "$ac_ct_NMEDIT"; then
 ac_cv_prog_ac_ct_NMEDIT="$ac_ct_NMEDIT" # Let the user override the test.
 else
@@ -9849,11 +10549,15 @@
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
 for ac_exec_ext in '' $ac_executable_extensions; do
- if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+ if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
 ac_cv_prog_ac_ct_NMEDIT="nmedit"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
 break 2
 fi
 done
@@ -9864,11 +10568,11 @@
 fi
 ac_ct_NMEDIT=$ac_cv_prog_ac_ct_NMEDIT
 if test -n "$ac_ct_NMEDIT"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_NMEDIT" >&5
-$as_echo "$ac_ct_NMEDIT" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_ct_NMEDIT" >&5
+printf "%s\n" "$ac_ct_NMEDIT" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 if test "x$ac_ct_NMEDIT" = x; then
@@ -9876,8 +10580,8 @@
 else
 case $cross_compiling:$ac_tool_warned in
 yes:)
-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
-$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
+printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
 ac_tool_warned=yes ;;
 esac
 NMEDIT=$ac_ct_NMEDIT
@@ -9889,11 +10593,12 @@
 if test -n "$ac_tool_prefix"; then
 # Extract the first word of "${ac_tool_prefix}lipo", so it can be a program name with args.
 set dummy ${ac_tool_prefix}lipo; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_LIPO+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_LIPO+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if test -n "$LIPO"; then
 ac_cv_prog_LIPO="$LIPO" # Let the user override the test.
 else
@@ -9901,11 +10606,15 @@
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
 for ac_exec_ext in '' $ac_executable_extensions; do
- if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+ if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
 ac_cv_prog_LIPO="${ac_tool_prefix}lipo"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
 break 2
 fi
 done
@@ -9916,11 +10625,11 @@
 fi
 LIPO=$ac_cv_prog_LIPO
 if test -n "$LIPO"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $LIPO" >&5
-$as_echo "$LIPO" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $LIPO" >&5
+printf "%s\n" "$LIPO" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -9929,11 +10638,12 @@
 ac_ct_LIPO=$LIPO
 # Extract the first word of "lipo", so it can be a program name with args.
 set dummy lipo; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_ac_ct_LIPO+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_ac_ct_LIPO+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if test -n "$ac_ct_LIPO"; then
 ac_cv_prog_ac_ct_LIPO="$ac_ct_LIPO" # Let the user override the test.
 else
@@ -9941,11 +10651,15 @@
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
 for ac_exec_ext in '' $ac_executable_extensions; do
- if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+ if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
 ac_cv_prog_ac_ct_LIPO="lipo"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
 break 2
 fi
 done
@@ -9956,11 +10670,11 @@
 fi
 ac_ct_LIPO=$ac_cv_prog_ac_ct_LIPO
 if test -n "$ac_ct_LIPO"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_LIPO" >&5
-$as_echo "$ac_ct_LIPO" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_ct_LIPO" >&5
+printf "%s\n" "$ac_ct_LIPO" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 if test "x$ac_ct_LIPO" = x; then
@@ -9968,8 +10682,8 @@
 else
 case $cross_compiling:$ac_tool_warned in
 yes:)
-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
-$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
+printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
 ac_tool_warned=yes ;;
 esac
 LIPO=$ac_ct_LIPO
@@ -9981,11 +10695,12 @@
 if test -n "$ac_tool_prefix"; then
 # Extract the first word of "${ac_tool_prefix}otool", so it can be a program name with args.
 set dummy ${ac_tool_prefix}otool; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_OTOOL+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_OTOOL+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if test -n "$OTOOL"; then
 ac_cv_prog_OTOOL="$OTOOL" # Let the user override the test.
 else
@@ -9993,11 +10708,15 @@
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
 for ac_exec_ext in '' $ac_executable_extensions; do
- if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+ if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
 ac_cv_prog_OTOOL="${ac_tool_prefix}otool"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
 break 2
 fi
 done
@@ -10008,11 +10727,11 @@
 fi
 OTOOL=$ac_cv_prog_OTOOL
 if test -n "$OTOOL"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $OTOOL" >&5
-$as_echo "$OTOOL" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $OTOOL" >&5
+printf "%s\n" "$OTOOL" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -10021,11 +10740,12 @@
 ac_ct_OTOOL=$OTOOL
 # Extract the first word of "otool", so it can be a program name with args.
 set dummy otool; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_ac_ct_OTOOL+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_ac_ct_OTOOL+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if test -n "$ac_ct_OTOOL"; then
 ac_cv_prog_ac_ct_OTOOL="$ac_ct_OTOOL" # Let the user override the test.
 else
@@ -10033,11 +10753,15 @@
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
 for ac_exec_ext in '' $ac_executable_extensions; do
- if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+ if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
 ac_cv_prog_ac_ct_OTOOL="otool"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
 break 2
 fi
 done
@@ -10048,11 +10772,11 @@
 fi
 ac_ct_OTOOL=$ac_cv_prog_ac_ct_OTOOL
 if test -n "$ac_ct_OTOOL"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_OTOOL" >&5
-$as_echo "$ac_ct_OTOOL" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_ct_OTOOL" >&5
+printf "%s\n" "$ac_ct_OTOOL" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 if test "x$ac_ct_OTOOL" = x; then
@@ -10060,8 +10784,8 @@
 else
 case $cross_compiling:$ac_tool_warned in
 yes:)
-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
-$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
+printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
 ac_tool_warned=yes ;;
 esac
 OTOOL=$ac_ct_OTOOL
@@ -10073,11 +10797,12 @@
 if test -n "$ac_tool_prefix"; then
 # Extract the first word of "${ac_tool_prefix}otool64", so it can be a program name with args.
 set dummy ${ac_tool_prefix}otool64; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_OTOOL64+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_OTOOL64+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if test -n "$OTOOL64"; then
 ac_cv_prog_OTOOL64="$OTOOL64" # Let the user override the test.
 else
@@ -10085,11 +10810,15 @@
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
 for ac_exec_ext in '' $ac_executable_extensions; do
- if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+ if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
 ac_cv_prog_OTOOL64="${ac_tool_prefix}otool64"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
 break 2
 fi
 done
@@ -10100,11 +10829,11 @@
 fi
 OTOOL64=$ac_cv_prog_OTOOL64
 if test -n "$OTOOL64"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $OTOOL64" >&5
-$as_echo "$OTOOL64" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $OTOOL64" >&5
+printf "%s\n" "$OTOOL64" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -10113,11 +10842,12 @@
 ac_ct_OTOOL64=$OTOOL64
 # Extract the first word of "otool64", so it can be a program name with args.
 set dummy otool64; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_prog_ac_ct_OTOOL64+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+printf %s "checking for $ac_word... " >&6; }
+if test ${ac_cv_prog_ac_ct_OTOOL64+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 if test -n "$ac_ct_OTOOL64"; then
 ac_cv_prog_ac_ct_OTOOL64="$ac_ct_OTOOL64" # Let the user override the test.
 else
@@ -10125,11 +10855,15 @@
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
 for ac_exec_ext in '' $ac_executable_extensions; do
- if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+ if as_fn_executable_p "$as_dir$ac_word$ac_exec_ext"; then
 ac_cv_prog_ac_ct_OTOOL64="otool64"
- $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: found $as_dir$ac_word$ac_exec_ext" >&5
 break 2
 fi
 done
@@ -10140,11 +10874,11 @@
 fi
 ac_ct_OTOOL64=$ac_cv_prog_ac_ct_OTOOL64
 if test -n "$ac_ct_OTOOL64"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_OTOOL64" >&5
-$as_echo "$ac_ct_OTOOL64" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_ct_OTOOL64" >&5
+printf "%s\n" "$ac_ct_OTOOL64" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 if test "x$ac_ct_OTOOL64" = x; then
@@ -10152,8 +10886,8 @@
 else
 case $cross_compiling:$ac_tool_warned in
 yes:)
-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
-$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
+printf "%s\n" "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
 ac_tool_warned=yes ;;
 esac
 OTOOL64=$ac_ct_OTOOL64
@@ -10188,11 +10922,12 @@
 
 
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for -single_module linker flag" >&5
-$as_echo_n "checking for -single_module linker flag... " >&6; }
-if ${lt_cv_apple_cc_single_mod+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for -single_module linker flag" >&5
+printf %s "checking for -single_module linker flag... " >&6; }
+if test ${lt_cv_apple_cc_single_mod+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 lt_cv_apple_cc_single_mod=no
 if test -z "$LT_MULTI_MODULE"; then
 	# By default we will add the -single_module flag. You can override
@@ -10221,14 +10956,15 @@
 	rm -f conftest.*
 fi
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_apple_cc_single_mod" >&5
-$as_echo "$lt_cv_apple_cc_single_mod" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_apple_cc_single_mod" >&5
+printf "%s\n" "$lt_cv_apple_cc_single_mod" >&6; }
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for -exported_symbols_list linker flag" >&5
-$as_echo_n "checking for -exported_symbols_list linker flag... " >&6; }
-if ${lt_cv_ld_exported_symbols_list+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for -exported_symbols_list linker flag" >&5
+printf %s "checking for -exported_symbols_list linker flag... " >&6; }
+if test ${lt_cv_ld_exported_symbols_list+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 lt_cv_ld_exported_symbols_list=no
 save_LDFLAGS=$LDFLAGS
 echo "_main" > conftest.sym
@@ -10237,39 +10973,41 @@
 /* end confdefs.h. */
 
 int
-main ()
+main (void)
 {
 
 ;
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
 lt_cv_ld_exported_symbols_list=yes
-else
+else $as_nop
 lt_cv_ld_exported_symbols_list=no
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
 conftest$ac_exeext conftest.$ac_ext
 	LDFLAGS=$save_LDFLAGS
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_ld_exported_symbols_list" >&5
-$as_echo "$lt_cv_ld_exported_symbols_list" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_ld_exported_symbols_list" >&5
+printf "%s\n" "$lt_cv_ld_exported_symbols_list" >&6; }
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for -force_load linker flag" >&5
-$as_echo_n "checking for -force_load linker flag... " >&6; }
-if ${lt_cv_ld_force_load+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for -force_load linker flag" >&5
+printf %s "checking for -force_load linker flag... " >&6; }
+if test ${lt_cv_ld_force_load+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 lt_cv_ld_force_load=no
 cat > conftest.c << _LT_EOF
 int forced_loaded() { return 2;}
 _LT_EOF
 echo "$LTCC $LTCFLAGS -c -o conftest.o conftest.c" >&5
 $LTCC $LTCFLAGS -c -o conftest.o conftest.c 2>&5
- echo "$AR cru libconftest.a conftest.o" >&5
- $AR cru libconftest.a conftest.o 2>&5
+ echo "$AR cr libconftest.a conftest.o" >&5
+ $AR cr libconftest.a conftest.o 2>&5
 echo "$RANLIB libconftest.a" >&5
 $RANLIB libconftest.a 2>&5
 cat > conftest.c << _LT_EOF
@@ -10289,8 +11027,8 @@
 rm -rf conftest.dSYM
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_ld_force_load" >&5
-$as_echo "$lt_cv_ld_force_load" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_ld_force_load" >&5
+printf "%s\n" "$lt_cv_ld_force_load" >&6; }
 case $host_os in
 rhapsody* | darwin1.012)
 _lt_dar_allow_undefined='$wl-undefined ${wl}suppress' ;;
@@ -10301,11 +11039,11 @@
 # to the OS version, if on x86, and 10.4, the deployment
 # target defaults to 10.4. Don't you love it?
 case ${MACOSX_DEPLOYMENT_TARGET-10.0},$host in
-	10.0,*86*-darwin8*|10.0,*-darwin91*)
+	10.0,*86*-darwin8*|10.0,*-darwin912*)
 	 _lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;;
 	10.012,.*)
 	 _lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;;
-	10.*)
+	10.*|11.*)
 	 _lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;;
 esac
 ;;
@@ -10361,155 +11099,51 @@
 esac
 }
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for ANSI C header files" >&5
-$as_echo_n "checking for ANSI C header files... " >&6; }
-if ${ac_cv_header_stdc+:} false; then :
- $as_echo_n "(cached) " >&6
-else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h. */
-#include <stdlib.h>
-#include <stdarg.h>
-#include <string.h>
-#include <float.h>
-
-int
-main ()
-{
-
- ;
- return 0;
-}
-_ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
- ac_cv_header_stdc=yes
-else
- ac_cv_header_stdc=no
-fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-
-if test $ac_cv_header_stdc = yes; then
- # SunOS 4.x string.h does not declare mem*, contrary to ANSI.
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h. */
-#include <string.h>
-
-_ACEOF
-if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
- $EGREP "memchr" >/dev/null 2>&1; then :
-
-else
- ac_cv_header_stdc=no
-fi
-rm -f conftest*
+ac_header= ac_cache=
+for ac_item in $ac_header_c_list
+do
+ if test $ac_cache; then
+ ac_fn_c_check_header_compile "$LINENO" $ac_header ac_cv_header_$ac_cache "$ac_includes_default"
+ if eval test \"x\$ac_cv_header_$ac_cache\" = xyes; then
+ printf "%s\n" "#define $ac_item 1" >> confdefs.h
+ fi
+ ac_header= ac_cache=
+ elif test $ac_header; then
+ ac_cache=$ac_item
+ else
+ ac_header=$ac_item
+ fi
+done
 
-fi
 
-if test $ac_cv_header_stdc = yes; then
- # ISC 2.0.2 stdlib.h does not declare free, contrary to ANSI.
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h. */
-#include <stdlib.h>
 
-_ACEOF
-if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
- $EGREP "free" >/dev/null 2>&1; then :
 
-else
- ac_cv_header_stdc=no
-fi
-rm -f conftest*
 
-fi
 
-if test $ac_cv_header_stdc = yes; then
- # /bin/cc in Irix-4.0.5 gets non-ANSI ctype macros unless using -ansi.
- if test "$cross_compiling" = yes; then :
- :
-else
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h. */
-#include <ctype.h>
-#include <stdlib.h>
-#if ((' ' & 0x0FF) == 0x020)
-# define ISLOWER(c) ('a' <= (c) && (c) <= 'z')
-# define TOUPPER(c) (ISLOWER(c) ? 'A' + ((c) - 'a') : (c))
-#else
-# define ISLOWER(c) \
-		 (('a' <= (c) && (c) <= 'i') \
-		 || ('j' <= (c) && (c) <= 'r') \
-		 || ('s' <= (c) && (c) <= 'z'))
-# define TOUPPER(c) (ISLOWER(c) ? ((c) | 0x40) : (c))
-#endif
 
-#define XOR(e, f) (((e) && !(f)) || (!(e) && (f)))
-int
-main ()
-{
- int i;
- for (i = 0; i < 256; i++)
- if (XOR (islower (i), ISLOWER (i))
-	|| toupper (i) != TOUPPER (i))
- return 2;
- return 0;
-}
-_ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
 
-else
- ac_cv_header_stdc=no
-fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
- conftest.$ac_objext conftest.beam conftest.$ac_ext
-fi
-
-fi
-fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_header_stdc" >&5
-$as_echo "$ac_cv_header_stdc" >&6; }
-if test $ac_cv_header_stdc = yes; then
+if test $ac_cv_header_stdlib_h = yes && test $ac_cv_header_string_h = yes
+then :
 
-$as_echo "#define STDC_HEADERS 1" >>confdefs.h
-
-fi
-
-# On IRIX 5.3, sys/types and inttypes.h are conflicting.
-for ac_header in sys/types.h sys/stat.h stdlib.h string.h memory.h strings.h \
-		 inttypes.h stdint.h unistd.h
-do :
- as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
-ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default
-"
-if eval test \"x\$"$as_ac_Header"\" = x"yes"; then :
- cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1
-_ACEOF
+printf "%s\n" "#define STDC_HEADERS 1" >>confdefs.h
 
 fi
-
-done
-
-
-for ac_header in dlfcn.h
-do :
- ac_fn_c_check_header_compile "$LINENO" "dlfcn.h" "ac_cv_header_dlfcn_h" "$ac_includes_default
+ac_fn_c_check_header_compile "$LINENO" "dlfcn.h" "ac_cv_header_dlfcn_h" "$ac_includes_default
 "
-if test "x$ac_cv_header_dlfcn_h" = xyes; then :
- cat >>confdefs.h <<_ACEOF
-#define HAVE_DLFCN_H 1
-_ACEOF
+if test "x$ac_cv_header_dlfcn_h" = xyes
+then :
+ printf "%s\n" "#define HAVE_DLFCN_H 1" >>confdefs.h
 
 fi
 
-done
-
 
 
 
 
 # Set options
 # Check whether --enable-static was given.
-if test "${enable_static+set}" = set; then :
+if test ${enable_static+y}
+then :
 enableval=$enable_static; p=${PACKAGE-default}
 case $enableval in
 yes) enable_static=yes ;;
@@ -10527,7 +11161,7 @@
 IFS=$lt_save_ifs
 ;;
 esac
-else
+else $as_nop
 enable_static=no
 fi
 
@@ -10547,7 +11181,8 @@
 
 
 # Check whether --enable-shared was given.
-if test "${enable_shared+set}" = set; then :
+if test ${enable_shared+y}
+then :
 enableval=$enable_shared; p=${PACKAGE-default}
 case $enableval in
 yes) enable_shared=yes ;;
@@ -10565,7 +11200,7 @@
 IFS=$lt_save_ifs
 ;;
 esac
-else
+else $as_nop
 enable_shared=yes
 fi
 
@@ -10580,7 +11215,8 @@
 
 
 # Check whether --with-pic was given.
-if test "${with_pic+set}" = set; then :
+if test ${with_pic+y}
+then :
 withval=$with_pic; lt_p=${PACKAGE-default}
 case $withval in
 yes|no) pic_mode=$withval ;;
@@ -10597,7 +11233,7 @@
 IFS=$lt_save_ifs
 ;;
 esac
-else
+else $as_nop
 pic_mode=default
 fi
 
@@ -10609,7 +11245,8 @@
 
 
 # Check whether --enable-fast-install was given.
-if test "${enable_fast_install+set}" = set; then :
+if test ${enable_fast_install+y}
+then :
 enableval=$enable_fast_install; p=${PACKAGE-default}
 case $enableval in
 yes) enable_fast_install=yes ;;
@@ -10627,7 +11264,7 @@
 IFS=$lt_save_ifs
 ;;
 esac
-else
+else $as_nop
 enable_fast_install=yes
 fi
 
@@ -10641,11 +11278,12 @@
 shared_archive_member_spec=
 case $host,$enable_shared in
 power*-*-aix5-9*,yes)
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking which variant of shared library versioning to provide" >&5
-$as_echo_n "checking which variant of shared library versioning to provide... " >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking which variant of shared library versioning to provide" >&5
+printf %s "checking which variant of shared library versioning to provide... " >&6; }
 
 # Check whether --with-aix-soname was given.
-if test "${with_aix_soname+set}" = set; then :
+if test ${with_aix_soname+y}
+then :
 withval=$with_aix_soname; case $withval in
 aix|svr4|both)
 ;;
@@ -10654,18 +11292,19 @@
 ;;
 esac
 lt_cv_with_aix_soname=$with_aix_soname
-else
- if ${lt_cv_with_aix_soname+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+else $as_nop
+ if test ${lt_cv_with_aix_soname+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 lt_cv_with_aix_soname=aix
 fi
 
 with_aix_soname=$lt_cv_with_aix_soname
 fi
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $with_aix_soname" >&5
-$as_echo "$with_aix_soname" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $with_aix_soname" >&5
+printf "%s\n" "$with_aix_soname" >&6; }
 if test aix != "$with_aix_soname"; then
 # For the AIX way of multilib, we name the shared archive member
 # based on the bitwidth used, traditionally 'shr.o' or 'shr_64.o',
@@ -10747,11 +11386,12 @@
 setopt NO_GLOB_SUBST
 fi
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for objdir" >&5
-$as_echo_n "checking for objdir... " >&6; }
-if ${lt_cv_objdir+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for objdir" >&5
+printf %s "checking for objdir... " >&6; }
+if test ${lt_cv_objdir+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 rm -f .libs 2>/dev/null
 mkdir .libs 2>/dev/null
 if test -d .libs; then
@@ -10762,17 +11402,15 @@
 fi
 rmdir .libs 2>/dev/null
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_objdir" >&5
-$as_echo "$lt_cv_objdir" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_objdir" >&5
+printf "%s\n" "$lt_cv_objdir" >&6; }
 objdir=$lt_cv_objdir
 
 
 
 
 
-cat >>confdefs.h <<_ACEOF
-#define LT_OBJDIR "$lt_cv_objdir/"
-_ACEOF
+printf "%s\n" "#define LT_OBJDIR \"$lt_cv_objdir/\"" >>confdefs.h
 
 
 
@@ -10818,11 +11456,12 @@
 case $deplibs_check_method in
 file_magic*)
 if test "$file_magic_cmd" = '$MAGIC_CMD'; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for ${ac_tool_prefix}file" >&5
-$as_echo_n "checking for ${ac_tool_prefix}file... " >&6; }
-if ${lt_cv_path_MAGIC_CMD+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for ${ac_tool_prefix}file" >&5
+printf %s "checking for ${ac_tool_prefix}file... " >&6; }
+if test ${lt_cv_path_MAGIC_CMD+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 case $MAGIC_CMD in
 \\/* | ?:\\/*)
 lt_cv_path_MAGIC_CMD=$MAGIC_CMD # Let the user override the test with a path.
@@ -10871,11 +11510,11 @@
 
 MAGIC_CMD=$lt_cv_path_MAGIC_CMD
 if test -n "$MAGIC_CMD"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $MAGIC_CMD" >&5
-$as_echo "$MAGIC_CMD" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $MAGIC_CMD" >&5
+printf "%s\n" "$MAGIC_CMD" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -10884,11 +11523,12 @@
 
 if test -z "$lt_cv_path_MAGIC_CMD"; then
 if test -n "$ac_tool_prefix"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for file" >&5
-$as_echo_n "checking for file... " >&6; }
-if ${lt_cv_path_MAGIC_CMD+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for file" >&5
+printf %s "checking for file... " >&6; }
+if test ${lt_cv_path_MAGIC_CMD+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 case $MAGIC_CMD in
 \\/* | ?:\\/*)
 lt_cv_path_MAGIC_CMD=$MAGIC_CMD # Let the user override the test with a path.
@@ -10937,11 +11577,11 @@
 
 MAGIC_CMD=$lt_cv_path_MAGIC_CMD
 if test -n "$MAGIC_CMD"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $MAGIC_CMD" >&5
-$as_echo "$MAGIC_CMD" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $MAGIC_CMD" >&5
+printf "%s\n" "$MAGIC_CMD" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
 
@@ -11026,11 +11666,12 @@
 lt_prog_compiler_no_builtin_flag=' -fno-builtin' ;;
 esac
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $compiler supports -fno-rtti -fno-exceptions" >&5
-$as_echo_n "checking if $compiler supports -fno-rtti -fno-exceptions... " >&6; }
-if ${lt_cv_prog_compiler_rtti_exceptions+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking if $compiler supports -fno-rtti -fno-exceptions" >&5
+printf %s "checking if $compiler supports -fno-rtti -fno-exceptions... " >&6; }
+if test ${lt_cv_prog_compiler_rtti_exceptions+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 lt_cv_prog_compiler_rtti_exceptions=no
 ac_outfile=conftest.$ac_objext
 echo "$lt_simple_compile_test_code" > conftest.$ac_ext
@@ -11061,8 +11702,8 @@
 $RM conftest*
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_rtti_exceptions" >&5
-$as_echo "$lt_cv_prog_compiler_rtti_exceptions" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_rtti_exceptions" >&5
+printf "%s\n" "$lt_cv_prog_compiler_rtti_exceptions" >&6; }
 
 if test yes = "$lt_cv_prog_compiler_rtti_exceptions"; then
 lt_prog_compiler_no_builtin_flag="$lt_prog_compiler_no_builtin_flag -fno-rtti -fno-exceptions"
@@ -11259,6 +11900,12 @@
 	lt_prog_compiler_pic='-KPIC'
 	lt_prog_compiler_static='-static'
 ;;
+ # flang / f18. f95 an alias for gfortran or flang on Debian
+ flang* | f18* | f95*)
+	lt_prog_compiler_wl='-Wl,'
+	lt_prog_compiler_pic='-fPIC'
+	lt_prog_compiler_static='-static'
+ ;;
 # icc used to be incompatible with GCC.
 # ICC 10 doesn't accept -KPIC any more.
 icc* | ifort*)
@@ -11419,26 +12066,28 @@
 ;;
 esac
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $compiler option to produce PIC" >&5
-$as_echo_n "checking for $compiler option to produce PIC... " >&6; }
-if ${lt_cv_prog_compiler_pic+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for $compiler option to produce PIC" >&5
+printf %s "checking for $compiler option to produce PIC... " >&6; }
+if test ${lt_cv_prog_compiler_pic+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 lt_cv_prog_compiler_pic=$lt_prog_compiler_pic
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_pic" >&5
-$as_echo "$lt_cv_prog_compiler_pic" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_pic" >&5
+printf "%s\n" "$lt_cv_prog_compiler_pic" >&6; }
 lt_prog_compiler_pic=$lt_cv_prog_compiler_pic
 
 #
 # Check to make sure the PIC flag actually works.
 #
 if test -n "$lt_prog_compiler_pic"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $compiler PIC flag $lt_prog_compiler_pic works" >&5
-$as_echo_n "checking if $compiler PIC flag $lt_prog_compiler_pic works... " >&6; }
-if ${lt_cv_prog_compiler_pic_works+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking if $compiler PIC flag $lt_prog_compiler_pic works" >&5
+printf %s "checking if $compiler PIC flag $lt_prog_compiler_pic works... " >&6; }
+if test ${lt_cv_prog_compiler_pic_works+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 lt_cv_prog_compiler_pic_works=no
 ac_outfile=conftest.$ac_objext
 echo "$lt_simple_compile_test_code" > conftest.$ac_ext
@@ -11469,8 +12118,8 @@
 $RM conftest*
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_pic_works" >&5
-$as_echo "$lt_cv_prog_compiler_pic_works" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_pic_works" >&5
+printf "%s\n" "$lt_cv_prog_compiler_pic_works" >&6; }
 
 if test yes = "$lt_cv_prog_compiler_pic_works"; then
 case $lt_prog_compiler_pic in
@@ -11498,11 +12147,12 @@
 # Check to make sure the static flag actually works.
 #
 wl=$lt_prog_compiler_wl eval lt_tmp_static_flag=\"$lt_prog_compiler_static\"
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if $compiler static flag $lt_tmp_static_flag works" >&5
-$as_echo_n "checking if $compiler static flag $lt_tmp_static_flag works... " >&6; }
-if ${lt_cv_prog_compiler_static_works+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking if $compiler static flag $lt_tmp_static_flag works" >&5
+printf %s "checking if $compiler static flag $lt_tmp_static_flag works... " >&6; }
+if test ${lt_cv_prog_compiler_static_works+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 lt_cv_prog_compiler_static_works=no
 save_LDFLAGS=$LDFLAGS
 LDFLAGS="$LDFLAGS $lt_tmp_static_flag"
@@ -11526,8 +12176,8 @@
 LDFLAGS=$save_LDFLAGS
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_static_works" >&5
-$as_echo "$lt_cv_prog_compiler_static_works" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_static_works" >&5
+printf "%s\n" "$lt_cv_prog_compiler_static_works" >&6; }
 
 if test yes = "$lt_cv_prog_compiler_static_works"; then
 :
@@ -11541,11 +12191,12 @@
 
 
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $compiler supports -c -o file.$ac_objext" >&5
-$as_echo_n "checking if $compiler supports -c -o file.$ac_objext... " >&6; }
-if ${lt_cv_prog_compiler_c_o+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking if $compiler supports -c -o file.$ac_objext" >&5
+printf %s "checking if $compiler supports -c -o file.$ac_objext... " >&6; }
+if test ${lt_cv_prog_compiler_c_o+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 lt_cv_prog_compiler_c_o=no
 $RM -r conftest 2>/dev/null
 mkdir conftest
@@ -11588,19 +12239,20 @@
 $RM conftest*
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_c_o" >&5
-$as_echo "$lt_cv_prog_compiler_c_o" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_c_o" >&5
+printf "%s\n" "$lt_cv_prog_compiler_c_o" >&6; }
 
 
 
 
 
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $compiler supports -c -o file.$ac_objext" >&5
-$as_echo_n "checking if $compiler supports -c -o file.$ac_objext... " >&6; }
-if ${lt_cv_prog_compiler_c_o+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking if $compiler supports -c -o file.$ac_objext" >&5
+printf %s "checking if $compiler supports -c -o file.$ac_objext... " >&6; }
+if test ${lt_cv_prog_compiler_c_o+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 lt_cv_prog_compiler_c_o=no
 $RM -r conftest 2>/dev/null
 mkdir conftest
@@ -11643,8 +12295,8 @@
 $RM conftest*
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_c_o" >&5
-$as_echo "$lt_cv_prog_compiler_c_o" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler_c_o" >&5
+printf "%s\n" "$lt_cv_prog_compiler_c_o" >&6; }
 
 
 
@@ -11652,19 +12304,19 @@
 hard_links=nottested
 if test no = "$lt_cv_prog_compiler_c_o" && test no != "$need_locks"; then
 # do not overwrite the value of need_locks provided by the user
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if we can lock with hard links" >&5
-$as_echo_n "checking if we can lock with hard links... " >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking if we can lock with hard links" >&5
+printf %s "checking if we can lock with hard links... " >&6; }
 hard_links=yes
 $RM conftest*
 ln conftest.a conftest.b 2>/dev/null && hard_links=no
 touch conftest.a
 ln conftest.a conftest.b 2>&5 || hard_links=no
 ln conftest.a conftest.b 2>/dev/null && hard_links=no
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $hard_links" >&5
-$as_echo "$hard_links" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $hard_links" >&5
+printf "%s\n" "$hard_links" >&6; }
 if test no = "$hard_links"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: '$CC' does not support '-c -o', so 'make -j' may be unsafe" >&5
-$as_echo "$as_me: WARNING: '$CC' does not support '-c -o', so 'make -j' may be unsafe" >&2;}
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: '$CC' does not support '-c -o', so 'make -j' may be unsafe" >&5
+printf "%s\n" "$as_me: WARNING: '$CC' does not support '-c -o', so 'make -j' may be unsafe" >&2;}
 need_locks=warn
 fi
 else
@@ -11676,8 +12328,8 @@
 
 
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the $compiler linker ($LD) supports shared libraries" >&5
-$as_echo_n "checking whether the $compiler linker ($LD) supports shared libraries... " >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the $compiler linker ($LD) supports shared libraries" >&5
+printf %s "checking whether the $compiler linker ($LD) supports shared libraries... " >&6; }
 
 runpath_var=
 allow_undefined_flag=
@@ -12235,21 +12887,23 @@
 if test set = "${lt_cv_aix_libpath+set}"; then
 aix_libpath=$lt_cv_aix_libpath
 else
- if ${lt_cv_aix_libpath_+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ if test ${lt_cv_aix_libpath_+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
 
 int
-main ()
+main (void)
 {
 
 ;
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
 
 lt_aix_libpath_sed='
 /Import File Strings/,/^$/ {
@@ -12264,7 +12918,7 @@
 lt_cv_aix_libpath_=`dump -HX64 conftest$ac_exeext 2>/dev/null | $SED -n -e "$lt_aix_libpath_sed"`
 fi
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
 conftest$ac_exeext conftest.$ac_ext
 if test -z "$lt_cv_aix_libpath_"; then
 lt_cv_aix_libpath_=/usr/lib:/lib
@@ -12288,21 +12942,23 @@
 	 if test set = "${lt_cv_aix_libpath+set}"; then
 aix_libpath=$lt_cv_aix_libpath
 else
- if ${lt_cv_aix_libpath_+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ if test ${lt_cv_aix_libpath_+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
 
 int
-main ()
+main (void)
 {
 
 ;
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
 
 lt_aix_libpath_sed='
 /Import File Strings/,/^$/ {
@@ -12317,7 +12973,7 @@
 lt_cv_aix_libpath_=`dump -HX64 conftest$ac_exeext 2>/dev/null | $SED -n -e "$lt_aix_libpath_sed"`
 fi
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
 conftest$ac_exeext conftest.$ac_ext
 if test -z "$lt_cv_aix_libpath_"; then
 lt_cv_aix_libpath_=/usr/lib:/lib
@@ -12568,11 +13224,12 @@
 
 	 # Older versions of the 11.00 compiler do not understand -b yet
 	 # (HP92453-01 A.11.01.20 doesn't, HP92453-01 B.11.X.35175-35176.GP does)
-	 { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $CC understands -b" >&5
-$as_echo_n "checking if $CC understands -b... " >&6; }
-if ${lt_cv_prog_compiler__b+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+	 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking if $CC understands -b" >&5
+printf %s "checking if $CC understands -b... " >&6; }
+if test ${lt_cv_prog_compiler__b+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 lt_cv_prog_compiler__b=no
 save_LDFLAGS=$LDFLAGS
 LDFLAGS="$LDFLAGS -b"
@@ -12596,8 +13253,8 @@
 LDFLAGS=$save_LDFLAGS
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler__b" >&5
-$as_echo "$lt_cv_prog_compiler__b" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_prog_compiler__b" >&5
+printf "%s\n" "$lt_cv_prog_compiler__b" >&6; }
 
 if test yes = "$lt_cv_prog_compiler__b"; then
 archive_cmds='$CC -b $wl+h $wl$soname $wl+b $wl$install_libdir -o $lib $libobjs $deplibs $compiler_flags'
@@ -12637,28 +13294,30 @@
 	# work, assume that -exports_file does not work either and
 	# implicitly export all symbols.
 	# This should be the same for all languages, so no per-tag cache variable.
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the $host_os linker accepts -exported_symbol" >&5
-$as_echo_n "checking whether the $host_os linker accepts -exported_symbol... " >&6; }
-if ${lt_cv_irix_exported_symbol+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the $host_os linker accepts -exported_symbol" >&5
+printf %s "checking whether the $host_os linker accepts -exported_symbol... " >&6; }
+if test ${lt_cv_irix_exported_symbol+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 save_LDFLAGS=$LDFLAGS
 	 LDFLAGS="$LDFLAGS -shared $wl-exported_symbol ${wl}foo $wl-update_registry $wl/dev/null"
 	 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
 int foo (void) { return 0; }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
 lt_cv_irix_exported_symbol=yes
-else
+else $as_nop
 lt_cv_irix_exported_symbol=no
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
 conftest$ac_exeext conftest.$ac_ext
 LDFLAGS=$save_LDFLAGS
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_irix_exported_symbol" >&5
-$as_echo "$lt_cv_irix_exported_symbol" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_irix_exported_symbol" >&5
+printf "%s\n" "$lt_cv_irix_exported_symbol" >&6; }
 	if test yes = "$lt_cv_irix_exported_symbol"; then
 archive_expsym_cmds='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all "$wl-set_version $wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations $wl-exports_file $wl$export_symbols -o $lib'
 	fi
@@ -12939,8 +13598,8 @@
 fi
 fi
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ld_shlibs" >&5
-$as_echo "$ld_shlibs" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ld_shlibs" >&5
+printf "%s\n" "$ld_shlibs" >&6; }
 test no = "$ld_shlibs" && can_build_shared=no
 
 with_gnu_ld=$with_gnu_ld
@@ -12976,18 +13635,19 @@
 # Test whether the compiler implicitly links with -lc since on some
 # systems, -lgcc has to come before -lc. If gcc already passes -lc
 # to ld, don't add -lc before -lgcc.
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether -lc should be explicitly linked in" >&5
-$as_echo_n "checking whether -lc should be explicitly linked in... " >&6; }
-if ${lt_cv_archive_cmds_need_lc+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether -lc should be explicitly linked in" >&5
+printf %s "checking whether -lc should be explicitly linked in... " >&6; }
+if test ${lt_cv_archive_cmds_need_lc+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 $RM conftest*
 	echo "$lt_simple_compile_test_code" > conftest.$ac_ext
 
 	if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5
 (eval $ac_compile) 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; } 2>conftest.err; then
 	 soname=conftest
 	 lib=conftest
@@ -13005,7 +13665,7 @@
 	 if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$archive_cmds 2\>\&1 \| $GREP \" -lc \" \>/dev/null 2\>\&1\""; } >&5
 (eval $archive_cmds 2\>\&1 \| $GREP \" -lc \" \>/dev/null 2\>\&1) 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; }
 	 then
 	 lt_cv_archive_cmds_need_lc=no
@@ -13019,8 +13679,8 @@
 	$RM conftest*
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_archive_cmds_need_lc" >&5
-$as_echo "$lt_cv_archive_cmds_need_lc" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_archive_cmds_need_lc" >&5
+printf "%s\n" "$lt_cv_archive_cmds_need_lc" >&6; }
 archive_cmds_need_lc=$lt_cv_archive_cmds_need_lc
 ;;
 esac
@@ -13179,8 +13839,8 @@
 
 
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking dynamic linker characteristics" >&5
-$as_echo_n "checking dynamic linker characteristics... " >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking dynamic linker characteristics" >&5
+printf %s "checking dynamic linker characteristics... " >&6; }
 
 if test yes = "$GCC"; then
 case $host_os in
@@ -13741,9 +14401,10 @@
 shlibpath_overrides_runpath=no
 
 # Some binutils ld are patched to set DT_RUNPATH
- if ${lt_cv_shlibpath_overrides_runpath+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ if test ${lt_cv_shlibpath_overrides_runpath+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 lt_cv_shlibpath_overrides_runpath=no
 save_LDFLAGS=$LDFLAGS
 save_libdir=$libdir
@@ -13753,19 +14414,21 @@
 /* end confdefs.h. */
 
 int
-main ()
+main (void)
 {
 
 ;
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
- if ($OBJDUMP -p conftest$ac_exeext) 2>/dev/null | grep "RUNPATH.*$libdir" >/dev/null; then :
+if ac_fn_c_try_link "$LINENO"
+then :
+ if ($OBJDUMP -p conftest$ac_exeext) 2>/dev/null | grep "RUNPATH.*$libdir" >/dev/null
+then :
 lt_cv_shlibpath_overrides_runpath=yes
 fi
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
 conftest$ac_exeext conftest.$ac_ext
 LDFLAGS=$save_LDFLAGS
 libdir=$save_libdir
@@ -14009,8 +14672,8 @@
 dynamic_linker=no
 ;;
 esac
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $dynamic_linker" >&5
-$as_echo "$dynamic_linker" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $dynamic_linker" >&5
+printf "%s\n" "$dynamic_linker" >&6; }
 test no = "$dynamic_linker" && can_build_shared=no
 
 variables_saved_for_relink="PATH $shlibpath_var $runpath_var"
@@ -14131,8 +14794,8 @@
 
 
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking how to hardcode library paths into programs" >&5
-$as_echo_n "checking how to hardcode library paths into programs... " >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking how to hardcode library paths into programs" >&5
+printf %s "checking how to hardcode library paths into programs... " >&6; }
 hardcode_action=
 if test -n "$hardcode_libdir_flag_spec" ||
 test -n "$runpath_var" ||
@@ -14156,8 +14819,8 @@
 # directories.
 hardcode_action=unsupported
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $hardcode_action" >&5
-$as_echo "$hardcode_action" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $hardcode_action" >&5
+printf "%s\n" "$hardcode_action" >&6; }
 
 if test relink = "$hardcode_action" ||
 test yes = "$inherit_rpath"; then
@@ -14201,11 +14864,12 @@
 
 darwin*)
 # if libdl is installed we need to link against it
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for dlopen in -ldl" >&5
-$as_echo_n "checking for dlopen in -ldl... " >&6; }
-if ${ac_cv_lib_dl_dlopen+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for dlopen in -ldl" >&5
+printf %s "checking for dlopen in -ldl... " >&6; }
+if test ${ac_cv_lib_dl_dlopen+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 ac_check_lib_save_LIBS=$LIBS
 LIBS="-ldl $LIBS"
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
@@ -14214,32 +14878,31 @@
 /* Override any GCC internal prototype to avoid an error.
 Use char because int might match the return type of a GCC
 builtin and then its argument prototype would still apply. */
-#ifdef __cplusplus
-extern "C"
-#endif
 char dlopen ();
 int
-main ()
+main (void)
 {
 return dlopen ();
 ;
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
 ac_cv_lib_dl_dlopen=yes
-else
+else $as_nop
 ac_cv_lib_dl_dlopen=no
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
 conftest$ac_exeext conftest.$ac_ext
 LIBS=$ac_check_lib_save_LIBS
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_dl_dlopen" >&5
-$as_echo "$ac_cv_lib_dl_dlopen" >&6; }
-if test "x$ac_cv_lib_dl_dlopen" = xyes; then :
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_dl_dlopen" >&5
+printf "%s\n" "$ac_cv_lib_dl_dlopen" >&6; }
+if test "x$ac_cv_lib_dl_dlopen" = xyes
+then :
 lt_cv_dlopen=dlopen lt_cv_dlopen_libs=-ldl
-else
+else $as_nop
 
 lt_cv_dlopen=dyld
 lt_cv_dlopen_libs=
@@ -14259,14 +14922,16 @@
 
 *)
 ac_fn_c_check_func "$LINENO" "shl_load" "ac_cv_func_shl_load"
-if test "x$ac_cv_func_shl_load" = xyes; then :
+if test "x$ac_cv_func_shl_load" = xyes
+then :
 lt_cv_dlopen=shl_load
-else
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for shl_load in -ldld" >&5
-$as_echo_n "checking for shl_load in -ldld... " >&6; }
-if ${ac_cv_lib_dld_shl_load+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+else $as_nop
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for shl_load in -ldld" >&5
+printf %s "checking for shl_load in -ldld... " >&6; }
+if test ${ac_cv_lib_dld_shl_load+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 ac_check_lib_save_LIBS=$LIBS
 LIBS="-ldld $LIBS"
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
@@ -14275,41 +14940,42 @@
 /* Override any GCC internal prototype to avoid an error.
 Use char because int might match the return type of a GCC
 builtin and then its argument prototype would still apply. */
-#ifdef __cplusplus
-extern "C"
-#endif
 char shl_load ();
 int
-main ()
+main (void)
 {
 return shl_load ();
 ;
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
 ac_cv_lib_dld_shl_load=yes
-else
+else $as_nop
 ac_cv_lib_dld_shl_load=no
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
 conftest$ac_exeext conftest.$ac_ext
 LIBS=$ac_check_lib_save_LIBS
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_dld_shl_load" >&5
-$as_echo "$ac_cv_lib_dld_shl_load" >&6; }
-if test "x$ac_cv_lib_dld_shl_load" = xyes; then :
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_dld_shl_load" >&5
+printf "%s\n" "$ac_cv_lib_dld_shl_load" >&6; }
+if test "x$ac_cv_lib_dld_shl_load" = xyes
+then :
 lt_cv_dlopen=shl_load lt_cv_dlopen_libs=-ldld
-else
+else $as_nop
 ac_fn_c_check_func "$LINENO" "dlopen" "ac_cv_func_dlopen"
-if test "x$ac_cv_func_dlopen" = xyes; then :
+if test "x$ac_cv_func_dlopen" = xyes
+then :
 lt_cv_dlopen=dlopen
-else
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for dlopen in -ldl" >&5
-$as_echo_n "checking for dlopen in -ldl... " >&6; }
-if ${ac_cv_lib_dl_dlopen+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+else $as_nop
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for dlopen in -ldl" >&5
+printf %s "checking for dlopen in -ldl... " >&6; }
+if test ${ac_cv_lib_dl_dlopen+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 ac_check_lib_save_LIBS=$LIBS
 LIBS="-ldl $LIBS"
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
@@ -14318,37 +14984,37 @@
 /* Override any GCC internal prototype to avoid an error.
 Use char because int might match the return type of a GCC
 builtin and then its argument prototype would still apply. */
-#ifdef __cplusplus
-extern "C"
-#endif
 char dlopen ();
 int
-main ()
+main (void)
 {
 return dlopen ();
 ;
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
 ac_cv_lib_dl_dlopen=yes
-else
+else $as_nop
 ac_cv_lib_dl_dlopen=no
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
 conftest$ac_exeext conftest.$ac_ext
 LIBS=$ac_check_lib_save_LIBS
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_dl_dlopen" >&5
-$as_echo "$ac_cv_lib_dl_dlopen" >&6; }
-if test "x$ac_cv_lib_dl_dlopen" = xyes; then :
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_dl_dlopen" >&5
+printf "%s\n" "$ac_cv_lib_dl_dlopen" >&6; }
+if test "x$ac_cv_lib_dl_dlopen" = xyes
+then :
 lt_cv_dlopen=dlopen lt_cv_dlopen_libs=-ldl
-else
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for dlopen in -lsvld" >&5
-$as_echo_n "checking for dlopen in -lsvld... " >&6; }
-if ${ac_cv_lib_svld_dlopen+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+else $as_nop
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for dlopen in -lsvld" >&5
+printf %s "checking for dlopen in -lsvld... " >&6; }
+if test ${ac_cv_lib_svld_dlopen+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 ac_check_lib_save_LIBS=$LIBS
 LIBS="-lsvld $LIBS"
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
@@ -14357,37 +15023,37 @@
 /* Override any GCC internal prototype to avoid an error.
 Use char because int might match the return type of a GCC
 builtin and then its argument prototype would still apply. */
-#ifdef __cplusplus
-extern "C"
-#endif
 char dlopen ();
 int
-main ()
+main (void)
 {
 return dlopen ();
 ;
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
 ac_cv_lib_svld_dlopen=yes
-else
+else $as_nop
 ac_cv_lib_svld_dlopen=no
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
 conftest$ac_exeext conftest.$ac_ext
 LIBS=$ac_check_lib_save_LIBS
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_svld_dlopen" >&5
-$as_echo "$ac_cv_lib_svld_dlopen" >&6; }
-if test "x$ac_cv_lib_svld_dlopen" = xyes; then :
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_svld_dlopen" >&5
+printf "%s\n" "$ac_cv_lib_svld_dlopen" >&6; }
+if test "x$ac_cv_lib_svld_dlopen" = xyes
+then :
 lt_cv_dlopen=dlopen lt_cv_dlopen_libs=-lsvld
-else
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for dld_link in -ldld" >&5
-$as_echo_n "checking for dld_link in -ldld... " >&6; }
-if ${ac_cv_lib_dld_dld_link+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+else $as_nop
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for dld_link in -ldld" >&5
+printf %s "checking for dld_link in -ldld... " >&6; }
+if test ${ac_cv_lib_dld_dld_link+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 ac_check_lib_save_LIBS=$LIBS
 LIBS="-ldld $LIBS"
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
@@ -14396,30 +15062,29 @@
 /* Override any GCC internal prototype to avoid an error.
 Use char because int might match the return type of a GCC
 builtin and then its argument prototype would still apply. */
-#ifdef __cplusplus
-extern "C"
-#endif
 char dld_link ();
 int
-main ()
+main (void)
 {
 return dld_link ();
 ;
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
 ac_cv_lib_dld_dld_link=yes
-else
+else $as_nop
 ac_cv_lib_dld_dld_link=no
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
 conftest$ac_exeext conftest.$ac_ext
 LIBS=$ac_check_lib_save_LIBS
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_dld_dld_link" >&5
-$as_echo "$ac_cv_lib_dld_dld_link" >&6; }
-if test "x$ac_cv_lib_dld_dld_link" = xyes; then :
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_dld_dld_link" >&5
+printf "%s\n" "$ac_cv_lib_dld_dld_link" >&6; }
+if test "x$ac_cv_lib_dld_dld_link" = xyes
+then :
 lt_cv_dlopen=dld_link lt_cv_dlopen_libs=-ldld
 fi
 
@@ -14458,11 +15123,12 @@
 save_LIBS=$LIBS
 LIBS="$lt_cv_dlopen_libs $LIBS"
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether a program can dlopen itself" >&5
-$as_echo_n "checking whether a program can dlopen itself... " >&6; }
-if ${lt_cv_dlopen_self+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether a program can dlopen itself" >&5
+printf %s "checking whether a program can dlopen itself... " >&6; }
+if test ${lt_cv_dlopen_self+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 	 if test yes = "$cross_compiling"; then :
 lt_cv_dlopen_self=cross
 else
@@ -14541,7 +15207,7 @@
 if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_link\""; } >&5
 (eval $ac_link) 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; } && test -s "conftest$ac_exeext" 2>/dev/null; then
 (./conftest; exit; ) >&5 2>/dev/null
 lt_status=$?
@@ -14559,16 +15225,17 @@
 
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_dlopen_self" >&5
-$as_echo "$lt_cv_dlopen_self" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_dlopen_self" >&5
+printf "%s\n" "$lt_cv_dlopen_self" >&6; }
 
 if test yes = "$lt_cv_dlopen_self"; then
 wl=$lt_prog_compiler_wl eval LDFLAGS=\"\$LDFLAGS $lt_prog_compiler_static\"
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether a statically linked program can dlopen itself" >&5
-$as_echo_n "checking whether a statically linked program can dlopen itself... " >&6; }
-if ${lt_cv_dlopen_self_static+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether a statically linked program can dlopen itself" >&5
+printf %s "checking whether a statically linked program can dlopen itself... " >&6; }
+if test ${lt_cv_dlopen_self_static+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 	 if test yes = "$cross_compiling"; then :
 lt_cv_dlopen_self_static=cross
 else
@@ -14647,7 +15314,7 @@
 if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_link\""; } >&5
 (eval $ac_link) 2>&5
 ac_status=$?
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 test $ac_status = 0; } && test -s "conftest$ac_exeext" 2>/dev/null; then
 (./conftest; exit; ) >&5 2>/dev/null
 lt_status=$?
@@ -14665,8 +15332,8 @@
 
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_dlopen_self_static" >&5
-$as_echo "$lt_cv_dlopen_self_static" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $lt_cv_dlopen_self_static" >&5
+printf "%s\n" "$lt_cv_dlopen_self_static" >&6; }
 fi
 
 CPPFLAGS=$save_CPPFLAGS
@@ -14704,13 +15371,13 @@
 
 striplib=
 old_striplib=
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether stripping libraries is possible" >&5
-$as_echo_n "checking whether stripping libraries is possible... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether stripping libraries is possible" >&5
+printf %s "checking whether stripping libraries is possible... " >&6; }
 if test -n "$STRIP" && $STRIP -V 2>&1 | $GREP "GNU strip" >/dev/null; then
 test -z "$old_striplib" && old_striplib="$STRIP --strip-debug"
 test -z "$striplib" && striplib="$STRIP --strip-unneeded"
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 else
 # FIXME - insert some real tests, host_os isn't really good enough
 case $host_os in
@@ -14718,16 +15385,16 @@
 if test -n "$STRIP"; then
 striplib="$STRIP -x"
 old_striplib="$STRIP -S"
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 ;;
 *)
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 ;;
 esac
 fi
@@ -14744,13 +15411,13 @@
 
 
 # Report what library types will actually be built
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking if libtool supports shared libraries" >&5
-$as_echo_n "checking if libtool supports shared libraries... " >&6; }
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $can_build_shared" >&5
-$as_echo "$can_build_shared" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking if libtool supports shared libraries" >&5
+printf %s "checking if libtool supports shared libraries... " >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $can_build_shared" >&5
+printf "%s\n" "$can_build_shared" >&6; }
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether to build shared libraries" >&5
-$as_echo_n "checking whether to build shared libraries... " >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether to build shared libraries" >&5
+printf %s "checking whether to build shared libraries... " >&6; }
 test no = "$can_build_shared" && enable_shared=no
 
 # On AIX, shared libraries and static libraries use the same namespace, and
@@ -14774,15 +15441,15 @@
 fi
 ;;
 esac
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $enable_shared" >&5
-$as_echo "$enable_shared" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $enable_shared" >&5
+printf "%s\n" "$enable_shared" >&6; }
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether to build static libraries" >&5
-$as_echo_n "checking whether to build static libraries... " >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether to build static libraries" >&5
+printf %s "checking whether to build static libraries... " >&6; }
 # Make sure either enable_shared or enable_static is yes.
 test yes = "$enable_shared" || enable_static=yes
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $enable_static" >&5
-$as_echo "$enable_static" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $enable_static" >&5
+printf "%s\n" "$enable_static" >&6; }
 
 
 
@@ -14820,16 +15487,14 @@
 
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: **************************************** types" >&5
-$as_echo "$as_me: **************************************** types" >&6;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: **************************************** types" >&5
+printf "%s\n" "$as_me: **************************************** types" >&6;}
 ac_fn_c_find_intX_t "$LINENO" "8" "ac_cv_c_int8_t"
 case $ac_cv_c_int8_t in #(
 no|yes) ;; #(
 *)
 
-cat >>confdefs.h <<_ACEOF
-#define int8_t $ac_cv_c_int8_t
-_ACEOF
+printf "%s\n" "#define int8_t $ac_cv_c_int8_t" >>confdefs.h
 ;;
 esac
 
@@ -14838,9 +15503,7 @@
 no|yes) ;; #(
 *)
 
-cat >>confdefs.h <<_ACEOF
-#define int16_t $ac_cv_c_int16_t
-_ACEOF
+printf "%s\n" "#define int16_t $ac_cv_c_int16_t" >>confdefs.h
 ;;
 esac
 
@@ -14849,9 +15512,7 @@
 no|yes) ;; #(
 *)
 
-cat >>confdefs.h <<_ACEOF
-#define int32_t $ac_cv_c_int32_t
-_ACEOF
+printf "%s\n" "#define int32_t $ac_cv_c_int32_t" >>confdefs.h
 ;;
 esac
 
@@ -14860,9 +15521,7 @@
 no|yes) ;; #(
 *)
 
-cat >>confdefs.h <<_ACEOF
-#define int64_t $ac_cv_c_int64_t
-_ACEOF
+printf "%s\n" "#define int64_t $ac_cv_c_int64_t" >>confdefs.h
 ;;
 esac
 
@@ -14871,12 +15530,10 @@
 no|yes) ;; #(
 *)
 
-$as_echo "#define _UINT8_T 1" >>confdefs.h
+printf "%s\n" "#define _UINT8_T 1" >>confdefs.h
 
 
-cat >>confdefs.h <<_ACEOF
-#define uint8_t $ac_cv_c_uint8_t
-_ACEOF
+printf "%s\n" "#define uint8_t $ac_cv_c_uint8_t" >>confdefs.h
 ;;
 esac
 
@@ -14886,9 +15543,7 @@
 *)
 
 
-cat >>confdefs.h <<_ACEOF
-#define uint16_t $ac_cv_c_uint16_t
-_ACEOF
+printf "%s\n" "#define uint16_t $ac_cv_c_uint16_t" >>confdefs.h
 ;;
 esac
 
@@ -14897,12 +15552,10 @@
 no|yes) ;; #(
 *)
 
-$as_echo "#define _UINT32_T 1" >>confdefs.h
+printf "%s\n" "#define _UINT32_T 1" >>confdefs.h
 
 
-cat >>confdefs.h <<_ACEOF
-#define uint32_t $ac_cv_c_uint32_t
-_ACEOF
+printf "%s\n" "#define uint32_t $ac_cv_c_uint32_t" >>confdefs.h
 ;;
 esac
 
@@ -14911,119 +15564,117 @@
 no|yes) ;; #(
 *)
 
-$as_echo "#define _UINT64_T 1" >>confdefs.h
+printf "%s\n" "#define _UINT64_T 1" >>confdefs.h
 
 
-cat >>confdefs.h <<_ACEOF
-#define uint64_t $ac_cv_c_uint64_t
-_ACEOF
+printf "%s\n" "#define uint64_t $ac_cv_c_uint64_t" >>confdefs.h
 ;;
 esac
 
 ac_fn_c_check_type "$LINENO" "size_t" "ac_cv_type_size_t" "$ac_includes_default"
-if test "x$ac_cv_type_size_t" = xyes; then :
+if test "x$ac_cv_type_size_t" = xyes
+then :
 
-else
+else $as_nop
 
-cat >>confdefs.h <<_ACEOF
-#define size_t unsigned int
-_ACEOF
+printf "%s\n" "#define size_t unsigned int" >>confdefs.h
 
 fi
 
 ac_fn_c_check_type "$LINENO" "ssize_t" "ac_cv_type_ssize_t" "$ac_includes_default"
-if test "x$ac_cv_type_ssize_t" = xyes; then :
+if test "x$ac_cv_type_ssize_t" = xyes
+then :
 
-else
+else $as_nop
 
-cat >>confdefs.h <<_ACEOF
-#define ssize_t int
-_ACEOF
+printf "%s\n" "#define ssize_t int" >>confdefs.h
 
 fi
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for uid_t in sys/types.h" >&5
-$as_echo_n "checking for uid_t in sys/types.h... " >&6; }
-if ${ac_cv_type_uid_t+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for uid_t in sys/types.h" >&5
+printf %s "checking for uid_t in sys/types.h... " >&6; }
+if test ${ac_cv_type_uid_t+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
 #include <sys/types.h>
 
 _ACEOF
 if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
- $EGREP "uid_t" >/dev/null 2>&1; then :
+ $EGREP "uid_t" >/dev/null 2>&1
+then :
 ac_cv_type_uid_t=yes
-else
+else $as_nop
 ac_cv_type_uid_t=no
 fi
-rm -f conftest*
+rm -rf conftest*
 
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_type_uid_t" >&5
-$as_echo "$ac_cv_type_uid_t" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_type_uid_t" >&5
+printf "%s\n" "$ac_cv_type_uid_t" >&6; }
 if test $ac_cv_type_uid_t = no; then
 
-$as_echo "#define uid_t int" >>confdefs.h
+printf "%s\n" "#define uid_t int" >>confdefs.h
 
 
-$as_echo "#define gid_t int" >>confdefs.h
+printf "%s\n" "#define gid_t int" >>confdefs.h
 
 fi
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for socklen_t" >&5
-$as_echo_n "checking for socklen_t... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for socklen_t" >&5
+printf %s "checking for socklen_t... " >&6; }
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
 #include <sys/socket.h>
 
 _ACEOF
 if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
- $EGREP "socklen_t" >/dev/null 2>&1; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
-else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no (defined as int)" >&5
-$as_echo "no (defined as int)" >&6; }
+ $EGREP "socklen_t" >/dev/null 2>&1
+then :
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
+else $as_nop
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no (defined as int)" >&5
+printf "%s\n" "no (defined as int)" >&6; }
 
-$as_echo "#define socklen_t int" >>confdefs.h
+printf "%s\n" "#define socklen_t int" >>confdefs.h
 
 fi
-rm -f conftest*
+rm -rf conftest*
 
 ac_fn_c_check_type "$LINENO" "struct sockaddr_un" "ac_cv_type_struct_sockaddr_un" "#include <sys/un.h>
 "
-if test "x$ac_cv_type_struct_sockaddr_un" = xyes; then :
+if test "x$ac_cv_type_struct_sockaddr_un" = xyes
+then :
 
-cat >>confdefs.h <<_ACEOF
-#define HAVE_STRUCT_SOCKADDR_UN 1
-_ACEOF
+printf "%s\n" "#define HAVE_STRUCT_SOCKADDR_UN 1" >>confdefs.h
 
 
 fi
 
 ac_fn_c_check_type "$LINENO" "struct addrinfo" "ac_cv_type_struct_addrinfo" "#include <netdb.h>
 "
-if test "x$ac_cv_type_struct_addrinfo" = xyes; then :
+if test "x$ac_cv_type_struct_addrinfo" = xyes
+then :
 
-cat >>confdefs.h <<_ACEOF
-#define HAVE_STRUCT_ADDRINFO 1
-_ACEOF
+printf "%s\n" "#define HAVE_STRUCT_ADDRINFO 1" >>confdefs.h
 
 
 fi
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: **************************************** PTY device files" >&5
-$as_echo "$as_me: **************************************** PTY device files" >&6;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: **************************************** PTY device files" >&5
+printf "%s\n" "$as_me: **************************************** PTY device files" >&6;}
 if test "x$cross_compiling" = "xno"; then
- as_ac_File=`$as_echo "ac_cv_file_"/dev/ptmx"" | $as_tr_sh`
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for \"/dev/ptmx\"" >&5
-$as_echo_n "checking for \"/dev/ptmx\"... " >&6; }
-if eval \${$as_ac_File+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ as_ac_File=`printf "%s\n" "ac_cv_file_"/dev/ptmx"" | $as_tr_sh`
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for \"/dev/ptmx\"" >&5
+printf %s "checking for \"/dev/ptmx\"... " >&6; }
+if eval test \${$as_ac_File+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 test "$cross_compiling" = yes &&
 as_fn_error $? "cannot check for file existence when cross compiling" "$LINENO" 5
 if test -r ""/dev/ptmx""; then
@@ -15033,20 +15684,22 @@
 fi
 fi
 eval ac_res=\$$as_ac_File
-	 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
-if eval test \"x\$"$as_ac_File"\" = x"yes"; then :
-
-$as_echo "#define HAVE_DEV_PTMX 1" >>confdefs.h
+	 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
+printf "%s\n" "$ac_res" >&6; }
+if eval test \"x\$"$as_ac_File"\" = x"yes"
+then :
+
+printf "%s\n" "#define HAVE_DEV_PTMX 1" >>confdefs.h
 
 fi
 
- as_ac_File=`$as_echo "ac_cv_file_"/dev/ptc"" | $as_tr_sh`
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for \"/dev/ptc\"" >&5
-$as_echo_n "checking for \"/dev/ptc\"... " >&6; }
-if eval \${$as_ac_File+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ as_ac_File=`printf "%s\n" "ac_cv_file_"/dev/ptc"" | $as_tr_sh`
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for \"/dev/ptc\"" >&5
+printf %s "checking for \"/dev/ptc\"... " >&6; }
+if eval test \${$as_ac_File+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 test "$cross_compiling" = yes &&
 as_fn_error $? "cannot check for file existence when cross compiling" "$LINENO" 5
 if test -r ""/dev/ptc""; then
@@ -15056,52 +15709,54 @@
 fi
 fi
 eval ac_res=\$$as_ac_File
-	 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
-if eval test \"x\$"$as_ac_File"\" = x"yes"; then :
+	 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
+printf "%s\n" "$ac_res" >&6; }
+if eval test \"x\$"$as_ac_File"\" = x"yes"
+then :
 
-$as_echo "#define HAVE_DEV_PTS_AND_PTC 1" >>confdefs.h
+printf "%s\n" "#define HAVE_DEV_PTS_AND_PTC 1" >>confdefs.h
 
 fi
 
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cross-compilation: assuming /dev/ptmx and /dev/ptc are not available" >&5
-$as_echo "$as_me: WARNING: cross-compilation: assuming /dev/ptmx and /dev/ptc are not available" >&2;}
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: cross-compilation: assuming /dev/ptmx and /dev/ptc are not available" >&5
+printf "%s\n" "$as_me: WARNING: cross-compilation: assuming /dev/ptmx and /dev/ptc are not available" >&2;}
 fi
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: **************************************** entropy sources" >&5
-$as_echo "$as_me: **************************************** entropy sources" >&6;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: **************************************** entropy sources" >&5
+printf "%s\n" "$as_me: **************************************** entropy sources" >&6;}
 
 if test "x$cross_compiling" = "xno"; then
 
 # Check whether --with-egd-socket was given.
-if test "${with_egd_socket+set}" = set; then :
+if test ${with_egd_socket+y}
+then :
 withval=$with_egd_socket; EGD_SOCKET="$withval"
 
 fi
 
 if test -n "$EGD_SOCKET"; then
 
-cat >>confdefs.h <<_ACEOF
-#define EGD_SOCKET "$EGD_SOCKET"
-_ACEOF
+printf "%s\n" "#define EGD_SOCKET \"$EGD_SOCKET\"" >>confdefs.h
 
 fi
 
 # Check for user-specified random device
 
 # Check whether --with-random was given.
-if test "${with_random+set}" = set; then :
+if test ${with_random+y}
+then :
 withval=$with_random; RANDOM_FILE="$withval"
-else
+else $as_nop
 
 # Check for random device
- as_ac_File=`$as_echo "ac_cv_file_"/dev/urandom"" | $as_tr_sh`
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for \"/dev/urandom\"" >&5
-$as_echo_n "checking for \"/dev/urandom\"... " >&6; }
-if eval \${$as_ac_File+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ as_ac_File=`printf "%s\n" "ac_cv_file_"/dev/urandom"" | $as_tr_sh`
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for \"/dev/urandom\"" >&5
+printf %s "checking for \"/dev/urandom\"... " >&6; }
+if eval test \${$as_ac_File+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 test "$cross_compiling" = yes &&
 as_fn_error $? "cannot check for file existence when cross compiling" "$LINENO" 5
 if test -r ""/dev/urandom""; then
@@ -15111,9 +15766,10 @@
 fi
 fi
 eval ac_res=\$$as_ac_File
-	 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
-if eval test \"x\$"$as_ac_File"\" = x"yes"; then :
+	 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
+printf "%s\n" "$ac_res" >&6; }
+if eval test \"x\$"$as_ac_File"\" = x"yes"
+then :
 RANDOM_FILE="/dev/urandom"
 fi
 
@@ -15124,43 +15780,43 @@
 if test -n "$RANDOM_FILE"; then
 
 
-cat >>confdefs.h <<_ACEOF
-#define RANDOM_FILE "$RANDOM_FILE"
-_ACEOF
+printf "%s\n" "#define RANDOM_FILE \"$RANDOM_FILE\"" >>confdefs.h
 
 fi
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cross-compilation: assuming entropy sources are not available" >&5
-$as_echo "$as_me: WARNING: cross-compilation: assuming entropy sources are not available" >&2;}
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: cross-compilation: assuming entropy sources are not available" >&5
+printf "%s\n" "$as_me: WARNING: cross-compilation: assuming entropy sources are not available" >&2;}
 fi
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: **************************************** default group" >&5
-$as_echo "$as_me: **************************************** default group" >&6;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: **************************************** default group" >&5
+printf "%s\n" "$as_me: **************************************** default group" >&6;}
 DEFAULT_GROUP=nobody
 if test "x$cross_compiling" = "xno"; then
 grep '^nogroup:' /etc/group >/dev/null && DEFAULT_GROUP=nogroup
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cross-compilation: assuming nogroup is not available" >&5
-$as_echo "$as_me: WARNING: cross-compilation: assuming nogroup is not available" >&2;}
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: cross-compilation: assuming nogroup is not available" >&5
+printf "%s\n" "$as_me: WARNING: cross-compilation: assuming nogroup is not available" >&2;}
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for default group" >&5
-$as_echo_n "checking for default group... " >&6; }
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $DEFAULT_GROUP" >&5
-$as_echo "$DEFAULT_GROUP" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for default group" >&5
+printf %s "checking for default group... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $DEFAULT_GROUP" >&5
+printf "%s\n" "$DEFAULT_GROUP" >&6; }
 
 
 # Check whether --enable-largefile was given.
-if test "${enable_largefile+set}" = set; then :
+if test ${enable_largefile+y}
+then :
 enableval=$enable_largefile;
 fi
 
 if test "$enable_largefile" != no; then
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for special C compiler options needed for large files" >&5
-$as_echo_n "checking for special C compiler options needed for large files... " >&6; }
-if ${ac_cv_sys_largefile_CC+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for special C compiler options needed for large files" >&5
+printf %s "checking for special C compiler options needed for large files... " >&6; }
+if test ${ac_cv_sys_largefile_CC+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 ac_cv_sys_largefile_CC=no
 if test "$GCC" != yes; then
 ac_save_CC=$CC
@@ -15174,44 +15830,47 @@
 We can't simply define LARGE_OFF_T to be 9223372036854775807,
 since some C++ compilers masquerading as C compilers
 incorrectly reject 9223372036854775807. */
-#define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31))
+#define LARGE_OFF_T (((off_t) 1 << 31 << 31) - 1 + ((off_t) 1 << 31 << 31))
 int off_t_is_large(LARGE_OFF_T % 2147483629 == 721
 		 && LARGE_OFF_T % 2147483647 == 1)
 		 ? 1 : -1;
 int
-main ()
+main (void)
 {
 
 ;
 return 0;
 }
 _ACEOF
-	 if ac_fn_c_try_compile "$LINENO"; then :
+	 if ac_fn_c_try_compile "$LINENO"
+then :
 break
 fi
-rm -f core conftest.err conftest.$ac_objext
+rm -f core conftest.err conftest.$ac_objext conftest.beam
 	 CC="$CC -n32"
-	 if ac_fn_c_try_compile "$LINENO"; then :
+	 if ac_fn_c_try_compile "$LINENO"
+then :
 ac_cv_sys_largefile_CC=' -n32'; break
 fi
-rm -f core conftest.err conftest.$ac_objext
+rm -f core conftest.err conftest.$ac_objext conftest.beam
 	 break
 done
 CC=$ac_save_CC
 rm -f conftest.$ac_ext
 fi
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_sys_largefile_CC" >&5
-$as_echo "$ac_cv_sys_largefile_CC" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_sys_largefile_CC" >&5
+printf "%s\n" "$ac_cv_sys_largefile_CC" >&6; }
 if test "$ac_cv_sys_largefile_CC" != no; then
 CC=$CC$ac_cv_sys_largefile_CC
 fi
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for _FILE_OFFSET_BITS value needed for large files" >&5
-$as_echo_n "checking for _FILE_OFFSET_BITS value needed for large files... " >&6; }
-if ${ac_cv_sys_file_offset_bits+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for _FILE_OFFSET_BITS value needed for large files" >&5
+printf %s "checking for _FILE_OFFSET_BITS value needed for large files... " >&6; }
+if test ${ac_cv_sys_file_offset_bits+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 while :; do
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
@@ -15220,22 +15879,23 @@
 We can't simply define LARGE_OFF_T to be 9223372036854775807,
 since some C++ compilers masquerading as C compilers
 incorrectly reject 9223372036854775807. */
-#define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31))
+#define LARGE_OFF_T (((off_t) 1 << 31 << 31) - 1 + ((off_t) 1 << 31 << 31))
 int off_t_is_large(LARGE_OFF_T % 2147483629 == 721
 		 && LARGE_OFF_T % 2147483647 == 1)
 		 ? 1 : -1;
 int
-main ()
+main (void)
 {
 
 ;
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
 ac_cv_sys_file_offset_bits=no; break
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
 #define _FILE_OFFSET_BITS 64
@@ -15244,43 +15904,43 @@
 We can't simply define LARGE_OFF_T to be 9223372036854775807,
 since some C++ compilers masquerading as C compilers
 incorrectly reject 9223372036854775807. */
-#define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31))
+#define LARGE_OFF_T (((off_t) 1 << 31 << 31) - 1 + ((off_t) 1 << 31 << 31))
 int off_t_is_large(LARGE_OFF_T % 2147483629 == 721
 		 && LARGE_OFF_T % 2147483647 == 1)
 		 ? 1 : -1;
 int
-main ()
+main (void)
 {
 
 ;
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
 ac_cv_sys_file_offset_bits=64; break
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 ac_cv_sys_file_offset_bits=unknown
 break
 done
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_sys_file_offset_bits" >&5
-$as_echo "$ac_cv_sys_file_offset_bits" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_sys_file_offset_bits" >&5
+printf "%s\n" "$ac_cv_sys_file_offset_bits" >&6; }
 case $ac_cv_sys_file_offset_bits in #(
 no | unknown) ;;
 *)
-cat >>confdefs.h <<_ACEOF
-#define _FILE_OFFSET_BITS $ac_cv_sys_file_offset_bits
-_ACEOF
+printf "%s\n" "#define _FILE_OFFSET_BITS $ac_cv_sys_file_offset_bits" >>confdefs.h
 ;;
 esac
 rm -rf conftest*
 if test $ac_cv_sys_file_offset_bits = unknown; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for _LARGE_FILES value needed for large files" >&5
-$as_echo_n "checking for _LARGE_FILES value needed for large files... " >&6; }
-if ${ac_cv_sys_large_files+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for _LARGE_FILES value needed for large files" >&5
+printf %s "checking for _LARGE_FILES value needed for large files... " >&6; }
+if test ${ac_cv_sys_large_files+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 while :; do
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
@@ -15289,22 +15949,23 @@
 We can't simply define LARGE_OFF_T to be 9223372036854775807,
 since some C++ compilers masquerading as C compilers
 incorrectly reject 9223372036854775807. */
-#define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31))
+#define LARGE_OFF_T (((off_t) 1 << 31 << 31) - 1 + ((off_t) 1 << 31 << 31))
 int off_t_is_large(LARGE_OFF_T % 2147483629 == 721
 		 && LARGE_OFF_T % 2147483647 == 1)
 		 ? 1 : -1;
 int
-main ()
+main (void)
 {
 
 ;
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
 ac_cv_sys_large_files=no; break
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
 #define _LARGE_FILES 1
@@ -15313,131 +15974,242 @@
 We can't simply define LARGE_OFF_T to be 9223372036854775807,
 since some C++ compilers masquerading as C compilers
 incorrectly reject 9223372036854775807. */
-#define LARGE_OFF_T ((((off_t) 1 << 31) << 31) - 1 + (((off_t) 1 << 31) << 31))
+#define LARGE_OFF_T (((off_t) 1 << 31 << 31) - 1 + ((off_t) 1 << 31 << 31))
 int off_t_is_large(LARGE_OFF_T % 2147483629 == 721
 		 && LARGE_OFF_T % 2147483647 == 1)
 		 ? 1 : -1;
 int
-main ()
+main (void)
 {
 
 ;
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_compile "$LINENO"; then :
+if ac_fn_c_try_compile "$LINENO"
+then :
 ac_cv_sys_large_files=1; break
 fi
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
 ac_cv_sys_large_files=unknown
 break
 done
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_sys_large_files" >&5
-$as_echo "$ac_cv_sys_large_files" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_sys_large_files" >&5
+printf "%s\n" "$ac_cv_sys_large_files" >&6; }
 case $ac_cv_sys_large_files in #(
 no | unknown) ;;
 *)
-cat >>confdefs.h <<_ACEOF
-#define _LARGE_FILES $ac_cv_sys_large_files
-_ACEOF
+printf "%s\n" "#define _LARGE_FILES $ac_cv_sys_large_files" >>confdefs.h
 ;;
 esac
 rm -rf conftest*
 fi
-
-
 fi
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: **************************************** header files" >&5
-$as_echo "$as_me: **************************************** header files" >&6;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: **************************************** header files" >&5
+printf "%s\n" "$as_me: **************************************** header files" >&6;}
 # AC_HEADER_DIRENT
 # AC_HEADER_STDC
 # AC_HEADER_SYS_WAIT
-for ac_header in stdint.h inttypes.h malloc.h ucontext.h pthread.h poll.h \
- tcpd.h stropts.h grp.h unistd.h util.h libutil.h pty.h limits.h
-do :
- as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
-ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default"
-if eval test \"x\$"$as_ac_Header"\" = x"yes"; then :
- cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1
-_ACEOF
+ac_fn_c_check_header_compile "$LINENO" "stdint.h" "ac_cv_header_stdint_h" "$ac_includes_default"
+if test "x$ac_cv_header_stdint_h" = xyes
+then :
+ printf "%s\n" "#define HAVE_STDINT_H 1" >>confdefs.h
 
 fi
+ac_fn_c_check_header_compile "$LINENO" "inttypes.h" "ac_cv_header_inttypes_h" "$ac_includes_default"
+if test "x$ac_cv_header_inttypes_h" = xyes
+then :
+ printf "%s\n" "#define HAVE_INTTYPES_H 1" >>confdefs.h
 
-done
+fi
+ac_fn_c_check_header_compile "$LINENO" "malloc.h" "ac_cv_header_malloc_h" "$ac_includes_default"
+if test "x$ac_cv_header_malloc_h" = xyes
+then :
+ printf "%s\n" "#define HAVE_MALLOC_H 1" >>confdefs.h
 
-for ac_header in sys/types.h sys/select.h sys/poll.h sys/socket.h sys/un.h \
- sys/ioctl.h sys/filio.h sys/resource.h sys/uio.h sys/syscall.h
-do :
- as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
-ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default"
-if eval test \"x\$"$as_ac_Header"\" = x"yes"; then :
- cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1
-_ACEOF
+fi
+ac_fn_c_check_header_compile "$LINENO" "ucontext.h" "ac_cv_header_ucontext_h" "$ac_includes_default"
+if test "x$ac_cv_header_ucontext_h" = xyes
+then :
+ printf "%s\n" "#define HAVE_UCONTEXT_H 1" >>confdefs.h
 
 fi
+ac_fn_c_check_header_compile "$LINENO" "pthread.h" "ac_cv_header_pthread_h" "$ac_includes_default"
+if test "x$ac_cv_header_pthread_h" = xyes
+then :
+ printf "%s\n" "#define HAVE_PTHREAD_H 1" >>confdefs.h
 
-done
+fi
+ac_fn_c_check_header_compile "$LINENO" "poll.h" "ac_cv_header_poll_h" "$ac_includes_default"
+if test "x$ac_cv_header_poll_h" = xyes
+then :
+ printf "%s\n" "#define HAVE_POLL_H 1" >>confdefs.h
 
-for ac_header in linux/sched.h
-do :
- ac_fn_c_check_header_mongrel "$LINENO" "linux/sched.h" "ac_cv_header_linux_sched_h" "$ac_includes_default"
-if test "x$ac_cv_header_linux_sched_h" = xyes; then :
- cat >>confdefs.h <<_ACEOF
-#define HAVE_LINUX_SCHED_H 1
-_ACEOF
+fi
+ac_fn_c_check_header_compile "$LINENO" "tcpd.h" "ac_cv_header_tcpd_h" "$ac_includes_default"
+if test "x$ac_cv_header_tcpd_h" = xyes
+then :
+ printf "%s\n" "#define HAVE_TCPD_H 1" >>confdefs.h
 
 fi
+ac_fn_c_check_header_compile "$LINENO" "stropts.h" "ac_cv_header_stropts_h" "$ac_includes_default"
+if test "x$ac_cv_header_stropts_h" = xyes
+then :
+ printf "%s\n" "#define HAVE_STROPTS_H 1" >>confdefs.h
 
-done
+fi
+ac_fn_c_check_header_compile "$LINENO" "grp.h" "ac_cv_header_grp_h" "$ac_includes_default"
+if test "x$ac_cv_header_grp_h" = xyes
+then :
+ printf "%s\n" "#define HAVE_GRP_H 1" >>confdefs.h
+
+fi
+ac_fn_c_check_header_compile "$LINENO" "unistd.h" "ac_cv_header_unistd_h" "$ac_includes_default"
+if test "x$ac_cv_header_unistd_h" = xyes
+then :
+ printf "%s\n" "#define HAVE_UNISTD_H 1" >>confdefs.h
+
+fi
+ac_fn_c_check_header_compile "$LINENO" "util.h" "ac_cv_header_util_h" "$ac_includes_default"
+if test "x$ac_cv_header_util_h" = xyes
+then :
+ printf "%s\n" "#define HAVE_UTIL_H 1" >>confdefs.h
+
+fi
+ac_fn_c_check_header_compile "$LINENO" "libutil.h" "ac_cv_header_libutil_h" "$ac_includes_default"
+if test "x$ac_cv_header_libutil_h" = xyes
+then :
+ printf "%s\n" "#define HAVE_LIBUTIL_H 1" >>confdefs.h
+
+fi
+ac_fn_c_check_header_compile "$LINENO" "pty.h" "ac_cv_header_pty_h" "$ac_includes_default"
+if test "x$ac_cv_header_pty_h" = xyes
+then :
+ printf "%s\n" "#define HAVE_PTY_H 1" >>confdefs.h
+
+fi
+ac_fn_c_check_header_compile "$LINENO" "limits.h" "ac_cv_header_limits_h" "$ac_includes_default"
+if test "x$ac_cv_header_limits_h" = xyes
+then :
+ printf "%s\n" "#define HAVE_LIMITS_H 1" >>confdefs.h
+
+fi
+
+ac_fn_c_check_header_compile "$LINENO" "sys/types.h" "ac_cv_header_sys_types_h" "$ac_includes_default"
+if test "x$ac_cv_header_sys_types_h" = xyes
+then :
+ printf "%s\n" "#define HAVE_SYS_TYPES_H 1" >>confdefs.h
+
+fi
+ac_fn_c_check_header_compile "$LINENO" "sys/select.h" "ac_cv_header_sys_select_h" "$ac_includes_default"
+if test "x$ac_cv_header_sys_select_h" = xyes
+then :
+ printf "%s\n" "#define HAVE_SYS_SELECT_H 1" >>confdefs.h
+
+fi
+ac_fn_c_check_header_compile "$LINENO" "sys/poll.h" "ac_cv_header_sys_poll_h" "$ac_includes_default"
+if test "x$ac_cv_header_sys_poll_h" = xyes
+then :
+ printf "%s\n" "#define HAVE_SYS_POLL_H 1" >>confdefs.h
+
+fi
+ac_fn_c_check_header_compile "$LINENO" "sys/socket.h" "ac_cv_header_sys_socket_h" "$ac_includes_default"
+if test "x$ac_cv_header_sys_socket_h" = xyes
+then :
+ printf "%s\n" "#define HAVE_SYS_SOCKET_H 1" >>confdefs.h
+
+fi
+ac_fn_c_check_header_compile "$LINENO" "sys/un.h" "ac_cv_header_sys_un_h" "$ac_includes_default"
+if test "x$ac_cv_header_sys_un_h" = xyes
+then :
+ printf "%s\n" "#define HAVE_SYS_UN_H 1" >>confdefs.h
+
+fi
+ac_fn_c_check_header_compile "$LINENO" "sys/ioctl.h" "ac_cv_header_sys_ioctl_h" "$ac_includes_default"
+if test "x$ac_cv_header_sys_ioctl_h" = xyes
+then :
+ printf "%s\n" "#define HAVE_SYS_IOCTL_H 1" >>confdefs.h
+
+fi
+ac_fn_c_check_header_compile "$LINENO" "sys/filio.h" "ac_cv_header_sys_filio_h" "$ac_includes_default"
+if test "x$ac_cv_header_sys_filio_h" = xyes
+then :
+ printf "%s\n" "#define HAVE_SYS_FILIO_H 1" >>confdefs.h
+
+fi
+ac_fn_c_check_header_compile "$LINENO" "sys/resource.h" "ac_cv_header_sys_resource_h" "$ac_includes_default"
+if test "x$ac_cv_header_sys_resource_h" = xyes
+then :
+ printf "%s\n" "#define HAVE_SYS_RESOURCE_H 1" >>confdefs.h
+
+fi
+ac_fn_c_check_header_compile "$LINENO" "sys/uio.h" "ac_cv_header_sys_uio_h" "$ac_includes_default"
+if test "x$ac_cv_header_sys_uio_h" = xyes
+then :
+ printf "%s\n" "#define HAVE_SYS_UIO_H 1" >>confdefs.h
+
+fi
+ac_fn_c_check_header_compile "$LINENO" "sys/syscall.h" "ac_cv_header_sys_syscall_h" "$ac_includes_default"
+if test "x$ac_cv_header_sys_syscall_h" = xyes
+then :
+ printf "%s\n" "#define HAVE_SYS_SYSCALL_H 1" >>confdefs.h
+
+fi
+ac_fn_c_check_header_compile "$LINENO" "sys/param.h" "ac_cv_header_sys_param_h" "$ac_includes_default"
+if test "x$ac_cv_header_sys_param_h" = xyes
+then :
+ printf "%s\n" "#define HAVE_SYS_PARAM_H 1" >>confdefs.h
+
+fi
+
+ac_fn_c_check_header_compile "$LINENO" "linux/sched.h" "ac_cv_header_linux_sched_h" "$ac_includes_default"
+if test "x$ac_cv_header_linux_sched_h" = xyes
+then :
+ printf "%s\n" "#define HAVE_LINUX_SCHED_H 1" >>confdefs.h
+
+fi
 
 ac_fn_c_check_member "$LINENO" "struct msghdr" "msg_control" "ac_cv_member_struct_msghdr_msg_control" "
 $ac_includes_default
 #include <sys/socket.h>
 
 "
-if test "x$ac_cv_member_struct_msghdr_msg_control" = xyes; then :
+if test "x$ac_cv_member_struct_msghdr_msg_control" = xyes
+then :
 
-cat >>confdefs.h <<_ACEOF
-#define HAVE_STRUCT_MSGHDR_MSG_CONTROL 1
-_ACEOF
+printf "%s\n" "#define HAVE_STRUCT_MSGHDR_MSG_CONTROL 1" >>confdefs.h
 
 
-$as_echo "#define HAVE_MSGHDR_MSG_CONTROL 1" >>confdefs.h
+printf "%s\n" "#define HAVE_MSGHDR_MSG_CONTROL 1" >>confdefs.h
 
 fi
 
-for ac_header in linux/netfilter_ipv4.h
-do :
- ac_fn_c_check_header_compile "$LINENO" "linux/netfilter_ipv4.h" "ac_cv_header_linux_netfilter_ipv4_h" "
+ac_fn_c_check_header_compile "$LINENO" "linux/netfilter_ipv4.h" "ac_cv_header_linux_netfilter_ipv4_h" "
 #include <limits.h>
 #include <linux/types.h>
 #include <sys/socket.h>
 #include <netdb.h>
 
 "
-if test "x$ac_cv_header_linux_netfilter_ipv4_h" = xyes; then :
- cat >>confdefs.h <<_ACEOF
-#define HAVE_LINUX_NETFILTER_IPV4_H 1
-_ACEOF
+if test "x$ac_cv_header_linux_netfilter_ipv4_h" = xyes
+then :
+ printf "%s\n" "#define HAVE_LINUX_NETFILTER_IPV4_H 1" >>confdefs.h
 
 fi
 
-done
 
-
-{ $as_echo "$as_me:${as_lineno-$LINENO}: **************************************** libraries" >&5
-$as_echo "$as_me: **************************************** libraries" >&6;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: **************************************** libraries" >&5
+printf "%s\n" "$as_me: **************************************** libraries" >&6;}
 # Checks for standard libraries
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing gethostbyname" >&5
-$as_echo_n "checking for library containing gethostbyname... " >&6; }
-if ${ac_cv_search_gethostbyname+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for library containing gethostbyname" >&5
+printf %s "checking for library containing gethostbyname... " >&6; }
+if test ${ac_cv_search_gethostbyname+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 ac_func_search_save_LIBS=$LIBS
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
@@ -15445,55 +16217,58 @@
 /* Override any GCC internal prototype to avoid an error.
 Use char because int might match the return type of a GCC
 builtin and then its argument prototype would still apply. */
-#ifdef __cplusplus
-extern "C"
-#endif
 char gethostbyname ();
 int
-main ()
+main (void)
 {
 return gethostbyname ();
 ;
 return 0;
 }
 _ACEOF
-for ac_lib in '' nsl; do
+for ac_lib in '' nsl
+do
 if test -z "$ac_lib"; then
 ac_res="none required"
 else
 ac_res=-l$ac_lib
 LIBS="-l$ac_lib $ac_func_search_save_LIBS"
 fi
- if ac_fn_c_try_link "$LINENO"; then :
+ if ac_fn_c_try_link "$LINENO"
+then :
 ac_cv_search_gethostbyname=$ac_res
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
 conftest$ac_exeext
- if ${ac_cv_search_gethostbyname+:} false; then :
+ if test ${ac_cv_search_gethostbyname+y}
+then :
 break
 fi
 done
-if ${ac_cv_search_gethostbyname+:} false; then :
+if test ${ac_cv_search_gethostbyname+y}
+then :
 
-else
+else $as_nop
 ac_cv_search_gethostbyname=no
 fi
 rm conftest.$ac_ext
 LIBS=$ac_func_search_save_LIBS
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_gethostbyname" >&5
-$as_echo "$ac_cv_search_gethostbyname" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_gethostbyname" >&5
+printf "%s\n" "$ac_cv_search_gethostbyname" >&6; }
 ac_res=$ac_cv_search_gethostbyname
-if test "$ac_res" != no; then :
+if test "$ac_res" != no
+then :
 test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
 
 fi
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing yp_get_default_domain" >&5
-$as_echo_n "checking for library containing yp_get_default_domain... " >&6; }
-if ${ac_cv_search_yp_get_default_domain+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for library containing yp_get_default_domain" >&5
+printf %s "checking for library containing yp_get_default_domain... " >&6; }
+if test ${ac_cv_search_yp_get_default_domain+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 ac_func_search_save_LIBS=$LIBS
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
@@ -15501,55 +16276,58 @@
 /* Override any GCC internal prototype to avoid an error.
 Use char because int might match the return type of a GCC
 builtin and then its argument prototype would still apply. */
-#ifdef __cplusplus
-extern "C"
-#endif
 char yp_get_default_domain ();
 int
-main ()
+main (void)
 {
 return yp_get_default_domain ();
 ;
 return 0;
 }
 _ACEOF
-for ac_lib in '' nsl; do
+for ac_lib in '' nsl
+do
 if test -z "$ac_lib"; then
 ac_res="none required"
 else
 ac_res=-l$ac_lib
 LIBS="-l$ac_lib $ac_func_search_save_LIBS"
 fi
- if ac_fn_c_try_link "$LINENO"; then :
+ if ac_fn_c_try_link "$LINENO"
+then :
 ac_cv_search_yp_get_default_domain=$ac_res
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
 conftest$ac_exeext
- if ${ac_cv_search_yp_get_default_domain+:} false; then :
+ if test ${ac_cv_search_yp_get_default_domain+y}
+then :
 break
 fi
 done
-if ${ac_cv_search_yp_get_default_domain+:} false; then :
+if test ${ac_cv_search_yp_get_default_domain+y}
+then :
 
-else
+else $as_nop
 ac_cv_search_yp_get_default_domain=no
 fi
 rm conftest.$ac_ext
 LIBS=$ac_func_search_save_LIBS
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_yp_get_default_domain" >&5
-$as_echo "$ac_cv_search_yp_get_default_domain" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_yp_get_default_domain" >&5
+printf "%s\n" "$ac_cv_search_yp_get_default_domain" >&6; }
 ac_res=$ac_cv_search_yp_get_default_domain
-if test "$ac_res" != no; then :
+if test "$ac_res" != no
+then :
 test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
 
 fi
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing socket" >&5
-$as_echo_n "checking for library containing socket... " >&6; }
-if ${ac_cv_search_socket+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for library containing socket" >&5
+printf %s "checking for library containing socket... " >&6; }
+if test ${ac_cv_search_socket+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 ac_func_search_save_LIBS=$LIBS
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
@@ -15557,55 +16335,58 @@
 /* Override any GCC internal prototype to avoid an error.
 Use char because int might match the return type of a GCC
 builtin and then its argument prototype would still apply. */
-#ifdef __cplusplus
-extern "C"
-#endif
 char socket ();
 int
-main ()
+main (void)
 {
 return socket ();
 ;
 return 0;
 }
 _ACEOF
-for ac_lib in '' socket; do
+for ac_lib in '' socket
+do
 if test -z "$ac_lib"; then
 ac_res="none required"
 else
 ac_res=-l$ac_lib
 LIBS="-l$ac_lib $ac_func_search_save_LIBS"
 fi
- if ac_fn_c_try_link "$LINENO"; then :
+ if ac_fn_c_try_link "$LINENO"
+then :
 ac_cv_search_socket=$ac_res
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
 conftest$ac_exeext
- if ${ac_cv_search_socket+:} false; then :
+ if test ${ac_cv_search_socket+y}
+then :
 break
 fi
 done
-if ${ac_cv_search_socket+:} false; then :
+if test ${ac_cv_search_socket+y}
+then :
 
-else
+else $as_nop
 ac_cv_search_socket=no
 fi
 rm conftest.$ac_ext
 LIBS=$ac_func_search_save_LIBS
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_socket" >&5
-$as_echo "$ac_cv_search_socket" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_socket" >&5
+printf "%s\n" "$ac_cv_search_socket" >&6; }
 ac_res=$ac_cv_search_socket
-if test "$ac_res" != no; then :
+if test "$ac_res" != no
+then :
 test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
 
 fi
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing openpty" >&5
-$as_echo_n "checking for library containing openpty... " >&6; }
-if ${ac_cv_search_openpty+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for library containing openpty" >&5
+printf %s "checking for library containing openpty... " >&6; }
+if test ${ac_cv_search_openpty+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 ac_func_search_save_LIBS=$LIBS
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
@@ -15613,56 +16394,59 @@
 /* Override any GCC internal prototype to avoid an error.
 Use char because int might match the return type of a GCC
 builtin and then its argument prototype would still apply. */
-#ifdef __cplusplus
-extern "C"
-#endif
 char openpty ();
 int
-main ()
+main (void)
 {
 return openpty ();
 ;
 return 0;
 }
 _ACEOF
-for ac_lib in '' util; do
+for ac_lib in '' util
+do
 if test -z "$ac_lib"; then
 ac_res="none required"
 else
 ac_res=-l$ac_lib
 LIBS="-l$ac_lib $ac_func_search_save_LIBS"
 fi
- if ac_fn_c_try_link "$LINENO"; then :
+ if ac_fn_c_try_link "$LINENO"
+then :
 ac_cv_search_openpty=$ac_res
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
 conftest$ac_exeext
- if ${ac_cv_search_openpty+:} false; then :
+ if test ${ac_cv_search_openpty+y}
+then :
 break
 fi
 done
-if ${ac_cv_search_openpty+:} false; then :
+if test ${ac_cv_search_openpty+y}
+then :
 
-else
+else $as_nop
 ac_cv_search_openpty=no
 fi
 rm conftest.$ac_ext
 LIBS=$ac_func_search_save_LIBS
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_openpty" >&5
-$as_echo "$ac_cv_search_openpty" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_openpty" >&5
+printf "%s\n" "$ac_cv_search_openpty" >&6; }
 ac_res=$ac_cv_search_openpty
-if test "$ac_res" != no; then :
+if test "$ac_res" != no
+then :
 test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
 
 fi
 
 # Checks for dynamic loader needed by OpenSSL
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing dlopen" >&5
-$as_echo_n "checking for library containing dlopen... " >&6; }
-if ${ac_cv_search_dlopen+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for library containing dlopen" >&5
+printf %s "checking for library containing dlopen... " >&6; }
+if test ${ac_cv_search_dlopen+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 ac_func_search_save_LIBS=$LIBS
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
@@ -15670,55 +16454,58 @@
 /* Override any GCC internal prototype to avoid an error.
 Use char because int might match the return type of a GCC
 builtin and then its argument prototype would still apply. */
-#ifdef __cplusplus
-extern "C"
-#endif
 char dlopen ();
 int
-main ()
+main (void)
 {
 return dlopen ();
 ;
 return 0;
 }
 _ACEOF
-for ac_lib in '' dl; do
+for ac_lib in '' dl
+do
 if test -z "$ac_lib"; then
 ac_res="none required"
 else
 ac_res=-l$ac_lib
 LIBS="-l$ac_lib $ac_func_search_save_LIBS"
 fi
- if ac_fn_c_try_link "$LINENO"; then :
+ if ac_fn_c_try_link "$LINENO"
+then :
 ac_cv_search_dlopen=$ac_res
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
 conftest$ac_exeext
- if ${ac_cv_search_dlopen+:} false; then :
+ if test ${ac_cv_search_dlopen+y}
+then :
 break
 fi
 done
-if ${ac_cv_search_dlopen+:} false; then :
+if test ${ac_cv_search_dlopen+y}
+then :
 
-else
+else $as_nop
 ac_cv_search_dlopen=no
 fi
 rm conftest.$ac_ext
 LIBS=$ac_func_search_save_LIBS
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_dlopen" >&5
-$as_echo "$ac_cv_search_dlopen" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_dlopen" >&5
+printf "%s\n" "$ac_cv_search_dlopen" >&6; }
 ac_res=$ac_cv_search_dlopen
-if test "$ac_res" != no; then :
+if test "$ac_res" != no
+then :
 test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
 
 fi
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing shl_load" >&5
-$as_echo_n "checking for library containing shl_load... " >&6; }
-if ${ac_cv_search_shl_load+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for library containing shl_load" >&5
+printf %s "checking for library containing shl_load... " >&6; }
+if test ${ac_cv_search_shl_load+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 ac_func_search_save_LIBS=$LIBS
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
@@ -15726,46 +16513,48 @@
 /* Override any GCC internal prototype to avoid an error.
 Use char because int might match the return type of a GCC
 builtin and then its argument prototype would still apply. */
-#ifdef __cplusplus
-extern "C"
-#endif
 char shl_load ();
 int
-main ()
+main (void)
 {
 return shl_load ();
 ;
 return 0;
 }
 _ACEOF
-for ac_lib in '' dld; do
+for ac_lib in '' dld
+do
 if test -z "$ac_lib"; then
 ac_res="none required"
 else
 ac_res=-l$ac_lib
 LIBS="-l$ac_lib $ac_func_search_save_LIBS"
 fi
- if ac_fn_c_try_link "$LINENO"; then :
+ if ac_fn_c_try_link "$LINENO"
+then :
 ac_cv_search_shl_load=$ac_res
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
 conftest$ac_exeext
- if ${ac_cv_search_shl_load+:} false; then :
+ if test ${ac_cv_search_shl_load+y}
+then :
 break
 fi
 done
-if ${ac_cv_search_shl_load+:} false; then :
+if test ${ac_cv_search_shl_load+y}
+then :
 
-else
+else $as_nop
 ac_cv_search_shl_load=no
 fi
 rm conftest.$ac_ext
 LIBS=$ac_func_search_save_LIBS
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_shl_load" >&5
-$as_echo "$ac_cv_search_shl_load" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_shl_load" >&5
+printf "%s\n" "$ac_cv_search_shl_load" >&6; }
 ac_res=$ac_cv_search_shl_load
-if test "$ac_res" != no; then :
+if test "$ac_res" != no
+then :
 test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
 
 fi
@@ -15776,106 +16565,155 @@
 LIBS="$LIBS -lbe -lroot -lbind"
 fi
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: **************************************** library functions" >&5
-$as_echo "$as_me: **************************************** library functions" >&6;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: **************************************** library functions" >&5
+printf "%s\n" "$as_me: **************************************** library functions" >&6;}
 # safe string operations
-for ac_func in snprintf vsnprintf
-do :
- as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
-ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
-if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
- cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
-_ACEOF
+ac_fn_c_check_func "$LINENO" "snprintf" "ac_cv_func_snprintf"
+if test "x$ac_cv_func_snprintf" = xyes
+then :
+ printf "%s\n" "#define HAVE_SNPRINTF 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "vsnprintf" "ac_cv_func_vsnprintf"
+if test "x$ac_cv_func_vsnprintf" = xyes
+then :
+ printf "%s\n" "#define HAVE_VSNPRINTF 1" >>confdefs.h
 
 fi
-done
 
 # pseudoterminal
-for ac_func in openpty _getpty
-do :
- as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
-ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
-if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
- cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
-_ACEOF
+ac_fn_c_check_func "$LINENO" "openpty" "ac_cv_func_openpty"
+if test "x$ac_cv_func_openpty" = xyes
+then :
+ printf "%s\n" "#define HAVE_OPENPTY 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "_getpty" "ac_cv_func__getpty"
+if test "x$ac_cv_func__getpty" = xyes
+then :
+ printf "%s\n" "#define HAVE__GETPTY 1" >>confdefs.h
 
 fi
-done
 
 # Unix
-for ac_func in daemon waitpid wait4 setsid setgroups chroot realpath
-do :
- as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
-ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
-if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
- cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
-_ACEOF
+ac_fn_c_check_func "$LINENO" "daemon" "ac_cv_func_daemon"
+if test "x$ac_cv_func_daemon" = xyes
+then :
+ printf "%s\n" "#define HAVE_DAEMON 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "waitpid" "ac_cv_func_waitpid"
+if test "x$ac_cv_func_waitpid" = xyes
+then :
+ printf "%s\n" "#define HAVE_WAITPID 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "wait4" "ac_cv_func_wait4"
+if test "x$ac_cv_func_wait4" = xyes
+then :
+ printf "%s\n" "#define HAVE_WAIT4 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "setsid" "ac_cv_func_setsid"
+if test "x$ac_cv_func_setsid" = xyes
+then :
+ printf "%s\n" "#define HAVE_SETSID 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "setgroups" "ac_cv_func_setgroups"
+if test "x$ac_cv_func_setgroups" = xyes
+then :
+ printf "%s\n" "#define HAVE_SETGROUPS 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "chroot" "ac_cv_func_chroot"
+if test "x$ac_cv_func_chroot" = xyes
+then :
+ printf "%s\n" "#define HAVE_CHROOT 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "realpath" "ac_cv_func_realpath"
+if test "x$ac_cv_func_realpath" = xyes
+then :
+ printf "%s\n" "#define HAVE_REALPATH 1" >>confdefs.h
 
 fi
-done
 
 # limits
-for ac_func in sysconf getrlimit
-do :
- as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
-ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
-if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
- cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
-_ACEOF
+ac_fn_c_check_func "$LINENO" "sysconf" "ac_cv_func_sysconf"
+if test "x$ac_cv_func_sysconf" = xyes
+then :
+ printf "%s\n" "#define HAVE_SYSCONF 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "getrlimit" "ac_cv_func_getrlimit"
+if test "x$ac_cv_func_getrlimit" = xyes
+then :
+ printf "%s\n" "#define HAVE_GETRLIMIT 1" >>confdefs.h
 
 fi
-done
 
 # threads/reentrant functions
-for ac_func in pthread_sigmask localtime_r
-do :
- as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
-ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
-if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
- cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
-_ACEOF
+ac_fn_c_check_func "$LINENO" "pthread_sigmask" "ac_cv_func_pthread_sigmask"
+if test "x$ac_cv_func_pthread_sigmask" = xyes
+then :
+ printf "%s\n" "#define HAVE_PTHREAD_SIGMASK 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "localtime_r" "ac_cv_func_localtime_r"
+if test "x$ac_cv_func_localtime_r" = xyes
+then :
+ printf "%s\n" "#define HAVE_LOCALTIME_R 1" >>confdefs.h
 
 fi
-done
 
 # threads
-for ac_func in getcontext __makecontext_v2
-do :
- as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
-ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
-if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
- cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
-_ACEOF
+ac_fn_c_check_func "$LINENO" "getcontext" "ac_cv_func_getcontext"
+if test "x$ac_cv_func_getcontext" = xyes
+then :
+ printf "%s\n" "#define HAVE_GETCONTEXT 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "__makecontext_v2" "ac_cv_func___makecontext_v2"
+if test "x$ac_cv_func___makecontext_v2" = xyes
+then :
+ printf "%s\n" "#define HAVE___MAKECONTEXT_V2 1" >>confdefs.h
 
 fi
-done
 
 # sockets
-for ac_func in poll gethostbyname2 endhostent getnameinfo
-do :
- as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
-ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
-if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
- cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
-_ACEOF
+ac_fn_c_check_func "$LINENO" "poll" "ac_cv_func_poll"
+if test "x$ac_cv_func_poll" = xyes
+then :
+ printf "%s\n" "#define HAVE_POLL 1" >>confdefs.h
 
 fi
-done
+ac_fn_c_check_func "$LINENO" "gethostbyname2" "ac_cv_func_gethostbyname2"
+if test "x$ac_cv_func_gethostbyname2" = xyes
+then :
+ printf "%s\n" "#define HAVE_GETHOSTBYNAME2 1" >>confdefs.h
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for getaddrinfo" >&5
-$as_echo_n "checking for getaddrinfo... " >&6; }
+fi
+ac_fn_c_check_func "$LINENO" "endhostent" "ac_cv_func_endhostent"
+if test "x$ac_cv_func_endhostent" = xyes
+then :
+ printf "%s\n" "#define HAVE_ENDHOSTENT 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "getnameinfo" "ac_cv_func_getnameinfo"
+if test "x$ac_cv_func_getnameinfo" = xyes
+then :
+ printf "%s\n" "#define HAVE_GETNAMEINFO 1" >>confdefs.h
+
+fi
+
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for getaddrinfo" >&5
+printf %s "checking for getaddrinfo... " >&6; }
 case "$host_os" in
 *androideabi*)
 # http://stackoverflow.com/questions/7818246/segmentation-fault-in-getaddrinfo
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no (buggy Android implementation)" >&5
-$as_echo "no (buggy Android implementation)" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no (buggy Android implementation)" >&5
+printf "%s\n" "no (buggy Android implementation)" >&6; }
 ;;
 *)
 # Tru64 UNIX has getaddrinfo() but has it renamed in libc as
@@ -15889,7 +16727,7 @@
 #include <netdb.h>
 
 int
-main ()
+main (void)
 {
 
 getaddrinfo(NULL, NULL, NULL, NULL);
@@ -15898,132 +16736,138 @@
 return 0;
 }
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; };
-$as_echo "#define HAVE_GETADDRINFO 1" >>confdefs.h
-
-else
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+if ac_fn_c_try_link "$LINENO"
+then :
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; };
+printf "%s\n" "#define HAVE_GETADDRINFO 1" >>confdefs.h
+
+else $as_nop
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
 conftest$ac_exeext conftest.$ac_ext
 ;;
 esac
 # poll() is not recommended on Mac OS X <= 10.3 and broken on Mac OS X 10.4
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for broken poll() implementation" >&5
-$as_echo_n "checking for broken poll() implementation... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for broken poll() implementation" >&5
+printf %s "checking for broken poll() implementation... " >&6; }
 case "$host_os" in
 darwin0-8.*)
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes (poll() disabled)" >&5
-$as_echo "yes (poll() disabled)" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes (poll() disabled)" >&5
+printf "%s\n" "yes (poll() disabled)" >&6; }
 
-$as_echo "#define BROKEN_POLL 1" >>confdefs.h
+printf "%s\n" "#define BROKEN_POLL 1" >>confdefs.h
 
 ;;
 *)
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 ;;
 esac
 # GNU extensions
-for ac_func in pipe2 accept4
-do :
- as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
-ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
-if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
- cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
-_ACEOF
+ac_fn_c_check_func "$LINENO" "pipe2" "ac_cv_func_pipe2"
+if test "x$ac_cv_func_pipe2" = xyes
+then :
+ printf "%s\n" "#define HAVE_PIPE2 1" >>confdefs.h
+
+fi
+ac_fn_c_check_func "$LINENO" "accept4" "ac_cv_func_accept4"
+if test "x$ac_cv_func_accept4" = xyes
+then :
+ printf "%s\n" "#define HAVE_ACCEPT4 1" >>confdefs.h
 
 fi
-done
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: **************************************** optional features" >&5
-$as_echo "$as_me: **************************************** optional features" >&6;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: **************************************** optional features" >&5
+printf "%s\n" "$as_me: **************************************** optional features" >&6;}
 # Use IPv6?
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether to enable IPv6 support" >&5
-$as_echo_n "checking whether to enable IPv6 support... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether to enable IPv6 support" >&5
+printf %s "checking whether to enable IPv6 support... " >&6; }
 # Check whether --enable-ipv6 was given.
-if test "${enable_ipv6+set}" = set; then :
+if test ${enable_ipv6+y}
+then :
 enableval=$enable_ipv6;
 case "$enableval" in
- yes) { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ yes) { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 
-$as_echo "#define USE_IPv6 1" >>confdefs.h
+printf "%s\n" "#define USE_IPv6 1" >>confdefs.h
 
 ;;
- no) { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ no) { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 ;;
- *) { $as_echo "$as_me:${as_lineno-$LINENO}: result: error" >&5
-$as_echo "error" >&6; }
+ *) { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: error" >&5
+printf "%s\n" "error" >&6; }
 as_fn_error $? "bad value \"${enableval}\"" "$LINENO" 5
 ;;
 esac
 
-else
+else $as_nop
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes (default)" >&5
-$as_echo "yes (default)" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes (default)" >&5
+printf "%s\n" "yes (default)" >&6; }
 
-$as_echo "#define USE_IPv6 1" >>confdefs.h
+printf "%s\n" "#define USE_IPv6 1" >>confdefs.h
 
 
 fi
 
 
 # FIPS Mode
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether to enable FIPS support" >&5
-$as_echo_n "checking whether to enable FIPS support... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether to enable FIPS support" >&5
+printf %s "checking whether to enable FIPS support... " >&6; }
 # Check whether --enable-fips was given.
-if test "${enable_fips+set}" = set; then :
+if test ${enable_fips+y}
+then :
 enableval=$enable_fips;
 case "$enableval" in
- yes) { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ yes) { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 use_fips="yes"
 
-$as_echo "#define USE_FIPS 1" >>confdefs.h
+printf "%s\n" "#define USE_FIPS 1" >>confdefs.h
 
 ;;
- no) { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ no) { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 use_fips="no"
 ;;
- *) { $as_echo "$as_me:${as_lineno-$LINENO}: result: error" >&5
-$as_echo "error" >&6; }
+ *) { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: error" >&5
+printf "%s\n" "error" >&6; }
 as_fn_error $? "bad value \"${enableval}\"" "$LINENO" 5
 ;;
 esac
 
-else
+else $as_nop
 
 use_fips="auto"
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: autodetecting" >&5
-$as_echo "autodetecting" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: autodetecting" >&5
+printf "%s\n" "autodetecting" >&6; }
 
 
 fi
 
 
 # Disable systemd socket activation support
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether to enable systemd socket activation support" >&5
-$as_echo_n "checking whether to enable systemd socket activation support... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether to enable systemd socket activation support" >&5
+printf %s "checking whether to enable systemd socket activation support... " >&6; }
 # Check whether --enable-systemd was given.
-if test "${enable_systemd+set}" = set; then :
+if test ${enable_systemd+y}
+then :
 enableval=$enable_systemd;
 case "$enableval" in
- yes) { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing sd_listen_fds" >&5
-$as_echo_n "checking for library containing sd_listen_fds... " >&6; }
-if ${ac_cv_search_sd_listen_fds+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ yes) { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for library containing sd_listen_fds" >&5
+printf %s "checking for library containing sd_listen_fds... " >&6; }
+if test ${ac_cv_search_sd_listen_fds+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 ac_func_search_save_LIBS=$LIBS
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
@@ -16031,73 +16875,76 @@
 /* Override any GCC internal prototype to avoid an error.
 Use char because int might match the return type of a GCC
 builtin and then its argument prototype would still apply. */
-#ifdef __cplusplus
-extern "C"
-#endif
 char sd_listen_fds ();
 int
-main ()
+main (void)
 {
 return sd_listen_fds ();
 ;
 return 0;
 }
 _ACEOF
-for ac_lib in '' systemd systemd-daemon; do
+for ac_lib in '' systemd systemd-daemon
+do
 if test -z "$ac_lib"; then
 ac_res="none required"
 else
 ac_res=-l$ac_lib
 LIBS="-l$ac_lib $ac_func_search_save_LIBS"
 fi
- if ac_fn_c_try_link "$LINENO"; then :
+ if ac_fn_c_try_link "$LINENO"
+then :
 ac_cv_search_sd_listen_fds=$ac_res
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
 conftest$ac_exeext
- if ${ac_cv_search_sd_listen_fds+:} false; then :
+ if test ${ac_cv_search_sd_listen_fds+y}
+then :
 break
 fi
 done
-if ${ac_cv_search_sd_listen_fds+:} false; then :
+if test ${ac_cv_search_sd_listen_fds+y}
+then :
 
-else
+else $as_nop
 ac_cv_search_sd_listen_fds=no
 fi
 rm conftest.$ac_ext
 LIBS=$ac_func_search_save_LIBS
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_sd_listen_fds" >&5
-$as_echo "$ac_cv_search_sd_listen_fds" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_sd_listen_fds" >&5
+printf "%s\n" "$ac_cv_search_sd_listen_fds" >&6; }
 ac_res=$ac_cv_search_sd_listen_fds
-if test "$ac_res" != no; then :
+if test "$ac_res" != no
+then :
 test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
 
 fi
 
 
-$as_echo "#define USE_SYSTEMD 1" >>confdefs.h
+printf "%s\n" "#define USE_SYSTEMD 1" >>confdefs.h
 
 ;;
- no) { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ no) { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 ;;
- *) { $as_echo "$as_me:${as_lineno-$LINENO}: result: error" >&5
-$as_echo "error" >&6; }
+ *) { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: error" >&5
+printf "%s\n" "error" >&6; }
 as_fn_error $? "Bad value \"${enableval}\"" "$LINENO" 5
 ;;
 esac
 
-else
+else $as_nop
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: autodetecting" >&5
-$as_echo "autodetecting" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: autodetecting" >&5
+printf "%s\n" "autodetecting" >&6; }
 # the library name has changed to -lsystemd in systemd 209
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing sd_listen_fds" >&5
-$as_echo_n "checking for library containing sd_listen_fds... " >&6; }
-if ${ac_cv_search_sd_listen_fds+:} false; then :
- $as_echo_n "(cached) " >&6
-else
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for library containing sd_listen_fds" >&5
+printf %s "checking for library containing sd_listen_fds... " >&6; }
+if test ${ac_cv_search_sd_listen_fds+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
 ac_func_search_save_LIBS=$LIBS
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h. */
@@ -16105,74 +16952,74 @@
 /* Override any GCC internal prototype to avoid an error.
 Use char because int might match the return type of a GCC
 builtin and then its argument prototype would still apply. */
-#ifdef __cplusplus
-extern "C"
-#endif
 char sd_listen_fds ();
 int
-main ()
+main (void)
 {
 return sd_listen_fds ();
 ;
 return 0;
 }
 _ACEOF
-for ac_lib in '' systemd systemd-daemon; do
+for ac_lib in '' systemd systemd-daemon
+do
 if test -z "$ac_lib"; then
 ac_res="none required"
 else
 ac_res=-l$ac_lib
 LIBS="-l$ac_lib $ac_func_search_save_LIBS"
 fi
- if ac_fn_c_try_link "$LINENO"; then :
+ if ac_fn_c_try_link "$LINENO"
+then :
 ac_cv_search_sd_listen_fds=$ac_res
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
 conftest$ac_exeext
- if ${ac_cv_search_sd_listen_fds+:} false; then :
+ if test ${ac_cv_search_sd_listen_fds+y}
+then :
 break
 fi
 done
-if ${ac_cv_search_sd_listen_fds+:} false; then :
+if test ${ac_cv_search_sd_listen_fds+y}
+then :
 
-else
+else $as_nop
 ac_cv_search_sd_listen_fds=no
 fi
 rm conftest.$ac_ext
 LIBS=$ac_func_search_save_LIBS
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_sd_listen_fds" >&5
-$as_echo "$ac_cv_search_sd_listen_fds" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_sd_listen_fds" >&5
+printf "%s\n" "$ac_cv_search_sd_listen_fds" >&6; }
 ac_res=$ac_cv_search_sd_listen_fds
-if test "$ac_res" != no; then :
+if test "$ac_res" != no
+then :
 test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
- for ac_header in systemd/sd-daemon.h
+ for ac_header in systemd/sd-daemon.h
 do :
- ac_fn_c_check_header_mongrel "$LINENO" "systemd/sd-daemon.h" "ac_cv_header_systemd_sd_daemon_h" "$ac_includes_default"
-if test "x$ac_cv_header_systemd_sd_daemon_h" = xyes; then :
- cat >>confdefs.h <<_ACEOF
-#define HAVE_SYSTEMD_SD_DAEMON_H 1
-_ACEOF
+ ac_fn_c_check_header_compile "$LINENO" "systemd/sd-daemon.h" "ac_cv_header_systemd_sd_daemon_h" "$ac_includes_default"
+if test "x$ac_cv_header_systemd_sd_daemon_h" = xyes
+then :
+ printf "%s\n" "#define HAVE_SYSTEMD_SD_DAEMON_H 1" >>confdefs.h
 
 
-$as_echo "#define USE_SYSTEMD 1" >>confdefs.h
+printf "%s\n" "#define USE_SYSTEMD 1" >>confdefs.h
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: systemd support enabled" >&5
-$as_echo "$as_me: systemd support enabled" >&6;}
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: systemd support enabled" >&5
+printf "%s\n" "$as_me: systemd support enabled" >&6;}
 
-else
+else $as_nop
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: systemd header not found" >&5
-$as_echo "$as_me: systemd header not found" >&6;}
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: systemd header not found" >&5
+printf "%s\n" "$as_me: systemd header not found" >&6;}
 
 fi
 
 done
+else $as_nop
 
-else
-
- { $as_echo "$as_me:${as_lineno-$LINENO}: systemd library not found" >&5
-$as_echo "$as_me: systemd library not found" >&6;}
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: systemd library not found" >&5
+printf "%s\n" "$as_me: systemd library not found" >&6;}
 
 fi
 
@@ -16183,34 +17030,35 @@
 
 # Disable use of libwrap (TCP wrappers)
 # it should be the last check!
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether to enable TCP wrappers support" >&5
-$as_echo_n "checking whether to enable TCP wrappers support... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether to enable TCP wrappers support" >&5
+printf %s "checking whether to enable TCP wrappers support... " >&6; }
 # Check whether --enable-libwrap was given.
-if test "${enable_libwrap+set}" = set; then :
+if test ${enable_libwrap+y}
+then :
 enableval=$enable_libwrap;
 case "$enableval" in
- yes) { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
+ yes) { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
 
-$as_echo "#define USE_LIBWRAP 1" >>confdefs.h
+printf "%s\n" "#define USE_LIBWRAP 1" >>confdefs.h
 
 LIBS="$LIBS -lwrap"
 ;;
- no) { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ no) { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 ;;
- *) { $as_echo "$as_me:${as_lineno-$LINENO}: result: error" >&5
-$as_echo "error" >&6; }
+ *) { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: error" >&5
+printf "%s\n" "error" >&6; }
 as_fn_error $? "Bad value \"${enableval}\"" "$LINENO" 5
 ;;
 esac
 
-else
+else $as_nop
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: autodetecting" >&5
-$as_echo "autodetecting" >&6; }
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for hosts_access in -lwrap" >&5
-$as_echo_n "checking for hosts_access in -lwrap... " >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: autodetecting" >&5
+printf "%s\n" "autodetecting" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for hosts_access in -lwrap" >&5
+printf %s "checking for hosts_access in -lwrap... " >&6; }
 valid_LIBS="$LIBS"
 LIBS="$valid_LIBS -lwrap"
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
@@ -16218,7 +17066,7 @@
 
 int hosts_access(); int allow_severity, deny_severity;
 int
-main ()
+main (void)
 {
 hosts_access()
 ;
@@ -16226,69 +17074,70 @@
 }
 
 _ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
+if ac_fn_c_try_link "$LINENO"
+then :
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; };
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; };
 
-$as_echo "#define USE_LIBWRAP 1" >>confdefs.h
+printf "%s\n" "#define USE_LIBWRAP 1" >>confdefs.h
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: libwrap support enabled" >&5
-$as_echo "$as_me: libwrap support enabled" >&6;}
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: libwrap support enabled" >&5
+printf "%s\n" "$as_me: libwrap support enabled" >&6;}
 
-else
+else $as_nop
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 LIBS="$valid_LIBS"
- { $as_echo "$as_me:${as_lineno-$LINENO}: libwrap library not found" >&5
-$as_echo "$as_me: libwrap library not found" >&6;}
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: libwrap library not found" >&5
+printf "%s\n" "$as_me: libwrap library not found" >&6;}
 
 
 fi
-rm -f core conftest.err conftest.$ac_objext \
+rm -f core conftest.err conftest.$ac_objext conftest.beam \
 conftest$ac_exeext conftest.$ac_ext
 
 
 fi
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: **************************************** TLS" >&5
-$as_echo "$as_me: **************************************** TLS" >&6;}
-
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for compiler sysroot" >&5
-$as_echo_n "checking for compiler sysroot... " >&6; }
-if test "x$GCC" = "xyes"; then
- sysroot=`$CC --print-sysroot 2>/dev/null`
-fi
-if test -z "$sysroot" -o "x$sysroot" = "x/"; then
- sysroot=""
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: /" >&5
-$as_echo "/" >&6; }
-else
- SYSROOT="$sysroot"
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $sysroot" >&5
-$as_echo "$sysroot" >&6; }
-fi
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: **************************************** TLS" >&5
+printf "%s\n" "$as_me: **************************************** TLS" >&6;}
 
 check_ssl_dir() { :
 test -n "$1" -a -f "$1/include/openssl/ssl.h" && SSLDIR="$1"
 }
 
-find_ssl_dir() { :
- stunnel_prefix="$prefix"
- test "x$stunnel_prefix" = "xNONE" && stunnel_prefix=$ac_default_prefix
+iterate_ssl_dir() { :
 # OpenSSL directory search order:
 # - the user-specified prefix
 # - common locations for packages built from sources
 # - common locations for non-OS-default package managers
 # - common locations for OS-default package managers
 # - empty prefix
- for main_dir in "$stunnel_prefix" "/usr/local" "/opt" "/opt/local" "/usr/local/opt" "/opt/csw" "/usr/pkg" "/usr/lib" "/usr" ""; do
+ for main_dir in "/usr/local" "/opt" "/opt/local" "/usr/local/opt" "/opt/csw" "/usr/pkg" "/usr/lib" "/usr" ""; do
 for sub_dir in "/ssl" "/openssl" "/ossl" ""; do
- check_ssl_dir "$sysroot$main_dir$sub_dir" && return
+ check_ssl_dir "$1$main_dir$sub_dir" && return 0
 done
 done
+ return 1
+}
+
+find_ssl_dir() { :
+ # try Android *first*
+ case "$host_os" in
+ *androideabi*)
+ iterate_ssl_dir "$ANDROID_NDK/sysroot" && return
+ ;;
+ esac
+
+ test -d "$lt_sysroot" && iterate_ssl_dir "$lt_sysroot" && return
+ test "$prefix" != "NONE" && iterate_ssl_dir "$prefix" && return
+ test -d "$ac_default_prefix" && iterate_ssl_dir "$ac_default_prefix" && return
+ iterate_ssl_dir "" && return
+
+ # try Xcode *last*
 if test -x "/usr/bin/xcrun"; then
 sdk_path=`/usr/bin/xcrun --sdk macosx --show-sdk-path`
 check_ssl_dir "$sdk_path/usr" && return
@@ -16297,68 +17146,84 @@
 }
 
 SSLDIR=""
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for TLS directory" >&5
-$as_echo_n "checking for TLS directory... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for TLS directory" >&5
+printf %s "checking for TLS directory... " >&6; }
 
 # Check whether --with-ssl was given.
-if test "${with_ssl+set}" = set; then :
+if test ${with_ssl+y}
+then :
 withval=$with_ssl; check_ssl_dir "$withval"
-else
+else $as_nop
 find_ssl_dir
 
 fi
 
 if test -z "$SSLDIR"; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: not found" >&5
-$as_echo "not found" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: not found" >&5
+printf "%s\n" "not found" >&6; }
 as_fn_error $? "
 Could not find your TLS library installation dir
 Use --with-ssl option to fix this problem
 " "$LINENO" 5
 fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $SSLDIR" >&5
-$as_echo "$SSLDIR" >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $SSLDIR" >&5
+printf "%s\n" "$SSLDIR" >&6; }
 
 
-cat >>confdefs.h <<_ACEOF
-#define SSLDIR "$SSLDIR"
-_ACEOF
+printf "%s\n" "#define SSLDIR \"$SSLDIR\"" >>confdefs.h
 
 
 valid_CPPFLAGS="$CPPFLAGS"; CPPFLAGS="$CPPFLAGS -I$SSLDIR/include"
 valid_LIBS="$LIBS"; LIBS="$LIBS -L$SSLDIR/lib64 -L$SSLDIR/lib -lssl -lcrypto"
 
-if test "x$use_fips" = "xauto"; then
- for ac_func in FIPS_mode_set
-do :
- ac_fn_c_check_func "$LINENO" "FIPS_mode_set" "ac_cv_func_FIPS_mode_set"
-if test "x$ac_cv_func_FIPS_mode_set" = xyes; then :
- cat >>confdefs.h <<_ACEOF
-#define HAVE_FIPS_MODE_SET 1
-_ACEOF
-
+ac_fn_c_check_func "$LINENO" "FIPS_mode_set" "ac_cv_func_FIPS_mode_set"
+if test "x$ac_cv_func_FIPS_mode_set" = xyes
+then :
+ printf "%s\n" "#define HAVE_FIPS_MODE_SET 1" >>confdefs.h
 
-$as_echo "#define USE_FIPS 1" >>confdefs.h
+fi
+ac_fn_c_check_func "$LINENO" "OSSL_PROVIDER_available" "ac_cv_func_OSSL_PROVIDER_available"
+if test "x$ac_cv_func_OSSL_PROVIDER_available" = xyes
+then :
+ printf "%s\n" "#define HAVE_OSSL_PROVIDER_AVAILABLE 1" >>confdefs.h
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: FIPS support enabled" >&5
-$as_echo "$as_me: FIPS support enabled" >&6;}
+fi
 
-else
+if test "x$use_fips" = "xauto"; then
+ if test "x$ac_cv_func_FIPS_mode_set" = "xyes" -o "x$ac_cv_func_OSSL_PROVIDER_available" = "xyes"; then
 
- { $as_echo "$as_me:${as_lineno-$LINENO}: FIPS support not found" >&5
-$as_echo "$as_me: FIPS support not found" >&6;}
+printf "%s\n" "#define USE_FIPS 1" >>confdefs.h
 
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: FIPS support enabled" >&5
+printf "%s\n" "$as_me: FIPS support enabled" >&6;}
+ else
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: FIPS support not found" >&5
+printf "%s\n" "$as_me: FIPS support not found" >&6;}
+ fi
 fi
-done
 
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether DH parameters need to be updated" >&5
+printf %s "checking whether DH parameters need to be updated... " >&6; }
+# only build src/dhparam.c if sources are located in the current directory
+if test -f src/stunnel.c && ! grep -q " built for $PACKAGE_STRING " src/dhparam.c; then
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+printf "%s\n" "yes" >&6; }
+ $(dirname $0)/makedh.sh "$PACKAGE_STRING" >src/dhparam.c
+ # also update trusted CA certificates
+ curl 'https://ccadb-public.secure.force.com/mozilla/IncludedRootsPEMTxt?TrustBitsInclude=Websites' |
+ sed -e 's/\r//' -e 's/ $//' >tools/ca-certs.pem
+else
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
+printf "%s\n" "no" >&6; }
 fi
 
+SYSROOT="$lt_sysroot"
 CPPFLAGS="$valid_CPPFLAGS"
 LIBS="$valid_LIBS"
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: **************************************** write the results" >&5
-$as_echo "$as_me: **************************************** write the results" >&6;}
-ac_config_files="$ac_config_files Makefile src/Makefile doc/Makefile tools/Makefile tests/Makefile"
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: **************************************** write the results" >&5
+printf "%s\n" "$as_me: **************************************** write the results" >&6;}
+ac_config_files="$ac_config_files Makefile src/Makefile doc/Makefile tools/Makefile tests/Makefile tests/certs/Makefile"
 
 cat >confcache <<\_ACEOF
 # This file is a shell script that caches the results of configure
@@ -16387,8 +17252,8 @@
 case $ac_val in #(
 *${as_nl}*)
 case $ac_var in #(
- *_cv_*) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cache variable $ac_var contains a newline" >&5
-$as_echo "$as_me: WARNING: cache variable $ac_var contains a newline" >&2;} ;;
+ *_cv_*) { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: cache variable $ac_var contains a newline" >&5
+printf "%s\n" "$as_me: WARNING: cache variable $ac_var contains a newline" >&2;} ;;
 esac
 case $ac_var in #(
 _ | IFS | as_nl) ;; #(
@@ -16418,15 +17283,15 @@
 /^ac_cv_env_/b end
 t clear
 :clear
- s/^$^=*$=$.*{}.*$$/test "${\1+set}" = set || &/
+ s/^$^=*$=$.*{}.*$$/test ${\1+y} || &/
 t end
 s/^$^=*$=$.*$$/\1=${\1=\2}/
 :end' >>confcache
 if diff "$cache_file" confcache >/dev/null 2>&1; then :; else
 if test -w "$cache_file"; then
 if test "x$cache_file" != "x/dev/null"; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: updating cache $cache_file" >&5
-$as_echo "$as_me: updating cache $cache_file" >&6;}
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: updating cache $cache_file" >&5
+printf "%s\n" "$as_me: updating cache $cache_file" >&6;}
 if test ! -f "$cache_file" || test -h "$cache_file"; then
 	cat confcache >"$cache_file"
 else
@@ -16440,8 +17305,8 @@
 fi
 fi
 else
- { $as_echo "$as_me:${as_lineno-$LINENO}: not updating unwritable cache $cache_file" >&5
-$as_echo "$as_me: not updating unwritable cache $cache_file" >&6;}
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: not updating unwritable cache $cache_file" >&5
+printf "%s\n" "$as_me: not updating unwritable cache $cache_file" >&6;}
 fi
 fi
 rm -f confcache
@@ -16458,7 +17323,7 @@
 for ac_i in : $LIBOBJS; do test "x$ac_i" = x: && continue
 # 1. Remove the extension, and $U if already installed.
 ac_script='s/\$U\././;s/\.o$//;s/\.obj$//'
- ac_i=`$as_echo "$ac_i" | sed "$ac_script"`
+ ac_i=`printf "%s\n" "$ac_i" | sed "$ac_script"`
 # 2. Prepend LIBOBJDIR. When used with automake>=1.10 LIBOBJDIR
 # will be set to the directory where LIBOBJS objects are built.
 as_fn_append ac_libobjs " \${LIBOBJDIR}$ac_i\$U.$ac_objext"
@@ -16469,14 +17334,14 @@
 LTLIBOBJS=$ac_ltlibobjs
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking that generated files are newer than configure" >&5
-$as_echo_n "checking that generated files are newer than configure... " >&6; }
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking that generated files are newer than configure" >&5
+printf %s "checking that generated files are newer than configure... " >&6; }
 if test -n "$am_sleep_pid"; then
 # Hide warnings about reused PIDs.
 wait $am_sleep_pid 2>/dev/null
 fi
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: done" >&5
-$as_echo "done" >&6; }
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: done" >&5
+printf "%s\n" "done" >&6; }
 if test -n "$EXEEXT"; then
 am__EXEEXT_TRUE=
 am__EXEEXT_FALSE='#'
@@ -16485,10 +17350,6 @@
 am__EXEEXT_FALSE=
 fi
 
-if test -z "${AUTHOR_TESTS_TRUE}" && test -z "${AUTHOR_TESTS_FALSE}"; then
- as_fn_error $? "conditional \"AUTHOR_TESTS\" was never defined.
-Usually this means the macro was only invoked conditionally." "$LINENO" 5
-fi
 if test -z "${AMDEP_TRUE}" && test -z "${AMDEP_FALSE}"; then
 as_fn_error $? "conditional \"AMDEP\" was never defined.
 Usually this means the macro was only invoked conditionally." "$LINENO" 5
@@ -16502,8 +17363,8 @@
 ac_write_fail=0
 ac_clean_files_save=$ac_clean_files
 ac_clean_files="$ac_clean_files $CONFIG_STATUS"
-{ $as_echo "$as_me:${as_lineno-$LINENO}: creating $CONFIG_STATUS" >&5
-$as_echo "$as_me: creating $CONFIG_STATUS" >&6;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: creating $CONFIG_STATUS" >&5
+printf "%s\n" "$as_me: creating $CONFIG_STATUS" >&6;}
 as_write_fail=0
 cat >$CONFIG_STATUS <<_ASEOF || as_write_fail=1
 #! $SHELL
@@ -16526,14 +17387,16 @@
 
 # Be more Bourne compatible
 DUALCASE=1; export DUALCASE # for MKS sh
-if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then :
+as_nop=:
+if test ${ZSH_VERSION+y} && (emulate sh) >/dev/null 2>&1
+then :
 emulate sh
 NULLCMD=:
 # Pre-4.2 versions of Zsh do word splitting on ${1+"$@"}, which
 # is contrary to our usage. Disable this feature.
 alias -g '${1+"$@"}'='"$@"'
 setopt NO_GLOB_SUBST
-else
+else $as_nop
 case `(set -o) 2>/dev/null` in #(
 *posix*) :
 set -o posix ;; #(
@@ -16543,46 +17406,46 @@
 fi
 
 
+
+# Reset variables that may have inherited troublesome values from
+# the environment.
+
+# IFS needs to be set, to space, tab, and newline, in precisely that order.
+# (If _AS_PATH_WALK were called with IFS unset, it would have the
+# side effect of setting IFS to empty, thus disabling word splitting.)
+# Quoting is to prevent editors from complaining about space-tab.
 as_nl='
 '
 export as_nl
-# Printing a long string crashes Solaris 7 /usr/bin/printf.
-as_echo='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\'
-as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo
-as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo$as_echo
-# Prefer a ksh shell builtin over an external printf program on Solaris,
-# but without wasting forks for bash or zsh.
-if test -z "$BASH_VERSION$ZSH_VERSION" \
- && (test "X`print -r -- $as_echo`" = "X$as_echo") 2>/dev/null; then
- as_echo='print -r --'
- as_echo_n='print -rn --'
-elif (test "X`printf %s $as_echo`" = "X$as_echo") 2>/dev/null; then
- as_echo='printf %s\n'
- as_echo_n='printf %s'
-else
- if test "X`(/usr/ucb/echo -n -n $as_echo) 2>/dev/null`" = "X-n $as_echo"; then
- as_echo_body='eval /usr/ucb/echo -n "$1$as_nl"'
- as_echo_n='/usr/ucb/echo -n'
- else
- as_echo_body='eval expr "X$1" : "X\$.*\$"'
- as_echo_n_body='eval
- arg=$1;
- case $arg in #(
- *"$as_nl"*)
-	expr "X$arg" : "X\$.*\$$as_nl";
-	arg=`expr "X$arg" : ".*$as_nl\$.*\$"`;;
- esac;
- expr "X$arg" : "X\$.*\$" | tr -d "$as_nl"
- '
- export as_echo_n_body
- as_echo_n='sh -c $as_echo_n_body as_echo'
- fi
- export as_echo_body
- as_echo='sh -c $as_echo_body as_echo'
-fi
+IFS=" ""	$as_nl"
+
+PS1='$ '
+PS2='> '
+PS4='+ '
+
+# Ensure predictable behavior from utilities with locale-dependent output.
+LC_ALL=C
+export LC_ALL
+LANGUAGE=C
+export LANGUAGE
+
+# We cannot yet rely on "unset" to work, but we need these variables
+# to be unset--not just set to an empty or harmless value--now, to
+# avoid bugs in old shells (e.g. pre-3.0 UWIN ksh). This construct
+# also avoids known problems related to "unset" and subshell syntax
+# in other old shells (e.g. bash 2.01 and pdksh 5.2.14).
+for as_var in BASH_ENV ENV MAIL MAILPATH CDPATH
+do eval test \${$as_var+y} \
+ && ( (unset $as_var) || exit 1) >/dev/null 2>&1 && unset $as_var || :
+done
+
+# Ensure that fds 0, 1, and 2 are open.
+if (exec 3>&0) 2>/dev/null; then :; else exec 0</dev/null; fi
+if (exec 3>&1) 2>/dev/null; then :; else exec 1>/dev/null; fi
+if (exec 3>&2) ; then :; else exec 2>/dev/null; fi
 
 # The user is always right.
-if test "${PATH_SEPARATOR+set}" != set; then
+if ${PATH_SEPARATOR+false} :; then
 PATH_SEPARATOR=:
 (PATH='/bin;/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 && {
 (PATH='/bin:/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 ||
@@ -16591,13 +17454,6 @@
 fi
 
 
-# IFS
-# We need space, tab and new line, in precisely that order. Quoting is
-# there to prevent editors from complaining about space-tab.
-# (If _AS_PATH_WALK were called with IFS unset, it would disable word
-# splitting by setting IFS to empty value.)
-IFS=" ""	$as_nl"
-
 # Find who we are. Look in the path if we contain no directory separator.
 as_myself=
 case $0 in #((
@@ -16606,8 +17462,12 @@
 for as_dir in $PATH
 do
 IFS=$as_save_IFS
- test -z "$as_dir" && as_dir=.
- test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break
+ case $as_dir in #(((
+ '') as_dir=./ ;;
+ */) ;;
+ *) as_dir=$as_dir/ ;;
+ esac
+ test -r "$as_dir$0" && as_myself=$as_dir$0 && break
 done
 IFS=$as_save_IFS
 
@@ -16619,30 +17479,10 @@
 as_myself=$0
 fi
 if test ! -f "$as_myself"; then
- $as_echo "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2
+ printf "%s\n" "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2
 exit 1
 fi
 
-# Unset variables that we do not need and which cause bugs (e.g. in
-# pre-3.0 UWIN ksh). But do not cause bugs in bash 2.01; the "|| exit 1"
-# suppresses any "Segmentation fault" message there. '((' could
-# trigger a bug in pdksh 5.2.14.
-for as_var in BASH_ENV ENV MAIL MAILPATH
-do eval test x\${$as_var+set} = xset \
- && ( (unset $as_var) || exit 1) >/dev/null 2>&1 && unset $as_var || :
-done
-PS1='$ '
-PS2='> '
-PS4='+ '
-
-# NLS nuisances.
-LC_ALL=C
-export LC_ALL
-LANGUAGE=C
-export LANGUAGE
-
-# CDPATH.
-(unset CDPATH) >/dev/null 2>&1 && unset CDPATH
 
 
 # as_fn_error STATUS ERROR LINENO LOG_FD
@@ -16655,13 +17495,14 @@
 as_status=$1; test $as_status -eq 0 && as_status=1
 if test "$4"; then
 as_lineno=${as_lineno-"$3"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
- $as_echo "$as_me:${as_lineno-$LINENO}: error: $2" >&$4
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: $2" >&$4
 fi
- $as_echo "$as_me: error: $2" >&2
+ printf "%s\n" "$as_me: error: $2" >&2
 as_fn_exit $as_status
 } # as_fn_error
 
 
+
 # as_fn_set_status STATUS
 # -----------------------
 # Set $? to STATUS, without forking.
@@ -16688,18 +17529,20 @@
 { eval $1=; unset $1;}
 }
 as_unset=as_fn_unset
+
 # as_fn_append VAR VALUE
 # ----------------------
 # Append the text in VALUE to the end of the definition contained in VAR. Take
 # advantage of any shell optimizations that allow amortized linear growth over
 # repeated appends, instead of the typical quadratic growth present in naive
 # implementations.
-if (eval "as_var=1; as_var+=2; test x\$as_var = x12") 2>/dev/null; then :
+if (eval "as_var=1; as_var+=2; test x\$as_var = x12") 2>/dev/null
+then :
 eval 'as_fn_append ()
 {
 eval $1+=\$2
 }'
-else
+else $as_nop
 as_fn_append ()
 {
 eval $1=\$$1\$2
@@ -16711,12 +17554,13 @@
 # Perform arithmetic evaluation on the ARGs, and store the result in the
 # global $as_val. Take advantage of shells that can avoid forks. The arguments
 # must be portable across $(()) and expr.
-if (eval "test \$(( 1 + 1 )) = 2") 2>/dev/null; then :
+if (eval "test \$(( 1 + 1 )) = 2") 2>/dev/null
+then :
 eval 'as_fn_arith ()
 {
 as_val=$(( $* ))
 }'
-else
+else $as_nop
 as_fn_arith ()
 {
 as_val=`expr "$@" || test $? -eq 1`
@@ -16747,7 +17591,7 @@
 $as_expr X/"$0" : '.*/$^/^/*$/*$' \| \
 	 X"$0" : 'X$//$$' \| \
 	 X"$0" : 'X$/$' \| . 2>/dev/null ||
-$as_echo X/"$0" |
+printf "%s\n" X/"$0" |
 sed '/^.*\/$^/^/*$\/*$/{
 	 s//\1/
 	 q
@@ -16769,6 +17613,10 @@
 as_cr_digits='0123456789'
 as_cr_alnum=$as_cr_Letters$as_cr_digits
 
+
+# Determine whether it's possible to make 'echo' print without a newline.
+# These variables are no longer used directly by Autoconf, but are AC_SUBSTed
+# for compatibility with existing Makefiles.
 ECHO_C= ECHO_N= ECHO_T=
 case `echo -n x` in #(((((
 -n*)
@@ -16782,6 +17630,12 @@
 ECHO_N='-n';;
 esac
 
+# For backward compatibility with old third-party macros, we provide
+# the shell variables $as_echo and $as_echo_n. New code should use
+# AS_ECHO("message") and AS_ECHO_N("message"), respectively.
+as_echo='printf %s\n'
+as_echo_n='printf %s'
+
 rm -f conf$$ conf$$.exe conf$$.file
 if test -d conf$$.dir; then
 rm -f conf$$.dir/conf$$.file
@@ -16823,7 +17677,7 @@
 as_dirs=
 while :; do
 case $as_dir in #(
- *\'*) as_qdir=`$as_echo "$as_dir" | sed "s/'/'\\\\\\\\''/g"`;; #'(
+ *\'*) as_qdir=`printf "%s\n" "$as_dir" | sed "s/'/'\\\\\\\\''/g"`;; #'(
 *) as_qdir=$as_dir;;
 esac
 as_dirs="'$as_qdir' $as_dirs"
@@ -16832,7 +17686,7 @@
 	 X"$as_dir" : 'X$//$^/' \| \
 	 X"$as_dir" : 'X$//$$' \| \
 	 X"$as_dir" : 'X$/$' \| . 2>/dev/null ||
-$as_echo X"$as_dir" |
+printf "%s\n" X"$as_dir" |
 sed '/^X$.*^/$\/\/*^/^/*\/*$/{
 	 s//\1/
 	 q
@@ -16894,8 +17748,8 @@
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by stunnel $as_me 5.48, which was
-generated by GNU Autoconf 2.69. Invocation command line was
+This file was extended by stunnel $as_me 5.69, which was
+generated by GNU Autoconf 2.71. Invocation command line was
 
 CONFIG_FILES = $CONFIG_FILES
 CONFIG_HEADERS = $CONFIG_HEADERS
@@ -16957,14 +17811,16 @@
 Report bugs to the package provider."
 
 _ACEOF
+ac_cs_config=`printf "%s\n" "$ac_configure_args" | sed "$ac_safe_unquote"`
+ac_cs_config_escaped=`printf "%s\n" "$ac_cs_config" | sed "s/^ //; s/'/'\\\\\\\\''/g"`
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
-ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/\\""\`\$/\\\\&/g'`"
+ac_cs_config='$ac_cs_config_escaped'
 ac_cs_version="\\
-stunnel config.status 5.48
-configured by $0, generated by GNU Autoconf 2.69,
+stunnel config.status 5.69
+configured by $0, generated by GNU Autoconf 2.71,
 with options \\"\$ac_cs_config\\"
 
-Copyright (C) 2012 Free Software Foundation, Inc.
+Copyright (C) 2021 Free Software Foundation, Inc.
 This config.status script is free software; the Free Software Foundation
 gives unlimited permission to copy, distribute and modify it."
 
@@ -17004,15 +17860,15 @@
 -recheck | --recheck | --rechec | --reche | --rech | --rec | --re | --r)
 ac_cs_recheck=: ;;
 --version | --versio | --versi | --vers | --ver | --ve | --v | -V )
- $as_echo "$ac_cs_version"; exit ;;
+ printf "%s\n" "$ac_cs_version"; exit ;;
 --config | --confi | --conf | --con | --co | --c )
- $as_echo "$ac_cs_config"; exit ;;
+ printf "%s\n" "$ac_cs_config"; exit ;;
 --debug | --debu | --deb | --de | --d | -d )
 debug=: ;;
 --file | --fil | --fi | --f )
 $ac_shift
 case $ac_optarg in
- *\'*) ac_optarg=`$as_echo "$ac_optarg" | sed "s/'/'\\\\\\\\''/g"` ;;
+ *\'*) ac_optarg=`printf "%s\n" "$ac_optarg" | sed "s/'/'\\\\\\\\''/g"` ;;
 '') as_fn_error $? "missing file argument" ;;
 esac
 as_fn_append CONFIG_FILES " '$ac_optarg'"
@@ -17020,7 +17876,7 @@
 --header | --heade | --head | --hea )
 $ac_shift
 case $ac_optarg in
- *\'*) ac_optarg=`$as_echo "$ac_optarg" | sed "s/'/'\\\\\\\\''/g"` ;;
+ *\'*) ac_optarg=`printf "%s\n" "$ac_optarg" | sed "s/'/'\\\\\\\\''/g"` ;;
 esac
 as_fn_append CONFIG_HEADERS " '$ac_optarg'"
 ac_need_defaults=false;;
@@ -17029,7 +17885,7 @@
 as_fn_error $? "ambiguous option: \`$1'
 Try \`$0 --help' for more information.";;
 --help | --hel | -h )
- $as_echo "$ac_cs_usage"; exit ;;
+ printf "%s\n" "$ac_cs_usage"; exit ;;
 -q | -quiet | --quiet | --quie | --qui | --qu | --q \
 | -silent | --silent | --silen | --sile | --sil | --si | --s)
 ac_cs_silent=: ;;
@@ -17057,7 +17913,7 @@
 if \$ac_cs_recheck; then
 set X $SHELL '$0' $ac_configure_args \$ac_configure_extra_args --no-create --no-recursion
 shift
- \$as_echo "running CONFIG_SHELL=$SHELL \$*" >&6
+ \printf "%s\n" "running CONFIG_SHELL=$SHELL \$*" >&6
 CONFIG_SHELL='$SHELL'
 export CONFIG_SHELL
 exec "\$@"
@@ -17071,7 +17927,7 @@
 sed 'h;s/./-/g;s/^.../## /;s/...$/ ##/;p;x;p;x' <<_ASBOX
 ## Running $as_me. ##
 _ASBOX
- $as_echo "$ac_log"
+ printf "%s\n" "$ac_log"
 } >&5
 
 _ACEOF
@@ -17079,7 +17935,7 @@
 #
 # INIT-COMMANDS
 #
-AMDEP_TRUE="$AMDEP_TRUE" ac_aux_dir="$ac_aux_dir"
+AMDEP_TRUE="$AMDEP_TRUE" MAKE="${MAKE-make}"
 
 
 # The HP-UX ksh and POSIX shell print the target directory to stdout
@@ -17380,6 +18236,7 @@
 "doc/Makefile") CONFIG_FILES="$CONFIG_FILES doc/Makefile" ;;
 "tools/Makefile") CONFIG_FILES="$CONFIG_FILES tools/Makefile" ;;
 "tests/Makefile") CONFIG_FILES="$CONFIG_FILES tests/Makefile" ;;
+ "tests/certs/Makefile") CONFIG_FILES="$CONFIG_FILES tests/certs/Makefile" ;;
 
 *) as_fn_error $? "invalid argument: \`$ac_config_target'" "$LINENO" 5;;
 esac
@@ -17391,9 +18248,9 @@
 # We use the long form for the default assignment because of an extremely
 # bizarre bug on SunOS 4.1.3.
 if $ac_need_defaults; then
- test "${CONFIG_FILES+set}" = set || CONFIG_FILES=$config_files
- test "${CONFIG_HEADERS+set}" = set || CONFIG_HEADERS=$config_headers
- test "${CONFIG_COMMANDS+set}" = set || CONFIG_COMMANDS=$config_commands
+ test ${CONFIG_FILES+y} || CONFIG_FILES=$config_files
+ test ${CONFIG_HEADERS+y} || CONFIG_HEADERS=$config_headers
+ test ${CONFIG_COMMANDS+y} || CONFIG_COMMANDS=$config_commands
 fi
 
 # Have a temporary directory for convenience. Make it in the build tree
@@ -17729,7 +18586,7 @@
 	 esac ||
 	 as_fn_error 1 "cannot find input file: \`$ac_f'" "$LINENO" 5;;
 esac
- case $ac_f in *\'*) ac_f=`$as_echo "$ac_f" | sed "s/'/'\\\\\\\\''/g"`;; esac
+ case $ac_f in *\'*) ac_f=`printf "%s\n" "$ac_f" | sed "s/'/'\\\\\\\\''/g"`;; esac
 as_fn_append ac_file_inputs " '$ac_f'"
 done
 
@@ -17737,17 +18594,17 @@
 # use $as_me), people would be surprised to read:
 # /* config.h. Generated by config.status. */
 configure_input='Generated from '`
-	 $as_echo "$*" | sed 's|^^:*/||;s|:^:*/|, |g'
+	 printf "%s\n" "$*" | sed 's|^^:*/||;s|:^:*/|, |g'
 	`' by configure.'
 if test x"$ac_file" != x-; then
 configure_input="$ac_file. $configure_input"
- { $as_echo "$as_me:${as_lineno-$LINENO}: creating $ac_file" >&5
-$as_echo "$as_me: creating $ac_file" >&6;}
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: creating $ac_file" >&5
+printf "%s\n" "$as_me: creating $ac_file" >&6;}
 fi
 # Neutralize special characters interpreted by sed in replacement strings.
 case $configure_input in #(
 *\&* | *\|* | *\\* )
- ac_sed_conf_input=`$as_echo "$configure_input" |
+ ac_sed_conf_input=`printf "%s\n" "$configure_input" |
 sed 's/\\\\&|/\\\\&/g'`;; #(
 *) ac_sed_conf_input=$configure_input;;
 esac
@@ -17764,7 +18621,7 @@
 	 X"$ac_file" : 'X$//$^/' \| \
 	 X"$ac_file" : 'X$//$$' \| \
 	 X"$ac_file" : 'X$/$' \| . 2>/dev/null ||
-$as_echo X"$ac_file" |
+printf "%s\n" X"$ac_file" |
 sed '/^X$.*^/$\/\/*^/^/*\/*$/{
 	 s//\1/
 	 q
@@ -17788,9 +18645,9 @@
 case "$ac_dir" in
 .) ac_dir_suffix= ac_top_builddir_sub=. ac_top_build_prefix= ;;
 *)
- ac_dir_suffix=/`$as_echo "$ac_dir" | sed 's|^\.\\/||'`
+ ac_dir_suffix=/`printf "%s\n" "$ac_dir" | sed 's|^\.\\/||'`
 # A ".." for each directory in $ac_dir_suffix.
- ac_top_builddir_sub=`$as_echo "$ac_dir_suffix" | sed 's|/^\\/*|/..|g;s|/||'`
+ ac_top_builddir_sub=`printf "%s\n" "$ac_dir_suffix" | sed 's|/^\\/*|/..|g;s|/||'`
 case $ac_top_builddir_sub in
 "") ac_top_builddir_sub=. ac_top_build_prefix= ;;
 *) ac_top_build_prefix=$ac_top_builddir_sub/ ;;
@@ -17852,8 +18709,8 @@
 case `eval "sed -n \"\$ac_sed_dataroot\" $ac_file_inputs"` in
 *datarootdir*) ac_datarootdir_seen=yes;;
 *@datadir@*|*@docdir@*|*@infodir@*|*@localedir@*|*@mandir@*)
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&5
-$as_echo "$as_me: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&2;}
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&5
+printf "%s\n" "$as_me: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&2;}
 _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_datarootdir_hack='
@@ -17897,9 +18754,9 @@
 { ac_out=`sed -n '/\${datarootdir}/p' "$ac_tmp/out"`; test -n "$ac_out"; } &&
 { ac_out=`sed -n '/^	 *datarootdir	 *:*=/p' \
 "$ac_tmp/out"`; test -z "$ac_out"; } &&
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $ac_file contains a reference to the variable \`datarootdir'
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: $ac_file contains a reference to the variable \`datarootdir'
 which seems to be undefined. Please make sure it is defined" >&5
-$as_echo "$as_me: WARNING: $ac_file contains a reference to the variable \`datarootdir'
+printf "%s\n" "$as_me: WARNING: $ac_file contains a reference to the variable \`datarootdir'
 which seems to be undefined. Please make sure it is defined" >&2;}
 
 rm -f "$ac_tmp/stdin"
@@ -17915,20 +18772,20 @@
 #
 if test x"$ac_file" != x-; then
 {
- $as_echo "/* $configure_input */" \
+ printf "%s\n" "/* $configure_input */" >&1 \
 && eval '$AWK -f "$ac_tmp/defines.awk"' "$ac_file_inputs"
 } >"$ac_tmp/config.h" \
 || as_fn_error $? "could not create $ac_file" "$LINENO" 5
 if diff "$ac_file" "$ac_tmp/config.h" >/dev/null 2>&1; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: $ac_file is unchanged" >&5
-$as_echo "$as_me: $ac_file is unchanged" >&6;}
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: $ac_file is unchanged" >&5
+printf "%s\n" "$as_me: $ac_file is unchanged" >&6;}
 else
 rm -f "$ac_file"
 mv "$ac_tmp/config.h" "$ac_file" \
 	|| as_fn_error $? "could not create $ac_file" "$LINENO" 5
 fi
 else
- $as_echo "/* $configure_input */" \
+ printf "%s\n" "/* $configure_input */" >&1 \
 && eval '$AWK -f "$ac_tmp/defines.awk"' "$ac_file_inputs" \
 || as_fn_error $? "could not create -" "$LINENO" 5
 fi
@@ -17948,7 +18805,7 @@
 	 X"$_am_arg" : 'X$//$^/' \| \
 	 X"$_am_arg" : 'X$//$$' \| \
 	 X"$_am_arg" : 'X$/$' \| . 2>/dev/null ||
-$as_echo X"$_am_arg" |
+printf "%s\n" X"$_am_arg" |
 sed '/^X$.*^/$\/\/*^/^/*\/*$/{
 	 s//\1/
 	 q
@@ -17968,8 +18825,8 @@
 	 s/.*/./; q'`/stamp-h$_am_stamp_count
 ;;
 
- :C) { $as_echo "$as_me:${as_lineno-$LINENO}: executing $ac_file commands" >&5
-$as_echo "$as_me: executing $ac_file commands" >&6;}
+ :C) { printf "%s\n" "$as_me:${as_lineno-$LINENO}: executing $ac_file commands" >&5
+printf "%s\n" "$as_me: executing $ac_file commands" >&6;}
 ;;
 esac
 
@@ -17979,29 +18836,35 @@
 # Older Autoconf quotes --file arguments for eval, but not when files
 # are listed without --file. Let's play safe and only enable the eval
 # if we detect the quoting.
- case $CONFIG_FILES in
- *\'*) eval set x "$CONFIG_FILES" ;;
- *) set x $CONFIG_FILES ;;
- esac
+ # TODO: see whether this extra hack can be removed once we start
+ # requiring Autoconf 2.70 or later.
+ case $CONFIG_FILES in #(
+ *\'*) :
+ eval set x "$CONFIG_FILES" ;; #(
+ *) :
+ set x $CONFIG_FILES ;; #(
+ *) :
+ ;;
+esac
 shift
- for mf
+ # Used to flag and report bootstrapping failures.
+ am_rc=0
+ for am_mf
 do
 # Strip MF so we end up with the name of the file.
- mf=`echo "$mf" | sed -e 's/:.*$//'`
- # Check whether this is an Automake generated Makefile or not.
- # We used to match only the files named 'Makefile.in', but
- # some people rename them; so instead we look at the file content.
- # Grep'ing the first line is not enough: some people post-process
- # each Makefile.in and add a new line on top of each file to say so.
- # Grep'ing the whole file is not good either: AIX grep has a line
+ am_mf=`printf "%s\n" "$am_mf" | sed -e 's/:.*$//'`
+ # Check whether this is an Automake generated Makefile which includes
+ # dependency-tracking related rules and includes.
+ # Grep'ing the whole file directly is not great: AIX grep has a line
 # limit of 2048, but all sed's we know have understand at least 4000.
- if sed -n 's,^#.*generated by automake.*,X,p' "$mf" | grep X >/dev/null 2>&1; then
- dirpart=`$as_dirname -- "$mf" ||
-$as_expr X"$mf" : 'X$.*^/$//*^/^/*/*$' \| \
-	 X"$mf" : 'X$//$^/' \| \
-	 X"$mf" : 'X$//$$' \| \
-	 X"$mf" : 'X$/$' \| . 2>/dev/null ||
-$as_echo X"$mf" |
+ sed -n 's,^am--depfiles:.*,X,p' "$am_mf" | grep X >/dev/null 2>&1 \
+ || continue
+ am_dirpart=`$as_dirname -- "$am_mf" ||
+$as_expr X"$am_mf" : 'X$.*^/$//*^/^/*/*$' \| \
+	 X"$am_mf" : 'X$//$^/' \| \
+	 X"$am_mf" : 'X$//$$' \| \
+	 X"$am_mf" : 'X$/$' \| . 2>/dev/null ||
+printf "%s\n" X"$am_mf" |
 sed '/^X$.*^/$\/\/*^/^/*\/*$/{
 	 s//\1/
 	 q
@@ -18019,53 +18882,50 @@
 	 q
 	 }
 	 s/.*/./; q'`
- else
- continue
- fi
- # Extract the definition of DEPDIR, am__include, and am__quote
- # from the Makefile without running 'make'.
- DEPDIR=`sed -n 's/^DEPDIR = //p' < "$mf"`
- test -z "$DEPDIR" && continue
- am__include=`sed -n 's/^am__include = //p' < "$mf"`
- test -z "$am__include" && continue
- am__quote=`sed -n 's/^am__quote = //p' < "$mf"`
- # Find all dependency output files, they are included files with
- # $(DEPDIR) in their names. We invoke sed twice because it is the
- # simplest approach to changing $(DEPDIR) to its actual value in the
- # expansion.
- for file in `sed -n "
- s/^$am__include $am__quote$.*(DEPDIR).*$$am__quote"'$/\1/p' <"$mf" | \
-	 sed -e 's/\$(DEPDIR)/'"$DEPDIR"'/g'`; do
- # Make sure the directory exists.
- test -f "$dirpart/$file" && continue
- fdir=`$as_dirname -- "$file" ||
-$as_expr X"$file" : 'X$.*^/$//*^/^/*/*$' \| \
-	 X"$file" : 'X$//$^/' \| \
-	 X"$file" : 'X$//$$' \| \
-	 X"$file" : 'X$/$' \| . 2>/dev/null ||
-$as_echo X"$file" |
- sed '/^X$.*^/$\/\/*^/^/*\/*$/{
-	 s//\1/
-	 q
-	 }
-	 /^X$\/\/$^/.*/{
+ am_filepart=`$as_basename -- "$am_mf" ||
+$as_expr X/"$am_mf" : '.*/$^/^/*$/*$' \| \
+	 X"$am_mf" : 'X$//$$' \| \
+	 X"$am_mf" : 'X$/$' \| . 2>/dev/null ||
+printf "%s\n" X/"$am_mf" |
+ sed '/^.*\/$^/^/*$\/*$/{
 	 s//\1/
 	 q
 	 }
-	 /^X$\/\/$$/{
+	 /^X\/$\/\/$$/{
 	 s//\1/
 	 q
 	 }
-	 /^X$\/$.*/{
+	 /^X\/$\/$.*/{
 	 s//\1/
 	 q
 	 }
 	 s/.*/./; q'`
- as_dir=$dirpart/$fdir; as_fn_mkdir_p
- # echo "creating $dirpart/$file"
- echo '# dummy' > "$dirpart/$file"
- done
+ { echo "$as_me:$LINENO: cd "$am_dirpart" \
+ && sed -e '/# am--include-marker/d' "$am_filepart" \
+ | $MAKE -f - am--depfiles" >&5
+ (cd "$am_dirpart" \
+ && sed -e '/# am--include-marker/d' "$am_filepart" \
+ | $MAKE -f - am--depfiles) >&5 2>&5
+ ac_status=$?
+ echo "$as_me:$LINENO: \$? = $ac_status" >&5
+ (exit $ac_status); } || am_rc=$?
 done
+ if test $am_rc -ne 0; then
+ { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;}
+as_fn_error $? "Something went wrong bootstrapping makefile fragments
+ for automatic dependency tracking. If GNU make was not used, consider
+ re-running the configure script with MAKE=\"gmake\" (or whatever is
+ necessary). You can also try re-running configure with the
+ '--disable-dependency-tracking' option to at least be able to build
+ the package (albeit without support for automatic dependency tracking).
+See \`config.log' for more details" "$LINENO" 5; }
+ fi
+ { am_dirpart=; unset am_dirpart;}
+ { am_filepart=; unset am_filepart;}
+ { am_mf=; unset am_mf;}
+ { am_rc=; unset am_rc;}
+ rm -f conftest-deps.mk
 }
 ;;
 "libtool":C)
@@ -18595,6 +19455,7 @@
 esac
 
 
+
 ltmain=$ac_aux_dir/ltmain.sh
 
 
@@ -18644,12 +19505,13 @@
 $ac_cs_success || as_fn_exit 1
 fi
 if test -n "$ac_unrecognized_opts" && test "$enable_option_checking" != no; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: unrecognized options: $ac_unrecognized_opts" >&5
-$as_echo "$as_me: WARNING: unrecognized options: $ac_unrecognized_opts" >&2;}
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: unrecognized options: $ac_unrecognized_opts" >&5
+printf "%s\n" "$as_me: WARNING: unrecognized options: $ac_unrecognized_opts" >&2;}
 fi
 
 
-{ $as_echo "$as_me:${as_lineno-$LINENO}: **************************************** success" >&5
-$as_echo "$as_me: **************************************** success" >&6;}
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: **************************************** success" >&5
+printf "%s\n" "$as_me: **************************************** success" >&6;}
 # vim:ft=automake
 # End of configure.ac
+

_service:tar_scm:stunnel-5.48.tar.gz/configure.ac -> _service:tar_scm:stunnel-5.69.tar.gz/configure.ac Changed

@@ -1,14 +1,13 @@
 # Process this file with autoconf to produce a configure script.
 
-AC_INIT(stunnel,5.48)
+AC_INIT(stunnel,5.69)
 AC_MSG_NOTICE(**************************************** initialization)
 AC_CONFIG_AUX_DIR(auto)
 AC_CONFIG_MACRO_DIR(m4)
 AC_CONFIG_HEADERS(src/config.h)
 AC_CONFIG_SRCDIR(src/stunnel.c)
-AM_INIT_AUTOMAKE
+AM_INIT_AUTOMAKE(foreign)
 
-AM_CONDITIONAL(AUTHOR_TESTS, test -d ".git")
 AC_CANONICAL_HOST
 AC_SUBST(host)
 AC_DEFINE_UNQUOTED(HOST, "$host", Host description)
@@ -29,13 +28,25 @@
 ;;
 esac
 
-AC_PROG_CC
+AC_PROG_CC(gcc clang cl cc)
 AM_PROG_CC_C_O
 AC_PROG_INSTALL
 AC_PROG_MAKE_SET
 # silent build by default
 ifdef(AM_SILENT_RULES, AM_SILENT_RULES(yes))
 
+AC_MSG_NOTICE(**************************************** bash completion)
+# define a dummy PKG_CHECK_VAR if pkg-config is not installed
+m4_ifndef(PKG_CHECK_VAR, AC_DEFUN(PKG_CHECK_VAR, false))
+
+AC_ARG_WITH(bashcompdir,
+ AS_HELP_STRING(--with-bashcompdir=DIR, directory for bash completions), ,
+ PKG_CHECK_VAR(with_bashcompdir, bash-completion, completionsdir, ,
+ with_bashcompdir="${datarootdir}/bash-completion/completions"))
+AC_MSG_CHECKING(for bashcompdir)
+AC_MSG_RESULT($with_bashcompdir)
+AC_SUBST(bashcompdir, $with_bashcompdir)
+
 AC_MSG_NOTICE(**************************************** thread model)
 # thread detection should be done first, as it may change the CC variable
 
@@ -184,7 +195,8 @@
 AC_CHECK_HEADERS(stdint.h inttypes.h malloc.h ucontext.h pthread.h poll.h \
 tcpd.h stropts.h grp.h unistd.h util.h libutil.h pty.h limits.h)
 AC_CHECK_HEADERS(sys/types.h sys/select.h sys/poll.h sys/socket.h sys/un.h \
- sys/ioctl.h sys/filio.h sys/resource.h sys/uio.h sys/syscall.h)
+ sys/ioctl.h sys/filio.h sys/resource.h sys/uio.h sys/syscall.h \
+ sys/param.h)
 AC_CHECK_HEADERS(linux/sched.h)
 AC_CHECK_MEMBERS(struct msghdr.msg_control,
 AC_DEFINE(HAVE_MSGHDR_MSG_CONTROL, 1,
@@ -192,7 +204,7 @@
 AC_INCLUDES_DEFAULT
 #include <sys/socket.h>
 )
-AC_CHECK_HEADERS(linux/netfilter_ipv4.h, , , 
+AC_CHECK_HEADERS(linux/netfilter_ipv4.h, , ,
 
 #include <limits.h>
 #include <linux/types.h>
@@ -299,7 +311,7 @@
 --disable-fips disable OpenSSL FIPS support,
 
 case "$enableval" in
- yes) AC_MSG_RESULT(no)
+ yes) AC_MSG_RESULT(yes)
 use_fips="yes"
 AC_DEFINE(USE_FIPS, 1,
 Define to 1 to enable OpenSSL FIPS support)
@@ -397,36 +409,39 @@
 
 AC_MSG_NOTICE(**************************************** TLS)
 
-AC_MSG_CHECKING(for compiler sysroot)
-if test "x$GCC" = "xyes"; then
- sysroot=`$CC --print-sysroot 2>/dev/null`
-fi
-if test -z "$sysroot" -o "x$sysroot" = "x/"; then
- sysroot=""
- AC_MSG_RESULT(/)
-else
- SYSROOT="$sysroot"
- AC_MSG_RESULT($sysroot)
-fi
-
 check_ssl_dir() { :
 test -n "$1" -a -f "$1/include/openssl/ssl.h" && SSLDIR="$1"
 }
 
-find_ssl_dir() { :
- stunnel_prefix="$prefix"
- test "x$stunnel_prefix" = "xNONE" && stunnel_prefix=$ac_default_prefix
+iterate_ssl_dir() { :
 # OpenSSL directory search order:
 # - the user-specified prefix
 # - common locations for packages built from sources
 # - common locations for non-OS-default package managers
 # - common locations for OS-default package managers
 # - empty prefix
- for main_dir in "$stunnel_prefix" "/usr/local" "/opt" "/opt/local" "/usr/local/opt" "/opt/csw" "/usr/pkg" "/usr/lib" "/usr" ""; do
+ for main_dir in "/usr/local" "/opt" "/opt/local" "/usr/local/opt" "/opt/csw" "/usr/pkg" "/usr/lib" "/usr" ""; do
 for sub_dir in "/ssl" "/openssl" "/ossl" ""; do
- check_ssl_dir "$sysroot$main_dir$sub_dir" && return
+ check_ssl_dir "$1$main_dir$sub_dir" && return 0
 done
 done
+ return 1
+}
+
+find_ssl_dir() { :
+ # try Android *first*
+ case "$host_os" in
+ *androideabi*)
+ iterate_ssl_dir "$ANDROID_NDK/sysroot" && return
+ ;;
+ esac
+
+ test -d "$lt_sysroot" && iterate_ssl_dir "$lt_sysroot" && return
+ test "$prefix" != "NONE" && iterate_ssl_dir "$prefix" && return
+ test -d "$ac_default_prefix" && iterate_ssl_dir "$ac_default_prefix" && return
+ iterate_ssl_dir "" && return
+
+ # try Xcode *last*
 if test -x "/usr/bin/xcrun"; then
 sdk_path=`/usr/bin/xcrun --sdk macosx --show-sdk-path`
 check_ssl_dir "$sdk_path/usr" && return
@@ -446,7 +461,7 @@
 AC_MSG_ERROR(
 Could not find your TLS library installation dir
 Use --with-ssl option to fix this problem
-) 
+)
 fi
 AC_MSG_RESULT($SSLDIR)
 AC_SUBST(SSLDIR)
@@ -455,20 +470,34 @@
 valid_CPPFLAGS="$CPPFLAGS"; CPPFLAGS="$CPPFLAGS -I$SSLDIR/include"
 valid_LIBS="$LIBS"; LIBS="$LIBS -L$SSLDIR/lib64 -L$SSLDIR/lib -lssl -lcrypto"
 
+AC_CHECK_FUNCS(FIPS_mode_set OSSL_PROVIDER_available)
 if test "x$use_fips" = "xauto"; then
- AC_CHECK_FUNCS(FIPS_mode_set, 
+ if test "x$ac_cv_func_FIPS_mode_set" = "xyes" -o "x$ac_cv_func_OSSL_PROVIDER_available" = "xyes"; then
 AC_DEFINE(USE_FIPS, 1, Define to 1 to enable OpenSSL FIPS support)
 AC_MSG_NOTICE(FIPS support enabled)
- , 
+ else
 AC_MSG_NOTICE(FIPS support not found)
- )
+ fi
+fi
+
+AC_MSG_CHECKING(whether DH parameters need to be updated)
+# only build src/dhparam.c if sources are located in the current directory
+if test -f src/stunnel.c && ! grep -q " built for $PACKAGE_STRING " src/dhparam.c; then
+ AC_MSG_RESULT(yes)
+ $(dirname $0)/makedh.sh "$PACKAGE_STRING" >src/dhparam.c
+ # also update trusted CA certificates
+ curl 'https://ccadb-public.secure.force.com/mozilla/IncludedRootsPEMTxt?TrustBitsInclude=Websites' |
+ sed -e 's/\r//' -e 's/ $//' >tools/ca-certs.pem
+else
+ AC_MSG_RESULT(no)
 fi
 
+SYSROOT="$lt_sysroot"
 CPPFLAGS="$valid_CPPFLAGS"
 LIBS="$valid_LIBS"
 
 AC_MSG_NOTICE(**************************************** write the results)
-AC_CONFIG_FILES(Makefile src/Makefile doc/Makefile tools/Makefile tests/Makefile)
+AC_CONFIG_FILES(Makefile src/Makefile doc/Makefile tools/Makefile tests/Makefile tests/certs/Makefile)
 AC_OUTPUT
 
 AC_MSG_NOTICE(**************************************** success)

_service:tar_scm:stunnel-5.48.tar.gz/doc/Makefile.am -> _service:tar_scm:stunnel-5.69.tar.gz/doc/Makefile.am Changed

_service:tar_scm:stunnel-5.48.tar.gz/doc/Makefile.in -> _service:tar_scm:stunnel-5.69.tar.gz/doc/Makefile.in Changed

@@ -1,7 +1,7 @@
-# Makefile.in generated by automake 1.15 from Makefile.am.
+# Makefile.in generated by automake 1.16.5 from Makefile.am.
 # @configure_input@
 
-# Copyright (C) 1994-2014 Free Software Foundation, Inc.
+# Copyright (C) 1994-2021 Free Software Foundation, Inc.
 
 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -14,7 +14,7 @@
 
 @SET_MAKE@
 
-# by Michal Trojnara 1998-2018
+# by Michal Trojnara 1998-2023
 
 VPATH = @srcdir@
 am__is_gnu_make = { \
@@ -170,6 +170,8 @@
 CFLAGS = @CFLAGS@
 CPP = @CPP@
 CPPFLAGS = @CPPFLAGS@
+CSCOPE = @CSCOPE@
+CTAGS = @CTAGS@
 CYGPATH_W = @CYGPATH_W@
 DEFAULT_GROUP = @DEFAULT_GROUP@
 DEFS = @DEFS@
@@ -181,6 +183,7 @@
 ECHO_N = @ECHO_N@
 ECHO_T = @ECHO_T@
 EGREP = @EGREP@
+ETAGS = @ETAGS@
 EXEEXT = @EXEEXT@
 FGREP = @FGREP@
 GREP = @GREP@
@@ -218,6 +221,7 @@
 PATH_SEPARATOR = @PATH_SEPARATOR@
 PTHREAD_CC = @PTHREAD_CC@
 PTHREAD_CFLAGS = @PTHREAD_CFLAGS@
+PTHREAD_CXX = @PTHREAD_CXX@
 PTHREAD_LIBS = @PTHREAD_LIBS@
 RANDOM_FILE = @RANDOM_FILE@
 RANLIB = @RANLIB@
@@ -240,6 +244,7 @@
 am__tar = @am__tar@
 am__untar = @am__untar@
 ax_pthread_config = @ax_pthread_config@
+bashcompdir = @bashcompdir@
 bindir = @bindir@
 build = @build@
 build_alias = @build_alias@
@@ -285,11 +290,13 @@
 	stunnel.pl.pod.in stunnel.pl.8.in stunnel.pl.html.in pl
 man_MANS = stunnel.8 stunnel.pl.8
 doc_DATA = stunnel.html stunnel.pl.html
-CLEANFILES = $(man_MANS) $(doc_DATA)
+CLEANFILES = $(man_MANS)
+DISTCLEANFILES = $(doc_DATA)
 SUFFIXES = .pod.in .8.in .html.in
 edit = sed \
 	-e 's|@bindir@|$(bindir)|g' \
 	-e 's|@sysconfdir@|$(sysconfdir)|g' \
+	-e 's|\\f(CI@sysconfdir\\fI@|$(sysconfdir)|g' \
 	-e '\|^<link rev="made" href="|d'
 
 all: all-am
@@ -305,16 +312,16 @@
 	 exit 1;; \
 	 esac; \
 	done; \
-	echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu doc/Makefile'; \
+	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign doc/Makefile'; \
 	$(am__cd) $(top_srcdir) && \
-	 $(AUTOMAKE) --gnu doc/Makefile
+	 $(AUTOMAKE) --foreign doc/Makefile
 Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
 	@case '$?' in \
 	 *config.status*) \
 	 cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
 	 *) \
-	 echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
-	 cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
+	 echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__maybe_remake_depfiles)'; \
+	 cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__maybe_remake_depfiles);; \
 	esac;
 
 $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
@@ -401,8 +408,10 @@
 
 cscope cscopelist:
 
+distdir: $(BUILT_SOURCES)
+	$(MAKE) $(AM_MAKEFLAGS) distdir-am
 
-distdir: $(DISTFILES)
+distdir-am: $(DISTFILES)
 	@srcdirstrip=`echo "$(srcdir)" | sed 's/.^$$\\*/\\\\&/g'`; \
 	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/.^$$\\*/\\\\&/g'`; \
 	list='$(DISTFILES)'; \
@@ -466,6 +475,7 @@
 distclean-generic:
 	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
 	-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
+	-test -z "$(DISTCLEANFILES)" || rm -f $(DISTCLEANFILES)
 
 maintainer-clean-generic:
 	@echo "This command is intended for maintainers to use"
@@ -562,7 +572,8 @@
 
 .pod.in.html.in:
 	pod2html --index --backlink --header \
-		--title "stunnel TLS Proxy" --infile=$< --outfile=$@
+		--title "stunnel TLS Proxy" --infile=$< | \
+		sed -e 's|&#x142;|ł|g' >$@
 	rm -f pod2htmd.tmp pod2htmi.tmp
 
 $(man_MANS) $(doc_DATA): Makefile

_service:tar_scm:stunnel-5.48.tar.gz/doc/stunnel.8.in -> _service:tar_scm:stunnel-5.69.tar.gz/doc/stunnel.8.in Changed

@@ -1,4 +1,4 @@
-.\" Automatically generated by Pod::Man 4.07 (Pod::Simple 3.32)
+.\" Automatically generated by Pod::Man 4.14 (Pod::Simple 3.42)
 .\"
 .\" Standard preamble:
 .\" ========================================================================
@@ -54,20 +54,24 @@
 .\" Avoid warning from groff about undefined register 'F'.
 .de IX
 ..
-.if !\nF .nr F 0
-.if \nF>0 \{\
-. de IX
-. tm Index:\\$1\t\\n%\t"\\$2"
+.nr rF 0
+.if \n(.g .if rF .nr rF 1
+.if (\n(rF:(\n(.g==0)) \{\
+. if \nF \{\
+. de IX
+. tm Index:\\$1\t\\n%\t"\\$2"
 ..
-. if !\nF==2 \{\
-. nr % 0
-. nr F 2
+. if !\nF==2 \{\
+. nr % 0
+. nr F 2
+. \}
 . \}
 .\}
+.rr rF
 .\" ========================================================================
 .\"
 .IX Title "stunnel 8"
-.TH stunnel 8 "2018.07.02" "5.48" "stunnel TLS Proxy"
+.TH stunnel 8 "2023.02.07" "5.69" "stunnel TLS Proxy"
 .\" For nroff, turn off justification. Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
@@ -164,7 +168,7 @@
 A Unix socket path (Unix only).
 .SS "\s-1GLOBAL OPTIONS\s0"
 .IX Subsection "GLOBAL OPTIONS"
-.IP "\fBchroot\fR = \s-1DIRECTORY \s0(Unix only)" 4
+.IP "\fBchroot\fR = \s-1DIRECTORY\s0 (Unix only)" 4
 .IX Item "chroot = DIRECTORY (Unix only)"
 directory to chroot \fBstunnel\fR process
 .Sp
@@ -194,17 +198,22 @@
 .IX Item "debug = FACILITY.LEVEL"
 debugging level
 .Sp
-Level is one of the syslog level names or numbers
-emerg (0), alert (1), crit (2), err (3), warning (4), notice (5),
-info (6), or debug (7). All logs for the specified level and
-all levels numerically less than it will be shown. Use \fIdebug = debug\fR or
-\&\fIdebug = 7\fR for greatest debugging output. The default is notice (5).
+Level is one of the syslog level names or numbers emerg (0), alert (1),
+crit (2), err (3), warning (4), notice (5), info (6), or debug (7). All logs
+for the specified level and all levels numerically less than it will be shown.
+.Sp
+The \fIdebug = debug\fR (or the equivalent <debug = 7>) level produces for the
+most verbose log output. This logging level is only meant to be understood by
+stunnel developers, and not by users. Please either use the debug level when
+requested to do so by an stunnel developer, or when you intend to get confused.
 .Sp
-The syslog facility 'daemon' will be used unless a facility name is supplied.
+The default logging level is notice (5).
+.Sp
+The syslog 'daemon' facility will be used unless a facility name is supplied.
 (Facilities are not supported on Win32.)
 .Sp
 Case is ignored for both facilities and levels.
-.IP "\fB\s-1EGD\s0\fR = \s-1EGD_PATH \s0(Unix only)" 4
+.IP "\fB\s-1EGD\s0\fR = \s-1EGD_PATH\s0 (Unix only)" 4
 .IX Item "EGD = EGD_PATH (Unix only)"
 path to Entropy Gathering Daemon socket
 .Sp
@@ -247,19 +256,19 @@
 the destinations specified with \fIsyslog\fR and \fIoutput\fR.
 .Sp
 default: background in daemon mode
-.IP "\fBiconActive\fR = \s-1ICON_FILE \s0(\s-1GUI\s0 only)" 4
+.IP "\fBiconActive\fR = \s-1ICON_FILE\s0 (\s-1GUI\s0 only)" 4
 .IX Item "iconActive = ICON_FILE (GUI only)"
 \&\s-1GUI\s0 icon to be displayed when there are established connections
 .Sp
 On Windows platform the parameter should be an .ico file containing a 16x16
 pixel image.
-.IP "\fBiconError\fR = \s-1ICON_FILE \s0(\s-1GUI\s0 only)" 4
+.IP "\fBiconError\fR = \s-1ICON_FILE\s0 (\s-1GUI\s0 only)" 4
 .IX Item "iconError = ICON_FILE (GUI only)"
 \&\s-1GUI\s0 icon to be displayed when no valid configuration is loaded
 .Sp
 On Windows platform the parameter should be an .ico file containing a 16x16
 pixel image.
-.IP "\fBiconIdle\fR = \s-1ICON_FILE \s0(\s-1GUI\s0 only)" 4
+.IP "\fBiconIdle\fR = \s-1ICON_FILE\s0 (\s-1GUI\s0 only)" 4
 .IX Item "iconIdle = ICON_FILE (GUI only)"
 \&\s-1GUI\s0 icon to be displayed when there are no established connections
 .Sp
@@ -279,7 +288,7 @@
 .Sp
 /dev/stdout device can be used to send log messages to the standard
 output (for example to log them with daemontools splogger).
-.IP "\fBpid\fR = \s-1FILE \s0(Unix only)" 4
+.IP "\fBpid\fR = \s-1FILE\s0 (Unix only)" 4
 .IX Item "pid = FILE (Unix only)"
 pid file location
 .Sp
@@ -300,7 +309,7 @@
 overwrite the random seed files with new random data
 .Sp
 default: yes
-.IP "\fBservice\fR = \s-1SERVICE \s0(Unix only)" 4
+.IP "\fBservice\fR = \s-1SERVICE\s0 (Unix only)" 4
 .IX Item "service = SERVICE (Unix only)"
 stunnel service name
 .Sp
@@ -340,25 +349,36 @@
 .Vb 1
 \& accept = :::PORT
 .Ve
-.IP "\fBCApath\fR = \s-1DIRECTORY\s0" 4
-.IX Item "CApath = DIRECTORY"
-Certificate Authority directory
+.IP "\fBCAengine\fR = \s-1ENGINE\-SPECIFIC_CA_CERTIFICATE_IDENTIFIER\s0" 4
+.IX Item "CAengine = ENGINE-SPECIFIC_CA_CERTIFICATE_IDENTIFIER"
+load a trusted \s-1CA\s0 certificate from an engine
+.Sp
+The loaded \s-1CA\s0 certificates will be used with the \fIverifyChain\fR and
+\&\fIverifyPeer\fR options.
 .Sp
-This is the directory in which \fBstunnel\fR will look for certificates when using
-the \fIverifyChain\fR or \fIverifyPeer\fR options. Note that the certificates in
-this directory should be named \s-1XXXXXXXX.0\s0 where \s-1XXXXXXXX\s0 is the hash value of
-the \s-1DER\s0 encoded subject of the cert.
+Multiple \fICAengine\fR options are allowed in a single service section.
+.Sp
+Currently supported engines: pkcs11, cng.
+.IP "\fBCApath\fR = \s-1CA_DIRECTORY\s0" 4
+.IX Item "CApath = CA_DIRECTORY"
+load trusted \s-1CA\s0 certificates from a directory
+.Sp
+The loaded \s-1CA\s0 certificates will be used with the \fIverifyChain\fR and
+\&\fIverifyPeer\fR options.
+Note that the certificates in this directory should be named \s-1XXXXXXXX.0\s0 where
+\&\s-1XXXXXXXX\s0 is the hash value of the \s-1DER\s0 encoded subject of the cert.
 .Sp
 The hash algorithm has been changed in \fBOpenSSL 1.0.0\fR. It is required to
-c_rehash the directory on upgrade from \fBOpenSSL 0.x.x\fR to \fBOpenSSL 1.x.x\fR.
+c_rehash the directory on upgrade from \fBOpenSSL 0.x.x\fR to \fBOpenSSL 1.x.x\fR
+or later.
 .Sp
 \&\fICApath\fR path is relative to the \fIchroot\fR directory if specified.
 .IP "\fBCAfile\fR = \s-1CA_FILE\s0" 4
 .IX Item "CAfile = CA_FILE"
-Certificate Authority file
+load trusted \s-1CA\s0 certificates from a file
 .Sp
-This file contains multiple \s-1CA\s0 certificates, to be used with the \fIverifyChain\fR
-and \fIverifyPeer\fR options.
+The loaded \s-1CA\s0 certificates will be used with the \fIverifyChain\fR and
+\&\fIverifyPeer\fR options.
 .IP "\fBcert\fR = \s-1CERT_FILE\s0" 4
 .IX Item "cert = CERT_FILE"
 certificate chain file name
@@ -377,37 +397,51 @@
 .IX Item "checkEmail = EMAIL"
 email address of the peer certificate subject
 .Sp
-Multiple \fIcheckEmail\fR options are allowed in a single service section.
 Certificates are accepted if no subject checks were specified, or the email
 address of the peer certificate matches any of the email addresses specified
 with \fIcheckEmail\fR.
 .Sp
+Multiple \fIcheckEmail\fR options are allowed in a single service section.
+.Sp
 This option requires OpenSSL 1.0.2 or later.
 .IP "\fBcheckHost\fR = \s-1HOST\s0" 4
 .IX Item "checkHost = HOST"
 host of the peer certificate subject
 .Sp
-Multiple \fIcheckHost\fR options are allowed in a single service section.
 Certificates are accepted if no subject checks were specified, or the host name
 of the peer certificate matches any of the hosts specified with \fIcheckHost\fR.
 .Sp
+Multiple \fIcheckHost\fR options are allowed in a single service section.
+.Sp
 This option requires OpenSSL 1.0.2 or later.
 .IP "\fBcheckIP\fR = \s-1IP\s0" 4
 .IX Item "checkIP = IP"
 \&\s-1IP\s0 address of the peer certificate subject
 .Sp
-Multiple \fIcheckIP\fR options are allowed in a single service section.
 Certificates are accepted if no subject checks were specified, or the \s-1IP\s0
 address of the peer certificate matches any of the \s-1IP\s0 addresses specified with
 \&\fIcheckIP\fR.
 .Sp
+Multiple \fIcheckIP\fR options are allowed in a single service section.
+.Sp
 This option requires OpenSSL 1.0.2 or later.
 .IP "\fBciphers\fR = \s-1CIPHER_LIST\s0" 4
 .IX Item "ciphers = CIPHER_LIST"
-Select permitted \s-1TLS\s0 ciphers
+select permitted \s-1TLS\s0 ciphers (TLSv1.2 and below)
+.Sp
+This option does not impact TLSv1.3 ciphersuites.
 .Sp
 A colon-delimited list of the ciphers to allow in the \s-1TLS\s0 connection,
 for example \s-1DES\-CBC3\-SHA:IDEA\-CBC\-MD5.\s0
+.IP "\fBciphersuites\fR = \s-1CIPHERSUITES_LIST\s0" 4
+.IX Item "ciphersuites = CIPHERSUITES_LIST"
+select permitted TLSv1.3 ciphersuites
+.Sp
+A colon-delimited list of TLSv1.3 ciphersuites names in order of preference.
+.Sp
+This option requires OpenSSL 1.1.1 or later.
+.Sp
+default: \s-1TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256\s0
 .IP "\fBclient\fR = yes | no" 4
 .IX Item "client = yes | no"
 client mode (remote service uses \s-1TLS\s0)
@@ -420,10 +454,12 @@
 The \fBOpenSSL\fR configuration command is executed with the specified parameter.
 This allows any configuration commands to be invoked from the stunnel
 configuration file. Supported commands are described on the
-\&\fI\fISSL_CONF_cmd\fI\|(3ssl)\fR manual page.
+\&\fI\f(BISSL_CONF_cmd\fI\|(3ssl)\fR manual page.
 .Sp
 Several \fIconfig\fR lines can be used to specify multiple configuration commands.
 .Sp
+Use \fIcurves\fR option instead of enabling \fIconfig = Curves:list_curves\fR to support elliptic curves.
+.Sp
 This option requires OpenSSL 1.0.2 or later.
 .IP "\fBconnect\fR = \s-1HOST:\s0PORT" 4
 .IX Item "connect = HOST:PORT"
@@ -432,7 +468,6 @@
 If no host is specified, the host defaults to localhost.
 .Sp
 Multiple \fIconnect\fR options are allowed in a single service section.
-.Sp
 If host resolves to multiple addresses and/or if multiple \fIconnect\fR
 options are specified, then the remote address is chosen using a
 round-robin algorithm.
@@ -454,9 +489,11 @@
 .Sp
 This file contains multiple CRLs, used with the \fIverifyChain\fR and
 \&\fIverifyPeer\fR options.
-.IP "\fBcurve\fR = \s-1NID\s0" 4
-.IX Item "curve = NID"
-specify \s-1ECDH\s0 curve name
+.IP "\fBcurves\fR = list" 4
+.IX Item "curves = list"
+\&\s-1ECDH\s0 curves separated with ':'
+.Sp
+Only a single curve name is allowed for OpenSSL older than 1.1.1.
 .Sp
 To get a list of supported curves use:
 .Sp
@@ -464,7 +501,13 @@
 \& openssl ecparam \-list_curves
 .Ve
 .Sp
-default: prime256v1
+default:
+.Sp
+.Vb 1
+\& X25519:P\-256:X448:P\-521:P\-384 (OpenSSL 1.1.1 or later)
+\&
+\& prime256v1 (OpenSSL older than 1.1.1)
+.Ve
 .IP "\fBlogId\fR = \s-1TYPE\s0" 4
 .IX Item "logId = TYPE"
 connection identifier type
@@ -502,8 +545,13 @@
 Level is a one of the syslog level names or numbers
 emerg (0), alert (1), crit (2), err (3), warning (4), notice (5),
 info (6), or debug (7). All logs for the specified level and
-all levels numerically less than it will be shown. Use \fIdebug = debug\fR or
-\&\fIdebug = 7\fR for greatest debugging output. The default is notice (5).
+all levels numerically less than it will be shown.
+The default is notice (5).
+.Sp
+While the \fIdebug = debug\fR or \fIdebug = 7\fR level generates the most verbose
+output, it is only intended to be used by stunnel developers. Please only use
+this value if you are a developer, or you intend to send your logs to our
+technical support. Otherwise, the generated logs \fBwill\fR be confusing.
 .IP "\fBdelay\fR = yes | no" 4
 .IX Item "delay = yes | no"
 delay \s-1DNS\s0 lookup for the \fIconnect\fR option
@@ -557,7 +605,7 @@
 .RE
 .IP "\fBident\fR = \s-1USERNAME\s0" 4
 .IX Item "ident = USERNAME"
-use \s-1IDENT \s0(\s-1RFC 1413\s0) username checking
+use \s-1IDENT\s0 (\s-1RFC 1413\s0) username checking
 .IP "\fBinclude\fR = \s-1DIRECTORY\s0" 4
 .IX Item "include = DIRECTORY"
 include all configuration file parts located in \s-1DIRECTORY\s0
@@ -610,7 +658,7 @@
 validate certificates with their \s-1AIA OCSP\s0 responders
 .Sp
 This option enables \fIstunnel\fR to validate certificates with the list of
-\&\s-1OCSP\s0 responder URLs retrieved from their \s-1AIA \s0(Authority Information Access)
+\&\s-1OCSP\s0 responder URLs retrieved from their \s-1AIA\s0 (Authority Information Access)
 extension.
 .IP "\fBOCSPflag\fR = \s-1OCSP_FLAG\s0" 4
 .IX Item "OCSPflag = OCSP_FLAG"
@@ -632,7 +680,7 @@
 \&\fBOpenSSL\fR library options
 .Sp
 The parameter is the \fBOpenSSL\fR option name as described in the
-\&\fI\fISSL_CTX_set_options\fI\|(3ssl)\fR manual, but without \fI\s-1SSL_OP_\s0\fR prefix.
+\&\fI\f(BISSL_CTX_set_options\fI\|(3ssl)\fR manual, but without \fI\s-1SSL_OP_\s0\fR prefix.
 \&\fIstunnel \-options\fR lists the options found to be allowed in the
 current combination of \fIstunnel\fR and the \fIOpenSSL\fR library used
 to build it.
@@ -653,6 +701,9 @@
 \& options = NO_SSLv2
 \& options = NO_SSLv3
 .Ve
+.Sp
+Use \fIsslVersionMax\fR or \fIsslVersionMin\fR option instead of disabling specific \s-1TLS\s0 protocol
+versions when compiled with \fBOpenSSL 1.1.0\fR or later.
 .IP "\fBprotocol\fR = \s-1PROTO\s0" 4
 .IX Item "protocol = PROTO"
 application protocol to negotiate \s-1TLS\s0
@@ -667,17 +718,28 @@
 .IX Item "cifs"
 Proprietary (undocummented) extension of \s-1CIFS\s0 protocol implemented in Samba.
 Support for this extension was dropped in Samba 3.0.0.
+.IP "\fIcapwin\fR" 4
+.IX Item "capwin"
+http://www.capwin.org/ application support
+.IP "\fIcapwinctrl\fR" 4
+.IX Item "capwinctrl"
+http://www.capwin.org/ application support
+.Sp
+This protocol is only supported in client mode.
 .IP "\fIconnect\fR" 4
 .IX Item "connect"
-Based on \s-1RFC 2817 \- \s0\fIUpgrading to \s-1TLS\s0 Within \s-1HTTP/1.1\s0\fR, section 5.2 \- \fIRequesting a Tunnel with \s-1CONNECT\s0\fR
+Based on \s-1RFC 2817\s0 \- \fIUpgrading to \s-1TLS\s0 Within \s-1HTTP/1.1\s0\fR, section 5.2 \- \fIRequesting a Tunnel with \s-1CONNECT\s0\fR
 .Sp
 This protocol is only supported in client mode.
 .IP "\fIimap\fR" 4
 .IX Item "imap"
-Based on \s-1RFC 2595 \- \s0\fIUsing \s-1TLS\s0 with \s-1IMAP, POP3\s0 and \s-1ACAP\s0\fR
+Based on \s-1RFC 2595\s0 \- \fIUsing \s-1TLS\s0 with \s-1IMAP, POP3\s0 and \s-1ACAP\s0\fR
+.IP "\fIldap\fR" 4
+.IX Item "ldap"
+Based on \s-1RFC 2830\s0 \- \fILightweight Directory Access Protocol (v3): Extension for Transport Layer Security\fR
 .IP "\fInntp\fR" 4
 .IX Item "nntp"
-Based on \s-1RFC 4642 \- \s0\fIUsing Transport Layer Security (\s-1TLS\s0) with Network News Transfer Protocol (\s-1NNTP\s0)\fR
+Based on \s-1RFC 4642\s0 \- \fIUsing Transport Layer Security (\s-1TLS\s0) with Network News Transfer Protocol (\s-1NNTP\s0)\fR
 .Sp
 This protocol is only supported in client mode.
 .IP "\fIpgsql\fR" 4
@@ -686,14 +748,14 @@
 \&\fIhttp://www.postgresql.org/docs/8.3/static/protocol\-flow.html#AEN73982\fR
 .IP "\fIpop3\fR" 4
 .IX Item "pop3"
-Based on \s-1RFC 2449 \- \s0\fI\s-1POP3\s0 Extension Mechanism\fR
+Based on \s-1RFC 2449\s0 \- \fI\s-1POP3\s0 Extension Mechanism\fR
 .IP "\fIproxy\fR" 4
 .IX Item "proxy"
-Haproxy client \s-1IP\s0 address
-\&\fIhttp://haproxy.1wt.eu/download/1.5/doc/proxy\-protocol.txt\fR
+Passing of the original client \s-1IP\s0 address with HAProxy \s-1PROXY\s0 protocol version 1
+\&\fIhttps://www.haproxy.org/download/1.8/doc/proxy\-protocol.txt\fR
 .IP "\fIsmtp\fR" 4
 .IX Item "smtp"
-Based on \s-1RFC 2487 \- \s0\fI\s-1SMTP\s0 Service Extension for Secure \s-1SMTP\s0 over \s-1TLS\s0\fR
+Based on \s-1RFC 2487\s0 \- \fI\s-1SMTP\s0 Service Extension for Secure \s-1SMTP\s0 over \s-1TLS\s0\fR
 .IP "\fIsocks\fR" 4
 .IX Item "socks"
 \&\s-1SOCKS\s0 versions 4, 4a, and 5 are supported. The \s-1SOCKS\s0 protocol itself
@@ -729,16 +791,21 @@
 domain for the protocol negotiations
 .Sp
 Currently, this option is only supported in the client-side 'connect' protocol.
-.IP "\fBprotocolHost\fR = \s-1HOST:PORT\s0" 4
-.IX Item "protocolHost = HOST:PORT"
-destination address for the protocol negotiations
+.IP "\fBprotocolHeader\fR = \s-1HEADER\s0" 4
+.IX Item "protocolHeader = HEADER"
+header for the protocol negotiations
+.Sp
+Currently, this option is only supported in the client-side 'connect' protocol.
+.IP "\fBprotocolHost\fR = \s-1ADDRESS\s0" 4
+.IX Item "protocolHost = ADDRESS"
+host address for the protocol negotiations
 .Sp
-\&\fIprotocolHost\fR specifies the final \s-1TLS\s0 server to be connected to by the proxy,
-and not the proxy server directly connected by \fBstunnel\fR.
-The proxy server should be specified with the 'connect' option.
+For the 'connect' protocol negotiations, \fIprotocolHost\fR specifies \s-1HOST:PORT\s0 of
+the final \s-1TLS\s0 server to be connected to by the proxy. The proxy server
+directly connected by \fBstunnel\fR must be specified with the \fIconnect\fR option.
 .Sp
-Currently the protocol destination address only applies to the 'connect'
-protocol.
+For the 'smtp' protocol negotiations, \fIprotocolHost\fR controls the client \s-1SMTP
+HELO/EHLO\s0 value.
 .IP "\fBprotocolPassword\fR = \s-1PASSWORD\s0" 4
 .IX Item "protocolPassword = PASSWORD"
 password for the protocol negotiations
@@ -769,8 +836,10 @@
 \& IDENTITY:KEY
 .Ve
 .Sp
-The key is required to be at least 20 characters long.
-The file should not be world-readable nor world-writable.
+Hexadecimal keys are automatically converted to binary form.
+Keys are required to be at least 16 bytes long, which implies
+at least 32 characters for hexadecimal keys.
+The file should neither be world-readable nor world-writable.
 .IP "\fBpty\fR = yes | no (Unix only)" 4
 .IX Item "pty = yes | no (Unix only)"
 allocate a pseudoterminal for 'exec' option
@@ -808,6 +877,37 @@
 reconnect a connect+exec section after it was disconnected
 .Sp
 default: no
+.IP "\fBsecurityLevel\fR = \s-1LEVEL\s0" 4
+.IX Item "securityLevel = LEVEL"
+set the security level
+.Sp
+The meaning of each level is described below:
+.RS 4
+.IP "level 0" 4
+.IX Item "level 0"
+Everything is permitted.
+.IP "level 1" 4
+.IX Item "level 1"
+The security level corresponds to a minimum of 80 bits of security. Any parameters offering below 80 bits of security are excluded. As a result \s-1RSA, DSA\s0 and \s-1DH\s0 keys shorter than 1024 bits and \s-1ECC\s0 keys shorter than 160 bits are prohibited. All export cipher suites are prohibited since they all offer less than 80 bits of security. \s-1SSL\s0 version 2 is prohibited. Any cipher suite using \s-1MD5\s0 for the \s-1MAC\s0 is also prohibited.
+.IP "level 2" 4
+.IX Item "level 2"
+Security level set to 112 bits of security. As a result \s-1RSA, DSA\s0 and \s-1DH\s0 keys shorter than 2048 bits and \s-1ECC\s0 keys shorter than 224 bits are prohibited. In addition to the level 1 exclusions any cipher suite using \s-1RC4\s0 is also prohibited. \s-1SSL\s0 version 3 is also not allowed. Compression is disabled.
+.IP "level 3" 4
+.IX Item "level 3"
+Security level set to 128 bits of security. As a result \s-1RSA, DSA\s0 and \s-1DH\s0 keys shorter than 3072 bits and \s-1ECC\s0 keys shorter than 256 bits are prohibited. In addition to the level 2 exclusions cipher suites not offering forward secrecy are prohibited. \s-1TLS\s0 versions below 1.1 are not permitted. Session tickets are disabled.
+.IP "level 4" 4
+.IX Item "level 4"
+Security level set to 192 bits of security. As a result \s-1RSA, DSA\s0 and \s-1DH\s0 keys shorter than 7680 bits and \s-1ECC\s0 keys shorter than 384 bits are prohibited. Cipher suites using \s-1SHA1\s0 for the \s-1MAC\s0 are prohibited. \s-1TLS\s0 versions below 1.2 are not permitted.
+.IP "level 5" 4
+.IX Item "level 5"
+Security level set to 256 bits of security. As a result \s-1RSA, DSA\s0 and \s-1DH\s0 keys shorter than 15360 bits and \s-1ECC\s0 keys shorter than 512 bits are prohibited.
+.IP "default: 2" 4
+.IX Item "default: 2"
+.RE
+.RS 4
+.Sp
+The \fIsecurityLevel\fR option is only available when compiled with \fBOpenSSL 1.1.0\fR and later.
+.RE
 .IP "\fBrequireCert\fR = yes | no" 4
 .IX Item "requireCert = yes | no"
 require a client certificate for \fIverifyChain\fR or \fIverifyPeer\fR
@@ -818,18 +918,18 @@
 Both \fIverifyChain = yes\fR and \fIverifyPeer = yes\fR imply \fIrequireCert = yes\fR.
 .Sp
 default: no
-.IP "\fBsetgid\fR = \s-1GROUP \s0(Unix only)" 4
+.IP "\fBsetgid\fR = \s-1GROUP\s0 (Unix only)" 4
 .IX Item "setgid = GROUP (Unix only)"
 Unix group id
 .Sp
-As a global option: \fIsetgid()\fR to the specified group in daemon mode and clear all other groups.
+As a global option: \fBsetgid()\fR to the specified group in daemon mode and clear all other groups.
 .Sp
 As a service-level option: set the group of the Unix socket specified with \*(L"accept\*(R".
-.IP "\fBsetuid\fR = \s-1USER \s0(Unix only)" 4
+.IP "\fBsetuid\fR = \s-1USER\s0 (Unix only)" 4
 .IX Item "setuid = USER (Unix only)"
 Unix user id
 .Sp
-As a global option: \fIsetuid()\fR to the specified user in daemon mode.
+As a global option: \fBsetuid()\fR to the specified user in daemon mode.
 .Sp
 As a service-level option: set the owner of the Unix socket specified with \*(L"accept\*(R".
 .IP "\fBsessionCacheSize\fR = \s-1NUM_ENTRIES\s0" 4
@@ -846,35 +946,40 @@
 session cache timeout
 .Sp
 This is the number of seconds to keep cached \s-1TLS\s0 sessions.
+.IP "\fBsessionResume\fR = yes | no" 4
+.IX Item "sessionResume = yes | no"
+allow or disallow session resumption
+.Sp
+default: yes
 .IP "\fBsessiond\fR = \s-1HOST:PORT\s0" 4
 .IX Item "sessiond = HOST:PORT"
 address of sessiond \s-1TLS\s0 cache server
-.IP "\fBsni\fR = \s-1SERVICE_NAME:SERVER_NAME_PATTERN \s0(server mode)" 4
+.IP "\fBsni\fR = \s-1SERVICE_NAME:SERVER_NAME_PATTERN\s0 (server mode)" 4
 .IX Item "sni = SERVICE_NAME:SERVER_NAME_PATTERN (server mode)"
-Use the service as a slave service (a name-based virtual server) for Server
+Use the service as a secondary service (a name-based virtual server) for Server
 Name Indication \s-1TLS\s0 extension (\s-1RFC 3546\s0).
 .Sp
-\&\fI\s-1SERVICE_NAME\s0\fR specifies the master service that accepts client connections
+\&\fI\s-1SERVICE_NAME\s0\fR specifies the primary service that accepts client connections
 with the \fIaccept\fR option. \fI\s-1SERVER_NAME_PATTERN\s0\fR specifies the host name to
 be redirected. The pattern may start with the '*' character, e.g.
-\&'*.example.com'. Multiple slave services are normally specified for a single
-master service. The \fIsni\fR option can also be specified more than once within
-a single slave service.
+\&'*.example.com'. Multiple secondary services are normally specified for
+a single primary service. The \fIsni\fR option can also be specified more than
+once within a single secondary service.
 .Sp
-This service, as well as the master service, may not be configured in client
+This service, as well as the primary service, may not be configured in client
 mode.
 .Sp
-The \fIconnect\fR option of the slave service is ignored when the \fIprotocol\fR
+The \fIconnect\fR option of the secondary service is ignored when the \fIprotocol\fR
 option is specified, as \fIprotocol\fR connects to the remote host before \s-1TLS\s0
 handshake.
 .Sp
-Libwrap checks (Unix only) are performed twice: with the master service name
-after \s-1TCP\s0 connection is accepted, and with the slave service name during the
-\&\s-1TLS\s0 handshake.
+Libwrap checks (Unix only) are performed twice: with the primary service name
+after \s-1TCP\s0 connection is accepted, and with the secondary service name during
+the \s-1TLS\s0 handshake.
 .Sp
 The \fIsni\fR option is only available when compiled with \fBOpenSSL 1.0.0\fR and
 later.
-.IP "\fBsni\fR = \s-1SERVER_NAME \s0(client mode)" 4
+.IP "\fBsni\fR = \s-1SERVER_NAME\s0 (client mode)" 4
 .IX Item "sni = SERVER_NAME (client mode)"
 Use the parameter as the value of \s-1TLS\s0 Server Name Indication (\s-1RFC 3546\s0)
 extension.
@@ -907,29 +1012,100 @@
 .IX Item "sslVersion = SSL_VERSION"
 select the \s-1TLS\s0 protocol version
 .Sp
-Supported versions: all, SSLv2, SSLv3, TLSv1, TLSv1.1, TLSv1.2
+Supported versions: all, SSLv2, SSLv3, TLSv1, TLSv1.1, TLSv1.2, TLSv1.3
 .Sp
-sslVersion is obsolete and it will be removed in future releases of stunnel.
-Use the following options instead:
+Availability of specific protocols depends on the linked OpenSSL library.
+Older versions of OpenSSL do not support TLSv1.1, TLSv1.2 and TLSv1.3.
+Newer versions of OpenSSL do not support SSLv2.
 .Sp
-.Vb 6
-\& options = NO_SSLv2
-\& options = NO_SSLv3
-\& options = NO_TLSv1
-\& options = NO_TLSv1.1
-\& options = NO_TLSv1.2
-\& options = NO_TLSv1.3
+Obsolete SSLv2 and SSLv3 are currently disabled by default.
+.Sp
+Setting the option
+.Sp
+.Vb 1
+\& sslVersion = SSL_VERSION
 .Ve
 .Sp
+is equivalent to options
+.Sp
+.Vb 2
+\& sslVersionMax = SSL_VERSION
+\& sslVersionMin = SSL_VERSION
+.Ve
+.Sp
+when compiled with \fBOpenSSL 1.1.0\fR and later.
+.IP "\fBsslVersionMax\fR = \s-1SSL_VERSION\s0" 4
+.IX Item "sslVersionMax = SSL_VERSION"
+maximum supported protocol versions
+.Sp
+Supported versions: all, SSLv3, TLSv1, TLSv1.1, TLSv1.2, TLSv1.3
+.Sp
+\&\fIall\fR enable protocol versions up to the highest version supported by the
+linked OpenSSL library.
+.Sp
 Availability of specific protocols depends on the linked OpenSSL library.
-Older versions of OpenSSL do not support TLSv1.1 and TLSv1.2.
-Newer versions of OpenSSL do not support SSLv2.
 .Sp
-Obsolete SSLv2 and SSLv3 are currently disabled by default.
-See the \fBoptions\fR option documentation for details.
-.IP "\fBstack\fR = \s-1BYTES \s0(except for \s-1FORK\s0 model)" 4
+The \fIsslVersionMax\fR option is only available when compiled with \fBOpenSSL 1.1.0\fR and later.
+.Sp
+default: all
+.IP "\fBsslVersionMin\fR = \s-1SSL_VERSION\s0" 4
+.IX Item "sslVersionMin = SSL_VERSION"
+minimum supported protocol versions
+.Sp
+Supported versions: all, SSLv3, TLSv1, TLSv1.1, TLSv1.2, TLSv1.3
+.Sp
+\&\fIall\fR enable protocol versions down to the lowest version supported by the
+linked OpenSSL library.
+.Sp
+Availability of specific protocols depends on the linked OpenSSL library.
+.Sp
+The \fIsslVersionMin\fR option is only available when compiled with \fBOpenSSL 1.1.0\fR and later.
+.Sp
+default: TLSv1
+.IP "\fBstack\fR = \s-1BYTES\s0 (except for \s-1FORK\s0 model)" 4
 .IX Item "stack = BYTES (except for FORK model)"
-thread stack size
+\&\s-1CPU\s0 stack size of created threads
+.Sp
+Excessive thread stack size increases virtual memory usage.
+Insufficient thread stack size may cause application crashes.
+.Sp
+default: 65536 bytes (sufficient for all platforms we tested)
+.IP "\fBticketKeySecret\fR = \s-1SECRET\s0" 4
+.IX Item "ticketKeySecret = SECRET"
+hexadecimal symmetric key used for session ticket confidentiality protection
+.Sp
+Session tickets defined in \s-1RFC 5077\s0 provide an enhanced session resumption
+capability, where the server-side caching is not required to maintain per
+session state.
+.Sp
+Combining \fIticketKeySecret\fR and \fIticketMacSecret\fR options allow to resume a
+negotiated session on other cluster nodes, or to resume a negotiated
+session after server restart.
+.Sp
+The key is required to be either 16 or 32 bytes long, which implies exactly 32
+or 64 hexadecimal digits. Colons may optionally be used between two-character
+hexadecimal bytes.
+.Sp
+This option only works in server mode.
+.Sp
+The \fIticketKeySecret\fR option is only available when compiled with
+\&\fBOpenSSL 1.0.0\fR and later.
+.Sp
+Disabling \fI\s-1NO_TICKET\s0\fR option is required for the ticket support in OpenSSL
+older than 1.1.1, but note that this option is incompatible with the
+\&\fIredirect\fR option.
+.IP "\fBticketMacSecret\fR = \s-1SECRET\s0" 4
+.IX Item "ticketMacSecret = SECRET"
+hexadecimal symmetric key used for session ticket integrity protection
+.Sp
+The key is required to be either 16 or 32 bytes long, which implies exactly 32
+or 64 hexadecimal digits. Colons may optionally be used between two-character
+hexadecimal bytes.
+.Sp
+This option only works in server mode.
+.Sp
+The \fIticketMacSecret\fR option is only available when compiled with
+\&\fBOpenSSL 1.0.0\fR and later.
 .IP "\fBTIMEOUTbusy\fR = \s-1SECONDS\s0" 4
 .IX Item "TIMEOUTbusy = SECONDS"
 time to wait for expected data
@@ -1129,6 +1305,9 @@
 .IX Item "SIGUSR1"
 Close and reopen the \fBstunnel\fR log file.
 This function can be used for log rotation.
+.IP "\s-1SIGUSR2\s0" 4
+.IX Item "SIGUSR2"
+Log the list of active connections.
 .IP "\s-1SIGTERM, SIGQUIT, SIGINT\s0" 4
 .IX Item "SIGTERM, SIGQUIT, SIGINT"
 Shut \fBstunnel\fR down.
@@ -1215,19 +1394,19 @@
 .PP
 .Vb 5
 \& virtual
-\& ; master service
+\& ; primary service
 \& accept = 443
 \& cert = default.pem
 \& connect = default.internal.mydomain.com:8080
 \&
 \& sni1
-\& ; slave service 1
+\& ; secondary service 1
 \& sni = virtual:server1.mydomain.com
 \& cert = server1.pem
 \& connect = server1.internal.mydomain.com:8081
 \&
 \& sni2
-\& ; slave service 2
+\& ; secondary service 2
 \& sni = virtual:server2.mydomain.com
 \& cert = server2.pem
 \& connect = server2.internal.mydomain.com:8082
@@ -1319,25 +1498,21 @@
 generate them with the free \fBOpenSSL\fR package. You can find more
 information on certificates generation on pages listed below.
 .PP
-The order of contents of the \fI.pem\fR file is important. It should contain the
-unencrypted private key first, then a signed certificate (not certificate
-request). There should also be empty lines after the certificate and the private key.
-Any plaintext certificate information appended on the top of generated certificate
-should be discarded. So the file should look like this:
+The \fI.pem\fR file should contain the unencrypted private key and
+a signed certificate (not certificate request).
+So the file should look like this:
 .PP
-.Vb 8
+.Vb 6
 \& \-\-\-\-\-BEGIN RSA PRIVATE KEY\-\-\-\-\-
 \& encoded key
 \& \-\-\-\-\-END RSA PRIVATE KEY\-\-\-\-\-
-\& empty line
 \& \-\-\-\-\-BEGIN CERTIFICATE\-\-\-\-\-
 \& encoded certificate
 \& \-\-\-\-\-END CERTIFICATE\-\-\-\-\-
-\& empty line
 .Ve
 .SS "\s-1RANDOMNESS\s0"
 .IX Subsection "RANDOMNESS"
-\&\fBstunnel\fR needs to seed the \s-1PRNG \s0(pseudo-random number generator) in
+\&\fBstunnel\fR needs to seed the \s-1PRNG\s0 (pseudo-random number generator) in
 order for \s-1TLS\s0 to use good randomness. The following sources are loaded
 in order until sufficient random data has been gathered:
 .IP "\(bu" 4
@@ -1396,10 +1571,10 @@
 The \fIexecArgs\fR option and the Win32 command line do not support quoting.
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
-.IP "\fItcpd\fR\|(8)" 4
+.IP "\fBtcpd\fR\|(8)" 4
 .IX Item "tcpd"
 access control facility for internet services
-.IP "\fIinetd\fR\|(8)" 4
+.IP "\fBinetd\fR\|(8)" 4
 .IX Item "inetd"
 internet 'super\-server'
 .IP "\fIhttp://www.stunnel.org/\fR" 4

_service:tar_scm:stunnel-5.48.tar.gz/doc/stunnel.html.in -> _service:tar_scm:stunnel-5.69.tar.gz/doc/stunnel.html.in Changed

@@ -242,9 +242,13 @@
 
 debugging level
 
-Level is one of the syslog level names or numbers emerg (0), alert (1), crit (2), err (3), warning (4), notice (5), info (6), or debug (7). All logs for the specified level and all levels numerically less than it will be shown. Use debug = debug or debug = 7 for greatest debugging output. The default is notice (5).
+Level is one of the syslog level names or numbers emerg (0), alert (1), crit (2), err (3), warning (4), notice (5), info (6), or debug (7). All logs for the specified level and all levels numerically less than it will be shown.
 
-The syslog facility &#39;daemon&#39; will be used unless a facility name is supplied. (Facilities are not supported on Win32.)
+The debug = debug (or the equivalent &lt;debug = 7&gt;) level produces for the most verbose log output. This logging level is only meant to be understood by stunnel developers, and not by users. Please either use the debug level when requested to do so by an stunnel developer, or when you intend to get confused.
+
+The default logging level is notice (5).
+
+The syslog &#39;daemon&#39; facility will be used unless a facility name is supplied. (Facilities are not supported on Win32.)
 
 Case is ignored for both facilities and levels.
 
@@ -424,17 +428,29 @@
 
 To listen on all IPv6 addresses use:
 
-<pre><code> accept = :::PORT</code></pre>
+<pre><code>accept = :::PORT</code></pre>
 
 </dd>
-<dt id="CApath-DIRECTORY">CApath = DIRECTORY</dt>
+<dt id="CAengine-ENGINE-SPECIFIC_CA_CERTIFICATE_IDENTIFIER">CAengine = ENGINE-SPECIFIC_CA_CERTIFICATE_IDENTIFIER</dt>
 <dd>
 
-Certificate Authority directory
+load a trusted CA certificate from an engine
 
-This is the directory in which stunnel will look for certificates when using the verifyChain or verifyPeer options. Note that the certificates in this directory should be named XXXXXXXX.0 where XXXXXXXX is the hash value of the DER encoded subject of the cert.
+The loaded CA certificates will be used with the verifyChain and verifyPeer options.
 
-The hash algorithm has been changed in OpenSSL 1.0.0. It is required to c_rehash the directory on upgrade from OpenSSL 0.x.x to OpenSSL 1.x.x.
+Multiple CAengine options are allowed in a single service section.
+
+Currently supported engines: pkcs11, cng.
+
+</dd>
+<dt id="CApath-CA_DIRECTORY">CApath = CA_DIRECTORY</dt>
+<dd>
+
+load trusted CA certificates from a directory
+
+The loaded CA certificates will be used with the verifyChain and verifyPeer options. Note that the certificates in this directory should be named XXXXXXXX.0 where XXXXXXXX is the hash value of the DER encoded subject of the cert.
+
+The hash algorithm has been changed in OpenSSL 1.0.0. It is required to c_rehash the directory on upgrade from OpenSSL 0.x.x to OpenSSL 1.x.x or later.
 
 CApath path is relative to the chroot directory if specified.
 
@@ -442,9 +458,9 @@
 <dt id="CAfile-CA_FILE">CAfile = CA_FILE</dt>
 <dd>
 
-Certificate Authority file
+load trusted CA certificates from a file
 
-This file contains multiple CA certificates, to be used with the verifyChain and verifyPeer options.
+The loaded CA certificates will be used with the verifyChain and verifyPeer options.
 
 </dd>
 <dt id="cert-CERT_FILE">cert = CERT_FILE</dt>
@@ -464,7 +480,9 @@
 
 email address of the peer certificate subject
 
-Multiple checkEmail options are allowed in a single service section. Certificates are accepted if no subject checks were specified, or the email address of the peer certificate matches any of the email addresses specified with checkEmail.
+Certificates are accepted if no subject checks were specified, or the email address of the peer certificate matches any of the email addresses specified with checkEmail.
+
+Multiple checkEmail options are allowed in a single service section.
 
 This option requires OpenSSL 1.0.2 or later.
 
@@ -474,7 +492,9 @@
 
 host of the peer certificate subject
 
-Multiple checkHost options are allowed in a single service section. Certificates are accepted if no subject checks were specified, or the host name of the peer certificate matches any of the hosts specified with checkHost.
+Certificates are accepted if no subject checks were specified, or the host name of the peer certificate matches any of the hosts specified with checkHost.
+
+Multiple checkHost options are allowed in a single service section.
 
 This option requires OpenSSL 1.0.2 or later.
 
@@ -484,7 +504,9 @@
 
 IP address of the peer certificate subject
 
-Multiple checkIP options are allowed in a single service section. Certificates are accepted if no subject checks were specified, or the IP address of the peer certificate matches any of the IP addresses specified with checkIP.
+Certificates are accepted if no subject checks were specified, or the IP address of the peer certificate matches any of the IP addresses specified with checkIP.
+
+Multiple checkIP options are allowed in a single service section.
 
 This option requires OpenSSL 1.0.2 or later.
 
@@ -492,11 +514,25 @@
 <dt id="ciphers-CIPHER_LIST">ciphers = CIPHER_LIST</dt>
 <dd>
 
-Select permitted TLS ciphers
+select permitted TLS ciphers (TLSv1.2 and below)
+
+This option does not impact TLSv1.3 ciphersuites.
 
 A colon-delimited list of the ciphers to allow in the TLS connection, for example DES-CBC3-SHA:IDEA-CBC-MD5.
 
 </dd>
+<dt id="ciphersuites-CIPHERSUITES_LIST">ciphersuites = CIPHERSUITES_LIST</dt>
+<dd>
+
+select permitted TLSv1.3 ciphersuites
+
+A colon-delimited list of TLSv1.3 ciphersuites names in order of preference.
+
+This option requires OpenSSL 1.1.1 or later.
+
+default: TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256
+
+</dd>
 <dt id="client-yes-no">client = yes | no</dt>
 <dd>
 
@@ -514,6 +550,8 @@
 
 Several config lines can be used to specify multiple configuration commands.
 
+Use curves option instead of enabling config = Curves:list_curves to support elliptic curves.
+
 This option requires OpenSSL 1.0.2 or later.
 
 </dd>
@@ -524,9 +562,7 @@
 
 If no host is specified, the host defaults to localhost.
 
-Multiple connect options are allowed in a single service section.
-
-If host resolves to multiple addresses and/or if multiple connect options are specified, then the remote address is chosen using a round-robin algorithm.
+Multiple connect options are allowed in a single service section. If host resolves to multiple addresses and/or if multiple connect options are specified, then the remote address is chosen using a round-robin algorithm.
 
 </dd>
 <dt id="CRLpath-DIRECTORY">CRLpath = DIRECTORY</dt>
@@ -549,16 +585,22 @@
 This file contains multiple CRLs, used with the verifyChain and verifyPeer options.
 
 </dd>
-<dt id="curve-NID">curve = NID</dt>
+<dt id="curves-list">curves = list</dt>
 <dd>
 
-specify ECDH curve name
+ECDH curves separated with &#39;:&#39;
+
+Only a single curve name is allowed for OpenSSL older than 1.1.1.
 
 To get a list of supported curves use:
 
-<pre><code> openssl ecparam -list_curves</code></pre>
+<pre><code>openssl ecparam -list_curves</code></pre>
 
-default: prime256v1
+default:
+
+<pre><code>X25519:P-256:X448:P-521:P-384 (OpenSSL 1.1.1 or later)
+
+prime256v1 (OpenSSL older than 1.1.1)</code></pre>
 
 </dd>
 <dt id="logId-TYPE">logId = TYPE</dt>
@@ -606,7 +648,9 @@
 
 debugging level
 
-Level is a one of the syslog level names or numbers emerg (0), alert (1), crit (2), err (3), warning (4), notice (5), info (6), or debug (7). All logs for the specified level and all levels numerically less than it will be shown. Use debug = debug or debug = 7 for greatest debugging output. The default is notice (5).
+Level is a one of the syslog level names or numbers emerg (0), alert (1), crit (2), err (3), warning (4), notice (5), info (6), or debug (7). All logs for the specified level and all levels numerically less than it will be shown. The default is notice (5).
+
+While the debug = debug or debug = 7 level generates the most verbose output, it is only intended to be used by stunnel developers. Please only use this value if you are a developer, or you intend to send your logs to our technical support. Otherwise, the generated logs will be confusing.
 
 </dd>
 <dt id="delay-yes-no">delay = yes | no</dt>
@@ -694,13 +738,13 @@
 
 for global options:
 
-<pre><code> 00-global.conf</code></pre>
+<pre><code>00-global.conf</code></pre>
 
 for local service-level options:
 
-<pre><code> 01-service.conf
+<pre><code>01-service.conf
 
- 02-service.conf</code></pre>
+02-service.conf</code></pre>
 
 </dd>
 <dt id="key-KEY_FILE">key = KEY_FILE</dt>
@@ -710,7 +754,7 @@
 
 A private key is needed to authenticate the certificate owner. Since this file should be kept secret it should only be readable by its owner. On Unix systems you can use the following command:
 
-<pre><code> chmod 600 keyfile</code></pre>
+<pre><code>chmod 600 keyfile</code></pre>
 
 This parameter is also used as the private key identifier when a hardware engine is enabled.
 
@@ -774,12 +818,14 @@
 
 For example, for compatibility with the erroneous Eudora TLS implementation, the following option can be used:
 
-<pre><code> options = DONT_INSERT_EMPTY_FRAGMENTS</code></pre>
+<pre><code>options = DONT_INSERT_EMPTY_FRAGMENTS</code></pre>
 
 default:
 
-<pre><code> options = NO_SSLv2
- options = NO_SSLv3</code></pre>
+<pre><code>options = NO_SSLv2
+options = NO_SSLv3</code></pre>
+
+Use sslVersionMax or sslVersionMin option instead of disabling specific TLS protocol versions when compiled with OpenSSL 1.1.0 or later.
 
 </dd>
 <dt id="protocol-PROTO">protocol = PROTO</dt>
@@ -799,6 +845,20 @@
 Proprietary (undocummented) extension of CIFS protocol implemented in Samba. Support for this extension was dropped in Samba 3.0.0.
 
 </dd>
+<dt id="capwin">capwin</dt>
+<dd>
+
+http://www.capwin.org/ application support
+
+</dd>
+<dt id="capwinctrl">capwinctrl</dt>
+<dd>
+
+http://www.capwin.org/ application support
+
+This protocol is only supported in client mode.
+
+</dd>
 <dt id="connect">connect</dt>
 <dd>
 
@@ -813,6 +873,12 @@
 Based on RFC 2595 - Using TLS with IMAP, POP3 and ACAP
 
 </dd>
+<dt id="ldap">ldap</dt>
+<dd>
+
+Based on RFC 2830 - Lightweight Directory Access Protocol (v3): Extension for Transport Layer Security
+
+</dd>
 <dt id="nntp">nntp</dt>
 <dd>
 
@@ -836,7 +902,7 @@
 <dt id="proxy">proxy</dt>
 <dd>
 
-Haproxy client IP address http://haproxy.1wt.eu/download/1.5/doc/proxy-protocol.txt
+Passing of the original client IP address with HAProxy PROXY protocol version 1 https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt
 
 </dd>
 <dt id="smtp">smtp</dt>
@@ -882,14 +948,22 @@
 Currently, this option is only supported in the client-side &#39;connect&#39; protocol.
 
 </dd>
-<dt id="protocolHost-HOST:PORT">protocolHost = HOST:PORT</dt>
+<dt id="protocolHeader-HEADER">protocolHeader = HEADER</dt>
+<dd>
+
+header for the protocol negotiations
+
+Currently, this option is only supported in the client-side &#39;connect&#39; protocol.
+
+</dd>
+<dt id="protocolHost-ADDRESS">protocolHost = ADDRESS</dt>
 <dd>
 
-destination address for the protocol negotiations
+host address for the protocol negotiations
 
-protocolHost specifies the final TLS server to be connected to by the proxy, and not the proxy server directly connected by stunnel. The proxy server should be specified with the &#39;connect&#39; option.
+For the &#39;connect&#39; protocol negotiations, protocolHost specifies HOST:PORT of the final TLS server to be connected to by the proxy. The proxy server directly connected by stunnel must be specified with the connect option.
 
-Currently the protocol destination address only applies to the &#39;connect&#39; protocol.
+For the &#39;smtp&#39; protocol negotiations, protocolHost controls the client SMTP HELO/EHLO value.
 
 </dd>
 <dt id="protocolPassword-PASSWORD">protocolPassword = PASSWORD</dt>
@@ -925,9 +999,9 @@
 
 Each line of the file in the following format:
 
-<pre><code> IDENTITY:KEY</code></pre>
+<pre><code>IDENTITY:KEY</code></pre>
 
-The key is required to be at least 20 characters long. The file should not be world-readable nor world-writable.
+Hexadecimal keys are automatically converted to binary form. Keys are required to be at least 16 bytes long, which implies at least 32 characters for hexadecimal keys. The file should neither be world-readable nor world-writable.
 
 </dd>
 <dt id="pty-yes-no-Unix-only">pty = yes | no (Unix only)</dt>
@@ -978,6 +1052,60 @@
 default: no
 
 </dd>
+<dt id="securityLevel-LEVEL">securityLevel = LEVEL</dt>
+<dd>
+
+set the security level
+
+The meaning of each level is described below:
+
+<dl>
+
+<dt id="level-0">level 0</dt>
+<dd>
+
+Everything is permitted.
+
+</dd>
+<dt id="level-1">level 1</dt>
+<dd>
+
+The security level corresponds to a minimum of 80 bits of security. Any parameters offering below 80 bits of security are excluded. As a result RSA, DSA and DH keys shorter than 1024 bits and ECC keys shorter than 160 bits are prohibited. All export cipher suites are prohibited since they all offer less than 80 bits of security. SSL version 2 is prohibited. Any cipher suite using MD5 for the MAC is also prohibited.
+
+</dd>
+<dt id="level-2">level 2</dt>
+<dd>
+
+Security level set to 112 bits of security. As a result RSA, DSA and DH keys shorter than 2048 bits and ECC keys shorter than 224 bits are prohibited. In addition to the level 1 exclusions any cipher suite using RC4 is also prohibited. SSL version 3 is also not allowed. Compression is disabled.
+
+</dd>
+<dt id="level-3">level 3</dt>
+<dd>
+
+Security level set to 128 bits of security. As a result RSA, DSA and DH keys shorter than 3072 bits and ECC keys shorter than 256 bits are prohibited. In addition to the level 2 exclusions cipher suites not offering forward secrecy are prohibited. TLS versions below 1.1 are not permitted. Session tickets are disabled.
+
+</dd>
+<dt id="level-4">level 4</dt>
+<dd>
+
+Security level set to 192 bits of security. As a result RSA, DSA and DH keys shorter than 7680 bits and ECC keys shorter than 384 bits are prohibited. Cipher suites using SHA1 for the MAC are prohibited. TLS versions below 1.2 are not permitted.
+
+</dd>
+<dt id="level-5">level 5</dt>
+<dd>
+
+Security level set to 256 bits of security. As a result RSA, DSA and DH keys shorter than 15360 bits and ECC keys shorter than 512 bits are prohibited.
+
+</dd>
+<dt id="default:-2">default: 2</dt>
+<dd>
+
+</dd>
+</dl>
+
+The securityLevel option is only available when compiled with OpenSSL 1.1.0 and later.
+
+</dd>
 <dt id="requireCert-yes-no">requireCert = yes | no</dt>
 <dd>
 
@@ -1028,6 +1156,14 @@
 This is the number of seconds to keep cached TLS sessions.
 
 </dd>
+<dt id="sessionResume-yes-no">sessionResume = yes | no</dt>
+<dd>
+
+allow or disallow session resumption
+
+default: yes
+
+</dd>
 <dt id="sessiond-HOST:PORT">sessiond = HOST:PORT</dt>
 <dd>
 
@@ -1037,15 +1173,15 @@
 <dt id="sni-SERVICE_NAME:SERVER_NAME_PATTERN-server-mode">sni = SERVICE_NAME:SERVER_NAME_PATTERN (server mode)</dt>
 <dd>
 
-Use the service as a slave service (a name-based virtual server) for Server Name Indication TLS extension (RFC 3546).
+Use the service as a secondary service (a name-based virtual server) for Server Name Indication TLS extension (RFC 3546).
 
-SERVICE_NAME specifies the master service that accepts client connections with the accept option. SERVER_NAME_PATTERN specifies the host name to be redirected. The pattern may start with the &#39;*&#39; character, e.g. &#39;*.example.com&#39;. Multiple slave services are normally specified for a single master service. The sni option can also be specified more than once within a single slave service.
+SERVICE_NAME specifies the primary service that accepts client connections with the accept option. SERVER_NAME_PATTERN specifies the host name to be redirected. The pattern may start with the &#39;*&#39; character, e.g. &#39;*.example.com&#39;. Multiple secondary services are normally specified for a single primary service. The sni option can also be specified more than once within a single secondary service.
 
-This service, as well as the master service, may not be configured in client mode.
+This service, as well as the primary service, may not be configured in client mode.
 
-The connect option of the slave service is ignored when the protocol option is specified, as protocol connects to the remote host before TLS handshake.
+The connect option of the secondary service is ignored when the protocol option is specified, as protocol connects to the remote host before TLS handshake.
 
-Libwrap checks (Unix only) are performed twice: with the master service name after TCP connection is accepted, and with the slave service name during the TLS handshake.
+Libwrap checks (Unix only) are performed twice: with the primary service name after TCP connection is accepted, and with the secondary service name during the TLS handshake.
 
 The sni option is only available when compiled with OpenSSL 1.0.0 and later.
 
@@ -1069,15 +1205,15 @@
 
 Examples:
 
-<pre><code> socket = l:SO_LINGER=1:60
- set one minute timeout for closing local socket
- socket = r:SO_OOBINLINE=yes
- place out-of-band data directly into the
- receive data stream for remote sockets
- socket = a:SO_REUSEADDR=no
- disable address reuse (enabled by default)
- socket = a:SO_BINDTODEVICE=lo
- only accept connections on loopback interface</code></pre>
+<pre><code>socket = l:SO_LINGER=1:60
+ set one minute timeout for closing local socket
+socket = r:SO_OOBINLINE=yes
+ place out-of-band data directly into the
+ receive data stream for remote sockets
+socket = a:SO_REUSEADDR=no
+ disable address reuse (enabled by default)
+socket = a:SO_BINDTODEVICE=lo
+ only accept connections on loopback interface</code></pre>
 
 </dd>
 <dt id="sslVersion-SSL_VERSION">sslVersion = SSL_VERSION</dt>
@@ -1085,26 +1221,94 @@
 
 select the TLS protocol version
 
-Supported versions: all, SSLv2, SSLv3, TLSv1, TLSv1.1, TLSv1.2
+Supported versions: all, SSLv2, SSLv3, TLSv1, TLSv1.1, TLSv1.2, TLSv1.3
+
+Availability of specific protocols depends on the linked OpenSSL library. Older versions of OpenSSL do not support TLSv1.1, TLSv1.2 and TLSv1.3. Newer versions of OpenSSL do not support SSLv2.
+
+Obsolete SSLv2 and SSLv3 are currently disabled by default.
+
+Setting the option
+
+<pre><code>sslVersion = SSL_VERSION</code></pre>
 
-sslVersion is obsolete and it will be removed in future releases of stunnel. Use the following options instead:
+is equivalent to options
 
-<pre><code> options = NO_SSLv2
- options = NO_SSLv3
- options = NO_TLSv1
- options = NO_TLSv1.1
- options = NO_TLSv1.2
- options = NO_TLSv1.3</code></pre>
+<pre><code>sslVersionMax = SSL_VERSION
+sslVersionMin = SSL_VERSION</code></pre>
 
-Availability of specific protocols depends on the linked OpenSSL library. Older versions of OpenSSL do not support TLSv1.1 and TLSv1.2. Newer versions of OpenSSL do not support SSLv2.
+when compiled with OpenSSL 1.1.0 and later.
 
-Obsolete SSLv2 and SSLv3 are currently disabled by default. See the options option documentation for details.
+</dd>
+<dt id="sslVersionMax-SSL_VERSION">sslVersionMax = SSL_VERSION</dt>
+<dd>
+
+maximum supported protocol versions
+
+Supported versions: all, SSLv3, TLSv1, TLSv1.1, TLSv1.2, TLSv1.3
+
+all enable protocol versions up to the highest version supported by the linked OpenSSL library.
+
+Availability of specific protocols depends on the linked OpenSSL library.
+
+The sslVersionMax option is only available when compiled with OpenSSL 1.1.0 and later.
+
+default: all
+
+</dd>
+<dt id="sslVersionMin-SSL_VERSION">sslVersionMin = SSL_VERSION</dt>
+<dd>
+
+minimum supported protocol versions
+
+Supported versions: all, SSLv3, TLSv1, TLSv1.1, TLSv1.2, TLSv1.3
+
+all enable protocol versions down to the lowest version supported by the linked OpenSSL library.
+
+Availability of specific protocols depends on the linked OpenSSL library.
+
+The sslVersionMin option is only available when compiled with OpenSSL 1.1.0 and later.
+
+default: TLSv1
 
 </dd>
 <dt id="stack-BYTES-except-for-FORK-model">stack = BYTES (except for FORK model)</dt>
 <dd>
 
-thread stack size
+CPU stack size of created threads
+
+Excessive thread stack size increases virtual memory usage. Insufficient thread stack size may cause application crashes.
+
+default: 65536 bytes (sufficient for all platforms we tested)
+
+</dd>
+<dt id="ticketKeySecret-SECRET">ticketKeySecret = SECRET</dt>
+<dd>
+
+hexadecimal symmetric key used for session ticket confidentiality protection
+
+Session tickets defined in RFC 5077 provide an enhanced session resumption capability, where the server-side caching is not required to maintain per session state.
+
+Combining ticketKeySecret and ticketMacSecret options allow to resume a negotiated session on other cluster nodes, or to resume a negotiated session after server restart.
+
+The key is required to be either 16 or 32 bytes long, which implies exactly 32 or 64 hexadecimal digits. Colons may optionally be used between two-character hexadecimal bytes.
+
+This option only works in server mode.
+
+The ticketKeySecret option is only available when compiled with OpenSSL 1.0.0 and later.
+
+Disabling NO_TICKET option is required for the ticket support in OpenSSL older than 1.1.1, but note that this option is incompatible with the redirect option.
+
+</dd>
+<dt id="ticketMacSecret-SECRET">ticketMacSecret = SECRET</dt>
+<dd>
+
+hexadecimal symmetric key used for session ticket integrity protection
+
+The key is required to be either 16 or 32 bytes long, which implies exactly 32 or 64 hexadecimal digits. Colons may optionally be used between two-character hexadecimal bytes.
+
+This option only works in server mode.
+
+The ticketMacSecret option is only available when compiled with OpenSSL 1.0.0 and later.
 
 </dd>
 <dt id="TIMEOUTbusy-SECONDS">TIMEOUTbusy = SECONDS</dt>
@@ -1162,13 +1366,13 @@
 
 This configuration requires the following setup for iptables and routing (possibly in /etc/rc.local or equivalent file):
 
-<pre><code> iptables -t mangle -N DIVERT
- iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT
- iptables -t mangle -A DIVERT -j MARK --set-mark 1
- iptables -t mangle -A DIVERT -j ACCEPT
- ip rule add fwmark 1 lookup 100
- ip route add local 0.0.0.0/0 dev lo table 100
- echo 0 &gt;/proc/sys/net/ipv4/conf/lo/rp_filter</code></pre>
+<pre><code>iptables -t mangle -N DIVERT
+iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT
+iptables -t mangle -A DIVERT -j MARK --set-mark 1
+iptables -t mangle -A DIVERT -j ACCEPT
+ip rule add fwmark 1 lookup 100
+ip route add local 0.0.0.0/0 dev lo table 100
+echo 0 &gt;/proc/sys/net/ipv4/conf/lo/rp_filter</code></pre>
 
 stunnel must also to be executed as root and without the setuid option.
 
@@ -1203,24 +1407,24 @@
 
 A service section for transparent destination may look like this:
 
-<pre><code> transparent
- client = yes
- accept = &lt;stunnel_port&gt;
- transparent = destination</code></pre>
+<pre><code>transparent
+client = yes
+accept = &lt;stunnel_port&gt;
+transparent = destination</code></pre>
 
 This configuration requires iptables setup to work, possibly in /etc/rc.local or equivalent file.
 
 For a connect target installed on the same host:
 
-<pre><code> /sbin/iptables -t nat -I OUTPUT -p tcp --dport &lt;redirected_port&gt; \
- -m ! --uid-owner &lt;stunnel_user_id&gt; \
- -j DNAT --to-destination &lt;local_ip&gt;:&lt;stunnel_port&gt;</code></pre>
+<pre><code>/sbin/iptables -t nat -I OUTPUT -p tcp --dport &lt;redirected_port&gt; \
+ -m ! --uid-owner &lt;stunnel_user_id&gt; \
+ -j DNAT --to-destination &lt;local_ip&gt;:&lt;stunnel_port&gt;</code></pre>
 
 For a connect target installed on a remote host:
 
-<pre><code> /sbin/iptables -I INPUT -i eth0 -p tcp --dport &lt;stunnel_port&gt; -j ACCEPT
- /sbin/iptables -t nat -I PREROUTING -p tcp --dport &lt;redirected_port&gt; \
- -i eth0 -j DNAT --to-destination &lt;local_ip&gt;:&lt;stunnel_port&gt;</code></pre>
+<pre><code>/sbin/iptables -I INPUT -i eth0 -p tcp --dport &lt;stunnel_port&gt; -j ACCEPT
+/sbin/iptables -t nat -I PREROUTING -p tcp --dport &lt;redirected_port&gt; \
+ -i eth0 -j DNAT --to-destination &lt;local_ip&gt;:&lt;stunnel_port&gt;</code></pre>
 
 The transparent destination option is currently only supported on Linux.
 
@@ -1261,31 +1465,31 @@
 
 <dl>
 
-<dt id="level-0">level 0</dt>
+<dt id="level-01">level 0</dt>
 <dd>
 
 Request and ignore the peer certificate.
 
 </dd>
-<dt id="level-1">level 1</dt>
+<dt id="level-11">level 1</dt>
 <dd>
 
 Verify the peer certificate if present.
 
 </dd>
-<dt id="level-2">level 2</dt>
+<dt id="level-21">level 2</dt>
 <dd>
 
 Verify the peer certificate.
 
 </dd>
-<dt id="level-3">level 3</dt>
+<dt id="level-31">level 3</dt>
 <dd>
 
 Verify the peer against a locally installed certificate.
 
 </dd>
-<dt id="level-4">level 4</dt>
+<dt id="level-41">level 4</dt>
 <dd>
 
 Ignore the chain and only verify the peer certificate.
@@ -1371,6 +1575,12 @@
 Close and reopen the stunnel log file. This function can be used for log rotation.
 
 </dd>
+<dt id="SIGUSR2">SIGUSR2</dt>
+<dd>
+
+Log the list of active connections.
+
+</dd>
 <dt id="SIGTERM-SIGQUIT-SIGINT">SIGTERM, SIGQUIT, SIGINT</dt>
 <dd>
 
@@ -1385,116 +1595,116 @@
 
 In order to provide TLS encapsulation to your local imapd service, use:
 
-<pre><code> imapd
- accept = 993
- exec = /usr/sbin/imapd
- execArgs = imapd</code></pre>
+<pre><code>imapd
+accept = 993
+exec = /usr/sbin/imapd
+execArgs = imapd</code></pre>
 
 or in remote mode:
 
-<pre><code> imapd
- accept = 993
- connect = 143</code></pre>
+<pre><code>imapd
+accept = 993
+connect = 143</code></pre>
 
 In order to let your local e-mail client connect to a TLS-enabled imapd service on another server, configure the e-mail client to connect to localhost on port 119 and use:
 
-<pre><code> imap
- client = yes
- accept = 143
- connect = servername:993</code></pre>
+<pre><code>imap
+client = yes
+accept = 143
+connect = servername:993</code></pre>
 
 If you want to provide tunneling to your pppd daemon on port 2020, use something like:
 
-<pre><code> vpn
- accept = 2020
- exec = /usr/sbin/pppd
- execArgs = pppd local
- pty = yes</code></pre>
+<pre><code>vpn
+accept = 2020
+exec = /usr/sbin/pppd
+execArgs = pppd local
+pty = yes</code></pre>
 
 If you want to use stunnel in inetd mode to launch your imapd process, you&#39;d use this stunnel.conf. Note there must be no service_name section.
 
-<pre><code> exec = /usr/sbin/imapd
- execArgs = imapd</code></pre>
+<pre><code>exec = /usr/sbin/imapd
+execArgs = imapd</code></pre>
 
 To setup SOCKS VPN configure the following client service:
 
-<pre><code> socks_client
- client = yes
- accept = 127.0.0.1:1080
- connect = vpn_server:9080
- verifyPeer = yes
- CAfile = stunnel.pem</code></pre>
+<pre><code>socks_client
+client = yes
+accept = 127.0.0.1:1080
+connect = vpn_server:9080
+verifyPeer = yes
+CAfile = stunnel.pem</code></pre>
 
 The corresponding configuration on the vpn_server host:
 
-<pre><code> socks_server
- protocol = socks
- accept = 9080
- cert = stunnel.pem
- key = stunnel.key</code></pre>
+<pre><code>socks_server
+protocol = socks
+accept = 9080
+cert = stunnel.pem
+key = stunnel.key</code></pre>
 
 Now test your configuration on the client machine with:
 
-<pre><code> curl --socks4a localhost http://www.example.com/</code></pre>
+<pre><code>curl --socks4a localhost http://www.example.com/</code></pre>
 
 An example server mode SNI configuration:
 
-<pre><code> virtual
- ; master service
- accept = 443
- cert = default.pem
- connect = default.internal.mydomain.com:8080
-
- sni1
- ; slave service 1
- sni = virtual:server1.mydomain.com
- cert = server1.pem
- connect = server1.internal.mydomain.com:8081
-
- sni2
- ; slave service 2
- sni = virtual:server2.mydomain.com
- cert = server2.pem
- connect = server2.internal.mydomain.com:8082
- verifyPeer = yes
- CAfile = server2-allowed-clients.pem</code></pre>
+<pre><code>virtual
+; primary service
+accept = 443
+cert = default.pem
+connect = default.internal.mydomain.com:8080
+
+sni1
+; secondary service 1
+sni = virtual:server1.mydomain.com
+cert = server1.pem
+connect = server1.internal.mydomain.com:8081
+
+sni2
+; secondary service 2
+sni = virtual:server2.mydomain.com
+cert = server2.pem
+connect = server2.internal.mydomain.com:8082
+verifyPeer = yes
+CAfile = server2-allowed-clients.pem</code></pre>
 
 An example of advanced engine configuration allows for authentication with private keys stored in the Windows certificate store (Windows only). With the CAPI engine you don&#39;t need to manually select the client key to use. The client key is automatically selected based on the list of CAs trusted by the server.
 
-<pre><code> engine = capi
+<pre><code>engine = capi
 
- service
- engineId = capi
- client = yes
- accept = 127.0.0.1:8080
- connect = example.com:8443</code></pre>
+service
+engineId = capi
+client = yes
+accept = 127.0.0.1:8080
+connect = example.com:8443</code></pre>
 
 An example of advanced engine configuration to use the certificate and the corresponding private key from a pkcs11 engine:
 
-<pre><code> engine = pkcs11
- engineCtrl = MODULE_PATH:opensc-pkcs11.so
- engineCtrl = PIN:123456
+<pre><code>engine = pkcs11
+engineCtrl = MODULE_PATH:opensc-pkcs11.so
+engineCtrl = PIN:123456
 
- service
- engineId = pkcs11
- client = yes
- accept = 127.0.0.1:8080
- connect = example.com:843
- cert = pkcs11:token=MyToken;object=MyCert
- key = pkcs11:token=MyToken;object=MyKey</code></pre>
+service
+engineId = pkcs11
+client = yes
+accept = 127.0.0.1:8080
+connect = example.com:843
+cert = pkcs11:token=MyToken;object=MyCert
+key = pkcs11:token=MyToken;object=MyKey</code></pre>
 
 An example of advanced engine configuration to use the certificate and the corresponding private key from a SoftHSM token:
 
-<pre><code> engine = pkcs11
- engineCtrl = MODULE_PATH:softhsm2.dll
- engineCtrl = PIN:12345
+<pre><code>engine = pkcs11
+engineCtrl = MODULE_PATH:softhsm2.dll
+engineCtrl = PIN:12345
 
- service
- engineId = pkcs11
- client = yes
- accept = 127.0.0.1:8080
- connect = example.com:843
- cert = pkcs11:token=MyToken;object=KeyCert</code></pre>
+service
+engineId = pkcs11
+client = yes
+accept = 127.0.0.1:8080
+connect = example.com:843
+cert = pkcs11:token=MyToken;object=KeyCert</code></pre>
 
 <a href="#_podtop_"><h1 id="NOTES">NOTES</h1></a>
 
@@ -1508,7 +1718,7 @@
 
 For example, if you have the following line in inetd.conf:
 
-<pre><code> imaps stream tcp nowait root @bindir@/stunnel stunnel @sysconfdir@/stunnel/imaps.conf</code></pre>
+<pre><code>imaps stream tcp nowait root @bindir@/stunnel stunnel @sysconfdir@/stunnel/imaps.conf</code></pre>
 
 In these cases, the inetd-style program is responsible for binding a network socket (imaps above) and handing it to stunnel when a connection is received. Thus you do not want stunnel to have any accept option. All the Service Level Options should be placed in the global options section, and no service_name section will be present. See the EXAMPLES section for example configurations.
 
@@ -1516,16 +1726,14 @@
 
 Each TLS-enabled daemon needs to present a valid X.509 certificate to the peer. It also needs a private key to decrypt the incoming data. The easiest way to obtain a certificate and a key is to generate them with the free OpenSSL package. You can find more information on certificates generation on pages listed below.
 
-The order of contents of the .pem file is important. It should contain the unencrypted private key first, then a signed certificate (not certificate request). There should also be empty lines after the certificate and the private key. Any plaintext certificate information appended on the top of generated certificate should be discarded. So the file should look like this:
+The .pem file should contain the unencrypted private key and a signed certificate (not certificate request). So the file should look like this:
 
-<pre><code> -----BEGIN RSA PRIVATE KEY-----
- encoded key
- -----END RSA PRIVATE KEY-----
- empty line
- -----BEGIN CERTIFICATE-----
- encoded certificate
- -----END CERTIFICATE-----
- empty line</code></pre>
+<pre><code>-----BEGIN RSA PRIVATE KEY-----
+encoded key
+-----END RSA PRIVATE KEY-----
+-----BEGIN CERTIFICATE-----
+encoded certificate
+-----END CERTIFICATE-----</code></pre>
 
 <h2 id="RANDOMNESS">RANDOMNESS</h2>
 
@@ -1571,7 +1779,7 @@
 
 Alternatively, it is possible to specify static DH parameters in the certificate file, which disables generating temporary DH parameters:
 
-<pre><code> openssl dhparam 2048 &gt;&gt; stunnel.pem</code></pre>
+<pre><code>openssl dhparam 2048 &gt;&gt; stunnel.pem</code></pre>
 
 <a href="#_podtop_"><h1 id="FILES">FILES</h1></a>
 
@@ -1623,7 +1831,7 @@
 
 <dl>
 
-<dt id="Micha-Trojnara">Micha&#x142; Trojnara</dt>
+<dt id="Micha-Trojnara">Michał Trojnara</dt>
 <dd>
 
 &lt;Michal.Trojnara@stunnel.org&gt;

_service:tar_scm:stunnel-5.48.tar.gz/doc/stunnel.pl.8.in -> _service:tar_scm:stunnel-5.69.tar.gz/doc/stunnel.pl.8.in Changed

@@ -1,4 +1,4 @@
-.\" Automatically generated by Pod::Man 4.07 (Pod::Simple 3.32)
+.\" Automatically generated by Pod::Man 4.14 (Pod::Simple 3.42)
 .\"
 .\" Standard preamble:
 .\" ========================================================================
@@ -54,20 +54,24 @@
 .\" Avoid warning from groff about undefined register 'F'.
 .de IX
 ..
-.if !\nF .nr F 0
-.if \nF>0 \{\
-.    de IX
-.    tm Index:\\$1\t\\n%\t"\\$2"
+.nr rF 0
+.if \n(.g .if rF .nr rF 1
+.if (\n(rF:(\n(.g==0)) \{\
+.    if \nF \{\
+.        de IX
+.        tm Index:\\$1\t\\n%\t"\\$2"
 ..
-.    if !\nF==2 \{\
-.        nr % 0
-.        nr F 2
+.        if !\nF==2 \{\
+.            nr % 0
+.            nr F 2
+.        \}
 .    \}
 .\}
+.rr rF
 .\" ========================================================================
 .\"
 .IX Title "stunnel 8"
-.TH stunnel 8 "2018.07.02" "5.48" "stunnel TLS Proxy"
+.TH stunnel 8 "2023.02.07" "5.69" "stunnel TLS Proxy"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
@@ -163,7 +167,7 @@
 ścieżką do gniazda Unix (tylko Unix)
 .SS "\s-1OPCJE GLOBALNE\s0"
 .IX Subsection "OPCJE GLOBALNE"
-.IP "\fBchroot\fR = \s-1KATALOG \s0(tylko Unix)" 4
+.IP "\fBchroot\fR = \s-1KATALOG\s0 (tylko Unix)" 4
 .IX Item "chroot = KATALOG (tylko Unix)"
 katalog roboczego korzenia systemu plików
 .Sp
@@ -199,8 +203,14 @@
 emerg (0), alert (1), crit (2), err (3), warning (4), notice (5),
 info (6) lub debug (7).
 Zapisywane są komunikaty o poziomie niższym (numerycznie) lub równym podanemu.
-Do uzyskania najwyższego poziomu szczegółowości można użyć opcji
-\&\fIdebug = debug\fR lub \fIdebug = 7\fR.  Domyślnym poziomem jest notice (5).
+Domyślnym poziomem jest notice (5).
+.Sp
+Jakkolwiek użycie \fIdebug = debug\fR lub \fIdebug = 7\fR zapewnia najbardziej
+szczegółowe logi, ich zawartość jest użyteczna jedynie dla programistów
+zajmujących się stunnelem.  Użyj tego poziomu logowania jedynie jeśli jesteś
+programistką/programistą stunnela, albo przygotowujesz szczegółowe informacje
+celem przesłania do wsparcia technicznego.  W przeciwnym wypadku próba analizy
+zawartości logów \fBbędzie\fR jedynie źródłem dodatkowego zamieszania.
 .Sp
 O ile nie wyspecyfikowano podsystemu użyty będzie domyślny: daemon.
 Podsystemy nie są wspierane przez platformę Win32.
@@ -215,23 +225,23 @@
 \&\fBOpenSSL\fR.
 .IP "\fBengine\fR = auto | IDENTYFIKATOR_URZĄDZENIA" 4
 .IX Item "engine = auto | IDENTYFIKATOR_URZĄDZENIA"
-wybór sprzętowego urządzenia kryptograficznego
+wybór silnika kryptograficznego
 .Sp
-domyślnie: bez wykorzystania urządzeń kryptograficznych
+domyślnie: bez wykorzystania silników kryptograficznych
 .Sp
 Sekcja PRZYKŁADY zawiera przykładowe konfiguracje wykorzystujące
-urządzenia kryptograficzne.
+silniki kryptograficzne.
 .IP "\fBengineCtrl\fR = KOMENDA:PARAMETR" 4
 .IX Item "engineCtrl = KOMENDA:PARAMETR"
-konfiguracja urządzenia kryptograficznego
+konfiguracja silnika kryptograficznego
 .IP "\fBengineDefault\fR = LISTA_ZADAŃ" 4
 .IX Item "engineDefault = LISTA_ZADAŃ"
-lista zadań OpenSSL oddelegowanych do bieżącego urządzenia
+lista zadań OpenSSL oddelegowanych do bieżącego silnika
 .Sp
 Parametrem jest lista oddzielonych przecinkami zadań OpenSSL, które mają
-zostać oddelegowane do bieżącego urządzenia kryptograficznego.
+zostać oddelegowane do bieżącego silnika kryptograficznego.
 .Sp
-W zależności od konkretnego urządzenia dostępne mogą być następujące zadania:
+W zależności od konkretnego silnika dostępne mogą być następujące zadania:
 \&\s-1ALL, RSA, DSA, ECDH, ECDSA, DH, RAND, CIPHERS, DIGESTS, PKEY, PKEY_CRYPTO,
 PKEY_ASN1.\s0
 .IP "\fBfips\fR = yes | no" 4
@@ -282,7 +292,7 @@
 Do kierowania komunikatów na standardowe wyjście (na przykład po to, żeby
 zalogować je programem splogger z pakietu daemontools) można podać jako
 parametr urządzenie /dev/stdout.
-.IP "\fBpid\fR = \s-1PLIK \s0(tylko Unix)" 4
+.IP "\fBpid\fR = \s-1PLIK\s0 (tylko Unix)" 4
 .IX Item "pid = PLIK (tylko Unix)"
 położenie pliku z numerem procesu
 .Sp
@@ -304,7 +314,7 @@
 nadpisz plik nowymi wartościami pseudolosowymi
 .Sp
 domyślnie: yes (nadpisz)
-.IP "\fBservice\fR = \s-1SERWIS \s0(tylko Unix)" 4
+.IP "\fBservice\fR = \s-1SERWIS\s0 (tylko Unix)" 4
 .IX Item "service = SERWIS (tylko Unix)"
 nazwa usługi
 .Sp
@@ -346,9 +356,19 @@
 .Vb 1
 \&    accept = :::port
 .Ve
+.IP "\fBCAengine\fR = \s-1IDENTYFIKATOR_CA_W_ENGINE\s0" 4
+.IX Item "CAengine = IDENTYFIKATOR_CA_W_ENGINE"
+ładuje zaufane certyfikaty Centrum certyfikacji z silnika
+.Sp
+Opcja pozwala określić położenie pliku zawierającego certyfikaty używane
+przez opcję \fIverifyChain\fR lub \fIverifyPeer\fR.
+.Sp
+Opcja może być użyta wielokrotnie w pojedynczej sekcji.
+.Sp
+Aktualnie wspierane silniki: pkcs11, cng.
 .IP "\fBCApath\fR = \s-1KATALOG_CA\s0" 4
 .IX Item "CApath = KATALOG_CA"
-katalog Centrum Certyfikacji
+ładuje zaufane certyfikaty Centrum certyfikacji z katalogu
 .Sp
 Opcja określa katalog, w którym \fBstunnel\fR będzie szukał certyfikatów, jeżeli
 użyta została opcja \fIverifyChain\fR lub \fIverifyPeer\fR.  Pliki z certyfikatami
@@ -362,7 +382,7 @@
 względem tego katalogu.
 .IP "\fBCAfile\fR = \s-1PLIK_CA\s0" 4
 .IX Item "CAfile = PLIK_CA"
-plik Centrum Certyfikacji
+ładuje zaufane certyfikaty Centrum certyfikacji z pliku
 .Sp
 Opcja pozwala określić położenie pliku zawierającego certyfikaty używane
 przez opcję \fIverifyChain\fR lub \fIverifyPeer\fR.
@@ -379,7 +399,7 @@
 Certyfikat jest konieczny, aby używać programu w trybie serwera.
 W trybie klienta certyfikat jest opcjonalny.
 .Sp
-Jeżeli używane jest sprzętowe urządzenie kryptograficzne, to opcja \fBcert\fR
+Jeżeli używany jest silnik kryptograficzny, to opcja \fBcert\fR
 pozwala wybrać identyfikator używanego certyfikatu.
 .IP "\fBcheckEmail\fR = \s-1EMAIL\s0" 4
 .IX Item "checkEmail = EMAIL"
@@ -413,10 +433,21 @@
 Opcja ta wymaga biblioteki OpenSSL w wersji 1.0.2 lub nowszej.
 .IP "\fBciphers\fR = LISTA_SZYFRÓW" 4
 .IX Item "ciphers = LISTA_SZYFRÓW"
-lista dozwolonych szyfrów \s-1TLS\s0
+lista dozwolonych szyfrów dla protokołów SSLv2, SSLv3, TLSv1, TLSv1.1, TLSv1.2
+.Sp
+Ta opcja nie wpływa na listę parametrów kryptograficznych dla protokołu TLSv1.3
 .Sp
 Parametrem tej opcji jest lista szyfrów, które będą użyte przy
 otwieraniu nowych połączeń \s-1TLS,\s0 np.:  \s-1DES\-CBC3\-SHA:IDEA\-CBC\-MD5\s0
+.IP "\fBciphersuites\fR = LISTA_PARAMETRÓW_KRYPTOGRAFICZNYCH" 4
+.IX Item "ciphersuites = LISTA_PARAMETRÓW_KRYPTOGRAFICZNYCH"
+lista dozwolonych parametrów kryptograficznych dla protokołu TLSv1.3
+.Sp
+Parametrem tej opcji są listy parametrów kryptograficznych w kolejności ich preferowania.
+.Sp
+Opcja \fIciphersuites\fR jest dostępna począwszy od \fBOpenSSL 1.1.1\fR.
+.Sp
+domyślnie: \s-1TLS_CHACHA20_POLY1305_SHA256: TLS_AES_256_GCM_SHA384: TLS_AES_128_GCM_SHA256\s0
 .IP "\fBclient\fR = yes | no" 4
 .IX Item "client = yes | no"
 tryb kliencki (zdalna usługa używa \s-1TLS\s0)
@@ -428,12 +459,15 @@
 .Sp
 Komenda konfiguracyjna \fBOpenSSL\fR zostaje wykonana z podanym parametrem.
 Pozwala to na wydawanie komend konfiguracyjnych \fBOpenSSL\fR z pliku
-konfiguracyjnego stunnela.  Dostępne komendy opisane są w manualu
-\&\fI\fISSL_CONF_cmd\fI\|(3ssl)\fR.
+konfiguracyjnego stunnela.  Dostępne komendy opisane są w podręczniku
+\&\fI\f(BISSL_CONF_cmd\fI\|(3ssl)\fR.
 .Sp
 Możliwe jest wyspecyfikowanie wielu opcji \fBOpenSSL\fR przez wielokrotne użycie
 komendy \fBconfig\fR.
 .Sp
+Zamiast wyłączać \fIconfig = Curves:list_curves\fR
+użyj opcji \fIcurves\fR w celu ustawienia krzywych eliptycznych.
+.Sp
 Opcja ta wymaga biblioteki OpenSSL w wersji 1.0.2 lub nowszej.
 .IP "\fBconnect\fR = \s-1HOST:\s0PORT" 4
 .IX Item "connect = HOST:PORT"
@@ -464,9 +498,11 @@
 .Sp
 Opcja pozwala określić położenie pliku zawierającego listy \s-1CRL\s0 używane
 przez opcje \fIverifyChain\fR i \fIverifyPeer\fR.
-.IP "\fBcurve\fR = \s-1NID\s0" 4
-.IX Item "curve = NID"
-krzywa dla \s-1ECDH\s0
+.IP "\fBcurves\fR = lista" 4
+.IX Item "curves = lista"
+krzywe \s-1ECDH\s0 odddzielone ':'
+.Sp
+Wersje OpenSSL starsze niż 1.1.1 pozwalają na użycie tylko jednej krzywej.
 .Sp
 Listę dostępnych krzywych można uzyskać poleceniem:
 .Sp
@@ -474,7 +510,13 @@
 \&    openssl ecparam \-list_curves
 .Ve
 .Sp
-domyślnie: prime256v1
+domyślnie:
+.Sp
+.Vb 1
+\&    X25519:P\-256:X448:P\-521:P\-384 (począwszy od OpenSSL 1.1.1)
+\&
+\&    prime256v1 (OpenSSL starszy niż 1.1.1)
+.Ve
 .IP "\fBlogId\fR = \s-1TYP\s0" 4
 .IX Item "logId = TYP"
 typ identyfikatora połączenia klienta
@@ -530,13 +572,13 @@
 .Sp
 Opóźnione rozwijanie adresu automatycznie aktywuje \fIfailover = prio\fR.
 .Sp
-default: no
+domyślnie: no
 .IP "\fBengineId\fR = NUMER_URZĄDZENIA" 4
 .IX Item "engineId = NUMER_URZĄDZENIA"
-wybierz urządzenie dla usługi
+wybierz silnik kryptograficzny dla usługi
 .IP "\fBengineNum\fR = NUMER_URZĄDZENIA" 4
 .IX Item "engineNum = NUMER_URZĄDZENIA"
-wybierz urządzenie dla usługi
+wybierz silnik kryptograficzny dla usługi
 .Sp
 Urządzenia są numerowane od 1 w górę.
 .IP "\fBexec\fR = ŚCIEŻKA_DO_PROGRAMU" 4
@@ -572,7 +614,7 @@
 .RE
 .IP "\fBident\fR = NAZWA_UŻYTKOWNIKA" 4
 .IX Item "ident = NAZWA_UŻYTKOWNIKA"
-weryfikuj nazwę zdalnego użytkownika korzystając z protokołu \s-1IDENT \s0(\s-1RFC 1413\s0)
+weryfikuj nazwę zdalnego użytkownika korzystając z protokołu \s-1IDENT\s0 (\s-1RFC 1413\s0)
 .IP "\fBinclude\fR = \s-1KATALOG\s0" 4
 .IX Item "include = KATALOG"
 wczytaj fragmenty plików konfiguracyjnych z podanego katalogu
@@ -605,8 +647,8 @@
 \&    chmod 600 keyfile
 .Ve
 .Sp
-Jeżeli używane jest sprzętowe urządzenie kryptograficzne, to opcja \fBkey\fR
-pozwala wybrać identyfikator używanego klucza prywatnego.
+Jeżeli używany jest silnik kryptograficzny, to opcja \fBkey\fR pozwala wybrać
+identyfikator używanego klucza prywatnego.
 .Sp
 domyślnie: wartość opcji \fIcert\fR
 .IP "\fBlibwrap\fR = yes | no" 4
@@ -628,7 +670,7 @@
 weryfikuj certyfikaty przy użyciu respondertów \s-1AIA\s0
 .Sp
 Opcja \fIOCSPaia\fR pozwala na weryfikowanie certyfikatów przy pomocy listy URLi
-responderów \s-1OCSP\s0 przesłanych w rozszerzeniach \s-1AIA \s0(Authority Information Access).
+responderów \s-1OCSP\s0 przesłanych w rozszerzeniach \s-1AIA\s0 (Authority Information Access).
 .IP "\fBOCSPflag\fR = \s-1FLAGA_OCSP\s0" 4
 .IX Item "OCSPflag = FLAGA_OCSP"
 flaga respondera \s-1OCSP\s0
@@ -649,7 +691,7 @@
 .IX Item "options = OPCJE_SSL"
 opcje biblioteki \fBOpenSSL\fR
 .Sp
-Parametrem jest nazwa opcji zgodnie z opisem w \fI\fISSL_CTX_set_options\fI\|(3ssl)\fR,
+Parametrem jest nazwa opcji zgodnie z opisem w \fI\f(BISSL_CTX_set_options\fI\|(3ssl)\fR,
 ale bez przedrostka \fI\s-1SSL_OP_\s0\fR.
 \&\fIstunnel \-options\fR wyświetla opcje dozwolone w aktualnej kombinacji
 programu \fIstunnel\fR i biblioteki \fIOpenSSL\fR.
@@ -670,6 +712,9 @@
 \&    options = NO_SSLv2
 \&    options = NO_SSLv3
 .Ve
+.Sp
+Począwszy od \fBOpenSSL 1.1.0\fR, zamiast wyłączać określone wersje protokołów \s-1TLS\s0
+użyj opcji \fIsslVersionMax\fR lub \fIsslVersionMin\fR.
 .IP "\fBprotocol\fR = PROTOKÓŁ" 4
 .IX Item "protocol = PROTOKÓŁ"
 negocjuj \s-1TLS\s0 podanym protokołem aplikacyjnym
@@ -683,32 +728,44 @@
 .IP "\fIcifs\fR" 4
 .IX Item "cifs"
 Nieudokumentowane rozszerzenie protokołu \s-1CIFS\s0 wspierane przez serwer Samba.
-Wsparcie dla tego rozrzeczenia zostało zarzucone w wersji 3.0.0 serwera Samba.
+Wsparcie dla tego rozszerzenia zostało zarzucone w wersji 3.0.0 serwera Samba.
+.IP "\fIcapwin\fR" 4
+.IX Item "capwin"
+Wsparcie dla aplikacji http://www.capwin.org/
+.IP "\fIcapwinctrl\fR" 4
+.IX Item "capwinctrl"
+Wsparcie dla aplikacji http://www.capwin.org/
+.Sp
+Ten protokół jest wspierany wyłącznie w trybie klienckim.
 .IP "\fIconnect\fR" 4
 .IX Item "connect"
-Negocjacja \s-1RFC 2817 \- \s0\fIUpgrading to \s-1TLS\s0 Within \s-1HTTP/1.1\s0\fR, rozdział 5.2 \- \fIRequesting a Tunnel with \s-1CONNECT\s0\fR
+Negocjacja \s-1RFC 2817\s0 \- \fIUpgrading to \s-1TLS\s0 Within \s-1HTTP/1.1\s0\fR, rozdział 5.2 \- \fIRequesting a Tunnel with \s-1CONNECT\s0\fR
 .Sp
 Ten protokół jest wspierany wyłącznie w trybie klienckim.
 .IP "\fIimap\fR" 4
 .IX Item "imap"
-Negocjacja \s-1RFC 2595 \- \s0\fIUsing \s-1TLS\s0 with \s-1IMAP, POP3\s0 and \s-1ACAP\s0\fR
+Negocjacja \s-1RFC 2595\s0 \- \fIUsing \s-1TLS\s0 with \s-1IMAP, POP3\s0 and \s-1ACAP\s0\fR
+.IP "\fIldap\fR" 4
+.IX Item "ldap"
+Negocjacja \s-1RFC 2830\s0 \- \fILightweight Directory Access Protocol (v3): Extension for Transport Layer Security\fR
 .IP "\fInntp\fR" 4
 .IX Item "nntp"
-Negocjacja \s-1RFC 4642 \- \s0\fIUsing Transport Layer Security (\s-1TLS\s0) with Network News Transfer Protocol (\s-1NNTP\s0)\fR
+Negocjacja \s-1RFC 4642\s0 \- \fIUsing Transport Layer Security (\s-1TLS\s0) with Network News Transfer Protocol (\s-1NNTP\s0)\fR
 .Sp
 Ten protokół jest wspierany wyłącznie w trybie klienckim.
 .IP "\fIpgsql\fR" 4
 .IX Item "pgsql"
-Negocjacja http://www.postgresql.org/docs/8.3/static/protocol\-flow.html#AEN73982
+Negocjacja \fIhttp://www.postgresql.org/docs/8.3/static/protocol\-flow.html#AEN73982\fR
 .IP "\fIpop3\fR" 4
 .IX Item "pop3"
-Negocjacja \s-1RFC 2449 \- \s0\fI\s-1POP3\s0 Extension Mechanism\fR
+Negocjacja \s-1RFC 2449\s0 \- \fI\s-1POP3\s0 Extension Mechanism\fR
 .IP "\fIproxy\fR" 4
 .IX Item "proxy"
-Przekazywanie adresu \s-1IP\s0 haproxy http://haproxy.1wt.eu/download/1.5/doc/proxy\-protocol.txt
+Przekazywanie oryginalnego \s-1IP\s0 klienta przez protokół HAProxy \s-1PROXY\s0 w wersji 1
+\&\fIhttps://www.haproxy.org/download/1.8/doc/proxy\-protocol.txt\fR
 .IP "\fIsmtp\fR" 4
 .IX Item "smtp"
-Negocjacja \s-1RFC 2487 \- \s0\fI\s-1SMTP\s0 Service Extension for Secure \s-1SMTP\s0 over \s-1TLS\s0\fR
+Negocjacja \s-1RFC 2487\s0 \- \fI\s-1SMTP\s0 Service Extension for Secure \s-1SMTP\s0 over \s-1TLS\s0\fR
 .IP "\fIsocks\fR" 4
 .IX Item "socks"
 Wspierany jest protokół \s-1SOCKS\s0 w wersjach 4, 4a i 5.
@@ -742,17 +799,22 @@
 .IX Item "protocolDomain = DOMENA"
 domena do negocjacji protokołu
 .Sp
-W obecnej wersji wybrana domena ma zastosowanie wyłącznie w protokole 'connect'.
-.IP "\fBprotocolHost\fR = \s-1HOST:PORT\s0" 4
-.IX Item "protocolHost = HOST:PORT"
-adres docelowy do negocjacji protokołu
+W obecnej wersji opcja ma zastosowanie wyłącznie w protokole 'connect'.
+.IP "\fBprotocolHeader\fR = NAGŁÓWEK" 4
+.IX Item "protocolHeader = NAGŁÓWEK"
+nagłówek do negocjacji protokołu
+.Sp
+W obecnej wersji opcja ma zastosowanie wyłącznie w protokole 'connect'.
+.IP "\fBprotocolHost\fR = \s-1ADRES\s0" 4
+.IX Item "protocolHost = ADRES"
+adres hosta do negocjacji protokołu
 .Sp
-\&\fIprotocolHost\fR określa docelowy serwer \s-1TLS,\s0 do którego połączyć ma się proxy.
-Nie jest to adres serwera proxy, do którego połączenie zestawia \fBstunnel\fR.
-Adres serwera proxy powinien być określony przy pomocy opcji 'connect'.
+Dla protokołu 'connect', \fIprotocolHost\fR określa docelowy serwer \s-1TLS,\s0 do
+którego połączyć ma się proxy.  Adres serwera proxy, do którego łączy się
+\&\fBstunnel\fR, musi być określony przy pomocy opcji \fIconnect\fR.
 .Sp
-W obecnej wersji adres docelowy protokołu ma zastosowanie wyłącznie w protokole
-\&'connect'.
+Dla protokołu 'smtp', \fIprotocolHost\fR określa wartość \s-1HELO/EHLO\s0 wysyłanego
+przy negocjacji klienta.
 .IP "\fBprotocolPassword\fR = HASŁO" 4
 .IX Item "protocolPassword = HASŁO"
 hasło do negocjacji protokołu
@@ -782,11 +844,13 @@
 \&    TOŻSAMOŚĆ:KLUCZ
 .Ve
 .Sp
-Klucz musi być mieć przynajmniej 20 znaków.
+Szesnastkowe klucze są automatycznie konwertowane do postaci binarnej.
+Klucz musi być mieć przynajmniej 16 bajtów, co w przypadku kluczy
+szesnastkowych przekłada się na przynajmniej 32 znaki.
 Należy ograniczyć dostęp do czytania lub pisania do tego pliku.
 .IP "\fBpty\fR = yes | no (tylko Unix)" 4
 .IX Item "pty = yes | no (tylko Unix)"
-alokuj pseudoterminal dla programu uruchamianego w opcji 'exec'
+alokuj pseudo-terminal dla programu uruchamianego w opcji 'exec'
 .IP "\fBredirect\fR = \s-1HOST:\s0PORT" 4
 .IX Item "redirect = HOST:PORT"
 przekieruj klienta, któremu nie udało się poprawnie uwierzytelnić przy pomocy certyfikatu
@@ -804,7 +868,7 @@
 .Sp
 http://vincent.bernat.im/en/blog/2011\-ssl\-dos\-mitigation.html
 .Sp
-Warto zauważyć, że zablokowanie renegocjacji \s-1TLS\s0 nie zebezpiecza w pełni
+Warto zauważyć, że zablokowanie renegocjacji \s-1TLS\s0 nie zabezpiecza w pełni
 przed opisanym problemem.
 .Sp
 domyślnie: yes (o ile wspierane przez \fBOpenSSL\fR)
@@ -820,6 +884,37 @@
 połącz ponownie sekcję connect+exec po rozłączeniu
 .Sp
 domyślnie: no
+.IP "\fBsecurityLevel\fR = \s-1POZIOM\s0" 4
+.IX Item "securityLevel = POZIOM"
+ustaw poziom bezpieczeństwa
+.Sp
+Znaczenie każdego poziomu opisano poniżej:
+.RS 4
+.IP "poziom 0" 4
+.IX Item "poziom 0"
+Wszystko jest dozwolone.
+.IP "poziom 1" 4
+.IX Item "poziom 1"
+Poziom bezpieczeństwa zapewniający minimum 80 bitów bezpieczeństwa. Żadne parametry kryptograficzne oferujące poziom bezpieczeństwa poniżej 80 bitów nie mogą zostać użyte. W związku z tym \s-1RSA, DSA\s0 oraz klucze \s-1DH\s0 krótsze niż 1024 bity, a także klucze \s-1ECC\s0 krótsze niż 160 bitów i wszystkie eksportowe zestawy szyfrów są niedozwolone. Użycie SSLv2 jest zabronione. Wszelkie listy parametrów kryptograficznych używające \s-1MD5\s0 do \s-1MAC\s0 są zabronione.
+.IP "poziom 2" 4
+.IX Item "poziom 2"
+Poziom bezpieczeństwa zapewniający 112 bitów bezpieczeństwa. W związku z tym \s-1RSA, DSA\s0 oraz klucze \s-1DH\s0 krótsze niż 2048 bitów, a także klucze \s-1ECC\s0 krótsze niż 224 bity są niedozwolone. Oprócz wyłączeń z poziomu 1 zabronione jest także korzystanie z zestawów szyfrów używających \s-1RC4.\s0 Użycie SSLv3 jest zabronione. Kompresja jest wyłączona.
+.IP "poziom 3" 4
+.IX Item "poziom 3"
+Poziom bezpieczeństwa zapewniający 128 bitów bezpieczeństwa. W związku z tym \s-1RSA, DSA\s0 oraz klucze \s-1DH\s0 krótsze niż 3072 bity, a także klucze \s-1ECC\s0 krótsze niż 256 bitów są niedozwolone. Oprócz wyłączeń z poziomu 2  zabronione jest także korzystanie z zestawów szyfrów nie zapewniających utajniania z wyprzedzeniem (forward secrecy).  Wersje \s-1TLS\s0 starsze niż 1.1 są zabronione. Bilety sesji są wyłączone.
+.IP "poziom 4" 4
+.IX Item "poziom 4"
+Poziom bezpieczeństwa zapewniający 192 bity bezpieczeństwa. W związku z tym \s-1RSA, DSA\s0 oraz klucze \s-1DH\s0 krótsze niż 7680 bitów, a także klucze \s-1ECC\s0 krótsze niż 384 bity są niedozwolone. Listy parametrów kryptograficznych używających \s-1SHA1\s0 do \s-1MAC\s0 są zabronione. Wersje \s-1TLS\s0 starsze niż 1.2 są zabronione.
+.IP "poziom 5" 4
+.IX Item "poziom 5"
+Poziom bezpieczeństwa zapewniający 256 bitów bezpieczeństwa. W związku z tym \s-1RSA, DSA\s0 oraz klucze \s-1DH\s0 krótsze niż 15360 bitów, a także klucze \s-1ECC\s0 krótsze niż 512 bitów są niedozwolone.
+.IP "domyślnie: 2" 4
+.IX Item "domyślnie: 2"
+.RE
+.RS 4
+.Sp
+Opcja \fIsecurityLevel\fR jest dostępna począwszy od \fBOpenSSL 1.1.0\fR.
+.RE
 .IP "\fBrequireCert\fR = yes | no" 4
 .IX Item "requireCert = yes | no"
 wymagaj certyfikatu klienta dla \fIverifyChain\fR lub \fIverifyPeer\fR
@@ -831,7 +926,7 @@
 automatycznie ustawiają \fIrequireCert\fR na \fIyes\fR.
 .Sp
 domyślnie: no
-.IP "\fBsetgid\fR = \s-1IDENTYFIKATOR_GRUPY \s0(tylko Unix)" 4
+.IP "\fBsetgid\fR = \s-1IDENTYFIKATOR_GRUPY\s0 (tylko Unix)" 4
 .IX Item "setgid = IDENTYFIKATOR_GRUPY (tylko Unix)"
 identyfikator grupy Unix
 .Sp
@@ -861,9 +956,14 @@
 .Sp
 Parametr określa czas w sekundach, po którym sesja \s-1TLS\s0 zostanie usunięta z
 pamięci podręcznej.
+.IP "\fBsessionResume\fR = yes | no" 4
+.IX Item "sessionResume = yes | no"
+zezwalaj lub nie zezwalaj na wznawianie sesji
+.Sp
+domyślnie: yes
 .IP "\fBsessiond\fR = \s-1HOST:PORT\s0" 4
 .IX Item "sessiond = HOST:PORT"
-adres sessiond \- servera cache sesji \s-1TLS\s0
+adres sessiond \- serwera cache sesji \s-1TLS\s0
 .IP "\fBsni\fR = NAZWA_USŁUGI:WZORZEC_NAZWY_SERWERA (tryb serwera)" 4
 .IX Item "sni = NAZWA_USŁUGI:WZORZEC_NAZWY_SERWERA (tryb serwera)"
 Użyj usługi jako podrzędnej (virtualnego serwera) dla rozszerzenia \s-1TLS\s0 Server
@@ -872,8 +972,8 @@
 \&\fINAZWA_USŁUGI\fR wskazuje usługę nadrzędną, która odbiera połączenia od klientów
 przy pomocy opcji \fIaccept\fR.  \fI\s-1WZORZEC_NAZWY_SERWERA\s0\fR wskazuje nazwę serwera
 wirtualnego.  Wzorzec może zaczynać się znakiem '*', np. '*.example.com".  Z
-pojedyńczą usługą nadrzędną powiązane jest zwykle wiele usług podrzędnych.
-Opcja \fIsni\fR może być rownież użyta wielokrotnie w ramach jednej usługi
+pojedynczą usługą nadrzędną powiązane jest zwykle wiele usług podrzędnych.
+Opcja \fIsni\fR może być również użyta wielokrotnie w ramach jednej usługi
 podrzędnej.
 .Sp
 Zarówno usługa nadrzędna jak i podrzędna nie może być skonfigurowana w trybie
@@ -888,7 +988,7 @@
 usługi podrzędnej podczas negocjacji \s-1TLS.\s0
 .Sp
 Opcja \fIsni\fR jest dostępna począwszy od \fBOpenSSL 1.0.0\fR.
-.IP "\fBsni\fR = \s-1NAZWA_SERWERA \s0(tryb klienta)" 4
+.IP "\fBsni\fR = \s-1NAZWA_SERWERA\s0 (tryb klienta)" 4
 .IX Item "sni = NAZWA_SERWERA (tryb klienta)"
 Użyj parametru jako wartości rozszerzenia \s-1TLS\s0 Server Name Indication
 (\s-1RFC 3546\s0).
@@ -924,29 +1024,98 @@
 .IX Item "sslVersion = WERSJA_SSL"
 wersja protokołu \s-1TLS\s0
 .Sp
-Wspierane wersje: all, SSLv2, SSLv3, TLSv1, TLSv1.1, TLSv1.2
+Wspierane wersje: all, SSLv2, SSLv3, TLSv1, TLSv1.1, TLSv1.2, TLSv1.3
 .Sp
-Ocja \fIsslVersion\fR jest przestarzała i zostanie usunięta w przyszłych wersjach stunnela.
-Zamiast niej należy używać następujących opcji:
+Dostępność konkretnych protokołów zależy od użytej wersji OpenSSL.
+Starsze wersje OpenSSL nie wspierają TLSv1.1, TLSv1.2, TLSv1.3.
+Nowsze wersje OpenSSL nie wspierają SSLv2.
 .Sp
-.Vb 6
-\&    options = NO_SSLv2
-\&    options = NO_SSLv3
-\&    options = NO_TLSv1
-\&    options = NO_TLSv1.1
-\&    options = NO_TLSv1.2
-\&    options = NO_TLSv1.3
+Przestarzałe protokoły SSLv2 i SSLv3 są domyślnie wyłączone.
+.Sp
+Począwszy od \fBOpenSSL 1.1.0\fR, ustawienie
+.Sp
+.Vb 1
+\&    sslVersion = WERSJA_SSL
 .Ve
 .Sp
+jest równoważne opcjom
+.Sp
+.Vb 2
+\&    sslVersionMax = WERSJA_SSL
+\&    sslVersionMin = WERSJA_SSL
+.Ve
+.IP "\fBsslVersionMax\fR = \s-1WERSJA_SSL\s0" 4
+.IX Item "sslVersionMax = WERSJA_SSL"
+maksymalna wspierana wersja protokołu \s-1TLS\s0
+.Sp
+Wspierane wersje: all, SSLv3, TLSv1, TLSv1.1, TLSv1.2, TLSv1.3
+.Sp
+\&\fIall\fR włącza wszystkie wersje protokołów aż do maksymalnej wersji wspieranej
+przez bibliotekę użytej wersji OpenSSL.
+.Sp
 Dostępność konkretnych protokołów zależy od użytej wersji OpenSSL.
-Starsze wersje OpenSSL nie wspierają TLSv1.1 i TLSv1.2.
-Nowsze wersje OpenSSL nie wspierają SSLv2.
 .Sp
-Przestarzałe protokoły SSLv2 i SSLv3 są domyślnie wyłączone.
-Szczegółowe informacje dostępne są w opisie opcji \fBoptions\fR.
+Opcja \fIsslVersionMax\fR jest dostępna począwszy od \fBOpenSSL 1.1.0\fR.
+.Sp
+domyślnie: all
+.IP "\fBsslVersionMin\fR = \s-1WERSJA_SSL\s0" 4
+.IX Item "sslVersionMin = WERSJA_SSL"
+minimalna wspierana wersja protokołu \s-1TLS\s0
+.Sp
+Wspierane wersje: all, SSLv3, TLSv1, TLSv1.1, TLSv1.2, TLSv1.3
+.Sp
+\&\fIall\fR włącza wszystkie wersje protokołów aż do minimalnej wersji wspieranej
+przez bibliotekę użytej wersji OpenSSL.
+.Sp
+Dostępność konkretnych protokołów zależy od użytej wersji OpenSSL.
+.Sp
+Opcja \fIsslVersionMin\fR jest dostępna począwszy od \fBOpenSSL 1.1.0\fR.
+.Sp
+domyślnie: TLSv1
 .IP "\fBstack\fR = LICZBA_BAJTÓW (z wyjątkiem modelu \s-1FORK\s0)" 4
 .IX Item "stack = LICZBA_BAJTÓW (z wyjątkiem modelu FORK)"
-rozmiar stosu procesora wątku
+rozmiar stosu procesora tworzonych wątków
+.Sp
+Zbyt duży stos zwiększa zużycie pamięci wirtualnej.
+Zbyt mały stos może powodować problemy ze stabilnością aplikacji.
+.Sp
+domyślnie: 65536 bytes (wystarczający dla testowanych platform)
+.IP "\fBticketKeySecret\fR = \s-1SECRET\s0" 4
+.IX Item "ticketKeySecret = SECRET"
+szesnastkowy klucz symetryczny używany przez serwer do zapewnienia poufności
+biletów sesji
+.Sp
+Bilety sesji zdefiniowane w \s-1RFC 5077\s0 zapewniają ulepszoną możliwość wznawiania
+sesji, w której implementacja serwera nie jest wymagana do utrzymania stanu
+sesji.
+.Sp
+Łączne użycie opcji \fIticketKeySecret\fR i \fIticketMacSecret\fR umożliwia
+wznawianie sesji na klastrze serwerów lub wznowienie sesji po restarcie
+serwera.
+.Sp
+Klucz musi mieć rozmiar 16 lub 32 bajtów, co przekłada się na dokładnie 32 lub
+64 cyfry szesnastkowe. Poszczególne bajty mogą być opcjonalnie oddzielone
+dwukropkami.
+.Sp
+Opcja działa wyłącznie w trybie serwera.
+.Sp
+Opcja \fIticketKeySecret\fR jest dostępna począwszy od \fBOpenSSL 1.0.0\fR.
+.Sp
+Wyłączenie opcji \fI\s-1NO_TICKET\s0\fR jest wymagane dla obsługi biletów sesji w
+OpenSSL-u starszym niż 1.1.1, ale opcja ta jest niekompatybilna z opcją
+\&\fIredirect\fR.
+.IP "\fBticketMacSecret\fR = \s-1SECRET\s0" 4
+.IX Item "ticketMacSecret = SECRET"
+szesnastkowy klucz symetryczny używany przez serwer zapewnienia integralności
+biletów sesji
+.Sp
+Klucz musi mieć rozmiar 16 lub 32 bajtów, co przekłada się na dokładnie 32 lub
+64 cyfry szesnastkowe. Poszczególne bajty mogą być opcjonalnie oddzielone
+dwukropkami.
+.Sp
+Opcja działa wyłącznie w trybie serwera.
+.Sp
+Opcja \fIticketMacSecret\fR jest dostępna począwszy od \fBOpenSSL 1.0.0\fR.
 .IP "\fBTIMEOUTbusy\fR = \s-1LICZBA_SEKUND\s0" 4
 .IX Item "TIMEOUTbusy = LICZBA_SEKUND"
 czas oczekiwania na spodziewane dane
@@ -967,7 +1136,7 @@
 .RS 4
 .IP "\fBnone\fR" 4
 .IX Item "none"
-Zablokuj wsparcie dla przezroczystago proxy.  Jest to wartość domyślna.
+Zablokuj wsparcie dla przezroczystego proxy.  Jest to wartość domyślna.
 .IP "\fBsource\fR" 4
 .IX Item "source"
 Przepisz adres, aby nawiązywane połączenie wydawało się pochodzić
@@ -1014,7 +1183,7 @@
 .IX Item "destination"
 Oryginalny adres docelowy jest używany zamiast opcji \fIconnect\fR.
 .Sp
-Przykładowana konfiguracja przezroczystego adresu docelowego:
+Przykładowa konfiguracja przezroczystego adresu docelowego:
 .Sp
 .Vb 4
 \&    transparent
@@ -1049,7 +1218,7 @@
 .RE
 .RS 4
 .Sp
-Dla zapewnienia kompatybilności z wcześniejszymim wersjami wspierane są dwie
+Dla zapewnienia kompatybilności z wcześniejszymi wersjami wspierane są dwie
 dodatkowe opcje:
 .IP "\fIyes\fR" 4
 .IX Item "yes"
@@ -1144,6 +1313,9 @@
 .IX Item "SIGUSR1"
 Zamknij i otwórz ponownie log.
 Funkcja ta może zostać użyta w skrypcie rotującym log programu \fBstunnel\fR.
+.IP "\s-1SIGUSR2\s0" 4
+.IX Item "SIGUSR2"
+Zapisz w logu listę aktywnych połączeń.
 .IP "\s-1SIGTERM, SIGQUIT, SIGINT\s0" 4
 .IX Item "SIGTERM, SIGQUIT, SIGINT"
 Zakończ działanie programu.
@@ -1252,10 +1424,7 @@
 .Ve
 .PP
 Przykładowa konfiguracja umożliwiająca uwierzytelnienie z użyciem klucza prywatnego
-przechowywanego w Windows Certificate Store (tylko Windows).
-W przypadku użycia silnika \s-1CAPI,\s0 nie należy ustawiać opcji cert, gdyż klucz klienta
-zostanie automatycznie pobrany z Certificate Store na podstawie zaufanych certyfikatów
-\&\s-1CA\s0 przedstawionych przez serwer.
+przechowywanego w Windows Certificate Store (tylko Windows):
 .PP
 .Vb 1
 \&    engine = capi
@@ -1267,8 +1436,12 @@
 \&    connect = example.com:8443
 .Ve
 .PP
+W przypadku użycia silnika \s-1CAPI,\s0 nie należy ustawiać opcji cert, gdyż klucz klienta
+zostanie automatycznie pobrany z Certificate Store na podstawie zaufanych certyfikatów
+\&\s-1CA\s0 przedstawionych przez serwer.
+.PP
 Przykładowa konfiguracja umożliwiająca użycie certyfikatu i klucza prywatnego z
-urządzenia zgodnego z pkcs11:
+urządzenia obsługiwanego przez silnik pkcs11:
 .PP
 .Vb 3
 \&    engine = pkcs11
@@ -1285,7 +1458,7 @@
 .Ve
 .PP
 Przykładowa konfiguracja umożliwiająca użycie certyfikatu i klucza prywatnego
-umieszczonego na tokenie SoftHSM
+umieszczonego na tokenie SoftHSM:
 .PP
 .Vb 3
 \&    engine = pkcs11
@@ -1308,7 +1481,7 @@
 połączeń otwieranych na portach o dynamicznie przydzielanych numerach.
 Istnieją jednak specjalne wersje klientów i serwerów \s-1FTP\s0 pozwalające
 na szyfrowanie przesyłanych danych przy pomocy protokołu \fI\s-1TLS\s0\fR.
-.SS "\s-1TRYB INETD \s0(tylko Unix)"
+.SS "\s-1TRYB INETD\s0 (tylko Unix)"
 .IX Subsection "TRYB INETD (tylko Unix)"
 W większości zastosowań \fBstunnel\fR samodzielnie nasłuchuje na porcie
 podanym w pliku konfiguracyjnym i tworzy połączenie z innym portem
@@ -1342,27 +1515,21 @@
 wolnego pakietu \fBOpenSSL\fR.  Więcej informacji na temat generowania
 certyfikatów można znaleźć na umieszczonych poniżej stronach.
 .PP
-Istotną kwestią jest kolejność zawartości pliku \fI.pem\fR.
-W pierwszej kolejności powinien on zawierać klucz prywatny,
-a dopiero za nim podpisany certyfikat (nie żądanie certyfikatu).
-Po certyfikacie i kluczu prywatnym powinny znajdować się puste linie.
-Jeżeli przed certyfikatem znajdują się dodatkowe informacje tekstowe,
-to powinny one zostać usunięte.  Otrzymany plik powinien mieć
-następującą postać:
+Plik \fI.pem\fR powinien zawierać klucz prywatny oraz podpisany certyfikat
+(nie żądanie certyfikatu).
+Otrzymany plik powinien mieć następującą postać:
 .PP
-.Vb 8
+.Vb 6
 \&    \-\-\-\-\-BEGIN RSA PRIVATE KEY\-\-\-\-\-
 \&    zakodowany klucz
 \&    \-\-\-\-\-END RSA PRIVATE KEY\-\-\-\-\-
-\&    pusta linia
 \&    \-\-\-\-\-BEGIN CERTIFICATE\-\-\-\-\-
 \&    zakodowany certyfikat
 \&    \-\-\-\-\-END CERTIFICATE\-\-\-\-\-
-\&    pusta linia
 .Ve
 .SS "LOSOWOŚĆ"
 .IX Subsection "LOSOWOŚĆ"
-\&\fBstunnel\fR potrzebuje zainicjować \s-1PRNG \s0(generator liczb pseudolosowych),
+\&\fBstunnel\fR potrzebuje zainicjować \s-1PRNG\s0 (generator liczb pseudolosowych),
 gdyż protokół \s-1TLS\s0 wymaga do bezpieczeństwa kryptograficznego źródła
 dobrej losowości.  Następujące źródła są kolejno odczytywane aż do
 uzyskania  wystarczającej ilości entropii:
@@ -1388,7 +1555,7 @@
 .PP
 Warto zwrócić uwagę, że na maszynach z systemem Windows, na których
 konsoli nie pracuje użytkownik, zawartość ekranu nie jest wystarczająco
-zmienna, aby zainicjować \s-1PRNG.  W\s0 takim przypadku do zainicjowania
+zmienna, aby zainicjować \s-1PRNG.\s0  W takim przypadku do zainicjowania
 generatora należy użyć opcji \fIRNDfile\fR.
 .PP
 Plik \fIRNDfile\fR powinien zawierać dane losowe \*(-- również w tym sensie,
@@ -1407,8 +1574,8 @@
 .SS "\s-1PARAMETRY DH\s0"
 .IX Subsection "PARAMETRY DH"
 Począwszy od wersji 4.40 \fBstunnel\fR zawiera w kodzie programu 2048\-bitowe
-parametry \s-1DH. \s0 Od wersji 5.18 te początkowe wartości parametrów \s-1DH\s0 są
-wymieniane na autogenerowane parametry tymczasowe.
+parametry \s-1DH.\s0  Od wersji 5.18 te początkowe wartości parametrów \s-1DH\s0 są
+wymieniane na automatycznie generowane parametry tymczasowe.
 Wygenerowanie parametrów \s-1DH\s0 może zająć nawet wiele minut.
 .PP
 Alternatywnie parametry \s-1DH\s0 można umieścić w pliku razem z certyfikatem,
@@ -1427,10 +1594,10 @@
 Opcja \fIexecArgs\fR oraz linia komend Win32 nie obsługuje cytowania.
 .SH "ZOBACZ RÓWNIEŻ"
 .IX Header "ZOBACZ RÓWNIEŻ"
-.IP "\fItcpd\fR\|(8)" 4
+.IP "\fBtcpd\fR\|(8)" 4
 .IX Item "tcpd"
 biblioteka kontroli dostępu do usług internetowych
-.IP "\fIinetd\fR\|(8)" 4
+.IP "\fBinetd\fR\|(8)" 4
 .IX Item "inetd"
 \&'super\-serwer' internetowy
 .IP "\fIhttp://www.stunnel.org/\fR" 4

_service:tar_scm:stunnel-5.48.tar.gz/doc/stunnel.pl.html.in -> _service:tar_scm:stunnel-5.69.tar.gz/doc/stunnel.pl.html.in Changed

@@ -47,7 +47,7 @@
 
 <a href="#_podtop_"><h1 id="NAZWA">NAZWA</h1></a>
 
-stunnel - uniwersalny tunel protoko&#x142;u TLS
+stunnel - uniwersalny tunel protokołu TLS
 
 <a href="#_podtop_"><h1 id="SKADNIA">SK&#x141;ADNIA</h1></a>
 
@@ -69,9 +69,9 @@
 
 <a href="#_podtop_"><h1 id="OPIS">OPIS</h1></a>
 
-Program stunnel zosta&#x142; zaprojektowany do opakowywania w protok&oacute;&#x142; TLS po&#x142;&#x105;cze&#x144; pomi&#x119;dzy zdalnymi klientami a lokalnymi lub zdalnymi serwerami. Przez serwer lokalny rozumiana jest aplikacja przeznaczona do uruchamiania przy pomocy inetd. Stunnel pozwala na proste zestawienie komunikacji serwer&oacute;w nie posiadaj&#x105;cych funkcjonalno&#x15B;ci TLS poprzez bezpieczne kana&#x142;y TLS.
+Program stunnel został zaprojektowany do opakowywania w protok&oacute;ł TLS poł&#x105;cze&#x144; pomi&#x119;dzy zdalnymi klientami a lokalnymi lub zdalnymi serwerami. Przez serwer lokalny rozumiana jest aplikacja przeznaczona do uruchamiania przy pomocy inetd. Stunnel pozwala na proste zestawienie komunikacji serwer&oacute;w nie posiadaj&#x105;cych funkcjonalno&#x15B;ci TLS poprzez bezpieczne kanały TLS.
 
-stunnel pozwala doda&#x107; funkcjonalno&#x15B;&#x107; TLS do powszechnie stosowanych demon&oacute;w inetd, np. pop3 lub imap, do samodzielnych demon&oacute;w, np. nntp, smtp lub http, a nawet tunelowa&#x107; ppp poprzez gniazda sieciowe bez zmian w kodzie &#x17A;r&oacute;d&#x142;owym.
+stunnel pozwala doda&#x107; funkcjonalno&#x15B;&#x107; TLS do powszechnie stosowanych demon&oacute;w inetd, np. pop3 lub imap, do samodzielnych demon&oacute;w, np. nntp, smtp lub http, a nawet tunelowa&#x107; ppp poprzez gniazda sieciowe bez zmian w kodzie &#x17A;r&oacute;dłowym.
 
 <a href="#_podtop_"><h1 id="OPCJE">OPCJE</h1></a>
 
@@ -140,7 +140,7 @@
 <dt id="reload-tylko-Windows-NT-lub-nowszy">-reload (tylko Windows NT lub nowszy)</dt>
 <dd>
 
-prze&#x142;aduj plik konfiguracyjny uruchomionego serwisu NT
+przeładuj plik konfiguracyjny uruchomionego serwisu NT
 
 </dd>
 <dt id="reopen-tylko-Windows-NT-lub-nowszy">-reopen (tylko Windows NT lub nowszy)</dt>
@@ -178,7 +178,7 @@
 <li>par&#x105; &#39;nazwa_opcji = warto&#x15B;&#x107;_opcji&#39;
 
 </li>
-<li>tekstem &#39;nazwa_us&#x142;ugi&#39; wskazuj&#x105;cym pocz&#x105;tek definicji us&#x142;ugi
+<li>tekstem &#39;nazwa_usługi&#39; wskazuj&#x105;cym pocz&#x105;tek definicji usługi
 
 </li>
 </ul>
@@ -207,7 +207,7 @@
 
 katalog roboczego korzenia systemu plik&oacute;w
 
-Opcja okre&#x15B;la katalog, w kt&oacute;rym uwi&#x119;ziony zostanie proces programu stunnel tu&#x17C; po jego inicjalizacji, a przed rozpocz&#x119;ciem odbierania po&#x142;&#x105;cze&#x144;. &#x15A;cie&#x17C;ki podane w opcjach CApath, CRLpath, pid oraz exec musz&#x105; by&#x107; umieszczone wewn&#x105;trz katalogu podanego w opcji chroot i okre&#x15B;lone wzgl&#x119;dem tego katalogu.
+Opcja okre&#x15B;la katalog, w kt&oacute;rym uwi&#x119;ziony zostanie proces programu stunnel tu&#x17C; po jego inicjalizacji, a przed rozpocz&#x119;ciem odbierania poł&#x105;cze&#x144;. &#x15A;cie&#x17C;ki podane w opcjach CApath, CRLpath, pid oraz exec musz&#x105; by&#x107; umieszczone wewn&#x105;trz katalogu podanego w opcji chroot i okre&#x15B;lone wzgl&#x119;dem tego katalogu.
 
 Niekt&oacute;re funkcje systemu operacyjnego mog&#x105; wymaga&#x107; dodatkowych plik&oacute;w umieszczonych w katalogu podanego w parametrze chroot:
 
@@ -228,7 +228,7 @@
 <dt id="compression-deflate-zlib">compression = deflate | zlib</dt>
 <dd>
 
-wyb&oacute;r algorytmu kompresji przesy&#x142;anych danych
+wyb&oacute;r algorytmu kompresji przesyłanych danych
 
 domy&#x15B;lnie: bez kompresji
 
@@ -238,9 +238,11 @@
 <dt id="debug-PODSYSTEM-.POZIOM">debug = PODSYSTEM.POZIOM</dt>
 <dd>
 
-szczeg&oacute;&#x142;owo&#x15B;&#x107; logowania
+szczeg&oacute;łowo&#x15B;&#x107; logowania
 
-Poziom logowania mo&#x17C;na okre&#x15B;li&#x107; przy pomocy jednej z nazw lub liczb: emerg (0), alert (1), crit (2), err (3), warning (4), notice (5), info (6) lub debug (7). Zapisywane s&#x105; komunikaty o poziomie ni&#x17C;szym (numerycznie) lub r&oacute;wnym podanemu. Do uzyskania najwy&#x17C;szego poziomu szczeg&oacute;&#x142;owo&#x15B;ci mo&#x17C;na u&#x17C;y&#x107; opcji debug = debug lub debug = 7. Domy&#x15B;lnym poziomem jest notice (5).
+Poziom logowania mo&#x17C;na okre&#x15B;li&#x107; przy pomocy jednej z nazw lub liczb: emerg (0), alert (1), crit (2), err (3), warning (4), notice (5), info (6) lub debug (7). Zapisywane s&#x105; komunikaty o poziomie ni&#x17C;szym (numerycznie) lub r&oacute;wnym podanemu. Domy&#x15B;lnym poziomem jest notice (5).
+
+Jakkolwiek u&#x17C;ycie debug = debug lub debug = 7 zapewnia najbardziej szczeg&oacute;łowe logi, ich zawarto&#x15B;&#x107; jest u&#x17C;yteczna jedynie dla programist&oacute;w zajmuj&#x105;cych si&#x119; stunnelem. U&#x17C;yj tego poziomu logowania jedynie je&#x15B;li jeste&#x15B; programistk&#x105;/programist&#x105; stunnela, albo przygotowujesz szczeg&oacute;łowe informacje celem przesłania do wsparcia technicznego. W przeciwnym wypadku pr&oacute;ba analizy zawarto&#x15B;ci log&oacute;w b&#x119;dzie jedynie &#x17A;r&oacute;dłem dodatkowego zamieszania.
 
 O ile nie wyspecyfikowano podsystemu u&#x17C;yty b&#x119;dzie domy&#x15B;lny: daemon. Podsystemy nie s&#x105; wspierane przez platform&#x119; Win32.
 
@@ -258,27 +260,27 @@
 <dt id="engine-auto-IDENTYFIKATOR_URZDZENIA">engine = auto | IDENTYFIKATOR_URZ&#x104;DZENIA</dt>
 <dd>
 
-wyb&oacute;r sprz&#x119;towego urz&#x105;dzenia kryptograficznego
+wyb&oacute;r silnika kryptograficznego
 
-domy&#x15B;lnie: bez wykorzystania urz&#x105;dze&#x144; kryptograficznych
+domy&#x15B;lnie: bez wykorzystania silnik&oacute;w kryptograficznych
 
-Sekcja PRZYK&#x141;ADY zawiera przyk&#x142;adowe konfiguracje wykorzystuj&#x105;ce urz&#x105;dzenia kryptograficzne.
+Sekcja PRZYK&#x141;ADY zawiera przykładowe konfiguracje wykorzystuj&#x105;ce silniki kryptograficzne.
 
 </dd>
 <dt id="engineCtrl-KOMENDA-:PARAMETR">engineCtrl = KOMENDA:PARAMETR</dt>
 <dd>
 
-konfiguracja urz&#x105;dzenia kryptograficznego
+konfiguracja silnika kryptograficznego
 
 </dd>
 <dt id="engineDefault-LISTA_ZADA">engineDefault = LISTA_ZADA&#x143;</dt>
 <dd>
 
-lista zada&#x144; OpenSSL oddelegowanych do bie&#x17C;&#x105;cego urz&#x105;dzenia
+lista zada&#x144; OpenSSL oddelegowanych do bie&#x17C;&#x105;cego silnika
 
-Parametrem jest lista oddzielonych przecinkami zada&#x144; OpenSSL, kt&oacute;re maj&#x105; zosta&#x107; oddelegowane do bie&#x17C;&#x105;cego urz&#x105;dzenia kryptograficznego.
+Parametrem jest lista oddzielonych przecinkami zada&#x144; OpenSSL, kt&oacute;re maj&#x105; zosta&#x107; oddelegowane do bie&#x17C;&#x105;cego silnika kryptograficznego.
 
-W zale&#x17C;no&#x15B;ci od konkretnego urz&#x105;dzenia dost&#x119;pne mog&#x105; by&#x107; nast&#x119;puj&#x105;ce zadania: ALL, RSA, DSA, ECDH, ECDSA, DH, RAND, CIPHERS, DIGESTS, PKEY, PKEY_CRYPTO, PKEY_ASN1.
+W zale&#x17C;no&#x15B;ci od konkretnego silnika dost&#x119;pne mog&#x105; by&#x107; nast&#x119;puj&#x105;ce zadania: ALL, RSA, DSA, ECDH, ECDSA, DH, RAND, CIPHERS, DIGESTS, PKEY, PKEY_CRYPTO, PKEY_ASN1.
 
 </dd>
 <dt id="fips-yes-no">fips = yes | no</dt>
@@ -286,7 +288,7 @@
 
 tryb FIPS 140-2
 
-Opcja pozwala wy&#x142;&#x105;czy&#x107; wej&#x15B;cie w tryb FIPS, je&#x15B;li stunnel zosta&#x142; skompilowany ze wsparciem dla FIPS 140-2.
+Opcja pozwala wył&#x105;czy&#x107; wej&#x15B;cie w tryb FIPS, je&#x15B;li stunnel został skompilowany ze wsparciem dla FIPS 140-2.
 
 domy&#x15B;lnie: no (od wersji 5.00)
 
@@ -296,15 +298,15 @@
 
 tryb pierwszoplanowy
 
-U&#x17C;ycie tej opcji powoduje, &#x17C;e stunnel nie przechodzi w t&#x142;o.
+U&#x17C;ycie tej opcji powoduje, &#x17C;e stunnel nie przechodzi w tło.
 
-Parametr yes powoduje dodatkowo, &#x17C;e komunikaty diagnostyczne logowane s&#x105; na standardowy strumie&#x144; b&#x142;&#x119;d&oacute;w (stderr) opr&oacute;cz wyj&#x15B;&#x107; zdefiniowanych przy pomocy opcji syslog i output.
+Parametr yes powoduje dodatkowo, &#x17C;e komunikaty diagnostyczne logowane s&#x105; na standardowy strumie&#x144; bł&#x119;d&oacute;w (stderr) opr&oacute;cz wyj&#x15B;&#x107; zdefiniowanych przy pomocy opcji syslog i output.
 
 </dd>
 <dt id="iconActive-PLIK_Z_IKONK-tylko-GUI">iconActive = PLIK_Z_IKONK&#x104; (tylko GUI)</dt>
 <dd>
 
-ikonka wy&#x15B;wietlana przy obecno&#x15B;ci aktywnych po&#x142;&#x105;cze&#x144; do us&#x142;ugi
+ikonka wy&#x15B;wietlana przy obecno&#x15B;ci aktywnych poł&#x105;cze&#x144; do usługi
 
 W systemie Windows ikonka to plik .ico zawieraj&#x105;cy obrazek 16x16 pikseli.
 
@@ -312,7 +314,7 @@
 <dt id="iconError-PLIK_Z_IKONK-tylko-GUI">iconError = PLIK_Z_IKONK&#x104; (tylko GUI)</dt>
 <dd>
 
-ikonka wy&#x15B;wietlana, je&#x17C;eli nie zosta&#x142; za&#x142;adowany poprawny plik konfiguracyjny
+ikonka wy&#x15B;wietlana, je&#x17C;eli nie został załadowany poprawny plik konfiguracyjny
 
 W systemie Windows ikonka to plik .ico zawieraj&#x105;cy obrazek 16x16 pikseli.
 
@@ -320,7 +322,7 @@
 <dt id="iconIdle-PLIK_Z_IKONK-tylko-GUI">iconIdle = PLIK_Z_IKONK&#x104; (tylko GUI)</dt>
 <dd>
 
-ikonka wy&#x15B;wietlana przy braku aktywnych po&#x142;&#x105;cze&#x144; do us&#x142;ugi
+ikonka wy&#x15B;wietlana przy braku aktywnych poł&#x105;cze&#x144; do usługi
 
 W systemie Windows ikonka to plik .ico zawieraj&#x105;cy obrazek 16x16 pikseli.
 
@@ -328,7 +330,7 @@
 <dt id="log-append-overwrite">log = append | overwrite</dt>
 <dd>
 
-obs&#x142;uga log&oacute;w
+obsługa log&oacute;w
 
 Ta opcja pozwala okre&#x15B;li&#x107;, czy nowe logi w pliku (okre&#x15B;lonym w opcji output) b&#x119;d&#x105; dodawane czy nadpisywane.
 
@@ -342,13 +344,13 @@
 
 U&#x17C;ycie tej opcji powoduje dopisanie log&oacute;w do podanego pliku.
 
-Do kierowania komunikat&oacute;w na standardowe wyj&#x15B;cie (na przyk&#x142;ad po to, &#x17C;eby zalogowa&#x107; je programem splogger z pakietu daemontools) mo&#x17C;na poda&#x107; jako parametr urz&#x105;dzenie /dev/stdout.
+Do kierowania komunikat&oacute;w na standardowe wyj&#x15B;cie (na przykład po to, &#x17C;eby zalogowa&#x107; je programem splogger z pakietu daemontools) mo&#x17C;na poda&#x107; jako parametr urz&#x105;dzenie /dev/stdout.
 
 </dd>
 <dt id="pid-PLIK-tylko-Unix">pid = PLIK (tylko Unix)</dt>
 <dd>
 
-po&#x142;o&#x17C;enie pliku z numerem procesu
+poło&#x17C;enie pliku z numerem procesu
 
 Je&#x17C;eli argument jest pusty, plik nie zostanie stworzony.
 
@@ -380,9 +382,9 @@
 <dt id="service-SERWIS-tylko-Unix">service = SERWIS (tylko Unix)</dt>
 <dd>
 
-nazwa us&#x142;ugi
+nazwa usługi
 
-Podana nazwa us&#x142;ugi b&#x119;dzie u&#x17C;ywana jako nazwa us&#x142;ugi dla inicjalizacji sysloga, oraz dla biblioteki TCP Wrapper w trybie inetd. Chocia&#x17C; technicznie mo&#x17C;na u&#x17C;y&#x107; tej opcji w trybie w sekcji us&#x142;ug, to jest ona u&#x17C;yteczna jedynie w opcjach globalnych.
+Podana nazwa usługi b&#x119;dzie u&#x17C;ywana jako nazwa usługi dla inicjalizacji sysloga, oraz dla biblioteki TCP Wrapper w trybie inetd. Chocia&#x17C; technicznie mo&#x17C;na u&#x17C;y&#x107; tej opcji w trybie w sekcji usług, to jest ona u&#x17C;yteczna jedynie w opcjach globalnych.
 
 domy&#x15B;lnie: stunnel
 
@@ -390,49 +392,61 @@
 <dt id="syslog-yes-no-tylko-Unix">syslog = yes | no (tylko Unix)</dt>
 <dd>
 
-w&#x142;&#x105;cz logowanie poprzez mechanizm syslog
+wł&#x105;cz logowanie poprzez mechanizm syslog
 
-domy&#x15B;lnie: yes (w&#x142;&#x105;cz)
+domy&#x15B;lnie: yes (wł&#x105;cz)
 
 </dd>
 <dt id="taskbar-yes-no-tylko-WIN32">taskbar = yes | no (tylko WIN32)</dt>
 <dd>
 
-w&#x142;&#x105;cz ikonk&#x119; w prawym dolnym rogu ekranu
+wł&#x105;cz ikonk&#x119; w prawym dolnym rogu ekranu
 
-domy&#x15B;lnie: yes (w&#x142;&#x105;cz)
+domy&#x15B;lnie: yes (wł&#x105;cz)
 
 </dd>
 </dl>
 
 <h2 id="OPCJE-USUG">OPCJE US&#x141;UG</h2>
 
-Ka&#x17C;da sekcja konfiguracji us&#x142;ugi zaczyna si&#x119; jej nazw&#x105; uj&#x119;t&#x105; w nawias kwadratowy. Nazwa us&#x142;ugi u&#x17C;ywana jest do kontroli dost&#x119;pu przez bibliotek&#x119; libwrap (TCP wrappers) oraz pozwala rozr&oacute;&#x17C;ni&#x107; poszczeg&oacute;lne us&#x142;ugi w logach.
+Ka&#x17C;da sekcja konfiguracji usługi zaczyna si&#x119; jej nazw&#x105; uj&#x119;t&#x105; w nawias kwadratowy. Nazwa usługi u&#x17C;ywana jest do kontroli dost&#x119;pu przez bibliotek&#x119; libwrap (TCP wrappers) oraz pozwala rozr&oacute;&#x17C;ni&#x107; poszczeg&oacute;lne usługi w logach.
 
-Je&#x17C;eli stunnel ma zosta&#x107; u&#x17C;yty w trybie inetd, gdzie za odebranie po&#x142;&#x105;czenia odpowiada osobny program (zwykle inetd, xinetd lub tcpserver), nale&#x17C;y przeczyta&#x107; sekcj&#x119; TRYB INETD poni&#x17C;ej.
+Je&#x17C;eli stunnel ma zosta&#x107; u&#x17C;yty w trybie inetd, gdzie za odebranie poł&#x105;czenia odpowiada osobny program (zwykle inetd, xinetd lub tcpserver), nale&#x17C;y przeczyta&#x107; sekcj&#x119; TRYB INETD poni&#x17C;ej.
 
 <dl>
 
 <dt id="accept-HOST:-PORT">accept = HOST:PORT</dt>
 <dd>
 
-nas&#x142;uchuje na po&#x142;&#x105;czenia na podanym adresie i porcie
+nasłuchuje na poł&#x105;czenia na podanym adresie i porcie
+
+Je&#x17C;eli nie został podany adres, stunnel domy&#x15B;lnie nasłuchuje na wszystkich adresach IPv4 lokalnych interfejs&oacute;w.
+
+Aby nasłuchiwa&#x107; na wszystkich adresach IPv6 nale&#x17C;y u&#x17C;y&#x107;:
+
+<pre><code>accept = :::port</code></pre>
+
+</dd>
+<dt id="CAengine-IDENTYFIKATOR_CA_W_ENGINE">CAengine = IDENTYFIKATOR_CA_W_ENGINE</dt>
+<dd>
+
+ładuje zaufane certyfikaty Centrum certyfikacji z silnika
 
-Je&#x17C;eli nie zosta&#x142; podany adres, stunnel domy&#x15B;lnie nas&#x142;uchuje na wszystkich adresach IPv4 lokalnych interfejs&oacute;w.
+Opcja pozwala okre&#x15B;li&#x107; poło&#x17C;enie pliku zawieraj&#x105;cego certyfikaty u&#x17C;ywane przez opcj&#x119; verifyChain lub verifyPeer.
 
-Aby nas&#x142;uchiwa&#x107; na wszystkich adresach IPv6 nale&#x17C;y u&#x17C;y&#x107;:
+Opcja mo&#x17C;e by&#x107; u&#x17C;yta wielokrotnie w pojedynczej sekcji.
 
-<pre><code> accept = :::port</code></pre>
+Aktualnie wspierane silniki: pkcs11, cng.
 
 </dd>
 <dt id="CApath-KATALOG_CA">CApath = KATALOG_CA</dt>
 <dd>
 
-katalog Centrum Certyfikacji
+ładuje zaufane certyfikaty Centrum certyfikacji z katalogu
 
-Opcja okre&#x15B;la katalog, w kt&oacute;rym stunnel b&#x119;dzie szuka&#x142; certyfikat&oacute;w, je&#x17C;eli u&#x17C;yta zosta&#x142;a opcja verifyChain lub verifyPeer. Pliki z certyfikatami musz&#x105; posiada&#x107; specjalne nazwy XXXXXXXX.0, gdzie XXXXXXXX jest skr&oacute;tem kryptograficznym reprezentacji DER nazwy podmiotu certyfikatu.
+Opcja okre&#x15B;la katalog, w kt&oacute;rym stunnel b&#x119;dzie szukał certyfikat&oacute;w, je&#x17C;eli u&#x17C;yta została opcja verifyChain lub verifyPeer. Pliki z certyfikatami musz&#x105; posiada&#x107; specjalne nazwy XXXXXXXX.0, gdzie XXXXXXXX jest skr&oacute;tem kryptograficznym reprezentacji DER nazwy podmiotu certyfikatu.
 
-Funkcja skr&oacute;tu zosta&#x142;a zmieniona w OpenSSL 1.0.0. Nale&#x17C;y wykona&#x107; c_rehash przy zmianie OpenSSL 0.x.x na 1.x.x.
+Funkcja skr&oacute;tu została zmieniona w OpenSSL 1.0.0. Nale&#x17C;y wykona&#x107; c_rehash przy zmianie OpenSSL 0.x.x na 1.x.x.
 
 Je&#x17C;eli zdefiniowano katalog chroot, to &#x15B;cie&#x17C;ka do CApath jest okre&#x15B;lona wzgl&#x119;dem tego katalogu.
 
@@ -440,21 +454,21 @@
 <dt id="CAfile-PLIK_CA">CAfile = PLIK_CA</dt>
 <dd>
 
-plik Centrum Certyfikacji
+ładuje zaufane certyfikaty Centrum certyfikacji z pliku
 
-Opcja pozwala okre&#x15B;li&#x107; po&#x142;o&#x17C;enie pliku zawieraj&#x105;cego certyfikaty u&#x17C;ywane przez opcj&#x119; verifyChain lub verifyPeer.
+Opcja pozwala okre&#x15B;li&#x107; poło&#x17C;enie pliku zawieraj&#x105;cego certyfikaty u&#x17C;ywane przez opcj&#x119; verifyChain lub verifyPeer.
 
 </dd>
 <dt id="cert-PLIK_CERT">cert = PLIK_CERT</dt>
 <dd>
 
-plik z &#x142;a&#x144;cuchem certyfikat&oacute;w
+plik z ła&#x144;cuchem certyfikat&oacute;w
 
-Opcja okre&#x15B;la po&#x142;o&#x17C;enie pliku zawieraj&#x105;cego certyfikaty u&#x17C;ywane przez program stunnel do uwierzytelnienia si&#x119; przed drug&#x105; stron&#x105; po&#x142;&#x105;czenia. Plik powinien zawiera&#x107; kompletny &#x142;a&#x144;cuch certyfikat&oacute;w pocz&#x105;wszy od certyfikatu klienta/serwera, a sko&#x144;czywszy na samopodpisanym certyfikacie g&#x142;&oacute;wnego CA. Obs&#x142;ugiwane s&#x105; pliki w formacie PEM lub P12.
+Opcja okre&#x15B;la poło&#x17C;enie pliku zawieraj&#x105;cego certyfikaty u&#x17C;ywane przez program stunnel do uwierzytelnienia si&#x119; przed drug&#x105; stron&#x105; poł&#x105;czenia. Plik powinien zawiera&#x107; kompletny ła&#x144;cuch certyfikat&oacute;w pocz&#x105;wszy od certyfikatu klienta/serwera, a sko&#x144;czywszy na samopodpisanym certyfikacie gł&oacute;wnego CA. Obsługiwane s&#x105; pliki w formacie PEM lub P12.
 
 Certyfikat jest konieczny, aby u&#x17C;ywa&#x107; programu w trybie serwera. W trybie klienta certyfikat jest opcjonalny.
 
-Je&#x17C;eli u&#x17C;ywane jest sprz&#x119;towe urz&#x105;dzenie kryptograficzne, to opcja cert pozwala wybra&#x107; identyfikator u&#x17C;ywanego certyfikatu.
+Je&#x17C;eli u&#x17C;ywany jest silnik kryptograficzny, to opcja cert pozwala wybra&#x107; identyfikator u&#x17C;ywanego certyfikatu.
 
 </dd>
 <dt id="checkEmail-EMAIL">checkEmail = EMAIL</dt>
@@ -490,15 +504,29 @@
 <dt id="ciphers-LISTA_SZYFRW">ciphers = LISTA_SZYFR&Oacute;W</dt>
 <dd>
 
-lista dozwolonych szyfr&oacute;w TLS
+lista dozwolonych szyfr&oacute;w dla protokoł&oacute;w SSLv2, SSLv3, TLSv1, TLSv1.1, TLSv1.2
+
+Ta opcja nie wpływa na list&#x119; parametr&oacute;w kryptograficznych dla protokołu TLSv1.3
+
+Parametrem tej opcji jest lista szyfr&oacute;w, kt&oacute;re b&#x119;d&#x105; u&#x17C;yte przy otwieraniu nowych poł&#x105;cze&#x144; TLS, np.: DES-CBC3-SHA:IDEA-CBC-MD5
+
+</dd>
+<dt id="ciphersuites-LISTA_PARAMETRW_KRYPTOGRAFICZNYCH">ciphersuites = LISTA_PARAMETR&Oacute;W_KRYPTOGRAFICZNYCH</dt>
+<dd>
+
+lista dozwolonych parametr&oacute;w kryptograficznych dla protokołu TLSv1.3
+
+Parametrem tej opcji s&#x105; listy parametr&oacute;w kryptograficznych w kolejno&#x15B;ci ich preferowania.
+
+Opcja ciphersuites jest dost&#x119;pna pocz&#x105;wszy od OpenSSL 1.1.1.
 
-Parametrem tej opcji jest lista szyfr&oacute;w, kt&oacute;re b&#x119;d&#x105; u&#x17C;yte przy otwieraniu nowych po&#x142;&#x105;cze&#x144; TLS, np.: DES-CBC3-SHA:IDEA-CBC-MD5
+domy&#x15B;lnie: TLS_CHACHA20_POLY1305_SHA256: TLS_AES_256_GCM_SHA384: TLS_AES_128_GCM_SHA256
 
 </dd>
 <dt id="client-yes-no">client = yes | no</dt>
 <dd>
 
-tryb kliencki (zdalna us&#x142;uga u&#x17C;ywa TLS)
+tryb kliencki (zdalna usługa u&#x17C;ywa TLS)
 
 domy&#x15B;lnie: no (tryb serwerowy)
 
@@ -508,31 +536,33 @@
 
 komenda konfiguracyjna OpenSSL
 
-Komenda konfiguracyjna OpenSSL zostaje wykonana z podanym parametrem. Pozwala to na wydawanie komend konfiguracyjnych OpenSSL z pliku konfiguracyjnego stunnela. Dost&#x119;pne komendy opisane s&#x105; w manualu SSL_CONF_cmd(3ssl).
+Komenda konfiguracyjna OpenSSL zostaje wykonana z podanym parametrem. Pozwala to na wydawanie komend konfiguracyjnych OpenSSL z pliku konfiguracyjnego stunnela. Dost&#x119;pne komendy opisane s&#x105; w podr&#x119;czniku SSL_CONF_cmd(3ssl).
 
 Mo&#x17C;liwe jest wyspecyfikowanie wielu opcji OpenSSL przez wielokrotne u&#x17C;ycie komendy config.
 
+Zamiast wył&#x105;cza&#x107; config = Curves:list_curves u&#x17C;yj opcji curves w celu ustawienia krzywych eliptycznych.
+
 Opcja ta wymaga biblioteki OpenSSL w wersji 1.0.2 lub nowszej.
 
 </dd>
 <dt id="connect-HOST:-PORT">connect = HOST:PORT</dt>
 <dd>
 
-po&#x142;&#x105;cz si&#x119; ze zdalnym serwerem na podany port
+poł&#x105;cz si&#x119; ze zdalnym serwerem na podany port
 
-Je&#x17C;eli nie zosta&#x142; podany adres, stunnel domy&#x15B;lnie &#x142;&#x105;czy si&#x119; z lokalnym serwerem.
+Je&#x17C;eli nie został podany adres, stunnel domy&#x15B;lnie ł&#x105;czy si&#x119; z lokalnym serwerem.
 
-Komenda mo&#x17C;e by&#x107; u&#x17C;yta wielokrotnie w pojedynczej sekcji celem zapewnienia wysokiej niezawodno&#x15B;ci lub roz&#x142;o&#x17C;enia ruchu pomi&#x119;dzy wiele serwer&oacute;w.
+Komenda mo&#x17C;e by&#x107; u&#x17C;yta wielokrotnie w pojedynczej sekcji celem zapewnienia wysokiej niezawodno&#x15B;ci lub rozło&#x17C;enia ruchu pomi&#x119;dzy wiele serwer&oacute;w.
 
 </dd>
 <dt id="CRLpath-KATALOG_CRL">CRLpath = KATALOG_CRL</dt>
 <dd>
 
-katalog List Odwo&#x142;anych Certyfikat&oacute;w (CRL)
+katalog List Odwołanych Certyfikat&oacute;w (CRL)
 
-Opcja okre&#x15B;la katalog, w kt&oacute;rym stunnel b&#x119;dzie szuka&#x142; list CRL u&#x17C;ywanych przez opcje verifyChain i verifyPeer. Pliki z listami CRL musz&#x105; posiada&#x107; specjalne nazwy XXXXXXXX.r0, gdzie XXXXXXXX jest skr&oacute;tem listy CRL.
+Opcja okre&#x15B;la katalog, w kt&oacute;rym stunnel b&#x119;dzie szukał list CRL u&#x17C;ywanych przez opcje verifyChain i verifyPeer. Pliki z listami CRL musz&#x105; posiada&#x107; specjalne nazwy XXXXXXXX.r0, gdzie XXXXXXXX jest skr&oacute;tem listy CRL.
 
-Funkcja skr&oacute;tu zosta&#x142;a zmieniona OpenSSL 1.0.0. Nale&#x17C;y wykona&#x107; c_rehash przy zmianie OpenSSL 0.x.x na 1.x.x.
+Funkcja skr&oacute;tu została zmieniona OpenSSL 1.0.0. Nale&#x17C;y wykona&#x107; c_rehash przy zmianie OpenSSL 0.x.x na 1.x.x.
 
 Je&#x17C;eli zdefiniowano katalog chroot, to &#x15B;cie&#x17C;ka do CRLpath jest okre&#x15B;lona wzgl&#x119;dem tego katalogu.
 
@@ -540,29 +570,35 @@
 <dt id="CRLfile-PLIK_CRL">CRLfile = PLIK_CRL</dt>
 <dd>
 
-plik List Odwo&#x142;anych Certyfikat&oacute;w (CRL)
+plik List Odwołanych Certyfikat&oacute;w (CRL)
 
-Opcja pozwala okre&#x15B;li&#x107; po&#x142;o&#x17C;enie pliku zawieraj&#x105;cego listy CRL u&#x17C;ywane przez opcje verifyChain i verifyPeer.
+Opcja pozwala okre&#x15B;li&#x107; poło&#x17C;enie pliku zawieraj&#x105;cego listy CRL u&#x17C;ywane przez opcje verifyChain i verifyPeer.
 
 </dd>
-<dt id="curve-NID">curve = NID</dt>
+<dt id="curves-lista">curves = lista</dt>
 <dd>
 
-krzywa dla ECDH
+krzywe ECDH odddzielone &#39;:&#39;
+
+Wersje OpenSSL starsze ni&#x17C; 1.1.1 pozwalaj&#x105; na u&#x17C;ycie tylko jednej krzywej.
 
 List&#x119; dost&#x119;pnych krzywych mo&#x17C;na uzyska&#x107; poleceniem:
 
-<pre><code> openssl ecparam -list_curves</code></pre>
+<pre><code>openssl ecparam -list_curves</code></pre>
+
+domy&#x15B;lnie:
+
+<pre><code>X25519:P-256:X448:P-521:P-384 (pocz&#x105;wszy od OpenSSL 1.1.1)
 
-domy&#x15B;lnie: prime256v1
+prime256v1 (OpenSSL starszy ni&#x17C; 1.1.1)</code></pre>
 
 </dd>
 <dt id="logId-TYP">logId = TYP</dt>
 <dd>
 
-typ identyfikatora po&#x142;&#x105;czenia klienta
+typ identyfikatora poł&#x105;czenia klienta
 
-Identyfikator ten pozwala rozr&oacute;&#x17C;ni&#x107; wpisy w logu wygenerowane dla poszczeg&oacute;lnych po&#x142;&#x105;cze&#x144;.
+Identyfikator ten pozwala rozr&oacute;&#x17C;ni&#x107; wpisy w logu wygenerowane dla poszczeg&oacute;lnych poł&#x105;cze&#x144;.
 
 Aktualnie wspierane typy:
 
@@ -571,13 +607,13 @@
 <dt id="sequential">sequential</dt>
 <dd>
 
-Kolejny numer po&#x142;&#x105;czenia jest unikalny jedynie w obr&#x119;bie pojedynczej instancji programu stunnel, ale bardzo kr&oacute;tki. Jest on szczeg&oacute;lnie u&#x17C;yteczny przy r&#x119;cznej analizie log&oacute;w.
+Kolejny numer poł&#x105;czenia jest unikalny jedynie w obr&#x119;bie pojedynczej instancji programu stunnel, ale bardzo kr&oacute;tki. Jest on szczeg&oacute;lnie u&#x17C;yteczny przy r&#x119;cznej analizie log&oacute;w.
 
 </dd>
 <dt id="unique">unique</dt>
 <dd>
 
-Ten rodzaj identyfikatora jest globalnie unikalny, ale znacznie d&#x142;u&#x17C;szy, ni&#x17C; kolejny numer po&#x142;&#x105;czenia. Jest on szczeg&oacute;lnie u&#x17C;yteczny przy zautomatyzowanej analizie log&oacute;w.
+Ten rodzaj identyfikatora jest globalnie unikalny, ale znacznie dłu&#x17C;szy, ni&#x17C; kolejny numer poł&#x105;czenia. Jest on szczeg&oacute;lnie u&#x17C;yteczny przy zautomatyzowanej analizie log&oacute;w.
 
 </dd>
 <dt id="thread">thread</dt>
@@ -600,9 +636,9 @@
 <dt id="debug-POZIOM">debug = POZIOM</dt>
 <dd>
 
-szczeg&oacute;&#x142;owo&#x15B;&#x107; logowania
+szczeg&oacute;łowo&#x15B;&#x107; logowania
 
-Poziom logowania mo&#x17C;na okre&#x15B;li&#x107; przy pomocy jednej z nazw lub liczb: emerg (0), alert (1), crit (2), err (3), warning (4), notice (5), info (6) lub debug (7). Zapisywane s&#x105; komunikaty o poziomie ni&#x17C;szym (numerycznie) lub r&oacute;wnym podanemu. Do uzyskania najwy&#x17C;szego poziomu szczeg&oacute;&#x142;owo&#x15B;ci mo&#x17C;na u&#x17C;y&#x107; opcji debug = debug lub debug = 7. Domy&#x15B;lnym poziomem jest notice (5).
+Poziom logowania mo&#x17C;na okre&#x15B;li&#x107; przy pomocy jednej z nazw lub liczb: emerg (0), alert (1), crit (2), err (3), warning (4), notice (5), info (6) lub debug (7). Zapisywane s&#x105; komunikaty o poziomie ni&#x17C;szym (numerycznie) lub r&oacute;wnym podanemu. Do uzyskania najwy&#x17C;szego poziomu szczeg&oacute;łowo&#x15B;ci mo&#x17C;na u&#x17C;y&#x107; opcji debug = debug lub debug = 7. Domy&#x15B;lnym poziomem jest notice (5).
 
 </dd>
 <dt id="delay-yes-no">delay = yes | no</dt>
@@ -610,25 +646,25 @@
 
 op&oacute;&#x17A;nij rozwini&#x119;cie adresu DNS podanego w opcji connect
 
-Opcja jest przydatna przy dynamicznym DNS, albo gdy us&#x142;uga DNS nie jest dost&#x119;pna przy starcie programu stunnel (klient VPN, po&#x142;&#x105;czenie wdzwaniane).
+Opcja jest przydatna przy dynamicznym DNS, albo gdy usługa DNS nie jest dost&#x119;pna przy starcie programu stunnel (klient VPN, poł&#x105;czenie wdzwaniane).
 
-Op&oacute;&#x17A;nione rozwijanie adresu DNS jest w&#x142;&#x105;czane automatycznie, je&#x17C;eli nie powiedzie si&#x119; rozwini&#x119;cie kt&oacute;regokolwiek z adres&oacute;w connect dla danej us&#x142;ugi.
+Op&oacute;&#x17A;nione rozwijanie adresu DNS jest wł&#x105;czane automatycznie, je&#x17C;eli nie powiedzie si&#x119; rozwini&#x119;cie kt&oacute;regokolwiek z adres&oacute;w connect dla danej usługi.
 
 Op&oacute;&#x17A;nione rozwijanie adresu automatycznie aktywuje failover = prio.
 
-default: no
+domy&#x15B;lnie: no
 
 </dd>
 <dt id="engineId-NUMER_URZDZENIA">engineId = NUMER_URZ&#x104;DZENIA</dt>
 <dd>
 
-wybierz urz&#x105;dzenie dla us&#x142;ugi
+wybierz silnik kryptograficzny dla usługi
 
 </dd>
 <dt id="engineNum-NUMER_URZDZENIA">engineNum = NUMER_URZ&#x104;DZENIA</dt>
 <dd>
 
-wybierz urz&#x105;dzenie dla us&#x142;ugi
+wybierz silnik kryptograficzny dla usługi
 
 Urz&#x105;dzenia s&#x105; numerowane od 1 w g&oacute;r&#x119;.
 
@@ -646,9 +682,9 @@
 <dt id="execArgs-0-1-2">execArgs = $0 $1 $2 ...</dt>
 <dd>
 
-argumenty do opcji exec w&#x142;&#x105;cznie z nazw&#x105; programu ($0)
+argumenty do opcji exec wł&#x105;cznie z nazw&#x105; programu ($0)
 
-Cytowanie nie jest wspierane w obecnej wersji programu. Argumenty s&#x105; rozdzielone dowoln&#x105; liczb&#x105; bia&#x142;ych znak&oacute;w.
+Cytowanie nie jest wspierane w obecnej wersji programu. Argumenty s&#x105; rozdzielone dowoln&#x105; liczb&#x105; białych znak&oacute;w.
 
 </dd>
 <dt id="failover-rr-prio">failover = rr | prio</dt>
@@ -661,7 +697,7 @@
 <dt id="rr">rr</dt>
 <dd>
 
-round robin - sprawiedliwe roz&#x142;o&#x17C;enie obci&#x105;&#x17C;enia
+round robin - sprawiedliwe rozło&#x17C;enie obci&#x105;&#x17C;enia
 
 </dd>
 <dt id="prio">prio</dt>
@@ -678,7 +714,7 @@
 <dt id="ident-NAZWA_UYTKOWNIKA">ident = NAZWA_U&#x17B;YTKOWNIKA</dt>
 <dd>
 
-weryfikuj nazw&#x119; zdalnego u&#x17C;ytkownika korzystaj&#x105;c z protoko&#x142;u IDENT (RFC 1413)
+weryfikuj nazw&#x119; zdalnego u&#x17C;ytkownika korzystaj&#x105;c z protokołu IDENT (RFC 1413)
 
 </dd>
 <dt id="include-KATALOG">include = KATALOG</dt>
@@ -690,13 +726,13 @@
 
 dla opcji globalnych:
 
-<pre><code> 00-global.conf</code></pre>
+<pre><code>00-global.conf</code></pre>
 
-dla lokalnych opcji us&#x142;ug:
+dla lokalnych opcji usług:
 
-<pre><code> 01-service.conf
+<pre><code>01-service.conf
 
- 02-service.conf</code></pre>
+02-service.conf</code></pre>
 
 </dd>
 <dt id="key-PLIK_KLUCZA">key = PLIK_KLUCZA</dt>
@@ -704,11 +740,11 @@
 
 klucz prywatny do certyfikatu podanego w opcji cert
 
-Klucz prywatny jest potrzebny do uwierzytelnienia w&#x142;a&#x15B;ciciela certyfikatu. Poniewa&#x17C; powinien on by&#x107; zachowany w tajemnicy, prawa do jego odczytu powinien mie&#x107; wy&#x142;&#x105;cznie w&#x142;a&#x15B;ciciel pliku. W systemie Unix mo&#x17C;na to osi&#x105;gn&#x105;&#x107; komend&#x105;:
+Klucz prywatny jest potrzebny do uwierzytelnienia wła&#x15B;ciciela certyfikatu. Poniewa&#x17C; powinien on by&#x107; zachowany w tajemnicy, prawa do jego odczytu powinien mie&#x107; wył&#x105;cznie wła&#x15B;ciciel pliku. W systemie Unix mo&#x17C;na to osi&#x105;gn&#x105;&#x107; komend&#x105;:
 
-<pre><code> chmod 600 keyfile</code></pre>
+<pre><code>chmod 600 keyfile</code></pre>
 
-Je&#x17C;eli u&#x17C;ywane jest sprz&#x119;towe urz&#x105;dzenie kryptograficzne, to opcja key pozwala wybra&#x107; identyfikator u&#x17C;ywanego klucza prywatnego.
+Je&#x17C;eli u&#x17C;ywany jest silnik kryptograficzny, to opcja key pozwala wybra&#x107; identyfikator u&#x17C;ywanego klucza prywatnego.
 
 domy&#x15B;lnie: warto&#x15B;&#x107; opcji cert
 
@@ -716,7 +752,7 @@
 <dt id="libwrap-yes-no">libwrap = yes | no</dt>
 <dd>
 
-w&#x142;&#x105;cz lub wy&#x142;&#x105;cz korzystanie z /etc/hosts.allow i /etc/hosts.deny.
+wł&#x105;cz lub wył&#x105;cz korzystanie z /etc/hosts.allow i /etc/hosts.deny.
 
 domy&#x15B;lnie: no (od wersji 5.00)
 
@@ -724,9 +760,9 @@
 <dt id="local-HOST">local = HOST</dt>
 <dd>
 
-IP &#x17A;r&oacute;d&#x142;a do nawi&#x105;zywania zdalnych po&#x142;&#x105;cze&#x144;
+IP &#x17A;r&oacute;dła do nawi&#x105;zywania zdalnych poł&#x105;cze&#x144;
 
-Domy&#x15B;lnie u&#x17C;ywane jest IP najbardziej zewn&#x119;trznego interfejsu w stron&#x119; serwera, do kt&oacute;rego nawi&#x105;zywane jest po&#x142;&#x105;czenie.
+Domy&#x15B;lnie u&#x17C;ywane jest IP najbardziej zewn&#x119;trznego interfejsu w stron&#x119; serwera, do kt&oacute;rego nawi&#x105;zywane jest poł&#x105;czenie.
 
 </dd>
 <dt id="OCSP-URL">OCSP = URL</dt>
@@ -740,7 +776,7 @@
 
 weryfikuj certyfikaty przy u&#x17C;yciu respondert&oacute;w AIA
 
-Opcja OCSPaia pozwala na weryfikowanie certyfikat&oacute;w przy pomocy listy URLi responder&oacute;w OCSP przes&#x142;anych w rozszerzeniach AIA (Authority Information Access).
+Opcja OCSPaia pozwala na weryfikowanie certyfikat&oacute;w przy pomocy listy URLi responder&oacute;w OCSP przesłanych w rozszerzeniach AIA (Authority Information Access).
 
 </dd>
 <dt id="OCSPflag-FLAGA_OCSP">OCSPflag = FLAGA_OCSP</dt>
@@ -756,9 +792,9 @@
 <dt id="OCSPnonce-yes-no">OCSPnonce = yes | no</dt>
 <dd>
 
-wysy&#x142;aj i weryfikuj OCSP nonce
+wysyłaj i weryfikuj OCSP nonce
 
-Opcja OCSPnonce zabezpiecza protok&oacute;&#x142; OCSP przed atakami powt&oacute;rzeniowymi. Ze wzgl&#x119;du na z&#x142;o&#x17C;ono&#x15B;&#x107; obliczeniow&#x105; rozszerzenie nonce jest zwykle wspierane jedynie przez wewn&#x119;trzne (np. korporacyjne), a nie przez publiczne respondery OCSP.
+Opcja OCSPnonce zabezpiecza protok&oacute;ł OCSP przed atakami powt&oacute;rzeniowymi. Ze wzgl&#x119;du na zło&#x17C;ono&#x15B;&#x107; obliczeniow&#x105; rozszerzenie nonce jest zwykle wspierane jedynie przez wewn&#x119;trzne (np. korporacyjne), a nie przez publiczne respondery OCSP.
 
 </dd>
 <dt id="options-OPCJE_SSL">options = OPCJE_SSL</dt>
@@ -768,41 +804,57 @@
 
 Parametrem jest nazwa opcji zgodnie z opisem w SSL_CTX_set_options(3ssl), ale bez przedrostka SSL_OP_. stunnel -options wy&#x15B;wietla opcje dozwolone w aktualnej kombinacji programu stunnel i biblioteki OpenSSL.
 
-Aby wyspecyfikowa&#x107; kilka opcji nale&#x17C;y u&#x17C;y&#x107; options wielokrotnie. Nazwa opcji mo&#x17C;e by&#x107; poprzedzona my&#x15B;lnikiem (&quot;-&quot;) celem wy&#x142;&#x105;czenia opcji.
+Aby wyspecyfikowa&#x107; kilka opcji nale&#x17C;y u&#x17C;y&#x107; options wielokrotnie. Nazwa opcji mo&#x17C;e by&#x107; poprzedzona my&#x15B;lnikiem (&quot;-&quot;) celem wył&#x105;czenia opcji.
 
-Na przyk&#x142;ad, dla zachowania kompatybilno&#x15B;ci z b&#x142;&#x119;dami implementacji TLS w programie Eudora, mo&#x17C;na u&#x17C;y&#x107; opcji:
+Na przykład, dla zachowania kompatybilno&#x15B;ci z bł&#x119;dami implementacji TLS w programie Eudora, mo&#x17C;na u&#x17C;y&#x107; opcji:
 
-<pre><code> options = DONT_INSERT_EMPTY_FRAGMENTS</code></pre>
+<pre><code>options = DONT_INSERT_EMPTY_FRAGMENTS</code></pre>
 
 domy&#x15B;lnie:
 
-<pre><code> options = NO_SSLv2
- options = NO_SSLv3</code></pre>
+<pre><code>options = NO_SSLv2
+options = NO_SSLv3</code></pre>
+
+Pocz&#x105;wszy od OpenSSL 1.1.0, zamiast wył&#x105;cza&#x107; okre&#x15B;lone wersje protokoł&oacute;w TLS u&#x17C;yj opcji sslVersionMax lub sslVersionMin.
 
 </dd>
 <dt id="protocol-PROTOK">protocol = PROTOK&Oacute;&#x141;</dt>
 <dd>
 
-negocjuj TLS podanym protoko&#x142;em aplikacyjnym
+negocjuj TLS podanym protokołem aplikacyjnym
 
-Opcja ta w&#x142;&#x105;cza wst&#x119;pn&#x105; negocjacj&#x119; szyfrowania TLS dla wybranego protoko&#x142;u aplikacyjnego. Opcji protocol nie nale&#x17C;y u&#x17C;ywa&#x107; z szyfrowaniem TLS na osobnym porcie.
+Opcja ta wł&#x105;cza wst&#x119;pn&#x105; negocjacj&#x119; szyfrowania TLS dla wybranego protokołu aplikacyjnego. Opcji protocol nie nale&#x17C;y u&#x17C;ywa&#x107; z szyfrowaniem TLS na osobnym porcie.
 
-Aktualnie wspierane protoko&#x142;y:
+Aktualnie wspierane protokoły:
 
 <dl>
 
 <dt id="cifs">cifs</dt>
 <dd>
 
-Nieudokumentowane rozszerzenie protoko&#x142;u CIFS wspierane przez serwer Samba. Wsparcie dla tego rozrzeczenia zosta&#x142;o zarzucone w wersji 3.0.0 serwera Samba.
+Nieudokumentowane rozszerzenie protokołu CIFS wspierane przez serwer Samba. Wsparcie dla tego rozszerzenia zostało zarzucone w wersji 3.0.0 serwera Samba.
+
+</dd>
+<dt id="capwin">capwin</dt>
+<dd>
+
+Wsparcie dla aplikacji http://www.capwin.org/
+
+</dd>
+<dt id="capwinctrl">capwinctrl</dt>
+<dd>
+
+Wsparcie dla aplikacji http://www.capwin.org/
+
+Ten protok&oacute;ł jest wspierany wył&#x105;cznie w trybie klienckim.
 
 </dd>
 <dt id="connect">connect</dt>
 <dd>
 
-Negocjacja RFC 2817 - Upgrading to TLS Within HTTP/1.1, rozdzia&#x142; 5.2 - Requesting a Tunnel with CONNECT
+Negocjacja RFC 2817 - Upgrading to TLS Within HTTP/1.1, rozdział 5.2 - Requesting a Tunnel with CONNECT
 
-Ten protok&oacute;&#x142; jest wspierany wy&#x142;&#x105;cznie w trybie klienckim.
+Ten protok&oacute;ł jest wspierany wył&#x105;cznie w trybie klienckim.
 
 </dd>
 <dt id="imap">imap</dt>
@@ -811,18 +863,24 @@
 Negocjacja RFC 2595 - Using TLS with IMAP, POP3 and ACAP
 
 </dd>
+<dt id="ldap">ldap</dt>
+<dd>
+
+Negocjacja RFC 2830 - Lightweight Directory Access Protocol (v3): Extension for Transport Layer Security
+
+</dd>
 <dt id="nntp">nntp</dt>
 <dd>
 
 Negocjacja RFC 4642 - Using Transport Layer Security (TLS) with Network News Transfer Protocol (NNTP)
 
-Ten protok&oacute;&#x142; jest wspierany wy&#x142;&#x105;cznie w trybie klienckim.
+Ten protok&oacute;ł jest wspierany wył&#x105;cznie w trybie klienckim.
 
 </dd>
 <dt id="pgsql">pgsql</dt>
 <dd>
 
-Negocjacja http://www.postgresql.org/docs/8.3/static/protocol-flow.html#AEN73982
+Negocjacja http://www.postgresql.org/docs/8.3/static/protocol-flow.html#AEN73982
 
 </dd>
 <dt id="pop3">pop3</dt>
@@ -834,7 +892,7 @@
 <dt id="proxy">proxy</dt>
 <dd>
 
-Przekazywanie adresu IP haproxy http://haproxy.1wt.eu/download/1.5/doc/proxy-protocol.txt
+Przekazywanie oryginalnego IP klienta przez protok&oacute;ł HAProxy PROXY w wersji 1 https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt
 
 </dd>
 <dt id="smtp">smtp</dt>
@@ -846,15 +904,15 @@
 <dt id="socks">socks</dt>
 <dd>
 
-Wspierany jest protok&oacute;&#x142; SOCKS w wersjach 4, 4a i 5. Protok&oacute;&#x142; SOCKS enkapsulowany jest w protokole TLS, wi&#x119;c adres serwera docelowego nie jest widoczny dla napastnika przechwytuj&#x105;cego ruch sieciowy.
+Wspierany jest protok&oacute;ł SOCKS w wersjach 4, 4a i 5. Protok&oacute;ł SOCKS enkapsulowany jest w protokole TLS, wi&#x119;c adres serwera docelowego nie jest widoczny dla napastnika przechwytuj&#x105;cego ruch sieciowy.
 
 http://www.openssh.com/txt/socks4.protocol
 
 http://www.openssh.com/txt/socks4a.protocol
 
-Nie jest wspierana komenda BIND protoko&#x142;u SOCKS. Przes&#x142;ana warto&#x15B;&#x107; parametru USERID jest ignorowana.
+Nie jest wspierana komenda BIND protokołu SOCKS. Przesłana warto&#x15B;&#x107; parametru USERID jest ignorowana.
 
-Sekcja PRZYK&#x141;ADY zawiera przyk&#x142;adowe pliki konfiguracyjne VPNa zbudowanego w oparciu o szyfrowany protok&oacute;&#x142; SOCKS.
+Sekcja PRZYK&#x141;ADY zawiera przykładowe pliki konfiguracyjne VPNa zbudowanego w oparciu o szyfrowany protok&oacute;ł SOCKS.
 
 </dd>
 </dl>
@@ -863,47 +921,55 @@
 <dt id="protocolAuthentication-UWIERZYTELNIENIE">protocolAuthentication = UWIERZYTELNIENIE</dt>
 <dd>
 
-rodzaj uwierzytelnienia do negocjacji protoko&#x142;u
+rodzaj uwierzytelnienia do negocjacji protokołu
 
-Opcja ta jest wpierana wy&#x142;&#x105;cznie w klienckich protoko&#x142;ach &#39;connect&#39; i &#39;smtp&#39;.
+Opcja ta jest wpierana wył&#x105;cznie w klienckich protokołach &#39;connect&#39; i &#39;smtp&#39;.
 
-W protokole &#39;connect&#39; wspierane jest uwierzytelnienie &#39;basic&#39; oraz &#39;ntlm&#39;. Domy&#x15B;lnym rodzajem uwierzytelnienia protoko&#x142;u &#39;connect&#39; jest &#39;basic&#39;.
+W protokole &#39;connect&#39; wspierane jest uwierzytelnienie &#39;basic&#39; oraz &#39;ntlm&#39;. Domy&#x15B;lnym rodzajem uwierzytelnienia protokołu &#39;connect&#39; jest &#39;basic&#39;.
 
-W protokole &#39;smtp&#39; wspierane jest uwierzytelnienie &#39;plain&#39; oraz &#39;login&#39;. Domy&#x15B;lnym rodzajem uwierzytelnienia protoko&#x142;u &#39;smtp&#39; jest &#39;plain&#39;.
+W protokole &#39;smtp&#39; wspierane jest uwierzytelnienie &#39;plain&#39; oraz &#39;login&#39;. Domy&#x15B;lnym rodzajem uwierzytelnienia protokołu &#39;smtp&#39; jest &#39;plain&#39;.
 
 </dd>
 <dt id="protocolDomain-DOMENA">protocolDomain = DOMENA</dt>
 <dd>
 
-domena do negocjacji protoko&#x142;u
+domena do negocjacji protokołu
+
+W obecnej wersji opcja ma zastosowanie wył&#x105;cznie w protokole &#39;connect&#39;.
+
+</dd>
+<dt id="protocolHeader-NAGWEK">protocolHeader = NAG&#x141;&Oacute;WEK</dt>
+<dd>
+
+nagł&oacute;wek do negocjacji protokołu
 
-W obecnej wersji wybrana domena ma zastosowanie wy&#x142;&#x105;cznie w protokole &#39;connect&#39;.
+W obecnej wersji opcja ma zastosowanie wył&#x105;cznie w protokole &#39;connect&#39;.
 
 </dd>
-<dt id="protocolHost-HOST:PORT">protocolHost = HOST:PORT</dt>
+<dt id="protocolHost-ADRES">protocolHost = ADRES</dt>
 <dd>
 
-adres docelowy do negocjacji protoko&#x142;u
+adres hosta do negocjacji protokołu
 
-protocolHost okre&#x15B;la docelowy serwer TLS, do kt&oacute;rego po&#x142;&#x105;czy&#x107; ma si&#x119; proxy. Nie jest to adres serwera proxy, do kt&oacute;rego po&#x142;&#x105;czenie zestawia stunnel. Adres serwera proxy powinien by&#x107; okre&#x15B;lony przy pomocy opcji &#39;connect&#39;.
+Dla protokołu &#39;connect&#39;, protocolHost okre&#x15B;la docelowy serwer TLS, do kt&oacute;rego poł&#x105;czy&#x107; ma si&#x119; proxy. Adres serwera proxy, do kt&oacute;rego ł&#x105;czy si&#x119; stunnel, musi by&#x107; okre&#x15B;lony przy pomocy opcji connect.
 
-W obecnej wersji adres docelowy protoko&#x142;u ma zastosowanie wy&#x142;&#x105;cznie w protokole &#39;connect&#39;.
+Dla protokołu &#39;smtp&#39;, protocolHost okre&#x15B;la warto&#x15B;&#x107; HELO/EHLO wysyłanego przy negocjacji klienta.
 
 </dd>
 <dt id="protocolPassword-HASO">protocolPassword = HAS&#x141;O</dt>
 <dd>
 
-has&#x142;o do negocjacji protoko&#x142;u
+hasło do negocjacji protokołu
 
-Opcja ta jest wspierana wy&#x142;&#x105;cznie w klienckich protoko&#x142;ach &#39;connect&#39; i &#39;smtp&#39;.
+Opcja ta jest wspierana wył&#x105;cznie w klienckich protokołach &#39;connect&#39; i &#39;smtp&#39;.
 
 </dd>
 <dt id="protocolUsername-UYTKOWNIK">protocolUsername = U&#x17B;YTKOWNIK</dt>
 <dd>
 
-nazwa u&#x17C;ytkownika do negocjacji protoko&#x142;u
+nazwa u&#x17C;ytkownika do negocjacji protokołu
 
-Opcja ta jest wspierana wy&#x142;&#x105;cznie w klienckich protoko&#x142;ach &#39;connect&#39; i &#39;smtp&#39;.
+Opcja ta jest wspierana wył&#x105;cznie w klienckich protokołach &#39;connect&#39; i &#39;smtp&#39;.
 
 </dd>
 <dt id="PSKidentity-TOSAMO">PSKidentity = TO&#x17B;SAMO&#x15A;&#x106;</dt>
@@ -923,23 +989,23 @@
 
 Ka&#x17C;da linia pliku jest w nast&#x119;puj&#x105;cym formacie:
 
-<pre><code> TO&#x17B;SAMO&#x15A;&#x106;:KLUCZ</code></pre>
+<pre><code>TO&#x17B;SAMO&#x15A;&#x106;:KLUCZ</code></pre>
 
-Klucz musi by&#x107; mie&#x107; przynajmniej 20 znak&oacute;w. Nale&#x17C;y ograniczy&#x107; dost&#x119;p do czytania lub pisania do tego pliku.
+Szesnastkowe klucze s&#x105; automatycznie konwertowane do postaci binarnej. Klucz musi by&#x107; mie&#x107; przynajmniej 16 bajt&oacute;w, co w przypadku kluczy szesnastkowych przekłada si&#x119; na przynajmniej 32 znaki. Nale&#x17C;y ograniczy&#x107; dost&#x119;p do czytania lub pisania do tego pliku.
 
 </dd>
 <dt id="pty-yes-no-tylko-Unix">pty = yes | no (tylko Unix)</dt>
 <dd>
 
-alokuj pseudoterminal dla programu uruchamianego w opcji &#39;exec&#39;
+alokuj pseudo-terminal dla programu uruchamianego w opcji &#39;exec&#39;
 
 </dd>
 <dt id="redirect-HOST:-PORT">redirect = HOST:PORT</dt>
 <dd>
 
-przekieruj klienta, kt&oacute;remu nie uda&#x142;o si&#x119; poprawnie uwierzytelni&#x107; przy pomocy certyfikatu
+przekieruj klienta, kt&oacute;remu nie udało si&#x119; poprawnie uwierzytelni&#x107; przy pomocy certyfikatu
 
-Opcja dzia&#x142;a wy&#x142;&#x105;cznie w trybie serwera. Cz&#x119;&#x15B;&#x107; negocjacji protoko&#x142;&oacute;w jest niekompatybilna z opcj&#x105; redirect.
+Opcja działa wył&#x105;cznie w trybie serwera. Cz&#x119;&#x15B;&#x107; negocjacji protokoł&oacute;w jest niekompatybilna z opcj&#x105; redirect.
 
 </dd>
 <dt id="renegotiation-yes-no">renegotiation = yes | no</dt>
@@ -947,13 +1013,13 @@
 
 pozwalaj na renegocjacj&#x119; TLS
 
-Zastosowania renegocjacji TLS zawieraj&#x105; niekt&oacute;re scenariusze uwierzytelniania oraz renegocjacj&#x119; kluczy dla d&#x142;ugotrwa&#x142;ych po&#x142;&#x105;cze&#x144;.
+Zastosowania renegocjacji TLS zawieraj&#x105; niekt&oacute;re scenariusze uwierzytelniania oraz renegocjacj&#x119; kluczy dla długotrwałych poł&#x105;cze&#x144;.
 
-Z drugiej strony w&#x142;asno&#x15B;&#x107; na mo&#x17C;e u&#x142;atwi&#x107; trywialny atak DoS poprzez wygenerowanie obci&#x105;&#x17C;enia procesora:
+Z drugiej strony własno&#x15B;&#x107; na mo&#x17C;e ułatwi&#x107; trywialny atak DoS poprzez wygenerowanie obci&#x105;&#x17C;enia procesora:
 
 http://vincent.bernat.im/en/blog/2011-ssl-dos-mitigation.html
 
-Warto zauwa&#x17C;y&#x107;, &#x17C;e zablokowanie renegocjacji TLS nie zebezpiecza w pe&#x142;ni przed opisanym problemem.
+Warto zauwa&#x17C;y&#x107;, &#x17C;e zablokowanie renegocjacji TLS nie zabezpiecza w pełni przed opisanym problemem.
 
 domy&#x15B;lnie: yes (o ile wspierane przez OpenSSL)
 
@@ -961,7 +1027,7 @@
 <dt id="reset-yes-no">reset = yes | no</dt>
 <dd>
 
-sygnalizuj wyst&#x105;pienie b&#x142;&#x119;du przy pomocy flagi TCP RST
+sygnalizuj wyst&#x105;pienie bł&#x119;du przy pomocy flagi TCP RST
 
 Opcja nie jest wspierana na niekt&oacute;rych platformach.
 
@@ -971,17 +1037,71 @@
 <dt id="retry-yes-no">retry = yes | no</dt>
 <dd>
 
-po&#x142;&#x105;cz ponownie sekcj&#x119; connect+exec po roz&#x142;&#x105;czeniu
+poł&#x105;cz ponownie sekcj&#x119; connect+exec po rozł&#x105;czeniu
 
 domy&#x15B;lnie: no
 
 </dd>
+<dt id="securityLevel-POZIOM">securityLevel = POZIOM</dt>
+<dd>
+
+ustaw poziom bezpiecze&#x144;stwa
+
+Znaczenie ka&#x17C;dego poziomu opisano poni&#x17C;ej:
+
+<dl>
+
+<dt id="poziom-0">poziom 0</dt>
+<dd>
+
+Wszystko jest dozwolone.
+
+</dd>
+<dt id="poziom-1">poziom 1</dt>
+<dd>
+
+Poziom bezpiecze&#x144;stwa zapewniaj&#x105;cy minimum 80 bit&oacute;w bezpiecze&#x144;stwa. &#x17B;adne parametry kryptograficzne oferuj&#x105;ce poziom bezpiecze&#x144;stwa poni&#x17C;ej 80 bit&oacute;w nie mog&#x105; zosta&#x107; u&#x17C;yte. W zwi&#x105;zku z tym RSA, DSA oraz klucze DH kr&oacute;tsze ni&#x17C; 1024 bity, a tak&#x17C;e klucze ECC kr&oacute;tsze ni&#x17C; 160 bit&oacute;w i wszystkie eksportowe zestawy szyfr&oacute;w s&#x105; niedozwolone. U&#x17C;ycie SSLv2 jest zabronione. Wszelkie listy parametr&oacute;w kryptograficznych u&#x17C;ywaj&#x105;ce MD5 do MAC s&#x105; zabronione.
+
+</dd>
+<dt id="poziom-2">poziom 2</dt>
+<dd>
+
+Poziom bezpiecze&#x144;stwa zapewniaj&#x105;cy 112 bit&oacute;w bezpiecze&#x144;stwa. W zwi&#x105;zku z tym RSA, DSA oraz klucze DH kr&oacute;tsze ni&#x17C; 2048 bit&oacute;w, a tak&#x17C;e klucze ECC kr&oacute;tsze ni&#x17C; 224 bity s&#x105; niedozwolone. Opr&oacute;cz wył&#x105;cze&#x144; z poziomu 1 zabronione jest tak&#x17C;e korzystanie z zestaw&oacute;w szyfr&oacute;w u&#x17C;ywaj&#x105;cych RC4. U&#x17C;ycie SSLv3 jest zabronione. Kompresja jest wył&#x105;czona.
+
+</dd>
+<dt id="poziom-3">poziom 3</dt>
+<dd>
+
+Poziom bezpiecze&#x144;stwa zapewniaj&#x105;cy 128 bit&oacute;w bezpiecze&#x144;stwa. W zwi&#x105;zku z tym RSA, DSA oraz klucze DH kr&oacute;tsze ni&#x17C; 3072 bity, a tak&#x17C;e klucze ECC kr&oacute;tsze ni&#x17C; 256 bit&oacute;w s&#x105; niedozwolone. Opr&oacute;cz wył&#x105;cze&#x144; z poziomu 2 zabronione jest tak&#x17C;e korzystanie z zestaw&oacute;w szyfr&oacute;w nie zapewniaj&#x105;cych utajniania z wyprzedzeniem (forward secrecy). Wersje TLS starsze ni&#x17C; 1.1 s&#x105; zabronione. Bilety sesji s&#x105; wył&#x105;czone.
+
+</dd>
+<dt id="poziom-4">poziom 4</dt>
+<dd>
+
+Poziom bezpiecze&#x144;stwa zapewniaj&#x105;cy 192 bity bezpiecze&#x144;stwa. W zwi&#x105;zku z tym RSA, DSA oraz klucze DH kr&oacute;tsze ni&#x17C; 7680 bit&oacute;w, a tak&#x17C;e klucze ECC kr&oacute;tsze ni&#x17C; 384 bity s&#x105; niedozwolone. Listy parametr&oacute;w kryptograficznych u&#x17C;ywaj&#x105;cych SHA1 do MAC s&#x105; zabronione. Wersje TLS starsze ni&#x17C; 1.2 s&#x105; zabronione.
+
+</dd>
+<dt id="poziom-5">poziom 5</dt>
+<dd>
+
+Poziom bezpiecze&#x144;stwa zapewniaj&#x105;cy 256 bit&oacute;w bezpiecze&#x144;stwa. W zwi&#x105;zku z tym RSA, DSA oraz klucze DH kr&oacute;tsze ni&#x17C; 15360 bit&oacute;w, a tak&#x17C;e klucze ECC kr&oacute;tsze ni&#x17C; 512 bit&oacute;w s&#x105; niedozwolone.
+
+</dd>
+<dt id="domylnie:-2">domy&#x15B;lnie: 2</dt>
+<dd>
+
+</dd>
+</dl>
+
+Opcja securityLevel jest dost&#x119;pna pocz&#x105;wszy od OpenSSL 1.1.0.
+
+</dd>
 <dt id="requireCert-yes-no">requireCert = yes | no</dt>
 <dd>
 
 wymagaj certyfikatu klienta dla verifyChain lub verifyPeer
 
-Przy opcji requireCert ustawionej na no, stunnel akceptuje po&#x142;&#x105;czenia klient&oacute;w, kt&oacute;re nie wys&#x142;a&#x142;y certyfikatu.
+Przy opcji requireCert ustawionej na no, stunnel akceptuje poł&#x105;czenia klient&oacute;w, kt&oacute;re nie wysłały certyfikatu.
 
 Zar&oacute;wno verifyChain = yes jak i verifyPeer = yes automatycznie ustawiaj&#x105; requireCert na yes.
 
@@ -993,9 +1113,9 @@
 
 identyfikator grupy Unix
 
-Jako opcja globalna: grupa, z kt&oacute;rej prawami pracowa&#x142; b&#x119;dzie stunnel.
+Jako opcja globalna: grupa, z kt&oacute;rej prawami pracował b&#x119;dzie stunnel.
 
-Jako opcja us&#x142;ugi: grupa gniazda Unix utworzonego przy pomocy opcji &quot;accept&quot;.
+Jako opcja usługi: grupa gniazda Unix utworzonego przy pomocy opcji &quot;accept&quot;.
 
 </dd>
 <dt id="setuid-IDENTYFIKATOR_UYTKOWNIKA-tylko-Unix">setuid = IDENTYFIKATOR_U&#x17B;YTKOWNIKA (tylko Unix)</dt>
@@ -1003,9 +1123,9 @@
 
 identyfikator u&#x17C;ytkownika Unix
 
-Jako opcja globalna: u&#x17C;ytkownik, z kt&oacute;rego prawami pracowa&#x142; b&#x119;dzie stunnel.
+Jako opcja globalna: u&#x17C;ytkownik, z kt&oacute;rego prawami pracował b&#x119;dzie stunnel.
 
-Jako opcja us&#x142;ugi: w&#x142;a&#x15B;ciciel gniazda Unix utworzonego przy pomocy opcji &quot;accept&quot;.
+Jako opcja usługi: wła&#x15B;ciciel gniazda Unix utworzonego przy pomocy opcji &quot;accept&quot;.
 
 </dd>
 <dt id="sessionCacheSize-LICZBA_POZYCJI_CACHE">sessionCacheSize = LICZBA_POZYCJI_CACHE</dt>
@@ -1026,24 +1146,32 @@
 Parametr okre&#x15B;la czas w sekundach, po kt&oacute;rym sesja TLS zostanie usuni&#x119;ta z pami&#x119;ci podr&#x119;cznej.
 
 </dd>
+<dt id="sessionResume-yes-no">sessionResume = yes | no</dt>
+<dd>
+
+zezwalaj lub nie zezwalaj na wznawianie sesji
+
+domy&#x15B;lnie: yes
+
+</dd>
 <dt id="sessiond-HOST:PORT">sessiond = HOST:PORT</dt>
 <dd>
 
-adres sessiond - servera cache sesji TLS
+adres sessiond - serwera cache sesji TLS
 
 </dd>
 <dt id="sni-NAZWA_USUGI:WZORZEC_NAZWY_SERWERA-tryb-serwera">sni = NAZWA_US&#x141;UGI:WZORZEC_NAZWY_SERWERA (tryb serwera)</dt>
 <dd>
 
-U&#x17C;yj us&#x142;ugi jako podrz&#x119;dnej (virtualnego serwera) dla rozszerzenia TLS Server Name Indication (RFC 3546).
+U&#x17C;yj usługi jako podrz&#x119;dnej (virtualnego serwera) dla rozszerzenia TLS Server Name Indication (RFC 3546).
 
-NAZWA_US&#x141;UGI wskazuje us&#x142;ug&#x119; nadrz&#x119;dn&#x105;, kt&oacute;ra odbiera po&#x142;&#x105;czenia od klient&oacute;w przy pomocy opcji accept. WZORZEC_NAZWY_SERWERA wskazuje nazw&#x119; serwera wirtualnego. Wzorzec mo&#x17C;e zaczyna&#x107; si&#x119; znakiem &#39;*&#39;, np. &#39;*.example.com&quot;. Z pojedy&#x144;cz&#x105; us&#x142;ug&#x105; nadrz&#x119;dn&#x105; powi&#x105;zane jest zwykle wiele us&#x142;ug podrz&#x119;dnych. Opcja sni mo&#x17C;e by&#x107; rownie&#x17C; u&#x17C;yta wielokrotnie w ramach jednej us&#x142;ugi podrz&#x119;dnej.
+NAZWA_US&#x141;UGI wskazuje usług&#x119; nadrz&#x119;dn&#x105;, kt&oacute;ra odbiera poł&#x105;czenia od klient&oacute;w przy pomocy opcji accept. WZORZEC_NAZWY_SERWERA wskazuje nazw&#x119; serwera wirtualnego. Wzorzec mo&#x17C;e zaczyna&#x107; si&#x119; znakiem &#39;*&#39;, np. &#39;*.example.com&quot;. Z pojedyncz&#x105; usług&#x105; nadrz&#x119;dn&#x105; powi&#x105;zane jest zwykle wiele usług podrz&#x119;dnych. Opcja sni mo&#x17C;e by&#x107; r&oacute;wnie&#x17C; u&#x17C;yta wielokrotnie w ramach jednej usługi podrz&#x119;dnej.
 
-Zar&oacute;wno us&#x142;uga nadrz&#x119;dna jak i podrz&#x119;dna nie mo&#x17C;e by&#x107; skonfigurowana w trybie klienckim.
+Zar&oacute;wno usługa nadrz&#x119;dna jak i podrz&#x119;dna nie mo&#x17C;e by&#x107; skonfigurowana w trybie klienckim.
 
-Opcja connect us&#x142;ugi podrz&#x119;dnej jest ignorowana w po&#x142;&#x105;czeniu z opcj&#x105; protocol, gdy&#x17C; po&#x142;&#x105;czenie do zdalnego serwera jest w tym wypadku nawi&#x105;zywane przed negocjacj&#x105; TLS.
+Opcja connect usługi podrz&#x119;dnej jest ignorowana w poł&#x105;czeniu z opcj&#x105; protocol, gdy&#x17C; poł&#x105;czenie do zdalnego serwera jest w tym wypadku nawi&#x105;zywane przed negocjacj&#x105; TLS.
 
-Uwierzytelnienie przy pomocy biblioteki libwrap jest realizowane dwukrotnie: najpierw dla us&#x142;ugi nadrz&#x119;dnej po odebraniu po&#x142;&#x105;czenia TCP, a nast&#x119;pnie dla us&#x142;ugi podrz&#x119;dnej podczas negocjacji TLS.
+Uwierzytelnienie przy pomocy biblioteki libwrap jest realizowane dwukrotnie: najpierw dla usługi nadrz&#x119;dnej po odebraniu poł&#x105;czenia TCP, a nast&#x119;pnie dla usługi podrz&#x119;dnej podczas negocjacji TLS.
 
 Opcja sni jest dost&#x119;pna pocz&#x105;wszy od OpenSSL 1.0.0.
 
@@ -1053,7 +1181,7 @@
 
 U&#x17C;yj parametru jako warto&#x15B;ci rozszerzenia TLS Server Name Indication (RFC 3546).
 
-Pusta warto&#x15B;&#x107; parametru NAZWA_SERWERA wy&#x142;&#x105;cza wysy&#x142;anie rozszerzenia SNI.
+Pusta warto&#x15B;&#x107; parametru NAZWA_SERWERA wył&#x105;cza wysyłanie rozszerzenia SNI.
 
 Opcja sni jest dost&#x119;pna pocz&#x105;wszy od OpenSSL 1.0.0.
 
@@ -1065,48 +1193,114 @@
 
 Dla opcji linger warto&#x15B;ci maj&#x105; posta&#x107; l_onof:l_linger. Dla opcji time warto&#x15B;ci maj&#x105; posta&#x107; tv_sec:tv_usec.
 
-Przyk&#x142;ady:
+Przykłady:
 
-<pre><code> socket = l:SO_LINGER=1:60
- ustaw jednominutowe przeterminowanie
- przy zamykaniu lokalnego gniazda
- socket = r:SO_OOBINLINE=yes
- umie&#x15B;&#x107; dane pozapasmowe (out-of-band)
- bezpo&#x15B;rednio w strumieniu danych
- wej&#x15B;ciowych dla zdalnych gniazd
- socket = a:SO_REUSEADDR=no
- zablokuj ponowne u&#x17C;ywanie portu
- (domy&#x15B;lnie w&#x142;&#x105;czone)
- socket = a:SO_BINDTODEVICE=lo
- przyjmuj po&#x142;&#x105;czenia wy&#x142;&#x105;cznie na
- interfejsie zwrotnym (ang. loopback)</code></pre>
+<pre><code>socket = l:SO_LINGER=1:60
+ ustaw jednominutowe przeterminowanie
+ przy zamykaniu lokalnego gniazda
+socket = r:SO_OOBINLINE=yes
+ umie&#x15B;&#x107; dane pozapasmowe (out-of-band)
+ bezpo&#x15B;rednio w strumieniu danych
+ wej&#x15B;ciowych dla zdalnych gniazd
+socket = a:SO_REUSEADDR=no
+ zablokuj ponowne u&#x17C;ywanie portu
+ (domy&#x15B;lnie wł&#x105;czone)
+socket = a:SO_BINDTODEVICE=lo
+ przyjmuj poł&#x105;czenia wył&#x105;cznie na
+ interfejsie zwrotnym (ang. loopback)</code></pre>
 
 </dd>
 <dt id="sslVersion-WERSJA_SSL">sslVersion = WERSJA_SSL</dt>
 <dd>
 
-wersja protoko&#x142;u TLS
+wersja protokołu TLS
+
+Wspierane wersje: all, SSLv2, SSLv3, TLSv1, TLSv1.1, TLSv1.2, TLSv1.3
+
+Dost&#x119;pno&#x15B;&#x107; konkretnych protokoł&oacute;w zale&#x17C;y od u&#x17C;ytej wersji OpenSSL. Starsze wersje OpenSSL nie wspieraj&#x105; TLSv1.1, TLSv1.2, TLSv1.3. Nowsze wersje OpenSSL nie wspieraj&#x105; SSLv2.
+
+Przestarzałe protokoły SSLv2 i SSLv3 s&#x105; domy&#x15B;lnie wył&#x105;czone.
+
+Pocz&#x105;wszy od OpenSSL 1.1.0, ustawienie
+
+<pre><code>sslVersion = WERSJA_SSL</code></pre>
+
+jest r&oacute;wnowa&#x17C;ne opcjom
+
+<pre><code>sslVersionMax = WERSJA_SSL
+sslVersionMin = WERSJA_SSL</code></pre>
+
+</dd>
+<dt id="sslVersionMax-WERSJA_SSL">sslVersionMax = WERSJA_SSL</dt>
+<dd>
+
+maksymalna wspierana wersja protokołu TLS
+
+Wspierane wersje: all, SSLv3, TLSv1, TLSv1.1, TLSv1.2, TLSv1.3
+
+all wł&#x105;cza wszystkie wersje protokoł&oacute;w a&#x17C; do maksymalnej wersji wspieranej przez bibliotek&#x119; u&#x17C;ytej wersji OpenSSL.
+
+Dost&#x119;pno&#x15B;&#x107; konkretnych protokoł&oacute;w zale&#x17C;y od u&#x17C;ytej wersji OpenSSL.
+
+Opcja sslVersionMax jest dost&#x119;pna pocz&#x105;wszy od OpenSSL 1.1.0.
+
+domy&#x15B;lnie: all
+
+</dd>
+<dt id="sslVersionMin-WERSJA_SSL">sslVersionMin = WERSJA_SSL</dt>
+<dd>
+
+minimalna wspierana wersja protokołu TLS
 
-Wspierane wersje: all, SSLv2, SSLv3, TLSv1, TLSv1.1, TLSv1.2
+Wspierane wersje: all, SSLv3, TLSv1, TLSv1.1, TLSv1.2, TLSv1.3
 
-Ocja sslVersion jest przestarza&#x142;a i zostanie usuni&#x119;ta w przysz&#x142;ych wersjach stunnela. Zamiast niej nale&#x17C;y u&#x17C;ywa&#x107; nast&#x119;puj&#x105;cych opcji:
+all wł&#x105;cza wszystkie wersje protokoł&oacute;w a&#x17C; do minimalnej wersji wspieranej przez bibliotek&#x119; u&#x17C;ytej wersji OpenSSL.
 
-<pre><code> options = NO_SSLv2
- options = NO_SSLv3
- options = NO_TLSv1
- options = NO_TLSv1.1
- options = NO_TLSv1.2
- options = NO_TLSv1.3</code></pre>
+Dost&#x119;pno&#x15B;&#x107; konkretnych protokoł&oacute;w zale&#x17C;y od u&#x17C;ytej wersji OpenSSL.
 
-Dost&#x119;pno&#x15B;&#x107; konkretnych protoko&#x142;&oacute;w zale&#x17C;y od u&#x17C;ytej wersji OpenSSL. Starsze wersje OpenSSL nie wspieraj&#x105; TLSv1.1 i TLSv1.2. Nowsze wersje OpenSSL nie wspieraj&#x105; SSLv2.
+Opcja sslVersionMin jest dost&#x119;pna pocz&#x105;wszy od OpenSSL 1.1.0.
 
-Przestarza&#x142;e protoko&#x142;y SSLv2 i SSLv3 s&#x105; domy&#x15B;lnie wy&#x142;&#x105;czone. Szczeg&oacute;&#x142;owe informacje dost&#x119;pne s&#x105; w opisie opcji options.
+domy&#x15B;lnie: TLSv1
 
 </dd>
 <dt id="stack-LICZBA_BAJTW-z-wyjtkiem-modelu-FORK">stack = LICZBA_BAJT&Oacute;W (z wyj&#x105;tkiem modelu FORK)</dt>
 <dd>
 
-rozmiar stosu procesora w&#x105;tku
+rozmiar stosu procesora tworzonych w&#x105;tk&oacute;w
+
+Zbyt du&#x17C;y stos zwi&#x119;ksza zu&#x17C;ycie pami&#x119;ci wirtualnej. Zbyt mały stos mo&#x17C;e powodowa&#x107; problemy ze stabilno&#x15B;ci&#x105; aplikacji.
+
+domy&#x15B;lnie: 65536 bytes (wystarczaj&#x105;cy dla testowanych platform)
+
+</dd>
+<dt id="ticketKeySecret-SECRET">ticketKeySecret = SECRET</dt>
+<dd>
+
+szesnastkowy klucz symetryczny u&#x17C;ywany przez serwer do zapewnienia poufno&#x15B;ci bilet&oacute;w sesji
+
+Bilety sesji zdefiniowane w RFC 5077 zapewniaj&#x105; ulepszon&#x105; mo&#x17C;liwo&#x15B;&#x107; wznawiania sesji, w kt&oacute;rej implementacja serwera nie jest wymagana do utrzymania stanu sesji.
+
+&#x141;&#x105;czne u&#x17C;ycie opcji ticketKeySecret i ticketMacSecret umo&#x17C;liwia wznawianie sesji na klastrze serwer&oacute;w lub wznowienie sesji po restarcie serwera.
+
+Klucz musi mie&#x107; rozmiar 16 lub 32 bajt&oacute;w, co przekłada si&#x119; na dokładnie 32 lub 64 cyfry szesnastkowe. Poszczeg&oacute;lne bajty mog&#x105; by&#x107; opcjonalnie oddzielone dwukropkami.
+
+Opcja działa wył&#x105;cznie w trybie serwera.
+
+Opcja ticketKeySecret jest dost&#x119;pna pocz&#x105;wszy od OpenSSL 1.0.0.
+
+Wył&#x105;czenie opcji NO_TICKET jest wymagane dla obsługi bilet&oacute;w sesji w OpenSSL-u starszym ni&#x17C; 1.1.1, ale opcja ta jest niekompatybilna z opcj&#x105; redirect.
+
+</dd>
+<dt id="ticketMacSecret-SECRET">ticketMacSecret = SECRET</dt>
+<dd>
+
+szesnastkowy klucz symetryczny u&#x17C;ywany przez serwer zapewnienia integralno&#x15B;ci bilet&oacute;w sesji
+
+Klucz musi mie&#x107; rozmiar 16 lub 32 bajt&oacute;w, co przekłada si&#x119; na dokładnie 32 lub 64 cyfry szesnastkowe. Poszczeg&oacute;lne bajty mog&#x105; by&#x107; opcjonalnie oddzielone dwukropkami.
+
+Opcja działa wył&#x105;cznie w trybie serwera.
+
+Opcja ticketMacSecret jest dost&#x119;pna pocz&#x105;wszy od OpenSSL 1.0.0.
 
 </dd>
 <dt id="TIMEOUTbusy-LICZBA_SEKUND">TIMEOUTbusy = LICZBA_SEKUND</dt>
@@ -1124,13 +1318,13 @@
 <dt id="TIMEOUTconnect-LICZBA_SEKUND">TIMEOUTconnect = LICZBA_SEKUND</dt>
 <dd>
 
-czas oczekiwania na nawi&#x105;zanie po&#x142;&#x105;czenia
+czas oczekiwania na nawi&#x105;zanie poł&#x105;czenia
 
 </dd>
 <dt id="TIMEOUTidle-LICZBA_SEKUND">TIMEOUTidle = LICZBA_SEKUND</dt>
 <dd>
 
-maksymalny czas utrzymywania bezczynnego po&#x142;&#x105;czenia
+maksymalny czas utrzymywania bezczynnego poł&#x105;czenia
 
 </dd>
 <dt id="transparent-none-source-destination-both-tylko-Unix">transparent = none | source | destination | both (tylko Unix)</dt>
@@ -1145,38 +1339,38 @@
 <dt id="none">none</dt>
 <dd>
 
-Zablokuj wsparcie dla przezroczystago proxy. Jest to warto&#x15B;&#x107; domy&#x15B;lna.
+Zablokuj wsparcie dla przezroczystego proxy. Jest to warto&#x15B;&#x107; domy&#x15B;lna.
 
 </dd>
 <dt id="source">source</dt>
 <dd>
 
-Przepisz adres, aby nawi&#x105;zywane po&#x142;&#x105;czenie wydawa&#x142;o si&#x119; pochodzi&#x107; bezpo&#x15B;rednio od klienta, a nie od programu stunnel.
+Przepisz adres, aby nawi&#x105;zywane poł&#x105;czenie wydawało si&#x119; pochodzi&#x107; bezpo&#x15B;rednio od klienta, a nie od programu stunnel.
 
-Opcja jest aktualnie obs&#x142;ugiwana w:
+Opcja jest aktualnie obsługiwana w:
 
 <dl>
 
 <dt id="Trybie-zdalnym-opcja-connect-w-systemie-Linux-2.6.28">Trybie zdalnym (opcja connect) w systemie Linux &gt;=2.6.28</dt>
 <dd>
 
-Konfiguracja wymaga nast&#x119;puj&#x105;cych ustawie&#x144; iptables oraz routingu (na przyk&#x142;ad w pliku /etc/rc.local lub analogicznym):
+Konfiguracja wymaga nast&#x119;puj&#x105;cych ustawie&#x144; iptables oraz routingu (na przykład w pliku /etc/rc.local lub analogicznym):
 
-<pre><code> iptables -t mangle -N DIVERT
- iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT
- iptables -t mangle -A DIVERT -j MARK --set-mark 1
- iptables -t mangle -A DIVERT -j ACCEPT
- ip rule add fwmark 1 lookup 100
- ip route add local 0.0.0.0/0 dev lo table 100
- echo 0 &gt;/proc/sys/net/ipv4/conf/lo/rp_filter</code></pre>
+<pre><code>iptables -t mangle -N DIVERT
+iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT
+iptables -t mangle -A DIVERT -j MARK --set-mark 1
+iptables -t mangle -A DIVERT -j ACCEPT
+ip rule add fwmark 1 lookup 100
+ip route add local 0.0.0.0/0 dev lo table 100
+echo 0 &gt;/proc/sys/net/ipv4/conf/lo/rp_filter</code></pre>
 
-Konfiguracja ta wymaga, aby stunnel by&#x142; wykonywany jako root i bez opcji setuid.
+Konfiguracja ta wymaga, aby stunnel był wykonywany jako root i bez opcji setuid.
 
 </dd>
 <dt id="Trybie-zdalnym-opcja-connect-w-systemie-Linux-2.2.x">Trybie zdalnym (opcja connect) w systemie Linux 2.2.x</dt>
 <dd>
 
-Konfiguracja ta wymaga skompilowania j&#x105;dra z opcj&#x105; transparent proxy. Docelowa us&#x142;uga musi by&#x107; umieszczona na osobnej maszynie, do kt&oacute;rej routing kierowany jest poprzez serwer stunnela.
+Konfiguracja ta wymaga skompilowania j&#x105;dra z opcj&#x105; transparent proxy. Docelowa usługa musi by&#x107; umieszczona na osobnej maszynie, do kt&oacute;rej routing kierowany jest poprzez serwer stunnela.
 
 Dodatkowo stunnel powinien by&#x107; wykonywany jako root i bez opcji setuid.
 
@@ -1190,7 +1384,7 @@
 <dt id="Trybie-lokalnym-opcja-exec">Trybie lokalnym (opcja exec)</dt>
 <dd>
 
-Konfiguracja ta jest realizowana przy pomocy biblioteki libstunnel.so. Do za&#x142;adowania biblioteki wykorzystywana jest zmienna &#x15B;rodowiskowa _RLD_LIST na platformie Tru64 lub LD_PRELOAD na innych platformach.
+Konfiguracja ta jest realizowana przy pomocy biblioteki libstunnel.so. Do załadowania biblioteki wykorzystywana jest zmienna &#x15B;rodowiskowa _RLD_LIST na platformie Tru64 lub LD_PRELOAD na innych platformach.
 
 </dd>
 </dl>
@@ -1201,52 +1395,52 @@
 
 Oryginalny adres docelowy jest u&#x17C;ywany zamiast opcji connect.
 
-Przyk&#x142;adowana konfiguracja przezroczystego adresu docelowego:
+Przykładowa konfiguracja przezroczystego adresu docelowego:
 
-<pre><code> transparent
- client = yes
- accept = &lt;port_stunnela&gt;
- transparent = destination</code></pre>
+<pre><code>transparent
+client = yes
+accept = &lt;port_stunnela&gt;
+transparent = destination</code></pre>
 
-Konfiguracja wymaga ustawie&#x144; iptables, na przyk&#x142;ad w pliku /etc/rc.local lub analogicznym.
+Konfiguracja wymaga ustawie&#x144; iptables, na przykład w pliku /etc/rc.local lub analogicznym.
 
-W przypadku docelowej us&#x142;ugi umieszczonej na tej samej maszynie:
+W przypadku docelowej usługi umieszczonej na tej samej maszynie:
 
-<pre><code> /sbin/iptables -t nat -I OUTPUT -p tcp --dport &lt;port_przekierowany&gt; \
- -m ! --uid-owner &lt;identyfikator_u&#x17C;ytkownika_stunnela&gt; \
- -j DNAT --to-destination &lt;lokalne_ip&gt;:&lt;lokalny_port&gt;</code></pre>
+<pre><code>/sbin/iptables -t nat -I OUTPUT -p tcp --dport &lt;port_przekierowany&gt; \
+ -m ! --uid-owner &lt;identyfikator_u&#x17C;ytkownika_stunnela&gt; \
+ -j DNAT --to-destination &lt;lokalne_ip&gt;:&lt;lokalny_port&gt;</code></pre>
 
-W przypadku docelowej us&#x142;ugi umieszczonej na zdalnej maszynie:
+W przypadku docelowej usługi umieszczonej na zdalnej maszynie:
 
-<pre><code> /sbin/iptables -I INPUT -i eth0 -p tcp --dport &lt;port_stunnela&gt; -j ACCEPT
- /sbin/iptables -t nat -I PREROUTING -p tcp --dport &lt;port_przekierowany&gt; \
- -i eth0 -j DNAT --to-destination &lt;lokalne_ip&gt;:&lt;port_stunnela&gt;</code></pre>
+<pre><code>/sbin/iptables -I INPUT -i eth0 -p tcp --dport &lt;port_stunnela&gt; -j ACCEPT
+/sbin/iptables -t nat -I PREROUTING -p tcp --dport &lt;port_przekierowany&gt; \
+ -i eth0 -j DNAT --to-destination &lt;lokalne_ip&gt;:&lt;port_stunnela&gt;</code></pre>
 
-Przezroczysty adres docelowy jest aktualnie wspierany wy&#x142;&#x105;cznie w systemie Linux.
+Przezroczysty adres docelowy jest aktualnie wspierany wył&#x105;cznie w systemie Linux.
 
 </dd>
 <dt id="both">both</dt>
 <dd>
 
-U&#x17C;yj przezroczystego proxy zar&oacute;wno dla adresu &#x17A;r&oacute;d&#x142;owego jak i docelowego.
+U&#x17C;yj przezroczystego proxy zar&oacute;wno dla adresu &#x17A;r&oacute;dłowego jak i docelowego.
 
 </dd>
 </dl>
 
-Dla zapewnienia kompatybilno&#x15B;ci z wcze&#x15B;niejszymim wersjami wspierane s&#x105; dwie dodatkowe opcje:
+Dla zapewnienia kompatybilno&#x15B;ci z wcze&#x15B;niejszymi wersjami wspierane s&#x105; dwie dodatkowe opcje:
 
 <dl>
 
 <dt id="yes">yes</dt>
 <dd>
 
-Opcja zosta&#x142;a przemianowana na source.
+Opcja została przemianowana na source.
 
 </dd>
 <dt id="no">no</dt>
 <dd>
 
-Opcja zosta&#x142;a przemianowana na none.
+Opcja została przemianowana na none.
 
 </dd>
 </dl>
@@ -1255,40 +1449,40 @@
 <dt id="verify-POZIOM">verify = POZIOM</dt>
 <dd>
 
-weryfikuj certyfikat drugiej strony po&#x142;&#x105;czenia
+weryfikuj certyfikat drugiej strony poł&#x105;czenia
 
-Opcja ta jest przestarza&#x142;a i nale&#x17C;y j&#x105; zast&#x105;pi&#x107; przez opcje verifyChain i verifyPeer.
+Opcja ta jest przestarzała i nale&#x17C;y j&#x105; zast&#x105;pi&#x107; przez opcje verifyChain i verifyPeer.
 
 <dl>
 
-<dt id="poziom-0">poziom 0</dt>
+<dt id="poziom-01">poziom 0</dt>
 <dd>
 
 zarz&#x105;daj certyfikatu i zignoruj go
 
 </dd>
-<dt id="poziom-1">poziom 1</dt>
+<dt id="poziom-11">poziom 1</dt>
 <dd>
 
-weryfikuj, je&#x17C;eli zosta&#x142; przedstawiony
+weryfikuj, je&#x17C;eli został przedstawiony
 
 </dd>
-<dt id="poziom-2">poziom 2</dt>
+<dt id="poziom-21">poziom 2</dt>
 <dd>
 
 weryfikuj z zainstalowanym certyfikatem Centrum Certyfikacji
 
 </dd>
-<dt id="poziom-3">poziom 3</dt>
+<dt id="poziom-31">poziom 3</dt>
 <dd>
 
 weryfikuj z lokalnie zainstalowanym certyfikatem drugiej strony
 
 </dd>
-<dt id="poziom-4">poziom 4</dt>
+<dt id="poziom-41">poziom 4</dt>
 <dd>
 
-weryfikuj z certyfikatem drugiej strony ignoruj&#x105;c &#x142;a&#x144;cuch CA
+weryfikuj z certyfikatem drugiej strony ignoruj&#x105;c ła&#x144;cuch CA
 
 </dd>
 <dt id="domylnie">domy&#x15B;lnie</dt>
@@ -1303,11 +1497,11 @@
 <dt id="verifyChain-yes-no">verifyChain = yes | no</dt>
 <dd>
 
-weryfikuj &#x142;a&#x144;cuch certyfikat&oacute;w drugiej strony
+weryfikuj ła&#x144;cuch certyfikat&oacute;w drugiej strony
 
 Do weryfikacji certyfikatu serwera kluczowe jest, aby wymaga&#x107; r&oacute;wnie&#x17C; konkretnego certyfikatu przy pomocy checkHost lub checkIP.
 
-Samopodpisany certyfikat g&#x142;&oacute;wnego CA nale&#x17C;y umie&#x15B;ci&#x107; albo w pliku podanym w opcji CAfile, albo w katalogu podanym w opcji CApath.
+Samopodpisany certyfikat gł&oacute;wnego CA nale&#x17C;y umie&#x15B;ci&#x107; albo w pliku podanym w opcji CAfile, albo w katalogu podanym w opcji CApath.
 
 domy&#x15B;lnie: no
 
@@ -1326,20 +1520,20 @@
 
 <a href="#_podtop_"><h1 id="ZWRACANA-WARTO">ZWRACANA WARTO&#x15A;&#x106;</h1></a>
 
-stunnel zwraca zero w przypadku sukcesu, lub warto&#x15B;&#x107; niezerow&#x105; w przypadku b&#x142;&#x119;du.
+stunnel zwraca zero w przypadku sukcesu, lub warto&#x15B;&#x107; niezerow&#x105; w przypadku bł&#x119;du.
 
 <a href="#_podtop_"><h1 id="SIGNAY">SIGNA&#x141;Y</h1></a>
 
-Nast&#x119;puj&#x105;ce sygna&#x142;y mog&#x105; by&#x107; u&#x17C;yte do sterowania programem w systemie Unix:
+Nast&#x119;puj&#x105;ce sygnały mog&#x105; by&#x107; u&#x17C;yte do sterowania programem w systemie Unix:
 
 <dl>
 
 <dt id="SIGHUP">SIGHUP</dt>
 <dd>
 
-Za&#x142;aduj ponownie plik konfiguracyjny.
+Załaduj ponownie plik konfiguracyjny.
 
-Niekt&oacute;re globalne opcje nie b&#x119;d&#x105; prze&#x142;adowane:
+Niekt&oacute;re globalne opcje nie b&#x119;d&#x105; przeładowane:
 
 <ul>
 
@@ -1360,9 +1554,9 @@
 </li>
 </ul>
 
-Je&#x17C;eli wykorzystywana jest opcja &#39;setuid&#39; stunnel nie b&#x119;dzie m&oacute;g&#x142; za&#x142;adowa&#x107; ponownie konfiguracji wykorzystuj&#x105;cej uprzywilejowane (&lt;1024) porty.
+Je&#x17C;eli wykorzystywana jest opcja &#39;setuid&#39; stunnel nie b&#x119;dzie m&oacute;gł załadowa&#x107; ponownie konfiguracji wykorzystuj&#x105;cej uprzywilejowane (&lt;1024) porty.
 
-Je&#x17C;eli wykorzystywana jest opcja &#39;chroot&#39; stunnel b&#x119;dzie szuka&#x142; wszystkich potrzebnych plik&oacute;w (&#x142;&#x105;cznie z plikiem konfiguracyjnym, certyfikatami, logiem i plikiem pid) wewn&#x105;trz katalogu wskazanego przez &#39;chroot&#39;.
+Je&#x17C;eli wykorzystywana jest opcja &#39;chroot&#39; stunnel b&#x119;dzie szukał wszystkich potrzebnych plik&oacute;w (ł&#x105;cznie z plikiem konfiguracyjnym, certyfikatami, logiem i plikiem pid) wewn&#x105;trz katalogu wskazanego przez &#39;chroot&#39;.
 
 </dd>
 <dt id="SIGUSR1">SIGUSR1</dt>
@@ -1371,166 +1565,172 @@
 Zamknij i otw&oacute;rz ponownie log. Funkcja ta mo&#x17C;e zosta&#x107; u&#x17C;yta w skrypcie rotuj&#x105;cym log programu stunnel.
 
 </dd>
+<dt id="SIGUSR2">SIGUSR2</dt>
+<dd>
+
+Zapisz w logu list&#x119; aktywnych poł&#x105;cze&#x144;.
+
+</dd>
 <dt id="SIGTERM-SIGQUIT-SIGINT">SIGTERM, SIGQUIT, SIGINT</dt>
 <dd>
 
-Zako&#x144;cz dzia&#x142;anie programu.
+Zako&#x144;cz działanie programu.
 
 </dd>
 </dl>
 
-Skutek wys&#x142;ania innych sygna&#x142;&oacute;w jest niezdefiniowany.
+Skutek wysłania innych sygnał&oacute;w jest niezdefiniowany.
 
 <a href="#_podtop_"><h1 id="PRZYKADY">PRZYK&#x141;ADY</h1></a>
 
-Szyfrowanie po&#x142;&#x105;cze&#x144; do lokalnego serwera imapd mo&#x17C;na u&#x17C;y&#x107;:
+Szyfrowanie poł&#x105;cze&#x144; do lokalnego serwera imapd mo&#x17C;na u&#x17C;y&#x107;:
 
-<pre><code> imapd
- accept = 993
- exec = /usr/sbin/imapd
- execArgs = imapd</code></pre>
+<pre><code>imapd
+accept = 993
+exec = /usr/sbin/imapd
+execArgs = imapd</code></pre>
 
 albo w trybie zdalnym:
 
-<pre><code> imapd
- accept = 993
- connect = 143</code></pre>
+<pre><code>imapd
+accept = 993
+connect = 143</code></pre>
 
 Aby umo&#x17C;liwi&#x107; lokalnemu klientowi poczty elektronicznej korzystanie z serwera imapd przez TLS nale&#x17C;y skonfigurowa&#x107; pobieranie poczty z adresu localhost i portu 119, oraz u&#x17C;y&#x107; nast&#x119;puj&#x105;cej konfiguracji:
 
-<pre><code> imap
- client = yes
- accept = 143
- connect = serwer:993</code></pre>
+<pre><code>imap
+client = yes
+accept = 143
+connect = serwer:993</code></pre>
 
-W po&#x142;&#x105;czeniu z programem pppd stunnel pozwala zestawi&#x107; prosty VPN. Po stronie serwera nas&#x142;uchuj&#x105;cego na porcie 2020 jego konfiguracja mo&#x17C;e wygl&#x105;da&#x107; nast&#x119;puj&#x105;co:
+W poł&#x105;czeniu z programem pppd stunnel pozwala zestawi&#x107; prosty VPN. Po stronie serwera nasłuchuj&#x105;cego na porcie 2020 jego konfiguracja mo&#x17C;e wygl&#x105;da&#x107; nast&#x119;puj&#x105;co:
 
-<pre><code> vpn
- accept = 2020
- exec = /usr/sbin/pppd
- execArgs = pppd local
- pty = yes</code></pre>
+<pre><code>vpn
+accept = 2020
+exec = /usr/sbin/pppd
+execArgs = pppd local
+pty = yes</code></pre>
 
-Poni&#x17C;szy plik konfiguracyjny mo&#x17C;e by&#x107; wykorzystany do uruchomienia programu stunnel w trybie inetd. Warto zauwa&#x17C;y&#x107;, &#x17C;e w pliku konfiguracyjnym nie ma sekcji nazwa_us&#x142;ugi.
+Poni&#x17C;szy plik konfiguracyjny mo&#x17C;e by&#x107; wykorzystany do uruchomienia programu stunnel w trybie inetd. Warto zauwa&#x17C;y&#x107;, &#x17C;e w pliku konfiguracyjnym nie ma sekcji nazwa_usługi.
 
-<pre><code> exec = /usr/sbin/imapd
- execArgs = imapd</code></pre>
+<pre><code>exec = /usr/sbin/imapd
+execArgs = imapd</code></pre>
 
 Aby skonfigurowa&#x107; VPN mo&#x17C;na u&#x17C;y&#x107; nast&#x119;puj&#x105;cej konfiguracji klienta:
 
-<pre><code> socks_client
- client = yes
- accept = 127.0.0.1:1080
- connect = vpn_server:9080
- verifyPeer = yes
- CAfile = stunnel.pem</code></pre>
+<pre><code>socks_client
+client = yes
+accept = 127.0.0.1:1080
+connect = vpn_server:9080
+verifyPeer = yes
+CAfile = stunnel.pem</code></pre>
 
 Odpowiadaj&#x105;ca jej konfiguracja serwera vpn_server:
 
-<pre><code> socks_server
- protocol = socks
- accept = 9080
- cert = stunnel.pem
- key = stunnel.key</code></pre>
+<pre><code>socks_server
+protocol = socks
+accept = 9080
+cert = stunnel.pem
+key = stunnel.key</code></pre>
 
 Do przetestowania konfiguracji mo&#x17C;na wyda&#x107; na maszynie klienckiej komend&#x119;:
 
-<pre><code> curl --socks4a localhost http://www.example.com/</code></pre>
+<pre><code>curl --socks4a localhost http://www.example.com/</code></pre>
+
+Przykładowa konfiguracja serwera SNI:
 
-Przyk&#x142;adowa konfiguracja serwera SNI:
+<pre><code>virtual
+; usługa nadrz&#x119;dna
+accept = 443
+cert = default.pem
+connect = default.internal.mydomain.com:8080
 
-<pre><code> virtual
- ; us&#x142;uga nadrz&#x119;dna
- accept = 443
- cert = default.pem
- connect = default.internal.mydomain.com:8080
+sni1
+; usługa podrz&#x119;dna 1
+sni = virtual:server1.mydomain.com
+cert = server1.pem
+connect = server1.internal.mydomain.com:8081
 
- sni1
- ; us&#x142;uga podrz&#x119;dna 1
- sni = virtual:server1.mydomain.com
- cert = server1.pem
- connect = server1.internal.mydomain.com:8081
+sni2
+; usługa podrz&#x119;dna 2
+sni = virtual:server2.mydomain.com
+cert = server2.pem
+connect = server2.internal.mydomain.com:8082
+verifyPeer = yes
+CAfile = server2-allowed-clients.pem</code></pre>
 
- sni2
- ; us&#x142;uga podrz&#x119;dna 2
- sni = virtual:server2.mydomain.com
- cert = server2.pem
- connect = server2.internal.mydomain.com:8082
- verifyPeer = yes
- CAfile = server2-allowed-clients.pem</code></pre>
+Przykładowa konfiguracja umo&#x17C;liwiaj&#x105;ca uwierzytelnienie z u&#x17C;yciem klucza prywatnego przechowywanego w Windows Certificate Store (tylko Windows):
 
-Przyk&#x142;adowa konfiguracja umo&#x17C;liwiaj&#x105;ca uwierzytelnienie z u&#x17C;yciem klucza prywatnego przechowywanego w Windows Certificate Store (tylko Windows). W przypadku u&#x17C;ycia silnika CAPI, nie nale&#x17C;y ustawia&#x107; opcji cert, gdy&#x17C; klucz klienta zostanie automatycznie pobrany z Certificate Store na podstawie zaufanych certyfikat&oacute;w CA przedstawionych przez serwer.
+<pre><code>engine = capi
 
-<pre><code> engine = capi
+service
+engineId = capi
+client = yes
+accept = 127.0.0.1:8080
+connect = example.com:8443</code></pre>
 
- service
- engineId = capi
- client = yes
- accept = 127.0.0.1:8080
- connect = example.com:8443</code></pre>
+W przypadku u&#x17C;ycia silnika CAPI, nie nale&#x17C;y ustawia&#x107; opcji cert, gdy&#x17C; klucz klienta zostanie automatycznie pobrany z Certificate Store na podstawie zaufanych certyfikat&oacute;w CA przedstawionych przez serwer.
 
-Przyk&#x142;adowa konfiguracja umo&#x17C;liwiaj&#x105;ca u&#x17C;ycie certyfikatu i klucza prywatnego z urz&#x105;dzenia zgodnego z pkcs11:
+Przykładowa konfiguracja umo&#x17C;liwiaj&#x105;ca u&#x17C;ycie certyfikatu i klucza prywatnego z urz&#x105;dzenia obsługiwanego przez silnik pkcs11:
 
-<pre><code> engine = pkcs11
- engineCtrl = MODULE_PATH:opensc-pkcs11.so
- engineCtrl = PIN:123456
+<pre><code>engine = pkcs11
+engineCtrl = MODULE_PATH:opensc-pkcs11.so
+engineCtrl = PIN:123456
 
- service
- engineId = pkcs11
- client = yes
- accept = 127.0.0.1:8080
- connect = example.com:843
- cert = pkcs11:token=MyToken;object=MyCert
- key = pkcs11:token=MyToken;object=MyKey</code></pre>
+service
+engineId = pkcs11
+client = yes
+accept = 127.0.0.1:8080
+connect = example.com:843
+cert = pkcs11:token=MyToken;object=MyCert
+key = pkcs11:token=MyToken;object=MyKey</code></pre>
 
-Przyk&#x142;adowa konfiguracja umo&#x17C;liwiaj&#x105;ca u&#x17C;ycie certyfikatu i klucza prywatnego umieszczonego na tokenie SoftHSM
+Przykładowa konfiguracja umo&#x17C;liwiaj&#x105;ca u&#x17C;ycie certyfikatu i klucza prywatnego umieszczonego na tokenie SoftHSM:
 
-<pre><code> engine = pkcs11
- engineCtrl = MODULE_PATH:softhsm2.dll
- engineCtrl = PIN:12345
+<pre><code>engine = pkcs11
+engineCtrl = MODULE_PATH:softhsm2.dll
+engineCtrl = PIN:12345
 
- service
- engineId = pkcs11
- client = yes
- accept = 127.0.0.1:8080
- connect = example.com:843
- cert = pkcs11:token=MyToken;object=KeyCert</code></pre>
+service
+engineId = pkcs11
+client = yes
+accept = 127.0.0.1:8080
+connect = example.com:843
+cert = pkcs11:token=MyToken;object=KeyCert</code></pre>
 
 <a href="#_podtop_"><h1 id="NOTKI">NOTKI</h1></a>
 
 <h2 id="OGRANICZENIA">OGRANICZENIA</h2>
 
-stunnel nie mo&#x17C;e by&#x107; u&#x17C;ywany do szyfrowania protoko&#x142;u FTP, poniewa&#x17C; do przesy&#x142;ania poszczeg&oacute;lnych plik&oacute;w u&#x17C;ywa on dodatkowych po&#x142;&#x105;cze&#x144; otwieranych na portach o dynamicznie przydzielanych numerach. Istniej&#x105; jednak specjalne wersje klient&oacute;w i serwer&oacute;w FTP pozwalaj&#x105;ce na szyfrowanie przesy&#x142;anych danych przy pomocy protoko&#x142;u TLS.
+stunnel nie mo&#x17C;e by&#x107; u&#x17C;ywany do szyfrowania protokołu FTP, poniewa&#x17C; do przesyłania poszczeg&oacute;lnych plik&oacute;w u&#x17C;ywa on dodatkowych poł&#x105;cze&#x144; otwieranych na portach o dynamicznie przydzielanych numerach. Istniej&#x105; jednak specjalne wersje klient&oacute;w i serwer&oacute;w FTP pozwalaj&#x105;ce na szyfrowanie przesyłanych danych przy pomocy protokołu TLS.
 
 <h2 id="TRYB-INETD-tylko-Unix">TRYB INETD (tylko Unix)</h2>
 
-W wi&#x119;kszo&#x15B;ci zastosowa&#x144; stunnel samodzielnie nas&#x142;uchuje na porcie podanym w pliku konfiguracyjnym i tworzy po&#x142;&#x105;czenie z innym portem podanym w opcji connect lub nowym programem podanym w opcji exec. Niekt&oacute;rzy wol&#x105; jednak wykorzystywa&#x107; oddzielny program, kt&oacute;ry odbiera po&#x142;&#x105;czenia, po czym uruchamia program stunnel. Przyk&#x142;adami takich program&oacute;w s&#x105; inetd, xinetd i tcpserver.
+W wi&#x119;kszo&#x15B;ci zastosowa&#x144; stunnel samodzielnie nasłuchuje na porcie podanym w pliku konfiguracyjnym i tworzy poł&#x105;czenie z innym portem podanym w opcji connect lub nowym programem podanym w opcji exec. Niekt&oacute;rzy wol&#x105; jednak wykorzystywa&#x107; oddzielny program, kt&oacute;ry odbiera poł&#x105;czenia, po czym uruchamia program stunnel. Przykładami takich program&oacute;w s&#x105; inetd, xinetd i tcpserver.
 
-Przyk&#x142;adowa linia pliku /etc/inetd.conf mo&#x17C;e wygl&#x105;da&#x107; tak:
+Przykładowa linia pliku /etc/inetd.conf mo&#x17C;e wygl&#x105;da&#x107; tak:
 
-<pre><code> imaps stream tcp nowait root @bindir@/stunnel
- stunnel @sysconfdir@/stunnel/imaps.conf</code></pre>
+<pre><code>imaps stream tcp nowait root @bindir@/stunnel
+ stunnel @sysconfdir@/stunnel/imaps.conf</code></pre>
 
-Poniewa&#x17C; w takich przypadkach po&#x142;&#x105;czenie na zdefiniowanym porcie (tutaj imaps) nawi&#x105;zuje osobny program (tutaj inetd), stunnel nie mo&#x17C;e u&#x17C;ywa&#x107; opcji accept. W pliku konfiguracyjnym nie mo&#x17C;e by&#x107; r&oacute;wnie&#x17C; zdefiniowana &#x17C;adna us&#x142;uga (nazwa_us&#x142;ugi), poniewa&#x17C; konfiguracja taka pozwala na nawi&#x105;zanie tylko jednego po&#x142;&#x105;czenia. Wszystkie OPCJE US&#x141;UG powinny by&#x107; umieszczone razem z opcjami globalnymi. Przyk&#x142;ad takiej konfiguracji znajduje si&#x119; w sekcji PRZYK&#x141;ADY.
+Poniewa&#x17C; w takich przypadkach poł&#x105;czenie na zdefiniowanym porcie (tutaj imaps) nawi&#x105;zuje osobny program (tutaj inetd), stunnel nie mo&#x17C;e u&#x17C;ywa&#x107; opcji accept. W pliku konfiguracyjnym nie mo&#x17C;e by&#x107; r&oacute;wnie&#x17C; zdefiniowana &#x17C;adna usługa (nazwa_usługi), poniewa&#x17C; konfiguracja taka pozwala na nawi&#x105;zanie tylko jednego poł&#x105;czenia. Wszystkie OPCJE US&#x141;UG powinny by&#x107; umieszczone razem z opcjami globalnymi. Przykład takiej konfiguracji znajduje si&#x119; w sekcji PRZYK&#x141;ADY.
 
 <h2 id="CERTYFIKATY">CERTYFIKATY</h2>
 
-Protok&oacute;&#x142; TLS wymaga, aby ka&#x17C;dy serwer przedstawia&#x142; si&#x119; nawi&#x105;zuj&#x105;cemu po&#x142;&#x105;czenie klientowi prawid&#x142;owym certyfikatem X.509. Potwierdzenie to&#x17C;samo&#x15B;ci serwera polega na wykazaniu, &#x17C;e posiada on odpowiadaj&#x105;cy certyfikatowi klucz prywatny. Najprostsz&#x105; metod&#x105; uzyskania certyfikatu jest wygenerowanie go przy pomocy wolnego pakietu OpenSSL. Wi&#x119;cej informacji na temat generowania certyfikat&oacute;w mo&#x17C;na znale&#x17A;&#x107; na umieszczonych poni&#x17C;ej stronach.
+Protok&oacute;ł TLS wymaga, aby ka&#x17C;dy serwer przedstawiał si&#x119; nawi&#x105;zuj&#x105;cemu poł&#x105;czenie klientowi prawidłowym certyfikatem X.509. Potwierdzenie to&#x17C;samo&#x15B;ci serwera polega na wykazaniu, &#x17C;e posiada on odpowiadaj&#x105;cy certyfikatowi klucz prywatny. Najprostsz&#x105; metod&#x105; uzyskania certyfikatu jest wygenerowanie go przy pomocy wolnego pakietu OpenSSL. Wi&#x119;cej informacji na temat generowania certyfikat&oacute;w mo&#x17C;na znale&#x17A;&#x107; na umieszczonych poni&#x17C;ej stronach.
 
-Istotn&#x105; kwesti&#x105; jest kolejno&#x15B;&#x107; zawarto&#x15B;ci pliku .pem. W pierwszej kolejno&#x15B;ci powinien on zawiera&#x107; klucz prywatny, a dopiero za nim podpisany certyfikat (nie &#x17C;&#x105;danie certyfikatu). Po certyfikacie i kluczu prywatnym powinny znajdowa&#x107; si&#x119; puste linie. Je&#x17C;eli przed certyfikatem znajduj&#x105; si&#x119; dodatkowe informacje tekstowe, to powinny one zosta&#x107; usuni&#x119;te. Otrzymany plik powinien mie&#x107; nast&#x119;puj&#x105;c&#x105; posta&#x107;:
+Plik .pem powinien zawiera&#x107; klucz prywatny oraz podpisany certyfikat (nie &#x17C;&#x105;danie certyfikatu). Otrzymany plik powinien mie&#x107; nast&#x119;puj&#x105;c&#x105; posta&#x107;:
 
-<pre><code> -----BEGIN RSA PRIVATE KEY-----
- zakodowany klucz
- -----END RSA PRIVATE KEY-----
- pusta linia
- -----BEGIN CERTIFICATE-----
- zakodowany certyfikat
- -----END CERTIFICATE-----
- pusta linia</code></pre>
+<pre><code>-----BEGIN RSA PRIVATE KEY-----
+zakodowany klucz
+-----END RSA PRIVATE KEY-----
+-----BEGIN CERTIFICATE-----
+zakodowany certyfikat
+-----END CERTIFICATE-----</code></pre>
 
 <h2 id="LOSOWO">LOSOWO&#x15A;&#x106;</h2>
 
-stunnel potrzebuje zainicjowa&#x107; PRNG (generator liczb pseudolosowych), gdy&#x17C; protok&oacute;&#x142; TLS wymaga do bezpiecze&#x144;stwa kryptograficznego &#x17A;r&oacute;d&#x142;a dobrej losowo&#x15B;ci. Nast&#x119;puj&#x105;ce &#x17A;r&oacute;d&#x142;a s&#x105; kolejno odczytywane a&#x17C; do uzyskania wystarczaj&#x105;cej ilo&#x15B;ci entropii:
+stunnel potrzebuje zainicjowa&#x107; PRNG (generator liczb pseudolosowych), gdy&#x17C; protok&oacute;ł TLS wymaga do bezpiecze&#x144;stwa kryptograficznego &#x17A;r&oacute;dła dobrej losowo&#x15B;ci. Nast&#x119;puj&#x105;ce &#x17A;r&oacute;dła s&#x105; kolejno odczytywane a&#x17C; do uzyskania wystarczaj&#x105;cej ilo&#x15B;ci entropii:
 
 <ul>
 
@@ -1549,7 +1749,7 @@
 <li>Zawarto&#x15B;&#x107; ekranu w systemie Windows.
 
 </li>
-<li>Gniazdo egd, je&#x17C;eli u&#x17C;yta zosta&#x142;a opcja EGD.
+<li>Gniazdo egd, je&#x17C;eli u&#x17C;yta została opcja EGD.
 
 </li>
 <li>Gniazdo egd podane w opcji &#39;--with-egd-socket&#39; w czasie konfiguracji programu.
@@ -1562,17 +1762,17 @@
 
 Warto zwr&oacute;ci&#x107; uwag&#x119;, &#x17C;e na maszynach z systemem Windows, na kt&oacute;rych konsoli nie pracuje u&#x17C;ytkownik, zawarto&#x15B;&#x107; ekranu nie jest wystarczaj&#x105;co zmienna, aby zainicjowa&#x107; PRNG. W takim przypadku do zainicjowania generatora nale&#x17C;y u&#x17C;y&#x107; opcji RNDfile.
 
-Plik RNDfile powinien zawiera&#x107; dane losowe -- r&oacute;wnie&#x17C; w tym sensie, &#x17C;e powinny by&#x107; one inne przy ka&#x17C;dym uruchomieniu programu stunnel. O ile nie u&#x17C;yta zosta&#x142;a opcja RNDoverwrite jest to robione automatycznie. Do r&#x119;cznego uzyskania takiego pliku u&#x17C;yteczna mo&#x17C;e by&#x107; komenda openssl rand dostarczana ze wsp&oacute;&#x142;czesnymi wersjami pakietu OpenSSL.
+Plik RNDfile powinien zawiera&#x107; dane losowe -- r&oacute;wnie&#x17C; w tym sensie, &#x17C;e powinny by&#x107; one inne przy ka&#x17C;dym uruchomieniu programu stunnel. O ile nie u&#x17C;yta została opcja RNDoverwrite jest to robione automatycznie. Do r&#x119;cznego uzyskania takiego pliku u&#x17C;yteczna mo&#x17C;e by&#x107; komenda openssl rand dostarczana ze wsp&oacute;łczesnymi wersjami pakietu OpenSSL.
 
-Jeszcze jedna istotna informacja -- je&#x17C;eli dost&#x119;pne jest urz&#x105;dzenie /dev/urandom biblioteka OpenSSL ma zwyczaj zasilania nim PRNG w trakcie sprawdzania stanu generatora. W systemach z /dev/urandom urz&#x105;dzenie to b&#x119;dzie najprawdopodobniej u&#x17C;yte, pomimo &#x17C;e znajduje si&#x119; na samym ko&#x144;cu powy&#x17C;szej listy. Jest to w&#x142;a&#x15B;ciwo&#x15B;&#x107; biblioteki OpenSSL, a nie programu stunnel.
+Jeszcze jedna istotna informacja -- je&#x17C;eli dost&#x119;pne jest urz&#x105;dzenie /dev/urandom biblioteka OpenSSL ma zwyczaj zasilania nim PRNG w trakcie sprawdzania stanu generatora. W systemach z /dev/urandom urz&#x105;dzenie to b&#x119;dzie najprawdopodobniej u&#x17C;yte, pomimo &#x17C;e znajduje si&#x119; na samym ko&#x144;cu powy&#x17C;szej listy. Jest to wła&#x15B;ciwo&#x15B;&#x107; biblioteki OpenSSL, a nie programu stunnel.
 
 <h2 id="PARAMETRY-DH">PARAMETRY DH</h2>
 
-Pocz&#x105;wszy od wersji 4.40 stunnel zawiera w kodzie programu 2048-bitowe parametry DH. Od wersji 5.18 te pocz&#x105;tkowe warto&#x15B;ci parametr&oacute;w DH s&#x105; wymieniane na autogenerowane parametry tymczasowe. Wygenerowanie parametr&oacute;w DH mo&#x17C;e zaj&#x105;&#x107; nawet wiele minut.
+Pocz&#x105;wszy od wersji 4.40 stunnel zawiera w kodzie programu 2048-bitowe parametry DH. Od wersji 5.18 te pocz&#x105;tkowe warto&#x15B;ci parametr&oacute;w DH s&#x105; wymieniane na automatycznie generowane parametry tymczasowe. Wygenerowanie parametr&oacute;w DH mo&#x17C;e zaj&#x105;&#x107; nawet wiele minut.
 
-Alternatywnie parametry DH mo&#x17C;na umie&#x15B;ci&#x107; w pliku razem z certyfikatem, co wy&#x142;&#x105;cza generowanie parametr&oacute;w tymczasowych:
+Alternatywnie parametry DH mo&#x17C;na umie&#x15B;ci&#x107; w pliku razem z certyfikatem, co wył&#x105;cza generowanie parametr&oacute;w tymczasowych:
 
-<pre><code> openssl dhparam 2048 &gt;&gt; stunnel.pem</code></pre>
+<pre><code>openssl dhparam 2048 &gt;&gt; stunnel.pem</code></pre>
 
 <a href="#_podtop_"><h1 id="PLIKI">PLIKI</h1></a>
 
@@ -1588,7 +1788,7 @@
 
 <a href="#_podtop_"><h1 id="BDY">B&#x141;&#x118;DY</h1></a>
 
-Opcja execArgs oraz linia komend Win32 nie obs&#x142;uguje cytowania.
+Opcja execArgs oraz linia komend Win32 nie obsługuje cytowania.
 
 <a href="#_podtop_"><h1 id="ZOBACZ-RWNIE">ZOBACZ R&Oacute;WNIE&#x17B;</h1></a>
 
@@ -1597,7 +1797,7 @@
 <dt id="tcpd-8"><a href="http://man.he.net/man8/tcpd">tcpd(8)</a></dt>
 <dd>
 
-biblioteka kontroli dost&#x119;pu do us&#x142;ug internetowych
+biblioteka kontroli dost&#x119;pu do usług internetowych
 
 </dd>
 <dt id="inetd-8"><a href="http://man.he.net/man8/inetd">inetd(8)</a></dt>
@@ -1624,7 +1824,7 @@
 
 <dl>
 
-<dt id="Micha-Trojnara">Micha&#x142; Trojnara</dt>
+<dt id="Micha-Trojnara">Michał Trojnara</dt>
 <dd>
 
 &lt;Michal.Trojnara@stunnel.org&gt;

_service:tar_scm:stunnel-5.48.tar.gz/doc/stunnel.pl.pod.in -> _service:tar_scm:stunnel-5.69.tar.gz/doc/stunnel.pl.pod.in Changed

@@ -190,8 +190,14 @@
 emerg (0), alert (1), crit (2), err (3), warning (4), notice (5),
 info (6) lub debug (7).
 Zapisywane są komunikaty o poziomie niższym (numerycznie) lub równym podanemu.
-Do uzyskania najwyższego poziomu szczegółowości można użyć opcji
-I<debug = debug> lub I<debug = 7>. Domyślnym poziomem jest notice (5).
+Domyślnym poziomem jest notice (5).
+
+Jakkolwiek użycie I<debug = debug> lub I<debug = 7> zapewnia najbardziej
+szczegółowe logi, ich zawartość jest użyteczna jedynie dla programistów
+zajmujących się stunnelem. Użyj tego poziomu logowania jedynie jeśli jesteś
+programistką/programistą stunnela, albo przygotowujesz szczegółowe informacje
+celem przesłania do wsparcia technicznego. W przeciwnym wypadku próba analizy
+zawartości logów B<będzie> jedynie źródłem dodatkowego zamieszania.
 
 O ile nie wyspecyfikowano podsystemu użyty będzie domyślny: daemon.
 Podsystemy nie są wspierane przez platformę Win32.
@@ -208,25 +214,25 @@
 
 =item B<engine> = auto | IDENTYFIKATOR_URZĄDZENIA
 
-wybór sprzętowego urządzenia kryptograficznego
+wybór silnika kryptograficznego
 
-domyślnie: bez wykorzystania urządzeń kryptograficznych
+domyślnie: bez wykorzystania silników kryptograficznych
 
 Sekcja PRZYKŁADY zawiera przykładowe konfiguracje wykorzystujące
-urządzenia kryptograficzne.
+silniki kryptograficzne.
 
 =item B<engineCtrl> = KOMENDA:PARAMETR
 
-konfiguracja urządzenia kryptograficznego
+konfiguracja silnika kryptograficznego
 
 =item B<engineDefault> = LISTA_ZADAŃ
 
-lista zadań OpenSSL oddelegowanych do bieżącego urządzenia
+lista zadań OpenSSL oddelegowanych do bieżącego silnika
 
 Parametrem jest lista oddzielonych przecinkami zadań OpenSSL, które mają
-zostać oddelegowane do bieżącego urządzenia kryptograficznego.
+zostać oddelegowane do bieżącego silnika kryptograficznego.
 
-W zależności od konkretnego urządzenia dostępne mogą być następujące zadania:
+W zależności od konkretnego silnika dostępne mogą być następujące zadania:
 ALL, RSA, DSA, ECDH, ECDSA, DH, RAND, CIPHERS, DIGESTS, PKEY, PKEY_CRYPTO,
 PKEY_ASN1.
 
@@ -361,9 +367,20 @@
 
 accept = :::port
 
+=item B<CAengine> = IDENTYFIKATOR_CA_W_ENGINE
+
+ładuje zaufane certyfikaty Centrum certyfikacji z silnika
+
+Opcja pozwala określić położenie pliku zawierającego certyfikaty używane
+przez opcję I<verifyChain> lub I<verifyPeer>.
+
+Opcja może być użyta wielokrotnie w pojedynczej sekcji.
+
+Aktualnie wspierane silniki: pkcs11, cng.
+
 =item B<CApath> = KATALOG_CA
 
-katalog Centrum Certyfikacji
+ładuje zaufane certyfikaty Centrum certyfikacji z katalogu
 
 Opcja określa katalog, w którym B<stunnel> będzie szukał certyfikatów, jeżeli
 użyta została opcja I<verifyChain> lub I<verifyPeer>. Pliki z certyfikatami
@@ -378,7 +395,7 @@
 
 =item B<CAfile> = PLIK_CA
 
-plik Centrum Certyfikacji
+ładuje zaufane certyfikaty Centrum certyfikacji z pliku
 
 Opcja pozwala określić położenie pliku zawierającego certyfikaty używane
 przez opcję I<verifyChain> lub I<verifyPeer>.
@@ -396,7 +413,7 @@
 Certyfikat jest konieczny, aby używać programu w trybie serwera.
 W trybie klienta certyfikat jest opcjonalny.
 
-Jeżeli używane jest sprzętowe urządzenie kryptograficzne, to opcja B<cert>
+Jeżeli używany jest silnik kryptograficzny, to opcja B<cert>
 pozwala wybrać identyfikator używanego certyfikatu.
 
 =item B<checkEmail> = EMAIL
@@ -434,11 +451,23 @@
 
 =item B<ciphers> = LISTA_SZYFRÓW
 
-lista dozwolonych szyfrów TLS
+lista dozwolonych szyfrów dla protokołów SSLv2, SSLv3, TLSv1, TLSv1.1, TLSv1.2
+
+Ta opcja nie wpływa na listę parametrów kryptograficznych dla protokołu TLSv1.3
 
 Parametrem tej opcji jest lista szyfrów, które będą użyte przy
 otwieraniu nowych połączeń TLS, np.: DES-CBC3-SHA:IDEA-CBC-MD5
 
+=item B<ciphersuites> = LISTA_PARAMETRÓW_KRYPTOGRAFICZNYCH
+
+lista dozwolonych parametrów kryptograficznych dla protokołu TLSv1.3
+
+Parametrem tej opcji są listy parametrów kryptograficznych w kolejności ich preferowania.
+
+Opcja I<ciphersuites> jest dostępna począwszy od B<OpenSSL 1.1.1>.
+
+domyślnie: TLS_CHACHA20_POLY1305_SHA256: TLS_AES_256_GCM_SHA384: TLS_AES_128_GCM_SHA256
+
 =item B<client> = yes | no
 
 tryb kliencki (zdalna usługa używa TLS)
@@ -451,12 +480,15 @@
 
 Komenda konfiguracyjna B<OpenSSL> zostaje wykonana z podanym parametrem.
 Pozwala to na wydawanie komend konfiguracyjnych B<OpenSSL> z pliku
-konfiguracyjnego stunnela. Dostępne komendy opisane są w manualu
+konfiguracyjnego stunnela. Dostępne komendy opisane są w podręczniku
 I<SSL_CONF_cmd(3ssl)>.
 
 Możliwe jest wyspecyfikowanie wielu opcji B<OpenSSL> przez wielokrotne użycie
 komendy B<config>.
 
+Zamiast wyłączać I<config = Curves:list_curves>
+użyj opcji I<curves> w celu ustawienia krzywych eliptycznych.
+
 Opcja ta wymaga biblioteki OpenSSL w wersji 1.0.2 lub nowszej.
 
 =item B<connect> = HOST:PORT
@@ -491,15 +523,21 @@
 Opcja pozwala określić położenie pliku zawierającego listy CRL używane
 przez opcje I<verifyChain> i I<verifyPeer>.
 
-=item B<curve> = NID
+=item B<curves> = lista
+
+krzywe ECDH odddzielone ':'
 
-krzywa dla ECDH
+Wersje OpenSSL starsze niż 1.1.1 pozwalają na użycie tylko jednej krzywej.
 
 Listę dostępnych krzywych można uzyskać poleceniem:
 
 openssl ecparam -list_curves
 
-domyślnie: prime256v1
+domyślnie:
+
+ X25519:P-256:X448:P-521:P-384 (począwszy od OpenSSL 1.1.1)
+
+ prime256v1 (OpenSSL starszy niż 1.1.1)
 
 =item B<logId> = TYP
 
@@ -562,15 +600,15 @@
 
 Opóźnione rozwijanie adresu automatycznie aktywuje I<failover = prio>.
 
-default: no
+domyślnie: no
 
 =item B<engineId> = NUMER_URZĄDZENIA
 
-wybierz urządzenie dla usługi
+wybierz silnik kryptograficzny dla usługi
 
 =item B<engineNum> = NUMER_URZĄDZENIA
 
-wybierz urządzenie dla usługi
+wybierz silnik kryptograficzny dla usługi
 
 Urządzenia są numerowane od 1 w górę.
 
@@ -640,8 +678,8 @@
 
 chmod 600 keyfile
 
-Jeżeli używane jest sprzętowe urządzenie kryptograficzne, to opcja B<key>
-pozwala wybrać identyfikator używanego klucza prywatnego.
+Jeżeli używany jest silnik kryptograficzny, to opcja B<key> pozwala wybrać
+identyfikator używanego klucza prywatnego.
 
 domyślnie: wartość opcji I<cert>
 
@@ -709,6 +747,9 @@
 options = NO_SSLv2
 options = NO_SSLv3
 
+Począwszy od B<OpenSSL 1.1.0>, zamiast wyłączać określone wersje protokołów TLS
+użyj opcji I<sslVersionMax> lub I<sslVersionMin>.
+
 =item B<protocol> = PROTOKÓŁ
 
 negocjuj TLS podanym protokołem aplikacyjnym
@@ -724,7 +765,17 @@
 =item I<cifs>
 
 Nieudokumentowane rozszerzenie protokołu CIFS wspierane przez serwer Samba.
-Wsparcie dla tego rozrzeczenia zostało zarzucone w wersji 3.0.0 serwera Samba.
+Wsparcie dla tego rozszerzenia zostało zarzucone w wersji 3.0.0 serwera Samba.
+
+=item I<capwin>
+
+Wsparcie dla aplikacji http://www.capwin.org/
+
+=item I<capwinctrl>
+
+Wsparcie dla aplikacji http://www.capwin.org/
+
+Ten protokół jest wspierany wyłącznie w trybie klienckim.
 
 =item I<connect>
 
@@ -736,6 +787,10 @@
 
 Negocjacja RFC 2595 - I<Using TLS with IMAP, POP3 and ACAP>
 
+=item I<ldap>
+
+Negocjacja RFC 2830 - I<Lightweight Directory Access Protocol (v3): Extension for Transport Layer Security>
+
 =item I<nntp>
 
 Negocjacja RFC 4642 - I<Using Transport Layer Security (TLS) with Network News Transfer Protocol (NNTP)>
@@ -744,7 +799,7 @@
 
 =item I<pgsql>
 
-Negocjacja http://www.postgresql.org/docs/8.3/static/protocol-flow.html#AEN73982
+Negocjacja F<http://www.postgresql.org/docs/8.3/static/protocol-flow.html#AEN73982>
 
 =item I<pop3>
 
@@ -752,7 +807,8 @@
 
 =item I<proxy>
 
-Przekazywanie adresu IP haproxy http://haproxy.1wt.eu/download/1.5/doc/proxy-protocol.txt
+Przekazywanie oryginalnego IP klienta przez protokół HAProxy PROXY w wersji 1
+F<https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt>
 
 =item I<smtp>
 
@@ -792,18 +848,24 @@
 
 domena do negocjacji protokołu
 
-W obecnej wersji wybrana domena ma zastosowanie wyłącznie w protokole 'connect'.
+W obecnej wersji opcja ma zastosowanie wyłącznie w protokole 'connect'.
+
+=item B<protocolHeader> = NAGŁÓWEK
 
-=item B<protocolHost> = HOST:PORT
+nagłówek do negocjacji protokołu
 
-adres docelowy do negocjacji protokołu
+W obecnej wersji opcja ma zastosowanie wyłącznie w protokole 'connect'.
 
-I<protocolHost> określa docelowy serwer TLS, do którego połączyć ma się proxy.
-Nie jest to adres serwera proxy, do którego połączenie zestawia B<stunnel>.
-Adres serwera proxy powinien być określony przy pomocy opcji 'connect'.
+=item B<protocolHost> = ADRES
 
-W obecnej wersji adres docelowy protokołu ma zastosowanie wyłącznie w protokole
-'connect'.
+adres hosta do negocjacji protokołu
+
+Dla protokołu 'connect', I<protocolHost> określa docelowy serwer TLS, do
+którego połączyć ma się proxy. Adres serwera proxy, do którego łączy się
+B<stunnel>, musi być określony przy pomocy opcji I<connect>.
+
+Dla protokołu 'smtp', I<protocolHost> określa wartość HELO/EHLO wysyłanego
+przy negocjacji klienta.
 
 =item B<protocolPassword> = HASŁO
 
@@ -835,12 +897,14 @@
 
 TOŻSAMOŚĆ:KLUCZ
 
-Klucz musi być mieć przynajmniej 20 znaków.
+Szesnastkowe klucze są automatycznie konwertowane do postaci binarnej.
+Klucz musi być mieć przynajmniej 16 bajtów, co w przypadku kluczy
+szesnastkowych przekłada się na przynajmniej 32 znaki.
 Należy ograniczyć dostęp do czytania lub pisania do tego pliku.
 
 =item B<pty> = yes | no (tylko Unix)
 
-alokuj pseudoterminal dla programu uruchamianego w opcji 'exec'
+alokuj pseudo-terminal dla programu uruchamianego w opcji 'exec'
 
 =item B<redirect> = HOST:PORT
 
@@ -860,7 +924,7 @@
 
 http://vincent.bernat.im/en/blog/2011-ssl-dos-mitigation.html
 
-Warto zauważyć, że zablokowanie renegocjacji TLS nie zebezpiecza w pełni
+Warto zauważyć, że zablokowanie renegocjacji TLS nie zabezpiecza w pełni
 przed opisanym problemem.
 
 domyślnie: yes (o ile wspierane przez B<OpenSSL>)
@@ -879,6 +943,44 @@
 
 domyślnie: no
 
+=item B<securityLevel> = POZIOM
+
+ustaw poziom bezpieczeństwa
+
+Znaczenie każdego poziomu opisano poniżej:
+
+=over 4
+
+=item poziom 0
+
+Wszystko jest dozwolone.
+
+=item poziom 1
+
+Poziom bezpieczeństwa zapewniający minimum 80 bitów bezpieczeństwa. Żadne parametry kryptograficzne oferujące poziom bezpieczeństwa poniżej 80 bitów nie mogą zostać użyte. W związku z tym RSA, DSA oraz klucze DH krótsze niż 1024 bity, a także klucze ECC krótsze niż 160 bitów i wszystkie eksportowe zestawy szyfrów są niedozwolone. Użycie SSLv2 jest zabronione. Wszelkie listy parametrów kryptograficznych używające MD5 do MAC są zabronione.
+
+=item poziom 2
+
+Poziom bezpieczeństwa zapewniający 112 bitów bezpieczeństwa. W związku z tym RSA, DSA oraz klucze DH krótsze niż 2048 bitów, a także klucze ECC krótsze niż 224 bity są niedozwolone. Oprócz wyłączeń z poziomu 1 zabronione jest także korzystanie z zestawów szyfrów używających RC4. Użycie SSLv3 jest zabronione. Kompresja jest wyłączona.
+
+=item poziom 3
+
+Poziom bezpieczeństwa zapewniający 128 bitów bezpieczeństwa. W związku z tym RSA, DSA oraz klucze DH krótsze niż 3072 bity, a także klucze ECC krótsze niż 256 bitów są niedozwolone. Oprócz wyłączeń z poziomu 2 zabronione jest także korzystanie z zestawów szyfrów nie zapewniających utajniania z wyprzedzeniem (forward secrecy). Wersje TLS starsze niż 1.1 są zabronione. Bilety sesji są wyłączone.
+
+=item poziom 4
+
+Poziom bezpieczeństwa zapewniający 192 bity bezpieczeństwa. W związku z tym RSA, DSA oraz klucze DH krótsze niż 7680 bitów, a także klucze ECC krótsze niż 384 bity są niedozwolone. Listy parametrów kryptograficznych używających SHA1 do MAC są zabronione. Wersje TLS starsze niż 1.2 są zabronione.
+
+=item poziom 5
+
+Poziom bezpieczeństwa zapewniający 256 bitów bezpieczeństwa. W związku z tym RSA, DSA oraz klucze DH krótsze niż 15360 bitów, a także klucze ECC krótsze niż 512 bitów są niedozwolone.
+
+=item domyślnie: 2
+
+=back
+
+Opcja I<securityLevel> jest dostępna począwszy od B<OpenSSL 1.1.0>.
+
 =item B<requireCert> = yes | no
 
 wymagaj certyfikatu klienta dla I<verifyChain> lub I<verifyPeer>
@@ -925,9 +1027,15 @@
 Parametr określa czas w sekundach, po którym sesja TLS zostanie usunięta z
 pamięci podręcznej.
 
+=item B<sessionResume> = yes | no
+
+zezwalaj lub nie zezwalaj na wznawianie sesji
+
+domyślnie: yes
+
 =item B<sessiond> = HOST:PORT
 
-adres sessiond - servera cache sesji TLS
+adres sessiond - serwera cache sesji TLS
 
 =item B<sni> = NAZWA_USŁUGI:WZORZEC_NAZWY_SERWERA (tryb serwera)
 
@@ -937,8 +1045,8 @@
 I<NAZWA_USŁUGI> wskazuje usługę nadrzędną, która odbiera połączenia od klientów
 przy pomocy opcji I<accept>. I<WZORZEC_NAZWY_SERWERA> wskazuje nazwę serwera
 wirtualnego. Wzorzec może zaczynać się znakiem '*', np. '*.example.com". Z
-pojedyńczą usługą nadrzędną powiązane jest zwykle wiele usług podrzędnych.
-Opcja I<sni> może być rownież użyta wielokrotnie w ramach jednej usługi
+pojedynczą usługą nadrzędną powiązane jest zwykle wiele usług podrzędnych.
+Opcja I<sni> może być również użyta wielokrotnie w ramach jednej usługi
 podrzędnej.
 
 Zarówno usługa nadrzędna jak i podrzędna nie może być skonfigurowana w trybie
@@ -990,28 +1098,99 @@
 
 wersja protokołu TLS
 
-Wspierane wersje: all, SSLv2, SSLv3, TLSv1, TLSv1.1, TLSv1.2
-
-Ocja I<sslVersion> jest przestarzała i zostanie usunięta w przyszłych wersjach stunnela.
-Zamiast niej należy używać następujących opcji:
-
- options = NO_SSLv2
- options = NO_SSLv3
- options = NO_TLSv1
- options = NO_TLSv1.1
- options = NO_TLSv1.2
- options = NO_TLSv1.3
+Wspierane wersje: all, SSLv2, SSLv3, TLSv1, TLSv1.1, TLSv1.2, TLSv1.3
 
 Dostępność konkretnych protokołów zależy od użytej wersji OpenSSL.
-Starsze wersje OpenSSL nie wspierają TLSv1.1 i TLSv1.2.
+Starsze wersje OpenSSL nie wspierają TLSv1.1, TLSv1.2, TLSv1.3.
 Nowsze wersje OpenSSL nie wspierają SSLv2.
 
 Przestarzałe protokoły SSLv2 i SSLv3 są domyślnie wyłączone.
-Szczegółowe informacje dostępne są w opisie opcji B<options>.
+
+Począwszy od B<OpenSSL 1.1.0>, ustawienie
+
+ sslVersion = WERSJA_SSL
+
+jest równoważne opcjom
+
+ sslVersionMax = WERSJA_SSL
+ sslVersionMin = WERSJA_SSL
+
+=item B<sslVersionMax> = WERSJA_SSL
+
+maksymalna wspierana wersja protokołu TLS
+
+Wspierane wersje: all, SSLv3, TLSv1, TLSv1.1, TLSv1.2, TLSv1.3
+
+I<all> włącza wszystkie wersje protokołów aż do maksymalnej wersji wspieranej
+przez bibliotekę użytej wersji OpenSSL.
+
+Dostępność konkretnych protokołów zależy od użytej wersji OpenSSL.
+
+Opcja I<sslVersionMax> jest dostępna począwszy od B<OpenSSL 1.1.0>.
+
+domyślnie: all
+
+=item B<sslVersionMin> = WERSJA_SSL
+
+minimalna wspierana wersja protokołu TLS
+
+Wspierane wersje: all, SSLv3, TLSv1, TLSv1.1, TLSv1.2, TLSv1.3
+
+I<all> włącza wszystkie wersje protokołów aż do minimalnej wersji wspieranej
+przez bibliotekę użytej wersji OpenSSL.
+
+Dostępność konkretnych protokołów zależy od użytej wersji OpenSSL.
+
+Opcja I<sslVersionMin> jest dostępna począwszy od B<OpenSSL 1.1.0>.
+
+domyślnie: TLSv1
 
 =item B<stack> = LICZBA_BAJTÓW (z wyjątkiem modelu FORK)
 
-rozmiar stosu procesora wątku
+rozmiar stosu procesora tworzonych wątków
+
+Zbyt duży stos zwiększa zużycie pamięci wirtualnej.
+Zbyt mały stos może powodować problemy ze stabilnością aplikacji.
+
+domyślnie: 65536 bytes (wystarczający dla testowanych platform)
+
+=item B<ticketKeySecret> = SECRET
+
+szesnastkowy klucz symetryczny używany przez serwer do zapewnienia poufności
+biletów sesji
+
+Bilety sesji zdefiniowane w RFC 5077 zapewniają ulepszoną możliwość wznawiania
+sesji, w której implementacja serwera nie jest wymagana do utrzymania stanu
+sesji.
+
+Łączne użycie opcji I<ticketKeySecret> i I<ticketMacSecret> umożliwia
+wznawianie sesji na klastrze serwerów lub wznowienie sesji po restarcie
+serwera.
+
+Klucz musi mieć rozmiar 16 lub 32 bajtów, co przekłada się na dokładnie 32 lub
+64 cyfry szesnastkowe. Poszczególne bajty mogą być opcjonalnie oddzielone
+dwukropkami.
+
+Opcja działa wyłącznie w trybie serwera.
+
+Opcja I<ticketKeySecret> jest dostępna począwszy od B<OpenSSL 1.0.0>.
+
+Wyłączenie opcji I<NO_TICKET> jest wymagane dla obsługi biletów sesji w
+OpenSSL-u starszym niż 1.1.1, ale opcja ta jest niekompatybilna z opcją
+I<redirect>.
+
+=item B<ticketMacSecret> = SECRET
+
+szesnastkowy klucz symetryczny używany przez serwer zapewnienia integralności
+biletów sesji
+
+Klucz musi mieć rozmiar 16 lub 32 bajtów, co przekłada się na dokładnie 32 lub
+64 cyfry szesnastkowe. Poszczególne bajty mogą być opcjonalnie oddzielone
+dwukropkami.
+
+Opcja działa wyłącznie w trybie serwera.
+
+Opcja I<ticketMacSecret> jest dostępna począwszy od B<OpenSSL 1.0.0>.
 
 =item B<TIMEOUTbusy> = LICZBA_SEKUND
 
@@ -1039,7 +1218,7 @@
 
 =item B<none>
 
-Zablokuj wsparcie dla przezroczystago proxy. Jest to wartość domyślna.
+Zablokuj wsparcie dla przezroczystego proxy. Jest to wartość domyślna.
 
 =item B<source>
 
@@ -1090,7 +1269,7 @@
 
 Oryginalny adres docelowy jest używany zamiast opcji I<connect>.
 
-Przykładowana konfiguracja przezroczystego adresu docelowego:
+Przykładowa konfiguracja przezroczystego adresu docelowego:
 
 transparent
 client = yes
@@ -1120,7 +1299,7 @@
 
 =back
 
-Dla zapewnienia kompatybilności z wcześniejszymim wersjami wspierane są dwie
+Dla zapewnienia kompatybilności z wcześniejszymi wersjami wspierane są dwie
 dodatkowe opcje:
 
 =over 4
@@ -1248,6 +1427,10 @@
 Zamknij i otwórz ponownie log.
 Funkcja ta może zostać użyta w skrypcie rotującym log programu B<stunnel>.
 
+=item SIGUSR2
+
+Zapisz w logu listę aktywnych połączeń.
+
 =item SIGTERM, SIGQUIT, SIGINT
 
 Zakończ działanie programu.
@@ -1342,10 +1525,7 @@
 CAfile = server2-allowed-clients.pem
 
 Przykładowa konfiguracja umożliwiająca uwierzytelnienie z użyciem klucza prywatnego
-przechowywanego w Windows Certificate Store (tylko Windows).
-W przypadku użycia silnika CAPI, nie należy ustawiać opcji cert, gdyż klucz klienta
-zostanie automatycznie pobrany z Certificate Store na podstawie zaufanych certyfikatów
-CA przedstawionych przez serwer.
+przechowywanego w Windows Certificate Store (tylko Windows):
 
 engine = capi
 
@@ -1355,8 +1535,12 @@
 accept = 127.0.0.1:8080
 connect = example.com:8443
 
+W przypadku użycia silnika CAPI, nie należy ustawiać opcji cert, gdyż klucz klienta
+zostanie automatycznie pobrany z Certificate Store na podstawie zaufanych certyfikatów
+CA przedstawionych przez serwer.
+
 Przykładowa konfiguracja umożliwiająca użycie certyfikatu i klucza prywatnego z
-urządzenia zgodnego z pkcs11:
+urządzenia obsługiwanego przez silnik pkcs11:
 
 engine = pkcs11
 engineCtrl = MODULE_PATH:opensc-pkcs11.so
@@ -1371,7 +1555,7 @@
 key = pkcs11:token=MyToken;object=MyKey
 
 Przykładowa konfiguracja umożliwiająca użycie certyfikatu i klucza prywatnego
-umieszczonego na tokenie SoftHSM
+umieszczonego na tokenie SoftHSM:
 
 engine = pkcs11
 engineCtrl = MODULE_PATH:softhsm2.dll
@@ -1427,22 +1611,16 @@
 wolnego pakietu B<OpenSSL>. Więcej informacji na temat generowania
 certyfikatów można znaleźć na umieszczonych poniżej stronach.
 
-Istotną kwestią jest kolejność zawartości pliku I<.pem>.
-W pierwszej kolejności powinien on zawierać klucz prywatny,
-a dopiero za nim podpisany certyfikat (nie żądanie certyfikatu).
-Po certyfikacie i kluczu prywatnym powinny znajdować się puste linie.
-Jeżeli przed certyfikatem znajdują się dodatkowe informacje tekstowe,
-to powinny one zostać usunięte. Otrzymany plik powinien mieć
-następującą postać:
+Plik I<.pem> powinien zawierać klucz prywatny oraz podpisany certyfikat
+(nie żądanie certyfikatu).
+Otrzymany plik powinien mieć następującą postać:
 
 -----BEGIN RSA PRIVATE KEY-----
 zakodowany klucz
 -----END RSA PRIVATE KEY-----
- pusta linia
 -----BEGIN CERTIFICATE-----
 zakodowany certyfikat
 -----END CERTIFICATE-----
- pusta linia
 
 =head2 LOSOWOŚĆ
 
@@ -1513,7 +1691,7 @@
 
 Począwszy od wersji 4.40 B<stunnel> zawiera w kodzie programu 2048-bitowe
 parametry DH. Od wersji 5.18 te początkowe wartości parametrów DH są
-wymieniane na autogenerowane parametry tymczasowe.
+wymieniane na automatycznie generowane parametry tymczasowe.
 Wygenerowanie parametrów DH może zająć nawet wiele minut.
 
 Alternatywnie parametry DH można umieścić w pliku razem z certyfikatem,

_service:tar_scm:stunnel-5.48.tar.gz/doc/stunnel.pod.in -> _service:tar_scm:stunnel-5.69.tar.gz/doc/stunnel.pod.in Changed

@@ -186,13 +186,18 @@
 
 debugging level
 
-Level is one of the syslog level names or numbers
-emerg (0), alert (1), crit (2), err (3), warning (4), notice (5),
-info (6), or debug (7). All logs for the specified level and
-all levels numerically less than it will be shown. Use I<debug = debug> or
-I<debug = 7> for greatest debugging output. The default is notice (5).
+Level is one of the syslog level names or numbers emerg (0), alert (1),
+crit (2), err (3), warning (4), notice (5), info (6), or debug (7). All logs
+for the specified level and all levels numerically less than it will be shown.
+
+The I<debug = debug> (or the equivalent <debug = 7>) level produces for the
+most verbose log output. This logging level is only meant to be understood by
+stunnel developers, and not by users. Please either use the debug level when
+requested to do so by an stunnel developer, or when you intend to get confused.
+
+The default logging level is notice (5).
 
-The syslog facility 'daemon' will be used unless a facility name is supplied.
+The syslog 'daemon' facility will be used unless a facility name is supplied.
 (Facilities are not supported on Win32.)
 
 Case is ignored for both facilities and levels.
@@ -357,26 +362,38 @@
 
 accept = :::PORT
 
-=item B<CApath> = DIRECTORY
+=item B<CAengine> = ENGINE-SPECIFIC_CA_CERTIFICATE_IDENTIFIER
+
+load a trusted CA certificate from an engine
+
+The loaded CA certificates will be used with the I<verifyChain> and
+I<verifyPeer> options.
+
+Multiple I<CAengine> options are allowed in a single service section.
 
-Certificate Authority directory
+Currently supported engines: pkcs11, cng.
 
-This is the directory in which B<stunnel> will look for certificates when using
-the I<verifyChain> or I<verifyPeer> options. Note that the certificates in
-this directory should be named XXXXXXXX.0 where XXXXXXXX is the hash value of
-the DER encoded subject of the cert.
+=item B<CApath> = CA_DIRECTORY
+
+load trusted CA certificates from a directory
+
+The loaded CA certificates will be used with the I<verifyChain> and
+I<verifyPeer> options.
+Note that the certificates in this directory should be named XXXXXXXX.0 where
+XXXXXXXX is the hash value of the DER encoded subject of the cert.
 
 The hash algorithm has been changed in B<OpenSSL 1.0.0>. It is required to
-c_rehash the directory on upgrade from B<OpenSSL 0.x.x> to B<OpenSSL 1.x.x>.
+c_rehash the directory on upgrade from B<OpenSSL 0.x.x> to B<OpenSSL 1.x.x>
+or later.
 
 I<CApath> path is relative to the I<chroot> directory if specified.
 
 =item B<CAfile> = CA_FILE
 
-Certificate Authority file
+load trusted CA certificates from a file
 
-This file contains multiple CA certificates, to be used with the I<verifyChain>
-and I<verifyPeer> options.
+The loaded CA certificates will be used with the I<verifyChain> and
+I<verifyPeer> options.
 
 =item B<cert> = CERT_FILE
 
@@ -397,41 +414,56 @@
 
 email address of the peer certificate subject
 
-Multiple I<checkEmail> options are allowed in a single service section.
 Certificates are accepted if no subject checks were specified, or the email
 address of the peer certificate matches any of the email addresses specified
 with I<checkEmail>.
 
+Multiple I<checkEmail> options are allowed in a single service section.
+
 This option requires OpenSSL 1.0.2 or later.
 
 =item B<checkHost> = HOST
 
 host of the peer certificate subject
 
-Multiple I<checkHost> options are allowed in a single service section.
 Certificates are accepted if no subject checks were specified, or the host name
 of the peer certificate matches any of the hosts specified with I<checkHost>.
 
+Multiple I<checkHost> options are allowed in a single service section.
+
 This option requires OpenSSL 1.0.2 or later.
 
 =item B<checkIP> = IP
 
 IP address of the peer certificate subject
 
-Multiple I<checkIP> options are allowed in a single service section.
 Certificates are accepted if no subject checks were specified, or the IP
 address of the peer certificate matches any of the IP addresses specified with
 I<checkIP>.
 
+Multiple I<checkIP> options are allowed in a single service section.
+
 This option requires OpenSSL 1.0.2 or later.
 
 =item B<ciphers> = CIPHER_LIST
 
-Select permitted TLS ciphers
+select permitted TLS ciphers (TLSv1.2 and below)
+
+This option does not impact TLSv1.3 ciphersuites.
 
 A colon-delimited list of the ciphers to allow in the TLS connection,
 for example DES-CBC3-SHA:IDEA-CBC-MD5.
 
+=item B<ciphersuites> = CIPHERSUITES_LIST
+
+select permitted TLSv1.3 ciphersuites
+
+A colon-delimited list of TLSv1.3 ciphersuites names in order of preference.
+
+This option requires OpenSSL 1.1.1 or later.
+
+default: TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256
+
 =item B<client> = yes | no
 
 client mode (remote service uses TLS)
@@ -449,6 +481,8 @@
 
 Several I<config> lines can be used to specify multiple configuration commands.
 
+Use I<curves> option instead of enabling I<config = Curves:list_curves> to support elliptic curves.
+
 This option requires OpenSSL 1.0.2 or later.
 
 =item B<connect> = HOST:PORT
@@ -458,7 +492,6 @@
 If no host is specified, the host defaults to localhost.
 
 Multiple I<connect> options are allowed in a single service section.
-
 If host resolves to multiple addresses and/or if multiple I<connect>
 options are specified, then the remote address is chosen using a
 round-robin algorithm.
@@ -483,15 +516,21 @@
 This file contains multiple CRLs, used with the I<verifyChain> and
 I<verifyPeer> options.
 
-=item B<curve> = NID
+=item B<curves> = list
 
-specify ECDH curve name
+ECDH curves separated with ':'
+
+Only a single curve name is allowed for OpenSSL older than 1.1.1.
 
 To get a list of supported curves use:
 
 openssl ecparam -list_curves
 
-default: prime256v1
+default:
+
+ X25519:P-256:X448:P-521:P-384 (OpenSSL 1.1.1 or later)
+
+ prime256v1 (OpenSSL older than 1.1.1)
 
 =item B<logId> = TYPE
 
@@ -535,8 +574,13 @@
 Level is a one of the syslog level names or numbers
 emerg (0), alert (1), crit (2), err (3), warning (4), notice (5),
 info (6), or debug (7). All logs for the specified level and
-all levels numerically less than it will be shown. Use I<debug = debug> or
-I<debug = 7> for greatest debugging output. The default is notice (5).
+all levels numerically less than it will be shown.
+The default is notice (5).
+
+While the I<debug = debug> or I<debug = 7> level generates the most verbose
+output, it is only intended to be used by stunnel developers. Please only use
+this value if you are a developer, or you intend to send your logs to our
+technical support. Otherwise, the generated logs B<will> be confusing.
 
 =item B<delay> = yes | no
 
@@ -694,6 +738,9 @@
 options = NO_SSLv2
 options = NO_SSLv3
 
+Use I<sslVersionMax> or I<sslVersionMin> option instead of disabling specific TLS protocol
+versions when compiled with B<OpenSSL 1.1.0> or later.
+
 =item B<protocol> = PROTO
 
 application protocol to negotiate TLS
@@ -711,6 +758,16 @@
 Proprietary (undocummented) extension of CIFS protocol implemented in Samba.
 Support for this extension was dropped in Samba 3.0.0.
 
+=item I<capwin>
+
+http://www.capwin.org/ application support
+
+=item I<capwinctrl>
+
+http://www.capwin.org/ application support
+
+This protocol is only supported in client mode.
+
 =item I<connect>
 
 Based on RFC 2817 - I<Upgrading to TLS Within HTTP/1.1>, section 5.2 - I<Requesting a Tunnel with CONNECT>
@@ -721,6 +778,10 @@
 
 Based on RFC 2595 - I<Using TLS with IMAP, POP3 and ACAP>
 
+=item I<ldap>
+
+Based on RFC 2830 - I<Lightweight Directory Access Protocol (v3): Extension for Transport Layer Security>
+
 =item I<nntp>
 
 Based on RFC 4642 - I<Using Transport Layer Security (TLS) with Network News Transfer Protocol (NNTP)>
@@ -738,8 +799,8 @@
 
 =item I<proxy>
 
-Haproxy client IP address
-F<http://haproxy.1wt.eu/download/1.5/doc/proxy-protocol.txt>
+Passing of the original client IP address with HAProxy PROXY protocol version 1
+F<https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt>
 
 =item I<smtp>
 
@@ -782,16 +843,22 @@
 
 Currently, this option is only supported in the client-side 'connect' protocol.
 
-=item B<protocolHost> = HOST:PORT
+=item B<protocolHeader> = HEADER
 
-destination address for the protocol negotiations
+header for the protocol negotiations
+
+Currently, this option is only supported in the client-side 'connect' protocol.
 
-I<protocolHost> specifies the final TLS server to be connected to by the proxy,
-and not the proxy server directly connected by B<stunnel>.
-The proxy server should be specified with the 'connect' option.
+=item B<protocolHost> = ADDRESS
 
-Currently the protocol destination address only applies to the 'connect'
-protocol.
+host address for the protocol negotiations
+
+For the 'connect' protocol negotiations, I<protocolHost> specifies HOST:PORT of
+the final TLS server to be connected to by the proxy. The proxy server
+directly connected by B<stunnel> must be specified with the I<connect> option.
+
+For the 'smtp' protocol negotiations, I<protocolHost> controls the client SMTP
+HELO/EHLO value.
 
 =item B<protocolPassword> = PASSWORD
 
@@ -824,8 +891,10 @@
 
 IDENTITY:KEY
 
-The key is required to be at least 20 characters long.
-The file should not be world-readable nor world-writable.
+Hexadecimal keys are automatically converted to binary form.
+Keys are required to be at least 16 bytes long, which implies
+at least 32 characters for hexadecimal keys.
+The file should neither be world-readable nor world-writable.
 
 =item B<pty> = yes | no (Unix only)
 
@@ -869,6 +938,44 @@
 
 default: no
 
+=item B<securityLevel> = LEVEL
+
+set the security level
+
+The meaning of each level is described below:
+
+=over 4
+
+=item level 0
+
+Everything is permitted.
+
+=item level 1
+
+The security level corresponds to a minimum of 80 bits of security. Any parameters offering below 80 bits of security are excluded. As a result RSA, DSA and DH keys shorter than 1024 bits and ECC keys shorter than 160 bits are prohibited. All export cipher suites are prohibited since they all offer less than 80 bits of security. SSL version 2 is prohibited. Any cipher suite using MD5 for the MAC is also prohibited.
+
+=item level 2
+
+Security level set to 112 bits of security. As a result RSA, DSA and DH keys shorter than 2048 bits and ECC keys shorter than 224 bits are prohibited. In addition to the level 1 exclusions any cipher suite using RC4 is also prohibited. SSL version 3 is also not allowed. Compression is disabled.
+
+=item level 3
+
+Security level set to 128 bits of security. As a result RSA, DSA and DH keys shorter than 3072 bits and ECC keys shorter than 256 bits are prohibited. In addition to the level 2 exclusions cipher suites not offering forward secrecy are prohibited. TLS versions below 1.1 are not permitted. Session tickets are disabled.
+
+=item level 4
+
+Security level set to 192 bits of security. As a result RSA, DSA and DH keys shorter than 7680 bits and ECC keys shorter than 384 bits are prohibited. Cipher suites using SHA1 for the MAC are prohibited. TLS versions below 1.2 are not permitted.
+
+=item level 5
+
+Security level set to 256 bits of security. As a result RSA, DSA and DH keys shorter than 15360 bits and ECC keys shorter than 512 bits are prohibited.
+
+=item default: 2
+
+=back
+
+The I<securityLevel> option is only available when compiled with B<OpenSSL 1.1.0> and later.
+
 =item B<requireCert> = yes | no
 
 require a client certificate for I<verifyChain> or I<verifyPeer>
@@ -912,32 +1019,38 @@
 
 This is the number of seconds to keep cached TLS sessions.
 
+=item B<sessionResume> = yes | no
+
+allow or disallow session resumption
+
+default: yes
+
 =item B<sessiond> = HOST:PORT
 
 address of sessiond TLS cache server
 
 =item B<sni> = SERVICE_NAME:SERVER_NAME_PATTERN (server mode)
 
-Use the service as a slave service (a name-based virtual server) for Server
+Use the service as a secondary service (a name-based virtual server) for Server
 Name Indication TLS extension (RFC 3546).
 
-I<SERVICE_NAME> specifies the master service that accepts client connections
+I<SERVICE_NAME> specifies the primary service that accepts client connections
 with the I<accept> option. I<SERVER_NAME_PATTERN> specifies the host name to
 be redirected. The pattern may start with the '*' character, e.g.
-'*.example.com'. Multiple slave services are normally specified for a single
-master service. The I<sni> option can also be specified more than once within
-a single slave service.
+'*.example.com'. Multiple secondary services are normally specified for
+a single primary service. The I<sni> option can also be specified more than
+once within a single secondary service.
 
-This service, as well as the master service, may not be configured in client
+This service, as well as the primary service, may not be configured in client
 mode.
 
-The I<connect> option of the slave service is ignored when the I<protocol>
+The I<connect> option of the secondary service is ignored when the I<protocol>
 option is specified, as I<protocol> connects to the remote host before TLS
 handshake.
 
-Libwrap checks (Unix only) are performed twice: with the master service name
-after TCP connection is accepted, and with the slave service name during the
-TLS handshake.
+Libwrap checks (Unix only) are performed twice: with the primary service name
+after TCP connection is accepted, and with the secondary service name during
+the TLS handshake.
 
 The I<sni> option is only available when compiled with B<OpenSSL 1.0.0> and
 later.
@@ -975,28 +1088,101 @@
 
 select the TLS protocol version
 
-Supported versions: all, SSLv2, SSLv3, TLSv1, TLSv1.1, TLSv1.2
-
-sslVersion is obsolete and it will be removed in future releases of stunnel.
-Use the following options instead:
-
- options = NO_SSLv2
- options = NO_SSLv3
- options = NO_TLSv1
- options = NO_TLSv1.1
- options = NO_TLSv1.2
- options = NO_TLSv1.3
+Supported versions: all, SSLv2, SSLv3, TLSv1, TLSv1.1, TLSv1.2, TLSv1.3
 
 Availability of specific protocols depends on the linked OpenSSL library.
-Older versions of OpenSSL do not support TLSv1.1 and TLSv1.2.
+Older versions of OpenSSL do not support TLSv1.1, TLSv1.2 and TLSv1.3.
 Newer versions of OpenSSL do not support SSLv2.
 
 Obsolete SSLv2 and SSLv3 are currently disabled by default.
-See the B<options> option documentation for details.
+
+Setting the option
+
+ sslVersion = SSL_VERSION
+
+is equivalent to options
+
+ sslVersionMax = SSL_VERSION
+ sslVersionMin = SSL_VERSION
+
+when compiled with B<OpenSSL 1.1.0> and later.
+
+=item B<sslVersionMax> = SSL_VERSION
+
+maximum supported protocol versions
+
+Supported versions: all, SSLv3, TLSv1, TLSv1.1, TLSv1.2, TLSv1.3
+
+I<all> enable protocol versions up to the highest version supported by the
+linked OpenSSL library.
+
+Availability of specific protocols depends on the linked OpenSSL library.
+
+The I<sslVersionMax> option is only available when compiled with B<OpenSSL 1.1.0> and later.
+
+default: all
+
+=item B<sslVersionMin> = SSL_VERSION
+
+minimum supported protocol versions
+
+Supported versions: all, SSLv3, TLSv1, TLSv1.1, TLSv1.2, TLSv1.3
+
+I<all> enable protocol versions down to the lowest version supported by the
+linked OpenSSL library.
+
+Availability of specific protocols depends on the linked OpenSSL library.
+
+The I<sslVersionMin> option is only available when compiled with B<OpenSSL 1.1.0> and later.
+
+default: TLSv1
 
 =item B<stack> = BYTES (except for FORK model)
 
-thread stack size
+CPU stack size of created threads
+
+Excessive thread stack size increases virtual memory usage.
+Insufficient thread stack size may cause application crashes.
+
+default: 65536 bytes (sufficient for all platforms we tested)
+
+=item B<ticketKeySecret> = SECRET
+
+hexadecimal symmetric key used for session ticket confidentiality protection
+
+Session tickets defined in RFC 5077 provide an enhanced session resumption
+capability, where the server-side caching is not required to maintain per
+session state.
+
+Combining I<ticketKeySecret> and I<ticketMacSecret> options allow to resume a
+negotiated session on other cluster nodes, or to resume a negotiated
+session after server restart.
+
+The key is required to be either 16 or 32 bytes long, which implies exactly 32
+or 64 hexadecimal digits. Colons may optionally be used between two-character
+hexadecimal bytes.
+
+This option only works in server mode.
+
+The I<ticketKeySecret> option is only available when compiled with
+B<OpenSSL 1.0.0> and later.
+
+Disabling I<NO_TICKET> option is required for the ticket support in OpenSSL
+older than 1.1.1, but note that this option is incompatible with the
+I<redirect> option.
+
+=item B<ticketMacSecret> = SECRET
+
+hexadecimal symmetric key used for session ticket integrity protection
+
+The key is required to be either 16 or 32 bytes long, which implies exactly 32
+or 64 hexadecimal digits. Colons may optionally be used between two-character
+hexadecimal bytes.
+
+This option only works in server mode.
+
+The I<ticketMacSecret> option is only available when compiled with
+B<OpenSSL 1.0.0> and later.
 
 =item B<TIMEOUTbusy> = SECONDS
 
@@ -1235,6 +1421,10 @@
 Close and reopen the B<stunnel> log file.
 This function can be used for log rotation.
 
+=item SIGUSR2
+
+Log the list of active connections.
+
 =item SIGTERM, SIGQUIT, SIGINT
 
 Shut B<stunnel> down.
@@ -1308,19 +1498,19 @@
 An example server mode SNI configuration:
 
 virtual
- ; master service
+ ; primary service
 accept = 443
 cert = default.pem
 connect = default.internal.mydomain.com:8080
 
 sni1
- ; slave service 1
+ ; secondary service 1
 sni = virtual:server1.mydomain.com
 cert = server1.pem
 connect = server1.internal.mydomain.com:8081
 
 sni2
- ; slave service 2
+ ; secondary service 2
 sni = virtual:server2.mydomain.com
 cert = server2.pem
 connect = server2.internal.mydomain.com:8082
@@ -1408,20 +1598,16 @@
 generate them with the free B<OpenSSL> package. You can find more
 information on certificates generation on pages listed below.
 
-The order of contents of the I<.pem> file is important. It should contain the
-unencrypted private key first, then a signed certificate (not certificate
-request). There should also be empty lines after the certificate and the private key.
-Any plaintext certificate information appended on the top of generated certificate
-should be discarded. So the file should look like this:
+The I<.pem> file should contain the unencrypted private key and
+a signed certificate (not certificate request).
+So the file should look like this:
 
 -----BEGIN RSA PRIVATE KEY-----
 encoded key
 -----END RSA PRIVATE KEY-----
- empty line
 -----BEGIN CERTIFICATE-----
 encoded certificate
 -----END CERTIFICATE-----
- empty line
 
 =head2 RANDOMNESS

_service:tar_scm:stunnel-5.48.tar.gz/m4/libtool.m4 -> _service:tar_scm:stunnel-5.69.tar.gz/m4/libtool.m4 Changed

@@ -1041,8 +1041,8 @@
 _LT_EOF
 echo "$LTCC $LTCFLAGS -c -o conftest.o conftest.c" >&AS_MESSAGE_LOG_FD
 $LTCC $LTCFLAGS -c -o conftest.o conftest.c 2>&AS_MESSAGE_LOG_FD
- echo "$AR cru libconftest.a conftest.o" >&AS_MESSAGE_LOG_FD
- $AR cru libconftest.a conftest.o 2>&AS_MESSAGE_LOG_FD
+ echo "$AR cr libconftest.a conftest.o" >&AS_MESSAGE_LOG_FD
+ $AR cr libconftest.a conftest.o 2>&AS_MESSAGE_LOG_FD
 echo "$RANLIB libconftest.a" >&AS_MESSAGE_LOG_FD
 $RANLIB libconftest.a 2>&AS_MESSAGE_LOG_FD
 cat > conftest.c << _LT_EOF
@@ -1071,11 +1071,11 @@
 # to the OS version, if on x86, and 10.4, the deployment
 # target defaults to 10.4. Don't you love it?
 case ${MACOSX_DEPLOYMENT_TARGET-10.0},$host in
-	10.0,*86*-darwin8*|10.0,*-darwin91*)
+	10.0,*86*-darwin8*|10.0,*-darwin912*)
 	 _lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;;
 	10.012,.*)
 	 _lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;;
-	10.*)
+	10.*|11.*)
 	 _lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;;
 esac
 ;;
@@ -1492,7 +1492,7 @@
 m4_defun(_LT_PROG_AR,
 AC_CHECK_TOOLS(AR, ar, false)
 : ${AR=ar}
-: ${AR_FLAGS=cru}
+: ${AR_FLAGS=cr}
 _LT_DECL(, AR, 1, The archiver)
 _LT_DECL(, AR_FLAGS, 1, Flags to create an archive)
 
@@ -4063,7 +4063,8 @@
 if AC_TRY_EVAL(ac_compile); then
 # Now try to grab the symbols.
 nlist=conftest.nm
- if AC_TRY_EVAL(NM conftest.$ac_objext \| "$lt_cv_sys_global_symbol_pipe" \> $nlist) && test -s "$nlist"; then
+ $ECHO "$as_me:$LINENO: $NM conftest.$ac_objext | $lt_cv_sys_global_symbol_pipe > $nlist" >&AS_MESSAGE_LOG_FD
+ if eval "$NM" conftest.$ac_objext \| "$lt_cv_sys_global_symbol_pipe" \> $nlist 2>&AS_MESSAGE_LOG_FD && test -s "$nlist"; then
 # Try sorting and uniquifying the output.
 if sort "$nlist" | uniq > "$nlist"T; then
 	mv -f "$nlist"T "$nlist"
@@ -4703,6 +4704,12 @@
 	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC'
 	_LT_TAGVAR(lt_prog_compiler_static, $1)='-static'
 ;;
+ # flang / f18. f95 an alias for gfortran or flang on Debian
+ flang* | f18* | f95*)
+	_LT_TAGVAR(lt_prog_compiler_wl, $1)='-Wl,'
+	_LT_TAGVAR(lt_prog_compiler_pic, $1)='-fPIC'
+	_LT_TAGVAR(lt_prog_compiler_static, $1)='-static'
+ ;;
 # icc used to be incompatible with GCC.
 # ICC 10 doesn't accept -KPIC any more.
 icc* | ifort*)
@@ -6438,7 +6445,7 @@
 # Commands to make compiler produce verbose output that lists
 # what "hidden" libraries, object files and flags are used when
 # linking a shared library.
- output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"'
+ output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP " \-L"'
 
 else
 GXX=no
@@ -6813,7 +6820,7 @@
 # explicitly linking system object files so we need to strip them
 # from the output so that they don't get included in the library
 # dependencies.
- output_verbose_link_cmd='templist=`($CC -b $CFLAGS -v conftest.$objext 2>&1) | $EGREP "\-L"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"'
+ output_verbose_link_cmd='templist=`($CC -b $CFLAGS -v conftest.$objext 2>&1) | $EGREP " \-L"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"'
 ;;
 *)
 if test yes = "$GXX"; then
@@ -6878,7 +6885,7 @@
 	 # explicitly linking system object files so we need to strip them
 	 # from the output so that they don't get included in the library
 	 # dependencies.
-	 output_verbose_link_cmd='templist=`($CC -b $CFLAGS -v conftest.$objext 2>&1) | $GREP "\-L"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"'
+	 output_verbose_link_cmd='templist=`($CC -b $CFLAGS -v conftest.$objext 2>&1) | $GREP " \-L"`; list= ; for z in $templist; do case $z in conftest.$objext) list="$list $z";; *.$objext);; *) list="$list $z";;esac; done; func_echo_all "$list"'
 	 ;;
 *)
 	 if test yes = "$GXX"; then
@@ -7217,7 +7224,7 @@
 	 # Commands to make compiler produce verbose output that lists
 	 # what "hidden" libraries, object files and flags are used when
 	 # linking a shared library.
-	 output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"'
+	 output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP " \-L"'
 
 	 else
 	 # FIXME: insert proper C++ library support
@@ -7301,7 +7308,7 @@
 	 # Commands to make compiler produce verbose output that lists
 	 # what "hidden" libraries, object files and flags are used when
 	 # linking a shared library.
-	 output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"'
+	 output_verbose_link_cmd='$CC -shared $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP " \-L"'
 	 else
 	 # g++ 2.7 appears to require '-G' NOT '-shared' on this
 	 # platform.
@@ -7312,7 +7319,7 @@
 	 # Commands to make compiler produce verbose output that lists
 	 # what "hidden" libraries, object files and flags are used when
 	 # linking a shared library.
-	 output_verbose_link_cmd='$CC -G $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP "\-L"'
+	 output_verbose_link_cmd='$CC -G $CFLAGS -v conftest.$objext 2>&1 | $GREP -v "^Configured with:" | $GREP " \-L"'
 	 fi
 
 	 _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='$wl-R $wl$libdir'

_service:tar_scm:stunnel-5.69.tar.gz/makedh.sh Added

_service:tar_scm:stunnel-5.48.tar.gz/src/Makefile.am -> _service:tar_scm:stunnel-5.69.tar.gz/src/Makefile.am Changed

@@ -1,5 +1,5 @@
 ## Process this file with automake to produce Makefile.in
-# by Michal Trojnara 1998-2018
+# by Michal Trojnara 1998-2023
 
 ###############################################################################
 # File lists                                                                  #
@@ -16,17 +16,6 @@
 win32_cli_sources = ui_win_cli.c
 
 ###############################################################################
-# Generate a new set of DH parameters for each version                        #
-###############################################################################
-
-dhparam.c: version.h
-	echo '#include "common.h"' >dhparam.c
-	echo '#ifndef OPENSSL_NO_DH' >>dhparam.c
-	echo '#define DN_new DH_new' >>dhparam.c
-	openssl dhparam -noout -C 2048 >>dhparam.c
-	echo '#endif /* OPENSSL_NO_DH */' >>dhparam.c
-
-###############################################################################
 # Unix executables and shared library                                         #
 ###############################################################################
 
@@ -40,7 +29,7 @@
 # Red Hat "by design" bug #82369
 stunnel_CPPFLAGS = -I$(SYSROOT)/usr/kerberos/include
 
-# Additional preprocesor definitions
+# Additional preprocessor definitions
 stunnel_CPPFLAGS += -I$(SSLDIR)/include
 stunnel_CPPFLAGS += -DLIBDIR='"$(pkglibdir)"'
 stunnel_CPPFLAGS += -DCONFDIR='"$(sysconfdir)/stunnel"'
@@ -64,15 +53,12 @@
 # Win32 executables                                                           #
 ###############################################################################
 
-if AUTHOR_TESTS
-# Just check if the programs can be built, don't perform any actual tests
-#check-local: mingw mingw64
-endif
-
 mingw:
-	$(MAKE) -f $(srcdir)/mingw.mk srcdir=$(srcdir) win32_targetcpu=i686 win32_mingw=mingw
+	$(MAKE) -f $(srcdir)/mingw.mk srcdir=$(srcdir) win32_arch=win32 win32_targetcpu=i686 win32_mingw=mingw
+
 mingw64:
-	$(MAKE) -f $(srcdir)/mingw.mk srcdir=$(srcdir) win32_targetcpu=x86_64 win32_mingw=mingw64
+	$(MAKE) -f $(srcdir)/mingw.mk srcdir=$(srcdir) win32_arch=win64 win32_targetcpu=x86_64 win32_mingw=mingw64
+
 .PHONY: mingw mingw64
 
 clean-local:

_service:tar_scm:stunnel-5.48.tar.gz/src/Makefile.in -> _service:tar_scm:stunnel-5.69.tar.gz/src/Makefile.in Changed

@@ -1,7 +1,7 @@
-# Makefile.in generated by automake 1.15 from Makefile.am.
+# Makefile.in generated by automake 1.16.5 from Makefile.am.
 # @configure_input@
 
-# Copyright (C) 1994-2014 Free Software Foundation, Inc.
+# Copyright (C) 1994-2021 Free Software Foundation, Inc.
 
 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -14,7 +14,7 @@
 
 @SET_MAKE@
 
-# by Michal Trojnara 1998-2018
+# by Michal Trojnara 1998-2023
 
 ###############################################################################
 # File lists #
@@ -110,6 +110,9 @@
 CONFIG_HEADER = config.h
 CONFIG_CLEAN_FILES =
 CONFIG_CLEAN_VPATH_FILES =
+am__installdirs = "$(DESTDIR)$(bindir)" "$(DESTDIR)$(pkglibdir)" \
+	"$(DESTDIR)$(bindir)"
+PROGRAMS = $(bin_PROGRAMS)
 am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
 am__vpath_adj = case $$p in \
 $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
@@ -137,8 +140,6 @@
 || { echo " ( cd '$$dir' && rm -f" $$files ")"; \
 $(am__cd) "$$dir" && rm -f $$files; }; \
 }
-am__installdirs = "$(DESTDIR)$(pkglibdir)" "$(DESTDIR)$(bindir)" \
-	"$(DESTDIR)$(bindir)"
 LTLIBRARIES = $(pkglib_LTLIBRARIES)
 libstunnel_la_LIBADD =
 am__objects_1 = env.lo
@@ -151,7 +152,6 @@
 libstunnel_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
 	$(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \
 	$(libstunnel_la_LDFLAGS) $(LDFLAGS) -o $@
-PROGRAMS = $(bin_PROGRAMS)
 am__objects_2 =
 am__objects_3 = stunnel-tls.$(OBJEXT) stunnel-str.$(OBJEXT) \
 	stunnel-file.$(OBJEXT) stunnel-client.$(OBJEXT) \
@@ -186,7 +186,18 @@
 am__v_at_1 = 
 DEFAULT_INCLUDES = -I.@am__isrc@
 depcomp = $(SHELL) $(top_srcdir)/auto/depcomp
-am__depfiles_maybe = depfiles
+am__maybe_remake_depfiles = depfiles
+am__depfiles_remade = ./$(DEPDIR)/env.Plo \
+	./$(DEPDIR)/stunnel-client.Po ./$(DEPDIR)/stunnel-cron.Po \
+	./$(DEPDIR)/stunnel-ctx.Po ./$(DEPDIR)/stunnel-dhparam.Po \
+	./$(DEPDIR)/stunnel-fd.Po ./$(DEPDIR)/stunnel-file.Po \
+	./$(DEPDIR)/stunnel-libwrap.Po ./$(DEPDIR)/stunnel-log.Po \
+	./$(DEPDIR)/stunnel-network.Po ./$(DEPDIR)/stunnel-options.Po \
+	./$(DEPDIR)/stunnel-protocol.Po ./$(DEPDIR)/stunnel-pty.Po \
+	./$(DEPDIR)/stunnel-resolver.Po ./$(DEPDIR)/stunnel-ssl.Po \
+	./$(DEPDIR)/stunnel-sthreads.Po ./$(DEPDIR)/stunnel-str.Po \
+	./$(DEPDIR)/stunnel-stunnel.Po ./$(DEPDIR)/stunnel-tls.Po \
+	./$(DEPDIR)/stunnel-ui_unix.Po ./$(DEPDIR)/stunnel-verify.Po
 am__mv = mv -f
 COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
 	$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
@@ -213,8 +224,8 @@
 n|no|NO) false;; \
 *) (install-info --version) >/dev/null 2>&1;; \
 esac
-am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) \
-	$(LISP)config.h.in
+am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP) \
+	config.h.in
 # Read a list of newline-separated strings from the standard input,
 # and print each of them once, without duplicates. Input order is
 # *not* preserved.
@@ -231,8 +242,6 @@
 unique=`for i in $$list; do \
 if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
 done | $(am__uniquify_input)`
-ETAGS = etags
-CTAGS = ctags
 am__DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/config.h.in \
 	$(top_srcdir)/auto/depcomp
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
@@ -249,6 +258,8 @@
 CFLAGS = @CFLAGS@
 CPP = @CPP@
 CPPFLAGS = @CPPFLAGS@
+CSCOPE = @CSCOPE@
+CTAGS = @CTAGS@
 CYGPATH_W = @CYGPATH_W@
 DEFAULT_GROUP = @DEFAULT_GROUP@
 DEFS = @DEFS@
@@ -260,6 +271,7 @@
 ECHO_N = @ECHO_N@
 ECHO_T = @ECHO_T@
 EGREP = @EGREP@
+ETAGS = @ETAGS@
 EXEEXT = @EXEEXT@
 FGREP = @FGREP@
 GREP = @GREP@
@@ -297,6 +309,7 @@
 PATH_SEPARATOR = @PATH_SEPARATOR@
 PTHREAD_CC = @PTHREAD_CC@
 PTHREAD_CFLAGS = @PTHREAD_CFLAGS@
+PTHREAD_CXX = @PTHREAD_CXX@
 PTHREAD_LIBS = @PTHREAD_LIBS@
 RANDOM_FILE = @RANDOM_FILE@
 RANLIB = @RANLIB@
@@ -319,6 +332,7 @@
 am__tar = @am__tar@
 am__untar = @am__untar@
 ax_pthread_config = @ax_pthread_config@
+bashcompdir = @bashcompdir@
 bindir = @bindir@
 build = @build@
 build_alias = @build_alias@
@@ -380,7 +394,7 @@
 
 # Red Hat "by design" bug #82369
 
-# Additional preprocesor definitions
+# Additional preprocessor definitions
 stunnel_CPPFLAGS = -I$(SYSROOT)/usr/kerberos/include \
 	-I$(SSLDIR)/include -DLIBDIR='"$(pkglibdir)"' \
 	-DCONFDIR='"$(sysconfdir)/stunnel"'
@@ -411,16 +425,16 @@
 	 exit 1;; \
 	 esac; \
 	done; \
-	echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/Makefile'; \
+	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign src/Makefile'; \
 	$(am__cd) $(top_srcdir) && \
-	 $(AUTOMAKE) --gnu src/Makefile
+	 $(AUTOMAKE) --foreign src/Makefile
 Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
 	@case '$?' in \
 	 *config.status*) \
 	 cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
 	 *) \
-	 echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
-	 cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
+	 echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__maybe_remake_depfiles)'; \
+	 cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__maybe_remake_depfiles);; \
 	esac;
 
 $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
@@ -446,44 +460,6 @@
 
 distclean-hdr:
 	-rm -f config.h stamp-h1
-
-install-pkglibLTLIBRARIES: $(pkglib_LTLIBRARIES)
-	@$(NORMAL_INSTALL)
-	@list='$(pkglib_LTLIBRARIES)'; test -n "$(pkglibdir)" || list=; \
-	list2=; for p in $$list; do \
-	 if test -f $$p; then \
-	 list2="$$list2 $$p"; \
-	 else :; fi; \
-	done; \
-	test -z "$$list2" || { \
-	 echo " $(MKDIR_P) '$(DESTDIR)$(pkglibdir)'"; \
-	 $(MKDIR_P) "$(DESTDIR)$(pkglibdir)" || exit 1; \
-	 echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(pkglibdir)'"; \
-	 $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(pkglibdir)"; \
-	}
-
-uninstall-pkglibLTLIBRARIES:
-	@$(NORMAL_UNINSTALL)
-	@list='$(pkglib_LTLIBRARIES)'; test -n "$(pkglibdir)" || list=; \
-	for p in $$list; do \
-	 $(am__strip_dir) \
-	 echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(pkglibdir)/$$f'"; \
-	 $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(pkglibdir)/$$f"; \
-	done
-
-clean-pkglibLTLIBRARIES:
-	-test -z "$(pkglib_LTLIBRARIES)" || rm -f $(pkglib_LTLIBRARIES)
-	@list='$(pkglib_LTLIBRARIES)'; \
-	locs=`for p in $$list; do echo $$p; done | \
-	 sed 's|^^/*$$|.|; s|/^/*$$||; s|$$|/so_locations|' | \
-	 sort -u`; \
-	test -z "$$locs" || { \
-	 echo rm -f $${locs}; \
-	 rm -f $${locs}; \
-	}
-
-libstunnel.la: $(libstunnel_la_OBJECTS) $(libstunnel_la_DEPENDENCIES) $(EXTRA_libstunnel_la_DEPENDENCIES) 
-	$(AM_V_CCLD)$(libstunnel_la_LINK) -rpath $(pkglibdir) $(libstunnel_la_OBJECTS) $(libstunnel_la_LIBADD) $(LIBS)
 install-binPROGRAMS: $(bin_PROGRAMS)
 	@$(NORMAL_INSTALL)
 	@list='$(bin_PROGRAMS)'; test -n "$(bindir)" || list=; \
@@ -534,6 +510,44 @@
 	echo " rm -f" $$list; \
 	rm -f $$list
 
+install-pkglibLTLIBRARIES: $(pkglib_LTLIBRARIES)
+	@$(NORMAL_INSTALL)
+	@list='$(pkglib_LTLIBRARIES)'; test -n "$(pkglibdir)" || list=; \
+	list2=; for p in $$list; do \
+	 if test -f $$p; then \
+	 list2="$$list2 $$p"; \
+	 else :; fi; \
+	done; \
+	test -z "$$list2" || { \
+	 echo " $(MKDIR_P) '$(DESTDIR)$(pkglibdir)'"; \
+	 $(MKDIR_P) "$(DESTDIR)$(pkglibdir)" || exit 1; \
+	 echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(pkglibdir)'"; \
+	 $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(pkglibdir)"; \
+	}
+
+uninstall-pkglibLTLIBRARIES:
+	@$(NORMAL_UNINSTALL)
+	@list='$(pkglib_LTLIBRARIES)'; test -n "$(pkglibdir)" || list=; \
+	for p in $$list; do \
+	 $(am__strip_dir) \
+	 echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(pkglibdir)/$$f'"; \
+	 $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(pkglibdir)/$$f"; \
+	done
+
+clean-pkglibLTLIBRARIES:
+	-test -z "$(pkglib_LTLIBRARIES)" || rm -f $(pkglib_LTLIBRARIES)
+	@list='$(pkglib_LTLIBRARIES)'; \
+	locs=`for p in $$list; do echo $$p; done | \
+	 sed 's|^^/*$$|.|; s|/^/*$$||; s|$$|/so_locations|' | \
+	 sort -u`; \
+	test -z "$$locs" || { \
+	 echo rm -f $${locs}; \
+	 rm -f $${locs}; \
+	}
+
+libstunnel.la: $(libstunnel_la_OBJECTS) $(libstunnel_la_DEPENDENCIES) $(EXTRA_libstunnel_la_DEPENDENCIES) 
+	$(AM_V_CCLD)$(libstunnel_la_LINK) -rpath $(pkglibdir) $(libstunnel_la_OBJECTS) $(libstunnel_la_LIBADD) $(LIBS)
+
 stunnel$(EXEEXT): $(stunnel_OBJECTS) $(stunnel_DEPENDENCIES) $(EXTRA_stunnel_DEPENDENCIES) 
 	@rm -f stunnel$(EXEEXT)
 	$(AM_V_CCLD)$(stunnel_LINK) $(stunnel_OBJECTS) $(stunnel_LDADD) $(LIBS)
@@ -579,27 +593,33 @@
 distclean-compile:
 	-rm -f *.tab.c
 
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/env.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-client.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-cron.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-ctx.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-dhparam.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-fd.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-file.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-libwrap.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-log.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-network.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-options.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-protocol.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-pty.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-resolver.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-ssl.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-sthreads.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-str.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-stunnel.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-tls.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-ui_unix.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-verify.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/env.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-client.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-cron.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-ctx.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-dhparam.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-fd.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-file.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-libwrap.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-log.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-network.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-options.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-protocol.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-pty.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-resolver.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-ssl.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-sthreads.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-str.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-stunnel.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-tls.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-ui_unix.Po@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stunnel-verify.Po@am__quote@ # am--include-marker
+
+$(am__depfiles_remade):
+	@$(MKDIR_P) $(@D)
+	@echo '# dummy' >$@-t && $(am__mv) $@-t $@
+
+am--depfiles: $(am__depfiles_remade)
 
 .c.o:
 @am__fastdepCC_TRUE@	$(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
@@ -959,8 +979,10 @@
 
 distclean-tags:
 	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
+distdir: $(BUILT_SOURCES)
+	$(MAKE) $(AM_MAKEFLAGS) distdir-am
 
-distdir: $(DISTFILES)
+distdir-am: $(DISTFILES)
 	@srcdirstrip=`echo "$(srcdir)" | sed 's/.^$$\\*/\\\\&/g'`; \
 	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/.^$$\\*/\\\\&/g'`; \
 	list='$(DISTFILES)'; \
@@ -992,9 +1014,9 @@
 	done
 check-am: all-am
 check: check-am
-all-am: Makefile $(LTLIBRARIES) $(PROGRAMS) $(SCRIPTS) config.h
+all-am: Makefile $(PROGRAMS) $(LTLIBRARIES) $(SCRIPTS) config.h
 installdirs:
-	for dir in "$(DESTDIR)$(pkglibdir)" "$(DESTDIR)$(bindir)" "$(DESTDIR)$(bindir)"; do \
+	for dir in "$(DESTDIR)$(bindir)" "$(DESTDIR)$(pkglibdir)" "$(DESTDIR)$(bindir)"; do \
 	 test -z "$$dir" || $(MKDIR_P) "$$dir"; \
 	done
 install: install-am
@@ -1034,7 +1056,27 @@
 	clean-pkglibLTLIBRARIES mostlyclean-am
 
 distclean: distclean-am
-	-rm -rf ./$(DEPDIR)
+		-rm -f ./$(DEPDIR)/env.Plo
+	-rm -f ./$(DEPDIR)/stunnel-client.Po
+	-rm -f ./$(DEPDIR)/stunnel-cron.Po
+	-rm -f ./$(DEPDIR)/stunnel-ctx.Po
+	-rm -f ./$(DEPDIR)/stunnel-dhparam.Po
+	-rm -f ./$(DEPDIR)/stunnel-fd.Po
+	-rm -f ./$(DEPDIR)/stunnel-file.Po
+	-rm -f ./$(DEPDIR)/stunnel-libwrap.Po
+	-rm -f ./$(DEPDIR)/stunnel-log.Po
+	-rm -f ./$(DEPDIR)/stunnel-network.Po
+	-rm -f ./$(DEPDIR)/stunnel-options.Po
+	-rm -f ./$(DEPDIR)/stunnel-protocol.Po
+	-rm -f ./$(DEPDIR)/stunnel-pty.Po
+	-rm -f ./$(DEPDIR)/stunnel-resolver.Po
+	-rm -f ./$(DEPDIR)/stunnel-ssl.Po
+	-rm -f ./$(DEPDIR)/stunnel-sthreads.Po
+	-rm -f ./$(DEPDIR)/stunnel-str.Po
+	-rm -f ./$(DEPDIR)/stunnel-stunnel.Po
+	-rm -f ./$(DEPDIR)/stunnel-tls.Po
+	-rm -f ./$(DEPDIR)/stunnel-ui_unix.Po
+	-rm -f ./$(DEPDIR)/stunnel-verify.Po
 	-rm -f Makefile
 distclean-am: clean-am distclean-compile distclean-generic \
 	distclean-hdr distclean-tags
@@ -1081,7 +1123,27 @@
 installcheck-am:
 
 maintainer-clean: maintainer-clean-am
-	-rm -rf ./$(DEPDIR)
+		-rm -f ./$(DEPDIR)/env.Plo
+	-rm -f ./$(DEPDIR)/stunnel-client.Po
+	-rm -f ./$(DEPDIR)/stunnel-cron.Po
+	-rm -f ./$(DEPDIR)/stunnel-ctx.Po
+	-rm -f ./$(DEPDIR)/stunnel-dhparam.Po
+	-rm -f ./$(DEPDIR)/stunnel-fd.Po
+	-rm -f ./$(DEPDIR)/stunnel-file.Po
+	-rm -f ./$(DEPDIR)/stunnel-libwrap.Po
+	-rm -f ./$(DEPDIR)/stunnel-log.Po
+	-rm -f ./$(DEPDIR)/stunnel-network.Po
+	-rm -f ./$(DEPDIR)/stunnel-options.Po
+	-rm -f ./$(DEPDIR)/stunnel-protocol.Po
+	-rm -f ./$(DEPDIR)/stunnel-pty.Po
+	-rm -f ./$(DEPDIR)/stunnel-resolver.Po
+	-rm -f ./$(DEPDIR)/stunnel-ssl.Po
+	-rm -f ./$(DEPDIR)/stunnel-sthreads.Po
+	-rm -f ./$(DEPDIR)/stunnel-str.Po
+	-rm -f ./$(DEPDIR)/stunnel-stunnel.Po
+	-rm -f ./$(DEPDIR)/stunnel-tls.Po
+	-rm -f ./$(DEPDIR)/stunnel-ui_unix.Po
+	-rm -f ./$(DEPDIR)/stunnel-verify.Po
 	-rm -f Makefile
 maintainer-clean-am: distclean-am maintainer-clean-generic
 
@@ -1103,7 +1165,7 @@
 
 .MAKE: all install-am install-strip
 
-.PHONY: CTAGS GTAGS TAGS all all-am check check-am clean \
+.PHONY: CTAGS GTAGS TAGS all all-am am--depfiles check check-am clean \
 	clean-binPROGRAMS clean-generic clean-libtool clean-local \
 	clean-pkglibLTLIBRARIES cscopelist-am ctags ctags-am distclean \
 	distclean-compile distclean-generic distclean-hdr \
@@ -1122,17 +1184,6 @@
 
 .PRECIOUS: Makefile
 
-
-###############################################################################
-# Generate a new set of DH parameters for each version #
-###############################################################################
-
-dhparam.c: version.h
-	echo '#include "common.h"' >dhparam.c
-	echo '#ifndef OPENSSL_NO_DH' >>dhparam.c
-	echo '#define DN_new DH_new' >>dhparam.c
-	openssl dhparam -noout -C 2048 >>dhparam.c
-	echo '#endif /* OPENSSL_NO_DH */' >>dhparam.c
 stunnel3: Makefile
 	$(edit) '$(srcdir)/$@.in' >$@
 stunnel3: $(srcdir)/stunnel3.in
@@ -1141,13 +1192,12 @@
 # Win32 executables #
 ###############################################################################
 
-# Just check if the programs can be built, don't perform any actual tests
-#check-local: mingw mingw64
-
 mingw:
-	$(MAKE) -f $(srcdir)/mingw.mk srcdir=$(srcdir) win32_targetcpu=i686 win32_mingw=mingw
+	$(MAKE) -f $(srcdir)/mingw.mk srcdir=$(srcdir) win32_arch=win32 win32_targetcpu=i686 win32_mingw=mingw
+
 mingw64:
-	$(MAKE) -f $(srcdir)/mingw.mk srcdir=$(srcdir) win32_targetcpu=x86_64 win32_mingw=mingw64
+	$(MAKE) -f $(srcdir)/mingw.mk srcdir=$(srcdir) win32_arch=win64 win32_targetcpu=x86_64 win32_mingw=mingw64
+
 .PHONY: mingw mingw64
 
 clean-local:

_service:tar_scm:stunnel-5.48.tar.gz/src/client.c -> _service:tar_scm:stunnel-5.69.tar.gz/src/client.c Changed

@@ -1,6 +1,6 @@
 /*
 * stunnel TLS offloading and load-balancing proxy
- * Copyright (C) 1998-2018 Michal Trojnara <Michal.Trojnara@stunnel.org>
+ * Copyright (C) 1998-2023 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
@@ -35,7 +35,6 @@
 * forward this exception.
 */
 
-#include "common.h"
 #include "prototypes.h"
 
 #ifndef SHUT_RD
@@ -56,6 +55,9 @@
 NOEXPORT void remote_start(CLI *);
 NOEXPORT void ssl_start(CLI *);
 NOEXPORT void session_cache_retrieve(CLI *);
+#if OPENSSL_VERSION_NUMBER >= 0x10101000L
+NOEXPORT void print_tmp_key(SSL *s);
+#endif
 NOEXPORT void print_cipher(CLI *);
 NOEXPORT void transfer(CLI *);
 NOEXPORT int parse_socket_error(CLI *, const char *);
@@ -73,7 +75,7 @@
 NOEXPORT int connect_init(CLI *, int);
 NOEXPORT int redirect(CLI *);
 NOEXPORT void print_bound_address(CLI *);
-NOEXPORT void reset(SOCKET, char *);
+NOEXPORT void reset(SOCKET, const char *);
 
 /* allocate local data structure for the new thread */
 CLI *alloc_client_session(SERVICE_OPTIONS *opt, SOCKET rfd, SOCKET wfd) {
@@ -94,28 +96,64 @@
 #else
 void *
 #endif
-client_thread(void *arg) {
+ client_thread(void *arg) {
 CLI *c=arg;
+#ifdef DEBUG_STACK_SIZE
+ size_t stack_size=c->opt->stack_size;
+#endif
+
+#ifdef USE_FORK
+ /* do not use signal pipe in child processes */
+ signal(SIGCHLD, SIG_IGN); /* ignore dead children */
+ signal(SIGHUP, SIG_DFL);
+ signal(SIGUSR1, SIG_DFL);
+ signal(SIGUSR2, SIG_DFL);
+ signal(SIGPIPE, SIG_IGN); /* ignore broken pipe */
+ signal(SIGTERM, SIG_DFL);
+ signal(SIGQUIT, SIG_DFL);
+ signal(SIGINT, SIG_DFL);
+#endif /* USE_FORK */
+
+ /* make sure c->thread_* values are initialized */
+ CRYPTO_THREAD_read_lock(stunnel_locksLOCK_THREAD_LIST);
+ CRYPTO_THREAD_unlock(stunnel_locksLOCK_THREAD_LIST);
 
 /* initialize */
 c->tls=NULL; /* do not reuse */
 tls_alloc(c, NULL, NULL);
 #ifdef DEBUG_STACK_SIZE
- stack_info(1); /* initialize */
+ stack_info(stack_size, 1); /* initialize */
 #endif
 
 /* execute */
 client_main(c);
 
- /* cleanup */
+ /* cleanup the thread */
+#ifndef USE_FORK
+ CRYPTO_THREAD_write_lock(stunnel_locksLOCK_THREAD_LIST);
+ if(thread_head==c)
+ thread_head=c->thread_next;
+ if(c->thread_prev)
+ c->thread_prev->thread_next=c->thread_next;
+ if(c->thread_next)
+ c->thread_next->thread_prev=c->thread_prev;
+#ifdef USE_PTHREAD
+ pthread_detach(c->thread_id);
+#endif
+#ifdef USE_WIN32
+ CloseHandle(c->thread_id);
+#endif
+ CRYPTO_THREAD_unlock(stunnel_locksLOCK_THREAD_LIST);
+#endif /* !USE_FORK */
+ client_free(c);
 #ifdef DEBUG_STACK_SIZE
- stack_info(0); /* display computed value */
+ stack_info(stack_size, 0); /* display computed value */
 #endif
 str_stats(); /* client thread allocation tracking */
 tls_cleanup();
 /* s_log() is not allowed after tls_cleanup() */
 
- /* terminate */
+ /* terminate the thread */
 #if defined(USE_WIN32) || defined(USE_OS2)
 #if !defined(_WIN32_WCE)
 _endthreadex(0);
@@ -129,6 +167,12 @@
 #endif
 }
 
+#ifdef DEBUG_STACK_SIZE
+void ignore_value(void *ptr) {
+ (void)ptr; /* squash the unused parameter warning */
+}
+#endif
+
 void client_main(CLI *c) {
 s_log(LOG_DEBUG, "Service %s started", c->opt->servname);
 if(c->opt->exec_name && c->opt->connect_addr.names) {
@@ -139,6 +183,9 @@
 } else {
 client_run(c);
 }
+}
+
+void client_free(CLI *c) {
 #ifndef USE_FORK
 service_free(c->opt);
 #endif
@@ -154,7 +201,7 @@
 #endif /* __GNUC__ */
 NOEXPORT void exec_connect_loop(CLI *c) {
 unsigned long long seq=0;
- char *fresh_id=c->tls->id;
+ const char *fresh_id=c->tls->id;
 unsigned retry;
 
 do {
@@ -171,7 +218,7 @@
 s_log(LOG_INFO, "Retrying an exec+connect section");
 /* c and id are detached, so it is safe to call str_stats() */
 str_stats(); /* client thread allocation tracking */
- sleep(1); /* FIXME: not a good idea in ucontext threading */
+ s_poll_sleep(1, 0);
 c->rr++;
 }
 
@@ -214,7 +261,8 @@
 #endif /* __GNUC__ */
 NOEXPORT void client_run(CLI *c) {
 jmp_buf exception_buffer, *exception_backup;
- int err, rst;
+ int err, rst_remote, rst_local;
+ char *close_status;
 #ifndef USE_FORK
 int num;
 #endif
@@ -254,11 +302,29 @@
 }
 c->exception_pointer=exception_backup;
 
- rst=err==1 && c->opt->option.reset;
+ /* plain socket is remote in the server mode */
+ rst_remote=err==1 && c->opt->option.reset &&
+ (!c->fatal_alert || !c->opt->option.client);
+ /* plain socket is local in the client mode */
+ rst_local=err==1 && c->opt->option.reset &&
+ (!c->fatal_alert || c->opt->option.client);
+ if(rst_remote && rst_local)
+ close_status="reset";
+ else if(rst_remote)
+ close_status="reset/closed";
+ else if(rst_local)
+ close_status="closed/reset";
+ else
+ close_status="closed";
 s_log(LOG_NOTICE,
 "Connection %s: %llu byte(s) sent to TLS, %llu byte(s) sent to socket",
- rst ? "reset" : "closed",
+ close_status,
 (unsigned long long)c->ssl_bytes, (unsigned long long)c->sock_bytes);
+#ifdef USE_WIN32
+ if(capwin_hwnd && (rst_remote || rst_local)
+ && InterlockedExchange(&capwin_connectivity, 0))
+ PostMessage(capwin_hwnd, WM_CAPWIN_NET_DOWN, 0, 0);
+#endif
 
 /* cleanup temporary (e.g. IDENT) socket */
 if(c->fd!=INVALID_SOCKET)
@@ -287,8 +353,11 @@
 
 /* cleanup the remote socket */
 if(c->remote_fd.fd!=INVALID_SOCKET) { /* remote socket initialized */
- if(rst && c->remote_fd.is_socket) /* reset */
- reset(c->remote_fd.fd, "linger (remote)");
+ if(rst_remote && c->remote_fd.is_socket) /* reset */
+ reset(c->remote_fd.fd, "remote_fd");
+#ifndef USE_UCONTEXT
+ set_nonblock(c->remote_fd.fd, 0);
+#endif
 closesocket(c->remote_fd.fd);
 s_log(LOG_DEBUG, "Remote descriptor (FD=%ld) closed",
 (long)c->remote_fd.fd);
@@ -298,16 +367,19 @@
 /* cleanup the local socket */
 if(c->local_rfd.fd!=INVALID_SOCKET) { /* local socket initialized */
 if(c->local_rfd.fd==c->local_wfd.fd) {
- if(rst && c->local_rfd.is_socket)
- reset(c->local_rfd.fd, "linger (local)");
+ if(rst_local && c->local_rfd.is_socket)
+ reset(c->local_rfd.fd, "local_rfd/local_wfd");
+#ifndef USE_UCONTEXT
+ set_nonblock(c->local_rfd.fd, 0);
+#endif
 closesocket(c->local_rfd.fd);
 s_log(LOG_DEBUG, "Local descriptor (FD=%ld) closed",
 (long)c->local_rfd.fd);
 } else { /* stdin/stdout */
- if(rst && c->local_rfd.is_socket)
- reset(c->local_rfd.fd, "linger (local_rfd)");
- if(rst && c->local_wfd.is_socket)
- reset(c->local_wfd.fd, "linger (local_wfd)");
+ if(rst_local && c->local_rfd.is_socket)
+ reset(c->local_rfd.fd, "local_rfd");
+ if(rst_local && c->local_wfd.is_socket)
+ reset(c->local_wfd.fd, "local_wfd");
 }
 c->local_rfd.fd=c->local_wfd.fd=INVALID_SOCKET;
 }
@@ -365,15 +437,19 @@
 addr_len=sizeof(SOCKADDR_UNION);
 c->local_rfd.is_socket=!getpeername(c->local_rfd.fd, &addr.sa, &addr_len);
 if(c->local_rfd.is_socket) {
+ /* store the retrieved peer address */
 memcpy(&c->peer_addr.sa, &addr.sa, (size_t)addr_len);
 c->peer_addr_len=addr_len;
- if(socket_options_set(c->opt, c->local_rfd.fd, 1))
+ if(
+#ifdef HAVE_STRUCT_SOCKADDR_UN
+ addr.sa.sa_family!=AF_UNIX &&
+#endif
+ socket_options_set(c->opt, c->local_rfd.fd, 1)) {
 s_log(LOG_WARNING, "Failed to set local socket options");
- } else {
- if(get_last_socket_error()!=S_ENOTSOCK) {
- sockerror("getpeerbyname (local_rfd)");
- throw_exception(c, 1);
 }
+ } else if(get_last_socket_error()!=S_ENOTSOCK) {
+ sockerror("getpeerbyname (local_rfd)");
+ throw_exception(c, 1);
 }
 
 /* check if local_wfd is a socket and get peer address */
@@ -383,17 +459,21 @@
 addr_len=sizeof(SOCKADDR_UNION);
 c->local_wfd.is_socket=!getpeername(c->local_wfd.fd, &addr.sa, &addr_len);
 if(c->local_wfd.is_socket) {
- if(!c->local_rfd.is_socket) { /* already retrieved */
+ if(!c->local_rfd.is_socket) { /* not retrieved from rfd? */
+ /* store the retrieved peer address */
 memcpy(&c->peer_addr.sa, &addr.sa, (size_t)addr_len);
 c->peer_addr_len=addr_len;
 }
- if(socket_options_set(c->opt, c->local_wfd.fd, 1))
+ if(
+#ifdef HAVE_STRUCT_SOCKADDR_UN
+ addr.sa.sa_family!=AF_UNIX &&
+#endif
+ socket_options_set(c->opt, c->local_wfd.fd, 1)) {
 s_log(LOG_WARNING, "Failed to set local socket options");
- } else {
- if(get_last_socket_error()!=S_ENOTSOCK) {
- sockerror("getpeerbyname (local_wfd)");
- throw_exception(c, 1);
 }
+ } else if(get_last_socket_error()!=S_ENOTSOCK) {
+ sockerror("getpeerbyname (local_wfd)");
+ throw_exception(c, 1);
 }
 }
 
@@ -452,7 +532,10 @@
 
 NOEXPORT void ssl_start(CLI *c) {
 int i, err;
+ SSL_SESSION *sess;
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
 int unsafe_openssl;
+#endif /* OpenSSL version < 1.1.0 */
 
 c->ssl=SSL_new(c->opt->ctx);
 if(!c->ssl) {
@@ -498,31 +581,34 @@
 else
 s_log(LOG_INFO, "Peer certificate not required");
 
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
 unsafe_openssl=OpenSSL_version_num()<0x0090810fL ||
 (OpenSSL_version_num()>=0x10000000L &&
 OpenSSL_version_num()<0x1000002fL);
+#endif /* OpenSSL version < 1.1.0 */
 while(1) {
 /* critical section for OpenSSL version < 0.9.8p or 1.x.x < 1.0.0b *
 * this critical section is a crude workaround for CVE-2010-3864 *
 * see http://www.securityfocus.com/bid/44884 for details *
 * alternative solution is to disable internal session caching *
 * NOTE: this critical section also covers callbacks (e.g. OCSP) */
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
 if(unsafe_openssl)
 CRYPTO_THREAD_write_lock(stunnel_locksLOCK_SSL);
+#endif /* OpenSSL version < 1.1.0 */
 
- if(c->opt->option.client)
- i=SSL_connect(c->ssl);
- else
- i=SSL_accept(c->ssl);
+ i=c->opt->option.client ? SSL_connect(c->ssl) : SSL_accept(c->ssl);
 
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
 if(unsafe_openssl)
 CRYPTO_THREAD_unlock(stunnel_locksLOCK_SSL);
+#endif /* OpenSSL version < 1.1.0 */
 
 err=SSL_get_error(c->ssl, i);
 if(err==SSL_ERROR_NONE)
 break; /* ok -> done */
 if(err==SSL_ERROR_WANT_READ || err==SSL_ERROR_WANT_WRITE) {
- s_poll_init(c->fds);
+ s_poll_init(c->fds, 0);
 s_poll_add(c->fds, c->ssl_rfd->fd,
 err==SSL_ERROR_WANT_READ,
 err==SSL_ERROR_WANT_WRITE);
@@ -552,14 +638,38 @@
 #endif
 continue;
 }
+ sockerror(c->opt->option.client ? "SSL_connect" : "SSL_accept");
+ throw_exception(c, 1);
 }
- if(c->opt->option.client)
- sslerror("SSL_connect");
- else
- sslerror("SSL_accept");
+ sslerror(c->opt->option.client ? "SSL_connect" : "SSL_accept");
 throw_exception(c, 1);
 }
 print_cipher(c);
+ sess=SSL_get1_session(c->ssl);
+ if(sess) {
+ X509 *peer_cert=SSL_get_peer_certificate(c->ssl);
+ if(peer_cert) {
+ X509_free(peer_cert);
+ } else { /* no authentication was performed */
+ if(!SSL_SESSION_set_ex_data(sess,
+ index_session_authenticated, NULL)) {
+ sslerror("SSL_SESSION_set_ex_data");
+ SSL_SESSION_free(sess);
+ throw_exception(c, 1);
+ }
+ }
+ if(SSL_session_reused(c->ssl)) {
+ print_session_id(sess);
+ } else { /* a new session was negotiated */
+ /* SSL_SESS_CACHE_NO_INTERNAL_STORE prevented automatic caching */
+ if(!c->opt->option.client)
+ SSL_CTX_add_session(c->opt->ctx, sess);
+ }
+ SSL_SESSION_free(sess);
+ } else if(c->opt->redirect_addr.names) {
+ s_log(LOG_ERR, "No session available for redirection");
+ throw_exception(c, 1);
+ }
 }
 
 NOEXPORT void session_cache_retrieve(CLI *c) {
@@ -581,8 +691,54 @@
 CRYPTO_THREAD_unlock(stunnel_locksLOCK_SESSION);
 }
 
+#if OPENSSL_VERSION_NUMBER >= 0x10101000L
+NOEXPORT void print_tmp_key(SSL *s) {
+ EVP_PKEY *key;
+ long tmp_key_found;
+
+#ifdef SSL_CTRL_GET_PEER_TMP_KEY
+ tmp_key_found=SSL_get_peer_tmp_key(s, &key);
+#else
+ tmp_key_found=SSL_get_server_tmp_key(s, &key);
+#endif
+ if(!tmp_key_found) {
+ s_log(LOG_INFO, "No peer temporary key received");
+ return;
+ }
+ switch(EVP_PKEY_id(key)) {
+ case EVP_PKEY_RSA:
+ s_log(LOG_INFO, "Peer temporary key: RSA, %d bits", EVP_PKEY_bits(key));
+ break;
+ case EVP_PKEY_DH:
+ s_log(LOG_INFO, "Peer temporary key: DH, %d bits", EVP_PKEY_bits(key));
+ break;
+#ifndef OPENSSL_NO_EC
+ case EVP_PKEY_EC:
+ {
+ EC_KEY *ec=EVP_PKEY_get1_EC_KEY(key);
+ int nid=EC_GROUP_get_curve_name(EC_KEY_get0_group(ec));
+ const char *cname=EC_curve_nid2nist(nid);
+ EC_KEY_free(ec);
+ if (cname == NULL)
+ cname=OBJ_nid2sn(nid);
+ s_log(LOG_INFO, "Peer temporary key: ECDH, %s, %d bits", cname, EVP_PKEY_bits(key));
+ }
+ break;
+#endif
+ default:
+ s_log(LOG_INFO, "Peer temporary key: %s, %d bits", OBJ_nid2sn(EVP_PKEY_id(key)),
+ EVP_PKEY_bits(key));
+ }
+ EVP_PKEY_free(key);
+}
+#endif /* OpenSSL 1.1.1 or later */
+
 NOEXPORT void print_cipher(CLI *c) { /* print negotiated cipher */
+#if OPENSSL_VERSION_NUMBER >= 0x10101000L
+ const SSL_CIPHER *cipher;
+#else
 SSL_CIPHER *cipher;
+#endif /* OpenSSL 1.1.1 or later */
 #ifndef OPENSSL_NO_COMP
 const COMP_METHOD *compression, *expansion;
 #endif
@@ -592,13 +748,16 @@
 
 s_log(LOG_INFO, "TLS %s: %s",
 c->opt->option.client ? "connected" : "accepted",
- SSL_session_reused(c->ssl) ?
+ SSL_session_reused(c->ssl) && !c->flag.psk ?
 "previous session reused" : "new session negotiated");
 
- cipher=(SSL_CIPHER *)SSL_get_current_cipher(c->ssl);
+ cipher=SSL_get_current_cipher(c->ssl);
 s_log(LOG_INFO, "%s ciphersuite: %s (%d-bit encryption)",
 SSL_get_version(c->ssl), SSL_CIPHER_get_name(cipher),
 SSL_CIPHER_get_bits(cipher, NULL));
+#if OPENSSL_VERSION_NUMBER >= 0x10101000L
+ print_tmp_key(c->ssl);
+#endif
 
 #ifndef OPENSSL_NO_COMP
 compression=SSL_get_current_compression(c->ssl);
@@ -612,8 +771,12 @@
 
 /****************************** transfer data */
 NOEXPORT void transfer(CLI *c) {
+ int timeout; /* s_poll_wait timeout in seconds */
+ int pending; /* either processed on unprocessed TLS data */
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+ int has_pending=0, prev_has_pending;
+#endif
 int watchdog=0; /* a counter to detect an infinite loop */
- ssize_t num;
 int err;
 /* logical channels (not file descriptors!) open for read or write */
 int sock_open_rd=1, sock_open_wr=1;
@@ -639,7 +802,7 @@
 && c->sock_ptr && !write_wants_read;
 
 /****************************** setup c->fds structure */
- s_poll_init(c->fds); /* initialize the structure */
+ s_poll_init(c->fds, 0); /* initialize the structure */
 /* for plain socket open data strem = open file descriptor */
 /* make sure to add each open socket to receive exceptions! */
 if(sock_open_rd) /* only poll if the read file descriptor is open */
@@ -656,17 +819,31 @@
 }
 
 /****************************** wait for an event */
- err=s_poll_wait(c->fds,
- (sock_open_rd && /* both peers open */
+ pending=SSL_pending(c->ssl);
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+ /* only attempt to process SSL_has_pending() data once */
+ prev_has_pending=has_pending;
+ has_pending=SSL_has_pending(c->ssl);
+ pending=pending || (has_pending && !prev_has_pending);
+#endif
+ if(read_wants_read && pending) {
+ timeout=0; /* process any buffered data without delay */
+ } else if((sock_open_rd && /* both peers open */
 !(SSL_get_shutdown(c->ssl)&SSL_RECEIVED_SHUTDOWN)) ||
- c->ssl_ptr /* data buffered to write to socket */ ||
- c->sock_ptr /* data buffered to write to TLS */ ?
- c->opt->timeout_idle : c->opt->timeout_close, 0);
+ c->ssl_ptr /* data buffered to write to socket */ ||
+ c->sock_ptr /* data buffered to write to TLS */) {
+ timeout=c->opt->timeout_idle;
+ } else {
+ timeout=c->opt->timeout_close;
+ }
+ err=s_poll_wait(c->fds, timeout, 0);
 switch(err) {
 case -1:
 sockerror("transfer: s_poll_wait");
 throw_exception(c, 1);
 case 0: /* timeout */
+ if(read_wants_read && pending)
+ break;
 if((sock_open_rd &&
 !(SSL_get_shutdown(c->ssl)&SSL_RECEIVED_SHUTDOWN)) ||
 c->ssl_ptr || c->sock_ptr) {
@@ -674,12 +851,12 @@
 " TIMEOUTidle exceeded: sending reset");
 s_poll_dump(c->fds, LOG_DEBUG);
 throw_exception(c, 1);
- } else { /* already closing connection */
- s_log(LOG_ERR, "transfer: s_poll_wait:"
- " TIMEOUTclose exceeded: closing");
- s_poll_dump(c->fds, LOG_DEBUG);
- return; /* OK */
 }
+ /* already closing connection */
+ s_log(LOG_ERR, "transfer: s_poll_wait:"
+ " TIMEOUTclose exceeded: closing");
+ s_poll_dump(c->fds, LOG_DEBUG);
+ return; /* OK */
 }
 
 /****************************** retrieve results from c->fds */
@@ -731,17 +908,21 @@
 
 /****************************** hangups without read or write */
 if(!(sock_can_rd || sock_can_wr || ssl_can_rd || ssl_can_wr)) {
- if(s_poll_hup(c->fds, c->sock_rfd->fd) ||
- s_poll_hup(c->fds, c->sock_wfd->fd)) {
+ if(s_poll_hup(c->fds, c->sock_wfd->fd)) {
 if(c->ssl_ptr) {
 s_log(LOG_ERR,
- "Socket closed (HUP) with %ld unsent byte(s)",
+ "Write socket closed (HUP) with %ld unsent byte(s)",
 (long)c->ssl_ptr);
 throw_exception(c, 1); /* reset the sockets */
 }
- s_log(LOG_INFO, "Socket closed (HUP)");
- sock_open_rd=sock_open_wr=0;
- } else if(s_poll_hup(c->fds, c->ssl_rfd->fd) ||
+ s_log(LOG_INFO, "Write socket closed (HUP)");
+ sock_open_wr=0;
+ }
+ if(s_poll_hup(c->fds, c->sock_rfd->fd)) {
+ s_log(LOG_INFO, "Read socket closed (HUP)");
+ sock_open_rd=0;
+ }
+ if(s_poll_hup(c->fds, c->ssl_rfd->fd) ||
 s_poll_hup(c->fds, c->ssl_wfd->fd)) {
 if(c->sock_ptr) {
 s_log(LOG_ERR,
@@ -762,9 +943,9 @@
 
 /****************************** send TLS close_notify alert */
 if(shutdown_wants_read || shutdown_wants_write) {
- num=SSL_shutdown(c->ssl); /* send close_notify alert */
+ int num=SSL_shutdown(c->ssl); /* send close_notify alert */
 if(num<0) /* -1 - not completed */
- err=SSL_get_error(c->ssl, (int)num);
+ err=SSL_get_error(c->ssl, num);
 else /* 0 or 1 - success */
 err=SSL_ERROR_NONE;
 switch(err) {
@@ -772,16 +953,6 @@
 s_log(LOG_INFO, "SSL_shutdown successfully sent close_notify alert");
 shutdown_wants_read=shutdown_wants_write=0;
 break;
- case SSL_ERROR_SYSCALL: /* socket error */
- if(parse_socket_error(c, "SSL_shutdown"))
- break; /* a non-critical error: retry */
- SSL_set_shutdown(c->ssl, SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
- shutdown_wants_read=shutdown_wants_write=0;
- break;
- case SSL_ERROR_ZERO_RETURN: /* connection closed */
- SSL_set_shutdown(c->ssl, SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
- shutdown_wants_read=shutdown_wants_write=0;
- break;
 case SSL_ERROR_WANT_WRITE:
 s_log(LOG_DEBUG, "SSL_shutdown returned WANT_WRITE: retrying");
 shutdown_wants_read=0;
@@ -795,6 +966,16 @@
 case SSL_ERROR_SSL: /* TLS error */
 sslerror("SSL_shutdown");
 throw_exception(c, 1);
+ case SSL_ERROR_ZERO_RETURN: /* received a close_notify alert */
+ SSL_set_shutdown(c->ssl, SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
+ shutdown_wants_read=shutdown_wants_write=0;
+ break;
+ case SSL_ERROR_SYSCALL: /* socket error */
+ if(parse_socket_error(c, "SSL_shutdown"))
+ break; /* a non-critical error: retry */
+ SSL_set_shutdown(c->ssl, SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
+ shutdown_wants_read=shutdown_wants_write=0;
+ break;
 default:
 s_log(LOG_ERR, "SSL_shutdown/SSL_get_error returned %d", err);
 throw_exception(c, 1);
@@ -803,7 +984,7 @@
 
 /****************************** write to socket */
 if(sock_open_wr && sock_can_wr) {
- num=writesocket(c->sock_wfd->fd, c->ssl_buff, c->ssl_ptr);
+ ssize_t num=writesocket(c->sock_wfd->fd, c->ssl_buff, c->ssl_ptr);
 switch(num) {
 case -1: /* error */
 if(parse_socket_error(c, "writesocket"))
@@ -824,7 +1005,7 @@
 
 /****************************** read from socket */
 if(sock_open_rd && sock_can_rd) {
- num=readsocket(c->sock_rfd->fd,
+ ssize_t num=readsocket(c->sock_rfd->fd,
 c->sock_buff+c->sock_ptr, BUFFSIZE-c->sock_ptr);
 switch(num) {
 case -1:
@@ -852,21 +1033,21 @@
 /****************************** write to TLS */
 if((write_wants_read && ssl_can_rd) ||
 (write_wants_write && ssl_can_wr)) {
+ int num=SSL_write(c->ssl, c->sock_buff, (int)(c->sock_ptr));
 write_wants_read=0;
 write_wants_write=0;
- num=SSL_write(c->ssl, c->sock_buff, (int)(c->sock_ptr));
- switch(err=SSL_get_error(c->ssl, (int)num)) {
+ switch(err=SSL_get_error(c->ssl, num)) {
 case SSL_ERROR_NONE:
 if(num==0) { /* nothing was written: ignore */
 s_log(LOG_DEBUG, "SSL_write returned 0");
- break; /* do not reset the watchdog */
+ } else {
+ memmove(c->sock_buff, c->sock_buff+num,
+ c->sock_ptr-(size_t)num);
+ c->sock_ptr-=(size_t)num;
+ memset(c->sock_buff+c->sock_ptr, 0, (size_t)num); /* PPD */
+ c->ssl_bytes+=(size_t)num;
+ watchdog=0; /* data transferred -> reset the watchdog */
 }
- memmove(c->sock_buff, c->sock_buff+num,
- c->sock_ptr-(size_t)num);
- c->sock_ptr-=(size_t)num;
- memset(c->sock_buff+c->sock_ptr, 0, (size_t)num); /* paranoia */
- c->ssl_bytes+=(size_t)num;
- watchdog=0; /* reset the watchdog */
 break;
 case SSL_ERROR_WANT_WRITE: /* buffered data? */
 s_log(LOG_DEBUG, "SSL_write returned WANT_WRITE: retrying");
@@ -880,8 +1061,13 @@
 s_log(LOG_DEBUG,
 "SSL_write returned WANT_X509_LOOKUP: retrying");
 break;
+ case SSL_ERROR_SSL:
+ sslerror("SSL_write");
+ throw_exception(c, 1);
+ case SSL_ERROR_ZERO_RETURN: /* a buffered close_notify alert */
+ /* fall through */
 case SSL_ERROR_SYSCALL: /* socket error */
- if(num && parse_socket_error(c, "SSL_write"))
+ if(parse_socket_error(c, "SSL_write") && num) /* always log the error */
 break; /* a non-critical error: retry */
 /* EOF -> buggy (e.g. Microsoft) peer:
 * TLS socket closed without close_notify alert */
@@ -894,14 +1080,6 @@
 s_log(LOG_INFO, "TLS socket closed (SSL_write)");
 SSL_set_shutdown(c->ssl, SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
 break;
- case SSL_ERROR_ZERO_RETURN: /* close_notify alert received */
- s_log(LOG_INFO, "TLS closed (SSL_write)");
- if(SSL_version(c->ssl)==SSL2_VERSION)
- SSL_set_shutdown(c->ssl, SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
- break;
- case SSL_ERROR_SSL:
- sslerror("SSL_write");
- throw_exception(c, 1);
 default:
 s_log(LOG_ERR, "SSL_write/SSL_get_error returned %d", err);
 throw_exception(c, 1);
@@ -909,21 +1087,21 @@
 }
 
 /****************************** read from TLS */
- if((read_wants_read && (ssl_can_rd || SSL_pending(c->ssl))) ||
+ if((read_wants_read && (ssl_can_rd || pending)) ||
 /* it may be possible to read some pending data after
 * writesocket() above made some room in c->ssl_buff */
 (read_wants_write && ssl_can_wr)) {
+ int num=SSL_read(c->ssl, c->ssl_buff+c->ssl_ptr, (int)(BUFFSIZE-c->ssl_ptr));
 read_wants_read=0;
 read_wants_write=0;
- num=SSL_read(c->ssl, c->ssl_buff+c->ssl_ptr, (int)(BUFFSIZE-c->ssl_ptr));
- switch(err=SSL_get_error(c->ssl, (int)num)) {
+ switch(err=SSL_get_error(c->ssl, num)) {
 case SSL_ERROR_NONE:
 if(num==0) { /* nothing was read: ignore */
 s_log(LOG_DEBUG, "SSL_read returned 0");
- break; /* do not reset the watchdog */
+ } else {
+ c->ssl_ptr+=(size_t)num;
+ watchdog=0; /* data transferred -> reset the watchdog */
 }
- c->ssl_ptr+=(size_t)num;
- watchdog=0; /* reset the watchdog */
 break;
 case SSL_ERROR_WANT_WRITE:
 s_log(LOG_DEBUG, "SSL_read returned WANT_WRITE: retrying");
@@ -939,8 +1117,17 @@
 s_log(LOG_DEBUG,
 "SSL_read returned WANT_X509_LOOKUP: retrying");
 break;
+ case SSL_ERROR_SSL:
+ sslerror("SSL_read");
+ throw_exception(c, 1);
+ case SSL_ERROR_ZERO_RETURN: /* received a close_notify alert */
+ s_log(LOG_INFO, "TLS closed (SSL_read)");
+ if(SSL_version(c->ssl)==SSL2_VERSION)
+ SSL_set_shutdown(c->ssl,
+ SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
+ break;
 case SSL_ERROR_SYSCALL:
- if(num && parse_socket_error(c, "SSL_read"))
+ if(parse_socket_error(c, "SSL_read") && num) /* always log the error */
 break; /* a non-critical error: retry */
 /* EOF -> buggy (e.g. Microsoft) peer:
 * TLS socket closed without close_notify alert */
@@ -954,15 +1141,6 @@
 SSL_set_shutdown(c->ssl,
 SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
 break;
- case SSL_ERROR_ZERO_RETURN: /* close_notify alert received */
- s_log(LOG_INFO, "TLS closed (SSL_read)");
- if(SSL_version(c->ssl)==SSL2_VERSION)
- SSL_set_shutdown(c->ssl,
- SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
- break;
- case SSL_ERROR_SSL:
- sslerror("SSL_read");
- throw_exception(c, 1);
 default:
 s_log(LOG_ERR, "SSL_read/SSL_get_error returned %d", err);
 throw_exception(c, 1);
@@ -1047,8 +1225,14 @@
 s_log(LOG_ERR,
 "please report the problem to Michal.Trojnara@stunnel.org");
 stunnel_info(LOG_ERR);
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+ s_log(LOG_ERR, "protocol=%s, SSL_pending=%d, SSL_has_pending=%d",
+ SSL_get_version(c->ssl),
+ SSL_pending(c->ssl), SSL_has_pending(c->ssl));
+#else
 s_log(LOG_ERR, "protocol=%s, SSL_pending=%d",
 SSL_get_version(c->ssl), SSL_pending(c->ssl));
+#endif
 s_log(LOG_ERR, "sock_open_rd=%s, sock_open_wr=%s",
 sock_open_rd ? "Y" : "n", sock_open_wr ? "Y" : "n");
 s_log(LOG_ERR, "SSL_RECEIVED_SHUTDOWN=%s, SSL_SENT_SHUTDOWN=%s",
@@ -1075,22 +1259,15 @@
 shutdown_wants_read || shutdown_wants_write);
 }
 
-#ifdef __GNUC__
-#if __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 6)
-#pragma GCC diagnostic push
-#endif /* __GNUC__>=4.6 */
-#if __GNUC__ >= 7
-#pragma GCC diagnostic ignored "-Wimplicit-fallthrough"
-#endif /* __GNUC__>=7 */
-#endif /* __GNUC__ */
-
 /* returns 0 on close and 1 on non-critical errors */
 NOEXPORT int parse_socket_error(CLI *c, const char *text) {
 switch(get_last_socket_error()) {
 /* http://tangentsoft.net/wskfaq/articles/bsd-compatibility.html */
 case 0: /* close on read, or close on write on WIN32 */
+ /* fall through */
 #ifndef USE_WIN32
 case EPIPE: /* close on write on Unix */
+ /* fall through */
 #endif
 case S_ECONNABORTED:
 s_log(LOG_INFO, "%s: Socket is closed", text);
@@ -1100,7 +1277,7 @@
 return 1;
 case S_EWOULDBLOCK:
 s_log(LOG_NOTICE, "%s: Would block: retrying", text);
- sleep(1); /* Microsoft bug KB177346 */
+ s_poll_sleep(1, 0); /* Microsoft bug KB177346 */
 return 1;
 #if S_EAGAIN!=S_EWOULDBLOCK
 case S_EAGAIN:
@@ -1115,8 +1292,8 @@
 s_log(LOG_INFO, "%s: Socket is closed (exec)", text);
 return 0;
 }
- /* fall through */
 #endif
+ /* fall through */
 default:
 sockerror(text);
 throw_exception(c, 1);
@@ -1124,12 +1301,6 @@
 }
 }
 
-#ifdef __GNUC__
-#if __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 6)
-#pragma GCC diagnostic pop
-#endif /* __GNUC__>=4.6 */
-#endif /* __GNUC__ */
-
 NOEXPORT void auth_user(CLI *c) {
 #ifndef _WIN32_WCE
 struct servent *s_ent; /* structure for getservbyname */
@@ -1186,7 +1357,7 @@
 }
 *system++='\0';
 if(strcmp(type, " USERID ")) {
- s_log(LOG_ERR, "Incorrect INETD response type");
+ s_log(LOG_ERR, "Incorrect IDENT response type");
 str_free(line);
 throw_exception(c, 1);
 }
@@ -1248,8 +1419,6 @@
 
 #else /* standard Unix version */
 
-extern char **environ;
-
 NOEXPORT SOCKET connect_local(CLI *c) { /* spawn local process */
 int fd2, pid;
 char **env;
@@ -1285,7 +1454,7 @@
 /* dup2() does not copy FD_CLOEXEC flag */
 dup2(fd1, 0);
 dup2(fd1, 1);
- if(!global_options.option.log_stderr)
+ if(!c->opt->option.log_stderr)
 dup2(fd1, 2);
 closesocket(fd1); /* not really needed due to FD_CLOEXEC */
 #ifdef HAVE_PTHREAD_SIGMASK
@@ -1295,6 +1464,7 @@
 signal(SIGCHLD, SIG_DFL);
 signal(SIGHUP, SIG_DFL);
 signal(SIGUSR1, SIG_DFL);
+ signal(SIGUSR2, SIG_DFL);
 signal(SIGPIPE, SIG_DFL);
 signal(SIGTERM, SIG_DFL);
 signal(SIGQUIT, SIG_DFL);
@@ -1310,6 +1480,7 @@
 }
 
 char **env_alloc(CLI *c) {
+ extern char **environ;
 char **env=NULL, **p;
 unsigned n=0; /* (n+2) keeps the list NULL-terminated */
 char *name, host40, port6;
@@ -1331,7 +1502,8 @@
 envn++=str_dup("LD_PRELOAD_32=" LIBDIR "/libstunnel.so");
 env=str_realloc(env, (n+2)*sizeof(char *));
 envn++=str_dup("LD_PRELOAD_64=" LIBDIR "/" MACH64 "/libstunnel.so");
-#elif __osf /* for Tru64 _RLD_LIST is used instead */
+#elif defined(__osf) || defined(__osf__)
+ /* for Tru64 _RLD_LIST is used instead */
 env=str_realloc(env, (n+2)*sizeof(char *));
 envn++=str_dup("_RLD_LIST=" LIBDIR "/libstunnel.so:DEFAULT");
 #else
@@ -1397,9 +1569,13 @@
 if(!connect_init(c, c->connect_addr.addrc->idx.sa.sa_family) &&
 !s_connect(c, &c->connect_addr.addrc->idx,
 addr_len(&c->connect_addr.addrc->idx))) {
- if(c->ssl)
- idx_cache_save(SSL_get_session(c->ssl),
- &c->connect_addr.addrc->idx);
+ if(c->ssl) {
+ SSL_SESSION *sess=SSL_get1_session(c->ssl);
+ if(sess) {
+ idx_cache_save(sess, &c->connect_addr.addrc->idx);
+ SSL_SESSION_free(sess);
+ }
+ }
 print_bound_address(c);
 fd=c->fd;
 c->fd=INVALID_SOCKET;
@@ -1419,6 +1595,7 @@
 SOCKADDR_UNION *old_addr, *new_addr;
 socklen_t len;
 char *addr_txt;
+ int ok;
 
 /* make a copy of the address, so it may work with delayed resolver */
 len=addr_len(cur_addr);
@@ -1431,10 +1608,14 @@
 
 CRYPTO_THREAD_write_lock(stunnel_locksLOCK_ADDR);
 old_addr=SSL_SESSION_get_ex_data(sess, index_session_connect_address);
- /* we can safely ignore the SSL_SESSION_set_ex_data() failure */
- SSL_SESSION_set_ex_data(sess, index_session_connect_address, new_addr);
+ ok=SSL_SESSION_set_ex_data(sess, index_session_connect_address, new_addr);
 CRYPTO_THREAD_unlock(stunnel_locksLOCK_ADDR);
- str_free(old_addr); /* NULL pointers are ignored */
+ if(ok) {
+ str_free(old_addr); /* NULL pointers are ignored */
+ } else { /* failed to store new_addr -> remove it */
+ sslerror("SSL_SESSION_set_ex_data");
+ str_free(new_addr); /* NULL pointers are ignored */
+ }
 }
 
 NOEXPORT unsigned idx_cache_retrieve(CLI *c) {
@@ -1444,30 +1625,34 @@
 char *addr_txt;
 
 if(c->ssl && SSL_session_reused(c->ssl)) {
- CRYPTO_THREAD_read_lock(stunnel_locksLOCK_ADDR);
- ptr=SSL_SESSION_get_ex_data(SSL_get_session(c->ssl),
- index_session_connect_address);
- if(ptr) {
- len=addr_len(ptr);
- memcpy(&addr, ptr, (size_t)len);
- CRYPTO_THREAD_unlock(stunnel_locksLOCK_ADDR);
- /* address was copied, ptr itself is no longer valid */
- for(i=0; i<c->connect_addr.num; ++i) {
- if(addr_len(&c->connect_addr.addri)==len &&
- !memcmp(&c->connect_addr.addri,
- &addr, (size_t)len)) {
- addr_txt=s_ntop(&addr, len);
- s_log(LOG_INFO, "persistence: %s reused", addr_txt);
- str_free(addr_txt);
- return i;
+ SSL_SESSION *sess=SSL_get1_session(c->ssl);
+ if(sess) {
+ CRYPTO_THREAD_read_lock(stunnel_locksLOCK_ADDR);
+ ptr=SSL_SESSION_get_ex_data(sess, index_session_connect_address);
+ if(ptr) {
+ len=addr_len(ptr);
+ memcpy(&addr, ptr, (size_t)len);
+ CRYPTO_THREAD_unlock(stunnel_locksLOCK_ADDR);
+ SSL_SESSION_free(sess);
+ /* address was copied, ptr itself is no longer valid */
+ for(i=0; i<c->connect_addr.num; ++i) {
+ if(addr_len(&c->connect_addr.addri)==len &&
+ !memcmp(&c->connect_addr.addri,
+ &addr, (size_t)len)) {
+ addr_txt=s_ntop(&addr, len);
+ s_log(LOG_INFO, "persistence: %s reused", addr_txt);
+ str_free(addr_txt);
+ return i;
+ }
 }
+ addr_txt=s_ntop(&addr, len);
+ s_log(LOG_INFO, "persistence: %s not available", addr_txt);
+ str_free(addr_txt);
+ } else {
+ CRYPTO_THREAD_unlock(stunnel_locksLOCK_ADDR);
+ SSL_SESSION_free(sess);
+ s_log(LOG_NOTICE, "persistence: No cached address found");
 }
- addr_txt=s_ntop(&addr, len);
- s_log(LOG_INFO, "persistence: %s not available", addr_txt);
- str_free(addr_txt);
- } else {
- CRYPTO_THREAD_unlock(stunnel_locksLOCK_ADDR);
- s_log(LOG_NOTICE, "persistence: No cached address found");
 }
 }
 
@@ -1513,28 +1698,16 @@
 
 if(c->bind_addr) {
 /* setup bind_addr based on c->bind_addr */
-#if 0
- /* IPv6 addresses converted from IPv4 cause timeouts */
-#ifdef USE_IPv6
- if(c->bind_addr->sa.sa_family==AF_INET && domain==AF_INET6) {
- /* convert the binding address from IPv4 to IPv6 */
- memset(&bind_addr, 0, sizeof bind_addr);
- bind_addr.in6.sin6_family=AF_INET6;
- bind_addr.in6.sin6_port=c->bind_addr->in.sin_port;
- /* address format example: ::ffff:192.0.2.128 */
- memset((char *)&bind_addr.in6.sin6_addr+10, 0xff, 2);
- memcpy((char *)&bind_addr.in6.sin6_addr+12,
- &c->bind_addr->in.sin_addr, 4);
- } else /* just make a local copy */
-#endif
-#endif
- memcpy(&bind_addr, c->bind_addr, (size_t)addr_len(c->bind_addr));
+ memcpy(&bind_addr, c->bind_addr, (size_t)addr_len(c->bind_addr));
 /* perform the initial sanity checks before creating a socket */
 if(bind_addr.sa.sa_family!=domain) {
 s_log(LOG_DEBUG, "Cannot assign an AF=%d address an AF=%d socket",
 bind_addr.sa.sa_family, domain);
 return 1; /* failure */
 }
+ } else {
+ /* only needed to avoid a warning in MSVC */
+ memset(&bind_addr, 0, sizeof bind_addr);
 }
 
 /* create a new socket */
@@ -1608,12 +1781,19 @@
 }
 
 NOEXPORT int redirect(CLI *c) {
+ SSL_SESSION *sess;
+ void *ex_data;
+
 if(!c->opt->redirect_addr.names)
 return 0; /* redirect not configured */
 if(!c->ssl)
 return 1; /* TLS not established -> always redirect */
- return !SSL_SESSION_get_ex_data(SSL_get_session(c->ssl),
- index_session_authenticated);
+ sess=SSL_get1_session(c->ssl);
+ if(!sess)
+ return 1; /* no TLS session -> always redirect */
+ ex_data=SSL_SESSION_get_ex_data(sess, index_session_authenticated);
+ SSL_SESSION_free(sess);
+ return ex_data == NULL;
 }
 
 NOEXPORT void print_bound_address(CLI *c) {
@@ -1634,13 +1814,18 @@
 str_free(txt);
 }
 
-NOEXPORT void reset(SOCKET fd, char *txt) { /* set lingering on a socket */
+NOEXPORT void reset(SOCKET fd, const char *txt) { /* set lingering on a socket */
 struct linger l;
 
+ s_log(LOG_DEBUG, "%s reset (FD=%ld)", txt, (long)fd);
 l.l_onoff=1;
 l.l_linger=0;
- if(setsockopt(fd, SOL_SOCKET, SO_LINGER, (void *)&l, sizeof l))
- log_error(LOG_DEBUG, get_last_socket_error(), txt);
+ if(setsockopt(fd, SOL_SOCKET, SO_LINGER, (void *)&l, sizeof l)) {
+ int err=get_last_socket_error();
+ char *message=str_printf("setsockopt(SO_LINGER) on %s", txt);
+ log_error(LOG_INFO, err, message);
+ str_free(message);
+ }
 }
 
 void throw_exception(CLI *c, int v) {

_service:tar_scm:stunnel-5.48.tar.gz/src/common.h -> _service:tar_scm:stunnel-5.69.tar.gz/src/common.h Changed

@@ -1,6 +1,6 @@
 /*
 * stunnel TLS offloading and load-balancing proxy
- * Copyright (C) 1998-2018 Michal Trojnara <Michal.Trojnara@stunnel.org>
+ * Copyright (C) 1998-2023 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
@@ -42,6 +42,8 @@
 
 /**************************************** common constants */
 
+#define DEFAULT_SECURITY_LEVEL 2
+
 #define LIBWRAP_CLIENTS 5
 
 /* CPU stack size */
@@ -102,7 +104,6 @@
 typedef int ssize_t;
 #endif /* _WIN64 */
 #endif /* !__MINGW32__ */
-#define PATH_MAX MAX_PATH
 #define USE_IPv6
 #define _CRT_SECURE_NO_DEPRECATE
 #define _CRT_NONSTDC_NO_DEPRECATE
@@ -225,7 +226,6 @@
 #define vsnprintf _vsnprintf
 #define strcasecmp _stricmp
 #define strncasecmp _strnicmp
-#define sleep(c) Sleep(1000*(c))
 
 #define get_last_socket_error() WSAGetLastError()
 #define set_last_socket_error(e) WSASetLastError(e)
@@ -242,6 +242,9 @@
 #include <ws2tcpip.h>
 
 #include <windows.h>
+#include <windowsx.h>
+
+#include <malloc.h> /* _alloca */
 
 #include <process.h> /* _beginthread */
 #include <shlobj.h> /* SHGetFolderPath */
@@ -249,6 +252,10 @@
 
 #include "resources.h"
 
+#ifndef PRIX64
+#define PRIX64 "I64X"
+#endif
+
 /**************************************** non-WIN32 headers */
 
 #else /* USE_WIN32 */
@@ -317,6 +324,9 @@
 #include <sys/select.h> /* for aix */
 #endif
 #include <dirent.h>
+#ifdef HAVE_SYS_PARAM_H
+#include <sys/param.h> /* MAXPATHLEN */
+#endif
 
 #if defined(HAVE_POLL) && !defined(BROKEN_POLL)
 #ifdef HAVE_POLL_H
@@ -408,6 +418,9 @@
 
 /**************************************** OpenSSL headers */
 
+/* TODO: remove this after migrating to the OpenSSL 3.0 API */
+#define OPENSSL_SUPPRESS_DEPRECATED
+
 #define OPENSSL_THREAD_DEFINES
 #include <openssl/opensslconf.h>
 /* opensslv.h requires prior opensslconf.h to include -fips in version string */
@@ -452,9 +465,14 @@
 #endif /* !defined(OPENSSL_NO_SSL2) */
 #else /* OpenSSL older than 1.1.0 */
 #define X509_STORE_CTX_get0_chain(x) X509_STORE_CTX_get_chain(x)
+#define OPENSSL_hexstr2buf string_to_hex
 #endif /* OpenSSL 1.1.0 or newer */
 
-#if defined(USE_WIN32) && defined(OPENSSL_FIPS)
+#if OPENSSL_VERSION_NUMBER<0x10101000L
+#define OPENSSL_NO_TLS1_3
+#endif /* OpenSSL older than 1.1.1 */
+
+#ifdef USE_WIN32
 #define USE_FIPS
 #endif
 
@@ -475,7 +493,7 @@
 #include <openssl/dh.h>
 #if OPENSSL_VERSION_NUMBER<0x10100000L
 int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g);
-#endif /* OpenSSL older than 1.1.0 */
+#endif /* OPENSSL_VERSION_NUMBER<0x10100000L */
 #endif /* !defined(OPENSSL_NO_DH) */
 #ifndef OPENSSL_NO_ENGINE
 #include <openssl/engine.h>
@@ -487,6 +505,13 @@
 /* not defined in public headers before OpenSSL 0.9.8 */
 STACK_OF(SSL_COMP) *SSL_COMP_get_compression_methods(void);
 #endif /* !defined(OPENSSL_NO_COMP) */
+#if OPENSSL_VERSION_NUMBER>=0x10101000L
+#include <openssl/storeerr.h>
+#endif /* OPENSSL_VERSION_NUMBER>=0x10101000L */
+#if OPENSSL_VERSION_NUMBER>=0x30000000L
+#include <openssl/provider.h>
+#include <openssl/proverr.h>
+#endif /* OPENSSL_VERSION_NUMBER>=0x30000000L */
 
 #ifndef OPENSSL_VERSION
 #define OPENSSL_VERSION SSLEAY_VERSION
@@ -519,6 +544,16 @@
 #define offsetof(T, F) ((unsigned)((char *)&((T *)0L)->F - (char *)0L))
 #endif
 
+#define is_prefix(a, b) (strncasecmp((a), (b), strlen(b))==0)
+
+#ifndef va_copy
+#ifdef __va_copy
+#define va_copy(dst, src) __va_copy((dst), (src))
+#else /* __va_copy */
+#define va_copy(dst, src) memcpy(&(dst), &(src), sizeof(va_list))
+#endif /* __va_copy */
+#endif /* va_copy */
+
 #endif /* defined COMMON_H */
 
 /* end of common.h */

_service:tar_scm:stunnel-5.48.tar.gz/src/config.h.in -> _service:tar_scm:stunnel-5.69.tar.gz/src/config.h.in Changed

@@ -69,15 +69,15 @@
 /* Define to 1 if you have the <malloc.h> header file. */
 #undef HAVE_MALLOC_H
 
-/* Define to 1 if you have the <memory.h> header file. */
-#undef HAVE_MEMORY_H
-
 /* Define to 1 if you have 'msghdr.msg_control' structure. */
 #undef HAVE_MSGHDR_MSG_CONTROL
 
 /* Define to 1 if you have the `openpty' function. */
 #undef HAVE_OPENPTY
 
+/* Define to 1 if you have the `OSSL_PROVIDER_available' function. */
+#undef HAVE_OSSL_PROVIDER_AVAILABLE
+
 /* Define to 1 if you have the `pipe2' function. */
 #undef HAVE_PIPE2
 
@@ -117,6 +117,9 @@
 /* Define to 1 if you have the <stdint.h> header file. */
 #undef HAVE_STDINT_H
 
+/* Define to 1 if you have the <stdio.h> header file. */
+#undef HAVE_STDIO_H
+
 /* Define to 1 if you have the <stdlib.h> header file. */
 #undef HAVE_STDLIB_H
 
@@ -150,6 +153,9 @@
 /* Define to 1 if you have the <sys/ioctl.h> header file. */
 #undef HAVE_SYS_IOCTL_H
 
+/* Define to 1 if you have the <sys/param.h> header file. */
+#undef HAVE_SYS_PARAM_H
+
 /* Define to 1 if you have the <sys/poll.h> header file. */
 #undef HAVE_SYS_POLL_H
 
@@ -241,7 +247,9 @@
 /* TLS directory */
 #undef SSLDIR
 
-/* Define to 1 if you have the ANSI C header files. */
+/* Define to 1 if all of the C90 standard headers exist (not just the ones
+ required in a freestanding environment). This macro is provided for
+ backward compatibility; new code need not use it. */
 #undef STDC_HEADERS
 
 /* Define to 1 to enable OpenSSL FIPS support */
@@ -271,11 +279,6 @@
 /* Use Darwin source */
 #undef _DARWIN_C_SOURCE
 
-/* Enable large inode numbers on Mac OS X 10.5. */
-#ifndef _DARWIN_USE_64_BIT_INODE
-# define _DARWIN_USE_64_BIT_INODE 1
-#endif
-
 /* Number of bits in a file offset, on hosts where this is settable. */
 #undef _FILE_OFFSET_BITS

_service:tar_scm:stunnel-5.48.tar.gz/src/cron.c -> _service:tar_scm:stunnel-5.69.tar.gz/src/cron.c Changed

@@ -1,6 +1,6 @@
 /*
 * stunnel TLS offloading and load-balancing proxy
- * Copyright (C) 1998-2018 Michal Trojnara <Michal.Trojnara@stunnel.org>
+ * Copyright (C) 1998-2023 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
@@ -35,25 +35,43 @@
 * forward this exception.
 */
 
-#include "common.h"
 #include "prototypes.h"
 
+/* run the per-day job every 24 hours */
+#define PER_DAY_PERIOD (24*60*60)
+
+#ifdef USE_OS_THREADS
+THREAD_ID per_second_thread_id=(THREAD_ID)0, per_day_thread_id=(THREAD_ID)0;
+#endif
+
 #ifdef USE_PTHREAD
-NOEXPORT void *cron_thread(void *arg);
+NOEXPORT void *per_second_thread(void *arg);
+NOEXPORT void *per_day_thread(void *arg);
 #endif
+
 #ifdef USE_WIN32
-NOEXPORT unsigned __stdcall cron_thread(void *arg);
+NOEXPORT unsigned __stdcall per_second_thread(void *arg);
+NOEXPORT unsigned __stdcall per_day_thread(void *arg);
 #endif
+
 #ifdef USE_OS_THREADS
-NOEXPORT void cron_worker(void);
-NOEXPORT void cron_dh_param(void);
-#endif
+NOEXPORT void per_second_worker(void);
+NOEXPORT void per_day_worker(void);
+#ifndef OPENSSL_NO_DH
+#if OPENSSL_VERSION_NUMBER>=0x0090800fL
+NOEXPORT void per_day_dh_param(BN_GENCB *);
+NOEXPORT BN_GENCB *per_day_bn_gencb(void);
+NOEXPORT int bn_callback(int, int, BN_GENCB *);
+#else /* OpenSSL older than 0.9.8 */
+NOEXPORT void per_day_dh_param(void);
+NOEXPORT void dh_callback(int, int, void *);
+#endif /* OpenSSL 0.9.8 or later */
+#endif /* OPENSSL_NO_DH */
+#endif /* USE_OS_THREADS */
 
 #if defined(USE_PTHREAD)
 
 int cron_init() {
- pthread_t thread;
- pthread_attr_t pth_attr;
 #if defined(HAVE_PTHREAD_SIGMASK) && !defined(__APPLE__)
 sigset_t new_set, old_set;
 #endif /* HAVE_PTHREAD_SIGMASK && !__APPLE__*/
@@ -62,53 +80,71 @@
 sigfillset(&new_set);
 pthread_sigmask(SIG_SETMASK, &new_set, &old_set); /* block signals */
 #endif /* HAVE_PTHREAD_SIGMASK && !__APPLE__*/
- pthread_attr_init(&pth_attr);
- pthread_attr_setdetachstate(&pth_attr, PTHREAD_CREATE_DETACHED);
- if(pthread_create(&thread, &pth_attr, cron_thread, NULL))
+ CRYPTO_THREAD_write_lock(stunnel_locksLOCK_THREAD_LIST);
+ if(pthread_create(&per_second_thread_id, NULL, per_second_thread, NULL))
+ ioerror("pthread_create");
+ if(pthread_create(&per_day_thread_id, NULL, per_day_thread, NULL))
 ioerror("pthread_create");
- pthread_attr_destroy(&pth_attr);
+ CRYPTO_THREAD_unlock(stunnel_locksLOCK_THREAD_LIST);
 #if defined(HAVE_PTHREAD_SIGMASK) && !defined(__APPLE__)
 pthread_sigmask(SIG_SETMASK, &old_set, NULL); /* unblock signals */
 #endif /* HAVE_PTHREAD_SIGMASK && !__APPLE__*/
 return 0;
 }
 
-NOEXPORT void *cron_thread(void *arg) {
+NOEXPORT void *per_second_thread(void *arg) {
+ (void)arg; /* squash the unused parameter warning */
+ tls_alloc(NULL, NULL, "per-second");
+ per_second_worker();
+ return NULL; /* it should never be executed */
+}
+
+NOEXPORT void *per_day_thread(void *arg) {
 #ifdef SCHED_BATCH
 struct sched_param param;
 #endif
 
 (void)arg; /* squash the unused parameter warning */
- tls_alloc(NULL, NULL, "cron");
+ tls_alloc(NULL, NULL, "per-day");
 #ifdef SCHED_BATCH
 param.sched_priority=0;
 if(pthread_setschedparam(pthread_self(), SCHED_BATCH, &param))
 ioerror("pthread_getschedparam");
 #endif
- cron_worker();
+ per_day_worker();
 return NULL; /* it should never be executed */
 }
 
 #elif defined(USE_WIN32)
 
 int cron_init() {
- HANDLE handle;
-
- handle=(HANDLE)_beginthreadex(NULL, 0, cron_thread, NULL, 0, NULL);
- if(!handle) {
+ CRYPTO_THREAD_write_lock(stunnel_locksLOCK_THREAD_LIST);
+ per_second_thread_id=(HANDLE)_beginthreadex(NULL, 0, per_second_thread, NULL, 0, NULL);
+ per_day_thread_id=(HANDLE)_beginthreadex(NULL, 0, per_day_thread, NULL, 0, NULL);
+ CRYPTO_THREAD_unlock(stunnel_locksLOCK_THREAD_LIST);
+ if(!per_day_thread_id || !per_day_thread_id) {
 ioerror("_beginthreadex");
 return 1;
 }
- CloseHandle(handle);
 return 0;
 }
 
-NOEXPORT unsigned __stdcall cron_thread(void *arg) {
+NOEXPORT unsigned __stdcall per_second_thread(void *arg) {
+ (void)arg; /* squash the unused parameter warning */
+
+ tls_alloc(NULL, NULL, "per-second");
+ per_second_worker();
+ _endthreadex(0); /* it should never be executed */
+ return 0;
+}
+
+NOEXPORT unsigned __stdcall per_day_thread(void *arg) {
 (void)arg; /* squash the unused parameter warning */
- tls_alloc(NULL, NULL, "cron");
+
+ tls_alloc(NULL, NULL, "per-day");
 if(!SetThreadPriority(GetCurrentThread(), THREAD_PRIORITY_LOWEST))
 ioerror("SetThreadPriority");
- cron_worker();
+ per_day_worker();
 _endthreadex(0); /* it should never be executed */
 return 0;
 }
@@ -122,36 +158,52 @@
 
 #endif
 
-/* run the cron job every 24 hours */
-#define CRON_PERIOD (24*60*60)
-
 #ifdef USE_OS_THREADS
 
-NOEXPORT void cron_worker(void) {
+NOEXPORT void per_second_worker(void) {
+ s_log(LOG_DEBUG, "Per-second thread initialized");
+ for(;;) {
+ s_poll_sleep(1, 0); /* 1 second */
+ CRYPTO_THREAD_read_lock(stunnel_locksLOCK_LOG_MODE);
+ file_flush(outfile);
+ CRYPTO_THREAD_unlock(stunnel_locksLOCK_LOG_MODE);
+ }
+}
+
+NOEXPORT void per_day_worker(void) {
 time_t now, then;
 int delay;
+#if !defined(OPENSSL_NO_DH) && OPENSSL_VERSION_NUMBER>=0x0090800fL
+ BN_GENCB *bn_gencb;
+#endif
 
- s_log(LOG_DEBUG, "Cron thread initialized");
- sleep(60); /* allow the other services to start with idle CPU */
+ s_log(LOG_DEBUG, "Per-day thread initialized");
+#if !defined(OPENSSL_NO_DH) && OPENSSL_VERSION_NUMBER>=0x0090800fL
+ bn_gencb=per_day_bn_gencb();
+#endif
 time(&then);
 for(;;) {
- s_log(LOG_INFO, "Executing cron jobs");
+ s_log(LOG_INFO, "Executing per-day jobs");
 #ifndef OPENSSL_NO_DH
- cron_dh_param();
+#if OPENSSL_VERSION_NUMBER>=0x0090800fL
+ per_day_dh_param(bn_gencb);
+#else /* OpenSSL older than 0.9.8 */
+ per_day_dh_param();
+#endif /* OpenSSL 0.9.8 or later */
 #endif /* OPENSSL_NO_DH */
 time(&now);
- s_log(LOG_INFO, "Cron jobs completed in %d seconds", (int)(now-then));
- then+=CRON_PERIOD;
+ s_log(LOG_INFO, "Per-day jobs completed in %d seconds", (int)(now-then));
+ then+=PER_DAY_PERIOD;
 if(then>now) {
 delay=(int)(then-now);
 } else {
- s_log(LOG_NOTICE, "Cron backlog cleared (possible hibernation)");
- delay=CRON_PERIOD-(int)(now-then)%CRON_PERIOD;
+ s_log(LOG_NOTICE, "Per-day backlog cleared (possible hibernation)");
+ delay=PER_DAY_PERIOD-(int)(now-then)%PER_DAY_PERIOD;
 then=now+delay;
 }
 s_log(LOG_DEBUG, "Waiting %d seconds", delay);
- do { /* retry sleep() if it was interrupted by a signal */
- sleep((unsigned)delay);
+ do { /* retry s_poll_sleep() if it was interrupted by a signal */
+ s_poll_sleep(delay, 0);
 time(&now);
 delay=(int)(then-now);
 } while(delay>0);
@@ -161,11 +213,16 @@
 }
 
 #ifndef OPENSSL_NO_DH
-NOEXPORT void cron_dh_param(void) {
+
+#if OPENSSL_VERSION_NUMBER>=0x0090800fL
+NOEXPORT void per_day_dh_param(BN_GENCB *bn_gencb) {
+#else /* OpenSSL older than 0.9.8 */
+NOEXPORT void per_day_dh_param(void) {
+#endif /* OpenSSL 0.9.8 or later */
 SERVICE_OPTIONS *opt;
 DH *dh;
 
- if(!dh_needed)
+ if(!dh_temp_params || !service_options.next)
 return;
 
 s_log(LOG_NOTICE, "Updating DH parameters");
@@ -176,18 +233,18 @@
 sslerror("DH_new");
 return;
 }
- if(!DH_generate_parameters_ex(dh, 2048, 2, NULL)) {
+ if(!DH_generate_parameters_ex(dh, 2048, 2, bn_gencb)) {
 DH_free(dh);
 sslerror("DH_generate_parameters_ex");
 return;
 }
 #else /* OpenSSL older than 0.9.8 */
- dh=DH_generate_parameters(2048, 2, NULL, NULL);
+ dh=DH_generate_parameters(2048, 2, dh_callback, NULL);
 if(!dh) {
 sslerror("DH_generate_parameters");
 return;
 }
-#endif
+#endif /* OpenSSL 0.9.8 or later */
 
 /* update global dh_params for future configuration reloads */
 CRYPTO_THREAD_write_lock(stunnel_locksLOCK_DH);
@@ -196,11 +253,54 @@
 CRYPTO_THREAD_unlock(stunnel_locksLOCK_DH);
 
 /* set for all sections that require it */
+ CRYPTO_THREAD_read_lock(stunnel_locksLOCK_SECTIONS);
 for(opt=service_options.next; opt; opt=opt->next)
- if(opt->option.dh_needed)
+ if(opt->option.dh_temp_params)
 SSL_CTX_set_tmp_dh(opt->ctx, dh);
+ CRYPTO_THREAD_unlock(stunnel_locksLOCK_SECTIONS);
 s_log(LOG_NOTICE, "DH parameters updated");
 }
+
+#if OPENSSL_VERSION_NUMBER>=0x0090800fL
+
+NOEXPORT BN_GENCB *per_day_bn_gencb(void) {
+#if OPENSSL_VERSION_NUMBER>=0x10100000L
+ BN_GENCB *bn_gencb;
+
+ bn_gencb=BN_GENCB_new();
+ if(!bn_gencb) {
+ sslerror("BN_GENCB_new");
+ return NULL;
+ }
+ BN_GENCB_set(bn_gencb, bn_callback, NULL);
+ return bn_gencb;
+#else
+ static BN_GENCB bn_gencb;
+
+ BN_GENCB_set(&bn_gencb, bn_callback, NULL);
+ return &bn_gencb;
+#endif
+}
+
+NOEXPORT int bn_callback(int p, int n, BN_GENCB *cb) {
+ (void)p; /* squash the unused parameter warning */
+ (void)n; /* squash the unused parameter warning */
+ (void)cb; /* squash the unused parameter warning */
+ s_poll_sleep(0, 100); /* 100ms */
+ return 1; /* return nonzero for success */
+}
+
+#else /* OpenSSL older than 0.9.8 */
+
+NOEXPORT void dh_callback(int p, int n, void *arg) {
+ (void)p; /* squash the unused parameter warning */
+ (void)n; /* squash the unused parameter warning */
+ (void)arg; /* squash the unused parameter warning */
+ s_poll_sleep(0, 100); /* 100ms */
+}
+
+#endif /* OpenSSL 0.9.8 or later */
+
 #endif /* OPENSSL_NO_DH */
 
 #endif /* USE_OS_THREADS */

_service:tar_scm:stunnel-5.48.tar.gz/src/ctx.c -> _service:tar_scm:stunnel-5.69.tar.gz/src/ctx.c Changed

@@ -1,6 +1,6 @@
 /*
 * stunnel TLS offloading and load-balancing proxy
- * Copyright (C) 1998-2018 Michal Trojnara <Michal.Trojnara@stunnel.org>
+ * Copyright (C) 1998-2023 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
@@ -35,9 +35,12 @@
 * forward this exception.
 */
 
-#include "common.h"
 #include "prototypes.h"
 
+#if defined(__GNUC__) && defined(USE_WIN32)
+#pragma GCC diagnostic ignored "-Wformat"
+#endif /* defined(__GNUC__) && defined(USE_WIN32) */
+
 SERVICE_OPTIONS *current_section=NULL;
 
 /* try an empty passphrase first */
@@ -46,7 +49,7 @@
 
 #ifndef OPENSSL_NO_DH
 DH *dh_params=NULL;
-int dh_needed=0;
+int dh_temp_params=0;
 #endif /* OPENSSL_NO_DH */
 
 /**************************************** prototypes */
@@ -88,7 +91,19 @@
 NOEXPORT int cache_passwd_get_cb(char *, int, int, void *);
 NOEXPORT int cache_passwd_set_cb(char *, int, int, void *);
 NOEXPORT void set_prompt(const char *);
-NOEXPORT int ui_retry();
+NOEXPORT int ui_retry(void);
+
+/* session tickets */
+#if OPENSSL_VERSION_NUMBER >= 0x10101000L
+NOEXPORT int generate_session_ticket_cb(SSL *, void *);
+NOEXPORT int decrypt_session_ticket_cb(SSL *, SSL_SESSION *,
+ const unsigned char *, size_t, SSL_TICKET_STATUS, void *);
+#endif /* OpenSSL 1.1.1 or later */
+
+#if OPENSSL_VERSION_NUMBER>=0x10000000L
+NOEXPORT int ssl_tlsext_ticket_key_cb(SSL *, unsigned char *,
+ unsigned char *, EVP_CIPHER_CTX *, HMAC_CTX *, int);
+#endif /* OpenSSL 1.0.0 or later */
 
 /* session callbacks */
 NOEXPORT int sess_new_cb(SSL *, SSL_SESSION *);
@@ -114,7 +129,7 @@
 NOEXPORT void info_callback(const SSL *, int, int);
 
 NOEXPORT void sslerror_queue(void);
-NOEXPORT void sslerror_log(unsigned long, char *);
+NOEXPORT void sslerror_log(unsigned long, const char *, int, const char *);
 
 /**************************************** initialize section->ctx */
 
@@ -125,22 +140,68 @@
 #endif
 
 int context_init(SERVICE_OPTIONS *section) { /* init TLS context */
- /* create TLS context */
+ /* create a new TLS context */
+#if OPENSSL_VERSION_NUMBER>=0x10100000L
+#if OPENSSL_VERSION_NUMBER>=0x30000000L
+ section->ctx=SSL_CTX_new_ex(NULL,
+ EVP_default_properties_is_fips_enabled(NULL) ?
+ "fips=yes" : "provider!=fips",
+ section->option.client ?
+ TLS_client_method() : TLS_server_method());
+#else /* OPENSSL_VERSION_NUMBER<0x30000000L */
+ section->ctx=SSL_CTX_new(section->option.client ?
+ TLS_client_method() : TLS_server_method());
+#endif /* OPENSSL_VERSION_NUMBER>=0x30000000L */
+ if(section->min_proto_version &&
+ !SSL_CTX_set_min_proto_version(section->ctx,
+ section->min_proto_version)) {
+ s_log(LOG_ERR, "Failed to set the minimum protocol version 0x%X",
+ section->min_proto_version);
+ return 1; /* FAILED */
+ }
+ if(section->max_proto_version &&
+ !SSL_CTX_set_max_proto_version(section->ctx,
+ section->max_proto_version)) {
+ s_log(LOG_ERR, "Failed to set the maximum protocol version 0x%X",
+ section->max_proto_version);
+ return 1; /* FAILED */
+ }
+#else /* OPENSSL_VERSION_NUMBER<0x10100000L */
 if(section->option.client)
 section->ctx=SSL_CTX_new(section->client_method);
 else /* server mode */
 section->ctx=SSL_CTX_new(section->server_method);
+#endif /* OPENSSL_VERSION_NUMBER<0x10100000L */
 if(!section->ctx) {
 sslerror("SSL_CTX_new");
 return 1; /* FAILED */
 }
- /* for callbacks */
+
+ /* allow callbacks to access their SERVICE_OPTIONS structure */
 if(!SSL_CTX_set_ex_data(section->ctx, index_ssl_ctx_opt, section)) {
 sslerror("SSL_CTX_set_ex_data");
 return 1; /* FAILED */
 }
 current_section=section; /* setup current section for callbacks */
 
+#if OPENSSL_VERSION_NUMBER>=0x10100000L
+ /* set the security level */
+ if(section->security_level>=0) {
+ /* set the user-specified value */
+ SSL_CTX_set_security_level(section->ctx, section->security_level);
+ s_log(LOG_INFO, "User-specified security level set: %d",
+ section->security_level);
+ } else if(SSL_CTX_get_security_level(section->ctx)<DEFAULT_SECURITY_LEVEL) {
+ /* set our default, as it is more secure than the OpenSSL default */
+ SSL_CTX_set_security_level(section->ctx, DEFAULT_SECURITY_LEVEL);
+ s_log(LOG_INFO, "stunnel default security level set: %d",
+ DEFAULT_SECURITY_LEVEL);
+ } else { /* our default is not more secure than the OpenSSL default */
+ s_log(LOG_INFO, "OpenSSL security level is used: %d",
+ SSL_CTX_get_security_level(section->ctx));
+ }
+#endif /* OpenSSL 1.1.0 or later */
+
 /* ciphers */
 if(section->cipher_list) {
 s_log(LOG_DEBUG, "Ciphers: %s", section->cipher_list);
@@ -150,8 +211,26 @@
 }
 }
 
+#ifndef OPENSSL_NO_TLS1_3
+ /* ciphersuites */
+ if(section->ciphersuites) {
+ s_log(LOG_DEBUG, "TLSv1.3 ciphersuites: %s", section->ciphersuites);
+ if(!SSL_CTX_set_ciphersuites(section->ctx, section->ciphersuites)) {
+ sslerror("SSL_CTX_set_ciphersuites");
+ return 1; /* FAILED */
+ }
+ }
+#endif /* TLS 1.3 */
+
 /* TLS options: configure the stunnel defaults first */
 SSL_CTX_set_options(section->ctx, SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3);
+ /* no session ticket gets sent to the client at all in TLSv1.2
+ and below, but a stateful ticket will be sent in TLSv1.3 */
+#ifdef SSL_OP_NO_TICKET
+ if(!section->option.client && !section->option.session_resume) {
+ SSL_CTX_set_options(section->ctx, SSL_OP_NO_TICKET);
+ }
+#endif
 #ifdef SSL_OP_NO_COMPRESSION
 /* we implemented a better way to disable compression if needed */
 SSL_CTX_clear_options(section->ctx, SSL_OP_NO_COMPRESSION);
@@ -167,11 +246,12 @@
 
 /* TLS options: log the configured values */
 #if OPENSSL_VERSION_NUMBER>=0x009080dfL
- s_log(LOG_DEBUG, "TLS options: 0x%08lX (+0x%08lX, -0x%08lX)",
+ s_log(LOG_DEBUG,
+ "TLS options: 0x%" PRIX64 " (+0x%" PRIX64 ", -0x%" PRIX64 ")",
 SSL_CTX_get_options(section->ctx),
 section->ssl_options_set, section->ssl_options_clear);
 #else /* OpenSSL older than 0.9.8m */
- s_log(LOG_DEBUG, "TLS options: 0x%08lX (+0x%08lX)",
+ s_log(LOG_DEBUG, "TLS options: 0x%" PRIX64 " (+0x%" PRIX64 ")",
 SSL_CTX_get_options(section->ctx), section->ssl_options_set);
 #endif /* OpenSSL 0.9.8m or later */
 
@@ -179,7 +259,7 @@
 if(conf_init(section))
 return 1; /* FAILED */
 
- /* mode */
+ /* setup mode of operation for the TLS state machine */
 #ifdef SSL_MODE_RELEASE_BUFFERS
 SSL_CTX_set_mode(section->ctx,
 SSL_MODE_ENABLE_PARTIAL_WRITE |
@@ -191,19 +271,43 @@
 SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
 #endif
 
+ /* setup session tickets */
+#if OPENSSL_VERSION_NUMBER >= 0x10101000L
+ SSL_CTX_set_session_ticket_cb(section->ctx, generate_session_ticket_cb,
+ decrypt_session_ticket_cb, NULL);
+#endif /* OpenSSL 1.1.1 or later */
+
+#if OPENSSL_VERSION_NUMBER>=0x10000000L
+ if((section->ticket_key)&&(section->ticket_mac))
+ SSL_CTX_set_tlsext_ticket_key_cb(section->ctx, ssl_tlsext_ticket_key_cb);
+#endif /* OpenSSL 1.0.0 or later */
+
 /* setup session cache */
 if(!section->option.client) {
 unsigned servname_len=(unsigned)strlen(section->servname);
 if(servname_len>SSL_MAX_SSL_SESSION_ID_LENGTH)
 servname_len=SSL_MAX_SSL_SESSION_ID_LENGTH;
+#ifndef OPENSSL_NO_TLS1_3
+ /* suppress all tickets (stateful and stateless) in TLSv1.3 */
+ if(!section->option.session_resume && !SSL_CTX_set_num_tickets(section->ctx, 0)) {
+ sslerror("SSL_CTX_set_num_tickets");
+ return 1; /* FAILED */
+ }
+#endif /* TLS 1.3 */
 if(!SSL_CTX_set_session_id_context(section->ctx,
 (unsigned char *)section->servname, servname_len)) {
 sslerror("SSL_CTX_set_session_id_context");
 return 1; /* FAILED */
 }
 }
- SSL_CTX_set_session_cache_mode(section->ctx,
- SSL_SESS_CACHE_BOTH | SSL_SESS_CACHE_NO_INTERNAL_STORE);
+ if(section->option.session_resume) {
+ SSL_CTX_set_session_cache_mode(section->ctx,
+ SSL_SESS_CACHE_BOTH | SSL_SESS_CACHE_NO_INTERNAL_STORE);
+ } else {
+ SSL_CTX_set_session_cache_mode(section->ctx, SSL_SESS_CACHE_OFF);
+ }
+ s_log(LOG_INFO, "Session resumption %s", section->option.session_resume
+ ? "enabled" : "disabled");
 SSL_CTX_sess_set_cache_size(section->ctx, section->session_size);
 SSL_CTX_set_timeout(section->ctx, section->session_timeout);
 SSL_CTX_sess_set_new_cb(section->ctx, sess_new_cb);
@@ -221,18 +325,18 @@
 if(verify_init(section))
 return 1; /* FAILED */
 
- /* initialize the DH/ECDH key agreement in the server mode */
- if(!section->option.client) {
+ /* initialize the DH/ECDH key agreement */
 #ifndef OPENSSL_NO_TLSEXT
+ if(!section->option.client)
 SSL_CTX_set_tlsext_servername_callback(section->ctx, servername_cb);
 #endif /* OPENSSL_NO_TLSEXT */
 #ifndef OPENSSL_NO_DH
- dh_init(section); /* ignore the result (errors are not critical) */
+ dh_init(section); /* ignore the result (errors are not critical) */
 #endif /* OPENSSL_NO_DH */
 #ifndef OPENSSL_NO_ECDH
- ecdh_init(section); /* ignore the result (errors are not critical) */
+ if(ecdh_init(section))
+ return 1; /* FAILED */
 #endif /* OPENSSL_NO_ECDH */
- }
 
 return 0; /* OK */
 }
@@ -323,8 +427,13 @@
 char description128;
 STACK_OF(SSL_CIPHER) *ciphers;
 
- /* check if DH is actually enabled for this section */
- section->option.dh_needed=0;
+ section->option.dh_temp_params=0; /* disable by default */
+
+ /* check if DH is needed for this section */
+ if(section->option.client) {
+ s_log(LOG_INFO, "DH initialization skipped: client section");
+ return 0; /* OK */
+ }
 ciphers=SSL_CTX_get_ciphers(section->ctx);
 if(!ciphers)
 return 1; /* ERROR (unlikely) */
@@ -335,12 +444,15 @@
 description, sizeof description);
 /* s_log(LOG_INFO, "Ciphersuite: %s", description); */
 if(strstr(description, " Kx=DH")) {
- section->option.dh_needed=1; /* update this context */
+ s_log(LOG_INFO, "DH initialization needed for %s",
+ SSL_CIPHER_get_name(sk_SSL_CIPHER_value(ciphers, i)));
 break;
 }
 }
- if(!section->option.dh_needed) /* no DH ciphers found */
+ if(i==n) { /* no DH ciphers found */
+ s_log(LOG_INFO, "DH initialization skipped: no DH ciphersuites");
 return 0; /* OK */
+ }
 
 s_log(LOG_DEBUG, "DH initialization");
 #ifndef OPENSSL_NO_ENGINE
@@ -356,8 +468,8 @@
 CRYPTO_THREAD_read_lock(stunnel_locksLOCK_DH);
 SSL_CTX_set_tmp_dh(section->ctx, dh_params);
 CRYPTO_THREAD_unlock(stunnel_locksLOCK_DH);
- dh_needed=1; /* generate temporary DH parameters in cron */
- section->option.dh_needed=1; /* update this context */
+ dh_temp_params=1; /* generate temporary DH parameters in cron */
+ section->option.dh_temp_params=1; /* update this section in cron */
 s_log(LOG_INFO, "Using dynamic DH parameters");
 return 0; /* OK */
 }
@@ -392,23 +504,43 @@
 /**************************************** ECDH initialization */
 
 #ifndef OPENSSL_NO_ECDH
-NOEXPORT int ecdh_init(SERVICE_OPTIONS *section) {
+
+#if OPENSSL_VERSION_NUMBER < 0x10101000L
+/* simplified version that only supports a single curve */
+NOEXPORT int SSL_CTX_set1_groups_list(SSL_CTX *ctx, char *list) {
+ int nid;
 EC_KEY *ecdh;
 
- s_log(LOG_DEBUG, "ECDH initialization");
- ecdh=EC_KEY_new_by_curve_name(section->curve);
+ nid=OBJ_txt2nid(list);
+ if(nid==NID_undef) {
+ s_log(LOG_ERR, "Unsupported curve: %s", list);
+ return 0; /* FAILED */
+ }
+ ecdh=EC_KEY_new_by_curve_name(nid);
 if(!ecdh) {
 sslerror("EC_KEY_new_by_curve_name");
- s_log(LOG_ERR, "Cannot create curve %s",
- OBJ_nid2ln(section->curve));
- return 1; /* FAILED */
+ return 0; /* FAILED */
+ }
+ if(!SSL_CTX_set_tmp_ecdh(ctx, ecdh)) {
+ sslerror("SSL_CTX_set_tmp_ecdhSSL_CTX_set_tmp_ecdh");
+ EC_KEY_free(ecdh);
+ return 0; /* FAILED */
 }
- SSL_CTX_set_tmp_ecdh(section->ctx, ecdh);
 EC_KEY_free(ecdh);
- s_log(LOG_DEBUG, "ECDH initialized with curve %s",
- OBJ_nid2ln(section->curve));
+ return 1; /* OK */
+}
+#endif /* OpenSSL version < 1.1.1 */
+
+NOEXPORT int ecdh_init(SERVICE_OPTIONS *section) {
+ s_log(LOG_DEBUG, "ECDH initialization");
+ if(!SSL_CTX_set1_groups_list(section->ctx, section->curves)) {
+ s_log(LOG_ERR, "Invalid groups list in 'curves'");
+ return 1; /* FAILED */
+ }
+ s_log(LOG_DEBUG, "ECDH initialized with curves %s", section->curves);
 return 0; /* OK */
 }
+
 #endif /* OPENSSL_NO_ECDH */
 
 /**************************************** initialize OpenSSL CONF */
@@ -577,37 +709,25 @@
 unsigned char *psk, unsigned max_psk_len) {
 CLI *c;
 PSK_KEYS *found;
- size_t len;
 
 c=SSL_get_ex_data(ssl, index_ssl_cli);
 found=psk_find(&c->opt->psk_sorted, identity);
- if(found) {
- len=found->key_len;
- } else {
- s_log(LOG_ERR, "No key found for PSK identity \"%s\"", identity);
- len=0;
+ if(!found) {
+ s_log(LOG_INFO, "PSK identity not found (session resumption?)");
+ return 0;
 }
- if(len>max_psk_len) {
- s_log(LOG_ERR, "PSK too long (%lu>%d bytes)",
- (long unsigned)len, max_psk_len);
- len=0;
- }
- if(len) {
- memcpy(psk, found->key_val, len);
- s_log(LOG_NOTICE, "Key configured for PSK identity \"%s\"", identity);
- } else { /* block identity probes if possible */
- if(max_psk_len>=32 && RAND_bytes(psk, 32)>0) {
- len=32; /* 256 random bits */
- s_log(LOG_ERR, "Configured random PSK");
- } else {
- s_log(LOG_ERR, "Rejecting with unknown_psk_identity alert");
- }
+ if(found->key_len>max_psk_len) {
+ s_log(LOG_ERR, "PSK too long (%u>%u)", found->key_len, max_psk_len);
+ return 0;
 }
- return (unsigned)len;
+ memcpy(psk, found->key_val, found->key_len);
+ s_log(LOG_NOTICE, "Key configured for PSK identity \"%s\"", identity);
+ c->flag.psk=1;
+ return found->key_len;
 }
 
 NOEXPORT int psk_compar(const void *a, const void *b) {
- PSK_KEYS *x=*(PSK_KEYS **)a, *y=*(PSK_KEYS **)b;
+ const PSK_KEYS *x=*(PSK_KEYS *const*)a, *y=*(PSK_KEYS *const*)b;
 
 #if 0
 s_log(LOG_DEBUG, "PSK cmp: %s %s", x->identity, y->identity);
@@ -639,7 +759,7 @@
 PSK_KEYS *psk_find(const PSK_TABLE *table, const char *identity) {
 PSK_KEYS key, *ptr=&key, **ret;
 
- key.identity=(char *)identity;
+ key.identity=identity;
 ret=bsearch(&ptr,
 table->val, table->num, sizeof(PSK_KEYS *), psk_compar);
 return ret ? *ret : NULL;
@@ -775,27 +895,39 @@
 #ifndef OPENSSL_NO_ENGINE
 
 NOEXPORT int load_cert_engine(SERVICE_OPTIONS *section) {
- struct {
- const char *id;
- X509 *cert;
- } parms;
+ X509 *cert;
 
 s_log(LOG_INFO, "Loading certificate from engine ID: %s", section->cert);
- parms.id=section->cert;
- parms.cert=NULL;
- ENGINE_ctrl_cmd(section->engine, "LOAD_CERT_CTRL", 0, &parms, NULL, 1);
- if(!parms.cert) {
- sslerror("ENGINE_ctrl_cmd");
+ cert=engine_get_cert(section->engine, section->cert);
+ if(!cert)
 return 1; /* FAILED */
- }
- if(!SSL_CTX_use_certificate(section->ctx, parms.cert)) {
+ if(!SSL_CTX_use_certificate(section->ctx, cert)) {
 sslerror("SSL_CTX_use_certificate");
+ X509_free(cert);
 return 1; /* FAILED */
 }
 s_log(LOG_INFO, "Certificate loaded from engine ID: %s", section->cert);
+ X509_free(cert);
 return 0; /* OK */
 }
 
+UI_METHOD *ui_stunnel() {
+ static UI_METHOD *ui_method=NULL;
+
+ if(ui_method) /* already initialized */
+ return ui_method;
+ ui_method=UI_create_method("stunnel UI");
+ if(!ui_method) {
+ sslerror("UI_create_method");
+ return NULL;
+ }
+ UI_method_set_opener(ui_method, ui_get_opener());
+ UI_method_set_writer(ui_method, ui_get_writer());
+ UI_method_set_reader(ui_method, ui_get_reader());
+ UI_method_set_closer(ui_method, ui_get_closer());
+ return ui_method;
+}
+
 NOEXPORT int load_key_engine(SERVICE_OPTIONS *section) {
 int i;
 EVP_PKEY *pkey;
@@ -807,7 +939,7 @@
 
 for(i=0; i<3; i++) {
 pkey=ENGINE_load_private_key(section->engine, section->key,
- UI_stunnel(), NULL);
+ ui_stunnel(), NULL);
 if(!pkey) {
 if(i<2 && ui_retry()) { /* wrong PIN */
 sslerror_queue(); /* dump the error queue */
@@ -866,50 +998,261 @@
 unsigned long err=ERR_peek_error();
 
 switch(ERR_GET_LIB(err)) {
- case ERR_LIB_ASN1:
- return 1;
- case ERR_LIB_PKCS12:
+ case ERR_LIB_EVP: /* 6 */
 switch(ERR_GET_REASON(err)) {
- case PKCS12_R_MAC_VERIFY_FAILURE:
+ case EVP_R_BAD_DECRYPT:
 return 1;
 default:
+ s_log(LOG_ERR, "Unhandled ERR_LIB_EVP error reason: %d",
+ ERR_GET_REASON(err));
 return 0;
 }
- case ERR_LIB_EVP:
+ case ERR_LIB_PEM: /* 9 */
 switch(ERR_GET_REASON(err)) {
- case EVP_R_BAD_DECRYPT:
+ case PEM_R_BAD_PASSWORD_READ:
+ case PEM_R_BAD_DECRYPT:
 return 1;
 default:
+ s_log(LOG_ERR, "Unhandled ERR_LIB_PEM error reason: %d",
+ ERR_GET_REASON(err));
 return 0;
 }
- case ERR_LIB_PEM:
+ case ERR_LIB_ASN1: /* 13 */
+ return 1;
+ case ERR_LIB_PKCS12: /* 35 */
 switch(ERR_GET_REASON(err)) {
- case PEM_R_BAD_PASSWORD_READ:
+ case PKCS12_R_MAC_VERIFY_FAILURE:
 return 1;
 default:
+ s_log(LOG_ERR, "Unhandled ERR_LIB_PKCS12 error reason: %d",
+ ERR_GET_REASON(err));
 return 0;
 }
- case ERR_LIB_UI:
+#ifdef ERR_LIB_DSO /* 37 */
+ case ERR_LIB_DSO:
+ return 1;
+#endif
+ case ERR_LIB_UI: /* 40 */
 switch(ERR_GET_REASON(err)) {
 case UI_R_RESULT_TOO_LARGE:
 case UI_R_RESULT_TOO_SMALL:
+#ifdef UI_R_PROCESSING_ERROR
+ case UI_R_PROCESSING_ERROR:
+#endif
+ return 1;
+ default:
+ s_log(LOG_ERR, "Unhandled ERR_LIB_UI error reason: %d",
+ ERR_GET_REASON(err));
+ return 0;
+ }
+#ifdef ERR_LIB_OSSL_STORE
+ case ERR_LIB_OSSL_STORE: /* 44 - added in OpenSSL 1.1.1 */
+ switch(ERR_GET_REASON(err)) {
+ case OSSL_STORE_R_BAD_PASSWORD_READ:
+ return 1;
+ default:
+ s_log(LOG_ERR, "Unhandled ERR_LIB_OSSL_STORE error reason: %d",
+ ERR_GET_REASON(err));
+ return 0;
+ }
+#endif
+#ifdef ERR_LIB_PROV
+ case ERR_LIB_PROV: /* 57 - added in OpenSSL 3.0 */
+ switch(ERR_GET_REASON(err)) {
+ case PROV_R_BAD_DECRYPT:
 return 1;
 default:
+ s_log(LOG_ERR, "Unhandled ERR_LIB_PROV error reason: %d",
+ ERR_GET_REASON(err));
 return 0;
 }
- case ERR_LIB_USER: /* PKCS#11 hacks */
+#endif
+ case ERR_LIB_USER: /* 128 - PKCS#11 hacks */
 switch(ERR_GET_REASON(err)) {
 case 7UL: /* CKR_ARGUMENTS_BAD */
 case 0xa0UL: /* CKR_PIN_INCORRECT */
 return 1;
 default:
+ s_log(LOG_ERR, "Unhandled ERR_LIB_USER error reason: %d",
+ ERR_GET_REASON(err));
 return 0;
 }
 default:
+ s_log(LOG_ERR, "Unhandled error library: %d", ERR_GET_LIB(err));
 return 0;
 }
 }
 
+/**************************************** session tickets */
+
+#if OPENSSL_VERSION_NUMBER >= 0x10101000L
+
+typedef struct {
+ void *session_authenticated;
+#if 0
+ SOCKADDR_UNION addr;
+#endif
+} TICKET_DATA;
+
+NOEXPORT int generate_session_ticket_cb(SSL *ssl, void *arg) {
+ SSL_SESSION *sess;
+ TICKET_DATA ticket_data;
+#if 0
+ SOCKADDR_UNION *addr;
+#endif
+ int retval;
+
+ (void)arg; /* squash the unused parameter warning */
+
+ s_log(LOG_DEBUG, "Generate session ticket callback");
+
+ sess=SSL_get1_session(ssl);
+ if(!sess)
+ return 0;
+ memset(&ticket_data, 0, sizeof(TICKET_DATA));
+
+ ticket_data.session_authenticated=
+ SSL_SESSION_get_ex_data(sess, index_session_authenticated);
+
+#if 0
+ /* TODO: add remote_start() invocation here */
+ CRYPTO_THREAD_read_lock(stunnel_locksLOCK_ADDR);
+ addr=SSL_SESSION_get_ex_data(sess, index_session_connect_address);
+ if(addr)
+ memcpy(&ticket_data.addr, addr, (size_t)addr_len(addr));
+ CRYPTO_THREAD_unlock(stunnel_locksLOCK_ADDR);
+#endif
+
+ retval=SSL_SESSION_set1_ticket_appdata(sess,
+ &ticket_data, sizeof(TICKET_DATA));
+ SSL_SESSION_free(sess);
+ return retval;
+}
+
+NOEXPORT int decrypt_session_ticket_cb(SSL *ssl, SSL_SESSION *sess,
+ const unsigned char *keyname, size_t keyname_len,
+ SSL_TICKET_STATUS status, void *arg) {
+ TICKET_DATA *ticket_data;
+ size_t ticket_len;
+
+ (void)ssl; /* squash the unused parameter warning */
+ (void)keyname; /* squash the unused parameter warning */
+ (void)keyname_len; /* squash the unused parameter warning */
+ (void)arg; /* squash the unused parameter warning */
+
+ s_log(LOG_DEBUG, "Decrypt session ticket callback");
+
+ switch(status) {
+ case SSL_TICKET_EMPTY:
+ case SSL_TICKET_NO_DECRYPT:
+ return SSL_TICKET_RETURN_IGNORE_RENEW;
+ case SSL_TICKET_SUCCESS:
+ case SSL_TICKET_SUCCESS_RENEW:
+ break;
+ default:
+ return SSL_TICKET_RETURN_ABORT;
+ }
+
+ if(!SSL_SESSION_get0_ticket_appdata(sess,
+ (void **)&ticket_data, &ticket_len)) {
+ s_log(LOG_WARNING, "Failed to get ticket application data");
+ return SSL_TICKET_RETURN_IGNORE_RENEW;
+ }
+ if(!ticket_data) {
+ s_log(LOG_WARNING, "Invalid ticket application data value");
+ return SSL_TICKET_RETURN_IGNORE_RENEW;
+ }
+ if(ticket_len != sizeof(TICKET_DATA)) {
+ s_log(LOG_WARNING, "Invalid ticket application data length");
+ return SSL_TICKET_RETURN_IGNORE_RENEW;
+ }
+
+ s_log(LOG_INFO, "Decrypted ticket for an authenticated session: %s",
+ ticket_data->session_authenticated ? "yes" : "no");
+ SSL_SESSION_set_ex_data(sess, index_session_authenticated,
+ ticket_data->session_authenticated);
+
+#if 0
+ if(ticket_data->addr.sa.sa_family) {
+ char *addr_txt;
+ SOCKADDR_UNION *old_addr;
+
+ addr_txt=s_ntop(&ticket_data->addr, addr_len(&ticket_data->addr));
+ s_log(LOG_INFO, "Decrypted ticket persistence address: %s", addr_txt);
+ str_free(addr_txt);
+ CRYPTO_THREAD_write_lock(stunnel_locksLOCK_ADDR);
+ old_addr=SSL_SESSION_get_ex_data(sess, index_session_connect_address);
+ if(SSL_SESSION_set_ex_data(sess, index_session_connect_address, &ticket_data->addr)) {
+ CRYPTO_THREAD_unlock(stunnel_locksLOCK_ADDR);
+ str_free(old_addr); /* NULL pointers are ignored */
+ } else { /* failed to store ticket_data->addr */
+ CRYPTO_THREAD_unlock(stunnel_locksLOCK_ADDR);
+ sslerror("SSL_SESSION_set_ex_data");
+ }
+ } else {
+ s_log(LOG_INFO, "Decrypted ticket did not include a persistence address");
+ }
+#endif
+
+ switch(status) {
+ case SSL_TICKET_SUCCESS:
+ return SSL_TICKET_RETURN_USE;
+ case SSL_TICKET_SUCCESS_RENEW:
+ return SSL_TICKET_RETURN_USE_RENEW;
+ }
+ return SSL_TICKET_RETURN_ABORT; /* it should never get executed */
+}
+#endif
+
+#if OPENSSL_VERSION_NUMBER>=0x10000000L
+NOEXPORT int ssl_tlsext_ticket_key_cb(SSL *ssl, unsigned char *key_name,
+ unsigned char *iv, EVP_CIPHER_CTX *ctx, HMAC_CTX *hctx, int enc) {
+ CLI *c;
+ const EVP_CIPHER *cipher;
+ int iv_len;
+
+ (void)key_name; /* squash the unused parameter warning */
+ s_log(LOG_DEBUG, "Session ticket processing callback");
+
+ c=SSL_get_ex_data(ssl, index_ssl_cli);
+ if(!HMAC_Init_ex(hctx, (const unsigned char *)(c->opt->ticket_mac->key_val),
+ c->opt->ticket_mac->key_len, EVP_sha256(), NULL)) {
+ s_log(LOG_ERR, "HMAC_Init_ex failed");
+ return -1;
+ }
+ if(c->opt->ticket_key->key_len == 16)
+ cipher=EVP_aes_128_cbc();
+ else /* c->opt->ticket_key->key_len == 32 */
+ cipher=EVP_aes_256_cbc();
+ if(enc) { /* create new session */
+ /* EVP_CIPHER_iv_length() returns 16 for either cipher EVP_aes_128_cbc() or EVP_aes_256_cbc() */
+ iv_len=EVP_CIPHER_iv_length(cipher);
+ if(RAND_bytes(iv, iv_len) <= 0) { /* RAND_bytes error */
+ s_log(LOG_ERR, "RAND_bytes failed");
+ return -1;
+ }
+ if(!EVP_EncryptInit_ex(ctx, cipher, NULL,
+ (const unsigned char *)(c->opt->ticket_key->key_val), iv)) {
+ s_log(LOG_ERR, "EVP_EncryptInit_ex failed");
+ return -1;
+ }
+ } else /* retrieve session */
+ if(!EVP_DecryptInit_ex(ctx, cipher, NULL,
+ (const unsigned char *)(c->opt->ticket_key->key_val), iv)) {
+ s_log(LOG_ERR, "EVP_DecryptInit_ex failed");
+ return -1;
+ }
+ /* By default, in TLSv1.2 and below, a new session ticket */
+ /* is not issued on a successful resumption. */
+ /* In TLSv1.3 the default behaviour is to always issue a new ticket on resumption. */
+ /* This behaviour can NOT be changed if this ticket key callback is in use! */
+ if(strcmp(SSL_get_version(c->ssl), "TLSv1.3"))
+ return 1; /* new session ticket is not issued */
+ else
+ return 2; /* session ticket should be replaced */
+}
+#endif /* OpenSSL 1.0.0 or later */
+
 /**************************************** session callbacks */
 
 NOEXPORT int sess_new_cb(SSL *ssl, SSL_SESSION *sess) {
@@ -917,16 +1260,40 @@
 
 s_log(LOG_DEBUG, "New session callback");
 c=SSL_get_ex_data(ssl, index_ssl_cli);
- new_chain(c);
+
+ new_chain(c); /* new session -> we may have a new peer certificate chain */
+
 if(c->opt->option.client)
 session_cache_save(c, sess);
- else /* SSL_SESS_CACHE_NO_INTERNAL_STORE prevented automatic caching */
- SSL_CTX_add_session(SSL_get_SSL_CTX(ssl), sess);
+
 if(c->opt->option.sessiond)
 cache_new(ssl, sess);
+
+ print_session_id(sess);
+
 return 0; /* the OpenSSL's manual is really bad -> use the source here */
 }
 
+#if OPENSSL_VERSION_NUMBER<0x0090800fL
+NOEXPORT const unsigned char *SSL_SESSION_get_id(const SSL_SESSION *s,
+ unsigned int *len) {
+ if(len)
+ *len=s->session_id_length;
+ return (const unsigned char *)s->session_id;
+}
+#endif
+
+void print_session_id(SSL_SESSION *sess) {
+ const unsigned char *session_id;
+ unsigned int session_id_length;
+ char session_id_txt2*SSL_MAX_SSL_SESSION_ID_LENGTH+1;
+
+ session_id=SSL_SESSION_get_id(sess, &session_id_length);
+ bin2hexstring(session_id, session_id_length,
+ session_id_txt, sizeof session_id_txt);
+ s_log(LOG_INFO, "Session id: %s", session_id_txt);
+}
+
 NOEXPORT void new_chain(CLI *c) {
 BIO *bio;
 int i, len;
@@ -1044,12 +1411,7 @@
 val_tmp=val=str_alloc((size_t)val_len);
 i2d_SSL_SESSION(sess, &val_tmp);
 
-#if OPENSSL_VERSION_NUMBER>=0x0090800fL
 session_id=SSL_SESSION_get_id(sess, &session_id_length);
-#else
- session_id=(const unsigned char *)sess->session_id;
- session_id_length=sess->session_id_length;
-#endif
 cache_transfer(SSL_get_SSL_CTX(ssl), CACHE_CMD_NEW,
 SSL_SESSION_get_timeout(sess),
 session_id, session_id_length, val, (size_t)val_len, NULL, NULL);
@@ -1058,7 +1420,8 @@
 
 NOEXPORT SSL_SESSION *cache_get(SSL *ssl,
 const unsigned char *key, int key_len) {
- unsigned char *val=NULL, *val_tmp=NULL;
+ unsigned char *val=NULL;
+ const unsigned char *val_tmp=NULL;
 ssize_t val_len=0;
 SSL_SESSION *sess;
 
@@ -1067,11 +1430,7 @@
 if(!val)
 return NULL;
 val_tmp=val;
- sess=d2i_SSL_SESSION(NULL,
-#if OPENSSL_VERSION_NUMBER>=0x0090707fL
- (const unsigned char **)
-#endif /* OpenSSL version >= 0.9.7g */
- &val_tmp, (long)val_len);
+ sess=d2i_SSL_SESSION(NULL, &val_tmp, (long)val_len);
 str_free(val);
 return sess;
 }
@@ -1080,12 +1439,7 @@
 const unsigned char *session_id;
 unsigned int session_id_length;
 
-#if OPENSSL_VERSION_NUMBER>=0x0090800fL
 session_id=SSL_SESSION_get_id(sess, &session_id_length);
-#else
- session_id=(const unsigned char *)sess->session_id;
- session_id_length=sess->session_id_length;
-#endif
 cache_transfer(ctx, CACHE_CMD_REMOVE, 0,
 session_id, session_id_length, NULL, 0, NULL, NULL);
 }
@@ -1104,9 +1458,7 @@
 const u_char *val, const size_t val_len,
 unsigned char **ret, size_t *ret_len) {
 char session_id_txt2*SSL_MAX_SSL_SESSION_ID_LENGTH+1;
- const char hex16="0123456789ABCDEF";
 const char *type_description={"new", "get", "remove"};
- unsigned i;
 SOCKET s;
 ssize_t len;
 struct timeval t;
@@ -1117,11 +1469,7 @@
 *ret=NULL;
 
 /* log the request information */
- for(i=0; i<key_len && i<SSL_MAX_SSL_SESSION_ID_LENGTH; ++i) {
- session_id_txt2*i=hexkeyi>>4;
- session_id_txt2*i+1=hexkeyi&0x0f;
- }
- session_id_txt2*i='\0';
+ bin2hexstring(key, key_len, session_id_txt, sizeof session_id_txt);
 s_log(LOG_INFO,
 "cache_transfer: request=%s, timeout=%ld, id=%s, length=%lu",
 type_descriptiontype, timeout, session_id_txt, (long unsigned)val_len);
@@ -1189,8 +1537,9 @@
 len=recv(s, (void *)packet, sizeof(CACHE_PACKET), 0);
 closesocket(s);
 if(len<0) {
- if(get_last_socket_error()==S_EWOULDBLOCK ||
- get_last_socket_error()==S_EAGAIN)
+ int err=get_last_socket_error();
+
+ if(err==S_EWOULDBLOCK || (S_EWOULDBLOCK!=S_EAGAIN && err==S_EAGAIN))
 s_log(LOG_INFO, "cache_transfer: recv timeout");
 else
 sockerror("cache_transfer: recv");
@@ -1224,58 +1573,66 @@
 CLI *c;
 SSL_CTX *ctx;
 const char *state_string;
-
- c=SSL_get_ex_data((SSL *)ssl, index_ssl_cli);
- if(c) {
 #if OPENSSL_VERSION_NUMBER>=0x10100000L
- OSSL_HANDSHAKE_STATE state=SSL_get_state(ssl);
+ OSSL_HANDSHAKE_STATE state=SSL_get_state(ssl);
 #else
- int state=SSL_get_state((SSL *)ssl);
+ int state=SSL_get_state((SSL *)ssl);
 #endif
 
+ c=SSL_get_ex_data(ssl, index_ssl_cli);
+ if(!c) {
+ s_log(LOG_ERR,
+ "INTERNAL ERROR: info_callback() called without CLI, state = %x",
+ state);
+ return;
+ }
 #if 0
- s_log(LOG_DEBUG, "state = %x", state);
+ s_log(LOG_DEBUG, "state = %x", state);
 #endif
 
+ /* do not reset the TLS socket after a fatal alert */
+ if(where & SSL_CB_ALERT && !strcmp(SSL_alert_type_string(ret), "F"))
+ c->fatal_alert=1;
+
 /* log the client certificate request (if received) */
 #ifndef SSL3_ST_CR_CERT_REQ_A
- if(state==TLS_ST_CR_CERT_REQ)
+ if(state==TLS_ST_CR_CERT_REQ)
 #else
- if(state==SSL3_ST_CR_CERT_REQ_A)
+ if(state==SSL3_ST_CR_CERT_REQ_A)
 #endif
- print_client_CA_list(SSL_get_client_CA_list((SSL *)ssl));
+ print_CA_list("Received trusted client CA",
+ SSL_get_client_CA_list(ssl));
 #ifndef SSL3_ST_CR_SRVR_DONE_A
- if(state==TLS_ST_CR_SRVR_DONE)
+ if(state==TLS_ST_CR_SRVR_DONE)
 #else
- if(state==SSL3_ST_CR_SRVR_DONE_A)
+ if(state==SSL3_ST_CR_SRVR_DONE_A)
 #endif
- if(!SSL_get_client_CA_list((SSL *)ssl))
- s_log(LOG_INFO, "Client certificate not requested");
-
- /* prevent renegotiation DoS attack */
- if((where&SSL_CB_HANDSHAKE_DONE)
- && c->reneg_state==RENEG_INIT) {
- /* first (initial) handshake was completed, remember this,
- * so that further renegotiation attempts can be detected */
- c->reneg_state=RENEG_ESTABLISHED;
- } else if((where&SSL_CB_ACCEPT_LOOP)
- && c->reneg_state==RENEG_ESTABLISHED) {
+ if(!SSL_get_client_CA_list(ssl))
+ s_log(LOG_INFO, "Client certificate not requested");
+
+ /* prevent renegotiation DoS attack */
+ if((where&SSL_CB_HANDSHAKE_DONE)
+ && c->reneg_state==RENEG_INIT) {
+ /* first (initial) handshake was completed, remember this,
+ * so that further renegotiation attempts can be detected */
+ c->reneg_state=RENEG_ESTABLISHED;
+ } else if((where&SSL_CB_ACCEPT_LOOP)
+ && c->reneg_state==RENEG_ESTABLISHED) {
 #ifndef SSL3_ST_SR_CLNT_HELLO_A
- if(state==TLS_ST_SR_CLNT_HELLO) {
+ if(state==TLS_ST_SR_CLNT_HELLO) {
 #else
- if(state==SSL3_ST_SR_CLNT_HELLO_A
- || state==SSL23_ST_SR_CLNT_HELLO_A) {
+ if(state==SSL3_ST_SR_CLNT_HELLO_A
+ || state==SSL23_ST_SR_CLNT_HELLO_A) {
 #endif
- /* client hello received after initial handshake,
- * this means renegotiation -> mark it */
- c->reneg_state=RENEG_DETECTED;
- }
+ /* client hello received after initial handshake,
+ * this means renegotiation -> mark it */
+ c->reneg_state=RENEG_DETECTED;
 }
-
- if(c->opt->log_level<LOG_DEBUG) /* performance optimization */
- return;
 }
 
+ if(c->opt->log_level<LOG_DEBUG)
+ return; /* performance optimization: skip logging debug info */
+
 if(where & SSL_CB_LOOP) {
 state_string=SSL_state_string_long(ssl);
 if(strcmp(state_string, "unknown state"))
@@ -1289,7 +1646,7 @@
 SSL_alert_type_string_long(ret),
 SSL_alert_desc_string_long(ret));
 } else if(where==SSL_CB_HANDSHAKE_DONE) {
- ctx=SSL_get_SSL_CTX((SSL *)ssl);
+ ctx=SSL_get_SSL_CTX(ssl);
 if(c->opt->option.client) {
 s_log(LOG_DEBUG, "%6ld client connect(s) requested",
 SSL_CTX_sess_connect(ctx));
@@ -1326,13 +1683,15 @@
 
 /**************************************** TLS error reporting */
 
-void sslerror(char *txt) { /* OpenSSL error handler */
+void sslerror(const char *txt) { /* OpenSSL error handler */
 unsigned long err;
+ const char *file;
+ int line;
 
- err=ERR_get_error();
+ err=ERR_get_error_line(&file, &line);
 if(err) {
 sslerror_queue();
- sslerror_log(err, txt);
+ sslerror_log(err, file, line, txt);
 } else {
 s_log(LOG_ERR, "%s: Peer suddenly disconnected", txt);
 }
@@ -1340,21 +1699,24 @@
 
 NOEXPORT void sslerror_queue(void) { /* recursive dump of the error queue */
 unsigned long err;
+ const char *file;
+ int line;
 
- err=ERR_get_error();
+ err=ERR_get_error_line(&file, &line);
 if(err) {
 sslerror_queue();
- sslerror_log(err, "error queue");
+ sslerror_log(err, file, line, "error queue");
 }
 }
 
-NOEXPORT void sslerror_log(unsigned long err, char *txt) {
- char *error_string;
+NOEXPORT void sslerror_log(unsigned long err,
+ const char *file, int line, const char *txt) {
+ char *str;
 
- error_string=str_alloc(256);
- ERR_error_string_n(err, error_string, 256);
- s_log(LOG_ERR, "%s: %lX: %s", txt, err, error_string);
- str_free(error_string);
+ str=str_alloc(256);
+ ERR_error_string_n(err, str, 256);
+ s_log(LOG_ERR, "%s: %s:%d: %s", txt, file, line, str);
+ str_free(str);
 }
 
 /* end of ctx.c */

_service:tar_scm:stunnel-5.48.tar.gz/src/dhparam.c -> _service:tar_scm:stunnel-5.69.tar.gz/src/dhparam.c Changed

@@ -1,57 +1,50 @@
-#include "common.h"
+/* dhparam.c: initial DH parameters for stunnel */
+#include "prototypes.h"
 #ifndef OPENSSL_NO_DH
 #define DN_new DH_new
-#ifndef HEADER_DH_H
-# include <openssl/dh.h>
-#endif
-
-DH *get_dh2048()
-{
+DH *get_dh2048(void) {
 static unsigned char dhp_2048 = {
-	0xC1, 0x52, 0x91, 0xEE, 0xF0, 0xDF, 0xCB, 0x9C, 0x9A, 0xFA, 
-	0xC4, 0x41, 0x27, 0x23, 0xEA, 0xD2, 0x93, 0xF2, 0x93, 0x6A, 
-	0x54, 0xBF, 0xB1, 0xB6, 0xF3, 0x0F, 0x27, 0xF4, 0xD5, 0x68, 
-	0x1F, 0x5A, 0xCF, 0xA0, 0x53, 0xC5, 0x40, 0x4E, 0xD8, 0x54, 
-	0x5D, 0xC4, 0xE5, 0x16, 0x60, 0x5B, 0xEF, 0xB5, 0x36, 0x2D, 
-	0x10, 0xB2, 0xE1, 0xC9, 0x14, 0xDE, 0xC3, 0x25, 0x3C, 0xD9, 
-	0x04, 0x65, 0x71, 0x2E, 0xC7, 0x7E, 0x38, 0x6A, 0xC6, 0x1F, 
-	0x7A, 0xF5, 0xC0, 0x9B, 0xD7, 0x42, 0xF9, 0x1D, 0xC1, 0xB2, 
-	0xD9, 0x0D, 0x34, 0xF0, 0xF5, 0xD4, 0x5F, 0x66, 0x8B, 0x58, 
-	0x7F, 0x91, 0xA5, 0x0B, 0xA2, 0x61, 0x1F, 0xD6, 0x71, 0xE9, 
-	0x30, 0xE4, 0xB8, 0xCF, 0x8B, 0xED, 0x59, 0x32, 0x41, 0x85, 
-	0xF5, 0xA9, 0x70, 0x5F, 0x7F, 0x47, 0x11, 0xDF, 0x92, 0xA4, 
-	0xD4, 0x07, 0x72, 0x78, 0x75, 0xCE, 0x7B, 0xD7, 0xAB, 0x75, 
-	0xAF, 0x9C, 0xC9, 0xE1, 0x94, 0xFF, 0xE3, 0x60, 0x9C, 0x8A, 
-	0x4C, 0xC1, 0xF8, 0xEC, 0xEA, 0x7A, 0x90, 0x84, 0xD9, 0x31, 
-	0x24, 0xE1, 0x6C, 0xAB, 0xF5, 0x3B, 0x91, 0x45, 0x59, 0x32, 
-	0xE4, 0x43, 0x52, 0xD1, 0x4E, 0x9E, 0xC3, 0xC3, 0xD1, 0xEA, 
-	0xCB, 0x60, 0x05, 0x9E, 0x75, 0xAD, 0x92, 0xD7, 0xBD, 0xA8, 
-	0x05, 0x49, 0xC0, 0xAA, 0x5D, 0xE5, 0x02, 0x7D, 0xF9, 0x6C, 
-	0x69, 0x21, 0xC9, 0x57, 0x7E, 0xE4, 0x09, 0x84, 0xA5, 0x0C, 
-	0xF8, 0x86, 0xB9, 0x93, 0x7B, 0x67, 0x18, 0x43, 0x9C, 0xB7, 
-	0x8B, 0xE3, 0xD2, 0xCD, 0x90, 0x45, 0x83, 0xD7, 0xA9, 0x77, 
-	0x6C, 0xD8, 0x2A, 0x0D, 0x7B, 0xB6, 0xBB, 0xEE, 0xAA, 0xFE, 
-	0xCE, 0x18, 0x41, 0x67, 0x81, 0x0A, 0xB4, 0x77, 0x36, 0xFE, 
-	0x5A, 0x0E, 0x4F, 0x14, 0x9F, 0x40, 0x20, 0x92, 0xE4, 0x40, 
-	0x9A, 0x41, 0x3A, 0x42, 0xCE, 0x2B
+ 0x9f, 0x7e, 0x7a, 0xda, 0x97, 0xce, 0x22, 0xe2, 0x35, 0x68, 0xc9, 0xe9,
+ 0xc8, 0xe7, 0x19, 0x11, 0x02, 0xbe, 0x30, 0x88, 0x48, 0x89, 0xf1, 0x7d,
+ 0x0b, 0xcc, 0xc7, 0x38, 0x58, 0x16, 0xb3, 0xca, 0xd3, 0xd0, 0x45, 0xd4,
+ 0x36, 0x50, 0x25, 0xb3, 0x7e, 0xf8, 0x24, 0x29, 0x7c, 0x4a, 0xbc, 0xee,
+ 0xe5, 0x1d, 0x2f, 0xef, 0xf3, 0x07, 0xd1, 0x2a, 0x3f, 0xec, 0x31, 0x91,
+ 0xb2, 0x80, 0xda, 0x96, 0x59, 0x7d, 0xe6, 0x7d, 0x4d, 0x38, 0x40, 0x4a,
+ 0x00, 0x50, 0x64, 0x96, 0x47, 0x90, 0x4c, 0xc8, 0xe1, 0x3c, 0x1f, 0xda,
+ 0xb4, 0x89, 0x56, 0x99, 0x1d, 0xff, 0x82, 0xc5, 0x1f, 0x41, 0xfd, 0x1f,
+ 0xb3, 0xf1, 0x4f, 0xb0, 0x8c, 0xde, 0xda, 0xee, 0xba, 0x3b, 0x25, 0x32,
+ 0x7a, 0x04, 0x26, 0x7a, 0x44, 0xf2, 0x46, 0xd9, 0xb7, 0x28, 0xa3, 0xdc,
+ 0xe9, 0x50, 0x00, 0xe7, 0x92, 0x94, 0x5a, 0xe1, 0x4e, 0xc6, 0xc8, 0x82,
+ 0x42, 0xe2, 0xf1, 0x21, 0x8f, 0xcf, 0xcc, 0x56, 0xff, 0xba, 0x8c, 0xc3,
+ 0xc8, 0xd8, 0xfe, 0x09, 0x63, 0x2f, 0x33, 0x8f, 0x95, 0xf8, 0x5b, 0x44,
+ 0xfb, 0xdd, 0x81, 0x67, 0x02, 0x9d, 0xe3, 0x47, 0xf4, 0x93, 0x3d, 0xe5,
+ 0x34, 0x09, 0xa5, 0x77, 0x2e, 0x92, 0x0f, 0x97, 0x83, 0x71, 0xff, 0xa7,
+ 0x51, 0x95, 0x4e, 0x4f, 0x28, 0xcf, 0x47, 0x45, 0xe0, 0xe8, 0x3d, 0x7a,
+ 0x9c, 0xdf, 0x50, 0x2d, 0x91, 0x64, 0x8c, 0xba, 0x5e, 0x1a, 0x11, 0xa2,
+ 0xd8, 0x26, 0x67, 0x78, 0x61, 0xa1, 0x44, 0x2a, 0xfb, 0xcb, 0xfa, 0x6f,
+ 0x4f, 0x01, 0x80, 0x5e, 0x00, 0x45, 0x0d, 0x50, 0x1e, 0xaf, 0xd9, 0xf4,
+ 0x9c, 0x92, 0x1d, 0x6e, 0x64, 0xd3, 0x4d, 0xbd, 0xd3, 0x15, 0xaf, 0x64,
+ 0x3c, 0x00, 0xf1, 0x89, 0x8f, 0xa5, 0x13, 0xa7, 0x06, 0x92, 0x05, 0xdd,
+ 0x10, 0x92, 0x61, 0xc7
 };
 static unsigned char dhg_2048 = {
-	0x02
+ 0x02
 };
 DH *dh = DH_new();
- BIGNUM *dhp_bn, *dhg_bn;
+ BIGNUM *p, *g;
 
 if (dh == NULL)
 return NULL;
- dhp_bn = BN_bin2bn(dhp_2048, sizeof (dhp_2048), NULL);
- dhg_bn = BN_bin2bn(dhg_2048, sizeof (dhg_2048), NULL);
- if (dhp_bn == NULL || dhg_bn == NULL
- || !DH_set0_pqg(dh, dhp_bn, NULL, dhg_bn)) {
+ p = BN_bin2bn(dhp_2048, sizeof(dhp_2048), NULL);
+ g = BN_bin2bn(dhg_2048, sizeof(dhg_2048), NULL);
+ if (p == NULL || g == NULL
+ || !DH_set0_pqg(dh, p, NULL, g)) {
 DH_free(dh);
- BN_free(dhp_bn);
- BN_free(dhg_bn);
+ BN_free(p);
+ BN_free(g);
 return NULL;
 }
 return dh;
 }
 #endif /* OPENSSL_NO_DH */
+/* built for stunnel 5.69 */

_service:tar_scm:stunnel-5.48.tar.gz/src/env.c -> _service:tar_scm:stunnel-5.69.tar.gz/src/env.c Changed

_service:tar_scm:stunnel-5.48.tar.gz/src/evc.mak -> _service:tar_scm:stunnel-5.69.tar.gz/src/evc.mak Changed

@@ -1,4 +1,4 @@
-# wce.mak for stunnel.exe by Michal Trojnara 1998-2018
+# wce.mak for stunnel.exe by Michal Trojnara 1998-2023
 # with help of Pierre Delaage <delaage.pierre@free.fr>
 # pdelaage 20140610 : added UNICODE optional FLAG, always ACTIVE on WCE because of poor ANSI support
 # pdelaage 20140610 : added _WIN32_WCE flag for RC compilation, to preprocess out "HELP" unsupported menu flag on WCE
@@ -8,10 +8,10 @@
 # for X86-WCE targets, although compiler "cl.exe" is REALLY the same as desktop W32 VS6 C++ compiler,
 # the MT flags relating to LIBCMT is useless BECAUSE LIBCMT does NOT exist on WCE. No msvcrt on WCE either...
 
-# pdelaage 20140610 : Note on /MC flag 
+# pdelaage 20140610 : Note on /MC flag
 # For other targets than X86/Emulator, /MC flag is redundant with "/nodefaultlib coredll.lib corelibc.lib" LD lib list.
-# For << X86 / Emulator >> target, as the cl.exe compiler IS the SAME as the standard VS6.0 C++ compiler for Desktop Pentium processor, 
-# /MC flag is in fact NOT existing, thus requiring an explicit linking with core libs by using : 
+# For << X86 / Emulator >> target, as the cl.exe compiler IS the SAME as the standard VS6.0 C++ compiler for Desktop Pentium processor,
+# /MC flag is in fact NOT existing, thus requiring an explicit linking with core libs by using :
 # /NODEFAULTLIB coredll.lib corelibc.lib,
 # something that is correct for any WCE target, X86 and other, and leading /MC flag to be useless ALSO for other target than X86.

_service:tar_scm:stunnel-5.48.tar.gz/src/fd.c -> _service:tar_scm:stunnel-5.69.tar.gz/src/fd.c Changed

@@ -1,6 +1,6 @@
 /*
 * stunnel TLS offloading and load-balancing proxy
- * Copyright (C) 1998-2018 Michal Trojnara <Michal.Trojnara@stunnel.org>
+ * Copyright (C) 1998-2023 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
@@ -35,7 +35,6 @@
 * forward this exception.
 */
 
-#include "common.h"
 #include "prototypes.h"
 
 #if defined HAVE_PIPE2 && defined HAVE_ACCEPT4
@@ -49,7 +48,7 @@
 
 /**************************************** prototypes */
 
-NOEXPORT SOCKET setup_fd(SOCKET, int, char *);
+NOEXPORT SOCKET setup_fd(SOCKET, int, const char *);
 
 /**************************************** internal limit of file descriptors */
 
@@ -101,7 +100,7 @@
 
 /**************************************** file descriptor validation */
 
-SOCKET s_socket(int domain, int type, int protocol, int nonblock, char *msg) {
+SOCKET s_socket(int domain, int type, int protocol, int nonblock, const char *msg) {
 SOCKET fd;
 
 #ifdef USE_NEW_LINUX_API
@@ -120,7 +119,7 @@
 }
 
 SOCKET s_accept(SOCKET sockfd, struct sockaddr *addr, socklen_t *addrlen,
- int nonblock, char *msg) {
+ int nonblock, const char *msg) {
 SOCKET fd;
 
 #ifdef USE_NEW_LINUX_API
@@ -137,7 +136,7 @@
 #ifndef USE_WIN32
 
 int s_socketpair(int domain, int type, int protocol, SOCKET sv2,
- int nonblock, char *msg) {
+ int nonblock, const char *msg) {
 #ifdef USE_NEW_LINUX_API
 if(nonblock)
 type|=SOCK_NONBLOCK;
@@ -158,7 +157,7 @@
 return 0;
 }
 
-int s_pipe(int pipefd2, int nonblock, char *msg) {
+int s_pipe(int pipefd2, int nonblock, const char *msg) {
 int retval;
 
 #ifdef USE_NEW_LINUX_API
@@ -186,7 +185,7 @@
 
 #endif /* USE_WIN32 */
 
-NOEXPORT SOCKET setup_fd(SOCKET fd, int nonblock, char *msg) {
+NOEXPORT SOCKET setup_fd(SOCKET fd, int nonblock, const char *msg) {
 #if !defined USE_NEW_LINUX_API && defined FD_CLOEXEC
 int err;
 #endif

_service:tar_scm:stunnel-5.48.tar.gz/src/file.c -> _service:tar_scm:stunnel-5.69.tar.gz/src/file.c Changed

@@ -1,6 +1,6 @@
 /*
 * stunnel TLS offloading and load-balancing proxy
- * Copyright (C) 1998-2018 Michal Trojnara <Michal.Trojnara@stunnel.org>
+ * Copyright (C) 1998-2023 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
@@ -35,66 +35,51 @@
 * forward this exception.
 */
 
-#include "common.h"
 #include "prototypes.h"
 
-#ifdef USE_WIN32
-
-DISK_FILE *file_open(char *name, FILE_MODE mode) {
+DISK_FILE *file_fdopen(int fd, FILE_MODE file_mode) {
 DISK_FILE *df;
- LPTSTR tname;
- HANDLE fh;
- DWORD desired_access, creation_disposition;
+ FILE *f;
+ char *mode;
 
- /* open file */
- switch(mode) {
- case FILE_MODE_READ:
- desired_access=GENERIC_READ;
- creation_disposition=OPEN_EXISTING;
+ switch(fd) {
+ case 0:
+ f=stdin;
 break;
- case FILE_MODE_APPEND:
- /* reportedly more compatible than FILE_APPEND_DATA */
- desired_access=GENERIC_WRITE;
- creation_disposition=OPEN_ALWAYS; /* keep the data */
+ case 1:
+ f=stdout;
 break;
- case FILE_MODE_OVERWRITE:
- desired_access=GENERIC_WRITE;
- creation_disposition=CREATE_ALWAYS; /* remove the data */
+ case 2:
+ f=stderr;
 break;
- default: /* invalid mode */
- return NULL;
+ default:
+ switch(file_mode) {
+ case FILE_MODE_READ:
+ mode="r";
+ break;
+ case FILE_MODE_APPEND:
+ mode="a";
+ break;
+ case FILE_MODE_OVERWRITE:
+ mode="w";
+ break;
+ default: /* invalid file_mode */
+ return NULL;
+ }
+ f=fdopen(fd, mode);
 }
- tname=str2tstr(name);
- fh=CreateFile(tname, desired_access, FILE_SHARE_READ, NULL,
- creation_disposition, FILE_ATTRIBUTE_NORMAL, (HANDLE)NULL);
- str_free(tname); /* str_free() overwrites GetLastError() value */
- if(fh==INVALID_HANDLE_VALUE)
+ if(!f)
 return NULL;
- if(mode==FILE_MODE_APPEND) /* workaround for FILE_APPEND_DATA */
- SetFilePointer(fh, 0, NULL, FILE_END);
-
- /* setup df structure */
- df=str_alloc(sizeof df);
- df->fh=fh;
- return df;
-}
-
-#else /* USE_WIN32 */
-
-DISK_FILE *file_fdopen(int fd) {
- DISK_FILE *df;
-
 df=str_alloc(sizeof(DISK_FILE));
- df->fd=fd;
+ df->f=f;
 return df;
 }
 
-DISK_FILE *file_open(char *name, FILE_MODE mode) {
- DISK_FILE *df;
+DISK_FILE *file_open(char *name, FILE_MODE file_mode) {
 int fd, flags;
 
 /* open file */
- switch(mode) {
+ switch(file_mode) {
 case FILE_MODE_READ:
 flags=O_RDONLY;
 break;
@@ -104,66 +89,46 @@
 case FILE_MODE_OVERWRITE:
 flags=O_CREAT|O_WRONLY|O_TRUNC;
 break;
- default: /* invalid mode */
+ default: /* invalid file_mode */
 return NULL;
 }
-#ifdef O_NONBLOCK
- flags|=O_NONBLOCK;
-#elif defined O_NDELAY
- flags|=O_NDELAY;
-#endif
 #ifdef O_CLOEXEC
 flags|=O_CLOEXEC;
 #endif /* O_CLOEXEC */
+ /* don't fopen() directly to prevent O_CLOEXEC race condition */
+#ifdef USE_WIN32
+ fd=_open(name, flags, _S_IREAD|_S_IWRITE);
+#else /* USE_WIN32 */
 fd=open(name, flags, 0640);
- if(fd==INVALID_SOCKET)
+#endif /* USE_WIN32 */
+ if(fd<0)
 return NULL;
-
- /* setup df structure */
- df=str_alloc(sizeof df);
- df->fd=fd;
- return df;
+ return file_fdopen(fd, file_mode);
 }
 
-#endif /* USE_WIN32 */
-
 void file_close(DISK_FILE *df) {
 if(!df) /* nothing to do */
 return;
-#ifdef USE_WIN32
- CloseHandle(df->fh);
-#else /* USE_WIN32 */
- if(df->fd>2) /* never close stdin/stdout/stder */
- close(df->fd);
-#endif /* USE_WIN32 */
+ if(fileno(df->f)>2) /* never close stdin/stdout/stder */
+ fclose(df->f);
 str_free(df);
 }
 
 ssize_t file_getline(DISK_FILE *df, char *line, int len) {
- /* this version is really slow, but performance is not important here */
- /* (no buffering is implemented) */
 ssize_t i;
-#ifdef USE_WIN32
- DWORD num;
-#else /* USE_WIN32 */
- ssize_t num;
-#endif /* USE_WIN32 */
+ int c;
 
 if(!df) /* not opened */
 return -1;
 
 for(i=0; i<len-1; i++) {
-#ifdef USE_WIN32
- ReadFile(df->fh, line+i, 1, &num, NULL);
-#else /* USE_WIN32 */
- num=read(df->fd, line+i, 1);
-#endif /* USE_WIN32 */
- if(num!=1) { /* EOF */
- if(i) /* any previously retrieved data */
- break;
- else
+ c=getc(df->f);
+ if(c==EOF) {
+ if(!i) /* no previously retrieved data */
 return -1;
+ break; /* MSDOS-style last file line */
 }
+ linei=(char)c;
 if(linei=='\n') /* LF */
 break;
 if(linei=='\r') /* CR */
@@ -173,30 +138,33 @@
 return i;
 }
 
-ssize_t file_putline(DISK_FILE *df, char *line) {
+ssize_t file_putline_nonewline(DISK_FILE *df, char *line) {
+ /* used for fatal_debug() -> no str.c functions are allowed */
+ FILE *f;
+ int num;
+
+ f=df ? df->f : stderr; /* no file -> write to stderr */
+ num=fputs(line, f); /* automatically converts LF->CRLF on Windows */
+ return (ssize_t)num;
+}
+
+ssize_t file_putline_newline(DISK_FILE *df, char *line) {
 char *buff;
 size_t len;
-#ifdef USE_WIN32
- DWORD num;
-#else /* USE_WIN32 */
 ssize_t num;
-#endif /* USE_WIN32 */
 
 len=strlen(line);
- buff=str_alloc(len+2); /* +2 for CR+LF */
+ buff=str_alloc(len+3); /* +2 for LF+NUL */
 strcpy(buff, line);
-#ifdef USE_WIN32
- bufflen++='\r'; /* CR */
-#endif /* USE_WIN32 */
 bufflen++='\n'; /* LF */
-#ifdef USE_WIN32
- WriteFile(df->fh, buff, (DWORD)len, &num, NULL);
-#else /* USE_WIN32 */
- /* no file -> write to stderr */
- num=write(df ? df->fd : 2, buff, len);
-#endif /* USE_WIN32 */
+ bufflen='\0'; /* NUL */
+ num=file_putline_nonewline(df, buff);
 str_free(buff);
- return (ssize_t)num;
+ return num;
+}
+
+int file_flush(DISK_FILE *df) {
+ return fflush(df ? df->f : stderr); /* no file -> flush stderr */
 }
 
 int file_permissions(const char *file_name) {
@@ -213,6 +181,7 @@
 "Insecure file permissions on %s", file_name);
 #else
 (void)file_name; /* squash the unused parameter warning */
+ /* not (yet) implemented */
 #endif
 return 0;
 }

_service:tar_scm:stunnel-5.48.tar.gz/src/libwrap.c -> _service:tar_scm:stunnel-5.69.tar.gz/src/libwrap.c Changed

_service:tar_scm:stunnel-5.48.tar.gz/src/log.c -> _service:tar_scm:stunnel-5.69.tar.gz/src/log.c Changed

@@ -1,6 +1,6 @@
 /*
 * stunnel TLS offloading and load-balancing proxy
- * Copyright (C) 1998-2018 Michal Trojnara <Michal.Trojnara@stunnel.org>
+ * Copyright (C) 1998-2023 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
@@ -35,14 +35,14 @@
 * forward this exception.
 */
 
-#include "common.h"
 #include "prototypes.h"
 
 NOEXPORT void log_queue(SERVICE_OPTIONS *, int, char *, char *, char *);
 NOEXPORT void log_raw(SERVICE_OPTIONS *, int, char *, char *, char *);
 NOEXPORT void safestring(char *);
 
-static DISK_FILE *outfile=NULL;
+DISK_FILE *outfile=NULL;
+
 static struct LIST { /* single-linked list of log lines */
 struct LIST *next;
 SERVICE_OPTIONS *opt;
@@ -55,19 +55,25 @@
 
 static int syslog_opened=0;
 
-void syslog_open(void) {
- syslog_close();
- if(global_options.option.log_syslog)
+NOEXPORT void syslog_open(void) {
+ if(global_options.option.log_syslog) {
+ static char *servname=NULL;
+ char *servname_old;
+
+ /* openlog(3) requires a persistent copy of the "ident" parameter */
+ servname_old=servname;
+ servname=str_dup(service_options.servname);
 #ifdef __ultrix__
- openlog(service_options.servname, 0);
+ openlog(servname, 0);
 #else
- openlog(service_options.servname,
- LOG_CONS|LOG_NDELAY, global_options.log_facility);
+ openlog(servname, LOG_CONS|LOG_NDELAY, global_options.log_facility);
 #endif /* __ultrix__ */
+ str_free(servname_old);
+ }
 syslog_opened=1;
 }
 
-void syslog_close(void) {
+NOEXPORT void syslog_close(void) {
 if(syslog_opened) {
 if(global_options.option.log_syslog)
 closelog();
@@ -77,7 +83,7 @@
 
 #endif /* !defined(USE_WIN32) && !defined(__vms) */
 
-int log_open(void) {
+NOEXPORT int outfile_open(void) {
 if(global_options.output_file) { /* 'output' option specified */
 outfile=file_open(global_options.output_file,
 global_options.log_file_mode);
@@ -100,24 +106,56 @@
 return 1;
 }
 }
- log_flush(LOG_MODE_CONFIGURED);
 return 0;
 }
 
-void log_close(void) {
- /* prevent changing the mode while logging */
- CRYPTO_THREAD_write_lock(stunnel_locksLOCK_LOG_MODE);
- log_mode=LOG_MODE_BUFFER;
+NOEXPORT void outfile_close(void) {
 if(outfile) {
 file_close(outfile);
 outfile=NULL;
 }
+}
+
+int log_open(int sink) {
+#if !defined(USE_WIN32) && !defined(__vms)
+ if(sink&SINK_SYSLOG)
+ syslog_open();
+#endif
+ if(sink&SINK_OUTFILE && outfile_open())
+ return 1;
+ return 0;
+}
+
+void log_close(int sink) {
+ /* prevent changing the mode while logging */
+ CRYPTO_THREAD_write_lock(stunnel_locksLOCK_LOG_MODE);
+#if !defined(USE_WIN32) && !defined(__vms)
+ if(sink&SINK_SYSLOG)
+ syslog_close();
+#endif
+ if(sink&SINK_OUTFILE)
+ outfile_close();
 CRYPTO_THREAD_unlock(stunnel_locksLOCK_LOG_MODE);
 }
 
 void s_log(int level, const char *format, ...) {
 va_list ap;
- char *text, *stamp, *id;
+
+ va_start(ap, format);
+ s_vlog(level, format, ap);
+ va_end(ap);
+}
+
+#ifdef __GNUC__
+#if __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 6)
+#pragma GCC diagnostic push
+#endif /* __GNUC__>=4.6 */
+#pragma GCC diagnostic ignored "-Wformat-nonliteral"
+#endif /* __GNUC__ */
+void s_vlog(int level, const char *format, va_list ap) {
+ va_list aq;
+ char stamp72, id72, *text;
+ int len;
 #ifdef USE_WIN32
 DWORD libc_error;
 #else
@@ -150,15 +188,25 @@
 #else
 timeptr=localtime(&gmt);
 #endif
- stamp=str_printf("%04d.%02d.%02d %02d:%02d:%02d",
+ snprintf(stamp, sizeof stamp, "%04d.%02d.%02d %02d:%02d:%02d",
 timeptr->tm_year+1900, timeptr->tm_mon+1, timeptr->tm_mday,
 timeptr->tm_hour, timeptr->tm_min, timeptr->tm_sec);
- id=str_printf("LOG%d%s", level, tls_data->id);
+ snprintf(id, sizeof id, "LOG%d%s", level, tls_data->id);
 
 /* format the text to be logged */
- va_start(ap, format);
- text=str_vprintf(format, ap);
- va_end(ap);
+ va_copy(aq, ap);
+ len=vsnprintf(NULL, 0, format, ap);
+ if(len>1024)
+ len=1024;
+#ifdef USE_WIN32
+ text=_alloca((size_t)len+1);
+#else
+ text=alloca((size_t)len+1);
+#endif
+ len=vsnprintf(text, (size_t)len+1, format, aq);
+ va_end(aq);
+ while(len>0 && textlen-1=='\n')
+ text--len='\0'; /* strip trailing newlines */
 safestring(text);
 
 /* either log or queue for logging */
@@ -173,6 +221,11 @@
 set_last_error(libc_error);
 set_last_socket_error(socket_error);
 }
+#ifdef __GNUC__
+#if __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 6)
+#pragma GCC diagnostic pop
+#endif /* __GNUC__>=4.6 */
+#endif /* __GNUC__ */
 
 NOEXPORT void log_queue(SERVICE_OPTIONS *opt,
 int level, char *stamp, char *id, char *text) {
@@ -183,12 +236,9 @@
 tmp->next=NULL;
 tmp->opt=opt;
 tmp->level=level;
- tmp->stamp=stamp;
- str_detach(tmp->stamp);
- tmp->id=id;
- str_detach(tmp->id);
- tmp->text=text;
- str_detach(tmp->text);
+ tmp->stamp=str_dup_detached(stamp);
+ tmp->id=str_dup_detached(id);
+ tmp->text=str_dup_detached(text);
 
 /* append the new element to the list */
 CRYPTO_THREAD_write_lock(stunnel_locksLOCK_LOG_BUFFER);
@@ -203,26 +253,33 @@
 
 void log_flush(LOG_MODE new_mode) {
 CRYPTO_THREAD_write_lock(stunnel_locksLOCK_LOG_MODE);
- /* prevent changing LOG_MODE_CONFIGURED to LOG_MODE_ERROR
- * once stderr file descriptor is closed */
- if(log_mode!=LOG_MODE_CONFIGURED)
- log_mode=new_mode;
- /* log_raw() will use the new value of log_mode */
- CRYPTO_THREAD_write_lock(stunnel_locksLOCK_LOG_BUFFER);
- while(head) {
- struct LIST *tmp=head;
- head=head->next;
- log_raw(tmp->opt, tmp->level, tmp->stamp, tmp->id, tmp->text);
- str_free(tmp);
+
+ log_mode=new_mode;
+
+ /* emit the buffered logs (unless we just started buffering) */
+ if(new_mode!=LOG_MODE_BUFFER) {
+ /* log_raw() will use the new value of log_mode */
+ CRYPTO_THREAD_write_lock(stunnel_locksLOCK_LOG_BUFFER);
+ while(head) {
+ struct LIST *tmp=head;
+ head=head->next;
+ log_raw(tmp->opt, tmp->level, tmp->stamp, tmp->id, tmp->text);
+ str_free(tmp->stamp);
+ str_free(tmp->id);
+ str_free(tmp->text);
+ str_free(tmp);
+ }
+ head=tail=NULL;
+ CRYPTO_THREAD_unlock(stunnel_locksLOCK_LOG_BUFFER);
 }
- head=tail=NULL;
- CRYPTO_THREAD_unlock(stunnel_locksLOCK_LOG_BUFFER);
+
 CRYPTO_THREAD_unlock(stunnel_locksLOCK_LOG_MODE);
 }
 
 NOEXPORT void log_raw(SERVICE_OPTIONS *opt,
 int level, char *stamp, char *id, char *text) {
 char *line;
+ size_t size;
 
 /* NOTE: opt->log_level may have changed since s_log().
 * It is important to use the new value and not the old one. */
@@ -230,33 +287,44 @@
 /* build the line and log it to syslog/file if configured */
 switch(log_mode) {
 case LOG_MODE_CONFIGURED:
- line=str_printf("%s %s: %s", stamp, id, text);
+ size=strlen(stamp)+strlen(id)+strlen(text)+4;
+#ifdef USE_WIN32
+ line=_alloca(size);
+#else
+ line=alloca(size);
+#endif
+ snprintf(line, size, "%s %s: %s", stamp, id, text);
 if(level<=opt->log_level) {
 #if !defined(USE_WIN32) && !defined(__vms)
 if(global_options.option.log_syslog)
 syslog(level, "%s: %s", id, text);
 #endif /* USE_WIN32, __vms */
- if(outfile)
- file_putline(outfile, line);
+ if(outfile) {
+ file_putline_newline(outfile, line);
+#ifndef USE_OS_THREADS
+ file_flush(outfile);
+#endif /* !USE_OS_THREADS */
+ }
 }
 break;
 case LOG_MODE_ERROR:
 /* don't log the id or the time stamp */
+ size=strlen(text)+5;
+#ifdef USE_WIN32
+ line=_alloca(size);
+#else
+ line=alloca(size);
+#endif
 if(level>=0 && level<=7) /* just in case */
- line=str_printf("%c %s", "***!:. "level, text);
+ snprintf(line, size, "%c %s", "***!:. "level, text);
 else
- line=str_printf("? %s", text);
+ snprintf(line, size, "? %s", text);
 break;
 default: /* LOG_MODE_INFO */
 /* don't log the level, the id or the time stamp */
- line=str_dup(text);
+ line=text;
 }
 
- /* free the memory */
- str_free(stamp);
- str_free(id);
- str_free(text);
-
 /* log the line to the UI (GUI, stderr, etc.) */
 if(log_mode==LOG_MODE_ERROR ||
 (log_mode==LOG_MODE_INFO && level<LOG_DEBUG) ||
@@ -264,12 +332,10 @@
 level<=opt->log_level
 #else
 (level<=opt->log_level &&
- global_options.option.log_stderr)
+ opt->option.log_stderr)
 #endif
 )
 ui_new_log(line);
-
- str_free(line);
 }
 
 #ifdef __GNUC__
@@ -281,7 +347,14 @@
 #endif /* __GNUC__ */
 char *log_id(CLI *c) {
 const char table62=
- "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
+ {'0', '1', '2', '3', '4', '5', '6', '7',
+ '8', '9', 'a', 'b', 'c', 'd', 'e', 'f',
+ 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n',
+ 'o', 'p', 'q', 'r', 's', 't', 'u', 'v',
+ 'w', 'x', 'y', 'z', 'A', 'B', 'C', 'D',
+ 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L',
+ 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T',
+ 'U', 'V', 'W', 'X', 'Y', 'Z'};
 unsigned char rnd22;
 char *uniq;
 size_t i;
@@ -291,6 +364,7 @@
 case LOG_ID_SEQUENTIAL:
 return str_printf("%llu", c->seq);
 case LOG_ID_UNIQUE:
+ memset(rnd, 0, sizeof rnd);
 if(RAND_bytes(rnd, sizeof rnd)<=0) /* log2(62^22)=130.99 */
 return str_dup("error");
 for(i=0; i<sizeof rnd; ++i) {
@@ -330,10 +404,9 @@
 #pragma GCC diagnostic ignored "-Wunused-result"
 #endif /* __GNUC__>=4.6 */
 #endif /* __GNUC__ */
-void fatal_debug(char *txt, const char *file, int line) {
+void fatal_debug(const char *txt, const char *file, int line) {
 char msg80;
 #ifdef USE_WIN32
- DWORD num;
 #ifdef UNICODE
 TCHAR tmsg80;
 #endif
@@ -343,13 +416,8 @@
 "INTERNAL ERROR: %s at %s, line %d\n", txt, file, line);
 
 if(outfile) {
-#ifdef USE_WIN32
- WriteFile(outfile->fh, msg, (DWORD)strlen(msg), &num, NULL);
-#else /* USE_WIN32 */
- /* no file -> write to stderr */
- /* no meaningful way here to handle the result */
- write(outfile ? outfile->fd : 2, msg, strlen(msg));
-#endif /* USE_WIN32 */
+ file_putline_nonewline(outfile, msg);
+ file_flush(outfile);
 }
 
 #ifndef USE_WIN32
@@ -516,4 +584,19 @@
 *c='.';
 }
 
+/* provide hex string corresponding to the input string
+ * will be NULL terminated */
+void bin2hexstring(const unsigned char *in_data, size_t in_size, char *out_data, size_t out_size) {
+ const char hex16=
+ {'0', '1', '2', '3', '4', '5', '6', '7',
+ '8', '9' ,'A', 'B', 'C', 'D', 'E', 'F'};
+ size_t i;
+
+ for(i=0; i<in_size && 2*i+2<out_size; ++i) {
+ out_data2*i=hexin_datai>>4;
+ out_data2*i+1=hexin_datai&0x0f;
+ }
+ out_data2*i='\0';
+}
+
 /* end of log.c */

_service:tar_scm:stunnel-5.48.tar.gz/src/mingw.mak -> _service:tar_scm:stunnel-5.69.tar.gz/src/mingw.mak Changed

@@ -1,4 +1,4 @@
-# Simple Makefile.w32 for stunnel.exe by Michal Trojnara 1998-2018
+# Simple Makefile.w32 for stunnel.exe by Michal Trojnara 1998-2023
 #
 # Modified by Brian Hatch (bri@stunnel.org)
 # 20101030 pdelaage:
@@ -19,7 +19,7 @@
 # On Windows host, download:
 # http://gnuwin32.sourceforge.net/downlinks/coreutils.php
 # if you have forgotten this, this makefile will remind you...
- 
+
 # Modify this to point to your actual openssl compile directory
 # (You did already compile openssl, didn't you???)
 #SSLDIR=../../openssl-0.9.8zh
@@ -98,7 +98,7 @@
 # default options : -J rc -O coff, input rc file, output coff file.
 
 RFLAGS=-v --use-temp-file $(DEFINES)
-# following RFLAGS2 useful if one day use-temp-file does not exist anymore 
+# following RFLAGS2 useful if one day use-temp-file does not exist anymore
 RFLAGS2=-v $(DEFINES)
 LDFLAGS=-s
 
@@ -117,7 +117,7 @@
 
 # pdelaage : trick for windres preprocessing popen bug on Windows, in case the windres option
 # use_temp_file disappear one day...
-# comment out the $(RC) rule above to activate the following 
+# comment out the $(RC) rule above to activate the following
 
 $(OBJ)/%.rcp: $(SRC)/%.rc
 	$(RCP) $(DEFINES) -o$@ $<
@@ -125,7 +125,7 @@
 $(OBJ)/%.o: $(OBJ)/%.rcp
 	$(RC) $(RFLAGS2) -o$@ $<
 
-# Note : gnu-make will automatically RM the intermediate "rcp" file 
+# Note : gnu-make will automatically RM the intermediate "rcp" file
 # BUT it will ABSOLUTELY NEED the "rm" command available : not a problem on linux
 # but on a windows dev host machine, one will need to install gnu-win32/rm command
 # in the system...
@@ -152,7 +152,7 @@
 	@true >$(NULLDEV) 2>&1
 endif
 	
-clean: 
+clean:
 	-@ $(DELFILES) $(OBJ)/*.o
 	-@ $(DELFILES) $(BIN)/stunnel.exe >$(NULLDEV) 2>&1
 	-@ $(DELDIR) $(OBJ) >$(NULLDEV) 2>&1
@@ -164,10 +164,10 @@
 	-@ $(MKDIR) $(BINROOT) >$(NULLDEV) 2>&1
 	-@ $(MKDIR) $(BIN) >$(NULLDEV) 2>&1
 
-# pseudo-target for RC-preprocessor debugging 
+# pseudo-target for RC-preprocessor debugging
 # result appears OK, as a text file
 faketest:
-	gcc -E -xc-header -DRC_INVOKED $(DEFINES) -o $(SRC)/resources.rcp $(SRC)/resources.rc 
+	gcc -E -xc-header -DRC_INVOKED $(DEFINES) -o $(SRC)/resources.rcp $(SRC)/resources.rc
 
 $(OBJS): *.h mingw.mak

_service:tar_scm:stunnel-5.48.tar.gz/src/mingw.mk -> _service:tar_scm:stunnel-5.69.tar.gz/src/mingw.mk Changed

@@ -1,29 +1,54 @@
 ## mingw/mingw64 Makefile
-# by Michal Trojnara 1998-2018
+# by Michal Trojnara 1998-2023
 
 # 32-bit Windows
+#win32_arch=win32
 #win32_targetcpu=i686
 #win32_mingw=mingw
 
 # 64-bit Windows
+#win32_arch=win64
 #win32_targetcpu=x86_64
 #win32_mingw=mingw64
 
-bindir = ../bin/$(win32_mingw)
-objdir = ../obj/$(win32_mingw)
+bindir = ../bin/$(win32_arch)
+objdir = ../obj/$(win32_arch)
 
-win32_ssl_dir = /opt/openssl-$(win32_mingw)
+ifeq ($(win32_ssl_dir),)
+win32_ssl_dir := /opt/openssl-$(win32_mingw)
+endif
 win32_cppflags = -I$(win32_ssl_dir)/include
-win32_cflags = -mthreads -fstack-protector -O2
-win32_cflags += -Wall -Wextra -Wpedantic -Wformat=2 -Wconversion -Wno-long-long
+win32_cflags = -g -mthreads -O2
+win32_cflags += -fstack-protector
+win32_cflags += -Wall -Wextra -Wpedantic -Wconversion -Wno-long-long -ansi
 win32_cflags += -D_FORTIFY_SOURCE=2 -DUNICODE -D_UNICODE
-win32_ldflags = -mthreads -fstack-protector -s
+win32_ldflags = -g -mthreads -pipe
+win32_ldflags += -fstack-protector
+win32_ldflags += -Wl,--dynamicbase,--nxcompat,--no-seh,--tsaware,--no-insert-timestamp
+ifeq ($(win32_arch),win64)
+win32_ldflags += -Wl,--high-entropy-va
+else
+win32_ldflags += -Wl,--large-address-aware
+endif
 
-win32_common_libs = -lws2_32 -lkernel32
-win32_ssl_libs = -L$(win32_ssl_dir)/lib -lcrypto -lssl
+# -fstack-protector was broken in x86_64-w64-mingw32-gcc 8.2.0
+
+# compiling with -D_FORTIFY_SOURCE=2 may require linking with -lssp
+win32_common_libs = -lws2_32 -lkernel32 -lssp
+ifneq (,$(wildcard $(win32_ssl_dir)/lib64/libcrypto.dll.a))
+ # use OpenSSL 3.x.x mingw-generated library stubs if available
+ win32_ssl_libs = -L$(win32_ssl_dir)/lib64 -lcrypto -lssl
+else ifneq (,$(wildcard $(win32_ssl_dir)/lib/libcrypto.dll.a))
+ # use OpenSSL 1.x.x mingw-generated library stubs if available
+ win32_ssl_libs = -L$(win32_ssl_dir)/lib -lcrypto -lssl
+else
+ # directly import libeay32.dll and ssleay32.dll otherwise
+ win32_ssl_libs = -L$(win32_ssl_dir)/bin -llibeay32 -lssleay32
+endif
 win32_gui_libs = $(win32_common_libs) -lgdi32 -lpsapi $(win32_ssl_libs)
 win32_cli_libs = $(win32_common_libs) $(win32_ssl_libs)
 
+common_headers = common.h prototypes.h version.h
 win32_common = tls str file client log options protocol network resolver
 win32_common += ssl ctx verify sthreads fd dhparam cron stunnel
 win32_gui = ui_win_gui resources
@@ -47,8 +72,14 @@
 $(bindir)/tstunnel.exe: $(win32_common_objs) $(win32_cli_objs)
 	$(win32_cc) $(win32_ldflags) -o $(bindir)/tstunnel.exe $(win32_common_objs) $(win32_cli_objs) $(win32_cli_libs)
 
-$(objdir)/%.o: $(srcdir)/%.c $(common_headers)
+$(objdir)/%.o: $(srcdir)/%.c
 	$(win32_cc) -c $(win32_cppflags) $(win32_cflags) -o $@ $<
 
-$(objdir)/resources.o: $(srcdir)/resources.rc $(srcdir)/resources.h $(srcdir)/version.h
+$(objdir)/%.o: $(common_headers)
+
+$(win32_gui_objs): $(srcdir)/resources.h
+
+$(objdir)/resources.o: $(srcdir)/resources.rc
 	$(win32_windres) --include-dir $(srcdir) $< $@
+
+$(objdir)/resources.o: $(srcdir)/version.h

_service:tar_scm:stunnel-5.48.tar.gz/src/network.c -> _service:tar_scm:stunnel-5.69.tar.gz/src/network.c Changed

@@ -1,6 +1,6 @@
 /*
 * stunnel TLS offloading and load-balancing proxy
- * Copyright (C) 1998-2018 Michal Trojnara <Michal.Trojnara@stunnel.org>
+ * Copyright (C) 1998-2023 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
@@ -40,12 +40,14 @@
 #define FD_SETSIZE 1000000
 #endif
 
-#include "common.h"
 #include "prototypes.h"
 
 /* #define DEBUG_UCONTEXT */
 
 NOEXPORT void s_poll_realloc(s_poll_set *);
+#ifndef USE_UCONTEXT
+NOEXPORT void check_terminate(s_poll_set *);
+#endif
 
 /**************************************** s_poll functions */
 
@@ -63,10 +65,17 @@
 }
 }
 
-void s_poll_init(s_poll_set *fds) {
+void s_poll_init(s_poll_set *fds, int main_thread) {
 fds->nfds=0;
 fds->allocated=4; /* prealloc 4 file descriptors */
 s_poll_realloc(fds);
+ fds->main_thread=main_thread;
+#ifdef USE_TERMINATE_PIPE
+ s_poll_add(fds, main_thread ? signal_pipe0 : terminate_pipe0, 1, 0);
+#else
+ if(main_thread)
+ s_poll_add(fds, signal_pipe0, 1, 0);
+#endif
 }
 
 void s_poll_add(s_poll_set *fds, SOCKET fd, int rd, int wr) {
@@ -334,6 +343,8 @@
 do { /* skip "Interrupted system call" errors */
 retval=poll(fds->ufds, fds->nfds, sec<0 ? -1 : 1000*sec+msec);
 } while(retval<0 && get_last_socket_error()==S_EINTR);
+ if(retval>0)
+ check_terminate(fds);
 return retval;
 }
 
@@ -358,7 +369,7 @@
 }
 }
 
-void s_poll_init(s_poll_set *fds) {
+void s_poll_init(s_poll_set *fds, int main_thread) {
 #ifdef USE_WIN32
 fds->allocated=4; /* prealloc 4 file descriptors */
 #endif
@@ -367,6 +378,13 @@
 FD_ZERO(fds->iwfds);
 FD_ZERO(fds->ixfds);
 fds->max=0; /* no file descriptors */
+ fds->main_thread=main_thread;
+#ifdef USE_TERMINATE_PIPE
+ s_poll_add(fds, main_thread ? signal_pipe0 : terminate_pipe0, 1, 0);
+#else
+ if(main_thread)
+ s_poll_add(fds, signal_pipe0, 1, 0);
+#endif
 }
 
 void s_poll_add(s_poll_set *fds, SOCKET fd, int rd, int wr) {
@@ -449,6 +467,8 @@
 retval=select((int)fds->max+1,
 fds->orfds, fds->owfds, fds->oxfds, tv_ptr);
 } while(retval<0 && get_last_socket_error()==S_EINTR);
+ if(retval>0)
+ check_terminate(fds);
 return retval;
 }
 
@@ -465,7 +485,7 @@
 SOCKET fd;
 int ir, iw, ix, or, ow, ox;
 
- for(fd=0; fd<fds->max; fd++) {
+ for(fd=0; fd<fds->max+1; fd++) {
 ir=FD_ISSET(fd, fds->irfds);
 iw=FD_ISSET(fd, fds->iwfds);
 ix=FD_ISSET(fd, fds->ixfds);
@@ -481,11 +501,50 @@
 
 #endif /* USE_POLL */
 
+void s_poll_sleep(int sec, int msec) {
+#ifdef USE_WIN32
+ Sleep(1000*(DWORD)sec+(DWORD)msec);
+#else
+ s_poll_set *fds=s_poll_alloc();
+ s_poll_init(fds, 0);
+ s_poll_wait(fds, sec, msec);
+ s_poll_free(fds);
+#endif
+}
+
+#ifndef USE_UCONTEXT
+NOEXPORT void check_terminate(s_poll_set *fds) {
+#ifdef USE_TERMINATE_PIPE
+ if(!fds->main_thread && s_poll_canread(fds, terminate_pipe0)) {
+#ifdef USE_PTHREAD
+ pthread_exit(NULL);
+#endif /* USE_PTHREAD */
+#if defined(USE_WIN32) || defined(USE_OS2)
+#if defined(_WIN32_WCE)
+ /* FIXME */
+#else /* !_WIN32_WCE */
+ _endthreadex(0);
+#endif /* _WIN32_WCE */
+#endif /* USE_WIN32 || USE_OS2 */
+#ifdef USE_UCONTEXT
+ /* currently unused */
+ s_poll_wait(NULL, 0, 0); /* wait on poll() */
+#endif /* USE_UCONTEXT */
+#ifdef USE_FORK
+ exit(0);
+#endif /* USE_FORK */
+ }
+#else /* USE_TERMINATE_PIPE */
+ (void)fds; /* squash the unused parameter warning */
+#endif /* USE_TERMINATE_PIPE */
+}
+#endif
+
 /**************************************** fd management */
 
 int socket_options_set(SERVICE_OPTIONS *service, SOCKET s, int type) {
 SOCK_OPT *ptr;
- static char *type_str3={"accept", "local", "remote"};
+ static const char *type_str3={"accept", "local", "remote"};
 socklen_t opt_size;
 int retval=0; /* no error found */
 
@@ -560,8 +619,9 @@
 
 s_log(LOG_DEBUG, "s_connect: s_poll_wait %s: waiting %d seconds",
 dst, c->opt->timeout_connect);
- s_poll_init(c->fds);
+ s_poll_init(c->fds, 0);
 s_poll_add(c->fds, c->fd, 1, 1);
+ s_poll_dump(c->fds, LOG_DEBUG);
 switch(s_poll_wait(c->fds, c->opt->timeout_connect, 0)) {
 case -1:
 error=get_last_socket_error();
@@ -592,16 +652,16 @@
 str_free(dst);
 return -1;
 }
- return -1; /* should not be possible */
 }
 
 void s_write(CLI *c, SOCKET fd, const void *buf, size_t len) {
 /* simulate a blocking write */
- uint8_t *ptr=(uint8_t *)buf;
- ssize_t num;
+ const uint8_t *ptr=(const uint8_t *)buf;
 
 while(len>0) {
- s_poll_init(c->fds);
+ ssize_t num;
+
+ s_poll_init(c->fds, 0);
 s_poll_add(c->fds, fd, 0, 1); /* write */
 switch(s_poll_wait(c->fds, c->opt->timeout_busy, 0)) {
 case -1:
@@ -617,9 +677,20 @@
 s_log(LOG_ERR, "s_write: s_poll_wait: unknown result");
 throw_exception(c, 1); /* error */
 }
- num=writesocket(fd, (void *)ptr, len);
+
+ num=writesocket(fd, (const void *)ptr, len);
 if(num==-1) { /* error */
- sockerror("writesocket (s_write)");
+ int error=get_last_socket_error();
+ if(error==S_EINPROGRESS) {
+ s_log(LOG_DEBUG, "s_write: EINPROGRESS: Retrying");
+ continue; /* retry */
+ }
+ if(error==S_EWOULDBLOCK) {
+ s_log(LOG_DEBUG, "s_write: EWOULDBLOCK: Retrying");
+ continue; /* retry */
+ }
+ s_log(LOG_ERR, "s_write: writesocket: %s (%d)",
+ s_strerror(error), error);
 throw_exception(c, 1);
 }
 ptr+=(size_t)num;
@@ -627,39 +698,63 @@
 }
 }
 
-void s_read(CLI *c, SOCKET fd, void *ptr, size_t len) {
+size_t s_read_eof(CLI *c, SOCKET fd, void *ptr, size_t len) {
 /* simulate a blocking read */
- ssize_t num;
+ /* return a value < len on EOF */
+ size_t total=0;
 
 while(len>0) {
- s_poll_init(c->fds);
+ ssize_t num;
+
+ s_poll_init(c->fds, 0);
 s_poll_add(c->fds, fd, 1, 0); /* read */
 switch(s_poll_wait(c->fds, c->opt->timeout_busy, 0)) {
 case -1:
- sockerror("s_read: s_poll_wait");
+ sockerror("s_read_eof: s_poll_wait");
 throw_exception(c, 1); /* error */
 case 0:
- s_log(LOG_INFO, "s_read: s_poll_wait:"
+ s_log(LOG_INFO, "s_read_eof: s_poll_wait:"
 " TIMEOUTbusy exceeded: sending reset");
 throw_exception(c, 1); /* timeout */
 case 1:
 break; /* OK */
 default:
- s_log(LOG_ERR, "s_read: s_poll_wait: unknown result");
+ s_log(LOG_ERR, "s_read_eof: s_poll_wait: unknown result");
 throw_exception(c, 1); /* error */
 }
- num=readsocket(fd, ptr, len);
- switch(num) {
- case -1: /* error */
- sockerror("readsocket (s_read)");
- throw_exception(c, 1);
- case 0: /* EOF */
- s_log(LOG_ERR, "Unexpected socket close (s_read)");
+
+ num=readsocket(fd, (char *)ptr+total, len);
+ if(num==-1) { /* error */
+ int error=get_last_socket_error();
+ if(error==S_EINPROGRESS) {
+ s_log(LOG_DEBUG, "s_read_eof: EINPROGRESS: Retrying");
+ continue; /* retry */
+ }
+ if(error==S_EWOULDBLOCK) {
+ s_log(LOG_DEBUG, "s_ssl_eof: EWOULDBLOCK: Retrying");
+ continue; /* retry */
+ }
+ s_log(LOG_ERR, "s_read_eof: readsocket: %s (%d)",
+ s_strerror(error), error);
 throw_exception(c, 1);
 }
- ptr=(uint8_t *)ptr+num;
+ if(num==0) { /* EOF */
+ s_log(LOG_DEBUG, "s_read_eof: EOF");
+ break;
+ }
+ total+=(size_t)num;
 len-=(size_t)num;
 }
+ return total;
+}
+
+void s_read(CLI *c, SOCKET fd, void *ptr, size_t len) {
+ /* simulate a blocking read */
+ /* throw an exception on EOF */
+ if(s_read_eof(c, fd, ptr, len)!=len) {
+ s_log(LOG_ERR, "s_read: Unexpected socket close");
+ throw_exception(c, 1);
+ }
 }
 
 void fd_putline(CLI *c, SOCKET fd, const char *line) {
@@ -720,70 +815,125 @@
 
 void s_ssl_write(CLI *c, const void *buf, int len) {
 /* simulate a blocking SSL_write */
- uint8_t *ptr=(uint8_t *)buf;
- int num;
+ const uint8_t *ptr=(const uint8_t *)buf;
 
 while(len>0) {
- s_poll_init(c->fds);
+ int num, err;
+
+ s_poll_init(c->fds, 0);
 s_poll_add(c->fds, c->ssl_wfd->fd, 0, 1); /* write */
 switch(s_poll_wait(c->fds, c->opt->timeout_busy, 0)) {
 case -1:
- sockerror("s_write: s_poll_wait");
+ sockerror("s_ssl_write: s_poll_wait");
 throw_exception(c, 1); /* error */
 case 0:
- s_log(LOG_INFO, "s_write: s_poll_wait:"
+ s_log(LOG_INFO, "s_ssl_write: s_poll_wait:"
 " TIMEOUTbusy exceeded: sending reset");
 throw_exception(c, 1); /* timeout */
 case 1:
 break; /* OK */
 default:
- s_log(LOG_ERR, "s_write: s_poll_wait: unknown result");
+ s_log(LOG_ERR, "s_ssl_write: s_poll_wait: unknown result");
 throw_exception(c, 1); /* error */
 }
- num=SSL_write(c->ssl, (void *)ptr, len);
- if(num==-1) { /* error */
- sockerror("SSL_write (s_ssl_write)");
+
+ num=SSL_write(c->ssl, (const void *)ptr, len);
+ err=SSL_get_error(c->ssl, num);
+ if(err==SSL_ERROR_NONE) {
+ ptr+=num;
+ len-=num;
+ } else if(err==SSL_ERROR_WANT_WRITE) {
+ s_log(LOG_DEBUG, "s_ssl_write: SSL_ERROR_WANT_WRITE: Retrying");
+ } else if(err==SSL_ERROR_SSL) {
+ sslerror("s_ssl_write: SSL_write");
+ throw_exception(c, 1);
+ } else if(err==SSL_ERROR_SYSCALL) {
+ int error=get_last_socket_error();
+ if(error==S_EINPROGRESS) {
+ s_log(LOG_DEBUG, "s_ssl_write: EINPROGRESS: Retrying");
+ continue; /* retry */
+ }
+ if(error==S_EWOULDBLOCK) {
+ s_log(LOG_DEBUG, "s_ssl_write: EWOULDBLOCK: Retrying");
+ continue; /* retry */
+ }
+ s_log(LOG_ERR, "s_ssl_write: SSL_write: %s (%d)",
+ s_strerror(error), error);
+ throw_exception(c, 1);
+ } else {
+ s_log(LOG_ERR, "s_ssl_write: Unhandled error %d", err);
 throw_exception(c, 1);
 }
- ptr+=num;
- len-=num;
 }
 }
 
-void s_ssl_read(CLI *c, void *ptr, int len) {
+size_t s_ssl_read_eof(CLI *c, void *ptr, int len) {
 /* simulate a blocking SSL_read */
- int num;
+ /* return a value < len on EOF */
+ size_t total=0;
 
 while(len>0) {
+ int num, err;
+
 if(!SSL_pending(c->ssl)) {
- s_poll_init(c->fds);
+ s_poll_init(c->fds, 0);
 s_poll_add(c->fds, c->ssl_rfd->fd, 1, 0); /* read */
 switch(s_poll_wait(c->fds, c->opt->timeout_busy, 0)) {
 case -1:
- sockerror("s_read: s_poll_wait");
+ sockerror("s_ssl_read_eof: s_poll_wait");
 throw_exception(c, 1); /* error */
 case 0:
- s_log(LOG_INFO, "s_read: s_poll_wait:"
+ s_log(LOG_INFO, "s_ssl_read_eof: s_poll_wait:"
 " TIMEOUTbusy exceeded: sending reset");
 throw_exception(c, 1); /* timeout */
 case 1:
 break; /* OK */
 default:
- s_log(LOG_ERR, "s_read: s_poll_wait: unknown result");
+ s_log(LOG_ERR, "s_ssl_read_eof: s_poll_wait: unknown result");
 throw_exception(c, 1); /* error */
 }
 }
- num=SSL_read(c->ssl, ptr, len);
- switch(num) {
- case -1: /* error */
- sockerror("SSL_read (s_ssl_read)");
+
+ num=SSL_read(c->ssl, (char *)ptr+total, len);
+ err=SSL_get_error(c->ssl, num);
+ if(err==SSL_ERROR_NONE) {
+ total+=(size_t)num;
+ len-=num;
+ } else if(err==SSL_ERROR_ZERO_RETURN) {
+ s_log(LOG_DEBUG, "s_ssl_read_eof: close_notify");
+ break; /* EOF */
+ } else if(err==SSL_ERROR_WANT_READ) {
+ s_log(LOG_DEBUG, "s_ssl_read_eof: SSL_ERROR_WANT_READ: Retrying");
+ } else if(err==SSL_ERROR_SSL) {
+ sslerror("s_ssl_read_eof: SSL_read");
 throw_exception(c, 1);
- case 0: /* EOF */
- s_log(LOG_ERR, "Unexpected socket close (s_ssl_read)");
+ } else if(err==SSL_ERROR_SYSCALL) {
+ int error=get_last_socket_error();
+ if(error==S_EINPROGRESS) {
+ s_log(LOG_DEBUG, "s_ssl_read_eof: EINPROGRESS: Retrying");
+ continue; /* retry */
+ }
+ if(error==S_EWOULDBLOCK) {
+ s_log(LOG_DEBUG, "s_ssl_read_eof: EWOULDBLOCK: Retrying");
+ continue; /* retry */
+ }
+ s_log(LOG_ERR, "s_ssl_read_eof: SSL_read: %s (%d)",
+ s_strerror(error), error);
+ throw_exception(c, 1);
+ } else {
+ s_log(LOG_ERR, "s_ssl_read_oef: Unhandled error %d", err);
 throw_exception(c, 1);
 }
- ptr=(uint8_t *)ptr+num;
- len-=num;
+ }
+ return total;
+}
+
+void s_ssl_read(CLI *c, void *ptr, int len) {
+ /* simulate a blocking SSL_read */
+ /* throw an exception on EOF */
+ if(s_ssl_read_eof(c, ptr, len)!=(size_t)len) {
+ s_log(LOG_ERR, "s_ssl_read: Unexpected socket close");
+ throw_exception(c, 1);
 }
 }
 
@@ -856,6 +1006,21 @@
 s_log(LOG_DEBUG, " -> %s", line);
 }
 
+void ssl_printf(CLI *c, const char *format, ...) {
+ va_list ap;
+ char *line;
+
+ va_start(ap, format);
+ line=str_vprintf(format, ap);
+ va_end(ap);
+ if(!line) {
+ s_log(LOG_ERR, "ssl_printf: str_vprintf failed");
+ throw_exception(c, 1);
+ }
+ ssl_putline(c, line);
+ str_free(line);
+}
+
 /**************************************** network helpers */
 
 #define INET_SOCKET_PAIR
@@ -929,10 +1094,10 @@
 addrlen=sizeof(SOCKADDR_UNION);
 #ifdef SO_ORIGINAL_DST
 #ifdef USE_IPv6
- if(!getsockopt(fd, SOL_IPV6, SO_ORIGINAL_DST, &addr->sa, &addrlen))
+ if(!getsockopt(fd, SOL_IPV6, SO_ORIGINAL_DST, (char *)&addr->sa, &addrlen))
 return 0; /* succeeded */
 #endif /* USE_IPv6 */
- if(!getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, &addr->sa, &addrlen))
+ if(!getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, (char *)&addr->sa, &addrlen))
 return 0; /* succeeded */
 sockerror("getsockopt SO_ORIGINAL_DST");
 #else /* SO_ORIGINAL_DST */

_service:tar_scm:stunnel-5.48.tar.gz/src/options.c -> _service:tar_scm:stunnel-5.69.tar.gz/src/options.c Changed

@@ -1,6 +1,6 @@
 /*
 * stunnel TLS offloading and load-balancing proxy
- * Copyright (C) 1998-2018 Michal Trojnara <Michal.Trojnara@stunnel.org>
+ * Copyright (C) 1998-2023 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
@@ -35,27 +35,34 @@
 * forward this exception.
 */
 
-#include "common.h"
 #include "prototypes.h"
 
+#if OPENSSL_VERSION_NUMBER >= 0x10101000L
+#define DEFAULT_CURVES "X25519:P-256:X448:P-521:P-384"
+#else /* OpenSSL version < 1.1.1 */
+#define DEFAULT_CURVES "prime256v1"
+#endif /* OpenSSL version >= 1.1.1 */
+
 #if defined(_WIN32_WCE) && !defined(CONFDIR)
 #define CONFDIR "\\stunnel"
 #endif
 
 #define CONFLINELEN (16*1024)
 
+#define INVALID_SSL_OPTION ((long unsigned)-1)
+
 typedef enum {
- CMD_BEGIN, /* initialize defaults */
- CMD_EXEC, /* process command */
- CMD_END, /* end of section */
- CMD_DUP, /* duplicate new_service_options */
- CMD_FREE, /* deallocate memory */
- CMD_DEFAULT, /* print default value */
- CMD_HELP /* print help */
+ CMD_SET_DEFAULTS, /* set default values */
+ CMD_SET_COPY, /* duplicate from new_service_options */
+ CMD_FREE, /* deallocate memory */
+ CMD_SET_VALUE, /* set a user-specified value */
+ CMD_INITIALIZE, /* initialize the global options or a section */
+ CMD_PRINT_DEFAULTS, /* print default values */
+ CMD_PRINT_HELP /* print help */
 } CMD;
 
 NOEXPORT int options_file(char *, CONF_TYPE, SERVICE_OPTIONS **);
-NOEXPORT int options_include(char *, SERVICE_OPTIONS **);
+NOEXPORT int init_section(int, SERVICE_OPTIONS **);
 #ifdef USE_WIN32
 struct dirent {
 char d_nameMAX_PATH;
@@ -65,18 +72,22 @@
 int (*)(const struct dirent **, const struct dirent **));
 int alphasort(const struct dirent **, const struct dirent **);
 #endif
-NOEXPORT char *parse_global_option(CMD, char *, char *);
-NOEXPORT char *parse_service_option(CMD, SERVICE_OPTIONS *, char *, char *);
+NOEXPORT const char *parse_global_option(CMD, GLOBAL_OPTIONS *, char *, char *);
+NOEXPORT const char *parse_service_option(CMD, SERVICE_OPTIONS **, char *, char *);
 
 #ifndef OPENSSL_NO_TLSEXT
-NOEXPORT char *sni_init(SERVICE_OPTIONS *);
+NOEXPORT const char *sni_init(SERVICE_OPTIONS *);
 NOEXPORT void sni_free(SERVICE_OPTIONS *);
 #endif /* !defined(OPENSSL_NO_TLSEXT) */
 
+#if OPENSSL_VERSION_NUMBER>=0x10100000L
+NOEXPORT int str_to_proto_version(const char *);
+#else /* OPENSSL_VERSION_NUMBER<0x10100000L */
 NOEXPORT char *tls_methods_set(SERVICE_OPTIONS *, const char *);
 NOEXPORT char *tls_methods_check(SERVICE_OPTIONS *);
+#endif /* OPENSSL_VERSION_NUMBER<0x10100000L */
 
-NOEXPORT char *parse_debug_level(char *, SERVICE_OPTIONS *);
+NOEXPORT const char *parse_debug_level(char *, SERVICE_OPTIONS *);
 
 #ifndef OPENSSL_NO_PSK
 NOEXPORT PSK_KEYS *psk_read(char *);
@@ -84,125 +95,176 @@
 NOEXPORT void psk_free(PSK_KEYS *);
 #endif /* !defined(OPENSSL_NO_PSK) */
 
+#if OPENSSL_VERSION_NUMBER>=0x10000000L
+NOEXPORT TICKET_KEY *key_read(char *, const char *);
+NOEXPORT TICKET_KEY *key_dup(TICKET_KEY *);
+NOEXPORT void key_free(TICKET_KEY *);
+#endif /* OpenSSL 1.0.0 or later */
+
 typedef struct {
- char *name;
+ const char *name;
 long unsigned value;
 } SSL_OPTION;
 
 static const SSL_OPTION ssl_opts = {
- {"MICROSOFT_SESS_ID_BUG", SSL_OP_MICROSOFT_SESS_ID_BUG},
- {"NETSCAPE_CHALLENGE_BUG", SSL_OP_NETSCAPE_CHALLENGE_BUG},
+#ifdef SSL_OP_ALL
+ {"ALL", SSL_OP_ALL},
+#endif
+#ifdef SSL_OP_ALLOW_CLIENT_RENEGOTIATION
+ {"ALLOW_CLIENT_RENEGOTIATION", SSL_OP_ALLOW_CLIENT_RENEGOTIATION},
+#endif
+#ifdef SSL_OP_ALLOW_NO_DHE_KEX
+ {"ALLOW_NO_DHE_KEX", SSL_OP_ALLOW_NO_DHE_KEX},
+#endif
+#ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
+ {"ALLOW_UNSAFE_LEGACY_RENEGOTIATION", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION},
+#endif
+#ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
+ {"CIPHER_SERVER_PREFERENCE", SSL_OP_CIPHER_SERVER_PREFERENCE},
+#endif
+#ifdef SSL_OP_CISCO_ANYCONNECT
+ {"CISCO_ANYCONNECT", SSL_OP_CISCO_ANYCONNECT},
+#endif
+#ifdef SSL_OP_CLEANSE_PLAINTEXT
+ {"CLEANSE_PLAINTEXT", SSL_OP_CLEANSE_PLAINTEXT},
+#endif
+#ifdef SSL_OP_COOKIE_EXCHANGE
+ {"COOKIE_EXCHANGE", SSL_OP_COOKIE_EXCHANGE},
+#endif
+#ifdef SSL_OP_CRYPTOPRO_TLSEXT_BUG
+ {"CRYPTOPRO_TLSEXT_BUG", SSL_OP_CRYPTOPRO_TLSEXT_BUG},
+#endif
+#ifdef SSL_OP_DISABLE_TLSEXT_CA_NAMES
+ {"DISABLE_TLSEXT_CA_NAMES", SSL_OP_DISABLE_TLSEXT_CA_NAMES},
+#endif
+#ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
+ {"DONT_INSERT_EMPTY_FRAGMENTS", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS},
+#endif
+#ifdef SSL_OP_ENABLE_KTLS
+ {"ENABLE_KTLS", SSL_OP_ENABLE_KTLS},
+#endif
+#ifdef SSL_OP_ENABLE_MIDDLEBOX_COMPAT
+ {"ENABLE_MIDDLEBOX_COMPAT", SSL_OP_ENABLE_MIDDLEBOX_COMPAT},
+#endif
+#ifdef SSL_OP_EPHEMERAL_RSA
+ {"EPHEMERAL_RSA", SSL_OP_EPHEMERAL_RSA},
+#endif
+#ifdef SSL_OP_IGNORE_UNEXPECTED_EOF
+ {"IGNORE_UNEXPECTED_EOF", SSL_OP_IGNORE_UNEXPECTED_EOF},
+#endif
 #ifdef SSL_OP_LEGACY_SERVER_CONNECT
 {"LEGACY_SERVER_CONNECT", SSL_OP_LEGACY_SERVER_CONNECT},
 #endif
- {"NETSCAPE_REUSE_CIPHER_CHANGE_BUG",
- SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG},
-#ifdef SSL_OP_TLSEXT_PADDING
- {"TLSEXT_PADDING", SSL_OP_TLSEXT_PADDING},
-#endif
+#ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
 {"MICROSOFT_BIG_SSLV3_BUFFER", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER},
-#ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
- {"SAFARI_ECDHE_ECDSA_BUG", SSL_OP_SAFARI_ECDHE_ECDSA_BUG},
 #endif
- {"SSLEAY_080_CLIENT_DH_BUG", SSL_OP_SSLEAY_080_CLIENT_DH_BUG},
- {"TLS_D5_BUG", SSL_OP_TLS_D5_BUG},
- {"TLS_BLOCK_PADDING_BUG", SSL_OP_TLS_BLOCK_PADDING_BUG},
+#ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
+ {"MICROSOFT_SESS_ID_BUG", SSL_OP_MICROSOFT_SESS_ID_BUG},
+#endif
 #ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
 {"MSIE_SSLV2_RSA_PADDING", SSL_OP_MSIE_SSLV2_RSA_PADDING},
 #endif
- {"SSLREF2_REUSE_CERT_TYPE_BUG", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG},
-#ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
- {"DONT_INSERT_EMPTY_FRAGMENTS", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS},
-#endif
- {"ALL", SSL_OP_ALL},
-#ifdef SSL_OP_NO_QUERY_MTU
- {"NO_QUERY_MTU", SSL_OP_NO_QUERY_MTU},
+#ifdef SSL_OP_NETSCAPE_CA_DN_BUG
+ {"NETSCAPE_CA_DN_BUG", SSL_OP_NETSCAPE_CA_DN_BUG},
 #endif
-#ifdef SSL_OP_COOKIE_EXCHANGE
- {"COOKIE_EXCHANGE", SSL_OP_COOKIE_EXCHANGE},
+#ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
+ {"NETSCAPE_CHALLENGE_BUG", SSL_OP_NETSCAPE_CHALLENGE_BUG},
 #endif
-#ifdef SSL_OP_NO_TICKET
- {"NO_TICKET", SSL_OP_NO_TICKET},
+#ifdef SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG
+ {"NETSCAPE_DEMO_CIPHER_CHANGE_BUG", SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG},
 #endif
-#ifdef SSL_OP_CISCO_ANYCONNECT
- {"CISCO_ANYCONNECT", SSL_OP_CISCO_ANYCONNECT},
+#ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
+ {"NETSCAPE_REUSE_CIPHER_CHANGE_BUG", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG},
 #endif
-#ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
- {"NO_SESSION_RESUMPTION_ON_RENEGOTIATION",
- SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION},
+#ifdef SSL_OP_NO_ANTI_REPLAY
+ {"NO_ANTI_REPLAY", SSL_OP_NO_ANTI_REPLAY},
 #endif
 #ifdef SSL_OP_NO_COMPRESSION
 {"NO_COMPRESSION", SSL_OP_NO_COMPRESSION},
 #endif
-#ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
- {"ALLOW_UNSAFE_LEGACY_RENEGOTIATION",
- SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION},
+#ifdef SSL_OP_NO_DTLS_MASK
+ {"NO_DTLS_MASK", SSL_OP_NO_DTLS_MASK},
 #endif
-#ifdef SSL_OP_SINGLE_ECDH_USE
- {"SINGLE_ECDH_USE", SSL_OP_SINGLE_ECDH_USE},
+#ifdef SSL_OP_NO_DTLSv1
+ {"NO_DTLSv1", SSL_OP_NO_DTLSv1},
 #endif
- {"SINGLE_DH_USE", SSL_OP_SINGLE_DH_USE},
- {"EPHEMERAL_RSA", SSL_OP_EPHEMERAL_RSA},
-#ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
- {"CIPHER_SERVER_PREFERENCE", SSL_OP_CIPHER_SERVER_PREFERENCE},
+#ifdef SSL_OP_NO_DTLSv1_2
+ {"NO_DTLSv1_2", SSL_OP_NO_DTLSv1_2},
 #endif
- {"TLS_ROLLBACK_BUG", SSL_OP_TLS_ROLLBACK_BUG},
+#ifdef SSL_OP_NO_ENCRYPT_THEN_MAC
+ {"NO_ENCRYPT_THEN_MAC", SSL_OP_NO_ENCRYPT_THEN_MAC},
+#endif
+#ifdef SSL_OP_NO_EXTENDED_MASTER_SECRET
+ {"NO_EXTENDED_MASTER_SECRET", SSL_OP_NO_EXTENDED_MASTER_SECRET},
+#endif
+#ifdef SSL_OP_NO_QUERY_MTU
+ {"NO_QUERY_MTU", SSL_OP_NO_QUERY_MTU},
+#endif
+#ifdef SSL_OP_NO_RENEGOTIATION
+ {"NO_RENEGOTIATION", SSL_OP_NO_RENEGOTIATION},
+#endif
+#ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
+ {"NO_SESSION_RESUMPTION_ON_RENEGOTIATION", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION},
+#endif
+#ifdef SSL_OP_NO_SSL_MASK
+ {"NO_SSL_MASK", SSL_OP_NO_SSL_MASK},
+#endif
+#ifdef SSL_OP_NO_SSLv2
 {"NO_SSLv2", SSL_OP_NO_SSLv2},
+#endif
+#ifdef SSL_OP_NO_SSLv3
 {"NO_SSLv3", SSL_OP_NO_SSLv3},
+#endif
+#ifdef SSL_OP_NO_TICKET
+ {"NO_TICKET", SSL_OP_NO_TICKET},
+#endif
+#ifdef SSL_OP_NO_TLSv1
 {"NO_TLSv1", SSL_OP_NO_TLSv1},
+#endif
 #ifdef SSL_OP_NO_TLSv1_1
- {"NO_TLSv1.1", SSL_OP_NO_TLSv1_1},
-#else /* ignore if unsupported by OpenSSL */
- {"NO_TLSv1.1", 0},
+ {"NO_TLSv1_1", SSL_OP_NO_TLSv1_1},
 #endif
 #ifdef SSL_OP_NO_TLSv1_2
- {"NO_TLSv1.2", SSL_OP_NO_TLSv1_2},
-#else /* ignore if unsupported by OpenSSL */
- {"NO_TLSv1.2", 0},
+ {"NO_TLSv1_2", SSL_OP_NO_TLSv1_2},
 #endif
 #ifdef SSL_OP_NO_TLSv1_3
- {"NO_TLSv1.3", SSL_OP_NO_TLSv1_3},
- {"NO_TLSv1_3", SSL_OP_NO_TLSv1_3}, /* keep compatibility with our typo */
-#else /* ignore if unsupported by OpenSSL */
- {"NO_TLSv1.3", 0},
- {"NO_TLSv1_3", 0}, /* keep compatibility with our typo */
+ {"NO_TLSv1_3", SSL_OP_NO_TLSv1_3},
 #endif
+#ifdef SSL_OP_PKCS1_CHECK_1
 {"PKCS1_CHECK_1", SSL_OP_PKCS1_CHECK_1},
+#endif
+#ifdef SSL_OP_PKCS1_CHECK_2
 {"PKCS1_CHECK_2", SSL_OP_PKCS1_CHECK_2},
- {"NETSCAPE_CA_DN_BUG", SSL_OP_NETSCAPE_CA_DN_BUG},
-#ifdef SSL_OP_NON_EXPORT_FIRST
- {"NON_EXPORT_FIRST", SSL_OP_NON_EXPORT_FIRST},
 #endif
- {"NETSCAPE_DEMO_CIPHER_CHANGE_BUG", SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG},
-#ifdef SSL_OP_CRYPTOPRO_TLSEXT_BUG
- {"CRYPTOPRO_TLSEXT_BUG", SSL_OP_CRYPTOPRO_TLSEXT_BUG},
+#ifdef SSL_OP_PRIORITIZE_CHACHA
+ {"PRIORITIZE_CHACHA", SSL_OP_PRIORITIZE_CHACHA},
 #endif
-#ifdef SSL_OP_NO_DTLSv1
- {"NO_DTLSv1", SSL_OP_NO_DTLSv1},
+#ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
+ {"SAFARI_ECDHE_ECDSA_BUG", SSL_OP_SAFARI_ECDHE_ECDSA_BUG},
 #endif
-#ifdef SSL_OP_NO_DTLSv1_2
- {"NO_DTLSv1_2", SSL_OP_NO_DTLSv1_2},
+#ifdef SSL_OP_SINGLE_DH_USE
+ {"SINGLE_DH_USE", SSL_OP_SINGLE_DH_USE},
 #endif
-#ifdef SSL_OP_NO_SSL_MASK
- {"NO_SSL_MASK", SSL_OP_NO_SSL_MASK},
+#ifdef SSL_OP_SINGLE_ECDH_USE
+ {"SINGLE_ECDH_USE", SSL_OP_SINGLE_ECDH_USE},
 #endif
-#ifdef SSL_OP_NO_DTLS_MASK
- {"NO_DTLS_MASK", SSL_OP_NO_DTLS_MASK},
+#ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
+ {"SSLEAY_080_CLIENT_DH_BUG", SSL_OP_SSLEAY_080_CLIENT_DH_BUG},
 #endif
-#ifdef SSL_OP_NO_ENCRYPT_THEN_MAC
- {"NO_ENCRYPT_THEN_MAC", SSL_OP_NO_ENCRYPT_THEN_MAC},
+#ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
+ {"SSLREF2_REUSE_CERT_TYPE_BUG", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG},
 #endif
-#ifdef SSL_OP_ALLOW_NO_DHE_KEX
- {"ALLOW_NO_DHE_KEX", SSL_OP_ALLOW_NO_DHE_KEX},
+#ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
+ {"TLS_BLOCK_PADDING_BUG", SSL_OP_TLS_BLOCK_PADDING_BUG},
 #endif
-#ifdef SSL_OP_ENABLE_MIDDLEBOX_COMPAT
- {"ENABLE_MIDDLEBOX_COMPAT", SSL_OP_ENABLE_MIDDLEBOX_COMPAT},
+#ifdef SSL_OP_TLS_D5_BUG
+ {"TLS_D5_BUG", SSL_OP_TLS_D5_BUG},
 #endif
-#ifdef SSL_OP_NO_RENEGOTIATION
- {"NO_RENEGOTIATION", SSL_OP_NO_RENEGOTIATION},
+#ifdef SSL_OP_TLSEXT_PADDING
+ {"TLSEXT_PADDING", SSL_OP_TLSEXT_PADDING},
 #endif
-#ifdef SSL_OP_PRIORITIZE_CHACHA
- {"PRIORITIZE_CHACHA", SSL_OP_PRIORITIZE_CHACHA},
+#ifdef SSL_OP_TLS_ROLLBACK_BUG
+ {"TLS_ROLLBACK_BUG", SSL_OP_TLS_ROLLBACK_BUG},
 #endif
 {NULL, 0}
 };
@@ -211,7 +273,7 @@
 NOEXPORT void print_ssl_options(void);
 
 NOEXPORT SOCK_OPT *socket_options_init(void);
-NOEXPORT void socket_option_set_int(SOCK_OPT *, char *, int, int);
+NOEXPORT void socket_option_set_int(SOCK_OPT *, const char *, int, int);
 NOEXPORT SOCK_OPT *socket_options_dup(SOCK_OPT *);
 NOEXPORT void socket_options_free(SOCK_OPT *);
 NOEXPORT int socket_options_print(void);
@@ -224,15 +286,17 @@
 
 #ifndef OPENSSL_NO_ENGINE
 NOEXPORT void engine_reset_list(void);
-NOEXPORT char *engine_auto(void);
-NOEXPORT char *engine_open(const char *);
-NOEXPORT char *engine_ctrl(const char *, const char *);
-NOEXPORT char *engine_default(const char *);
-NOEXPORT char *engine_init(void);
+NOEXPORT const char *engine_auto(void);
+NOEXPORT const char *engine_open(const char *);
+NOEXPORT const char *engine_ctrl(const char *, const char *);
+NOEXPORT const char *engine_default(const char *);
+NOEXPORT const char *engine_init(void);
 NOEXPORT ENGINE *engine_get_by_id(const char *);
 NOEXPORT ENGINE *engine_get_by_num(const int);
 #endif /* !defined(OPENSSL_NO_ENGINE) */
 
+NOEXPORT const char *include_config(char *, SERVICE_OPTIONS **);
+
 NOEXPORT void print_syntax(void);
 
 NOEXPORT void name_list_append(NAME_LIST **, char *);
@@ -244,7 +308,7 @@
 NOEXPORT void arg_free(char **arg);
 #endif
 
-char configuration_filePATH_MAX;
+static char *configuration_file=NULL;
 
 GLOBAL_OPTIONS global_options;
 SERVICE_OPTIONS service_options;
@@ -253,11 +317,18 @@
 static GLOBAL_OPTIONS new_global_options;
 static SERVICE_OPTIONS new_service_options;
 
-static char *option_not_found=
+static const char *option_not_found=
 "Specified option name is not valid here";
 
-static char *stunnel_cipher_list=
+static const char *stunnel_cipher_list=
 "HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK";
+static const char *fips_cipher_list=
+ "FIPS:!DH:!kDHEPSK";
+
+#ifndef OPENSSL_NO_TLS1_3
+static const char *stunnel_ciphersuites=
+ "TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256";
+#endif /* TLS 1.3 */
 
 /**************************************** parse commandline parameters */
 
@@ -268,7 +339,7 @@
 */
 
 int options_cmdline(char *arg1, char *arg2) {
- char *name;
+ const char *name;
 CONF_TYPE type;
 
 #ifdef USE_WIN32
@@ -287,13 +358,13 @@
 "stunnel.conf";
 type=CONF_FILE;
 } else if(!strcasecmp(arg1, "-help")) {
- parse_global_option(CMD_HELP, NULL, NULL);
- parse_service_option(CMD_HELP, NULL, NULL, NULL);
+ parse_global_option(CMD_PRINT_HELP, NULL, NULL, NULL);
+ parse_service_option(CMD_PRINT_HELP, NULL, NULL, NULL);
 log_flush(LOG_MODE_INFO);
 return 2;
 } else if(!strcasecmp(arg1, "-version")) {
- parse_global_option(CMD_DEFAULT, NULL, NULL);
- parse_service_option(CMD_DEFAULT, NULL, NULL, NULL);
+ parse_global_option(CMD_PRINT_DEFAULTS, NULL, NULL, NULL);
+ parse_service_option(CMD_PRINT_DEFAULTS, NULL, NULL, NULL);
 log_flush(LOG_MODE_INFO);
 return 2;
 } else if(!strcasecmp(arg1, "-sockets")) {
@@ -321,18 +392,30 @@
 type=CONF_FILE;
 }
 
-#ifdef HAVE_REALPATH
 if(type==CONF_FILE) {
- if(!realpath(name, configuration_file)) {
+#ifdef HAVE_REALPATH
+ char *buffer=NULL, *real_path;
+#ifdef MAXPATHLEN
+ /* a workaround for pre-POSIX.1-2008 4.4BSD and Solaris */
+ buffer=malloc(MAXPATHLEN);
+#endif
+ real_path=realpath(name, buffer);
+ if(!real_path) {
+ free(buffer);
 s_log(LOG_ERR, "Invalid configuration file name \"%s\"", name);
 ioerror("realpath");
 return 1;
 }
- return options_parse(type);
- }
+ configuration_file=str_dup(real_path);
+ free(real_path);
+#else
+ configuration_file=str_dup(name);
 #endif
- strncpy(configuration_file, name, PATH_MAX-1);
- configuration_filePATH_MAX-1='\0';
+#ifndef USE_WIN32
+ } else if(type==CONF_FD) {
+ configuration_file=str_dup(name);
+#endif
+ }
 return options_parse(type);
 }
 
@@ -340,44 +423,29 @@
 
 int options_parse(CONF_TYPE type) {
 SERVICE_OPTIONS *section;
- char *errstr;
 
 options_defaults();
 section=&new_service_options;
- if(options_file(configuration_file, type, &section))
- return 1;
-
- if(new_service_options.next) { /* daemon mode: initialize sections */
- for(section=new_service_options.next; section; section=section->next) {
- s_log(LOG_INFO, "Initializing service %s", section->servname);
- errstr=parse_service_option(CMD_END, section, NULL, NULL);
- if(errstr)
- break;
- }
- } else { /* inetd mode: need to initialize global options */
- errstr=parse_global_option(CMD_END, NULL, NULL);
- if(errstr) {
- s_log(LOG_ERR, "Global options: %s", errstr);
- return 1;
- }
- s_log(LOG_INFO, "Initializing inetd mode configuration");
- section=&new_service_options;
- errstr=parse_service_option(CMD_END, section, NULL, NULL);
- }
- if(errstr) {
- s_log(LOG_ERR, "Service %s: %s", section->servname, errstr);
+ /* options_file() is a recursive function, so the last section of the
+ * configuration file section needs to be initialized separately */
+ if(options_file(configuration_file, type, &section) ||
+ init_section(1, &section)) {
+ s_log(LOG_ERR, "Configuration failed");
+ options_free(0); /* free the new options */
 return 1;
 }
-
 s_log(LOG_NOTICE, "Configuration successful");
 return 0;
 }
 
-NOEXPORT int options_file(char *path, CONF_TYPE type, SERVICE_OPTIONS **section) {
+NOEXPORT int options_file(char *path, CONF_TYPE type,
+ SERVICE_OPTIONS **section_ptr) {
 DISK_FILE *df;
- char line_textCONFLINELEN, *errstr;
+ char line_textCONFLINELEN;
+ const char *errstr;
 char config_lineCONFLINELEN, *config_opt, *config_arg;
 int i, line_number=0;
+ const u_char utf8_bom = {0xef, 0xbb, 0xbf};
 #ifndef USE_WIN32
 int fd;
 char *tmp_str;
@@ -393,7 +461,7 @@
 print_syntax();
 return 1;
 }
- df=file_fdopen(fd);
+ df=file_fdopen(fd, FILE_MODE_READ);
 } else
 #endif
 df=file_open(path, FILE_MODE_READ);
@@ -409,11 +477,9 @@
 ++line_number;
 config_opt=config_line;
 if(line_number==1) {
- if(config_opt0==(char)0xef &&
- config_opt1==(char)0xbb &&
- config_opt2==(char)0xbf) {
+ if(!memcmp(config_opt, utf8_bom, sizeof utf8_bom)) {
 s_log(LOG_NOTICE, "UTF-8 byte order mark detected");
- config_opt+=3;
+ config_opt+=sizeof utf8_bom;
 } else {
 s_log(LOG_NOTICE, "UTF-8 byte order mark not detected");
 }
@@ -427,15 +493,9 @@
 continue;
 
 if(config_opt0=='' && config_optstrlen(config_opt)-1=='') { /* new section */
- /* initialize global options */
- if(!new_service_options.next) {
- errstr=parse_global_option(CMD_END, NULL, NULL);
- if(errstr) {
- s_log(LOG_ERR, "%s:%d: \"%s\": %s",
- path, line_number, line_text, errstr);
- file_close(df);
- return 1;
- }
+ if(init_section(0, section_ptr)) {
+ file_close(df);
+ return 1;
 }
 
 /* append a new SERVICE_OPTIONS structure to the list */
@@ -443,16 +503,16 @@
 SERVICE_OPTIONS *new_section;
 new_section=str_alloc_detached(sizeof(SERVICE_OPTIONS));
 new_section->next=NULL;
- (*section)->next=new_section;
- *section=new_section;
+ (*section_ptr)->next=new_section;
+ *section_ptr=new_section;
 }
 
 /* initialize the newly allocated section */
 ++config_opt;
 config_optstrlen(config_opt)-1='\0';
- (*section)->servname=str_dup_detached(config_opt);
- (*section)->session=NULL;
- parse_service_option(CMD_DUP, *section, NULL, NULL);
+ (*section_ptr)->servname=str_dup_detached(config_opt);
+ (*section_ptr)->session=NULL;
+ parse_service_option(CMD_SET_COPY, section_ptr, NULL, NULL);
 continue;
 }
 
@@ -469,22 +529,12 @@
 while(isspace((unsigned char)*config_arg))
 ++config_arg; /* remove initial whitespaces */
 
- if(!strcasecmp(config_opt, "include")) {
- if(options_include(config_arg, section)) {
- s_log(LOG_ERR, "%s:%d: Failed to include directory \"%s\"",
- path, line_number, config_arg);
- file_close(df);
- return 1;
- }
- continue;
- }
-
 errstr=option_not_found;
 /* try global options first (e.g. for 'debug') */
 if(!new_service_options.next)
- errstr=parse_global_option(CMD_EXEC, config_opt, config_arg);
+ errstr=parse_global_option(CMD_SET_VALUE, &new_global_options, config_opt, config_arg);
 if(errstr==option_not_found)
- errstr=parse_service_option(CMD_EXEC, *section, config_opt, config_arg);
+ errstr=parse_service_option(CMD_SET_VALUE, section_ptr, config_opt, config_arg);
 if(errstr) {
 s_log(LOG_ERR, "%s:%d: \"%s\": %s",
 path, line_number, line_text, errstr);
@@ -496,36 +546,35 @@
 return 0;
 }
 
-NOEXPORT int options_include(char *directory, SERVICE_OPTIONS **section) {
- struct dirent **namelist;
- int i, num, err=0;
+NOEXPORT int init_section(int eof, SERVICE_OPTIONS **section_ptr) {
+ const char *errstr;
 
- num=scandir(directory, &namelist, NULL, alphasort);
- if(num<0) {
- ioerror("scandir");
- return 1;
+#ifndef USE_WIN32
+ (*section_ptr)->option.log_stderr=new_global_options.option.log_stderr;
+#endif /* USE_WIN32 */
+
+ if(*section_ptr==&new_service_options) {
+ /* end of global options or inetd mode -> initialize globals */
+ errstr=parse_global_option(CMD_INITIALIZE, &new_global_options, NULL, NULL);
+ if(errstr) {
+ s_log(LOG_ERR, "Global options: %s", errstr);
+ return 1;
+ }
 }
- for(i=0; i<num; ++i) {
- if(!err) {
- struct stat sb;
- char *name=str_printf(
-#ifdef USE_WIN32
- "%s\\%s",
-#else
- "%s/%s",
-#endif
- directory, namelisti->d_name);
- stat(name, &sb);
- if(S_ISREG(sb.st_mode))
- err=options_file(name, CONF_FILE, section);
+
+ if(*section_ptr!=&new_service_options || eof) {
+ /* end service section or inetd mode -> initialize service */
+ errstr=parse_service_option(CMD_INITIALIZE, section_ptr, NULL, NULL);
+ if(errstr) {
+ if(*section_ptr==&new_service_options)
+ s_log(LOG_ERR, "Inetd mode: %s", errstr);
 else
- s_log(LOG_DEBUG, "\"%s\" is not a file", name);
- str_free(name);
+ s_log(LOG_ERR, "Service %s: %s",
+ (*section_ptr)->servname, errstr);
+ return 1;
 }
- free(namelisti);
 }
- free(namelist);
- return err;
+ return 0;
 }
 
 #ifdef USE_WIN32
@@ -580,31 +629,51 @@
 #endif
 
 void options_defaults() {
+ SERVICE_OPTIONS *service;
+
 /* initialize globals *before* opening the config file */
 memset(&new_global_options, 0, sizeof(GLOBAL_OPTIONS));
 memset(&new_service_options, 0, sizeof(SERVICE_OPTIONS));
 new_service_options.next=NULL;
 
- parse_global_option(CMD_BEGIN, NULL, NULL);
- parse_service_option(CMD_BEGIN, &new_service_options, NULL, NULL);
+ parse_global_option(CMD_SET_DEFAULTS, &new_global_options, NULL, NULL);
+ service=&new_service_options;
+ parse_service_option(CMD_SET_DEFAULTS, &service, NULL, NULL);
 }
 
 void options_apply() { /* apply default/validated configuration */
 unsigned num=0;
 SERVICE_OPTIONS *section;
 
+ CRYPTO_THREAD_write_lock(stunnel_locksLOCK_SECTIONS);
+
 memcpy(&global_options, &new_global_options, sizeof(GLOBAL_OPTIONS));
+ memset(&new_global_options, 0, sizeof(GLOBAL_OPTIONS));
 
 /* service_options are used for inetd mode and to enumerate services */
 for(section=new_service_options.next; section; section=section->next)
 section->section_number=num++;
 memcpy(&service_options, &new_service_options, sizeof(SERVICE_OPTIONS));
+ memset(&new_service_options, 0, sizeof(SERVICE_OPTIONS));
 number_of_sections=num;
+
+ CRYPTO_THREAD_unlock(stunnel_locksLOCK_SECTIONS);
 }
 
-void options_free() {
- /* FIXME: this operation may be unsafe, as client() threads use it */
- parse_global_option(CMD_FREE, NULL, NULL);
+void options_free(int current) {
+ GLOBAL_OPTIONS *global=current?&global_options:&new_global_options;
+ SERVICE_OPTIONS *service=current?&service_options:&new_service_options;
+
+ parse_global_option(CMD_FREE, global, NULL, NULL);
+
+ CRYPTO_THREAD_write_lock(stunnel_locksLOCK_SECTIONS);
+ while(service) {
+ SERVICE_OPTIONS *tmp=service;
+ service=service->next;
+ tmp->next=NULL;
+ service_free(tmp);
+ }
+ CRYPTO_THREAD_unlock(stunnel_locksLOCK_SECTIONS);
 }
 
 void service_up_ref(SERVICE_OPTIONS *section) {
@@ -625,16 +694,18 @@
 #else
 ref=--(section->ref);
 #endif
+ if(ref<0)
+ fatal("Negative section reference counter");
 if(ref==0)
- parse_service_option(CMD_FREE, section, NULL, NULL);
+ parse_service_option(CMD_FREE, &section, NULL, NULL);
 }
 
 /**************************************** global options */
 
-NOEXPORT char *parse_global_option(CMD cmd, char *opt, char *arg) {
+NOEXPORT const char *parse_global_option(CMD cmd, GLOBAL_OPTIONS *options, char *opt, char *arg) {
 void *tmp;
 
- if(cmd==CMD_DEFAULT || cmd==CMD_HELP) {
+ if(cmd==CMD_PRINT_DEFAULTS || cmd==CMD_PRINT_HELP) {
 s_log(LOG_NOTICE, " ");
 s_log(LOG_NOTICE, "Global options:");
 }
@@ -642,26 +713,26 @@
 /* chroot */
 #ifdef HAVE_CHROOT
 switch(cmd) {
- case CMD_BEGIN:
- new_global_options.chroot_dir=NULL;
- break;
- case CMD_EXEC:
- if(strcasecmp(opt, "chroot"))
- break;
- new_global_options.chroot_dir=str_dup(arg);
- return NULL; /* OK */
- case CMD_END:
+ case CMD_SET_DEFAULTS:
+ options->chroot_dir=NULL;
 break;
- case CMD_DUP: /* not used for global options */
+ case CMD_SET_COPY: /* not used for global options */
 break;
 case CMD_FREE:
- tmp=global_options.chroot_dir;
- global_options.chroot_dir=NULL;
+ tmp=options->chroot_dir;
+ options->chroot_dir=NULL;
 str_free(tmp);
 break;
- case CMD_DEFAULT:
+ case CMD_SET_VALUE:
+ if(strcasecmp(opt, "chroot"))
+ break;
+ options->chroot_dir=str_dup(arg);
+ return NULL; /* OK */
+ case CMD_INITIALIZE:
 break;
- case CMD_HELP:
+ case CMD_PRINT_DEFAULTS:
+ break;
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = directory to chroot stunnel process", "chroot");
 break;
 }
@@ -670,32 +741,34 @@
 /* compression */
 #ifndef OPENSSL_NO_COMP
 switch(cmd) {
- case CMD_BEGIN:
- new_global_options.compression=COMP_NONE;
+ case CMD_SET_DEFAULTS:
+ options->compression=COMP_NONE;
+ break;
+ case CMD_SET_COPY: /* not used for global options */
 break;
- case CMD_EXEC:
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "compression"))
 break;
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
 /* only allow compression with OpenSSL 0.9.8 or later
 * with OpenSSL #1468 zlib memory leak fixed */
 if(OpenSSL_version_num()<0x00908051L) /* 0.9.8e-beta1 */
 return "Compression unsupported due to a memory leak";
+#endif /* OpenSSL version < 1.1.0 */
 if(!strcasecmp(arg, "deflate"))
- new_global_options.compression=COMP_DEFLATE;
+ options->compression=COMP_DEFLATE;
 else if(!strcasecmp(arg, "zlib"))
- new_global_options.compression=COMP_ZLIB;
+ options->compression=COMP_ZLIB;
 else
 return "Specified compression type is not available";
 return NULL; /* OK */
- case CMD_END:
- break;
- case CMD_DUP: /* not used for global options */
+ case CMD_INITIALIZE:
 break;
- case CMD_FREE:
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_DEFAULT:
- break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = compression type",
 "compression");
 break;
@@ -704,33 +777,33 @@
 
 /* EGD */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 #ifdef EGD_SOCKET
- new_global_options.egd_sock=EGD_SOCKET;
+ options->egd_sock=EGD_SOCKET;
 #else
- new_global_options.egd_sock=NULL;
+ options->egd_sock=NULL;
 #endif
 break;
- case CMD_EXEC:
- if(strcasecmp(opt, "EGD"))
- break;
- new_global_options.egd_sock=str_dup(arg);
- return NULL; /* OK */
- case CMD_END:
- break;
- case CMD_DUP: /* not used for global options */
+ case CMD_SET_COPY: /* not used for global options */
 break;
 case CMD_FREE:
- tmp=global_options.egd_sock;
- global_options.egd_sock=NULL;
+ tmp=options->egd_sock;
+ options->egd_sock=NULL;
 str_free(tmp);
 break;
- case CMD_DEFAULT:
+ case CMD_SET_VALUE:
+ if(strcasecmp(opt, "EGD"))
+ break;
+ options->egd_sock=str_dup(arg);
+ return NULL; /* OK */
+ case CMD_INITIALIZE:
+ break;
+ case CMD_PRINT_DEFAULTS:
 #ifdef EGD_SOCKET
 s_log(LOG_NOTICE, "%-22s = %s", "EGD", EGD_SOCKET);
 #endif
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = path to Entropy Gathering Daemon socket", "EGD");
 break;
 }
@@ -739,27 +812,27 @@
 
 /* engine */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 engine_reset_list();
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY: /* not used for global options */
+ break;
+ case CMD_FREE:
+ /* FIXME: investigate if we can free it */
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "engine"))
 break;
 if(!strcasecmp(arg, "auto"))
 return engine_auto();
 else
 return engine_open(arg);
- case CMD_END:
+ case CMD_INITIALIZE:
 engine_init();
 break;
- case CMD_DUP: /* not used for global options */
- break;
- case CMD_FREE:
- /* FIXME: investigate if we can free it */
- break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = auto|engine_id",
 "engine");
 break;
@@ -767,9 +840,13 @@
 
 /* engineCtrl */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY: /* not used for global options */
+ break;
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "engineCtrl"))
 break;
 {
@@ -778,15 +855,11 @@
 *tmp_str++='\0';
 return engine_ctrl(arg, tmp_str);
 }
- case CMD_END:
- break;
- case CMD_DUP: /* not used for global options */
- break;
- case CMD_FREE:
+ case CMD_INITIALIZE:
 break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = cmd:arg",
 "engineCtrl");
 break;
@@ -794,21 +867,21 @@
 
 /* engineDefault */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
+ break;
+ case CMD_SET_COPY: /* not used for global options */
 break;
- case CMD_EXEC:
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "engineDefault"))
 break;
 return engine_default(arg);
- case CMD_END:
- break;
- case CMD_DUP: /* not used for global options */
+ case CMD_INITIALIZE:
 break;
- case CMD_FREE:
- break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = TASK_LIST",
 "engineDefault");
 break;
@@ -818,75 +891,110 @@
 
 /* fips */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 #ifdef USE_FIPS
- new_global_options.option.fips=0;
+ options->option.fips=fips_default()?1:0;
 #endif /* USE_FIPS */
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY: /* not used for global options */
+ break;
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "fips"))
 break;
+ if(!strcasecmp(arg, "yes")) {
 #ifdef USE_FIPS
- if(!strcasecmp(arg, "yes"))
- new_global_options.option.fips=1;
- else if(!strcasecmp(arg, "no"))
- new_global_options.option.fips=0;
- else
- return "The argument needs to be either 'yes' or 'no'";
+ options->option.fips=1;
 #else
- if(strcasecmp(arg, "no"))
 return "FIPS support is not available";
 #endif /* USE_FIPS */
+ } else if(!strcasecmp(arg, "no")) {
+#ifdef USE_FIPS
+ if(fips_default())
+ return "Failed to override system-wide FIPS mode";
+ options->option.fips=0;
+#endif /* USE_FIPS */
+ } else {
+ return "The argument needs to be either 'yes' or 'no'";
+ }
 return NULL; /* OK */
- case CMD_END:
- break;
- case CMD_DUP: /* not used for global options */
- break;
- case CMD_FREE:
- break;
- case CMD_DEFAULT:
+ case CMD_INITIALIZE:
 break;
- case CMD_HELP:
+ case CMD_PRINT_DEFAULTS:
 #ifdef USE_FIPS
- s_log(LOG_NOTICE, "%-22s = yes|no FIPS 140-2 mode",
- "fips");
+ if(fips_available())
+ s_log(LOG_NOTICE, "%-22s = %s", "fips", fips_default()?"yes":"no");
 #endif /* USE_FIPS */
 break;
+ case CMD_PRINT_HELP:
+ if(fips_available())
+ s_log(LOG_NOTICE, "%-22s = yes|no FIPS 140-2 mode",
+ "fips");
+ break;
 }
 
 /* foreground */
 #ifndef USE_WIN32
 switch(cmd) {
- case CMD_BEGIN:
- new_global_options.option.foreground=0;
- new_global_options.option.log_stderr=0;
+ case CMD_SET_DEFAULTS:
+ options->option.foreground=0;
+ options->option.log_stderr=0;
+ break;
+ case CMD_SET_COPY: /* not used for global options */
 break;
- case CMD_EXEC:
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "foreground"))
 break;
 if(!strcasecmp(arg, "yes")) {
- new_global_options.option.foreground=1;
- new_global_options.option.log_stderr=1;
+ options->option.foreground=1;
+ options->option.log_stderr=1;
 } else if(!strcasecmp(arg, "quiet")) {
- new_global_options.option.foreground=1;
- new_global_options.option.log_stderr=0;
+ options->option.foreground=1;
+ options->option.log_stderr=0;
 } else if(!strcasecmp(arg, "no")) {
- new_global_options.option.foreground=0;
- new_global_options.option.log_stderr=0;
+ options->option.foreground=0;
+ options->option.log_stderr=0;
 } else
 return "The argument needs to be either 'yes', 'quiet' or 'no'";
 return NULL; /* OK */
- case CMD_END:
+ case CMD_INITIALIZE:
+ break;
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_DUP: /* not used for global options */
+ case CMD_PRINT_HELP:
+ s_log(LOG_NOTICE, "%-22s = yes|quiet|no foreground mode (don't fork, log to stderr)",
+ "foreground");
+ break;
+ }
+#else
+ switch(cmd) {
+ case CMD_SET_DEFAULTS:
+ break;
+ case CMD_SET_COPY: /* not used for global options */
 break;
 case CMD_FREE:
 break;
- case CMD_DEFAULT:
+ case CMD_SET_VALUE:
+ if(strcasecmp(opt, "foreground"))
+ break;
+ if(!strcasecmp(arg, "yes")) {
+ /* ignore */
+ } else if(!strcasecmp(arg, "quiet")) {
+ /* ignore */
+ } else if(!strcasecmp(arg, "no")) {
+ return "The argument needs to be 'yes' or 'quiet'";
+ } else
+ return "The argument needs to be 'yes' or 'quiet'";
+ return NULL; /* OK */
+ case CMD_INITIALIZE:
 break;
- case CMD_HELP:
- s_log(LOG_NOTICE, "%-22s = yes|quiet|no foreground mode (don't fork, log to stderr)",
- "foreground");
+ case CMD_PRINT_DEFAULTS:
+ break;
+ case CMD_PRINT_HELP:
+ s_log(LOG_NOTICE, "%-22s = foreground mode", "foreground");
 break;
 }
 #endif
@@ -895,75 +1003,78 @@
 
 /* iconActive */
 switch(cmd) {
- case CMD_BEGIN:
- new_global_options.iconICON_ACTIVE=load_icon_default(ICON_ACTIVE);
+ case CMD_SET_DEFAULTS:
+ options->iconICON_ACTIVE=load_icon_default(ICON_ACTIVE);
+ break;
+ case CMD_SET_COPY: /* not used for global options */
+ break;
+ case CMD_FREE:
+ /* FIXME: investigate if we can free it */
 break;
- case CMD_EXEC:
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "iconActive"))
 break;
- if(!(new_global_options.iconICON_ACTIVE=load_icon_file(arg)))
+ options->iconICON_ACTIVE=load_icon_file(arg);
+ if(!options->iconICON_ACTIVE)
 return "Failed to load the specified icon";
 return NULL; /* OK */
- case CMD_END:
+ case CMD_INITIALIZE:
 break;
- case CMD_DUP: /* not used for global options */
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_FREE:
- /* FIXME: investigate if we can free it */
- break;
- case CMD_DEFAULT:
- break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = icon when connections are established", "iconActive");
 break;
 }
 
 /* iconError */
 switch(cmd) {
- case CMD_BEGIN:
- new_global_options.iconICON_ERROR=load_icon_default(ICON_ERROR);
+ case CMD_SET_DEFAULTS:
+ options->iconICON_ERROR=load_icon_default(ICON_ERROR);
+ break;
+ case CMD_SET_COPY: /* not used for global options */
 break;
- case CMD_EXEC:
+ case CMD_FREE:
+ /* FIXME: investigate if we can free it */
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "iconError"))
 break;
- if(!(new_global_options.iconICON_ERROR=load_icon_file(arg)))
+ options->iconICON_ERROR=load_icon_file(arg);
+ if(!options->iconICON_ERROR)
 return "Failed to load the specified icon";
 return NULL; /* OK */
- case CMD_END:
- break;
- case CMD_DUP: /* not used for global options */
+ case CMD_INITIALIZE:
 break;
- case CMD_FREE:
- /* FIXME: investigate if we can free it */
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_DEFAULT:
- break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = icon for invalid configuration file", "iconError");
 break;
 }
 
 /* iconIdle */
 switch(cmd) {
- case CMD_BEGIN:
- new_global_options.iconICON_IDLE=load_icon_default(ICON_IDLE);
+ case CMD_SET_DEFAULTS:
+ options->iconICON_IDLE=load_icon_default(ICON_IDLE);
+ break;
+ case CMD_SET_COPY: /* not used for global options */
+ break;
+ case CMD_FREE:
+ /* FIXME: investigate if we can free it */
 break;
- case CMD_EXEC:
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "iconIdle"))
 break;
- if(!(new_global_options.iconICON_IDLE=load_icon_file(arg)))
+ options->iconICON_IDLE=load_icon_file(arg);
+ if(!options->iconICON_IDLE)
 return "Failed to load the specified icon";
 return NULL; /* OK */
- case CMD_END:
+ case CMD_INITIALIZE:
 break;
- case CMD_DUP: /* not used for global options */
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_FREE:
- /* FIXME: investigate if we can free it */
- break;
- case CMD_DEFAULT:
- break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = icon when no connections were established", "iconIdle");
 break;
 }
@@ -972,28 +1083,28 @@
 
 /* log */
 switch(cmd) {
- case CMD_BEGIN:
- new_global_options.log_file_mode=FILE_MODE_APPEND;
+ case CMD_SET_DEFAULTS:
+ options->log_file_mode=FILE_MODE_APPEND;
+ break;
+ case CMD_SET_COPY: /* not used for global options */
 break;
- case CMD_EXEC:
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "log"))
 break;
 if(!strcasecmp(arg, "append"))
- new_global_options.log_file_mode=FILE_MODE_APPEND;
+ options->log_file_mode=FILE_MODE_APPEND;
 else if(!strcasecmp(arg, "overwrite"))
- new_global_options.log_file_mode=FILE_MODE_OVERWRITE;
+ options->log_file_mode=FILE_MODE_OVERWRITE;
 else
 return "The argument needs to be either 'append' or 'overwrite'";
 return NULL; /* OK */
- case CMD_END:
- break;
- case CMD_DUP: /* not used for global options */
- break;
- case CMD_FREE:
+ case CMD_INITIALIZE:
 break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = append|overwrite log file",
 "log");
 break;
@@ -1001,26 +1112,32 @@
 
 /* output */
 switch(cmd) {
- case CMD_BEGIN:
- new_global_options.output_file=NULL;
+ case CMD_SET_DEFAULTS:
+ options->output_file=NULL;
 break;
- case CMD_EXEC:
- if(strcasecmp(opt, "output"))
- break;
- new_global_options.output_file=str_dup(arg);
- return NULL; /* OK */
- case CMD_END:
- break;
- case CMD_DUP: /* not used for global options */
+ case CMD_SET_COPY: /* not used for global options */
 break;
 case CMD_FREE:
- tmp=global_options.output_file;
- global_options.output_file=NULL;
+ tmp=options->output_file;
+ options->output_file=NULL;
 str_free(tmp);
 break;
- case CMD_DEFAULT:
+ case CMD_SET_VALUE:
+ if(strcasecmp(opt, "output"))
+ break;
+ options->output_file=str_dup(arg);
+ return NULL; /* OK */
+ case CMD_INITIALIZE:
+#ifndef USE_WIN32
+ if(!options->option.foreground /* daemonize() used */ &&
+ options->output_file /* log file enabled */ &&
+ options->output_file0!='/' /* relative path */)
+ return "Log file must include full path name";
+#endif
+ break;
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = file to append log messages", "output");
 break;
 }
@@ -1028,29 +1145,33 @@
 /* pid */
 #ifndef USE_WIN32
 switch(cmd) {
- case CMD_BEGIN:
- new_global_options.pidfile=NULL; /* do not create a pid file */
+ case CMD_SET_DEFAULTS:
+ options->pidfile=NULL; /* do not create a pid file */
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY: /* not used for global options */
+ break;
+ case CMD_FREE:
+ tmp=options->pidfile;
+ options->pidfile=NULL;
+ str_free(tmp);
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "pid"))
 break;
 if(arg0) /* is argument not empty? */
- new_global_options.pidfile=str_dup(arg);
+ options->pidfile=str_dup(arg);
 else
- new_global_options.pidfile=NULL; /* empty -> do not create a pid file */
+ options->pidfile=NULL; /* empty -> do not create a pid file */
 return NULL; /* OK */
- case CMD_END:
+ case CMD_INITIALIZE:
+ if(!options->option.foreground /* daemonize() used */ &&
+ options->pidfile /* pid file enabled */ &&
+ options->pidfile0!='/' /* relative path */)
+ return "Pid file must include full path name";
 break;
- case CMD_DUP: /* not used for global options */
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_FREE:
- tmp=global_options.pidfile;
- global_options.pidfile=NULL;
- str_free(tmp);
- break;
- case CMD_DEFAULT:
- break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = pid file", "pid");
 break;
 }
@@ -1058,91 +1179,91 @@
 
 /* RNDbytes */
 switch(cmd) {
- case CMD_BEGIN:
- new_global_options.random_bytes=RANDOM_BYTES;
+ case CMD_SET_DEFAULTS:
+ options->random_bytes=RANDOM_BYTES;
+ break;
+ case CMD_SET_COPY: /* not used for global options */
+ break;
+ case CMD_FREE:
 break;
- case CMD_EXEC:
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "RNDbytes"))
 break;
 {
 char *tmp_str;
- new_global_options.random_bytes=(long)strtol(arg, &tmp_str, 10);
+ options->random_bytes=(long)strtol(arg, &tmp_str, 10);
 if(tmp_str==arg || *tmp_str) /* not a number */
 return "Illegal number of bytes to read from random seed files";
 }
 return NULL; /* OK */
- case CMD_END:
+ case CMD_INITIALIZE:
 break;
- case CMD_DUP: /* not used for global options */
- break;
- case CMD_FREE:
- break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 s_log(LOG_NOTICE, "%-22s = %d", "RNDbytes", RANDOM_BYTES);
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = bytes to read from random seed files", "RNDbytes");
 break;
 }
 
 /* RNDfile */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 #ifdef RANDOM_FILE
- new_global_options.rand_file=str_dup(RANDOM_FILE);
+ options->rand_file=str_dup(RANDOM_FILE);
 #else
- new_global_options.rand_file=NULL;
+ options->rand_file=NULL;
 #endif
 break;
- case CMD_EXEC:
- if(strcasecmp(opt, "RNDfile"))
- break;
- new_global_options.rand_file=str_dup(arg);
- return NULL; /* OK */
- case CMD_END:
- break;
- case CMD_DUP: /* not used for global options */
+ case CMD_SET_COPY: /* not used for global options */
 break;
 case CMD_FREE:
- tmp=global_options.rand_file;
- global_options.rand_file=NULL;
+ tmp=options->rand_file;
+ options->rand_file=NULL;
 str_free(tmp);
 break;
- case CMD_DEFAULT:
+ case CMD_SET_VALUE:
+ if(strcasecmp(opt, "RNDfile"))
+ break;
+ options->rand_file=str_dup(arg);
+ return NULL; /* OK */
+ case CMD_INITIALIZE:
+ break;
+ case CMD_PRINT_DEFAULTS:
 #ifdef RANDOM_FILE
 s_log(LOG_NOTICE, "%-22s = %s", "RNDfile", RANDOM_FILE);
 #endif
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = path to file with random seed data", "RNDfile");
 break;
 }
 
 /* RNDoverwrite */
 switch(cmd) {
- case CMD_BEGIN:
- new_global_options.option.rand_write=1;
+ case CMD_SET_DEFAULTS:
+ options->option.rand_write=1;
+ break;
+ case CMD_SET_COPY: /* not used for global options */
 break;
- case CMD_EXEC:
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "RNDoverwrite"))
 break;
 if(!strcasecmp(arg, "yes"))
- new_global_options.option.rand_write=1;
+ options->option.rand_write=1;
 else if(!strcasecmp(arg, "no"))
- new_global_options.option.rand_write=0;
+ options->option.rand_write=0;
 else
 return "The argument needs to be either 'yes' or 'no'";
 return NULL; /* OK */
- case CMD_END:
- break;
- case CMD_DUP: /* not used for global options */
+ case CMD_INITIALIZE:
 break;
- case CMD_FREE:
- break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 s_log(LOG_NOTICE, "%-22s = yes", "RNDoverwrite");
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = yes|no overwrite seed datafiles with new random data",
 "RNDoverwrite");
 break;
@@ -1151,29 +1272,52 @@
 /* syslog */
 #ifndef USE_WIN32
 switch(cmd) {
- case CMD_BEGIN:
- new_global_options.option.log_syslog=1;
+ case CMD_SET_DEFAULTS:
+ options->option.log_syslog=1;
+ break;
+ case CMD_SET_COPY: /* not used for global options */
 break;
- case CMD_EXEC:
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "syslog"))
 break;
 if(!strcasecmp(arg, "yes"))
- new_global_options.option.log_syslog=1;
+ options->option.log_syslog=1;
 else if(!strcasecmp(arg, "no"))
- new_global_options.option.log_syslog=0;
+ options->option.log_syslog=0;
 else
 return "The argument needs to be either 'yes' or 'no'";
 return NULL; /* OK */
- case CMD_END:
+ case CMD_INITIALIZE:
 break;
- case CMD_DUP: /* not used for global options */
+ case CMD_PRINT_DEFAULTS:
+ break;
+ case CMD_PRINT_HELP:
+ s_log(LOG_NOTICE, "%-22s = yes|no send logging messages to syslog",
+ "syslog");
+ break;
+ }
+#else
+ switch(cmd) {
+ case CMD_SET_DEFAULTS:
+ break;
+ case CMD_SET_COPY: /* not used for global options */
 break;
 case CMD_FREE:
 break;
- case CMD_DEFAULT:
+ case CMD_SET_VALUE:
+ if(strcasecmp(opt, "syslog"))
+ break;
+ if(strcasecmp(arg, "no"))
+ return "The argument needs to be 'no'";
+ return NULL; /* OK */
+ case CMD_INITIALIZE:
+ break;
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_HELP:
- s_log(LOG_NOTICE, "%-22s = yes|no send logging messages to syslog",
+ case CMD_PRINT_HELP:
+ s_log(LOG_NOTICE, "%-22s = unused syslog",
 "syslog");
 break;
 }
@@ -1182,29 +1326,29 @@
 /* taskbar */
 #ifdef USE_WIN32
 switch(cmd) {
- case CMD_BEGIN:
- new_global_options.option.taskbar=1;
+ case CMD_SET_DEFAULTS:
+ options->option.taskbar=1;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY: /* not used for global options */
+ break;
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "taskbar"))
 break;
 if(!strcasecmp(arg, "yes"))
- new_global_options.option.taskbar=1;
+ options->option.taskbar=1;
 else if(!strcasecmp(arg, "no"))
- new_global_options.option.taskbar=0;
+ options->option.taskbar=0;
 else
 return "The argument needs to be either 'yes' or 'no'";
 return NULL; /* OK */
- case CMD_END:
- break;
- case CMD_DUP: /* not used for global options */
- break;
- case CMD_FREE:
+ case CMD_INITIALIZE:
 break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 s_log(LOG_NOTICE, "%-22s = yes", "taskbar");
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = yes|no enable the taskbar icon", "taskbar");
 break;
 }
@@ -1212,21 +1356,22 @@
 
 /* final checks */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 break;
- case CMD_EXEC:
- return option_not_found;
- case CMD_END:
- /* FIPS needs to be initialized as early as possible */
- if(ssl_configure(&new_global_options)) /* configure global TLS settings */
- return "Failed to initialize TLS";
- case CMD_DUP:
+ case CMD_SET_COPY:
 break;
 case CMD_FREE:
+ memset(options, 0, sizeof(GLOBAL_OPTIONS));
 break;
- case CMD_DEFAULT:
+ case CMD_SET_VALUE:
+ return option_not_found;
+ case CMD_INITIALIZE:
+ /* FIPS needs to be initialized as early as possible */
+ if(ssl_configure(options)) /* configure global TLS settings */
+ return "Failed to initialize TLS";
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 break;
 }
 return NULL; /* OK */
@@ -1234,37 +1379,61 @@
 
 /**************************************** service-level options */
 
-NOEXPORT char *parse_service_option(CMD cmd, SERVICE_OPTIONS *section,
+NOEXPORT const char *parse_service_option(CMD cmd, SERVICE_OPTIONS **section_ptr,
 char *opt, char *arg) {
+ SERVICE_OPTIONS *section;
 int endpoints=0;
 #ifndef USE_WIN32
 struct group *gr;
 struct passwd *pw;
 #endif
 
- if(cmd==CMD_DEFAULT || cmd==CMD_HELP) {
- s_log(LOG_NOTICE, " ");
- s_log(LOG_NOTICE, "Service-level options:");
+ section=section_ptr ? *section_ptr : NULL;
+
+ if(cmd==CMD_SET_DEFAULTS || cmd==CMD_SET_COPY) {
+ section->ref=1;
+ if(section==&service_options)
+ s_log(LOG_ERR, "INTERNAL ERROR: Initializing deployed section defaults");
+ else if(section==&new_service_options)
+ s_log(LOG_INFO, "Initializing inetd mode configuration");
+ else
+ s_log(LOG_INFO, "Initializing service %s", section->servname);
 } else if(cmd==CMD_FREE) {
 if(section==&service_options)
- s_log(LOG_DEBUG, "Deallocating section defaults");
+ s_log(LOG_DEBUG, "Deallocating deployed section defaults");
+ else if(section==&new_service_options)
+ s_log(LOG_DEBUG, "Deallocating temporary section defaults");
 else
 s_log(LOG_DEBUG, "Deallocating section %s", section->servname);
+ } else if(cmd==CMD_PRINT_DEFAULTS || cmd==CMD_PRINT_HELP) {
+ s_log(LOG_NOTICE, " ");
+ s_log(LOG_NOTICE, "Service-level options:");
 }
 
 /* accept */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 addrlist_clear(&section->local_addr, 1);
 section->local_fd=NULL;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ addrlist_clear(&section->local_addr, 1);
+ section->local_fd=NULL;
+ name_list_dup(&section->local_addr.names,
+ new_service_options.local_addr.names);
+ break;
+ case CMD_FREE:
+ name_list_free(section->local_addr.names);
+ str_free(section->local_addr.addr);
+ str_free(section->local_fd);
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "accept"))
 break;
 section->option.accept=1;
 name_list_append(&section->local_addr.names, arg);
 return NULL; /* OK */
- case CMD_END:
+ case CMD_INITIALIZE:
 if(section->local_addr.names) {
 unsigned i;
 if(!addrlist_resolve(&section->local_addr))
@@ -1275,34 +1444,58 @@
 ++endpoints;
 }
 break;
- case CMD_DUP:
- addrlist_clear(&section->local_addr, 1);
- section->local_fd=NULL;
- name_list_dup(&section->local_addr.names,
- new_service_options.local_addr.names);
+ case CMD_PRINT_DEFAULTS:
+ break;
+ case CMD_PRINT_HELP:
+ s_log(LOG_NOTICE, "%-22s = host:port accept connections on specified host:port",
+ "accept");
+ break;
+ }
+
+#ifndef OPENSSL_NO_ENGINE
+ /* CAengine */
+ switch(cmd) {
+ case CMD_SET_DEFAULTS:
+ section->ca_engine=NULL;
+ break;
+ case CMD_SET_COPY:
+ name_list_dup(&section->ca_engine,
+ new_service_options.ca_engine);
 break;
 case CMD_FREE:
- name_list_free(section->local_addr.names);
- str_free(section->local_addr.addr);
- str_free(section->local_fd);
+ name_list_free(section->ca_engine);
 break;
- case CMD_DEFAULT:
+ case CMD_SET_VALUE:
+ if(strcasecmp(opt, "CAengine"))
+ break;
+ name_list_append(&section->ca_engine, arg);
+ return NULL; /* OK */
+ case CMD_INITIALIZE:
 break;
- case CMD_HELP:
- s_log(LOG_NOTICE, "%-22s = host:port accept connections on specified host:port",
- "accept");
+ case CMD_PRINT_DEFAULTS:
+ break;
+ case CMD_PRINT_HELP:
+ s_log(LOG_NOTICE, "%-22s = engine-specific CA certificate identifier for 'verify' option",
+ "CAengine");
 break;
 }
+#endif /* !OPENSSL_NO_ENGINE */
 
 /* CApath */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 #if 0
 section->ca_dir=(char *)X509_get_default_cert_dir();
 #endif
 section->ca_dir=NULL;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->ca_dir=str_dup_detached(new_service_options.ca_dir);
+ break;
+ case CMD_FREE:
+ str_free(section->ca_dir);
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "CApath"))
 break;
 str_free(section->ca_dir);
@@ -1311,21 +1504,15 @@
 else
 section->ca_dir=NULL;
 return NULL; /* OK */
- case CMD_END:
- break;
- case CMD_DUP:
- section->ca_dir=str_dup_detached(new_service_options.ca_dir);
+ case CMD_INITIALIZE:
 break;
- case CMD_FREE:
- str_free(section->ca_dir);
- break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 #if 0
 s_log(LOG_NOTICE, "%-22s = %s", "CApath",
 section->ca_dir ? section->ca_dir : "(none)");
 #endif
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = CA certificate directory for 'verify' option",
 "CApath");
 break;
@@ -1333,13 +1520,19 @@
 
 /* CAfile */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 #if 0
 section->ca_file=(char *)X509_get_default_certfile();
 #endif
 section->ca_file=NULL;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->ca_file=str_dup_detached(new_service_options.ca_file);
+ break;
+ case CMD_FREE:
+ str_free(section->ca_file);
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "CAfile"))
 break;
 str_free(section->ca_file);
@@ -1348,21 +1541,15 @@
 else
 section->ca_file=NULL;
 return NULL; /* OK */
- case CMD_END:
- break;
- case CMD_DUP:
- section->ca_file=str_dup_detached(new_service_options.ca_file);
+ case CMD_INITIALIZE:
 break;
- case CMD_FREE:
- str_free(section->ca_file);
- break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 #if 0
 s_log(LOG_NOTICE, "%-22s = %s", "CAfile",
 section->ca_file ? section->ca_file : "(none)");
 #endif
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = CA certificate file for 'verify' option",
 "CAfile");
 break;
@@ -1370,16 +1557,22 @@
 
 /* cert */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->cert=NULL;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->cert=str_dup_detached(new_service_options.cert);
+ break;
+ case CMD_FREE:
+ str_free(section->cert);
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "cert"))
 break;
 str_free(section->cert);
 section->cert=str_dup_detached(arg);
 return NULL; /* OK */
- case CMD_END:
+ case CMD_INITIALIZE:
 #ifndef OPENSSL_NO_PSK
 if(section->psk_keys)
 break;
@@ -1391,15 +1584,9 @@
 if(!section->option.client && !section->cert)
 return "TLS server needs a certificate";
 break;
- case CMD_DUP:
- section->cert=str_dup_detached(new_service_options.cert);
- break;
- case CMD_FREE:
- str_free(section->cert);
- break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 break; /* no default certificate */
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = certificate chain", "cert");
 break;
 }
@@ -1408,28 +1595,28 @@
 
 /* checkEmail */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->check_email=NULL;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ name_list_dup(&section->check_email,
+ new_service_options.check_email);
+ break;
+ case CMD_FREE:
+ name_list_free(section->check_email);
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "checkEmail"))
 break;
 name_list_append(&section->check_email, arg);
 return NULL; /* OK */
- case CMD_END:
+ case CMD_INITIALIZE:
 if(section->check_email && !section->option.verify_chain && !section->option.verify_peer)
 return "Either \"verifyChain\" or \"verifyPeer\" has to be enabled";
 break;
- case CMD_DUP:
- name_list_dup(&section->check_email,
- new_service_options.check_email);
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_FREE:
- name_list_free(section->check_email);
- break;
- case CMD_DEFAULT:
- break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = peer certificate email address",
 "checkEmail");
 break;
@@ -1437,28 +1624,28 @@
 
 /* checkHost */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->check_host=NULL;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ name_list_dup(&section->check_host,
+ new_service_options.check_host);
+ break;
+ case CMD_FREE:
+ name_list_free(section->check_host);
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "checkHost"))
 break;
 name_list_append(&section->check_host, arg);
 return NULL; /* OK */
- case CMD_END:
+ case CMD_INITIALIZE:
 if(section->check_host && !section->option.verify_chain && !section->option.verify_peer)
 return "Either \"verifyChain\" or \"verifyPeer\" has to be enabled";
 break;
- case CMD_DUP:
- name_list_dup(&section->check_host,
- new_service_options.check_host);
- break;
- case CMD_FREE:
- name_list_free(section->check_host);
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_DEFAULT:
- break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = peer certificate host name pattern",
 "checkHost");
 break;
@@ -1466,28 +1653,28 @@
 
 /* checkIP */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->check_ip=NULL;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ name_list_dup(&section->check_ip,
+ new_service_options.check_ip);
+ break;
+ case CMD_FREE:
+ name_list_free(section->check_ip);
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "checkIP"))
 break;
 name_list_append(&section->check_ip, arg);
 return NULL; /* OK */
- case CMD_END:
+ case CMD_INITIALIZE:
 if(section->check_ip && !section->option.verify_chain && !section->option.verify_peer)
 return "Either \"verifyChain\" or \"verifyPeer\" has to be enabled";
 break;
- case CMD_DUP:
- name_list_dup(&section->check_ip,
- new_service_options.check_ip);
- break;
- case CMD_FREE:
- name_list_free(section->check_ip);
- break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = peer certificate IP address",
 "checkIP");
 break;
@@ -1497,54 +1684,93 @@
 
 /* ciphers */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->cipher_list=NULL;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->cipher_list=str_dup_detached(new_service_options.cipher_list);
+ break;
+ case CMD_FREE:
+ str_free(section->cipher_list);
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "ciphers"))
 break;
 str_free(section->cipher_list);
 section->cipher_list=str_dup_detached(arg);
 return NULL; /* OK */
- case CMD_END:
+ case CMD_INITIALIZE:
 if(!section->cipher_list) {
- /* this is only executed for global options,
- * because section->cipher_list is no longer NULL */
+ /* this is only executed for global options, because
+ * section->cipher_list is no longer NULL in sections */
 #ifdef USE_FIPS
 if(new_global_options.option.fips)
- section->cipher_list=str_dup_detached("FIPS");
+ section->cipher_list=str_dup_detached(fips_cipher_list);
 else
 #endif /* USE_FIPS */
 section->cipher_list=str_dup_detached(stunnel_cipher_list);
 }
 break;
- case CMD_DUP:
- section->cipher_list=str_dup_detached(new_service_options.cipher_list);
+ case CMD_PRINT_DEFAULTS:
+ if(fips_available()) {
+ s_log(LOG_NOTICE, "%-22s = %s %s", "ciphers",
+ fips_cipher_list, "(with \"fips = yes\")");
+ s_log(LOG_NOTICE, "%-22s = %s %s", "ciphers",
+ stunnel_cipher_list, "(with \"fips = no\")");
+ } else {
+ s_log(LOG_NOTICE, "%-22s = %s", "ciphers", stunnel_cipher_list);
+ }
+ break;
+ case CMD_PRINT_HELP:
+ s_log(LOG_NOTICE, "%-22s = permitted ciphers for TLS 1.2 or older", "ciphers");
+ break;
+ }
+
+#ifndef OPENSSL_NO_TLS1_3
+ /* ciphersuites */
+ switch(cmd) {
+ case CMD_SET_DEFAULTS:
+ section->ciphersuites=NULL;
+ break;
+ case CMD_SET_COPY:
+ section->ciphersuites=str_dup_detached(new_service_options.ciphersuites);
 break;
 case CMD_FREE:
- str_free(section->cipher_list);
+ str_free(section->ciphersuites);
 break;
- case CMD_DEFAULT:
-#ifdef USE_FIPS
- s_log(LOG_NOTICE, "%-22s = %s %s", "ciphers",
- "FIPS", "(with \"fips = yes\")");
- s_log(LOG_NOTICE, "%-22s = %s %s", "ciphers",
- stunnel_cipher_list, "(with \"fips = no\")");
-#else
- s_log(LOG_NOTICE, "%-22s = %s", "ciphers", stunnel_cipher_list);
-#endif /* USE_FIPS */
+ case CMD_SET_VALUE:
+ if(strcasecmp(opt, "ciphersuites"))
+ break;
+ str_free(section->ciphersuites);
+ section->ciphersuites=str_dup_detached(arg);
+ return NULL; /* OK */
+ case CMD_INITIALIZE:
+ if(!section->ciphersuites) {
+ /* this is only executed for global options, because
+ * section->ciphersuites is no longer NULL in sections */
+ section->ciphersuites=str_dup_detached(stunnel_ciphersuites);
+ }
 break;
- case CMD_HELP:
- s_log(LOG_NOTICE, "%-22s = list of permitted TLS ciphers", "ciphers");
+ case CMD_PRINT_DEFAULTS:
+ s_log(LOG_NOTICE, "%-22s = %s %s", "ciphersuites", stunnel_ciphersuites, "(with TLSv1.3)");
+ break;
+ case CMD_PRINT_HELP:
+ s_log(LOG_NOTICE, "%-22s = permitted ciphersuites for TLS 1.3", "ciphersuites");
 break;
 }
+#endif /* TLS 1.3 */
 
 /* client */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->option.client=0;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->option.client=new_service_options.option.client;
+ break;
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "client"))
 break;
 if(!strcasecmp(arg, "yes"))
@@ -1554,16 +1780,11 @@
 else
 return "The argument needs to be either 'yes' or 'no'";
 return NULL; /* OK */
- case CMD_END:
- break;
- case CMD_DUP:
- section->option.client=new_service_options.option.client;
+ case CMD_INITIALIZE:
 break;
- case CMD_FREE:
- break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = yes|no client mode (remote service uses TLS)",
 "client");
 break;
@@ -1573,25 +1794,25 @@
 
 /* config */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->config=NULL;
 break;
- case CMD_EXEC:
- if(strcasecmp(opt, "config"))
- break;
- name_list_append(&section->config, arg);
- return NULL; /* OK */
- case CMD_END:
- break;
- case CMD_DUP:
+ case CMD_SET_COPY:
 name_list_dup(&section->config, new_service_options.config);
 break;
 case CMD_FREE:
 name_list_free(section->config);
 break;
- case CMD_DEFAULT:
+ case CMD_SET_VALUE:
+ if(strcasecmp(opt, "config"))
+ break;
+ name_list_append(&section->config, arg);
+ return NULL; /* OK */
+ case CMD_INITIALIZE:
 break;
- case CMD_HELP:
+ case CMD_PRINT_DEFAULTS:
+ break;
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = command:parameter to execute",
 "config");
 break;
@@ -1601,16 +1822,27 @@
 
 /* connect */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 addrlist_clear(&section->connect_addr, 0);
 section->connect_session=NULL;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ addrlist_clear(&section->connect_addr, 0);
+ section->connect_session=NULL;
+ name_list_dup(&section->connect_addr.names,
+ new_service_options.connect_addr.names);
+ break;
+ case CMD_FREE:
+ name_list_free(section->connect_addr.names);
+ str_free(section->connect_addr.addr);
+ str_free(section->connect_session);
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "connect"))
 break;
 name_list_append(&section->connect_addr.names, arg);
 return NULL; /* OK */
- case CMD_END:
+ case CMD_INITIALIZE:
 if(section->connect_addr.names) {
 if(!section->option.delayed_lookup &&
 !addrlist_resolve(&section->connect_addr)) {
@@ -1626,20 +1858,9 @@
 ++endpoints;
 }
 break;
- case CMD_DUP:
- addrlist_clear(&section->connect_addr, 0);
- section->connect_session=NULL;
- name_list_dup(&section->connect_addr.names,
- new_service_options.connect_addr.names);
- break;
- case CMD_FREE:
- name_list_free(section->connect_addr.names);
- str_free(section->connect_addr.addr);
- str_free(section->connect_session);
- break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = host:port to connect",
 "connect");
 break;
@@ -1647,10 +1868,16 @@
 
 /* CRLpath */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->crl_dir=NULL;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->crl_dir=str_dup_detached(new_service_options.crl_dir);
+ break;
+ case CMD_FREE:
+ str_free(section->crl_dir);
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "CRLpath"))
 break;
 str_free(section->crl_dir);
@@ -1659,27 +1886,27 @@
 else
 section->crl_dir=NULL;
 return NULL; /* OK */
- case CMD_END:
- break;
- case CMD_DUP:
- section->crl_dir=str_dup_detached(new_service_options.crl_dir);
- break;
- case CMD_FREE:
- str_free(section->crl_dir);
+ case CMD_INITIALIZE:
 break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = CRL directory", "CRLpath");
 break;
 }
 
 /* CRLfile */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->crl_file=NULL;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->crl_file=str_dup_detached(new_service_options.crl_file);
+ break;
+ case CMD_FREE:
+ str_free(section->crl_file);
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "CRLfile"))
 break;
 str_free(section->crl_file);
@@ -1688,48 +1915,41 @@
 else
 section->crl_file=NULL;
 return NULL; /* OK */
- case CMD_END:
- break;
- case CMD_DUP:
- section->crl_file=str_dup_detached(new_service_options.crl_file);
- break;
- case CMD_FREE:
- str_free(section->crl_file);
+ case CMD_INITIALIZE:
 break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = CRL file", "CRLfile");
 break;
 }
 
 #ifndef OPENSSL_NO_ECDH
 
- /* curve */
-#define DEFAULT_CURVE NID_X9_62_prime256v1
+ /* curves */
 switch(cmd) {
- case CMD_BEGIN:
- section->curve=DEFAULT_CURVE;
+ case CMD_SET_DEFAULTS:
+ section->curves=str_dup_detached(DEFAULT_CURVES);
 break;
- case CMD_EXEC:
- if(strcasecmp(opt, "curve"))
- break;
- section->curve=OBJ_txt2nid(arg);
- if(section->curve==NID_undef)
- return "Curve name not supported";
- return NULL; /* OK */
- case CMD_END:
- break;
- case CMD_DUP:
- section->curve=new_service_options.curve;
+ case CMD_SET_COPY:
+ section->curves=str_dup_detached(new_service_options.curves);
 break;
 case CMD_FREE:
+ str_free(section->curves);
+ break;
+ case CMD_SET_VALUE:
+ if(strcasecmp(opt, "curves") && strcasecmp(opt, "curve"))
+ break;
+ str_free(section->curves);
+ section->curves=str_dup_detached(arg);
+ return NULL; /* OK */
+ case CMD_INITIALIZE:
 break;
- case CMD_DEFAULT:
- s_log(LOG_NOTICE, "%-22s = %s", "curve", OBJ_nid2ln(DEFAULT_CURVE));
+ case CMD_PRINT_DEFAULTS:
+ s_log(LOG_NOTICE, "%-22s = %s", "curves", DEFAULT_CURVES);
 break;
- case CMD_HELP:
- s_log(LOG_NOTICE, "%-22s = ECDH curve name", "curve");
+ case CMD_PRINT_HELP:
+ s_log(LOG_NOTICE, "%-22s = ECDH curve names", "curves");
 break;
 }
 
@@ -1737,31 +1957,31 @@
 
 /* debug */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->log_level=LOG_NOTICE;
 #if !defined (USE_WIN32) && !defined (__vms)
 new_global_options.log_facility=LOG_DAEMON;
 #endif
 break;
- case CMD_EXEC:
- if(strcasecmp(opt, "debug"))
- break;
- return parse_debug_level(arg, section);
- case CMD_END:
- break;
- case CMD_DUP:
+ case CMD_SET_COPY:
 section->log_level=new_service_options.log_level;
 break;
 case CMD_FREE:
 break;
- case CMD_DEFAULT:
+ case CMD_SET_VALUE:
+ if(strcasecmp(opt, "debug"))
+ break;
+ return parse_debug_level(arg, section);
+ case CMD_INITIALIZE:
+ break;
+ case CMD_PRINT_DEFAULTS:
 #if !defined (USE_WIN32) && !defined (__vms)
 s_log(LOG_NOTICE, "%-22s = %s", "debug", "daemon.notice");
 #else
 s_log(LOG_NOTICE, "%-22s = %s", "debug", "notice");
 #endif
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 #if !defined (USE_WIN32) && !defined (__vms)
 s_log(LOG_NOTICE, "%-22s = facility.level (e.g. daemon.info)", "debug");
 #else
@@ -1772,10 +1992,15 @@
 
 /* delay */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->option.delayed_lookup=0;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->option.delayed_lookup=new_service_options.option.delayed_lookup;
+ break;
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "delay"))
 break;
 if(!strcasecmp(arg, "yes"))
@@ -1785,16 +2010,11 @@
 else
 return "The argument needs to be either 'yes' or 'no'";
 return NULL; /* OK */
- case CMD_END:
+ case CMD_INITIALIZE:
 break;
- case CMD_DUP:
- section->option.delayed_lookup=new_service_options.option.delayed_lookup;
- break;
- case CMD_FREE:
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_DEFAULT:
- break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE,
 "%-22s = yes|no delay DNS lookup for 'connect' option",
 "delay");
@@ -1805,25 +2025,25 @@
 
 /* engineId */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
+ break;
+ case CMD_SET_COPY:
+ section->engine=new_service_options.engine;
+ break;
+ case CMD_FREE:
 break;
- case CMD_EXEC:
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "engineId"))
 break;
 section->engine=engine_get_by_id(arg);
 if(!section->engine)
 return "Engine ID not found";
 return NULL; /* OK */
- case CMD_END:
+ case CMD_INITIALIZE:
 break;
- case CMD_DUP:
- section->engine=new_service_options.engine;
- break;
- case CMD_FREE:
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_DEFAULT:
- break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = ID of engine to read the key from",
 "engineId");
 break;
@@ -1831,9 +2051,14 @@
 
 /* engineNum */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->engine=new_service_options.engine;
+ break;
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "engineNum"))
 break;
 {
@@ -1846,16 +2071,11 @@
 if(!section->engine)
 return "Illegal engine number";
 return NULL; /* OK */
- case CMD_END:
- break;
- case CMD_DUP:
- section->engine=new_service_options.engine;
+ case CMD_INITIALIZE:
 break;
- case CMD_FREE:
- break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = number of engine to read the key from",
 "engineNum");
 break;
@@ -1865,10 +2085,16 @@
 
 /* exec */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->exec_name=NULL;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->exec_name=str_dup_detached(new_service_options.exec_name);
+ break;
+ case CMD_FREE:
+ str_free(section->exec_name);
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "exec"))
 break;
 str_free(section->exec_name);
@@ -1883,19 +2109,13 @@
 }
 #endif
 return NULL; /* OK */
- case CMD_END:
+ case CMD_INITIALIZE:
 if(section->exec_name)
 ++endpoints;
 break;
- case CMD_DUP:
- section->exec_name=str_dup_detached(new_service_options.exec_name);
- break;
- case CMD_FREE:
- str_free(section->exec_name);
- break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = file execute local inetd-type program",
 "exec");
 break;
@@ -1903,39 +2123,39 @@
 
 /* execArgs */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->exec_args=NULL;
 break;
- case CMD_EXEC:
- if(strcasecmp(opt, "execArgs"))
- break;
+ case CMD_SET_COPY:
 #ifdef USE_WIN32
- str_free(section->exec_args);
- section->exec_args=str_dup_detached(arg);
+ section->exec_args=str_dup_detached(new_service_options.exec_args);
 #else
- arg_free(section->exec_args);
- section->exec_args=arg_alloc(arg);
+ section->exec_args=arg_dup(new_service_options.exec_args);
 #endif
- return NULL; /* OK */
- case CMD_END:
 break;
- case CMD_DUP:
+ case CMD_FREE:
 #ifdef USE_WIN32
- section->exec_args=str_dup_detached(new_service_options.exec_args);
+ str_free(section->exec_args);
 #else
- section->exec_args=arg_dup(new_service_options.exec_args);
+ arg_free(section->exec_args);
 #endif
 break;
- case CMD_FREE:
+ case CMD_SET_VALUE:
+ if(strcasecmp(opt, "execArgs"))
+ break;
 #ifdef USE_WIN32
 str_free(section->exec_args);
+ section->exec_args=str_dup_detached(arg);
 #else
 arg_free(section->exec_args);
+ section->exec_args=arg_alloc(arg);
 #endif
+ return NULL; /* OK */
+ case CMD_INITIALIZE:
 break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = arguments for 'exec' (including $0)",
 "execArgs");
 break;
@@ -1943,11 +2163,17 @@
 
 /* failover */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->failover=FAILOVER_PRIO;
 section->rr=0;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->failover=new_service_options.failover;
+ section->rr=new_service_options.rr;
+ break;
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "failover"))
 break;
 if(!strcasecmp(arg, "rr"))
@@ -1957,19 +2183,13 @@
 else
 return "The argument needs to be either 'rr' or 'prio'";
 return NULL; /* OK */
- case CMD_END:
+ case CMD_INITIALIZE:
 if(section->option.delayed_lookup)
 section->failover=FAILOVER_PRIO;
 break;
- case CMD_DUP:
- section->failover=new_service_options.failover;
- section->rr=new_service_options.rr;
- break;
- case CMD_FREE:
- break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = rr|prio failover strategy",
 "failover");
 break;
@@ -1977,54 +2197,76 @@
 
 /* ident */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->username=NULL;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->username=str_dup_detached(new_service_options.username);
+ break;
+ case CMD_FREE:
+ str_free(section->username);
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "ident"))
 break;
 str_free(section->username);
 section->username=str_dup_detached(arg);
 return NULL; /* OK */
- case CMD_END:
+ case CMD_INITIALIZE:
 break;
- case CMD_DUP:
- section->username=str_dup_detached(new_service_options.username);
+ case CMD_PRINT_DEFAULTS:
+ break;
+ case CMD_PRINT_HELP:
+ s_log(LOG_NOTICE, "%-22s = username for IDENT (RFC 1413) checking", "ident");
+ break;
+ }
+
+ /* include */
+ switch(cmd) {
+ case CMD_SET_DEFAULTS:
+ break;
+ case CMD_SET_COPY:
 break;
 case CMD_FREE:
- str_free(section->username);
 break;
- case CMD_DEFAULT:
+ case CMD_SET_VALUE:
+ if(strcasecmp(opt, "include"))
+ break;
+ return include_config(arg, section_ptr);
+ case CMD_INITIALIZE:
 break;
- case CMD_HELP:
- s_log(LOG_NOTICE, "%-22s = username for IDENT (RFC 1413) checking", "ident");
+ case CMD_PRINT_DEFAULTS:
+ break;
+ case CMD_PRINT_HELP:
+ s_log(LOG_NOTICE, "%-22s = directory with configuration file snippets",
+ "include");
 break;
 }
 
 /* key */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->key=NULL;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->key=str_dup_detached(new_service_options.key);
+ break;
+ case CMD_FREE:
+ str_free(section->key);
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "key"))
 break;
 str_free(section->key);
 section->key=str_dup_detached(arg);
 return NULL; /* OK */
- case CMD_END:
+ case CMD_INITIALIZE:
 if(section->cert && !section->key)
 section->key=str_dup_detached(section->cert);
 break;
- case CMD_DUP:
- section->key=str_dup_detached(new_service_options.key);
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_FREE:
- str_free(section->key);
- break;
- case CMD_DEFAULT:
- break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = certificate private key", "key");
 break;
 }
@@ -2032,10 +2274,15 @@
 /* libwrap */
 #ifdef USE_LIBWRAP
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->option.libwrap=0; /* disable libwrap by default */
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->option.libwrap=new_service_options.option.libwrap;
+ break;
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "libwrap"))
 break;
 if(!strcasecmp(arg, "yes"))
@@ -2045,16 +2292,11 @@
 else
 return "The argument needs to be either 'yes' or 'no'";
 return NULL; /* OK */
- case CMD_END:
- break;
- case CMD_DUP:
- section->option.libwrap=new_service_options.option.libwrap;
- break;
- case CMD_FREE:
+ case CMD_INITIALIZE:
 break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = yes|no use /etc/hosts.allow and /etc/hosts.deny",
 "libwrap");
 break;
@@ -2063,28 +2305,28 @@
 
 /* local */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->option.local=0;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->option.local=new_service_options.option.local;
+ memcpy(&section->source_addr, &new_service_options.source_addr,
+ sizeof(SOCKADDR_UNION));
+ break;
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "local"))
 break;
 if(!hostport2addr(&section->source_addr, arg, "0", 1))
 return "Failed to resolve local address";
 section->option.local=1;
 return NULL; /* OK */
- case CMD_END:
+ case CMD_INITIALIZE:
 break;
- case CMD_DUP:
- section->option.local=new_service_options.option.local;
- memcpy(&section->source_addr, &new_service_options.source_addr,
- sizeof(SOCKADDR_UNION));
- break;
- case CMD_FREE:
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_DEFAULT:
- break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = IP address to be used as source for remote"
 " connections", "local");
 break;
@@ -2092,10 +2334,15 @@
 
 /* logId */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->log_id=LOG_ID_SEQUENTIAL;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->log_id=new_service_options.log_id;
+ break;
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "logId"))
 break;
 if(!strcasecmp(arg, "sequential"))
@@ -2109,17 +2356,12 @@
 else
 return "Invalid connection identifier type";
 return NULL; /* OK */
- case CMD_END:
+ case CMD_INITIALIZE:
 break;
- case CMD_DUP:
- section->log_id=new_service_options.log_id;
- break;
- case CMD_FREE:
- break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 s_log(LOG_NOTICE, "%-22s = %s", "logId", "sequential");
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = connection identifier type",
 "logId");
 break;
@@ -2129,36 +2371,41 @@
 
 /* OCSP */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->ocsp_url=NULL;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->ocsp_url=str_dup_detached(new_service_options.ocsp_url);
+ break;
+ case CMD_FREE:
+ str_free(section->ocsp_url);
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "ocsp"))
 break;
 str_free(section->ocsp_url);
 section->ocsp_url=str_dup_detached(arg);
 return NULL; /* OK */
- case CMD_END:
+ case CMD_INITIALIZE:
 break;
- case CMD_DUP:
- section->ocsp_url=str_dup_detached(new_service_options.ocsp_url);
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_FREE:
- str_free(section->ocsp_url);
- break;
- case CMD_DEFAULT:
- break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = OCSP responder URL", "OCSP");
 break;
 }
 
 /* OCSPaia */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->option.aia=0; /* disable AIA by default */
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->option.aia=new_service_options.option.aia;
+ break;
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "OCSPaia"))
 break;
 if(!strcasecmp(arg, "yes"))
@@ -2168,16 +2415,11 @@
 else
 return "The argument needs to be either 'yes' or 'no'";
 return NULL; /* OK */
- case CMD_END:
- break;
- case CMD_DUP:
- section->option.aia=new_service_options.option.aia;
- break;
- case CMD_FREE:
+ case CMD_INITIALIZE:
 break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE,
 "%-22s = yes|no check the AIA responders from certificates",
 "OCSPaia");
@@ -2186,10 +2428,15 @@
 
 /* OCSPflag */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->ocsp_flags=0;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->ocsp_flags=new_service_options.ocsp_flags;
+ break;
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "OCSPflag"))
 break;
 {
@@ -2199,26 +2446,26 @@
 section->ocsp_flags|=tmp_ulong;
 }
 return NULL;
- case CMD_END:
+ case CMD_INITIALIZE:
 break;
- case CMD_DUP:
- section->ocsp_flags=new_service_options.ocsp_flags;
- break;
- case CMD_FREE:
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_DEFAULT:
- break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = OCSP responder flags", "OCSPflag");
 break;
 }
 
 /* OCSPnonce */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->option.nonce=0; /* disable OCSP nonce by default */
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->option.nonce=new_service_options.option.nonce;
+ break;
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "OCSPnonce"))
 break;
 if(!strcasecmp(arg, "yes"))
@@ -2228,16 +2475,11 @@
 else
 return "The argument needs to be either 'yes' or 'no'";
 return NULL; /* OK */
- case CMD_END:
- break;
- case CMD_DUP:
- section->option.nonce=new_service_options.option.nonce;
+ case CMD_INITIALIZE:
 break;
- case CMD_FREE:
- break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE,
 "%-22s = yes|no send and verify the OCSP nonce extension",
 "OCSPnonce");
@@ -2248,19 +2490,27 @@
 
 /* options */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->ssl_options_set=0;
 #if OPENSSL_VERSION_NUMBER>=0x009080dfL
 section->ssl_options_clear=0;
 #endif /* OpenSSL 0.9.8m or later */
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->ssl_options_set=new_service_options.ssl_options_set;
+#if OPENSSL_VERSION_NUMBER>=0x009080dfL
+ section->ssl_options_clear=new_service_options.ssl_options_clear;
+#endif /* OpenSSL 0.9.8m or later */
+ break;
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "options"))
 break;
 #if OPENSSL_VERSION_NUMBER>=0x009080dfL
 if(*arg=='-') {
 long unsigned tmp=parse_ssl_option(arg+1);
- if(!tmp)
+ if(tmp==INVALID_SSL_OPTION)
 return "Illegal TLS option";
 section->ssl_options_clear|=tmp;
 return NULL; /* OK */
@@ -2268,67 +2518,53 @@
 #endif /* OpenSSL 0.9.8m or later */
 {
 long unsigned tmp=parse_ssl_option(arg);
- if(!tmp)
+ if(tmp==INVALID_SSL_OPTION)
 return "Illegal TLS option";
 section->ssl_options_set|=tmp;
 }
 return NULL; /* OK */
- case CMD_END:
- break;
- case CMD_DUP:
- section->ssl_options_set=new_service_options.ssl_options_set;
-#if OPENSSL_VERSION_NUMBER>=0x009080dfL
- section->ssl_options_clear=new_service_options.ssl_options_clear;
-#endif /* OpenSSL 0.9.8m or later */
- break;
- case CMD_FREE:
+ case CMD_INITIALIZE:
 break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 s_log(LOG_NOTICE, "%-22s = %s", "options", "NO_SSLv2");
 s_log(LOG_NOTICE, "%-22s = %s", "options", "NO_SSLv3");
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = TLS option to set/reset", "options");
 break;
 }
 
 /* protocol */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->protocol=NULL;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->protocol=str_dup_detached(new_service_options.protocol);
+ break;
+ case CMD_FREE:
+ str_free(section->protocol);
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "protocol"))
 break;
 str_free(section->protocol);
 section->protocol=str_dup_detached(arg);
 return NULL; /* OK */
- case CMD_END:
+ case CMD_INITIALIZE:
 /* PROTOCOL_CHECK also initializes:
 section->option.connect_before_ssl
 section->option.protocol_endpoint */
 {
- char *tmp_str=protocol(NULL, section, PROTOCOL_CHECK);
+ const char *tmp_str=protocol(NULL, section, PROTOCOL_CHECK);
 if(tmp_str)
 return tmp_str;
 }
 endpoints+=section->option.protocol_endpoint;
-#ifdef SSL_OP_NO_TICKET
- /* disable RFC4507 support introduced in OpenSSL 0.9.8f */
- /* session tickets do not support SSL_SESSION_*_ex_data() */
- if(!section->option.connect_before_ssl) /* address cache can be used */
- section->ssl_options_set|=SSL_OP_NO_TICKET;
-#endif
- break;
- case CMD_DUP:
- section->protocol=str_dup_detached(new_service_options.protocol);
 break;
- case CMD_FREE:
- str_free(section->protocol);
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_DEFAULT:
- break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = protocol to negotiate before TLS initialization",
 "protocol");
 s_log(LOG_NOTICE, "%25scurrently supported: cifs, connect, imap,", "");
@@ -2338,27 +2574,27 @@
 
 /* protocolAuthentication */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->protocol_authentication=str_dup_detached("basic");
 break;
- case CMD_EXEC:
- if(strcasecmp(opt, "protocolAuthentication"))
- break;
- str_free(section->protocol_authentication);
- section->protocol_authentication=str_dup_detached(arg);
- return NULL; /* OK */
- case CMD_END:
- break;
- case CMD_DUP:
+ case CMD_SET_COPY:
 section->protocol_authentication=
 str_dup_detached(new_service_options.protocol_authentication);
 break;
 case CMD_FREE:
 str_free(section->protocol_authentication);
 break;
- case CMD_DEFAULT:
+ case CMD_SET_VALUE:
+ if(strcasecmp(opt, "protocolAuthentication"))
+ break;
+ str_free(section->protocol_authentication);
+ section->protocol_authentication=str_dup_detached(arg);
+ return NULL; /* OK */
+ case CMD_INITIALIZE:
+ break;
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = authentication type for protocol negotiations",
 "protocolAuthentication");
 break;
@@ -2366,55 +2602,82 @@
 
 /* protocolDomain */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->protocol_domain=NULL;
 break;
- case CMD_EXEC:
- if(strcasecmp(opt, "protocolDomain"))
- break;
- str_free(section->protocol_domain);
- section->protocol_domain=str_dup_detached(arg);
- return NULL; /* OK */
- case CMD_END:
- break;
- case CMD_DUP:
+ case CMD_SET_COPY:
 section->protocol_domain=
 str_dup_detached(new_service_options.protocol_domain);
 break;
 case CMD_FREE:
 str_free(section->protocol_domain);
 break;
- case CMD_DEFAULT:
+ case CMD_SET_VALUE:
+ if(strcasecmp(opt, "protocolDomain"))
+ break;
+ str_free(section->protocol_domain);
+ section->protocol_domain=str_dup_detached(arg);
+ return NULL; /* OK */
+ case CMD_INITIALIZE:
+ break;
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = domain for protocol negotiations",
 "protocolDomain");
 break;
 }
 
- /* protocolHost */
+ /* protocolHeader */
 switch(cmd) {
- case CMD_BEGIN:
- section->protocol_host=NULL;
+ case CMD_SET_DEFAULTS:
+ section->protocol_header=NULL;
 break;
- case CMD_EXEC:
- if(strcasecmp(opt, "protocolHost"))
+ case CMD_SET_COPY:
+ name_list_dup(&section->protocol_header,
+ new_service_options.protocol_header);
+ break;
+ case CMD_FREE:
+ name_list_free(section->protocol_header);
+ break;
+ case CMD_SET_VALUE:
+ if(strcasecmp(opt, "protocolHeader"))
 break;
- str_free(section->protocol_host);
- section->protocol_host=str_dup_detached(arg);
+ name_list_append(&section->protocol_header, arg);
 return NULL; /* OK */
- case CMD_END:
+ case CMD_INITIALIZE:
+ break;
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_DUP:
+ case CMD_PRINT_HELP:
+ s_log(LOG_NOTICE, "%-22s = custom header for protocol negotiations",
+ "protocolHeader");
+ break;
+ }
+
+ /* protocolHost */
+ switch(cmd) {
+ case CMD_SET_DEFAULTS:
+ section->protocol_host=NULL;
+ break;
+ case CMD_SET_COPY:
 section->protocol_host=
 str_dup_detached(new_service_options.protocol_host);
 break;
 case CMD_FREE:
 str_free(section->protocol_host);
 break;
- case CMD_DEFAULT:
+ case CMD_SET_VALUE:
+ if(strcasecmp(opt, "protocolHost"))
+ break;
+ str_free(section->protocol_host);
+ section->protocol_host=str_dup_detached(arg);
+ return NULL; /* OK */
+ case CMD_INITIALIZE:
+ break;
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = host:port for protocol negotiations",
 "protocolHost");
 break;
@@ -2422,27 +2685,27 @@
 
 /* protocolPassword */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->protocol_password=NULL;
 break;
- case CMD_EXEC:
- if(strcasecmp(opt, "protocolPassword"))
- break;
- str_free(section->protocol_password);
- section->protocol_password=str_dup_detached(arg);
- return NULL; /* OK */
- case CMD_END:
- break;
- case CMD_DUP:
+ case CMD_SET_COPY:
 section->protocol_password=
 str_dup_detached(new_service_options.protocol_password);
 break;
 case CMD_FREE:
 str_free(section->protocol_password);
 break;
- case CMD_DEFAULT:
+ case CMD_SET_VALUE:
+ if(strcasecmp(opt, "protocolPassword"))
+ break;
+ str_free(section->protocol_password);
+ section->protocol_password=str_dup_detached(arg);
+ return NULL; /* OK */
+ case CMD_INITIALIZE:
+ break;
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = password for protocol negotiations",
 "protocolPassword");
 break;
@@ -2450,27 +2713,27 @@
 
 /* protocolUsername */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->protocol_username=NULL;
 break;
- case CMD_EXEC:
- if(strcasecmp(opt, "protocolUsername"))
- break;
- str_free(section->protocol_username);
- section->protocol_username=str_dup_detached(arg);
- return NULL; /* OK */
- case CMD_END:
- break;
- case CMD_DUP:
+ case CMD_SET_COPY:
 section->protocol_username=
 str_dup_detached(new_service_options.protocol_username);
 break;
 case CMD_FREE:
 str_free(section->protocol_username);
 break;
- case CMD_DEFAULT:
+ case CMD_SET_VALUE:
+ if(strcasecmp(opt, "protocolUsername"))
+ break;
+ str_free(section->protocol_username);
+ section->protocol_username=str_dup_detached(arg);
+ return NULL; /* OK */
+ case CMD_INITIALIZE:
 break;
- case CMD_HELP:
+ case CMD_PRINT_DEFAULTS:
+ break;
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = username for protocol negotiations",
 "protocolUsername");
 break;
@@ -2480,19 +2743,27 @@
 
 /* PSKidentity */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->psk_identity=NULL;
 section->psk_selected=NULL;
 section->psk_sorted.val=NULL;
 section->psk_sorted.num=0;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->psk_identity=
+ str_dup_detached(new_service_options.psk_identity);
+ break;
+ case CMD_FREE:
+ str_free(section->psk_identity);
+ str_free(section->psk_sorted.val);
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "PSKidentity"))
 break;
 str_free(section->psk_identity);
 section->psk_identity=str_dup_detached(arg);
 return NULL; /* OK */
- case CMD_END:
+ case CMD_INITIALIZE:
 if(!section->psk_keys) /* PSK not configured */
 break;
 psk_sort(&section->psk_sorted, section->psk_keys);
@@ -2511,17 +2782,9 @@
 "PSK identity is ignored in the server mode");
 }
 break;
- case CMD_DUP:
- section->psk_identity=
- str_dup_detached(new_service_options.psk_identity);
- break;
- case CMD_FREE:
- str_free(section->psk_identity);
- str_free(section->psk_sorted.val);
- break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = identity for PSK authentication",
 "PSKidentity");
 break;
@@ -2529,27 +2792,27 @@
 
 /* PSKsecrets */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->psk_keys=NULL;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->psk_keys=psk_dup(new_service_options.psk_keys);
+ break;
+ case CMD_FREE:
+ psk_free(section->psk_keys);
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "PSKsecrets"))
 break;
 section->psk_keys=psk_read(arg);
 if(!section->psk_keys)
 return "Failed to read PSK secrets";
 return NULL; /* OK */
- case CMD_END:
+ case CMD_INITIALIZE:
 break;
- case CMD_DUP:
- section->psk_keys=psk_dup(new_service_options.psk_keys);
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_FREE:
- psk_free(section->psk_keys);
- break;
- case CMD_DEFAULT:
- break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = secrets for PSK authentication",
 "PSKsecrets");
 break;
@@ -2560,10 +2823,15 @@
 /* pty */
 #ifndef USE_WIN32
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->option.pty=0;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->option.pty=new_service_options.option.pty;
+ break;
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "pty"))
 break;
 if(!strcasecmp(arg, "yes"))
@@ -2573,16 +2841,11 @@
 else
 return "The argument needs to be either 'yes' or 'no'";
 return NULL; /* OK */
- case CMD_END:
- break;
- case CMD_DUP:
- section->option.pty=new_service_options.option.pty;
+ case CMD_INITIALIZE:
 break;
- case CMD_FREE:
- break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = yes|no allocate pseudo terminal for 'exec' option",
 "pty");
 break;
@@ -2591,21 +2854,29 @@
 
 /* redirect */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 addrlist_clear(&section->redirect_addr, 0);
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ addrlist_clear(&section->redirect_addr, 0);
+ name_list_dup(&section->redirect_addr.names,
+ new_service_options.redirect_addr.names);
+ break;
+ case CMD_FREE:
+ name_list_free(section->redirect_addr.names);
+ str_free(section->redirect_addr.addr);
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "redirect"))
 break;
-#ifdef SSL_OP_NO_TICKET
- /* disable RFC4507 support introduced in OpenSSL 0.9.8f */
- /* session tickets do not support SSL_SESSION_*_ex_data() */
- section->ssl_options_set|=SSL_OP_NO_TICKET;
-#endif
 name_list_append(&section->redirect_addr.names, arg);
 return NULL; /* OK */
- case CMD_END:
+ case CMD_INITIALIZE:
 if(section->redirect_addr.names) {
+ if(section->option.client)
+ return "\"redirect\" is unsupported in client sections";
+ if(section->option.connect_before_ssl)
+ return "\"redirect\" is incompatible with the specified protocol negotiation";
 if(!section->option.delayed_lookup &&
 !addrlist_resolve(&section->redirect_addr)) {
 s_log(LOG_INFO,
@@ -2618,18 +2889,9 @@
 return "Either \"verifyChain\" or \"verifyPeer\" has to be enabled for \"redirect\" to work";
 }
 break;
- case CMD_DUP:
- addrlist_clear(&section->redirect_addr, 0);
- name_list_dup(&section->redirect_addr.names,
- new_service_options.redirect_addr.names);
- break;
- case CMD_FREE:
- name_list_free(section->redirect_addr.names);
- str_free(section->redirect_addr.addr);
- break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE,
 "%-22s = host:port to redirect on authentication failures",
 "redirect");
@@ -2638,10 +2900,15 @@
 
 /* renegotiation */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->option.renegotiation=1;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->option.renegotiation=new_service_options.option.renegotiation;
+ break;
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "renegotiation"))
 break;
 if(!strcasecmp(arg, "yes"))
@@ -2651,16 +2918,11 @@
 else
 return "The argument needs to be either 'yes' or 'no'";
 return NULL; /* OK */
- case CMD_END:
- break;
- case CMD_DUP:
- section->option.renegotiation=new_service_options.option.renegotiation;
- break;
- case CMD_FREE:
+ case CMD_INITIALIZE:
 break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = yes|no support renegotiation",
 "renegotiation");
 break;
@@ -2668,10 +2930,15 @@
 
 /* requireCert */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->option.require_cert=0;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->option.require_cert=new_service_options.option.require_cert;
+ break;
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "requireCert"))
 break;
 if(!strcasecmp(arg, "yes")) {
@@ -2683,16 +2950,11 @@
 return "The argument needs to be either 'yes' or 'no'";
 }
 return NULL; /* OK */
- case CMD_END:
- break;
- case CMD_DUP:
- section->option.require_cert=new_service_options.option.require_cert;
- break;
- case CMD_FREE:
+ case CMD_INITIALIZE:
 break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = yes|no require client certificate",
 "requireCert");
 break;
@@ -2700,10 +2962,15 @@
 
 /* reset */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->option.reset=1; /* enabled by default */
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->option.reset=new_service_options.option.reset;
+ break;
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "reset"))
 break;
 if(!strcasecmp(arg, "yes"))
@@ -2713,16 +2980,11 @@
 else
 return "The argument needs to be either 'yes' or 'no'";
 return NULL; /* OK */
- case CMD_END:
- break;
- case CMD_DUP:
- section->option.reset=new_service_options.option.reset;
- break;
- case CMD_FREE:
+ case CMD_INITIALIZE:
 break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = yes|no send TCP RST on error",
 "reset");
 break;
@@ -2730,10 +2992,15 @@
 
 /* retry */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->option.retry=0;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->option.retry=new_service_options.option.retry;
+ break;
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "retry"))
 break;
 if(!strcasecmp(arg, "yes"))
@@ -2743,44 +3010,72 @@
 else
 return "The argument needs to be either 'yes' or 'no'";
 return NULL; /* OK */
- case CMD_END:
+ case CMD_INITIALIZE:
 break;
- case CMD_DUP:
- section->option.retry=new_service_options.option.retry;
+ case CMD_PRINT_DEFAULTS:
+ break;
+ case CMD_PRINT_HELP:
+ s_log(LOG_NOTICE, "%-22s = yes|no retry connect+exec section",
+ "retry");
+ break;
+ }
+
+#if OPENSSL_VERSION_NUMBER>=0x10100000L
+ /* securityLevel */
+ switch(cmd) {
+ case CMD_SET_DEFAULTS:
+ section->security_level=-1;
+ break;
+ case CMD_SET_COPY:
+ section->security_level=new_service_options.security_level;
 break;
 case CMD_FREE:
 break;
- case CMD_DEFAULT:
+ case CMD_SET_VALUE:
+ if(strcasecmp(opt, "securityLevel"))
+ break;
+ {
+ char *tmp_str;
+ int tmp_int =(int)strtol(arg, &tmp_str, 10);
+ if(tmp_str==arg || *tmp_str || tmp_int<0 || tmp_int>5) /* not a correct number */
+ return "Illegal security level";
+ section->security_level = tmp_int;
+ }
+ return NULL; /* OK */
+ case CMD_INITIALIZE:
 break;
- case CMD_HELP:
- s_log(LOG_NOTICE, "%-22s = yes|no retry connect+exec section",
- "retry");
+ case CMD_PRINT_DEFAULTS:
+ s_log(LOG_NOTICE, "%-22s = %d", "securityLevel", DEFAULT_SECURITY_LEVEL);
+ break;
+ case CMD_PRINT_HELP:
+ s_log(LOG_NOTICE, "%-22s = set the security level", "securityLevel");
 break;
 }
+#endif /* OpenSSL 1.1.0 or later */
 
 #ifndef USE_WIN32
 /* service */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->servname=str_dup_detached("stunnel");
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ /* servname is *not* copied from the global section */
+ break;
+ case CMD_FREE:
+ /* deallocation is performed at the end CMD_FREE */
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "service"))
 break;
 str_free(section->servname);
 section->servname=str_dup_detached(arg);
 return NULL; /* OK */
- case CMD_END:
- break;
- case CMD_DUP:
- /* servname is *not* copied from the global section */
+ case CMD_INITIALIZE:
 break;
- case CMD_FREE:
- /* deallocation is performed at the end CMD_FREE */
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_DEFAULT:
- break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = service name", "service");
 break;
 }
@@ -2789,10 +3084,15 @@
 #ifndef USE_WIN32
 /* setgid */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->gid=0;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->gid=new_service_options.gid;
+ break;
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "setgid"))
 break;
 gr=getgrnam(arg);
@@ -2807,16 +3107,11 @@
 return "Illegal GID";
 }
 return NULL; /* OK */
- case CMD_END:
+ case CMD_INITIALIZE:
 break;
- case CMD_DUP:
- section->gid=new_service_options.gid;
- break;
- case CMD_FREE:
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_DEFAULT:
- break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = groupname for setgid()", "setgid");
 break;
 }
@@ -2825,10 +3120,15 @@
 #ifndef USE_WIN32
 /* setuid */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->uid=0;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->uid=new_service_options.uid;
+ break;
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "setuid"))
 break;
 pw=getpwnam(arg);
@@ -2843,16 +3143,11 @@
 return "Illegal UID";
 }
 return NULL; /* OK */
- case CMD_END:
+ case CMD_INITIALIZE:
 break;
- case CMD_DUP:
- section->uid=new_service_options.uid;
- break;
- case CMD_FREE:
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_DEFAULT:
- break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = username for setuid()", "setuid");
 break;
 }
@@ -2860,10 +3155,15 @@
 
 /* sessionCacheSize */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->session_size=1000L;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->session_size=new_service_options.session_size;
+ break;
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "sessionCacheSize"))
 break;
 {
@@ -2873,27 +3173,27 @@
 return "Illegal session cache size";
 }
 return NULL; /* OK */
- case CMD_END:
+ case CMD_INITIALIZE:
 break;
- case CMD_DUP:
- section->session_size=new_service_options.session_size;
- break;
- case CMD_FREE:
- break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 s_log(LOG_NOTICE, "%-22s = %ld", "sessionCacheSize", 1000L);
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = session cache size", "sessionCacheSize");
 break;
 }
 
 /* sessionCacheTimeout */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->session_timeout=300L;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->session_timeout=new_service_options.session_timeout;
+ break;
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "sessionCacheTimeout") && strcasecmp(opt, "session"))
 break;
 {
@@ -2903,30 +3203,62 @@
 return "Illegal session cache timeout";
 }
 return NULL; /* OK */
- case CMD_END:
- break;
- case CMD_DUP:
- section->session_timeout=new_service_options.session_timeout;
+ case CMD_INITIALIZE:
 break;
- case CMD_FREE:
- break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 s_log(LOG_NOTICE, "%-22s = %ld seconds", "sessionCacheTimeout", 300L);
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = session cache timeout (in seconds)",
 "sessionCacheTimeout");
 break;
 }
 
+ /* sessionResume */
+ switch(cmd) {
+ case CMD_SET_DEFAULTS:
+ section->option.session_resume=1; /* enabled by default */
+ break;
+ case CMD_SET_COPY:
+ section->option.session_resume=new_service_options.option.session_resume;
+ break;
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
+ if(strcasecmp(opt, "sessionResume"))
+ break;
+ if(!strcasecmp(arg, "yes"))
+ section->option.session_resume=1;
+ else if(!strcasecmp(arg, "no"))
+ section->option.session_resume=0;
+ else
+ return "The argument needs to be either 'yes' or 'no'";
+ return NULL; /* OK */
+ case CMD_INITIALIZE:
+ break;
+ case CMD_PRINT_DEFAULTS:
+ break;
+ case CMD_PRINT_HELP:
+ s_log(LOG_NOTICE, "%-22s = yes|no enable session resumption",
+ "sessionResume");
+ break;
+ }
+
 /* sessiond */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->option.sessiond=0;
 memset(&section->sessiond_addr, 0, sizeof(SOCKADDR_UNION));
 section->sessiond_addr.in.sin_family=AF_INET;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->option.sessiond=new_service_options.option.sessiond;
+ memcpy(&section->sessiond_addr, &new_service_options.sessiond_addr,
+ sizeof(SOCKADDR_UNION));
+ break;
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "sessiond"))
 break;
 section->option.sessiond=1;
@@ -2938,18 +3270,11 @@
 if(!name2addr(&section->sessiond_addr, arg, 0))
 return "Failed to resolve sessiond server address";
 return NULL; /* OK */
- case CMD_END:
+ case CMD_INITIALIZE:
 break;
- case CMD_DUP:
- section->option.sessiond=new_service_options.option.sessiond;
- memcpy(&section->sessiond_addr, &new_service_options.sessiond_addr,
- sizeof(SOCKADDR_UNION));
- break;
- case CMD_FREE:
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_DEFAULT:
- break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = host:port use sessiond at host:port",
 "sessiond");
 break;
@@ -2958,37 +3283,37 @@
 #ifndef OPENSSL_NO_TLSEXT
 /* sni */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->servername_list_head=NULL;
 section->servername_list_tail=NULL;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->sni=
+ str_dup_detached(new_service_options.sni);
+ break;
+ case CMD_FREE:
+ str_free(section->sni);
+ sni_free(section);
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "sni"))
 break;
 str_free(section->sni);
 section->sni=str_dup_detached(arg);
 return NULL; /* OK */
- case CMD_END:
+ case CMD_INITIALIZE:
 {
- char *tmp_str=sni_init(section);
+ const char *tmp_str=sni_init(section);
 if(tmp_str)
 return tmp_str;
 }
 if(!section->option.client && section->sni)
 ++endpoints;
 break;
- case CMD_DUP:
- section->sni=
- str_dup_detached(new_service_options.sni);
- break;
- case CMD_FREE:
- str_free(section->sni);
- sni_free(section);
- break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_HELP:
- s_log(LOG_NOTICE, "%-22s = master_service:host_name for an SNI virtual service",
+ case CMD_PRINT_HELP:
+ s_log(LOG_NOTICE, "%-22s = primary_service:host_name for an SNI virtual service",
 "sni");
 break;
 }
@@ -2996,74 +3321,180 @@
 
 /* socket */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->sock_opts=socket_options_init();
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->sock_opts=socket_options_dup(new_service_options.sock_opts);
+ break;
+ case CMD_FREE:
+ socket_options_free(section->sock_opts);
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "socket"))
 break;
 if(socket_option_parse(section->sock_opts, arg))
 return "Illegal socket option";
 return NULL; /* OK */
- case CMD_END:
+ case CMD_INITIALIZE:
 break;
- case CMD_DUP:
- section->sock_opts=socket_options_dup(new_service_options.sock_opts);
+ case CMD_PRINT_DEFAULTS:
+ break;
+ case CMD_PRINT_HELP:
+ s_log(LOG_NOTICE, "%-22s = a|l|r:option=value:value", "socket");
+ s_log(LOG_NOTICE, "%25sset an option on accept/local/remote socket", "");
+ break;
+ }
+
+#if OPENSSL_VERSION_NUMBER>=0x10100000L
+
+ /* sslVersion */
+ switch(cmd) {
+ case CMD_SET_DEFAULTS:
+ /* handled in sslVersionMax and sslVersionMin */
+ break;
+ case CMD_SET_COPY:
+ /* handled in sslVersionMax and sslVersionMin */
 break;
 case CMD_FREE:
- socket_options_free(section->sock_opts);
 break;
- case CMD_DEFAULT:
+ case CMD_SET_VALUE:
+ if(strcasecmp(opt, "sslVersion"))
+ break;
+ section->max_proto_version=
+ section->min_proto_version=str_to_proto_version(arg);
+ if(section->max_proto_version==-1)
+ return "Invalid protocol version";
+ return NULL; /* OK */
+ case CMD_INITIALIZE:
+ if(section->max_proto_version && section->min_proto_version &&
+ section->max_proto_version<section->min_proto_version)
+ return "Invalid protocol version range";
 break;
- case CMD_HELP:
- s_log(LOG_NOTICE, "%-22s = a|l|r:option=value:value", "socket");
- s_log(LOG_NOTICE, "%25sset an option on accept/local/remote socket", "");
+ case CMD_PRINT_DEFAULTS:
+ break;
+ case CMD_PRINT_HELP:
+ s_log(LOG_NOTICE, "%-22s = all"
+ "|SSLv3|TLSv1|TLSv1.1|TLSv1.2"
+#ifdef TLS1_3_VERSION
+ "|TLSv1.3"
+#endif
+ " TLS version", "sslVersion");
+ break;
+ }
+
+ /* sslVersionMax */
+ switch(cmd) {
+ case CMD_SET_DEFAULTS:
+ section->max_proto_version=0; /* highest supported */
+ break;
+ case CMD_SET_COPY:
+ section->max_proto_version=new_service_options.max_proto_version;
+ break;
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
+ if(strcasecmp(opt, "sslVersionMax"))
+ break;
+ section->max_proto_version=str_to_proto_version(arg);
+ if(section->max_proto_version==-1)
+ return "Invalid protocol version";
+ return NULL; /* OK */
+ case CMD_INITIALIZE:
+ break;
+ case CMD_PRINT_DEFAULTS:
+ break;
+ case CMD_PRINT_HELP:
+ s_log(LOG_NOTICE, "%-22s = all"
+ "|SSLv3|TLSv1|TLSv1.1|TLSv1.2"
+#ifdef TLS1_3_VERSION
+ "|TLSv1.3"
+#endif
+ " TLS version", "sslVersionMax");
 break;
 }
 
+ /* sslVersionMin */
+ switch(cmd) {
+ case CMD_SET_DEFAULTS:
+ section->min_proto_version=0; /* lowest supported */
+ break;
+ case CMD_SET_COPY:
+ section->min_proto_version=new_service_options.min_proto_version;
+ break;
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
+ if(strcasecmp(opt, "sslVersionMin"))
+ break;
+ section->min_proto_version=str_to_proto_version(arg);
+ if(section->min_proto_version==-1)
+ return "Invalid protocol version";
+ return NULL; /* OK */
+ case CMD_INITIALIZE:
+ break;
+ case CMD_PRINT_DEFAULTS:
+ break;
+ case CMD_PRINT_HELP:
+ s_log(LOG_NOTICE, "%-22s = all"
+ "|SSLv3|TLSv1|TLSv1.1|TLSv1.2"
+#ifdef TLS1_3_VERSION
+ "|TLSv1.3"
+#endif
+ " TLS version", "sslVersionMin");
+ break;
+ }
+
+#else /* OPENSSL_VERSION_NUMBER<0x10100000L */
+
 /* sslVersion */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 tls_methods_set(section, NULL);
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->client_method=new_service_options.client_method;
+ section->server_method=new_service_options.server_method;
+ break;
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "sslVersion"))
 break;
 return tls_methods_set(section, arg);
- case CMD_END:
+ case CMD_INITIALIZE:
 {
 char *tmp_str=tls_methods_check(section);
 if(tmp_str)
 return tmp_str;
 }
 break;
- case CMD_DUP:
- section->client_method=new_service_options.client_method;
- section->server_method=new_service_options.server_method;
- break;
- case CMD_FREE:
- break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = all"
-#if OPENSSL_VERSION_NUMBER<0x10100000L
 "|SSLv2|SSLv3|TLSv1"
 #if OPENSSL_VERSION_NUMBER>=0x10001000L
 "|TLSv1.1|TLSv1.2"
 #endif /* OPENSSL_VERSION_NUMBER>=0x10001000L */
-#endif /* OPENSSL_VERSION_NUMBER<0x10100000L */
 " TLS method", "sslVersion");
 break;
 }
 
+#endif /* OPENSSL_VERSION_NUMBER<0x10100000L */
+
 #ifndef USE_FORK
 /* stack */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->stack_size=DEFAULT_STACK_SIZE;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->stack_size=new_service_options.stack_size;
+ break;
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "stack"))
 break;
 {
@@ -3073,28 +3504,106 @@
 return "Illegal thread stack size";
 }
 return NULL; /* OK */
- case CMD_END:
- break;
- case CMD_DUP:
- section->stack_size=new_service_options.stack_size;
- break;
- case CMD_FREE:
+ case CMD_INITIALIZE:
 break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 s_log(LOG_NOTICE, "%-22s = %d bytes", "stack", DEFAULT_STACK_SIZE);
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = thread stack size (in bytes)", "stack");
 break;
 }
 #endif
 
+#if OPENSSL_VERSION_NUMBER>=0x10000000L
+
+ /* ticketKeySecret */
+ switch(cmd) {
+ case CMD_SET_DEFAULTS:
+ section->ticket_key=NULL;
+ break;
+ case CMD_SET_COPY:
+ section->ticket_key=key_dup(new_service_options.ticket_key);
+ break;
+ case CMD_FREE:
+ key_free(section->ticket_key);
+ break;
+ case CMD_SET_VALUE:
+ if(strcasecmp(opt, "ticketKeySecret"))
+ break;
+ section->ticket_key=key_read(arg, "ticketKeySecret");
+ if(!section->ticket_key)
+ return "Failed to read ticketKeySecret";
+ return NULL; /* OK */
+ case CMD_INITIALIZE:
+ if(!section->ticket_key) /* ticketKeySecret not configured */
+ break;
+ if(section->option.client){
+ s_log(LOG_NOTICE,
+ "ticketKeySecret is ignored in the client mode");
+ break;
+ }
+ if(section->ticket_key && !section->ticket_mac)
+ return "\"ticketKeySecret\" and \"ticketMacSecret\" must be set together";
+ break;
+ case CMD_PRINT_DEFAULTS:
+ break;
+ case CMD_PRINT_HELP:
+ s_log(LOG_NOTICE, "%-22s = secret key for encryption/decryption TLSv1.3 tickets",
+ "ticketKeySecret");
+ break;
+ }
+
+ /* ticketMacSecret */
+ switch(cmd) {
+ case CMD_SET_DEFAULTS:
+ section->ticket_mac=NULL;
+ break;
+ case CMD_SET_COPY:
+ section->ticket_mac=key_dup(new_service_options.ticket_mac);
+ break;
+ case CMD_FREE:
+ key_free(section->ticket_mac);
+ break;
+ case CMD_SET_VALUE:
+ if(strcasecmp(opt, "ticketMacSecret"))
+ break;
+ section->ticket_mac=key_read(arg, "ticketMacSecret");
+ if(!section->ticket_mac)
+ return "Failed to read ticketMacSecret";
+ return NULL; /* OK */
+ case CMD_INITIALIZE:
+ if(!section->ticket_mac) /* ticketMacSecret not configured */
+ break;
+ if(section->option.client){
+ s_log(LOG_NOTICE,
+ "ticketMacSecret is ignored in the client mode");
+ break;
+ }
+ if(section->ticket_mac && !section->ticket_key)
+ return "\"ticketKeySecret\" and \"ticketMacSecret\" must be set together";
+ break;
+ case CMD_PRINT_DEFAULTS:
+ break;
+ case CMD_PRINT_HELP:
+ s_log(LOG_NOTICE, "%-22s = key for HMAC operations on TLSv1.3 tickets",
+ "ticketMacSecret");
+ break;
+ }
+
+#endif /* OpenSSL 1.0.0 or later */
+
 /* TIMEOUTbusy */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->timeout_busy=300; /* 5 minutes */
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->timeout_busy=new_service_options.timeout_busy;
+ break;
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "TIMEOUTbusy"))
 break;
 {
@@ -3104,27 +3613,27 @@
 return "Illegal busy timeout";
 }
 return NULL; /* OK */
- case CMD_END:
+ case CMD_INITIALIZE:
 break;
- case CMD_DUP:
- section->timeout_busy=new_service_options.timeout_busy;
- break;
- case CMD_FREE:
- break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 s_log(LOG_NOTICE, "%-22s = %d seconds", "TIMEOUTbusy", 300);
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = seconds to wait for expected data", "TIMEOUTbusy");
 break;
 }
 
 /* TIMEOUTclose */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->timeout_close=60; /* 1 minute */
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->timeout_close=new_service_options.timeout_close;
+ break;
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "TIMEOUTclose"))
 break;
 {
@@ -3134,17 +3643,12 @@
 return "Illegal close timeout";
 }
 return NULL; /* OK */
- case CMD_END:
+ case CMD_INITIALIZE:
 break;
- case CMD_DUP:
- section->timeout_close=new_service_options.timeout_close;
- break;
- case CMD_FREE:
- break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 s_log(LOG_NOTICE, "%-22s = %d seconds", "TIMEOUTclose", 60);
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = seconds to wait for close_notify",
 "TIMEOUTclose");
 break;
@@ -3152,10 +3656,15 @@
 
 /* TIMEOUTconnect */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->timeout_connect=10; /* 10 seconds */
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->timeout_connect=new_service_options.timeout_connect;
+ break;
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "TIMEOUTconnect"))
 break;
 {
@@ -3165,27 +3674,27 @@
 return "Illegal connect timeout";
 }
 return NULL; /* OK */
- case CMD_END:
+ case CMD_INITIALIZE:
 break;
- case CMD_DUP:
- section->timeout_connect=new_service_options.timeout_connect;
- break;
- case CMD_FREE:
- break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 s_log(LOG_NOTICE, "%-22s = %d seconds", "TIMEOUTconnect", 10);
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = seconds to connect remote host", "TIMEOUTconnect");
 break;
 }
 
 /* TIMEOUTidle */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->timeout_idle=43200; /* 12 hours */
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->timeout_idle=new_service_options.timeout_idle;
+ break;
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "TIMEOUTidle"))
 break;
 {
@@ -3195,17 +3704,12 @@
 return "Illegal idle timeout";
 return NULL; /* OK */
 }
- case CMD_END:
- break;
- case CMD_DUP:
- section->timeout_idle=new_service_options.timeout_idle;
+ case CMD_INITIALIZE:
 break;
- case CMD_FREE:
- break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 s_log(LOG_NOTICE, "%-22s = %d seconds", "TIMEOUTidle", 43200);
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = seconds to keep an idle connection", "TIMEOUTidle");
 break;
 }
@@ -3213,11 +3717,17 @@
 /* transparent */
 #ifndef USE_WIN32
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->option.transparent_src=0;
 section->option.transparent_dst=0;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->option.transparent_src=new_service_options.option.transparent_src;
+ section->option.transparent_dst=new_service_options.option.transparent_dst;
+ break;
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "transparent"))
 break;
 if(!strcasecmp(arg, "none") || !strcasecmp(arg, "no")) {
@@ -3235,19 +3745,13 @@
 } else
 return "Selected transparent proxy mode is not available";
 return NULL; /* OK */
- case CMD_END:
+ case CMD_INITIALIZE:
 if(section->option.transparent_dst)
 ++endpoints;
 break;
- case CMD_DUP:
- section->option.transparent_src=new_service_options.option.transparent_src;
- section->option.transparent_dst=new_service_options.option.transparent_dst;
- break;
- case CMD_FREE:
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_DEFAULT:
- break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE,
 "%-22s = none|source|destination|both transparent proxy mode",
 "transparent");
@@ -3257,10 +3761,15 @@
 
 /* verify */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->option.request_cert=0;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->option.request_cert=new_service_options.option.request_cert;
+ break;
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "verify"))
 break;
 {
@@ -3274,41 +3783,37 @@
 section->option.verify_peer=(tmp_int>=3);
 }
 return NULL; /* OK */
- case CMD_END:
+ case CMD_INITIALIZE:
+#ifndef OPENSSL_NO_ENGINE
+ if((section->option.verify_chain || section->option.verify_peer) &&
+ !section->ca_engine && !section->ca_file && !section->ca_dir)
+ return "Either \"CAengine\", \"CAfile\" or \"CApath\" has to be configured";
+#else
 if((section->option.verify_chain || section->option.verify_peer) &&
 !section->ca_file && !section->ca_dir)
 return "Either \"CAfile\" or \"CApath\" has to be configured";
+#endif
 break;
- case CMD_DUP:
- section->option.request_cert=new_service_options.option.request_cert;
- break;
- case CMD_FREE:
- break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 s_log(LOG_NOTICE, "%-22s = none", "verify");
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE,
 "%-22s = level of peer certificate verification", "verify");
- s_log(LOG_NOTICE,
- "%25slevel 0 - request and ignore peer cert", "");
- s_log(LOG_NOTICE,
- "%25slevel 1 - only validate peer cert if present", "");
- s_log(LOG_NOTICE,
- "%25slevel 2 - always require a valid peer cert", "");
- s_log(LOG_NOTICE,
- "%25slevel 3 - verify peer with locally installed cert", "");
- s_log(LOG_NOTICE,
- "%25slevel 4 - ignore CA chain and only verify peer cert", "");
 break;
 }
 
 /* verifyChain */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->option.verify_chain=0;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->option.verify_chain=new_service_options.option.verify_chain;
+ break;
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "verifyChain"))
 break;
 if(!strcasecmp(arg, "yes")) {
@@ -3321,16 +3826,11 @@
 return "The argument needs to be either 'yes' or 'no'";
 }
 return NULL; /* OK */
- case CMD_END:
- break;
- case CMD_DUP:
- section->option.verify_chain=new_service_options.option.verify_chain;
- break;
- case CMD_FREE:
+ case CMD_INITIALIZE:
 break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = yes|no verify certificate chain",
 "verifyChain");
 break;
@@ -3338,10 +3838,15 @@
 
 /* verifyPeer */
 switch(cmd) {
- case CMD_BEGIN:
+ case CMD_SET_DEFAULTS:
 section->option.verify_peer=0;
 break;
- case CMD_EXEC:
+ case CMD_SET_COPY:
+ section->option.verify_peer=new_service_options.option.verify_peer;
+ break;
+ case CMD_FREE:
+ break;
+ case CMD_SET_VALUE:
 if(strcasecmp(opt, "verifyPeer"))
 break;
 if(!strcasecmp(arg, "yes")) {
@@ -3354,16 +3859,11 @@
 return "The argument needs to be either 'yes' or 'no'";
 }
 return NULL; /* OK */
- case CMD_END:
- break;
- case CMD_DUP:
- section->option.verify_peer=new_service_options.option.verify_peer;
- break;
- case CMD_FREE:
+ case CMD_INITIALIZE:
 break;
- case CMD_DEFAULT:
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 s_log(LOG_NOTICE, "%-22s = yes|no verify peer certificate",
 "verifyPeer");
 break;
@@ -3371,13 +3871,26 @@
 
 /* final checks */
 switch(cmd) {
- case CMD_BEGIN:
- section->ref=1;
+ case CMD_SET_DEFAULTS:
+ break;
+ case CMD_SET_COPY:
 break;
- case CMD_EXEC:
+ case CMD_FREE:
+ str_free(section->chain);
+ if(section->session)
+ SSL_SESSION_free(section->session);
+ if(section->ctx)
+ SSL_CTX_free(section->ctx);
+ str_free(section->servname);
+ if(section==&service_options || section==&new_service_options)
+ memset(section, 0, sizeof(SERVICE_OPTIONS));
+ else
+ str_free(section);
+ break;
+ case CMD_SET_VALUE:
 return option_not_found;
- case CMD_END:
- if(new_service_options.next) { /* daemon mode checks */
+ case CMD_INITIALIZE:
+ if(section!=&new_service_options) { /* daemon mode checks */
 if(endpoints!=2)
 return "Each service must define two endpoints";
 } else { /* inetd mode checks */
@@ -3388,27 +3901,23 @@
 if(endpoints!=1)
 return "Inetd mode must define one endpoint";
 }
+#ifdef SSL_OP_NO_TICKET
+ /* disable RFC4507 support introduced in OpenSSL 0.9.8f */
+ /* OpenSSL 1.1.1 is required to serialize application data
+ * into session tickets */
+ /* server mode sections need it for the "redirect" option
+ * and connect address session persistence */
+ if(OpenSSL_version_num()<0x10101000L &&
+ !section->option.client &&
+ !section->option.connect_before_ssl)
+ section->ssl_options_set|=SSL_OP_NO_TICKET;
+#endif /* SSL_OP_NO_TICKET */
 if(context_init(section)) /* initialize TLS context */
 return "Failed to initialize TLS context";
 break;
- case CMD_DUP:
- section->ref=1;
+ case CMD_PRINT_DEFAULTS:
 break;
- case CMD_FREE:
- str_free(section->chain);
- if(section->session)
- SSL_SESSION_free(section->session);
- if(section->ctx)
- SSL_CTX_free(section->ctx);
- str_free(section->servname);
- if(section==&service_options)
- memset(section, 0, sizeof(SERVICE_OPTIONS));
- else
- str_free(section);
- break;
- case CMD_DEFAULT:
- break;
- case CMD_HELP:
+ case CMD_PRINT_HELP:
 break;
 }
 
@@ -3419,7 +3928,7 @@
 
 #ifndef OPENSSL_NO_TLSEXT
 
-NOEXPORT char *sni_init(SERVICE_OPTIONS *section) {
+NOEXPORT const char *sni_init(SERVICE_OPTIONS *section) {
 char *tmp_str;
 SERVICE_OPTIONS *tmpsrv;
 
@@ -3435,7 +3944,7 @@
 if(!tmpsrv)
 return "SNI section name not found";
 if(tmpsrv->option.client)
- return "SNI master service is a TLS client";
+ return "SNI primary service is a TLS client";
 if(tmpsrv->servername_list_tail) {
 tmpsrv->servername_list_tail->next=str_alloc_detached(sizeof(SERVERNAME_LIST));
 tmpsrv->servername_list_tail=tmpsrv->servername_list_tail->next;
@@ -3446,7 +3955,7 @@
 tmpsrv->ssl_options_set|=
 SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION;
 }
- /* a slave section reference is needed to prevent a race condition
+ /* a secondary section reference is needed to prevent a race condition
 while switching to a section after configuration file reload */
 service_up_ref(section);
 tmpsrv->servername_list_tail->servername=str_dup_detached(tmp_str);
@@ -3483,7 +3992,7 @@
 while(curr) {
 SERVERNAME_LIST *next=curr->next;
 str_free(curr->servername);
- service_free(curr->opt); /* free the slave section */
+ service_free(curr->opt); /* free the secondary section */
 str_free(curr);
 curr=next;
 }
@@ -3493,7 +4002,31 @@
 
 #endif /* !defined(OPENSSL_NO_TLSEXT) */
 
-/**************************************** (deprecated) TLS methods */
+/**************************************** modern TLS version handling */
+
+#if OPENSSL_VERSION_NUMBER>=0x10100000L
+
+NOEXPORT int str_to_proto_version(const char *name) {
+ if(!strcasecmp(name, "all"))
+ return 0;
+ if(!strcasecmp(name, "SSLv3"))
+ return SSL3_VERSION;
+ if(!strcasecmp(name, "TLSv1"))
+ return TLS1_VERSION;
+ if(!strcasecmp(name, "TLSv1.1"))
+ return TLS1_1_VERSION;
+ if(!strcasecmp(name, "TLSv1.2"))
+ return TLS1_2_VERSION;
+#ifdef TLS1_3_VERSION
+ if(!strcasecmp(name, "TLSv1.3"))
+ return TLS1_3_VERSION;
+#endif
+ return -1;
+}
+
+/**************************************** deprecated TLS version handling */
+
+#else /* OPENSSL_VERSION_NUMBER<0x10100000L */
 
 #ifdef __GNUC__
 #pragma GCC diagnostic push
@@ -3502,22 +4035,11 @@
 
 NOEXPORT char *tls_methods_set(SERVICE_OPTIONS *section, const char *arg) {
 if(!arg) { /* defaults */
-#if OPENSSL_VERSION_NUMBER>=0x10100000L
- section->client_method=(SSL_METHOD *)TLS_client_method();
- section->server_method=(SSL_METHOD *)TLS_server_method();
-#else
 section->client_method=(SSL_METHOD *)SSLv23_client_method();
 section->server_method=(SSL_METHOD *)SSLv23_server_method();
-#endif
 } else if(!strcasecmp(arg, "all")) {
-#if OPENSSL_VERSION_NUMBER>=0x10100000L
- section->client_method=(SSL_METHOD *)TLS_client_method();
- section->server_method=(SSL_METHOD *)TLS_server_method();
-#else
 section->client_method=(SSL_METHOD *)SSLv23_client_method();
 section->server_method=(SSL_METHOD *)SSLv23_server_method();
-#endif
-#if OPENSSL_API_COMPAT<0x10100000L
 } else if(!strcasecmp(arg, "SSLv2")) {
 #ifndef OPENSSL_NO_SSL2
 section->client_method=(SSL_METHOD *)SSLv2_client_method();
@@ -3553,14 +4075,12 @@
 #else /* OPENSSL_NO_TLS1_2 */
 return "TLSv1.2 not supported";
 #endif /* !OPENSSL_NO_TLS1_2 */
-#endif /* OPENSSL_API_COMPAT<0x10100000L */
 } else
 return "Incorrect version of TLS protocol";
 return NULL; /* OK */
 }
 
 NOEXPORT char *tls_methods_check(SERVICE_OPTIONS *section) {
- (void)section; /* squash the unused parameter warning */
 #ifdef USE_FIPS
 if(new_global_options.option.fips) {
 #ifndef OPENSSL_NO_SSL2
@@ -3576,6 +4096,8 @@
 return "\"sslVersion = SSLv3\" not supported in FIPS mode";
 #endif /* !OPENSSL_NO_SSL3 */
 }
+#else /* USE_FIPS */
+ (void)section; /* squash the unused parameter warning */
 #endif /* USE_FIPS */
 return NULL;
 }
@@ -3584,14 +4106,16 @@
 #pragma GCC diagnostic pop
 #endif /* __GNUC__ */
 
+#endif /* OPENSSL_VERSION_NUMBER<0x10100000L */
+
 /**************************************** facility/debug level */
 
 typedef struct {
- char *name;
+ const char *name;
 int value;
 } facilitylevel;
 
-NOEXPORT char *parse_debug_level(char *arg, SERVICE_OPTIONS *section) {
+NOEXPORT const char *parse_debug_level(char *arg, SERVICE_OPTIONS *section) {
 facilitylevel *fl;
 
 /* facilities only make sense on unix */
@@ -3665,20 +4189,20 @@
 /**************************************** TLS options */
 
 NOEXPORT long unsigned parse_ssl_option(char *arg) {
- SSL_OPTION *option;
+ const SSL_OPTION *option;
 
- for(option=(SSL_OPTION *)ssl_opts; option->name; ++option)
+ for(option=ssl_opts; option->name; ++option)
 if(!strcasecmp(option->name, arg))
 return option->value;
- return 0; /* FAILED */
+ return INVALID_SSL_OPTION; /* FAILED */
 }
 
 NOEXPORT void print_ssl_options(void) {
- SSL_OPTION *option;
+ const SSL_OPTION *option;
 
 s_log(LOG_NOTICE, " ");
 s_log(LOG_NOTICE, "Supported TLS options:");
- for(option=(SSL_OPTION *)ssl_opts; option->name; ++option)
+ for(option=ssl_opts; option->name; ++option)
 s_log(LOG_NOTICE, "options = %s", option->name);
 }
 
@@ -3688,8 +4212,9 @@
 
 NOEXPORT PSK_KEYS *psk_read(char *key_file) {
 DISK_FILE *df;
- char lineCONFLINELEN, *key_val;
- size_t key_len;
+ char lineCONFLINELEN, *key_str;
+ unsigned char *key_buf;
+ long key_len;
 PSK_KEYS *head=NULL, *tail=NULL, *curr;
 int line_number=0;
 
@@ -3704,8 +4229,8 @@
 ++line_number;
 if(!line0) /* empty line */
 continue;
- key_val=strchr(line, ':');
- if(!key_val) {
+ key_str=strchr(line, ':');
+ if(!key_str) {
 s_log(LOG_ERR,
 "PSKsecrets line %d: Not in identity:key format",
 line_number);
@@ -3713,8 +4238,7 @@
 psk_free(head);
 return NULL;
 }
- *key_val++='\0';
- key_len=strlen(key_val);
+ *key_str++='\0';
 if(strlen(line)+1>PSK_MAX_IDENTITY_LEN) { /* with the trailing '\0' */
 s_log(LOG_ERR,
 "PSKsecrets line %d: Identity longer than %d characters",
@@ -3723,27 +4247,44 @@
 psk_free(head);
 return NULL;
 }
+ key_buf=OPENSSL_hexstr2buf(key_str, &key_len);
+ if(key_buf) { /* a valid hexadecimal value */
+ s_log(LOG_INFO, "PSKsecrets line %d: "
+ "%ld-byte hexadecimal key configured for identity \"%s\"",
+ line_number, key_len, line);
+ } else { /* not a valid hexadecimal value -> copy as a string */
+ key_len=(long)strlen(key_str);
+ key_buf=OPENSSL_malloc((size_t)key_len);
+ memcpy(key_buf, key_str, (size_t)key_len);
+ s_log(LOG_INFO, "PSKsecrets line %d: "
+ "%ld-byte ASCII key configured for identity \"%s\"",
+ line_number, key_len, line);
+ }
 if(key_len>PSK_MAX_PSK_LEN) {
 s_log(LOG_ERR,
- "PSKsecrets line %d: Key longer than %d characters",
+ "PSKsecrets line %d: Key longer than %d bytes",
 line_number, PSK_MAX_PSK_LEN);
+ OPENSSL_free(key_buf);
 file_close(df);
 psk_free(head);
 return NULL;
 }
- if(key_len<20) {
+ if(key_len<16) {
 /* shorter keys are unlikely to have sufficient entropy */
 s_log(LOG_ERR,
- "PSKsecrets line %d: Key shorter than 20 characters",
+ "PSKsecrets line %d: Key shorter than 16 bytes",
 line_number);
+ OPENSSL_free(key_buf);
 file_close(df);
 psk_free(head);
 return NULL;
 }
 curr=str_alloc_detached(sizeof(PSK_KEYS));
 curr->identity=str_dup_detached(line);
- curr->key_val=(unsigned char *)str_dup_detached(key_val);
- curr->key_len=key_len;
+ curr->key_val=str_alloc_detached((size_t)key_len);
+ memcpy(curr->key_val, key_buf, (size_t)key_len);
+ OPENSSL_free(key_buf);
+ curr->key_len=(unsigned)key_len;
 curr->next=NULL;
 if(head)
 tail->next=curr;
@@ -3758,10 +4299,11 @@
 NOEXPORT PSK_KEYS *psk_dup(PSK_KEYS *src) {
 PSK_KEYS *head=NULL, *tail=NULL, *curr;
 
- while(src) {
+ for(; src; src=src->next) {
 curr=str_alloc_detached(sizeof(PSK_KEYS));
 curr->identity=str_dup_detached(src->identity);
- curr->key_val=(unsigned char *)str_dup_detached((char *)src->key_val);
+ curr->key_val=str_alloc_detached(src->key_len);
+ memcpy(curr->key_val, src->key_val, src->key_len);
 curr->key_len=src->key_len;
 curr->next=NULL;
 if(head)
@@ -3776,7 +4318,7 @@
 NOEXPORT void psk_free(PSK_KEYS *head) {
 while(head) {
 PSK_KEYS *next=head->next;
- str_free(head->identity);
+ str_free_const(head->identity);
 str_free(head->key_val);
 str_free(head);
 head=next;
@@ -3785,6 +4327,61 @@
 
 #endif
 
+/**************************************** read ticket key */
+
+#if OPENSSL_VERSION_NUMBER>=0x10000000L
+
+NOEXPORT TICKET_KEY *key_read(char *arg, const char *option) {
+ char *key_str;
+ unsigned char *key_buf;
+ long key_len;
+ TICKET_KEY *head=NULL;
+
+ key_str=str_dup_detached(arg);
+ key_buf=OPENSSL_hexstr2buf(key_str, &key_len);
+ if(key_buf)
+ if((key_len == 16) || (key_len == 32)) /* a valid 16 or 32 byte hexadecimal value */
+ s_log(LOG_INFO, "%s configured", option);
+ else { /* not a valid length */
+ s_log(LOG_ERR, "%s value has %ld bytes instead of required 16 or 32 bytes",
+ option, key_len);
+ OPENSSL_free(key_buf);
+ key_free(head);
+ return NULL;
+ }
+ else { /* not a valid hexadecimal form */
+ s_log(LOG_ERR, "Required %s is 16 or 32 byte hexadecimal key", option);
+ key_free(head);
+ return NULL;
+ }
+ head=str_alloc_detached(sizeof(TICKET_KEY));
+ head->key_val=str_alloc_detached((size_t)key_len);
+ memcpy(head->key_val, key_buf, (size_t)key_len);
+ OPENSSL_free(key_buf);
+ head->key_len=(int)key_len;
+ return head;
+}
+
+NOEXPORT TICKET_KEY *key_dup(TICKET_KEY *src) {
+ TICKET_KEY *head=NULL;
+
+ if (src) {
+ head=str_alloc_detached(sizeof(TICKET_KEY));
+ head->key_val=(unsigned char *)str_dup_detached((char *)src->key_val);
+ head->key_len=src->key_len;
+ }
+ return head;
+}
+
+NOEXPORT void key_free(TICKET_KEY *head) {
+ if (head) {
+ str_free(head->key_val);
+ str_free(head);
+ }
+}
+
+#endif /* OpenSSL 1.0.0 or later */
+
 /**************************************** socket options */
 
 #define VAL_TAB {NULL, NULL, NULL}
@@ -3862,6 +4459,9 @@
 memcpy(opt, sock_opts_def, sizeof sock_opts_def);
 
 #ifdef USE_WIN32
+#ifdef _MSC_VER
+#pragma warning(disable: 4996)
+#endif
 version=GetVersion();
 major=LOBYTE(LOWORD(version));
 minor=HIBYTE(LOWORD(version));
@@ -3877,7 +4477,7 @@
 return opt;
 }
 
-NOEXPORT void socket_option_set_int(SOCK_OPT *opt, char *name, int type, int value) {
+NOEXPORT void socket_option_set_int(SOCK_OPT *opt, const char *name, int type, int value) {
 for(; opt->opt_str; ++opt) {
 if(!strcmp(name, opt->opt_str)) {
 opt->opt_valtype=str_alloc_detached(sizeof(OPT_UNION));
@@ -3920,13 +4520,6 @@
 
 NOEXPORT int socket_options_print(void) {
 SOCK_OPT *opt, *ptr;
- SOCKET fd;
- socklen_t optlen;
- OPT_UNION val;
- char *ta, *tl, *tr, *td;
-
- fd=socket(AF_INET, SOCK_STREAM, 0);
- opt=socket_options_init();
 
 s_log(LOG_NOTICE, " ");
 s_log(LOG_NOTICE, "Socket option defaults:");
@@ -3934,8 +4527,21 @@
 " Option Name | Accept | Local | Remote |OS default");
 s_log(LOG_NOTICE,
 " --------------------+----------+----------+----------+----------");
+
+ opt=socket_options_init();
 for(ptr=opt; ptr->opt_str; ++ptr) {
+ SOCKET fd;
+ socklen_t optlen;
+ OPT_UNION val;
+ char *ta, *tl, *tr, *td;
+
 /* get OS default value */
+#if defined(AF_INET6) && defined(IPPROTO_IPV6)
+ if(ptr->opt_level==IPPROTO_IPV6)
+ fd=socket(AF_INET6, SOCK_STREAM, 0);
+ else
+#endif
+ fd=socket(AF_INET, SOCK_STREAM, 0);
 optlen=sizeof val;
 if(getsockopt(fd, ptr->opt_level,
 ptr->opt_name, (void *)&val, &optlen)) {
@@ -3952,17 +4558,19 @@
 }
 } else
 td=socket_option_text(ptr->opt_type, &val);
+ closesocket(fd);
+
 /* get stunnel default values */
 ta=socket_option_text(ptr->opt_type, ptr->opt_val0);
 tl=socket_option_text(ptr->opt_type, ptr->opt_val1);
 tr=socket_option_text(ptr->opt_type, ptr->opt_val2);
- /* print collected data and fee the memory */
+
+ /* print collected data and free the allocated memory */
 s_log(LOG_NOTICE, " %-20s|%10s|%10s|%10s|%10s",
 ptr->opt_str, ta, tl, tr, td);
 str_free(ta); str_free(tl); str_free(tr); str_free(td);
 }
 socket_options_free(opt);
- closesocket(fd);
 return 0; /* OK */
 }
 
@@ -4084,7 +4692,7 @@
 
 NOEXPORT unsigned long parse_ocsp_flag(char *arg) {
 struct {
- char *name;
+ const char *name;
 unsigned long value;
 } ocsp_opts = {
 {"NOCERTS", OCSP_NOCERTS},
@@ -4124,7 +4732,7 @@
 engine_initialized=1;
 }
 
-NOEXPORT char *engine_auto(void) {
+NOEXPORT const char *engine_auto(void) {
 ENGINE *e;
 
 s_log(LOG_INFO, "Enabling automatic engine support");
@@ -4142,30 +4750,48 @@
 return NULL; /* OK */
 }
 
-NOEXPORT char *engine_open(const char *name) {
+NOEXPORT const char *engine_open(const char *name) {
+ ENGINE *e;
+ struct {
+ void (*vlog)(int, const char *, va_list);
+ } vlog_callback;
+
 engine_init(); /* initialize the previous engine (if any) */
 if(++current_engine>=MAX_ENGINES)
 return "Too many open engines";
+
 s_log(LOG_DEBUG, "Enabling support for engine \"%s\"", name);
- enginescurrent_engine=ENGINE_by_id(name);
- if(!enginescurrent_engine) {
+ e=ENGINE_by_id(name);
+ if(!e) {
 sslerror("ENGINE_by_id");
 return "Failed to open the engine";
 }
 engine_initialized=0;
- if(ENGINE_ctrl(enginescurrent_engine, ENGINE_CTRL_SET_USER_INTERFACE,
- 0, UI_stunnel(), NULL)) {
+
+ vlog_callback.vlog=&s_vlog;
+ if(ENGINE_ctrl_cmd(e, "VLOG_A", 0, &vlog_callback, NULL, 0)) {
+ s_log(LOG_NOTICE, "Logging initialized on engine #%d (%s)",
+ current_engine+1, ENGINE_get_id(e));
+ } else {
+ ERR_clear_error();
+ s_log(LOG_INFO, "Logging not supported by engine #%d (%s)",
+ current_engine+1, ENGINE_get_id(e));
+ }
+
+ if(ENGINE_ctrl(e, ENGINE_CTRL_SET_USER_INTERFACE, 0, ui_stunnel(), NULL)) {
 s_log(LOG_NOTICE, "UI set for engine #%d (%s)",
- current_engine+1, ENGINE_get_id(enginescurrent_engine));
+ current_engine+1, ENGINE_get_id(e));
 } else {
 ERR_clear_error();
 s_log(LOG_INFO, "UI not supported by engine #%d (%s)",
- current_engine+1, ENGINE_get_id(enginescurrent_engine));
+ current_engine+1, ENGINE_get_id(e));
 }
+
+ enginescurrent_engine=e;
 return NULL; /* OK */
 }
 
-NOEXPORT char *engine_ctrl(const char *cmd, const char *arg) {
+NOEXPORT const char *engine_ctrl(const char *cmd, const char *arg) {
 if(current_engine<0)
 return "No engine was defined";
 if(!strcasecmp(cmd, "INIT")) /* special control command */
@@ -4181,7 +4807,7 @@
 return NULL; /* OK */
 }
 
-NOEXPORT char *engine_default(const char *list) {
+NOEXPORT const char *engine_default(const char *list) {
 if(current_engine<0)
 return "No engine was defined";
 if(!ENGINE_set_default_string(enginescurrent_engine, list)) {
@@ -4193,7 +4819,7 @@
 return NULL;
 }
 
-NOEXPORT char *engine_init(void) {
+NOEXPORT const char *engine_init(void) {
 if(engine_initialized) /* either first or already initialized */
 return NULL; /* OK */
 s_log(LOG_DEBUG, "Initializing engine #%d (%s)",
@@ -4214,13 +4840,6 @@
 return "Selecting default engine failed";
 }
 #endif
- /* engines can add new algorithms */
-#if OPENSSL_VERSION_NUMBER>=0x10100000L
- OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS|
- OPENSSL_INIT_ADD_ALL_DIGESTS, NULL);
-#else
- OpenSSL_add_all_algorithms();
-#endif
 
 s_log(LOG_INFO, "Engine #%d (%s) initialized",
 current_engine+1, ENGINE_get_id(enginescurrent_engine));
@@ -4245,6 +4864,41 @@
 
 #endif /* !defined(OPENSSL_NO_ENGINE) */
 
+/**************************************** include config directory */
+
+NOEXPORT const char *include_config(char *directory, SERVICE_OPTIONS **section_ptr) {
+ struct dirent **namelist;
+ int i, num, err=0;
+
+ num=scandir(directory, &namelist, NULL, alphasort);
+ if(num<0) {
+ ioerror("scandir");
+ return "Failed to include directory";
+ }
+ for(i=0; i<num; ++i) {
+ if(!err) {
+ struct stat sb;
+ char *name=str_printf(
+#ifdef USE_WIN32
+ "%s\\%s",
+#else
+ "%s/%s",
+#endif
+ directory, namelisti->d_name);
+ if(!stat(name, &sb) && S_ISREG(sb.st_mode))
+ err=options_file(name, CONF_FILE, section_ptr);
+ else
+ s_log(LOG_DEBUG, "\"%s\" is not a file", name);
+ str_free(name);
+ }
+ free(namelisti);
+ }
+ free(namelist);
+ if(err)
+ return "Failed to include a file";
+ return NULL;
+}
+
 /**************************************** fatal error */
 
 NOEXPORT void print_syntax(void) {

_service:tar_scm:stunnel-5.48.tar.gz/src/os2.mak -> _service:tar_scm:stunnel-5.69.tar.gz/src/os2.mak Changed

_service:tar_scm:stunnel-5.48.tar.gz/src/protocol.c -> _service:tar_scm:stunnel-5.69.tar.gz/src/protocol.c Changed

@@ -1,6 +1,6 @@
 /*
 * stunnel TLS offloading and load-balancing proxy
- * Copyright (C) 1998-2018 Michal Trojnara <Michal.Trojnara@stunnel.org>
+ * Copyright (C) 1998-2023 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
@@ -35,10 +35,9 @@
 * forward this exception.
 */
 
-#include "common.h"
 #include "prototypes.h"
 
-#define is_prefix(a, b) (strncasecmp((a), (b), strlen(b))==0)
+#define CAPWIN_BUFFER_SIZE 100
 
 /* protocol-specific function prototypes */
 NOEXPORT char *socks_client(CLI *, SERVICE_OPTIONS *, const PHASE);
@@ -64,19 +63,30 @@
 NOEXPORT char *imap_client(CLI *, SERVICE_OPTIONS *, const PHASE);
 NOEXPORT char *imap_server(CLI *, SERVICE_OPTIONS *, const PHASE);
 NOEXPORT char *nntp_client(CLI *, SERVICE_OPTIONS *, const PHASE);
+NOEXPORT char *ldap_client(CLI *, SERVICE_OPTIONS *, const PHASE);
 NOEXPORT char *connect_server(CLI *, SERVICE_OPTIONS *, const PHASE);
 NOEXPORT char *connect_client(CLI *, SERVICE_OPTIONS *, const PHASE);
 #ifndef OPENSSL_NO_MD4
 NOEXPORT void ntlm(CLI *, SERVICE_OPTIONS *);
-NOEXPORT char *ntlm1();
+NOEXPORT char *ntlm1(void);
 NOEXPORT char *ntlm3(char *, char *, char *, char *);
-NOEXPORT void crypt_DES(DES_cblock, DES_cblock, DES_cblock);
+NOEXPORT void crypt_DES(DES_cblock, DES_cblock, unsigned char7);
 #endif
 NOEXPORT char *base64(int, const char *, int);
+NOEXPORT char *capwin_server(CLI *, SERVICE_OPTIONS *, const PHASE);
+NOEXPORT char *capwin_client(CLI *, SERVICE_OPTIONS *, const PHASE);
+NOEXPORT char *capwinctrl_client(CLI *, SERVICE_OPTIONS *, const PHASE);
+
+/* global state */
+NOEXPORT char capwin_authCAPWIN_BUFFER_SIZE={0};
+#ifdef USE_WIN32
+HWND capwin_hwnd=NULL;
+LONG capwin_connectivity=0;
+#endif
 
 /**************************************** framework */
 
-char *protocol(CLI *c, SERVICE_OPTIONS *opt, const PHASE phase) {
+const char *protocol(CLI *c, SERVICE_OPTIONS *opt, const PHASE phase) {
 if(phase==PROTOCOL_CHECK) /* default to be overridden by protocols */
 opt->option.connect_before_ssl=opt->option.client;
 if(!opt->protocol) /* no protocol specified */
@@ -113,10 +123,22 @@
 return opt->option.client ?
 nntp_client(c, opt, phase) :
 "The 'nntp' protocol is not supported in the server mode";
+ if(!strcasecmp(opt->protocol, "ldap"))
+ return opt->option.client ?
+ ldap_client(c, opt, phase) :
+ "The 'ldap' protocol is not supported in the server mode";
 if(!strcasecmp(opt->protocol, "connect"))
 return opt->option.client ?
 connect_client(c, opt, phase) :
 connect_server(c, opt, phase);
+ if(!strcasecmp(opt->protocol, "capwin"))
+ return opt->option.client ?
+ capwin_client(c, opt, phase) :
+ capwin_server(c, opt, phase);
+ if(!strcasecmp(opt->protocol, "capwinctrl"))
+ return opt->option.client ?
+ capwinctrl_client(c, opt, phase) :
+ "The 'capwinctrl' protocol is not supported in the server mode";
 return "Protocol not supported";
 }
 
@@ -565,7 +587,8 @@
 SOCKADDR_UNION addr;
 socklen_t addrlen;
 char src_hostIP_LEN, dst_hostIP_LEN;
- char src_portPORT_LEN, dst_portPORT_LEN, *proto;
+ char src_portPORT_LEN, dst_portPORT_LEN;
+ const char *proto;
 int err;
 
 (void)opt; /* squash the unused parameter warning */
@@ -647,7 +670,7 @@
 (void)opt; /* squash the unused parameter warning */
 if(phase!=PROTOCOL_EARLY)
 return NULL;
- s_read(c, c->local_rfd.fd, buffer, 4) ;/* NetBIOS header */
+ s_read(c, c->local_rfd.fd, buffer, 4); /* NetBIOS header */
 len=(uint16_t)(((uint16_t)(buffer2)<<8)|buffer3);
 if(len>sizeof buffer-4) {
 s_log(LOG_ERR, "Received block too long");
@@ -686,17 +709,31 @@
 
 NOEXPORT char *pgsql_server(CLI *c, SERVICE_OPTIONS *opt, const PHASE phase) {
 uint8_t buffer8, ssl_ok1={'S'};
+ /* https://www.postgresql.org/docs/current/protocol-message-formats.html */
+ static const uint8_t gss_request8={0, 0, 0, 8, 0x04, 0xd2, 0x16, 0x30};
+ static const uint8_t gss_response62=
+ {'E', 0, 0, 0, 61, 'S', 'E', 'R', 'R', 'O', 'R', 0, 'C', 'X', 'X', '0',
+ '0', '0', 0, 'M', 'S', 'S', 'L', ' ', 'e', 'x', 'p', 'e', 'c', 't', 'e', 'd',
+ ' ', 'b', 'u', 't', ' ', 'n', 'o', 't', ' ', 'r', 'e', 'q', 'u', 'e', 's', 't',
+ 'e', 'd', ' ', 'b', 'y', ' ', 'c', 'l', 'i', 'e', 'n', 't', 0, 0};
 
 (void)opt; /* squash the unused parameter warning */
 if(phase!=PROTOCOL_EARLY)
 return NULL;
+ s_log(LOG_DEBUG, "Started server-side psql protocol negotiation");
 memset(buffer, 0, sizeof buffer);
 s_read(c, c->local_rfd.fd, buffer, sizeof buffer);
+ if(!safe_memcmp(buffer, gss_request, sizeof gss_request)) {
+ s_log(LOG_INFO, "GSSAPI encryption requested, rejecting gracefully");
+ s_write(c, c->local_wfd.fd, gss_response, sizeof gss_response);
+ throw_exception(c, 2); /* don't reset */
+ }
 if(safe_memcmp(buffer, ssl_request, sizeof ssl_request)) {
 s_log(LOG_ERR, "PostgreSQL client did not request TLS, rejecting");
 /* no way to send error on startup, so just drop the client */
 throw_exception(c, 1);
 }
+ s_log(LOG_DEBUG, "SSLRequest received");
 s_write(c, c->local_wfd.fd, ssl_ok, sizeof ssl_ok);
 return NULL;
 }
@@ -711,6 +748,14 @@
 break;
 case PROTOCOL_LATE:
 if(opt->protocol_username && opt->protocol_password) {
+ char *line;
+
+ if(opt->protocol_host)
+ ssl_printf(c, "HELO %s", opt->protocol_host);
+ else
+ ssl_putline(c, "HELO localhost");
+ line=ssl_getline(c); /* ignore the reply */
+ str_free(line);
 if(!strcasecmp(c->opt->protocol_authentication, "LOGIN"))
 smtp_client_login(c,
 opt->protocol_username, opt->protocol_password);
@@ -735,7 +780,10 @@
 fd_putline(c, c->local_wfd.fd, line);
 } while(is_prefix(line, "220-"));
 
- fd_putline(c, c->remote_fd.fd, "EHLO localhost");
+ if(c->opt->protocol_host)
+ fd_printf(c, c->remote_fd.fd, "EHLO %s", c->opt->protocol_host);
+ else
+ fd_putline(c, c->remote_fd.fd, "EHLO localhost");
 do { /* skip multiline reply */
 str_free(line);
 line=fd_getline(c, c->remote_fd.fd);
@@ -838,7 +886,7 @@
 return NULL;
 
 /* detect RFC 2487 */
- s_poll_init(c->fds);
+ s_poll_init(c->fds, 0);
 s_poll_add(c->fds, c->local_rfd.fd, 1, 0);
 switch(s_poll_wait(c->fds, 0, 200)) { /* wait up to 200ms */
 case 0: /* fd not ready to read */
@@ -971,9 +1019,9 @@
 str_free(line);
 throw_exception(c, 1);
 }
- fd_putline(c, c->local_wfd.fd, line);
- fd_putline(c, c->remote_fd.fd, "stunnel STARTTLS");
 str_free(line);
+ fd_putline(c, c->local_wfd.fd, "* OK Connected.");
+ fd_putline(c, c->remote_fd.fd, "stunnel STARTTLS");
 line=fd_getline(c, c->remote_fd.fd);
 if(!is_prefix(line, "stunnel OK")) {
 fd_putline(c, c->local_wfd.fd,
@@ -993,7 +1041,7 @@
 opt->option.connect_before_ssl=1; /* c->remote_fd needed */
 if(phase!=PROTOCOL_MIDDLE)
 return NULL;
- s_poll_init(c->fds);
+ s_poll_init(c->fds, 0);
 s_poll_add(c->fds, c->local_rfd.fd, 1, 0);
 switch(s_poll_wait(c->fds, 0, 200)) {
 case 0: /* fd not ready to read */
@@ -1114,6 +1162,132 @@
 return NULL;
 }
 
+/**************************************** LDAP, RFC 2830 */
+
+uint8_t ldap_starttls_message0x1d + 2 = {
+ 0x30, /* tag = UNIVERSAL SEQUENCE */
+ 0x1d, /* len = 29 */
+ 0x02, /* tag = INTEGER (messageID) */
+ 0x01, /* len = 1 */
+ 0x01, /* val = 1 (this is messageID 1) */
+ 0x77, /* tag = APPLICATION 23 (ExtendedRequest)
+ * 0b01xxxxxx => Class = Application
+ * 0bxx1xxxxx => P/C = Constructed
+ * 0bxxx10111 => Number = 23 */
+ 0x18, /* len = 24 */
+ 0x80, /* tag = CONTEXT-SPECIFIC 0 (requestName) */
+ 0x16, /* len = 22 */
+ /* val = LDAP_START_TLS_OID
+ * OID: 1.3.6.1.4.1.1466.20037 */
+ '1', '.',
+ '3', '.',
+ '6', '.',
+ '1', '.',
+ '4', '.',
+ '1', '.',
+ '1', '4', '6', '6', '.',
+ '2', '0', '0', '3', '7'
+ /* no requestValue, as per RFC2830
+ * (section 2.1: "The requestValue field is absent") */
+};
+
+#define LDAP_UNIVERSAL_SEQUENCE 0x30
+#define LDAP_WINLDAP_FOUR_BYTE_LEN_FLAG 0x84
+#define LDAP_RESPONSE_MSG_ID_TAG_INTEGER 0x02
+#define LDAP_RESPONSE_MSG_ID_LEN 0x01
+#define LDAP_RESPONSE_MSG_ID_VAL 0x01
+#define LDAP_RESPONSE_OP_APPLICATION_24 0x78
+#define LDAP_RESPONSE_RESULT_TAG_ENUMERATED 0x0a
+#define LDAP_RESPONSE_RESULT_LEN 0x01
+#define LDAP_RESPONSE_RESULT_VAL_SUCCESS 0x00
+
+/* also see:
+ * https://ldap.com/ldapv3-wire-protocol-reference-extended/
+ */
+
+NOEXPORT char *ldap_client(CLI *c, SERVICE_OPTIONS *opt, const PHASE phase) {
+ uint8_t buffer_8;
+ uint32_t buffer_32;
+ size_t resp_len;
+ uint8_t ldap_response128;
+ size_t resp_idx;
+
+ (void)opt; /* squash the unused parameter warning */
+
+ if(phase!=PROTOCOL_MIDDLE)
+ return NULL;
+
+ s_log(LOG_DEBUG, "Sending LDAP Start TLS request");
+ s_write(c, c->remote_fd.fd, ldap_starttls_message, sizeof(ldap_starttls_message));
+
+ s_log(LOG_DEBUG, "Receiving LDAP response tag");
+ s_read(c, c->remote_fd.fd, &buffer_8, 1);
+ if(buffer_8!=LDAP_UNIVERSAL_SEQUENCE) {
+ s_log(LOG_ERR, "LDAP response is not UNIVERSAL SEQUENCE");
+ throw_exception(c, 1);
+ }
+
+ s_log(LOG_DEBUG, "Receiving LDAP response length");
+ s_read(c, c->remote_fd.fd, &buffer_8, 1);
+ if(buffer_8==LDAP_WINLDAP_FOUR_BYTE_LEN_FLAG) { /* WinLDAP */
+ /* receive response length (4 bytes, network byte order) */
+ s_read(c, c->remote_fd.fd, &buffer_32, 4);
+ resp_len=ntohl(buffer_32);
+ } else {
+ resp_len=buffer_8;
+ }
+ if(resp_len>sizeof(ldap_response)) {
+ s_log(LOG_ERR, "LDAP response too long (%lu byte(s))",
+ (unsigned long)resp_len);
+ throw_exception(c, 1);
+ }
+
+ s_log(LOG_DEBUG, "Receiving LDAP response value (%lu byte(s))",
+ (unsigned long)resp_len);
+ memset(ldap_response, 0, sizeof(ldap_response)); /* prevent data leaks */
+ s_read(c, c->remote_fd.fd, ldap_response, resp_len);
+
+ s_log(LOG_DEBUG, "Decoding LDAP response value");
+ resp_idx=0;
+ if(ldap_responseresp_idx++!=LDAP_RESPONSE_MSG_ID_TAG_INTEGER) {
+ s_log(LOG_ERR, "LDAP response has an incorrect message ID type");
+ throw_exception(c, 1);
+ }
+ if(ldap_responseresp_idx++!=LDAP_RESPONSE_MSG_ID_LEN) {
+ s_log(LOG_ERR, "LDAP response has an unexpected message ID length");
+ throw_exception(c, 1);
+ }
+ if(ldap_responseresp_idx++!=LDAP_RESPONSE_MSG_ID_VAL) {
+ s_log(LOG_ERR, "LDAP response has an unexpected message ID value");
+ throw_exception(c, 1);
+ }
+ if(ldap_responseresp_idx++!=LDAP_RESPONSE_OP_APPLICATION_24) {
+ s_log(LOG_ERR, "LDAP response protocol op is not ExtendedResponse");
+ throw_exception(c, 1);
+ }
+ /* we do not validate the protocol op sequence length */
+ if(ldap_responseresp_idx++==LDAP_WINLDAP_FOUR_BYTE_LEN_FLAG) { /* WinLDAP */
+ resp_idx+=4; /* skip next 4 bytes */
+ }
+ if(ldap_responseresp_idx++!=LDAP_RESPONSE_RESULT_TAG_ENUMERATED) {
+ s_log(LOG_ERR, "LDAP response has an unexpected result code type");
+ throw_exception(c, 1);
+ }
+ if(ldap_responseresp_idx++!=LDAP_RESPONSE_RESULT_LEN) {
+ s_log(LOG_ERR, "LDAP response has an unexpected result code length");
+ throw_exception(c, 1);
+ }
+ if(ldap_responseresp_idx!=LDAP_RESPONSE_RESULT_VAL_SUCCESS) {
+ s_log(LOG_ERR, "LDAP response has indicated an error (%u)",
+ ldap_responseresp_idx);
+ throw_exception(c, 1);
+ }
+ /* any remaining data is ignored */
+
+ s_log(LOG_INFO, "LDAP Start TLS successfully negotiated");
+ return NULL;
+}
+
 /**************************************** connect */
 
 NOEXPORT char *connect_server(CLI *c, SERVICE_OPTIONS *opt, const PHASE phase) {
@@ -1163,9 +1337,11 @@
 
 NOEXPORT char *connect_client(CLI *c, SERVICE_OPTIONS *opt, const PHASE phase) {
 char *line, *encoded;
+ NAME_LIST *ptr;
 
 if(phase!=PROTOCOL_MIDDLE)
 return NULL;
+
 if(!opt->protocol_host) {
 s_log(LOG_ERR, "protocolHost not specified");
 throw_exception(c, 1);
@@ -1195,7 +1371,10 @@
 str_free(encoded);
 }
 }
+ for(ptr=opt->protocol_header; ptr; ptr=ptr->next)
+ fd_putline(c, c->remote_fd.fd, ptr->name); /* custom header */
 fd_putline(c, c->remote_fd.fd, ""); /* empty line */
+
 line=fd_getline(c, c->remote_fd.fd);
 if(!is_prefix(line, "HTTP/1.0 2") && !is_prefix(line, "HTTP/1.1 2")) {
 /* not "HTTP/1.x 2xx Connection established" */
@@ -1413,7 +1592,7 @@
 BIO_set_flags(b64, BIO_FLAGS_BASE64_NO_NL);
 bio=BIO_new(BIO_s_mem());
 if(!bio) {
- str_free(b64);
+ BIO_free(b64);
 return NULL;
 }
 if(encode)
@@ -1440,4 +1619,251 @@
 return out;
 }
 
+/**************************************** capwin authentication support */
+
+NOEXPORT int capwin_decode(const char *src,
+ char **cmd, char **user, char **pass, char **ctrl) {
+ char *us1, *us2, *us3, *fs;
+
+ us1=strchr(src, '\x1f');
+ if(!us1) {
+ s_log(LOG_ERR, "CapWIN: Malformed credentials (1)");
+ return 1; /* FAILED */
+ }
+ us2=strchr(us1 + 1, '\x1f');
+ if(!us2) {
+ s_log(LOG_ERR, "CapWIN: Malformed credentials (2)");
+ return 1; /* FAILED */
+ }
+ us3=strchr(us2 + 1, '\x1f');
+ if(!us3) {
+ s_log(LOG_ERR, "CapWIN: Malformed credentials (3)");
+ return 1; /* FAILED */
+ }
+ fs=strchr(us3 + 1, '\x1c');
+ if(!fs) {
+ s_log(LOG_ERR, "CapWIN: Malformed credentials (4)");
+ return 1; /* FAILED */
+ }
+ if(cmd) {
+ size_t len=(size_t)(us1 - src);
+ *cmd=str_alloc(len + 1);
+ memcpy(*cmd, src, len);
+ }
+ if(user) {
+ size_t len=(size_t)(us2 - us1) - 1;
+ *user=str_alloc(len + 1);
+ memcpy(*user, us1 + 1, len);
+ }
+ if(pass) {
+ size_t len=(size_t)(us3 - us2) - 1;
+ *pass=str_alloc(len + 1);
+ memcpy(*pass, us2 + 1, len);
+ }
+ if(ctrl) {
+ size_t len=(size_t)(fs - us3) - 1;
+ *ctrl=str_alloc(len + 1);
+ memcpy(*ctrl, us3 + 1, len);
+ }
+ return 0; /* SUCCESS */
+}
+
+NOEXPORT int ldap_auth(CLI *c, const char *dn, const char *pass) {
+ size_t dn_len, pass_len, req_len;
+ SOCKADDR_UNION addr;
+ int i;
+ unsigned char *req, resp22;
+ const unsigned char resp_ok22=
+ {0x30, 0x84, 0x00, 0x00, 0x00, 0x10, 0x02, 0x01,
+ 0x01, 0x61, 0x84, 0x00, 0x00, 0x00, 0x07, 0x0a,
+ 0x01, 0x00, 0x04, 0x00, 0x04, 0x00};
+
+ /* reject parameters too long for simple encoding */
+ dn_len=strlen(dn);
+ pass_len=strlen(pass);
+ req_len=dn_len + pass_len + 14;
+ if(req_len > 120) {
+ s_log(LOG_ERR, "LDAP: Request too long");
+ return 1; /* FAILED */
+ }
+
+ /* connect the configured LDAP server */
+ if(!name2addr(&addr, c->opt->protocol_host, 0)) {
+ s_log(LOG_ERR, "LDAP: Failed to resolve protocolHost");
+ return 1; /* FAILED */
+ }
+ c->fd=s_socket(addr.sa.sa_family, SOCK_STREAM, 0, 1, "LDAP socket");
+ if(c->fd==INVALID_SOCKET)
+ return 1; /* FAILED */
+ s_log(LOG_DEBUG, "LDAP: Connecting the server");
+ if(s_connect(c, &addr, addr_len(&addr))) {
+ closesocket(c->fd);
+ c->fd=INVALID_SOCKET; /* avoid double close on cleanup */
+ return 1; /* FAILED */
+ }
+
+ /* send BindRequest */
+ req=str_alloc(req_len);
+ i=0;
+ reqi++=0x30; /* SEQUENCE */
+ reqi++=(unsigned char)(dn_len + pass_len + 12);
+ reqi++=0x02; /* INTEGER */
+ reqi++=0x01; /* length */
+ reqi++=0x01; /* MessageID */
+ reqi++=0x60; /* APPLICATION 0: BindRequest */
+ reqi++=(unsigned char)(dn_len + pass_len + 7);
+ reqi++=0x02; /* INTEGER */
+ reqi++=0x01; /* length */
+ reqi++=0x03; /* LDAP protocol version */
+ reqi++=0x04; /* OCTET STRING */
+ reqi++=(unsigned char)dn_len;
+ memcpy(req + i, dn, dn_len);
+ i+=(int)dn_len;
+ reqi++=0x80; /* IMPLICIT 0: simple authentication */
+ reqi++=(unsigned char)pass_len;
+ memcpy(req + i, pass, pass_len);
+ s_log(LOG_DEBUG, "LDAP: Sending BindRequest");
+ s_write(c, c->fd, req, req_len);
+ str_free(req);
+
+ /* receive BindResponse */
+ s_log(LOG_DEBUG, "LDAP: Waiting for BindResponse");
+ s_read(c, c->fd, resp, sizeof resp);
+ closesocket(c->fd);
+ c->fd=INVALID_SOCKET; /* avoid double close on cleanup */
+ return memcmp(resp, resp_ok, sizeof resp);
+}
+
+NOEXPORT char *ldap_escape_dn(const char *src) {
+ int i=0, j=0;
+ char *dst=str_alloc(2 * strlen(src) + 1);
+
+ while(srci) {
+ if(strchr("+;,\\\"<>#", srci))
+ dstj++='\\';
+ dstj++=srci++;
+ }
+ return dst;
+}
+
+NOEXPORT char *capwin_server(CLI *c, SERVICE_OPTIONS *opt, const PHASE phase) {
+ char *buffer, *user, *pass, *esc_user, *dn;
+ const char *success="BINGO", *failure="FAILED";
+ int i;
+
+ (void)opt; /* squash the unused parameter warning */
+ switch(phase) {
+ case PROTOCOL_MIDDLE: /* TLS is established */
+ buffer=str_alloc(CAPWIN_BUFFER_SIZE);
+ for(i=0; i<CAPWIN_BUFFER_SIZE - 1; ++i) {
+ s_ssl_read(c, buffer+i, 1);
+ if(bufferi == '\x1c')
+ break;
+ }
+ if(capwin_decode(buffer, NULL, &user, &pass, NULL)) {
+ /* malformed request: reset instead of sending "FAILED" */
+ str_free(buffer);
+ throw_exception(c, 1);
+ }
+ str_free(buffer);
+ esc_user=ldap_escape_dn(user);
+ str_free(user);
+ dn=str_printf("uid=%s,ou=people,O=CAPWIN,C=US", esc_user);
+ str_free(esc_user);
+ if(ldap_auth(c, dn, pass)) {
+ str_free(dn);
+ str_free(pass);
+ s_log(LOG_ERR, "CapWIN: Authentication failed");
+ s_ssl_write(c, failure, (int)strlen(failure));
+ throw_exception(c, 2); /* don't reset */
+ }
+ str_free(dn);
+ str_free(pass);
+ s_log(LOG_NOTICE, "CapWIN: Authentication succeeded");
+ break;
+ case PROTOCOL_LATE: /* remote host is connected */
+ s_ssl_write(c, success, (int)strlen(success));
+ break;
+ default:
+ break;
+ }
+ return NULL;
+}
+
+NOEXPORT char *capwin_client(CLI *c, SERVICE_OPTIONS *opt, const PHASE phase) {
+ char *cmd, *user, *pass, *ctrl, *req, resp5;
+
+ (void)opt; /* squash the unused parameter warning */
+ if(phase!=PROTOCOL_LATE)
+ return NULL;
+
+ /* we extract the username and the password to work around a bug in the
+ * original server-side code that required unused units to be empty */
+ /* otherwise, we could simply forward capwin_auth directly */
+ if(!capwin_auth0) {
+ s_log(LOG_ERR, "CapWIN: No credentials set");
+ throw_exception(c, 1);
+ }
+ if(capwin_decode(capwin_auth, &cmd, &user, &pass, &ctrl))
+ throw_exception(c, 1);
+ if(strcmp(cmd, "AUTH")) {
+ s_log(LOG_ERR, "CapWIN: Invalid authentication request");
+ str_free(cmd);
+ str_free(user);
+ str_free(pass);
+ str_free(ctrl);
+ throw_exception(c, 1);
+ }
+ str_free(cmd);
+ req=str_printf("\x1f%s\x1f%s\x1f\x1c", user, pass);
+ str_free(user);
+ str_free(pass);
+#ifdef USE_WIN32
+ capwin_hwnd=(HWND)(uintptr_t)atoi(ctrl);
+#endif
+ str_free(ctrl);
+
+ s_log(LOG_DEBUG, "CapWIN: Sending credentials");
+ s_ssl_write(c, req, (int)strlen(req));
+ str_free(req);
+
+ s_log(LOG_DEBUG, "CapWIN: Waiting for response");
+ s_ssl_read(c, resp, sizeof resp);
+#ifdef USE_WIN32
+ /* we received a response, so network is up */
+ if(!InterlockedExchange(&capwin_connectivity, 1))
+ PostMessage(capwin_hwnd, WM_CAPWIN_NET_UP, 0, 0);
+#endif
+ if(memcmp(resp, "BINGO", sizeof resp)) {
+ s_log(LOG_ERR, "CapWIN: Authentication failed");
+#ifdef USE_WIN32
+ PostMessage(capwin_hwnd, WM_CAPWIN_AUTH_FAIL, 0, 0);
+#endif
+ throw_exception(c, 1);
+ }
+ s_log(LOG_NOTICE, "CapWIN: Authentication succeeded");
+#ifdef USE_WIN32
+ PostMessage(capwin_hwnd, WM_CAPWIN_AUTH_OK, 0, 0);
+#endif
+ return NULL;
+}
+
+NOEXPORT char *capwinctrl_client(CLI *c, SERVICE_OPTIONS *opt, const PHASE phase) {
+ switch(phase) {
+ case PROTOCOL_CHECK:
+ opt->option.protocol_endpoint=1;
+ break;
+ case PROTOCOL_EARLY:
+ s_log(LOG_DEBUG, "CapWIN: Setting credentials");
+ memset(capwin_auth, 0, CAPWIN_BUFFER_SIZE);
+ s_read_eof(c, c->local_rfd.fd, capwin_auth, CAPWIN_BUFFER_SIZE - 1);
+ s_log(LOG_NOTICE, "CapWIN: Credentials set");
+ /* skip connecting a remote host */
+ throw_exception(c, 2); /* don't reset */
+ default:
+ break;
+ }
+ return NULL;
+}
+
 /* end of protocol.c */

_service:tar_scm:stunnel-5.48.tar.gz/src/prototypes.h -> _service:tar_scm:stunnel-5.69.tar.gz/src/prototypes.h Changed

@@ -1,6 +1,6 @@
 /*
 * stunnel TLS offloading and load-balancing proxy
- * Copyright (C) 1998-2018 Michal Trojnara <Michal.Trojnara@stunnel.org>
+ * Copyright (C) 1998-2023 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
@@ -40,6 +40,18 @@
 
 #include "common.h"
 
+#if defined(USE_PTHREAD) || defined(USE_WIN32)
+#define USE_OS_THREADS
+#endif
+
+#ifdef USE_OS_THREADS
+#ifndef USE_WIN32
+ /* FIXME: waiting for a single terminate_pipe socket
+ * from multiple threads causes a deadlock on WIN32 */
+#define USE_TERMINATE_PIPE
+#endif /* USE_WIN32 */
+#endif /* USE_OS_THREADS */
+
 /**************************************** forward declarations */
 
 typedef struct tls_data_struct TLS_DATA;
@@ -47,6 +59,13 @@
 
 /**************************************** data structures */
 
+#ifdef USE_PTHREAD
+ typedef pthread_t THREAD_ID;
+#endif
+#ifdef USE_WIN32
+ typedef HANDLE THREAD_ID;
+#endif
+
 #if defined (USE_WIN32)
 #define ICON_IMAGE HICON
 #elif defined(__APPLE__)
@@ -107,7 +126,10 @@
 
 #ifndef OPENSSL_NO_COMP
 typedef enum {
- COMP_NONE, COMP_DEFLATE, COMP_ZLIB
+ COMP_NONE, /* empty compression algorithms set */
+ COMP_DEFLATE, /* default OpenSSL's compression algorithms set */
+ COMP_ZLIB, /* additional historic ZLIB compression algorithm id */
+ STUNNEL_COMPS /* number of compression algorithms sets */
 } COMP_TYPE;
 #endif /* !defined(OPENSSL_NO_COMP) */
 
@@ -164,9 +186,9 @@
 
 #ifndef OPENSSL_NO_PSK
 typedef struct psk_keys_struct {
- char *identity;
+ const char *identity; /* the OpenSSL API requires const */
 unsigned char *key_val;
- size_t key_len;
+ unsigned key_len;
 struct psk_keys_struct *next;
 } PSK_KEYS;
 typedef struct psk_table_struct {
@@ -175,6 +197,13 @@
 } PSK_TABLE;
 #endif /* !defined(OPENSSL_NO_PSK) */
 
+#if OPENSSL_VERSION_NUMBER>=0x10000000L
+typedef struct ticket_key_struct {
+ unsigned char *key_val;
+ int key_len;
+} TICKET_KEY;
+#endif /* OpenSSL 1.0.0 or later */
+
 typedef struct service_options_struct {
 struct service_options_struct *next; /* next node in the services list */
 SSL_CTX *ctx; /* TLS context */
@@ -201,10 +230,13 @@
 SOCK_OPT *sock_opts;
 
 /* service-specific data for verify.c */
- char *ca_dir; /* directory for hashed certs */
- char *ca_file; /* file containing bunches of certs */
- char *crl_dir; /* directory for hashed CRLs */
- char *crl_file; /* file containing bunches of CRLs */
+#ifndef OPENSSL_NO_ENGINE
+ NAME_LIST *ca_engine; /* engine-specific CA certificate identifier list */
+#endif
+ char *ca_dir; /* directory containing hashed CA certs */
+ char *ca_file; /* file containing concatenated CA certs */
+ char *crl_dir; /* directory containing hashed CRLs */
+ char *crl_file; /* file containing concatenated CRLs */
 #ifndef OPENSSL_NO_OCSP
 char *ocsp_url;
 unsigned long ocsp_flags;
@@ -216,14 +248,24 @@
 
 /* service-specific data for ctx.c */
 char *cipher_list;
+#ifndef OPENSSL_NO_TLS1_3
+ char *ciphersuites;
+#endif /* TLS 1.3 */
 char *cert; /* cert filename */
 char *key; /* pem (priv key/cert) filename */
 long session_size, session_timeout;
- long unsigned ssl_options_set;
+#if OPENSSL_VERSION_NUMBER>=0x10100000L
+ int security_level;
+#endif /* OpenSSL 1.1.0 or later */
+ uint64_t ssl_options_set;
 #if OPENSSL_VERSION_NUMBER>=0x009080dfL
- long unsigned ssl_options_clear;
+ uint64_t ssl_options_clear;
 #endif /* OpenSSL 0.9.8m or later */
+#if OPENSSL_VERSION_NUMBER>=0x10100000L
+ int min_proto_version, max_proto_version;
+#else /* OPENSSL_VERSION_NUMBER<0x10100000L */
 SSL_METHOD *client_method, *server_method;
+#endif /* OPENSSL_VERSION_NUMBER<0x10100000L */
 SOCKADDR_UNION sessiond_addr;
 #ifndef OPENSSL_NO_TLSEXT
 char *sni;
@@ -235,11 +277,15 @@
 PSK_TABLE psk_sorted;
 #endif /* !defined(OPENSSL_NO_PSK) */
 #ifndef OPENSSL_NO_ECDH
- int curve;
+ char *curves;
 #endif /* !defined(OPENSSL_NO_ECDH) */
 #ifndef OPENSSL_NO_ENGINE
 ENGINE *engine; /* engine to read the private key */
 #endif /* !defined(OPENSSL_NO_ENGINE) */
+#if OPENSSL_VERSION_NUMBER>=0x10000000L
+ TICKET_KEY *ticket_key; /* key for handling session tickets */
+ TICKET_KEY *ticket_mac; /* key for protecting session tickets */
+#endif /* OpenSSL 1.0.0 or later */
 
 /* service-specific data for client.c */
 char *exec_name; /* program name for local mode */
@@ -262,7 +308,8 @@
 char *username;
 
 /* service-specific data for protocol.c */
- char * protocol;
+ char *protocol;
+ NAME_LIST *protocol_header;
 char *protocol_host;
 char *protocol_domain;
 char *protocol_username;
@@ -290,6 +337,7 @@
 #endif
 unsigned local:1; /* outgoing interface specified */
 unsigned retry:1; /* loop remote+program */
+ unsigned session_resume:1; /* enable session resumption */
 unsigned sessiond:1;
 #ifndef USE_WIN32
 unsigned pty:1;
@@ -305,8 +353,11 @@
 unsigned nonce:1; /* send and verify OCSP nonce */
 #endif /* !defined(OPENSSL_NO_OCSP) */
 #ifndef OPENSSL_NO_DH
- unsigned dh_needed:1;
+ unsigned dh_temp_params:1;
 #endif /* OPENSSL_NO_DH */
+#ifndef USE_WIN32
+ unsigned log_stderr:1; /* a copy of the global switch */
+#endif /* USE_WIN32 */
 } option;
 } SERVICE_OPTIONS;
 
@@ -333,7 +384,7 @@
 } OPT_UNION;
 
 struct sock_opt_struct {
- char *opt_str;
+ const char *opt_str;
 int opt_level;
 int opt_name;
 VAL_TYPE opt_type;
@@ -358,15 +409,12 @@
 unsigned allocated;
 #endif
 #endif
+ int main_thread;
 } s_poll_set;
 
-typedef struct disk_file {
-#ifdef USE_WIN32
- HANDLE fh;
-#else
- int fd;
-#endif
- /* the interface is prepared to easily implement buffering if needed */
+typedef struct {
+ /* stdio is currently used, but alternative implementations can be added */
+ FILE *f;
 } DISK_FILE;
 
 /* definitions for client.c */
@@ -382,13 +430,20 @@
 RENEG_DETECTED /* renegotiation detected */
 } RENEG_STATE;
 
-typedef struct {
+typedef struct client_data_struct {
 jmp_buf *exception_pointer;
 
 SSL *ssl; /* TLS connection */
 SERVICE_OPTIONS *opt;
 TLS_DATA *tls;
 
+#ifdef USE_OS_THREADS
+ THREAD_ID thread_id;
+#endif
+#ifndef USE_FORK
+ struct client_data_struct *thread_prev, *thread_next;
+#endif
+
 SOCKADDR_UNION peer_addr; /* peer address */
 socklen_t peer_addr_len;
 char *accepted_address; /* textual representation of the peer address */
@@ -399,6 +454,7 @@
 FD remote_fd; /* remote file descriptor */
 unsigned long pid; /* PID of the local process */
 SOCKET fd; /* temporary file descriptor */
+ int fatal_alert; /* received a fatal alert */
 RENEG_STATE reneg_state; /* used to track renegotiation attempts */
 unsigned long long seq; /* sequential thread number for logging */
 unsigned rr; /* per-client sequential number for round-robin failover */
@@ -411,6 +467,9 @@
 FD *ssl_rfd, *ssl_wfd; /* read and write TLS descriptors */
 uint64_t sock_bytes, ssl_bytes; /* bytes written to socket and TLS */
 s_poll_set *fds; /* file descriptors */
+ struct {
+ unsigned psk:1; /* PSK identity was found */
+ } flag;
 } CLI;
 
 /**************************************** prototypes for stunnel.c */
@@ -419,14 +478,14 @@
 extern int max_clients;
 extern int num_clients;
 #endif
+extern SOCKET signal_pipe2;
+extern SOCKET terminate_pipe2;
 
 void main_init(void);
 int main_configure(char *, char *);
 void main_cleanup(void);
 int drop_privileges(int);
 void daemon_loop(void);
-void unbind_ports(void);
-int bind_ports(void);
 void signal_post(uint8_t);
 #if !defined(USE_WIN32) && !defined(USE_OS2)
 void pid_status_hang(const char *);
@@ -435,14 +494,13 @@
 
 /**************************************** prototypes for options.c */
 
-extern char configuration_filePATH_MAX;
 extern unsigned number_of_sections;
 
 int options_cmdline(char *, char *);
 int options_parse(CONF_TYPE);
 void options_defaults(void);
 void options_apply(void);
-void options_free(void);
+void options_free(int);
 
 void service_up_ref(SERVICE_OPTIONS *);
 void service_free(SERVICE_OPTIONS *);
@@ -452,20 +510,21 @@
 #ifndef USE_FORK
 void get_limits(void); /* setup global max_clients and max_fds */
 #endif
-SOCKET s_socket(int, int, int, int, char *);
-int s_pipe(int2, int, char *);
-int s_socketpair(int, int, int, SOCKET2, int, char *);
-SOCKET s_accept(SOCKET, struct sockaddr *, socklen_t *, int, char *);
+SOCKET s_socket(int, int, int, int, const char *);
+int s_pipe(int2, int, const char *);
+int s_socketpair(int, int, int, SOCKET2, int, const char *);
+SOCKET s_accept(SOCKET, struct sockaddr *, socklen_t *, int, const char *);
 void set_nonblock(SOCKET, unsigned long);
 
 /**************************************** prototypes for log.c */
 
-#if !defined(USE_WIN32) && !defined(__vms)
-void syslog_open(void);
-void syslog_close(void);
-#endif
-int log_open(void);
-void log_close(void);
+#define SINK_SYSLOG 1
+#define SINK_OUTFILE 2
+
+extern DISK_FILE *outfile;
+
+int log_open(int);
+void log_close(int);
 void log_flush(LOG_MODE);
 void s_log(int, const char *, ...)
 #ifdef __GNUC__
@@ -473,13 +532,15 @@
 #else
 ;
 #endif
+void s_vlog(int, const char *, va_list);
 char *log_id(CLI *);
-void fatal_debug(char *, const char *, int) NORETURN;
+void fatal_debug(const char *, const char *, int) NORETURN;
 #define fatal(a) fatal_debug((a), __FILE__, __LINE__)
 void ioerror(const char *);
 void sockerror(const char *);
 void log_error(int, int, const char *);
 char *s_strerror(int);
+void bin2hexstring(const unsigned char *, size_t, char *, size_t);
 
 /**************************************** prototypes for pty.c */
 
@@ -491,6 +552,11 @@
 
 /**************************************** prototypes for cron.c */
 
+#ifdef USE_OS_THREADS
+extern THREAD_ID per_second_thread_id;
+extern THREAD_ID per_day_thread_id;
+#endif
+
 int cron_init(void);
 
 /**************************************** prototypes for ssl.c */
@@ -498,6 +564,9 @@
 extern int index_ssl_cli, index_ssl_ctx_opt;
 extern int index_session_authenticated, index_session_connect_address;
 
+int fips_default(void);
+int fips_available(void);
+void crypto_init(void);
 int ssl_init(void);
 int ssl_configure(GLOBAL_OPTIONS *);
 
@@ -507,7 +576,7 @@
 
 #ifndef OPENSSL_NO_DH
 extern DH *dh_params;
-extern int dh_needed;
+extern int dh_temp_params;
 #endif /* OPENSSL_NO_DH */
 
 int context_init(SERVICE_OPTIONS *);
@@ -515,19 +584,26 @@
 void psk_sort(PSK_TABLE *, PSK_KEYS *);
 PSK_KEYS *psk_find(const PSK_TABLE *, const char *);
 #endif /* !defined(OPENSSL_NO_PSK) */
-void sslerror(char *);
+#ifndef OPENSSL_NO_ENGINE
+UI_METHOD *ui_stunnel(void);
+#endif /* !defined(OPENSSL_NO_ENGINE) */
+void print_session_id(SSL_SESSION *);
+void sslerror(const char *);
 
 /**************************************** prototypes for verify.c */
 
 int verify_init(SERVICE_OPTIONS *);
-void print_client_CA_list(const STACK_OF(X509_NAME) *);
+#ifndef OPENSSL_NO_ENGINE
+X509 *engine_get_cert(ENGINE *, const char *);
+#endif
+void print_CA_list(const char *, const STACK_OF(X509_NAME) *);
 char *X509_NAME2text(X509_NAME *);
 
 /**************************************** prototypes for network.c */
 
 s_poll_set *s_poll_alloc(void);
 void s_poll_free(s_poll_set *);
-void s_poll_init(s_poll_set *);
+void s_poll_init(s_poll_set *, int);
 void s_poll_add(s_poll_set *, SOCKET, int, int);
 void s_poll_remove(s_poll_set *, SOCKET);
 int s_poll_canread(s_poll_set *, SOCKET);
@@ -537,15 +613,18 @@
 int s_poll_err(s_poll_set *, SOCKET);
 int s_poll_wait(s_poll_set *, int, int);
 void s_poll_dump(s_poll_set *, int);
+void s_poll_sleep(int, int);
 
 #ifdef USE_WIN32
-#define SIGNAL_RELOAD_CONFIG 1
-#define SIGNAL_REOPEN_LOG 2
-#define SIGNAL_TERMINATE 3
+#define SIGNAL_TERMINATE 1
+#define SIGNAL_RELOAD_CONFIG 2
+#define SIGNAL_REOPEN_LOG 3
+#define SIGNAL_CONNECTIONS 4
 #else
+#define SIGNAL_TERMINATE SIGTERM
 #define SIGNAL_RELOAD_CONFIG SIGHUP
 #define SIGNAL_REOPEN_LOG SIGUSR1
-#define SIGNAL_TERMINATE SIGTERM
+#define SIGNAL_CONNECTIONS SIGUSR2
 #endif
 
 int socket_options_set(SERVICE_OPTIONS *, SOCKET, int);
@@ -560,8 +639,9 @@
 #else
 void *
 #endif
-client_thread(void *);
+ client_thread(void *);
 void client_main(CLI *);
+void client_free(CLI *);
 void throw_exception(CLI *, int) NORETURN;
 
 /**************************************** prototypes for network.c */
@@ -569,6 +649,7 @@
 int get_socket_error(const SOCKET);
 int s_connect(CLI *, SOCKADDR_UNION *, socklen_t);
 void s_write(CLI *, SOCKET fd, const void *, size_t);
+size_t s_read_eof(CLI *, SOCKET fd, void *, size_t);
 void s_read(CLI *, SOCKET fd, void *, size_t);
 void fd_putline(CLI *, SOCKET, const char *);
 char *fd_getline(CLI *, SOCKET);
@@ -580,10 +661,17 @@
 ;
 #endif
 void s_ssl_write(CLI *, const void *, int);
+size_t s_ssl_read_eof(CLI *, void *, int);
 void s_ssl_read(CLI *, void *, int);
 char *ssl_getstring(CLI *c);
 char *ssl_getline(CLI *c);
 void ssl_putline(CLI *c, const char *);
+void ssl_printf(CLI *, const char *, ...)
+#ifdef __GNUC__
+ __attribute__((format(printf, 2, 3)));
+#else
+ ;
+#endif
 
 /**************************************** prototype for protocol.c */
 
@@ -594,17 +682,23 @@
 PROTOCOL_LATE
 } PHASE;
 
-char *protocol(CLI *, SERVICE_OPTIONS *opt, const PHASE);
+#ifdef USE_WIN32
+extern HWND capwin_hwnd;
+extern LONG capwin_connectivity;
+#endif
+
+const char *protocol(CLI *, SERVICE_OPTIONS *opt, const PHASE);
 
 /**************************************** prototypes for resolver.c */
 
-void resolver_init();
+void resolver_init(void);
+int use_ipv6(void);
 
 unsigned name2addr(SOCKADDR_UNION *, char *, int);
-unsigned hostport2addr(SOCKADDR_UNION *, char *, char *, int);
+unsigned hostport2addr(SOCKADDR_UNION *, char *, const char *, int);
 
 unsigned name2addrlist(SOCKADDR_LIST *, char *);
-unsigned hostport2addrlist(SOCKADDR_LIST *, char *, char *);
+unsigned hostport2addrlist(SOCKADDR_LIST *, char *, const char *);
 
 void addrlist_clear(SOCKADDR_LIST *, int);
 unsigned addrlist_dup(SOCKADDR_LIST *, const SOCKADDR_LIST *);
@@ -624,21 +718,8 @@
 #endif
 
 #ifdef USE_WIN32
-
 /* rename some locally shadowed declarations */
 #define getnameinfo local_getnameinfo
-
-#ifndef _WIN32_WCE
-typedef int (CALLBACK * GETADDRINFO) (const char *,
- const char *, const struct addrinfo *, struct addrinfo **);
-typedef void (CALLBACK * FREEADDRINFO) (struct addrinfo *);
-typedef int (CALLBACK * GETNAMEINFO) (const struct sockaddr *, socklen_t,
- char *, size_t, char *, size_t, int);
-extern GETADDRINFO s_getaddrinfo;
-extern FREEADDRINFO s_freeaddrinfo;
-extern GETNAMEINFO s_getnameinfo;
-#endif /* ! _WIN32_WCE */
-
 #endif /* USE_WIN32 */
 
 int getnameinfo(const struct sockaddr *, socklen_t,
@@ -648,8 +729,8 @@
 
 /**************************************** prototypes for sthreads.c */
 
-#if defined(USE_PTHREAD) || defined(USE_WIN32)
-#define USE_OS_THREADS
+#ifndef USE_FORK
+extern CLI *thread_head;
 #endif
 
 #if OPENSSL_VERSION_NUMBER<0x10100004L
@@ -663,9 +744,11 @@
 #ifdef USE_WIN32
 CRITICAL_SECTION critical_section;
 #endif
+#ifdef DEBUG_LOCKS
 const char *init_file, *read_lock_file, *write_lock_file,
 *unlock_file, *destroy_file;
 int init_line, read_lock_line, write_lock_line, unlock_line, destroy_line;
+#endif
 };
 
 typedef struct CRYPTO_dynlock_value CRYPTO_RWLOCK;
@@ -679,6 +762,7 @@
 #endif /* OPENSSL_VERSION_NUMBER<0x10100004L */
 
 typedef enum {
+ LOCK_THREAD_LIST, /* sthreads.c */
 LOCK_SESSION, LOCK_ADDR,
 LOCK_CLIENTS, LOCK_SSL, /* client.c */
 LOCK_REF, /* options.c */
@@ -691,6 +775,10 @@
 #ifndef OPENSSL_NO_DH
 LOCK_DH, /* ctx.c */
 #endif /* OPENSSL_NO_DH */
+#ifdef USE_WIN32
+ LOCK_WIN_LOG, /* ui_win_gui.c */
+#endif
+ LOCK_SECTIONS, /* traversing section list */
 STUNNEL_LOCKS /* number of locks */
 } LOCK_TYPE;
 
@@ -710,6 +798,7 @@
 unsigned long stunnel_process_id(void);
 unsigned long stunnel_thread_id(void);
 int create_client(SOCKET, SOCKET, CLI *);
+
 #ifdef USE_UCONTEXT
 typedef struct CONTEXT_STRUCTURE {
 char *stack; /* CPU stack for this thread */
@@ -724,23 +813,28 @@
 extern CONTEXT *ready_head, *ready_tail;
 extern CONTEXT *waiting_head, *waiting_tail;
 #endif
+
 #ifdef _WIN32_WCE
 long _beginthread(void (*)(void *), int, void *);
 void _endthread(void);
 #endif
+
 #ifdef DEBUG_STACK_SIZE
-void stack_info(int);
+void stack_info(size_t, int);
+void ignore_value(void *);
 #endif
 
 /**************************************** prototypes for file.c */
 
 #ifndef USE_WIN32
-DISK_FILE *file_fdopen(int);
+DISK_FILE *file_fdopen(int, FILE_MODE mode);
 #endif
 DISK_FILE *file_open(char *, FILE_MODE mode);
 void file_close(DISK_FILE *);
 ssize_t file_getline(DISK_FILE *, char *, int);
-ssize_t file_putline(DISK_FILE *, char *);
+ssize_t file_putline_nonewline(DISK_FILE *, char *);
+ssize_t file_putline_newline(DISK_FILE *, char *);
+int file_flush(DISK_FILE *);
 int file_permissions(const char *);
 
 #ifdef USE_WIN32
@@ -750,18 +844,18 @@
 
 /**************************************** prototypes for libwrap.c */
 
-int libwrap_init();
+int libwrap_init(void);
 void libwrap_auth(CLI *);
 
 /**************************************** prototypes for tls.c */
 
 extern volatile int tls_initialized;
 
-void tls_init();
-TLS_DATA *tls_alloc(CLI *, TLS_DATA *, char *);
-void tls_cleanup();
+void tls_init(void);
+TLS_DATA *tls_alloc(CLI *, TLS_DATA *, const char *);
+void tls_cleanup(void);
 void tls_set(TLS_DATA *);
-TLS_DATA *tls_get();
+TLS_DATA *tls_get(void);
 
 /**************************************** prototypes for str.c */
 
@@ -773,11 +867,12 @@
 size_t alloc_bytes, alloc_blocks;
 CLI *c;
 SERVICE_OPTIONS *opt;
- char *id;
+ const char *id;
 };
 
-void str_init(TLS_DATA *);
-void str_cleanup(TLS_DATA *);
+void str_init(void);
+void str_thread_init(TLS_DATA *);
+void str_thread_cleanup(TLS_DATA *);
 char *str_dup_debug(const char *, const char *, int);
 #define str_dup(a) str_dup_debug((a), __FILE__, __LINE__)
 char *str_dup_detached_debug(const char *, const char *, int);
@@ -793,21 +888,29 @@
 LPTSTR str_tprintf(LPCTSTR, ...);
 #endif
 
-void str_canary_init();
-void str_stats();
+void str_canary_init(void);
+void str_stats(void);
+
 void *str_alloc_debug(size_t, const char *, int);
 #define str_alloc(a) str_alloc_debug((a), __FILE__, __LINE__)
 void *str_alloc_detached_debug(size_t, const char *, int);
 #define str_alloc_detached(a) str_alloc_detached_debug((a), __FILE__, __LINE__)
+
 void *str_realloc_debug(void *, size_t, const char *, int);
 #define str_realloc(a, b) str_realloc_debug((a), (b), __FILE__, __LINE__)
 void *str_realloc_detached_debug(void *, size_t, const char *, int);
 #define str_realloc_detached(a, b) str_realloc_detached_debug((a), (b), __FILE__, __LINE__)
+
 void str_detach_debug(void *, const char *, int);
 #define str_detach(a) str_detach_debug((a), __FILE__, __LINE__)
+void str_detach_const_debug(const void *, const char *, int);
+#define str_detach_const(a) str_detach_const_debug((a), __FILE__, __LINE__)
+
 void str_free_debug(void *, const char *, int);
 #define str_free(a) str_free_debug((a), __FILE__, __LINE__), (a)=NULL
 #define str_free_expression(a) str_free_debug((a), __FILE__, __LINE__)
+void str_free_const_debug(const void *, const char *, int);
+#define str_free_const(a) str_free_const_debug((a), __FILE__, __LINE__), (a)=NULL
 
 void leak_table_utilization(void);
 
@@ -826,7 +929,10 @@
 
 int ui_passwd_cb(char *, int, int, void *);
 #ifndef OPENSSL_NO_ENGINE
-UI_METHOD *UI_stunnel(void);
+int (*ui_get_opener(void)) (UI *);
+int (*ui_get_writer(void)) (UI *, UI_STRING *);
+int (*ui_get_reader(void)) (UI *, UI_STRING *);
+int (*ui_get_closer(void)) (UI *);
 #endif /* !defined(OPENSSL_NO_ENGINE) */
 
 #ifdef ICON_IMAGE

_service:tar_scm:stunnel-5.48.tar.gz/src/pty.c -> _service:tar_scm:stunnel-5.69.tar.gz/src/pty.c Changed

_service:tar_scm:stunnel-5.48.tar.gz/src/resolver.c -> _service:tar_scm:stunnel-5.69.tar.gz/src/resolver.c Changed

@@ -1,6 +1,6 @@
 /*
 * stunnel TLS offloading and load-balancing proxy
- * Copyright (C) 1998-2018 Michal Trojnara <Michal.Trojnara@stunnel.org>
+ * Copyright (C) 1998-2023 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
@@ -35,14 +35,35 @@
 * forward this exception.
 */
 
-#include "common.h"
 #include "prototypes.h"
 
+#ifdef _MSC_VER
+/*
+ * Disable MSVC C4996 warning:
+ * warning C4996: 'inet_addr': Use inet_pton() or InetPton() instead
+ * warning C4996: 'inet_ntoa': Use inet_ntop() or InetNtop() instead
+ * warning C4996: 'gethostbyname': Use getaddrinfo() or GetAddrInfoW() instead
+ */
+#pragma warning(disable: 4996)
+#endif
+
 /**************************************** prototypes */
 
 #if defined(USE_WIN32) && !defined(_WIN32_WCE)
+
+typedef int (CALLBACK * GETADDRINFO) (const char *,
+ const char *, const struct addrinfo *, struct addrinfo **);
+typedef void (CALLBACK * FREEADDRINFO) (struct addrinfo *);
+typedef int (CALLBACK * GETNAMEINFO) (const struct sockaddr *, socklen_t,
+ char *, size_t, char *, size_t, int);
+extern GETADDRINFO s_getaddrinfo;
+extern FREEADDRINFO s_freeaddrinfo;
+extern GETNAMEINFO s_getnameinfo;
+
 NOEXPORT int get_ipv6(LPTSTR);
-#endif
+
+#endif /* defined(USE_WIN32) && !defined(_WIN32_WCE) */
+
 NOEXPORT void addrlist2addr(SOCKADDR_UNION *, SOCKADDR_LIST *);
 NOEXPORT void addrlist_reset(SOCKADDR_LIST *);
 
@@ -134,6 +155,18 @@
 #endif /* __GNUC__ */
 #endif
 
+int use_ipv6() {
+#if defined(USE_WIN32) && !defined(_WIN32_WCE)
+ return s_getaddrinfo != NULL;
+#else /* defined(USE_WIN32) && !defined(_WIN32_WCE) */
+#if defined(USE_IPv6)
+ return 1;
+#else /* defined(USE_IPv6) */
+ return 0;
+#endif /* defined(USE_IPv6) */
+#endif /* defined(USE_WIN32) && !defined(_WIN32_WCE) */
+}
+
 /**************************************** stunnel resolver API */
 
 unsigned name2addr(SOCKADDR_UNION *addr, char *name, int passive) {
@@ -151,7 +184,7 @@
 }
 
 unsigned hostport2addr(SOCKADDR_UNION *addr,
- char *host_name, char *port_name, int passive) {
+ char *host_name, const char *port_name, int passive) {
 SOCKADDR_LIST *addr_list;
 unsigned num;
 
@@ -225,7 +258,7 @@
 }
 
 unsigned hostport2addrlist(SOCKADDR_LIST *addr_list,
- char *host_name, char *port_name) {
+ char *host_name, const char *port_name) {
 struct addrinfo hints, *res, *cur;
 int err, retry=0;
 unsigned num;
@@ -255,7 +288,7 @@
 }
 if(err==EAI_AGAIN && ++retry<=3) {
 s_log(LOG_DEBUG, "getaddrinfo: EAI_AGAIN received: retrying");
- sleep(1);
+ s_poll_sleep(1, 0);
 continue;
 }
 #ifdef AI_ADDRCONFIG
@@ -320,7 +353,7 @@
 }
 
 unsigned addrlist_resolve(SOCKADDR_LIST *addr_list) {
- unsigned num=0, rnd;
+ unsigned num=0, rnd=0;
 NAME_LIST *host;
 
 addrlist_reset(addr_list);
@@ -350,24 +383,30 @@
 if(err) {
 s_log(LOG_ERR, "getnameinfo: %s", s_gai_strerror(err));
 retval=str_dup("unresolvable address");
- } else
- retval=str_printf("%s:%s", host, port);
+ } else if(!*port && !*host)
+ retval=str_dup("unnamed socket");
+ else
+ retval=str_printf("%s%s%s", host, *host && *port ? ":" : "", port);
 str_free(host);
 str_free(port);
 return retval;
 }
 
 socklen_t addr_len(const SOCKADDR_UNION *addr) {
- if(addr->sa.sa_family==AF_INET)
+ switch(addr->sa.sa_family) {
+ case AF_UNSPEC: /* 0 */
+ return 0;
+ case AF_INET: /* 2 (almost universally) */
 return sizeof(struct sockaddr_in);
 #ifdef USE_IPv6
- if(addr->sa.sa_family==AF_INET6)
+ case AF_INET6:
 return sizeof(struct sockaddr_in6);
 #endif
 #ifdef HAVE_STRUCT_SOCKADDR_UN
- if(addr->sa.sa_family==AF_UNIX)
+ case AF_UNIX:
 return sizeof(struct sockaddr_un);
 #endif
+ }
 s_log(LOG_ERR, "INTERNAL ERROR: Unknown sa_family: %d",
 addr->sa.sa_family);
 return sizeof(SOCKADDR_UNION);

_service:tar_scm:stunnel-5.48.tar.gz/src/resources.h -> _service:tar_scm:stunnel-5.69.tar.gz/src/resources.h Changed

@@ -2,9 +2,14 @@
 
 #define WM_VALID_CONFIG     (WM_APP+0)
 #define WM_INVALID_CONFIG   (WM_APP+1)
-#define WM_LOG              (WM_APP+2)
-#define WM_NEW_CHAIN        (WM_APP+3)
-#define WM_CLIENTS          (WM_APP+4)
+#define WM_NEW_CHAIN        (WM_APP+2)
+#define WM_TERMINATE        (WM_APP+3)
+
+#define WM_CAPWIN_DESTROY   (WM_APP+0x67)
+#define WM_CAPWIN_NET_DOWN  (WM_APP+0x68)
+#define WM_CAPWIN_NET_UP    (WM_APP+0x69)
+#define WM_CAPWIN_AUTH_OK   (WM_APP+0x70)
+#define WM_CAPWIN_AUTH_FAIL (WM_APP+0x71)
 
 #define IDI_STUNNEL_MAIN    10
 #define IDI_STUNNEL_ACTIVE  11
@@ -14,6 +19,7 @@
 #define IDE_EDIT            20
 #define IDE_PASSEDIT        21
 #define IDE_PINEDIT         22
+#define IDE_PAUSE           23
 
 #define IDM_TRAYMENU        30
 #define IDM_MAINMENU        31
@@ -23,8 +29,9 @@
 
 #define IDM_SAVE_LOG        40
 #define IDM_REOPEN_LOG      41
-#define IDM_EDIT_CONFIG     42
-#define IDM_RELOAD_CONFIG   43
+#define IDM_CONNECTIONS     42
+#define IDM_EDIT_CONFIG     43
+#define IDM_RELOAD_CONFIG   44
 
 #define IDM_ABOUT           50
 #define IDM_MANPAGE         51

_service:tar_scm:stunnel-5.48.tar.gz/src/resources.rc -> _service:tar_scm:stunnel-5.69.tar.gz/src/resources.rc Changed

@@ -19,7 +19,7 @@
             VALUE "FileDescription",    "stunnel - TLS offloading and load-balancing proxy"
             VALUE "FileVersion",        STUNNEL_VERSION
             VALUE "InternalName",       "stunnel"
-            VALUE "LegalCopyright",     "© by Michal Trojnara, 1998-2018"
+            VALUE "LegalCopyright",     "© by Michal Trojnara, 1998-2023"
             VALUE "OriginalFilename",   "stunnel.exe"
             VALUE "ProductName",        STUNNEL_PRODUCTNAME
             VALUE "ProductVersion",     STUNNEL_VERSION
@@ -42,8 +42,9 @@
     BEGIN
         MENUITEM "&Save Log As",            IDM_SAVE_LOG
         MENUITEM "Reopen &Log File",        IDM_REOPEN_LOG, GRAYED
+        MENUITEM "Co&nnections",            IDM_CONNECTIONS
         MENUITEM SEPARATOR
-        MENUITEM "E&xit",                   IDM_EXIT
+        MENUITEM "&Terminate",              IDM_EXIT
         MENUITEM SEPARATOR
         MENUITEM "&Close",                  IDM_CLOSE
     END
@@ -53,13 +54,13 @@
     POPUP "&Configuration"
 #endif
     BEGIN
-        MENUITEM "&Edit Configuration",      IDM_EDIT_CONFIG
-        MENUITEM "&Reload Configuration",    IDM_RELOAD_CONFIG
+        MENUITEM "&Edit Configuration",     IDM_EDIT_CONFIG
+        MENUITEM "&Reload Configuration",   IDM_RELOAD_CONFIG
     END
 #ifdef _WIN32_WCE
-    POPUP "&Save Peer Certs"
+    POPUP "&Save Peer Cert",                GRAYED
 #else
-    POPUP "&Save Peer Certificate"
+    POPUP "&Save Peer Certificate",         GRAYED
 #endif
     BEGIN
         MENUITEM "dummy",                   0, GRAYED
@@ -79,20 +80,22 @@
     BEGIN
         MENUITEM "Show Log &Window",        IDM_SHOW_LOG
         MENUITEM SEPARATOR
-        POPUP "&Save Peer Certificate"
+        MENUITEM "Reopen &Log File",        IDM_REOPEN_LOG, GRAYED
+        MENUITEM "Co&nnections",            IDM_CONNECTIONS
+        MENUITEM SEPARATOR
+        MENUITEM "&Edit Configuration",     IDM_EDIT_CONFIG
+        MENUITEM "&Reload Configuration",   IDM_RELOAD_CONFIG
+        MENUITEM SEPARATOR
+        POPUP "&Save Peer Certificate",     GRAYED
         BEGIN
             MENUITEM "dummy",               0, GRAYED
         END
         MENUITEM SEPARATOR
-        MENUITEM "&Edit Configuration",      IDM_EDIT_CONFIG
-        MENUITEM "&Reload Configuration",    IDM_RELOAD_CONFIG
-        MENUITEM "Reopen &Log File",        IDM_REOPEN_LOG, GRAYED
-        MENUITEM SEPARATOR
         MENUITEM "&Homepage",               IDM_HOMEPAGE
         MENUITEM "&Manual",                 IDM_MANPAGE
         MENUITEM "&About",                  IDM_ABOUT
         MENUITEM SEPARATOR
-        MENUITEM "E&xit",                   IDM_EXIT
+        MENUITEM "&Terminate",              IDM_EXIT
     END
 END
 
@@ -104,7 +107,7 @@
     ICON            IDI_STUNNEL_MAIN, -1,                        6,  6,  20, 20
     LTEXT           "stunnel version", -1,                      30,  4,  49,  8
     LTEXT           STUNNEL_VERSION, -1,                        79,  4,  57,  8
-    LTEXT           "© by Michal Trojnara, 1998-2018", -1,      30, 12, 106,  8
+    LTEXT           "© by Michal Trojnara, 1998-2023", -1,      30, 12, 106,  8
     LTEXT           "All Rights Reserved", -1,                  30, 20, 106,  8
     LTEXT           "Licensed under the GNU GPL version 2", -1,  4, 28, 132,  8
     LTEXT           "with a special exception for OpenSSL", -1,  4, 36, 132,  8

_service:tar_scm:stunnel-5.48.tar.gz/src/ssl.c -> _service:tar_scm:stunnel-5.69.tar.gz/src/ssl.c Changed

@@ -1,6 +1,6 @@
 /*
 * stunnel TLS offloading and load-balancing proxy
- * Copyright (C) 1998-2018 Michal Trojnara <Michal.Trojnara@stunnel.org>
+ * Copyright (C) 1998-2023 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
@@ -35,14 +35,27 @@
 * forward this exception.
 */
 
-#include "common.h"
 #include "prototypes.h"
 
 /* global OpenSSL initialization: compression, engine, entropy */
-NOEXPORT void cb_free(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
+NOEXPORT void cb_new_auth(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
+ int idx, long argl, void *argp);
+#if OPENSSL_VERSION_NUMBER>=0x30000000L
+NOEXPORT int cb_dup_addr(CRYPTO_EX_DATA *to, const CRYPTO_EX_DATA *from,
+ void **from_d, int idx, long argl, void *argp);
+#elif OPENSSL_VERSION_NUMBER>=0x10100000L
+NOEXPORT int cb_dup_addr(CRYPTO_EX_DATA *to, const CRYPTO_EX_DATA *from,
+ void *from_d, int idx, long argl, void *argp);
+#else
+NOEXPORT int cb_dup_addr(CRYPTO_EX_DATA *to, CRYPTO_EX_DATA *from,
+ void *from_d, int idx, long argl, void *argp);
+#endif
+NOEXPORT void cb_free_addr(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
 int idx, long argl, void *argp);
 #ifndef OPENSSL_NO_COMP
-NOEXPORT int compression_init(GLOBAL_OPTIONS *);
+NOEXPORT void compression_init(void);
+NOEXPORT int compression_set(GLOBAL_OPTIONS *);
+NOEXPORT void compression_list(void);
 #endif
 NOEXPORT int prng_init(GLOBAL_OPTIONS *);
 NOEXPORT int add_rand_file(GLOBAL_OPTIONS *, const char *);
@@ -50,33 +63,142 @@
 
 int index_ssl_cli, index_ssl_ctx_opt;
 int index_session_authenticated, index_session_connect_address;
+#ifndef OPENSSL_NO_COMP
+NOEXPORT STACK_OF(SSL_COMP) *comp_methodsSTUNNEL_COMPS;
+#endif
+
+#ifdef USE_FIPS
+int fips_default() {
+ static int cache=-1;
+
+ if(cache == -1) {
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+ cache=EVP_default_properties_is_fips_enabled(NULL);
+#else /* OPENSSL_VERSION_NUMBER < 0x30000000L */
+ cache=FIPS_mode();
+#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */
+ }
+ return cache;
+}
+#endif /* USE_FIPS */
+
+int fips_available() { /* either FIPS provider or container is available */
+#ifdef USE_FIPS
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+ static OSSL_PROVIDER *fips=NULL;
+
+ if(!fips)
+ fips=OSSL_PROVIDER_try_load(NULL, "fips", 1);
+ return fips && OSSL_PROVIDER_available(NULL, "fips");
+#else /* OPENSSL_VERSION_NUMBER >= 0x30000000L */
+ /* checking for OPENSSL_FIPS would be less precise, because it only
+ * depends on the compiled, and not on the running OpenSSL version */
+ return strstr(OpenSSL_version(OPENSSL_VERSION), "-fips") != NULL ||
+ strstr(OpenSSL_version(OPENSSL_VERSION), "FIPS") != NULL; /* RHEL */
+#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */
+#else /* USE_FIPS */
+ return 0;
+#endif /* USE_FIPS */
+}
 
-int ssl_init(void) { /* init TLS before parsing configuration file */
+/* initialize libcrypto before invoking API functions that require it */
+void crypto_init() {
 #if OPENSSL_VERSION_NUMBER>=0x10100000L
- OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS |
- OPENSSL_INIT_LOAD_CRYPTO_STRINGS | OPENSSL_INIT_LOAD_CONFIG, NULL);
-#else
+ OPENSSL_INIT_SETTINGS *conf;
+#endif /* OPENSSL_VERSION_NUMBER>=0x10100000L */
+#ifdef USE_WIN32
+ TCHAR stunnel_exe_pathMAX_PATH;
+ LPTSTR c;
+#if OPENSSL_VERSION_NUMBER>=0x10100000L
+ char *stunnel_dir, *path;
+#endif /* OPENSSL_VERSION_NUMBER>=0x10100000L */
+
+ /* identify stunnel_exe_path */
+ GetModuleFileName(0, stunnel_exe_path, MAX_PATH);
+ c=_tcsrchr(stunnel_exe_path, TEXT('\\')); /* last backslash */
+ if(c) { /* found */
+ *c=TEXT('\0'); /* truncate the program name */
+ c=_tcsrchr(stunnel_exe_path, TEXT('\\')); /* previous backslash */
+ if(c && !_tcscmp(c+1, TEXT("bin")))
+ *c=TEXT('\0'); /* truncate "bin" */
+ }
+
+ /* set current working directory */
+#ifndef _WIN32_WCE
+ if(!SetCurrentDirectory(stunnel_exe_path)) {
+ LPTSTR errmsg=str_tprintf(TEXT("Cannot set directory to %s"),
+ stunnel_exe_path);
+ message_box(errmsg, MB_ICONERROR);
+ str_free(errmsg);
+ exit(1);
+ }
+ /* try to enter the "config" subdirectory, ignore the result */
+ SetCurrentDirectory(TEXT("config"));
+#endif
+
+ /* setup the environment */
+ _tputenv(str_tprintf(TEXT("OPENSSL_ENGINES=%s\\engines"),
+ stunnel_exe_path));
+ _tputenv(str_tprintf(TEXT("OPENSSL_MODULES=%s\\ossl-modules"),
+ stunnel_exe_path));
+ _tputenv(str_tprintf(TEXT("OPENSSL_CONF=%s\\config\\openssl.cnf"),
+ stunnel_exe_path));
+#endif /* USE_WIN32 */
+
+ /* initialize OpenSSL */
+#if OPENSSL_VERSION_NUMBER>=0x10100000L
+ conf=OPENSSL_INIT_new();
+#ifdef USE_WIN32
+ stunnel_dir=tstr2str(stunnel_exe_path);
+ if(!stunnel_dir) /* fail-safe */
+ stunnel_dir=str_dup("..");
+ path=str_printf("%s\\config\\openssl.cnf", stunnel_dir);
+ if(!OPENSSL_INIT_set_config_filename(conf, path)) {
+ s_log(LOG_ERR, "Failed to set OpenSSL configuration file name");
+ }
+ str_free(path);
+#endif /* USE_WIN32 */
+ OPENSSL_init_crypto(
+ OPENSSL_INIT_LOAD_CRYPTO_STRINGS | OPENSSL_INIT_LOAD_CONFIG, conf);
+ OPENSSL_INIT_free(conf);
+#else /* OPENSSL_VERSION_NUMBER>=0x10100000L */
 OPENSSL_config(NULL);
 SSL_load_error_strings();
 SSL_library_init();
-#endif
+#endif /* OPENSSL_VERSION_NUMBER>=0x10100000L */
+
+#ifdef USE_WIN32
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+ /* setup the default search path for providers */
+ /* WARNING: OpenSSL needs to already be initialized */
+ path=str_printf("%s\\ossl-modules", stunnel_dir);
+ if(!OSSL_PROVIDER_set_default_search_path(NULL, path)) {
+ s_log(LOG_ERR, "Failed to set default ossl-modules path");
+ }
+ str_free(path);
+#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */
+#if OPENSSL_VERSION_NUMBER>=0x10100000L
+ str_free(stunnel_dir);
+#endif /* OPENSSL_VERSION_NUMBER>=0x10100000L */
+#endif /* USE_WIN32 */
+}
+
+/* initialize lbssl before parsing the configuration file */
+int ssl_init(void) {
 index_ssl_cli=SSL_get_ex_new_index(0,
- "CLI pointer", NULL, NULL, NULL);
+ strdup("CLI pointer"), NULL, NULL, NULL);
 index_ssl_ctx_opt=SSL_CTX_get_ex_new_index(0,
- "SERVICE_OPTIONS pointer", NULL, NULL, NULL);
+ strdup("SERVICE_OPTIONS pointer"), NULL, NULL, NULL);
 index_session_authenticated=SSL_SESSION_get_ex_new_index(0,
- "session authenticated", NULL, NULL, NULL);
+ strdup("session authenticated"), cb_new_auth, NULL, NULL);
 index_session_connect_address=SSL_SESSION_get_ex_new_index(0,
- "session connect address", NULL, NULL, cb_free);
+ strdup("session connect address"), NULL, cb_dup_addr, cb_free_addr);
 if(index_ssl_cli<0 || index_ssl_ctx_opt<0 ||
 index_session_authenticated<0 ||
 index_session_connect_address<0) {
 s_log(LOG_ERR, "Application specific data initialization failed");
 return 1;
 }
-#ifndef OPENSSL_NO_ENGINE
- ENGINE_load_builtin_engines();
-#endif
 #ifndef OPENSSL_NO_DH
 dh_params=get_dh2048();
 if(!dh_params) {
@@ -84,6 +206,9 @@
 return 1;
 }
 #endif /* OPENSSL_NO_DH */
+#ifndef OPENSSL_NO_COMP
+ compression_init();
+#endif /* OPENSSL_NO_COMP */
 return 0;
 }
 
@@ -97,17 +222,55 @@
 BN_free(dh->p);
 BN_free(dh->q);
 BN_free(dh->g);
- dh->p = p;
- dh->q = q;
- dh->g = g;
+ dh->p=p;
+ dh->q=q;
+ dh->g=g;
 if(q)
- dh->length = BN_num_bits(q);
+ dh->length=BN_num_bits(q);
 return 1;
 }
 #endif
 #endif
 
-NOEXPORT void cb_free(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
+NOEXPORT void cb_new_auth(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
+ int idx, long argl, void *argp) {
+ (void)parent; /* squash the unused parameter warning */
+ (void)ptr; /* squash the unused parameter warning */
+ (void)argl; /* squash the unused parameter warning */
+ s_log(LOG_DEBUG, "Initializing application specific data for %s",
+ (char *)argp);
+ if(!CRYPTO_set_ex_data(ad, idx, (void *)(-1)))
+ sslerror("CRYPTO_set_ex_data");
+}
+
+#if OPENSSL_VERSION_NUMBER>=0x30000000L
+NOEXPORT int cb_dup_addr(CRYPTO_EX_DATA *to, const CRYPTO_EX_DATA *from,
+ void **from_d, int idx, long argl, void *argp) {
+#elif OPENSSL_VERSION_NUMBER>=0x10100000L
+NOEXPORT int cb_dup_addr(CRYPTO_EX_DATA *to, const CRYPTO_EX_DATA *from,
+ void *from_d, int idx, long argl, void *argp) {
+#else
+NOEXPORT int cb_dup_addr(CRYPTO_EX_DATA *to, CRYPTO_EX_DATA *from,
+ void *from_d, int idx, long argl, void *argp) {
+#endif
+ SOCKADDR_UNION *src, *dst;
+ socklen_t len;
+
+ (void)to; /* squash the unused parameter warning */
+ (void)from; /* squash the unused parameter warning */
+ (void)idx; /* squash the unused parameter warning */
+ (void)argl; /* squash the unused parameter warning */
+ s_log(LOG_DEBUG, "Duplicating application specific data for %s",
+ (char *)argp);
+ src=*(void **)from_d;
+ len=addr_len(src);
+ dst=str_alloc_detached((size_t)len);
+ memcpy(dst, src, (size_t)len);
+ *(void **)from_d=dst;
+ return 1;
+}
+
+NOEXPORT void cb_free_addr(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
 int idx, long argl, void *argp) {
 (void)parent; /* squash the unused parameter warning */
 (void)ad; /* squash the unused parameter warning */
@@ -120,6 +283,31 @@
 
 int ssl_configure(GLOBAL_OPTIONS *global) { /* configure global TLS settings */
 #ifdef USE_FIPS
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+ if(global->option.fips) {
+ if(!EVP_default_properties_is_fips_enabled(NULL)) {
+ if(!fips_available()) {
+ sslerror("FIPS PROVIDER");
+ return 1;
+ }
+ if(!EVP_default_properties_enable_fips(NULL, 1) ||
+ !EVP_default_properties_is_fips_enabled(NULL)) {
+ s_log(LOG_ERR, "Enabling FIPS provider failed");
+ return 1;
+ }
+ s_log(LOG_NOTICE, "FIPS provider enabled");
+ }
+ } else {
+ if(EVP_default_properties_is_fips_enabled(NULL)) {
+ if(!EVP_default_properties_enable_fips(NULL, 0) ||
+ EVP_default_properties_is_fips_enabled(NULL)) {
+ s_log(LOG_ERR, "Disabling FIPS provider failed");
+ return 1;
+ }
+ s_log(LOG_NOTICE, "FIPS provider disabled");
+ }
+ }
+#else /* OPENSSL_VERSION_NUMBER >= 0x30000000L */
 if(FIPS_mode()!=global->option.fips) {
 RAND_set_rand_method(NULL); /* reset RAND methods */
 if(!FIPS_mode_set(global->option.fips)) {
@@ -132,15 +320,30 @@
 return 1;
 }
 }
+#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */
 s_log(LOG_NOTICE, "FIPS mode %s",
 global->option.fips ? "enabled" : "disabled");
 #endif /* USE_FIPS */
+
 #ifndef OPENSSL_NO_COMP
- if(compression_init(global))
+ if(compression_set(global))
 return 1;
+ compression_list();
 #endif /* OPENSSL_NO_COMP */
 if(prng_init(global))
 return 1;
+
+#ifndef OPENSSL_NO_ENGINE
+ ENGINE_load_builtin_engines();
+#endif
+
+ /* cryptographic algoritms can only be configured once,
+ * after all the engines are initialized */
+#if OPENSSL_VERSION_NUMBER>=0x10100000L
+ OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
+#else
+ OpenSSL_add_all_algorithms();
+#endif
 return 0; /* SUCCESS */
 }
 
@@ -162,73 +365,94 @@
 
 #endif /* OPENSSL_VERSION_NUMBER<0x10100000L */
 
-NOEXPORT int compression_init(GLOBAL_OPTIONS *global) {
+#if OPENSSL_VERSION_NUMBER<0x10002000L
+
+NOEXPORT void SSL_COMP_set0_compression_methods(STACK_OF(SSL_COMP) *new_meths) {
+ STACK_OF(SSL_COMP) *old_meths;
+ int num, i;
+
+ old_meths=SSL_COMP_get_compression_methods();
+ sk_SSL_COMP_zero(old_meths);
+
+ num=sk_SSL_COMP_num(new_meths);
+ for(i=0; i<num; ++i)
+ sk_SSL_COMP_push(old_meths, sk_SSL_COMP_value(new_meths, i));
+}
+
+#endif /* OPENSSL_VERSION_NUMBER>=0x10002000L */
+
+NOEXPORT void compression_init() {
 STACK_OF(SSL_COMP) *methods;
- int num_methods, i;
+ COMP_METHOD *zlib;
 
+ memset(comp_methods, 0, sizeof comp_methods);
+
+ /* setup COMP_NONE */
+ comp_methodsCOMP_NONE=sk_SSL_COMP_new_null();
+
+ /* setup COMP_DEFLATE (RFC 1951) */
 methods=SSL_COMP_get_compression_methods();
- if(!methods) {
- if(global->compression==COMP_NONE) {
- s_log(LOG_NOTICE, "Failed to get compression methods");
- return 0; /* ignore */
- } else {
- s_log(LOG_ERR, "Failed to get compression methods");
- return 1;
- }
- }
+ if(!methods || !sk_SSL_COMP_num(methods))
+ return;
+ comp_methodsCOMP_DEFLATE=sk_SSL_COMP_dup(methods);
 
- if(global->compression==COMP_NONE) {
- /* delete OpenSSL defaults (empty the SSL_COMP stack) */
- /* cannot use sk_SSL_COMP_pop_free,
- * as it also destroys the stack itself */
- /* only leave the standard RFC 1951 (DEFLATE) algorithm,
- * if any of the private algorithms is enabled */
- while(sk_SSL_COMP_num(methods))
- OPENSSL_free(sk_SSL_COMP_pop(methods));
- s_log(LOG_DEBUG, "Compression disabled");
- return 0; /* success */
- }
+ /* setup COMP_ZLIB (DEFLATE + obsolete private id 0xe0) */
+ zlib=COMP_zlib();
+ if(!zlib || COMP_get_type(zlib)==NID_undef)
+ return;
+ if(SSL_COMP_add_compression_method(0xe0, zlib))
+ return;
+ comp_methodsCOMP_ZLIB=methods; /* reuse the memory */
+}
 
- if(!sk_SSL_COMP_num(methods)) {
- s_log(LOG_ERR, "No compression method is available");
+NOEXPORT int compression_set(GLOBAL_OPTIONS *global) {
+ if(!comp_methodsglobal->compression) {
+ s_log(LOG_ERR, "Configured compression is unsupported by OpenSSL");
 return 1;
 }
+ SSL_COMP_set0_compression_methods(comp_methodsglobal->compression);
+ return 0; /* success */
+}
 
- /* also insert the obsolete ZLIB algorithm */
- if(global->compression==COMP_ZLIB) {
- /* 224 - within the private range (193 to 255) */
- COMP_METHOD *meth=COMP_zlib();
- if(!meth || COMP_get_type(meth)==NID_undef) {
- s_log(LOG_ERR, "ZLIB compression is not supported");
- return 1;
- }
- if(SSL_COMP_add_compression_method(0xe0, meth)) {
- sslerror("SSL_COMP_add_compression_method");
- return 1;
- }
- }
+NOEXPORT void compression_list() {
+ STACK_OF(SSL_COMP) *methods;
+ int num_methods, i;
 
+ methods=SSL_COMP_get_compression_methods();
 num_methods=sk_SSL_COMP_num(methods);
+ if(!num_methods) {
+ s_log(LOG_INFO, "Compression disabled");
+ return;
+ }
 s_log(LOG_INFO, "Compression enabled: %d method%s",
 num_methods, num_methods==1 ? "" : "s");
 for(i=0; i<num_methods; ++i) {
- SSL_COMP *comp=sk_SSL_COMP_value(methods, i);
- if(comp) {
- const char *name=SSL_COMP_get0_name(comp);
- /* see OpenSSL commit 847406923534dd791f73d0cda15d3f17f513f2a5 */
- if(!name)
- name="unknown";
- s_log(LOG_INFO, "Compression id 0x%02x: %s",
- SSL_COMP_get_id(comp), name);
- }
+ SSL_COMP *comp;
+ const char *name;
+
+ comp=sk_SSL_COMP_value(methods, i);
+ if(!comp)
+ continue;
+ name=SSL_COMP_get0_name(comp);
+ /* see OpenSSL commit 847406923534dd791f73d0cda15d3f17f513f2a5 */
+ if(!name)
+ name="unknown";
+ s_log(LOG_INFO, "Compression id 0x%02x: %s",
+ SSL_COMP_get_id(comp), name);
 }
- return 0; /* success */
 }
 #endif /* OPENSSL_NO_COMP */
 
 NOEXPORT int prng_init(GLOBAL_OPTIONS *global) {
 int totbytes=0;
 char filename256;
+ const RAND_METHOD *meth=RAND_get_rand_method();
+
+ /* skip PRNG initialization when no seeding methods are available */
+ if(meth==NULL || meth->status==NULL || meth->add==NULL) {
+ s_log(LOG_DEBUG, "No PRNG seeding methods");
+ return 0; /* success */
+ }
 
 if(RAND_status()) {
 s_log(LOG_DEBUG, "No PRNG seeding was required");

_service:tar_scm:stunnel-5.48.tar.gz/src/sthreads.c -> _service:tar_scm:stunnel-5.69.tar.gz/src/sthreads.c Changed

@@ -1,6 +1,6 @@
 /*
 * stunnel TLS offloading and load-balancing proxy
- * Copyright (C) 1998-2018 Michal Trojnara <Michal.Trojnara@stunnel.org>
+ * Copyright (C) 1998-2023 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
@@ -40,9 +40,17 @@
 #include <os2.h>
 #endif
 
-#include "common.h"
 #include "prototypes.h"
 
+/**************************************** prototypes */
+
+NOEXPORT void thread_id_init(void);
+NOEXPORT void locking_init(void);
+#ifndef USE_FORK
+CLI *thread_head=NULL;
+NOEXPORT void thread_list_add(CLI *);
+#endif
+
 /**************************************** thread ID callbacks */
 
 #ifdef USE_UCONTEXT
@@ -103,11 +111,11 @@
 }
 #endif
 
-void thread_id_init(void) {
+NOEXPORT void thread_id_init() {
 #if OPENSSL_VERSION_NUMBER>=0x10000000L && OPENSSL_VERSION_NUMBER<0x10100000L
 CRYPTO_THREADID_set_callback(threadid_func);
 #endif
-#if OPENSSL_VERSION_NUMBER<0x10000000L || !defined(OPENSSL_NO_DEPRECATED)
+#if OPENSSL_VERSION_NUMBER<0x10000000L
 CRYPTO_set_id_callback(stunnel_thread_id);
 #endif
 }
@@ -122,36 +130,61 @@
 NOEXPORT void s_lock_init_debug(struct CRYPTO_dynlock_value *lock,
 const char *file, int line) {
 pthread_rwlock_init(&lock->rwlock, NULL);
+#ifdef DEBUG_LOCKS
 lock->init_file=file;
 lock->init_line=line;
+#else
+ (void)file; /* squash the unused parameter warning */
+ (void)line; /* squash the unused parameter warning */
+#endif
 }
 
 NOEXPORT void s_read_lock_debug(struct CRYPTO_dynlock_value *lock,
 const char *file, int line) {
 pthread_rwlock_rdlock(&lock->rwlock);
+#ifdef DEBUG_LOCKS
 lock->read_lock_file=file;
 lock->read_lock_line=line;
+#else
+ (void)file; /* squash the unused parameter warning */
+ (void)line; /* squash the unused parameter warning */
+#endif
 }
 
 NOEXPORT void s_write_lock_debug(struct CRYPTO_dynlock_value *lock,
 const char *file, int line) {
 pthread_rwlock_wrlock(&lock->rwlock);
+#ifdef DEBUG_LOCKS
 lock->write_lock_file=file;
 lock->write_lock_line=line;
+#else
+ (void)file; /* squash the unused parameter warning */
+ (void)line; /* squash the unused parameter warning */
+#endif
 }
 
 NOEXPORT void s_unlock_debug(struct CRYPTO_dynlock_value *lock,
 const char *file, int line) {
 pthread_rwlock_unlock(&lock->rwlock);
+#ifdef DEBUG_LOCKS
 lock->unlock_file=file;
 lock->unlock_line=line;
+#else
+ (void)file; /* squash the unused parameter warning */
+ (void)line; /* squash the unused parameter warning */
+#endif
 }
 
 NOEXPORT void s_lock_destroy_debug(struct CRYPTO_dynlock_value *lock,
 const char *file, int line) {
 pthread_rwlock_destroy(&lock->rwlock);
+#ifdef DEBUG_LOCKS
 lock->destroy_file=file;
 lock->destroy_line=line;
+#else
+ (void)file; /* squash the unused parameter warning */
+ (void)line; /* squash the unused parameter warning */
+#endif
 str_free(lock);
 }
 
@@ -166,36 +199,61 @@
 NOEXPORT void s_lock_init_debug(struct CRYPTO_dynlock_value *lock,
 const char *file, int line) {
 InitializeCriticalSection(&lock->critical_section);
+#ifdef DEBUG_LOCKS
 lock->init_file=file;
 lock->init_line=line;
+#else
+ (void)file; /* squash the unused parameter warning */
+ (void)line; /* squash the unused parameter warning */
+#endif
 }
 
 NOEXPORT void s_read_lock_debug(struct CRYPTO_dynlock_value *lock,
 const char *file, int line) {
 EnterCriticalSection(&lock->critical_section);
+#ifdef DEBUG_LOCKS
 lock->read_lock_file=file;
 lock->read_lock_line=line;
+#else
+ (void)file; /* squash the unused parameter warning */
+ (void)line; /* squash the unused parameter warning */
+#endif
 }
 
 NOEXPORT void s_write_lock_debug(struct CRYPTO_dynlock_value *lock,
 const char *file, int line) {
 EnterCriticalSection(&lock->critical_section);
+#ifdef DEBUG_LOCKS
 lock->write_lock_file=file;
 lock->write_lock_line=line;
+#else
+ (void)file; /* squash the unused parameter warning */
+ (void)line; /* squash the unused parameter warning */
+#endif
 }
 
 NOEXPORT void s_unlock_debug(struct CRYPTO_dynlock_value *lock,
 const char *file, int line) {
 LeaveCriticalSection(&lock->critical_section);
+#ifdef DEBUG_LOCKS
 lock->unlock_file=file;
 lock->unlock_line=line;
+#else
+ (void)file; /* squash the unused parameter warning */
+ (void)line; /* squash the unused parameter warning */
+#endif
 }
 
 NOEXPORT void s_lock_destroy_debug(struct CRYPTO_dynlock_value *lock,
 const char *file, int line) {
 DeleteCriticalSection(&lock->critical_section);
+#ifdef DEBUG_LOCKS
 lock->destroy_file=file;
 lock->destroy_line=line;
+#else
+ (void)file; /* squash the unused parameter warning */
+ (void)line; /* squash the unused parameter warning */
+#endif
 str_free(lock);
 }
 
@@ -208,11 +266,12 @@
 #if !defined(USE_OS_THREADS)
 /* no synchronization is needed */
 return *val+=amount;
-#elif defined(__GNUC__) && defined(__ATOMIC_ACQ_REL)
+#elif defined(__ATOMIC_ACQ_REL)
 if(__atomic_is_lock_free(sizeof *val, val))
 return __atomic_add_fetch(val, amount, __ATOMIC_ACQ_REL);
 #elif defined(_MSC_VER)
- return InterlockedExchangeAdd(val, amount)+amount;
+ /* casting is safe, because sizeof(long)==sizeof(int) on Windows */
+ return InterlockedExchangeAdd((long *)val, amount)+amount;
 #endif
 CRYPTO_THREAD_write_lock(lock);
 ret=(*val+=amount);
@@ -256,7 +315,6 @@
 NOEXPORT void s_dynlock_destroy_cb(struct CRYPTO_dynlock_value *lock,
 const char *file, int line) {
 s_lock_destroy_debug(lock, file, line);
- str_free(lock);
 }
 
 NOEXPORT void s_locking_cb(int mode, int type, const char *file, int line) {
@@ -295,7 +353,6 @@
 
 void CRYPTO_THREAD_lock_free(CRYPTO_RWLOCK *lock) {
 s_lock_destroy_debug(lock, __FILE__, __LINE__);
- str_free(lock);
 }
 
 #else /* USE_OS_THREADS */
@@ -332,7 +389,7 @@
 
 #endif /* OPENSSL_VERSION_NUMBER<0x10100004L */
 
-void locking_init(void) {
+NOEXPORT void locking_init() {
 size_t i;
 #if defined(USE_OS_THREADS) && OPENSSL_VERSION_NUMBER<0x10100004L
 size_t num;
@@ -458,6 +515,7 @@
 context->context.uc_stack.ss_flags=0;
 
 makecontext(&context->context, (void(*)(void))client_thread, ARGC, arg);
+ thread_list_add(arg);
 s_log(LOG_DEBUG, "New context created");
 return 0;
 }
@@ -502,14 +560,25 @@
 
 #ifdef USE_PTHREAD
 
+NOEXPORT void *dummy_thread(void *arg) {
+ pthread_exit(arg);
+ return arg;
+}
+
 int sthreads_init(void) {
+ pthread_t thread_id;
+
+ /* this is a workaround for NPTL threads failing to invoke
+ * pthread_exit() or pthread_cancel() from a chroot jail */
+ if(!pthread_create(&thread_id, NULL, dummy_thread, NULL))
+ pthread_join(thread_id, NULL);
+
 thread_id_init();
 locking_init();
 return 0;
 }
 
 int create_client(SOCKET ls, SOCKET s, CLI *arg) {
- pthread_t thread;
 pthread_attr_t pth_attr;
 int error;
 #if defined(HAVE_PTHREAD_SIGMASK) && !defined(__APPLE__)
@@ -528,22 +597,25 @@
 pthread_sigmask(SIG_SETMASK, &new_set, &old_set); /* block signals */
 #endif /* HAVE_PTHREAD_SIGMASK && !__APPLE__*/
 pthread_attr_init(&pth_attr);
- pthread_attr_setdetachstate(&pth_attr, PTHREAD_CREATE_DETACHED);
 pthread_attr_setstacksize(&pth_attr, arg->opt->stack_size);
- error=pthread_create(&thread, &pth_attr, client_thread, arg);
+
+ CRYPTO_THREAD_write_lock(stunnel_locksLOCK_THREAD_LIST);
+ error=pthread_create(&arg->thread_id, &pth_attr, client_thread, arg);
 pthread_attr_destroy(&pth_attr);
 #if defined(HAVE_PTHREAD_SIGMASK) && !defined(__APPLE__)
 pthread_sigmask(SIG_SETMASK, &old_set, NULL); /* unblock signals */
 #endif /* HAVE_PTHREAD_SIGMASK && !__APPLE__*/
-
 if(error) {
 errno=error;
 ioerror("pthread_create");
+ CRYPTO_THREAD_unlock(stunnel_locksLOCK_THREAD_LIST);
 str_free(arg);
 if(s>=0)
 closesocket(s);
 return -1;
 }
+ thread_list_add(arg);
+ CRYPTO_THREAD_unlock(stunnel_locksLOCK_THREAD_LIST);
 return 0;
 }
 
@@ -562,20 +634,22 @@
 }
 
 int create_client(SOCKET ls, SOCKET s, CLI *arg) {
- HANDLE thread;
-
 (void)ls; /* this parameter is only used with USE_FORK */
 s_log(LOG_DEBUG, "Creating a new thread");
- thread=(HANDLE)_beginthreadex(NULL, (unsigned)arg->opt->stack_size,
- client_thread, arg, 0, NULL);
- if(!thread) {
+ CRYPTO_THREAD_write_lock(stunnel_locksLOCK_THREAD_LIST);
+ arg->thread_id=(HANDLE)_beginthreadex(NULL,
+ (unsigned)arg->opt->stack_size, client_thread, arg,
+ STACK_SIZE_PARAM_IS_A_RESERVATION, NULL);
+ if(!arg->thread_id) {
 ioerror("_beginthreadex");
+ CRYPTO_THREAD_unlock(stunnel_locksLOCK_THREAD_LIST);
 str_free(arg);
 if(s!=INVALID_SOCKET)
 closesocket(s);
 return -1;
 }
- CloseHandle(thread);
+ thread_list_add(arg);
+ CRYPTO_THREAD_unlock(stunnel_locksLOCK_THREAD_LIST);
 s_log(LOG_DEBUG, "New thread created");
 return 0;
 }
@@ -623,7 +697,7 @@
 void *arglist, unsigned initflag, unsigned *thrdaddr) {
 return CreateThread(NULL, stack_size,
 (LPTHREAD_START_ROUTINE)start_address, arglist,
- STACK_SIZE_PARAM_IS_A_RESERVATION, NULL);
+ (DWORD)initflag, (LPDWORD)thrdaddr);
 }
 
 void _endthreadex(unsigned retval) {
@@ -634,47 +708,103 @@
 
 #ifdef DEBUG_STACK_SIZE
 
-#define STACK_RESERVE (STACK_SIZE/8)
-#define VERIFY_AREA ((STACK_SIZE-STACK_RESERVE)/sizeof(uint32_t))
-#define TEST_VALUE 0xdeadbeef
+#define STACK_RESERVE 16384
 
 /* some heuristic to determine the usage of client stack size */
-void stack_info(int init) { /* 1-initialize, 0-display */
- uint32_t tableVERIFY_AREA;
- int i, num;
- static int min_num=VERIFY_AREA;
+NOEXPORT size_t stack_num(size_t stack_size, int init) {
+#ifdef _WIN64
+ typedef unsigned long long TL;
+#else
+ typedef unsigned long TL;
+#endif
+ size_t verify_area, verify_num, i;
+ TL test_value, *table;
+
+ if(stack_size<STACK_RESERVE)
+ return 0;
+ verify_area=(stack_size-STACK_RESERVE)&~(sizeof(TL)-1);
+ verify_num=verify_area/sizeof(TL);
+ test_value=(TL)0x1337deadbeef1337;
+ table=alloca(verify_area);
 
 if(init) {
- for(i=0; i<VERIFY_AREA; i++)
- tablei=TEST_VALUE;
+ for(i=0; i<verify_num; i++)
+ tablei=test_value;
+ ignore_value(table); /* prevent code optimization */
+ return 0;
 } else {
 /* the stack grows down */
- for(i=0; i<VERIFY_AREA; i++)
- if(tablei!=TEST_VALUE)
+ for(i=0; i<verify_num; i++)
+ if(tablei!=test_value)
 break;
- num=i;
+ if(i>=16)
+ return stack_size-i*sizeof(TL);
 /* the stack grows up */
- for(i=0; i<VERIFY_AREA; i++)
- if(tableVERIFY_AREA-i-1!=TEST_VALUE)
+ for(i=0; i<verify_num; i++)
+ if(tableverify_num-i-1!=test_value)
 break;
- if(i>num) /* use the higher value */
- num=i;
- if(num<64) {
- s_log(LOG_NOTICE, "STACK_RESERVE is too high");
- return;
- }
- if(num<min_num)
- min_num=num;
- s_log(LOG_NOTICE,
- "stack_info: size=%d, current=%d (%d%%), maximum=%d (%d%%)",
- STACK_SIZE,
- (int)((VERIFY_AREA-num)*sizeof(uint32_t)),
- (int)((VERIFY_AREA-num)*sizeof(uint32_t)*100/STACK_SIZE),
- (int)((VERIFY_AREA-min_num)*sizeof(uint32_t)),
- (int)((VERIFY_AREA-min_num)*sizeof(uint32_t)*100/STACK_SIZE));
+ if(i>=16)
+ return stack_size-(i*sizeof(TL)+STACK_RESERVE);
+ return 0; /* not enough samples for meaningful results */
 }
 }
 
+#ifdef __GNUC__
+#if __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 6)
+#pragma GCC diagnostic push
+#endif /* __GNUC__>=4.6 */
+#pragma GCC diagnostic ignored "-Wformat"
+#endif /* __GNUC__ */
+void stack_info(size_t stack_size, int init) { /* 1-initialize, 0-display */
+ static size_t max_num=0;
+ size_t num;
+
+#ifdef USE_WIN32
+ SYSTEM_INFO si;
+ GetSystemInfo(&si);
+ stack_size&=~((size_t)si.dwPageSize-1);
+#elif defined(_SC_PAGESIZE)
+ stack_size&=~((size_t)sysconf(_SC_PAGESIZE)-1);
+#elif defined(_SC_PAGE_SIZE)
+ stack_size&=~((size_t)sysconf(_SC_PAGE_SIZE)-1);
+#else
+ stack_size&=~(4096-1); /* just a guess */
+#endif
+ num=stack_num(stack_size, init);
+ if(init)
+ return;
+ if(!num) {
+ s_log(LOG_NOTICE, "STACK_RESERVE is too high");
+ return;
+ }
+ if(num>max_num)
+ max_num=num;
+ s_log(LOG_NOTICE,
+#ifdef USE_WIN32
+ "stack_info: size=%Iu, current=%Iu (%Iu%%), maximum=%Iu (%Iu%%)",
+#else
+ "stack_info: size=%zu, current=%zu (%zu%%), maximum=%zu (%zu%%)",
+#endif
+ stack_size,
+ num, num*100/stack_size,
+ max_num, max_num*100/stack_size);
+}
+#ifdef __GNUC__
+#if __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 6)
+#pragma GCC diagnostic pop
+#endif /* __GNUC__>=4.6 */
+#endif /* __GNUC__ */
+
 #endif /* DEBUG_STACK_SIZE */
 
+#ifndef USE_FORK
+NOEXPORT void thread_list_add(CLI *c) {
+ c->thread_next=thread_head;
+ c->thread_prev=NULL;
+ if(thread_head)
+ thread_head->thread_prev=c;
+ thread_head=c;
+}
+#endif /* !USE_FORK */
+
 /* end of sthreads.c */

_service:tar_scm:stunnel-5.48.tar.gz/src/str.c -> _service:tar_scm:stunnel-5.69.tar.gz/src/str.c Changed

@@ -1,6 +1,6 @@
 /*
 * stunnel TLS offloading and load-balancing proxy
- * Copyright (C) 1998-2018 Michal Trojnara <Michal.Trojnara@stunnel.org>
+ * Copyright (C) 1998-2023 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
@@ -35,7 +35,6 @@
 * forward this exception.
 */
 
-#include "common.h"
 #include "prototypes.h"
 
 /* Uncomment to see allocation sources in core dumps */
@@ -61,6 +60,7 @@
 
 /* most platforms require allocations to be aligned */
 #ifdef _MSC_VER
+#pragma warning(disable: 4324)
 __declspec(align(16))
 #endif
 struct alloc_list_struct {
@@ -84,13 +84,18 @@
 
 #define LEAK_TABLE_SIZE 997
 typedef struct {
+ int num, max; /* current and highest number of allocations */
+ int64_t total; /* approximate total number of heap operations */
 const char *alloc_file;
 int alloc_line;
- int num, max;
 } LEAK_ENTRY;
 NOEXPORT LEAK_ENTRY leak_hash_tableLEAK_TABLE_SIZE,
 *leak_resultsLEAK_TABLE_SIZE;
-NOEXPORT volatile int leak_result_num=0;
+NOEXPORT int leak_result_num=0;
+
+#if OPENSSL_VERSION_NUMBER >= 0x10101000L
+DEFINE_STACK_OF(LEAK_ENTRY)
+#endif /* OpenSSL version >= 1.1.1 */
 
 #ifdef USE_WIN32
 NOEXPORT LPTSTR str_vtprintf(LPCTSTR, va_list);
@@ -102,8 +107,9 @@
 NOEXPORT void str_leak_debug(const ALLOC_LIST *, int);
 
 NOEXPORT LEAK_ENTRY *leak_search(const ALLOC_LIST *);
-NOEXPORT void leak_report();
-NOEXPORT long leak_threshold();
+NOEXPORT int leak_cmp(const LEAK_ENTRY *const *, const LEAK_ENTRY *const *);
+NOEXPORT void leak_report(void);
+NOEXPORT long leak_threshold(void);
 
 TLS_DATA *ui_tls;
 NOEXPORT uint8_t canary10; /* 80-bit canary value */
@@ -111,14 +117,6 @@
 
 /**************************************** string manipulation functions */
 
-#ifndef va_copy
-#ifdef __va_copy
-#define va_copy(dst, src) __va_copy((dst), (src))
-#else /* __va_copy */
-#define va_copy(dst, src) memcpy(&(dst), &(src), sizeof(va_list))
-#endif /* __va_copy */
-#endif /* va_copy */
-
 char *str_dup_debug(const char *str, const char *file, int line) {
 char *retval;
 
@@ -157,7 +155,7 @@
 #endif /* __GNUC__ */
 char *str_vprintf(const char *format, va_list start_ap) {
 int n;
- size_t size=32;
+ size_t size=96;
 char *p;
 va_list ap;
 
@@ -213,12 +211,16 @@
 
 /**************************************** memory allocation wrappers */
 
-void str_init(TLS_DATA *tls_data) {
+void str_init(void) {
+ memset(leak_hash_table, 0, sizeof leak_hash_table);
+}
+
+void str_thread_init(TLS_DATA *tls_data) {
 tls_data->alloc_head=NULL;
 tls_data->alloc_bytes=tls_data->alloc_blocks=0;
 }
 
-void str_cleanup(TLS_DATA *tls_data) {
+void str_thread_cleanup(TLS_DATA *tls_data) {
 /* free all attached allocations */
 while(tls_data->alloc_head) /* str_free macro requires an lvalue */
 str_free_expression(tls_data->alloc_head+1);
@@ -394,6 +396,19 @@
 }
 }
 
+/* Here be dragons:
+ * this is an ugly hack to work around OpenSSL API that requires const
+ * function parameters -> use it with extreme caution */
+void str_detach_const_debug(const void *ptr, const char *file, int line) {
+ union {
+ const void *c;
+ void *v;
+ } u;
+
+ u.c=ptr;
+ str_detach_debug(u.v, file, line);
+}
+
 void str_free_debug(void *ptr, const char *file, int line) {
 ALLOC_LIST *alloc_list;
 
@@ -419,6 +434,19 @@
 system_free(alloc_list);
 }
 
+/* Here be dragons:
+ * this is an ugly hack to work around OpenSSL API that requires const
+ * function parameters -> use it with extreme caution */
+void str_free_const_debug(const void *ptr, const char *file, int line) {
+ union {
+ const void *c;
+ void *v;
+ } u;
+
+ u.c=ptr;
+ str_free_debug(u.v, file, line);
+}
+
 NOEXPORT ALLOC_LIST *get_alloc_list_ptr(void *ptr, const char *file, int line) {
 ALLOC_LIST *alloc_list;
 
@@ -443,6 +471,8 @@
 int new_entry;
 int allocations;
 
+ if(service_options.log_level<LOG_DEBUG) /* performance optimization */
+ return;
 #ifdef USE_OS_THREADS
 if(!stunnel_locksSTUNNEL_LOCKS-1) /* threads not initialized */
 return;
@@ -470,20 +500,24 @@
 CRYPTO_THREAD_unlock(stunnel_locksLOCK_LEAK_HASH);
 }
 
- /* for performance we try to avoid calling CRYPTO_atomic_add() here */
+ /* for performance reasons, we ignore the race condition, as an approximate
+ * number of allocations is good enough to identify the most used entries */
+ entry->total++;
+
+ /* for performance reasons, we try to avoid calling CRYPTO_atomic_add() */
 #ifdef USE_OS_THREADS
-#if defined(__GNUC__) && defined(__ATOMIC_ACQ_REL)
+#ifdef _MSC_VER
+ /* casting is safe, because sizeof(long)==sizeof(int) on Windows */
+ allocations=InterlockedExchangeAdd((long *)&entry->num, change)+change;
+#else /* defined(_MSC_VER) */
+#ifdef __ATOMIC_ACQ_REL
 if(__atomic_is_lock_free(sizeof entry->num, &entry->num))
 allocations=__atomic_add_fetch(&entry->num, change, __ATOMIC_ACQ_REL);
- else
+ else /* atomic add not directly supported by the compiler */
+#endif /* defined(__ATOMIC_ACQ_REL) */
 CRYPTO_atomic_add(&entry->num, change, &allocations,
 stunnel_locksLOCK_LEAK_HASH);
-#elif defined(_MSC_VER)
- allocations=InterlockedExchangeAdd(&entry->num, change)+change;
-#else /* atomic add not directly supported by the compiler */
- CRYPTO_atomic_add(&entry->num, change, &allocations,
- stunnel_locksLOCK_LEAK_HASH);
-#endif
+#endif /* defined(_MSC_VER) */
 #else /* USE_OS_THREADS */
 allocations=(entry->num+=change);
 #endif /* USE_OS_THREADS */
@@ -499,20 +533,16 @@
 /* we *may* need to allocate a new leak_results entry */
 /* locking is slow, so we try to avoid it if possible */
 CRYPTO_THREAD_write_lock(stunnel_locksLOCK_LEAK_RESULTS);
- if(entry->max==0) { /* the table may have changed */
- leak_resultsleak_result_num=entry;
- entry->max=allocations;
- ++leak_result_num; /* at the end to avoid a lock in leak_report() */
- } else { /* gracefully handle the race condition */
- entry->max=allocations;
- }
+ if(entry->max==0) /* the table may have changed */
+ leak_resultsleak_result_num++=entry;
+ entry->max=allocations;
 CRYPTO_THREAD_unlock(stunnel_locksLOCK_LEAK_RESULTS);
 }
 
 /* O(1) hash table lookup */
 NOEXPORT LEAK_ENTRY *leak_search(const ALLOC_LIST *alloc_list) {
 /* a trivial hash based on source file name *address* and line number */
- unsigned i=((unsigned)(uintptr_t)alloc_list->alloc_file+
+ unsigned i=(1777*(unsigned)(uintptr_t)alloc_list->alloc_file+
 (unsigned)alloc_list->alloc_line)%LEAK_TABLE_SIZE;
 
 while(!(leak_hash_tablei.alloc_line==0 ||
@@ -524,18 +554,48 @@
 
 void leak_table_utilization() {
 int i, utilization=0;
+ int64_t grand_total=0;
+#if OPENSSL_VERSION_NUMBER >= 0x10101000L
+ STACK_OF(LEAK_ENTRY) *stats;
+#endif /* OpenSSL version >= 1.1.1 */
 
- for(i=0; i<LEAK_TABLE_SIZE; ++i) {
- if(leak_hash_tablei.alloc_line) {
+ /* leak_hash_table is only filled at the DEBUG logging level */
+ if(service_options.log_level<LOG_DEBUG)
+ return;
+
+ /* log total hash table utilization */
+ for(i=0; i<LEAK_TABLE_SIZE; ++i)
+ if(leak_hash_tablei.total) {
 ++utilization;
-#if 0
- s_log(LOG_DEBUG, "Leak hash entry %d: %s:%d", i,
- leak_hash_tablei.alloc_file, leak_hash_tablei.alloc_line);
-#endif
+ grand_total+=leak_hash_tablei.total;
 }
- }
- s_log(LOG_DEBUG, "Leak detection table utilization: %d/%d, %02.2f%%",
+ s_log(LOG_DEBUG, "Leak detection table utilization: %d/%d (%05.2f%%)",
 utilization, LEAK_TABLE_SIZE, 100.0*utilization/LEAK_TABLE_SIZE);
+
+#if OPENSSL_VERSION_NUMBER >= 0x10101000L
+ /* log up to 5 most frequently used heap allocations */
+ stats=sk_LEAK_ENTRY_new_reserve(leak_cmp, utilization);
+ for(i=0; i<LEAK_TABLE_SIZE; ++i)
+ if(leak_hash_tablei.total)
+ sk_LEAK_ENTRY_push(stats, leak_hash_table + i);
+ sk_LEAK_ENTRY_sort(stats);
+ for(i=0; i<5 && sk_LEAK_ENTRY_num(stats); ++i) {
+ LEAK_ENTRY *entry=sk_LEAK_ENTRY_pop(stats);
+ s_log(LOG_DEBUG, "#%d: %05.2f%% of heap operations: %s:%d",
+ i+1, 100.0*(double)entry->total/(double)grand_total,
+ entry->alloc_file, entry->alloc_line);
+ }
+ sk_LEAK_ENTRY_free(stats);
+#endif /* OpenSSL version >= 1.1.1 */
+}
+
+NOEXPORT int leak_cmp(const LEAK_ENTRY *const *a, const LEAK_ENTRY *const *b) {
+ int64_t d = (*a)->total - (*b)->total;
+ if(d>0)
+ return 1;
+ if(d<0)
+ return -1;
+ return 0;
 }
 
 /* report identified leaks */
@@ -544,12 +604,15 @@
 long limit;
 
 limit=leak_threshold();
+
+ CRYPTO_THREAD_read_lock(stunnel_locksLOCK_LEAK_RESULTS);
 for(i=0; i<leak_result_num; ++i)
 if(leak_resultsi /* an officious compiler could reorder code */ &&
 leak_resultsi->max>limit /* the limit could have changed */)
 s_log(LOG_WARNING, "Possible memory leak at %s:%d: %d allocations",
 leak_resultsi->alloc_file, leak_resultsi->alloc_line,
 leak_resultsi->max);
+ CRYPTO_THREAD_unlock(stunnel_locksLOCK_LEAK_RESULTS);
 }
 
 NOEXPORT long leak_threshold() {
@@ -567,11 +630,34 @@
 /* a version of memcmp() with execution time not dependent on data values */
 /* it does *not* allow testing whether s1 is greater or lesser than s2 */
 int safe_memcmp(const void *s1, const void *s2, size_t n) {
- uint8_t *p1=(uint8_t *)s1, *p2=(uint8_t *)s2;
- int r=0;
+#ifdef _WIN64
+ typedef unsigned long long TL;
+#else
+ typedef unsigned long TL;
+#endif
+ typedef unsigned char TS;
+ TL r=0;
+ const TL *pl1, *pl2;
+ const TS *ps1, *ps2;
+ int n1=(int)((uintptr_t)s1&(sizeof(TL)-1)); /* unaligned bytes in s1 */
+ int n2=(int)((uintptr_t)s2&(sizeof(TL)-1)); /* unaligned bytes in s2 */
+
+ if(n1 || n2) { /* either pointer unaligned */
+ ps1=(const TS *)s1;
+ ps2=(const TS *)s2;
+ } else { /* both pointers aligned -> compare full words */
+ pl1=(const TL *)s1;
+ pl2=(const TL *)s2;
+ while(n>=sizeof(TL)) {
+ n-=sizeof(TL);
+ r|=(*pl1++)^(*pl2++);
+ }
+ ps1=(const TS *)pl1;
+ ps2=(const TS *)pl2;
+ }
 while(n--)
- r|=(*p1++)^(*p2++);
- return r;
+ r|=(*ps1++)^(*ps2++);
+ return r!=0;
 }
 
 /* end of str.c */

_service:tar_scm:stunnel-5.48.tar.gz/src/stunnel.c -> _service:tar_scm:stunnel-5.69.tar.gz/src/stunnel.c Changed

@@ -1,6 +1,6 @@
 /*
 * stunnel TLS offloading and load-balancing proxy
- * Copyright (C) 1998-2018 Michal Trojnara <Michal.Trojnara@stunnel.org>
+ * Copyright (C) 1998-2023 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
@@ -35,7 +35,6 @@
 * forward this exception.
 */
 
-#include "common.h"
 #include "prototypes.h"
 
 /* http://www.openssl.org/support/faq.html#PROG2 */
@@ -68,24 +67,32 @@
 };
 #endif
 
+NOEXPORT void terminate_threads(void);
 #if !defined(USE_WIN32) && !defined(USE_OS2)
 NOEXPORT void pid_status_nohang(const char *);
 NOEXPORT void status_info(int, int, const char *);
 #endif
 NOEXPORT int accept_connection(SERVICE_OPTIONS *, unsigned);
 NOEXPORT int exec_connect_start(void);
+NOEXPORT void unbind_ports(void);
 NOEXPORT void unbind_port(SERVICE_OPTIONS *, unsigned);
+NOEXPORT int bind_ports(void);
 NOEXPORT SOCKET bind_port(SERVICE_OPTIONS *, int, unsigned);
 #ifdef HAVE_CHROOT
 NOEXPORT int change_root(void);
 #endif
-NOEXPORT int signal_pipe_init(void);
+NOEXPORT int pipe_init(SOCKET 2, const char *);
 NOEXPORT int signal_pipe_dispatch(void);
+NOEXPORT void reload_config(void);
+NOEXPORT int process_connections(void);
 NOEXPORT char *signal_name(int);
 
 /**************************************** global variables */
 
-static SOCKET signal_pipe2={INVALID_SOCKET, INVALID_SOCKET};
+SOCKET signal_pipe2={INVALID_SOCKET, INVALID_SOCKET};
+#ifdef USE_TERMINATE_PIPE
+SOCKET terminate_pipe2={INVALID_SOCKET, INVALID_SOCKET};
+#endif /* USE_TERMINATE_PIPE */
 
 #ifndef USE_FORK
 int max_clients=0;
@@ -115,19 +122,24 @@
 #endif
 /* basic initialization contains essential functions required for logging
 * subsystem to function properly, thus all errors here are fatal */
- if(ssl_init()) /* initialize TLS library */
+ if(ssl_init()) /* initialize libssl */
 fatal("TLS initialization failed");
 if(sthreads_init()) /* initialize critical sections & TLS callbacks */
 fatal("Threads initialization failed");
- options_defaults();
- options_apply();
+ options_defaults(); /* initialize defaults */
+ options_apply(); /* apply the defaults */
 #ifndef USE_FORK
 get_limits(); /* required by setup_fd() */
 #endif
 fds=s_poll_alloc();
- if(signal_pipe_init())
+ if(pipe_init(signal_pipe, "signal_pipe"))
 fatal("Signal pipe initialization failed: "
 "check your personal firewall");
+#ifdef USE_TERMINATE_PIPE
+ if(pipe_init(terminate_pipe, "terminate_pipe"))
+ fatal("Terminate pipe initialization failed: "
+ "check your personal firewall");
+#endif /* USE_TERMINATE_PIPE */
 stunnel_info(LOG_NOTICE);
 if(systemd_fds>0)
 s_log(LOG_INFO, "Systemd socket activation: %d descriptors received",
@@ -144,38 +156,53 @@
 int main_configure(char *arg1, char *arg2) {
 int cmdline_status;
 
+ log_flush(LOG_MODE_BUFFER);
 cmdline_status=options_cmdline(arg1, arg2);
- if(cmdline_status) /* cannot proceed */
+ if(cmdline_status) { /* cannot proceed */
+ log_flush(LOG_MODE_ERROR);
 return cmdline_status;
- options_apply();
+ }
+ options_free(1); /* free the defaults */
+ options_apply(); /* apply the new options */
 str_canary_init(); /* needs prng initialization from options_cmdline */
-#if !defined(USE_WIN32) && !defined(__vms)
- /* syslog_open() must be called before change_root()
+ /* log_open(SINK_SYSLOG) must be called before change_root()
 * to be able to access /dev/log socket */
- syslog_open();
-#endif /* !defined(USE_WIN32) && !defined(__vms) */
- if(bind_ports())
+ log_open(SINK_SYSLOG);
+ if(bind_ports()) { /* initial binding failed - restoring the defaults */
+ unbind_ports(); /* unbind the successfully bound ports */
+ options_free(1); /* free the current options */
+ options_defaults(); /* initialize defaults */
+ options_apply(); /* apply the defaults */
+ log_flush(LOG_MODE_ERROR);
 return 1;
+ }
 
 #ifdef HAVE_CHROOT
 /* change_root() must be called before drop_privileges()
 * since chroot() needs root privileges */
- if(change_root())
+ if(change_root()) {
+ log_flush(LOG_MODE_ERROR);
 return 1;
+ }
 #endif /* HAVE_CHROOT */
 
- if(drop_privileges(1))
+ if(drop_privileges(1)) {
+ log_flush(LOG_MODE_ERROR);
 return 1;
+ }
 
- /* log_open() must be called after drop_privileges()
+ /* log_open(SINK_OUTFILE) must be called after drop_privileges()
 * or logfile rotation won't be possible */
- /* log_open() must be called before daemonize()
- * since daemonize() invalidates stderr */
- if(log_open())
+ if(log_open(SINK_OUTFILE)) {
+ log_flush(LOG_MODE_ERROR);
 return 1;
+ }
 #ifndef USE_FORK
 num_clients=0; /* the first valid config */
 #endif
+ /* log_flush(LOG_MODE_CONFIGURED) must be called before daemonize()
+ * since daemonize() invalidates stderr */
+ log_flush(LOG_MODE_CONFIGURED);
 return 0;
 }
 
@@ -212,17 +239,75 @@
 }
 
 void main_cleanup() {
+ terminate_threads();
 unbind_ports();
 s_poll_free(fds);
 fds=NULL;
 #if 0
 str_stats(); /* main thread allocation tracking */
 #endif
- log_flush(LOG_MODE_ERROR);
-#if !defined(USE_WIN32) && !defined(__vms)
- syslog_close();
-#endif /* !defined(USE_WIN32) && !defined(__vms) */
+ log_flush(LOG_MODE_BUFFER); /* no more logs */
+ log_close(SINK_SYSLOG|SINK_OUTFILE);
+}
+
+#ifdef __GNUC__
+#if __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 6) || defined(__clang__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wunused-result"
+#endif /* __GNUC__>=4.6 */
+#endif /* __GNUC__ */
+NOEXPORT void terminate_threads() {
+#ifdef USE_TERMINATE_PIPE
+ CLI *c;
+ unsigned i, threads;
+ THREAD_ID *thread_list;
+
+ CRYPTO_THREAD_write_lock(stunnel_locksLOCK_THREAD_LIST);
+ threads=0;
+ for(c=thread_head; c; c=c->thread_next) /* count client threads */
+ threads++;
+ thread_list=str_alloc((threads+2)*sizeof(THREAD_ID));
+ i=0;
+ for(c=thread_head; c; c=c->thread_next) { /* copy client threads */
+ thread_listi++=c->thread_id;
+ s_log(LOG_DEBUG, "Terminating a thread for %s", c->opt->servname);
+ }
+ if(per_second_thread_id) { /* append per_second_thread_id if used */
+ thread_listthreads++=per_second_thread_id;
+ s_log(LOG_DEBUG, "Terminating the per-second thread");
+ }
+ if(per_day_thread_id) { /* append per_day_thread_id if used */
+ thread_listthreads++=per_day_thread_id;
+ s_log(LOG_DEBUG, "Terminating the per-day thread");
+ }
+ CRYPTO_THREAD_unlock(stunnel_locksLOCK_THREAD_LIST);
+
+ if(threads) {
+ s_log(LOG_INFO, "Terminating %u service thread(s)", threads);
+ writesocket(terminate_pipe1, "", 1);
+ for(i=0; i<threads; ++i) { /* join client threads */
+#ifdef USE_PTHREAD
+ if(pthread_join(thread_listi, NULL))
+ s_log(LOG_ERR, "pthread_join() failed");
+#endif
+#ifdef USE_WIN32
+ if(WaitForSingleObject(thread_listi, INFINITE)==WAIT_FAILED)
+ ioerror("WaitForSingleObject");
+ if(!CloseHandle(thread_listi))
+ ioerror("CloseHandle");
+#endif
+ }
+ s_log(LOG_INFO, "Service threads terminated");
+ }
+
+ str_free(thread_list);
+#endif /* USE_TERMINATE_PIPE */
 }
+#ifdef __GNUC__
+#if __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 6)
+#pragma GCC diagnostic pop
+#endif /* __GNUC__>=4.6 */
+#endif /* __GNUC__ */
 
 /**************************************** Unix-specific initialization */
 
@@ -280,6 +365,7 @@
 s_log(LOG_CRIT, "Failed to start exec+connect services");
 exit(1);
 }
+ s_log(LOG_INFO, "Accepting new connections");
 while(1) {
 int temporary_lack_of_resources=0;
 int num=s_poll_wait(fds, -1, -1);
@@ -309,7 +395,7 @@
 if(temporary_lack_of_resources) {
 s_log(LOG_NOTICE,
 "Accepting new connections suspended for 1 second");
- sleep(1); /* to avoid log trashing */
+ s_poll_sleep(1, 0); /* to avoid log trashing */
 }
 }
 leak_table_utilization();
@@ -400,22 +486,21 @@
 }
 
 /* clear fds, close old ports */
-void unbind_ports(void) {
+NOEXPORT void unbind_ports(void) {
 SERVICE_OPTIONS *opt;
 
- s_poll_init(fds);
- s_poll_add(fds, signal_pipe0, 1, 0);
+ s_poll_init(fds, 1);
 
- opt=service_options.next;
- service_options.next=NULL;
- service_free(&service_options);
-
- while(opt) {
+ for(opt=service_options.next; opt; opt=opt->next) {
 unsigned i;
+
 s_log(LOG_DEBUG, "Unbinding service %s", opt->servname);
+
+ /* "accept" service */
 for(i=0; i<opt->local_addr.num; ++i)
 unbind_port(opt, i);
- /* exec+connect service */
+
+ /* "exec+connect" service */
 if(opt->exec_name && opt->connect_addr.names) {
 /* create exec+connect services */
 /* FIXME: this is just a crude workaround */
@@ -423,20 +508,8 @@
 /* FIXME: this won't work with FORK threads */
 opt->option.retry=0;
 }
- /* purge session cache of the old SSL_CTX object */
- /* this workaround won't be needed anymore after */
- /* delayed deallocation calls SSL_CTX_free() */
- if(opt->ctx)
- SSL_CTX_flush_sessions(opt->ctx,
- (long)time(NULL)+opt->session_timeout+1);
- s_log(LOG_DEBUG, "Service %s closed", opt->servname);
 
- {
- SERVICE_OPTIONS *garbage=opt;
- opt=opt->next;
- garbage->next=NULL;
- service_free(garbage);
- }
+ s_log(LOG_DEBUG, "Service %s closed", opt->servname);
 }
 }
 
@@ -474,7 +547,7 @@
 }
 
 /* open new ports, update fds */
-int bind_ports(void) {
+NOEXPORT int bind_ports(void) {
 SERVICE_OPTIONS *opt;
 int listening_section;
 
@@ -486,8 +559,7 @@
 libwrap_init();
 #endif /* USE_LIBWRAP */
 
- s_poll_init(fds);
- s_poll_add(fds, signal_pipe0, 1, 0);
+ s_poll_init(fds, 1);
 
 /* allow clean unbind_ports() even though
 bind_ports() was not fully performed */
@@ -521,7 +593,7 @@
 s_log(LOG_DEBUG, "Skipped exec+connect service %s", opt->servname);
 #ifndef OPENSSL_NO_TLSEXT
 } else if(!opt->option.client && opt->sni) {
- s_log(LOG_DEBUG, "Skipped SNI slave service %s", opt->servname);
+ s_log(LOG_DEBUG, "Skipped SNI secondary service %s", opt->servname);
 #endif
 } else { /* each service must define two endpoints */
 s_log(LOG_ERR, "Invalid service %s", opt->servname);
@@ -540,7 +612,6 @@
 NOEXPORT SOCKET bind_port(SERVICE_OPTIONS *opt, int listening_section, unsigned i) {
 SOCKET fd;
 SOCKADDR_UNION *addr=opt->local_addr.addr+i;
- char *local_address;
 #ifdef HAVE_STRUCT_SOCKADDR_UN
 struct stat sb; /* buffer for lstat() */
 #endif
@@ -563,21 +634,22 @@
 return INVALID_SOCKET;
 }
 
- /* local socket can't be unnamed */
- local_address=s_ntop(addr, addr_len(addr));
 /* we don't bind or listen on a socket inherited from systemd */
 if(listening_section>=systemd_fds) {
 if(bind(fd, &addr->sa, addr_len(addr))) {
 int err=get_last_socket_error();
+ char *requested_bind_address;
+
+ /* local socket can't be unnamed */
+ requested_bind_address=s_ntop(addr, addr_len(addr));
 s_log(LOG_NOTICE, "Binding service %s to %s: %s (%d)",
- opt->servname, local_address, s_strerror(err), err);
- str_free(local_address);
+ opt->servname, requested_bind_address, s_strerror(err), err);
+ str_free(requested_bind_address);
 closesocket(fd);
 return INVALID_SOCKET;
 }
 if(listen(fd, SOMAXCONN)) {
 sockerror("listen");
- str_free(local_address);
 closesocket(fd);
 return INVALID_SOCKET;
 }
@@ -607,9 +679,21 @@
 }
 #endif
 
- s_log(LOG_INFO, "Service %s (FD=%ld) bound to %s",
- opt->servname, (long)fd, local_address);
- str_free(local_address);
+ {
+ SOCKADDR_UNION assigned_addr;
+ socklen_t assigned_addr_len=sizeof assigned_addr;
+ char *assigned_bind_address;
+
+ if(getsockname(fd, &assigned_addr.sa, &assigned_addr_len)) {
+ sockerror("getsockname");
+ closesocket(fd);
+ return INVALID_SOCKET;
+ }
+ assigned_bind_address=s_ntop(&assigned_addr, addr_len(&assigned_addr));
+ s_log(LOG_INFO, "Service %s (FD=%ld) bound to %s",
+ opt->servname, (long)fd, assigned_bind_address);
+ str_free(assigned_bind_address);
+ }
 return fd;
 }
 
@@ -625,15 +709,18 @@
 sockerror("chdir");
 return 1;
 }
+ s_log(LOG_NOTICE, "Switched to chroot directory: %s", global_options.chroot_dir);
 return 0;
 }
 #endif /* HAVE_CHROOT */
 
 /**************************************** signal pipe handling */
 
-NOEXPORT int signal_pipe_init(void) {
+NOEXPORT int pipe_init(SOCKET socket_vector2, const char *name) {
 #ifdef USE_WIN32
- if(make_sockets(signal_pipe))
+ (void)name; /* squash the unused parameter warning */
+
+ if(make_sockets(socket_vector))
 return 1;
 #elif defined(__INNOTEK_LIBC__)
 /* Innotek port of GCC can not use select on a pipe:
@@ -643,29 +730,29 @@
 int pipe_in;
 
 FD_ZERO(&set_pipe);
- signal_pipe0=s_socket(PF_OS2, SOCK_STREAM, 0, 0, "socket#1");
- signal_pipe1=s_socket(PF_OS2, SOCK_STREAM, 0, 0, "socket#2");
+ socket_vector0=s_socket(PF_OS2, SOCK_STREAM, 0, 0, "socket#1");
+ socket_vector1=s_socket(PF_OS2, SOCK_STREAM, 0, 0, "socket#2");
 
 /* connect the two endpoints */
 memset(&un, 0, sizeof un);
 un.sun_len=sizeof un;
 un.sun_family=AF_OS2;
- sprintf(un.sun_path, "\\socket\\stunnel-%u", getpid());
+ sprintf(un.sun_path, "\\socket\\stunnel-%s-%u", name, getpid());
 /* make the first endpoint listen */
- bind(signal_pipe0, (struct sockaddr *)&un, sizeof un);
- listen(signal_pipe0, 1);
- connect(signal_pipe1, (struct sockaddr *)&un, sizeof un);
- FD_SET(signal_pipe0, &set_pipe);
- if(select(signal_pipe0+1, &set_pipe, NULL, NULL, NULL)>0) {
- pipe_in=signal_pipe0;
- signal_pipe0=s_accept(signal_pipe0, NULL, 0, 0, "accept");
+ bind(socket_vector0, (struct sockaddr *)&un, sizeof un);
+ listen(socket_vector0, 1);
+ connect(socket_vector1, (struct sockaddr *)&un, sizeof un);
+ FD_SET(socket_vector0, &set_pipe);
+ if(select(socket_vector0+1, &set_pipe, NULL, NULL, NULL)>0) {
+ pipe_in=socket_vector0;
+ socket_vector0=s_accept(socket_vector0, NULL, 0, 0, "accept");
 closesocket(pipe_in);
 } else {
 sockerror("select");
 return 1;
 }
 #else /* Unix */
- if(s_pipe(signal_pipe, 1, "signal_pipe"))
+ if(s_pipe(socket_vector, 1, name))
 return 1;
 #endif /* USE_WIN32 */
 return 0;
@@ -709,7 +796,7 @@
 s_poll_remove(fds, signal_pipe0);
 closesocket(signal_pipe0);
 closesocket(signal_pipe1);
- if(signal_pipe_init()) {
+ if(pipe_init(signal_pipe, "signal_pipe")) {
 s_log(LOG_ERR,
 "Signal pipe reinitialization failed; terminating");
 return 1;
@@ -730,35 +817,24 @@
 #endif /* defined USE_FORK */
 return 0;
 #endif /* !defind USE_WIN32 */
+ case SIGNAL_TERMINATE:
+ s_log(LOG_DEBUG, "Processing SIGNAL_TERMINATE");
+ s_log(LOG_NOTICE, "Terminated");
+ return 1;
 case SIGNAL_RELOAD_CONFIG:
 s_log(LOG_DEBUG, "Processing SIGNAL_RELOAD_CONFIG");
- if(options_parse(CONF_RELOAD)) {
- s_log(LOG_ERR, "Failed to reload the configuration file");
- } else {
- unbind_ports();
- log_close();
- options_free(); /* FIXME: the pattern should be copy-apply-free */
- options_apply();
- log_open();
- ui_config_reloaded();
- if(bind_ports()) {
- /* FIXME: handle the error */
- }
- if(exec_connect_start()) {
- /* FIXME: handle the error */
- }
- }
+ reload_config();
 return 0;
 case SIGNAL_REOPEN_LOG:
 s_log(LOG_DEBUG, "Processing SIGNAL_REOPEN_LOG");
- log_close();
- log_open();
+ log_flush(LOG_MODE_BUFFER);
+ log_close(SINK_OUTFILE);
+ log_open(SINK_OUTFILE);
+ log_flush(LOG_MODE_CONFIGURED);
 s_log(LOG_NOTICE, "Log file reopened");
 return 0;
- case SIGNAL_TERMINATE:
- s_log(LOG_DEBUG, "Processing SIGNAL_TERMINATE");
- s_log(LOG_NOTICE, "Terminated");
- return 1;
+ case SIGNAL_CONNECTIONS:
+ return process_connections();
 default:
 sig_name=signal_name(sig);
 s_log(LOG_ERR, "Received %s; terminating", sig_name);
@@ -767,6 +843,82 @@
 }
 }
 
+NOEXPORT void reload_config() {
+ static int delay=10; /* default of 10ms */
+#ifdef HAVE_CHROOT
+ struct stat sb;
+#endif /* HAVE_CHROOT */
+
+ if(options_parse(CONF_RELOAD)) {
+ s_log(LOG_ERR, "Failed to reload the configuration file");
+ return;
+ }
+ unbind_ports();
+ log_flush(LOG_MODE_BUFFER);
+#ifdef HAVE_CHROOT
+ /* we don't close SINK_SYSLOG if chroot is enabled and
+ * there is no /dev/log inside it, which could allow
+ * openlog(3) to reopen the syslog socket later */
+ if(global_options.chroot_dir && stat("/dev/log", &sb))
+ log_close(SINK_OUTFILE);
+ else
+#endif /* HAVE_CHROOT */
+ log_close(SINK_SYSLOG|SINK_OUTFILE);
+ /* there is no race condition here:
+ * client threads are not allowed to use global options */
+ options_free(1); /* free the current options */
+ options_apply(); /* apply the new options */
+ /* we hope that a sane openlog(3) implementation won't
+ * attempt to reopen /dev/log if it's already open */
+ log_open(SINK_SYSLOG|SINK_OUTFILE);
+ log_flush(LOG_MODE_CONFIGURED);
+ ui_config_reloaded();
+ /* we use "|" instead of "||" to attempt initialization of both subsystems */
+ if(bind_ports() | exec_connect_start()) { /* failed */
+ unbind_ports();
+ s_poll_sleep(delay/1000, delay%1000); /* sleep to avoid log trashing */
+ signal_post(SIGNAL_RELOAD_CONFIG); /* retry */
+ delay*=2;
+ if(delay > 10000) /* limit to 10s */
+ delay=10000;
+ } else { /* success */
+ delay=10; /* reset back to 10ms */
+ }
+}
+
+#ifdef __GNUC__
+#if __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 6)
+#pragma GCC diagnostic push
+#endif /* __GNUC__>=4.6 */
+#pragma GCC diagnostic ignored "-Wformat"
+#pragma GCC diagnostic ignored "-Wformat-extra-args"
+#endif /* __GNUC__ */
+NOEXPORT int process_connections() {
+#ifndef USE_FORK
+ CLI *c;
+ int n=0;
+
+ s_log(LOG_EMERG, "Active connections:");
+ CRYPTO_THREAD_write_lock(stunnel_locksLOCK_THREAD_LIST);
+ for(c=thread_head; c; c=c->thread_next) {
+ s_log(LOG_EMERG, "Active connection %d: Service %s, "
+ "%llu byte(s) sent to TLS, "
+ "%llu byte(s) sent to socket",
+ ++n, c->opt->servname,
+ (unsigned long long)c->ssl_bytes,
+ (unsigned long long)c->sock_bytes);
+ }
+ CRYPTO_THREAD_unlock(stunnel_locksLOCK_THREAD_LIST);
+ s_log(LOG_EMERG, "Listed %d active connection(s)", n);
+#endif /* USE_FORK */
+ return 0; /* continue execution */
+}
+#ifdef __GNUC__
+#if __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 6)
+#pragma GCC diagnostic pop
+#endif /* __GNUC__>=4.6 */
+#endif /* __GNUC__ */
+
 /**************************************** signal name decoding */
 
 #define check_signal(s) if(signum==s) return str_dup(#s);
@@ -882,99 +1034,96 @@
 
 /**************************************** log build details */
 
+static char *str_cat(char *dst, const char *src) {
+ dst=str_realloc(dst, strlen(dst) + strlen(src) + 1);
+ strcat(dst, src);
+ return dst;
+}
+
 void stunnel_info(int level) {
+ int tls_feature_found=0;
+ char *features;
+
 s_log(level, "stunnel " STUNNEL_VERSION " on " HOST " platform");
 if(strcmp(OPENSSL_VERSION_TEXT, OpenSSL_version(OPENSSL_VERSION))) {
 s_log(level, "Compiled with " OPENSSL_VERSION_TEXT);
 s_log(level, "Running with %s", OpenSSL_version(OPENSSL_VERSION));
- if((OpenSSL_version_num()^OPENSSL_VERSION_NUMBER)&~0xfffu)
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+ if((OPENSSL_version_major()<<8 | OPENSSL_version_minor()) !=
+ OPENSSL_VERSION_NUMBER>>20)
+#else /* OpenSSL version < 3.0.0 */
+ if(OpenSSL_version_num()>>12 != OPENSSL_VERSION_NUMBER>>12)
+#endif /* OpenSSL version >= 3.0.0 */
 s_log(level, "Update OpenSSL shared libraries or rebuild stunnel");
 } else {
 s_log(level, "Compiled/running with " OPENSSL_VERSION_TEXT);
 }
- s_log(level,
 
- "Threading:"
+ features=str_dup("Threading:");
 #ifdef USE_UCONTEXT
- "UCONTEXT"
+ features=str_cat(features, "UCONTEXT");
 #endif
 #ifdef USE_PTHREAD
- "PTHREAD"
+ features=str_cat(features, "PTHREAD");
 #endif
 #ifdef USE_WIN32
- "WIN32"
+ features=str_cat(features, "WIN32");
 #endif
 #ifdef USE_FORK
- "FORK"
+ features=str_cat(features, "FORK");
 #endif
 
- " Sockets:"
+ features=str_cat(features, " Sockets:");
 #ifdef USE_POLL
- "POLL"
+ features=str_cat(features, "POLL");
 #else /* defined(USE_POLL) */
- "SELECT"
+ features=str_cat(features, "SELECT");
 #endif /* defined(USE_POLL) */
- ",IPv%c"
+ /* supported IP version parameter */
+ features=str_cat(features, use_ipv6() ? ",IPv6" : ",IPv4");
 #ifdef USE_SYSTEMD
- ",SYSTEMD"
+ features=str_cat(features, ",SYSTEMD");
 #endif /* defined(USE_SYSTEMD) */
 
- " TLS:"
+ features=str_cat(features, " TLS:");
 #ifndef OPENSSL_NO_ENGINE
-#define TLS_FEATURE_FOUND
- "ENGINE"
+ features=str_cat(features, "ENGINE");
+ tls_feature_found=1;
 #endif /* !defined(OPENSSL_NO_ENGINE) */
-#ifdef USE_FIPS
-#ifdef TLS_FEATURE_FOUND
- ","
-#else
-#define TLS_FEATURE_FOUND
-#endif
- "FIPS"
-#endif /* defined(USE_FIPS) */
+ if(fips_available()) {
+ if(tls_feature_found)
+ features=str_cat(features, ",");
+ features=str_cat(features, "FIPS");
+ tls_feature_found=1;
+ }
 #ifndef OPENSSL_NO_OCSP
-#ifdef TLS_FEATURE_FOUND
- ","
-#else
-#define TLS_FEATURE_FOUND
-#endif
- "OCSP"
+ if(tls_feature_found)
+ features=str_cat(features, ",");
+ features=str_cat(features, "OCSP");
+ tls_feature_found=1;
 #endif /* !defined(OPENSSL_NO_OCSP) */
 #ifndef OPENSSL_NO_PSK
-#ifdef TLS_FEATURE_FOUND
- ","
-#else
-#define TLS_FEATURE_FOUND
-#endif
- "PSK"
+ if(tls_feature_found)
+ features=str_cat(features, ",");
+ features=str_cat(features, "PSK");
+ tls_feature_found=1;
 #endif /* !defined(OPENSSL_NO_PSK) */
 #ifndef OPENSSL_NO_TLSEXT
-#ifdef TLS_FEATURE_FOUND
- ","
-#else
-#define TLS_FEATURE_FOUND
-#endif
- "SNI"
+ if(tls_feature_found)
+ features=str_cat(features, ",");
+ features=str_cat(features, "SNI");
+ tls_feature_found=1;
 #endif /* !defined(OPENSSL_NO_TLSEXT) */
-#ifndef TLS_FEATURE_FOUND
- "NONE"
-#endif /* !defined(TLS_FEATURE_FOUND) */
+ if(!tls_feature_found)
+ features=str_cat(features, "NONE");
 
 #ifdef USE_LIBWRAP
- " Auth:LIBWRAP"
-#endif
-
- , /* supported IP version parameter */
-#if defined(USE_WIN32) && !defined(_WIN32_WCE)
- s_getaddrinfo ? '6' : '4'
-#else /* defined(USE_WIN32) */
-#if defined(USE_IPv6)
- '6'
-#else /* defined(USE_IPv6) */
- '4'
-#endif /* defined(USE_IPv6) */
-#endif /* defined(USE_WIN32) */
- );
+ features=str_cat(features, " Auth:LIBWRAP");
+#endif
+
+ s_log(level, "%s", features);
+ str_free(features);
+
 #ifdef errno
 #define xstr(a) str(a)
 #define str(a) #a

_service:tar_scm:stunnel-5.48.tar.gz/src/tls.c -> _service:tar_scm:stunnel-5.69.tar.gz/src/tls.c Changed

@@ -1,6 +1,6 @@
 /*
 * stunnel TLS offloading and load-balancing proxy
- * Copyright (C) 1998-2018 Michal Trojnara <Michal.Trojnara@stunnel.org>
+ * Copyright (C) 1998-2023 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
@@ -35,12 +35,11 @@
 * forward this exception.
 */
 
-#include "common.h"
 #include "prototypes.h"
 
 volatile int tls_initialized=0;
 
-NOEXPORT void tls_platform_init();
+NOEXPORT void tls_platform_init(void);
 #if OPENSSL_VERSION_NUMBER<0x10100000L
 NOEXPORT void free_function(void *);
 #endif
@@ -59,22 +58,23 @@
 CRYPTO_set_mem_ex_functions(str_alloc_detached_debug,
 str_realloc_detached_debug, free_function);
 #endif
+ str_init();
 }
 
 /* this has to be the first function called by a new thread */
-TLS_DATA *tls_alloc(CLI *c, TLS_DATA *inherited, char *txt) {
+TLS_DATA *tls_alloc(CLI *c, TLS_DATA *inherited, const char *txt) {
 TLS_DATA *tls_data;
 
 if(inherited) { /* reuse the thread-local storage after fork() */
 tls_data=inherited;
- str_free(tls_data->id);
+ str_free_const(tls_data->id);
 } else {
 tls_data=calloc(1, sizeof(TLS_DATA));
 if(!tls_data)
 fatal("Out of memory");
 if(c)
 c->tls=tls_data;
- str_init(tls_data);
+ str_thread_init(tls_data);
 tls_data->c=c;
 tls_data->opt=c?c->opt:&service_options;
 }
@@ -84,10 +84,10 @@
 /* str.c functions can be used below this point */
 if(txt) {
 tls_data->id=str_dup(txt);
- str_detach(tls_data->id); /* it is deallocated after str_stats() */
+ str_detach_const(tls_data->id); /* it is deallocated after str_stats() */
 } else if(c) {
 tls_data->id=log_id(c);
- str_detach(tls_data->id); /* it is deallocated after str_stats() */
+ str_detach_const(tls_data->id); /* it is deallocated after str_stats() */
 }
 
 return tls_data;
@@ -100,8 +100,8 @@
 tls_data=tls_get();
 if(!tls_data)
 return;
- str_cleanup(tls_data);
- str_free(tls_data->id); /* detached allocation */
+ str_thread_cleanup(tls_data);
+ str_free_const(tls_data->id); /* detached allocation */
 tls_set(NULL);
 free(tls_data);
 }

_service:tar_scm:stunnel-5.48.tar.gz/src/ui_unix.c -> _service:tar_scm:stunnel-5.69.tar.gz/src/ui_unix.c Changed

@@ -1,6 +1,6 @@
 /*
 * stunnel TLS offloading and load-balancing proxy
- * Copyright (C) 1998-2018 Michal Trojnara <Michal.Trojnara@stunnel.org>
+ * Copyright (C) 1998-2023 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
@@ -35,7 +35,6 @@
 * forward this exception.
 */
 
-#include "common.h"
 #include "prototypes.h"
 
 NOEXPORT int main_unix(int, char*);
@@ -55,6 +54,7 @@
 mallopt(M_MMAP_THRESHOLD, 4096);
 #endif
 tls_init(); /* initialize thread-local storage */
+ crypto_init(); /* initialize libcrypto */
 retval=main_unix(argc, argv);
 main_cleanup();
 return retval;
@@ -99,6 +99,7 @@
 signal(SIGCHLD, signal_handler); /* handle dead children */
 signal(SIGHUP, signal_handler); /* configuration reload */
 signal(SIGUSR1, signal_handler); /* log reopen */
+ signal(SIGUSR2, signal_handler); /* connections */
 signal(SIGPIPE, SIG_IGN); /* ignore broken pipe */
 if(signal(SIGTERM, SIG_IGN)!=SIG_IGN)
 signal(SIGTERM, signal_handler); /* fatal */
@@ -107,7 +108,19 @@
 if(signal(SIGINT, SIG_IGN)!=SIG_IGN)
 signal(SIGINT, signal_handler); /* fatal */
 #endif
+#ifdef USE_FORK
+ setpgid(0, 0); /* create a new process group if needed */
+#endif
 daemon_loop();
+#ifdef USE_FORK
+ s_log(LOG_NOTICE, "Terminating service processes");
+ signal(SIGCHLD, SIG_IGN);
+ signal(SIGTERM, SIG_IGN);
+ kill(0, SIGTERM); /* kill the whole process group */
+ while(wait(NULL)!=-1)
+ ;
+ s_log(LOG_NOTICE, "Service processes terminated");
+#endif
 #if !defined(__vms) && !defined(USE_OS2)
 delete_pid();
 #endif /* standard Unix */
@@ -124,7 +137,9 @@
 set_nonblock(1, 1); /* stdout */
 c=alloc_client_session(&service_options, 0, 1);
 tls_alloc(c, ui_tls, NULL);
+ service_up_ref(&service_options);
 client_main(c);
+ client_free(c);
 }
 return 0;
 }
@@ -182,11 +197,6 @@
 s_log(LOG_DEBUG, "No pid file being created");
 return 0;
 }
- if(global_options.pidfile0!='/') {
- /* to prevent creating pid file relative to '/' after daemonize() */
- s_log(LOG_ERR, "Pid file (%s) must be full path name", global_options.pidfile);
- return 1;
- }
 
 /* silently remove the old pid file */
 unlink(global_options.pidfile);
@@ -266,9 +276,23 @@
 }
 
 #ifndef OPENSSL_NO_ENGINE
-UI_METHOD *UI_stunnel() {
- return UI_OpenSSL();
+
+int (*ui_get_opener()) (UI *) {
+ return UI_method_get_opener(UI_OpenSSL());
+}
+
+int (*ui_get_writer()) (UI *, UI_STRING *) {
+ return UI_method_get_writer(UI_OpenSSL());
+}
+
+int (*ui_get_reader()) (UI *, UI_STRING *) {
+ return UI_method_get_reader(UI_OpenSSL());
 }
+
+int (*ui_get_closer()) (UI *) {
+ return UI_method_get_closer(UI_OpenSSL());
+}
+
 #endif
 
 /* end of ui_unix.c */

_service:tar_scm:stunnel-5.48.tar.gz/src/ui_win_cli.c -> _service:tar_scm:stunnel-5.69.tar.gz/src/ui_win_cli.c Changed

@@ -1,6 +1,6 @@
 /*
 * stunnel TLS offloading and load-balancing proxy
- * Copyright (C) 1998-2018 Michal Trojnara <Michal.Trojnara@stunnel.org>
+ * Copyright (C) 1998-2023 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
@@ -35,38 +35,14 @@
 * forward this exception.
 */
 
-#include "common.h"
 #include "prototypes.h"
 
 int main(int argc, char *argv) {
 static struct WSAData wsa_state;
- TCHAR *c, stunnel_exe_pathMAX_PATH;
 
 tls_init(); /* initialize thread-local storage */
-
- /* set current working directory and engine path */
- GetModuleFileName(0, stunnel_exe_path, MAX_PATH);
- c=_tcsrchr(stunnel_exe_path, TEXT('\\')); /* last backslash */
- if(c) { /* found */
- *c=TEXT('\0'); /* truncate the program name */
- c=_tcsrchr(stunnel_exe_path, TEXT('\\')); /* previous backslash */
- if(c && !_tcscmp(c+1, TEXT("bin")))
- *c=TEXT('\0'); /* truncate "bin" */
- }
-#ifndef _WIN32_WCE
- if(!SetCurrentDirectory(stunnel_exe_path)) {
- /* log to stderr, as s_log() is not initialized */
- _ftprintf(stderr, TEXT("Cannot set directory to %s"),
- stunnel_exe_path);
- return 1;
- }
- /* try to enter the "config" subdirectory, ignore the result */
- SetCurrentDirectory(TEXT("config"));
-#endif
- _tputenv(str_tprintf(TEXT("OPENSSL_ENGINES=%s\\engines"),
- stunnel_exe_path));
-
- if(WSAStartup(MAKEWORD(1, 1), &wsa_state))
+ crypto_init(); /* initialize libcrypto */
+ if(WSAStartup(MAKEWORD(2, 2), &wsa_state))
 return 1;
 resolver_init();
 main_init();
@@ -130,9 +106,23 @@
 }
 
 #ifndef OPENSSL_NO_ENGINE
-UI_METHOD *UI_stunnel() {
- return UI_OpenSSL();
+
+int (*ui_get_opener()) (UI *) {
+ return UI_method_get_opener(UI_OpenSSL());
+}
+
+int (*ui_get_writer()) (UI *, UI_STRING *) {
+ return UI_method_get_writer(UI_OpenSSL());
+}
+
+int (*ui_get_reader()) (UI *, UI_STRING *) {
+ return UI_method_get_reader(UI_OpenSSL());
 }
+
+int (*ui_get_closer()) (UI *) {
+ return UI_method_get_closer(UI_OpenSSL());
+}
+
 #endif
 
 /* end of ui_win_cli.c */

_service:tar_scm:stunnel-5.48.tar.gz/src/ui_win_gui.c -> _service:tar_scm:stunnel-5.69.tar.gz/src/ui_win_gui.c Changed

@@ -1,6 +1,6 @@
 /*
 * stunnel TLS offloading and load-balancing proxy
- * Copyright (C) 1998-2018 Michal Trojnara <Michal.Trojnara@stunnel.org>
+ * Copyright (C) 1998-2023 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
@@ -35,13 +35,13 @@
 * forward this exception.
 */
 
-#include "common.h"
 #include "prototypes.h"
 #include <commdlg.h>
 #include <commctrl.h>
 #ifndef _WIN32_WCE
 #include <psapi.h>
 #endif
+#include <sddl.h>
 #include "resources.h"
 
 #define LOG_LINES 1000
@@ -61,48 +61,71 @@
 /* mingw-Patches-1825044 is missing in Debian Squeeze */
 WINBASEAPI BOOL WINAPI CheckTokenMembership(HANDLE, PSID, PBOOL);
 
-/* prototypes */
-NOEXPORT BOOL CALLBACK enum_windows(HWND, LPARAM);
-NOEXPORT void gui_cmdline();
-NOEXPORT int initialize_winsock(void);
-NOEXPORT int gui_loop();
+/* initialization */
+NOEXPORT int winsock_initialize(void);
+NOEXPORT unsigned __stdcall daemon_thread(void *);
+
+/* GUI core */
+NOEXPORT void gui_cmdline(void);
+NOEXPORT void gui_init(void);
+NOEXPORT int gui_loop(void);
 
+/* GUI callbacks */
 NOEXPORT void CALLBACK timer_proc(HWND, UINT, UINT_PTR, DWORD);
 NOEXPORT LRESULT CALLBACK window_proc(HWND, UINT, WPARAM, LPARAM);
+NOEXPORT LRESULT CALLBACK edit_proc(HWND, UINT, WPARAM, LPARAM);
 NOEXPORT LRESULT CALLBACK about_proc(HWND, UINT, WPARAM, LPARAM);
 NOEXPORT LRESULT CALLBACK pass_proc(HWND, UINT, WPARAM, LPARAM);
-NOEXPORT int pin_cb(UI *, UI_STRING *);
-
-NOEXPORT void save_log(void);
-NOEXPORT void win_log(LPCTSTR);
-NOEXPORT int save_text_file(LPTSTR, char *);
-NOEXPORT void update_logs(void);
-NOEXPORT LPTSTR log_txt(void);
-
-NOEXPORT unsigned __stdcall daemon_thread(void *);
 
-NOEXPORT void valid_config(void);
-NOEXPORT void invalid_config(void);
-NOEXPORT void update_peer_menu(void);
+/* icon tray */
 NOEXPORT void tray_update(const int);
 NOEXPORT void tray_delete(void);
-NOEXPORT void error_box(LPCTSTR);
-NOEXPORT void edit_config(HWND);
 
-/* NT Service related function */
+/* configuration file (re)loading */
+NOEXPORT void config_valid(void);
+NOEXPORT void config_invalid(void);
+NOEXPORT void config_edit(HWND);
+
+/* peer certs */
+NOEXPORT void peer_menu_update(void);
+NOEXPORT void peer_menu_update_unlocked(void);
+NOEXPORT void peer_cert_save(WPARAM wParam);
+
+/* UI callbacks */
+NOEXPORT int pin_cb(UI *, UI_STRING *);
+
+/* log handling */
+NOEXPORT void log_save(void);
+NOEXPORT void log_push(LPCTSTR);
+NOEXPORT void log_update(void);
+NOEXPORT LPTSTR log_txt(void);
+
+/* control pipe support */
+NOEXPORT void control_pipe_names(void);
+NOEXPORT int control_pipe_client(void);
+NOEXPORT int control_pipe_server(LPTSTR);
+NOEXPORT unsigned __stdcall control_pipe_server_thread(void *);
+NOEXPORT unsigned __stdcall control_pipe_instance_thread(void *);
+NOEXPORT int control_pipe_send(HANDLE, const char *, ...);
+NOEXPORT char *control_pipe_recv(HANDLE);
+NOEXPORT char *control_pipe_call(LPTSTR, const char *, ...);
+
+/* NT Service support */
 #ifndef _WIN32_WCE
 NOEXPORT int service_initialize(void);
 NOEXPORT int service_install(void);
 NOEXPORT int service_uninstall(void);
 NOEXPORT int service_start(void);
 NOEXPORT int service_stop(void);
-NOEXPORT int service_user(DWORD);
 NOEXPORT void WINAPI service_main(DWORD, LPTSTR *);
 NOEXPORT void WINAPI control_handler(DWORD);
 #endif /* !defined(_WIN32_WCE) */
 
-/* other functions */
-NOEXPORT LPTSTR get_params();
+/* helper functions */
+NOEXPORT LPTSTR params_get(void);
+NOEXPORT int text_file_create(LPTSTR, char *);
+NOEXPORT void gui_signal_post(uint8_t);
+NOEXPORT void error_box(LPCTSTR);
 
 /* global variables */
 static struct LIST {
@@ -112,7 +135,7 @@
 } *head=NULL, *tail=NULL;
 
 static HINSTANCE ghInst;
-static HWND edit_handle=NULL;
+static HWND edit_handle=NULL, pause_handle=NULL;
 static HMENU tray_menu_handle=NULL;
 #ifndef _WIN32_WCE
 static HMENU main_menu_handle=NULL;
@@ -121,6 +144,7 @@
 #ifdef _WIN32_WCE
 static HWND command_bar_handle; /* command bar handle */
 #endif
+static WNDPROC default_edit_proc;
 /* win32_name is needed for any error_box(), message_box(),
 * and the initial main window title */
 static TCHAR *win32_name=TEXT("stunnel ") TEXT(STUNNEL_VERSION)
@@ -129,22 +153,27 @@
 #ifndef _WIN32_WCE
 static SERVICE_STATUS serviceStatus;
 static SERVICE_STATUS_HANDLE serviceStatusHandle=0;
-#define SERVICE_CONTROL_USER 128
 #endif
 
 static BOOL visible=FALSE;
 static HANDLE main_initialized=NULL; /* global initialization performed */
+static HANDLE main_terminated=NULL; /* daemon_loop() terminated */
 static HANDLE config_ready=NULL; /* reload without a valid configuration */
-static LONG new_logs=0;
+static BOOL new_logs=FALSE;
+static int removed_logs=0;
 
 static struct {
 char *config_file;
+ char *config_command;
 unsigned service:1, install:1, uninstall:1, start:1, stop:1,
 quiet:1, exit:1, reload:1, reopen:1;
 } cmdline;
 
 static char ui_passPEM_BUFSIZE;
 
+LPTSTR pipe_name_ui, pipe_name_service;
+BOOL nt_service_client=FALSE;
+
 /**************************************** initialization */
 
 int WINAPI WinMain(HINSTANCE this_instance, HINSTANCE prev_instance,
@@ -154,11 +183,7 @@
 LPSTR lpCmdLine,
 #endif
 int nCmdShow) {
- TCHAR stunnel_exe_pathMAX_PATH;
- LPTSTR c;
-#ifndef _WIN32_WCE
- LPTSTR errmsg;
-#endif
+ HANDLE daemon;
 
 (void)prev_instance; /* squash the unused parameter warning */
 (void)lpCmdLine; /* squash the unused parameter warning */
@@ -166,48 +191,23 @@
 
 tls_init(); /* initialize thread-local storage */
 ghInst=this_instance;
- gui_cmdline(); /* setup global cmdline structure */
- GetModuleFileName(0, stunnel_exe_path, MAX_PATH);
 
-#ifndef _WIN32_WCE
- /* find previous instances of the same executable */
- if(!cmdline.service && !cmdline.install && !cmdline.uninstall &&
- !cmdline.reload && !cmdline.reopen &&
- !cmdline.start && !cmdline.stop) {
- EnumWindows(enum_windows, (LPARAM)stunnel_exe_path);
- if(cmdline.exit)
- return 1; /* in case EnumWindows didn't find a previous instance */
- }
-#endif
+ crypto_init(); /* initialize libcrypto */
 
- /* set current working directory and engine path */
- c=_tcsrchr(stunnel_exe_path, TEXT('\\')); /* last backslash */
- if(c) { /* found */
- *c=TEXT('\0'); /* truncate the program name */
- c=_tcsrchr(stunnel_exe_path, TEXT('\\')); /* previous backslash */
- if(c && !_tcscmp(c+1, TEXT("bin")))
- *c=TEXT('\0'); /* truncate "bin" */
- }
-#ifndef _WIN32_WCE
- if(!SetCurrentDirectory(stunnel_exe_path)) {
- errmsg=str_tprintf(TEXT("Cannot set directory to %s"),
- stunnel_exe_path);
- message_box(errmsg, MB_ICONERROR);
- str_free(errmsg);
- return 1;
- }
- /* try to enter the "config" subdirectory, ignore the result */
- SetCurrentDirectory(TEXT("config"));
-#endif
- _tputenv(str_tprintf(TEXT("OPENSSL_ENGINES=%s\\engines"),
- stunnel_exe_path));
+ gui_cmdline(); /* setup global cmdline structure */
+ control_pipe_names();
 
- if(initialize_winsock())
+ if(winsock_initialize())
 return 1;
 
 #ifndef _WIN32_WCE
- if(cmdline.service) /* "-service" must be processed before "-install" */
+ if(cmdline.service) { /* "-service" must be processed before "-install" */
+ cmdline.quiet=1;
+ /* create a service pipe thread for accepting signals */
+ if(control_pipe_server(pipe_name_service))
+ return 1; /* a control pipe service already exists or failed */
 return service_initialize();
+ }
 if(cmdline.install)
 return service_install();
 if(cmdline.uninstall)
@@ -216,128 +216,174 @@
 return service_start();
 if(cmdline.stop)
 return service_stop();
- if(cmdline.reload)
- return service_user(SIGNAL_RELOAD_CONFIG);
- if(cmdline.reopen)
- return service_user(SIGNAL_REOPEN_LOG);
 #endif
+
+ /* auto-reset, non-signaled events */
+ main_initialized=CreateEvent(NULL, FALSE, FALSE, NULL);
+ main_terminated=CreateEvent(NULL, FALSE, FALSE, NULL);
+ config_ready=CreateEvent(NULL, FALSE, FALSE, NULL);
+
+ if(control_pipe_client())
+ return 0;
+ /* create a service pipe thread for accepting signals */
+ if(control_pipe_server(pipe_name_service))
+ return 1; /* a control pipe service already exists or failed */
+ gui_init();
+ /* hwnd needs to be initialized before _beginthreadex() */
+ daemon=(HANDLE)_beginthreadex(NULL, DEFAULT_STACK_SIZE,
+ daemon_thread, NULL, 0, NULL);
+ if(!daemon)
+ fatal("Failed to create the daemon thread");
+ CloseHandle(daemon);
+ WaitForSingleObject(main_initialized, INFINITE);
 return gui_loop();
 }
 
-#ifndef _WIN32_WCE
-
-NOEXPORT BOOL CALLBACK enum_windows(HWND other_window_handle, LPARAM lParam) {
- DWORD pid;
- HMODULE module;
- HANDLE process_handle;
- TCHAR window_exe_pathMAX_PATH;
- LPTSTR stunnel_exe_path=(LPTSTR)lParam;
+/* try to load winsock2 resolver functions from a specified dll name */
+NOEXPORT int winsock_initialize() {
+ static struct WSAData wsa_state;
 
- if(!other_window_handle)
- return TRUE;
- module=(HMODULE)GetWindowLongPtr(other_window_handle, GWLP_HINSTANCE);
- GetWindowThreadProcessId(other_window_handle, &pid);
- process_handle=OpenProcess(SYNCHRONIZE| /* WaitForSingleObject() */
- PROCESS_TERMINATE| /* TerminateProcess() */
- PROCESS_QUERY_INFORMATION|PROCESS_VM_READ, /* GetModuleFileNameEx() */
- FALSE, pid);
- if(!process_handle)
- return TRUE;
- if(!GetModuleFileNameEx(process_handle,
- module, window_exe_path, MAX_PATH)) {
- CloseHandle(process_handle);
- return TRUE;
+ if(WSAStartup(MAKEWORD(2, 2), &wsa_state)) {
+ message_box(TEXT("Failed to initialize winsock"), MB_ICONERROR);
+ return 1; /* error */
 }
- if(_tcscmp(stunnel_exe_path, window_exe_path)) {
- CloseHandle(process_handle);
- return TRUE;
+ resolver_init();
+ return 0; /* IPv4 detected -> OK */
+}
+
+NOEXPORT unsigned __stdcall daemon_thread(void *arg) {
+ (void)arg; /* squash the unused parameter warning */
+
+ tls_alloc(NULL, NULL, "main"); /* new thread-local storage */
+ main_init();
+ SetEvent(main_initialized); /* unlock the GUI thread */
+ /* get a valid configuration */
+ if(cmdline.config_command) {
+ main_configure(cmdline.config_command, NULL);
+ ShowWindow(hwnd, SW_SHOWNORMAL); /* show window */
+ SetForegroundWindow(hwnd); /* bring on top */
 }
- if(cmdline.exit) {
- PostMessage(other_window_handle, WM_COMMAND, IDM_EXIT, 0);
- if(WaitForSingleObject(process_handle, 3000)==WAIT_TIMEOUT) {
- TerminateProcess(process_handle, 0);
- WaitForSingleObject(process_handle, 3000);
- }
- } else {
- ShowWindow(other_window_handle, SW_SHOWNORMAL); /* show window */
- SetForegroundWindow(other_window_handle); /* bring on top */
+ while(main_configure(cmdline.config_file, NULL)) {
+ PostMessage(hwnd, WM_INVALID_CONFIG, 0, 0); /* display error */
+ WaitForSingleObject(config_ready, INFINITE);
 }
- CloseHandle(process_handle);
- exit(0);
- return FALSE; /* should never be executed */
+ PostMessage(hwnd, WM_VALID_CONFIG, 0, 0);
+
+ /* start the main loop */
+ daemon_loop();
+ main_cleanup();
+ SetEvent(main_terminated); /* ready for WM_QUIT */
+ PostMessage(hwnd, WM_TERMINATE, 0, 0); /* terminate GUI */
+ tls_cleanup();
+ _endthreadex(0); /* SIGNAL_TERMINATE received */
+ return 0;
 }
 
-#endif
+/**************************************** GUI core */
 
 NOEXPORT void gui_cmdline() {
- char *line, *c, *opt;
+ char *line, *c, *config_file=NULL;
 
- line=tstr2str(get_params());
 memset(&cmdline, 0, sizeof cmdline);
+ line=tstr2str(params_get());
 c=line;
- while(*c && (*c=='/' || *c=='-')) {
- opt=c;
- while(*c && !isspace(*c)) /* skip non-whitespaces */
- c++;
- while(*c && isspace(*c)) /* replace whitespaces with '\0' */
+ while(*c) {
+ char *opt;
+
+ if(*c=='\"') { /* the option is within double quotes */
 *c++='\0';
- if(!strcasecmp(opt+1, "install"))
- cmdline.install=1;
- else if(!strcasecmp(opt+1, "uninstall"))
- cmdline.uninstall=1;
- else if(!strcasecmp(opt+1, "reload"))
- cmdline.reload=1;
- else if(!strcasecmp(opt+1, "reopen"))
- cmdline.reopen=1;
- else if(!strcasecmp(opt+1, "start"))
- cmdline.start=1;
- else if(!strcasecmp(opt+1, "stop"))
- cmdline.stop=1;
- else if(!strcasecmp(opt+1, "service"))
- cmdline.service=1;
- else if(!strcasecmp(opt+1, "quiet"))
- cmdline.quiet=1;
- else if(!strcasecmp(opt+1, "exit"))
- cmdline.exit=1;
- else { /* an option to be processed in options.c */
- c=opt;
+ opt=c;
+ while(*c && *c!='\"') /* find the closing double quote */
+ c++;
+ if(*c=='\"') /* replace with '\0' if found */
+ *c++='\0';
+ } else if(*c=='-' || *c=='/') { /* advanced parameters: the option is the next word */
+ opt=c;
+ while(*c && !isspace(*c)) /* skip non-whitespaces */
+ c++;
+ } else { /* the rest of the line is our configuration file path */
+ config_file=c;
 break;
 }
- }
- if(*c=='\"') { /* the option is within double quotes */
- c++;
- opt=c;
- while(*c && *c!='\"') /* find the closing double quote */
- c++;
- *c='\0';
- } else /* the option is simply the rest of the line */
- opt=c;
- cmdline.config_file=*opt ? str_dup(opt) : NULL;
- str_free(line);
-}
-
-/* try to load winsock2 resolver functions from a specified dll name */
-NOEXPORT int initialize_winsock() {
- static struct WSAData wsa_state;
+ while(*c && isspace(*c)) /* replace whitespaces with '\0' */
+ *c++='\0';
 
- if(WSAStartup(MAKEWORD( 2, 2 ), &wsa_state)) {
- message_box(TEXT("Failed to initialize winsock"), MB_ICONERROR);
- return 1; /* error */
+ if(*opt=='/' || *opt=='-') {
+ if(!strcasecmp(opt+1, "install")) {
+ cmdline.install=1;
+ continue;
+ }
+ if(!strcasecmp(opt+1, "uninstall")) {
+ cmdline.uninstall=1;
+ continue;
+ }
+ if(!strcasecmp(opt+1, "reload")) {
+ cmdline.reload=1;
+ continue;
+ }
+ if(!strcasecmp(opt+1, "reopen")) {
+ cmdline.reopen=1;
+ continue;
+ }
+ if(!strcasecmp(opt+1, "start")) {
+ cmdline.start=1;
+ continue;
+ }
+ if(!strcasecmp(opt+1, "stop")) {
+ cmdline.stop=1;
+ continue;
+ }
+ if(!strcasecmp(opt+1, "service")) {
+ cmdline.service=1;
+ continue;
+ }
+ if(!strcasecmp(opt+1, "quiet")) {
+ cmdline.quiet=1;
+ continue;
+ }
+ if(!strcasecmp(opt+1, "exit")) {
+ cmdline.exit=1;
+ continue;
+ }
+ if(!strcasecmp(opt+1, "help")) {
+ cmdline.config_command="-help";
+ continue;
+ }
+ if(!strcasecmp(opt+1, "version")) {
+ cmdline.config_command="-version";
+ continue;
+ }
+ if(!strcasecmp(opt+1, "sockets")) {
+ cmdline.config_command="-sockets";
+ continue;
+ }
+ if(!strcasecmp(opt+1, "options")) {
+ cmdline.config_command="-options";
+ continue;
+ }
+ }
+ /* any other non-empty option must be our configuration file name */
+ if(*opt && !config_file)
+ config_file=opt;
 }
- resolver_init();
- return 0; /* IPv4 detected -> OK */
+ if(!config_file || !*config_file)
+ config_file="stunnel.conf";
+ config_file=_fullpath(NULL, config_file, 0);
+ if(config_file) { /* _fullpath managed to create an absolute path */
+ cmdline.config_file=str_dup(config_file);
+ free(config_file);
+ } else {
+ cmdline.config_file=str_dup("stunnel.conf");
+ }
+ str_free(line);
 }
 
-/**************************************** GUI thread */
-
-NOEXPORT int gui_loop() {
- HANDLE handle;
+NOEXPORT void gui_init() {
 #ifdef _WIN32_WCE
 WNDCLASS wc;
 #else
 WNDCLASSEX wc;
 #endif
- MSG msg;
 LPTSTR classname=TEXT("stunnel_main_window_class");
 
 /* register the class */
@@ -369,39 +415,30 @@
 NULL, NULL, ghInst, NULL);
 #else
 main_menu_handle=LoadMenu(ghInst, MAKEINTRESOURCE(IDM_MAINMENU));
- if(main_menu_handle && cmdline.service) {
- /* block unsafe operations in the service mode */
- EnableMenuItem(main_menu_handle, IDM_EDIT_CONFIG, MF_GRAYED);
- EnableMenuItem(main_menu_handle, IDM_SAVE_LOG, MF_GRAYED);
- }
 hwnd=CreateWindow(classname, win32_name, WS_TILEDWINDOW,
 CW_USEDEFAULT, CW_USEDEFAULT, CW_USEDEFAULT, CW_USEDEFAULT,
 NULL, main_menu_handle, ghInst, NULL);
 #endif
 
- /* auto-reset, non-signaled events */
- main_initialized=CreateEvent(NULL, FALSE, FALSE, NULL);
- config_ready=CreateEvent(NULL, FALSE, FALSE, NULL);
- /* hwnd needs to be initialized before _beginthreadex() */
- handle=(HANDLE)_beginthreadex(NULL, DEFAULT_STACK_SIZE,
- daemon_thread, NULL, 0, NULL);
- if(!handle)
- fatal("Failed to create the daemon thread");
- CloseHandle(handle);
- WaitForSingleObject(main_initialized, INFINITE);
- /* logging subsystem is now available */
+ /* create initial icon tray */
+ tray_update(0);
+}
 
- /* setup periodic event to trigger update_logs() */
+NOEXPORT int gui_loop() {
+ MSG msg;
+
+ /* setup periodic event to trigger log_update() and tray_update() */
 SetTimer(NULL, 0, 1000, timer_proc); /* run callback once per second */
 
- s_log(LOG_DEBUG, "GUI message loop initialized");
 for(;;)
 switch(GetMessage(&msg, NULL, 0, 0)) {
 case -1:
 ioerror("GetMessage");
 return 0;
 case 0:
- s_log(LOG_DEBUG, "GUI message loop terminated");
+ /* the following error may only be logged if main_cleanup()
+ * did not disable logging with log_flush(LOG_MODE_BUFFER) */
+ ui_new_log("GUI message loop terminated with WM_QUIT");
 return (int)msg.wParam;
 default:
 TranslateMessage(&msg);
@@ -409,30 +446,27 @@
 }
 }
 
-NOEXPORT void CALLBACK timer_proc(HWND hwnd, UINT msg, UINT_PTR id, DWORD t) {
- (void)hwnd; /* squash the unused parameter warning */
+/**************************************** GUI callbacks */
+
+NOEXPORT void CALLBACK timer_proc(HWND hWnd, UINT msg, UINT_PTR id, DWORD t) {
+ (void)hWnd; /* squash the unused parameter warning */
 (void)msg; /* squash the unused parameter warning */
 (void)id; /* squash the unused parameter warning */
 (void)t; /* squash the unused parameter warning */
- if(visible)
- update_logs();
- tray_update(num_clients); /* needed when explorer.exe (re)starts */
+ log_update();
+ tray_update(num_clients);
 }
 
 NOEXPORT LRESULT CALLBACK window_proc(HWND main_window_handle,
 UINT message, WPARAM wParam, LPARAM lParam) {
 POINT pt;
 RECT rect;
- PAINTSTRUCT ps;
- SERVICE_OPTIONS *section;
- unsigned section_number;
- LPTSTR txt;
+ HFONT monospaced_font, proportional_font;
 
 #if 0
 switch(message) {
 case WM_CTLCOLORSTATIC:
 case WM_TIMER:
- case WM_LOG:
 break;
 default:
 s_log(LOG_DEBUG, "Window message: 0x%x(0x%hx,0x%lx)",
@@ -453,14 +487,24 @@
 #endif
 
 /* create child edit window */
- edit_handle=CreateWindowEx(WS_EX_STATICEDGE, TEXT("EDIT"), NULL,
+ edit_handle=CreateWindowEx(WS_EX_STATICEDGE, WC_EDIT, NULL,
 WS_CHILD|WS_VISIBLE|WS_HSCROLL|WS_VSCROLL|ES_MULTILINE|ES_READONLY,
 0, 0, 0, 0, main_window_handle, (HMENU)IDE_EDIT, ghInst, NULL);
+ pause_handle=CreateWindowEx(0, WC_BUTTON, TEXT("Pause auto-scroll"),
+ WS_CHILD|WS_VISIBLE|BS_CHECKBOX|BS_AUTOCHECKBOX|BS_TEXT,
+ 0, 0, 0, 0, main_window_handle, (HMENU)IDE_PAUSE, ghInst, NULL);
+ default_edit_proc=(WNDPROC)SetWindowLongPtr(edit_handle, GWLP_WNDPROC,
+ (LONG_PTR)edit_proc);
 #ifndef _WIN32_WCE
- SendMessage(edit_handle, WM_SETFONT,
- (WPARAM)CreateFont(-12, 0, 0, 0, FW_DONTCARE, FALSE, FALSE, FALSE,
- DEFAULT_CHARSET, OUT_RASTER_PRECIS, CLIP_DEFAULT_PRECIS,
- PROOF_QUALITY, DEFAULT_PITCH, TEXT("Courier")),
+ monospaced_font=CreateFont(-12, 0, 0, 0, FW_DONTCARE, FALSE, FALSE, FALSE,
+ DEFAULT_CHARSET, OUT_RASTER_PRECIS, CLIP_DEFAULT_PRECIS,
+ PROOF_QUALITY, DEFAULT_PITCH, TEXT("Courier")),
+ SendMessage(edit_handle, WM_SETFONT, (WPARAM)monospaced_font,
+ MAKELPARAM(FALSE, 0)); /* no need to redraw right now */
+ proportional_font=CreateFont(-12, 0, 0, 0, FW_NORMAL, FALSE, FALSE, FALSE,
+ DEFAULT_CHARSET, OUT_TT_PRECIS, CLIP_DEFAULT_PRECIS,
+ DEFAULT_QUALITY, DEFAULT_PITCH, TEXT("Segoe UI")),
+ SendMessage(pause_handle, WM_SETFONT, (WPARAM)proportional_font,
 MAKELPARAM(FALSE, 0)); /* no need to redraw right now */
 #endif
 /* NOTE: there's no return statement here -> proceeding with resize */
@@ -474,7 +518,8 @@
 SendMessage(command_bar_handle, TB_AUTOSIZE, 0L, 0L);
 CommandBar_AlignAdornments(command_bar_handle);
 #else
- MoveWindow(edit_handle, 0, 0, rect.right, rect.bottom, TRUE);
+ MoveWindow(edit_handle, 0, 0, rect.right, rect.bottom-17, TRUE);
+ MoveWindow(pause_handle, 0, rect.bottom-17, rect.right, 17, TRUE);
 #endif
 UpdateWindow(edit_handle);
 /* CommandBar_Show(command_bar_handle, TRUE); */
@@ -485,8 +530,19 @@
 return 0;
 
 case WM_PAINT:
- BeginPaint(hwnd, &ps);
- EndPaint(hwnd, &ps);
+ {
+ PAINTSTRUCT ps;
+ BeginPaint(hwnd, &ps);
+ EndPaint(hwnd, &ps);
+ }
+ break;
+
+ case WM_GETMINMAXINFO:
+ {
+ LPMINMAXINFO minmaxinfo=(LPMINMAXINFO)lParam;
+ minmaxinfo->ptMinTrackSize.x=320;
+ minmaxinfo->ptMinTrackSize.y=200;
+ }
 break;
 
 case WM_CLOSE:
@@ -503,8 +559,7 @@
 if(tray_menu_handle)
 CheckMenuItem(tray_menu_handle, IDM_SHOW_LOG,
 visible ? MF_CHECKED : MF_UNCHECKED);
- if(visible)
- update_logs();
+ log_update();
 #ifdef WM_SHOWWINDOW
 return 0;
 #else
@@ -512,6 +567,7 @@
 #endif
 
 case WM_DESTROY:
+ tray_delete(); /* remove the taskbark icon if exists */
 #ifdef _WIN32_WCE
 CommandBar_Destroy(command_bar_handle);
 #else
@@ -521,29 +577,14 @@
 main_menu_handle=NULL;
 }
 #endif
- tray_delete(); /* remove the taskbark icon if exists */
 PostQuitMessage(0);
 return 0;
 
+ case WM_TERMINATE:
+ DestroyWindow(main_window_handle);
+ return 0;
+
 case WM_COMMAND:
- if(wParam>=IDM_PEER_MENU && wParam<IDM_PEER_MENU+number_of_sections) {
- for(section=service_options.next, section_number=0;
- section && wParam!=IDM_PEER_MENU+section_number;
- section=section->next, ++section_number)
- ;
- if(!section)
- return 0;
- if(save_text_file(section->file, section->chain))
- return 0;
-#ifndef _WIN32_WCE
- if(main_menu_handle)
- CheckMenuItem(main_menu_handle, (UINT)wParam, MF_CHECKED);
-#endif
- if(tray_menu_handle)
- CheckMenuItem(tray_menu_handle, (UINT)wParam, MF_CHECKED);
- message_box(section->help, MB_ICONINFORMATION);
- return 0;
- }
 switch(wParam) {
 case IDM_ABOUT:
 DialogBox(ghInst, TEXT("AboutBox"), main_window_handle,
@@ -561,43 +602,40 @@
 ShowWindow(main_window_handle, SW_HIDE); /* hide window */
 break;
 case IDM_EXIT:
- if(num_clients>=0) /* signal_pipe is active */
- signal_post(SIGNAL_TERMINATE);
- DestroyWindow(main_window_handle);
+ gui_signal_post(SIGNAL_TERMINATE);
 break;
 case IDM_SAVE_LOG:
- if(!cmdline.service) /* security */
- save_log();
+ log_save();
 break;
 case IDM_EDIT_CONFIG:
 #ifndef _WIN32_WCE
- if(!cmdline.service) /* security */
- edit_config(main_window_handle);
+ config_edit(main_window_handle);
 #endif
 break;
 case IDM_RELOAD_CONFIG:
- if(num_clients>=0) /* signal_pipe is active */
- signal_post(SIGNAL_RELOAD_CONFIG);
- else
- SetEvent(config_ready); /* unlock daemon_thread() */
+ gui_signal_post(SIGNAL_RELOAD_CONFIG);
 break;
 case IDM_REOPEN_LOG:
- signal_post(SIGNAL_REOPEN_LOG);
+ gui_signal_post(SIGNAL_REOPEN_LOG);
+ break;
+ case IDM_CONNECTIONS:
+ gui_signal_post(SIGNAL_CONNECTIONS);
 break;
 case IDM_MANPAGE:
 #ifndef _WIN32_WCE
- if(!cmdline.service) /* security */
- ShellExecute(main_window_handle, TEXT("open"),
- TEXT("..\\doc\\stunnel.html"), NULL, NULL, SW_SHOWNORMAL);
+ ShellExecute(main_window_handle, TEXT("open"),
+ TEXT("..\\doc\\stunnel.html"), NULL, NULL, SW_SHOWNORMAL);
 #endif
 break;
 case IDM_HOMEPAGE:
 #ifndef _WIN32_WCE
- if(!cmdline.service) /* security */
- ShellExecute(main_window_handle, TEXT("open"),
- TEXT("http://www.stunnel.org/"), NULL, NULL, SW_SHOWNORMAL);
+ ShellExecute(main_window_handle, TEXT("open"),
+ TEXT("http://www.stunnel.org/"), NULL, NULL, SW_SHOWNORMAL);
 #endif
 break;
+ default:
+ if(wParam>=IDM_PEER_MENU && wParam<IDM_PEER_MENU+number_of_sections)
+ peer_cert_save(wParam);
 }
 return 0;
 
@@ -618,8 +656,9 @@
 TPM_BOTTOMALIGN, pt.x, pt.y, main_window_handle, NULL);
 PostMessage(main_window_handle, WM_NULL, 0, 0);
 break;
+
 #ifndef _WIN32_WCE
- case WM_LBUTTONDBLCLK: /* switch log window visibility */
+ case WM_LBUTTONDOWN: /* switch log window visibility */
 if(visible) {
 ShowWindow(main_window_handle, SW_HIDE); /* hide window */
 } else {
@@ -632,17 +671,11 @@
 return 0;
 
 case WM_VALID_CONFIG:
- valid_config();
+ config_valid();
 return 0;
 
 case WM_INVALID_CONFIG:
- invalid_config();
- return 0;
-
- case WM_LOG:
- txt=(LPTSTR)wParam;
- win_log(txt);
- str_free(txt);
+ config_invalid();
 return 0;
 
 case WM_NEW_CHAIN:
@@ -656,14 +689,22 @@
 (UINT)(IDM_PEER_MENU+wParam), MF_ENABLED);
 return 0;
 
- case WM_CLIENTS:
- tray_update((int)wParam);
- return 0;
+ case WM_CAPWIN_DESTROY:
+ DestroyWindow(main_window_handle);
+ return TRUE;
 }
 
 return DefWindowProc(main_window_handle, message, wParam, lParam);
 }
 
+NOEXPORT LRESULT CALLBACK edit_proc(HWND hWnd, UINT uMsg, WPARAM wParam, LPARAM lParam) {
+ if(uMsg==WM_CHAR && wParam==VK_SPACE) {
+ Button_SetCheck(pause_handle, !Button_GetCheck(pause_handle));
+ return 0;
+ }
+ return CallWindowProc(default_edit_proc, hWnd, uMsg, wParam, lParam);
+}
+
 NOEXPORT LRESULT CALLBACK about_proc(HWND dialog_handle, UINT message,
 WPARAM wParam, LPARAM lParam) {
 (void)lParam; /* squash the unused parameter warning */
@@ -748,224 +789,160 @@
 UNREFERENCED_PARAMETER(lParam);
 }
 
-int ui_passwd_cb(char *buf, int size, int rwflag, void *userdata) {
- int len;
+/**************************************** icon tray */
 
- (void)rwflag; /* squash the unused parameter warning */
- (void)userdata; /* squash the unused parameter warning */
- if(!DialogBox(ghInst, TEXT("PassBox"), hwnd, (DLGPROC)pass_proc))
- return 0; /* dialog cancelled or failed */
- len=(int)strlen(ui_pass);
- if(len<0 || size<0) /* the API uses signed integers */
- return 0;
- if(len>size) /* truncate the returned data if needed */
- len=size;
- memcpy(buf, ui_pass, (size_t)len);
- memset(ui_pass, 0, sizeof ui_pass);
- return len;
-}
+NOEXPORT void tray_update(const int num) {
+ NOTIFYICONDATA nid;
+ static ICON_TYPE previous_icon=ICON_NONE;
+ ICON_TYPE current_icon;
+ LPTSTR tip;
 
-#ifndef OPENSSL_NO_ENGINE
-UI_METHOD *UI_stunnel() {
- static UI_METHOD *ui_method=NULL;
-
- if(ui_method) /* already initialized */
- return ui_method;
- ui_method=UI_create_method("stunnel WIN32 UI");
- if(!ui_method) {
- sslerror("UI_create_method");
- return NULL;
+ if(!nt_service_client) {
+ if(!global_options.option.taskbar) { /* currently disabled */
+ tray_delete(); /* remove the taskbark icon if exists */
+ return;
+ }
+ }
+ if(!tray_menu_handle) /* initialize taskbar */
+ tray_menu_handle=LoadMenu(ghInst, MAKEINTRESOURCE(IDM_TRAYMENU));
+ if(!tray_menu_handle) {
+ ioerror("LoadMenu");
+ return;
 }
- UI_method_set_reader(ui_method, pin_cb);
- return ui_method;
-}
 
-NOEXPORT int pin_cb(UI *ui, UI_STRING *uis) {
- if(!DialogBox(ghInst, TEXT("PassBox"), hwnd, (DLGPROC)pass_proc))
- return 0; /* dialog cancelled or failed */
- UI_set_result(ui, uis, ui_pass);
- memset(ui_pass, 0, sizeof ui_pass);
- return 1;
+ ZeroMemory(&nid, sizeof nid);
+ nid.cbSize=sizeof nid;
+ nid.uID=1; /* application-defined icon ID */
+ nid.uFlags=NIF_MESSAGE|NIF_TIP;
+ nid.uCallbackMessage=WM_SYSTRAY; /* notification message */
+ nid.hWnd=hwnd; /* window to receive notifications */
+ if(num<0) {
+ tip=str_tprintf(TEXT("stunnel is down"));
+ current_icon=ICON_ERROR;
+ } else if(num>0) {
+ tip=str_tprintf(TEXT("stunnel connections: %d"), num);
+ current_icon=ICON_ACTIVE;
+ } else {
+ tip=str_tprintf(TEXT("stunnel is idle"));
+ current_icon=ICON_IDLE;
+ }
+ _tcsncpy(nid.szTip, tip, 63);
+ nid.szTip63=TEXT('\0');
+ str_free(tip);
+ if(!nt_service_client) {
+ nid.hIcon=global_options.iconcurrent_icon;
+ } else { /* NT service client: configuration file ignored */
+ static ICON_IMAGE iconICON_NONE={NULL, NULL, NULL};
+ if(!iconcurrent_icon)
+ iconcurrent_icon=load_icon_default(current_icon);
+ nid.hIcon=iconcurrent_icon;
+ }
+ if(current_icon!=previous_icon) {
+ nid.uFlags|=NIF_ICON;
+ previous_icon=current_icon;
+ }
+ if(Shell_NotifyIcon(NIM_MODIFY, &nid)) /* modify tooltip */
+ return; /* OK: taskbar icon exists */
+ /* tooltip update failed - try to create the icon */
+ nid.uFlags|=NIF_ICON;
+ Shell_NotifyIcon(NIM_ADD, &nid);
 }
-#endif
 
-/**************************************** log handling */
+NOEXPORT void tray_delete(void) {
+ NOTIFYICONDATA nid;
 
-NOEXPORT void save_log() {
- TCHAR file_nameMAX_PATH;
- OPENFILENAME ofn;
- LPTSTR txt;
- LPSTR str;
+ if(tray_menu_handle) {
+ ZeroMemory(&nid, sizeof nid);
+ nid.cbSize=sizeof nid;
+ nid.uID=1; /* application-defined icon ID */
+ nid.hWnd=hwnd; /* window to receive notifications */
+ nid.uFlags=NIF_TIP; /* not really sure what to put here, but it works */
+ Shell_NotifyIcon(NIM_DELETE, &nid); /* this removes the icon */
+ if(!DestroyMenu(tray_menu_handle)) /* release menu resources */
+ ioerror("DestroyMenu");
+ tray_menu_handle=NULL;
+ }
+}
 
- ZeroMemory(&ofn, sizeof ofn);
- file_name0='\0';
+/**************************************** configuration file (re)loading */
 
- ofn.lStructSize=sizeof ofn;
- ofn.hwndOwner=hwnd;
- ofn.lpstrFilter=TEXT("Log Files (*.log)\0*.log\0All Files (*.*)\0*.*\0\0");
- ofn.lpstrFile=file_name;
- ofn.nMaxFile=MAX_PATH;
- ofn.lpstrDefExt=TEXT("LOG");
- ofn.lpstrInitialDir=TEXT(".");
+NOEXPORT void config_invalid() {
+ /* update the main window title */
+ win32_name=TEXT("stunnel ") TEXT(STUNNEL_VERSION) TEXT(" on ")
+ TEXT(STUNNEL_PLATFORM) TEXT(" (invalid configuration file)");
+ SetWindowText(hwnd, win32_name);
 
- ofn.lpstrTitle=TEXT("Save Log");
- ofn.Flags=OFN_EXPLORER|OFN_PATHMUSTEXIST|OFN_HIDEREADONLY|
- OFN_OVERWRITEPROMPT;
- if(!GetSaveFileName(&ofn))
- return;
-
- txt=log_txt(); /* need to convert the result to UTF-8 */
- str=tstr2str(txt);
- str_free(txt);
- save_text_file(file_name, str);
- str_free(str);
-}
-
-NOEXPORT int save_text_file(LPTSTR file_name, char *str) {
- HANDLE file_handle;
- DWORD ignore;
-
- file_handle=CreateFile(file_name, GENERIC_WRITE, 0, NULL,
- CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
- if(file_handle==INVALID_HANDLE_VALUE) {
- error_box(TEXT("CreateFile"));
- return 1;
- }
- if(!WriteFile(file_handle, str, (DWORD)strlen(str), &ignore, NULL)) {
- CloseHandle(file_handle);
- error_box(TEXT("WriteFile"));
- return 1;
- }
- CloseHandle(file_handle);
- return 0;
-}
-
-NOEXPORT void win_log(LPCTSTR txt) {
- struct LIST *curr;
- size_t txt_len;
- static size_t log_len=0;
-
- txt_len=_tcslen(txt);
- curr=str_alloc(sizeof(struct LIST)+txt_len*sizeof(TCHAR));
- curr->len=txt_len;
- _tcscpy(curr->txt, txt);
- curr->next=NULL;
- if(tail)
- tail->next=curr;
- tail=curr;
- if(!head)
- head=tail;
- log_len++;
- while(log_len>LOG_LINES) {
- curr=head;
- head=head->next;
- str_free(curr);
- log_len--;
- }
- new_logs=1;
-}
-
-NOEXPORT void update_logs(void) {
- LPTSTR txt;
-
- if(!InterlockedExchange(&new_logs, 0))
- return;
- txt=log_txt();
- SetWindowText(edit_handle, txt);
- str_free(txt);
- SendMessage(edit_handle, WM_VSCROLL, (WPARAM)SB_BOTTOM, (LPARAM)0);
-}
-
-NOEXPORT LPTSTR log_txt(void) {
- LPTSTR buff;
- size_t ptr=0, len=0;
- struct LIST *curr;
-
- for(curr=head; curr; curr=curr->next)
- len+=curr->len+2; /* +2 for trailing '\r\n' */
- buff=str_alloc((len+1)*sizeof(TCHAR)); /* +1 for trailing '\0' */
- for(curr=head; curr; curr=curr->next) {
- memcpy(buff+ptr, curr->txt, curr->len*sizeof(TCHAR));
- ptr+=curr->len;
- if(curr->next) {
- buffptr++=TEXT('\r');
- buffptr++=TEXT('\n');
- }
- }
- buffptr=TEXT('\0');
- return buff;
-}
-
-/**************************************** worker thread */
-
-NOEXPORT unsigned __stdcall daemon_thread(void *arg) {
- (void)arg; /* squash the unused parameter warning */
-
- tls_alloc(NULL, NULL, "main"); /* new thread-local storage */
- main_init();
- SetEvent(main_initialized); /* unlock the GUI thread */
- /* get a valid configuration */
- while(main_configure(cmdline.config_file, NULL)) {
- if(cmdline.config_file && *cmdline.config_file=='-')
- cmdline.config_file=NULL; /* don't retry commandline switches */
- unbind_ports(); /* in case initialization failed after bind_ports() */
- log_flush(LOG_MODE_ERROR); /* otherwise logs are buffered */
- PostMessage(hwnd, WM_INVALID_CONFIG, 0, 0); /* display error */
- WaitForSingleObject(config_ready, INFINITE);
- log_close(); /* prevent main_configure() from logging in error mode */
- }
- PostMessage(hwnd, WM_VALID_CONFIG, 0, 0);
-
- /* start the main loop */
- daemon_loop();
- main_cleanup();
- _endthreadex(0); /* SIGNAL_TERMINATE received */
- return 0;
-}
-
-/**************************************** helper functions */
-
-NOEXPORT void invalid_config() {
- /* update the main window title */
- win32_name=TEXT("stunnel ") TEXT(STUNNEL_VERSION) TEXT(" on ")
- TEXT(STUNNEL_PLATFORM) TEXT(" (invalid configuration file)");
- SetWindowText(hwnd, win32_name);
-
- /* log window is hidden by default */
- ShowWindow(hwnd, SW_SHOWNORMAL); /* show window */
- SetForegroundWindow(hwnd); /* bring on top */
+ /* log window is hidden by default */
+ ShowWindow(hwnd, SW_SHOWNORMAL); /* show window */
+ SetForegroundWindow(hwnd); /* bring on top */
 
 tray_update(-1); /* error icon */
- update_peer_menu(); /* purge the list of sections */
+ peer_menu_update(); /* purge the list of sections */
 
- win_log(TEXT(""));
- s_log(LOG_ERR, "Server is down");
+ log_push(TEXT(""));
+ ui_new_log("Server is down");
 message_box(TEXT("Stunnel server is down due to an error.\n")
 TEXT("You need to exit and correct the problem.\n")
 TEXT("Click OK to see the error log window."),
 MB_ICONERROR);
 }
 
-NOEXPORT void valid_config() {
+NOEXPORT void config_valid() {
 /* update the main window title */
 win32_name=TEXT("stunnel ") TEXT(STUNNEL_VERSION) TEXT(" on ")
 TEXT(STUNNEL_PLATFORM);
 SetWindowText(hwnd, win32_name);
 
 tray_update(num_clients); /* idle or busy icon (on reload) */
- update_peer_menu(); /* one menu item per section */
+ peer_menu_update(); /* one menu item per section */
 
 /* enable IDM_REOPEN_LOG menu if a log file is used, disable otherwise */
+ if(!nt_service_client) {
 #ifndef _WIN32_WCE
- EnableMenuItem(main_menu_handle, IDM_REOPEN_LOG,
- (UINT)(global_options.output_file ? MF_ENABLED : MF_GRAYED));
-#endif
- if(tray_menu_handle)
- EnableMenuItem(tray_menu_handle, IDM_REOPEN_LOG,
+ EnableMenuItem(main_menu_handle, IDM_REOPEN_LOG,
 (UINT)(global_options.output_file ? MF_ENABLED : MF_GRAYED));
+#endif
+ if(tray_menu_handle)
+ EnableMenuItem(tray_menu_handle, IDM_REOPEN_LOG,
+ (UINT)(global_options.output_file ? MF_ENABLED : MF_GRAYED));
+ }
+}
+
+ /* TODO: port it to WCE */
+NOEXPORT void config_edit(HWND main_window_handle) {
+ char *quoted;
+ LPTSTR conf_path;
+ DISK_FILE *df;
+
+ if(!cmdline.config_file)
+ return;
+ quoted=str_printf("\"%s\"", cmdline.config_file);
+ conf_path=str2tstr(quoted);
+ str_free(quoted);
+
+ df=file_open(cmdline.config_file, FILE_MODE_APPEND);
+ if(df) { /* the configuration file is writable */
+ file_close(df);
+ ShellExecute(main_window_handle, TEXT("open"),
+ TEXT("notepad.exe"), conf_path,
+ NULL, SW_SHOWNORMAL);
+ } else { /* UAC workaround */
+ ShellExecute(main_window_handle, TEXT("runas"),
+ TEXT("notepad.exe"), conf_path,
+ NULL, SW_SHOWNORMAL);
+ }
+ str_free(conf_path);
+}
+
+/**************************************** peer certs */
+
+NOEXPORT void peer_menu_update(void) {
+ CRYPTO_THREAD_read_lock(stunnel_locksLOCK_SECTIONS);
+ peer_menu_update_unlocked();
+ CRYPTO_THREAD_unlock(stunnel_locksLOCK_SECTIONS);
 }
 
-NOEXPORT void update_peer_menu(void) {
+NOEXPORT void peer_menu_update_unlocked(void) {
 SERVICE_OPTIONS *section;
 #ifndef _WIN32_WCE
 HMENU main_peer_list=NULL;
@@ -977,13 +954,13 @@
 /* purge menu peer lists */
 #ifndef _WIN32_WCE
 if(main_menu_handle)
- main_peer_list=GetSubMenu(main_menu_handle, 2); /* 3rd submenu */
+ main_peer_list=GetSubMenu(main_menu_handle, 2); /* 3rd sub-menu */
 if(main_peer_list)
 while(GetMenuItemCount(main_peer_list)) /* purge old menu */
 DeleteMenu(main_peer_list, 0, MF_BYPOSITION);
 #endif
 if(tray_menu_handle)
- tray_peer_list=GetSubMenu(GetSubMenu(tray_menu_handle, 0), 2);
+ tray_peer_list=GetSubMenu(GetSubMenu(tray_menu_handle, 0), 8); /* 9th sub-menu */
 if(tray_peer_list)
 while(GetMenuItemCount(tray_peer_list)) /* purge old menu */
 DeleteMenu(tray_peer_list, 0, MF_BYPOSITION);
@@ -1027,14 +1004,53 @@
 
 ++section_number;
 }
+ if(section_number) { /* enable Save Peer Certificate */
+#ifndef _WIN32_WCE
+ /* 0 - File, 1 - Configuration, 2 - Save Peer Certificate */
+ EnableMenuItem(main_menu_handle, 2, MF_BYPOSITION|MF_ENABLED);
+#endif
+ if(tray_menu_handle) /* 9th position on the tray menu */
+ EnableMenuItem(GetSubMenu(tray_menu_handle, 0), 8, MF_BYPOSITION|MF_ENABLED);
+ }
 if(hwnd)
 DrawMenuBar(hwnd);
 }
 
+NOEXPORT void peer_cert_save(WPARAM wParam) {
+ SERVICE_OPTIONS *section;
+ unsigned section_number;
+
+ CRYPTO_THREAD_read_lock(stunnel_locksLOCK_SECTIONS);
+ for(section=service_options.next, section_number=0;
+ section && wParam!=IDM_PEER_MENU+section_number;
+ section=section->next, ++section_number)
+ ;
+ if(section && !text_file_create(section->file, section->chain)) {
+#ifndef _WIN32_WCE
+ if(main_menu_handle)
+ CheckMenuItem(main_menu_handle, (UINT)wParam, MF_CHECKED);
+#endif
+ if(tray_menu_handle)
+ CheckMenuItem(tray_menu_handle, (UINT)wParam, MF_CHECKED);
+ message_box(section->help, MB_ICONINFORMATION);
+ }
+ CRYPTO_THREAD_unlock(stunnel_locksLOCK_SECTIONS);
+}
+
+/**************************************** options callbacks */
+
+void ui_config_reloaded(void) {
+ if(!hwnd) /* NT service */
+ return; /* not supported */
+ PostMessage(hwnd, WM_VALID_CONFIG, 0, 0);
+}
+
 ICON_IMAGE load_icon_default(ICON_TYPE type) {
 WORD idi;
 ICON_IMAGE img;
 
+ if(!hwnd) /* NT service */
+ return NULL; /* not supported */
 switch(type) {
 case ICON_ACTIVE:
 idi=IDI_STUNNEL_ACTIVE;
@@ -1057,6 +1073,8 @@
 LPTSTR tname;
 ICON_IMAGE icon;
 
+ if(!hwnd) /* NT service */
+ return NULL; /* not supported */
 tname=str2tstr((LPSTR)name);
 #ifndef _WIN32_WCE
 icon=LoadImage(NULL, tname, IMAGE_ICON, GetSystemMetrics(SM_CXSMICON),
@@ -1064,148 +1082,480 @@
 #else
 /* TODO: Implement a WCE version of LoadImage() */
 /* icon=wceLoadIconFromFile(tname); */
- s_log(LOG_ERR, "Loading image from file not implemented on WCE");
+ ui_new_log("Loading image from file not implemented on WCE");
 icon=NULL;
 #endif
 str_free(tname);
 return icon;
 }
 
-NOEXPORT void tray_update(const int num) {
- NOTIFYICONDATA nid;
- static ICON_TYPE previous_icon=ICON_NONE;
- ICON_TYPE current_icon;
- LPTSTR tip;
+/**************************************** client callbacks */
 
- if(!global_options.option.taskbar) { /* currently disabled */
- tray_delete(); /* remove the taskbark icon if exists */
- return;
+void ui_new_chain(const unsigned section_number) {
+ if(!hwnd) /* NT service */
+ return; /* not supported */
+ PostMessage(hwnd, WM_NEW_CHAIN, section_number, 0);
+}
+
+void ui_clients(const long num) {
+ if(cmdline.service) { /* forward the number of connections to the connected client */
+ char *result;
+
+ result=control_pipe_call(pipe_name_ui, "connections %d", num);
+ str_free(result);
 }
- if(!tray_menu_handle) /* initialize taskbar */
- tray_menu_handle=LoadMenu(ghInst, MAKEINTRESOURCE(IDM_TRAYMENU));
- if(!tray_menu_handle) {
- ioerror("LoadMenu");
+}
+
+/**************************************** s_log callbacks */
+
+void message_box(LPCTSTR text, const UINT type) {
+ if(cmdline.quiet)
 return;
- }
- if(cmdline.service)
- EnableMenuItem(tray_menu_handle, IDM_EDIT_CONFIG, MF_GRAYED);
+ MessageBox(hwnd, text, win32_name, type);
+}
 
- ZeroMemory(&nid, sizeof nid);
- nid.cbSize=sizeof nid;
- nid.uID=1; /* application-defined icon ID */
- nid.uFlags=NIF_MESSAGE|NIF_TIP;
- nid.uCallbackMessage=WM_SYSTRAY; /* notification message */
- nid.hWnd=hwnd; /* window to receive notifications */
- if(num<0) {
- tip=str_tprintf(TEXT("Server is down"));
- current_icon=ICON_ERROR;
- } else if(num>0) {
- tip=str_tprintf(TEXT("%d active session(s)"), num);
- current_icon=ICON_ACTIVE;
- } else {
- tip=str_tprintf(TEXT("Server is idle"));
- current_icon=ICON_IDLE;
- }
- _tcsncpy(nid.szTip, tip, 63);
- nid.szTip63=TEXT('\0');
- str_free(tip);
- nid.hIcon=global_options.iconcurrent_icon;
- if(current_icon!=previous_icon) {
- nid.uFlags|=NIF_ICON;
- previous_icon=current_icon;
+void ui_new_log(const char *line) {
+ if(cmdline.service) { /* forward the log to the connected client */
+ char *result;
+
+ result=control_pipe_call(pipe_name_ui, "log %s", line);
+ str_free(result);
+ } else if(hwnd) { /* GUI mode */
+ LPTSTR txt;
+
+ txt=str2tstr(line);
+ log_push(txt);
+ str_free(txt);
 }
- if(Shell_NotifyIcon(NIM_MODIFY, &nid)) /* modify tooltip */
- return; /* OK: taskbar icon exists */
- /* tooltip update failed - try to create the icon */
- nid.uFlags|=NIF_ICON;
- Shell_NotifyIcon(NIM_ADD, &nid);
 }
 
-NOEXPORT void tray_delete(void) {
- NOTIFYICONDATA nid;
+/**************************************** ctx callbacks */
 
- if(tray_menu_handle) {
- ZeroMemory(&nid, sizeof nid);
- nid.cbSize=sizeof nid;
- nid.uID=1; /* application-defined icon ID */
- nid.hWnd=hwnd; /* window to receive notifications */
- nid.uFlags=NIF_TIP; /* not really sure what to put here, but it works */
- Shell_NotifyIcon(NIM_DELETE, &nid); /* this removes the icon */
- if(!DestroyMenu(tray_menu_handle)) /* release menu resources */
- ioerror("DestroyMenu");
- tray_menu_handle=NULL;
- }
+int ui_passwd_cb(char *buf, int size, int rwflag, void *userdata) {
+ int len;
+
+ (void)rwflag; /* squash the unused parameter warning */
+ (void)userdata; /* squash the unused parameter warning */
+ if(!hwnd) /* NT service */
+ return 0; /* not supported */
+ if(!DialogBox(ghInst, TEXT("PassBox"), hwnd, (DLGPROC)pass_proc))
+ return 0; /* dialog cancelled or failed */
+ len=(int)strlen(ui_pass);
+ if(len<0 || size<0) /* the API uses signed integers */
+ return 0;
+ if(len>size) /* truncate the returned data if needed */
+ len=size;
+ memcpy(buf, ui_pass, (size_t)len);
+ memset(ui_pass, 0, sizeof ui_pass);
+ return len;
 }
 
-NOEXPORT void error_box(LPCTSTR text) {
- LPTSTR errmsg, fullmsg;
- DWORD dw;
+#ifndef OPENSSL_NO_ENGINE
 
- dw=GetLastError();
- FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER|FORMAT_MESSAGE_FROM_SYSTEM,
- NULL, dw, MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
- (LPTSTR)&errmsg, 0, NULL);
- fullmsg=str_tprintf(TEXT("%s: error %ld: %s"), text, dw, errmsg);
- LocalFree(errmsg);
- message_box(fullmsg, MB_ICONERROR);
- str_free(fullmsg);
+NOEXPORT int pin_cb(UI *ui, UI_STRING *uis) {
+ if(!DialogBox(ghInst, TEXT("PassBox"), hwnd, (DLGPROC)pass_proc))
+ return 0; /* dialog cancelled or failed */
+ UI_set_result(ui, uis, ui_pass);
+ memset(ui_pass, 0, sizeof ui_pass);
+ return 1;
 }
 
-void message_box(LPCTSTR text, const UINT type) {
- if(cmdline.quiet)
+int (*ui_get_opener()) (UI *) {
+ return NULL;
+}
+
+int (*ui_get_writer()) (UI *, UI_STRING *) {
+ return NULL;
+}
+
+int (*ui_get_reader()) (UI *, UI_STRING *) {
+ return hwnd ? pin_cb : NULL; /* only allow for UI in GUI mode */
+}
+
+int (*ui_get_closer()) (UI *) {
+ return NULL;
+}
+
+#endif
+
+/**************************************** log handling */
+
+NOEXPORT void log_save() {
+ TCHAR file_nameMAX_PATH;
+ OPENFILENAME ofn;
+ LPTSTR txt;
+ LPSTR str;
+
+ ZeroMemory(&ofn, sizeof ofn);
+ file_name0='\0';
+
+ ofn.lStructSize=sizeof ofn;
+ ofn.hwndOwner=hwnd;
+ ofn.lpstrFilter=TEXT("Log Files (*.log)\0*.log\0All Files (*.*)\0*.*\0\0");
+ ofn.lpstrFile=file_name;
+ ofn.nMaxFile=MAX_PATH;
+ ofn.lpstrDefExt=TEXT("LOG");
+ ofn.lpstrInitialDir=TEXT(".");
+
+ ofn.lpstrTitle=TEXT("Save Log");
+ ofn.Flags=OFN_EXPLORER|OFN_PATHMUSTEXIST|OFN_HIDEREADONLY|
+ OFN_OVERWRITEPROMPT;
+ if(!GetSaveFileName(&ofn))
 return;
- MessageBox(hwnd, text, win32_name, type);
+
+ CRYPTO_THREAD_write_lock(stunnel_locksLOCK_WIN_LOG);
+ txt=log_txt(); /* need to convert the result to UTF-8 */
+ CRYPTO_THREAD_unlock(stunnel_locksLOCK_WIN_LOG);
+ str=tstr2str(txt);
+ str_free(txt);
+ text_file_create(file_name, str);
+ str_free(str);
 }
 
-void ui_new_chain(const unsigned section_number) {
- PostMessage(hwnd, WM_NEW_CHAIN, section_number, 0);
+NOEXPORT void log_push(LPCTSTR txt) {
+ struct LIST *curr;
+ size_t txt_len;
+ static size_t log_len=0;
+
+ txt_len=_tcslen(txt);
+ curr=str_alloc_detached(sizeof(struct LIST)+txt_len*sizeof(TCHAR));
+ curr->len=txt_len;
+ _tcscpy(curr->txt, txt);
+ curr->next=NULL;
+
+ /* this critical section is performance critical */
+ CRYPTO_THREAD_write_lock(stunnel_locksLOCK_WIN_LOG);
+ if(tail)
+ tail->next=curr;
+ tail=curr;
+ if(!head)
+ head=tail;
+ log_len++;
+ new_logs=TRUE;
+ if(log_len>LOG_LINES) {
+ curr=head;
+ head=head->next;
+ log_len--;
+ removed_logs++;
+ } else {
+ curr=NULL;
+ }
+ CRYPTO_THREAD_unlock(stunnel_locksLOCK_WIN_LOG);
+
+ str_free(curr);
 }
 
-void ui_new_log(const char *line) {
+NOEXPORT void log_update(void) {
 LPTSTR txt;
- txt=str2tstr(line);
- str_detach(txt); /* this allocation will be freed in the GUI thread */
- PostMessage(hwnd, WM_LOG, (WPARAM)txt, 0);
+ int offset;
+
+ if(!visible || Button_GetCheck(pause_handle))
+ return;
+
+ /* retrieve the new edit control text */
+ CRYPTO_THREAD_write_lock(stunnel_locksLOCK_WIN_LOG);
+ if(new_logs) {
+ txt=log_txt();
+ new_logs=FALSE;
+ offset=removed_logs;
+ removed_logs=0;
+ } else {
+ txt=NULL;
+ offset=0; /* only needed to avoid a warning in MSVC */
+ }
+ CRYPTO_THREAD_unlock(stunnel_locksLOCK_WIN_LOG);
+
+ if(txt) {
+ int cur_pos, max_pos;
+ WPARAM vscroll_param;
+
+ /* update the text and scroll it without flickering */
+ SendMessage(edit_handle, WM_SETREDRAW, (WPARAM)FALSE, (LPARAM)0);
+ cur_pos=GetScrollPos(edit_handle, SB_VERT);
+ SendMessage(edit_handle, WM_VSCROLL, (WPARAM)SB_BOTTOM, (LPARAM)0);
+ max_pos=GetScrollPos(edit_handle, SB_VERT);
+ SetWindowText(edit_handle, txt);
+ str_free(txt);
+ /* stick to the bottom, otherwise scroll up if lines were removed */
+ vscroll_param=cur_pos==max_pos ? (WPARAM)SB_BOTTOM :
+ MAKEWPARAM(SB_THUMBPOSITION, cur_pos<offset ? 0 : cur_pos-offset);
+ SendMessage(edit_handle, WM_VSCROLL, vscroll_param, (LPARAM)0);
+ SendMessage(edit_handle, WM_SETREDRAW, (WPARAM)TRUE, (LPARAM)0);
+
+ /* redraw the affected areas of the edit control */
+ if(cur_pos==max_pos || cur_pos<offset) /* visible text has changed */
+ UpdateWindow(edit_handle);
+ else /* only update the vertical scrollbar */
+ SetScrollPos(edit_handle, SB_VERT, cur_pos-offset, TRUE);
+ }
 }
 
-void ui_config_reloaded(void) {
- PostMessage(hwnd, WM_VALID_CONFIG, 0, 0);
+NOEXPORT LPTSTR log_txt(void) {
+ LPTSTR buff;
+ size_t ptr=0, len=0;
+ struct LIST *curr;
+
+ for(curr=head; curr; curr=curr->next)
+ len+=curr->len+2; /* +2 for trailing '\r\n' */
+ buff=str_alloc((len+1)*sizeof(TCHAR)); /* +1 for trailing '\0' */
+ for(curr=head; curr; curr=curr->next) {
+ memcpy(buff+ptr, curr->txt, curr->len*sizeof(TCHAR));
+ ptr+=curr->len;
+ if(curr->next) {
+ buffptr++=TEXT('\r');
+ buffptr++=TEXT('\n');
+ }
+ }
+ buffptr=TEXT('\0');
+ return buff;
 }
 
-void ui_clients(const long num) {
- PostMessage(hwnd, WM_CLIENTS, (WPARAM)num, 0);
+/**************************************** control pipe */
+
+/* build a pipe file name from the configuration file name */
+NOEXPORT void control_pipe_names() {
+ char *pipe_name_txt, *text;
+
+ if(cmdline.config_file) {
+ unsigned char hash_binSHA256_DIGEST_LENGTH;
+ char hash_txt2*SHA256_DIGEST_LENGTH+1;
+
+ /* SHA256 is only used here to prevent collisions, and not for security */
+ SHA256((unsigned char *)cmdline.config_file, strlen(cmdline.config_file), hash_bin);
+ bin2hexstring(hash_bin, sizeof hash_bin, hash_txt, sizeof hash_txt);
+ pipe_name_txt=str_printf("\\\\.\\pipe\\%s", hash_txt);
+ } else {
+ pipe_name_txt=str_dup("\\\\.\\pipe\\stunnel-fallback");
+ }
+ text=str_printf("%s-ui", pipe_name_txt);
+ pipe_name_ui=str2tstr(text);
+ str_free(text);
+ text=str_printf("%s-service", pipe_name_txt);
+ pipe_name_service=str2tstr(text);
+ str_free(text);
+ str_free(pipe_name_txt);
 }
 
- /* TODO: port it to WCE */
-NOEXPORT void edit_config(HWND main_window_handle) {
- TCHAR cwdMAX_PATH;
- LPTSTR conf_file, conf_path;
- DISK_FILE *df;
+/* attempt to send a command to an already running stunnel */
+NOEXPORT int control_pipe_client() {
+ char *result=NULL;
+
+ if(cmdline.exit || cmdline.reload || cmdline.reopen) {
+ if(cmdline.exit)
+ result=control_pipe_call(pipe_name_service, "signal %u", SIGNAL_TERMINATE);
+ else if(cmdline.reload)
+ result=control_pipe_call(pipe_name_service, "signal %u", SIGNAL_RELOAD_CONFIG);
+ else if(cmdline.reopen)
+ result=control_pipe_call(pipe_name_service, "signal %u", SIGNAL_REOPEN_LOG);
+ if(!result) {
+ message_box(TEXT("The target stunnel was not found"), MB_ICONERROR);
+ return 1; /* terminate this instance */
+ }
+ if(strcasecmp(result, "succeeded")) {
+ message_box(TEXT("Request failed"), MB_ICONERROR);
+ str_free(result);
+ return 1; /* terminate this instance */
+ }
+ message_box(TEXT("Request succeeded"), MB_ICONINFORMATION);
+ str_free(result);
+ return 1; /* terminate this instance */
+ }
+ result=control_pipe_call(pipe_name_service, "connect");
+ if(!result)
+ return 0; /* proceed with GUI initialization */
+ if(!is_prefix(result, "service ")) {
+ str_free(result);
+ return 1; /* terminate this instance */
+ }
+ num_clients=atol(result+8);
+ str_free(result);
+
+ nt_service_client=TRUE;
+ sthreads_init(); /* required for locking to work */
+ if(control_pipe_server(pipe_name_ui))
+ return 1; /* a control pipe ui already exists or failed */
+ gui_init();
+ win32_name=TEXT("stunnel ") TEXT(STUNNEL_VERSION) TEXT(" on ")
+ TEXT(STUNNEL_PLATFORM) TEXT(" (NT service client)");
+ SetWindowText(hwnd, win32_name);
+#ifndef _WIN32_WCE
+ EnableMenuItem(main_menu_handle, IDM_REOPEN_LOG, MF_ENABLED);
+#endif
+ if(tray_menu_handle)
+ EnableMenuItem(tray_menu_handle, IDM_REOPEN_LOG, MF_ENABLED);
+ ShowWindow(hwnd, SW_SHOWNORMAL); /* show window */
+ SetForegroundWindow(hwnd); /* bring on top */
+ /* create a UI pipe thread for accepting logs */
+ gui_loop();
+ return 0; /* terminate this instance */
+}
+
+/* create a new control pipe server */
+NOEXPORT int control_pipe_server(LPTSTR pipe_name) {
+ char *result;
+ HANDLE thread;
+
+ result=control_pipe_call(pipe_name, "connect");
+ if(result) { /* a control pipe server already exists */
+ str_free(result);
+ return 1;
+ }
+ thread=(HANDLE)_beginthreadex(NULL, DEFAULT_STACK_SIZE,
+ control_pipe_server_thread, pipe_name, 0, NULL);
+ if(!thread) {
+ message_box(TEXT("Failed to create a control pipe server"), MB_ICONERROR);
+ return 1;
+ }
+ CloseHandle(thread);
+ return 0;
+}
 
- conf_file=str2tstr(configuration_file);
- if(*conf_file==TEXT('\"')) {
- conf_path=conf_file;
- } else if(_tcschr(conf_file, TEXT('\\'))) {
- conf_path=str_tprintf(TEXT("\"%s\""), conf_file);
- str_free(conf_file);
+#define MSG_SIZE 256
+
+NOEXPORT unsigned __stdcall control_pipe_server_thread(void *arg) {
+ LPTSTR pipe_name=arg;
+ SECURITY_ATTRIBUTES sa;
+
+ tls_alloc(NULL, NULL, "control server");
+
+ /* initialize security attributes */
+ sa.nLength=sizeof(SECURITY_ATTRIBUTES);
+ sa.bInheritHandle=FALSE;
+ sa.lpSecurityDescriptor=NULL;
+ if(ConvertStringSecurityDescriptorToSecurityDescriptor(
+ TEXT("D:") /* discretionary ACL */
+ TEXT("(D;OICI;GA;;;BG)") /* deny access to Built-in Guests */
+ TEXT("(D;OICI;GA;;;AN)") /* deny access to Anonymous Logon */
+ TEXT("(A;OICI;GRGW;;;AU)"), /* allow read/write to Authenticated Users */
+ SDDL_REVISION_1, &sa.lpSecurityDescriptor, NULL)) {
+ /* spawn new threads for incoming client connections */
+ for(;;) {
+ BOOL connected;
+ HANDLE pipe=CreateNamedPipe(pipe_name, PIPE_ACCESS_DUPLEX,
+ PIPE_TYPE_MESSAGE|PIPE_READMODE_MESSAGE|PIPE_WAIT,
+ PIPE_UNLIMITED_INSTANCES, MSG_SIZE, MSG_SIZE, 3000, &sa);
+ if(pipe==INVALID_HANDLE_VALUE) {
+ message_box(TEXT("Failed to create a control pipe"), MB_ICONERROR);
+ break;
+ }
+ connected=ConnectNamedPipe(pipe, NULL);
+ if(!connected)
+ connected=(GetLastError()==ERROR_PIPE_CONNECTED);
+ if(connected) {
+ HANDLE thread=(HANDLE)_beginthreadex(NULL, DEFAULT_STACK_SIZE,
+ control_pipe_instance_thread, pipe, 0, NULL);
+ if(thread)
+ CloseHandle(thread);
+ } else {
+ CloseHandle(pipe);
+ }
+ }
 } else {
- GetCurrentDirectory(MAX_PATH, cwd);
- conf_path=str_tprintf(TEXT("\"%s\\%s\""), cwd, conf_file);
- str_free(conf_file);
+ message_box(TEXT("Failed to create a security descriptor"), MB_ICONERROR);
 }
 
- df=file_open(configuration_file, FILE_MODE_APPEND);
- if(df) { /* the configuration file is writable */
- file_close(df);
- ShellExecute(main_window_handle, TEXT("open"),
- TEXT("notepad.exe"), conf_path,
- NULL, SW_SHOWNORMAL);
- } else { /* UAC workaround */
- ShellExecute(main_window_handle, TEXT("runas"),
- TEXT("notepad.exe"), conf_path,
- NULL, SW_SHOWNORMAL);
+ if(nt_service_client && hwnd)
+ PostMessage(hwnd, WM_TERMINATE, 0, 0); /* terminate GUI */
+ tls_cleanup();
+ _endthreadex(0);
+ return 0;
+}
+
+NOEXPORT unsigned __stdcall control_pipe_instance_thread(void *arg) {
+ HANDLE pipe=arg;
+ char *message;
+
+ tls_alloc(NULL, NULL, "control instance");
+
+ /* process incoming data */
+ message=control_pipe_recv(pipe);
+ if(message) {
+ if(hwnd) { /* UI is available */
+ if(is_prefix(message, "log ")) {
+ control_pipe_send(pipe, "succeeded");
+ ui_new_log(message+4);
+ } else if(is_prefix(message, "connections ")) {
+ control_pipe_send(pipe, "succeeded");
+ num_clients=atol(message+12);
+ } else if(is_prefix(message, "signal ")) {
+ control_pipe_send(pipe, "succeeded");
+ gui_signal_post((uint8_t)atoi(message+7));
+ } else if(!strcasecmp(message, "connect")) {
+ control_pipe_send(pipe, "succeeded");
+ ShowWindow(hwnd, SW_SHOWNORMAL); /* show window */
+ SetForegroundWindow(hwnd); /* bring on top */
+ } else if(!strcasecmp(message, "terminate")) {
+ control_pipe_send(pipe, "succeeded");
+ PostMessage(hwnd, WM_TERMINATE, 0, 0); /* terminate GUI */
+ } else { /* ignore unknown messages */
+ control_pipe_send(pipe, "ignored");
+ }
+ } else if(cmdline.service) { /* NT service */
+ if(is_prefix(message, "signal ")) {
+ control_pipe_send(pipe, "succeeded");
+ signal_post((uint8_t)atoi(message+7));
+ } else if(!strcasecmp(message, "connect")) {
+ control_pipe_send(pipe, "service %d", num_clients);
+ } else { /* ignore unknown messages */
+ control_pipe_send(pipe, "ignored");
+ }
+ } else {
+ control_pipe_send(pipe, "failed");
+ }
+ str_free(message);
 }
- str_free(conf_path);
+ CloseHandle(pipe);
+ tls_cleanup();
+ _endthreadex(0);
+ return 0;
+}
+
+NOEXPORT int control_pipe_send(HANDLE pipe, const char *format, ...) {
+ va_list ap;
+ char *send_buf;
+ BOOL success;
+ DWORD send_len, sent_len;
+
+ va_start(ap, format);
+ send_buf=str_vprintf(format, ap);
+ va_end(ap);
+ send_len=(DWORD)strlen(send_buf);
+ success=WriteFile(pipe, send_buf, send_len, &sent_len, NULL);
+ str_free(send_buf);
+ return !success || sent_len!=send_len;
+}
+
+NOEXPORT char *control_pipe_recv(HANDLE pipe) {
+ char recv_bufMSG_SIZE+1;
+ BOOL success;
+ DWORD recv_len;
+
+ success=ReadFile(pipe, recv_buf, MSG_SIZE, &recv_len, NULL);
+ if(!success || !recv_len)
+ return NULL;
+ recv_bufrecv_len='\0'; /* null-terminate the received message */
+ return str_dup(recv_buf);
+}
+
+NOEXPORT char *control_pipe_call(LPTSTR name, const char *format, ...) {
+ va_list ap;
+ char recv_bufMSG_SIZE+1, *send_buf;
+ BOOL success;
+ DWORD send_len, recv_len;
+
+ va_start(ap, format);
+ send_buf=str_vprintf(format, ap);
+ va_end(ap);
+ send_len=(DWORD)strlen(send_buf);
+ success=CallNamedPipe(name,
+ send_buf, send_len,
+ recv_buf, MSG_SIZE,
+ &recv_len, 3000);
+ str_free(send_buf);
+ if(!success || !recv_len)
+ return NULL;
+ recv_bufrecv_len='\0'; /* null-terminate the message */
+ return str_dup(recv_buf);
 }
 
 /**************************************** windows service */
@@ -1217,8 +1567,6 @@
 
 serviceTable0.lpServiceName=SERVICE_NAME;
 serviceTable0.lpServiceProc=service_main;
- /* disable taskbar for security */
- /* global_options.option.taskbar=0; */
 if(!StartServiceCtrlDispatcher(serviceTable)) {
 error_box(TEXT("StartServiceCtrlDispatcher"));
 return 1;
@@ -1242,10 +1590,9 @@
 }
 GetModuleFileName(0, stunnel_exe_path, MAX_PATH);
 service_path=str_tprintf(TEXT("\"%s\" -service %s"),
- stunnel_exe_path, get_params());
+ stunnel_exe_path, params_get());
 service=CreateService(scm, SERVICE_NAME, SERVICE_DISPLAY_NAME,
- SERVICE_ALL_ACCESS,
- SERVICE_WIN32_OWN_PROCESS|SERVICE_INTERACTIVE_PROCESS,
+ SERVICE_ALL_ACCESS, SERVICE_WIN32_OWN_PROCESS,
 SERVICE_AUTO_START, SERVICE_ERROR_NORMAL, service_path,
 NULL, NULL, TEXT("TCPIP\0"), NULL, NULL);
 if(!service) {
@@ -1267,7 +1614,7 @@
 
 NOEXPORT int service_uninstall(void) {
 SC_HANDLE scm, service;
- SERVICE_STATUS serviceStatus;
+ SERVICE_STATUS service_status;
 
 scm=OpenSCManager(0, 0, SC_MANAGER_CONNECT);
 if(!scm) {
@@ -1280,13 +1627,13 @@
 CloseServiceHandle(scm);
 return 1;
 }
- if(!QueryServiceStatus(service, &serviceStatus)) {
+ if(!QueryServiceStatus(service, &service_status)) {
 error_box(TEXT("QueryServiceStatus"));
 CloseServiceHandle(service);
 CloseServiceHandle(scm);
 return 1;
 }
- if(serviceStatus.dwCurrentState!=SERVICE_STOPPED) {
+ if(service_status.dwCurrentState!=SERVICE_STOPPED) {
 message_box(TEXT("The service is still running"), MB_ICONERROR);
 CloseServiceHandle(service);
 CloseServiceHandle(scm);
@@ -1306,7 +1653,7 @@
 
 NOEXPORT int service_start(void) {
 SC_HANDLE scm, service;
- SERVICE_STATUS serviceStatus;
+ SERVICE_STATUS service_status;
 
 scm=OpenSCManager(0, 0, SC_MANAGER_CONNECT);
 if(!scm) {
@@ -1327,14 +1674,14 @@
 }
 do {
 Sleep(1000);
- if(!QueryServiceStatus(service, &serviceStatus)) {
+ if(!QueryServiceStatus(service, &service_status)) {
 error_box(TEXT("QueryServiceStatus"));
 CloseServiceHandle(service);
 CloseServiceHandle(scm);
 return 1;
 }
- } while(serviceStatus.dwCurrentState==SERVICE_START_PENDING);
- if(serviceStatus.dwCurrentState!=SERVICE_RUNNING) {
+ } while(service_status.dwCurrentState==SERVICE_START_PENDING);
+ if(service_status.dwCurrentState!=SERVICE_RUNNING) {
 message_box(TEXT("Failed to start service"), MB_ICONERROR);
 CloseServiceHandle(service);
 CloseServiceHandle(scm);
@@ -1348,7 +1695,7 @@
 
 NOEXPORT int service_stop(void) {
 SC_HANDLE scm, service;
- SERVICE_STATUS serviceStatus;
+ SERVICE_STATUS service_status;
 
 scm=OpenSCManager(0, 0, SC_MANAGER_CONNECT);
 if(!scm) {
@@ -1361,19 +1708,19 @@
 CloseServiceHandle(scm);
 return 1;
 }
- if(!QueryServiceStatus(service, &serviceStatus)) {
+ if(!QueryServiceStatus(service, &service_status)) {
 error_box(TEXT("QueryServiceStatus"));
 CloseServiceHandle(service);
 CloseServiceHandle(scm);
 return 1;
 }
- if(serviceStatus.dwCurrentState==SERVICE_STOPPED) {
+ if(service_status.dwCurrentState==SERVICE_STOPPED) {
 message_box(TEXT("The service is already stopped"), MB_ICONERROR);
 CloseServiceHandle(service);
 CloseServiceHandle(scm);
 return 1;
 }
- if(!ControlService(service, SERVICE_CONTROL_STOP, &serviceStatus)) {
+ if(!ControlService(service, SERVICE_CONTROL_STOP, &service_status)) {
 error_box(TEXT("ControlService"));
 CloseServiceHandle(service);
 CloseServiceHandle(scm);
@@ -1381,71 +1728,19 @@
 }
 do {
 Sleep(1000);
- if(!QueryServiceStatus(service, &serviceStatus)) {
+ if(!QueryServiceStatus(service, &service_status)) {
 error_box(TEXT("QueryServiceStatus"));
 CloseServiceHandle(service);
 CloseServiceHandle(scm);
 return 1;
 }
- } while(serviceStatus.dwCurrentState!=SERVICE_STOPPED);
+ } while(service_status.dwCurrentState!=SERVICE_STOPPED);
 message_box(TEXT("Service stopped"), MB_ICONINFORMATION);
 CloseServiceHandle(service);
 CloseServiceHandle(scm);
 return 0;
 }
 
-NOEXPORT int service_user(DWORD sig) {
- SC_HANDLE scm, service;
- SERVICE_STATUS serviceStatus;
-
- scm=OpenSCManager(0, 0, SC_MANAGER_CONNECT);
- if(!scm) {
- error_box(TEXT("OpenSCManager"));
- return 1;
- }
- service=OpenService(scm, SERVICE_NAME,
- SERVICE_QUERY_STATUS|SERVICE_USER_DEFINED_CONTROL);
- if(!service) {
- error_box(TEXT("OpenService"));
- CloseServiceHandle(scm);
- return 1;
- }
- if(!QueryServiceStatus(service, &serviceStatus)) {
- error_box(TEXT("QueryServiceStatus"));
- CloseServiceHandle(service);
- CloseServiceHandle(scm);
- return 1;
- }
- if(serviceStatus.dwCurrentState==SERVICE_STOPPED) {
- message_box(TEXT("The service is stopped"), MB_ICONERROR);
- CloseServiceHandle(service);
- CloseServiceHandle(scm);
- return 1;
- }
- if(!ControlService(service, SERVICE_CONTROL_USER+sig, &serviceStatus)) {
- error_box(TEXT("ControlService"));
- CloseServiceHandle(service);
- CloseServiceHandle(scm);
- return 1;
- }
- switch(sig) {
- case SIGNAL_RELOAD_CONFIG:
- message_box(TEXT("Service configuration reloaded"),
- MB_ICONINFORMATION);
- break;
- case SIGNAL_REOPEN_LOG:
- message_box(TEXT("Service log file reopened"),
- MB_ICONINFORMATION);
- break;
- default:
- message_box(TEXT("Undefined operation requested"),
- MB_ICONINFORMATION);
- }
- CloseServiceHandle(service);
- CloseServiceHandle(scm);
- return 0;
-}
-
 NOEXPORT void WINAPI service_main(DWORD argc, LPTSTR* argv) {
 (void)argc; /* squash the unused parameter warning */
 (void)argv; /* squash the unused parameter warning */
@@ -1465,6 +1760,8 @@
 RegisterServiceCtrlHandler(SERVICE_NAME, control_handler);
 
 if(serviceStatusHandle) {
+ char *result;
+
 /* service is starting */
 serviceStatus.dwCurrentState=SERVICE_START_PENDING;
 SetServiceStatus(serviceStatusHandle, &serviceStatus);
@@ -1475,7 +1772,13 @@
 serviceStatus.dwCurrentState=SERVICE_RUNNING;
 SetServiceStatus(serviceStatusHandle, &serviceStatus);
 
- gui_loop();
+ /* start the main loop */
+ main_init();
+ if(!main_configure(cmdline.config_file, NULL))
+ daemon_loop();
+ result=control_pipe_call(pipe_name_ui, "terminate");
+ str_free(result);
+ main_cleanup();
 
 /* service was stopped */
 serviceStatus.dwCurrentState=SERVICE_STOP_PENDING;
@@ -1497,18 +1800,12 @@
 case SERVICE_CONTROL_STOP:
 serviceStatus.dwCurrentState=SERVICE_STOP_PENDING;
 SetServiceStatus(serviceStatusHandle, &serviceStatus);
- PostMessage(hwnd, WM_COMMAND, IDM_EXIT, 0);
+ signal_post(SIGNAL_TERMINATE);
 return;
 case SERVICE_CONTROL_PAUSE:
 break;
 case SERVICE_CONTROL_CONTINUE:
 break;
- case SERVICE_CONTROL_USER+SIGNAL_RELOAD_CONFIG:
- signal_post(SIGNAL_RELOAD_CONFIG);
- break;
- case SERVICE_CONTROL_USER+SIGNAL_REOPEN_LOG:
- signal_post(SIGNAL_REOPEN_LOG);
- break;
 default:
 if(controlCode >= 128 && controlCode <= 255)
 break; /* user defined control code */
@@ -1520,13 +1817,15 @@
 
 #endif /* !defined(_WIN32_WCE) */
 
-/**************************************** other functions */
+/**************************************** helper functions */
 
-NOEXPORT LPTSTR get_params() {
+NOEXPORT LPTSTR params_get() {
 LPTSTR c;
 TCHAR s;
 
 c=GetCommandLine();
+
+ /* skip executable path */
 if(*c==TEXT('\"')) {
 s=TEXT('\"');
 ++c;
@@ -1538,9 +1837,75 @@
 ++c;
 break;
 }
+
+ /* skip spaces */
 while(*c==TEXT(' '))
 ++c;
- return c;
+
+ return c; /* return parameters */
+}
+
+NOEXPORT int text_file_create(LPTSTR file_name, char *str) {
+ HANDLE file_handle;
+ DWORD ignore;
+
+ file_handle=CreateFile(file_name, GENERIC_WRITE, 0, NULL,
+ CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
+ if(file_handle==INVALID_HANDLE_VALUE) {
+ error_box(TEXT("CreateFile"));
+ return 1;
+ }
+ if(!WriteFile(file_handle, str, (DWORD)strlen(str), &ignore, NULL)) {
+ CloseHandle(file_handle);
+ error_box(TEXT("WriteFile"));
+ return 1;
+ }
+ CloseHandle(file_handle);
+ return 0;
+}
+
+/* a wrapper is needed for GUI (not for NT service), as signal_pipe only
+ * becomes active after the first valid configuration file is loaded */
+NOEXPORT void gui_signal_post(uint8_t sig) {
+ if(nt_service_client) {
+ char *result;
+
+ /* forward the signal to the connected server */
+ result=control_pipe_call(pipe_name_service, "signal %u", sig);
+ str_free(result);
+ } else if(num_clients>=0) { /* signal_pipe is active */
+ signal_post(sig);
+ if(hwnd && sig==SIGNAL_TERMINATE) { /* forcefully close the GUI */
+ /* 3 seconds for the main and client threads to save the final logs */
+ if(WaitForSingleObject(main_terminated, 3000) != WAIT_OBJECT_0)
+ PostMessage(hwnd, WM_TERMINATE, 0, 0); /* terminate GUI */
+ }
+ } else { /* no valid configuration file is loaded */
+ switch(sig) {
+ case SIGNAL_TERMINATE:
+ PostMessage(hwnd, WM_TERMINATE, 0, 0); /* terminate GUI */
+ break;
+ case SIGNAL_RELOAD_CONFIG:
+ SetEvent(config_ready); /* unlock daemon_thread() */
+ break;
+ default: /* ignore */
+ break;
+ }
+ }
+}
+
+NOEXPORT void error_box(LPCTSTR text) {
+ LPTSTR errmsg, fullmsg;
+ DWORD dw;
+
+ dw=GetLastError();
+ FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER|FORMAT_MESSAGE_FROM_SYSTEM,
+ NULL, dw, MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
+ (LPTSTR)&errmsg, 0, NULL);
+ fullmsg=str_tprintf(TEXT("%s: error %ld: %s"), text, dw, errmsg);
+ LocalFree(errmsg);
+ message_box(fullmsg, MB_ICONERROR);
+ str_free(fullmsg);
 }
 
 /* end of ui_win_gui.c */

_service:tar_scm:stunnel-5.48.tar.gz/src/vc.mak -> _service:tar_scm:stunnel-5.69.tar.gz/src/vc.mak Changed

_service:tar_scm:stunnel-5.48.tar.gz/src/verify.c -> _service:tar_scm:stunnel-5.69.tar.gz/src/verify.c Changed

@@ -1,6 +1,6 @@
 /*
 * stunnel TLS offloading and load-balancing proxy
- * Copyright (C) 1998-2018 Michal Trojnara <Michal.Trojnara@stunnel.org>
+ * Copyright (C) 1998-2023 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
@@ -35,17 +35,16 @@
 * forward this exception.
 */
 
-#include "common.h"
 #include "prototypes.h"
 
 /**************************************** prototypes */
 
 /* verify initialization */
-NOEXPORT void set_client_CA_list(SERVICE_OPTIONS *section);
-NOEXPORT void auth_warnings(SERVICE_OPTIONS *);
-NOEXPORT int crl_init(SERVICE_OPTIONS *section);
+NOEXPORT int init_ca(SERVICE_OPTIONS *section);
+NOEXPORT int init_crl(SERVICE_OPTIONS *section);
 NOEXPORT int load_file_lookup(X509_STORE *, char *);
 NOEXPORT int add_dir_lookup(X509_STORE *, char *);
+NOEXPORT void auth_warnings(SERVICE_OPTIONS *);
 
 /* verify callback */
 NOEXPORT int verify_callback(int, X509_STORE_CTX *);
@@ -73,21 +72,11 @@
 int verify_init(SERVICE_OPTIONS *section) {
 int verify_mode=0;
 
- /* CA initialization */
- if(section->ca_file || section->ca_dir) {
- if(!SSL_CTX_load_verify_locations(section->ctx,
- section->ca_file, section->ca_dir)) {
- sslerror("SSL_CTX_load_verify_locations");
- return 1; /* FAILED */
- }
- }
- if(section->ca_file && !section->option.client)
- set_client_CA_list(section); /* only performed on the server */
-
- /* CRL initialization */
- if(section->crl_file || section->crl_dir)
- if(crl_init(section))
+ if(init_ca(section))
+ if(section->option.verify_chain || section->option.verify_peer)
 return 1; /* FAILED */
+ if(init_crl(section))
+ return 1; /* FAILED */
 
 /* verify callback setup */
 if(section->option.request_cert) {
@@ -96,24 +85,72 @@
 verify_mode|=SSL_VERIFY_FAIL_IF_NO_PEER_CERT;
 }
 SSL_CTX_set_verify(section->ctx, verify_mode, verify_callback);
+
 auth_warnings(section);
 
 return 0; /* OK */
 }
 
-/* trusted CA names sent to clients for client cert selection */
-NOEXPORT void set_client_CA_list(SERVICE_OPTIONS *section) {
- STACK_OF(X509_NAME) *ca_dn;
+NOEXPORT int init_ca(SERVICE_OPTIONS *section) {
+ STACK_OF(X509_NAME) *ca_dn=NULL;
+#ifndef OPENSSL_NO_ENGINE
+ NAME_LIST *ptr;
+#endif
+
+ ca_dn=sk_X509_NAME_new_null();
+
+#ifndef OPENSSL_NO_ENGINE
+ /* CA and client CA list initialization with the engine */
+ for(ptr=section->ca_engine; ptr; ptr=ptr->next) {
+ X509 *cert=engine_get_cert(section->engine, ptr->name);
+ if(cert) {
+ X509_STORE_add_cert(SSL_CTX_get_cert_store(section->ctx), cert);
+ sk_X509_NAME_push(ca_dn,
+ X509_NAME_dup(X509_get_subject_name(cert)));
+ X509_free(cert);
+ } else {
+ s_log(LOG_ERR, "CAengine failed to retrieve \"%s\"", ptr->name);
+ }
+ }
+#endif
+
+ /* client CA list initialization with the file and/or directory */
+ if(section->ca_file)
+ SSL_add_file_cert_subjects_to_stack(ca_dn, section->ca_file);
+ if(section->ca_dir)
+ SSL_add_dir_cert_subjects_to_stack(ca_dn, section->ca_dir);
+
+ if(!sk_X509_NAME_num(ca_dn)) {
+ s_log(LOG_ERR, "No trusted certificates found");
+ sk_X509_NAME_pop_free(ca_dn, X509_NAME_free);
+ return 1; /* FAILED */
+ }
+
+ if(section->option.client) {
+ print_CA_list("Configured trusted server CA", ca_dn);
+ sk_X509_NAME_pop_free(ca_dn, X509_NAME_free);
+ } else { /* only set the client CA list on the server */
+ print_CA_list("Configured trusted client CA", ca_dn);
+ SSL_CTX_set_client_CA_list(section->ctx, ca_dn);
+ }
 
- s_log(LOG_DEBUG, "Client CA list: %s", section->ca_file);
- ca_dn=SSL_load_client_CA_file(section->ca_file);
- SSL_CTX_set_client_CA_list(section->ctx, ca_dn);
- print_client_CA_list(ca_dn);
+ /* CA initialization with the file and/or directory */
+ if(section->ca_file || section->ca_dir) {
+ if(!SSL_CTX_load_verify_locations(section->ctx,
+ section->ca_file, section->ca_dir)) {
+ sslerror("SSL_CTX_load_verify_locations");
+ }
+ }
+
+ return 0; /* OK */
 }
 
-NOEXPORT int crl_init(SERVICE_OPTIONS *section) {
+NOEXPORT int init_crl(SERVICE_OPTIONS *section) {
 X509_STORE *store;
 
+ if(!section->crl_file && !section->crl_dir)
+ return 0; /* OK (nothing to initialize) */
+
 store=SSL_CTX_get_cert_store(section->ctx);
 if(section->crl_file) {
 if(load_file_lookup(store, section->crl_file))
@@ -214,18 +251,23 @@
 s_log(LOG_INFO, "Certificate verification disabled");
 return 1; /* accept */
 }
- if(verify_checks(c, preverify_ok, callback_ctx)) {
- if(!SSL_SESSION_set_ex_data(SSL_get_session(ssl),
- index_session_authenticated, (void *)(-1))) {
+ if(verify_checks(c, preverify_ok, callback_ctx))
+ return 1; /* accept */
+ if(c->opt->option.connect_before_ssl)
+ return 0; /* reject */
+ if(c->opt->redirect_addr.names) {
+ SSL_SESSION *sess=SSL_get1_session(c->ssl);
+ if(!sess)
+ return 0; /* reject */
+ if(!SSL_SESSION_set_ex_data(sess,
+ index_session_authenticated, NULL)) {
 sslerror("SSL_SESSION_set_ex_data");
+ SSL_SESSION_free(sess);
 return 0; /* reject */
 }
+ SSL_SESSION_free(sess);
 return 1; /* accept */
 }
- if(c->opt->option.client || c->opt->protocol)
- return 0; /* reject */
- if(c->opt->redirect_addr.names)
- return 1; /* accept */
 return 0; /* reject */
 }
 
@@ -466,7 +508,7 @@
 }
 
 /* use the responder from AIA (Authority Information Access) */
- if(c->opt->option.aia && (aia=X509_get1_ocsp(cert))) {
+ if(c->opt->option.aia && (aia=X509_get1_ocsp(cert))!=NULL) {
 for(i=0; i<sk_OPENSSL_STRING_num(aia); i++) {
 url=sk_OPENSSL_STRING_value(aia, i);
 s_log(LOG_NOTICE, "OCSP: Connecting the AIA responder \"%s\"", url);
@@ -651,7 +693,7 @@
 
 /* OCSP protocol communication loop */
 while(OCSP_sendreq_nbio(&resp, req_ctx)==-1) {
- s_poll_init(c->fds);
+ s_poll_init(c->fds, 0);
 s_poll_add(c->fds, c->fd, BIO_should_read(bio), BIO_should_write(bio));
 switch(s_poll_wait(c->fds, c->opt->timeout_busy, 0)) {
 case -1:
@@ -732,22 +774,40 @@
 
 #endif /* !defined(OPENSSL_NO_OCSP) */
 
-void print_client_CA_list(const STACK_OF(X509_NAME) *ca_dn) {
+#ifndef OPENSSL_NO_ENGINE
+
+X509 *engine_get_cert(ENGINE *engine, const char *id) {
+ struct {
+ const char *id;
+ X509 *cert;
+ } parms;
+
+ parms.id=id;
+ parms.cert=NULL;
+ ENGINE_ctrl_cmd(engine, "LOAD_CERT_CTRL", 0, &parms, NULL, 1);
+ if(!parms.cert)
+ sslerror("ENGINE_ctrl_cmd");
+ return parms.cert;
+}
+
+#endif
+
+void print_CA_list(const char *type, const STACK_OF(X509_NAME) *ca_dn) {
 char *ca_name;
 int n, i;
 
 if(!ca_dn) {
- s_log(LOG_INFO, "No client CA list");
+ s_log(LOG_INFO, "%s list not found", type);
 return;
 }
 n=sk_X509_NAME_num(ca_dn);
 if(n==0) {
- s_log(LOG_INFO, "Empty client CA list");
+ s_log(LOG_INFO, "%s list is empty", type);
 return;
 }
 for(i=0; i<n; ++i) {
 ca_name=X509_NAME2text(sk_X509_NAME_value(ca_dn, i));
- s_log(LOG_INFO, "Client CA: %s", ca_name);
+ s_log(LOG_INFO, "%s: %s", type, ca_name);
 str_free(ca_name);
 }
 }

_service:tar_scm:stunnel-5.48.tar.gz/src/version.h -> _service:tar_scm:stunnel-5.69.tar.gz/src/version.h Changed

_service:tar_scm:stunnel-5.48.tar.gz/tests/Makefile.am -> _service:tar_scm:stunnel-5.69.tar.gz/tests/Makefile.am Changed

_service:tar_scm:stunnel-5.48.tar.gz/tests/Makefile.in -> _service:tar_scm:stunnel-5.69.tar.gz/tests/Makefile.in Changed

@@ -1,7 +1,7 @@
-# Makefile.in generated by automake 1.15 from Makefile.am.
+# Makefile.in generated by automake 1.16.5 from Makefile.am.
 # @configure_input@
 
-# Copyright (C) 1994-2014 Free Software Foundation, Inc.
+# Copyright (C) 1994-2021 Free Software Foundation, Inc.
 
 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -14,7 +14,7 @@
 
 @SET_MAKE@
 
-# by Michal Trojnara 1998-2018
+# by Michal Trojnara 1998-2023
 VPATH = @srcdir@
 am__is_gnu_make = { \
   if test -z '$(MAKELEVEL)'; then \
@@ -116,14 +116,72 @@
 am__v_at_1 = 
 SOURCES =
 DIST_SOURCES =
+RECURSIVE_TARGETS = all-recursive check-recursive cscopelist-recursive \
+	ctags-recursive dvi-recursive html-recursive info-recursive \
+	install-data-recursive install-dvi-recursive \
+	install-exec-recursive install-html-recursive \
+	install-info-recursive install-pdf-recursive \
+	install-ps-recursive install-recursive installcheck-recursive \
+	installdirs-recursive pdf-recursive ps-recursive \
+	tags-recursive uninstall-recursive
 am__can_run_installinfo = \
   case $$AM_UPDATE_INFO_DIR in \
     n|no|NO) false;; \
     *) (install-info --version) >/dev/null 2>&1;; \
   esac
+RECURSIVE_CLEAN_TARGETS = mostlyclean-recursive clean-recursive	\
+  distclean-recursive maintainer-clean-recursive
+am__recursive_targets = \
+  $(RECURSIVE_TARGETS) \
+  $(RECURSIVE_CLEAN_TARGETS) \
+  $(am__extra_recursive_targets)
+AM_RECURSIVE_TARGETS = $(am__recursive_targets:-recursive=) TAGS CTAGS \
+	distdir distdir-am
 am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
+# Read a list of newline-separated strings from the standard input,
+# and print each of them once, without duplicates.  Input order is
+# *not* preserved.
+am__uniquify_input = $(AWK) '\
+  BEGIN { nonempty = 0; } \
+  { items$$0 = 1; nonempty = 1; } \
+  END { if (nonempty) { for (i in items) print i; }; } \
+'
+# Make sure the list of sources is unique.  This is necessary because,
+# e.g., the same source file might be shared among _SOURCES variables
+# for different programs/libraries.
+am__define_uniq_tagged_files = \
+  list='$(am__tagged_files)'; \
+  unique=`for i in $$list; do \
+    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
+  done | $(am__uniquify_input)`
+DIST_SUBDIRS = $(SUBDIRS)
 am__DIST_COMMON = $(srcdir)/Makefile.in
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
+am__relativize = \
+  dir0=`pwd`; \
+  sed_first='s,^$^/*$/.*$$,\1,'; \
+  sed_rest='s,^^/*/*,,'; \
+  sed_last='s,^.*/$^/*$$$,\1,'; \
+  sed_butlast='s,/*^/*$$,,'; \
+  while test -n "$$dir1"; do \
+    first=`echo "$$dir1" | sed -e "$$sed_first"`; \
+    if test "$$first" != "."; then \
+      if test "$$first" = ".."; then \
+        dir2=`echo "$$dir0" | sed -e "$$sed_last"`/"$$dir2"; \
+        dir0=`echo "$$dir0" | sed -e "$$sed_butlast"`; \
+      else \
+        first2=`echo "$$dir2" | sed -e "$$sed_first"`; \
+        if test "$$first2" = "$$first"; then \
+          dir2=`echo "$$dir2" | sed -e "$$sed_rest"`; \
+        else \
+          dir2="../$$dir2"; \
+        fi; \
+        dir0="$$dir0"/"$$first"; \
+      fi; \
+    fi; \
+    dir1=`echo "$$dir1" | sed -e "$$sed_rest"`; \
+  done; \
+  reldir="$$dir2"
 ACLOCAL = @ACLOCAL@
 AMTAR = @AMTAR@
 AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
@@ -137,6 +195,8 @@
 CFLAGS = @CFLAGS@
 CPP = @CPP@
 CPPFLAGS = @CPPFLAGS@
+CSCOPE = @CSCOPE@
+CTAGS = @CTAGS@
 CYGPATH_W = @CYGPATH_W@
 DEFAULT_GROUP = @DEFAULT_GROUP@
 DEFS = @DEFS@
@@ -148,6 +208,7 @@
 ECHO_N = @ECHO_N@
 ECHO_T = @ECHO_T@
 EGREP = @EGREP@
+ETAGS = @ETAGS@
 EXEEXT = @EXEEXT@
 FGREP = @FGREP@
 GREP = @GREP@
@@ -185,6 +246,7 @@
 PATH_SEPARATOR = @PATH_SEPARATOR@
 PTHREAD_CC = @PTHREAD_CC@
 PTHREAD_CFLAGS = @PTHREAD_CFLAGS@
+PTHREAD_CXX = @PTHREAD_CXX@
 PTHREAD_LIBS = @PTHREAD_LIBS@
 RANDOM_FILE = @RANDOM_FILE@
 RANLIB = @RANLIB@
@@ -207,6 +269,7 @@
 am__tar = @am__tar@
 am__untar = @am__untar@
 ax_pthread_config = @ax_pthread_config@
+bashcompdir = @bashcompdir@
 bindir = @bindir@
 build = @build@
 build_alias = @build_alias@
@@ -248,8 +311,9 @@
 top_build_prefix = @top_build_prefix@
 top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
-EXTRA_DIST = make_test test_library recipes certs execute execute_read execute_write
-all: all-am
+SUBDIRS = certs
+EXTRA_DIST = maketest.py plugin_collection.py reader.py error.py plugins
+all: all-recursive
 
 .SUFFIXES:
 $(srcdir)/Makefile.in:  $(srcdir)/Makefile.am  $(am__configure_deps)
@@ -261,16 +325,16 @@
 	      exit 1;; \
 	  esac; \
 	done; \
-	echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu tests/Makefile'; \
+	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign tests/Makefile'; \
 	$(am__cd) $(top_srcdir) && \
-	  $(AUTOMAKE) --gnu tests/Makefile
+	  $(AUTOMAKE) --foreign tests/Makefile
 Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
 	@case '$?' in \
 	  *config.status*) \
 	    cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
 	  *) \
-	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
-	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
+	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__maybe_remake_depfiles)'; \
+	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__maybe_remake_depfiles);; \
 	esac;
 
 $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
@@ -287,14 +351,109 @@
 
 clean-libtool:
 	-rm -rf .libs _libs
-tags TAGS:
-
-ctags CTAGS:
 
-cscope cscopelist:
+# This directory's subdirectories are mostly independent; you can cd
+# into them and run 'make' without going through this Makefile.
+# To change the values of 'make' variables: instead of editing Makefiles,
+# (1) if the variable is set in 'config.status', edit 'config.status'
+#     (which will cause the Makefiles to be regenerated when you run 'make');
+# (2) otherwise, pass the desired values on the 'make' command line.
+$(am__recursive_targets):
+	@fail=; \
+	if $(am__make_keepgoing); then \
+	  failcom='fail=yes'; \
+	else \
+	  failcom='exit 1'; \
+	fi; \
+	dot_seen=no; \
+	target=`echo $@ | sed s/-recursive//`; \
+	case "$@" in \
+	  distclean-* | maintainer-clean-*) list='$(DIST_SUBDIRS)' ;; \
+	  *) list='$(SUBDIRS)' ;; \
+	esac; \
+	for subdir in $$list; do \
+	  echo "Making $$target in $$subdir"; \
+	  if test "$$subdir" = "."; then \
+	    dot_seen=yes; \
+	    local_target="$$target-am"; \
+	  else \
+	    local_target="$$target"; \
+	  fi; \
+	  ($(am__cd) $$subdir && $(MAKE) $(AM_MAKEFLAGS) $$local_target) \
+	  || eval $$failcom; \
+	done; \
+	if test "$$dot_seen" = "no"; then \
+	  $(MAKE) $(AM_MAKEFLAGS) "$$target-am" || exit 1; \
+	fi; test -z "$$fail"
+
+ID: $(am__tagged_files)
+	$(am__define_uniq_tagged_files); mkid -fID $$unique
+tags: tags-recursive
+TAGS: tags
+
+tags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
+	set x; \
+	here=`pwd`; \
+	if ($(ETAGS) --etags-include --version) >/dev/null 2>&1; then \
+	  include_option=--etags-include; \
+	  empty_fix=.; \
+	else \
+	  include_option=--include; \
+	  empty_fix=; \
+	fi; \
+	list='$(SUBDIRS)'; for subdir in $$list; do \
+	  if test "$$subdir" = .; then :; else \
+	    test ! -f $$subdir/TAGS || \
+	      set "$$@" "$$include_option=$$here/$$subdir/TAGS"; \
+	  fi; \
+	done; \
+	$(am__define_uniq_tagged_files); \
+	shift; \
+	if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
+	  test -n "$$unique" || unique=$$empty_fix; \
+	  if test $$# -gt 0; then \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      "$$@" $$unique; \
+	  else \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      $$unique; \
+	  fi; \
+	fi
+ctags: ctags-recursive
+
+CTAGS: ctags
+ctags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
+	$(am__define_uniq_tagged_files); \
+	test -z "$(CTAGS_ARGS)$$unique" \
+	  || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
+	     $$unique
+
+GTAGS:
+	here=`$(am__cd) $(top_builddir) && pwd` \
+	  && $(am__cd) $(top_srcdir) \
+	  && gtags -i $(GTAGS_ARGS) "$$here"
+cscopelist: cscopelist-recursive
+
+cscopelist-am: $(am__tagged_files)
+	list='$(am__tagged_files)'; \
+	case "$(srcdir)" in \
+	  \\/* | ?:\\/*) sdir="$(srcdir)" ;; \
+	  *) sdir=$(subdir)/$(srcdir) ;; \
+	esac; \
+	for i in $$list; do \
+	  if test -f "$$i"; then \
+	    echo "$(subdir)/$$i"; \
+	  else \
+	    echo "$$sdir/$$i"; \
+	  fi; \
+	done >> $(top_builddir)/cscope.files
 
+distclean-tags:
+	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
+distdir: $(BUILT_SOURCES)
+	$(MAKE) $(AM_MAKEFLAGS) distdir-am
 
-distdir: $(DISTFILES)
+distdir-am: $(DISTFILES)
 	@srcdirstrip=`echo "$(srcdir)" | sed 's/.^$$\\*/\\\\&/g'`; \
 	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/.^$$\\*/\\\\&/g'`; \
 	list='$(DISTFILES)'; \
@@ -324,20 +483,49 @@
 	    || exit 1; \
 	  fi; \
 	done
+	@list='$(DIST_SUBDIRS)'; for subdir in $$list; do \
+	  if test "$$subdir" = .; then :; else \
+	    $(am__make_dryrun) \
+	      || test -d "$(distdir)/$$subdir" \
+	      || $(MKDIR_P) "$(distdir)/$$subdir" \
+	      || exit 1; \
+	    dir1=$$subdir; dir2="$(distdir)/$$subdir"; \
+	    $(am__relativize); \
+	    new_distdir=$$reldir; \
+	    dir1=$$subdir; dir2="$(top_distdir)"; \
+	    $(am__relativize); \
+	    new_top_distdir=$$reldir; \
+	    echo " (cd $$subdir && $(MAKE) $(AM_MAKEFLAGS) top_distdir="$$new_top_distdir" distdir="$$new_distdir" \\"; \
+	    echo "     am__remove_distdir=: am__skip_length_check=: am__skip_mode_fix=: distdir)"; \
+	    ($(am__cd) $$subdir && \
+	      $(MAKE) $(AM_MAKEFLAGS) \
+	        top_distdir="$$new_top_distdir" \
+	        distdir="$$new_distdir" \
+		am__remove_distdir=: \
+		am__skip_length_check=: \
+		am__skip_mode_fix=: \
+	        distdir) \
+	      || exit 1; \
+	  fi; \
+	done
+	$(MAKE) $(AM_MAKEFLAGS) \
+	  top_distdir="$(top_distdir)" distdir="$(distdir)" \
+	  dist-hook
 check-am: all-am
 	$(MAKE) $(AM_MAKEFLAGS) check-local
-check: check-am
+check: check-recursive
 all-am: Makefile
-installdirs:
-install: install-am
-install-exec: install-exec-am
-install-data: install-data-am
-uninstall: uninstall-am
+installdirs: installdirs-recursive
+installdirs-am:
+install: install-recursive
+install-exec: install-exec-recursive
+install-data: install-data-recursive
+uninstall: uninstall-recursive
 
 install-am: all-am
 	@$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
 
-installcheck: installcheck-am
+installcheck: installcheck-recursive
 install-strip:
 	if test -z '$(STRIP)'; then \
 	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
@@ -359,95 +547,105 @@
 maintainer-clean-generic:
 	@echo "This command is intended for maintainers to use"
 	@echo "it deletes files that may require special tools to rebuild."
-clean: clean-am
+clean: clean-recursive
 
 clean-am: clean-generic clean-libtool mostlyclean-am
 
-distclean: distclean-am
+distclean: distclean-recursive
 	-rm -f Makefile
-distclean-am: clean-am distclean-generic distclean-local
+distclean-am: clean-am distclean-generic distclean-local \
+	distclean-tags
 
-dvi: dvi-am
+dvi: dvi-recursive
 
 dvi-am:
 
-html: html-am
+html: html-recursive
 
 html-am:
 
-info: info-am
+info: info-recursive
 
 info-am:
 
 install-data-am:
 
-install-dvi: install-dvi-am
+install-dvi: install-dvi-recursive
 
 install-dvi-am:
 
 install-exec-am:
 
-install-html: install-html-am
+install-html: install-html-recursive
 
 install-html-am:
 
-install-info: install-info-am
+install-info: install-info-recursive
 
 install-info-am:
 
 install-man:
 
-install-pdf: install-pdf-am
+install-pdf: install-pdf-recursive
 
 install-pdf-am:
 
-install-ps: install-ps-am
+install-ps: install-ps-recursive
 
 install-ps-am:
 
 installcheck-am:
 
-maintainer-clean: maintainer-clean-am
+maintainer-clean: maintainer-clean-recursive
 	-rm -f Makefile
 maintainer-clean-am: distclean-am maintainer-clean-generic
 
-mostlyclean: mostlyclean-am
+mostlyclean: mostlyclean-recursive
 
 mostlyclean-am: mostlyclean-generic mostlyclean-libtool
 
-pdf: pdf-am
+pdf: pdf-recursive
 
 pdf-am:
 
-ps: ps-am
+ps: ps-recursive
 
 ps-am:
 
 uninstall-am:
 
-.MAKE: check-am install-am install-strip
-
-.PHONY: all all-am check check-am check-local clean clean-generic \
-	clean-libtool cscopelist-am ctags-am distclean \
-	distclean-generic distclean-libtool distclean-local distdir \
-	dvi dvi-am html html-am info info-am install install-am \
-	install-data install-data-am install-dvi install-dvi-am \
-	install-exec install-exec-am install-html install-html-am \
-	install-info install-info-am install-man install-pdf \
-	install-pdf-am install-ps install-ps-am install-strip \
-	installcheck installcheck-am installdirs maintainer-clean \
-	maintainer-clean-generic mostlyclean mostlyclean-generic \
-	mostlyclean-libtool pdf pdf-am ps ps-am tags-am uninstall \
-	uninstall-am
+.MAKE: $(am__recursive_targets) check-am install-am install-strip
+
+.PHONY: $(am__recursive_targets) CTAGS GTAGS TAGS all all-am check \
+	check-am check-local clean clean-generic clean-libtool \
+	cscopelist-am ctags ctags-am dist-hook distclean \
+	distclean-generic distclean-libtool distclean-local \
+	distclean-tags distdir dvi dvi-am html html-am info info-am \
+	install install-am install-data install-data-am install-dvi \
+	install-dvi-am install-exec install-exec-am install-html \
+	install-html-am install-info install-info-am install-man \
+	install-pdf install-pdf-am install-ps install-ps-am \
+	install-strip installcheck installcheck-am installdirs \
+	installdirs-am maintainer-clean maintainer-clean-generic \
+	mostlyclean mostlyclean-generic mostlyclean-libtool pdf pdf-am \
+	ps ps-am tags tags-am uninstall uninstall-am
 
 .PRECIOUS: Makefile
 
 
+# try to find a supported python version (>= 3.7) that works
 check-local:
-	$(srcdir)/make_test
+	for v in $$(seq 20 -1 7); do command -v python3.$$v && break; done || ( echo "Python 3.7 or later not found" && false )
+	for v in $$(seq 20 -1 7); do command -v python3.$$v && python3.$$v $(srcdir)/maketest.py --debug=10 --libs=$(SSLDIR)/lib64:$(SSLDIR)/lib && break; done
+
+dist-hook:
+	rm -rf $(distdir)/__pycache__ $(distdir)/plugins/__pycache__
 
 distclean-local:
 	rm -f logs/*.log
+	rm -f certs/*.pem
+	rm -f certs/*.p12
+	rm -f certs/*.txt
 
 # Tell versions 3.59,3.63) of GNU make to not export all variables.
 # Otherwise a system limit (for SysV at least) may be exceeded.

_service:tar_scm:stunnel-5.69.tar.gz/tests/certs/Makefile.am Added

_service:tar_scm:stunnel-5.69.tar.gz/tests/certs/Makefile.in Added

@@ -0,0 +1,461 @@
+# Makefile.in generated by automake 1.16.5 from Makefile.am.
+# @configure_input@
+
+# Copyright (C) 1994-2021 Free Software Foundation, Inc.
+
+# This Makefile.in is free software; the Free Software Foundation
+# gives unlimited permission to copy and/or distribute it,
+# with or without modifications, as long as this notice is preserved.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
+# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+# PARTICULAR PURPOSE.
+
+@SET_MAKE@
+
+# by Michal Trojnara 1998-2023
+VPATH = @srcdir@
+am__is_gnu_make = { \
+  if test -z '$(MAKELEVEL)'; then \
+    false; \
+  elif test -n '$(MAKE_HOST)'; then \
+    true; \
+  elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
+    true; \
+  else \
+    false; \
+  fi; \
+}
+am__make_running_with_option = \
+  case $${target_option-} in \
+      ?) ;; \
+      *) echo "am__make_running_with_option: internal error: invalid" \
+              "target option '$${target_option-}' specified" >&2; \
+         exit 1;; \
+  esac; \
+  has_opt=no; \
+  sane_makeflags=$$MAKEFLAGS; \
+  if $(am__is_gnu_make); then \
+    sane_makeflags=$$MFLAGS; \
+  else \
+    case $$MAKEFLAGS in \
+      *\\\ \	*) \
+        bs=\\; \
+        sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \
+          | sed "s/$$bs$$bs$$bs $$bs	*//g"`;; \
+    esac; \
+  fi; \
+  skip_next=no; \
+  strip_trailopt () \
+  { \
+    flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \
+  }; \
+  for flg in $$sane_makeflags; do \
+    test $$skip_next = yes && { skip_next=no; continue; }; \
+    case $$flg in \
+      *=*|--*) continue;; \
+        -*I) strip_trailopt 'I'; skip_next=yes;; \
+      -*I?*) strip_trailopt 'I';; \
+        -*O) strip_trailopt 'O'; skip_next=yes;; \
+      -*O?*) strip_trailopt 'O';; \
+        -*l) strip_trailopt 'l'; skip_next=yes;; \
+      -*l?*) strip_trailopt 'l';; \
+      -dEDm) skip_next=yes;; \
+      -JT) skip_next=yes;; \
+    esac; \
+    case $$flg in \
+      *$$target_option*) has_opt=yes; break;; \
+    esac; \
+  done; \
+  test $$has_opt = yes
+am__make_dryrun = (target_option=n; $(am__make_running_with_option))
+am__make_keepgoing = (target_option=k; $(am__make_running_with_option))
+pkgdatadir = $(datadir)/@PACKAGE@
+pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
+am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
+install_sh_DATA = $(install_sh) -c -m 644
+install_sh_PROGRAM = $(install_sh) -c
+install_sh_SCRIPT = $(install_sh) -c
+INSTALL_HEADER = $(INSTALL_DATA)
+transform = $(program_transform_name)
+NORMAL_INSTALL = :
+PRE_INSTALL = :
+POST_INSTALL = :
+NORMAL_UNINSTALL = :
+PRE_UNINSTALL = :
+POST_UNINSTALL = :
+build_triplet = @build@
+host_triplet = @host@
+subdir = tests/certs
+ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
+am__aclocal_m4_deps = $(top_srcdir)/m4/libtool.m4 \
+	$(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \
+	$(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \
+	$(top_srcdir)/configure.ac
+am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
+	$(ACLOCAL_M4)
+DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
+mkinstalldirs = $(install_sh) -d
+CONFIG_HEADER = $(top_builddir)/src/config.h
+CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
+AM_V_P = $(am__v_P_@AM_V@)
+am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
+am__v_P_0 = false
+am__v_P_1 = :
+AM_V_GEN = $(am__v_GEN_@AM_V@)
+am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@)
+am__v_GEN_0 = @echo "  GEN     " $@;
+am__v_GEN_1 = 
+AM_V_at = $(am__v_at_@AM_V@)
+am__v_at_ = $(am__v_at_@AM_DEFAULT_V@)
+am__v_at_0 = @
+am__v_at_1 = 
+SOURCES =
+DIST_SOURCES =
+am__can_run_installinfo = \
+  case $$AM_UPDATE_INFO_DIR in \
+    n|no|NO) false;; \
+    *) (install-info --version) >/dev/null 2>&1;; \
+  esac
+am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
+am__DIST_COMMON = $(srcdir)/Makefile.in
+DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
+ACLOCAL = @ACLOCAL@
+AMTAR = @AMTAR@
+AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
+AR = @AR@
+AUTOCONF = @AUTOCONF@
+AUTOHEADER = @AUTOHEADER@
+AUTOMAKE = @AUTOMAKE@
+AWK = @AWK@
+CC = @CC@
+CCDEPMODE = @CCDEPMODE@
+CFLAGS = @CFLAGS@
+CPP = @CPP@
+CPPFLAGS = @CPPFLAGS@
+CSCOPE = @CSCOPE@
+CTAGS = @CTAGS@
+CYGPATH_W = @CYGPATH_W@
+DEFAULT_GROUP = @DEFAULT_GROUP@
+DEFS = @DEFS@
+DEPDIR = @DEPDIR@
+DLLTOOL = @DLLTOOL@
+DSYMUTIL = @DSYMUTIL@
+DUMPBIN = @DUMPBIN@
+ECHO_C = @ECHO_C@
+ECHO_N = @ECHO_N@
+ECHO_T = @ECHO_T@
+EGREP = @EGREP@
+ETAGS = @ETAGS@
+EXEEXT = @EXEEXT@
+FGREP = @FGREP@
+GREP = @GREP@
+INSTALL = @INSTALL@
+INSTALL_DATA = @INSTALL_DATA@
+INSTALL_PROGRAM = @INSTALL_PROGRAM@
+INSTALL_SCRIPT = @INSTALL_SCRIPT@
+INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
+LD = @LD@
+LDFLAGS = @LDFLAGS@
+LIBOBJS = @LIBOBJS@
+LIBS = @LIBS@
+LIBTOOL = @LIBTOOL@
+LIBTOOL_DEPS = @LIBTOOL_DEPS@
+LIPO = @LIPO@
+LN_S = @LN_S@
+LTLIBOBJS = @LTLIBOBJS@
+LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
+MAKEINFO = @MAKEINFO@
+MANIFEST_TOOL = @MANIFEST_TOOL@
+MKDIR_P = @MKDIR_P@
+NM = @NM@
+NMEDIT = @NMEDIT@
+OBJDUMP = @OBJDUMP@
+OBJEXT = @OBJEXT@
+OTOOL = @OTOOL@
+OTOOL64 = @OTOOL64@
+PACKAGE = @PACKAGE@
+PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
+PACKAGE_NAME = @PACKAGE_NAME@
+PACKAGE_STRING = @PACKAGE_STRING@
+PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
+PACKAGE_VERSION = @PACKAGE_VERSION@
+PATH_SEPARATOR = @PATH_SEPARATOR@
+PTHREAD_CC = @PTHREAD_CC@
+PTHREAD_CFLAGS = @PTHREAD_CFLAGS@
+PTHREAD_CXX = @PTHREAD_CXX@
+PTHREAD_LIBS = @PTHREAD_LIBS@
+RANDOM_FILE = @RANDOM_FILE@
+RANLIB = @RANLIB@
+SED = @SED@
+SET_MAKE = @SET_MAKE@
+SHELL = @SHELL@
+SSLDIR = @SSLDIR@
+STRIP = @STRIP@
+VERSION = @VERSION@
+abs_builddir = @abs_builddir@
+abs_srcdir = @abs_srcdir@
+abs_top_builddir = @abs_top_builddir@
+abs_top_srcdir = @abs_top_srcdir@
+ac_ct_AR = @ac_ct_AR@
+ac_ct_CC = @ac_ct_CC@
+ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
+am__include = @am__include@
+am__leading_dot = @am__leading_dot@
+am__quote = @am__quote@
+am__tar = @am__tar@
+am__untar = @am__untar@
+ax_pthread_config = @ax_pthread_config@
+bashcompdir = @bashcompdir@
+bindir = @bindir@
+build = @build@
+build_alias = @build_alias@
+build_cpu = @build_cpu@
+build_os = @build_os@
+build_vendor = @build_vendor@
+builddir = @builddir@
+datadir = @datadir@
+datarootdir = @datarootdir@
+docdir = @docdir@
+dvidir = @dvidir@
+exec_prefix = @exec_prefix@
+host = @host@
+host_alias = @host_alias@
+host_cpu = @host_cpu@
+host_os = @host_os@
+host_vendor = @host_vendor@
+htmldir = @htmldir@
+includedir = @includedir@
+infodir = @infodir@
+install_sh = @install_sh@
+libdir = @libdir@
+libexecdir = @libexecdir@
+localedir = @localedir@
+localstatedir = @localstatedir@
+mandir = @mandir@
+mkdir_p = @mkdir_p@
+oldincludedir = @oldincludedir@
+pdfdir = @pdfdir@
+prefix = @prefix@
+program_transform_name = @program_transform_name@
+psdir = @psdir@
+runstatedir = @runstatedir@
+sbindir = @sbindir@
+sharedstatedir = @sharedstatedir@
+srcdir = @srcdir@
+sysconfdir = @sysconfdir@
+target_alias = @target_alias@
+top_build_prefix = @top_build_prefix@
+top_builddir = @top_builddir@
+top_srcdir = @top_srcdir@
+EXTRA_DIST = maketestcert.sh openssltest.cnf
+all: all-am
+
+.SUFFIXES:
+$(srcdir)/Makefile.in:  $(srcdir)/Makefile.am  $(am__configure_deps)
+	@for dep in $?; do \
+	  case '$(am__configure_deps)' in \
+	    *$$dep*) \
+	      ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \
+	        && { if test -f $@; then exit 0; else break; fi; }; \
+	      exit 1;; \
+	  esac; \
+	done; \
+	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign tests/certs/Makefile'; \
+	$(am__cd) $(top_srcdir) && \
+	  $(AUTOMAKE) --foreign tests/certs/Makefile
+Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
+	@case '$?' in \
+	  *config.status*) \
+	    cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
+	  *) \
+	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__maybe_remake_depfiles)'; \
+	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__maybe_remake_depfiles);; \
+	esac;
+
+$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+
+$(top_srcdir)/configure:  $(am__configure_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(ACLOCAL_M4):  $(am__aclocal_m4_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
+
+mostlyclean-libtool:
+	-rm -f *.lo
+
+clean-libtool:
+	-rm -rf .libs _libs
+tags TAGS:
+
+ctags CTAGS:
+
+cscope cscopelist:
+
+distdir: $(BUILT_SOURCES)
+	$(MAKE) $(AM_MAKEFLAGS) distdir-am
+
+distdir-am: $(DISTFILES)
+	@srcdirstrip=`echo "$(srcdir)" | sed 's/.^$$\\*/\\\\&/g'`; \
+	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/.^$$\\*/\\\\&/g'`; \
+	list='$(DISTFILES)'; \
+	  dist_files=`for file in $$list; do echo $$file; done | \
+	  sed -e "s|^$$srcdirstrip/||;t" \
+	      -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \
+	case $$dist_files in \
+	  */*) $(MKDIR_P) `echo "$$dist_files" | \
+			   sed '/\//!d;s|^|$(distdir)/|;s,/^/*$$,,' | \
+			   sort -u` ;; \
+	esac; \
+	for file in $$dist_files; do \
+	  if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
+	  if test -d $$d/$$file; then \
+	    dir=`echo "/$$file" | sed -e 's,/^/*$$,,'`; \
+	    if test -d "$(distdir)/$$file"; then \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
+	      cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
+	  else \
+	    test -f "$(distdir)/$$file" \
+	    || cp -p $$d/$$file "$(distdir)/$$file" \
+	    || exit 1; \
+	  fi; \
+	done
+check-am: all-am
+	$(MAKE) $(AM_MAKEFLAGS) check-local
+check: check-am
+all-am: Makefile
+installdirs:
+install: install-am
+install-exec: install-exec-am
+install-data: install-data-am
+uninstall: uninstall-am
+
+install-am: all-am
+	@$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
+
+installcheck: installcheck-am
+install-strip:
+	if test -z '$(STRIP)'; then \
+	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	      install; \
+	else \
+	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	    "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \
+	fi
+mostlyclean-generic:
+
+clean-generic:
+
+distclean-generic:
+	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+	-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
+
+maintainer-clean-generic:
+	@echo "This command is intended for maintainers to use"
+	@echo "it deletes files that may require special tools to rebuild."
+clean: clean-am
+
+clean-am: clean-generic clean-libtool mostlyclean-am
+
+distclean: distclean-am
+	-rm -f Makefile
+distclean-am: clean-am distclean-generic
+
+dvi: dvi-am
+
+dvi-am:
+
+html: html-am
+
+html-am:
+
+info: info-am
+
+info-am:
+
+install-data-am:
+
+install-dvi: install-dvi-am
+
+install-dvi-am:
+
+install-exec-am:
+
+install-html: install-html-am
+
+install-html-am:
+
+install-info: install-info-am
+
+install-info-am:
+
+install-man:
+
+install-pdf: install-pdf-am
+
+install-pdf-am:
+
+install-ps: install-ps-am
+
+install-ps-am:
+
+installcheck-am:
+
+maintainer-clean: maintainer-clean-am
+	-rm -f Makefile
+maintainer-clean-am: distclean-am maintainer-clean-generic
+
+mostlyclean: mostlyclean-am
+
+mostlyclean-am: mostlyclean-generic mostlyclean-libtool
+
+pdf: pdf-am
+
+pdf-am:
+
+ps: ps-am
+
+ps-am:
+
+uninstall-am:
+
+.MAKE: check-am install-am install-strip
+
+.PHONY: all all-am check check-am check-local clean clean-generic \
+	clean-libtool cscopelist-am ctags-am distclean \
+	distclean-generic distclean-libtool distdir dvi dvi-am html \
+	html-am info info-am install install-am install-data \
+	install-data-am install-dvi install-dvi-am install-exec \
+	install-exec-am install-html install-html-am install-info \
+	install-info-am install-man install-pdf install-pdf-am \
+	install-ps install-ps-am install-strip installcheck \
+	installcheck-am installdirs maintainer-clean \
+	maintainer-clean-generic mostlyclean mostlyclean-generic \
+	mostlyclean-libtool pdf pdf-am ps ps-am tags-am uninstall \
+	uninstall-am
+
+.PRECIOUS: Makefile
+
+
+check-local:
+	$(srcdir)/maketestcert.sh
+
+dist-local:
+	$(srcdir)/maketestcert.sh
+
+# Tell versions 3.59,3.63) of GNU make to not export all variables.
+# Otherwise a system limit (for SysV at least) may be exceeded.
+.NOEXPORT:

_service:tar_scm:stunnel-5.69.tar.gz/tests/certs/maketestcert.sh Added

@@ -0,0 +1,115 @@
+#!/bin/sh
+
+ddays=1461
+
+result_path=$(pwd)
+cd $(dirname "$0")
+script_path=$(pwd)
+cd "${result_path}"
+
+mkdir "tmp/"
+
+# create new psk secrets
+gen_psk () {
+ tr -c -d 'A-Za-z0-9' </dev/urandom 2>> "maketestcert.log" | head -c 50 > tmp/psk.txt
+ if -s tmp/psk.txt 
+ then
+ printf "test$1:" > tmp/psk$1.txt
+ cat tmp/psk.txt >> tmp/psk$1.txt 2>> "maketestcert.log"
+ printf "\n" >> tmp/psk$1.txt
+ fi
+ rm -f tmp/psk.txt
+}
+
+export LC_ALL=C
+gen_psk 1
+cat tmp/psk1.txt > tmp/secrets.txt 2>> "maketestcert.log"
+gen_psk 2
+cat tmp/psk2.txt >> tmp/secrets.txt 2>> "maketestcert.log"
+gen_psk 2
+
+# OpenSSL settings
+TEMP_LD_LIBRARY_PATH=$LD_LIBRARY_PATH
+LD_LIBRARY_PATH=""
+OPENSSL=openssl
+CONF="${script_path}/openssltest.cnf"
+
+mkdir "demoCA/"
+touch "demoCA/index.txt"
+touch "demoCA/index.txt.attr"
+echo 1000 > "demoCA/serial"
+
+# generate a self-signed certificate
+$OPENSSL req -config $CONF -new -x509 -days $ddays -keyout tmp/stunnel.pem -out tmp/stunnel.pem \
+ -subj "/C=PL/ST=Mazovia Province/L=Warsaw/O=Stunnel Developers/OU=Provisional CA/CN=localhost/emailAddress=stunnel@example.com" \
+ 1>&2 2>> "maketestcert.log"
+
+# generate root CA certificate
+$OPENSSL genrsa -out demoCA/CA.key 1>&2 2>> "maketestcert.log"
+$OPENSSL req -config $CONF -new -x509 -days $ddays -key demoCA/CA.key -out tmp/CACert.pem \
+ -subj "/C=PL/O=Stunnel Developers/OU=Root CA/CN=CA/emailAddress=CA@example.com" \
+ 1>&2 2>> "maketestcert.log"
+
+# generate a certificate to revoke
+$OPENSSL genrsa -out demoCA/revoked.key 1>&2 2>> "maketestcert.log"
+$OPENSSL req -config $CONF -new -key demoCA/revoked.key -out demoCA/revoked.csr \
+ -subj "/C=PL/O=Stunnel Developers/OU=revoked/CN=revoked/emailAddress=revoked@example.com" \
+ 1>&2 2>> "maketestcert.log"
+
+$OPENSSL ca -config $CONF -batch -days $ddays -in demoCA/revoked.csr -out demoCA/revoked.cer 1>&2 2>> "maketestcert.log"
+
+$OPENSSL x509 -in demoCA/revoked.cer -out tmp/revoked_cert.pem 1>&2 2>> "maketestcert.log"
+cat demoCA/revoked.key >> tmp/revoked_cert.pem 2>> "maketestcert.log"
+
+# revoke above certificate and generate CRL file
+$OPENSSL ca -config $CONF -revoke demoCA/1000.pem 1>&2 2>> "maketestcert.log"
+$OPENSSL ca -config $CONF -gencrl -crldays $ddays -out tmp/CACertCRL.pem 1>&2 2>> "maketestcert.log"
+
+# generate a client certificate
+$OPENSSL genrsa -out demoCA/client.key 1>&2 2>> "maketestcert.log"
+$OPENSSL req -config $CONF -new -key demoCA/client.key -out demoCA/client.csr \
+ -subj "/C=PL/O=Stunnel Developers/OU=client/CN=client/emailAddress=client@example.com" \
+ 1>&2 2>> "maketestcert.log"
+
+$OPENSSL ca -config $CONF -batch -days $ddays -in demoCA/client.csr -out demoCA/client.cer 1>&2 2>> "maketestcert.log"
+
+$OPENSSL x509 -in demoCA/client.cer -out tmp/client_cert.pem 1>&2 2>> "maketestcert.log"
+cat tmp/client_cert.pem > tmp/PeerCerts.pem 2>> "maketestcert.log"
+cat demoCA/client.key >> tmp/client_cert.pem 2>> "maketestcert.log"
+
+# generate a server certificate
+$OPENSSL genrsa -out demoCA/server.key 1>&2 2>> "maketestcert.log"
+$OPENSSL req -config $CONF -new -key demoCA/server.key -out demoCA/server.csr \
+ -subj "/C=PL/O=Stunnel Developers/OU=server/CN=server/emailAddress=server@example.com" \
+ 1>&2 2>> "maketestcert.log"
+
+$OPENSSL ca -config $CONF -batch -days $ddays -in demoCA/server.csr -out demoCA/server.cer 1>&2 2>> "maketestcert.log"
+
+$OPENSSL x509 -in demoCA/server.cer -out tmp/server_cert.pem 1>&2 2>> "maketestcert.log"
+cat tmp/server_cert.pem >> tmp/PeerCerts.pem 2>> "maketestcert.log"
+cat demoCA/server.key >> tmp/server_cert.pem 2>> "maketestcert.log"
+
+# create a PKCS#12 file with a server certificate
+$OPENSSL pkcs12 -export -certpbe pbeWithSHA1And3-KeyTripleDES-CBC -in tmp/server_cert.pem -out tmp/server_cert.p12 -passout pass: 1>&2 2>> "maketestcert.log"
+
+# copy new files
+if -s tmp/stunnel.pem && -s tmp/CACert.pem && -s tmp/CACertCRL.pem && \
+ -s tmp/revoked_cert.pem && -s tmp/client_cert.pem && -s tmp/server_cert.pem && \
+ -s tmp/PeerCerts.pem && -s tmp/server_cert.p12 && \
+ -s tmp/psk1.txt && -s tmp/psk2.txt && -s tmp/secrets.txt 
+ then
+ cp tmp/* ./
+ printf "%s\n" "keys & certificates successfully generated"
+ printf "%s\n" "./maketestcert.sh finished"
+ rm -f "maketestcert.log"
+ else
+ printf "%s\n" "./maketestcert.sh failed"
+ printf "%s\n" "error logs ${result_path}/maketestcert.log"
+ fi
+
+# remove the working directory
+rm -rf "demoCA/"
+rm -rf "tmp/"
+
+# restore settings
+LD_LIBRARY_PATH=$TEMP_LD_LIBRARY_PATH

_service:tar_scm:stunnel-5.69.tar.gz/tests/certs/openssltest.cnf Added

@@ -0,0 +1,58 @@
+# OpenSSL root CA configuration file
+
+ ca 
+default_ca                      = CA_default
+
+ CA_default 
+# Directory and file locations.
+dir                             = .
+certs                           = $dir/demoCA
+crl_dir                         = $dir/demoCA
+new_certs_dir                   = $dir/demoCA
+database                        = $dir/demoCA/index.txt
+serial                          = $dir/demoCA/serial
+crl_extensions                  = crl_ext
+default_md                      = sha256
+preserve                        = no
+policy                          = policy_match
+x509_extensions                 = usr_cert
+private_key                     = $dir/demoCA/CA.key
+certificate                     = $dir/tmp/CACert.pem
+
+ req 
+encrypt_key                     = no
+default_bits                    = 2048
+default_md                      = sha256
+string_mask                     = utf8only
+x509_extensions                 = ca_extensions
+distinguished_name              = req_distinguished_name
+
+ crl_ext 
+authorityKeyIdentifier          = keyid:always
+
+ usr_cert 
+basicConstraints                = CA:FALSE
+subjectKeyIdentifier            = hash
+authorityKeyIdentifier          = keyid, issuer
+
+ ca_extensions 
+basicConstraints                = critical, CA:true
+subjectKeyIdentifier            = hash
+authorityKeyIdentifier          = keyid:always,issuer
+keyUsage                        = critical, digitalSignature, cRLSign, keyCertSign
+
+ policy_match 
+countryName                     = match
+organizationName                = match
+organizationalUnitName          = optional
+commonName                      = supplied
+emailAddress                    = optional
+
+ req_distinguished_name 
+countryName                     = Country Name (2 letter code)
+stateOrProvinceName             = State or Province Name
+localityName                    = Locality Name
+0.organizationName              = Organization Name
+organizationalUnitName          = Organizational Unit Name
+commonName                      = Common Name
+emailAddress                    = Email Address

_service:tar_scm:stunnel-5.69.tar.gz/tests/error.py Added

_service:tar_scm:stunnel-5.69.tar.gz/tests/maketest.py Added

@@ -0,0 +1,1775 @@
+"""Run stunnel with a test configuration, see if it works."""
+# pylint: disable=too-many-lines
+
+from __future__ import annotations
+
+import argparse
+import asyncio
+import contextlib
+import dataclasses
+import logging
+import os
+import pathlib
+import re
+import signal
+import shlex
+import ssl
+import subprocess
+import sys
+import tempfile
+
+from typing import (
+ Any,
+ Callable,
+ Coroutine,
+ Dict,
+ List,
+ NamedTuple,
+ Optional,
+ TypeVar
+)
+
+from plugin_collection import PluginCollection
+
+EXIT_SUCCESS = 0
+EXIT_FAILURE = 1
+
+RESULT_PATH = os.getcwd()
+DEFAULT_PROG = os.path.join(RESULT_PATH, "../src/stunnel")
+DEFAULT_CERTS = os.path.join(RESULT_PATH, "certs")
+DEFAULT_LOGS = os.path.join(RESULT_PATH, "logs")
+DEFAULT_LEVEL = logging.INFO
+
+RE_STUNNEL_VERSION = re.compile(
+ r""" ^
+ stunnel\s+
+ (?P<version> (?: 5-9 | 1-90-9* ) \. \S+ )
+ (?: \s .* )?
+ $ """,
+ re.X
+)
+
+RE_OPENSSL_VERSION = re.compile(
+ r""" ^
+ Compiled\/running\swith\sOpenSSL\s+
+ (?P<version> (?: 0-3\.0-9\.0-9* ) \S+)
+ (?: \s .* )?
+ $ """,
+ re.X
+)
+
+RE_LINE_IDX = re.compile(r" ^ Hello \s+ (?P<idx> 0 | 1-90-9* ) $ ", re.X)
+
+
+class UnsupportedOpenSSL(Exception):
+ """Unsupported version of OpenSSL"""
+
+
+@dataclasses.dataclass(frozen=True)
+class LogEvent():
+ """The base class for an event."""
+ etype: str
+ level: int
+ log: str
+
+
+TLogEvent = TypeVar("TEvent", bound=LogEvent)
+
+
+@dataclasses.dataclass(frozen=True)
+class ResultEvent(LogEvent):
+ """The event to determine the test result."""
+
+ result: bool
+
+
+@dataclasses.dataclass(frozen=True)
+class ListenerClientEvent(LogEvent):
+ """The listener task handled a connected client event."""
+
+ peer: str
+ conns: TestConnection
+
+
+@dataclasses.dataclass(frozen=True)
+class ClientSendDataEvent(ListenerClientEvent):
+ """The specified client sent some data to server."""
+
+ idx: int
+
+
+@dataclasses.dataclass(frozen=True)
+class ConnectionDoneEvent(LogEvent):
+ """A test connection was completed."""
+
+ idx: int
+ conns: TestConnection
+ prefix: str
+ conn_num: int
+ task: bool
+
+
+@dataclasses.dataclass(frozen=True)
+class StunnelEvent(LogEvent):
+ """The event from the stunnel output pipe."""
+
+ service: str
+ port: int
+
+
+@dataclasses.dataclass
+class TestConnection:
+ """A single connection to the listener via stunnel."""
+
+ idx: int
+ port: int
+ peer: Optionalstr
+
+
+@dataclasses.dataclass
+class TestParameters():
+ """The various states of the test connections."""
+
+ ssl_client: bool
+ ssl_server: bool
+ description: str
+ context: str
+ services: Liststr
+ conn_num: int
+
+
+@dataclasses.dataclass
+class TestEvents():
+ """The various states of the test events."""
+
+ skip: Liststr
+ success: Liststr
+ failure: Liststr
+ count: int
+
+
+class Keys(NamedTuple):
+ """Dictionary key tuple."""
+
+ pid: int
+ service: str
+
+
+class Config(NamedTuple):
+ """Runtime configuration for the stunnel test."""
+ # pylint: disable=too-few-public-methods
+
+ scriptdir: pathlib.Path
+ pythondir: pathlib.Path
+ certdir: pathlib.Path
+ children: Dict
+ Keys, asyncio.subprocess.Process # pylint: disable=no-member
+ 
+ mainq: asyncio.QueueLogEvent
+ logsq: asyncio.QueueLogEvent
+ resq: asyncio.QueueLogEvent
+ program: pathlib.Path
+ tasks: Dictstr, asyncio.TaskNone
+ tempd: pathlib.Path
+ utf8_env: Dictstr, str
+ results: pathlib.Path
+ summary: pathlib.Path
+ debug: int
+
+
+class TestConnections(NamedTuple):
+ """The various states of the test connections."""
+ # pylint: disable=too-few-public-methods
+
+ by_id: Dictint, TestConnection
+ pending: Dictstr, ListListenerClientEvent
+
+
+class PrintLogs():
+ """Base class to handle logging"""
+
+ @classmethod
+ def setup_logger(
+ cls, name: str, formats:str, log_file:pathlib.Path, debug: int
+ ) -> logging.Logger:
+ """To setup as many loggers as you want"""
+ formatter = logging.Formatter(formats)
+ handler = logging.FileHandler(log_file)
+ handler.setFormatter(formatter)
+ logger = logging.getLogger(name)
+ logger.setLevel(debug)
+ logger.addHandler(handler)
+ return logger
+
+
+ @classmethod
+ def transcript_logs(cls, name: str, format_str:str) -> None:
+ """Direct print output to a file, in addition to the terminal."""
+ formatter = logging.Formatter(format_str)
+ console = logging.StreamHandler()
+ console.setLevel(DEFAULT_LEVEL)
+ console.setFormatter(formatter)
+ logging.getLogger(name).addHandler(console)
+
+
+ @classmethod
+ def log_event(cls, evt: LogEvent, logger: logging.Logger) -> None:
+ """Log a message with the given level."""
+ if evt.level == 50:
+ logger.critical(evt.log)
+ elif evt.level == 40:
+ logger.error(evt.log)
+ elif evt.level == 30:
+ logger.warning(evt.log)
+ elif evt.level == 20:
+ logger.info(evt.log)
+ else:
+ logger.debug(evt.log)
+
+
+class TestLogs(PrintLogs):
+ """Base class for a event logs."""
+
+ def __init__(self, cfg: Config):
+ self.cfg = cfg
+
+
+ async def process_client(self, evt: ListenerClientEvent) -> None:
+ """Shuffle things around the conns structure."""
+ tag = "process_client"
+ try:
+ peer = evt.peer
+ conns = evt.conns
+ if peer in conns.pending:
+ conns.pendingpeer.append(evt)
+ if evt.etype == "client_send_data":
+ conn = conns.by_id.get(evt.idx)
+ if conn is None:
+ raise Exception("Listener reported unknown connection")
+ if conn.peer is not None:
+ raise Exception(f"Listener reported bad conn {conn!r}")
+ conn.peer = peer
+ return
+
+ if evt.etype != "client_connected":
+ raise Exception(f"Expected 'client connected' first, got {evt.etype}")
+ conns.pendingpeer = evt
+
+ except Exception as err: # pylint: disable=broad-except
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="fatal_event",
+ level=50,
+ log=f"{tag} Something went wrong: {err}"
+ )
+ )
+
+
+ async def remove_connection(self, evt: ConnectionDoneEvent, num: int) -> None:
+ """Remove a connection from the structure."""
+ tag = "remove_connection"
+ try:
+ conns = evt.conns
+ conn = conns.by_id.get(evt.idx)
+ if conn is None:
+ raise Exception("No connection")
+ del conns.by_idevt.idx
+ if conn.peer is None:
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=30,
+ log=f"{tag} Warning: Connection #{evt.idx} done too early"
+ )
+ )
+ if evt.task:
+ name = f"{evt.prefix}{evt.idx}"
+ task = self.cfg.tasks.pop(name)
+ await asyncio.gather(task, return_exceptions=True)
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=10,
+ log=f"{tag} Done with task '{name}'"
+ )
+ )
+ num += 1
+ if num == evt.conn_num:
+ num = 0
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="all_connections_event",
+ level=10,
+ log=f"{tag} Testing connections done"
+ )
+ )
+ return num
+
+ except Exception as err: # pylint: disable=broad-except
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="fatal_event",
+ level=50,
+ log=f"{tag} Something went wrong: {err}"
+ )
+ )
+
+
+ async def process_events(self, logger: logging.Logger) -> None:
+ """Wait for all events to handle,
+ return a summary of all test results.
+ """
+ num = 0
+ succeeded = 0
+ failed = 0
+ skipped = 0
+ while True:
+ evt = await self.cfg.mainq.get()
+ self.log_event(evt, logger)
+ if evt.etype == "cleanup_event" or evt.etype == "output_event" \
+ or evt.etype == "fatal_event":
+ await self.cfg.resq.put(evt)
+ elif evt.etype == "stunnel_event" or evt.etype == "result_event" \
+ or evt.etype == "all_connections_event":
+ await self.cfg.logsq.put(evt)
+ elif evt.etype == "client_connected" or evt.etype == "client_send_data" \
+ or evt.etype == "client_done":
+ await self.process_client(evt)
+ elif evt.etype == "connection_done_event":
+ await self.cfg.logsq.put(evt)
+ num = await self.remove_connection(evt, num)
+ elif evt.etype == "set_result_event":
+ succeeded += 1 if evt.result=="succeeded" else 0
+ failed += 1 if evt.result=="failed" else 0
+ skipped += 1 if evt.result=="skipped" else 0
+ await self.cfg.logsq.put(evt)
+ elif evt.etype == "finish_event":
+ await self.cfg.logsq.put(evt)
+ return succeeded, failed, skipped
+
+
+ async def check_version(self, cmd_str: str, p_err: str) -> None:
+ """Check the version of python, stunnel and openssl"""
+ tag = "check_version"
+ lines = p_err.splitlines()
+ if not lines:
+ raise Exception(f"Expected at least one line of output from `{cmd_str}`")
+ openssl_version = None
+ stunnel_version = None
+ for line in lines:
+ match = RE_STUNNEL_VERSION.match(line)
+ if match:
+ stunnel_version = match.group("version")
+ match = RE_OPENSSL_VERSION.match(line)
+ if match:
+ openssl_version = match.group("version")
+ if not openssl_version:
+ raise Exception("Stunnel was compiled and run with different OpenSSL versions")
+ """TLSv1.1 and TLSv1.2 available only with OpenSSL version 1.0.1 and later"""
+ if openssl_version < "1.0.1":
+ raise UnsupportedOpenSSL(f"OpenSSL version {openssl_version} is deprecated and not supported")
+ if not (sys.version_info.major == 3 and sys.version_info.minor >= 7):
+ raise Exception("Python 3.7 or higher is required.\n"
+ + "You are using Python {}.{}.".format(sys.version_info.major, sys.version_info.minor))
+ if not stunnel_version:
+ raise Exception(
+ f"Could not find the version line in the `{cmd_str}` output:\n"
+ + "\n".join(lines)
+ )
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=20,
+ log=f"{tag} Got stunnel version {stunnel_version}"
+ )
+ )
+
+ async def get_version(self, logger:logging.Logger) -> str:
+ """Obtain the version of stunnel."""
+ tag = "get_version"
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=10,
+ log=f"{tag} Trying to obtain the version of {self.cfg.program}"
+ )
+ )
+ cmd = str(self.cfg.program), "-version"
+ cmd_str = " ".join(shlex.quote(word) for word in cmd)
+ try:
+ proc = await asyncio.create_subprocess_exec(
+ *cmd,
+ stdin=subprocess.DEVNULL,
+ stdout=subprocess.PIPE,
+ stderr=subprocess.PIPE,
+ env=self.cfg.utf8_env
+ )
+ except (OSError, subprocess.CalledProcessError) as err:
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="fatal_event",
+ level=50,
+ log=f"{tag} Could not start `{cmd_str}`: {err}"
+ )
+ )
+ raise RuntimeError(err) from err
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=10,
+ log=f"{tag} Started `{cmd_str}` as process {proc.pid}"
+ )
+ )
+ b_out, b_err = await proc.communicate()
+ if b_out is None or b_err is None:
+ raise Exception("proc.communicate() failed")
+ p_out, p_err = b_out.decode("UTF-8"), b_err.decode("UTF-8")
+ logger.info(p_err)
+ rcode = await proc.wait()
+ if rcode != 0:
+ print(b_out.decode("UTF-8"))
+ print(b_err.decode("UTF-8"), file=sys.stderr)
+ raise Exception(f"`{cmd_str}` exited with code {rcode}")
+ if p_out:
+ raise Exception(f"`{cmd_str}` produced output on its stdout stream:\n{p_out}")
+ await self.check_version(cmd_str, p_err)
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=10,
+ log=f"{tag} Using {self.cfg.tempd} as a temporary directory"
+ )
+ )
+
+
+class TestResult():
+ """Base class for test result."""
+
+ def __init__(self, cfg: Config, logger: logging.Logger):
+ self.cfg = cfg
+ self.logger=logger
+ self.events = TestEvents(
+ skip=,
+ success=,
+ failure=,
+ count=0
+ )
+
+
+ async def parse_event(self, evt: LogEvent) -> str:
+ """Parse the event log and send the appropriate event."""
+ for event in self.events.skip:
+ if re.search(event, evt.log):
+ return "skipped"
+ for event in self.events.success:
+ if re.search(event, evt.log):
+ self.events.count -= 1
+ if self.events.count == 0:
+ return "succeeded"
+ for event in self.events.failure:
+ if re.search(event, evt.log):
+ self.logger.info(evt.log)
+ return "failed"
+ return "UNKNOWN"
+
+
+ async def set_result(self) -> str:
+ """Determine the test result."""
+ tag = "set_result"
+ result = "UNKNOWN"
+ while True:
+ evt = await self.cfg.resq.get()
+ if evt.etype == "output_event" or evt.etype == "fatal_event":
+ if result != "skipped":
+ parsed = await self.parse_event(evt)
+ if result == "UNKNOWN":
+ result = parsed
+ elif evt.etype == "cleanup_event":
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="result_event",
+ level=10,
+ log=f"{tag} The test result has been set"
+ )
+ )
+ if self.events.count > 0 and result != "skipped":
+ self.logger.info(f"Error: {self.events.count}"
+ + f" of {self.events.success} event(s) not found")
+ result = "failed"
+ if result == "UNKNOWN":
+ result = "succeeded"
+ break
+ self.logger.info("." * 70 + " " + result)
+ return result
+
+
+class TestSuite(TestResult):
+ """Base class for test suite"""
+
+ def __init__(self, cfg: Config, logger: logging.Logger):
+ super().__init__(cfg, logger)
+ self.logger=logger
+ self.conns = TestConnections(
+ by_id={},
+ pending={}
+ )
+ self.params = TestParameters(
+ ssl_client=False,
+ ssl_server=False,
+ description='UNKNOWN',
+ context={},
+ services=,
+ conn_num=1
+ )
+
+
+ async def expect_event(self, msgq: asyncio.QueueLogEvent, pattern: str) -> TLogEvent:
+ """Make sure the next event in the logsq queue is of that etype."""
+ evt = await msgq.get()
+ if evt.etype != pattern:
+ raise Exception(f"Expected {pattern}, got {evt.etype}")
+ return evt
+
+
+ async def prepare_server_cfgfile(
+ self, cfg: Config, port: int, service: str
+ ) -> pathlib.Path:
+ """Create a configuration file for a stunnel server."""
+
+
+ async def prepare_additional_server_cfgfile(
+ self, cfg: Config, ports: int, lport: int
+ ) -> pathlib.Path:
+ """Create a configuration file for additional stunnel server."""
+
+
+ async def prepare_client_cfgfile(
+ self, cfg: Config, ports: list, service: str
+ ) -> (pathlib.Path, pathlib.Path):
+ """Create a configuration file for a stunnel client."""
+
+
+ async def start_socket_connections(self) -> None:
+ """Start the socket unix server and create the listener task for serve_forever"""
+
+
+ async def start_connections(self, cfgfile: pathlib.Path, port: int) -> None:
+ """Start a group of similar connections, wait for all the connections to complete"""
+
+
+ async def test_stunnel(self, cfg: Config) -> None:
+ """Make a single test of the given stunnel configuration"""
+ try:
+ tag = "test_stunnel"
+ self.logger.info(self.params.description)
+ await self.cfg.mainq.put(LogEvent(etype="log", level=30, log=""))
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=30,
+ log=f"{tag} ***** Start '{self.params.description}' *****"
+ )
+ )
+ task = asyncio.create_task(self.set_result())
+ lport = await self.start_listener()
+ ports = lport
+ await self.start_socket_connections()
+ for service in self.params.services:
+ if re.search("server", service):
+ cfgfile = await self.prepare_server_cfgfile(cfg, lport, service)
+ port = await self.start_stunnel(cfgfile, service)
+ ports.append(port)
+ elif service == "client":
+ cfgfile, cfgnew = await self.prepare_client_cfgfile(cfg, ports, service)
+ port = await self.start_stunnel(cfgfile, service)
+ if cfgnew is not os.devnull:
+ port = await self.reload_stunnel(cfgfile, cfgnew)
+ else:
+ raise Exception(f"Unknown '{service}' service")
+
+ cfgfile = await self.prepare_additional_server_cfgfile(cfg, ports, lport)
+ await self.start_connections(cfgfile, port)
+
+ except Exception as err: # pylint: disable=broad-except
+ await cfg.mainq.put(
+ LogEvent(
+ etype="fatal_event",
+ level=50,
+ log=f"{tag} Something went wrong: {err}"
+ )
+ )
+ finally:
+ await self.cleanup_stunnels()
+ await self.cleanup_tasks()
+ await self.expect_event(self.cfg.logsq, "result_event")
+ result = task.result()
+ await self.cfg.mainq.put(
+ ResultEvent(
+ etype="set_result_event",
+ level=30,
+ log=f"{tag} Test {result}",
+ result=result
+ )
+ )
+ await self.expect_event(self.cfg.logsq, "set_result_event")
+
+
+ async def stunnel_output(self, p_out: asyncio.StreamReader, service: str) -> None:
+ """Pipe the stunnel output thing."""
+ tag = "stunnel_output"
+ try:
+ while True:
+ data = await p_out.readline()
+ if not data:
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=20,
+ log=f"{tag} Waiting for an EOF on the '{service}_output' reader socket"
+ )
+ )
+ line = await p_out.read(1)
+ if line:
+ raise Exception(f"Did not expect to read {line!r}")
+ return
+
+ line = data.decode("UTF-8").rstrip("\r\n")
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="output_event",
+ level=20,
+ log=f"{service} Read {line!r}"
+ )
+ )
+ if re.search("bound to", line):
+ port = re.search(r"\:(\d{0,9})$", line).group(1)
+ text = re.search(r"\:(.*)", line).group(1)
+ await self.cfg.mainq.put(
+ StunnelEvent(
+ etype="stunnel_event",
+ level=10,
+ log=f"{tag} {text}",
+ service=service,
+ port=port
+ )
+ )
+ elif re.search("Accepting new connections", line):
+ await self.cfg.mainq.put(
+ StunnelEvent(
+ etype="stunnel_event",
+ level=10,
+ log=f"{tag} Accepting new connections",
+ service=service,
+ port=0
+ )
+ )
+ elif re.search(r"Service \inetd\ started", line):
+ await self.cfg.mainq.put(
+ StunnelEvent(
+ etype="stunnel_event",
+ level=10,
+ log=f"{tag} Starting inetd mode",
+ service=service,
+ port=0
+ )
+ )
+ elif re.search(r"Starting exec\+connect", line):
+ await self.cfg.mainq.put(
+ StunnelEvent(
+ etype="stunnel_event",
+ level=10,
+ log=f"{tag} Starting exec+connect mode",
+ service=service,
+ port=0
+ )
+ )
+ elif re.search("Configuration failed", line):
+ await self.cfg.mainq.put(
+ StunnelEvent(
+ etype="stunnel_event",
+ level=30,
+ log=f"{tag} Stunnel '{service}' configuration failed",
+ service=service,
+ port=-1
+ )
+ )
+
+ except Exception as err: # pylint: disable=broad-except
+ await self.cfg.mainq.put(
+ StunnelEvent(
+ etype="stunnel_event",
+ level=50,
+ log=f"{tag} Something went wrong: {err}",
+ service=service,
+ port=0
+ )
+ )
+
+
+ async def run_stunnel(self, cfgfile: pathlib.Path, service: str) -> int:
+ """Create the stunnel subprocess."""
+ tag = "run_stunnel"
+ proc = await asyncio.create_subprocess_exec(
+ str(self.cfg.program),
+ str(cfgfile),
+ stdin=subprocess.DEVNULL,
+ stdout=subprocess.DEVNULL,
+ stderr=subprocess.PIPE,
+ bufsize=0,
+ env=self.cfg.utf8_env
+ )
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=10,
+ log=f"{tag} Launching the stunnel '{service}' - got pid {proc.pid}"
+ )
+ )
+ self.cfg.childrenKeys(pid=proc.pid, service=service) = proc
+ self.cfg.tasksf"{service}_output" = asyncio.create_task(self.stunnel_output(proc.stderr, service))
+
+
+ async def check_listening_port(self, port:int, service: str) -> int:
+ """Raise exception if configuration failed."""
+ tag = "check_listening_port"
+ if port == -1:
+ raise Exception(f"stunnel \'{service}\' failed")
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=20,
+ log=f"{tag} '{service}' is listening on port {port}"
+ )
+ )
+
+
+ async def accepting_connections(self, port:int, service: str) -> int:
+ """If stunnel bound, expect log: Accepting new connections."""
+ await self.check_listening_port(port, service)
+ if int(port) > 0:
+ await self.expect_event(self.cfg.logsq, "stunnel_event")
+
+
+ async def start_stunnel(self, cfgfile: pathlib.Path, service: str) -> int:
+ """Launch the stunnel with the specified config file."""
+ tag = "start_stunnel"
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=20,
+ log=f"{tag} Using config file {cfgfile}"
+ )
+ )
+ for line in cfgfile.read_text(encoding="UTF-8").splitlines():
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=20,
+ log=f"{tag} {line}"
+ )
+ )
+ await self.run_stunnel(cfgfile, service)
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=10,
+ log=f"{tag} Waiting for the stunnel '{service}' to start up"
+ )
+ )
+ evt = await self.expect_event(self.cfg.logsq, "stunnel_event")
+ await self.accepting_connections(evt.port, evt.service)
+ return evt.port
+
+
+ async def reload_stunnel(
+ self, cfgfile: pathlib.Path, cfgnew: pathlib.Path
+ ) -> None:
+ """Reload the stunnel with the specified config file."""
+ tag = "reload_stunnel"
+ os.replace(cfgnew, cfgfile)
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=20,
+ log=f"{tag} Reload using config file {cfgfile}"
+ )
+ )
+ for line in cfgfile.read_text(encoding="UTF-8").splitlines():
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=20,
+ log=f"{tag} {line}"
+ )
+ )
+ for key, _ in self.cfg.children.items():
+ os.kill(key.pid, signal.SIGHUP)
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=10,
+ log=f"{tag} Reload stunnel '{key.service}' PID {key.pid}"
+ )
+ )
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=10,
+ log=f"{tag} Waiting for the stunnel to start up"
+ )
+ )
+ evt = await self.expect_event(self.cfg.logsq, "stunnel_event")
+ await self.check_listening_port(evt.port, evt.service)
+ return evt.port
+
+
+ async def start_socket_server(self,
+ callback: Callable
+ asyncio.StreamReader, asyncio.StreamWriter, CoroutineAny, Any, None
+ 
+ ) -> asyncio.AbstractServer:
+ """Get a first available listening port,
+ create a new SSL context if necessary and start a socket server.
+ The ctx.load_verify_locations method must be specified
+ when ctx.verify_mode is other than CERT_NONE.
+ """
+ tag = "start_socket_server"
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=20,
+ log=f"{tag} Server starts on a first available port"
+ )
+ )
+ try:
+ if self.params.ssl_server:
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=20,
+ log=f"{tag} Creating a SSL context"
+ )
+ )
+ ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=20,
+ log=f"{tag} Load server certificate"
+ )
+ )
+ ctx.load_cert_chain(
+ certfile=str(self.cfg.certdir / "server_cert.pem")
+ )
+ if self.params.context == "cert_required":
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=20,
+ log=f"{tag} Set verify mode: cert required"
+ )
+ )
+ ctx.verify_mode = ssl.CERT_REQUIRED
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=20,
+ log=f"{tag} Load Certificate Authority file"
+ )
+ )
+ ctx.load_verify_locations(
+ cafile=str(self.cfg.certdir / "CACert.pem")
+ )
+ else:
+ ctx=None
+
+ protocol = "HTTPS" if self.params.ssl_server else "HTTP"
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=20,
+ log=f"{tag} Start {protocol} server"
+ )
+ )
+ return await asyncio.start_server(
+ callback,
+ host='127.0.0.1',
+ port=0,
+ ssl=ctx,
+ reuse_address=True,
+ )
+
+ except OSError as err:
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="fatal_event",
+ level=50,
+ log=f"{tag} Start server failed: {err}"
+ )
+ )
+
+
+ async def client_connected_cb(
+ self,
+ server_reader: asyncio.StreamReader,
+ server_writer: asyncio.StreamWriter
+ ) -> None:
+ """Receive something from the client, write something back the client,
+ close down sockets, send event "client_done"
+ """
+ peer_addr, peer_port = server_writer.get_extra_info("peername"):2
+ peer = f"{peer_addr}:{peer_port}"
+ tag = f"client_connected_cb {peer}"
+ await self.cfg.mainq.put(
+ ListenerClientEvent(
+ etype="client_connected",
+ level=20,
+ log=f"{tag} The 'listener' task accepted a connection from a client",
+ peer=peer,
+ conns=self.conns
+ )
+ )
+ while not server_writer.is_closing():
+ line = await server_reader.readline()
+ if re.search("PROXY TCP4 127.0.0.1", line.decode("UTF-8")):
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=10,
+ log=f"{tag} The listener get the original client IP address"
+ + " with HAProxy PROXY protocol"
+ )
+ )
+ else:
+ try:
+ match = RE_LINE_IDX.match(line.decode("UTF-8"))
+ if not match:
+ raise Exception(f"Server received unexpected message: {line!r}")
+ idx = int(match.group("idx"))
+ await self.cfg.mainq.put(
+ ClientSendDataEvent(
+ etype="client_send_data",
+ level=20,
+ log=f"{tag} The client #{idx} sent data to the server: {line!r}",
+ peer=peer,
+ conns=self.conns,
+ idx=idx
+ )
+ )
+ line = "There!\n".encode("UTF-8")
+ server_writer.write(line)
+ await server_writer.drain()
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=20,
+ log=f"{tag} The server sent data to the client #{idx}: {line!r}",
+ )
+ )
+ except Exception as err: # pylint: disable=broad-except
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="fatal_event",
+ level=50,
+ log=f"{tag} Handling {peer}: {err}"
+ )
+ )
+ finally:
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=10,
+ log=f"{tag} Closing down the server writer socket"
+ )
+ )
+ try:
+ server_writer.close()
+ await server_writer.wait_closed()
+ except ConnectionResetError as err:
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=20,
+ log=f"{tag} Handling {peer}: {err}"
+ )
+ )
+ finally:
+ await self.cfg.mainq.put(
+ ListenerClientEvent(
+ etype="client_done",
+ level=10,
+ log=f"{tag} The 'listener' task closed a connection to the client",
+ peer=peer,
+ conns=self.conns
+ )
+ )
+
+
+ async def start_listener(self) -> int:
+ """Start the socket server, create the listener task for serve_forever
+ and return a listening port.
+ """
+ tag = "start_listener"
+ protocol = "HTTPS" if self.params.ssl_server else "HTTP"
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=20,
+ log=f"{tag} Awaiting the {protocol} server started..."
+ )
+ )
+ srv = await self.start_socket_server(self.client_connected_cb)
+ if not srv:
+ raise Exception(f"The listening {protocol} socket server failed")
+ if not srv.sockets:
+ raise Exception(f"Expected a listening socket, got {srv.sockets!r}")
+ hostname, port = srv.sockets0.getsockname():2
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=20,
+ log=f"{tag} {protocol} server is listening on {hostname}:{port}"
+ )
+ )
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=20,
+ log=f"{tag} Awaiting client connections..."
+ )
+ )
+ # Start accepting connections until the coroutine is cancelled.
+ # Cancellation of serve_forever task causes the server to be closed.
+ self.cfg.tasks"listener" = asyncio.create_task(srv.serve_forever())
+ return port
+
+
+ async def cleanup_tasks(self) -> None:
+ """Cancel and remove all tasks."""
+ tag = "cleanup_tasks"
+ try:
+ tasks = 
+ for name, task in self.cfg.tasks.items():
+ tasks.append(name)
+ task.cancel()
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=10,
+ log=f"{tag} Waiting for the '{name}' task to hopefully finish"
+ )
+ )
+ await asyncio.gather(task, return_exceptions=True)
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=10,
+ log=f"{tag} Done with the '{name}' task"
+ )
+ )
+ for name in tasks:
+ self.cfg.tasks.pop(name)
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="cleanup_event",
+ level=10,
+ log=f"{tag} Done with all tasks"
+ )
+ )
+
+ except Exception as err: # pylint: disable=broad-except
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="cleanup_event",
+ level=20,
+ log=f"{tag} Cleanup '{name}' task failed: {err}"
+ )
+ )
+
+
+ async def cleanup_stunnels(self) -> None:
+ """Terminate and remove any remaining stunnel processes."""
+ try:
+ tag = "cleanup_stunnels"
+ num = len(self.cfg.children)
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=10,
+ log=f"{tag} About to kill and wait for {num} stunnel process(es)"
+ )
+ )
+ waiters = asyncio.create_task(proc.wait()) for proc in self.cfg.children.values()
+ children = 
+ for key, proc in self.cfg.children.items():
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=10,
+ log=f"{tag} Waiting for the '{key.service}' PID {key.pid} to exit..."
+ )
+ )
+ children.append(key)
+ try:
+ proc.terminate()
+ except ProcessLookupError:
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=10,
+ log=f"{tag} PID {key.pid} already finished"
+ )
+ )
+ except Exception as err: # pylint: disable=broad-except
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=30,
+ log=f"{tag} PID {key.pid} termination error: {err!r}"
+ )
+ )
+ for key in children:
+ self.cfg.children.pop(key)
+
+ wait_res = await asyncio.gather(*waiters, return_exceptions=True)
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=20,
+ log=f"{tag} Got stunnel processes' exit status: {wait_res!r}",
+ )
+ )
+
+ except Exception as err: # pylint: disable=broad-except
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="fatal_event",
+ level=50,
+ log=f"{tag} Something went wrong: {err}"
+ )
+ )
+
+
+ async def cleanup_stunnel(self, service: str) -> None:
+ """Terminate and remove a stunnel processe."""
+ tag = f"cleanup_stunnel {service}"
+ try:
+ for key, proc in self.cfg.children.items():
+ if key.service is service:
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=10,
+ log=f"{tag} Waiting for the '{key.service}' PID {key.pid} to exit..."
+ )
+ )
+ finished = key
+ try:
+ proc.terminate()
+ except ProcessLookupError:
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=30,
+ log=f"{tag} - already finished, it seems"
+ )
+ )
+ except Exception as err: # pylint: disable=broad-except
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=30,
+ log=f"{tag} - {err!r}"
+ )
+ )
+ wait_res = await asyncio.gather(proc.wait(), return_exceptions=True)
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=20,
+ log=f"{tag} Got stunnel processes' exit status: {wait_res!r}",
+ )
+ )
+ self.cfg.children.pop(finished)
+
+ except Exception as err: # pylint: disable=broad-except
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="fatal_event",
+ level=50,
+ log=f"{tag} Something went wrong: {err}"
+ )
+ )
+
+
+class StunnelAcceptConnect(TestSuite):
+ """Base class for connection tests"""
+
+ def __init__(self, cfg: Config, logger: logging.Logger):
+ super().__init__(cfg, logger)
+ self.cfg = cfg
+
+
+ async def reopen_stunnel(self, cfgfile: pathlib.Path, idx: int, service: str) -> None:
+ """Shut stunnel down and run new stunnel subprocess."""
+
+
+ async def start_connections(
+ self, cfgfile: pathlib.Path, port: int
+ ) -> None:
+ """Start a group of similar connections, wait for all the connections to complete"""
+ tag = "start_connections"
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=10,
+ log=f"{tag} Testing connections..."
+ )
+ )
+ for idx in range(self.params.conn_num):
+ conn = TestConnection(idx=idx, port=port, peer=None)
+ self.conns.by_ididx = conn
+ prefix = "encr-" if self.params.ssl_client else "plain-"
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=10,
+ log=f"{tag} Create task {prefix}{idx}"
+ )
+ )
+ await self.reopen_stunnel(cfgfile, idx, "server")
+ self.cfg.tasksf'{prefix}{idx}' = asyncio.create_task(self.test_connect(conn))
+ await self.expect_event(self.cfg.logsq, "connection_done_event")
+
+ await self.expect_event(self.cfg.logsq, "all_connections_event")
+
+
+ async def establish_connection(
+ self, conn: TestConnection
+ ) -> (asyncio.StreamReader, asyncio.StreamWriter):
+ """Establish a network connection and return a pair of (reader, writer) objects"""
+ tag = f"establish_connection 127.0.0.1:{conn.port} #{conn.idx}"
+ try:
+ if self.params.ssl_client:
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=20,
+ log=f"{tag} Creating a SSL context"
+ )
+ )
+ ctx = ssl.SSLContext(ssl.PROTOCOL_TLS)
+
+ if self.params.context == "load_correct_cert":
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=20,
+ log=f"{tag} Load the correct certificate"
+ )
+ )
+ ctx.load_cert_chain(
+ certfile=str(self.cfg.certdir / "client_cert.pem")
+ )
+ if self.params.context == "load_revoked_cert":
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=20,
+ log=f"{tag} Load the revoked certificate"
+ )
+ )
+ ctx.load_cert_chain(
+ certfile=str(self.cfg.certdir / "revoked_cert.pem")
+ )
+ if self.params.context == "load_wrong_cert":
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=20,
+ log=f"{tag} Load the wrong certificate"
+ )
+ )
+ ctx.load_cert_chain(
+ certfile=str(self.cfg.certdir / "stunnel.pem")
+ )
+ if self.params.context == "load_verify_locations":
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=20,
+ log=f"{tag} Load Certificate Authority file"
+ )
+ )
+ ctx.load_verify_locations(
+ cafile=str(self.cfg.certdir / "CACert.pem")
+ )
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=20,
+ log=f"{tag} Opening a SSL connection"
+ )
+ )
+ else:
+ # self.params.ssl_client is False
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=20,
+ log=f"{tag} Opening an unencrypted connection"
+ )
+ )
+ ctx = None
+
+ return await asyncio.open_connection('127.0.0.1', conn.port, ssl=ctx)
+
+ except OSError as err: # pylint: disable=broad-except
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=30,
+ log=f"{tag} Failed to connect to 127.0.0.1:{conn.port}: {err}"
+ )
+ )
+ return None, None
+
+
+ async def get_io_stream(
+ self, conn: TestConnection
+ ) -> (asyncio.StreamReader, asyncio.StreamWriter):
+ """Start a network connection and return a pair of (reader, writer) objects."""
+ client_reader, client_writer = await self.establish_connection(conn)
+ if not client_reader or not client_writer:
+ raise Exception("Establish connection failed")
+ return client_reader, client_writer
+
+
+ async def test_connect(self, conn: TestConnection) -> None:
+ """Make a connection, send something to the server, receive data from the server,
+ close down sockets, send event "connection_done_event"
+ """
+ tag = f"test_connect 127.0.0.1:{conn.port} #{conn.idx}"
+ try:
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=20,
+ log=f"{tag} Trying port {conn.port} encrypted {self.params.ssl_client}"
+ )
+ )
+ client_reader, client_writer = await self.get_io_stream(conn)
+ if client_writer.is_closing():
+ raise Exception("Client writer is closing")
+
+ line = f"Hello {conn.idx}\n".encode("UTF-8")
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=10,
+ log=f"{tag} Sending 'Hello {conn.idx}' to the server"
+ )
+ )
+ client_writer.write(line)
+ await client_writer.drain()
+
+ line = await client_reader.readline()
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=10,
+ log=f"{tag} Client received '{line!r}' from the server"
+ )
+ )
+ if line != "There!\n".encode("UTF-8"):
+ raise Exception(f"Client received unexpected message: {line!r}")
+
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=10,
+ log=f"{tag} Closing down the client writer socket"
+ )
+ )
+ client_writer.close()
+ await client_writer.wait_closed()
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=10,
+ log=f"{tag} Waiting for an EOF on the client reader socket"
+ )
+ )
+ line = await client_reader.read(1)
+ if line:
+ raise Exception(f"Did not expect to read {line!r}")
+
+ except Exception as err: # pylint: disable=broad-except
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="fatal_event",
+ level=30,
+ log=f"{tag} {err}",
+ )
+ )
+ finally:
+ await self.cfg.mainq.put(
+ ConnectionDoneEvent(
+ etype="connection_done_event",
+ level=20,
+ log=f"{tag} Test connection #{conn.idx} has been completed",
+ idx=conn.idx,
+ conns=self.conns,
+ prefix="encr-" if self.params.ssl_client else "plain-",
+ conn_num=self.params.conn_num,
+ task=True
+ )
+ )
+
+
+class ExpectedConfigurationFailure(StunnelAcceptConnect):
+ """Raise when a specific error occurs."""
+
+ async def check_listening_port(self, port:int, service: str) -> int:
+ """Configuration failed as expected."""
+
+ async def accepting_connections(self, port:int, service: str) -> int:
+ """If stunnel bound, expect log: Accepting new connections."""
+ if int(port) > 0:
+ await self.expect_event(self.cfg.logsq, "stunnel_event")
+
+class ClientInetd(StunnelAcceptConnect):
+ """Base class for inetd mode tests.
+ Some other program accept incoming connections and launch stunnel.
+ """
+
+ def __init__(self, cfg: Config, logger: logging.Logger):
+ super().__init__(cfg, logger)
+ self.cfg = cfg
+ self.reader=subprocess.DEVNULL
+ self.writer=subprocess.DEVNULL
+
+
+ async def check_listening_port(self, port:int, service: str) -> int:
+ """You do not want stunnel to have any accept option."""
+
+
+ async def accepting_connections(self, port:int, service: str) -> int:
+ """If stunnel bound, expect log: Accepting new connections."""
+ if int(port) > 0:
+ await self.expect_event(self.cfg.logsq, "stunnel_event")
+
+
+ async def run_stunnel(self, cfgfile: pathlib.Path, service: str) -> int:
+ """Create the stunnel subprocess."""
+ tag = "run_stunnel"
+ proc = await asyncio.create_subprocess_exec(
+ str(self.cfg.program),
+ str(cfgfile),
+ stdin=subprocess.PIPE,
+ stdout=subprocess.PIPE,
+ stderr=subprocess.PIPE,
+ bufsize=0,
+ env=self.cfg.utf8_env
+ )
+ self.writer = proc.stdin
+ self.reader = proc.stdout
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=10,
+ log=f"{tag} Launching the stunnel '{service}' - got pid {proc.pid}"
+ )
+ )
+ self.cfg.childrenKeys(pid=proc.pid, service=service) = proc
+ self.cfg.tasksf"{service}_output" = asyncio.create_task(self.stunnel_output(proc.stderr, service))
+
+
+ async def get_io_stream(
+ self, conn: TestConnection
+ ) -> (asyncio.StreamReader, asyncio.StreamWriter):
+ """Return a pair of (reader, writer) objects."""
+ return self.reader, self.writer
+
+
+class ClientConnectExec(TestSuite):
+ """Base class for connect+exec tests.
+ Execute a local inetd-type program.
+ """
+
+ def __init__(self, cfg: Config, logger: logging.Logger, path:pathlib.Path):
+ super().__init__(cfg, logger)
+ self.cfg = cfg
+ self.path = path
+ self.idx=0
+
+
+ async def check_listening_port(self, port:int, service: str) -> int:
+ """Raise exception if configuration failed."""
+ if port == -1:
+ raise Exception(f"stunnel \'{service}\' failed")
+
+
+ async def accepting_connections(self, port:int, service: str) -> int:
+ """Expect log: Accepting new connections."""
+ await self.check_listening_port(port, service)
+ await self.expect_event(self.cfg.logsq, "stunnel_event")
+
+
+ async def socket_connected_cb(
+ self, reader: asyncio.StreamReader, writer: asyncio.StreamWriter
+ ) -> None:
+ """Handle a socket connection."""
+ tag = f"socket_connected_cb #{self.idx}"
+ conn = TestConnection(idx=self.idx, port=0, peer=None)
+ self.conns.by_idself.idx = conn
+ line = f"Hello {self.idx}\n".encode("UTF-8")
+ try:
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=10,
+ log=f"{tag} Sending 'Hello {self.idx}' to the server"
+ )
+ )
+ writer.write(line)
+ await writer.drain()
+ line = await reader.readline()
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=20,
+ log=f"{tag} Client received '{line}' from the server"
+ )
+ )
+ if line != "There!\n".encode("UTF-8"):
+ raise Exception(f"Client received unexpected message: {line!r}")
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=10,
+ log=f"{tag} Closing down the 'unix server' writer socket"
+ )
+ )
+ writer.close()
+ await writer.wait_closed()
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=10,
+ log=f"{tag} Waiting for an EOF on the 'unix server' reader socket"
+ )
+ )
+ line = await reader.read(1)
+ if line:
+ raise Exception(f"Did not expect to read {line!r}")
+
+ except Exception as err: # pylint: disable=broad-except
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="fatal_event",
+ level=20,
+ log=f"{tag} {err}",
+ )
+ )
+ finally:
+ await self.cfg.mainq.put(
+ ConnectionDoneEvent(
+ etype="connection_done_event",
+ level=20,
+ log=f"{tag} Test connection #{self.idx} has been completed",
+ idx=self.idx,
+ conns=self.conns,
+ prefix="encr-" if self.params.ssl_client else "plain-",
+ conn_num=self.params.conn_num,
+ task=False
+ )
+ )
+ self.idx +=1
+
+
+ async def start_socket_connections(self) -> None:
+ """Start the socket unix server and create the listener task for serve_forever"""
+ tag = "start_socket_connections"
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=20,
+ log=f"{tag} Awaiting the 'unix server' with {self.path} started..."
+ )
+ )
+ srv = await asyncio.start_unix_server(self.socket_connected_cb, self.path)
+ self.cfg.tasks"unix server" = asyncio.create_task(srv.serve_forever())
+
+
+ async def start_connections(self, cfgfile: pathlib.Path, port: int) -> None:
+ """Wait for all the connections to complete."""
+ for _ in range(self.params.conn_num):
+ await self.expect_event(self.cfg.logsq, "connection_done_event")
+ await self.expect_event(self.cfg.logsq, "all_connections_event")
+
+
+class ServerReopen(ClientConnectExec):
+ """Base class for shut down tests"""
+
+ def __init__(self, cfg: Config, logger: logging.Logger, path:pathlib.Path):
+ super().__init__(cfg, logger, path)
+ self.cfg = cfg
+
+
+ async def reopen_stunnel(self, cfgfile: pathlib.Path, idx: int, service: str) -> None:
+ """Shut stunnel down and run new stunnel subprocess."""
+ if idx == 3:
+ await self.cleanup_stunnel(service)
+ await self.start_stunnel(cfgfile, service)
+
+
+@contextlib.contextmanager
+def parse_args() -> Config:
+ """Parse the command-line arguments."""
+ parser = argparse.ArgumentParser()
+ parser.add_argument(
+ "--certs",
+ type=pathlib.Path,
+ default=DEFAULT_CERTS,
+ metavar="CERTDIR",
+ help="the path to the test certificates directory "
+ f"(default: {DEFAULT_CERTS})",
+ )
+ parser.add_argument(
+ "--program",
+ type=pathlib.Path,
+ default=DEFAULT_PROG,
+ help=f"the path to the stunnel executable to use "
+ f"(default: {DEFAULT_PROG})",
+ )
+ parser.add_argument(
+ "--logs",
+ type=pathlib.Path,
+ default=DEFAULT_LOGS,
+ metavar="LOGDIR",
+ help=f"the path to the test logs directory "
+ f"(default: {DEFAULT_LOGS})",
+ )
+ parser.add_argument(
+ "--libs",
+ type=pathlib.Path,
+ default="",
+ metavar="LIBRARY_PATH",
+ help="the path to the OpenSSL libraries "
+ "(default: NULL)",
+ )
+ parser.add_argument(
+ "--debug",
+ type=int,
+ default=DEFAULT_LEVEL,
+ metavar="LEVEL",
+ help="the logging level "
+ "(default: INFO)",
+ )
+ args = parser.parse_args()
+ utf8_env = dict(os.environ)
+ # environment can only contain strings
+ utf8_env.update({
+ "LC_ALL": "C.UTF-8",
+ "LANGUAGE": "",
+ "LD_LIBRARY_PATH": str(args.libs)})
+ if not os.path.isdir(args.logs):
+ os.mkdir(args.logs)
+ with os.scandir(args.logs) as entries:
+ for entry in entries:
+ os.remove(entry)
+
+ with tempfile.TemporaryDirectory(prefix="stunnel_tests.") as tempd_name:
+ yield Config(
+ scriptdir=os.path.dirname(os.path.abspath(__file__)),
+ pythondir=sys.executable,
+ certdir=args.certs,
+ children={},
+ mainq=asyncio.Queue(),
+ logsq=asyncio.Queue(),
+ resq=asyncio.Queue(),
+ program=args.program,
+ tasks={},
+ tempd=pathlib.Path(tempd_name),
+ utf8_env=utf8_env,
+ results=os.path.join(args.logs, "results.log"),
+ summary=os.path.join(args.logs, "summary.log"),
+ debug=args.debug
+ )
+
+
+async def main() -> None:
+ """Main program: parse arguments, prepare an environment, run tests."""
+ tag = "main"
+ with parse_args() as cfg:
+
+ # Initialize the event processing infrastructure.
+ try:
+ rlogs = TestLogs(cfg)
+ formats = "%(levelname)s: %(asctime)s: %(message)s"
+ rlogger = rlogs.setup_logger("results", formats, cfg.results, cfg.debug)
+ task = asyncio.create_task(rlogs.process_events(rlogger))
+
+ slogs = TestLogs(cfg)
+ formats = "%(message)s"
+ slogger = slogs.setup_logger("summary", formats, cfg.summary, DEFAULT_LEVEL)
+ except Exception as err: # pylint: disable=broad-except
+ # Logging is not available at this point.
+ print(err)
+ print("Framework initalization failed")
+ sys.exit(EXIT_FAILURE)
+
+ # Execute the tests.
+ try:
+ await slogs.get_version(slogger)
+ slogs.transcript_logs("summary", formats)
+
+ await PluginCollection(cfg, slogger, 'plugins')
+ await cfg.mainq.put(
+ LogEvent(
+ etype="finish_event",
+ level=20,
+ log=f"{tag} Stunnel tests completed"
+ )
+ )
+ except UnsupportedOpenSSL as err:
+ await cfg.mainq.put(
+ LogEvent(
+ etype="finish_event",
+ level=30,
+ log=f"{tag} Unsupported OpenSSL: {err}"
+ )
+ )
+ print(err)
+ except Exception as err: # pylint: disable=broad-except
+ await cfg.mainq.put(
+ LogEvent(
+ etype="finish_event",
+ level=50,
+ log=f"{tag} Something went wrong: {err}"
+ )
+ )
+ print(err)
+
+ # Report the results.
+ evt = await cfg.logsq.get()
+ if evt.etype == "finish_event":
+ succeeded, failed, skipped = task.result()
+ slogger.info("\nSummary:")
+ slogger.info("\tsucceeded: %s", succeeded)
+ slogger.info("\tfailed: %s", failed)
+ slogger.info("\tskipped: %s", skipped)
+ slogger.info("\nTesting results: %s", cfg.results)
+ if evt.level < 40: # not an error
+ if failed == 0:
+ sys.exit(EXIT_SUCCESS)
+ else:
+ slogger.error("Failed (not all plugins were executed)")
+ else: # not synchronized -> stats may be misleading
+ slogger.error("Failed (expected 'finish_event')")
+ sys.exit(EXIT_FAILURE)
+
+
+if __name__ == "__main__":
+ asyncio.run(main())

_service:tar_scm:stunnel-5.69.tar.gz/tests/plugin_collection.py Added

@@ -0,0 +1,151 @@
+"""A plugin structure"""
+
+import dataclasses
+import errno
+import inspect
+import os
+import posix
+import pkgutil
+
+
+def err_msg(err: int) -> str:
+ """Build the message to expect when an OS error occurs."""
+ raw = str(OSError(err, posix.strerror(err)))
+ return raw.replace("", "\\").replace("", "\\")
+
+
+ERR_CONN_RESET = err_msg(errno.ECONNRESET)
+
+
+@dataclasses.dataclass(frozen=True)
+class LogEvent():
+ """The base class for an event."""
+ etype: str
+ level: int
+ log: str
+
+
+class Plugin():
+ """Base class that each plugin must inherit from. Within this class
+ you must define the methods that all of your plugins must implement
+ """
+ # pylint: disable=too-few-public-methods
+
+ def __init__(self):
+ self.description = 'UNKNOWN'
+
+ async def perform_operation(self, cfg, logger):
+ """The method that we expect all plugins to implement. This is the
+ method that our framework will call
+ """
+ raise NotImplementedError
+
+
+class PluginCollection():
+ """Upon creation, this class will read the plugins package for modules
+ that contain a class definition that is inheriting from the Plugin class
+ """
+
+ def __init__(self, cfg, logger, plugin_package):
+ """Constructor that initiates the reading of all available plugins
+ when an instance of the PluginCollection object is created
+ """
+ self.plugin_package = plugin_package
+ self.cfg = cfg
+ self.logger = logger
+ self.plugins = 
+ self.seen_paths = 
+
+
+ def __await__(self):
+ return self.async_init().__await__()
+
+
+ async def async_init(self):
+ """Constructor that initiates the reading of all available plugins
+ when an instance of the PluginCollection object is created
+ """
+ await self.reload_plugins()
+ await self.apply_all_plugins()
+
+
+ async def reload_plugins(self):
+ """Reset the list of all plugins and initiate the walk over the main
+ provided plugin package to load all available plugins
+ """
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=10,
+ log=f'plugins Looking for plugins under package {self.plugin_package}'
+ )
+ )
+ await self.walk_package(self.plugin_package)
+
+
+ async def apply_all_plugins(self):
+ """Apply all of the plugins
+ """
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=10,
+ log='plugins ----- Applying all plugins -----'
+ )
+ )
+ for plugin in self.plugins:
+ await self.cfg.mainq.put(LogEvent(etype="log", level=20, log=""))
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=20,
+ log=f'plugins >>>>> Applying \'{plugin.description}\' <<<<<'
+ )
+ )
+ await plugin.perform_operation(self.cfg, self.logger)
+
+ async def walk_package(self, package):
+ """Recursively walk the supplied package to retrieve all plugins
+ """
+ imported_package = __import__(package, fromlist='blah')
+
+ for _, pluginname, ispkg in pkgutil.iter_modules(
+ imported_package.__path__, imported_package.__name__ + '.'
+ ):
+ if not ispkg:
+ plugin_module = __import__(pluginname, fromlist='blah')
+ clsmembers = inspect.getmembers(plugin_module, inspect.isclass)
+ for (_, cls) in clsmembers:
+ # Only add classes that are a sub class of Plugin, but NOT Plugin itself
+ if issubclass(cls, Plugin) & (cls is not Plugin):
+ await self.cfg.mainq.put(
+ LogEvent(
+ etype="log",
+ level=10,
+ log=f'plugins Found plugin class: {cls.__module__}.{cls.__name__}'
+ )
+ )
+ self.plugins.append(cls())
+
+
+ # Now that we have looked at all the modules in the current package, start looking
+ # recursively for additional modules in sub packages
+ all_current_paths = 
+ if isinstance(imported_package.__path__, str):
+ all_current_paths.append(imported_package.__path__)
+ else:
+ all_current_paths.extend(imported_package.__path__)
+
+ for pkg_path in all_current_paths:
+ if pkg_path not in self.seen_paths:
+ self.seen_paths.append(pkg_path)
+
+ # Get all sub directory of the current package path directory
+ child_pkgs = 
+ p for p in os.listdir(pkg_path)
+ if os.path.isdir(os.path.join(pkg_path, p))
+ 
+
+ # For each sub directory, apply the walk_package method recursively
+ for child_pkg in child_pkgs:
+ await self.walk_package(package + '.' + child_pkg)

_service:tar_scm:stunnel-5.69.tar.gz/tests/plugins Added

_service:tar_scm:stunnel-5.69.tar.gz/tests/plugins/p01_client_cert.py Added

@@ -0,0 +1,137 @@
+"""stunnel client tests"""
+
+import logging
+import os
+import pathlib
+from plugin_collection import Plugin, ERR_CONN_RESET
+from maketest import (
+    Config,
+    StunnelAcceptConnect
+)
+
+
+class StunnelTest(StunnelAcceptConnect):
+    """Base class for stunnel client tests."""
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.ssl_server = True
+        self.params.services = 'client'
+
+
+class CertTest(StunnelTest):
+    """ Checking if the cert option ensures a client certificate.
+        The success is expected because the client presents a certificate.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '011. Test \"cert\" option'
+        self.params.context = 'cert_required'
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            "Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_client_cfgfile(
+        self, cfg: Config, ports: list, service: str
+    ) -> (pathlib.Path, pathlib.Path):
+        """Create a configuration file for a stunnel client."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    client = yes
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{ports0}
+    cert = {cfg.certdir}/client_cert.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_client.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile, os.devnull
+
+
+
+class FailureCertTest(StunnelTest):
+    """ Checking if the cert option ensures a client certificate.
+        The failure is expected because the client does not present any certificate.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '012. Test no \"cert\" option'
+        self.params.context = 'cert_required'
+        self.events.count = 1
+        self.events.success = 
+            "Client received unexpected message",
+            ERR_CONN_RESET
+        
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            "Redirecting connection",
+            #ERR_CONN_RESET,
+            #"Connection lost",
+            #"Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_client_cfgfile(
+        self, cfg: Config, ports: list, service: str
+    ) -> (pathlib.Path, pathlib.Path):
+        """Create a configuration file for a stunnel client."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    client = yes
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{ports0}
+    ;client does not present any certificate
+    ;cert = {cfg.certdir}/client_cert.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_client.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile, os.devnull
+
+
+
+class StunnelClientTest(Plugin):
+    """Stunnel client tests
+       HTTP client --> stunnel client --> HTTPS server
+    """
+    # pylint: disable=too-few-public-methods
+
+    def __init__(self):
+        super().__init__()
+        self.description = 'Existing certificate'
+
+
+    async def perform_operation(self, cfg: Config, logger: logging.Logger) -> None:
+        """Run tests"""
+        stunnel = CertTest(cfg, logger)
+        await stunnel.test_stunnel(cfg)
+
+        stunnel = FailureCertTest(cfg, logger)
+        await stunnel.test_stunnel(cfg)

_service:tar_scm:stunnel-5.69.tar.gz/tests/plugins/p02_require_cert.py Added

@@ -0,0 +1,133 @@
+"""stunnel server tests"""
+
+import logging
+import pathlib
+from plugin_collection import Plugin, ERR_CONN_RESET
+from maketest import (
+    Config,
+    StunnelAcceptConnect
+)
+
+
+class StunnelTest(StunnelAcceptConnect):
+    """Base class for stunnel server tests."""
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.ssl_client = True
+        self.params.services = 'server'
+
+
+class RequireCertTest(StunnelTest):
+    """Checking if the requireCert option requires a client certificate.
+       The success is expected because the client presents any but incorrect certificate.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '021. Test \"requireCert\" option'
+        self.params.context = 'load_wrong_cert'
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            "Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+    requireCert = yes
+
+    {service}
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{port}
+    cert = {cfg.certdir}/server_cert.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class FailureRequireCertTest(StunnelTest):
+    """Checking if the requireCert option requires a client certificate.
+       The failure is expected because the client does not present any certificate.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '022. Failure test \"requireCert\" option'
+        self.events.count = 1
+        self.events.success = 
+            "peer did not return a certificate",
+            "alert certificate required",
+            ERR_CONN_RESET
+        
+        self.events.failure = 
+            #"peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            "Redirecting connection",
+            #ERR_CONN_RESET,
+            #"Connection lost",
+            #"Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+    requireCert = yes
+
+    {service}
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{port}
+    cert = {cfg.certdir}/server_cert.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class StunnelServerTest(Plugin):
+    """Stunnel server tests:
+       HTTPS client --> stunnel server --> HTTP server
+    """
+    # pylint: disable=too-few-public-methods
+
+    def __init__(self):
+        super().__init__()
+        self.description = 'Require certificate'
+
+
+    async def perform_operation(self, cfg: Config, logger: logging.Logger) -> None:
+        """Run tests"""
+        stunnel = RequireCertTest(cfg, logger)
+        await stunnel.test_stunnel(cfg)
+
+        stunnel = FailureRequireCertTest(cfg, logger)
+        await stunnel.test_stunnel(cfg)

_service:tar_scm:stunnel-5.69.tar.gz/tests/plugins/p03_verify_peer.py Added

@@ -0,0 +1,139 @@
+"""stunnel server tests"""
+
+import logging
+import pathlib
+from plugin_collection import Plugin, ERR_CONN_RESET
+from maketest import (
+    Config,
+    StunnelAcceptConnect
+)
+
+
+class StunnelTest(StunnelAcceptConnect):
+    """Base class for stunnel server tests."""
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.ssl_client = True
+        self.params.services = 'server'
+
+
+class VerifyPeer(StunnelTest):
+    """Checking if the verifyPeer option verifies the peer certificate.
+       The peer certificate is stored in the file specified with CAfile.
+       The success is expected because the client presents the valid certificate.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '031. Test \"verifyPeer\" option'
+        self.params.context = 'load_correct_cert'
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            "Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{port}
+    cert = {cfg.certdir}/server_cert.pem
+    verifyPeer = yes
+    CAfile = {cfg.certdir}/PeerCerts.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class FailureVerifyPeer(StunnelTest):
+    """Checking if the verifyPeer option verifies the peer certificate.
+       The valid peer certificate is stored in the file specified with CAfile.
+       The failure is expected because the client presents an incorrect certificate.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '032. Failure test \"verifyPeer\" option'
+        self.params.context = 'load_wrong_cert'
+        self.events.count = 1
+        self.events.success = 
+            "certificate verify failed",
+            "unknown CA",
+            "alert unknown ca",
+            ERR_CONN_RESET
+        
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            #"certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            "Redirecting connection",
+            #ERR_CONN_RESET,
+            #"Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{port}
+    cert = {cfg.certdir}/server_cert.pem
+    verifyPeer = yes
+    CAfile = {cfg.certdir}/PeerCerts.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class StunnelServerTest(Plugin):
+    """Stunnel server tests:
+       HTTPS client --> stunnel server --> HTTP server
+    """
+    # pylint: disable=too-few-public-methods
+
+    def __init__(self):
+        super().__init__()
+        self.description = 'Verify peer'
+
+
+    async def perform_operation(self, cfg: Config, logger: logging.Logger) -> None:
+        """Run tests"""
+        stunnel = VerifyPeer(cfg, logger)
+        await stunnel.test_stunnel(cfg)
+
+        stunnel = FailureVerifyPeer(cfg, logger)
+        await stunnel.test_stunnel(cfg)

_service:tar_scm:stunnel-5.69.tar.gz/tests/plugins/p04_verify_chain.py Added

@@ -0,0 +1,139 @@
+"""stunnel server tests"""
+
+import logging
+import pathlib
+from plugin_collection import Plugin, ERR_CONN_RESET
+from maketest import (
+    Config,
+    StunnelAcceptConnect
+)
+
+
+class StunnelTest(StunnelAcceptConnect):
+    """Base class for stunnel server tests."""
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.ssl_client = True
+        self.params.services = 'server'
+
+
+class VerifyChain(StunnelTest):
+    """Checking if the verifyChain option verifies the peer certificate starting from the root CA.
+       The self-signed root CA certificate is stored in the file specified with CAfile.
+       The success is expected because python client presents the valid certificate.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '041. Test \"verifyChain\" option'
+        self.params.context = 'load_correct_cert'
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            "Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{port}
+    cert = {cfg.certdir}/server_cert.pem
+    verifyChain = yes
+    CAfile = {cfg.certdir}/CACert.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class FailureVerifyChain(StunnelTest):
+    """Checking if the verifyChain option verifies the peer certificate starting from the root CA.
+       The self-signed root CA certificate is stored in the file specified with CAfile.
+       The failure is expected because python client presents an incorrect certificate.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '042. Failure test \"verifyChain\" option'
+        self.params.context = 'load_wrong_cert'
+        self.events.count = 1
+        self.events.success = 
+            "certificate verify failed",
+            "unknown CA",
+            "alert unknown ca",
+            ERR_CONN_RESET
+        
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            #"certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            "Redirecting connection",
+            #ERR_CONN_RESET,
+            #"Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{port}
+    cert = {cfg.certdir}/server_cert.pem
+    verifyChain = yes
+    CAfile = {cfg.certdir}/CACert.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class StunnelServerTest(Plugin):
+    """Stunnel server tests:
+       HTTPS client --> stunnel server --> HTTP server
+    """
+    # pylint: disable=too-few-public-methods
+
+    def __init__(self):
+        super().__init__()
+        self.description = 'Verify chain'
+
+
+    async def perform_operation(self, cfg: Config, logger: logging.Logger) -> None:
+        """Run tests"""
+        stunnel = VerifyChain(cfg, logger)
+        await stunnel.test_stunnel(cfg)
+
+        stunnel = FailureVerifyChain(cfg, logger)
+        await stunnel.test_stunnel(cfg)

_service:tar_scm:stunnel-5.69.tar.gz/tests/plugins/p05_verify_crl.py Added

@@ -0,0 +1,144 @@
+"""stunnel server tests"""
+
+import logging
+import pathlib
+from plugin_collection import Plugin, ERR_CONN_RESET
+from maketest import (
+    Config,
+    StunnelAcceptConnect
+)
+
+
+class StunnelTest(StunnelAcceptConnect):
+    """Base class for stunnel server tests."""
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.ssl_client = True
+        self.params.services = 'server'
+
+
+class VerifyCRL(StunnelTest):
+    """Checking if the CRL is verified.
+       The verifyChain option verifies the peer certificate starting from the root CA.
+       The self-signed root CA certificate is stored in the file specified with CAfile.
+       Certificate Revocation Lists file is stored in the file specified with CRLfile.
+       The success is expected because python client presents the valid certificate.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '051. CRL file with valid certificate'
+        self.params.context = 'load_correct_cert'
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            "Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{port}
+    cert = {cfg.certdir}/server_cert.pem
+    verifyChain = yes
+    CAfile = {cfg.certdir}/CACert.pem
+    CRLfile = {cfg.certdir}/CACertCRL.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class FailureVerifyCRL(StunnelTest):
+    """Checking if the CRL is verified.
+       The verifyChain option verifies the peer certificate starting from the root CA.
+       The self-signed root CA certificate is stored in the file specified with CAfile.
+       Certificate Revocation Lists file is stored in the file specified with CRLfile.
+       The failure is expected because the python client presents the revoked certificate.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '052. CRL file with revoked certificate'
+        self.params.context = 'load_revoked_cert'
+        self.events.count = 1
+        self.events.success = 
+            "certificate verify failed",
+            "certificate revoked",
+            ERR_CONN_RESET
+        
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            #"certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            "Redirecting connection",
+            #ERR_CONN_RESET,
+            #"Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{port}
+    cert = {cfg.certdir}/server_cert.pem
+    verifyChain = yes
+    CAfile = {cfg.certdir}/CACert.pem
+    CRLfile = {cfg.certdir}/CACertCRL.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class StunnelServerTest(Plugin):
+    """Stunnel server tests:
+       HTTPS client --> stunnel server --> HTTP server
+    """
+    # pylint: disable=too-few-public-methods
+
+    def __init__(self):
+        super().__init__()
+        self.description = 'Verify CRL file'
+
+
+    async def perform_operation(self, cfg: Config, logger: logging.Logger) -> None:
+        """Run tests"""
+        stunnel = VerifyCRL(cfg, logger)
+        await stunnel.test_stunnel(cfg)
+
+        stunnel = FailureVerifyCRL(cfg, logger)
+        await stunnel.test_stunnel(cfg)

_service:tar_scm:stunnel-5.69.tar.gz/tests/plugins/p06_psk_secrets.py Added

@@ -0,0 +1,174 @@
+"""stunnel client-server tests"""
+
+import logging
+import os
+import pathlib
+from plugin_collection import Plugin, ERR_CONN_RESET
+from maketest import (
+    Config,
+    StunnelAcceptConnect
+)
+
+
+class StunnelTest(StunnelAcceptConnect):
+    """Base class for stunnel client-server tests."""
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.services = 'server', 'client'
+
+
+class PSKSecrets(StunnelTest):
+    """Checking if the PSK authentication works properly.
+       PSK identities and corresponding keys are stored in files specified with PSKsecrets.
+       The success is expected because the client presents the valid PSK.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '061. Test \"PSKsecrets\" option'
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            "Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_client_cfgfile(
+        self, cfg: Config, ports: list, service: str
+    ) -> (pathlib.Path, pathlib.Path):
+        """Create a configuration file for a stunnel client."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    client = yes
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{ports1}
+    PSKsecrets = {cfg.certdir}/psk1.txt
+    """
+        cfgfile = cfg.tempd / "stunnel_client.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile, os.devnull
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+    requireCert = yes
+
+    {service}
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{port}
+    PSKsecrets = {cfg.certdir}/secrets.txt
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class FailurePSKSecrets(StunnelTest):
+    """Checking if the PSK authentication works properly.
+       PSK identities and corresponding keys are stored in files specified with PSKsecrets.
+       The failure is expected because the client presented an incorrect key.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '062. Failure test \"PSKsecrets\" option'
+        self.events.count = 1
+        self.events.success = 
+            "binder does not verify",
+            "bad record mac",
+            ERR_CONN_RESET
+        
+        self.events.failure = 
+            #"peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            "Redirecting connection",
+            #ERR_CONN_RESET,
+            #"Connection lost",
+            #"Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_client_cfgfile(
+        self, cfg: Config, ports: list, service: str
+    ) -> (pathlib.Path, pathlib.Path):
+        """Create a configuration file for a stunnel client."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    client = yes
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{ports1}
+    PSKsecrets = {cfg.certdir}/psk2.txt
+    """
+        cfgfile = cfg.tempd / "stunnel_client.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile, os.devnull
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+    requireCert = yes
+
+    {service}
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{port}
+    PSKsecrets = {cfg.certdir}/secrets.txt
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class StunnelClientServerTest(Plugin):
+    """Stunnel client-server tests
+       HTTP client --> stunnel client --> stunnel server --> HTTP server
+    """
+    # pylint: disable=too-few-public-methods
+
+    def __init__(self):
+        super().__init__()
+        self.description = 'PSK authentication'
+
+
+    async def perform_operation(self, cfg: Config, logger: logging.Logger) -> None:
+        """Run tests"""
+        stunnel = PSKSecrets(cfg, logger)
+        await stunnel.test_stunnel(cfg)
+
+        stunnel = FailurePSKSecrets(cfg, logger)
+        await stunnel.test_stunnel(cfg)

_service:tar_scm:stunnel-5.69.tar.gz/tests/plugins/p07_p12cert.py Added

@@ -0,0 +1,80 @@
+"""stunnel server tests"""
+
+import logging
+import pathlib
+from plugin_collection import Plugin, ERR_CONN_RESET
+from maketest import (
+    Config,
+    StunnelAcceptConnect
+)
+
+
+class StunnelTest(StunnelAcceptConnect):
+    """Base class for stunnel server tests."""
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.ssl_client = True
+        self.params.services = 'server'
+
+
+class Certp12Test(StunnelTest):
+    """Checking if the file containing certificates used by stunnel to authenticate
+       itself against the remote client may be in the P12 format.
+       The success is expected because the server presents the valid certificate in the P12 format.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '071. Test PKCS#12 certificate'
+        self.params.context = 'load_verify_locations"'
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            "Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{port}
+    cert = {cfg.certdir}/server_cert.p12
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class StunnelServerTest(Plugin):
+    """Stunnel server tests:
+       HTTPS client --> stunnel server --> HTTP server
+    """
+    # pylint: disable=too-few-public-methods
+
+    def __init__(self):
+        super().__init__()
+        self.description = 'Existing PKCS#12 certificate'
+
+
+    async def perform_operation(self, cfg: Config, logger: logging.Logger) -> None:
+        """Run tests"""
+        stunnel = Certp12Test(cfg, logger)
+        await stunnel.test_stunnel(cfg)

_service:tar_scm:stunnel-5.69.tar.gz/tests/plugins/p08_ipv6.py Added

@@ -0,0 +1,96 @@
+"""stunnel client-server tests"""
+
+import logging
+import os
+import pathlib
+from plugin_collection import Plugin, ERR_CONN_RESET
+from maketest import (
+    Config,
+    StunnelAcceptConnect
+)
+
+
+class StunnelTest(StunnelAcceptConnect):
+    """Base class for stunnel client-server tests."""
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.services = 'server', 'client'
+
+
+class IPv6Test(StunnelTest):
+    """ Checking if IPv6 is supported.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '081. Test IPv6 support'
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            "Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_client_cfgfile(
+        self, cfg: Config, ports: list, service: str
+    ) -> (pathlib.Path, pathlib.Path):
+        """Create a configuration file for a stunnel client."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    client = yes
+    accept = 127.0.0.1:0
+    connect = ::1:{ports1}
+    """
+        cfgfile = cfg.tempd / "stunnel_client.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile, os.devnull
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    accept = ::1:0
+    connect = 127.0.0.1:{port}
+    cert = {cfg.certdir}/server_cert.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class StunnelClientTest(Plugin):
+    """Stunnel client-server tests
+       HTTP client --> stunnel client --> stunnel server --> HTTP server
+    """
+    # pylint: disable=too-few-public-methods
+
+    def __init__(self):
+        super().__init__()
+        self.description = 'IPv6 support'
+
+
+    async def perform_operation(self, cfg: Config, logger: logging.Logger) -> None:
+        """Run tests"""
+        stunnel = IPv6Test(cfg, logger)
+        await stunnel.test_stunnel(cfg)

_service:tar_scm:stunnel-5.69.tar.gz/tests/plugins/p09_bind.py Added

@@ -0,0 +1,81 @@
+"""stunnel server tests"""
+
+import logging
+import pathlib
+from plugin_collection import Plugin, ERR_CONN_RESET
+from maketest import (
+    Config,
+    StunnelAcceptConnect
+)
+
+
+class StunnelTest(StunnelAcceptConnect):
+    """Base class for stunnel server tests."""
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.ssl_client = True
+        self.params.services = 'server'
+
+
+class BindingTest(StunnelTest):
+    """Checking if the service does't refuse to start if binding fails for some addresses:ports.
+       Sample log expected:
+       LOG5ui: Binding service server to 127.0.0.1:43293: Address already in use (98)
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '091. Binding server'
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            "Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    accept = 127.0.0.1:{port}
+    accept = 127.0.0.1:0
+    accept = 127.0.0.1:{port}
+    connect = 127.0.0.1:{port}
+    cert = {cfg.certdir}/server_cert.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class StunnelServerTest(Plugin):
+    """Stunnel server tests:
+       HTTPS client --> stunnel server --> HTTP server
+    """
+    # pylint: disable=too-few-public-methods
+
+    def __init__(self):
+        super().__init__()
+        self.description = 'Binding service'
+
+
+    async def perform_operation(self, cfg: Config, logger: logging.Logger) -> None:
+        """Run tests"""
+        stunnel = BindingTest(cfg, logger)
+        await stunnel.test_stunnel(cfg)

_service:tar_scm:stunnel-5.69.tar.gz/tests/plugins/p10_fips.py Added

@@ -0,0 +1,107 @@
+"""stunnel client-server tests"""
+
+import logging
+import os
+import pathlib
+from plugin_collection import Plugin, ERR_CONN_RESET
+from maketest import (
+    Config,
+    StunnelAcceptConnect
+)
+
+
+class StunnelTest(StunnelAcceptConnect):
+    """Base class for stunnel client-server tests."""
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.services = 'server', 'client'
+
+
+class FIPSTest(StunnelTest):
+    """ Checking FIPS mode.
+        The success is expected.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '101. Test FIPS mode'
+        self.events.skip = 
+            "FIPS provider not available",
+            "fips mode not supported",
+            r"FIPS PROVIDER.*could not load the shared library",
+            r"FIPS PROVIDER.*missing config data"
+        
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            "Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_client_cfgfile(
+        self, cfg: Config, ports: list, service: str
+    ) -> (pathlib.Path, pathlib.Path):
+        """Create a configuration file for a stunnel client."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    fips = yes
+
+    {service}
+    client = yes
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{ports1}
+    """
+        cfgfile = cfg.tempd / "stunnel_client.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile, os.devnull
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    fips = yes
+
+    {service}
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{port}
+    cert = {cfg.certdir}/server_cert.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class StunnelClientServerTest(Plugin):
+    """Stunnel client-server tests
+       HTTP client --> stunnel client --> stunnel server --> HTTP server
+    """
+    # pylint: disable=too-few-public-methods
+
+    def __init__(self):
+        super().__init__()
+        self.description = 'FIPS mode'
+
+
+    async def perform_operation(self, cfg: Config, logger: logging.Logger) -> None:
+        """Run tests"""
+        stunnel = FIPSTest(cfg, logger)
+        await stunnel.test_stunnel(cfg)

_service:tar_scm:stunnel-5.69.tar.gz/tests/plugins/p11_fips_cipher.py Added

@@ -0,0 +1,216 @@
+"""stunnel server tests"""
+
+import logging
+import pathlib
+from plugin_collection import Plugin, ERR_CONN_RESET
+from maketest import (
+    Config,
+    ExpectedConfigurationFailure
+)
+
+
+class StunnelTest(ExpectedConfigurationFailure):
+    """Base class for stunnel server tests."""
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.ssl_client = True
+        self.params.services = 'server'
+
+
+class FailureCipherFIPS(StunnelTest):
+    """Checking FIPS mode.
+       The cipher "CAMELLIA256-SHA" (TLS1_TXT_RSA_WITH_CAMELLIA_256_CBC_SHA256)
+       is unavailable if FIPS is enabled.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '111. Failure FIPS mode with unavailable cipher'
+        self.events.skip = 
+            "FIPS provider not available",
+            "fips mode not supported",
+            r"FIPS PROVIDER.*could not load the shared library",
+            r"FIPS PROVIDER.*missing config data"
+        
+        self.events.count = 1
+        self.events.success = 
+            "no cipher match"
+        
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            "Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            #"Something went wrong: stunnel 'server' failed",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    fips = yes
+    ciphers = CAMELLIA256-SHA
+
+    {service}
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{port}
+    cert = {cfg.certdir}/server_cert.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class FailureCiphersuitesFIPS(StunnelTest):
+    """Checking FIPS mode.
+       The ciphersuite "TLS_CHACHA20_POLY1305_SHA256" is unavailable if FIPS is enabled.
+       This option requires OpenSSL 1.1.1 or later.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '112. Failure FIPS mode with unavailable ciphersuite'
+        self.events.skip = 
+            "FIPS provider not available",
+            "fips mode not supported",
+            r"FIPS PROVIDER.*could not load the shared library",
+            "Specified option name is not valid here",
+            r"FIPS PROVIDER.*missing config data"
+        
+        self.events.count = 1
+        self.events.success = 
+            "disabled for FIPS",
+            "no ciphers available"
+        
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            "Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    fips = yes
+    ciphersuites = TLS_CHACHA20_POLY1305_SHA256
+
+    {service}
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{port}
+    cert = {cfg.certdir}/server_cert.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+
+
+class FailureEllipticCurveFIPS(StunnelTest):
+    """ Checking FIPS mode.
+        The elliptic curve "sect163r1" is unavailable if FIPS is enabled.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '113. Failure FIPS mode with unavailable elliptic curve'
+        self.events.skip = 
+            "FIPS provider not available",
+            "fips mode not supported",
+            r"FIPS PROVIDER.*could not load the shared library",
+            r"FIPS PROVIDER.*missing config data"
+        
+        self.events.count = 1
+        self.events.success = 
+            "no suitable key share",
+            "Invalid groups list in 'curves'"
+        
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            "Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    fips = yes
+    curves = sect163r1
+
+    {service}
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{port}
+    cert = {cfg.certdir}/server_cert.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class StunnelServerTest(Plugin):
+    """Stunnel server tests:
+       HTTPS client --> stunnel server --> HTTP server
+    """
+    # pylint: disable=too-few-public-methods
+
+    def __init__(self):
+        super().__init__()
+        self.description = 'FIPS mode cipher'
+
+
+    async def perform_operation(self, cfg: Config, logger: logging.Logger) -> None:
+        """Run tests"""
+        stunnel = FailureCipherFIPS(cfg, logger)
+        await stunnel.test_stunnel(cfg)
+
+        stunnel = FailureCiphersuitesFIPS(cfg, logger)
+        await stunnel.test_stunnel(cfg)
+
+        stunnel = FailureEllipticCurveFIPS(cfg, logger)
+        await stunnel.test_stunnel(cfg)

_service:tar_scm:stunnel-5.69.tar.gz/tests/plugins/p12_sni.py Added

@@ -0,0 +1,192 @@
+"""stunnel client-server tests"""
+
+import logging
+import os
+import pathlib
+from plugin_collection import Plugin, ERR_CONN_RESET
+from maketest import (
+    Config,
+    StunnelAcceptConnect
+)
+
+
+class StunnelTest(StunnelAcceptConnect):
+    """Base class for stunnel client-server tests."""
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.services = 'server_virtual', 'client'
+
+
+class SNITest(StunnelTest):
+    """Use the service as a secondary service (a name-based virtual server)
+       for Server Name Indication TLS extension.
+       SERVICE_NAME (server_virtual) specifies the primary service that
+       accepts client connections with the accept option.
+       SERVER_NAME_PATTERN (*.mydomain.com) specifies the host name to be redirected.
+       The success is expected because the client presents the sni pattern (sni.mydomain.com)
+       corresponding with SERVER_NAME_PATTERN (*.mydomain.com).
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '121. Test \"sni\" option'
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            "Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_client_cfgfile(
+        self, cfg: Config, ports: list, service: str
+    ) -> (pathlib.Path, pathlib.Path):
+        """Create a configuration file for a stunnel client."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    client = yes
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{ports1}
+    sni = sni.mydomain.com
+    cert = {cfg.certdir}/client_cert.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_client.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile, os.devnull
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    accept = 127.0.0.1:0
+    cert = {cfg.certdir}/server_cert.pem
+    exec = {cfg.pythondir}
+    execArgs = python3 {cfg.scriptdir}/error.py
+
+    sni
+    connect = 127.0.0.1:{port}
+    sni = server_virtual:*.mydomain.com
+    cert = {cfg.certdir}/server_cert.pem
+    verifyPeer = yes
+    CAfile = {cfg.certdir}/PeerCerts.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class FailureSNITest(StunnelTest):
+    """Use the service as a secondary service (a name-based virtual server)
+       for Server Name Indication TLS extension.
+       SERVICE_NAME (server_virtual) specifies the primary service that
+       accepts client connections with the accept option.
+       SERVER_NAME_PATTERN sni.mydomain.com) specifies the host name to be redirected.
+       The success is expected because the client doesn't present any sni pattern.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '122. Failure test \"sni\" option'
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            "Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_client_cfgfile(
+        self, cfg: Config, ports: list, service: str
+    ) -> (pathlib.Path, pathlib.Path):
+        """Create a configuration file for a stunnel client."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    client = yes
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{ports1}
+    ;the client doesn't present any sni pattern
+    ;sni = sni.mydomain.com
+    cert = {cfg.certdir}/client_cert.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_client.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile, os.devnull
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{port}
+    cert = {cfg.certdir}/server_cert.pem
+    verifyPeer = yes
+    CAfile = {cfg.certdir}/PeerCerts.pem
+
+    sni
+    sni = server_virtual:*.mydomain.com
+    cert = {cfg.certdir}/server_cert.pem
+    exec = {cfg.pythondir}
+    execArgs = python3 {cfg.scriptdir}/error.py
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class StunnelClientServerTest(Plugin):
+    """Stunnel client-server tests
+       HTTP client --> stunnel client --> stunnel server --> HTTP server
+    """
+    # pylint: disable=too-few-public-methods
+
+    def __init__(self):
+        super().__init__()
+        self.description = 'Server Name Indication'
+
+
+    async def perform_operation(self, cfg: Config, logger: logging.Logger) -> None:
+        """Run tests"""
+        stunnel = SNITest(cfg, logger)
+        await stunnel.test_stunnel(cfg)
+
+        stunnel = FailureSNITest(cfg, logger)
+        await stunnel.test_stunnel(cfg)

_service:tar_scm:stunnel-5.69.tar.gz/tests/plugins/p13_resume.py Added

@@ -0,0 +1,343 @@
+"""stunnel client-server tests"""
+
+import logging
+import os
+import pathlib
+from plugin_collection import Plugin, ERR_CONN_RESET
+from maketest import (
+    Config,
+    StunnelAcceptConnect
+)
+
+
+class StunnelTest(StunnelAcceptConnect):
+    """Base class for stunnel client-server tests."""
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.services = 'server', 'client'
+        self.params.conn_num = 3
+
+
+class ResumePSK(StunnelTest):
+    """Checking if the PSK authentication works properly when the session is resumed.
+       We expect exactly 2 "TLS accepted: previous session reused" to be logged
+       by the server service because the client presents the valid PSK.
+       PSK identities and corresponding keys are stored in files specified with PSKsecrets.
+       This resumption of the session does not work for the FORK threading model.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '131. Resume session with PSK authentication'
+        self.events.skip = 
+            "FORK"
+        
+        self.events.count = 2
+        self.events.success = 
+            "TLS accepted: previous session reused"
+        
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            #"TLS accepted: previous session reused",
+            "Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_client_cfgfile(
+        self, cfg: Config, ports: list, service: str
+    ) -> (pathlib.Path, pathlib.Path):
+        """Create a configuration file for a stunnel client."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    client = yes
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{ports1}
+    PSKsecrets = {cfg.certdir}/psk1.txt
+    """
+        cfgfile = cfg.tempd / "stunnel_client.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile, os.devnull
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{port}
+    PSKsecrets = {cfg.certdir}/secrets.txt
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class ResumeCacheTLSv12(StunnelTest):
+    """Checking the cache session resumption.
+       We expect exactly 2 "TLS accepted: previous session reused" to be
+       logged by the server service.
+       "options = NO_TICKET" turns off ticket support in TLSv1.2 and older.
+       In TLSv1.3, "options = NO_TICKET" switches from using stateful tickets to
+       stateless tickets (traditional cache with session id sent in tickets).
+       https://github.com/openssl/openssl/issues/10280
+       Session cache resumption does not work with the FORK threading model.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '132. Cache session resumption with TLSv1.2'
+        self.events.skip = 
+            "FORK"
+        
+        self.events.count = 2
+        self.events.success = 
+            "TLS accepted: previous session reused"
+        
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            #"TLS accepted: previous session reused",
+            "Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_client_cfgfile(
+        self, cfg: Config, ports: list, service: str
+    ) -> (pathlib.Path, pathlib.Path):
+        """Create a configuration file for a stunnel client."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    client = yes
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{ports1}
+    cert = {cfg.certdir}/client_cert.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_client.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile, os.devnull
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    sslVersion = TLSv1.2
+    options = NO_TICKET
+
+    {service}
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{port}
+    cert = {cfg.certdir}/server_cert.pem
+    verifyPeer = yes
+    CAfile = {cfg.certdir}/PeerCerts.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class SessionResume(StunnelTest):
+    """Enable the 'sessionResume' service-level option to allow session resumption.
+       This resumption of the session does not work for the FORK threading model.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '133. Test enabled \"sessionResume\" option'
+        self.events.skip = 
+            "FORK"
+        
+        self.events.count = 2
+        self.events.success = 
+            "TLS accepted: previous session reused"
+        
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            #"TLS accepted: previous session reused",
+            "Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_client_cfgfile(
+        self, cfg: Config, ports: list, service: str
+    ) -> (pathlib.Path, pathlib.Path):
+        """Create a configuration file for a stunnel client."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    client = yes
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{ports1}
+    cert = {cfg.certdir}/client_cert.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_client.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile, os.devnull
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    sessionResume = yes
+
+    {service}
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{port}
+    cert = {cfg.certdir}/server_cert.pem
+    verifyPeer = yes
+    CAfile = {cfg.certdir}/PeerCerts.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class NoSessionResume(StunnelTest):
+    """Disable the 'sessionResume' service-level option to disallow session resumption.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '134. Test disabled \"sessionResume\" option'
+        self.events.count = 3
+        self.events.success = 
+            "TLS accepted: new session negotiated"
+        
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            "Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_client_cfgfile(
+        self, cfg: Config, ports: list, service: str
+    ) -> (pathlib.Path, pathlib.Path):
+        """Create a configuration file for a stunnel client."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    client = yes
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{ports1}
+    cert = {cfg.certdir}/client_cert.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_client.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile, os.devnull
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    sessionResume = no
+
+    {service}
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{port}
+    cert = {cfg.certdir}/server_cert.pem
+    verifyPeer = yes
+    CAfile = {cfg.certdir}/PeerCerts.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class StunnelClientServerTest(Plugin):
+    """Stunnel client-server tests
+       HTTP client --> stunnel client --> stunnel server --> HTTP server
+    """
+    # pylint: disable=too-few-public-methods
+
+    def __init__(self):
+        super().__init__()
+        self.description = 'Resume session'
+
+
+    async def perform_operation(self, cfg: Config, logger: logging.Logger) -> None:
+        """Run tests"""
+        stunnel = ResumePSK(cfg, logger)
+        await stunnel.test_stunnel(cfg)
+
+        stunnel = ResumeCacheTLSv12(cfg, logger)
+        await stunnel.test_stunnel(cfg)
+
+        stunnel = SessionResume(cfg, logger)
+        await stunnel.test_stunnel(cfg)
+
+        stunnel = NoSessionResume(cfg, logger)
+        await stunnel.test_stunnel(cfg)

_service:tar_scm:stunnel-5.69.tar.gz/tests/plugins/p14_resume_ticket.py Added

@@ -0,0 +1,209 @@
+"""stunnel client-server tests"""
+
+import logging
+import os
+import pathlib
+from plugin_collection import Plugin, ERR_CONN_RESET
+from maketest import (
+    Config,
+    ClientConnectExec
+)
+
+
+class StunnelTest(ClientConnectExec):
+    """Base class for stunnel client-server tests."""
+
+    def __init__(self, cfg: Config, logger: logging.Logger, path:pathlib.Path):
+        super().__init__(cfg, logger, path)
+        self.params.services = 'server', 'client'
+        self.params.conn_num = 3
+        self.events.count = 2
+
+
+class ResumeTicketTLSv12(StunnelTest):
+    """Checking the stateless session ticket resumption (RFC 4507bis) with TLSv1.2.
+       We expect exactly 2 "TLS accepted: previous session reused" to be logged by the
+       server service, because client connected 3 times (1 new session, 2 reused sessions).
+       The following options are used to disable session cache:
+       - The "sessionCacheSize = 1" option sets the internal session cache size.
+       - "options = -NO_TICKET" (it is the default with OpenSSL 1.1.1 or later)
+       Stateless session ticket resumption also works with the FORK threading model.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger, path:pathlib.Path):
+        super().__init__(cfg, logger, path)
+        self.params.description = '141. Stateless session ticket resumption with TLSv1.2'
+        self.events.count = 2
+        self.events.success = 
+            "TLS accepted: previous session reused"
+        
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            #"TLS accepted: previous session reused",
+            "Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+        self.path = path
+
+
+    async def prepare_client_cfgfile(
+        self, cfg: Config, ports: list, service: str
+    ) -> (pathlib.Path, pathlib.Path):
+        """Create a configuration file for a stunnel client."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    retry = yes
+
+    {service}
+    client = yes
+    exec = {cfg.pythondir}
+    execArgs = python3 {cfg.scriptdir}/reader.py {self.path}
+    connect = 127.0.0.1:{ports1}
+    cert = {cfg.certdir}/client_cert.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_client.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile, os.devnull
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    sslVersion = TLSv1.2
+    sessionCacheSize = 1
+    options = -NO_TICKET
+
+    {service}
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{port}
+    cert = {cfg.certdir}/server_cert.pem
+    verifyPeer = yes
+    CAfile = {cfg.certdir}/PeerCerts.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class ResumeTicketTLSv13(StunnelTest):
+    """Checking the stateless session ticket resumption (RFC 4507bis) with TLS 1.3.
+       We expect exactly 2 "TLS accepted: previous session reused" to be logged by the
+       server service, because client connected 3 times (1 new session, 2 reused sessions).
+       The following options are used to disable session cache:
+       - The "sessionCacheSize = 1" option sets the internal session cache size.
+       - "options = -NO_TICKET" (it is the default with OpenSSL 1.1.1 or later).
+       Stateless session ticket resumption also works with the FORK threading model.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger, path:pathlib.Path):
+        super().__init__(cfg, logger, path)
+        self.params.description = '142. Stateless session ticket resumption with TLSv1.3'
+        self.events.count = 2
+        self.events.skip = 
+            "Incorrect version of TLS protocol",
+            "Invalid protocol version"
+        
+        self.events.success = 
+            "TLS accepted: previous session reused"
+        
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            #"TLS accepted: previous session reused",
+            "Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+        self.path = path
+
+
+    async def prepare_client_cfgfile(
+        self, cfg: Config, ports: list, service: str
+    ) -> (pathlib.Path, pathlib.Path):
+        """Create a configuration file for a stunnel client."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    retry = yes
+
+    {service}
+    client = yes
+    exec = {cfg.pythondir}
+    execArgs = python3 {cfg.scriptdir}/reader.py {self.path}
+    connect = 127.0.0.1:{ports1}
+    cert = {cfg.certdir}/client_cert.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_client.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile, os.devnull
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    sslVersion = TLSv1.3
+    sessionCacheSize = 1
+    options = -NO_TICKET
+
+    {service}
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{port}
+    cert = {cfg.certdir}/server_cert.pem
+    verifyPeer = yes
+    CAfile = {cfg.certdir}/PeerCerts.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class StunnelClientServerTest(Plugin):
+    """Stunnel client-server tests
+       HTTP client --> stunnel client --> stunnel server --> HTTP server
+    """
+    # pylint: disable=too-few-public-methods
+
+    def __init__(self):
+        super().__init__()
+        self.description = 'Resume session'
+
+
+    async def perform_operation(self, cfg: Config, logger: logging.Logger) -> None:
+        """Run tests"""
+        path = os.path.join(cfg.tempd, 'unix.sock')
+        stunnel = ResumeTicketTLSv12(cfg, logger, path)
+        await stunnel.test_stunnel(cfg)
+
+        stunnel = ResumeTicketTLSv13(cfg, logger, path)
+        await stunnel.test_stunnel(cfg)

_service:tar_scm:stunnel-5.69.tar.gz/tests/plugins/p15_resume_secret.py Added

@@ -0,0 +1,142 @@
+"""stunnel client-server tests"""
+
+import logging
+import os
+import pathlib
+from plugin_collection import Plugin, ERR_CONN_RESET
+from maketest import (
+    Config,
+    ServerReopen
+)
+
+
+class StunnelTest(ServerReopen):
+    """Base class for stunnel client-server tests."""
+
+    def __init__(self, cfg: Config, logger: logging.Logger, path:pathlib.Path):
+        super().__init__(cfg, logger, path)
+        self.params.services = 'server', 'client'
+        self.params.conn_num = 4
+        self.events.count = 1
+
+
+class ResumeTicketSecret(StunnelTest):
+    """Checking if the reloaded server resume the session with secret keys for
+       the session ticket processing.
+       We expect exactly 2 "TLS accepted: previous session reused" to be logged by the
+       server service, because the server holds keys for the session ticket processing.
+       The ticket session resumption also works for the FORK model.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger, path:pathlib.Path):
+        super().__init__(cfg, logger, path)
+        self.params.description = '151. Session resumption with secret keys'
+        self.events.count = 3
+        self.events.success = 
+            "TLS accepted: previous session reused"
+        
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            #"TLS accepted: previous session reused",
+            "Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+        self.path = path
+
+
+    async def prepare_client_cfgfile(
+        self, cfg: Config, ports: list, service: str
+    ) -> (pathlib.Path, pathlib.Path):
+        """Create a configuration file for a stunnel client."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    retry = yes
+
+    {service}
+    client = yes
+    exec = {cfg.pythondir}
+    execArgs = python3 {cfg.scriptdir}/reader.py {self.path}
+    connect = 127.0.0.1:{ports1}
+    cert = {cfg.certdir}/client_cert.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_client.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile, os.devnull
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    options = -NO_TICKET
+    ticketKeySecret = 6c:42:72:46:57:23:3a:3d:4b:54:2d:7b:55:4b:6e:8f:32:5c:21:6a:2e:6e:47:31:57:20:2f:75:26:7b:4d:25
+    ticketMacSecret = 3f:3c:77:53:32:48:79:76:75:7a:50:33:70:65:47:27:32:79:73:7e:73:2c:21:6c:3a:6f:30:28:4c:5c:27:1f
+
+    {service}
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{port}
+    cert = {cfg.certdir}/server_cert.pem
+    verifyPeer = yes
+    CAfile = {cfg.certdir}/PeerCerts.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+    async def prepare_additional_server_cfgfile(
+        self, cfg: Config, ports: list, lport: int
+    ) -> pathlib.Path:
+        """Create a configuration file for new stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    ticketKeySecret = 6c:42:72:46:57:23:3a:3d:4b:54:2d:7b:55:4b:6e:8f:32:5c:21:6a:2e:6e:47:31:57:20:2f:75:26:7b:4d:25
+    ticketMacSecret = 3f:3c:77:53:32:48:79:76:75:7a:50:33:70:65:47:27:32:79:73:7e:73:2c:21:6c:3a:6f:30:28:4c:5c:27:1f
+
+    server
+    accept = 127.0.0.1:{ports1}
+    connect = 127.0.0.1:{lport}
+    cert = {cfg.certdir}/server_cert.pem
+    verifyPeer = yes
+    CAfile = {cfg.certdir}/PeerCerts.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class StunnelClientServerTest(Plugin):
+    """Stunnel client-server tests
+       HTTP client --> stunnel client --> stunnel server --> HTTP server
+    """
+    # pylint: disable=too-few-public-methods
+
+    def __init__(self):
+        super().__init__()
+        self.description = 'Resume session'
+
+
+    async def perform_operation(self, cfg: Config, logger: logging.Logger) -> None:
+        """Run tests"""
+        path = os.path.join(cfg.tempd, 'unix.sock')
+        stunnel = ResumeTicketSecret(cfg, logger, path)
+        await stunnel.test_stunnel(cfg)

_service:tar_scm:stunnel-5.69.tar.gz/tests/plugins/p16_redirect.py Added

@@ -0,0 +1,348 @@
+"""stunnel server tests"""
+
+import logging
+import pathlib
+from plugin_collection import Plugin, ERR_CONN_RESET
+from maketest import (
+    Config,
+    StunnelAcceptConnect
+)
+
+class StunnelTest(StunnelAcceptConnect):
+    """Base class for stunnel server tests."""
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.ssl_client = True
+        self.params.services = 'server'
+
+
+class RedirectWrongPeerCert(StunnelTest):
+    """Redirect stunnel server test.
+       The client presents the *wrong* certificate so the connection is redirected.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '161. Redirect connection (wrong peer certificate)'
+        self.params.context = 'load_wrong_cert'
+        self.events.count = 1
+        self.events.success = 
+            "Redirecting connection"
+        
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            #"Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    accept = 127.0.0.1:0
+    exec = {cfg.pythondir}
+    execArgs = python3 {cfg.scriptdir}/error.py
+    redirect = 127.0.0.1:{port}
+    cert = {cfg.certdir}/server_cert.pem
+    verifyPeer = yes
+    CAfile = {cfg.certdir}/PeerCerts.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class RedirectNoPeerCert(StunnelTest):
+    """Redirect stunnel server test.
+       The client does not present any certificate so the connection is redirected.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '162. Redirect connection (no peer certificate)'
+        self.events.count = 1
+        self.events.success = 
+            "Redirecting connection"
+        
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            #"Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    accept = 127.0.0.1:0
+    exec = {cfg.pythondir}
+    execArgs = python3 {cfg.scriptdir}/error.py
+    redirect = 127.0.0.1:{port}
+    cert = {cfg.certdir}/server_cert.pem
+    verifyPeer = yes
+    CAfile = {cfg.certdir}/PeerCerts.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class NoRedirectCorrectPeerCert(StunnelTest):
+    """No redirect stunnel server test.
+       The client presents the *correct* certificate and the connection is not redirected.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '163. Not redirected connection (valid peer certificate)'
+        self.params.context = 'load_correct_cert'
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            "Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{port}
+    redirect = 127.0.0.1:0
+    cert = {cfg.certdir}/server_cert.pem
+    verifyPeer = yes
+    CAfile = {cfg.certdir}/PeerCerts.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class RedirectWrongChainCert(StunnelTest):
+    """Redirect stunnel server test.
+       The client does not present any certificate so the connection is redirected.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '164. Redirect connection (wrong chain)'
+        self.events.count = 1
+        self.events.success = 
+            "Redirecting connection"
+        
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            #"Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    accept = 127.0.0.1:0
+    exec = {cfg.pythondir}
+    execArgs = python3 {cfg.scriptdir}/error.py
+    redirect = 127.0.0.1:{port}
+    cert = {cfg.certdir}/server_cert.pem
+    verifyChain = yes
+    CAfile = {cfg.certdir}/CACert.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class RedirectNoChainCert(StunnelTest):
+    """No redirect stunnel server test.
+       The client does not present any certificate so the connection is redirected.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '165. Redirect connection (no chain)'
+        self.events.count = 1
+        self.events.success = 
+            "Redirecting connection"
+        
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            #"Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    accept = 127.0.0.1:0
+    exec = {cfg.pythondir}
+    execArgs = python3 {cfg.scriptdir}/error.py
+    redirect = 127.0.0.1:{port}
+    cert = {cfg.certdir}/server_cert.pem
+    verifyChain = yes
+    CAfile = {cfg.certdir}/CACert.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class NoRedirectCorrectChainCert(StunnelTest):
+    """No redirect stunnel server test.
+       The client presents the *correct* certificate and the connection is not redirected.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '166. Not redirected connection (valid chain)'
+        self.params.context = 'load_correct_cert'
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            "Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{port}
+    redirect = 127.0.0.1:0
+    cert = {cfg.certdir}/server_cert.pem
+    verifyChain = yes
+    CAfile = {cfg.certdir}/CACert.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class RedirectStunnelTest(Plugin):
+    """Stunnel redirect server tests
+       HTTPS client --> stunnel server --> HTTP server or "Wrong_connection!"
+    """
+    # pylint: disable=too-few-public-methods
+
+    def __init__(self):
+        super().__init__()
+        self.description = 'Redirect connection'
+
+
+    async def perform_operation(self, cfg: Config, logger: logging.Logger) -> None:
+        """Run tests"""
+        stunnel = RedirectWrongPeerCert(cfg, logger)
+        await stunnel.test_stunnel(cfg)
+
+        stunnel = RedirectNoPeerCert(cfg, logger)
+        await stunnel.test_stunnel(cfg)
+
+        stunnel = NoRedirectCorrectPeerCert(cfg, logger)
+        await stunnel.test_stunnel(cfg)
+
+        stunnel = RedirectWrongChainCert(cfg, logger)
+        await stunnel.test_stunnel(cfg)
+
+        stunnel = RedirectNoChainCert(cfg, logger)
+        await stunnel.test_stunnel(cfg)
+
+        stunnel = NoRedirectCorrectChainCert(cfg, logger)
+        await stunnel.test_stunnel(cfg)

_service:tar_scm:stunnel-5.69.tar.gz/tests/plugins/p17_redirect_proxy.py Added

@@ -0,0 +1,197 @@
+"""stunnel server tests"""
+
+import logging
+import pathlib
+from plugin_collection import Plugin, ERR_CONN_RESET
+from maketest import (
+    Config,
+    StunnelAcceptConnect
+)
+
+class StunnelTest(StunnelAcceptConnect):
+    """Base class for stunnel client-server tests."""
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.ssl_client = True
+        self.params.services = 'server'
+
+
+class RedirectProxyWrongPeerCert(StunnelTest):
+    """Redirect stunnel server test.
+       The client presents the *wrong* certificate so the connection is redirected.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '171. Redirect proxy connection (wrong peer certificate)'
+        self.params.context = 'load_wrong_cert'
+        self.events.count = 1
+        self.events.success = 
+            "Redirecting connection"
+        
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            #"Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    protocol = proxy
+
+    {service}
+    accept = 127.0.0.1:0
+    exec = {cfg.pythondir}
+    execArgs = python3 {cfg.scriptdir}/error.py
+    redirect = 127.0.0.1:{port}
+    cert = {cfg.certdir}/server_cert.pem
+    verifyPeer = yes
+    CAfile = {cfg.certdir}/PeerCerts.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class RedirectProxyNoPeerCert(StunnelTest):
+    """Redirect stunnel server test.
+       The client does not present any certificate so the connection is redirected.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '172. Redirect proxy connection (no peer certificate)'
+        self.events.count = 1
+        self.events.success = 
+            "Redirecting connection"
+        
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            #"Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    protocol = proxy
+
+    {service}
+    accept = 127.0.0.1:0
+    exec = {cfg.pythondir}
+    execArgs = python3 {cfg.scriptdir}/error.py
+    redirect = 127.0.0.1:{port}
+    cert = {cfg.certdir}/server_cert.pem
+    verifyPeer = yes
+    CAfile = {cfg.certdir}/PeerCerts.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class NoRedirectProxyCorrectPeerCert(StunnelTest):
+    """No redirect stunnel server test.
+       The client presents the *correct* certificate and the connection is not redirected.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '173. Not redirected proxy connection (valid peer certificate)'
+        self.params.context = 'load_correct_cert'
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            "Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    protocol = proxy
+
+    {service}
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{port}
+    redirect = 127.0.0.1:0
+    cert = {cfg.certdir}/server_cert.pem
+    verifyPeer = yes
+    CAfile = {cfg.certdir}/PeerCerts.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class RedirectStunnelTest(Plugin):
+    """Stunnel redirect server tests
+       HTTPS client --> stunnel server --> HTTP server or "Wrong_connection!"
+    """
+    # pylint: disable=too-few-public-methods
+
+    def __init__(self):
+        super().__init__()
+        self.description = 'Redirect PROXY connection'
+
+
+    async def perform_operation(self, cfg: Config, logger: logging.Logger) -> None:
+        """Run tests"""
+
+        stunnel = RedirectProxyWrongPeerCert(cfg, logger)
+        await stunnel.test_stunnel(cfg)
+
+        stunnel = RedirectProxyNoPeerCert(cfg, logger)
+        await stunnel.test_stunnel(cfg)
+
+        stunnel = NoRedirectProxyCorrectPeerCert(cfg, logger)
+        await stunnel.test_stunnel(cfg)

_service:tar_scm:stunnel-5.69.tar.gz/tests/plugins/p18_redirect_resume.py Added

@@ -0,0 +1,267 @@
+"""stunnel client-server tests"""
+
+import logging
+import os
+import pathlib
+from plugin_collection import Plugin, ERR_CONN_RESET
+from maketest import (
+    Config,
+    StunnelAcceptConnect
+)
+
+class StunnelTest(StunnelAcceptConnect):
+    """Base class for stunnel client-server tests."""
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.services = 'server', 'client'
+        self.params.conn_num = 3
+        self.events.count = 2
+        self.events.skip = 
+            "FORK"
+        
+
+
+class ResumeRedirectWrongCert(StunnelTest):
+    """Checking if redirect TLS client connections works properly when the session is resumed.
+       Redirect TLS client connections on certificate-based authentication failures.
+       Exactly 2 "TLS accepted: previous session reused" logs for server services are expected,
+       because the client presents the wrong certificate.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '181. Session resumption and redirect (wrong certificate)'
+        self.events.count = 2
+        self.events.success = 
+            "TLS accepted: previous session reused"
+        
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            #"TLS accepted: previous session reused",
+            #"Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_client_cfgfile(
+        self, cfg: Config, ports: list, service: str
+    ) -> (pathlib.Path, pathlib.Path):
+        """Create a configuration file for a stunnel client."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    client = yes
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{ports1}
+    ;cert = {cfg.certdir}/client_cert.pem
+    ;wrong certificate
+    cert = {cfg.certdir}/stunnel.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_client.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile, os.devnull
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    accept = 127.0.0.1:0
+    exec = {cfg.pythondir}
+    execArgs = python3 {cfg.scriptdir}/error.py
+    redirect = 127.0.0.1:{port}
+    cert = {cfg.certdir}/server_cert.pem
+    verifyPeer = yes
+    CAfile = {cfg.certdir}/PeerCerts.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class ResumeRedirectNoCert(StunnelTest):
+    """Checking if redirect TLS client connections works properly when the session is resumed.
+       Redirect TLS client connections on certificate-based authentication failures.
+       Exactly 2 "TLS accepted: previous session reused" logs for server services are expected,
+       because the client does not present the any certificate.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '182. Session resumption and redirect (no certificate)'
+        self.events.count = 2
+        self.events.success = 
+            "TLS accepted: previous session reused"
+        
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            #"TLS accepted: previous session reused",
+            #"Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_client_cfgfile(
+        self, cfg: Config, ports: list, service: str
+    ) -> (pathlib.Path, pathlib.Path):
+        """Create a configuration file for a stunnel client."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    client = yes
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{ports1}
+    ;no certificate
+    """
+        cfgfile = cfg.tempd / "stunnel_client.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile, os.devnull
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    accept = 127.0.0.1:0
+    exec = {cfg.pythondir}
+    execArgs = python3 {cfg.scriptdir}/error.py
+    redirect = 127.0.0.1:{port}
+    cert = {cfg.certdir}/server_cert.pem
+    verifyPeer = yes
+    CAfile = {cfg.certdir}/PeerCerts.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class ResumeNoRedirectCorrectCert(StunnelTest):
+    """Checking if redirect TLS client connections works properly when the session is resumed.
+       Do not redirect TLS client connections on certificate-based authentication success.
+       Just 2 "TLS accepted: previous session reused" log for server service
+       is expected, because the client presents the *correct* certificate.
+       HTTP client --> stunnel client --> stunnel server --> HTTP server
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '183. Session resumption and no redirect (valid certificate)'
+        self.events.count = 2
+        self.events.success = 
+            "TLS accepted: previous session reused"
+        
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            #"TLS accepted: previous session reused",
+            "Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_client_cfgfile(
+        self, cfg: Config, ports: list, service: str
+    ) -> (pathlib.Path, pathlib.Path):
+        """Create a configuration file for a stunnel client."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    client = yes
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{ports1}
+    ;correct certificate
+    cert = {cfg.certdir}/client_cert.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_client.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile, os.devnull
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{port}
+    redirect = 127.0.0.1:0
+    cert = {cfg.certdir}/server_cert.pem
+    verifyPeer = yes
+    CAfile = {cfg.certdir}/PeerCerts.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class RedirectStunnelTest(Plugin):
+    """Stunnel redirect-client-server tests
+       HTTP client --> stunnel client --> stunnel server --> HTTP server or "Wrong_connection!"
+    """
+    # pylint: disable=too-few-public-methods
+
+    def __init__(self):
+        super().__init__()
+        self.description = 'Resume redirected connection'
+
+
+    async def perform_operation(self, cfg: Config, logger: logging.Logger) -> None:
+        """Run tests"""
+        stunnel = ResumeRedirectWrongCert(cfg, logger)
+        await stunnel.test_stunnel(cfg)
+
+        stunnel = ResumeRedirectNoCert(cfg, logger)
+        await stunnel.test_stunnel(cfg)
+
+        stunnel = ResumeNoRedirectCorrectCert(cfg, logger)
+        await stunnel.test_stunnel(cfg)

_service:tar_scm:stunnel-5.69.tar.gz/tests/plugins/p19_reload.py Added

@@ -0,0 +1,94 @@
+"""stunnel client tests"""
+
+import logging
+import pathlib
+from plugin_collection import Plugin, ERR_CONN_RESET
+from maketest import (
+    Config,
+    StunnelAcceptConnect
+)
+
+
+class StunnelTest(StunnelAcceptConnect):
+    """Base class for stunnel client tests."""
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.ssl_server = True
+        self.params.services = 'client'
+
+
+class ReloadTest(StunnelTest):
+    """ Checking if the stunnel works correctly after reloading the configuration.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '191. Reload configuration'
+        self.params.context = 'cert_required'
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            "Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_client_cfgfile(
+        self, cfg: Config, ports: list, service: str
+    ) -> (pathlib.Path, pathlib.Path):
+        """Create a configuration file for a stunnel client."""
+        contents = f"""
+    ;client doesn't present any certificate
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    client = yes
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{ports0}
+    """
+        reload_contents = f"""
+    ;client presents a certificate
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    client = yes
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{ports0}
+    cert = {cfg.certdir}/client_cert.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_client.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        reload_cfgfile = cfg.tempd / "reload_stunnel_client.conf"
+        reload_cfgfile.write_text(reload_contents, encoding="UTF-8")
+        return cfgfile, reload_cfgfile
+
+
+
+class StunnelClientTest(Plugin):
+    """Stunnel client tests
+       HTTP client --> stunnel client --> HTTPS server
+    """
+    # pylint: disable=too-few-public-methods
+
+    def __init__(self):
+        super().__init__()
+        self.description = 'Reload configuration'
+
+
+    async def perform_operation(self, cfg: Config, logger: logging.Logger) -> None:
+        """Run tests"""
+        stunnel = ReloadTest(cfg, logger)
+        await stunnel.test_stunnel(cfg)

_service:tar_scm:stunnel-5.69.tar.gz/tests/plugins/p20_failover.py Added

@@ -0,0 +1,187 @@
+"""stunnel client-server tests"""
+
+import logging
+import os
+import pathlib
+from plugin_collection import Plugin, ERR_CONN_RESET
+from maketest import (
+    Config,
+    StunnelAcceptConnect
+)
+
+
+class StunnelTest(StunnelAcceptConnect):
+    """Base class for stunnel client-server tests."""
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.services = 
+            'server1',
+            'server2',
+            'server3',
+            'client'
+        
+        self.params.conn_num = 3
+
+
+class FailoverRoundRobin(StunnelTest):
+    """Checking if the failover strategy  for multiple "connect" targets.
+       The round robin (rr) strategy ensures fair load distribution.
+       Exactly one connection with each service is expected,
+       so "TLS accepted: previous session reused" message shows an error.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '201. Failover round robin (rr) strategy'
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            "Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_client_cfgfile(
+        self, cfg: Config, ports: list, service: str
+    ) -> (pathlib.Path, pathlib.Path):
+        """Create a configuration file for a stunnel client."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    failover = rr
+
+    {service}
+    client = yes
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{ports1}
+    connect = 127.0.0.1:{ports2}
+    connect = 127.0.0.1:{ports3}
+    """
+        cfgfile = cfg.tempd / "stunnel_client.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile, os.devnull
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{port}
+    cert = {cfg.certdir}/server_cert.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class FailoverPriority(StunnelTest):
+    """Checking if the failover strategy  for multiple "connect" targets.
+       The priority (prio) strategy uses the order specified in the config file.
+       All connections to the server1 service are expected.
+       "TLS accepted: previous session reused" is not achievable with
+       the FORK threading model.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '202. Failover priority (prio) strategy'
+        self.events.count = 2
+        self.events.success = 
+            r"\server1\.*TLS accepted"
+        
+        self.events.failure = 
+            r"\server2\.*TLS accepted",
+            r"\server3\.*TLS accepted",
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            #"TLS accepted: previous session reused",
+            "Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_client_cfgfile(
+        self, cfg: Config, ports: list, service: str
+    ) -> (pathlib.Path, pathlib.Path):
+        """Create a configuration file for a stunnel client."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    failover = prio
+
+    {service}
+    client = yes
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{ports1}
+    connect = 127.0.0.1:{ports2}
+    connect = 127.0.0.1:{ports3}
+    """
+        cfgfile = cfg.tempd / "stunnel_client.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile, os.devnull
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{port}
+    cert = {cfg.certdir}/server_cert.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class StunnelClientServerTest(Plugin):
+    """Stunnel client-server tests
+       HTTP client --> stunnel client --> stunnel server --> HTTP server
+    """
+    # pylint: disable=too-few-public-methods
+
+    def __init__(self):
+        super().__init__()
+        self.description = 'Failover strategy'
+
+
+    async def perform_operation(self, cfg: Config, logger: logging.Logger) -> None:
+        """Run tests"""
+        stunnel = FailoverRoundRobin(cfg, logger)
+        await stunnel.test_stunnel(cfg)
+
+        stunnel = FailoverPriority(cfg, logger)
+        await stunnel.test_stunnel(cfg)

_service:tar_scm:stunnel-5.69.tar.gz/tests/plugins/p21_include.py Added

@@ -0,0 +1,113 @@
+"""stunnel client-server tests"""
+
+import logging
+import os
+import pathlib
+from plugin_collection import Plugin, ERR_CONN_RESET
+from maketest import (
+    Config,
+    StunnelAcceptConnect
+)
+
+
+class StunnelTest(StunnelAcceptConnect):
+    """Base class for stunnel client-server tests."""
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.services = 'server', 'client'
+
+
+class IncludedConfiguration(StunnelTest):
+    """Checking if stunnel works with the configuration placed in a few files.
+       All configuration file parts are located in the directory specified with include.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '211. Included configuration files'
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            "Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_client_cfgfile(
+        self, cfg: Config, ports: list, service: str
+    ) -> (pathlib.Path, pathlib.Path):
+        """Create a configuration file for a stunnel client."""
+
+        with open(f"{cfg.tempd}/conf.d/00-global.conf", "w") as conf:
+            conf.write(f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+    """
+            )
+        with open(f"{cfg.tempd}/conf.d/01-service.conf", "w") as conf:
+            conf.write(f"""
+    {service}
+    client = yes
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{ports1}
+    """)
+
+        contents = f"""
+    include = {cfg.tempd}/conf.d
+    """
+        cfgfile = cfg.tempd / "stunnel_client.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile, os.devnull
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        os.mkdir(f"{cfg.tempd}/conf.d")
+        with open(f"{cfg.tempd}/conf.d/00-global.conf", "w") as conf:
+            conf.write(f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+    """)
+        with open(f"{cfg.tempd}/conf.d/01-service.conf", "w") as conf:
+            conf.write(f"""
+    {service}
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{port}
+    cert = {cfg.certdir}/server_cert.pem
+    """)
+        contents = f"""
+    include = {cfg.tempd}/conf.d
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class StunnelClientServerTest(Plugin):
+    """Stunnel client-server tests
+       HTTP client --> stunnel client --> stunnel server --> HTTP server
+    """
+    # pylint: disable=too-few-public-methods
+
+    def __init__(self):
+        super().__init__()
+        self.description = 'Included configuration'
+
+
+    async def perform_operation(self, cfg: Config, logger: logging.Logger) -> None:
+        """Run tests"""
+        stunnel = IncludedConfiguration(cfg, logger)
+        await stunnel.test_stunnel(cfg)

_service:tar_scm:stunnel-5.69.tar.gz/tests/plugins/p22_inetd.py Added

@@ -0,0 +1,77 @@
+"""stunnel client tests"""
+
+import logging
+import os
+import pathlib
+from plugin_collection import Plugin, ERR_CONN_RESET
+from maketest import (
+    Config,
+    ClientInetd
+)
+
+
+class StunnelTest(ClientInetd):
+    """Base class for stunnel client tests."""
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.ssl_server = True
+        self.params.services = 'client'
+
+
+class InetdMode(StunnelTest):
+    """Checking client inetd mode."""
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '221. Client inetd mode'
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            "Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Client writer is closing",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_client_cfgfile(
+        self, cfg: Config, ports: list, service: str
+    ) -> (pathlib.Path, pathlib.Path):
+        """Create a configuration file for a stunnel client."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+    service = inetd
+    client = yes
+    connect = 127.0.0.1:{ports0}
+    """
+        cfgfile = cfg.tempd / "stunnel_client.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile, os.devnull
+
+
+
+class StunnelClientTest(Plugin):
+    """Stunnel client tests
+       HTTP client --> stunnel client --> HTTPS server
+    """
+    # pylint: disable=too-few-public-methods
+
+    def __init__(self):
+        super().__init__()
+        self.description = 'Internet service daemon'
+
+
+    async def perform_operation(self, cfg: Config, logger: logging.Logger) -> None:
+        """Run tests"""
+        stunnel = InetdMode(cfg, logger)
+        await stunnel.test_stunnel(cfg)

_service:tar_scm:stunnel-5.69.tar.gz/tests/plugins/p23_exec_conn.py Added

@@ -0,0 +1,83 @@
+"""stunnel client tests"""
+
+import logging
+import os
+import pathlib
+from plugin_collection import Plugin, ERR_CONN_RESET
+from maketest import (
+    Config,
+    ClientConnectExec
+)
+
+
+class StunnelTest(ClientConnectExec):
+    """Base class for stunnel client-server tests."""
+
+    def __init__(self, cfg: Config, logger: logging.Logger, path:pathlib.Path):
+        super().__init__(cfg, logger, path)
+        self.params.ssl_server = True
+        self.params.services = 'client'
+
+
+class ExecConnect(StunnelTest):
+    """Simple execute a local inetd-type program in the client service.
+       The execArgs option contains arguments for exec including the program name.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger, path:pathlib.Path):
+        super().__init__(cfg, logger, path)
+        self.params.description = '231. Test exec+connect service'
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            "Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+        self.path = path
+
+
+    async def prepare_client_cfgfile(
+        self, cfg: Config, ports: list, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel client."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    client = yes
+    exec = {cfg.pythondir}
+    execArgs = python3 {cfg.scriptdir}/reader.py {self.path}
+    connect = 127.0.0.1:{ports0}
+    cert = {cfg.certdir}/client_cert.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_client.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile, os.devnull
+
+
+class StunnelClientServerTest(Plugin):
+    """Stunnel client tests
+       HTTP client --> stunnel client --> HTTPS server
+    """
+    # pylint: disable=too-few-public-methods
+
+    def __init__(self):
+        super().__init__()
+        self.description = 'Execute a local inetd-type program'
+
+
+    async def perform_operation(self, cfg: Config, logger: logging.Logger) -> None:
+        """Run tests"""
+        path = os.path.join(cfg.tempd, 'unix.sock')
+        stunnel = ExecConnect(cfg, logger, path)
+        await stunnel.test_stunnel(cfg)

_service:tar_scm:stunnel-5.69.tar.gz/tests/plugins/p24_delay.py Added

@@ -0,0 +1,207 @@
+"""stunnel client-server tests"""
+
+import logging
+import os
+import pathlib
+from plugin_collection import Plugin, ERR_CONN_RESET
+from maketest import (
+    Config,
+    ClientConnectExec
+)
+
+
+class StunnelTest(ClientConnectExec):
+    """Base class for stunnel client-server tests."""
+
+    def __init__(self, cfg: Config, logger: logging.Logger, path:pathlib.Path):
+        super().__init__(cfg, logger, path)
+        self.params.services = 
+            'server1',
+            'server2',
+            'server3',
+            'client'
+        
+        self.params.conn_num = 3
+
+
+class RetryDelay(StunnelTest):
+    """Checking if the delay option works properly when the session is resumed.
+       This option delays DNS lookup for the connect option.
+       Delayed resolver inflicts failover = prio.
+       We expect exactly 2 "TLS accepted: previous session reused" to be
+       logged by the server service.
+       The resumption of the session does not work for the FORK model.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger, path:pathlib.Path):
+        super().__init__(cfg, logger, path)
+        self.params.description = '241. Resume session with delay option'
+        self.events.skip = 
+            "FORK"
+        
+        self.events.count = 2
+        self.events.success = 
+            r"\server1\.*TLS accepted: previous session reused"
+        
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            #"TLS accepted: previous session reused",
+            "Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+        self.path = path
+
+
+    async def prepare_client_cfgfile(
+        self, cfg: Config, ports: list, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel client."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    delay = yes
+    retry = yes
+
+    {service}
+    client = yes
+    exec = {cfg.pythondir}
+    execArgs = python3 {cfg.scriptdir}/reader.py {self.path}
+    connect = 127.0.0.1:{ports1}
+    connect = 127.0.0.1:{ports2}
+    connect = 127.0.0.1:{ports3}
+    cert = {cfg.certdir}/client_cert.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_client.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile, os.devnull
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{port}
+    cert = {cfg.certdir}/server_cert.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class RetryNoDelay(StunnelTest):
+    """Checking if disable delay option works properly when the session is resumed.
+       This option delays DNS lookup for the connect option.
+       We expect exactly 3 "TLS accepted: new session negotiated" to be
+       logged by all services, because failover = rr.
+       The resumption of the session does not work for the FORK model.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger, path:pathlib.Path):
+        super().__init__(cfg, logger, path)
+        self.params.description = '242. Resume session with disable delay option'
+        self.events.skip = 
+            "FORK"
+        
+        self.events.count = 2
+        self.events.success = 
+            "TLS accepted: new session negotiated"
+        
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            #"TLS accepted: previous session reused",
+            "Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            "Something went wrong",
+            "INTERNAL ERROR"
+        
+        self.path = path
+
+
+    async def prepare_client_cfgfile(
+        self, cfg: Config, ports: list, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel client."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    delay = no
+    failover = rr
+    retry = yes
+
+    {service}
+    client = yes
+    exec = {cfg.pythondir}
+    execArgs = python3 {cfg.scriptdir}/reader.py {self.path}
+    connect = 127.0.0.1:{ports1}
+    connect = 127.0.0.1:{ports2}
+    connect = 127.0.0.1:{ports3}
+    cert = {cfg.certdir}/client_cert.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_client.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile, os.devnull
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    accept = 127.0.0.1:0
+    connect = 127.0.0.1:{port}
+    cert = {cfg.certdir}/server_cert.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class StunnelClientServerTest(Plugin):
+    """Stunnel client-server tests
+       HTTP client --> stunnel client --> stunnel server --> HTTP server
+    """
+    # pylint: disable=too-few-public-methods
+
+    def __init__(self):
+        super().__init__()
+        self.description = 'Delay option vs resumed session'
+
+
+    async def perform_operation(self, cfg: Config, logger: logging.Logger) -> None:
+        """Run tests"""
+        path = os.path.join(cfg.tempd, 'unix.sock')
+        stunnel = RetryDelay(cfg, logger, path)
+        await stunnel.test_stunnel(cfg)
+
+        stunnel = RetryNoDelay(cfg, logger, path)
+        await stunnel.test_stunnel(cfg)

_service:tar_scm:stunnel-5.69.tar.gz/tests/plugins/p25_wrong_client.py Added

@@ -0,0 +1,85 @@
+"""stunnel client tests"""
+
+import logging
+import os
+import pathlib
+from plugin_collection import Plugin, ERR_CONN_RESET
+from maketest import (
+    Config,
+    ExpectedConfigurationFailure
+)
+
+
+class StunnelTest(ExpectedConfigurationFailure):
+    """Base class for stunnel client tests."""
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.ssl_server = True
+        self.params.services = 'client'
+
+
+class WrongClientTest(StunnelTest):
+    """Checking the wrong client configuration.
+       The failure is expected because there is no connect option in the client service.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '251. Wrong client configuration'
+        self.events.count = 1
+        self.events.success = 
+            "Each service must define two endpoints"
+        
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            "Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            #"Something went wrong: stunnel 'client' failed",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_client_cfgfile(
+        self, cfg: Config, ports: list, service: str
+    ) -> (pathlib.Path, pathlib.Path):
+        """Create a configuration file for a stunnel client."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    client = yes
+    accept = 127.0.0.1:0
+    ;*** error ***
+    ;connect = 127.0.0.1:{ports0}
+    cert = {cfg.certdir}/client_cert.pem
+    """
+        cfgfile = cfg.tempd / "stunnel_client.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile, os.devnull
+
+
+class StunnelClientTest(Plugin):
+    """Stunnel client tests:
+       HTTP client --> stunnel client --> HTTPS server
+    """
+    # pylint: disable=too-few-public-methods
+
+    def __init__(self):
+        super().__init__()
+        self.description = 'Wrong configuration'
+
+
+    async def perform_operation(self, cfg: Config, logger: logging.Logger) -> None:
+        """Run tests"""
+        stunnel = WrongClientTest(cfg, logger)
+        await stunnel.test_stunnel(cfg)

_service:tar_scm:stunnel-5.69.tar.gz/tests/plugins/p26_wrong_server.py Added

@@ -0,0 +1,83 @@
+"""stunnel server tests"""
+
+import logging
+import pathlib
+from plugin_collection import Plugin, ERR_CONN_RESET
+from maketest import (
+    Config,
+    ExpectedConfigurationFailure
+)
+
+
+class StunnelTest(ExpectedConfigurationFailure):
+    """Base class for stunnel server tests."""
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.ssl_client = True
+        self.params.services = 'server'
+
+
+class WrongServerTest(StunnelTest):
+    """Checking the wrong server configuration.
+       The failure is expected because there is no accept option in the server service.
+    """
+
+    def __init__(self, cfg: Config, logger: logging.Logger):
+        super().__init__(cfg, logger)
+        self.params.description = '261. Wrong server configuration'
+        self.events.count = 1
+        self.events.success = 
+            "Each service must define two endpoints"
+        
+        self.events.failure = 
+            "peer did not return a certificate",
+            "bad certificate",
+            "certificate verify failed",
+            "unsupported protocol",
+            "TLS accepted: previous session reused",
+            "Redirecting connection",
+            ERR_CONN_RESET,
+            "Connection lost",
+            "Client received unexpected message",
+            "Server received unexpected message",
+            #"Something went wrong: stunnel 'server' failed",
+            "INTERNAL ERROR"
+        
+
+
+    async def prepare_server_cfgfile(
+        self, cfg: Config, port: int, service: str
+    ) -> pathlib.Path:
+        """Create a configuration file for a stunnel server."""
+        contents = f"""
+    foreground = yes
+    debug = debug
+    syslog = no
+
+    {service}
+    accept = 127.0.0.1:0
+    ;*** error ***
+    ;connect = 127.0.0.1:{port}
+    cert = {cfg.certdir}/server_cert.p12
+    """
+        cfgfile = cfg.tempd / "stunnel_server.conf"
+        cfgfile.write_text(contents, encoding="UTF-8")
+        return cfgfile
+
+
+class StunnelServerTest(Plugin):
+    """Stunnel server tests:
+       HTTPS client --> stunnel server --> HTTP server
+    """
+    # pylint: disable=too-few-public-methods
+
+    def __init__(self):
+        super().__init__()
+        self.description = 'Wrong configuration'
+
+
+    async def perform_operation(self, cfg: Config, logger: logging.Logger) -> None:
+        """Run tests"""
+        stunnel = WrongServerTest(cfg, logger)
+        await stunnel.test_stunnel(cfg)

_service:tar_scm:stunnel-5.69.tar.gz/tests/reader.py Added

_service:tar_scm:stunnel-5.48.tar.gz/tools/Makefile.am -> _service:tar_scm:stunnel-5.69.tar.gz/tools/Makefile.am Changed

_service:tar_scm:stunnel-5.48.tar.gz/tools/Makefile.in -> _service:tar_scm:stunnel-5.69.tar.gz/tools/Makefile.in Changed

@@ -1,7 +1,7 @@
-# Makefile.in generated by automake 1.15 from Makefile.am.
+# Makefile.in generated by automake 1.16.5 from Makefile.am.
 # @configure_input@
 
-# Copyright (C) 1994-2014 Free Software Foundation, Inc.
+# Copyright (C) 1994-2021 Free Software Foundation, Inc.
 
 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -14,7 +14,7 @@
 
 @SET_MAKE@
 
-# by Michal Trojnara 1998-2018
+# by Michal Trojnara 1998-2023
 
 VPATH = @srcdir@
 am__is_gnu_make = { \
@@ -98,7 +98,8 @@
 	$(top_srcdir)/configure.ac
 am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
 	$(ACLOCAL_M4)
-DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
+DIST_COMMON = $(srcdir)/Makefile.am $(dist_bashcomp_DATA) \
+	$(am__DIST_COMMON)
 mkinstalldirs = $(install_sh) -d
 CONFIG_HEADER = $(top_builddir)/src/config.h
 CONFIG_CLEAN_FILES =
@@ -149,8 +150,9 @@
     || { echo " ( cd '$$dir' && rm -f" $$files ")"; \
          $(am__cd) "$$dir" && rm -f $$files; }; \
   }
-am__installdirs = "$(DESTDIR)$(confdir)" "$(DESTDIR)$(examplesdir)"
-DATA = $(conf_DATA) $(examples_DATA)
+am__installdirs = "$(DESTDIR)$(confdir)" "$(DESTDIR)$(bashcompdir)" \
+	"$(DESTDIR)$(examplesdir)"
+DATA = $(conf_DATA) $(dist_bashcomp_DATA) $(examples_DATA)
 am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
 am__DIST_COMMON = $(srcdir)/Makefile.in
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
@@ -167,6 +169,8 @@
 CFLAGS = @CFLAGS@
 CPP = @CPP@
 CPPFLAGS = @CPPFLAGS@
+CSCOPE = @CSCOPE@
+CTAGS = @CTAGS@
 CYGPATH_W = @CYGPATH_W@
 DEFAULT_GROUP = @DEFAULT_GROUP@
 DEFS = @DEFS@
@@ -178,6 +182,7 @@
 ECHO_N = @ECHO_N@
 ECHO_T = @ECHO_T@
 EGREP = @EGREP@
+ETAGS = @ETAGS@
 EXEEXT = @EXEEXT@
 FGREP = @FGREP@
 GREP = @GREP@
@@ -215,6 +220,7 @@
 PATH_SEPARATOR = @PATH_SEPARATOR@
 PTHREAD_CC = @PTHREAD_CC@
 PTHREAD_CFLAGS = @PTHREAD_CFLAGS@
+PTHREAD_CXX = @PTHREAD_CXX@
 PTHREAD_LIBS = @PTHREAD_LIBS@
 RANDOM_FILE = @RANDOM_FILE@
 RANLIB = @RANLIB@
@@ -237,6 +243,9 @@
 am__tar = @am__tar@
 am__untar = @am__untar@
 ax_pthread_config = @ax_pthread_config@
+
+# bash completion script
+bashcompdir = @bashcompdir@
 bindir = @bindir@
 build = @build@
 build_alias = @build_alias@
@@ -279,16 +288,17 @@
 top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
 EXTRA_DIST = ca.html ca.pl importCA.html importCA.sh script.sh \
-	makecert.sh openssl.cnf stunnel.nsi stunnel.license \
-	stunnel.conf stunnel.conf-sample.in stunnel.init.in \
-	stunnel.service.in stunnel.logrotate stunnel.rh.init \
-	stunnel.spec
+	makecert.sh openssl.cnf stunnel.nsi ReplaceInFile3.nsh \
+	stunnel.license stunnel.conf stunnel.conf-sample.in \
+	stunnel.init.in stunnel.service.in stunnel.logrotate \
+	stunnel.rh.init stunnel.spec ca-certs.pem
 confdir = $(sysconfdir)/stunnel
 conf_DATA = stunnel.conf-sample
 examplesdir = $(docdir)/examples
 examples_DATA = stunnel.init stunnel.service stunnel.logrotate \
 	stunnel.rh.init stunnel.spec ca.html ca.pl importCA.html \
 	importCA.sh script.sh
+dist_bashcomp_DATA = stunnel.bash
 CLEANFILES = stunnel.conf-sample stunnel.init stunnel.service
 edit = sed \
 	-e 's|@prefix@|$(prefix)|g' \
@@ -309,16 +319,16 @@
 	      exit 1;; \
 	  esac; \
 	done; \
-	echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu tools/Makefile'; \
+	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign tools/Makefile'; \
 	$(am__cd) $(top_srcdir) && \
-	  $(AUTOMAKE) --gnu tools/Makefile
+	  $(AUTOMAKE) --foreign tools/Makefile
 Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
 	@case '$?' in \
 	  *config.status*) \
 	    cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
 	  *) \
-	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
-	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
+	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__maybe_remake_depfiles)'; \
+	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__maybe_remake_depfiles);; \
 	esac;
 
 $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
@@ -356,6 +366,27 @@
 	@list='$(conf_DATA)'; test -n "$(confdir)" || list=; \
 	files=`for p in $$list; do echo $$p; done | sed -e 's|^.*/||'`; \
 	dir='$(DESTDIR)$(confdir)'; $(am__uninstall_files_from_dir)
+install-dist_bashcompDATA: $(dist_bashcomp_DATA)
+	@$(NORMAL_INSTALL)
+	@list='$(dist_bashcomp_DATA)'; test -n "$(bashcompdir)" || list=; \
+	if test -n "$$list"; then \
+	  echo " $(MKDIR_P) '$(DESTDIR)$(bashcompdir)'"; \
+	  $(MKDIR_P) "$(DESTDIR)$(bashcompdir)" || exit 1; \
+	fi; \
+	for p in $$list; do \
+	  if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \
+	  echo "$$d$$p"; \
+	done | $(am__base_list) | \
+	while read files; do \
+	  echo " $(INSTALL_DATA) $$files '$(DESTDIR)$(bashcompdir)'"; \
+	  $(INSTALL_DATA) $$files "$(DESTDIR)$(bashcompdir)" || exit $$?; \
+	done
+
+uninstall-dist_bashcompDATA:
+	@$(NORMAL_UNINSTALL)
+	@list='$(dist_bashcomp_DATA)'; test -n "$(bashcompdir)" || list=; \
+	files=`for p in $$list; do echo $$p; done | sed -e 's|^.*/||'`; \
+	dir='$(DESTDIR)$(bashcompdir)'; $(am__uninstall_files_from_dir)
 install-examplesDATA: $(examples_DATA)
 	@$(NORMAL_INSTALL)
 	@list='$(examples_DATA)'; test -n "$(examplesdir)" || list=; \
@@ -383,8 +414,10 @@
 
 cscope cscopelist:
 
+distdir: $(BUILT_SOURCES)
+	$(MAKE) $(AM_MAKEFLAGS) distdir-am
 
-distdir: $(DISTFILES)
+distdir-am: $(DISTFILES)
 	@srcdirstrip=`echo "$(srcdir)" | sed 's/.^$$\\*/\\\\&/g'`; \
 	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/.^$$\\*/\\\\&/g'`; \
 	list='$(DISTFILES)'; \
@@ -418,7 +451,7 @@
 check: check-am
 all-am: Makefile $(DATA)
 installdirs:
-	for dir in "$(DESTDIR)$(confdir)" "$(DESTDIR)$(examplesdir)"; do \
+	for dir in "$(DESTDIR)$(confdir)" "$(DESTDIR)$(bashcompdir)" "$(DESTDIR)$(examplesdir)"; do \
 	  test -z "$$dir" || $(MKDIR_P) "$$dir"; \
 	done
 install: install-am
@@ -473,7 +506,7 @@
 info-am:
 
 install-data-am: install-confDATA install-data-local \
-	install-examplesDATA
+	install-dist_bashcompDATA install-examplesDATA
 
 install-dvi: install-dvi-am
 
@@ -517,7 +550,8 @@
 
 ps-am:
 
-uninstall-am: uninstall-confDATA uninstall-examplesDATA
+uninstall-am: uninstall-confDATA uninstall-dist_bashcompDATA \
+	uninstall-examplesDATA
 
 .MAKE: install-am install-strip
 
@@ -525,14 +559,15 @@
 	cscopelist-am ctags-am distclean distclean-generic \
 	distclean-libtool distdir dvi dvi-am html html-am info info-am \
 	install install-am install-confDATA install-data \
-	install-data-am install-data-local install-dvi install-dvi-am \
-	install-examplesDATA install-exec install-exec-am install-html \
-	install-html-am install-info install-info-am install-man \
-	install-pdf install-pdf-am install-ps install-ps-am \
-	install-strip installcheck installcheck-am installdirs \
-	maintainer-clean maintainer-clean-generic mostlyclean \
-	mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
-	tags-am uninstall uninstall-am uninstall-confDATA \
+	install-data-am install-data-local install-dist_bashcompDATA \
+	install-dvi install-dvi-am install-examplesDATA install-exec \
+	install-exec-am install-html install-html-am install-info \
+	install-info-am install-man install-pdf install-pdf-am \
+	install-ps install-ps-am install-strip installcheck \
+	installcheck-am installdirs maintainer-clean \
+	maintainer-clean-generic mostlyclean mostlyclean-generic \
+	mostlyclean-libtool pdf pdf-am ps ps-am tags-am uninstall \
+	uninstall-am uninstall-confDATA uninstall-dist_bashcompDATA \
 	uninstall-examplesDATA
 
 .PRECIOUS: Makefile

_service:tar_scm:stunnel-5.69.tar.gz/tools/ReplaceInFile3.nsh Added

@@ -0,0 +1,154 @@
+/*
+First occurrence to be replaced: FST_OCC.
+   FST_OCC = all, renders the same as FST_OCC = 1.
+   if FST_OCC greater than the number of occurences in the file: no alteration of the file,
+   FST_OCC negative or 0 will leave the file content unchanged no matter the NR_OCC value.
+Nr max of occurrences replaced onwards: NR_OCC,
+   if NR_OCC = all --> replacement as long as a string to be replaced is found,
+   if NR_OCC = stritly positive integer, replaces up to NR_OCC occurrences provided they exist,
+   NR_OCC negative or 0 yields the same as all.
+
+Order to run down and search the file: from left to right and top down.
+REPLACEMENT_STR, OLD_STR, read line should be less than 1024 characters long.
+For NSIS Unicode, FILE_TO_MODIFIED must be utf-8 encoded.
+*/
+
+Var /Global OLD_STR
+Var /Global FST_OCC
+Var /Global NR_OCC
+Var /Global REPLACEMENT_STR
+Var /Global FILE_TO_MODIFIED
+
+!macro ReplaceInFile OLD_STR FST_OCC NR_OCC REPLACEMENT_STR FILE_TO_MODIFIED
+
+        Push "${OLD_STR}" ;text to be replaced
+	Push "${REPLACEMENT_STR}" ;replace with
+	Push "${FST_OCC}" ; starts replacing onwards FST_OCC occurrences
+	Push "${NR_OCC}" ; replaces NR_OCC occurrences in all
+	Push "${FILE_TO_MODIFIED}" ; file to replace in
+	Call AdvReplaceInFile
+
+!macroend
+
+
+Function AdvReplaceInFile
+Exch $0 ;FILE_TO_MODIFIED file to replace in
+Exch
+Exch $1 ;the NR_OCC of OLD_STR occurrences to be replaced.
+Exch
+Exch 2
+Exch $2 ;FST_OCC: the first occurrence to be replaced and onwards
+Exch 2
+Exch 3
+Exch $3 ;REPLACEMENT_STR string to replace with
+Exch 3
+Exch 4
+Exch $4 ;OLD_STR to be replaced
+Exch 4
+Push $5 ;incrementing counter
+Push $6 ;a chunk of read line
+Push $7 ;the read line altered or not
+Push $8 ;left string
+Push $9 ;right string or forster read line
+Push $R0 ;temp file handle
+Push $R1 ;FILE_TO_MODIFIED file handle
+Push $R2 ;a line read
+Push $R3 ;the length of OLD_STR
+Push $R4 ;counts reaching of FST_OCC
+Push $R5 ;counts reaching of NR_OCC
+Push $R6 ;temp file name
+
+
+  GetTempFileName $R6
+
+  FileOpen $R1 $0 r 			;FILE_TO_MODIFIED file to search in
+  FileOpen $R0 $R6 w                    ;temp file
+   StrLen $R3 $4			;the length of OLD_STR
+   StrCpy $R4 0				;counter initialization
+   StrCpy $R5 -1			;counter initialization
+
+loop_read:
+ ClearErrors
+ FileRead $R1 $R2 			;reading line
+ IfErrors exit				;when end of file has been reached
+
+   StrCpy $5 -1  			;cursor, start of read line chunk
+   StrLen $7 $R2 			;read line length
+   IntOp $5 $5 - $7			;cursor initialization
+   StrCpy $7 $R2			;$7 contains read line
+
+loop_filter:
+   IntOp $5 $5 + 1 			;cursor shifting
+   StrCmp $5 0 file_write		;end of line has been reached
+   StrCpy $6 $7 $R3 $5 			;a chunk of read line of length OLD_STR
+   StrCmp $6 $4 0 loop_filter		;continues to search OLD_STR if no match
+
+StrCpy $8 $7 $5 			;left part
+IntOp $6 $5 + $R3
+IntCmp $6 0 yes no			;left part + OLD_STR == full line read ?
+yes:
+StrCpy $9 ""
+Goto done
+no:
+StrCpy $9 $7 "" $6 			;right part
+done:
+StrCpy $9 $8$3$9 			;replacing OLD_STR by REPLACEMENT_STR in forster read line
+
+IntOp $R4 $R4 + 1			;counter incrementation
+;MessageBox MB_OK|MB_ICONINFORMATION \
+;"count R4 = $R4, fst_occ = $2"
+StrCmp $2 all follow_up			;exchange ok, then goes to search the next OLD_STR
+IntCmp $R4 $2 follow_up			;no exchange until FST_OCC has been reached,
+Goto loop_filter			;and then searching for the next OLD_STR
+
+follow_up:
+IntOp $R4 $R4 - 1			;now counter is to be stuck to FST_OCC
+
+IntOp $R5 $R5 + 1			;counter incrementation
+;MessageBox MB_OK|MB_ICONINFORMATION \
+;"count R5 = $R5, nbr_occ = $1"
+StrCmp $1 all exchange_ok 		;goes to exchange OLD_STR with REPLACEMENT_STR
+IntCmp $R5 $1 finalize			;proceeding exchange until NR_OCC has been reached
+
+exchange_ok:
+IntOp $5 $5 + $R3 			;updating cursor
+StrCpy $7 $9				;updating read line with forster read line
+Goto loop_filter			;goes searching the same read line
+
+finalize:
+IntOp $R5 $R5 - 1			;now counter is to be stuck to NR_OCC
+
+file_write:
+ FileWrite $R0 $7 			;writes altered or unaltered line
+Goto loop_read				;reads the next line
+
+exit:
+  FileClose $R0
+  FileClose $R1
+
+   ;SetDetailsPrint none
+  Delete $0
+  Rename $R6 $0				;superseding FILE_TO_MODIFIED file with
+					;temp file built with REPLACEMENT_STR
+  ;Delete $R6
+   ;SetDetailsPrint lastused
+
+Pop $R6
+Pop $R5
+Pop $R4
+Pop $R3
+Pop $R2
+Pop $R1
+Pop $R0
+Pop $9
+Pop $8
+Pop $7
+Pop $6
+Pop $5
+;These values are stored in the stack in the reverse order they were pushed
+Pop $0
+Pop $1
+Pop $2
+Pop $3
+Pop $4
+FunctionEnd

_service:tar_scm:stunnel-5.69.tar.gz/tools/ca-certs.pem Added

@@ -0,0 +1,3517 @@
+-----BEGIN CERTIFICATE-----
+MIIGSzCCBDOgAwIBAgIRANm1Q3+vqTkPAAAAAFVlrVgwDQYJKoZIhvcNAQELBQAw
+gb4xCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1FbnRydXN0LCBJbmMuMSgwJgYDVQQL
+Ex9TZWUgd3d3LmVudHJ1c3QubmV0L2xlZ2FsLXRlcm1zMTkwNwYDVQQLEzAoYykg
+MjAxNSBFbnRydXN0LCBJbmMuIC0gZm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxMjAw
+BgNVBAMTKUVudHJ1c3QgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEc0
+MB4XDTE1MDUyNzExMTExNloXDTM3MTIyNzExNDExNlowgb4xCzAJBgNVBAYTAlVT
+MRYwFAYDVQQKEw1FbnRydXN0LCBJbmMuMSgwJgYDVQQLEx9TZWUgd3d3LmVudHJ1
+c3QubmV0L2xlZ2FsLXRlcm1zMTkwNwYDVQQLEzAoYykgMjAxNSBFbnRydXN0LCBJ
+bmMuIC0gZm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxMjAwBgNVBAMTKUVudHJ1c3Qg
+Um9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEc0MIICIjANBgkqhkiG9w0B
+AQEFAAOCAg8AMIICCgKCAgEAsewsQu7i0TD/pZJH4i3DumSXbcr3DbVZwbPLqGgZ
+2K+EbTBwXX7zLtJTmeH+H17ZSK9dE43b/2MzTdMAArzE+NEGCJR5WIoV3imz/f3E
+T+iq4qA7ec2/a0My3dl0ELn39GjUu9CH1apLiipvKgS1sqbHoHrmSKvS0VnM1n4j
+5pds8ELl3FFLFUHtSUrJ3hCX1nbB76W1NhSXNdh4IjVS70O92yfbYVaCNNzLiGAM
+C1rlLAHGVK/XqsEQe9IFWrhAnoanw5CGAlZSCXqc0ieCU0plUmr1POeo8pyvi73T
+DtTUXm6Hnmo9RR3RXRv06QqsYJn7ibT/mCzPfB3pAqoEmh643IhuJbNsZvc8kPNX
+wbMv9W3y+8qh+CmdRouzavbmZwe+LGcKKh9asj5XxNMhIWNlUpEbsZmOeX7m640A
+2Vqq6nPopIICR5b+W45UYaPrL0swsIsjdXJ8ITzI9vF01Bx7owVV7rtNOzK+mndm
+nqxpkCIHH2E6lr7lmk/MBTwoWdPBDFSoWWG9yHJM6Nyfh3+9nEg2XpWjDrk4JFX8
+dWbrAuMINClKxuMrLzOg2qOGpRKX/YAr2hRC45K9PvJdXmd0LhyIRyk0X+IyqJwl
+N4y6mACXi0mWHv0liqzc2thddG5msP9E36EYxr5ILzeUePiVSj9/E15dWf10hkNj
+c0kCAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYD
+VR0OBBYEFJ84xFYjwznooHFs6FRM5Og6sb9nMA0GCSqGSIb3DQEBCwUAA4ICAQAS
+5UKme4sPDORGpbZgQIeMJX6tuGguW8ZAdjwD+MlZ9POrYs4QjbRaZIxowLByQzTS
+Gwv2LFPSypBLhmb8qoMi9IsabyZIrHZ3CL/FmFz0Jomee8O5ZDIBf9PD3Vht7LGr
+hFV0d4QEJ1JrhkzO3bll/9bGXp+aEJlLdWr+aumXIOTkdnrG0CSqkM0gkLpHZPt/
+B7NTeLUKYvJzQ85BK4FqLoUWlFPUa19yIqtRLULVAJyZv967lDtX/Zr1hstWO1uI
+AeV8KEsD+UmDfLJ/fOPtjqF/YFOOVZ1QNBIPt5d7bIdKROf1beyAN/BYGW5KaHbw
+H5Lk6rWS02FREAutp9lfx1/cH6NcjKF+m7ee01ZvZl4HliDtC3T7Zk6LERXpgUl+
+b7DUUH8i119lAg2m9IUe2K4GS0qn0jFmwvjO5QimpAKWRGhXxNUzzxkvFMSUHHuk
+2fCfDrGA4tGeEWSpiBE6doLlYsKA2KSD7ZPvfC+QsDJMlhVoSFLUmQjAJOgc47Ol
+IQ6SwJAfzyBfyjs4x7dtOvPmRLgOMWuIjnDrnBdSqEGULoe256YSxXXfW8AKbnuk
+5F6G+TaU33fD6Q3AOfF5u0aOq0NZJ7cguyPpVkAh7DE9ZapD8j3fcEThuk0mEDuY
+n/PIjhs4ViFqUZPTkcpG2om3PVODLAgfi49T3f+sHw==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDlDCCAnygAwIBAgIKMfXkYgxsWO3W2DANBgkqhkiG9w0BAQsFADBnMQswCQYD
+VQQGEwJJTjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBU
+ZWNobm9sb2dpZXMgTGltaXRlZDEcMBoGA1UEAxMTZW1TaWduIFJvb3QgQ0EgLSBH
+MTAeFw0xODAyMTgxODMwMDBaFw00MzAyMTgxODMwMDBaMGcxCzAJBgNVBAYTAklO
+MRMwEQYDVQQLEwplbVNpZ24gUEtJMSUwIwYDVQQKExxlTXVkaHJhIFRlY2hub2xv
+Z2llcyBMaW1pdGVkMRwwGgYDVQQDExNlbVNpZ24gUm9vdCBDQSAtIEcxMIIBIjAN
+BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAk0u76WaK7p1b1TST0Bsew+eeuGQz
+f2N4aLTNLnF115sgxk0pvLZoYIr3IZpWNVrzdr3YzZr/k1ZLpVkGoZM0Kd0WNHVO
+8oG0x5ZOrRkVUkr+PHB1cM2vK6sVmjM8qrOLqs1D/fXqcP/tzxE7lM5OMhbTI0Aq
+d7OvPAEsbO2ZLIvZTmmYsvePQbAyeGHWDV/D+qJAkh1cF+ZwPjXnorfCYuKrpDhM
+tTk1b+oDafo6VGiFbdbyL0NVHpENDtjVaqSW0RM8LHhQ6DqS0hdW5TUaQBw+jSzt
+Od9C4INBdN+jzcKGYEho42kLVACL5HZpIQ15TjQIXhTCzLG3rdd8cIrHhQIDAQAB
+o0IwQDAdBgNVHQ4EFgQU++8Nhp6w492pufEhF38+/PB3KxowDgYDVR0PAQH/BAQD
+AgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAFn/8oz1h31x
+PaOfG1vR2vjTnGs2vZupYeveFix0PZ7mddrXuqe8QhfnPZHr5X3dPpzxz5KsbEjM
+wiI/aTvFthUvozXGaCocV685743QNcMYDHsAVhzNixl03r4PEuDQqqE/AjSxcM6d
+GNYIAwlG7mDgfrbESQRRfXBgvKqy/3lyeqYdPV8q+Mri/Tm3R7nrft8EI6/6nAYH
+6ftjk4BAtcZsCjEozgyfz7MjNYBBjWzEN3uBL4ChQEKF6dk4jeihU80Bv2noWgby
+RQuQ+q7hv53yrlc8pa6yVvSLZUDp/TGBLPQ5Cdjua6e0ph0VpZj3AYHYhX3zUVxx
+iN66zB+Afko=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICTjCCAdOgAwIBAgIKPPYHqWhwDtqLhDAKBggqhkjOPQQDAzBrMQswCQYDVQQG
+EwJJTjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBUZWNo
+bm9sb2dpZXMgTGltaXRlZDEgMB4GA1UEAxMXZW1TaWduIEVDQyBSb290IENBIC0g
+RzMwHhcNMTgwMjE4MTgzMDAwWhcNNDMwMjE4MTgzMDAwWjBrMQswCQYDVQQGEwJJ
+TjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBUZWNobm9s
+b2dpZXMgTGltaXRlZDEgMB4GA1UEAxMXZW1TaWduIEVDQyBSb290IENBIC0gRzMw
+djAQBgcqhkjOPQIBBgUrgQQAIgNiAAQjpQy4LRL1KPOxst3iAhKAnjlfSU2fySU0
+WXTsuwYc58Byr+iuL+FBVIcUqEqy6HyC5ltqtdyzdc6LBtCGI79G1Y4PPwT01xyS
+fvalY8L1X44uT6EYGQIrMgqCZH0Wk9GjQjBAMB0GA1UdDgQWBBR8XQKEE9TMipuB
+zhccLikenEhjQjAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAKBggq
+hkjOPQQDAwNpADBmAjEAvvNhzwIQHWSVB7gYboiFBS+DCBeQyh+KTOgNG3qxrdWB
+CUfvO6wIBHxcmbHtRwfSAjEAnbpV/KlK6O3t5nYBQnvI+GDZjVGLVTv7jHvrZQnD
++JbNR6iC8hZVdyR+EhCVBCyj
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDczCCAlugAwIBAgILAK7PALrEzzL4Q7IwDQYJKoZIhvcNAQELBQAwVjELMAkG
+A1UEBhMCVVMxEzARBgNVBAsTCmVtU2lnbiBQS0kxFDASBgNVBAoTC2VNdWRocmEg
+SW5jMRwwGgYDVQQDExNlbVNpZ24gUm9vdCBDQSAtIEMxMB4XDTE4MDIxODE4MzAw
+MFoXDTQzMDIxODE4MzAwMFowVjELMAkGA1UEBhMCVVMxEzARBgNVBAsTCmVtU2ln
+biBQS0kxFDASBgNVBAoTC2VNdWRocmEgSW5jMRwwGgYDVQQDExNlbVNpZ24gUm9v
+dCBDQSAtIEMxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAz+upufGZ
+BczYKCFK83M0UYRWEPWgTywS4/oTmifQz/l5GnRfHXk5/Fv4cI7gklL35CX5VIPZ
+HdPIWoU/Xse2B+4+wM6ar6xWQio5JXDWv7V7Nq2s9nPczdcdioOl+yuQFTdrHCZH
+3DspVpNqs8FqOp099cGXOFgFixwR4+S0uF2FHYP+eF8LRWgYSKVGczQ7/g/IdrvH
+GPMF0Ybzhe3nudkyrVWIzqa2kbBPrH4VI5b2P/AgNBbeCsbEBEV5f6f9vtKppa+c
+xSMq9zwhbL2vj07FOrLzNBL834AaSaTUqZX3noleoomslMuoaJuvimUnzYnu3Yy1
+aylwQ6BpC+S5DwIDAQABo0IwQDAdBgNVHQ4EFgQU/qHgcB4qAzlSWkK+XJGFehiq
+TbUwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEL
+BQADggEBAMJKVvoVIXsoounlHfv4LcQ5lkFMOycsxGwYFYDGrK9HWS8mC+M2sO87
+/kOXSTKZEhVb3xEp/6tT+LvBeA+snFOvV71ojD1pM/CjoCNjO2RnIkSt1XHLVip4
+kqNPEjE2NuLe/gDEo2APJ62gsIq1NnpSob0n9CAnYuhNlCQT5AoE6TyrLshDCUrG
+YQTlSTR+08TI9Q/Aqum6VF7zYytPT1DU/rl7mYw9wC68AivTxEDkigcxHpvOJpkT
++xHqmiIMERnHXhuBUDDIlhJu58tBf5E7oke3VIAb3ADMmpDqw8NQBmIMMMAVSKeo
+WXzhriKi4gp6D/piq1JM4fHfyr6DDUI=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICKzCCAbGgAwIBAgIKe3G2gla4EnycqDAKBggqhkjOPQQDAzBaMQswCQYDVQQG
+EwJVUzETMBEGA1UECxMKZW1TaWduIFBLSTEUMBIGA1UEChMLZU11ZGhyYSBJbmMx
+IDAeBgNVBAMTF2VtU2lnbiBFQ0MgUm9vdCBDQSAtIEMzMB4XDTE4MDIxODE4MzAw
+MFoXDTQzMDIxODE4MzAwMFowWjELMAkGA1UEBhMCVVMxEzARBgNVBAsTCmVtU2ln
+biBQS0kxFDASBgNVBAoTC2VNdWRocmEgSW5jMSAwHgYDVQQDExdlbVNpZ24gRUND
+IFJvb3QgQ0EgLSBDMzB2MBAGByqGSM49AgEGBSuBBAAiA2IABP2lYa57JhAd6bci
+MK4G9IGzsUJxlTm801Ljr6/58pc1kjZGDoeVjbk5Wum739D+yAdBPLtVb4Ojavti
+sIGJAnB9SMVK4+kiVCJNk7tCDK93nCOmfddhEc5lx/h//vXyqaNCMEAwHQYDVR0O
+BBYEFPtaSNCAIEDyqOkAB2kZd6fmw/TPMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMB
+Af8EBTADAQH/MAoGCCqGSM49BAMDA2gAMGUCMQC02C8Cif22TGK6Q04ThHK1rt0c
+3ta13FaPWEBaLd4gTCKDypOofu4SQMfWh0/434UCMBwUZOR8loMRnLDRWmFLpg9J
+0wD8ofzkpf9/rdcw0Md3f76BB1UwUCAU9Vc4CqgxUQ==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFRzCCAy+gAwIBAgIJEQA0tk7GNi02MA0GCSqGSIb3DQEBCwUAMEExCzAJBgNV
+BAYTAlJPMRQwEgYDVQQKEwtDRVJUU0lHTiBTQTEcMBoGA1UECxMTY2VydFNJR04g
+Uk9PVCBDQSBHMjAeFw0xNzAyMDYwOTI3MzVaFw00MjAyMDYwOTI3MzVaMEExCzAJ
+BgNVBAYTAlJPMRQwEgYDVQQKEwtDRVJUU0lHTiBTQTEcMBoGA1UECxMTY2VydFNJ
+R04gUk9PVCBDQSBHMjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMDF
+dRmRfUR0dIf+DjuW3NgBFszuY5HnC2/OOwppGnzC46+CjobXXo9X69MhWf05N0Iw
+vlDqtg+piNguLWkh59E3GE59kdUWX2tbAMI5Qw02hVK5U2UPHULlj88F0+7cDBrZ
+uIt4ImfkabBoxTzkbFpG583H+u/E7Eu9aqSs/cwoUe+StCmrqzWaTOTECMYmzPhp
+n+Sc8CnTXPnGFiWeI8MgwT0PPzhAsP6CRDiqWhqKa2NYOLQV07YRaXseVO6MGiKs
+cpc/I1mbySKEwQdPzH/iV8oScLumZfNpdWO9lfsbl83kqK/20U6o2YpxJM02PbyW
+xPFsqa7lzw1uKA2wDrXKUXt4FMMgL3/7FFXhEZn91QqhngLjYl/rNUssuHLoPj1P
+rCy7Lobio3aP5ZMqz6WryFyNSwb/EkaseMsUBzXgqd+L6a8VTxaJW732jcZZroiF
+DsGJ6x9nxUWO/203Nit4ZoORUSs9/1F3dmKh7Gc+PoGD4FapUB8fepmrY7+EF3fx
+DTvf95xhszWYijqy7DwaNz9+j5LP2RIUZNoQAhVB/0/E6xyjyfqZ90bp4RjZsbgy
+LcsUDFDYg2WD7rlcz8sFWkz6GZdr1l0T08JcVLwyc6B49fFtHsufpaafItzRUZ6C
+eWRgKRM+o/1Pcmqr4tTluCRVLERLiohEnMqE0yo7AgMBAAGjQjBAMA8GA1UdEwEB
+/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBSCIS1mxteg4BXrzkwJ
+d8RgnlRuAzANBgkqhkiG9w0BAQsFAAOCAgEAYN4auOfyYILVAzOBywaK8SJJ6ejq
+kX/GM15oGQOGO0MBzwdw5AgeZYWR5hEit/UCI46uuR59H35s5r0l1ZUa8gWmr4UC
+b6741jH/JclKyMeKqdmfS0mbEVeZkkMR3rYzpMzXjWR91M08KCy0mpbqTfXERMQl
+qiCA2ClV9+BB/AYm/7k29UMUA2Z44RGx2iBfRgB4ACGlHgAoYXhvqAEBj500mv/0
+OJD7uNGzcgbJceaBxXntC6Z58hMLnPddDnskk7RI24Zf3lCGeOdA5jGokHZwYa+c
+NywRtYK3qq4kNFtyDGkNzVmf9nGvnAvRCjj5BiKDUyUM/FHE5r7iOZULJK2v0ZXk
+ltd0ZGtxTgI8qoXzIKNDOXZbbFD+mpwUHmUUihW9o4JFWklWatKcsWMy5WHgUyIO
+pwpJ6st+H6jiYoD2EEVSmAYY3qXNL3+q1Ok+CHLsIwMCPKaq2LxndD0UF/tUSxfj
+03k9bWtJySgOLnRQvwzZRjoQhsmnP+mg7H/rpXdYaXHmgwo38oZJar55CJD2AhZk
+PuXaTH4MNMn5X7azKFGnpyuqSfqNZSlO42sTp5SjLVFteAxEy9/eCG/Oo2Sr05WE
+1LlSVHJ7liXMvGnjSG4N0MedJ5qq+BOS3R7fY581qRY27Iy4g/Q9iY/NtBde17MX
+QRBdJ3NghVdJIgc=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIGFDCCA/ygAwIBAgIIG3Dp0v+ubHEwDQYJKoZIhvcNAQELBQAwUTELMAkGA1UE
+BhMCRVMxQjBABgNVBAMMOUF1dG9yaWRhZCBkZSBDZXJ0aWZpY2FjaW9uIEZpcm1h
+cHJvZmVzaW9uYWwgQ0lGIEE2MjYzNDA2ODAeFw0xNDA5MjMxNTIyMDdaFw0zNjA1
+MDUxNTIyMDdaMFExCzAJBgNVBAYTAkVTMUIwQAYDVQQDDDlBdXRvcmlkYWQgZGUg
+Q2VydGlmaWNhY2lvbiBGaXJtYXByb2Zlc2lvbmFsIENJRiBBNjI2MzQwNjgwggIi
+MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDKlmuO6vj78aI14H9M2uDDUtd9
+thDIAl6zQyrET2qyyhxdKJp4ERppWVevtSBC5IsP5t9bpgOSL/UR5GLXMnE42QQM
+cas9UX4PB99jBVzpv5RvwSmCwLTaUbDBPLutN0pcyvFLNg4kq7/DhHf9qFD0sefG
+L9ItWY16Ck6WaVICqjaY7Pz6FIMMNx/Jkjd/14Et5cS54D40/mf0PmbR0/RAz15i
+NA9wBj4gGFrO93IbJWyTdBSTo3OxDqqHECNZXyAFGUftaI6SEspd/NYrspI8IM/h
+X68gvqB2f3bl7BqGYTM+53u0P6APjqK5am+5hyZvQWyIplD9amML9ZMWGxmPsu2b
+m8mQ9QEM3xk9Dz44I8kvjwzRAv4bVdZO0I08r0+k8/6vKtMFnXkIoctXMbScyJCy
+Z/QYFpM6/EfY0XiWMR+6KwxfXZmtY4laJCB22N/9q06mIqqdXuYnin1oKaPnirja
+EbsXLZmdEyRG98Xi2J+Of8ePdG1asuhy9azuJBCtLxTa/y2aRnFHvkLfuwHb9H/T
+KI8xWVvTyQKmtFLKbpf7Q8UIJm+K9Lv9nyiqDdVF8xM6HdjAeI9BZzwelGSuewvF
+6NkBiDkal4ZkQdU7hwxu+g/GvUgUvzlN1J5Bto+WHWOWk9mVBngxaJ43BjuAiUVh
+OSPHG0SjFeUc+JIwuwIDAQABo4HvMIHsMB0GA1UdDgQWBBRlzeurNR4APn7VdMAc
+tHNHDhpkLzASBgNVHRMBAf8ECDAGAQH/AgEBMIGmBgNVHSAEgZ4wgZswgZgGBFUd
+IAAwgY8wLwYIKwYBBQUHAgEWI2h0dHA6Ly93d3cuZmlybWFwcm9mZXNpb25hbC5j
+b20vY3BzMFwGCCsGAQUFBwICMFAeTgBQAGEAcwBlAG8AIABkAGUAIABsAGEAIABC
+AG8AbgBhAG4AbwB2AGEAIAA0ADcAIABCAGEAcgBjAGUAbABvAG4AYQAgADAAOAAw
+ADEANzAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADggIBAHSHKAIrdx9m
+iWTtj3QuRhy7qPj4Cx2Dtjqn6EWKB7fgPiDL4QjbEwj4KKE1soCzC1HA01aajTNF
+Sa9J8OA9B3pFE1r/yJfY0xgsfZb43aJlQ3CTkBW6kN/oGbDbLIpgD7dvlAceHabJ
+hfa9NPhAeGIQcDq+fUs5gakQ1JZBu/hfHAsdCPKxsIl68veg4MSPi3i1O1ilI45P
+Vf42O+AMt8oqMEEgtIDNrvx2ZnOorm7hfNoD6JQg5iKj0B+QXSBTFCZX2lSX3xZE
+EAEeiGaPcjiT3SC3NL7X8e5jjkd5KAb881lFJWAiMxujX6i6KtoaPc1A6ozuBRWV
+1aUsIC+nmCjuRfzxuIgALI9C2lHVnOUTaHFFQ4ueCyE8S1wF3BqfmI7avSKecs2t
+CsvMo2ebKHTEm9caPARYpoKdrcd7b/+Alun4jWq9GJAd/0kakFI3ky88Al2CdgtR
+5xbHV/g4+afNmyJU72OwFW1TZQNKXkqgsqeOSQBZONXH9IBk9W6VULgRfhVwOEqw
+f9DEMnDAGf/JOC0ULGb0QkTmVXYbgBVX/8Cnp6o5qtjTcNAuuuuUavpfNIbnYrX9
+ivAwhZTJryQCL2/W3Wf+47BVTwSYT6RBVuKT0Gro1vP7ZeDOdcQxWQzugsgMYDNK
+GbqEZycPvEJdvSRUDewdcAZfpLz6IHxV
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICYDCCAgegAwIBAgIMDWpfCD8oXD5Rld9dMAoGCCqGSM49BAMCMIGRMQswCQYD
+VQQGEwJVUzERMA8GA1UECBMISWxsaW5vaXMxEDAOBgNVBAcTB0NoaWNhZ28xITAf
+BgNVBAoTGFRydXN0d2F2ZSBIb2xkaW5ncywgSW5jLjE6MDgGA1UEAxMxVHJ1c3R3
+YXZlIEdsb2JhbCBFQ0MgUDI1NiBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0x
+NzA4MjMxOTM1MTBaFw00MjA4MjMxOTM1MTBaMIGRMQswCQYDVQQGEwJVUzERMA8G
+A1UECBMISWxsaW5vaXMxEDAOBgNVBAcTB0NoaWNhZ28xITAfBgNVBAoTGFRydXN0
+d2F2ZSBIb2xkaW5ncywgSW5jLjE6MDgGA1UEAxMxVHJ1c3R3YXZlIEdsb2JhbCBF
+Q0MgUDI1NiBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTBZMBMGByqGSM49AgEGCCqG
+SM49AwEHA0IABH77bOYj43MyCMpg5lOcunSNGLB4kFKA3TjASh3RqMyTpJcGOMoN
+FWLGjgEqZZ2q3zSRLoHB5DOSMcT9CTqmP62jQzBBMA8GA1UdEwEB/wQFMAMBAf8w
+DwYDVR0PAQH/BAUDAwcGADAdBgNVHQ4EFgQUo0EGrJBt0UrrdaVKEJmzsaGLSvcw
+CgYIKoZIzj0EAwIDRwAwRAIgB+ZU2g6gWrKuEZ+Hxbb/ad4lvvigtwjzRM4q3wgh
+DDcCIC0mA6AFvWvR9lz4ZcyGbbOcNEhjhAnFjXca4syc4XR7
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIF2jCCA8KgAwIBAgIMBfcOhtpJ80Y1LrqyMA0GCSqGSIb3DQEBCwUAMIGIMQsw
+CQYDVQQGEwJVUzERMA8GA1UECAwISWxsaW5vaXMxEDAOBgNVBAcMB0NoaWNhZ28x
+ITAfBgNVBAoMGFRydXN0d2F2ZSBIb2xkaW5ncywgSW5jLjExMC8GA1UEAwwoVHJ1
+c3R3YXZlIEdsb2JhbCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0xNzA4MjMx
+OTM0MTJaFw00MjA4MjMxOTM0MTJaMIGIMQswCQYDVQQGEwJVUzERMA8GA1UECAwI
+SWxsaW5vaXMxEDAOBgNVBAcMB0NoaWNhZ28xITAfBgNVBAoMGFRydXN0d2F2ZSBI
+b2xkaW5ncywgSW5jLjExMC8GA1UEAwwoVHJ1c3R3YXZlIEdsb2JhbCBDZXJ0aWZp
+Y2F0aW9uIEF1dGhvcml0eTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB
+ALldUShLPDeS0YLOvR29zd24q88KPuFd5dyqCblXAj7mY2Hf8g+CY66j96xz0Xzn
+swuvCAAJWX/NKSqIk4cXGIDtiLK0thAfLdZfVaITXdHG6wZWiYj+rDKd/VzDBcdu
+7oaJuogDnXIhhpCujwOl3J+IKMujkkkP7NAP4m1ET4BqstTnoApTAbqOl5F2brz8
+1Ws25kCI1nsvXwXoLG0R8+eyvpJETNKXpP7ScoFDB5zpET71ixpZfR9oWN0EACyW
+80OzfpgZdNmcc9kYvkHHNHnZ9GLCQ7mzJ7Aiy/k9UscwR7PJPrhq4ufogXBeQotP
+JqX+OsIgbrv4Fo7NDKm0G2x2EOFYeUY+VM6AqFcJNykbmROPDMjWLBz7BegIlT1l
+RtzuzWniTY+HKE40Cz7PFNm73bZQmq131BnW2hqIyE4bJ3XYsgjxroMwuREOzYfw
+hI0Vcnyh78zyiGG69Gm7DIwLdVcEuE4qFC49DxweMqZiNu5m4iK4BUBjECLzMx10
+coos9TkpoNPnG4CELcU9402x/RpvumUHO1jsQkUm+9jaJXLE9gCxInm943xZYkqc
+BW89zubWR2OZxiRvchLIrH+QtAuRcOi35hYQcRfO3gZPSEF9NUqjifLJS3tBEW1n
+twiYTOURGa5CgNz7kAXU+FDKvuStx8KU1xad5hePrzb7AgMBAAGjQjBAMA8GA1Ud
+EwEB/wQFMAMBAf8wHQYDVR0OBBYEFJngGWcNYtt2s9o9uFvo/ULSMQ6HMA4GA1Ud
+DwEB/wQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAgEAmHNw4rDT7TnsTGDZqRKGFx6W
+0OhUKDtkLSGm+J1WE2pIPU/HPinbbViDVD2HfSMF1OQc3Og4ZYbFdada2zUFvXfe
+uyk3QAUHw5RSn8pk3fEbK9xGChACMf1KaA0HZJDmHvUqoai7PF35owgLEQzxPy0Q
+lG/+4jSHg9bP5Rs1bdID4bANqKCqRieCNqcVtgimQlRXtpla4gt5kNdXElE1GYhB
+aCXUNxeEFfsBctyV3lImIJgm4nb1J2/6ADtKYdkNy1GTKv0WBpanI5ojSP5RvbbE
+sLFUzt5sQa0WZ37b/TjNuThOssFgy50X31ieemKyJo90lZvkWx3SD92YHJtZuSPT
+MaCm/zjdzyBP6VhWOmfD0faZmZ26NraAL4hHT4a/RDqA5Dccprrql5gR0IRiR2Qe
+qu5AvzSxnI9O4fKSTx+O856X3vOmeWqJcU9LJxdI/uz0UA9PSX3MReO9ekDFQdxh
+VicGaeVyQYHTtgGJoC86cnn+OjC/QezHYj6RS8fZMXZC+fc8Y+wmjHMMfRod6qh8
+h6jCJ3zhM0EPz8/8AKAigJ5Kp28AsEFFtyLKaEjFQqKu3R3y4G5OBVixwJAWKqQ9
+EEC+j2Jjg6mcgn0tAumDMHzLJ8n9HmYAsC7TIS+OMxZsmO0QqAfWzJPP29FpHOTK
+yeC2nOnOcXHebD8WpHk=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICnTCCAiSgAwIBAgIMCL2Fl2yZJ6SAaEc7MAoGCCqGSM49BAMDMIGRMQswCQYD
+VQQGEwJVUzERMA8GA1UECBMISWxsaW5vaXMxEDAOBgNVBAcTB0NoaWNhZ28xITAf
+BgNVBAoTGFRydXN0d2F2ZSBIb2xkaW5ncywgSW5jLjE6MDgGA1UEAxMxVHJ1c3R3
+YXZlIEdsb2JhbCBFQ0MgUDM4NCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0x
+NzA4MjMxOTM2NDNaFw00MjA4MjMxOTM2NDNaMIGRMQswCQYDVQQGEwJVUzERMA8G
+A1UECBMISWxsaW5vaXMxEDAOBgNVBAcTB0NoaWNhZ28xITAfBgNVBAoTGFRydXN0
+d2F2ZSBIb2xkaW5ncywgSW5jLjE6MDgGA1UEAxMxVHJ1c3R3YXZlIEdsb2JhbCBF
+Q0MgUDM4NCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTB2MBAGByqGSM49AgEGBSuB
+BAAiA2IABGvaDXU1CDFHBa5FmVXxERMuSvgQMSOjfoPTfygIOiYaOs+Xgh+AtycJ
+j9GOMMQKmw6sWASr9zZ9lCOkmwqKi6vr/TklZvFe/oyujUF5nQlgziip04pt89ZF
+1PKYhDhloKNDMEEwDwYDVR0TAQH/BAUwAwEB/zAPBgNVHQ8BAf8EBQMDBwYAMB0G
+A1UdDgQWBBRVqYSJ0sEyvRjLbKYHTsjnnb6CkDAKBggqhkjOPQQDAwNnADBkAjA3
+AZKXRRJ+oPM+rRk6ct30UJMDEr5E0k9BpIycnR+j9sKS50gU/k6bpZFXrsY3crsC
+MGclCrEMXu6pY5Jv5ZAL/mYiykf9ijH3g/56vxC+GCsej/YpHpRZ744hN8tRmKVu
+Sw==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICbjCCAfOgAwIBAgIQYvYybOXE42hcG2LdnC6dlTAKBggqhkjOPQQDAzB4MQsw
+CQYDVQQGEwJFUzERMA8GA1UECgwIRk5NVC1SQ00xDjAMBgNVBAsMBUNlcmVzMRgw
+FgYDVQRhDA9WQVRFUy1RMjgyNjAwNEoxLDAqBgNVBAMMI0FDIFJBSVogRk5NVC1S
+Q00gU0VSVklET1JFUyBTRUdVUk9TMB4XDTE4MTIyMDA5MzczM1oXDTQzMTIyMDA5
+MzczM1oweDELMAkGA1UEBhMCRVMxETAPBgNVBAoMCEZOTVQtUkNNMQ4wDAYDVQQL
+DAVDZXJlczEYMBYGA1UEYQwPVkFURVMtUTI4MjYwMDRKMSwwKgYDVQQDDCNBQyBS
+QUlaIEZOTVQtUkNNIFNFUlZJRE9SRVMgU0VHVVJPUzB2MBAGByqGSM49AgEGBSuB
+BAAiA2IABPa6V1PIyqvfNkpSIeSX0oNnnvBlUdBeh8dHsVnyV0ebAAKTRBdp20LH
+sbI6GA60XYyzZl2hNPk2LEnb80b8s0RpRBNm/dfF/a82Tc4DTQdxz69qBdKiQ1oK
+Um8BA06Oi6NCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYD
+VR0OBBYEFAG5L++/EYZg8k/QQW6rcx/n0m5JMAoGCCqGSM49BAMDA2kAMGYCMQCu
+SuMrQMN0EfKVrRYj3k4MGuZdpSRea0R7/DjiT8ucRRcRTBQnJlU5dUoDzBOQn5IC
+MQD6SmxgiHPz7riYYqnOK8LZiqZwMR2vsJRM60/G49HzYqc8/5MuB1xJAWdpEgJy
+v+c=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFVjCCAz6gAwIBAgIUQ+NxE9izWRRdt86M/TX9b7wFjUUwDQYJKoZIhvcNAQEL
+BQAwQzELMAkGA1UEBhMCQ04xHDAaBgNVBAoTE2lUcnVzQ2hpbmEgQ28uLEx0ZC4x
+FjAUBgNVBAMTDXZUcnVzIFJvb3QgQ0EwHhcNMTgwNzMxMDcyNDA1WhcNNDMwNzMx
+MDcyNDA1WjBDMQswCQYDVQQGEwJDTjEcMBoGA1UEChMTaVRydXNDaGluYSBDby4s
+THRkLjEWMBQGA1UEAxMNdlRydXMgUm9vdCBDQTCCAiIwDQYJKoZIhvcNAQEBBQAD
+ggIPADCCAgoCggIBAL1VfGHTuB0EYgWgrmy3cLRB6ksDXhA/kFocizuwZotsSKYc
+IrrVQJLuM7IjWcmOvFjai57QGfIvWcaMY1q6n6MLsLOaXLoRuBLpDLvPbmyAhykU
+AyyNJJrIZIO1aqwTLDPxn9wsYTwaP3BVm60AUn/PBLn+NvqcwBauYv6WTEN+VRS+
+GrPSbcKvdmaVayqwlHeFXgQPYh1jdfdr58tbmnDsPmcF8P4HCIDPKNsFxhQnL4Z9
+8Cfe/+Z+M0jnCx5Y0ScrUw5XSmXX+6KAYPxMvDVTAWqXcoKv8R1w6Jz1717CbMdH
+flqUhSZNO7rrTOiwCcJlwp2dCZtOtZcFrPUGoPc2BX70kLJrxLT5ZOrpGgrIDajt
+J8nU57O5q4IikCc9Kuh8kO+8T/3iCiSn3mUkpF3qwHYw03dQ+A0Em5Q2AXPKBlim
+0zvc+gRGE1WKyURHuFE5Gi7oNOJ5y1lKCn+8pu8fA2dqWSslYpPZUxlmPCdiKYZN
+pGvu/9ROutW04o5IWgAZCfEF2c6Rsffr6TlP9m8EQ5pV9T4FFL2/s1m02I4zhKOQ
+UqqzApVg+QxMaPnu1RcN+HFXtSXkKe5lXa/R7jwXC1pDxaWG6iSe4gUH3DRCEpHW
+OXSuTEGC2/KmSNGzm/MzqvOmwMVO9fSddmPmAsYiS8GVP1BkLFTltvA8Kc9XAgMB
+AAGjQjBAMB0GA1UdDgQWBBRUYnBj8XWEQ1iO0RYgscasGrz2iTAPBgNVHRMBAf8E
+BTADAQH/MA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAgEAKbqSSaet
+8PFww+SX8J+pJdVrnjT+5hpk9jprUrIQeBqfTNqK2uwcN1LgQkv7bHbKJAs5EhWd
+nxEt/Hlk3ODg9d3gV8mlsnZwUKT+twpw1aA08XXXTUm6EdGz2OyC/+sOxL9kLX1j
+bhd47F18iMjrjld22VkE+rxSH0Ws8HqA7Oxvdq6R2xCOBNyS36D25q5J08FsEhvM
+Kar5CKXiNxTKsbhm7xqC5PD48acWabfbqWE8n/Uxy+QARsIvdLGx14HuqCaVvIiv
+TDUHKgLKeBRtRytAVunLKmChZwOgzoy8sHJnxDHO2zTlJQNgJXtxmOTAGytfdELS
+S8VZCAeHvsXDf+eW2eHcKJfWjwXj9ZtOyh1QRwVTsMo554WgicEFOwE30z9J4nfr
+I8iIZjs9OXYhRvHsXyO466JmdXTBQPfYaJqT4i2pLr0cox7IdMakLXogqzu4sEb9
+b91fUlV1YvCXoHzXOP0l382gmxDPi7g4Xl7FtKYCNqEeXxzP4padKar9mK5S4fNB
+UvupLnKWnyfjqnN9+BojZns7q2WwMgFLFT49ok8MKzWixtlnEjUwzXYuFrOZnk1P
+Ti07NEPhmg4NpGaXutIcSkwsKouLgU9xGqndXHt7CMUADTdA43x7VF8vhV929ven
+sBxXVsFy6K2ir40zSbofitzmdHxghm+Hl3s=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICDzCCAZWgAwIBAgIUbmq8WapTvpg5Z6LSa6Q75m0c1towCgYIKoZIzj0EAwMw
+RzELMAkGA1UEBhMCQ04xHDAaBgNVBAoTE2lUcnVzQ2hpbmEgQ28uLEx0ZC4xGjAY
+BgNVBAMTEXZUcnVzIEVDQyBSb290IENBMB4XDTE4MDczMTA3MjY0NFoXDTQzMDcz
+MTA3MjY0NFowRzELMAkGA1UEBhMCQ04xHDAaBgNVBAoTE2lUcnVzQ2hpbmEgQ28u
+LEx0ZC4xGjAYBgNVBAMTEXZUcnVzIEVDQyBSb290IENBMHYwEAYHKoZIzj0CAQYF
+K4EEACIDYgAEZVBKrox5lkqqHAjDo6LN/llWQXf9JpRCux3NCNtzslt188+cToL0
+v/hhJoVs1oVbcnDS/dtitN9Ti72xRFhiQgnH+n9bEOf+QP3A2MMrMudwpremIFUd
+e4BdS49nTPEQo0IwQDAdBgNVHQ4EFgQUmDnNvtiyjPeyq+GtJK97fKHbH88wDwYD
+VR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwCgYIKoZIzj0EAwMDaAAwZQIw
+V53dVvHH4+m4SVBrm2nDb+zDfSXkV5UTQJtS0zvzQBm8JsctBp61ezaf9SXUY2sA
+AjEA6dPGnlaaKsyh2j/IZivTWJwghfqrkYpwcBE4YGQLYgmRWAD5Tfs0aNoJrSEG
+GJTO
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIF6zCCA9OgAwIBAgIIVrYpzTS8ePYwDQYJKoZIhvcNAQELBQAwgYIxCzAJBgNV
+BAYTAlVTMQ4wDAYDVQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3RvbjEYMBYGA1UE
+CgwPU1NMIENvcnBvcmF0aW9uMTcwNQYDVQQDDC5TU0wuY29tIEVWIFJvb3QgQ2Vy
+dGlmaWNhdGlvbiBBdXRob3JpdHkgUlNBIFIyMB4XDTE3MDUzMTE4MTQzN1oXDTQy
+MDUzMDE4MTQzN1owgYIxCzAJBgNVBAYTAlVTMQ4wDAYDVQQIDAVUZXhhczEQMA4G
+A1UEBwwHSG91c3RvbjEYMBYGA1UECgwPU1NMIENvcnBvcmF0aW9uMTcwNQYDVQQD
+DC5TU0wuY29tIEVWIFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgUlNBIFIy
+MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAjzZlQOHWTcDXtOlG2mvq
+M0fNTPl9fb69LT3w23jhhqXZuglXaO1XPqDQCEGD5yhBJB/jchXQARr7XnAjssuf
+OePPxU7Gkm0mxnu7s9onnQqG6YE3Bf7wcXHswxzpY6IXFJ3vG2fThVUCAtZJycxa
+4bH3bzKfydQ7iEGonL3Lq9ttewkfokxykNorCPzPPFTOZw+oz12WGQvE43LrrdF9
+HSfvkusQv1vrO6/PgN3B0pYEW3p+pKk8OHakYo6gOV7qd89dAFmPZiw+B6KjBSYR
+aZfqhbcPlgtLyEDhULouisv3D5oi53+aNxPN8k0TayHRwMwi8qFG9kRpnMphNQcA
+b9ZhCBHqurj26bNg5U257J8UZslXWNvNh2n4ioYSA0e/ZhN2rHd9NCSFg83XqpyQ
+Gp8hLH94t2S42Oim9HizVcuE0jLEeK6jj2HdzghTreyI/BXkmg3mnxp3zkyPuBQV
+PWKchjgGAGYS5Fl2WlPAApiiECtoRHuOec4zSnaqW4EWG7WK2NAAe15itAnWhmMO
+pgWVSbooi4iTsjQc2KRVbrcc0N6ZVTsj9CLg+SlmJuwgUHfbSguPvuUCYHBBXtSu
+UDkiFCbLsjtzdFVHB3mBOagwE0TlBIqulhMlQg+5U8Sb/M3kHN48+qvWBkofZ6aY
+MBzdLNvcGJVXZsb/XItW9XcCAwEAAaNjMGEwDwYDVR0TAQH/BAUwAwEB/zAfBgNV
+HSMEGDAWgBT5YLvU49U09rj1BoAlp3PbRmmonjAdBgNVHQ4EFgQU+WC71OPVNPa4
+9QaAJadz20ZpqJ4wDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4ICAQBW
+s47LCp1Jjr+kxJG7ZhcFUZh1++VQLHqe8RT6q9OKPv+RKY9ji9i0qVQBDb6Thi/5
+Sm3HXvVX+cpVHBK+Rw82xd9qt9t1wkclf7nxY/hoLVUE0fKNsKTPvDxeH3jnpaAg
+cLAExbf3cqfeIg29MyVGjGSSJuM+LmOW2puMPfgYCdcDzH2GguDKBAdRUNf/ktUM
+79qGn5nX67evaOI5JpS6aLe/g9Pqemc9YmeuJeVy6OLk7K4S9ksrPJ/psEDzOFSz
+/bdoyNrGj1E8svuR3Bznm53htw1yj+KkxKl4+esUrMZDBcJlOSgYAsOCsp0FvmXt
+ll9ldDz7CTUue5wT/RsPXcdtgTpWD8w74a8CLyKsRspGPKAcTNZEtF4uXBVmCeEm
+Kf7GUmG6sXP/wwyc5WxqlD8UykAWlYTzWamsX0xhk23RO8yilQwipmdnRC652dKK
+QbNmC1r7fSOl8hqw/96bg5Qu0T/fkreRrwU7ZcegbLHNYhLDkBvjJc40vG93drEQ
+w/cFGsDWr3RiSBd3kmmQYRzelYB0VI8YHMPzA9C/pEN1hlMYegouCRw2n5H9gooi
+S9EOUCXdywMMF8mDAAhONU2Ki+3wApRmLER/y5UnlhetCTCstnEXbosX9hwJ1C07
+mKVx01QT2WDz9UtmT/rx7iASjbSsV7FFY6GsdqnC+w==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFajCCA1KgAwIBAgIQLd2szmKXlKFD6LDNdmpeYDANBgkqhkiG9w0BAQsFADBP
+MQswCQYDVQQGEwJUVzEjMCEGA1UECgwaQ2h1bmdod2EgVGVsZWNvbSBDby4sIEx0
+ZC4xGzAZBgNVBAMMEkhpUEtJIFJvb3QgQ0EgLSBHMTAeFw0xOTAyMjIwOTQ2MDRa
+Fw0zNzEyMzExNTU5NTlaME8xCzAJBgNVBAYTAlRXMSMwIQYDVQQKDBpDaHVuZ2h3
+YSBUZWxlY29tIENvLiwgTHRkLjEbMBkGA1UEAwwSSGlQS0kgUm9vdCBDQSAtIEcx
+MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA9B5/UnMyDHPkvRN0o9Qw
+qNCuS9i233VHZvR85zkEHmpwINJaR3JnVfSl6J3VHiGh8Ge6zCFovkRTv4354twv
+Vcg3Px+kwJyz5HdcoEb+d/oaoDjq7Zpy3iu9lFc6uux55199QmQ5eiY29yTw1S+6
+lZgRZq2XNdZ1AYDgr/SEYYwNHl98h5ZeQa/rh+r4XfEuiAU+TCK72h8q3VJGZDnz
+Qs7ZngyzsHeXZJzA9KMuH5UHsBffMNsAGJZMoYFL3QRtU6M9/Aes1MU3guvklQgZ
+KILSQjqj2FPseYlgSGDIcpJQ3AOPgz+yQlda22rpEZfdhSi8MEyr48KxRURHH+CK
+FgeW0iEPU8DtqX7UTuybCeyvQqww1r/REEXgphaypcXTT3OUM3ECoWqj1jOXTyFj
+HluP2cFeRXF3D4FdXyGarYPM+l7WjSNfGz1BryB1ZlpK9p/7qxj3ccC2HTHsOyDr
+y+K49a6SsvfhhEvyovKTmiKe0xRvNlS9H15ZFblzqMF8b3ti6RZsR1pl8w4Rm0bZ
+/W3c1pzAtH2lsN0/Vm+h+fbkEkj9Bn8SV7apI09bA8PgcSojt/ewsTu8mL3WmKgM
+a/aOEmem8rJY5AIJEzypuxC00jBF8ez3ABHfZfjcK0NVvxaXxA/VLGGEqnKG/uY6
+fsI/fe78LxQ+5oXdUG+3Se0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAdBgNV
+HQ4EFgQU8ncX+l6o/vY9cdVouslGDDjYr7AwDgYDVR0PAQH/BAQDAgGGMA0GCSqG
+SIb3DQEBCwUAA4ICAQBQUfB13HAE4/+qddRxosuej6ip0691x1TPOhwEmSKsxBHi
+7zNKpiMdDg1H2DfHb680f0+BazVP6XKlMeJ45/dOlBhbQH3PayFUhuaVevvGyuqc
+SE5XCV0vrPSltJczWNWseanMX/mF+lLFjfiRFOs6DRfQUsJ748JzjkZ4Bjgs6Fza
+ZsT0pPBWGTMpWmWSBUdGSquEwx4noR8RkpkndZMPvDY7l1ePJlsMu5wP1G4wB9Tc
+XzZoZjmDlicmisjEOf6aIW/Vcobpf2Lll07QJNBAsNB1CI69aO4I1258EHBGG3zg
+iLKecoaZAeO/n0kZtCW+VmWuF2PlHt/o/0elv+EmBYTksMCv5wiZqAxeJoBF1Pho
+L5aPruJKHJwWDBNvOIf2u8g0X5IDUXlwpt/L9ZlNec1OvFefQ05rLisY+GpzjLrF
+Ne85akEez3GoorKGB1s6yeHvP2UEgEcyRHCVTjFnanRbEEV16rCf0OY1/k6fi8wr
+kkVbbiVghUbN0aqwdmaTd5a+g744tiROJgvM7XpWGuDpWsZkrUx6AEhEL7lAuxM+
+vhV4nYWBSipX3tUZQ9rbyltHhoMLP7YNdnhzeSJesYAfz77RP1YQmCuVh6EfnWQU
+YDksswBVLuT1sw5XxJFBAJw/6KXf6vb/yPCtbVKoF6ubYfwSUTXkJf2vqmqGOQ==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICaTCCAe+gAwIBAgIQISpWDK7aDKtARb8roi066jAKBggqhkjOPQQDAzBtMQsw
+CQYDVQQGEwJDSDEQMA4GA1UEChMHV0lTZUtleTEiMCAGA1UECxMZT0lTVEUgRm91
+bmRhdGlvbiBFbmRvcnNlZDEoMCYGA1UEAxMfT0lTVEUgV0lTZUtleSBHbG9iYWwg
+Um9vdCBHQyBDQTAeFw0xNzA1MDkwOTQ4MzRaFw00MjA1MDkwOTU4MzNaMG0xCzAJ
+BgNVBAYTAkNIMRAwDgYDVQQKEwdXSVNlS2V5MSIwIAYDVQQLExlPSVNURSBGb3Vu
+ZGF0aW9uIEVuZG9yc2VkMSgwJgYDVQQDEx9PSVNURSBXSVNlS2V5IEdsb2JhbCBS
+b290IEdDIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAETOlQwMYPchi82PG6s4ni
+eUqjFqdrVCTbUf/q9Akkwwsin8tqJ4KBDdLArzHkdIJuyiXZjHWd8dvQmqJLIX4W
+p2OQ0jnUsYd4XxiWD1AbNTcPasbc2RNNpI6QN+a9WzGRo1QwUjAOBgNVHQ8BAf8E
+BAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUSIcUrOPDnpBgOtfKie7T
+rYy0UGYwEAYJKwYBBAGCNxUBBAMCAQAwCgYIKoZIzj0EAwMDaAAwZQIwJsdpW9zV
+57LnyAyMjMPdeYwbY9XJUpROTYJKcx6ygISpJcBMWm1JKWB4E+J+SOtkAjEA2zQg
+Mgj/mkkCtojeFK9dbJlxjRo/i9fgojaGHAeCOnZT/cKi7e97sIBPWA9LUzm9
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICQDCCAeWgAwIBAgIMAVRI7yH9l1kN9QQKMAoGCCqGSM49BAMCMHExCzAJBgNV
+BAYTAkhVMREwDwYDVQQHDAhCdWRhcGVzdDEWMBQGA1UECgwNTWljcm9zZWMgTHRk
+LjEXMBUGA1UEYQwOVkFUSFUtMjM1ODQ0OTcxHjAcBgNVBAMMFWUtU3ppZ25vIFJv
+b3QgQ0EgMjAxNzAeFw0xNzA4MjIxMjA3MDZaFw00MjA4MjIxMjA3MDZaMHExCzAJ
+BgNVBAYTAkhVMREwDwYDVQQHDAhCdWRhcGVzdDEWMBQGA1UECgwNTWljcm9zZWMg
+THRkLjEXMBUGA1UEYQwOVkFUSFUtMjM1ODQ0OTcxHjAcBgNVBAMMFWUtU3ppZ25v
+IFJvb3QgQ0EgMjAxNzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABJbcPYrYsHtv
+xie+RJCxs1YVe45DJH0ahFnuY2iyxl6H0BVIHqiQrb1TotreOpCmYF9oMrWGQd+H
+Wyx7xf58etqjYzBhMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0G
+A1UdDgQWBBSHERUI0arBeAyxr87GyZDvvzAEwDAfBgNVHSMEGDAWgBSHERUI0arB
+eAyxr87GyZDvvzAEwDAKBggqhkjOPQQDAgNJADBGAiEAtVfd14pVCzbhhkT61Nlo
+jbjcI4qKDdQvfepz7L9NbKgCIQDLpbQS+ue16M9+k/zzNY9vTlp8tLxOsvxyqltZ
++efcMQ==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIGFDCCA/ygAwIBAgIIU+w77vuySF8wDQYJKoZIhvcNAQEFBQAwUTELMAkGA1UE
+BhMCRVMxQjBABgNVBAMMOUF1dG9yaWRhZCBkZSBDZXJ0aWZpY2FjaW9uIEZpcm1h
+cHJvZmVzaW9uYWwgQ0lGIEE2MjYzNDA2ODAeFw0wOTA1MjAwODM4MTVaFw0zMDEy
+MzEwODM4MTVaMFExCzAJBgNVBAYTAkVTMUIwQAYDVQQDDDlBdXRvcmlkYWQgZGUg
+Q2VydGlmaWNhY2lvbiBGaXJtYXByb2Zlc2lvbmFsIENJRiBBNjI2MzQwNjgwggIi
+MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDKlmuO6vj78aI14H9M2uDDUtd9
+thDIAl6zQyrET2qyyhxdKJp4ERppWVevtSBC5IsP5t9bpgOSL/UR5GLXMnE42QQM
+cas9UX4PB99jBVzpv5RvwSmCwLTaUbDBPLutN0pcyvFLNg4kq7/DhHf9qFD0sefG
+L9ItWY16Ck6WaVICqjaY7Pz6FIMMNx/Jkjd/14Et5cS54D40/mf0PmbR0/RAz15i
+NA9wBj4gGFrO93IbJWyTdBSTo3OxDqqHECNZXyAFGUftaI6SEspd/NYrspI8IM/h
+X68gvqB2f3bl7BqGYTM+53u0P6APjqK5am+5hyZvQWyIplD9amML9ZMWGxmPsu2b
+m8mQ9QEM3xk9Dz44I8kvjwzRAv4bVdZO0I08r0+k8/6vKtMFnXkIoctXMbScyJCy
+Z/QYFpM6/EfY0XiWMR+6KwxfXZmtY4laJCB22N/9q06mIqqdXuYnin1oKaPnirja
+EbsXLZmdEyRG98Xi2J+Of8ePdG1asuhy9azuJBCtLxTa/y2aRnFHvkLfuwHb9H/T
+KI8xWVvTyQKmtFLKbpf7Q8UIJm+K9Lv9nyiqDdVF8xM6HdjAeI9BZzwelGSuewvF
+6NkBiDkal4ZkQdU7hwxu+g/GvUgUvzlN1J5Bto+WHWOWk9mVBngxaJ43BjuAiUVh
+OSPHG0SjFeUc+JIwuwIDAQABo4HvMIHsMBIGA1UdEwEB/wQIMAYBAf8CAQEwDgYD
+VR0PAQH/BAQDAgEGMB0GA1UdDgQWBBRlzeurNR4APn7VdMActHNHDhpkLzCBpgYD
+VR0gBIGeMIGbMIGYBgRVHSAAMIGPMC8GCCsGAQUFBwIBFiNodHRwOi8vd3d3LmZp
+cm1hcHJvZmVzaW9uYWwuY29tL2NwczBcBggrBgEFBQcCAjBQHk4AUABhAHMAZQBv
+ACAAZABlACAAbABhACAAQgBvAG4AYQBuAG8AdgBhACAANAA3ACAAQgBhAHIAYwBl
+AGwAbwBuAGEAIAAwADgAMAAxADcwDQYJKoZIhvcNAQEFBQADggIBABd9oPm03cXF
+661LJLWhAqvdpYhKsg9VSytXjDvlMd3+xDLx51tkljYyGOylMnfX40S2wBEqgLk9
+am58m9Ot/MPWo+ZkKXzR4Tgegiv/J2Wv+xYVxC5xhOW1//qkR71kMrv2JYSiJ0L1
+ILDCExARzRAVukKQKtJE4ZYm6zFIEv0q2skGz3QeqUvVhyj5eTSSPi5E6PaPT481
+PyWzOdxjKpBrIF/EUhJOlywqrJ2X3kjyo2bbwtKDlaZmp54lD+kLM5FlClrD2VQS
+3a/DTg4fJl4N3LON7NWBcN7STyQF82xO9UxJZo3R/9ILJUFI/lGExkKvgATP0H5k
+SeTy36LssUzAKh3ntLFlosS88Zj0qnAHY7S42jtM+kAiMFsRpvAFDsYCA0irhpuF
+3dvd6qJ2gHN99ZwExEWN57kci57q13XRcrHedUTnQn3iV2t93Jm8PYMo6oCTjcVM
+ZcFwgbg4/EMxsvYDNEeyrPsiBsse3RdHHF9mudMaotoRsaS8I8nkvof/uZS2+F0g
+StRf571oe2XyFR7SOqkt6dhrJKyXWERHrVkY8SFlcN7ONGCoQPHzPKTDKCOM/icz
+Q0CgFzzr6juwcqajuUpLXhZI9LK8yIySxZ2frHI2vDSANGupi5LAuBft7HZT9SQB
+jLMi6Et8Vcad+qMUu2WFbm5PEn4KPJ2V
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFaTCCA1GgAwIBAgIJAJK4iNuwisFjMA0GCSqGSIb3DQEBCwUAMFIxCzAJBgNV
+BAYTAlNLMRMwEQYDVQQHEwpCcmF0aXNsYXZhMRMwEQYDVQQKEwpEaXNpZyBhLnMu
+MRkwFwYDVQQDExBDQSBEaXNpZyBSb290IFIyMB4XDTEyMDcxOTA5MTUzMFoXDTQy
+MDcxOTA5MTUzMFowUjELMAkGA1UEBhMCU0sxEzARBgNVBAcTCkJyYXRpc2xhdmEx
+EzARBgNVBAoTCkRpc2lnIGEucy4xGTAXBgNVBAMTEENBIERpc2lnIFJvb3QgUjIw
+ggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCio8QACdaFXS1tFPbCw3Oe
+NcJxVX6B+6tGUODBfEl45qt5WDza/3wcn9iXAng+a0EE6UG9vgMsRfYvZNSrXaNH
+PWSb6WiaxswbP7q+sos0Ai6YVRn8jG+qX9pMzk0DIaPY0jSTVpbLTAwAFjxfGs3I
+x2ymrdMxp7zo5eFm1tL7A7RBZckQrg4FY8aAamkw/dLukO8NJ9+flXP04SXabBbe
+QTg06ov80egEFGEtQX6sx3dOy1FU+16SGBsEWmjGycT6txOgmLcRK7fWV8x8nhfR
+yyX+hk4kLlYMeE2eARKmK6cBZW58Yh2EhN/qwGu1pSqVg8NTEQxzHQuyRpDRQjrO
+QG6Vrf/GlK1ul4SOfW+eioANSW1z4nuSHsPzwfPrLgVv2RvPN3YEyLRa5Beny912
+H9AZdugsBbPWnDTYltxhh5EF5EQIM8HauQhl1K6yNg3ruji6DOWbnuuNZt2Zz9aJ
+QfYEkoopKW1rOhzndX0CcQ7zwOe9yxndnWCywmZgtrEE7snmhrmaZkCo5xHtgUUD
+i/ZnWejBBhG93c+AAk9lQHhcR1DIm+YfgXvkRKhbhZri3lrVx/k6RGZL5DJUfORs
+nLMOPReisjQS1n6yqEm70XooQL6iFh/f5DcfEXP7kAplQ6INfPgGAVUzfbANuPT1
+rqVCV3w2EYx7XsQDnYx5nQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1Ud
+DwEB/wQEAwIBBjAdBgNVHQ4EFgQUtZn4r7CU9eMg1gqtzk5WpC5uQu0wDQYJKoZI
+hvcNAQELBQADggIBACYGXnDnZTPIgm7ZnBc6G3pmsgH2eDtpXi/q/075KMOYKmFM
+tCQSin1tERT3nLXK5ryeJ45MGcipvXrA1zYObYVybqjGom32+nNjf7xueQgcnYqf
+GopTpti72TVVsRHFqQOzVju5hJMiXn7B9hJSi+osZ7z+Nkz1uM/Rs0mSO9MpDpkb
+lvdhuDvEK7Z4bLQjb/D907JedR+Zlais9trhxTF7+9FGs9K8Z7RiVLoJ92Owk6Ka
++elSLotgEqv89WBW7xBci8QaQtyDW2QOy7W81k/BfDxujRNt+3vrMNDcTa/F1bal
+TFtxyegxvug4BkihGuLq0t4SOVga/4AOgnXmt8kHbA7v/zjxmHHEt38OFdAlab0i
+nSvtBfZGR6ztwPDUO+Ls7pZbkBNOHlY667DvlruWIxG68kOGdGSVyCh13x01utI3
+gzhTODY7z2zp+WsO0PsE6E9312UBeIYMej4hYvF/Y3EMyZ9E26gnonW+boE+18Dr
+G5gPcFw0sorMwIUY6256s/daoQe/qUKS82Ail+QUoQebTnbAjn39pCXHR+3/H3Os
+zMOl6W8KjptlwlCFtaOgUxLMVYdh84GuEEZhvUQhuMI9dM9+JDX6HAcOmz0iyu8x
+L4ysEr3vQCj8KWefshNPZiTEUxnpHikV7+ZtsH8tZ/3zbBt1RqPlShfppNcL
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDODCCAiCgAwIBAgIGIAYFFnACMA0GCSqGSIb3DQEBBQUAMDsxCzAJBgNVBAYT
+AlJPMREwDwYDVQQKEwhjZXJ0U0lHTjEZMBcGA1UECxMQY2VydFNJR04gUk9PVCBD
+QTAeFw0wNjA3MDQxNzIwMDRaFw0zMTA3MDQxNzIwMDRaMDsxCzAJBgNVBAYTAlJP
+MREwDwYDVQQKEwhjZXJ0U0lHTjEZMBcGA1UECxMQY2VydFNJR04gUk9PVCBDQTCC
+ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALczuX7IJUqOtdu0KBuqV5Do
+0SLTZLrTk+jUrIZhQGpgV2hUhE28alQCBf/fm5oqrl0Hj0rDKH/v+yv6efHHrfAQ
+UySQi2bJqIirr1qjAOm+ukbuW3N7LBeCgV5iLKECZbO9xSsAfsT8AzNXDe3i+s5d
+RdY4zTW2ssHQnIFKquSyAVwdj1+ZxLGt24gh65AIgoDzMKND5pCCrlUoSe1b16kQ
+OA7+j0xbm0bqQfWwCHTD0IgztnzXdN/chNFDDnU5oSVAKOp4yw4sLjmdjItuFhwv
+JoIQ4uNllAoEwF73XVv4EOLQunpL+943AAAaWyjj0pxzPjKHmKHJUS/X3qwzs08C
+AwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAcYwHQYDVR0O
+BBYEFOCMm9slSbPxfIbWskKHC9BroNnkMA0GCSqGSIb3DQEBBQUAA4IBAQA+0hyJ
+LjX8+HXd5n9liPRyTMks1zJO890ZeUe9jjtbkw9QSSQTaxQGcu8J06Gh40CEyecY
+MnQ8SG4Pn0vU9x7Tk4ZkVJdjclDVVc/6IJMCopvDI5NOFlV2oHB5bc0hH88vLbwZ
+44gx+FkagQnIl6Z0x2DEW8xXjrJ1/RsCCdtZb3KTafcxQdaIOL+Hsr0Wefmq5L6I
+Jd1hJyMctTEHBDa0GpC9oHRxUIltvBTjD4au8as+x6AJzKNI0eDbZOeStc+vckNw
+i/nDhDwTqn6Sm1dTk/pwwpEOMfmbZ13pljheX7NzTogVZ96edhBiIL5VaZVDADlN
+9u6wWk5JRFRYX0KD
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDuzCCAqOgAwIBAgIDBETAMA0GCSqGSIb3DQEBBQUAMH4xCzAJBgNVBAYTAlBM
+MSIwIAYDVQQKExlVbml6ZXRvIFRlY2hub2xvZ2llcyBTLkEuMScwJQYDVQQLEx5D
+ZXJ0dW0gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIjAgBgNVBAMTGUNlcnR1bSBU
+cnVzdGVkIE5ldHdvcmsgQ0EwHhcNMDgxMDIyMTIwNzM3WhcNMjkxMjMxMTIwNzM3
+WjB+MQswCQYDVQQGEwJQTDEiMCAGA1UEChMZVW5pemV0byBUZWNobm9sb2dpZXMg
+Uy5BLjEnMCUGA1UECxMeQ2VydHVtIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSIw
+IAYDVQQDExlDZXJ0dW0gVHJ1c3RlZCBOZXR3b3JrIENBMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEA4/t9o3K6wvDJFIf1awFO4W5AB7ptJ11/91sts1rH
+UV+rpDKmYYe2bg+G0jACl/jXaVehGDldamR5xgFZrDwxSjh80gTSSyjoIF87B6LM
+TXPb865Px1bVWqeWifrzq2jUI4ZZJ88JJ7ysbnKDHDBy3+Ci6dLhdHUZvSqeexVU
+BBvXQzmtVSjF4hq79MDkrjhJM8x2hZ85RdKknvISjFH4fOQtf/WsX+sWn7Et0brM
+kUJ3TCXJkDhv2/DM+44el1k+1WBO5gUo7Ul5E0u6SNsv+XLTOcr+H9g0cvW0QM8x
+AcPs3hEtF10fuFDRXhmnad4HMyjKUJX5p1TLVIZQRan5SQIDAQABo0IwQDAPBgNV
+HRMBAf8EBTADAQH/MB0GA1UdDgQWBBQIds3LB/8k9sXN7buQvOKEN0Z19zAOBgNV
+HQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQEFBQADggEBAKaorSLOAT2mo/9i0Eidi15y
+sHhE49wcrwn9I0j6vSrEuVUEtRCjjSfeC4Jj0O7eDDd5QVsisrCaQVymcODU0HfL
+I9MA4GxWL+FpDQ3Zqr8hgVDZBqWo/5U30Kr+4rP1mS1FhIrlQgnXdAIv94nYmem8
+J9RHjboNRhx3zxSkHLmkMcScKHQDNP8zGSal6Q10tz6XxnboJ5ajZt3hrvJBW8qY
+VoNzcOSGGtIxQbovvi0TWnZvTuhOgQ4/WwMioBK+ZlgRSssDxLQqKi2WF+A5VLxI
+03YnnZotBqbJ7DnSq9ufmgsnAjUpsUCV5/nonFWIGUbWtzT1fs45mtk48VH3Tyw=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFgjCCA2qgAwIBAgILWku9WvtPilv6ZeUwDQYJKoZIhvcNAQELBQAwTTELMAkG
+A1UEBhMCQVQxIzAhBgNVBAoTGmUtY29tbWVyY2UgbW9uaXRvcmluZyBHbWJIMRkw
+FwYDVQQDExBHTE9CQUxUUlVTVCAyMDIwMB4XDTIwMDIxMDAwMDAwMFoXDTQwMDYx
+MDAwMDAwMFowTTELMAkGA1UEBhMCQVQxIzAhBgNVBAoTGmUtY29tbWVyY2UgbW9u
+aXRvcmluZyBHbWJIMRkwFwYDVQQDExBHTE9CQUxUUlVTVCAyMDIwMIICIjANBgkq
+hkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAri5WrRsc7/aVj6B3GyvTY4+ETUWiD59b
+RatZe1E0+eyLinjF3WuvvcTfk0Uev5E4C64OFudBc/jbu9G4UeDLgztzOG53ig9Z
+YybNpyrOVPu44sB8R85gfD+yc/LAGbaKkoc1DZAoouQVBGM+uq/ufF7MpotQsjj3
+QWPKzv9pj2gOlTblzLmMCcpL3TGQlsjMH/1WljTbjhzqLL6FLmPdqqmV0/0plRPw
+yJiT2S0WR5ARg6I6IqIoV6Lr/sCMKKCmfecqQjuCgGOlYx8ZzHyyZqjC0203b+J+
+BlHZRYQfEs4kUmSFC0iAToexIiIwquuuvuAC4EDosEKAA1GqtH6qRNdDYfOiaxaJ
+SaSjpCuKAsR49GiKweR6NrFvG5Ybd0mN1MkGco/PU+PcF4UgStyYJ9ORJitHHmkH
+r96i5OTUawuzXnzUJIBHKWk7buis/UDr2O1xcSvy6Fgd60GXIsUf1DnQJ4+H4xj0
+4KlGDfV0OoIu0G4skaMxXDtG6nsEEFZegB31pWXogvziB4xiRfUg3kZwhqG8k9Me
+dKZssCz3AwyIDMvUclOGvGBG85hqwvG/Q/lwIHfKN0F5VVJjjVsSn8VoxIidrPIw
+q7ejMZdnrY8XD2zHc+0klGvIg5rQmjdJBKuxFshsSUktq6HQjJLyQUp5ISXbY9e2
+nKd+Qmn7OmMCAwEAAaNjMGEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC
+AQYwHQYDVR0OBBYEFNwuH9FhN3nkq9XVsxJxaD1qaJwiMB8GA1UdIwQYMBaAFNwu
+H9FhN3nkq9XVsxJxaD1qaJwiMA0GCSqGSIb3DQEBCwUAA4ICAQCR8EICaEDuw2jA
+VC/f7GLDw56KoDEoqoOOpFaWEhCGVrqXctJUMHytGdUdaG/7FELYjQ7ztdGl4wJC
+XtzoRlgHNQIw4Lx0SsFDKv/bGtCwr2zD/cuz9X9tAy5ZVp0tLTWMstZDFyySCstd
+6IwPS3BD0IL/qMy/pJTAvoe9iuOTe8aPmxadJ2W8esVCgmxcB9CpwYhgROmYhRZf
++I/KARDOJcP5YBugxZfD0yyIMaK9MOzQ0MAS8cE54+X1+NZK3TTN+2/BT+MAi1bi
+kvcoskJ3ciNnxz8RFbLEAwW+uxF7Cr+obuf/WEPPm2eggAe2HcqtbepBEX4tdJP7
+wry+UUTF72glJ4DjyKDUEuzZpTcdN3y0kcra1LGWge9oXHYQSa9+pTeAsRxSvTOB
+TI/53WXZFM2KJVj04sWDpQmQ1GwUY7VA3+vA/MRYfg0UFodUJ25W5HCEuGwyEn6C
+MUO+1918oa2u1qsgEu8KwxCMSZY13At1XrFP1U80DhEgB3VDRemjEdqso5nCtnkn
+4rnvyOL2NSl6dPrFf4IFYqYK6miyeUcGbvJXqBUzxvd4Sj1Ce2t+/vdG6tHrju+I
+aFvowdlxfv1k7/9nR4hYJS8+hge9+6jlgqispdNpQ80xiEmEU5LAsTkbOYMBMMTy
+qfrQA71yN2BWHzZ8vTmR9W0Nv3vXkg==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIEHTCCAwWgAwIBAgIQToEtioJl4AsC7j41AkblPTANBgkqhkiG9w0BAQUFADCB
+gTELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G
+A1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxJzAlBgNV
+BAMTHkNPTU9ETyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNjEyMDEwMDAw
+MDBaFw0yOTEyMzEyMzU5NTlaMIGBMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3Jl
+YXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01P
+RE8gQ0EgTGltaXRlZDEnMCUGA1UEAxMeQ09NT0RPIENlcnRpZmljYXRpb24gQXV0
+aG9yaXR5MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0ECLi3LjkRv3
+UcEbVASY06m/weaKXTuH+7uIzg3jLz8GlvCiKVCZrts7oVewdFFxze1CkU1B/qnI
+2GqGd0S7WWaXUF601CxwRM/aN5VCaTwwxHGzUvAhTaHYujl8HJ6jJJ3ygxaYqhZ8
+Q5sVW7euNJH+1GImGEaaP+vB+fGQV+useg2L23IwambV4EajcNxo2f8ESIl33rXp
++2dtQem8Ob0y2WIC8bGoPW43nOIv4tOiJovGuFVDiOEjPqXSJDlqR6sA1KGzqSX+
+DT+nHbrTUcELpNqsOO9VUCQFZUaTNE8tja3G1CEZ0o7KBWFxB3NH5YoZEr0ETc5O
+nKVIrLsm9wIDAQABo4GOMIGLMB0GA1UdDgQWBBQLWOWLxkwVN6RAqTCpIb5HNlpW
+/zAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zBJBgNVHR8EQjBAMD6g
+PKA6hjhodHRwOi8vY3JsLmNvbW9kb2NhLmNvbS9DT01PRE9DZXJ0aWZpY2F0aW9u
+QXV0aG9yaXR5LmNybDANBgkqhkiG9w0BAQUFAAOCAQEAPpiem/Yb6dc5t3iuHXIY
+SdOH5EOC6z/JqvWote9VfCFSZfnVDeFs9D6Mk3ORLgLETgdxb8CPOGEIqB6BCsAv
+IC9Bi5HcSEW88cbeunZrM8gALTFGTO3nnc+IlP8zwFboJIYmuNg4ON8qa90SzMc/
+RxdMosIGlgnW2/4/PEZB31jiVg88O8EckzXZOFKs7sjsLjBOlDW0JB9LeGna8gI4
+zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd
+BA6+C4OmF4O5MBKgxTMVBbkN+8cFduPYSo38NBejxiEovjBFMR7HeL5YYTisO+IB
+ZQ==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICiTCCAg+gAwIBAgIQH0evqmIAcFBUTAGem2OZKjAKBggqhkjOPQQDAzCBhTEL
+MAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UE
+BxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxKzApBgNVBAMT
+IkNPTU9ETyBFQ0MgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDgwMzA2MDAw
+MDAwWhcNMzgwMTE4MjM1OTU5WjCBhTELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdy
+ZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09N
+T0RPIENBIExpbWl0ZWQxKzApBgNVBAMTIkNPTU9ETyBFQ0MgQ2VydGlmaWNhdGlv
+biBBdXRob3JpdHkwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQDR3svdcmCFYX7deSR
+FtSrYpn1PlILBs5BAH+X4QokPB0BBO490o0JlwzgdeT6+3eKKvUDYEs2ixYjFq0J
+cfRK9ChQtP6IHG4/bC8vCVlbpVsLM5niwz2J+Wos77LTBumjQjBAMB0GA1UdDgQW
+BBR1cacZSBm8nZ3qQUfflMRId5nTeTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/
+BAUwAwEB/zAKBggqhkjOPQQDAwNoADBlAjEA7wNbeqy3eApyt4jf/7VGFAkK+qDm
+fQjGGoe9GKhzvSbKYAydzpmfz1wPMOG+FDHqAjAU9JM8SaczepBGR7NjfRObTrdv
+GDeAU/7dIOA1mjbRxwG55tzd8/8dLDoWV9mSOdY=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIEMzCCAxugAwIBAgIDCYPzMA0GCSqGSIb3DQEBCwUAME0xCzAJBgNVBAYTAkRF
+MRUwEwYDVQQKDAxELVRydXN0IEdtYkgxJzAlBgNVBAMMHkQtVFJVU1QgUm9vdCBD
+bGFzcyAzIENBIDIgMjAwOTAeFw0wOTExMDUwODM1NThaFw0yOTExMDUwODM1NTha
+ME0xCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0IEdtYkgxJzAlBgNVBAMM
+HkQtVFJVU1QgUm9vdCBDbGFzcyAzIENBIDIgMjAwOTCCASIwDQYJKoZIhvcNAQEB
+BQADggEPADCCAQoCggEBANOySs96R+91myP6Oi/WUEWJNTrGa9v+2wBoqOADER03
+UAifTUpolDWzU9GUY6cgVq/eUXjsKj3zSEhQPgrfRlWLJ23DEE0NkVJD2IfgXU42
+tSHKXzlABF9bfsyjxiupQB7ZNoTWSPOSHjRGICTBpFGOShrvUD9pXRl/RcPHAY9R
+ySPocq60vFYJfxLLHLGvKZAKyVXMD9O0Gu1HNVpK7ZxzBCHQqr0ME7UAyiZsxGsM
+lFqVlNpQmvH/pStmMaTJOKDfHR+4CS7zp+hnUquVH+BGPtikw8paxTGA6Eian5Rp
+/hnd2HN8gcqW3o7tszIFZYQ05ub9VxC1X3a/L7AQDcUCAwEAAaOCARowggEWMA8G
+A1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFP3aFMSfMN4hvR5COfyrYyNJ4PGEMA4G
+A1UdDwEB/wQEAwIBBjCB0wYDVR0fBIHLMIHIMIGAoH6gfIZ6bGRhcDovL2RpcmVj
+dG9yeS5kLXRydXN0Lm5ldC9DTj1ELVRSVVNUJTIwUm9vdCUyMENsYXNzJTIwMyUy
+MENBJTIwMiUyMDIwMDksTz1ELVRydXN0JTIwR21iSCxDPURFP2NlcnRpZmljYXRl
+cmV2b2NhdGlvbmxpc3QwQ6BBoD+GPWh0dHA6Ly93d3cuZC10cnVzdC5uZXQvY3Js
+L2QtdHJ1c3Rfcm9vdF9jbGFzc18zX2NhXzJfMjAwOS5jcmwwDQYJKoZIhvcNAQEL
+BQADggEBAH+X2zDI36ScfSF6gHDOFBJpiBSVYEQBrLLpME+bUMJm2H6NMLVwMeni
+acfzcNsgFYbQDfC+rAF1hM5+n02/t2A7nPPKHeJeaNijnZflQGDSNiH+0LS4F9p0
+o3/U37CYAqxva2ssJSRyoWXuJVrl5jLn8t+rSfrzkGkj2wTZ51xY/GXUl77M/C4K
+zCUqNQT4YJEVdT1B/yMfGchs64JTBKbkTCJNjYy6zltz7GRUUG3RnFX7acM2w4y8
+PIWmawomDeCTmGCufsYkl4phX5GOZpIJhzbNi5stPvZR1FDUWSi9g/LMKHtThm3Y
+Johw1+qRzT65ysCQblrGXnRl11z+o+I=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIEQzCCAyugAwIBAgIDCYP0MA0GCSqGSIb3DQEBCwUAMFAxCzAJBgNVBAYTAkRF
+MRUwEwYDVQQKDAxELVRydXN0IEdtYkgxKjAoBgNVBAMMIUQtVFJVU1QgUm9vdCBD
+bGFzcyAzIENBIDIgRVYgMjAwOTAeFw0wOTExMDUwODUwNDZaFw0yOTExMDUwODUw
+NDZaMFAxCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0IEdtYkgxKjAoBgNV
+BAMMIUQtVFJVU1QgUm9vdCBDbGFzcyAzIENBIDIgRVYgMjAwOTCCASIwDQYJKoZI
+hvcNAQEBBQADggEPADCCAQoCggEBAJnxhDRwui+3MKCOvXwEz75ivJn9gpfSegpn
+ljgJ9hBOlSJzmY3aFS3nBfwZcyK3jpgAvDw9rKFs+9Z5JUut8Mxk2og+KbgPCdM0
+3TP1YtHhzRnp7hhPTFiu4h7WDFsVWtg6uMQYZB7jM7K1iXdODL/ZlGsTl28So/6Z
+qQTMFexgaDbtCHu39b+T7WYxg4zGcTSHThfqr4uRjRxWQa4iN1438h3Z0S0NL2lR
+p75mpoo6Kr3HGrHhFPC+Oh25z1uxav60sUYgovseO3Dvk5h9jHOW8sXvhXCtKSb8
+HgQ+HKDYD8tSg2J87otTlZCpV6LqYQXY+U3EJ/pure3511H3a6UCAwEAAaOCASQw
+ggEgMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFNOUikxiEyoZLsyvcop9Ntea
+HNxnMA4GA1UdDwEB/wQEAwIBBjCB3QYDVR0fBIHVMIHSMIGHoIGEoIGBhn9sZGFw
+Oi8vZGlyZWN0b3J5LmQtdHJ1c3QubmV0L0NOPUQtVFJVU1QlMjBSb290JTIwQ2xh
+c3MlMjAzJTIwQ0ElMjAyJTIwRVYlMjAyMDA5LE89RC1UcnVzdCUyMEdtYkgsQz1E
+RT9jZXJ0aWZpY2F0ZXJldm9jYXRpb25saXN0MEagRKBChkBodHRwOi8vd3d3LmQt
+dHJ1c3QubmV0L2NybC9kLXRydXN0X3Jvb3RfY2xhc3NfM19jYV8yX2V2XzIwMDku
+Y3JsMA0GCSqGSIb3DQEBCwUAA4IBAQA07XtaPKSUiO8aEXUHL7P+PPoeUSbrh/Yp
+3uDx1MYkCenBz1UbtDDZzhr+BlGmFaQt77JLvyAoJUnRpjZ3NOhk31KxEcdzes05
+nsKtjHEh8lprr988TlWvsoRlFIm5d8sqMb7Po23Pb0iUMkZv53GMoKaEGTcH8gNF
+CSuGdXzfX2lXANtu2KZyIktQ1HWYVt+3GP9DQ1CuekR78HlR10M9p9OB0/DJT7na
+xpeG0ILD5EJt/rDiZE4OJudANCa1CInXCGNjOCd1HjPqbqjdn5lPdE2BiYBL3ZqX
+KVwvvoFBuYz/6n1gBp7N1z3TLqMVvKjmJuVvw9y4AyHqnxbxLFS1
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIEkTCCA3mgAwIBAgIERWtQVDANBgkqhkiG9w0BAQUFADCBsDELMAkGA1UEBhMC
+VVMxFjAUBgNVBAoTDUVudHJ1c3QsIEluYy4xOTA3BgNVBAsTMHd3dy5lbnRydXN0
+Lm5ldC9DUFMgaXMgaW5jb3Jwb3JhdGVkIGJ5IHJlZmVyZW5jZTEfMB0GA1UECxMW
+KGMpIDIwMDYgRW50cnVzdCwgSW5jLjEtMCsGA1UEAxMkRW50cnVzdCBSb290IENl
+cnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTA2MTEyNzIwMjM0MloXDTI2MTEyNzIw
+NTM0MlowgbAxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1FbnRydXN0LCBJbmMuMTkw
+NwYDVQQLEzB3d3cuZW50cnVzdC5uZXQvQ1BTIGlzIGluY29ycG9yYXRlZCBieSBy
+ZWZlcmVuY2UxHzAdBgNVBAsTFihjKSAyMDA2IEVudHJ1c3QsIEluYy4xLTArBgNV
+BAMTJEVudHJ1c3QgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTCCASIwDQYJ
+KoZIhvcNAQEBBQADggEPADCCAQoCggEBALaVtkNC+sZtKm9I35RMOVcF7sN5EUFo
+Nu3s/poBj6E4KPz3EEZmLk0eGrEaTsbRwJWIsMn/MYszA9u3g3s+IIRe7bJWKKf4
+4LlAcTfFy0cOlypowCKVYhXbR9n10Cv/gkvJrT7eTNuQgFA/CYqEAOwwCj0Yzfv9
+KlmaI5UXLEWeH25DeW0MXJj+SKfFI0dcXv1u5x609mhF0YaDW6KKjbHjKYD+JXGI
+rb68j6xSlkuqUY3kEzEZ6E5Nn9uss2rVvDlUccp6en+Q3X0dgNmBu1kmwhH+5pPi
+94DkZfs0Nw4pgHBNrziGLp5/V6+eF67rHMsoIV+2HNjnogQi+dPa2MsCAwEAAaOB
+sDCBrTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zArBgNVHRAEJDAi
+gA8yMDA2MTEyNzIwMjM0MlqBDzIwMjYxMTI3MjA1MzQyWjAfBgNVHSMEGDAWgBRo
+kORnpKZTgMeGZqTx90tD+4S9bTAdBgNVHQ4EFgQUaJDkZ6SmU4DHhmak8fdLQ/uE
+vW0wHQYJKoZIhvZ9B0EABBAwDhsIVjcuMTo0LjADAgSQMA0GCSqGSIb3DQEBBQUA
+A4IBAQCT1DCw1wMgKtD5Y+iRDAUgqV8ZyntyTtSx29CW+1RaGSwMCPeyvIWonX9t
+O1KzKtvn1ISMY/YPyyYBkVBs9F8U4pN0wBOeMDpQ47RgxRzwIkSNcUesyBrJ6Zua
+AGAT/3B+XxFNSRuzFVJ7yVTav52Vr2ua2J7p8eRDjeIRRDq/r72DQnNSi6q7pynP
+9WQcCk3RvKqsnyrQ/39/2n3qse0wJcGE2jTSW3iDVuycNsMm4hH2Z0kdkquM++v/
+eu6FSqdQgPCnXEqULl8FmTxSQeDNtGPPAUO6nIPcj2A781q0tHuu2guQOHXvgR1m
+0vdXcDazv/wor3ElhVsT/h5/WrQ8
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIEKjCCAxKgAwIBAgIEOGPe+DANBgkqhkiG9w0BAQUFADCBtDEUMBIGA1UEChML
+RW50cnVzdC5uZXQxQDA+BgNVBAsUN3d3dy5lbnRydXN0Lm5ldC9DUFNfMjA0OCBp
+bmNvcnAuIGJ5IHJlZi4gKGxpbWl0cyBsaWFiLikxJTAjBgNVBAsTHChjKSAxOTk5
+IEVudHJ1c3QubmV0IExpbWl0ZWQxMzAxBgNVBAMTKkVudHJ1c3QubmV0IENlcnRp
+ZmljYXRpb24gQXV0aG9yaXR5ICgyMDQ4KTAeFw05OTEyMjQxNzUwNTFaFw0yOTA3
+MjQxNDE1MTJaMIG0MRQwEgYDVQQKEwtFbnRydXN0Lm5ldDFAMD4GA1UECxQ3d3d3
+LmVudHJ1c3QubmV0L0NQU18yMDQ4IGluY29ycC4gYnkgcmVmLiAobGltaXRzIGxp
+YWIuKTElMCMGA1UECxMcKGMpIDE5OTkgRW50cnVzdC5uZXQgTGltaXRlZDEzMDEG
+A1UEAxMqRW50cnVzdC5uZXQgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgKDIwNDgp
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArU1LqRKGsuqjIAcVFmQq
+K0vRvwtKTY7tgHalZ7d4QMBzQshowNtTK91euHaYNZOLGp18EzoOH1u3Hs/lJBQe
+sYGpjX24zGtLA/ECDNyrpUAkAH90lKGdCCmziAv1h3edVc3kw37XamSrhRSGlVuX
+MlBvPci6Zgzj/L24ScF2iUkZ/cCovYmjZy/Gn7xxGWC4LeksyZB2ZnuU4q941mVT
+XTzWnLLPKQP5L6RQstRIzgUyVYr9smRMDuSYB3Xbf9+5CFVghTAp+XtIpGmG4zU/
+HoZdenoVve8AjhUiVBcAkCaTvA5JaJG/+EfTnZVCwQ5N328mz8MYIWJmQ3DW1cAH
+4QIDAQABo0IwQDAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNV
+HQ4EFgQUVeSB0RGAvtiJuQijMfmhJAkWuXAwDQYJKoZIhvcNAQEFBQADggEBADub
+j1abMOdTmXx6eadNl9cZlZD7Bh/KM3xGY4+WZiT6QBshJ8rmcnPyT/4xmf3IDExo
+U8aAghOY+rat2l098c5u9hURlIIM7j+VrxGrD9cv3h8Dj1csHsm7mhpElesYT6Yf
+zX1XEC+bBAlahLVu2B064dae0Wx5XnkcFMXj0EyTO2U87d89vqbllRrDtRnDvV5b
+u/8j72gZyxKTJ1wDLW8w0B62GqzeWvfRqqgnpv55gcR5mTNXuhKwqeBCbJPKVt7+
+bYQLCIt+jerXmCHG8+c8eS9enNFMFY3h7CI3zJpDC5fcgJCNs2ebb0gIFVbPv/Er
+fF6adulZkMV8gzURZVE=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFsDCCA5igAwIBAgIQFci9ZUdcr7iXAF7kBtK8nTANBgkqhkiG9w0BAQUFADBe
+MQswCQYDVQQGEwJUVzEjMCEGA1UECgwaQ2h1bmdod2EgVGVsZWNvbSBDby4sIEx0
+ZC4xKjAoBgNVBAsMIWVQS0kgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAe
+Fw0wNDEyMjAwMjMxMjdaFw0zNDEyMjAwMjMxMjdaMF4xCzAJBgNVBAYTAlRXMSMw
+IQYDVQQKDBpDaHVuZ2h3YSBUZWxlY29tIENvLiwgTHRkLjEqMCgGA1UECwwhZVBL
+SSBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIICIjANBgkqhkiG9w0BAQEF
+AAOCAg8AMIICCgKCAgEA4SUP7o3biDN1Z82tH306Tm2d0y8U82N0ywEhajfqhFAH
+SyZbCUNsIZ5qyNUD9WBpj8zwIuQf5/dqIjG3LBXy4P4AakP/h2XGtRrBp0xtInAh
+ijHyl3SJCRImHJ7K2RKilTza6We/CKBk49ZCt0Xvl/T29de1ShUCWH2YWEtgvM3X
+DZoTM1PRYfl61dd4s5oz9wCGzh1NlDivqOx4UXCKXBCDUSH3ET00hl7lSM2XgYI1
+TBnsZfZrxQWh7kcT1rMhJ5QQCtkkO7q+RBNGMD+XPNjX12ruOzjjK9SXDrkb5wdJ
+fzcq+Xd4z1TtW0ado4AOkUPB1ltfFLqfpo0kR0BZv3I4sjZsN/+Z0V0OWQqraffA
+sgRFelQArr5T9rXn4fg8ozHSqf4hUmTFpmfwdQcGlBSBVcYn5AGPF8Fqcde+S/uU
+WH1+ETOxQvdibBjWzwloPn9s9h6PYq2lY9sJpx8iQkEeb5mKPtf5P0B6ebClAZLS
+nT0IFaUQAS2zMnaolQ2zepr7BxB4EW/hj8e6DyUadCrlHJhBmd8hh+iVBmoKs2pH
+dmX2Os+PYhcZewoozRrSgx4hxyy/vv9haLdnG7t4TY3OZ+XkwY63I2binZB1NJip
+NiuKmpS5nezMirH4JYlcWrYvjB9teSSnUmjDhDXiZo1jDiVN1Rmy5nk3pyKdVDEC
+AwEAAaNqMGgwHQYDVR0OBBYEFB4M97Zn8uGSJglFwFU5Lnc/QkqiMAwGA1UdEwQF
+MAMBAf8wOQYEZyoHAAQxMC8wLQIBADAJBgUrDgMCGgUAMAcGBWcqAwAABBRFsMLH
+ClZ87lt4DJX5GFPBphzYEDANBgkqhkiG9w0BAQUFAAOCAgEACbODU1kBPpVJufGB
+uvl2ICO1J2B01GqZNF5sAFPZn/KmsSQHRGoqxqWOeBLoR9lYGxMqXnmbnwoqZ6Yl
+PwZpVnPDimZI+ymBV3QGypzqKOg4ZyYr8dW1P2WT+DZdjo2NQCCHGervJ8A9tDkP
+JXtoUHRVnAxZfVo9QZQlUgjgRywVMRnVvwdVxrsStZf0X4OFunHB2WyBEXYKCrC/
+gpf36j36+uwtqSiUO1bd0lEursC9CBWMd1I0ltabrNMdjmEPNXubrjlpC2JgQCA2
+j6/7Nu4tCEoduL+bXPjqpRugc6bY+G7gMwRfaKonh+3ZwZCc7b3jajWvY9+rGNm6
+5ulK6lCKD2GTHuItGeIwlDWSXQ62B68ZgI9HkFFLLk3dheLSClIKF5r8GrBQAuUB
+o2M3IUxExJtRmREOc5wGj1QupyheRDmHVi03vYVElOEMSyycw5KFNGHLD7ibSkNS
+/jQ6fbjpKdx2qcgw+BRxgMYeNkh0IkFch4LoGHGLQYlE535YW6i4jRPpp2zDR+2z
+Gp1iro2C6pSe3VkQw63d4k3jMdXH7OjysP6SHhYKGvzZ8/gntsm+HbRsZJB/9OTE
+W9c3rkIO3aQab3yIVMUWbuF6aC74Or8NpDyJO3inTmODBCEIZ43ygknQW/2xzQ+D
+hNQ+IIX3Sj0rnP0qCglN6oH4EZw=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIGSzCCBDOgAwIBAgIIamg+nFGby1MwDQYJKoZIhvcNAQELBQAwgbIxCzAJBgNV
+BAYTAlRSMQ8wDQYDVQQHDAZBbmthcmExQDA+BgNVBAoMN0UtVHXEn3JhIEVCRyBC
+aWxpxZ9pbSBUZWtub2xvamlsZXJpIHZlIEhpem1ldGxlcmkgQS7Fni4xJjAkBgNV
+BAsMHUUtVHVncmEgU2VydGlmaWthc3lvbiBNZXJrZXppMSgwJgYDVQQDDB9FLVR1
+Z3JhIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTEzMDMwNTEyMDk0OFoXDTIz
+MDMwMzEyMDk0OFowgbIxCzAJBgNVBAYTAlRSMQ8wDQYDVQQHDAZBbmthcmExQDA+
+BgNVBAoMN0UtVHXEn3JhIEVCRyBCaWxpxZ9pbSBUZWtub2xvamlsZXJpIHZlIEhp
+em1ldGxlcmkgQS7Fni4xJjAkBgNVBAsMHUUtVHVncmEgU2VydGlmaWthc3lvbiBN
+ZXJrZXppMSgwJgYDVQQDDB9FLVR1Z3JhIENlcnRpZmljYXRpb24gQXV0aG9yaXR5
+MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA4vU/kwVRHoViVF56C/UY
+B4Oufq9899SKa6VjQzm5S/fDxmSJPZQuVIBSOTkHS0vdhQd2h8y/L5VMzH2nPbxH
+D5hw+IyFHnSOkm0bQNGZDbt1bsipa5rAhDGvykPL6ys06I+XawGb1Q5KCKpbknSF
+Q9OArqGIW66z6l7LFpp3RMih9lRozt6Plyu6W0ACDGQXwLWTzeHxE2bODHnv0ZEo
+q1+gElIwcxmOj+GMB6LDu0rw6h8VqO4lzKRG+Bsi77MOQ7osJLjFLFzUHPhdZL3D
+k14opz8n8Y4e0ypQBaNV2cvnOVPAmJ6MVGKLJrD3fY185MaeZkJVgkfnsliNZvcH
+fC425lAcP9tDJMW/hkd5s3kc91r0E+xs+D/iWR+V7kI+ua2oMoVJl0b+SzGPWsut
+dEcf6ZG33ygEIqDUD13ieU/qbIWGvaimzuT6w+Gzrt48Ue7LE3wBf4QOXVGUnhMM
+ti6lTPk5cDZvlsouDERVxcr6XQKj39ZkjFqzAQqptQpHF//vkUAqjqFGOjGY5RH8
+zLtJVor8udBhmm9lbObDyz51Sf6Pp+KJxWfXnUYTTjF2OySznhFlhqt/7x3U+Lzn
+rFpct1pHXFXOVbQicVtbC/DP3KBhZOqp12gKY6fgDT+gr9Oq0n7vUaDmUStVkhUX
+U8u3Zg5mTPj5dUyQ5xJwx0UCAwEAAaNjMGEwHQYDVR0OBBYEFC7j27JJ0JxUeVz6
+Jyr+zE7S6E5UMA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAULuPbsknQnFR5
+XPonKv7MTtLoTlQwDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4ICAQAF
+Nzr0TbdF4kV1JI+2d1LoHNgQk2Xz8lkGpD4eKexd0dCrfOAKkEh47U6YA5n+KGCR
+HTAduGN8qOY1tfrTYXbm1gdLymmasoR6d5NFFxWfJNCYExL/u6Au/U5Mh/jOXKqY
+GwXgAEZKgoClM4so3O0409/lPun++1ndYYRP0lSWE2ETPo+Aab6TR7U1Q9Jauz1c
+77NCR807VRMGsAnb/WP2OogKmW9+4c4bU2pEZiNRCHu8W1Ki/QY3OEBhj0qWuJA3
++GbHeJAAFS6LrVE1Uweoa2iu+U48BybNCAVwzDk/dr2l02cmAYamU9JgO3xDf1WK
+vJUawSg5TB9D0pH0clmKuVb8P7Sd2nCcdlqMQ1DujjByTd//SffGqWfZbawCEeI6
+FiWnWAjLb1NBnEg4R2gz0dfHj9R0IdTDBZB6/86WiLEVKV0jq9BgoRJP3vQXzTLl
+yb/IQ639Lo7xr+L0mPoSHyDYwKcMhcWQ9DstliaxLL5Mq+ux0orJ23gTDx4JnW2P
+AJ8C2sH6H3p6CcRK5ogql5+Ji/03X186zjhZhkuvcQu02PJwT58yE+Owp1fl2tpD
+y4Q08ijE6m30Ku/Ba3ba+367hTzSU8JNvnHhRdH9I2cNE3X7z2VnIp2usAnRCf8d
+NL/+I5c30jn6PQ0GC7TbO6Orb1wdtn7os4I07QZcJA==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIBtjCCAVugAwIBAgITBmyf1XSXNmY/Owua2eiedgPySjAKBggqhkjOPQQDAjA5
+MQswCQYDVQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRkwFwYDVQQDExBBbWF6b24g
+Um9vdCBDQSAzMB4XDTE1MDUyNjAwMDAwMFoXDTQwMDUyNjAwMDAwMFowOTELMAkG
+A1UEBhMCVVMxDzANBgNVBAoTBkFtYXpvbjEZMBcGA1UEAxMQQW1hem9uIFJvb3Qg
+Q0EgMzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABCmXp8ZBf8ANm+gBG1bG8lKl
+ui2yEujSLtf6ycXYqm0fc4E7O5hrOXwzpcVOho6AF2hiRVd9RFgdszflZwjrZt6j
+QjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgGGMB0GA1UdDgQWBBSr
+ttvXBp43rDCGB5Fwx5zEGbF4wDAKBggqhkjOPQQDAgNJADBGAiEA4IWSoxe3jfkr
+BqWTrBqYaGFy+uGh0PsceGCmQ5nFuMQCIQCcAu/xlJyzlvnrxir4tiz+OpAUFteM
+YyRIHN8wfdVoOw==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFiDCCA3CgAwIBAgIIfQmX/vBH6nowDQYJKoZIhvcNAQELBQAwYjELMAkGA1UE
+BhMCQ04xMjAwBgNVBAoMKUdVQU5HIERPTkcgQ0VSVElGSUNBVEUgQVVUSE9SSVRZ
+IENPLixMVEQuMR8wHQYDVQQDDBZHRENBIFRydXN0QVVUSCBSNSBST09UMB4XDTE0
+MTEyNjA1MTMxNVoXDTQwMTIzMTE1NTk1OVowYjELMAkGA1UEBhMCQ04xMjAwBgNV
+BAoMKUdVQU5HIERPTkcgQ0VSVElGSUNBVEUgQVVUSE9SSVRZIENPLixMVEQuMR8w
+HQYDVQQDDBZHRENBIFRydXN0QVVUSCBSNSBST09UMIICIjANBgkqhkiG9w0BAQEF
+AAOCAg8AMIICCgKCAgEA2aMW8Mh0dHeb7zMNOwZ+Vfy1YI92hhJCfVZmPoiC7XJj
+Dp6L3TQsAlFRwxn9WVSEyfFrs0yw6ehGXTjGoqcuEVe6ghWinI9tsJlKCvLriXBj
+TnnEt1u9ol2x8kECK62pOqPseQrsXzrj/e+APK00mxqriCZ7VqKChh/rNYmDf1+u
+KU49tm7srsHwJ5uu4/Ts765/94Y9cnrrpftZTqfrlYwiOXnhLQiPzLyRuEH3FMEj
+qcOtmkVEs7LXLM3GKeJQEK5cy4KOFxg2fZfmiJqwTTQJ9Cy5WmYqsBebnh52nUpm
+MUHfP/vFBu8btn4aRjb3ZGM74zkYI+dndRTVdVeSN72+ahsmUPI2JgaQxXABZG12
+ZuGR224HwGGALrIuL4xwp9E7PLOR5G62xDtw8mySlwnNR30YwPO7ng/Wi64HtloP
+zgsMR6flPri9fcebNaBhlzpBdRfMK5Z3KpIhHtmVdiBnaM8Nvd/WHwlqmuLMc3Gk
+L30SgLdTMEZeS1SZD2fJpcjyIMGC7J0R38IC+xo70e0gmu9lZJIQDSri3nDxGGeC
+jGHeuLzRL5z7D9Ar7Rt2ueQ5Vfj4oR24qoAATILnsn8JuLwwoC8N9VKejveSswoA
+HQBUlwbgsQfZxw9cZX08bVlX5O2ljelAU58VS6Bx9hoh49pwBiFYFIeFd3mqgnkC
+AwEAAaNCMEAwHQYDVR0OBBYEFOLJQJ9NzuiaoXzPDj9lxSmIahlRMA8GA1UdEwEB
+/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4ICAQDRSVfg
+p8xoWLoBDysZzY2wYUWsEe1jUGn4H3++Fo/9nesLqjJHdtJnJO29fDMylyrHBYZm
+DRd9FBUb1Ov9H5r2XpdptxolpAqzkT9fNqyL7FeoPueBihhXOYV0GkLH6VsTX4/5
+COmSdI31R9KrO9b7eGZONn356ZLpBN79SWP8bfsUcZNnL0dKt7n/HipzcEYwv1ry
+L3ml4Y0M2fmyYzeMN2WFcGpcWwlyua1jPLHd+PwyvzeG5LuOmCd+uh8W4XAR8gPf
+JWIyJyYYMoSf/wA6E7qaTfRPuBRwIrHKK5DOKcFw9C+df/KQHtZa37dG/OaG+svg
+IHZ6uqbL9XzeYqWxi+7egmaKTjowHz+Ay60nugxe19CxVsp3cbK1daFQqUBDF8Io
+2c9Si1vIY9RCPqAzekYu9wogRlR+ak8x8YF+QnQ4ZXMn7sZ8uI7XpTrXmKGcjBBV
+09tL7ECQ8s1uV9JiDnxXk7Gnbc2dg7sq5+W2O3FYrf3RRbxake5TFW/TRQl1brqQ
+XR4EzzffHqhmsYzmIGrv/EhOdJhCrylvLmrH+33RZjEizIYAfmaDDEL0vTSSwxrq
+T8p+ck0LcIymSLumoRT2+1hEmRSuqguTaaApJUqlyyvdimYHFngVV3Eb7PVHhPOe
+MTd61X8kreS8/f3MboPoDKi3QWwH3b08hpcv0g==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFQTCCAymgAwIBAgITBmyf0pY1hp8KD+WGePhbJruKNzANBgkqhkiG9w0BAQwF
+ADA5MQswCQYDVQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRkwFwYDVQQDExBBbWF6
+b24gUm9vdCBDQSAyMB4XDTE1MDUyNjAwMDAwMFoXDTQwMDUyNjAwMDAwMFowOTEL
+MAkGA1UEBhMCVVMxDzANBgNVBAoTBkFtYXpvbjEZMBcGA1UEAxMQQW1hem9uIFJv
+b3QgQ0EgMjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK2Wny2cSkxK
+gXlRmeyKy2tgURO8TW0G/LAIjd0ZEGrHJgw12MBvIITplLGbhQPDW9tK6Mj4kHbZ
+W0/jTOgGNk3Mmqw9DJArktQGGWCsN0R5hYGCrVo34A3MnaZMUnbqQ523BNFQ9lXg
+1dKmSYXpN+nKfq5clU1Imj+uIFptiJXZNLhSGkOQsL9sBbm2eLfq0OQ6PBJTYv9K
+8nu+NQWpEjTj82R0Yiw9AElaKP4yRLuH3WUnAnE72kr3H9rN9yFVkE8P7K6C4Z9r
+2UXTu/Bfh+08LDmG2j/e7HJV63mjrdvdfLC6HM783k81ds8P+HgfajZRRidhW+me
+z/CiVX18JYpvL7TFz4QuK/0NURBs+18bvBt+xa47mAExkv8LV/SasrlX6avvDXbR
+8O70zoan4G7ptGmh32n2M8ZpLpcTnqWHsFcQgTfJU7O7f/aS0ZzQGPSSbtqDT6Zj
+mUyl+17vIWR6IF9sZIUVyzfpYgwLKhbcAS4y2j5L9Z469hdAlO+ekQiG+r5jqFoz
+7Mt0Q5X5bGlSNscpb/xVA1wf+5+9R+vnSUeVC06JIglJ4PVhHvG/LopyboBZ/1c6
++XUyo05f7O0oYtlNc/LMgRdg7c3r3NunysV+Ar3yVAhU/bQtCSwXVEqY0VThUWcI
+0u1ufm8/0i2BWSlmy5A5lREedCf+3euvAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMB
+Af8wDgYDVR0PAQH/BAQDAgGGMB0GA1UdDgQWBBSwDPBMMPQFWAJI/TPlUq9LhONm
+UjANBgkqhkiG9w0BAQwFAAOCAgEAqqiAjw54o+Ci1M3m9Zh6O+oAA7CXDpO8Wqj2
+LIxyh6mx/H9z/WNxeKWHWc8w4Q0QshNabYL1auaAn6AFC2jkR2vHat+2/XcycuUY
++gn0oJMsXdKMdYV2ZZAMA3m3MSNjrXiDCYZohMr/+c8mmpJ5581LxedhpxfL86kS
+k5Nrp+gvU5LEYFiwzAJRGFuFjWJZY7attN6a+yb3ACfAXVU3dJnJUH/jWS5E4ywl
+7uxMMne0nxrpS10gxdr9HIcWxkPo1LsmmkVwXqkLN1PiRnsn/eBG8om3zEK2yygm
+btmlyTrIQRNg91CMFa6ybRoVGld45pIq2WWQgj9sAq+uEjonljYE1x2igGOpm/Hl
+urR8FLBOybEfdF849lHqm/osohHUqS0nGkWxr7JOcQ3AWEbWaQbLU8uz/mtBzUF+
+fUwPfHJ5elnNXkoOrJupmHN5fLT0zLm4BwyydFy4x2+IoZCn9Kr5v2c69BoVYh63
+n749sSmvZ6ES8lgQGVMDMBu4Gon2nL2XA46jCfMdiyHxtN/kHNGfZQIG6lzWE7OE
+76KlXIx3KadowGuuQNKotOrN8I1LOJwZmhsoVLiJkO/KdYE+HvJkJMcYr07/R54H
+9jVlpNMKVv/1F2Rs76giJUmTtt8AF9pYfl3uxRuw0dFfIRDH+fO6AgonB8Xx1sfT
+4PsJYGw=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDQTCCAimgAwIBAgITBmyfz5m/jAo54vB4ikPmljZbyjANBgkqhkiG9w0BAQsF
+ADA5MQswCQYDVQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRkwFwYDVQQDExBBbWF6
+b24gUm9vdCBDQSAxMB4XDTE1MDUyNjAwMDAwMFoXDTM4MDExNzAwMDAwMFowOTEL
+MAkGA1UEBhMCVVMxDzANBgNVBAoTBkFtYXpvbjEZMBcGA1UEAxMQQW1hem9uIFJv
+b3QgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALJ4gHHKeNXj
+ca9HgFB0fW7Y14h29Jlo91ghYPl0hAEvrAIthtOgQ3pOsqTQNroBvo3bSMgHFzZM
+9O6II8c+6zf1tRn4SWiw3te5djgdYZ6k/oI2peVKVuRF4fn9tBb6dNqcmzU5L/qw
+IFAGbHrQgLKm+a/sRxmPUDgH3KKHOVj4utWp+UhnMJbulHheb4mjUcAwhmahRWa6
+VOujw5H5SNz/0egwLX0tdHA114gk957EWW67c4cX8jJGKLhD+rcdqsq08p8kDi1L
+93FcXmn/6pUCyziKrlA4b9v7LWIbxcceVOF34GfID5yHI9Y/QCB/IIDEgEw+OyQm
+jgSubJrIqg0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC
+AYYwHQYDVR0OBBYEFIQYzIU07LwMlJQuCFmcx7IQTgoIMA0GCSqGSIb3DQEBCwUA
+A4IBAQCY8jdaQZChGsV2USggNiMOruYou6r4lK5IpDB/G/wkjUu0yKGX9rbxenDI
+U5PMCCjjmCXPI6T53iHTfIUJrU6adTrCC2qJeHZERxhlbI1Bjjt/msv0tadQ1wUs
+N+gDS63pYaACbvXy8MWy7Vu33PqUXHeeE6V/Uq2V8viTO96LXFvKWlJbYK8U90vv
+o/ufQJVtMVT8QtPHRh8jrdkPSHCa2XV4cdFyQzR1bldZwgJcJmApzyMZFo6IQ6XU
+5MsI+yMRQ+hDKXJioaldXgjUkK642M4UwtBV8ob2xJNDd2ZhwLnoQdeXeGADbkpy
+rqXRfboQnoZsG4q5WTP468SQvvG5
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAwTDEgMB4G
+A1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNp
+Z24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4
+MTAwMDAwWjBMMSAwHgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEG
+A1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZI
+hvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5BngiFvXAg7aEyiie/QV2EcWtiHL8
+RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X17YUhhB5uzsT
+gHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm
+KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zd
+QQ4gOsC0p6Hpsk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZ
+XriX7613t2Saer9fwRPvm2L7DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAw
+DgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFI/wS3+o
+LkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBLQNvAUKr+yAzv95ZU
+RUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25sbwMp
+jjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK
+6fBdRoyV3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQX
+mcIfeg7jLQitChws/zyrVQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecs
+Mx86OyXShkDOOyyGeMlhLxS67ttVb9+E7gUJTb0o2HLO02JQZR7rkpeDMdmztcpH
+WD9f
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG
+A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv
+b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw
+MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i
+YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT
+aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ
+jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp
+xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz8kHp
+1Wrjsok6Vjk4bwY8iGlbKk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdG
+snUOhugZitVtbNV4FpWi6cgKOOvyJBNPc1STE4U6G7weNLWLBYy5d4ux2x8gkasJ
+U26Qzns3dLlwR5EiUWMWea6xrkEmCMgZK9FGqkjWZCrXgzT/LCrBbBlDSgeF59N8
+9iFo7+ryUp9/k5DPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8E
+BTADAQH/MB0GA1UdDgQWBBRge2YaRQ2XyolQL30EzTSo//z9SzANBgkqhkiG9w0B
+AQUFAAOCAQEA1nPnfE920I2/7LqivjTFKDK1fPxsnCwrvQmeU79rXqoRSLblCKOz
+yj1hTdNGCbM+w6DjY1Ub8rrvrTnhQ7k4o+YviiY776BQVvnGCv04zcQLcFGUl5gE
+38NflNUVyRRBnMRddWQVDf9VMOyGj/8N7yy5Y0b2qvzfvGn9LhJIZJrglfCm7ymP
+AbEVtQwdpf5pLGkkeB6zpxxxYu7KyJesF12KwvhHhm4qxFYxldBniYUr+WymXUad
+DKqC5JlR3XC321Y9YeRq4VzW9v493kHMB65jUr9TU/Qr6cf9tveCX4XSQRjbgbME
+HMUfpIBvFSDJ3gyICh3WZlXi/EjJKSZp4A==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIEADCCAuigAwIBAgIBADANBgkqhkiG9w0BAQUFADBjMQswCQYDVQQGEwJVUzEh
+MB8GA1UEChMYVGhlIEdvIERhZGR5IEdyb3VwLCBJbmMuMTEwLwYDVQQLEyhHbyBE
+YWRkeSBDbGFzcyAyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTA0MDYyOTE3
+MDYyMFoXDTM0MDYyOTE3MDYyMFowYzELMAkGA1UEBhMCVVMxITAfBgNVBAoTGFRo
+ZSBHbyBEYWRkeSBHcm91cCwgSW5jLjExMC8GA1UECxMoR28gRGFkZHkgQ2xhc3Mg
+MiBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTCCASAwDQYJKoZIhvcNAQEBBQADggEN
+ADCCAQgCggEBAN6d1+pXGEmhW+vXX0iG6r7d/+TvZxz0ZWizV3GgXne77ZtJ6XCA
+PVYYYwhv2vLM0D9/AlQiVBDYsoHUwHU9S3/Hd8M+eKsaA7Ugay9qK7HFiH7Eux6w
+wdhFJ2+qN1j3hybX2C32qRe3H3I2TqYXP2WYktsqbl2i/ojgC95/5Y0V4evLOtXi
+EqITLdiOr18SPaAIBQi2XKVlOARFmR6jYGB0xUGlcmIbYsUfb18aQr4CUWWoriMY
+avx4A6lNf4DD+qta/KFApMoZFv6yyO9ecw3ud72a9nmYvLEHZ6IVDd2gWMZEewo+
+YihfukEHU1jPEX44dMX4/7VpkI+EdOqXG68CAQOjgcAwgb0wHQYDVR0OBBYEFNLE
+sNKR1EwRcbNhyz2h/t2oatTjMIGNBgNVHSMEgYUwgYKAFNLEsNKR1EwRcbNhyz2h
+/t2oatTjoWekZTBjMQswCQYDVQQGEwJVUzEhMB8GA1UEChMYVGhlIEdvIERhZGR5
+IEdyb3VwLCBJbmMuMTEwLwYDVQQLEyhHbyBEYWRkeSBDbGFzcyAyIENlcnRpZmlj
+YXRpb24gQXV0aG9yaXR5ggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQAD
+ggEBADJL87LKPpH8EsahB4yOd6AzBhRckB4Y9wimPQoZ+YeAEW5p5JYXMP80kWNy
+OO7MHAGjHZQopDH2esRU1/blMVgDoszOYtuURXO1v0XJJLXVggKtI3lpjbi2Tc7P
+TMozI+gciKqdi0FuFskg5YmezTvacPd+mSYgFFQlq25zheabIZ0KbIIOqPjCDPoQ
+HmyW74cNxA9hi63ugyuV+I6ShHI56yDqg+2DzZduCLzrTia2cyvk0/ZM/iZx4mER
+dEr/VxqHD3VILs9RaRegAhJhldXRQLIQTO7ErBBDpqWeCtWVYpoNz4iCxTIM5Cuf
+ReYNnyicsbkqWletNw+vHX/bvZ8=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDxTCCAq2gAwIBAgIBADANBgkqhkiG9w0BAQsFADCBgzELMAkGA1UEBhMCVVMx
+EDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxGjAYBgNVBAoT
+EUdvRGFkZHkuY29tLCBJbmMuMTEwLwYDVQQDEyhHbyBEYWRkeSBSb290IENlcnRp
+ZmljYXRlIEF1dGhvcml0eSAtIEcyMB4XDTA5MDkwMTAwMDAwMFoXDTM3MTIzMTIz
+NTk1OVowgYMxCzAJBgNVBAYTAlVTMRAwDgYDVQQIEwdBcml6b25hMRMwEQYDVQQH
+EwpTY290dHNkYWxlMRowGAYDVQQKExFHb0RhZGR5LmNvbSwgSW5jLjExMC8GA1UE
+AxMoR28gRGFkZHkgUm9vdCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkgLSBHMjCCASIw
+DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL9xYgjx+lk09xvJGKP3gElY6SKD
+E6bFIEMBO4Tx5oVJnyfq9oQbTqC023CYxzIBsQU+B07u9PpPL1kwIuerGVZr4oAH
+/PMWdYA5UXvl+TW2dE6pjYIT5LY/qQOD+qK+ihVqf94Lw7YZFAXK6sOoBJQ7Rnwy
+DfMAZiLIjWltNowRGLfTshxgtDj6AozO091GB94KPutdfMh8+7ArU6SSYmlRJQVh
+GkSBjCypQ5Yj36w6gZoOKcUcqeldHraenjAKOc7xiID7S13MMuyFYkMlNAJWJwGR
+tDtwKj9useiciAF9n9T521NtYJ2/LOdYq7hfRvzOxBsDPAnrSTFcaUaz4EcCAwEA
+AaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYE
+FDqahQcQZyi27/a9BUFuIMGU2g/eMA0GCSqGSIb3DQEBCwUAA4IBAQCZ21151fmX
+WWcDYfF+OwYxdS2hII5PZYe096acvNjpL9DbWu7PdIxztDhC2gV7+AJ1uP2lsdeu
+9tfeE8tTEH6KRtGX+rcuKxGrkLAngPnon1rpN5+r5N9ss4UXnT3ZJE95kTXWXwTr
+gIOrmgIttRD02JDHBHNA7XIloKmf7J6raBKZV8aPEjoJpL1E/QYVN8Gb5DKj7Tjo
+2GTzLH4U/ALqn83/B2gX2yKQOC16jdFU8WnjXzPKej17CuPKf1855eJ1usV2GDPO
+LPAvTK33sefOT6jEm0pUBsV/fdUID+Ic/n4XuKxe9tQWskMJDE32p2u0mYRlynqI
+4uJEvlz36hz1
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDMDCCAhigAwIBAgICA+gwDQYJKoZIhvcNAQEFBQAwRzELMAkGA1UEBhMCSEsx
+FjAUBgNVBAoTDUhvbmdrb25nIFBvc3QxIDAeBgNVBAMTF0hvbmdrb25nIFBvc3Qg
+Um9vdCBDQSAxMB4XDTAzMDUxNTA1MTMxNFoXDTIzMDUxNTA0NTIyOVowRzELMAkG
+A1UEBhMCSEsxFjAUBgNVBAoTDUhvbmdrb25nIFBvc3QxIDAeBgNVBAMTF0hvbmdr
+b25nIFBvc3QgUm9vdCBDQSAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
+AQEArP84tulmAknjorThkPlAj3n54r15/gK97iSSHSL22oVyaf7XPwnU3ZG1ApzQ
+jVrhVcNQhrkpJsLj2aDxaQMoIIBFIi1WpztUlVYiWR8o3x8gPW2iNr4joLFutbEn
+PzlTCeqrauh0ssJlXI6/fMN4hM2eFvz1Lk8gKgifd/PFHsSaUmYeSF7jEAaPIpjh
+ZY4bXSNmO7ilMlHIhqqhqZ5/dpTCpmy3QfDVyAY45tQM4vM7TG1QjMSDJ8EThFk9
+nnV0ttgCXjqQesBCNnLsak3c78QA3xMYV18meMjWCnl3v/evt3a5pQuEF10Q6m/h
+q5URX208o1xNg1vysxmKgIsLhwIDAQABoyYwJDASBgNVHRMBAf8ECDAGAQH/AgED
+MA4GA1UdDwEB/wQEAwIBxjANBgkqhkiG9w0BAQUFAAOCAQEADkbVPK7ih9legYsC
+mEEIjEy82tvuJxuC52pF7BaLT4Wg87JwvVqWuspube5Gi27nKi6Wsxkz67SfqLI3
+7piol7Yutmcn1KZJ/RyTZXaeQi/cImyaT/JaFTmxcdcrUehtHJjA2Sr0oYJ71clB
+oiMBdDhViw+5LmeiIAQ32pwL0xch4I+XeTRvhEgCIDMb5jREn5Fw9IBehEPCKdJs
+EhTkYY2sEJCehFC78JZvRZ+K88psT/oROhUVRsPNH4NbLUES7VBnQRM9IauUiqpO
+fMGx+6fWtScvl6tu4B3i0RwsH0Ti/L6RoZz71ilTc4afU9hDDl3WY4JxHYB0yvbi
+AmvZWg==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIECjCCAvKgAwIBAgIJAMJ+QwRORz8ZMA0GCSqGSIb3DQEBCwUAMIGCMQswCQYD
+VQQGEwJIVTERMA8GA1UEBwwIQnVkYXBlc3QxFjAUBgNVBAoMDU1pY3Jvc2VjIEx0
+ZC4xJzAlBgNVBAMMHk1pY3Jvc2VjIGUtU3ppZ25vIFJvb3QgQ0EgMjAwOTEfMB0G
+CSqGSIb3DQEJARYQaW5mb0BlLXN6aWduby5odTAeFw0wOTA2MTYxMTMwMThaFw0y
+OTEyMzAxMTMwMThaMIGCMQswCQYDVQQGEwJIVTERMA8GA1UEBwwIQnVkYXBlc3Qx
+FjAUBgNVBAoMDU1pY3Jvc2VjIEx0ZC4xJzAlBgNVBAMMHk1pY3Jvc2VjIGUtU3pp
+Z25vIFJvb3QgQ0EgMjAwOTEfMB0GCSqGSIb3DQEJARYQaW5mb0BlLXN6aWduby5o
+dTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOn4j/NjrdqG2KfgQvvP
+kd6mJviZpWNwrZuuyjNAfW2WbqEORO7hE52UQlKavXWFdCyoDh2Tthi3jCyoz/tc
+cbna7P7ofo/kLx2yqHWH2Leh5TvPmUpG0IMZfcChEhyVbUr02MelTTMuhTlAdX4U
+fIASmFDHQWe4oIBhVKZsTh/gnQ4H6cm6M+f+wFUoLAKApxn1ntxVUwOXewdI/5n7
+N4okxFnMUBBjjqqpGrCEGob5X7uxUG6k0QrM1XF+H6cbfPVTbiJfyyvm1HxdrtbC
+xkzlBQHZ7Vf8wSN5/PrIJIOV87VqUQHQd9bpEqH5GoP7ghu5sJf0dgYzQ0mg/wu1
++rUCAwEAAaOBgDB+MA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0G
+A1UdDgQWBBTLD8bfQkPMPcu1SCOhGnqmKrs0aDAfBgNVHSMEGDAWgBTLD8bfQkPM
+Pcu1SCOhGnqmKrs0aDAbBgNVHREEFDASgRBpbmZvQGUtc3ppZ25vLmh1MA0GCSqG
+SIb3DQEBCwUAA4IBAQDJ0Q5eLtXMs3w+y/w9/w0olZMEyL/azXm4Q5DwpL7v8u8h
+mLzU1F0G9u5C7DBsoKqpyvGvivo/C3NqPuouQH4frlRheesuCDfXI/OMn74dseGk
+ddug4lQUsbocKaQY9hK6ohQU4zE1yED/t+AFdlfBHFny+L/k7SViXITwfn4fs775
+tyERzAMBVnCnEJIeGzSBHq2cGsMEPO0CYdYeBvNfOofyK/FFh+U9rNHHV4S9a67c
+2Pm2G2JwCz02yULyMtd6YebS2z3PyKnJm9zbWETXbzivf3jTo60adbocwTZ8jx5t
+HMN1Rq41Bab2XD0h7lbwyYIiLXpUq3DDfSJlgnCW
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIEFTCCAv2gAwIBAgIGSUEs5AAQMA0GCSqGSIb3DQEBCwUAMIGnMQswCQYDVQQG
+EwJIVTERMA8GA1UEBwwIQnVkYXBlc3QxFTATBgNVBAoMDE5ldExvY2sgS2Z0LjE3
+MDUGA1UECwwuVGFuw7pzw610dsOhbnlraWFkw7NrIChDZXJ0aWZpY2F0aW9uIFNl
+cnZpY2VzKTE1MDMGA1UEAwwsTmV0TG9jayBBcmFueSAoQ2xhc3MgR29sZCkgRsWR
+dGFuw7pzw610dsOhbnkwHhcNMDgxMjExMTUwODIxWhcNMjgxMjA2MTUwODIxWjCB
+pzELMAkGA1UEBhMCSFUxETAPBgNVBAcMCEJ1ZGFwZXN0MRUwEwYDVQQKDAxOZXRM
+b2NrIEtmdC4xNzA1BgNVBAsMLlRhbsO6c8OtdHbDoW55a2lhZMOzayAoQ2VydGlm
+aWNhdGlvbiBTZXJ2aWNlcykxNTAzBgNVBAMMLE5ldExvY2sgQXJhbnkgKENsYXNz
+IEdvbGQpIEbFkXRhbsO6c8OtdHbDoW55MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+MIIBCgKCAQEAxCRec75LbRTDofTjl5Bu0jBFHjzuZ9lk4BqKf8owyoPjIMHj9DrT
+lF8afFttvzBPhCf2nx9JvMaZCpDyD/V/Q4Q3Y1GLeqVw/HpYzY6b7cNGbIRwXdrz
+AZAj/E4wqX7hJ2Pn7WQ8oLjJM2P+FpD/sLj916jAwJRDC7bVWaaeVtAkH3B5r9s5
+VA1lddkVQZQBr17s9o3x/61k/iCa11zr/qYfCGSji3ZVrR47KGAuhyXoqq8fxmRG
+ILdwfzzeSNuWU7c5d+Qa4scWhHaXWy+7GRWF+GmF9ZmnqfI0p6m2pgP8b4Y9VHx2
+BJtr+UBdADTHLpl1neWIA6pN+APSQnbAGwIDAKiLo0UwQzASBgNVHRMBAf8ECDAG
+AQH/AgEEMA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUzPpnk/C2uNClwB7zU/2M
+U9+D15YwDQYJKoZIhvcNAQELBQADggEBAKt/7hwWqZw8UQCgwBEIBaeZ5m8BiFRh
+bvG5GK1Krf6BQCOUL/t1fC8oS2IkgYIL9WHxHG64YTjrgfpioTtaYtOUZcTh5m2C
++C8lcLIhJsFyUR+MLMOEkMNaj7rP9KdlpeuY0fsFskZ1FSNqb4VjMIDw1Z4fKRzC
+bLBQWV2QWzuoDTDPv31/zvGdg73JRm4gpvlhUbohL3u+pRVjodSVh/GeufOJ8z2F
+uLjbvrW5KfnaNwUASZQDhETnv0Mxz3WLJdH0pmT1kvarBes96aULNmLazAZfNou2
+XjG4Kvte9nHfRCaexOYNkbQudZWAUWpLMKawYqGT8ZvYzsRjdT9ZR7E=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIB8jCCAXigAwIBAgITBmyf18G7EEwpQ+Vxe3ssyBrBDjAKBggqhkjOPQQDAzA5
+MQswCQYDVQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRkwFwYDVQQDExBBbWF6b24g
+Um9vdCBDQSA0MB4XDTE1MDUyNjAwMDAwMFoXDTQwMDUyNjAwMDAwMFowOTELMAkG
+A1UEBhMCVVMxDzANBgNVBAoTBkFtYXpvbjEZMBcGA1UEAxMQQW1hem9uIFJvb3Qg
+Q0EgNDB2MBAGByqGSM49AgEGBSuBBAAiA2IABNKrijdPo1MN/sGKe0uoe0ZLY7Bi
+9i0b2whxIdIA6GO9mif78DluXeo9pcmBqqNbIJhFXRbb/egQbeOc4OO9X4Ri83Bk
+M6DLJC9wuoihKqB1+IGuYgbEgds5bimwHvouXKNCMEAwDwYDVR0TAQH/BAUwAwEB
+/zAOBgNVHQ8BAf8EBAMCAYYwHQYDVR0OBBYEFNPsxzplbszh2naaVvuc84ZtV+WB
+MAoGCCqGSM49BAMDA2gAMGUCMDqLIfG9fhGt0O9Yli/W651+kI0rz2ZVwyzjKKlw
+CkcO8DdZEv8tmZQoTipPNU0zWgIxAOp1AE47xDqUEpHJWEadIRNyp4iciuRMStuW
+1KyLa2tJElMzrdfkviT8tQp21KW8EA==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIGCzCCA/OgAwIBAgIBADANBgkqhkiG9w0BAQsFADCBpjELMAkGA1UEBhMCR1Ix
+DzANBgNVBAcTBkF0aGVuczFEMEIGA1UEChM7SGVsbGVuaWMgQWNhZGVtaWMgYW5k
+IFJlc2VhcmNoIEluc3RpdHV0aW9ucyBDZXJ0LiBBdXRob3JpdHkxQDA+BgNVBAMT
+N0hlbGxlbmljIEFjYWRlbWljIGFuZCBSZXNlYXJjaCBJbnN0aXR1dGlvbnMgUm9v
+dENBIDIwMTUwHhcNMTUwNzA3MTAxMTIxWhcNNDAwNjMwMTAxMTIxWjCBpjELMAkG
+A1UEBhMCR1IxDzANBgNVBAcTBkF0aGVuczFEMEIGA1UEChM7SGVsbGVuaWMgQWNh
+ZGVtaWMgYW5kIFJlc2VhcmNoIEluc3RpdHV0aW9ucyBDZXJ0LiBBdXRob3JpdHkx
+QDA+BgNVBAMTN0hlbGxlbmljIEFjYWRlbWljIGFuZCBSZXNlYXJjaCBJbnN0aXR1
+dGlvbnMgUm9vdENBIDIwMTUwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoIC
+AQDC+Kk/G4n8PDwEXT2QNrCROnk8ZlrvbTkBSRq0t89/TSNTt5AA4xMqKKYx8ZEA
+4yjsriFBzh/a/X0SWwGDD7mwX5nh8hKDgE0GPt+sr+ehiGsxr/CL0BgzuNtFajT0
+AoAkKAoCFZVedioNmToUW/bLy1O8E00BiDeUJRtCvCLYjqOWXjrZMts+6PAQZe10
+4S+nfK8nNLspfZu2zwnI5dMK/IhlZXQK3HMcXM1AsRzUtoSMTFDPaI6oWa7CJ06C
+ojXdFPQf/7J31Ycvqm59JCfnxssm5uX+Zwdj2EUN3TpZZTlYepKZcj2chF6IIbjV
+9Cz82XBST3i4vTwri5WY9bPRaM8gFH5MXF/ni+X1NYEZN9cRCLdmvtNKzoNXADrD
+gfgXy5I2XdGj2HUb4Ysn6npIQf1FGQatJ5lOwXBH3bWfgVMS5bGMSF0xQxfjjMZ6
+Y5ZLKTBOhE5iGV48zpeQpX8B653g+IuJ3SWYPZK2fu/Z8VFRfS0myGlZYeCsargq
+NhEEelC9MoS+L9xy1dcdFkfkR2YgP/SWxa+OAXqlD3pk9Q0Yh9muiNX6hME6wGko
+LfINaFGq46V3xqSQDqE3izEjR8EJCOtu93ib14L8hCCZSRm2Ekax+0VVFqmjZayc
+Bw/qa9wfLgZy7IaIEuQt218FL+TwA9MmM+eAws1CoRc0CwIDAQABo0IwQDAPBgNV
+HRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUcRVnyMjJvXVd
+ctA4GGqd83EkVAswDQYJKoZIhvcNAQELBQADggIBAHW7bVRLqhBYRjTyYtcWNl0I
+XtVsyIe9tC5G8jH4fOpCtZMWVdyhDBKg2mF+D1hYc2Ryx+hFjtyp8iY/xnmMsVMI
+M4GwVhO+5lFc2JsKT0ucVlMC6U/2DWDqTUJV6HwbISHTGzrMd/K4kPFox/la/vot
+9L/J9UUbzjgQKjeKeaO04wlshYaT/4mWJ3iBj2fjRnRUjtkNaeJK9E10A/+yd+2V
+Z5fkscWrv2oj6NSU4kQoYsRL4vDY4ilrGnB+JGGTe08DMiUNRSQrlrRGar9KC/ea
+j8GsGsVn82800vpzY4zvFrCopEYq+OsS7HK07/grfoxSwIuEVPkvPuNVqNxmsdnh
+X9izjFk0WaSrT2y7HxjbdavYy5LNlDhhDgcGH0tGEPEVvo2FXDtKK4F5D7Rpn0lQ
+l033DlZdwJVqwjbDG2jJ9SrcR5q+ss7FJej6A7na+RZukYT1HCjI/CbM1xyQVqdf
+bzoEvM14iQuODy+jqk+iGxI9FghAD/FGTNeqewjBCvVtJ94Cj8rDtSvK6evIIVM4
+pcw72Hc3MKJP2W/R8kCtQXoXxdZKNYm3QdV8hn9VTYNKpXMgwDqvkPGaJI7ZjnHK
+e7iG2rKPmT4dEw0SEe7Uq/DpFXYC5ODfqiAeW2GFZECpkJcNrVPSWh2HagCXZWK0
+vm9qp/UsQu0yrbYhnr68
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFWjCCA0KgAwIBAgISEdK7udcjGJ5AXwqdLdDfJWfRMA0GCSqGSIb3DQEBDAUA
+MEYxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMRwwGgYD
+VQQDExNHbG9iYWxTaWduIFJvb3QgUjQ2MB4XDTE5MDMyMDAwMDAwMFoXDTQ2MDMy
+MDAwMDAwMFowRjELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYt
+c2ExHDAaBgNVBAMTE0dsb2JhbFNpZ24gUm9vdCBSNDYwggIiMA0GCSqGSIb3DQEB
+AQUAA4ICDwAwggIKAoICAQCsrHQy6LNl5brtQyYdpokNRbopiLKkHWPd08EsCVeJ
+OaFV6Wc0dwxu5FUdUiXSE2te4R2pt32JMl8Nnp8semNgQB+msLZ4j5lUlghYruQG
+vGIFAha/r6gjA7aUD7xubMLL1aa7DOn2wQL7Id5m3RerdELv8HQvJfTqa1VbkNud
+316HCkD7rRlr+/fKYIje2sGP1q7Vf9Q8g+7XFkyDRTNrJ9CG0Bwta/OrffGFqfUo
+0q3v84RLHIf8E6M6cqJaESvWJ3En7YEtbWaBkoe0G1h6zD8K+kZPTXhc+CtI4wSE
+y132tGqzZfxCnlEmIyDLPRT5ge1lFgBPGmSXZgjPjHvjK8Cd+RTyG/FWaha/LIWF
+zXg4mutCagI0GIMXTpRW+LaCtfOW3T3zvn8gdz57GSNrLNRyc0NXfeD412lPFzYE
++cCQYDdF3uYM2HSNrpyibXRdQr4G9dlkbgIQrImwTDsHTUB+JMWKmIJ5jqSngiCN
+I/onccnfxkF0oE32kRbcRoxfKWMxWXEM2G/CtjJ9++ZdU6Z+Ffy7dXxd7Pj2Fxzs
+x2sZy/N78CsHpdlseVR2bJ0cpm4O6XkMqCNqo98bMDGfsVR7/mrLZqrcZdCinkqa
+ByFrgY/bxFn63iLABJzjqls2k+g9vXqhnQt2sQvHnf3PmKgGwvgqo6GDoLclcqUC
+4wIDAQABo0IwQDAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNV
+HQ4EFgQUA1yrc4GHqMywptWU4jaWSf8FmSwwDQYJKoZIhvcNAQEMBQADggIBAHx4
+7PYCLLtbfpIrXTncvtgdokIzTfnvpCo7RGkerNlFo048p9gkUbJUHJNOxO97k4Vg
+JuoJSOD1u8fpaNK7ajFxzHmuEajwmf3lH7wvqMxX63bEIaZHU1VNaL8FpO7XJqti
+2kM3S+LGteWygxk6x9PbTZ4IevPuzz5i+6zoYMzRx6Fcg0XERczzF2sUyQQCPtIk
+pnnpHs6i58FZFZ8d4kuaPp92CC1r2LpXFNqD6v6MVenQTqnMdzGxRBF6XLE+0xRF
+FRhiJBPSy03OXIPBNvIQtQ6IbbjhVp+J3pZmOUdkLG5NrmJ7v2B0GbhWrJKsFjLt
+rWhV/pi60zTe9Mlhww6G9kuEYO4Ne7UyWHmRVSyBQ7N0H3qqJZ4d16GLuc1CLgSk
+ZoNNiTW2bKg2SnkheCLQQrzRQDGQob4Ez8pn7fXwgNNgyYMqIgXQBztSvwyeqiv5
+u+YfjyW6hY0XHgL+XVAEV8/+LbzvXMAaq7afJMbfc2hIkCwU9D9SGuTSyxTDYWnP
+4vkYxboznxSjBF25cfe1lNj2M8FawTSLfJvdkzrnE6JwYZ+vj+vYxXX4M2bUdGc6
+N3ec592kD3ZDZopD8p/7DEJ4Y9HiD2971KE9dJeFt0g5QdYg/NA6s/rob8SKunE3
+vouXsXgxT7PntgMTzlSdriVZzH81Xwj3QEUxeCp6
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICCzCCAZGgAwIBAgISEdK7ujNu1LzmJGjFDYQdmOhDMAoGCCqGSM49BAMDMEYx
+CzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMRwwGgYDVQQD
+ExNHbG9iYWxTaWduIFJvb3QgRTQ2MB4XDTE5MDMyMDAwMDAwMFoXDTQ2MDMyMDAw
+MDAwMFowRjELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2Ex
+HDAaBgNVBAMTE0dsb2JhbFNpZ24gUm9vdCBFNDYwdjAQBgcqhkjOPQIBBgUrgQQA
+IgNiAAScDrHPt+ieUnd1NPqlRqetMhkytAepJ8qUuwzSChDH2omwlwxwEwkBjtjq
+R+q+soArzfwoDdusvKSGN+1wCAB16pMLey5SnCNoIwZD7JIvU4Tb+0cUB+hflGdd
+yXqBPCCjQjBAMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1Ud
+DgQWBBQxCpCPtsad0kRLgLWi5h+xEk8blTAKBggqhkjOPQQDAwNoADBlAjEA31SQ
+7Zvvi5QCkxeCmb6zniz2C5GMn0oUsfZkvLtoURMMA/cVi4RguYv/Uo7njLwcAjA8
++RHUjE7AwWHCFUyqqx0LMV87HOIAl0Qx5v5zli/altP+CAezNIm8BZ/3Hobui3A=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIF8zCCA9ugAwIBAgIUDU3FzRYilZYIfrgLfxUGNPt5EDQwDQYJKoZIhvcNAQEL
+BQAwgYAxCzAJBgNVBAYTAlRSMQ8wDQYDVQQHEwZBbmthcmExGTAXBgNVBAoTEEUt
+VHVncmEgRUJHIEEuUy4xHTAbBgNVBAsTFEUtVHVncmEgVHJ1c3QgQ2VudGVyMSYw
+JAYDVQQDEx1FLVR1Z3JhIEdsb2JhbCBSb290IENBIFJTQSB2MzAeFw0yMDAzMTgw
+OTA3MTdaFw00NTAzMTIwOTA3MTdaMIGAMQswCQYDVQQGEwJUUjEPMA0GA1UEBxMG
+QW5rYXJhMRkwFwYDVQQKExBFLVR1Z3JhIEVCRyBBLlMuMR0wGwYDVQQLExRFLVR1
+Z3JhIFRydXN0IENlbnRlcjEmMCQGA1UEAxMdRS1UdWdyYSBHbG9iYWwgUm9vdCBD
+QSBSU0EgdjMwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCiZvCJt3J7
+7gnJY9LTQ91ew6aEOErxjYG7FL1H6EAX8z3DeEVypi6Q3po61CBxyryfHUuXCscx
+uj7X/iWpKo429NEvx7epXTPcMHD4QGxLsqYxYdE0PD0xesevxKenhOGXpOhL9hd8
+7jwH7eKKV9y2+/hDJVDqJ4GohryPUkqWOmAalrv9c/SF/YP9f4RtNGx/ardLAQO/
+rWm31zLZ9Vdq6YaCPqVmMbMWPcLzJmAy01IesGykNz709a/r4d+ABs8qQedmCeFL
+l+d3vSFtKbZnwy1+7dZ5ZdHPOrbRsV5WYVB6Ws5OUDGAA5hH5+QYfERaxqSzO8bG
+wzrwbMOLyKSRBfP12baqBqG3q+Sx6iEUXIOk/P+2UNOMEiaZdnDpwA+mdPy70Bt4
+znKS4iicvObpCdg604nmvi533wEKb5b25Y08TVJ2Glbhc34XrD2tbKNSEhhw5oBO
+M/J+JjKsBY04pOZ2PJ8QaQ5tndLBeSBrW88zjdGUdjXnXVXHt6woq0bM5zshtQoK
+5EpZ3IE1S0SVEgpnpaH/WwAH0sDM+T/8nzPyAPiMbIedBi3x7+PmBvrFZhNb/FAH
+nnGGstpvdDDPk1Po3CLW3iAfYY2jLqN4MpBs3KwytQXk9TwzDdbgh3cXTJ2w2Amo
+DVf3RIXwyAS+XF1a4xeOVGNpf0l0ZAWMowIDAQABo2MwYTAPBgNVHRMBAf8EBTAD
+AQH/MB8GA1UdIwQYMBaAFLK0ruYt9ybVqnUtdkvAG1Mh0EjvMB0GA1UdDgQWBBSy
+tK7mLfcm1ap1LXZLwBtTIdBI7zAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQEL
+BQADggIBAImocn+M684uGMQQgC0QDP/7FM0E4BQ8Tpr7nym/Ip5XuYJzEmMmtcyQ
+6dIqKe6cLcwsmb5FJ+Sxce3kOJUxQfJ9emN438o2Fi+CiJ+8EUdPdk3ILY7r3y18
+Tjvarvbj2l0Upq7ohUSdBm6O++96SmotKygY/r+QLHUWnw/qln0F7psTpURs+APQ
+3SPh/QMSEgj0GDSz4DcLdxEBSL9htLX4GdnLTeqjjO/98Aa1bZL0SmFQhO3sSdPk
+vmjmLuMxC1QLGpLWgti2omU8ZgT5Vdps+9u1FGZNlIM7zR6mK7L+d0CGq+ffCsn9
+9t2HVhjYsCxVYJb6CH5SkPVLpi6HfMsg2wY+oF0Dd32iPBMbKaITVaA9FCKvb7jQ
+mhty3QUBjYZgv6Rn7rWlDdF/5horYmbDB7rnoEgcOMPpRfunf/ztAmgayncSd6YA
+VSgU7NbHEqIbZULpkejLPoeJVF3Zr52XnGnnCv8PWniLYypMfUeUP95L6VPQMPHF
+9p5J3zugkaOj/s1YzOrfr28oO6Bpm4/srK4rVJ2bBLFHIK+WEj5jlB0E5y67hscM
+moi/dkfv97ALl2bSRM9gUgfh1SxKOidhd8rXj+eHDjD/DLsE4mHDosiXYY60MGo8
+bcIHX0pzLz/5FooBZu+6kcpSV3uu1OYP3Qt6f4ueJiDPO++BcYNZ
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICpTCCAiqgAwIBAgIUJkYZdzHhT28oNt45UYbm1JeIIsEwCgYIKoZIzj0EAwMw
+gYAxCzAJBgNVBAYTAlRSMQ8wDQYDVQQHEwZBbmthcmExGTAXBgNVBAoTEEUtVHVn
+cmEgRUJHIEEuUy4xHTAbBgNVBAsTFEUtVHVncmEgVHJ1c3QgQ2VudGVyMSYwJAYD
+VQQDEx1FLVR1Z3JhIEdsb2JhbCBSb290IENBIEVDQyB2MzAeFw0yMDAzMTgwOTQ2
+NThaFw00NTAzMTIwOTQ2NThaMIGAMQswCQYDVQQGEwJUUjEPMA0GA1UEBxMGQW5r
+YXJhMRkwFwYDVQQKExBFLVR1Z3JhIEVCRyBBLlMuMR0wGwYDVQQLExRFLVR1Z3Jh
+IFRydXN0IENlbnRlcjEmMCQGA1UEAxMdRS1UdWdyYSBHbG9iYWwgUm9vdCBDQSBF
+Q0MgdjMwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAASOmCm/xxAeJ9urA8woLNheSBkQ
+KczLWYHMjLiSF4mDKpL2w6QdTGLVn9agRtwcvHbB40fQWxPa56WzZkjnIZpKT4YK
+fWzqTTKACrJ6CZtpS5iB4i7sAnCWH/31Rs7K3IKjYzBhMA8GA1UdEwEB/wQFMAMB
+Af8wHwYDVR0jBBgwFoAU/4Ixcj75xGZsrTie0bBRiKWQzPUwHQYDVR0OBBYEFP+C
+MXI++cRmbK04ntGwUYilkMz1MA4GA1UdDwEB/wQEAwIBBjAKBggqhkjOPQQDAwNp
+ADBmAjEA5gVYaWHlLcoNy/EZCL3W/VGSGn5jVASQkZo1kTmZ+gepZpO6yGjUij/6
+7W4WAie3AjEA3VoXK3YdZUKWpqxdinlW2Iob35reX8dQj7FbcQwm32pAAOwzkSFx
+vmjkI6TZraE3
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFYDCCA0igAwIBAgIUeFhfLq0sGUvjNwc1NBMotZbUZZMwDQYJKoZIhvcNAQEL
+BQAwSDELMAkGA1UEBhMCQk0xGTAXBgNVBAoTEFF1b1ZhZGlzIExpbWl0ZWQxHjAc
+BgNVBAMTFVF1b1ZhZGlzIFJvb3QgQ0EgMSBHMzAeFw0xMjAxMTIxNzI3NDRaFw00
+MjAxMTIxNzI3NDRaMEgxCzAJBgNVBAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBM
+aW1pdGVkMR4wHAYDVQQDExVRdW9WYWRpcyBSb290IENBIDEgRzMwggIiMA0GCSqG
+SIb3DQEBAQUAA4ICDwAwggIKAoICAQCgvlAQjunybEC0BJyFuTHK3C3kEakEPBtV
+wedYMB0ktMPvhd6MLOHBPd+C5k+tR4ds7FtJwUrVu4/sh6x/gpqG7D0DmVIB0jWe
+rNrwU8lmPNSsAgHaJNM7qAJGr6Qc4/hzWHa39g6QDbXwz8z6+cZM5cOGMAqNF341
+68Xfuw6cwI2H44g4hWf6Pser4BOcBRiYz5P1sZK0/CPTz9XEJ0ngnjybCKOLXSoh
+4Pw5qlPafX7PGglTvF0FBM+hSo+LdoINofjSxxR3W5A2B4GbPgb6Ul5jxaYA/qXp
+UhtStZI5cgMJYr2wYBZupt0lwgNm3fME0UDiTouG9G/lg6AnhF4EwfWQvTA9xO+o
+abw4m6SkltFi2mnAAZauy8RRNOoMqv8hjlmPSlzkYZqn0ukqeI1RPToV7qJZjqlc
+3sX5kCLliEVx3ZGZbHqfPT2YfF72vhZooF6uCyP8Wg+qInYtyaEQHeTTRCOQiJ/G
+KubX9ZqzWB4vMIkIG1SitZgj7Ah3HJVdYdHLiZxfokqRmu8hqkkWCKi9YSgxyXSt
+hfbZxbGL0eUQMk1fiyA6PEkfM4VZDdvLCXVDaXP7a3F98N/ETH3Goy7IlXnLc6KO
+Tk0k+17kBL5yG6YnLUlamXrXXAkgt3+UuU/xDRxeiEIbEbfnkduebPRq34wGmAOt
+zCjvpUfzUwIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIB
+BjAdBgNVHQ4EFgQUo5fW816iEOGrRZ88F2Q87gFwnMwwDQYJKoZIhvcNAQELBQAD
+ggIBABj6W3X8PnrHX3fHyt/PX8MSxEBd1DKquGrX1RUVRpgjpeaQWxiZTOOtQqOC
+MTaIzen7xASWSIsBx40Bz1szBpZGZnQdT+3Btrm0DWHMY37XLneMlhwqI2hrhVd2
+cDMT/uFPpiN3GPoajOi9ZcnPP/TJF9zrx7zABC4tRi9pZsMbj/7sPtPKlL92CiUN
+qXsCHKnQO18LwIE6PWThv6ctTr1NxNgpxiIY0MWscgKCP6o6ojoilzHdCGPDdRS5
+YCgtW2jgFqlmgiNR9etT2DGbe+m3nUvriBbP+V04ikkwj+3x6xn0dxoxGE1nVGwv
+b2X52z3sIexe9PSLymBlVNFxZPT5pqOBMzYzcfCkeF9OrYMh3jRJjehZrJ3ydlo2
+8hP0r+AJx2EqbPfgna67hkooby7utHnNkDPDs3b69fBsnQGQ+p6Q9pxyz0fawx/k
+NSBT8lTR32GDpgLiJTjehTItXnOQUl1CxM49S+H5GYQd1aJQzEH7QRTDvdbJWqNj
+ZgKAvQU6O0ec7AAmTPWIUb+oI38YB7AL7YsmoWTTYUrrXJ/es69nA7Mf3W1daWhp
+q1467HxpvMc7hU6eFbm0FU/DlXpY18ls6Wy58yljXrQs8C097Vpl4KlbQMJImYFt
+nh8GKjwStIsPm6Ik8KaN1nrgS7ZklmOVhMJKzRwuJIczYOXD
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFtzCCA5+gAwIBAgICBQkwDQYJKoZIhvcNAQEFBQAwRTELMAkGA1UEBhMCQk0x
+GTAXBgNVBAoTEFF1b1ZhZGlzIExpbWl0ZWQxGzAZBgNVBAMTElF1b1ZhZGlzIFJv
+b3QgQ0EgMjAeFw0wNjExMjQxODI3MDBaFw0zMTExMjQxODIzMzNaMEUxCzAJBgNV
+BAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBMaW1pdGVkMRswGQYDVQQDExJRdW9W
+YWRpcyBSb290IENBIDIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCa
+GMpLlA0ALa8DKYrwD4HIrkwZhR0In6spRIXzL4GtMh6QRr+jhiYaHv5+HBg6XJxg
+Fyo6dIMzMH1hVBHL7avg5tKifvVrbxi3Cgst/ek+7wrGsxDp3MJGF/hd/aTa/55J
+WpzmM+Yklvc/ulsrHHo1wtZn/qtmUIttKGAr79dgw8eTvI02kfN/+NsRE8Scd3bB
+rrcCaoF6qUWD4gXmuVbBlDePSHFjIuwXZQeVikvfj8ZaCuWw419eaxGrDPmF60Tp
++ARz8un+XJiM9XOva7R+zdRcAitMOeGylZUtQofX1bOQQ7dsE/He3fbE+Ik/0XX1
+ksOR1YqI0JDs3G3eicJlcZaLDQP9nL9bFqyS2+r+eXyt66/3FsvbzSUr5R/7mp/i
+Ucw6UwxI5g69ybR2BlLmEROFcmMDBOAENisgGQLodKcftslWZvB1JdxnwQ5hYIiz
+PtGo/KPaHbDRsSNU30R2be1B2MGyIrZTHN81Hdyhdyox5C315eXbyOD/5YDXC2Og
+/zOhD7osFRXql7PSorW+8oyWHhqPHWykYTe5hnMz15eWniN9gqRMgeKh0bpnX5UH
+oycR7hYQe7xFSkyyBNKr79X9DFHOUGoIMfmR2gyPZFwDwzqLID9ujWc9Otb+fVuI
+yV77zGHcizN300QyNQliBJIWENieJ0f7OyHj+OsdWwIDAQABo4GwMIGtMA8GA1Ud
+EwEB/wQFMAMBAf8wCwYDVR0PBAQDAgEGMB0GA1UdDgQWBBQahGK8SEwzJQTU7tD2
+A8QZRtGUazBuBgNVHSMEZzBlgBQahGK8SEwzJQTU7tD2A8QZRtGUa6FJpEcwRTEL
+MAkGA1UEBhMCQk0xGTAXBgNVBAoTEFF1b1ZhZGlzIExpbWl0ZWQxGzAZBgNVBAMT
+ElF1b1ZhZGlzIFJvb3QgQ0EgMoICBQkwDQYJKoZIhvcNAQEFBQADggIBAD4KFk2f
+BluornFdLwUvZ+YTRYPENvbzwCYMDbVHZF34tHLJRqUDGCdViXh9duqWNIAXINzn
+g/iN/Ae42l9NLmeyhP3ZRPx3UIHmfLTJDQtyU/h2BwdBR5YM++CCJpNVjP4iH2Bl
+fF/nJrP3MpCYUNQ3cVX2kiF495V5+vgtJodmVjB3pjd4M1IQWK4/YY7yarHvGH5K
+WWPKjaJW1acvvFYfzznB4vsKqBUsfU16Y8Zsl0Q80m/DShcK+JDSV6IZUaUtl0Ha
+B0+pUNqQjZRG4T7wlP0QADj1O+hA4bRuVhogzG9Yje0uRY/W6ZM/57Es3zrWIozc
+hLsib9D45MY56QSIPMO661V6bYCZJPVsAfv4l7CUW+v90m/xd2gNNWQjrLhVoQPR
+TUIZ3Ph1WVaj+ahJefivDrkRoHy3au000LYmYjgahwz46P0u05B/B5EqHdZ+XIWD
+mbA4CD/pXvk1B+TJYm5Xf6dQlfe6yJvmjqIBxdZmv3lh8zwc4bmCXF2gw+nYSL0Z
+ohEUGW6yhhtoPkg3Goi3XZZenMfvJ2II4pEZXNLxId26F0KCl3GBUzGpn/Z9Yr9y
+4aOTHcyKJloJONDO1w2AFrR4pTqHTI2KpdVGl/IsELm8VCLAAVBpQ570su9t+Oza
+8eOx79+Rj1QqCyXBJhnEUhAFZdWCEOrCMc0u
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFYDCCA0igAwIBAgIURFc0JFuBiZs18s64KztbpybwdSgwDQYJKoZIhvcNAQEL
+BQAwSDELMAkGA1UEBhMCQk0xGTAXBgNVBAoTEFF1b1ZhZGlzIExpbWl0ZWQxHjAc
+BgNVBAMTFVF1b1ZhZGlzIFJvb3QgQ0EgMiBHMzAeFw0xMjAxMTIxODU5MzJaFw00
+MjAxMTIxODU5MzJaMEgxCzAJBgNVBAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBM
+aW1pdGVkMR4wHAYDVQQDExVRdW9WYWRpcyBSb290IENBIDIgRzMwggIiMA0GCSqG
+SIb3DQEBAQUAA4ICDwAwggIKAoICAQChriWyARjcV4g/Ruv5r+LrI3HimtFhZiFf
+qq8nUeVuGxbULX1QsFN3vXg6YOJkApt8hpvWGo6t/x8Vf9WVHhLL5hSEBMHfNrMW
+n4rjyduYNM7YMxcoRvynyfDStNVNCXJJ+fKH46nafaF9a7I6JaltUkSs+L5u+9ym
+c5GQYaYDFCDy54ejiK2toIz/pgslUiXnFgHVy7g1gQyjO/Dh4fxaXc6AcW34Sas+
+O7q414AB+6XrW7PFXmAqMaCvN+ggOp+oMiwMzAkd056OXbxMmO7FGmh77FOm6RQ1
+o9/NgJ8MSPsc9PG/Srj61YxxSscfrf5BmrODXfKEVu+lV0POKa2Mq1W/xPtbAd0j
+IaFYAI7D0GoT7RPjEiuA3GfmlbLNHiJuKvhB1PLKFAeNilUSxmn1uIZoL1NesNKq
+IcGY5jDjZ1XHm26sGahVpkUG0CM62+tlXSoREfA7T8pt9DTEceT/AFr2XK4jYIVz
+8eQQsSWu1ZK7E8EM4DnatDlXtas1qnIhO4M15zHfeiFuuDIIfR0ykRVKYnLP43eh
+vNURG3YBZwjgQQvD6xVu+KQZ2aKrr+InUlYrAoosFCT5v0ICvybIxo/gbjh9Uy3l
+7ZizlWNof/k19N+IxWA1ksB8aRxhlRbQ694Lrz4EEEVlWFA4r0jyWbYW8jwNkALG
+cC4BrTwV1wIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIB
+BjAdBgNVHQ4EFgQU7edvdlq/YOxJW8ald7tyFnGbxD0wDQYJKoZIhvcNAQELBQAD
+ggIBAJHfgD9DCX5xwvfrs4iP4VGyvD11+ShdyLyZm3tdquXK4Qr36LLTn91nMX66
+AarHakE7kNQIXLJgapDwyM4DYvmL7ftuKtwGTTwpD4kWilhMSA/ohGHqPHKmd+RC
+roijQ1h5fq7KpVMNqT1wvSAZYaRsOPxDMuHBR//47PERIjKWnML2W2mWeyAMQ0Ga
+W/ZZGYjeVYg3UQt4XAoeo0L9x52ID8DyeAIkVJOviYeIyUqAHerQbj5hLja7NQ4n
+lv1mNDthcnPxFlxHBlRJAHpYErAK74X9sbgzdWqTHBLmYF5vHX/JHyPLhGGfHoJE
++V+tYlUkmlKY7VHnoX6XOuYvHxHaU4AshZ6rNRDbIl9qxV6XU/IyAgkwo1jwDQHV
+csaxfGl7w/U2Rcxhbl5MlMVerugOXou/983g7aEOGzPuVBj+D77vfoRrQ+NwmNtd
+dbINWQeFFSM51vHfqSYP1kjHs6Yi9TM3WpVHn3u6GBVv/9YUZINJ0gpnIdsPNWNg
+KCLjsZWDzYWm3S8P52dSbrsvhXz1SnPnxT7AvSESBT/8twNJAlvIJebiVDj1eYeM
+HVOyToV7BjjHLPj4sHKNJeV3UvQDHEimUF+IIDBu8oJDqz2XhOdT+yHBTw8imoa4
+WSr2Rz0ZiC3oheGe7IUIarFsNMkd7EgrO3jtZsSOeWmD3n+M
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIGnTCCBIWgAwIBAgICBcYwDQYJKoZIhvcNAQEFBQAwRTELMAkGA1UEBhMCQk0x
+GTAXBgNVBAoTEFF1b1ZhZGlzIExpbWl0ZWQxGzAZBgNVBAMTElF1b1ZhZGlzIFJv
+b3QgQ0EgMzAeFw0wNjExMjQxOTExMjNaFw0zMTExMjQxOTA2NDRaMEUxCzAJBgNV
+BAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBMaW1pdGVkMRswGQYDVQQDExJRdW9W
+YWRpcyBSb290IENBIDMwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDM
+V0IWVJzmmNPTTe7+7cefQzlKZbPoFog02w1ZkXTPkrgEQK0CSzGrvI2RaNggDhoB
+4hp7Thdd4oq3P5kazethq8Jlph+3t723j/z9cI8LoGe+AaJZz3HmDyl2/7FWeUUr
+H556VOijKTVopAFPD6QuN+8bv+OPEKhyq1hX51SGyMnzW9os2l2ObjyjPtr7guXd
+8lyyBTNvijbO0BNO/79KDDRMpsMhvVAEVeuxu537RR5kFd5VAYwCdrXLoT9Cabwv
+vWhDFlaJKjdhkf2mrk7AyxRllDdLkgbvBNDInIjbC3uBr7E9KsRlOni27tyAsdLT
+mZw67mtaa7ONt9XOnMK+pUsvFrGeaDsGb659n/je7Mwpp5ijJUMv7/FfJuGITfhe
+btfZFG4ZM2mnO4SJk8RTVROhUXhA+LjJou57ulJCg54U7QVSWllWp5f8nT8KKdjc
+T5EOE7zelaTfi5m+rJsziO+1ga8bxiJTyPbH7pcUsMV8eFLI8M5ud2CEpukqdiDt
+WAEXMJPpGovgc2PZapKUSU60rUqFxKMiMPwJ7Wgic6aIDFUhWMXhOp8q3crhkODZ
+c6tsgLjoC2SToJyMGf+z0gzskSaHirOi4XCPLArlzW1oUevaPwV/izLmE1xr/l9A
+4iLItLRkT9a6fUg+qGkM17uGcclzuD87nSVL2v9A6wIDAQABo4IBlTCCAZEwDwYD
+VR0TAQH/BAUwAwEB/zCB4QYDVR0gBIHZMIHWMIHTBgkrBgEEAb5YAAMwgcUwgZMG
+CCsGAQUFBwICMIGGGoGDQW55IHVzZSBvZiB0aGlzIENlcnRpZmljYXRlIGNvbnN0
+aXR1dGVzIGFjY2VwdGFuY2Ugb2YgdGhlIFF1b1ZhZGlzIFJvb3QgQ0EgMyBDZXJ0
+aWZpY2F0ZSBQb2xpY3kgLyBDZXJ0aWZpY2F0aW9uIFByYWN0aWNlIFN0YXRlbWVu
+dC4wLQYIKwYBBQUHAgEWIWh0dHA6Ly93d3cucXVvdmFkaXNnbG9iYWwuY29tL2Nw
+czALBgNVHQ8EBAMCAQYwHQYDVR0OBBYEFPLAE+CCQz777i9nMpY1XNu4ywLQMG4G
+A1UdIwRnMGWAFPLAE+CCQz777i9nMpY1XNu4ywLQoUmkRzBFMQswCQYDVQQGEwJC
+TTEZMBcGA1UEChMQUXVvVmFkaXMgTGltaXRlZDEbMBkGA1UEAxMSUXVvVmFkaXMg
+Um9vdCBDQSAzggIFxjANBgkqhkiG9w0BAQUFAAOCAgEAT62gLEz6wPJv92ZVqyM0
+7ucp2sNbtrCD2dDQ4iH782CnO11gUyeim/YIIirnv6By5ZwkajGxkHon24QRiSem
+d1o417+shvzuXYO8BsbRd2sPbSQvS3pspweWyuOEn62Iix2rFo1bZhfZFvSLgNLd
++LJ2w/w4E6oM3kJpK27zPOuAJ9v1pkQNn1pVWQvVDVJIxa6f8i+AxeoyUDUSly7B
+4f/xI4hROJ/yZlZ25w9Rl6VSDE1JUZU2Pb+iSwwQHYaZTKrzchGT5Or2m9qoXadN
+t54CrnMAyNojA+j56hl0YgCUyyIgvpSnWbWCar6ZeXqp8kokUvd0/bpO5qgdAm6x
+DYBEwa7TIzdfu4V8K5Iu6H6li92Z4b8nby1dqnuH/grdS/yO9SbkbnBCbjPsMZ57
+k8HkyWkaPcBrTiJt7qtYTcbQQcEr6k8Sh17rRdhs9ZgC06DYVYoGmRmioHfRMJ6s
+zHXug/WwYjnPbFfiTNKRCw51KBuav/0aQ/HKd/s7j2G4aSgWQgRecCocIdiP4b0j
+Wy10QJLZYxkNc91pvGJHvOB0K7Lrfb5BG7XARsWhIstfTsEokt4YutUqKLsRixeT
+mJlglFwjz1onl14LBQaTNx47aTbrqZ5hHY8y2o4M1nQ+ewkk2gF3R8Q7zTSMmfXK
+4SVhM7JZG+Ju1zdXtg2pEto=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFYDCCA0igAwIBAgIULvWbAiin23r/1aOp7r0DoM8Sah0wDQYJKoZIhvcNAQEL
+BQAwSDELMAkGA1UEBhMCQk0xGTAXBgNVBAoTEFF1b1ZhZGlzIExpbWl0ZWQxHjAc
+BgNVBAMTFVF1b1ZhZGlzIFJvb3QgQ0EgMyBHMzAeFw0xMjAxMTIyMDI2MzJaFw00
+MjAxMTIyMDI2MzJaMEgxCzAJBgNVBAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBM
+aW1pdGVkMR4wHAYDVQQDExVRdW9WYWRpcyBSb290IENBIDMgRzMwggIiMA0GCSqG
+SIb3DQEBAQUAA4ICDwAwggIKAoICAQCzyw4QZ47qFJenMioKVjZ/aEzHs286IxSR
+/xl/pcqs7rN2nXrpixurazHb+gtTTK/FpRp5PIpM/6zfJd5O2YIyC0TeytuMrKNu
+FoM7pmRLMon7FhY4futD4tN0SsJiCnMK3UmzV9KwCoWdcTzeo8vAMvMBOSBDGzXR
+U7Ox7sWTaYI+FrUoRqHe6okJ7UO4BUaKhvVZR74bbwEhELn9qdIoyhA5CcoTNs+c
+ra1AdHkrAj80//ogaX3T7mH1urPnMNA3I4ZyYUUpSFlob3emLoG+B01vr87ERROR
+FHAGjx+f+IdpsQ7vw4kZ6+ocYfx6bIrc1gMLnia6Et3UVDmrJqMz6nWB2i3ND0/k
+A9HvFZcba5DFApCTZgIhsUfei5pKgLlVj7WiL8DWM2fafsSntARE60f75li59wzw
+eyuxwHApw0BiLTtIadwjPEjrewl5qW3aqDCYz4ByA4imW0aucnl8CAMhZa634Ryl
+sSqiMd5mBPfAdOhx3v89WcyWJhKLhZVXGqtrdQtEPREoPHtht+KPZ0/l7DxMYIBp
+VzgeAVuNVejH38DMdyM0SXV89pgR6y3e7UEuFAUCf+D+IOs15xGsIs5XPd7JMG0Q
+A4XN8f+MFrXBsj6IbGB/kE+V9/YtrQE5BwT6dYB9v0lQ7e/JxHwc64B+27bQ3RP+
+ydOc17KXqQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIB
+BjAdBgNVHQ4EFgQUxhfQvKjqAkPyGwaZXSuQILnXnOQwDQYJKoZIhvcNAQELBQAD
+ggIBADRh2Va1EodVTd2jNTFGu6QHcrxfYWLopfsLN7E8trP6KZ1/AvWkyaiTt3px
+KGmPc+FSkNrVvjrlt3ZqVoAh313m6Tqe5T72omnHKgqwGEfcIHB9UqM+WXzBusnI
+FUBhynLWcKzSt/Ac5IYp8M7vaGPQtSCKFWGafoaYtMnCdvvMujAWzKNhxnQT5Wvv
+oxXqA/4Ti2Tk08HS6IT7SdEQTXlm66r99I0xHnAUrdzeZxNMgRVhvLfZkXdxGYFg
+u/BYpbWcC/ePIlUnwEsBbTuZDdQdm2NnL9DuDcpmvJRPpq3t/O5jrFc/ZSXPsoaP
+0Aj/uHYUbt7lJ+yreLVTubY/6CD50qi+YUbKh4yE8/nxoGibIh6BJpsQBJFxwAYf
+3KDTuVan45gtf4Od34wrnDKOMpTwATwiKp9Dwi7DmDkHOHv8XgBCH/MyJnmDhPbl
+8MFREsALHgQjDFSlTC9JxUrRtm5gDWv8a4uFJGS3iQ6rJUdbPM9+Sb3H6QrG2vd+
+DhcI00iX0HGS8A85PjRqHH3Y8iKuu2n0M7SmSFXRDw4m6Oy2Cy2nhTXN/VnIn9HN
+PlopNLk9hM6xZdRZkZFWdSHBd575euFgndOtBBj0fOtek49TSiIp+EgrPk2GrFt/
+ywaZWWDYWGWVjUTR939+J399roD1B0y2PpxxVJkES/1Y+Zj0
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDvDCCAqSgAwIBAgIQB1YipOjUiolN9BPI8PjqpTANBgkqhkiG9w0BAQUFADBK
+MQswCQYDVQQGEwJVUzEgMB4GA1UEChMXU2VjdXJlVHJ1c3QgQ29ycG9yYXRpb24x
+GTAXBgNVBAMTEFNlY3VyZSBHbG9iYWwgQ0EwHhcNMDYxMTA3MTk0MjI4WhcNMjkx
+MjMxMTk1MjA2WjBKMQswCQYDVQQGEwJVUzEgMB4GA1UEChMXU2VjdXJlVHJ1c3Qg
+Q29ycG9yYXRpb24xGTAXBgNVBAMTEFNlY3VyZSBHbG9iYWwgQ0EwggEiMA0GCSqG
+SIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvNS7YrGxVaQZx5RNoJLNP2MwhR/jxYDiJ
+iQPpvepeRlMJ3Fz1Wuj3RSoC6zFh1ykzTM7HfAo3fg+6MpjhHZevj8fcyTiW89sa
+/FHtaMbQbqR8JNGuQsiWUGMu4P51/pinX0kuleM5M2SOHqRfkNJnPLLZ/kG5VacJ
+jnIFHovdRIWCQtBJwB1g8NEXLJXr9qXBkqPFwqcIYA1gBBCWeZ4WNOaptvolRTnI
+HmX5k/Wq8VLcmZg9pYYaDDUz+kulBAYVHDGA76oYa8J719rO+TMg1fW9ajMtgQT7
+sFzUnKPiXB3jqUJ1XnvUd+85VLrJChgbEplJL4hL/VBi0XPnj3pDAgMBAAGjgZ0w
+gZowEwYJKwYBBAGCNxQCBAYeBABDAEEwCwYDVR0PBAQDAgGGMA8GA1UdEwEB/wQF
+MAMBAf8wHQYDVR0OBBYEFK9EBMJBfkiD2045AuzshHrmzsmkMDQGA1UdHwQtMCsw
+KaAnoCWGI2h0dHA6Ly9jcmwuc2VjdXJldHJ1c3QuY29tL1NHQ0EuY3JsMBAGCSsG
+AQQBgjcVAQQDAgEAMA0GCSqGSIb3DQEBBQUAA4IBAQBjGghAfaReUw132HquHw0L
+URYD7xh8yOOvaliTFGCRsoTciE6+OYo68+aCiV0BN7OrJKQVDpI1WkpEXk5X+nXO
+H0jOZvQ8QCaSmGwb7iRGDBezUqXbpZGRzzfTb+cnCDpOGR86p1hcF895P4vkp9Mm
+I50mD1hp/Ed+stCNi5O/KU9DaXR2Z0vPB4zmAve14bRDtUstFJ/53CYNv6ZHdAbY
+iNE6KTCEztI5gGIbqMdXSbxqVVFnFUq+NQfk1XWYN3kwFNspnWzFacxHVaIw98xc
+f8LDmBxrThaA63p4ZUWiABqvDA1VZDRIuJK58bRQKfJPIx/abKwfROHdI3hRW8cW
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDbTCCAlWgAwIBAgIBATANBgkqhkiG9w0BAQUFADBYMQswCQYDVQQGEwJKUDEr
+MCkGA1UEChMiSmFwYW4gQ2VydGlmaWNhdGlvbiBTZXJ2aWNlcywgSW5jLjEcMBoG
+A1UEAxMTU2VjdXJlU2lnbiBSb290Q0ExMTAeFw0wOTA0MDgwNDU2NDdaFw0yOTA0
+MDgwNDU2NDdaMFgxCzAJBgNVBAYTAkpQMSswKQYDVQQKEyJKYXBhbiBDZXJ0aWZp
+Y2F0aW9uIFNlcnZpY2VzLCBJbmMuMRwwGgYDVQQDExNTZWN1cmVTaWduIFJvb3RD
+QTExMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA/XeqpRyQBTvLTJsz
+i1oURaTnkBbR31fSIRCkF/3frNYfp+TbfPfs37gD2pRY/V1yfIw/XwFndBWW4wI8
+h9uuywGOwvNmxoVF9ALGOrVisq/6nL+k5tSAMJjzDbaTj6nU2DbysPyKyiyhFTOV
+MdrAG/LuYpmGYz+/3ZMqg6h2uRMft85OQoWPIucuGvKVCbIFtUROd6EgvanyTgp9
+UK31BQ1FT0Zx/Sg+U/sE2C3XZR1KG/rPO7AxmjVuyIsG0wCR8pQIZUyxNAYAeoni
+8McDWc/V1uinMrPmmECGxc0nEovMe863ETxiYAcjPitAbpSACW22s293bzUIUPsC
+h8U+iQIDAQABo0IwQDAdBgNVHQ4EFgQUW/hNT7KlhtQ60vFjmqC+CfZXt94wDgYD
+VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggEB
+AKChOBZmLqdWHyGcBvod7bkixTgm2E5P7KN/ed5GIaGHd48HCJqypMWvDzKYC3xm
+KbabfSVSSUOrTC4rbnpwrxYO4wJs+0LmGJ1F2FXI6Dvd5+H0LgscNFxsWEr7jIhQ
+X5Ucv+2rIrVls4W6ng+4reV6G4pQOh29Dbx7VFALuUKvVaAYga1lme++5Jy/xIWr
+QbJUb9wlze144o4MjQlJ3WN7WmmWAiGovVJZ6X01y8hSyn+B/tlr0/cR7SXf+Of5
+pPpyl4RTDaXQMhhRdlkUbA/r7F+AjHVDg8OFmP9Mni0N5HeDk061lgeLKBObjBmN
+QSdJQO7e5iNEOdyhIta6A/I=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDuDCCAqCgAwIBAgIQDPCOXAgWpa1Cf/DrJxhZ0DANBgkqhkiG9w0BAQUFADBI
+MQswCQYDVQQGEwJVUzEgMB4GA1UEChMXU2VjdXJlVHJ1c3QgQ29ycG9yYXRpb24x
+FzAVBgNVBAMTDlNlY3VyZVRydXN0IENBMB4XDTA2MTEwNzE5MzExOFoXDTI5MTIz
+MTE5NDA1NVowSDELMAkGA1UEBhMCVVMxIDAeBgNVBAoTF1NlY3VyZVRydXN0IENv
+cnBvcmF0aW9uMRcwFQYDVQQDEw5TZWN1cmVUcnVzdCBDQTCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAKukgeWVzfX2FI7CT8rU4niVWJxB4Q2ZQCQXOZEz
+Zum+4YOvYlyJ0fwkW2Gz4BERQRwdbvC4u/jep4G6pkjGnx29vo6pQT64lO0pGtSO
+0gMdA+9tDWccV9cGrcrI9f4Or2YlSASWC12juhbDCE/RRvgUXPLIXgGZbf2IzIao
+wW8xQmxSPmjL8xk037uHGFaAJsTQ3MBv396gwpEWoGQRS0S8Hvbn+mPeZqx2pHGj
+7DaUaHp3pLHnDi+BeuK1cobvomuL8A/b01k/unK8RCSc43Oz969XL0Imnal0ugBS
+8kvNU3xHCzaFDmapCJcWNFfBZveA4+1wVMeT4C4oFVmHursCAwEAAaOBnTCBmjAT
+BgkrBgEEAYI3FAIEBh4EAEMAQTALBgNVHQ8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB
+/zAdBgNVHQ4EFgQUQjK2FvoE/f5dS3rD/fdMQB1aQ68wNAYDVR0fBC0wKzApoCeg
+JYYjaHR0cDovL2NybC5zZWN1cmV0cnVzdC5jb20vU1RDQS5jcmwwEAYJKwYBBAGC
+NxUBBAMCAQAwDQYJKoZIhvcNAQEFBQADggEBADDtT0rhWDpSclu1pqNlGKa7UTt3
+6Z3q059c4EVlew3KW+JwULKUBRSuSceNQQcSc5R+DCMh/bwQf2AQWnL1mA6s7Ll/
+3XpvXdMc9P+IBWlCqQVxyLesJugutIxq/3HcuLHfmbx8IVQr5Fiiu1cprp6poxkm
+D5kuCLDv/WnPmRoJjeOnnyvJNjR7JLN4TJUXpAYmHrZkUjZfYGfZnMUFdAvnZyPS
+CPyI6a6Lf+Ew9Dd+/cYy2i2eRDAwbO4H3tI0/NL/QPZL9GZGBlSm8jIKYyYwa5vR
+3ItHuuG51WLQoqD0ZwV4KWMabwTW+MZMo5qxN7SN5ShLHZ4swrhovO0C7jE=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDWjCCAkKgAwIBAgIBADANBgkqhkiG9w0BAQUFADBQMQswCQYDVQQGEwJKUDEY
+MBYGA1UEChMPU0VDT00gVHJ1c3QubmV0MScwJQYDVQQLEx5TZWN1cml0eSBDb21t
+dW5pY2F0aW9uIFJvb3RDQTEwHhcNMDMwOTMwMDQyMDQ5WhcNMjMwOTMwMDQyMDQ5
+WjBQMQswCQYDVQQGEwJKUDEYMBYGA1UEChMPU0VDT00gVHJ1c3QubmV0MScwJQYD
+VQQLEx5TZWN1cml0eSBDb21tdW5pY2F0aW9uIFJvb3RDQTEwggEiMA0GCSqGSIb3
+DQEBAQUAA4IBDwAwggEKAoIBAQCzs/5/022x7xZ8V6UMbXaKL0u/ZPtM7orw8yl8
+9f/uKuDp6bpbZCKamm8sOiZpUQWZJtzVHGpxxpp9Hp3dfGzGjGdnSj74cbAZJ6kJ
+DKaVv0uMDPpVmDvY6CKhS3E4eayXkmmziX7qIWgGmBSWh9JhNrxtJ1aeV+7AwFb9
+Ms+k2Y7CI9eNqPPYJayX5HA49LY6tJ07lyZDo6G8SVlyTCMwhwFY9k6+HGhWZq/N
+QV3Is00qVUarH9oe4kA92819uZKAnDfdDJZkndwi92SL32HeFZRSFaB9UslLqCHJ
+xrHty8OVYNEP8Ktw+N/LTX7s1vqr2b1/VPKl6Xn62dZ2JChzAgMBAAGjPzA9MB0G
+A1UdDgQWBBSgc0mZaNyFW2XjmygvV5+9M7wHSDALBgNVHQ8EBAMCAQYwDwYDVR0T
+AQH/BAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAaECpqLvkT115swW1F7NgE+vG
+kl3g0dNq/vu+m22/xwVtWSDEHPC32oRYAmP6SBbvT6UL90qY8j+eG61Ha2POCEfr
+Uj94nK9NrvjVT8+amCoQQTlSxN3Zmw7vkwGusi7KaEIkQmywszo+zenaSMQVy+n5
+Bw+SUEmK3TGXX8npN6o7WWWXlDLJs58+OmJYxUmtYg5xpTKqL8aJdkNAExNnPaJU
+JRDL8Try2frbSVa7pv6nQTXD4IhhyYjH3zYQIphZ6rBK+1YWc26sTfcioU+tHXot
+RSflMMFe8toTyyVCUZVHA4xsIcx0Qu1T/zOLjw9XARYvz6buyXAiFL39vmwLAw==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDdzCCAl+gAwIBAgIBADANBgkqhkiG9w0BAQsFADBdMQswCQYDVQQGEwJKUDEl
+MCMGA1UEChMcU0VDT00gVHJ1c3QgU3lzdGVtcyBDTy4sTFRELjEnMCUGA1UECxMe
+U2VjdXJpdHkgQ29tbXVuaWNhdGlvbiBSb290Q0EyMB4XDTA5MDUyOTA1MDAzOVoX
+DTI5MDUyOTA1MDAzOVowXTELMAkGA1UEBhMCSlAxJTAjBgNVBAoTHFNFQ09NIFRy
+dXN0IFN5c3RlbXMgQ08uLExURC4xJzAlBgNVBAsTHlNlY3VyaXR5IENvbW11bmlj
+YXRpb24gUm9vdENBMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANAV
+OVKxUrO6xVmCxF1SrjpDZYBLx/KWvNs2l9amZIyoXvDjChz335c9S672XewhtUGr
+zbl+dp+++T42NKA7wfYxEUV0kz1XgMX5iZnK5atq1LXaQZAQwdbWQonCv/Q4EpVM
+VAX3NuRFg3sUZdbcDE3R3n4MqzvEFb46VqZab3ZpUql6ucjrappdUtAtCms1FgkQ
+hNBqyjoGADdH5H5XTz+L62e4iKrFvlNVspHEfbmwhRkGeC7bYRr6hfVKkaHnFtWO
+ojnflLhwHyg/i/xAXmODPIMqGplrz95Zajv8bxbXH/1KEOtOghY6rCcMU/Gt1SSw
+awNQwS08Ft1ENCcadfsCAwEAAaNCMEAwHQYDVR0OBBYEFAqFqXdlBZh8QIH4D5cs
+OPEK7DzPMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3
+DQEBCwUAA4IBAQBMOqNErLlFsceTfsgLCkLfZOoc7llsCLqJX2rKSpWeeo8HxdpF
+coJxDjrSzG+ntKEju/Ykn8sX/oymzsLS28yN/HH8AynBbF0zX2S2ZTuJbxh2ePXc
+okgfGT+Ok+vx+hfuzU7jBBJV1uXk3fs+BXziHV7Gp7yXT2g69ekuCkO2r1dcYmh8
+t/2jioSgrGK+KwmHNPBqAbubKVY8/gA3zyNs8U6qtnRGEmyR7jTV7JqR50S+kDFy
+1UkC9gLl9B/rfNmWVan/7Ir5mUf/NVoCqgTLiluHcSmRvaS0eg29mvVXIwAHIRc/
+SjnRBUkLp7Y3gaVdjKozXoEofKd9J+sAro03
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFRzCCAy+gAwIBAgIRAI4P+UuQcWhlM1T01EQ5t+AwDQYJKoZIhvcNAQELBQAw
+PTELMAkGA1UEBhMCVVMxEjAQBgNVBAoTCUNlcnRhaW5seTEaMBgGA1UEAxMRQ2Vy
+dGFpbmx5IFJvb3QgUjEwHhcNMjEwNDAxMDAwMDAwWhcNNDYwNDAxMDAwMDAwWjA9
+MQswCQYDVQQGEwJVUzESMBAGA1UEChMJQ2VydGFpbmx5MRowGAYDVQQDExFDZXJ0
+YWlubHkgUm9vdCBSMTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANA2
+1B/q3avk0bbm+yLA3RMNansiExyXPGhjZjKcA7WNpIGD2ngwEc/csiu+kr+O5MQT
+vqRoTNoCaBZ0vrLdBORrKt03H2As2/X3oXyVtwxwhi7xOu9S98zTm/mLvg7fMbed
+aFySpvXl8wo0tf97ouSHocavFwDvA5HtqRxOcT3Si2yJ9HiG5mpJoM610rCrm/b0
+1C7jcvk2xusVtyWMOvwlDbMicyF0yEqWYZL1LwsYpfSt4u5BvQF5+paMjRcCMLT5
+r3gajLQ2EBAHBXDQ9DGQilHFhiZ5shGIXsXwClTNSaa/ApzSRKft43jvRl5tcdF5
+cBxGX1HpyTfcX35pe0HfNEXgO4T0oYoKNp43zGJS4YkNKPl6I7ENPT2a/Z2B7yyQ
+wHtETrtJ4A5KVpK8y7XdeReJkd5hiXSSqOMyhb5OhaRLWcsrxXiOcVTQAjeZjOVJ
+6uBUcqQRBi8LjMFbvrWhsFNunLhgkR9Za/kt9JQKl7XsxXYDVBtlUrpMklZRNaBA
+2CnbrlJ2Oy0wQJuK0EJWtLeIAaSHO1OWzaMWj/Nmqhexx2DgwUMFDO6bW2BvBlyH
+Wyf5QBGenDPBt+U1VwV/J84XIIwc/PH72jEpSe31C4SnT8H2TsIonPru4K8H+zMR
+eiFPCyEQtkA6qyI6BJyLm4SGcprSp6XEtHWRqSsjAgMBAAGjQjBAMA4GA1UdDwEB
+/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTgqj8ljZ9EXME66C6u
+d0yEPmcM9DANBgkqhkiG9w0BAQsFAAOCAgEAuVevuBLaV4OPaAszHQNTVfSVcOQr
+PbA56/qJYv331hgELyE03fFo8NWWWt7CgKPBjcZq91l3rhVkz1t5BXdm6ozTaw3d
+8VkswTOlMIAVRQdFGjEitpIAq5lNOo93r6kiyi9jyhXWx8bwPWz8HA2YEGGeEaIi
+1wrykXprOQ4vMMM2SZ/g6Q8CRFA3lFV96p/2O7qUpUzpvD5RtOjKkjZUbVwlKNrd
+rRT90+7iIgXr0PK3aBLXWopBGsaSpVo7Y0VPv+E6dyIvXL9G+VoDhRNCX8reU9di
+taY1BMJH/5n9hN9czulegChB8n3nHpDYT3Y+gjwN/KUD+nsa2UUeYNrEjvn8K8l7
+lcUq/6qJ34IxD3L/DCfXCh5WAFAeDJDBlrXYFIW7pw0WwfgHJBu6haEaBQmAupVj
+yTrsJZ9/nbqkRxWbRHDxakvWOF5D8xh+UG7pWijmZeZ3Gzr9Hb4DJqPb1OG7fpYn
+Kx3upPvaJVQTA945xsMfTZDsjxtK0hzthZU4UHlG1sGQUDGpXJpuHfUzVounmdLy
+yCwzk5Iwx06MZTMQZBf9JBeW0Y3COmor6xOLRPIh80oat3df1+2IpHLlOR+Vnb5n
+wXARPbv0+Em34yaXOp/SX3z7wJl8OSngex2/DaeP0ik0biQVy96QXr8axGbqwua6
+OV+KmalBWQewLK8=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIB9zCCAX2gAwIBAgIQBiUzsUcDMydc+Y2aub/M+DAKBggqhkjOPQQDAzA9MQsw
+CQYDVQQGEwJVUzESMBAGA1UEChMJQ2VydGFpbmx5MRowGAYDVQQDExFDZXJ0YWlu
+bHkgUm9vdCBFMTAeFw0yMTA0MDEwMDAwMDBaFw00NjA0MDEwMDAwMDBaMD0xCzAJ
+BgNVBAYTAlVTMRIwEAYDVQQKEwlDZXJ0YWlubHkxGjAYBgNVBAMTEUNlcnRhaW5s
+eSBSb290IEUxMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE3m/4fxzf7flHh4axpMCK
++IKXgOqPyEpeKn2IaKcBYhSRJHpcnqMXfYqGITQYUBsQ3tA3SybHGWCA6TS9YBk2
+QNYphwk8kXr2vBMj3VlOBF7PyAIcGFPBMdjaIOlEjeR2o0IwQDAOBgNVHQ8BAf8E
+BAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU8ygYy2R17ikq6+2uI1g4
+hevIIgcwCgYIKoZIzj0EAwMDaAAwZQIxALGOWiDDshliTd6wT99u0nCK8Z9+aozm
+ut6Dacpps6kFtZaSF4fC0urQe87YQVt8rgIwRt7qy12a7DLCZRawTDBcMPPaTnOG
+BtjOiQRINzf43TNRnXCve1XYAS59BWQOhriR
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIEDzCCAvegAwIBAgIBADANBgkqhkiG9w0BAQUFADBoMQswCQYDVQQGEwJVUzEl
+MCMGA1UEChMcU3RhcmZpZWxkIFRlY2hub2xvZ2llcywgSW5jLjEyMDAGA1UECxMp
+U3RhcmZpZWxkIENsYXNzIDIgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDQw
+NjI5MTczOTE2WhcNMzQwNjI5MTczOTE2WjBoMQswCQYDVQQGEwJVUzElMCMGA1UE
+ChMcU3RhcmZpZWxkIFRlY2hub2xvZ2llcywgSW5jLjEyMDAGA1UECxMpU3RhcmZp
+ZWxkIENsYXNzIDIgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggEgMA0GCSqGSIb3
+DQEBAQUAA4IBDQAwggEIAoIBAQC3Msj+6XGmBIWtDBFk385N78gDGIc/oav7PKaf
+8MOh2tTYbitTkPskpD6E8J7oX+zlJ0T1KKY/e97gKvDIr1MvnsoFAZMej2YcOadN
++lq2cwQlZut3f+dZxkqZJRRU6ybH838Z1TBwj6+wRir/resp7defqgSHo9T5iaU0
+X9tDkYI22WY8sbi5gv2cOj4QyDvvBmVmepsZGD3/cVE8MC5fvj13c7JdBmzDI1aa
+K4UmkhynArPkPw2vCHmCuDY96pzTNbO8acr1zJ3o/WSNF4Azbl5KXZnJHoe0nRrA
+1W4TNSNe35tfPe/W93bC6j67eA0cQmdrBNj41tpvi/JEoAGrAgEDo4HFMIHCMB0G
+A1UdDgQWBBS/X7fRzt0fhvRbVazc1xDCDqmI5zCBkgYDVR0jBIGKMIGHgBS/X7fR
+zt0fhvRbVazc1xDCDqmI56FspGowaDELMAkGA1UEBhMCVVMxJTAjBgNVBAoTHFN0
+YXJmaWVsZCBUZWNobm9sb2dpZXMsIEluYy4xMjAwBgNVBAsTKVN0YXJmaWVsZCBD
+bGFzcyAyIENlcnRpZmljYXRpb24gQXV0aG9yaXR5ggEAMAwGA1UdEwQFMAMBAf8w
+DQYJKoZIhvcNAQEFBQADggEBAAWdP4id0ckaVaGsafPzWdqbAYcaT1epoXkJKtv3
+L7IezMdeatiDh6GX70k1PncGQVhiv45YuApnP+yz3SFmH8lU+nLMPUxA2IGvd56D
+eruix/U0F47ZEUD0/CwqTRV/p2JdLiXTAAsgGh1o+Re49L2L7ShZ3U0WixeDyLJl
+xy16paq8U4Zt3VekyvggQQto8PT7dL5WXXp59fkdheMtlb71cZBDzI0fmgAKhynp
+VSJYACPq4xJDKVtHCN2MQWplBqjlIapBtJUhlbl90TSrE9atvNziPTnNvT51cKEY
+WQPJIrSPnNVeKtelttQKbfi3QBFGmh95DmK/D5fs4C8fF5Q=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIID3TCCAsWgAwIBAgIBADANBgkqhkiG9w0BAQsFADCBjzELMAkGA1UEBhMCVVMx
+EDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxJTAjBgNVBAoT
+HFN0YXJmaWVsZCBUZWNobm9sb2dpZXMsIEluYy4xMjAwBgNVBAMTKVN0YXJmaWVs
+ZCBSb290IENlcnRpZmljYXRlIEF1dGhvcml0eSAtIEcyMB4XDTA5MDkwMTAwMDAw
+MFoXDTM3MTIzMTIzNTk1OVowgY8xCzAJBgNVBAYTAlVTMRAwDgYDVQQIEwdBcml6
+b25hMRMwEQYDVQQHEwpTY290dHNkYWxlMSUwIwYDVQQKExxTdGFyZmllbGQgVGVj
+aG5vbG9naWVzLCBJbmMuMTIwMAYDVQQDEylTdGFyZmllbGQgUm9vdCBDZXJ0aWZp
+Y2F0ZSBBdXRob3JpdHkgLSBHMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
+ggEBAL3twQP89o/8ArFvW59I2Z154qK3A2FWGMNHttfKPTUuiUP3oWmb3ooa/RMg
+nLRJdzIpVv257IzdIvpy3Cdhl+72WoTsbhm5iSzchFvVdPtrX8WJpRBSiUZV9Lh1
+HOZ/5FSuS/hVclcCGfgXcVnrHigHdMWdSL5stPSksPNkN3mSwOxGXn/hbVNMYq/N
+Hwtjuzqd+/x5AJhhdM8mgkBj87JyahkNmcrUDnXMN/uLicFZ8WJ/X7NfZTD4p7dN
+dloedl40wOiWVpmKs/B/pM293DIxfJHP4F8R+GuqSVzRmZTRouNjWwl2tVZi4Ut0
+HZbUJtQIBFnQmA4O5t78w+wfkPECAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAO
+BgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFHwMMh+n2TB/xH1oo2Kooc6rB1snMA0G
+CSqGSIb3DQEBCwUAA4IBAQARWfolTwNvlJk7mh+ChTnUdgWUXuEok21iXQnCoKjU
+sHU48TRqneSfioYmUeYs0cYtbpUgSpIB7LiKZ3sx4mcujJUDJi5DnUox9g61DLu3
+4jd/IroAow57UvtruzvE03lRTs2Q9GcHGcg8RnoNAX3FWOdt5oUwF5okxBDgBPfg
+8n/Uqgr/Qh037ZTlZFkSIHc40zI+OIF1lnP6aI+xy84fxez6nH7PfrHxBy22/L/K
+pL/QlwVKvOoYKAKQvVR4CSFx09F9HdkWsKlhPdAKACL8x3vLCWRFCztAgfd9fDL1
+mMpYjn0q7pBZc2T5NnReJaH1ZgUufzkVqSr7UIuOhWn0
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIID7zCCAtegAwIBAgIBADANBgkqhkiG9w0BAQsFADCBmDELMAkGA1UEBhMCVVMx
+EDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxJTAjBgNVBAoT
+HFN0YXJmaWVsZCBUZWNobm9sb2dpZXMsIEluYy4xOzA5BgNVBAMTMlN0YXJmaWVs
+ZCBTZXJ2aWNlcyBSb290IENlcnRpZmljYXRlIEF1dGhvcml0eSAtIEcyMB4XDTA5
+MDkwMTAwMDAwMFoXDTM3MTIzMTIzNTk1OVowgZgxCzAJBgNVBAYTAlVTMRAwDgYD
+VQQIEwdBcml6b25hMRMwEQYDVQQHEwpTY290dHNkYWxlMSUwIwYDVQQKExxTdGFy
+ZmllbGQgVGVjaG5vbG9naWVzLCBJbmMuMTswOQYDVQQDEzJTdGFyZmllbGQgU2Vy
+dmljZXMgUm9vdCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkgLSBHMjCCASIwDQYJKoZI
+hvcNAQEBBQADggEPADCCAQoCggEBANUMOsQq+U7i9b4Zl1+OiFOxHz/Lz58gE20p
+OsgPfTz3a3Y4Y9k2YKibXlwAgLIvWX/2h/klQ4bnaRtSmpDhcePYLQ1Ob/bISdm2
+8xpWriu2dBTrz/sm4xq6HZYuajtYlIlHVv8loJNwU4PahHQUw2eeBGg6345AWh1K
+Ts9DkTvnVtYAcMtS7nt9rjrnvDH5RfbCYM8TWQIrgMw0R9+53pBlbQLPLJGmpufe
+hRhJfGZOozptqbXuNC66DQO4M99H67FrjSXZm86B0UVGMpZwh94CDklDhbZsc7tk
+6mFBrMnUVN+HL8cisibMn1lUaJ/8viovxFUcdUBgF4UCVTmLfwUCAwEAAaNCMEAw
+DwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFJxfAN+q
+AdcwKziIorhtSpzyEZGDMA0GCSqGSIb3DQEBCwUAA4IBAQBLNqaEd2ndOxmfZyMI
+bw5hyf2E3F/YNoHN2BtBLZ9g3ccaaNnRbobhiCPPE95Dz+I0swSdHynVv/heyNXB
+ve6SbzJ08pGCL72CQnqtKrcgfU28elUSwhXqvfdqlS5sdJ/PHLTyxQGjhdByPq1z
+qwubdQxtRbeOlKyWN7Wg0I8VRw7j6IPdj/3vQQF3zCepYoUz8jcI73HPdwbeyBkd
+iEDPfUYd/x7H4c7/I9vG+o1VTqkC50cRRj70/b17KSa7qWFiNyi2LSr2EIZkyXCn
+0q23KXB56jzaYyWf/Wi3MOxw+3WKt21gZ7IeyLnp2KhvAotnDU0mV3HaIPzBSlCN
+sSi6
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFujCCA6KgAwIBAgIJALtAHEP1Xk+wMA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNV
+BAYTAkNIMRUwEwYDVQQKEwxTd2lzc1NpZ24gQUcxHzAdBgNVBAMTFlN3aXNzU2ln
+biBHb2xkIENBIC0gRzIwHhcNMDYxMDI1MDgzMDM1WhcNMzYxMDI1MDgzMDM1WjBF
+MQswCQYDVQQGEwJDSDEVMBMGA1UEChMMU3dpc3NTaWduIEFHMR8wHQYDVQQDExZT
+d2lzc1NpZ24gR29sZCBDQSAtIEcyMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC
+CgKCAgEAr+TufoskDhJuqVAtFkQ7kpJcyrhdhJJCEyq8ZVeCQD5XJM1QiyUqt2/8
+76LQwB8CJEoTlo8jE+YoWACjR8cGp4QjK7u9lit/VcyLwVcfDmJlD909Vopz2q5+
+bbqBHH5CjCA12UNNhPqE21Is8w4ndwtrvxEvcnifLtg+5hg3Wipy+dpikJKVyh+c
+6bM8K8vzARO/Ws/BtQpgvd21mWRTuKCWs2/iJneRjOBiEAKfNA+k1ZIzUd6+jbqE
+emA8atufK+ze3gE/bk3lUIbLtK/tREDFylqM2tIrfKjuvqblCqoOpd8FUrdVxyJd
+MmqXl2MT28nbeTZ7hTpKxVKJ+STnnXepgv9VHKVxaSvRAiTysybUa9oEVeXBCsdt
+MDeQKuSeFDNeFhdVxVu1yzSJkvGdJo+hB9TGsnhQ2wwMC3wLjEHXuendjIj3o02y
+MszYF9rNt85mndT9Xv+9lz4pded+p2JYryU0pUHHPbwNUMoDAw8IWh+Vc3hiv69y
+FGkOpeUDDniOJihC8AcLYiAQZzlG+qkDzAQ4embvIIO1jEpWjpEA/I5cgt6IoMPi
+aG59je883WX0XaxR7ySArqpWl2/5rX3aYT+YdzylkbYcjCbaZaIJbcHiVOO5ykxM
+gI93e2CaHt+28kgeDrpOVG2Y4OGiGqJ3UM/EY5LsRxmd6+ZrzsECAwEAAaOBrDCB
+qTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUWyV7
+lqRlUX64OfPAeGZe6Drn8O4wHwYDVR0jBBgwFoAUWyV7lqRlUX64OfPAeGZe6Drn
+8O4wRgYDVR0gBD8wPTA7BglghXQBWQECAQEwLjAsBggrBgEFBQcCARYgaHR0cDov
+L3JlcG9zaXRvcnkuc3dpc3NzaWduLmNvbS8wDQYJKoZIhvcNAQEFBQADggIBACe6
+45R88a7A3hfm5djV9VSwg/S7zV4Fe0+fdWavPOhWfvxyeDgD2StiGwC5+OlgzczO
+UYrHUDFu4Up+GC9pWbY9ZIEr44OE5iKHjn3g7gKZYbge9LgriBIWhMIxkziWMaa5
+O1M/wySTVltpkuzFwbs4AOPsF6m43Md8AYOfMke6UiI0HTJ6CVanfCU2qT1L2sCC
+bwq7EsiHSycR+R4tx5M/nttfJmtS2S6K8RTGRI0Vqbe/vd6mGu6uLftIdxf+u+yv
+GPUqUfA5hJeVbG4bwyvEdGB5JbAKJ9/fXtI5z0V9QkvfsywexcZdylU6oJxpmo/a
+77KwPJ+HbBIrZXAVUjEaJM9vMSNQH4xPjyPDdEFjHFWoFN0+4FFQz/EbMFYOkrCC
+hdiDyyJkvC24JdVUorgG6q2SpCSgwYa1ShNqR88uC1aVVMvOmttqtKay20EIhid3
+92qgQmwLOM7XdVAyksLfKzAiSNDVQTglXaTpXZ/GlHXQRf0wl0OPkKsKx4ZzYEpp
+Ld6leNcG2mqeSz53OiATIgHQv2ieY2BrNU0LbbqhPcCT4H8js1WtciVORvnSFu+w
+ZMEBnunKoGqYDs/YYPIvSbjkQuE4NRb0yG5P94FW6LqjviOvrv1vA+ACOzB2+htt
+Qc8Bsem4yWb02ybzOqR08kkkW8mw0FfB+j564ZfJ
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFvTCCA6WgAwIBAgIITxvUL1S7L0swDQYJKoZIhvcNAQEFBQAwRzELMAkGA1UE
+BhMCQ0gxFTATBgNVBAoTDFN3aXNzU2lnbiBBRzEhMB8GA1UEAxMYU3dpc3NTaWdu
+IFNpbHZlciBDQSAtIEcyMB4XDTA2MTAyNTA4MzI0NloXDTM2MTAyNTA4MzI0Nlow
+RzELMAkGA1UEBhMCQ0gxFTATBgNVBAoTDFN3aXNzU2lnbiBBRzEhMB8GA1UEAxMY
+U3dpc3NTaWduIFNpbHZlciBDQSAtIEcyMIICIjANBgkqhkiG9w0BAQEFAAOCAg8A
+MIICCgKCAgEAxPGHf9N4Mfc4yfjDmUO8x/e8N+dOcbpLj6VzHVxumK4DV644N0Mv
+Fz0fyM5oEMF4rhkDKxD6LHmD9ui5aLlV8gREpzn5/ASLHvGiTSf5YXu6t+WiE7br
+YT7QbNHm+/pe7R20nqA1W6GSy/BJkv6FCgU+5tkL4k+73JU3/JHpMjUi0R86TieF
+nbAVlDLaYQ1HTWBCrpJH6INaUFjpiou5XaHc3ZlKHzZnu0jkg7Y360g6rw9njxcH
+6ATK72oxh9TAtvmUcXtnZLi2kUpCe2UuMGoM9ZDulebyzYLs2aFK7PayS+VFheZt
+eJMELpyCbTapxDFkH4aDCyr0NQp4yVXPQbBH6TCfmb5hqAaEuSh6XzjZG6k4sIN/
+c8HDO0gqgg8hm7jMqDXDhBuDsz6+pJVpATqJAHgE2cn0mRmrVn5bi4Y5FZGkECwJ
+MoBgs5PAKrYYC51+jUnyEEp/+dVGLxmSo5mnJqy7jDzmDrxHB9xzUfFwZC8I+bRH
+HTBsROopN4WSaGa8gzj+ezku01DwH/teYLappvonQfGbGHLy9YR0SslnxFSuSGTf
+jNFusB3hB48IHpmccelM2KX3RxIfdNFRnobzwqIjQAtz20um53MGjMGg6cFZrEb6
+5i/4z3GcRm25xBWNOHkDRUjvxF3XCO6HOSKGsg0PWEP3calILv3q1h8CAwEAAaOB
+rDCBqTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU
+F6DNweRBtjpbO8tFnb0cwpj6hlgwHwYDVR0jBBgwFoAUF6DNweRBtjpbO8tFnb0c
+wpj6hlgwRgYDVR0gBD8wPTA7BglghXQBWQEDAQEwLjAsBggrBgEFBQcCARYgaHR0
+cDovL3JlcG9zaXRvcnkuc3dpc3NzaWduLmNvbS8wDQYJKoZIhvcNAQEFBQADggIB
+AHPGgeAn0i0P4JUw4ppBf1AsX19iYamGamkYDHRJ1l2E6kFSGG9YrVBWIGrGvShp
+WJHckRE1qTodvBqlYJ7YH39FkWnZfrt4csEGDyrOj4VwYaygzQu4OSlWhDJOhrs9
+xCrZ1x9y7v5RoSJBsXECYxqCsGKrXlcSH9/L3XWgwF15kIwb4FDm3jH+mHtwX6WQ
+2K34ArZv02DdQEsixT2tOnqfGhpHkXkzuoLcMmkDlm4fS/Bx/uNncqCxv1yL5PqZ
+IseEuRuNI5c/7SXgz2W79WEE790eslpBIlqhn10s6FvJbakMDHiqYMZWjwFaDGi8
+aRl5xB9+lwW/xekkUV7U1UtT7dkjWjYDZaPBA61BMPNGG4WQr2W11bHkFlt4dR2X
+em1ZqSqPe97Dh4kQmUlzeMg9vVE1dCrV8X5pGyq7O70luJpaPXJhkGaH7gzWTdQR
+dAtq/gsD/KNVV4n+SsuuWxcFyPKNIzFTONItaj+CuY0IavdeQXRuwxF+B6wpYJE/
+OMpXEA29MC/HpeZBoNquBYeaoKRlbEwJDIm6uNO5wJOKMPqN5ZprFQFOZ6raYlY+
+hAhm0sQ2fac+EPyI4NSA5QC9qvNOBqN6avlicuMJT+ubDgEj8Z+7fNzcbBGXJbLy
+tGMU0gYqZ4yD9c7qB9iaah7s5Aq7KkzrCWA5zspi2C5u
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIF7zCCA9egAwIBAgIIDdPjvGz5a7EwDQYJKoZIhvcNAQELBQAwgYQxEjAQBgNV
+BAUTCUc2MzI4NzUxMDELMAkGA1UEBhMCRVMxJzAlBgNVBAoTHkFORiBBdXRvcmlk
+YWQgZGUgQ2VydGlmaWNhY2lvbjEUMBIGA1UECxMLQU5GIENBIFJhaXoxIjAgBgNV
+BAMTGUFORiBTZWN1cmUgU2VydmVyIFJvb3QgQ0EwHhcNMTkwOTA0MTAwMDM4WhcN
+MzkwODMwMTAwMDM4WjCBhDESMBAGA1UEBRMJRzYzMjg3NTEwMQswCQYDVQQGEwJF
+UzEnMCUGA1UEChMeQU5GIEF1dG9yaWRhZCBkZSBDZXJ0aWZpY2FjaW9uMRQwEgYD
+VQQLEwtBTkYgQ0EgUmFpejEiMCAGA1UEAxMZQU5GIFNlY3VyZSBTZXJ2ZXIgUm9v
+dCBDQTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANvrayvmZFSVgpCj
+cqQZAZ2cC4Ffc0m6p6zzBE57lgvsEeBbphzOG9INgxwruJ4dfkUyYA8H6XdYfp9q
+yGFOtibBTI3/TO80sh9l2Ll49a2pcbnvT1gdpd50IJeh7WhM3pIXS7yr/2WanvtH
+2Vdy8wmhrnZEE26cLUQ5vPnHO6RYPUG9tMJJo8gN0pcvB2VSAKduyK9o7PQUlrZX
+H1bDOZ8rbeTzPvY1ZNoMHKGESy9LS+IsJJ1tk0DrtSOOMspvRdOoiXsezx76W0OL
+zc2oD2rKDF65nkeP8Nm2CgtYZRczuSPkdxl9y0oukntPLxB3sY0vaJxizOBQ+OyR
+p1RMVwnVdmPF6GUe7m1qzwmd+nxPrWAI/VaZDxUse6mAq4xhj0oHdkLePfTdsiQz
+W7i1o0TJrH93PB0j7IKppuLIBkwC/qxcmZkLLxCKpvR/1Yd0DVlJRfbwcVw5Kda/
+SiOL9V8BY9KHcyi1Swr1+KuCLH5zJTIdC2MKF4EA/7Z2Xue0sUDKIbvVgFHlSFJn
+LNJhiQcND85Cd8BEc5xEUKDbEAotlRyBr+Qc5RQe8TZBAQIvfXOn3kLMTOmJDVb3
+n5HUA8ZsyY/b2BzgQJhdZpmYgG4t/wHFzstGH6wCxkPmrqKEPMVOHj1tyRRM4y5B
+u8o5vzY8KhmqQYdOpc5LMnndkEl/AgMBAAGjYzBhMB8GA1UdIwQYMBaAFJxf0Gxj
+o1+TypOYCK2Mh6UsXME3MB0GA1UdDgQWBBScX9BsY6Nfk8qTmAitjIelLFzBNzAO
+BgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOC
+AgEATh65isagmD9uw2nAalxJUqzLK114OMHVVISfk/CHGT0sZonrDUL8zPB1hT+L
+9IBdeeUXZ701guLyPI59WzbLWoAAKfLOKyzxj6ptBZNscsdW699QIyjlRRA96Gej
+rw5VD5AJYu9LWaL2U/HANeQvwSS9eS9OICI7/RogsKQOLHDtdD+4E5UGUcjohybK
+pFtqFiGS3XNgnhAY3jyB6ugYw3yJ8otQPr0R4hUDqDZ9MwFsSBXXiJCZBMXM5gf0
+vPSQ7RPi6ovDj6MzD8EpTBNO2hVWcXNyglD2mjN8orGoGjR0ZVzO0eurU+AagNjq
+OknkJjCb5RyKqKkVMoaZkgoQI1YS4PbOTOK7vtuNknMBZi9iPrJyJ0U27U1W45eZ
+/zo1PqVUSlJZS2Db7v54EX9K3BR5YLZrZAPbFYPhor72I5dQ8AkzNqdxliXzuUJ9
+2zg/LFis6ELhDtjTO0wugumDLmsx2d1Hhk9tl5EuT+IocTUW0fJz/iUrB0ckYyfI
++PbZa/wSMVYIwFNCr5zQM378BvAxRAMU8Vjq8moNqRGyg77FGr8H6lnco4g175x2
+MjxNBiLOFeXdntiP2t7SxDnlF4HPOEfrf4htWRvfn0IUrn7PqLBmZdo3r5+qPeoo
+tt7VMVgWglvquxl1AnMaykgaIZOQCo6ThKd9OyMYkomgjaw=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFODCCAyCgAwIBAgIRAJW+FqD3LkbxezmCcvqLzZYwDQYJKoZIhvcNAQEFBQAw
+NzEUMBIGA1UECgwLVGVsaWFTb25lcmExHzAdBgNVBAMMFlRlbGlhU29uZXJhIFJv
+b3QgQ0EgdjEwHhcNMDcxMDE4MTIwMDUwWhcNMzIxMDE4MTIwMDUwWjA3MRQwEgYD
+VQQKDAtUZWxpYVNvbmVyYTEfMB0GA1UEAwwWVGVsaWFTb25lcmEgUm9vdCBDQSB2
+MTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMK+6yfwIaPzaSZVfp3F
+VRaRXP3vIb9TgHot0pGMYzHw7CTww6XScnwQbfQ3t+XmfHnqjLWCi65ItqwA3GV1
+7CpNX8GH9SBlK4GoRz6JI5UwFpB/6FcHSOcZrr9FZ7E3GwYq/t75rH2D+1665I+X
+Z75Ljo1kB1c4VWk0Nj0TSO9P4tNmHqTPGrdeNjPUtAa9GAH9d4RQAEX1jF3oI7x+
+/jXh7VB7qTCNGdMJjmhnXb88lxhTuylixcpecsHHltTbLaC0H2kD7OriUPEMPPCs
+81Mt8Bz17Ww5OXOAFshSsCPN4D7c3TxHoLs1iuKYaIu+5b9y7tL6pe0S7fyYGKkm
+dtwoSxAgHNN/Fnct7W+A90m7UwW7XWjH1Mh1Fj+JWov3F0fUTPHSiXk+TT2YqGHe
+Oh7S+F4D4MHJHIzTjU3TlTazN19jY5szFPAtJmtTfImMMsJu7D0hADnJoWjiUIMu
+sDor8zagrC/kb2HCUQk5PotTubtn2txTuXZZNp1D5SDgPTJghSJRt8czu90VL6R4
+pgd7gUY2BIbdeTXHlSw7sKMXNeVzH7RcWe/a6hBle3rQf5+ztCo3O3CLm1u5K7fs
+slESl1MpWtTwEhDcTwK7EpIvYtQ/aUN8Ddb8WHUBiJ1YFkveupD/RwGJBmr2X7KQ
+arMCpgKIv7NHfirZ1fpoeDVNAgMBAAGjPzA9MA8GA1UdEwEB/wQFMAMBAf8wCwYD
+VR0PBAQDAgEGMB0GA1UdDgQWBBTwj1k4ALP1j5qWDNXr+nuqF+gTEjANBgkqhkiG
+9w0BAQUFAAOCAgEAvuRcYk4k9AwI//DTDGjkk0kiP0Qnb7tt3oNmzqjMDfz1mgbl
+dxSR651Be5kqhOX//CHBXfDkH1e3damhXwIm/9fH907eT/j3HEbAek9ALCI18Bmx
+0GtnLLCo4MBANzX2hFxc469CeP6nyQ1Q6g2EdvZR74NTxnr/DlZJLo961gzmJ1Tj
+TQpgcmLNkQfWpb/ImWvtxBnmq0wROMVvMeJuScg/doAmAyYp4Db29iBT4xdwNBed
+Y2gea+zDTYa4EzAvXUYNR0PVG6pZDrlcjQZIrXSHX8f8MVRBE+LHIQ6e4B4N4cB7
+Q4WQxYpYxmUKeFfyxiMPAdkgS94P+5KFdSpcc41teyWRyu5FrgZLAMzTsVlQ2jqI
+OylDRl6XK1TOU2+NSueW+r9xDkKLfP0ooNBIytrEgUy7onOTJsjrDNYmiLbAJM+7
+vVvrdX3pCI6GMyx5dwlppYn8s3CQh3aP0yK7Qs69cwsgJirQmz1wHiRszYd2qReW
+t88NkvuOGKmYSdGe/mBEciG5Ge3C9THxOUiIkCR1VBatzvT4aRRkOfujuLpwQMcn
+HL/EVlP6Y2XQ8xwOFvVrhlhNGNTkDY6lnVuR3HYkUD/GKvvZt5y11ubQ2egZixVx
+SK236thZiNSQvxaz2emsWWFUyBy6ysHK4bkgTI86k4mloMy/0/Z1pHWWbVY=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDwzCCAqugAwIBAgIBATANBgkqhkiG9w0BAQsFADCBgjELMAkGA1UEBhMCREUx
+KzApBgNVBAoMIlQtU3lzdGVtcyBFbnRlcnByaXNlIFNlcnZpY2VzIEdtYkgxHzAd
+BgNVBAsMFlQtU3lzdGVtcyBUcnVzdCBDZW50ZXIxJTAjBgNVBAMMHFQtVGVsZVNl
+YyBHbG9iYWxSb290IENsYXNzIDIwHhcNMDgxMDAxMTA0MDE0WhcNMzMxMDAxMjM1
+OTU5WjCBgjELMAkGA1UEBhMCREUxKzApBgNVBAoMIlQtU3lzdGVtcyBFbnRlcnBy
+aXNlIFNlcnZpY2VzIEdtYkgxHzAdBgNVBAsMFlQtU3lzdGVtcyBUcnVzdCBDZW50
+ZXIxJTAjBgNVBAMMHFQtVGVsZVNlYyBHbG9iYWxSb290IENsYXNzIDIwggEiMA0G
+CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCqX9obX+hzkeXaXPSi5kfl82hVYAUd
+AqSzm1nzHoqvNK38DcLZSBnuaY/JIPwhqgcZ7bBcrGXHX+0CfHt8LRvWurmAwhiC
+FoT6ZrAIxlQjgeTNuUk/9k9uN0goOA/FvudocP05l03Sx5iRUKrERLMjfTlH6VJi
+1hKTXrcxlkIF+3anHqP1wvzpesVsqXFP6st4vGCvx9702cu+fjOlbpSD8DT6Iavq
+jnKgP6TeMFvvhk1qlVtDRKgQFRzlAVfFmPHmBiiRqiDFt1MmUUOyCxGVWOHAD3bZ
+wI18gfNycJ5v/hqO2V81xrJvNHy+SE/iWjnX2J14np+GPgNeGYtEotXHAgMBAAGj
+QjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBS/
+WSA2AHmgoCJrjNXyYdK4LMuCSjANBgkqhkiG9w0BAQsFAAOCAQEAMQOiYQsfdOhy
+NsZt+U2e+iKo4YFWz827n+qrkRk4r6p8FU3ztqONpfSO9kSpp+ghla0+AGIWiPAC
+uvxhI+YzmzB6azZie60EI4RYZeLbK4rnJVM3YlNfvNoBYimipidx5joifsFvHZVw
+IEoHNN/q/xWA5brXethbdXwFeilHfkCoMRN3zUA7tFFHei4R40cR3p1m0IvVVGb6
+g1XqfMIpiRvpb7PO4gWEyS8+eIVibslfwXhjdFjASBgMmTnrpMwatXlajRWc2BQN
+9noHV8cigwUtPJslJj0Ys6lDfMjIq2SPDqO/nBudMNva0Bkuqjzx+zOAduTNrRlP
+BSeOE6Fuwg==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDwzCCAqugAwIBAgIBATANBgkqhkiG9w0BAQsFADCBgjELMAkGA1UEBhMCREUx
+KzApBgNVBAoMIlQtU3lzdGVtcyBFbnRlcnByaXNlIFNlcnZpY2VzIEdtYkgxHzAd
+BgNVBAsMFlQtU3lzdGVtcyBUcnVzdCBDZW50ZXIxJTAjBgNVBAMMHFQtVGVsZVNl
+YyBHbG9iYWxSb290IENsYXNzIDMwHhcNMDgxMDAxMTAyOTU2WhcNMzMxMDAxMjM1
+OTU5WjCBgjELMAkGA1UEBhMCREUxKzApBgNVBAoMIlQtU3lzdGVtcyBFbnRlcnBy
+aXNlIFNlcnZpY2VzIEdtYkgxHzAdBgNVBAsMFlQtU3lzdGVtcyBUcnVzdCBDZW50
+ZXIxJTAjBgNVBAMMHFQtVGVsZVNlYyBHbG9iYWxSb290IENsYXNzIDMwggEiMA0G
+CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC9dZPwYiJvJK7genasfb3ZJNW4t/zN
+8ELg63iIVl6bmlQdTQyK9tPPcPRStdiTBONGhnFBSivwKixVA9ZIw+A5OO3yXDw/
+RLyTPWGrTs0NvvAgJ1gORH8EGoel15YUNpDQSXuhdfsaa3Ox+M6pCSzyU9XDFES4
+hqX2iys52qMzVNn6chr3IhUciJFrf2blw2qAsCTz34ZFiP0Zf3WHHx+xGwpzJFu5
+ZeAsVMhg02YXP+HMVDNzkQI6pn97djmiH5a2OK61yJN0HZ65tOVgnS9W0eDrXltM
+EnAMbEQgqxHY9Bn20pxSN+f6tsIxO0rUFJmtxxr1XV/6B7h8DR/Wgx6zAgMBAAGj
+QjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBS1
+A/d2O2GCahKqGFPrAyGUv/7OyjANBgkqhkiG9w0BAQsFAAOCAQEAVj3vlNW92nOy
+WL6ukK2YJ5f+AbGwUgC4TeQbIXQbfsDuXmkqJa9c1h3a0nnJ85cp4IaH3gRZD/FZ
+1GSFS5mvJQQeyUapl96Cshtwn5z2r3Ex3XsFpSzTucpH9sry9uetuUg/vBa3wW30
+6gmv7PO15wWeph6KU1HWk4HMdJP2udqmJQV0eVp+QD6CSyYRMG7hP0HHRwA11fXT
+91Q+gT3aSWqas+8QPebrb9HIIkfLzM8BMZLZGOMivgkeGj5asuRrDFR6fUNOuIml
+e9eiPZaGzPImNC1qkp2aGtAw4l1OBLBfiyB+d8E9lYLRRpo7PHi4b6HQDWSieB4p
+TpPDpFQUWw==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFQTCCAymgAwIBAgICDL4wDQYJKoZIhvcNAQELBQAwUTELMAkGA1UEBhMCVFcx
+EjAQBgNVBAoTCVRBSVdBTi1DQTEQMA4GA1UECxMHUm9vdCBDQTEcMBoGA1UEAxMT
+VFdDQSBHbG9iYWwgUm9vdCBDQTAeFw0xMjA2MjcwNjI4MzNaFw0zMDEyMzExNTU5
+NTlaMFExCzAJBgNVBAYTAlRXMRIwEAYDVQQKEwlUQUlXQU4tQ0ExEDAOBgNVBAsT
+B1Jvb3QgQ0ExHDAaBgNVBAMTE1RXQ0EgR2xvYmFsIFJvb3QgQ0EwggIiMA0GCSqG
+SIb3DQEBAQUAA4ICDwAwggIKAoICAQCwBdvI64zEbooh745NnHEKH1Jw7W2CnJfF
+10xORUnLQEK1EjRsGcJ0pDFfhQKX7EMzClPSnIyOt7h52yvVavKOZsTuKwEHktSz
+0ALfUPZVr2YOy+BHYC8rMjk1Ujoog/h7FsYYuGLWRyWRzvAZEk2tY/XTP3VfKfCh
+MBwqoJimFb3u/Rk28OKRQ4/6ytYQJ0lM793B8YVwm8rqqFpD/G2Gb3PpN0Wp8DbH
+zIh1HrtsBv+baz4X7GGqcXzGHaL3SekVtTzWoWH1EfcFbx39Eb7QMAfCKbAJTibc
+46KokWofwpFFiFzlmLhxpRUZyXx1EcxwdE8tmx2RRP1WKKD+u4ZqyPpcC1jcxkt2
+yKsi2XMPpfRaAok/T54igu6idFMqPVMnaR1sjjIsZAAmY2E2TqNGtz99sy2sbZCi
+laLOz9qC5wc0GZbpuCGqKX6mOL6OKUohZnkfs8O1CWfe1tQHRvMq2uYiN2DLgbYP
+oA/pyJV/v1WRBXrPPRXAb94JlAGD1zQbzECl8LibZ9WYkTunhHiVJqRaCPgrdLQA
+BDzfuBSO6N+pjWxnkjMdwLfS7JLIvgm/LCkFbwJrnu+8vyq8W8BQj0FwcYeyTbcE
+qYSjMq+u7msXi7Kx/mzhkIyIqJdIzshNy/MGz19qCkKxHh53L46g5pIOBvwFItIm
+4TFRfTLcDwIDAQABoyMwITAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB
+/zANBgkqhkiG9w0BAQsFAAOCAgEAXzSBdu+WHdXltdkCY4QWwa6gcFGn90xHNcgL
+1yg9iXHZqjNB6hQbbCEAwGxCGX6faVsgQt+i0trEfJdLjbDorMjupWkEmQqSpqsn
+LhpNgb+E1HAerUf+/UqdM+DyucRFCCEK2mlpc3INvjT+lIutwx4116KD7+U4x6WF
+H6vPNOw/KP4M8VeGTslV9xzU2KV9Bnpv1d8Q34FOIWWxtuEXeZVFBs5fzNxGiWNo
+RI2T9GRwoD2dKAXDOXC4Ynsg/eTb6QihuJ49CcdP+yz4k3ZB3lLg4VfSnQO8d57+
+nile98FRYB/e2guyLXW3Q0iT5/Z5xoRdgFlglPx4mI88k1HtQJAH32RjJMtOcQWh
+15QaiDLxInQirqWm2BJpTGCjAu4r7NRjkgtevi92a6O2JryPA9gK8kxkRr05YuWW
+6zRjESjMlfGt7+/cgFhI6Uu46mWs6fyAtbXIRfmswZ/ZuepiiI7E8UuDEq3mi4TW
+nsLrgxifarsbJGAzcMzs9zLzXNl5fe+epP7JI8Mk7hWSsT2RTyaGvWZzJBPqpK5j
+wa19hAM8EHiGG3njxPPyBJUgriOCxLM6AGK/5jYk4Ve6xx6QddVfP5VhK8E7zeWz
+aGHQRiapIVJpLesux+t3zqY6tQMzT3bR51xUAV3LePTJDL/PEo4XLSNolOer/qmy
+KwbQBM0=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDezCCAmOgAwIBAgIBATANBgkqhkiG9w0BAQUFADBfMQswCQYDVQQGEwJUVzES
+MBAGA1UECgwJVEFJV0FOLUNBMRAwDgYDVQQLDAdSb290IENBMSowKAYDVQQDDCFU
+V0NBIFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDgwODI4MDcyNDMz
+WhcNMzAxMjMxMTU1OTU5WjBfMQswCQYDVQQGEwJUVzESMBAGA1UECgwJVEFJV0FO
+LUNBMRAwDgYDVQQLDAdSb290IENBMSowKAYDVQQDDCFUV0NBIFJvb3QgQ2VydGlm
+aWNhdGlvbiBBdXRob3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
+AQCwfnK4pAOU5qfeCTiRShFAh6d8WWQUe7UREN3+v9XAu1bihSX0NXIP+FPQQeFE
+AcK0HMMxQhZHhTMidrIKbw/lJVBPhYa+v5guEGcevhEFhgWQxFnQfHgQsIBct+HH
+K3XLfJ+utdGdIzdjp9xCoi2SBBtQwXu4PhvJVgSLL1KbralW6cH/ralYhzC2gfeX
+RfwZVzsrb+RH9JlF/h3x+JejiB03HFyP4HYlmlD4oFT/RJB2I9IyxsOrBr/8+7/z
+rX2SYgJbKdM1o5OaQ2RgXbL6Mv87BK9NQGr5x+PvI/1ry+UPizgN7gr8/g+YnzAx
+3WxSZfmLgb4i4RxYA7qRG4kHAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNV
+HRMBAf8EBTADAQH/MB0GA1UdDgQWBBRqOFsmjd6LWvJPelSDGRjjCDWmujANBgkq
+hkiG9w0BAQUFAAOCAQEAPNV3PdrfibqHDAhUaiBQkr6wQT25JmSDCi/oQMCXKCeC
+MErJk/9q56YAf4lCmtYR5VPOL8zy2gXE/uJQxDqGfczafhAJO5I1KlOy/usrBdls
+XebQ79NqZp4VKIV66IIArB6nCWlWQtNoURi+VJq/REG6Sb4gumlc7rh3zc5sH62D
+lhh9DrUUOYTxKOkto557HnpyWoOzeW/vtPzQCqVYT0bf+215WfKEIlKuD8z7fDvn
+aspHYcN6+NOSBB+4IIThNlQWx0DeO4pz3N/GCUzf7Nr/1FNCocnyYh0igzyXxfkZ
+YiesZSLX0zzG5Y6yU8xJzrww/nsOM5D77dIUkR8Hrw==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFgzCCA2ugAwIBAgIORea7A4Mzw4VlSOb/RVEwDQYJKoZIhvcNAQEMBQAwTDEg
+MB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjYxEzARBgNVBAoTCkdsb2Jh
+bFNpZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMTQxMjEwMDAwMDAwWhcNMzQx
+MjEwMDAwMDAwWjBMMSAwHgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSNjET
+MBEGA1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbjCCAiIwDQYJ
+KoZIhvcNAQEBBQADggIPADCCAgoCggIBAJUH6HPKZvnsFMp7PPcNCPG0RQssgrRI
+xutbPK6DuEGSMxSkb3/pKszGsIhrxbaJ0cay/xTOURQh7ErdG1rG1ofuTToVBu1k
+ZguSgMpE3nOUTvOniX9PeGMIyBJQbUJmL025eShNUhqKGoC3GYEOfsSKvGRMIRxD
+aNc9PIrFsmbVkJq3MQbFvuJtMgamHvm566qjuL++gmNQ0PAYid/kD3n16qIfKtJw
+LnvnvJO7bVPiSHyMEAc4/2ayd2F+4OqMPKq0pPbzlUoSB239jLKJz9CgYXfIWHSw
+1CM69106yqLbnQneXUQtkPGBzVeS+n68UARjNN9rkxi+azayOeSsJDa38O+2HBNX
+k7besvjihbdzorg1qkXy4J02oW9UivFyVm4uiMVRQkQVlO6jxTiWm05OWgtH8wY2
+SXcwvHE35absIQh1/OZhFj931dmRl4QKbNQCTXTAFO39OfuD8l4UoQSwC+n+7o/h
+bguyCLNhZglqsQY6ZZZZwPA1/cnaKI0aEYdwgQqomnUdnjqGBQCe24DWJfncBZ4n
+WUx2OVvq+aWh2IMP0f/fMBH5hc8zSPXKbWQULHpYT9NLCEnFlWQaYw55PfWzjMpY
+rZxCRXluDocZXFSxZba/jJvcE+kNb7gu3GduyYsRtYQUigAZcIN5kZeR1Bonvzce
+MgfYFGM8KEyvAgMBAAGjYzBhMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTAD
+AQH/MB0GA1UdDgQWBBSubAWjkxPioufi1xzWx/B/yGdToDAfBgNVHSMEGDAWgBSu
+bAWjkxPioufi1xzWx/B/yGdToDANBgkqhkiG9w0BAQwFAAOCAgEAgyXt6NH9lVLN
+nsAEoJFp5lzQhN7craJP6Ed41mWYqVuoPId8AorRbrcWc+ZfwFSY1XS+wc3iEZGt
+Ixg93eFyRJa0lV7Ae46ZeBZDE1ZXs6KzO7V33EByrKPrmzU+sQghoefEQzd5Mr61
+55wsTLxDKZmOMNOsIeDjHfrYBzN2VAAiKrlNIC5waNrlU/yDXNOd8v9EDERm8tLj
+vUYAGm0CuiVdjaExUd1URhxN25mW7xocBFymFe944Hn+Xds+qkxV/ZoVqW/hpvvf
+cDDpw+5CRu3CkwWJ+n1jez/QcYF8AOiYrg54NMMl+68KnyBr3TsTjxKM4kEaSHpz
+oHdpx7Zcf4LIHv5YGygrqGytXm3ABdJ7t+uA/iU3/gKbaKxCXcPu9czc8FB10jZp
+nOZ7BN9uBmm23goJSFmH63sUYHpkqmlD75HHTOwY3WzvUy2MmeFe8nI+z1TIvWfs
+pA9MRf/TuTAjB0yPEL+GltmZWrSZVxykzLsViVO6LAUP5MSeGbEYNNVMnbrt9x+v
+JJUEeKgDu+6B5dpffItKoZB0JaezPkvILFa9x8jvOOJckvB595yEunQtYQEgfn7R
+8k8HWV+LLUNS60YMlOH1Zkd5d9VUWx+tJDfLRVpOoERIyNiwmcUVhAn21klJwGW4
+5hpxbqCo8YLoRT5s1gLXCmeDBVrJpBA=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFszCCA5ugAwIBAgIUEwLV4kBMkkaGFmddtLu7sms+/BMwDQYJKoZIhvcNAQEL
+BQAwYTELMAkGA1UEBhMCVE4xNzA1BgNVBAoMLkFnZW5jZSBOYXRpb25hbGUgZGUg
+Q2VydGlmaWNhdGlvbiBFbGVjdHJvbmlxdWUxGTAXBgNVBAMMEFR1blRydXN0IFJv
+b3QgQ0EwHhcNMTkwNDI2MDg1NzU2WhcNNDQwNDI2MDg1NzU2WjBhMQswCQYDVQQG
+EwJUTjE3MDUGA1UECgwuQWdlbmNlIE5hdGlvbmFsZSBkZSBDZXJ0aWZpY2F0aW9u
+IEVsZWN0cm9uaXF1ZTEZMBcGA1UEAwwQVHVuVHJ1c3QgUm9vdCBDQTCCAiIwDQYJ
+KoZIhvcNAQEBBQADggIPADCCAgoCggIBAMPN0/y9BFPdDCA61YguBUtB9YOCfvdZ
+n56eY+hz2vYGqU8ftPkLHzmMmiDQfgbU7DTZhrx1W4eI8NLZ1KMKsmwb60ksPqxd
+2JQDoOw05TDENX37Jk0bbjBU2PWARZw5rZzJJQRNmpA+TkBuimvNKWfGzC3gdOgF
+VwpIUPp6Q9p+7FuaDmJ2/uqdHYVy7BG7NegfJ7/Boce7SBbdVtfMTqDhuazb1YMZ
+GoXRlJfXyqNlC/M4+QKu3fZnz8k/9YosRxqZbwUN/dAdgjH8KcwAWJeRTIAAHDOF
+li/LQcKLEITDCSSJH7UP2dl3RxiSlGBcx5kDPP73lad9UKGAwqmDrViWVSHbhlnU
+r8a83YFuB9tgYv7sEG7aaAH0gxupPqJbI9dkxt/con3YS7qC0lH4Zr8GRuR5KiY2
+eY8fTpkdso8MDhz/yV3A/ZAQprE38806JG60hZC/gLkMjNWb1sjxVj8agIl6qeIb
+MlEsPvLfe/ZdeikZjuXIvTZxi11Mwh0/rViizz1wTaZQmCXcI/m4WEEIcb9PuISg
+jwBUFfyRbVinljvrS5YnzWuioYasDXxU5mZMZl+QviGaAkYt5IPCgLnPSz7ofzwB
+7I9ezX/SKEIBlYrilz0QIX32nRzFNKHsLA4KUiwSVXAkPcvCFDVDXSdOvsC9qnyW
+5/yeYa1E0wCXAgMBAAGjYzBhMB0GA1UdDgQWBBQGmpsfU33x9aTI04Y+oXNZtPdE
+ITAPBgNVHRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFAaamx9TffH1pMjThj6hc1m0
+90QhMA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAgEAqgVutt0Vyb+z
+xiD2BkewhpMl0425yAA/l/VSJ4hxyXT968pk21vvHl26v9Hr7lxpuhbI87mP0zYu
+QEkHDVneixCwSQXi/5E/S7fdAo74gShczNxtr18UnH1YeA32gAm56Q6XKRm4t+v4
+FstVEuTGfbvE7Pi1HE4+Z7/FXxttbUcoqgRYYdZ2vyJ/0Adqp2RT8JeNnYA/u8EH
+22Wv5psymsNUk8QcCMNE+3tjEUPRahphanltkE8pjkcFwRJpadbGNjHh/PqAulxP
+xOu3Mqz4dWEX1xAZufHSCe96Qp1bWgvUxpVOKs7/B9dPfhgGiPEZtdmYu65xxBzn
+dFlY7wyJz4sfdZMaBBSSSFCp61cpABbjNhzI+L/wM9VBD8TMPN3pM0MBkRArHtG5
+Xc0yGYuPjCB31yLEQtyEFpslbei0VXF/sHyz03FJuc9SpAQ/3D2gu68zngowYI7b
+nV2UqL1g52KAdoGDDIzMMEZJ4gzSqK/rYXHv5yJiqfdcZGyfFoxnNidF9Ql7v/YQ
+CvGwjVRDjAS6oz/v4jXH+XTgbzRB0L9zZVcg+ZtnemZoJE6AZb0QmQZZ8mWvuMZH
+u/2QeItBcy6vVR/cO5JyboTT0GFMDcx2V+IthSIVNg3rAZ3r2OvEhJn7wAzMMujj
+d9qDRIueVSjAi1jTkD5OGwDxFa2DK5o=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIEMDCCAxigAwIBAgIQUJRs7Bjq1ZxN1ZfvdY+grTANBgkqhkiG9w0BAQUFADCB
+gjELMAkGA1UEBhMCVVMxHjAcBgNVBAsTFXd3dy54cmFtcHNlY3VyaXR5LmNvbTEk
+MCIGA1UEChMbWFJhbXAgU2VjdXJpdHkgU2VydmljZXMgSW5jMS0wKwYDVQQDEyRY
+UmFtcCBHbG9iYWwgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDQxMTAxMTcx
+NDA0WhcNMzUwMTAxMDUzNzE5WjCBgjELMAkGA1UEBhMCVVMxHjAcBgNVBAsTFXd3
+dy54cmFtcHNlY3VyaXR5LmNvbTEkMCIGA1UEChMbWFJhbXAgU2VjdXJpdHkgU2Vy
+dmljZXMgSW5jMS0wKwYDVQQDEyRYUmFtcCBHbG9iYWwgQ2VydGlmaWNhdGlvbiBB
+dXRob3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCYJB69FbS6
+38eMpSe2OAtp87ZOqCwuIR1cRN8hXX4jdP5efrRKt6atH67gBhbim1vZZ3RrXYCP
+KZ2GG9mcDZhtdhAoWORlsH9KmHmf4MMxfoArtYzAQDsRhtDLooY2YKTVMIJt2W7Q
+DxIEM5dfT2Fa8OT5kavnHTu86M/0ay00fOJIYRyO82FEzG+gSqmUsE3a56k0enI4
+qEHMPJQRfevIpoy3hsvKMzvZPTeL+3o+hiznc9cKV6xkmxnr9A8ECIqsAxcZZPRa
+JSKNNCyy9mgdEm3Tih4U2sSPpuIjhdV6Db1q4Ons7Be7QhtnqiXtRYMh/MHJfNVi
+PvryxS3T/dRlAgMBAAGjgZ8wgZwwEwYJKwYBBAGCNxQCBAYeBABDAEEwCwYDVR0P
+BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFMZPoj0GY4QJnM5i5ASs
+jVy16bYbMDYGA1UdHwQvMC0wK6ApoCeGJWh0dHA6Ly9jcmwueHJhbXBzZWN1cml0
+eS5jb20vWEdDQS5jcmwwEAYJKwYBBAGCNxUBBAMCAQEwDQYJKoZIhvcNAQEFBQAD
+ggEBAJEVOQMBG2f7Shz5CmBbodpNl2L5JFMn14JkTpAuw0kbK5rc/Kh4ZzXxHfAR
+vbdI4xD2Dd8/0sm2qlWkSLoC295ZLhVbO50WfUfXN+pfTXYSNrsf16GBBEYgoyxt
+qZ4Bfj8pzgCT3/3JknOJiWSe5yvkHJEs0rnOfc5vMZnT5r7SHpDwCRR5XCOrTdLa
+IR9NmXmd4c8nnxCbHIgNsIpkQTG4DmyQJKSbXHGPurt+HBvbaoAPIbzp26a3QPSy
+i6mx5O+aGtA9aZnuqCij4Tyz8LIRnM98QObd50N9otg6tamN8jSZxNQQ4Qb9CYQQ
+O+7ETPTsJ3xCwnR8gooJybQDJbw=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICwzCCAkqgAwIBAgIBADAKBggqhkjOPQQDAjCBqjELMAkGA1UEBhMCR1IxDzAN
+BgNVBAcTBkF0aGVuczFEMEIGA1UEChM7SGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJl
+c2VhcmNoIEluc3RpdHV0aW9ucyBDZXJ0LiBBdXRob3JpdHkxRDBCBgNVBAMTO0hl
+bGxlbmljIEFjYWRlbWljIGFuZCBSZXNlYXJjaCBJbnN0aXR1dGlvbnMgRUNDIFJv
+b3RDQSAyMDE1MB4XDTE1MDcwNzEwMzcxMloXDTQwMDYzMDEwMzcxMlowgaoxCzAJ
+BgNVBAYTAkdSMQ8wDQYDVQQHEwZBdGhlbnMxRDBCBgNVBAoTO0hlbGxlbmljIEFj
+YWRlbWljIGFuZCBSZXNlYXJjaCBJbnN0aXR1dGlvbnMgQ2VydC4gQXV0aG9yaXR5
+MUQwQgYDVQQDEztIZWxsZW5pYyBBY2FkZW1pYyBhbmQgUmVzZWFyY2ggSW5zdGl0
+dXRpb25zIEVDQyBSb290Q0EgMjAxNTB2MBAGByqGSM49AgEGBSuBBAAiA2IABJKg
+QehLgoRc4vgxEZmGZE4JJS+dQS8KrjVPdJWyUWRrjWvmP3CV8AVER6ZyOFB2lQJa
+jq4onvktTpnvLEhvTCUp6NFxW98dwXU3tNf6e3pCnGoKVlp8aQuqgAkkbH7BRqNC
+MEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFLQi
+C4KZJAEOnLvkDv2/+5cgk5kqMAoGCCqGSM49BAMCA2cAMGQCMGfOFmI4oqxiRaep
+lSTAGiecMjvAwNW6qef4BENThe5SId6d9SWDPp5YSy/XZxMOIQIwBeF1Ad5o7Sof
+TUwJCA3sS61kFyjndc5FZXIhF8siQQ6ME5g4mlRtm8rifOoCWCKR
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIC2zCCAmCgAwIBAgIQXwJB13qHfEwDo6yWjfv/0DAKBggqhkjOPQQDAzBIMQsw
+CQYDVQQGEwJERTEVMBMGA1UEChMMRC1UcnVzdCBHbWJIMSIwIAYDVQQDExlELVRS
+VVNUIEVWIFJvb3QgQ0EgMSAyMDIwMB4XDTIwMDIxMTEwMDAwMFoXDTM1MDIxMTA5
+NTk1OVowSDELMAkGA1UEBhMCREUxFTATBgNVBAoTDEQtVHJ1c3QgR21iSDEiMCAG
+A1UEAxMZRC1UUlVTVCBFViBSb290IENBIDEgMjAyMDB2MBAGByqGSM49AgEGBSuB
+BAAiA2IABPEL3YZDIBnfl4XoIkqbz52Yv7QFJsnL46bSj8WeeHsxiamJrSc8ZRCC
+/N/DnU7wMyPE0jL1HLDfMxddxfCxivnvubcUyilKwg+pf3VlSSowZ/Rk99Yad9rD
+wpdhQntJraOCAQ0wggEJMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFH8QARY3
+OqQo5FD4pPfsazK2/umLMA4GA1UdDwEB/wQEAwIBBjCBxgYDVR0fBIG+MIG7MD6g
+PKA6hjhodHRwOi8vY3JsLmQtdHJ1c3QubmV0L2NybC9kLXRydXN0X2V2X3Jvb3Rf
+Y2FfMV8yMDIwLmNybDB5oHegdYZzbGRhcDovL2RpcmVjdG9yeS5kLXRydXN0Lm5l
+dC9DTj1ELVRSVVNUJTIwRVYlMjBSb290JTIwQ0ElMjAxJTIwMjAyMCxPPUQtVHJ1
+c3QlMjBHbWJILEM9REU/Y2VydGlmaWNhdGVyZXZvY2F0aW9ubGlzdDAKBggqhkjO
+PQQDAwNpADBmAjEAyjzGKnXCXnViOTYAYFqLwZOZzNnbQTs7h5kXO9XMT8oi96CA
+y/m0sRtW9XLS/BnRAjEAkfcwkz8QRitxpNA7RJvAKQIFskF3UfN5Wp6OFKBOQtJb
+gfM0agPnIjhQW+0ZT0MW
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIEIDCCAwigAwIBAgIJAISCLF8cYtBAMA0GCSqGSIb3DQEBCwUAMIGcMQswCQYD
+VQQGEwJQQTEPMA0GA1UECAwGUGFuYW1hMRQwEgYDVQQHDAtQYW5hbWEgQ2l0eTEk
+MCIGA1UECgwbVHJ1c3RDb3IgU3lzdGVtcyBTLiBkZSBSLkwuMScwJQYDVQQLDB5U
+cnVzdENvciBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxFzAVBgNVBAMMDlRydXN0Q29y
+IEVDQS0xMB4XDTE2MDIwNDEyMzIzM1oXDTI5MTIzMTE3MjgwN1owgZwxCzAJBgNV
+BAYTAlBBMQ8wDQYDVQQIDAZQYW5hbWExFDASBgNVBAcMC1BhbmFtYSBDaXR5MSQw
+IgYDVQQKDBtUcnVzdENvciBTeXN0ZW1zIFMuIGRlIFIuTC4xJzAlBgNVBAsMHlRy
+dXN0Q29yIENlcnRpZmljYXRlIEF1dGhvcml0eTEXMBUGA1UEAwwOVHJ1c3RDb3Ig
+RUNBLTEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDPj+ARtZ+odnbb
+3w9U73NjKYKtR8aja+3+XzP4Q1HpGjORMRegdMTUpwHmspI+ap3tDvl0mEDTPwOA
+BoJA6LHip1GnHYMma6ve+heRK9jGrB6xnhkB1Zem6g23xFUfJ3zSCNV2HykVh0A5
+3ThFEXXQmqc04L/NyFIduUd+Dbi7xgz2c1cWWn5DkR9VOsZtRASqnKmcp0yJF4Ou
+owReUoCLHhIlERnXDH19MURB6tuvsBzvgdAsxZohmz3tQjtQJvLsznFhBmIhVE5/
+wZ0+fyCMgMsq2JdiyIMzkX2woloPV+g7zPIlstR8L+xNxqE6FXrntl019fZISjZF
+ZtS6mFjBAgMBAAGjYzBhMB0GA1UdDgQWBBREnkj1zG1I1KBLf/5ZJC+Dl5mahjAf
+BgNVHSMEGDAWgBREnkj1zG1I1KBLf/5ZJC+Dl5mahjAPBgNVHRMBAf8EBTADAQH/
+MA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOCAQEABT41XBVwm8nHc2Fv
+civUwo/yQ10CzsSUuZQRg2dd4mdsdXa/uwyqNsatR5Nj3B5+1t4u/ukZMjgDfxT2
+AHMsWbEhBuH7rBiVDKP/mZb3Kyeb1STMHd3BOuCYRLDE5D53sXOpZCz2HAF8P11F
+hcCF5yWPldwX8zyfGm6wyuMdKulMY/okYWLW2n62HGz1Ah3UKt1VkOsqEUc8Ll50
+soIipX1TH0XsJ5F95yIW6MBoNtjG8U+ARDL54dHRHareqKucBK+tIA5kmE2la8BI
+WJZpTdwHjFGTot+fDz2LYLSCjaoITmJF4PkL0uDgPFveXHEnJcLmA4GLEFPjx1Wi
+tJ/X5g==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIGLzCCBBegAwIBAgIIJaHfyjPLWQIwDQYJKoZIhvcNAQELBQAwgaQxCzAJBgNV
+BAYTAlBBMQ8wDQYDVQQIDAZQYW5hbWExFDASBgNVBAcMC1BhbmFtYSBDaXR5MSQw
+IgYDVQQKDBtUcnVzdENvciBTeXN0ZW1zIFMuIGRlIFIuTC4xJzAlBgNVBAsMHlRy
+dXN0Q29yIENlcnRpZmljYXRlIEF1dGhvcml0eTEfMB0GA1UEAwwWVHJ1c3RDb3Ig
+Um9vdENlcnQgQ0EtMjAeFw0xNjAyMDQxMjMyMjNaFw0zNDEyMzExNzI2MzlaMIGk
+MQswCQYDVQQGEwJQQTEPMA0GA1UECAwGUGFuYW1hMRQwEgYDVQQHDAtQYW5hbWEg
+Q2l0eTEkMCIGA1UECgwbVHJ1c3RDb3IgU3lzdGVtcyBTLiBkZSBSLkwuMScwJQYD
+VQQLDB5UcnVzdENvciBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxHzAdBgNVBAMMFlRy
+dXN0Q29yIFJvb3RDZXJ0IENBLTIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK
+AoICAQCnIG7CKqJiJJWQdsg4foDSq8GbZQWU9MEKENUCrO2fk8eHyLAnK0IMPQo+
+QVqedd2NyuCb7GgypGmSaIwLgQ5WoD4a3SwlFIIvl9NkRvRUqdw6VC0xK5mC8tkq
+1+9xALgxpL56JAfDQiDyitSSBBtlVkxs1Pu2YVpHI7TYabS3OtB0PAx1oYxOdqHp
+2yqlO/rOsP9+aij9JxzIsekp8VduZLTQwRVtDr4uDkbIXvRR/u8OYzo7cbrPb1nK
+DOObXUm4TOJXsZiKQlecdu/vvdFoqNL0Cbt3Nb4lggjEFixEIFapRBF37120Hape
+az6LMvYHL1cEksr1/p3C6eizjkxLAjHZ5DxIgif3GIJ2SDpxsROhOdUuxTTCHWKF
+3wP+TfSvPd9cW436cOGlfifHhi5qjxLGhF5DUVCcGZt45vz27Ud+ez1m7xMTiF88
+oWP7+ayHNZ/zgp6kPwqcMWmLmaSISo5uZk3vFsQPeSghYA2FFn3XVDjxklb9tTNM
+g9zXEJ9L/cb4Qr26fHMC4P99zVvh1Kxhe1fVSntb1IVYJ12/+CtgrKAmrhQhJ8Z3
+mjOAPF5GP/fDsaOGM8boXg25NSyqRsGFAnWAoOsk+xWq5Gd/bnc/9ASKL3x74xdh
+8N0JqSDIvgmk0H5Ew7IwSjiqqewYmgeCK9u4nBit2uBGF6zPXQIDAQABo2MwYTAd
+BgNVHQ4EFgQU2f4hQG6UnrybPZx9mCAZ5YwwYrIwHwYDVR0jBBgwFoAU2f4hQG6U
+nrybPZx9mCAZ5YwwYrIwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAYYw
+DQYJKoZIhvcNAQELBQADggIBAJ5Fngw7tu/hOsh80QA9z+LqBrWyOrsGS2h60COX
+dKcs8AjYeVrXWoSK2BKaG9l9XE1wxaX5q+WjiYndAfrs3fnpkpfbsEZC89NiqpX+
+MWcUaViQCqoL7jcjx1BRtPV+nuN79+TMQjItSQzL/0kMmx40/W5ulop5A7Zv2wnL
+/V9lFDfhOPXzYRZY5LVtDQsEGz9QLX+zx3oaFoBg+Iof6Rsqxvm6ARppv9JYx1RX
+CI/hOWB3S6xZhBqI8d3LT3jX5+EzLfzuQfogsL7L9ziUwOHQhQ+77Sxzq+3+knYa
+ZH9bDTMJBzN7Bj8RpFxwPIXAz+OQqIN3+tvmxYxoZxBnpVIt8MSZj3+/0WvitUfW
+2dCFmU2Umw9Lje4AWkcdEQOsQRivh7dvDDqPys/cA8GiCcjl/YBeyGBCARsaU1q7
+N6a3vLqE6R5sGtRk2tRD/pOLS/IseRYQ1JMLiI+h2IYURpFHmygk71dSTlxCnKr3
+Sewn6EAes6aJInKc9Q0ztFijMDvd1GpUk74aTfOTlPf8hAs/hCBcNANExdqtvArB
+As8e5ZTZ845b2EzwnexhF7sUMlQMAimTHpKG9n/v55IFDlndmQguLvqcAFLTxWYp
+5KeXRKQOKIETNcX2b2TmQcTVL8w0RSXPQQCWPUouwpaYT05KnJe32x+SMsj/D1Fu
+1uwJ
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFpDCCA4ygAwIBAgIQOcqTHO9D88aOk8f0ZIk4fjANBgkqhkiG9w0BAQsFADBs
+MQswCQYDVQQGEwJHUjE3MDUGA1UECgwuSGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJl
+c2VhcmNoIEluc3RpdHV0aW9ucyBDQTEkMCIGA1UEAwwbSEFSSUNBIFRMUyBSU0Eg
+Um9vdCBDQSAyMDIxMB4XDTIxMDIxOTEwNTUzOFoXDTQ1MDIxMzEwNTUzN1owbDEL
+MAkGA1UEBhMCR1IxNzA1BgNVBAoMLkhlbGxlbmljIEFjYWRlbWljIGFuZCBSZXNl
+YXJjaCBJbnN0aXR1dGlvbnMgQ0ExJDAiBgNVBAMMG0hBUklDQSBUTFMgUlNBIFJv
+b3QgQ0EgMjAyMTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAIvC569l
+mwVnlskNJLnQDmT8zuIkGCyEf3dRywQRNrhe7Wlxp57kJQmXZ8FHws+RFjZiPTgE
+4VGC/6zStGndLuwRo0Xua2s7TL+MjaQenRG56Tj5eg4MmOIjHdFOY9TnuEFE+2uv
+a9of08WRiFukiZLRgeaMOVig1mlDqa2YUlhu2wr7a89o+uOkXjpFc5gH6l8Cct4M
+pbOfrqkdtx2z/IpZ525yZa31MJQjB/OCFks1mJxTuy/K5FrZx40d/JiZ+yykgmvw
+Kh+OC19xXFyuQnspiYHLA6OZyoieC0AJQTPb5lh6/a6ZcMBaD9YThnEvdmn8kN3b
+LW7R8pv1GmuebxWMevBLKKAiOIAkbDakO/IwkfN4E8/BPzWr8R0RI7VDIp4BkrcY
+AuUR0YLbFQDMYTfBKnya4dC6s1BG7oKsnTH4+yPiAwBIcKMJJnkVU2DzOFytOOqB
+AGMUuTNe3QvboEUHGjMJ+E20pwKmafTCWQWIZYVWrkvL4N48fS0ayOn7H6NhStYq
+E613TBoYm5EPWNgGVMWX+Ko/IIqmhaZ39qb8HOLubpQzKoNQhArlT4b4UEV4AIHr
+W2jjJo3Me1xR9BQsQL4aYB16cmEdH2MtiKrOokWQCPxrvrNQKlr9qEgYRtaQQJKQ
+CoReaDH46+0N0x3GfZkYVVYnZS6NRcUk7M7jAgMBAAGjQjBAMA8GA1UdEwEB/wQF
+MAMBAf8wHQYDVR0OBBYEFApII6ZgpJIKM+qTW8VX6iVNvRLuMA4GA1UdDwEB/wQE
+AwIBhjANBgkqhkiG9w0BAQsFAAOCAgEAPpBIqm5iFSVmewzVjIuJndftTgfvnNAU
+X15QvWiWkKQUEapobQk1OUAJ2vQJLDSle1mESSmXdMgHHkdt8s4cUCbjnj1AUz/3
+f5Z2EMVGpdAgS1D0NTsY9FVqQRtHBmg8uwkIYtlfVUKqrFOFrJVWNlar5AWMxaja
+H6NpvVMPxP/cyuN+8kyIhkdGGvMA9YCRotxDQpSbIPDRzbLrLFPCU3hKTwSUQZqP
+JzLB5UkZv/HywouoCjkxKLR9YjYsTewfM7Z+d21+UPCfDtcRj88YxeMn/ibvBZ3P
+zzfF0HvaO7AWhAw6k9a+F9sPPg4ZeAnHqQJyIkv3N3a6dcSFA1pj1bF1BcK5vZSt
+jBWZp5N99sXzqnTPBIWUmAD04vnKJGW/4GKvyMX6ssmeVkjaef2WdhW+o45WxLM0
+/L5H9MG0qPzVMIho7suuyWPEdr6sOBjhXlzPrjoiUevRi7PzKzMHVIf6tLITe7pT
+BGIBnfHAT+7hOtSLIBD6Alfm78ELt5BGnBkpjNxvoEppaZS3JGWg/6w/zgH7IS79
+aPib8qXPMThcFarmlwDB31qlpzmq6YR/PFGoOtmUW4y/Twhx5duoXNTSpv4Ao8YW
+xw/ogM4cKGR0GQjTQuPOAF1/sdwTsOEFy9EgqoZ0njnnkf3/W9b3raYvAwtt41dU
+63ZTGI0RmLo=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICVDCCAdugAwIBAgIQZ3SdjXfYO2rbIvT/WeK/zjAKBggqhkjOPQQDAzBsMQsw
+CQYDVQQGEwJHUjE3MDUGA1UECgwuSGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJlc2Vh
+cmNoIEluc3RpdHV0aW9ucyBDQTEkMCIGA1UEAwwbSEFSSUNBIFRMUyBFQ0MgUm9v
+dCBDQSAyMDIxMB4XDTIxMDIxOTExMDExMFoXDTQ1MDIxMzExMDEwOVowbDELMAkG
+A1UEBhMCR1IxNzA1BgNVBAoMLkhlbGxlbmljIEFjYWRlbWljIGFuZCBSZXNlYXJj
+aCBJbnN0aXR1dGlvbnMgQ0ExJDAiBgNVBAMMG0hBUklDQSBUTFMgRUNDIFJvb3Qg
+Q0EgMjAyMTB2MBAGByqGSM49AgEGBSuBBAAiA2IABDgI/rGgltJ6rK9JOtDA4MM7
+KKrxcm1lAEeIhPyaJmuqS7psBAqIXhfyVYf8MLA04jRYVxqEU+kw2anylnTDUR9Y
+STHMmE5gEYd103KUkE+bECUqqHgtvpBBWJAVcqeht6NCMEAwDwYDVR0TAQH/BAUw
+AwEB/zAdBgNVHQ4EFgQUyRtTgRL+BNUW0aq8mm+3oJUZbsowDgYDVR0PAQH/BAQD
+AgGGMAoGCCqGSM49BAMDA2cAMGQCMBHervjcToiwqfAircJRQO9gcS3ujwLEXQNw
+SaSS6sUUiHCm0w2wqsosQJz76YJumgIwK0eaB8bRwoF8yguWGEEbo/QwCZ61IygN
+nxS2PFOiTAZpffpskcYqSUXm7LcT4Tps
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIEMDCCAxigAwIBAgIJANqb7HHzA7AZMA0GCSqGSIb3DQEBCwUAMIGkMQswCQYD
+VQQGEwJQQTEPMA0GA1UECAwGUGFuYW1hMRQwEgYDVQQHDAtQYW5hbWEgQ2l0eTEk
+MCIGA1UECgwbVHJ1c3RDb3IgU3lzdGVtcyBTLiBkZSBSLkwuMScwJQYDVQQLDB5U
+cnVzdENvciBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxHzAdBgNVBAMMFlRydXN0Q29y
+IFJvb3RDZXJ0IENBLTEwHhcNMTYwMjA0MTIzMjE2WhcNMjkxMjMxMTcyMzE2WjCB
+pDELMAkGA1UEBhMCUEExDzANBgNVBAgMBlBhbmFtYTEUMBIGA1UEBwwLUGFuYW1h
+IENpdHkxJDAiBgNVBAoMG1RydXN0Q29yIFN5c3RlbXMgUy4gZGUgUi5MLjEnMCUG
+A1UECwweVHJ1c3RDb3IgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MR8wHQYDVQQDDBZU
+cnVzdENvciBSb290Q2VydCBDQS0xMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAv463leLCJhJrMxnHQFgKq1mqjQCj/IDHUHuO1CAmujIS2CNUSSUQIpid
+RtLByZ5OGy4sDjjzGiVoHKZaBeYei0i/mJZ0PmnK6bV4pQa81QBeCQryJ3pS/C3V
+seq0iWEk8xoT26nPUu0MJLq5nux+AHT6k61sKZKuUbS701e/s/OojZz0JEsq1pme
+9J7+wH5COucLlVPat2gOkEz7cD+PSiyU8ybdY2mplNgQTsVHCJCZGxdNuWxu72CV
+EY4hgLW9oHPY0LJ3xEXqWib7ZnZ2+AYfYW0PVcWDtxBWcgYHpfOxGgMFZA6dWorW
+hnAbJN7+KIor0Gqw/Hqi3LJ5DotlDwIDAQABo2MwYTAdBgNVHQ4EFgQU7mtJPHo/
+DeOxCbeKyKsZn3MzUOcwHwYDVR0jBBgwFoAU7mtJPHo/DeOxCbeKyKsZn3MzUOcw
+DwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQAD
+ggEBACUY1JGPE+6PHh0RU9otRCkZoB5rMZ5NDp6tPVxBb5UrJKF5mDo4Nvu7Zp5I
+/5CQ7z3UuJu0h3U/IJvOcs+hVcFNZKIZBqEHMwwLKeXx6quj7LUKdJDHfXLy11yf
+ke+Ri7fc7Waiz45mO7yfOgLgJ90WmMCV1Aqk5IGadZQ1nJBfiDcGrVmVCrDRZ9MZ
+yonnMlo2HD6CqFqTvsbQZJG2z9m2GM/bftJlo6bEjhcxwft+dtvTheNYsnd6djts
+L1Ac59v2Z3kf9YKVmgenFK+P3CghZwnS1k1aHBkcjndcw5QkPTJrS37UeJSDvjdN
+zl/HHk484IkzlQsPpTLWPFp5LBk=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFWjCCA0KgAwIBAgIQT9Irj/VkyDOeTzRYZiNwYDANBgkqhkiG9w0BAQsFADBH
+MQswCQYDVQQGEwJDTjERMA8GA1UECgwIVW5pVHJ1c3QxJTAjBgNVBAMMHFVDQSBF
+eHRlbmRlZCBWYWxpZGF0aW9uIFJvb3QwHhcNMTUwMzEzMDAwMDAwWhcNMzgxMjMx
+MDAwMDAwWjBHMQswCQYDVQQGEwJDTjERMA8GA1UECgwIVW5pVHJ1c3QxJTAjBgNV
+BAMMHFVDQSBFeHRlbmRlZCBWYWxpZGF0aW9uIFJvb3QwggIiMA0GCSqGSIb3DQEB
+AQUAA4ICDwAwggIKAoICAQCpCQcoEwKwmeBkqh5DFnpzsZGgdT6o+uM4AHrsiWog
+D4vFsJszA1qGxliG1cGFu0/GnEBNyr7uaZa4rYEwmnySBesFK5pI0Lh2PpbIILvS
+sPGP2KxFRv+qZ2C0d35qHzwaUnoEPQc8hQ2E0B92CvdqFN9y4zR8V05WAT558aop
+O2z6+I9tTcg1367r3CTueUWnhbYFiN6IXSV8l2RnCdm/WhUFhvMJHuxYMjMR83dk
+sHYf5BA1FxvyDrFspCqjc/wJHx4yGVMR59mzLC52LqGj3n5qiAno8geK+LLNEOfi
+c0CTuwjRP+H8C5SzJe98ptfRr5//lpr1kXuYC3fUfugH0mK1lTnj8/FtDw5lhIpj
+VMWAtuCeS31HJqcBCF3RiJ7XwzJE+oJKCmhUfzhTA8ykADNkUVkLo4KRel7sFsLz
+KuZi2irbWWIQJUoqgQtHB0MGcIfS+pMRKXpITeuUx3BNr2fVUbGAIAEBtHoIppB/
+TuDvB0GHr2qlXov7z1CymlSvw4m6WC31MJixNnI5fkkE/SmnTHnkBVfblLkWU41G
+sx2VYVdWf6/wFlthWG82UBEL2KwrlRYaDh8IzTY0ZRBiZtWAXxQgXy0MoHgKaNYs
+1+lvK9JKBZP8nm9rZ/+I8U6laUpSNwXqxhaN0sSZ0YIrO7o1dfdRUVjzyAfd5LQD
+fwIDAQABo0IwQDAdBgNVHQ4EFgQU2XQ65DA9DfcS3H5aBZ8eNJr34RQwDwYDVR0T
+AQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQADggIBADaN
+l8xCFWQpN5smLNb7rhVpLGsaGvdftvkHTFnq88nIua7Mui563MD1sC3AO6+fcAUR
+ap8lTwEpcOPlDOHqWnzcSbvBHiqB9RZLcpHIojG5qtr8nR/zXUACE/xOHAbKsxSQ
+VBcZEhrxH9cMaVr2cXj0lH2RC47skFSOvG+hTKv8dGT9cZr4QQehzZHkPJrgmzI5
+c6sq1WnIeJEmMX3ixzDx/BR4dxIOE/TdFpS/S2d7cFOFyrC78zhNLJA5wA3CXWvp
+4uXViI3WLL+rG761KIcSF3Ru/H38j9CHJrAb+7lsq+KePRXBOy5nAliRn+/4Qh8s
+t2j1da3Ptfb/EX3C8CSlrdP6oDyp+l3cpaDvRKS+1ujl5BOWF3sGPjLtx7dCvHaj
+2GU4Kzg1USEODm8uNBNA4StnDG1KQTAYI1oyVZnJF+A83vbsea0rWBmirSwiGpWO
+vpaQXUJXxPkUAzUrHC1RVwinOt4/5Mi0A3PCwSaAuwtCH60NryZy2sy+s6ODWA2C
+xR9GUeOcGMyNm43sSet1UNWMKFnKdDTajAshqx7qG+XH/RU+wBeq+yNuJkbL+vmx
+cmtpzyKEC2IPrNkZAJSidjzULZrtBJ4tBmIQN1IchXIbJ+XMxjHsN+xjWZsLHXbM
+fjKaiJUINlK73nZfdklJrX+9ZSCyycErdhh2n1ax
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFRjCCAy6gAwIBAgIQXd+x2lqj7V2+WmUgZQOQ7zANBgkqhkiG9w0BAQsFADA9
+MQswCQYDVQQGEwJDTjERMA8GA1UECgwIVW5pVHJ1c3QxGzAZBgNVBAMMElVDQSBH
+bG9iYWwgRzIgUm9vdDAeFw0xNjAzMTEwMDAwMDBaFw00MDEyMzEwMDAwMDBaMD0x
+CzAJBgNVBAYTAkNOMREwDwYDVQQKDAhVbmlUcnVzdDEbMBkGA1UEAwwSVUNBIEds
+b2JhbCBHMiBSb290MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAxeYr
+b3zvJgUno4Ek2m/LAfmZmqkywiKHYUGRO8vDaBsGxUypK8FnFyIdK+35KYmToni9
+kmugow2ifsqTs6bRjDXVdfkX9s9FxeV67HeToI8jrg4aA3++1NDtLnurRiNb/yzm
+VHqUwCoV8MmNsHo7JOHXaOIxPAYzRrZUEaalLyJUKlgNAQLx+hVRZ2zA+te2G3/R
+VogvGjqNO7uCEeBHANBSh6v7hn4PJGtAnTRnvI3HLYZveT6OqTwXS3+wmeOwcWDc
+C/Vkw85DvG1xudLeJ1uK6NjGruFZfc8oLTW4lVYa8bJYS7cSN8h8s+1LgOGN+jIj
+tm+3SJUIsUROhYw6AlQgL9+/V087OpAh18EmNVQg7Mc/R+zvWr9LesGtOxdQXGLY
+D0tK3Cv6brxzks3sx1DoQZbXqX5t2Okdj4q1uViSukqSKwxW/YDrCPBeKW4bHAyv
+j5OJrdu9o54hyokZ7N+1wxrrFv54NkzWbtA+FxyQF2smuvt6L78RHBgOLXMDj6Dl
+NaBa4kx1HXHhOThTeEDMg5PXCp6dW4+K5OXgSORIskfNTip1KnvyIvbJvgmRlld6
+iIis7nCs+dwp4wwcOxJORNanTrAmyPPZGpeRaOrvjUYG0lZFWJo8DA+DuAUlwznP
+O6Q0ibd5Ei9Hxeepl2n8pndntd978XplFeRhVmUCAwEAAaNCMEAwDgYDVR0PAQH/
+BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFIHEjMz15DD/pQwIX4wV
+ZyF0Ad/fMA0GCSqGSIb3DQEBCwUAA4ICAQATZSL1jiutROTL/7lo5sOASD0Ee/oj
+L3rtNtqyzm325p7lX1iPyzcyochltq44PTUbPrw7tgTQvPlJ9Zv3hcU2tsu8+Mg5
+1eRfB70VVJd0ysrtT7q6ZHafgbiERUlMjW+i67HM0cOU2kTC5uLqGOiiHycFutfl
+1qnN3e92mI0ADs0b+gO3joBYDic/UvuUospeZcnWhNq5NXHzJsBPd+aBJ9J3O5oU
+b3n09tDh05S60FdRvScFDcH9yBIw7m+NESsIndTUv4BFFJqIRNow6rSn4+7vW4LV
+PtateJLbXDzz2K36uGt/xDYotgIVilQsnLAXc47QN6MUPJiVAAwpBVueSUmxX8fj
+y88nZY41F7dXyDDZQVu5FLbowg+UMaeUmMxq67XhJ/UQqAHojhJi6IjMtX9Gl8Cb
+EGY4GjZGXyJoPd/JxhMnq1MGrKI8hgZlb7F+sSlEmqO6SWkoaY/X5V+tBIZkbxqg
+DMUIYs6Ao9Dz7GjevjPHF1t/gMRMTLGmhIrDO7gJzRSBuhjjVFc2/tsvfEehOjPI
++Vg7RE+xygKJBJYoaMVLuCaJu9YzL1DV/pqJuhgyklTGW+Cd+V7lDSKb9triyCGy
+YiGqhkCyLmTTX8jjfhFnRR8F/uOi77Oos/N9j/gMHyIfLXC0uAE0djAA5SN4p1bX
+UB+K+wb1whnw0A==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIClDCCAhqgAwIBAgIILCmcWxbtBZUwCgYIKoZIzj0EAwIwfzELMAkGA1UEBhMC
+VVMxDjAMBgNVBAgMBVRleGFzMRAwDgYDVQQHDAdIb3VzdG9uMRgwFgYDVQQKDA9T
+U0wgQ29ycG9yYXRpb24xNDAyBgNVBAMMK1NTTC5jb20gRVYgUm9vdCBDZXJ0aWZp
+Y2F0aW9uIEF1dGhvcml0eSBFQ0MwHhcNMTYwMjEyMTgxNTIzWhcNNDEwMjEyMTgx
+NTIzWjB/MQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxEDAOBgNVBAcMB0hv
+dXN0b24xGDAWBgNVBAoMD1NTTCBDb3Jwb3JhdGlvbjE0MDIGA1UEAwwrU1NMLmNv
+bSBFViBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IEVDQzB2MBAGByqGSM49
+AgEGBSuBBAAiA2IABKoSR5CYG/vvw0AHgyBO8TCCogbR8pKGYfL2IWjKAMTH6kMA
+VIbc/R/fALhBYlzccBYy3h+Z1MzFB8gIH2EWB1E9fVwHU+M1OIzfzZ/ZLg1Kthku
+WnBaBu2+8KGwytAJKaNjMGEwHQYDVR0OBBYEFFvKXuXe0oGqzagtZFG22XKbl+ZP
+MA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAUW8pe5d7SgarNqC1kUbbZcpuX
+5k8wDgYDVR0PAQH/BAQDAgGGMAoGCCqGSM49BAMCA2gAMGUCMQCK5kCJN+vp1RPZ
+ytRrJPOwPYdGWBrssd9v+1a6cGvHOMzosYxPD/fxZ3YOg9AeUY8CMD32IygmTMZg
+h5Mmm7I1HrrW9zzRHM76JTymGoEVW/MSD2zuZYrJh6j5B+BimoxcSg==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICjTCCAhSgAwIBAgIIdebfy8FoW6gwCgYIKoZIzj0EAwIwfDELMAkGA1UEBhMC
+VVMxDjAMBgNVBAgMBVRleGFzMRAwDgYDVQQHDAdIb3VzdG9uMRgwFgYDVQQKDA9T
+U0wgQ29ycG9yYXRpb24xMTAvBgNVBAMMKFNTTC5jb20gUm9vdCBDZXJ0aWZpY2F0
+aW9uIEF1dGhvcml0eSBFQ0MwHhcNMTYwMjEyMTgxNDAzWhcNNDEwMjEyMTgxNDAz
+WjB8MQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxEDAOBgNVBAcMB0hvdXN0
+b24xGDAWBgNVBAoMD1NTTCBDb3Jwb3JhdGlvbjExMC8GA1UEAwwoU1NMLmNvbSBS
+b290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IEVDQzB2MBAGByqGSM49AgEGBSuB
+BAAiA2IABEVuqVDEpiM2nl8ojRfLliJkP9x6jh3MCLOicSS6jkm5BBtHllirLZXI
+7Z4INcgn64mMU1jrYor+8FsPazFSY0E7ic3s7LaNGdM0B9y7xgZ/wkWV7Mt/qCPg
+CemB+vNH06NjMGEwHQYDVR0OBBYEFILRhXMw5zUE044CkvvlpNHEIejNMA8GA1Ud
+EwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAUgtGFczDnNQTTjgKS++Wk0cQh6M0wDgYD
+VR0PAQH/BAQDAgGGMAoGCCqGSM49BAMCA2cAMGQCMG/n61kRpGDPYbCWe+0F+S8T
+kdzt5fxQaxFGRrMcIQBiu77D5+jNB5n5DQtdcj7EqgIwH7y6C+IwJPt8bYBVCpk+
+gA0z5Wajs6O7pdWLjwkspl1+4vAHCGht0nxpbl/f5Wpl
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIF3TCCA8WgAwIBAgIIeyyb0xaAMpkwDQYJKoZIhvcNAQELBQAwfDELMAkGA1UE
+BhMCVVMxDjAMBgNVBAgMBVRleGFzMRAwDgYDVQQHDAdIb3VzdG9uMRgwFgYDVQQK
+DA9TU0wgQ29ycG9yYXRpb24xMTAvBgNVBAMMKFNTTC5jb20gUm9vdCBDZXJ0aWZp
+Y2F0aW9uIEF1dGhvcml0eSBSU0EwHhcNMTYwMjEyMTczOTM5WhcNNDEwMjEyMTcz
+OTM5WjB8MQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxEDAOBgNVBAcMB0hv
+dXN0b24xGDAWBgNVBAoMD1NTTCBDb3Jwb3JhdGlvbjExMC8GA1UEAwwoU1NMLmNv
+bSBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IFJTQTCCAiIwDQYJKoZIhvcN
+AQEBBQADggIPADCCAgoCggIBAPkP3aMrfcvQKv7sZ4Wm5y4bunfh4/WvpOz6Sl2R
+xFdHaxh3a3by/ZPkPQ/CFp4LZsNWlJ4Xg4XOVu/yFv0AYvUiCVToZRdOQbngT0aX
+qhvIuG5iXmmxX9sqAn78bMrzQdjt0Oj8P2FI7bADFB0QDksZ4LtO7IZl/zbzXmcC
+C52GVWH9ejjt/uIZALdvoVBidXQ8oPrIJZK0bnoix/geoeOy3ZExqysdBP+lSgQ3
+6YWkMyv94tZVNHwZpEpox7Ko07fKoZOI68GXvIz5HdkihCR0xwQ9aqkpk8zruFvh
+/l8lqjRYyMEjVJ0bmBHDOJx+PYZspQ9AhnwC9FwCTyjLrnGfDzrIM/4RJTXq/LrF
+YD3ZfBjVsqnTdXgDciLKOsMf7yzlLqn6niy2UUb9rwPW6mBo6oUWNmuF6R7As93E
+JNyAKoFBbZQ+yODJgUEAnl6/f8UImKIYLEJAs/lvOCdLToD0PYFH4Ih86hzOtXVc
+US4cK38acijnALXRdMbX5J+tB5O2UzU1/Dfkw/ZdFr4hc96SCvigY2q8lpJqPvi8
+ZVWb3vUNiSYE/CUapiVpy8JtynziWV+XrOvvLsi81xtZPCvM8hnIk2snYxnP/Okm
++Mpxm3+T/jRnhE6Z6/yzeAkzcLpmpnbtG3PrGqUNxCITIJRWCk4sbE6x/c+cCbqi
+M+2HAgMBAAGjYzBhMB0GA1UdDgQWBBTdBAkHovV6fVJTEpKV7jiAJQ2mWTAPBgNV
+HRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFN0ECQei9Xp9UlMSkpXuOIAlDaZZMA4G
+A1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOCAgEAIBgRlCn7Jp0cHh5wYfGV
+cpNxJK1ok1iOMq8bs3AD/CUrdIWQPXhq9LmLpZc7tRiRux6n+UBbkflVma8eEdBc
+Hadm47GUBwwyOabqG7B52B2ccETjit3E+ZUfijhDPwGFpUenPUayvOUiaPd7nNgs
+PgohyC0zrL/FgZkxdMF1ccW+sfAjRfSda/wZY52jvATGGAslu1OJD7OAUN5F7kR/
+q5R4ZJjT9ijdh9hwZXT7DrkT66cPYakylszeu+1jTBi7qUD3oFRuIIhxdRjqerQ0
+cuAjJ3dctpDqhiVAq+8zD8ufgr6iIPv2tS0a5sKFsXQP+8hlAqRSAUfdSSLBv9jr
+a6x+3uxjMxW3IwiPxg+NQVrdjsW5j+VFP3jbutIbQLH+cU0/4IGiul607BXgk90I
+H37hVZkLId6Tngr75qNJvTYw/ud3sqB1l7UtgYgXZSD32pAAn8lSzDLKNXz1PQ/Y
+K9f1JmzJBjSWFupwWRoyeXkLtoh/D1JIPb9s2KJELtFOt3JY04kTlf5Eq/jXixtu
+nLwsoFvVagCvXzfh1foQC5ichucmj87w7G6KVwuA406ywKBjYZC6VWg3dGq2ktuf
+oYYitmUnDuy2n0Jg5GfCtdpBC8TTi2EbvPofkSvXRAdeuims2cXp71NIWuuA8ShY
+Ic2wBlX7Jz9TkHCpBB5XJ7k=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICODCCAb6gAwIBAgIJANZdm7N4gS7rMAoGCCqGSM49BAMDMGExCzAJBgNVBAYT
+AkpQMSUwIwYDVQQKExxTRUNPTSBUcnVzdCBTeXN0ZW1zIENPLixMVEQuMSswKQYD
+VQQDEyJTZWN1cml0eSBDb21tdW5pY2F0aW9uIEVDQyBSb290Q0ExMB4XDTE2MDYx
+NjA1MTUyOFoXDTM4MDExODA1MTUyOFowYTELMAkGA1UEBhMCSlAxJTAjBgNVBAoT
+HFNFQ09NIFRydXN0IFN5c3RlbXMgQ08uLExURC4xKzApBgNVBAMTIlNlY3VyaXR5
+IENvbW11bmljYXRpb24gRUNDIFJvb3RDQTEwdjAQBgcqhkjOPQIBBgUrgQQAIgNi
+AASkpW9gAwPDvTH00xecK4R1rOX9PVdu12O/5gSJko6BnOPpR27KkBLIE+Cnnfdl
+dB9sELLo5OnvbYUymUSxXv3MdhDYW72ixvnWQuRXdtyQwjWpS4g8EkdtXP9JTxpK
+ULGjQjBAMB0GA1UdDgQWBBSGHOf+LaVKiwj+KBH6vqNm+GBZLzAOBgNVHQ8BAf8E
+BAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAwNoADBlAjAVXUI9/Lbu
+9zuxNuie9sRGKEkz0FhDKmMpzE2xtHqiuQ04pV1IKv3LsnNdo4gIxwwCMQDAqy0O
+be0YottT6SXbVQjgUMzfRGEWgqtJsLKB7HOHeLRMsmIbEvoWTSVLY70eN9k=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFfzCCA2egAwIBAgIJAOF8N0D9G/5nMA0GCSqGSIb3DQEBDAUAMF0xCzAJBgNV
+BAYTAkpQMSUwIwYDVQQKExxTRUNPTSBUcnVzdCBTeXN0ZW1zIENPLixMVEQuMScw
+JQYDVQQDEx5TZWN1cml0eSBDb21tdW5pY2F0aW9uIFJvb3RDQTMwHhcNMTYwNjE2
+MDYxNzE2WhcNMzgwMTE4MDYxNzE2WjBdMQswCQYDVQQGEwJKUDElMCMGA1UEChMc
+U0VDT00gVHJ1c3QgU3lzdGVtcyBDTy4sTFRELjEnMCUGA1UEAxMeU2VjdXJpdHkg
+Q29tbXVuaWNhdGlvbiBSb290Q0EzMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC
+CgKCAgEA48lySfcw3gl8qUCBWNO0Ot26YQ+TUG5pPDXC7ltzkBtnTCHsXzW7OT4r
+CmDvu20rhvtxosis5FaU+cmvsXLUIKx00rgVrVH+hXShuRD+BYD5UpOzQD11EKzA
+lrenfna84xtSGc4RHwsENPXY9Wk8d/Nk9A2qhd7gCVAEF5aEt8iKvE1y/By7z/MG
+TfmfZPd+pmaGNXHIEYBMwXFAWB6+oHP2/D5Q4eAvJj1+XCO1eXDe+uDRpdYMQXF7
+9+qMHIjH7Iv10S9VlkZ8WjtYO/u62C21Jdp6Ts9EriGmnpjKIG58u4iFW/vAEGK7
+8vknR+/RiTlDxN/e4UG/VHMgly1s2vPUB6PmudhvrvyMGS7TZ2crldtYXLVqAvO4
+g160a75BflcJdURQVc1aEWEhCmHCqYj9E7wtiS/NYeCVvsq1e+F7NGcLH7YMx3we
+GVPKp7FKFSBWFHA9K4IsD50VHUeAR/94mQ4xr28+j+2GaR57GIgUssL8gjMunEst
++3A7caoreyYn8xrC3PsXuKHqy6C0rtOUfnrQq8PsOC0RLoi/1D+tEjtCrI8Cbn3M
+0V9hvqG8OmpI6iZVIhZdXw3/JzOfGAN0iltSIEdrRU0id4xVJ/CvHozJgyJUt5rQ
+T9nO/NkuHJYosQLTA70lUhw0Zk8jq/R3gpYd0VcwCBEF/VfR2ccCAwEAAaNCMEAw
+HQYDVR0OBBYEFGQUfPxYchamCik0FW8qy7z8r6irMA4GA1UdDwEB/wQEAwIBBjAP
+BgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDAUAA4ICAQDcAiMI4u8hOscNtybS
+YpOnpSNyByCCYN8Y11StaSWSntkUz5m5UoHPrmyKO1o5yGwBQ8IibQLwYs1OY0PA
+FNr0Y/Dq9HHuTofjcan0yVflLl8cebsjqodEV+m9NU1Bu0soo5iyG9kLFwfl9+qd
+9XbXv8S2gVj/yP9kaWJ5rW4OH3/uHWnlt3Jxs/6lATWUVCvAUm2PVcTJ0rjLyjQI
+UYWg9by0F1jqClx6vWPGOi//lkkZhOpn2ASxYfQAW0q3nHE3GYV5v4GwxxMOdnE+
+OoAGrgYWp421wsTL/0ClXI2lyTrtcoHKXJg80jQDdwj98ClZXSEIx2C/pHF7uNke
+gr4Jr2VvKKu/S7XuPghHJ6APbw+LP6yVGPO5DtxnVW5inkYO0QR4ynKudtml+LLf
+iAlhi+8kTtFZP1rUPcmTPCtk9YENFpb3ksP+MW/oKjJ0DvRMmEoYDjBU1cXrvMUV
+nuiZIesnKwkK2/HmcBhWuwzkvvnoEKQTkrgc4NtnHVMDpCKn3F2SEDzq//wbEBrD
+2NCcnWXL0CsnMQMeNuE9dnUM/0Umud1RvCPHX9jYhxBAEg09ODfnRDwYwFMJZI//
+1ZqmfHAuc1Uh6N//g7kdPjIe1qZ9LPFm6Vwdp6POXiUyK+OVrCoHzrQoeIY8Laad
+TdJ0MN1kURXbg4NR16/9M51NZg==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIF2DCCA8CgAwIBAgIQTKr5yttjb+Af907YWwOGnTANBgkqhkiG9w0BAQwFADCB
+hTELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G
+A1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxKzApBgNV
+BAMTIkNPTU9ETyBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMTE5
+MDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBhTELMAkGA1UEBhMCR0IxGzAZBgNVBAgT
+EkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UEChMR
+Q09NT0RPIENBIExpbWl0ZWQxKzApBgNVBAMTIkNPTU9ETyBSU0EgQ2VydGlmaWNh
+dGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCR
+6FSS0gpWsawNJN3Fz0RndJkrN6N9I3AAcbxT38T6KhKPS38QVr2fcHK3YX/JSw8X
+pz3jsARh7v8Rl8f0hj4K+j5c+ZPmNHrZFGvnnLOFoIJ6dq9xkNfs/Q36nGz637CC
+9BR++b7Epi9Pf5l/tfxnQ3K9DADWietrLNPtj5gcFKt+5eNu/Nio5JIk2kNrYrhV
+/erBvGy2i/MOjZrkm2xpmfh4SDBF1a3hDTxFYPwyllEnvGfDyi62a+pGx8cgoLEf
+Zd5ICLqkTqnyg0Y3hOvozIFIQ2dOciqbXL1MGyiKXCJ7tKuY2e7gUYPDCUZObT6Z
++pUX2nwzV0E8jVHtC7ZcryxjGt9XyD+86V3Em69FmeKjWiS0uqlWPc9vqv9JWL7w
+qP/0uK3pN/u6uPQLOvnoQ0IeidiEyxPx2bvhiWC4jChWrBQdnArncevPDt09qZah
+SL0896+1DSJMwBGB7FY79tOi4lu3sgQiUpWAk2nojkxl8ZEDLXB0AuqLZxUpaVIC
+u9ffUGpVRr+goyhhf3DQw6KqLCGqR84onAZFdr+CGCe01a60y1Dma/RMhnEw6abf
+Fobg2P9A3fvQQoh/ozM6LlweQRGBY84YcWsr7KaKtzFcOmpH4MN5WdYgGq/yapiq
+crxXStJLnbsQ/LBMQeXtHT1eKJ2czL+zUdqnR+WEUwIDAQABo0IwQDAdBgNVHQ4E
+FgQUu69+Aj36pvE8hI6t7jiY7NkyMtQwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB
+/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAArx1UaEt65Ru2yyTUEUAJNMnMvl
+wFTPoCWOAvn9sKIN9SCYPBMtrFaisNZ+EZLpLrqeLppysb0ZRGxhNaKatBYSaVqM
+4dc+pBroLwP0rmEdEBsqpIt6xf4FpuHA1sj+nq6PK7o9mfjYcwlYRm6mnPTXJ9OV
+2jeDchzTc+CiR5kDOF3VSXkAKRzH7JsgHAckaVd4sjn8OoSgtZx8jb8uk2Intzna
+FxiuvTwJaP+EmzzV1gsD41eeFPfR60/IvYcjt7ZJQ3mFXLrrkguhxuhoqEwWsRqZ
+CuhTLJK7oQkYdQxlqHvLI7cawiiFwxv/0Cti76R7CZGYZ4wUAc1oBmpjIXUDgIiK
+boHGhfKppC3n9KUkEEeDys30jXlYsQab5xoq2Z0B15R97QNKyvDb6KkBPvVWmcke
+jkk9u+UJueBPSZI9FoJAzMxZxuY67RIuaTxslbH9qh17f4a+Hg4yRvv7E491f0yL
+S0Zj/gA0QHDBw7mh3aZw4gSzQbzpgJHqZJx64SIDqZxubw5lT2yHh17zbqD5daWb
+QOhTsiedSrnAdyGN/4fy3ryM7xfft0kL0fJuMAsaDk527RH89elWsn2/x20Kk4yl
+0MC2Hb46TpSi125sC8KKfPog88Tk5c0NqMuRkrF8hey1FGlmDoLnzc7ILaZRfyHB
+NVOFBkpdn627G190
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCB
+iDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0pl
+cnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV
+BAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAw
+MjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNV
+BAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVU
+aGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2Vy
+dGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK
+AoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B
+3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkY
+tJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/
+Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2
+VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT
+79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6
+c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmT
+Yo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97l
+c6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4ee
+UB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeE
+Hg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAd
+BgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8G
+A1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPF
+Up/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KO
+VWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3
+ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs
+8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcR
+iQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYze
+Sf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZ
+XHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/
+qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRB
+VXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aB
+L6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfG
+jjxDah2nGN59PRbxYvnKkKj9
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICjzCCAhWgAwIBAgIQXIuZxVqUxdJxVt7NiYDMJjAKBggqhkjOPQQDAzCBiDEL
+MAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNl
+eSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMT
+JVVTRVJUcnVzdCBFQ0MgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMjAx
+MDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgT
+Ck5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVUaGUg
+VVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBFQ0MgQ2VydGlm
+aWNhdGlvbiBBdXRob3JpdHkwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQarFRaqflo
+I+d61SRvU8Za2EurxtW20eZzca7dnNYMYf3boIkDuAUU7FfO7l0/4iGzzvfUinng
+o4N+LZfQYcTxmdwlkWOrfzCjtHDix6EznPO/LlxTsV+zfTJ/ijTjeXmjQjBAMB0G
+A1UdDgQWBBQ64QmG1M8ZwpZ2dEl23OA1xmNjmjAOBgNVHQ8BAf8EBAMCAQYwDwYD
+VR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAwNoADBlAjA2Z6EWCNzklwBBHU6+4WMB
+zzuqQhFkoJ2UOQIReVx7Hfpkue4WQrO/isIJxOzksU0CMQDpKmFHjFJKS04YcPbW
+RNZu9YO6bVi9JNlWSOrvxKJGgYhqOkbRqZtNyWHa0V1Xahg=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICHjCCAaSgAwIBAgIRYFlJ4CYuu1X5CneKcflK2GwwCgYIKoZIzj0EAwMwUDEk
+MCIGA1UECxMbR2xvYmFsU2lnbiBFQ0MgUm9vdCBDQSAtIFI1MRMwEQYDVQQKEwpH
+bG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTEyMTExMzAwMDAwMFoX
+DTM4MDExOTAzMTQwN1owUDEkMCIGA1UECxMbR2xvYmFsU2lnbiBFQ0MgUm9vdCBD
+QSAtIFI1MRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu
+MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAER0UOlvt9Xb/pOdEh+J8LttV7HpI6SFkc
+8GIxLcB6KP4ap1yztsyX50XUWPrRd21DosCHZTQKH3rd6zwzocWdTaRvQZU4f8ke
+hOvRnkmSh5SHDDqFSmafnVmTTZdhBoZKo0IwQDAOBgNVHQ8BAf8EBAMCAQYwDwYD
+VR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUPeYpSJvqB8ohREom3m7e0oPQn1kwCgYI
+KoZIzj0EAwMDaAAwZQIxAOVpEslu28YxuglB4Zf4+/2a4n0Sye18ZNPLBSWLVtmg
+515dTguDnFt2KaAJJiFqYgIwcdK1j1zqO+F4CYWodZI7yFz9SO8NdCKoCOJuxUnO
+xwy8p2Fp8fc74SrL+SvzZpA3
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFYDCCA0igAwIBAgIQCgFCgAAAAUUjyES1AAAAAjANBgkqhkiG9w0BAQsFADBK
+MQswCQYDVQQGEwJVUzESMBAGA1UEChMJSWRlblRydXN0MScwJQYDVQQDEx5JZGVu
+VHJ1c3QgQ29tbWVyY2lhbCBSb290IENBIDEwHhcNMTQwMTE2MTgxMjIzWhcNMzQw
+MTE2MTgxMjIzWjBKMQswCQYDVQQGEwJVUzESMBAGA1UEChMJSWRlblRydXN0MScw
+JQYDVQQDEx5JZGVuVHJ1c3QgQ29tbWVyY2lhbCBSb290IENBIDEwggIiMA0GCSqG
+SIb3DQEBAQUAA4ICDwAwggIKAoICAQCnUBneP5k91DNG8W9RYYKyqU+PZ4ldhNlT
+3Qwo2dfw/66VQ3KZ+bVdfIrBQuExUHTRgQ18zZshq0PirK1ehm7zCYofWjK9ouuU
++ehcCuz/mNKvcbO0U59Oh++SvL3sTzIwiEsXXlfEU8L2ApeN2WIrvyQfYo3fw7gp
+S0l4PJNgiCL8mdo2yMKi1CxUAGc1bnO/AljwpN3lsKImesrgNqUZFvX9t++uP0D1
+bVoE/c40yiTcdCMbXTMTEl3EASX2MN0CXZ/g1Ue9tOsbobtJSdifWwLziuQkkORi
+T0/Br4sOdBeo0XKIanoBScy0RnnGF7HamB4HWfp1IYVl3ZBWzvurpWCdxJ35UrCL
+vYf5jysjCiN2O/cz4ckA82n5S6LgTrx+kzmEB/dEcH7+B1rlsazRGMzyNeVJSQjK
+Vsk9+w8YfYs7wRPCTY/JTw436R+hDmrfYi7LNQZReSzIJTj0+kuniVyc0uMNOYZK
+dHzVWYfCP04MXFL0PfdSgvHqo6z9STQaKPNBiDoT7uje/5kdX7rL6B7yuVBgwDHT
+c+XvvqDtMwt0viAgxGds8AgDelWAf0ZOlqf0Hj7h9tgJ4TNkK2PXMl6f+cB7D3hv
+l7yTmvmcEpB4eoCHFddydJxVdHixuuFucAS6T6C6aMN7/zHwcz09lCqxC0EOoP5N
+iGVreTO01wIDAQABo0IwQDAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB
+/zAdBgNVHQ4EFgQU7UQZwNPwBovupHu+QucmVMiONnYwDQYJKoZIhvcNAQELBQAD
+ggIBAA2ukDL2pkt8RHYZYR4nKM1eVO8lvOMIkPkp165oCOGUAFjvLi5+U1KMtlwH
+6oi6mYtQlNeCgN9hCQCTrQ0U5s7B8jeUeLBfnLOic7iPBZM4zY0+sLj7wM+x8uwt
+LRvM7Kqas6pgghstO8OEPVeKlh6cdbjTMM1gCIOQ045U8U1mwF10A0Cj7oV+wh93
+nAbowacYXVKV7cndJZ5t+qntozo00Fl72u1Q8zW/7esUTTHHYPTa8Yec4kjixsU3
++wYQ+nVZZjFHKdp2mhzpgq7vmrlR94gjmmmVYjzlVYA211QC//G5Xc7UI2/YRYRK
+W2XviQzdFKcgyxilJbQN+QHwotL0AMh0jqEqSI5l2xPE4iUXfeu+h1sXIFRRk0pT
+AwvsXcoz7WL9RccvW9xYoIA55vrX/hMUpu09lEpCdNTDd1lzzY9GvlU47/rokTLq
+l1gEIt44w8y8bckzOmoKaT+gyOpyj4xjhiO9bTyWnpXgSUyqorkqG5w2gXjtw+hG
+4iZZRHUe2XWJUc0QhJ1hYMtd+ZciTY6Y5uN/9lu7rs3KSoFrXgvzUeF0K+l+J6fZ
+mUlO+KWA2yUPHGNiiskzZ2s8EIPGrd6ozRaOjfAHN3Gf8qv8QfXBi+wAN10J5U6A
+7/qxXDgGpRtK4dw4LTzcqx+QGtVKnO7RcGzM7vRX+Bi6hG6H
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFZjCCA06gAwIBAgIQCgFCgAAAAUUjz0Z8AAAAAjANBgkqhkiG9w0BAQsFADBN
+MQswCQYDVQQGEwJVUzESMBAGA1UEChMJSWRlblRydXN0MSowKAYDVQQDEyFJZGVu
+VHJ1c3QgUHVibGljIFNlY3RvciBSb290IENBIDEwHhcNMTQwMTE2MTc1MzMyWhcN
+MzQwMTE2MTc1MzMyWjBNMQswCQYDVQQGEwJVUzESMBAGA1UEChMJSWRlblRydXN0
+MSowKAYDVQQDEyFJZGVuVHJ1c3QgUHVibGljIFNlY3RvciBSb290IENBIDEwggIi
+MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC2IpT8pEiv6EdrCvsnduTyP4o7
+ekosMSqMjbCpwzFrqHd2hCa2rIFCDQjrVVi7evi8ZX3yoG2LqEfpYnYeEe4IFNGy
+RBb06tD6Hi9e28tzQa68ALBKK0CyrOE7S8ItneShm+waOh7wCLPQ5CQ1B5+ctMlS
+bdsHyo+1W/CD80/HLaXIrcuVIKQxKFdYWuSNG5qrng0M8gozOSI5Cpcu81N3uURF
+/YTLNiCBWS2ab21ISGHKTN9T0a9SvESfqy9rg3LvdYDaBjMbXcjaY8ZNzaxmMc3R
+3j6HEDbhuaR672BQssvKplbgN6+rNBM5Jeg5ZuSYeqoSmJxZZoY+rfGwyj4GD3vw
+EUs3oERte8uojHH01bWRNszwFcYr3lEXsZdMUD2xlVl8BX0tIdUAvwFnol57plzy
+9yLxkA2T26pEUWbMfXYD62qoKjgZl3YNa4ph+bz27nb9cCvdKTz4Ch5bQhyLVi9V
+GxyhLrXHFub4qjySjmm2AcG1hp2JDws4lFTo6tyePSW8Uybt1as5qsVATFSrsrTZ
+2fjXctscvG29ZV/viDUqZi/u9rNl8DONfJhBaUYPQxxp+pu10GFqzcpL2UyQRqsV
+WaFHVCkugyhfHMKiq3IXAAaOReyL4jM9f9oZRORicsPfIsbyVtTdX5Vy7W1f90gD
+W/3FKqD2cyOEEBsB5wIDAQABo0IwQDAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/
+BAUwAwEB/zAdBgNVHQ4EFgQU43HgntinQtnbcZFrlJPrw6PRFKMwDQYJKoZIhvcN
+AQELBQADggIBAEf63QqwEZE4rU1d9+UOl1QZgkiHVIyqZJnYWv6IAcVYpZmxI1Qj
+t2odIFflAWJBF9MJ23XLblSQdf4an4EKwt3X9wnQW3IV5B4Jaj0z8yGa5hV+rVHV
+DRDtfULAj+7AmgjVQdZcDiFpboBhDhXAuM/FSRJSzL46zNQuOAXeNf0fb7iAaJg9
+TaDKQGXSc3z1i9kKlT/YPyNtGtEqJBnZhbMX73huqVjRI9PHE+1yJX9dsXNw0H8G
+lwmEKYBhHfpe/3OsoOOJuBxxFcbeMX8S3OFtm6/n6J91eEyrRjuazr8FGF1NFTwW
+mhlQBJqymm9li1JfPFgEKCXAZmExfrngdbkaqIHWchezxQMxNRF4eKLg6TCMf4Df
+WN88uieW4oA0beOY02QnrEh+KHdcxiVhJfiFDGX6xDIvpZgF5PgLZxYWxoK4Mhn5
++bl53B/N66+rDt0b20XkeucC4pVd/GnwU2lhlXV5C15V5jgclKlZM57IcXR5f1GJ
+tshquDDIajjDbp7hNxbqBWJMWxJH7ae0s1hWx0nzfxJoCTFx8G34Tkf71oXuxVhA
+GaQdp/lLQzfcaFpPz+vCZHTetBXZ9FRUGi8c15dxVJCO2SCdUyt/q4/i6jC8UDfv
+8Ue1fXwsBOxonbRJRBD0ckscZOf85muQ3Wl9af0AVqW3rLatt8o+Ae+c
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICGzCCAaGgAwIBAgIQQdKd0XLq7qeAwSxs6S+HUjAKBggqhkjOPQQDAzBPMQsw
+CQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFyY2gg
+R3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMjAeFw0yMDA5MDQwMDAwMDBaFw00
+MDA5MTcxNjAwMDBaME8xCzAJBgNVBAYTAlVTMSkwJwYDVQQKEyBJbnRlcm5ldCBT
+ZWN1cml0eSBSZXNlYXJjaCBHcm91cDEVMBMGA1UEAxMMSVNSRyBSb290IFgyMHYw
+EAYHKoZIzj0CAQYFK4EEACIDYgAEzZvVn4CDCuwJSvMWSj5cz3es3mcFDR0HttwW
++1qLFNvicWDEukWVEYmO6gbf9yoWHKS5xcUy4APgHoIYOIvXRdgKam7mAHf7AlF9
+ItgKbppbd9/w+kHsOdx1ymgHDB/qo0IwQDAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0T
+AQH/BAUwAwEB/zAdBgNVHQ4EFgQUfEKWrt5LSDv6kviejM9ti6lyN5UwCgYIKoZI
+zj0EAwMDaAAwZQIwe3lORlCEwkSHRhtFcP9Ymd70/aTSVaYgLXTWNLxBo1BfASdW
+tL4ndQavEi51mI38AjEAi/V3bNTIZargCyzuFJ0nN6T5U6VR5CmD1/iQMVtCnwr1
+/q4AaOeMSQ+2b1tbFfLn
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIEPjCCAyagAwIBAgIESlOMKDANBgkqhkiG9w0BAQsFADCBvjELMAkGA1UEBhMC
+VVMxFjAUBgNVBAoTDUVudHJ1c3QsIEluYy4xKDAmBgNVBAsTH1NlZSB3d3cuZW50
+cnVzdC5uZXQvbGVnYWwtdGVybXMxOTA3BgNVBAsTMChjKSAyMDA5IEVudHJ1c3Qs
+IEluYy4gLSBmb3IgYXV0aG9yaXplZCB1c2Ugb25seTEyMDAGA1UEAxMpRW50cnVz
+dCBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRzIwHhcNMDkwNzA3MTcy
+NTU0WhcNMzAxMjA3MTc1NTU0WjCBvjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUVu
+dHJ1c3QsIEluYy4xKDAmBgNVBAsTH1NlZSB3d3cuZW50cnVzdC5uZXQvbGVnYWwt
+dGVybXMxOTA3BgNVBAsTMChjKSAyMDA5IEVudHJ1c3QsIEluYy4gLSBmb3IgYXV0
+aG9yaXplZCB1c2Ugb25seTEyMDAGA1UEAxMpRW50cnVzdCBSb290IENlcnRpZmlj
+YXRpb24gQXV0aG9yaXR5IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
+AoIBAQC6hLZy254Ma+KZ6TABp3bqMriVQRrJ2mFOWHLP/vaCeb9zYQYKpSfYs1/T
+RU4cctZOMvJyig/3gxnQaoCAAEUesMfnmr8SVycco2gvCoe9amsOXmXzHHfV1IWN
+cCG0szLni6LVhjkCsbjSR87kyUnEO6fe+1R9V77w6G7CebI6C1XiUJgWMhNcL3hW
+wcKUs/Ja5CeanyTXxuzQmyWC48zCxEXFjJd6BmsqEZ+pCm5IO2/b1BEZQvePB7/1
+U1+cPvQXLOZprE4yTGJ36rfo5bs0vBmLrpxR57d+tVOxMyLlbc9wPBr64ptntoP0
+jaWvYkxN4FisZDQSA/i2jZRjJKRxAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAP
+BgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRqciZ60B7vfec7aVHUbI2fkBJmqzAN
+BgkqhkiG9w0BAQsFAAOCAQEAeZ8dlsa2eT8ijYfThwMEYGprmi5ZiXMRrEPR9RP/
+jTkrwPK9T3CMqS/qF8QLVJ7UG5aYMzyorWKiAHarWWluBh1+xLlEjZivEtRh2woZ
+Rkfz6/djwUAFQKXSt/S1mja/qYh2iARVBCuch38aNzx+LaUa2NSJXsq9rD1s2G2v
+1fN2D807iDginWyTmsQ9v4IbZT+mD12q/OWyFcq1rca8PdCE6OoGcrBNOTJ4vz4R
+nAuknZoh8/CbCzB428Hch0P+vGOaysXCHMnHjf87ElgI5rY97HosTvuDls4MPGmH
+VHOkc8KT/1EQrBVUAdj8BbGJoX90g5pJ19xOe4pIb4tF9g==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIC+TCCAoCgAwIBAgINAKaLeSkAAAAAUNCR+TAKBggqhkjOPQQDAzCBvzELMAkG
+A1UEBhMCVVMxFjAUBgNVBAoTDUVudHJ1c3QsIEluYy4xKDAmBgNVBAsTH1NlZSB3
+d3cuZW50cnVzdC5uZXQvbGVnYWwtdGVybXMxOTA3BgNVBAsTMChjKSAyMDEyIEVu
+dHJ1c3QsIEluYy4gLSBmb3IgYXV0aG9yaXplZCB1c2Ugb25seTEzMDEGA1UEAxMq
+RW50cnVzdCBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IC0gRUMxMB4XDTEy
+MTIxODE1MjUzNloXDTM3MTIxODE1NTUzNlowgb8xCzAJBgNVBAYTAlVTMRYwFAYD
+VQQKEw1FbnRydXN0LCBJbmMuMSgwJgYDVQQLEx9TZWUgd3d3LmVudHJ1c3QubmV0
+L2xlZ2FsLXRlcm1zMTkwNwYDVQQLEzAoYykgMjAxMiBFbnRydXN0LCBJbmMuIC0g
+Zm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxMzAxBgNVBAMTKkVudHJ1c3QgUm9vdCBD
+ZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEVDMTB2MBAGByqGSM49AgEGBSuBBAAi
+A2IABIQTydC6bUF74mzQ61VfZgIaJPRbiWlH47jCffHyAsWfoPZb1YsGGYZPUxBt
+ByQnoaD41UcZYUx9ypMn6nQM72+WCf5j7HBdNq1nd67JnXxVRDqiY1Ef9eNi1KlH
+Bz7MIKNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O
+BBYEFLdj5xrdjekIplWDpOBqUEFlEUJJMAoGCCqGSM49BAMDA2cAMGQCMGF52OVC
+R98crlOZF7ZvHH3hvxGU0QOIdeSNiaSKd0bebWHvAvX7td/M/k7//qnmpwIwW5nX
+hTcGtXsI/esni0qU+eH6p44mCOh8kmhtc9hvJqwhAriZtyZBWyVgrtBIGu4G
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFgzCCA2ugAwIBAgIPXZONMGc2yAYdGsdUhGkHMA0GCSqGSIb3DQEBCwUAMDsx
+CzAJBgNVBAYTAkVTMREwDwYDVQQKDAhGTk1ULVJDTTEZMBcGA1UECwwQQUMgUkFJ
+WiBGTk1ULVJDTTAeFw0wODEwMjkxNTU5NTZaFw0zMDAxMDEwMDAwMDBaMDsxCzAJ
+BgNVBAYTAkVTMREwDwYDVQQKDAhGTk1ULVJDTTEZMBcGA1UECwwQQUMgUkFJWiBG
+Tk1ULVJDTTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALpxgHpMhm5/
+yBNtwMZ9HACXjywMI7sQmkCpGreHiPibVmr75nuOi5KOpyVdWRHbNi63URcfqQgf
+BBckWKo3Shjf5TnUV/3XwSyRAZHiItQDwFj8d0fsjz50Q7qsNI1NOHZnjrDIbzAz
+WHFctPVrbtQBULgTfmxKo0nRIBnuvMApGGWn3v7v3QqQIecaZ5JCEJhfTzC8PhxF
+tBDXaEAUwED653cXeuYLj2VbPNmaUtu1vZ5Gzz3rkQUCwJaydkxNEJY7kvqcfw+Z
+374jNUUeAlz+taibmSXaXvMiwzn15Cou08YfxGyqxRxqAQVKL9LFwag0Jl1mpdIC
+IfkYtwb1TplvqKtMUejPUBjFd8g5CSxJkjKZqLsXF3mwWsXmo8RZZUc1g16p6DUL
+mbvkzSDGm0oGObVo/CK67lWMK07q87Hj/LaZmtVC+nFNCM+HHmpxffnTtOmlcYF7
+wk5HlqX2doWjKI/pgG6BU6VtX7hI+cL5NqYuSf+4lsKMB7ObiFj86xsc3i1w4peS
+MKGJ47xVqCfWS+2QrYv6YyVZLag13cqXM7zlzced0ezvXg5KkAYmY6252TUtB7p2
+ZSysV4999AeU14ECll2jB0nVetBX+RvnU0Z1qrB5QstocQjpYL05ac70r8NWQMet
+UqIJ5G+GR4of6ygnXYMgrwTJbFaai0b1AgMBAAGjgYMwgYAwDwYDVR0TAQH/BAUw
+AwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFPd9xf3E6Jobd2Sn9R2gzL+H
+YJptMD4GA1UdIAQ3MDUwMwYEVR0gADArMCkGCCsGAQUFBwIBFh1odHRwOi8vd3d3
+LmNlcnQuZm5tdC5lcy9kcGNzLzANBgkqhkiG9w0BAQsFAAOCAgEAB5BK3/MjTvDD
+nFFlm5wioooMhfNzKWtN/gHiqQxjAb8EZ6WdmF/9ARP67Jpi6Yb+tmLSbkyU+8B1
+RXxlDPiyN8+sD8+Nb/kZ94/sHvJwnvDKuO+3/3Y3dlv2bojzr2IyIpMNOmqOFGYM
+LVN0V2Ue1bLdI4E7pWYjJ2cJj+F3qkPNZVEI7VFY/uY5+ctHhKQV8Xa7pO6kO8Rf
+77IzlhEYt8llvhjho6Tc+hj507wTmzl6NLrTQfv6MooqtyuGC2mDOL7Nii4LcK2N
+JpLuHvUBKwrZ1pebbuCoGRw6IYsMHkCtA+fdZn71uSANA+iW+YJF1DngoABd15jm
+fZ5nc8OaKveri6E6FO80vFIOiZiaBECEHX5FaZNXzuvO+FB8TxxuBEOb+dY7Ixjp
+6o7RTUaN8Tvkasq6+yO3m/qZASlaWFot4/nUbQ4mrcFuNLwy+AwF+mWj2zs3gyLp
+1txyM/1d8iC9djwj2ij3+RvrWWTV3F9yfiD8zYm1kGdNYno/Tq0dwzn+evQoFt9B
+9kiABdcPUXmsEKvU7ANm5mqwujGSQkBqvjrTcuFqN1W8rB2Vt2lh8kORdOag0wok
+RqEIr9baRRmW1FMdW4R58MD3R++Lj8UGrp1MYp3/RgT408m2ECVAdf4WqslKYIYv
+uu8wd+RU4riEmViAqhOLUTpPSPaLtrM=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICZTCCAeugAwIBAgIQeI8nXIESUiClBNAt3bpz9DAKBggqhkjOPQQDAzB0MQsw
+CQYDVQQGEwJQTDEhMB8GA1UEChMYQXNzZWNvIERhdGEgU3lzdGVtcyBTLkEuMScw
+JQYDVQQLEx5DZXJ0dW0gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxGTAXBgNVBAMT
+EENlcnR1bSBFQy0zODQgQ0EwHhcNMTgwMzI2MDcyNDU0WhcNNDMwMzI2MDcyNDU0
+WjB0MQswCQYDVQQGEwJQTDEhMB8GA1UEChMYQXNzZWNvIERhdGEgU3lzdGVtcyBT
+LkEuMScwJQYDVQQLEx5DZXJ0dW0gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxGTAX
+BgNVBAMTEENlcnR1bSBFQy0zODQgQ0EwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAATE
+KI6rGFtqvm5kN2PkzeyrOvfMobgOgknXhimfoZTy42B4mIF4Bk3y7JoOV2CDn7Tm
+Fy8as10CW4kjPMIRBSqniBMY81CE1700LCeJVf/OTOffph8oxPBUw7l8t1Ot68Kj
+QjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFI0GZnQkdjrzife81r1HfS+8
+EF9LMA4GA1UdDwEB/wQEAwIBBjAKBggqhkjOPQQDAwNoADBlAjADVS2m5hjEfO/J
+UG7BJw+ch69u1RsIGL2SKcHvlJF40jocVYli5RsJHrpka/F2tNQCMQC0QoSZ/6vn
+nvuRlydd3LBbMHHOXjgaatkl5+r3YZJW+OraNsKHZZYuciUvf9/DE8k=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFwDCCA6igAwIBAgIQHr9ZULjJgDdMBvfrVU+17TANBgkqhkiG9w0BAQ0FADB6
+MQswCQYDVQQGEwJQTDEhMB8GA1UEChMYQXNzZWNvIERhdGEgU3lzdGVtcyBTLkEu
+MScwJQYDVQQLEx5DZXJ0dW0gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxHzAdBgNV
+BAMTFkNlcnR1bSBUcnVzdGVkIFJvb3QgQ0EwHhcNMTgwMzE2MTIxMDEzWhcNNDMw
+MzE2MTIxMDEzWjB6MQswCQYDVQQGEwJQTDEhMB8GA1UEChMYQXNzZWNvIERhdGEg
+U3lzdGVtcyBTLkEuMScwJQYDVQQLEx5DZXJ0dW0gQ2VydGlmaWNhdGlvbiBBdXRo
+b3JpdHkxHzAdBgNVBAMTFkNlcnR1bSBUcnVzdGVkIFJvb3QgQ0EwggIiMA0GCSqG
+SIb3DQEBAQUAA4ICDwAwggIKAoICAQDRLY67tzbqbTeRn06TpwXkKQMlzhyC93yZ
+n0EGze2jusDbCSzBfN8pfktlL5On1AFrAygYo9idBcEq2EXxkd7fO9CAAozPOA/q
+p1x4EaTByIVcJdPTsuclzxFUl6s1wB52HO8AU5853BSlLCIls3Jy/I2z5T4IHhQq
+NwuIPMqw9MjCoa68wb4pZ1Xi/K1ZXP69VyywkI3C7Te2fJmItdUDmj0VDT06qKhF
+8JVOJVkdzZhpu9PMMsmN74H+rX2Ju7pgE8pllWeg8xn2A1bUatMn4qGtg/BKEiJ3
+HAVz4hlxQsDsdUaakFjgao4rpUYwBI4Zshfjvqm6f1bxJAPXsiEodg42MEx51UGa
+mqi4NboMOvJEGyCI98Ul1z3G4z5D3Yf+xOr1Uz5MZf87Sst4WmsXXw3Hw09Omiqi
+7VdNIuJGmj8PkTQkfVXjjJU30xrwCSss0smNtA0Aq2cpKNgB9RkEth2+dv5yXMSF
+ytKAQd8FqKPVhJBPC/PgP5sZ0jeJP/J7UhyM9uH3PAeXjA6iWYEMspA90+NZRu0P
+qafegGtaqge2Gcu8V/OXIXoMsSt0Puvap2ctTMSYnjYJdmZm/Bo/6khUHL4wvYBQ
+v3y1zgD2DGHZ5yQD4OMBgQ692IU0iL2yNqh7XAjlRICMb/gv1SHKHRzQ+8S1h9E6
+Tsd2tTVItQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBSM+xx1
+vALTn04uSNn5YFSqxLNP+jAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQENBQAD
+ggIBAEii1QALLtA/vBzVtVRJHlpr9OTy4EA34MwUe7nJ+jW1dReTagVphZzNTxl4
+WxmB82M+w85bj/UvXgF2Ez8sALnNllI5SW0ETsXpD4YN4fqzX4IS8TrOZgYkNCvo
+zMrnadyHncI013nR03e4qllY/p0m+jiGPp2Kh2RX5Rc64vmNueMzeMGQ2Ljdt4NR
+5MTMI9UGfOZR0800McD2RrsLrfw9EAUqO0qRJe6M1ISHgCq8CYyqOhNf6DR5UMEQ
+GfnTKB7U0VEwKbOukGfWHwpjscWpxkIxYxeU72nLL/qMFH3EQxiJ2fAyQOaA4kZf
+5ePBAFmo+eggvIksDkc0C+pXwlM2/KfUrzHN/gLldfq5Jwn58/U7yn2fqSLLiMmq
+0Uc9NneoWWRrJ8/vJ8HjJLWG965+Mk2weWjROeiQWMODvA8s1pfrzgzhIMfatz7D
+P78v3DSk+yshzWePS/Tj6tQ/50+6uaWTRRxmHyH6ZF5v4HaUMst19W7l9o/HuKTM
+qJZ9ZPskWkoDbGs4xugDQ5r3V7mzKWmTOPQD8rv7gmsHINFSH5pkAnuYZttcTVoP
+0ISVoDwUQwbKytu4QTbaakRnh6+v40URFWkIsr4WOZckbxJF0WddCajJFdr60qZf
+E2Efv4WstK2tBZQIgx51F9NxO5NQI1mg7TyRVJ12AMXDuDjb
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIEYzCCA0ugAwIBAgIBATANBgkqhkiG9w0BAQsFADCB0jELMAkGA1UEBhMCVFIx
+GDAWBgNVBAcTD0dlYnplIC0gS29jYWVsaTFCMEAGA1UEChM5VHVya2l5ZSBCaWxp
+bXNlbCB2ZSBUZWtub2xvamlrIEFyYXN0aXJtYSBLdXJ1bXUgLSBUVUJJVEFLMS0w
+KwYDVQQLEyRLYW11IFNlcnRpZmlrYXN5b24gTWVya2V6aSAtIEthbXUgU00xNjA0
+BgNVBAMTLVRVQklUQUsgS2FtdSBTTSBTU0wgS29rIFNlcnRpZmlrYXNpIC0gU3Vy
+dW0gMTAeFw0xMzExMjUwODI1NTVaFw00MzEwMjUwODI1NTVaMIHSMQswCQYDVQQG
+EwJUUjEYMBYGA1UEBxMPR2ViemUgLSBLb2NhZWxpMUIwQAYDVQQKEzlUdXJraXll
+IEJpbGltc2VsIHZlIFRla25vbG9qaWsgQXJhc3Rpcm1hIEt1cnVtdSAtIFRVQklU
+QUsxLTArBgNVBAsTJEthbXUgU2VydGlmaWthc3lvbiBNZXJrZXppIC0gS2FtdSBT
+TTE2MDQGA1UEAxMtVFVCSVRBSyBLYW11IFNNIFNTTCBLb2sgU2VydGlmaWthc2kg
+LSBTdXJ1bSAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr3UwM6q7
+a9OZLBI3hNmNe5eA027n/5tQlT6QlVZC1xl8JoSNkvoBHToP4mQ4t4y86Ij5iySr
+LqP1N+RAjhgleYN1Hzv/bKjFxlb4tO2KRKOrbEz8HdDc72i9z+SqzvBV96I01INr
+N3wcwv61A+xXzry0tcXtAA9TNypN9E8Mg/uGz8v+jE69h/mniyFXnHrfA2eJLJ2X
+YacQuFWQfw4tJzh03+f92k4S400VIgLI4OD8D62K18lUUMw7D8oWgITQUVbDjlZ/
+iSIzL+aFCr2lqBs23tPcLG07xxO9WSMs5uWk99gL7eqQQESolbuT1dCANLZGeA4f
+AJNG4e7p+exPFwIDAQABo0IwQDAdBgNVHQ4EFgQUZT/HiobGPN08VFw1+DrtUgxH
+V8gwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEL
+BQADggEBACo/4fEyjq7hmFxLXs9rHmoJ0iKpEsdeV31zVmSAhHqT5Am5EM2fKifh
+AHe+SMg1qIGf5LgsyX8OsNJLN13qudULXjS99HMpw+0mFZx+CFOKWI3QSyjfwbPf
+IPP54+M638yclNhOT8NrF7f3cuitZjO1JVOr4PhMqZ398g26rrnZqsZr+ZO7rqu4
+lzwDGrpDxpa5RXI4s6ehlj2Re37AIVNMh+3yC1SVUZPVIqUNivGTDj5UDrDYyU7c
+8jEyVupk+eq1nRZmQnLzf9OxMUP8pI4X8W0jq5Rm+K37DwhuJi1/FwcJsoz7UMCf
+lo3Ptv0AnVoUmr8CRPXBwp8iXqIPoeM=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAw
+TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
+cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4
+WhcNMzUwNjA0MTEwNDM4WjBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJu
+ZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBY
+MTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK3oJHP0FDfzm54rVygc
+h77ct984kIxuPOZXoHj3dcKi/vVqbvYATyjb3miGbESTtrFj/RQSa78f0uoxmyF+
+0TM8ukj13Xnfs7j/EvEhmkvBioZxaUpmZmyPfjxwv60pIgbz5MDmgK7iS4+3mX6U
+A5/TR5d8mUgjU+g4rk8Kb4Mu0UlXjIB0ttov0DiNewNwIRt18jA8+o+u3dpjq+sW
+T8KOEUt+zwvo/7V3LvSye0rgTBIlDHCNAymg4VMk7BPZ7hm/ELNKjD+Jo2FR3qyH
+B5T0Y3HsLuJvW5iB4YlcNHlsdu87kGJ55tukmi8mxdAQ4Q7e2RCOFvu396j3x+UC
+B5iPNgiV5+I3lg02dZ77DnKxHZu8A/lJBdiB3QW0KtZB6awBdpUKD9jf1b0SHzUv
+KBds0pjBqAlkd25HN7rOrFleaJ1/ctaJxQZBKT5ZPt0m9STJEadao0xAH0ahmbWn
+OlFuhjuefXKnEgV4We0+UXgVCwOPjdAvBbI+e0ocS3MFEvzG6uBQE3xDk3SzynTn
+jh8BCNAw1FtxNrQHusEwMFxIt4I7mKZ9YIqioymCzLq9gwQbooMDQaHWBfEbwrbw
+qHyGO0aoSCqI3Haadr8faqU9GY/rOPNk3sgrDQoo//fb4hVC1CLQJ13hef4Y53CI
+rU7m2Ys6xt0nUW7/vGT1M0NPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNV
+HRMBAf8EBTADAQH/MB0GA1UdDgQWBBR5tFnme7bl5AFzgAiIyBpY9umbbjANBgkq
+hkiG9w0BAQsFAAOCAgEAVR9YqbyyqFDQDLHYGmkgJykIrGF1XIpu+ILlaS/V9lZL
+ubhzEFnTIZd+50xx+7LSYK05qAvqFyFWhfFQDlnrzuBZ6brJFe+GnY+EgPbk6ZGQ
+3BebYhtF8GaV0nxvwuo77x/Py9auJ/GpsMiu/X1+mvoiBOv/2X/qkSsisRcOj/KK
+NFtY2PwByVS5uCbMiogziUwthDyC3+6WVwW6LLv3xLfHTjuCvjHIInNzktHCgKQ5
+ORAzI4JMPJ+GslWYHb4phowim57iaztXOoJwTdwJx4nLCgdNbOhdjsnvzqvHu7Ur
+TkXWStAmzOVyyghqpZXjFaH3pO3JLF+l+/+sKAIuvtd7u+Nxe5AW0wdeRlN8NwdC
+jNPElpzVmbUq4JUagEiuTDkHzsxHpFKVK7q4+63SM1N95R1NbdWhscdCb+ZAJzVc
+oyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq
+4RgqsahDYVvTH9w7jXbyLeiNdd8XM2w9U/t7y0Ff/9yi0GE44Za4rF2LN9d11TPA
+mRGunUHBcnWEvgJBQl9nJEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57d
+emyPxgcYxn/eR44/KJ4EBs+lVDR3veyJm+kXQ99b21/+jh5Xos1AnX5iItreGCc=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFdDCCA1ygAwIBAgIPAWdfJ9b+euPkrL4JWwWeMA0GCSqGSIb3DQEBCwUAMEQx
+CzAJBgNVBAYTAkZJMRowGAYDVQQKDBFUZWxpYSBGaW5sYW5kIE95ajEZMBcGA1UE
+AwwQVGVsaWEgUm9vdCBDQSB2MjAeFw0xODExMjkxMTU1NTRaFw00MzExMjkxMTU1
+NTRaMEQxCzAJBgNVBAYTAkZJMRowGAYDVQQKDBFUZWxpYSBGaW5sYW5kIE95ajEZ
+MBcGA1UEAwwQVGVsaWEgUm9vdCBDQSB2MjCCAiIwDQYJKoZIhvcNAQEBBQADggIP
+ADCCAgoCggIBALLQPwe84nvQa5n44ndp586dpAO8gm2h/oFlH0wnrI4AuhZ76zBq
+AMCzdGh+sq/H1WKzej9Qyow2RCRj0jbpDIX2Q3bVTKFgcmfiKDOlyzG4OiIjNLh9
+vVYiQJ3q9HsDrWj8soFPmNB06o3lfc1jw6P23pLCWBnglrvFxKk9pXSW/q/5iaq9
+lRdU2HhE8Qx3FZLgmEKnpNaqIJLNwaCzlrI6hEKNfdWV5Nbb6WLEWLN5xYzTNTOD
+n3WhUidhOPFZPY5Q4L15POdslv5e2QJltI5c0BE0312/UqeBAMN/mUWZFdUXyApT
+7GPzmX3MaRKGwhfwAZ6/hLzRUssbkmbOpFPlob/E2wnW5olWK8jjfN7j/4nlNW4o
+6GwLI1GpJQXrSPjdscr6bAhR77cYbETKJuFzxokGgeWKrLDiKca5JLNrRBH0pUPC
+TEPlcDaMtjNXepUugqD0XBCzYYP2AgWGLnwtbNwDRm41k9V6lS/eINhbfpSQBGq6
+WT0EBXWdN6IOLj3rwaRSg/7Qa9RmjtzG6RJOHSpXqhC8fF6CfaamyfItufUXJ63R
+DolUK5X6wK0dmBR4M0KGCqlztft0DbcbMBnEWg4cJ7faGND/isgFuvGqHKI3t+ZI
+pEYslOqodmJHixBTB0hXbOKSTbauBcvcwUpej6w9GU7C7WB1K9vBykLVAgMBAAGj
+YzBhMB8GA1UdIwQYMBaAFHKs5DN5qkWH9v2sHZ7Wxy+G2CQ5MB0GA1UdDgQWBBRy
+rOQzeapFh/b9rB2e1scvhtgkOTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUw
+AwEB/zANBgkqhkiG9w0BAQsFAAOCAgEAoDtZpwmUPjaE0n4vOaWWl/oRrfxn83EJ
+8rKJhGdEr7nv7ZbsnGTbMjBvZ5qsfl+yqwE2foH65IRe0qw24GtixX1LDoJt0nZi
+0f6X+J8wfBj5tFJ3gh1229MdqfDBmgC9bXXYfef6xzijnHDoRnkDry5023X4blMM
+A8iZGok1GTzTyVR8qPAs5m4HeW9q4ebqkYJpCh3DflminmtGFZhb069GHWLIzoBS
+SRE/yQQSwxN8PzuKlts8oB4KtItUsiRnDe+Cy748fdHif64W1lZYudogsYMVoe+K
+TTJvQS8TUoKU1xrBeKJR3Stwbbca+few4GeXVtt8YVMJAygCQMez2P2ccGrGKMOF
+6eLtGpOg3kuYooQ+BXcBlj37tCAPnHICehIv1aO6UXivKitEZU61/Qrowc15h2Er
+3oBXRb9n8ZuRXqWk7FlIEA04x7D6w0RtBPV4UBySllva9bguulvP5fBqnUsvWHMt
+Ty3EHD70sz+rFQ47GUGKpMFXEmZxTPpT41frYpUJnlTd0cI8Vzy9OK2YZLe4A5pT
+VmBds9hCG1xLEooc6+t9xnppxyd/pPiL8uSUZodL6ZQHCRJ5irLrdATczvREWeAW
+ysUsWNc8e89ihmpQfTU2Zqf7N+cox9jQraVplI/owd8k+BsHMYeB2F326CjYSlKA
+rBPuUBQemMc=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDtTCCAp2gAwIBAgIQdrEgUnTwhYdGs/gjGvbCwDANBgkqhkiG9w0BAQsFADBt
+MQswCQYDVQQGEwJDSDEQMA4GA1UEChMHV0lTZUtleTEiMCAGA1UECxMZT0lTVEUg
+Rm91bmRhdGlvbiBFbmRvcnNlZDEoMCYGA1UEAxMfT0lTVEUgV0lTZUtleSBHbG9i
+YWwgUm9vdCBHQiBDQTAeFw0xNDEyMDExNTAwMzJaFw0zOTEyMDExNTEwMzFaMG0x
+CzAJBgNVBAYTAkNIMRAwDgYDVQQKEwdXSVNlS2V5MSIwIAYDVQQLExlPSVNURSBG
+b3VuZGF0aW9uIEVuZG9yc2VkMSgwJgYDVQQDEx9PSVNURSBXSVNlS2V5IEdsb2Jh
+bCBSb290IEdCIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2Be3
+HEokKtaXscriHvt9OO+Y9bI5mE4nuBFde9IllIiCFSZqGzG7qFshISvYD06fWvGx
+WuR51jIjK+FTzJlFXHtPrby/h0oLS5daqPZI7H17Dc0hBt+eFf1Biki3IPShehtX
+1F1Q/7pn2COZH8g/497/b1t3sWtuuMlk9+HKQUYOKXHQuSP8yYFfTvdv37+ErXNk
+u7dCjmn21HYdfp2nuFeKUWdy19SouJVUQHMD9ur06/4oQnc/nSMbsrY9gBQHTC5P
+99UKFg29ZkM3fiNDecNAhvVMKdqOmq0NpQSHiB6F4+lT1ZvIiwNjeOvgGUpuuy9r
+M2RYk61pv48b74JIxwIDAQABo1EwTzALBgNVHQ8EBAMCAYYwDwYDVR0TAQH/BAUw
+AwEB/zAdBgNVHQ4EFgQUNQ/INmNe4qPs+TtmFc5RUuORmj0wEAYJKwYBBAGCNxUB
+BAMCAQAwDQYJKoZIhvcNAQELBQADggEBAEBM+4eymYGQfp3FsLAmzYh7KzKNbrgh
+cViXfa43FK8+5/ea4n32cZiZBKpDdHij40lhPnOMTZTg+XHEthYOU3gf1qKHLwI5
+gSk8rxWYITD+KJAAjNHhy/peyP34EEY7onhCkRd0VQreUGdNZtGn//3ZwLWoo4rO
+ZvUPQ82nK1d7Y0Zqqi5S2PTt4W2tKZB4SLrhI6qjiey1q5bAtEuiHZeeevJuQHHf
+aPFlTc58Bd9TZaml8LGXBHAVRgOY1NK/VLSgWH1Sb9pWJmLU2NuJMW8c8CLC02Ic
+Nc1MaRVUGpCY3useX8p3x8uOPUNpnJpY0CQ73xtAln41rYHHTnG6iBM=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIEMjCCAxqgAwIBAgIBATANBgkqhkiG9w0BAQUFADB7MQswCQYDVQQGEwJHQjEb
+MBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHDAdTYWxmb3JkMRow
+GAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UEAwwYQUFBIENlcnRpZmlj
+YXRlIFNlcnZpY2VzMB4XDTA0MDEwMTAwMDAwMFoXDTI4MTIzMTIzNTk1OVowezEL
+MAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UE
+BwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNVBAMM
+GEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczCCASIwDQYJKoZIhvcNAQEBBQADggEP
+ADCCAQoCggEBAL5AnfRu4ep2hxxNRUSOvkbIgwadwSr+GB+O5AL686tdUIoWMQua
+BtDFcCLNSS1UY8y2bmhGC1Pqy0wkwLxyTurxFa70VJoSCsN6sjNg4tqJVfMiWPPe
+3M/vg4aijJRPn2jymJBGhCfHdr/jzDUsi14HZGWCwEiwqJH5YZ92IFCokcdmtet4
+YgNW8IoaE+oxox6gmf049vYnMlhvB/VruPsUK6+3qszWY19zjNoFmag4qMsXeDZR
+rOme9Hg6jc8P2ULimAyrL58OAd7vn5lJ8S3frHRNG5i1R8XlKdH5kBjHYpy+g8cm
+ez6KJcfA3Z3mNWgQIJ2P2N7Sw4ScDV7oL8kCAwEAAaOBwDCBvTAdBgNVHQ4EFgQU
+oBEKIz6W8Qfs4q8p74Klf9AwpLQwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF
+MAMBAf8wewYDVR0fBHQwcjA4oDagNIYyaHR0cDovL2NybC5jb21vZG9jYS5jb20v
+QUFBQ2VydGlmaWNhdGVTZXJ2aWNlcy5jcmwwNqA0oDKGMGh0dHA6Ly9jcmwuY29t
+b2RvLm5ldC9BQUFDZXJ0aWZpY2F0ZVNlcnZpY2VzLmNybDANBgkqhkiG9w0BAQUF
+AAOCAQEACFb8AvCb6P+k+tZ7xkSAzk/ExfYAWMymtrwUSWgEdujm7l3sAg9g1o1Q
+GE8mTgHj5rCl7r+8dFRBv/38ErjHT1r0iWAFf2C3BUrz9vHCv8S5dIa2LX1rzNLz
+Rt0vxuBqw8M0Ayx9lt1awg6nCpnBBYurDC/zXDrPbDdVCYfeU0BsWO/8tqtlbgT2
+G9w84FoVxp7Z8VlIMCFlA2zs6SFz7JsDoeA3raAVGI/6ugLOpyypEBMs1OUIJqsi
+l2D4kF501KKaU73yqWjgom7C12yxow+ev+to51byrvLjKzg6CYG1a4XXvi3tPxq3
+smPi9WIsgtRqAEFQ8TmDn5XpNpaYbg==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIH0zCCBbugAwIBAgIIXsO3pkN/pOAwDQYJKoZIhvcNAQEFBQAwQjESMBAGA1UE
+AwwJQUNDVlJBSVoxMRAwDgYDVQQLDAdQS0lBQ0NWMQ0wCwYDVQQKDARBQ0NWMQsw
+CQYDVQQGEwJFUzAeFw0xMTA1MDUwOTM3MzdaFw0zMDEyMzEwOTM3MzdaMEIxEjAQ
+BgNVBAMMCUFDQ1ZSQUlaMTEQMA4GA1UECwwHUEtJQUNDVjENMAsGA1UECgwEQUND
+VjELMAkGA1UEBhMCRVMwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCb
+qau/YUqXry+XZpp0X9DZlv3P4uRm7x8fRzPCRKPfmt4ftVTdFXxpNRFvu8gMjmoY
+HtiP2Ra8EEg2XPBjs5BaXCQ316PWywlxufEBcoSwfdtNgM3802/J+Nq2DoLSRYWo
+G2ioPej0RGy9ocLLA76MPhMAhN9KSMDjIgro6TenGEyxCQ0jVn8ETdkXhBilyNpA
+lHPrzg5XPAOBOp0KoVdDaaxXbXmQeOW1tDvYvEyNKKGno6e6Ak4l0Squ7a4DIrhr
+IA8wKFSVf+DuzgpmndFALW4ir50awQUZ0m/A8p/4e7MCQvtQqR0tkw8jq8bBD5L/
+0KIV9VMJcRz/RROE5iZe+OCIHAr8Fraocwa48GOEAqDGWuzndN9wrqODJerWx5eH
+k6fGioozl2A3ED6XPm4pFdahD9GILBKfb6qkxkLrQaLjlUPTAYVtjrs78yM2x/47
+4KElB0iryYl0/wiPgL/AlmXz7uxLaL2diMMxs0Dx6M/2OLuc5NF/1OVYm3z61PMO
+m3WR5LpSLhl+0fXNWhn8ugb2+1KoS5kE3fj5tItQo05iifCHJPqDQsGH+tUtKSpa
+cXpkatcnYGMN285J9Y0fkIkyF/hzQ7jSWpOGYdbhdQrqeWZ2iE9x6wQl1gpaepPl
+uUsXQA+xtrn13k/c4LOsOxFwYIRKQ26ZIMApcQrAZQIDAQABo4ICyzCCAscwfQYI
+KwYBBQUHAQEEcTBvMEwGCCsGAQUFBzAChkBodHRwOi8vd3d3LmFjY3YuZXMvZmls
+ZWFkbWluL0FyY2hpdm9zL2NlcnRpZmljYWRvcy9yYWl6YWNjdjEuY3J0MB8GCCsG
+AQUFBzABhhNodHRwOi8vb2NzcC5hY2N2LmVzMB0GA1UdDgQWBBTSh7Tj3zcnk1X2
+VuqB5TbMjB4/vTAPBgNVHRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFNKHtOPfNyeT
+VfZW6oHlNsyMHj+9MIIBcwYDVR0gBIIBajCCAWYwggFiBgRVHSAAMIIBWDCCASIG
+CCsGAQUFBwICMIIBFB6CARAAQQB1AHQAbwByAGkAZABhAGQAIABkAGUAIABDAGUA
+cgB0AGkAZgBpAGMAYQBjAGkA8wBuACAAUgBhAO0AegAgAGQAZQAgAGwAYQAgAEEA
+QwBDAFYAIAAoAEEAZwBlAG4AYwBpAGEAIABkAGUAIABUAGUAYwBuAG8AbABvAGcA
+7QBhACAAeQAgAEMAZQByAHQAaQBmAGkAYwBhAGMAaQDzAG4AIABFAGwAZQBjAHQA
+cgDzAG4AaQBjAGEALAAgAEMASQBGACAAUQA0ADYAMAAxADEANQA2AEUAKQAuACAA
+QwBQAFMAIABlAG4AIABoAHQAdABwADoALwAvAHcAdwB3AC4AYQBjAGMAdgAuAGUA
+czAwBggrBgEFBQcCARYkaHR0cDovL3d3dy5hY2N2LmVzL2xlZ2lzbGFjaW9uX2Mu
+aHRtMFUGA1UdHwROMEwwSqBIoEaGRGh0dHA6Ly93d3cuYWNjdi5lcy9maWxlYWRt
+aW4vQXJjaGl2b3MvY2VydGlmaWNhZG9zL3JhaXphY2N2MV9kZXIuY3JsMA4GA1Ud
+DwEB/wQEAwIBBjAXBgNVHREEEDAOgQxhY2N2QGFjY3YuZXMwDQYJKoZIhvcNAQEF
+BQADggIBAJcxAp/n/UNnSEQU5CmH7UwoZtCPNdpNYbdKl02125DgBS4OxnnQ8pdp
+D70ER9m+27Up2pvZrqmZ1dM8MJP1jaGo/AaNRPTKFpV8M9xii6g3+CfYCS0b78gU
+JyCpZET/LtZ1qmxNYEAZSUNUY9rizLpm5U9EelvZaoErQNV/+QEnWCzI7UiRfD+m
+AM/EKXMRNt6GGT6d7hmKG9Ww7Y49nCrADdg9ZuM8Db3VlFzi4qc1GwQA9j9ajepD
+vV+JHanBsMyZ4k0ACtrJJ1vnE5Bc5PUzolVt3OAJTS+xJlsndQAJxGJ3KQhfnlms
+tn6tn1QwIgPBHnFk/vk4CpYY3QIUrCPLBhwepH2NDd4nQeit2hW3sCPdK6jT2iWH
+7ehVRE2I9DZ+hJp4rPcOVkkO1jMl1oRQQmwgEh0q1b688nCBpHBgvgW1m54ERL5h
+I6zppSSMEYCUWqKiuUnSwdzRp+0xESyeGabu4VXhwOrPDYTkF7eifKXeVSUG7szA
+h1xA2syVP1XgNce4hL60Xc16gwFy7ofmXx2utYXGJt/mwZrpHgJHnyqobalbz+xF
+d3+YJ5oyXSrjhO7FmGYvliAd3djDJ9ew+f7Zfc3Qn48LFFhRny+Lwzgt3uiP1o2H
+pPVWQxaZLPSkVrQ0uGE3ycJYgBugl6H8WY3pEfbRD0tVNEYqi4Y7
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFuzCCA6OgAwIBAgIIVwoRl0LE48wwDQYJKoZIhvcNAQELBQAwazELMAkGA1UE
+BhMCSVQxDjAMBgNVBAcMBU1pbGFuMSMwIQYDVQQKDBpBY3RhbGlzIFMucC5BLi8w
+MzM1ODUyMDk2NzEnMCUGA1UEAwweQWN0YWxpcyBBdXRoZW50aWNhdGlvbiBSb290
+IENBMB4XDTExMDkyMjExMjIwMloXDTMwMDkyMjExMjIwMlowazELMAkGA1UEBhMC
+SVQxDjAMBgNVBAcMBU1pbGFuMSMwIQYDVQQKDBpBY3RhbGlzIFMucC5BLi8wMzM1
+ODUyMDk2NzEnMCUGA1UEAwweQWN0YWxpcyBBdXRoZW50aWNhdGlvbiBSb290IENB
+MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAp8bEpSmkLO/lGMWwUKNv
+UTufClrJwkg4CsIcoBh/kbWHuUA/3R1oHwiD1S0eiKD4j1aPbZkCkpAW1V8IbInX
+4ay8IMKx4INRimlNAJZaby/ARH6jDuSRzVju3PvHHkVH3Se5CAGfpiEd9UEtL0z9
+KK3giq0itFZljoZUj5NDKd45RnijMCO6zfB9E1fAXdKDa0hMxKufgFpbOr3JpyI/
+gCczWw63igxdBzcIy2zSekciRDXFzMwujt0q7bd9Zg1fYVEiVRvjRuPjPdA1Yprb
+rxTIW6HMiRvhMCb8oJsfgadHHwTrozmSBp+Z07/T6k9QnBn+locePGX2oxgkg4YQ
+51Q+qDp2JE+BIcXjDwL4k5RHILv+1A7TaLndxHqEguNTVHnd25zS8gebLra8Pu2F
+be8lEfKXGkJh90qX6IuxEAf6ZYGyojnP9zz/GPvG8VqLWeICrHuS0E4UT1lF9gxe
+KF+w6D9Fz8+vm2/7hNN3WpVvrJSEnu68wEqPSpP4RCHiMUVhUE4Q2OM1fEwZtN4F
+v6MGn8i1zeQf1xcGDXqVdFUNaBr8EBtiZJ1t4JWgw5QHVw0U5r0F+7if5t+L4sbn
+fpb2U8WANFAoWPASUHEXMLrmeGO89LKtmyuy/uE5jF66CyCU3nuDuP/jVo23Eek7
+jPKxwV2dpAtMK9myGPW1n0sCAwEAAaNjMGEwHQYDVR0OBBYEFFLYiDrIn3hm7Ynz
+ezhwlMkCAjbQMA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAUUtiIOsifeGbt
+ifN7OHCUyQICNtAwDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4ICAQAL
+e3KHwGCmSUyIWOYdiPcUZEim2FgKDk8TNd81HdTtBjHIgT5q1d07GjLukD0R0i70
+jsNjLiNmsGe+b7bAEzlgqqI0JZN1Ut6nna0Oh4lScWoWPBkdg/iaKWW+9D+a2fDz
+WochcYBNy+A4mz+7+uAwTc+G02UQGRjRlwKxK3JCaKygvU5a2hi/a5iB0P2avl4V
+SM0RFbnAKVy06Ij3Pjaut2L9HmLecHgQHEhb2rykOLpn7VU+Xlff1ANATIGk0k9j
+pwlCCRT8AKnCgHNPLsBA2RF7SOp6AsDT6ygBJlh0wcBzIm2Tlf05fbsq4/aC4yyX
+X04fkZT6/iyj2HYauE2yOE+b+h1IYHkm4vP9qdCa6HCPSXrW5b0KDtst842/6+Ok
+fcvHlXHo2qN8xcL4dJIEG4aspCJTQLas/kx2z/uUMsA1n3Y/buWQbqCmJqK4LL7R
+K4X9p2jIugErsWx0Hbhzlefut8cl8ABMALJ+tguLHPPAUJ4lueAI3jZm/zel0btU
+ZCzJJ7VLkn5l/9Mt4blOvH+kQSGQQXemOR/qnuOf0GZvBeyqdn6/axag67XH/JJU
+LysRJyU3eExRarDzzFhdFPFqSBX/wge2sY0PjlxQRrM9vwGYT7JZVEc+NHt4bVaT
+LnPqZih4zR0Uv6CPLy64Lo7yFIrM6bV8+2ydDKXhlg==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDTDCCAjSgAwIBAgIId3cGJyapsXwwDQYJKoZIhvcNAQELBQAwRDELMAkGA1UE
+BhMCVVMxFDASBgNVBAoMC0FmZmlybVRydXN0MR8wHQYDVQQDDBZBZmZpcm1UcnVz
+dCBDb21tZXJjaWFsMB4XDTEwMDEyOTE0MDYwNloXDTMwMTIzMTE0MDYwNlowRDEL
+MAkGA1UEBhMCVVMxFDASBgNVBAoMC0FmZmlybVRydXN0MR8wHQYDVQQDDBZBZmZp
+cm1UcnVzdCBDb21tZXJjaWFsMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
+AQEA9htPZwcroRX1BiLLHwGy43NFBkRJLLtJJRTWzsO3qyxPxkEylFf6EqdbDuKP
+Hx6GGaeqtS25Xw2Kwq+FNXkyLbscYjfysVtKPcrNcV/pQr6U6Mje+SJIZMblq8Yr
+ba0F8PrVC8+a5fBQpIs7R6UjW3p6+DM/uO+Zl+MgwdYoic+U+7lF7eNAFxHUdPAL
+MeIrJmqbTFeurCA+ukV6BfO9m2kVrn1OIGPENXY6BwLJN/3HR+7o8XYdcxXyl6S1
+yHp52UKqK39c/s4mT6NmgTWvRLpUHhwwMmWd5jyTXlBOeuM61G7MGvv50jeuJCqr
+VwMiKA1JdX+3KNp1v47j3A55MQIDAQABo0IwQDAdBgNVHQ4EFgQUnZPGU4teyq8/
+nx4P5ZmVvCT2lI8wDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwDQYJ
+KoZIhvcNAQELBQADggEBAFis9AQOzcAN/wr91LoWXym9e2iZWEnStB03TX8nfUYG
+XUPGhi4+c7ImfU+TqbbEKpqrIZcUsd6M06uJFdhrJNTxFq7YpFzUf1GO7RgBsZNj
+vbz4YYCanrHOQnDiqX0GJX0nof5v7LMeJNrjS1UaADs1tDvZ110w/YETifLCBivt
+Z8SOyUOyXGsViQK8YvxO8rUzqrJv0wqiUOP2O+guRMLbZjipM1ZI8W0bM40NjD9g
+N53Tym1+NH4Nn3J2ixufcv1SNUFFApYvHLKac0khsUlHRUe072o0EclNmsxZt9YC
+nlpOZbWUrhvfKbAW8b8Angc6F2S1BLUjIZkKlTuXfO8=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDTDCCAjSgAwIBAgIIfE8EORzUmS0wDQYJKoZIhvcNAQEFBQAwRDELMAkGA1UE
+BhMCVVMxFDASBgNVBAoMC0FmZmlybVRydXN0MR8wHQYDVQQDDBZBZmZpcm1UcnVz
+dCBOZXR3b3JraW5nMB4XDTEwMDEyOTE0MDgyNFoXDTMwMTIzMTE0MDgyNFowRDEL
+MAkGA1UEBhMCVVMxFDASBgNVBAoMC0FmZmlybVRydXN0MR8wHQYDVQQDDBZBZmZp
+cm1UcnVzdCBOZXR3b3JraW5nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
+AQEAtITMMxcua5Rsa2FSoOujz3mUTOWUgJnLVWREZY9nZOIG41w3SfYvm4SEHi3y
+YJ0wTsyEheIszx6e/jarM3c1RNg1lho9Nuh6DtjVR6FqaYvZ/Ls6rnla1fTWcbua
+kCNrmreIdIcMHl+5ni36q1Mr3Lt2PpNMCAiMHqIjHNRqrSK6mQEubWXLviRmVSRL
+QESxG9fhwoXA3hA/Pe24/PHxI1Pcv2WXb9n5QHGNfb2V1M6+oF4nI979ptAmDgAp
+6zxG8D1gvz9Q0twmQVGeFDdCBKNwV6gbh+0t+nvujArjqWaJGctB+d1ENmHP4ndG
+yH329JKBNv3bNPFyfvMMFr20FQIDAQABo0IwQDAdBgNVHQ4EFgQUBx/S55zawm6i
+QLSwelAQUHTEyL0wDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwDQYJ
+KoZIhvcNAQEFBQADggEBAIlXshZ6qML91tmbmzTCnLQyFE2npN/svqe++EPbkTfO
+tDIuUFUaNU52Q3Eg75N3ThVwLofDwR1t3Mu1J9QsVtFSUzpE0nPIxBsFZVpikpzu
+QY0x2+c06lkh1QF612S4ZDnNye2v7UsDSKegmQGA3GWjNq5lWUhPgkvIZfFXHeVZ
+Lgo/bNjR9eUJtGxUAArgFU2HdW23WJZa3W3SAKD0m0i+wzekujbgfIeFlxoVot4u
+olu9rxj5kFDNcFn4J2dHy8egBzp90SxdbBk6ZrV9/ZFvgrG+CJPbFEfxojfHRZ48
+x3evZKiT3/Zpg4Jg8klCNO1aAFSFHBY2kgxc+qatv9s=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFRjCCAy6gAwIBAgIIbYwURrGmCu4wDQYJKoZIhvcNAQEMBQAwQTELMAkGA1UE
+BhMCVVMxFDASBgNVBAoMC0FmZmlybVRydXN0MRwwGgYDVQQDDBNBZmZpcm1UcnVz
+dCBQcmVtaXVtMB4XDTEwMDEyOTE0MTAzNloXDTQwMTIzMTE0MTAzNlowQTELMAkG
+A1UEBhMCVVMxFDASBgNVBAoMC0FmZmlybVRydXN0MRwwGgYDVQQDDBNBZmZpcm1U
+cnVzdCBQcmVtaXVtMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAxBLf
+qV/+Qd3d9Z+K4/as4Tx4mrzY8H96oDMq3I0gW64tb+eT2TZwamjPjlGjhVtnBKAQ
+JG9dKILBl1fYSCkTtuG+kU3fhQxTGJoeJKJPj/CihQvL9Cl/0qRY7iZNyaqoe5rZ
++jjeRFcV5fiMyNlI4g0WJx0eyIOFJbe6qlVBzAMiSy2RjYvmia9mx+n/K+k8rNrS
+s8PhaJyJ+HoAVt70VZVs+7pk3WKL3wt3MutizCaam7uqYoNMtAZ6MMgpv+0GTZe5
+HMQxK9VfvFMSF5yZVylmd2EhMQcuJUmdGPLu8ytxjLW6OQdJd/zvLpKQBY0tL3d7
+70O/Nbua2Plzpyzy0FfuKE4mX4+QaAkvuPjcBukumj5Rp9EixAqnOEhss/n/fauG
+V+O61oV4d7pD6kh/9ti+I20ev9E2bFhc8e6kGVQa9QPSdubhjL08s9NIS+LI+H+S
+qHZGnEJlPqQewQcDWkYtuJfzt9WyVSHvutxMAJf7FJUnM7/oQ0dG0giZFmA7mn7S
+5u046uwBHjxIVkkJx0w3AJ6IDsBz4W9m6XJHMD4Q5QsDyZpCAGzFlH5hxIrff4Ia
+C1nEWTJ3s7xgaVY5/bQGeyzWZDbZvUjthB9+pSKPKrhC9IK31FOQeE4tGv2Bb0TX
+OwF0lkLgAOIua+rF7nKsu7/+6qqo+Nz2snmKtmcCAwEAAaNCMEAwHQYDVR0OBBYE
+FJ3AZ6YMItkm9UWrpmVSESfYRaxjMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/
+BAQDAgEGMA0GCSqGSIb3DQEBDAUAA4ICAQCzV00QYk465KzquByvMiPIs0laUZx2
+KI15qldGF9X1Uva3ROgIRL8YhNILgM3FEv0AVQVhh0HctSSePMTYyPtwni94loMg
+Nt58D2kTiKV1NpgIpsbfrM7jWNa3Pt668+s0QNiigfV4Py/VpfzZotReBA4Xrf5B
+8OWycvpEgjNC6C1Y91aMYj+6QrCcDFx+LmUmXFNPALJ4fqENmS2NuB2OosSw/WDQ
+MKSOyARiqcTtNd56l+0OOF6SL5Nwpamcb6d9Ex1+xghIsV5n61EIJenmJWtSKZGc
+0jlzCFfemQa0W50QBuHCAKi4HEoCChTQwUHK+4w1IX2COPKpVJEZNZOUbWo6xbLQ
+u4mGk+ibyQ86p3q4ofB4Rvr8Ny/lioTz3/4E2aFooC8k4gmVBtWVyuEklut89pMF
+u+1z6S3RdTnX5yTb2E5fQ4+e0BQ5v1VwSJlXMbSc7kqYA5YwH2AG7hsj/oFgIxpH
+YoWlzBk0gG+zrBrjn/B7SK3VAdlntqlyk+otZrWyuOQ9PLLvTIzq6we/qzWaVYa8
+GKa1qF60g2xraUDTn9zxw2lrueFtCfTxqlB2Cnp9ehehVZZCmTEJ3WARjQUwfuaO
+RtGdFNrHF+QFlozEJLUbzxQHskD4o55BhrwE0GuWyCqANP2/7waj3VjFhT0+j/6e
+KeC2uAloGRwYQw==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIB/jCCAYWgAwIBAgIIdJclisc/elQwCgYIKoZIzj0EAwMwRTELMAkGA1UEBhMC
+VVMxFDASBgNVBAoMC0FmZmlybVRydXN0MSAwHgYDVQQDDBdBZmZpcm1UcnVzdCBQ
+cmVtaXVtIEVDQzAeFw0xMDAxMjkxNDIwMjRaFw00MDEyMzExNDIwMjRaMEUxCzAJ
+BgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEgMB4GA1UEAwwXQWZmaXJt
+VHJ1c3QgUHJlbWl1bSBFQ0MwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQNMF4bFZ0D
+0KF5Nbc6PJJ6yhUczWLznCZcBz3lVPqj1swS6vQUX+iOGasvLkjmrBhDeKzQN8O9
+ss0s5kfiGuZjuD0uL3jET9v0D6RoTFVya5UdThhClXjMNzyR4ptlKymjQjBAMB0G
+A1UdDgQWBBSaryl6wBE1NSZRMADDav5A1a7WPDAPBgNVHRMBAf8EBTADAQH/MA4G
+A1UdDwEB/wQEAwIBBjAKBggqhkjOPQQDAwNnADBkAjAXCfOHiFBar8jAQr9HX/Vs
+aobgxCd05DhT1wV/GzTjxi+zygk8N53X57hG8f2h4nECMEJZh0PUUd+60wkyWs6I
+flc9nF9Ca/UHLbXwgpP5WW+uZPpY5Yse42O+tYHNbwKMeQ==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDdzCCAl+gAwIBAgIIXDPLYixfszIwDQYJKoZIhvcNAQELBQAwPDEeMBwGA1UE
+AwwVQXRvcyBUcnVzdGVkUm9vdCAyMDExMQ0wCwYDVQQKDARBdG9zMQswCQYDVQQG
+EwJERTAeFw0xMTA3MDcxNDU4MzBaFw0zMDEyMzEyMzU5NTlaMDwxHjAcBgNVBAMM
+FUF0b3MgVHJ1c3RlZFJvb3QgMjAxMTENMAsGA1UECgwEQXRvczELMAkGA1UEBhMC
+REUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCVhTuXbyo7LjvPpvMp
+Nb7PGKw+qtn4TaA+Gke5vJrf8v7MPkfoepbCJI419KkM/IL9bcFyYie96mvr54rM
+VD6QUM+A1JX76LWC1BTFtqlVJVfbsVD2sGBkWXppzwO3bw2+yj5vdHLqqjAqc2K+
+SZFhyBH+DgMq92og3AIVDV4VavzjgsG1xZ1kCWyjWZgHJ8cblithdHFsQ/H3NYkQ
+4J7sVaE3IqKHBAUsR320HLliKWYoyrfhk/WklAOZuXCFteZI6o1Q/NnezG8HDt0L
+cp2AMBYHlT8oDv3FdU9T1nSatCQujgKRz3bFmx5VdJx4IbHwLfELn8LVlhgf8FQi
+eowHAgMBAAGjfTB7MB0GA1UdDgQWBBSnpQaxLKYJYO7Rl+lwrrw7GWzbITAPBgNV
+HRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFKelBrEspglg7tGX6XCuvDsZbNshMBgG
+A1UdIAQRMA8wDQYLKwYBBAGwLQMEAQEwDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3
+DQEBCwUAA4IBAQAmdzTblEiGKkGdLD4GkGDEjKwLVLgfuXvTBznk+j57sj1O7Z8j
+vZfza1zv7v1Apt+hk6EKhqzvINB5Ab149xnYJDE0BAGmuhWawyfc2E8PzBhj/5kP
+DpFrdRbhIfzYJsdHt6bPWHJxfrrhTZVHO8mvbaG0weyJ9rQPOLXiZNwlz6bb65pc
+maHFCN795trV1lpFDMS3wrUU77QR/w4VtfX128a961qn8FYiqTxlVMYVqL2Gns2D
+lmh6cYGJ4Qvh6hEbaAjMaZ7snkGeRDImeuKHCnE96+RapNLbxc3G3mB/ufNPRJLv
+KrcYPqcZ2Qt9sTdBQrC6YB3y/gkRsPCHe6ed
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDcjCCAlqgAwIBAgIUPopdB+xV0jLVt+O2XwHrLdzk1uQwDQYJKoZIhvcNAQEL
+BQAwUTELMAkGA1UEBhMCUEwxKDAmBgNVBAoMH0tyYWpvd2EgSXpiYSBSb3psaWN6
+ZW5pb3dhIFMuQS4xGDAWBgNVBAMMD1NaQUZJUiBST09UIENBMjAeFw0xNTEwMTkw
+NzQzMzBaFw0zNTEwMTkwNzQzMzBaMFExCzAJBgNVBAYTAlBMMSgwJgYDVQQKDB9L
+cmFqb3dhIEl6YmEgUm96bGljemVuaW93YSBTLkEuMRgwFgYDVQQDDA9TWkFGSVIg
+Uk9PVCBDQTIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC3vD5QqEvN
+QLXOYeeWyrSh2gwisPq1e3YAd4wLz32ohswmUeQgPYUM1ljj5/QqGJ3a0a4m7utT
+3PSQ1hNKDJA8w/Ta0o4NkjrcsbH/ON7Dui1fgLkCvUqdGw+0w8LBZwPd3BucPbOw
+3gAeqDRHu5rr/gsUvTaE2g0gv/pby6kWIK05YO4vdbbnl5z5Pv1+TW9NL++IDWr6
+3fE9biCloBK0TXC5ztdyO4mTp4CEHCdJckm1/zuVnsHMyAHs6A6KCpbns6aH5db5
+BSsNl0BwPLqsdVqc1U2dAgrSS5tmS0YHF2Wtn2yIANwiieDhZNRnvDF5YTy7ykHN
+XGoAyDw4jlivAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQD
+AgEGMB0GA1UdDgQWBBQuFqlKGLXLzPVvUPMjX/hd56zwyDANBgkqhkiG9w0BAQsF
+AAOCAQEAtXP4A9xZWx126aMqe5Aosk3AM0+qmrHUuOQn/6mWmc5G4G18TKI4pAZw
+8PRBEew/R40/cof5O/2kbytTAOD/OblqBw7rHRz2onKQy4I9EYKL0rufKq8h5mOG
+nXkZ7/e7DDWQw4rtTw/1zBLZpD67oPwglV9PJi8RI4NOdQcPv5vRtB3pEAT+ymCP
+oky4rc/hkA/NrgrHXXu3UNLUYfrVFdvXn4dRVOul4+vJhaAlIDf7js4MNIThPIGy
+d05DpYhfhmehPea0XGG2Ptv+tyjFogeutcrKjSoS75ftwjCkySp6+/NNIxuZMzSg
+LvWpCz/UXeHPhJ/iGcJfitYgHuNztw==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIF0jCCA7qgAwIBAgIQIdbQSk8lD8kyN/yqXhKN6TANBgkqhkiG9w0BAQ0FADCB
+gDELMAkGA1UEBhMCUEwxIjAgBgNVBAoTGVVuaXpldG8gVGVjaG5vbG9naWVzIFMu
+QS4xJzAlBgNVBAsTHkNlcnR1bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEkMCIG
+A1UEAxMbQ2VydHVtIFRydXN0ZWQgTmV0d29yayBDQSAyMCIYDzIwMTExMDA2MDgz
+OTU2WhgPMjA0NjEwMDYwODM5NTZaMIGAMQswCQYDVQQGEwJQTDEiMCAGA1UEChMZ
+VW5pemV0byBUZWNobm9sb2dpZXMgUy5BLjEnMCUGA1UECxMeQ2VydHVtIENlcnRp
+ZmljYXRpb24gQXV0aG9yaXR5MSQwIgYDVQQDExtDZXJ0dW0gVHJ1c3RlZCBOZXR3
+b3JrIENBIDIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC9+Xj45tWA
+DGSdhhuWZGc/IjoedQF97/tcZ4zJzFxrqZHmuULlIEub2pt7uZld2ZuAS9eEQCsn
+0+i6MLs+CRqnSZXvK0AkwpfHp+6bJe+oCgCXhVqqndwpyeI1B+twTUrWwbNWuKFB
+OJvR+zF/j+Bf4bE/D44WSWDXBo0Y+aomEKsq09DRZ40bRr5HMNUuctHFY9rnY3lE
+fktjJImGLjQ/KUxSiyqnwOKRKIm5wFv5HdnnJ63/mgKXwcZQkpsCLL2puTRZCr+E
+Sv/f/rOf69me4Jgj7KZrdxYq28ytOxykh9xGc14ZYmhFV+SQgkK7QtbwYeDBoz1m
+o130GO6IyY0XRSmZMnUCMe4pJshrAua1YkV/NxVaI2iJ1D7eTiew8EAMvE0Xy02i
+sx7QBlrd9pPPV3WZ9fqGGmd4s7+W/jTcvedSVuWz5XV710GRBdxdaeOVDUO5/IOW
+OZV7bIBaTxNyxtd9KXpEulKkKtVBRgkg/iKgtlswjbyJDNXXcPiHUv3a76xRLgez
+Tv7QCdpw75j6VuZt27VXS9zlLCUVyJ4ueE742pyehizKV/Ma5ciSixqClnrDvFAS
+adgOWkaLOusm+iPJtrCBvkIApPjW/jAux9JG9uWOdf3yzLnQh1vMBhBgu4M1t15n
+3kfsmUjxpKEV/q2MYo45VU85FrmxY53/twIDAQABo0IwQDAPBgNVHRMBAf8EBTAD
+AQH/MB0GA1UdDgQWBBS2oVQ5AsOgP46KvPrU+Bym0ToO/TAOBgNVHQ8BAf8EBAMC
+AQYwDQYJKoZIhvcNAQENBQADggIBAHGlDs7k6b8/ONWJWsQCYftMxRQXLYtPU2sQ
+F/xlhMcQSZDe28cmk4gmb3DWAl45oPePq5a1pRNcgRRtDoGCERuKTsZPpd1iHkTf
+CVn0W3cLN+mLIMb4Ck4uWBzrM9DPhmDJ2vuAL55MYIR4PSFk1vtBHxgP58l1cb29
+XN40hz5BsA72udY/CROWFC/emh1auVbONTqwX3BNXuMp8SMoclm2q8KMZiYcdywm
+djWLKKdpoPk79SPdhRB0yZADVpHnr7pH1BKXESLjokmUbOe3lEu6LaTaM4tMpkT/
+WjzGHWTYtTHkpjx6qFcL2+1hGsvxznN3Y6SHb0xRONbkX8eftoEq5IVIeVheO/jb
+AoJnwTnbw3RLPTYe+SmTiGhbqEQZIfCn6IENLOiTNrQ3ssqwGyZ6miUfmpqAnksq
+P/ujmv5zMnHCnsZy4YpoJ/HkD7TETKVhk/iXEAcqMCWpuchxuO9ozC1+9eB+D4Ko
+b7a6bINDd82Kkhehnlt4Fj1F4jNy3eFmypnTycUm/Q1oBEauttmbjL4ZvrHG8hnj
+XALKLNhvSgfZyTXaQHXyxKcZb55CEJh15pWLYLztxRLXis7VmFxWlgPF7ncGNf/P
+5O4/E2Hu29othfDNrp2yGAlFw5Khchf8R7agCyzxxN5DaAhqXzvwdmP7zAYspsbi
+DrW5viSP
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFWTCCA0GgAwIBAgIBAjANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJOTzEd
+MBsGA1UECgwUQnV5cGFzcyBBUy05ODMxNjMzMjcxIDAeBgNVBAMMF0J1eXBhc3Mg
+Q2xhc3MgMyBSb290IENBMB4XDTEwMTAyNjA4Mjg1OFoXDTQwMTAyNjA4Mjg1OFow
+TjELMAkGA1UEBhMCTk8xHTAbBgNVBAoMFEJ1eXBhc3MgQVMtOTgzMTYzMzI3MSAw
+HgYDVQQDDBdCdXlwYXNzIENsYXNzIDMgUm9vdCBDQTCCAiIwDQYJKoZIhvcNAQEB
+BQADggIPADCCAgoCggIBAKXaCpUWUOOV8l6ddjEGMnqb8RB2uACatVI2zSRHsJ8Y
+ZLya9vrVediQYkwiL944PdbgqOkcLNt4EemOaFEVcsfzM4fkoF0LXOBXByow9c3E
+N3coTRiR5r/VUv1xLXA+58bEiuPwKAv0dpihi4dVsjoT/Lc+JzeOIuOoTyrvYLs9
+tznDDgFHmV0ST9tD+leh7fmdvhFHJlsTmKtdFoqwNxxXnUX/iJY2v7vKB3tvh2PX
+0DJq1l1sDPGzbjniazEuOQAnFN44wOwZZoYS6J1yFhNkUsepNxz9gjDthBgd9K5c
+/3ATAOux9TN6S9ZV+AWNS2mw9bMoNlwUxFFzTWsL8TQH2xc519woe2v1n/MuwU8X
+KhDzzMro6/1rqy6any2CbgTUUgGTLT2G/H783+9CHaZr77kgxve9oKeV/afmiSTY
+zIw0bOIjL9kSGiG5VZFvC5F5GQytQIgLcOJ60g7YaEi7ghM5EFjp2CoHxhLbWNvS
+O1UQRwUVZ2J+GGOmRj8JDlQyXr8NYnon74Do29lLBlo3WiXQCBJ31G8JUJc9yB3D
+34xFMFbG02SrZvPAXpacw8Tvw3xrizp5f7NJzz3iiZ+gMEuFuZyUJHmPfWupRWgP
+K9Dx2hzLabjKSWJtyNBjYt1gD1iqj6G8BaVmos8bdrKEZLFMOVLAMLrwjEsCsLa3
+AgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFEe4zf/lb+74suwv
+Tg75JbCOPGvDMA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAgEAACAj
+QTUEkMJAYmDv4jVM1z+s4jSQuKFvdvoWFqRINyzpkMLyPPgKn9iB5btb2iUspKdV
+cSQy9sgL8rxq+JOssgfCX5/bzMiKqr5qb+FJEMwx14C7u8jYog5kV+qi9cKpMRXS
+IGrs/CIBKM+GuIAeqcwRpTzyFrNHnfzSgCHEy9BHcEGhyoMZCCxt8l13nIoUE9Q2
+HJLw5QY33KbmkJs4j1xrG0aGQ0JfPgEHU1RdZX33inOhmlRaHylDFCfChQ+1iHsa
+O5S3HWCntZznKWlXWpuTekMwGwPXYshApqr8ZORK15FTAaggiG6cX0S5y2CBNOxv
+033aSF/rtJC8LakcC6wc1aJoIIAE1vyxjy+7SjENSoYc6+I2KSb12tjE8nVhz36u
+dmNKekBlk4f4HoCMhuWG1o8O/FMsYOgWYRqiPkN7zTlgVGr18okmAWiDSKIz6MkE
+kbIRNBE+6tBDGR8Dk5AM/1E9V/RBbuHLoL7ryWPNbczk+DaqaJ3tvV2XcEQNtg41
+3OEMXbugUZTLfhbrES+jkkXITHHZvMmZUldGL1DPvTVp9D0VzgalLA8+9oG6lLvD
+u79leNKGef9JOxqDDPDeeOzI8k1MGt6CKfjBWtrt7uYnXuhF0J0cUahoq0Tj0Itq
+4/g7u9xN12TyUb7mqqta6THuBrxzvxNiCp/HuZc=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFjTCCA3WgAwIBAgIEGErM1jANBgkqhkiG9w0BAQsFADBWMQswCQYDVQQGEwJD
+TjEwMC4GA1UECgwnQ2hpbmEgRmluYW5jaWFsIENlcnRpZmljYXRpb24gQXV0aG9y
+aXR5MRUwEwYDVQQDDAxDRkNBIEVWIFJPT1QwHhcNMTIwODA4MDMwNzAxWhcNMjkx
+MjMxMDMwNzAxWjBWMQswCQYDVQQGEwJDTjEwMC4GA1UECgwnQ2hpbmEgRmluYW5j
+aWFsIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MRUwEwYDVQQDDAxDRkNBIEVWIFJP
+T1QwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDXXWvNED8fBVnVBU03
+sQ7smCuOFR36k0sXgiFxEFLXUWRwFsJVaU2OFW2fvwwbwuCjZ9YMrM8irq93VCpL
+TIpTUnrD7i7es3ElweldPe6hL6P3KjzJIx1qqx2hp/Hz7KDVRM8Vz3IvHWOX6Jn5
+/ZOkVIBMUtRSqy5J35DNuF++P96hyk0g1CXohClTt7GIH//62pCfCqktQT+x8Rgp
+7hZZLDRJGqgG16iI0gNyejLi6mhNbiyWZXvKWfry4t3uMCz7zEasxGPrb382KzRz
+EpR/38wmnvFyXVBlWY9ps4deMm/DGIq1lY+wejfeWkU7xzbh72fROdOXW3NiGUgt
+hxwG+3SYIElz8AXSG7Ggo7cbcNOIabla1jj0Ytwli3i/+Oh+uFzJlU9fpy25IGvP
+a931DfSCt/SyZi4QKPaXWnuWFo8BGS1sbn85WAZkgwGDg8NNkt0yxoekN+kWzqot
+aK8KgWU6cMGbrU1tVMoqLUuFG7OA5nBFDWteNfB/O7ic5ARwiRIlk9oKmSJgamNg
+TnYGmE69g60dWIolhdLHZR4tjsbftsbhf4oEIRUpdPA+nJCdDC7xij5aqgwJHsfV
+PKPtl8MeNPo4+QgO48BdK4PRVmrJtqhUUy54Mmc9gn900PvhtgVguXDbjgv5E1hv
+cWAQUhC5wUEJ73IfZzF4/5YFjQIDAQABo2MwYTAfBgNVHSMEGDAWgBTj/i39KNAL
+tbq2osS/BqoFjJP7LzAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAd
+BgNVHQ4EFgQU4/4t/SjQC7W6tqLEvwaqBYyT+y8wDQYJKoZIhvcNAQELBQADggIB
+ACXGumvrh8vegjmWPfBEp2uEcwPenStPuiB/vHiyz5ewG5zz13ku9Ui20vsXiObT
+ej/tUxPQ4i9qecsAIyjmHjdXNYmEwnZPNDatZ8POQQaIxffu2Bq41gt/UP+TqhdL
+jOztUmCypAbqTuv0axn96/Ua4CUqmtzHQTb3yHQFhDmVOdYLO6Qn+gjYXB74BGBS
+ESgoA//vU2YApUo0FmZ8/Qmkrp5nGm9BC2sGE5uPhnEFtC+NiWYzKXZUmhH4J/qy
+P5Hgzg0b8zAarb8iXRvTvyUFTeGSGn+ZnzxEk8rUQElsgIfXBDrDMlI1Dlb4pd19
+xIsNER9Tyx6yF7Zod1rg1MvIB671Oi6ON7fQAUtDKXeMOZePglr4UeWJoBjnaH9d
+Ci77o0cOPaYjesYBx4/IXr9tgFa+iiS6M+qf4TIRnvHST4D2G0CvOJ4RUHlzEhLN
+5mydLIhyPDCBBpEi6lmt2hkuIsKNuYyH4Ga8cyNfIWRjgEj1oDwYPZTISEEdQLpe
+/v5WOaHIz16eGWRGENoXkbcFgKyLmZJ956LYBws2J+dIeWCKw9cTXPhyQN9Ky8+Z
+AAoACxGV2lZFA4gKn2fQ1XmxqI1AbQ3CekD6819kR5LLU7m7Wc5P/dAVUwHY3+vZ
+5nbv0CO7O6l5s9UCKc2Jo5YPSjXnTkLAdc0Hz+Ys63su
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFWTCCA0GgAwIBAgIBAjANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJOTzEd
+MBsGA1UECgwUQnV5cGFzcyBBUy05ODMxNjMzMjcxIDAeBgNVBAMMF0J1eXBhc3Mg
+Q2xhc3MgMiBSb290IENBMB4XDTEwMTAyNjA4MzgwM1oXDTQwMTAyNjA4MzgwM1ow
+TjELMAkGA1UEBhMCTk8xHTAbBgNVBAoMFEJ1eXBhc3MgQVMtOTgzMTYzMzI3MSAw
+HgYDVQQDDBdCdXlwYXNzIENsYXNzIDIgUm9vdCBDQTCCAiIwDQYJKoZIhvcNAQEB
+BQADggIPADCCAgoCggIBANfHXvfBB9R3+0Mh9PT1aeTuMgHbo4Yf5FkNuud1g1Lr
+6hxhFUi7HQfKjK6w3Jad6sNgkoaCKHOcVgb/S2TwDCo3SbXlzwx87vFKu3MwZfPV
+L4O2fuPn9Z6rYPnT8Z2SdIrkHJasW4DptfQxh6NR/Md+oW+OU3fUl8FVM5I+GC91
+1K2GScuVr1QGbNgGE41b/+EmGVnAJLqBcXmQRFBoJJRfuLMR8SlBYaNByyM21cHx
+MlAQTn/0hpPshNOOvEu/XAFOBz3cFIqUCqTqc/sLUegTBxj6DvEr0VQVfTzh97QZ
+QmdiXnfgolXsttlpF9U6r0TtSsWe5HonfOV116rLJeffawrbD02TTqigzXsu8lkB
+arcNuAeBfos4GzjmCleZPe4h6KP1DBbdi+w0jpwqHAAVF41og9JwnxgIzRFo1clr
+Us3ERo/ctfPYV3Me6ZQ5BL/T3jjetFPsaRyifsSP5BtwrfKi+fv3FmRmaZ9JUaLi
+FRhnBkp/1Wy1TbMz4GHrXb7pmA8y1x1LPC5aAVKRCfLf6o3YBkBjqhHk/sM3nhRS
+P/TizPJhk9H9Z2vXUq6/aKtAQ6BXNVN48FP4YUIHZMbXb5tMOA1jrGKvNouicwoN
+9SG9dKpN6nIDSdvHXx1iY8f93ZHsM+71bbRuMGjeyNYmsHVee7QHIJihdjK4TWxP
+AgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFMmAd+BikoL1Rpzz
+uvdMw964o605MA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAgEAU18h
+9bqwOlI5LJKwbADJ784g7wbylp7ppHR/ehb8t/W2+xUbP6umwHJdELFx7rxP462s
+A20ucS6vxOOto70MEae0/0qyexAQH6dXQbLArvQsWdZHEIjzIVEpMMpghq9Gqx3t
+OluwlN5E40EIosHsHdb9T7bWR9AUC8rmyrV7d35BH16Dx7aMOZawP5aBQW9gkOLo
++fsicdl9sz1Gv7SEr5AcD48Saq/v7h56rgJKihcrdv6sVIkkLE8/trKnToyokZf7
+KcZ7XC25y2a2t6hbElGFtQl+Ynhw/qlqYLYdDnkM/crqJIByw5c/8nerQyIKx+u2
+DISCLIBrQYoIwOula9+ZEsuK1V6ADJHgJgg2SMX6OBE1/yWDLfJ6v9r9jv6ly0Us
+H8SIU653DtmadsWOLB2jutXsMq7Aqqz30XpN69QH4kj3Io6wpJ9qzo6ysmD0oyLQ
+I+uUWnpp3Q+/QFesa1lQ2aOZ4W7+jQF5JyMV3pKdewlNWudLSDBaGOYKbeaP4NK7
+5t98biGCwWg5TbSYWGZizEqQXsP6JwSxeRV0mcy+rSDeJmAc61ZRpqPq5KM/p/9h
+3PFaTWwyI0PurKju7koSCTxdccK+efrCh2gdC/1cacwG0Jp9VJkqyTkaGa9LKkPz
+Y11aWOIv4x3kqdbQCtCev9eBCfHJxyYNrJgWVqA=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFzzCCA7egAwIBAgIUCBZfikyl7ADJk0DfxMauI7gcWqQwDQYJKoZIhvcNAQEL
+BQAwbzELMAkGA1UEBhMCSEsxEjAQBgNVBAgTCUhvbmcgS29uZzESMBAGA1UEBxMJ
+SG9uZyBLb25nMRYwFAYDVQQKEw1Ib25na29uZyBQb3N0MSAwHgYDVQQDExdIb25n
+a29uZyBQb3N0IFJvb3QgQ0EgMzAeFw0xNzA2MDMwMjI5NDZaFw00MjA2MDMwMjI5
+NDZaMG8xCzAJBgNVBAYTAkhLMRIwEAYDVQQIEwlIb25nIEtvbmcxEjAQBgNVBAcT
+CUhvbmcgS29uZzEWMBQGA1UEChMNSG9uZ2tvbmcgUG9zdDEgMB4GA1UEAxMXSG9u
+Z2tvbmcgUG9zdCBSb290IENBIDMwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK
+AoICAQCziNfqzg8gTr7m1gNt7ln8wlffKWihgw4+aMdoWJwcYEuJQwy51BWy7sFO
+dem1p+/l6TWZ5Mwc50tfjTMwIDNT2aa71T4Tjukfh0mtUC1Qyhi+AViiE3CWu4mI
+VoBc+L0sPOFMV4i707mV78vH9toxdCim5lSJ9UExyuUmGs2C4HDaOym71QP1mbpV
+9WTRYA6ziUm4ii8F0oRFKHyPaFASePwLtVPLwpgchKOesL4jpNrcyCse2m5FHomY
+2vkALgbpDDtw1VAliJnLzXNg99X/NWfFobxeq81KuEXryGgeDQ0URhLj0mRiikKY
+vLTGCAj4/ahMZJx2Ab0vqWwzD9g/KLg8aQFChn5pwckGyuV6RmXpwtZQQS4/t+Tt
+bNe/JgERohYpSms0BpDsE9K2+2p20jzt8NYt3eEV7KObLyzJPivkaTv/ciWxNoZb
+x39ri1UbSsUgYT2uy1DhCDq+sI9jQVMwCFk8mB13umOResoQUGC/8Ne8lYePl8X+
+l2oBlKN8W4UdKjk60FSh0Tlxnf0h+bV78OLgAo9uliQlLKAeLKjEiafv7ZkGL7YK
+TE/bosw3Gq9HhS2KX8Q0NEwA/RiTZxPRN+ZItIsGxVd7GYYKecsAyVKvQv83j+Gj
+Hno9UKtjBucVtT+2RTeUN7F+8kjDf8V1/peNRY8apxpyKBpADwIDAQABo2MwYTAP
+BgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAfBgNVHSMEGDAWgBQXnc0e
+i9Y5K3DTXNSguB+wAPzFYTAdBgNVHQ4EFgQUF53NHovWOStw01zUoLgfsAD8xWEw
+DQYJKoZIhvcNAQELBQADggIBAFbVe27mIgHSQpsY1Q7XZiNc4/6gx5LS6ZStS6LG
+7BJ8dNVI0lkUmcDrudHr9EgwW62nV3OZqdPlt9EuWSRY3GguLmLYauRwCy0gUCCk
+MpXRAJi70/33MvJJrsZ64Ee+bs7Lo3I6LWldy8joRTnU+kLBEUx3XZL7av9YROXr
+gZ6voJmtvqkBZss4HTzfQx/0TW60uhdG/H39h4F5ag0zD/ov+BS5gLNdTaqX4fnk
+GMX41TiMJjz98iji7lpJiCzfeT2OnpA8vUFKOt1b9pq0zj8lMH8yfaIDlNDceqFS
+3m6TjRgm/VWsvY+b0s+v54Ysyx8Jb6NvqYTUc79NoXQbTiNg8swOqn+knEwlqLJm
+Ozj/2ZQw9nKEvmhVEA/GcywWaZMH/rFF7buiVWqw2rVKAiUnhde3t4ZEFolsgCs+
+l6mc1X5VTMbeRRAc6uk7nwNT7u56AQIWeNTowr5GdogTPyK7SBIdUgC0An4hGh6c
+JfTzPV4e0hz5sy229zdcxsshTrD3mUcYhcErulWuBurQB7Lcq9CClnXO0lD+mefP
+L5/ndtFhKvshuzHQqp9HpLIiyhY6UFfEW0NnxWViA0kB60PZ2Pierc+xYw5F9KBa
+LJstxabArahH9CdMOA0uG0k7UvToiIMrVCjU8jVStDKDYmlkDJGcn5fqdBb9HxEG
+mpv0
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFojCCA4qgAwIBAgIUAZQwHqIL3fXFMyqxQ0Rx+NZQTQ0wDQYJKoZIhvcNAQEM
+BQAwaTELMAkGA1UEBhMCS1IxJjAkBgNVBAoMHU5BVkVSIEJVU0lORVNTIFBMQVRG
+T1JNIENvcnAuMTIwMAYDVQQDDClOQVZFUiBHbG9iYWwgUm9vdCBDZXJ0aWZpY2F0
+aW9uIEF1dGhvcml0eTAeFw0xNzA4MTgwODU4NDJaFw0zNzA4MTgyMzU5NTlaMGkx
+CzAJBgNVBAYTAktSMSYwJAYDVQQKDB1OQVZFUiBCVVNJTkVTUyBQTEFURk9STSBD
+b3JwLjEyMDAGA1UEAwwpTkFWRVIgR2xvYmFsIFJvb3QgQ2VydGlmaWNhdGlvbiBB
+dXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC21PGTXLVA
+iQqrDZBbUGOukJR0F0Vy1ntlWilLp1agS7gvQnXp2XskWjFlqxcX0TM62RHcQDaH
+38dq6SZeWYp34+hInDEW+j6RscrJo+KfziFTowI2MMtSAuXaMl3Dxeb57hHHi8lE
+HoSTGEq0n+USZGnQJoViAbbJAh2+g1G7XNr4rRVqmfeSVPc0W+m/6imBEtRTkZaz
+kVrd/pBzKPswRrXKCAfHcXLJZtM0l/aM9BhK4dA9WkW2aacp+yPOiNgSnABIqKYP
+szuSjXEOdMWLyEz59JuOuDxp7W87UC9Y7cSw0BwbagzivESq2M0UXZR4Yb8Obtoq
+vC8MC3GmsxY/nOb5zJ9TNeIDoKAYv7vxvvTWjIcNQvcGufFt7QSUqP620wbGQGHf
+nZ3zVHbOUzoBppJB7ASjjw2i1QnK1sua8e9DXcCrpUHPXFNwcMmIpi3Ua2FzUCaG
+YQ5fG8Ir4ozVu53BA0K6lNpfqbDKzE0K70dpAy8i+/Eozr9dUGWokG2zdLAIx6yo
+0es+nPxdGoMuK8u180SdOqcXYZaicdNwlhVNt0xz7hlcxVs+Qf6sdWA7G2POAN3a
+CJBitOUt7kinaxeZVL6HSuOpXgRM6xBtVNbv8ejyYhbLgGvtPe31HzClrkvJE+2K
+AQHJuFFYwGY6sWZLxNUxAmLpdIQM201GLQIDAQABo0IwQDAdBgNVHQ4EFgQU0p+I
+36HNLL3s9TsBAZMzJ7LrYEswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMB
+Af8wDQYJKoZIhvcNAQEMBQADggIBADLKgLOdPVQG3dLSLvCkASELZ0jKbY7gyKoN
+qo0hV4/GPnrK21HUUrPUloSlWGB/5QuOH/XcChWB5Tu2tyIvCZwTFrFsDDUIbatj
+cu3cvuzHV+YwIHHW1xDBE1UBjCpD5EHxzzp6U5LOogMFDTjfArsQLtk70pt6wKGm
++LUx5vR1yblTmXVHIloUFcd4G7ad6Qz4G3bxhYTeodoS76TiEJd6eN4MUZeoIUCL
+hr0N8F5OSza7OyAfikJW4Qsav3vQIkMsRIz75Sq0bBwcupTgE34h5prCy8VCZLQe
+lHsIJchxzIdFV4XTnyliIoNRlwAYl3dqmJLJfGBs32x9SuRwTMKeuB330DTHD8z7
+p/8Dvq1wkNoL3chtl1+afwkyQf3NosxabUzyqkn+Zvjp2DXrDige7kgvOtB5CTh8
+piKCk5XQA76+AqAF3SAi428diDRgxuYKuQl1C/AH6GmWNcf7I4GOODm4RStDeKLR
+LBT/DShycpWbXgnbiUSYqqFJu3FS8r/2/yehNq+4tneI3TqkbZs0kNwUXTC/t+sX
+5Ie3cdCh13cV1ELX8vMxmV2b3RZtP+oGI/hGoiLtk/bdmuYqh7GYVPEi92tF4+KO
+dh2ajcQGjTa3FPOdVGm3jjzVpG2Tgbet9r1ke8LJaDmgkpzNNIaRkPpkUZ3+/uul
+9XXeifdy
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDdzCCAl+gAwIBAgIEAgAAuTANBgkqhkiG9w0BAQUFADBaMQswCQYDVQQGEwJJ
+RTESMBAGA1UEChMJQmFsdGltb3JlMRMwEQYDVQQLEwpDeWJlclRydXN0MSIwIAYD
+VQQDExlCYWx0aW1vcmUgQ3liZXJUcnVzdCBSb290MB4XDTAwMDUxMjE4NDYwMFoX
+DTI1MDUxMjIzNTkwMFowWjELMAkGA1UEBhMCSUUxEjAQBgNVBAoTCUJhbHRpbW9y
+ZTETMBEGA1UECxMKQ3liZXJUcnVzdDEiMCAGA1UEAxMZQmFsdGltb3JlIEN5YmVy
+VHJ1c3QgUm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKMEuyKr
+mD1X6CZymrV51Cni4eiVgLGw41uOKymaZN+hXe2wCQVt2yguzmKiYv60iNoS6zjr
+IZ3AQSsBUnuId9Mcj8e6uYi1agnnc+gRQKfRzMpijS3ljwumUNKoUMMo6vWrJYeK
+mpYcqWe4PwzV9/lSEy/CG9VwcPCPwBLKBsua4dnKM3p31vjsufFoREJIE9LAwqSu
+XmD+tqYF/LTdB1kC1FkYmGP1pWPgkAx9XbIGevOF6uvUA65ehD5f/xXtabz5OTZy
+dc93Uk3zyZAsuT3lySNTPx8kmCFcB5kpvcY67Oduhjprl3RjM71oGDHweI12v/ye
+jl0qhqdNkNwnGjkCAwEAAaNFMEMwHQYDVR0OBBYEFOWdWTCCR1jMrPoIVDaGezq1
+BE3wMBIGA1UdEwEB/wQIMAYBAf8CAQMwDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3
+DQEBBQUAA4IBAQCFDF2O5G9RaEIFoN27TyclhAO992T9Ldcw46QQF+vaKSm2eT92
+9hkTI7gQCvlYpNRhcL0EYWoSihfVCr3FvDB81ukMJY2GQE/szKN+OMY3EU/t3Wgx
+jkzSswF07r51XgdIGn9w/xZchMB5hbgF/X++ZRGjD8ACtPhSNzkE1akxehi/oCr0
+Epn3o0WC4zxe9Z2etciefC7IpJ5OCBRLbf1wbWsaY71k5h+3zvDyny67G7fyUIhz
+ksLi4xaNmjICq44Y3ekQEe5+NauQrz4wlHrQMz2nZQ/1/I6eYs9HRCwBXbsdtTLS
+R9I4LtD+gdwyah617jzV/OeBHRnDJELqYzmp
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDtzCCAp+gAwIBAgIQDOfg5RfYRv6P5WD8G/AwOTANBgkqhkiG9w0BAQUFADBl
+MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
+d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJv
+b3QgQ0EwHhcNMDYxMTEwMDAwMDAwWhcNMzExMTEwMDAwMDAwWjBlMQswCQYDVQQG
+EwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNl
+cnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJvb3QgQ0EwggEi
+MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCtDhXO5EOAXLGH87dg+XESpa7c
+JpSIqvTO9SA5KFhgDPiA2qkVlTJhPLWxKISKityfCgyDF3qPkKyK53lTXDGEKvYP
+mDI2dsze3Tyoou9q+yHyUmHfnyDXH+Kx2f4YZNISW1/5WBg1vEfNoTb5a3/UsDg+
+wRvDjDPZ2C8Y/igPs6eD1sNuRMBhNZYW/lmci3Zt1/GiSw0r/wty2p5g0I6QNcZ4
+VYcgoc/lbQrISXwxmDNsIumH0DJaoroTghHtORedmTpyoeb6pNnVFzF1roV9Iq4/
+AUaG9ih5yLHa5FcXxH4cDrC0kqZWs72yl+2qp/C3xag/lRbQ/6GW6whfGHdPAgMB
+AAGjYzBhMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQW
+BBRF66Kv9JLLgjEtUYunpyGd823IDzAfBgNVHSMEGDAWgBRF66Kv9JLLgjEtUYun
+pyGd823IDzANBgkqhkiG9w0BAQUFAAOCAQEAog683+Lt8ONyc3pklL/3cmbYMuRC
+dWKuh+vy1dneVrOfzM4UKLkNl2BcEkxY5NM9g0lFWJc1aRqoR+pWxnmrEthngYTf
+fwk8lOa4JiwgvT2zKIn3X/8i4peEH+ll74fg38FnSbNd67IJKusm7Xi+fT8r87cm
+NW1fiQG2SVufAQWbqz0lwcy2f8Lxb4bG+mRo64EtlOtCt/qMHt1i8b5QZ7dsvfPx
+H2sMNgcWfzd8qVttevESRmCD1ycEvkvOl77DZypoEd+A5wwzZr8TDRRu838fYxAe
++o0bJW1sj6W3YQGx0qMmoRBxna3iw/nDmVG3KwcIzi7mULKn+gpFL6Lw8g==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDljCCAn6gAwIBAgIQC5McOtY5Z+pnI7/Dr5r0SzANBgkqhkiG9w0BAQsFADBl
+MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
+d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJv
+b3QgRzIwHhcNMTMwODAxMTIwMDAwWhcNMzgwMTE1MTIwMDAwWjBlMQswCQYDVQQG
+EwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNl
+cnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJvb3QgRzIwggEi
+MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDZ5ygvUj82ckmIkzTz+GoeMVSA
+n61UQbVH35ao1K+ALbkKz3X9iaV9JPrjIgwrvJUXCzO/GU1BBpAAvQxNEP4Htecc
+biJVMWWXvdMX0h5i89vqbFCMP4QMls+3ywPgym2hFEwbid3tALBSfK+RbLE4E9Hp
+EgjAALAcKxHad3A2m67OeYfcgnDmCXRwVWmvo2ifv922ebPynXApVfSr/5Vh88lA
+bx3RvpO704gqu52/clpWcTs/1PPRCv4o76Pu2ZmvA9OPYLfykqGxvYmJHzDNw6Yu
+YjOuFgJ3RFrngQo8p0Quebg/BLxcoIfhG69Rjs3sLPr4/m3wOnyqi+RnlTGNAgMB
+AAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgGGMB0GA1UdDgQW
+BBTOw0q5mVXyuNtgv6l+vVa1lzan1jANBgkqhkiG9w0BAQsFAAOCAQEAyqVVjOPI
+QW5pJ6d1Ee88hjZv0p3GeDgdaZaikmkuOGybfQTUiaWxMTeKySHMq2zNixya1r9I
+0jJmwYrA8y8678Dj1JGG0VDjA9tzd29KOVPt3ibHtX2vK0LRdWLjSisCx1BL4Gni
+lmwORGYQRI+tBev4eaymG+g3NJ1TyWGqolKvSnAWhsI6yLETcDbYz+70CjTVW0z9
+B5yiutkBclzzTcHdDrEcDcRjvq30FPuJ7KJBDkzMyFdA0G4Dqs0MjomZmWzwPDCv
+ON9vvKO+KSAnq3T/EyJ43pdSVR6DtVQgA+6uwE9W3jfMw3+qBCe703e4YtsXfJwo
+IhNzbM8m9Yop5w==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICRjCCAc2gAwIBAgIQC6Fa+h3foLVJRK/NJKBs7DAKBggqhkjOPQQDAzBlMQsw
+CQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cu
+ZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJvb3Qg
+RzMwHhcNMTMwODAxMTIwMDAwWhcNMzgwMTE1MTIwMDAwWjBlMQswCQYDVQQGEwJV
+UzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQu
+Y29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJvb3QgRzMwdjAQBgcq
+hkjOPQIBBgUrgQQAIgNiAAQZ57ysRGXtzbg/WPuNsVepRC0FFfLvC/8QdJ+1YlJf
+Zn4f5dwbRXkLzMZTCp2NXQLZqVneAlr2lSoOjThKiknGvMYDOAdfVdp+CW7if17Q
+RSAPWXYQ1qAk8C3eNvJsKTmjQjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/
+BAQDAgGGMB0GA1UdDgQWBBTL0L2p4ZgFUaFNN6KDec6NHSrkhDAKBggqhkjOPQQD
+AwNnADBkAjAlpIFFAmsSS3V0T8gj43DydXLefInwz5FyYZ5eEJJZVrmDxxDnOOlY
+JjZ91eQ0hjkCMHw2U/Aw5WJjOpnitqM7mzT6HtoQknFekROn3aRukswy1vUhZscv
+6pZjamVFkpUBtA==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDrzCCApegAwIBAgIQCDvgVpBCRrGhdWrJWZHHSjANBgkqhkiG9w0BAQUFADBh
+MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
+d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD
+QTAeFw0wNjExMTAwMDAwMDBaFw0zMTExMTAwMDAwMDBaMGExCzAJBgNVBAYTAlVT
+MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j
+b20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IENBMIIBIjANBgkqhkiG
+9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4jvhEXLeqKTTo1eqUKKPC3eQyaKl7hLOllsB
+CSDMAZOnTjC3U/dDxGkAV53ijSLdhwZAAIEJzs4bg7/fzTtxRuLWZscFs3YnFo97
+nh6Vfe63SKMI2tavegw5BmV/Sl0fvBf4q77uKNd0f3p4mVmFaG5cIzJLv07A6Fpt
+43C/dxC//AH2hdmoRBBYMql1GNXRor5H4idq9Joz+EkIYIvUX7Q6hL+hqkpMfT7P
+T19sdl6gSzeRntwi5m3OFBqOasv+zbMUZBfHWymeMr/y7vrTC0LUq7dBMtoM1O/4
+gdW7jVg/tRvoSSiicNoxBN33shbyTApOB6jtSj1etX+jkMOvJwIDAQABo2MwYTAO
+BgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUA95QNVbR
+TLtm8KPiGxvDl7I90VUwHwYDVR0jBBgwFoAUA95QNVbRTLtm8KPiGxvDl7I90VUw
+DQYJKoZIhvcNAQEFBQADggEBAMucN6pIExIK+t1EnE9SsPTfrgT1eXkIoyQY/Esr
+hMAtudXH/vTBH1jLuG2cenTnmCmrEbXjcKChzUyImZOMkXDiqw8cvpOp/2PV5Adg
+06O/nVsJ8dWO41P0jmP6P6fbtGbfYmbW0W5BjfIttep3Sp+dWOIrWcBAI+0tKIJF
+PnlUkiaY4IBIqDfv8NZ5YBberOgOzW6sRBc4L0na4UU+Krk2U886UAb3LujEV0ls
+YSEY1QSteDwsOoBrp+uvFRTp2InBuThs4pFsiv9kuXclVzDAGySj4dzp30d8tbQk
+CAUw7C29C79Fv1C5qfPrmAESrciIxpg0X40KPMbp1ZWVbd4=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDjjCCAnagAwIBAgIQAzrx5qcRqaC7KGSxHQn65TANBgkqhkiG9w0BAQsFADBh
+MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
+d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBH
+MjAeFw0xMzA4MDExMjAwMDBaFw0zODAxMTUxMjAwMDBaMGExCzAJBgNVBAYTAlVT
+MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j
+b20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IEcyMIIBIjANBgkqhkiG
+9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuzfNNNx7a8myaJCtSnX/RrohCgiN9RlUyfuI
+2/Ou8jqJkTx65qsGGmvPrC3oXgkkRLpimn7Wo6h+4FR1IAWsULecYxpsMNzaHxmx
+1x7e/dfgy5SDN67sH0NO3Xss0r0upS/kqbitOtSZpLYl6ZtrAGCSYP9PIUkY92eQ
+q2EGnI/yuum06ZIya7XzV+hdG82MHauVBJVJ8zUtluNJbd134/tJS7SsVQepj5Wz
+tCO7TG1F8PapspUwtP1MVYwnSlcUfIKdzXOS0xZKBgyMUNGPHgm+F6HmIcr9g+UQ
+vIOlCsRnKPZzFBQ9RnbDhxSJITRNrw9FDKZJobq7nMWxM4MphQIDAQABo0IwQDAP
+BgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAdBgNVHQ4EFgQUTiJUIBiV
+5uNu5g/6+rkS7QYXjzkwDQYJKoZIhvcNAQELBQADggEBAGBnKJRvDkhj6zHd6mcY
+1Yl9PMWLSn/pvtsrF9+wX3N3KjITOYFnQoQj8kVnNeyIv/iPsGEMNKSuIEyExtv4
+NeF22d+mQrvHRAiGfzZ0JFrabA0UWTW98kndth/Jsw1HKj2ZL7tcu7XUIOGZX1NG
+Fdtom/DzMNU+MeKNhJ7jitralj41E6Vf8PlwUHBHQRFXGU7Aj64GxJUTFy8bJZ91
+8rGOmaFvE7FBcf6IKshPECBV1/MUReXgRPTqh5Uykw7+U0b6LJ3/iyK5S9kJRaTe
+pLiaWN0bfVKfjllDiIGknibVb63dDcY3fe0Dkhvld1927jyNxF1WW6LZZm6zNTfl
+MrY=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICPzCCAcWgAwIBAgIQBVVWvPJepDU1w6QP1atFcjAKBggqhkjOPQQDAzBhMQsw
+CQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cu
+ZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBHMzAe
+Fw0xMzA4MDExMjAwMDBaFw0zODAxMTUxMjAwMDBaMGExCzAJBgNVBAYTAlVTMRUw
+EwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20x
+IDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IEczMHYwEAYHKoZIzj0CAQYF
+K4EEACIDYgAE3afZu4q4C/sLfyHS8L6+c/MzXRq8NOrexpu80JX28MzQC7phW1FG
+fp4tn+6OYwwX7Adw9c+ELkCDnOg/QW07rdOkFFk2eJ0DQ+4QE2xy3q6Ip6FrtUPO
+Z9wj/wMco+I+o0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAd
+BgNVHQ4EFgQUs9tIpPmhxdiuNkHMEWNpYim8S8YwCgYIKoZIzj0EAwMDaAAwZQIx
+AK288mw/EkrRLTnDCgmXc/SINoyIJ7vmiI1Qhadj+Z4y3maTD/HMsQmP3Wyr+mt/
+oAIwOWZbwmSNuJ5Q3KjVSaLtx9zRSX8XAbjIho9OjIgrqJqpisXRAL34VOKa5Vt8
+sycX
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDxTCCAq2gAwIBAgIQAqxcJmoLQJuPC3nyrkYldzANBgkqhkiG9w0BAQUFADBs
+MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
+d3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBIaWdoIEFzc3VyYW5j
+ZSBFViBSb290IENBMB4XDTA2MTExMDAwMDAwMFoXDTMxMTExMDAwMDAwMFowbDEL
+MAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3
+LmRpZ2ljZXJ0LmNvbTErMCkGA1UEAxMiRGlnaUNlcnQgSGlnaCBBc3N1cmFuY2Ug
+RVYgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMbM5XPm
++9S75S0tMqbf5YE/yc0lSbZxKsPVlDRnogocsF9ppkCxxLeyj9CYpKlBWTrT3JTW
+PNt0OKRKzE0lgvdKpVMSOO7zSW1xkX5jtqumX8OkhPhPYlG++MXs2ziS4wblCJEM
+xChBVfvLWokVfnHoNb9Ncgk9vjo4UFt3MRuNs8ckRZqnrG0AFFoEt7oT61EKmEFB
+Ik5lYYeBQVCmeVyJ3hlKV9Uu5l0cUyx+mM0aBhakaHPQNAQTXKFx01p8VdteZOE3
+hzBWBOURtCmAEvF5OYiiAhF8J2a3iLd48soKqDirCmTCv2ZdlYTBoSUeh10aUAsg
+EsxBu24LUTi4S8sCAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQF
+MAMBAf8wHQYDVR0OBBYEFLE+w2kD+L9HAdSYJhoIAu9jZCvDMB8GA1UdIwQYMBaA
+FLE+w2kD+L9HAdSYJhoIAu9jZCvDMA0GCSqGSIb3DQEBBQUAA4IBAQAcGgaX3Nec
+nzyIZgYIVyHbIUf4KmeqvxgydkAQV8GK83rZEWWONfqe/EW1ntlMMUu4kehDLI6z
+eM7b41N5cdblIZQB2lWHmiRk9opmzN6cN82oNLFpmyPInngiK3BD41VHMWEZ71jF
+hS9OMPagMRYjyOfiZRYzy78aG6A9+MpeizGLYAiJLQwGXFK3xPkKmNEVX58Svnw2
+Yzi9RKR/5CYrCsSXaQ3pjOLAEFe4yHYSkVXySGnYvCoCWw9E1CAx2/S6cCZdkGCe
+vEsXCS+0yx5DaMkHJ8HSXPfqIbloEpw8nL+e/IBcm2PN7EeqJSdnoDfzAIJ9VNep
++OkuE6N36B9K
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFkDCCA3igAwIBAgIQBZsbV56OITLiOQe9p3d1XDANBgkqhkiG9w0BAQwFADBi
+MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
+d3cuZGlnaWNlcnQuY29tMSEwHwYDVQQDExhEaWdpQ2VydCBUcnVzdGVkIFJvb3Qg
+RzQwHhcNMTMwODAxMTIwMDAwWhcNMzgwMTE1MTIwMDAwWjBiMQswCQYDVQQGEwJV
+UzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQu
+Y29tMSEwHwYDVQQDExhEaWdpQ2VydCBUcnVzdGVkIFJvb3QgRzQwggIiMA0GCSqG
+SIb3DQEBAQUAA4ICDwAwggIKAoICAQC/5pBzaN675F1KPDAiMGkz7MKnJS7JIT3y
+ithZwuEppz1Yq3aaza57G4QNxDAf8xukOBbrVsaXbR2rsnnyyhHS5F/WBTxSD1If
+xp4VpX6+n6lXFllVcq9ok3DCsrp1mWpzMpTREEQQLt+C8weE5nQ7bXHiLQwb7iDV
+ySAdYyktzuxeTsiT+CFhmzTrBcZe7FsavOvJz82sNEBfsXpm7nfISKhmV1efVFiO
+DCu3T6cw2Vbuyntd463JT17lNecxy9qTXtyOj4DatpGYQJB5w3jHtrHEtWoYOAMQ
+jdjUN6QuBX2I9YI+EJFwq1WCQTLX2wRzKm6RAXwhTNS8rhsDdV14Ztk6MUSaM0C/
+CNdaSaTC5qmgZ92kJ7yhTzm1EVgX9yRcRo9k98FpiHaYdj1ZXUJ2h4mXaXpI8OCi
+EhtmmnTK3kse5w5jrubU75KSOp493ADkRSWJtppEGSt+wJS00mFt6zPZxd9LBADM
+fRyVw4/3IbKyEbe7f/LVjHAsQWCqsWMYRJUadmJ+9oCw++hkpjPRiQfhvbfmQ6QY
+uKZ3AeEPlAwhHbJUKSWJbOUOUlFHdL4mrLZBdd56rF+NP8m800ERElvlEFDrMcXK
+chYiCd98THU/Y+whX8QgUWtvsauGi0/C1kVfnSD8oR7FwI+isX4KJpn15GkvmB0t
+9dmpsh3lGwIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIB
+hjAdBgNVHQ4EFgQU7NfjgtJxXWRM3y5nP+e6mK4cD08wDQYJKoZIhvcNAQEMBQAD
+ggIBALth2X2pbL4XxJEbw6GiAI3jZGgPVs93rnD5/ZpKmbnJeFwMDF/k5hQpVgs2
+SV1EY+CtnJYYZhsjDT156W1r1lT40jzBQ0CuHVD1UvyQO7uYmWlrx8GnqGikJ9yd
++SeuMIW59mdNOj6PWTkiU0TryF0Dyu1Qen1iIQqAyHNm0aAFYF/opbSnr6j3bTWc
+fFqK1qI4mfN4i/RN0iAL3gTujJtHgXINwBQy7zBZLq7gcfJW5GqXb5JQbZaNaHqa
+sjYUegbyJLkJEVDXCLG4iXqEI2FCKeWjzaIgQdfRnGTZ6iahixTXTBmyUEFxPT9N
+cCOGDErcgdLMMpSEDQgJlxxPwO5rIHQw0uA5NBCFIRUBCOhVMt5xSdkoF1BN5r5N
+0XWs0Mr7QbhDparTwwVETyw2m+L64kW4I1NsBm9nVX9GtUw/bihaeSbSpKhil9Ie
+4u1Ki7wb/UdKDd9nZn6yW0HQO+T0O/QEY+nvwlQAUaCKKsnOeMzV6ocEGLPOr0mI
+r/OSmbaz5mEP0oUA51Aa5BuVnRmhuZyxm7EAHu/QD09CbMkKvO5D+jpxpchNJqU1
+/YldvIViHTLSoCtU7ZpXwdv6EM8Zt4tKG48BtieVU+i2iW1bvGjUI+iLUaJW+fCm
+gKDWHrO8Dw9TdSmq6hN35N6MgSGtBxBHEa2HPQfRdbzP82Z+
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIF8TCCA9mgAwIBAgIQALC3WhZIX7/hy/WL1xnmfTANBgkqhkiG9w0BAQsFADA4
+MQswCQYDVQQGEwJFUzEUMBIGA1UECgwLSVpFTlBFIFMuQS4xEzARBgNVBAMMCkl6
+ZW5wZS5jb20wHhcNMDcxMjEzMTMwODI4WhcNMzcxMjEzMDgyNzI1WjA4MQswCQYD
+VQQGEwJFUzEUMBIGA1UECgwLSVpFTlBFIFMuQS4xEzARBgNVBAMMCkl6ZW5wZS5j
+b20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDJ03rKDx6sp4boFmVq
+scIbRTJxldn+EFvMr+eleQGPicPK8lVx93e+d5TzcqQsRNiekpsUOqHnJJAKClaO
+xdgmlOHZSOEtPtoKct2jmRXagaKH9HtuJneJWK3W6wyyQXpzbm3benhB6QiIEn6H
+LmYRY2xU+zydcsC8Lv/Ct90NduM61/e0aL6i9eOBbsFGb12N4E3GVFWJGjMxCrFX
+uaOKmMPsOzTFlUFpfnXCPCDFYbpRR6AgkJOhkEvzTnyFRVSa0QUmQbC1TR0zvsQD
+yCV8wXDbO/QJLVQnSKwv4cSsPsjLkkxTOTcj7NMB+eAJRE1NZMDhDVqHIrytG6P+
+JrUV86f8hBnp7KGItERphIPzidF0BqnMC9bC3ieFUCbKF7jJeodWLBoBHmy+E60Q
+rLUk9TiRodZL2vG70t5HtfG8gfZZa88ZU+mNFctKy6lvROUbQc/hhqfK0GqfvEyN
+BjNaooXlkDWgYlwWTvDjovoDGrQscbNYLN57C9saD+veIR8GdwYDsMnvmfzAuU8L
+hij+0rnq49qlw0dpEuDb8PYZi+17cNcC1u2HGCgsBCRMd+RIihrGO5rUD8r6ddIB
+QFqNeb+Lz0vPqhbBleStTIo+F5HUsWLlguWABKQDfo2/2n+iD5dPDNMN+9fR5XJ+
+HMh3/1uaD7euBUbl8agW7EekFwIDAQABo4H2MIHzMIGwBgNVHREEgagwgaWBD2lu
+Zm9AaXplbnBlLmNvbaSBkTCBjjFHMEUGA1UECgw+SVpFTlBFIFMuQS4gLSBDSUYg
+QTAxMzM3MjYwLVJNZXJjLlZpdG9yaWEtR2FzdGVpeiBUMTA1NSBGNjIgUzgxQzBB
+BgNVBAkMOkF2ZGEgZGVsIE1lZGl0ZXJyYW5lbyBFdG9yYmlkZWEgMTQgLSAwMTAx
+MCBWaXRvcmlhLUdhc3RlaXowDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC
+AQYwHQYDVR0OBBYEFB0cZQ6o8iV7tJHP5LGx5r1VdGwFMA0GCSqGSIb3DQEBCwUA
+A4ICAQB4pgwWSp9MiDrAyw6lFn2fuUhfGI8NYjb2zRlrrKvV9pF9rnHzP7MOeIWb
+laQnIUdCSnxIOvVFfLMMjlF4rJUT3sb9fbgakEyrkgPH7UIBzg/YsfqikuFgba56
+awmqxinuaElnMIAkejEWOVt+8Rwu3WwJrfIxwYJOubv5vr8qhT/AQKM6WfxZSzwo
+JNu0FXWuDYi6LnPAvViH5ULy617uHjAimcs30cQhbIHsvm0m5hzkQiCeR7Csg1lw
+LDXWrzY0tM07+DKo7+N4ifuNRSzanLh+QBxh5z6ikixL8s36mLYp//Pye6kfLqCT
+VyvehQP5aTfLnnhqBbTFMXiJ7HqnheG5ezzevh55hM6fcA5ZwjUukCox2eRFekGk
+LhObNA5me0mrZJfQRsN5nXJQY6aYWwa9SG3YOYNw6DXwBdGqvOPbyALqfP2C2sJb
+UjWumDqtujWTI6cfSN01RpiyEGjkpTHCClguGYEQyVB1/OpaFs4R1+7vUIgtYf8/
+QnMFlEPVjjxOAToZpR9GTnfQXeWBIiGH/pR9hNiTrdZoQ0iy2+tzJOeRf1SktoA+
+naM8THLCV8Sg1Mw4J87VBp6iSNnpn86CcDaTmjvfliHjWbcM2pE38P1ZWrOZyGls
+QyYBNWNgVYkDOnXYukrZVP/u3oDYLdE41V4tC5h9Pmzb/CaIxw==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICCTCCAY6gAwIBAgINAgPlwGjvYxqccpBQUjAKBggqhkjOPQQDAzBHMQswCQYD
+VQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEUMBIG
+A1UEAxMLR1RTIFJvb3QgUjQwHhcNMTYwNjIyMDAwMDAwWhcNMzYwNjIyMDAwMDAw
+WjBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2Vz
+IExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjQwdjAQBgcqhkjOPQIBBgUrgQQAIgNi
+AATzdHOnaItgrkO4NcWBMHtLSZ37wWHO5t5GvWvVYRg1rkDdc/eJkTBa6zzuhXyi
+QHY7qca4R9gq55KRanPpsXI5nymfopjTX15YhmUPoYRlBtHci8nHc8iMai/lxKvR
+HYqjQjBAMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQW
+BBSATNbrdP9JNqPV2Py1PsVq8JQdjDAKBggqhkjOPQQDAwNpADBmAjEA6ED/g94D
+9J+uHXqnLrmvT/aDHQ4thQEd0dlq7A/Cr8deVl5c1RxYIigL9zC2L7F8AjEA8GE8
+p/SgguMh1YQdc4acLa/KNJvxn7kjNuK8YAOdgLOaVsjh4rsUecrNIdSUtUlD
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFVzCCAz+gAwIBAgINAgPlk28xsBNJiGuiFzANBgkqhkiG9w0BAQwFADBHMQsw
+CQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEU
+MBIGA1UEAxMLR1RTIFJvb3QgUjEwHhcNMTYwNjIyMDAwMDAwWhcNMzYwNjIyMDAw
+MDAwWjBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZp
+Y2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjEwggIiMA0GCSqGSIb3DQEBAQUA
+A4ICDwAwggIKAoICAQC2EQKLHuOhd5s73L+UPreVp0A8of2C+X0yBoJx9vaMf/vo
+27xqLpeXo4xL+Sv2sfnOhB2x+cWX3u+58qPpvBKJXqeqUqv4IyfLpLGcY9vXmX7w
+Cl7raKb0xlpHDU0QM+NOsROjyBhsS+z8CZDfnWQpJSMHobTSPS5g4M/SCYe7zUjw
+TcLCeoiKu7rPWRnWr4+wB7CeMfGCwcDfLqZtbBkOtdh+JhpFAz2weaSUKK0Pfybl
+qAj+lug8aJRT7oM6iCsVlgmy4HqMLnXWnOunVmSPlk9orj2XwoSPwLxAwAtcvfaH
+szVsrBhQf4TgTM2S0yDpM7xSma8ytSmzJSq0SPly4cpk9+aCEI3oncKKiPo4Zor8
+Y/kB+Xj9e1x3+naH+uzfsQ55lVe0vSbv1gHR6xYKu44LtcXFilWr06zqkUspzBmk
+MiVOKvFlRNACzqrOSbTqn3yDsEB750Orp2yjj32JgfpMpf/VjsPOS+C12LOORc92
+wO1AK/1TD7Cn1TsNsYqiA94xrcx36m97PtbfkSIS5r762DL8EGMUUXLeXdYWk70p
+aDPvOmbsB4om3xPXV2V4J95eSRQAogB/mqghtqmxlbCluQ0WEdrHbEg8QOB+DVrN
+VjzRlwW5y0vtOUucxD/SVRNuJLDWcfr0wbrM7Rv1/oFB2ACYPTrIrnqYNxgFlQID
+AQABo0IwQDAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4E
+FgQU5K8rJnEaK0gnhS9SZizv8IkTcT4wDQYJKoZIhvcNAQEMBQADggIBAJ+qQibb
+C5u+/x6Wki4+omVKapi6Ist9wTrYggoGxval3sBOh2Z5ofmmWJyq+bXmYOfg6LEe
+QkEzCzc9zolwFcq1JKjPa7XSQCGYzyI0zzvFIoTgxQ6KfF2I5DUkzps+GlQebtuy
+h6f88/qBVRRiClmpIgUxPoLW7ttXNLwzldMXG+gnoot7TiYaelpkttGsN/H9oPM4
+7HLwEXWdyzRSjeZ2axfG34arJ45JK3VmgRAhpuo+9K4l/3wV3s6MJT/KYnAK9y8J
+ZgfIPxz88NtFMN9iiMG1D53Dn0reWVlHxYciNuaCp+0KueIHoI17eko8cdLiA6Ef
+MgfdG+RCzgwARWGAtQsgWSl4vflVy2PFPEz0tv/bal8xa5meLMFrUKTX5hgUvYU/
+Z6tGn6D/Qqc6f1zLXbBwHSs09dR2CQzreExZBfMzQsNhFRAbd03OIozUhfJFfbdT
+6u9AWpQKXCBfTkBdYiJ23//OYb2MI3jSNwLgjt7RETeJ9r/tSQdirpLsQBqvFAnZ
+0E6yove+7u7Y/9waLd64NnHi/Hm3lCXRSHNboTXns5lndcEZOitHTtNCjv0xyBZm
+2tIMPNuzjsmhDYAPexZ3FL//2wmUspO8IFgV6dtxQ/PeEMMA3KgqlbbC1j+Qa3bb
+bP6MvPJwNQzcmRk13NfIRmPVNnGuV/u3gm3c
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFVzCCAz+gAwIBAgINAgPlrsWNBCUaqxElqjANBgkqhkiG9w0BAQwFADBHMQsw
+CQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEU
+MBIGA1UEAxMLR1RTIFJvb3QgUjIwHhcNMTYwNjIyMDAwMDAwWhcNMzYwNjIyMDAw
+MDAwWjBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZp
+Y2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjIwggIiMA0GCSqGSIb3DQEBAQUA
+A4ICDwAwggIKAoICAQDO3v2m++zsFDQ8BwZabFn3GTXd98GdVarTzTukk3LvCvpt
+nfbwhYBboUhSnznFt+4orO/LdmgUud+tAWyZH8QiHZ/+cnfgLFuv5AS/T3KgGjSY
+6Dlo7JUle3ah5mm5hRm9iYz+re026nO8/4Piy33B0s5Ks40FnotJk9/BW9BuXvAu
+MC6C/Pq8tBcKSOWIm8Wba96wyrQD8Nr0kLhlZPdcTK3ofmZemde4wj7I0BOdre7k
+RXuJVfeKH2JShBKzwkCX44ofR5GmdFrS+LFjKBC4swm4VndAoiaYecb+3yXuPuWg
+f9RhD1FLPD+M2uFwdNjCaKH5wQzpoeJ/u1U8dgbuak7MkogwTZq9TwtImoS1mKPV
++3PBV2HdKFZ1E66HjucMUQkQdYhMvI35ezzUIkgfKtzra7tEscszcTJGr61K8Yzo
+dDqs5xoic4DSMPclQsciOzsSrZYuxsN2B6ogtzVJV+mSSeh2FnIxZyuWfoqjx5RW
+Ir9qS34BIbIjMt/kmkRtWVtd9QCgHJvGeJeNkP+byKq0rxFROV7Z+2et1VsRnTKa
+G73VululycslaVNVJ1zgyjbLiGH7HrfQy+4W+9OmTN6SpdTi3/UGVN4unUu0kzCq
+gc7dGtxRcw1PcOnlthYhGXmy5okLdWTK1au8CcEYof/UVKGFPP0UJAOyh9OktwID
+AQABo0IwQDAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4E
+FgQUu//KjiOfT5nK2+JopqUVJxce2Q4wDQYJKoZIhvcNAQEMBQADggIBAB/Kzt3H
+vqGf2SdMC9wXmBFqiN495nFWcrKeGk6c1SuYJF2ba3uwM4IJvd8lRuqYnrYb/oM8
+0mJhwQTtzuDFycgTE1XnqGOtjHsB/ncw4c5omwX4Eu55MaBBRTUoCnGkJE+M3DyC
+B19m3H0Q/gxhswWV7uGugQ+o+MePTagjAiZrHYNSVc61LwDKgEDg4XSsYPWHgJ2u
+NmSRXbBoGOqKYcl3qJfEycel/FVL8/B/uWU9J2jQzGv6U53hkRrJXRqWbTKH7QMg
+yALOWr7Z6v2yTcQvG99fevX4i8buMTolUVVnjWQye+mew4K6Ki3pHrTgSAai/Gev
+HyICc/sgCq+dVEuhzf9gR7A/Xe8bVr2XIZYtCtFenTgCR2y59PYjJbigapordwj6
+xLEokCZYCDzifqrXPW+6MYgKBesntaFJ7qBFVHvmJ2WZICGoo7z7GJa7Um8M7YNR
+TOlZ4iBgxcJlkoKM8xAfDoqXvneCbT+PHV28SSe9zE8P4c52hgQjxcCMElv924Sg
+JPFI/2R80L5cFtHvma3AH/vLrrw4IgYmZNralw4/KBVEqE8AyvCazM90arQ+POuV
+7LXTWtiBmelDGDfrs7vRWGJB82bSj6p4lVQgw1oudCvV0b4YacCs1aTPObpRhANl
+6WLAYv7YTVWW4tAR+kg0Eeye7QUd5MjWHYbL
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICCTCCAY6gAwIBAgINAgPluILrIPglJ209ZjAKBggqhkjOPQQDAzBHMQswCQYD
+VQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEUMBIG
+A1UEAxMLR1RTIFJvb3QgUjMwHhcNMTYwNjIyMDAwMDAwWhcNMzYwNjIyMDAwMDAw
+WjBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2Vz
+IExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjMwdjAQBgcqhkjOPQIBBgUrgQQAIgNi
+AAQfTzOHMymKoYTey8chWEGJ6ladK0uFxh1MJ7x/JlFyb+Kf1qPKzEUURout736G
+jOyxfi//qXGdGIRFBEFVbivqJn+7kAHjSxm65FSWRQmx1WyRRK2EE46ajA2ADDL2
+4CejQjBAMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQW
+BBTB8Sa6oC2uhYHP0/EqEr24Cmf9vDAKBggqhkjOPQQDAwNpADBmAjEA9uEglRR7
+VKOQFhG/hMjqb2sXnh5GmCCbn9MN2azTL818+FsuVbu/3ZL3pAzcMeGiAjEA/Jdm
+ZuVDFhOD3cffL74UOO0BzrEXGhF16b0DjyZ+hOXJYKaV11RZt+cRLInUue4X
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIB3DCCAYOgAwIBAgINAgPlfvU/k/2lCSGypjAKBggqhkjOPQQDAjBQMSQwIgYD
+VQQLExtHbG9iYWxTaWduIEVDQyBSb290IENBIC0gUjQxEzARBgNVBAoTCkdsb2Jh
+bFNpZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMTIxMTEzMDAwMDAwWhcNMzgw
+MTE5MDMxNDA3WjBQMSQwIgYDVQQLExtHbG9iYWxTaWduIEVDQyBSb290IENBIC0g
+UjQxEzARBgNVBAoTCkdsb2JhbFNpZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wWTAT
+BgcqhkjOPQIBBggqhkjOPQMBBwNCAAS4xnnTj2wlDp8uORkcA6SumuU5BwkWymOx
+uYb4ilfBV85C+nOh92VC/x7BALJucw7/xyHlGKSq2XE/qNS5zowdo0IwQDAOBgNV
+HQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUVLB7rUW44kB/
++wpu+74zyTyjhNUwCgYIKoZIzj0EAwIDRwAwRAIgIk90crlgr/HmnKAWBVBfw147
+bmF0774BxL4YSFlhgjICICadVGNA3jdgUM/I2O2dgq43mLyjj0xMqTQrbO/7lZsm
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICWTCCAd+gAwIBAgIQZvI9r4fei7FK6gxXMQHC7DAKBggqhkjOPQQDAzBlMQsw
+CQYDVQQGEwJVUzEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMTYwNAYD
+VQQDEy1NaWNyb3NvZnQgRUNDIFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IDIw
+MTcwHhcNMTkxMjE4MjMwNjQ1WhcNNDIwNzE4MjMxNjA0WjBlMQswCQYDVQQGEwJV
+UzEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMTYwNAYDVQQDEy1NaWNy
+b3NvZnQgRUNDIFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IDIwMTcwdjAQBgcq
+hkjOPQIBBgUrgQQAIgNiAATUvD0CQnVBEyPNgASGAlEvaqiBYgtlzPbKnR5vSmZR
+ogPZnZH6thaxjG7efM3beaYvzrvOcS/lpaso7GMEZpn4+vKTEAXhgShC48Zo9OYb
+hGBKia/teQ87zvH2RPUBeMCjVDBSMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8E
+BTADAQH/MB0GA1UdDgQWBBTIy5lycFIM+Oa+sgRXKSrPQhDtNTAQBgkrBgEEAYI3
+FQEEAwIBADAKBggqhkjOPQQDAwNoADBlAjBY8k3qDPlfXu5gKcs68tvWMoQZP3zV
+L8KxzJOuULsJMsbG7X7JNpQS5GiFBqIb0C8CMQCZ6Ra0DvpWSNSkMBaReNtUjGUB
+iudQZsIxtzm6uBoiB078a1QWIP8rtedMDE2mT3M=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFqDCCA5CgAwIBAgIQHtOXCV/YtLNHcB6qvn9FszANBgkqhkiG9w0BAQwFADBl
+MQswCQYDVQQGEwJVUzEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMTYw
+NAYDVQQDEy1NaWNyb3NvZnQgUlNBIFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5
+IDIwMTcwHhcNMTkxMjE4MjI1MTIyWhcNNDIwNzE4MjMwMDIzWjBlMQswCQYDVQQG
+EwJVUzEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMTYwNAYDVQQDEy1N
+aWNyb3NvZnQgUlNBIFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IDIwMTcwggIi
+MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDKW76UM4wplZEWCpW9R2LBifOZ
+Nt9GkMml7Xhqb0eRaPgnZ1AzHaGm++DlQ6OEAlcBXZxIQIJTELy/xztokLaCLeX0
+ZdDMbRnMlfl7rEqUrQ7eS0MdhweSE5CAg2Q1OQT85elss7YfUJQ4ZVBcF0a5toW1
+HLUX6NZFndiyJrDKxHBKrmCk3bPZ7Pw71VdyvD/IybLeS2v4I2wDwAW9lcfNcztm
+gGTjGqwu+UcF8ga2m3P1eDNbx6H7JyqhtJqRjJHTOoI+dkC0zVJhUXAoP8XFWvLJ
+jEm7FFtNyP9nTUwSlq31/niol4fX/V4ggNyhSyL71Imtus5Hl0dVe49FyGcohJUc
+aDDv70ngNXtk55iwlNpNhTs+VcQor1fznhPbRiefHqJeRIOkpcrVE7NLP8TjwuaG
+YaRSMLl6IE9vDzhTyzMMEyuP1pq9KsgtsRx9S1HKR9FIJ3Jdh+vVReZIZZ2vUpC6
+W6IYZVcSn2i51BVrlMRpIpj0M+Dt+VGOQVDJNE92kKz8OMHY4Xu54+OU4UZpyw4K
+UGsTuqwPN1q3ErWQgR5WrlcihtnJ0tHXUeOrO8ZV/R4O03QK0dqq6mm4lyiPSMQH
++FJDOvTKVTUssKZqwJz58oHhEmrARdlns87/I6KJClTUFLkqqNfs+avNJVgyeY+Q
+W5g5xAgGwax/Dj0ApQIDAQABo1QwUjAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/
+BAUwAwEB/zAdBgNVHQ4EFgQUCctZf4aycI8awznjwNnpv7tNsiMwEAYJKwYBBAGC
+NxUBBAMCAQAwDQYJKoZIhvcNAQEMBQADggIBAKyvPl3CEZaJjqPnktaXFbgToqZC
+LgLNFgVZJ8og6Lq46BrsTaiXVq5lQ7GPAJtSzVXNUzltYkyLDVt8LkS/gxCP81OC
+gMNPOsduET/m4xaRhPtthH80dK2Jp86519efhGSSvpWhrQlTM93uCupKUY5vVau6
+tZRGrox/2KJQJWVggEbbMwSubLWYdFQl3JPk+ONVFT24bcMKpBLBaYVu32TxU5nh
+SnUgnZUP5NbcA/FZGOhHibJXWpS2qdgXKxdJ5XbLwVaZOjex/2kskZGT4d9Mozd2
+TaGf+G0eHdP67Pv0RR0Tbc/3WeUiJ3IrhvNXuzDtJE3cfVa7o7P4NHmJweDyAmH3
+pvwPuxwXC65B2Xy9J6P9LjrRk5Sxcx0ki69bIImtt2dmefU6xqaWM/5TkshGsRGR
+xpl/j8nWZjEgQRCHLQzWwa80mMpkg/sTV9HB8Dx6jKXB/ZUhoHHBk2dxEuqPiApp
+GWSZI1b7rCoucL5mxAyE7+WL85MB+GqQk2dLsmijtWKP6T+MejteD+eMuMZ87zf9
+dOLITzNy4ZQ5bb0Sr74MTnB8G2+NszKTc0QWbej09+CVgI+WXTik9KveCjCHk9hN
+AHFiRSdLOkKEW39lt2c0Ui2cFmuqqNh7o0JMcccMyj6D5KbvtwEwXlGjefVwaaZB
+RA+GsCyRxj3qrg+E
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIC2zCCAmCgAwIBAgIQfMmPK4TX3+oPyWWa00tNljAKBggqhkjOPQQDAzBIMQsw
+CQYDVQQGEwJERTEVMBMGA1UEChMMRC1UcnVzdCBHbWJIMSIwIAYDVQQDExlELVRS
+VVNUIEJSIFJvb3QgQ0EgMSAyMDIwMB4XDTIwMDIxMTA5NDUwMFoXDTM1MDIxMTA5
+NDQ1OVowSDELMAkGA1UEBhMCREUxFTATBgNVBAoTDEQtVHJ1c3QgR21iSDEiMCAG
+A1UEAxMZRC1UUlVTVCBCUiBSb290IENBIDEgMjAyMDB2MBAGByqGSM49AgEGBSuB
+BAAiA2IABMbLxyjR+4T1mu9CFCDhQ2tuda38KwOE1HaTJddZO0Flax7mNCq7dPYS
+zuht56vkPE4/RAiLzRZxy7+SmfSk1zxQVFKQhYN4lGdnoxwJGT11NIXe7WB9xwy0
+QVK5buXuQqOCAQ0wggEJMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFHOREKv/
+VbNafAkl1bK6CKBrqx9tMA4GA1UdDwEB/wQEAwIBBjCBxgYDVR0fBIG+MIG7MD6g
+PKA6hjhodHRwOi8vY3JsLmQtdHJ1c3QubmV0L2NybC9kLXRydXN0X2JyX3Jvb3Rf
+Y2FfMV8yMDIwLmNybDB5oHegdYZzbGRhcDovL2RpcmVjdG9yeS5kLXRydXN0Lm5l
+dC9DTj1ELVRSVVNUJTIwQlIlMjBSb290JTIwQ0ElMjAxJTIwMjAyMCxPPUQtVHJ1
+c3QlMjBHbWJILEM9REU/Y2VydGlmaWNhdGVyZXZvY2F0aW9ubGlzdDAKBggqhkjO
+PQQDAwNpADBmAjEAlJAtE/rhY/hhY+ithXhUkZy4kzg+GkHaQBZTQgjKL47xPoFW
+wKrY7RjEsK70PvomAjEA8yjixtsrmfu3Ubgko6SUeho/5jbiA1czijDLgsfWFBHV
+dWNbFJWcHwHP2NVypw87
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIGWzCCBEOgAwIBAgIRAMrpG4nxVQMNo+ZBbcTjpuEwDQYJKoZIhvcNAQELBQAw
+WjELMAkGA1UEBhMCRlIxEjAQBgNVBAoMCURoaW15b3RpczEcMBoGA1UECwwTMDAw
+MiA0ODE0NjMwODEwMDAzNjEZMBcGA1UEAwwQQ2VydGlnbmEgUm9vdCBDQTAeFw0x
+MzEwMDEwODMyMjdaFw0zMzEwMDEwODMyMjdaMFoxCzAJBgNVBAYTAkZSMRIwEAYD
+VQQKDAlEaGlteW90aXMxHDAaBgNVBAsMEzAwMDIgNDgxNDYzMDgxMDAwMzYxGTAX
+BgNVBAMMEENlcnRpZ25hIFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAw
+ggIKAoICAQDNGDllGlmx6mQWDoyUJJV8g9PFOSbcDO8WV43X2KyjQn+Cyu3NW9sO
+ty3tRQgXstmzy9YXUnIo245Onoq2C/mehJpNdt4iKVzSs9IGPjA5qXSjklYcoW9M
+CiBtnyN6tMbaLOQdLNyzKNAT8kxOAkmhVECe5uUFoC2EyP+YbNDrihqECB63aCPu
+I9Vwzm1RaRDuoXrC0SIxwoKF0vJVdlB8JXrJhFwLrN1CTivngqIkicuQstDuI7pm
+TLtipPlTWmR7fJj6o0ieD5Wupxj0auwuA0Wv8HT4Ks16XdG+RCYyKfHx9WzMfgIh
+C59vpD++nVPiz32pLHxYGpfhPTc3GGYo0kDFUYqMwy3OU4gkWGQwFsWq4NYKpkDf
+ePb1BHxpE4S80dGnBs8B92jAqFe7OmGtBIyT46388NtEbVncSVmurJqZNjBBe3Yz
+IoejwpKGbvlw7q6Hh5UbxHq9MfPU0uWZ/75I7HX1eBYdpnDBfzwboZL7z8g81sWT
+Co/1VTp2lc5ZmIoJlXcymoO6LAQ6l73UL77XbJuiyn1tJslV1c/DeVIICZkHJC1k
+JWumIWmbat10TWuXekG9qxf5kBdIjzb5LdXF2+6qhUVB+s06RbFo5jZMm5BX7CO5
+hwjCxAnxl4YqKE3idMDaxIzb3+KhF1nOJFl0Mdp//TBt2dzhauH8XwIDAQABo4IB
+GjCCARYwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYE
+FBiHVuBud+4kNTxOc5of1uHieX4rMB8GA1UdIwQYMBaAFBiHVuBud+4kNTxOc5of
+1uHieX4rMEQGA1UdIAQ9MDswOQYEVR0gADAxMC8GCCsGAQUFBwIBFiNodHRwczov
+L3d3d3cuY2VydGlnbmEuZnIvYXV0b3JpdGVzLzBtBgNVHR8EZjBkMC+gLaArhilo
+dHRwOi8vY3JsLmNlcnRpZ25hLmZyL2NlcnRpZ25hcm9vdGNhLmNybDAxoC+gLYYr
+aHR0cDovL2NybC5kaGlteW90aXMuY29tL2NlcnRpZ25hcm9vdGNhLmNybDANBgkq
+hkiG9w0BAQsFAAOCAgEAlLieT/DjlQgi581oQfccVdV8AOItOoldaDgvUSILSo3L
+6btdPrtcPbEo/uRTVRPPoZAbAh1fZkYJMyjhDSSXcNMQH+pkV5a7XdrnxIxPTGRG
+HVyH41neQtGbqH6mid2PHMkwgu07nM3A6RngatgCdTer9zQoKJHyBApPNeNgJgH6
+0BGM+RFq7q89w1DTj18zeTyGqHNFkIwgtnJzFyO+B2XleJINugHA64wcZr+shncB
+lA2c5uk5jR+mUYyZDDl34bSb+hxnV29qao6pK0xXeXpXIs/NX2NGjVxZOob4Mkdi
+o2cNGJHc+6Zr9UhhcyNZjgKnvETq9Emd8VRY+WCv2hikLyhF3HqgiIZd8zvn/yk1
+gPxkQ5Tm4xxvvq0OKmOZK8l+hfZx6AYDlf7ej0gcWtSS6Cvu5zHbugRqh5jnxV/v
+faci9wHYTfmJ0A6aBVmknpjZbyvKcL5kwlWj9Omvw5Ip3IgWJJk8jSaYtlu3zM63
+Nwf9JtmYhST/WSMDmu2dnajkXjjO11INb9I/bbEFa0nOipFGc/T2L/Coc3cOZayh
+jWZSaX5LaAzHHjcng6WMxwLkFM1JAbBzs/3GkDpv0mztO+7skb6iQ12LAEpmJURw
+3kAP+HwV96LOPNdeE4yBFxgX0b3xdxA61GU5wSesVywlVP+i2k+KYTlerj1KjL0=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDqDCCApCgAwIBAgIJAP7c4wEPyUj/MA0GCSqGSIb3DQEBBQUAMDQxCzAJBgNV
+BAYTAkZSMRIwEAYDVQQKDAlEaGlteW90aXMxETAPBgNVBAMMCENlcnRpZ25hMB4X
+DTA3MDYyOTE1MTMwNVoXDTI3MDYyOTE1MTMwNVowNDELMAkGA1UEBhMCRlIxEjAQ
+BgNVBAoMCURoaW15b3RpczERMA8GA1UEAwwIQ2VydGlnbmEwggEiMA0GCSqGSIb3
+DQEBAQUAA4IBDwAwggEKAoIBAQDIaPHJ1tazNHUmgh7stL7qXOEm7RFHYeGifBZ4
+QCHkYJ5ayGPhxLGWkv8YbWkj4Sti993iNi+RB7lIzw7sebYs5zRLcAglozyHGxny
+gQcPOJAZ0xH+hrTy0V4eHpbNgGzOOzGTtvKg0KmVEn2lmsxryIRWijOp5yIVUxbw
+zBfsV1/pogqYCd7jX5xv3EjjhQsVWqa6n6xI4wmy9/Qy3l40vhx4XUJbzg4ij02Q
+130yGLMLLGq/jj8UEYkgDncUtT2UCIf3JR7VsmAA7G8qKCVuKj4YYxclPz5EIBb2
+JsglrgVKtOdjLPOMFlN+XPsRGgjBRmKfIrjxwo1p3Po6WAbfAgMBAAGjgbwwgbkw
+DwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUGu3+QTmQtCRZvgHyUtVF9lo53BEw
+ZAYDVR0jBF0wW4AUGu3+QTmQtCRZvgHyUtVF9lo53BGhOKQ2MDQxCzAJBgNVBAYT
+AkZSMRIwEAYDVQQKDAlEaGlteW90aXMxETAPBgNVBAMMCENlcnRpZ25hggkA/tzj
+AQ/JSP8wDgYDVR0PAQH/BAQDAgEGMBEGCWCGSAGG+EIBAQQEAwIABzANBgkqhkiG
+9w0BAQUFAAOCAQEAhQMeknH2Qq/ho2Ge6/PAD/Kl1NqV5ta+aDY9fm4fTIrv0Q8h
+bV6lUmPOEvjvKtpv6zf+EwLHyzs+ImvaYS5/1HI93TDhHkxAGYwP15zRgzB7mFnc
+fca5DClMoTOi62c6ZYTTluLtdkVwj7Ur3vkj1kluPBS1xp81HlDQwY9qcEQCYsuu
+HWhBp6pX6FOqB9IG9tUUBguRA3UsbHK1YZWaDYu5Def131TN3ubY1gkIl2PlwS6w
+t0QmwCbAr1UwnjvVNioZBPRcHv/PLLf/0P2HQBHVESO7SMAhqaQoLf0V+LBOK/Qw
+WyH8EZE0vkHve52Xdf+XlcCWWC/qu0bXu+TZLg==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFZjCCA06gAwIBAgIQCPm0eKj6ftpqMzeJ3nzPijANBgkqhkiG9w0BAQwFADBN
+MQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xJTAjBgNVBAMT
+HERpZ2lDZXJ0IFRMUyBSU0E0MDk2IFJvb3QgRzUwHhcNMjEwMTE1MDAwMDAwWhcN
+NDYwMTE0MjM1OTU5WjBNMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQs
+IEluYy4xJTAjBgNVBAMTHERpZ2lDZXJ0IFRMUyBSU0E0MDk2IFJvb3QgRzUwggIi
+MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCz0PTJeRGd/fxmgefM1eS87IE+
+ajWOLrfn3q/5B03PMJ3qCQuZvWxX2hhKuHisOjmopkisLnLlvevxGs3npAOpPxG0
+2C+JFvuUAT27L/gTBaF4HI4o4EXgg/RZG5Wzrn4DReW+wkL+7vI8toUTmDKdFqgp
+wgscONyfMXdcvyej/Cestyu9dJsXLfKB2l2w4SMXPohKEiPQ6s+d3gMXsUJKoBZM
+pG2T6T867jp8nVid9E6P/DsjyG244gXazOvswzH016cpVIDPRFtMbzCe88zdH5RD
+nU1/cHAN1DrRN/BsnZvAFJNY781BOHW8EwOVfH/jXOnVDdXifBBiqmvwPXbzP6Po
+sMH976pXTayGpxi0KcEsDr9kvimM2AItzVwv8n/vFfQMFawKsPHTDU9qTXeXAaDx
+Zre3zu/O7Oyldcqs4+Fj97ihBMi8ez9dLRYiVu1ISf6nL3kwJZu6ay0/nTvEF+cd
+Lvvyz6b84xQslpghjLSR6Rlgg/IwKwZzUNWYOwbpx4oMYIwo+FKbbuH2TbsGJJvX
+KyY//SovcfXWJL5/MZ4PbeiPT02jP/816t9JXkGPhvnxd3lLG7SjXi/7RgLQZhNe
+XoVPzthwiHvOAbWWl9fNff2C+MIkwcoBOU+NosEUQB+cZtUMCUbW8tDRSHZWOkPL
+tgoRObqME2wGtZ7P6wIDAQABo0IwQDAdBgNVHQ4EFgQUUTMc7TZArxfTJc1paPKv
+TiM+s0EwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcN
+AQEMBQADggIBAGCmr1tfV9qJ20tQqcQjNSH/0GEwhJG3PxDPJY7Jv0Y02cEhJhxw
+GXIeo8mH/qlDZJY6yFMECrZBu8RHANmfGBg7sg7zNOok992vIGCukihfNudd5N7H
+PNtQOa27PShNlnx2xlv0wdsUpasZYgcYQF+Xkdycx6u1UQ3maVNVzDl92sURVXLF
+O4uJ+DQtpBflF+aZfTCIITfNMBc9uPK8qHWgQ9w+iUuQrm0D4ByjoJYJu32jtyoQ
+REtGBzRj7TG5BO6jm5qu5jF49OokYTurWGT/u4cnYiWB39yhL/btp/96j1EuMPik
+AdKFOV8BmZZvWltwGUb+hmA+rYAQCd05JS9Yf7vSdPD3Rh9GOUrYU9DzLjtxpdRv
+/PNn5AeP3SYZ4Y1b+qOTEZvpyDrDVWiakuFSdjjo4bq9+0/V77PnSIMx8IIh47a+
+p6tv75/fTM8BuGJqIz3nCU2AG3swpMPdB380vqQmsvZB6Akd4yCYqjdP//fx4ilw
+MUc/dNAUFvohigLVigmUdy7yWSiLfFCSCmZ4OIN1xLVaqBHG5cGdZlXPU8Sv13WF
+qUITVuwhd4GTWgzqltlJyqEI8pc7bZsEGCREjnwB8twl2F6GmrE52/WRMmrRpnCK
+ovfepEWFJqgejF0pW8hL2JpqA15w8oVPbEtoL8pU9ozaMv7Da4M/OMZ+
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICGTCCAZ+gAwIBAgIQCeCTZaz32ci5PhwLBCou8zAKBggqhkjOPQQDAzBOMQsw
+CQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xJjAkBgNVBAMTHURp
+Z2lDZXJ0IFRMUyBFQ0MgUDM4NCBSb290IEc1MB4XDTIxMDExNTAwMDAwMFoXDTQ2
+MDExNDIzNTk1OVowTjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDkRpZ2lDZXJ0LCBJ
+bmMuMSYwJAYDVQQDEx1EaWdpQ2VydCBUTFMgRUNDIFAzODQgUm9vdCBHNTB2MBAG
+ByqGSM49AgEGBSuBBAAiA2IABMFEoc8Rl1Ca3iOCNQfN0MsYndLxf3c1TzvdlHJS
+7cI7+Oz6e2tYIOyZrsn8aLN1udsJ7MgT9U7GCh1mMEy7H0cKPGEQQil8pQgO4CLp
+0zVozptjn4S1mU1YoI71VOeVyaNCMEAwHQYDVR0OBBYEFMFRRVBZqz7nLFr6ICIS
+B4CIfBFqMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MAoGCCqGSM49
+BAMDA2gAMGUCMQCJao1H5+z8blUD2WdsJk6Dxv3J+ysTvLd6jLRl0mlpYxNjOyZQ
+LgGheQaRnUi/wr4CMEfDFXuxoJGZSZOoPHzoRgaLLPIxAJSdYsiJvRmEFOml+wG4
+DXZDjC5Ty3zfDBeWUA==
+-----END CERTIFICATE-----

_service:tar_scm:stunnel-5.48.tar.gz/tools/makecert.sh -> _service:tar_scm:stunnel-5.69.tar.gz/tools/makecert.sh Changed

_service:tar_scm:stunnel-5.48.tar.gz/tools/openssl.cnf -> _service:tar_scm:stunnel-5.69.tar.gz/tools/openssl.cnf Changed

@@ -1,20 +1,45 @@
 # OpenSSL configuration file to create a server certificate
-# by Michal Trojnara 1998-2018
+# by Michal Trojnara 1998-2023
+
+# Use this in order to automatically load providers.
+openssl_conf = openssl_init
+
+# Comment out the next line to ignore configuration errors
+config_diagnostics = 1
+
+# For FIPS
+#.include "../config/fipsmodule.cnf"
+
+openssl_init
+#providers = provider_sect
+alg_section = evp_properties
+
+# List of providers to load
+provider_sect
+default = default_sect
+#fips = fips_sect
+
+# To enforce FIPS mode for the application
+evp_properties
+#default_properties = "fips=yes"
+
+default_sect
+activate = 1
 
  req 
 # comment out the next line to protect the private key with a passphrase
 encrypt_key                     = no
 # the default key length is secure and quite fast - do not change it
 default_bits                    = 2048
-default_md                      = sha1
+default_md                      = sha256
 x509_extensions                 = stunnel_extensions
 distinguished_name              = stunnel_dn
 
  stunnel_extensions 
-nsCertType                      = server
+nsCertType                      = server, client
 basicConstraints                = CA:TRUE,pathlen:0
-keyUsage                        = keyCertSign
-extendedKeyUsage                = serverAuth
+keyUsage                        = keyCertSign, digitalSignature, keyEncipherment
+extendedKeyUsage                = serverAuth, clientAuth
 nsComment                       = "stunnel self-signed certificate"
 
  stunnel_dn

_service:tar_scm:stunnel-5.69.tar.gz/tools/stunnel.bash Added

_service:tar_scm:stunnel-5.48.tar.gz/tools/stunnel.conf -> _service:tar_scm:stunnel-5.69.tar.gz/tools/stunnel.conf Changed

@@ -1,4 +1,4 @@
-; Sample stunnel configuration file for Win32 by Michal Trojnara 2002-2018
+; Sample stunnel configuration file for Win64 by Michal Trojnara 2002-2023
 ; Some options used here may be inadequate for your particular configuration
 ; This sample file does *not* represent stunnel.conf defaults
 ; Please consult the manual for detailed description of available options
@@ -18,14 +18,20 @@
 ; stored in the Windows certificate store
 ; Each section using this feature also needs the "engineId = capi" option
 ;engine = capi
+; You also need to disable TLS 1.2 or later, because the CryptoAPI engine
+; currently does not support PSS
+;sslVersionMax = TLSv1.1
+; TLSv1.1 requires security level 0 when compiled OpenSSL 3.0 and later
+;securityLevel = 0
 
 ; The pkcs11 engine allows for authentication with cryptographic
 ; keys isolated in a hardware or software token
 ; MODULE_PATH specifies the path to the pkcs11 module shared library,
-; e.g. softhsm2.dll or opensc-pkcs11.so
+; such as softhsm2-x64.dll or opensc-pkcs11.dll
+; IMPORTANT: A 64-bit stunnel requires 64-bit PKCS#11 modules
 ; Each section using this feature also needs the "engineId = pkcs11" option
 ;engine = pkcs11
-;engineCtrl = MODULE_PATH:softhsm2.dll
+;engineCtrl = MODULE_PATH:softhsm2-x64.dll
 ;engineCtrl = PIN:1234
 
 ; **************************************************************************
@@ -108,6 +114,9 @@
 ;connect = 143
 ;cert = stunnel.pem
 
+; Either only expose this service to trusted networks, or require
+; authentication when relaying emails originated from loopback.
+; Otherwise the following configuration creates an open relay.
 ;ssmtp
 ;accept  = 465
 ;connect = 25
@@ -129,7 +138,6 @@
 ;accept = 1337
 ;exec = c:\windows\system32\cmd.exe
 ;execArgs = cmd.exe
-;ciphers = PSK
 ;PSKsecrets = secrets.txt
 
 ; vim:ft=dosini

_service:tar_scm:stunnel-5.48.tar.gz/tools/stunnel.conf-sample.in -> _service:tar_scm:stunnel-5.69.tar.gz/tools/stunnel.conf-sample.in Changed

_service:tar_scm:stunnel-5.48.tar.gz/tools/stunnel.init.in -> _service:tar_scm:stunnel-5.69.tar.gz/tools/stunnel.init.in Changed

@@ -26,7 +26,6 @@
 NAME=stunnel
 DESC="TLS tunnels"
 OPTIONS=""
-ENABLED=0
 
 get_opt() {
   sed -e "s;^:space:*;;" -e "s;:space:*$;;" \
@@ -57,7 +56,7 @@
     ulimit $RLIMITS
   fi
   res=0
-  for file in $FILES; do 
+  for file in $FILES; do
     if  -f $file ; then
       echo -n " $file: "
       args="$file $OPTIONS"
@@ -86,7 +85,7 @@
 {
   local sig file pidfile status
 
-  sig=${1:-TERM}
+  sig=$1
   res=0
   for file in $FILES; do
     echo -n " $file: "
@@ -95,7 +94,7 @@
       echo -n "no pid file"
     else
       status=0
-      killproc -p "$pidfile" "$DAEMON" "$sig" || status=$?
+      killproc -p "$pidfile" "$DAEMON" ${sig:+"$sig"} || status=$?
       if  "$status" -eq 0 ; then
         echo -n 'stopped'
       else
@@ -183,10 +182,6 @@
 fi
 
  -f @sysconfdir@/default/stunnel  && . @sysconfdir@/default/stunnel
-if  "$ENABLED" = "0"  ; then
-  echo "$DESC disabled, see @sysconfdir@/default/stunnel"
-  exit 0
-fi
 
 # If the user want to manage a single tunnel, the conf file's name
 # is in $2. Otherwise, respect @sysconfdir@/default/stunnel4 setting.
@@ -229,7 +224,7 @@
     echo -n "Reloading configuration $DESC:"
     killdaemons HUP
     res=$?
-    ;;  
+    ;;
   restart)
     echo -n "Restarting $DESC:"
     killdaemons && startdaemons

_service:tar_scm:stunnel-5.48.tar.gz/tools/stunnel.license -> _service:tar_scm:stunnel-5.69.tar.gz/tools/stunnel.license Changed

_service:tar_scm:stunnel-5.48.tar.gz/tools/stunnel.nsi -> _service:tar_scm:stunnel-5.69.tar.gz/tools/stunnel.nsi Changed

@@ -1,7 +1,10 @@
-# NSIS stunnel installer by Michal Trojnara 1998-2018
+# NSIS stunnel installer by Michal Trojnara 1998-2023
 
 !define /ifndef VERSION testing
 !define /ifndef ARCH win32
+!define /ifndef LIB lib64
+!define /ifndef SUFFIX 3
+!define /ifndef ENABLE_FIPS 0
 
 !define REGKEY_INSTALL "Software\NSIS_stunnel"
 !define REGKEY_UNINST \
@@ -27,35 +30,43 @@
 !define MUI_FINISHPAGE_RUN "$INSTDIR\bin\stunnel.exe"
 !define MUI_FINISHPAGE_RUN_TEXT "Start stunnel after installation"
 !define MUI_FINISHPAGE_RUN_NOTCHECKED
+!define MUI_FINISHPAGE_NOAUTOCLOSE
+!define MUI_UNFINISHPAGE_NOAUTOCLOSE
+
 !include "MUI2.nsh"
 # define SF_SELECTED
 !include "Sections.nsh"
-# additional plugins
-!addplugindir "plugins/SimpleFC"
-!addplugindir "plugins/ShellLink/Plugins"
 
 !define /ifndef ROOT_DIR \devel
 
 !define /ifndef STUNNEL_DIR ${ROOT_DIR}\src\stunnel
-!define /ifndef STUNNEL_BIN_DIR ${STUNNEL_DIR}\bin\${ARCH}
 !define /ifndef STUNNEL_TOOLS_DIR ${STUNNEL_DIR}\tools
-!define /ifndef STUNNEL_DOC_DIR ${STUNNEL_DIR}\doc
 !define /ifndef STUNNEL_SRC_DIR ${STUNNEL_DIR}\src
 
+!define /ifndef DEST_DIR ${STUNNEL_DIR}
+!define /ifndef STUNNEL_BIN_DIR ${DEST_DIR}\bin\${ARCH}
+!define /ifndef STUNNEL_DOC_DIR ${DEST_DIR}\doc
+
 !define /ifndef BIN_DIR ${ROOT_DIR}\${ARCH}
 !define /ifndef OPENSSL_DIR ${BIN_DIR}\openssl
 !define /ifndef OPENSSL_BIN_DIR ${OPENSSL_DIR}\bin
-!if ${ARCH} == win32
-!define /ifndef OPENSSL_ENGINES_DIR ${OPENSSL_DIR}\lib\engines
-!else
-!define /ifndef OPENSSL_ENGINES_DIR ${OPENSSL_DIR}\lib\engines-1_1
+!define /ifndef OPENSSL_ENGINES_DIR ${OPENSSL_DIR}\${LIB}\engines-${SUFFIX}
+!if ${SUFFIX} == "3"
+!define /ifndef OPENSSL_OSSLMODULES_DIR ${OPENSSL_DIR}\${LIB}\ossl-modules
 !endif
 !define /ifndef ZLIB_DIR ${BIN_DIR}\zlib
 !define /ifndef REDIST_DIR ${BIN_DIR}\redist
 
+!if ${SUFFIX} == "3"
+!include "${STUNNEL_TOOLS_DIR}/ReplaceInFile3.nsh"
+!endif
+
+# additional plugins
+!addplugindir "${STUNNEL_TOOLS_DIR}/plugins/"
+
 !define MUI_ICON ${STUNNEL_SRC_DIR}\stunnel.ico
 
-!insertmacro MUI_PAGE_LICENSE "stunnel.license"
+!insertmacro MUI_PAGE_LICENSE "${STUNNEL_TOOLS_DIR}\stunnel.license"
 !insertmacro MULTIUSER_PAGE_INSTALLMODE
 !insertmacro MUI_PAGE_COMPONENTS
 !insertmacro MUI_PAGE_DIRECTORY
@@ -158,6 +169,7 @@
 !macro CleanupStunnelFiles
   # current versions
   Delete "$INSTDIR\config\openssl.cnf"
+  Delete "$INSTDIR\config\fipsmodule.cnf"
 
   Delete "$INSTDIR\bin\stunnel.exe"
   Delete "$INSTDIR\bin\stunnel.pdb"
@@ -173,11 +185,24 @@
   Delete "$INSTDIR\bin\zlib1.pdb"
   Delete "$INSTDIR\bin\msvcr90.dll"
   Delete "$INSTDIR\bin\Microsoft.VC90.CRT.Manifest"
+  Delete "$INSTDIR\bin\libcrypto-1_1.dll"
+  Delete "$INSTDIR\bin\libcrypto-1_1.pdb"
+  Delete "$INSTDIR\bin\libssl-1_1.dll"
+  Delete "$INSTDIR\bin\libssl-1_1.pdb"
   Delete "$INSTDIR\bin\libcrypto-1_1-x64.dll"
   Delete "$INSTDIR\bin\libcrypto-1_1-x64.pdb"
   Delete "$INSTDIR\bin\libssl-1_1-x64.dll"
   Delete "$INSTDIR\bin\libssl-1_1-x64.pdb"
+  Delete "$INSTDIR\bin\libcrypto-3.dll"
+  Delete "$INSTDIR\bin\libcrypto-3.pdb"
+  Delete "$INSTDIR\bin\libssl-3.dll"
+  Delete "$INSTDIR\bin\libssl-3.pdb"
+  Delete "$INSTDIR\bin\libcrypto-3-x64.dll"
+  Delete "$INSTDIR\bin\libcrypto-3-x64.pdb"
+  Delete "$INSTDIR\bin\libssl-3-x64.dll"
+  Delete "$INSTDIR\bin\libssl-3-x64.pdb"
   Delete "$INSTDIR\bin\vcruntime140.dll"
+  Delete "$INSTDIR\bin\libssp-0.dll"
   RMDir "$INSTDIR\bin"
 
   Delete "$INSTDIR\engines\4758cca.dll"
@@ -208,6 +233,12 @@
   Delete "$INSTDIR\engines\pkcs11.pdb"
   RMDir "$INSTDIR\engines"
 
+  Delete "$INSTDIR\ossl-modules\fips.dll"
+  Delete "$INSTDIR\ossl-modules\fips.pdb"
+  Delete "$INSTDIR\ossl-modules\legacy.dll"
+  Delete "$INSTDIR\ossl-modules\legacy.pdb"
+  RMDir "$INSTDIR\ossl-modules"
+
   Delete "$INSTDIR\doc\*.html"
   RMDir "$INSTDIR\doc"
 
@@ -324,15 +355,64 @@
   SetOutPath "$INSTDIR\bin"
   File "${STUNNEL_BIN_DIR}\stunnel.exe"
   !if ${ARCH} == win32
-  File "${OPENSSL_BIN_DIR}\libeay32.dll"
-  File "${OPENSSL_BIN_DIR}\ssleay32.dll"
-  File "${REDIST_DIR}\msvcr90.dll"
-  File "${REDIST_DIR}\Microsoft.VC90.CRT.Manifest"
-  # MINGW builds requires libssp-0.dll instead of msvcr90.dll
+  # Visual C++ 2008
+  #File "${OPENSSL_BIN_DIR}\libeay32.dll"
+  #File "${OPENSSL_BIN_DIR}\ssleay32.dll"
+  #File "${REDIST_DIR}\msvcr90.dll"
+  #File "${REDIST_DIR}\Microsoft.VC90.CRT.Manifest"
+  File "${OPENSSL_BIN_DIR}\libcrypto-${SUFFIX}.dll"
+  File "${OPENSSL_BIN_DIR}\libssl-${SUFFIX}.dll"
+  !if /FileExists "/usr/i686-w64-mingw32/bin/libssp-0.dll"
+  File "/usr/i686-w64-mingw32/bin/libssp-0.dll"
+  !else
+  !if /FileExists "/usr/lib/gcc/i686-w64-mingw32/10-win32/libssp-0.dll"
+  File "/usr/lib/gcc/i686-w64-mingw32/10-win32/libssp-0.dll"
+  !else
+  !if /FileExists "/usr/lib/gcc/i686-w64-mingw32/9.3-win32/libssp-0.dll"
+  File "/usr/lib/gcc/i686-w64-mingw32/9.3-win32/libssp-0.dll"
+  !else
+  !if /FileExists "/usr/lib/gcc/i686-w64-mingw32/8.3-win32/libssp-0.dll"
+  File "/usr/lib/gcc/i686-w64-mingw32/8.3-win32/libssp-0.dll"
+  !else
+  !if /FileExists "/usr/i686-w64-mingw32/sys-root/mingw/bin/libssp-0.dll"
+  File "/usr/i686-w64-mingw32/sys-root/mingw/bin/libssp-0.dll"
+  !endif
+  !endif
+  !endif
+  !endif
+  !endif
   !else
-  File "${OPENSSL_BIN_DIR}\libcrypto-1_1-x64.dll"
-  File "${OPENSSL_BIN_DIR}\libssl-1_1-x64.dll"
-  File "${REDIST_DIR}\vcruntime140.dll"
+  File "${OPENSSL_BIN_DIR}\libcrypto-${SUFFIX}-x64.dll"
+  File "${OPENSSL_BIN_DIR}\libssl-${SUFFIX}-x64.dll"
+  !if /FileExists "/usr/x86_64-w64-mingw32/bin/libssp-0.dll"
+  File "/usr/x86_64-w64-mingw32/bin/libssp-0.dll"
+  !else
+  !if /FileExists "/usr/lib/gcc/x86_64-w64-mingw32/10-win32/libssp-0.dll"
+  File "/usr/lib/gcc/x86_64-w64-mingw32/10-win32/libssp-0.dll"
+  !else
+  !if /FileExists "/usr/lib/gcc/x86_64-w64-mingw32/9.3-win32/libssp-0.dll"
+  File "/usr/lib/gcc/x86_64-w64-mingw32/9.3-win32/libssp-0.dll"
+  !else
+  !if /FileExists "/usr/lib/gcc/x86_64-w64-mingw32/8.3-win32/libssp-0.dll"
+  File "/usr/lib/gcc/x86_64-w64-mingw32/8.3-win32/libssp-0.dll"
+  !else
+  !if /FileExists "/usr/x86_64-w64-mingw32/sys-root/mingw/bin/libssp-0.dll"
+  File "/usr/x86_64-w64-mingw32/sys-root/mingw/bin/libssp-0.dll"
+  !endif
+  !endif
+  !endif
+  !endif
+  !endif
+  #SetOutPath "$INSTDIR"
+  #ReadRegStr $0 HKLM "SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64" "Installed"
+  #${If} $0 == 1
+  #  DetailPrint "VC 2017 Redistributable already installed"
+  #${Else}
+  #  DetailPrint "Installing VC 2017 Redistributable"
+  #  File "${REDIST_DIR}\VC_redist.x64.exe"
+  #  ExecWait '"$INSTDIR\VC_redist.x64.exe" /quiet'
+  #  Delete "$INSTDIR\VC_redist.x64.exe"
+  #${EndIf}
   !endif
 
   # write new engine libraries
@@ -341,6 +421,15 @@
   File "${OPENSSL_ENGINES_DIR}\padlock.dll"
   File "${OPENSSL_ENGINES_DIR}\pkcs11.dll"
 
+  # write new provider libraries
+  !if ${SUFFIX} == "3"
+  SetOutPath "$INSTDIR\ossl-modules"
+  !if ${ENABLE_FIPS}
+  File "${OPENSSL_OSSLMODULES_DIR}\fips.dll"
+  !endif
+  File "${OPENSSL_OSSLMODULES_DIR}\legacy.dll"
+  !endif
+
   # write new documentation
   SetOutPath "$INSTDIR\doc"
   File "${STUNNEL_DOC_DIR}\stunnel.html"
@@ -368,8 +457,45 @@
 Section "openssl.exe" sectionOPENSSL
   SetOutPath "$INSTDIR\bin"
   File "${OPENSSL_BIN_DIR}\openssl.exe"
+
   SetOutPath "$INSTDIR\config"
   File "${STUNNEL_TOOLS_DIR}\openssl.cnf"
+!if ${SUFFIX} == "3"
+  Push "#providers = provider_sect"     # text to be replaced
+  Push "providers = provider_sect"      # replace with
+  Push 1                                # start replacing at the 1st occurrence
+  Push 1                                # replace 1 occurrences onwards, in all
+  Push "$INSTDIR\config\openssl.cnf"    # file to replace in
+  Call AdvReplaceInFile
+!endif
+
+!if ${ENABLE_FIPS}
+  # create fipsmodule.cnf
+  ExecWait '"$INSTDIR\bin\openssl.exe" fipsinstall -module "$INSTDIR\ossl-modules\fips.dll" \
+    -out "$INSTDIR\config\fipsmodule.cnf" -provider_name fips'
+
+  # modify fipsmodule.cnf and openssl.cnf to enable FIPS mode
+  Push "activate = 1"                   # text to be replaced
+  Push "#activate = 1"                  # replace with
+  Push 1                                # start replacing at the 1st occurrence
+  Push 1                                # replace 1 occurrences onwards, in all
+  Push "$INSTDIR\config\fipsmodule.cnf" # file to replace in
+  Call AdvReplaceInFile
+
+  Push "#.include"                      # text to be replaced
+  Push ".include"                       # replace with
+  Push 1                                # start replacing at the 1st occurrence
+  Push 1                                # replace 1 occurrences onwards, in all
+  Push "$INSTDIR\config\openssl.cnf"    # file to replace in
+  Call AdvReplaceInFile
+
+  Push "#fips = fips_sect"              # text to be replaced
+  Push "fips = fips_sect"               # replace with
+  Push 1                                # start replacing at the 1st occurrence
+  Push 1                                # replace 1 occurrences onwards, in all
+  Push "$INSTDIR\config\openssl.cnf"    # file to replace in
+  Call AdvReplaceInFile
+!endif
 
   # create stunnel.pem
   IfSilent no_new_pem
@@ -478,6 +604,7 @@
 
 SectionGroupEnd
 
+/*
 Section /o "Debugging Symbols" sectionDEBUG
   SetOutPath "$INSTDIR\bin"
 
@@ -488,8 +615,8 @@
   File "${OPENSSL_BIN_DIR}\ssleay32.pdb"
   File "${ZLIB_DIR}\zlib1.pdb"
   !else
-  File "${OPENSSL_BIN_DIR}\libcrypto-1_1-x64.pdb"
-  File "${OPENSSL_BIN_DIR}\libssl-1_1-x64.pdb"
+  File "${OPENSSL_BIN_DIR}\libcrypto-${SUFFIX}-x64.pdb"
+  File "${OPENSSL_BIN_DIR}\libssl-${SUFFIX}-x64.pdb"
   !endif
 
   # optional tstunnel.exe
@@ -510,9 +637,15 @@
   SetOutPath "$INSTDIR\engines"
   File "${OPENSSL_ENGINES_DIR}\capi.pdb"
   File "${OPENSSL_ENGINES_DIR}\padlock.pdb"
-  # File "${OPENSSL_ENGINES_DIR}\pkcs11.pdb"
+  File "${OPENSSL_ENGINES_DIR}\pkcs11.pdb"
+
+  # providers
+  SetOutPath "$INSTDIR\ossl-modules"
+  File "${OPENSSL_OSSLMODULES_DIR}\fips.pdb"
+  File "${OPENSSL_OSSLMODULES_DIR}\legacy.pdb"
   SetOutPath "$INSTDIR"
 SectionEnd
+*/
 
 Section
   !insertmacro RestartStunnel
@@ -523,9 +656,7 @@
   !insertmacro CleanupStunnelFiles
 
   # remove the stunnel directory
-  Delete "$INSTDIR\config\stunnel.pem"
-  Delete "$INSTDIR\config\stunnel.conf"
-  RMDir "$INSTDIR\config"
+  RMDir /r "$INSTDIR\config"
   Delete "$INSTDIR\uninstall.exe"
   RMDir "$INSTDIR"
 
@@ -550,8 +681,10 @@
   "Installs the Start Menu shortcuts for managing stunnel."
 LangString DESC_sectionDESKTOP ${LANG_ENGLISH} \
   "Installs the Desktop shortcut for stunnel."
+/*
 LangString DESC_sectionDEBUG ${LANG_ENGLISH} \
   "Installs the .PDB (program database) files for the executables and libraries."
+*/
 LangString DESC_groupTOOLS ${LANG_ENGLISH} \
   "Installs optional (but useful) tools."
 LangString DESC_groupSHORTCUTS ${LANG_ENGLISH} \
@@ -563,7 +696,9 @@
     !insertmacro MUI_DESCRIPTION_TEXT ${sectionTSTUNNEL} $(DESC_sectionTSTUNNEL)
     !insertmacro MUI_DESCRIPTION_TEXT ${sectionMENU} $(DESC_sectionMENU)
     !insertmacro MUI_DESCRIPTION_TEXT ${sectionDESKTOP} $(DESC_sectionDESKTOP)
+/*
     !insertmacro MUI_DESCRIPTION_TEXT ${sectionDEBUG} $(DESC_sectionDEBUG)
+*/
     !insertmacro MUI_DESCRIPTION_TEXT ${groupTOOLS} $(DESC_groupTOOLS)
     !insertmacro MUI_DESCRIPTION_TEXT ${groupSHORTCUTS} $(DESC_groupSHORTCUTS)
 !insertmacro MUI_FUNCTION_DESCRIPTION_END

_service:tar_scm:stunnel-5.48.tar.gz/tools/stunnel.service.in -> _service:tar_scm:stunnel-5.69.tar.gz/tools/stunnel.service.in Changed

_service:tar_scm:stunnel-5.48.tar.gz/tools/stunnel.spec -> _service:tar_scm:stunnel-5.69.tar.gz/tools/stunnel.spec Changed

@@ -1,100 +1,105 @@
 Name: stunnel
-Version: 5.48
+Version: 5.69
 Release: 1%{?dist}
 Summary: An TLS-encrypting socket wrapper
 Group: Applications/Internet
 License: GPLv2
-URL: http://www.stunnel.org/
+URL: https://www.stunnel.org/
 Source0: https://www.stunnel.org/downloads/stunnel-%{version}.tar.gz
-Source1: %{name}.init
-Source2: %{name}.logrotate
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
-BuildRequires: openssl-devel
-BuildRequires: tcp_wrappers-devel
-Requires(pre): shadow-utils
-Requires(post): chkconfig
-Requires(preun): chkconfig
-Requires(postun): initscripts
+# util-linux is needed for rename
+BuildRequires: openssl-devel, util-linux
+%if 0%{?fedora} >= 15 || 0%{?rhel} >= 7
+BuildRequires: systemd-units
+Requires(post): systemd-units
+Requires(preun): systemd-units
+Requires(postun): systemd-units
+%endif
 
 %description
 Stunnel is a socket wrapper which can provide TLS (Transport Layer Security) support to ordinary applications. For example, it can be used
 in conjunction with imapd to create an TLS secure IMAP server.
 
+# Do not generate provides for private libraries
+%global __provides_exclude_from ^%{_libdir}/stunnel/.*$
+
 %prep
 %setup -q
 
 %build
-%configure --enable-fips --enable-ipv6 --with-ssl=%{_prefix}\
- --sysconfdir=%{_sysconfdir}\
- CPPFLAGS="-UPIDFILE -DPIDFILE='\"%{_localstatedir}/lib/%{name}/%{name}.pid\"'"
-make LDADD="-pie -Wl,-z,defs,-z,relro,-z,now" %{?_smp_mflags}
-
-
+%configure --enable-fips --enable-ipv6 --with-ssl=%{_prefix} \
+ CPPFLAGS="-UPIDFILE -DPIDFILE='\"%{_localstatedir}/run/stunnel.pid\"'"
+make V=1
 
 %install
-rm -rf $RPM_BUILD_ROOT
-make install DESTDIR=$RPM_BUILD_ROOT
-%{__mv} $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/%{name}.conf-sample\
- $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/%{name}.conf
-%{__install} -d $RPM_BUILD_ROOT%{_initrddir}
-%{__install} -d $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig
-%{__install} -d $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d
-%{__install} -d $RPM_BUILD_ROOT%{_sysconfdir}/%{name}/conf.d
-%{__install} -d $RPM_BUILD_ROOT%{_localstatedir}/log/%{name}
-%{__install} -d $RPM_BUILD_ROOT%{_localstatedir}/lib/%{name}
-%{__install} -p -m0755 %{SOURCE1} $RPM_BUILD_ROOT%{_initrddir}/%{name}
-%{__install} -p -m0644 %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/%{name}
+make install DESTDIR=%{buildroot}
+# Move the translated man pages to the right subdirectories, and strip off the
+# language suffixes.
 for lang in pl ; do
- mkdir -p $RPM_BUILD_ROOT/%{_mandir}/${lang}/man8
- mv $RPM_BUILD_ROOT/%{_mandir}/man8/*.${lang}.8* $RPM_BUILD_ROOT/%{_mandir}/${lang}/man8/
- rename ".${lang}" "" $RPM_BUILD_ROOT/%{_mandir}/${lang}/man8/*
+ mkdir -p %{buildroot}/%{_mandir}/${lang}/man8
+ mv %{buildroot}/%{_mandir}/man8/*.${lang}.8* %{buildroot}/%{_mandir}/${lang}/man8/
+ rename ".${lang}" "" %{buildroot}/%{_mandir}/${lang}/man8/*
 done
-echo "# %{name} options" > $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig/%{name}
-
-%clean
-rm -rf $RPM_BUILD_ROOT
-
-%pre
-getent group %{name} >/dev/null || groupadd -f -r %{name}
-if ! getent passwd %{name} >/dev/null ; then
- useradd -r -g %{name} -d %{_localstatedir}/lib/%{name} \
- -s /sbin/nologin -c "%{name} user" %{name}
-fi
-exit 0
+%if 0%{?fedora} >= 15 || 0%{?rhel} >= 7
+mkdir -p %{buildroot}%{_unitdir}
+cp tools/%{name}.service %{buildroot}%{_unitdir}/%{name}.service
+mkdir -p %{buildroot}%{_datadir}/bash-completion/completions
+cp tools/%{name}.bash %{buildroot}%{_datadir}/bash-completion/completions/%{name}.bash
+%endif
 
 %post
 /sbin/ldconfig
-/sbin/chkconfig --add %{name}
+%if 0%{?fedora} >= 15 || 0%{?rhel} >= 7
+%systemd_post %{name}.service
+%endif
+
+%preun
+%if 0%{?fedora} >= 15 || 0%{?rhel} >= 7
+%systemd_preun %{name}.service
+%endif
 
 %postun
 /sbin/ldconfig
-if "$1" -ge "1" ; then
- /sbin/service %{name} restart >/dev/null 2>&1 || :
-fi
-
-%preun
-if $1 -eq 0 ; then
- /sbin/service %{name} stop >/dev/null 2>&1
- /sbin/chkconfig --del %{name}
-fi
+%if 0%{?fedora} >= 15 || 0%{?rhel} >= 7
+%systemd_postun_with_restart %{name}.service
+%endif
 
 %files
-%defattr(-,root,root,-)
-%doc COPYING COPYRIGHT.GPL README ChangeLog doc/stunnel.html
-%doc tools/ca.html tools/ca.pl tools/importCA.html tools/importCA.sh tools/openssl.cnf
-%{_bindir}/*
-%{_libdir}/%{name}
-%{_sysconfdir}/%{name}
-%{_initrddir}/%{name}
-%{_mandir}/man8/%{name}.*
-%{_mandir}/pl/man8/%{name}.*
-%config(noreplace) %{_sysconfdir}/sysconfig/%{name}
-%config(noreplace) %{_sysconfdir}/logrotate.d/%{name}
-%config(noreplace) %{_sysconfdir}/%{name}/%{name}.conf
-%attr(0750,%{name},%{name}) %{_localstatedir}/lib/%{name}
-%attr(0750,%{name},%{name}) %{_localstatedir}/log/%{name}
+%{!?_licensedir:%global license %%doc}
+%doc COPYING.md COPYRIGHT.md README.md NEWS.md AUTHORS.md BUGS.md CREDITS.md PORTS.md TODO.md
+%license COPY*
+%lang(en) %doc doc/en/*
+%lang(pl) %doc doc/pl/*
+%{_bindir}/stunnel
+%exclude %{_bindir}/stunnel3
+%exclude %{_datadir}/doc/stunnel
+%{_libdir}/stunnel
+%exclude %{_libdir}/stunnel/libstunnel.la
+%{_mandir}/man8/stunnel.8*
+%lang(pl) %{_mandir}/pl/man8/stunnel.8*
+%dir %{_sysconfdir}/%{name}
+%config %{_sysconfdir}/%{name}/*-sample
+%if 0%{?fedora} >= 15 || 0%{?rhel} >= 7
+%{_unitdir}/%{name}*.service
+%endif
+%config(noreplace) %{_datarootdir}/bash-completion/*
 
 %changelog
+* Fri Feb 24 2023 Małgorzata Olszówka <Malgorzata.Olszowka@stunnel.org>
+- Fixed bash completion support
+- Removed excluding pem files
+
+* Wed Mar 02 2022 Małgorzata Olszówka <Malgorzata.Olszowka@stunnel.org>
+- bash completion support
+
+* Fri Sep 24 2021 Michał Trojnara <Michal.Trojnara@stunnel.org>
+- Added systemd startup for Fedora >= 15 or RHEL >= 7
+- Removed obsolete init startup
+- Removed obsolete logrotate configuration (replaced with journalctl)
+- Removed obsolete tcp_wrappers-devel support
+- Removed creating a dedicated user
+- Simplified the .spec file
+
 * Wed Apr 27 2016 Andrew Colin Kissa <andrew@topdog.za.net> - 5.32-1
 - Added init script that actually works on Redhat
 - Lots of changes and cleanup to improve spec
@@ -111,7 +116,7 @@
 * Wed Mar 17 2004 neeo <neeo@irc.pl>
 - updated for 4.05
 
-* Sun Jun 24 2000 Brian Hatch <bri@stunnel.org>
+* Sat Jun 24 2000 Brian Hatch <bri@stunnel.org>
 - updated for 3.8p3
 
 * Wed Jul 14 1999 Dirk O. Siebnich <dok@vossnet.de>

Changes of Revision 2