Stunnel 5.74 x64

Bugfixes:
Fixed a stapling cache deallocation crash.
Fixed "redirect" with protocol negotiation.
Features:
"protocolHost" support for "socks" protocol clients.
More detailed logs in OpenSSL 3.0 or later.

Security bugfixes:
OpenSSL DLLs updated to version 3.3.2.
OpenSSL FIPS Provider updated to version 3.0.9.
Bugfixes:
Fixed a memory leak while reloading stunnel.conf sections with "client=yes" and "delay=no".
Fixed TIMEOUTocsp with values greater than 4.
Fix the IPv6 test on a non-IPv6 machine.
Features:
HELO replaced with EHLO in the post-STARTTLS SMTP protocol negotiation (thx to Peter Pentchev).
OCSP stapling fetches moved away from server threads.
Improved client-side session resumption.
Added support for the mimalloc allocator.
Check for protocolHost moved to configuration file processing for the client-side CONNECT protocol.
Clarified some confusing OpenSSL's certificate verification error messages.
stunnel.nsi updated for Debian 13 and Fedora.
Improved NetBSD compatibility.

Security bugfixes:
OpenSSL DLLs updated to version 3.1.3.
Bugfixes:
Fixed the console output of tstunnel.exe.
Features sponsored by SAE IT-systems
OCSP stapling is requested and verified in the client mode.
Using "verifyChain" automatically enables OCSP stapling in the client mode.
OCSP stapling is always available in the server mode.
An inconclusive OCSP verification breaks TLS negotiation. This can be disabled with "OCSPrequire = no".
Added the "TIMEOUTocsp" option to control the maximum time allowed for connecting an OCSP responder.
Features:
Added support for Red Hat OpenSSL 3.x patches.

urgency: HIGH

Security bugfixes
OpenSSL DLLs updated to version 3.0.7.
New features
Provided a logging callback to custom engines.
Bugfixes
OpenSSL DLLs updated to version 3.0.6.
Fixed "make cert" with OpenSSL older than 3.0.
Fixed the code and the documentation to use concious language for SNI servers (thx to Clemens Lang).

Security bugfixes
OpenSSL DLLs updated to version 3.0.2.
New features
Updated stunnel.spec to support bash completion
Bugfixes
Fixed an PRNG initialization crash (thx to Gleydson Soares).

New features
Added a bash completion script.
Bugfixes
Fixed a transfer() loop bug.

New features sponsored by the University of Maryland
Added new "protocol = capwin" and "protocol = capwinctrl" configuration file options.
New features for the Windows platform
Added client mode allowing authenticated users to view logs, reconfigure and terminate running stunnel services.
Added support for multiple GUI and service instances distinguised by the location of stunnel.conf.
Improved log window scrolling.
Added a new 'Pause auto-scroll' GUI checkbox.
Double click on the icon tray replaced with single click.
OpenSSL DLLs updated to version 3.0.1.
Other new features
Rewritten the testing framework in python (thx to Peter Pentchev for inspiration and initial framework).
Added support for missing SSL_set_options() values.
Updated stunnel.spec to support RHEL8.
Bugfixes
Fixed OpenSSL 3.0 build.
Fixed reloading configuration with "systemctl reload stunnel.service".
Fixed incorrect messages logged for OpenSSL errors.
Fixed printing IPv6 socket option defaults on FreeBSD.

New features
New 'sessionResume' service-level option to allow or disallow session resumption
Added support for the new SSL_set_options() values.
Download fresh ca-certs.pem for each new release.
Bugfixes
Fixed 'redirect' with 'protocol'. This combination is not supported by 'smtp', 'pop3' and 'imap' protocols.
Enforced minimum WIN32 log window size.
Fixed support for password-protected private keys with OpenSSL 3.0 (thx to Dmitry Belyavskiy).
Added missing TLS options supported in OpenSSL 1.1.1k.

Security bugfixes:
OpenSSL DLLs updated to version 1.1.1k.
New features:
Client-side "protocol = ldap" support (thx to Bart Dopheide and Seth Grover).
Bugfixes:
The test suite fixed not to require external connectivity.
Fixed paths in generated manuals (thx to Tatsuki Makino).
Fixed configuration reload when compression is used.
Fixed compilation with early releases of OpenSSL 1.1.1.

Security bugfixes:
The "redirect" option was fixed to properly handle unauthenticated requests (thx to Martin Stein).
Fixed a double free with OpenSSL older than 1.1.0 (thx to Petr Strukov).
OpenSSL DLLs updated to version 1.1.1j.
New features:
New 'protocolHeader' service-level option to insert custom 'connect' protocol negotiation headers. This feature can be used to impersonate other software (e.g. web browsers).
'protocolHost' can also be used to control the client SMTP protocol negotiation HELO/EHLO value.
Initial FIPS 3.0 support.
Bugfixes:
X.509v3 extensions required by modern versions of OpenSSL are added to generated self-signed test certificates.
Fixed a tiny memory leak in configuration file reload error handling (thx to Richard K?nning).
Merged Debian 05-typos.patch (thx to Peter Pentchev).
Merged with minor changes Debian 06-hup-separate.patch (thx to Peter Pentchev).
Merged Debian 07-imap-capabilities.patch (thx to Ansgar).
Merged Debian 08-addrconfig-workaround.patch (thx to Peter Pentchev).
Fixed tests on the WSL2 platform.
NSIS installer updated to version 3.06 to fix a multiuser installation bug on some platforms, including 64-bit XP.
Fixed engine initialization (thx to Petr Strukov).
FIPS TLS feature is reported when a provider or container is available, and not when FIPS control API is available.

New features
Various text files converted to Markdown format.
Bugfixes
Support for realpath(3) implementations incompatible with POSIX.1-2008, such as 4.4BSD or Solaris.
Support for engines without PRNG seeding methods (thx to Petr Mikhalitsyn).
Retry unsuccessful port binding on configuration file reload.
Thread safety fixes in SSL_SESSION object handling.
Terminate clients on exit in the FORK threading model.

Bugfixes:
Fixed data transfer stalls introduced in stunnel 5.51.
New features:
Android binary updated to support Android 4.x.

New features:
Performance optimizations.
Logging of negotiated or resumed TLS session IDs (thx to ANSSI - National Cybersecurity Agency of France).
Merged Debian 10-enabled.patch and 11-killproc.patch (thx to Peter Pentchev).
OpenSSL DLLs updated to version 1.0.2p.
PKCS#11 engine DLL updated to version 0.4.9.
Bugfixes:
Fixed a crash in the session persistence implementation.
Fixed syslog identifier after configuration file reload.
Fixed non-interactive "make check" invocations.
Fixed reloading syslog configuration.
stunnel.pem created with SHA-256 instead of SHA-1.
SHA-256 "make check" certificates.

New features:
Implemented try-restart in the SysV init script (thx to Peter Pentchev).
Bug fixes:
A service no longer refuses to start if binding fails for some (but not all) addresses:ports.
Fixed compression handling with OpenSSL 1.1.0 and later.
_beginthread() replaced with safer _beginthreadex().