CVS commit: [pkgsrc-2013Q4] pkgsrc/security/stunnel

["Matthias Scheler" <tron%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   tron
Date:           Wed Mar 12 09:41:10 UTC 2014

Modified Files:
        pkgsrc/security/stunnel [pkgsrc-2013Q4]: Makefile distinfo
        pkgsrc/security/stunnel/patches [pkgsrc-2013Q4]: patch-ac

Log Message:
Pullup ticket #4341 - requested by jym
security/stunnel: security update

Revisions pulled up:
- security/stunnel/Makefile                         1.86-1.87,1.89 via patch
- security/stunnel/distinfo                         1.38-1.39
- security/stunnel/patches/patch-ac                 1.16

---
   Module Name: pkgsrc
   Committed By:        tron
   Date:                Sun Jan 26 15:51:54 UTC 2014

   Modified Files:
        pkgsrc/security/stunnel: Makefile

   Log Message:
   Fix permissions so that "etc/stunnel" belongs to the actual "root" user
   and not to the user that build the package. Bump package revision
   because of this fix.

---
   Module Name: pkgsrc
   Committed By:        tron
   Date:                Sun Jan 26 16:59:13 UTC 2014

   Modified Files:
        pkgsrc/security/stunnel: Makefile distinfo

   Log Message:
   Update "stunnel" package to version 4.56. Changes since 4.55:
   - Fixed a regression bug introduced in version 4.55 causing random
     crashes on several platforms, including Windows 7.
   - Fixed incorrect "stunnel -exit" process synchronisation.
   - Fixed FIPS detection with new versions of the OpenSSL library.
   - Failure to open the log file at startup is no longer ignored.

---
   Module Name: pkgsrc
   Committed By:        jym
   Date:                Wed Mar 12 00:24:35 UTC 2014

   Modified Files:
        pkgsrc/security/stunnel: Makefile distinfo
        pkgsrc/security/stunnel/patches: patch-ac

   Log Message:
   Update stunnel to 5.00.

   Of utmost importance: it fixes CVE 2014-0016.

   Thanks to jgw (Jeff W) _AT_ sdf.org for working on the same patch
   independently.

   In before the freeze! Changelog follows.

       Security bugfixes
           Added PRNG state update in fork threading (CVE-2014-0016).
       New global configuration file defaults
           Default "fips" option value is now "no", as FIPS mode is only 
helpful for compliance, and never for actual security.
           Default "pid" is now "", i.e. not to create a pid file at startup.
       New service-level configuration file defaults
           Default "ciphers" updated to "HIGH:MEDIUM:+3DES:+DH:!aNULL:!SSLv2" 
due to AlFBPPS attack and bad performance of DH ciphersuites.
           Default "libwrap" setting is now "no" to improve performance.
       New features
           OpenSSL DLLs updated to version 1.0.1f.
           zlib DLL updated to version 1.2.8.
           autoconf scripts upgraded to version 2.69.
           TLS 1.1 and TLS 1.2 are now allowed in the FIPS mode.
           New service-level option "redirect" to redirect SSL client 
connections on authentication failures instead of rejecting them.
           New global "engineDefault" configuration file option to control 
which OpenSSL tasks are delegated to the current engine. Available tasks: ALL, 
RSA, DSA, ECDH, ECDSA, DH, RAND, CIPHERS, DIGESTS, PKEY, PKEY_CRYPTO, PKEY_ASN1.
           New service-level configuration file option "engineId" to select the 
engine by identifier, e.g. "engineId = capi".
           New global configuration file option "log" to control whether to 
append (the default), or to overwrite log file while (re)opening.
           Different taskbar icon colors to indicate the service state.
           New global configuration file options "iconIdle", "iconActive", and 
"iconError" to select status icon on GUI taskbar.
           Removed the limit of 63 stunnel.conf sections on Win32 platform.
           Installation of a sample certificate was moved to a separate "cert" 
target in order to allow unattended (e.g. scripted) installations.
           Reduced length of the logged thread identifier. It is still based on 
the OS thread ID, and thus not unique over long periods of time.
           Improved readability of error messages printed when stunnel refuses 
to start due to a critical error.
       Bugfixes
           LD_PRELOAD Solaris compatibility bug fixed (thx to Norm Jacobs).
           CRYPTO_NUM_LOCKS replaced with CRYPTO_num_locks() to improve binary 
compatibility with diverse builds of OpenSSL (thx to Norm Jacobs).
           Corrected round-robin failover behavior under heavy load.
           Numerous fixes in the engine support code.
           On Win32 platform .rnd file moved from c:\ to the stunnel folder.


To generate a diff of this commit:
cvs rdiff -u -r1.85 -r1.85.2.1 pkgsrc/security/stunnel/Makefile
cvs rdiff -u -r1.37 -r1.37.8.1 pkgsrc/security/stunnel/distinfo
cvs rdiff -u -r1.15 -r1.15.18.1 pkgsrc/security/stunnel/patches/patch-ac

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.