Stunnel v5.59

Security bugfixes:
OpenSSL DLLs updated to version 1.1.1k.
New features:
Client-side "protocol = ldap" support (thx to Bart Dopheide and Seth Grover).
Bugfixes:
The test suite fixed not to require external connectivity.
Fixed paths in generated manuals (thx to Tatsuki Makino).
Fixed configuration reload when compression is used.
Fixed compilation with early releases of OpenSSL 1.1.1.

Security bugfixes:
The "redirect" option was fixed to properly handle unauthenticated requests (thx to Martin Stein).
Fixed a double free with OpenSSL older than 1.1.0 (thx to Petr Strukov).
OpenSSL DLLs updated to version 1.1.1j.
New features:
New 'protocolHeader' service-level option to insert custom 'connect' protocol negotiation headers. This feature can be used to impersonate other software (e.g. web browsers).
'protocolHost' can also be used to control the client SMTP protocol negotiation HELO/EHLO value.
Initial FIPS 3.0 support.
Bugfixes:
X.509v3 extensions required by modern versions of OpenSSL are added to generated self-signed test certificates.
Fixed a tiny memory leak in configuration file reload error handling (thx to Richard K?nning).
Merged Debian 05-typos.patch (thx to Peter Pentchev).
Merged with minor changes Debian 06-hup-separate.patch (thx to Peter Pentchev).
Merged Debian 07-imap-capabilities.patch (thx to Ansgar).
Merged Debian 08-addrconfig-workaround.patch (thx to Peter Pentchev).
Fixed tests on the WSL2 platform.
NSIS installer updated to version 3.06 to fix a multiuser installation bug on some platforms, including 64-bit XP.
Fixed engine initialization (thx to Petr Strukov).
FIPS TLS feature is reported when a provider or container is available, and not when FIPS control API is available.

New features
Various text files converted to Markdown format.
Bugfixes
Support for realpath(3) implementations incompatible with POSIX.1-2008, such as 4.4BSD or Solaris.
Support for engines without PRNG seeding methods (thx to Petr Mikhalitsyn).
Retry unsuccessful port binding on configuration file reload.
Thread safety fixes in SSL_SESSION object handling.
Terminate clients on exit in the FORK threading model.

Bugfixes:
Fixed data transfer stalls introduced in stunnel 5.51.
New features:
Android binary updated to support Android 4.x.

New features:
Performance optimizations.
Logging of negotiated or resumed TLS session IDs (thx to ANSSI - National Cybersecurity Agency of France).
Merged Debian 10-enabled.patch and 11-killproc.patch (thx to Peter Pentchev).
OpenSSL DLLs updated to version 1.0.2p.
PKCS#11 engine DLL updated to version 0.4.9.
Bugfixes:
Fixed a crash in the session persistence implementation.
Fixed syslog identifier after configuration file reload.
Fixed non-interactive "make check" invocations.
Fixed reloading syslog configuration.
stunnel.pem created with SHA-256 instead of SHA-1.
SHA-256 "make check" certificates.

New features:
Implemented try-restart in the SysV init script (thx to Peter Pentchev).
Bug fixes:
A service no longer refuses to start if binding fails for some (but not all) addresses:ports.
Fixed compression handling with OpenSSL 1.1.0 and later.
_beginthread() replaced with safer _beginthreadex().

New features:
Signed Win32 executables, libraries, and installer.
Bugfixes:
Default accept address restored to INADDR_ANY.
Fixed a race condition in "make check".
Fixed removing the pid file after configuration reload.

New features:
OpenSSL DLLs updated to version 1.0.2m.
Android build updated to OpenSSL 1.1.0g.
Allow for multiple "accept" ports per section.
Self-test framework (make check).
Added config load before OpenSSL init (thx to Dmitrii Pichulin).
OpenSSL 1.1.0 support for Travis CI.
OpenSSL 1.1.1-dev compilation fixes.
Bugfixes:
Fixed a memory fault on Solaris.
Fixed round-robin failover in the FORK threading model.
Fixed handling SSL_ERROR_ZERO_RETURN in SSL_shutdown().
Minor fixes of the logging subsystem.

New features:
"redirect" also supports "exec" and not only "connect".
PKCS#11 engine DLL updated to version 0.4.7.
Bug fixes:
Fixed premature cron thread initialization causing hangs.
Fixed "verifyPeer = yes" on OpenSSL <= 1.0.1.
Fixed pthreads support on OpenSolaris.

New features
PKCS#11 engine DLL updated to version 0.4.5.
Default engine UI set with ENGINE_CTRL_SET_USER_INTERFACE.
Key file name added into the passphrase console prompt.
Performance optimization in memory leak detection.
Bugfixes
Fixed crashes with the OpenSSL 1.1.0 branch.
Fixed certificate verification with "verifyPeer = yes" and "verifyChain = no" (the default), while the peer only returns a single certificate.

Security bugfixes
OpenSSL DLLs updated to version 1.0.2k. https://www.openssl.org/news/secadv/20170126.txt
New features
DH ciphersuites are now disabled by default.
The daily server DH parameter regeneration is only performed if DH ciphersuites are enabled in the configuration file.
"checkHost" and "checkEmail" were modified to require either "verifyChain" or "verifyPeer" (thx to Ma?orzata Olsz?wka).
Bugfixes
Fixed setting default ciphers.

New features:
PKCS#11 engine (pkcs11.dll) added to the Win32 build.
Per-destination TLS session cache added for the client mode.
The new "logId" parameter "process" added to log PID values.
Added support for the new SSL_set_options() values.
Updated the manual page.
Obsolete references to "SSL" replaced with "TLS".
Bugfixes:
Fixed "logId" parameter to also work in inetd mode.
"delay = yes" properly enforces "failover = prio".
Fixed fd_set allocation size on Win64.
Fixed reloading invalid configuration file on Win32.
Fixed resolving addresses with unconfigured network interfaces.

Bugfixes
OpenSSL DLLs updated to version 1.0.2j (stops crashes).
The default SNI target (not handled by any slave service) is handled by the master service rather than rejected.
Removed thread synchronization in the FORK threading model.

New features:
Removed direct zlib dependency.
Added support for OpenSSL 1.1.0-dev built with "no-deprecated".
Bugfixes

Таким образом вы сможете шифровать любой трафик..

Security bugfixes
• Fixed malfunctioning "verify = 4".
New features
• Bind sockets with SO_EXCLUSIVEADDRUSE on WIN32.
• Added three new service-level options: requireCert, verifyChain, and • verifyPeer for fine-grained certificate verification control.
• Improved compatibility with the current OpenSSL 1.1.0-dev tree.

Security bugfixes
OpenSSL DLLs updated to version 1.0.2h. https://www.openssl.org/news/secadv_20160503.txt
New features
New "socket = a:IPV6_V6ONLY=yes" option to only bind IPv6.
Memory leak detection.
Improved compatibility with the current OpenSSL 1.1.0-dev tree.
Added/fixed Red Hat scripts (thx to Andrew Colin Kissa).
Bugfixes
Workaround for a WinCE sockets quirk (thx to Richard Kraemer).
Fixed data alignment on 64-bit MSVC (thx to Yuris W. Auzins).

New features

New "socket = a:IPV6_V6ONLY=yes" option to only bind IPv6.
Improved compatibility with the current OpenSSL 1.1.0-dev tree.

Bugfixes

Fixed data alignment on 64-bit MSVC (thx to Yuris W. Auzins).

Security bug fixes:
OpenSSL DLLs updated to version 1.0.2g.
New features:
Added logging the list of client CAs requested by the server.
Improved compatibility with the current OpenSSL 1.1.0-dev tree.
Bug fixes:
Only reset the watchdog if some data was actually transferred.
A workaround implemented for the unexpected exceptfds set by select() on WinCE 6.0