- stunnel-announce - stunnel.org

stunnel beta (5.04b2) is available for testing
by Michal Trojnara 19 Sep '14

19 Sep '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Guys, Please feel free to try the second beta version: https://www.stunnel.org/downloads/beta/stunnel-5.04b2.tar.gz https://www.stunnel.org/downloads/beta/stunnel-5.04b2-installer.exe I have finished implementing Win32 UNICODE support. The following planned features depend on UNICODE support: - Non-ASCII path names (this is already partially implemented) - UTF8 stunnel.conf - Windows CE GUI stunnel 5.04b2 also fixes missing taskbar icon when stunnel is executed with commandline switches (for example "stunnel -help"). Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlQcnAcACgkQ/NU+nXTHMtHOnQCeJFPogmAyhDFQ+CoLT17nhd1I CSIAni1tOnInyScnXwB/d876RF0o9YYt =PJ+o -----END PGP SIGNATURE-----

1 0

Re: [stunnel-announce] [stunnel-users] stunnel beta (5.04b1) is available for testing
by Michal Trojnara 16 Sep '14

16 Sep '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 josealf(a)rocketmail.com wrote: > Are you sure the stunnel-5.04b1.tar.gz file includes all changed > files since 5.03 release? Argh. I indeed copied the wrong file. My mistake. Thank you for reporting it. I corrected the stunnel-5.04b1.tar.gz file. Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlQYoD4ACgkQ/NU+nXTHMtHv6ACfcqL//tSfU3I5JsJeMUchIBun A1wAoIHQuGy5+pVx0apCSHsH9VKqeVZk =AgTb -----END PGP SIGNATURE-----

1 0

stunnel beta (5.04b1) is available for testing
by Michal Trojnara 16 Sep '14

16 Sep '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Guys, Please feel free to try the beta version I just made available for download: https://www.stunnel.org/downloads/beta/stunnel-5.04b1.tar.gz https://www.stunnel.org/downloads/beta/stunnel-5.04b1-installer.exe The list of changes includes most of the issues recently discussed on the stunnel-users mailing list and more. * New features - Support for local mode ("exec" option) on Win32. - A more explicit service description provided for the Windows SCM (thx to Pierre Delaage). - TCP/IP dependency added for NT service in order to (hopefully) prevent initialization failure at boot time. - FIPS canister updated to version 2.0.8 in the Win32 binary build. * Bugfixes - load_icon_default() modified to return copies of default icons instead of the original resources to prevent the resources from being destroyed. - Reportedly more compatible values used for the dwDesiredAccess parameter of the CreateFile() function (thx to Pierre Delaage). - Partially merged UNICODE compilation fixes (thx to Pierre Delaage). - Partially merged Windows CE patches (thx to Pierre Delaage). - Fixed typos in stunnel.init.in and vc.mak. - Fixed incorrect memory allocation statistics update in str_realloc(). - Missing REMOTE_PORT environmental variable is provided to processes spawned with "exec" on Unix platforms. - Taskbar icon is no longer disabled for NT service. Some basic examples for local mode ("exec" option) on Windows: ; Service based on a command-line tool [netstat] accept = 8015 exec = c:\windows\system32\netstat.exe execargs = netstat -a ; Remote cmd.exe protected with SSL ; Certificate-based authentication needs to be configured here! [cmd] accept = 1337 exec = c:\windows\system32\cmd.exe Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlQYYkoACgkQ/NU+nXTHMtGmfwCfSdHFmK8q5IRcS/CoFmYMZ40G zUEAoNUrIp0KAJ4+0LPwx+/1lJG6q2q/ =aSXM -----END PGP SIGNATURE-----

1 0

stunnel 5.03 released
by Michal Trojnara 07 Aug '14

07 Aug '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.03 of stunnel. The ChangeLog entry: Version 5.03, 2014.08.07, urgency: HIGH: * Security bugfixes - OpenSSL DLLs updated to version 1.0.1i. See https://www.openssl.org/news/secadv_20140806.txt * New features - FIPS autoconfiguration cleanup. - FIPS canister updated to version 2.0.6. - Improved SNI diagnostic logging. * Bugfixes - Compilation fixes for old versions of OpenSSL. - Fixed whitespace handling in the stunnel.init script. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 5e8196f913bf7460082c1c7e5d436fbfba7f65d56c60065e6ccf0df9057294ef stunnel-5.03-android.zip 803bc85fbc80f22d71b13d4180e2d51c02586b2cc611169961a2745e47e31c4f stunnel-5.03-installer.exe 9a1e369466fa756e6f48b11480a3338c1fa4717e6472871bf4a3a96c483edd03 stunnel-5.03.tar.gz Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlPj3nMACgkQ/NU+nXTHMtGM3ACfdFm7k754Pzo1rhDkVb6rT5nO EEUAoJoSXbRPHu3jphxXYVA5SeJ05BXj =tFws -----END PGP SIGNATURE-----

1 0

stunnel 5.02 released
by Michal Trojnara 09 Jun '14

09 Jun '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.02 of stunnel. The ChangeLog entry: Version 5.02, 2014.06.09, urgency: HIGH: * Security bugfixes - OpenSSL DLLs updated to version 1.0.1h. See http://www.openssl.org/news/secadv_20140605.txt * New features - Major rewrite of the protocol.c interface: it is now possible to add protocol negotiations at multiple connection phases, protocols can individually decide whether the remote connection will be established before or after SSL/TLS is negotiated. - Heap memory blocks are wiped before release. This only works for block allocated by stunnel, and not by OpenSSL or other libraries. - The safe_memcmp() function implemented with execution time not dependent on the compared data. - Updated the stunnel.conf and stunnel.init templates. - Added a client-mode example to the manual. * Bugfixes - Fixed "failover = rr" broken since version 5.00. - Fixed "taskbar = no" broken since version 5.00. - Compilation fix for missing SSL_OP_MSIE_SSLV2_RSA_PADDING option. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: c258b71d7f82bba5b0a4ccc69fbda632f1fefe9108589a92aa1016f33985973e stunnel-5.02.tar.gz 2125bf8e9241cb9f7969cb74f8409ce77f2c49e1390d363aa46bc436b9d908aa stunnel-5.02-installer.exe f962a2f4a0e16f07ff10339066ec89d7686734dcabba88654f2e71da4f658529 stunnel-5.02-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlOVrZkACgkQ/NU+nXTHMtHBIQCfefzazgvECg8p4qoHgsMjw/KM gTQAoM0mYm+S7exolJjiBBfSlx2G8Rjn =hyr4 -----END PGP SIGNATURE-----

1 0

Syringe
by Michal Trojnara 21 Apr '14

21 Apr '14

Hi Guys, I'm glad to announce syringe, a service for testing client-side heartbleed. It allows to easily examine most of the obscure TLS clients (for example embedded devices). The service is available online at https://www.stunnel.org:4433/ Best regards, Mike

1 0

stunnel 5.01 released
by Michal Trojnara 08 Apr '14

08 Apr '14

Dear Users, I have released version 5.01 of stunnel. The ChangeLog entry: Version 5.01, 2014.04.08, urgency: HIGH: * Security bugfixes - OpenSSL DLLs updated to version 1.0.1g. This version mitigates TLS heartbeat read overrun (CVE-2014-0160). * New features - X.509 extensions added to the created self-signed stunnel.pem. - "FIPS = no" also allowed in non-FIPS builds of stunnel. - Search all certificates with the same subject name for a matching public key rather than only the first one (thx to Leon Winter). - Create logs in the local application data folder if stunnel folder is not writable on Win32. * Bugfixes - close_notify not sent when SSL still has some data buffered. - Protocol negotiation with server-side SNI fixed. - A Mac OS X missing symbols fixed. - Win32 configuration file reload crash fixed. - Added s_pool_free() on exec+connect service retires. - Line-buffering enforced on stderr output. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hash for stunnel-5.01.tar.gz: 2565bf58ffe8a612304c64df621105b2e42d6e389e815ed4205dbeec4f3f886b Best regards, Mike

1 0

stunnel 5.00 released
by Michal Trojnara 06 Mar '14

06 Mar '14

Dear Users, I have released version 5.00 of stunnel. The ChangeLog entry: stunnel 5.00 disables some features previously enabled by default. Users should review whether the new defaults are appropriate for their particular deployments. Packages maintainers may consider prepending the old defaults for "fips" (if supported by their OpenSSL library), "pid" and "libwrap" to stunnel.conf during automated updates. Version 5.00, 2014.03.06, urgency: HIGH: * Security bugfixes - Added PRNG state update in fork threading (CVE-2014-0016). * New global configuration file defaults - Default "fips" option value is now "no", as FIPS mode is only helpful for compliance, and never for actual security. - Default "pid" is now "", i.e. not to create a pid file at startup. * New service-level configuration file defaults - Default "ciphers" updated to "HIGH:MEDIUM:+3DES:+DH:!aNULL:!SSLv2" due to AlFBPPS attack and bad performance of DH ciphersuites. - Default "libwrap" setting is now "no" to improve performance. * New features - OpenSSL DLLs updated to version 1.0.1f. - zlib DLL updated to version 1.2.8. - autoconf scripts upgraded to version 2.69. - TLS 1.1 and TLS 1.2 are now allowed in the FIPS mode. - New service-level option "redirect" to redirect SSL client connections on authentication failures instead of rejecting them. - New global "engineDefault" configuration file option to control which OpenSSL tasks are delegated to the current engine. Available tasks: ALL, RSA, DSA, ECDH, ECDSA, DH, RAND, CIPHERS, DIGESTS, PKEY, PKEY_CRYPTO, PKEY_ASN1. - New service-level configuration file option "engineId" to select the engine by identifier, e.g. "engineId = capi". - New global configuration file option "log" to control whether to append (the default), or to overwrite log file while (re)opening. - Different taskbar icon colors to indicate the service state. - New global configuration file options "iconIdle", "iconActive", and "iconError" to select status icon on GUI taskbar. - Removed the limit of 63 stunnel.conf sections on Win32 platform. - Installation of a sample certificate was moved to a separate "cert" target in order to allow unattended (e.g. scripted) installations. - Reduced length of the logged thread identifier. It is still based on the OS thread ID, and thus not unique over long periods of time. - Improved readability of error messages printed when stunnel refuses to start due to a critical error. * Bugfixes - LD_PRELOAD Solaris compatibility bug fixed (thx to Norm Jacobs). - CRYPTO_NUM_LOCKS replaced with CRYPTO_num_locks() to improve binary compatibility with diverse builds of OpenSSL (thx to Norm Jacobs). - Corrected round-robin failover behavior under heavy load. - Numerous fixes in the engine support code. - On Win32 platform .rnd file moved from c:\ to the stunnel folder. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hash for stunnel-5.00.tar.gz: 88986d52a7ef1aff0cc26fc0a9830361c991baba7ee591d5cf1cc8baef75bc13 Best regards, Mike

1 0

stunnel 4.56 released
by Michal Trojnara 22 Mar '13

22 Mar '13

Dear Users, I have released version 4.56 of stunnel. The ChangeLog entry: Version 4.56, 2013.03.22, urgency: HIGH: * New features - Win32 installer automatically configures firewall exceptions. - Win32 installer configures administrative shortcuts to invoke UAC. - Improved Win32 GUI shutdown time. * Bugfixes - Fixed a regression bug introduced in version 4.55 causing random crashes on several platforms, including Windows 7. - Fixed startup crashes on some Win32 systems. - Fixed incorrect "stunnel -exit" process synchronisation. - Fixed FIPS detection with new versions of the OpenSSL library. - Failure to open the log file at startup is no longer ignored. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hash for stunnel-4.56.tar.gz: 9cae2cfbe26d87443398ce50d7d5db54e5ea363889d5d2ec8d2778a01c871293 Best regards, Mike

1 0

stunnel 4.55 released (security update)
by Michal Trojnara 03 Mar '13

03 Mar '13

Dear Users, I have released version 4.55 of stunnel. This is a massive bugfix release, including a security bugfix. Update is highly recommended. The ChangeLog entry: Version 4.55, 2013.03.03, urgency: HIGH: * Security bugfix - OpenSSL updated to version 1.0.1e in Win32/Android builds. - Buffer overflow vulnerability fixed in the NTLM authentication of the CONNECT protocol negotiation. See https://www.stunnel.org/CVE-2013-1762.html for details. * New features - SNI wildcard matching in server mode. - Terminal version of stunnel (tstunnel.exe) build for Win32. * Bugfixes - Fixed write half-close handling in the transfer() function (thx to Dustin Lundquist). - Fixed EAGAIN error handling in the transfer() function (thx to Jan Bee). - Restored default signal handlers before execvp() (thx to Michael Weiser). - Fixed memory leaks in protocol negotiation (thx to Arthur Mesh). - Fixed a file descriptor leak during configuration file reload (thx to Arthur Mesh). - Closed SSL sockets were removed from the the transfer() c->fds poll. - Minor fix in handling exotic inetd-mode configurations. - WCE compilation fixes. - IPv6 compilation fix in protocol.c. - Windows installer fixes. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hash for stunnel-4.55.tar.gz: 5a4acecfabd454415c727435acdfca7dc46aa542998fb278293f494a6d36d37a Best regards, Mike

1 0