Changelog:
Version 4.53, 2012.03.19, urgency: MEDIUM:
* New features
- Added client-mode "sni" option to directly control the value of
TLS Server Name Indication (RFC 3546) extension.
- Added support for IP_FREEBIND socket option with a pached Linux kernel.
- Glibc-specific dynamic allocation tuning was applied to help unused memory
deallocation.
- Non-blocking OCSP implementation.
* Bugfixes
- Compilation fixes for old versions of OpenSSL (tested against 0.9.6).
- Usage of uninitialized variables fixed in exec+connect services.
- Occasional logging subsystem crash with exec+connect services.
- OpenBSD compilation fix (thx to Michele Orru').
- Session id context initialized with session name rather than a constant.
- Fixed handling of a rare inetd mode use case, where either stdin or stdout
is a socket, but not both of them at the same time.
- Fixed missing OPENSSL_Applink http://www.openssl.org/support/faq.html#PROG2
- Fixed crash on termination with FORK threading model.
- Fixed dead canary after configuration reload with open connections.
- Fixed missing file descriptors passed to local mode processes.
- Fixed required jmp_buf alignment on Itanium platform.
- Removed creating /dev/zero in the chroot jail on Solaris platform.
- Fixed detection of WSAECONNREFUSED Winsock error.
- Missing Microsoft.VC90.CRT.manifest added to Windows installer.
Version 4.52, 2012.01.12, urgency: MEDIUM:
* Bugfixes
- Fixed write closure notification for non-socket file descriptors.
- Removed a line logged to stderr in inetd mode.
- Fixed "Socket operation on non-socket" error in inetd mode on Mac OS X
platform.
- Removed direct access to the fields of the X509_STORE_CTX data structure.
Version 4.51, 2012.01.09, urgency: MEDIUM:
* New features
- Updated Win32 binary distribution OpenSSL DLLs to version 0.9.8s-fips.
- Updated Android binary OpenSSL to version 1.0.0f.
- Zlib support added to Win32 and Android binary builds.
- New "compression = deflate" global option to enable RFC 2246 compresion.
For compatibility with previous versions "compression = zlib" and
"compression = rle" also enable the deflate (RFC 2246) compression.
- Separate default ciphers and sslVersion for "fips = yes" and "fips = no".
- UAC support for editing configuration file with Windows GUI.
* Bugfixes
- Fixed exec+connect sections.
- Added a workaround for broken Android getaddrinfo():
http://stackoverflow.com/questions/7818246/segmentation-fault-in-getaddrinfo
Version 4.50, 2011.12.03, urgency: MEDIUM:
New features
Added Android port.
Updated INSTALL.FIPS.
Bugfixes
Fixed internal memory allocation problem in inetd mode.
Fixed FIPS mode on Microsoft Vista, Server 2008, and Windows 7. This fix required to compile OpenSSL FIPS-compliant DLLs with MSVC 9.0, instead of MSVC 10.0. msvcr100.dll was replaced with msvcr90.dll. GPL compatibility issues are explained in the GPL FAQ: http://www.gnu.org/licenses/gpl-faq.html#WindowsRuntimeAndGPL
POP3 server-side protocol negotiation updated to report STLS capability (thx to Anthony Morgan).
Version 4.49, 2011.11.28, urgency: MEDIUM:
Bugfixes
Missing Microsoft Visual C++ Redistributable (msvcr100.dll) required by FIPS-compliant OpenSSL library was added to the Windows installer.
A bug was fixed causing crashes on MacOS X and some other platforms.
Version 4.48, 2011.11.26, urgency: MEDIUM:
New features
FIPS support on Win32 platform added. OpenSSL 0.9.8r DLLs based on FIPS 1.2.3 canister are included with this version of stunnel. FIPS mode can be disabled with "fips = no" configuration file option.
Bugfixes
Fixed canary initialization problem on Win32 platform.
Version 4.47, 2011.11.21, urgency: MEDIUM:
Internal improvements
CVE-2010-3864 workaround improved to check runtime version of OpenSSL rather than compiled version, and to allow OpenSSL 0.x.x >= 0.9.8p.
Encoding of man page sources changed to UTF-8.
Bugfixes
Handling of socket/SSL close in transfer() function was fixed.
Logging was modified to save and restore system error codes.
Option "service" was restricted to Unix, as since stunnel 4.42 it wasn't doing anything useful on Windows platform.
Changelog:
Version 4.46, 2011.11.04, urgency: LOW:
* New features
- Added Unix socket support (e.g. "connect = /var/run/stunnel/socket").
- Added "verify = 4" mode to ignore CA chain and only verify peer certificate.
- Removed the limit of 16 IP addresses for a single 'connect' option.
- Removed the limit of 256 stunnel.conf sections in PTHREAD threading model.
It is still not possible have more than 63 sections on WIN32 platform.
http://msdn.microsoft.com/en-us/library/windows/desktop/ms740141(v=vs.85).aspx
* Optimizations
- Reduced per-connection memory usage.
- Performed a major refactoring of internal data structures. Extensive
internal testing was performed, but some regression bugs are expected.
* Bugfixes
- Fixed WIN32 compilation with Mingw32.
- Fixed non-blocking API emulation layer in UCONTEXT threading model.
- Fixed signal handling in UCONTEXT threading model.
set in PKG_SYSCONFDIR variable, so it is passed down to Makefile.
Configuration final path ends up being etc/stunnel/stunnel/stunnel.conf,
which is wrong.
- New features
- New verify level 0 to request and ignore peer certificate. This
feature is useful with the new Windows GUI menu to save cached peer
certificate chains, as SSL client certificates are not sent by default.
- Manual page has been updated.
- Removed support for changing Windows Service name with "service" option.
- Hardcoded 2048-bit DH parameters are used as a fallback if DH parameters
are not provided in stunnel.pem.
- Default "ciphers" value updated to prefer ECDH:
"ALL:!SSLv2:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH".
- Default ECDH curve updated to "prime256v1".
- Removed support for temporary RSA keys (used in obsolete export ciphers).
- Bugfixes
- The -quiet commandline option was applied to *all* message boxes.
- Silent install (/S option) no longer attempts to create stunnel.pem.
Version 4.39, 2011.07.06, urgency: LOW:
New features
New Win32 installer module to build self-signed stunnel.pem.
Added configuration file editing with Windows GUI.
Added log file reopening file editing with Windows GUI. It might be useful to also implement log file rotation.
Improved configuration file reload with Windows GUI.
Version 4.38, 2011.06.28, urgency: MEDIUM:
New features
Server-side SNI implemented (RFC 3546 section 3.1) with a new service-level option "nsi".
"socket" option also accepts "yes" and "no" for flags.
Nagle's algorithm is now disabled by default for improved interactivity.
Bugfixes
A compilation fix was added for OpenSSL version < 1.0.0.
Signal pipe set to non-blocking mode. This bug caused hangs of stunnel features based on signals, e.g. local mode, FORK threading, or configuration file reload on Unix. Win32 platform was not affected.
Version 4.37, 2011.06.17, urgency: MEDIUM:
New features
Client-side SNI implemented (RFC 3546 section 3.1).
Default "ciphers" changed from the OpenSSL default to a more secure and faster "RC4-MD5:HIGH:!aNULL:!SSLv2". A paranoid (and usually slower) setting would be "HIGH:!aNULL:!SSLv2".
Recommended "options = NO_SSLv2" added to the sample stunnel.conf file.
Default client method upgraded from SSLv3 to TLSv1. To connect servers without TLS support use "sslVersion = SSLv3" option.
Improved --enable-fips and --disable-fips ./configure option handling.
On startup stunnel now compares the compiled version of OpenSSL against the running version of OpenSSL. A warning is logged on mismatch.
Bugfixes
Non-blocking socket handling in local mode fixed (Debian bug #626856).
UCONTEXT threading mode fixed.
Removed the use of gcc Thread-Local Storage for improved portability.
va_copy macro defined for platforms that do not have it.
Fixed "local" option parsing on IPv4 systems.
Solaris compilation fix (redefinition of "STR").
Version 4.36, 2011.05.03, urgency: LOW:
New features
Updated Win32 DLLs for OpenSSL 1.0.0d.
Dynamic memory management for strings manipulation: no more static STRLEN limit, lower stack footprint.
Strict public key comparison added for "verify = 3" certificate checking mode (thx to Philipp Hartwig).
Backlog parameter of listen(2) changed from 5 to SOMAXCONN: improved behavior on heavy load.
Example tools/stunnel.service file added for systemd service manager.
Bugfixes
Missing pthread_attr_destroy() added to fix memory leak (thx to Paul Allex and Peter Pentchev).
Fixed the incorrect way of setting FD_CLOEXEC flag.
Fixed --enable-libwrap option of ./configure script.
/opt/local added to OpenSSL search path for MacPorts compatibility.
Workaround implemented for signal handling on MacOS X.
A trivial bug fixed in the stunnel.init script.
Retry implemented on EAI_AGAIN error returned by resolver calls.
Version 4.35, 2011.02.05, urgency: LOW:
New features
Updated Win32 DLLs for OpenSSL 1.0.0c.
Transparent source (non-local bind) added for FreeBSD 8.x.
Transparent destination ("transparent = destination") added for Linux.
Bugfixes
Fixed reload of FIPS-enabled stunnel.
Compiler options are now auto-detected by ./configure script in order to support obsolete versions of gcc.
Async-signal-unsafe s_log() removed from SIGTERM/SIGQUIT/SIGINT handler.
CLOEXEC file descriptor leaks fixed on Linux >= 2.6.28 with glibc >= 2.10. Irreparable race condition leaks remain on other Unix platforms. This issue may have security implications on some deployments: http://udrepper.livejournal.com/20407.html
Directory lib64 included in the OpenSSL library search path.
Windows CE compilation fixes (thx to Pierre Delaage).
Deprecated RSA_generate_key() replaced with RSA_generate_key_ex().
Domain name changes (courtesy of Bri Hatch)
http://stunnel.mirt.net/ --> http://www.stunnel.org/
ftp://stunnel.mirt.net/ --> http://ftp.stunnel.org/
stunnel.mirt.net::stunnel --> rsync.stunnel.org::stunnel
stunnel-users@mirt.net --> stunnel-users@stunnel.orgstunnel-announce@mirt.net --> stunnel-announce@stunnel.org
Version 4.34, 2010.09.19, urgency: LOW:
New features
Updated Win32 DLLs for OpenSSL 1.0.0a.
Updated Win32 DLLs for zlib 1.2.5.
Updated automake to version 1.11.1
Updated libtool to version 2.2.6b
Added ECC support with a new service-level "curve" option.
DH support is now enabled by default.
Added support for OpenSSL builds with some algorithms disabled.
./configure modified to support cross-compilation.
Sample stunnel.init updated based on Debian init script.
Bugfixes
Implemented fixes in user interface to enter engine PIN.
Fixed a transfer() loop issue on socket errors.
Fixed missing WIN32 taskbar icon while displaying a global option error.
- New features
- New service-level "libwrap" option for run-time control whether
/etc/hosts.allow and /etc/hosts.deny are used for access control.
Disabling libwrap significantly increases performance of stunnel.
- Log file reopen on USR1 signal was added.
- Graceful configuration reload with HUP signal on Unix
and with GUI on Windows.
- Bugfixes
- Inetd mode fixed
- Fixed a transfer() loop issue with SSLv2 connections.
- Fixed a "setsockopt IP_TRANSPARENT" warning with "local" option.
- Logging subsystem bugfixes and cleanup.
- Installer bugfixes for Vista and later versions of Windows.
- FIPS mode can be enabled/disabled at runtime.
Version 4.29, 2009.12.02, urgency: MEDIUM:
* New features sponsored by Searchtech Limited http://www.astraweb.com/
- sessiond, a high performance SSL session cache was built for stunnel.
A new service-level "sessiond" option was added. sessiond is
available for download on ftp://stunnel.mirt.net/stunnel/sessiond/ .
stunnel clusters will be a lot faster, now!
* Bugfixes
- "execargs" defaults to the "exec" parameter (thx to Peter Pentchev).
- Compilation fixes added for AIX and old versions of OpenSSL.
- Missing "fips" option was added to the manual.
Version 4.28, 2009.11.08, urgency: MEDIUM:
* New features
- Win32 DLLs for OpenSSL 0.9.8l.
- Transparent proxy support on Linux kernels >=2.6.28.
See the manual for details.
- New socket options to control TCP keepalive on Linux:
TCP_KEEPCNT, TCP_KEEPIDLE, TCP_KEEPINTVL.
- SSL options updated for the recent version of OpenSSL library.
* Bugfixes
- A serious bug in asynchronous shutdown code fixed.
- Data alignment updated in libwrap.c.
- Polish manual encoding fixed.
- Notes on compression implementation in OpenSSL added to the manual.
- fix the configuration path and file, so it can use the proper user:group
and the chroot
- fix some pkglint warnings regarding PKG_OPTIONS: 'pthread' => 'threads',
'libwrap' => 'tcpwrappers' (in accordance to mk/defaults/options.description)
Bump PKGREVISION.
- New features
- FIPS support was updated for openssl-fips 1.2.
- New priority failover strategy for multiple "connect" targets,
controlled with "failover=rr" (default) or "failover=prio".
- pgsql protocol negotiation by Marko Kreen <markokr@gmail.com>.
- Bugfixes
- Libwrap helper processes fixed to close standard
input/output/error file descriptors.
* libwrap related fixes, better debugging messages, MS Visual C++ support
Changes 4.25:
* delay libwrap process spawning after dropping privs, other improvements
only suggest pthread option when native pthread exists.
We cannot use pthread.buildlink3.mk to just detect if suituable pthread
implementation exist or not.
Avoid unwanted dependency on pthread package when no native pthread and
pthread option off.
* Move inclusion of seculity/tcp_wappers/buildlink3.mk to rightful place in
options.mk.
Avoid unwanted dependency on tcp_wrappers when libwrap option off.
* Remove deprecated(?) --with-tcp-wrappers from CONFIGURE_ARGS.
* Remove --enable-libwrap from CONFIGURE_ARGS even if require tcp_wrappers.
It affect not only check of existence of tcp_wappers but also blow off
needful addition of -lwrap to LIBS.
Fixes PR 39635
4.24: fix security problem (properly reject revoked certs)
4.23: WinNT bugfix
4.22:
- A new global option to control logging to syslog.
Simultaneous logging to a file and the syslog is now possible.
- A new service level option to control stack size.
- Restored chroot() to be executed after decoding numerical
userid and groupid values in drop_privileges().
- A few bugs fixed the in the new libwrap support code.
- TLSv1 method used by default in FIPS mode instead of
SSLv3 client and SSLv23 server methods.
4.21:
- Initial FIPS 140-2 support (see INSTALL.FIPS for details).
- Experimental fast support for non-MT-safe libwrap is provided
with pre-spawned processes.
- Stunnel binary moved from /usr/local/sbin to /usr/local/bin
in order to meet FHS and LSB requirements.
- Added code to disallow compiling stunnel with pthreads when
OpenSSL is compiled without threads support.
- Minor manual update.
- TODO file updated.
- Dynamic locking callbacks added (needed by some engines to work).
- AC_ARG_ENABLE fixed in configure.am to accept yes/no arguments.
- On some systems libwrap requires yp_get_default_domain from libnsl,
additional checking for libnsl was added to the ./configure script.
- Sending a list of trusted CAs for the client to choose the right
certificate restored.
- Some compatibility issues with NTLM authentication fixed.
Version 4.20, 2006.11.30, urgency: MEDIUM:
* Release notes
- The new transfer() function has been well tested.
I recommend upgrading any previous version with this one.
* Bugfixes
- Fixed support for encrypted passphases (broken in 4.19).
- Reduced amount of debug logs.
- A minor man page update.
Version 4.19, 2006.11.11, urgency: LOW/EXPERIMENTAL:
* Release notes
- There are a lot of new features in this version. I recommend
to test it well before upgrading your mission-critical systems.
* New features
- New service-level option to specify OCSP server flag:
OCSPflag = <flag>
- "protocolCredentials" option changed to "protocolUsername"
and "protocolPassword"
- NTLM support to be enabled with the new service-level option:
protocolAuthentication = NTLM
- imap protocol negotiation support added.
- Passphrase cache was added so the user does not need to reenter
the same passphrase for each defined service any more.
- New service-level option to retry connect+exec section:
retry = yes|no
- Local IP and port is logged for each established connection.
- Win32 DLLs for OpenSSL 0.9.8d.
* Bugfixes
- Serious problem with SSL_WANT_* retries fixed.
The new code requires extensive testing!
Version 4.18, 2006.09.26, urgency: MEDIUM:
* Bugfixes
- GPF on entering private key pass phrase on Win32 fixed.
- Updated OpenSSL Win32 DLLs.
- Minor configure script update.
Version 4.17, 2006.09.10, urgency: MEDIUM:
* New features
- Win32 DLLs for OpenSSL 0.9.8c.
* Bugfixes
- Problem with detecting getaddrinfo() in ./configure fixed.
- Compilation problem due to misplaced #endif in ssl.c fixed.
- Duplicate 220 in smtp_server() function in protocol.c fixed.
- Minor os2.mak update.
- Minor update of safestring()/safename() macros.
Version 4.16, 2006.08.31, urgency: MEDIUM:
* New features sponsored by Hewlett-Packard
- A new global option to control engine:
engineCtrl = <command>[:<parameter>]
- A new service-level option to select engine to read private key:
engineNum = <engine number>
- OCSP support:
ocsp = <URL>
* New features
- A new option to select version of SSL protocol:
sslVersion = all|SSLv2|SSLv3|TLSv1
- Visual Studio vc.mak by David Gillingham <dgillingham@gmail.com>.
- OS2 support by Paul Smedley (http://smedley.info)
* Bugfixes
- An ordinary user can install stunnel again.
- Compilation problem with --enable-dh fixed.
- Some minor compilation warnings fixed.
- Service-level CRL cert store implemented.
- GPF on protocol negotiations fixed.
- Problem detecting addrinfo() on Tru64 fixed.
- Default group is now detected by configure script.
- Check for maximum number of defined services added.
- OpenSSL_add_all_algorithms() added to SSL initialization.
- configure script sections reordered to detect pthread library funcions.
- RFC 2487 autdoetection improved. High resolution s_poll_wait()
not currently supported by UCONTEXT threading.
- More precise description of cert directory file names (thx to Muhammad
Muquit).
* Other changes
- Maximum number of services increased from 64 to 256 when poll() is used.
(PKG_SYSCONFDIR already includes "stunnel" by default, so avoid the
package adding another and making $PREFIX/etc/stunnel/stunnel/stunnel.conf;
the pidfile does not normally belong under $PREFIX as $PREFIX/var/run is
not normally cleaned/checked by OS-supplied processes.)
And always is defined as share/examples/rc.d
which was the default before.
This rc.d scripts are not automatically added to PLISTs now also.
So add to each corresponding PLIST as required.
This was discussed on tech-pkg in late January and late April.
Todo: remove the RCD_SCRIPTS_EXAMPLEDIR uses in MESSAGES and elsewhere
and remove the RCD_SCRIPTS_EXAMPLEDIR itself.
Version 4.07, 2005.01.03, urgency: MEDIUM:
* Bugfixes
- Problem with infinite poll() timeout negative, but not equal to -1 fixed.
- Problem with a file descriptor ready to be read just after a non-blocking
connect call fixed.
- Compile error with EAI_NODATA not defined or equal to EAI_NONAME fixed.
- IP address and TCP port textual representation length (IPLEN) increased
to 128 bytes.
- OpenSSL engine support is only used if engine.h header file exists.
Version 4.06, 2004.12.26, urgency: LOW:
* New feature sponsored by SURFnet http://www.surfnet.nl/
- IPv6 support (to be enabled with ./configure --enable-ipv6).
* New features
- poll() support - no more FD_SETSIZE limit!
- Multiple connect=host:port options are allowed in a single service
section. Remote hosts are connected using round-robin algorithm.
This feature is not compatible with delayed resolver.
- New 'compression' option to enable compression. To use zlib
algorithm you have to enable it when building OpenSSL library.
- New 'engine' option to select a hardware engine.
- New 'TIMEOUTconnect' option with 10 seconds default added.
- stunnel3 perl script to emulate version 3.x command line options.
- French manual updated by Bernard Choppy <choppy AT free POINT fr>.
- A watchdog to detect transfer() infinite loops added.
- Configuration file comment character changed from '#' to ';'.
'#' will still be recognized to keep compatibility.
- MT-safe getaddrinfo() and getnameinfo() are used where available
to get better performance on resolver calls.
- Automake upgraded from 1.4-p4 to 1.7.9.
* Bugfixes
- log() changed to s_log() to avoid conflicts on some systems.
- Common CRIT_INET critical section introduced instead of separate
CRIT_NTOA and CRIT_RESOLVER to avoid potential problems with
libwrap (TCP Wrappers) library.
- CreateThread() finally replaced with _beginthread() on Win32.
- make install creates $(localstatedir)/stunnel.
$(localstatedir)/stunnel/dev/zero is also created on Solaris.
- Race condition with client session cache fixed.
- Other minor bugfixes.
* Release notes
- Default is *not* to use IPv6 '::' for accept and '::1' for
connect. For example to accept pop3s on IPv6 you could use:
'accept = :::995'. I hope the new syntax is clear enough.
under share/examples/rc.d. The variable name already was named
RCD_SCRIPTS_EXAMPLEDIR.
This is from ideas from Greg Woods and others.
Also bumped PKGREVISION for all packages using RCD_SCRIPTS mechanism
(as requested by wiz).
in the process. (More information on tech-pkg.)
Bump PKGREVISION and BUILDLINK_DEPENDS of all packages using libtool and
installing .la files.
Bump PKGREVISION (only) of all packages depending directly on the above
via a buildlink3 include.
All library names listed by *.la files no longer need to be listed
in the PLIST, e.g., instead of:
lib/libfoo.a
lib/libfoo.la
lib/libfoo.so
lib/libfoo.so.0
lib/libfoo.so.0.1
one simply needs:
lib/libfoo.la
and bsd.pkg.mk will automatically ensure that the additional library
names are listed in the installed package +CONTENTS file.
Also make LIBTOOLIZE_PLIST default to "yes".
* New feature sponsored by SURFnet http://www.surfnet.nl/
- Support for CIFS aka SMB protocol SSL negotiation.
* New features
- CRL support with new CApath and CAfile global options.
- New 'taskbar' option on WIN32 (thx to Ken Mattsen
<ken.Mattsen@roxio.com>).
- New -fd command line parameter to read configuration
from a specified file descriptor instead of a file.
- accept is reported as error with [section] defined (in
stunnel 4.04 it was silently ignored causing problems
for lusers that did not read the fine manual).
- Use fcntl() instead of ioctlsocket() to set socket
nonblocking when it is supported.
- Basic support for hardware engines with OpenSSL >= 0.9.7.
- French manual by Bernard Choppy <choppy@imaginet.fr>.
- Thread stack size reduced to 64KB for maximum scalability.
- Added optional code to debug thread stack usage.
- Support for nsr-tandem-nsk (thx to Tom Bates <tom.bates@hp.com>).
* Bugfixes
- TCP wrappers code moved to CRIT_NTOA critical section
since it uses static inet_ntoa() result buffer.
- SSL_ERROR_SYSCALL handling problems fixed.
- added code to retry nonblocking SSL_shutdown() calls.
- Use FD_SETSIZE instead of 16 file descriptors in inetd
mode.
- fdscanf groks lowercase protocol negotiation commands.
- WIN32 taskbar GDI objects leak fixed.
- Libwrap detection bug in ./configure script fixed.
- grp.h header detection fixed for NetBSD and possibly
other systems.
- Some other minor updates.
