Dear Users,
I have released version 4.53 of stunnel. This is major a bugfix release. Upgrade is highly recommended.
The ChangeLog entry:
Version 4.53, 2012.03.19, urgency: MEDIUM: * New features - Added client-mode "sni" option to directly control the value of TLS Server Name Indication (RFC 3546) extension. - Added support for IP_FREEBIND socket option with a pached Linux kernel. - Glibc-specific dynamic allocation tuning was applied to help unused memory deallocation. - Non-blocking OCSP implementation. * Bugfixes - Compilation fixes for old versions of OpenSSL (tested against 0.9.6). - Usage of uninitialized variables fixed in exec+connect services. - Occasional logging subsystem crash with exec+connect services. - OpenBSD compilation fix (thx to Michele Orru'). - Session id context initialized with session name rather than a constant. - Fixed handling of a rare inetd mode use case, where either stdin or stdout is a socket, but not both of them at the same time. - Fixed missing OPENSSL_Applink http://www.openssl.org/support/faq.html#PROG2 - Fixed crash on termination with FORK threading model. - Fixed dead canary after configuration reload with open connections. - Fixed missing file descriptors passed to local mode processes. - Fixed required jmp_buf alignment on Itanium platform. - Removed creating /dev/zero in the chroot jail on Solaris platform. - Fixed detection of WSAECONNREFUSED Winsock error. - Missing Microsoft.VC90.CRT.manifest added to Windows installer.
Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/
SHA-256 hash for stunnel-4.53.tar.gz: 3e640aa4c96861d10addba758b66e99e7c5aec8697764f2a59ca2268901b8e57
Best regards, Mike
Thanks for the new version!
Upon loading configuration in 4.53, I noticed that I no longer get the following log entry for each service loaded:
2012.03.19 21:18:34 LOG6[504:928]: SSL context initialized
Is this by design, or related to the session ID context bugfix?
Regards;
Thomas
On 3/19/2012 5:24 PM, Michal Trojnara wrote:
Dear Users,
I have released version 4.53 of stunnel. This is major a bugfix release. Upgrade is highly recommended.
The ChangeLog entry:
Version 4.53, 2012.03.19, urgency: MEDIUM: * New features - Added client-mode "sni" option to directly control the value of TLS Server Name Indication (RFC 3546) extension. - Added support for IP_FREEBIND socket option with a pached Linux kernel. - Glibc-specific dynamic allocation tuning was applied to help unused memory deallocation. - Non-blocking OCSP implementation. * Bugfixes - Compilation fixes for old versions of OpenSSL (tested against 0.9.6). - Usage of uninitialized variables fixed in exec+connect services. - Occasional logging subsystem crash with exec+connect services. - OpenBSD compilation fix (thx to Michele Orru'). - Session id context initialized with session name rather than a constant. - Fixed handling of a rare inetd mode use case, where either stdin or stdout is a socket, but not both of them at the same time. - Fixed missing OPENSSL_Applink http://www.openssl.org/support/faq.html#PROG2 - Fixed crash on termination with FORK threading model. - Fixed dead canary after configuration reload with open connections. - Fixed missing file descriptors passed to local mode processes. - Fixed required jmp_buf alignment on Itanium platform. - Removed creating /dev/zero in the chroot jail on Solaris platform. - Fixed detection of WSAECONNREFUSED Winsock error. - Missing Microsoft.VC90.CRT.manifest added to Windows installer.
Home page: http://www.stunnel.org/ http://stunnel.mirt.net/ Download: ftp://ftp.stunnel.org/stunnel/ ftp://stunnel.mirt.net/stunnel/
SHA-256 hash for stunnel-4.53.tar.gz:
3e640aa4c96861d10addba758b66e99e7c5aec8697764f2a59ca2268901b8e57
Best regards,
Mike
stunnel-users mailing list [email protected] http://stunnel.mirt.net/mailman/listinfo/stunnel-users
I have just uploaded the updated Debian package of stunnel 4.53 to the unstable distribution.
As a notable change, beyond the bugfixes and new features in 4.53 itself, this package has enabled the use of compile time 'hardening' options. (See http://wiki.debian.org/Hardening )
Since our build system was already very strict, this did not cause any new warnings or error messages to be output during compile, link or my basic level run time testing. Nevertheles, I wuold kindly request the help of this list in ferreting out any minor issue that may have crept in.
Note that the expected efect of this hardening options is to turn potential vulnerability vectors into hard crashes. Thus, even if a new bug *does* turn out, it's most likely to be an old, hidden, bug.
For the record, the new compile options enabled were
-D_FORTIFY_SOURCE=2 -fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security
And the new link options
-Wl,-z,relro
-
Michal Trojnara -
Rodrigo Gallardo -
Thomas Eifert