2012-04-16 18:55:21 +02:00
|
|
|
# $NetBSD: Makefile,v 1.77 2012/04/16 16:55:21 ryoon Exp $
|
2000-04-03 11:25:35 +02:00
|
|
|
|
2012-04-16 18:55:21 +02:00
|
|
|
DISTNAME= stunnel-4.53
|
Update stunnel to 3.9. For NetBSD, if in-tree OpenSSL exists, then the
default certificate directory is now /etc/openssl/certs (matches OpenSSL's
default), but if stunnel uses the pkgsrc OpenSSL, then the default is
${PREFIX}/certs.
Changes from version 3.8 include:
* Updated temporary key generation:
- stunnel is now honoring requested key-lengths correctly,
- temporary key is changed every hour.
* transfer() no longer hangs on some platforms.
Special thanks to Peter Wagemans for the patch.
* Potential security problem with syslog() call fixed.
* use daemon() function instead of daemonize, if available
* added -S flag, allowing you to choose which default verify
sources to use
* relocated service name output logging until after log_open.
(no longer outputs log info to inetd socket, causing bad SSL)
* -V flag now outputs the default values used by stunnel
* Added rigerous PRNG seeding
* PID changes (and related security-fix)
* Man page fixes
* Client SSL Session-IDs now used
* -N flag to specify tcpwrapper service name
* UPGRADE NOTE: this version seriously changes several previous stunnel
default behaviours. There are no longer any default cert file/dirs
compilied into stunnel, you must use the --with-cert-dir and
--with-cert-file configure arguments to set these manually, if desired.
Stunnel does not use the underlying ssl library defaults by default
unless configured with --enable-ssllib-cs. Note that these can always
be enabled at run time with the -A,-a, and -S flags.
Additionally, unless --with-pem-dir is specified at compile time,
stunnel will default to looking for stunnel.pem in the current directory.
2000-12-19 08:03:21 +01:00
|
|
|
CATEGORIES= security
|
Update to 4.39
Version 4.39, 2011.07.06, urgency: LOW:
New features
New Win32 installer module to build self-signed stunnel.pem.
Added configuration file editing with Windows GUI.
Added log file reopening file editing with Windows GUI. It might be useful to also implement log file rotation.
Improved configuration file reload with Windows GUI.
Version 4.38, 2011.06.28, urgency: MEDIUM:
New features
Server-side SNI implemented (RFC 3546 section 3.1) with a new service-level option "nsi".
"socket" option also accepts "yes" and "no" for flags.
Nagle's algorithm is now disabled by default for improved interactivity.
Bugfixes
A compilation fix was added for OpenSSL version < 1.0.0.
Signal pipe set to non-blocking mode. This bug caused hangs of stunnel features based on signals, e.g. local mode, FORK threading, or configuration file reload on Unix. Win32 platform was not affected.
Version 4.37, 2011.06.17, urgency: MEDIUM:
New features
Client-side SNI implemented (RFC 3546 section 3.1).
Default "ciphers" changed from the OpenSSL default to a more secure and faster "RC4-MD5:HIGH:!aNULL:!SSLv2". A paranoid (and usually slower) setting would be "HIGH:!aNULL:!SSLv2".
Recommended "options = NO_SSLv2" added to the sample stunnel.conf file.
Default client method upgraded from SSLv3 to TLSv1. To connect servers without TLS support use "sslVersion = SSLv3" option.
Improved --enable-fips and --disable-fips ./configure option handling.
On startup stunnel now compares the compiled version of OpenSSL against the running version of OpenSSL. A warning is logged on mismatch.
Bugfixes
Non-blocking socket handling in local mode fixed (Debian bug #626856).
UCONTEXT threading mode fixed.
Removed the use of gcc Thread-Local Storage for improved portability.
va_copy macro defined for platforms that do not have it.
Fixed "local" option parsing on IPv4 systems.
Solaris compilation fix (redefinition of "STR").
Version 4.36, 2011.05.03, urgency: LOW:
New features
Updated Win32 DLLs for OpenSSL 1.0.0d.
Dynamic memory management for strings manipulation: no more static STRLEN limit, lower stack footprint.
Strict public key comparison added for "verify = 3" certificate checking mode (thx to Philipp Hartwig).
Backlog parameter of listen(2) changed from 5 to SOMAXCONN: improved behavior on heavy load.
Example tools/stunnel.service file added for systemd service manager.
Bugfixes
Missing pthread_attr_destroy() added to fix memory leak (thx to Paul Allex and Peter Pentchev).
Fixed the incorrect way of setting FD_CLOEXEC flag.
Fixed --enable-libwrap option of ./configure script.
/opt/local added to OpenSSL search path for MacPorts compatibility.
Workaround implemented for signal handling on MacOS X.
A trivial bug fixed in the stunnel.init script.
Retry implemented on EAI_AGAIN error returned by resolver calls.
Version 4.35, 2011.02.05, urgency: LOW:
New features
Updated Win32 DLLs for OpenSSL 1.0.0c.
Transparent source (non-local bind) added for FreeBSD 8.x.
Transparent destination ("transparent = destination") added for Linux.
Bugfixes
Fixed reload of FIPS-enabled stunnel.
Compiler options are now auto-detected by ./configure script in order to support obsolete versions of gcc.
Async-signal-unsafe s_log() removed from SIGTERM/SIGQUIT/SIGINT handler.
CLOEXEC file descriptor leaks fixed on Linux >= 2.6.28 with glibc >= 2.10. Irreparable race condition leaks remain on other Unix platforms. This issue may have security implications on some deployments: http://udrepper.livejournal.com/20407.html
Directory lib64 included in the OpenSSL library search path.
Windows CE compilation fixes (thx to Pierre Delaage).
Deprecated RSA_generate_key() replaced with RSA_generate_key_ex().
Domain name changes (courtesy of Bri Hatch)
http://stunnel.mirt.net/ --> http://www.stunnel.org/
ftp://stunnel.mirt.net/ --> http://ftp.stunnel.org/
stunnel.mirt.net::stunnel --> rsync.stunnel.org::stunnel
stunnel-users@mirt.net --> stunnel-users@stunnel.org
stunnel-announce@mirt.net --> stunnel-announce@stunnel.org
Version 4.34, 2010.09.19, urgency: LOW:
New features
Updated Win32 DLLs for OpenSSL 1.0.0a.
Updated Win32 DLLs for zlib 1.2.5.
Updated automake to version 1.11.1
Updated libtool to version 2.2.6b
Added ECC support with a new service-level "curve" option.
DH support is now enabled by default.
Added support for OpenSSL builds with some algorithms disabled.
./configure modified to support cross-compilation.
Sample stunnel.init updated based on Debian init script.
Bugfixes
Implemented fixes in user interface to enter engine PIN.
Fixed a transfer() loop issue on socket errors.
Fixed missing WIN32 taskbar icon while displaying a global option error.
2011-07-11 16:20:23 +02:00
|
|
|
MASTER_SITES= ftp://ftp.stunnel.org/stunnel/
|
2000-04-03 11:25:35 +02:00
|
|
|
|
2011-08-25 09:20:44 +02:00
|
|
|
MAINTAINER= pkgsrc-users@NetBSD.org
|
Update stunnel to 3.9. For NetBSD, if in-tree OpenSSL exists, then the
default certificate directory is now /etc/openssl/certs (matches OpenSSL's
default), but if stunnel uses the pkgsrc OpenSSL, then the default is
${PREFIX}/certs.
Changes from version 3.8 include:
* Updated temporary key generation:
- stunnel is now honoring requested key-lengths correctly,
- temporary key is changed every hour.
* transfer() no longer hangs on some platforms.
Special thanks to Peter Wagemans for the patch.
* Potential security problem with syslog() call fixed.
* use daemon() function instead of daemonize, if available
* added -S flag, allowing you to choose which default verify
sources to use
* relocated service name output logging until after log_open.
(no longer outputs log info to inetd socket, causing bad SSL)
* -V flag now outputs the default values used by stunnel
* Added rigerous PRNG seeding
* PID changes (and related security-fix)
* Man page fixes
* Client SSL Session-IDs now used
* -N flag to specify tcpwrapper service name
* UPGRADE NOTE: this version seriously changes several previous stunnel
default behaviours. There are no longer any default cert file/dirs
compilied into stunnel, you must use the --with-cert-dir and
--with-cert-file configure arguments to set these manually, if desired.
Stunnel does not use the underlying ssl library defaults by default
unless configured with --enable-ssllib-cs. Note that these can always
be enabled at run time with the -A,-a, and -S flags.
Additionally, unless --with-pem-dir is specified at compile time,
stunnel will default to looking for stunnel.pem in the current directory.
2000-12-19 08:03:21 +01:00
|
|
|
HOMEPAGE= http://www.stunnel.org/
|
2001-02-17 18:42:09 +01:00
|
|
|
COMMENT= Universal SSL tunnel
|
2009-07-10 13:23:10 +02:00
|
|
|
LICENSE= gnu-gpl-v2
|
2000-04-03 11:25:35 +02:00
|
|
|
|
2008-05-27 13:51:32 +02:00
|
|
|
PKG_DESTDIR_SUPPORT= user-destdir
|
|
|
|
|
|
2009-10-31 00:54:52 +01:00
|
|
|
BUILD_DEFS+= VARBASE
|
2006-10-14 13:12:19 +02:00
|
|
|
USE_LIBTOOL= yes
|
2005-09-28 22:52:18 +02:00
|
|
|
GNU_CONFIGURE= yes
|
2008-10-17 09:31:58 +02:00
|
|
|
CONFIGURE_ARGS+= --localstatedir=${VARBASE}
|
|
|
|
|
CONFIGURE_ARGS+= --sysconfdir=${PKG_SYSCONFDIR}
|
|
|
|
|
CONFIGURE_ARGS+= --with-cert-dir=${SSLCERTS:Q}
|
|
|
|
|
CONFIGURE_ARGS+= --with-pem-dir=${SSLCERTS:Q}
|
|
|
|
|
CONFIGURE_ARGS+= --with-ssl=${SSLBASE:Q}
|
2003-07-29 13:18:38 +02:00
|
|
|
|
2011-11-10 22:01:39 +01:00
|
|
|
.include "../../mk/bsd.prefs.mk"
|
|
|
|
|
|
2009-10-31 00:54:52 +01:00
|
|
|
STUNNEL_USER?= stunnel
|
|
|
|
|
STUNNEL_GROUP?= stunnel
|
|
|
|
|
PKG_HOME?= ${VARBASE}/chroot/stunnel
|
|
|
|
|
PKG_USERS= ${STUNNEL_USER}:${STUNNEL_GROUP}::Stunnel:${PKG_HOME}
|
|
|
|
|
PKG_GROUPS= ${STUNNEL_GROUP}
|
|
|
|
|
USER_GROUP= ${STUNNEL_USER} ${STUNNEL_GROUP}
|
|
|
|
|
|
2003-07-29 13:18:38 +02:00
|
|
|
PKG_SYSCONFSUBDIR= stunnel
|
2009-10-31 00:54:52 +01:00
|
|
|
PKG_SYSCONFDIR_PERMS= ${USER_GROUP} 0700
|
|
|
|
|
|
|
|
|
|
OWN_DIRS_PERMS= ${PKG_HOME} ${USER_GROUP} 0700
|
|
|
|
|
CONF_FILES_PERMS+= ${PREFIX}/share/examples/stunnel/stunnel.conf-sample \
|
|
|
|
|
${PKG_SYSCONFDIR}/stunnel.conf ${USER_GROUP} 0644
|
2000-04-03 19:37:51 +02:00
|
|
|
|
2004-06-06 16:19:04 +02:00
|
|
|
RCD_SCRIPTS= stunnel
|
2009-10-31 00:54:52 +01:00
|
|
|
|
2006-02-17 08:43:36 +01:00
|
|
|
REPLACE_PERL+= src/stunnel3.in
|
2006-06-16 11:23:22 +02:00
|
|
|
USE_TOOLS+= perl:run
|
2004-06-06 16:19:04 +02:00
|
|
|
|
2009-10-31 00:54:52 +01:00
|
|
|
SUBST_CLASSES+= chroot
|
|
|
|
|
SUBST_MESSAGE.chroot= Fix chroot path
|
|
|
|
|
SUBST_STAGE.chroot= pre-configure
|
|
|
|
|
SUBST_FILES.chroot= tools/stunnel.conf-sample.in
|
|
|
|
|
SUBST_SED.chroot+= -e 's|@prefix@/var/lib|@localstatedir@/chroot|'
|
|
|
|
|
|
|
|
|
|
SUBST_CLASSES+= stunnel
|
|
|
|
|
SUBST_MESSAGE.stunnel= Fix user and group
|
|
|
|
|
SUBST_STAGE.stunnel= post-configure
|
|
|
|
|
SUBST_FILES.stunnel= tools/stunnel.conf-sample
|
|
|
|
|
SUBST_SED.stunnel= -e 's|setuid = nobody|setuid = ${STUNNEL_USER}|'
|
|
|
|
|
SUBST_SED.stunnel+= -e 's|setgid = nogroup|setgid = ${STUNNEL_GROUP}|'
|
|
|
|
|
|
2007-08-11 16:41:36 +02:00
|
|
|
.include "options.mk"
|
2006-10-14 13:12:19 +02:00
|
|
|
|
2011-11-26 05:39:19 +01:00
|
|
|
.include "../../devel/zlib/buildlink3.mk"
|
2004-04-25 05:12:29 +02:00
|
|
|
.include "../../security/openssl/buildlink3.mk"
|
2000-04-03 11:25:35 +02:00
|
|
|
.include "../../mk/bsd.pkg.mk"
|
