Compare commits
No commits in common. 'i8c' and 'c9' have entirely different histories.
@ -1 +1 @@
|
||||
SOURCES/stunnel-5.71.tar.gz
|
||||
SOURCES/stunnel-5.62.tar.gz
|
||||
|
||||
@ -1 +1 @@
|
||||
dab534acc28f389f98bf8724d9f42ad9ca472691 SOURCES/stunnel-5.71.tar.gz
|
||||
e18be56bfee006f5e58de044fda7bdcfaa425b3f SOURCES/stunnel-5.62.tar.gz
|
||||
|
||||
@ -1,125 +0,0 @@
|
||||
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||
|
||||
mQINBFTU6YwBEAC6PP7E4J6cRZQsJlFE+o3zdQYo7Mg2sVxDR6K9Cha52wn7P0t0
|
||||
hHUd0CSmWyfjmYUy3/7jYjgKe4oiGzeSCVK8b3TiX3ylHi/nW3mixwpDPwFmr5Cf
|
||||
ce55Ro3TdIeslRGigK8Hl+/l4n9c9z/AiTvcdAEQ34BJhERce4/KFx+/omiaxe7S
|
||||
fzzU/+52zy+v4FfnclgRQrzrD8sxNag6CQOaQ8lTMczNkBkDlhQTOPYkfNf76PUY
|
||||
kbWpcH7n9N50nddjEaLf7DPjOETc4OH/g5a99FSEJL7jyEgn+C8RX7RpbbAxCNlX
|
||||
1231NZoresLmxSulB6fRWLmhJ8pES3sRxE1IfwUfPpUZuTPzwXEFJY6StY5OCVy8
|
||||
rNFpkYlEePuVn74XkGbvv7dkkisq4Hp59zfIUaNVRod0Xk2rM8Rx8d5IK801Ywsn
|
||||
RyzCE02zt3N2O4IdXI1qQ1gMJNyaE/k2Qk8buh8BsKJzZca34WGocHOxz2O5s7FN
|
||||
Q1pLNpLmuHZIdyvYqcsenLz5EV8X2LztRmJ3Se4ag/XyXPYwS6lXX1YUGVxZpk0E
|
||||
sQDRdJvYCsGcUy253w+W7Nm/BtjKi6/PJmjEEU7ieHppR9Yp+LI3lyzNBeZAIVqk
|
||||
4Hco05l4GUKtEDFfOQ58sULDqJWmpH4T72DHeCpfRB0guaPa5TYY7B0umQARAQAB
|
||||
tC5NaWNoYcWCIFRyb2puYXJhIDxNaWNoYWwuVHJvam5hcmFAc3R1bm5lbC5vcmc+
|
||||
iQJSBBMBCAA8AhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgBYhBKyRXqMGRdnT
|
||||
1Nrk/rEEiTLdOqqjBQJiemhbAhkBAAoJELEEiTLdOqqjH/YP/i5fQuvTvwSHZAwK
|
||||
JgSUijxD4z2jCtYvXIa7BPNiu8mnyupPAdoZE7BNehuvAc7kYj4dNmC/cY+CRcan
|
||||
OW05ByU/N+RObQYs6dkSLuyzOfqdnA2SZgcPreOZyLe/Yz9nSh5BVigSyiNY+clT
|
||||
JMfISdvfAxlxkVxyfJ293ePECZ7VKfzp18ntDBIY5yos4K0FXKpFVhhWHT9SlsQe
|
||||
tAKTOm6WdJx852y53TvZYzPEVznZhLSj//yYWG7TVQ47oSrsUW5pGaQybtYNIwGa
|
||||
sHGj0SFscYb8IBF4gOaTFPiwKJykmwfF0F7A6wO+oSs7By1o4fEoVr1y3UWO/ATx
|
||||
RF3GyX/6NHTu2OwTmtWozTKkd4agGPmQgn+ApueaBq7Tn9EA+5e83hRY8/c0xOvu
|
||||
XRHrB+PTp4HT3yPcVbGP6vRkpPsRIxtzzw+G1AdwIcMULg/J5qKilRyKLbN12cmc
|
||||
Jjtk6Ii7cskgj/3iYVRy/Xtw9Q2+9aMPPs1H4QklimDuR/KWCqyd61e1ct+Y4XGq
|
||||
HM93/GQuku1sGA6YsfUpDWv3rjwoGejyif3lyHjERaGh1BCYD6Olhe2QtCEuOvuA
|
||||
G2qPT0gZ1q33JVN3wNJfD6JreG7HubG0le+iwLoQTXa3qjhF8DeAgOC+yLKYv3iD
|
||||
ms49fpkKFScmRCmWU0C/2zqe0/GetCtNaWNoYcWCIFRyb2puYXJhIDxNaWNoYWwu
|
||||
VHJvam5hcmFAbWlydC5uZXQ+iQJPBBMBCAA5AhsDBgsJCAcDAgYVCAIJCgsEFgID
|
||||
AQIeAQIXgBYhBKyRXqMGRdnT1Nrk/rEEiTLdOqqjBQJiemhbAAoJELEEiTLdOqqj
|
||||
k5UP/1G8u1Hpr0Ie4YXn1ru1hQaauEqTXGfgcsSuuqvS4GCgY93+Q0jv0YV1Owxs
|
||||
pJWmN3aYKtsj86EAEkOcz23HkhwwvTKkhrZWCATQzhpGZfFWECPm+CycNksc+pkq
|
||||
eykg5RN00DecGpG5x0p2twrRI4j+K4OKSGJvx8vjxBMGoGAoHtBl73nhwuY9CsqL
|
||||
CnCn3lohv03GPvvlO6dhOordBI4U50ky5ZZsQ/qMD7vAGFktbJMyhYJ96ASdVqfG
|
||||
L0DTQ6E1QwS4PQlyEt6PBCtt6T3kU7i9mYy+TQtI+wH3r2hx+UEQaC+9hzY4FZwH
|
||||
xOdH7zumOthMu/uBGK2uMkj7mVpHEGU/69EvROYzf0HtN2vs2yCMirtrlbfQ0bez
|
||||
YyXiTd8+ka0vTWM2rE6rav5RIRDmD7U3u4fPwnpSRTDxCHJglIisymLd01W0Qh8l
|
||||
qCyHOOsRHu2k3RfdILd+F26Ii31073kAaga5iDlKrPyVV38upLIPy/G9QJ8rdYBR
|
||||
EvF0VaYQW+rwsInE8mYfWgcwKT3ZeWop0dD7NFurbHZxfTkL1QCEo+EurrFxBLCm
|
||||
qfPEbQwoMwS5hCAcGRjXDpt0ZZe55VdLXaW9E/GINHPVoM+dMqmmYxEOCvuOez4c
|
||||
MMmt6a5kFPPtWo2o7dcBpDG7ZX3UkUGVAmQuSENIY3yXqYcXtC9NaWNoYcWCIFRy
|
||||
b2puYXJhIDxNaWNoYWwuVHJvam5hcmFAbW9iaS1jb20ubmV0PokCTwQTAQgAOQIb
|
||||
AwYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AWIQSskV6jBkXZ09Ta5P6xBIky3Tqq
|
||||
owUCYnpoUQAKCRCxBIky3Tqqo7cBD/sFjmAnOyuEvlVKXEihLmABFBeWjKiGaR4U
|
||||
0+V8ZPvBEzHVQ5e2ywqa68xgFK66JlapnZlAeOoUZYc/uj0xzNwzS4sdnc/ejWn+
|
||||
B0gM9ZLYs1BeYib2k4Bf0c8ccjjCX5r8+Uio8aCB4hSyckmyD+svfmnrzyMEEAZN
|
||||
d+0uiwmmHNEDHqIg76xo7DO+DvV2+sEkLEtdKCfTws94qEWQHGHYwpcbDngSamVZ
|
||||
zML48L4liQX0l7Dz8j09Tf1EYg2DRSvn4s2bzyrFIsnz6yrlf8K0hCYkaTLKnCSx
|
||||
Bj7ESXj/bOQY4fBAHNy2gRXq3ELgdliCQHeT+9TD5JI58rWQBY48QGF7CAxMcC3H
|
||||
3nI/Zq/DSaakOVwianqY2VJDFAYXogmEOR/kWE3lPerp6qum+n4WcDiteQXJMHmV
|
||||
t/JYAZ3zbOhmu9F2NI7Ce4uZe8rQ0PG5Jgb5wE76i9zrCwFACPKhJVim4kWIOPf8
|
||||
eT1LCC4adpyeUMrH342CVb2xpS+gQ89V7sTt9uFPp9wTl5QvsD3uTWKzGkRV9s7b
|
||||
rnFuJYGDRM/EN0nFZF8D0RbrwYNK5KXSZ0VOTrud9ZcEsJQeISqLX4QBMrSl/Nst
|
||||
r9MTUuBf6N3b5zDRmHJQ6+myyE/8cgHwEsmOIJCSEcQjkYsUruQhuW2Et1EZtrcb
|
||||
/KHFRhRjP7RATWljaGHFgiBUcm9qbmFyYSAoYXV4aWxpYXJ5IGFkZHJlc3MpIDxN
|
||||
aWNoYWwuVHJvam5hcmFAZ21haWwuY29tPokCTgQTAQgAOAIbAwULCQgHAgYVCgkI
|
||||
CwIEFgIDAQIeAQIXgBYhBKyRXqMGRdnT1Nrk/rEEiTLdOqqjBQJiemhDAAoJELEE
|
||||
iTLdOqqjWfkQALjs436L79R26iQc8aWu3IWAZ8FOv8VqbTcGH3fQ16DcJ+OaBQkl
|
||||
qHTWsbs9Bhq49lU6WiZLIJWTp8bl6fdC5XbJYFYW7fMBSyUFpSqQFACY6EF3vdDS
|
||||
bcVcT6aModzq1mG9CFuU5wt0GrZOy4v0pXvJK0Y+CzY3Rm/Nev0Ou3HUFWgsOpHZ
|
||||
jnCCkNyQ1C1jJ9mDid55dID8byLvkmS8Z3pVhFQ3Ko9gZv47GeeNjG26rbNmsVwZ
|
||||
Ki7c9iJM/RbCgr+LVElFVtFyJP2WUxHjl2RbrJIJB9YUNY1N7z0tDnqN1FCPbFkj
|
||||
zkMuuj0yPp9CqGZge+A5tT5NfytGYPMSOD9up4SXVr+ejOtUL5riW3LsnewjTJuM
|
||||
f2qP1h52FAduB9SfGTf0XlLlKJkjkw3Q9WmrOndJcEsKRGarfcWFPMOml3xmcoAM
|
||||
9jU0H9P1ZAHlKON0eL1vKBgS5XL0s4pVvwsYZ+dfDcNU+bUCrTRLc0uccsIzDrio
|
||||
bbaz7VtUzEsWqPozW6CTozDWDSfKRuWuB2vAYfqKJN8ZAkvOu00ZKwT/DiCpLQ6e
|
||||
GQ8tcAvum9Sd9jydwqs89UNhKNkovwMwALjLITaZ72ILgYo3Mo57fT6MpVspxJ23
|
||||
+6RP8+MAM+HhJYfODuGvNHR3n5aO0WnwM8YoH14hjHUKtr7z83iivhSOuQINBFTU
|
||||
68MBEADyAgLrjV0rpqn1bUrcSSpGfTPrOLN1Uav+O9/zEVd5Sr5q7GLFnS0Rjo0z
|
||||
kIFLJrkEIr0gZVaYk1trPJZRriWUDoS+ZTFxN4YTumlADgqXVvO9Srm6mj7z7RW6
|
||||
q8sL9tXPQNScVJYlgcBms9n7I7TIyry9oZOjmTAqLFDg2L437USIAspl7HWDpRb1
|
||||
3QcBxgRr+VNaHPcnRXXLJjhWi/fSC2ijrsqRIL9KzBnMhHTQJAavPe3CUa4HvdKb
|
||||
Vh+oOptjx1Asl7JTSi8h5T3lUjlxAXoPUfxh1oxZCboy1UB8hflYygf56rgCeT2G
|
||||
KVF4YA2QhY1KozbUOt27dytsYhiJk8Rp0p8bHCq7C9ENMSAPiCOoy8R3EDZbqzhZ
|
||||
HfpLAyR460RKPbUyJHZgNxsjMhtSH2nQ/wNka9BxWHjmMKB05wvm2H1HTvqelcef
|
||||
wUh7Yh8BmdfU6emwqf9ionTA0WEZhbFX/JkDXQ1sUoVeEPUUaqs7PqVKqaoPPTS1
|
||||
eh8XjfZp77s/NM/2fhyKPiTRJgbWX8tOGc5gvdI1QIbesIBJ5aheaHEJhEaLRfDc
|
||||
gmtylU2Y1AP5IstONUH3gCUONKXHWrRX73KaEYeLnXCwFJqMzAN7FpIj9YzXL2VE
|
||||
7CXt54APjV88CvNOV4CpPz1qRYt69MEta+Pn2aS729kBbbr/VQARAQABiQIfBBgB
|
||||
AgAJBQJU1OvDAhsMAAoJELEEiTLdOqqjY0IQAIcnt7SXw2FLiyV/N6PUABc7AvXA
|
||||
N7Gfq2GmB7EDKpkshqJuqEjJuFKjUs4vU1j/nnK2xxs5Avs2WJEBdU3oX2Vx6v6r
|
||||
PEvkmDHNRTp2vJqk1lizTq7fB+vxm1Ju8gA43/Dz22b20fGg1QhhllRlE4UFbp+f
|
||||
xGSFuhCzSEkXFZ9aCE7GFLRNcnz8xnhhx8PL4TDosgDKbcDVdj777ZUwQeopzKFT
|
||||
3lbmyoCx87kyRFZrQT0lNLZ1ZO141NY+ifLAkZf+ZJVUxmA5kXqjfZVv0tOcHrvp
|
||||
hBo+IyW7aqD69GREz/PIaO8/HuGKV/rwJbFlwgeyV+nmAlXpG+2Ur6a4S8iRKY1j
|
||||
KLyFCnVjkLq5Zv0la3/0hIn5fP6f7mcAcRTNb8t4QPKGNWVL286gADLXyvjuZDJv
|
||||
MnarbM4ej3OXd8o4nZLhIUEoYe4iE87EbYKu6HE31Tn5HBMOooQJ64JlE4xhAvOW
|
||||
Yg/a8z824VWFCbyI2FtO8R6eHiZYPgi44cmSq/MorMBeWWiy5QrgHSRuWHgZo5WY
|
||||
SNpcbDzvz2s6VDMPnnrpKAo8M1S2ibn94hzLr9RgGgV3uUuW0hVJIIDVVQxTgxYm
|
||||
CPBr2CTozGg17x1wnX3uhAx+Fk2MnzRLkL5rZqXjCtHa8v/eFeHLYzaQbvdEtLPE
|
||||
SJWgmwb6FvM218hruQINBFTU7lkBEADWkatDVXdgxcXcPPC8D+5Zv3XanCpS8wAA
|
||||
q9gIOIQsg4/Ttzfb7PTg39s5eOJnYlvwC4gKPi/3a1cDKC1/XzPHChTwA5eK5Jw/
|
||||
fDLVmmsHDyTvV03LReYRduJfu2Quh7Q7NaUJo1NqNJdMQtP6dgdM6QGysLhP7LsD
|
||||
Bi55AlhRpGQlH/lNzrxSdFI7b3mmAl3sShZYCTLdt0f5Mo3QyxqAInBr5GtcUa0g
|
||||
qNTRcAqx11PFArHZJQYXRBV01n/XgO6jvdu2he0eAHSjF7CeyImnlcpZibntFI0u
|
||||
/UsqvbqJJS1QzUIAhkAu4YwDJBdUSjs6bO5mY3TJFgzsVKekbisgOcPFiENNpr7F
|
||||
ZvvfxXy4tANkBWcC4ESGrVFAQOtEz9ctuJu9UHOl34kj1ad40SnR6GrmwQLoVspj
|
||||
PQepWTZIfUOlvS2Cu3HPdzus+zu9F2YUzFO5hy1LO6o0ekpf4LquDIBbazEQoPTK
|
||||
zw5gRreG+tAVIDOcz+Pdfx2B7UOuIchB38O3j4sx09yxCTe+3LuljFkgNFr2GXue
|
||||
Bp6xBJn/s9X9yPtTuqJ5OvW6U7UZzkZzJLYe7g/3XT0dfW0ERC8Yelup70tzZ3RU
|
||||
qAdWMb28MusTWH+pcpuafQsXVhHh2Noz6xgJ9g475bNkpQAI90yrcuJ3/ehDvWnp
|
||||
42C7qVByAQARAQABiQQ+BBgBAgAJBQJU1O5ZAhsCAikJELEEiTLdOqqjwV0gBBkB
|
||||
AgAGBQJU1O5ZAAoJEC78f/DUFuAU3HoQAJHsIoHcy/aU1pFGtpVHCM2u6bI4Oqyd
|
||||
f+h7eVp3TiIIFv0nEbI3JMYXSzq16hqhxfEh5nnRsXsa5hyd6kwameIwKQTbKaUz
|
||||
qu4U01NRgLTYWyujApBugLtLkM3aXuVvieWDINfuc6U4yaFNzcP9Cx24zJL0fmSM
|
||||
UUq3Mtg7BERX9Ecj/BBTJPLN7yqz8HGlPf8exIm4ZnJstJ39+Z4zjfGCFx18OApN
|
||||
oaQWSGFbtRaC06FC1jGvRUPgcTDgL6czKSyooAgUwGMkCq2y5Z5KBq9WttTwqvOV
|
||||
wkUdKui9ns+LSYoxgcaiY+y1lxnHCvXm3cGEO+iAxJGxxTWYtSKAsQaJbE9XG1CW
|
||||
YdNl8yezgLLThLuMrgaLHQ83heL/2s5wsUJvnN11wtWuqK5P523879M8pQodO8sv
|
||||
WAXgOXKlu7xNBa07vENI/LvBJ09ZQ3kYGOzFtl9WVam+9UyYZS7KAiXQuSsksobG
|
||||
TfoCc2kQ+qxD171GyC7l0/2UY/PeKDETen5SWFajl6ompnAB8QVv7Q9DMpJDrMgV
|
||||
AB/nR5Ij+lZ/5en1c5Pjt3jLxpbMcDtP+Nr21vJ356DvVk6o4W1U/zMVa+Y+eiiz
|
||||
GsFHuor9EFjn89cqF8bXTIRhdKNNqnh2azLjfSXwxy6qjnmKLGBPm/Fl9N7IWNOM
|
||||
eaO4cPWtNN+leTgP/0Yj1wh+tZzOGttY3wGg/roiYxelWFnMO3pLm710dI0l2qK8
|
||||
PMKSS1v+mxcgu++7eouZvWcluw3M30Ymbouh27MInhKpqh2OEyQ2L9Nz3l3HSfZw
|
||||
I/ZGH+O/OjvOupA7T1zxq3+kUSIXwuBSVzlBoH8Y2FcGomiDbI7NQ8YqrQ4zL/C2
|
||||
1bjZMJ7tX4nx+efXrF8aGdXCaJZFBqp0KIUNjYiI4eGdHB8lUA2t11+5T8Any9jx
|
||||
dfOvEjthkvjdXnfRaJyHVUHTRcsVTxqPTwWyN0W9HvsADEVT4J3qwfrKrqOxFeml
|
||||
DQE47XlpH7CikS+0rAN1G7dNrB4LVcwstDhe431CXRswfR3rbq4wbbNR9kY7WM1M
|
||||
5LixSESomwiZuwv+GA0Mpi9+jTBIc9aZCj2ePDtobwx7Lvsjd8vUQuP9N9rzqeM+
|
||||
kn+2YUwtX2e1YAJxb9ze2iN1w/bvytPD/jOT5KvZm/7ds/XKMl3TPgHeBhjPYFRh
|
||||
NTt3KIDjUqCThl9XWfY1QDFAljO8QgBlwwRYDes5Nv4CNwFVdfz0aTQETKRWYD0b
|
||||
zTy1uYj7gNR3Zz/53XF659vjdMY6LAqrBj46z2J7LcVuyehi7Mo+x3ksHIkUS51s
|
||||
wHXnaH3m783KxozQCML7I+2WlItQhoNRbvlUCVAo9aPUCDm5WlzZJwwSN69B
|
||||
=EgcU
|
||||
-----END PGP PUBLIC KEY BLOCK-----
|
||||
@ -0,0 +1,22 @@
|
||||
diff -up stunnel-5.48/src/str.c.coverity stunnel-5.48/src/str.c
|
||||
--- stunnel-5.48/src/str.c.coverity 2018-07-02 23:30:10.000000000 +0200
|
||||
+++ stunnel-5.48/src/str.c 2018-09-04 17:24:08.949928906 +0200
|
||||
@@ -165,6 +165,7 @@ char *str_vprintf(const char *format, va
|
||||
for(;;) {
|
||||
va_copy(ap, start_ap);
|
||||
n=vsnprintf(p, size, format, ap);
|
||||
+ va_end(ap);
|
||||
if(n>-1 && n<(int)size)
|
||||
return p;
|
||||
if(n>-1) /* glibc 2.1 */
|
||||
diff -up stunnel-5.48/src/stunnel.c.coverity stunnel-5.48/src/stunnel.c
|
||||
--- stunnel-5.48/src/stunnel.c.coverity 2018-07-02 23:30:10.000000000 +0200
|
||||
+++ stunnel-5.48/src/stunnel.c 2018-09-04 17:24:08.949928906 +0200
|
||||
@@ -364,7 +364,6 @@ NOEXPORT int accept_connection(SERVICE_O
|
||||
#endif
|
||||
if(create_client(fd, s, alloc_client_session(opt, s, s))) {
|
||||
s_log(LOG_ERR, "Connection rejected: create_client failed");
|
||||
- closesocket(s);
|
||||
#ifndef USE_FORK
|
||||
service_free(opt);
|
||||
#endif
|
||||
@ -0,0 +1,12 @@
|
||||
diff -up stunnel-5.55/src/options.c.system-ciphers stunnel-5.55/src/options.c
|
||||
--- stunnel-5.55/src/options.c.system-ciphers 2019-09-19 14:43:00.631059024 +0200
|
||||
+++ stunnel-5.55/src/options.c 2019-09-19 14:51:02.120053849 +0200
|
||||
@@ -277,7 +277,7 @@ static char *option_not_found=
|
||||
"Specified option name is not valid here";
|
||||
|
||||
static char *stunnel_cipher_list=
|
||||
- "HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK";
|
||||
+ "PROFILE=SYSTEM";
|
||||
|
||||
#ifndef OPENSSL_NO_TLS1_3
|
||||
static char *stunnel_ciphersuites=
|
||||
@ -0,0 +1,19 @@
|
||||
tests: Adapt to OpenSSL 3.x FIPS mode
|
||||
|
||||
In OpenSSL 3.0 with FIPS enabled, this test no longer fails with
|
||||
a human-readable error message (such as "no ciphers available"), but
|
||||
instead causes an internal error. Extend the success regex list to also
|
||||
accept this result.
|
||||
diff -up stunnel-5.61/tests/plugins/p11_fips_cipher.py.openssl30 stunnel-5.61/tests/plugins/p11_fips_cipher.py
|
||||
--- stunnel-5.61/tests/plugins/p11_fips_cipher.py.openssl30 2022-01-12 15:15:03.211690650 +0100
|
||||
+++ stunnel-5.61/tests/plugins/p11_fips_cipher.py 2022-01-12 15:15:20.937008173 +0100
|
||||
@@ -91,7 +91,8 @@ class FailureCiphersuitesFIPS(StunnelTes
|
||||
self.events.count = 1
|
||||
self.events.success = [
|
||||
"disabled for FIPS",
|
||||
- "no ciphers available"
|
||||
+ "no ciphers available",
|
||||
+ "TLS alert \\(write\\): fatal: internal error"
|
||||
]
|
||||
self.events.failure = [
|
||||
"peer did not return a certificate",
|
||||
@ -0,0 +1,57 @@
|
||||
Limit curves defaults in FIPS mode
|
||||
|
||||
Our copy of OpenSSL disables the X25519 and X448 curves in FIPS mode,
|
||||
but stunnel defaults to enabling them and then fails to do so.
|
||||
|
||||
Upstream-Status: Inappropriate [caused by a downstream patch to openssl]
|
||||
diff -up stunnel-5.62/src/options.c.disabled-curves stunnel-5.62/src/options.c
|
||||
--- stunnel-5.62/src/options.c.disabled-curves 2022-02-04 13:46:45.936884124 +0100
|
||||
+++ stunnel-5.62/src/options.c 2022-02-04 13:53:16.346725153 +0100
|
||||
@@ -40,8 +40,10 @@
|
||||
|
||||
#if OPENSSL_VERSION_NUMBER >= 0x10101000L
|
||||
#define DEFAULT_CURVES "X25519:P-256:X448:P-521:P-384"
|
||||
+#define DEFAULT_CURVES_FIPS "P-256:P-521:P-384"
|
||||
#else /* OpenSSL version < 1.1.1 */
|
||||
#define DEFAULT_CURVES "prime256v1"
|
||||
+#define DEFAULT_CURVES_FIPS "prime256v1"
|
||||
#endif /* OpenSSL version >= 1.1.1 */
|
||||
|
||||
#if defined(_WIN32_WCE) && !defined(CONFDIR)
|
||||
@@ -1855,7 +1857,7 @@ NOEXPORT char *parse_service_option(CMD
|
||||
/* curves */
|
||||
switch(cmd) {
|
||||
case CMD_SET_DEFAULTS:
|
||||
- section->curves=str_dup_detached(DEFAULT_CURVES);
|
||||
+ section->curves = NULL;
|
||||
break;
|
||||
case CMD_SET_COPY:
|
||||
section->curves=str_dup_detached(new_service_options.curves);
|
||||
@@ -1870,9 +1872,26 @@ NOEXPORT char *parse_service_option(CMD
|
||||
section->curves=str_dup_detached(arg);
|
||||
return NULL; /* OK */
|
||||
case CMD_INITIALIZE:
|
||||
+ if(!section->curves) {
|
||||
+ /* this is only executed for global options, because
|
||||
+ * section->curves is no longer NULL in sections */
|
||||
+#ifdef USE_FIPS
|
||||
+ if(new_global_options.option.fips)
|
||||
+ section->curves=str_dup_detached(DEFAULT_CURVES_FIPS);
|
||||
+ else
|
||||
+#endif /* USE_FIPS */
|
||||
+ section->curves=str_dup_detached(DEFAULT_CURVES);
|
||||
+ }
|
||||
break;
|
||||
case CMD_PRINT_DEFAULTS:
|
||||
- s_log(LOG_NOTICE, "%-22s = %s", "curves", DEFAULT_CURVES);
|
||||
+ if(fips_available()) {
|
||||
+ s_log(LOG_NOTICE, "%-22s = %s %s", "curves",
|
||||
+ DEFAULT_CURVES_FIPS, "(with \"fips = yes\")");
|
||||
+ s_log(LOG_NOTICE, "%-22s = %s %s", "curves",
|
||||
+ DEFAULT_CURVES, "(with \"fips = no\")");
|
||||
+ } else {
|
||||
+ s_log(LOG_NOTICE, "%-22s = %s", "curves", DEFAULT_CURVES);
|
||||
+ }
|
||||
break;
|
||||
case CMD_PRINT_HELP:
|
||||
s_log(LOG_NOTICE, "%-22s = ECDH curve names", "curves");
|
||||
@ -0,0 +1,140 @@
|
||||
From 6baa5762ea5edb192ec003333d62b1d0e56509bf Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Micha=C5=82=20Trojnara?= <Michal.Trojnara@stunnel.org>
|
||||
Date: Sun, 11 Sep 2022 23:52:18 +0200
|
||||
Subject: [PATCH] stunnel-5.66
|
||||
|
||||
---
|
||||
src/common.h | 6 +++++-
|
||||
src/ctx.c | 58 +++++++++++++++++++++++++++++++++++++++++++---------
|
||||
2 files changed, 53 insertions(+), 11 deletions(-)
|
||||
|
||||
diff --git a/src/common.h b/src/common.h
|
||||
index bc37eb5..997e66e 100644
|
||||
--- a/src/common.h
|
||||
+++ b/src/common.h
|
||||
@@ -491,7 +491,7 @@ extern char *sys_errlist[];
|
||||
#include <openssl/dh.h>
|
||||
#if OPENSSL_VERSION_NUMBER<0x10100000L
|
||||
int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g);
|
||||
-#endif /* OpenSSL older than 1.1.0 */
|
||||
+#endif /* OPENSSL_VERSION_NUMBER<0x10100000L */
|
||||
#endif /* !defined(OPENSSL_NO_DH) */
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
#include <openssl/engine.h>
|
||||
@@ -503,8 +503,12 @@ int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g);
|
||||
/* not defined in public headers before OpenSSL 0.9.8 */
|
||||
STACK_OF(SSL_COMP) *SSL_COMP_get_compression_methods(void);
|
||||
#endif /* !defined(OPENSSL_NO_COMP) */
|
||||
+#if OPENSSL_VERSION_NUMBER>=0x10101000L
|
||||
+#include <openssl/storeerr.h>
|
||||
+#endif /* OPENSSL_VERSION_NUMBER>=0x10101000L */
|
||||
#if OPENSSL_VERSION_NUMBER>=0x30000000L
|
||||
#include <openssl/provider.h>
|
||||
+#include <openssl/proverr.h>
|
||||
#endif /* OPENSSL_VERSION_NUMBER>=0x30000000L */
|
||||
|
||||
#ifndef OPENSSL_VERSION
|
||||
diff --git a/src/ctx.c b/src/ctx.c
|
||||
index a2202b7..cc0806c 100644
|
||||
--- a/src/ctx.c
|
||||
+++ b/src/ctx.c
|
||||
@@ -1001,30 +1001,41 @@ NOEXPORT int ui_retry() {
|
||||
unsigned long err=ERR_peek_error();
|
||||
|
||||
switch(ERR_GET_LIB(err)) {
|
||||
- case ERR_LIB_ASN1:
|
||||
- return 1;
|
||||
- case ERR_LIB_PKCS12:
|
||||
+ case ERR_LIB_EVP: /* 6 */
|
||||
switch(ERR_GET_REASON(err)) {
|
||||
- case PKCS12_R_MAC_VERIFY_FAILURE:
|
||||
+ case EVP_R_BAD_DECRYPT:
|
||||
return 1;
|
||||
default:
|
||||
+ s_log(LOG_ERR, "Unhandled ERR_LIB_EVP error reason: %d",
|
||||
+ ERR_GET_REASON(err));
|
||||
return 0;
|
||||
}
|
||||
- case ERR_LIB_EVP:
|
||||
+ case ERR_LIB_PEM: /* 9 */
|
||||
switch(ERR_GET_REASON(err)) {
|
||||
- case EVP_R_BAD_DECRYPT:
|
||||
+ case PEM_R_BAD_PASSWORD_READ:
|
||||
+ case PEM_R_BAD_DECRYPT:
|
||||
return 1;
|
||||
default:
|
||||
+ s_log(LOG_ERR, "Unhandled ERR_LIB_PEM error reason: %d",
|
||||
+ ERR_GET_REASON(err));
|
||||
return 0;
|
||||
}
|
||||
- case ERR_LIB_PEM:
|
||||
+ case ERR_LIB_ASN1: /* 13 */
|
||||
+ return 1;
|
||||
+ case ERR_LIB_PKCS12: /* 35 */
|
||||
switch(ERR_GET_REASON(err)) {
|
||||
- case PEM_R_BAD_PASSWORD_READ:
|
||||
+ case PKCS12_R_MAC_VERIFY_FAILURE:
|
||||
return 1;
|
||||
default:
|
||||
+ s_log(LOG_ERR, "Unhandled ERR_LIB_PKCS12 error reason: %d",
|
||||
+ ERR_GET_REASON(err));
|
||||
return 0;
|
||||
}
|
||||
- case ERR_LIB_UI:
|
||||
+#ifdef ERR_LIB_DSO /* 37 */
|
||||
+ case ERR_LIB_DSO:
|
||||
+ return 1;
|
||||
+#endif
|
||||
+ case ERR_LIB_UI: /* 40 */
|
||||
switch(ERR_GET_REASON(err)) {
|
||||
case UI_R_RESULT_TOO_LARGE:
|
||||
case UI_R_RESULT_TOO_SMALL:
|
||||
@@ -1033,17 +1044,44 @@ NOEXPORT int ui_retry() {
|
||||
#endif
|
||||
return 1;
|
||||
default:
|
||||
+ s_log(LOG_ERR, "Unhandled ERR_LIB_UI error reason: %d",
|
||||
+ ERR_GET_REASON(err));
|
||||
+ return 0;
|
||||
+ }
|
||||
+#ifdef ERR_LIB_OSSL_STORE
|
||||
+ case ERR_LIB_OSSL_STORE: /* 44 - added in OpenSSL 1.1.1 */
|
||||
+ switch(ERR_GET_REASON(err)) {
|
||||
+ case OSSL_STORE_R_BAD_PASSWORD_READ:
|
||||
+ return 1;
|
||||
+ default:
|
||||
+ s_log(LOG_ERR, "Unhandled ERR_LIB_OSSL_STORE error reason: %d",
|
||||
+ ERR_GET_REASON(err));
|
||||
+ return 0;
|
||||
+ }
|
||||
+#endif
|
||||
+#ifdef ERR_LIB_PROV
|
||||
+ case ERR_LIB_PROV: /* 57 - added in OpenSSL 3.0 */
|
||||
+ switch(ERR_GET_REASON(err)) {
|
||||
+ case PROV_R_BAD_DECRYPT:
|
||||
+ return 1;
|
||||
+ default:
|
||||
+ s_log(LOG_ERR, "Unhandled ERR_LIB_PROV error reason: %d",
|
||||
+ ERR_GET_REASON(err));
|
||||
return 0;
|
||||
}
|
||||
- case ERR_LIB_USER: /* PKCS#11 hacks */
|
||||
+#endif
|
||||
+ case ERR_LIB_USER: /* 128 - PKCS#11 hacks */
|
||||
switch(ERR_GET_REASON(err)) {
|
||||
case 7UL: /* CKR_ARGUMENTS_BAD */
|
||||
case 0xa0UL: /* CKR_PIN_INCORRECT */
|
||||
return 1;
|
||||
default:
|
||||
+ s_log(LOG_ERR, "Unhandled ERR_LIB_USER error reason: %d",
|
||||
+ ERR_GET_REASON(err));
|
||||
return 0;
|
||||
}
|
||||
default:
|
||||
+ s_log(LOG_ERR, "Unhandled error library: %d", ERR_GET_LIB(err));
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
--
|
||||
2.38.1
|
||||
|
||||
@ -0,0 +1,18 @@
|
||||
-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQKTBAABCgB9FiEEK8fk5n48wMG+py+MLvx/8NQW4BQFAmHlyoBfFIAAAAAALgAo
|
||||
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDJC
|
||||
QzdFNEU2N0UzQ0MwQzFCRUE3MkY4QzJFRkM3RkYwRDQxNkUwMTQACgkQLvx/8NQW
|
||||
4BRqiw//dzBO+CqezKNlkVT5sePEfriVPk0iYa7IyGQ2xclohI3X3A0NaLHhwysa
|
||||
2pFo+myUn5h2qVM6jfuPbXHxDSgDQIcRoEEWpLbVEnVy5vMpVsB5wY4fwfyd3crM
|
||||
2J24XPdODE8H2mB28JXHyQdXehMtzOAMJ57ugUbrU4drNOR8sCRbp+sBChI8JK9Q
|
||||
IYvUoMPMCukFXws0KFEYjRom/FyQlde2Wz9ZPiluRzj6RWPQvQht8EiB7IfPrq2m
|
||||
fiPmOxUnB+Ry6/eaSp7JLlrnL4q5Zhw0HS/pMbWpiB9nPb9SLoKufJ9hYQs5X2h9
|
||||
L85VPMAAAStQ4PcvFYWt/nV03p3agImdMLrwlaMi/Bb95+tk7OoNLu7yz9RQ9QAo
|
||||
SPamduORs4/KhtlMzRf2G8utIQRa4fI47KDOO1+1qRfTH4t/Bf3Fr/gI34AW24ZZ
|
||||
hu2nHqr+UxGkU42HJEhsL9tAvBFr/mBI64sHtAI41e25CkqBQSqD+FxUw5snbVgP
|
||||
XxiM9tNo/UUZpCMnmkAZUqVFKYT10VSFTDo6/LcoMYZf1zzCWch3wJTtf2ZPUJYG
|
||||
6kNpdCEzsXYileL6iCof9+J5hNaNGpsgTi+ljz1jujzOHWGw6hyIWUiYTBGmRAbl
|
||||
Pehbx5RYqQe9gX0nFRRs3o9y9p8B4MLMAvJdhx6vqxgd2H1SDJA=
|
||||
=MLHM
|
||||
-----END PGP SIGNATURE-----
|
||||
@ -1,37 +0,0 @@
|
||||
From 6c8c4c8c85204943223b251d09ca1e93571a437a Mon Sep 17 00:00:00 2001
|
||||
From: Sahana Prasad <sprasad@localhost.localdomain>
|
||||
Date: Mon, 12 Sep 2022 11:07:38 +0200
|
||||
Subject: [PATCH 3/7] Use cipher configuration from crypto-policies
|
||||
|
||||
On Fedora, CentOS and RHEL, the system's crypto policies are the best
|
||||
source to determine which cipher suites to accept in TLS. On these
|
||||
platforms, OpenSSL supports the PROFILE=SYSTEM setting to use those
|
||||
policies. Change stunnel to default to this setting.
|
||||
|
||||
Co-Authored-by: Sahana Prasad <shebburn@redhat.com>
|
||||
Patch-name: stunnel-5.69-system-ciphers.patch
|
||||
Patch-id: 3
|
||||
From-dist-git-commit: 70b3076eb09912b3a11f371b8c523303114fffa3
|
||||
---
|
||||
src/options.c | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/src/options.c b/src/options.c
|
||||
index 6e4a18b..4d31815 100644
|
||||
--- a/src/options.c
|
||||
+++ b/src/options.c
|
||||
@@ -321,9 +321,9 @@ static const char *option_not_found=
|
||||
"Specified option name is not valid here";
|
||||
|
||||
static const char *stunnel_cipher_list=
|
||||
- "HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK";
|
||||
+ "PROFILE=SYSTEM";
|
||||
static const char *fips_cipher_list=
|
||||
- "FIPS:!DH:!kDHEPSK";
|
||||
+ "PROFILE=SYSTEM";
|
||||
|
||||
#ifndef OPENSSL_NO_TLS1_3
|
||||
static const char *stunnel_ciphersuites=
|
||||
--
|
||||
2.39.2
|
||||
|
||||
@ -1,37 +0,0 @@
|
||||
From 4ffcbcecaf901b13a36dba1e651cfc16e5242e5a Mon Sep 17 00:00:00 2001
|
||||
From: Clemens Lang <cllang@redhat.com>
|
||||
Date: Thu, 19 Oct 2023 14:41:54 +0200
|
||||
Subject: [PATCH] Preserve NO_TLSv1.[123] option compatibility
|
||||
|
||||
On RHEL 8, stunnel used to support the NO_TLSv1.1, NO_TLSv1.2, and
|
||||
NO_TLSv1.3 values for the options directive. Since we do not break
|
||||
compatibility, preserve these options for customers that have them set.
|
||||
|
||||
Related: RHEL-2340
|
||||
---
|
||||
src/options.c | 3 +++
|
||||
1 file changed, 3 insertions(+)
|
||||
|
||||
diff --git a/src/options.c b/src/options.c
|
||||
index a306c4c..c05692c 100644
|
||||
--- a/src/options.c
|
||||
+++ b/src/options.c
|
||||
@@ -229,12 +229,15 @@ static const SSL_OPTION ssl_opts[] = {
|
||||
#endif
|
||||
#ifdef SSL_OP_NO_TLSv1_1
|
||||
{"NO_TLSv1_1", SSL_OP_NO_TLSv1_1},
|
||||
+ {"NO_TLSv1.1", SSL_OP_NO_TLSv1_1},
|
||||
#endif
|
||||
#ifdef SSL_OP_NO_TLSv1_2
|
||||
{"NO_TLSv1_2", SSL_OP_NO_TLSv1_2},
|
||||
+ {"NO_TLSv1.2", SSL_OP_NO_TLSv1_2},
|
||||
#endif
|
||||
#ifdef SSL_OP_NO_TLSv1_3
|
||||
{"NO_TLSv1_3", SSL_OP_NO_TLSv1_3},
|
||||
+ {"NO_TLSv1.3", SSL_OP_NO_TLSv1_3},
|
||||
#endif
|
||||
#ifdef SSL_OP_PKCS1_CHECK_1
|
||||
{"PKCS1_CHECK_1", SSL_OP_PKCS1_CHECK_1},
|
||||
--
|
||||
2.41.0
|
||||
|
||||
@ -1,18 +0,0 @@
|
||||
-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQKTBAABCgB9FiEEK8fk5n48wMG+py+MLvx/8NQW4BQFAmUKA7NfFIAAAAAALgAo
|
||||
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDJC
|
||||
QzdFNEU2N0UzQ0MwQzFCRUE3MkY4QzJFRkM3RkYwRDQxNkUwMTQACgkQLvx/8NQW
|
||||
4BS9ZxAAxK9dNbFrL3ZOmW18OT82LKza1Zli9grdiEx4GY6s+atY6DgrWiOfJi5A
|
||||
NQtwoeYRWcEkMgWKRev28zMEPzGkUzYyaBUbqDDisAziDXyyKfriqmkbG4jl8Gv+
|
||||
qY+SgrM2ElhZxTnvRtUvzG6dogBeA1iWcNANAYgYVxH2yOFcNB0HYA25aBrPpmO4
|
||||
37h7ZRc94Yn2fK4zdR7D8DxYEAkmrZJxMydytTwp4EHu2t3lmw+vJdzIS7RtJoRL
|
||||
Apd/Fh8USZB++Xx+4vFiuDcydGz5xdUNCB9jXYJoTCxFUP9mQsyR05Q8uscPunk9
|
||||
SfCd7pbzextsoFF5gOoee3tvwgwlhI7SR9eS585ni0oXyNaFUMwXS0qBVN1f86fr
|
||||
iAl3j8pGVnqJpmiZ8o4xGj3/g5Nvp14Ts/qXlRvqvzoU6Ka6MEefH2sMxzm5RCQr
|
||||
tAcrDROGUyN0HJcdy8TAWobqX0HWQqwlGjyeZAJAtFcmno00Au6FYnkn+dLkvxIx
|
||||
bsEaaG7QrP9p6JpEnQhsLLEKAgD9olmPWzFLCeeE1PZg/klSbVG4qmHv113ixlDy
|
||||
6smwnHDnb+UysgosKyAzWqlrLUhPYqca83Y8DFbpS9wi1AG6OjCuJ3jtdRq+HAjn
|
||||
l5PRZhWOTUi+weLWSpmGO2py5JfJm010grKdzA9d9YMR9YspSOU=
|
||||
=6RnW
|
||||
-----END PGP SIGNATURE-----
|
||||
@ -1,107 +0,0 @@
|
||||
From 5f0b818f62720d5bd8b8c9c631604ddb4c992be7 Mon Sep 17 00:00:00 2001
|
||||
From: Clemens Lang <cllang@redhat.com>
|
||||
Date: Wed, 31 Jul 2024 15:35:24 +0200
|
||||
Subject: [PATCH] src/verify.c: Speed up loading client CA list
|
||||
|
||||
Do not attempt to load and print all trusted CAs unless we need them to
|
||||
invoke SSL_CTX_set_client_CA_list(3). Loading all trusted CAs can be
|
||||
slow, especially if there are many. The CAdir format allows OpenSSL to
|
||||
only load them on demand, avoiding this overhead.
|
||||
|
||||
Additionally, SSL_CTX_load_verify_locations(3) supports file formats
|
||||
that SSL_load_client_CA_file(3) and SSL_add_*_cert_subjects_to_stack(3)
|
||||
do not support, for example certificates in the BEGIN TRUSTED
|
||||
CERTIFICATE format. Valid configurations with older stunnel versions
|
||||
that point to such a file would otherwise needlessly start failing.
|
||||
|
||||
Additionally, use SSL_load_client_CA_file(3) to load certificates from
|
||||
a file rather than SSL_add_file_cert_subjects_to_stack(3), since the
|
||||
former uses a hashtable for deduplication, but the latter relies on
|
||||
a sorted STACK_OF(X509_NAME). The sorting is exceptionally slow in
|
||||
OpenSSL, because the comparison function for X509_NAMEs converts them to
|
||||
DER involving a memory allocation, which is already expensive, but even
|
||||
more expensive when used with stunnel's custom allocator functions.
|
||||
|
||||
An upstream PR openssl/openssl#25056 will eventually fix this, but it
|
||||
will take quite a while for this to arrive on users' systems, and it
|
||||
will likely not be backported into older affected versions of OpenSSL or
|
||||
their forks.
|
||||
|
||||
Related: RHEL-50154
|
||||
Related: RHEL-46411
|
||||
Signed-off-by: Clemens Lang <cllang@redhat.com>
|
||||
---
|
||||
src/verify.c | 42 ++++++++++++++++++++++++++++--------------
|
||||
1 file changed, 28 insertions(+), 14 deletions(-)
|
||||
|
||||
diff --git a/src/verify.c b/src/verify.c
|
||||
index 56ab130..d1d3849 100644
|
||||
--- a/src/verify.c
|
||||
+++ b/src/verify.c
|
||||
@@ -95,10 +95,35 @@ NOEXPORT int init_ca(SERVICE_OPTIONS *section) {
|
||||
if(!SSL_CTX_load_verify_locations(section->ctx,
|
||||
section->ca_file, section->ca_dir)) {
|
||||
sslerror("SSL_CTX_load_verify_locations");
|
||||
+ return 1; /* FAILED */
|
||||
}
|
||||
}
|
||||
|
||||
- ca_dn=sk_X509_NAME_new_null();
|
||||
+ /* Do not attempt to load and print all trusted CAs unless we need them to
|
||||
+ invoke SSL_CTX_set_client_CA_list(3). Loading all trusted CAs can be
|
||||
+ slow, especially if there are many. The CAdir format allows OpenSSL to
|
||||
+ only load them on demand.
|
||||
+ Additionally, SSL_CTX_load_verify_locations(3) supports file formats
|
||||
+ that SSL_load_client_CA_file(3) and SSL_add_*_cert_subjects_to_stack(3)
|
||||
+ do not support, for example certificates in the BEGIN TRUSTED
|
||||
+ CERTIFICATE format. Valid configurations with older stunnel versions
|
||||
+ that point to such a file would otherwise needlessly start failing. */
|
||||
+ if(section->option.client)
|
||||
+ return 0; /* OK */
|
||||
+
|
||||
+ if(section->ca_file)
|
||||
+ /* SSL_load_client_CA_file is a lot faster than
|
||||
+ SSL_add_file_cert_subjects_to_stack(). Use it for ca_file if
|
||||
+ specified, then add the rest of the certificates to this stack. */
|
||||
+ ca_dn=SSL_load_client_CA_file(section->ca_file);
|
||||
+
|
||||
+ if (!ca_dn)
|
||||
+ /* ca_file not set, or SSL_load_client_CA_file(3) failed. */
|
||||
+ ca_dn=sk_X509_NAME_new_null();
|
||||
+
|
||||
+ /* client CA list initialization from directory */
|
||||
+ if(section->ca_dir)
|
||||
+ SSL_add_dir_cert_subjects_to_stack(ca_dn, section->ca_dir);
|
||||
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
/* CA and client CA list initialization with the engine */
|
||||
@@ -115,24 +140,13 @@ NOEXPORT int init_ca(SERVICE_OPTIONS *section) {
|
||||
}
|
||||
#endif
|
||||
|
||||
- /* client CA list initialization with the file and/or directory */
|
||||
- if(section->ca_file)
|
||||
- SSL_add_file_cert_subjects_to_stack(ca_dn, section->ca_file);
|
||||
- if(section->ca_dir)
|
||||
- SSL_add_dir_cert_subjects_to_stack(ca_dn, section->ca_dir);
|
||||
-
|
||||
if(!sk_X509_NAME_num(ca_dn)) {
|
||||
sk_X509_NAME_pop_free(ca_dn, X509_NAME_free);
|
||||
return 1; /* FAILED */
|
||||
}
|
||||
|
||||
- if(section->option.client) {
|
||||
- print_CA_list("Configured trusted server CA", ca_dn);
|
||||
- sk_X509_NAME_pop_free(ca_dn, X509_NAME_free);
|
||||
- } else { /* only set the client CA list on the server */
|
||||
- print_CA_list("Configured trusted client CA", ca_dn);
|
||||
- SSL_CTX_set_client_CA_list(section->ctx, ca_dn);
|
||||
- }
|
||||
+ print_CA_list("Configured trusted client CA", ca_dn);
|
||||
+ SSL_CTX_set_client_CA_list(section->ctx, ca_dn);
|
||||
|
||||
return 0; /* OK */
|
||||
}
|
||||
--
|
||||
2.45.2
|
||||
|
||||
Loading…
Reference in new issue