Imported Upstream version 5.44

.travis.yml

@@ -19,9 +19,16 @@ env:
 addons:
   apt:
     packages:
+    - autoconf-archive
     - libssl-dev
     - libwrap0-dev
+    - nmap
 
-before_script: autoreconf -fvi && touch src/dhparam.c
+before_script:
+  - if [ "$TRAVIS_OS_NAME" == "osx" ]; then brew update; brew install autoconf-archive nmap; fi; true
+  - autoreconf -fvi && touch src/dhparam.c
 
-script: ./configure $CONFIGURE_OPTIONS && make && make test
+script:
+  - ./configure $CONFIGURE_OPTIONS
+  - make
+  - make test || ( for FILE in tests/logs/*.log; do echo "*** $FILE ***"; cat "$FILE"; done; false )

ChangeLog

@@ -1,5 +1,28 @@
 stunnel change log
 
+Version 5.44, 2017.11.26, urgency: MEDIUM
+* New features
+  - Signed Win32 executables, libraries, and installer.
+* Bugfixes
+  - Default accept address restored to INADDR_ANY.
+  - Fixed a race condition in "make check".
+  - Fixed removing the pid file after configuration reload.
+
+Version 5.43, 2017.11.05, urgency: LOW
+* New features
+  - OpenSSL DLLs updated to version 1.0.2m.
+  - Android build updated to OpenSSL 1.1.0g.
+  - Allow for multiple "accept" ports per section.
+  - Self-test framework (make check).
+  - Added config load before OpenSSL init (thx to Dmitrii Pichulin).
+  - OpenSSL 1.1.0 support for Travis CI.
+  - OpenSSL 1.1.1-dev compilation fixes.
+* Bugfixes
+  - Fixed a memory fault on Solaris.
+  - Fixed round-robin failover in the FORK threading model.
+  - Fixed handling SSL_ERROR_ZERO_RETURN in SSL_shutdown().
+  - Minor fixes of the logging subsystem.
+
 Version 5.42, 2017.07.16, urgency: HIGH
 * New features
   - "redirect" also supports "exec" and not only "connect".

Makefile.am

@@ -3,7 +3,7 @@
 
 ACLOCAL_AMFLAGS = -I m4
 
-SUBDIRS = src doc tools
+SUBDIRS = src doc tools tests
 
 LIBTOOL_DEPS = @LIBTOOL_DEPS@
 libtool: $(LIBTOOL_DEPS)
@@ -41,9 +41,7 @@ sign: dist
 cert:
 	$(MAKE) -C tools cert
 
-test:
+test: check
-	$(abs_builddir)/src/stunnel -version
-	@echo "No tests are currently implemented"
 
 install-data-hook:
 	@echo "*********************************************************"

Makefile.in

@@ -1,7 +1,7 @@
-# Makefile.in generated by automake 1.14.1 from Makefile.am.
+# Makefile.in generated by automake 1.15 from Makefile.am.
 # @configure_input@
 
-# Copyright (C) 1994-2013 Free Software Foundation, Inc.
+# Copyright (C) 1994-2014 Free Software Foundation, Inc.
 
 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -17,7 +17,17 @@
 # by Michal Trojnara 2015-2017
 
 VPATH = @srcdir@
-am__is_gnu_make = test -n '$(MAKEFILE_LIST)' && test -n '$(MAKELEVEL)'
+am__is_gnu_make = { \
+  if test -z '$(MAKELEVEL)'; then \
+    false; \
+  elif test -n '$(MAKE_HOST)'; then \
+    true; \
+  elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
+    true; \
+  else \
+    false; \
+  fi; \
+}
 am__make_running_with_option = \
   case $${target_option-} in \
       ?) ;; \
@@ -81,14 +91,6 @@ POST_UNINSTALL = :
 build_triplet = @build@
 host_triplet = @host@
 subdir = .
-DIST_COMMON = INSTALL NEWS README AUTHORS ChangeLog \
-	$(srcdir)/Makefile.in $(srcdir)/Makefile.am \
-	$(top_srcdir)/configure $(am__configure_deps) COPYING TODO \
-	auto/compile auto/config.guess auto/config.sub auto/depcomp \
-	auto/install-sh auto/missing auto/ltmain.sh \
-	$(top_srcdir)/auto/compile $(top_srcdir)/auto/config.guess \
-	$(top_srcdir)/auto/config.sub $(top_srcdir)/auto/install-sh \
-	$(top_srcdir)/auto/ltmain.sh $(top_srcdir)/auto/missing
 ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
 am__aclocal_m4_deps = $(top_srcdir)/m4/libtool.m4 \
 	$(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \
@@ -96,6 +98,8 @@ am__aclocal_m4_deps = $(top_srcdir)/m4/libtool.m4 \
 	$(top_srcdir)/configure.ac
 am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
 	$(ACLOCAL_M4)
+DIST_COMMON = $(srcdir)/Makefile.am $(top_srcdir)/configure \
+	$(am__configure_deps) $(am__DIST_COMMON)
 am__CONFIG_DISTCLEAN_FILES = config.status config.cache config.log \
  configure.lineno config.status.lineno
 mkinstalldirs = $(install_sh) -d
@@ -187,6 +191,13 @@ ETAGS = etags
 CTAGS = ctags
 CSCOPE = cscope
 DIST_SUBDIRS = $(SUBDIRS)
+am__DIST_COMMON = $(srcdir)/Makefile.in $(top_srcdir)/auto/compile \
+	$(top_srcdir)/auto/config.guess $(top_srcdir)/auto/config.sub \
+	$(top_srcdir)/auto/install-sh $(top_srcdir)/auto/ltmain.sh \
+	$(top_srcdir)/auto/missing AUTHORS COPYING ChangeLog INSTALL \
+	NEWS README TODO auto/compile auto/config.guess \
+	auto/config.sub auto/depcomp auto/install-sh auto/ltmain.sh \
+	auto/missing
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
 distdir = $(PACKAGE)-$(VERSION)
 top_distdir = $(distdir)
@@ -269,6 +280,7 @@ LIBTOOL_DEPS = @LIBTOOL_DEPS@
 LIPO = @LIPO@
 LN_S = @LN_S@
 LTLIBOBJS = @LTLIBOBJS@
+LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
 MAKEINFO = @MAKEINFO@
 MANIFEST_TOOL = @MANIFEST_TOOL@
 MKDIR_P = @MKDIR_P@
@@ -352,7 +364,7 @@ top_build_prefix = @top_build_prefix@
 top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
 ACLOCAL_AMFLAGS = -I m4
-SUBDIRS = src doc tools
+SUBDIRS = src doc tools tests
 EXTRA_DIST = PORTS BUGS COPYRIGHT.GPL CREDITS INSTALL.W32 INSTALL.WCE \
 	INSTALL.FIPS build-android.sh .travis.yml
 doc_DATA = INSTALL README TODO COPYING AUTHORS ChangeLog PORTS BUGS \
@@ -380,7 +392,6 @@ $(srcdir)/Makefile.in:  $(srcdir)/Makefile.am  $(am__configure_deps)
 	echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu Makefile'; \
 	$(am__cd) $(top_srcdir) && \
 	  $(AUTOMAKE) --gnu Makefile
-.PRECIOUS: Makefile
 Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
 	@case '$?' in \
 	  *config.status*) \
@@ -617,15 +628,15 @@ dist-xz: distdir
 	$(am__post_remove_distdir)
 
 dist-tarZ: distdir
-	@echo WARNING: "Support for shar distribution archives is" \
+	@echo WARNING: "Support for distribution archives compressed with" \
-	               "deprecated." >&2
+		       "legacy program 'compress' is deprecated." >&2
 	@echo WARNING: "It will be removed altogether in Automake 2.0" >&2
 	tardir=$(distdir) && $(am__tar) | compress -c >$(distdir).tar.Z
 	$(am__post_remove_distdir)
 
 dist-shar: distdir
-	@echo WARNING: "Support for distribution archives compressed with" \
+	@echo WARNING: "Support for shar distribution archives is" \
-		       "legacy program 'compress' is deprecated." >&2
+	               "deprecated." >&2
 	@echo WARNING: "It will be removed altogether in Automake 2.0" >&2
 	shar $(distdir) | GZIP=$(GZIP_ENV) gzip -c >$(distdir).shar.gz
 	$(am__post_remove_distdir)
@@ -661,17 +672,17 @@ distcheck: dist
 	esac
 	chmod -R a-w $(distdir)
 	chmod u+w $(distdir)
-	mkdir $(distdir)/_build $(distdir)/_inst
+	mkdir $(distdir)/_build $(distdir)/_build/sub $(distdir)/_inst
 	chmod a-w $(distdir)
 	test -d $(distdir)/_build || exit 0; \
 	dc_install_base=`$(am__cd) $(distdir)/_inst && pwd | sed -e 's,^[^:\\/]:[\\/],/,'` \
 	  && dc_destdir="$${TMPDIR-/tmp}/am-dc-$$$$/" \
 	  && am__cwd=`pwd` \
-	  && $(am__cd) $(distdir)/_build \
+	  && $(am__cd) $(distdir)/_build/sub \
-	  && ../configure \
+	  && ../../configure \
 	    $(AM_DISTCHECK_CONFIGURE_FLAGS) \
 	    $(DISTCHECK_CONFIGURE_FLAGS) \
-	    --srcdir=.. --prefix="$$dc_install_base" \
+	    --srcdir=../.. --prefix="$$dc_install_base" \
 	  && $(MAKE) $(AM_MAKEFLAGS) \
 	  && $(MAKE) $(AM_MAKEFLAGS) dvi \
 	  && $(MAKE) $(AM_MAKEFLAGS) check \
@@ -853,6 +864,8 @@ uninstall-am: uninstall-docDATA
 	mostlyclean mostlyclean-generic mostlyclean-libtool pdf pdf-am \
 	ps ps-am tags tags-am uninstall uninstall-am uninstall-docDATA
 
+.PRECIOUS: Makefile
+
 libtool: $(LIBTOOL_DEPS)
 	$(SHELL) ./config.status libtool
 
@@ -877,9 +890,7 @@ sign: dist
 cert:
 	$(MAKE) -C tools cert
 
-test:
+test: check
-	$(abs_builddir)/src/stunnel -version
-	@echo "No tests are currently implemented"
 
 install-data-hook:
 	@echo "*********************************************************"

aclocal.m4

@@ -1,6 +1,6 @@
-# generated automatically by aclocal 1.14.1 -*- Autoconf -*-
+# generated automatically by aclocal 1.15 -*- Autoconf -*-
 
-# Copyright (C) 1996-2013 Free Software Foundation, Inc.
+# Copyright (C) 1996-2014 Free Software Foundation, Inc.
 
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -26,7 +26,7 @@ To do so, use the procedure documented by the package, typically 'autoreconf'.])
 #
 # SYNOPSIS
 #
-#   AX_APPEND_COMPILE_FLAGS([FLAG1 FLAG2 ...], [FLAGS-VARIABLE], [EXTRA-FLAGS])
+#   AX_APPEND_COMPILE_FLAGS([FLAG1 FLAG2 ...], [FLAGS-VARIABLE], [EXTRA-FLAGS], [INPUT])
 #
 # DESCRIPTION
 #
@@ -42,6 +42,8 @@ To do so, use the procedure documented by the package, typically 'autoreconf'.])
 #   the flags: "CFLAGS EXTRA-FLAGS FLAG".  This can for example be used to
 #   force the compiler to issue an error when a bad flag is given.
 #
+#   INPUT gives an alternative input source to AC_COMPILE_IFELSE.
+#
 #   NOTE: This macro depends on the AX_APPEND_FLAG and
 #   AX_CHECK_COMPILE_FLAG. Please keep this macro in sync with
 #   AX_APPEND_LINK_FLAGS.
@@ -76,13 +78,13 @@ To do so, use the procedure documented by the package, typically 'autoreconf'.])
 #   modified version of the Autoconf Macro, you may extend this special
 #   exception to the GPL to apply to your modified version as well.
 
-#serial 4
+#serial 5
 
 AC_DEFUN([AX_APPEND_COMPILE_FLAGS],
 [AX_REQUIRE_DEFINED([AX_CHECK_COMPILE_FLAG])
 AX_REQUIRE_DEFINED([AX_APPEND_FLAG])
 for flag in $1; do
-  AX_CHECK_COMPILE_FLAG([$flag], [AX_APPEND_FLAG([$flag], [$2])], [], [$3])
+  AX_CHECK_COMPILE_FLAG([$flag], [AX_APPEND_FLAG([$flag], [$2])], [], [$3], [$4])
 done
 ])dnl AX_APPEND_COMPILE_FLAGS
 
@@ -137,22 +139,24 @@ done
 #   modified version of the Autoconf Macro, you may extend this special
 #   exception to the GPL to apply to your modified version as well.
 
-#serial 2
+#serial 6
 
 AC_DEFUN([AX_APPEND_FLAG],
-[AC_PREREQ(2.59)dnl for _AC_LANG_PREFIX
+[dnl
-AS_VAR_PUSHDEF([FLAGS], [m4_default($2,_AC_LANG_PREFIX[FLAGS])])dnl
+AC_PREREQ(2.64)dnl for _AC_LANG_PREFIX and AS_VAR_SET_IF
-AS_VAR_SET_IF(FLAGS,
+AS_VAR_PUSHDEF([FLAGS], [m4_default($2,_AC_LANG_PREFIX[FLAGS])])
-  [case " AS_VAR_GET(FLAGS) " in
+AS_VAR_SET_IF(FLAGS,[
-    *" $1 "*)
+  AS_CASE([" AS_VAR_GET(FLAGS) "],
-      AC_RUN_LOG([: FLAGS already contains $1])
+    [*" $1 "*], [AC_RUN_LOG([: FLAGS already contains $1])],
-      ;;
+    [
-    *)
+     AS_VAR_APPEND(FLAGS,[" $1"])
-      AC_RUN_LOG([: FLAGS="$FLAGS $1"])
+     AC_RUN_LOG([: FLAGS="$FLAGS"])
-      AS_VAR_SET(FLAGS, ["AS_VAR_GET(FLAGS) $1"])
+    ])
-      ;;
+  ],
-   esac],
+  [
-  [AS_VAR_SET(FLAGS,["$1"])])
+  AS_VAR_SET(FLAGS,[$1])
+  AC_RUN_LOG([: FLAGS="$FLAGS"])
+  ])
 AS_VAR_POPDEF([FLAGS])dnl
 ])dnl AX_APPEND_FLAG
 
@@ -162,7 +166,7 @@ AS_VAR_POPDEF([FLAGS])dnl
 #
 # SYNOPSIS
 #
-#   AX_APPEND_LINK_FLAGS([FLAG1 FLAG2 ...], [FLAGS-VARIABLE], [EXTRA-FLAGS])
+#   AX_APPEND_LINK_FLAGS([FLAG1 FLAG2 ...], [FLAGS-VARIABLE], [EXTRA-FLAGS], [INPUT])
 #
 # DESCRIPTION
 #
@@ -177,6 +181,8 @@ AS_VAR_POPDEF([FLAGS])dnl
 #   EXTRA-FLAGS FLAG".  This can for example be used to force the linker to
 #   issue an error when a bad flag is given.
 #
+#   INPUT gives an alternative input source to AC_COMPILE_IFELSE.
+#
 #   NOTE: This macro depends on the AX_APPEND_FLAG and AX_CHECK_LINK_FLAG.
 #   Please keep this macro in sync with AX_APPEND_COMPILE_FLAGS.
 #
@@ -210,13 +216,13 @@ AS_VAR_POPDEF([FLAGS])dnl
 #   modified version of the Autoconf Macro, you may extend this special
 #   exception to the GPL to apply to your modified version as well.
 
-#serial 4
+#serial 5
 
 AC_DEFUN([AX_APPEND_LINK_FLAGS],
 [AX_REQUIRE_DEFINED([AX_CHECK_LINK_FLAG])
 AX_REQUIRE_DEFINED([AX_APPEND_FLAG])
 for flag in $1; do
-  AX_CHECK_LINK_FLAG([$flag], [AX_APPEND_FLAG([$flag], [m4_default([$2], [LDFLAGS])])], [], [$3])
+  AX_CHECK_LINK_FLAG([$flag], [AX_APPEND_FLAG([$flag], [m4_default([$2], [LDFLAGS])])], [], [$3], [$4])
 done
 ])dnl AX_APPEND_LINK_FLAGS
 
@@ -277,10 +283,10 @@ done
 #   modified version of the Autoconf Macro, you may extend this special
 #   exception to the GPL to apply to your modified version as well.
 
-#serial 3
+#serial 4
 
 AC_DEFUN([AX_CHECK_COMPILE_FLAG],
-[AC_PREREQ(2.59)dnl for _AC_LANG_PREFIX
+[AC_PREREQ(2.64)dnl for _AC_LANG_PREFIX and AS_VAR_IF
 AS_VAR_PUSHDEF([CACHEVAR],[ax_cv_check_[]_AC_LANG_ABBREV[]flags_$4_$1])dnl
 AC_CACHE_CHECK([whether _AC_LANG compiler accepts $1], CACHEVAR, [
   ax_check_save_flags=$[]_AC_LANG_PREFIX[]FLAGS
@@ -289,7 +295,7 @@ AC_CACHE_CHECK([whether _AC_LANG compiler accepts $1], CACHEVAR, [
     [AS_VAR_SET(CACHEVAR,[yes])],
     [AS_VAR_SET(CACHEVAR,[no])])
   _AC_LANG_PREFIX[]FLAGS=$ax_check_save_flags])
-AS_IF([test x"AS_VAR_GET(CACHEVAR)" = xyes],
+AS_VAR_IF(CACHEVAR,yes,
   [m4_default([$2], :)],
   [m4_default([$3], :)])
 AS_VAR_POPDEF([CACHEVAR])dnl
@@ -352,10 +358,11 @@ AS_VAR_POPDEF([CACHEVAR])dnl
 #   modified version of the Autoconf Macro, you may extend this special
 #   exception to the GPL to apply to your modified version as well.
 
-#serial 3
+#serial 4
 
 AC_DEFUN([AX_CHECK_LINK_FLAG],
-[AS_VAR_PUSHDEF([CACHEVAR],[ax_cv_check_ldflags_$4_$1])dnl
+[AC_PREREQ(2.64)dnl for _AC_LANG_PREFIX and AS_VAR_IF
+AS_VAR_PUSHDEF([CACHEVAR],[ax_cv_check_ldflags_$4_$1])dnl
 AC_CACHE_CHECK([whether the linker accepts $1], CACHEVAR, [
   ax_check_save_flags=$LDFLAGS
   LDFLAGS="$LDFLAGS $4 $1"
@@ -363,7 +370,7 @@ AC_CACHE_CHECK([whether the linker accepts $1], CACHEVAR, [
     [AS_VAR_SET(CACHEVAR,[yes])],
     [AS_VAR_SET(CACHEVAR,[no])])
   LDFLAGS=$ax_check_save_flags])
-AS_IF([test x"AS_VAR_GET(CACHEVAR)" = xyes],
+AS_VAR_IF(CACHEVAR,yes,
   [m4_default([$2], :)],
   [m4_default([$3], :)])
 AS_VAR_POPDEF([CACHEVAR])dnl
@@ -390,10 +397,10 @@ AS_VAR_POPDEF([CACHEVAR])dnl
 #   is necessary on AIX to use the special cc_r compiler alias.)
 #
 #   NOTE: You are assumed to not only compile your program with these flags,
-#   but also link it with them as well. e.g. you should link with
+#   but also to link with them as well. For example, you might link with
 #   $PTHREAD_CC $CFLAGS $PTHREAD_CFLAGS $LDFLAGS ... $PTHREAD_LIBS $LIBS
 #
-#   If you are only building threads programs, you may wish to use these
+#   If you are only building threaded programs, you may wish to use these
 #   variables in your default LIBS, CFLAGS, and CC:
 #
 #     LIBS="$PTHREAD_LIBS $LIBS"
@@ -401,8 +408,8 @@ AS_VAR_POPDEF([CACHEVAR])dnl
 #     CC="$PTHREAD_CC"
 #
 #   In addition, if the PTHREAD_CREATE_JOINABLE thread-attribute constant
-#   has a nonstandard name, defines PTHREAD_CREATE_JOINABLE to that name
+#   has a nonstandard name, this macro defines PTHREAD_CREATE_JOINABLE to
-#   (e.g. PTHREAD_CREATE_UNDETACHED on AIX).
+#   that name (e.g. PTHREAD_CREATE_UNDETACHED on AIX).
 #
 #   Also HAVE_PTHREAD_PRIO_INHERIT is defined if pthread is found and the
 #   PTHREAD_PRIO_INHERIT symbol is defined when compiling with
@@ -453,35 +460,40 @@ AS_VAR_POPDEF([CACHEVAR])dnl
 #   modified version of the Autoconf Macro, you may extend this special
 #   exception to the GPL to apply to your modified version as well.
 
-#serial 21
+#serial 23
 
 AU_ALIAS([ACX_PTHREAD], [AX_PTHREAD])
 AC_DEFUN([AX_PTHREAD], [
 AC_REQUIRE([AC_CANONICAL_HOST])
+AC_REQUIRE([AC_PROG_CC])
+AC_REQUIRE([AC_PROG_SED])
 AC_LANG_PUSH([C])
 ax_pthread_ok=no
 
 # We used to check for pthread.h first, but this fails if pthread.h
-# requires special compiler flags (e.g. on True64 or Sequent).
+# requires special compiler flags (e.g. on Tru64 or Sequent).
 # It gets checked for in the link test anyway.
 
 # First of all, check if the user has set any of the PTHREAD_LIBS,
 # etcetera environment variables, and if threads linking works using
 # them:
-if test x"$PTHREAD_LIBS$PTHREAD_CFLAGS" != x; then
+if test "x$PTHREAD_CFLAGS$PTHREAD_LIBS" != "x"; then
-        save_CFLAGS="$CFLAGS"
+        ax_pthread_save_CC="$CC"
+        ax_pthread_save_CFLAGS="$CFLAGS"
+        ax_pthread_save_LIBS="$LIBS"
+        AS_IF([test "x$PTHREAD_CC" != "x"], [CC="$PTHREAD_CC"])
         CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
-        save_LIBS="$LIBS"
         LIBS="$PTHREAD_LIBS $LIBS"
-        AC_MSG_CHECKING([for pthread_join in LIBS=$PTHREAD_LIBS with CFLAGS=$PTHREAD_CFLAGS])
+        AC_MSG_CHECKING([for pthread_join using $CC $PTHREAD_CFLAGS $PTHREAD_LIBS])
-        AC_TRY_LINK_FUNC([pthread_join], [ax_pthread_ok=yes])
+        AC_LINK_IFELSE([AC_LANG_CALL([], [pthread_join])], [ax_pthread_ok=yes])
         AC_MSG_RESULT([$ax_pthread_ok])
-        if test x"$ax_pthread_ok" = xno; then
+        if test "x$ax_pthread_ok" = "xno"; then
                 PTHREAD_LIBS=""
                 PTHREAD_CFLAGS=""
         fi
-        LIBS="$save_LIBS"
+        CC="$ax_pthread_save_CC"
-        CFLAGS="$save_CFLAGS"
+        CFLAGS="$ax_pthread_save_CFLAGS"
+        LIBS="$ax_pthread_save_LIBS"
 fi
 
 # We must check for the threads library under a number of different
@@ -494,7 +506,7 @@ fi
 # which indicates that we try without any flags at all, and "pthread-config"
 # which is a program returning the flags for the Pth emulation library.
 
-ax_pthread_flags="pthreads none -Kthread -kthread lthread -pthread -pthreads -mthreads pthread --thread-safe -mt pthread-config"
+ax_pthread_flags="pthreads none -Kthread -pthread -pthreads -mthreads pthread --thread-safe -mt pthread-config"
 
 # The ordering *is* (sometimes) important.  Some notes on the
 # individual items follow:
@@ -503,82 +515,225 @@ ax_pthread_flags="pthreads none -Kthread -kthread lthread -pthread -pthreads -mt
 # none: in case threads are in libc; should be tried before -Kthread and
 #       other compiler flags to prevent continual compiler warnings
 # -Kthread: Sequent (threads in libc, but -Kthread needed for pthread.h)
-# -kthread: FreeBSD kernel threads (preferred to -pthread since SMP-able)
+# -pthread: Linux/gcc (kernel threads), BSD/gcc (userland threads), Tru64
-# lthread: LinuxThreads port on FreeBSD (also preferred to -pthread)
+#           (Note: HP C rejects this with "bad form for `-t' option")
-# -pthread: Linux/gcc (kernel threads), BSD/gcc (userland threads)
+# -pthreads: Solaris/gcc (Note: HP C also rejects)
-# -pthreads: Solaris/gcc
-# -mthreads: Mingw32/gcc, Lynx/gcc
 # -mt: Sun Workshop C (may only link SunOS threads [-lthread], but it
-#      doesn't hurt to check since this sometimes defines pthreads too;
+#      doesn't hurt to check since this sometimes defines pthreads and
-#      also defines -D_REENTRANT)
+#      -D_REENTRANT too), HP C (must be checked before -lpthread, which
-#      ... -mt is also the pthreads flag for HP/aCC
+#      is present but should not be used directly; and before -mthreads,
+#      because the compiler interprets this as "-mt" + "-hreads")
+# -mthreads: Mingw32/gcc, Lynx/gcc
 # pthread: Linux, etcetera
 # --thread-safe: KAI C++
 # pthread-config: use pthread-config program (for GNU Pth library)
 
-case ${host_os} in
+case $host_os in
+
+        freebsd*)
+
+        # -kthread: FreeBSD kernel threads (preferred to -pthread since SMP-able)
+        # lthread: LinuxThreads port on FreeBSD (also preferred to -pthread)
+
+        ax_pthread_flags="-kthread lthread $ax_pthread_flags"
+        ;;
+
+        hpux*)
+
+        # From the cc(1) man page: "[-mt] Sets various -D flags to enable
+        # multi-threading and also sets -lpthread."
+
+        ax_pthread_flags="-mt -pthread pthread $ax_pthread_flags"
+        ;;
+
+        openedition*)
+
+        # IBM z/OS requires a feature-test macro to be defined in order to
+        # enable POSIX threads at all, so give the user a hint if this is
+        # not set. (We don't define these ourselves, as they can affect
+        # other portions of the system API in unpredictable ways.)
+
+        AC_EGREP_CPP([AX_PTHREAD_ZOS_MISSING],
+            [
+#            if !defined(_OPEN_THREADS) && !defined(_UNIX03_THREADS)
+             AX_PTHREAD_ZOS_MISSING
+#            endif
+            ],
+            [AC_MSG_WARN([IBM z/OS requires -D_OPEN_THREADS or -D_UNIX03_THREADS to enable pthreads support.])])
+        ;;
+
         solaris*)
 
         # On Solaris (at least, for some versions), libc contains stubbed
         # (non-functional) versions of the pthreads routines, so link-based
-        # tests will erroneously succeed.  (We need to link with -pthreads/-mt/
+        # tests will erroneously succeed. (N.B.: The stubs are missing
-        # -lpthread.)  (The stubs are missing pthread_cleanup_push, or rather
+        # pthread_cleanup_push, or rather a function called by this macro,
-        # a function called by this macro, so we could check for that, but
+        # so we could check for that, but who knows whether they'll stub
-        # who knows whether they'll stub that too in a future libc.)  So,
+        # that too in a future libc.)  So we'll check first for the
-        # we'll just look for -pthreads and -lpthread first:
+        # standard Solaris way of linking pthreads (-mt -lpthread).
 
-        ax_pthread_flags="-pthreads pthread -mt -pthread $ax_pthread_flags"
+        ax_pthread_flags="-mt,pthread pthread $ax_pthread_flags"
-        ;;
-
-        darwin*)
-        ax_pthread_flags="-pthread $ax_pthread_flags"
         ;;
 esac
 
-# Clang doesn't consider unrecognized options an error unless we specify
+# GCC generally uses -pthread, or -pthreads on some platforms (e.g. SPARC)
-# -Werror. We throw in some extra Clang-specific options to ensure that
-# this doesn't happen for GCC, which also accepts -Werror.
 
-AC_MSG_CHECKING([if compiler needs -Werror to reject unknown flags])
+AS_IF([test "x$GCC" = "xyes"],
-save_CFLAGS="$CFLAGS"
+      [ax_pthread_flags="-pthread -pthreads $ax_pthread_flags"])
-ax_pthread_extra_flags="-Werror"
-CFLAGS="$CFLAGS $ax_pthread_extra_flags -Wunknown-warning-option -Wsizeof-array-argument"
-AC_COMPILE_IFELSE([AC_LANG_PROGRAM([int foo(void);],[foo()])],
-                  [AC_MSG_RESULT([yes])],
-                  [ax_pthread_extra_flags=
-                   AC_MSG_RESULT([no])])
-CFLAGS="$save_CFLAGS"
 
-if test x"$ax_pthread_ok" = xno; then
+# The presence of a feature test macro requesting re-entrant function
-for flag in $ax_pthread_flags; do
+# definitions is, on some systems, a strong hint that pthreads support is
+# correctly enabled
 
-        case $flag in
+case $host_os in
+        darwin* | hpux* | linux* | osf* | solaris*)
+        ax_pthread_check_macro="_REENTRANT"
+        ;;
+
+        aix*)
+        ax_pthread_check_macro="_THREAD_SAFE"
+        ;;
+
+        *)
+        ax_pthread_check_macro="--"
+        ;;
+esac
+AS_IF([test "x$ax_pthread_check_macro" = "x--"],
+      [ax_pthread_check_cond=0],
+      [ax_pthread_check_cond="!defined($ax_pthread_check_macro)"])
+
+# Are we compiling with Clang?
+
+AC_CACHE_CHECK([whether $CC is Clang],
+    [ax_cv_PTHREAD_CLANG],
+    [ax_cv_PTHREAD_CLANG=no
+     # Note that Autoconf sets GCC=yes for Clang as well as GCC
+     if test "x$GCC" = "xyes"; then
+        AC_EGREP_CPP([AX_PTHREAD_CC_IS_CLANG],
+            [/* Note: Clang 2.7 lacks __clang_[a-z]+__ */
+#            if defined(__clang__) && defined(__llvm__)
+             AX_PTHREAD_CC_IS_CLANG
+#            endif
+            ],
+            [ax_cv_PTHREAD_CLANG=yes])
+     fi
+    ])
+ax_pthread_clang="$ax_cv_PTHREAD_CLANG"
+
+ax_pthread_clang_warning=no
+
+# Clang needs special handling, because older versions handle the -pthread
+# option in a rather... idiosyncratic way
+
+if test "x$ax_pthread_clang" = "xyes"; then
+
+        # Clang takes -pthread; it has never supported any other flag
+
+        # (Note 1: This will need to be revisited if a system that Clang
+        # supports has POSIX threads in a separate library.  This tends not
+        # to be the way of modern systems, but it's conceivable.)
+
+        # (Note 2: On some systems, notably Darwin, -pthread is not needed
+        # to get POSIX threads support; the API is always present and
+        # active.  We could reasonably leave PTHREAD_CFLAGS empty.  But
+        # -pthread does define _REENTRANT, and while the Darwin headers
+        # ignore this macro, third-party headers might not.)
+
+        PTHREAD_CFLAGS="-pthread"
+        PTHREAD_LIBS=
+
+        ax_pthread_ok=yes
+
+        # However, older versions of Clang make a point of warning the user
+        # that, in an invocation where only linking and no compilation is
+        # taking place, the -pthread option has no effect ("argument unused
+        # during compilation").  They expect -pthread to be passed in only
+        # when source code is being compiled.
+        #
+        # Problem is, this is at odds with the way Automake and most other
+        # C build frameworks function, which is that the same flags used in
+        # compilation (CFLAGS) are also used in linking.  Many systems
+        # supported by AX_PTHREAD require exactly this for POSIX threads
+        # support, and in fact it is often not straightforward to specify a
+        # flag that is used only in the compilation phase and not in
+        # linking.  Such a scenario is extremely rare in practice.
+        #
+        # Even though use of the -pthread flag in linking would only print
+        # a warning, this can be a nuisance for well-run software projects
+        # that build with -Werror.  So if the active version of Clang has
+        # this misfeature, we search for an option to squash it.
+
+        AC_CACHE_CHECK([whether Clang needs flag to prevent "argument unused" warning when linking with -pthread],
+            [ax_cv_PTHREAD_CLANG_NO_WARN_FLAG],
+            [ax_cv_PTHREAD_CLANG_NO_WARN_FLAG=unknown
+             # Create an alternate version of $ac_link that compiles and
+             # links in two steps (.c -> .o, .o -> exe) instead of one
+             # (.c -> exe), because the warning occurs only in the second
+             # step
+             ax_pthread_save_ac_link="$ac_link"
+             ax_pthread_sed='s/conftest\.\$ac_ext/conftest.$ac_objext/g'
+             ax_pthread_link_step=`$as_echo "$ac_link" | sed "$ax_pthread_sed"`
+             ax_pthread_2step_ac_link="($ac_compile) && (echo ==== >&5) && ($ax_pthread_link_step)"
+             ax_pthread_save_CFLAGS="$CFLAGS"
+             for ax_pthread_try in '' -Qunused-arguments -Wno-unused-command-line-argument unknown; do
+                AS_IF([test "x$ax_pthread_try" = "xunknown"], [break])
+                CFLAGS="-Werror -Wunknown-warning-option $ax_pthread_try -pthread $ax_pthread_save_CFLAGS"
+                ac_link="$ax_pthread_save_ac_link"
+                AC_LINK_IFELSE([AC_LANG_SOURCE([[int main(void){return 0;}]])],
+                    [ac_link="$ax_pthread_2step_ac_link"
+                     AC_LINK_IFELSE([AC_LANG_SOURCE([[int main(void){return 0;}]])],
+                         [break])
+                    ])
+             done
+             ac_link="$ax_pthread_save_ac_link"
+             CFLAGS="$ax_pthread_save_CFLAGS"
+             AS_IF([test "x$ax_pthread_try" = "x"], [ax_pthread_try=no])
+             ax_cv_PTHREAD_CLANG_NO_WARN_FLAG="$ax_pthread_try"
+            ])
+
+        case "$ax_cv_PTHREAD_CLANG_NO_WARN_FLAG" in
+                no | unknown) ;;
+                *) PTHREAD_CFLAGS="$ax_cv_PTHREAD_CLANG_NO_WARN_FLAG $PTHREAD_CFLAGS" ;;
+        esac
+
+fi # $ax_pthread_clang = yes
+
+if test "x$ax_pthread_ok" = "xno"; then
+for ax_pthread_try_flag in $ax_pthread_flags; do
+
+        case $ax_pthread_try_flag in
                 none)
                 AC_MSG_CHECKING([whether pthreads work without any flags])
                 ;;
 
+                -mt,pthread)
+                AC_MSG_CHECKING([whether pthreads work with -mt -lpthread])
+                PTHREAD_CFLAGS="-mt"
+                PTHREAD_LIBS="-lpthread"
+                ;;
+
                 -*)
-                AC_MSG_CHECKING([whether pthreads work with $flag])
+                AC_MSG_CHECKING([whether pthreads work with $ax_pthread_try_flag])
-                PTHREAD_CFLAGS="$flag"
+                PTHREAD_CFLAGS="$ax_pthread_try_flag"
                 ;;
 
                 pthread-config)
                 AC_CHECK_PROG([ax_pthread_config], [pthread-config], [yes], [no])
-                if test x"$ax_pthread_config" = xno; then continue; fi
+                AS_IF([test "x$ax_pthread_config" = "xno"], [continue])
                 PTHREAD_CFLAGS="`pthread-config --cflags`"
                 PTHREAD_LIBS="`pthread-config --ldflags` `pthread-config --libs`"
                 ;;
 
                 *)
-                AC_MSG_CHECKING([for the pthreads library -l$flag])
+                AC_MSG_CHECKING([for the pthreads library -l$ax_pthread_try_flag])
-                PTHREAD_LIBS="-l$flag"
+                PTHREAD_LIBS="-l$ax_pthread_try_flag"
                 ;;
         esac
 
-        save_LIBS="$LIBS"
+        ax_pthread_save_CFLAGS="$CFLAGS"
-        save_CFLAGS="$CFLAGS"
+        ax_pthread_save_LIBS="$LIBS"
+        CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
         LIBS="$PTHREAD_LIBS $LIBS"
-        CFLAGS="$CFLAGS $PTHREAD_CFLAGS $ax_pthread_extra_flags"
 
         # Check for various functions.  We must include pthread.h,
         # since some functions may be macros.  (On the Sequent, we
@@ -589,7 +744,11 @@ for flag in $ax_pthread_flags; do
         # pthread_cleanup_push because it is one of the few pthread
         # functions on Solaris that doesn't have a non-functional libc stub.
         # We try pthread_create on general principles.
+
         AC_LINK_IFELSE([AC_LANG_PROGRAM([#include <pthread.h>
+#                       if $ax_pthread_check_cond
+#                        error "$ax_pthread_check_macro must be defined"
+#                       endif
                         static void routine(void *a) { a = 0; }
                         static void *start_routine(void *a) { return a; }],
                        [pthread_t th; pthread_attr_t attr;
@@ -601,13 +760,11 @@ for flag in $ax_pthread_flags; do
             [ax_pthread_ok=yes],
             [])
 
-        LIBS="$save_LIBS"
+        CFLAGS="$ax_pthread_save_CFLAGS"
-        CFLAGS="$save_CFLAGS"
+        LIBS="$ax_pthread_save_LIBS"
 
         AC_MSG_RESULT([$ax_pthread_ok])
-        if test "x$ax_pthread_ok" = xyes; then
+        AS_IF([test "x$ax_pthread_ok" = "xyes"], [break])
-                break;
-        fi
 
         PTHREAD_LIBS=""
         PTHREAD_CFLAGS=""
@@ -615,62 +772,65 @@ done
 fi
 
 # Various other checks:
-if test "x$ax_pthread_ok" = xyes; then
+if test "x$ax_pthread_ok" = "xyes"; then
-        save_LIBS="$LIBS"
+        ax_pthread_save_CFLAGS="$CFLAGS"
-        LIBS="$PTHREAD_LIBS $LIBS"
+        ax_pthread_save_LIBS="$LIBS"
-        save_CFLAGS="$CFLAGS"
         CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
+        LIBS="$PTHREAD_LIBS $LIBS"
 
         # Detect AIX lossage: JOINABLE attribute is called UNDETACHED.
-        AC_MSG_CHECKING([for joinable pthread attribute])
+        AC_CACHE_CHECK([for joinable pthread attribute],
-        attr_name=unknown
+            [ax_cv_PTHREAD_JOINABLE_ATTR],
-        for attr in PTHREAD_CREATE_JOINABLE PTHREAD_CREATE_UNDETACHED; do
+            [ax_cv_PTHREAD_JOINABLE_ATTR=unknown
+             for ax_pthread_attr in PTHREAD_CREATE_JOINABLE PTHREAD_CREATE_UNDETACHED; do
                  AC_LINK_IFELSE([AC_LANG_PROGRAM([#include <pthread.h>],
-                           [int attr = $attr; return attr /* ; */])],
+                                                 [int attr = $ax_pthread_attr; return attr /* ; */])],
-                [attr_name=$attr; break],
+                                [ax_cv_PTHREAD_JOINABLE_ATTR=$ax_pthread_attr; break],
                                 [])
              done
-        AC_MSG_RESULT([$attr_name])
+            ])
-        if test "$attr_name" != PTHREAD_CREATE_JOINABLE; then
+        AS_IF([test "x$ax_cv_PTHREAD_JOINABLE_ATTR" != "xunknown" && \
-            AC_DEFINE_UNQUOTED([PTHREAD_CREATE_JOINABLE], [$attr_name],
+               test "x$ax_cv_PTHREAD_JOINABLE_ATTR" != "xPTHREAD_CREATE_JOINABLE" && \
+               test "x$ax_pthread_joinable_attr_defined" != "xyes"],
+              [AC_DEFINE_UNQUOTED([PTHREAD_CREATE_JOINABLE],
+                                  [$ax_cv_PTHREAD_JOINABLE_ATTR],
                                   [Define to necessary symbol if this constant
                                    uses a non-standard name on your system.])
-        fi
+               ax_pthread_joinable_attr_defined=yes
+              ])
 
-        AC_MSG_CHECKING([if more special flags are required for pthreads])
+        AC_CACHE_CHECK([whether more special flags are required for pthreads],
-        flag=no
+            [ax_cv_PTHREAD_SPECIAL_FLAGS],
-        case ${host_os} in
+            [ax_cv_PTHREAD_SPECIAL_FLAGS=no
-            aix* | freebsd* | darwin*) flag="-D_THREAD_SAFE";;
+             case $host_os in
-            osf* | hpux*) flag="-D_REENTRANT";;
              solaris*)
-            if test "$GCC" = "yes"; then
+             ax_cv_PTHREAD_SPECIAL_FLAGS="-D_POSIX_PTHREAD_SEMANTICS"
-                flag="-D_REENTRANT"
-            else
-                # TODO: What about Clang on Solaris?
-                flag="-mt -D_REENTRANT"
-            fi
              ;;
              esac
-        AC_MSG_RESULT([$flag])
+            ])
-        if test "x$flag" != xno; then
+        AS_IF([test "x$ax_cv_PTHREAD_SPECIAL_FLAGS" != "xno" && \
-            PTHREAD_CFLAGS="$flag $PTHREAD_CFLAGS"
+               test "x$ax_pthread_special_flags_added" != "xyes"],
-        fi
+              [PTHREAD_CFLAGS="$ax_cv_PTHREAD_SPECIAL_FLAGS $PTHREAD_CFLAGS"
+               ax_pthread_special_flags_added=yes])
 
         AC_CACHE_CHECK([for PTHREAD_PRIO_INHERIT],
-            [ax_cv_PTHREAD_PRIO_INHERIT], [
+            [ax_cv_PTHREAD_PRIO_INHERIT],
-                AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <pthread.h>]],
+            [AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <pthread.h>]],
                                              [[int i = PTHREAD_PRIO_INHERIT;]])],
                             [ax_cv_PTHREAD_PRIO_INHERIT=yes],
                             [ax_cv_PTHREAD_PRIO_INHERIT=no])
             ])
-        AS_IF([test "x$ax_cv_PTHREAD_PRIO_INHERIT" = "xyes"],
+        AS_IF([test "x$ax_cv_PTHREAD_PRIO_INHERIT" = "xyes" && \
-            [AC_DEFINE([HAVE_PTHREAD_PRIO_INHERIT], [1], [Have PTHREAD_PRIO_INHERIT.])])
+               test "x$ax_pthread_prio_inherit_defined" != "xyes"],
+              [AC_DEFINE([HAVE_PTHREAD_PRIO_INHERIT], [1], [Have PTHREAD_PRIO_INHERIT.])
+               ax_pthread_prio_inherit_defined=yes
+              ])
 
-        LIBS="$save_LIBS"
+        CFLAGS="$ax_pthread_save_CFLAGS"
-        CFLAGS="$save_CFLAGS"
+        LIBS="$ax_pthread_save_LIBS"
 
         # More AIX lossage: compile with *_r variant
-        if test "x$GCC" != xyes; then
+        if test "x$GCC" != "xyes"; then
             case $host_os in
                 aix*)
                 AS_CASE(["x/$CC"],
@@ -692,7 +852,7 @@ AC_SUBST([PTHREAD_CFLAGS])
 AC_SUBST([PTHREAD_CC])
 
 # Finally, execute ACTION-IF-FOUND/ACTION-IF-NOT-FOUND:
-if test x"$ax_pthread_ok" = xyes; then
+if test "x$ax_pthread_ok" = "xyes"; then
         ifelse([$1],,[AC_DEFINE([HAVE_PTHREAD],[1],[Define if you have POSIX threads libraries and header files.])],[$1])
         :
 else
@@ -740,7 +900,7 @@ AC_DEFUN([AX_REQUIRE_DEFINED], [dnl
   m4_ifndef([$1], [m4_fatal([macro ]$1[ is not defined; is a m4 file missing?])])
 ])dnl AX_REQUIRE_DEFINED
 
-# Copyright (C) 2002-2013 Free Software Foundation, Inc.
+# Copyright (C) 2002-2014 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -752,10 +912,10 @@ AC_DEFUN([AX_REQUIRE_DEFINED], [dnl
 # generated from the m4 files accompanying Automake X.Y.
 # (This private macro should not be called outside this file.)
 AC_DEFUN([AM_AUTOMAKE_VERSION],
-[am__api_version='1.14'
+[am__api_version='1.15'
 dnl Some users find AM_AUTOMAKE_VERSION and mistake it for a way to
 dnl require some minimum version.  Point them to the right macro.
-m4_if([$1], [1.14.1], [],
+m4_if([$1], [1.15], [],
       [AC_FATAL([Do not call $0, use AM_INIT_AUTOMAKE([$1]).])])dnl
 ])
 
@@ -771,14 +931,14 @@ m4_define([_AM_AUTOCONF_VERSION], [])
 # Call AM_AUTOMAKE_VERSION and AM_AUTOMAKE_VERSION so they can be traced.
 # This function is AC_REQUIREd by AM_INIT_AUTOMAKE.
 AC_DEFUN([AM_SET_CURRENT_AUTOMAKE_VERSION],
-[AM_AUTOMAKE_VERSION([1.14.1])dnl
+[AM_AUTOMAKE_VERSION([1.15])dnl
 m4_ifndef([AC_AUTOCONF_VERSION],
   [m4_copy([m4_PACKAGE_VERSION], [AC_AUTOCONF_VERSION])])dnl
 _AM_AUTOCONF_VERSION(m4_defn([AC_AUTOCONF_VERSION]))])
 
 # AM_AUX_DIR_EXPAND                                         -*- Autoconf -*-
 
-# Copyright (C) 2001-2013 Free Software Foundation, Inc.
+# Copyright (C) 2001-2014 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -830,7 +990,7 @@ am_aux_dir=`cd "$ac_aux_dir" && pwd`
 
 # AM_CONDITIONAL                                            -*- Autoconf -*-
 
-# Copyright (C) 1997-2013 Free Software Foundation, Inc.
+# Copyright (C) 1997-2014 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -861,7 +1021,7 @@ AC_CONFIG_COMMANDS_PRE(
 Usually this means the macro was only invoked conditionally.]])
 fi])])
 
-# Copyright (C) 1999-2013 Free Software Foundation, Inc.
+# Copyright (C) 1999-2014 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -1052,7 +1212,7 @@ _AM_SUBST_NOTMAKE([am__nodep])dnl
 
 # Generate code to set up dependency tracking.              -*- Autoconf -*-
 
-# Copyright (C) 1999-2013 Free Software Foundation, Inc.
+# Copyright (C) 1999-2014 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -1128,7 +1288,7 @@ AC_DEFUN([AM_OUTPUT_DEPENDENCY_COMMANDS],
 
 # Do all the work for Automake.                             -*- Autoconf -*-
 
-# Copyright (C) 1996-2013 Free Software Foundation, Inc.
+# Copyright (C) 1996-2014 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -1218,8 +1378,8 @@ AC_REQUIRE([AC_PROG_MKDIR_P])dnl
 # <http://lists.gnu.org/archive/html/automake/2012-07/msg00001.html>
 # <http://lists.gnu.org/archive/html/automake/2012-07/msg00014.html>
 AC_SUBST([mkdir_p], ['$(MKDIR_P)'])
-# We need awk for the "check" target.  The system "awk" is bad on
+# We need awk for the "check" target (and possibly the TAP driver).  The
-# some platforms.
+# system "awk" is bad on some platforms.
 AC_REQUIRE([AC_PROG_AWK])dnl
 AC_REQUIRE([AC_PROG_MAKE_SET])dnl
 AC_REQUIRE([AM_SET_LEADING_DOT])dnl
@@ -1293,6 +1453,9 @@ END
     AC_MSG_ERROR([Your 'rm' program is bad, sorry.])
   fi
 fi
+dnl The trailing newline in this macro's definition is deliberate, for
+dnl backward compatibility and to allow trailing 'dnl'-style comments
+dnl after the AM_INIT_AUTOMAKE invocation. See automake bug#16841.
 ])
 
 dnl Hook into '_AC_COMPILER_EXEEXT' early to learn its expansion.  Do not
@@ -1322,7 +1485,7 @@ for _am_header in $config_headers :; do
 done
 echo "timestamp for $_am_arg" >`AS_DIRNAME(["$_am_arg"])`/stamp-h[]$_am_stamp_count])
 
-# Copyright (C) 2001-2013 Free Software Foundation, Inc.
+# Copyright (C) 2001-2014 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -1333,7 +1496,7 @@ echo "timestamp for $_am_arg" >`AS_DIRNAME(["$_am_arg"])`/stamp-h[]$_am_stamp_co
 # Define $install_sh.
 AC_DEFUN([AM_PROG_INSTALL_SH],
 [AC_REQUIRE([AM_AUX_DIR_EXPAND])dnl
-if test x"${install_sh}" != xset; then
+if test x"${install_sh+set}" != xset; then
   case $am_aux_dir in
   *\ * | *\	*)
     install_sh="\${SHELL} '$am_aux_dir/install-sh'" ;;
@@ -1343,7 +1506,7 @@ if test x"${install_sh}" != xset; then
 fi
 AC_SUBST([install_sh])])
 
-# Copyright (C) 2003-2013 Free Software Foundation, Inc.
+# Copyright (C) 2003-2014 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -1364,7 +1527,7 @@ AC_SUBST([am__leading_dot])])
 
 # Check to see how 'make' treats includes.	            -*- Autoconf -*-
 
-# Copyright (C) 2001-2013 Free Software Foundation, Inc.
+# Copyright (C) 2001-2014 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -1414,7 +1577,7 @@ rm -f confinc confmf
 
 # Fake the existence of programs that GNU maintainers use.  -*- Autoconf -*-
 
-# Copyright (C) 1997-2013 Free Software Foundation, Inc.
+# Copyright (C) 1997-2014 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -1453,7 +1616,7 @@ fi
 
 # Helper functions for option handling.                     -*- Autoconf -*-
 
-# Copyright (C) 2001-2013 Free Software Foundation, Inc.
+# Copyright (C) 2001-2014 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -1482,7 +1645,7 @@ AC_DEFUN([_AM_SET_OPTIONS],
 AC_DEFUN([_AM_IF_OPTION],
 [m4_ifset(_AM_MANGLE_OPTION([$1]), [$2], [$3])])
 
-# Copyright (C) 1999-2013 Free Software Foundation, Inc.
+# Copyright (C) 1999-2014 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -1529,7 +1692,7 @@ AC_LANG_POP([C])])
 # For backward compatibility.
 AC_DEFUN_ONCE([AM_PROG_CC_C_O], [AC_REQUIRE([AC_PROG_CC])])
 
-# Copyright (C) 2001-2013 Free Software Foundation, Inc.
+# Copyright (C) 2001-2014 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -1548,7 +1711,7 @@ AC_DEFUN([AM_RUN_LOG],
 
 # Check to make sure that the build environment is sane.    -*- Autoconf -*-
 
-# Copyright (C) 1996-2013 Free Software Foundation, Inc.
+# Copyright (C) 1996-2014 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -1629,7 +1792,7 @@ AC_CONFIG_COMMANDS_PRE(
 rm -f conftest.file
 ])
 
-# Copyright (C) 2009-2013 Free Software Foundation, Inc.
+# Copyright (C) 2009-2014 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -1689,7 +1852,7 @@ AC_SUBST([AM_BACKSLASH])dnl
 _AM_SUBST_NOTMAKE([AM_BACKSLASH])dnl
 ])
 
-# Copyright (C) 2001-2013 Free Software Foundation, Inc.
+# Copyright (C) 2001-2014 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -1717,7 +1880,7 @@ fi
 INSTALL_STRIP_PROGRAM="\$(install_sh) -c -s"
 AC_SUBST([INSTALL_STRIP_PROGRAM])])
 
-# Copyright (C) 2006-2013 Free Software Foundation, Inc.
+# Copyright (C) 2006-2014 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -1736,7 +1899,7 @@ AC_DEFUN([AM_SUBST_NOTMAKE], [_AM_SUBST_NOTMAKE($@)])
 
 # Check how to create a tarball.                            -*- Autoconf -*-
 
-# Copyright (C) 2004-2013 Free Software Foundation, Inc.
+# Copyright (C) 2004-2014 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,

auto/compile

@@ -3,7 +3,7 @@
 
 scriptversion=2012-10-14.11; # UTC
 
-# Copyright (C) 1999-2013 Free Software Foundation, Inc.
+# Copyright (C) 1999-2014 Free Software Foundation, Inc.
 # Written by Tom Tromey <tromey@cygnus.com>.
 #
 # This program is free software; you can redistribute it and/or modify

auto/config.guess

@@ -1,8 +1,8 @@
 #! /bin/sh
 # Attempt to guess a canonical system name.
-#   Copyright 1992-2014 Free Software Foundation, Inc.
+#   Copyright 1992-2016 Free Software Foundation, Inc.
 
-timestamp='2014-03-23'
+timestamp='2016-10-02'
 
 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
@@ -24,12 +24,12 @@ timestamp='2014-03-23'
 # program.  This Exception is an additional permission under section 7
 # of the GNU General Public License, version 3 ("GPLv3").
 #
-# Originally written by Per Bothner.
+# Originally written by Per Bothner; maintained since 2000 by Ben Elliston.
 #
 # You can get the latest version of this script from:
-# http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess;hb=HEAD
+# http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess
 #
-# Please send patches with a ChangeLog entry to config-patches@gnu.org.
+# Please send patches to <config-patches@gnu.org>.
 
 
 me=`echo "$0" | sed -e 's,.*/,,'`
@@ -50,7 +50,7 @@ version="\
 GNU config.guess ($timestamp)
 
 Originally written by Per Bothner.
-Copyright 1992-2014 Free Software Foundation, Inc.
+Copyright 1992-2016 Free Software Foundation, Inc.
 
 This is free software; see the source for copying conditions.  There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -168,19 +168,29 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
 	# Note: NetBSD doesn't particularly care about the vendor
 	# portion of the name.  We always set it to "unknown".
 	sysctl="sysctl -n hw.machine_arch"
-	UNAME_MACHINE_ARCH=`(/sbin/$sysctl 2>/dev/null || \
+	UNAME_MACHINE_ARCH=`(uname -p 2>/dev/null || \
-	    /usr/sbin/$sysctl 2>/dev/null || echo unknown)`
+	    /sbin/$sysctl 2>/dev/null || \
+	    /usr/sbin/$sysctl 2>/dev/null || \
+	    echo unknown)`
 	case "${UNAME_MACHINE_ARCH}" in
 	    armeb) machine=armeb-unknown ;;
 	    arm*) machine=arm-unknown ;;
 	    sh3el) machine=shl-unknown ;;
 	    sh3eb) machine=sh-unknown ;;
 	    sh5el) machine=sh5le-unknown ;;
+	    earmv*)
+		arch=`echo ${UNAME_MACHINE_ARCH} | sed -e 's,^e\(armv[0-9]\).*$,\1,'`
+		endian=`echo ${UNAME_MACHINE_ARCH} | sed -ne 's,^.*\(eb\)$,\1,p'`
+		machine=${arch}${endian}-unknown
+		;;
 	    *) machine=${UNAME_MACHINE_ARCH}-unknown ;;
 	esac
 	# The Operating System including object format, if it has switched
-	# to ELF recently, or will in the future.
+	# to ELF recently (or will in the future) and ABI.
 	case "${UNAME_MACHINE_ARCH}" in
+	    earm*)
+		os=netbsdelf
+		;;
 	    arm*|i386|m68k|ns32k|sh3*|sparc|vax)
 		eval $set_cc_for_build
 		if echo __ELF__ | $CC_FOR_BUILD -E - 2>/dev/null \
@@ -197,6 +207,13 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
 		os=netbsd
 		;;
 	esac
+	# Determine ABI tags.
+	case "${UNAME_MACHINE_ARCH}" in
+	    earm*)
+		expr='s/^earmv[0-9]/-eabi/;s/eb$//'
+		abi=`echo ${UNAME_MACHINE_ARCH} | sed -e "$expr"`
+		;;
+	esac
 	# The OS release
 	# Debian GNU/NetBSD machines have a different userland, and
 	# thus, need a distinct triplet. However, they do not need
@@ -207,13 +224,13 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
 		release='-gnu'
 		;;
 	    *)
-		release=`echo ${UNAME_RELEASE}|sed -e 's/[-_].*/\./'`
+		release=`echo ${UNAME_RELEASE} | sed -e 's/[-_].*//' | cut -d. -f1,2`
 		;;
 	esac
 	# Since CPU_TYPE-MANUFACTURER-KERNEL-OPERATING_SYSTEM:
 	# contains redundant information, the shorter form:
 	# CPU_TYPE-MANUFACTURER-OPERATING_SYSTEM is used.
-	echo "${machine}-${os}${release}"
+	echo "${machine}-${os}${release}${abi}"
 	exit ;;
     *:Bitrig:*:*)
 	UNAME_MACHINE_ARCH=`arch | sed 's/Bitrig.//'`
@@ -223,6 +240,10 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
 	UNAME_MACHINE_ARCH=`arch | sed 's/OpenBSD.//'`
 	echo ${UNAME_MACHINE_ARCH}-unknown-openbsd${UNAME_RELEASE}
 	exit ;;
+    *:LibertyBSD:*:*)
+	UNAME_MACHINE_ARCH=`arch | sed 's/^.*BSD\.//'`
+	echo ${UNAME_MACHINE_ARCH}-unknown-libertybsd${UNAME_RELEASE}
+	exit ;;
     *:ekkoBSD:*:*)
 	echo ${UNAME_MACHINE}-unknown-ekkobsd${UNAME_RELEASE}
 	exit ;;
@@ -235,6 +256,9 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
     *:MirBSD:*:*)
 	echo ${UNAME_MACHINE}-unknown-mirbsd${UNAME_RELEASE}
 	exit ;;
+    *:Sortix:*:*)
+	echo ${UNAME_MACHINE}-unknown-sortix
+	exit ;;
     alpha:OSF1:*:*)
 	case $UNAME_RELEASE in
 	*4.0)
@@ -251,42 +275,42 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
 	ALPHA_CPU_TYPE=`/usr/sbin/psrinfo -v | sed -n -e 's/^  The alpha \(.*\) processor.*$/\1/p' | head -n 1`
 	case "$ALPHA_CPU_TYPE" in
 	    "EV4 (21064)")
-		UNAME_MACHINE="alpha" ;;
+		UNAME_MACHINE=alpha ;;
 	    "EV4.5 (21064)")
-		UNAME_MACHINE="alpha" ;;
+		UNAME_MACHINE=alpha ;;
 	    "LCA4 (21066/21068)")
-		UNAME_MACHINE="alpha" ;;
+		UNAME_MACHINE=alpha ;;
 	    "EV5 (21164)")
-		UNAME_MACHINE="alphaev5" ;;
+		UNAME_MACHINE=alphaev5 ;;
 	    "EV5.6 (21164A)")
-		UNAME_MACHINE="alphaev56" ;;
+		UNAME_MACHINE=alphaev56 ;;
 	    "EV5.6 (21164PC)")
-		UNAME_MACHINE="alphapca56" ;;
+		UNAME_MACHINE=alphapca56 ;;
 	    "EV5.7 (21164PC)")
-		UNAME_MACHINE="alphapca57" ;;
+		UNAME_MACHINE=alphapca57 ;;
 	    "EV6 (21264)")
-		UNAME_MACHINE="alphaev6" ;;
+		UNAME_MACHINE=alphaev6 ;;
 	    "EV6.7 (21264A)")
-		UNAME_MACHINE="alphaev67" ;;
+		UNAME_MACHINE=alphaev67 ;;
 	    "EV6.8CB (21264C)")
-		UNAME_MACHINE="alphaev68" ;;
+		UNAME_MACHINE=alphaev68 ;;
 	    "EV6.8AL (21264B)")
-		UNAME_MACHINE="alphaev68" ;;
+		UNAME_MACHINE=alphaev68 ;;
 	    "EV6.8CX (21264D)")
-		UNAME_MACHINE="alphaev68" ;;
+		UNAME_MACHINE=alphaev68 ;;
 	    "EV6.9A (21264/EV69A)")
-		UNAME_MACHINE="alphaev69" ;;
+		UNAME_MACHINE=alphaev69 ;;
 	    "EV7 (21364)")
-		UNAME_MACHINE="alphaev7" ;;
+		UNAME_MACHINE=alphaev7 ;;
 	    "EV7.9 (21364A)")
-		UNAME_MACHINE="alphaev79" ;;
+		UNAME_MACHINE=alphaev79 ;;
 	esac
 	# A Pn.n version is a patched version.
 	# A Vn.n version is a released version.
 	# A Tn.n version is a released field test version.
 	# A Xn.n version is an unreleased experimental baselevel.
 	# 1.2 uses "1.2" for uname -r.
-	echo ${UNAME_MACHINE}-dec-osf`echo ${UNAME_RELEASE} | sed -e 's/^[PVTX]//' | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz'`
+	echo ${UNAME_MACHINE}-dec-osf`echo ${UNAME_RELEASE} | sed -e 's/^[PVTX]//' | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz`
 	# Reset EXIT trap before exiting to avoid spurious non-zero exit code.
 	exitcode=$?
 	trap '' 0
@@ -359,16 +383,16 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
 	exit ;;
     i86pc:SunOS:5.*:* | i86xen:SunOS:5.*:*)
 	eval $set_cc_for_build
-	SUN_ARCH="i386"
+	SUN_ARCH=i386
 	# If there is a compiler, see if it is configured for 64-bit objects.
 	# Note that the Sun cc does not turn __LP64__ into 1 like gcc does.
 	# This test works for both compilers.
-	if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then
+	if [ "$CC_FOR_BUILD" != no_compiler_found ]; then
 	    if (echo '#ifdef __amd64'; echo IS_64BIT_ARCH; echo '#endif') | \
-		(CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \
+		(CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) | \
 		grep IS_64BIT_ARCH >/dev/null
 	    then
-		SUN_ARCH="x86_64"
+		SUN_ARCH=x86_64
 	    fi
 	fi
 	echo ${SUN_ARCH}-pc-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
@@ -393,7 +417,7 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
 	exit ;;
     sun*:*:4.2BSD:*)
 	UNAME_RELEASE=`(sed 1q /etc/motd | awk '{print substr($5,1,3)}') 2>/dev/null`
-	test "x${UNAME_RELEASE}" = "x" && UNAME_RELEASE=3
+	test "x${UNAME_RELEASE}" = x && UNAME_RELEASE=3
 	case "`/bin/arch`" in
 	    sun3)
 		echo m68k-sun-sunos${UNAME_RELEASE}
@@ -579,8 +603,9 @@ EOF
 	else
 		IBM_ARCH=powerpc
 	fi
-	if [ -x /usr/bin/oslevel ] ; then
+	if [ -x /usr/bin/lslpp ] ; then
-		IBM_REV=`/usr/bin/oslevel`
+		IBM_REV=`/usr/bin/lslpp -Lqc bos.rte.libc |
+			   awk -F: '{ print $3 }' | sed s/[0-9]*$/0/`
 	else
 		IBM_REV=${UNAME_VERSION}.${UNAME_RELEASE}
 	fi
@@ -617,13 +642,13 @@ EOF
 		    sc_cpu_version=`/usr/bin/getconf SC_CPU_VERSION 2>/dev/null`
 		    sc_kernel_bits=`/usr/bin/getconf SC_KERNEL_BITS 2>/dev/null`
 		    case "${sc_cpu_version}" in
-		      523) HP_ARCH="hppa1.0" ;; # CPU_PA_RISC1_0
+		      523) HP_ARCH=hppa1.0 ;; # CPU_PA_RISC1_0
-		      528) HP_ARCH="hppa1.1" ;; # CPU_PA_RISC1_1
+		      528) HP_ARCH=hppa1.1 ;; # CPU_PA_RISC1_1
 		      532)                      # CPU_PA_RISC2_0
 			case "${sc_kernel_bits}" in
-			  32) HP_ARCH="hppa2.0n" ;;
+			  32) HP_ARCH=hppa2.0n ;;
-			  64) HP_ARCH="hppa2.0w" ;;
+			  64) HP_ARCH=hppa2.0w ;;
-			  '') HP_ARCH="hppa2.0" ;;   # HP-UX 10.20
+			  '') HP_ARCH=hppa2.0 ;;   # HP-UX 10.20
 			esac ;;
 		    esac
 		fi
@@ -662,11 +687,11 @@ EOF
 		    exit (0);
 		}
 EOF
-		    (CCOPTS= $CC_FOR_BUILD -o $dummy $dummy.c 2>/dev/null) && HP_ARCH=`$dummy`
+		    (CCOPTS="" $CC_FOR_BUILD -o $dummy $dummy.c 2>/dev/null) && HP_ARCH=`$dummy`
 		    test -z "$HP_ARCH" && HP_ARCH=hppa
 		fi ;;
 	esac
-	if [ ${HP_ARCH} = "hppa2.0w" ]
+	if [ ${HP_ARCH} = hppa2.0w ]
 	then
 	    eval $set_cc_for_build
 
@@ -679,12 +704,12 @@ EOF
 	    # $ CC_FOR_BUILD="cc +DA2.0w" ./config.guess
 	    # => hppa64-hp-hpux11.23
 
-	    if echo __LP64__ | (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) |
+	    if echo __LP64__ | (CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) |
 		grep -q __LP64__
 	    then
-		HP_ARCH="hppa2.0w"
+		HP_ARCH=hppa2.0w
 	    else
-		HP_ARCH="hppa64"
+		HP_ARCH=hppa64
 	    fi
 	fi
 	echo ${HP_ARCH}-hp-hpux${HPUX_REV}
@@ -789,14 +814,14 @@ EOF
 	echo craynv-cray-unicosmp${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
 	exit ;;
     F30[01]:UNIX_System_V:*:* | F700:UNIX_System_V:*:*)
-	FUJITSU_PROC=`uname -m | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz'`
+	FUJITSU_PROC=`uname -m | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz`
-	FUJITSU_SYS=`uname -p | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/\///'`
+	FUJITSU_SYS=`uname -p | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz | sed -e 's/\///'`
 	FUJITSU_REL=`echo ${UNAME_RELEASE} | sed -e 's/ /_/'`
 	echo "${FUJITSU_PROC}-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}"
 	exit ;;
     5000:UNIX_System_V:4.*:*)
-	FUJITSU_SYS=`uname -p | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/\///'`
+	FUJITSU_SYS=`uname -p | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz | sed -e 's/\///'`
-	FUJITSU_REL=`echo ${UNAME_RELEASE} | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/ /_/'`
+	FUJITSU_REL=`echo ${UNAME_RELEASE} | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz | sed -e 's/ /_/'`
 	echo "sparc-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}"
 	exit ;;
     i*86:BSD/386:*:* | i*86:BSD/OS:*:* | *:Ascend\ Embedded/OS:*:*)
@@ -878,7 +903,7 @@ EOF
 	exit ;;
     *:GNU/*:*:*)
 	# other systems with GNU libc and userland
-	echo ${UNAME_MACHINE}-unknown-`echo ${UNAME_SYSTEM} | sed 's,^[^/]*/,,' | tr '[A-Z]' '[a-z]'``echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'`-${LIBC}
+	echo ${UNAME_MACHINE}-unknown-`echo ${UNAME_SYSTEM} | sed 's,^[^/]*/,,' | tr "[:upper:]" "[:lower:]"``echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'`-${LIBC}
 	exit ;;
     i*86:Minix:*:*)
 	echo ${UNAME_MACHINE}-pc-minix
@@ -901,7 +926,7 @@ EOF
 	  EV68*) UNAME_MACHINE=alphaev68 ;;
 	esac
 	objdump --private-headers /bin/sh | grep -q ld.so.1
-	if test "$?" = 0 ; then LIBC="gnulibc1" ; fi
+	if test "$?" = 0 ; then LIBC=gnulibc1 ; fi
 	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
     arc:Linux:*:* | arceb:Linux:*:*)
@@ -932,6 +957,9 @@ EOF
     crisv32:Linux:*:*)
 	echo ${UNAME_MACHINE}-axis-linux-${LIBC}
 	exit ;;
+    e2k:Linux:*:*)
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
+	exit ;;
     frv:Linux:*:*)
 	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
@@ -944,6 +972,9 @@ EOF
     ia64:Linux:*:*)
 	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
+    k1om:Linux:*:*)
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
+	exit ;;
     m32r*:Linux:*:*)
 	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
@@ -969,6 +1000,9 @@ EOF
 	eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^CPU'`
 	test x"${CPU}" != x && { echo "${CPU}-unknown-linux-${LIBC}"; exit; }
 	;;
+    mips64el:Linux:*:*)
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
+	exit ;;
     openrisc*:Linux:*:*)
 	echo or1k-unknown-linux-${LIBC}
 	exit ;;
@@ -1001,6 +1035,9 @@ EOF
     ppcle:Linux:*:*)
 	echo powerpcle-unknown-linux-${LIBC}
 	exit ;;
+    riscv32:Linux:*:* | riscv64:Linux:*:*)
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
+	exit ;;
     s390:Linux:*:* | s390x:Linux:*:*)
 	echo ${UNAME_MACHINE}-ibm-linux-${LIBC}
 	exit ;;
@@ -1020,7 +1057,7 @@ EOF
 	echo ${UNAME_MACHINE}-dec-linux-${LIBC}
 	exit ;;
     x86_64:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
+	echo ${UNAME_MACHINE}-pc-linux-${LIBC}
 	exit ;;
     xtensa*:Linux:*:*)
 	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
@@ -1099,7 +1136,7 @@ EOF
 	# uname -m prints for DJGPP always 'pc', but it prints nothing about
 	# the processor, so we play safe by assuming i586.
 	# Note: whatever this is, it MUST be the same as what config.sub
-	# prints for the "djgpp" host, or else GDB configury will decide that
+	# prints for the "djgpp" host, or else GDB configure will decide that
 	# this is a cross-build.
 	echo i586-pc-msdosdjgpp
 	exit ;;
@@ -1248,6 +1285,9 @@ EOF
     SX-8R:SUPER-UX:*:*)
 	echo sx8r-nec-superux${UNAME_RELEASE}
 	exit ;;
+    SX-ACE:SUPER-UX:*:*)
+	echo sxace-nec-superux${UNAME_RELEASE}
+	exit ;;
     Power*:Rhapsody:*:*)
 	echo powerpc-apple-rhapsody${UNAME_RELEASE}
 	exit ;;
@@ -1261,9 +1301,9 @@ EOF
 	    UNAME_PROCESSOR=powerpc
 	fi
 	if test `echo "$UNAME_RELEASE" | sed -e 's/\..*//'` -le 10 ; then
-	    if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then
+	    if [ "$CC_FOR_BUILD" != no_compiler_found ]; then
 		if (echo '#ifdef __LP64__'; echo IS_64BIT_ARCH; echo '#endif') | \
-		    (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \
+		    (CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) | \
 		    grep IS_64BIT_ARCH >/dev/null
 		then
 		    case $UNAME_PROCESSOR in
@@ -1285,7 +1325,7 @@ EOF
 	exit ;;
     *:procnto*:*:* | *:QNX:[0123456789]*:*)
 	UNAME_PROCESSOR=`uname -p`
-	if test "$UNAME_PROCESSOR" = "x86"; then
+	if test "$UNAME_PROCESSOR" = x86; then
 		UNAME_PROCESSOR=i386
 		UNAME_MACHINE=pc
 	fi
@@ -1316,7 +1356,7 @@ EOF
 	# "uname -m" is not consistent, so use $cputype instead. 386
 	# is converted to i386 for consistency with other x86
 	# operating systems.
-	if test "$cputype" = "386"; then
+	if test "$cputype" = 386; then
 	    UNAME_MACHINE=i386
 	else
 	    UNAME_MACHINE="$cputype"
@@ -1358,7 +1398,7 @@ EOF
 	echo i386-pc-xenix
 	exit ;;
     i*86:skyos:*:*)
-	echo ${UNAME_MACHINE}-pc-skyos`echo ${UNAME_RELEASE}` | sed -e 's/ .*$//'
+	echo ${UNAME_MACHINE}-pc-skyos`echo ${UNAME_RELEASE} | sed -e 's/ .*$//'`
 	exit ;;
     i*86:rdos:*:*)
 	echo ${UNAME_MACHINE}-pc-rdos
@@ -1369,23 +1409,25 @@ EOF
     x86_64:VMkernel:*:*)
 	echo ${UNAME_MACHINE}-unknown-esx
 	exit ;;
+    amd64:Isilon\ OneFS:*:*)
+	echo x86_64-unknown-onefs
+	exit ;;
 esac
 
 cat >&2 <<EOF
 $0: unable to guess system type
 
-This script, last modified $timestamp, has failed to recognize
+This script (version $timestamp), has failed to recognize the
-the operating system you are using. It is advised that you
+operating system you are using. If your script is old, overwrite
-download the most up to date version of the config scripts from
+config.guess and config.sub with the latest versions from:
 
-  http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess;hb=HEAD
+  http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess
 and
-  http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub;hb=HEAD
+  http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub
 
-If the version you run ($0) is already up to date, please
+If $0 has already been updated, send the following data and any
-send the following data and any information you think might be
+information you think might be pertinent to config-patches@gnu.org to
-pertinent to <config-patches@gnu.org> in order to provide the needed
+provide the necessary information to handle your system.
-information to handle your system.
 
 config.guess timestamp = $timestamp
 

auto/config.sub

@@ -1,8 +1,8 @@
 #! /bin/sh
 # Configuration validation subroutine script.
-#   Copyright 1992-2014 Free Software Foundation, Inc.
+#   Copyright 1992-2016 Free Software Foundation, Inc.
 
-timestamp='2014-09-11'
+timestamp='2016-11-04'
 
 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
@@ -25,7 +25,7 @@ timestamp='2014-09-11'
 # of the GNU General Public License, version 3 ("GPLv3").
 
 
-# Please send patches with a ChangeLog entry to config-patches@gnu.org.
+# Please send patches to <config-patches@gnu.org>.
 #
 # Configuration subroutine to validate and canonicalize a configuration type.
 # Supply the specified configuration type as an argument.
@@ -33,7 +33,7 @@ timestamp='2014-09-11'
 # Otherwise, we print the canonical config type on stdout and succeed.
 
 # You can get the latest version of this script from:
-# http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub;hb=HEAD
+# http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub
 
 # This file is supposed to be the same for all GNU packages
 # and recognize all the CPU types, system types and aliases
@@ -53,8 +53,7 @@ timestamp='2014-09-11'
 me=`echo "$0" | sed -e 's,.*/,,'`
 
 usage="\
-Usage: $0 [OPTION] CPU-MFR-OPSYS
+Usage: $0 [OPTION] CPU-MFR-OPSYS or ALIAS
-       $0 [OPTION] ALIAS
 
 Canonicalize a configuration name.
 
@@ -68,7 +67,7 @@ Report bugs and patches to <config-patches@gnu.org>."
 version="\
 GNU config.sub ($timestamp)
 
-Copyright 1992-2014 Free Software Foundation, Inc.
+Copyright 1992-2016 Free Software Foundation, Inc.
 
 This is free software; see the source for copying conditions.  There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -117,8 +116,8 @@ maybe_os=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\2/'`
 case $maybe_os in
   nto-qnx* | linux-gnu* | linux-android* | linux-dietlibc | linux-newlib* | \
   linux-musl* | linux-uclibc* | uclinux-uclibc* | uclinux-gnu* | kfreebsd*-gnu* | \
-  knetbsd*-gnu* | netbsd*-gnu* | \
+  knetbsd*-gnu* | netbsd*-gnu* | netbsd*-eabi* | \
-  kopensolaris*-gnu* | \
+  kopensolaris*-gnu* | cloudabi*-eabi* | \
   storm-chaos* | os2-emx* | rtmk-nova*)
     os=-$maybe_os
     basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`
@@ -255,12 +254,13 @@ case $basic_machine in
 	| arc | arceb \
 	| arm | arm[bl]e | arme[lb] | armv[2-8] | armv[3-8][lb] | armv7[arm] \
 	| avr | avr32 \
+	| ba \
 	| be32 | be64 \
 	| bfin \
 	| c4x | c8051 | clipper \
 	| d10v | d30v | dlx | dsp16xx \
-	| epiphany \
+	| e2k | epiphany \
-	| fido | fr30 | frv \
+	| fido | fr30 | frv | ft32 \
 	| h8300 | h8500 | hppa | hppa1.[01] | hppa2.0 | hppa2.0[nw] | hppa64 \
 	| hexagon \
 	| i370 | i860 | i960 | ia64 \
@@ -301,11 +301,12 @@ case $basic_machine in
 	| open8 | or1k | or1knd | or32 \
 	| pdp10 | pdp11 | pj | pjl \
 	| powerpc | powerpc64 | powerpc64le | powerpcle \
+	| pru \
 	| pyramid \
 	| riscv32 | riscv64 \
 	| rl78 | rx \
 	| score \
-	| sh | sh[1234] | sh[24]a | sh[24]aeb | sh[23]e | sh[34]eb | sheb | shbe | shle | sh[1234]le | sh3ele \
+	| sh | sh[1234] | sh[24]a | sh[24]aeb | sh[23]e | sh[234]eb | sheb | shbe | shle | sh[1234]le | sh3ele \
 	| sh64 | sh64le \
 	| sparc | sparc64 | sparc64b | sparc64v | sparc86x | sparclet | sparclite \
 	| sparcv8 | sparcv9 | sparcv9b | sparcv9v \
@@ -313,6 +314,7 @@ case $basic_machine in
 	| tahoe | tic4x | tic54x | tic55x | tic6x | tic80 | tron \
 	| ubicom32 \
 	| v850 | v850e | v850e1 | v850e2 | v850es | v850e2v3 \
+	| visium \
 	| we32k \
 	| x86 | xc16x | xstormy16 | xtensa \
 	| z8k | z80)
@@ -327,6 +329,9 @@ case $basic_machine in
 	c6x)
 		basic_machine=tic6x-unknown
 		;;
+	leon|leon[3-9])
+		basic_machine=sparc-$basic_machine
+		;;
 	m6811 | m68hc11 | m6812 | m68hc12 | m68hcs12x | nvptx | picochip)
 		basic_machine=$basic_machine-unknown
 		os=-none
@@ -372,12 +377,13 @@ case $basic_machine in
 	| alphapca5[67]-* | alpha64pca5[67]-* | arc-* | arceb-* \
 	| arm-*  | armbe-* | armle-* | armeb-* | armv*-* \
 	| avr-* | avr32-* \
+	| ba-* \
 	| be32-* | be64-* \
 	| bfin-* | bs2000-* \
 	| c[123]* | c30-* | [cjt]90-* | c4x-* \
 	| c8051-* | clipper-* | craynv-* | cydra-* \
 	| d10v-* | d30v-* | dlx-* \
-	| elxsi-* \
+	| e2k-* | elxsi-* \
 	| f30[01]-* | f700-* | fido-* | fr30-* | frv-* | fx80-* \
 	| h8300-* | h8500-* \
 	| hppa-* | hppa1.[01]-* | hppa2.0-* | hppa2.0[nw]-* | hppa64-* \
@@ -423,13 +429,15 @@ case $basic_machine in
 	| orion-* \
 	| pdp10-* | pdp11-* | pj-* | pjl-* | pn-* | power-* \
 	| powerpc-* | powerpc64-* | powerpc64le-* | powerpcle-* \
+	| pru-* \
 	| pyramid-* \
+	| riscv32-* | riscv64-* \
 	| rl78-* | romp-* | rs6000-* | rx-* \
 	| sh-* | sh[1234]-* | sh[24]a-* | sh[24]aeb-* | sh[23]e-* | sh[34]eb-* | sheb-* | shbe-* \
 	| shle-* | sh[1234]le-* | sh3ele-* | sh64-* | sh64le-* \
 	| sparc-* | sparc64-* | sparc64b-* | sparc64v-* | sparc86x-* | sparclet-* \
 	| sparclite-* \
-	| sparcv8-* | sparcv9-* | sparcv9b-* | sparcv9v-* | sv1-* | sx?-* \
+	| sparcv8-* | sparcv9-* | sparcv9b-* | sparcv9v-* | sv1-* | sx*-* \
 	| tahoe-* \
 	| tic30-* | tic4x-* | tic54x-* | tic55x-* | tic6x-* | tic80-* \
 	| tile*-* \
@@ -437,6 +445,7 @@ case $basic_machine in
 	| ubicom32-* \
 	| v850-* | v850e-* | v850e1-* | v850es-* | v850e2-* | v850e2v3-* \
 	| vax-* \
+	| visium-* \
 	| we32k-* \
 	| x86-* | x86_64-* | xc16x-* | xps100-* \
 	| xstormy16-* | xtensa*-* \
@@ -513,6 +522,9 @@ case $basic_machine in
 		basic_machine=i386-pc
 		os=-aros
 		;;
+	asmjs)
+		basic_machine=asmjs-unknown
+		;;
 	aux)
 		basic_machine=m68k-apple
 		os=-aux
@@ -633,6 +645,14 @@ case $basic_machine in
 		basic_machine=m68k-bull
 		os=-sysv3
 		;;
+	e500v[12])
+		basic_machine=powerpc-unknown
+		os=$os"spe"
+		;;
+	e500v[12]-*)
+		basic_machine=powerpc-`echo $basic_machine | sed 's/^[^-]*-//'`
+		os=$os"spe"
+		;;
 	ebmon29k)
 		basic_machine=a29k-amd
 		os=-ebmon
@@ -774,6 +794,9 @@ case $basic_machine in
 		basic_machine=m68k-isi
 		os=-sysv
 		;;
+	leon-*|leon[3-9]-*)
+		basic_machine=sparc-`echo $basic_machine | sed 's/-.*//'`
+		;;
 	m68knommu)
 		basic_machine=m68k-unknown
 		os=-linux
@@ -1009,7 +1032,7 @@ case $basic_machine in
 	ppc-* | ppcbe-*)
 		basic_machine=powerpc-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
-	ppcle | powerpclittle | ppc-le | powerpc-little)
+	ppcle | powerpclittle)
 		basic_machine=powerpcle-unknown
 		;;
 	ppcle-* | powerpclittle-*)
@@ -1019,7 +1042,7 @@ case $basic_machine in
 		;;
 	ppc64-*) basic_machine=powerpc64-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
-	ppc64le | powerpc64little | ppc64-le | powerpc64-little)
+	ppc64le | powerpc64little)
 		basic_machine=powerpc64le-unknown
 		;;
 	ppc64le-* | powerpc64little-*)
@@ -1365,18 +1388,18 @@ case $os in
 	      | -hpux* | -unos* | -osf* | -luna* | -dgux* | -auroraux* | -solaris* \
 	      | -sym* | -kopensolaris* | -plan9* \
 	      | -amigaos* | -amigados* | -msdos* | -newsos* | -unicos* | -aof* \
-	      | -aos* | -aros* \
+	      | -aos* | -aros* | -cloudabi* | -sortix* \
 	      | -nindy* | -vxsim* | -vxworks* | -ebmon* | -hms* | -mvs* \
 	      | -clix* | -riscos* | -uniplus* | -iris* | -rtu* | -xenix* \
 	      | -hiux* | -386bsd* | -knetbsd* | -mirbsd* | -netbsd* \
-	      | -bitrig* | -openbsd* | -solidbsd* \
+	      | -bitrig* | -openbsd* | -solidbsd* | -libertybsd* \
 	      | -ekkobsd* | -kfreebsd* | -freebsd* | -riscix* | -lynxos* \
 	      | -bosx* | -nextstep* | -cxux* | -aout* | -elf* | -oabi* \
 	      | -ptx* | -coff* | -ecoff* | -winnt* | -domain* | -vsta* \
 	      | -udi* | -eabi* | -lites* | -ieee* | -go32* | -aux* \
 	      | -chorusos* | -chorusrdb* | -cegcc* \
 	      | -cygwin* | -msys* | -pe* | -psos* | -moss* | -proelf* | -rtems* \
-	      | -mingw32* | -mingw64* | -linux-gnu* | -linux-android* \
+	      | -midipix* | -mingw32* | -mingw64* | -linux-gnu* | -linux-android* \
 	      | -linux-newlib* | -linux-musl* | -linux-uclibc* \
 	      | -uxpv* | -beos* | -mpeix* | -udk* | -moxiebox* \
 	      | -interix* | -uwin* | -mks* | -rhapsody* | -darwin* | -opened* \
@@ -1385,7 +1408,8 @@ case $os in
 	      | -os2* | -vos* | -palmos* | -uclinux* | -nucleus* \
 	      | -morphos* | -superux* | -rtmk* | -rtmk-nova* | -windiss* \
 	      | -powermax* | -dnix* | -nx6 | -nx7 | -sei* | -dragonfly* \
-	      | -skyos* | -haiku* | -rdos* | -toppers* | -drops* | -es* | -tirtos*)
+	      | -skyos* | -haiku* | -rdos* | -toppers* | -drops* | -es* \
+	      | -onefs* | -tirtos* | -phoenix* | -fuchsia*)
 	# Remember, each alternative MUST END IN *, to match a version number.
 		;;
 	-qnx*)
@@ -1517,6 +1541,8 @@ case $os in
 		;;
 	-nacl*)
 		;;
+	-ios)
+		;;
 	-none)
 		;;
 	*)

auto/depcomp

@@ -3,7 +3,7 @@
 
 scriptversion=2013-05-30.07; # UTC
 
-# Copyright (C) 1999-2013 Free Software Foundation, Inc.
+# Copyright (C) 1999-2014 Free Software Foundation, Inc.
 
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by

auto/install-sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 # install - install a program, script, or datafile
 
-scriptversion=2011-11-20.07; # UTC
+scriptversion=2014-09-12.12; # UTC
 
 # This originates from X11R5 (mit/util/scripts/install.sh), which was
 # later released in X11R6 (xc/config/util/install.sh) with the
@@ -41,19 +41,15 @@ scriptversion=2011-11-20.07; # UTC
 # This script is compatible with the BSD install script, but was written
 # from scratch.
 
+tab='	'
 nl='
 '
-IFS=" ""	$nl"
+IFS=" $tab$nl"
 
-# set DOITPROG to echo to test this script
+# Set DOITPROG to "echo" to test this script.
 
-# Don't use :- since 4.3BSD and earlier shells don't like it.
 doit=${DOITPROG-}
-if test -z "$doit"; then
+doit_exec=${doit:-exec}
-  doit_exec=exec
-else
-  doit_exec=$doit
-fi
 
 # Put in absolute file names if you don't have them in your path;
 # or use environment vars.
@@ -68,17 +64,6 @@ mvprog=${MVPROG-mv}
 rmprog=${RMPROG-rm}
 stripprog=${STRIPPROG-strip}
 
-posix_glob='?'
-initialize_posix_glob='
-  test "$posix_glob" != "?" || {
-    if (set -f) 2>/dev/null; then
-      posix_glob=
-    else
-      posix_glob=:
-    fi
-  }
-'
-
 posix_mkdir=
 
 # Desired mode of installed file.
@@ -97,7 +82,7 @@ dir_arg=
 dst_arg=
 
 copy_on_change=false
-no_target_directory=
+is_target_a_directory=possibly
 
 usage="\
 Usage: $0 [OPTION]... [-T] SRCFILE DSTFILE
@@ -143,8 +128,7 @@ while test $# -ne 0; do
 
     -m) mode=$2
         case $mode in
-	  *' '* | *'	'* | *'
+          *' '* | *"$tab"* | *"$nl"* | *'*'* | *'?'* | *'['*)
-'*	  | *'*'* | *'?'* | *'['*)
             echo "$0: invalid mode: $mode" >&2
             exit 1;;
         esac
@@ -155,14 +139,16 @@ while test $# -ne 0; do
 
     -s) stripcmd=$stripprog;;
 
-    -t) dst_arg=$2
+    -t)
+        is_target_a_directory=always
+        dst_arg=$2
         # Protect names problematic for 'test' and other utilities.
         case $dst_arg in
           -* | [=\(\)!]) dst_arg=./$dst_arg;;
         esac
         shift;;
 
-    -T) no_target_directory=true;;
+    -T) is_target_a_directory=never;;
 
     --version) echo "$0 $scriptversion"; exit $?;;
 
@@ -177,6 +163,16 @@ while test $# -ne 0; do
   shift
 done
 
+# We allow the use of options -d and -T together, by making -d
+# take the precedence; this is for compatibility with GNU install.
+
+if test -n "$dir_arg"; then
+  if test -n "$dst_arg"; then
+    echo "$0: target directory not allowed when installing a directory." >&2
+    exit 1
+  fi
+fi
+
 if test $# -ne 0 && test -z "$dir_arg$dst_arg"; then
   # When -d is used, all remaining arguments are directories to create.
   # When -t is used, the destination is already specified.
@@ -207,6 +203,15 @@ if test $# -eq 0; then
   exit 0
 fi
 
+if test -z "$dir_arg"; then
+  if test $# -gt 1 || test "$is_target_a_directory" = always; then
+    if test ! -d "$dst_arg"; then
+      echo "$0: $dst_arg: Is not a directory." >&2
+      exit 1
+    fi
+  fi
+fi
+
 if test -z "$dir_arg"; then
   do_exit='(exit $ret); exit $ret'
   trap "ret=129; $do_exit" 1
@@ -269,7 +274,7 @@ do
     # If destination is a directory, append the input filename; won't work
     # if double slashes aren't ignored.
     if test -d "$dst"; then
-      if test -n "$no_target_directory"; then
+      if test "$is_target_a_directory" = never; then
         echo "$0: $dst_arg: Is a directory" >&2
         exit 1
       fi
@@ -277,33 +282,7 @@ do
       dst=$dstdir/`basename "$src"`
       dstdir_status=0
     else
-      # Prefer dirname, but fall back on a substitute if dirname fails.
+      dstdir=`dirname "$dst"`
-      dstdir=`
-	(dirname "$dst") 2>/dev/null ||
-	expr X"$dst" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \
-	     X"$dst" : 'X\(//\)[^/]' \| \
-	     X"$dst" : 'X\(//\)$' \| \
-	     X"$dst" : 'X\(/\)' \| . 2>/dev/null ||
-	echo X"$dst" |
-	    sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{
-		   s//\1/
-		   q
-		 }
-		 /^X\(\/\/\)[^/].*/{
-		   s//\1/
-		   q
-		 }
-		 /^X\(\/\/\)$/{
-		   s//\1/
-		   q
-		 }
-		 /^X\(\/\).*/{
-		   s//\1/
-		   q
-		 }
-		 s/.*/./; q'
-      `
-
       test -d "$dstdir"
       dstdir_status=$?
     fi
@@ -403,14 +382,12 @@ do
         *)  prefix='';;
       esac
 
-      eval "$initialize_posix_glob"
-
       oIFS=$IFS
       IFS=/
-      $posix_glob set -f
+      set -f
       set fnord $dstdir
       shift
-      $posix_glob set +f
+      set +f
       IFS=$oIFS
 
       prefixes=
@@ -481,13 +458,10 @@ do
     if $copy_on_change &&
        old=`LC_ALL=C ls -dlL "$dst"     2>/dev/null` &&
        new=`LC_ALL=C ls -dlL "$dsttmp"  2>/dev/null` &&
-
+       set -f &&
-       eval "$initialize_posix_glob" &&
-       $posix_glob set -f &&
        set X $old && old=:$2:$4:$5:$6 &&
        set X $new && new=:$2:$4:$5:$6 &&
-       $posix_glob set +f &&
+       set +f &&
-
        test "$old" = "$new" &&
        $cmpprog "$dst" "$dsttmp" >/dev/null 2>&1
     then

auto/missing

@@ -3,7 +3,7 @@
 
 scriptversion=2013-10-28.13; # UTC
 
-# Copyright (C) 1996-2013 Free Software Foundation, Inc.
+# Copyright (C) 1996-2014 Free Software Foundation, Inc.
 # Originally written by Fran,cois Pinard <pinard@iro.umontreal.ca>, 1996.
 
 # This program is free software; you can redistribute it and/or modify

build-android.sh

@@ -1,10 +1,10 @@
 #!/bin/sh
 set -ev
-VERSION=5.42
+VERSION=5.44
 DST=stunnel-$VERSION-android
 
 # to build OpenSSL:
-# ./Configure threads no-shared no-dso --cross-compile-prefix=arm-linux-androideabi- --openssldir=/opt/androideabi/sysroot linux-armv4
+# ./Configure threads no-shared no-dso --cross-compile-prefix=arm-linux-androideabi- --prefix=/opt/androideabi/sysroot linux-armv4
 # make install
 
 test -f Makefile && make distclean

configure.ac

@@ -1,6 +1,6 @@
 # Process this file with autoconf to produce a configure script.
 
-AC_INIT([stunnel],[5.42])
+AC_INIT([stunnel],[5.44])
 AC_MSG_NOTICE([**************************************** initialization])
 AC_CONFIG_AUX_DIR(auto)
 AC_CONFIG_MACRO_DIR([m4])
@@ -461,7 +461,7 @@ CPPFLAGS="$valid_CPPFLAGS"
 LIBS="$valid_LIBS"
 
 AC_MSG_NOTICE([**************************************** write the results])
-AC_CONFIG_FILES([Makefile src/Makefile doc/Makefile tools/Makefile])
+AC_CONFIG_FILES([Makefile src/Makefile doc/Makefile tools/Makefile tests/Makefile])
 AC_OUTPUT
 
 AC_MSG_NOTICE([**************************************** success])

doc/Makefile.in

@@ -1,7 +1,7 @@
-# Makefile.in generated by automake 1.14.1 from Makefile.am.
+# Makefile.in generated by automake 1.15 from Makefile.am.
 # @configure_input@
 
-# Copyright (C) 1994-2013 Free Software Foundation, Inc.
+# Copyright (C) 1994-2014 Free Software Foundation, Inc.
 
 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -17,7 +17,17 @@
 # by Michal Trojnara 2015-2017
 
 VPATH = @srcdir@
-am__is_gnu_make = test -n '$(MAKEFILE_LIST)' && test -n '$(MAKELEVEL)'
+am__is_gnu_make = { \
+  if test -z '$(MAKELEVEL)'; then \
+    false; \
+  elif test -n '$(MAKE_HOST)'; then \
+    true; \
+  elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
+    true; \
+  else \
+    false; \
+  fi; \
+}
 am__make_running_with_option = \
   case $${target_option-} in \
       ?) ;; \
@@ -81,7 +91,6 @@ POST_UNINSTALL = :
 build_triplet = @build@
 host_triplet = @host@
 subdir = doc
-DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/Makefile.am
 ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
 am__aclocal_m4_deps = $(top_srcdir)/m4/libtool.m4 \
 	$(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \
@@ -89,6 +98,7 @@ am__aclocal_m4_deps = $(top_srcdir)/m4/libtool.m4 \
 	$(top_srcdir)/configure.ac
 am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
 	$(ACLOCAL_M4)
+DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
 mkinstalldirs = $(install_sh) -d
 CONFIG_HEADER = $(top_builddir)/src/config.h
 CONFIG_CLEAN_FILES =
@@ -145,6 +155,7 @@ NROFF = nroff
 MANS = $(man_MANS)
 DATA = $(doc_DATA)
 am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
+am__DIST_COMMON = $(srcdir)/Makefile.in
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
 ACLOCAL = @ACLOCAL@
 AMTAR = @AMTAR@
@@ -187,6 +198,7 @@ LIBTOOL_DEPS = @LIBTOOL_DEPS@
 LIPO = @LIPO@
 LN_S = @LN_S@
 LTLIBOBJS = @LTLIBOBJS@
+LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
 MAKEINFO = @MAKEINFO@
 MANIFEST_TOOL = @MANIFEST_TOOL@
 MKDIR_P = @MKDIR_P@
@@ -295,7 +307,6 @@ $(srcdir)/Makefile.in:  $(srcdir)/Makefile.am  $(am__configure_deps)
 	echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu doc/Makefile'; \
 	$(am__cd) $(top_srcdir) && \
 	  $(AUTOMAKE) --gnu doc/Makefile
-.PRECIOUS: Makefile
 Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
 	@case '$?' in \
 	  *config.status*) \
@@ -541,6 +552,8 @@ uninstall-man: uninstall-man8
 	mostlyclean-libtool pdf pdf-am ps ps-am tags-am uninstall \
 	uninstall-am uninstall-docDATA uninstall-man uninstall-man8
 
+.PRECIOUS: Makefile
+
 
 .pod.in.8.in:
 	pod2man -u -n stunnel -s 8 -r $(VERSION) \

m4/ltoptions.m4

@@ -1,14 +1,14 @@
 # Helper functions for option handling.                    -*- Autoconf -*-
 #
-#   Copyright (C) 2004, 2005, 2007, 2008, 2009 Free Software Foundation,
+#   Copyright (C) 2004-2005, 2007-2009, 2011-2015 Free Software
-#   Inc.
+#   Foundation, Inc.
 #   Written by Gary V. Vaughan, 2004
 #
 # This file is free software; the Free Software Foundation gives
 # unlimited permission to copy and/or distribute it, with or without
 # modifications, as long as this notice is preserved.
 
-# serial 7 ltoptions.m4
+# serial 8 ltoptions.m4
 
 # This is to help aclocal find these macros, as it can't see m4_define.
 AC_DEFUN([LTOPTIONS_VERSION], [m4_if([1])])
@@ -29,7 +29,7 @@ m4_define([_LT_SET_OPTION],
 [m4_define(_LT_MANGLE_OPTION([$1], [$2]))dnl
 m4_ifdef(_LT_MANGLE_DEFUN([$1], [$2]),
         _LT_MANGLE_DEFUN([$1], [$2]),
-    [m4_warning([Unknown $1 option `$2'])])[]dnl
+    [m4_warning([Unknown $1 option '$2'])])[]dnl
 ])
 
 
@@ -75,13 +75,15 @@ m4_if([$1],[LT_INIT],[
   dnl
   dnl If no reference was made to various pairs of opposing options, then
   dnl we run the default mode handler for the pair.  For example, if neither
-  dnl `shared' nor `disable-shared' was passed, we enable building of shared
+  dnl 'shared' nor 'disable-shared' was passed, we enable building of shared
   dnl archives by default:
   _LT_UNLESS_OPTIONS([LT_INIT], [shared disable-shared], [_LT_ENABLE_SHARED])
   _LT_UNLESS_OPTIONS([LT_INIT], [static disable-static], [_LT_ENABLE_STATIC])
   _LT_UNLESS_OPTIONS([LT_INIT], [pic-only no-pic], [_LT_WITH_PIC])
   _LT_UNLESS_OPTIONS([LT_INIT], [fast-install disable-fast-install],
 		   [_LT_ENABLE_FAST_INSTALL])
+  _LT_UNLESS_OPTIONS([LT_INIT], [aix-soname=aix aix-soname=both aix-soname=svr4],
+		   [_LT_WITH_AIX_SONAME([aix])])
   ])
 ])# _LT_SET_OPTIONS
 
@@ -112,7 +114,7 @@ AU_DEFUN([AC_LIBTOOL_DLOPEN],
 [_LT_SET_OPTION([LT_INIT], [dlopen])
 AC_DIAGNOSE([obsolete],
 [$0: Remove this warning and the call to _LT_SET_OPTION when you
-put the `dlopen' option into LT_INIT's first parameter.])
+put the 'dlopen' option into LT_INIT's first parameter.])
 ])
 
 dnl aclocal-1.4 backwards compatibility:
@@ -148,7 +150,7 @@ AU_DEFUN([AC_LIBTOOL_WIN32_DLL],
 _LT_SET_OPTION([LT_INIT], [win32-dll])
 AC_DIAGNOSE([obsolete],
 [$0: Remove this warning and the call to _LT_SET_OPTION when you
-put the `win32-dll' option into LT_INIT's first parameter.])
+put the 'win32-dll' option into LT_INIT's first parameter.])
 ])
 
 dnl aclocal-1.4 backwards compatibility:
@@ -157,9 +159,9 @@ dnl AC_DEFUN([AC_LIBTOOL_WIN32_DLL], [])
 
 # _LT_ENABLE_SHARED([DEFAULT])
 # ----------------------------
-# implement the --enable-shared flag, and supports the `shared' and
+# implement the --enable-shared flag, and supports the 'shared' and
-# `disable-shared' LT_INIT options.
+# 'disable-shared' LT_INIT options.
-# DEFAULT is either `yes' or `no'.  If omitted, it defaults to `yes'.
+# DEFAULT is either 'yes' or 'no'.  If omitted, it defaults to 'yes'.
 m4_define([_LT_ENABLE_SHARED],
 [m4_define([_LT_ENABLE_SHARED_DEFAULT], [m4_if($1, no, no, yes)])dnl
 AC_ARG_ENABLE([shared],
@@ -172,14 +174,14 @@ AC_ARG_ENABLE([shared],
     *)
       enable_shared=no
       # Look at the argument we got.  We use all the common list separators.
-      lt_save_ifs="$IFS"; IFS="${IFS}$PATH_SEPARATOR,"
+      lt_save_ifs=$IFS; IFS=$IFS$PATH_SEPARATOR,
       for pkg in $enableval; do
-	IFS="$lt_save_ifs"
+	IFS=$lt_save_ifs
 	if test "X$pkg" = "X$p"; then
 	  enable_shared=yes
 	fi
       done
-      IFS="$lt_save_ifs"
+      IFS=$lt_save_ifs
       ;;
     esac],
     [enable_shared=]_LT_ENABLE_SHARED_DEFAULT)
@@ -211,9 +213,9 @@ dnl AC_DEFUN([AM_DISABLE_SHARED], [])
 
 # _LT_ENABLE_STATIC([DEFAULT])
 # ----------------------------
-# implement the --enable-static flag, and support the `static' and
+# implement the --enable-static flag, and support the 'static' and
-# `disable-static' LT_INIT options.
+# 'disable-static' LT_INIT options.
-# DEFAULT is either `yes' or `no'.  If omitted, it defaults to `yes'.
+# DEFAULT is either 'yes' or 'no'.  If omitted, it defaults to 'yes'.
 m4_define([_LT_ENABLE_STATIC],
 [m4_define([_LT_ENABLE_STATIC_DEFAULT], [m4_if($1, no, no, yes)])dnl
 AC_ARG_ENABLE([static],
@@ -226,14 +228,14 @@ AC_ARG_ENABLE([static],
     *)
      enable_static=no
       # Look at the argument we got.  We use all the common list separators.
-      lt_save_ifs="$IFS"; IFS="${IFS}$PATH_SEPARATOR,"
+      lt_save_ifs=$IFS; IFS=$IFS$PATH_SEPARATOR,
       for pkg in $enableval; do
-	IFS="$lt_save_ifs"
+	IFS=$lt_save_ifs
 	if test "X$pkg" = "X$p"; then
 	  enable_static=yes
 	fi
       done
-      IFS="$lt_save_ifs"
+      IFS=$lt_save_ifs
       ;;
     esac],
     [enable_static=]_LT_ENABLE_STATIC_DEFAULT)
@@ -265,9 +267,9 @@ dnl AC_DEFUN([AM_DISABLE_STATIC], [])
 
 # _LT_ENABLE_FAST_INSTALL([DEFAULT])
 # ----------------------------------
-# implement the --enable-fast-install flag, and support the `fast-install'
+# implement the --enable-fast-install flag, and support the 'fast-install'
-# and `disable-fast-install' LT_INIT options.
+# and 'disable-fast-install' LT_INIT options.
-# DEFAULT is either `yes' or `no'.  If omitted, it defaults to `yes'.
+# DEFAULT is either 'yes' or 'no'.  If omitted, it defaults to 'yes'.
 m4_define([_LT_ENABLE_FAST_INSTALL],
 [m4_define([_LT_ENABLE_FAST_INSTALL_DEFAULT], [m4_if($1, no, no, yes)])dnl
 AC_ARG_ENABLE([fast-install],
@@ -280,14 +282,14 @@ AC_ARG_ENABLE([fast-install],
     *)
       enable_fast_install=no
       # Look at the argument we got.  We use all the common list separators.
-      lt_save_ifs="$IFS"; IFS="${IFS}$PATH_SEPARATOR,"
+      lt_save_ifs=$IFS; IFS=$IFS$PATH_SEPARATOR,
       for pkg in $enableval; do
-	IFS="$lt_save_ifs"
+	IFS=$lt_save_ifs
 	if test "X$pkg" = "X$p"; then
 	  enable_fast_install=yes
 	fi
       done
-      IFS="$lt_save_ifs"
+      IFS=$lt_save_ifs
       ;;
     esac],
     [enable_fast_install=]_LT_ENABLE_FAST_INSTALL_DEFAULT)
@@ -304,14 +306,14 @@ AU_DEFUN([AC_ENABLE_FAST_INSTALL],
 [_LT_SET_OPTION([LT_INIT], m4_if([$1], [no], [disable-])[fast-install])
 AC_DIAGNOSE([obsolete],
 [$0: Remove this warning and the call to _LT_SET_OPTION when you put
-the `fast-install' option into LT_INIT's first parameter.])
+the 'fast-install' option into LT_INIT's first parameter.])
 ])
 
 AU_DEFUN([AC_DISABLE_FAST_INSTALL],
 [_LT_SET_OPTION([LT_INIT], [disable-fast-install])
 AC_DIAGNOSE([obsolete],
 [$0: Remove this warning and the call to _LT_SET_OPTION when you put
-the `disable-fast-install' option into LT_INIT's first parameter.])
+the 'disable-fast-install' option into LT_INIT's first parameter.])
 ])
 
 dnl aclocal-1.4 backwards compatibility:
@@ -319,11 +321,64 @@ dnl AC_DEFUN([AC_ENABLE_FAST_INSTALL], [])
 dnl AC_DEFUN([AM_DISABLE_FAST_INSTALL], [])
 
 
+# _LT_WITH_AIX_SONAME([DEFAULT])
+# ----------------------------------
+# implement the --with-aix-soname flag, and support the `aix-soname=aix'
+# and `aix-soname=both' and `aix-soname=svr4' LT_INIT options. DEFAULT
+# is either `aix', `both' or `svr4'.  If omitted, it defaults to `aix'.
+m4_define([_LT_WITH_AIX_SONAME],
+[m4_define([_LT_WITH_AIX_SONAME_DEFAULT], [m4_if($1, svr4, svr4, m4_if($1, both, both, aix))])dnl
+shared_archive_member_spec=
+case $host,$enable_shared in
+power*-*-aix[[5-9]]*,yes)
+  AC_MSG_CHECKING([which variant of shared library versioning to provide])
+  AC_ARG_WITH([aix-soname],
+    [AS_HELP_STRING([--with-aix-soname=aix|svr4|both],
+      [shared library versioning (aka "SONAME") variant to provide on AIX, @<:@default=]_LT_WITH_AIX_SONAME_DEFAULT[@:>@.])],
+    [case $withval in
+    aix|svr4|both)
+      ;;
+    *)
+      AC_MSG_ERROR([Unknown argument to --with-aix-soname])
+      ;;
+    esac
+    lt_cv_with_aix_soname=$with_aix_soname],
+    [AC_CACHE_VAL([lt_cv_with_aix_soname],
+      [lt_cv_with_aix_soname=]_LT_WITH_AIX_SONAME_DEFAULT)
+    with_aix_soname=$lt_cv_with_aix_soname])
+  AC_MSG_RESULT([$with_aix_soname])
+  if test aix != "$with_aix_soname"; then
+    # For the AIX way of multilib, we name the shared archive member
+    # based on the bitwidth used, traditionally 'shr.o' or 'shr_64.o',
+    # and 'shr.imp' or 'shr_64.imp', respectively, for the Import File.
+    # Even when GNU compilers ignore OBJECT_MODE but need '-maix64' flag,
+    # the AIX toolchain works better with OBJECT_MODE set (default 32).
+    if test 64 = "${OBJECT_MODE-32}"; then
+      shared_archive_member_spec=shr_64
+    else
+      shared_archive_member_spec=shr
+    fi
+  fi
+  ;;
+*)
+  with_aix_soname=aix
+  ;;
+esac
+
+_LT_DECL([], [shared_archive_member_spec], [0],
+    [Shared archive member basename, for filename based shared library versioning on AIX])dnl
+])# _LT_WITH_AIX_SONAME
+
+LT_OPTION_DEFINE([LT_INIT], [aix-soname=aix], [_LT_WITH_AIX_SONAME([aix])])
+LT_OPTION_DEFINE([LT_INIT], [aix-soname=both], [_LT_WITH_AIX_SONAME([both])])
+LT_OPTION_DEFINE([LT_INIT], [aix-soname=svr4], [_LT_WITH_AIX_SONAME([svr4])])
+
+
 # _LT_WITH_PIC([MODE])
 # --------------------
-# implement the --with-pic flag, and support the `pic-only' and `no-pic'
+# implement the --with-pic flag, and support the 'pic-only' and 'no-pic'
 # LT_INIT options.
-# MODE is either `yes' or `no'.  If omitted, it defaults to `both'.
+# MODE is either 'yes' or 'no'.  If omitted, it defaults to 'both'.
 m4_define([_LT_WITH_PIC],
 [AC_ARG_WITH([pic],
     [AS_HELP_STRING([--with-pic@<:@=PKGS@:>@],
@@ -334,19 +389,17 @@ m4_define([_LT_WITH_PIC],
     *)
       pic_mode=default
       # Look at the argument we got.  We use all the common list separators.
-      lt_save_ifs="$IFS"; IFS="${IFS}$PATH_SEPARATOR,"
+      lt_save_ifs=$IFS; IFS=$IFS$PATH_SEPARATOR,
       for lt_pkg in $withval; do
-	IFS="$lt_save_ifs"
+	IFS=$lt_save_ifs
 	if test "X$lt_pkg" = "X$lt_p"; then
 	  pic_mode=yes
 	fi
       done
-      IFS="$lt_save_ifs"
+      IFS=$lt_save_ifs
       ;;
     esac],
-    [pic_mode=default])
+    [pic_mode=m4_default([$1], [default])])
-
-test -z "$pic_mode" && pic_mode=m4_default([$1], [default])
 
 _LT_DECL([], [pic_mode], [0], [What type of objects to build])dnl
 ])# _LT_WITH_PIC
@@ -359,7 +412,7 @@ AU_DEFUN([AC_LIBTOOL_PICMODE],
 [_LT_SET_OPTION([LT_INIT], [pic-only])
 AC_DIAGNOSE([obsolete],
 [$0: Remove this warning and the call to _LT_SET_OPTION when you
-put the `pic-only' option into LT_INIT's first parameter.])
+put the 'pic-only' option into LT_INIT's first parameter.])
 ])
 
 dnl aclocal-1.4 backwards compatibility:

m4/ltsugar.m4

@@ -1,6 +1,7 @@
 # ltsugar.m4 -- libtool m4 base layer.                         -*-Autoconf-*-
 #
-# Copyright (C) 2004, 2005, 2007, 2008 Free Software Foundation, Inc.
+# Copyright (C) 2004-2005, 2007-2008, 2011-2015 Free Software
+# Foundation, Inc.
 # Written by Gary V. Vaughan, 2004
 #
 # This file is free software; the Free Software Foundation gives
@@ -33,7 +34,7 @@ m4_define([_lt_join],
 # ------------
 # Manipulate m4 lists.
 # These macros are necessary as long as will still need to support
-# Autoconf-2.59 which quotes differently.
+# Autoconf-2.59, which quotes differently.
 m4_define([lt_car], [[$1]])
 m4_define([lt_cdr],
 [m4_if([$#], 0, [m4_fatal([$0: cannot be called without arguments])],
@@ -44,7 +45,7 @@ m4_define([lt_unquote], $1)
 
 # lt_append(MACRO-NAME, STRING, [SEPARATOR])
 # ------------------------------------------
-# Redefine MACRO-NAME to hold its former content plus `SEPARATOR'`STRING'.
+# Redefine MACRO-NAME to hold its former content plus 'SEPARATOR''STRING'.
 # Note that neither SEPARATOR nor STRING are expanded; they are appended
 # to MACRO-NAME as is (leaving the expansion for when MACRO-NAME is invoked).
 # No SEPARATOR is output if MACRO-NAME was previously undefined (different

m4/ltversion.m4

@@ -1,6 +1,6 @@
 # ltversion.m4 -- version numbers			-*- Autoconf -*-
 #
-#   Copyright (C) 2004 Free Software Foundation, Inc.
+#   Copyright (C) 2004, 2011-2015 Free Software Foundation, Inc.
 #   Written by Scott James Remnant, 2004
 #
 # This file is free software; the Free Software Foundation gives
@@ -9,15 +9,15 @@
 
 # @configure_input@
 
-# serial 3337 ltversion.m4
+# serial 4179 ltversion.m4
 # This file is part of GNU Libtool
 
-m4_define([LT_PACKAGE_VERSION], [2.4.2])
+m4_define([LT_PACKAGE_VERSION], [2.4.6])
-m4_define([LT_PACKAGE_REVISION], [1.3337])
+m4_define([LT_PACKAGE_REVISION], [2.4.6])
 
 AC_DEFUN([LTVERSION_VERSION],
-[macro_version='2.4.2'
+[macro_version='2.4.6'
-macro_revision='1.3337'
+macro_revision='2.4.6'
 _LT_DECL(, macro_version, 0, [Which release of libtool.m4 was used?])
 _LT_DECL(, macro_revision, 0)
 ])

m4/lt~obsolete.m4

@@ -1,6 +1,7 @@
 # lt~obsolete.m4 -- aclocal satisfying obsolete definitions.    -*-Autoconf-*-
 #
-#   Copyright (C) 2004, 2005, 2007, 2009 Free Software Foundation, Inc.
+#   Copyright (C) 2004-2005, 2007, 2009, 2011-2015 Free Software
+#   Foundation, Inc.
 #   Written by Scott James Remnant, 2004.
 #
 # This file is free software; the Free Software Foundation gives
@@ -11,7 +12,7 @@
 
 # These exist entirely to fool aclocal when bootstrapping libtool.
 #
-# In the past libtool.m4 has provided macros via AC_DEFUN (or AU_DEFUN)
+# In the past libtool.m4 has provided macros via AC_DEFUN (or AU_DEFUN),
 # which have later been changed to m4_define as they aren't part of the
 # exported API, or moved to Autoconf or Automake where they belong.
 #

src/Makefile.am

@@ -66,7 +66,7 @@ libstunnel_la_LDFLAGS = -avoid-version
 
 if AUTHOR_TESTS
 # Just check if the programs can be built, don't perform any actual tests
-check-local: mingw mingw64
+#check-local: mingw mingw64
 endif
 
 mingw:

src/Makefile.in

@@ -1,7 +1,7 @@
-# Makefile.in generated by automake 1.14.1 from Makefile.am.
+# Makefile.in generated by automake 1.15 from Makefile.am.
 # @configure_input@
 
-# Copyright (C) 1994-2013 Free Software Foundation, Inc.
+# Copyright (C) 1994-2014 Free Software Foundation, Inc.
 
 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -23,7 +23,17 @@
 
 
 VPATH = @srcdir@
-am__is_gnu_make = test -n '$(MAKEFILE_LIST)' && test -n '$(MAKELEVEL)'
+am__is_gnu_make = { \
+  if test -z '$(MAKELEVEL)'; then \
+    false; \
+  elif test -n '$(MAKE_HOST)'; then \
+    true; \
+  elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
+    true; \
+  else \
+    false; \
+  fi; \
+}
 am__make_running_with_option = \
   case $${target_option-} in \
       ?) ;; \
@@ -88,8 +98,6 @@ build_triplet = @build@
 host_triplet = @host@
 bin_PROGRAMS = stunnel$(EXEEXT)
 subdir = src
-DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/Makefile.am \
-	$(srcdir)/config.h.in $(top_srcdir)/auto/depcomp
 ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
 am__aclocal_m4_deps = $(top_srcdir)/m4/libtool.m4 \
 	$(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \
@@ -97,6 +105,7 @@ am__aclocal_m4_deps = $(top_srcdir)/m4/libtool.m4 \
 	$(top_srcdir)/configure.ac
 am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
 	$(ACLOCAL_M4)
+DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
 mkinstalldirs = $(install_sh) -d
 CONFIG_HEADER = config.h
 CONFIG_CLEAN_FILES =
@@ -224,6 +233,8 @@ am__define_uniq_tagged_files = \
   done | $(am__uniquify_input)`
 ETAGS = etags
 CTAGS = ctags
+am__DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/config.h.in \
+	$(top_srcdir)/auto/depcomp
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
 ACLOCAL = @ACLOCAL@
 AMTAR = @AMTAR@
@@ -266,6 +277,7 @@ LIBTOOL_DEPS = @LIBTOOL_DEPS@
 LIPO = @LIPO@
 LN_S = @LN_S@
 LTLIBOBJS = @LTLIBOBJS@
+LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
 MAKEINFO = @MAKEINFO@
 MANIFEST_TOOL = @MANIFEST_TOOL@
 MKDIR_P = @MKDIR_P@
@@ -401,7 +413,6 @@ $(srcdir)/Makefile.in:  $(srcdir)/Makefile.am  $(am__configure_deps)
 	echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/Makefile'; \
 	$(am__cd) $(top_srcdir) && \
 	  $(AUTOMAKE) --gnu src/Makefile
-.PRECIOUS: Makefile
 Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
 	@case '$?' in \
 	  *config.status*) \
@@ -978,9 +989,7 @@ distdir: $(DISTFILES)
 	    || exit 1; \
 	  fi; \
 	done
-@AUTHOR_TESTS_FALSE@check-local:
 check-am: all-am
-	$(MAKE) $(AM_MAKEFLAGS) check-local
 check: check-am
 all-am: Makefile $(LTLIBRARIES) $(PROGRAMS) $(SCRIPTS) config.h
 installdirs:
@@ -1091,9 +1100,9 @@ ps-am:
 uninstall-am: uninstall-binPROGRAMS uninstall-binSCRIPTS \
 	uninstall-pkglibLTLIBRARIES
 
-.MAKE: all check-am install-am install-strip
+.MAKE: all install-am install-strip
 
-.PHONY: CTAGS GTAGS TAGS all all-am check check-am check-local clean \
+.PHONY: CTAGS GTAGS TAGS all all-am check check-am clean \
 	clean-binPROGRAMS clean-generic clean-libtool clean-local \
 	clean-pkglibLTLIBRARIES cscopelist-am ctags ctags-am distclean \
 	distclean-compile distclean-generic distclean-hdr \
@@ -1110,6 +1119,8 @@ uninstall-am: uninstall-binPROGRAMS uninstall-binSCRIPTS \
 	tags tags-am uninstall uninstall-am uninstall-binPROGRAMS \
 	uninstall-binSCRIPTS uninstall-pkglibLTLIBRARIES
 
+.PRECIOUS: Makefile
+
 
 ###############################################################################
 # Generate a new set of DH parameters for each version                        #
@@ -1130,7 +1141,7 @@ stunnel3: $(srcdir)/stunnel3.in
 ###############################################################################
 
 # Just check if the programs can be built, don't perform any actual tests
-@AUTHOR_TESTS_TRUE@check-local: mingw mingw64
+#check-local: mingw mingw64
 
 mingw:
 	$(MAKE) -f $(srcdir)/mingw.mk srcdir=$(srcdir) win32_targetcpu=i686 win32_mingw=mingw

src/client.c

@@ -85,6 +85,7 @@ CLI *alloc_client_session(SERVICE_OPTIONS *opt, SOCKET rfd, SOCKET wfd) {
     c->local_rfd.fd=rfd;
     c->local_wfd.fd=wfd;
     c->seq=seq++;
+    c->opt->seq++;
     return c;
 }
 
@@ -254,7 +255,8 @@ NOEXPORT void client_run(CLI *c) {
 
         /* free the client context */
     str_free(c->connect_addr.addr);
-    /* we currently don't make a local copy of c->connect_addr.session */
+    /* a client does not have its own local copy of
+       c->connect_addr.session and c->connect_addr.fd */
     s_poll_free(c->fds);
     c->fds=NULL;
 }
@@ -646,21 +648,18 @@ NOEXPORT void transfer(CLI *c) {
                     s_poll_err(c->fds, c->sock_rfd->fd)) {
                 err=get_socket_error(c->sock_rfd->fd);
                 if(err)
-                    s_log(LOG_ERR, "socket fd: %s (%d)",
+                    log_error(LOG_INFO, err, "socket fd");
-                        s_strerror(err), err);
             }
         } else {
             if(sock_can_rd && s_poll_err(c->fds, c->sock_rfd->fd)) {
                 err=get_socket_error(c->sock_rfd->fd);
                 if(err)
-                    s_log(LOG_ERR, "socket rfd: %s (%d)",
+                    log_error(LOG_INFO, err, "socket rfd");
-                        s_strerror(err), err);
             }
             if(sock_can_wr && s_poll_err(c->fds, c->sock_wfd->fd)) {
                 err=get_socket_error(c->sock_wfd->fd);
                 if(err)
-                    s_log(LOG_ERR, "socket wfd: %s (%d)",
+                    log_error(LOG_INFO, err, "socket wfd");
-                        s_strerror(err), err);
             }
         }
         if(c->ssl_rfd->fd==c->ssl_wfd->fd) {
@@ -668,22 +667,19 @@ NOEXPORT void transfer(CLI *c) {
                     s_poll_err(c->fds, c->ssl_rfd->fd)) {
                 err=get_socket_error(c->ssl_rfd->fd);
                 if(err)
-                    s_log(LOG_ERR, "TLS fd: %s (%d)",
+                    log_error(LOG_INFO, err, "TLS fd");
-                        s_strerror(err), err);
             }
         } else {
             if(ssl_can_rd && s_poll_err(c->fds, c->ssl_rfd->fd)) {
                 err=get_socket_error(c->ssl_rfd->fd);
                 if(err)
-                    s_log(LOG_ERR, "TLS rfd: %s (%d)",
+                    log_error(LOG_INFO, err, "TLS rfd");
-                        s_strerror(err), err);
             }
             if(c->ssl_rfd->fd!=c->ssl_wfd->fd &&
                     ssl_can_wr && s_poll_err(c->fds, c->ssl_wfd->fd)) {
                 err=get_socket_error(c->ssl_wfd->fd);
                 if(err)
-                    s_log(LOG_ERR, "TLS wfd: %s (%d)",
+                    log_error(LOG_INFO, err, "TLS wfd");
-                        s_strerror(err), err);
             }
         }
 
@@ -736,6 +732,10 @@ NOEXPORT void transfer(CLI *c) {
                 SSL_set_shutdown(c->ssl, SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
                 shutdown_wants_read=shutdown_wants_write=0;
                 break;
+            case SSL_ERROR_ZERO_RETURN: /* connection closed */
+                SSL_set_shutdown(c->ssl, SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
+                shutdown_wants_read=shutdown_wants_write=0;
+                break;
             case SSL_ERROR_WANT_WRITE:
                 s_log(LOG_DEBUG, "SSL_shutdown returned WANT_WRITE: retrying");
                 shutdown_wants_read=0;
@@ -1109,6 +1109,7 @@ NOEXPORT void auth_user(CLI *c, char *accepted_address) {
 #endif
     SOCKADDR_UNION ident;     /* IDENT socket name */
     char *line, *type, *system, *user;
+    unsigned remote_port, local_port;
 
     if(!c->opt->username)
         return; /* -u option not specified */
@@ -1136,9 +1137,10 @@ NOEXPORT void auth_user(CLI *c, char *accepted_address) {
     if(s_connect(c, &ident, addr_len(&ident)))
         longjmp(c->err, 1);
     s_log(LOG_DEBUG, "IDENT server connected");
-    fd_printf(c, c->fd, "%u , %u",
+    remote_port=ntohs(c->peer_addr.in.sin_port);
-        ntohs(c->peer_addr.in.sin_port),
+    local_port=(unsigned)(c->opt->local_addr.addr ?
-        ntohs(c->opt->local_addr.in.sin_port));
+        ntohs(c->opt->local_addr.addr[0].in.sin_port) : 0);
+    fd_printf(c, c->fd, "%u , %u", remote_port, local_port);
     line=fd_getline(c, c->fd);
     closesocket(c->fd);
     c->fd=INVALID_SOCKET; /* avoid double close on cleanup */
@@ -1443,9 +1445,7 @@ NOEXPORT unsigned idx_cache_retrieve(CLI *c) {
     }
 
     if(c->opt->failover==FAILOVER_RR) {
-        /* the race condition here can be safely ignored */
+        i=(c->connect_addr.start+c->opt->seq)%c->connect_addr.num;
-        i=c->connect_addr.parent->rr;
-        c->connect_addr.parent->rr=(i+1)%c->connect_addr.num;
         s_log(LOG_INFO, "failover: round-robin, starting at entry #%d", i);
     } else {
         i=0;

src/config.h.in

@@ -207,8 +207,7 @@
 /* Host description */
 #undef HOST
 
-/* Define to the sub-directory in which libtool stores uninstalled libraries.
+/* Define to the sub-directory where libtool stores uninstalled libraries. */
-   */
 #undef LT_OBJDIR
 
 /* Name of package */

src/dhparam.c

@@ -8,32 +8,32 @@
 DH *get_dh2048()
 {
     static unsigned char dhp_2048[] = {
-	0xE5, 0x09, 0xEB, 0x6B, 0x7E, 0xFF, 0x06, 0x2E, 0xE9, 0x8E, 
+	0xEF, 0xED, 0x5C, 0xA2, 0x8E, 0x37, 0xD8, 0xF4, 0xD1, 0xE9, 
-	0xEB, 0xB8, 0x15, 0x2E, 0x83, 0xE9, 0x77, 0x6B, 0x98, 0x80, 
+	0x85, 0x06, 0x79, 0x0E, 0xC0, 0xBC, 0xD2, 0xF3, 0xBC, 0x26, 
-	0xC2, 0x5B, 0xC7, 0x99, 0xEF, 0xD2, 0x3B, 0x75, 0x23, 0xD1, 
+	0xAE, 0x63, 0xB9, 0x06, 0xDF, 0x16, 0xDB, 0xE5, 0x76, 0x76, 
-	0xEF, 0x4D, 0x2C, 0xE6, 0xE5, 0xD3, 0x6A, 0x5E, 0x38, 0x4A, 
+	0xD5, 0xBC, 0x4F, 0xC1, 0x55, 0x28, 0xC9, 0x7A, 0xC8, 0xD6, 
-	0x05, 0x15, 0x57, 0xFF, 0x46, 0x22, 0x0F, 0xDC, 0xC9, 0xF0, 
+	0x1E, 0xB0, 0x5D, 0x85, 0x12, 0x39, 0x62, 0x06, 0x9D, 0x99, 
-	0xA0, 0x4C, 0x2B, 0x70, 0x91, 0x30, 0x32, 0x3A, 0x20, 0x38, 
+	0x4D, 0xCF, 0x79, 0x27, 0x94, 0xB6, 0xE1, 0xC2, 0x92, 0x06, 
-	0xB6, 0x62, 0xAE, 0x8C, 0x9E, 0x9B, 0x7A, 0x04, 0xCF, 0x9C, 
+	0xA3, 0xCF, 0x10, 0x25, 0xC4, 0x3D, 0x01, 0xD2, 0x34, 0x0C, 
-	0x20, 0x0C, 0x9D, 0x34, 0xFC, 0xB5, 0x46, 0x9E, 0xB6, 0x56, 
+	0x1F, 0xB2, 0xA3, 0x0D, 0xA8, 0xDC, 0xB6, 0x5F, 0xDB, 0x8C, 
-	0x94, 0x7A, 0x8E, 0x7B, 0xEA, 0x77, 0x3D, 0x1F, 0x57, 0xAD, 
+	0xF6, 0x73, 0xC2, 0x07, 0x70, 0x4D, 0x01, 0x85, 0xE8, 0x49, 
-	0xB0, 0xB7, 0xD6, 0x2E, 0x95, 0x5B, 0xA7, 0x1E, 0xF1, 0x84, 
+	0xBC, 0xC1, 0x80, 0x6C, 0x77, 0x71, 0xFF, 0x5D, 0x25, 0x2F, 
-	0x04, 0x7C, 0x77, 0x9B, 0x10, 0x8D, 0x5F, 0xA5, 0x2B, 0x0D, 
+	0x64, 0x5F, 0x0D, 0x33, 0xB3, 0x43, 0x24, 0xC0, 0xFC, 0xB3, 
-	0xCB, 0xFB, 0xB9, 0x0A, 0xCB, 0xDD, 0x70, 0x9F, 0x85, 0xBA, 
+	0x94, 0xEA, 0xF2, 0xB7, 0x24, 0x08, 0x12, 0x74, 0x9D, 0xEA, 
-	0xE3, 0x6A, 0xD1, 0xE4, 0x83, 0x7B, 0x89, 0x66, 0xAC, 0x58, 
+	0x20, 0x31, 0xD7, 0x0C, 0x0A, 0x84, 0x37, 0xCF, 0x34, 0x56, 
-	0x12, 0x43, 0x5B, 0xA8, 0x02, 0xC0, 0x5C, 0x27, 0x61, 0x97, 
+	0x85, 0xFB, 0xF4, 0x7C, 0xF4, 0x4E, 0x67, 0x0E, 0x63, 0xB2, 
-	0x5D, 0xEC, 0x94, 0x71, 0xB2, 0x13, 0x13, 0xAB, 0x30, 0x0C, 
+	0x49, 0xAF, 0xA6, 0x43, 0xD3, 0x6E, 0x60, 0xA9, 0x96, 0xD6, 
-	0x54, 0x54, 0x8C, 0xE2, 0x9D, 0x07, 0xDE, 0xE7, 0x62, 0x70, 
+	0xE8, 0x63, 0x7E, 0x23, 0x39, 0x91, 0xE1, 0xF6, 0xC3, 0x8B, 
-	0xDE, 0x6C, 0x48, 0xD7, 0x69, 0xDA, 0xBC, 0xDA, 0xB1, 0x82, 
+	0x60, 0x92, 0x73, 0xB9, 0x5A, 0x69, 0xDF, 0x8A, 0xD4, 0x0E, 
-	0xE4, 0xD7, 0xE4, 0xFB, 0x6D, 0x36, 0x46, 0x55, 0x30, 0x63, 
+	0x1C, 0x95, 0x82, 0x59, 0xE4, 0x3B, 0xA8, 0xAC, 0x46, 0x47, 
-	0x18, 0x42, 0x82, 0x60, 0xE2, 0x76, 0x23, 0x56, 0x34, 0x25, 
+	0xE2, 0xFE, 0x98, 0xD7, 0xC2, 0xD4, 0xC6, 0x0A, 0xC5, 0x23, 
-	0xA9, 0x6A, 0xF1, 0x06, 0xB1, 0x68, 0xAD, 0x7F, 0xCE, 0x06, 
+	0x98, 0xCA, 0x0C, 0x5A, 0x82, 0xE1, 0x17, 0xC8, 0xA4, 0x5C, 
-	0xEE, 0x85, 0xA5, 0x83, 0x85, 0x08, 0x45, 0x45, 0x09, 0xA7, 
+	0x43, 0x2A, 0xE5, 0x5B, 0x20, 0x7C, 0x36, 0x90, 0x71, 0xB6, 
-	0x3D, 0xC9, 0xAC, 0xE6, 0x3A, 0x98, 0x93, 0xBF, 0x98, 0x2E, 
+	0x02, 0x55, 0xF5, 0x26, 0x13, 0xCF, 0xB3, 0x4C, 0xB7, 0x89, 
-	0x4D, 0x00, 0x3B, 0x74, 0x62, 0x7B, 0x8D, 0xBD, 0x18, 0x6C, 
+	0x57, 0xC8, 0x27, 0x28, 0x72, 0x04, 0xF1, 0x78, 0x4B, 0xFF, 
-	0xAC, 0x4B, 0xEF, 0xF5, 0xAD, 0x0E, 0x2E, 0x85, 0x60, 0xE6, 
+	0xB3, 0x78, 0x60, 0x79, 0xEF, 0xDD, 0xDE, 0x34, 0x88, 0xE2, 
-	0xF4, 0x3F, 0x25, 0xFE, 0xAE, 0xC3, 0x18, 0x9B, 0x04, 0x7B, 
+	0x00, 0x13, 0xED, 0x4B, 0x9F, 0xE7, 0x71, 0xBA, 0x68, 0xF6, 
-	0xC7, 0x48, 0xE8, 0xC1, 0x3C, 0x13
+	0xD2, 0x9E, 0xF3, 0x3B, 0x2D, 0x2B
     };
     static unsigned char dhg_2048[] = {
 	0x02

src/log.c

@@ -38,8 +38,8 @@
 #include "common.h"
 #include "prototypes.h"
 
-NOEXPORT void log_raw(const SERVICE_OPTIONS *, const int,
+NOEXPORT void log_queue(SERVICE_OPTIONS *, int, char *, char *, char *);
-    const char *, const char *, const char *);
+NOEXPORT void log_raw(SERVICE_OPTIONS *, int, char *, char *, char *);
 NOEXPORT void safestring(char *);
 
 static DISK_FILE *outfile=NULL;
@@ -115,34 +115,9 @@ void log_close(void) {
     stunnel_write_unlock(&stunnel_locks[LOCK_LOG_MODE]);
 }
 
-void log_flush(LOG_MODE new_mode) {
-    struct LIST *tmp;
-
-    stunnel_write_lock(&stunnel_locks[LOCK_LOG_MODE]);
-    /* prevent changing LOG_MODE_CONFIGURED to LOG_MODE_ERROR
-     * once stderr file descriptor is closed */
-    if(log_mode!=LOG_MODE_CONFIGURED)
-        log_mode=new_mode;
-    /* log_raw() will use the new value of log_mode */
-    stunnel_write_lock(&stunnel_locks[LOCK_LOG_BUFFER]);
-    while(head) {
-        log_raw(head->opt, head->level, head->stamp, head->id, head->text);
-        str_free(head->stamp);
-        str_free(head->id);
-        str_free(head->text);
-        tmp=head;
-        head=head->next;
-        str_free(tmp);
-    }
-    head=tail=NULL;
-    stunnel_write_unlock(&stunnel_locks[LOCK_LOG_BUFFER]);
-    stunnel_write_unlock(&stunnel_locks[LOCK_LOG_MODE]);
-}
-
 void s_log(int level, const char *format, ...) {
     va_list ap;
     char *text, *stamp, *id;
-    struct LIST *tmp;
 #ifdef USE_WIN32
     DWORD libc_error;
 #else
@@ -156,6 +131,9 @@ void s_log(int level, const char *format, ...) {
 #endif
     TLS_DATA *tls_data;
 
+    libc_error=get_last_error();
+    socket_error=get_last_socket_error();
+
     tls_data=tls_get();
     if(!tls_data) {
         tls_data=tls_alloc(NULL, NULL, "log");
@@ -164,12 +142,7 @@ void s_log(int level, const char *format, ...) {
     }
 
     /* performance optimization: skip the trivial case early */
-    if(log_mode==LOG_MODE_CONFIGURED && level>tls_data->opt->log_level)
+    if(log_mode!=LOG_MODE_CONFIGURED || level<=tls_data->opt->log_level) {
-        return;
-
-    libc_error=get_last_error();
-    socket_error=get_last_socket_error();
-
         /* format the id to be logged */
         time(&gmt);
 #if defined(HAVE_LOCALTIME_R) && defined(_REENTRANT)
@@ -188,12 +161,27 @@ void s_log(int level, const char *format, ...) {
         va_end(ap);
         safestring(text);
 
+        /* either log or queue for logging */
         stunnel_read_lock(&stunnel_locks[LOCK_LOG_MODE]);
-    if(log_mode==LOG_MODE_BUFFER) { /* save the text to log it later */
+        if(log_mode==LOG_MODE_BUFFER)
-        stunnel_write_lock(&stunnel_locks[LOCK_LOG_BUFFER]);
+            log_queue(tls_data->opt, level, stamp, id, text);
+        else
+            log_raw(tls_data->opt, level, stamp, id, text);
+        stunnel_read_unlock(&stunnel_locks[LOCK_LOG_MODE]);
+    }
+
+    set_last_error(libc_error);
+    set_last_socket_error(socket_error);
+}
+
+NOEXPORT void log_queue(SERVICE_OPTIONS *opt,
+        int level, char *stamp, char *id, char *text) {
+    struct LIST *tmp;
+
+    /* make a new element */
     tmp=str_alloc_detached(sizeof(struct LIST));
     tmp->next=NULL;
-        tmp->opt=tls_data->opt;
+    tmp->opt=opt;
     tmp->level=level;
     tmp->stamp=stamp;
     str_detach(tmp->stamp);
@@ -201,31 +189,46 @@ void s_log(int level, const char *format, ...) {
     str_detach(tmp->id);
     tmp->text=text;
     str_detach(tmp->text);
+
+    /* append the new element to the list */
+    stunnel_write_lock(&stunnel_locks[LOCK_LOG_BUFFER]);
     if(tail)
         tail->next=tmp;
     else
         head=tmp;
     tail=tmp;
     stunnel_write_unlock(&stunnel_locks[LOCK_LOG_BUFFER]);
-    } else { /* ready log the text directly */
-        log_raw(tls_data->opt, level, stamp, id, text);
-        str_free(stamp);
-        str_free(id);
-        str_free(text);
-    }
-    stunnel_read_unlock(&stunnel_locks[LOCK_LOG_MODE]);
-
-    set_last_error(libc_error);
-    set_last_socket_error(socket_error);
 }
 
-NOEXPORT void log_raw(const SERVICE_OPTIONS *opt,
+void log_flush(LOG_MODE new_mode) {
-        const int level, const char *stamp,
+    stunnel_write_lock(&stunnel_locks[LOCK_LOG_MODE]);
-        const char *id, const char *text) {
+    /* prevent changing LOG_MODE_CONFIGURED to LOG_MODE_ERROR
+     * once stderr file descriptor is closed */
+    if(log_mode!=LOG_MODE_CONFIGURED)
+        log_mode=new_mode;
+    /* log_raw() will use the new value of log_mode */
+    stunnel_write_lock(&stunnel_locks[LOCK_LOG_BUFFER]);
+    while(head) {
+        struct LIST *tmp=head;
+        head=head->next;
+        log_raw(tmp->opt, tmp->level, tmp->stamp, tmp->id, tmp->text);
+        str_free(tmp);
+    }
+    head=tail=NULL;
+    stunnel_write_unlock(&stunnel_locks[LOCK_LOG_BUFFER]);
+    stunnel_write_unlock(&stunnel_locks[LOCK_LOG_MODE]);
+}
+
+NOEXPORT void log_raw(SERVICE_OPTIONS *opt,
+        int level, char *stamp, char *id, char *text) {
     char *line;
 
-    /* build the line and log it to syslog/file */
+    /* NOTE: opt->log_level may have changed since s_log().
-    if(log_mode==LOG_MODE_CONFIGURED) { /* configured */
+     * It is important to use the new value and not the old one. */
+
+    /* build the line and log it to syslog/file if configured */
+    switch(log_mode) {
+    case LOG_MODE_CONFIGURED:
         line=str_printf("%s %s: %s", stamp, id, text);
         if(level<=opt->log_level) {
 #if !defined(USE_WIN32) && !defined(__vms)
@@ -233,15 +236,25 @@ NOEXPORT void log_raw(const SERVICE_OPTIONS *opt,
                 syslog(level, "%s: %s", id, text);
 #endif /* USE_WIN32, __vms */
             if(outfile)
-                file_putline(outfile, line); /* send log to file */
+                file_putline(outfile, line);
         }
-    } else if(log_mode==LOG_MODE_ERROR) {
+        break;
+    case LOG_MODE_ERROR:
+        /* don't log the id or the time stamp */
         if(level>=0 && level<=7) /* just in case */
             line=str_printf("[%c] %s", "***!:.  "[level], text);
         else
             line=str_printf("[?] %s", text);
-    } else /* LOG_MODE_INFO */
+        break;
-        line=str_dup(text); /* don't log the time stamp in error mode */
+    default: /* LOG_MODE_INFO */
+        /* don't log the level, the id or the time stamp */
+        line=str_dup(text);
+    }
+
+    /* free the memory */
+    str_free(stamp);
+    str_free(id);
+    str_free(text);
 
     /* log the line to the UI (GUI, stderr, etc.) */
     if(log_mode==LOG_MODE_ERROR ||

src/options.c

@@ -1151,21 +1151,20 @@ NOEXPORT char *parse_service_option(CMD cmd, SERVICE_OPTIONS *section,
     /* accept */
     switch(cmd) {
     case CMD_BEGIN:
-        section->option.accept=0;
+        addrlist_clear(&section->local_addr, 1);
-        memset(&section->local_addr, 0, sizeof(SOCKADDR_UNION));
-        section->local_addr.in.sin_family=AF_INET;
-        section->fd=INVALID_SOCKET;
         break;
     case CMD_EXEC:
         if(strcasecmp(opt, "accept"))
             break;
         section->option.accept=1;
-        if(!name2addr(&section->local_addr, arg, 1))
+        name_list_append(&section->local_addr.names, arg);
-            return "Failed to resolve accepting address";
         return NULL; /* OK */
     case CMD_END:
-        if(section->option.accept)
+        if(section->local_addr.names) {
+            if(!addrlist_resolve(&section->local_addr))
+                return "Cannot resolve accept target";
             ++endpoints;
+        }
         break;
     case CMD_FREE:
         break;
@@ -1728,6 +1727,7 @@ NOEXPORT char *parse_service_option(CMD cmd, SERVICE_OPTIONS *section,
     switch(cmd) {
     case CMD_BEGIN:
         section->failover=FAILOVER_RR;
+        section->seq=0;
         break;
     case CMD_EXEC:
         if(strcasecmp(opt, "failover"))
@@ -3307,6 +3307,7 @@ SOCK_OPT *sock_opts=NULL, sock_opts_def[]= {
 #ifdef SO_BINDTODEVICE
     {"SO_BINDTODEVICE", SOL_SOCKET,     SO_BINDTODEVICE, TYPE_STRING,  {NULL, NULL, NULL}},
 #endif
+#ifdef SOL_TCP
 #ifdef TCP_KEEPCNT
     {"TCP_KEEPCNT",     SOL_TCP,        TCP_KEEPCNT,     TYPE_INT,     {NULL, NULL, NULL}},
 #endif
@@ -3316,6 +3317,7 @@ SOCK_OPT *sock_opts=NULL, sock_opts_def[]= {
 #ifdef TCP_KEEPINTVL
     {"TCP_KEEPINTVL",   SOL_TCP,        TCP_KEEPINTVL,   TYPE_INT,     {NULL, NULL, NULL}},
 #endif
+#endif /* SOL_TCP */
 #ifdef IP_TOS
     {"IP_TOS",          IPPROTO_IP,     IP_TOS,          TYPE_INT,     {NULL, NULL, NULL}},
 #endif
@@ -3655,6 +3657,14 @@ NOEXPORT char *engine_init(void) {
         return "Selecting default engine failed";
     }
 #endif
+    /* engines can add new algorithms */
+#if OPENSSL_VERSION_NUMBER>=0x10100000L
+    OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS|
+        OPENSSL_INIT_ADD_ALL_DIGESTS, NULL);
+#else
+    OpenSSL_add_all_algorithms();
+#endif
+
     s_log(LOG_INFO, "Engine #%d (%s) initialized",
         current_engine+1, ENGINE_get_id(engines[current_engine]));
     engine_initialized=1;

src/os2.mak

@@ -1,11 +1,11 @@
 prefix=.
 DEFS = -DPACKAGE_NAME=\"stunnel\" \
 	-DPACKAGE_TARNAME=\"stunnel\" \
-	-DPACKAGE_VERSION=\"5.42\" \
+	-DPACKAGE_VERSION=\"5.44\" \
-	-DPACKAGE_STRING=\"stunnel\ 5.42\" \
+	-DPACKAGE_STRING=\"stunnel\ 5.44\" \
 	-DPACKAGE_BUGREPORT=\"\" \
 	-DPACKAGE=\"stunnel\" \
-	-DVERSION=\"5.42\" \
+	-DVERSION=\"5.44\" \
 	-DSTDC_HEADERS=1 \
 	-DHAVE_SYS_TYPES_H=1 \
 	-DHAVE_SYS_STAT_H=1 \

src/prototypes.h

@@ -98,8 +98,9 @@ typedef struct name_list_struct {
 typedef struct sockaddr_list {                          /* list of addresses */
     struct sockaddr_list *parent;   /* used by copies to locate their parent */
     SOCKADDR_UNION *addr;                     /* array of resolved addresses */
+    SOCKET *fd;                       /* array of accepting file descriptors */
     SSL_SESSION **session;                /* array of cached client sessions */
-    unsigned rr;                          /* current address for round-robin */
+    unsigned start;              /* initial address for round-robin failover */
     unsigned num;                             /* how many addresses are used */
     int passive;                                         /* listening socket */
     NAME_LIST *names;                          /* a list of unresolved names */
@@ -125,7 +126,6 @@ typedef struct {
 #ifdef HAVE_CHROOT
     char *chroot_dir;
 #endif
-    unsigned long dpid;
     char *pidfile;
 #endif
 
@@ -238,7 +238,6 @@ typedef struct service_options_struct {
 #endif /* !defined(OPENSSL_NO_ENGINE) */
 
         /* service-specific data for client.c */
-    SOCKET fd;     /* file descriptor accepting connections for this service */
     SSL_SESSION *session;                           /* recently used session */
     char *exec_name;                          /* program name for local mode */
 #ifdef USE_WIN32
@@ -246,13 +245,14 @@ typedef struct service_options_struct {
 #else
     char **exec_args;                    /* program arguments for local mode */
 #endif
-    SOCKADDR_UNION local_addr, source_addr;
+    SOCKADDR_UNION source_addr;
-    SOCKADDR_LIST connect_addr, redirect_addr;
+    SOCKADDR_LIST local_addr, connect_addr, redirect_addr;
     int timeout_busy;                       /* maximum waiting for data time */
     int timeout_close;                          /* maximum close_notify time */
     int timeout_connect;                           /* maximum connect() time */
     int timeout_idle;                        /* maximum idle connection time */
     enum {FAILOVER_RR, FAILOVER_PRIO} failover;         /* failover strategy */
+    unsigned seq;              /* sequential number for round-robin failover */
     char *username;
 
         /* service-specific data for protocol.c */

src/resolver.c

@@ -138,6 +138,7 @@ unsigned name2addr(SOCKADDR_UNION *addr, char *name, int passive) {
     if(retval)
         addrlist2addr(addr, addr_list);
     str_free(addr_list->addr);
+    str_free(addr_list->fd);
     str_free(addr_list->session);
     str_free(addr_list);
     return retval;
@@ -154,6 +155,7 @@ unsigned hostport2addr(SOCKADDR_UNION *addr,
     if(num)
         addrlist2addr(addr, addr_list);
     str_free(addr_list->addr);
+    str_free(addr_list->fd);
     str_free(addr_list->session);
     str_free(addr_list);
     return num;
@@ -196,6 +198,9 @@ unsigned name2addrlist(SOCKADDR_LIST *addr_list, char *name) {
             (addr_list->num+1)*sizeof(SOCKADDR_UNION));
         addr_list->addr[addr_list->num].un.sun_family=AF_UNIX;
         strcpy(addr_list->addr[addr_list->num].un.sun_path, name);
+        addr_list->fd=str_realloc(addr_list->fd,
+            (addr_list->num+1)*sizeof(SOCKET));
+        addr_list->fd[addr_list->num]=INVALID_SOCKET;
         addr_list->session=str_realloc(addr_list->session,
             (addr_list->num+1)*sizeof(SSL_SESSION *));
         addr_list->session[addr_list->num]=NULL;
@@ -291,6 +296,9 @@ unsigned hostport2addrlist(SOCKADDR_LIST *addr_list,
             (addr_list->num+1)*sizeof(SOCKADDR_UNION));
         memcpy(&addr_list->addr[addr_list->num], cur->ai_addr,
             (size_t)cur->ai_addrlen);
+        addr_list->fd=str_realloc(addr_list->fd,
+            (addr_list->num+1)*sizeof(SOCKET));
+        addr_list->fd[addr_list->num]=INVALID_SOCKET;
         addr_list->session=str_realloc(addr_list->session,
             (addr_list->num+1)*sizeof(SSL_SESSION *));
         addr_list->session[addr_list->num]=NULL;
@@ -312,8 +320,9 @@ void addrlist_clear(SOCKADDR_LIST *addr_list, int passive) {
 NOEXPORT void addrlist_reset(SOCKADDR_LIST *addr_list) {
     addr_list->num=0;
     addr_list->addr=NULL;
+    addr_list->fd=NULL;
     addr_list->session=NULL;
-    addr_list->rr=0; /* reset the round-robin counter */
+    addr_list->start=0;
     addr_list->parent=addr_list; /* allow a copy to locate its parent */
 }
 
@@ -325,7 +334,8 @@ unsigned addrlist_dup(SOCKADDR_LIST *dst, const SOCKADDR_LIST *src) {
     } else { /* delayed resolver */
         addrlist_resolve(dst);
     }
-    /* we currently don't make a local copy of src->session */
+    /* a client does not have its own local copy of
+       src->session and src->fd */
     return dst->num;
 }
 
@@ -336,16 +346,13 @@ unsigned addrlist_resolve(SOCKADDR_LIST *addr_list) {
     addrlist_reset(addr_list);
     for(host=addr_list->names; host; host=host->next)
         num+=name2addrlist(addr_list, host->name);
-    switch(num) {
+    if(num<2) {
-    case 0:
+        addr_list->start=0;
-    case 1:
+    } else {
-        addr_list->rr=0;
-        break;
-    default:
         /* randomize the initial value of round-robin counter */
         /* ignore the error value and the distribution bias */
         RAND_bytes((unsigned char *)&rnd, sizeof rnd);
-        addr_list->rr=rnd%num;
+        addr_list->start=rnd%num;
     }
     return num;
 }

src/ssl.c

@@ -53,8 +53,9 @@ int index_session_authenticated, index_session_connect_address;
 int ssl_init(void) { /* init TLS before parsing configuration file */
 #if OPENSSL_VERSION_NUMBER>=0x10100000L
     OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS |
-        OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
+        OPENSSL_INIT_LOAD_CRYPTO_STRINGS | OPENSSL_INIT_LOAD_CONFIG, NULL);
 #else
+    OPENSSL_config(NULL);
     SSL_load_error_strings();
     SSL_library_init();
 #endif

src/stunnel.c

@@ -64,7 +64,9 @@ struct sockaddr_un {
 };
 #endif
 
-NOEXPORT int accept_connection(SERVICE_OPTIONS *);
+NOEXPORT int accept_connection(SERVICE_OPTIONS *, unsigned);
+NOEXPORT void unbind_port(SERVICE_OPTIONS *, unsigned);
+NOEXPORT SOCKET bind_port(SERVICE_OPTIONS *, int, unsigned);
 #ifdef HAVE_CHROOT
 NOEXPORT int change_root(void);
 #endif
@@ -295,10 +297,13 @@ void daemon_loop(void) {
             if(s_poll_canread(fds, signal_pipe[0]))
                 if(signal_pipe_dispatch()) /* SIGNAL_TERMINATE or error */
                     break; /* terminate daemon_loop */
-            for(opt=service_options.next; opt; opt=opt->next)
+            for(opt=service_options.next; opt; opt=opt->next) {
-                if(opt->option.accept && s_poll_canread(fds, opt->fd))
+                unsigned i;
-                    if(accept_connection(opt))
+                for(i=0; i<opt->local_addr.num; ++i)
+                    if(s_poll_canread(fds, opt->local_addr.fd[i]))
+                        if(accept_connection(opt, i))
                             temporary_lack_of_resources=1;
+            }
         } else {
             log_error(LOG_NOTICE, get_last_socket_error(),
                 "daemon_loop: s_poll_wait");
@@ -313,15 +318,15 @@ void daemon_loop(void) {
 }
 
     /* return 1 when a short delay is needed before another try */
-NOEXPORT int accept_connection(SERVICE_OPTIONS *opt) {
+NOEXPORT int accept_connection(SERVICE_OPTIONS *opt, unsigned i) {
     SOCKADDR_UNION addr;
     char *from_address;
-    SOCKET s;
+    SOCKET s, fd=opt->local_addr.fd[i];
     socklen_t addrlen;
 
     addrlen=sizeof addr;
     for(;;) {
-        s=s_accept(opt->fd, &addr.sa, &addrlen, 1, "local socket");
+        s=s_accept(fd, &addr.sa, &addrlen, 1, "local socket");
         if(s!=INVALID_SOCKET) /* success! */
             break;
         switch(get_last_socket_error()) {
@@ -356,8 +361,7 @@ NOEXPORT int accept_connection(SERVICE_OPTIONS *opt) {
         return 0;
     }
 #endif
-    if(create_client(opt->fd, s,
+    if(create_client(fd, s, alloc_client_session(opt, s, s), client_thread)) {
-            alloc_client_session(opt, s, s), client_thread)) {
         s_log(LOG_ERR, "Connection rejected: create_client failed");
         closesocket(s);
         return 0;
@@ -370,37 +374,17 @@ NOEXPORT int accept_connection(SERVICE_OPTIONS *opt) {
 /* clear fds, close old ports */
 void unbind_ports(void) {
     SERVICE_OPTIONS *opt;
-#ifdef HAVE_STRUCT_SOCKADDR_UN
-    struct stat sb; /* buffer for lstat() */
-#endif
 
     s_poll_init(fds);
     s_poll_add(fds, signal_pipe[0], 1, 0);
 
     for(opt=service_options.next; opt; opt=opt->next) {
-        s_log(LOG_DEBUG, "Closing service [%s]", opt->servname);
+        unsigned i;
-        if(opt->option.accept && opt->fd!=INVALID_SOCKET) {
+        s_log(LOG_DEBUG, "Unbinding service [%s]", opt->servname);
-            if(opt->fd<(SOCKET)listen_fds_start ||
+        for(i=0; i<opt->local_addr.num; ++i)
-                    opt->fd>=(SOCKET)(listen_fds_start+systemd_fds))
+            unbind_port(opt, i);
-                closesocket(opt->fd);
+        /* exec+connect service */
-            s_log(LOG_DEBUG, "Service [%s] closed (FD=%ld)",
+        if(opt->exec_name && opt->connect_addr.names) {
-                opt->servname, (long)opt->fd);
-            opt->fd=INVALID_SOCKET;
-#ifdef HAVE_STRUCT_SOCKADDR_UN
-            if(opt->local_addr.sa.sa_family==AF_UNIX) {
-                if(lstat(opt->local_addr.un.sun_path, &sb))
-                    sockerror(opt->local_addr.un.sun_path);
-                else if(!S_ISSOCK(sb.st_mode))
-                    s_log(LOG_ERR, "Not a socket: %s",
-                        opt->local_addr.un.sun_path);
-                else if(unlink(opt->local_addr.un.sun_path))
-                    sockerror(opt->local_addr.un.sun_path);
-                else
-                    s_log(LOG_DEBUG, "Socket removed: %s",
-                        opt->local_addr.un.sun_path);
-            }
-#endif
-        } else if(opt->exec_name && opt->connect_addr.names) {
             /* create exec+connect services             */
             /* FIXME: this is just a crude workaround   */
             /*        is it better to kill the service? */
@@ -416,15 +400,44 @@ void unbind_ports(void) {
     }
 }
 
-/* open new ports, update fds */
+NOEXPORT void unbind_port(SERVICE_OPTIONS *opt, unsigned i) {
-int bind_ports(void) {
+    SOCKET fd=opt->local_addr.fd[i];
-    SERVICE_OPTIONS *opt;
+    SOCKADDR_UNION *addr=opt->local_addr.addr+i;
-    char *local_address;
-    int listening_section;
 #ifdef HAVE_STRUCT_SOCKADDR_UN
     struct stat sb; /* buffer for lstat() */
 #endif
 
+    if(fd==INVALID_SOCKET)
+        return;
+    opt->local_addr.fd[i]=INVALID_SOCKET;
+
+    if(fd<(SOCKET)listen_fds_start ||
+            fd>=(SOCKET)(listen_fds_start+systemd_fds))
+        closesocket(fd);
+    s_log(LOG_DEBUG, "Service [%s] closed (FD=%ld)",
+        opt->servname, (long)fd);
+
+#ifdef HAVE_STRUCT_SOCKADDR_UN
+    if(addr->sa.sa_family==AF_UNIX) {
+        if(lstat(addr->un.sun_path, &sb))
+            sockerror(addr->un.sun_path);
+        else if(!S_ISSOCK(sb.st_mode))
+            s_log(LOG_ERR, "Not a socket: %s",
+                addr->un.sun_path);
+        else if(unlink(addr->un.sun_path))
+            sockerror(addr->un.sun_path);
+        else
+            s_log(LOG_DEBUG, "Socket removed: %s",
+                addr->un.sun_path);
+    }
+#endif
+}
+
+/* open new ports, update fds */
+int bind_ports(void) {
+    SERVICE_OPTIONS *opt;
+    int listening_section;
+
 #ifdef USE_LIBWRAP
     /* execute after options_cmdline() to know service_options.next,
      * but as early as possible to avoid leaking file descriptors */
@@ -438,82 +451,28 @@ int bind_ports(void) {
 
     /* allow clean unbind_ports() even though
        bind_ports() was not fully performed */
-    for(opt=service_options.next; opt; opt=opt->next)
+    for(opt=service_options.next; opt; opt=opt->next) {
-        if(opt->option.accept)
+        unsigned i;
-            opt->fd=INVALID_SOCKET;
+        for(i=0; i<opt->local_addr.num; ++i)
+            opt->local_addr.fd[i]=INVALID_SOCKET;
+    }
 
     listening_section=0;
     for(opt=service_options.next; opt; opt=opt->next) {
-        if(opt->option.accept) {
+        unsigned i;
-            if(listening_section<systemd_fds) {
+        s_log(LOG_DEBUG, "Binding service [%s]", opt->servname);
-                opt->fd=(SOCKET)(listen_fds_start+listening_section);
+        for(i=0; i<opt->local_addr.num; ++i) {
-                s_log(LOG_DEBUG,
+            SOCKET fd;
-                    "Listening file descriptor received from systemd (FD=%ld)",
+            fd=bind_port(opt, listening_section, i);
-                    (long)opt->fd);
+            if(fd==INVALID_SOCKET)
-            } else {
-                opt->fd=s_socket(opt->local_addr.sa.sa_family,
-                    SOCK_STREAM, 0, 1, "accept socket");
-                if(opt->fd==INVALID_SOCKET)
                 return 1;
-                s_log(LOG_DEBUG, "Listening file descriptor created (FD=%ld)",
+            s_poll_add(fds, fd, 1, 0);
-                    (long)opt->fd);
+            opt->local_addr.fd[i]=fd;
         }
-            if(set_socket_options(opt->fd, 0)<0) {
+        if(opt->local_addr.num)
-                closesocket(opt->fd);
-                opt->fd=INVALID_SOCKET;
-                return 1;
-            }
-            /* local socket can't be unnamed */
-            local_address=s_ntop(&opt->local_addr, addr_len(&opt->local_addr));
-            /* we don't bind or listen on a socket inherited from systemd */
-            if(listening_section>=systemd_fds) {
-                if(bind(opt->fd, &opt->local_addr.sa, addr_len(&opt->local_addr))) {
-                    sockerror("bind");
-                    s_log(LOG_ERR, "Error binding service [%s] to %s",
-                        opt->servname, local_address);
-                    closesocket(opt->fd);
-                    opt->fd=INVALID_SOCKET;
-                    str_free(local_address);
-                    return 1;
-                }
-                if(listen(opt->fd, SOMAXCONN)) {
-                    sockerror("listen");
-                    closesocket(opt->fd);
-                    opt->fd=INVALID_SOCKET;
-                    str_free(local_address);
-                    return 1;
-                }
-            }
-#ifdef HAVE_STRUCT_SOCKADDR_UN
-            /* chown the UNIX socket, errors are ignored */
-            if(opt->local_addr.sa.sa_family==AF_UNIX &&
-                    (opt->uid || opt->gid)) {
-                /* fchown() does *not* work on UNIX sockets */
-                if(!lchown(opt->local_addr.un.sun_path, opt->uid, opt->gid))
-                    s_log(LOG_DEBUG,
-                        "Socket chown succeeded: %s, UID=%u, GID=%u",
-                        opt->local_addr.un.sun_path,
-                        (unsigned)opt->uid, (unsigned)opt->gid);
-                else if(lstat(opt->local_addr.un.sun_path, &sb))
-                    sockerror(opt->local_addr.un.sun_path);
-                else if(sb.st_uid==opt->uid && sb.st_gid==opt->gid)
-                    s_log(LOG_DEBUG,
-                        "Socket chown unneeded: %s, UID=%u, GID=%u",
-                        opt->local_addr.un.sun_path,
-                        (unsigned)opt->uid, (unsigned)opt->gid);
-                else
-                    s_log(LOG_ERR, "Socket chown failed: %s, UID=%u, GID=%u",
-                        opt->local_addr.un.sun_path,
-                        (unsigned)opt->uid, (unsigned)opt->gid);
-            }
-#endif
-            s_poll_add(fds, opt->fd, 1, 0);
-            s_log(LOG_DEBUG, "Service [%s] (FD=%ld) bound to %s",
-                opt->servname, (long)opt->fd, local_address);
-            str_free(local_address);
             ++listening_section;
-        } else if(opt->exec_name && opt->connect_addr.names) {
         /* create exec+connect services */
+        if(opt->exec_name && opt->connect_addr.names) {
             /* FIXME: needs to be delayed on reload with opt->option.retry set */
             create_client(INVALID_SOCKET, INVALID_SOCKET,
                 alloc_client_session(opt, INVALID_SOCKET, INVALID_SOCKET),
@@ -529,6 +488,82 @@ int bind_ports(void) {
     return 0; /* OK */
 }
 
+NOEXPORT SOCKET bind_port(SERVICE_OPTIONS *opt, int listening_section, unsigned i) {
+    SOCKET fd;
+    SOCKADDR_UNION *addr=opt->local_addr.addr+i;
+    char *local_address;
+#ifdef HAVE_STRUCT_SOCKADDR_UN
+    struct stat sb; /* buffer for lstat() */
+#endif
+
+    if(listening_section<systemd_fds) {
+        fd=(SOCKET)(listen_fds_start+listening_section);
+        s_log(LOG_DEBUG,
+            "Listening file descriptor received from systemd (FD=%ld)",
+            (long)fd);
+    } else {
+        fd=s_socket(addr->sa.sa_family, SOCK_STREAM, 0, 1, "accept socket");
+        if(fd==INVALID_SOCKET)
+            return INVALID_SOCKET;
+        s_log(LOG_DEBUG, "Listening file descriptor created (FD=%ld)",
+            (long)fd);
+    }
+
+    if(set_socket_options(fd, 0)<0) {
+        closesocket(fd);
+        return INVALID_SOCKET;
+    }
+
+    /* local socket can't be unnamed */
+    local_address=s_ntop(addr, addr_len(addr));
+    /* we don't bind or listen on a socket inherited from systemd */
+    if(listening_section>=systemd_fds) {
+        if(bind(fd, &addr->sa, addr_len(addr))) {
+            sockerror("bind");
+            s_log(LOG_ERR, "Error binding service [%s] to %s",
+                opt->servname, local_address);
+            str_free(local_address);
+            closesocket(fd);
+            return INVALID_SOCKET;
+        }
+        if(listen(fd, SOMAXCONN)) {
+            sockerror("listen");
+            str_free(local_address);
+            closesocket(fd);
+            return INVALID_SOCKET;
+        }
+    }
+
+#ifdef HAVE_STRUCT_SOCKADDR_UN
+    /* chown the UNIX socket, errors are ignored */
+    if(addr->sa.sa_family==AF_UNIX &&
+            (opt->uid || opt->gid)) {
+        /* fchown() does *not* work on UNIX sockets */
+        if(!lchown(addr->un.sun_path, opt->uid, opt->gid))
+            s_log(LOG_DEBUG,
+                "Socket chown succeeded: %s, UID=%u, GID=%u",
+                addr->un.sun_path,
+                (unsigned)opt->uid, (unsigned)opt->gid);
+        else if(lstat(addr->un.sun_path, &sb))
+            sockerror(addr->un.sun_path);
+        else if(sb.st_uid==opt->uid && sb.st_gid==opt->gid)
+            s_log(LOG_DEBUG,
+                "Socket chown unneeded: %s, UID=%u, GID=%u",
+                addr->un.sun_path,
+                (unsigned)opt->uid, (unsigned)opt->gid);
+        else
+            s_log(LOG_ERR, "Socket chown failed: %s, UID=%u, GID=%u",
+                addr->un.sun_path,
+                (unsigned)opt->uid, (unsigned)opt->gid);
+    }
+#endif
+
+    s_log(LOG_DEBUG, "Service [%s] (FD=%ld) bound to %s",
+        opt->servname, (long)fd, local_address);
+    str_free(local_address);
+    return fd;
+}
+
 #ifdef HAVE_CHROOT
 NOEXPORT int change_root(void) {
     if(!global_options.chroot_dir)
@@ -801,6 +836,7 @@ void stunnel_info(int level) {
     if(strcmp(OPENSSL_VERSION_TEXT, OpenSSL_version(OPENSSL_VERSION))) {
         s_log(level, "Compiled with " OPENSSL_VERSION_TEXT);
         s_log(level, "Running  with %s", OpenSSL_version(OPENSSL_VERSION));
+        if((OpenSSL_version_num()^OPENSSL_VERSION_NUMBER)&~0xfffu)
             s_log(level, "Update OpenSSL shared libraries or rebuild stunnel");
     } else {
         s_log(level, "Compiled/running with " OPENSSL_VERSION_TEXT);

src/ui_unix.c

@@ -38,6 +38,8 @@
 #include "common.h"
 #include "prototypes.h"
 
+NOEXPORT unsigned long dpid;
+
 NOEXPORT int main_unix(int, char*[]);
 #if !defined(__vms) && !defined(USE_OS2)
 NOEXPORT int daemonize(int);
@@ -184,7 +186,7 @@ NOEXPORT int create_pid(void) {
         s_log(LOG_ERR, "Pid file (%s) must be full path name", global_options.pidfile);
         return 1;
     }
-    global_options.dpid=(unsigned long)getpid();
+    dpid=(unsigned long)getpid();
 
     /* silently remove old pid file */
     unlink(global_options.pidfile);
@@ -194,7 +196,7 @@ NOEXPORT int create_pid(void) {
         ioerror("create");
         return 1;
     }
-    pid=str_printf("%lu\n", global_options.dpid);
+    pid=str_printf("%lu\n", dpid);
     if(write(pf, pid, strlen(pid))<(int)strlen(pid)) {
         s_log(LOG_ERR, "Cannot write pid file %s", global_options.pidfile);
         ioerror("write");
@@ -208,7 +210,7 @@ NOEXPORT int create_pid(void) {
 }
 
 NOEXPORT void delete_pid(void) {
-    if((unsigned long)getpid()!=global_options.dpid)
+    if((unsigned long)getpid()!=dpid)
         return; /* current process is not main daemon process */
     s_log(LOG_DEBUG, "removing pid file %s", global_options.pidfile);
     if(unlink(global_options.pidfile)<0)

src/vc.mak

@@ -10,8 +10,10 @@
 
 !IF [ml64.exe /help >NUL 2>&1]
 TARGET=win32
+SSLLIBS=libeay32.lib ssleay32.lib
 !ELSE
 TARGET=win64
+SSLLIBS=libcrypto.lib libssl.lib
 !ENDIF
 !MESSAGE Detected target: $(TARGET)
 !MESSAGE
@@ -53,7 +55,6 @@ LDFLAGS=/NOLOGO /DEBUG
 SHAREDLIBS=ws2_32.lib user32.lib shell32.lib kernel32.lib
 GUILIBS=advapi32.lib comdlg32.lib crypt32.lib gdi32.lib psapi.lib
 CLILIBS=
-SSLLIBS=/LIBPATH:"$(LIBDIR)" libeay32.lib ssleay32.lib
 # static linking:
 #	/LIBPATH:"$(LIBDIR)\VC\static" libeay32MD.lib ssleay32MD.lib
 
@@ -90,12 +91,12 @@ $(GUIOBJS): *.h vc.mak
 $(CLIOBJS): *.h vc.mak
 
 $(BIN)\stunnel.exe: $(SHAREDOBJS) $(GUIOBJS)
-	$(LINK) $(LDFLAGS) $(SHAREDLIBS) $(GUILIBS) $(SSLLIBS) /OUT:$@ $**
+	$(LINK) $(LDFLAGS) $(SHAREDLIBS) $(GUILIBS) /LIBPATH:"$(LIBDIR)" $(SSLLIBS) /OUT:$@ $**
 	IF EXIST $@.manifest \
 		mt -nologo -manifest $@.manifest -outputresource:$@;1
 
 $(BIN)\tstunnel.exe: $(SHAREDOBJS) $(CLIOBJS)
-	$(LINK) $(LDFLAGS) $(SHAREDLIBS) $(CLILIBS) $(SSLLIBS) /OUT:$@ $**
+	$(LINK) $(LDFLAGS) $(SHAREDLIBS) $(CLILIBS) /LIBPATH:"$(LIBDIR)" $(SSLLIBS) /OUT:$@ $**
 	IF EXIST $@.manifest \
 		mt -nologo -manifest $@.manifest -outputresource:$@;1
 

src/version.h

@@ -65,7 +65,7 @@
 
 /* START CUSTOMIZE */
 #define VERSION_MAJOR 5
-#define VERSION_MINOR 42
+#define VERSION_MINOR 44
 /* END CUSTOMIZE */
 
 /* all the following macros are ABSOLUTELY NECESSARY to have proper string

tests/Makefile.am

@@ -0,0 +1,10 @@
+## Process this file with automake to produce Makefile.in
+# by Michal Trojnara 2017
+
+EXTRA_DIST = make_test test_library recipes certs execute
+
+check-local:
+	$(srcdir)/make_test
+
+distclean-local:
+	rm -f logs/*.log

tests/Makefile.in

@@ -0,0 +1,454 @@
+# Makefile.in generated by automake 1.15 from Makefile.am.
+# @configure_input@
+
+# Copyright (C) 1994-2014 Free Software Foundation, Inc.
+
+# This Makefile.in is free software; the Free Software Foundation
+# gives unlimited permission to copy and/or distribute it,
+# with or without modifications, as long as this notice is preserved.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
+# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+# PARTICULAR PURPOSE.
+
+@SET_MAKE@
+
+# by Michal Trojnara 2017
+VPATH = @srcdir@
+am__is_gnu_make = { \
+  if test -z '$(MAKELEVEL)'; then \
+    false; \
+  elif test -n '$(MAKE_HOST)'; then \
+    true; \
+  elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
+    true; \
+  else \
+    false; \
+  fi; \
+}
+am__make_running_with_option = \
+  case $${target_option-} in \
+      ?) ;; \
+      *) echo "am__make_running_with_option: internal error: invalid" \
+              "target option '$${target_option-}' specified" >&2; \
+         exit 1;; \
+  esac; \
+  has_opt=no; \
+  sane_makeflags=$$MAKEFLAGS; \
+  if $(am__is_gnu_make); then \
+    sane_makeflags=$$MFLAGS; \
+  else \
+    case $$MAKEFLAGS in \
+      *\\[\ \	]*) \
+        bs=\\; \
+        sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \
+          | sed "s/$$bs$$bs[$$bs $$bs	]*//g"`;; \
+    esac; \
+  fi; \
+  skip_next=no; \
+  strip_trailopt () \
+  { \
+    flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \
+  }; \
+  for flg in $$sane_makeflags; do \
+    test $$skip_next = yes && { skip_next=no; continue; }; \
+    case $$flg in \
+      *=*|--*) continue;; \
+        -*I) strip_trailopt 'I'; skip_next=yes;; \
+      -*I?*) strip_trailopt 'I';; \
+        -*O) strip_trailopt 'O'; skip_next=yes;; \
+      -*O?*) strip_trailopt 'O';; \
+        -*l) strip_trailopt 'l'; skip_next=yes;; \
+      -*l?*) strip_trailopt 'l';; \
+      -[dEDm]) skip_next=yes;; \
+      -[JT]) skip_next=yes;; \
+    esac; \
+    case $$flg in \
+      *$$target_option*) has_opt=yes; break;; \
+    esac; \
+  done; \
+  test $$has_opt = yes
+am__make_dryrun = (target_option=n; $(am__make_running_with_option))
+am__make_keepgoing = (target_option=k; $(am__make_running_with_option))
+pkgdatadir = $(datadir)/@PACKAGE@
+pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
+am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
+install_sh_DATA = $(install_sh) -c -m 644
+install_sh_PROGRAM = $(install_sh) -c
+install_sh_SCRIPT = $(install_sh) -c
+INSTALL_HEADER = $(INSTALL_DATA)
+transform = $(program_transform_name)
+NORMAL_INSTALL = :
+PRE_INSTALL = :
+POST_INSTALL = :
+NORMAL_UNINSTALL = :
+PRE_UNINSTALL = :
+POST_UNINSTALL = :
+build_triplet = @build@
+host_triplet = @host@
+subdir = tests
+ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
+am__aclocal_m4_deps = $(top_srcdir)/m4/libtool.m4 \
+	$(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \
+	$(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \
+	$(top_srcdir)/configure.ac
+am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
+	$(ACLOCAL_M4)
+DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
+mkinstalldirs = $(install_sh) -d
+CONFIG_HEADER = $(top_builddir)/src/config.h
+CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
+AM_V_P = $(am__v_P_@AM_V@)
+am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
+am__v_P_0 = false
+am__v_P_1 = :
+AM_V_GEN = $(am__v_GEN_@AM_V@)
+am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@)
+am__v_GEN_0 = @echo "  GEN     " $@;
+am__v_GEN_1 = 
+AM_V_at = $(am__v_at_@AM_V@)
+am__v_at_ = $(am__v_at_@AM_DEFAULT_V@)
+am__v_at_0 = @
+am__v_at_1 = 
+SOURCES =
+DIST_SOURCES =
+am__can_run_installinfo = \
+  case $$AM_UPDATE_INFO_DIR in \
+    n|no|NO) false;; \
+    *) (install-info --version) >/dev/null 2>&1;; \
+  esac
+am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
+am__DIST_COMMON = $(srcdir)/Makefile.in
+DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
+ACLOCAL = @ACLOCAL@
+AMTAR = @AMTAR@
+AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
+AR = @AR@
+AUTOCONF = @AUTOCONF@
+AUTOHEADER = @AUTOHEADER@
+AUTOMAKE = @AUTOMAKE@
+AWK = @AWK@
+CC = @CC@
+CCDEPMODE = @CCDEPMODE@
+CFLAGS = @CFLAGS@
+CPP = @CPP@
+CPPFLAGS = @CPPFLAGS@
+CYGPATH_W = @CYGPATH_W@
+DEFAULT_GROUP = @DEFAULT_GROUP@
+DEFS = @DEFS@
+DEPDIR = @DEPDIR@
+DLLTOOL = @DLLTOOL@
+DSYMUTIL = @DSYMUTIL@
+DUMPBIN = @DUMPBIN@
+ECHO_C = @ECHO_C@
+ECHO_N = @ECHO_N@
+ECHO_T = @ECHO_T@
+EGREP = @EGREP@
+EXEEXT = @EXEEXT@
+FGREP = @FGREP@
+GREP = @GREP@
+INSTALL = @INSTALL@
+INSTALL_DATA = @INSTALL_DATA@
+INSTALL_PROGRAM = @INSTALL_PROGRAM@
+INSTALL_SCRIPT = @INSTALL_SCRIPT@
+INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
+LD = @LD@
+LDFLAGS = @LDFLAGS@
+LIBOBJS = @LIBOBJS@
+LIBS = @LIBS@
+LIBTOOL = @LIBTOOL@
+LIBTOOL_DEPS = @LIBTOOL_DEPS@
+LIPO = @LIPO@
+LN_S = @LN_S@
+LTLIBOBJS = @LTLIBOBJS@
+LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
+MAKEINFO = @MAKEINFO@
+MANIFEST_TOOL = @MANIFEST_TOOL@
+MKDIR_P = @MKDIR_P@
+NM = @NM@
+NMEDIT = @NMEDIT@
+OBJDUMP = @OBJDUMP@
+OBJEXT = @OBJEXT@
+OTOOL = @OTOOL@
+OTOOL64 = @OTOOL64@
+PACKAGE = @PACKAGE@
+PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
+PACKAGE_NAME = @PACKAGE_NAME@
+PACKAGE_STRING = @PACKAGE_STRING@
+PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
+PACKAGE_VERSION = @PACKAGE_VERSION@
+PATH_SEPARATOR = @PATH_SEPARATOR@
+PTHREAD_CC = @PTHREAD_CC@
+PTHREAD_CFLAGS = @PTHREAD_CFLAGS@
+PTHREAD_LIBS = @PTHREAD_LIBS@
+RANDOM_FILE = @RANDOM_FILE@
+RANLIB = @RANLIB@
+SED = @SED@
+SET_MAKE = @SET_MAKE@
+SHELL = @SHELL@
+SSLDIR = @SSLDIR@
+STRIP = @STRIP@
+VERSION = @VERSION@
+abs_builddir = @abs_builddir@
+abs_srcdir = @abs_srcdir@
+abs_top_builddir = @abs_top_builddir@
+abs_top_srcdir = @abs_top_srcdir@
+ac_ct_AR = @ac_ct_AR@
+ac_ct_CC = @ac_ct_CC@
+ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
+am__include = @am__include@
+am__leading_dot = @am__leading_dot@
+am__quote = @am__quote@
+am__tar = @am__tar@
+am__untar = @am__untar@
+ax_pthread_config = @ax_pthread_config@
+bindir = @bindir@
+build = @build@
+build_alias = @build_alias@
+build_cpu = @build_cpu@
+build_os = @build_os@
+build_vendor = @build_vendor@
+builddir = @builddir@
+datadir = @datadir@
+datarootdir = @datarootdir@
+docdir = @docdir@
+dvidir = @dvidir@
+exec_prefix = @exec_prefix@
+host = @host@
+host_alias = @host_alias@
+host_cpu = @host_cpu@
+host_os = @host_os@
+host_vendor = @host_vendor@
+htmldir = @htmldir@
+includedir = @includedir@
+infodir = @infodir@
+install_sh = @install_sh@
+libdir = @libdir@
+libexecdir = @libexecdir@
+localedir = @localedir@
+localstatedir = @localstatedir@
+mandir = @mandir@
+mkdir_p = @mkdir_p@
+oldincludedir = @oldincludedir@
+pdfdir = @pdfdir@
+prefix = @prefix@
+program_transform_name = @program_transform_name@
+psdir = @psdir@
+runstatedir = @runstatedir@
+sbindir = @sbindir@
+sharedstatedir = @sharedstatedir@
+srcdir = @srcdir@
+sysconfdir = @sysconfdir@
+target_alias = @target_alias@
+top_build_prefix = @top_build_prefix@
+top_builddir = @top_builddir@
+top_srcdir = @top_srcdir@
+EXTRA_DIST = make_test test_library recipes certs execute
+all: all-am
+
+.SUFFIXES:
+$(srcdir)/Makefile.in:  $(srcdir)/Makefile.am  $(am__configure_deps)
+	@for dep in $?; do \
+	  case '$(am__configure_deps)' in \
+	    *$$dep*) \
+	      ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \
+	        && { if test -f $@; then exit 0; else break; fi; }; \
+	      exit 1;; \
+	  esac; \
+	done; \
+	echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu tests/Makefile'; \
+	$(am__cd) $(top_srcdir) && \
+	  $(AUTOMAKE) --gnu tests/Makefile
+Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
+	@case '$?' in \
+	  *config.status*) \
+	    cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
+	  *) \
+	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
+	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
+	esac;
+
+$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+
+$(top_srcdir)/configure:  $(am__configure_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(ACLOCAL_M4):  $(am__aclocal_m4_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
+
+mostlyclean-libtool:
+	-rm -f *.lo
+
+clean-libtool:
+	-rm -rf .libs _libs
+tags TAGS:
+
+ctags CTAGS:
+
+cscope cscopelist:
+
+
+distdir: $(DISTFILES)
+	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	list='$(DISTFILES)'; \
+	  dist_files=`for file in $$list; do echo $$file; done | \
+	  sed -e "s|^$$srcdirstrip/||;t" \
+	      -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \
+	case $$dist_files in \
+	  */*) $(MKDIR_P) `echo "$$dist_files" | \
+			   sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \
+			   sort -u` ;; \
+	esac; \
+	for file in $$dist_files; do \
+	  if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
+	  if test -d $$d/$$file; then \
+	    dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+	    if test -d "$(distdir)/$$file"; then \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
+	      cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
+	  else \
+	    test -f "$(distdir)/$$file" \
+	    || cp -p $$d/$$file "$(distdir)/$$file" \
+	    || exit 1; \
+	  fi; \
+	done
+check-am: all-am
+	$(MAKE) $(AM_MAKEFLAGS) check-local
+check: check-am
+all-am: Makefile
+installdirs:
+install: install-am
+install-exec: install-exec-am
+install-data: install-data-am
+uninstall: uninstall-am
+
+install-am: all-am
+	@$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
+
+installcheck: installcheck-am
+install-strip:
+	if test -z '$(STRIP)'; then \
+	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	      install; \
+	else \
+	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	    "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \
+	fi
+mostlyclean-generic:
+
+clean-generic:
+
+distclean-generic:
+	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+	-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
+
+maintainer-clean-generic:
+	@echo "This command is intended for maintainers to use"
+	@echo "it deletes files that may require special tools to rebuild."
+clean: clean-am
+
+clean-am: clean-generic clean-libtool mostlyclean-am
+
+distclean: distclean-am
+	-rm -f Makefile
+distclean-am: clean-am distclean-generic distclean-local
+
+dvi: dvi-am
+
+dvi-am:
+
+html: html-am
+
+html-am:
+
+info: info-am
+
+info-am:
+
+install-data-am:
+
+install-dvi: install-dvi-am
+
+install-dvi-am:
+
+install-exec-am:
+
+install-html: install-html-am
+
+install-html-am:
+
+install-info: install-info-am
+
+install-info-am:
+
+install-man:
+
+install-pdf: install-pdf-am
+
+install-pdf-am:
+
+install-ps: install-ps-am
+
+install-ps-am:
+
+installcheck-am:
+
+maintainer-clean: maintainer-clean-am
+	-rm -f Makefile
+maintainer-clean-am: distclean-am maintainer-clean-generic
+
+mostlyclean: mostlyclean-am
+
+mostlyclean-am: mostlyclean-generic mostlyclean-libtool
+
+pdf: pdf-am
+
+pdf-am:
+
+ps: ps-am
+
+ps-am:
+
+uninstall-am:
+
+.MAKE: check-am install-am install-strip
+
+.PHONY: all all-am check check-am check-local clean clean-generic \
+	clean-libtool cscopelist-am ctags-am distclean \
+	distclean-generic distclean-libtool distclean-local distdir \
+	dvi dvi-am html html-am info info-am install install-am \
+	install-data install-data-am install-dvi install-dvi-am \
+	install-exec install-exec-am install-html install-html-am \
+	install-info install-info-am install-man install-pdf \
+	install-pdf-am install-ps install-ps-am install-strip \
+	installcheck installcheck-am installdirs maintainer-clean \
+	maintainer-clean-generic mostlyclean mostlyclean-generic \
+	mostlyclean-libtool pdf pdf-am ps ps-am tags-am uninstall \
+	uninstall-am
+
+.PRECIOUS: Makefile
+
+
+check-local:
+	$(srcdir)/make_test
+
+distclean-local:
+	rm -f logs/*.log
+
+# Tell versions [3.59,3.63) of GNU make to not export all variables.
+# Otherwise a system limit (for SysV at least) may be exceeded.
+.NOEXPORT:

tests/certs/CACert.pem

@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDWTCCAkGgAwIBAgIBATANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJwbDEQ
+MA4GA1UECgwHQ0FfY2VydDEQMA4GA1UECwwHQ0FfY2VydDEQMA4GA1UEAwwHQ0Ff
+Y2VydDEiMCAGCSqGSIb3DQEJARYTQ0FfY2VydEBleGFtcGxlLmNvbTAeFw0xNzA0
+MjYxODQxMDBaFw0xODA0MTMxNTQ1MDBaMGcxCzAJBgNVBAYTAnBsMRAwDgYDVQQK
+DAdDQV9jZXJ0MRAwDgYDVQQLDAdDQV9jZXJ0MRAwDgYDVQQDDAdDQV9jZXJ0MSIw
+IAYJKoZIhvcNAQkBFhNDQV9jZXJ0QGV4YW1wbGUuY29tMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAr8xh9XMrSTxiwLDWGw9eMtFJSAGyNTaoBKPgfuQd
++cv+EQrDLrE+h0ywctdzBLooxyu0ZxMOXQV/Z726f8WJsEjWIUvoOnCs3OT1Q8PJ
+V39z8Tuw5aWQRJ9uwyr1q+YV897NRCNeT8LrRFls9XZGsHz8Wd8glwwPQ67fR/bS
+eP3GvhHPJqGNh3QvybUbK52klUQMVN4MEtSNFFcxp6hwEWhuID12ychFUNVOL/Fu
+eCUjBUVufREqs+iIbmgpLKLCPc9BULXhUY+O9DYP9ahjXikdtP5xQ9AqviossWLG
+ubxNlYBOYOzpeZIZMZyyAHQ7oYBXtCJFyNMap0/2ABI1twIDAQABoxAwDjAMBgNV
+HRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQCXA7LBokSKKpwdPMthpvm8f08h
+/GnY8zF7S+UrNEIZAxpAr/p+GJOZqHjLMhUjdW5Jbazuyl7W0mlatUoTzXx35PJt
+oC1jL2K1viTuEtciPt3SVgeBysTPTCw2ZDJSsXZ2X8dFhrk0Gsc3DDjOiyCLcKEz
+oOE97ZomwATnNcVBq735zBCNEj967rOjmDUJsuVfqiIWfhjfYaw9MEj3d0FcJb1v
+3FPQ89fMM/Z3NpkL5I8+g+TKOlhvc1WDbqcBsiG/CVQo4+ClT73XZqL4woFvDaq6
+b32pz28GqKKxWzv5e4m/9cTt8F7PZIc5hJBsyeBdtFSup2zntCop/qtiT5HQ
+-----END CERTIFICATE-----

tests/certs/CACertCRL.pem

@@ -0,0 +1,13 @@
+-----BEGIN X509 CRL-----
+MIIB/jCB5wIBATANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJwbDEQMA4GA1UE
+CgwHQ0FfY2VydDEQMA4GA1UECwwHQ0FfY2VydDEQMA4GA1UEAwwHQ0FfY2VydDEi
+MCAGCSqGSIb3DQEJARYTQ0FfY2VydEBleGFtcGxlLmNvbRcNMTcwNTI5MTQxMTAw
+WhcNMjcwNjI4MTQxMTAwWjA8MDoCAQMXDTE3MDQyNjE5MDAxM1owJjAYBgNVHRgE
+ERgPMjAxNzA0MjYxOTAwMDBaMAoGA1UdFQQDCgEGoA4wDDAKBgNVHRQEAwIBAjAN
+BgkqhkiG9w0BAQUFAAOCAQEAKzIVMH126DHmfgLmm7jPBi4L6xs0N75zIiay8f2S
+2/XjD7xU3r8vA0Qd06wEUhSe63tqEb+qForNEZwNJpKxM2OW0Z8fTM40793/8WY4
+m6b5IE2SH8mrCUP4ASmB3Jo/uyFPJ+zXhI7Oj59noN+nu/T6DUloJcVMHh0rYeUR
+QpXwdsllJgVVDnqvD4jOVPSVr2NHuMBPk1cw07HZe+V2/xbI/jFNRIKf+KVWE2h8
+4hpiWRONQF9c0eLRskLCqcfyDulpk62hZJV61c4ckGeUyq7aG2N+Ypmm/stnRWGG
+NkSLu99WGPRPjVGderIjBD9I6SNe0LbvUn6t2+DfFoBn4w==
+-----END X509 CRL-----

tests/certs/PeerCerts.pem

@@ -0,0 +1,41 @@
+-----BEGIN CERTIFICATE-----
+MIIDZjCCAk6gAwIBAgIBBDANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJwbDEQ
+MA4GA1UECgwHQ0FfY2VydDEQMA4GA1UECwwHQ0FfY2VydDEQMA4GA1UEAwwHQ0Ff
+Y2VydDEiMCAGCSqGSIb3DQEJARYTQ0FfY2VydEBleGFtcGxlLmNvbTAeFw0xNzA0
+MjYxODQ1MDBaFw0xODA0MTMxNTQ1MDBaMIGFMQswCQYDVQQGEwJwbDEPMA0GA1UE
+CBMGY2xpZW50MQ8wDQYDVQQHEwZjbGllbnQxDzANBgNVBAoTBmNsaWVudDEPMA0G
+A1UECxMGY2xpZW50MQ8wDQYDVQQDEwZjbGllbnQxITAfBgkqhkiG9w0BCQEWEmNs
+aWVudEBleGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+ANmjtYUKRiuc9zrC3skW6m9AdHI7fnDt7E0OPilNOQTVoxl7KNysDfQcezcdE7u9
+1G9gnnlCpm3glmM7r28f3VHh9TXDjyJNO2h6se/Wmk7joZ6IBio5qtlHHQLZoS6P
+DkgZvTEqvlGBCAt0uHTGiAxxSFRCHI1FWIC2Cr9pOyUh/aFVVa5tD8SpKZwWV8eT
+hN46auWcvtcjELPhSc1X/fBa3swEEIqpSggwqVapJ2xoiZNF9pQ1nCJfJ6ppkr0n
+r69lOhoJ7tXeOzeoBF+QZxAbEQAW29bHa39fHGxT/g6tvOcpdcBQ5qtnOyswqHEA
+BE1CyWfUG5RuqpK7zK5ZqvkCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEAZO2G+h4X
+UUMB0uVIiz/+iX9b/EifbLwLs87zEAzfYlWCr0pq2DGMxhEUq+vSxr3j3YV1I6Rz
+y2Ao2CyWI/2NoS0Jvf2MpyX+lmGV1diFJWOl4BFf5MzTU1Smc0ryulVV2uOadbkt
+ekwHYaoohAg9aQe1DXFJV7ZSwoM3KfaJmaGV+BlOSqD6TGs75jmUwG11GyTEebg9
+DxXm39mEczVnxLIZNIv4zv0DYIof4sAzMhnGqSesqoUjJeSUUVysp7Mwmk4E48WA
+wCiubahEe0boWHlrT2is5tF88Fwkjjcwqw2jQX1+LeWiB/RA3kNxU4WTx0BFLvyH
+lfwzVP+lAnWMng==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDVDCCAjygAwIBAgIBAjANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJwbDEQ
+MA4GA1UECgwHQ0FfY2VydDEQMA4GA1UECwwHQ0FfY2VydDEQMA4GA1UEAwwHQ0Ff
+Y2VydDEiMCAGCSqGSIb3DQEJARYTQ0FfY2VydEBleGFtcGxlLmNvbTAeFw0xNzA0
+MjYxODQzMDBaFw0xODA0MTMxNTQ1MDBaMHQxCzAJBgNVBAYTAnBsMQ8wDQYDVQQI
+EwZzZXJ2ZXIxDzANBgNVBAoTBnNlcnZlcjEPMA0GA1UECxMGc2VydmVyMQ8wDQYD
+VQQDEwZzZXJ2ZXIxITAfBgkqhkiG9w0BCQEWEnNlcnZlckBleGFtcGxlLmNvbTCC
+ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK3S0m42/yBrStPI8A8eV0ig
+fehupIp0sDft/zBAf0r7bg7A1rAuJLkupIfm6Dnc0/vK43/pO8rCTQu7Xf9hMXyQ
+TL3Hr7CamjAITJQ3CSwTBXrWfvwzzr+h2SG2U6DKBh9eBhb7f3ndVcwLIc4WCjJy
+45gv5caKF9RSYUYVSun1tRzRI7xEiSMmQPbLJN1WGsP9nICFd4P2jj/cKJpPzU1O
+wEf4V6wm0sdZ2ECJ8hG5PqfKlxCy1UtSpzMaFR+wqKk1Rujx9hR9CycaROe+0Csk
+97DnygirND6V651tzuTheIrcL5tWAIShVgwxdisi1ui8mxSVUv6Q6DHAPLcx7+0C
+AwEAATANBgkqhkiG9w0BAQUFAAOCAQEAiPQrjJbTZ6NB+FO0lJtt5vEBLdepkl6x
+mtopQRxHPZIuUqV8viP9EW2PlrrPkpdbYZtkD0AuCXiqGD9u31kIHKG05GiQYj8q
+XPy55QuOntWfwJc4GEZ9uebYckHGSNLsyubdkneLeXlEZz2RbtCoZS5337nlaUCm
+93Hp/bRCFZ7if9tiscxwTft92z2+Tc5bI4JGAJfex/VgyggpNRLSDDRibNvFrooO
+1kSnDxySyCtysodXfonWpJFA9EAcUHXY6vlGvzLVJRfrqsS7vC/fuKOz684XDYIL
+g/eJED4XR47T8gA85vM8LWl80lXvfFIYsirOnYmeQDSfTRDG9eZG6Q==
+-----END CERTIFICATE-----

tests/certs/cafile.pem

@@ -0,0 +1,23 @@
+-----BEGIN CERTIFICATE-----
+MIID5TCCAs2gAwIBAgIJAJoOR3t6TXSbMA0GCSqGSIb3DQEBCwUAMIGIMQswCQYD
+VQQGEwJVUzETMBEGA1UECAwKQ2Fsb2Zvcm5pYTESMBAGA1UEBwwJU2FjcmFtZXRv
+MRgwFgYDVQQKDA9FeGFtcGxlIENvbXBhbnkxHDAaBgNVBAsME1RlY2hub2xvZ3kg
+RGl2aXNpb24xGDAWBgNVBAMMD3d3dy5leGFtcGxlLmNvbTAeFw0xNjA5MjkwODI5
+MjNaFw0xNzA5MjkwODI5MjNaMIGIMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2Fs
+b2Zvcm5pYTESMBAGA1UEBwwJU2FjcmFtZXRvMRgwFgYDVQQKDA9FeGFtcGxlIENv
+bXBhbnkxHDAaBgNVBAsME1RlY2hub2xvZ3kgRGl2aXNpb24xGDAWBgNVBAMMD3d3
+dy5leGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKi0
+nOJAoZIimJkLQ3A6osD2ZgX635Esqwb819plRyDOc9Lyt2CKiVrLyHNXrZQE7FRC
+6Uq5evb1EQYie0eTxzp8n0lOw/R4goapksLk+yLiVJXt76/ivLjATTC2B5uxUyiO
+euZDFiVO9jjfTGeG0ASdkrL69Ngw6EdkzjvvFc1XCDMLy5UZ59d9x6PNncIUJk7l
+FcxCGSh5qlggj3lHTc/9nHpz5gZpLbq4DFdsGMOfNSkjyes2dFbnHKAQrq6s49ns
+7X3iYCmJF2mfVDCtca3+NYgvujdBGGO2FaX1P9VTtBUTomO9NGcphJGGayRwtpf6
+14F4aY1KRjoq9Ln4fHkCAwEAAaNQME4wHQYDVR0OBBYEFA0sd/zjLicJm3nWXEqU
+IPMpNB2VMB8GA1UdIwQYMBaAFA0sd/zjLicJm3nWXEqUIPMpNB2VMAwGA1UdEwQF
+MAMBAf8wDQYJKoZIhvcNAQELBQADggEBAH+NDRfE44vMKv8Wfx8PZ08QlSTsyUt5
+vvEnxum6j3Hj+LDiAEXzlZ5oxX/zNEVHPAkwcvhs7dgRFNJ8+SlebGzk+u//53rW
+iOqMD1YKiFxmzVa+KlQIHBE/yO24/XG/pe7PVtZV8pF2w8Wi1ppTrZt1pzCRPiCM
+ga7ijgizp+972wt33YRWnX486XuolYc3gMLIha9vADodRH+tYtkEY6TnCga+tz4u
+LGY5eMbTTUIOEK4rGxr78FruEYOBZPKq0CtSwlGT2MMVngYg+ah51rIU6V0DXA+W
+B9YmCA2mrCMtCVaUbiQ3Zc+dHTtmameVNtv7RQGnCDY7zWPyXjmZ1oU=
+-----END CERTIFICATE-----

tests/certs/client_cert.pem

@@ -0,0 +1,48 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEA2aO1hQpGK5z3OsLeyRbqb0B0cjt+cO3sTQ4+KU05BNWjGXso
+3KwN9Bx7Nx0Tu73Ub2CeeUKmbeCWYzuvbx/dUeH1NcOPIk07aHqx79aaTuOhnogG
+Kjmq2UcdAtmhLo8OSBm9MSq+UYEIC3S4dMaIDHFIVEIcjUVYgLYKv2k7JSH9oVVV
+rm0PxKkpnBZXx5OE3jpq5Zy+1yMQs+FJzVf98FrezAQQiqlKCDCpVqknbGiJk0X2
+lDWcIl8nqmmSvSevr2U6Ggnu1d47N6gEX5BnEBsRABbb1sdrf18cbFP+Dq285yl1
+wFDmq2c7KzCocQAETULJZ9QblG6qkrvMrlmq+QIDAQABAoIBACtVfloMDqa2bT+E
+94kAiBM4uTbZg7aGmQtKr7PXjWfaBcyYCi3OEEUvupThtEEobfjzOvqX+71a/3ao
+tqigppecLw/SbVh+GjsWWwGPMFBO4KpJGTklHFCA6VTc8kvr7gMLJPF6OkTONUTa
+q7OMqCAaGjW0qCy0xwdxt7gfAsjEmtLNH7rLocQFk56y0Nz68jWLIMjnRxAq3NaQ
+ZgGE0NRwxUPhgbYl0s3MmhDPulth8+FLryZ8pmIZkKphtIvSXSPQBivdLAUkkhFx
+elUu9xHHXbqHhnCGjPjwK4CUGGp2m6mlCev/OlcHkzKWcBOJZKaAoWAQMGqCg0bu
+OS0T79UCgYEA7279C7IW7EgI9co4exxZl41gMuZxEcQzXAaHwx2m//9sPm6CczZt
+5OIAsenFU7b8hWCO5hJro7hhbp2YBTqtfQNM6KaY33W8iH6k7JcO+HfpLGHcNz1P
+S4+31Kj4k5dnz1us90uv8A77Jji1OSTJTBCgyrgmfGhPzqQnbNWNV+8CgYEA6LKw
+cYmzBUL//H2Y5HYafqOYlsC5YVGZTm//mp7DpGXdi2twmATskcnQ8BR5WtZ5Ca+2
+VHEoEAUTRLbX+CoUKeE34mnIXTIEU0dzRmw3CMK4DZVRPnIYaqckJH6GLxwCEMZE
+zlI8Hks+OrCSVgKYsKqMiOdTDdNoX4/9WaQ9A5cCgYEA6r8IfXUHoHUnw8OWCK3M
+8Rd9H6prZR3VtP36EUR7PTYx7Cvw3gCZUfR69fPasa8Qebwnnk6lFglqDUeZilbz
+TUP1HYxpCX2ncLOqAwQ/e0AlbowrmkUT/2NSur9Hp3ykHNsnA/ZC8rvdZKXol7QH
+X/pViyttIEAtLs4mkT/2qiUCgYBJfbXQBecuMDzcp2YUMWCowk48vl1N6RF7/k9B
+rAap8yoHEEWdHWEBojWEvVKeZ8IOVxpEjQBUHuY4+242CEQZ/fFCZppLJLLNAnHb
+ue2frK+oSpJAIJSpimQVyofidPwKBDRS3RHzl1vt+ToeQ++pTBPaYQSQB0add8JR
+/1btvQKBgG2uNFimmJ29DKSt8nRXm7wUkdQNORTZa0wygZbDaQgHxyiHOY9TgfhF
+PQHI/7abb/9PrMhchTWjV7w/e0E6q9Sc4kG1tz5MV9pWreXY7Uolg532zUsYqZVW
+0tQbWQR2fk+3ZoN9qHYZqYE/coqNdbtpLUIVWh3Yrh3V6L9Xw0us
+-----END RSA PRIVATE KEY-----
+-----BEGIN CERTIFICATE-----
+MIIDZjCCAk6gAwIBAgIBBDANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJwbDEQ
+MA4GA1UECgwHQ0FfY2VydDEQMA4GA1UECwwHQ0FfY2VydDEQMA4GA1UEAwwHQ0Ff
+Y2VydDEiMCAGCSqGSIb3DQEJARYTQ0FfY2VydEBleGFtcGxlLmNvbTAeFw0xNzA0
+MjYxODQ1MDBaFw0xODA0MTMxNTQ1MDBaMIGFMQswCQYDVQQGEwJwbDEPMA0GA1UE
+CBMGY2xpZW50MQ8wDQYDVQQHEwZjbGllbnQxDzANBgNVBAoTBmNsaWVudDEPMA0G
+A1UECxMGY2xpZW50MQ8wDQYDVQQDEwZjbGllbnQxITAfBgkqhkiG9w0BCQEWEmNs
+aWVudEBleGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+ANmjtYUKRiuc9zrC3skW6m9AdHI7fnDt7E0OPilNOQTVoxl7KNysDfQcezcdE7u9
+1G9gnnlCpm3glmM7r28f3VHh9TXDjyJNO2h6se/Wmk7joZ6IBio5qtlHHQLZoS6P
+DkgZvTEqvlGBCAt0uHTGiAxxSFRCHI1FWIC2Cr9pOyUh/aFVVa5tD8SpKZwWV8eT
+hN46auWcvtcjELPhSc1X/fBa3swEEIqpSggwqVapJ2xoiZNF9pQ1nCJfJ6ppkr0n
+r69lOhoJ7tXeOzeoBF+QZxAbEQAW29bHa39fHGxT/g6tvOcpdcBQ5qtnOyswqHEA
+BE1CyWfUG5RuqpK7zK5ZqvkCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEAZO2G+h4X
+UUMB0uVIiz/+iX9b/EifbLwLs87zEAzfYlWCr0pq2DGMxhEUq+vSxr3j3YV1I6Rz
+y2Ao2CyWI/2NoS0Jvf2MpyX+lmGV1diFJWOl4BFf5MzTU1Smc0ryulVV2uOadbkt
+ekwHYaoohAg9aQe1DXFJV7ZSwoM3KfaJmaGV+BlOSqD6TGs75jmUwG11GyTEebg9
+DxXm39mEczVnxLIZNIv4zv0DYIof4sAzMhnGqSesqoUjJeSUUVysp7Mwmk4E48WA
+wCiubahEe0boWHlrT2is5tF88Fwkjjcwqw2jQX1+LeWiB/RA3kNxU4WTx0BFLvyH
+lfwzVP+lAnWMng==
+-----END CERTIFICATE-----

tests/certs/psk1.txt

@@ -0,0 +1 @@
+test1:oaP4EishaeSaishei6rio6xeeph3az

tests/certs/psk2.txt

@@ -0,0 +1 @@
+test2:sah5uishaeSaishei6rio6r8iap3az

tests/certs/revoked_cert.pem

@@ -0,0 +1,48 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEogIBAAKCAQEA7VkojMNX9wmcnIJsRHist/phM9XN5Y5E3yfPzuOYj2ZaA7yE
+yMtl8qMngQJBjYEgkBGr3GD02Xz+j/CDAYD7XbicuyxnR0UH1eADsIQok9ATCAyp
+LJMN7yHix60B62GvdiWUFQC18K8ldhR3497uDf7FVUxcKEnG+pz+jRV+njDUYqGl
+CpoNAfON+9Kf87qdV+Mkxb+Rt+VvNKqzSjrktqtF9kjAs1sibOCuaQq55HdPNJDu
+RATtknx1jwwRnjVANirdYAlgD5J0psLM568B/eBgVlv6wnV+SJClNupNshX3FQox
+vuVENqGEA2d6fXHoyWBD/Dyz6sTwbHst14p9twIDAQABAoIBABL4S0tk2YT/GatQ
+qUKXuoZB1r8D2Z79TffgALXybuEXNx6RVLOPvig0bhXbjk23AllBcFD+1tMDMH1k
+pbPbETweYzh6hg6mL8giTWkwRuX5fWvpRyQu5LA2Lx/ybfLYLePtgPZkxiXkecQE
+QsjNqo0nzbHRlpQJwYOKRLYV/7a43PP6PVszOOz/gxHl4A5o2a6sDY8YDRbJz9BX
+w+PhuhtJMYaTIPnHYD+4zbi3szftkFH/AXyJmKWpusyBUuyAEh07fETAOA7FD7QQ
+TEg7vmLr50uNBt7+luVbfFTC156ehriU+/0DkEgnPORNLPfbv65iRoxAd+T6JxVj
+fbU76OECgYEA/ttZoE+5MyPO+drefjB5OC4sJI/rgf9v8xZdD9MoJNVl/ewst7Pk
+0gkW+t9mD9ZKyi5ecylU2U4vb/MGkrSzkimxEXMxGMMudmhjFcRvoDMBBj7klfsd
+EoQ0YVs5yyJkehGX3+8hSAyIbkrMLQtJrduPVy8qGV7qeupZfKIjCpkCgYEA7mm0
+D82FD2wl8ZqaTe44TNjkDQ6Nk6NmNPNprjwNeMSqNvHvF+irfLagSKAnQfkFs6vQ
+XjGB+3mnBkg+/8BndB5iEYJ41nMkPSNMPy0FYznmLwMFf11p7E6ncqrCLwOEQ3vi
+s3YONadV7ifv/MEBDlmJIgwq74QIAZo/QYu7zM8CgYBKPXWfWHn3pr+9Uv+rPM2j
+Cvg68l3FcbaX1nTnjjhMeomKbYkdPl8yvAkgrYEare79dIJ5A5o+7yKsdtv8Un1Y
+36JAFhFASGM5hPEQPzfRL+plel62Pf9bDH4BukRcozknwgY+6ncEePopPsq5eGdP
+KP1ZhVi7KUYe5jOJNeYFSQKBgGgJ2pi2z+T+BcTb+ZAeb5UhZMtJ2YBe4sAipLBy
+5lIYSEs34mVllEgVDfcDZH5GpDVWudQQ+K771GZKaquCk+K5S4RmkkLK9jpzx9cd
+12cIoilLwT9mTU3guPOyDpEjkLk+O5yi3OqO/lGyPejndIWFjvE7rBTfYfsJC6eX
+yblDAoGAWMZ3050vZXVOlaMJDVEBXT+TVm6lAS+GbAoW1A31Fv6fs+PSGgaRUz/l
+tc1Da39UEBBbX/pudD5XVShnXhR1KeBG9nPRaP70NSXOQjHh0W1OzL9viSMvUx3f
+EsK3y9WO1cr8C89e/9vNektU29irMzTwQQolb+tR9f9BIpae0XM=
+-----END RSA PRIVATE KEY-----
+-----BEGIN CERTIFICATE-----
+MIIDbDCCAlSgAwIBAgIBAzANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJwbDEQ
+MA4GA1UECgwHQ0FfY2VydDEQMA4GA1UECwwHQ0FfY2VydDEQMA4GA1UEAwwHQ0Ff
+Y2VydDEiMCAGCSqGSIb3DQEJARYTQ0FfY2VydEBleGFtcGxlLmNvbTAeFw0xNzA0
+MjYxODQ1MDBaFw0xODA0MTMxNTQ1MDBaMIGLMQswCQYDVQQGEwJwbDEQMA4GA1UE
+CBMHcmV2b2tlZDEQMA4GA1UEBxMHcmV2b2tlZDEQMA4GA1UEChMHcmV2b2tlZDEQ
+MA4GA1UECxMHcmV2b2tlZDEQMA4GA1UEAxMHcmV2b2tlZDEiMCAGCSqGSIb3DQEJ
+ARYTcmV2b2tlZEBleGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
+AQoCggEBAO1ZKIzDV/cJnJyCbER4rLf6YTPVzeWORN8nz87jmI9mWgO8hMjLZfKj
+J4ECQY2BIJARq9xg9Nl8/o/wgwGA+124nLssZ0dFB9XgA7CEKJPQEwgMqSyTDe8h
+4setAethr3YllBUAtfCvJXYUd+Pe7g3+xVVMXChJxvqc/o0Vfp4w1GKhpQqaDQHz
+jfvSn/O6nVfjJMW/kbflbzSqs0o65LarRfZIwLNbImzgrmkKueR3TzSQ7kQE7ZJ8
+dY8MEZ41QDYq3WAJYA+SdKbCzOevAf3gYFZb+sJ1fkiQpTbqTbIV9xUKMb7lRDah
+hANnen1x6MlgQ/w8s+rE8Gx7LdeKfbcCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEA
+TFyPHPwb3CwDvPVlC6pgaowXbDEiQ5vU2Oecq/RwMxhC1FJ5ks+VIQ+KBrDRs9Ao
+k7dF5kuGc3ZAFHgWnzpyUobAyeZchaykLYy8yslwW6xFEbWXW599mjI3D5/N9xcy
+v8IHwqTTQRaxPPdcu3vjDtdpgJY89lFE2mzdPNz24Z/qsTPdLG1668L2CxoplGl2
+0THVrNHxpDF0QqINZpTc6TzsZgvROXmcAYzg2D4v5TmUzXQaLhnPTkcKWfwxpUu0
+XDlFJuNKr+YLS9GY+0lE1kNHpiTEusnfTPRXneDZipD3Hr6LsXX0ahRgbA3loyTJ
+B9Kk23ftqSr4oePTJytIAA==
+-----END CERTIFICATE-----

tests/certs/secrets.txt

@@ -0,0 +1,2 @@
+test1:oaP4EishaeSaishei6rio6xeeph3az
+test2:yah5uS4aijooxilier8iaphuwah1Lo

tests/certs/server_cert.pem

@@ -0,0 +1,47 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEogIBAAKCAQEArdLSbjb/IGtK08jwDx5XSKB96G6kinSwN+3/MEB/SvtuDsDW
+sC4kuS6kh+boOdzT+8rjf+k7ysJNC7td/2ExfJBMvcevsJqaMAhMlDcJLBMFetZ+
+/DPOv6HZIbZToMoGH14GFvt/ed1VzAshzhYKMnLjmC/lxooX1FJhRhVK6fW1HNEj
+vESJIyZA9ssk3VYaw/2cgIV3g/aOP9womk/NTU7AR/hXrCbSx1nYQInyEbk+p8qX
+ELLVS1KnMxoVH7CoqTVG6PH2FH0LJxpE577QKyT3sOfKCKs0PpXrnW3O5OF4itwv
+m1YAhKFWDDF2KyLW6LybFJVS/pDoMcA8tzHv7QIDAQABAoIBAAbCvWaGAxRKuAVW
+umeMIY70lxEURJgSA8yZGCTTTWAoOVafj3oYwVrmgoW6qGufuCsB8ClIdAfl2MNN
+DVHigN88aY+0FZRD3x1hJUFahqPNNZhagWPjy/XOILjb85K8aNKNgKUiMQoXXr/p
+6u2uE8V0jH+d1U0Mj/K1JY1pRJmm4W7Tp366z3goibOK6tWwSbGGiPWXvfy8fZdz
+8Hs/pG3oGEciof5hg55wSfJ+XF24iu850GaIKSNAf6pLUoU6S4zKj01qpSOEY1vN
+Sv5r8/yd3VQzoxk6wVDQvo7qIS7zqvvUqw0iCf3JsWGnQmEGQqwWmLiT8yE1CxFy
+H8veha0CgYEA3lffU6HSXw5zHW3o3Bx6/pGGkPlNzUDi/NbOd2kr/wBOZvmJOR2d
+U0CKoqjJpBTs7CEnpvbSkz4Hit/Y00UgQS1Zvfqo5m1yhWl1jiiHqoe0Alc/P5fa
+YMkkV+++eUUQFNJCiQKMRElkEEEITw21EmflWW86/ln9GAO8YZ1Ne0cCgYEAyCK9
+J4plfXEyTJpltg/7z/0DMuJwc3qRLMicaXcHHWK+C6ZSFOn6rzx/1GWa25Z3sXT8
+XAe98ZCYDK2+twCLtM6z2uKj/xCkZWH8AmaKKbLsMYCHXkOi38EpuxT1uiXosjVf
+ArZoAL472X5d4Eg/szGsfeMmvPm52V7OM3tHbSsCgYBydtR/DqDp1NuIfAvUPUlI
+gwy+18mo8E2rEr7qFJfUyIiUVMTDRa63rFNy1+gu86LhEVSDjS/tI5LoeML8SOsJ
+Atrfhgqrzg6WBivByrXFIeWXCumByKBhEUwHhWIOtnJH9dLRDCHACfRctc4cPJdK
+aXhWKYA6b4NveITj0AKSgwKBgDYFen1j1AVKOsOGoZHFOrlnmCdyC9x/5xPpip7F
+LDx4XMgUOu++QJZwhCi2zFgdg215IG1PAaxk1UYG2AXZtdw2N0IMDyxYN6fODRIw
+z3Z1/19VTDTbmOlA4JzJCZMXjHoeAelfhy88KjeI7poNpnQeImtQlzJHTi0odAxd
+aGhFAoGAfxHh4GhsIpIwxQMKINUXvwQAI3rUph5gMv0MS3CAwoVAFNzKZeJQsRVW
+IsI830HC+sPEpekiGcYFsRIbZv+Eh/f4j9TJ7eqUrkxVluleFU6YFHuFepbmcH4L
+nZKr5bR+kg4g0g3iqNey5pJIfTj+GoLmnv6GakqQNUdFSBAJ98g=
+-----END RSA PRIVATE KEY-----
+-----BEGIN CERTIFICATE-----
+MIIDVDCCAjygAwIBAgIBAjANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJwbDEQ
+MA4GA1UECgwHQ0FfY2VydDEQMA4GA1UECwwHQ0FfY2VydDEQMA4GA1UEAwwHQ0Ff
+Y2VydDEiMCAGCSqGSIb3DQEJARYTQ0FfY2VydEBleGFtcGxlLmNvbTAeFw0xNzA0
+MjYxODQzMDBaFw0xODA0MTMxNTQ1MDBaMHQxCzAJBgNVBAYTAnBsMQ8wDQYDVQQI
+EwZzZXJ2ZXIxDzANBgNVBAoTBnNlcnZlcjEPMA0GA1UECxMGc2VydmVyMQ8wDQYD
+VQQDEwZzZXJ2ZXIxITAfBgkqhkiG9w0BCQEWEnNlcnZlckBleGFtcGxlLmNvbTCC
+ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK3S0m42/yBrStPI8A8eV0ig
+fehupIp0sDft/zBAf0r7bg7A1rAuJLkupIfm6Dnc0/vK43/pO8rCTQu7Xf9hMXyQ
+TL3Hr7CamjAITJQ3CSwTBXrWfvwzzr+h2SG2U6DKBh9eBhb7f3ndVcwLIc4WCjJy
+45gv5caKF9RSYUYVSun1tRzRI7xEiSMmQPbLJN1WGsP9nICFd4P2jj/cKJpPzU1O
+wEf4V6wm0sdZ2ECJ8hG5PqfKlxCy1UtSpzMaFR+wqKk1Rujx9hR9CycaROe+0Csk
+97DnygirND6V651tzuTheIrcL5tWAIShVgwxdisi1ui8mxSVUv6Q6DHAPLcx7+0C
+AwEAATANBgkqhkiG9w0BAQUFAAOCAQEAiPQrjJbTZ6NB+FO0lJtt5vEBLdepkl6x
+mtopQRxHPZIuUqV8viP9EW2PlrrPkpdbYZtkD0AuCXiqGD9u31kIHKG05GiQYj8q
+XPy55QuOntWfwJc4GEZ9uebYckHGSNLsyubdkneLeXlEZz2RbtCoZS5337nlaUCm
+93Hp/bRCFZ7if9tiscxwTft92z2+Tc5bI4JGAJfex/VgyggpNRLSDDRibNvFrooO
+1kSnDxySyCtysodXfonWpJFA9EAcUHXY6vlGvzLVJRfrqsS7vC/fuKOz684XDYIL
+g/eJED4XR47T8gA85vM8LWl80lXvfFIYsirOnYmeQDSfTRDG9eZG6Q==
+-----END CERTIFICATE-----

tests/certs/stunnel.pem

@@ -0,0 +1,52 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDOzXhuuDTB83n4
+5gy6buWIi4umz40Qdw11SuQQt3xV1MlZGFl+MuX+Py8/PmvvzzCdwYLG0oTGCrzK
+zdO08tbr0z9y50Q6i+YXP33myS75kMvoB/jVHGx7cVZq/xjwCE8gFJNPI52HUEOH
+Prtqg51a1shWy+208uYK96iROUaoTeIFhhJ8SScsiMWZIKgEqalWjdeSwBrSEEUa
+EM3ORd3huJ2FElDMeZ86ucAlAaOqIhw37M9OpunkOqE37GagnYxQdU8bxKLOuNGr
+ShT2eU8fDDqw9ypSfwCrordSz0oBV6sjUYAEAIOXOpWfTBDXlk0CO5hnSDjDaikp
+lTax3ze7AgMBAAECggEBALryujV1JpRSs2fTJ5x91dgbNlLE++Pvi+YFnqiSBr9c
+zexR+8z+3DV8Dw0gM9klNvDV15A/DTIu0L6RVRoWET48yPXppR88CvPnPLyeEG4h
+fIO0eTjGKjdpnNK662NKT6VTlFuNecGySGmBx1Ehy+Urlw4H6kqS7mzpt6QY4AwS
+Qr1CHx43tyc7XyAWjb+7d+VUhAhoJPKobkF4J83KxDFN1q+7/gLaX+2Twh78aM8A
+PBxEOG37FcJx2l81EK5UpxNXoJPo15uPzUD8mH+1p4z203eNYo4qB1ruo4wNJhLB
+cO6kA4z5M6xQkgB4UafQh5R2/CseNHvvGmhB61R6eOkCgYEA+Pa8UASeDcNrnF/l
+ObtSETEnJbijBabObbxRYlLdhwF6hp+ASdLt0agQGOTnhJUP7goQyJr6ww9ODoA8
+dJw5utmIGGv1vBae5SwxEamBgMRkn3tSZy6MW06LfhHjPc7Ky1DMbuzGlIoYJzXs
+W7ECAIGblgv2NFJHSRVJFB7aJccCgYEA1KWyXA2TGCLY4xY3QMjiprwbzQgcPRH/
+w6mmOzh44nrT3YhQrDC+55KjXPoml8NKc+smW6cR8Yv01fLFc6Ec0mBWZqpOQvwM
+P58JAFf/us/L5ZcdKuYwYxVYHW1s/t4SXZPD/A5TdspLrJvF6Ib8NrzFfu1ym7z8
+N8Kg2uqxzm0CgYEAy8TnDHc7BfjUswCqFT6ERR399JnSlGWav6ZK1jcMqdtD9bvG
+vKWvkNIFmtp/w7xddW83nXl7lPuJ38SFtsvHVG+HPLXgQzogg2JQJyydmk8kLIQ7
+RciLiJAZC+6IF6aRxSc0q/WP8zOz4SP5eHLAOLncJktUEC7nuaF6VsWJtzECgYAM
+Yo4t0FiV2km5iCy1qD2TKneQDH3gjLDRy4qz/kkEH9VBHNReAwTLZf3/x04CHsyy
+TarRQbzIzbb30wjvAB42nofJuPeP7TAlcHTMwVNSpRGiEJgRTJDa5H5aUGo9ud9l
+9do/TvJLg+K+beAr99ius3XpO5kmOu6RrNNDjNHITQKBgQDr0V+awa944XZLUCmD
+uxCiheqiUKJKe5uYX8/jBFQ4onQFHlzGRtd3wpTZ3JHPPLOGYkAVognXy0LqM9zG
+E1nozTRsSqfy2qfSgSGiSmxktoPWTen7YpA0+J+d+T6UcBfvWVbAFvBmk+2n1nXa
+040QCD05eHlIWVrTIMgGqfRrgQ==
+-----END PRIVATE KEY-----
+-----BEGIN CERTIFICATE-----
+MIIEAzCCAuugAwIBAgIJAIMM7qk8vX8HMA0GCSqGSIb3DQEBBQUAMIGDMQswCQYD
+VQQGEwJQTDEZMBcGA1UECAwQTWF6b3ZpYSBQcm92aW5jZTEPMA0GA1UEBwwGV2Fy
+c2F3MRswGQYDVQQKDBJTdHVubmVsIERldmVsb3BlcnMxFzAVBgNVBAsMDlByb3Zp
+c2lvbmFsIENBMRIwEAYDVQQDDAlsb2NhbGhvc3QwHhcNMTcwNDI3MTc1MzM5WhcN
+MjEwNDI3MTc1MzM5WjCBgzELMAkGA1UEBhMCUEwxGTAXBgNVBAgMEE1hem92aWEg
+UHJvdmluY2UxDzANBgNVBAcMBldhcnNhdzEbMBkGA1UECgwSU3R1bm5lbCBEZXZl
+bG9wZXJzMRcwFQYDVQQLDA5Qcm92aXNpb25hbCBDQTESMBAGA1UEAwwJbG9jYWxo
+b3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzs14brg0wfN5+OYM
+um7liIuLps+NEHcNdUrkELd8VdTJWRhZfjLl/j8vPz5r788wncGCxtKExgq8ys3T
+tPLW69M/cudEOovmFz995sku+ZDL6Af41Rxse3FWav8Y8AhPIBSTTyOdh1BDhz67
+aoOdWtbIVsvttPLmCveokTlGqE3iBYYSfEknLIjFmSCoBKmpVo3XksAa0hBFGhDN
+zkXd4bidhRJQzHmfOrnAJQGjqiIcN+zPTqbp5DqhN+xmoJ2MUHVPG8SizrjRq0oU
+9nlPHww6sPcqUn8Aq6K3Us9KAVerI1GABACDlzqVn0wQ15ZNAjuYZ0g4w2opKZU2
+sd83uwIDAQABo3gwdjARBglghkgBhvhCAQEEBAMCBkAwDwYDVR0TBAgwBgEB/wIB
+ADALBgNVHQ8EBAMCAgQwEwYDVR0lBAwwCgYIKwYBBQUHAwEwLgYJYIZIAYb4QgEN
+BCEWH3N0dW5uZWwgc2VsZi1zaWduZWQgY2VydGlmaWNhdGUwDQYJKoZIhvcNAQEF
+BQADggEBAEVV6RJ4N+7Y4ImwrxalKnM+RX1c0tRXeX2NCLYeTypu1MNbyXJeWSrR
+N7r49JuxrJSnIFHpTcZzGxOFI8flVeDXDFdt6hpvWX/p+RIVPj2TARNh0VrTni7O
+imcTGlbakxiGk6whM9fh3I1Kxvz949DC6Y8prLuwnjBnQYsyHJC6WQsIKlT/+fnp
+hyX1lRUVAWa6UHPAFq39RsUQLOA5w95A6fDkfXevx/PfjHEpymK0C6/C+amu5dhz
+xNZQsGDEG749Ny+xI1azUG7pwOEZmXN+hZKMs8YPG6NpAf63xhNFBAYpjT4wlE1/
+96h/XIphwPJAiVbc7lxcHpTTlZfcQi8=
+-----END CERTIFICATE-----

tests/execute

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+printf "%-35s\t%s\n" "test $1" "success"

tests/make_test

@@ -0,0 +1,59 @@
+#!/bin/sh
+
+result=0
+count=0
+fail=0
+skip=0
+
+result_path=$(pwd)
+cd $(dirname "$0")
+script_path=$(pwd)
+cd "${result_path}"
+result_path="${result_path}/logs"
+
+if [ -n "$(command -v ncat)" ]
+  then # ncat
+    mynetcat="ncat"
+  elif [ -n "$(command -v nc)" ]
+    then # nc
+      mynetcat="nc"
+  else # # netcat not found
+    mynetcat="null"
+  fi
+if [ "$mynetcat" != "null" ] # netcat is required
+  then
+    rm -rf "${result_path}"
+    mkdir "${result_path}"
+    cd "${result_path}"
+    date > "results.log"
+    ../../src/stunnel -version 2>> "results.log"
+    printf "\n%s\n" "Testing..." >> "results.log"
+    head -n5 "results.log"
+    for plik in ${script_path}/recipes/*
+      do
+        /bin/sh $plik $mynetcat
+        state=$?
+        if [ "$state" -eq 0 ]
+          then # $state=0
+            count=$((count + 1))
+          elif [ "$state" -eq 125 ]
+            then # $state=125
+              skip=$((skip + 1))
+          else # $state=1
+            fail=$((fail + 1))
+            result=1
+          fi
+      done
+    if [ $count -eq 0 ]
+      then # no test was done
+        result=1
+      fi
+    printf "%s\n" "summary: success $count, skip $skip, fail $fail"
+    printf "%s\n" "summary: success $count, skip $skip, fail $fail" >> "results.log"
+    printf "%s\n" "./make_test finished"
+    cd ..
+  else # netcat not found
+    printf "%s\n" "./make_test skipped: ncat (nc) not found in \$PATH"
+    #result=125
+  fi
+exit $result

tests/recipes/010_require_cert

@@ -0,0 +1,28 @@
+#!/bin/sh
+. $(dirname $0)/../test_library
+
+start() {
+  ../../src/stunnel -fd 0 <<EOT
+  debug = debug
+  syslog = no
+  pid = ${result_path}/stunnel.pid
+  output = ${result_path}/stunnel.log
+
+  [https client]
+  client = yes
+  accept = 127.0.0.1:${http1}
+  connect = 127.0.0.1:${https}
+  cert = ${script_path}/certs/client_cert.pem
+
+  [https server]
+  accept = 127.0.0.1:${https}
+  connect = 127.0.0.1:${http2}
+  cert = ${script_path}/certs/server_cert.pem
+  requireCert = yes
+EOT
+}
+
+check_ports "010_require_cert"
+start 2> "error.log"
+test_log_for "010_require_cert" "success" "$1" 2>> "stderr.log"
+exit $?

tests/recipes/011_verify_peer

@@ -0,0 +1,29 @@
+#!/bin/sh
+. $(dirname $0)/../test_library
+
+start() {
+  ../../src/stunnel -fd 0 <<EOT
+  debug = debug
+  syslog = no
+  pid = ${result_path}/stunnel.pid
+  output = ${result_path}/stunnel.log
+
+  [https client]
+  client = yes
+  accept = 127.0.0.1:${http1}
+  connect = 127.0.0.1:${https}
+  cert = ${script_path}/certs/client_cert.pem
+
+  [https server]
+  accept = 127.0.0.1:${https}
+  connect = 127.0.0.1:${http2}
+  cert = ${script_path}/certs/server_cert.pem
+  verifyPeer = yes
+  CAfile = ${script_path}/certs/PeerCerts.pem
+EOT
+}
+
+check_ports "011_verify_peer"
+start 2> "error.log"
+test_log_for "011_verify_peer" "success" "$1" 2>> "stderr.log"
+exit $?

tests/recipes/012_verify_chain

@@ -0,0 +1,28 @@
+#!/bin/sh
+. $(dirname $0)/../test_library
+
+start() {
+  ../../src/stunnel -fd 0 <<EOT
+  debug = debug
+  syslog = no
+  pid = ${result_path}/stunnel.pid
+  output = ${result_path}/stunnel.log
+
+  [https client]
+  client = yes
+  accept = 127.0.0.1:${http1}
+  connect = 127.0.0.1:${https}
+  verifyChain = yes
+  CAfile = ${script_path}/certs/CACert.pem
+
+  [https server]
+  accept = 127.0.0.1:${https}
+  connect = 127.0.0.1:${http2}
+  cert = ${script_path}/certs/server_cert.pem
+EOT
+}
+
+check_ports "012_verify_chain"
+start 2> "error.log"
+test_log_for "012_verify_chain" "success" "$1" 2>> "stderr.log"
+exit $?

tests/recipes/013_CRL_file

@@ -0,0 +1,29 @@
+#!/bin/sh
+. $(dirname $0)/../test_library
+
+start() {
+  ../../src/stunnel -fd 0 <<EOT
+  debug = debug
+  syslog = no
+  pid = ${result_path}/stunnel.pid
+  output = ${result_path}/stunnel.log
+
+  [https client]
+  client = yes
+  accept = 127.0.0.1:${http1}
+  connect = 127.0.0.1:${https}
+  verifyChain = yes
+  CAfile = ${script_path}/certs/CACert.pem
+  CRLfile = ${script_path}/certs/CACertCRL.pem
+
+  [https server]
+  accept = 127.0.0.1:${https}
+  connect = 127.0.0.1:${http2}
+  cert = ${script_path}/certs/server_cert.pem
+EOT
+}
+
+check_ports "013_CRL_file"
+start 2> "error.log"
+test_log_for "013_CRL_file" "success" "$1" 2>> "stderr.log"
+exit $?

tests/recipes/014_PSK_secrets

@@ -0,0 +1,35 @@
+#!/bin/sh
+. $(dirname $0)/../test_library
+
+start() {
+  ../../src/stunnel -fd 0 <<EOT
+  debug = debug
+  syslog = no
+  pid = ${result_path}/stunnel.pid
+  output = ${result_path}/stunnel.log
+  sslVersion = TLSv1
+
+  [https client]
+  client = yes
+  accept = 127.0.0.1:${http1}
+  connect = 127.0.0.1:${https}
+  PSKsecrets = ${script_path}/certs/psk1.txt
+
+  [https server]
+  accept = 127.0.0.1:${https}
+  connect = 127.0.0.1:${http2}
+  ciphers = PSK
+  PSKsecrets = ${script_path}/certs/secrets.txt
+EOT
+}
+
+check_ports "014_PSK_secrets"
+if grep -q "OpenSSL 1" "results.log"
+  then
+    start 2> "error.log"
+    test_log_for "014_PSK_secrets" "success" "$1" 2>> "stderr.log"
+    exit $?
+  else
+    exit_logs "014_PSK_secrets" "skipped"
+    exit 125
+  fi

tests/recipes/015_p12_cert

@@ -0,0 +1,32 @@
+#!/bin/sh
+. $(dirname $0)/../test_library
+
+start() {
+  ../../src/stunnel -fd 0 <<EOT
+  debug = debug
+  syslog = no
+  pid = ${result_path}/stunnel.pid
+  output = ${result_path}/stunnel.log
+
+  [https client]
+  client = yes
+  accept = 127.0.0.1:${http1}
+  connect = 127.0.0.1:${https}
+
+  [https server]
+  accept = 127.0.0.1:${https}
+  connect = 127.0.0.1:${http2}
+  cert = ${script_path}/certs/server_cert.p12
+EOT
+}
+
+check_ports "015_p12_cert"
+if grep -q "OpenSSL 1" "results.log"
+  then
+    start 2> "error.log"
+    test_log_for "015_p12_cert" "success" "$1" 2>> "stderr.log"
+    exit $?
+  else
+    exit_logs "015_p12_cert" "skipped"
+    exit 125
+  fi

tests/recipes/020_IPv6

@@ -0,0 +1,32 @@
+#!/bin/sh
+. $(dirname $0)/../test_library
+
+start() {
+  ../../src/stunnel -fd 0 <<EOT
+  debug = debug
+  syslog = no
+  pid = ${result_path}/stunnel.pid
+  output = ${result_path}/stunnel.log
+
+  [https client]
+  client = yes
+  accept = 127.0.0.1:${http1}
+  connect = :::${https}
+
+  [https server]
+  accept = :::${https}
+  connect = 127.0.0.1:${http2}
+  cert = ${script_path}/certs/stunnel.pem
+EOT
+}
+
+check_ports "020_IPv6"
+if grep -q "IPv6" "results.log" && PATH="${PATH}:/sbin:/usr/sbin" ifconfig | grep -q "inet6" && [ -n "$(command -v ncat)" ] # nc does not support IPv6
+  then
+    start 2> "error.log"
+    test_log_for "020_IPv6" "success" "$1" 2>> "stderr.log"
+    exit $?
+  else
+    exit_logs "020_IPv6" "skipped"
+    exit 125
+  fi

tests/recipes/021_FIPS

@@ -0,0 +1,33 @@
+#!/bin/sh
+. $(dirname $0)/../test_library
+
+start() {
+  ../../src/stunnel -fd 0 <<EOT
+  debug = debug
+  syslog = no
+  pid = ${result_path}/stunnel.pid
+  output = ${result_path}/stunnel.log
+  fips = yes
+
+  [https client]
+  client = yes
+  accept = 127.0.0.1:${http1}
+  connect = 127.0.0.1:${https}
+
+  [https server]
+  accept = 127.0.0.1:${https}
+  connect = 127.0.0.1:${http2}
+  cert = ${script_path}/certs/stunnel.pem
+EOT
+}
+
+check_ports "021_FIPS"
+if grep -q "FIPS" results.log && grep -q "\-fips" results.log
+  then
+    start 2> "error.log"
+    test_log_for "021_FIPS" "success" "$1" 2>> "stderr.log"
+    exit $?
+  else
+    exit_logs "021_FIPS" "skipped"
+    exit 125
+  fi

tests/recipes/030_simple_execute

@@ -0,0 +1,27 @@
+#!/bin/sh
+. $(dirname $0)/../test_library
+
+start() {
+  ../../src/stunnel -fd 0 <<EOT
+  debug = debug
+  syslog = no
+  pid = ${result_path}/stunnel.pid
+  output = ${result_path}/stunnel.log
+
+  [https client]
+  client = yes
+  accept = 127.0.0.1:${http1}
+  connect = 127.0.0.1:${https}
+
+  [https server]
+  accept = 127.0.0.1:${https}
+  exec = ${script_path}/execute
+  execArgs = execute 030_simple_execute
+  cert = ${script_path}/certs/server_cert.pem
+EOT
+}
+
+check_ports "030_simple_execute"
+start 2> "error.log"
+test_log_for "030_simple_execute" "execute" "$1" 2>> "stderr.log"
+exit $?

tests/recipes/031_redirect

@@ -0,0 +1,54 @@
+#!/bin/sh
+. $(dirname $0)/../test_library
+
+start() {
+  ../../src/stunnel -fd 0 <<EOT
+  debug = debug
+  syslog = no
+  pid = ${result_path}/stunnel.pid
+  output = ${result_path}/stunnel.log
+
+  [https client]
+  client = yes
+  accept = 127.0.0.1:${http1}
+  connect = 127.0.0.1:${https}
+  ;cert = ${script_path}/certs/client_cert.pem
+;wrong certificate
+  cert = ${script_path}/certs/stunnel.pem
+
+  [client_2]
+  client = yes
+  accept = 127.0.0.1:${http2}
+  connect = 127.0.0.1:${https2}
+
+  [client_3]
+  client = yes
+  accept = 127.0.0.1:${http3}
+  connect = 127.0.0.1:${https3}
+
+  [https server]
+  accept = 127.0.0.1:${https}
+  connect = 127.0.0.1:${http2}
+  redirect = ${http3}
+  cert = ${script_path}/certs/server_cert.pem
+  verifyPeer = yes
+  CAfile = ${script_path}/certs/PeerCerts.pem
+
+  [server_2]
+  accept = 127.0.0.1:${https2}
+  cert = ${script_path}/certs/server_cert.pem
+  exec = ${script_path}/execute
+  execArgs = execute 031_redirect_error
+
+  [server_3]
+  accept = 127.0.0.1:${https3}
+  cert = ${script_path}/certs/server_cert.pem
+  exec = ${script_path}/execute
+  execArgs = execute 031_redirect
+EOT
+}
+
+check_ports "031_redirect"
+start 2> "error.log"
+test_log_for "031_redirect" "execute" "$1" 2>> "stderr.log"
+exit $?

tests/recipes/032_no_redirect

@@ -0,0 +1,53 @@
+#!/bin/sh
+. $(dirname $0)/../test_library
+
+start() {
+  ../../src/stunnel -fd 0 <<EOT
+  debug = debug
+  syslog = no
+  pid = ${result_path}/stunnel.pid
+  output = ${result_path}/stunnel.log
+
+  [https client]
+  client = yes
+  accept = 127.0.0.1:${http1}
+  connect = 127.0.0.1:${https}
+;correct certificate
+  cert = ${script_path}/certs/client_cert.pem
+
+  [client_2]
+  client = yes
+  accept = 127.0.0.1:${http2}
+  connect = 127.0.0.1:${https2}
+
+  [client_3]
+  client = yes
+  accept = 127.0.0.1:${http3}
+  connect = 127.0.0.1:${https3}
+
+  [https server]
+  accept = 127.0.0.1:${https}
+  connect = 127.0.0.1:${http2}
+  redirect = ${http3}
+  cert = ${script_path}/certs/server_cert.pem
+  verifyPeer = yes
+  CAfile = ${script_path}/certs/PeerCerts.pem
+
+  [server_2]
+  accept = 127.0.0.1:${https2}
+  cert = ${script_path}/certs/server_cert.pem
+  exec = ${script_path}/execute
+  execArgs = execute 032_no_redirect
+
+  [server_3]
+  accept = 127.0.0.1:${https3}
+  cert = ${script_path}/certs/server_cert.pem
+  exec = ${script_path}/execute
+  execArgs = execute 032_no_redirect_error
+EOT
+}
+
+check_ports "032_no_redirect"
+start 2> "error.log"
+test_log_for "032_no_redirect" "execute" "$1" 2>> "stderr.log"
+exit $?

tests/recipes/033_redirect_exec

@@ -0,0 +1,44 @@
+#!/bin/sh
+. $(dirname $0)/../test_library
+
+start() {
+  ../../src/stunnel -fd 0 <<EOT
+  debug = debug
+  syslog = no
+  pid = ${result_path}/stunnel.pid
+  output = ${result_path}/stunnel.log
+
+  [https client]
+  client = yes
+  accept = 127.0.0.1:${http1}
+  connect = 127.0.0.1:${https}
+  ;cert = ${script_path}/certs/client_cert.pem
+;wrong certificate
+  cert = ${script_path}/certs/stunnel.pem
+
+  [client_2]
+  client = yes
+  accept = 127.0.0.1:${http2}
+  connect = 127.0.0.1:${https2}
+
+  [https server]
+  accept = 127.0.0.1:${https}
+  exec = ${script_path}/execute
+  execArgs = execute 033_redirect_exec_error
+  redirect = ${http2}
+  cert = ${script_path}/certs/server_cert.pem
+  verifyPeer = yes
+  CAfile = ${script_path}/certs/PeerCerts.pem
+
+  [server_2]
+  accept = 127.0.0.1:${https2}
+  cert = ${script_path}/certs/server_cert.pem
+  exec = ${script_path}/execute
+  execArgs = execute 033_redirect_exec
+EOT
+}
+
+check_ports "033_redirect_exec"
+start 2> "error.log"
+test_log_for "033_redirect_exec" "execute" "$1" 2>> "stderr.log"
+exit $?

tests/recipes/034_no_redirect_exec

@@ -0,0 +1,43 @@
+#!/bin/sh
+. $(dirname $0)/../test_library
+
+start() {
+  ../../src/stunnel -fd 0 <<EOT
+  debug = debug
+  syslog = no
+  pid = ${result_path}/stunnel.pid
+  output = ${result_path}/stunnel.log
+
+  [https client]
+  client = yes
+  accept = 127.0.0.1:${http1}
+  connect = 127.0.0.1:${https}
+;correct certificate
+  cert = ${script_path}/certs/client_cert.pem
+
+  [client_2]
+  client = yes
+  accept = 127.0.0.1:${http2}
+  connect = 127.0.0.1:${https2}
+
+  [https server]
+  accept = 127.0.0.1:${https}
+  exec = ${script_path}/execute
+  execArgs = execute 034_no_redirect_exec
+  redirect = ${http2}
+  cert = ${script_path}/certs/server_cert.pem
+  verifyPeer = yes
+  CAfile = ${script_path}/certs/PeerCerts.pem
+
+  [server_2]
+  accept = 127.0.0.1:${https2}
+  cert = ${script_path}/certs/server_cert.pem
+  exec = ${script_path}/execute
+  execArgs = execute 034_no_redirect_exec_error
+EOT
+}
+
+check_ports "034_no_redirect_exec"
+start 2> "error.log"
+test_log_for "034_no_redirect_exec" "execute" "$1" 2>> "stderr.log"
+exit $?

tests/recipes/035_SNI

@@ -0,0 +1,43 @@
+#!/bin/sh
+. $(dirname $0)/../test_library
+
+start() {
+  ../../src/stunnel -fd 0 <<EOT
+  debug = debug
+  syslog = no
+  pid = ${result_path}/stunnel.pid
+  output = ${result_path}/stunnel.log
+
+  [https client]
+  client = yes
+  accept = 127.0.0.1:${http1}
+  connect = 127.0.0.1:${https}
+  sni = sni.mydomain.com
+  cert = ${script_path}/certs/client_cert.pem
+
+  [virtual]
+  accept = 127.0.0.1:${https}
+  cert =  ${script_path}/certs/server_cert.pem
+  exec = ${script_path}/execute
+  execArgs = execute 035_SNI_error
+
+  [sni]
+  sni = virtual:sni.mydomain.com
+  cert = ${script_path}/certs/server_cert.pem
+  exec = ${script_path}/execute
+  execArgs = execute 035_SNI
+  verifyPeer = yes
+  CAfile = ${script_path}/certs/PeerCerts.pem
+EOT
+}
+
+check_ports "035_SNI"
+if grep -q "OpenSSL 1" "results.log"
+  then
+    start 2> "error.log"
+    test_log_for "035_SNI" "execute" "$1" 2>> "stderr.log"
+    exit $?
+  else
+    exit_logs "035_SNI" "skipped"
+    exit 125
+  fi

tests/recipes/036_no_SNI

@@ -0,0 +1,40 @@
+#!/bin/sh
+. $(dirname $0)/../test_library
+
+start() {
+  ../../src/stunnel -fd 0 <<EOT
+  debug = debug
+  syslog = no
+  pid = ${result_path}/stunnel.pid
+  output = ${result_path}/stunnel.log
+
+  [https client]
+  client = yes
+  accept = 127.0.0.1:${http1}
+  connect = 127.0.0.1:${https}
+  ;sni = sni.mydomain.com
+
+  [virtual]
+  accept = 127.0.0.1:${https}
+  cert =  ${script_path}/certs/server_cert.pem
+  exec = ${script_path}/execute
+  execArgs = execute 036_no_SNI
+
+  [sni]
+  sni = virtual:sni.mydomain.com
+  cert = ${script_path}/certs/server_cert.pem
+  exec = ${script_path}/execute
+  execArgs = execute 036_no_SNI_error
+EOT
+}
+
+check_ports "036_no_SNI"
+if grep -q "OpenSSL 1" "results.log"
+  then
+    start 2> "error.log"
+    test_log_for "036_no_SNI" "execute" "$1" 2>> "stderr.log"
+    exit $?
+  else
+    exit_logs "036_no_SNI" "skipped"
+    exit 125
+  fi

tests/recipes/037_failover_prio1

@@ -0,0 +1,32 @@
+#!/bin/sh
+. $(dirname $0)/../test_library
+
+start() {
+  ../../src/stunnel -fd 0 <<EOT
+  debug = debug
+  syslog = no
+  pid = ${result_path}/stunnel.pid
+  output = ${result_path}/stunnel.log
+
+  [https client]
+  client = yes
+  failover = prio
+  accept = 127.0.0.1:${http1}
+  connect = 127.0.0.1:${https}
+  connect = 127.0.0.1:${https2}
+
+  [https server_1]
+  accept = 127.0.0.1:${https}
+  connect = 127.0.0.1:${http2}
+  cert = ${script_path}/certs/server_cert.pem
+
+  [https server_2]
+  accept = 127.0.0.1:${https2}
+  connect = 127.0.0.1:${http2}
+  cert = ${script_path}/certs/server_cert.pem
+EOT
+}
+
+check_ports "037_failover_prio1"
+test_log_for "037_failover_prio1" "prio" "$1" 2>> "stderr.log"
+exit $?

tests/recipes/038_failover_prio2

@@ -0,0 +1,32 @@
+#!/bin/sh
+. $(dirname $0)/../test_library
+
+start() {
+  ../../src/stunnel -fd 0 <<EOT
+  debug = debug
+  syslog = no
+  pid = ${result_path}/stunnel.pid
+  output = ${result_path}/stunnel.log
+
+  [https client]
+  client = yes
+  failover = prio
+  accept = 127.0.0.1:${http1}
+  connect = 127.0.0.1:${https}
+  connect = 127.0.0.1:${https2}
+
+  ;[https server_1]
+  ;accept = 127.0.0.1:${https}
+  ;connect = 127.0.0.1:${http2}
+  ;cert = ${script_path}/certs/server_cert.pem
+
+  [https server_2]
+  accept = 127.0.0.1:${https2}
+  connect = 127.0.0.1:${http2}
+  cert = ${script_path}/certs/server_cert.pem
+EOT
+}
+
+check_ports "038_failover_prio2"
+test_log_for "038_failover_prio2" "prio" "$1" 2>> "stderr.log"
+exit $?

tests/recipes/039_failover_rr

@@ -0,0 +1,38 @@
+#!/bin/sh
+. $(dirname $0)/../test_library
+
+start() {
+  ../../src/stunnel -fd 0 <<EOT
+  debug = debug
+  syslog = no
+  pid = ${result_path}/stunnel.pid
+  output = ${result_path}/stunnel.log
+
+  [https client]
+  client = yes
+  failover = rr
+  accept = 127.0.0.1:${http1}
+  connect = 127.0.0.1:${https}
+  connect = 127.0.0.1:${https2}
+  connect = 127.0.0.1:${https3}
+
+  [https server_1]
+  accept = 127.0.0.1:${https}
+  connect = 127.0.0.1:${http2}
+  cert = ${script_path}/certs/server_cert.pem
+
+  [https server_2]
+  accept = 127.0.0.1:${https2}
+  connect = 127.0.0.1:${http2}
+  cert = ${script_path}/certs/server_cert.pem
+
+  [https server_3]
+  accept = 127.0.0.1:${https3}
+  connect = 127.0.0.1:${http2}
+  cert = ${script_path}/certs/server_cert.pem
+EOT
+}
+
+check_ports "039_failover_rr"
+test_log_for "039_failover_rr" "rr" "$1" 2>> "stderr.log"
+exit $?

tests/recipes/040_reload

@@ -0,0 +1,43 @@
+#!/bin/sh
+. $(dirname $0)/../test_library
+
+check_ports "040_reload"
+
+echo "
+  debug = debug
+  syslog = no
+  pid = ${result_path}/stunnel.pid
+  output = ${result_path}/stunnel.log
+
+  [https client]
+  client = yes
+  accept = 127.0.0.1:${http3}
+  connect = 127.0.0.1:${https}
+
+  [https server]
+  accept = 127.0.0.1:${https}
+  connect = 127.0.0.1:${http2}
+  cert = ${script_path}/certs/server_cert.pem" > "stunnel.conf"
+
+../../src/stunnel stunnel.conf 2> "error.log"
+
+#  accept = 127.0.0.1:${http3} -> accept = 127.0.0.1:${http1}
+echo "
+  debug = debug
+  syslog = no
+  pid = ${result_path}/stunnel.pid
+  output = ${result_path}/stunnel.log
+
+  [https client]
+  client = yes
+  accept = 127.0.0.1:${http1}
+  connect = 127.0.0.1:${https}
+
+  [https server]
+  accept = 127.0.0.1:${https}
+  connect = 127.0.0.1:${http2}
+  cert = ${script_path}/certs/server_cert.pem" > "stunnel.conf"
+
+reload_stunnel
+test_log_for "040_reload" "success" "$1" 2>> "stderr.log"
+exit $?

tests/recipes/110_failure_require_cert

@@ -0,0 +1,28 @@
+#!/bin/sh
+. $(dirname $0)/../test_library
+
+start() {
+  ../../src/stunnel -fd 0 <<EOT
+  debug = debug
+  syslog = no
+  pid = ${result_path}/stunnel.pid
+  output = ${result_path}/stunnel.log
+
+  [https client]
+  client = yes
+  accept = 127.0.0.1:${http1}
+  connect = 127.0.0.1:${https}
+  ;cert = ${script_path}/certs/client_cert.pem
+
+  [https server]
+  accept = 127.0.0.1:${https}
+  connect = 127.0.0.1:${http2}
+  cert = ${script_path}/certs/server_cert.pem
+  requireCert = yes
+EOT
+}
+
+check_ports "110_failure_require_cert"
+start 2> "error.log"
+test_log_for "110_failure_require_cert" "failure" "$1" 2>> "stderr.log"
+exit $?

tests/recipes/111_failure_verify_peer

@@ -0,0 +1,29 @@
+#!/bin/sh
+. $(dirname $0)/../test_library
+
+start() {
+  ../../src/stunnel -fd 0 <<EOT
+  debug = debug
+  syslog = no
+  pid = ${result_path}/stunnel.pid
+  output = ${result_path}/stunnel.log
+
+  [https client]
+  client = yes
+  accept = 127.0.0.1:${http1}
+  connect = 127.0.0.1:${https}
+  cert = ${script_path}/certs/stunnel.pem
+
+  [https server]
+  accept = 127.0.0.1:${https}
+  connect = 127.0.0.1:${http2}
+  cert = ${script_path}/certs/server_cert.pem
+  verifyPeer = yes
+  CAfile = ${script_path}/certs/CACert.pem
+EOT
+}
+
+check_ports "111_failure_verify_peer"
+start 2> "error.log"
+test_log_for "111_failure_verify_peer" "failure" "$1" 2>> "stderr.log"
+exit $?

tests/recipes/112_failure_verify_chain

@@ -0,0 +1,28 @@
+#!/bin/sh
+. $(dirname $0)/../test_library
+
+start() {
+  ../../src/stunnel -fd 0 <<EOT
+  debug = debug
+  syslog = no
+  pid = ${result_path}/stunnel.pid
+  output = ${result_path}/stunnel.log
+
+  [https client]
+  client = yes
+  accept = 127.0.0.1:${http1}
+  connect = 127.0.0.1:${https}
+  verifyChain = yes
+  CAfile = ${script_path}/certs/CACert.pem
+
+  [https server]
+  accept = 127.0.0.1:${https}
+  connect = 127.0.0.1:${http2}
+  cert = ${script_path}/certs/stunnel.pem
+EOT
+}
+
+check_ports "112_failure_verify_chain"
+start 2> "error.log"
+test_log_for "112_failure_verify_chain" "failure" "$1" 2>> "stderr.log"
+exit $?

tests/recipes/113_failure_CRL_file

@@ -0,0 +1,29 @@
+#!/bin/sh
+. $(dirname $0)/../test_library
+
+start() {
+  ../../src/stunnel -fd 0 <<EOT
+  debug = debug
+  syslog = no
+  pid = ${result_path}/stunnel.pid
+  output = ${result_path}/stunnel.log
+
+  [https client]
+  client = yes
+  accept = 127.0.0.1:${http1}
+  connect = 127.0.0.1:${https}
+  verifyChain = yes
+  CAfile = ${script_path}/certs/CACert.pem
+  CRLfile = ${script_path}/certs/CACertCRL.pem
+
+  [https server]
+  accept = 127.0.0.1:${https}
+  connect = 127.0.0.1:${http2}
+  cert = ${script_path}/certs/revoked_cert.pem
+EOT
+}
+
+check_ports "113_failure_CRL_file"
+start 2> "error.log"
+test_log_for "113_failure_CRL_file" "failure" "$1" 2>> "stderr.log"
+exit $?

tests/recipes/114_failure_PSK_secrets

@@ -0,0 +1,35 @@
+#!/bin/sh
+. $(dirname $0)/../test_library
+
+start() {
+  ../../src/stunnel -fd 0 <<EOT
+  debug = debug
+  syslog = no
+  pid = ${result_path}/stunnel.pid
+  output = ${result_path}/stunnel.log
+  sslVersion = TLSv1
+
+  [https client]
+  client = yes
+  accept = 127.0.0.1:${http1}
+  connect = 127.0.0.1:${https}
+  PSKsecrets = ${script_path}/certs/psk2.txt
+
+  [https server]
+  accept = 127.0.0.1:${https}
+  connect = 127.0.0.1:${http2}
+  ciphers = PSK
+  PSKsecrets = ${script_path}/certs/secrets.txt
+EOT
+}
+
+check_ports "114_failure_PSK_secrets"
+if grep -q "OpenSSL 1" "results.log"
+  then
+    start 2> "error.log"
+    test_log_for "114_failure_PSK_secrets" "failure" "$1" 2>> "stderr.log"
+    exit $?
+  else
+    exit_logs "114_failure_PSK_secrets" "skipped" "error"
+    exit 125
+  fi

tests/recipes/120_failure_no_cert

@@ -0,0 +1,28 @@
+#!/bin/sh
+. $(dirname $0)/../test_library
+
+start() {
+  ../../src/stunnel -fd 0 <<EOT
+  debug = debug
+  syslog = no
+  pid = ${result_path}/stunnel.pid
+  output = ${result_path}/stunnel.log
+
+  [https client]
+  client = yes
+  accept = 127.0.0.1:${http1}
+  connect = 127.0.0.1:${https}
+
+  [https server]
+  accept = 127.0.0.1:${https}
+  connect = 127.0.0.1:${http2}
+  cert = ${script_path}/certs/server_cert.pem
+  ;*** error***
+  requireCert = yes
+EOT
+}
+
+check_ports "120_failure_no_cert"
+start 2> "error.log"
+test_log_for "120_failure_no_cert" "failure" "$1" 2>> "stderr.log"
+exit $?

tests/recipes/121_failure_wrong_config

@@ -0,0 +1,30 @@
+#!/bin/sh
+. $(dirname $0)/../test_library
+
+start() {
+  ../../src/stunnel -fd 0 <<EOT
+  debug = debug
+  syslog = no
+  pid = ${result_path}/stunnel.pid
+  output = ${result_path}/stunnel.log
+
+  [https client]
+  client = yes
+  accept = 127.0.0.1:${http1}
+  ;*** error***
+  ;connect = 127.0.0.1:${https}
+  cert = ${script_path}/certs/client_cert.pem
+
+  [https server]
+  accept = 127.0.0.1:${https}
+  connect = 127.0.0.1:${http2}
+  cert = ${script_path}/certs/server_cert.pem
+EOT
+}
+
+check_ports "121_failure_wrong_config"
+start 2> "error.log"
+test_log_for "121_failure_wrong_config" "failure" "$1" 2>> "stderr.log"
+exit $?
+
+

tests/test_library

@@ -0,0 +1,409 @@
+# this file is a library sourced from recipes/*
+
+result_path=$(pwd)
+cd $(dirname "$0")/../
+script_path=$(pwd)
+cd "${result_path}"
+
+result_logs() {
+  # $1 = test name
+  # $2 = status: "ok" / "failed" / "configuration failed" / "expected error"
+  #              "skipped" / "ncat (nc) failed" / "shouldn't work"
+  # $3 = file name: "stunnel" / "error"
+
+  if [ "$2" = "expected error" ]
+    then # expected error - it's ok
+      printf "%-35s\t%s\n" "test $1" "ok"
+     else
+      printf "%-35s\t%s\n" "test $1" "$2"
+     fi
+  if [ "$2" != "ok" ] && [ "$2" != "ncat (nc) failed" ]
+    then
+      printf "%-35s\t%s\n" "test $1" "$2" >> "results.log"
+    fi
+  if [ "$2" = "failed" ] || [ "$2" = "configuration failed" ] || [ "$2" = "shouldn't work" ]
+    then # file with stunnel error logs
+      printf "%-35s\t%s\n" "error logs" "logs/$1.log"
+      cat "$3.log" > "$1.log"
+    else
+      cat "temp.log" >> "results.log" 2>> "stderr_nc.log"
+    fi
+  return 0
+}
+
+exit_logs() {
+  # $1 = test name
+  # $2 = status
+
+  case "$2" in
+    "ok") result_logs "$1" "ok" "UNUSED PATTERN";;
+    "failed") result_logs "$1" "failed" "stunnel";;
+    "configuration failed") result_logs "$1" "configuration failed" "error";;
+    "expected error") result_logs "$1" "expected error" "UNUSED PATTERN";;
+    "skipped") result_logs "$1" "skipped" "error";;
+    "ncat (nc) failed") result_logs "$1" "failed" "stunnel";;
+    "shouldn't work") result_logs "$1" "shouldn't work" "stunnel";;
+  esac
+  return 0
+}
+
+clean_logs() {
+  rm -f "stunnel.log"
+  rm -f "temp.log"
+  rm -f "error.log"
+  rm -f "stderr_nc.log"
+  rm -f "stunnel.conf"
+  return 0
+}
+
+waiting_for() {
+  # waiting for strings ($2 or $3 or $4) to appear in the file $1.log
+
+  mkfifo "fifo"
+  (cat "$1.log"; tail -f "$1.log") > "fifo" 2>> "stderr_nc.log" &
+  pid_tail=$!
+  (sleep 3; echo "TIMEOUT") > "fifo" &
+  pid_timeout=$!
+  grep -q -e "$2" -e "$3" -e "$4" -e "TIMEOUT" "fifo"
+  pid_children=$(ps -o pid,ppid | \
+    awk -v ppid1="${pid_tail}" -v ppid2="${pid_timeout}" \
+      '{if ($2==ppid1 || $2==ppid2) print $1}')
+  kill ${pid_tail} ${pid_timeout} ${pid_children} 2>> "stderr_nc.log"
+  wait ${pid_tail} ${pid_timeout} 2>> "stderr_nc.log"
+  rm -f "fifo"
+  return 0
+}
+
+connecting_ncat() {
+  # $1 = test name
+  # $2 = string to send
+  # $3 = netcat name: "ncat" / "nc"
+
+  result=0
+  mkfifo "nodata"
+  printf "\n%s\n" "test $1" > "stderr_nc.log"
+  cat "nodata" | "$3" -l -p "$http2" -vvv >"temp.log" 2>> "stderr_nc.log" &
+  pid_nc=$!
+  waiting_for "stderr_nc" "Listening" "listening" "QUITTING"
+  if grep -q "istening" "stderr_nc.log"
+    then # Listening or listening
+      if [ "$3" = "ncat" ]
+        then
+          printf "%-35s\t%s\n" "test $1" "$2" | "$3" 127.0.0.1 "$http1" -vv 2>> "stderr_nc.log"
+        else
+          printf "%-35s\t%s\n" "test $1" "$2" | "$3" 127.0.0.1 "$http1" -vv 2>> "stderr_nc.log" &
+        fi
+    else # ncat (nc) failed
+      result=1
+    fi
+  if [  "$3" = ncat ]
+    then
+      waiting_for "stderr_nc" "Closing" "Connection reset by peer" "UNUSED PATTERN"
+    else
+      waiting_for "stderr_nc" "accepted" "from localhost" "Connection reset by peer"
+  fi
+  kill -TERM ${pid_nc} 2>> "stderr_nc.log"
+  cat "stderr_nc.log" >> "stderr.log"
+  echo "somedata" > "nodata"
+  rm -f "nodata"
+  return $result
+}
+
+killing_stunnel() {
+  waiting_for "$1" "Service .* finished" "Sent socket write shutdown" "UNUSED PATTERN"
+  kill -TERM $(tail "stunnel.pid") 2>> "stderr.log"
+  waiting_for "stunnel" "removing pid file" "UNUSED PATTERN" "UNUSED PATTERN"
+  return 0
+}
+
+reload_stunnel() {
+  waiting_for "stunnel" "stunnel.pid" "UNUSED PATTERN" "UNUSED PATTERN"
+  kill -HUP $(tail "stunnel.pid") 2>> "stderr.log"
+  waiting_for "stunnel" "127.0.0.1:${http1}" "UNUSED PATTERN" "UNUSED PATTERN"
+  return 0
+}
+
+expected_success() {
+  # expects to send the s using stunnel
+  # $1 = test name
+  # $2 = netcat name: "ncat" / "nc"
+
+  result=0
+  if [ ! -s "error.log" ]
+    then
+      if connecting_ncat "$1" "success" "$2"
+        then
+          if grep -q "test $1.*success" "temp.log"
+            then
+              exit_code="ok"
+            else # test failed
+              exit_code="failed"
+              result=1
+            fi
+        else # ncat (nc) failed
+          exit_code="ncat (nc) failed"
+          result=1
+        fi
+      killing_stunnel stunnel
+    else # configuration failed
+      exit_code="configuration failed"
+      result=1
+    fi
+  exit_logs "$1" "$exit_code"
+  return $result
+}
+
+expected_failure() {
+  # $1 = test name
+  # $2 = netcat name: "ncat" / "nc"
+
+  result=0
+  if [ ! -s "error.log" ]
+    then
+      if connecting_ncat "$1" "shouldn't work" "$2"
+        then
+          if grep -q "test $1.*shouldn't work" "temp.log"
+            then # ops...stunnel works
+              exit_code="shouldn't work"
+              result=1
+            else
+              exit_code="expected error"
+            fi
+        else # ncat (nc) failed
+          exit_code="ncat (nc) failed"
+          result=1
+        fi
+      killing_stunnel stunnel
+    else # configuration failed, but it is ok
+      exit_code="expected error"
+    fi
+  exit_logs "$1" "$exit_code"
+  return $result
+}
+
+execute_program() {
+  # $1 = test name
+  # $2 = netcat name: "ncat" / "nc"
+
+  result=0
+  mkfifo "nodata"
+  if [ ! -s "error.log" ]
+    then
+      cat "nodata" | "$2" 127.0.0.1 "$http1" -vv > "temp.log" 2>>"stderr.log" &
+      pid_nce=$!
+      killing_stunnel stunnel
+      kill -TERM ${pid_nce} 2>> "stderr.log"
+      echo "somedata" > "nodata" 2>> "stderr.log"
+      rm -f "nodata"
+      if grep -q "test $1.*success" "temp.log"
+        then
+          if grep -q "$1_error" "temp.log"
+            then # only for redirect tests
+              exit_code="failed"
+              result=1
+            else
+              exit_code="ok"
+          fi
+        else # test failed
+          exit_code="failed"
+          result=1
+        fi
+    else # configuration failed
+      exit_code="configuration failed"
+      result=1
+    fi
+  exit_logs "$1" "$exit_code"
+  return $result
+}
+
+loop_prio() {
+  # $1 = test name
+  # $2 = netcat name: "ncat" / "nc"
+
+  result=0
+  i=1
+  max=12
+  start $i 2> "error.log"
+  if [ ! -s "error.log" ]
+    then
+      waiting_for "stunnel" "Created pid file" "UNUSED PATTERN" "UNUSED PATTERN"
+      mv "stunnel.log" "stunnel_0.log"
+      kill -USR1 $(tail "stunnel.pid") 2>> "stderr.log"
+      while [ $i -le $max ] && [ $result -eq 0 ]
+        do
+          if connecting_ncat "$1" "success" "$2"
+            then
+              waiting_for "stunnel" "Service .* finished" "Sent socket write shutdown" "UNUSED PATTERN"
+              if grep -q "test $1.*success" "temp.log"
+                then
+                  if [ $1 = "037_failover_prio1" ]
+                    then
+                      serv="server_2\] accepted connection"
+                    else
+                      serv="server_1\] accepted connection"
+                    fi
+		  if ! grep -q "$serv" "stunnel.log"
+		    then # second server doesn't accept any client
+		      if [ $i -eq $max ]
+			then # last successed turn of the loop
+			  exit_code="ok"
+			fi
+		    else # error - second server accepts a client
+                      exit_code="failed"
+		      result=1
+		    fi
+                else # stunnel doesn't work
+                  exit_code="failed"
+                  result=1
+                fi
+            else # ncat (nc) failed
+              exit_code="ncat (nc) failed"
+              result=1
+            fi
+          waiting_for "stunnel" "Service .* finished" "Sent socket write shutdown" "UNUSED PATTERN"
+          mv "stunnel.log" "stunnel_$i.log"
+          kill -USR1 $(tail "stunnel.pid") 2>> "stderr.log"
+          i=$((i + 1))
+        done
+      cat "stunnel_0.log" > "stunnel_all.log"
+      rm -f "stunnel_0.log"
+      j=1
+      while [ $j -lt $i ]
+        do
+          printf "%s\n" "connection $j" >> "stunnel_all.log"
+          cat "stunnel_$j.log" >> "stunnel_all.log"
+          rm -f "stunnel_$j.log"
+          j=$((j + 1))
+        done
+      killing_stunnel stunnel_all
+      cat "stunnel.log" >> "stunnel_all.log"
+      cat "stunnel_all.log" > "stunnel.log"
+      rm -f "stunnel_all.log"
+    else # configuration failed
+      exit_code="configuration failed"
+      result=1
+    fi
+  exit_logs "$1" "$exit_code"
+  return $result
+}
+
+loop_rr() {
+  # $1 = test name
+  # $2 = netcat name: "ncat" / "nc"
+
+  result=0
+  i=1
+  max=3
+  first=0
+  second=0
+  third=0
+  start $i 2> "error.log"
+  if [ ! -s "error.log" ]
+    then
+      waiting_for "stunnel" "Created pid file" "UNUSED PATTERN" "UNUSED PATTERN"
+      mv "stunnel.log" "stunnel_0.log"
+      kill -USR1 $(tail "stunnel.pid") 2>> "stderr.log"
+      while [ $i -le $max ] && [ $result -eq 0 ]
+        do
+          if connecting_ncat "$1" "success" "$2"
+            then
+              waiting_for "stunnel" "Service .* finished" "Sent socket write shutdown" "UNUSED PATTERN"
+              if ! grep -q "test $1.*success" "temp.log"
+                then # stunnel doesn't work
+                  exit_code="failed"
+                  result=1
+                fi
+            else # ncat (nc) failed
+              exit_code="ncat (nc) failed"
+              result=1
+            fi
+          waiting_for "stunnel" "Service .* finished" "Sent socket write shutdown" "UNUSED PATTERN"
+          mv "stunnel.log" "stunnel_$i.log"
+          kill -USR1 $(tail "stunnel.pid") 2>> "stderr.log"
+          i=$((i + 1))
+        done
+      cat "stunnel_0.log" > "stunnel_all.log"
+      rm -f "stunnel_0.log"
+      j=1
+      while [ $j -lt $i ]
+        do
+          printf "%s\n" "connection $j" >> "stunnel_all.log"
+          cat "stunnel_$j.log" >> "stunnel_all.log"
+          rm -f "stunnel_$j.log"
+          j=$((j + 1))
+        done
+      killing_stunnel stunnel_all
+      cat "stunnel.log" >> "stunnel_all.log"
+      cat "stunnel_all.log" > "stunnel.log"
+      rm -f "stunnel_all.log"
+      first=$(grep -c "server_1\] accepted connection" "stunnel.log")
+      second=$(grep -c "server_2\] accepted connection" "stunnel.log")
+      third=$(grep -c "server_3\] accepted connection" "stunnel.log")
+    else # configuration failed
+      exit_code="configuration failed"
+      result=1
+    fi
+    if [ $result -eq 0 ]
+      then
+        product=$((first * second * third))
+        if [ $product -ne 0 ]
+          then # round robin
+            printf "%-35s\t%s\n" "test $1: $first x $second x $third" "success" > "temp.log"
+            exit_code="ok"
+          else
+            printf "%-35s\t%s\n" "test $1: $first x $second x $third" "failed" > "temp.log"
+            exit_code="failed"
+            result=1
+          fi
+      fi
+  exit_logs "$1" "$exit_code"
+  return $result
+}
+
+test_log_for() {
+  # $1 = test name
+  # $2 = function name
+  # $3 = netcat name: "ncat" / "nc"
+
+  case "$2" in
+    "success") expected_success "$1" "$3";;
+    "failure") expected_failure "$1" "$3";;
+    "execute") execute_program "$1" "$3";;
+    "prio") loop_prio "$1" "$3";;
+    "rr") loop_rr "$1" "$3";;
+  esac
+  result=$?
+  clean_logs
+  return $result
+}
+
+set_port() {
+  port=$((port+1))
+  while netstat -an 2>> "stderr.log" | grep $port | grep -q LISTEN
+    do
+      port=$((port+1))
+    done
+  return 0
+}
+
+check_ports() {
+  port=8079
+  set_port $port
+  http1=$port
+  set_port $port
+  http2=$port
+  set_port $port
+  http3=$port
+
+  port=4432
+  set_port $port
+  https=$port
+  set_port $port
+  https2=$port
+  set_port $port
+  https3=$port
+
+  printf "\n%s\n" "test $1" >> "stderr.log"
+  printf "%s\n" "ports: $http1 $http2 $http3 $https $https2 $https3" >> "stderr.log"
+  return 0
+}

tools/Makefile.in

@@ -1,7 +1,7 @@
-# Makefile.in generated by automake 1.14.1 from Makefile.am.
+# Makefile.in generated by automake 1.15 from Makefile.am.
 # @configure_input@
 
-# Copyright (C) 1994-2013 Free Software Foundation, Inc.
+# Copyright (C) 1994-2014 Free Software Foundation, Inc.
 
 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -17,7 +17,17 @@
 # by Michal Trojnara 2015-2017
 
 VPATH = @srcdir@
-am__is_gnu_make = test -n '$(MAKEFILE_LIST)' && test -n '$(MAKELEVEL)'
+am__is_gnu_make = { \
+  if test -z '$(MAKELEVEL)'; then \
+    false; \
+  elif test -n '$(MAKE_HOST)'; then \
+    true; \
+  elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
+    true; \
+  else \
+    false; \
+  fi; \
+}
 am__make_running_with_option = \
   case $${target_option-} in \
       ?) ;; \
@@ -81,7 +91,6 @@ POST_UNINSTALL = :
 build_triplet = @build@
 host_triplet = @host@
 subdir = tools
-DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/Makefile.am
 ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
 am__aclocal_m4_deps = $(top_srcdir)/m4/libtool.m4 \
 	$(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \
@@ -89,6 +98,7 @@ am__aclocal_m4_deps = $(top_srcdir)/m4/libtool.m4 \
 	$(top_srcdir)/configure.ac
 am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
 	$(ACLOCAL_M4)
+DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
 mkinstalldirs = $(install_sh) -d
 CONFIG_HEADER = $(top_builddir)/src/config.h
 CONFIG_CLEAN_FILES =
@@ -142,6 +152,7 @@ am__uninstall_files_from_dir = { \
 am__installdirs = "$(DESTDIR)$(confdir)" "$(DESTDIR)$(examplesdir)"
 DATA = $(conf_DATA) $(examples_DATA)
 am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
+am__DIST_COMMON = $(srcdir)/Makefile.in
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
 ACLOCAL = @ACLOCAL@
 AMTAR = @AMTAR@
@@ -184,6 +195,7 @@ LIBTOOL_DEPS = @LIBTOOL_DEPS@
 LIPO = @LIPO@
 LN_S = @LN_S@
 LTLIBOBJS = @LTLIBOBJS@
+LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
 MAKEINFO = @MAKEINFO@
 MANIFEST_TOOL = @MANIFEST_TOOL@
 MKDIR_P = @MKDIR_P@
@@ -300,7 +312,6 @@ $(srcdir)/Makefile.in:  $(srcdir)/Makefile.am  $(am__configure_deps)
 	echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu tools/Makefile'; \
 	$(am__cd) $(top_srcdir) && \
 	  $(AUTOMAKE) --gnu tools/Makefile
-.PRECIOUS: Makefile
 Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
 	@case '$?' in \
 	  *config.status*) \
@@ -524,6 +535,8 @@ uninstall-am: uninstall-confDATA uninstall-examplesDATA
 	tags-am uninstall uninstall-am uninstall-confDATA \
 	uninstall-examplesDATA
 
+.PRECIOUS: Makefile
+
 
 install-data-local:
 	${INSTALL} -d -m 1770 $(DESTDIR)$(localstatedir)/lib/stunnel

tools/stunnel.nsi

@@ -45,12 +45,14 @@ BrandingText "Author: Michal Trojnara"
 !define /ifndef BIN_DIR ${ROOT_DIR}\${ARCH}
 !define /ifndef OPENSSL_DIR ${BIN_DIR}\openssl
 !define /ifndef OPENSSL_BIN_DIR ${OPENSSL_DIR}\bin
+!if ${ARCH} == win32
 !define /ifndef OPENSSL_ENGINES_DIR ${OPENSSL_DIR}\lib\engines
+!else
+!define /ifndef OPENSSL_ENGINES_DIR ${OPENSSL_DIR}\lib\engines-1_1
+!endif
 !define /ifndef ZLIB_DIR ${BIN_DIR}\zlib
 !define /ifndef REDIST_DIR ${BIN_DIR}\redist
 
-!define /ifndef LIBP11_DIR ${ROOT_DIR}\src\libp11-0.4.7\src
-
 !define MUI_ICON ${STUNNEL_SRC_DIR}\stunnel.ico
 
 !insertmacro MUI_PAGE_LICENSE "stunnel.license"
@@ -173,16 +175,28 @@ no_service_restart:
   Delete "$INSTDIR\bin\Microsoft.VC90.CRT.Manifest"
   RMDir "$INSTDIR\bin"
 
+  Delete "$INSTDIR\engines\4758cca.dll"
+  Delete "$INSTDIR\engines\4758cca.pdb"
+  Delete "$INSTDIR\engines\aep.dll"
+  Delete "$INSTDIR\engines\aep.pdb"
+  Delete "$INSTDIR\engines\atalla.dll"
+  Delete "$INSTDIR\engines\atalla.pdb"
   Delete "$INSTDIR\engines\capi.dll"
   Delete "$INSTDIR\engines\capi.pdb"
   Delete "$INSTDIR\engines\chil.dll"
   Delete "$INSTDIR\engines\chil.pdb"
+  Delete "$INSTDIR\engines\cswift.dll"
+  Delete "$INSTDIR\engines\cswift.pdb"
   Delete "$INSTDIR\engines\gmp.dll"
   Delete "$INSTDIR\engines\gmp.pdb"
   Delete "$INSTDIR\engines\gost.dll"
   Delete "$INSTDIR\engines\gost.pdb"
+  Delete "$INSTDIR\engines\nuron.dll"
+  Delete "$INSTDIR\engines\nuron.pdb"
   Delete "$INSTDIR\engines\padlock.dll"
   Delete "$INSTDIR\engines\padlock.pdb"
+  Delete "$INSTDIR\engines\sureware.dll"
+  Delete "$INSTDIR\engines\sureware.pdb"
   Delete "$INSTDIR\engines\ubsec.dll"
   Delete "$INSTDIR\engines\ubsec.pdb"
   Delete "$INSTDIR\engines\pkcs11.dll"
@@ -304,26 +318,23 @@ Section "Core Files" sectionCORE
   # write new executables/libraries files
   SetOutPath "$INSTDIR\bin"
   File "${STUNNEL_BIN_DIR}\stunnel.exe"
+  !if ${ARCH} == win32
   File "${OPENSSL_BIN_DIR}\libeay32.dll"
   File "${OPENSSL_BIN_DIR}\ssleay32.dll"
-  !if ${ARCH} == win32
-  File "${ZLIB_DIR}\zlib1.dll"
   File "${REDIST_DIR}\msvcr90.dll"
   File "${REDIST_DIR}\Microsoft.VC90.CRT.Manifest"
   # MINGW builds requires libssp-0.dll instead of msvcr90.dll
   !else
+  File "${OPENSSL_BIN_DIR}\libcrypto-1_1-x64.dll"
+  File "${OPENSSL_BIN_DIR}\libssl-1_1-x64.dll"
   File "${REDIST_DIR}\vcruntime140.dll"
   !endif
 
   # write new engine libraries
   SetOutPath "$INSTDIR\engines"
   File "${OPENSSL_ENGINES_DIR}\capi.dll"
-  File "${OPENSSL_ENGINES_DIR}\chil.dll"
-  File "${OPENSSL_ENGINES_DIR}\gmp.dll"
-  File "${OPENSSL_ENGINES_DIR}\gost.dll"
   File "${OPENSSL_ENGINES_DIR}\padlock.dll"
-  File "${OPENSSL_ENGINES_DIR}\ubsec.dll"
+  File "${OPENSSL_ENGINES_DIR}\pkcs11.dll"
-  File "${LIBP11_DIR}\pkcs11.dll"
 
   # write new documentation
   SetOutPath "$INSTDIR\doc"
@@ -467,10 +478,13 @@ Section /o "Debugging Symbols" sectionDEBUG
 
   # core components
   File "${STUNNEL_BIN_DIR}\stunnel.pdb"
+  !if ${ARCH} == win32
   File "${OPENSSL_BIN_DIR}\libeay32.pdb"
   File "${OPENSSL_BIN_DIR}\ssleay32.pdb"
-  !if ${ARCH} == win32
   File "${ZLIB_DIR}\zlib1.pdb"
+  !else
+  File "${OPENSSL_BIN_DIR}\libcrypto-1_1-x64.dll"
+  File "${OPENSSL_BIN_DIR}\libssl-1_1-x64.dll"
   !endif
 
   # optional tstunnel.exe
@@ -490,12 +504,8 @@ no_openssl_pdb:
   # engines
   SetOutPath "$INSTDIR\engines"
   File "${OPENSSL_ENGINES_DIR}\capi.pdb"
-  File "${OPENSSL_ENGINES_DIR}\chil.pdb"
-  File "${OPENSSL_ENGINES_DIR}\gmp.pdb"
-  File "${OPENSSL_ENGINES_DIR}\gost.pdb"
   File "${OPENSSL_ENGINES_DIR}\padlock.pdb"
-  File "${OPENSSL_ENGINES_DIR}\ubsec.pdb"
+  # File "${OPENSSL_ENGINES_DIR}\pkcs11.pdb"
-  # File "${LIBP11_DIR}\pkcs11.pdb"
   SetOutPath "$INSTDIR"
 SectionEnd
 

tools/stunnel.spec

@@ -1,5 +1,5 @@
 Name:           stunnel
-Version:        5.42
+Version:        5.44
 Release:        1%{?dist}
 Summary:        An TLS-encrypting socket wrapper
 Group:          Applications/Internet