- stunnel-users - stunnel.org

stunnel 5.50 on Solaris 10
by Udo Erdelhoff 12 Dec '18

12 Dec '18

Hi, quick heads-up to anybody building/using stunnel 5.50 on Solaris 10 and wondering where the "Invalid configuration file name" errors are coming from: The problem is the call to realpath in line 334 of options.c, it uses NULL as second argument as a request to have the realpath function allocate the memory buffer for the sanitized string. This variant of realpath is not supported on Solaris 10, and leads to EINVAL (error code 22). Quickest fix is to run configure and then manually change src/config.h to have /* #undef HAVE_REALPATH */ instead of #define HAVE_REALPATH 1 -- "Treason is a charge invented by winners as an excuse for hanging the losers." - Benjamin Franklin, ca. 1776

1 0

Support for multiple root CAs
by Tom Bentley 07 Dec '18

07 Dec '18

Hi, I'm using stunnel to secure communication between nodes in a cluster, using a self-signed CA to sign the server certs and the `verify = 2` config parameter. This works great. What I want to be able to do is replace the CA key and certificate without breaking the cluster. How I thought this should work would be: 1. Configure the stunnels to trust both the old and new CA certificates while the nodes continued to use server certificates signed by the old CA key. 2. Switch to using using server certifcates signed by the new CA key. 3. Finally remove trust in the old CA certificate. I'd tried this by putting both CA certificates in a single file and using `CAfile` config parameter, and also by using the `CApath` config parameter with both root CA certificates in the configured directory, but I've not been able to get this to work while keeping `verify = 2`. It does work if I temporary use `verify = 0`, but obviously that means I've not got TLS authentication duration the duration of the process. Can anyone confirm whether stunnel supports this use case, and if so suggest where I might be going wrong? Many thanks, Tom

1 0

Re: [stunnel-users] older browsers, stunnel and privoxy (kovacs janos) - stunnel-users Digest, Vol 173, Issue 7
by Thomas GMX 07 Dec '18

07 Dec '18

Hi Janos, mail (SMTP / POP / IMAP) are other protocols as HTTPS. I was not able to connect via sTunnel to a server via HTTPS - and this was the reason to create and use my HTTPSProxy. HTTPSProxy is based on this code (local front- and rear proxy are connected directly without Proxomitron): https://prxbx.com/forums/showthread.php?tid=2172 https://prxbx.com/forums/showthread.php?tid=2191&pid=19252#pid19252 You can build your own release with python if you do not trust the versions offered by me or HeinoGanda on MSFN. Regards Thomas S. -----Original Message----- From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of stunnel-users-request(a)stunnel.org Sent: Friday, December 07, 2018 12:00 PM To: stunnel-users(a)stunnel.org Subject: stunnel-users Digest, Vol 173, Issue 7 Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. Re: older browsers, stunnel and privoxy (kovacs janos) ---------------------------------------------------------------------- Message: 1 Date: Fri, 7 Dec 2018 01:30:21 +0100 From: kovacs janos <kovacsjanosfasz(a)gmail.com> To: Flo Rance <trourance(a)gmail.com> Cc: zizazit(a)protonmail.com, stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] older browsers, stunnel and privoxy Message-ID: <CAOchpkp+5YDig_XpWPFVdP9zQ-L2UN10p8Wzsm9ggv2iuWpU8Q(a)mail.gmail.com> Content-Type: text/plain; charset="UTF-8" now im really not sure, since the wikipedia page on stunnel also describes the program doing exactly what i need in the Example scenario section: https://en.wikipedia.org/wiki/Stunnel#Example_scenario "Network traffic from the client initially passes over SSL to the stunnel application, which transparently encrypts/decrypts traffic and forwards unsecured traffic to port 25 locally. The mail server sees a non-SSL mail client. " only difference is, i need it to forward "unsecured traffic" to my browser client, not a server. are you all sure its really not possible? On 12/5/18, kovacs janos <kovacsjanosfasz(a)gmail.com> wrote: > thank you for suggestions, but can someone tell me in what cases > stunnel can be used? > i can connect to http websites through it, but https doesnt work, even > if it would otherwise do. > i try to connect to 'https://via.hypothes.is/' like this, which i can > access in browser without any proxy: > [Tunnel_in] > client = yes > accept = 127.0.0.1:443 > connect = via.hypothes.is:443 > > i get these logs: > LOG5[1]: Service [Tunnel_in] accepted connection from 127.0.0.1:1788 > LOG5[1]: s_connect: connected 104.20.214.15:443 > LOG5[1]: Service [Tunnel_in] connected remote server from 192.168.0.3:1789 > LOG5[1]: Connection closed: 197 byte(s) sent to TLS, 332 byte(s) sent to > socket > > and the browser just shows a 'server not found' error. > with http sites its the same logs except the IP and bytes, and it > loads in the browser. > > On 12/5/18, Flo Rance <trourance(a)gmail.com> wrote: >> I would recommend to use squid which is able to do SSL bump. >> >> https://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit >> >> Therefore, you'll be able to connect with TLS1.0 to squid and the proxy >> will establish a TLSv1.2 to the final destination. >> >> Regards, >> Flo >> >> On Tue, Dec 4, 2018 at 9:38 PM kovacs janos <kovacsjanosfasz(a)gmail.com> >> wrote: >> >>> well, what i meant is forwarding to the current address the browser >>> connects to, so basically browsing through stunnel. >>> >>> is it really that complicated to achieve that? if i configure stunnel >>> as a client, and make the browser send traffic to the accept address, >>> shouldnt stunnel encrypt the traffic with TLS and send forward to the >>> connect address? if thats true, shouldnt it also decrypt returning >>> traffic and send back to the browser? >>> when i configured stunnel as both client and server on the same >>> computer, it worked, but the browser still gave >>> 'ssl_error_no_cypher_overlap' errors. probably because the server side >>> decrypted it again before it reached the website's server? >>> >>> i dont necessarily need it to strip encryption, just use anything >>> below TLS 1.1. for example on 'https://via.hypothes.is/' i can visit >>> sites that would otherwise give cypher error, and they stay as https >>> >>> On 12/4/18, Zizhong Zhang <zizazit(a)protonmail.com> wrote: >>> > Hello, >>> > >>> >> im trying to make older browsers be able to display TLS 1.1 and TLS >>> >> 1.2 >>> >> sites. >>> >> i heard stunnel cant be configured to always forward to the current >>> >> site address dynamically, thats why i would use privoxy. >>> > >>> > If by "forward to the current site address dynamically" you meant >>> "forward >>> > to the current address of one specific domain" then stunnel can >>> > achieve >>> that >>> > by adding "delay = yes". >>> > >>> > However, if I understood correctly, you wanted to let stunnel strip >>> > or remove SSL for whatever sites you visit. Then no, I don't think you >>> can >>> > achieve that with privoxy and stunnel. If that's what you want, I >>> > would >>> > suggest you use nginx to remove SSL. The following example >>> > configuration >>> > will let nginx "upgrade" your HTTP request to HTTPS. >>> > >>> > events {} http { server { >>> > resolver 9.9.9.9; >>> > listen 80; >>> > location / { >>> > proxy_pass https://$host$request_uri; >>> > proxy_set_header Host $http_host; >>> > } >>> > }} >>> > >>> > You can then point any domain to the nginx server (for example, via >>> > the >>> > hosts file) and visit the site via HTTP. This will make HTTPS-oly >>> > servers >>> > happy. >>> > >>> > That won't strip third-party HTTPS:// URL resources like NewIPNow >>> > does, >>> but >>> > you can use the nginx "sub_filter" to replace HTTPS with HTTP in HTML. >>> Also >>> > there are "security features" like "Content-Security-Policy" that >>> > prevent >>> > modern browsers from visiting your SSL-stripped sites, but I believe >>> > your >>> > out-dated browser will happily ignore those. >>> > >>> > --Zizhong >>> > >>> _______________________________________________ >>> stunnel-users mailing list >>> stunnel-users(a)stunnel.org >>> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >>> >> > ------------------------------ Subject: Digest Footer _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users ------------------------------ End of stunnel-users Digest, Vol 173, Issue 7 *********************************************

1 0

Re: [stunnel-users] older browsers with modern HTTPS - stunnel-users Digest, Vol 173, Issue 4
by Thomas GMX 05 Dec '18

05 Dec '18

Hi Janos, you can use a local proxy to "translate" HTTPS TLS1.0 to TLS1.2 Look here: https://msfn.org/board/topic/176344-problems-accessing-certain-sites-https-… HTTPSProxy (and tools) manage the whole traffic locally (in- and outgoing HTTPS), but needs manually configuration as described in the help files. If you have questions please ask in this forum. Regards Thomas S. -----Original Message----- From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of stunnel-users-request(a)stunnel.org Sent: Wednesday, December 05, 2018 10:12 AM To: stunnel-users(a)stunnel.org Subject: stunnel-users Digest, Vol 173, Issue 4 Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. Re: older browsers, stunnel and privoxy (kovacs janos) 2. Re: older browsers, stunnel and privoxy (Zizhong Zhang) 3. Re: older browsers, stunnel and privoxy (kovacs janos) 4. Re: older browsers, stunnel and privoxy (Flo Rance) ---------------------------------------------------------------------- Message: 1 Date: Tue, 4 Dec 2018 19:27:15 +0100 From: kovacs janos <kovacsjanosfasz(a)gmail.com> To: Flo Rance <trourance(a)gmail.com> Cc: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] older browsers, stunnel and privoxy Message-ID: <CAOchpkrOTmoAgCpv4fK19NhZeP-5-JgjX3EASFcfQbMVydR2yA(a)mail.gmail.com> Content-Type: text/plain; charset="UTF-8" well yes, im pretty sure the same encryption is needed in requests and the returned page, otherwise it would probably get a no cypher overlap error. so i basically need stunnel to encrypt outgoing requests, and decrypt the returned things and only on the browser side of connection. there's a good reason why they are deprecated, but it would be better to add this functionality this way if possible, rather than change whole programs, especially when its the purpose of stunnel, according to the description On 12/4/18, Flo Rance <trourance(a)gmail.com> wrote: > This is not what I've understood from your first description. You would > like to bridge TLSv1 to TLSv1.1 or TLSv1.2 before sending requests to a web > proxy. > > This is why I don't think stunnel is intended for that. > > That said, if SSLV3 and TLSv1 have been deprecated, there's a good reason > and you should seriously think to update your tools. > > Regards, > Flo > > On Tue, Dec 4, 2018 at 3:18 PM kovacs janos <kovacsjanosfasz(a)gmail.com> > wrote: > >> well, it says this on the first line of the website: >> "Stunnel is a proxy designed to add TLS encryption functionality to >> existing clients and servers without any changes in the programs' >> code." >> >> i just want to add TLS functionality to client browsers which dont >> have it. i only need stunnel to decrypt TLS traffic going back to the >> browser. >> >> On 12/4/18, Flo Rance <trourance(a)gmail.com> wrote: >> > Sorry I didn't read it correctly. I don't think this is something >> > stunnel >> > can handle. >> > >> > Regards, >> > Flo >> > >> > On Mon, Dec 3, 2018 at 9:31 PM kovacs janos <kovacsjanosfasz(a)gmail.com> >> > wrote: >> > >> >> thank you for the reply, >> >> its the address and port where privoxy listens for requests. >> >> from the config file: >> >> "# 4.1. listen-address >> >> # ==================== >> >> # >> >> # Specifies: >> >> # >> >> # The IP address and TCP port on which Privoxy will listen for >> >> # client requests." >> >> and under it: >> >> >> >> listen-address 127.0.0.1:8118 >> >> >> >> On 12/3/18, Flo Rance <trourance(a)gmail.com> wrote: >> >> > Hi, >> >> > >> >> > It's not clear in your description what is running on 8118 local >> >> > port. >> >> > >> >> > Regards, >> >> > Flo >> >> > >> >> > On Mon, Dec 3, 2018 at 2:40 PM kovacs janos < >> kovacsjanosfasz(a)gmail.com> >> >> > wrote: >> >> > >> >> >> sorry to bother, >> >> >> im trying to make older browsers be able to display TLS 1.1 and TLS >> >> >> 1.2 >> >> >> sites. >> >> >> i heard stunnel cant be configured to always forward to the current >> >> >> site address dynamically, thats why i would use privoxy. >> >> >> the browser is configured to send to: >> >> >> 127.0.0.1 443 >> >> >> >> >> >> stunnel config has this at the end: >> >> >> [Tunnel_in] >> >> >> client = yes >> >> >> accept = 127.0.0.1:443 >> >> >> connect = 127.0.0.1:8118 >> >> >> verifyChain = yes >> >> >> CAfile = ca-certs.pem >> >> >> checkHost = localhost >> >> >> >> >> >> 127.0.0.1:8118 is the privoxy address. >> >> >> this is what stunnel writes: >> >> >> LOG5[main]: Configuration successful >> >> >> LOG5[0]: Service [Tunnel_in] accepted connection from >> >> >> 127.0.0.1:3261 >> >> >> LOG5[0]: s_connect: connected 127.0.0.1:8118 >> >> >> LOG5[0]: Service [Tunnel_in] connected remote server from >> >> 127.0.0.1:3262 >> >> >> >> >> >> and the browser infinitely loads, and never loads anything or >> >> >> leaves >> >> >> the >> >> >> page. >> >> >> if i remove the last 3 lines, its the same just with this line >> >> >> added: >> >> >> LOG4[main]: Service [Tunnel_in] needs authentication to prevent >> >> >> MITM >> >> >> attacks >> >> >> >> >> >> but it doesnt give an error or anything. >> >> >> >> >> >> with a configuration like: >> >> >> [Tunnel_out] >> >> >> client = no >> >> >> accept = 127.0.0.1:443 >> >> >> connect = 127.0.0.1:8118 >> >> >> cert = stunnel.pem >> >> >> >> >> >> this is what it gives: >> >> >> LOG5[3]: Service [Tunnel_out] accepted connection from >> 127.0.0.1:3294 >> >> >> LOG3[3]: SSL_accept: 1407609B: error:1407609B:SSL >> >> >> routines:SSL23_GET_CLIENT_HELLO:https proxy request >> >> >> LOG5[3]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to >> >> >> socket >> >> >> >> >> >> and browser gives a server not found error immediately. im not even >> >> >> sure if i should use client or server configuration in a case like >> >> >> this, but none of them works anyway. all i would need is for my >> >> >> browser to get the pages decrypted, or at least in less than >> >> >> TLS1.1. >> >> >> like how on newipnow.com i can access sites with any encryption, >> since >> >> >> they are sent to the browser without encryption. the browser just >> >> >> gives an "unencrypted tunnel" warning, which is how i found >> >> >> stunnel, >> >> >> and which is exactly what i need, just locally. >> >> >> _______________________________________________ >> >> >> stunnel-users mailing list >> >> >> stunnel-users(a)stunnel.org >> >> >> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >> >> >> >> >> > >> >> >> > >> > ------------------------------ Message: 2 Date: Tue, 04 Dec 2018 19:16:53 +0000 From: Zizhong Zhang <zizazit(a)protonmail.com> To: kovacs janos <kovacsjanosfasz(a)gmail.com> Cc: "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Subject: Re: [stunnel-users] older browsers, stunnel and privoxy Message-ID: <mSx8WOjppmpWbvW5ETuPUXO048xh4PcPTtZPpOpzkrecueeSUtjQQx13FhtLO24lkyNXRPe_lNpMV8ko6RMEvowOx7mg6rl_1hwj43QAxWw=(a)protonmail.com> Content-Type: text/plain; charset=UTF-8 Hello, > im trying to make older browsers be able to display TLS 1.1 and TLS 1.2 sites. > i heard stunnel cant be configured to always forward to the current > site address dynamically, thats why i would use privoxy. If by "forward to the current site address dynamically" you meant "forward to the current address of one specific domain" then stunnel can achieve that by adding "delay = yes". However, if I understood correctly, you wanted to let stunnel strip or remove SSL for whatever sites you visit. Then no, I don't think you can achieve that with privoxy and stunnel. If that's what you want, I would suggest you use nginx to remove SSL. The following example configuration will let nginx "upgrade" your HTTP request to HTTPS. events {} http { server { resolver 9.9.9.9; listen 80; location / { proxy_pass https://$host$request_uri; proxy_set_header Host $http_host; } }} You can then point any domain to the nginx server (for example, via the hosts file) and visit the site via HTTP. This will make HTTPS-oly servers happy. That won't strip third-party HTTPS:// URL resources like NewIPNow does, but you can use the nginx "sub_filter" to replace HTTPS with HTTP in HTML. Also there are "security features" like "Content-Security-Policy" that prevent modern browsers from visiting your SSL-stripped sites, but I believe your out-dated browser will happily ignore those. --Zizhong ------------------------------ Message: 3 Date: Tue, 4 Dec 2018 21:37:53 +0100 From: kovacs janos <kovacsjanosfasz(a)gmail.com> To: Zizhong Zhang <zizazit(a)protonmail.com> Cc: "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Subject: Re: [stunnel-users] older browsers, stunnel and privoxy Message-ID: <CAOchpkq7vG8vHBCrbVn6d4Eh7M2rd6jEob_huhoG=ZefJnpHLw(a)mail.gmail.com> Content-Type: text/plain; charset="UTF-8" well, what i meant is forwarding to the current address the browser connects to, so basically browsing through stunnel. is it really that complicated to achieve that? if i configure stunnel as a client, and make the browser send traffic to the accept address, shouldnt stunnel encrypt the traffic with TLS and send forward to the connect address? if thats true, shouldnt it also decrypt returning traffic and send back to the browser? when i configured stunnel as both client and server on the same computer, it worked, but the browser still gave 'ssl_error_no_cypher_overlap' errors. probably because the server side decrypted it again before it reached the website's server? i dont necessarily need it to strip encryption, just use anything below TLS 1.1. for example on 'https://via.hypothes.is/' i can visit sites that would otherwise give cypher error, and they stay as https On 12/4/18, Zizhong Zhang <zizazit(a)protonmail.com> wrote: > Hello, > >> im trying to make older browsers be able to display TLS 1.1 and TLS 1.2 >> sites. >> i heard stunnel cant be configured to always forward to the current >> site address dynamically, thats why i would use privoxy. > > If by "forward to the current site address dynamically" you meant "forward > to the current address of one specific domain" then stunnel can achieve that > by adding "delay = yes". > > However, if I understood correctly, you wanted to let stunnel strip > or remove SSL for whatever sites you visit. Then no, I don't think you can > achieve that with privoxy and stunnel. If that's what you want, I would > suggest you use nginx to remove SSL. The following example configuration > will let nginx "upgrade" your HTTP request to HTTPS. > > events {} http { server { > resolver 9.9.9.9; > listen 80; > location / { > proxy_pass https://$host$request_uri; > proxy_set_header Host $http_host; > } > }} > > You can then point any domain to the nginx server (for example, via the > hosts file) and visit the site via HTTP. This will make HTTPS-oly servers > happy. > > That won't strip third-party HTTPS:// URL resources like NewIPNow does, but > you can use the nginx "sub_filter" to replace HTTPS with HTTP in HTML. Also > there are "security features" like "Content-Security-Policy" that prevent > modern browsers from visiting your SSL-stripped sites, but I believe your > out-dated browser will happily ignore those. > > --Zizhong > ------------------------------ Message: 4 Date: Wed, 5 Dec 2018 10:12:06 +0100 From: Flo Rance <trourance(a)gmail.com> To: kovacsjanosfasz(a)gmail.com Cc: zizazit(a)protonmail.com, stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] older browsers, stunnel and privoxy Message-ID: <CAHogYcV+ig2-2u8CWYbbqH_AnkiZNzqM9etx=jHj3N+nug-FpQ(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" I would recommend to use squid which is able to do SSL bump. https://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit Therefore, you'll be able to connect with TLS1.0 to squid and the proxy will establish a TLSv1.2 to the final destination. Regards, Flo On Tue, Dec 4, 2018 at 9:38 PM kovacs janos <kovacsjanosfasz(a)gmail.com> wrote: > well, what i meant is forwarding to the current address the browser > connects to, so basically browsing through stunnel. > > is it really that complicated to achieve that? if i configure stunnel > as a client, and make the browser send traffic to the accept address, > shouldnt stunnel encrypt the traffic with TLS and send forward to the > connect address? if thats true, shouldnt it also decrypt returning > traffic and send back to the browser? > when i configured stunnel as both client and server on the same > computer, it worked, but the browser still gave > 'ssl_error_no_cypher_overlap' errors. probably because the server side > decrypted it again before it reached the website's server? > > i dont necessarily need it to strip encryption, just use anything > below TLS 1.1. for example on 'https://via.hypothes.is/' i can visit > sites that would otherwise give cypher error, and they stay as https > > On 12/4/18, Zizhong Zhang <zizazit(a)protonmail.com> wrote: > > Hello, > > > >> im trying to make older browsers be able to display TLS 1.1 and TLS 1.2 > >> sites. > >> i heard stunnel cant be configured to always forward to the current > >> site address dynamically, thats why i would use privoxy. > > > > If by "forward to the current site address dynamically" you meant > "forward > > to the current address of one specific domain" then stunnel can achieve > that > > by adding "delay = yes". > > > > However, if I understood correctly, you wanted to let stunnel strip > > or remove SSL for whatever sites you visit. Then no, I don't think you > can > > achieve that with privoxy and stunnel. If that's what you want, I would > > suggest you use nginx to remove SSL. The following example configuration > > will let nginx "upgrade" your HTTP request to HTTPS. > > > > events {} http { server { > > resolver 9.9.9.9; > > listen 80; > > location / { > > proxy_pass https://$host$request_uri; > > proxy_set_header Host $http_host; > > } > > }} > > > > You can then point any domain to the nginx server (for example, via the > > hosts file) and visit the site via HTTP. This will make HTTPS-oly servers > > happy. > > > > That won't strip third-party HTTPS:// URL resources like NewIPNow does, > but > > you can use the nginx "sub_filter" to replace HTTPS with HTTP in HTML. > Also > > there are "security features" like "Content-Security-Policy" that prevent > > modern browsers from visiting your SSL-stripped sites, but I believe your > > out-dated browser will happily ignore those. > > > > --Zizhong > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >

2 1

Web mail browsing over stunnel
by Osvald Brko 05 Dec '18

05 Dec '18

Hello, I would like to use stunnel for mail reading from www.hotmail.com . But there are plenty of redirections, to outlook.live.com, login.live.com, outlook.office365.com etc., moreover IP adresses of these servers are changing... Is there any configuration which allowed to use such web server over stunnel? Regards, Olda

1 0

stunnel 5.50 released
by Michal Trojnara 04 Dec '18

04 Dec '18

Dear Users, I have released version 5.50 of stunnel. Version 5.50, 2018.12.02, urgency: MEDIUM * New features - 32-bit Windows builds replaced with 64-bit builds. - OpenSSL DLLs updated to version 1.1.1. - Check whether "output" is not a relative file name. - Major code cleanup in the configuration file parser. - Added sslVersion, sslVersionMin and sslVersionMax for OpenSSL 1.1.0 and later. * Bugfixes - Fixed PSK session resumption with TLS 1.3. - Fixed a memory leak in WIN32 logging subsystem. - Allow for zero value (ignored) TLS options. - Partially refactored configuration file parsing and logging subsystems for clearer code and minor bugfixes. * Caveats - We removed FIPS support from our standard builds. FIPS will still be available with bespoke builds. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 951d92502908b852a297bd9308568f7c36598670b84286d3e05d4a3a550c0149 stunnel-5.50.tar.gz e855d58a05dca0943a5da8d030b5904630ee9cff47c3d747d326e151724f3bc8 stunnel-5.50-win64-installer.exe ad6c952cd26951c5a986efe8034b71af07c951e11d06e0b0ce73ef82594b1041 stunnel-5.50-android.zip Best regards, Mike

3 2

PSK mode does not work correctly with TLSv1.3
by Zizhong Zhang 21 Nov '18

21 Nov '18

Hello, In TLSv1.3, session resumption has been reworked to be the same way as PSK. The client attempts resumption by appending a ticket as PSK identity to the head of the list. With OpenSSL 1.1.1, the server side should use the new SSL_CTX_set_psk_find_session_callback() callback instead of SSL_CTX_set_psk_server_callback() which is used by stunnel now. Because stunnel only verifies against the first PSK identity, stunnel will fail for every other connections it makes. This impacts the default configuration when running with OpenSSL 1.1.1 because TLSv1.3 is enabled by default. It may be confusing because only half of the connections will fail as the client will try to resume the last successful session for every second connections. I purpose that stunnel should switch to SSL_CTX_set_psk_find_session_callback() for OpenSSL 1.1.1, and that it preferably should default to a maximum version of TLSv1.2 because it might be compiled with OpenSSL 1.0.x but runs with OpenSSL 1.1.1 which will enable TLSv1.3 automatically. With regards, --Zizhong

1 0

Installing stunnel as a Windows service with another service name?
by Al Birchall 16 Nov '18

16 Nov '18

Hi, Is it possible to install stunnel as a Windows service with another name? I want to have multiple instances of stunnel running on the same Windows 2008 server, if possible. Many thanks. Al

2 1

Server is down
by Paul Muller 12 Nov '18

12 Nov '18

I've installed Stunnel before with no issues. But now I'm getting the following: ] Running on Windows 6.1 [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark not detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [SMTP Outgoing] [ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK [ ] TLS options: 0x03000004 (+0x00000000, -0x00000000) [ ] No certificate or private key specified [:] Service [SMTP Outgoing] needs authentication to prevent MITM attacks [.] Configuration successful [ ] Binding service [SMTP Outgoing] [ ] Listening file descriptor created (FD=1388) [ ] Setting accept socket options (FD=1388) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [.] Binding service [SMTP Outgoing] to 0.0.0.0:25: Address already in use (WSAEADDRINUSE) (10048) [!] Binding service [SMTP Outgoing] failed [ ] Deallocating section defaults [ ] Unbinding service [SMTP Outgoing] [ ] Service [SMTP Outgoing] closed [ ] Deallocating section [SMTP Outgoing] [!] Server is down Please let me know what I'm doing wrong here. Thank you, [logo1] Paul A. Muller * Systems and Networking Consultant Earnest & Associates * Profitability Improvement Specialists Voice: 305.822.5353 x354 * Fax: 305.822.5848 Email: paul.muller(a)earnestassoc.com<mailto:paul.muller@earnestassoc.com> * Web: earnestassoc.com<http://www.earnestassoc.com/> * Twitter: @earnestassoc<http://twitter.com/earnestassoc>

1 0

Issue with Office365 certificates
by milanimarco82＠libero.it 09 Nov '18

09 Nov '18

Hello, I'm encountering an issue while using sTunnel with an Office365 account. sTunnel worked properly for a few months, while it gived an error with certificates since yesterday, whilst didn't change anything in the configuration. This is our configuration: [pop3s] client = yes accept = 127.0.0.1:2001 connect = outlook.office365.com:995 CAfile = C:\Program Files (x86)\stunnel\config\ca-certs.pem checkHost = outlook.office365.com verifyChain = yes OCSPaia = yes This is what we get in the log: 2018.11.09 11:34:09 LOG7[main]: Found 1 ready file descriptor(s) 2018.11.09 11:34:09 LOG7[main]: FD=432 ifds=r-x ofds=--- 2018.11.09 11:34:09 LOG7[main]: Service [pop3s] accepted (FD=672) from 127.0.0.1:49619 2018.11.09 11:34:09 LOG7[main]: Creating a new thread 2018.11.09 11:34:09 LOG7[main]: New thread created 2018.11.09 11:34:09 LOG7[30]: Service [pop3s] started 2018.11.09 11:34:09 LOG7[30]: Setting local socket options (FD=672) 2018.11.09 11:34:09 LOG7[30]: Option TCP_NODELAY set on local socket 2018.11.09 11:34:09 LOG5[30]: Service [pop3s] accepted connection from 127.0.0.1:49619 2018.11.09 11:34:09 LOG6[30]: failover: priority, starting at entry #0 2018.11.09 11:34:09 LOG6[30]: s_connect: connecting 40.101.9.178:995 2018.11.09 11:34:09 LOG7[30]: s_connect: s_poll_wait 40.101.9.178:995: waiting 10 seconds 2018.11.09 11:34:09 LOG5[30]: s_connect: connected 40.101.9.178:995 2018.11.09 11:34:09 LOG5[30]: Service [pop3s] connected remote server from 172.31.20.23:49620 2018.11.09 11:34:09 LOG7[30]: Setting remote socket options (FD=668) 2018.11.09 11:34:09 LOG7[30]: Option TCP_NODELAY set on remote socket 2018.11.09 11:34:09 LOG7[30]: Remote descriptor (FD=668) initialized 2018.11.09 11:34:09 LOG6[30]: SNI: sending servername: outlook.office365.com 2018.11.09 11:34:09 LOG6[30]: Peer certificate required 2018.11.09 11:34:09 LOG7[30]: TLS state (connect): before/connect initialization 2018.11.09 11:34:09 LOG7[30]: TLS state (connect): SSLv2/v3 write client hello A 2018.11.09 11:34:09 LOG7[30]: TLS state (connect): SSLv3 read server hello A 2018.11.09 11:34:09 LOG7[30]: Verification started at depth=2: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA 2018.11.09 11:34:09 LOG7[30]: CERT: Pre-verification succeeded 2018.11.09 11:34:09 LOG7[30]: OCSP: Ignoring root certificate 2018.11.09 11:34:09 LOG6[30]: Certificate accepted at depth=2: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA 2018.11.09 11:34:09 LOG7[30]: Verification started at depth=1: C=US, O=DigiCert Inc, CN=DigiCert Cloud Services CA-1 2018.11.09 11:34:09 LOG7[30]: CERT: Pre-verification succeeded 2018.11.09 11:34:09 LOG5[30]: OCSP: Connecting the AIA responder "http://ocsp.digicert.com" 2018.11.09 11:34:09 LOG6[30]: s_connect: connecting 93.184.220.29:80 2018.11.09 11:34:09 LOG7[30]: s_connect: s_poll_wait 93.184.220.29:80: waiting 10 seconds 2018.11.09 11:34:09 LOG5[30]: s_connect: connected 93.184.220.29:80 2018.11.09 11:34:09 LOG7[30]: OCSP: Connected ocsp.digicert.com:80 2018.11.09 11:34:09 LOG7[30]: OCSP: Response received 2018.11.09 11:34:09 LOG6[30]: OCSP: Status: good 2018.11.09 11:34:09 LOG6[30]: OCSP: This update: Nov 9 00:00:00 2018 GMT 2018.11.09 11:34:09 LOG6[30]: OCSP: Next update: Nov 16 00:00:00 2018 GMT 2018.11.09 11:34:09 LOG5[30]: OCSP: Certificate accepted 2018.11.09 11:34:09 LOG6[30]: Certificate accepted at depth=1: C=US, O=DigiCert Inc, CN=DigiCert Cloud Services CA-1 2018.11.09 11:34:09 LOG7[30]: Verification started at depth=0: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=outlook.com 2018.11.09 11:34:09 LOG7[30]: CERT: Pre-verification succeeded 2018.11.09 11:34:09 LOG6[30]: CERT: Host name "outlook.office365.com" matched with "*.office365.com" 2018.11.09 11:34:09 LOG5[30]: OCSP: Connecting the AIA responder "http://ocspx.digicert.com" 2018.11.09 11:34:09 LOG6[30]: s_connect: connecting 93.184.220.29:80 2018.11.09 11:34:09 LOG7[30]: s_connect: s_poll_wait 93.184.220.29:80: waiting 10 seconds 2018.11.09 11:34:09 LOG5[30]: s_connect: connected 93.184.220.29:80 2018.11.09 11:34:09 LOG7[30]: OCSP: Connected ocspx.digicert.com:80 2018.11.09 11:34:09 LOG7[30]: OCSP: Response received 2018.11.09 11:34:09 LOG3[30]: OCSP: Responder error: 6: unauthorized 2018.11.09 11:34:09 LOG4[30]: Rejected by OCSP at depth=0: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=outlook.com 2018.11.09 11:34:09 LOG7[30]: TLS alert (write): fatal: handshake failure 2018.11.09 11:34:09 LOG3[30]: SSL_connect: 14090086: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed 2018.11.09 11:34:09 LOG5[30]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.11.09 11:34:09 LOG7[30]: Deallocating application specific data for session connect address 2018.11.09 11:34:09 LOG7[30]: Remote descriptor (FD=668) closed 2018.11.09 11:34:09 LOG7[30]: Local descriptor (FD=672) closed 2018.11.09 11:34:09 LOG7[30]: Service [pop3s] finished (0 left) Can you please help me? Thanks in advance!

2 3