- stunnel-users - stunnel.org

How upgrade stunnel?
by magali morales 30 Oct '12

30 Oct '12

Hi!! I have installed the version 4.44 of stunnel, haproxy I am currently using 1.4.22. I need to update stunnel most recent version. How do I update stunnel to the latest version? And I want to know How do I uninstall stunnel? I hope you can help me, I thank you in advance!

7 7

TIMEOUTclose exceeded: closing
by Michael Wittig 25 Oct '12

25 Oct '12

Hi, I am using stunnes 4.54, my config looks like this: chroot = /opt/stunnel/jail/ setuid = stunnel setgid = stunnel pid = /stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 syslog = yes debug = local1.warning fips = no [http] cert = /opt/stunnel/www.crt key = /opt/stunnel/www.key sslVersion = all options = NO_SSLv2 renegotiation = no accept = 192.168.72.10:443 connect = 192.168.71.10:80 TIMEOUTclose = 0 xforwardedfor = yes My log is full with: Oct 25 14:49:33 www stunnel: LOG3[15114:140668359968512]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing Oct 25 14:49:36 www stunnel: LOG3[15114:140668360591104]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing Oct 25 14:50:08 www stunnel: LOG3[15114:140668360812288]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing Oct 25 14:50:13 www stunnel: LOG3[15114:140668360591104]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing The doc suggests to "set to 0 for buggy MSIE" the mailing list tells me "You requested close timeout of 0 seconds and that's exactly what you get." But i still don't understand why this is an error and what can I do to get rid of it? Or is it okay to don't look for errors in the log? Regards, Michael

2 1

some version issue
by Sergey Pimenov 25 Oct '12

25 Oct '12

Hello, I have a little problem, working with stunnel. The problem is: 25 10:50:53 LOG3[2612:1972]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number and the full log: 25 10:50:32 LOG7[2612:2988]: No limit detected for the number of clients 2012.10.25 10:50:32 LOG5[2612:2988]: stunnel 4.53 on x86-pc-mingw32-gnu platform 2012.10.25 10:50:32 LOG5[2612:2988]: Compiled/running with OpenSSL 0.9.8s-fips 4 Jan 2012 2012.10.25 10:50:32 LOG5[2612:2988]: Threading:WIN32 SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:SELECT+IPv6 2012.10.25 10:50:32 LOG5[2612:2988]: Reading configuration from file stunnel.conf 2012.10.25 10:50:33 LOG5[2612:2988]: FIPS mode is enabled 2012.10.25 10:50:33 LOG7[2612:2988]: Compression not enabled 2012.10.25 10:50:33 LOG7[2612:2988]: PRNG seeded successfully 2012.10.25 10:50:33 LOG6[2612:2988]: Initializing service section [POS] 2012.10.25 10:50:33 LOG7[2612:2988]: Certificate: C:\Arcus2\SSL\pos3135pem.pem 2012.10.25 10:50:33 LOG7[2612:2988]: Certificate loaded 2012.10.25 10:50:33 LOG7[2612:2988]: Key file: C:\Arcus2\SSL\pos3135key.pem 2012.10.25 10:50:33 LOG7[2612:2988]: Private key loaded 2012.10.25 10:50:33 LOG7[2612:2988]: SSL options set: 0x00000004 2012.10.25 10:50:33 LOG5[2612:2988]: Configuration successful 2012.10.25 10:50:33 LOG7[2612:2988]: Service [POS] (FD=180) bound to 127.0.0.1:9021 2012.10.25 10:50:53 LOG7[2612:2988]: Service [POS] accepted (FD=260) from 127.0.0.1:3645 2012.10.25 10:50:53 LOG7[2612:2988]: Creating a new thread 2012.10.25 10:50:53 LOG7[2612:2988]: New thread created 2012.10.25 10:50:53 LOG7[2612:1972]: Service [POS] started 2012.10.25 10:50:53 LOG5[2612:1972]: Service [POS] accepted connection from 127.0.0.1:3645 2012.10.25 10:50:53 LOG6[2612:1972]: connect_blocking: connecting 217.69.205.63:9021 2012.10.25 10:50:53 LOG7[2612:1972]: connect_blocking: s_poll_wait 217.69.205.63:9021: waiting 10 seconds 2012.10.25 10:50:53 LOG5[2612:1972]: connect_blocking: connected 217.69.205.63:9021 2012.10.25 10:50:53 LOG5[2612:1972]: Service [POS] connected remote server from 213.156.128.147:3646 2012.10.25 10:50:53 LOG7[2612:1972]: Remote socket (FD=284) initialized 2012.10.25 10:50:53 LOG3[2612:1972]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2012.10.25 10:50:53 LOG5[2612:1972]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2012.10.25 10:50:53 LOG7[2612:1972]: Remote socket (FD=284) closed 2012.10.25 10:50:53 LOG7[2612:1972]: Local socket (FD=260) closed 2012.10.25 10:50:53 LOG7[2612:1972]: Service [POS] finished (0 left) my .conf file is: cert = C:\Arcus2\SSL\pos3135pem.pem key = C:\Arcus2\SSL\pos3135key.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 CAfile = C:\Arcus2\SSL\cacert.pem debug = 7 output = stunnel.log [POS] client = yes accept = 127.0.0.1:9021 connect = xxx.xxx.xxx.xxx:9021 if I change conf file, adding sslVersion = all or sslVersion = SSLv3, I have another error Section POS: sslVersion = TLSv1 is required in FIPS mode Thank your for help, Sergey Pimenov

2 1

Stunnel 4.54 manifest
by John A. Wallace 24 Oct '12

24 Oct '12

Hi, Michal. Good news about the update! I noticed that this version, the one for Windows installation, has many more files in it than the last version. It's no problem, but I was just wondering why the change this time? Thanks. John > -----Original Message----- > From: stunnel-announce-bounces(a)stunnel.org [mailto:stunnel-announce- > bounces(a)stunnel.org] On Behalf Of stunnel-announce-request(a)stunnel.org > Sent: Wednesday, October 10, 2012 5:00 AM > To: stunnel-announce(a)stunnel.org > Subject: stunnel-announce Digest, Vol 48, Issue 1 > > Send stunnel-announce mailing list submissions to > stunnel-announce(a)stunnel.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-announce > or, via email, send a message with subject or body 'help' to > stunnel-announce-request(a)stunnel.org > > You can reach the person managing the list at > stunnel-announce-owner(a)stunnel.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-announce digest..." > > > Today's Topics: > > 1. stunnel 4.54 released (Michal Trojnara) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 09 Oct 2012 23:37:41 +0200 > From: Michal Trojnara <Michal.Trojnara(a)mirt.net> > To: stunnel-users(a)stunnel.org, stunnel-announce(a)stunnel.org, > openssl-users(a)openssl.org > Subject: [stunnel-announce] stunnel 4.54 released > Message-ID: <50749925.8030905(a)mirt.net> > Content-Type: text/plain; charset="iso-8859-1" > > Dear Users, > > > I have released version 4.54 of stunnel. The ChangeLog entry: > > > Version 4.54, 2012.10.09, urgency: MEDIUM: > * New Win32 features > - FIPS module updated to version 2.0. > - OpenSSL DLLs updated to version 1.0.1c. > - zlib DLL updated to version 1.2.7. > - Engine DLLs added: 4758cca, aep, atalla, capi, chil, cswift, gmp, > gost, nuron, padlock, sureware, ubsec. > * Other new features > - "session" option renamed to more readable "sessionCacheTimeout". > The old name remains accepted for backward compatibility. > - New service-level "sessionCacheSize" option to control session cache > size. > - New service-level option "reset" to control whether TCP RST flag is > used to indicate errors. The default value is "reset = yes". > - New service-level option "renegotiation" to disable SSL > renegotiation. > This feature is based on a public-domain patch by Janusz Dziemidowicz. > - New FreeBSD socket options: IP_FREEBIND, IP_BINDANY, IPV6_BINDANY > (thx to Janusz Dziemidowicz). > - New parameters to configure TLS v1.1/v1.2 with OpenSSL version 1.0.1 > or higher (thx to Henrik Riomar). > * Bugfixes > - Fixed "Application Failed to Initialize Properly (0xc0150002)" error. > - Fixed missing SSL state debug log entries. > - Fixed a race condition in libwrap code resulting in random stalls > (thx to Andrew Skalski). > - Session cache purged at configuration file reload to reduce memory > leak. > Remaining leak of a few kilobytes per section is yet to be fixed. > - Fixed regression bug in "transparent = destination" functionality > (thx to Stefan Lauterbach). This bug was introduced in stunnel 4.51. > - "transparent = destination" is now a valid endpoint in inetd mode. > - "delay = yes" fixed to work even if specified *after* "connect" > option. > - Multiple "connect" targets fixed to also work with delayed resolver. > - The number of resolver retries of EAI_AGAIN error has been limited > to > 3 in order to prevent infinite loops.. > > > Home page: https://www.stunnel.org/ <http://stunnel.mirt.net/> > Download: https://www.stunnel.org/downloads.html > <ftp://stunnel.mirt.net/stunnel/> > > > SHA-256 hash for stunnel-4.54.tar.gz: > > b7e1b9e63569574dbdabee8af90b8ab88db3fe13dcb1268d59a1408c56e6de7b > > > Best regards, > > Mike > > > -------------- next part -------------- A non-text attachment was > scrubbed... > Name: signature.asc > Type: application/pgp-signature > Size: 196 bytes > Desc: OpenPGP digital signature > URL: <http://www.stunnel.org/pipermail/stunnel- > announce/attachments/20121009/f9eac1e3/attachment-0001.pgp> > > ------------------------------ > > _______________________________________________ > stunnel-announce mailing list > stunnel-announce(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-announce > > > End of stunnel-announce Digest, Vol 48, Issue 1 > ***********************************************

3 6

Re: [stunnel-users] (no subject)
by John 23 Oct '12

23 Oct '12

wrote in message news:... Path: news.gmane.org!not-for-mail From: Leandro Avila <leandro.avila(a)ymail.com> Newsgroups: gmane.network.stunnel.user Subject: Re: Safest suggested client/server stunnel configurations to prevent MITM attacks Date: Mon, 22 Oct 2012 12:50:07 -0700 (PDT) Lines: 52 Approved: news(a)gmane.org Message-ID: <1350935407.72221.YahooMailNeo(a)web111004.mail.gq1.yahoo.com> References: <4B5D7F24543C2E4DB3172B1F82446E56C8473D31(a)CBMBOX1.cloudblock.com> Reply-To: Leandro Avila <leandro.avila(a)ymail.com> NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 X-Trace: ger.gmane.org 1350935423 5511 80.91.229.3 (22 Oct 2012 19:50:23 GMT) X-Complaints-To: usenet(a)ger.gmane.org NNTP-Posting-Date: Mon, 22 Oct 2012 19:50:23 +0000 (UTC) To: "Michael K. Avanessian" <michael(a)mka.net>, "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Original-X-From: stunnel-users-bounces(a)stunnel.org Mon Oct 22 21:50:30 2012 Return-path: <stunnel-users-bounces(a)stunnel.org> Envelope-to: gnsu-stunnel-users(a)m.gmane.org Original-Received: from linode.mirt.net ([207.192.69.165]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from <stunnel-users-bounces(a)stunnel.org>) id 1TQO15-0006Lq-PI for gnsu-stunnel-users(a)m.gmane.org; Mon, 22 Oct 2012 21:50:28 +0200 Original-Received: from linode.mirt.net (localhost [127.0.0.1]) by linode.mirt.net (Postfix) with ESMTP id E06E11C115; Mon, 22 Oct 2012 21:50:13 +0200 (CEST) X-Original-To: stunnel-users(a)stunnel.org Delivered-To: stunnel-users(a)stunnel.org Original-Received: from nm7-vm0.bullet.mail.ne1.yahoo.com (nm7-vm0.bullet.mail.ne1.yahoo.com [98.138.91.66]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by linode.mirt.net (Postfix) with ESMTPS id 2914F1C0F8 for <stunnel-users(a)stunnel.org>; Mon, 22 Oct 2012 21:50:09 +0200 (CEST) Original-Received: from [98.138.90.52] by nm7.bullet.mail.ne1.yahoo.com with NNFMP; 22 Oct 2012 19:50:08 -0000 Original-Received: from [98.138.89.195] by tm5.bullet.mail.ne1.yahoo.com with NNFMP; 22 Oct 2012 19:50:08 -0000 Original-Received: from [127.0.0.1] by omp1053.mail.ne1.yahoo.com with NNFMP; 22 Oct 2012 19:50:08 -0000 X-Yahoo-Newman-Property: ymail-3 X-Yahoo-Newman-Id: 65068.27023.bm(a)omp1053.mail.ne1.yahoo.com Original-Received: (qmail 75038 invoked by uid 60001); 22 Oct 2012 19:50:07 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ymail.com; s=s1024; t=1350935407; bh=0Y+VdggsIVZOwOr4EaEYksE57qG+K4Xf7m79PQuMl/4=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type:Content-Transfer-Encoding; b=uUP64Hu7MIb0ahLEqKeQ2rUov8flXv6sjA7h5DanB+bxl2m8dRHLsiUrFHiPFhWcsNIUGtevpvfsxYifmZPjIMTiOvHyxZPxQo2uXvlAzOZKwPuaNEvXrYVNiwVO0nZjG00eA+Gpo8dJCS50OObUbvjympoIhG60TioBD4rSw5U= DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=ymail.com; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type:Content-Transfer-Encoding; b=wx17KKam+BlR2A3orpl30Y8/UU3T1ZQ5cDajNEkq008Ppz1baFHK10kwWYt35qPShDTswy2xduxRIzGN/JTVdE8Vb9hFmfmWPtOkptIRxMf26YV6r/x53AKs8rACXc8tNyJVeczxzNSAE1/iycwLc4Q5lwdUda4qUe8+09gtNa0=; X-YMail-OSG: b3DSDKgVM1mQHP5ZBTfIr3A5W2ZGXp385_N0YTtfmQmY8Tx PSFpP624fQl9zaJm1NcwnCvuFSUunTJ.Q6u_X6ZqnTdr.J_LYAj5IOqyykQ2 l4Al99RB4Au24agY5aySFUQj2AVKVLlThmnaaZKrM2O6i4lQj42kjXE9SjCN Ko1OE8i8SRI1X8s_OszQhSFqPwpJVxJ6a8XwsT.HHRvnjCN5oawxLfeYhi8I Nc497s5NZ3BjLmS2ddO1rE_aDEXfeZZf5G4FssKYeY.CR5XmhczPnRsqEOO0 nYj_KNi6UlLDyqhpRuMqUJYBD.JQXLJzN9IG3zKYBdvkip2LXSMmutoKPT8Z oEEAd3OEom9Rew5fODminUDtopQjgJUGkRl5fJPz2xthop6HA8XuKHCMTM6B d1YYbS_V1c5QklFH6aN6XbAYJRG36RA9gKBGsO2BVZ_5t36738Y3Bff.0ySt 6iW79amGPEIc__mjy0VELbOmQ3WPpHOPdBiH.GuHKGcmpVqApD5u2dHxOWa0 cJzYLcE0Fdfsdr6YOWGOh9jGD.P.St5QItI4sMxAhQ9WROechXtibFdHjrFO _Md3OgU8mIpgCFwIbK4b2K4cyPAiM5Kl1P_uFLQ5HE9uAg_8I64GtaSYyTGM 1aFaD9IVrniBqWo.oWvM2Lp.7TyGddU7.olqsc6MmSljcf4b.Rx5cRTwDw2R Kqc1fDQWPPxDDd1pMa1Nasg27P2qGUEy1DSofVwCgDn9MSKvSGj8- Original-Received: from [134.161.133.36] by web111004.mail.gq1.yahoo.com via HTTP; Mon, 22 Oct 2012 12:50:07 PDT X-Rocket-MIMEInfo: 001.001, Pl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCj4gRnJvbTogTWljaGFlbCBLLiBBdmFuZXNzaWFuIDxtaWNoYWVsQG1rYS5uZXQ.Cj5UbzogInN0dW5uZWwtdXNlcnNAc3R1bm5lbC5vcmciIDxzdHVubmVsLXVzZXJzQHN0dW5uZWwub3JnPiAKPlNlbnQ6IEZyaWRheSwgT2N0b2JlciAxOSwgMjAxMiAxMDo0MSBQTQo.U3ViamVjdDogW3N0dW5uZWwtdXNlcnNdIFNhZmVzdCBzdWdnZXN0ZWQgY2xpZW50L3NlcnZlciBzdHVubmVsIGNvbmZpZ3VyYXRpb25zIHRvIHByZXZlbnQgTUlUTSBhdHRhY2tzCgoBMAEBAQE- X-Mailer: YahooMailWebService/0.8.123.460 In-Reply-To: <4B5D7F24543C2E4DB3172B1F82446E56C8473D31(a)CBMBOX1.cloudblock.com> X-BeenThere: stunnel-users(a)stunnel.org X-Mailman-Version: 2.1.13 Precedence: list List-Id: "public, moderate-volume list - general discussion, problem reports, patches" <stunnel-users.stunnel.org> List-Unsubscribe: <https://www.stunnel.org/cgi-bin/mailman/options/stunnel-users>, <mailto:stunnel-users-request@stunnel.org?subject=unsubscribe> List-Archive: <http://www.stunnel.org/pipermail/stunnel-users> List-Post: <mailto:stunnel-users@stunnel.org> List-Help: <mailto:stunnel-users-request@stunnel.org?subject=help> List-Subscribe: <https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users>, <mailto:stunnel-users-request@stunnel.org?subject=subscribe> Original-Sender: stunnel-users-bounces(a)stunnel.org Errors-To: stunnel-users-bounces(a)stunnel.org Xref: news.gmane.org gmane.network.stunnel.user:5976 Archived-At: <http://permalink.gmane.org/gmane.network.stunnel.user/5976> Pl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCj4gRnJvbTogTWljaGFlbCBLLiBBdmFu ZXNzaWFuIDxtaWNoYWVsQG1rYS5uZXQ+Cj5UbzogInN0dW5uZWwtdXNlcnNAc3R1bm5lbC5vcmci IDxzdHVubmVsLXVzZXJzQHN0dW5uZWwub3JnPiAKPlNlbnQ6IEZyaWRheSwgT2N0b2JlciAxOSwg MjAxMiAxMDo0MSBQTQo+U3ViamVjdDogW3N0dW5uZWwtdXNlcnNdIFNhZmVzdCBzdWdnZXN0ZWQg Y2xpZW50L3NlcnZlciBzdHVubmVsIGNvbmZpZ3VyYXRpb25zIHRvIHByZXZlbnQgTUlUTSBhdHRh Y2tzCgo+SeKAmW0gY3VycmVudGx5IHR1bm5lbGluZyBTU0ggb3ZlciBTU0wgdXNpbmcgc3R1bm5l bC4KPkkgdGhvdWdodCB0aGF0IHN0dW5uZWxlZCBzc2ggZGF0YSB3YXMgc2FmZS7CoCBIb3dldmVy LCByZWNlbnRseSBJ4oCZdmUgcmVhZCB0aGF0IGlmIGdvaW5nIHRocm91Z2ggYSBzb3BoaXN0aWNh dGVkIGh0dHAvaHR0cHMgcHJveHksIGl04oCZcyBwb3NzaWJsZSB0byBiZSBoYWNrZWQgYnkgYSDi gJxsZWdpdGltYXRl4oCdIG1pdG0gYXR0YWNrIHRvIGZvb2wgYW4gU1NMIGNsaWVudC4KClR1bm5l bGVkIGFuZCBub3QtdHVubmVsZWQgU1NIIGRhdGEgX2lzXyBzYWZlLiBUaGUgU1NIIHByb3RvY29s IGlzIHByZXR0eSBzZWN1cmUgYnkgaXRzZWxmLsKgCgpNeSB1bmRlcnN0YW5kaW5nIGlzIHRoYXQg dG8gcHVsbCBvZmYgdGhlIHR5cGUgb2YgU1NML1RMUyBkYXRhIGluc3BlY3Rpb24gdGhhdCB5b3Ug bWVudGlvbgpodHRwOi8vd3d3LnNvdXJjZWZpcmUuY29tL3NlY3VyaXR5LXRlY2hub2xvZ2llcy9u ZXR3b3JrLXNlY3VyaXR5L3NzbC1lbmNyeXB0aW9uLWRlY3J5cHRpb24KCnRoZXJlIGhhcyB0byBi ZSBzb21lIHdvcmsgZG9uZSBvbiB0aGUgY2xpZW50IHNpZGUgb2YgdGhlIGNvbm5lY3Rpb24uIChJ bnN0YWxsIGEgY3VzdG9tCgpDQSBjZXJ0aWZpY2F0ZSBpbiB0aGUgdHJ1c3RlZCBjZXJ0aWZpY2F0 ZSBzdG9yZSBvZiB0aGUgY2xpZW50IG1hY2hpbmUpCgpTbyBldmVuIGlmIHlvdSB3ZXJlIG9uIHN1 Y2ggYSBuZXR3b3JrLCBhcyBsb25nIGFzIHlvdXIgImF0dGFja2VyIiBkb2VzIG5vdCBoYXZlIGNv bnRyb2wKb2YgeW91ciBtYWNoaW5lLiB0aGUgU1NML1RMUyBwcm90b2NvbCB3aWxsIHByb3RlY3Qg eW91IGJlY2F1c2Ugb2YgdGhlIHdheSBrZXlzIChjZXJ0aWZpY2F0ZXMpCmFyZSB2ZXJpZmllZC4g KE5vdGljZSB0aGUga2V5IHdvcmQgaGVyZSBpcyB2ZXJpZmllZCkKCj7CoAo+SXMgaXQgc3RpbGwg cG9zc2libGUgdG8gY29uZmlndXJlIHN0dW5uZWwgc28gdGhhdCBzc2wgY2Fu4oCZdCBiZSBjb21w cm9taXNlZCBiZXR3ZWVuIGJvdGggZW5kcz8KPsKgCj5J4oCZbSBnb2luZyB0byB0YWtlIGEgd2ls ZCBndWVzcyBoZXJlOyB3aGljaCBJ4oCZbSBzdXJlIEnigJltIHByb2JhYmx5IHdyb25nLsKgIEJ1 dCwgY291bGQgSSBqdXN0IGluc3RhbGwgc3R1bm5lbDsgYW5kLCBsZXQgaXQgY3JlYXRlIGF1dG9t YXRpY2FsbHkgYSBzZWxmLXNpZ25lZCAoc3R1bm5lbC5wZW0pIGNlcnRpZmljYXRlIGZpbGXigKYg dGhlbiBqdXN0IGNvcHkgdGhhdCBmaWxlIHRvIHRoZSBzdHVubmVsIGluc3RhbGwgb24gdGhlIG90 aGVyIGVuZD/CoCBUaGF0IHdheSBib3RoIHNpZGVzIGFyZSBhbHJlYWR5IGF3YXJlIG9mIGVhY2gg b3RoZXLigJlzIHB1YmxpYyBrZXlzOyBhbmQsIHdvdWxkbuKAmXQgYmUgdnVsbmVyYWJsZSBkdXJp bmcgdGhlIGluaXRpYWwgdW5lbmNyeXB0ZWQgaGFuZHNoYWtlPwo+wqAKPknigJltIHN1cmUgSeKA mW0gcHJvYmFibHkgd2F5IG9mZjsgYW5kLCB0aGVyZeKAmXMgbW9yZSBJIG5lZWQgdG8gZG8gaW4g c3R1bm5lbOKAmXMgY29uZmlndXJhdGlvbiB0byBmdXJ0aGVyIGVuc3VyZSB0aGUgU1NMIHdvbuKA mXQgYmUgY29tcHJvbWlzZWQuLiBzdWNoIGFzIHRoZSBzdHVubmVsIOKAnHZlcmlmeeKAnSBzZXR0 aW5nLsKgIEnigJltIG5vdCBzdXJlIHdoaWNoIHNldHRpbmcgdG8gaGF2ZSBpdDsgYW5kLCB3aGF0 IGl0IGFjdHVhbGx5IGRvZXMuCj7CoAo+SeKAmW0gaG9waW5nIHNvbWVvbmUgY291bGQgc2hlZCBz b21lIGxpZ2h0IG9uIHRoaXMgd2l0aCBzaW1wbGUgc3VnZ2VzdGVkIGNsaWVudMOgIHNlcnZlciBj b25maWdzIHRoYXQgd291bGQga2VlcCBzc2wgdW5jb21wcm9taXNlZCBhcyBtdWNoIGFzIHBvc3Np YmxlLgo+wqAKPlRoYW5rcyBpbiBhZHZhbmNlIQoKVGhlIGNvbmZpZ3VyYXRpb24geW91IGFyZSBs b29raW5nIGZvciBzdHVubmVsIGludm9sdmVzIHRoZSB2ZXJpZnkgbGV2ZWwgMyBzZXR0aW5nIG9u IHRoZSBjb25maWcKKFZlcmlmeSBwZWVyIHdpdGggbG9jYWxseSBpbnN0YWxsZWQgY2VydGlmaWNh dGUpCgpQbHVzIHRoZSBrZXkgbWFuYWdlbWVudCBpbnZvbHZlZCB0byBzZXQgdGhhdCB1cC4KClRh a2UgYSBsb29rIGEgdGhpcyBkb2N1bWVudC4gSXQgaXMgYSBsaXR0bGUgb3V0IG9mIGRhdGUuIEJV VCB0aGUgcGFydCBhYm91dCBzZXR0aW5nIHVwIHRoZQpjZXJ0aWZpY2F0ZXMgb24gY2xpZW50IGFu ZCBzZXJ2ZXIgc3RpbGwgYXBwbGllcy4gYW5kIGlzIGEgZ29vZCB3YXkgdG8gc3RhcnQKaHR0cDov L3d3dy5zeW1hbnRlYy5jb20vY29ubmVjdC9hcnRpY2xlcy9yZW1vdGUtZGVza3RvcC1tYW5hZ2Vt ZW50LXNvbHV0aW9uLW1pY3Jvc29mdAoKSG9wZSB0aGlzIGhlbHBzCgoKCkxlYW5kcm8gQXZpbGEK LS0tLS0tLS0tLS0tLS0tLQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXwpzdHVubmVsLXVzZXJzIG1haWxpbmcgbGlzdApzdHVubmVsLXVzZXJzQHN0dW5uZWwu b3JnCmh0dHBzOi8vd3d3LnN0dW5uZWwub3JnL2NnaS1iaW4vbWFpbG1hbi9saXN0aW5mby9zdHVu bmVsLXVzZXJzCg== ------------------------ In the above data, I do not see any legible information at all. What am I missing?

2 1

Safest suggested client/server stunnel configurations to prevent MITM attacks
by Michael K. Avanessian 22 Oct '12

22 Oct '12

I'm currently tunneling SSH over SSL using stunnel. I thought that stunneled ssh data was safe. However, recently I've read that if going through a sophisticated http/https proxy, it's possible to be hacked by a "legitimate" mitm attack to fool an SSL client. Is it still possible to configure stunnel so that ssl can't be compromised between both ends? I'm going to take a wild guess here; which I'm sure I'm probably wrong. But, could I just install stunnel; and, let it create automatically a self-signed (stunnel.pem) certificate file... then just copy that file to the stunnel install on the other end? That way both sides are already aware of each other's public keys; and, wouldn't be vulnerable during the initial unencrypted handshake? I'm sure I'm probably way off; and, there's more I need to do in stunnel's configuration to further ensure the SSL won't be compromised.. such as the stunnel "verify" setting. I'm not sure which setting to have it; and, what it actually does. I'm hoping someone could shed some light on this with simple suggested client--> server configs that would keep ssl uncompromised as much as possible. Thanks in advance!

3 2

Need help building FIPS capable Stunnel for Windows CE
by Bao, Robert 18 Oct '12

18 Oct '12

I am attempting to build a FIPS-capable Openssl for an XScale processor (ARMV4I) running under Windows CE 5.0 (using openssl-1.0.1c and openssl-fips-2.0.1), that was successful. Then I built the latest Stunnel (just released few days ago) with FIPS option turned on. The build appears to complete successfully. However, at run-time, entering FIPS mode fails and the following messages are produced: error stack: 2D079089 : error:2D079089:FIPS routines:fips_pkey_signature_test:test failure FIPS_mode_set: 2D06B06F: error:2D06B06F:FIPS routines:FIPS_check_incore_fingerprint:fingerprint does not match I have reviewed the build instructions outlined in the OpenSSL FIPS user guide carefully and believe all the build instructions have been adhered to. What needs to be changed for the signature to be properly embedded? Robert Bao Tyco

2 2

Unable to Stop Service - Windows XP SP3 x86
by Thomas Eifert 16 Oct '12

16 Oct '12

I just uninstalled Stunnel version 4.53 and replaced it with 4.54 on my Windows XP SP3 x86 machine. What I generally do is stop the service, uninstall the service, then uninstall Stunnel prior to installing the new version. When I attempted to stop the version 4.53 service via the start menu shortcut, I was unsuccessful; all that happened was that the Stunnel status/log window would launch. This was repeatable. Likewise, when I attempted to stop it from an elevated command prompt using stunnel.exe -stop, the result was the same. I am administrator on this machine. I launched services.msc, and was able to stop it from there without any difficulty. After I installed 4.54, just to see what would happen, I attempted to stop the service again using the same methods. Same result.. I just can't do it in the conventional manner. I checked to ensure that there was only one Stunnel service/process running, and that checks out okay. Not sure if others are seeing this issue, but thought I'd better let someone know about it. Thanks for the new version! Regards, Thomas -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

1 0

X-Forwarded-For stunnel 4.54 patch
by Michael Wittig 16 Oct '12

16 Oct '12

Hi, I created the X-Forwarded-For stunnel 4.54 patch: https://gist.github.com/3899818 Could someone else check it? -- Michael

1 0

Client Authentication and CRL Verification
by Jean-Philippe Constant 16 Oct '12

16 Oct '12

Hi, I am using stunnel in server mode with mutual authentication. The PKI used to authenticate my client is the following : root CA -> Intermediate CA -> Client. My stunnel configuration is : CAfile = RootCA.pem CRLfile = IntermediateCACRL.pem verify = 2 RootCA.pem contains the Root CA certificate IntermediateCACRL.pem contains the CRL file of the Intermediate CA The client authentication with client certificate goes well. The problem occurs when a client certificate is revoked. After the Intermediate CA CRL updates, the client certificate is still accepted whereas it should be refused. With the following configuration the revoked certificate is refused : CAfile = IntermediateCA.pem CRLfile = IntermediateCACRL.pem verify = 2 but I would prefer using the first configuration. Everything happens like if stunnel checks the crl only for the CA certificate and not for the whole certification chain. Thank you for your answers, Jean-Philippe Constant

1 0

SSL proxy in Windows - IP Address Issue
by Brian McGinity 16 Oct '12

16 Oct '12

Thank you so much for stunnel. This program is amazing!!!! In Windows, I'd like to move SSL processing out of Apache and into stunnel. Is there a way for Apache to know the client's ip address? - In Windows, "transparent" mode is unavailable - "xforwardedfor" is for smtp and not https connections - "protocol = proxy" is for Haproxy only? Brian

2 3

Asterisk with stunnel
by manjula hettiarachchi 15 Oct '12

15 Oct '12

Hi List I am new to stunnel, Just tried today to send Asterisk SIP request to stunnel client and forward to stunnel-server --> asterisk on another machine. (server ip=x.x.x.x) (client ip=y.y.y.y) Client config: cert=/etc/stunnel/stunnel.pem client=yes pid=/tmp/stunnel.pid debug=7 output=/etc/stunnel/stunnel.log [sip] accept=16380 connect=x.x.x.x:17380 ================================ Server Config: cert=/etc/stunnel/stunnel.pem #client=no pid=/tmp/stunnel.pid debug=7 output=/etc/stunnel/stunel.log [sip-IN] accept=17380 connect=5060 When tried 'telnet localhost 16380 from client machine i could see packets coming to server. However when Asterisk sends a sip request to port 16380, exten => _X.,1,Dial(SIP/${EXTEN}@y.y.y.y:16380,20,rt) i dont see packets forwaded to the server. Pls advise if anyone has used this scenario Best Regards Manjula

2 1

Re: [stunnel-users] stunnel-users Digest, Vol 99, Issue 2
by Scott McKeown 10 Oct '12

10 Oct '12

Hi Michal, Thats great news and thank you for update. I think the 'renegotiation' option will be a great addition. -- With Kind Regards. Scott McKeown Loadbalancer.org http://www.loadbalancer.org

1 0

stunnel 4.54 released
by Michal Trojnara 09 Oct '12

09 Oct '12

Dear Users, I have released version 4.54 of stunnel. The ChangeLog entry: Version 4.54, 2012.10.09, urgency: MEDIUM: * New Win32 features - FIPS module updated to version 2.0. - OpenSSL DLLs updated to version 1.0.1c. - zlib DLL updated to version 1.2.7. - Engine DLLs added: 4758cca, aep, atalla, capi, chil, cswift, gmp, gost, nuron, padlock, sureware, ubsec. * Other new features - "session" option renamed to more readable "sessionCacheTimeout". The old name remains accepted for backward compatibility. - New service-level "sessionCacheSize" option to control session cache size. - New service-level option "reset" to control whether TCP RST flag is used to indicate errors. The default value is "reset = yes". - New service-level option "renegotiation" to disable SSL renegotiation. This feature is based on a public-domain patch by Janusz Dziemidowicz. - New FreeBSD socket options: IP_FREEBIND, IP_BINDANY, IPV6_BINDANY (thx to Janusz Dziemidowicz). - New parameters to configure TLS v1.1/v1.2 with OpenSSL version 1.0.1 or higher (thx to Henrik Riomar). * Bugfixes - Fixed "Application Failed to Initialize Properly (0xc0150002)" error. - Fixed missing SSL state debug log entries. - Fixed a race condition in libwrap code resulting in random stalls (thx to Andrew Skalski). - Session cache purged at configuration file reload to reduce memory leak. Remaining leak of a few kilobytes per section is yet to be fixed. - Fixed regression bug in "transparent = destination" functionality (thx to Stefan Lauterbach). This bug was introduced in stunnel 4.51. - "transparent = destination" is now a valid endpoint in inetd mode. - "delay = yes" fixed to work even if specified *after* "connect" option. - Multiple "connect" targets fixed to also work with delayed resolver. - The number of resolver retries of EAI_AGAIN error has been limited to 3 in order to prevent infinite loops.. Home page: https://www.stunnel.org/ <http://stunnel.mirt.net/> Download: https://www.stunnel.org/downloads.html <ftp://stunnel.mirt.net/stunnel/> SHA-256 hash for stunnel-4.54.tar.gz: b7e1b9e63569574dbdabee8af90b8ab88db3fe13dcb1268d59a1408c56e6de7b Best regards, Mike

1 0

How to forward client's IP address with stunnel on Windows
by Emmanuel Egensperger 08 Oct '12

08 Oct '12

Dear stunnel's users, I have search on google and try many things on stunnel's configuration to forward ip address, but nothing works ? I have found this option in the FAQ : transparent = source But it seems that it doesn't work on windows ? >Line 22: "transparent = source": Specified option name is not valid here >Server is down Is there any solution to my problem ? Have I done something wrong ? Best regards, Manu Egen

2 1

Timeouts and inetd mode
by Bruce Guenter 28 Sep '12

28 Sep '12

Hi. As far as I can tell, if stunnel is running in "inetd mode", at least TIMEOUTbusy does not work. In particularl, stunnel will never timeout waiting for the SSL handshake to complete. If I'm reading the sources right, this is because the code to set up the SSL session calls SSL_accept before checking for data on stdin, and stdin is never set to non-blocking mode (only newly created sockets and/or pipes are). Would it make sense to set stdin (and stdout) to non-blocking mode when timeouts are enabled? Something in init_local maybe? -- Bruce Guenter <bruce(a)untroubled.org> http://untroubled.org/

1 0

SNI with wildcard certificates
by Gustavo Machado 27 Sep '12

27 Sep '12

Hi, I would like to use SNI in combination with wildcard certificates. I currently have the following configuration: [https] accept = 443 connect = 80 TIMEOUTclose = 0 cert = C:\default.pem key = C:\default.key ;SNI Config ;========== [https_a] sni = https:one.org connect = 80 cert = C:\a.pem key = C:\a.key [https_a_wc] sni = https:*.one.org connect = 80 cert = C:\b.pem key = C:\b.key If I go to https://one.org then I can see a.pem in the browser. If I go to https://mysubdomain.one.org I see default.pem. What am I missing?? Thanks! Gustavo

2 1

Chain pem files
by Gustavo Machado 27 Sep '12

27 Sep '12

Hi guys, Sorry for the newbie question, but I have the following configuration for an HTTPS endpoint: [https_one] sni = https:one.org connect = 44300 cert = D:\node\https\default.crt key = D:\node\https\default.key It works wonders, however I need to provide to this configuration two more .pem files for "chain". How would go about doing that? Thanks, Gustavo

1 1

Stunnel build with openssl 1.0+
by Gustavo Machado 27 Sep '12

27 Sep '12

Hi guys, I would like to use SNI and looks like I need a build with openssl 1.0+ Can you guys point me to a download link to the installer for that build? Thanks, Gustavo

2 2

(no subject)
by larisaka＠yahoo.com 25 Sep '12

25 Sep '12

http://www.steam-n-gleam.com/wp-content/plugins/bookingbug/google.html?fs=z…

1 0

Stunnel blocks booting process when no network connectivity
by Muschi Stevenson 25 Sep '12

25 Sep '12

My stunnel implementation works fine when the network is plugged in but it does not start at all, which stops the whole boot process, when there is no network connected on the machine (as a client). As extra information: - I'm using "delay=yes" - I'm using an fqdn (e.g: stunnel.mydomain.com) for the connections - Using stunnel 4.53 - Using ubuntu 12.04 but this also happened with centos5 previously however after some time it did boot on centos which doesn't happen in ubuntu How can this be avoided or a timeout specified? Doing an strace as suggested by symcbean shows the following (including the last part where it hangs): [...] --- SIGCHLD (Child exited) @ 0 (0) --- rt_sigreturn(0x11) = 0 close(3) = 0 wait4(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 6039 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7ff9ce0c79d0) = 6046 wait4(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 6046 --- SIGCHLD (Child exited) @ 0 (0) --- rt_sigreturn(0x11) = 6046 write(1, "[Started: /etc/stunnel/stunnel.c"..., 37) = 37 write(1, "stunnel.\n", 9) = 9 exit_group(0) = ? [...] stunnel hangs in this line: wait4(-1, and when i plug in the network cable it continues to show [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 6046 Any help would be appreciated as this is critically blocking our deployment http://serverfault.com/questions/429072/stunnel-delaying-boot

2 6

[patch] options-related-to-TLS-v1.1-v1.2
by Henrik Riomar 21 Sep '12

21 Sep '12

Hi, When building stunnel against OpenSSL 1.0.1 support for TLS v1.1/v1.2 gets included. This patch adds options to configure these protocols in stunnel.conf. The patch is against 4.53 and under public domain. Best Regards, Henrik

2 3

"Broken pipe" issue
by Kai M. Becker 20 Sep '12

20 Sep '12

Hi :) although several postings state that this issue has been fixed, I'm still getting this error message: Error detected on SSL (read) file descriptor: Broken pipe (32) OS: OpenSuSE 11.4 stunnel: 4.53 The original problem for taking a closer look though, are hanging incoming connections. I.e. a https request is not forwarded to the backend application, but hangs somewhere in limbo. My current workaround are TIMEOUT* settings to kill these connections. Does anyone have some suggestions how to solve these issues? Kai -- == Kai M. Becker == kmb(a)kai-m-becker.de == Bremen, Germany == "Any technology distinguishable from magic is insufficiently advanced"

2 2

SSL renegotiation patch
by Janusz Dziemidowicz 19 Sep '12

19 Sep '12

Hi, since I couldn't find a better place I'm sending a simple patch that allows to disable SSL renegotiation here. Possible reasons for this: - famous renegotiation SSL flaw, patched in OpenSSL a long time ago, but not everyone can or want to upgrade OpenSSL - renegotiation makes some DoS attacks much easier (see http://www.thc.org/thc-ssl-dos/) regardless of it being a secure one or not - it is really not needed in many cases The approach is based on what is being done in Apache. The default is to allow renegotation, so there should be no surprises for anyone after upgrade. Patch applies on latest (4.54b4) stunnel beta. Feel free to comment:) -- Janusz Dziemidowicz

3 13

Re: [stunnel-users] Binding to non-local sockets
by Janusz Dziemidowicz 19 Sep '12

19 Sep '12

2012/9/12 Willy Tarreau <w(a)1wt.eu>: > Janusz, > > I just saw your mail on stunnel-users. You don't need to use IP_FREEBIND > to bind to a non-existent address under Linux. You can simply enable > sys.net.ipv4.ip_nonlocal_bind to do this. This is how most users deal > with VRRP setups. It does not allow the backup server to receive the > traffic aimed at the missing address, but it allows the process to bind > even when the address is missing so that it becomes operational upon a > switchover. I am aware of this sysctl. However, this will allows any process on the system to bind to any address. In my case I prefer to enable this on per process basis to avoid any possible configuration errors in any other service running on my machines. Since stunnel already had low level socket options exposed I've simply added IP_FREEBIND to the list;) -- Janusz Dziemidowicz

1 0