summaryrefslogtreecommitdiff
path: root/security
diff options
context:
space:
mode:
authorjym <jym@pkgsrc.org>2016-08-29 19:21:24 +0000
committerjym <jym@pkgsrc.org>2016-08-29 19:21:24 +0000
commitbdf88bca466a7f67db0114169e3fbd727a750296 (patch)
treed80ef56954a124ef46b1e252f4d28c7fb2b69938 /security
parentf43ebaaaafaaa9b513050e5bb49905f88e6c8120 (diff)
downloadpkgsrc-bdf88bca466a7f67db0114169e3fbd727a750296.tar.gz
PR pkg/51449
Update stunnel to 5.35. - Add patch to provide an explicit chroot option to the default configuration sample (option is documented but not found within the default conf file). While here, enable setuid/setgid as stunnel user/group creations are handled by package. - Rework SUBSTs so that they apply to the correct sample config file. Changelog: Version 5.35, 2016.07.18, urgency: HIGH * Bugfixes - Fixed incorrectly enforced client certificate requests. - Only default to SO_EXCLUSIVEADDRUSE on Vista and later. - Fixed thread safety of the configuration file reopening. Version 5.34, 2016.07.05, urgency: HIGH * Security bugfixes - Fixed malfunctioning "verify = 4". * New features - Bind sockets with SO_EXCLUSIVEADDRUSE on WIN32. - Added three new service-level options: requireCert, verifyChain, and verifyPeer for fine-grained certificate verification control. - Improved compatibility with the current OpenSSL 1.1.0-dev tree. Version 5.33, 2016.06.23, urgency: HIGH * New features - Improved memory leak detection performance and accuracy. - Improved compatibility with the current OpenSSL 1.1.0-dev tree. - SNI support also enabled on OpenSSL 0.9.8f and later (thx to Guillermo Rodriguez Garcia). - Added support for PKCS #12 (.p12/.pfx) certificates (thx to Dmitry Bakshaev). * Bugfixes - Fixed a TLS session caching memory leak (thx to Richard Kraemer). Before stunnel 5.27 this leak only emerged with sessiond enabled. - Yet another WinCE socket fix (thx to Richard Kraemer). - Fixed passphrase/pin dialogs in tstunnel.exe. - Fixed a FORK threading build regression bug. - OPENSSL_NO_DH compilation fix (thx to Brian Lin).
Diffstat (limited to 'security')
-rw-r--r--security/stunnel/Makefile21
-rw-r--r--security/stunnel/distinfo11
-rw-r--r--security/stunnel/patches/patch-stunnel.conf-sample.in22
3 files changed, 34 insertions, 20 deletions
diff --git a/security/stunnel/Makefile b/security/stunnel/Makefile
index c8fc92c47ee..7624dea47c9 100644
--- a/security/stunnel/Makefile
+++ b/security/stunnel/Makefile
@@ -1,7 +1,6 @@
-# $NetBSD: Makefile,v 1.103 2016/07/09 06:38:57 wiz Exp $
+# $NetBSD: Makefile,v 1.104 2016/08/29 19:21:24 jym Exp $
-DISTNAME= stunnel-5.32
-PKGREVISION= 1
+DISTNAME= stunnel-5.35
CATEGORIES= security
MASTER_SITES= http://www.stunnel.org/downloads/
@@ -41,19 +40,11 @@ RCD_SCRIPTS= stunnel
REPLACE_PERL+= src/stunnel3.in
USE_TOOLS+= perl:run
-SUBST_CLASSES+= chroot
-SUBST_MESSAGE.chroot= Fix chroot path
-SUBST_STAGE.chroot= pre-configure
-SUBST_FILES.chroot= tools/stunnel.conf-sample.in
-SUBST_SED.chroot+= -e 's|@prefix@/var/lib|@localstatedir@/chroot|'
-
SUBST_CLASSES+= stunnel
-SUBST_MESSAGE.stunnel= Fix user, group and pid
-SUBST_STAGE.stunnel= post-configure
-SUBST_FILES.stunnel= tools/stunnel.conf-sample
-SUBST_SED.stunnel= -e 's|setuid = nobody|setuid = ${STUNNEL_USER}|'
-SUBST_SED.stunnel+= -e 's|setgid = nogroup|setgid = ${STUNNEL_GROUP}|'
-SUBST_SED.stunnel+= -e 's|pid = /stunnel.pid|pid = /pid/stunnel.pid|'
+SUBST_MESSAGE.stunnel= Fix user and group
+SUBST_STAGE.stunnel= pre-configure
+SUBST_FILES.stunnel= tools/stunnel.conf-sample.in
+SUBST_VARS.stunnel= STUNNEL_USER STUNNEL_GROUP
.include "options.mk"
diff --git a/security/stunnel/distinfo b/security/stunnel/distinfo
index f253f54206c..ccfa1887287 100644
--- a/security/stunnel/distinfo
+++ b/security/stunnel/distinfo
@@ -1,8 +1,9 @@
-$NetBSD: distinfo,v 1.50 2016/06/03 23:12:06 jym Exp $
+$NetBSD: distinfo,v 1.51 2016/08/29 19:21:24 jym Exp $
-SHA1 (stunnel-5.32.tar.gz) = 44f64ee0f9c7235a00d33b8338d439dbc519c594
-RMD160 (stunnel-5.32.tar.gz) = 13157bd6b1b32ca87465ff11dcd9bceed424c480
-SHA512 (stunnel-5.32.tar.gz) = aad3b718a727ae23bc88bda027017a5e4e19d2d08c1d4e95087dae20d4ed994d0ce29e9ae4b4d40456a7d7aaeb10c30a4283c6be2965d7183982204a347781bc
-Size (stunnel-5.32.tar.gz) = 641907 bytes
+SHA1 (stunnel-5.35.tar.gz) = 90cafc2208aa3acefb503856482e163e9af463c4
+RMD160 (stunnel-5.35.tar.gz) = 92f7c680e9de49740094a531c5b466aa5ac9d453
+SHA512 (stunnel-5.35.tar.gz) = cdec7ddafbfac4a1d420704baec72fedbd655871137ec8283c066203c0859019c6e11ce00647e5b471a019409e4eb5e9525166eddd7ddffa25055b95c0cacd9e
+Size (stunnel-5.35.tar.gz) = 645148 bytes
SHA1 (patch-aa) = b247aca629197887fb720f7a02d9b73d60bb0d37
SHA1 (patch-ac) = 91b09d39fb968ad76952acdff250150d3e372c36
+SHA1 (patch-stunnel.conf-sample.in) = 86d195963e5ad2db381ac89ae0fca13a7f641fa5
diff --git a/security/stunnel/patches/patch-stunnel.conf-sample.in b/security/stunnel/patches/patch-stunnel.conf-sample.in
new file mode 100644
index 00000000000..37fb34808de
--- /dev/null
+++ b/security/stunnel/patches/patch-stunnel.conf-sample.in
@@ -0,0 +1,22 @@
+$NetBSD: patch-stunnel.conf-sample.in,v 1.1 2016/08/29 19:21:24 jym Exp $
+
+--- tools/stunnel.conf-sample.in.orig 2016-07-05 21:27:57.000000000 +0000
++++ tools/stunnel.conf-sample.in
+@@ -8,11 +8,14 @@
+ ; **************************************************************************
+
+ ; It is recommended to drop root privileges if stunnel is started by root
+-;setuid = nobody
+-;setgid = @DEFAULT_GROUP@
++setuid = @STUNNEL_USER@
++setgid = @STUNNEL_GROUP@
++
++; Default chroot path
++chroot = @localstatedir@/chroot/stunnel/
+
+ ; PID file is created inside the chroot jail (if enabled)
+-;pid = @localstatedir@/run/stunnel.pid
++pid = /pid/stunnel.pid
+
+ ; Debugging stuff (may be useful for troubleshooting)
+ ;foreground = yes