- stunnel-users - stunnel.org

Tunnelblick over stunnel - connects but does not work
by Anton Kantsel 10 Nov '17

10 Nov '17

Hi! As OpenVPN seems to become banned in increasing number of countries, I had to look for a way to foil DPI. Wrapping OpenVPN traffic into stunnel SSL-secured connection seems promising but... On Windows machine it really works just fine. But on macOS it connects, but then no surfing or other Internet application works whatsoever. Looks like DNS problem but may be it's different... Moreover, in 40 secs or so Tunnelblick disconnects with message "2017-11-10 00:08:54 *Tunnelblick: After 30.0 seconds, gave up trying to fetch IP address information using the ipInfo host's name after connecting. 2017-11-10 00:09:30 *Tunnelblick: After 30.0 seconds, gave up trying to fetch IP address information using the ipInfo host's IP address after connecting". Then it tries to connect again but never succeeds and cycles forever. Please find stunnel config and Tunnelblik full log below. Would appreciate any help! [STUNNEL] $ stunnel -version stunnel 5.23 on x86_64-apple-darwin14.5.0 platform Compiled with OpenSSL 0.9.8zd 8 Jan 2015 Running with OpenSSL 0.9.8zh 14 Jan 2016 Update OpenSSL shared libraries or rebuild stunnel Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP Global options: debug = daemon.notice RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = HIGH:+3DES:+DH:!aNULL:!SSLv2 curve = prime256v1 debug = notice logId = sequential options = NO_SSLv2 options = NO_SSLv3 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none stunnel.conf file: cert=stunnel.pem options=NO_SSLv2 [openvpn] client=yes accept=localhost:989 connect=X.X.X.X:990 [TUNNELBLICK] *Tunnelblick: OS X 10.12.6; Tunnelblick 3.7.4 (build 4900); prior version 3.7.3 (build 4880); Standard user git commit 0f68fae3cabe6b2ebdc9fbb3054232074c03bbfb Configuration client2_pc_stunnel "Sanitized" condensed configuration file for /Library/Application Support/Tunnelblick/Shared/client2_pc_stunnel.tblk: client dev tun proto tcp remote 127.0.0.1 989 resolv-retry infinite nobind persist-key persist-tun verb 3 remote-cert-tls server keepalive 10 120 tls-client key-direction 1 <ca> [Security-related line(s) omitted] </ca> <cert> [Security-related line(s) omitted] </cert> <key> [Security-related line(s) omitted] </key> <tls-auth> [Security-related line(s) omitted] </tls-auth> ================================================================================ XXX ================================================================================ There are no unusual files in client2_pc_stunnel.tblk ================================================================================ Configuration preferences: useDNS = 1 -notMonitoringConnection = 0 -resetPrimaryInterfaceAfterDisconnect = 1 -routeAllTrafficThroughVpn = 1 -runMtuTest = 0 -doNotFlushCache = 0 -useRouteUpInsteadOfUp = 1 -openvpnVersion = - -notOKToCheckThatIPAddressDidNotChangeAfterConnection = 0 -keepConnected = 1 -lastConnectionSucceeded = 1 -prependDomainNameToSearchDomains = 1 ================================================================================ Wildcard preferences: -notOKToCheckThatIPAddressDidNotChangeAfterConnection = 0 ================================================================================ Program preferences: skipWarningAboutNonAdminUpdatingTunnelblick = 1 skipWarningThatIPANotFetchedBeforeConnection = 1 skipWarningThatInternetIsNotReachable = 1 skipWarningAboutPlacingIconNearTheSpotlightIcon = 1 placeIconInStandardPositionInStatusBar = 0 launchAtNextLogin = 1 notOKToCheckThatIPAddressDidNotChangeAfterConnection = 0 tunnelblickVersionHistory = ( "3.7.4 (build 4900)", "3.7.3 (build 4880)", "3.7.2a (build 4851)", "3.7.2 (build 4850)", "3.7.1b (build 4813)", "3.7.1a (build 4812)", "3.7.1 (build 4811)", "3.7.0 (build 4790)", "3.6.9 (build 4685)", "3.6.8 (build 4625)" ) statusDisplayNumber = 0 lastLaunchTime = 531944638.592689 showConnectedDurations = 1 lastLanguageAtLaunchWasRTL = 0 connectionWindowDisplayCriteria = showWhenConnecting maxLogDisplaySize = 102400 lastConnectedDisplayName = client2_pc_stunnel keyboardShortcutIndex = 1 updateCheckAutomatically = 1 NSWindow Frame SettingsSheetWindow = 367 167 829 524 0 0 1280 777 NSWindow Frame ConnectingWindow = 469 442 389 187 0 0 1280 777 NSWindow Frame SUStatusFrame = 624 664 400 129 0 0 1600 877 NSWindow Frame SUUpdateAlert = 516 363 620 392 0 0 1600 877 NSWindow Frame ListingWindow = 64 330 500 422 0 0 1280 777 detailsWindowFrameVersion = 4900 detailsWindowFrame = {{48, 0}, {1232, 777}} detailsWindowLeftFrame = {{0, 0}, {224, 659}} detailsWindowViewIndex = 0 detailsWindowConfigurationsTabIdentifier = log leftNavSelectedDisplayName = client2_pc_stunnel AdvancedWindowTabIdentifier = whileConnected haveDealtWithOldTunTapPreferences = 1 haveDealtWithOldLoginItem = 1 SUEnableAutomaticChecks = 1 SUFeedURL = https://www.tunnelblick.net/appcast-s.rss SUScheduledCheckInterval = 86400 SUSendProfileInfo = 1 SULastCheckTime = 2017-11-09 18:24:28 +0000 SULastProfileSubmissionDate = 2017-11-08 18:10:57 +0000 SUHasLaunchedBefore = 1 WebKitDefaultFontSize = 11 WebKitStandardFont = .AppleSystemUIFont askedUserIfOKToCheckThatIPAddressDidNotChangeAfterConnection = 1 haveDealtWithSparkle1dot5b6 = 1 tunnelblickdHash = 004cdba8e08abd144bc48409040bc80e29c12ee9741ed7d73754f51d2547f7ea tunnelblickdPlistHash = ce400d395d1801b003398461b5420021f4d591822783a04b79b2f43956d28620 updateSendProfileInfo = 1 ================================================================================ Tunnelblick Log: *Tunnelblick: OS X 10.12.6; Tunnelblick 3.7.4 (build 4900); prior version 3.7.3 (build 4880) 2017-11-10 00:08:03 *Tunnelblick: Attempting connection with client2_pc_stunnel; Set nameserver = 769; monitoring connection 2017-11-10 00:08:03 *Tunnelblick: openvpnstart start client2_pc_stunnel.tblk 1337 769 0 3 0 1099696 -ptADGNWradsgnw 2.4.4-libressl-2.5.5 2017-11-10 00:08:03 *Tunnelblick: openvpnstart log: OpenVPN started successfully. Command used to start OpenVPN (one argument per displayed line): /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.4.4-libressl-2.5.5/openvpn --daemon --log /Library/Application Support/Tunnelblick/Logs/-SLibrary-SApplication Support-STunnelblick-SShared-Sclient2_pc_stunnel.tblk-SContents-SResources-Sconfig.ovpn.769_0_3_0_1099696.1337.openvpn.log --cd /Library/Application Support/Tunnelblick/Shared/client2_pc_stunnel.tblk/Contents/Resources --setenv IV_GUI_VER "net.tunnelblick.tunnelblick 4900 3.7.4 (build 4900)" --verb 3 --config /Library/Application Support/Tunnelblick/Shared/client2_pc_stunnel.tblk/Contents/Resources/config.ovpn --verb 3 --cd /Library/Application Support/Tunnelblick/Shared/client2_pc_stunnel.tblk/Contents/Resources --management 127.0.0.1 1337 --management-query-passwords --management-hold --redirect-gateway def1 --script-security 2 --route-up /Applications/Tunnelblick.app/Contents/Resources/ client.up.tunnelblick.sh -9 -d -f -m -p -r -w -ptADGNWradsgnw --down /Applications/Tunnelblick.app/Contents/Resources/ client.down.tunnelblick.sh -9 -d -f -m -p -r -w -ptADGNWradsgnw 2017-11-10 00:08:03 OpenVPN 2.4.4 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD] built on Nov 2 2017 2017-11-10 00:08:03 library versions: LibreSSL 2.5.5, LZO 2.10 2017-11-10 00:08:03 MANAGEMENT: TCP Socket listening on [AF_INET] 127.0.0.1:1337 2017-11-10 00:08:03 Need hold release from management interface, waiting... 2017-11-10 00:08:03 MANAGEMENT: Client connected from [AF_INET] 127.0.0.1:1337 2017-11-10 00:08:03 *Tunnelblick: openvpnstart starting OpenVPN 2017-11-10 00:08:04 *Tunnelblick: Established communication with OpenVPN 2017-11-10 00:08:04 MANAGEMENT: CMD 'pid' 2017-11-10 00:08:04 MANAGEMENT: CMD 'state on' 2017-11-10 00:08:04 MANAGEMENT: CMD 'state' 2017-11-10 00:08:04 MANAGEMENT: CMD 'bytecount 1' 2017-11-10 00:08:04 MANAGEMENT: CMD 'hold release' 2017-11-10 00:08:04 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts 2017-11-10 00:08:04 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication 2017-11-10 00:08:04 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication 2017-11-10 00:08:04 TCP/UDP: Preserving recently used remote address: [AF_INET]127.0.0.1:989 2017-11-10 00:08:04 Socket Buffers: R=[131072->131072] S=[131072->131072] 2017-11-10 00:08:04 Attempting to establish TCP connection with [AF_INET] 127.0.0.1:989 [nonblock] 2017-11-10 00:08:04 MANAGEMENT: >STATE:1510254484,TCP_CONNECT,,,,,, 2017-11-10 00:08:04 TCP connection established with [AF_INET]127.0.0.1:989 2017-11-10 00:08:04 TCP_CLIENT link local: (not bound) 2017-11-10 00:08:04 TCP_CLIENT link remote: [AF_INET]127.0.0.1:989 2017-11-10 00:08:04 MANAGEMENT: >STATE:1510254484,WAIT,,,,,, 2017-11-10 00:08:07 MANAGEMENT: >STATE:1510254487,AUTH,,,,,, 2017-11-10 00:08:07 TLS: Initial packet from [AF_INET]127.0.0.1:989, sid=db4e0f35 f615606b 2017-11-10 00:08:07 VERIFY OK: depth=1, C=UZ, ST=UZ, L=XXX, O=XXX, OU=VPNUnit, CN=XXX <http://talk.ingichkimetals.com>, name=EasyRSA, emailAddress=XXX 2017-11-10 00:08:07 VERIFY KU OK 2017-11-10 00:08:07 Validating certificate extended key usage 2017-11-10 00:08:07 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication 2017-11-10 00:08:07 VERIFY EKU OK 2017-11-10 00:08:07 VERIFY OK: depth=0, C=UZ, ST=UZ, L=XXX, O=IngMet, OU=VPNUnit, CN=server, name=EasyRSA, emailAddress=XXX 2017-11-10 00:08:08 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA 2017-11-10 00:08:08 [server] Peer Connection Initiated with [AF_INET] 127.0.0.1:989 2017-11-10 00:08:09 MANAGEMENT: >STATE:1510254489,GET_CONFIG,,,,,, 2017-11-10 00:08:09 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1) 2017-11-10 00:08:10 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway local def1,route 10.0.26.0 255.255.255.0,dhcp-option DNS 10.0.26.1,route 10.0.26.1,topology net30,ping 10,ping-restart 120,ifconfig 10.0.26.10 10.0.26.9,peer-id 0,cipher AES-256-GCM' 2017-11-10 00:08:10 OPTIONS IMPORT: timers and/or timeouts modified 2017-11-10 00:08:10 OPTIONS IMPORT: --ifconfig/up options modified 2017-11-10 00:08:10 OPTIONS IMPORT: route options modified 2017-11-10 00:08:10 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified 2017-11-10 00:08:10 OPTIONS IMPORT: peer-id set 2017-11-10 00:08:10 OPTIONS IMPORT: adjusting link_mtu to 1626 2017-11-10 00:08:10 OPTIONS IMPORT: data channel crypto options modified 2017-11-10 00:08:10 Data Channel: using negotiated cipher 'AES-256-GCM' 2017-11-10 00:08:10 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key 2017-11-10 00:08:10 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key 2017-11-10 00:08:10 Opening utun (connect(AF_SYS_CONTROL)): Resource busy (errno=16) 2017-11-10 00:08:10 Opened utun device utun1 2017-11-10 00:08:10 do_ifconfig, tt->did_ifconfig_ipv6_setup=0 2017-11-10 00:08:10 MANAGEMENT: >STATE:1510254490,ASSIGN_IP,,10.0.26.10,,,, 2017-11-10 00:08:10 /sbin/ifconfig utun1 delete ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address 2017-11-10 00:08:10 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure 2017-11-10 00:08:10 /sbin/ifconfig utun1 10.0.26.10 10.0.26.9 mtu 1500 netmask 255.255.255.255 up 2017-11-10 00:08:10 /sbin/route add -net 0.0.0.0 10.0.26.9 128.0.0.0 add net 0.0.0.0: gateway 10.0.26.9 2017-11-10 00:08:10 /sbin/route add -net 128.0.0.0 10.0.26.9 128.0.0.0 add net 128.0.0.0: gateway 10.0.26.9 2017-11-10 00:08:10 MANAGEMENT: >STATE:1510254490,ADD_ROUTES,,,,,, 2017-11-10 00:08:10 /sbin/route add -net 10.0.26.0 10.0.26.9 255.255.255.0 add net 10.0.26.0: gateway 10.0.26.9 2017-11-10 00:08:10 /sbin/route add -net 10.0.26.1 10.0.26.9 255.255.255.255 add net 10.0.26.1: gateway 10.0.26.9 ********************************************** Start of output from client.up.tunnelblick.sh Retrieved from OpenVPN: name server(s) [ 10.0.26.1 ], search domain(s) [ ] and SMB server(s) [ ] and using default domain name [ openvpn ] Not aggregating ServerAddresses because running on OS X 10.6 or higher Prepending 'openvpn' to search domains '' because the search domains were not set manually (or are allowed to be changed) and 'Prepend domain name to search domains' was selected Saved the DNS and SMB configurations so they can be restored Changed DNS ServerAddresses setting from '172.20.10.1' to '10.0.26.1' Changed DNS SearchDomains setting from '' to 'openvpn' Changed DNS DomainName setting from '' to 'openvpn' Did not change SMB NetBIOSName setting of '' Did not change SMB Workgroup setting of '' Did not change SMB WINSAddresses setting of '' DNS servers '10.0.26.1' will be used for DNS queries when the VPN is active NOTE: The DNS servers do not include any free public DNS servers known to Tunnelblick. This may cause DNS queries to fail or be intercepted or falsified even if they are directed through the VPN. Specify only known public DNS servers or DNS servers located on the VPN network to avoid such problems. Flushed the DNS cache via dscacheutil /usr/sbin/discoveryutil not present. Not flushing the DNS cache via discoveryutil Notified mDNSResponder that the DNS cache was flushed Setting up to monitor system configuration with process-network-changes End of output from client.up.tunnelblick.sh ********************************************** 2017-11-10 00:08:13 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this 2017-11-10 00:08:13 Initialization Sequence Completed 2017-11-10 00:08:13 MANAGEMENT: >STATE:1510254493,CONNECTED,SUCCESS,10.0.26.10,127.0.0.1,989,127.0.0.1,50665 2017-11-10 00:08:14 *Tunnelblick: No 'connected.sh' script to execute 2017-11-10 00:08:54 *Tunnelblick: After 30.0 seconds, gave up trying to fetch IP address information using the ipInfo host's name after connecting. 2017-11-10 00:09:30 *Tunnelblick: After 30.0 seconds, gave up trying to fetch IP address information using the ipInfo host's IP address after connecting. 2017-11-10 00:10:13 [server] Inactivity timeout (--ping-restart), restarting 2017-11-10 00:10:13 SIGUSR1[soft,ping-restart] received, process restarting 2017-11-10 00:10:13 MANAGEMENT: >STATE:1510254613,RECONNECTING,ping-restart,,,,, 2017-11-10 00:10:14 *Tunnelblick: No 'reconnecting.sh' script to execute 2017-11-10 00:10:14 MANAGEMENT: CMD 'hold release' 2017-11-10 00:10:14 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts 2017-11-10 00:10:14 TCP/UDP: Preserving recently used remote address: [AF_INET]127.0.0.1:989 2017-11-10 00:10:14 Socket Buffers: R=[131072->131072] S=[131072->131072] 2017-11-10 00:10:14 Attempting to establish TCP connection with [AF_INET] 127.0.0.1:989 [nonblock] 2017-11-10 00:10:14 MANAGEMENT: >STATE:1510254614,TCP_CONNECT,,,,,, 2017-11-10 00:10:15 TCP connection established with [AF_INET]127.0.0.1:989 2017-11-10 00:10:15 TCP_CLIENT link local: (not bound) 2017-11-10 00:10:15 TCP_CLIENT link remote: [AF_INET]127.0.0.1:989 2017-11-10 00:10:15 MANAGEMENT: >STATE:1510254615,WAIT,,,,,, 2017-11-10 00:10:24 Connection reset, restarting [-1] 2017-11-10 00:10:24 SIGUSR1[soft,connection-reset] received, process restarting 2017-11-10 00:10:24 MANAGEMENT: >STATE:1510254624,RECONNECTING,connection-reset,,,,, 2017-11-10 00:10:24 *Tunnelblick: No 'reconnecting.sh' script to execute 2017-11-10 00:10:24 MANAGEMENT: CMD 'hold release' 2017-11-10 00:10:24 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts 2017-11-10 00:10:24 TCP/UDP: Preserving recently used remote address: [AF_INET]127.0.0.1:989 2017-11-10 00:10:24 Socket Buffers: R=[131072->131072] S=[131072->131072] 2017-11-10 00:10:24 Attempting to establish TCP connection with [AF_INET] 127.0.0.1:989 [nonblock] 2017-11-10 00:10:24 MANAGEMENT: >STATE:1510254624,TCP_CONNECT,,,,,, 2017-11-10 00:10:25 TCP connection established with [AF_INET]127.0.0.1:989 2017-11-10 00:10:25 TCP_CLIENT link local: (not bound) 2017-11-10 00:10:25 TCP_CLIENT link remote: [AF_INET]127.0.0.1:989 2017-11-10 00:10:25 MANAGEMENT: >STATE:1510254625,WAIT,,,,,, 2017-11-10 00:10:32 *Tunnelblick: Disconnecting; notification window disconnect button pressed 2017-11-10 00:10:33 *Tunnelblick: No 'pre-disconnect.sh' script to execute 2017-11-10 00:10:33 *Tunnelblick: Disconnecting using 'kill' 2017-11-10 00:10:33 event_wait : Interrupted system call (code=4) 2017-11-10 00:10:33 /sbin/route delete -net 10.0.26.0 10.0.26.9 255.255.255.0 delete net 10.0.26.0: gateway 10.0.26.9 2017-11-10 00:10:33 /sbin/route delete -net 10.0.26.1 10.0.26.9 255.255.255.255 delete net 10.0.26.1: gateway 10.0.26.9 2017-11-10 00:10:33 /sbin/route delete -net 0.0.0.0 10.0.26.9 128.0.0.0 delete net 0.0.0.0: gateway 10.0.26.9 2017-11-10 00:10:33 /sbin/route delete -net 128.0.0.0 10.0.26.9 128.0.0.0 delete net 128.0.0.0: gateway 10.0.26.9 2017-11-10 00:10:33 Closing TUN/TAP interface 2017-11-10 00:10:33 /Applications/Tunnelblick.app/Contents/Resources/ client.down.tunnelblick.sh -9 -d -f -m -p -r -w -ptADGNWradsgnw utun1 1500 1623 10.0.26.10 10.0.26.9 init ********************************************** Start of output from client.down.tunnelblick.sh Cancelled monitoring of system configuration changes Restored the DNS and SMB configurations Flushed the DNS cache via dscacheutil /usr/sbin/discoveryutil not present. Not flushing the DNS cache via discoveryutil Notified mDNSResponder that the DNS cache was flushed Resetting primary interface 'en0' via networksetup -setairportpower en0 off/on... End of output from client.down.tunnelblick.sh ********************************************** 2017-11-10 00:10:36 SIGTERM[hard,] received, process exiting 2017-11-10 00:10:36 MANAGEMENT: >STATE:1510254636,EXITING,SIGTERM,,,,, 2017-11-10 00:10:36 *Tunnelblick: No 'post-disconnect.sh' script to execute 2017-11-10 00:10:36 *Tunnelblick: Expected disconnection occurred. ================================================================================ "Sanitized" full configuration file client dev tun proto tcp remote 127.0.0.1 989 resolv-retry infinite nobind persist-key persist-tun verb 3 remote-cert-tls server keepalive 10 120 tls-client key-direction 1 <ca> [Security-related line(s) omitted] </ca> <cert> [Security-related line(s) omitted] </cert> <key> [Security-related line(s) omitted] </key> <tls-auth> [Security-related line(s) omitted] </tls-auth> ================================================================================ ifconfig output: lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384 options=1203<RXCSUM,TXCSUM,TXSTATUS,SW_TIMESTAMP> inet 127.0.0.1 netmask 0xff000000 inet6 ::1 prefixlen 128 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1 nd6 options=201<PERFORMNUD,DAD> gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280 stf0: flags=0<> mtu 1280 en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500 ether 60:03:08:a6:ca:5a inet 172.20.10.2 netmask 0xfffffff0 broadcast 172.20.10.15 media: autoselect status: active en1: flags=963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX> mtu 1500 options=60<TSO4,TSO6> ether 72:00:01:d9:43:00 media: autoselect <full-duplex> status: inactive en2: flags=963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX> mtu 1500 options=60<TSO4,TSO6> ether 72:00:01:d9:43:01 media: autoselect <full-duplex> status: inactive p2p0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 2304 ether 02:03:08:a6:ca:5a media: autoselect status: inactive awdl0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1484 ether c2:f1:c7:85:b6:9d inet6 fe80::c0f1:c7ff:fe85:b69d%awdl0 prefixlen 64 scopeid 0x8 nd6 options=201<PERFORMNUD,DAD> media: autoselect status: active bridge0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500 options=63<RXCSUM,TXCSUM,TSO4,TSO6> ether 72:00:01:d9:43:00 Configuration: id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0 maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200 root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0 ipfilter disabled flags 0x2 member: en1 flags=3<LEARNING,DISCOVER> ifmaxaddr 0 port 5 priority 0 path cost 0 member: en2 flags=3<LEARNING,DISCOVER> ifmaxaddr 0 port 6 priority 0 path cost 0 media: <unknown type> status: inactive utun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 2000 inet6 fe80::6c50:d369:e570:bf02%utun0 prefixlen 64 scopeid 0xa nd6 options=201<PERFORMNUD,DAD> ================================================================================ Console Log: 2017-11-09 23:23:57 Tunnelblick[1595] Tunnelblick: OS X 10.12.6; Tunnelblick 3.7.4 (build 4900) 2017-11-09 23:23:57 Tunnelblick[1595] Warning: preferences contain unknown preference 'PMPrintingExpandedStateForPrint2' 2017-11-09 23:23:57 Tunnelblick[1595] Warning: preferences contain unknown preference 'userAgreementVersionAgreedTo' 2017-11-10 00:08:54 Tunnelblick[1595] currentIPInfo(Name): IP address info could not be fetched within 35.4 seconds; the error was 'Error Domain=NSURLErrorDomain Code=-1001 "The request timed out." UserInfo={NSUnderlyingError=0x60800024a200 {Error Domain=kCFErrorDomainCFNetwork Code=-1001 "The request timed out." UserInfo={NSErrorFailingURLStringKey=https://tunnelblick.net/ipinfo, NSErrorFailingURLKey=https://tunnelblick.net/ipinfo, _kCFStreamErrorCodeKey=-2102, _kCFStreamErrorDomainKey=4, NSLocalizedDescription=The request timed out.}}, NSErrorFailingURLStringKey= https://tunnelblick.net/ipinfo, NSErrorFailingURLKey= https://tunnelblick.net/ipinfo, _kCFStreamErrorDomainKey=4, _kCFStreamErrorCodeKey=-2102, NSLocalizedDescription=The request timed out.}'; the response was '(null)' 2017-11-10 00:09:30 Tunnelblick[1595] currentIPInfo(Address): IP address info could not be fetched within 35.5 seconds; the error was 'Error Domain=NSURLErrorDomain Code=-1001 "The request timed out." UserInfo={NSUnderlyingError=0x60000044cea0 {Error Domain=kCFErrorDomainCFNetwork Code=-1001 "The request timed out." UserInfo={NSErrorFailingURLStringKey=http://205.233.73.116/ipinfo, NSErrorFailingURLKey=http://205.233.73.116/ipinfo, _kCFStreamErrorCodeKey=-2102, _kCFStreamErrorDomainKey=4, NSLocalizedDescription=The request timed out.}}, NSErrorFailingURLStringKey= http://205.233.73.116/ipinfo, NSErrorFailingURLKey= http://205.233.73.116/ipinfo, _kCFStreamErrorDomainKey=4, _kCFStreamErrorCodeKey=-2102, NSLocalizedDescription=The request timed out.}'; the response was '(null)'

1 0

Re: [stunnel-users] Web browsing over stunnel
by Osvald Brko 08 Nov '17

08 Nov '17

> From: Josealf.rm <josealf(a)rocketmail.com> > Sent: Tuesday, November 7, 2017 10:41 AM > To: Peter Pentchev > Cc: Osvald Brko; stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] Web browsing over stunnel > Osvald, > Peter made a very clear explanation. Note that your connect statement should be something like: > connect=104.239.213.7:443 > And you should test using something like: > http://www.stunnel.net:8888/ O.K., I understand it. www.stunnel.org still refuse connection (see below), but I was able to open www.wikipedia.org: http://www.wikipedia.org:8888/ [https_test] client = yes accept = 127.0.0.1:8888 connect = 91.198.174.192:443 #127.0.0.1 localhost #127.0.0.1 www.stunnel.org 127.0.0.1 www.wikipedia.org But of course I am not able to use any web link, and I can see only default main page without any path. So stunnel is completely unusable for web browsing, I am right? O.B. ===== http://www.stunnel.org:8888/ [https_test] client = yes accept = 127.0.0.1:8888 connect = 207.192.69.165:443 #127.0.0.1 localhost 127.0.0.1 www.stunnel.org #127.0.0.1 www.wikipedia.org 2017.11.07 15:51:37 LOG7[main]: Service [https_test] (FD=260) bound to 127.0.0.1:8888 2017.11.07 15:51:37 LOG7[cron]: Cron thread initialized 2017.11.07 15:51:53 LOG7[main]: Found 1 ready file descriptor(s) 2017.11.07 15:51:53 LOG7[main]: FD=232 ifds=r-x ofds=--- 2017.11.07 15:51:53 LOG7[main]: FD=248 ifds=r-x ofds=--- 2017.11.07 15:51:53 LOG7[main]: Service [https_test] accepted (FD=300) from 127.0.0.1:3197 2017.11.07 15:51:53 LOG7[main]: Creating a new thread 2017.11.07 15:51:53 LOG7[main]: New thread created 2017.11.07 15:51:53 LOG7[0]: Service [https_test] started 2017.11.07 15:51:53 LOG7[0]: Option TCP_NODELAY set on local socket 2017.11.07 15:51:53 LOG5[0]: Service [https_test] accepted connection from 127.0.0.1:3197 2017.11.07 15:51:53 LOG6[0]: s_connect: connecting 207.192.69.165:443 2017.11.07 15:51:53 LOG7[0]: s_connect: s_poll_wait 207.192.69.165:443: waiting 10 seconds 2017.11.07 15:51:53 LOG5[0]: s_connect: connected 207.192.69.165:443 2017.11.07 15:51:53 LOG5[0]: Service [https_test] connected remote server from XX.XXX.XXX.XXX:3198 2017.11.07 15:51:53 LOG7[0]: Option TCP_NODELAY set on remote socket 2017.11.07 15:51:53 LOG7[0]: Remote descriptor (FD=320) initialized 2017.11.07 15:51:53 LOG6[0]: SNI: sending servername: 207.192.69.165 2017.11.07 15:51:53 LOG6[0]: Peer certificate not required 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): before/connect initialization 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv2/v3 write client hello A 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 read server hello A 2017.11.07 15:51:53 LOG6[0]: Certificate verification disabled 2017.11.07 15:51:53 LOG6[0]: Certificate verification disabled 2017.11.07 15:51:53 LOG6[0]: Certificate verification disabled 2017.11.07 15:51:53 LOG6[0]: Certificate verification disabled 2017.11.07 15:51:53 LOG6[0]: Certificate verification disabled 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 read server certificate A 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 read server key exchange A 2017.11.07 15:51:53 LOG6[0]: Client certificate not requested 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 read server done A 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 write client key exchange A 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 write change cipher spec A 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 write finished A 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 flush data 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 read server session ticket A 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 read finished A 2017.11.07 15:51:53 LOG7[0]: 1 client connect(s) requested 2017.11.07 15:51:53 LOG7[0]: 1 client connect(s) succeeded 2017.11.07 15:51:53 LOG7[0]: 0 client renegotiation(s) requested 2017.11.07 15:51:53 LOG7[0]: 0 session reuse(s) 2017.11.07 15:51:53 LOG6[0]: TLS connected: new session negotiated 2017.11.07 15:51:53 LOG7[0]: Peer certificate was cached (7519 bytes) 2017.11.07 15:51:53 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2017.11.07 15:51:53 LOG7[0]: Compression: null, expansion: null 2017.11.07 15:51:58 LOG7[0]: TLS alert (read): warning: close notify 2017.11.07 15:51:58 LOG6[0]: TLS closed (SSL_read) 2017.11.07 15:51:58 LOG7[0]: Sent socket write shutdown 2017.11.07 15:51:59 LOG3[0]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2017.11.07 15:51:59 LOG5[0]: Connection reset: 483 byte(s) sent to TLS, 429 byte(s) sent to socket 2017.11.07 15:51:59 LOG7[0]: Remote descriptor (FD=320) closed 2017.11.07 15:51:59 LOG7[0]: Local descriptor (FD=300) closed 2017.11.07 15:51:59 LOG7[0]: Service [https_test] finished (0 left)

2 2

Re: [stunnel-users] stunnel 5.43 released
by Ian Bamforth 07 Nov '17

07 Nov '17

Hi, I'm having trouble installing the new release on Ubuntu 14.04. The command I'm running is: execute ./configure --with-ssl=/usr/local/openssl-1.1.0g && make && make check && sudo make install I get this output: 15:13:06 stunnel 5.43 on x86_64-pc-linux-gnu platform 15:13:06 Compiled/running with OpenSSL 1.1.0g 2 Nov 2017 15:13:06 Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 15:13:06 15:13:06 test 010_require_cert ok 15:13:06 test 011_verify_peer ok 15:13:06 test 012_verify_chain ok 15:13:06 test 013_CRL_file failed 15:13:06 error logs logs/013_CRL_file.log 15:13:06 test 014_PSK_secrets ok 15:13:06 test 015_p12_cert ok 15:13:06 test 020_IPv6 skipped 15:13:06 test 021_FIPS skipped 15:13:06 test 030_simple_execute ok 15:13:06 test 031_redirect ok 15:13:06 test 032_no_redirect ok 15:13:06 test 033_redirect_exec ok 15:13:06 test 034_no_redirect_exec ok 15:13:06 test 035_SNI ok 15:13:06 test 036_no_SNI ok 15:13:06 test 037_failover_prio1 failed 15:13:06 error logs logs/037_failover_prio1.log 15:13:06 test 038_failover_prio2 failed 15:13:06 error logs logs/038_failover_prio2.log 15:13:06 test 039_failover_rr ok 15:13:06 test 040_reload ok 15:13:06 test 110_failure_require_cert ok 15:13:06 test 111_failure_verify_peer ok 15:13:06 test 112_failure_verify_chain ok 15:13:06 test 113_failure_CRL_file ok 15:13:06 test 114_failure_PSK_secrets ok 15:13:06 test 120_failure_no_cert ok 15:13:06 test 121_failure_wrong_config ok 15:13:06 summary: success 21, skip 2, fail 3 15:13:06 ./make_test finished 15:13:06 make[2]: Leaving directory `/opt/stunnel/stunnel-5.43/tests' 15:13:06 make[1]: Leaving directory `/opt/stunnel/stunnel-5.43/tests' 15:13:06 STDERR: make[2]: *** [check-local] Error 1 15:13:06 make[1]: *** [check-am] Error 2 15:13:06 make: *** [check-recursive] Error 1 15:13:06 ---- End output of ./configure --with-ssl=/usr/local/openssl-1.1.0g && make && make check && sudo make install ---- 15:13:06 Ran ./configure --with-ssl=/usr/local/openssl-1.1.0g && make && make check && sudo make install returned 2 This was working until the new release (we were on 5.42), is there some change required? Regards, Ian Bamforth Senior Software Engineer Operations & Planning Systems Division W: www.tracsis.com www.tracsisops.com Tracsis plc Leeds Innovation Centre 103 Clarendon Road Leeds LS2 9DF Tracsis Operations and Planning Systems Division is a Division of Tracsis plc and comprises Tracsis plc (05019106), Tracsis Rail Consultancy Limited (05047148), Safety Information Systems Limited trading as COMPASS (02588404) and Tracsis Retail and Operations Limited (04225250), all subsidiaries of Tracsis plc with a registered office at Leeds Innovation Centre,103 Clarendon Road, Leeds, LS2 9DF. VAT Registration No: 945 7876 61. This email and its attachments may be confidential and are intended solely for the use of the individual(s) to whom it is addressed. If you are not the intended recipient of this email and its attachments, you must take no action based upon them, nor must you copy or show them to anyone. Please contact the sender if you believe you have received this email in error. -----Original Message----- From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Michal Trojnara Sent: 05 November 2017 23:03 To: stunnel-users(a)stunnel.org; stunnel-announce(a)stunnel.org; openssl-users(a)openssl.org Subject: [stunnel-users] stunnel 5.43 released Dear Users, I have released version 5.43 of stunnel. Version 5.43, 2017.11.05, urgency: LOW * New features - OpenSSL DLLs updated to version 1.0.2m. - Android build updated to OpenSSL 1.1.0g. - Allow for multiple "accept" ports per section. - Self-test framework (make check). - Added config load before OpenSSL init (thx to Dmitrii Pichulin). - OpenSSL 1.1.0 support for Travis CI. - OpenSSL 1.1.1-dev compilation fixes. * Bugfixes - Fixed a memory fault on Solaris. - Fixed round-robin failover in the FORK threading model. - Fixed handling SSL_ERROR_ZERO_RETURN in SSL_shutdown(). - Minor fixes of the logging subsystem. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 05915babf705a0494886a72a7367913d403d07fc908ebb7b380d639e2d8bcee2 stunnel-5.43.tar.gz 5249479d295f482ecac9cd3d5c89c0e5d41ae6ff8e265d4634ecfd8761834201 stunnel-5.43-win32-installer.exe e628fa7027d19bf4f0a62392f9dc042d97959498c292e13ebdf30c65a545dd6d stunnel-5.43-android.zip Best regards, Mike

1 0

Web browsing over stunnel
by Osvald Brko 02 Nov '17

02 Nov '17

Hello, I try to use stunnel for web browsing (https), and I am not successful. (While mail client against IMAP server works fine). Can anybody give me a hint what to try? The situation: Windows XP SP3, MSIE 8 (or Firefox 43.0.1. for check), stunnel 5.42 stunnel.conf : debug = 7 [https_test] client = yes accept = 127.0.0.1:8888 connect = www.stunnel.org:443 http://127.0.0.1:8888/ -> Error HTTP 404 Not Found 2017.11.02 13:01:50 LOG7[main]: Running on Windows 5.1 2017.11.02 13:01:50 LOG7[main]: No limit detected for the number of clients 2017.11.02 13:01:50 LOG5[main]: stunnel 5.42 on x86-pc-msvc-1500 platform 2017.11.02 13:01:50 LOG5[main]: Compiled/running with OpenSSL 1.0.2l-fips 25 May 2017 2017.11.02 13:01:50 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2017.11.02 13:01:50 LOG7[main]: errno: (*_errno()) 2017.11.02 13:01:50 LOG7[ui]: GUI message loop initialized 2017.11.02 13:01:50 LOG7[main]: Running on Windows 5.1 2017.11.02 13:01:50 LOG5[main]: Reading configuration from file stunnel.conf 2017.11.02 13:01:50 LOG5[main]: UTF-8 byte order mark detected 2017.11.02 13:01:50 LOG5[main]: FIPS mode disabled 2017.11.02 13:01:50 LOG7[main]: Compression disabled 2017.11.02 13:01:50 LOG7[main]: PRNG seeded successfully 2017.11.02 13:01:50 LOG6[main]: Initializing service [XXXXXX-imap] 2017.11.02 13:01:50 LOG7[main]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2017.11.02 13:01:50 LOG7[main]: TLS options: 0x03000004 (+0x03000000, -0x00000000) 2017.11.02 13:01:50 LOG7[main]: No certificate or private key specified 2017.11.02 13:01:50 LOG6[main]: Initializing service [https_test] 2017.11.02 13:01:50 LOG7[main]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2017.11.02 13:01:50 LOG7[main]: TLS options: 0x03000004 (+0x03000000, -0x00000000) 2017.11.02 13:01:50 LOG7[main]: No certificate or private key specified 2017.11.02 13:01:50 LOG4[main]: Service [https_test] needs authentication to prevent MITM attacks 2017.11.02 13:01:50 LOG5[main]: Configuration successful 2017.11.02 13:01:50 LOG7[main]: Listening file descriptor created (FD=236) 2017.11.02 13:01:50 LOG7[main]: Service [XXXXXX-imap] (FD=236) bound to 127.0.0.1:143 2017.11.02 13:01:50 LOG7[main]: Listening file descriptor created (FD=260) 2017.11.02 13:01:50 LOG7[main]: Service [https_test] (FD=260) bound to 127.0.0.1:8888 2017.11.02 13:01:50 LOG7[cron]: Cron thread initialized 2017.11.02 13:02:11 LOG7[main]: Found 1 ready file descriptor(s) 2017.11.02 13:02:11 LOG7[main]: FD=236 ifds=r-x ofds=--- 2017.11.02 13:02:11 LOG7[main]: FD=248 ifds=r-x ofds=--- 2017.11.02 13:02:11 LOG7[main]: Service [https_test] accepted (FD=304) from 127.0.0.1:3424 2017.11.02 13:02:11 LOG7[main]: Creating a new thread 2017.11.02 13:02:11 LOG7[main]: New thread created 2017.11.02 13:02:11 LOG7[0]: Service [https_test] started 2017.11.02 13:02:11 LOG7[0]: Option TCP_NODELAY set on local socket 2017.11.02 13:02:11 LOG5[0]: Service [https_test] accepted connection from 127.0.0.1:3424 2017.11.02 13:02:11 LOG6[0]: s_connect: connecting 207.192.69.165:443 2017.11.02 13:02:11 LOG7[0]: s_connect: s_poll_wait 207.192.69.165:443: waiting 10 seconds 2017.11.02 13:02:11 LOG5[0]: s_connect: connected 207.192.69.165:443 2017.11.02 13:02:11 LOG5[0]: Service [https_test] connected remote server from XX.XXX.XXX.XXX:3425 2017.11.02 13:02:11 LOG7[0]: Option TCP_NODELAY set on remote socket 2017.11.02 13:02:11 LOG7[0]: Remote descriptor (FD=320) initialized 2017.11.02 13:02:11 LOG6[0]: SNI: sending servername: www.stunnel.org 2017.11.02 13:02:11 LOG6[0]: Peer certificate not required 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): before/connect initialization 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv2/v3 write client hello A 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 read server hello A 2017.11.02 13:02:11 LOG6[0]: Certificate verification disabled 2017.11.02 13:02:11 LOG6[0]: Certificate verification disabled 2017.11.02 13:02:11 LOG6[0]: Certificate verification disabled 2017.11.02 13:02:11 LOG6[0]: Certificate verification disabled 2017.11.02 13:02:11 LOG6[0]: Certificate verification disabled 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 read server certificate A 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 read server key exchange A 2017.11.02 13:02:11 LOG6[0]: Client certificate not requested 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 read server done A 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 write client key exchange A 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 write change cipher spec A 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 write finished A 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 flush data 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 read server session ticket A 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 read finished A 2017.11.02 13:02:11 LOG7[0]: 1 client connect(s) requested 2017.11.02 13:02:11 LOG7[0]: 1 client connect(s) succeeded 2017.11.02 13:02:11 LOG7[0]: 0 client renegotiation(s) requested 2017.11.02 13:02:11 LOG7[0]: 0 session reuse(s) 2017.11.02 13:02:11 LOG6[0]: TLS connected: new session negotiated 2017.11.02 13:02:11 LOG7[0]: Peer certificate was cached (7519 bytes) 2017.11.02 13:02:11 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2017.11.02 13:02:11 LOG7[0]: Compression: null, expansion: null 2017.11.02 13:02:16 LOG7[0]: TLS alert (read): warning: close notify 2017.11.02 13:02:16 LOG6[0]: TLS closed (SSL_read) 2017.11.02 13:02:16 LOG7[0]: Sent socket write shutdown 2017.11.02 13:02:21 LOG3[0]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2017.11.02 13:02:21 LOG5[0]: Connection reset: 565 byte(s) sent to TLS, 399 byte(s) sent to socket 2017.11.02 13:02:21 LOG7[0]: Remote descriptor (FD=320) closed 2017.11.02 13:02:21 LOG7[0]: Local descriptor (FD=304) closed 2017.11.02 13:02:21 LOG7[0]: Service [https_test] finished (0 left) 2017.11.02 13:02:50 LOG6[cron]: Executing cron jobs 2017.11.02 13:02:50 LOG6[cron]: Cron jobs completed in 0 seconds 2017.11.02 13:02:50 LOG7[cron]: Waiting 86400 seconds

1 0

Problem: eMail over SMTP on port 587 accepted without error but not forwarded
by Ben Stover 02 Nov '17

02 Nov '17

After a long time of successful usage of stunnel on a Windows 7 system I experienced now permanent problems with sending messages from my local email client over stunnel + SMTP to the remote smtp-server on port 587. Again: my local client+stunnel setup is/was untouched. When I send now messages to remote port 587 (as before) they are silently accepted but NOT forwarded to the final destination. No error messages was returned. The only thing I could imagine is that the webhoster changed the mail server certificate. How does stunnel handle this scenario? Do I have to tell stunnel that the remote certificate changed? how? Receiving eMails through POP3 on port 995 works. WebHoster has no clue what the reason is. The (anonymized) log below shows the transfer Any help is welcomed. Thank you Peter 2017.11.02 13:03:51 LOG7[main]: Found 1 ready file descriptor(s) 2017.11.02 13:03:51 LOG7[main]: FD=388 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=464 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=468 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=472 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=476 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=480 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=484 ifds=r-x ofds=r-- 2017.11.02 13:03:51 LOG7[main]: FD=488 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=492 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=496 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=500 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=504 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=508 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=512 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=516 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=520 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=524 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=528 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: Service [mail-smtp] accepted (FD=904) from 127.0.0.1:47872 2017.11.02 13:03:51 LOG7[main]: Creating a new thread 2017.11.02 13:03:51 LOG7[main]: New thread created 2017.11.02 13:03:51 LOG7[537]: Service [mail-smtp] started 2017.11.02 13:03:51 LOG7[537]: Option TCP_NODELAY set on local socket 2017.11.02 13:03:51 LOG5[537]: Service [mail-smtp] accepted connection from 127.0.0.1:47872 2017.11.02 13:03:51 LOG6[537]: s_connect: connecting 195.54.77.83:587 2017.11.02 13:03:51 LOG7[537]: s_connect: s_poll_wait 195.54.77.83:587: waiting 10 seconds 2017.11.02 13:03:51 LOG5[537]: s_connect: connected 195.54.77.83:587 2017.11.02 13:03:51 LOG5[537]: Service [mail-smtp] connected remote server from 192.168.0.10:47873 2017.11.02 13:03:51 LOG7[537]: Option TCP_NODELAY set on remote socket 2017.11.02 13:03:51 LOG7[537]: Remote descriptor (FD=876) initialized 2017.11.02 13:03:51 LOG7[537]: <- 220 foobar.testserver.com ESMTP Postfix 2017.11.02 13:03:51 LOG7[537]: -> 220 foobar.testserver.com ESMTP Postfix 2017.11.02 13:03:51 LOG7[537]: -> EHLO localhost 2017.11.02 13:03:51 LOG7[537]: <- 250-foobar.testserver.com 2017.11.02 13:03:51 LOG7[537]: <- 250-PIPELINING 2017.11.02 13:03:51 LOG7[537]: <- 250-SIZE 104857600 2017.11.02 13:03:51 LOG7[537]: <- 250-ETRN 2017.11.02 13:03:51 LOG7[537]: <- 250-STARTTLS 2017.11.02 13:03:51 LOG7[537]: <- 250-ENHANCEDSTATUSCODES 2017.11.02 13:03:51 LOG7[537]: <- 250-8BITMIME 2017.11.02 13:03:51 LOG7[537]: <- 250 DSN 2017.11.02 13:03:51 LOG7[537]: -> STARTTLS 2017.11.02 13:03:51 LOG7[537]: <- 220 2.0.0 Ready to start TLS 2017.11.02 13:03:51 LOG6[537]: SNI: sending servername: foobar.testserver.com 2017.11.02 13:03:51 LOG6[537]: Peer certificate not required 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): before/connect initialization 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 write client hello A 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 read server hello A 2017.11.02 13:03:51 LOG6[537]: Certificate verification disabled 2017.11.02 13:03:51 LOG6[537]: Certificate verification disabled 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 read server certificate A 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 read server key exchange A 2017.11.02 13:03:51 LOG6[537]: Client certificate not requested 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 read server done A 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 write client key exchange A 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 write change cipher spec A 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 write finished A 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 flush data 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 read server session ticket A 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 read finished A 2017.11.02 13:03:51 LOG7[537]: 2 client connect(s) requested 2017.11.02 13:03:51 LOG7[537]: 2 client connect(s) succeeded 2017.11.02 13:03:51 LOG7[537]: 0 client renegotiation(s) requested 2017.11.02 13:03:51 LOG7[537]: 0 session reuse(s) 2017.11.02 13:03:51 LOG6[537]: TLS connected: new session negotiated 2017.11.02 13:03:51 LOG7[537]: Deallocating application specific data for session connect address 2017.11.02 13:03:51 LOG6[537]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2017.11.02 13:03:51 LOG7[537]: Compression: null, expansion: null 2017.11.02 13:03:52 LOG6[537]: Read socket closed (readsocket) 2017.11.02 13:03:52 LOG7[537]: Sending close_notify alert 2017.11.02 13:03:52 LOG7[537]: TLS alert (write): warning: close notify 2017.11.02 13:03:52 LOG6[537]: SSL_shutdown successfully sent close_notify alert 2017.11.02 13:03:52 LOG7[537]: TLS alert (read): warning: close notify 2017.11.02 13:03:52 LOG6[537]: TLS closed (SSL_read) 2017.11.02 13:03:52 LOG7[537]: Sent socket write shutdown 2017.11.02 13:03:52 LOG5[537]: Connection closed: 2954 byte(s) sent to TLS, 337 byte(s) sent to socket 2017.11.02 13:03:52 LOG7[537]: Remote descriptor (FD=876) closed 2017.11.02 13:03:52 LOG7[537]: Local descriptor (FD=904) closed 2017.11.02 13:03:52 LOG7[537]: Service [mailo-smtp] finished (0 left)

1 0

Re: [stunnel-users] How to distinguish stunnel definition between SMTP through SSL-TLS vs. STARTTLS?
by Harris, Douglas (SSC/SPC) 26 Oct '17

26 Oct '17

> Ok, if I specify > > protocol=smtp > > what does that mean: "Connect through SSL-TLS protocol" or "connect through STARTTLS protocol"? That means connect using STARTTLS. > It seems to me that I ALWAYS have to specify "protocol=smtp" for ALL smtp-server connects. You don't. If you are not using STARTTLS you don't specify "protocol=". > Is this done only by port number 465 vs 587? No. > That would mean there is a hidden configuration by convention! Indeed. That would be bad. > What if the webhoster would set up a special mail server at port 8888? Then you would specify port 8888 in your "connect=" config

1 0

How to distinguish stunnel definition between SMTP through SSL-TLS vs. STARTTLS?
by Ben Stover 26 Oct '17

26 Oct '17

As yyou know there are two types of letting a local email client connect to remote secured SMTP server: 1.) through SSL-TLS and 2.) through STARTTLS How do I distinguish betwen these connection types in the stunnel.conf setup file? In a previous post I was told to look at the "protocol" parameter. Ok, if I specify protocol=smtp what does that mean: "Connect through SSL-TLS protocol" or "connect through STARTTLS protocol"? It seems to me that I ALWAYS have to specify "protocol=smtp" for ALL smtp-server connects. The stunnel documentation does not explain how to setup the *.conf file for each of the variants. Is this done only by port number 465 vs 587? That would mean there is a hidden configuration by convention! What if the webhoster would set up a special mail server at port 8888? Ben

1 0

stunnel and TLS1.2 for IE
by Thomas GMX 20 Oct '17

20 Oct '17

Hello. I have successfully configured my email client (Outlook 2010) to my provider with TLS1.2 via stunnel running as a service. config: debug = 5 engine = capi [freenet-pop3s] client = yes EngineID = capi accept = localhost:2110 connect = mx.freenet.de:995 [freenet-smpts] client = yes EngineID = capi accept = localhost:2025 connect = mx.freenet.de:465 That was no problem. But at this point I am wondering if it is possible and how I can configure stunnel so that "all" https traffic from Internet Explorer is going through stunnel and connect to internet with highest secure level supported. Not only to one specific server (connect = xyz.net) but to all servers given in IE address. By now I guess that I have to set IE so that it uses a https-proxy at "localhost:xxx" with stunnel config "accept = localhost:xxx". But how is stunnel config for "connect x.x.x.x:443" that it connect to the right server in internet I specified in IE address line? Can someone give me a hint? Or impossible? Thanks a lot Thomas

2 1

Connection setup for STARTTLS vs. SSL/TLS for POP3/SMTP mail servers?
by Ben Stover 20 Oct '17

20 Oct '17

In stunnels *.conf file I can specify the mail server name and the port for a connection. How can I tell stunnel to use STARTTLS as connect type? How can I tell stunnel to use SSL/TLS as connect type? Does stunnel support both connect types at all or only one? Is the connect type for SMTP completely determined by port e.g.: STARTTLS over port 587 and SSL/TLS over port 465 or can both connect types use both ports? Assume I do not get the supported connect type information from my webhoster: How can I find it out from my (client) side? What are there error messages? Ben

2 1

Stunnel on Android 7.x not working?
by John Appleseed 14 Oct '17

14 Oct '17

Hello, I have trouble with stunnel on Android 7.x.. I'm trying to connect to OpenVPN server through SSL tunneling with stunnel. On phone I'm using stunnel installed in Termux and OpenVPN. Everything is correctly configured, Im using the same config on other devices in same network and it works perfectly. I tried it with different devices with Android 7.x and it is not working at all :( Immediately after succesful connection I am receiving: TLS fd: Software caused connection abort (103) TLS socket closed (SSL_read) And it is still reconnecting again and again with the same error. I also tried it with stunnel downloaded directly from stunnel.org site.. Anyone with new Android who have working stunnel? Where can be the problem? Example stunnel.conf on Android: socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = debug [openvpn] client = yes accept = 1337 connect = *****.ddns.net:993 cert = /path/to/stunnel.pem and on server: chroot = /var/lib/stunnel4 pid = /stunnel.pid output = /stunnel.log setuid = stunnel4 setgid = stunnel4 socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [openvpn] client = no accept = 993 connect = 127.0.0.1:1194 cert = /etc/stunnel/stunnel.pem Example stunnel.log is in attachment. Thank you very much

1 0