- stunnel-users - stunnel.org

No Taskbar Icon
by Carter Browne 26 Sep '14

26 Sep '14

I have updated stunnel to version 5.04 on Windows 7 32 & 64 bit, Windows Server 2008R2, Windows Server 2012 and Windows Server 2012R2 and in no case does the icon appear. I explicitly set taskbar = yes in the configuration file. -- Carter Browne cbrowne(a)cbcs-usa.com

5 13

"Socket operation on non-socket" when trying to pass the configuration file as a file descriptor on OSX
by Guylhem 24 Sep '14

24 Sep '14

Hello I'm trying to pass the configuration file with option fd. However, I get the following errors when I do : echo my configuration | stunnel -fd 0 This is not related to echo since I get the same errors with: cat conf | stunnel -fd 0 stunnel is just filling my logs with : 2014-07-13 6:48:46.675 PM stunnel[1959]: LOG3[140735238959888]: local socket: Socket operation on non-socket (38) 2014-07-13 6:48:46.676 PM stunnel[1959]: LOG3[140735238959888]: local socket: Socket operation on non-socket (38) (...) stunnel ./conf works fine I found a reference to a bug that caused this same error message on OSX when run in inetd mode, but nothing else. Any help is appreciated I'm using stunnel 5.02 on x86_64-apple-darwin13.2.0 platform with the following in -sockets: Socket option defaults: Option Name | Accept | Local | Remote |OS default ----------------+----------+----------+----------+---------- SO_DEBUG | -- | -- | -- | no SO_DONTROUTE | -- | -- | -- | no SO_KEEPALIVE | -- | -- | -- | no SO_LINGER | -- | -- | -- | 0:0 SO_OOBINLINE | -- | -- | -- | no SO_RCVBUF | -- | -- | -- | 131072 SO_SNDBUF | -- | -- | -- | 131072 SO_RCVLOWAT | -- | -- | -- | 1 SO_SNDLOWAT | -- | -- | -- | 2048 SO_RCVTIMEO | -- | -- | -- | 0:0 SO_SNDTIMEO | -- | -- | -- | 0:0 SO_REUSEADDR | yes| -- | -- | no TCP_KEEPCNT | -- | -- | -- |write-only TCP_KEEPINTVL | -- | -- | -- |write-only IP_TOS | -- | -- | -- | 0 IP_TTL | -- | -- | -- | 64 TCP_NODELAY | -- | yes| yes| no My configuration is quite simple : I just echo CAfile=/path/to/file.pem verify = 3 fips = no options = NO_SSLv2 debug = 7 [test] client = yes accept = 127.0.0.1:4443 connect = remoteip:443

2 1

Stunnel as windows service doesn't start on restart.
by John Smith 24 Sep '14

24 Sep '14

Running stunnel 5.03 on Windows 2008 R2. Everything is installed and working fine. I can even start/stop the service no problem... (Pretty sure the service is set to start Automatically) When I reboot my server stunnel service shows as started but nothing gets logged and none of my connections work. Once I restart the service through service manager, everything works. So on startup it doesn't seem to run... This only happens if i reboot the machine. I also asked the same question here: http://serverfault.com/questions/627932/stunnel-as-windows-service-doesnt-s… Output of my logs proving it works. 2014.09.11 15:57:48 LOG5[1612]: stunnel 5.03 on x86-pc-msvc-1500 platform 2014.09.11 15:57:48 LOG5[1612]: Compiled/running with OpenSSL 1.0.1i-fips 6 Aug 2014 2014.09.11 15:57:48 LOG5[1612]: Threading:WIN32 Sockets:SELECT,IPv6 SSL:ENGINE,OCSP,FIPS 2014.09.11 15:57:48 LOG5[1612]: Reading configuration from file stunnel.conf 2014.09.11 15:57:48 LOG5[1612]: FIPS mode disabled 2014.09.11 15:57:49 LOG5[1612]: Configuration successful

8 27

Possible problem found in init script with 'dirty' config file
by F. J. Blanco 23 Sep '14

23 Sep '14

Hi there. Perhaps this is a foolishness, but it happens to me, triggering a great headache. I'm Debian (Wheezy) user, using stunnel 4.53-1.1. I copied the stunnel configuration from another machine for a simple LAN SMTP relay. When I tried to reload the script, I got this: # /etc/init.d/stunnel4 start > Reloading configuration SSL tunnels: /etc/init.d/stunnel4: 34: test: /var/lib/stunnel4/: unexpected operator A few hours laters, I discovered the problem was in config file, in the chroot parameter: chroot = /var/lib/stunnel4 Specifically, with a hide space at the end of the line: chroot = /var/lib/stunnel4[ ] In the init script, in the function get_pids(), this mistake caused that this checkout fails: --- if test -f $CHROOT/$PIDFILE; then cat $CHROOT/$PIDFILE fi --- 'cat /var/lib/stunnel4///stunnel.pid' is not the same as 'cat /var/lib/stunnel4/[ ]//stunnel.pid' Perhaps a suggestion, a little change here: CHROOT=`grep "^chroot" $file|sed "s;.*= *;;"` Adding a space filter: CHROOT=`grep "^chroot" $file|sed "s;.*= *;;" | tr -d " "` Regards.

4 10

Re: [stunnel-users] Stunnel as windows service doesn't start on restart.
by josealf＠rocketmail.com 22 Sep '14

22 Sep '14

John. Looks fine to me. Same configuration works in my Windows 7 64 bits. I have no access to Windows Server 2008 R2, but I would expect it to work the same. What are you securing with stunnel?... Perhaps the service you are securing is starting after stunnel? -----Original Message----- From: John Smith <java.dev.mtl(a)gmail.com> Date: Mon, 22 Sep 2014 11:09:21 To: Jose Diaz<josealf(a)rocketmail.com> Subject: Re: [stunnel-users] Stunnel as windows service doesn't start on restart. SERVICE_NAME: stunnel TYPE : 110 WIN32_OWN_PROCESS (interactive) START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : "C:\Program Files (x86)\stunnel\stunnel.exe" -service -install LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Stunnel SSL wrapper DEPENDENCIES : TCPIP SERVICE_START_NAME : LocalSystem On 22 September 2014 11:02, John Smith <java.dev.mtl(a)gmail.com> wrote: > After reboot? > > On 22 September 2014 10:11, <josealf(a)rocketmail.com> wrote: > >> >> Interesting. Please execute >> >> sc qc stunnel >> >> And post the output. >> >> >> >> -----Original Message----- >> From: John Smith <java.dev.mtl(a)gmail.com> >> Sender: "stunnel-users" <stunnel-users-bounces(a)stunnel.org> >> Date: Mon, 22 Sep 2014 09:54:10 >> To: Michal Trojnara<Michal.Trojnara(a)mirt.net> >> Cc: <stunnel-users(a)stunnel.org> >> Subject: Re: [stunnel-users] Stunnel as windows service doesn't start on >> restart. >> >> _______________________________________________ >> stunnel-users mailing list >> stunnel-users(a)stunnel.org >> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >> >> >> >> >

2 3

stunnel beta (5.04b1) is available for testing
by Michal Trojnara 22 Sep '14

22 Sep '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Guys, Please feel free to try the beta version I just made available for download: https://www.stunnel.org/downloads/beta/stunnel-5.04b1.tar.gz https://www.stunnel.org/downloads/beta/stunnel-5.04b1-installer.exe The list of changes includes most of the issues recently discussed on the stunnel-users mailing list and more. * New features - Support for local mode ("exec" option) on Win32. - A more explicit service description provided for the Windows SCM (thx to Pierre Delaage). - TCP/IP dependency added for NT service in order to (hopefully) prevent initialization failure at boot time. - FIPS canister updated to version 2.0.8 in the Win32 binary build. * Bugfixes - load_icon_default() modified to return copies of default icons instead of the original resources to prevent the resources from being destroyed. - Reportedly more compatible values used for the dwDesiredAccess parameter of the CreateFile() function (thx to Pierre Delaage). - Partially merged UNICODE compilation fixes (thx to Pierre Delaage). - Partially merged Windows CE patches (thx to Pierre Delaage). - Fixed typos in stunnel.init.in and vc.mak. - Fixed incorrect memory allocation statistics update in str_realloc(). - Missing REMOTE_PORT environmental variable is provided to processes spawned with "exec" on Unix platforms. - Taskbar icon is no longer disabled for NT service. Some basic examples for local mode ("exec" option) on Windows: ; Service based on a command-line tool [netstat] accept = 8015 exec = c:\windows\system32\netstat.exe execargs = netstat -a ; Remote cmd.exe protected with SSL ; Certificate-based authentication needs to be configured here! [cmd] accept = 1337 exec = c:\windows\system32\cmd.exe Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlQYYkoACgkQ/NU+nXTHMtGmfwCfSdHFmK8q5IRcS/CoFmYMZ40G zUEAoNUrIp0KAJ4+0LPwx+/1lJG6q2q/ =aSXM -----END PGP SIGNATURE-----

3 11

Support for PSK
by Thomas Conté 21 Sep '14

21 Sep '14

Hello everyone, In the context of an embedded project, I have developed a lightweight, PolarSSL-based TLS-PSK client running on an Arduino board. Now I am looking for a generic server-side solution to connect the TLK-PSK client to a few Web services living in various app servers (Node.JS, IIS, and others). Since PSK support is not widespread, I am thinking about using stunnel as a generic front-end to these services. I have done a quick-and-dirty POC of adding PSK support to stunnel and it looks like this could be done with minor modifications, e.g. adding a call to SSL_CTX_set_psk_server_callback and the corresponding callback to ctx.c. Right now the psk_key and psk_identity values are hard-coded, so of course those need to be added to the configuration file. Is the community interested in further work in that area? Or is PSK support already in the stunnel roadmap? Cheers, -- Thomas Conté.

2 1

stunnel 5.04 released
by Michal Trojnara 21 Sep '14

21 Sep '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.04 of stunnel. The ChangeLog entry: Version 5.04, 2014.09.21, urgency: LOW: * New features - Support for local mode ("exec" option) on Win32. - Support for UTF-8 config file and log file. - Win32 UTF-16 build (thx to Pierre Delaage for support). - Support for Unicode file names on Win32. - A more explicit service description provided for the Windows SCM (thx to Pierre Delaage). - TCP/IP dependency added for NT service in order to prevent initialization failure at boot time. - FIPS canister updated to version 2.0.8 in the Win32 binary build. * Bugfixes - load_icon_default() modified to return copies of default icons instead of the original resources to prevent the resources from being destroyed. - Partially merged Windows CE patches (thx to Pierre Delaage). - Fixed typos in stunnel.init.in and vc.mak. - Fixed incorrect memory allocation statistics update in str_realloc(). - Missing REMOTE_PORT environmental variable is provided to processes spawned with "exec" on Unix platforms. - Taskbar icon is no longer disabled for NT service. - Fixed taskbar icon initialization when commandline options are specified. - Reportedly more compatible values used for the dwDesiredAccess parameter of the CreateFile() function (thx to Pierre Delaage). - A number of minor Win32 GUI bugfixes and improvements. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: ee9702e073cb8d5940a1310ae171a38d3264f1ce3b087160728bbbcf5710cec1 stunnel-5.04.tar.gz 045145b4e6ef66d29774b558837bd693a0dbab9f7295586da9e5f0de4c5a7481 stunnel-5.04-installer.exe d1bc5c00278f31c64ad4a601d9e398b21284777f9079e91b8cbaef1e8e91f538 stunnel-5.04-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlQfAqsACgkQ/NU+nXTHMtH1cACeLEi7tFSEoxYJCfZROeaTLD4J +8sAoKK+l/6Bjl2sLwPRTcmw/Vj4+PYy =F0H9 -----END PGP SIGNATURE-----

1 0

GnuTLS port
by Max 20 Sep '14

20 Sep '14

Pardon if that was asked before, but are there port of stunnel to GnuTLS available somewhere? With recent fallout from heartbleed I'm looking into getting rid of openssl (besides I've never liked the license anyway :) and stunnel is one of the very few programs which got dependency on it. cheers, Max.

2 1

stunnel beta (5.04b2) is available for testing
by Michal Trojnara 19 Sep '14

19 Sep '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Guys, Please feel free to try the second beta version: https://www.stunnel.org/downloads/beta/stunnel-5.04b2.tar.gz https://www.stunnel.org/downloads/beta/stunnel-5.04b2-installer.exe I have finished implementing Win32 UNICODE support. The following planned features depend on UNICODE support: - Non-ASCII path names (this is already partially implemented) - UTF8 stunnel.conf - Windows CE GUI stunnel 5.04b2 also fixes missing taskbar icon when stunnel is executed with commandline switches (for example "stunnel -help"). Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlQcnAcACgkQ/NU+nXTHMtHOnQCeJFPogmAyhDFQ+CoLT17nhd1I CSIAni1tOnInyScnXwB/d876RF0o9YYt =PJ+o -----END PGP SIGNATURE-----

1 0