-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi Guys,
Please feel free to try the beta version I just made available for
download:
https://www.stunnel.org/downloads/beta/stunnel-5.04b1.tar.gzhttps://www.stunnel.org/downloads/beta/stunnel-5.04b1-installer.exe
The list of changes includes most of the issues recently discussed on
the stunnel-users mailing list and more.
* New features
- Support for local mode ("exec" option) on Win32.
- A more explicit service description provided for the Windows SCM
(thx to Pierre Delaage).
- TCP/IP dependency added for NT service in order to (hopefully)
prevent initialization failure at boot time.
- FIPS canister updated to version 2.0.8 in the Win32 binary build.
* Bugfixes
- load_icon_default() modified to return copies of default icons
instead of the original resources to prevent the resources from
being destroyed.
- Reportedly more compatible values used for the dwDesiredAccess
parameter of the CreateFile() function (thx to Pierre Delaage).
- Partially merged UNICODE compilation fixes (thx to Pierre Delaage).
- Partially merged Windows CE patches (thx to Pierre Delaage).
- Fixed typos in stunnel.init.in and vc.mak.
- Fixed incorrect memory allocation statistics update in
str_realloc().
- Missing REMOTE_PORT environmental variable is provided to processes
spawned with "exec" on Unix platforms.
- Taskbar icon is no longer disabled for NT service.
Some basic examples for local mode ("exec" option) on Windows:
; Service based on a command-line tool
[netstat]
accept = 8015
exec = c:\windows\system32\netstat.exe
execargs = netstat -a
; Remote cmd.exe protected with SSL
; Certificate-based authentication needs to be configured here!
[cmd]
accept = 1337
exec = c:\windows\system32\cmd.exe
Mike
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iEYEARECAAYFAlQYYkoACgkQ/NU+nXTHMtGmfwCfSdHFmK8q5IRcS/CoFmYMZ40G
zUEAoNUrIp0KAJ4+0LPwx+/1lJG6q2q/
=aSXM
-----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Dear Users,
I have released version 5.03 of stunnel.
The ChangeLog entry:
Version 5.03, 2014.08.07, urgency: HIGH:
* Security bugfixes
- OpenSSL DLLs updated to version 1.0.1i.
See https://www.openssl.org/news/secadv_20140806.txt
* New features
- FIPS autoconfiguration cleanup.
- FIPS canister updated to version 2.0.6.
- Improved SNI diagnostic logging.
* Bugfixes
- Compilation fixes for old versions of OpenSSL.
- Fixed whitespace handling in the stunnel.init script.
Home page: https://www.stunnel.org/
Download: https://www.stunnel.org/downloads.html
SHA-256 hashes:
5e8196f913bf7460082c1c7e5d436fbfba7f65d56c60065e6ccf0df9057294ef
stunnel-5.03-android.zip
803bc85fbc80f22d71b13d4180e2d51c02586b2cc611169961a2745e47e31c4f
stunnel-5.03-installer.exe
9a1e369466fa756e6f48b11480a3338c1fa4717e6472871bf4a3a96c483edd03
stunnel-5.03.tar.gz
Best regards,
Mike
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iEYEARECAAYFAlPj3nMACgkQ/NU+nXTHMtGM3ACfdFm7k754Pzo1rhDkVb6rT5nO
EEUAoJoSXbRPHu3jphxXYVA5SeJ05BXj
=tFws
-----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Dear Users,
I have released version 5.02 of stunnel.
The ChangeLog entry:
Version 5.02, 2014.06.09, urgency: HIGH:
* Security bugfixes
- OpenSSL DLLs updated to version 1.0.1h.
See http://www.openssl.org/news/secadv_20140605.txt
* New features
- Major rewrite of the protocol.c interface: it is now possible to
add protocol negotiations at multiple connection phases,
protocols can individually decide whether the remote connection
will be established before or after SSL/TLS is negotiated.
- Heap memory blocks are wiped before release. This only works for
block allocated by stunnel, and not by OpenSSL or other libraries.
- The safe_memcmp() function implemented with execution time not
dependent on the compared data.
- Updated the stunnel.conf and stunnel.init templates.
- Added a client-mode example to the manual.
* Bugfixes
- Fixed "failover = rr" broken since version 5.00.
- Fixed "taskbar = no" broken since version 5.00.
- Compilation fix for missing SSL_OP_MSIE_SSLV2_RSA_PADDING option.
Home page: https://www.stunnel.org/
Download: https://www.stunnel.org/downloads.html
SHA-256 hashes:
c258b71d7f82bba5b0a4ccc69fbda632f1fefe9108589a92aa1016f33985973e
stunnel-5.02.tar.gz
2125bf8e9241cb9f7969cb74f8409ce77f2c49e1390d363aa46bc436b9d908aa
stunnel-5.02-installer.exe
f962a2f4a0e16f07ff10339066ec89d7686734dcabba88654f2e71da4f658529
stunnel-5.02-android.zip
Best regards,
Mike
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iEYEARECAAYFAlOVrZkACgkQ/NU+nXTHMtHBIQCfefzazgvECg8p4qoHgsMjw/KM
gTQAoM0mYm+S7exolJjiBBfSlx2G8Rjn
=hyr4
-----END PGP SIGNATURE-----
Hi Guys,
I'm glad to announce syringe, a service for testing client-side heartbleed.
It allows to easily examine most of the obscure TLS clients (for example
embedded devices).
The service is available online at https://www.stunnel.org:4433/
Best regards,
Mike
Dear Users,
I have released version 5.01 of stunnel.
The ChangeLog entry:
Version 5.01, 2014.04.08, urgency: HIGH:
* Security bugfixes
- OpenSSL DLLs updated to version 1.0.1g.
This version mitigates TLS heartbeat read overrun (CVE-2014-0160).
* New features
- X.509 extensions added to the created self-signed stunnel.pem.
- "FIPS = no" also allowed in non-FIPS builds of stunnel.
- Search all certificates with the same subject name for a matching
public key rather than only the first one (thx to Leon Winter).
- Create logs in the local application data folder if stunnel folder
is not writable on Win32.
* Bugfixes
- close_notify not sent when SSL still has some data buffered.
- Protocol negotiation with server-side SNI fixed.
- A Mac OS X missing symbols fixed.
- Win32 configuration file reload crash fixed.
- Added s_pool_free() on exec+connect service retires.
- Line-buffering enforced on stderr output.
Home page: https://www.stunnel.org/
Download: https://www.stunnel.org/downloads.html
SHA-256 hash for stunnel-5.01.tar.gz:
2565bf58ffe8a612304c64df621105b2e42d6e389e815ed4205dbeec4f3f886b
Best regards,
Mike
Dear Users,
I have released version 5.00 of stunnel.
The ChangeLog entry:
stunnel 5.00 disables some features previously enabled by default.
Users should review whether the new defaults are appropriate for their
particular deployments. Packages maintainers may consider prepending
the old defaults for "fips" (if supported by their OpenSSL library),
"pid" and "libwrap" to stunnel.conf during automated updates.
Version 5.00, 2014.03.06, urgency: HIGH:
* Security bugfixes
- Added PRNG state update in fork threading (CVE-2014-0016).
* New global configuration file defaults
- Default "fips" option value is now "no", as FIPS mode is only
helpful for compliance, and never for actual security.
- Default "pid" is now "", i.e. not to create a pid file at startup.
* New service-level configuration file defaults
- Default "ciphers" updated to "HIGH:MEDIUM:+3DES:+DH:!aNULL:!SSLv2"
due to AlFBPPS attack and bad performance of DH ciphersuites.
- Default "libwrap" setting is now "no" to improve performance.
* New features
- OpenSSL DLLs updated to version 1.0.1f.
- zlib DLL updated to version 1.2.8.
- autoconf scripts upgraded to version 2.69.
- TLS 1.1 and TLS 1.2 are now allowed in the FIPS mode.
- New service-level option "redirect" to redirect SSL client
connections on authentication failures instead of rejecting them.
- New global "engineDefault" configuration file option to control
which OpenSSL tasks are delegated to the current engine.
Available tasks: ALL, RSA, DSA, ECDH, ECDSA, DH, RAND, CIPHERS,
DIGESTS, PKEY, PKEY_CRYPTO, PKEY_ASN1.
- New service-level configuration file option "engineId" to select
the engine by identifier, e.g. "engineId = capi".
- New global configuration file option "log" to control whether to
append (the default), or to overwrite log file while (re)opening.
- Different taskbar icon colors to indicate the service state.
- New global configuration file options "iconIdle", "iconActive",
and "iconError" to select status icon on GUI taskbar.
- Removed the limit of 63 stunnel.conf sections on Win32 platform.
- Installation of a sample certificate was moved to a separate "cert"
target in order to allow unattended (e.g. scripted) installations.
- Reduced length of the logged thread identifier. It is still based
on the OS thread ID, and thus not unique over long periods of time.
- Improved readability of error messages printed when stunnel refuses
to start due to a critical error.
* Bugfixes
- LD_PRELOAD Solaris compatibility bug fixed (thx to Norm Jacobs).
- CRYPTO_NUM_LOCKS replaced with CRYPTO_num_locks() to improve binary
compatibility with diverse builds of OpenSSL (thx to Norm Jacobs).
- Corrected round-robin failover behavior under heavy load.
- Numerous fixes in the engine support code.
- On Win32 platform .rnd file moved from c:\ to the stunnel folder.
Home page: https://www.stunnel.org/
Download: https://www.stunnel.org/downloads.html
SHA-256 hash for stunnel-5.00.tar.gz:
88986d52a7ef1aff0cc26fc0a9830361c991baba7ee591d5cf1cc8baef75bc13
Best regards,
Mike
Dear Users,
I have released version 4.56 of stunnel.
The ChangeLog entry:
Version 4.56, 2013.03.22, urgency: HIGH:
* New features
- Win32 installer automatically configures firewall exceptions.
- Win32 installer configures administrative shortcuts to invoke UAC.
- Improved Win32 GUI shutdown time.
* Bugfixes
- Fixed a regression bug introduced in version 4.55 causing random
crashes on several platforms, including Windows 7.
- Fixed startup crashes on some Win32 systems.
- Fixed incorrect "stunnel -exit" process synchronisation.
- Fixed FIPS detection with new versions of the OpenSSL library.
- Failure to open the log file at startup is no longer ignored.
Home page: https://www.stunnel.org/
Download: https://www.stunnel.org/downloads.html
SHA-256 hash for stunnel-4.56.tar.gz:
9cae2cfbe26d87443398ce50d7d5db54e5ea363889d5d2ec8d2778a01c871293
Best regards,
Mike
Dear Users,
I have released version 4.55 of stunnel. This is a massive bugfix
release, including a security bugfix. Update is highly recommended.
The ChangeLog entry:
Version 4.55, 2013.03.03, urgency: HIGH:
* Security bugfix
- OpenSSL updated to version 1.0.1e in Win32/Android builds.
- Buffer overflow vulnerability fixed in the NTLM authentication
of the CONNECT protocol negotiation.
See https://www.stunnel.org/CVE-2013-1762.html for details.
* New features
- SNI wildcard matching in server mode.
- Terminal version of stunnel (tstunnel.exe) build for Win32.
* Bugfixes
- Fixed write half-close handling in the transfer() function (thx to
Dustin Lundquist).
- Fixed EAGAIN error handling in the transfer() function (thx to
Jan Bee).
- Restored default signal handlers before execvp() (thx to Michael
Weiser).
- Fixed memory leaks in protocol negotiation (thx to Arthur Mesh).
- Fixed a file descriptor leak during configuration file reload (thx
to Arthur Mesh).
- Closed SSL sockets were removed from the the transfer() c->fds poll.
- Minor fix in handling exotic inetd-mode configurations.
- WCE compilation fixes.
- IPv6 compilation fix in protocol.c.
- Windows installer fixes.
Home page: https://www.stunnel.org/
Download: https://www.stunnel.org/downloads.html
SHA-256 hash for stunnel-4.55.tar.gz:
5a4acecfabd454415c727435acdfca7dc46aa542998fb278293f494a6d36d37a
Best regards,
Mike
Dear Users,
I have released version 4.54 of stunnel. The ChangeLog entry:
Version 4.54, 2012.10.09, urgency: MEDIUM:
* New Win32 features
- FIPS module updated to version 2.0.
- OpenSSL DLLs updated to version 1.0.1c.
- zlib DLL updated to version 1.2.7.
- Engine DLLs added: 4758cca, aep, atalla, capi, chil, cswift, gmp, gost,
nuron, padlock, sureware, ubsec.
* Other new features
- "session" option renamed to more readable "sessionCacheTimeout".
The old name remains accepted for backward compatibility.
- New service-level "sessionCacheSize" option to control session cache size.
- New service-level option "reset" to control whether TCP RST flag is used
to indicate errors. The default value is "reset = yes".
- New service-level option "renegotiation" to disable SSL renegotiation.
This feature is based on a public-domain patch by Janusz Dziemidowicz.
- New FreeBSD socket options: IP_FREEBIND, IP_BINDANY, IPV6_BINDANY (thx
to Janusz Dziemidowicz).
- New parameters to configure TLS v1.1/v1.2 with OpenSSL version 1.0.1
or higher (thx to Henrik Riomar).
* Bugfixes
- Fixed "Application Failed to Initialize Properly (0xc0150002)" error.
- Fixed missing SSL state debug log entries.
- Fixed a race condition in libwrap code resulting in random stalls (thx
to Andrew Skalski).
- Session cache purged at configuration file reload to reduce memory leak.
Remaining leak of a few kilobytes per section is yet to be fixed.
- Fixed regression bug in "transparent = destination" functionality (thx
to Stefan Lauterbach). This bug was introduced in stunnel 4.51.
- "transparent = destination" is now a valid endpoint in inetd mode.
- "delay = yes" fixed to work even if specified *after* "connect" option.
- Multiple "connect" targets fixed to also work with delayed resolver.
- The number of resolver retries of EAI_AGAIN error has been limited to 3
in order to prevent infinite loops..
Home page: https://www.stunnel.org/ <http://stunnel.mirt.net/>
Download: https://www.stunnel.org/downloads.html
<ftp://stunnel.mirt.net/stunnel/>
SHA-256 hash for stunnel-4.54.tar.gz:
b7e1b9e63569574dbdabee8af90b8ab88db3fe13dcb1268d59a1408c56e6de7b
Best regards,
Mike
Dear Users,
I have released version 4.53 of stunnel. This is major a bugfix
release. Upgrade is highly recommended.
The ChangeLog entry:
Version 4.53, 2012.03.19, urgency: MEDIUM:
* New features
- Added client-mode "sni" option to directly control the value of
TLS Server Name Indication (RFC 3546) extension.
- Added support for IP_FREEBIND socket option with a pached Linux
kernel.
- Glibc-specific dynamic allocation tuning was applied to help
unused memory
deallocation.
- Non-blocking OCSP implementation.
* Bugfixes
- Compilation fixes for old versions of OpenSSL (tested against
0.9.6).
- Usage of uninitialized variables fixed in exec+connect services.
- Occasional logging subsystem crash with exec+connect services.
- OpenBSD compilation fix (thx to Michele Orru').
- Session id context initialized with session name rather than a
constant.
- Fixed handling of a rare inetd mode use case, where either stdin
or stdout
is a socket, but not both of them at the same time.
- Fixed missing OPENSSL_Applink http://www.openssl.org/support/faq.html#PROG2
- Fixed crash on termination with FORK threading model.
- Fixed dead canary after configuration reload with open connections.
- Fixed missing file descriptors passed to local mode processes.
- Fixed required jmp_buf alignment on Itanium platform.
- Removed creating /dev/zero in the chroot jail on Solaris platform.
- Fixed detection of WSAECONNREFUSED Winsock error.
- Missing Microsoft.VC90.CRT.manifest added to Windows installer.
Home page: http://www.stunnel.org/
Download: ftp://ftp.stunnel.org/stunnel/
SHA-256 hash for stunnel-4.53.tar.gz:
3e640aa4c96861d10addba758b66e99e7c5aec8697764f2a59ca2268901b8e57
Best regards,
Mike
