- stunnel-users - stunnel.org

Re: [stunnel-users] Is there a way to specify certificate content in stunnel config
by Eric S Eberhard 24 Jul '18

24 Jul '18

Use stunnel in inetd mode. Execute a script (or better C program). Copy the certificates for making the stunnel connection to a directory that is OK … then delete them immediately after stunnel starts. Hack – but might be OK for what you are doing. I am not sure why anyone would think it more secure to put the keys into the stunnel command than to just use them from a file … but I likely do not know enough about your application to make a judgement. Eric Eric S Eberhard VICS (Vertical Integrated Computer Systems) Voice: 928 567 3529 Cell : 928 301 7537 (not reliable except for text or if not home) 2933 W Middle Verde Rd Camp Verde, AZ 86322 From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Hari Sent: Thursday, July 19, 2018 4:42 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Is there a way to specify certificate content in stunnel config Hi, I have a requirement where in i cannot specify the certificate and/or private key details as "files" to stunnel configuration, owing to the location and/or file system availability for stunnel to access them. Is there a way to specify the actual certificate content in stunnel configuration (similar to other parameters like port numbers etc.,) so that the same can be leveraged. Thanks Hari <http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_cam…> Virus-free. <http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_cam…> www.avg.com

3 2

Grok log parsing
by Manuele Trimarchi 24 Jul '18

24 Jul '18

I would ask if someone use Grok log parsing for stunnel and, if yes, what kind of filter statement are you using? At the moment I've just created 2 parser: STUNNEL_AcceptedConnectionParser %{date("yyyy.MM.dd HH:mm:ss"):date} LOG%{integer:loglevel}\[%{integer:session_id}\]\: Service \[%{word:csb_name}\-%{word:csb_port}\] accepted connection from %{ipv4:caller_ip}\:%{port:caller_port} and STUNNEL_ConnectionClosedParser %{date("yyyy.MM.dd HH:mm:ss"):date} LOG%{integer:loglevel}\[%{integer:session_id}\]\: Connection closed\: %{integer:byte_tx} byte$s$ sent to SSL\, %{integer:byte_rx} byte$s$ sent to socket I'm new with Grok and all the things related to log match-and-parse, so I think that there will be a much better solution than mine, anyway Google this time doesn't help unfortunately. Thank you so much to all those who will help me with this stuff! Manuele

1 1

Cross Compiling Stunnel-5.48 Using BoringSSL
by Jaymin D 24 Jul '18

24 Jul '18

Hi All, I want to cross compile the Stunnel-5.48 for my Android AOSP (arch64) platform using BoringSSL's 'libssl.so' and 'libcrypto.so' libraries. I have successfully cross compiled the BoringSSL in my AOSP and both .so file was generated for arch64 platform. Am using BoringSSL which was delivered with Android AOSP (Android 7). Am cross compiling using "build-android.sh" script. But, while cross compiling the Stunnel-5.48 facing error as below: ------------------------------------------------------------------------------------------------ VERSION=5.48 > DST=stunnel-$VERSION-android > # to build OpenSSL: > # ./Configure threads no-shared no-dso > --cross-compile-prefix=arm-linux-androideabi- > --prefix=/opt/androideabi/sysroot linux-armv4 > # make install > LDFLAGS="$LDFLAGS -L/home/jaymin/Desktop/boringssl_lib -fPIE" > export LDFLAGS > test -f Makefile && make distclean > mkdir -p bin/android > cd bin/android > ../../configure --with-pic --enable-shared --with-sysroot > --host=aarch64-linux-android --with-ssl=/home/jaymin/Desktop/boringssl_lib > configure: **************************************** initialization > checking for a BSD-compatible install... /usr/bin/install -c > checking whether build environment is sane... yes > checking for aarch64-linux-android-strip... no > checking for strip... strip > checking for a thread-safe mkdir -p... /bin/mkdir -p > checking for gawk... gawk > checking whether make sets $(MAKE)... yes > checking whether make supports nested variables... yes > checking build system type... x86_64-pc-linux-gnu > checking host system type... aarch64-unknown-linux-android > checking for aarch64-linux-android-gcc... no > checking for gcc... gcc > checking whether the C compiler works... yes > checking for C compiler default output file name... a.out > checking for suffix of executables... > checking whether we are cross compiling... no > checking for suffix of object files... o > checking whether we are using the GNU C compiler... yes > checking whether gcc accepts -g... yes > checking for gcc option to accept ISO C89... none needed > checking whether gcc understands -c and -o together... yes > checking for style of include used by make... GNU > checking dependency style of gcc... gcc3 > checking whether make sets $(MAKE)... (cached) yes > checking whether make supports nested variables... (cached) yes > configure: **************************************** thread model > checking for a sed that does not truncate output... /bin/sed > checking how to run the C preprocessor... gcc -E > checking for grep that handles long lines and -e... /bin/grep > checking for egrep... /bin/grep -E > checking whether gcc is Clang... no > checking whether pthreads work with -pthread... yes > checking for joinable pthread attribute... PTHREAD_CREATE_JOINABLE > checking whether more special flags are required for pthreads... no > checking for PTHREAD_PRIO_INHERIT... yes > configure: PTHREAD thread model detected > configure: **************************************** compiler/linker flags > checking whether C compiler accepts -Wall... yes > checking whether C compiler accepts -Wextra... yes > checking whether C compiler accepts -Wpedantic... yes > checking whether C compiler accepts -Wformat=2... yes > checking whether C compiler accepts -Wconversion... yes > checking whether C compiler accepts -Wno-long-long... yes > checking whether C compiler accepts -Wno-deprecated-declarations... yes > checking whether C compiler accepts -fPIE... yes > checking whether C compiler accepts -fstack-protector... yes > checking whether the linker accepts -fPIE... yes > checking whether the linker accepts -pie... yes > checking whether the linker accepts -Wl,-z,relro... yes > checking whether the linker accepts -Wl,-z,now... yes > checking whether the linker accepts -Wl,-z,noexecstack... yes > checking whether C compiler accepts -D_FORTIFY_SOURCE=2... yes > configure: **************************************** libtool > checking how to print strings... printf > checking for a sed that does not truncate output... (cached) /bin/sed > checking for fgrep... /bin/grep -F > checking for ld used by gcc... /usr/bin/ld > checking if the linker (/usr/bin/ld) is GNU ld... yes > checking for BSD- or MS-compatible name lister (nm)... no > checking for aarch64-linux-android-dumpbin... no > checking for aarch64-linux-android-link... no > checking for dumpbin... no > checking for link... link -dump > checking the name lister (nm) interface... BSD nm > checking whether ln -s works... yes > checking the maximum length of command line arguments... 1572864 > checking how to convert x86_64-pc-linux-gnu file names to > aarch64-unknown-linux-android format... func_convert_file_noop > checking how to convert x86_64-pc-linux-gnu file names to toolchain > format... func_convert_file_noop > checking for /usr/bin/ld option to reload object files... -r > checking for aarch64-linux-android-objdump... no > checking for objdump... objdump > checking how to recognize dependent libraries... pass_all > checking for aarch64-linux-android-dlltool... no > checking for dlltool... no > checking how to associate runtime and link libraries... printf %s\n > checking for aarch64-linux-android-ar... no > checking for ar... ar > checking for archiver @FILE support... @ > checking for aarch64-linux-android-strip... strip > checking for aarch64-linux-android-ranlib... no > checking for ranlib... ranlib > checking command to parse nm output from gcc object... ok > checking for sysroot... / > checking for a working dd... /bin/dd > checking how to truncate binary pipes... /bin/dd bs=4096 count=1 > checking for aarch64-linux-android-mt... no > checking for mt... mt > checking if mt is a manifest tool... no > checking for ANSI C header files... yes > checking for sys/types.h... yes > checking for sys/stat.h... yes > checking for stdlib.h... yes > checking for string.h... yes > checking for memory.h... yes > checking for strings.h... yes > checking for inttypes.h... yes > checking for stdint.h... yes > checking for unistd.h... yes > checking for dlfcn.h... yes > checking for objdir... .libs > checking if gcc supports -fno-rtti -fno-exceptions... no > checking for gcc option to produce PIC... -fPIC -DPIC > checking if gcc PIC flag -fPIC -DPIC works... yes > checking if gcc static flag -static works... no > checking if gcc supports -c -o file.o... yes > checking if gcc supports -c -o file.o... (cached) yes > checking whether the gcc linker (/usr/bin/ld) supports shared libraries... > yes > checking whether -lc should be explicitly linked in... no > checking dynamic linker characteristics... Android linker > checking how to hardcode library paths into programs... immediate > checking whether stripping libraries is possible... yes > checking if libtool supports shared libraries... yes > checking whether to build shared libraries... yes > checking whether to build static libraries... no > configure: **************************************** types > checking for int8_t... yes > checking for int16_t... yes > checking for int32_t... yes > checking for int64_t... yes > checking for uint8_t... yes > checking for uint16_t... yes > checking for uint32_t... yes > checking for uint64_t... yes > checking for size_t... yes > checking for ssize_t... yes > checking for uid_t in sys/types.h... yes > checking for socklen_t... yes > checking for struct sockaddr_un... yes > checking for struct addrinfo... yes > configure: **************************************** PTY device files > checking for "/dev/ptmx"... yes > checking for "/dev/ptc"... no > configure: **************************************** entropy sources > checking for "/dev/urandom"... yes > configure: **************************************** default group > checking for default group... nogroup > checking for special C compiler options needed for large files... no > checking for _FILE_OFFSET_BITS value needed for large files... no > configure: **************************************** header files > checking for stdint.h... (cached) yes > checking for inttypes.h... (cached) yes > checking malloc.h usability... yes > checking malloc.h presence... yes > checking for malloc.h... yes > checking ucontext.h usability... yes > checking ucontext.h presence... yes > checking for ucontext.h... yes > checking pthread.h usability... yes > checking pthread.h presence... yes > checking for pthread.h... yes > checking poll.h usability... yes > checking poll.h presence... yes > checking for poll.h... yes > checking tcpd.h usability... no > checking tcpd.h presence... no > checking for tcpd.h... no > checking stropts.h usability... yes > checking stropts.h presence... yes > checking for stropts.h... yes > checking grp.h usability... yes > checking grp.h presence... yes > checking for grp.h... yes > checking for unistd.h... (cached) yes > checking util.h usability... no > checking util.h presence... no > checking for util.h... no > checking libutil.h usability... no > checking libutil.h presence... no > checking for libutil.h... no > checking pty.h usability... yes > checking pty.h presence... yes > checking for pty.h... yes > checking limits.h usability... yes > checking limits.h presence... yes > checking for limits.h... yes > checking for sys/types.h... (cached) yes > checking sys/select.h usability... yes > checking sys/select.h presence... yes > checking for sys/select.h... yes > checking sys/poll.h usability... yes > checking sys/poll.h presence... yes > checking for sys/poll.h... yes > checking sys/socket.h usability... yes > checking sys/socket.h presence... yes > checking for sys/socket.h... yes > checking sys/un.h usability... yes > checking sys/un.h presence... yes > checking for sys/un.h... yes > checking sys/ioctl.h usability... yes > checking sys/ioctl.h presence... yes > checking for sys/ioctl.h... yes > checking sys/filio.h usability... no > checking sys/filio.h presence... no > checking for sys/filio.h... no > checking sys/resource.h usability... yes > checking sys/resource.h presence... yes > checking for sys/resource.h... yes > checking sys/uio.h usability... yes > checking sys/uio.h presence... yes > checking for sys/uio.h... yes > checking sys/syscall.h usability... yes > checking sys/syscall.h presence... yes > checking for sys/syscall.h... yes > checking linux/sched.h usability... yes > checking linux/sched.h presence... yes > checking for linux/sched.h... yes > checking for struct msghdr.msg_control... yes > checking for linux/netfilter_ipv4.h... yes > configure: **************************************** libraries > checking for library containing gethostbyname... none required > checking for library containing yp_get_default_domain... -lnsl > checking for library containing socket... none required > checking for library containing openpty... -lutil > checking for library containing dlopen... -ldl > checking for library containing shl_load... no > configure: **************************************** library functions > checking for snprintf... yes > checking for vsnprintf... yes > checking for openpty... yes > checking for _getpty... no > checking for daemon... yes > checking for waitpid... yes > checking for wait4... yes > checking for setsid... yes > checking for setgroups... yes > checking for chroot... yes > checking for realpath... yes > checking for sysconf... yes > checking for getrlimit... yes > checking for pthread_sigmask... yes > checking for localtime_r... yes > checking for getcontext... yes > checking for __makecontext_v2... no > checking for poll... yes > checking for gethostbyname2... yes > checking for endhostent... yes > checking for getnameinfo... yes > checking for getaddrinfo... yes > checking for broken poll() implementation... no > checking for pipe2... yes > checking for accept4... yes > configure: **************************************** optional features > checking whether to enable IPv6 support... yes (default) > checking whether to enable FIPS support... autodetecting > checking whether to enable systemd socket activation support... > autodetecting > checking for library containing sd_listen_fds... no > configure: systemd library not found > checking whether to enable TCP wrappers support... autodetecting > checking for hosts_access in -lwrap... no > configure: libwrap library not found > configure: **************************************** TLS > checking for compiler sysroot... / > checking for TLS directory... /home/jaymin/Desktop/boringssl_lib > checking for FIPS_mode_set... yes > configure: FIPS support enabled > configure: **************************************** write the results > checking that generated files are newer than configure... done > configure: creating ./config.status > config.status: creating Makefile > config.status: creating src/Makefile > config.status: creating doc/Makefile > config.status: creating tools/Makefile > config.status: creating tests/Makefile > config.status: creating src/config.h > config.status: src/config.h is unchanged > config.status: executing depfiles commands > config.status: executing libtool commands > configure: **************************************** success > make clean > Making clean in src > make[1]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/src' > rm -f stunnel > test -z "stunnel3" || rm -f stunnel3 > rm -rf .libs _libs > rm -rf ../obj ../bin > test -z "libstunnel.la" || rm -f libstunnel.la > rm -f ./so_locations > rm -f *.o > rm -f *.lo > make[1]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/src' > Making clean in doc > make[1]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/doc' > test -z "stunnel.8 stunnel.pl.8 stunnel.html stunnel.pl.html" || rm -f > stunnel.8 stunnel.pl.8 stunnel.html stunnel.pl.html > rm -rf .libs _libs > rm -f *.lo > make[1]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/doc' > Making clean in tools > make[1]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/tools' > test -z "stunnel.conf-sample stunnel.init stunnel.service" || rm -f > stunnel.conf-sample stunnel.init stunnel.service > rm -rf .libs _libs > rm -f *.lo > make[1]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/tools' > Making clean in tests > make[1]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/tests' > rm -rf .libs _libs > rm -f *.lo > make[1]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/tests' > make[1]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android' > rm -rf .libs _libs > rm -f *.lo > make[1]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android' > make > Making all in src > make[1]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/src' > make all-am > make[2]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/src' > CC env.lo > CCLD libstunnel.la > CC stunnel-tls.o > CC stunnel-str.o > CC stunnel-file.o > CC stunnel-client.o > CC stunnel-log.o > CC stunnel-options.o > CC stunnel-protocol.o > CC stunnel-network.o > CC stunnel-resolver.o > CC stunnel-ssl.o > CC stunnel-ctx.o > CC stunnel-verify.o > CC stunnel-sthreads.o > CC stunnel-fd.o > CC stunnel-dhparam.o > CC stunnel-cron.o > CC stunnel-stunnel.o > CC stunnel-pty.o > CC stunnel-libwrap.o > CC stunnel-ui_unix.o > CCLD stunnel > /usr/bin/ld: skipping incompatible > /home/jaymin/Desktop/boringssl_lib/libssl.so when searching for -lssl > /usr/bin/ld: skipping incompatible > /home/jaymin/Desktop/boringssl_lib/libcrypto.so when searching for -lcrypto > stunnel-str.o: In function `str_leak_debug': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/str.c:459: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/str.c:470: > undefined reference to `CRYPTO_THREAD_unlock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/str.c:501: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/str.c:509: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-client.o: In function `session_cache_retrieve': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:568: > undefined reference to `CRYPTO_THREAD_read_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:581: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-client.o: In function `ssl_start': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:501: > undefined reference to `OpenSSL_version_num' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:519: > undefined reference to `CRYPTO_THREAD_unlock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:511: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:502: > undefined reference to `OpenSSL_version_num' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:503: > undefined reference to `OpenSSL_version_num' > stunnel-client.o: In function `print_cipher': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:595: > undefined reference to `SSL_session_reused' > stunnel-client.o: In function `idx_cache_retrieve': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1446: > undefined reference to `SSL_session_reused' > stunnel-client.o: In function `idx_cache_save': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1432: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1436: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-client.o: In function `idx_cache_retrieve': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1447: > undefined reference to `CRYPTO_THREAD_read_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1453: > undefined reference to `CRYPTO_THREAD_unlock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1469: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-client.o: In function `client_run': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:224: > undefined reference to `CRYPTO_atomic_add' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:323: > undefined reference to `CRYPTO_atomic_add' > stunnel-log.o: In function `log_close': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:109: > undefined reference to `CRYPTO_THREAD_write_lock' > stunnel-log.o: In function `s_log': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:165: > undefined reference to `CRYPTO_THREAD_read_lock' > stunnel-log.o: In function `log_queue': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:194: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:201: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-log.o: In function `s_log': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:170: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-log.o: In function `log_flush': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:205: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:211: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:219: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-log.o: In function `log_close': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:115: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-log.o: In function `log_flush': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:220: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-options.o: In function `engine_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:4219: > undefined reference to `OPENSSL_init_crypto' > stunnel-options.o: In function `service_up_ref': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:614: > undefined reference to `CRYPTO_atomic_add' > stunnel-options.o: In function `parse_global_option': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:681: > undefined reference to `OpenSSL_version_num' > stunnel-options.o: In function `tls_methods_set': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:3514: > undefined reference to `TLS_client_method' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:3515: > undefined reference to `TLS_server_method' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:3506: > undefined reference to `TLS_client_method' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:3507: > undefined reference to `TLS_server_method' > stunnel-options.o: In function `service_up_ref': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:614: > undefined reference to `CRYPTO_atomic_add' > stunnel-options.o: In function `service_free': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:624: > undefined reference to `CRYPTO_atomic_add' > stunnel-ssl.o: In function `ssl_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ssl.c:56: > undefined reference to `OPENSSL_init_ssl' > stunnel-ssl.o: In function `sk_SSL_COMP_pop': > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:846: undefined > reference to `OPENSSL_sk_pop' > stunnel-ssl.o: In function `sk_SSL_COMP_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:846: undefined > reference to `OPENSSL_sk_num' > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:846: undefined > reference to `OPENSSL_sk_num' > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:846: undefined > reference to `OPENSSL_sk_num' > stunnel-ssl.o: In function `sk_SSL_COMP_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:846: undefined > reference to `OPENSSL_sk_value' > stunnel-ssl.o: In function `compression_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ssl.c:217: > undefined reference to `SSL_COMP_get0_name' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ssl.c:221: > undefined reference to `SSL_COMP_get_id' > stunnel-ssl.o: In function `ssl_configure': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ssl.c:127: > undefined reference to `OPENSSL_init_crypto' > stunnel-ssl.o: In function `compression_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ssl.c:201: > undefined reference to `COMP_get_type' > stunnel-ctx.o: In function `info_callback': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:1231: > undefined reference to `SSL_get_state' > stunnel-ctx.o: In function `session_cache_save': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:981: > undefined reference to `SSL_SESSION_up_ref' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:986: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:999: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-ctx.o: In function `sk_X509_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_value' > stunnel-ctx.o: In function `sk_X509_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_num' > stunnel-ctx.o: In function `session_cache_save': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:999: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-ctx.o: In function `context_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:154: > undefined reference to `SSL_CTX_set_options' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:157: > undefined reference to `SSL_CTX_clear_options' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:161: > undefined reference to `SSL_CTX_set_options' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:164: > undefined reference to `SSL_CTX_clear_options' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:170: > undefined reference to `SSL_CTX_get_options' > stunnel-ctx.o: In function `dh_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:328: > undefined reference to `SSL_CTX_get_ciphers' > stunnel-ctx.o: In function `sk_SSL_CIPHER_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:845: undefined > reference to `OPENSSL_sk_num' > stunnel-ctx.o: In function `sk_SSL_CIPHER_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:845: undefined > reference to `OPENSSL_sk_value' > stunnel-ctx.o: In function `dh_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:356: > undefined reference to `CRYPTO_THREAD_read_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:358: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-verify.o: In function `ocsp_request': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/verify.c:539: > undefined reference to `X509_STORE_CTX_get0_chain' > stunnel-verify.o: In function `get_current_issuer': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/verify.c:701: > undefined reference to `X509_STORE_CTX_get0_chain' > stunnel-verify.o: In function `sk_X509_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_num' > stunnel-verify.o: In function `sk_X509_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_value' > stunnel-verify.o: In function `sk_OPENSSL_STRING_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/safestack.h:151: > undefined reference to `OPENSSL_sk_value' > stunnel-verify.o: In function `sk_OPENSSL_STRING_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/safestack.h:151: > undefined reference to `OPENSSL_sk_num' > stunnel-verify.o: In function `cert_check_local': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/verify.c:353: > undefined reference to `X509_STORE_CTX_get1_certs' > stunnel-verify.o: In function `sk_X509_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_num' > stunnel-verify.o: In function `sk_X509_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_value' > stunnel-verify.o: In function `sk_X509_pop_free': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_pop_free' > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_pop_free' > stunnel-verify.o: In function `sk_X509_NAME_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:75: undefined > reference to `OPENSSL_sk_num' > stunnel-verify.o: In function `sk_X509_NAME_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:75: undefined > reference to `OPENSSL_sk_value' > stunnel-sthreads.o: In function `locking_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/sthreads.c:358: > undefined reference to `CRYPTO_THREAD_lock_new' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/sthreads.c:358: > undefined reference to `CRYPTO_THREAD_lock_new' > stunnel-dhparam.o: In function `get_dh2048': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/dhparam.c:49: > undefined reference to `DH_set0_pqg' > stunnel-cron.o: In function `cron_dh_param': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/cron.c:193: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/cron.c:196: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-stunnel.o: In function `stunnel_info': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/stunnel.c:887: > undefined reference to `OpenSSL_version' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/stunnel.c:889: > undefined reference to `OpenSSL_version' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/stunnel.c:890: > undefined reference to `OpenSSL_version_num' > collect2: error: ld returned 1 exit status > Makefile:538: recipe for target 'stunnel' failed > make[2]: *** [stunnel] Error 1 > make[2]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/src' > Makefile:401: recipe for target 'all' failed > make[1]: *** [all] Error 2 > make[1]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/src' > Makefile:447: recipe for target 'all-recursive' failed > make: *** [all-recursive] Error 1 ------------------------------------------------------------------------------------------------ As I want to use SSL, did modification as below: --------------------------------------------------------------------------------------------- #!/bin/sh > set -ev > VERSION=5.48 > DST=stunnel-$VERSION-android > # to build OpenSSL: > # ./Configure threads no-shared no-dso > --cross-compile-prefix=arm-linux-androideabi- > --prefix=/opt/androideabi/sysroot linux-armv4 > # make install > LDFLAGS="$LDFLAGS -L/home/jaymin/Desktop/boringssl_lib -fPIE" > export LDFLAGS > test -f Makefile && make distclean > mkdir -p bin/android > cd bin/android > ../../configure --with-pic --enable-shared --with-sysroot > --host=aarch64-linux-android --with-ssl=/home/jaymin/Desktop/boringssl_lib > make clean > make > cd ../.. > mkdir $DST > cp bin/android/src/stunnel $DST > # arm-linux-androideabi-strip $DST/stunnel $DST/openssl > # cp /opt/androideabi/sysroot/bin/openssl $DST > # arm-linux-androideabi-strip $DST/openssl > zip -r $DST.zip $DST > rm -rf $DST > # sha256sum $DST.zip > # mv $DST.zip ../dist/ --------------------------------------------------------------------------------------------- How can I cross compile the Stunnel-5.48 using this BoringSSL? Are my BoringSSL's .so files incompatible? Any suggestions. Regards, Jaymin

1 0

"Reverse" tunneling with stunnel.
by C. Petro 20 Jul '18

20 Jul '18

I have a client who is setting up a logging infrastructure involving a couple of DMZs forwarding logs into central logging points. They have to pass compliance audits (SOX, PCI at least) and have some rather specific desires in regards to how they want the log traffic to move, and which servers *initiate* the connections. Which is to say they want the internal servers to set up tunnels to the DMZ servers and then the forwarders use that tunnel to deliver logs back. Lemme see if I can ascii art this: central1----------------------------------dmz1 \____________________ / _____________________\ _/ / \ central2----------------------------------dmz2 Something like that. Central1=10.10.1.2 Central2=10.9.1.2 DMZ1=172.18.0.5 DMZ2=172.20.0.5 Firewalls are in effect. I have gotten it set up so that I can initiate a connection FROM Central1 to DMZ2. [Tunnel_to_DMZ2] client = yes accept = 3002 connect = 172.20.0.5:5000 And [Tunnel_from_Central1] accept = 5000 connect = 3000 Like I said, I can open a tunnel from Central1 to DMZ2, but can't get traffic to pass backwards--I get a message in the log saying the session is closed. Is it possible to set stunnel up in a "reverse tunnel" mode--one where the connect is initiated from one end, but the other does most of the message passing? What I am missing? Thanks, Petro.

2 2

TLS alert (read): fatal: bad record mac (windows)
by Per Gunnarsson 19 Jul '18

19 Jul '18

I found it after looking once more in the log file. PSK client configured for identity "ï»¿user2" (the identity in the secrets.txt is user2:secretkey, somehow those three weird characters are added on windows) I got around it by copying the secrets.txt file to the server so that the secrets.txt on the server also begins with "ï»¿user2" but I suspect it's a bug. Regards, Per Gunnarsson

1 0

Is there a way to specify certificate content in stunnel config
by Hari 19 Jul '18

19 Jul '18

Hi, I have a requirement where in i cannot specify the certificate and/or private key details as "files" to stunnel configuration, owing to the location and/or file system availability for stunnel to access them. Is there a way to specify the actual certificate content in stunnel configuration (similar to other parameters like port numbers etc.,) so that the same can be leveraged. ThanksHari | | Virus-free. www.avg.com |

1 0

TLS alert (read): fatal: bad record mac (windows)
by Per Gunnarsson 19 Jul '18

19 Jul '18

Hello! I am trying to set up stunnel from a windows box to a VPS. I have working tunnels from a FreeBSD box to the VPS. On the VPS, the config looks like: [socks_server] protocol = socks PSKsecrets = /my/secret/location/secrets.txt accept = xxx.xxx.xxx.xxx:xxxx [ssh] PSKsecrets = /my/secret/location/hecrets.txt accept = xxx.xxx.xxx.xxx:xxxx connect = 127.0.0.1:22 On the windows box, the config looks like this: [socks_client2] debug = 7 client = yes PSKsecrets = c:\my\secret\location\secrets.txt accept = 127.0.0.1:1080 connect = xxx.xxx.xxx.xxx:xxxx The log on Windows looks like this: 2018.07.19 13:13:09 LOG5[main]: stunnel 5.48 on x86-pc-msvc-1500 platform 2018.07.19 13:13:09 LOG5[main]: Compiled/running with OpenSSL 1.0.2o-fips 27 Mar 2018 2018.07.19 13:13:09 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2018.07.19 13:13:09 LOG5[main]: Reading configuration from file stunnel.conf 2018.07.19 13:13:09 LOG5[main]: UTF-8 byte order mark detected 2018.07.19 13:13:09 LOG5[main]: FIPS mode disabled 2018.07.19 13:13:09 LOG5[main]: Configuration successful 2018.07.19 13:13:11 LOG7[0]: Service [socks_client2] started 2018.07.19 13:13:11 LOG7[0]: Setting local socket options (FD=460) 2018.07.19 13:13:11 LOG7[0]: Option TCP_NODELAY set on local socket 2018.07.19 13:13:11 LOG5[0]: Service [socks_client2] accepted connection from 127.0.0.1:56598 2018.07.19 13:13:11 LOG6[0]: s_connect: connecting xxx.xxx.xxx.xxx:xxxx 2018.07.19 13:13:11 LOG7[0]: s_connect: s_poll_wait xxx.xxx.xxx.xxx:xxxx: waiting 10 seconds 2018.07.19 13:13:11 LOG5[0]: s_connect: connected xxx.xxx.xxx.xxx:xxxx 2018.07.19 13:13:11 LOG5[0]: Service [socks_client2] connected remote server from 192.168.1.65:56599 2018.07.19 13:13:11 LOG7[0]: Setting remote socket options (FD=508) 2018.07.19 13:13:11 LOG7[0]: Option TCP_NODELAY set on remote socket 2018.07.19 13:13:11 LOG7[0]: Remote descriptor (FD=508) initialized 2018.07.19 13:13:11 LOG6[0]: SNI: sending servername: xxx.xxx.xxx.xxx 2018.07.19 13:13:11 LOG6[0]: Peer certificate not required 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): before/connect initialization 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv2/v3 write client hello A 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv3 read server hello A 2018.07.19 13:13:11 LOG6[0]: Client certificate not requested 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv3 read server done A 2018.07.19 13:13:11 LOG6[0]: PSK client configured for identity "ï»¿user2" 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv3 write client key exchange A 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv3 write change cipher spec A 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv3 write finished A 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv3 flush data 2018.07.19 13:13:11 LOG3[0]: SSL_connect: Peer suddenly disconnected 2018.07.19 13:13:11 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.07.19 13:13:11 LOG7[0]: Deallocating application specific data for session connect address 2018.07.19 13:13:11 LOG7[0]: Remote descriptor (FD=508) closed 2018.07.19 13:13:11 LOG7[0]: Local descriptor (FD=460) closed 2018.07.19 13:13:11 LOG7[0]: Service [socks_client2] finished (0 left) 2018.07.19 13:13:34 LOG7[1]: Service [socks_client2] started 2018.07.19 13:13:34 LOG7[1]: Setting local socket options (FD=528) 2018.07.19 13:13:34 LOG7[1]: Option TCP_NODELAY set on local socket 2018.07.19 13:13:34 LOG5[1]: Service [socks_client2] accepted connection from 127.0.0.1:56601 2018.07.19 13:13:34 LOG6[1]: s_connect: connecting xxx.xxx.xxx.xxx:xxxx 2018.07.19 13:13:34 LOG7[1]: s_connect: s_poll_wait xxx.xxx.xxx.xxx:xxxx: waiting 10 seconds 2018.07.19 13:13:34 LOG5[1]: s_connect: connected xxx.xxx.xxx.xxx:xxxx 2018.07.19 13:13:34 LOG5[1]: Service [socks_client2] connected remote server from 192.168.1.65:56602 2018.07.19 13:13:34 LOG7[1]: Setting remote socket options (FD=536) 2018.07.19 13:13:34 LOG7[1]: Option TCP_NODELAY set on remote socket 2018.07.19 13:13:34 LOG7[1]: Remote descriptor (FD=536) initialized 2018.07.19 13:13:34 LOG6[1]: SNI: sending servername: xxx.xxx.xxx.xxx 2018.07.19 13:13:34 LOG6[1]: Peer certificate not required 2018.07.19 13:13:34 LOG7[1]: TLS state (connect): before/connect initialization 2018.07.19 13:13:34 LOG7[1]: TLS state (connect): SSLv2/v3 write client hello A 2018.07.19 13:13:35 LOG7[1]: TLS state (connect): SSLv3 read server hello A 2018.07.19 13:13:35 LOG6[1]: Client certificate not requested 2018.07.19 13:13:35 LOG7[1]: TLS state (connect): SSLv3 read server done A 2018.07.19 13:13:35 LOG6[1]: PSK client configured for identity "ï»¿user2" 2018.07.19 13:13:35 LOG7[1]: TLS state (connect): SSLv3 write client key exchange A 2018.07.19 13:13:35 LOG7[1]: TLS state (connect): SSLv3 write change cipher spec A 2018.07.19 13:13:35 LOG7[1]: TLS state (connect): SSLv3 write finished A 2018.07.19 13:13:35 LOG7[1]: TLS state (connect): SSLv3 flush data 2018.07.19 13:13:35 LOG7[1]: TLS alert (read): fatal: bad record mac 2018.07.19 13:13:35 LOG3[1]: SSL_connect: 140943FC: error:140943FC:SSL routines:ssl3_read_bytes:sslv3 alert bad record mac 2018.07.19 13:13:35 LOG5[1]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.07.19 13:13:35 LOG7[1]: Deallocating application specific data for session connect address 2018.07.19 13:13:35 LOG7[1]: Remote descriptor (FD=536) closed 2018.07.19 13:13:35 LOG7[1]: Local descriptor (FD=528) closed 2018.07.19 13:13:35 LOG7[1]: Service [socks_client2] finished (0 left) 2018.07.19 13:14:06 LOG7[2]: Service [socks_client2] started 2018.07.19 13:14:06 LOG7[2]: Setting local socket options (FD=1880) 2018.07.19 13:14:06 LOG7[2]: Option TCP_NODELAY set on local socket 2018.07.19 13:14:06 LOG5[2]: Service [socks_client2] accepted connection from 127.0.0.1:56604 2018.07.19 13:14:06 LOG6[2]: s_connect: connecting xxx.xxx.xxx.xxx:xxxx 2018.07.19 13:14:06 LOG7[2]: s_connect: s_poll_wait xxx.xxx.xxx.xxx:xxxx: waiting 10 seconds 2018.07.19 13:14:06 LOG5[2]: s_connect: connected xxx.xxx.xxx.xxx:xxxx 2018.07.19 13:14:06 LOG5[2]: Service [socks_client2] connected remote server from 192.168.1.65:56605 2018.07.19 13:14:06 LOG7[2]: Setting remote socket options (FD=2044) 2018.07.19 13:14:06 LOG7[2]: Option TCP_NODELAY set on remote socket 2018.07.19 13:14:06 LOG7[2]: Remote descriptor (FD=2044) initialized 2018.07.19 13:14:06 LOG6[2]: SNI: sending servername: xxx.xxx.xxx.xxx 2018.07.19 13:14:06 LOG6[2]: Peer certificate not required 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): before/connect initialization 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv2/v3 write client hello A 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv3 read server hello A 2018.07.19 13:14:06 LOG6[2]: Client certificate not requested 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv3 read server done A 2018.07.19 13:14:06 LOG6[2]: PSK client configured for identity "ï»¿user2" 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv3 write client key exchange A 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv3 write change cipher spec A 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv3 write finished A 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv3 flush data 2018.07.19 13:14:06 LOG7[2]: TLS alert (read): fatal: bad record mac 2018.07.19 13:14:06 LOG3[2]: SSL_connect: 140943FC: error:140943FC:SSL routines:ssl3_read_bytes:sslv3 alert bad record mac 2018.07.19 13:14:06 LOG5[2]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.07.19 13:14:06 LOG7[2]: Deallocating application specific data for session connect address 2018.07.19 13:14:06 LOG7[2]: Remote descriptor (FD=2044) closed 2018.07.19 13:14:06 LOG7[2]: Local descriptor (FD=1880) closed 2018.07.19 13:14:06 LOG7[2]: Service [socks_client2] finished (0 left)

1 0

Loss of ability to use Stunnel-Blat, and a solution
by Roger Bohl 10 Jul '18

10 Jul '18

Early in 2018, around the time when I upgraded my system to Windows 10, the Stunnel and Blat files that had worked fine with my Vista PC would not work with the new PC. However, the "bug" turned out to be unrelated to the change in operating systems, but rather an "upgrade" to Gmail: Coincidentally, about that time, Gmail evidently decided to stop accepting e-mails from apps deemed "a less secure app", including Stunnel-Blat, with Blat then displaying messages: *** Warning *** The SMTP server did not accept Auth PLAIN value. *** Warning *** Are your login userid and password correct? *** Warning *** The SMTP server did not accept Auth LOGIN PASSWD value. Only a failure message sent to my "backup e-mail address" led me to explore this as a possible cause for what I had thought was, but turned out not to be, a Stunnel-Blat problem. Gmail has an option to suppress this heightened security feature, and when I activated this option, my Stunnel-Blat tools immediately began to function as intended. While I was at first able to enable Gmail to "Allow access from "less secure accounts," I have been unable to get through Gmail options consistently to turn this on and off and share this info with others. (I would welcome instructions that work consistently.) I would also welcome guidance on how to include Stunnel-Blat as a specific alllowed app, without having to enable Gmail to enable *all* "less secure apps" Roger Bohl

3 3

Re: [stunnel-users] Intermittent error in 042_inetd
by Eric S Eberhard 10 Jul '18

10 Jul '18

The 50% could be because the server side is not fully updated - we have this problem a lot with very large companies that should know better (and in reality should overlap instead of changing over - meaning allow SSLv3 for 3 months or something while also accepting TLSv2. A very good way to test is to get a telnet program. Then "telnent localhost port#" - the port # being the port number stunnel is running on. This will remove all variables except stunnel and allow you to see the output. It could be you are connecting fine and failing some other authentication like a login - which you can see often with telnet. And set your firewall to not allow telnet on port 23. Also, we have found stunnel MUCH more reliable under inetd (if you are on Unix of course) than as a stand-alone server. A little performance loss that is unnoticeable to us - big customers exchange 2-4 million XML documents a day (using stunnel) so inetd is definitely not the most efficient way, but the machines are so darn fast it seems not to matter. The certificates have become more painful but I have never had to use an official signed one. I make my own with openssl. However, there are intermediate ones that are needed from whomever you connect to if they have a signed certificate - say from Verisign - you may need your certificate and Verisigns, etc - in a chain. I use "cacert" to set to a large file of .pem certificates - which I simply download from the Web (available all over, some work, some don't. When you get one that works . then use it. You can modify them by adding anything not found in the file. Supposedly the cacert file I have now is good till 2020 for the big names. You can also use openssl to get the certificate from the server - just ask and you shall receive. It should have the entire chain. I used to have on massive cacert for everyone and it was getting out of hand. As tacky as it is, I just make a cacert.pem file for every connection (e.g. Walmart, Fedex, Target, whatever). This allows working connections to keep working while you fiddle with a tricky one. Eric Eric S Eberhard VICS (Vertical Integrated Computer Systems) Voice: 928 567 3529 Cell : 928 301 7537 (not reliable except for text or if not home) 2933 W Middle Verde Rd Camp Verde, AZ 86322 From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Ian Bamforth Sent: Wednesday, July 04, 2018 9:00 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Intermittent error in 042_inetd Afternoon, Until recently we'd disabled `make test` because of certificate problems - we've re-enabled it (using `make check`) but are getting intermittent failures (around 50% of CI runs). Below is the output from the logs - I can't see what's gone wrong, can anyone shed any light? 2018.07.04 09:59:36 LOG7[ui]: Clients allowed=14648 2018.07.04 09:59:36 LOG7[ui]: errno: (*__errno_location ()) 2018.07.04 09:59:36 LOG7[ui]: Compression disabled 2018.07.04 09:59:36 LOG7[ui]: No PRNG seeding was required 2018.07.04 09:59:36 LOG7[ui]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2018.07.04 09:59:36 LOG7[ui]: TLS options: 0x02004004 (+0x00004000, -0x00000000) 2018.07.04 09:59:36 LOG7[ui]: Private key check succeeded 2018.07.04 09:59:36 LOG7[ui]: ECDH initialization 2018.07.04 09:59:36 LOG7[ui]: ECDH initialized with curve prime256v1 2018.07.04 09:59:36 LOG7[ui]: Binding service [server] 2018.07.04 09:59:36 LOG7[ui]: Listening file descriptor created (FD=6) 2018.07.04 09:59:36 LOG7[ui]: Setting accept socket options (FD=6) 2018.07.04 09:59:36 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2018.07.04 09:59:36 LOG7[main]: Created pid file /opt/stunnel/stunnel-5.48/tests/logs/stunnel.pid 2018.07.04 09:59:36 LOG7[cron]: Cron thread initialized 2018.07.04 09:59:36 LOG7[main]: Found 1 ready file descriptor(s) 2018.07.04 09:59:36 LOG7[main]: FD=4 events=0x2001 revents=0x0 2018.07.04 09:59:36 LOG7[main]: FD=6 events=0x2001 revents=0x1 2018.07.04 09:59:36 LOG7[main]: Service [server] accepted (FD=3) from 127.0.0.1:58890 2018.07.04 09:59:36 LOG7[0]: Service [server] started 2018.07.04 09:59:36 LOG7[0]: Setting local socket options (FD=3) 2018.07.04 09:59:36 LOG7[0]: Option TCP_NODELAY set on local socket 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): before SSL initialization 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): before SSL initialization 2018.07.04 09:59:36 LOG7[0]: SNI: no virtual services defined 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS read client hello 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write server hello 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write certificate 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write key exchange 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write server done 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write server done 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS read client key exchange 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS read change cipher spec 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS read finished 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write change cipher spec 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write finished 2018.07.04 09:59:36 LOG7[0]: New session callback 2018.07.04 09:59:36 LOG7[0]: 1 server accept(s) requested 2018.07.04 09:59:36 LOG7[0]: 1 server accept(s) succeeded 2018.07.04 09:59:36 LOG7[0]: 0 server renegotiation(s) requested 2018.07.04 09:59:36 LOG7[0]: 0 session reuse(s) 2018.07.04 09:59:36 LOG7[0]: 1 internal session cache item(s) 2018.07.04 09:59:36 LOG7[0]: 0 internal session cache fill-up(s) 2018.07.04 09:59:36 LOG7[0]: 0 internal session cache miss(es) 2018.07.04 09:59:36 LOG7[0]: 0 external session cache hit(s) 2018.07.04 09:59:36 LOG7[0]: 0 expired session(s) retrieved 2018.07.04 09:59:36 LOG7[0]: Compression: null, expansion: null 2018.07.04 09:59:36 LOG7[0]: Setting remote socket options (FD=10) 2018.07.04 09:59:36 LOG7[0]: Option TCP_NODELAY set on remote socket 2018.07.04 09:59:36 LOG7[0]: Remote descriptor (FD=10) initialized 2018.07.04 09:59:36 LOG7[0]: TLS alert (read): warning: close notify 2018.07.04 09:59:36 LOG7[0]: Sent socket write shutdown 2018.07.04 09:59:36 LOG7[0]: Remote descriptor (FD=10) closed 2018.07.04 09:59:36 LOG7[0]: Local descriptor (FD=3) closed 2018.07.04 09:59:36 LOG7[0]: Service [server] finished (0 left) 2018.07.04 09:59:36 LOG7[main]: Found 1 ready file descriptor(s) 2018.07.04 09:59:36 LOG7[main]: FD=4 events=0x2001 revents=0x1 2018.07.04 09:59:36 LOG7[main]: FD=6 events=0x2001 revents=0x0 2018.07.04 09:59:36 LOG7[main]: Dispatching a signal from the signal pipe 2018.07.04 09:59:36 LOG7[main]: Processing SIGCHLD 2018.07.04 09:59:36 LOG7[main]: Retrieving pid statuses with waitpid() 2018.07.04 09:59:36 LOG7[ui]: Clients allowed=14648 2018.07.04 09:59:36 LOG7[ui]: errno: (*__errno_location ()) 2018.07.04 09:59:36 LOG7[ui]: Compression disabled 2018.07.04 09:59:36 LOG7[ui]: No PRNG seeding was required 2018.07.04 09:59:36 LOG7[ui]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2018.07.04 09:59:36 LOG7[ui]: TLS options: 0x02000004 (+0x00000000, -0x00000000) 2018.07.04 09:59:36 LOG7[ui]: No certificate or private key specified 2018.07.04 09:59:36 LOG7[0]: Service [inetd client] started 2018.07.04 09:59:36 LOG7[0]: s_connect: s_poll_wait 127.0.0.1:4433: waiting 10 seconds 2018.07.04 09:59:36 LOG7[0]: Setting remote socket options (FD=3) 2018.07.04 09:59:36 LOG7[0]: Option TCP_NODELAY set on remote socket 2018.07.04 09:59:36 LOG7[0]: Remote descriptor (FD=3) initialized 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): before SSL initialization 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write client hello 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write client hello 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read server hello 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read server certificate 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read server key exchange 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read server done 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write client key exchange 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write change cipher spec 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write finished 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write finished 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read change cipher spec 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read finished 2018.07.04 09:59:36 LOG7[0]: New session callback 2018.07.04 09:59:36 LOG7[0]: Peer certificate was cached (1241 bytes) 2018.07.04 09:59:36 LOG7[0]: 1 client connect(s) requested 2018.07.04 09:59:36 LOG7[0]: 1 client connect(s) succeeded 2018.07.04 09:59:36 LOG7[0]: 0 client renegotiation(s) requested 2018.07.04 09:59:36 LOG7[0]: 0 session reuse(s) 2018.07.04 09:59:36 LOG7[0]: Compression: null, expansion: null 2018.07.04 09:59:36 LOG7[0]: Sending close_notify alert 2018.07.04 09:59:36 LOG7[0]: TLS alert (write): warning: close notify 2018.07.04 09:59:36 LOG7[0]: Remote descriptor (FD=3) closed 2018.07.04 09:59:36 LOG7[0]: Service [inetd client] finished (0 left) 2018.07.04 09:59:36 LOG7[0]: Deallocating section defaults 2018.07.04 09:59:36 LOG7[main]: Found 1 ready file descriptor(s) 2018.07.04 09:59:36 LOG7[main]: FD=4 events=0x2001 revents=0x1 2018.07.04 09:59:36 LOG7[main]: FD=6 events=0x2001 revents=0x0 2018.07.04 09:59:36 LOG7[main]: Dispatching a signal from the signal pipe 2018.07.04 09:59:36 LOG7[main]: Processing SIGNAL_TERMINATE 2018.07.04 09:59:36 LOG7[main]: Leak detection table utilization: 86/997, 8.63% 2018.07.04 09:59:36 LOG7[main]: Removed pid file /opt/stunnel/stunnel-5.48/tests/logs/stunnel.pid 2018.07.04 09:59:36 LOG7[main]: Deallocating section defaults Regards, Ian Bamforth Senior Software Engineer Operations & Planning Systems Division T: <tel:00441133443970> +44 (0)113 344 3970 M: <tel:00447852404240> +44 (0)7852 404240 E: <mailto:Ian.Bamforth@tracsis.com> Ian.Bamforth(a)tracsis.com W: <https://www.tracsis.com> www.tracsis.com <http://www.tracsisops.com> www.tracsisops.com Follow Us <https://www.linkedin.com/company/972873?trk=tyah&trkInfo=idx:1-1-1,tarId:14 20795682492,tas:tracsis> <https://www.twitter.com/tracsis> Tracsis plc Leeds Innovation Centre 103 Clarendon Road Leeds LS2 9DF <https://static.tracsis.com/email/award4.png> Tracsis Operations and Planning Systems Division is a Division of Tracsis plc and comprises Tracsis plc (05019106), Tracsis Rail Consultancy Limited (05047148), Safety Information Systems Limited trading as COMPASS (02588404) and Tracsis Retail and Operations Limited (04225250), all subsidiaries of Tracsis plc with a registered office at Leeds Innovation Centre,103 Clarendon Road, Leeds, LS2 9DF. VAT Registration No: 945 7876 61. This email and its attachments may be confidential and are intended solely for the use of the individual(s) to whom it is addressed. If you are not the intended recipient of this email and its attachments, you must take no action based upon them, nor must you copy or show them to anyone. Please contact the sender if you believe you have received this email in error.

2 1

Re: [stunnel-users] [EXTERNAL] Re: Stunnel connection issue?
by Eric S Eberhard 09 Jul '18

09 Jul '18

Exactly. Eric Eric S Eberhard VICS (Vertical Integrated Computer Systems) Voice: 928 567 3529 Cell : 928 301 7537 (not reliable except for text or if not home) 2933 W Middle Verde Rd Camp Verde, AZ 86322 -----Original Message----- From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Peter Pentchev Sent: Thursday, July 05, 2018 5:47 AM To: Spies, Will <Will_Spies(a)comcast.com> Cc: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] [EXTERNAL] Re: Stunnel connection issue? On Thu, Jul 05, 2018 at 11:41:18AM +0000, Spies, Will wrote: > Thanks for the quick response. The client is an Echo Show device and > there is no log. It is an RTSP connection and my backend (behind > Stunnel) is Live555ProxyServer. I read somewhere there is some bug > related to MSIE that closed the connection like this and the fix is to > use TIMEOUTclose=0 which I did but this did not help. This is the > earlier (startup) portion of my log: Hi, Unfortunately, without more information about what the client doesn't like about the established connection, I don't think there is anything more I can help you with :( You *might* try playing with stunnel's cipher settings (OpenSSL options), on the off chance that the client is somewhat confused and offers for negotiation a cipher or something that it later realizes it cannot support... but that would be really weird. G'luck, Peter -- Peter Pentchev roam(a){ringlet.net,debian.org,FreeBSD.org} pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

1 0