MSVSphere Packaging Team
5 months ago
parent
3372d22995
commit
bcb08a1e8c
GPG Key ID:
B2B0B9F29E528FE8
@ -1 +1 @@
|
||||
SOURCES/stunnel-5.56.tar.gz
|
||||
SOURCES/stunnel-5.71.tar.gz
|
||||
|
||||
@ -1 +1 @@
|
||||
a7fa3fb55d698f50f3d54e4fc08588a119f21cad SOURCES/stunnel-5.56.tar.gz
|
||||
dab534acc28f389f98bf8724d9f42ad9ca472691 SOURCES/stunnel-5.71.tar.gz
|
||||
|
||||
@ -0,0 +1,125 @@
|
||||
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||
|
||||
mQINBFTU6YwBEAC6PP7E4J6cRZQsJlFE+o3zdQYo7Mg2sVxDR6K9Cha52wn7P0t0
|
||||
hHUd0CSmWyfjmYUy3/7jYjgKe4oiGzeSCVK8b3TiX3ylHi/nW3mixwpDPwFmr5Cf
|
||||
ce55Ro3TdIeslRGigK8Hl+/l4n9c9z/AiTvcdAEQ34BJhERce4/KFx+/omiaxe7S
|
||||
fzzU/+52zy+v4FfnclgRQrzrD8sxNag6CQOaQ8lTMczNkBkDlhQTOPYkfNf76PUY
|
||||
kbWpcH7n9N50nddjEaLf7DPjOETc4OH/g5a99FSEJL7jyEgn+C8RX7RpbbAxCNlX
|
||||
1231NZoresLmxSulB6fRWLmhJ8pES3sRxE1IfwUfPpUZuTPzwXEFJY6StY5OCVy8
|
||||
rNFpkYlEePuVn74XkGbvv7dkkisq4Hp59zfIUaNVRod0Xk2rM8Rx8d5IK801Ywsn
|
||||
RyzCE02zt3N2O4IdXI1qQ1gMJNyaE/k2Qk8buh8BsKJzZca34WGocHOxz2O5s7FN
|
||||
Q1pLNpLmuHZIdyvYqcsenLz5EV8X2LztRmJ3Se4ag/XyXPYwS6lXX1YUGVxZpk0E
|
||||
sQDRdJvYCsGcUy253w+W7Nm/BtjKi6/PJmjEEU7ieHppR9Yp+LI3lyzNBeZAIVqk
|
||||
4Hco05l4GUKtEDFfOQ58sULDqJWmpH4T72DHeCpfRB0guaPa5TYY7B0umQARAQAB
|
||||
tC5NaWNoYcWCIFRyb2puYXJhIDxNaWNoYWwuVHJvam5hcmFAc3R1bm5lbC5vcmc+
|
||||
iQJSBBMBCAA8AhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgBYhBKyRXqMGRdnT
|
||||
1Nrk/rEEiTLdOqqjBQJiemhbAhkBAAoJELEEiTLdOqqjH/YP/i5fQuvTvwSHZAwK
|
||||
JgSUijxD4z2jCtYvXIa7BPNiu8mnyupPAdoZE7BNehuvAc7kYj4dNmC/cY+CRcan
|
||||
OW05ByU/N+RObQYs6dkSLuyzOfqdnA2SZgcPreOZyLe/Yz9nSh5BVigSyiNY+clT
|
||||
JMfISdvfAxlxkVxyfJ293ePECZ7VKfzp18ntDBIY5yos4K0FXKpFVhhWHT9SlsQe
|
||||
tAKTOm6WdJx852y53TvZYzPEVznZhLSj//yYWG7TVQ47oSrsUW5pGaQybtYNIwGa
|
||||
sHGj0SFscYb8IBF4gOaTFPiwKJykmwfF0F7A6wO+oSs7By1o4fEoVr1y3UWO/ATx
|
||||
RF3GyX/6NHTu2OwTmtWozTKkd4agGPmQgn+ApueaBq7Tn9EA+5e83hRY8/c0xOvu
|
||||
XRHrB+PTp4HT3yPcVbGP6vRkpPsRIxtzzw+G1AdwIcMULg/J5qKilRyKLbN12cmc
|
||||
Jjtk6Ii7cskgj/3iYVRy/Xtw9Q2+9aMPPs1H4QklimDuR/KWCqyd61e1ct+Y4XGq
|
||||
HM93/GQuku1sGA6YsfUpDWv3rjwoGejyif3lyHjERaGh1BCYD6Olhe2QtCEuOvuA
|
||||
G2qPT0gZ1q33JVN3wNJfD6JreG7HubG0le+iwLoQTXa3qjhF8DeAgOC+yLKYv3iD
|
||||
ms49fpkKFScmRCmWU0C/2zqe0/GetCtNaWNoYcWCIFRyb2puYXJhIDxNaWNoYWwu
|
||||
VHJvam5hcmFAbWlydC5uZXQ+iQJPBBMBCAA5AhsDBgsJCAcDAgYVCAIJCgsEFgID
|
||||
AQIeAQIXgBYhBKyRXqMGRdnT1Nrk/rEEiTLdOqqjBQJiemhbAAoJELEEiTLdOqqj
|
||||
k5UP/1G8u1Hpr0Ie4YXn1ru1hQaauEqTXGfgcsSuuqvS4GCgY93+Q0jv0YV1Owxs
|
||||
pJWmN3aYKtsj86EAEkOcz23HkhwwvTKkhrZWCATQzhpGZfFWECPm+CycNksc+pkq
|
||||
eykg5RN00DecGpG5x0p2twrRI4j+K4OKSGJvx8vjxBMGoGAoHtBl73nhwuY9CsqL
|
||||
CnCn3lohv03GPvvlO6dhOordBI4U50ky5ZZsQ/qMD7vAGFktbJMyhYJ96ASdVqfG
|
||||
L0DTQ6E1QwS4PQlyEt6PBCtt6T3kU7i9mYy+TQtI+wH3r2hx+UEQaC+9hzY4FZwH
|
||||
xOdH7zumOthMu/uBGK2uMkj7mVpHEGU/69EvROYzf0HtN2vs2yCMirtrlbfQ0bez
|
||||
YyXiTd8+ka0vTWM2rE6rav5RIRDmD7U3u4fPwnpSRTDxCHJglIisymLd01W0Qh8l
|
||||
qCyHOOsRHu2k3RfdILd+F26Ii31073kAaga5iDlKrPyVV38upLIPy/G9QJ8rdYBR
|
||||
EvF0VaYQW+rwsInE8mYfWgcwKT3ZeWop0dD7NFurbHZxfTkL1QCEo+EurrFxBLCm
|
||||
qfPEbQwoMwS5hCAcGRjXDpt0ZZe55VdLXaW9E/GINHPVoM+dMqmmYxEOCvuOez4c
|
||||
MMmt6a5kFPPtWo2o7dcBpDG7ZX3UkUGVAmQuSENIY3yXqYcXtC9NaWNoYcWCIFRy
|
||||
b2puYXJhIDxNaWNoYWwuVHJvam5hcmFAbW9iaS1jb20ubmV0PokCTwQTAQgAOQIb
|
||||
AwYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AWIQSskV6jBkXZ09Ta5P6xBIky3Tqq
|
||||
owUCYnpoUQAKCRCxBIky3Tqqo7cBD/sFjmAnOyuEvlVKXEihLmABFBeWjKiGaR4U
|
||||
0+V8ZPvBEzHVQ5e2ywqa68xgFK66JlapnZlAeOoUZYc/uj0xzNwzS4sdnc/ejWn+
|
||||
B0gM9ZLYs1BeYib2k4Bf0c8ccjjCX5r8+Uio8aCB4hSyckmyD+svfmnrzyMEEAZN
|
||||
d+0uiwmmHNEDHqIg76xo7DO+DvV2+sEkLEtdKCfTws94qEWQHGHYwpcbDngSamVZ
|
||||
zML48L4liQX0l7Dz8j09Tf1EYg2DRSvn4s2bzyrFIsnz6yrlf8K0hCYkaTLKnCSx
|
||||
Bj7ESXj/bOQY4fBAHNy2gRXq3ELgdliCQHeT+9TD5JI58rWQBY48QGF7CAxMcC3H
|
||||
3nI/Zq/DSaakOVwianqY2VJDFAYXogmEOR/kWE3lPerp6qum+n4WcDiteQXJMHmV
|
||||
t/JYAZ3zbOhmu9F2NI7Ce4uZe8rQ0PG5Jgb5wE76i9zrCwFACPKhJVim4kWIOPf8
|
||||
eT1LCC4adpyeUMrH342CVb2xpS+gQ89V7sTt9uFPp9wTl5QvsD3uTWKzGkRV9s7b
|
||||
rnFuJYGDRM/EN0nFZF8D0RbrwYNK5KXSZ0VOTrud9ZcEsJQeISqLX4QBMrSl/Nst
|
||||
r9MTUuBf6N3b5zDRmHJQ6+myyE/8cgHwEsmOIJCSEcQjkYsUruQhuW2Et1EZtrcb
|
||||
/KHFRhRjP7RATWljaGHFgiBUcm9qbmFyYSAoYXV4aWxpYXJ5IGFkZHJlc3MpIDxN
|
||||
aWNoYWwuVHJvam5hcmFAZ21haWwuY29tPokCTgQTAQgAOAIbAwULCQgHAgYVCgkI
|
||||
CwIEFgIDAQIeAQIXgBYhBKyRXqMGRdnT1Nrk/rEEiTLdOqqjBQJiemhDAAoJELEE
|
||||
iTLdOqqjWfkQALjs436L79R26iQc8aWu3IWAZ8FOv8VqbTcGH3fQ16DcJ+OaBQkl
|
||||
qHTWsbs9Bhq49lU6WiZLIJWTp8bl6fdC5XbJYFYW7fMBSyUFpSqQFACY6EF3vdDS
|
||||
bcVcT6aModzq1mG9CFuU5wt0GrZOy4v0pXvJK0Y+CzY3Rm/Nev0Ou3HUFWgsOpHZ
|
||||
jnCCkNyQ1C1jJ9mDid55dID8byLvkmS8Z3pVhFQ3Ko9gZv47GeeNjG26rbNmsVwZ
|
||||
Ki7c9iJM/RbCgr+LVElFVtFyJP2WUxHjl2RbrJIJB9YUNY1N7z0tDnqN1FCPbFkj
|
||||
zkMuuj0yPp9CqGZge+A5tT5NfytGYPMSOD9up4SXVr+ejOtUL5riW3LsnewjTJuM
|
||||
f2qP1h52FAduB9SfGTf0XlLlKJkjkw3Q9WmrOndJcEsKRGarfcWFPMOml3xmcoAM
|
||||
9jU0H9P1ZAHlKON0eL1vKBgS5XL0s4pVvwsYZ+dfDcNU+bUCrTRLc0uccsIzDrio
|
||||
bbaz7VtUzEsWqPozW6CTozDWDSfKRuWuB2vAYfqKJN8ZAkvOu00ZKwT/DiCpLQ6e
|
||||
GQ8tcAvum9Sd9jydwqs89UNhKNkovwMwALjLITaZ72ILgYo3Mo57fT6MpVspxJ23
|
||||
+6RP8+MAM+HhJYfODuGvNHR3n5aO0WnwM8YoH14hjHUKtr7z83iivhSOuQINBFTU
|
||||
68MBEADyAgLrjV0rpqn1bUrcSSpGfTPrOLN1Uav+O9/zEVd5Sr5q7GLFnS0Rjo0z
|
||||
kIFLJrkEIr0gZVaYk1trPJZRriWUDoS+ZTFxN4YTumlADgqXVvO9Srm6mj7z7RW6
|
||||
q8sL9tXPQNScVJYlgcBms9n7I7TIyry9oZOjmTAqLFDg2L437USIAspl7HWDpRb1
|
||||
3QcBxgRr+VNaHPcnRXXLJjhWi/fSC2ijrsqRIL9KzBnMhHTQJAavPe3CUa4HvdKb
|
||||
Vh+oOptjx1Asl7JTSi8h5T3lUjlxAXoPUfxh1oxZCboy1UB8hflYygf56rgCeT2G
|
||||
KVF4YA2QhY1KozbUOt27dytsYhiJk8Rp0p8bHCq7C9ENMSAPiCOoy8R3EDZbqzhZ
|
||||
HfpLAyR460RKPbUyJHZgNxsjMhtSH2nQ/wNka9BxWHjmMKB05wvm2H1HTvqelcef
|
||||
wUh7Yh8BmdfU6emwqf9ionTA0WEZhbFX/JkDXQ1sUoVeEPUUaqs7PqVKqaoPPTS1
|
||||
eh8XjfZp77s/NM/2fhyKPiTRJgbWX8tOGc5gvdI1QIbesIBJ5aheaHEJhEaLRfDc
|
||||
gmtylU2Y1AP5IstONUH3gCUONKXHWrRX73KaEYeLnXCwFJqMzAN7FpIj9YzXL2VE
|
||||
7CXt54APjV88CvNOV4CpPz1qRYt69MEta+Pn2aS729kBbbr/VQARAQABiQIfBBgB
|
||||
AgAJBQJU1OvDAhsMAAoJELEEiTLdOqqjY0IQAIcnt7SXw2FLiyV/N6PUABc7AvXA
|
||||
N7Gfq2GmB7EDKpkshqJuqEjJuFKjUs4vU1j/nnK2xxs5Avs2WJEBdU3oX2Vx6v6r
|
||||
PEvkmDHNRTp2vJqk1lizTq7fB+vxm1Ju8gA43/Dz22b20fGg1QhhllRlE4UFbp+f
|
||||
xGSFuhCzSEkXFZ9aCE7GFLRNcnz8xnhhx8PL4TDosgDKbcDVdj777ZUwQeopzKFT
|
||||
3lbmyoCx87kyRFZrQT0lNLZ1ZO141NY+ifLAkZf+ZJVUxmA5kXqjfZVv0tOcHrvp
|
||||
hBo+IyW7aqD69GREz/PIaO8/HuGKV/rwJbFlwgeyV+nmAlXpG+2Ur6a4S8iRKY1j
|
||||
KLyFCnVjkLq5Zv0la3/0hIn5fP6f7mcAcRTNb8t4QPKGNWVL286gADLXyvjuZDJv
|
||||
MnarbM4ej3OXd8o4nZLhIUEoYe4iE87EbYKu6HE31Tn5HBMOooQJ64JlE4xhAvOW
|
||||
Yg/a8z824VWFCbyI2FtO8R6eHiZYPgi44cmSq/MorMBeWWiy5QrgHSRuWHgZo5WY
|
||||
SNpcbDzvz2s6VDMPnnrpKAo8M1S2ibn94hzLr9RgGgV3uUuW0hVJIIDVVQxTgxYm
|
||||
CPBr2CTozGg17x1wnX3uhAx+Fk2MnzRLkL5rZqXjCtHa8v/eFeHLYzaQbvdEtLPE
|
||||
SJWgmwb6FvM218hruQINBFTU7lkBEADWkatDVXdgxcXcPPC8D+5Zv3XanCpS8wAA
|
||||
q9gIOIQsg4/Ttzfb7PTg39s5eOJnYlvwC4gKPi/3a1cDKC1/XzPHChTwA5eK5Jw/
|
||||
fDLVmmsHDyTvV03LReYRduJfu2Quh7Q7NaUJo1NqNJdMQtP6dgdM6QGysLhP7LsD
|
||||
Bi55AlhRpGQlH/lNzrxSdFI7b3mmAl3sShZYCTLdt0f5Mo3QyxqAInBr5GtcUa0g
|
||||
qNTRcAqx11PFArHZJQYXRBV01n/XgO6jvdu2he0eAHSjF7CeyImnlcpZibntFI0u
|
||||
/UsqvbqJJS1QzUIAhkAu4YwDJBdUSjs6bO5mY3TJFgzsVKekbisgOcPFiENNpr7F
|
||||
ZvvfxXy4tANkBWcC4ESGrVFAQOtEz9ctuJu9UHOl34kj1ad40SnR6GrmwQLoVspj
|
||||
PQepWTZIfUOlvS2Cu3HPdzus+zu9F2YUzFO5hy1LO6o0ekpf4LquDIBbazEQoPTK
|
||||
zw5gRreG+tAVIDOcz+Pdfx2B7UOuIchB38O3j4sx09yxCTe+3LuljFkgNFr2GXue
|
||||
Bp6xBJn/s9X9yPtTuqJ5OvW6U7UZzkZzJLYe7g/3XT0dfW0ERC8Yelup70tzZ3RU
|
||||
qAdWMb28MusTWH+pcpuafQsXVhHh2Noz6xgJ9g475bNkpQAI90yrcuJ3/ehDvWnp
|
||||
42C7qVByAQARAQABiQQ+BBgBAgAJBQJU1O5ZAhsCAikJELEEiTLdOqqjwV0gBBkB
|
||||
AgAGBQJU1O5ZAAoJEC78f/DUFuAU3HoQAJHsIoHcy/aU1pFGtpVHCM2u6bI4Oqyd
|
||||
f+h7eVp3TiIIFv0nEbI3JMYXSzq16hqhxfEh5nnRsXsa5hyd6kwameIwKQTbKaUz
|
||||
qu4U01NRgLTYWyujApBugLtLkM3aXuVvieWDINfuc6U4yaFNzcP9Cx24zJL0fmSM
|
||||
UUq3Mtg7BERX9Ecj/BBTJPLN7yqz8HGlPf8exIm4ZnJstJ39+Z4zjfGCFx18OApN
|
||||
oaQWSGFbtRaC06FC1jGvRUPgcTDgL6czKSyooAgUwGMkCq2y5Z5KBq9WttTwqvOV
|
||||
wkUdKui9ns+LSYoxgcaiY+y1lxnHCvXm3cGEO+iAxJGxxTWYtSKAsQaJbE9XG1CW
|
||||
YdNl8yezgLLThLuMrgaLHQ83heL/2s5wsUJvnN11wtWuqK5P523879M8pQodO8sv
|
||||
WAXgOXKlu7xNBa07vENI/LvBJ09ZQ3kYGOzFtl9WVam+9UyYZS7KAiXQuSsksobG
|
||||
TfoCc2kQ+qxD171GyC7l0/2UY/PeKDETen5SWFajl6ompnAB8QVv7Q9DMpJDrMgV
|
||||
AB/nR5Ij+lZ/5en1c5Pjt3jLxpbMcDtP+Nr21vJ356DvVk6o4W1U/zMVa+Y+eiiz
|
||||
GsFHuor9EFjn89cqF8bXTIRhdKNNqnh2azLjfSXwxy6qjnmKLGBPm/Fl9N7IWNOM
|
||||
eaO4cPWtNN+leTgP/0Yj1wh+tZzOGttY3wGg/roiYxelWFnMO3pLm710dI0l2qK8
|
||||
PMKSS1v+mxcgu++7eouZvWcluw3M30Ymbouh27MInhKpqh2OEyQ2L9Nz3l3HSfZw
|
||||
I/ZGH+O/OjvOupA7T1zxq3+kUSIXwuBSVzlBoH8Y2FcGomiDbI7NQ8YqrQ4zL/C2
|
||||
1bjZMJ7tX4nx+efXrF8aGdXCaJZFBqp0KIUNjYiI4eGdHB8lUA2t11+5T8Any9jx
|
||||
dfOvEjthkvjdXnfRaJyHVUHTRcsVTxqPTwWyN0W9HvsADEVT4J3qwfrKrqOxFeml
|
||||
DQE47XlpH7CikS+0rAN1G7dNrB4LVcwstDhe431CXRswfR3rbq4wbbNR9kY7WM1M
|
||||
5LixSESomwiZuwv+GA0Mpi9+jTBIc9aZCj2ePDtobwx7Lvsjd8vUQuP9N9rzqeM+
|
||||
kn+2YUwtX2e1YAJxb9ze2iN1w/bvytPD/jOT5KvZm/7ds/XKMl3TPgHeBhjPYFRh
|
||||
NTt3KIDjUqCThl9XWfY1QDFAljO8QgBlwwRYDes5Nv4CNwFVdfz0aTQETKRWYD0b
|
||||
zTy1uYj7gNR3Zz/53XF659vjdMY6LAqrBj46z2J7LcVuyehi7Mo+x3ksHIkUS51s
|
||||
wHXnaH3m783KxozQCML7I+2WlItQhoNRbvlUCVAo9aPUCDm5WlzZJwwSN69B
|
||||
=EgcU
|
||||
-----END PGP PUBLIC KEY BLOCK-----
|
||||
@ -1,11 +0,0 @@
|
||||
diff -up stunnel-5.50/tools/stunnel.service.in.systemd-service stunnel-5.50/tools/stunnel.service.in
|
||||
--- stunnel-5.50/tools/stunnel.service.in.systemd-service 2019-01-14 12:17:15.826868965 +0100
|
||||
+++ stunnel-5.50/tools/stunnel.service.in 2019-01-14 12:18:21.186753131 +0100
|
||||
@@ -5,6 +5,7 @@ After=syslog.target network.target
|
||||
[Service]
|
||||
ExecStart=@bindir@/stunnel
|
||||
Type=forking
|
||||
+PrivateTmp=true
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@ -1,22 +0,0 @@
|
||||
diff -up stunnel-5.48/src/str.c.coverity stunnel-5.48/src/str.c
|
||||
--- stunnel-5.48/src/str.c.coverity 2018-07-02 23:30:10.000000000 +0200
|
||||
+++ stunnel-5.48/src/str.c 2018-09-04 17:24:08.949928906 +0200
|
||||
@@ -165,6 +165,7 @@ char *str_vprintf(const char *format, va
|
||||
for(;;) {
|
||||
va_copy(ap, start_ap);
|
||||
n=vsnprintf(p, size, format, ap);
|
||||
+ va_end(ap);
|
||||
if(n>-1 && n<(int)size)
|
||||
return p;
|
||||
if(n>-1) /* glibc 2.1 */
|
||||
diff -up stunnel-5.48/src/stunnel.c.coverity stunnel-5.48/src/stunnel.c
|
||||
--- stunnel-5.48/src/stunnel.c.coverity 2018-07-02 23:30:10.000000000 +0200
|
||||
+++ stunnel-5.48/src/stunnel.c 2018-09-04 17:24:08.949928906 +0200
|
||||
@@ -364,7 +364,6 @@ NOEXPORT int accept_connection(SERVICE_O
|
||||
#endif
|
||||
if(create_client(fd, s, alloc_client_session(opt, s, s))) {
|
||||
s_log(LOG_ERR, "Connection rejected: create_client failed");
|
||||
- closesocket(s);
|
||||
#ifndef USE_FORK
|
||||
service_free(opt);
|
||||
#endif
|
||||
@ -1,66 +1,98 @@
|
||||
--- stunnel-5.56/doc/stunnel.8.in.curves-doc-update 2020-04-16 17:12:48.171590017 +0200
|
||||
+++ stunnel-5.56/doc/stunnel.8.in 2020-04-16 17:16:07.001603122 +0200
|
||||
@@ -473,6 +473,8 @@ This file contains multiple CRLs, used w
|
||||
From e951a8a7edc87dbd608043f8aab67ef12979e3ca Mon Sep 17 00:00:00 2001
|
||||
From: Sahana Prasad <sahana@redhat.com>
|
||||
Date: Mon, 12 Sep 2022 11:07:38 +0200
|
||||
Subject: [PATCH 6/8] Apply patch stunnel-5.56-curves-doc-update.patch
|
||||
|
||||
Patch-name: stunnel-5.56-curves-doc-update.patch
|
||||
Patch-id: 6
|
||||
From-dist-git-commit: 70b3076eb09912b3a11f371b8c523303114fffa3
|
||||
---
|
||||
doc/stunnel.8.in | 2 ++
|
||||
doc/stunnel.html.in | 2 ++
|
||||
doc/stunnel.pl.8.in | 2 ++
|
||||
doc/stunnel.pl.html.in | 2 ++
|
||||
doc/stunnel.pl.pod.in | 2 ++
|
||||
doc/stunnel.pod.in | 2 ++
|
||||
6 files changed, 12 insertions(+)
|
||||
|
||||
diff --git a/doc/stunnel.8.in b/doc/stunnel.8.in
|
||||
index a56f0b7..977a1a4 100644
|
||||
--- a/doc/stunnel.8.in
|
||||
+++ b/doc/stunnel.8.in
|
||||
@@ -475,6 +475,8 @@ This file contains multiple CRLs, used with the \fIverifyChain\fR and
|
||||
.IX Item "curves = list"
|
||||
\&\s-1ECDH\s0 curves separated with ':'
|
||||
.Sp
|
||||
+Note: This option is supported for server mode sockets only.
|
||||
+.Sp
|
||||
Only a single curve name is allowed for OpenSSL older than 1.1.0.
|
||||
Only a single curve name is allowed for OpenSSL older than 1.1.1.
|
||||
.Sp
|
||||
To get a list of supported curves use:
|
||||
--- stunnel-5.56/doc/stunnel.html.in.curves-doc-update 2020-04-16 17:13:25.664962696 +0200
|
||||
+++ stunnel-5.56/doc/stunnel.html.in 2020-04-16 17:16:55.897111302 +0200
|
||||
@@ -568,6 +568,8 @@
|
||||
diff --git a/doc/stunnel.html.in b/doc/stunnel.html.in
|
||||
index 608afa9..cecc81a 100644
|
||||
--- a/doc/stunnel.html.in
|
||||
+++ b/doc/stunnel.html.in
|
||||
@@ -570,6 +570,8 @@
|
||||
|
||||
<p>ECDH curves separated with ':'</p>
|
||||
|
||||
+<p>Note: This option is supported for server mode sockets only.</p>
|
||||
+
|
||||
<p>Only a single curve name is allowed for OpenSSL older than 1.1.0.</p>
|
||||
<p>Only a single curve name is allowed for OpenSSL older than 1.1.1.</p>
|
||||
|
||||
<p>To get a list of supported curves use:</p>
|
||||
--- stunnel-5.56/doc/stunnel.pod.in.curves-doc-update 2020-04-16 17:13:43.412139122 +0200
|
||||
+++ stunnel-5.56/doc/stunnel.pod.in 2020-04-16 17:17:25.414418073 +0200
|
||||
@@ -499,6 +499,8 @@ I<verifyPeer> options.
|
||||
diff --git a/doc/stunnel.pl.8.in b/doc/stunnel.pl.8.in
|
||||
index e2e6622..eae88f8 100644
|
||||
--- a/doc/stunnel.pl.8.in
|
||||
+++ b/doc/stunnel.pl.8.in
|
||||
@@ -492,6 +492,8 @@ przez opcje \fIverifyChain\fR i \fIverifyPeer\fR.
|
||||
.IX Item "curves = lista"
|
||||
krzywe \s-1ECDH\s0 odddzielone ':'
|
||||
.Sp
|
||||
+Uwaga: ta opcja wpływa tylko na gniazda w trybie serwera.
|
||||
+.Sp
|
||||
Wersje OpenSSL starsze niż 1.1.1 pozwalają na użycie tylko jednej krzywej.
|
||||
.Sp
|
||||
Listę dostępnych krzywych można uzyskać poleceniem:
|
||||
diff --git a/doc/stunnel.pl.html.in b/doc/stunnel.pl.html.in
|
||||
index 7be87f1..7fd7a7c 100644
|
||||
--- a/doc/stunnel.pl.html.in
|
||||
+++ b/doc/stunnel.pl.html.in
|
||||
@@ -568,6 +568,8 @@
|
||||
|
||||
ECDH curves separated with ':'
|
||||
<p>krzywe ECDH odddzielone ':'</p>
|
||||
|
||||
+Note: This option is supported for server mode sockets only.
|
||||
+<p>Uwaga: ta opcja wpływa tylko na gniazda w trybie serwera.</p>
|
||||
+
|
||||
Only a single curve name is allowed for OpenSSL older than 1.1.0.
|
||||
<p>Wersje OpenSSL starsze niż 1.1.1 pozwalają na użycie tylko jednej krzywej.</p>
|
||||
|
||||
To get a list of supported curves use:
|
||||
--- stunnel-5.56/doc/stunnel.pl.pod.in.curves-doc-update 2020-04-16 17:25:22.631934496 +0200
|
||||
+++ stunnel-5.56/doc/stunnel.pl.pod.in 2020-04-16 17:47:46.872353210 +0200
|
||||
@@ -507,6 +507,8 @@ przez opcje I<verifyChain> i I<verifyPee
|
||||
<p>Listę dostępnych krzywych można uzyskać poleceniem:</p>
|
||||
diff --git a/doc/stunnel.pl.pod.in b/doc/stunnel.pl.pod.in
|
||||
index dc6b255..712f751 100644
|
||||
--- a/doc/stunnel.pl.pod.in
|
||||
+++ b/doc/stunnel.pl.pod.in
|
||||
@@ -516,6 +516,8 @@ przez opcje I<verifyChain> i I<verifyPeer>.
|
||||
|
||||
krzywe ECDH odddzielone ':'
|
||||
|
||||
+Uwaga: ta opcja wpływa tylko na gniazda w trybie serwera.
|
||||
+
|
||||
Wersje OpenSSL starsze niż 1.1.0 pozwalają na użycie tylko jednej krzywej.
|
||||
Wersje OpenSSL starsze niż 1.1.1 pozwalają na użycie tylko jednej krzywej.
|
||||
|
||||
Listę dostępnych krzywych można uzyskać poleceniem:
|
||||
--- stunnel-5.56/doc/stunnel.pl.html.in.curves-doc-update 2020-04-16 17:24:46.857579674 +0200
|
||||
+++ stunnel-5.56/doc/stunnel.pl.html.in 2020-04-16 17:46:13.385404626 +0200
|
||||
@@ -564,6 +564,8 @@
|
||||
diff --git a/doc/stunnel.pod.in b/doc/stunnel.pod.in
|
||||
index 840c708..85cc199 100644
|
||||
--- a/doc/stunnel.pod.in
|
||||
+++ b/doc/stunnel.pod.in
|
||||
@@ -501,6 +501,8 @@ I<verifyPeer> options.
|
||||
|
||||
<p>krzywe ECDH odddzielone ':'</p>
|
||||
ECDH curves separated with ':'
|
||||
|
||||
+<p>Uwaga: ta opcja wpływa tylko na gniazda w trybie serwera.</p>
|
||||
+Note: This option is supported for server mode sockets only.
|
||||
+
|
||||
<p>Wersje OpenSSL starsze niż 1.1.0 pozwalają na użycie tylko jednej krzywej.</p>
|
||||
Only a single curve name is allowed for OpenSSL older than 1.1.1.
|
||||
|
||||
<p>Listę dostępnych krzywych można uzyskać poleceniem:</p>
|
||||
--- stunnel-5.56/doc/stunnel.pl.8.in.curves-doc-update 2020-04-16 17:24:25.665369474 +0200
|
||||
+++ stunnel-5.56/doc/stunnel.pl.8.in 2020-04-16 17:45:14.141792786 +0200
|
||||
@@ -483,6 +483,8 @@ przez opcje \fIverifyChain\fR i \fIverif
|
||||
.IX Item "curves = lista"
|
||||
krzywe \s-1ECDH\s0 odddzielone ':'
|
||||
.Sp
|
||||
+Uwaga: ta opcja wpływa tylko na gniazda w trybie serwera.
|
||||
+.Sp
|
||||
Wersje OpenSSL starsze niż 1.1.0 pozwalają na użycie tylko jednej krzywej.
|
||||
.Sp
|
||||
Listę dostępnych krzywych można uzyskać poleceniem:
|
||||
To get a list of supported curves use:
|
||||
--
|
||||
2.37.3
|
||||
|
||||
|
||||
@ -1,12 +0,0 @@
|
||||
diff -up stunnel-5.55/src/options.c.system-ciphers stunnel-5.55/src/options.c
|
||||
--- stunnel-5.55/src/options.c.system-ciphers 2019-09-19 14:43:00.631059024 +0200
|
||||
+++ stunnel-5.55/src/options.c 2019-09-19 14:51:02.120053849 +0200
|
||||
@@ -277,7 +277,7 @@ static char *option_not_found=
|
||||
"Specified option name is not valid here";
|
||||
|
||||
static char *stunnel_cipher_list=
|
||||
- "HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK";
|
||||
+ "PROFILE=SYSTEM";
|
||||
|
||||
#ifndef OPENSSL_NO_TLS1_3
|
||||
static char *stunnel_ciphersuites=
|
||||
@ -1,219 +0,0 @@
|
||||
diff -up stunnel-5.56/src/ssl.c.verify-chain stunnel-5.56/src/ssl.c
|
||||
--- stunnel-5.56/src/ssl.c.verify-chain 2021-02-17 00:37:28.950981672 +0100
|
||||
+++ stunnel-5.56/src/ssl.c 2021-02-17 00:37:36.047053139 +0100
|
||||
@@ -1,6 +1,6 @@
|
||||
/*
|
||||
* stunnel TLS offloading and load-balancing proxy
|
||||
- * Copyright (C) 1998-2019 Michal Trojnara <Michal.Trojnara@stunnel.org>
|
||||
+ * Copyright (C) 1998-2020 Michal Trojnara <Michal.Trojnara@stunnel.org>
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
@@ -39,7 +39,12 @@
|
||||
#include "prototypes.h"
|
||||
|
||||
/* global OpenSSL initialization: compression, engine, entropy */
|
||||
-#if OPENSSL_VERSION_NUMBER>=0x10100000L
|
||||
+NOEXPORT void cb_new_auth(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
|
||||
+ int idx, long argl, void *argp);
|
||||
+#if OPENSSL_VERSION_NUMBER>=0x30000000L
|
||||
+NOEXPORT int cb_dup_addr(CRYPTO_EX_DATA *to, const CRYPTO_EX_DATA *from,
|
||||
+ void **from_d, int idx, long argl, void *argp);
|
||||
+#elif OPENSSL_VERSION_NUMBER>=0x10100000L
|
||||
NOEXPORT int cb_dup_addr(CRYPTO_EX_DATA *to, const CRYPTO_EX_DATA *from,
|
||||
void *from_d, int idx, long argl, void *argp);
|
||||
#else
|
||||
@@ -72,7 +77,7 @@ int ssl_init(void) { /* init TLS before
|
||||
index_ssl_ctx_opt=SSL_CTX_get_ex_new_index(0,
|
||||
"SERVICE_OPTIONS pointer", NULL, NULL, NULL);
|
||||
index_session_authenticated=SSL_SESSION_get_ex_new_index(0,
|
||||
- "session authenticated", NULL, NULL, NULL);
|
||||
+ "session authenticated", cb_new_auth, NULL, NULL);
|
||||
index_session_connect_address=SSL_SESSION_get_ex_new_index(0,
|
||||
"session connect address", NULL, cb_dup_addr, cb_free_addr);
|
||||
if(index_ssl_cli<0 || index_ssl_ctx_opt<0 ||
|
||||
@@ -104,17 +109,31 @@ int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNU
|
||||
BN_free(dh->p);
|
||||
BN_free(dh->q);
|
||||
BN_free(dh->g);
|
||||
- dh->p = p;
|
||||
- dh->q = q;
|
||||
- dh->g = g;
|
||||
+ dh->p=p;
|
||||
+ dh->q=q;
|
||||
+ dh->g=g;
|
||||
if(q)
|
||||
- dh->length = BN_num_bits(q);
|
||||
+ dh->length=BN_num_bits(q);
|
||||
return 1;
|
||||
}
|
||||
#endif
|
||||
#endif
|
||||
|
||||
-#if OPENSSL_VERSION_NUMBER>=0x10100000L
|
||||
+NOEXPORT void cb_new_auth(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
|
||||
+ int idx, long argl, void *argp) {
|
||||
+ (void)parent; /* squash the unused parameter warning */
|
||||
+ (void)ptr; /* squash the unused parameter warning */
|
||||
+ (void)argl; /* squash the unused parameter warning */
|
||||
+ s_log(LOG_DEBUG, "Initializing application specific data for %s",
|
||||
+ (char *)argp);
|
||||
+ if(!CRYPTO_set_ex_data(ad, idx, (void *)(-1)))
|
||||
+ sslerror("CRYPTO_set_ex_data");
|
||||
+}
|
||||
+
|
||||
+#if OPENSSL_VERSION_NUMBER>=0x30000000L
|
||||
+NOEXPORT int cb_dup_addr(CRYPTO_EX_DATA *to, const CRYPTO_EX_DATA *from,
|
||||
+ void **from_d, int idx, long argl, void *argp) {
|
||||
+#elif OPENSSL_VERSION_NUMBER>=0x10100000L
|
||||
NOEXPORT int cb_dup_addr(CRYPTO_EX_DATA *to, const CRYPTO_EX_DATA *from,
|
||||
void *from_d, int idx, long argl, void *argp) {
|
||||
#else
|
||||
diff -up stunnel-5.56/src/verify.c.verify-chain stunnel-5.56/src/verify.c
|
||||
--- stunnel-5.56/src/verify.c.verify-chain 2021-02-17 00:37:11.577806692 +0100
|
||||
+++ stunnel-5.56/src/verify.c 2021-02-17 00:37:42.542118546 +0100
|
||||
@@ -1,6 +1,6 @@
|
||||
/*
|
||||
* stunnel TLS offloading and load-balancing proxy
|
||||
- * Copyright (C) 1998-2019 Michal Trojnara <Michal.Trojnara@stunnel.org>
|
||||
+ * Copyright (C) 1998-2020 Michal Trojnara <Michal.Trojnara@stunnel.org>
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License as published by the
|
||||
@@ -214,11 +214,15 @@ NOEXPORT int verify_callback(int preveri
|
||||
s_log(LOG_INFO, "Certificate verification disabled");
|
||||
return 1; /* accept */
|
||||
}
|
||||
- if(verify_checks(c, preverify_ok, callback_ctx)) {
|
||||
+ if(verify_checks(c, preverify_ok, callback_ctx))
|
||||
+ return 1; /* accept */
|
||||
+ if(c->opt->option.client || c->opt->protocol)
|
||||
+ return 0; /* reject */
|
||||
+ if(c->opt->redirect_addr.names) {
|
||||
SSL_SESSION *sess=SSL_get1_session(c->ssl);
|
||||
if(sess) {
|
||||
- int ok=SSL_SESSION_set_ex_data(sess, index_session_authenticated,
|
||||
- (void *)(-1));
|
||||
+ int ok=SSL_SESSION_set_ex_data(sess,
|
||||
+ index_session_authenticated, NULL);
|
||||
SSL_SESSION_free(sess);
|
||||
if(!ok) {
|
||||
sslerror("SSL_SESSION_set_ex_data");
|
||||
@@ -227,10 +231,6 @@ NOEXPORT int verify_callback(int preveri
|
||||
}
|
||||
return 1; /* accept */
|
||||
}
|
||||
- if(c->opt->option.client || c->opt->protocol)
|
||||
- return 0; /* reject */
|
||||
- if(c->opt->redirect_addr.names)
|
||||
- return 1; /* accept */
|
||||
return 0; /* reject */
|
||||
}
|
||||
|
||||
diff -up stunnel-5.56/tests/recipes/028_redirect_chain.verify-chain stunnel-5.56/tests/recipes/028_redirect_chain
|
||||
--- stunnel-5.56/tests/recipes/028_redirect_chain.verify-chain 2021-02-17 00:38:44.823745781 +0100
|
||||
+++ stunnel-5.56/tests/recipes/028_redirect_chain 2021-02-17 00:38:16.143456937 +0100
|
||||
@@ -0,0 +1,50 @@
|
||||
+#!/bin/sh
|
||||
+
|
||||
+# Redirect TLS client connections on certificate-based authentication failures.
|
||||
+# [client_1] -> [server_1] -> [client_2] -> [server_2]
|
||||
+# The success is expected because the client presents the *wrong* certificate
|
||||
+# and the client connection is redirected.
|
||||
+# Checking if the verifyChain option verifies the peer certificate starting from the root CA.
|
||||
+
|
||||
+. $(dirname $0)/../test_library
|
||||
+
|
||||
+start() {
|
||||
+ ../../src/stunnel -fd 0 <<EOT
|
||||
+ debug = debug
|
||||
+ syslog = no
|
||||
+ pid = ${result_path}/stunnel.pid
|
||||
+ output = ${result_path}/stunnel.log
|
||||
+
|
||||
+ [client_1]
|
||||
+ client = yes
|
||||
+ accept = 127.0.0.1:${http1}
|
||||
+ connect = 127.0.0.1:${https1}
|
||||
+ ;cert = ${script_path}/certs/client_cert.pem
|
||||
+;wrong self signed certificate
|
||||
+ cert = ${script_path}/certs/stunnel.pem
|
||||
+
|
||||
+ [client_2]
|
||||
+ client = yes
|
||||
+ accept = 127.0.0.1:${http2}
|
||||
+ connect = 127.0.0.1:${https2}
|
||||
+
|
||||
+ [server_1]
|
||||
+ accept = 127.0.0.1:${https1}
|
||||
+ exec = ${script_path}/execute
|
||||
+ execArgs = execute 028_redirect_chain_error
|
||||
+ redirect = ${http2}
|
||||
+ cert = ${script_path}/certs/server_cert.pem
|
||||
+ verifyChain = yes
|
||||
+ CAfile = ${script_path}/certs/CACert.pem
|
||||
+
|
||||
+ [server_2]
|
||||
+ accept = 127.0.0.1:${https2}
|
||||
+ cert = ${script_path}/certs/server_cert.pem
|
||||
+ exec = ${script_path}/execute
|
||||
+ execArgs = execute 028_redirect_chain
|
||||
+
|
||||
+EOT
|
||||
+}
|
||||
+
|
||||
+test_log_for "028_redirect_chain" "execute" "0" "$1" "$2" "$3" 2>> "stderr.log"
|
||||
+exit $?
|
||||
diff -up stunnel-5.56/tests/recipes/029_no_redirect_chain.verify-chain stunnel-5.56/tests/recipes/029_no_redirect_chain
|
||||
--- stunnel-5.56/tests/recipes/029_no_redirect_chain.verify-chain 2021-02-17 00:38:57.819876672 +0100
|
||||
+++ stunnel-5.56/tests/recipes/029_no_redirect_chain 2021-02-17 00:38:24.895545080 +0100
|
||||
@@ -0,0 +1,49 @@
|
||||
+#!/bin/sh
|
||||
+
|
||||
+# Do not redirect TLS client connections on certificate-based authentication success.
|
||||
+# [client_1] -> [server_1]
|
||||
+# The success is expected because the client presents the *correct* certificate
|
||||
+# and the client connection isn't redirected.
|
||||
+# Checking if the verifyChain option verifies the peer certificate starting from the root CA.
|
||||
+
|
||||
+. $(dirname $0)/../test_library
|
||||
+
|
||||
+start() {
|
||||
+ ../../src/stunnel -fd 0 <<EOT
|
||||
+ debug = debug
|
||||
+ syslog = no
|
||||
+ pid = ${result_path}/stunnel.pid
|
||||
+ output = ${result_path}/stunnel.log
|
||||
+
|
||||
+ [client_1]
|
||||
+ client = yes
|
||||
+ accept = 127.0.0.1:${http1}
|
||||
+ connect = 127.0.0.1:${https1}
|
||||
+;correct certificate
|
||||
+ cert = ${script_path}/certs/client_cert.pem
|
||||
+
|
||||
+ [client_2]
|
||||
+ client = yes
|
||||
+ accept = 127.0.0.1:${http2}
|
||||
+ connect = 127.0.0.1:${https2}
|
||||
+
|
||||
+ [server_1]
|
||||
+ accept = 127.0.0.1:${https1}
|
||||
+ exec = ${script_path}/execute
|
||||
+ execArgs = execute 029_no_redirect_chain
|
||||
+ redirect = ${http2}
|
||||
+ cert = ${script_path}/certs/server_cert.pem
|
||||
+ verifyChain = yes
|
||||
+ CAfile = ${script_path}/certs/CACert.pem
|
||||
+
|
||||
+ [server_2]
|
||||
+ accept = 127.0.0.1:${https2}
|
||||
+ cert = ${script_path}/certs/server_cert.pem
|
||||
+ exec = ${script_path}/execute
|
||||
+ execArgs = execute 029_no_redirect_chain_error
|
||||
+
|
||||
+EOT
|
||||
+}
|
||||
+
|
||||
+test_log_for "029_no_redirect_chain" "execute" "0" "$1" "$2" "$3" 2>> "stderr.log"
|
||||
+exit $?
|
||||
@ -1,18 +0,0 @@
|
||||
-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQKTBAABCgB9FiEEK8fk5n48wMG+py+MLvx/8NQW4BQFAl3YIPhfFIAAAAAALgAo
|
||||
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDJC
|
||||
QzdFNEU2N0UzQ0MwQzFCRUE3MkY4QzJFRkM3RkYwRDQxNkUwMTQACgkQLvx/8NQW
|
||||
4BTuMw//R+LJhCo2prR6RIxEsYbfzIwkl9NwcE5EPTKse2umTOHsMRfVMpZiKjCl
|
||||
5UC1tLbqUzSjAydQiFwdvcHZAJLWblr84p+CC5hEaS/rwX4PL221gqqrC8Ut7ap3
|
||||
n/v5gCJ8iqnpgZSgHPSGqucG3x1KlZotPnny1RVIjCSHPvoUtocAwJNSChRkyUT0
|
||||
ym8qhUPyOmRhYQZew1haxFJa26yc017dN5QZy+H3uo0zPLXaWJpPjJG/1pBtden4
|
||||
mL+mg8phZZ9MtBtEOK2NTA+4K24vcM+aHoEyMI/dcmi4NN256N5CJZ13tF3LgHNV
|
||||
j0vp1a75p5aAMeRTv7zShegZGvJJciyYJKwRnOAUnHVFDhnsgd05VQHeWC1aFKjM
|
||||
cXwrvHgGn+TG0V29ahnzR7NdVhkuP3etcqx6FuIgcj2omp0Bj4zFRlKSl4x+hY56
|
||||
MTvwksIXZTItHvffiE49ExGPA8OQW3S9Sr+lPFk98xjVuTU/P8GIVNp2kof4ezYN
|
||||
Yhav4mA/KAkMX0fb+Cw6eyZl0aZEPx76hhkKhh2OmR8w3k5X2hetGcXX1/UFEHCm
|
||||
uNCvWwV5Ry6Kc8Zpr8p6fUOh0Se4cNi59c1FKEwMX1hTgLklbIZioiFM/fR0RLOJ
|
||||
PU/Cq+NbaZ3O8Cup7PsVjCDgXTcKcQAdQTOxgfW6f+szmTo5Qx4=
|
||||
=RhpX
|
||||
-----END PGP SIGNATURE-----
|
||||
@ -0,0 +1,27 @@
|
||||
From 6cb73d824ac204f5680e469b0474855aaa6b8ddc Mon Sep 17 00:00:00 2001
|
||||
From: Clemens Lang <cllang@redhat.com>
|
||||
Date: Mon, 12 Sep 2022 11:07:38 +0200
|
||||
Subject: [PATCH 2/8] Apply patch stunnel-5.61-systemd-service.patch
|
||||
|
||||
Patch-name: stunnel-5.61-systemd-service.patch
|
||||
Patch-id: 1
|
||||
From-dist-git-commit: 70b3076eb09912b3a11f371b8c523303114fffa3
|
||||
---
|
||||
tools/stunnel.service.in | 1 +
|
||||
1 file changed, 1 insertion(+)
|
||||
|
||||
diff --git a/tools/stunnel.service.in b/tools/stunnel.service.in
|
||||
index fa98996..0c5a216 100644
|
||||
--- a/tools/stunnel.service.in
|
||||
+++ b/tools/stunnel.service.in
|
||||
@@ -6,6 +6,7 @@ After=syslog.target network-online.target
|
||||
ExecStart=@bindir@/stunnel
|
||||
ExecReload=/bin/kill -HUP $MAINPID
|
||||
Type=forking
|
||||
+PrivateTmp=true
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
--
|
||||
2.37.3
|
||||
|
||||
@ -0,0 +1,37 @@
|
||||
From 6c8c4c8c85204943223b251d09ca1e93571a437a Mon Sep 17 00:00:00 2001
|
||||
From: Sahana Prasad <sprasad@localhost.localdomain>
|
||||
Date: Mon, 12 Sep 2022 11:07:38 +0200
|
||||
Subject: [PATCH 3/7] Use cipher configuration from crypto-policies
|
||||
|
||||
On Fedora, CentOS and RHEL, the system's crypto policies are the best
|
||||
source to determine which cipher suites to accept in TLS. On these
|
||||
platforms, OpenSSL supports the PROFILE=SYSTEM setting to use those
|
||||
policies. Change stunnel to default to this setting.
|
||||
|
||||
Co-Authored-by: Sahana Prasad <shebburn@redhat.com>
|
||||
Patch-name: stunnel-5.69-system-ciphers.patch
|
||||
Patch-id: 3
|
||||
From-dist-git-commit: 70b3076eb09912b3a11f371b8c523303114fffa3
|
||||
---
|
||||
src/options.c | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/src/options.c b/src/options.c
|
||||
index 6e4a18b..4d31815 100644
|
||||
--- a/src/options.c
|
||||
+++ b/src/options.c
|
||||
@@ -321,9 +321,9 @@ static const char *option_not_found=
|
||||
"Specified option name is not valid here";
|
||||
|
||||
static const char *stunnel_cipher_list=
|
||||
- "HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK";
|
||||
+ "PROFILE=SYSTEM";
|
||||
static const char *fips_cipher_list=
|
||||
- "FIPS:!DH:!kDHEPSK";
|
||||
+ "PROFILE=SYSTEM";
|
||||
|
||||
#ifndef OPENSSL_NO_TLS1_3
|
||||
static const char *stunnel_ciphersuites=
|
||||
--
|
||||
2.39.2
|
||||
|
||||
@ -0,0 +1,37 @@
|
||||
From 4ffcbcecaf901b13a36dba1e651cfc16e5242e5a Mon Sep 17 00:00:00 2001
|
||||
From: Clemens Lang <cllang@redhat.com>
|
||||
Date: Thu, 19 Oct 2023 14:41:54 +0200
|
||||
Subject: [PATCH] Preserve NO_TLSv1.[123] option compatibility
|
||||
|
||||
On RHEL 8, stunnel used to support the NO_TLSv1.1, NO_TLSv1.2, and
|
||||
NO_TLSv1.3 values for the options directive. Since we do not break
|
||||
compatibility, preserve these options for customers that have them set.
|
||||
|
||||
Related: RHEL-2340
|
||||
---
|
||||
src/options.c | 3 +++
|
||||
1 file changed, 3 insertions(+)
|
||||
|
||||
diff --git a/src/options.c b/src/options.c
|
||||
index a306c4c..c05692c 100644
|
||||
--- a/src/options.c
|
||||
+++ b/src/options.c
|
||||
@@ -229,12 +229,15 @@ static const SSL_OPTION ssl_opts[] = {
|
||||
#endif
|
||||
#ifdef SSL_OP_NO_TLSv1_1
|
||||
{"NO_TLSv1_1", SSL_OP_NO_TLSv1_1},
|
||||
+ {"NO_TLSv1.1", SSL_OP_NO_TLSv1_1},
|
||||
#endif
|
||||
#ifdef SSL_OP_NO_TLSv1_2
|
||||
{"NO_TLSv1_2", SSL_OP_NO_TLSv1_2},
|
||||
+ {"NO_TLSv1.2", SSL_OP_NO_TLSv1_2},
|
||||
#endif
|
||||
#ifdef SSL_OP_NO_TLSv1_3
|
||||
{"NO_TLSv1_3", SSL_OP_NO_TLSv1_3},
|
||||
+ {"NO_TLSv1.3", SSL_OP_NO_TLSv1_3},
|
||||
#endif
|
||||
#ifdef SSL_OP_PKCS1_CHECK_1
|
||||
{"PKCS1_CHECK_1", SSL_OP_PKCS1_CHECK_1},
|
||||
--
|
||||
2.41.0
|
||||
|
||||
@ -0,0 +1,18 @@
|
||||
-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQKTBAABCgB9FiEEK8fk5n48wMG+py+MLvx/8NQW4BQFAmUKA7NfFIAAAAAALgAo
|
||||
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDJC
|
||||
QzdFNEU2N0UzQ0MwQzFCRUE3MkY4QzJFRkM3RkYwRDQxNkUwMTQACgkQLvx/8NQW
|
||||
4BS9ZxAAxK9dNbFrL3ZOmW18OT82LKza1Zli9grdiEx4GY6s+atY6DgrWiOfJi5A
|
||||
NQtwoeYRWcEkMgWKRev28zMEPzGkUzYyaBUbqDDisAziDXyyKfriqmkbG4jl8Gv+
|
||||
qY+SgrM2ElhZxTnvRtUvzG6dogBeA1iWcNANAYgYVxH2yOFcNB0HYA25aBrPpmO4
|
||||
37h7ZRc94Yn2fK4zdR7D8DxYEAkmrZJxMydytTwp4EHu2t3lmw+vJdzIS7RtJoRL
|
||||
Apd/Fh8USZB++Xx+4vFiuDcydGz5xdUNCB9jXYJoTCxFUP9mQsyR05Q8uscPunk9
|
||||
SfCd7pbzextsoFF5gOoee3tvwgwlhI7SR9eS585ni0oXyNaFUMwXS0qBVN1f86fr
|
||||
iAl3j8pGVnqJpmiZ8o4xGj3/g5Nvp14Ts/qXlRvqvzoU6Ka6MEefH2sMxzm5RCQr
|
||||
tAcrDROGUyN0HJcdy8TAWobqX0HWQqwlGjyeZAJAtFcmno00Au6FYnkn+dLkvxIx
|
||||
bsEaaG7QrP9p6JpEnQhsLLEKAgD9olmPWzFLCeeE1PZg/klSbVG4qmHv113ixlDy
|
||||
6smwnHDnb+UysgosKyAzWqlrLUhPYqca83Y8DFbpS9wi1AG6OjCuJ3jtdRq+HAjn
|
||||
l5PRZhWOTUi+weLWSpmGO2py5JfJm010grKdzA9d9YMR9YspSOU=
|
||||
=6RnW
|
||||
-----END PGP SIGNATURE-----
|
||||
@ -0,0 +1,107 @@
|
||||
From 5f0b818f62720d5bd8b8c9c631604ddb4c992be7 Mon Sep 17 00:00:00 2001
|
||||
From: Clemens Lang <cllang@redhat.com>
|
||||
Date: Wed, 31 Jul 2024 15:35:24 +0200
|
||||
Subject: [PATCH] src/verify.c: Speed up loading client CA list
|
||||
|
||||
Do not attempt to load and print all trusted CAs unless we need them to
|
||||
invoke SSL_CTX_set_client_CA_list(3). Loading all trusted CAs can be
|
||||
slow, especially if there are many. The CAdir format allows OpenSSL to
|
||||
only load them on demand, avoiding this overhead.
|
||||
|
||||
Additionally, SSL_CTX_load_verify_locations(3) supports file formats
|
||||
that SSL_load_client_CA_file(3) and SSL_add_*_cert_subjects_to_stack(3)
|
||||
do not support, for example certificates in the BEGIN TRUSTED
|
||||
CERTIFICATE format. Valid configurations with older stunnel versions
|
||||
that point to such a file would otherwise needlessly start failing.
|
||||
|
||||
Additionally, use SSL_load_client_CA_file(3) to load certificates from
|
||||
a file rather than SSL_add_file_cert_subjects_to_stack(3), since the
|
||||
former uses a hashtable for deduplication, but the latter relies on
|
||||
a sorted STACK_OF(X509_NAME). The sorting is exceptionally slow in
|
||||
OpenSSL, because the comparison function for X509_NAMEs converts them to
|
||||
DER involving a memory allocation, which is already expensive, but even
|
||||
more expensive when used with stunnel's custom allocator functions.
|
||||
|
||||
An upstream PR openssl/openssl#25056 will eventually fix this, but it
|
||||
will take quite a while for this to arrive on users' systems, and it
|
||||
will likely not be backported into older affected versions of OpenSSL or
|
||||
their forks.
|
||||
|
||||
Related: RHEL-50154
|
||||
Related: RHEL-46411
|
||||
Signed-off-by: Clemens Lang <cllang@redhat.com>
|
||||
---
|
||||
src/verify.c | 42 ++++++++++++++++++++++++++++--------------
|
||||
1 file changed, 28 insertions(+), 14 deletions(-)
|
||||
|
||||
diff --git a/src/verify.c b/src/verify.c
|
||||
index 56ab130..d1d3849 100644
|
||||
--- a/src/verify.c
|
||||
+++ b/src/verify.c
|
||||
@@ -95,10 +95,35 @@ NOEXPORT int init_ca(SERVICE_OPTIONS *section) {
|
||||
if(!SSL_CTX_load_verify_locations(section->ctx,
|
||||
section->ca_file, section->ca_dir)) {
|
||||
sslerror("SSL_CTX_load_verify_locations");
|
||||
+ return 1; /* FAILED */
|
||||
}
|
||||
}
|
||||
|
||||
- ca_dn=sk_X509_NAME_new_null();
|
||||
+ /* Do not attempt to load and print all trusted CAs unless we need them to
|
||||
+ invoke SSL_CTX_set_client_CA_list(3). Loading all trusted CAs can be
|
||||
+ slow, especially if there are many. The CAdir format allows OpenSSL to
|
||||
+ only load them on demand.
|
||||
+ Additionally, SSL_CTX_load_verify_locations(3) supports file formats
|
||||
+ that SSL_load_client_CA_file(3) and SSL_add_*_cert_subjects_to_stack(3)
|
||||
+ do not support, for example certificates in the BEGIN TRUSTED
|
||||
+ CERTIFICATE format. Valid configurations with older stunnel versions
|
||||
+ that point to such a file would otherwise needlessly start failing. */
|
||||
+ if(section->option.client)
|
||||
+ return 0; /* OK */
|
||||
+
|
||||
+ if(section->ca_file)
|
||||
+ /* SSL_load_client_CA_file is a lot faster than
|
||||
+ SSL_add_file_cert_subjects_to_stack(). Use it for ca_file if
|
||||
+ specified, then add the rest of the certificates to this stack. */
|
||||
+ ca_dn=SSL_load_client_CA_file(section->ca_file);
|
||||
+
|
||||
+ if (!ca_dn)
|
||||
+ /* ca_file not set, or SSL_load_client_CA_file(3) failed. */
|
||||
+ ca_dn=sk_X509_NAME_new_null();
|
||||
+
|
||||
+ /* client CA list initialization from directory */
|
||||
+ if(section->ca_dir)
|
||||
+ SSL_add_dir_cert_subjects_to_stack(ca_dn, section->ca_dir);
|
||||
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
/* CA and client CA list initialization with the engine */
|
||||
@@ -115,24 +140,13 @@ NOEXPORT int init_ca(SERVICE_OPTIONS *section) {
|
||||
}
|
||||
#endif
|
||||
|
||||
- /* client CA list initialization with the file and/or directory */
|
||||
- if(section->ca_file)
|
||||
- SSL_add_file_cert_subjects_to_stack(ca_dn, section->ca_file);
|
||||
- if(section->ca_dir)
|
||||
- SSL_add_dir_cert_subjects_to_stack(ca_dn, section->ca_dir);
|
||||
-
|
||||
if(!sk_X509_NAME_num(ca_dn)) {
|
||||
sk_X509_NAME_pop_free(ca_dn, X509_NAME_free);
|
||||
return 1; /* FAILED */
|
||||
}
|
||||
|
||||
- if(section->option.client) {
|
||||
- print_CA_list("Configured trusted server CA", ca_dn);
|
||||
- sk_X509_NAME_pop_free(ca_dn, X509_NAME_free);
|
||||
- } else { /* only set the client CA list on the server */
|
||||
- print_CA_list("Configured trusted client CA", ca_dn);
|
||||
- SSL_CTX_set_client_CA_list(section->ctx, ca_dn);
|
||||
- }
|
||||
+ print_CA_list("Configured trusted client CA", ca_dn);
|
||||
+ SSL_CTX_set_client_CA_list(section->ctx, ca_dn);
|
||||
|
||||
return 0; /* OK */
|
||||
}
|
||||
--
|
||||
2.45.2
|
||||
|
||||
Loading…
Reference in new issue