- stunnel-users - stunnel.org

behavior change after enabling proxy protocol
by Philippe Anctil 05 Jun '14

05 Jun '14

Hello, We use stunnel to secure a proprietary tcp/ip protocol over the internet. More specifially we have - 1 balancer - 2 stunnel boxes - 1 app server The load balancer 'pings' stunnel boxes regularly to know if one is down. Recently, we have added support for the proxy protocol in our app and turned it on in our stunnel config. It works great except for one small new behavior: upon receiving a load balancer ping, stunnel performs a connection on our app (and sends the proxy header). I ran a tcpdump for a telnet on the stunnel port (8000). With proxy protocol disabled, stunnel does nothing while it waits for the certificate. The connection ended at my request. 17:33:08.537385 IP 127.0.0.1.6015 > 127.0.0.1.8000: S 356922015:356922015(0) win 32792 <mss 16396,sackOK,timestamp 1085620573 0,nop,wscale 7> 17:33:08.537386 IP 127.0.0.1.8000 > 127.0.0.1.6015: S 1525966521:1525966521(0) ack 356922016 win 32768 <mss 16396,sackOK,timestamp 1085620573 1085620573,nop,wscale 7> 17:33:08.537393 IP 127.0.0.1.6015 > 127.0.0.1.8000: . ack 1 win 257 <nop,nop,timestamp 1085620573 1085620573> 17:33:19.750431 IP 127.0.0.1.6015 > 127.0.0.1.8000: F 1:1(0) ack 1 win 257 <nop,nop,timestamp 1085631785 1085620573> 17:33:19.751065 IP 127.0.0.1.8000 > 127.0.0.1.6015: . ack 2 win 256 <nop,nop,timestamp 1085631786 1085631785> 17:33:19.751794 IP 127.0.0.1.8000 > 127.0.0.1.6015: R 1:1(0) ack 2 win 256 <nop,nop,timestamp 1085631787 1085631785> With proxy protocol enabled, stunnel establishes a connection to my app and sends the proxy protocol before even receiving the certificate. 17:34:35.370462 IP 127.0.0.1.6026 > 127.0.0.1.8000: S 2949098861:2949098861(0) win 32792 <mss 16396,sackOK,timestamp 1085707402 0,nop,wscale 7> 17:34:35.370475 IP 127.0.0.1.8000 > 127.0.0.1.6026: S 1044893129:1044893129(0) ack 2949098862 win 32768 <mss 16396,sackOK,timestamp 1085707402 1085707402,nop,wscale 7> 17:34:35.370481 IP 127.0.0.1.6026 > 127.0.0.1.8000: . ack 1 win 257 <nop,nop,timestamp 1085707402 1085707402> 17:34:35.371035 IP 127.0.0.1.37654 > 127.0.0.1.9000: S 801705083:801705083(0) win 32792 <mss 16396,sackOK,timestamp 1085707402 0,nop,wscale 7> 17:34:35.371046 IP 127.0.0.1.9000 > 127.0.0.1.37654: S 4068822820:4068822820(0) ack 801705084 win 32768 <mss 16396,sackOK,timestamp 1085707402 1085707402,nop,wscale 7> 17:34:35.371052 IP 127.0.0.1.37654 > 127.0.0.1.9000: . ack 1 win 257 <nop,nop,timestamp 1085707402 1085707402> 17:34:35.371583 IP 127.0.0.1.37654 > 127.0.0.1.9000: P 1:44(43) ack 1 win 257 <nop,nop,timestamp 1085707403 1085707402> 17:34:35.371595 IP 127.0.0.1.9000 > 127.0.0.1.37654: . ack 44 win 256 <nop,nop,timestamp 1085707403 1085707403> 17:34:50.484991 IP 127.0.0.1.9000 > 127.0.0.1.37654: F 1:1(0) ack 44 win 256 <nop,nop,timestamp 1085722515 1085707403> 17:34:50.485892 IP 127.0.0.1.37654 > 127.0.0.1.9000: . ack 2 win 257 <nop,nop,timestamp 1085722516 1085722515> 17:35:08.824661 IP 127.0.0.1.6026 > 127.0.0.1.8000: F 1:1(0) ack 1 win 257 <nop,nop,timestamp 1085740854 1085707402> 17:35:08.824906 IP 127.0.0.1.8000 > 127.0.0.1.6026: . ack 2 win 256 <nop,nop,timestamp 1085740854 1085740854> 17:35:08.824972 IP 127.0.0.1.37654 > 127.0.0.1.9000: R 44:44(0) ack 2 win 257 <nop,nop,timestamp 1085740854 1085722515> 17:35:08.825013 IP 127.0.0.1.8000 > 127.0.0.1.6026: R 1:1(0) ack 2 win 256 <nop,nop,timestamp 1085740855 1085740854> Note I used 'tcpdump -i lo -nn port 8000 or port 9000' for both traces. I see no good reason to connect to the application before the ssl session is established. Thank you for reading! -- Philippe Anctil

2 2

log format
by Philippe Anctil 04 Jun '14

04 Jun '14

I have noticed stunnel 5.01 log format is different when I run it under my account vs when I run it on the system. I don't remember seeing this with stunnel 4.56 and older. Format under my account: 2014.06.02 11:38:50 LOG6[26855]: SSL accepted: new session negotiated Format on the system: Jun 4 16:27:14 hostname stunnel: LOG6[11100:0]: SSL accepted: new session negotiated When I run under my account I normally save output to a separate file with output=. I guess this is what is having an influence on the log format? Is there any way I can have logging format in my account consistent with what I have in syslog? Thanks. -- Philippe Anctil

1 0

Problem with pidfile
by reg14＠rambler.ru 30 May '14

30 May '14

I run stunnel (version 5.00) as a non-root user which does not have write permissions to /var/run. So I created file /var/run/stunnel.log with right access for that user -rw-r--r--. 1 stunnel stunnel 0 May 28 21:31 stunnel.pid When I start daemon, it writes to logfile the following 2014.05.28 22:18:44 LOG3[8878]: Cannot create pid file /var/run/stunnel.pid 2014.05.28 22:18:44 LOG3[8878]: create: File exists (17) It seems that it tries to create pidfile in /var/run, and ignores that the file is already exists. As a result, pid is not written to stunnel.pid, and daemon crashes. Could this be fixed?

3 7

Possible Mail Relay (port 465/tcp-SSL) after stunnel install
by Sven Schulte 28 May '14

28 May '14

Dear colleagues, after installing stunnel (v 5.01) an PCI Security Scan finished with finding that port 465 allows mail relaying. (CVE-1999-0512, CVE-2002-1278, CVE-2003-0285). Any comments/ideas how to comly? Thanks in advance! Sven

1 0

Strange performance problem, need help troubleshooting
by Paulo Azevedo 24 May '14

24 May '14

I have a strange performance problem with stunnel, could you help me? Here is my setup: PC1 & PC2 -- Switch (GbE) -- Switch (100mbps) -- Router -- modem -- Internet PC1 has stunnel and HFS installed, sharing a folder to the internet.My internet upload speed is 20Mbps. With this setup, I can serve files at 8Mbps over the internet, but if I disable stunnel the speed doubles to 16Mbps. However, with stunnel active, if I try the same with PC2, I get 82Mbps (using the internet IP, it goes all the way to the router), so this does not appear to be a performance problem on the hardware. Can you give me some hints on what is limiting my speed here?

2 1

[patch] Systemd socket activation support in daemon mode
by Mark Theunissen 14 May '14

14 May '14

Hi, This patch allows stunnel to be started in daemon mode by systemd's socket activation. This is superior to inetd mode, for all the reasons specified in the stunnel howto. Since systemd is now the default in most of the major Linux distros, it would be great to have this committed upstream. https://gist.github.com/marktheunissen/7ce9426e66aa8f0ec2e1 Example systemd unit files: ### stunnel.socket [Unit] Description=Stunnel socket After=network.target [Socket] ListenStream=9999 ### stunnel.service [Unit] Description=Stunnel service After=network.target [Service] Type=forking ExecStart=stunnel /etc/stunnel/stunnel.conf Thanks, Mark Theunissen

1 1

Re: [stunnel-users] certificate verify failed
by Aaron Haywood 05 May '14

05 May '14

The following is an excerpt from my log's slightly modified to hide company specific data: 2014.05.01 10:11:05 LOG7[5956]: Starting certificate verification: depth=2, subject=/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority 2014.05.01 10:11:05 LOG6[5956]: Certificate accepted: depth=2, subject=/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority 2014.05.01 10:11:05 LOG7[5956]: Starting certificate verification: depth=1, subject=/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=######## 2014.05.01 10:11:05 LOG6[5956]: Certificate accepted: depth=1, subject=/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=######## 2014.05.01 10:11:05 LOG7[5956]: Starting certificate verification: depth=0, subject=/O=*.somedomain.com/OU=Domain Control Validated/CN=*.somedomain.com 2014.05.01 10:11:05 LOG3[5956]: CERT: X509_STORE_get1_certs: Peer suddenly disconnected 2014.05.01 10:11:05 LOG4[5956]: Certificate check failed: depth=0, subject=/O=*.somedomain.com/OU=Domain Control Validated/CN=*.somedomain.com 2014.05.01 10:11:05 LOG7[5956]: SSL alert (write): fatal: certificate unknown Respectfully, Aaron Haywood | Systems Administrator [cid:image002.png@01CEDA11.E935A7F0] O: 858.614.1547 | M: 858.699.8302 | www.sdhealthconnect.org CONNECT WITH US: Facebook<https://www.facebook.com/SDHealthConnect?filter=1> | Twitter<https://twitter.com/SDHealthConnect> | LinkedIn<http://www.linkedin.com/company/san-diego-health-connect?trk=company_logo> | Google+<https://plus.google.com/u/0/b/112077458420951237937/112077458420951237937/p…> | YouTube<http://www.youtube.com/SDHealthConnect>

1 0

Re: [stunnel-users] certificate verify failed
by Aaron Haywood 05 May '14

05 May '14

Roman, I was wondering if you changed your verify from level 3 to level 2, and if this resolved your peer disconnection error with stunnel. We're experiencing a similar problem but was wondering if anyone out there has resolved this issue already; and if so..how? :) Respectfully, Aaron Haywood | Systems Administrator [cid:image002.png@01CEDA11.E935A7F0] O: 858.614.1547 | M: 858.699.8302 | www.sdhealthconnect.org CONNECT WITH US: Facebook<https://www.facebook.com/SDHealthConnect?filter=1> | Twitter<https://twitter.com/SDHealthConnect> | LinkedIn<http://www.linkedin.com/company/san-diego-health-connect?trk=company_logo> | Google+<https://plus.google.com/u/0/b/112077458420951237937/112077458420951237937/p…> | YouTube<http://www.youtube.com/SDHealthConnect>

1 0

New stunnel how-to
by Patrick J. 30 Apr '14

30 Apr '14

Hi all, I've spent some time to write a new stunnel how-to. - Install and configure stunnel on a Raspberry Pi - Run stunnel in a chroot jail - Limit allowed ciphers and force Forward Secrecy - Restrict access to the stunnel server (verify = 3) - Disguise SSH as HTTPS traffic http://stunnel.qnea.net/ Regards from Germany, Patrick

1 1

Error 126 compiling on Mac OS X 10.7.5
by James Brown 29 Apr '14

29 Apr '14

I’ve just tried to install version 5.01 and encountered an error. I had no problems installing 5.01b1 previously. I just thought I’d install the release version. System is running Mac OS X 10.7.5. make ends with a warning, and make install fails: ld: warning: directory not found for option '-L/usr//lib64' Making all in doc make[1]: Nothing to be done for `all'. Making all in tools make[1]: Nothing to be done for `all'. make[1]: Nothing to be done for `all-am'. mail:stunnel-5.01 2 jlbrown$ sudo make install Password: Making install in src ../auto/install-sh -c -d '/usr/local/bin' /bin/sh ../libtool --mode=install /usr/bin/install -c stunnel '/usr/local/bin' libtool: install: /usr/bin/install -c stunnel /usr/local/bin/stunnel ../auto/install-sh -c -d '/usr/local/bin' /usr/bin/install -c stunnel3 '/usr/local/bin' ../auto/install-sh -c -d '/usr/local/lib/stunnel' /bin/sh ../libtool --mode=install /usr/bin/install -c libstunnel.la '/usr/local/lib/stunnel' libtool: install: /usr/bin/install -c .libs/libstunnel.dylib /usr/local/lib/stunnel/libstunnel.dylib libtool: install: /usr/bin/install -c .libs/libstunnel.lai /usr/local/lib/stunnel/libstunnel.la /Users/jlbrown/Downloads/stunnel-5.01: /Users/jlbrown/Downloads/stunnel-5.01: is a directory make[2]: *** [install-pkglibLTLIBRARIES] Error 126 make[1]: *** [install-am] Error 2 make: *** [install-recursive] Error 1 I just used ./configure with no arguments. Any suggestions? Thanks, James.

1 0

Verify=2 and Verification Depth...
by Matt Wise 28 Apr '14

28 Apr '14

It was my understanding that when you have an Stunnel Server configured with 'verify=2', that the client that connects must have a certificate signed by the same CA/SubCA combination that the server does. So for example: - My_Root_Ca (private CA) - Some_Random_Cert.pem - Stunnel_Sub_Ca: - Server.pem - Client.pem - Postgres_Sub_Ca: - Server.pem - postgres_user.pem With the above structure in place (and the stunnel server using Stunnel_Sub_Ca/Server.pem) if someone tried to connect in with the Stunnel_Sub_Ca/Client.pem cert, it would work... but if they tried to connect in with Postgres_Sub_Ca/Server.pem, it wouldn't. Unfortunately we're not seeing that behavior... we're seeing a behavior where *every* cert signed by the overall Root CA is validated. We're able to connect in using Some_Random_Cert.pem, Postgres_Sub_Ca/Server.pem and Postgres_Sub_Ca/postgres_user.pem. This feels wrong ... what am I missing? (We're using Stunnel 4.55 btw) Matt Wise Sr. Systems Architect Nextdoor.com

1 1

ephemeral port limit
by Frank Liu 28 Apr '14

28 Apr '14

Hi, I am trying to use stunnel to add ssl support to my app. My app and linux server are tuned to accept 200k+ connections without a problem. When adding stunnel on the same server, the connection stops when it reaches 64k due to stunnel uses ephemeral ports to connect to my app on the localhost. Any suggestions how to get around this limit? One thing I am thinking of is to add 10 virtual interfaces on loopback: lo0:2, lo0:3, etc with ip 127.0.0.2, 127.0.0.3 etc. Can stunnel be configured to cycle through a pool of ip for outbound connection to my app listening on 127.0.0.1? That would give 10x64k of ephemeral ports. I see stunnel has "local" to specify outgoing ip, but I am not sure if it supports a list of ip or use multiple times. If so, will it round robin the list? Thanks Frank

2 2

Syringe
by Michal Trojnara 21 Apr '14

21 Apr '14

Hi Guys, I'm glad to announce syringe, a service for testing client-side heartbleed. It allows to easily examine most of the obscure TLS clients (for example embedded devices). The service is available online at https://www.stunnel.org:4433/ Best regards, Mike

2 2

hardware random
by ios dev 20 Apr '14

20 Apr '14

Hello. I am using GOST engine and set it as default for ALL. At the same time i want to use hardware RNG from other engine. How can i do this? -- BR, Dev.

1 0

Problem with round robin on stunnel 5.0 and 5.1
by WNSDEV 14 Apr '14

14 Apr '14

When I use either of these two versions of stunnel the round-robin for "connect" only sends connections to the first host listed on the configuration file. However the round-robin works in Stunnel 4.56,4.55,4.54 and 4.53. Anyone else have this issue? Thank you, Pete Sangas ./stunnel -version stunnel 5.00 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.1g 7 Apr 2014 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Global options: debug = daemon.notice RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = HIGH:MEDIUM:+3DES:+DH:!aNULL:!SSLv2 (with "fips = no") curve = prime256v1 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds sslVersion = TLSv1 (with "fips = yes") sslVersion = TLSv1 for client, all for server (with "fips = no") stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none Config file : CApath = /xxx/certs/trusted CAfile = /yyy/cacert.pem ciphers = RC4-SHA debug = daemon.7 pid = /zzz/stunnel.pid options = NO_SSLv2 foreground = yes setgid = gid1 setuid = uid1 delay = no fips=no [stunnel] TIMEOUTidle=86400 verify = 3 cert = /path/servercert.pem accept = 443 failover=rr connect = 10.1.1.50:23 connect = 10.1.1.60:23

2 2

DH not working, although initialized correctly
by Ovidiu Lixandru 14 Apr '14

14 Apr '14

Hello, I'm trying to enable Forward Secrecy. have an stunnel 4.56 instance compiled with authpriv and xforwardedfor patches, configured as follows: sslVersion = all options = NO_SSLv2 ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4 renegotiation = no setuid = nobody setgid = nobody socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 libwrap = no TIMEOUTbusy = 120 xforwardedfor = yes [domain.com] accept = X.X.X.X:443 connect = 127.0.0.1:91 cert = /etc/pki/tls/certs/domain.pem key = /etc/pki/tls/private/domain.key domain.pem contains both the SSL certificate and the DH parameters (generated with "openssl dhparams 2048"). stunnel initializes the DH parameters correctly: 2014.04.14 12:08:18 LOG6[16629:140355580176320]: Initializing service [domain.com] 2014.04.14 12:08:18 LOG7[16629:140355580176320]: Certificate: /etc/pki/tls/certs/domain.pem 2014.04.14 12:08:18 LOG7[16629:140355580176320]: Certificate loaded 2014.04.14 12:08:18 LOG7[16629:140355580176320]: Key file: /etc/pki/tls/private/domain.key 2014.04.14 12:08:18 LOG7[16629:140355580176320]: Private key loaded 2014.04.14 12:08:18 LOG7[16629:140355580176320]: Using DH parameters from /etc/pki/tls/certs/domain.pem 2014.04.14 12:08:18 LOG7[16629:140355580176320]: DH initialized with 2048-bit key 2014.04.14 12:08:18 LOG7[16629:140355580176320]: SSL options set: 0x01000004 When I try to connect using openssl s_client, the connections fails with it unable to negotiate a cipher. On the client side: # openssl s_client -cipher ECDH -tls1 -connect www.domain.com:443 CONNECTED(00000003) 140735113126752:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1256:SSL alert number 40 140735113126752:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:596: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 7 bytes and written 0 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1 Cipher : 0000 Session-ID: Session-ID-ctx: Master-Key: Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1397471905 Timeout : 7200 (sec) Verify return code: 0 (ok) --- On the server side: 2014.04.14 11:57:10 LOG5[9647:140038728394496]: Service [domain.com] accepted connection from X.X.X.X:56678 2014.04.14 11:57:10 LOG7[9647:140038728394496]: SSL state (accept): before/accept initialization 2014.04.14 11:57:10 LOG7[9647:140038728394496]: SNI: no virtual services defined 2014.04.14 11:57:10 LOG7[9647:140038728394496]: SSL alert (write): fatal: handshake failure 2014.04.14 11:57:10 LOG3[9647:140038728394496]: SSL_accept: 1408A0C1: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher 2014.04.14 11:57:10 LOG5[9647:140038728394496]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket The client and the server have the same openssl version (1.0.1e), with the same supported ciphers. I tried different cipher combinations (i.e. "HIGH:!aNULL:!MD5"), but no lock. FWIW, the initial DH cipher list in the stunnel config file works correctly in an SSL nginx instance and openssl s_client negotiates "ECDHE-RSA-AES256-SHA". Any idea what may be wrong with stunnel? Thanks, Ovidiu

1 0

Re: [stunnel-users] Some troubles with PROXY protocol
by Alexey V. Drozdov 13 Apr '14

13 Apr '14

Hi, Mike! In spite of new changes, it's still work incorrect because of init_remote(c) connect to the address from root config section: protocol(c, PROTOCOL_PRE_CONNECT); init_remote(c); <<<<<<<<<< destination address from root section protocol(c, PROTOCOL_PRE_SSL); init_ssl(c); <<<<<<<<<<< switch to target SNI config section only there protocol(c, PROTOCOL_POST_SSL); <<<<<<<<<<< send PROXY protocol to incorrect address Context switch to target section parameters after init_ssl(c) only. /Alexey V. Drozdov e-mail: anyquist(a)yandex.ru

2 2

Connection closed with a turn server backend
by pablo platt 12 Apr '14

12 Apr '14

Hi, I'm trying to tunnel TLS connection to a turn server https://code.google.com/p/rfc5766-turn-server/ The connection is closed with; SSL socket closed on SSL_read I'm using the ubuntu 12.04 package http://packages.ubuntu.com/precise/stunnel4 Am I missing a configuration option in my stunnel config? Please see my config and log bellow. ----------------------------------------------- chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid debug = 7 output = /stunnel.log [ssl] accept = 443 connect = 3478 cert = /etc/stunnel/cert.pem key = /etc/stunnel/key.pem ---------------------------------------------------- 2014.04.12 13:40:15 LOG7[14983:140499885700864]: No limit detected for the number of clients 2014.04.12 13:40:15 LOG7[14983:140499885700864]: signal_pipe: FD=3 allocated (non-blocking mode) 2014.04.12 13:40:15 LOG7[14983:140499885700864]: signal_pipe: FD=4 allocated (non-blocking mode) 2014.04.12 13:40:15 LOG5[14983:140499885700864]: stunnel 4.42 on x86_64-pc-linux-gnu platform 2014.04.12 13:40:15 LOG5[14983:140499885700864]: Compiled/running with OpenSSL 1.0.1 14 Mar 2012 2014.04.12 13:40:15 LOG5[14983:140499885700864]: Threading:PTHREAD SSL:ENGINE Auth:LIBWRAP Sockets:POLL,IPv6 2014.04.12 13:40:15 LOG5[14983:140499885700864]: Reading configuration from file /etc/stunnel/stunnel.conf 2014.04.12 13:40:15 LOG7[14983:140499885700864]: PRNG seeded successfully 2014.04.12 13:40:15 LOG6[14983:140499885700864]: Initializing SSL context for service ssl 2014.04.12 13:40:15 LOG4[14983:140499885700864]: Insecure file permissions on /etc/stunnel/key.pem 2014.04.12 13:40:15 LOG7[14983:140499885700864]: Certificate: /etc/stunnel/cert.pem 2014.04.12 13:40:15 LOG7[14983:140499885700864]: Certificate loaded 2014.04.12 13:40:15 LOG7[14983:140499885700864]: Key file: /etc/stunnel/key.pem 2014.04.12 13:40:15 LOG7[14983:140499885700864]: Private key loaded 2014.04.12 13:40:15 LOG7[14983:140499885700864]: Could not load DH parameters from /etc/stunnel/cert.pem 2014.04.12 13:40:15 LOG7[14983:140499885700864]: Using hardcoded DH parameters 2014.04.12 13:40:15 LOG7[14983:140499885700864]: DH initialized with 2048-bit key 2014.04.12 13:40:15 LOG7[14983:140499885700864]: ECDH initialized with curve prime256v1 2014.04.12 13:40:15 LOG7[14983:140499885700864]: SSL options set: 0x00000004 2014.04.12 13:40:15 LOG6[14983:140499885700864]: SSL context initialized 2014.04.12 13:40:15 LOG5[14983:140499885700864]: Configuration successful 2014.04.12 13:40:15 LOG7[14983:140499885700864]: libwrap_init: FD=5 allocated (blocking mode) 2014.04.12 13:40:15 LOG7[14983:140499885700864]: libwrap_init: FD=6 allocated (blocking mode) 2014.04.12 13:40:15 LOG7[14983:140499885700864]: libwrap_init: FD=6 allocated (blocking mode) 2014.04.12 13:40:15 LOG7[14983:140499885700864]: libwrap_init: FD=7 allocated (blocking mode) 2014.04.12 13:40:15 LOG7[14983:140499885700864]: libwrap_init: FD=7 allocated (blocking mode) 2014.04.12 13:40:15 LOG7[14983:140499885700864]: libwrap_init: FD=8 allocated (blocking mode) 2014.04.12 13:40:15 LOG7[14983:140499885700864]: libwrap_init: FD=8 allocated (blocking mode) 2014.04.12 13:40:15 LOG7[14983:140499885700864]: libwrap_init: FD=9 allocated (blocking mode) 2014.04.12 13:40:15 LOG7[14983:140499885700864]: libwrap_init: FD=9 allocated (blocking mode) 2014.04.12 13:40:15 LOG7[14983:140499885700864]: libwrap_init: FD=10 allocated (blocking mode) 2014.04.12 13:40:15 LOG7[14983:140499885700864]: accept socket: FD=11 allocated (non-blocking mode) 2014.04.12 13:40:15 LOG7[14983:140499885700864]: Option SO_REUSEADDR set on accept socket 2014.04.12 13:40:15 LOG7[14983:140499885700864]: Service ssl bound to 0.0.0.0:443 2014.04.12 13:40:15 LOG7[14983:140499885700864]: Service ssl opened FD=11 2014.04.12 13:40:15 LOG7[14989:140499885700864]: Created pid file /stunnel4.pid 2014.04.12 13:40:17 LOG7[14989:140499885700864]: local socket: FD=0 allocated (non-blocking mode) 2014.04.12 13:40:17 LOG7[14989:140499885700864]: Service ssl accepted FD=0 from 192.168.56.1:54561 2014.04.12 13:40:17 LOG7[14989:140499885700864]: local socket: FD=1 allocated (non-blocking mode) 2014.04.12 13:40:17 LOG7[14989:140499885700864]: Service ssl accepted FD=1 from 192.168.56.1:54562 2014.04.12 13:40:17 LOG7[14989:140499885692672]: Service ssl started 2014.04.12 13:40:17 LOG7[14989:140499885692672]: Option TCP_NODELAY set on local socket 2014.04.12 13:40:17 LOG7[14989:140499885692672]: Waiting for a libwrap process 2014.04.12 13:40:17 LOG7[14989:140499885692672]: Acquired libwrap process #0 2014.04.12 13:40:17 LOG7[14989:140499885790976]: Service ssl started 2014.04.12 13:40:17 LOG7[14989:140499885790976]: Option TCP_NODELAY set on local socket 2014.04.12 13:40:17 LOG7[14989:140499885790976]: Waiting for a libwrap process 2014.04.12 13:40:17 LOG7[14989:140499885790976]: Acquired libwrap process #1 2014.04.12 13:40:17 LOG7[14989:140499885692672]: Releasing libwrap process #0 2014.04.12 13:40:17 LOG7[14989:140499885692672]: Released libwrap process #0 2014.04.12 13:40:17 LOG7[14989:140499885692672]: Service ssl permitted by libwrap from 192.168.56.1:54562 2014.04.12 13:40:17 LOG5[14989:140499885692672]: Service ssl accepted connection from 192.168.56.1:54562 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL state (accept): before/accept initialization 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL state (accept): SSLv3 read client hello A 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL state (accept): SSLv3 write server hello A 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL state (accept): SSLv3 write certificate A 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL state (accept): SSLv3 write key exchange A 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL state (accept): SSLv3 write server done A 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL state (accept): SSLv3 flush data 2014.04.12 13:40:17 LOG7[14989:140499885790976]: Releasing libwrap process #1 2014.04.12 13:40:17 LOG7[14989:140499885790976]: Released libwrap process #1 2014.04.12 13:40:17 LOG7[14989:140499885790976]: Service ssl permitted by libwrap from 192.168.56.1:54561 2014.04.12 13:40:17 LOG5[14989:140499885790976]: Service ssl accepted connection from 192.168.56.1:54561 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL state (accept): before/accept initialization 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL state (accept): SSLv3 read client hello A 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL state (accept): SSLv3 write server hello A 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL state (accept): SSLv3 write certificate A 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL state (accept): SSLv3 write key exchange A 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL state (accept): SSLv3 write server done A 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL state (accept): SSLv3 flush data 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL state (accept): SSLv3 read client key exchange A 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL state (accept): SSLv3 read finished A 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL state (accept): SSLv3 write session ticket A 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL state (accept): SSLv3 write change cipher spec A 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL state (accept): SSLv3 write finished A 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL state (accept): SSLv3 flush data 2014.04.12 13:40:17 LOG7[14989:140499885692672]: 0 items in the session cache 2014.04.12 13:40:17 LOG7[14989:140499885692672]: 0 client connects (SSL_connect()) 2014.04.12 13:40:17 LOG7[14989:140499885692672]: 0 client connects that finished 2014.04.12 13:40:17 LOG7[14989:140499885692672]: 0 client renegotiations requested 2014.04.12 13:40:17 LOG7[14989:140499885692672]: 2 server connects (SSL_accept()) 2014.04.12 13:40:17 LOG7[14989:140499885692672]: 1 server connects that finished 2014.04.12 13:40:17 LOG7[14989:140499885692672]: 0 server renegotiations requested 2014.04.12 13:40:17 LOG7[14989:140499885692672]: 0 session cache hits 2014.04.12 13:40:17 LOG7[14989:140499885692672]: 0 external session cache hits 2014.04.12 13:40:17 LOG7[14989:140499885692672]: 0 session cache misses 2014.04.12 13:40:17 LOG7[14989:140499885692672]: 0 session cache timeouts 2014.04.12 13:40:17 LOG6[14989:140499885692672]: SSL accepted: new session negotiated 2014.04.12 13:40:17 LOG6[14989:140499885692672]: Negotiated ciphers: ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(128) Mac=AEAD 2014.04.12 13:40:17 LOG7[14989:140499885692672]: remote socket: FD=2 allocated (non-blocking mode) 2014.04.12 13:40:17 LOG6[14989:140499885692672]: connect_blocking: connecting 192.169.56.300:3478 2014.04.12 13:40:17 LOG7[14989:140499885692672]: connect_blocking: s_poll_wait 192.169.56.300:3478: waiting 10 seconds 2014.04.12 13:40:17 LOG5[14989:140499885692672]: connect_blocking: connected 192.169.56.300:3478 2014.04.12 13:40:17 LOG5[14989:140499885692672]: Service ssl connected remote server from 192.169.56.300:59744 2014.04.12 13:40:17 LOG7[14989:140499885692672]: Remote FD=2 initialized 2014.04.12 13:40:17 LOG7[14989:140499885692672]: Option TCP_NODELAY set on remote socket 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL state (accept): SSLv3 read client key exchange A 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL state (accept): SSLv3 read finished A 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL state (accept): SSLv3 write session ticket A 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL state (accept): SSLv3 write change cipher spec A 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL state (accept): SSLv3 write finished A 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL state (accept): SSLv3 flush data 2014.04.12 13:40:17 LOG7[14989:140499885790976]: 0 items in the session cache 2014.04.12 13:40:17 LOG7[14989:140499885790976]: 0 client connects (SSL_connect()) 2014.04.12 13:40:17 LOG7[14989:140499885790976]: 0 client connects that finished 2014.04.12 13:40:17 LOG7[14989:140499885790976]: 0 client renegotiations requested 2014.04.12 13:40:17 LOG7[14989:140499885790976]: 2 server connects (SSL_accept()) 2014.04.12 13:40:17 LOG7[14989:140499885790976]: 2 server connects that finished 2014.04.12 13:40:17 LOG7[14989:140499885790976]: 0 server renegotiations requested 2014.04.12 13:40:17 LOG7[14989:140499885790976]: 0 session cache hits 2014.04.12 13:40:17 LOG7[14989:140499885790976]: 0 external session cache hits 2014.04.12 13:40:17 LOG7[14989:140499885790976]: 0 session cache misses 2014.04.12 13:40:17 LOG7[14989:140499885790976]: 0 session cache timeouts 2014.04.12 13:40:17 LOG6[14989:140499885790976]: SSL accepted: new session negotiated 2014.04.12 13:40:17 LOG6[14989:140499885790976]: Negotiated ciphers: ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(128) Mac=AEAD 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL socket closed on SSL_read 2014.04.12 13:40:17 LOG7[14989:140499885692672]: Sending socket write shutdown 2014.04.12 13:40:17 LOG5[14989:140499885692672]: Connection closed: 0 bytes sent to SSL, 0 bytes sent to socket 2014.04.12 13:40:17 LOG7[14989:140499885692672]: Service ssl finished (1 left) 2014.04.12 13:40:17 LOG7[14989:140499885692672]: str_stats: 0 block(s), 0 byte(s) 2014.04.12 13:40:17 LOG7[14989:140499885790976]: remote socket: FD=1 allocated (non-blocking mode) 2014.04.12 13:40:17 LOG6[14989:140499885790976]: connect_blocking: connecting 192.169.56.300:3478 2014.04.12 13:40:17 LOG7[14989:140499885790976]: connect_blocking: s_poll_wait 192.169.56.300:3478: waiting 10 seconds 2014.04.12 13:40:17 LOG5[14989:140499885790976]: connect_blocking: connected 192.169.56.300:3478 2014.04.12 13:40:17 LOG5[14989:140499885790976]: Service ssl connected remote server from 192.169.56.300:59745 2014.04.12 13:40:17 LOG7[14989:140499885790976]: Remote FD=1 initialized 2014.04.12 13:40:17 LOG7[14989:140499885790976]: Option TCP_NODELAY set on remote socket 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL socket closed on SSL_read 2014.04.12 13:40:17 LOG7[14989:140499885790976]: Sending socket write shutdown 2014.04.12 13:40:17 LOG5[14989:140499885790976]: Connection closed: 0 bytes sent to SSL, 0 bytes sent to socket 2014.04.12 13:40:17 LOG7[14989:140499885790976]: Service ssl finished (0 left) 2014.04.12 13:40:17 LOG7[14989:140499885790976]: str_stats: 0 block(s), 0 byte(s)

1 0

Bleedingheart Bug in OpenSSL
by Burak Say 11 Apr '14

11 Apr '14

Hello, When do you think you can release a patch to use OpenSSL 1.0.1g instead of 1.0.1f? Thanks, Burak Say

4 5

Re: [stunnel-users] Some troubles with PROXY protocol
by Alexey V. Drozdov 10 Apr '14

10 Apr '14

Hi, Mike! I have analyze your fix and found mistake :( We will switch to target SNI section after init_ssl(c) only, thereby init_remote(c) will be connect to wrong destination. if(!c->opt->option.client && c->opt->protocol<0 #ifndef OPENSSL_NO_TLSEXT && !c->opt->servername_list_head #endif ) { /* server mode and no protocol negotiation needed */ init_ssl(c); init_remote(c); } else { /* client mode or protocol negotiation enabled */ protocol(c, PROTOCOL_PRE_CONNECT); init_remote(c); <<<<<<<<<< Incorrect destination protocol(c, PROTOCOL_PRE_SSL); init_ssl(c); <<<<<<<<<<< switch to target SNI config section only there protocol(c, PROTOCOL_POST_SSL); } /Alexey V. Drozdov e-mail: anyquist(a)yandex.ru

2 1

stunnel 5.01 released
by Michal Trojnara 08 Apr '14

08 Apr '14

Dear Users, I have released version 5.01 of stunnel. The ChangeLog entry: Version 5.01, 2014.04.08, urgency: HIGH: * Security bugfixes - OpenSSL DLLs updated to version 1.0.1g. This version mitigates TLS heartbeat read overrun (CVE-2014-0160). * New features - X.509 extensions added to the created self-signed stunnel.pem. - "FIPS = no" also allowed in non-FIPS builds of stunnel. - Search all certificates with the same subject name for a matching public key rather than only the first one (thx to Leon Winter). - Create logs in the local application data folder if stunnel folder is not writable on Win32. * Bugfixes - close_notify not sent when SSL still has some data buffered. - Protocol negotiation with server-side SNI fixed. - A Mac OS X missing symbols fixed. - Win32 configuration file reload crash fixed. - Added s_pool_free() on exec+connect service retires. - Line-buffering enforced on stderr output. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hash for stunnel-5.01.tar.gz: 2565bf58ffe8a612304c64df621105b2e42d6e389e815ed4205dbeec4f3f886b Best regards, Mike

1 0

Re: [stunnel-users] public domain [Patch] Support multiple X509 client certificates with same CN
by Leon Winter 01 Apr '14

01 Apr '14

Hi Michal, > >What license do you need the patch to be? > > Preferably public domain, but any GPL-compatbile and non-copyleft license > should be fine. I hereby release my patches to stunnel for support of muliple client certificates with the same CN into the public domain. Best regards, Leon Winter

2 2

Some troubles with PROXY protocol
by Alexey V. Drozdov 31 Mar '14

31 Mar '14

Hi, I try to use PROXY protocol ability for my virtual server, but this options work for root section only. E.g. it not work for this simple case: [virtual_server] accept = 443 connect = localhost:1081 cert = /etc/stunnel/serverCA.crt key = /etc/stunnel/serverCA.key verify = 2 CAfile = /etc/stunnel/serverCA.crt [server_ru] sni = virtual_server:server.ru cert = /etc/stunnel/server.cer key = /etc/stunnel/server.pem connect = localhost:7000 protocol = proxy <-- option don not work there This problem exist due some code bug: NOEXPORT void client_try(CLI *c) { init_local(c); if(!c->opt->option.client && c->opt->protocol<0) // <-- condition is true in spite of setup protorol=proxy { init_ssl(c); // we'll switch to target section (c->opt) there only! init_remote(c); } else { protocol(c, PROTOCOL_PRE_CONNECT); init_remote(c); protocol(c, PROTOCOL_PRE_SSL); init_ssl(c); protocol(c, PROTOCOL_POST_SSL); } ... Simple adhoc solution work for me: if(!c->opt->option.client && c->opt->protocol<0) // <-- condition is true in spite of setup protorol=proxy { init_ssl(c); init_remote(c); // force initiate PROXY protocol protocol(c, PROTOCOL_PRE_SSL); } It's crutch and not general solution certain. But some code refactoring needs for more correct fix. I think that this bug will be fixed in future versions. Thanks for stunnel! :) /Alexey V. Drozdov e-mail: anyquist(a)yandex.ru

2 1

Build failure of stunned 5.00 under OS X.
by Marius Schamschula 28 Mar '14

28 Mar '14

Hi there, After having built many prior releases of stunned for OS X, I ran into the following issue with version 5.0: /bin/sh ../libtool --tag=CC --mode=link gcc -pthread -fstack-protector -fPIE -g -O2 -Wall -Wextra -Wno-long-long -pedantic -L/usr/local/ssl/lib64 -L/usr/local/ssl/lib -lssl -lcrypto -o stunnel stunnel-str.o stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-fd.o stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o stunnel-ui_unix.o -lz -lpthread -lwrap libtool: link: gcc -pthread -fstack-protector -fPIE -g -O2 -Wall -Wextra -Wno-long-long -pedantic -o stunnel stunnel-str.o stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-fd.o stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o stunnel-ui_unix.o -L/usr/local/ssl/lib64 -L/usr/local/ssl/lib -lssl -lcrypto -lz -lpthread -lwrap -pthread ld: warning: directory not found for option '-L/usr/local/ssl/lib64' Undefined symbols for architecture x86_64: "_load_icon_default", referenced from: _parse_global_option in stunnel-options.o "_load_icon_file", referenced from: _parse_global_option in stunnel-options.o ld: symbol(s) not found for architecture x86_64 collect2: ld returned 1 exit status he ewxat same issue under 10.8 and 10.9. Makefile:471: recipe for target 'stunnel' failed make[2]: *** [stunnel] Error 1 make[2]: Leaving directory '/private/tmp/stunnel-5.00/src' Makefile:339: recipe for target 'all' failed make[1]: *** [all] Error 2 make[1]: Leaving directory '/private/tmp/stunnel-5.00/src' Makefile:365: recipe for target 'all-recursive' failed make: *** [all-recursive] Error 1 This is the OS X 10.7 build, but I had the same issue under 10.8 and 10.9. Marius -- Marius Schamschula

1 0

Access to Packet Content
by Michael Carlino (RIT Student) 26 Mar '14

26 Mar '14

Hello stunnel users, I am working with what seems to be the standard stunnel HTTPS configuration. I have two instances of stunnel, one as a client and one as a server. The client accepts connections from a browser. The server sits in front of tomcat. If works like a charm (of course!). What I need to do seems simple, and I will try to keep my description of it generic. In the client stunnel I need to make a small change to the HTTP packet. I need to add some data to it. At the server side I need to access that added data. The server stunnel may close the SSL session based on that data. So, my question is: can I obtain access to the packet before it's encrypted and sent out over SSL? Can I get access to the decrypted packet before it's sent on to tomcat? I know that as a proxy stunnel has to be and tries to be general in nature. I am not concerned (right now) with developing a feature that will become available to others later. I don't mind if my changes make my development version of stunnel single-purpose. My work is academic and proof-of-concept in it's nature. I have collected references and a text book (Network Security with OpenSSL by Viega et al). I will continue to walk through and explore the code. Are there any programmer resources I can obtain? I see the occasional URL in the stunnel source code. I will have to check these URLs. --- I just now pursued http://haproxy.1wt.eu/download/1.5/doc/proxy-protocol.txt, and I see that there is a patch that allows stunnel to do an initial modification to the HTTP request to insert a X-Forwarded-For header. This sounds like what I need to do! I am going to look for that patch. I hope the source code for the patch is available. Please, if anyone has any advice, war stories, criticism, whatever... I would very much appreciate it. Regards.

4 8