-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Dear Users,
I have released version 5.02 of stunnel.
The ChangeLog entry:
Version 5.02, 2014.06.09, urgency: HIGH:
* Security bugfixes
- OpenSSL DLLs updated to version 1.0.1h.
See http://www.openssl.org/news/secadv_20140605.txt
* New features
- Major rewrite of the protocol.c interface: it is now possible to
add protocol negotiations at multiple connection phases,
protocols can individually decide whether the remote connection
will be established before or after SSL/TLS is negotiated.
- Heap memory blocks are wiped before release. This only works for
block allocated by stunnel, and not by OpenSSL or other libraries.
- The safe_memcmp() function implemented with execution time not
dependent on the compared data.
- Updated the stunnel.conf and stunnel.init templates.
- Added a client-mode example to the manual.
* Bugfixes
- Fixed "failover = rr" broken since version 5.00.
- Fixed "taskbar = no" broken since version 5.00.
- Compilation fix for missing SSL_OP_MSIE_SSLV2_RSA_PADDING option.
Home page: https://www.stunnel.org/
Download: https://www.stunnel.org/downloads.html
SHA-256 hashes:
c258b71d7f82bba5b0a4ccc69fbda632f1fefe9108589a92aa1016f33985973e
stunnel-5.02.tar.gz
2125bf8e9241cb9f7969cb74f8409ce77f2c49e1390d363aa46bc436b9d908aa
stunnel-5.02-installer.exe
f962a2f4a0e16f07ff10339066ec89d7686734dcabba88654f2e71da4f658529
stunnel-5.02-android.zip
Best regards,
Mike
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iEYEARECAAYFAlOVrZkACgkQ/NU+nXTHMtHBIQCfefzazgvECg8p4qoHgsMjw/KM
gTQAoM0mYm+S7exolJjiBBfSlx2G8Rjn
=hyr4
-----END PGP SIGNATURE-----
Hi Guys,
I'm glad to announce syringe, a service for testing client-side heartbleed.
It allows to easily examine most of the obscure TLS clients (for example
embedded devices).
The service is available online at https://www.stunnel.org:4433/
Best regards,
Mike
Dear Users,
I have released version 5.01 of stunnel.
The ChangeLog entry:
Version 5.01, 2014.04.08, urgency: HIGH:
* Security bugfixes
- OpenSSL DLLs updated to version 1.0.1g.
This version mitigates TLS heartbeat read overrun (CVE-2014-0160).
* New features
- X.509 extensions added to the created self-signed stunnel.pem.
- "FIPS = no" also allowed in non-FIPS builds of stunnel.
- Search all certificates with the same subject name for a matching
public key rather than only the first one (thx to Leon Winter).
- Create logs in the local application data folder if stunnel folder
is not writable on Win32.
* Bugfixes
- close_notify not sent when SSL still has some data buffered.
- Protocol negotiation with server-side SNI fixed.
- A Mac OS X missing symbols fixed.
- Win32 configuration file reload crash fixed.
- Added s_pool_free() on exec+connect service retires.
- Line-buffering enforced on stderr output.
Home page: https://www.stunnel.org/
Download: https://www.stunnel.org/downloads.html
SHA-256 hash for stunnel-5.01.tar.gz:
2565bf58ffe8a612304c64df621105b2e42d6e389e815ed4205dbeec4f3f886b
Best regards,
Mike
Dear Users,
I have released version 5.00 of stunnel.
The ChangeLog entry:
stunnel 5.00 disables some features previously enabled by default.
Users should review whether the new defaults are appropriate for their
particular deployments. Packages maintainers may consider prepending
the old defaults for "fips" (if supported by their OpenSSL library),
"pid" and "libwrap" to stunnel.conf during automated updates.
Version 5.00, 2014.03.06, urgency: HIGH:
* Security bugfixes
- Added PRNG state update in fork threading (CVE-2014-0016).
* New global configuration file defaults
- Default "fips" option value is now "no", as FIPS mode is only
helpful for compliance, and never for actual security.
- Default "pid" is now "", i.e. not to create a pid file at startup.
* New service-level configuration file defaults
- Default "ciphers" updated to "HIGH:MEDIUM:+3DES:+DH:!aNULL:!SSLv2"
due to AlFBPPS attack and bad performance of DH ciphersuites.
- Default "libwrap" setting is now "no" to improve performance.
* New features
- OpenSSL DLLs updated to version 1.0.1f.
- zlib DLL updated to version 1.2.8.
- autoconf scripts upgraded to version 2.69.
- TLS 1.1 and TLS 1.2 are now allowed in the FIPS mode.
- New service-level option "redirect" to redirect SSL client
connections on authentication failures instead of rejecting them.
- New global "engineDefault" configuration file option to control
which OpenSSL tasks are delegated to the current engine.
Available tasks: ALL, RSA, DSA, ECDH, ECDSA, DH, RAND, CIPHERS,
DIGESTS, PKEY, PKEY_CRYPTO, PKEY_ASN1.
- New service-level configuration file option "engineId" to select
the engine by identifier, e.g. "engineId = capi".
- New global configuration file option "log" to control whether to
append (the default), or to overwrite log file while (re)opening.
- Different taskbar icon colors to indicate the service state.
- New global configuration file options "iconIdle", "iconActive",
and "iconError" to select status icon on GUI taskbar.
- Removed the limit of 63 stunnel.conf sections on Win32 platform.
- Installation of a sample certificate was moved to a separate "cert"
target in order to allow unattended (e.g. scripted) installations.
- Reduced length of the logged thread identifier. It is still based
on the OS thread ID, and thus not unique over long periods of time.
- Improved readability of error messages printed when stunnel refuses
to start due to a critical error.
* Bugfixes
- LD_PRELOAD Solaris compatibility bug fixed (thx to Norm Jacobs).
- CRYPTO_NUM_LOCKS replaced with CRYPTO_num_locks() to improve binary
compatibility with diverse builds of OpenSSL (thx to Norm Jacobs).
- Corrected round-robin failover behavior under heavy load.
- Numerous fixes in the engine support code.
- On Win32 platform .rnd file moved from c:\ to the stunnel folder.
Home page: https://www.stunnel.org/
Download: https://www.stunnel.org/downloads.html
SHA-256 hash for stunnel-5.00.tar.gz:
88986d52a7ef1aff0cc26fc0a9830361c991baba7ee591d5cf1cc8baef75bc13
Best regards,
Mike
Dear Users,
I have released version 4.56 of stunnel.
The ChangeLog entry:
Version 4.56, 2013.03.22, urgency: HIGH:
* New features
- Win32 installer automatically configures firewall exceptions.
- Win32 installer configures administrative shortcuts to invoke UAC.
- Improved Win32 GUI shutdown time.
* Bugfixes
- Fixed a regression bug introduced in version 4.55 causing random
crashes on several platforms, including Windows 7.
- Fixed startup crashes on some Win32 systems.
- Fixed incorrect "stunnel -exit" process synchronisation.
- Fixed FIPS detection with new versions of the OpenSSL library.
- Failure to open the log file at startup is no longer ignored.
Home page: https://www.stunnel.org/
Download: https://www.stunnel.org/downloads.html
SHA-256 hash for stunnel-4.56.tar.gz:
9cae2cfbe26d87443398ce50d7d5db54e5ea363889d5d2ec8d2778a01c871293
Best regards,
Mike
Dear Users,
I have released version 4.55 of stunnel. This is a massive bugfix
release, including a security bugfix. Update is highly recommended.
The ChangeLog entry:
Version 4.55, 2013.03.03, urgency: HIGH:
* Security bugfix
- OpenSSL updated to version 1.0.1e in Win32/Android builds.
- Buffer overflow vulnerability fixed in the NTLM authentication
of the CONNECT protocol negotiation.
See https://www.stunnel.org/CVE-2013-1762.html for details.
* New features
- SNI wildcard matching in server mode.
- Terminal version of stunnel (tstunnel.exe) build for Win32.
* Bugfixes
- Fixed write half-close handling in the transfer() function (thx to
Dustin Lundquist).
- Fixed EAGAIN error handling in the transfer() function (thx to
Jan Bee).
- Restored default signal handlers before execvp() (thx to Michael
Weiser).
- Fixed memory leaks in protocol negotiation (thx to Arthur Mesh).
- Fixed a file descriptor leak during configuration file reload (thx
to Arthur Mesh).
- Closed SSL sockets were removed from the the transfer() c->fds poll.
- Minor fix in handling exotic inetd-mode configurations.
- WCE compilation fixes.
- IPv6 compilation fix in protocol.c.
- Windows installer fixes.
Home page: https://www.stunnel.org/
Download: https://www.stunnel.org/downloads.html
SHA-256 hash for stunnel-4.55.tar.gz:
5a4acecfabd454415c727435acdfca7dc46aa542998fb278293f494a6d36d37a
Best regards,
Mike
Dear Users,
I have released version 4.54 of stunnel. The ChangeLog entry:
Version 4.54, 2012.10.09, urgency: MEDIUM:
* New Win32 features
- FIPS module updated to version 2.0.
- OpenSSL DLLs updated to version 1.0.1c.
- zlib DLL updated to version 1.2.7.
- Engine DLLs added: 4758cca, aep, atalla, capi, chil, cswift, gmp, gost,
nuron, padlock, sureware, ubsec.
* Other new features
- "session" option renamed to more readable "sessionCacheTimeout".
The old name remains accepted for backward compatibility.
- New service-level "sessionCacheSize" option to control session cache size.
- New service-level option "reset" to control whether TCP RST flag is used
to indicate errors. The default value is "reset = yes".
- New service-level option "renegotiation" to disable SSL renegotiation.
This feature is based on a public-domain patch by Janusz Dziemidowicz.
- New FreeBSD socket options: IP_FREEBIND, IP_BINDANY, IPV6_BINDANY (thx
to Janusz Dziemidowicz).
- New parameters to configure TLS v1.1/v1.2 with OpenSSL version 1.0.1
or higher (thx to Henrik Riomar).
* Bugfixes
- Fixed "Application Failed to Initialize Properly (0xc0150002)" error.
- Fixed missing SSL state debug log entries.
- Fixed a race condition in libwrap code resulting in random stalls (thx
to Andrew Skalski).
- Session cache purged at configuration file reload to reduce memory leak.
Remaining leak of a few kilobytes per section is yet to be fixed.
- Fixed regression bug in "transparent = destination" functionality (thx
to Stefan Lauterbach). This bug was introduced in stunnel 4.51.
- "transparent = destination" is now a valid endpoint in inetd mode.
- "delay = yes" fixed to work even if specified *after* "connect" option.
- Multiple "connect" targets fixed to also work with delayed resolver.
- The number of resolver retries of EAI_AGAIN error has been limited to 3
in order to prevent infinite loops..
Home page: https://www.stunnel.org/ <http://stunnel.mirt.net/>
Download: https://www.stunnel.org/downloads.html
<ftp://stunnel.mirt.net/stunnel/>
SHA-256 hash for stunnel-4.54.tar.gz:
b7e1b9e63569574dbdabee8af90b8ab88db3fe13dcb1268d59a1408c56e6de7b
Best regards,
Mike
Dear Users,
I have released version 4.53 of stunnel. This is major a bugfix
release. Upgrade is highly recommended.
The ChangeLog entry:
Version 4.53, 2012.03.19, urgency: MEDIUM:
* New features
- Added client-mode "sni" option to directly control the value of
TLS Server Name Indication (RFC 3546) extension.
- Added support for IP_FREEBIND socket option with a pached Linux
kernel.
- Glibc-specific dynamic allocation tuning was applied to help
unused memory
deallocation.
- Non-blocking OCSP implementation.
* Bugfixes
- Compilation fixes for old versions of OpenSSL (tested against
0.9.6).
- Usage of uninitialized variables fixed in exec+connect services.
- Occasional logging subsystem crash with exec+connect services.
- OpenBSD compilation fix (thx to Michele Orru').
- Session id context initialized with session name rather than a
constant.
- Fixed handling of a rare inetd mode use case, where either stdin
or stdout
is a socket, but not both of them at the same time.
- Fixed missing OPENSSL_Applink http://www.openssl.org/support/faq.html#PROG2
- Fixed crash on termination with FORK threading model.
- Fixed dead canary after configuration reload with open connections.
- Fixed missing file descriptors passed to local mode processes.
- Fixed required jmp_buf alignment on Itanium platform.
- Removed creating /dev/zero in the chroot jail on Solaris platform.
- Fixed detection of WSAECONNREFUSED Winsock error.
- Missing Microsoft.VC90.CRT.manifest added to Windows installer.
Home page: http://www.stunnel.org/
Download: ftp://ftp.stunnel.org/stunnel/
SHA-256 hash for stunnel-4.53.tar.gz:
3e640aa4c96861d10addba758b66e99e7c5aec8697764f2a59ca2268901b8e57
Best regards,
Mike
Dear Users,
I have released version 4.52 of stunnel. This is a bugfix release.
Upgrade is highly recommended.
The ChangeLog entry:
Version 4.52, 2012.01.12, urgency: MEDIUM:
* Bugfixes
- Fixed write closure notification for non-socket file descriptors.
- Removed a line logged to stderr in inetd mode.
- Fixed "Socket operation on non-socket" error in inetd mode on Mac
OS X platform.
- Removed direct access to the fields of the X509_STORE_CTX data
structure.
Home page: http://www.stunnel.org/
Download: ftp://ftp.stunnel.org/stunnel/
SHA-256 hash for stunnel-4.52.tar.gz:
7c78c178074e9b96331518a9c309d2e95ca9ad6e0338a96d5ab8ad47fde4347c
Best regards,
Mike
Dear Users,
I have released version 4.51 of stunnel.
The ChangeLog entry:
Version 4.51, 2012.01.09, urgency: MEDIUM:
* New features
- Updated Win32 binary distribution OpenSSL DLLs to version 0.9.8s-fips.
- Updated Android binary OpenSSL to version 1.0.0f.
- Zlib support added to Win32 and Android binary builds.
- New "compression = deflate" global option to enable RFC 2246 compresion.
For compatibility with previous versions "compression = zlib" and
"compression = rle" also enable the deflate (RFC 2246) compression.
- Separate default ciphers and sslVersion for "fips = yes" and "fips = no".
- UAC support for editing configuration file with Windows GUI.
* Bugfixes
- Fixed exec+connect sections.
- Added a workaround for broken Android getaddrinfo():
http://stackoverflow.com/questions/7818246/segmentation-fault-in-getaddrinfo
Home page: http://www.stunnel.org/
Download: ftp://ftp.stunnel.org/stunnel/
SHA-256 hash for stunnel-4.51.tar.gz:
dc52b22de48a2d71ab6170adb628dbe05dd406d6c9103fc43fbdbda776c3e90b
Best regards,
Mike
