stunnel-users

stunnel-users@stunnel.org

6 participants
3294 discussions

Potentially dangerous change of behavior in handling "global option" in stunnel after version 5.45
by Tony Cheneau 29 Jun '18

29 Jun '18

Hello everyone, I was updating my version of stunnel and playing my regression suite and I was surprised to see some tests fail. We usually apply "verify = 2" as global option at the beginning of the configuration file on our stunnel "server" so as to enforce the client certificate verification. So I was a little bit surprise to see I could establish a TLS connection with my test server without providing a client certificate. The "verify = 2" as a "global option" is parsed at some point, because I can trigger an error message if I place a bogus value ("verify = 8"). Yet, it seems to be ignored when accepting connections. If I move the "verify = 2" from the "global option" to a service-level option for a specific service/tunnel, it works as expected (and documented): it rejects my certificate-less client. After a little bit of investigation, I was able to narrow down the change of behavior in version 5.45 (meaning that 5.44 still follow the old behavior). All the newer version follow this new behavior. I haven't seen any public CVS/SVN/git for stunnel, so I was not able to narrow it down further and I could not identify the exact change in the code that modified the behavior. While I understand that this option is documented in the manpage as a service-level option, in practice, "verify" could be used as a global option for years (my oldest documented usage at my company dates back from stunnel 4.54). (I know this option is going to be replaced by verifyChain/requireCert, the observed behavior reported in this email also applies on these options: they can't be applied program wide as a "global option") Am I missing something obvious here ? I haven't seen the change documented in the changelog, so it looks like a regression to me. Thank you in advance (and thank you for the great piece of software, obviously!). Regards, Tony Cheneau

1 0

Re: [stunnel-users] stunnel 5.47 released
by Eric S Eberhard 28 Jun '18

28 Jun '18

Query -- how does this relate to TLSv1.3 and the alpha version (which is not going to work with the final version -- and does not exist I think) -- and what version of openssl do you recommend? Thanks, Eric Eric S Eberhard VICS (Vertical Integrated Computer Systems) Voice: 928 567 3529 Cell : 928 301 7537 (not reliable except for text or if not home) 2933 W Middle Verde Rd Camp Verde, AZ 86322 -----Original Message----- From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Michal Trojnara Sent: Friday, June 22, 2018 11:10 PM To: stunnel-users(a)stunnel.org; stunnel-announce(a)stunnel.org; openssl-users(a)openssl.org Subject: [stunnel-users] stunnel 5.47 released Dear Users, I have released version 5.47 of stunnel. Version 5.47, 2018.06.23, urgency: HIGH * New features - Fast add_lock_callback for OpenSSL < 1.1.0. This largely improves performance on heavy load. - Automatic detection of Homebrew OpenSSL. - Clarified port binding error logs. - Various "make test" improvements. * Bugfixes - Fixed a crash on switching to SNI slave sections. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: c4e675db996eb92beef885f72a3ed8af3c7603fea6b99d2873198dd6c0021d0b stunnel-5.47.tar.gz 985e1d65a3f4a7599cc78630960e1b2c97981f91ce6bc41f2eefcd371b4067a3 stunnel-5.47-win32-installer.exe 309cfb79329448f0c134aece0d10d0737e3728b25c288e9a76650837cd6f839c stunnel-5.47-android.zip Best regards, Mike

1 0

question regarding TLS connection.
by Daniel Trickett 26 Jun '18

26 Jun '18

Hi We are using stunnel 5.44. We are having an issue connecting with a customer who is not supporting TLS 1.1, only 1.2 and 1.3. When I look in the log, I see the following. Why do I see the SSLv3 note in the line? The below leads me to believe that we connect to the customer, but they say that we are not. 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 read server certificate A 2018.06.25 11:37:24 LOG6[7]: Client certificate not requested 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 read server done A 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 write client key exchange A 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 write change cipher spec A 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 write finished A 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 flush data 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 read finished A 2018.06.25 11:37:24 LOG7[7]: 1 client connect(s) requested 2018.06.25 11:37:24 LOG7[7]: 1 client connect(s) succeeded 2018.06.25 11:37:24 LOG7[7]: 0 client renegotiation(s) requested 2018.06.25 11:37:24 LOG7[7]: 0 session reuse(s) 2018.06.25 11:37:24 LOG6[7]: TLS connected: new session negotiated Best regards, Dan Daniel Trickett Head of Database Services | MBS Business Technology BX-TCS-O Oracle ERP Business Services of Merck KGaA, Darmstadt, Germany Planned Absence - 7/2/2018 - 7/6/2018 MilliporeSigma A business of Merck KGaA, Darmstadt, Germany EMD Millipore Corporation | 80 Ashby Road | Bedford, MA 01730 | USA office 781-533-3017 |cell 978-761-3506 |email daniel.trickett(a)emdmillipore.com<mailto:daniel.trickett@emdmillipore.com> This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click http://www.emdgroup.com/emd/imprint/mail_disclaimer.html to access the German, French, Spanish and Portuguese versions of this disclaimer.

2 1

stunnel 5.47 released
by Michal Trojnara 23 Jun '18

23 Jun '18

Dear Users, I have released version 5.47 of stunnel. Version 5.47, 2018.06.23, urgency: HIGH * New features - Fast add_lock_callback for OpenSSL < 1.1.0. This largely improves performance on heavy load. - Automatic detection of Homebrew OpenSSL. - Clarified port binding error logs. - Various "make test" improvements. * Bugfixes - Fixed a crash on switching to SNI slave sections. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: c4e675db996eb92beef885f72a3ed8af3c7603fea6b99d2873198dd6c0021d0b stunnel-5.47.tar.gz 985e1d65a3f4a7599cc78630960e1b2c97981f91ce6bc41f2eefcd371b4067a3 stunnel-5.47-win32-installer.exe 309cfb79329448f0c134aece0d10d0737e3728b25c288e9a76650837cd6f839c stunnel-5.47-android.zip Best regards, Mike

2 1

Stunnel 5.45 and 5.46 crashes upon reconnect HTTPS
by Javier 22 Jun '18

22 Jun '18

Hi, isn't annoying when you are using an old version, 5.44, and all goes fine, you notice you are outdated and then comes the problems after update? :-P The thing is that yesterday I needed the HTTPS server so I run Stunnel 5.44 for my non-SSL app and all was fine. I updated to 5.46 just because I forgot the last time and didn't even run again because I didn't need it. Today I used it and... I had a crash. I tested 5.45 to trace versions back, and it crashes as well. Back to 5.44 and no crash. The crash happens when there is a reload/reconnect/multiconnect (example, 2 connections html+images) by the browser when connects to an HTTPS server. It only happens when using a SNI service. I've been able to trace back the log on those versions and when fails in 5.45 and 5.46 is at the time when it needs to switch to the SNI service. (log from 5.44) SNI: requested servername: xxx SNI: matched pattern: xxx SNI: switched to service [xxx] <<<<----- BEFORE SWITCH, IT CRASHES on 5.45 and 5.46 Imagine you load https://xxx/. The first time is fine, the second, crashes stunnel. Not happening with 5.44. I haven't seen any change to SNI in manual so... :-? These are the configs for the used virtual servers. Nothing has been changed, anyway: [SSL] client = no accept = y.y.y.1:4747 connect = y.y.y.2:443 [SSL-xxx-SNI] client = no sni = SSL:xxx connect = y.y.y.2:443 cert = pem key = pem Don't mind the port numbers. They aren't in conflict. Running on Windows 2000. Regards.

3 4

Reg : Stunnel + RSYNC Usage with TLSv1.2
by Sakthivel Ganesamoorthy 20 Jun '18

20 Jun '18

Hi, I have configured a server and client for Stunnel + Rsync usage over TLSv1.2. It is working fine, but I wanted to verify the "Cipher Key" exchange mechanism between "Server & Client" via "Wireshark". When I captured the logs via "Wireshark", it shows everything as TCP messages and I don't see any "Client Hello message (or) Cipher Key exchange message (or) any of the TLSv1.2" handshake messages. Please let me know whether I'm missing something here. Thanks, Sakthi

1 0

stunnel used as jump host for SFTP
by Schultz, Cecilia 20 Jun '18

20 Jun '18

Hello, I am trying to test stunnel to see if it can provide the functionality we need. We are a Windows shop. What we need is for multiple client machines (I call these C1, C2, C3) to connect to our server (S). Server S will connect to a remote SFTP server (port 22). I call the remote SFTP server "R". C1, C2, C3 and S are all inside our firewall. Currently S can connect and send files to R using SFTP (port 22). The problem is that R does not accept a range of IP addresses, and has a limit on the number of IP addresses they can accept. So, what I need is for C1, C2, C3 to be able to connect to server R using S as a jump host. >From R's perspective, it should be like the connection is coming from S. Question 1: can stunnel be used to accomplish this? Question 2: I have installed stunnel in a test server ("stunnel -install" actually from the bin folder), and configured the conf like this: [sftp] accept=127.0.0.1:22 connect=some.remote.server.com:22 I tried to use Winscp SFTP client to test a connection, but it times out. I then checked S, and I don't see anything listening on port 22. I did "netstat -a" and I don't see anything listening on port 22. Was something wrong in the "stunnel -install" command? Shouldn't it be listening on port 22? Also, I uncommented the entry for log, but I don't see any log file in the stunnel folder/subfolders ; Debugging stuff (may be useful for troubleshooting) debug = info output = stunnel.log Thanks for your help, Cecilia

3 3

Re: [stunnel-users] stunnel used as jump host for SFTP
by Schultz, Cecilia 20 Jun '18

20 Jun '18

Thank you so much for the info! I will try this out. From: stunnel-users <stunnel-users-bounces(a)stunnel.org> On Behalf Of Harris, Douglas (SSC/SPC) Sent: Wednesday, June 20, 2018 5:08 AM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] stunnel used as jump host for SFTP You can accomplish this in Windows. Just add a port forwarding rule to S: netsh interface portproxy add v4tov4 listenport=22 listenaddress=[IP of S] connectport=22 connectaddress=[IP of R] -Doug

1 0

stunnel PSK support via custome openssl engine
by Tarakeshwar Rao 14 Jun '18

14 Jun '18

Dear Stunnel-users, >From Stunnel man pages, I could see that we could read PSK secret from plain text file with following option: PSKsecrets = psk.txt Could it possible to use custom openssl engine to read PSK file from HSM. I know that this works for reading TLS keys. I am not sure how I could do it for PSK. Thanks for your support, Regards, Tarak

1 0

is it possible to make stunnel works for dbmail timsieved?
by cktmwe＠gmail.com 12 Jun '18

12 Jun '18

hello everyone, I'm currently try to stunnel sieve traffic to local dbmail timsieved, unfortunately I couldn't get it to work, my first question, does stunnel support sieve manage protocol? secondly if it does, how can I config the service? what I've done so far. timsieved started on 127.0.0.1:2000, connect and manage all works, I saw connection in dbmail log, then define sieve service block in stunnel.conf, restart stunnel, but if I connect our.public.ip:4190, timsieved becames no connection at all, dbmail log kept silent. traffic from port 4190 is already accepted in iptables. config that I used. > [sieve] > accept = our.public.ip:4190 > connect = 127.0.0.1:2000 > software version: stunnel-5.43 dbmail-3.2.3 Thanks.

2 1

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users