- stunnel-users - stunnel.org

Re: Stunnel Show Log Window
by Jose Alf. 31 May '26

31 May '26

Hi Graham, Yes. You are absolutely right. I was a bit confused with your question at first. I apologize. If we don't uncomment the output=filename.ext line, the log lines won't be written to any disk file. In this case, On Windows, the log lines go to the Log Window you mention. This is implemented as a circular buffer kept in RAM with hardcoded capacity for 1000 lines. That is, you will only see the last 1000 lines sent to the log and older lines are silently discarded. No crashes should happen. Best Regards,Jose -- On Sunday, May 31, 2026 at 10:57:37 AM GMT-5, Graham Jones <graham(a)lorien56.co.uk> wrote: Hi Jose, Thanks for the explanation about stunnel.log My config file has the line: ;output = stunnel.log I understand this to mean that the file stunnel.log is NOT created. And there is no evidence of this file anywhere. But the GUI allows me to see a "log window". So my question is: what happens when this "log window" fills up? Regards, == Graham > -----Original Message----- > From: Josealf.rm [mailto:josealf@rocketmail.com] > Sent: 31 May 2026 12:46 > To: Graham(a)lorien56.co.uk > Subject: Re: [stunnel-users] Stunnel Show Log Window > > Hi Graham, > > Stunnel does not implement automatic log rotation and it will not overwrite > earlier log entries. It will always try to append new entries at the end. By > default, the log file is named stunnel.log. If you run out of storage, stunnel > will probably crash. In Unix-like OSes like Linux or FreeBSD, you can configure > OS tasks to gracefully handle the log management. Periodically the stunnel > server process is stopped, the oldest log file is deleted and/or compressed > and the newest/current log is renamed. Then stunnel is started and a new > stunnel log is created. In Windows you could do something similar by creating > a suitable script or batch file and running it via Task Scheduler. > > Regards > Jose > > > > On 31/05/2026, at 1:26 AM, Graham Jones via stunnel-users <stunnel- > users(a)lists.stunnel.org> wrote: > > > > I'm new to Stunnel. > > > > stunnel 5.78 on x64-pc-mingw32-gnu platform Windows 7 Pro. > > > > I see the option to "Show Log Window". I have read the manual. I see > there > > is an option to specify an output file; I am not using this option. > > > > My question: > > > > When the space allocated to the log information fills up, what happens? > > Does stunnel overwrite the oldest log entries first? Or does it crash? > > > > Regards, > > > > == Graham > > > > > > _______________________________________________ > > stunnel-users mailing list -- stunnel-users(a)lists.stunnel.org > > To unsubscribe send an email to stunnel-users-leave(a)lists.stunnel.org

2 2

Stunnel Show Log Window
by Graham Jones 31 May '26

31 May '26

I'm new to Stunnel. stunnel 5.78 on x64-pc-mingw32-gnu platform Windows 7 Pro. I see the option to "Show Log Window". I have read the manual. I see there is an option to specify an output file; I am not using this option. My question: When the space allocated to the log information fills up, what happens? Does stunnel overwrite the oldest log entries first? Or does it crash? Regards, == Graham

2 1

Certificate rejected ...?
by Graham Jones 31 May '26

31 May '26

I'm new to Stunnel. stunnel 5.78 on x64-pc-mingw32-gnu platform Windows 7 Pro. During installation, the process walked me through the creation of a certificate. I have these settings: [Lopham-imap] client = yes accept = 127.0.0.1:52143 connect = mail.lopham.co.uk:993 CAfile = ca-certs.pem The connection succeeds. I add the following lines: verifyChain = yes checkHost = mail.lopham.co.uk OCSPaia = yes The connection fails with the following lines in the log: 2026.05.30 21:45:52 LOG5[2]: Service [Lopham-imap] accepted connection from 127.0.0.1:51901 2026.05.30 21:45:52 LOG5[2]: s_connect: connected 193.143.227.10:993 2026.05.30 21:45:52 LOG5[2]: Service [Lopham-imap] connected remote server from 127.0.0.1:51902 2026.05.30 21:45:52 LOG4[2]: CERT: Pre-verification error: certificate not found in local repository: self-signed certificate in certificate chain 2026.05.30 21:45:52 LOG4[2]: Rejected by CERT at depth=1: OU=generated by AVG Antivirus for SSL/TLS scanning, O=AVG Web/Mail Shield, CN=AVG Web/Mail Shield Root 2026.05.30 21:45:52 LOG3[2]: SSL_connect: tls_post_process_server_certificate@ssl/statem/statem_clnt.c:2124: error:0A000086:SSL routines::certificate verify failed: client 127.0.0.1:51901 2026.05.30 21:45:52 LOG5[2]: Connection closed/reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket I see it finds the self-signed certificate in certificate chain. Why is this rejected? Any ideas, please? Regards, == Graham

3 3

stunnel works but only with debug on
by Graham Jones 28 May '26

28 May '26

I'm new to stunnel. stunnel 5.78 on x64-pc-mingw32-gnu platform Windows 7 Pro Using Outlook to open a connection to a POP server Extract from stunnel.conf [Zen-pop3] client = yes accept = 127.0.0.1:110 connect = mailhost.zen.co.uk:995 CAfile = ca-certs.pem With debug = 7 the test succeeds. The log shows: 2026.05.13 16:49:06 LOG5[4]: Service [Zen-pop3] accepted connection from 127.0.0.1:49596 2026.05.13 16:49:06 LOG5[4]: s_connect: connected 212.23.1.19:995 2026.05.13 16:49:06 LOG5[4]: Service [Zen-pop3] connected remote server from 127.0.0.1:49598 2026.05.13 16:49:06 LOG5[4]: Connection closed: 59 byte(s) sent to TLS, 202 byte(s) sent to socket With ;debug a test connection fails after about 20 seconds delay. Log extract: 2026.05.13 17:22:05 LOG5[6]: Service [Zen-pop3] accepted connection from 127.0.0.1:53162 2026.05.13 17:22:05 LOG5[6]: s_connect: connected 212.23.1.11:995 2026.05.13 17:22:05 LOG5[6]: Service [Zen-pop3] connected remote server from 127.0.0.1:53163 2026.05.13 17:22:26 LOG3[6]: SSL_connect: Connection reset by peer (WSAECONNRESET) (10054) Why does it only work with debug enabled? Any ideas, please? Regards, == Graham

2 1

[PATCH 0/3] LDAP server-side STARTTLS support
by Steffen Heil | secforge 13 May '26

13 May '26

Hi Michal, This series adds server-side STARTTLS support for the LDAP protocol handler (RFC 2830). Three patches are attached: 0001 — core feature (src/protocol.c only) 0002 — automated test plugin for make check 0003 — optional Docker-based live integration test [RFC] Background ---------- stunnel already supports LDAP STARTTLS on the client side (ldap_client_middle): it connects to an LDAP backend, sends a StartTLS ExtendedRequest, waits for the success response, and then performs the TLS handshake toward the backend. The server side was missing. Without it, stunnel could not act as a TLS termination proxy in front of a plain LDAP backend for clients that initiate connections using STARTTLS — a common deployment pattern where legacy LDAP clients that do not support LDAPS (TLS-on-connect) still expect to negotiate TLS via STARTTLS before sending credentials. Patch 1 — core feature ----------------------- Two new functions in src/protocol.c, mirroring the structure of the existing client-side implementation: ldap_server_init Sets connect_before_ssl=1 so stunnel establishes the TCP connection to the backend before starting the TLS handshake with the local client. ldap_server_middle Reads the incoming LDAPMessage from the client and validates it as a StartTLS ExtendedRequest (APPLICATION 23, OID 1.3.6.1.4.1.1466.20037). Extracts the messageID and sends back a well-formed StartTLS ExtendedResponse (APPLICATION 24, resultCode=success) with the matching messageID. stunnel then performs SSL_accept with the client. WinLDAP-style four-byte length encoding is handled, matching the existing client-side behaviour. Both functions are registered in the PROTOCOL dispatch table under the existing "ldap" name, so protocol = ldap now works for both client and server services. Patch 2 — automated tests -------------------------- p28_ldap_starttls.py adds two tests to make check: Test 281: the Python test harness performs the RFC 2830 StartTLS exchange directly against a stunnel server (protocol=ldap), then upgrades to TLS via asyncio's loop.start_tls(), exercising ldap_server_middle in isolation. Test 282: a full client→server proxy chain where both stunnel instances run with protocol=ldap, exercising ldap_client_middle and ldap_server_middle together end-to-end. Patch 3 — live integration test [RFC / optional] ------------------------------------------------- ldap_starttls_live_test.sh is a shell script that runs against a real OpenLDAP server (osixia/openldap) in Docker. It requires Docker, ldapsearch/ldapadd, and openssl, so it is not part of make check. I'm sending it as an optional follow-up in case it is useful for manual verification or as a starting point for a CI stage. Feel free to drop it if it does not fit the project's test infrastructure. License ------- I dedicate my contributions in this patch series to the public domain, in line with the contribution policy stated in CREDITS.md. Regards, Steffen Heil Geschäftsführer _______________________________________________________________________________ secforge GmbH Starterzentrum | Campus A1.1 | 66123 Saarbrücken | Deutschland Phone: +49 179 2339260 | +49 681 93355440 E-Mail: steffen.heil(a)secforge.de<mailto:steffen.heil@secforge.de> Web: https://www.secforge.de Registergericht: Amtsgerichts Saarbrücken | HRB 109882 Geschäftsführer: Steffen Heil, Dr. Mikhail Kovalev

1 0

client UDP 5093 -> TCP 5555 and vice versa in Server (TCP 5555 -> UDP 5093)
by admin＠igram.gr 19 Apr '26

19 Apr '26

Hi, I have a project where several students with IBM SPSS installed need to connect to a server where the IBM SPSS Network License Manager (Sentinel RMS) is installed and it requires that UDP port 5093 be open on the server's firewall to allow the clients to communicate and retrieve licenses. In my case this is not allowed in the firewall and I am trying to find solutions. One solution is to create VPN users to ensure that only allowed clients can communicate on this port (UDP 5093). But I prefer to keep the port closed for everyone. So the question is of it is possible with stunnel to convert / wrap e.g. by users the UDP port 5093, to "convert" it to TCP e.g. 5555 thus bypassing the firewall policy on the server side (TCP/UDP 5093 is not allowed), and on the server side to do the reverse, i.e. the "conversion" from TCP 5555 to UDP 5093 or is it a stupid idea? Has anyone done a similar project? THX John

2 1

[PATCH] checkPurpose configuration to circumvent EKU
by stunnel＠benary.org 14 Apr '26

14 Apr '26

From: benaryorg <binary(a)benary.org> What this does in a nutshell is to allow to use client certificates for servers, and server certificates for clients. This has become a relevant workaround for people using Let's Encrypt certificates for mutual TLS authentication (i.e. checkHost on both sides). Let's Encrypt, due to pressure from Google, have disabled client usage in their certificates, thereby causing issues in the latest renewals. https://letsencrypt.org/2025/05/14/ending-tls-client-authentication Any connections initiated by a client using a server certificate as to authenticate against a server cause a "unsuitable certificate purpose" on the server side and a TLS termination on the client side. This patch allows to simply override this check, for better or for worse. An earlier version was written with `checkPurpose` being allowed to occur multiple times (like `checkHost` and friends). However the value set does not support binary OR (it is simply sequentially numbered). Signed-off-by: benaryorg <binary(a)benary.org> --- doc/stunnel.8.in | 7 +++++++ doc/stunnel.html.in | 8 ++++++++ doc/stunnel.pod.in | 8 ++++++++ src/options.c | 35 +++++++++++++++++++++++++++++++++++ src/prototypes.h | 1 + src/verify.c | 3 +++ 6 files changed, 62 insertions(+) diff --git a/doc/stunnel.8.in b/doc/stunnel.8.in index db02292..4450715 100644 --- a/doc/stunnel.8.in +++ b/doc/stunnel.8.in @@ -460,6 +460,13 @@ addresses specified with \fIcheckIP\fR. Multiple \fIcheckIP\fR options are allowed in a single service section. .Sp This option requires OpenSSL 1.0.2 or later. +.IP "\fBcheckPurpose\fR = default | any | client | server" 4 +.IX Item "\fBcheckPurpose\fR = default | any | client | server" +verify the Extended Key Usage of the peer certificate +.Sp +Certificate verification only succeeds if the certificate purpose, +specifically the Extended Key Usage, matches the parameters specified with +\fIcheckPurpose\fR. .IP "\fBciphers\fR = CIPHER_LIST" 4 .IX Item "ciphers = CIPHER_LIST" select permitted TLS ciphers (TLSv1.2 and below) diff --git a/doc/stunnel.html.in b/doc/stunnel.html.in index 90e8556..6eca48e 100644 --- a/doc/stunnel.html.in +++ b/doc/stunnel.html.in @@ -552,6 +552,14 @@ This option requires OpenSSL 1.0.2 or later. +</dd> +<dt id="checkPurpose-default-any-client-server">checkPurpose = default | any | client | server</dt> +<dd> + +verify the Extended Key Usage of the peer certificate + +Certificate verification only succeeds if the certificate purpose, specifically the Extended Key Usage, matches the parameters specified with checkPurpose. + </dd> <dt id="ciphers-CIPHER_LIST">ciphers = CIPHER_LIST</dt> <dd> diff --git a/doc/stunnel.pod.in b/doc/stunnel.pod.in index 752359d..977a879 100644 --- a/doc/stunnel.pod.in +++ b/doc/stunnel.pod.in @@ -500,6 +500,14 @@ Multiple I<checkIP> options are allowed in a single service section. This option requires OpenSSL 1.0.2 or later. +=item B<checkPurpose> = default | any | client | server + +verify the Extended Key Usage of the peer certificate + +Certificate verification only succeeds if the certificate purpose, +specifically the Extended Key Usage, matches the parameters specified with +I<checkPurpose>. + =item B<ciphers> = CIPHER_LIST select permitted TLS ciphers (TLSv1.2 and below) diff --git a/src/options.c b/src/options.c index 800d1f3..2ed4111 100644 --- a/src/options.c +++ b/src/options.c @@ -1854,6 +1854,41 @@ NOEXPORT const char *parse_service_option(CMD cmd, SERVICE_OPTIONS **section_ptr break; } + /* checkPurpose */ + switch(cmd) { + case CMD_SET_DEFAULTS: + section->check_purpose=X509_PURPOSE_DEFAULT_ANY; + break; + case CMD_SET_COPY: + section->check_purpose=new_service_options.check_purpose; + break; + case CMD_FREE: + break; + case CMD_SET_VALUE: + if(strcasecmp(opt, "checkPurpose")) + break; + if(!strcasecmp(arg, "default")) { + section->check_purpose=X509_PURPOSE_DEFAULT_ANY; + } else if(!strcasecmp(arg, "any")) { + section->check_purpose=X509_PURPOSE_ANY; + } else if(!strcasecmp(arg, "client")) { + section->check_purpose=X509_PURPOSE_SSL_CLIENT; + } else if(!strcasecmp(arg, "server")) { + section->check_purpose=X509_PURPOSE_SSL_SERVER; + } else { + return "The argument needs to be one of: default, any, client, server"; + } + return NULL; /* OK */ + case CMD_INITIALIZE: + break; + case CMD_PRINT_DEFAULTS: + break; + case CMD_PRINT_HELP: + s_log(LOG_NOTICE, "%-22s = client|server check for extended key usage", + "checkPurpose"); + break; + } + #endif /* OPENSSL_VERSION_NUMBER>=0x10002000L */ /* ciphers */ diff --git a/src/prototypes.h b/src/prototypes.h index 1142993..fde3da9 100644 --- a/src/prototypes.h +++ b/src/prototypes.h @@ -303,6 +303,7 @@ struct service_options_struct { NAME_LIST *check_host, *check_email, *check_ip; /* cert subject checks */ NAME_LIST *config; /* OpenSSL CONF options */ #endif /* OPENSSL_VERSION_NUMBER>=0x10002000L */ + int check_purpose; /* Extended Key Usage */ /* service-specific data for ctx.c */ char *cipher_list; diff --git a/src/verify.c b/src/verify.c index 7bab21e..e7dfe9f 100644 --- a/src/verify.c +++ b/src/verify.c @@ -78,6 +78,9 @@ int verify_init(SERVICE_OPTIONS *section) { verify_mode|=SSL_VERIFY_FAIL_IF_NO_PEER_CERT; } SSL_CTX_set_verify(section->ctx, verify_mode, verify_callback); + if(section->check_purpose) { + SSL_CTX_set_purpose(section->ctx, section->check_purpose); + } auth_warnings(section); -- 2.53.0

2 2

stunnel 5.78 released
by Michał Trojnara 10 Apr '26

10 Apr '26

Dear Users, I have released version 5.78 of stunnel. ### Version 5.78, 2026.04.09, urgency: MEDIUM * Security bugfixes - OpenSSL DLLs updated to version 3.5.6. * Bugfixes - Fixed WIN32 transfer() loop errors with OOB TCP. - Fixed a memory leak introduced in version 5.73. - Build fix for systems without timegm() (thanks to Jose A. Diaz and Shubham Gupta). - Fixed a startup crash when both global (default) and service-level lists of values are configured for an option. * Features - Support for zstd and brotli compression with OpenSSL 3.2 and TLS 1.2 or older. - WIN32 OpenSSL build with zlib and zstd support. - Support for new "options" parameter values. - Less bloated errors on an invalid configuration file. - Documentation updated from Pod to Pandoc Markdown. - Removed support for OpenSSL versions older than 0.9.8. The final update for the OpenSSL 0.9.7 branch (0.9.7m) was issed on 23 Feb 2007. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 8727e53bb8b7528f850327a2a149158422c02183bc120d1d733cc65b1e2c349d stunnel-5.78.tar.gz 541700197ce2e03dd86b343d9cbf6434359cca9f44e6927fde1d2c76c355c3e6 stunnel-5.78-win64-installer.exe b585d0828165d2e317f3956f2657fa6fb265b34b3ff49181bf561acd8eea2500 stunnel-5.78-android.zip Best regards, Mike

5 6

Connecting to Oracle errors to Connection reset by peer (104)
by HERCEK, Marián 27 Mar '26

27 Mar '26

Hello. Anybody has working setup with Oracle (SQLPlus)? Mine ends up with "Connection reset by peer". Server pid = /var/run/stunnel-oracle.pid cert = /etc/stunnel/stunnel.pem debug = 7 output = /var/log/stunnel/stunnel.log client = no [oracle] accept = 1.2.3.4:11521 connect = 127.0.0.1:1521 stunnel -version Initializing inetd mode configuration stunnel 5.71 on x86_64-redhat-linux-gnu platform Compiled/running with OpenSSL 1.1.1k FIPS 25 Mar 2021 Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Global options: fips = no RNDbytes = 1024 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = PROFILE=SYSTEM (with "fips = yes") ciphers = PROFILE=SYSTEM (with "fips = no") ciphersuites = TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 (with TLSv1.3) curves = P-256:P-521:P-384 (with "fips = yes") curves = X25519:P-256:X448:P-521:P-384 (with "fips = no") debug = daemon.notice logId = sequential options = NO_SSLv2 options = NO_SSLv3 securityLevel = 2 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds TIMEOUTocsp = 5 seconds verify = none Client debug = 7 output = stunnel.log client = yes [oracle] accept = 127.0.0.1:50102 connect = 1.2.3.4:11521 verifyChain = no stunnel 5.77 on x64-pc-mingw32-gnu platform Compiled/running with OpenSSL 3.5.5 27 Jan 2026 Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Global options: fips = no RNDbytes = 1024 RNDoverwrite = yes taskbar = yes Service-level options: ciphers = FIPS:!DH:!kDHEPSK (with "fips = yes") ciphers = HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK (with "fips = no") ciphersuites = TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 (with TLSv1.3) curves = P-256:P-521:P-384 (with "fips = yes") curves = X25519MLKEM768:X25519:P-256:X448:P-521:P-384 (with "fips = no") debug = notice logId = sequential options = NO_SSLv2 options = NO_SSLv3 securityLevel = 2 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds stack = 131072 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds TIMEOUTocsp = 5 seconds verify = none Debug logs from server (client logs are similar) 2026.03.26 12:54:18 LOG7[main]: Found 1 ready file descriptor(s) 2026.03.26 12:54:18 LOG7[main]: FD=4 events=0x2001 revents=0x0 2026.03.26 12:54:18 LOG7[main]: FD=9 events=0x2001 revents=0x1 2026.03.26 12:54:18 LOG7[main]: Service [oracle] accepted (FD=3) from 4.5.6.7:54017 2026.03.26 12:54:18 LOG7[3]: Service [oracle] started 2026.03.26 12:54:18 LOG7[3]: Setting local socket options (FD=3) 2026.03.26 12:54:18 LOG7[3]: Option TCP_NODELAY set on local socket 2026.03.26 12:54:18 LOG5[3]: Service [oracle] accepted connection from 4.5.6.7:54017 2026.03.26 12:54:18 LOG6[3]: Peer certificate not required 2026.03.26 12:54:18 LOG7[3]: TLS state (accept): before SSL initialization 2026.03.26 12:54:18 LOG7[3]: TLS state (accept): before SSL initialization 2026.03.26 12:54:18 LOG7[3]: Initializing application specific data for session authenticated 2026.03.26 12:54:18 LOG7[3]: Decrypt session ticket callback 2026.03.26 12:54:18 LOG6[3]: Decrypted ticket for an authenticated session: yes 2026.03.26 12:54:18 LOG7[3]: SNI: no virtual services defined 2026.03.26 12:54:18 LOG7[3]: TLS state (accept): SSLv3/TLS read client hello 2026.03.26 12:54:18 LOG7[3]: Deallocating application specific data for session connect address 2026.03.26 12:54:18 LOG7[3]: TLS state (accept): SSLv3/TLS write server hello 2026.03.26 12:54:18 LOG7[3]: TLS state (accept): SSLv3/TLS write change cipher spec 2026.03.26 12:54:18 LOG7[3]: TLS state (accept): TLSv1.3 early data 2026.03.26 12:54:18 LOG7[3]: TLS state (accept): TLSv1.3 early data 2026.03.26 12:54:18 LOG7[3]: Initializing application specific data for session authenticated 2026.03.26 12:54:18 LOG7[3]: Decrypt session ticket callback 2026.03.26 12:54:18 LOG6[3]: Decrypted ticket for an authenticated session: yes 2026.03.26 12:54:18 LOG7[3]: SNI: no virtual services defined 2026.03.26 12:54:18 LOG7[3]: TLS state (accept): SSLv3/TLS read client hello 2026.03.26 12:54:18 LOG7[3]: TLS state (accept): SSLv3/TLS write server hello 2026.03.26 12:54:18 LOG7[3]: TLS state (accept): TLSv1.3 write encrypted extensions 2026.03.26 12:54:18 LOG7[3]: TLS state (accept): SSLv3/TLS write finished 2026.03.26 12:54:18 LOG7[3]: TLS state (accept): TLSv1.3 early data 2026.03.26 12:54:18 LOG7[3]: TLS state (accept): TLSv1.3 early data 2026.03.26 12:54:18 LOG7[3]: TLS state (accept): SSLv3/TLS read finished 2026.03.26 12:54:18 LOG7[3]: 4 server accept(s) requested 2026.03.26 12:54:18 LOG7[3]: 4 server accept(s) succeeded 2026.03.26 12:54:18 LOG7[3]: 0 server renegotiation(s) requested 2026.03.26 12:54:18 LOG7[3]: 2 session reuse(s) 2026.03.26 12:54:18 LOG7[3]: 3 internal session cache item(s) 2026.03.26 12:54:18 LOG7[3]: 0 internal session cache fill-up(s) 2026.03.26 12:54:18 LOG7[3]: 0 internal session cache miss(es) 2026.03.26 12:54:18 LOG7[3]: 0 external session cache hit(s) 2026.03.26 12:54:18 LOG7[3]: 0 expired session(s) retrieved 2026.03.26 12:54:18 LOG7[3]: Initializing application specific data for session authenticated 2026.03.26 12:54:18 LOG7[3]: Deallocating application specific data for session connect address 2026.03.26 12:54:18 LOG7[3]: Generate session ticket callback 2026.03.26 12:54:18 LOG7[3]: Initializing application specific data for session authenticated 2026.03.26 12:54:18 LOG7[3]: Deallocating application specific data for session connect address 2026.03.26 12:54:18 LOG7[3]: New session callback 2026.03.26 12:54:18 LOG6[3]: No peer certificate received 2026.03.26 12:54:18 LOG6[3]: Session id: 483B0F9A7D229A299E5FE0AF18B9BC00D26CFB781A363ABC612E6C8481EE8D11 2026.03.26 12:54:18 LOG7[3]: TLS state (accept): SSLv3/TLS write session ticket 2026.03.26 12:54:18 LOG6[3]: TLS accepted: previous session reused 2026.03.26 12:54:18 LOG6[3]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) 2026.03.26 12:54:18 LOG6[3]: Peer temporary key: X25519, 253 bits 2026.03.26 12:54:18 LOG7[3]: Compression: null, expansion: null 2026.03.26 12:54:18 LOG6[3]: Session id: 483B0F9A7D229A299E5FE0AF18B9BC00D26CFB781A363ABC612E6C8481EE8D11 2026.03.26 12:54:18 LOG6[3]: s_connect: connecting 127.0.0.1:1521 2026.03.26 12:54:18 LOG7[3]: s_connect: s_poll_wait 127.0.0.1:1521: waiting 10 seconds 2026.03.26 12:54:18 LOG7[3]: FD=6 events=0x2001 revents=0x0 2026.03.26 12:54:18 LOG7[3]: FD=11 events=0x2005 revents=0x1 2026.03.26 12:54:18 LOG5[3]: s_connect: connected 127.0.0.1:1521 2026.03.26 12:54:18 LOG6[3]: persistence: 127.0.0.1:1521 cached 2026.03.26 12:54:18 LOG5[3]: Service [oracle] connected remote server from 127.0.0.1:43694 2026.03.26 12:54:18 LOG7[3]: Setting remote socket options (FD=11) 2026.03.26 12:54:18 LOG7[3]: Option TCP_NODELAY set on remote socket 2026.03.26 12:54:18 LOG7[3]: Remote descriptor (FD=11) initialized 2026.03.26 12:54:18 LOG6[3]: TLS fd: Connection reset by peer (104) 2026.03.26 12:54:18 LOG6[3]: transfer: SSL_read: Socket is closed 2026.03.26 12:54:18 LOG6[3]: TLS socket closed (SSL_read) 2026.03.26 12:54:18 LOG7[3]: Sent socket write shutdown 2026.03.26 12:54:18 LOG5[3]: Connection closed: 190 byte(s) sent to TLS, 663 byte(s) sent to socket 2026.03.26 12:54:18 LOG7[3]: Deallocating application specific data for session connect address 2026.03.26 12:54:18 LOG7[3]: Remote descriptor (FD=11) closed 2026.03.26 12:54:18 LOG7[3]: Local descriptor (FD=3) closed 2026.03.26 12:54:18 LOG7[3]: Service [oracle] finished (0 left)

2 1

stunnel 5.76+ segfaults when CAfile/cert are specified
by George Pucea 11 Mar '26

11 Mar '26

Dear team, I'm getting segfault when starting a stunnel. Here is a script to reproduce it with alpine: incident_cf cat stunnel-segfault-crash.sh *#!/bin/bash* *#* *# Reproducer: stunnel 5.76+ segfaults when CAfile/cert are specified* *# both globally and per-section with identical values.* *#* *# Requirements: Docker* *#* *# Expected output:* *# Segmentation fault* *# Exit: 139* *#* *docker run --rm alpine:latest sh -c '* *apk add -q stunnel openssl &&* *mkdir -p /app/managed &&* *openssl req -x509 -newkey rsa:2048 -keyout /tmp/k.pem -out /tmp/c.pem -days 1 -noenc -subj /CN=test 2>/dev/null &&* *cat /tmp/c.pem /tmp/k.pem > /app/managed/cert.pem &&* *cp /tmp/c.pem /app/managed/ca-file.pem &&* *echo "stunnel version: $(stunnel -version 2>&1 | grep "^stunnel")" &&* *printf "foreground=yes\nverify=2\nCApath=/etc/ssl/certs\nCAfile=/app/managed/ca-file.pem\ncert=/app/managed/cert.pem\npid=/tmp/s.pid\n[c0]\nclient=yes\naccept=33195\nCAfile=/app/managed/ca-file.pem\ncert=/app/managed/cert.pem\nconnect=192.0.2.1:12195 <http://192.0.2.1:12195>\n" > /tmp/test.conf &&* *stunnel /tmp/test.conf 2>&1; echo "Exit: $?"* *'* The workaround *is* removing the per-section CAfile/cert (relying on global values). Is this a known bug? Where can I report it? Thanks!

2 1