In the rc.d scripts, change assignments to rcvar to use the
literal name_enable wherever possible, and ${name}_enable
when it's not, to prepare for the demise of set_rcvar().

In cases where I had to hand-edit unusual instances also
modify formatting slightly to be more uniform (and in
some cases, correct). This includes adding some $FreeBSD$
tags, and most importantly moving rcvar= to right after
name= so it's clear that one is derived from the other.

- Add LDFLAGS to CONFIGURE_ENV and MAKE_ENV (as it was done with LDFLAGS)
- Fix all ports that add {CPP,LD}FLAGS to *_ENV to modify flags instead

PR:             157936
Submitted by:   myself
Exp-runs by:    pav
Approved by:    pav

Update to stunnel-4.43 which is not vulnerable to the security
problem described in the PR.

PR:             160218
Reported by:    Cory McIntire <loon@lolunix.org>

Update to stunnel-4.41 and fix the handling of CPPFLAGS.

Update to stunnel-4.35:
- drop the transparent proxying patch, integrated upstream
- while I'm here, fix the very first master site URL -
  the download page on stunnel.org just links to the sites now,
  and does not contain downloadable source

PR:             154631
Submitted by:   Tsurutani Naoki <turutani@scphys.kyoto-u.ac.jp>

Implement transparent proxying using the IP_BINDANY option if available in
a way a bit different (and a bit more generic) than the one in the PR.
While I'm here, declare the GPL-2+ license and remove the MD5 checksum.

PR:             153568
Submitted by:   Jason Helfman <jhelfman@experts-exchange.com>

Sync to new bsd.autotools.mk

Unbreak the build on FreeBSD 6.x and other versions that need
the port version of OpenSSL for elliptic curve cryptography.
While I'm here, update the list of master sites.

- Mark BROKEN on 6.X: does not compile

Reported by:    pointyhat

Update to stunnel-4.34.  In this version the DH parameters support was
made conditional only on OpenSSL support for it, not on GNU configure
parameters, so it will most probably be automatically enabled on
the currently supported FreeBSD versions.  If this leads to any problems,
I'll look into making it optional again.

Update to stunnel-4.33; hopefully, the stability problems are fixed now.

Begin the process of deprecating sysutils/rc_subr by
s#. %%RC_SUBR%%#. /etc/rc.subr#

Update to stunnel-4.29.  I'm holding off on the 4.30 update for
a couple of days until the chroot/SIGHUP/pid file problem discussed
on the stunnel-users mailing list is sorted out upstream.

PR:             142773
Reported by:    Tsurutani Naoki <turutani@scphys.kyoto-u.ac.jp>

Fix the build on FreeBSD 6.x (an older version of OpenSSL) by replacing
the official no_ticket.patch with an extended one ifdef'ing more options.
Replace the src/client.c patch with the official execargs.patch.
Bump PORTREVISION.

Update stunnel to 4.28, including a patch for older SSL versions.
Add two new configurable options to disable libwrap support (almost
as in the PR, but not quite) and enable Diffie-Hellman key exchange.

PR:             139147 (only the libwrap support, but missing -lwrap)
Submitted by:   Jim Riggs <ports@christianserving.org>

-Repocopy devel/libtool15 -> libtool22 and libltdl15 -> libltdl22.
-Update libtool and libltdl to 2.2.6a.
-Remove devel/libtool15 and devel/libltdl15.
-Fix ports build with libtool22/libltdl22.
-Bump ports that depend on libltdl22 due to shared library version change.
-Explain what to do update in the UPDATING.

It has been tested with GNOME2, XFCE4, KDE3, KDE4 and other many wm/desktop
and applications in the runtime.

With help:      marcus and kwm
Pointyhat-exp:  a few times by pav
Tested by:      pgollucci, "Romain Tartière" <romain@blogreen.org>, and
                a few MarcusCom CVS users. Also, I might have missed a few.
Repocopy by:    marcus
Approved by:    portmgr

Update to stunnel-4.27.

- Update to 4.26

PR:             130160
Submitted by:   "Beat Gätzi" <beat@chruetertee.ch>

- Remove conditional checks for FreeBSD 5.x and older

Update CONFIGURE_ARGS for how we pass CONFIGURE_TARGET to configure script.
Specifically, newer autoconf (> 2.13) has different semantic of the
configure target. In short, one should use --build=CONFIGURE_TARGET
instead of CONFIGURE_TARGET directly. Otherwise, you will get a warning
and the old semantic may be removed in later autoconf releases.

To workaround this issue, many ports hack the CONFIGURE_TARGET variable
so that it contains the ``--build='' prefix.

To solve this issue, under the fact that some ports still have
configure script generated by the old autoconf, we use runtime detection
in the do-configure target so that the proper argument can be used.

Changes to Mk/*:
 - Add runtime detection magic in bsd.port.mk

Update to stunnel-4.25.

Update to stunnel-4.24.

Update to the release version of stunnel-4.22.

Forced commit to note that files/stunnel.sh was repo-copied to
files/stunnel.in before the USE_RC_SUBR transition in my last commit.

Finish the USE_RC_SUBR transition after marcus repo-copied stunnel.sh
to stunnel.in.
No functional changes once the port has been installed, thus
no PORTREVISION bump.

Update the stunnel port to version 4.22b2 to fix inetd mode logging[1].

While I'm here, pick up various changes from PR's:
- convert the startup script to the new style[2], but do not yet enable
  USE_RC_SUBR; a repo-copy of stunnel.sh to stunnel.in should be done first
- use ETCDIR instead of PREFIX/etc/stunnel everywhere[3]
- wave a magic wand over the startup script generation process to mimic
  the changes that will be done by USE_RC_SUBR after the repo-copy

Prompted by:    Damian Wiest <dwiest@vailsys.com> and
                Luis Rodrigo Gallardo Cruz <rodrigo@nul-unu.com> on
                the stunnel-users mailing list [1]
PR:             119655 [2] - only the changes to the startup script
                116773 [3] - only the ETCDIR part
Submitted by:   Jason DiCioccio <jd@ods.org> [2],
                Alexander Logvinov <ports@logvinov.com> [3]

Add an official fix for the chroot mode resolving bug.

Approved by:    portmgr (pav)

Update to stunnel-4.21.

Remove always-false/true conditions based on OSVERSION 500000

Reserve a user and group ID for the stunnel daemon.
Loosely based on the PR, although I just used the next available UID/GID.

PR:             108784
Submitted by:   Alex Kozlov <spam@rm-rf.kiev.ua>

Use libtool port instead of included version to avoid objformat a.out botch

Update to stunnel 4.20.

Update to stunnel 4.19 and fix the NOPORTDOCS installation to really
skip over the installation of example files and scripts.  Of course,
stunnel.conf-sample is still installed into etc/stunnel/.

Fix the problem with unattended deinstallation by not even attempting
to remove the stunnel user and group at all - just kill the package
deinstall script.

PR:             104028
Reported by:    jan grant <jan.grant@bristol.ac.uk>,
                Stephen Hurd <shurd@sasktel.net> (in private mail a while ago),
                and, I think, many others

A trivial update to stunnel-4.18 - Windows-related changes only.

Update to stunnel 4.17.

PR:             103123
Submitted by:   vd

Update to stunnel 4.15, which has the major new feature of almost all
connection options being configurable per connection, not global anymore.

Conversion to a single libtool environment.

Approved by:    portmgr (kris)

Catch up with stunnel's tools/Makefile to make the port's "make cert"
target actually work again.
Follow the upstream author's idea of keeping all stunnel-related
configuration files into ${PREFIX}/etc/stunnel/ - now "make cert" also
installs the certificate there instead of ${PREFIX}/etc/.
Bump PORTREVISION and add a note to UPDATING for the certificate
location change.

PR:             91991
Reported by:    Jiri Pridal <jiri.pridal@firebrno.cz>

SHA256ify

Approved by: krion@

Mass-conversion to the USE_AUTOTOOLS New World Order.  The code present
in bsd.autotools.mk essentially makes this a no-op given that all the
old variables set a USE_AUTOTOOLS_COMPAT variable, which is parsed in
exactly the same way as USE_AUTOTOOLS itself.

Moreover, USE_AUTOTOOLS has already been extensively tested by the GNOME
team -- all GNOME 2.12.x ports use it.

Preliminary documentation can be found at:
        http://people.FreeBSD.org/~ade/autotools.txt

which is in the process of being SGMLized before introduction into the
Porters Handbook.

Light blue touch-paper.  Run.

Update to stunnel 4.14, which is mostly a bugfix release.
Besides what's in the PR, also revert the pidfile location change to
preserve POLA and hier(7).

PR:             88436
Submitted by:   Vasil Dimov <vd@datamax.bg>

Update to 4.13, which ought to fix the libc_r detection problem in
a short window of 5.x versions.

PR:             87839
Submitted by:   Vasil Dimov <vd@datamax.bg>

Update to stunnel 4.11, which is deemed a stable release.
Remove our local patches for ucontext/pthread/fork model choice, since
this is handled by a configure argument now.
Note that ucontext is not supported on FreeBSD versions less than 5.0.

PR:             83245 (mostly)
Submitted by:   Vasil Dimov <vd@datamax.bg>

OPTIONS'ify, but still leave WITH_STUNNEL_SSL_ENGINE out of it - it is
a bit too dangerous to leave out in the open.

Fix the stunnel ucontext-related problems using a patch from the author,
Michael Trojnara[1].
Also, add the build-time WITH_FORK, WITH_PTHREAD, and WITH_UCONTEXT knobs
to control the stunnel threading model used, based on Vasil Dimov's PR's
with some modifications [2].
While I'm here, add in a <sys/types.h> inclusion that seems to be needed
for <ucontext.h> at least on FreeBSD 6.0/sparc64.

Reported by:    many
Pointy hat to:  roam (myself) for both not noticing this and then letting
                it linger for a while
Obtained from:  Michael Trojnara's BSD patch from
                <53594c631989fde6ca0bdb3435b93dfe@mirt.net> [1]
PR:             81289, 82202 [2]
Submitted by:   Vasil Dimov

- Fix deinstall script when running in BATCH mode.

PR:             ports/67762
Submitted by:   Linus Sjoberg <lsjoberg@aland.net>
Approved by:    maintainer timeout (7 weeks)

Update to 4.10, fixing the execvp() and pid file issues while I'm here.

PR:             79114, 79120, 80143, 80405
Submitted by:   Florian Hars <hars@bik-gmbh.de>,
                Jim Hatfield <jim.hatfield@insignia.com>,
                Vasil Dimov <vd@datamax.bg>,
                Vsevolod Stakhov <vsevolod@highsecure.ru>

At Kris's request, back out the MACHINE_ARCH spelling correction until
after 5.4-RELEASE.

Assist getting more ports working on AMD64 by obeying the
Ports Collection documentation and use 'ARCH' rather than 'MACHINE_ARCH'.

Update stunnel to 4.07, which incorporates most of our fixes to 4.06
and also fixes a crash if a client connection is closed too early.

Approved by:    portmgr (krion)

Okay then, purge the last reference to MySQL in the startup script...

The last update for this year, I hope :)
Make stunnel use the rc_subr framework, allowing for much cleaner
startup and shutdown of multiple instances of stunnel.

Fix a getnameinfo() out-of-memory error caused by passing a 20-character
buffer to hold a numeric IPv4/v6 address.  Of course, IPv6 addresses may
be a bit longer than 20 characters :)

A-ha! moment during:    discussion with the stunnel author

Fix the build on FreeBSD versions around 5.2 when EAI_NODATA was
temporarily aliased to EAI_NONAME.
No PORTREVISION bump, since this is a no-op on earlier and later versions,
and it didn't build at all until now on the affected versions.

Reported by:    Bretislav Kubesa <bretislav.kubesa@centrum.cz>

Update to stunnel-4.06.  In addition to the PR:
- enable the new IPv6 functionality when WITH_IPV6 is defined;
- at last move over to libtool-1.5 and get rid of the .la file;
- update the WITH_STUNNEL_SSL_ENGINE message to also mention FreeBSD 6.x;
- remove the obsolete sock_ioctlsocket() definition from patch-aa;
- fix a couple of getnameinfo(3)-related buglets;
- fix a poll(2)-related buglet: it seems FreeBSD insists (correctly) that
  INFTIM passed to poll(2) should be -1, not just any negative value.

PR:             75519 (somewhat)
Submitted by:   Dan Langille <dan@langille.org>

Fix the bus error on startup in -CURRENT and 5.x-BETA.  It turns out
that the OpenSSL ENGINE code is, well, somewhat less than stellar,
especially in combo with malloc's 'j' option.  Even without it, though,
there are some problems that I don't have time to look into right now.

So, disable the OpenSSL ENGINE activation on FreeBSD 5.x, unless
the WITH_STUNNEL_SSL_ENGINE knob is turned on.  Also, while I'm here,
fix the CONFIGURE_TARGET so the GNU configure script does not complain
quite so loudly.  Bump PORTREVISION for the functionality change
(well, I guess you could say "not working" -> "working" is a functionality
change ;)

BROKEN -> IGNORE, since this is a runtime error and the port itself builds
just fine.

Suggested by:   kris

Use DOCSDIR.

Mark broken on -CURRENT until I figure out why stunnel doesn't like
-CURRENT's OpenSSL.

Reported by:    dougb

And hot on the heels of the distsite update, here's the promised update
to 4.05 :)

Fix the distsites; an update to stunnel-4.05 is coming shortly, but still,
do this in the meantime.

PR:             67200
Submitted by:   Roman Neuhauser <neuhauser@chello.cz>

SIZEify (maintainer timeout)

Brian Hatch updated his RSA blinding patch to only apply
the blinding when really needed.  However, the name of
the patch file was not changed, which may confuse FreeBSD
distfile mirrors.  So, host the patch file in my local
FreeBSD cluster space, changing the file's name.

Reported by:    Dan Langille <dan@langille.org>

Add Brian Hatch's patch to enable RSA blinding on older OpenSSL versions.

Note: this patch is not needed for the 4.8-RELEASE ports tree, since
FreeBSD 4.8 will ship with a fixed OpenSSL version.  However, this patch
SHOULD be applied by anyone running stunnel with a version of OpenSSL
older than 0.9.7a, as reported by the 'openssl version' command.

Submitted by:   Brian Hatch <bri@stunnel.org>

Remove pkg-comment files in my ports.

Update to stunnel-4.04.

Independently submitted by:     Dan Langille <dan@langille.org>

Update to 4.03.

'make cert' fix submitted by:   Krzysztof Stryjek <wtp@mud.pl>

drop dummy certificate from package

remove IS_INTERACTIVE again.
No response from maintainer since 30.09.2002

Apply a blessed +3 magic wand of autotools protection; a rogue run of
autoconf or automake over our local patches can ruin your whole day.
This rarely, if ever, affected the vpopmail ports, causing mysterious
failures at install time, but inevitably killed the stunnel build if
automake-1.5 happened to be installed.

Reported by:    Dan Langille <dan@langille.org> for stunnel,
                Sitchin Zech <mailsagan@yahoo.com> for vpopmail

Update to stunnel-4.00.

*** WARNING WARNING WARNING ***
The stunnel invocation has changed!  The program no longer accepts
command-line options, but is controlled by a config file instead.
Please refer to the stunnel(8) manual page for more information.

PR:             42249
Submitted by:   Dan Langille <dan@langille.org>, lioux

Take over maintainership; I use this a lot.

Maintainer relenquishing ports.

PR:             42829
Submitted by:   Martti Kuparinen <martti.kuparinen@iki.fi>
Approved by:    maintainer

Unbreak Package-Build, removed IS_INTERACTIVE

PORT UPDATE : security/stunnel 3.21c -> 3.22    

upgrade to 3.21c    

Update to 3.21b, fixing a Makefile bogon and a file descriptor leak.   Add a new
knob, PEM_DIR, to specify the path to install the certificate   generated during
the stunnel build, and later, the one generated using   the 'cert' target of the
port Makefile.    

Update to 3.21.   Change USE_AUTOCONF to GNU_CONFIGURE; there have been no
configure.in   patches for some time now.    

Update the checksum after the distfile was rerolled.   No changes in the
distfile.    

Update the stunnel package to the latest version.    

Update to 3.19.    

o Update to 3.18   	* MAX_CLIENTS is calculated based on FD_SETSIZE, now.   	*
Problems with closing SSL in transfer() fixed.   	* -I option to bind a static
local IP address added.   	* Debug output of info_callback redesigned.   o
Reorder MASTER_SITES    

Update to stunnel 3.17    

Update to 3.16.    

Update to version 3.15    

Use non-blocking I/O by default.    

Update to 3.14.    

upgrade to 3.13 and change master site    

upgrade and change maintainer email    

Update to 3.11 and mark as interactive (prompts for information while  
generating a certificate).    

Update to 3.10.    

Upgrade to stunnel 3.9 to fix security vulnerabilities.    

Convert category security to new layout.  

Update all ports using OpenSSL and RSA to work without rsaref since   it is no
longer required. Apologies to the various maintainers whom I   did not yet hear
back from, but the ports freeze is coming up in a few   hours and I will be
verifying all of these ports on a 4.1 machine   myself to catch any problems.   

Update to version 3.8.4.