Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package stunnel for openSUSE:Factory checked in at 2026-10-07 19:35:18 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/stunnel (Old) and /work/SRC/openSUSE:Factory/.stunnel.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "stunnel" Wed Oct 7 19:35:18 2026 rev:53 rq:1383024 version:5.82 Changes: -------- --- /work/SRC/openSUSE:Factory/stunnel/stunnel.changes 2026-08-11 17:14:46.844058399 +0200 +++ /work/SRC/openSUSE:Factory/.stunnel.new.3698736/stunnel.changes 2026-10-07 19:36:17.838922072 +0200 @@ -1,0 +2,33 @@ +Wed Oct 7 09:28:57 UTC 2026 - Pedro Monreal <[email protected]> + +- Update to 5.82: + * Bugfixes: + - Fixed premature connection closure on macOS when the peer + half-closed the plaintext connection while data still needed + to be forwarded. + +------------------------------------------------------------------- +Wed Oct 7 09:21:53 UTC 2026 - Pedro Monreal <[email protected]> + +- Update to 5.81: + * Security bugfixes + - OpenSSL DLLs updated to version 3.5.8. + - Fixed truncation and out-of-bounds reads when inheriting binary + session ticket keys containing null bytes + - Prevented OCSP stapling response failures from terminating the daemon + * Bugfixes + - Avoided spurious sysconf error messages after successful descriptor-limit + queries on platforms where a successful call may change errno. + - Fixed a potential crash when parsing empty ASCII PSK secrets + - Fixed a memory leak after DTLS listener poll errors and timeouts + - Fixed memory leaks during NTLM HTTP proxy negotiation + - Fixed early startup logging before thread lock initialization + - Rejected excessively nested configuration includes instead of + consuming the process stack recursively. + * Features + - Improved TLS and DTLS shutdown diagnostics. + * Rebase patches: + - stunnel-5.69-system-ciphers.patch + - stunnel-5.69-default-tls-version.patch + +------------------------------------------------------------------- Old: ---- stunnel-5.80.tar.gz stunnel-5.80.tar.gz.asc New: ---- stunnel-5.82.tar.gz stunnel-5.82.tar.gz.asc ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ stunnel.spec ++++++ --- /var/tmp/diff_new_pack.lWYsjA/_old 2026-10-07 19:36:19.014971240 +0200 +++ /var/tmp/diff_new_pack.lWYsjA/_new 2026-10-07 19:36:19.016971324 +0200 @@ -22,7 +22,7 @@ %define _fillupdir %{_localstatedir}/adm/fillup-templates %endif Name: stunnel -Version: 5.80 +Version: 5.82 Release: 0 Summary: Universal TLS Tunnel License: GPL-2.0-or-later ++++++ stunnel-5.69-default-tls-version.patch ++++++ --- /var/tmp/diff_new_pack.lWYsjA/_old 2026-10-07 19:36:19.052972829 +0200 +++ /var/tmp/diff_new_pack.lWYsjA/_new 2026-10-07 19:36:19.056972996 +0200 @@ -12,57 +12,44 @@ src/prototypes.h | 3 +++ 3 files changed, 36 insertions(+), 16 deletions(-) -Index: stunnel-5.72/src/ctx.c +Index: stunnel-5.82/src/ctx.c =================================================================== ---- stunnel-5.72.orig/src/ctx.c -+++ stunnel-5.72/src/ctx.c -@@ -163,19 +163,29 @@ int context_init(SERVICE_OPTIONS *sectio +--- stunnel-5.82.orig/src/ctx.c ++++ stunnel-5.82/src/ctx.c +@@ -520,16 +520,24 @@ int context_init(SERVICE_OPTIONS *sectio /* set supported protocol versions */ #if OPENSSL_VERSION_NUMBER>=0x10100000L -- if(section->min_proto_version && -- !SSL_CTX_set_min_proto_version(section->ctx, -- section->min_proto_version)) { -- s_log(LOG_ERR, "Failed to set the minimum protocol version 0x%X", -- section->min_proto_version); -- return 1; /* FAILED */ +- if(section->min_proto_version) { +- if(!SSL_CTX_set_min_proto_version(section->ctx, + if (section->min_proto_version == USE_DEFAULT_TLS_VERSION) { + s_log(LOG_INFO, "Using the default TLS minimum version as specified in" + " crypto policies. Not setting explicitly."); + } else { + if(section->min_proto_version && + !SSL_CTX_set_min_proto_version(section->ctx, -+ section->min_proto_version)) { -+ s_log(LOG_ERR, "Failed to set the minimum protocol version 0x%X", -+ section->min_proto_version); -+ return 1; /* FAILED */ -+ } + section->min_proto_version)) { + s_log(LOG_ERR, "Failed to set the minimum protocol version 0x%X", + section->min_proto_version); + return 1; /* FAILED */ + } } -- if(section->max_proto_version && -- !SSL_CTX_set_max_proto_version(section->ctx, -- section->max_proto_version)) { -- s_log(LOG_ERR, "Failed to set the maximum protocol version 0x%X", -- section->max_proto_version); -- return 1; /* FAILED */ +- if(section->max_proto_version) { +- if(!SSL_CTX_set_max_proto_version(section->ctx, + if (section->max_proto_version == USE_DEFAULT_TLS_VERSION) { + s_log(LOG_INFO, "Using the default TLS maximum version as specified in" + " crypto policies. Not setting explicitly"); + } else { + if(section->max_proto_version && + !SSL_CTX_set_max_proto_version(section->ctx, -+ section->max_proto_version)) { -+ s_log(LOG_ERR, "Failed to set the maximum protocol version 0x%X", -+ section->max_proto_version); -+ return 1; /* FAILED */ -+ } - } - #endif /* OPENSSL_VERSION_NUMBER>=0x10100000L */ - -Index: stunnel-5.72/src/options.c + section->max_proto_version)) { + s_log(LOG_ERR, "Failed to set the maximum protocol version 0x%X", + section->max_proto_version); +Index: stunnel-5.82/src/options.c =================================================================== ---- stunnel-5.72.orig/src/options.c -+++ stunnel-5.72/src/options.c -@@ -3429,8 +3429,9 @@ NOEXPORT const char *parse_service_optio +--- stunnel-5.82.orig/src/options.c ++++ stunnel-5.82/src/options.c +@@ -3894,8 +3894,9 @@ NOEXPORT const char *parse_service_optio return "Invalid protocol version"; return NULL; /* OK */ case CMD_INITIALIZE: @@ -74,7 +61,7 @@ return "Invalid protocol version range"; break; case CMD_PRINT_DEFAULTS: -@@ -3448,7 +3449,10 @@ NOEXPORT const char *parse_service_optio +@@ -3913,7 +3914,10 @@ NOEXPORT const char *parse_service_optio /* sslVersionMax */ switch(cmd) { case CMD_SET_DEFAULTS: @@ -86,7 +73,7 @@ break; case CMD_SET_COPY: section->max_proto_version=new_service_options.max_proto_version; -@@ -3479,7 +3483,10 @@ NOEXPORT const char *parse_service_optio +@@ -3944,7 +3948,10 @@ NOEXPORT const char *parse_service_optio /* sslVersionMin */ switch(cmd) { case CMD_SET_DEFAULTS: @@ -98,12 +85,12 @@ break; case CMD_SET_COPY: section->min_proto_version=new_service_options.min_proto_version; -Index: stunnel-5.72/src/prototypes.h +Index: stunnel-5.82/src/prototypes.h =================================================================== ---- stunnel-5.72.orig/src/prototypes.h -+++ stunnel-5.72/src/prototypes.h -@@ -956,6 +956,9 @@ ICON_IMAGE load_icon_default(ICON_TYPE); - ICON_IMAGE load_icon_file(const char *); +--- stunnel-5.82.orig/src/prototypes.h ++++ stunnel-5.82/src/prototypes.h +@@ -1035,6 +1035,9 @@ ICON_IMAGE load_icon_default(ICON_TYPE t + ICON_IMAGE load_icon_file(const char *file_name); #endif +#define USE_DEFAULT_TLS_VERSION ((int)-2) /* Use defaults in OpenSSL ++++++ stunnel-5.69-system-ciphers.patch ++++++ --- /var/tmp/diff_new_pack.lWYsjA/_old 2026-10-07 19:36:19.067973456 +0200 +++ /var/tmp/diff_new_pack.lWYsjA/_new 2026-10-07 19:36:19.070973581 +0200 @@ -16,18 +16,18 @@ src/options.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) -Index: stunnel-5.76/src/options.c +Index: stunnel-5.82/src/options.c =================================================================== ---- stunnel-5.76.orig/src/options.c -+++ stunnel-5.76/src/options.c -@@ -332,10 +332,10 @@ static const char *option_not_found= - "Specified option name is not valid here"; +--- stunnel-5.82.orig/src/options.c ++++ stunnel-5.82/src/options.c +@@ -396,10 +396,10 @@ NOEXPORT const char *option_not_found= + NOEXPORT const char option_include[]="Include directory"; - static const char *stunnel_cipher_list= + NOEXPORT const char *stunnel_cipher_list= - "HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK"; + "PROFILE=SYSTEM"; #ifdef USE_FIPS - static const char *fips_cipher_list= + NOEXPORT const char *fips_cipher_list= - "FIPS:!DH:!kDHEPSK"; + "PROFILE=SYSTEM"; #endif /* USE_FIPS */ ++++++ stunnel-5.80.tar.gz -> stunnel-5.82.tar.gz ++++++ ++++ 16695 lines of diff (skipped)
