From d49f1069c57d4e150e646e606dbf1bd272684d1d Mon Sep 17 00:00:00 2001 From: Wang Mingyu Date: Wed, 6 Mar 2024 16:43:28 +0800 Subject: stunnel: upgrade 5.69 -> 5.72 fix-openssl-no-des.patch refreshed for 5.72 License-Update: Copyright year updated to 2024. Changelog: =========== * Security bugfixes - OpenSSL DLLs updated to version 3.2.1. - OpenSSL FIPS Provider updated to version 3.0.8. * Bugfixes - Fixed SSL_CTX_new() errors handling. - Fixed OPENSSL_NO_PSK builds. - Android build updated for NDK r23c. - stunnel.nsi updated for Debian 12. - Fixed tests with OpenSSL older than 1.0.2. - Fixed the console output of tstunnel.exe. - Fixed TLS socket EOF handling with OpenSSL 3.x. This bug caused major interoperability issues between stunnel built with OpenSSL 3.x and Microsoft's Schannel Security Support Provider (SSP). - Fixed reading certificate chains from PKCS#12 files. * Features sponsored by SAE IT-systems - OCSP stapling is requested and verified in the client mode. - Using "verifyChain" automatically enables OCSP stapling in the client mode. - OCSP stapling is always available in the server mode. - An inconclusive OCSP verification breaks TLS negotiation. This can be disabled with "OCSPrequire = no". - Added the "TIMEOUTocsp" option to control the maximum time allowed for connecting an OCSP responder. * Features - Added support for Red Hat OpenSSL 3.x patches. - Added configurable delay for the "retry" option. Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj --- .../recipes-support/stunnel/stunnel_5.72.bb | 33 ++++++++++++++++++++++ 1 file changed, 33 insertions(+) create mode 100644 meta-networking/recipes-support/stunnel/stunnel_5.72.bb (limited to 'meta-networking/recipes-support/stunnel/stunnel_5.72.bb') diff --git a/meta-networking/recipes-support/stunnel/stunnel_5.72.bb b/meta-networking/recipes-support/stunnel/stunnel_5.72.bb new file mode 100644 index 000000000..6d21027a1 --- /dev/null +++ b/meta-networking/recipes-support/stunnel/stunnel_5.72.bb @@ -0,0 +1,33 @@ +SUMMARY = "Program for providing universal TLS/SSL tunneling service" +DESCRIPTION = "SSL encryption wrapper between remote client and local (inetd-startable) or remote server." +HOMEPAGE = "https://www.stunnel.org/" +SECTION = "net" +LICENSE = "GPL-2.0-or-later" +LIC_FILES_CHKSUM = "file://COPYING.md;md5=906ac034adaee9d093318e51b53453ca" + +DEPENDS = "autoconf-archive libnsl2 openssl" + +SRC_URI = "https://stunnel.org/archive/5.x/${BP}.tar.gz \ + file://fix-openssl-no-des.patch \ +" + +SRC_URI[sha256sum] = "3d532941281ae353319735144e4adb9ae489a10b7e309c58a48157f08f42e949" + +inherit autotools bash-completion pkgconfig + +PACKAGECONFIG ?= "${@bb.utils.filter('DISTRO_FEATURES', 'ipv6 systemd', d)} libwrap" + +PACKAGECONFIG[ipv6] = "--enable-ipv6,--disable-ipv6," +PACKAGECONFIG[libwrap] = "--enable-libwrap,--disable-libwrap,tcp-wrappers" +PACKAGECONFIG[systemd] = "--enable-systemd,--disable-systemd,systemd" + +EXTRA_OECONF += "--with-ssl='${STAGING_EXECPREFIXDIR}' --disable-fips" + +# When cross compiling, configure defaults to nobody, but provides no option to change it. +EXTRA_OEMAKE += "DEFAULT_GROUP='nogroup'" + +# stunnel3 is a Perl wrapper to allow use of the legacy stunnel 3.x commandline +# syntax with stunnel >= 4.05 +PACKAGES =+ "stunnel3" +FILES:stunnel3 = "${bindir}/stunnel3" +RDEPENDS:stunnel3 += "${PN} perl" -- cgit v1.2.3-54-g00ecf