hello,
diff updates stunnel to 5.82
it has now build compatibility with libressl, so this update also zap
patches no longer needed. Ok?
thanks,
- gsoares
diff --git a/security/stunnel/Makefile b/security/stunnel/Makefile
index a66f9e8aad7..110323f68b8 100644
--- a/security/stunnel/Makefile
+++ b/security/stunnel/Makefile
@@ -1,8 +1,7 @@
COMMENT= SSL encryption wrapper for standard network daemons
-DISTNAME= stunnel-5.64
+DISTNAME= stunnel-5.82
CATEGORIES= security
-REVISION= 2
MAINTAINER= Gleydson Soares <[email protected]>
diff --git a/security/stunnel/distinfo b/security/stunnel/distinfo
index 51f4b413da8..d6a9d3e821f 100644
--- a/security/stunnel/distinfo
+++ b/security/stunnel/distinfo
@@ -1,2 +1,2 @@
-SHA256 (stunnel-5.64.tar.gz) = 7r5T7RFrpDsueGdisMK5FRHnt0hXrUdlgk5xmeb6+IM=
-SIZE (stunnel-5.64.tar.gz) = 869088
+SHA256 (stunnel-5.82.tar.gz) = jnQ4zNazoqsFGC0IRuESpWp/VX7N7kDeB79nggAIvvc=
+SIZE (stunnel-5.82.tar.gz) = 963237
diff --git a/security/stunnel/patches/patch-Makefile_in
b/security/stunnel/patches/patch-Makefile_in
index 5e5549c2aa6..00ede8b960d 100644
--- a/security/stunnel/patches/patch-Makefile_in
+++ b/security/stunnel/patches/patch-Makefile_in
@@ -1,8 +1,8 @@
Index: Makefile.in
--- Makefile.in.orig
+++ Makefile.in
-@@ -371,7 +371,7 @@ top_srcdir = @top_srcdir@
- with_bashcompdir = @with_bashcompdir@
+@@ -374,7 +374,7 @@ top_builddir = @top_builddir@
+ top_srcdir = @top_srcdir@
AM_DISTCHECK_CONFIGURE_FLAGS =
--with-bashcompdir='$$(datarootdir)/bash-completion/completions'
ACLOCAL_AMFLAGS = -I m4
-SUBDIRS = src doc tools tests
diff --git a/security/stunnel/patches/patch-src_client_c
b/security/stunnel/patches/patch-src_client_c
deleted file mode 100644
index b1d9645f4aa..00000000000
--- a/security/stunnel/patches/patch-src_client_c
+++ /dev/null
@@ -1,30 +0,0 @@
-Index: src/client.c
---- src/client.c.orig
-+++ src/client.c
-@@ -750,7 +750,7 @@ NOEXPORT void print_cipher(CLI *c) { /* print negotiat
- NOEXPORT void transfer(CLI *c) {
- int timeout; /* s_poll_wait timeout in seconds */
- int pending; /* either processed on unprocessed TLS data */
--#if OPENSSL_VERSION_NUMBER >= 0x10100000L
-+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
- int has_pending=0, prev_has_pending;
- #endif
- int watchdog=0; /* a counter to detect an infinite loop */
-@@ -797,7 +797,7 @@ NOEXPORT void transfer(CLI *c) {
-
- /****************************** wait for an event */
- pending=SSL_pending(c->ssl);
--#if OPENSSL_VERSION_NUMBER >= 0x10100000L
-+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
- /* only attempt to process SSL_has_pending() data once */
- prev_has_pending=has_pending;
- has_pending=SSL_has_pending(c->ssl);
-@@ -1202,7 +1202,7 @@ NOEXPORT void transfer(CLI *c) {
- s_log(LOG_ERR,
- "please report the problem to [email protected]");
- stunnel_info(LOG_ERR);
--#if OPENSSL_VERSION_NUMBER >= 0x10100000L
-+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
- s_log(LOG_ERR, "protocol=%s, SSL_pending=%d, SSL_has_pending=%d",
- SSL_get_version(c->ssl),
- SSL_pending(c->ssl), SSL_has_pending(c->ssl));
diff --git a/security/stunnel/patches/patch-src_common_h
b/security/stunnel/patches/patch-src_common_h
deleted file mode 100644
index bd324352bd7..00000000000
--- a/security/stunnel/patches/patch-src_common_h
+++ /dev/null
@@ -1,12 +0,0 @@
-Index: src/common.h
---- src/common.h.orig
-+++ src/common.h
-@@ -454,7 +454,7 @@ extern char *sys_errlist[];
- #define OPENSSL_NO_TLS1_2
- #endif /* OpenSSL older than 1.0.1 || defined(OPENSSL_NO_TLS1) */
-
--#if OPENSSL_VERSION_NUMBER>=0x10100000L
-+#if OPENSSL_VERSION_NUMBER>=0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
- #ifndef OPENSSL_NO_SSL2
- #define OPENSSL_NO_SSL2
- #endif /* !defined(OPENSSL_NO_SSL2) */
diff --git a/security/stunnel/patches/patch-src_ctx_c
b/security/stunnel/patches/patch-src_ctx_c
deleted file mode 100644
index 8ed21c12de7..00000000000
--- a/security/stunnel/patches/patch-src_ctx_c
+++ /dev/null
@@ -1,67 +0,0 @@
-Index: src/ctx.c
---- src/ctx.c.orig
-+++ src/ctx.c
-@@ -91,7 +91,7 @@ NOEXPORT void set_prompt(const char *);
- NOEXPORT int ui_retry();
-
- /* session tickets */
--#if OPENSSL_VERSION_NUMBER >= 0x10101000L
-+#if OPENSSL_VERSION_NUMBER >= 0x10101000L && !defined(LIBRESSL_VERSION_NUMBER)
- NOEXPORT int generate_session_ticket_cb(SSL *, void *);
- NOEXPORT int decrypt_session_ticket_cb(SSL *, SSL_SESSION *,
- const unsigned char *, size_t, SSL_TICKET_STATUS, void *);
-@@ -179,7 +179,7 @@ int context_init(SERVICE_OPTIONS *section) { /* init T
- }
- current_section=section; /* setup current section for callbacks */
-
--#if OPENSSL_VERSION_NUMBER>=0x10100000L
-+#if OPENSSL_VERSION_NUMBER>=0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
- /* set the security level */
- if(section->security_level>=0) {
- /* set the user-specified value */
-@@ -265,7 +265,7 @@ int context_init(SERVICE_OPTIONS *section) { /* init T
- #endif
-
- /* setup session tickets */
--#if OPENSSL_VERSION_NUMBER >= 0x10101000L
-+#if OPENSSL_VERSION_NUMBER >= 0x10101000L && !defined(LIBRESSL_VERSION_NUMBER)
- SSL_CTX_set_session_ticket_cb(section->ctx, generate_session_ticket_cb,
- decrypt_session_ticket_cb, NULL);
- #endif /* OpenSSL 1.1.1 or later */
-@@ -539,7 +539,7 @@ NOEXPORT int ecdh_init(SERVICE_OPTIONS *section) {
- /**************************************** initialize OpenSSL CONF */
-
- NOEXPORT int conf_init(SERVICE_OPTIONS *section) {
--#if OPENSSL_VERSION_NUMBER>=0x10002000L
-+#if OPENSSL_VERSION_NUMBER>=0x10002000L && !defined(LIBRESSL_VERSION_NUMBER)
- SSL_CONF_CTX *cctx;
- NAME_LIST *curr;
- char *cmd, *param;
-@@ -1045,7 +1045,7 @@ NOEXPORT int ui_retry() {
-
- /**************************************** session tickets */
-
--#if OPENSSL_VERSION_NUMBER >= 0x10101000L
-+#if OPENSSL_VERSION_NUMBER >= 0x10101000L && !defined(LIBRESSL_VERSION_NUMBER)
-
- typedef struct {
- void *session_authenticated;
-@@ -1538,7 +1538,7 @@ NOEXPORT void info_callback(const SSL *ssl, int where,
-
- c=SSL_get_ex_data((SSL *)ssl, index_ssl_cli);
- if(c) {
--#if OPENSSL_VERSION_NUMBER>=0x10100000L
-+#if OPENSSL_VERSION_NUMBER>=0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
- OSSL_HANDSHAKE_STATE state=SSL_get_state(ssl);
- #else
- int state=SSL_get_state((SSL *)ssl);
-@@ -1574,8 +1574,7 @@ NOEXPORT void info_callback(const SSL *ssl, int where,
- #ifndef SSL3_ST_SR_CLNT_HELLO_A
- if(state==TLS_ST_SR_CLNT_HELLO) {
- #else
-- if(state==SSL3_ST_SR_CLNT_HELLO_A
-- || state==SSL23_ST_SR_CLNT_HELLO_A) {
-+ if(state==SSL3_ST_SR_CLNT_HELLO_A) {
- #endif
- /* client hello received after initial handshake,
- * this means renegotiation -> mark it */
diff --git a/security/stunnel/patches/patch-src_options_c
b/security/stunnel/patches/patch-src_options_c
deleted file mode 100644
index 453fc41f4bd..00000000000
--- a/security/stunnel/patches/patch-src_options_c
+++ /dev/null
@@ -1,12 +0,0 @@
-Index: src/options.c
---- src/options.c.orig
-+++ src/options.c
-@@ -38,7 +38,7 @@
- #include "common.h"
- #include "prototypes.h"
-
--#if OPENSSL_VERSION_NUMBER >= 0x10101000L
-+#if OPENSSL_VERSION_NUMBER >= 0x10101000L && !defined(LIBRESSL_VERSION_NUMBER)
- #define DEFAULT_CURVES "X25519:P-256:X448:P-521:P-384"
- #else /* OpenSSL version < 1.1.1 */
- #define DEFAULT_CURVES "prime256v1"
diff --git a/security/stunnel/patches/patch-src_prototypes_h
b/security/stunnel/patches/patch-src_prototypes_h
deleted file mode 100644
index 02436247b85..00000000000
--- a/security/stunnel/patches/patch-src_prototypes_h
+++ /dev/null
@@ -1,21 +0,0 @@
-Index: src/prototypes.h
---- src/prototypes.h.orig
-+++ src/prototypes.h
-@@ -736,7 +736,7 @@ int getnameinfo(const struct sockaddr *, socklen_t,
- extern CLI *thread_head;
- #endif
-
--#if OPENSSL_VERSION_NUMBER<0x10100004L
-+#if OPENSSL_VERSION_NUMBER<0x10100004L || defined(LIBRESSL_VERSION_NUMBER)
-
- #ifdef USE_OS_THREADS
-
-@@ -787,7 +787,7 @@ typedef enum {
-
- extern CRYPTO_RWLOCK *stunnel_locks[STUNNEL_LOCKS];
-
--#if OPENSSL_VERSION_NUMBER<0x10100004L
-+#if OPENSSL_VERSION_NUMBER<0x10100004L || defined(LIBRESSL_VERSION_NUMBER)
- /* Emulate the OpenSSL 1.1 locking API for older OpenSSL versions */
- CRYPTO_RWLOCK *CRYPTO_THREAD_lock_new(void);
- int CRYPTO_THREAD_read_lock(CRYPTO_RWLOCK *);
diff --git a/security/stunnel/patches/patch-src_ssl_c
b/security/stunnel/patches/patch-src_ssl_c
deleted file mode 100644
index 72c83bb83af..00000000000
--- a/security/stunnel/patches/patch-src_ssl_c
+++ /dev/null
@@ -1,30 +0,0 @@
-Index: src/ssl.c
---- src/ssl.c.orig
-+++ src/ssl.c
-@@ -44,7 +44,7 @@ NOEXPORT void cb_new_auth(void *parent, void *ptr, CRY
- #if OPENSSL_VERSION_NUMBER>=0x30000000L
- NOEXPORT int cb_dup_addr(CRYPTO_EX_DATA *to, const CRYPTO_EX_DATA *from,
- void **from_d, int idx, long argl, void *argp);
--#elif OPENSSL_VERSION_NUMBER>=0x10100000L
-+#elif OPENSSL_VERSION_NUMBER>=0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
- NOEXPORT int cb_dup_addr(CRYPTO_EX_DATA *to, const CRYPTO_EX_DATA *from,
- void *from_d, int idx, long argl, void *argp);
- #else
-@@ -87,7 +87,7 @@ int fips_available() { /* either FIPS provider or cont
- }
-
- int ssl_init(void) { /* init TLS before parsing configuration file */
--#if OPENSSL_VERSION_NUMBER>=0x10100000L
-+#if OPENSSL_VERSION_NUMBER>=0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
- OPENSSL_INIT_SETTINGS *conf=OPENSSL_INIT_new();
- #ifdef USE_WIN32
- OPENSSL_INIT_set_config_filename(conf, "..\\config\\openssl.cnf");
-@@ -161,7 +161,7 @@ NOEXPORT void cb_new_auth(void *parent, void *ptr, CRY
- #if OPENSSL_VERSION_NUMBER>=0x30000000L
- NOEXPORT int cb_dup_addr(CRYPTO_EX_DATA *to, const CRYPTO_EX_DATA *from,
- void **from_d, int idx, long argl, void *argp) {
--#elif OPENSSL_VERSION_NUMBER>=0x10100000L
-+#elif OPENSSL_VERSION_NUMBER>=0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
- NOEXPORT int cb_dup_addr(CRYPTO_EX_DATA *to, const CRYPTO_EX_DATA *from,
- void *from_d, int idx, long argl, void *argp) {
- #else
diff --git a/security/stunnel/patches/patch-src_sthreads_c
b/security/stunnel/patches/patch-src_sthreads_c
deleted file mode 100644
index a07f2cadc3b..00000000000
--- a/security/stunnel/patches/patch-src_sthreads_c
+++ /dev/null
@@ -1,31 +0,0 @@
-Index: src/sthreads.c
---- src/sthreads.c.orig
-+++ src/sthreads.c
-@@ -120,7 +120,7 @@ void thread_id_init(void) {
- /**************************************** locking */
-
- /* we only need to initialize locking with OpenSSL older than 1.1.0 */
--#if OPENSSL_VERSION_NUMBER<0x10100004L
-+#if OPENSSL_VERSION_NUMBER<0x10100004L || defined(LIBRESSL_VERSION_NUMBER)
-
- #ifdef USE_PTHREAD
-
-@@ -279,7 +279,7 @@ NOEXPORT int s_atomic_add(int *val, int amount, CRYPTO
-
- CRYPTO_RWLOCK *stunnel_locks[STUNNEL_LOCKS];
-
--#if OPENSSL_VERSION_NUMBER<0x10100004L
-+#if OPENSSL_VERSION_NUMBER<0x10100004L || defined(LIBRESSL_VERSION_NUMBER)
-
- #ifdef USE_OS_THREADS
-
-@@ -387,7 +387,8 @@ int CRYPTO_atomic_add(int *val, int amount, int *ret,
-
- void locking_init(void) {
- size_t i;
--#if defined(USE_OS_THREADS) && OPENSSL_VERSION_NUMBER<0x10100004L
-+#if defined(USE_OS_THREADS) && \
-+ (OPENSSL_VERSION_NUMBER<0x10100004L || defined(LIBRESSL_VERSION_NUMBER))
- size_t num;
-
- /* initialize the OpenSSL static locking */
diff --git a/security/stunnel/patches/patch-src_verify_c
b/security/stunnel/patches/patch-src_verify_c
deleted file mode 100644
index f9c266df47b..00000000000
--- a/security/stunnel/patches/patch-src_verify_c
+++ /dev/null
@@ -1,12 +0,0 @@
-Index: src/verify.c
---- src/verify.c.orig
-+++ src/verify.c
-@@ -351,7 +351,7 @@ NOEXPORT int cert_check_local(X509_STORE_CTX *callback
- cert=X509_STORE_CTX_get_current_cert(callback_ctx);
- subject=X509_get_subject_name(cert);
-
--#if OPENSSL_VERSION_NUMBER<0x10100006L
-+#if OPENSSL_VERSION_NUMBER<0x10100006L || defined(LIBRESSL_VERSION_NUMBER)
- #define X509_STORE_CTX_get1_certs X509_STORE_get1_certs
- #endif
- /* modern API allows retrieving multiple matching certificates */
diff --git a/security/stunnel/patches/patch-tools_stunnel_conf-sample_in
b/security/stunnel/patches/patch-tools_stunnel_conf-sample_in
index 3127c6966f8..452b00bc467 100644
--- a/security/stunnel/patches/patch-tools_stunnel_conf-sample_in
+++ b/security/stunnel/patches/patch-tools_stunnel_conf-sample_in
@@ -22,7 +22,7 @@ Index: tools/stunnel.conf-sample.in
-;output = @localstatedir@/log/stunnel.log
+;output = /stunnel.log
- ; Enable FIPS 140-2 mode if needed for compliance
+ ; Enable FIPS 140-3 mode if needed for compliance
;fips = yes
@@ -46,7 +47,7 @@
; * Include all configuration file fragments from the specified folder *
