- stunnel-users - stunnel.org

Re: [stunnel-users] stunnel 5.54 on x64-pc-mingw32-gnu platform
by Brent Kimberley 24 May '19

24 May '19

>> Stunnel v5.54 (local) halts during tunnel setup with stunnel v4.56 (remote) FYI. stunnel-5.55b1-win64-installer.exe does not halt during tunnel setup. Thanks! <Snip><Snip>[ ] Running on Windows 6.2[ ] No limit detected for the number of clients[.] stunnel 5.55 on x64-pc-mingw32-gnu platform[.] Compiled/running with OpenSSL 1.1.1b 26 Feb 2019[.] Reading configuration from file ...[.] UTF-8 byte order mark detected..[ ] Initializing service [..][ ] Ciphers: ..[ ] TLSv1.3 ...[ ] TLS options: ..[ ] Loading certificate from file: [ ] Certificate loaded from file: [ ] Loading private key from file: [ ] Private key loaded from file: [ ] Private key check succeeded[.] Configuration successful[ ] Binding service [ ] Listening file descriptor created [ ] Setting accept socket options [ ] Service bound to 2019.05.23 20:26:54 LOG6[cron]: Executing cron jobs2019.05.23 20:26:54 LOG6[cron]: Cron jobs completed in 0 seconds2019.05.23 20:27:09 LOG5[0]: Service accepted connection from 2019.05.23 20:27:09 LOG6[0]: s_connect: connecting 2019.05.23 20:27:09 LOG6[0]: CERT: 2019.05.23 20:27:09 LOG6[0]: CERT: 2019.05.23 20:27:09 LOG5[0]: Certificate accepted at 2019.05.23 20:27:09 LOG6[0]: Session id: 2019.05.23 20:27:09 LOG6[0]: TLS connected: new session negotiated2019.05.23 20:27:09 LOG6[0]: TLSv1.2 ciphersuite: 2019.05.23 20:27:16 LOG6[0]: Read socket closed 2019.05.23 20:27:16 LOG6[0]: SSL_shutdown successfully sent close_notify alert2019.05.23 20:27:16 LOG3[0]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing2019.05.23 20:27:16 LOG5[0]: Connection closed: </Snip> On Friday, May 17, 2019, 9:18:41 a.m. EDT, Brent Kimberley <brent_kimberley(a)rogers.com> wrote: Hi.Stunnel v5.54 (local) halts during tunnel setup with stunnel v4.56 (remote) whereas stunnel v5.53 (local) successfully establishes tunnels with stunnel v4.56 (remote). Debug 7 (local) doesn't detect any issues. Does remote 4.56 need to be upgraded? Does local 5.54 need to be patched? Best Regards,BK v5.54 x v4.56[local]s_connect: s_poll_wait <someip>:443: waiting 10 secondshalt...[remote]2019.05.17 08:47:34 LOG5[13009:140578290554624]: Service [httpsx] accepted connection from 2019.05.17 08:52:35 LOG6[13009:140578290554624]: init_ssl: s_poll_wait: TIMEOUTbusy exceeded: sending reset 2019.05.17 08:52:35 LOG5[13009:140578290554624]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket v5.53 x v4.56[local] 2019.05.17 08:57:18 LOG7[0]: s_connect: s_poll_wait <someip>:443: waiting 10 seconds2019.05.17 08:57:18 LOG5[0]: s_connect: connected <someip>:443...[remote]2019.05.17 09:11:10 LOG5[13009:140578290333440]: Service [httpsx] accepted connection from 2019.05.17 09:11:10 LOG5[13009:140578290333440]: Certificate accepted: depth=....

1 0

Re: [stunnel-users] Connection never completes
by Joe Fitzgerald 22 May '19

22 May '19

I am observing the same behavior Mario is seeing with STunnel 5.54 on Windows Server 2012 R2 running as a client. In my case I am upgrading the client side from STunnel 5.01. The client and server connected without difficulty when both were at STunnel 5.01. >From the STunnel v 5.54 client log: 2019.05.22 16:58:19 LOG7[main]: Found 1 ready file descriptor(s) 2019.05.22 16:58:19 LOG7[main]: FD=332 ifds=r-x ofds=--- 2019.05.22 16:58:19 LOG7[main]: FD=352 ifds=r-x ofds=--- 2019.05.22 16:58:19 LOG7[main]: Service [EchoClient] accepted (FD=440) from 127.0.0.1:62387 2019.05.22 16:58:19 LOG7[main]: Creating a new thread 2019.05.22 16:58:19 LOG7[main]: New thread created 2019.05.22 16:58:19 LOG7[0]: Service [EchoClient] started 2019.05.22 16:58:19 LOG7[0]: Setting local socket options (FD=440) 2019.05.22 16:58:19 LOG7[0]: Option TCP_NODELAY set on local socket 2019.05.22 16:58:19 LOG5[0]: Service [EchoClient] accepted connection from 127.0.0.1:62387 2019.05.22 16:58:19 LOG6[0]: s_connect: connecting 192.168.128.162:40007 2019.05.22 16:58:19 LOG7[0]: s_connect: s_poll_wait 192.168.128.162:40007: waiting 10 seconds >From the STunnel v 5.01 server log: 2019.05.22 16:58:19 LOG7[5072]: Service [EchoServer] accepted (FD=572) from 192.168.128.104:62388 2019.05.22 16:58:19 LOG7[5072]: Creating a new thread 2019.05.22 16:58:19 LOG7[5072]: New thread created 2019.05.22 16:58:19 LOG7[3724]: Service [EchoServer] started 2019.05.22 16:58:19 LOG5[3724]: Service [EchoServer] accepted connection from 192.168.128.104:62388 2019.05.22 16:58:19 LOG7[3724]: SSL state (accept): before/accept initialization

1 1

Connection never completes
by Mario Ricciardi 22 May '19

22 May '19

I have Stunnel on two computers, both Win10 version 5.54. One works flawlessly on my home network, but the second will not complete the connection to POP3 Office365 on the work network. It gets to s_connect and freezes: 2019.05.21 22:50:19 LOG7[main]: Found 1 ready file descriptor(s) 2019.05.21 22:50:19 LOG7[main]: FD=220 ifds=r-x ofds=--- 2019.05.21 22:50:19 LOG7[main]: Service [POP3 Incoming] accepted (FD=780) from 127.0.0.1:51378 2019.05.21 22:50:19 LOG7[main]: Creating a new thread 2019.05.21 22:50:19 LOG7[main]: New thread created 2019.05.21 22:50:19 LOG7[2]: Service [POP3 Incoming] started 2019.05.21 22:50:19 LOG7[2]: Setting local socket options (FD=780) 2019.05.21 22:50:19 LOG7[2]: Option TCP_NODELAY set on local socket 2019.05.21 22:50:19 LOG5[2]: Service [POP3 Incoming] accepted connection from 127.0.0.1:51378 2019.05.21 22:50:19 LOG6[2]: failover: priority, starting at entry #0 2019.05.21 22:50:19 LOG6[2]: s_connect: connecting 52.96.24.210:995 2019.05.21 22:50:19 LOG7[2]: s_connect: s_poll_wait 52.96.24.210:995: waiting 10 seconds The sessions stay active, but this is as far as they get. I start stunnel GUI and attempt to connect to the active port and the above behavior is what I get. Using OpenSSL I can connect just fine, so there doesn't appear to be a firewall issue: +OK The Microsoft Exchange POP3 service is ready. [WQBRAFgAUABSADAAMQBDAEEAMAAwA DgANgAuAEMAQQBOAFAAUgBEADAAMQAuAFAAUgBPAEQALgBPAFUAVABMAE8ATwBLAC4AQwBPAE0A] user LoadAccept(a)example.com +OK pass LAxxxxxx +OK User successfully logged on. list +OK 4 356828 1 70284 2 70415 3 108104 4 108025 The stunnel config is super simple: ; Debugging stuff (may be useful for troubleshooting) debug = 7 output = stunnel.log ; ************************************************************************** ; * Service definitions (at least one service has to be defined) * ; ************************************************************************** ;Microsoft Outlook [POP3 Incoming] client = yes accept = 127.0.0.1:110 connect = outlook.office365.com:995 verifyChain = yes CAfile = ca-certs.pem checkHost = outlook.office365.com OCSPaia = yes I won't bother showing the log for the working machine, but it has the same config. I'm really hoping there is simply something missing from the Windows install. A coworker has the same problem on their fresh company provided Win10 install. My functioning Win10 pc is my personal machine. Thanks, Mario --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus

1 0

hostapd & stunnel
by Johannes Eckhardt 20 May '19

20 May '19

Hi, I'm running stunnel 5.39 on a Raspberry Pi with Raspbian 9 (stretch). The Pi has two network interfaces (eth0, wlan0) and I'm running an access point with hostapd. What I want to do is to route all traffic from my wifi-clients (connected via wlan0) through stunnel/socks. working iptables configuration to access the internet from eth0/wlan0: iptables -A FORWARD -i eth0 -o wlan0 -m state --state \ RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT iptables -P OUTPUT ACCEPT iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE; if add the following lines (from stunnel.org) local traffic on eth0 goes to the stunnel-server but my wireless clients can't access the internet anymore. I tried several configurations, but without success... # stunnel socks iptables -t nat -A OUTPUT -p tcp -d TARGET-SERVER --dport 9080 -j ACCEPT iptables -t nat -A OUTPUT -o lo -j ACCEPT iptables -t nat -A OUTPUT -p tcp --dport 9050 -j ACCEPT iptables -t nat -A OUTPUT -p tcp -j REDIRECT --to-ports 9051 iptables -t nat -A PREROUTING -p tcp --dport 9050 -j ACCEPT iptables -t nat -A PREROUTING -p tcp -j REDIRECT --to-ports 9051 # /etc/stunnel/stunnel.conf [SOCKS Client Direct] client = yes PSKsecrets = secrets.txt accept = :::9050 connect = TARGET-SERVER:9080 [SOCKS Client Transparent IPv4] client = yes PSKsecrets = secrets.txt accept = 127.0.0.1:9051 connect = TARGET-SERVER:9080 protocol = socks Has anyone a solution for that? Best regards, Johannes

1 0

Version 5.54 'make check' fails test 042_inetd
by James Brown 20 May '19

20 May '19

Sorry, posted with incorrect subject. > On 20 May 2019, at 3:29 pm, James Brown <jlbrown(a)bordo.com.au <mailto:jlbrown@bordo.com.au>> wrote: > > Having problems installing version 5.54 on macOS X with this configure command: > > ./configure --with-ssl=/usr/local/Cellar/openssl(a)1.1/1.1.1b > > Configure runs OK, as does make. > > But ‘make check’ ends with: > > $ make check > Making check in src > make[1]: Nothing to be done for `check'. > Making check in doc > make[1]: Nothing to be done for `check'. > Making check in tools > make[1]: Nothing to be done for `check'. > Making check in tests > Making check in certs > /Library/Developer/CommandLineTools/usr/bin/make check-local > ./maketestcert.sh > keys & certificates successfully generated > ./maketestcert.sh finished > /Library/Developer/CommandLineTools/usr/bin/make check-local > ./make_test > Mon 20 May 2019 15:21:58 AEST > stunnel 5.54 on x86_64-apple-darwin18.5.0 platform > Compiled/running with OpenSSL 1.1.1b 26 Feb 2019 > Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI > > test 010_require_cert ok > test 011_verify_peer ok > test 012_verify_chain ok > test 013_CRL_file ok > test 014_PSK_secrets ok > test 015_p12_cert ok > test 020_IPv6 skipped > test 021_FIPS skipped > test 022_bind ok > test 030_simple_execute ok > test 031_redirect ok > test 032_no_redirect ok > test 033_redirect_exec ok > test 034_no_redirect_exec ok > test 035_SNI ok > test 036_no_SNI ok > test 037_failover_prio1 ok > test 038_failover_prio2 ok > test 039_failover_rr ok > test 040_reload ok > test 041_exec_connect ok > test 042_inetd failed > error logs logs/042_inetd.log > test 043_session_delay ok > test 044_session_nodelay ok > test 045_include ok > test 046_resume_PSK ok > test 047_resume_redirect ok > test 048_resume_noredirect ok > test 050_ticket_secrets ok > test 110_failure_require_cert ok > test 111_failure_verify_peer ok > test 112_failure_verify_chain ok > test 113_failure_CRL_file ok > test 114_failure_PSK_secrets ok > test 115_failure_wrong_config ok > summary: success 32, skip 2, fail 1 > ./make_test finished > make[3]: *** [check-local] Error 1 > make[2]: *** [check-am] Error 2 > make[1]: *** [check-recursive] Error 1 > make: *** [check-recursive] Error 1 > > How can I fix this 042_ inetd failure? > > Also, why did it skip the IPv6 test? > > Thanks, > > James. > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org <mailto:stunnel-users@stunnel.org> > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

2 2

5.54 fails - TLS directory not found
by James Brown 20 May '19

20 May '19

Having problems installing version 5.54 on macOS X with this configure command: ./configure --with-ssl=/usr/local/Cellar/openssl(a)1.1/1.1.1b Configure runs OK, as does make. But ‘make check’ ends with: $ make check Making check in src make[1]: Nothing to be done for `check'. Making check in doc make[1]: Nothing to be done for `check'. Making check in tools make[1]: Nothing to be done for `check'. Making check in tests Making check in certs /Library/Developer/CommandLineTools/usr/bin/make check-local ./maketestcert.sh keys & certificates successfully generated ./maketestcert.sh finished /Library/Developer/CommandLineTools/usr/bin/make check-local ./make_test Mon 20 May 2019 15:21:58 AEST stunnel 5.54 on x86_64-apple-darwin18.5.0 platform Compiled/running with OpenSSL 1.1.1b 26 Feb 2019 Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI test 010_require_cert ok test 011_verify_peer ok test 012_verify_chain ok test 013_CRL_file ok test 014_PSK_secrets ok test 015_p12_cert ok test 020_IPv6 skipped test 021_FIPS skipped test 022_bind ok test 030_simple_execute ok test 031_redirect ok test 032_no_redirect ok test 033_redirect_exec ok test 034_no_redirect_exec ok test 035_SNI ok test 036_no_SNI ok test 037_failover_prio1 ok test 038_failover_prio2 ok test 039_failover_rr ok test 040_reload ok test 041_exec_connect ok test 042_inetd failed error logs logs/042_inetd.log test 043_session_delay ok test 044_session_nodelay ok test 045_include ok test 046_resume_PSK ok test 047_resume_redirect ok test 048_resume_noredirect ok test 050_ticket_secrets ok test 110_failure_require_cert ok test 111_failure_verify_peer ok test 112_failure_verify_chain ok test 113_failure_CRL_file ok test 114_failure_PSK_secrets ok test 115_failure_wrong_config ok summary: success 32, skip 2, fail 1 ./make_test finished make[3]: *** [check-local] Error 1 make[2]: *** [check-am] Error 2 make[1]: *** [check-recursive] Error 1 make: *** [check-recursive] Error 1 How can I fix this 042_ inetd failure? Also, why did it skip the IPv6 test? Thanks, James.

1 0

stunnel 5.54 on x64-pc-mingw32-gnu platform vs 5.53
by Brent Kimberley 17 May '19

17 May '19

Hi.Stunnel v5.54 (local) halts during tunnel setup with stunnel v4.56 (remote) whereas stunnel v5.53 (local) successfully establishes tunnels with stunnel v4.56 (remote). Debug 7 (local) doesn't detect any issues. Does remote 4.56 need to be upgraded? Does local 5.54 need to be patched? Best Regards,BK v5.54 x v4.56[local]s_connect: s_poll_wait <someip>:443: waiting 10 secondshalt...[remote]2019.05.17 08:47:34 LOG5[13009:140578290554624]: Service [httpsx] accepted connection from 2019.05.17 08:52:35 LOG6[13009:140578290554624]: init_ssl: s_poll_wait: TIMEOUTbusy exceeded: sending reset 2019.05.17 08:52:35 LOG5[13009:140578290554624]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket v5.53 x v4.56[local] 2019.05.17 08:57:18 LOG7[0]: s_connect: s_poll_wait <someip>:443: waiting 10 seconds2019.05.17 08:57:18 LOG5[0]: s_connect: connected <someip>:443...[remote]2019.05.17 09:11:10 LOG5[13009:140578290333440]: Service [httpsx] accepted connection from 2019.05.17 09:11:10 LOG5[13009:140578290333440]: Certificate accepted: depth=....

1 0

Connection refused, then connects
by James Brown 17 May '19

17 May '19

Can anyone tell me why It tries ::1:25 first and fails before connecting to 127.0.0.1:25? 2019.05.17 13:48:34 LOG5[21]: Service [ssmtp465] accepted connection from ::ffff:192.168.1.76:49170 2019.05.17 13:48:34 LOG3[21]: s_connect: connect ::1:25: Connection refused (61) 2019.05.17 13:48:34 LOG5[21]: s_connect: connected 127.0.0.1:25 2019.05.17 13:48:34 LOG5[21]: Service [ssmtp465] connected remote server from 127.0.0.1:56701 /usr/local/etc/stunnel/stunnel.conf has: [ssmtp465] client = no accept = 465 connect = 25 options = NO_SSLv2 #transparent = source [ssmtp587] client = no accept = 587 connect = 127.0.0.1:25 options = NO_SSLv2 #transparent = source Not sure if this is relevant, but when I startup I get: 2019.05.17 12:45:27 LOG5[ui]: stunnel 5.53 on x86_64-apple-darwin18.5.0 platform 2019.05.17 12:45:27 LOG5[ui]: Compiled/running with OpenSSL 1.0.2r 26 Feb 2019 2019.05.17 12:45:27 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2019.05.17 12:45:27 LOG5[ui]: Reading configuration from file /usr/local/etc/stunnel/stunnel.conf 2019.05.17 12:45:27 LOG5[ui]: UTF-8 byte order mark detected 2019.05.17 12:45:27 LOG5[ui]: FIPS mode disabled 2019.05.17 12:45:27 LOG4[ui]: Insecure file permissions on /usr/local/etc/dovecot/mail.bordo.com.au.pem 2019.05.17 12:45:27 LOG4[ui]: Insecure file permissions on /usr/local/etc/dovecot/mail.bordo.com.au.pem 2019.05.17 12:45:27 LOG5[ui]: Configuration successful 2019.05.17 12:45:27 LOG5[ui]: Binding service [ssmtp465] to 0.0.0.0:465: Address already in use (48) 2019.05.17 12:45:27 LOG5[ui]: Binding service [ssmtp587] to 0.0.0.0:587: Address already in use (48) No idea what is already using those ports. Any suggestions? macOS 10.14.4 Thanks, James.

3 3

stunnel 5.54 released
by Michal Trojnara 15 May '19

15 May '19

Dear Users, I have released version 5.54 of stunnel. Version 5.54, 2019.05.15, urgency: LOW * New features - New "ticketKeySecret" and "ticketMacSecret" options to control confidentiality and integrity protection of the issued session tickets. These options allow for session resumption on other nodes in a cluster. - Added logging the list of active connections on SIGUSR2 or with Windows GUI. - Logging of the assigned bind address instead of the requested bind address. * Bugfixes - Service threads are terminated before OpenSSL cleanup to prevent occasional stunnel crashes at shutdown. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 5e8588a6c274b46b1d63e1b50f0725f4908dec736f6588eb48d1eb3d20c87902 stunnel-5.54.tar.gz ed8424731f7d6e0c9b11f4c7b597a072e558dae7979102d0b213759678079481 stunnel-5.54-win64-installer.exe 7659f605065e5155577a99abe1129dbc89523796196c8bf50d3fa9265ec34d93 stunnel-5.54-android.zip Best regards, Mike

1 0

Re: [stunnel-users] Stunnel 5.44 server side 'exec = pppd' runs second child 'pppd' process after reconnection. Bug?
by Eric Eberhard 15 May '19

15 May '19

Killing anything will change the PID. If the PID needs to be constant a zombie is bad news! Zombies stink! E -----Original Message----- From: Jochen Bern [mailto:Jochen.Bern@binect.de] Sent: Wednesday, May 15, 2019 1:42 AM To: stunnel-users(a)stunnel.org Cc: Florian Lohoff <f(a)zz.de>; Eric Eberhard <flash(a)vicsmba.com> Subject: Re: [stunnel-users] Stunnel 5.44 server side 'exec = pppd' runs second child 'pppd' process after reconnection. Bug? On 05/15/2019 12:22 AM, Florian Lohoff wrote: > On Tue, May 14, 2019 at 11:30:29AM -0700, Eric Eberhard wrote: >> That is not a bad idea. I'd wrap it in a C program so I could check >> if the pppd is alive and not a zombie. > > pppd is a pretty solid piece of software. Never seen it hang as a > zombie. A zombie process is *terminated* and, basically, just a remaining entry in the kernel's process table. It's not hanging around because of something its own code did wrong, but because its parent process fails to "reap" its child (first and foremost, collect its exit code from the kernel). Killing the parent cleans up zombies because the zombies get re-parented to the init / systemd process (PID 1), which then does the reaping. Regards, -- Jochen Bern Systemingenieur

1 0

Re: [stunnel-users] Stunnel 5.44 server side 'exec = pppd' runs second child 'pppd' process after reconnection. Bug?
by Jochen Bern 15 May '19

15 May '19

On 05/15/2019 12:22 AM, Florian Lohoff wrote: > On Tue, May 14, 2019 at 11:30:29AM -0700, Eric Eberhard wrote: >> That is not a bad idea. I'd wrap it in a C program so I could check >> if the pppd is alive and not a zombie. > > pppd is a pretty solid piece of software. Never seen it hang as a > zombie. A zombie process is *terminated* and, basically, just a remaining entry in the kernel's process table. It's not hanging around because of something its own code did wrong, but because its parent process fails to "reap" its child (first and foremost, collect its exit code from the kernel). Killing the parent cleans up zombies because the zombies get re-parented to the init / systemd process (PID 1), which then does the reaping. Regards, -- Jochen Bern Systemingenieur

1 0

Re: [stunnel-users] Possible to verify client certificate BUT ignore expiration-date?
by Eric Eberhard 14 May '19

14 May '19

Use openssl to make a private cert? E -----Original Message----- From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Christopher Schultz Sent: Monday, May 13, 2019 2:28 PM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Possible to verify client certificate BUT ignore expiration-date? All, Does anyone know if it is possible to perform all other verification of a client certificate EXCEPT allow the certificate to have expired? We have a vendor whose certificate has expired, and we want to allow their old certificate to work while they chase their tails trying to figure out the best way to re-issue a new cert for us. *eyeroll* Is it possible? Thanks, -chris

2 1

Re: [stunnel-users] Stunnel 5.44 server side 'exec = pppd' runs second child 'pppd' process after reconnection. Bug?
by Eric Eberhard 14 May '19

14 May '19

Yes. Use inetd (or equivalent). Making an independent server work is difficult due to the problems like you are having. Inetd is in many O/S included and essential, others available. It always works. Always. Yes, there is a tiny amount of overhead for making connections. On an ancient AIX IBM I manage 2-4 million XML documents exchanged per day with no problems, all with inetd. Try it – save yourself some misery. Or maybe it won’t help at all except to add information :) E From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Martin Got Sent: Monday, May 13, 2019 9:08 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Stunnel 5.44 server side 'exec = pppd' runs second child 'pppd' process after reconnection. Bug? I'm trying to make stunnel wrapped ppp connection to achieve bidirectional data transfer over stunnel like shown below. Stunnel client --connect--> Stunnel server pppd client --connect--> pppd server 10.0.1.2 <--data--> 10.0.1.1 OpenBSD 6.4amd64 with Stunnel 5.44 server works till stunnel retries 'exec = pppd' section once stunnel client is reconnected. Also 'exec = pppd' section retries after a short network related communication lag also. Previous 'pppd' child instance haven't killed by stunnel 5.44 before new instance started. So second 'pppd' process started and runs simultaneously with the first 'pppd' and link down. Restarting Stunnel server can clear child 'pppd' processes. So newly reestablished 'pppd' link between 10.0.1.1 <--> 10.0.1.2 endpoints works till next interconnection. Does stunnel server have an option to start only one instance in 'exec' section or what should be done to fix this? Any suggestions highly appreciated. # ps -axu | grep pppd user 43231 0.0 0.0 476 0:00.01 persist lock passive 10.0.1.1:10.0.1.2 local noauth (pppd) user 39187 0.0 0.0 468 0:00.01 persist lock passive 10.0.1.1:10.0.1.2 local noauth (pppd) # tail -n 10 /var/log/daemon pppd[39187] pppd 2.3.5 started by user, uid 0 pppd[43231] Using interface ppp1 pppd[43231] Connect: ppp0 <--> /dev/ttyp2 pppd[43231] Local IP address 10.0.1.1 pppd[43231] Remote IP address 10.0.1.2 pppd[39187] pppd 2.3.5 started by user, uid 0 pppd[39187] Using interface ppp0 pppd[39187] Connect: ppp0 <--> /dev/ttyp5 pppd[39187] Couldn't set interface address: Address 10.0.1.1 or destination 10.0.1.2 already exists Stunnel configurations for server and client: 1. Server's configuration ... foreground = yes debug = 7 socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;socket = l:SO_LINGER=1:60 ; Session cache sessionCacheSize = 100 sessionCacheTimeout = 600 stack = 65536 TIMEOUTbusy = 600 TIMEOUTconnect = 10 TIMEOUTidle = 43200 TIMEOUTclose = 5 [ppp] accept = LOCAL-IP:PORT exec = /usr/sbin/pppd execargs = lock 10.0.1.1:10.0.1.2 local debug noauth ;execargs = lock passive 10.0.1.1:10.0.1.2 local debug noauth pty = yes CAfile = ca.crt cert = server.crt key = server.key verifyChain = yes 2. Stunnel client's configuration ... foreground = yes debug = 7 socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Session cache sessionCacheSize = 1 sessionCacheTimeout = 600 failover = rr [ppp] client = yes retry = yes connect = REMOTE-IP:PORT exec = /usr/sbin/pppd execargs = defaultroute persist lock passive 10.0.1.2:10.0.1.1 local debug noauth name ppp-client pty = yes CAfile = ca.crt cert = client.crt key = client.key verifyChain = yes checkHost = REMOTE-HOSTNAME ;checkIP = 1.2.3.4

2 1

Re: [stunnel-users] Stunnel 5.44 server side 'exec = pppd' runs second child 'pppd' process after reconnection. Bug?
by Eric Eberhard 13 May '19

13 May '19

Sounds good. The inetd will handle the dropping of connections just fine ... but the below sounds like it would help even more. E -----Original Message----- From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Peter Pentchev Sent: Monday, May 13, 2019 2:16 PM To: Martin Got <martingot(a)protonmail.com> Cc: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Stunnel 5.44 server side 'exec = pppd' runs second child 'pppd' process after reconnection. Bug? On Mon, May 13, 2019 at 04:07:57PM +0000, Martin Got wrote: > I'm trying to make stunnel wrapped ppp connection to achieve bidirectional data transfer over stunnel like shown below. > > Stunnel client --connect--> Stunnel server > pppd client --connect--> pppd server > 10.0.1.2 <--data--> 10.0.1.1 > > OpenBSD 6.4amd64 with Stunnel 5.44 server works till stunnel retries 'exec = pppd' section once stunnel client is reconnected. Also 'exec = pppd' section retries after a short network related communication lag also. Previous 'pppd' child instance haven't killed by stunnel 5.44 before new instance started. > > So second 'pppd' process started and runs simultaneously with the first 'pppd' and link down. Restarting Stunnel server can clear child 'pppd' processes. So newly reestablished 'pppd' link between 10.0.1.1 <--> 10.0.1.2 endpoints works till next interconnection. > > Does stunnel server have an option to start only one instance in 'exec' section or what should be done to fix this? Unfortunately, stunnel was not designed for your use case; it was designed to allow many different clients to make use of different instances of the same server program, one instance per client. You might try to do something else: if you really only have a single PPP client and you can really guarantee that anything that connects to stunnel must reuse the same connection, you could write a separate program that listens on a TCP port or on a local Unix socket, waits for the first connection, starts an instance of pppd, and then, from that point on, sends all the traffic from this instance to all the connections that it has received, even if a new connection appears before the old one has been torn down. Then you can point stunnel to the local Unix socket of that service, and anything that connects to stunnel will establish a new connection to your service, but it will not matter, since your service will be written in such a way as to send all the traffic to all the connections. So the service should do something like: 1. Create a local Unix socket and start listening on it. 2. Wait for the first connection. 3. Start an instance of pppd (at most one instance shall be running at any point in time) 4. Keep waiting for new connections; accept any and treat them all in the same way. 5. If any data comes from a remote connection, send it to pppd. 6. If any data comes from pppd, send it to *all* the remote connections. 7. If any of the remote connections is closed, well, so be it, good riddance, another one will come along presently (or maybe another one has already come along and has started talking to pppd through this service). 8. If the pppd child process dies, close all the remote connections and go back to step 2. Then you shall only have a problem if there are two "real" connections from different places at the same time - but if I understand your setup correctly, this should not really happen, since it is only you (your laptop or something like that) that connects to the PPP server. If you want, I could try to whip up some simple implementation of such a pseudo-multiplexer. G'luck, Peter -- Peter Pentchev roam(a){ringlet.net,debian.org,FreeBSD.org} pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

1 0

Possible to verify client certificate BUT ignore expiration-date?
by Christopher Schultz 13 May '19

13 May '19

All, Does anyone know if it is possible to perform all other verification of a client certificate EXCEPT allow the certificate to have expired? We have a vendor whose certificate has expired, and we want to allow their old certificate to work while they chase their tails trying to figure out the best way to re-issue a new cert for us. *eyeroll* Is it possible? Thanks, -chris

1 0

Stunnel 5.44 server side 'exec = pppd' runs second child 'pppd' process after reconnection. Bug?
by Martin Got 13 May '19

13 May '19

I'm trying to make stunnel wrapped ppp connection to achieve bidirectional data transfer over stunnel like shown below. Stunnel client --connect--> Stunnel server pppd client --connect--> pppd server 10.0.1.2 <--data--> 10.0.1.1 OpenBSD 6.4amd64 with Stunnel 5.44 server works till stunnel retries 'exec = pppd' section once stunnel client is reconnected. Also 'exec = pppd' section retries after a short network related communication lag also. Previous 'pppd' child instance haven't killed by stunnel 5.44 before new instance started. So second 'pppd' process started and runs simultaneously with the first 'pppd' and link down. Restarting Stunnel server can clear child 'pppd' processes. So newly reestablished 'pppd' link between 10.0.1.1 <--> 10.0.1.2 endpoints works till next interconnection. Does stunnel server have an option to start only one instance in 'exec' section or what should be done to fix this? Any suggestions highly appreciated. # ps -axu | grep pppd user 43231 0.0 0.0 476 0:00.01 persist lock passive 10.0.1.1:10.0.1.2 local noauth (pppd) user 39187 0.0 0.0 468 0:00.01 persist lock passive 10.0.1.1:10.0.1.2 local noauth (pppd) # tail -n 10 /var/log/daemon pppd[39187] pppd 2.3.5 started by user, uid 0 pppd[43231] Using interface ppp1 pppd[43231] Connect: ppp0 <--> /dev/ttyp2 pppd[43231] Local IP address 10.0.1.1 pppd[43231] Remote IP address 10.0.1.2 pppd[39187] pppd 2.3.5 started by user, uid 0 pppd[39187] Using interface ppp0 pppd[39187] Connect: ppp0 <--> /dev/ttyp5 pppd[39187] Couldn't set interface address: Address 10.0.1.1 or destination 10.0.1.2 already exists Stunnel configurations for server and client: 1. Server's configuration ... foreground = yes debug = 7 socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;socket = l:SO_LINGER=1:60 ; Session cache sessionCacheSize = 100 sessionCacheTimeout = 600 stack = 65536 TIMEOUTbusy = 600 TIMEOUTconnect = 10 TIMEOUTidle = 43200 TIMEOUTclose = 5 [ppp] accept = LOCAL-IP:PORT exec = /usr/sbin/pppd execargs = lock 10.0.1.1:10.0.1.2 local debug noauth ;execargs = lock passive 10.0.1.1:10.0.1.2 local debug noauth pty = yes CAfile = ca.crt cert = server.crt key = server.key verifyChain = yes 2. Stunnel client's configuration ... foreground = yes debug = 7 socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Session cache sessionCacheSize = 1 sessionCacheTimeout = 600 failover = rr [ppp] client = yes retry = yes connect = REMOTE-IP:PORT exec = /usr/sbin/pppd execargs = defaultroute persist lock passive 10.0.1.2:10.0.1.1 local debug noauth name ppp-client pty = yes CAfile = ca.crt cert = client.crt key = client.key verifyChain = yes checkHost = REMOTE-HOSTNAME ;checkIP = 1.2.3.4

2 1

Stunnel for O365 Sending Some Reports but not Others
by David Schmidt 10 May '19

10 May '19

Hello, We needed to reconfigure Stunnel for the SAP Business Objects server that sent email reports from G Suite over to a configuration that sends from an O365 account. The problem is that some of the reports work fine after the reconfiguration, while others always fail and I can't find out why and nothing has changed other than the mail settings. Microsoft doesn't even see the failed reports hitting their servers but when I look at Stunnel it seems like the TLS connection is being established correctly and I can see the connection being established from our firewall logs. I've attached the current O365 config as well as the old GSuite conifg, as well as logs of the debug output I see when I run a report that succeeds versus a report that fails. Can anyone give me an idea as to why Stunnel seems to be working to send out some reports but not others? Thank you, David Schmidt | Administrateur TI / IT Administrator | MTYGroup.com<http://mtygroup.com/> T+1 514-336-8885 Ext 8236 | C+1 514-708-7299 | 8210, route Transcanadienne, St. Laurent, QC, H4S 1M5 [http://mtygroup.com/signature/gif/use_this_left.gif]<http://mtygroup.com> [http://mtygroup.com/signature/gif/use_this_right.gif] <http://mtygroup.com> AVERTISSEMENT CONCERNANT LA CONFIDENTIALIT? / WARNING CONCERNING CONFIDENTIALITY Ce message peut contenir des informations confidentielles, privil?gi?es, et seulement pour ses destinataires. Si vous avez re?u ce message par erreur, veuillez en informer imm?diatement l'exp?diteur par retour de courriel et supprimer cette communication de votre syst?me. This email message may contain information that is confidential, privileged, and for communication only to its intended recipient or recipients. If you have received this message in error, please immediately notify the sender and delete the original message without making a copy.

1 0

Problem with stunnel 5.51
by Carter Browne 08 May '19

08 May '19

I received the following error trying to connect to a Windows host using RDP. I use stunnel as a connection point with secure messages coming in and then forwarded as secure messages going the desired end point. Stunnel is running on all three systems, the originator, the relay, and the destination. I have been using stunnel in this role for many years. As an additional point, 5.51 did work properly in the same role for secure telnet. The part of the log showing the failure is below. Thanks, Carter Before 2019.05.03 15:44:02 LOG5[ui]: stunnel 5.50 on armv7l-unknown-linux-gnueabihf platform 2019.05.03 15:44:02 LOG5[ui]: Compiled with OpenSSL 1.1.1a 20 Nov 2018 2019.05.03 15:44:02 LOG5[ui]: Running with OpenSSL 1.1.1b 26 Feb 2019 2019.05.03 15:44:02 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI 2019.05.03 15:44:02 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf 2019.05.03 15:44:02 LOG5[ui]: UTF-8 byte order mark not detected 2019.05.03 15:44:02 LOG5[ui]: FIPS mode disabled 2019.05.03 15:44:52 LOG5[ui]: Configuration successful 2019.05.03 15:44:52 LOG5[ui]: Switched to chroot directory: /var/run/stunnel/ ... 2019.05.08 08:26:08 LOG5[980]: Service [c13alt-rdp] accepted connection from 192.168.179.22:63218 2019.05.08 08:26:09 LOG5[980]: Certificate accepted at depth=0: C=US, ST=Massachusetts, L=Winchester, O=CBCS, OU=MIS, CN=cbrowne-39, emailAddress=cbrowne(a)cbcs-usa.com 2019.05.08 08:26:09 LOG5[981]: Service [cbrowne-13-rdp] accepted connection from 127.0.0.1:49180 2019.05.08 08:26:09 LOG5[980]: s_connect: connected 127.0.1.127:3389 2019.05.08 08:26:09 LOG5[981]: s_connect: connected 10.251.129.118:8001 2019.05.08 08:26:09 LOG5[981]: Service [cbrowne-13-rdp] connected remote server from 10.251.129.84:44796 2019.05.08 08:26:09 LOG5[980]: Service [c13alt-rdp] connected remote server from 127.0.0.1:49180 2019.05.08 08:26:09 LOG5[981]: Certificate accepted at depth=0: C=US, ST=Massachusetts, L=Winchester, O=CBCS, OU=MIS, CN=cbrowne-13.cbcsnet.local, emailAddress=cbrowne(a)cbcs-usa.com 2019.05.08 08:26:23 LOG5[980]: Connection closed: 1615 byte(s) sent to TLS, 1061 byte(s) sent to socket 2019.05.08 08:26:23 LOG5[981]: Connection closed: 1061 byte(s) sent to TLS, 1615 byte(s) sent to socket 2019.05.08 08:26:23 LOG5[982]: Service [c13alt-rdp] accepted connection from 192.168.179.22:63243 2019.05.08 08:26:23 LOG5[983]: Service [cbrowne-13-rdp] accepted connection from 127.0.0.1:49184 2019.05.08 08:26:23 LOG5[982]: s_connect: connected 127.0.1.127:3389 2019.05.08 08:26:23 LOG5[982]: Service [c13alt-rdp] connected remote server from 127.0.0.1:49184 2019.05.08 08:26:23 LOG5[983]: s_connect: connected 10.251.129.118:8001 2019.05.08 08:26:23 LOG5[983]: Service [cbrowne-13-rdp] connected remote server from 10.251.129.84:44800 After 2019.05.08 12:50:18 LOG5[ui]: stunnel 5.51 on armv7l-unknown-linux-gnueabihf platform 2019.05.08 12:50:18 LOG5[ui]: Compiled/running with OpenSSL 1.1.1b 26 Feb 2019 2019.05.08 12:50:18 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI 2019.05.08 12:50:18 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf 2019.05.08 12:50:18 LOG5[ui]: UTF-8 byte order mark not detected 2019.05.08 12:50:18 LOG5[ui]: FIPS mode disabled 2019.05.08 12:50:42 LOG5[ui]: Configuration successful 2019.05.08 12:51:01 LOG5[2]: Service [c13alt-rdp] accepted connection from 192.168.179.22:64139 2019.05.08 12:51:02 LOG5[2]: Certificate accepted at depth=0: C=US, ST=Massachusetts, L=Winchester, O=CBCS, OU=MIS, CN=cbrowne-39, emailAddress=cbrowne(a)cbcs-usa.com 2019.05.08 12:51:02 LOG5[3]: Service [cbrowne-13-rdp] accepted connection from 127.0.0.1:49330 2019.05.08 12:51:02 LOG5[2]: s_connect: connected 127.0.1.127:3389 2019.05.08 12:51:02 LOG5[2]: Service [c13alt-rdp] connected remote server from 127.0.0.1:49330 2019.05.08 12:51:02 LOG5[3]: s_connect: connected 10.251.129.118:8001 2019.05.08 12:51:02 LOG5[3]: Service [cbrowne-13-rdp] connected remote server from 10.251.129.84:44946 2019.05.08 12:51:02 LOG5[3]: Certificate accepted at depth=0: C=US, ST=Massachusetts, L=Winchester, O=CBCS, OU=MIS, CN=cbrowne-13.cbcsnet.local, emailAddress=cbrowne(a)cbcs-usa.com 2019.05.08 12:51:15 LOG5[2]: Connection closed: 1615 byte(s) sent to TLS, 1061 byte(s) sent to socket 2019.05.08 12:51:15 LOG5[3]: Connection closed: 1061 byte(s) sent to TLS, 1615 byte(s) sent to socket 2019.05.08 12:51:15 LOG5[4]: Service [c13alt-rdp] accepted connection from 192.168.179.22:64141 2019.05.08 12:51:15 LOG5[5]: Service [cbrowne-13-rdp] accepted connection from 127.0.0.1:49334 2019.05.08 12:51:15 LOG5[4]: s_connect: connected 127.0.1.127:3389 2019.05.08 12:51:15 LOG5[4]: Service [c13alt-rdp] connected remote server from 127.0.0.1:49334 2019.05.08 12:51:15 LOG5[5]: s_connect: connected 10.251.129.118:8001 2019.05.08 12:51:15 LOG5[5]: Service [cbrowne-13-rdp] connected remote server from 10.251.129.84:44950 2019.05.08 12:51:18 LOG3[4]: transfer() loop executes not transferring any data 2019.05.08 12:51:18 LOG3[4]: please report the problem to Michal.Trojnara(a)stunnel.org 2019.05.08 12:51:18 LOG3[4]: stunnel 5.51 on armv7l-unknown-linux-gnueabihf platform 2019.05.08 12:51:18 LOG3[4]: Compiled/running with OpenSSL 1.1.1b 26 Feb 2019 2019.05.08 12:51:18 LOG3[4]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI 2019.05.08 12:51:18 LOG3[4]: protocol=TLSv1.2, SSL_pending=0 2019.05.08 12:51:18 LOG3[4]: sock_open_rd=Y, sock_open_wr=Y 2019.05.08 12:51:18 LOG3[4]: SSL_RECEIVED_SHUTDOWN=n, SSL_SENT_SHUTDOWN=n 2019.05.08 12:51:18 LOG3[4]: sock_can_rd=n, sock_can_wr=n 2019.05.08 12:51:18 LOG3[4]: ssl_can_rd=n, ssl_can_wr=n 2019.05.08 12:51:18 LOG3[4]: read_wants_read=Y, read_wants_write=n 2019.05.08 12:51:18 LOG3[4]: write_wants_read=n, write_wants_write=n 2019.05.08 12:51:18 LOG3[4]: shutdown_wants_read=n, shutdown_wants_write=n 2019.05.08 12:51:18 LOG3[4]: socket input buffer: 0 byte(s), TLS input buffer: 0 byte(s) 2019.05.08 12:51:18 LOG5[4]: Connection reset: 2786 byte(s) sent to TLS, 5077 byte(s) sent to socket 2019.05.08 12:51:18 LOG5[5]: Connection closed: 5077 byte(s) sent to TLS, 2989 byte(s) sent to socket 2019.05.08 12:52:03 LOG5[6]: Service [c13alt-rdp] accepted connection from 192.168.179.22:64144 2019.05.08 12:52:03 LOG5[6]: s_connect: connected 127.0.1.127:3389 2019.05.08 12:52:03 LOG5[6]: Service [c13alt-rdp] connected remote server from 127.0.0.1:49340 2019.05.08 12:52:03 LOG5[7]: Service [cbrowne-13-rdp] accepted connection from 127.0.0.1:49340 2019.05.08 12:52:03 LOG5[7]: s_connect: connected 10.251.129.118:8001 2019.05.08 12:52:03 LOG5[7]: Service [cbrowne-13-rdp] connected remote server from 10.251.129.84:44956 2019.05.08 12:52:14 LOG5[6]: Connection closed: 1615 byte(s) sent to TLS, 1061 byte(s) sent to socket 2019.05.08 12:52:14 LOG5[7]: Connection closed: 1061 byte(s) sent to TLS, 1615 byte(s) sent to socket 2019.05.08 12:52:14 LOG5[8]: Service [c13alt-rdp] accepted connection from 192.168.179.22:64147 2019.05.08 12:52:14 LOG5[9]: Service [cbrowne-13-rdp] accepted connection from 127.0.0.1:49344 2019.05.08 12:52:14 LOG5[9]: s_connect: connected 10.251.129.118:8001 2019.05.08 12:52:14 LOG5[9]: Service [cbrowne-13-rdp] connected remote server from 10.251.129.84:44960 2019.05.08 12:52:14 LOG5[8]: s_connect: connected 127.0.1.127:3389 2019.05.08 12:52:14 LOG5[8]: Service [c13alt-rdp] connected remote server from 127.0.0.1:49344 2019.05.08 12:52:16 LOG3[8]: transfer() loop executes not transferring any data 2019.05.08 12:52:16 LOG3[8]: please report the problem to Michal.Trojnara(a)stunnel.org

2 2

Automatic stunnel-client reconnect and keep initial session
by Martin Got 01 May '19

01 May '19

Which commands to stunnel can perform keeping session ID in case of stunnel-client reconnection? Do I add commands to both stunnel-client and stunnel-server to keep the initial session?

1 0

Keep initial session-ID when stunnel-client reconnect to a stunnel-server
by Martin Got 01 May '19

01 May '19

Trying to establish link using pppd connection overlapped into stunnel 5.44. Server runs on OpenBSD 6.4, client uses the same stunnel and OS versions. From the client's side I have to reconnect to stunnel-server in case of Internet link is dropped. And expecting that pppd session is kept by stunnel over reconnections possible. But stunnel-server runs another pppd instance when stunnel-client reconnects. After reconnection in system processes I see two pppd processes (as shows below), and pppd link has no pings after it. # ps -aux | grep pppd user 45359 0.0 0.0 440 1672 ?? I Tue11PM 0:00.01 lock passive 10.0.1.1:10.0.1.2 local debug noauth (pppd) user 1156 0.0 0.0 321 1210 ?? I Tue12PM 0:00.01 lock passive 10.0.1.1:10.0.1.2 local debug noauth (pppd) 1. The question is how to keep initial session established by stunnel-client and do not run second pppd process by stunnel-server? 2. May I keep session by cache-ID on the client's side only or do I need to do it on both client and server? Can it help not to run another pppd process? Both server config and client config parts are below: # cat /etc/stunnel/stunnel-server.conf ... [ppp] ;SERVER accept 1.2.3.4:443 exec = /usr/sbin/pppd execargs = lock passive 10.0.1.1:10.0.1.2 local debug noauth pty = yes CAfile = ca.crt cert = server.crt key = server.key verifyChain = yes TIMEOUTclose = 0 ... # cat /etc/stunnel/stunnel-client.conf ... [ppp] ;CLIENT client = yes retry = yes connect = 1.2.3.4:443 exec = /usr/sbin/pppd execargs = persist lock 10.0.1.2:10.0.1.1 local debug noauth name ppp-client pty = yes CAfile = ca.crt cert = client.crt key = client.key verifyChain = yes checkHost = hostname ;checkIP = 1.2.3.4 ... Thank you for answer in advance.

1 0

Re: [stunnel-users] illegal instruction crash 5.50 Debian/Stretch
by Michal Trojnara 29 Apr '19

29 Apr '19

On 24.04.2019 16:06, Florian Lohoff wrote: > with the stunnel4 in Debian/Stretch i am experiencing pretty regular > crashes with illegal instruction. Version is 5.50. > In Bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=880659 > you can see the drill down to a Lock beeing unlocked although > not locked. When i look at the code its some usage of openssl > primitives. (Unlock happens in openssl code) > I had a quick look at the changelog and this: > "Service threads are terminated before OpenSSL cleanup to prevent occasional stunnel crashes at shutdown." > sounds a bit like the issue i am experiencing. > Can you confirm this? Yes, I do confirm this is the issue described in the Debian bug #880659. It wasn't a simple coding error, but rather a design flaw introduced in version 3.0 that took 20 years to identify and fix. Before version 5.18, released almost 4 years ago, the shutdown race condition mostly manifested itself while terminating stunnel under extremely heavy load, such as stress testing. The probability has increased with the introduction of periodic DH parameter regeneration in version 5.18. I didn't test it, but I suspect some changes in the OpenSSL internals may have also cause the crashes to only surface fairly recently, and not 20 years ago. The fix itself involves a major redesign of the stunnel threading subsystem, so I made a beta version and I'd appreciate your help with testing it: https://www.stunnel.org/downloads/beta/stunnel-5.54b2.tar.gz Best regards, Mike

2 1

Either "verifyChain" or "verifyPeer" has to be enabled
by kovacs janos 23 Apr '19

23 Apr '19

sorry to bother, again this is probably something simple, but i couldn't find anything about it. i'm trying to make stunnel NOT verify the certificate of the address it connects to. specifically because the certificate date will give an error, and i know its safe to connect there. whenever i put 'verify = 0' or 'verifyChain = no' or 'verifyPeer = no' in the configuration, i get an error saying 'Either "verifyChain" or "verifyPeer" has to be enabled', and so the configuration can't be applied. and i found nothing about this anywhere. or this could only be set on server Services? and there is no way to not verify if 'client = yes'?

1 0

Stunnel 5.44 client syntax to accept connections on pty?
by Martin Got 18 Apr '19

18 Apr '19

How to use 'stunnel' in client mode to accept connections on pty from local programs like 'ppp' instead of 'accept=IP:PORT'? 'pty = yes' seems work in server mode only, so when I removed 'accept = 127.0.0.1:1723' from 'stunnel' client config I'm getting the error: [!] Service [ppp]: Each service must define two endpoints on stunnel-5.44 I need to call 'stunnel' client from 'pppd' and communicate with 'stunnel' using pty if it was possible by using a command: pppd /dev/ptyp3 10.0.1.2: local debug noauth passive noccp novj novjccomp nopcomp noaccomp name ppp-client connect 'stunnel /etc/stunnel/stunnel-client.conf' Both 'pppd' and 'stunnel' started by executing the command above, but 'pppd' can't communicate to 'stunnel' server using pty. Please advice. [ppp] client = yes accept = [127.0.0.1:1723 ](http://127.0.0.1:1723) ^^^^^^^^^^^^^^^^^^^^^^^ connect = STUNNEL-SERVER-IP:723 CAfile = /etc/stunnel/ca.crt cert = /etc/stunnel/client.crt key = /etc/stunnel/client.key verifyChain = yes checkHost = hostna.me ;checkIP = 1.2.3.4

2 1

Sending original IP (proxy) for smtp
by James Brown 16 Apr '19

16 Apr '19

I’d like stunnel to pass the incoming IP along, not stunnel's IP. My traffic flow is: Stunnel (accept on port 465) -> ASSP (an smtp proxy) -> Postfix (accept on port 10026) I tried: [ssmtp] client = no accept = 465 connect = 25 protocol = proxy But ASSP had: Apr-15-19 18:50:22 [Worker_1] Connected: session:7FE104AA1870 127.0.0.1:58954 > 127.0.0.1:25 > 127.0.0.1:10026 Apr-15-19 18:50:23 [Worker_1] 127.0.0.1 warning: got reply '502 5.5.2 Error: command not recognized' from 127.0.0.1 Apr-15-19 18:50:23 id-18223-03317 [Worker_1] 127.0.0.1 info: sending EHLO instead of HELO to 127.0.0.1 Apr-15-19 18:50:23 id-18223-03317 [Worker_1] 127.0.0.1 disconnected: session:7FE104AA1870 127.0.0.1 - processing time 1 seconds And Postfix had: 2019-04-15 18:50:22.995042+1000 localhost smtpd[33360]: connect from localhost[127.0.0.1] 2019-04-15 18:50:23.108756+1000 localhost smtpd[33360]: improper command pipelining after EHLO from localhost[127.0.0.1]: RSET\r\n 2019-04-15 18:50:23.273664+1000 localhost smtpd[33360]: disconnect from localhost[127.0.0.1] ehlo=2 rset=1 quit=1 unknown=0/1 commands=4/5 So I take it protocol=proxy is not the way to do it. Sounds like this only works with haproxy which I do not have installed. Is there a way to do this? The problem I am trying to solve is ASSP has lines like: warning: SMTP authentication failed on 127.0.0.1 - obviously I don’t want fail2ban to ban 127.0.0.1. Stunnel log has: 2019.04.15 18:52:26 LOG5[23]: Service [ssmtp] accepted connection from ::ffff:185.222.209.66:53642 2019.04.15 18:52:27 LOG3[23]: s_connect: connect ::1:25: Connection refused (61) Any suggestions? Thanks, James.

2 3

Support for TLS 1.3 Early Data?
by hshh 13 Apr '19

13 Apr '19

Is it stunnel 5.54 support for TLS 1.3 Early Data? Stunnel 5.54, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384. I was tested by openssl s_client, return "Early data was not sent".

1 0