April 2026 - stunnel-users

client UDP 5093 -> TCP 5555 and vice versa in Server (TCP 5555 -> UDP 5093)
by admin＠igram.gr 19 Apr '26

19 Apr '26

Hi, I have a project where several students with IBM SPSS installed need to connect to a server where the IBM SPSS Network License Manager (Sentinel RMS) is installed and it requires that UDP port 5093 be open on the server's firewall to allow the clients to communicate and retrieve licenses. In my case this is not allowed in the firewall and I am trying to find solutions. One solution is to create VPN users to ensure that only allowed clients can communicate on this port (UDP 5093). But I prefer to keep the port closed for everyone. So the question is of it is possible with stunnel to convert / wrap e.g. by users the UDP port 5093, to "convert" it to TCP e.g. 5555 thus bypassing the firewall policy on the server side (TCP/UDP 5093 is not allowed), and on the server side to do the reverse, i.e. the "conversion" from TCP 5555 to UDP 5093 or is it a stupid idea? Has anyone done a similar project? THX John

2 1

[PATCH] checkPurpose configuration to circumvent EKU
by stunnel＠benary.org 14 Apr '26

14 Apr '26

From: benaryorg <binary(a)benary.org> What this does in a nutshell is to allow to use client certificates for servers, and server certificates for clients. This has become a relevant workaround for people using Let's Encrypt certificates for mutual TLS authentication (i.e. checkHost on both sides). Let's Encrypt, due to pressure from Google, have disabled client usage in their certificates, thereby causing issues in the latest renewals. https://letsencrypt.org/2025/05/14/ending-tls-client-authentication Any connections initiated by a client using a server certificate as to authenticate against a server cause a "unsuitable certificate purpose" on the server side and a TLS termination on the client side. This patch allows to simply override this check, for better or for worse. An earlier version was written with `checkPurpose` being allowed to occur multiple times (like `checkHost` and friends). However the value set does not support binary OR (it is simply sequentially numbered). Signed-off-by: benaryorg <binary(a)benary.org> --- doc/stunnel.8.in | 7 +++++++ doc/stunnel.html.in | 8 ++++++++ doc/stunnel.pod.in | 8 ++++++++ src/options.c | 35 +++++++++++++++++++++++++++++++++++ src/prototypes.h | 1 + src/verify.c | 3 +++ 6 files changed, 62 insertions(+) diff --git a/doc/stunnel.8.in b/doc/stunnel.8.in index db02292..4450715 100644 --- a/doc/stunnel.8.in +++ b/doc/stunnel.8.in @@ -460,6 +460,13 @@ addresses specified with \fIcheckIP\fR. Multiple \fIcheckIP\fR options are allowed in a single service section. .Sp This option requires OpenSSL 1.0.2 or later. +.IP "\fBcheckPurpose\fR = default | any | client | server" 4 +.IX Item "\fBcheckPurpose\fR = default | any | client | server" +verify the Extended Key Usage of the peer certificate +.Sp +Certificate verification only succeeds if the certificate purpose, +specifically the Extended Key Usage, matches the parameters specified with +\fIcheckPurpose\fR. .IP "\fBciphers\fR = CIPHER_LIST" 4 .IX Item "ciphers = CIPHER_LIST" select permitted TLS ciphers (TLSv1.2 and below) diff --git a/doc/stunnel.html.in b/doc/stunnel.html.in index 90e8556..6eca48e 100644 --- a/doc/stunnel.html.in +++ b/doc/stunnel.html.in @@ -552,6 +552,14 @@ This option requires OpenSSL 1.0.2 or later. +</dd> +<dt id="checkPurpose-default-any-client-server">checkPurpose = default | any | client | server</dt> +<dd> + +verify the Extended Key Usage of the peer certificate + +Certificate verification only succeeds if the certificate purpose, specifically the Extended Key Usage, matches the parameters specified with checkPurpose. + </dd> <dt id="ciphers-CIPHER_LIST">ciphers = CIPHER_LIST</dt> <dd> diff --git a/doc/stunnel.pod.in b/doc/stunnel.pod.in index 752359d..977a879 100644 --- a/doc/stunnel.pod.in +++ b/doc/stunnel.pod.in @@ -500,6 +500,14 @@ Multiple I<checkIP> options are allowed in a single service section. This option requires OpenSSL 1.0.2 or later. +=item B<checkPurpose> = default | any | client | server + +verify the Extended Key Usage of the peer certificate + +Certificate verification only succeeds if the certificate purpose, +specifically the Extended Key Usage, matches the parameters specified with +I<checkPurpose>. + =item B<ciphers> = CIPHER_LIST select permitted TLS ciphers (TLSv1.2 and below) diff --git a/src/options.c b/src/options.c index 800d1f3..2ed4111 100644 --- a/src/options.c +++ b/src/options.c @@ -1854,6 +1854,41 @@ NOEXPORT const char *parse_service_option(CMD cmd, SERVICE_OPTIONS **section_ptr break; } + /* checkPurpose */ + switch(cmd) { + case CMD_SET_DEFAULTS: + section->check_purpose=X509_PURPOSE_DEFAULT_ANY; + break; + case CMD_SET_COPY: + section->check_purpose=new_service_options.check_purpose; + break; + case CMD_FREE: + break; + case CMD_SET_VALUE: + if(strcasecmp(opt, "checkPurpose")) + break; + if(!strcasecmp(arg, "default")) { + section->check_purpose=X509_PURPOSE_DEFAULT_ANY; + } else if(!strcasecmp(arg, "any")) { + section->check_purpose=X509_PURPOSE_ANY; + } else if(!strcasecmp(arg, "client")) { + section->check_purpose=X509_PURPOSE_SSL_CLIENT; + } else if(!strcasecmp(arg, "server")) { + section->check_purpose=X509_PURPOSE_SSL_SERVER; + } else { + return "The argument needs to be one of: default, any, client, server"; + } + return NULL; /* OK */ + case CMD_INITIALIZE: + break; + case CMD_PRINT_DEFAULTS: + break; + case CMD_PRINT_HELP: + s_log(LOG_NOTICE, "%-22s = client|server check for extended key usage", + "checkPurpose"); + break; + } + #endif /* OPENSSL_VERSION_NUMBER>=0x10002000L */ /* ciphers */ diff --git a/src/prototypes.h b/src/prototypes.h index 1142993..fde3da9 100644 --- a/src/prototypes.h +++ b/src/prototypes.h @@ -303,6 +303,7 @@ struct service_options_struct { NAME_LIST *check_host, *check_email, *check_ip; /* cert subject checks */ NAME_LIST *config; /* OpenSSL CONF options */ #endif /* OPENSSL_VERSION_NUMBER>=0x10002000L */ + int check_purpose; /* Extended Key Usage */ /* service-specific data for ctx.c */ char *cipher_list; diff --git a/src/verify.c b/src/verify.c index 7bab21e..e7dfe9f 100644 --- a/src/verify.c +++ b/src/verify.c @@ -78,6 +78,9 @@ int verify_init(SERVICE_OPTIONS *section) { verify_mode|=SSL_VERIFY_FAIL_IF_NO_PEER_CERT; } SSL_CTX_set_verify(section->ctx, verify_mode, verify_callback); + if(section->check_purpose) { + SSL_CTX_set_purpose(section->ctx, section->check_purpose); + } auth_warnings(section); -- 2.53.0

2 2

stunnel 5.78 released
by Michał Trojnara 10 Apr '26

10 Apr '26

Dear Users, I have released version 5.78 of stunnel. ### Version 5.78, 2026.04.09, urgency: MEDIUM * Security bugfixes - OpenSSL DLLs updated to version 3.5.6. * Bugfixes - Fixed WIN32 transfer() loop errors with OOB TCP. - Fixed a memory leak introduced in version 5.73. - Build fix for systems without timegm() (thanks to Jose A. Diaz and Shubham Gupta). - Fixed a startup crash when both global (default) and service-level lists of values are configured for an option. * Features - Support for zstd and brotli compression with OpenSSL 3.2 and TLS 1.2 or older. - WIN32 OpenSSL build with zlib and zstd support. - Support for new "options" parameter values. - Less bloated errors on an invalid configuration file. - Documentation updated from Pod to Pandoc Markdown. - Removed support for OpenSSL versions older than 0.9.8. The final update for the OpenSSL 0.9.7 branch (0.9.7m) was issed on 23 Feb 2007. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 8727e53bb8b7528f850327a2a149158422c02183bc120d1d733cc65b1e2c349d stunnel-5.78.tar.gz 541700197ce2e03dd86b343d9cbf6434359cca9f44e6927fde1d2c76c355c3e6 stunnel-5.78-win64-installer.exe b585d0828165d2e317f3956f2657fa6fb265b34b3ff49181bf561acd8eea2500 stunnel-5.78-android.zip Best regards, Mike

5 6