- stunnel-users - stunnel.org

configure.ac patch
by Kip Walraven 11 Dec '14

11 Dec '14

In case others are struggling with CentOS 6.5 configure issues that I had, I'm providing the following unified diff patch -Kip #============================================== --- ../stunnel-5.08/configure.ac 2014-12-03 05:35:16.000000000 -0500 +++ ./configure.ac 2014-12-11 10:32:47.000000000 -0500 @@ -402,13 +402,13 @@ AC_MSG_RESULT([autodetecting]) # the library name has changed to -lsystemd in systemd 209 AC_SEARCH_LIBS([sd_listen_fds], [systemd systemd-daemon], - AC_CHECK_HEADERS([systemd/sd-daemon.h], [ + [ AC_CHECK_HEADERS([systemd/sd-daemon.h], [ AC_DEFINE([USE_SYSTEMD], [1], [Define to 1 to enable systemd socket activation]) AC_MSG_NOTICE([systemd support enabled]) ], [ AC_MSG_NOTICE([systemd header not found]) - ]), [ + ]) ], [ AC_MSG_NOTICE([systemd library not found]) ]) ] @@ -462,7 +462,8 @@ AC_MSG_CHECKING([for compiler sysroot]) if test "$GCC" = yes; then SYSROOT=`$CC --print-sysroot 2>/dev/null` -else +fi +if test -z "$SYSROOT" ; then SYSROOT="/" fi AC_MSG_RESULT([$SYSROOT]) #==============================================

2 1

Can I run stunnel on TWO computers with the same certificates?
by Ben Stover 09 Dec '14

09 Dec '14

I would like to use stunnel from my DEsktop AND my Notebook. Can I run them in parallel (with the same certificates) or do they confuse each other? Ben

1 0

stunnel 5.08 released
by Michal Trojnara 09 Dec '14

09 Dec '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.08 of stunnel. The ChangeLog entry: Version 5.08, 2014.12.09, urgency: MEDIUM: * New features - Added SOCKS4/SOCKS4a protocol support. - Added SOCKS5 protocol support. - Added SOCKS RESOLVE [F0] TOR extension support. - Updated automake to version 1.14.1. - OpenSSL directory searching is now relative to the sysroot. * Bugfixes - Fixed improper hangup condition handling. - Fixed missing -pic linker option. This is required for Android 5.0 and improves security. To setup SOCKS4 VPN configure the following client service: [socks_client] client = yes accept = 127.0.0.1:1080 connect = vpn_server:9080 verify = 4 CAfile = stunnel.pem The corresponding configuration on the vpn_server host: [socks_server] protocol = socks accept = 9080 cert = stunnel.pem key = stunnel.key SOCKS-enabled clients (e.g. web browsers) can now use stunnel client for a VPN service. Encrypted DNS resolver is supported with SOCKS4a, SOCKS5, and SOCKS RESOLVE [F0] TOR extension. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 830b21d24cd237e96f4d7993be43553d4eba4d3cfa2660faa78dec8d41d314fc stunnel-5.08.tar.gz 84c06c8a3f8b6bbb5c1a2b6e352c70bdad1c87f1d5a37476e5dee02f2d65065c stunnel-5.08-installer.exe 28750afe9e5fec4b60b98468ea834cd126e149e8d97074b813b216723a889802 stunnel-5.08-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlSGzsMACgkQ/NU+nXTHMtHQlwCgwsX66e0EU5PMxsfMCdC5sfVt Fy4AnRXe65YLabb7K1XOn6tKncEH0smR =WP5h -----END PGP SIGNATURE-----

1 0

stunnel with TLSv1.2 ciphers
by Jérémy WILLIAME 08 Dec '14

08 Dec '14

Hi, I want to use stunnel with TLSv1.2 ciphers but it doesn't work. I use stunnel 5.07 compiled from source with prefix /opt/stunnel and lastest openssl (1.0.1j) This is my main configuration file: chroot = /opt/stunnel/var/lib/stunnel/ pid = /stunnel4.pid **cert = /opt/stunnel/etc/blabla/bla.pem key = /opt/stunnel/etc/blabla/bla.key ciphers = ECDHE-ECDSA-AES256-GCM-SHA384 options = NO_SSLv2 [imaps] accept = 993 connect = 143 I had to use one of this ciphers: ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES256-SHA384 DHE-RSA-AES256-GCM-SHA384 When i tried to use imaps connection over stunnel : root@bla: imtest -a homer -w homer -p 993 -s localhost SSL_connect error 0 SSL session removed failure: TLS negotiation failed if i use a SSLv3 cipher it works. root@bla: imtest -a homer -w homer -p 993 -s localhost verify error:num=18:self signed certificate TLS connection established: TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits) Someone have any idea ? Thanks. Jeremy

2 1

Stunnel for android
by Neacsu Mihai Adrian 03 Dec '14

03 Dec '14

Hello everyone. I am new to Stunnel, but i would like to compile a working version for Android L. The android version on the website is not compiled with PIE support, thus it does not run on Android L. I tried to look through the source code, and add the flags, -fPie and -pie, but i did not figure out where to do that. Also, after settings 755 on build-android.sh and running it, i get Permission denied on creating folders inside the /bin/android folder, even if i am running as root user. Any help is highly appreciated and i appologize if this has been already write in the archives, but i was not able to find anything related.

2 2

Memory leak on reconfiguration
by Alexander Paramonov 21 Nov '14

21 Nov '14

Hello, colleagues! I suppose there is a memory leak on stunnel reconfiguration when it receives the SIGHUP signal. Here is my experiment with stunnel 5.05 on linux: ~/busybox $ cat /home/posdebug/stunnel.cfg debug=6 options=NO_SSLv2 pid=/tmp/stunnel.pid [57797] accept = 127.0.0.1:57797 connect = 80.90.125.219:64141 key = /usr/unsign/key.pem cert = /usr/unsign/cert.pem CAfile = /usr/unsign/cert.pem verify = 2 ciphers = AES128-SHA:AES256-SHA:DES-CBC3-SHA:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:EDH-RSA-DES-CBC3-SHA sslVersion = all TIMEOUTbusy = 100 TIMEOUTconnect = 100 client = yes ~/busybox $ /usr/postunnel/stunnel /home/posdebug/stunnel.cfg ~/busybox $ top | grep stunnel 986 1 posdebug S *3592* 5.7 0 0.0 /usr/postunnel/stunnel /home/posdebug/stunnel.cfg ~/busybox $ kill -1 986 ~/busybox $ kill -1 986 ~/busybox $ kill -1 986 ~/busybox $ kill -1 986 ~/busybox $ kill -1 986 ~/busybox $ top | grep stunnel 986 1 posdebug S *3720* 5.9 0 0.0 /usr/postunnel/stunnel /home/posdebug/stunnel.cfg ~/busybox $ kill -1 986 ~/busybox $ kill -1 986 ~/busybox $ kill -1 986 ~/busybox $ kill -1 986 ~/busybox $ top | grep stunnel 986 1 posdebug S *3848* 6.2 0 0.0 /usr/postunnel/stunnel /home/posdebug/stunnel.cfg As i noticed, there are a lot of allocs on reconfiguration and only a few free() calls. Why? RAM is not unlimited, as far as i know. Any comments would be highly appreciated. -- Best regards Alexander Paramonov Software Engineer Terminal Technologies

2 4

Errors after upgrading to 5.07
by Mikhail Idris 17 Nov '14

17 Nov '14

Hello, I have recently upgraded to 5.07. But now, the console is spamming with messages such as: SSL_read returned WANT_READ: retrying Is this a critical error? Will it have any impact of any services that are currently using stunnel? Thank you. Regards, Mikhail

2 3

SSLscan does not display a certificate when connecting to stunnel
by Swonk, Glenn 15 Nov '14

15 Nov '14

When I open a connection to display the certificate, it works from openssl. openssl s_client -connect x58.swonk.com:444 However, when I use SSLScan, it only displays the supported server ciphers. SSLScan.exe --no-failed --sslv3 x58.swonk.com:444 I am troubleshooting a problem with a device which cannot connect directly to my https server and am trying to use stunnel to either forward the connection or help understand why it isn't working. The strange thing is that the 'Charles Proxy' (http://www.charlesproxy.com/) seems to forward the requests properly. Can anyone download a copy of SSLscan and test it against their connection? Any other ideas what may be the issue? thanks, glenn ___ ___| |___ ___ __ _ _ __ / __/ __| / __|/ __/ _` | '_ \ \__ \__ \ \__ \ (_| (_| | | | | |___/___/_|___/\___\__,_|_| |_| Version 1.8.2-win http://www.titania.co.uk Copyright Ian Ventura-Whiting 2009 Compiled against OpenSSL 0.9.8m 25 Feb 2010 esting SSL server x58.swonk.com on port 444 Supported Server Cipher(s): Accepted TLSv1 256 bits DHE-RSA-AES256-SHA Accepted TLSv1 256 bits AES256-SHA Accepted TLSv1 128 bits DHE-RSA-AES128-SHA Accepted TLSv1 128 bits AES128-SHA Accepted TLSv1 168 bits EDH-RSA-DES-CBC3-SHA Accepted TLSv1 56 bits EDH-RSA-DES-CBC-SHA Accepted TLSv1 168 bits DES-CBC3-SHA Accepted TLSv1 56 bits DES-CBC-SHA Accepted TLSv1 128 bits IDEA-CBC-SHA Accepted TLSv1 128 bits RC4-SHA Accepted TLSv1 128 bits RC4-MD5 Prefered Server Cipher(s): TLSv1 256 bits DHE-RSA-AES256-SHA ________________________________ This message may contain confidential information. If you are not the intended recipient of this e-mail, do not disseminate, distribute or copy this e-mail and delete this e-mail from your system.

1 0

socks4 support
by Michal Trojnara 15 Nov '14

15 Nov '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, Please take a look at the latest stunnel-5.08b4 available for download on https://www.stunnel.org/downloads.html It adds support for SOCKS4 and SOCKS4a protocols. The SOCKS protocol itself is encapsulated within SSL/TLS encryption layer to protect the final destination address. http://www.openssh.com/txt/socks4.protocol http://www.openssh.com/txt/socks4a.protocol The BIND command of the SOCKS protocol is not supported. The USERID parameter is ignored. To setup SOCKS4 VPN configure the following client service: [socks_client] client = yes accept = 127.0.0.1:1080 connect = vpn_server:9080 verify = 4 CAfile = stunnel.pem The corresponding configuration on the vpn_server host: [socks_server] protocol = socks accept = 9080 cert = stunnel.pem key = stunnel.key Now test your configuration on the client machine with: curl --socks4a localhost http://www.example.com/ Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlRmVXgACgkQ/NU+nXTHMtHuZwCfXlH0YYTHYhThoXPrCgV4OhrE BwsAoLgIpVWDOdBbISzrP53m2H9LUR6W =9DEh -----END PGP SIGNATURE-----

1 1

External validation of client certificates
by Rene Bartsch 15 Nov '14

15 Nov '14

Hi, we're having a special use case and hope to find a solution in stunnel. In our use case clients use self-signed X.509 certificates to authenticate with our TLS-server. We don't have a CA but a database with usernames (DN) and fingerprints of the client-certificates. Is it possible with stunnel not to validate the client certificates against a CA but handover the Distinguished Name to an external application which returns the fingerprint to check the certificate against? -- Best regards, Rene Bartsch, B. Sc. Informatics Current Bitcoin Exchange Rate: https://www.bitcoin.de/de/r/mwfngu

2 1