stunnel 4.22 security =77

SSL encryption wrapper for standard network daemons
Maintained by: roam@FreeBSD.org
Port Added: unknown

---

---

The stunnel program is designed to work  as  SSL  encryption
wrapper between remote client and local (inetd-startable) or
remote server. The concept is that having non-SSL aware dae-
mons  running  on  your  system you can easily setup them to
communicate with clients over secure SSL channel.

stunnel can be used to add  SSL  functionality  to  commonly
used  inetd  daemons  like  POP-2,  POP-3  and  IMAP servers
without any changes in the programs' code.

WWW: http://stunnel.mirt.net/

CVSWeb : Sources : Main Web Site : Distfiles Availability : PortsMon

---

Required To Build: devel/libtool15

---

To install the port: cd /usr/ports/security/stunnel/ && make install clean
To add the package: pkg_add -r stunnel

---

Configuration Options

===> The following configuration options are available for stunnel-4.22:
     FORK=off (default) "use the fork(3) threading model"
     PTHREAD=on (default) "use the pthread(3) threading model (default)"
     UCONTEXT=off (default) "use the ucontext(3) threading model"
     IPV6=off (default) "enable IPv6 support"
===> Use 'make config' to modify these settings

---

Master Sites:

http://www.stunnel.org/download/stunnel/src/

ftp://stunnel.mirt.net/stunnel/

ftp://stunnel.mirt.net/stunnel/OBSOLETE/

ftp://opensores.thebunker.net/pub/mirrors/stunnel/download/stunnel/src/

ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/distfiles/

• 2007-10-29

  Affects: users of security/stunnel

  Author: roam@FreeBSD.org

  Reason: 
    In the 4.21 update there are two major user-visible changes:
    - the stunnel binary is in ${PREFIX}/bin/, no longer in ${PREFIX}/sbin/;
    - the libstunnel library is in ${PREFIX}/lib/stunnel/ instead of lib/.
  
    You may need to adjust your PATH settings or your scripts to accommodate
    the new location of the stunnel executable (and library, if there is
    actually anything using it).
  
  



• 2006-01-31

  Affects: users of security/stunnel

  Author: roam@FreeBSD.org

  Reason: 
    Since stunnel-4.14_1, the stunnel.pem certificate generated by
    "make cert" is installed into /usr/local/etc/stunnel/ instead of
    /usr/local/etc/.
  
  

Update to the release version of stunnel-4.22.

Forced commit to note that files/stunnel.sh was repo-copied to
files/stunnel.in before the USE_RC_SUBR transition in my last commit.

Finish the USE_RC_SUBR transition after marcus repo-copied stunnel.sh
to stunnel.in.
No functional changes once the port has been installed, thus
no PORTREVISION bump.

Update the stunnel port to version 4.22b2 to fix inetd mode logging[1].

While I'm here, pick up various changes from PR's:
- convert the startup script to the new style[2], but do not yet enable
  USE_RC_SUBR; a repo-copy of stunnel.sh to stunnel.in should be done first
- use ETCDIR instead of PREFIX/etc/stunnel everywhere[3]
- wave a magic wand over the startup script generation process to mimic
  the changes that will be done by USE_RC_SUBR after the repo-copy

Prompted by:    Damian Wiest <dwiest@vailsys.com> and
                Luis Rodrigo Gallardo Cruz <rodrigo@nul-unu.com> on
                the stunnel-users mailing list [1]
PR:             119655 [2] - only the changes to the startup script
                116773 [3] - only the ETCDIR part
Submitted by:   Jason DiCioccio <jd@ods.org> [2],
                Alexander Logvinov <ports@logvinov.com> [3]

Add an official fix for the chroot mode resolving bug.

Approved by:    portmgr (pav)

Update to stunnel-4.21.

Remove always-false/true conditions based on OSVERSION 500000

Reserve a user and group ID for the stunnel daemon.
Loosely based on the PR, although I just used the next available UID/GID.

PR:             108784
Submitted by:   Alex Kozlov <spam@rm-rf.kiev.ua>

Use libtool port instead of included version to avoid objformat a.out botch

Update to stunnel 4.20.

Update to stunnel 4.19 and fix the NOPORTDOCS installation to really
skip over the installation of example files and scripts.  Of course,
stunnel.conf-sample is still installed into etc/stunnel/.

Fix the problem with unattended deinstallation by not even attempting
to remove the stunnel user and group at all - just kill the package
deinstall script.

PR:             104028
Reported by:    jan grant <jan.grant@bristol.ac.uk>,
                Stephen Hurd <shurd@sasktel.net> (in private mail a while ago),
                and, I think, many others

A trivial update to stunnel-4.18 - Windows-related changes only.

Update to stunnel 4.17.

PR:             103123
Submitted by:   vd

Update to stunnel 4.15, which has the major new feature of almost all
connection options being configurable per connection, not global anymore.

Conversion to a single libtool environment.

Approved by:    portmgr (kris)

Catch up with stunnel's tools/Makefile to make the port's "make cert"
target actually work again.
Follow the upstream author's idea of keeping all stunnel-related
configuration files into ${PREFIX}/etc/stunnel/ - now "make cert" also
installs the certificate there instead of ${PREFIX}/etc/.
Bump PORTREVISION and add a note to UPDATING for the certificate
location change.

PR:             91991
Reported by:    Jiri Pridal <jiri.pridal@firebrno.cz>

SHA256ify

Approved by: krion@

Mass-conversion to the USE_AUTOTOOLS New World Order.  The code present
in bsd.autotools.mk essentially makes this a no-op given that all the
old variables set a USE_AUTOTOOLS_COMPAT variable, which is parsed in
exactly the same way as USE_AUTOTOOLS itself.

Moreover, USE_AUTOTOOLS has already been extensively tested by the GNOME
team -- all GNOME 2.12.x ports use it.

Preliminary documentation can be found at:
        http://people.FreeBSD.org/~ade/autotools.txt

which is in the process of being SGMLized before introduction into the
Porters Handbook.

Light blue touch-paper.  Run.

Update to stunnel 4.14, which is mostly a bugfix release.
Besides what's in the PR, also revert the pidfile location change to
preserve POLA and hier(7).

PR:             88436
Submitted by:   Vasil Dimov <vd@datamax.bg>

Update to 4.13, which ought to fix the libc_r detection problem in
a short window of 5.x versions.

PR:             87839
Submitted by:   Vasil Dimov <vd@datamax.bg>

Update to stunnel 4.11, which is deemed a stable release.
Remove our local patches for ucontext/pthread/fork model choice, since
this is handled by a configure argument now.
Note that ucontext is not supported on FreeBSD versions less than 5.0.

PR:             83245 (mostly)
Submitted by:   Vasil Dimov <vd@datamax.bg>

OPTIONS'ify, but still leave WITH_STUNNEL_SSL_ENGINE out of it - it is
a bit too dangerous to leave out in the open.

Fix the stunnel ucontext-related problems using a patch from the author,
Michael Trojnara[1].
Also, add the build-time WITH_FORK, WITH_PTHREAD, and WITH_UCONTEXT knobs
to control the stunnel threading model used, based on Vasil Dimov's PR's
with some modifications [2].
While I'm here, add in a <sys/types.h> inclusion that seems to be needed
for <ucontext.h> at least on FreeBSD 6.0/sparc64.

Reported by:    many
Pointy hat to:  roam (myself) for both not noticing this and then letting
                it linger for a while
Obtained from:  Michael Trojnara's BSD patch from
                <53594c631989fde6ca0bdb3435b93dfe@mirt.net> [1]
PR:             81289, 82202 [2]
Submitted by:   Vasil Dimov

- Fix deinstall script when running in BATCH mode.

PR:             ports/67762
Submitted by:   Linus Sjoberg <lsjoberg@aland.net>
Approved by:    maintainer timeout (7 weeks)

Update to 4.10, fixing the execvp() and pid file issues while I'm here.

PR:             79114, 79120, 80143, 80405
Submitted by:   Florian Hars <hars@bik-gmbh.de>,
                Jim Hatfield <jim.hatfield@insignia.com>,
                Vasil Dimov <vd@datamax.bg>,
                Vsevolod Stakhov <vsevolod@highsecure.ru>

At Kris's request, back out the MACHINE_ARCH spelling correction until
after 5.4-RELEASE.

Assist getting more ports working on AMD64 by obeying the
Ports Collection documentation and use 'ARCH' rather than 'MACHINE_ARCH'.

Update stunnel to 4.07, which incorporates most of our fixes to 4.06
and also fixes a crash if a client connection is closed too early.

Approved by:    portmgr (krion)

Okay then, purge the last reference to MySQL in the startup script...

The last update for this year, I hope :)
Make stunnel use the rc_subr framework, allowing for much cleaner
startup and shutdown of multiple instances of stunnel.

Fix a getnameinfo() out-of-memory error caused by passing a 20-character
buffer to hold a numeric IPv4/v6 address.  Of course, IPv6 addresses may
be a bit longer than 20 characters :)

A-ha! moment during:    discussion with the stunnel author

Fix the build on FreeBSD versions around 5.2 when EAI_NODATA was
temporarily aliased to EAI_NONAME.
No PORTREVISION bump, since this is a no-op on earlier and later versions,
and it didn't build at all until now on the affected versions.

Reported by:    Bretislav Kubesa <bretislav.kubesa@centrum.cz>

Update to stunnel-4.06.  In addition to the PR:
- enable the new IPv6 functionality when WITH_IPV6 is defined;
- at last move over to libtool-1.5 and get rid of the .la file;
- update the WITH_STUNNEL_SSL_ENGINE message to also mention FreeBSD 6.x;
- remove the obsolete sock_ioctlsocket() definition from patch-aa;
- fix a couple of getnameinfo(3)-related buglets;
- fix a poll(2)-related buglet: it seems FreeBSD insists (correctly) that
  INFTIM passed to poll(2) should be -1, not just any negative value.

PR:             75519 (somewhat)
Submitted by:   Dan Langille <dan@langille.org>

Fix the bus error on startup in -CURRENT and 5.x-BETA.  It turns out
that the OpenSSL ENGINE code is, well, somewhat less than stellar,
especially in combo with malloc's 'j' option.  Even without it, though,
there are some problems that I don't have time to look into right now.

So, disable the OpenSSL ENGINE activation on FreeBSD 5.x, unless
the WITH_STUNNEL_SSL_ENGINE knob is turned on.  Also, while I'm here,
fix the CONFIGURE_TARGET so the GNU configure script does not complain
quite so loudly.  Bump PORTREVISION for the functionality change
(well, I guess you could say "not working" -> "working" is a functionality
change ;)

BROKEN -> IGNORE, since this is a runtime error and the port itself builds
just fine.

Suggested by:   kris

Use DOCSDIR.

Mark broken on -CURRENT until I figure out why stunnel doesn't like
-CURRENT's OpenSSL.

Reported by:    dougb

And hot on the heels of the distsite update, here's the promised update
to 4.05 :)

Fix the distsites; an update to stunnel-4.05 is coming shortly, but still,
do this in the meantime.

PR:             67200
Submitted by:   Roman Neuhauser <neuhauser@chello.cz>

SIZEify (maintainer timeout)

Brian Hatch updated his RSA blinding patch to only apply
the blinding when really needed.  However, the name of
the patch file was not changed, which may confuse FreeBSD
distfile mirrors.  So, host the patch file in my local
FreeBSD cluster space, changing the file's name.

Reported by:    Dan Langille <dan@langille.org>

Add Brian Hatch's patch to enable RSA blinding on older OpenSSL versions.

Note: this patch is not needed for the 4.8-RELEASE ports tree, since
FreeBSD 4.8 will ship with a fixed OpenSSL version.  However, this patch
SHOULD be applied by anyone running stunnel with a version of OpenSSL
older than 0.9.7a, as reported by the 'openssl version' command.

Submitted by:   Brian Hatch <bri@stunnel.org>

Remove pkg-comment files in my ports.

Update to stunnel-4.04.

Independently submitted by:     Dan Langille <dan@langille.org>

Update to 4.03.

'make cert' fix submitted by:   Krzysztof Stryjek <wtp@mud.pl>

drop dummy certificate from package

remove IS_INTERACTIVE again.
No response from maintainer since 30.09.2002

Apply a blessed +3 magic wand of autotools protection; a rogue run of
autoconf or automake over our local patches can ruin your whole day.
This rarely, if ever, affected the vpopmail ports, causing mysterious
failures at install time, but inevitably killed the stunnel build if
automake-1.5 happened to be installed.

Reported by:    Dan Langille <dan@langille.org> for stunnel,
                Sitchin Zech <mailsagan@yahoo.com> for vpopmail

Update to stunnel-4.00.

*** WARNING WARNING WARNING ***
The stunnel invocation has changed!  The program no longer accepts
command-line options, but is controlled by a config file instead.
Please refer to the stunnel(8) manual page for more information.

PR:             42249
Submitted by:   Dan Langille <dan@langille.org>, lioux

Take over maintainership; I use this a lot.

Maintainer relenquishing ports.

PR:             42829
Submitted by:   Martti Kuparinen <martti.kuparinen@iki.fi>
Approved by:    maintainer

Unbreak Package-Build, removed IS_INTERACTIVE

PORT UPDATE : security/stunnel 3.21c -> 3.22    

upgrade to 3.21c    

Update to 3.21b, fixing a Makefile bogon and a file descriptor leak.   Add a new
knob, PEM_DIR, to specify the path to install the certificate   generated during
the stunnel build, and later, the one generated using   the 'cert' target of the
port Makefile.    

Update to 3.21.   Change USE_AUTOCONF to GNU_CONFIGURE; there have been no
configure.in   patches for some time now.    

Update the checksum after the distfile was rerolled.   No changes in the
distfile.    

Update the stunnel package to the latest version.    

Update to 3.19.    

o Update to 3.18   	* MAX_CLIENTS is calculated based on FD_SETSIZE, now.   	*
Problems with closing SSL in transfer() fixed.   	* -I option to bind a static
local IP address added.   	* Debug output of info_callback redesigned.   o
Reorder MASTER_SITES    

Update to stunnel 3.17    

Update to 3.16.    

Update to version 3.15    

Use non-blocking I/O by default.    

Update to 3.14.    

upgrade to 3.13 and change master site    

upgrade and change maintainer email    

Update to 3.11 and mark as interactive (prompts for information while  
generating a certificate).    

Update to 3.10.    

Upgrade to stunnel 3.9 to fix security vulnerabilities.    

Convert category security to new layout.  

Update all ports using OpenSSL and RSA to work without rsaref since   it is no
longer required. Apologies to the various maintainers whom I   did not yet hear
back from, but the ports freeze is coming up in a few   hours and I will be
verifying all of these ports on a 4.1 machine   myself to catch any problems.   

Update to version 3.8.4.    

17 vulnerabilities affecting 42 ports have been reported in the past 14 days

^* - modified, not new

All vulnerabilities