summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authortron <tron>2014-03-12 09:41:09 +0000
committertron <tron>2014-03-12 09:41:09 +0000
commitff23066140fc76df4b48093ea80f8346e3d2adac (patch)
tree80337175dea12cd0a0510d506aa26e09af586169
parente78cbd1dd3c8685526c30e0ffcac3f1893165a20 (diff)
downloadpkgsrc-ff23066140fc76df4b48093ea80f8346e3d2adac.tar.gz
Pullup ticket #4341 - requested by jym
security/stunnel: security update Revisions pulled up: - security/stunnel/Makefile 1.86-1.87,1.89 via patch - security/stunnel/distinfo 1.38-1.39 - security/stunnel/patches/patch-ac 1.16 --- Module Name: pkgsrc Committed By: tron Date: Sun Jan 26 15:51:54 UTC 2014 Modified Files: pkgsrc/security/stunnel: Makefile Log Message: Fix permissions so that "etc/stunnel" belongs to the actual "root" user and not to the user that build the package. Bump package revision because of this fix. --- Module Name: pkgsrc Committed By: tron Date: Sun Jan 26 16:59:13 UTC 2014 Modified Files: pkgsrc/security/stunnel: Makefile distinfo Log Message: Update "stunnel" package to version 4.56. Changes since 4.55: - Fixed a regression bug introduced in version 4.55 causing random crashes on several platforms, including Windows 7. - Fixed incorrect "stunnel -exit" process synchronisation. - Fixed FIPS detection with new versions of the OpenSSL library. - Failure to open the log file at startup is no longer ignored. --- Module Name: pkgsrc Committed By: jym Date: Wed Mar 12 00:24:35 UTC 2014 Modified Files: pkgsrc/security/stunnel: Makefile distinfo pkgsrc/security/stunnel/patches: patch-ac Log Message: Update stunnel to 5.00. Of utmost importance: it fixes CVE 2014-0016. Thanks to jgw (Jeff W) _AT_ sdf.org for working on the same patch independently. In before the freeze! Changelog follows. Security bugfixes Added PRNG state update in fork threading (CVE-2014-0016). New global configuration file defaults Default "fips" option value is now "no", as FIPS mode is only helpful for compliance, and never for actual security. Default "pid" is now "", i.e. not to create a pid file at startup. New service-level configuration file defaults Default "ciphers" updated to "HIGH:MEDIUM:+3DES:+DH:!aNULL:!SSLv2" due to AlFBPPS attack and bad performance of DH ciphersuites. Default "libwrap" setting is now "no" to improve performance. New features OpenSSL DLLs updated to version 1.0.1f. zlib DLL updated to version 1.2.8. autoconf scripts upgraded to version 2.69. TLS 1.1 and TLS 1.2 are now allowed in the FIPS mode. New service-level option "redirect" to redirect SSL client connections on authentication failures instead of rejecting them. New global "engineDefault" configuration file option to control which OpenSSL tasks are delegated to the current engine. Available tasks: ALL, RSA, DSA, ECDH, ECDSA, DH, RAND, CIPHERS, DIGESTS, PKEY, PKEY_CRYPTO, PKEY_ASN1. New service-level configuration file option "engineId" to select the engine by identifier, e.g. "engineId = capi". New global configuration file option "log" to control whether to append (the default), or to overwrite log file while (re)opening. Different taskbar icon colors to indicate the service state. New global configuration file options "iconIdle", "iconActive", and "iconError" to select status icon on GUI taskbar. Removed the limit of 63 stunnel.conf sections on Win32 platform. Installation of a sample certificate was moved to a separate "cert" target in order to allow unattended (e.g. scripted) installations. Reduced length of the logged thread identifier. It is still based on the OS thread ID, and thus not unique over long periods of time. Improved readability of error messages printed when stunnel refuses to start due to a critical error. Bugfixes LD_PRELOAD Solaris compatibility bug fixed (thx to Norm Jacobs). CRYPTO_NUM_LOCKS replaced with CRYPTO_num_locks() to improve binary compatibility with diverse builds of OpenSSL (thx to Norm Jacobs). Corrected round-robin failover behavior under heavy load. Numerous fixes in the engine support code. On Win32 platform .rnd file moved from c:\ to the stunnel folder.
-rw-r--r--security/stunnel/Makefile7
-rw-r--r--security/stunnel/distinfo10
-rw-r--r--security/stunnel/patches/patch-ac14
3 files changed, 14 insertions, 17 deletions
diff --git a/security/stunnel/Makefile b/security/stunnel/Makefile
index cb2f37e0f9b..d78f3f49852 100644
--- a/security/stunnel/Makefile
+++ b/security/stunnel/Makefile
@@ -1,7 +1,6 @@
-# $NetBSD: Makefile,v 1.85 2013/10/31 15:58:30 jperkin Exp $
+# $NetBSD: Makefile,v 1.85.2.1 2014/03/12 09:41:09 tron Exp $
-DISTNAME= stunnel-4.55
-PKGREVISION= 2
+DISTNAME= stunnel-5.00
CATEGORIES= security
MASTER_SITES= http://www.stunnel.org/downloads/
@@ -29,7 +28,7 @@ PKG_GECOS.${STUNNEL_USER}?= Stunnel
PKG_HOME.${STUNNEL_USER}?= ${VARBASE}/chroot/stunnel
PKG_SYSCONFSUBDIR= stunnel
-PKG_SYSCONFDIR_PERMS= ${ROOT_USER} ${STUNNEL_GROUP} 0750
+PKG_SYSCONFDIR_PERMS= ${REAL_ROOT_USER} ${STUNNEL_GROUP} 0750
OWN_DIRS= ${PKG_HOME.${STUNNEL_USER}}/certs ${PKG_HOME.${STUNNEL_USER}}/crls
OWN_DIRS_PERMS= ${PKG_HOME.${STUNNEL_USER}}/pid ${USER_GROUP} 0750
diff --git a/security/stunnel/distinfo b/security/stunnel/distinfo
index ae035efe6db..82cb317af8a 100644
--- a/security/stunnel/distinfo
+++ b/security/stunnel/distinfo
@@ -1,7 +1,7 @@
-$NetBSD: distinfo,v 1.37 2013/03/06 22:50:31 jym Exp $
+$NetBSD: distinfo,v 1.37.8.1 2014/03/12 09:41:09 tron Exp $
-SHA1 (stunnel-4.55.tar.gz) = 9d29eb2f1880c7cf9ecbbd96dee8c0f8cc7e7f88
-RMD160 (stunnel-4.55.tar.gz) = 31fb1dd51046a34f902148a170cdc6c944ba5b63
-Size (stunnel-4.55.tar.gz) = 538408 bytes
+SHA1 (stunnel-5.00.tar.gz) = a048e24529e3b4cb787838ea6de5c6475746f197
+RMD160 (stunnel-5.00.tar.gz) = cd5efaec920529e65f5d233254110d5ae605535b
+Size (stunnel-5.00.tar.gz) = 586738 bytes
SHA1 (patch-aa) = 0e57d4fa383dad7891795073d1f6b5075715b346
-SHA1 (patch-ac) = 43521a88606981bc55dd94043d52b1a16f08e583
+SHA1 (patch-ac) = 63e80322e68efc7e6c5f0bab92e7260178a25109
diff --git a/security/stunnel/patches/patch-ac b/security/stunnel/patches/patch-ac
index 68dbbd4c4f5..dbd179c97ce 100644
--- a/security/stunnel/patches/patch-ac
+++ b/security/stunnel/patches/patch-ac
@@ -1,15 +1,13 @@
-$NetBSD: patch-ac,v 1.15 2011/11/10 21:01:39 ryoon Exp $
+$NetBSD: patch-ac,v 1.15.18.1 2014/03/12 09:41:09 tron Exp $
-Change pid file location.
-
---- src/Makefile.in.orig 2011-11-04 20:24:15.000000000 +0000
+--- src/Makefile.in.orig 2014-01-07 20:19:44.000000000 +0000
+++ src/Makefile.in
-@@ -271,7 +271,7 @@ libstunnel_la_LDFLAGS = -avoid-version
+@@ -310,7 +310,7 @@ libstunnel_la_LDFLAGS = -avoid-version
# Additional preprocesor definitions
stunnel_CPPFLAGS = -I/usr/kerberos/include -I$(SSLDIR)/include \
-- -DLIBDIR='"$(pkglibdir)"' -DCONFDIR='"$(sysconfdir)/stunnel"' \
-+ -DLIBDIR='"$(pkglibdir)"' -DCONFDIR='"$(sysconfdir)"' \
- -DPIDFILE='"$(localstatedir)/run/stunnel/stunnel.pid"'
+- -DLIBDIR='"$(pkglibdir)"' -DCONFDIR='"$(sysconfdir)/stunnel"'
++ -DLIBDIR='"$(pkglibdir)"' -DCONFDIR='"$(sysconfdir)"'
# Win32 executable
+ EXTRA_DIST = make.bat makece.bat makew32.bat mingw.mak evc.mak vc.mak \