- stunnel-users - stunnel.org

stunnel 4.36 released
by Michal Trojnara 03 May '11

03 May '11

Dear Users, Version 4.36 of stunnel was released. The ChangeLog entry: Version 4.36, 2011.05.03, urgency: LOW: * New features - Updated Win32 DLLs for OpenSSL 1.0.0d. - Dynamic memory management for strings manipulation: no more static STRLEN limit, lower stack footprint. - Strict public key comparison added for "verify = 3" certificate checking mode (thx to Philipp Hartwig). - Backlog parameter of listen(2) changed from 5 to SOMAXCONN: improved behavior on heavy load. - Example tools/stunnel.service file added for systemd service manager. * Bugfixes - Missing pthread_attr_destroy() added to fix memory leak (thx to Paul Allex and Peter Pentchev). - Fixed the incorrect way of setting FD_CLOEXEC flag. - Fixed --enable-libwrap option of ./configure script. - /opt/local added to OpenSSL search path for MacPorts compatibility. - Workaround implemented for signal handling on MacOS X. - A trivial bug fixed in the stunnel.init script. - Retry implemented on EAI_AGAIN error returned by resolver calls. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.36.tar.gz: 3483fc2011e8a9d2614a93a9dbf7eabf405044df3566f29144fe2d1dd37a35f5 Best regards, Mike

3 2

Re: [stunnel-users] need help error :SSL3_GET_RECORD:wrong versionnumber with cipher DES-CBC-SHA
by josealf＠rocketmail.com 03 May '11

03 May '11

Laurent, Can you post your configuration? For security, You should change the real IPs (but not the ports) before posting. You can check: 1. Does your stunnel client config has client=yes? 2. Does your stunnel server config has client=no 3. Check your packet flow, that is: your accept/connect settings. Regards Jose -----Original Message----- From: laurent.uk(a)bnpparibas.com Sender: stunnel-users-bounces(a)stunnel.org Date: Tue, 3 May 2011 14:16:09 To: <stunnel-users(a)stunnel.org> Subject: [stunnel-users] need help error :SSL3_GET_RECORD:wrong version number with cipher DES-CBC-SHA _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

Re: [stunnel-users] Temporary failure in name resolution (Michal Trojnara)
by Phil Wieland 29 Apr '11

29 Apr '11

I attach two strace reports, strace-good shows a successful use, strace-bad shows it failing after a reboot. In both cases I just telnet to localhost 55899, which gives the smtp server's banner in the good case. ltrace craps out with a [pid 1107] +++ killed by SIGTRAP +++ in both cases, and doesn't show anything useful. These are WITHOUT the suggested patch, I am not really equipped for building on this server. Phil

2 1

Re: [stunnel-users] Réf. : Re: Tr : Réf. : Re: Need some informations about stunnel(AC,?crl ?files)
by Ludolf Holzheid 29 Apr '11

29 Apr '11

On Fri, 2011-04-29 15:39:45 +0200, laurent.uk(a)bnpparibas.com wrote: > Dear Ludolf thank you for your response. > > I have another question. > > Is it possible to have 2 stunnel running on the same server? > > 1 stunnel with no client's certificate verification (verify = 0) with a > specific port > > and 1 stunnel with client's certificate verification (verify = 3) with > other specific port You may run as many instances of stunnel as you like, as long as they don't share listening ports (accept=...) or pid files (pid=...). Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Re: [stunnel-users] Tr : Réf. : Re: Need some informations about stunnel (AC,?crl?files)
by Ludolf Holzheid 28 Apr '11

28 Apr '11

On Thu, 2011-04-28 17:06:28 +0200, laurent.uk(a)bnpparibas.com wrote: > Dear Ludolf i need some help with the verify option. > > I want to check the certificate client in my machine and also check if the > certificate's client is in the crl list. > > You said that " > If you are using verify=3, stunnel checks client certificates against > the set of certificates in CApath or CAfile, not against CAs and CRLs." > > Is it possible to check client certificates with certificates in CaPath > and also with CRls? Laurent, By installing a certificate (to CApath or CAfile), you express your trust in the certificate. For the client certificates, you could either o implicitly trust all certificates signed by an installed CA certificate and not yet revoked (verify=2), or o explicitly trust installed client certificates (verify=3). In both cases, all installed certificates are fully trusted. Cross-checking a trusted (client-) certificate against an other trusted (CA-) certificate does not raise security or trustworthiness. In order to revoke a client certificate in verify=3 mode, just uninstall it. Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Delay before sending server hello
by Dan Price 28 Apr '11

28 Apr '11

I am using stunnel to accept TLS connections. I'm opening eight connections at virtually the same time, and occasionally see that for one of the connections, the handshake does not complete - stunnel does not send the server hello, and the client usually resets the connection. I did manage to capture one instance where stunnel sends the server hello, but it is delayed by over a minute. I upgraded to version 4.35, and I see the same behavior. I set debug=debug, and captured what I think are the relevant logs (through write server hello). I kept the logs for the successful connection (59924) that came in after the failed one (59923). Apr 27 13:21:22 cm stunnel: LOG7[10357:1431918272]: local socket: FD=15 allocated (non-blocking mode) Apr 27 13:21:22 cm stunnel: LOG7[10357:1431918272]: Service msrp accepted FD=15 from ::ffff:10.50.2.11:59923 Apr 27 13:21:22 cm stunnel: LOG7[10357:1431918272]: local socket: FD=16 allocated (non-blocking mode) Apr 27 13:21:22 cm stunnel: LOG7[10357:1431918272]: Service msrp accepted FD=16 from ::ffff:10.50.2.11:59924 Apr 27 13:21:22 cm stunnel: LOG7[10357:1431989136]: Service msrp started Apr 27 13:21:22 cm stunnel: LOG7[10357:1431989136]: Waiting for a libwrap process Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: Service msrp started Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: Waiting for a libwrap process Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: Acquired libwrap process #1 Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: Releasing libwrap process #1 Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: Released libwrap process #1 Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: Service msrp permitted by libwrap from ::ffff:10.50.2.11:59924 Apr 27 13:21:22 cm stunnel: LOG5[10357:1433471888]: Service msrp accepted connection from ::ffff:10.50.2.11:59924 Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: SSL state (accept): before/accept initialization Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: SSL state (accept): SSLv3 read client hello A Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: SSL state (accept): SSLv3 write server hello A Apr 27 13:22:38 cm stunnel: LOG7[10357:1431989136]: Acquired libwrap process #4 Apr 27 13:22:38 cm stunnel: LOG7[10357:1431989136]: Releasing libwrap process #4 Apr 27 13:22:38 cm stunnel: LOG7[10357:1431989136]: Released libwrap process #4 Apr 27 13:22:38 cm stunnel: LOG7[10357:1431989136]: Service msrp permitted by libwrap from ::ffff:10.50.2.11:59923 Apr 27 13:22:38 cm stunnel: LOG5[10357:1431989136]: Service msrp accepted connection from ::ffff:10.50.2.11:59923 Apr 27 13:22:38 cm stunnel: LOG7[10357:1431989136]: SSL state (accept): before/accept initialization Apr 27 13:22:38 cm stunnel: LOG7[10357:1431989136]: SSL state (accept): SSLv3 read client hello A Apr 27 13:22:38 cm stunnel: LOG7[10357:1431989136]: SSL state (accept): SSLv3 write server hello A Thanks, Dan

1 0

Does stunnel support startTLS?
by Markus Borst 28 Apr '11

28 Apr '11

Stunnel supports encryption in the "old" ssl style extra port configuration (i.e. imaps on port 993) where the encryption is negotiated immediately upon start of the connection. Does stunnel also support the startTLS method? i.e. a clear text connection is established (imap on port 143) and one of the first imap commands is startTLS, which negotiates the encryption and protects the connection from that time onwards. I know that supporting startTLS is a lot harder, since it means sniffing commands in the higher level protocol, but we need it nevertheless. (In fact, our imap server does support startTLS, but it does _not_ support importing an external certificate, which is why I'm looking for an external solution.) From reading the documentation I'm not sure whether stunnel supports startTLS, there are a few option descriptions which might point to startTLS, but I'm not sure. Anybody knows the definite answer? Greetings Markus Borst -- TU Darmstadt Hochschulrechenzentrum (HRZ) Markus Borst Adresse: Petersenstrasse 30, 64287 Darmstadt, Germany Tel.: 06151/16-2056 Email: M.Borst(a)hrz.tu-darmstadt.de

2 3

Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/accept initialization
by Jack Liu 28 Apr '11

28 Apr '11

Thx for continuing reply my msg, Yes, there is var/log/messages Inside there only has some iptables log, FTP, SMTP application log and nothing else. I am positive that this problem is not cause by iptables, becuase I tried with iptables off. Nothing else related to stunnel is found in that folder. Any other suggestions? Mr. Jack > From: sunyucong(a)gmail.com > Date: Mon, 25 Apr 2011 20:00:30 -0700 > Subject: Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/accept initialization > To: jackliu92(a)hotmail.com > CC: stunnel-users(a)stunnel.org > > I guess in centos that's /var/log/messages > but in general, you should probably check everything in /var/log to make sure. > > On Mon, Apr 25, 2011 at 5:38 PM, Jack Liu <jackliu92(a)hotmail.com> wrote: > > Thank you for helping, but both logs r not presented in my var/log/ dir. Any > > other suggestions? > > > > > > Mr. Jack > > > > > > > > > > > >> From: sunyucong(a)gmail.com > >> Date: Mon, 25 Apr 2011 16:25:20 -0700 > >> Subject: Re: [stunnel-users] Stunnel stuck at SSL state (accept): > >> before/accept initialization > >> To: jackliu92(a)hotmail.com > >> CC: stunnel-users(a)stunnel.org > >> > >> Are you sure that's entire log? check /var/log/daemons.log and > >> syslog.log as well. > >> > >> On Sun, Apr 24, 2011 at 1:30 AM, Jack Liu <jackliu92(a)hotmail.com> wrote: > >> > It anyone knows how to fix Stunnel stuck at SSL state (accept): > >> > before/accept initialization??? > >> > > >> > Here is the log: > >> > > >> > ----------------------------------------------------------------------------------------------------------- > >> > [root@vps1 ~]#stunnel /etc/stunnel/stunnel.conf > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Snagged 64 random bytes from > >> > /root/.rnd > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Wrote 1024 new random bytes > >> > to > >> > /root/.rnd > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: RAND_status claims > >> > sufficient > >> > entropy for the PRNG > >> > 2011.04.24 02:25:13 LOG6[32174:3085993680]: PRNG seeded successfully > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Certificate: > >> > /etc/stunnel/stunnel.pem > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Key file: > >> > /etc/stunnel/stunnel.pem > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Verify directory set to > >> > /etc/stunnel/CA > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: CRL directory set to > >> > /etc/stunnel/CRL > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: SSL context initialized for > >> > service 3proxy > >> > 2011.04.24 02:25:13 LOG5[32174:3085993680]: stunnel 4.15 on > >> > i686-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 > >> > 2011.04.24 02:25:13 LOG5[32174:3085993680]: Threading:PTHREAD SSL:ENGINE > >> > Sockets:POLL,IPv6 Auth:LIBWRAP > >> > 2011.04.24 02:25:13 LOG6[32174:3085993680]: file ulimit = 1024 (can be > >> > changed with 'ulimit -n') > >> > 2011.04.24 02:25:13 LOG6[32174:3085993680]: poll() used - no FD_SETSIZE > >> > limit for file descriptors > >> > 2011.04.24 02:25:13 LOG5[32174:3085993680]: 500 clients allowed > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 3 in non-blocking mode > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 4 in non-blocking mode > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 5 in non-blocking mode > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: SO_REUSEADDR option set on > >> > accept socket > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: 3proxy bound to > >> > 0.0.0.0:30001 > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Created pid file > >> > /var/run/stunnel.pid > >> > 2011.04.24 02:25:20 LOG7[32174:3085993680]: 3proxy accepted FD=6 from > >> > xx.xxx.xxx.xx:41165 > >> > 2011.04.24 02:25:20 LOG7[32174:3085990800]: 3proxy started > >> > 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 6 in non-blocking mode > >> > 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 7 in non-blocking mode > >> > 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 8 in non-blocking mode > >> > 2011.04.24 02:25:20 LOG7[32174:3085993680]: Cleaning up the signal pipe > >> > 2011.04.24 02:25:20 LOG6[32174:3085993680]: Child process 32176 finished > >> > with code 0 > >> > 2011.04.24 02:25:20 LOG7[32174:3085990800]: Connection from > >> > xx.xxx.xxx.xx:41165 permitted by libwrap > >> > 2011.04.24 02:25:20 LOG5[32174:3085990800]: 3proxy connected from > >> > xx.xxx.xxx.xx:41165 > >> > 2011.04.24 02:25:20 LOG7[32174:3085990800]: SSL state (accept): > >> > before/accept initialization <-----------------------Stuck here > >> > forever!!! > >> > 2011.04.24 02:25:22 LOG3[32174:3085990800]: SSL_accept: Peer suddenly > >> > disconnected > >> > 2011.04.24 02:25:22 LOG5[32174:3085990800]: Connection reset: 0 bytes > >> > sent > >> > to SSL, 0 bytes sent to socket > >> > 2011.04.24 02:25:22 LOG7[32174:3085990800]: 3proxy finished (0 left) > >> > 2011.04.24 02:25:25 LOG3[32174:3085993680]: Received signal 2; > >> > terminating > >> > 2011.04.24 02:25:25 LOG7[32174:3085993680]: removing pid file > >> > /var/run/stunnel.pid > >> > [root@vps1 ~]# > >> > > >> > ----------------------------------------------------------------------------------------------------------- > >> > stunnel.conf: > >> > cert = /etc/stunnel/stunnel.pem > >> > key = /etc/stunnel/stunnel.pem > >> > CApath = /etc/stunnel/CA > >> > CRLpath = /etc/stunnel/CRL > >> > debug = 7 > >> > foreground = yes > >> > verify = 1 > >> > # > >> > [3proxy] > >> > accept = 30001 > >> > connect = 127.0.0.1:33135 > >> > > >> > ----------------------------------------------------------------------------------------------------------- > >> > > >> > I am hosting with CentOS 5.5, and installed Stunnel via yum. > >> > Planning to use it with 3Proxy. However I experience the problem above, > >> > can > >> > someone please help with that? > >> > Thank you very much! > >> > > >> > > >> > > >> > Mr. Jack > >> > > >> > _______________________________________________ > >> > stunnel-users mailing list > >> > stunnel-users(a)stunnel.org > >> > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > >> > > >> > > >

3 6

Patch to enhance verify=3 with SHA-1 check
by Philipp Hartwig 27 Apr '11

27 Apr '11

As indicated in a previous mail to this list I was surprised by the following behavior: With "verify=3" stunnel doesn't compare the peer's certificate with the locally installed certificate for actual equality but it only checks whether they have the same subject. The recent Comodo incident[1] has shown that it is not impossible to get a certificate which matches the subject of the certificate of some interesting server and is signed by a trusted CA. That's why I was interested in a stricter form of verification (at least in client mode). I have attached a small patch, derived from code in the file "mutt_ssl.c" of the Mutt[2] mail client, which adds a check for equality of SHA-1 hashes to the "verify=3" certificate check. I mainly wrote it for personal use but maybe someone else will find it useful or has some comments. Regards, Philipp [1] http://blog.mozilla.com/security/2011/03/25/comodo-certificate-issue-follow… [2] http://www.mutt.org/

1 0

Re: [stunnel-users] Réf. : Re: Need some informations about stunnel (AC,?crl?files)
by Ludolf Holzheid 27 Apr '11

27 Apr '11

On Wed, 2011-04-27 13:06:43 +0200, laurent.uk(a)bnpparibas.com wrote: > Dear ludolf thanks you for your response. > > So if i use verify = 3, the crl files is useless. > > I went to the url http://crl.verisign.com , and there were a lot of files. > > what are the files corresponding of the crl list please? Those with the ".crl" extension, I suppose ;-) You'll need to look for the CRLs matching the certificates you want to use. Note, there may be CRLs for intermediate certificates too. At least (the randomly selected) Class3SoftwarePublishers.crl seems to be in DES format, you might have to convert it to PEM for use with stunnel. Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0