July 2018 - stunnel-users

stunnel FIPS mode 140-2/ Other Modes
by mehmet ozisik 19 Sep '25

19 Sep '25

Hi All, I would like to ask a question about stunnel fips mode. There are lots of question and answers on the internet related with this, but I could not find any answer related with mine. I am compiling with openssl (auto detecting fips) . Here is a part of confgiure output : checking for FIPS_mode_set... yes configure: FIPS mode detected So I am thinking that fips also is being included. Then I try to run stunnel on target platform (in stunnel.conf fips=yes) and it gives below error : Compiled/running with OpenSSL 0.9.8w-fips 23 Apr 2012 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Reading configuration from file stunnel.conf FIPS_mode_set: 2D06906E: error:2D06906E:FIPS routines:FIPS_CHECK_INCORE_FINGERPRINT:fingerprint does not match there are lots of information about this errror on internet. Then when I configure stunnel.conf with fips=no, stunnel is running successfully. I know that fips=yes means that enables FIPS 140-2 mode and I guess my fips canister does not supoort fips 140-2 mode (I do not know which fips mode it has supported). Now my question is coming : When I set fips=no, stunnel also starts with other available fips modes which the canister included? Or it skips running fips mode completely? Plase inform me if anyone has any idea? Regards

2 1

Requests to cloud server that requires host header
by Lorne Kates 13 Nov '24

13 Nov '24

(related to Akamai message from before-- but I have better troubleshooting information). I'm tying to route traffic through stunnel to a "cloud" based-endpoint. That endpoint has a static server name-- test.authorize.net. (This is the dev sandbox for auth.net) But if you do an nslookup on test.authorize.net, you'll get back a different servername and IP, because it's so wonderfully "cloud". Stunnel apparently tries to connect to the nslookup value. The server rejects the request because it can't route it back to test.authorize.net. I've tried adding "delay = yes" and "sni = test.authorize.net", but neither work. To see this in action, a simple setup with any accept, then connect to test.authorize.net:443 in client = yes mode. This is what a valid response looks like (13 -- give me the darn merchant ID in a POST): https://test.authorize.net/gateway/transact.dll This is what you'll get if you try to use stunnel (400 invalid url) : https://23.195.204.150/gateway/transact.dll So how can I get stunnel to send the proper Request Header (host: test.authorize.net) make sure it's using http/1.1, etc?

4 3

Stunnel 4 failing to connect to gmail
by Asif Iqbal 11 Dec '20

11 Dec '20

I am faling to connect to gmail. Not sure what that bind error means. iqbala@ghar:~$ sudo stunnel4 2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes from /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes to /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims sufficient entropy for the PRNG 2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for service ssmtp 2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE limit for file descriptors 2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on accept socket 2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to 74.125.93.111:587 2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign requested address (99) Here is how my conf file looks like iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$" cert = /etc/stunnel/stunnel.pem foreground = yes sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [ssmtp] accept = smtp.gmail.com:587 connect = 25 Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

5 9

Stunnel & Gmail security
by BOXI31 TEST 16 Oct '20

16 Oct '20

Hi all, To make "Stunnel 5.31" work with Gmail, I have to go in security settings of Gmail and "allow less secure apps to access my account". Is it mandatory ? Is it possible to set Stunnel to access Gmail without lowering it security level ? How ? I checked in log file TLS v1.2 is used by Stunnel but Gmail still consider it as a "less secure app." ! Regards, Steve

2 1

Re: [stunnel-users] Is there a way to specify certificate content in stunnel config
by Eric S Eberhard 24 Jul '18

24 Jul '18

Use stunnel in inetd mode. Execute a script (or better C program). Copy the certificates for making the stunnel connection to a directory that is OK … then delete them immediately after stunnel starts. Hack – but might be OK for what you are doing. I am not sure why anyone would think it more secure to put the keys into the stunnel command than to just use them from a file … but I likely do not know enough about your application to make a judgement. Eric Eric S Eberhard VICS (Vertical Integrated Computer Systems) Voice: 928 567 3529 Cell : 928 301 7537 (not reliable except for text or if not home) 2933 W Middle Verde Rd Camp Verde, AZ 86322 From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Hari Sent: Thursday, July 19, 2018 4:42 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Is there a way to specify certificate content in stunnel config Hi, I have a requirement where in i cannot specify the certificate and/or private key details as "files" to stunnel configuration, owing to the location and/or file system availability for stunnel to access them. Is there a way to specify the actual certificate content in stunnel configuration (similar to other parameters like port numbers etc.,) so that the same can be leveraged. Thanks Hari <http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_cam…> Virus-free. <http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_cam…> www.avg.com

3 2

Grok log parsing
by Manuele Trimarchi 24 Jul '18

24 Jul '18

I would ask if someone use Grok log parsing for stunnel and, if yes, what kind of filter statement are you using? At the moment I've just created 2 parser: STUNNEL_AcceptedConnectionParser %{date("yyyy.MM.dd HH:mm:ss"):date} LOG%{integer:loglevel}\[%{integer:session_id}\]\: Service \[%{word:csb_name}\-%{word:csb_port}\] accepted connection from %{ipv4:caller_ip}\:%{port:caller_port} and STUNNEL_ConnectionClosedParser %{date("yyyy.MM.dd HH:mm:ss"):date} LOG%{integer:loglevel}\[%{integer:session_id}\]\: Connection closed\: %{integer:byte_tx} byte$s$ sent to SSL\, %{integer:byte_rx} byte$s$ sent to socket I'm new with Grok and all the things related to log match-and-parse, so I think that there will be a much better solution than mine, anyway Google this time doesn't help unfortunately. Thank you so much to all those who will help me with this stuff! Manuele

1 1

Cross Compiling Stunnel-5.48 Using BoringSSL
by Jaymin D 24 Jul '18

24 Jul '18

Hi All, I want to cross compile the Stunnel-5.48 for my Android AOSP (arch64) platform using BoringSSL's 'libssl.so' and 'libcrypto.so' libraries. I have successfully cross compiled the BoringSSL in my AOSP and both .so file was generated for arch64 platform. Am using BoringSSL which was delivered with Android AOSP (Android 7). Am cross compiling using "build-android.sh" script. But, while cross compiling the Stunnel-5.48 facing error as below: ------------------------------------------------------------------------------------------------ VERSION=5.48 > DST=stunnel-$VERSION-android > # to build OpenSSL: > # ./Configure threads no-shared no-dso > --cross-compile-prefix=arm-linux-androideabi- > --prefix=/opt/androideabi/sysroot linux-armv4 > # make install > LDFLAGS="$LDFLAGS -L/home/jaymin/Desktop/boringssl_lib -fPIE" > export LDFLAGS > test -f Makefile && make distclean > mkdir -p bin/android > cd bin/android > ../../configure --with-pic --enable-shared --with-sysroot > --host=aarch64-linux-android --with-ssl=/home/jaymin/Desktop/boringssl_lib > configure: **************************************** initialization > checking for a BSD-compatible install... /usr/bin/install -c > checking whether build environment is sane... yes > checking for aarch64-linux-android-strip... no > checking for strip... strip > checking for a thread-safe mkdir -p... /bin/mkdir -p > checking for gawk... gawk > checking whether make sets $(MAKE)... yes > checking whether make supports nested variables... yes > checking build system type... x86_64-pc-linux-gnu > checking host system type... aarch64-unknown-linux-android > checking for aarch64-linux-android-gcc... no > checking for gcc... gcc > checking whether the C compiler works... yes > checking for C compiler default output file name... a.out > checking for suffix of executables... > checking whether we are cross compiling... no > checking for suffix of object files... o > checking whether we are using the GNU C compiler... yes > checking whether gcc accepts -g... yes > checking for gcc option to accept ISO C89... none needed > checking whether gcc understands -c and -o together... yes > checking for style of include used by make... GNU > checking dependency style of gcc... gcc3 > checking whether make sets $(MAKE)... (cached) yes > checking whether make supports nested variables... (cached) yes > configure: **************************************** thread model > checking for a sed that does not truncate output... /bin/sed > checking how to run the C preprocessor... gcc -E > checking for grep that handles long lines and -e... /bin/grep > checking for egrep... /bin/grep -E > checking whether gcc is Clang... no > checking whether pthreads work with -pthread... yes > checking for joinable pthread attribute... PTHREAD_CREATE_JOINABLE > checking whether more special flags are required for pthreads... no > checking for PTHREAD_PRIO_INHERIT... yes > configure: PTHREAD thread model detected > configure: **************************************** compiler/linker flags > checking whether C compiler accepts -Wall... yes > checking whether C compiler accepts -Wextra... yes > checking whether C compiler accepts -Wpedantic... yes > checking whether C compiler accepts -Wformat=2... yes > checking whether C compiler accepts -Wconversion... yes > checking whether C compiler accepts -Wno-long-long... yes > checking whether C compiler accepts -Wno-deprecated-declarations... yes > checking whether C compiler accepts -fPIE... yes > checking whether C compiler accepts -fstack-protector... yes > checking whether the linker accepts -fPIE... yes > checking whether the linker accepts -pie... yes > checking whether the linker accepts -Wl,-z,relro... yes > checking whether the linker accepts -Wl,-z,now... yes > checking whether the linker accepts -Wl,-z,noexecstack... yes > checking whether C compiler accepts -D_FORTIFY_SOURCE=2... yes > configure: **************************************** libtool > checking how to print strings... printf > checking for a sed that does not truncate output... (cached) /bin/sed > checking for fgrep... /bin/grep -F > checking for ld used by gcc... /usr/bin/ld > checking if the linker (/usr/bin/ld) is GNU ld... yes > checking for BSD- or MS-compatible name lister (nm)... no > checking for aarch64-linux-android-dumpbin... no > checking for aarch64-linux-android-link... no > checking for dumpbin... no > checking for link... link -dump > checking the name lister (nm) interface... BSD nm > checking whether ln -s works... yes > checking the maximum length of command line arguments... 1572864 > checking how to convert x86_64-pc-linux-gnu file names to > aarch64-unknown-linux-android format... func_convert_file_noop > checking how to convert x86_64-pc-linux-gnu file names to toolchain > format... func_convert_file_noop > checking for /usr/bin/ld option to reload object files... -r > checking for aarch64-linux-android-objdump... no > checking for objdump... objdump > checking how to recognize dependent libraries... pass_all > checking for aarch64-linux-android-dlltool... no > checking for dlltool... no > checking how to associate runtime and link libraries... printf %s\n > checking for aarch64-linux-android-ar... no > checking for ar... ar > checking for archiver @FILE support... @ > checking for aarch64-linux-android-strip... strip > checking for aarch64-linux-android-ranlib... no > checking for ranlib... ranlib > checking command to parse nm output from gcc object... ok > checking for sysroot... / > checking for a working dd... /bin/dd > checking how to truncate binary pipes... /bin/dd bs=4096 count=1 > checking for aarch64-linux-android-mt... no > checking for mt... mt > checking if mt is a manifest tool... no > checking for ANSI C header files... yes > checking for sys/types.h... yes > checking for sys/stat.h... yes > checking for stdlib.h... yes > checking for string.h... yes > checking for memory.h... yes > checking for strings.h... yes > checking for inttypes.h... yes > checking for stdint.h... yes > checking for unistd.h... yes > checking for dlfcn.h... yes > checking for objdir... .libs > checking if gcc supports -fno-rtti -fno-exceptions... no > checking for gcc option to produce PIC... -fPIC -DPIC > checking if gcc PIC flag -fPIC -DPIC works... yes > checking if gcc static flag -static works... no > checking if gcc supports -c -o file.o... yes > checking if gcc supports -c -o file.o... (cached) yes > checking whether the gcc linker (/usr/bin/ld) supports shared libraries... > yes > checking whether -lc should be explicitly linked in... no > checking dynamic linker characteristics... Android linker > checking how to hardcode library paths into programs... immediate > checking whether stripping libraries is possible... yes > checking if libtool supports shared libraries... yes > checking whether to build shared libraries... yes > checking whether to build static libraries... no > configure: **************************************** types > checking for int8_t... yes > checking for int16_t... yes > checking for int32_t... yes > checking for int64_t... yes > checking for uint8_t... yes > checking for uint16_t... yes > checking for uint32_t... yes > checking for uint64_t... yes > checking for size_t... yes > checking for ssize_t... yes > checking for uid_t in sys/types.h... yes > checking for socklen_t... yes > checking for struct sockaddr_un... yes > checking for struct addrinfo... yes > configure: **************************************** PTY device files > checking for "/dev/ptmx"... yes > checking for "/dev/ptc"... no > configure: **************************************** entropy sources > checking for "/dev/urandom"... yes > configure: **************************************** default group > checking for default group... nogroup > checking for special C compiler options needed for large files... no > checking for _FILE_OFFSET_BITS value needed for large files... no > configure: **************************************** header files > checking for stdint.h... (cached) yes > checking for inttypes.h... (cached) yes > checking malloc.h usability... yes > checking malloc.h presence... yes > checking for malloc.h... yes > checking ucontext.h usability... yes > checking ucontext.h presence... yes > checking for ucontext.h... yes > checking pthread.h usability... yes > checking pthread.h presence... yes > checking for pthread.h... yes > checking poll.h usability... yes > checking poll.h presence... yes > checking for poll.h... yes > checking tcpd.h usability... no > checking tcpd.h presence... no > checking for tcpd.h... no > checking stropts.h usability... yes > checking stropts.h presence... yes > checking for stropts.h... yes > checking grp.h usability... yes > checking grp.h presence... yes > checking for grp.h... yes > checking for unistd.h... (cached) yes > checking util.h usability... no > checking util.h presence... no > checking for util.h... no > checking libutil.h usability... no > checking libutil.h presence... no > checking for libutil.h... no > checking pty.h usability... yes > checking pty.h presence... yes > checking for pty.h... yes > checking limits.h usability... yes > checking limits.h presence... yes > checking for limits.h... yes > checking for sys/types.h... (cached) yes > checking sys/select.h usability... yes > checking sys/select.h presence... yes > checking for sys/select.h... yes > checking sys/poll.h usability... yes > checking sys/poll.h presence... yes > checking for sys/poll.h... yes > checking sys/socket.h usability... yes > checking sys/socket.h presence... yes > checking for sys/socket.h... yes > checking sys/un.h usability... yes > checking sys/un.h presence... yes > checking for sys/un.h... yes > checking sys/ioctl.h usability... yes > checking sys/ioctl.h presence... yes > checking for sys/ioctl.h... yes > checking sys/filio.h usability... no > checking sys/filio.h presence... no > checking for sys/filio.h... no > checking sys/resource.h usability... yes > checking sys/resource.h presence... yes > checking for sys/resource.h... yes > checking sys/uio.h usability... yes > checking sys/uio.h presence... yes > checking for sys/uio.h... yes > checking sys/syscall.h usability... yes > checking sys/syscall.h presence... yes > checking for sys/syscall.h... yes > checking linux/sched.h usability... yes > checking linux/sched.h presence... yes > checking for linux/sched.h... yes > checking for struct msghdr.msg_control... yes > checking for linux/netfilter_ipv4.h... yes > configure: **************************************** libraries > checking for library containing gethostbyname... none required > checking for library containing yp_get_default_domain... -lnsl > checking for library containing socket... none required > checking for library containing openpty... -lutil > checking for library containing dlopen... -ldl > checking for library containing shl_load... no > configure: **************************************** library functions > checking for snprintf... yes > checking for vsnprintf... yes > checking for openpty... yes > checking for _getpty... no > checking for daemon... yes > checking for waitpid... yes > checking for wait4... yes > checking for setsid... yes > checking for setgroups... yes > checking for chroot... yes > checking for realpath... yes > checking for sysconf... yes > checking for getrlimit... yes > checking for pthread_sigmask... yes > checking for localtime_r... yes > checking for getcontext... yes > checking for __makecontext_v2... no > checking for poll... yes > checking for gethostbyname2... yes > checking for endhostent... yes > checking for getnameinfo... yes > checking for getaddrinfo... yes > checking for broken poll() implementation... no > checking for pipe2... yes > checking for accept4... yes > configure: **************************************** optional features > checking whether to enable IPv6 support... yes (default) > checking whether to enable FIPS support... autodetecting > checking whether to enable systemd socket activation support... > autodetecting > checking for library containing sd_listen_fds... no > configure: systemd library not found > checking whether to enable TCP wrappers support... autodetecting > checking for hosts_access in -lwrap... no > configure: libwrap library not found > configure: **************************************** TLS > checking for compiler sysroot... / > checking for TLS directory... /home/jaymin/Desktop/boringssl_lib > checking for FIPS_mode_set... yes > configure: FIPS support enabled > configure: **************************************** write the results > checking that generated files are newer than configure... done > configure: creating ./config.status > config.status: creating Makefile > config.status: creating src/Makefile > config.status: creating doc/Makefile > config.status: creating tools/Makefile > config.status: creating tests/Makefile > config.status: creating src/config.h > config.status: src/config.h is unchanged > config.status: executing depfiles commands > config.status: executing libtool commands > configure: **************************************** success > make clean > Making clean in src > make[1]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/src' > rm -f stunnel > test -z "stunnel3" || rm -f stunnel3 > rm -rf .libs _libs > rm -rf ../obj ../bin > test -z "libstunnel.la" || rm -f libstunnel.la > rm -f ./so_locations > rm -f *.o > rm -f *.lo > make[1]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/src' > Making clean in doc > make[1]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/doc' > test -z "stunnel.8 stunnel.pl.8 stunnel.html stunnel.pl.html" || rm -f > stunnel.8 stunnel.pl.8 stunnel.html stunnel.pl.html > rm -rf .libs _libs > rm -f *.lo > make[1]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/doc' > Making clean in tools > make[1]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/tools' > test -z "stunnel.conf-sample stunnel.init stunnel.service" || rm -f > stunnel.conf-sample stunnel.init stunnel.service > rm -rf .libs _libs > rm -f *.lo > make[1]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/tools' > Making clean in tests > make[1]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/tests' > rm -rf .libs _libs > rm -f *.lo > make[1]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/tests' > make[1]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android' > rm -rf .libs _libs > rm -f *.lo > make[1]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android' > make > Making all in src > make[1]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/src' > make all-am > make[2]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/src' > CC env.lo > CCLD libstunnel.la > CC stunnel-tls.o > CC stunnel-str.o > CC stunnel-file.o > CC stunnel-client.o > CC stunnel-log.o > CC stunnel-options.o > CC stunnel-protocol.o > CC stunnel-network.o > CC stunnel-resolver.o > CC stunnel-ssl.o > CC stunnel-ctx.o > CC stunnel-verify.o > CC stunnel-sthreads.o > CC stunnel-fd.o > CC stunnel-dhparam.o > CC stunnel-cron.o > CC stunnel-stunnel.o > CC stunnel-pty.o > CC stunnel-libwrap.o > CC stunnel-ui_unix.o > CCLD stunnel > /usr/bin/ld: skipping incompatible > /home/jaymin/Desktop/boringssl_lib/libssl.so when searching for -lssl > /usr/bin/ld: skipping incompatible > /home/jaymin/Desktop/boringssl_lib/libcrypto.so when searching for -lcrypto > stunnel-str.o: In function `str_leak_debug': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/str.c:459: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/str.c:470: > undefined reference to `CRYPTO_THREAD_unlock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/str.c:501: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/str.c:509: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-client.o: In function `session_cache_retrieve': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:568: > undefined reference to `CRYPTO_THREAD_read_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:581: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-client.o: In function `ssl_start': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:501: > undefined reference to `OpenSSL_version_num' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:519: > undefined reference to `CRYPTO_THREAD_unlock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:511: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:502: > undefined reference to `OpenSSL_version_num' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:503: > undefined reference to `OpenSSL_version_num' > stunnel-client.o: In function `print_cipher': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:595: > undefined reference to `SSL_session_reused' > stunnel-client.o: In function `idx_cache_retrieve': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1446: > undefined reference to `SSL_session_reused' > stunnel-client.o: In function `idx_cache_save': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1432: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1436: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-client.o: In function `idx_cache_retrieve': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1447: > undefined reference to `CRYPTO_THREAD_read_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1453: > undefined reference to `CRYPTO_THREAD_unlock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1469: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-client.o: In function `client_run': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:224: > undefined reference to `CRYPTO_atomic_add' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:323: > undefined reference to `CRYPTO_atomic_add' > stunnel-log.o: In function `log_close': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:109: > undefined reference to `CRYPTO_THREAD_write_lock' > stunnel-log.o: In function `s_log': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:165: > undefined reference to `CRYPTO_THREAD_read_lock' > stunnel-log.o: In function `log_queue': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:194: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:201: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-log.o: In function `s_log': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:170: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-log.o: In function `log_flush': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:205: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:211: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:219: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-log.o: In function `log_close': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:115: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-log.o: In function `log_flush': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:220: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-options.o: In function `engine_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:4219: > undefined reference to `OPENSSL_init_crypto' > stunnel-options.o: In function `service_up_ref': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:614: > undefined reference to `CRYPTO_atomic_add' > stunnel-options.o: In function `parse_global_option': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:681: > undefined reference to `OpenSSL_version_num' > stunnel-options.o: In function `tls_methods_set': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:3514: > undefined reference to `TLS_client_method' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:3515: > undefined reference to `TLS_server_method' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:3506: > undefined reference to `TLS_client_method' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:3507: > undefined reference to `TLS_server_method' > stunnel-options.o: In function `service_up_ref': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:614: > undefined reference to `CRYPTO_atomic_add' > stunnel-options.o: In function `service_free': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:624: > undefined reference to `CRYPTO_atomic_add' > stunnel-ssl.o: In function `ssl_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ssl.c:56: > undefined reference to `OPENSSL_init_ssl' > stunnel-ssl.o: In function `sk_SSL_COMP_pop': > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:846: undefined > reference to `OPENSSL_sk_pop' > stunnel-ssl.o: In function `sk_SSL_COMP_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:846: undefined > reference to `OPENSSL_sk_num' > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:846: undefined > reference to `OPENSSL_sk_num' > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:846: undefined > reference to `OPENSSL_sk_num' > stunnel-ssl.o: In function `sk_SSL_COMP_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:846: undefined > reference to `OPENSSL_sk_value' > stunnel-ssl.o: In function `compression_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ssl.c:217: > undefined reference to `SSL_COMP_get0_name' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ssl.c:221: > undefined reference to `SSL_COMP_get_id' > stunnel-ssl.o: In function `ssl_configure': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ssl.c:127: > undefined reference to `OPENSSL_init_crypto' > stunnel-ssl.o: In function `compression_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ssl.c:201: > undefined reference to `COMP_get_type' > stunnel-ctx.o: In function `info_callback': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:1231: > undefined reference to `SSL_get_state' > stunnel-ctx.o: In function `session_cache_save': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:981: > undefined reference to `SSL_SESSION_up_ref' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:986: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:999: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-ctx.o: In function `sk_X509_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_value' > stunnel-ctx.o: In function `sk_X509_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_num' > stunnel-ctx.o: In function `session_cache_save': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:999: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-ctx.o: In function `context_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:154: > undefined reference to `SSL_CTX_set_options' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:157: > undefined reference to `SSL_CTX_clear_options' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:161: > undefined reference to `SSL_CTX_set_options' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:164: > undefined reference to `SSL_CTX_clear_options' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:170: > undefined reference to `SSL_CTX_get_options' > stunnel-ctx.o: In function `dh_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:328: > undefined reference to `SSL_CTX_get_ciphers' > stunnel-ctx.o: In function `sk_SSL_CIPHER_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:845: undefined > reference to `OPENSSL_sk_num' > stunnel-ctx.o: In function `sk_SSL_CIPHER_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:845: undefined > reference to `OPENSSL_sk_value' > stunnel-ctx.o: In function `dh_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:356: > undefined reference to `CRYPTO_THREAD_read_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:358: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-verify.o: In function `ocsp_request': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/verify.c:539: > undefined reference to `X509_STORE_CTX_get0_chain' > stunnel-verify.o: In function `get_current_issuer': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/verify.c:701: > undefined reference to `X509_STORE_CTX_get0_chain' > stunnel-verify.o: In function `sk_X509_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_num' > stunnel-verify.o: In function `sk_X509_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_value' > stunnel-verify.o: In function `sk_OPENSSL_STRING_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/safestack.h:151: > undefined reference to `OPENSSL_sk_value' > stunnel-verify.o: In function `sk_OPENSSL_STRING_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/safestack.h:151: > undefined reference to `OPENSSL_sk_num' > stunnel-verify.o: In function `cert_check_local': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/verify.c:353: > undefined reference to `X509_STORE_CTX_get1_certs' > stunnel-verify.o: In function `sk_X509_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_num' > stunnel-verify.o: In function `sk_X509_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_value' > stunnel-verify.o: In function `sk_X509_pop_free': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_pop_free' > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_pop_free' > stunnel-verify.o: In function `sk_X509_NAME_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:75: undefined > reference to `OPENSSL_sk_num' > stunnel-verify.o: In function `sk_X509_NAME_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:75: undefined > reference to `OPENSSL_sk_value' > stunnel-sthreads.o: In function `locking_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/sthreads.c:358: > undefined reference to `CRYPTO_THREAD_lock_new' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/sthreads.c:358: > undefined reference to `CRYPTO_THREAD_lock_new' > stunnel-dhparam.o: In function `get_dh2048': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/dhparam.c:49: > undefined reference to `DH_set0_pqg' > stunnel-cron.o: In function `cron_dh_param': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/cron.c:193: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/cron.c:196: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-stunnel.o: In function `stunnel_info': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/stunnel.c:887: > undefined reference to `OpenSSL_version' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/stunnel.c:889: > undefined reference to `OpenSSL_version' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/stunnel.c:890: > undefined reference to `OpenSSL_version_num' > collect2: error: ld returned 1 exit status > Makefile:538: recipe for target 'stunnel' failed > make[2]: *** [stunnel] Error 1 > make[2]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/src' > Makefile:401: recipe for target 'all' failed > make[1]: *** [all] Error 2 > make[1]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/src' > Makefile:447: recipe for target 'all-recursive' failed > make: *** [all-recursive] Error 1 ------------------------------------------------------------------------------------------------ As I want to use SSL, did modification as below: --------------------------------------------------------------------------------------------- #!/bin/sh > set -ev > VERSION=5.48 > DST=stunnel-$VERSION-android > # to build OpenSSL: > # ./Configure threads no-shared no-dso > --cross-compile-prefix=arm-linux-androideabi- > --prefix=/opt/androideabi/sysroot linux-armv4 > # make install > LDFLAGS="$LDFLAGS -L/home/jaymin/Desktop/boringssl_lib -fPIE" > export LDFLAGS > test -f Makefile && make distclean > mkdir -p bin/android > cd bin/android > ../../configure --with-pic --enable-shared --with-sysroot > --host=aarch64-linux-android --with-ssl=/home/jaymin/Desktop/boringssl_lib > make clean > make > cd ../.. > mkdir $DST > cp bin/android/src/stunnel $DST > # arm-linux-androideabi-strip $DST/stunnel $DST/openssl > # cp /opt/androideabi/sysroot/bin/openssl $DST > # arm-linux-androideabi-strip $DST/openssl > zip -r $DST.zip $DST > rm -rf $DST > # sha256sum $DST.zip > # mv $DST.zip ../dist/ --------------------------------------------------------------------------------------------- How can I cross compile the Stunnel-5.48 using this BoringSSL? Are my BoringSSL's .so files incompatible? Any suggestions. Regards, Jaymin

1 0

"Reverse" tunneling with stunnel.
by C. Petro 20 Jul '18

20 Jul '18

I have a client who is setting up a logging infrastructure involving a couple of DMZs forwarding logs into central logging points. They have to pass compliance audits (SOX, PCI at least) and have some rather specific desires in regards to how they want the log traffic to move, and which servers *initiate* the connections. Which is to say they want the internal servers to set up tunnels to the DMZ servers and then the forwarders use that tunnel to deliver logs back. Lemme see if I can ascii art this: central1----------------------------------dmz1 \____________________ / _____________________\ _/ / \ central2----------------------------------dmz2 Something like that. Central1=10.10.1.2 Central2=10.9.1.2 DMZ1=172.18.0.5 DMZ2=172.20.0.5 Firewalls are in effect. I have gotten it set up so that I can initiate a connection FROM Central1 to DMZ2. [Tunnel_to_DMZ2] client = yes accept = 3002 connect = 172.20.0.5:5000 And [Tunnel_from_Central1] accept = 5000 connect = 3000 Like I said, I can open a tunnel from Central1 to DMZ2, but can't get traffic to pass backwards--I get a message in the log saying the session is closed. Is it possible to set stunnel up in a "reverse tunnel" mode--one where the connect is initiated from one end, but the other does most of the message passing? What I am missing? Thanks, Petro.

2 2

TLS alert (read): fatal: bad record mac (windows)
by Per Gunnarsson 19 Jul '18

19 Jul '18

I found it after looking once more in the log file. PSK client configured for identity "ï»¿user2" (the identity in the secrets.txt is user2:secretkey, somehow those three weird characters are added on windows) I got around it by copying the secrets.txt file to the server so that the secrets.txt on the server also begins with "ï»¿user2" but I suspect it's a bug. Regards, Per Gunnarsson

1 0

Is there a way to specify certificate content in stunnel config
by Hari 19 Jul '18

19 Jul '18

Hi, I have a requirement where in i cannot specify the certificate and/or private key details as "files" to stunnel configuration, owing to the location and/or file system availability for stunnel to access them. Is there a way to specify the actual certificate content in stunnel configuration (similar to other parameters like port numbers etc.,) so that the same can be leveraged. ThanksHari | | Virus-free. www.avg.com |

1 0