Re: stunnel 5.38 released
Peter Pentchev <[email protected]>
| Newsgroups | gmane.network.stunnel.user |
|---|---|
| Message-ID | <[email protected]> |
On Sat, Nov 26, 2016 at 11:26:04PM +0100, Michał Trojnara wrote: > Dear Users, > > I have released version 5.38 of stunnel. Hi, Thanks for your continuing work on stunnel! Unfortunately, 5.38 doesn't compile with OpenSSL 1.1, at least with the 1.1.0c version in Debian unstable. It seems that the DH_set0_pqg() workaround was added with good reason - OpenSSL 1.1 wants us to treat a DH pointer as a pointer to an opaque structure, it hides the members. I'll apply the attached patch to the Debian package so that it'll build - it basically restores get_dh2048() to its 5.37 version. BTW, if you really want to remove the use of DH_set0_pqg(), it'd be a bit better to also remove the pre-1.1 implementation from src/ssl.c and the prototype in common.h. Thanks again for your time and work! G'luck, Peter -- Peter Pentchev [email protected] [email protected] [email protected] PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13 _______________________________________________ stunnel-users mailing list [email protected] https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users
08-dh-openssl-1.1.patch
(text/plain, 947 B)
Description: Restore the invocation of DH_set0_pqg(). It is needed for OpenSSL 1.1. . This patch actually restores the upstream code introduced in stunnel-5.32 and removed in stunnel-5.39. Forwarded: not-yet Author: Michal Trojnara <[email protected]> Last-Update: 2016-11-27 --- a/src/dhparam.c +++ b/src/dhparam.c @@ -34,12 +34,18 @@ 0x02, }; DH *dh; + BIGNUM *dhp_bn, *dhg_bn; if ((dh=DH_new()) == NULL) return(NULL); - dh->p=BN_bin2bn(dh2048_p,sizeof(dh2048_p),NULL); - dh->g=BN_bin2bn(dh2048_g,sizeof(dh2048_g),NULL); - if ((dh->p == NULL) || (dh->g == NULL)) - { DH_free(dh); return(NULL); } + dhp_bn=BN_bin2bn(dh2048_p,sizeof(dh2048_p),NULL); + dhg_bn=BN_bin2bn(dh2048_g,sizeof(dh2048_g),NULL); + if ((dhp_bn == NULL) || (dhg_bn == NULL) + || !DH_set0_pqg(dh, dhp_bn, NULL, dhg_bn)) { + DH_free(dh); + BN_free(dhp_bn); + BN_free(dhg_bn); + return(NULL); + } return(dh); } #endif /* OPENSSL_NO_DH */
signature.asc
(application/pgp-signature, 833 B)
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEELuenpRf8EkzxFcNUZR7vsCUn3xMFAlg6NwEACgkQZR7vsCUn 3xPfExAAr4q0ppvz0rLIHP6K+6Dpa5vD3b1N2GEeWNodGoIObDBMzQL5D+BDjEaO 8ckX3HkGt1mP7ILWQqlPyV+DO7ENRgTfBFuvTgiMJPIC+nRJX8Z/l7Tq7RHoBWfw FafqUGnSir7qzd+BTB+GXgPCHFPhmNn03//35L80P03agItfp46gyATOkV526mK+ ElCNxSQJJsyvsxurD+ct9NGQxz25KuY7Riz/Qk4rMenhdgF39vTxsdEQ4X7c7kkX ddDr/7VcqdzmeJdkWJdZWFumoscL8gF7D1NIRzntuIbNyWug2XxUaSZIdwbSbq0I iKkDBnvyZfTPQz4ElavhDVU7426uMzyBeKhMBiVn+qgyHrmp3cM7r2zt9NPmYkNb 8P9WEhvSnA/jTRnZ6AjyxzU/jkC5WOphWar6KmNhAgtyAcmXelC24jcDOmUkkDeE p83tFrhzdSmqWV+mi6KTHtNVJWkVuZGcps2yQalTpFoIMe6SFbO2m0B9dtfUj9/O zCxXlBgbjYwaox9arvle7eMB65pD3eUTNFdqsp2MxhQyKnGVC3E94Vd08tLfifV/ 0+QBgtgtoRkE6e0LH7LC/PegPFzIIl+JCYTuEZyulOHbRwpu6w242AipPTFLsqXD H/mHiQS1kexcefGoC5BPLmq/CqY219ZH2bNXgn900RsBRtiU0Os= =kSaj -----END PGP SIGNATURE-----