Re: stunnel 5.38 released

Peter Pentchev <[email protected]>
Newsgroups gmane.network.stunnel.user
Message-ID <[email protected]>
On Sat, Nov 26, 2016 at 11:26:04PM +0100, Michał Trojnara wrote:
> Dear Users,
> 
> I have released version 5.38 of stunnel.

Hi,

Thanks for your continuing work on stunnel!

Unfortunately, 5.38 doesn't compile with OpenSSL 1.1, at least with
the 1.1.0c version in Debian unstable.  It seems that the DH_set0_pqg()
workaround was added with good reason - OpenSSL 1.1 wants us to treat
a DH pointer as a pointer to an opaque structure, it hides the members.

I'll apply the attached patch to the Debian package so that it'll
build - it basically restores get_dh2048() to its 5.37 version.
BTW, if you really want to remove the use of DH_set0_pqg(), it'd
be a bit better to also remove the pre-1.1 implementation from
src/ssl.c and the prototype in common.h.

Thanks again for your time and work!

G'luck,
Peter

-- 
Peter Pentchev  [email protected] [email protected] [email protected]
PGP key:        http://people.FreeBSD.org/~roam/roam.key.asc
Key fingerprint 2EE7 A7A5 17FC 124C F115  C354 651E EFB0 2527 DF13

_______________________________________________
stunnel-users mailing list
[email protected]
https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users
08-dh-openssl-1.1.patch (text/plain, 947 B)
Description: Restore the invocation of DH_set0_pqg().
 It is needed for OpenSSL 1.1.
 .
 This patch actually restores the upstream code introduced in
 stunnel-5.32 and removed in stunnel-5.39.
Forwarded: not-yet
Author: Michal Trojnara <[email protected]>
Last-Update: 2016-11-27

--- a/src/dhparam.c
+++ b/src/dhparam.c
@@ -34,12 +34,18 @@
 		0x02,
 		};
 	DH *dh;
+	BIGNUM *dhp_bn, *dhg_bn;
 
 	if ((dh=DH_new()) == NULL) return(NULL);
-	dh->p=BN_bin2bn(dh2048_p,sizeof(dh2048_p),NULL);
-	dh->g=BN_bin2bn(dh2048_g,sizeof(dh2048_g),NULL);
-	if ((dh->p == NULL) || (dh->g == NULL))
-		{ DH_free(dh); return(NULL); }
+	dhp_bn=BN_bin2bn(dh2048_p,sizeof(dh2048_p),NULL);
+	dhg_bn=BN_bin2bn(dh2048_g,sizeof(dh2048_g),NULL);
+	if ((dhp_bn == NULL) || (dhg_bn == NULL)
+	    || !DH_set0_pqg(dh, dhp_bn, NULL, dhg_bn)) {
+		DH_free(dh);
+		BN_free(dhp_bn);
+		BN_free(dhg_bn);
+		return(NULL);
+	}
 	return(dh);
 	}
 #endif /* OPENSSL_NO_DH */
signature.asc (application/pgp-signature, 833 B)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEELuenpRf8EkzxFcNUZR7vsCUn3xMFAlg6NwEACgkQZR7vsCUn
3xPfExAAr4q0ppvz0rLIHP6K+6Dpa5vD3b1N2GEeWNodGoIObDBMzQL5D+BDjEaO
8ckX3HkGt1mP7ILWQqlPyV+DO7ENRgTfBFuvTgiMJPIC+nRJX8Z/l7Tq7RHoBWfw
FafqUGnSir7qzd+BTB+GXgPCHFPhmNn03//35L80P03agItfp46gyATOkV526mK+
ElCNxSQJJsyvsxurD+ct9NGQxz25KuY7Riz/Qk4rMenhdgF39vTxsdEQ4X7c7kkX
ddDr/7VcqdzmeJdkWJdZWFumoscL8gF7D1NIRzntuIbNyWug2XxUaSZIdwbSbq0I
iKkDBnvyZfTPQz4ElavhDVU7426uMzyBeKhMBiVn+qgyHrmp3cM7r2zt9NPmYkNb
8P9WEhvSnA/jTRnZ6AjyxzU/jkC5WOphWar6KmNhAgtyAcmXelC24jcDOmUkkDeE
p83tFrhzdSmqWV+mi6KTHtNVJWkVuZGcps2yQalTpFoIMe6SFbO2m0B9dtfUj9/O
zCxXlBgbjYwaox9arvle7eMB65pD3eUTNFdqsp2MxhQyKnGVC3E94Vd08tLfifV/
0+QBgtgtoRkE6e0LH7LC/PegPFzIIl+JCYTuEZyulOHbRwpu6w242AipPTFLsqXD
H/mHiQS1kexcefGoC5BPLmq/CqY219ZH2bNXgn900RsBRtiU0Os=
=kSaj
-----END PGP SIGNATURE-----
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.