- stunnel-users - stunnel.org

Exception 40000015 STATUS_FATAL_APP_EXIT
by alexwaskilledfriendlyfire＠gmail.com 11 Dec '17

11 Dec '17

Hello Stunnel-users, Well, I have a problem with latest stunnel-5.44-win32 build. Both GUI and console versions won't to start throwing unhandled exception: tstunnel.exe: Problem signature: Problem Event Name: APPCRASH Application Name: tstunnel.exe Application Version: 0.0.0.0 Application Timestamp: 5a18f4f5 Fault Module Name: tstunnel.exe Fault Module Version: 0.0.0.0 Fault Module Timestamp: 5a18f4f5 Exception Code: 40000015 Exception Offset: 0000e43d OS Version: 6.1.7601.2.1.0.256.4 Locale ID: 1049 Additional Information 1: 57b4 Additional Information 2: 57b4bc5bbe66a065d3bc087357c09646 Additional Information 3: f6bb Additional Information 4: f6bb7b9b6fcf2c5cdb238bc389e9ede9 And GUI version stunnel.exe: --------------------------- Microsoft Visual C++ Runtime Library --------------------------- Runtime Error! Program: C:\Progs\Stunnel\bin\stunnel.exe This application has requested the Runtime to terminate it in an unusual way. Please contact the application's support team for more information. --------------------------- OK --------------------------- Problem signature: Problem Event Name: APPCRASH Application Name: stunnel.exe Application Version: 5.44.0.0 Application Timestamp: 5a18f4f3 Fault Module Name: stunnel.exe Fault Module Version: 5.44.0.0 Fault Module Timestamp: 5a18f4f3 Exception Code: 40000015 Exception Offset: 0000e43d OS Version: 6.1.7601.2.1.0.256.4 Locale ID: 1049 Additional Information 1: 2de9 Additional Information 2: 2de98e0ccee9cc0b77f8fe3f51196ec8 Additional Information 3: 42db Additional Information 4: 42db6f5f1de1e71ee661917dbb7cc0c8 Completely fresh isntallation (or deleting config folder) doesn't solve my problem. My OS is legal Windows 7 x64 with latest updates. There are screenshots just for case. https://i.imgur.com/N1kPI9J.jpg https://i.imgur.com/CqMXWtx.jpg Probably I missing some DLL or service running but it's not an option to turn everything ON (and copy every single DLL ever made to my PC) to determine which one is not running. Probably it's something else. I need help. Thanks. -- Best regards, Alexwaskilledfriendlyfire mailto:alexwaskilledfriendlyfire@gmail.com

2 3

[patch] Fix build with LibreSSL
by Piotr Kubaj 06 Dec '17

06 Dec '17

Building against LibreSSL currently fails. Could you commit this patch? It builds fine on FreeBSD 11.1-RELEASE against LibreSSL 2.6.3. Since it doesn't change anything for OpenSSL, it should build against it too. -- ______________________________________ / A nickel ain't worth a dime anymore. \ | | \ -- Yogi Berra / -------------------------------------- \ ^__^ \ (oo)\_______ (__)\ )\/\ ||----w | || ||

1 0

possibility to delay connect to host
by Paavo Sild 04 Dec '17

04 Dec '17

Hello! I am a bit new to stunnel and while I tried to search the message archive I did not find any possible reference to the issue I try to solve. I am running a bit older version of stunnel as a simple reverse proxy. It accepts incoming TLS connection and opens clear TCP connection to a host specified by "connect" parameter in config. I wander - it is possible to delay the opening of TCP connection to a host until the actual data is received from client? I haven't found any reference to such a possibility in stunnel but thought that it worth to ask from community. The issue is that due to the nature of traffic there are instances then client negotiates the SSL connection but there is no actual data to be sent by the client. By opening the connection to host only when actual data is present would filter out unnecessary connections towards the application. Anybody had such an issue to solve? -- rgds, Paavo Sild --------------------- paavo.sild(a)estcard.ee ---------------------

1 0

routines:ssl3_read_bytes:sslv3 alert certificate unknown
by Ziad Badawi 04 Dec '17

04 Dec '17

Greetings, I am trying to capture clear text pcaps from client (browser) - server (java appserver) traffic. The java appserver is jboss using https. I'm running jboss and stunnel on the same machine. # stunnel.conf debug = 3 foreground = yes [jboss] client = yes cert= stunnel.pem # generated using makecert.sh accept = 1234 connect = 127.0.0.1:443 Version: stunnel 5.44 on x86_64-pc-linux-gnu platform Compiled/running with OpenSSL 1.0.2k-fips 26 Jan 2017 Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Global options: RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = HIGH:!DH:!aNULL:!SSLv2 (with "fips = no") curve = prime256v1 debug = daemon.notice logId = sequential options = NO_SSLv2 options = NO_SSLv3 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none When I try to test it usng firefox by browsing to https://localhost:1234, FF returns "Secure Connection Failed" and stunnel spits 2017.12.01 20:35:10 LOG3[0]: SSL_connect: 14094416: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown What am I missing / doing wrong? Regards Z

2 2

Stunnel 5.43 problem
by Carter Browne 15 Nov '17

15 Nov '17

When running stunnel 5.43 on Linux 4.14 (arm), accept = port only listens on 127.0.0.1:port. I don't know if other operating systems are affected. Carter

1 0

Re: [stunnel-users] TLS "translation" & 2-way auth
by Igor Gatis 15 Nov '17

15 Nov '17

It would be nice to know whether it is actually possible to achieve this with stunnel. If not, is there any other tool I could use or combine? On Nov 13, 2017 08:58, "Igor Gatis" <igorgatis(a)gmail.com> wrote: Yep, that's exactly what I'm seeking for help here. If we can abstract the 2-way bit for a second, I'd call this a "certificate transcription" TLS tunnel. On Thu, Nov 9, 2017 at 5:19 PM, Vincent Deschenes <vdeschenes(a)stelvio.com> wrote: > Ho, > > But that does not account for the A ->[TLS] ->B part. > > I believe that my sample will listen for unencrypted connection only. > > > > > > *From:* stunnel-users [mailto:stunnel-users-bounces@stunnel.org] *On > Behalf Of *Vincent Deschenes > *Sent:* Thursday, 9 November 2017 3:16 PM > *To:* Igor Gatis <igorgatis(a)gmail.com>; stunnel-users(a)stunnel.org > *Subject:* Re: [stunnel-users] TLS "translation" & 2-way auth > > > > You need to have a section in your config file which listen for requests > but also have the “client = yes” option with a cert and key like this: > > > > [http_a_to_c] > > client = yes > > accept = port_number_to_listen_on_server_b > > connect = server_c_address:443 > > cert = certificate.crt > > key = private.key > > > > > > cert and key are the certificate and private key server B uses to identify > itself on server C. > > You could also add more options to specify a trustore to specify which > cert coming from server C server B will trust, otherwise server B will > simply allow the connection. > > > > Good Luck > > > > > > *From:* stunnel-users [mailto:stunnel-users-bounces@stunnel.org > <stunnel-users-bounces(a)stunnel.org>] *On Behalf Of *Igor Gatis > *Sent:* Thursday, 9 November 2017 1:14 PM > *To:* stunnel-users(a)stunnel.org > *Subject:* [stunnel-users] TLS "translation" & 2-way auth > > > > Consider scenario below: > > > > Server A ==TLS==> Server B ==TLS+2WayAuth==> Server C > > > > Server A needs to connect to Server C through Server B which runs Stunnel. > Server C requires 2-way authentication. I have full control over Server A > and Server B and Server C belongs to a third-party. > > > > What does Stunnel config should look like? > > >

3 2

Re: [stunnel-users] Possible stunnel 5.43 bug ?
by Bezspam 15 Nov '17

15 Nov '17

Hello, The patch fixed the problem. Thank you very much! Best regards, Bez Spam Sent with [ProtonMail](https://protonmail.com) Secure Email. > -------- Original Message -------- > Subject: Re: [stunnel-users] Possible stunnel 5.43 bug ? > Local Time: November 15, 2017 7:15 AM > UTC Time: November 15, 2017 7:15 AM > From: Michal.Trojnara(a)stunnel.org > To: stunnel-users(a)stunnel.org <stunnel-users(a)stunnel.org> > > On 11/14/2017 01:33 PM, Bezspam wrote: > >> Is this a bug or expected behaviour? >> Best regards, >> Bez Spam >> >> Dear Bez, >> >> I confirm this is a bug. A patch that fixes it is: >> ftp://ftp.stunnel.org/stunnel/accept.patch >> >> There will be a bugfix release of stunnel later this week. >> >> Best regards, >> Mike > > --------------------------------------------------------------- > > stunnel-users mailing list > stunnel-users(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Ubuntu 16.04 problem
by Carter Browne 14 Nov '17

14 Nov '17

I have a very confusing problem with stunnel on Ubuntu. I have a configuration file that I have used in both Windows and Arch Linux. In the Arch version, I use a single file with all the certificates for the partner systems, in the Windows version I use a capath directory. I have tried both here and I always get the response "tlsv1 alert unknown ca". The beginning of the stunnel.conf file is below. Any hints would be appreciated. Carter cert = /etc/stunnel/xxxxxxx.pem key = /etc/stunnel/xxxxxxx.pem fips = no # Enable client mode client = yes ; Some security enhancements for UNIX systems - comment them out on Win32 #chroot = /var/run/stunnel/ #setuid = stunnel #setgid = stunnel ; PID is created inside chroot jail pid = /etc/stunnel/stunnel.pid ; Some performance tunings # Debug and Foreground are for testing socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 # Uncomment for debugging stunnel problems debug = 5 output = /etc/stunnel/stunnel.log ##foreground = yes ; NO SSLv2 options = NO_SSLv3 sslVersion = all Ciphers = ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:ECDH-RSA-AES256-SHA:ECDH-ECDSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDH-RSA-AES128-SHA:ECDH-ECDSA-AES128-SHA # # Uncomment and modify the CAFile to point to your ca.txt file #CAFile = /etc/stunnel/all.pem CAPath = /etc/stunnel/capath #CAPath = @sysconfdir/ssl/certs # Uncomment and modify the verify to enable CA validation # verifyChain = no VerifyPeer = yes

1 0

Possible stunnel 5.43 bug ?
by Bezspam 14 Nov '17

14 Nov '17

Hello, I use stunnel on FreeBSD 11.1. I install it from ports. Yesterday I updated to stunnel 5.43. However it stopped working. I investigated the problem and found the issue- instead on all network interfaces, "accept" listens on 127.0.0.1 : sockstat -4 USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS stunnel stunnel 43945 7 tcp4 127.0.0.1:2222 *:* stunnel stunnel 43945 8 tcp4 127.0.0.1:3128 *:* stunnel stunnel 43945 9 tcp4 127.0.0.1:8080 *:* stunnel stunnel 43945 10 tcp4 127.0.0.1:1616 *:* A workaround is to modify "accept = 0.0.0.0:3128" explicitly to listen on 0.0.0.0. Is this a bug or expected behaviour? Best regards, Bez Spam

2 1

TLS "translation" & 2-way auth
by Igor Gatis 13 Nov '17

13 Nov '17

Consider scenario below: Server A ==TLS==> Server B ==TLS+2WayAuth==> Server C Server A needs to connect to Server C through Server B which runs Stunnel. Server C requires 2-way authentication. I have full control over Server A and Server B and Server C belongs to a third-party. What does Stunnel config should look like?

2 3