CVE-2021-20230 (C, published 2021-02-23T17:15Z)
Description: value: A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options. This flaw allows an attacker with a certificate signed by a Certificate Authority, which is not the one accepted by the stunnel server, to access the tunneled service instead of being redirected to the address specified in the redirect option. The highest threat from this vulnerability is to confidentiality.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-295 \u2014 Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
Repository: https://github.com/mtrojnar/stunnel
Files changed:
COPYING.md
INSTALL.W32.md
Makefile.am
Makefile.in
NEWS.md
build-android.sh
configure
configure.ac
doc/Makefile.am
doc/Makefile.in
doc/stunnel.8.in
doc/stunnel.html.in
doc/stunnel.pl.8.in
doc/stunnel.pl.html.in
doc/stunnel.pl.pod.in
doc/stunnel.pod.in
src/Makefile.am
src/Makefile.in
src/client.c
src/common.h
src/cron.c
src/ctx.c
src/dhparam.c
src/env.c
src/evc.mak
src/fd.c
src/file.c
src/libwrap.c
src/log.c
src/mingw.mak
src/mingw.mk
src/network.c
src/options.c
src/os2.mak
src/protocol.c
src/prototypes.h
src/pty.c
src/resolver.c
src/resources.rc
src/ssl.c
src/sthreads.c
src/str.c
src/stunnel.c
src/tls.c
src/ui_unix.c
src/ui_win_cli.c
src/ui_win_gui.c
src/vc.mak
src/verify.c
src/version.h
tests/Makefile.am
tests/Makefile.in
tests/certs/CACert.pem
tests/certs/CACertCRL.pem
tests/certs/Makefile.am
tests/certs/Makefile.in
tests/certs/PeerCerts.pem
tests/certs/client_cert.pem
tests/certs/maketestcert.sh
tests/certs/psk1.txt
tests/certs/psk2.txt
tests/certs/revoked_cert.pem
tests/certs/secrets.txt
tests/certs/server_cert.pem
tests/certs/stunnel.pem
tests/make_test
tests/recipes/021_FIPS
tests/recipes/028_redirect_chain
tests/recipes/029_no_redirect_chain
tests/test_library
tools/Makefile.am
tools/Makefile.in
tools/openssl.cnf
tools/stunnel.conf-sample.in
tools/stunnel.license
tools/stunnel.nsi
tools/stunnel.service.in
tools/stunnel.spec
Commit message: stunnel-5.57


Vulnerable code:
_Copyright (C) 1998-2019 Michal Trojnara_
        --prefix=/opt/openssl-mingw64 mingw64 shared
      sed -i 's/^\(OPENSSLDIR=\).*/\1..\/config/' Makefile
      sed -i 's/^\(ENGINESDIR=\).*/\1..\/engines/' Makefile
        --prefix=/opt/openssl-mingw mingw shared
      sed -i 's/^\(OPENSSLDIR=\).*/\1..\/config/' Makefile
      sed -i 's/^\(ENGINESDIR=\).*/\1..\/engines/' Makefile
# by Michal Trojnara 1998-2019
# by Michal Trojnara 1998-2019
VERSION=5.56
# Generated by GNU Autoconf 2.69 for stunnel 5.56.
PACKAGE_VERSION='5.56'
PACKAGE_STRING='stunnel 5.56'
\`configure' configures stunnel 5.56 to adapt to many kinds of systems.
     short | recursive ) echo "Configuration of stunnel 5.56:";;
stunnel configure 5.56
It was created by stunnel $as_me 5.56, which was
 VERSION='5.56'
This file was extended by stunnel $as_me 5.56, which was
stunnel config.status 5.56
AC_INIT([stunnel],[5.56])
# by Michal Trojnara 1998-2019
# by Michal Trojnara 1998-2019
.TH stunnel 8 "2019.06.10" "5.55" "stunnel TLS Proxy"
Only a single curve name is allowed for OpenSSL older than 1.1.0.
<p>Only a single curve name is allowed for OpenSSL older than 1.1.0.</p>
<dt id="level-0">level 0</dt>
<dt id="level-1">level 1</dt>
<dt id="level-2">level 2</dt>
<dt id="level-3">level 3</dt>
<dt id="level-4">level 4</dt>
.TH stunnel 8 "2019.06.10" "5.55" "stunnel TLS Proxy"
Wersje OpenSSL starsze niÅ¼ 1.1.0 pozwalajÄ na uÅ¼ycie tylko jednej krzywej.
<p>Wersje OpenSSL starsze ni&#x17C; 1.1.0 pozwalaj&#x105; na u&#x17C;ycie tylko jednej krzywej.</p>
<dt id="poziom-0"><i>poziom 0</i></dt>
<dt id="poziom-1"><i>poziom 1</i></dt>
<dt id="poziom-2"><i>poziom 2</i></dt>
<dt id="poziom-3"><i>poziom 3</i></dt>
<dt id="poziom-4"><i>poziom 4</i></dt>
Wersje OpenSSL starsze niÅ¼ 1.1.0 pozwalajÄ na uÅ¼ycie tylko jednej krzywej.
Only a single curve name is allowed for OpenSSL older than 1.1.0.
# by Michal Trojnara 1998-2019
# by Michal Trojnara 1998-2019
 *   Copyright (C) 1998-2019 Michal Trojnara <Michal.Trojnara@stunnel.org>
    ssize_t num;
            num=SSL_shutdown(c->ssl); /* send close_notify alert */
                err=SSL_get_error(c->ssl, (int)num);
            case SSL_ERROR_SYSCALL: /* socket error */
                if(parse_socket_error(c, "SSL_shutdown"))
                    break; /* a non-critical error: retry */
                SSL_set_shutdown(c->ssl, SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
                shutdown_wants_read=shutdown_wants_write=0;
                break;
            case SSL_ERROR_ZERO_RETURN: /* connection closed */
                SSL_set_shutdown(c->ssl, SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
                shutdown_wants_read=shutdown_wants_write=0;
                break;
            num=writesocket(c->sock_wfd->fd, c->ssl_buff, c->ssl_ptr);
            num=readsocket(c->sock_rfd->fd,
            num=SSL_write(c->ssl, c->sock_buff, (int)(c->sock_ptr));
            switch(err=SSL_get_error(c->ssl, (int)num)) {
                if(num && parse_socket_error(c, "SSL_write"))
            case SSL_ERROR_ZERO_RETURN: /* close_notify alert received */
                s_log(LOG_INFO, "TLS closed (SSL_write)");
                if(SSL_version(c->ssl)==SSL2_VERSION)
                    SSL_set_shutdown(c->ssl, SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
                break;
            case SSL_ERROR_SSL:
                sslerror("SSL_write");
                throw_exception(c, 1);
            num=SSL_read(c->ssl, c->ssl_buff+c->ssl_ptr, (int)(BUFFSIZE-c->ssl_ptr));
            switch(err=SSL_get_error(c->ssl, (int)num)) {
                if(num && parse_socket_error(c, "SSL_read"))
            case SSL_ERROR_ZERO_RETURN: /* close_notify alert received */
                s_log(LOG_INFO, "TLS closed (SSL_read)");
                if(SSL_version(c->ssl)==SSL2_VERSION)
                    SSL_set_shutdown(c->ssl,
                        SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
                break;
            case SSL_ERROR_SSL:
                sslerror("SSL_read");
                throw_exception(c, 1);
#ifdef __GNUC__
#if __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 6)
#pragma GCC diagnostic push
#endif /* __GNUC__>=4.6 */
#if __GNUC__ >= 7
#pragma GCC diagnostic ignored "-Wimplicit-fallthrough"
#endif /* __GNUC__>=7 */
#endif /* __GNUC__ */

        /* fall through */
#ifdef __GNUC__
#if __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 6)
#pragma GCC diagnostic pop
#endif /* __GNUC__>=4.6 */
#endif /* __GNUC__ */

 *   Copyright (C) 1998-2019 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *   Copyright (C) 1998-2019 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *   Copyright (C) 1998-2019 Michal Trojnara <Michal.Trojnara@stunnel.org>
    /* create TLS context */
    /* for callbacks */
    /* mode */
    /* initialize the DH/ECDH key agreement in the server mode */
    if(!section->option.client) {
        dh_init(section); /* ignore the result (errors are not critical) */
        ecdh_init(section); /* ignore the result (errors are not critical) */
    }
    /* check if DH is actually enabled for this section */
        s_log(LOG_INFO, "DH initialization not needed");
        cipher = EVP_aes_128_cbc();
        cipher = EVP_aes_256_cbc();
        iv_len = EVP_CIPHER_iv_length(cipher);
        0xD5, 0x75, 0xF1, 0x23, 0xC1, 0x81, 0x4B, 0x44, 0x23, 0xBE,
        0x97, 0x81, 0x7A, 0xDA, 0x97, 0x1F, 0x1F, 0x0D, 0xD5, 0xEC,
        0xC5, 0x5F, 0x86, 0x42, 0x7F, 0x38, 0xA3, 0x95, 0xEE, 0xA0,
        0x52, 0x2C, 0xB7, 0x20, 0x29, 0xC1, 0xC7, 0xE6, 0x8E, 0x6F,
        0xE5, 0xC1, 0x0D, 0xDD, 0x8A, 0xEF, 0x8D, 0xE7, 0xA8, 0x63,
        0xB4, 0xF7, 0x58, 0x32, 0x0E, 0x24, 0xAC, 0x30, 0x94, 0xF5,
        0xC7, 0x02, 0x81, 0x1B, 0xC7, 0x68, 0xE5, 0x71, 0xD7, 0x1E,
        0x3D, 0xE4, 0x2E, 0x2F, 0xC0, 0x0A, 0xED, 0x34, 0xAC, 0xC0,
        0x1F, 0x0A, 0x56, 0xA4, 0x12, 0x02, 0xFD, 0x68, 0xD2, 0x4D,
        0x5E, 0x0A, 0x5D, 0x78, 0xE3, 0xA0, 0x85, 0x75, 0xD2, 0xA9,
        0xC1, 0xF2, 0xAD, 0x65, 0x11, 0xDE, 0xE8, 0x05, 0x68, 0x36,
        0x4C, 0x92, 0x99, 0x21, 0xB9, 0x69, 0xD0, 0x6F, 0xD8, 0xA3,
        0xEA, 0x35, 0x13, 0x93, 0xDC, 0x1B, 0x13, 0x16, 0xB2, 0x15,
        0x8E, 0x10, 0x22, 0xCE, 0x01, 0x1F, 0x1C, 0x09, 0x86, 0xD5,
        0xE7, 0xCB, 0xCF, 0xFA, 0xED, 0x2F, 0xE2, 0x3A, 0x65, 0x14,
        0xC9, 0xFA, 0x70, 0x99, 0xF7, 0xE0, 0x30, 0xBF, 0x7F, 0xEA,
        0x84, 0x14, 0x8A, 0x51, 0xC9, 0xE9, 0x85, 0x73, 0x7F, 0xA1,
        0xB0, 0xC3, 0x33, 0x9A, 0xAB, 0x69, 0x4E, 0x75, 0xFB, 0x12,
        0xB0, 0x9E, 0xB1, 0xD9, 0xD1, 0xB9, 0x32, 0x1D, 0xC6, 0xD9,
        0x2C, 0xAA, 0xB0, 0xC5, 0x3E, 0x69, 0x56, 0xA2, 0xB3, 0xA2,
        0x81, 0xCA, 0x9D, 0x77, 0xBB, 0x52, 0x44, 0xA2, 0xED, 0xE0,
        0xF0, 0x2A, 0x81, 0x85, 0x90, 0xB6, 0x04, 0x60, 0xEB, 0x09,
        0x72, 0x08, 0x44, 0xAF, 0x28, 0xF5, 0x15, 0x34, 0x87, 0x5C,
        0x8A, 0xB4, 0x5B, 0x15, 0x6A, 0xAD, 0x27, 0x4E, 0xA0, 0xDE,
        0x99, 0x22, 0xCF, 0xAB, 0x4C, 0xFD, 0x75, 0x10, 0x5D, 0xFF,
        0xE8, 0x81, 0x50, 0xC4, 0xC0, 0x4B
/* built for stunnel 5.56 */
 *   Copyright (C) 1998-2019 Michal Trojnara <Michal.Trojnara@stunnel.org>
# wce.mak for stunnel.exe by Michal Trojnara 1998-2019
 *   Copyright (C) 1998-2019 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *   Copyright (C) 1998-2019 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *   Copyright (C) 1998-2019 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *   Copyright (C) 1998-2019 Michal Trojnara <Michal.Trojnara@stunnel.org>
    /* prevent changing LOG_MODE_CONFIGURED to LOG_MODE_ERROR
     * once stderr file descriptor is closed */
    if(log_mode!=LOG_MODE_CONFIGURED || new_mode!=LOG_MODE_ERROR)
        log_mode=new_mode;
# Simple Makefile.w32 for stunnel.exe by Michal Trojnara 1998-2019
# by Michal Trojnara 1998-2019
 *   Copyright (C) 1998-2019 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *   Copyright (C) 1998-2019 Michal Trojnara <Michal.Trojnara@stunnel.org>
NOEXPORT char *parse_global_option(CMD, char *, char *);
    "TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256";
        parse_global_option(CMD_PRINT_HELP, NULL, NULL);
        parse_global_option(CMD_PRINT_DEFAULTS, NULL, NULL);
    if(options_file(configuration_file, type, &section))
    if(init_section(1, &section))
        return 1;

            errstr=parse_global_option(CMD_SET_VALUE, config_opt, config_arg);
        errstr=parse_global_option(CMD_INITIALIZE, NULL, NULL);
        if(*section_ptr==&new_service_options)
            s_log(LOG_INFO, "Initializing inetd mode configuration");
        else
            s_log(LOG_INFO, "Initializing service [%s]",
                (*section_ptr)->servname);
    parse_global_option(CMD_SET_DEFAULTS, NULL, NULL);
void options_free() {
    parse_global_option(CMD_FREE, NULL, NULL);
NOEXPORT char *parse_global_option(CMD cmd, char *opt, char *arg) {
        new_global_options.chroot_dir=NULL;
        tmp=global_options.chroot_dir;
        global_options.chroot_dir=NULL;
        new_global_options.chroot_dir=str_dup(arg);
        new_global_options.compression=COMP_NONE;
            new_global_options.compression=COMP_DEFLATE;
            new_global_options.compression=COMP_ZLIB;
        new_global_options.egd_sock=EGD_SOCKET;
        new_global_options.egd_sock=NULL;
        tmp=global_options.egd_sock;
        global_options.egd_sock=NULL;
        new_global_options.egd_sock=str_dup(arg);
        new_global_options.option.fips=0;
        if(!strcasecmp(arg, "yes"))
            new_global_options.option.fips=1;
        else if(!strcasecmp(arg, "no"))
            new_global_options.option.fips=0;
        else
            return "The argument needs to be either 'yes' or 'no'";
        if(strcasecmp(arg, "no"))
        new_global_options.option.foreground=0;
        new_global_options.option.log_stderr=0;
            new_global_options.option.foreground=1;
            new_global_options.option.log_stderr=1;
            new_global_options.option.foreground=1;
            new_global_options.option.log_stderr=0;
            new_global_options.option.foreground=0;
            new_global_options.option.log_stderr=0;
        new_global_options.icon[ICON_ACTIVE]=load_icon_default(ICON_ACTIVE);
        if(!(new_global_options.icon[ICON_ACTIVE]=load_icon_file(arg)))
        new_global_options.icon[ICON_ERROR]=load_icon_default(ICON_ERROR);
        if(!(new_global_options.icon[ICON_ERROR]=load_icon_file(arg)))
        new_global_options.icon[ICON_IDLE]=load_icon_default(ICON_IDLE);
        if(!(new_global_options.icon[ICON_IDLE]=load_icon_file(arg)))
        new_global_options.log_file_mode=FILE_MODE_APPEND;
            new_global_options.log_file_mode=FILE_MODE_APPEND;
            new_global_options.log_file_mode=FILE_MODE_OVERWRITE;
        new_global_options.output_file=NULL;
        tmp=global_options.output_file;
        global_options.output_file=NULL;
        new_global_options.output_file=str_dup(arg);
        if(!new_global_options.option.foreground /* daemonize() used */ &&
                new_global_options.output_file /* log file enabled */ &&
                new_global_options.output_file[0]!='/' /* relative path */)
        new_global_options.pidfile=NULL; /* do not create a pid file */
        tmp=global_options.pidfile;
        global_options.pidfile=NULL;
            new_global_options.pidfile=str_dup(arg);
            new_global_options.pidfile=NULL; /* empty -> do not create a pid file */
        if(!new_global_options.option.foreground /* daemonize() used */ &&
                new_global_options.pidfile /* pid file enabled */ &&
                new_global_options.pidfile[0]!='/' /* relative path */)
        new_global_options.random_bytes=RANDOM_BYTES;
            new_global_options.random_bytes=(long)strtol(arg, &tmp_str, 10);
        new_global_options.rand_file=str_dup(RANDOM_FILE);
        new_global_options.rand_file=NULL;
        tmp=global_options.rand_file;
        global_options.rand_file=NULL;
        new_global_options.rand_file=str_dup(arg);
        new_global_options.option.rand_write=1;
            new_global_options.option.rand_write=1;
            new_global_options.option.rand_write=0;
        new_global_options.option.log_syslog=1;
            new_global_options.option.log_syslog=1;
            new_global_options.option.log_syslog=0;
        new_global_options.option.taskbar=1;
            new_global_options.option.taskbar=1;
            new_global_options.option.taskbar=0;
        if(ssl_configure(&new_global_options)) /* configure global TLS settings */
        if(section==&service_options || section==&new_service_options)
            s_log(LOG_DEBUG, "Deallocating section defaults");
        s_log(LOG_NOTICE,
            "%25slevel 0 - request and ignore peer cert", "");
        s_log(LOG_NOTICE,
            "%25slevel 1 - only validate peer cert if present", "");
        s_log(LOG_NOTICE,
            "%25slevel 2 - always require a valid peer cert", "");
        s_log(LOG_NOTICE,
            "%25slevel 3 - verify peer with locally installed cert", "");
        s_log(LOG_NOTICE,
            "%25slevel 4 - ignore CA chain and only verify peer cert", "");
        if(section==&service_options)
	-DPACKAGE_VERSION=\"5.56\" \
	-DPACKAGE_STRING=\"stunnel\ 5.56\" \
	-DVERSION=\"5.56\" \
 *   Copyright (C) 1998-2019 Michal Trojnara <Michal.Trojnara@stunnel.org>
        str_free(b64);
 *   Copyright (C) 1998-2019 Michal Trojnara <Michal.Trojnara@stunnel.org>
void unbind_ports(void);
int bind_ports(void);
void options_free(void);
 *   Copyright (C) 1998-2019 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *   Copyright (C) 1998-2019 Michal Trojnara <Michal.Trojnara@stunnel.org>
            VALUE "LegalCopyright",     "© by Michal Trojnara, 1998-2019"
    LTEXT           "© by Michal Trojnara, 1998-2019", -1,      30, 12, 106,  8
 *   Copyright (C) 1998-2019 Michal Trojnara <Michal.Trojnara@stunnel.org>
#if OPENSSL_VERSION_NUMBER>=0x10100000L
        "session authenticated", NULL, NULL, NULL);
    dh->p = p;
    dh->q = q;
    dh->g = g;
        dh->length = BN_num_bits(q);
#if OPENSSL_VERSION_NUMBER>=0x10100000L
 *   Copyright (C) 1998-2019 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *   Copyright (C) 1998-2019 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *   Copyright (C) 1998-2019 Michal Trojnara <Michal.Trojnara@stunnel.org>
    options_defaults();
    options_apply();
    if(cmdline_status) /* cannot proceed */
    options_apply();
    if(bind_ports())
    if(change_root())
    if(drop_privileges(1))
    if(log_open(SINK_OUTFILE))
    log_flush(LOG_MODE_ERROR);
void unbind_ports(void) {
    CRYPTO_THREAD_write_lock(stunnel_locks[LOCK_SECTIONS]);

    opt=service_options.next;
    service_options.next=NULL;
    service_free(&service_options);

    while(opt) {
        /* exec+connect service */
        /* purge session cache of the old SSL_CTX object */
        /* this workaround won't be needed anymore after */
        /* delayed deallocation calls SSL_CTX_free()     */
        if(opt->ctx)
            SSL_CTX_flush_sessions(opt->ctx,
                (long)time(NULL)+opt->session_timeout+1);
        s_log(LOG_DEBUG, "Service [%s] closed", opt->servname);
        {
            SERVICE_OPTIONS *garbage=opt;
            opt=opt->next;
            garbage->next=NULL;
            service_free(garbage);
        }

    CRYPTO_THREAD_unlock(stunnel_locks[LOCK_SECTIONS]);
int bind_ports(void) {
    static int delay=10; /* 10ms */
    options_free();
    options_apply();
    if(bind_ports() | exec_connect_start()) {
        if(delay > 10000) /* 10s */
    } else {
        delay=10; /* 10ms */
 *   Copyright (C) 1998-2019 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *   Copyright (C) 1998-2019 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *   Copyright (C) 1998-2019 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *   Copyright (C) 1998-2019 Michal Trojnara <Michal.Trojnara@stunnel.org>
        unbind_ports(); /* in case initialization failed after bind_ports() */
        log_flush(LOG_MODE_ERROR); /* otherwise logs are buffered */
        tip=str_tprintf(TEXT("Server is down"));
        tip=str_tprintf(TEXT("%d active session(s)"), num);
        tip=str_tprintf(TEXT("Server is idle"));
# vc.mak by Michal Trojnara 1998-2019
 *   Copyright (C) 1998-2019 Michal Trojnara <Michal.Trojnara@stunnel.org>
    if(verify_checks(c, preverify_ok, callback_ctx)) {
            int ok=SSL_SESSION_set_ex_data(sess, index_session_authenticated,
                (void *)(-1));
    if(c->opt->option.client || c->opt->protocol)
        return 0; /* reject */
    if(c->opt->redirect_addr.names)
        return 1; /* accept */
 *   Copyright (C) 1998-2019 Michal Trojnara <Michal.Trojnara@stunnel.org>
#define VERSION_MINOR 56
# by Michal Trojnara 1998-2019
# by Michal Trojnara 1998-2019
MIIDwTCCAqmgAwIBAgIUXE+sARWPLGgknSpOyFlDQSWC7DswDQYJKoZIhvcNAQEL
QGV4YW1wbGUuY29tMB4XDTE5MTExMTIxNTgzMFoXDTIzMTExMTIxNTgzMFowaDEL
bGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAubPhK1yk1SJ5
EIJ1p2z/ujOh6BFOYeuKadoK8rUc8Yt8/tE7ah7qvHqD19szQ0fb84ZTIkhQNipp
4BhS5Cg358C6f3tWteLiM9zq9HaTePPuK+LzhJmLJb00Go4eHnm9SujBacO7SbqM
odySB1p7EL5HVd1YT64nIgFpYcyhYcTqhVE0e4+5Ud+irLk/rsiqmDtlrUABNc/E
krSozoZskk0YWR1RWh7qr23AKGr2sKqxdlrkjJqgPBx2VCEW9MTZrEX6jLn1SNF3
PuvUglPXADjjy/luFoDlKPuRpBXLsYVTx5j2Oi5hFsPPDJmqso2eFT39tJsqjGGh
25TZJiEdtQIDAQABo2MwYTAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBS/mA7w
0d3k444hl5TfRCmXzsFSuzAfBgNVHSMEGDAWgBS/mA7w0d3k444hl5TfRCmXzsFS
uzAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQADggEBADcEh1sUlM6AfrLC
ITX/hrGPRPbHkLjImXNdvf5TW3gsx5meGqp74mgbT9foq4VLhcEdDzXvcRcSkpJ7
Cfs5ZJkKNzkZgO2sJ3JPBMw143iMs05iyyQXXybjP9LJBpKD0TQ6Dl2HYiiP0pU8
c/lDUETXL14tp42kgQ6knHByQQi9E2EhKJnXPhkC9gUe1wcaVaP3WIoKxXfrHfwT
AsoeYVw+2CYdjyHj3XGBvZObqXKWU8zUkNbiqsntVxUg9bdQ9VFKKHw4o+yXyH6z
aStIXWdpMiUNTHnGk315X3E3Pea/XpiL9UW/1AbX80+yKog/hqJlt33QKTyIGaA4
ZdW+QoQ=
DAJDQTEdMBsGCSqGSIb3DQEJARYOQ0FAZXhhbXBsZS5jb20XDTE5MTExMTIxNTgz
MFoXDTIzMTExMTIxNTgzMFowFTATAgIQABcNMTkxMTExMjE1ODMwWqAjMCEwHwYD
VR0jBBgwFoAUv5gO8NHd5OOOIZeU30Qpl87BUrswDQYJKoZIhvcNAQELBQADggEB
AER7D1Mf6+ASMOULNKQ8MB0lqjWAf8XN67Ez/spAbF5B7ySaFPJOuT+90oTpccrW
08KPZVrUkAsWSBty06jsZe8IB8YLdpkdDD59dwqIQ5CILbvx16l0nqrXqOQ3kRfT
pfzikaOSrt7PWuHRRGnLiK88r+s1S5JqYtHAnhO4xyQzDmpyID/i5vS/3rfHCmEM
drk4vkkUq0wRFRiq0fXECF8bgIr366oCmm09rKy4jgyDxSo81yJCRlkNFOY6zxjS
RH7ckNLxJb77vaJGkNnaIefgQB+OML/UphzW/IcnKV03nGT6OEPUpVHeMAA365tV
z5HRB+7G/oLzauOgrVVkjvE=
# by Michal Trojnara 1998-2019
# by Michal Trojnara 1998-2019
MAkGA1UEAwwCQ0ExHTAbBgkqhkiG9w0BCQEWDkNBQGV4YW1wbGUuY29tMB4XDTE5
MTExMTIxNTgzMFoXDTIzMTExMTIxNTgzMFowbzELMAkGA1UEBhMCUEwxGzAZBgNV
DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALq/uXUhshKi4zWQw4ElNpMTvdjl
+1hnq8xuVFmb/s5hMpZNKLm0st3tLtbiAt9RBC7yaNqRLN49AZsJpgcuagAc9U7k
oUukal7XtnCSu62cZmhylSgZEoqeZUfIsbpbipQzIokPUfTjpW2LvCSrjAYFj2Zf
yyadFe9deWFVzZs1OYyutMQnwzdWvsi27Syndm95y98ib8NddyP4GFjlJVdZTnoe
fqTzvyKJYuEehh6gzuRoPAEn9zQCuUjznEa0P+gB8meFLo4ehGtmWnAByugngu0T
w/huoVDnxVzQu2S8d/48bn4OTLX/BS4NoPc3faRW394Khi1jMhy/Y7iquu0CAwEA
AaNNMEswCQYDVR0TBAIwADAdBgNVHQ4EFgQUXYHIEJEULLRMG3qTJJBls4L4Hd8w
HwYDVR0jBBgwFoAUv5gO8NHd5OOOIZeU30Qpl87BUrswDQYJKoZIhvcNAQELBQAD
ggEBABveCRNHqDZupucbNX0vgvGI3R0qBFUm3VWdTwn1OG+m8CDbcHdp1NQqY7zQ
4+dXZctbl2wnWVW+ENJ8nBhJklN4HZxHgDwSlYzHwNrHcUYoZKGh83tG6+G6dVQF
/4Yky5/4fOkt69pz7Z+0leZUcphJynvt4DW3nXL+FBSnlkbZDyvxQ+Zbr2jBeJ3r
Qib+4LIBngXSRwD/utcPC1HzzVPQ0gQcybd2Z+2ReZO4DR2AvYo0IiAEwT+vHXkZ
vzmO4YK55u9o3QZnSgA+pqOQkZJuPKpapITvkVNtM8DDqVr1tFB5h4NTff5byyGK
5KKKrVdvkXMZun1Jr3CoI32aXp4=
MAkGA1UEAwwCQ0ExHTAbBgkqhkiG9w0BCQEWDkNBQGV4YW1wbGUuY29tMB4XDTE5
MTExMTIxNTgzMFoXDTIzMTExMTIxNTgzMFowbzELMAkGA1UEBhMCUEwxGzAZBgNV
DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKZxU5tDdyU9rl2OA+u3SKXWyLmy
vW+f+FEmzdQwRK+AjbZrj7hNcmmtKUDhiPobT/Y1NpwqXRn37mtZEstXi/Kv5P7m
TKWIlwRn21/o2xVFAmKg1zwlAmzBTipsoSawSV+yYLG0LgKId3jCMvYVmekH1qpN
XgQyAt2Z4DpE3JGKnGtLUIyokkB2DfE6uCvRL+ySrzzOAoiK1yELUtF4SanBkqwt
GKyc8JHFXZ3ZIVZnYSnTGe8OhEkaOqMVmGtPzLnxt/1bj0cEYSlCXbz6UAZfLUqx
muDxSBqgG2CqQyh+3YYgTrQ4RIT7r0vEzop/f+4xE6kJsiVNd5dKHTxISYsCAwEA
AaNNMEswCQYDVR0TBAIwADAdBgNVHQ4EFgQUuBZiJEaBGeaketO4ZCodNbC8OrUw
HwYDVR0jBBgwFoAUv5gO8NHd5OOOIZeU30Qpl87BUrswDQYJKoZIhvcNAQELBQAD
ggEBAJ+0LcsCFTzVCo2VvbiGyYxJ9JPkYXMjCd9I+5zrzBx3RYH7V/cZrbx0DVOA
AsDJPz4GF0hoSWpCwMvtWfa5R4sGvQcfnc55ogsBZLkpQf1VVrPCQEjnWcrD5P9j
Ej3XImPSQrxWb4jvn7fQb0uqJTX/vpHNg2I7FCkbqxcrC99GnKn0fAm18HTT4iiF
y9LLFO7Oip8czCr3vozQZugZl10LW2M3GtOTyuCUJx1m6XQzW4U+jdtmJC6qmOiA
POo5bPcb7y97IbM6FxPpyKWzmn19iAXM3j/SSo+GlSypXAGN+L7mu2M8m5SITmRd
SjDkNyEZRi8WLaQB3SKzaC6iheo=
MAkGA1UEAwwCQ0ExHTAbBgkqhkiG9w0BCQEWDkNBQGV4YW1wbGUuY29tMB4XDTE5
MTExMTIxNTgzMFoXDTIzMTExMTIxNTgzMFowbzELMAkGA1UEBhMCUEwxGzAZBgNV
DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALq/uXUhshKi4zWQw4ElNpMTvdjl
+1hnq8xuVFmb/s5hMpZNKLm0st3tLtbiAt9RBC7yaNqRLN49AZsJpgcuagAc9U7k
oUukal7XtnCSu62cZmhylSgZEoqeZUfIsbpbipQzIokPUfTjpW2LvCSrjAYFj2Zf
yyadFe9deWFVzZs1OYyutMQnwzdWvsi27Syndm95y98ib8NddyP4GFjlJVdZTnoe
fqTzvyKJYuEehh6gzuRoPAEn9zQCuUjznEa0P+gB8meFLo4ehGtmWnAByugngu0T
w/huoVDnxVzQu2S8d/48bn4OTLX/BS4NoPc3faRW394Khi1jMhy/Y7iquu0CAwEA
AaNNMEswCQYDVR0TBAIwADAdBgNVHQ4EFgQUXYHIEJEULLRMG3qTJJBls4L4Hd8w
HwYDVR0jBBgwFoAUv5gO8NHd5OOOIZeU30Qpl87BUrswDQYJKoZIhvcNAQELBQAD
ggEBABveCRNHqDZupucbNX0vgvGI3R0qBFUm3VWdTwn1OG+m8CDbcHdp1NQqY7zQ
4+dXZctbl2wnWVW+ENJ8nBhJklN4HZxHgDwSlYzHwNrHcUYoZKGh83tG6+G6dVQF
/4Yky5/4fOkt69pz7Z+0leZUcphJynvt4DW3nXL+FBSnlkbZDyvxQ+Zbr2jBeJ3r
Qib+4LIBngXSRwD/utcPC1HzzVPQ0gQcybd2Z+2ReZO4DR2AvYo0IiAEwT+vHXkZ
vzmO4YK55u9o3QZnSgA+pqOQkZJuPKpapITvkVNtM8DDqVr1tFB5h4NTff5byyGK
5KKKrVdvkXMZun1Jr3CoI32aXp4=
MIIEpQIBAAKCAQEAur+5dSGyEqLjNZDDgSU2kxO92OX7WGerzG5UWZv+zmEylk0o
ubSy3e0u1uIC31EELvJo2pEs3j0BmwmmBy5qABz1TuShS6RqXte2cJK7rZxmaHKV
KBkSip5lR8ixuluKlDMiiQ9R9OOlbYu8JKuMBgWPZl/LJp0V7115YVXNmzU5jK60
xCfDN1a+yLbtLKd2b3nL3yJvw113I/gYWOUlV1lOeh5+pPO/Ioli4R6GHqDO5Gg8
ASf3NAK5SPOcRrQ/6AHyZ4Uujh6Ea2ZacAHK6CeC7RPD+G6hUOfFXNC7ZLx3/jxu
fg5Mtf8FLg2g9zd9pFbf3gqGLWMyHL9juKq67QIDAQABAoIBAQC3Tcl0N4ba1BfB
VD8SXLyc0Rvf8p4rwFbZatJQwtXxLWbCMSpwXfXT8COxuFapbJR2oGpbX3RzD96r
l2ToV56kTchbj/7iiJgAUCw7g0vEtWevzgiqOzH/7knrlAsfqQr1PNwBPJBtl6Wh
SS97rwbaQkrnac+2LyqAsXebGuWeGYmeq/hS7osamqr13mqWzVhHlLiuJTsSfgHg
UaixgQlq5MDRR9Era+lCvDNcPtvSLLxIZLLjeToAJz+0wRNNT2OMBdftv1bfRwnm
hMlIfJmM5e7NAQeXWywtK6bImLyNLJxtAEKfSK31GlmR4HADO0xKKrGBRWS6jjxh
uWaf+ijhAoGBAO1Iz4zcyHJi3ElyN+sHmRN/ucr86oQGoXoabssurWhPmG0a/Knv
JI431iYQO+KhkYuSVU0UOzZojHe1/iYbNJVhKooQUGVeSIrZclGfHnKqpXHVM9Ks
msNsMkdwIEZugVUsRtOrj3sAjUpqNMmJQ6fTo3YyG8xOA6D/x0aKNrF7AoGBAMl6
g2f2wQfjIdWUGE0JOycYcw2C8GkUeOwzxQ4dii8mUvb/JD2hqxHJJ3s/CCyKv0uD
m7D4ZsszLm7MW4fAEgxpUrpOY+r4o5q0wZLnNtARcqzDggFvmejgMFWiUgIiesV/
/iN3v0y8MUPmu3LXoznrm2SoTrjanimMT7pCSNS3AoGBAOCFkL48+v4hRUfJ59dg
bRviM686+bzLeWfMMyHWnQaiqhwy+Pji67gWZW/G1KNxNgLXCBfTGOQ2sRNlBYKR
I4RlWJcjMK96MzIO5vkMkwb1KW84ybyCzj4z1q96DVAXqBErwCjxoOZGc2sCa8h3
NalLvNROPbdn6k8hNzIr/eyZAoGBAMhy3R2n/3ALZ3QH/Q1Xq8Q/rOe6Z9kDhzLo
ZpqehQZXyJ74RGQU3g+540/Y7Bb0i1FjxJgS6qIrb3zIUCAE1XAHsUiuCPaTHKIk
R5oR8xSa504+zK8FC0kHEs9/yLta9m5b4soCrw53BUSa389n/nr3jwhb8sYyqryH
XiLfI3qNAoGAbV1RPIOob8n08gT5scu6DerTvCSe9P6qZWRyYjElSV/CVnBFBG6e
64PDOJ6y1/R4999zGRji8eMWdz7mUmMOFzkHvm/us5j4ZpuZwxZDRte9f4vV+yDP
Iz2oFCMK9HJVMMecIaE9sqkKfGSVvqGV3t7ikihmgJBzeJi2YVL7/5Y=
$OPENSSL pkcs12 -export -in tmp/server_cert.pem -out tmp/server_cert.p12 -passout pass: 1>&2 2>> "maketestcert.log"
test1:kvix8aMfwWEdGjJslhocucTcvGCr2qWT3E1PfwpGFIe0qOmhyi
test2:wionOV9B956yI9rFjlyq46IWps8cBqTYTmz7sW1rROGhNkWgyF
MAkGA1UEAwwCQ0ExHTAbBgkqhkiG9w0BCQEWDkNBQGV4YW1wbGUuY29tMB4XDTE5
MTExMTIxNTgzMFoXDTIzMTExMTIxNTgzMFowcjELMAkGA1UEBhMCUEwxGzAZBgNV
ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAObg8POTFshvLhXt/BhxBI8G
+yb/OeaohYdmtDtBfV4eXAubH6uewRIh4+4l3NHL5DG41hOSNueOf5WnSKVD1sYY
XoKlqukH7o1Z2x2x6IpHXGGnmVnIgMNJfBo3wuzBugeeepytYcQqYdmDugN6TB8f
hZUc90E1ZdER6jyJ+F31UmB1FWKpBILbsc8HZVmfEUMV0lFXRH+h7S/ncYY7WTQf
GglBlBzkOLfENTJRBKX7RRsh8ySf9LwjuxE58wOUwqFCzcgtyicLPg3JVNqbBqvW
+9iYDWcd3K1bD3az0quadfWDwRnMDGfMfU3Evp3nDSVB86Bru5cVPvf8UglbWiEC
AwEAAaNNMEswCQYDVR0TBAIwADAdBgNVHQ4EFgQUpAGy+3Vst01bjzeHY6vOJaAI
K60wHwYDVR0jBBgwFoAUv5gO8NHd5OOOIZeU30Qpl87BUrswDQYJKoZIhvcNAQEL
BQADggEBAELfKTDvo8X1AJrsZlkGS1QkdEbebVqMpvNO5AUnfH+DiUPUM8ejmSyL
WnWl+/F8TJu0o2ph+Jf1zMAyXXxm3gGWE7L64BSOtrnKz8Npvlg2CyJKp8LRQ69i
2XsHqbbzpmiwnn7y7FTHhOpVOWsg/lZfCrP82RD3HRz7Hpx1M+wyKMsFnoIphIz1
99Hj2H6cyHdw01xMjLz6eiKzBAV1N2IPzCaX/lNkWjlJjo+CNoT2nPYsOoBrUdGO
emu9o7jRLNqZK34roZW+ZbZGCL3lYuM1MYCkIDq8J6wyyquNNOShmk5pQBoaNtSb
kSMBXIHQEJHJOoxXzScOGMJH69hfhVc=
MIIEpAIBAAKCAQEA5uDw85MWyG8uFe38GHEEjwb7Jv855qiFh2a0O0F9Xh5cC5sf
q57BEiHj7iXc0cvkMbjWE5I2545/ladIpUPWxhhegqWq6QfujVnbHbHoikdcYaeZ
WciAw0l8GjfC7MG6B556nK1hxCph2YO6A3pMHx+FlRz3QTVl0RHqPIn4XfVSYHUV
YqkEgtuxzwdlWZ8RQxXSUVdEf6HtL+dxhjtZNB8aCUGUHOQ4t8Q1MlEEpftFGyHz
JJ/0vCO7ETnzA5TCoULNyC3KJws+DclU2psGq9b72JgNZx3crVsPdrPSq5p19YPB
GcwMZ8x9TcS+necNJUHzoGu7lxU+9/xSCVtaIQIDAQABAoIBAQCFKw+v3pJQj9hM
K9Wxn1aazNMGXkZeZauHOtUQLKkMJYS/6Pyud8YzGDso/MvOcsUvbMaFyVtD2mx6
vF9pe6Sg5CN3Rek7uih9fWumSByxzZFaflo0cDLc8UDUun8DIoaTqHRedJ8kj7Ga
zaD4Ko1Hkl3xcSCoiw0sNyIdQxNv1Vz2JdTuzgNAj29fuQH9BJeIRBX3i9LSf8b4
z+A1fZdYecKaM/gYd8YU0klShwlTiz32poq0broU/ZD2+DkXea6kLgDo4TwRFYH/
gEhmq6sHkjBPOWOkrI31/VeUGF3yZUnktw04Xx81SU70v1ajfvwlgm4K3RMX3ARP
vb4R3KIxAoGBAPP3FwePhmqvdd8mKHALJgeOHQm0MyFVr8/+iWHLGvUiAPvwjXWn
u9Snb7D9HFVUBPNVvesS3UcFzYATgD5bLu4baRXXhH+8aXoz/QMVoJauy5VqmXiN
nKHLP2F2VKM41fOGB4giEK0APH6tckrpmwaPRiG5ltAaRGxsf6p1UoxNAoGBAPJE
lqEaxeM6GFrbQRq+YZodIerE4epNJqMJZ7LD2AXr9HlfuI2FQaXaTFWizLQtwqZp
fm8xBL0rJ53wC0jUxzqMcTwYfrojGwy7+k3VxeuU2eG+autAE6uLLT5DHrumdYPu
oQDc8DhHNSmtbKv2hOboj7CE3Nt4tETsjBqADt8lAoGAJowNDHnGAEdW9Xo++20X
hiwTNHxPc93pGJEcPeJskPzdcPFSOJvXFsOZ5zom5uiOm7AZgPILGnS1Qp5SLggU
QzT7hqL14YTwmYlrWbhqFkTqD+K2+xBNBldp3UloGB4b2A1+VSkkv2EBLfbTzzhX
8VJj/2ImjR0JYKRIC7Pb5iUCgYBW21BFohugQ4vHxyOoOukzH46xZLS6E77uZMjQ
xnYEaXvUqAS6eDP5CjKj4SIS1vUaRGgX5TMVvwsNDKp/CgoDa6aNLRsCEOP5xMsQ
bLvwogUbcfFTNj3XGqa108qI7DzleAAxFwToqF7e+lYjsNYlEuuxFXE5HiVDMKtq
NM8gIQKBgQCuXTirYre6mCuzdGGSHBmRkIUm/cOkQzF05N/iD+s6mtK3fRa3PgkY
coLEgzTZBT+54u/7HfmS3OB6iWx+5Wrb2j1bSaD8zp70K9W1FE4ocPpT4pmJdK2r
HCS59Ng2AqV5FvClfHHJ1SJHnnnQcjL7GYGvuV8FBR7M6Orky3pPcw==
test1:kvix8aMfwWEdGjJslhocucTcvGCr2qWT3E1PfwpGFIe0qOmhyi
test2:W42xCIe3Zbp65qEBpo3ER4EvWkHSErEn0Ps8w0ikmMHr5tHuvY
MAkGA1UEAwwCQ0ExHTAbBgkqhkiG9w0BCQEWDkNBQGV4YW1wbGUuY29tMB4XDTE5
MTExMTIxNTgzMFoXDTIzMTExMTIxNTgzMFowbzELMAkGA1UEBhMCUEwxGzAZBgNV
DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKZxU5tDdyU9rl2OA+u3SKXWyLmy
vW+f+FEmzdQwRK+AjbZrj7hNcmmtKUDhiPobT/Y1NpwqXRn37mtZEstXi/Kv5P7m
TKWIlwRn21/o2xVFAmKg1zwlAmzBTipsoSawSV+yYLG0LgKId3jCMvYVmekH1qpN
XgQyAt2Z4DpE3JGKnGtLUIyokkB2DfE6uCvRL+ySrzzOAoiK1yELUtF4SanBkqwt
GKyc8JHFXZ3ZIVZnYSnTGe8OhEkaOqMVmGtPzLnxt/1bj0cEYSlCXbz6UAZfLUqx
muDxSBqgG2CqQyh+3YYgTrQ4RIT7r0vEzop/f+4xE6kJsiVNd5dKHTxISYsCAwEA
AaNNMEswCQYDVR0TBAIwADAdBgNVHQ4EFgQUuBZiJEaBGeaketO4ZCodNbC8OrUw
HwYDVR0jBBgwFoAUv5gO8NHd5OOOIZeU30Qpl87BUrswDQYJKoZIhvcNAQELBQAD
ggEBAJ+0LcsCFTzVCo2VvbiGyYxJ9JPkYXMjCd9I+5zrzBx3RYH7V/cZrbx0DVOA
AsDJPz4GF0hoSWpCwMvtWfa5R4sGvQcfnc55ogsBZLkpQf1VVrPCQEjnWcrD5P9j
Ej3XImPSQrxWb4jvn7fQb0uqJTX/vpHNg2I7FCkbqxcrC99GnKn0fAm18HTT4iiF
y9LLFO7Oip8czCr3vozQZugZl10LW2M3GtOTyuCUJx1m6XQzW4U+jdtmJC6qmOiA
POo5bPcb7y97IbM6FxPpyKWzmn19iAXM3j/SSo+GlSypXAGN+L7mu2M8m5SITmRd
SjDkNyEZRi8WLaQB3SKzaC6iheo=
MIIEowIBAAKCAQEApnFTm0N3JT2uXY4D67dIpdbIubK9b5/4USbN1DBEr4CNtmuP
uE1yaa0pQOGI+htP9jU2nCpdGffua1kSy1eL8q/k/uZMpYiXBGfbX+jbFUUCYqDX
PCUCbMFOKmyhJrBJX7JgsbQuAoh3eMIy9hWZ6QfWqk1eBDIC3ZngOkTckYqca0tQ
jKiSQHYN8Tq4K9Ev7JKvPM4CiIrXIQtS0XhJqcGSrC0YrJzwkcVdndkhVmdhKdMZ
7w6ESRo6oxWYa0/MufG3/VuPRwRhKUJdvPpQBl8tSrGa4PFIGqAbYKpDKH7dhiBO
tDhEhPuvS8TOin9/7jETqQmyJU13l0odPEhJiwIDAQABAoIBABiDUEDpqr59WxTE
OaeZksV54I4Y2PV7peKtyFqb0UHXuQdIyB3oqhUOP6kijj3nj9s+8xAE3TlZ3m9I
6w+vkRjo9tzjph4rA7LOaOyzKrDzPOqxrYFaIgVKYuy0mvdLt0K0zrDdTHlrB81t
LHw5qjU7xk3GnzYW930TkIaEZce5WXcG1SUBtdWrP6RGYAlOUCBSbnJcumpw2sE+
I7IoxMmQbVl9UOK1IRRltr76A2APoo7pPkz5ghqWgykjta8aMYEfEz6E19rTTPWE
PM8M28MzNcGN7inIMlejxii/LTJQLFfUVdPH0wOWNTZcvOkgcuF34tZ6b7ukw/Ky
XeOKJcECgYEA2RRytdmeOp7QDIaFTBwV2t5xuEBnVAQ9V0AEh3wr+PB9wDBLFkJv
wIKp+oMjJOURNnq8aP3wg+xuyKW0+fsHmFbytK5g7cjn8oXFyk9PvpAuhDXjGcQv
rjdwpaDzepUTjO77fHslqsfmreFZYGDTCA7X/jcXldnIPHygjbwvU5kCgYEAxEi6
XRBuhh2/U6aY4AdJxpwePTKi0LNSIsfb6IAlnqOyL8tGamJg3DSyD3xLnpo1UJjr
sRhgVVbRfGVgpm1Qkd826ekFtSDg65fkD1zcCd/ijSineFB3cIQSIX9+L1bpEcir
uey/qyc/a8+UZq/YEmXMnB6GDNtDClDriMQZ/MMCgYEAv8YRxNd4sp7ke3xHvEI/
iHjli/nRjuaj7jWPCsZG7og+/49qdkLBCRgl5Dr/zDNVroRleHeGiHVSNY42wHTl
c860Yax/0vGe/6DwaFcCwv4LKh+U/olT+hveN2RmVM/oUqQ5pfIBB8vL3absV3mS
VVcPt/ShsG+SNuV+zVgHk1kCgYBNLnPpqE5tekEDeZzfar491KGnWsPe4MRJXOFB
+THRwXiNhpb3uhtwO2BQ6oUppmWUfa0gA//NTsgs7AgnKRDnayhCrhhKctU+jolk
6RS05U5GR1gi3TE6ExS2C1Xo83nOPmQYRdnQSSyNDiDCiB6kjVb5hJ8daxJfehZD
vyig1QKBgBzpjUITbxy0uty5qL81aV1luMwlkSVhCHZCAjhFkbUxHFvMuoeFuwQm
aDcm/XZqbBEO8D1BcjAonMmpuVwnnhfaXEZwzZqP0oJaaS5GzwdEP/aT9NuUd3uf
1PXdun7ArANAQayTWiDP613UUHY96GszYpxCHQTF9uYUjk+3ncUV
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCqok2NvyMMKWnL
buYxcXic/T2j1OPDbeDzSy77t0hMGjbforHpHmnAHxdYPGTkgbbiaLRZJfNEBDD2
1H3c/YLC1cfwSc9tw1whbmmyxq1iPuNH1kE/o1kXNRVZta+oSzFGGzigD5c7Zp/F
xytmtu+R7pMpQv1IPOx2SFzqzm3bTRBjyciG+EFX8ceyRbmNuwyGfaWD+awbxp+I
gfChtD5Z6Kw/n6coaG4/VyxMni7GRB/MIyYmYqb/cfSQsGCq8EfvrAmUllqZ64Sl
k63z5VyPv3uestIHKWWwPitqCioCzeOt1VAyA5UeL22QocC2YfuSnJTjQZk2ESjq
FI41L155AgMBAAECggEASta0vR6/+G2RgTA6tiTWicRobJrK6sQejZbEHJLemsJE
nwF0lpJIP4NjccfLWI2r8NGLiC4k7AgKkbfRHEP0PhAViUZWPAYbOm563XZWRWjf
tno6U/cI9CzMGHSffmi8S8tUop8z7VGtcclRN9O0b4T79nTzMePGsno6hqHTfQMw
dHAucZY43puCOQm0Lkm0Mzf+XUC1SzjfhYni2HrsfKWmzLZPSZufzl6toQVjhzNI
EYl+4TpZFuScwB4Ox5bojsA9uLtluLEYGZ7Eu7J+ol4hIzyBDiZvosmkoEkbFjFt
2EvGAlzQhlcqUJECo69lfW5J9ZqASIKJqyH4q+NkIQKBgQDVcc9gniVhUQNIH1WE
FBTo8IqhUUIZ9fPj5ALxvtaXjZAjldySNiZDST3oQNXf9KhEhEJVDqb/CLN7U/Q8
7/A/WfMg29ud34gRJ1JbUxhUva1Gw4kbdvg2CEs/3DnepPHDFBBLAmsH7RWMTA3h
hWEVjD9gFUweVu/Zs+dy2h44uwKBgQDMp3ICJjMKTm1i9l4r/8J5ZdGD1K0A1a8D
MPzj7sjNa1sjrmtEQb9FBVwP9xfabV8EEFxcJdRb7e3282TeWrDx8sRpY8o2UJfi
QyDGvjvfzmUcHszD7z5jFl/dtt+nf6nKBFg8tLyBw4WahPUrmbjtCRvyb7ol2A0g
WaBInkpcWwKBgDHtd1bgZ1oGO0BJpBVLJUD/00281juAXtZ15YJq44N757WLPpcs
93JR1ZtYXy8N6bZtQZ7n2IRborA8iSsf7RDEl6yeARdCzG9GxWr7Wvunirq8znuQ
Lqtk8UU03IyKBMtfDBifri2idaHlwHF6Y6VIsyJkmPOX3m8MOB2Ti/I1AoGAXiM/
3CE6JSmCQ51UICUbjb/6KgvwMIwaXvtvuGEkWOljGPyoNtOPae5XNLjSbhUVOcdU
1MZJ8qd1aLz4zxckgYbMNjZC080qsFd0gjcLT52fANpiElbAec/W9SOjqWad8WEi
PXpdo8sOb89s/0tMtywTgOdH1xSUpSbVBdJaHjUCgYEAoUnR5XvNINIoG7oLDfFy
MP4w6t0dFjbjVZ5gu4EY0Bsz03lhil50POubS4QLzw3HXLnHMCZvgDeSVLdQvIxD
PexyOMWW9hgr0aP2U+NBu6uTGMizoKtGQcep7zypidKUrWYUmnuZ71t8ZldyisN2
b83EIZ4I3GVpI8ZulB/pmOM=
MIIEQTCCAymgAwIBAgIUB137S+cNuXYLmn5OBQ45oaesB18wDQYJKoZIhvcNAQEL
SIb3DQEJARYTc3R1bm5lbEBleGFtcGxlLmNvbTAeFw0xOTExMTEyMTU4MzBaFw0y
MzExMTEyMTU4MzBaMIGnMQswCQYDVQQGEwJQTDEZMBcGA1UECAwQTWF6b3ZpYSBQ
SIb3DQEBAQUAA4IBDwAwggEKAoIBAQCqok2NvyMMKWnLbuYxcXic/T2j1OPDbeDz
Sy77t0hMGjbforHpHmnAHxdYPGTkgbbiaLRZJfNEBDD21H3c/YLC1cfwSc9tw1wh
bmmyxq1iPuNH1kE/o1kXNRVZta+oSzFGGzigD5c7Zp/Fxytmtu+R7pMpQv1IPOx2
SFzqzm3bTRBjyciG+EFX8ceyRbmNuwyGfaWD+awbxp+IgfChtD5Z6Kw/n6coaG4/
VyxMni7GRB/MIyYmYqb/cfSQsGCq8EfvrAmUllqZ64Slk63z5VyPv3uestIHKWWw
PitqCioCzeOt1VAyA5UeL22QocC2YfuSnJTjQZk2ESjqFI41L155AgMBAAGjYzBh
MA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFOU5G8ScXk8i4W2ZgsMJoeB3C2Kk
MB8GA1UdIwQYMBaAFOU5G8ScXk8i4W2ZgsMJoeB3C2KkMA4GA1UdDwEB/wQEAwIB
hjANBgkqhkiG9w0BAQsFAAOCAQEAXd74EV07hNV4KQOl6km5J5l24koTYUK9JS8S
1MEjbhmmFqepSjwZRlXODsYGMT+qZOi7obOTW1Qn/8Y6OV0D3liSSYqRvgq10meG
7dWbSVGjbuJpY3v6aJPzpd5AhiYZPRpmlwqg8kolz50je5IxjQZT3QKCLs5XTBgy
6OMyH9uaAGFM6TNLXXVA5LNcske9zzRfzkkkVmjL2XUFAVveZbeqA+k2zxR0WYMo
6gQM7QE2GNbeyHRlPC4XM6mMO0tCsTfgw2hCZP98MD0Og4ejhClnSN1YdWRApQqY
f7diPDDG6IyXH92iwMc4Idr6U/LiBUPMps62u8Knl9MBGABCDg==
  if [ -n "$(command -v netstat)" ] && ! netstat -a -n 2>&1 | grep -q -e "usage" -e "invalid" -e "illegal" -e "command not found"
    elif [ -n "$(command -v ss)" ] && ! ss -a -n -l 2>&1 | grep -q -e "usage" -e "invalid" -e "illegal" -e "command not found"
      then
        mynetstat="ss"
    elif [ -n "$(command -v lsof)" ] && ! lsof -i -n -P 2>&1 | grep -q -e "usage" -e "invalid" -e "illegal" -e "command not found"
      then
        mynetstat="lsof"
    else # netstat / ss / lsof is required
      printf "%s\n" "netstat / ss / lsof not found in \$PATH or some option error"
      result=1
   fi
if grep -q "FIPS" results.log && grep -q "\-fips" results.log
              cat "nodata" | $mybuffer $opt_buf $mynetcat -l -p "$http_nc" -vvv > "temp.log" 2>> "stderr_nc.log" &
# by Michal Trojnara 1998-2019
# by Michal Trojnara 1998-2019
# by Michal Trojnara 1998-2019
ï»¿; Sample stunnel configuration file for Unix by Michal Trojnara 1998-2019
Copyright (C) 1998-2019 Michal Trojnara
# NSIS stunnel installer by Michal Trojnara 1998-2019
After=syslog.target network.target
Version:        5.56

Fixed code:
_Copyright (C) 1998-2020 Michal Trojnara_
        --prefix=/opt/openssl-mingw64 mingw64 shared enable-capieng
      sed -i 's/"\$(OPENSSLDIR)/"..\/config/' Makefile
      sed -i 's/"\$(ENGINESDIR)/"..\/engines/' Makefile
        --prefix=/opt/openssl-mingw mingw shared enable-capieng
      sed -i 's/"\$(OPENSSLDIR)/"..\/config/' Makefile
      sed -i 's/"\$(ENGINESDIR)/"..\/engines/' Makefile
# by Michal Trojnara 1998-2020
# by Michal Trojnara 1998-2020
### Version 5.57, 2020.10.11, urgency: HIGH
* Security bugfixes
  - The "redirect" option was fixed to properly
    handle "verifyChain = yes" (thx to Rob Hoes).
  - OpenSSL DLLs updated to version 1.1.1h.
* New features
  - New securityLevel configuration file option.
  - FIPS support for RHEL-based distributions.
  - Support for modern PostgreSQL clients (thx to Bram Geron).
  - Windows tooltip texts updated to mention "stunnel".
  - TLS 1.3 configuration updated for better compatibility.
* Bugfixes
  - Fixed a transfer() loop bug.
  - Fixed memory leaks on configuration reloading errors.
  - DH/ECDH initialization restored for client sections.
  - Delay startup with systemd until network is online.
  - bin\libssp-0.dll removed when uninstalling.
  - A number of testing framework fixes and improvements.

VERSION=5.57
# Generated by GNU Autoconf 2.69 for stunnel 5.57.
PACKAGE_VERSION='5.57'
PACKAGE_STRING='stunnel 5.57'
\`configure' configures stunnel 5.57 to adapt to many kinds of systems.
     short | recursive ) echo "Configuration of stunnel 5.57:";;
stunnel configure 5.57
It was created by stunnel $as_me 5.57, which was
 VERSION='5.57'
This file was extended by stunnel $as_me 5.57, which was
stunnel config.status 5.57
AC_INIT([stunnel],[5.57])
# by Michal Trojnara 1998-2020
# by Michal Trojnara 1998-2020
.TH stunnel 8 "2020.05.14" "5.57" "stunnel TLS Proxy"
Use \fIcurves\fR option instead of enabling \fIconfig = Curves:list_curves\fR to support elliptic curves.
.Sp
Only a single curve name is allowed for OpenSSL older than 1.1.1.
.IP "\fBsecurityLevel\fR = \s-1LEVEL\s0" 4
.IX Item "securityLevel = LEVEL"
set the security level
.Sp
The meaning of each level is described below:
.RS 4
.IP "level 0" 4
.IX Item "level 0"
Everything is permitted.
.IP "level 1" 4
.IX Item "level 1"
The security level corresponds to a minimum of 80 bits of security. Any parameters offering below 80 bits of security are excluded. As a result \s-1RSA, DSA\s0 and \s-1DH\s0 keys shorter than 1024 bits and \s-1ECC\s0 keys shorter than 160 bits are prohibited. All export cipher suites are prohibited since they all offer less than 80 bits of security. \s-1SSL\s0 version 2 is prohibited. Any cipher suite using \s-1MD5\s0 for the \s-1MAC\s0 is also prohibited.
.IP "level 2" 4
.IX Item "level 2"
Security level set to 112 bits of security. As a result \s-1RSA, DSA\s0 and \s-1DH\s0 keys shorter than 2048 bits and \s-1ECC\s0 keys shorter than 224 bits are prohibited. In addition to the level 1 exclusions any cipher suite using \s-1RC4\s0 is also prohibited. \s-1SSL\s0 version 3 is also not allowed. Compression is disabled.
.IP "level 3" 4
.IX Item "level 3"
Security level set to 128 bits of security. As a result \s-1RSA, DSA\s0 and \s-1DH\s0 keys shorter than 3072 bits and \s-1ECC\s0 keys shorter than 256 bits are prohibited. In addition to the level 2 exclusions cipher suites not offering forward secrecy are prohibited. \s-1TLS\s0 versions below 1.1 are not permitted. Session tickets are disabled.
.IP "level 4" 4
.IX Item "level 4"
Security level set to 192 bits of security. As a result \s-1RSA, DSA\s0 and \s-1DH\s0 keys shorter than 7680 bits and \s-1ECC\s0 keys shorter than 384 bits are prohibited. Cipher suites using \s-1SHA1\s0 for the \s-1MAC\s0 are prohibited. \s-1TLS\s0 versions below 1.2 are not permitted.
.IP "level 5" 4
.IX Item "level 5"
Security level set to 256 bits of security. As a result \s-1RSA, DSA\s0 and \s-1DH\s0 keys shorter than 15360 bits and \s-1ECC\s0 keys shorter than 512 bits are prohibited.
.IP "default: 2" 4
.IX Item "default: 2"
.RE
.RS 4
.Sp
The \fIsecurityLevel\fR option is only available when compiled with \fBOpenSSL 1.1.0\fR and later.
.RE
<p>Use <i>curves</i> option instead of enabling <i>config = Curves:list_curves</i> to support elliptic curves.</p>

<p>Only a single curve name is allowed for OpenSSL older than 1.1.1.</p>
</dd>
<dt id="securityLevel-LEVEL"><b>securityLevel</b> = LEVEL</dt>
<dd>

<p>set the security level</p>

<p>The meaning of each level is described below:</p>

<dl>

<dt id="level-0">level 0</dt>
<dd>

<p>Everything is permitted.</p>

</dd>
<dt id="level-1">level 1</dt>
<dd>

<p>The security level corresponds to a minimum of 80 bits of security. Any parameters offering below 80 bits of security are excluded. As a result RSA, DSA and DH keys shorter than 1024 bits and ECC keys shorter than 160 bits are prohibited. All export cipher suites are prohibited since they all offer less than 80 bits of security. SSL version 2 is prohibited. Any cipher suite using MD5 for the MAC is also prohibited.</p>

</dd>
<dt id="level-2">level 2</dt>
<dd>

<p>Security level set to 112 bits of security. As a result RSA, DSA and DH keys shorter than 2048 bits and ECC keys shorter than 224 bits are prohibited. In addition to the level 1 exclusions any cipher suite using RC4 is also prohibited. SSL version 3 is also not allowed. Compression is disabled.</p>

</dd>
<dt id="level-3">level 3</dt>
<dd>

<p>Security level set to 128 bits of security. As a result RSA, DSA and DH keys shorter than 3072 bits and ECC keys shorter than 256 bits are prohibited. In addition to the level 2 exclusions cipher suites not offering forward secrecy are prohibited. TLS versions below 1.1 are not permitted. Session tickets are disabled.</p>

</dd>
<dt id="level-4">level 4</dt>
<dd>

<p>Security level set to 192 bits of security. As a result RSA, DSA and DH keys shorter than 7680 bits and ECC keys shorter than 384 bits are prohibited. Cipher suites using SHA1 for the MAC are prohibited. TLS versions below 1.2 are not permitted.</p>

</dd>
<dt id="level-5">level 5</dt>
<dd>

<p>Security level set to 256 bits of security. As a result RSA, DSA and DH keys shorter than 15360 bits and ECC keys shorter than 512 bits are prohibited.</p>

</dd>
<dt id="default:-2">default: 2</dt>
<dd>

</dd>
</dl>

<p>The <i>securityLevel</i> option is only available when compiled with <b>OpenSSL 1.1.0</b> and later.</p>

<dt id="level-01">level 0</dt>
<dt id="level-11">level 1</dt>
<dt id="level-21">level 2</dt>
<dt id="level-31">level 3</dt>
<dt id="level-41">level 4</dt>
.TH stunnel 8 "2020.05.14" "5.57" "stunnel TLS Proxy"
Zamiast wyÅÄczaÄ \fIconfig = Curves:list_curves\fR
uÅ¼yj opcji \fIcurves\fR w celu ustawnienia krzywych eliptycznych.
.Sp
Wersje OpenSSL starsze niÅ¼ 1.1.1 pozwalajÄ na uÅ¼ycie tylko jednej krzywej.
.IP "\fBsecurityLevel\fR = \s-1POZIOM\s0" 4
.IX Item "securityLevel = POZIOM"
ustaw poziom bezpieczeÅstwa
.Sp
Znaczenie kaÅ¼dego poziomu opisano poniÅ¼ej:
.RS 4
.IP "poziom 0" 4
.IX Item "poziom 0"
Wszystko jest dozwolone.
.IP "poziom 1" 4
.IX Item "poziom 1"
Poziom bezpieczeÅstwa zapewniajÄcy minimum 80 bitÃ³w bezpieczeÅstwa. Å»adne parametry kryptograficzne oferujÄce poziom bezpieczeÅstwa poniÅ¼ej 80 bitÃ³w nie mogÄ zostaÄ uÅ¼yte. W zwiÄzku z tym \s-1RSA, DSA\s0 oraz klucze \s-1DH\s0 krÃ³tsze niÅ¼ 1024 bity, a takÅ¼e klucze \s-1ECC\s0 krÃ³tsze niÅ¼ 160 bitÃ³w i wszystkie eksportowe zestawy szyfrÃ³w sÄ niedozwolone. UÅ¼ycie SSLv2 jest zabronione. Wszelkie listy parametrÃ³w kryptograficznych uÅ¼ywajÄce \s-1MD5\s0 do \s-1MAC\s0 sÄ zabronione.
.IP "poziom 2" 4
.IX Item "poziom 2"
Poziom bezpieczeÅstwa zapewniajÄcy 112 bitÃ³w bezpieczeÅstwa. W zwiÄzku z tym \s-1RSA, DSA\s0 oraz klucze \s-1DH\s0 krÃ³tsze niÅ¼ 2048 bitÃ³w, a takÅ¼e klucze \s-1ECC\s0 krÃ³tsze niÅ¼ 224 bity sÄ niedozwolone. OprÃ³cz wyÅÄczeÅ z poziomu 1 zabronione jest takÅ¼e korzystanie z zestawÃ³w szyfrÃ³w uÅ¼ywajÄcych \s-1RC4.\s0 UÅ¼ycie SSLv3 jest zabronione. Kompresja jest wyÅÄczona.
.IP "poziom 3" 4
.IX Item "poziom 3"
Poziom bezpieczeÅstwa zapewniajÄcy 128 bitÃ³w bezpieczeÅstwa. W zwiÄzku z tym \s-1RSA, DSA\s0 oraz klucze \s-1DH\s0 krÃ³tsze niÅ¼ 3072 bity, a takÅ¼e klucze \s-1ECC\s0 krÃ³tsze niÅ¼ 256 bitÃ³w sÄ niedozwolone. OprÃ³cz wyÅÄczeÅ z poziomu 2  zabronione jest takÅ¼e korzystanie z zestawÃ³w szyfrÃ³w nie zapewniajÄcych utajniania z wyprzedzeniem (forward secrecy).  Wersje \s-1TLS\s0 starsze niÅ¼ 1.1 sÄ zabronione. Bilety sesji sÄ wyÅÄczone.
.IP "poziom 4" 4
.IX Item "poziom 4"
Poziom bezpieczeÅstwa zapewniajÄcy 192 bity bezpieczeÅstwa. W zwiÄzku z tym \s-1RSA, DSA\s0 oraz klucze \s-1DH\s0 krÃ³tsze niÅ¼ 7680 bitÃ³w, a takÅ¼e klucze \s-1ECC\s0 krÃ³tsze niÅ¼ 384 bity sÄ niedozwolone. Listy parametrÃ³w kryptograficznych uÅ¼ywajÄcych \s-1SHA1\s0 do \s-1MAC\s0 sÄ zabronione. Wersje \s-1TLS\s0 starsze niÅ¼ 1.2 sÄ zabronione.
.IP "poziom 5" 4
.IX Item "poziom 5"
Poziom bezpieczeÅstwa zapewniajÄcy 256 bitÃ³w bezpieczeÅstwa. W zwiÄzku z tym \s-1RSA, DSA\s0 oraz klucze \s-1DH\s0 krÃ³tsze niÅ¼ 15360 bitÃ³w, a takÅ¼e klucze \s-1ECC\s0 krÃ³tsze niÅ¼ 512 bitÃ³w sÄ niedozwolone.
.IP "domyÅlnie: 2" 4
.IX Item "domyÅlnie: 2"
.RE
.RS 4
.Sp
Opcja \fIsecurityLevel\fR jest dostÄpna poczÄwszy od \fBOpenSSL 1.1.0\fR.
.RE
<p>Zamiast wy&#x142;&#x105;cza&#x107; <i>config = Curves:list_curves</i> u&#x17C;yj opcji <i>curves</i> w celu ustawnienia krzywych eliptycznych.</p>

<p>Wersje OpenSSL starsze ni&#x17C; 1.1.1 pozwalaj&#x105; na u&#x17C;ycie tylko jednej krzywej.</p>
</dd>
<dt id="securityLevel-POZIOM"><b>securityLevel</b> = POZIOM</dt>
<dd>

<p>ustaw poziom bezpiecze&#x144;stwa</p>

<p>Znaczenie ka&#x17C;dego poziomu opisano poni&#x17C;ej:</p>

<dl>

<dt id="poziom-0">poziom 0</dt>
<dd>

<p>Wszystko jest dozwolone.</p>

</dd>
<dt id="poziom-1">poziom 1</dt>
<dd>

<p>Poziom bezpiecze&#x144;stwa zapewniaj&#x105;cy minimum 80 bit&oacute;w bezpiecze&#x144;stwa. &#x17B;adne parametry kryptograficzne oferuj&#x105;ce poziom bezpiecze&#x144;stwa poni&#x17C;ej 80 bit&oacute;w nie mog&#x105; zosta&#x107; u&#x17C;yte. W zwi&#x105;zku z tym RSA, DSA oraz klucze DH kr&oacute;tsze ni&#x17C; 1024 bity, a tak&#x17C;e klucze ECC kr&oacute;tsze ni&#x17C; 160 bit&oacute;w i wszystkie eksportowe zestawy szyfr&oacute;w s&#x105; niedozwolone. U&#x17C;ycie SSLv2 jest zabronione. Wszelkie listy parametr&oacute;w kryptograficznych u&#x17C;ywaj&#x105;ce MD5 do MAC s&#x105; zabronione.</p>

</dd>
<dt id="poziom-2">poziom 2</dt>
<dd>

<p>Poziom bezpiecze&#x144;stwa zapewniaj&#x105;cy 112 bit&oacute;w bezpiecze&#x144;stwa. W zwi&#x105;zku z tym RSA, DSA oraz klucze DH kr&oacute;tsze ni&#x17C; 2048 bit&oacute;w, a tak&#x17C;e klucze ECC kr&oacute;tsze ni&#x17C; 224 bity s&#x105; niedozwolone. Opr&oacute;cz wy&#x142;&#x105;cze&#x144; z poziomu 1 zabronione jest tak&#x17C;e korzystanie z zestaw&oacute;w szyfr&oacute;w u&#x17C;ywaj&#x105;cych RC4. U&#x17C;ycie SSLv3 jest zabronione. Kompresja jest wy&#x142;&#x105;czona.</p>

</dd>
<dt id="poziom-3">poziom 3</dt>
<dd>

<p>Poziom bezpiecze&#x144;stwa zapewniaj&#x105;cy 128 bit&oacute;w bezpiecze&#x144;stwa. W zwi&#x105;zku z tym RSA, DSA oraz klucze DH kr&oacute;tsze ni&#x17C; 3072 bity, a tak&#x17C;e klucze ECC kr&oacute;tsze ni&#x17C; 256 bit&oacute;w s&#x105; niedozwolone. Opr&oacute;cz wy&#x142;&#x105;cze&#x144; z poziomu 2 zabronione jest tak&#x17C;e korzystanie z zestaw&oacute;w szyfr&oacute;w nie zapewniaj&#x105;cych utajniania z wyprzedzeniem (forward secrecy). Wersje TLS starsze ni&#x17C; 1.1 s&#x105; zabronione. Bilety sesji s&#x105; wy&#x142;&#x105;czone.</p>

</dd>
<dt id="poziom-4">poziom 4</dt>
<dd>

<p>Poziom bezpiecze&#x144;stwa zapewniaj&#x105;cy 192 bity bezpiecze&#x144;stwa. W zwi&#x105;zku z tym RSA, DSA oraz klucze DH kr&oacute;tsze ni&#x17C; 7680 bit&oacute;w, a tak&#x17C;e klucze ECC kr&oacute;tsze ni&#x17C; 384 bity s&#x105; niedozwolone. Listy parametr&oacute;w kryptograficznych u&#x17C;ywaj&#x105;cych SHA1 do MAC s&#x105; zabronione. Wersje TLS starsze ni&#x17C; 1.2 s&#x105; zabronione.</p>

</dd>
<dt id="poziom-5">poziom 5</dt>
<dd>

<p>Poziom bezpiecze&#x144;stwa zapewniaj&#x105;cy 256 bit&oacute;w bezpiecze&#x144;stwa. W zwi&#x105;zku z tym RSA, DSA oraz klucze DH kr&oacute;tsze ni&#x17C; 15360 bit&oacute;w, a tak&#x17C;e klucze ECC kr&oacute;tsze ni&#x17C; 512 bit&oacute;w s&#x105; niedozwolone.</p>

</dd>
<dt id="domylnie:-2">domy&#x15B;lnie: 2</dt>
<dd>

</dd>
</dl>

<p>Opcja <i>securityLevel</i> jest dost&#x119;pna pocz&#x105;wszy od <b>OpenSSL 1.1.0</b>.</p>

<dt id="poziom-01"><i>poziom 0</i></dt>
<dt id="poziom-11"><i>poziom 1</i></dt>
<dt id="poziom-21"><i>poziom 2</i></dt>
<dt id="poziom-31"><i>poziom 3</i></dt>
<dt id="poziom-41"><i>poziom 4</i></dt>
Zamiast wyÅÄczaÄ I<config = Curves:list_curves>
uÅ¼yj opcji I<curves> w celu ustawnienia krzywych eliptycznych.

Wersje OpenSSL starsze niÅ¼ 1.1.1 pozwalajÄ na uÅ¼ycie tylko jednej krzywej.
=item B<securityLevel> = POZIOM

ustaw poziom bezpieczeÅstwa

Znaczenie kaÅ¼dego poziomu opisano poniÅ¼ej:

=over 4

=item poziom 0

Wszystko jest dozwolone.

=item poziom 1

Poziom bezpieczeÅstwa zapewniajÄcy minimum 80 bitÃ³w bezpieczeÅstwa. Å»adne parametry kryptograficzne oferujÄce poziom bezpieczeÅstwa poniÅ¼ej 80 bitÃ³w nie mogÄ zostaÄ uÅ¼yte. W zwiÄzku z tym RSA, DSA oraz klucze DH krÃ³tsze niÅ¼ 1024 bity, a takÅ¼e klucze ECC krÃ³tsze niÅ¼ 160 bitÃ³w i wszystkie eksportowe zestawy szyfrÃ³w sÄ niedozwolone. UÅ¼ycie SSLv2 jest zabronione. Wszelkie listy parametrÃ³w kryptograficznych uÅ¼ywajÄce MD5 do MAC sÄ zabronione.

=item poziom 2

Poziom bezpieczeÅstwa zapewniajÄcy 112 bitÃ³w bezpieczeÅstwa. W zwiÄzku z tym RSA, DSA oraz klucze DH krÃ³tsze niÅ¼ 2048 bitÃ³w, a takÅ¼e klucze ECC krÃ³tsze niÅ¼ 224 bity sÄ niedozwolone. OprÃ³cz wyÅÄczeÅ z poziomu 1 zabronione jest takÅ¼e korzystanie z zestawÃ³w szyfrÃ³w uÅ¼ywajÄcych RC4. UÅ¼ycie SSLv3 jest zabronione. Kompresja jest wyÅÄczona.

=item poziom 3

Poziom bezpieczeÅstwa zapewniajÄcy 128 bitÃ³w bezpieczeÅstwa. W zwiÄzku z tym RSA, DSA oraz klucze DH krÃ³tsze niÅ¼ 3072 bity, a takÅ¼e klucze ECC krÃ³tsze niÅ¼ 256 bitÃ³w sÄ niedozwolone. OprÃ³cz wyÅÄczeÅ z poziomu 2  zabronione jest takÅ¼e korzystanie z zestawÃ³w szyfrÃ³w nie zapewniajÄcych utajniania z wyprzedzeniem (forward secrecy).  Wersje TLS starsze niÅ¼ 1.1 sÄ zabronione. Bilety sesji sÄ wyÅÄczone.

=item poziom 4

Poziom bezpieczeÅstwa zapewniajÄcy 192 bity bezpieczeÅstwa. W zwiÄzku z tym RSA, DSA oraz klucze DH krÃ³tsze niÅ¼ 7680 bitÃ³w, a takÅ¼e klucze ECC krÃ³tsze niÅ¼ 384 bity sÄ niedozwolone. Listy parametrÃ³w kryptograficznych uÅ¼ywajÄcych SHA1 do MAC sÄ zabronione. Wersje TLS starsze niÅ¼ 1.2 sÄ zabronione.

=item poziom 5

Poziom bezpieczeÅstwa zapewniajÄcy 256 bitÃ³w bezpieczeÅstwa. W zwiÄzku z tym RSA, DSA oraz klucze DH krÃ³tsze niÅ¼ 15360 bitÃ³w, a takÅ¼e klucze ECC krÃ³tsze niÅ¼ 512 bitÃ³w sÄ niedozwolone.

=item domyÅlnie: 2

=back

Opcja I<securityLevel> jest dostÄpna poczÄwszy od B<OpenSSL 1.1.0>.

Use I<curves> option instead of enabling I<config = Curves:list_curves> to support elliptic curves.

Only a single curve name is allowed for OpenSSL older than 1.1.1.
=item B<securityLevel> = LEVEL

set the security level

The meaning of each level is described below:

=over 4

=item level 0

Everything is permitted.

=item level 1

The security level corresponds to a minimum of 80 bits of security. Any parameters offering below 80 bits of security are excluded. As a result RSA, DSA and DH keys shorter than 1024 bits and ECC keys shorter than 160 bits are prohibited. All export cipher suites are prohibited since they all offer less than 80 bits of security. SSL version 2 is prohibited. Any cipher suite using MD5 for the MAC is also prohibited.

=item level 2

Security level set to 112 bits of security. As a result RSA, DSA and DH keys shorter than 2048 bits and ECC keys shorter than 224 bits are prohibited. In addition to the level 1 exclusions any cipher suite using RC4 is also prohibited. SSL version 3 is also not allowed. Compression is disabled.

=item level 3

Security level set to 128 bits of security. As a result RSA, DSA and DH keys shorter than 3072 bits and ECC keys shorter than 256 bits are prohibited. In addition to the level 2 exclusions cipher suites not offering forward secrecy are prohibited. TLS versions below 1.1 are not permitted. Session tickets are disabled.

=item level 4

Security level set to 192 bits of security. As a result RSA, DSA and DH keys shorter than 7680 bits and ECC keys shorter than 384 bits are prohibited. Cipher suites using SHA1 for the MAC are prohibited. TLS versions below 1.2 are not permitted.

=item level 5

Security level set to 256 bits of security. As a result RSA, DSA and DH keys shorter than 15360 bits and ECC keys shorter than 512 bits are prohibited.

=item default: 2

=back

The I<securityLevel> option is only available when compiled with B<OpenSSL 1.1.0> and later.

# by Michal Trojnara 1998-2020
# by Michal Trojnara 1998-2020
 *   Copyright (C) 1998-2020 Michal Trojnara <Michal.Trojnara@stunnel.org>
#if OPENSSL_VERSION_NUMBER >= 0x10101000L
NOEXPORT void print_tmp_key(SSL *s);
#endif
#if OPENSSL_VERSION_NUMBER >= 0x10101000L
NOEXPORT void print_tmp_key(SSL *s) {
    EVP_PKEY *key;

    if (!SSL_get_peer_tmp_key(s, &key)) {
        sslerror("SSL_get_peer_tmp_key");
        return;
    }
    switch (EVP_PKEY_id(key)) {
    case EVP_PKEY_RSA:
        s_log(LOG_INFO, "Peer temporary key: RSA, %d bits", EVP_PKEY_bits(key));
        break;
    case EVP_PKEY_DH:
        s_log(LOG_INFO, "Peer temporary key: DH, %d bits", EVP_PKEY_bits(key));
        break;
#ifndef OPENSSL_NO_EC
    case EVP_PKEY_EC:
        {
            EC_KEY *ec=EVP_PKEY_get1_EC_KEY(key);
            int nid=EC_GROUP_get_curve_name(EC_KEY_get0_group(ec));
            const char *cname=EC_curve_nid2nist(nid);
            EC_KEY_free(ec);
            if (cname == NULL)
                cname=OBJ_nid2sn(nid);
            s_log(LOG_INFO, "Peer temporary key: ECDH, %s, %d bits", cname, EVP_PKEY_bits(key));
        }
        break;
#endif
    default:
        s_log(LOG_INFO, "Peer temporary key: %s, %d bits", OBJ_nid2sn(EVP_PKEY_id(key)),
                   EVP_PKEY_bits(key));
    }
    EVP_PKEY_free(key);
}
#endif /* OpenSSL 1.1.1 or later */

#if OPENSSL_VERSION_NUMBER >= 0x10101000L
    print_tmp_key(c->ssl);
#endif
            int num=SSL_shutdown(c->ssl); /* send close_notify alert */
                err=SSL_get_error(c->ssl, num);
            case SSL_ERROR_ZERO_RETURN: /* received a close_notify alert */
                SSL_set_shutdown(c->ssl, SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
                shutdown_wants_read=shutdown_wants_write=0;
                break;
            case SSL_ERROR_SYSCALL: /* socket error */
                if(parse_socket_error(c, "SSL_shutdown"))
                    break; /* a non-critical error: retry */
                SSL_set_shutdown(c->ssl, SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
                shutdown_wants_read=shutdown_wants_write=0;
                break;
            ssize_t num=writesocket(c->sock_wfd->fd, c->ssl_buff, c->ssl_ptr);
            ssize_t num=readsocket(c->sock_rfd->fd,
            int num=SSL_write(c->ssl, c->sock_buff, (int)(c->sock_ptr));
            switch(err=SSL_get_error(c->ssl, num)) {
            case SSL_ERROR_SSL:
                sslerror("SSL_write");
                throw_exception(c, 1);
            case SSL_ERROR_ZERO_RETURN: /* a buffered close_notify alert */
                /* fall through */
                if(parse_socket_error(c, "SSL_write") && num) /* always log the error */
            int num=SSL_read(c->ssl, c->ssl_buff+c->ssl_ptr, (int)(BUFFSIZE-c->ssl_ptr));
            switch(err=SSL_get_error(c->ssl, num)) {
            case SSL_ERROR_SSL:
                sslerror("SSL_read");
                throw_exception(c, 1);
            case SSL_ERROR_ZERO_RETURN: /* received a close_notify alert */
                s_log(LOG_INFO, "TLS closed (SSL_read)");
                if(SSL_version(c->ssl)==SSL2_VERSION)
                    SSL_set_shutdown(c->ssl,
                        SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
                break;
                if(parse_socket_error(c, "SSL_read") && num) /* always log the error */
        /* fall through */
        /* fall through */
        /* fall through */
 *   Copyright (C) 1998-2020 Michal Trojnara <Michal.Trojnara@stunnel.org>
#define DEFAULT_SECURITY_LEVEL 2

 *   Copyright (C) 1998-2020 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *   Copyright (C) 1998-2020 Michal Trojnara <Michal.Trojnara@stunnel.org>
    /* create a new TLS context */

    /* allow callbacks to access their SERVICE_OPTIONS structure */
#if OPENSSL_VERSION_NUMBER>=0x10100000L
    /* set the security level */
    if(section->security_level>=0) {
        /* set the user-specified value */
        SSL_CTX_set_security_level(section->ctx, section->security_level);
        s_log(LOG_INFO, "User-specified security level set: %d",
            section->security_level);
    } else if(SSL_CTX_get_security_level(section->ctx)<DEFAULT_SECURITY_LEVEL) {
        /* set our default, as it is more secure than the OpenSSL default */
        SSL_CTX_set_security_level(section->ctx, DEFAULT_SECURITY_LEVEL);
        s_log(LOG_INFO, "stunnel default security level set: %d",
            DEFAULT_SECURITY_LEVEL);
    } else { /* our default is not more secure than the OpenSSL default */
        s_log(LOG_INFO, "OpenSSL security level is used: %d",
            SSL_CTX_get_security_level(section->ctx));
    }
#endif /* OpenSSL 1.1.0 or later */

    /* setup mode of operation for the TLS state machine */
    /* initialize the DH/ECDH key agreement */
    if(!section->option.client)
    dh_init(section); /* ignore the result (errors are not critical) */
    ecdh_init(section); /* ignore the result (errors are not critical) */
    /* check if DH is needed for this section */
    if(section->option.client) {
        s_log(LOG_INFO, "DH initialization skipped: client section");
        return 0; /* OK */
    }
        s_log(LOG_INFO, "DH initialization skipped: no DH ciphersuites");
        cipher=EVP_aes_128_cbc();
        cipher=EVP_aes_256_cbc();
        iv_len=EVP_CIPHER_iv_length(cipher);
        0xCF, 0x9F, 0x3A, 0x9C, 0xC5, 0xA5, 0x89, 0x27, 0x6D, 0x2C,
        0x2C, 0xF3, 0xA6, 0x00, 0xD2, 0x7C, 0xEA, 0xFA, 0xF2, 0x43,
        0x4F, 0x49, 0x0A, 0xFC, 0xA6, 0xE7, 0x75, 0xCA, 0x07, 0xDC,
        0xA5, 0xF2, 0x83, 0x4E, 0x5A, 0xA0, 0xA0, 0xF5, 0x9C, 0xFD,
        0x02, 0xE6, 0x9E, 0xFC, 0x01, 0x59, 0xD7, 0xB6, 0xC1, 0x4E,
        0xC0, 0xB6, 0x71, 0x49, 0xF0, 0xC7, 0xD5, 0x2F, 0x8D, 0xDF,
        0xD3, 0xF1, 0x82, 0x82, 0x23, 0x33, 0x13, 0x93, 0xEB, 0x50,
        0x29, 0xFD, 0x1B, 0x5A, 0x2F, 0xD5, 0x08, 0x99, 0x64, 0xE9,
        0x7B, 0x1A, 0xDD, 0x68, 0x16, 0x08, 0xD0, 0x13, 0x82, 0xB6,
        0x86, 0x62, 0x76, 0xAA, 0x16, 0x14, 0xCC, 0x86, 0x72, 0x26,
        0x45, 0x8E, 0x2A, 0x82, 0x5B, 0x6F, 0xC1, 0xDF, 0xAA, 0x18,
        0x43, 0xB8, 0xAD, 0x84, 0x52, 0xF2, 0xD9, 0x9C, 0xC0, 0x47,
        0x52, 0x1B, 0x8E, 0x42, 0xC4, 0xD3, 0x61, 0x7B, 0x65, 0xA7,
        0x69, 0x03, 0xB5, 0xD4, 0x6C, 0x83, 0x6A, 0x46, 0x73, 0xAF,
        0x76, 0x77, 0x70, 0xC2, 0xD0, 0x74, 0xFE, 0x78, 0xF5, 0x75,
        0x3B, 0xCE, 0xE2, 0xB6, 0xA0, 0x25, 0xE9, 0xE8, 0x4B, 0xA2,
        0xF1, 0x20, 0x88, 0x13, 0x07, 0xED, 0x66, 0xBC, 0x46, 0xA1,
        0xB3, 0x44, 0xAF, 0x2C, 0xED, 0x73, 0x75, 0x3D, 0x14, 0x6E,
        0x43, 0x92, 0x40, 0x99, 0xB0, 0xD1, 0xBF, 0x2C, 0x4D, 0x0F,
        0x2A, 0x63, 0xF4, 0x85, 0x7B, 0x1B, 0x0E, 0x48, 0x5A, 0x06,
        0x02, 0xA6, 0x3D, 0x9E, 0x78, 0x05, 0xA8, 0x7C, 0xAD, 0x54,
        0x49, 0xDE, 0x7A, 0xE6, 0x36, 0x5C, 0x50, 0xFC, 0x09, 0x81,
        0x9E, 0x83, 0x53, 0x8C, 0x42, 0xEF, 0x12, 0x36, 0x4F, 0x22,
        0x16, 0x2A, 0x15, 0x88, 0x83, 0xA9, 0x00, 0x66, 0x9E, 0xD1,
        0xDC, 0x0F, 0x54, 0xC0, 0x32, 0x5C, 0x4C, 0x5E, 0xE2, 0x3D,
        0xBC, 0x56, 0x89, 0x75, 0x28, 0xA3
/* built for stunnel 5.57 */
 *   Copyright (C) 1998-2020 Michal Trojnara <Michal.Trojnara@stunnel.org>
# wce.mak for stunnel.exe by Michal Trojnara 1998-2020
 *   Copyright (C) 1998-2020 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *   Copyright (C) 1998-2020 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *   Copyright (C) 1998-2020 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *   Copyright (C) 1998-2020 Michal Trojnara <Michal.Trojnara@stunnel.org>
    log_mode=new_mode;
# Simple Makefile.w32 for stunnel.exe by Michal Trojnara 1998-2020
# by Michal Trojnara 1998-2020
 *   Copyright (C) 1998-2020 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *   Copyright (C) 1998-2020 Michal Trojnara <Michal.Trojnara@stunnel.org>
NOEXPORT char *parse_global_option(CMD, GLOBAL_OPTIONS *, char *, char *);
    "TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256";
        parse_global_option(CMD_PRINT_HELP, NULL, NULL, NULL);
        parse_global_option(CMD_PRINT_DEFAULTS, NULL, NULL, NULL);
    /* options_file() is a recursive function, so the last section of the
     * configuration file section needs to be initialized separately */
    if(options_file(configuration_file, type, &section) ||
            init_section(1, &section)) {
        s_log(LOG_ERR, "Configuration failed");
        options_free(0); /* free the new options */
    }
            errstr=parse_global_option(CMD_SET_VALUE, &new_global_options, config_opt, config_arg);
        errstr=parse_global_option(CMD_INITIALIZE, &new_global_options, NULL, NULL);
    parse_global_option(CMD_SET_DEFAULTS, &new_global_options, NULL, NULL);
    memset(&new_global_options, 0, sizeof(GLOBAL_OPTIONS));
    memset(&new_service_options, 0, sizeof(SERVICE_OPTIONS));
void options_free(int current) {
    GLOBAL_OPTIONS *global=current?&global_options:&new_global_options;
    SERVICE_OPTIONS *service=current?&service_options:&new_service_options;

    parse_global_option(CMD_FREE, global, NULL, NULL);

    CRYPTO_THREAD_write_lock(stunnel_locks[LOCK_SECTIONS]);
    while(service) {
        SERVICE_OPTIONS *tmp=service;
        service=service->next;
        tmp->next=NULL;
        service_free(tmp);
    }
    CRYPTO_THREAD_unlock(stunnel_locks[LOCK_SECTIONS]);
NOEXPORT char *parse_global_option(CMD cmd, GLOBAL_OPTIONS *options, char *opt, char *arg) {
        options->chroot_dir=NULL;
        tmp=options->chroot_dir;
        options->chroot_dir=NULL;
        options->chroot_dir=str_dup(arg);
        options->compression=COMP_NONE;
            options->compression=COMP_DEFLATE;
            options->compression=COMP_ZLIB;
        options->egd_sock=EGD_SOCKET;
        options->egd_sock=NULL;
        tmp=options->egd_sock;
        options->egd_sock=NULL;
        options->egd_sock=str_dup(arg);
        options->option.fips=FIPS_mode()?1:0;
        if(!strcasecmp(arg, "yes")) {
            options->option.fips=1;
        } else if(!strcasecmp(arg, "no")) {
#ifdef USE_FIPS
            if(FIPS_mode())
                return "Failed to override system-wide FIPS mode";
            options->option.fips=0;
#endif /* USE_FIPS */
        } else {
            return "The argument needs to be either 'yes' or 'no'";
        }
#ifdef USE_FIPS
        s_log(LOG_NOTICE, "%-22s = %s", "fips", FIPS_mode()?"yes":"no");
#endif /* USE_FIPS */
        options->option.foreground=0;
        options->option.log_stderr=0;
            options->option.foreground=1;
            options->option.log_stderr=1;
            options->option.foreground=1;
            options->option.log_stderr=0;
            options->option.foreground=0;
            options->option.log_stderr=0;
        options->icon[ICON_ACTIVE]=load_icon_default(ICON_ACTIVE);
        if(!(options->icon[ICON_ACTIVE]=load_icon_file(arg)))
        options->icon[ICON_ERROR]=load_icon_default(ICON_ERROR);
        if(!(options->icon[ICON_ERROR]=load_icon_file(arg)))
        options->icon[ICON_IDLE]=load_icon_default(ICON_IDLE);
        if(!(options->icon[ICON_IDLE]=load_icon_file(arg)))
        options->log_file_mode=FILE_MODE_APPEND;
            options->log_file_mode=FILE_MODE_APPEND;
            options->log_file_mode=FILE_MODE_OVERWRITE;
        options->output_file=NULL;
        tmp=options->output_file;
        options->output_file=NULL;
        options->output_file=str_dup(arg);
        if(!options->option.foreground /* daemonize() used */ &&
                options->output_file /* log file enabled */ &&
                options->output_file[0]!='/' /* relative path */)
        options->pidfile=NULL; /* do not create a pid file */
        tmp=options->pidfile;
        options->pidfile=NULL;
            options->pidfile=str_dup(arg);
            options->pidfile=NULL; /* empty -> do not create a pid file */
        if(!options->option.foreground /* daemonize() used */ &&
                options->pidfile /* pid file enabled */ &&
                options->pidfile[0]!='/' /* relative path */)
        options->random_bytes=RANDOM_BYTES;
            options->random_bytes=(long)strtol(arg, &tmp_str, 10);
        options->rand_file=str_dup(RANDOM_FILE);
        options->rand_file=NULL;
        tmp=options->rand_file;
        options->rand_file=NULL;
        options->rand_file=str_dup(arg);
        options->option.rand_write=1;
            options->option.rand_write=1;
            options->option.rand_write=0;
        options->option.log_syslog=1;
            options->option.log_syslog=1;
            options->option.log_syslog=0;
        options->option.taskbar=1;
            options->option.taskbar=1;
            options->option.taskbar=0;
        memset(options, 0, sizeof(GLOBAL_OPTIONS));
        if(ssl_configure(options)) /* configure global TLS settings */
        if(section==&service_options)
            s_log(LOG_ERR, "INTERNAL ERROR: Initializing deployed section defaults");
        else if(section==&new_service_options)
            s_log(LOG_INFO, "Initializing inetd mode configuration");
        else
            s_log(LOG_INFO, "Initializing service [%s]", section->servname);
        if(section==&service_options)
            s_log(LOG_DEBUG, "Deallocating deployed section defaults");
        else if(section==&new_service_options)
            s_log(LOG_DEBUG, "Deallocating temporary section defaults");
#if OPENSSL_VERSION_NUMBER>=0x10100000L
    /* securityLevel */
    switch(cmd) {
    case CMD_SET_DEFAULTS:
        section->security_level=-1;
        break;
    case CMD_SET_COPY:
        section->security_level=new_service_options.security_level;
        break;
    case CMD_FREE:
        break;
    case CMD_SET_VALUE:
        if(strcasecmp(opt, "securityLevel"))
            break;
        {
            char *tmp_str;
            int tmp_int =(int)strtol(arg, &tmp_str, 10);
            if(tmp_str==arg || *tmp_str || tmp_int<0 || tmp_int>5) /* not a correct number */
                return "Illegal security level";
            section->security_level = tmp_int;
        }
        return NULL; /* OK */
    case CMD_INITIALIZE:
        break;
    case CMD_PRINT_DEFAULTS:
        s_log(LOG_NOTICE, "%-22s = %d", "securityLevel", DEFAULT_SECURITY_LEVEL);
        break;
    case CMD_PRINT_HELP:
        s_log(LOG_NOTICE, "%-22s = set the security level", "securityLevel");
        break;
    }
#endif /* OpenSSL 1.1.0 or later */

        if(section==&service_options || section==&new_service_options)
	-DPACKAGE_VERSION=\"5.57\" \
	-DPACKAGE_STRING=\"stunnel\ 5.57\" \
	-DVERSION=\"5.57\" \
 *   Copyright (C) 1998-2020 Michal Trojnara <Michal.Trojnara@stunnel.org>
    /* https://www.postgresql.org/docs/current/protocol-message-formats.html */
    static const uint8_t gss_request[8]={0, 0, 0, 8, 0x04, 0xd2, 0x16, 0x30};
    static const uint8_t gss_response[62]=
        {'E', 0, 0, 0, 61, 'S', 'E', 'R', 'R', 'O', 'R', 0, 'C', 'X', 'X', '0',
        '0', '0', 0, 'M', 'S', 'S', 'L', ' ', 'e', 'x', 'p', 'e', 'c', 't', 'e', 'd',
        ' ', 'b', 'u', 't', ' ', 'n', 'o', 't', ' ', 'r', 'e', 'q', 'u', 'e', 's', 't',
        'e', 'd', ' ', 'b', 'y', ' ', 'c', 'l', 'i', 'e', 'n', 't', 0, 0};
    s_log(LOG_DEBUG, "Started server-side psql protcol negotiation");
    if(!safe_memcmp(buffer, gss_request, sizeof gss_request)) {
        s_log(LOG_INFO, "GSSAPI encryption requested, rejecting gracefully");
        s_write(c, c->local_wfd.fd, gss_response, sizeof gss_response);
        throw_exception(c, 2); /* don't reset */
    }
    s_log(LOG_DEBUG, "SSLRequest received");
        BIO_free(b64);
 *   Copyright (C) 1998-2020 Michal Trojnara <Michal.Trojnara@stunnel.org>
#if OPENSSL_VERSION_NUMBER>=0x10100000L
    int security_level;
#endif /* OpenSSL 1.1.0 or later */
void options_free(int);
 *   Copyright (C) 1998-2020 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *   Copyright (C) 1998-2020 Michal Trojnara <Michal.Trojnara@stunnel.org>
            VALUE "LegalCopyright",     "© by Michal Trojnara, 1998-2020"
    LTEXT           "© by Michal Trojnara, 1998-2020", -1,      30, 12, 106,  8
 *   Copyright (C) 1998-2020 Michal Trojnara <Michal.Trojnara@stunnel.org>
NOEXPORT void cb_new_auth(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
        int idx, long argl, void *argp);
#if OPENSSL_VERSION_NUMBER>=0x30000000L
NOEXPORT int cb_dup_addr(CRYPTO_EX_DATA *to, const CRYPTO_EX_DATA *from,
    void **from_d, int idx, long argl, void *argp);
#elif OPENSSL_VERSION_NUMBER>=0x10100000L
        "session authenticated", cb_new_auth, NULL, NULL);
    dh->p=p;
    dh->q=q;
    dh->g=g;
        dh->length=BN_num_bits(q);
NOEXPORT void cb_new_auth(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
        int idx, long argl, void *argp) {
    (void)parent; /* squash the unused parameter warning */
    (void)ptr; /* squash the unused parameter warning */
    (void)argl; /* squash the unused parameter warning */
    s_log(LOG_DEBUG, "Initializing application specific data for %s",
        (char *)argp);
    if(!CRYPTO_set_ex_data(ad, idx, (void *)(-1)))
        sslerror("CRYPTO_set_ex_data");
}

#if OPENSSL_VERSION_NUMBER>=0x30000000L
NOEXPORT int cb_dup_addr(CRYPTO_EX_DATA *to, const CRYPTO_EX_DATA *from,
        void **from_d, int idx, long argl, void *argp) {
#elif OPENSSL_VERSION_NUMBER>=0x10100000L
 *   Copyright (C) 1998-2020 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *   Copyright (C) 1998-2020 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *   Copyright (C) 1998-2020 Michal Trojnara <Michal.Trojnara@stunnel.org>
NOEXPORT void unbind_ports(void);
NOEXPORT int bind_ports(void);
    options_defaults(); /* initialize defaults */
    options_apply(); /* apply the defaults */
    log_flush(LOG_MODE_BUFFER);
    if(cmdline_status) { /* cannot proceed */
        log_flush(LOG_MODE_ERROR);
    }
    options_free(1); /* free the defaults */
    options_apply(); /* apply the new options */
    if(bind_ports()) { /* initial binding failed - restoring the defaults */
        unbind_ports(); /* unbind the successfully bound ports */
        options_free(1); /* free the current options */
        options_defaults(); /* initialize defaults */
        options_apply(); /* apply the defaults */
        log_flush(LOG_MODE_ERROR);
    }
    if(change_root()) {
        log_flush(LOG_MODE_ERROR);
    }
    if(drop_privileges(1)) {
        log_flush(LOG_MODE_ERROR);
    }
    if(log_open(SINK_OUTFILE)) {
        log_flush(LOG_MODE_ERROR);
    }
    log_flush(LOG_MODE_BUFFER); /* no more logs */
NOEXPORT void unbind_ports(void) {
    for(opt=service_options.next; opt; opt=opt->next) {


        /* "accept" service */

        /* "exec+connect" service */
        s_log(LOG_DEBUG, "Service [%s] closed", opt->servname);
NOEXPORT int bind_ports(void) {
    static int delay=10; /* default of 10ms */
    options_free(1); /* free the current options */
    options_apply(); /* apply the new options */
    if(bind_ports() | exec_connect_start()) { /* failed */
        unbind_ports();
        if(delay > 10000) /* limit to 10s */
    } else { /* success */
        delay=10; /* reset back to 10ms */
 *   Copyright (C) 1998-2020 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *   Copyright (C) 1998-2020 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *   Copyright (C) 1998-2020 Michal Trojnara <Michal.Trojnara@stunnel.org>
 *   Copyright (C) 1998-2020 Michal Trojnara <Michal.Trojnara@stunnel.org>
        tip=str_tprintf(TEXT("stunnel is down"));
        tip=str_tprintf(TEXT("stunnel connections: %d"), num);
        tip=str_tprintf(TEXT("stunnel is idle"));
# vc.mak by Michal Trojnara 1998-2020
 *   Copyright (C) 1998-2020 Michal Trojnara <Michal.Trojnara@stunnel.org>
    if(verify_checks(c, preverify_ok, callback_ctx))
        return 1; /* accept */
    if(c->opt->option.client || c->opt->protocol)
        return 0; /* reject */
    if(c->opt->redirect_addr.names) {
            int ok=SSL_SESSION_set_ex_data(sess,
                index_session_authenticated, NULL);
 *   Copyright (C) 1998-2020 Michal Trojnara <Michal.Trojnara@stunnel.org>
#define VERSION_MINOR 57
# by Michal Trojnara 1998-2020
# by Michal Trojnara 1998-2020
MIIDwTCCAqmgAwIBAgIUPmqRLFuc5lfA6qFZBf0nrjXH75wwDQYJKoZIhvcNAQEL
QGV4YW1wbGUuY29tMB4XDTIwMDMxODExMDAzMloXDTI0MDMxODExMDAzMlowaDEL
bGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsb+qw97wPxX6
OyPB5ZDGHYp8O4mjzD1EyWksqIP9ZT5Poc8RDxgeVik7RDNlmoJIwyvr9EizqXba
Yejn47d81LGB+hrSWtYn37F+m1cSLxRwHnX59G8dfSGwnnmlBf0rCVlOU4FjJt0o
/a8A0m7/5gj3U5Ka4trt14N3p42TtsPKDcs1aYEXKwjFIt1Sl+8QhzwV5B5yI8Q1
SidnLoIvqMOrXmTKHyKd2zdUazvRtv1MiubQER6nzW+Uz/k3QbgikwpTyt08HMu/
4SLh1zQkhqnYHZyYe5zYTQwp3BazaiUYGl4C2KE5tzBTRwxJzNrmNVPdM4YU8LMp
3IN1lHj5pQIDAQABo2MwYTAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRUkV/P
8nw1yFzBAH4Mn2/usPVuNDAfBgNVHSMEGDAWgBRUkV/P8nw1yFzBAH4Mn2/usPVu
NDAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQADggEBAFtIe/LW7mWuJt5n
ryrcEFX3k+pudHif2m6nO+xKUskm7N3cba8YHymaa1T3l47hdiU3yjkGUfxbFb/i
KBm10jLKP3aP1X8bo3Jo6RTpF0P44p2go0jBHxW0JsM2CvjU4Xq+V7FrNOvaI1SO
9+tiJM1hPXt66uZgzVgdBWYLqQs+gmndHYYY2E5j56YF6mtqU/lKuHLjFUg3GpIn
BM7KImw1ccaqOD9cIRO7k8w8NhG1KffWl8FitJnsEESZqzfofl4pY26J8VA/9+IW
Yqo3ekLx5aXmwcaoh3OyE2zbS3mAPJ28RZn8QmI0ZSQKj9VFnFhYOiSDnJEo9lNP
0/Cufe0=
DAJDQTEdMBsGCSqGSIb3DQEJARYOQ0FAZXhhbXBsZS5jb20XDTIwMDMxODExMDAz
MloXDTI0MDMxODExMDAzMlowFTATAgIQABcNMjAwMzE4MTEwMDMyWqAjMCEwHwYD
VR0jBBgwFoAUVJFfz/J8NchcwQB+DJ9v7rD1bjQwDQYJKoZIhvcNAQELBQADggEB
AFcJw3Wx+CBkf139xkALFGy1o/6PkzS7V15QHyGirceefmHlNXAv00UQK6LNX4Gq
q0JbEpyQMF5vb1/m44FjhLiVVSzpPGoq4oprTTz9VATMKhJsyzSBWD/KfxEAJnRG
rmxS3Dw5VCLjvv8Jj4b2WHfdc7za1Z5AHzrDSNEO14AXWDvdjKkCf15ff0v2YGUw
LH7biPE+jPKv3m5VCVZMdHsAQkJYBIE+4FwJPlSWSORmBtJ+RNxNtayrGMo/bqg7
MzMwd4e9l0CZ/smRHss+i0/1ZwWyFI/t2hPTQextCb8DdwlANZWuecwJ0tTkKpAN
yp2NFPEyeTj6GBg0GfkWYXs=
# by Michal Trojnara 1998-2020
# by Michal Trojnara 1998-2020
MAkGA1UEAwwCQ0ExHTAbBgkqhkiG9w0BCQEWDkNBQGV4YW1wbGUuY29tMB4XDTIw
MDMxODExMDAzMloXDTI0MDMxODExMDAzMlowbzELMAkGA1UEBhMCUEwxGzAZBgNV
DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMpo0aujxBW1c1JsAR+6YYsNMkW8
NJ7kYWombnsiBqMEeeycPkYMLXzeBdLSbNjq8zIdxr5HVZ0ddEQG9ZJvr+msFtJj
GDRHw0ZwoIVD2OYDMU8sKv08ZXsbue2Swp4Gu4aNOsf8Gfccq1j3BnRyAgYSPtTg
rVlFylCHuIz1oRod3G/gp75WKqHINNEfsn6yB6ZpoAzDJEB5Aw7Orv5ABwuxV+xi
AUWQwEbhqql7IzTsi6z258tr/EAd2UXqILITZCB7Z1+z1RAHyTSUK3NJ3nm644tB
8u3PUVaIy/GFEVqumCaGzqVHkq947lxSQGOec+PGni9hUECG/thkQOHKmdkCAwEA
AaNNMEswCQYDVR0TBAIwADAdBgNVHQ4EFgQUA8FQZJTMevOXlt8x0hO8XaVmxMow
HwYDVR0jBBgwFoAUVJFfz/J8NchcwQB+DJ9v7rD1bjQwDQYJKoZIhvcNAQELBQAD
ggEBAH2lhd2k0WfD5aIBCodQ6NOMJLSBxe56AnO4/jfIMtmOyr2dwKD9uHQL9vaZ
yeZsUmthD2/KIDi9Tj8TCt3NhK9YQLGDKPVVDN/0n/5aMi+jDXkYBrAhXXILFr7k
Xj+L2cF2EDK7ZxsHPQZG/vwn+kF3Mx7e4eEFMyaTgzK1aJjpvRUaKyiTMuykc5km
1q1tTQ/xji1Vo/WXfRkAb3FBXRldz39TTiJYB9iRS3NC5xUCmB1y3I34yfTzqgAX
mx46/egYIkexiJ5CxP1HIp8RfuhItoMVfheS+IKoiuYEWb03htb6nNkVV10i+VfO
PfsR9VApCSLUIIf1uY4YCGqns98=
MAkGA1UEAwwCQ0ExHTAbBgkqhkiG9w0BCQEWDkNBQGV4YW1wbGUuY29tMB4XDTIw
MDMxODExMDAzM1oXDTI0MDMxODExMDAzM1owbzELMAkGA1UEBhMCUEwxGzAZBgNV
DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKtvgHJPXYNMvLa0e05TFnnc2RcL
2sWY4q66bEdS5igjwyErUJ3gerdHy99RhMAs2em09zEJ/2JnVh6bUffWOX30YPIE
4osSUvltHikkmzCVvYnY0t22pasKkAxTihrt64DW0HNRgooJ0heaHQt2H7VYRknz
HCYJB9GFaoPSLmfmongyViS7SLlZhqjDoHDuE09VCUgR37AASXiu96zev4iw/PRd
uiVoV5x6T4vw6Nu42tTQp8yeyQyxis+pU2V655c3t7GJ+xaHdpUe6dqkQ0OIpdjv
joLjS489XLaASwLDeK0sumWYxLdPWb5gatkU3TSEzwweivAGV7jsSIRaoSMCAwEA
AaNNMEswCQYDVR0TBAIwADAdBgNVHQ4EFgQU3uwiKh/lnsuMHMep/SY2nFA9isgw
HwYDVR0jBBgwFoAUVJFfz/J8NchcwQB+DJ9v7rD1bjQwDQYJKoZIhvcNAQELBQAD
ggEBAGsDlfdAWYLlhQUtzKSTNEVZDXeyoGem1TFdyVez9rOI875pXWmvu+TrzhyL
1dH3yTYSvSyl7/gr/NvsGQDADfPpL88+bfiwzOimFYmpc1DtEjItN+m+2jc/mgKP
VmYype8pDCmtvsN+W+LeCqeJvej2SGTsVCivqVGU2kNIU2eihqg9ydHTXLYYamOc
aGm6SQsYPuBqffrE74SlyNskrUQr3awu+aFfXSpY8Ce0QxejojxtbXd2LT/f9M4v
87lMdtDV2c+8EvSFbN8/71STPYKVmrui7EchbRi6AX85JSyvbBZKG0yn/OtggIPV
+nttEwFYshY5MRp9oOtLaMOz2T0=
MAkGA1UEAwwCQ0ExHTAbBgkqhkiG9w0BCQEWDkNBQGV4YW1wbGUuY29tMB4XDTIw
MDMxODExMDAzMloXDTI0MDMxODExMDAzMlowbzELMAkGA1UEBhMCUEwxGzAZBgNV
DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMpo0aujxBW1c1JsAR+6YYsNMkW8
NJ7kYWombnsiBqMEeeycPkYMLXzeBdLSbNjq8zIdxr5HVZ0ddEQG9ZJvr+msFtJj
GDRHw0ZwoIVD2OYDMU8sKv08ZXsbue2Swp4Gu4aNOsf8Gfccq1j3BnRyAgYSPtTg
rVlFylCHuIz1oRod3G/gp75WKqHINNEfsn6yB6ZpoAzDJEB5Aw7Orv5ABwuxV+xi
AUWQwEbhqql7IzTsi6z258tr/EAd2UXqILITZCB7Z1+z1RAHyTSUK3NJ3nm644tB
8u3PUVaIy/GFEVqumCaGzqVHkq947lxSQGOec+PGni9hUECG/thkQOHKmdkCAwEA
AaNNMEswCQYDVR0TBAIwADAdBgNVHQ4EFgQUA8FQZJTMevOXlt8x0hO8XaVmxMow
HwYDVR0jBBgwFoAUVJFfz/J8NchcwQB+DJ9v7rD1bjQwDQYJKoZIhvcNAQELBQAD
ggEBAH2lhd2k0WfD5aIBCodQ6NOMJLSBxe56AnO4/jfIMtmOyr2dwKD9uHQL9vaZ
yeZsUmthD2/KIDi9Tj8TCt3NhK9YQLGDKPVVDN/0n/5aMi+jDXkYBrAhXXILFr7k
Xj+L2cF2EDK7ZxsHPQZG/vwn+kF3Mx7e4eEFMyaTgzK1aJjpvRUaKyiTMuykc5km
1q1tTQ/xji1Vo/WXfRkAb3FBXRldz39TTiJYB9iRS3NC5xUCmB1y3I34yfTzqgAX
mx46/egYIkexiJ5CxP1HIp8RfuhItoMVfheS+IKoiuYEWb03htb6nNkVV10i+VfO
PfsR9VApCSLUIIf1uY4YCGqns98=
MIIEowIBAAKCAQEAymjRq6PEFbVzUmwBH7phiw0yRbw0nuRhaiZueyIGowR57Jw+
RgwtfN4F0tJs2OrzMh3GvkdVnR10RAb1km+v6awW0mMYNEfDRnCghUPY5gMxTywq
/Txlexu57ZLCnga7ho06x/wZ9xyrWPcGdHICBhI+1OCtWUXKUIe4jPWhGh3cb+Cn
vlYqocg00R+yfrIHpmmgDMMkQHkDDs6u/kAHC7FX7GIBRZDARuGqqXsjNOyLrPbn
y2v8QB3ZReogshNkIHtnX7PVEAfJNJQrc0neebrji0Hy7c9RVojL8YURWq6YJobO
pUeSr3juXFJAY55z48aeL2FQQIb+2GRA4cqZ2QIDAQABAoIBABZK6RzQUp5Zd7QS
NSV7b5bTA0Bu9BSz7o60YOKq4rQ9n/gRVUJ9wNzJzzZi+p4BcnuIkAUQ8jr1rYJ4
ib9xEZzY2UKeq2HGrZkqemNzD4Z1v46KvMlbR4oBib7CtTCWaTzufRTdjTaML8sC
mfFlRRfKFqV3gWAdsaSg7hCIVQ/9G5lnnqJo3hkN5AXn2eHBonqFVjmGOCp5qrM5
v8i20Y4zsB4sis/zSwd/+AFVgpa9llkR6LvxxKNCkShV1ralhhAiaQsT6ZQw3wD+
ZP+7eSkkdijUNFNh7t1rSFfY5jz4NF+OdnO8UhYXqIG3OcljXvJS+AmDFvhrhN5s
pQhMFCkCgYEA+ZQM28lU7uQ5aKc3WLlLjgWN7efc0NZqpLe5PakL80Sw6V5SqpVC
TVinOZKwWxd/I4Qv4cp1hOo9UXUwlNNEsarJ7R8A7jYqWQPfGzFdsvtNELrMMpmo
cBSy633/etsMtuZXNuDMVfw6x1dS4/alVpbhmSjiNlA/dIeJtKTDd3cCgYEAz54S
W+Fx27LrC01O24XcW9Sledz1BSZR/2YtPZsNRFSu6ugfVa2bcsK14lL2DdV+iMP4
rx1117KvyMI4DhZpPJR2NMF7DbgVpXdg77HEsvSeOZ9cYxDBb5LEAofDyzT+iu7L
k276kc5ZOlXxQ0sYvTIn05FGH9fuiytGq47GbS8CgYEAnJX001in/xIVqsFvCi2H
Z924RJF6i1RbqGjUwgjzxHdOf7x8JSZsaNa8ZHTSTPSbAg+HcyRxQykru5XJGzbK
HKZI9orDLLGzNBInwongfdEJcvuf7gdWFKwH7ZQp3Eze10oBYh78VN5hinwRN5Gh
/oe/lzZ9ZxJGHbiD/2B4etUCgYAdibO69rwoMbBXD0yk1sqfFgXk7Ja/gNAxsevF
1AVzL0kjiprKqcRv81vFM2BmX3V9J8R9xYc6hOWVfmxTNMUMJWMb5lsHfKU3wWA9
OeFuRHcuY4nVXlDm+s6APaiRhJyiT48PDr7/d4giUI/erxR59mTMKOL9LM93ZVTM
m6eHaQKBgFjw70dcwzyZvggR8ueEtecMqpvjV9kKEBdZGkS0UqKh7aGVgNyJw4uR
WFi+Mg94CeWh/i4714kmlZya+wgOk9E66WfGmiklrbu5UbBDfGqlZfNyAczLhaDh
Zw8QwLvCdoXVi1JLsZEDrC29aGRvNGRWQzizgSo3/uP8BeF76kc7
$OPENSSL pkcs12 -export -certpbe pbeWithSHA1And3-KeyTripleDES-CBC -in tmp/server_cert.pem -out tmp/server_cert.p12 -passout pass: 1>&2 2>> "maketestcert.log"
test1:TXBWl8XpwwQxJNtCZxrNkeSTvnmft3dgTW5hhE66r8SO49PQRD
test2:VnmD1uRfNUva0XCERkuOEtGBfB61HHbkKLK6JeqlXQL2dCi0fl
MAkGA1UEAwwCQ0ExHTAbBgkqhkiG9w0BCQEWDkNBQGV4YW1wbGUuY29tMB4XDTIw
MDMxODExMDAzMloXDTI0MDMxODExMDAzMlowcjELMAkGA1UEBhMCUEwxGzAZBgNV
ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANG9Rl0i1K27+tQDQUP3b7R4
LZVYl/Ps0PiLBMBGjWKed/8rnxnI4XpByxg/c11u+oeQZQ+CfFsPo5dsjAK+oicD
hoMVbl88rA0RJBqzcl+A/Qtkj8qs4euGf9PvY1gj9V5GOWiQaTcf7hE/r4gvFBJL
rb5gbhsxXFYI4LjhftPNi23VwSRri9mVpi3zJiilqUIi3zEg1fDuWr8tYLfCiY9h
wqwtiiRAf+m9VRRlUj/wUoNidQx5DU7kdptYyJt6aKj01VUUZZfzFztkPMJ0qs1x
FYikgrg15aaLojuaVgYyxn0ykimzQ1owjxcPSLE+IYUzeYOFZIUJu2WEdqVmNiEC
AwEAAaNNMEswCQYDVR0TBAIwADAdBgNVHQ4EFgQUYf+nYo0mL3WWh6eg1cWZKR8R
76IwHwYDVR0jBBgwFoAUVJFfz/J8NchcwQB+DJ9v7rD1bjQwDQYJKoZIhvcNAQEL
BQADggEBACEZxu6QwVIg529yheX1RRjlK78RO/YFHzOTdjaDUE3sQV6Oc8WtL8bV
OgPm+cEjE7aWpq+ZXNyXTxdR+mmBadsa4HXuGGyloOa/eh9b5tS2uh/4mL7KT/7G
LqCl1QEUCCfjzt58Phl4mYkGPnQ4Cc5V/sE3qBSOs+lq6lh1kWQCAZKTYr3DzpAS
xPyTwcwiWoyM6reSOIVv7RYNep6O3kzUkly9Fl0yVlHvmGotPkuyRVbMgMTBXijm
4wu0lMk3jw9yvwT7N+/JKvfLvM/N87BS36yALLJj0YtBNemd0pdhhK/hoELCe08y
I9s/elTEnsV/+zJo29Kxi3mJlKIv3DI=
MIIEowIBAAKCAQEA0b1GXSLUrbv61ANBQ/dvtHgtlViX8+zQ+IsEwEaNYp53/yuf
GcjhekHLGD9zXW76h5BlD4J8Ww+jl2yMAr6iJwOGgxVuXzysDREkGrNyX4D9C2SP
yqzh64Z/0+9jWCP1XkY5aJBpNx/uET+viC8UEkutvmBuGzFcVgjguOF+082LbdXB
JGuL2ZWmLfMmKKWpQiLfMSDV8O5avy1gt8KJj2HCrC2KJEB/6b1VFGVSP/BSg2J1
DHkNTuR2m1jIm3poqPTVVRRll/MXO2Q8wnSqzXEViKSCuDXlpouiO5pWBjLGfTKS
KbNDWjCPFw9IsT4hhTN5g4VkhQm7ZYR2pWY2IQIDAQABAoIBADuHdjYvEaAx73JH
bjnFO/5D8eQmnhJMj89LXdDY9X4dLj/NeL3Pxzd0/xjlwW+udQsPD7AEQBl0aeEr
nN2Wj9104bPI3GfJh6e5yr6NWhQDP08BftJumTzJEvTrSA4XPqhAVED6Y/KSbHaW
1dJYUmES+8BCDF5Jd0SwBmBTGDUy6SEU5tUtArJosU2HSe9HQMnGisW/KYS0tMiS
iFmfNTUppRPmYE/736xZpPlccyEAkSzLKMyabR+v+tT6PWWAgyUZDlmYopUkl/nK
WZqJPtWLqspGFlU1YbTQgSMYR8h2vuQ73CekK+D7jvT4jz+RpucAMM8qFQqLdiO2
+PUx5rUCgYEA7ZrkyCYspYd54OvmWhCh3AXsGEcg/O6IZ6farQS6tqQ5JXHg6KTw
wT4i4FdJkGZt5GjKGp6c47zVBPBdkhkwJMMGtKbANfTws8ObzlG3dtO4rysiT4Nr
DrGBZTT9B97YSiHKkXgFqu17ClJpTK6KiBZ4q8qg+nyk9oBbxTHuUtsCgYEA4foc
CYxxr5Ei48tdty4ynxosnNLhA/36MdTYSKai7pAQu4oaXdW9G6JgwiBU6C+yGgXI
BOIqXaWkqnQRL9LmRTJ9RHD2D3153GU9dsg7C0gzvI/XKZ+ROu0/VeaKqJQEN11r
RdvGEnTWODn7aA9LucseEBTCgARXKYMHhAusBbMCgYEAv5Yh23FMlrxCfiY4u26l
1K/By2GvK8N6oXorTU9+7j5FBfhpDa3Roz/jB1naq2CsQ3xrWkOC5e8hJLZb/K3q
r/nBsnCyk89JNuoG+7nQYTQeur/hDpQ9AsAGQgET9gCuDjhpChrpFwYeLBh/Z6Fl
eo4EByF/4/oVWd3uIXc9X/kCgYAnpye8VTStxh4FMu5i8mxXltQ1QJvTg4GftOWu
+e6lRgppnjY6OQNSEhBAgEPl6liqUFFk6frdK+/VKUDKz4swoUdx9xB2b2Iu1mUO
rtwNgsHxWJw85Y8qc+8lN6slIbQLswzb2VDMdEwS2bnP7L8w/v9revkWVayl0CRF
e3bYGQKBgGkxBG8CzWksYeN4nw28nhgIrtiWApcKFV4Zuu3W6DnAac+Ape49fhtb
Noc7ZPRX/xDC+NrSPOuKK0tImDSMykwZsE49ndE1fjdOE7QhwS8D8D1GswyId9yn
znbePtt67VJ8aLLW9HdAdvNHcwSBNzUsaxOo5JQt11dzELBd0uZd
test1:TXBWl8XpwwQxJNtCZxrNkeSTvnmft3dgTW5hhE66r8SO49PQRD
test2:6lIJPO8ROwRvcvvvjnveiGVpqdPD7IjlquWCJfqIf7BykTHYC5
MAkGA1UEAwwCQ0ExHTAbBgkqhkiG9w0BCQEWDkNBQGV4YW1wbGUuY29tMB4XDTIw
MDMxODExMDAzM1oXDTI0MDMxODExMDAzM1owbzELMAkGA1UEBhMCUEwxGzAZBgNV
DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKtvgHJPXYNMvLa0e05TFnnc2RcL
2sWY4q66bEdS5igjwyErUJ3gerdHy99RhMAs2em09zEJ/2JnVh6bUffWOX30YPIE
4osSUvltHikkmzCVvYnY0t22pasKkAxTihrt64DW0HNRgooJ0heaHQt2H7VYRknz
HCYJB9GFaoPSLmfmongyViS7SLlZhqjDoHDuE09VCUgR37AASXiu96zev4iw/PRd
uiVoV5x6T4vw6Nu42tTQp8yeyQyxis+pU2V655c3t7GJ+xaHdpUe6dqkQ0OIpdjv
joLjS489XLaASwLDeK0sumWYxLdPWb5gatkU3TSEzwweivAGV7jsSIRaoSMCAwEA
AaNNMEswCQYDVR0TBAIwADAdBgNVHQ4EFgQU3uwiKh/lnsuMHMep/SY2nFA9isgw
HwYDVR0jBBgwFoAUVJFfz/J8NchcwQB+DJ9v7rD1bjQwDQYJKoZIhvcNAQELBQAD
ggEBAGsDlfdAWYLlhQUtzKSTNEVZDXeyoGem1TFdyVez9rOI875pXWmvu+TrzhyL
1dH3yTYSvSyl7/gr/NvsGQDADfPpL88+bfiwzOimFYmpc1DtEjItN+m+2jc/mgKP
VmYype8pDCmtvsN+W+LeCqeJvej2SGTsVCivqVGU2kNIU2eihqg9ydHTXLYYamOc
aGm6SQsYPuBqffrE74SlyNskrUQr3awu+aFfXSpY8Ce0QxejojxtbXd2LT/f9M4v
87lMdtDV2c+8EvSFbN8/71STPYKVmrui7EchbRi6AX85JSyvbBZKG0yn/OtggIPV
+nttEwFYshY5MRp9oOtLaMOz2T0=
MIIEowIBAAKCAQEAq2+Ack9dg0y8trR7TlMWedzZFwvaxZjirrpsR1LmKCPDIStQ
neB6t0fL31GEwCzZ6bT3MQn/YmdWHptR99Y5ffRg8gTiixJS+W0eKSSbMJW9idjS
3balqwqQDFOKGu3rgNbQc1GCignSF5odC3YftVhGSfMcJgkH0YVqg9IuZ+aieDJW
JLtIuVmGqMOgcO4TT1UJSBHfsABJeK73rN6/iLD89F26JWhXnHpPi/Do27ja1NCn
zJ7JDLGKz6lTZXrnlze3sYn7Fod2lR7p2qRDQ4il2O+OguNLjz1ctoBLAsN4rSy6
ZZjEt09ZvmBq2RTdNITPDB6K8AZXuOxIhFqhIwIDAQABAoIBABwmNdgPMhKiIgZ6
AhktSW5/FeJT3vs9DFOWZrsbYJFMtfiXTShvOJcpoc8sanjHpIxcW45gzt9QinKC
HGZudYg5/UUgCja9roQoJ6Cn0xeaLsIYqR8go3k/RcHQYcfkMxw3qYiV5LJXxHh9
pLFCFxjGwtvXoFKafv8nQgMdGuOSVV4LuBKy9kz3xJhK35VOaFZvFfvpTG3BY7P1
xDBgcCNwqsy/quzVRcCjREkutfvn/Cd3rSknJBlfvuesBzaZGp/zCLWe7fyHH2kr
sZfuLUQmtkdbbhJHfdJDmCloI+fMWdB6MsHzxRU45LkEm3PnaSr3Txv8jKXY1NG1
lGwTOPkCgYEA1220tcuulELfolvT9BSC4AF9/vAgFBFz3yWL89Xs9bHYmwyVLQmZ
mmxPDNSgjrAvif+37N1plhtIPnR7/tO+8UNmDzhcjUeemD681+6P+gHLYMSnR714
kj33THQVP5lS/YmTKIOGoQRzPWZyNT8EZEFTZ/wa7u9ZXSkY3U0WxVUCgYEAy7jL
juyFRUutT8G7aRRoZtYMmstLKjSeILAGJ5eN1gW9O5gf6hcdxyh8BzUjH8yqBmhh
0hwLRpS7DngtnlmJHlccLN7pESMG8KYBIglkvOoA9wAFQDxmLXzq8G3Nnw05iUYw
jpKf8s+railRnW5p5Vmq0q4CT0WPG2DtUpP7TJcCgYArEI44bVAn6TplbW/wcg07
lHDIft4axOZh7FKO2uv0ram8TQahKzMekJo42WSDQasvLgRpgFV0IV4OxiBnb5LT
DgMf9cdioreMfbYogFMdyjAK1yUNjU3GBkcibG42+YKClnbpeWl3VLlow8r+4+sP
05NFzTrhGs3Fdsq2qotrxQKBgH4vvtaOppYfpABtDbquy2Q3XaNcHPjNkszIe2d2
toJFF8ucFNiY7Pb5mqmUPmdqDD7f1QeiG1HiumLiCc+1wfsrFeatREw7GAdjq/v7
OYzSnTphpt79CoVOhO/b86t7M5JWCammJLDv9UtSwJz1UV6gxfCtm/yiJ1xcE2Q9
CUGNAoGBALFpYMYoDkYy0HnJmkeKx0U4Xxw4LQOk9m6pKI4wjl8L0kziIi7NSdg1
SQ9aup9Vvjo4RF06V84qamECruvI9hTzB8wNV8KByefQatU6FpxOniB13fYsViHo
HIDVNurvV/adURfbJUo0iwNmjTSe+fxAhRdrvCeG4RpnM5KY25IW
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQConNPaL8zDOcvB
S34MgmVCJng7EL3Z1Gj0wE6Nt+EVhLYnGJtRM8/5GibPijwaQ6i1zzwNZt50YGs/
NKISJH+3t+mLJt2Wt3AqQYsFKIZavpY9u0V8A8ITh4XVq4Ym+XJWFKkj4L3frFph
J5wdfO1dvts9dYATUq8ned/IKC4lfwV1eRnX3U5IwnXH/hursX6zn+1Lqshjqfo8
P4MnLAOA2ktc7dx4i2UTydeA1TKp8NAY19SlHDfMtAI2+7mZsu/tHqm++1Pa7U36
fsfe1kY/5CoSPMzCuC7V9rmBpFtTzCLo0u5LfL5CU56TuEpKh3Lvn5yQVpKQqpoY
SGxxwH3NAgMBAAECggEANDedREzZVPxpJYuDlcwsH7haM7CTmwo1FtcXfLwdcNSQ
tLriHtu05Kg8rLlas6eQb/2l02CwM8pIbGKYbpXvF65VHUsEBND6Y5u4ufg6449y
Z9u/QRDI4dNulyVvflJyHkZ3uyy2oLZ3pu7lYhx2Rjn9G6Nv7owEwmzz6MDIycNz
5NlWjHLeMbOdCK3hZ9TH3B8D4n3Lrk1xjJwZ7HMjw3Nf01/zNjYcbJK8MMAZGLER
zA5/L0AqE79GzQPGC3PJDlXczAhlRnlkR2Y9Qr2RxrbH1xdRGtoq9bCqkQq07pWc
rlhF9SoI0Iv3AYkhChKCxNfr3TN4HglRHjygNlSj4QKBgQDWmynvP73YZyaEiBGe
E1RcIKURX3+XGiE2mjrXRugC3nKcZKbRRy0+YiPhjuwQLv0lQC6+zKHwoFWQsbzc
cqEaGjLHUC5AHdRDtDDh8glBUAWcKzS1Yjdg+TBrwKwBUhOSh6yhOtxO6KG3Rsqp
wHL2dNux4LZsyvVH0P/fzCKCnwKBgQDJIpfgjoTWl9LZ/K7pSpZ0MjmFoN8H9vp8
3xirXVNwQT4rZ0cPwb+X+mmb5G+er7LanIQ2qy3GKlVuPMMdIxx5d7cr+EVxMUIT
CyQqOfVtBL//cv/qWGOrdH4NJuuP3+KZ0JbB8nSqwHVdfl7pqAEm6z4BOXjtwAoX
9ceCawe0EwKBgQCBCOis5umSLWtWcq4NGtg1UJePm5kO1HI174QDnqmv1+qXqFk5
Kg/FG6MxYwsDLA2fkTjKFiYklXL9PjEtZ2sAU9JGTyqP+J+BWd2ubSYtdBz7amsV
yIk9sHbxwvZpEN2d1B/zDX4bn/pkRZdje8hj8Z2LFW76eQoD9WF0QbxaRwKBgE/l
ZvEzi772hjJDNnPDRiqX/NOBCLdQO0Y5FMKVitxvfjOdjdPLgcDsHuFnB5PAdUpz
m+1faApsrIzipBrB5MC3dlKIB4WkLHwGE/KWHVCV73KYiuHbBJSJ7Lxqtm3rYEb7
XbdjCUb+tmBSH3+vVe3QykuQOeIvQ5Mq9Xpv65pzAoGALLf2ytpoeIzOQsMM2qu9
te0KqWVK/8hVkEfvjhx1H2EDvp/JZmssvwaOp+A2olwxaM0k8ah7/gPk2bTXaDVw
atV5R3sRaEC9JyKLtZxePelKgSMSTN4HmFqyiYVO/RUnucGqwWK2TnwouBeHQz+/
UqnxOJnYGMWx6w/CocCF3rM=
MIIEQTCCAymgAwIBAgIUSuVEGMw9akLvPANKAEGd0/NK+vwwDQYJKoZIhvcNAQEL
SIb3DQEJARYTc3R1bm5lbEBleGFtcGxlLmNvbTAeFw0yMDAzMTgxMTAwMzJaFw0y
NDAzMTgxMTAwMzJaMIGnMQswCQYDVQQGEwJQTDEZMBcGA1UECAwQTWF6b3ZpYSBQ
SIb3DQEBAQUAA4IBDwAwggEKAoIBAQConNPaL8zDOcvBS34MgmVCJng7EL3Z1Gj0
wE6Nt+EVhLYnGJtRM8/5GibPijwaQ6i1zzwNZt50YGs/NKISJH+3t+mLJt2Wt3Aq
QYsFKIZavpY9u0V8A8ITh4XVq4Ym+XJWFKkj4L3frFphJ5wdfO1dvts9dYATUq8n
ed/IKC4lfwV1eRnX3U5IwnXH/hursX6zn+1Lqshjqfo8P4MnLAOA2ktc7dx4i2UT
ydeA1TKp8NAY19SlHDfMtAI2+7mZsu/tHqm++1Pa7U36fsfe1kY/5CoSPMzCuC7V
9rmBpFtTzCLo0u5LfL5CU56TuEpKh3Lvn5yQVpKQqpoYSGxxwH3NAgMBAAGjYzBh
MA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFAeAZjHLK/Czco/lFBFa+pVYAehb
MB8GA1UdIwQYMBaAFAeAZjHLK/Czco/lFBFa+pVYAehbMA4GA1UdDwEB/wQEAwIB
hjANBgkqhkiG9w0BAQsFAAOCAQEAk5r97IvjEnOD7nKB2DXbbfJ2hmMWoQPjbB+Z
FIwbMyQeTM9r8jmk4wY3F+EclFiG9thbsAKM3P42rYJ54rrkFzHODC+DX7HvmOk1
ddSdDMCZ0837N0V8pW8khxh+ZasXHYj0EytvmqKMtrF6ZVlZKcRrY9GesnYVMKi5
nJbpMSicuFigH2KCO/sUyFguw+9B5E7V3A8A/pimEfjpD0+wuJLHMi0hwTb1wOB4
l5ojyyQQHOcBUv/C9R3zd0jvMoTFYo5N1yRToRwUNNvnPkMCK/OjOnV13WZjL48V
TeHYj4vRlioa8vpNfkX/s9FSzwJv9bCXCrjReiTwQHX/2Wl18A==
  if [ -f /mnt/c/Windows/System32/netstat.exe ] && ! /mnt/c/Windows/System32/netstat.exe -a -n 2>&1 | grep -q -e "usage" -e "invalid" -e "illegal" -e "command not found"
    then
      mynetstat="/mnt/c/Windows/System32/netstat.exe"
  elif [ -n "$(command -v netstat)" ] && ! netstat -a -n 2>&1 | grep -q -e "usage" -e "invalid" -e "illegal" -e "command not found"
  elif [ -n "$(command -v ss)" ] && ! ss -a -n -l 2>&1 | grep -q -e "usage" -e "invalid" -e "illegal" -e "command not found"
    then
      mynetstat="ss"
  elif [ -n "$(command -v lsof)" ] && ! lsof -i -n -P 2>&1 | grep -q -e "usage" -e "invalid" -e "illegal" -e "command not found"
    then
      mynetstat="lsof"
  else # netstat / ss / lsof is required
    printf "%s\n" "netstat / ss / lsof not found in \$PATH or some option error"
    result=1
  fi
    if [ -n "$(command -v fips-mode-setup)" ]
      then
        printf "\n" >> "results.log"
        fips-mode-setup --check 1>> "results.log"
      fi
if (grep -q "FIPS" results.log && grep -q "\-fips" results.log) || grep -q "FIPS mode is enabled" results.log
#!/bin/sh

# Redirect TLS client connections on certificate-based authentication failures.
# [client_1] -> [server_1] -> [client_2] -> [server_2]
# The success is expected because the client presents the *wrong* certificate
# and the client connection is redirected.
# Checking if the verifyChain option verifies the peer certificate starting from the root CA.

. $(dirname $0)/../test_library

start() {
  ../../src/stunnel -fd 0 <<EOT
  debug = debug
  syslog = no
  pid = ${result_path}/stunnel.pid
  output = ${result_path}/stunnel.log

  [client_1]
  client = yes
  accept = 127.0.0.1:${http1}
  connect = 127.0.0.1:${https1}
  ;cert = ${script_path}/certs/client_cert.pem
;wrong self signed certificate
  cert = ${script_path}/certs/stunnel.pem

  [client_2]
  client = yes
  accept = 127.0.0.1:${http2}
  connect = 127.0.0.1:${https2}

  [server_1]
  accept = 127.0.0.1:${https1}
  exec = ${script_path}/execute
  execArgs = execute 028_redirect_chain_error
  redirect = ${http2}
  cert = ${script_path}/certs/server_cert.pem
  verifyChain = yes
  CAfile = ${script_path}/certs/CACert.pem

  [server_2]
  accept = 127.0.0.1:${https2}
  cert = ${script_path}/certs/server_cert.pem
  exec = ${script_path}/execute
  execArgs = execute 028_redirect_chain

EOT
}

test_log_for "028_redirect_chain" "execute" "0" "$1" "$2" "$3" 2>> "stderr.log"
exit $?
#!/bin/sh

# Do not redirect TLS client connections on certificate-based authentication success.
# [client_1] -> [server_1]
# The success is expected because the client presents the *correct* certificate
# and the client connection isn't redirected.
# Checking if the verifyChain option verifies the peer certificate starting from the root CA.

. $(dirname $0)/../test_library

start() {
  ../../src/stunnel -fd 0 <<EOT
  debug = debug
  syslog = no
  pid = ${result_path}/stunnel.pid
  output = ${result_path}/stunnel.log

  [client_1]
  client = yes
  accept = 127.0.0.1:${http1}
  connect = 127.0.0.1:${https1}
;correct certificate
  cert = ${script_path}/certs/client_cert.pem

  [client_2]
  client = yes
  accept = 127.0.0.1:${http2}
  connect = 127.0.0.1:${https2}

  [server_1]
  accept = 127.0.0.1:${https1}
  exec = ${script_path}/execute
  execArgs = execute 029_no_redirect_chain
  redirect = ${http2}
  cert = ${script_path}/certs/server_cert.pem
  verifyChain = yes
  CAfile = ${script_path}/certs/CACert.pem

  [server_2]
  accept = 127.0.0.1:${https2}
  cert = ${script_path}/certs/server_cert.pem
  exec = ${script_path}/execute
  execArgs = execute 029_no_redirect_chain_error

EOT
}

test_log_for "029_no_redirect_chain" "execute" "0" "$1" "$2" "$3" 2>> "stderr.log"
exit $?
              cat "nodata" | $mybuffer $opt_buf $mynetcat -l -p "$http_nc" -s 127.0.0.1 -vvv > "temp.log" 2>> "stderr_nc.log" &
    "/mnt/c/Windows/System32/netstat.exe") opt_net="-a -n";;
# by Michal Trojnara 1998-2020
# by Michal Trojnara 1998-2020
# by Michal Trojnara 1998-2020
ï»¿; Sample stunnel configuration file for Unix by Michal Trojnara 1998-2020
Copyright (C) 1998-2020 Michal Trojnara
# NSIS stunnel installer by Michal Trojnara 1998-2020
  Delete "$INSTDIR\bin\libssp-0.dll"
  !if /FileExists "/usr/lib/gcc/x86_64-w64-mingw32/10-win32/libssp-0.dll"
  File "/usr/lib/gcc/x86_64-w64-mingw32/10-win32/libssp-0.dll"
  !else
  !if /FileExists "/usr/lib/gcc/x86_64-w64-mingw32/9.3-win32/libssp-0.dll"
  File "/usr/lib/gcc/x86_64-w64-mingw32/9.3-win32/libssp-0.dll"
  !else
  !endif
  !endif
After=syslog.target network-online.target
Version:        5.57