[pkgsrc/trunk]: pkgsrc/security/stunnel Update stunnel to 5.00.

[jym <jym%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/e93880b65276
branches:  trunk
changeset: 631643:e93880b65276
user:      jym <jym%pkgsrc.org@localhost>
date:      Wed Mar 12 00:24:35 2014 +0000

description:
Update stunnel to 5.00.

Of utmost importance: it fixes CVE 2014-0016.

Thanks to jgw (Jeff W) _AT_ sdf.org for working on the same patch
independently.

In before the freeze! Changelog follows.

    Security bugfixes
        Added PRNG state update in fork threading (CVE-2014-0016).
    New global configuration file defaults
        Default "fips" option value is now "no", as FIPS mode is only helpful for compliance, and never for actual security.
        Default "pid" is now "", i.e. not to create a pid file at startup.
    New service-level configuration file defaults
        Default "ciphers" updated to "HIGH:MEDIUM:+3DES:+DH:!aNULL:!SSLv2" due to AlFBPPS attack and bad performance of DH ciphersuites.
        Default "libwrap" setting is now "no" to improve performance.
    New features
        OpenSSL DLLs updated to version 1.0.1f.
        zlib DLL updated to version 1.2.8.
        autoconf scripts upgraded to version 2.69.
        TLS 1.1 and TLS 1.2 are now allowed in the FIPS mode.
        New service-level option "redirect" to redirect SSL client connections on authentication failures instead of rejecting them.
        New global "engineDefault" configuration file option to control which OpenSSL tasks are delegated to the current engine. Available tasks: ALL, RSA, DSA, ECDH, ECDSA, DH, RAND, CIPHERS, 
DIGESTS, PKEY, PKEY_CRYPTO, PKEY_ASN1.
        New service-level configuration file option "engineId" to select the engine by identifier, e.g. "engineId = capi".
        New global configuration file option "log" to control whether to append (the default), or to overwrite log file while (re)opening.
        Different taskbar icon colors to indicate the service state.
        New global configuration file options "iconIdle", "iconActive", and "iconError" to select status icon on GUI taskbar.
        Removed the limit of 63 stunnel.conf sections on Win32 platform.
        Installation of a sample certificate was moved to a separate "cert" target in order to allow unattended (e.g. scripted) installations.
        Reduced length of the logged thread identifier. It is still based on the OS thread ID, and thus not unique over long periods of time.
        Improved readability of error messages printed when stunnel refuses to start due to a critical error.
    Bugfixes
        LD_PRELOAD Solaris compatibility bug fixed (thx to Norm Jacobs).
        CRYPTO_NUM_LOCKS replaced with CRYPTO_num_locks() to improve binary compatibility with diverse builds of OpenSSL (thx to Norm Jacobs).
        Corrected round-robin failover behavior under heavy load.
        Numerous fixes in the engine support code.
        On Win32 platform .rnd file moved from c:\ to the stunnel folder.

diffstat:

 security/stunnel/Makefile         |   5 ++---
 security/stunnel/distinfo         |  10 +++++-----
 security/stunnel/patches/patch-ac |  14 ++++++--------
 3 files changed, 13 insertions(+), 16 deletions(-)

diffs (54 lines):

diff -r b6413bb6c27c -r e93880b65276 security/stunnel/Makefile
--- a/security/stunnel/Makefile Wed Mar 12 00:14:29 2014 +0000
+++ b/security/stunnel/Makefile Wed Mar 12 00:24:35 2014 +0000
@@ -1,7 +1,6 @@
-# $NetBSD: Makefile,v 1.88 2014/02/12 23:18:37 tron Exp $
+# $NetBSD: Makefile,v 1.89 2014/03/12 00:24:35 jym Exp $
 
-DISTNAME=              stunnel-4.56
-PKGREVISION=           1
+DISTNAME=              stunnel-5.00
 CATEGORIES=            security
 MASTER_SITES=          http://www.stunnel.org/downloads/
 
diff -r b6413bb6c27c -r e93880b65276 security/stunnel/distinfo
--- a/security/stunnel/distinfo Wed Mar 12 00:14:29 2014 +0000
+++ b/security/stunnel/distinfo Wed Mar 12 00:24:35 2014 +0000
@@ -1,7 +1,7 @@
-$NetBSD: distinfo,v 1.38 2014/01/26 16:59:13 tron Exp $
+$NetBSD: distinfo,v 1.39 2014/03/12 00:24:35 jym Exp $
 
-SHA1 (stunnel-4.56.tar.gz) = 0e5e495e05b8d14deadd294166b211f87a667b24
-RMD160 (stunnel-4.56.tar.gz) = 3c49fc88b42b3c33fbbf874bda220ff1d4fa7230
-Size (stunnel-4.56.tar.gz) = 540032 bytes
+SHA1 (stunnel-5.00.tar.gz) = a048e24529e3b4cb787838ea6de5c6475746f197
+RMD160 (stunnel-5.00.tar.gz) = cd5efaec920529e65f5d233254110d5ae605535b
+Size (stunnel-5.00.tar.gz) = 586738 bytes
 SHA1 (patch-aa) = 0e57d4fa383dad7891795073d1f6b5075715b346
-SHA1 (patch-ac) = 43521a88606981bc55dd94043d52b1a16f08e583
+SHA1 (patch-ac) = 63e80322e68efc7e6c5f0bab92e7260178a25109
diff -r b6413bb6c27c -r e93880b65276 security/stunnel/patches/patch-ac
--- a/security/stunnel/patches/patch-ac Wed Mar 12 00:14:29 2014 +0000
+++ b/security/stunnel/patches/patch-ac Wed Mar 12 00:24:35 2014 +0000
@@ -1,15 +1,13 @@
-$NetBSD: patch-ac,v 1.15 2011/11/10 21:01:39 ryoon Exp $
-
-Change pid file location.
+$NetBSD: patch-ac,v 1.16 2014/03/12 00:24:35 jym Exp $
 
---- src/Makefile.in.orig       2011-11-04 20:24:15.000000000 +0000
+--- src/Makefile.in.orig       2014-01-07 20:19:44.000000000 +0000
 +++ src/Makefile.in
-@@ -271,7 +271,7 @@ libstunnel_la_LDFLAGS = -avoid-version
+@@ -310,7 +310,7 @@ libstunnel_la_LDFLAGS = -avoid-version
  
  # Additional preprocesor definitions
  stunnel_CPPFLAGS = -I/usr/kerberos/include -I$(SSLDIR)/include \
--      -DLIBDIR='"$(pkglibdir)"' -DCONFDIR='"$(sysconfdir)/stunnel"' \
-+      -DLIBDIR='"$(pkglibdir)"' -DCONFDIR='"$(sysconfdir)"' \
-       -DPIDFILE='"$(localstatedir)/run/stunnel/stunnel.pid"'
+-      -DLIBDIR='"$(pkglibdir)"' -DCONFDIR='"$(sysconfdir)/stunnel"'
++      -DLIBDIR='"$(pkglibdir)"' -DCONFDIR='"$(sysconfdir)"'
  
  # Win32 executable
+ EXTRA_DIST = make.bat makece.bat makew32.bat mingw.mak evc.mak vc.mak \