- stunnel-users - stunnel.org

X-Forwarded-For stunnel 4.54 patch
by Michael Wittig 16 Oct '12

16 Oct '12

Hi, I created the X-Forwarded-For stunnel 4.54 patch: https://gist.github.com/3899818 Could someone else check it? -- Michael

1 0

Client Authentication and CRL Verification
by Jean-Philippe Constant 16 Oct '12

16 Oct '12

Hi, I am using stunnel in server mode with mutual authentication. The PKI used to authenticate my client is the following : root CA -> Intermediate CA -> Client. My stunnel configuration is : CAfile = RootCA.pem CRLfile = IntermediateCACRL.pem verify = 2 RootCA.pem contains the Root CA certificate IntermediateCACRL.pem contains the CRL file of the Intermediate CA The client authentication with client certificate goes well. The problem occurs when a client certificate is revoked. After the Intermediate CA CRL updates, the client certificate is still accepted whereas it should be refused. With the following configuration the revoked certificate is refused : CAfile = IntermediateCA.pem CRLfile = IntermediateCACRL.pem verify = 2 but I would prefer using the first configuration. Everything happens like if stunnel checks the crl only for the CA certificate and not for the whole certification chain. Thank you for your answers, Jean-Philippe Constant

1 0

SSL proxy in Windows - IP Address Issue
by Brian McGinity 16 Oct '12

16 Oct '12

Thank you so much for stunnel. This program is amazing!!!! In Windows, I'd like to move SSL processing out of Apache and into stunnel. Is there a way for Apache to know the client's ip address? - In Windows, "transparent" mode is unavailable - "xforwardedfor" is for smtp and not https connections - "protocol = proxy" is for Haproxy only? Brian

2 3

Asterisk with stunnel
by manjula hettiarachchi 15 Oct '12

15 Oct '12

Hi List I am new to stunnel, Just tried today to send Asterisk SIP request to stunnel client and forward to stunnel-server --> asterisk on another machine. (server ip=x.x.x.x) (client ip=y.y.y.y) Client config: cert=/etc/stunnel/stunnel.pem client=yes pid=/tmp/stunnel.pid debug=7 output=/etc/stunnel/stunnel.log [sip] accept=16380 connect=x.x.x.x:17380 ================================ Server Config: cert=/etc/stunnel/stunnel.pem #client=no pid=/tmp/stunnel.pid debug=7 output=/etc/stunnel/stunel.log [sip-IN] accept=17380 connect=5060 When tried 'telnet localhost 16380 from client machine i could see packets coming to server. However when Asterisk sends a sip request to port 16380, exten => _X.,1,Dial(SIP/${EXTEN}@y.y.y.y:16380,20,rt) i dont see packets forwaded to the server. Pls advise if anyone has used this scenario Best Regards Manjula

2 1

Re: [stunnel-users] stunnel-users Digest, Vol 99, Issue 2
by Scott McKeown 10 Oct '12

10 Oct '12

Hi Michal, Thats great news and thank you for update. I think the 'renegotiation' option will be a great addition. -- With Kind Regards. Scott McKeown Loadbalancer.org http://www.loadbalancer.org

1 0

stunnel 4.54 released
by Michal Trojnara 10 Oct '12

10 Oct '12

Dear Users, I have released version 4.54 of stunnel. The ChangeLog entry: Version 4.54, 2012.10.09, urgency: MEDIUM: * New Win32 features - FIPS module updated to version 2.0. - OpenSSL DLLs updated to version 1.0.1c. - zlib DLL updated to version 1.2.7. - Engine DLLs added: 4758cca, aep, atalla, capi, chil, cswift, gmp, gost, nuron, padlock, sureware, ubsec. * Other new features - "session" option renamed to more readable "sessionCacheTimeout". The old name remains accepted for backward compatibility. - New service-level "sessionCacheSize" option to control session cache size. - New service-level option "reset" to control whether TCP RST flag is used to indicate errors. The default value is "reset = yes". - New service-level option "renegotiation" to disable SSL renegotiation. This feature is based on a public-domain patch by Janusz Dziemidowicz. - New FreeBSD socket options: IP_FREEBIND, IP_BINDANY, IPV6_BINDANY (thx to Janusz Dziemidowicz). - New parameters to configure TLS v1.1/v1.2 with OpenSSL version 1.0.1 or higher (thx to Henrik Riomar). * Bugfixes - Fixed "Application Failed to Initialize Properly (0xc0150002)" error. - Fixed missing SSL state debug log entries. - Fixed a race condition in libwrap code resulting in random stalls (thx to Andrew Skalski). - Session cache purged at configuration file reload to reduce memory leak. Remaining leak of a few kilobytes per section is yet to be fixed. - Fixed regression bug in "transparent = destination" functionality (thx to Stefan Lauterbach). This bug was introduced in stunnel 4.51. - "transparent = destination" is now a valid endpoint in inetd mode. - "delay = yes" fixed to work even if specified *after* "connect" option. - Multiple "connect" targets fixed to also work with delayed resolver. - The number of resolver retries of EAI_AGAIN error has been limited to 3 in order to prevent infinite loops.. Home page: https://www.stunnel.org/ <http://stunnel.mirt.net/> Download: https://www.stunnel.org/downloads.html <ftp://stunnel.mirt.net/stunnel/> SHA-256 hash for stunnel-4.54.tar.gz: b7e1b9e63569574dbdabee8af90b8ab88db3fe13dcb1268d59a1408c56e6de7b Best regards, Mike

1 0

How to forward client's IP address with stunnel on Windows
by Emmanuel Egensperger 08 Oct '12

08 Oct '12

Dear stunnel's users, I have search on google and try many things on stunnel's configuration to forward ip address, but nothing works ? I have found this option in the FAQ : transparent = source But it seems that it doesn't work on windows ? >Line 22: "transparent = source": Specified option name is not valid here >Server is down Is there any solution to my problem ? Have I done something wrong ? Best regards, Manu Egen

2 1

Timeouts and inetd mode
by Bruce Guenter 28 Sep '12

28 Sep '12

Hi. As far as I can tell, if stunnel is running in "inetd mode", at least TIMEOUTbusy does not work. In particularl, stunnel will never timeout waiting for the SSL handshake to complete. If I'm reading the sources right, this is because the code to set up the SSL session calls SSL_accept before checking for data on stdin, and stdin is never set to non-blocking mode (only newly created sockets and/or pipes are). Would it make sense to set stdin (and stdout) to non-blocking mode when timeouts are enabled? Something in init_local maybe? -- Bruce Guenter <bruce(a)untroubled.org> http://untroubled.org/

1 0

SNI with wildcard certificates
by Gustavo Machado 27 Sep '12

27 Sep '12

Hi, I would like to use SNI in combination with wildcard certificates. I currently have the following configuration: [https] accept = 443 connect = 80 TIMEOUTclose = 0 cert = C:\default.pem key = C:\default.key ;SNI Config ;========== [https_a] sni = https:one.org connect = 80 cert = C:\a.pem key = C:\a.key [https_a_wc] sni = https:*.one.org connect = 80 cert = C:\b.pem key = C:\b.key If I go to https://one.org then I can see a.pem in the browser. If I go to https://mysubdomain.one.org I see default.pem. What am I missing?? Thanks! Gustavo

2 1

Chain pem files
by Gustavo Machado 27 Sep '12

27 Sep '12

Hi guys, Sorry for the newbie question, but I have the following configuration for an HTTPS endpoint: [https_one] sni = https:one.org connect = 44300 cert = D:\node\https\default.crt key = D:\node\https\default.key It works wonders, however I need to provide to this configuration two more .pem files for "chain". How would go about doing that? Thanks, Gustavo

1 1