- stunnel-users - stunnel.org

Use SNI
by Benjamin Hartwich 31 Oct '16

31 Oct '16

Hi, I´ve found the SNI parameter at stunnel, but it doesn´t work at my Ubuntu 16.04. My goal is, to use one dfn cert for the stunnel cert, which has 4 hostnames. This cert is on both servers. At the client server this cert works, because at the cert this is first hostname. At the second server I use the same cert, but it can´t be verified, because stunnel doesn´t recognize the correct hostname from the cert. Can anyone send me an example for a working SNI configuration? My Configs: Server one: client = yes cert = /etc/stunnel/cert.pem service = test debug = debug output = /var/log/stunnel4/stunnel.log foreground = no sslVersion = TLSv1 options = NO_SSLv3 options = NO_SSLv2 CAfile = /etc/ssl/web/chain.pem verify = 2 socket = r:TCP_NODELAY=1 [app1] accept = localhost:8090 connect = 10.1.2.1:8085´ ----- Server 2 (fails): client = no cert = /etc/stunnel/cert.pem service = test debug = debug output = /var/log/stunnel4/stunnel.log sslVersion = TLSv1 options = NO_SSLv3 options = NO_SSLv2 foreground = no CAfile = /etc/ssl/web/chain.pem verify = 2 socket = l:TCP_NODELAY=1 [ajp] accept = 8085 connect = 127.0.0.1:8009 --- Error: 2016.10.31 15:01:40 LOG7[9]: SNI: no virtual services defined 2016.10.31 15:01:40 LOG4[9]: CERT: Pre-verification error: unsupported certificate purpose Regards, Benjamin Hartwich Referat Basisdienste Zentrum für Informationstechnologie und Medienmanagement Universität Passau Innstr. 33, 94032 Passau Telefon +49 (0)851/509-3285, Telefax +49 (0)851/509-1802 E-Mail: benjamin.hartwich(a)uni-passau.de

1 0

Running Stunnel 5.23 as multiple windows services
by David Jones 25 Oct '16

25 Oct '16

Hi, I'm trying to run stunnel as a windows service. I have used the stunnel -install and one service has successfully been setup. We now have a need to run a second instance of stunnel and so that we are able to stop/start this instance and not affect the connectivity of the other one we would like to install it as a separate service. On an older version of stunnel we simply named the stunnel.exe differently and it ran both services separately. But with 5.23 it is not allowing us to do so. Coming up the error "CreateService: error 1073: The specified service already exists". I've tried adding service = into the .conf file and also using service= on the command line for the install but nothing works. So what have I missed? Thanks David Config: Service = Stunnel_TLS_Generic CApath = ./ debug=7 #debug = 1 output = TLS_Generic.log # Use it for client mode client = yes # Service-level configuration [Service_Name] options = NO_SSLv2 options = NO_SSLv3 sslVersion = TLSv1 accept = 20002 connect = URLtoserver:443

1 0

Re: [stunnel-users] JHH re: Server down? [GishPuppy]
by gmane.bl4＠gishpuppy.com 20 Oct '16

20 Oct '16

John H Hoffmann wrote: > upgraded to latest sTunnel v 5.36. > > In restarting sTunnel I immediately got a > 'server down' error > > [ ] Service [pop3s] (FD=432) bound to 0.0.0.0:995 > > > [!] bind: Permission denied (WSAEACCES) (10013) > > [!] Error binding service [comcast-pop3] to 127.0.0.1:995 > You probably have in the stunnel.conf something similar to: [pop3s] accept=995 {...} [comcast-pop3] accept=127.0.0.1:995 {...} accept=995 == 0.0.0.0:995 == (all localhost IPv4 addresses):995 Which includes 127.0.0.1:995 When the [comcast-pop3] service tries to bind to port 995 it fails because it is already bound at the [pop3s] service. Gishpuppy | To change the delivery settings for this email, click here: http://www.gishpuppy.com/cgi-bin/edit.py?email=gmane.bl4@gishpuppy.com

2 1

JHH re: Server down?
by John H Hoffmann | 847.998.6198 18 Oct '16

18 Oct '16

Hi .. I have been having spotty access to my main ISP email account the last two days so I upgraded to latest sTunnel v 5.36. I use sTunnel to help get emails from my ISP, Comcast, to load into an older version of GoldMine CRM. sTunnel has worked like a charm since 09/2013. In restarting sTunnel I immediately got a 'server down' error, log included below. Ideas? Suggestions? [ ] Cron thread initialized [ ] Running on Windows 6.1 [ ] No limit detected for the number of clients [.] stunnel 5.36 on x86-pc-msvc-1500 platform [.] Compiled/running with OpenSSL 1.0.2i-fips 22 Sep 2016 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] GUI message loop initialized [ ] Running on Windows 6.1 [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark not detected [.] FIPS mode disabled [ ] Compression disabled [ ] Snagged 64 random bytes from C:/.rnd [ ] Wrote 1024 new random bytes to C:/.rnd [ ] PRNG seeded successfully [ ] Initializing service [pop3s] [ ] Loading certificate from file: stunnel.pem [ ] Certificate loaded from file: stunnel.pem [ ] Loading private key from file: stunnel.pem [ ] Private key loaded from file: stunnel.pem [ ] Private key check succeeded [ ] DH initialization [ ] Could not load DH parameters from stunnel.pem [ ] Using dynamic DH parameters [ ] ECDH initialization [ ] ECDH initialized with curve prime256v1 [ ] SSL options: 0x03004004 (+0x03004000, -0x00000000) [ ] Initializing service [imaps] [ ] Loading certificate from file: stunnel.pem [ ] Certificate loaded from file: stunnel.pem [ ] Loading private key from file: stunnel.pem [ ] Private key loaded from file: stunnel.pem [ ] Private key check succeeded [ ] DH initialization [ ] Could not load DH parameters from stunnel.pem [ ] Using dynamic DH parameters [ ] ECDH initialization [ ] ECDH initialized with curve prime256v1 [ ] SSL options: 0x03004004 (+0x03004000, -0x00000000) [ ] Initializing service [ssmtp] [ ] Loading certificate from file: stunnel.pem [ ] Certificate loaded from file: stunnel.pem [ ] Loading private key from file: stunnel.pem [ ] Private key loaded from file: stunnel.pem [ ] Private key check succeeded [ ] DH initialization [ ] Could not load DH parameters from stunnel.pem [ ] Using dynamic DH parameters [ ] ECDH initialization [ ] ECDH initialized with curve prime256v1 [ ] SSL options: 0x03004004 (+0x03004000, -0x00000000) [ ] Initializing service [comcast-pop3] [ ] Loading certificate from file: stunnel.pem [ ] Certificate loaded from file: stunnel.pem [ ] Loading private key from file: stunnel.pem [ ] Private key loaded from file: stunnel.pem [ ] Private key check succeeded [:] Service [comcast-pop3] needs authentication to prevent MITM attacks [ ] SSL options: 0x03000004 (+0x03000000, -0x00000000) [ ] Initializing service [comcast-smtp] [ ] Loading certificate from file: stunnel.pem [ ] Certificate loaded from file: stunnel.pem [ ] Loading private key from file: stunnel.pem [ ] Private key loaded from file: stunnel.pem [ ] Private key check succeeded [:] Service [comcast-smtp] needs authentication to prevent MITM attacks [ ] SSL options: 0x03000004 (+0x03000000, -0x00000000) [.] Configuration successful [ ] Listening file descriptor created (FD=432) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [ ] Service [pop3s] (FD=432) bound to 0.0.0.0:995 [ ] Listening file descriptor created (FD=436) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [ ] Service [imaps] (FD=436) bound to 0.0.0.0:993 [ ] Listening file descriptor created (FD=440) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [ ] Service [ssmtp] (FD=440) bound to 0.0.0.0:465 [ ] Listening file descriptor created (FD=444) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [!] bind: Permission denied (WSAEACCES) (10013) [!] Error binding service [comcast-pop3] to 127.0.0.1:995 [ ] Closing service [pop3s] [ ] Service [pop3s] closed (FD=432) [ ] Service [pop3s] closed [ ] Closing service [imaps] [ ] Service [imaps] closed (FD=436) [ ] Service [imaps] closed [ ] Closing service [ssmtp] [ ] Service [ssmtp] closed (FD=440) [ ] Service [ssmtp] closed [ ] Closing service [comcast-pop3] [ ] Service [comcast-pop3] closed [ ] Closing service [comcast-smtp] [ ] Service [comcast-smtp] closed [!] Server is down Respectfully, John John H Hoffmann

2 1

Stunnel stops on Windows Server 2012
by Sam Ash 03 Oct '16

03 Oct '16

I've upgraded Stunnel from 5.35 to 5.36 on a server running windows server 2012. Since the upgrade it appears to stop running once i log out. I installed it as a service and set the service start to automatic. It has no problems running when someone is logged into the server. I'm not sure what i changed when i updated the version. Thanks

1 0

No cert?
by Dave Gradwell 27 Sep '16

27 Sep '16

Is there any way to configure a Stunnel server so that it doesn’t require a cert at all? I implement peer authentication using other means; I just want session encryption from Stunnel. Ideally, I’d like keys to be generated on-the-fly for each new connection. I don’t mind if this takes a few seconds… Thanks, Dave.

1 0

Re: [stunnel-users] Hangs when connecting -- advice pls
by Scott McKeown 21 Sep '16

21 Sep '16

Hi Guys, To me this looks like a cipher issue. There are a few options that you can try to resolve this if it is. I would try adding the following lines into your STunnel Configuration file: delay = yes options = NO_SSLv2 options = NO_SSLv3 options = NO_TLSv1 options = CIPHER_SERVER_PREFERENCE options = DONT_INSERT_EMPTY_FRAGMENTS Delay will delay and DNS lookups that maybe actioned by the request (not normally needed but I always include if for sanity sake) The three 'options' sections turn off all the known problematic cipher lists if you need a key that is in one of these block feel free to remove that directive but I think a good start would be to leave the 'NO_SSLv3' option in place The 'CIPHER_SERVER_PREFERENCE' option will make set whether the client is allowed to renegotiat the ciphers that are to be used between the client and the server process. And finally 'DONT_INSERT_EMPTY_FRAGMENTS' will mitigate an issue in the CBC ciphers that was in the SSLv3 and TLS1.0 cipher lists again I only include it for sanity sake now but its better to have than to go without. -- With Kind Regards. Scott McKeown Loadbalancer.org http://www.loadbalancer.org Tel (UK) - +44 (0) 3303801064 (24x7) Tel (US) - +1 888.867.9504 (Toll Free)(24x7)

2 1

Re: [stunnel-users] stunnel-users Digest, Vol 146, Issue 10
by Hon Quach 16 Sep '16

16 Sep '16

Can I be please removed from the mailing list? Sent from my iPhone > On Sep 16, 2016, at 12:14 PM, stunnel-users-request(a)stunnel.org wrote: > > Send stunnel-users mailing list submissions to > stunnel-users(a)stunnel.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)stunnel.org > > You can reach the person managing the list at > stunnel-users-owner(a)stunnel.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. Re: compilation error with stunnel-5.35 (Josealf.rm) > 2. Re: compilation error with stunnel-5.35 (Viorel Panaite) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 16 Sep 2016 13:04:09 -0500 > From: "Josealf.rm" <josealf(a)rocketmail.com> > To: Viorel Panaite <Viorel.Panaite(a)tecsys.com> > Cc: "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> > Subject: Re: [stunnel-users] compilation error with stunnel-5.35 > Message-ID: <6CE9A3F0-EE74-4CF0-ACCE-C5941B6B40A2(a)rocketmail.com> > Content-Type: text/plain; charset="utf-8" > > > Visorel, > > Did you compile OpenSSL yourself? Did you enable shared library support? > Maybe you system is picking system installed OpenSSL headers (0.9.8) instead of the new ones. > > Regards > Jose > > > Enviado desde mi iPhone >> El 16/09/2016, a las 9:39 a.m., Viorel Panaite <Viorel.Panaite(a)tecsys.com> escribió: >> >> I downloaded stunnel-5.35 and I’m trying to compile using openssl-1.0.2h on RedHat EL linux 5.4 >> >> I get this error when I’m trying to compile them together, >> >> Configure log >> ./configure --prefix=/apps/stunnel/535 --with-ssl=/apps/openssl/1.0.2h/ >> ……………………. >> hecking for broken poll() implementation... no >> checking for pipe2... no >> checking for accept4... no >> configure: **************************************** optional features >> checking whether to enable IPv6 support... yes (default) >> checking whether to enable FIPS support... autodetecting >> checking whether to enable systemd socket activation support... autodetecting >> checking for library containing sd_listen_fds... no >> configure: systemd library not found >> checking whether to enable TCP wrappers support... autodetecting >> checking for hosts_access in -lwrap... yes >> configure: libwrap support enabled >> configure: **************************************** SSL >> checking for compiler sysroot... / >> checking for SSL directory... /apps/openssl/1.0.2h/ >> checking for FIPS_mode_set... yes >> configure: FIPS support enabled >> configure: **************************************** write the results >> checking that generated files are newer than configure... done >> configure: creating ./config.status >> config.status: creating Makefile >> config.status: creating src/Makefile >> config.status: creating doc/Makefile >> config.status: creating tools/Makefile >> config.status: creating src/config.h >> config.status: src/config.h is unchanged >> config.status: executing depfiles commands >> config.status: executing libtool commands >> configure: **************************************** success >> >> make log >> >> [root@mybox stunnel-5.35]# make >> Making all in src >> make[1]: Entering directory `/apps/stunnel/stunnel-5.35/src' >> make all-am >> make[2]: Entering directory `/apps/stunnel/stunnel-5.35/src' >> CCLD stunnel >> /usr/bin/ld: skipping incompatible /apps/openssl/1.0.2h//lib/libssl.a when searching for -lssl >> /usr/bin/ld: skipping incompatible /apps/openssl/1.0.2h//lib/libcrypto.a when searching for -lcrypto >> stunnel-client.o: In function `client_run': >> /apps/stunnel/stunnel-5.35/src/client.c:201: undefined reference to `ERR_remove_thread_state' >> stunnel-options.o: In function `parse_service_option': >> /apps/stunnel/stunnel-5.35/src/options.c:2669: undefined reference to `TLSv1_2_client_method' >> /apps/stunnel/stunnel-5.35/src/options.c:2670: undefined reference to `TLSv1_2_server_method' >> /apps/stunnel/stunnel-5.35/src/options.c:2662: undefined reference to `TLSv1_1_client_method' >> /apps/stunnel/stunnel-5.35/src/options.c:2663: undefined reference to `TLSv1_1_server_method' >> stunnel-ctx.o: In function `auth_init': >> /apps/stunnel/stunnel-5.35/src/ctx.c:442: undefined reference to `SSL_CTX_set_psk_server_callback' >> stunnel-ctx.o: In function `context_init': >> /apps/stunnel/stunnel-5.35/src/ctx.c:133: undefined reference to `SSL_CTX_set_client_cert_engine' >> stunnel-ctx.o: In function `auth_init': >> /apps/stunnel/stunnel-5.35/src/ctx.c:440: undefined reference to `SSL_CTX_set_psk_client_callback' >> stunnel-ctx.o: In function `conf_init': >> /apps/stunnel/stunnel-5.35/src/ctx.c:376: undefined reference to `SSL_CONF_CTX_new' >> /apps/stunnel/stunnel-5.35/src/ctx.c:381: undefined reference to `SSL_CONF_CTX_set_ssl_ctx' >> /apps/stunnel/stunnel-5.35/src/ctx.c:382: undefined reference to `SSL_CONF_CTX_set_flags' >> /apps/stunnel/stunnel-5.35/src/ctx.c:383: undefined reference to `SSL_CONF_CTX_set_flags' >> /apps/stunnel/stunnel-5.35/src/ctx.c:385: undefined reference to `SSL_CONF_CTX_set_flags' >> /apps/stunnel/stunnel-5.35/src/ctx.c:392: undefined reference to `SSL_CONF_cmd' >> /apps/stunnel/stunnel-5.35/src/ctx.c:420: undefined reference to `SSL_CONF_CTX_finish' >> /apps/stunnel/stunnel-5.35/src/ctx.c:422: undefined reference to `SSL_CONF_CTX_free' >> stunnel-ctx.o: In function `ecdh_init': >> /apps/stunnel/stunnel-5.35/src/ctx.c:351: undefined reference to `EC_KEY_new_by_curve_name' >> /apps/stunnel/stunnel-5.35/src/ctx.c:359: undefined reference to `EC_KEY_free' >> stunnel-ctx.o: In function `conf_init': >> /apps/stunnel/stunnel-5.35/src/ctx.c:414: undefined reference to `SSL_CONF_CTX_free' >> /apps/stunnel/stunnel-5.35/src/ctx.c:409: undefined reference to `SSL_CONF_CTX_free' >> /apps/stunnel/stunnel-5.35/src/ctx.c:425: undefined reference to `SSL_CONF_CTX_free' >> stunnel-ctx.o: In function `servername_cb': >> /apps/stunnel/stunnel-5.35/src/ctx.c:229: undefined reference to `SSL_get_servername' >> /apps/stunnel/stunnel-5.35/src/ctx.c:253: undefined reference to `SSL_set_SSL_CTX' >> stunnel-verify.o: In function `ocsp_request': >> /apps/stunnel/stunnel-5.35/src/verify.c:499: undefined reference to `OCSP_CERTID_dup' >> stunnel-verify.o: In function `ocsp_get_response': >> /apps/stunnel/stunnel-5.35/src/verify.c:614: undefined reference to `OCSP_sendreq_new' >> /apps/stunnel/stunnel-5.35/src/verify.c:625: undefined reference to `OCSP_REQ_CTX_add1_header' >> /apps/stunnel/stunnel-5.35/src/verify.c:629: undefined reference to `OCSP_REQ_CTX_add1_header' >> /apps/stunnel/stunnel-5.35/src/verify.c:634: undefined reference to `OCSP_REQ_CTX_set1_req' >> /apps/stunnel/stunnel-5.35/src/verify.c:641: undefined reference to `OCSP_sendreq_nbio' >> /apps/stunnel/stunnel-5.35/src/verify.c:668: undefined reference to `OCSP_REQ_CTX_free' >> stunnel-verify.o: In function `cert_check_subject': >> /apps/stunnel/stunnel-5.35/src/verify.c:299: undefined reference to `X509_check_host' >> stunnel-verify.o: In function `ocsp_check': >> /apps/stunnel/stunnel-5.35/src/verify.c:457: undefined reference to `X509_get1_ocsp' >> stunnel-verify.o: In function `cert_check_subject': >> /apps/stunnel/stunnel-5.35/src/verify.c:312: undefined reference to `X509_check_email' >> /apps/stunnel/stunnel-5.35/src/verify.c:323: undefined reference to `X509_check_ip_asc' >> stunnel-verify.o: In function `cert_check_local': >> /apps/stunnel/stunnel-5.35/src/verify.c:356: undefined reference to `X509_STORE_get1_certs' >> stunnel-sthreads.o: In function `sthreads_init': >> /apps/stunnel/stunnel-5.35/src/sthreads.c:287: undefined reference to `CRYPTO_THREADID_set_callback' >> stunnel-sthreads.o: In function `threadid_func': >> /apps/stunnel/stunnel-5.35/src/sthreads.c:268: undefined reference to `CRYPTO_THREADID_set_numeric' >> collect2: ld returned 1 exit status >> make[2]: *** [stunnel] Error 1 >> make[2]: Leaving directory `/apps/stunnel/stunnel-5.35/src' >> make[1]: *** [all] Error 2 >> make[1]: Leaving directory `/apps/stunnel/stunnel-5.35/src' >> make: *** [all-recursive] Error 1 >> >> Thanks for your help. >> >> >> _______________________________________________ >> stunnel-users mailing list >> stunnel-users(a)stunnel.org >> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >

2 1

compilation error with stunnel-5.35
by Viorel Panaite 16 Sep '16

16 Sep '16

I downloaded stunnel-5.35 and I'm trying to compile using openssl-1.0.2h on RedHat EL linux 5.4 I get this error when I'm trying to compile them together, Configure log ./configure --prefix=/apps/stunnel/535 --with-ssl=/apps/openssl/1.0.2h/ ......................... hecking for broken poll() implementation... no checking for pipe2... no checking for accept4... no configure: **************************************** optional features checking whether to enable IPv6 support... yes (default) checking whether to enable FIPS support... autodetecting checking whether to enable systemd socket activation support... autodetecting checking for library containing sd_listen_fds... no configure: systemd library not found checking whether to enable TCP wrappers support... autodetecting checking for hosts_access in -lwrap... yes configure: libwrap support enabled configure: **************************************** SSL checking for compiler sysroot... / checking for SSL directory... /apps/openssl/1.0.2h/ checking for FIPS_mode_set... yes configure: FIPS support enabled configure: **************************************** write the results checking that generated files are newer than configure... done configure: creating ./config.status config.status: creating Makefile config.status: creating src/Makefile config.status: creating doc/Makefile config.status: creating tools/Makefile config.status: creating src/config.h config.status: src/config.h is unchanged config.status: executing depfiles commands config.status: executing libtool commands configure: **************************************** success make log [root@mybox stunnel-5.35]# make Making all in src make[1]: Entering directory `/apps/stunnel/stunnel-5.35/src' make all-am make[2]: Entering directory `/apps/stunnel/stunnel-5.35/src' CCLD stunnel /usr/bin/ld: skipping incompatible /apps/openssl/1.0.2h//lib/libssl.a when searching for -lssl /usr/bin/ld: skipping incompatible /apps/openssl/1.0.2h//lib/libcrypto.a when searching for -lcrypto stunnel-client.o: In function `client_run': /apps/stunnel/stunnel-5.35/src/client.c:201: undefined reference to `ERR_remove_thread_state' stunnel-options.o: In function `parse_service_option': /apps/stunnel/stunnel-5.35/src/options.c:2669: undefined reference to `TLSv1_2_client_method' /apps/stunnel/stunnel-5.35/src/options.c:2670: undefined reference to `TLSv1_2_server_method' /apps/stunnel/stunnel-5.35/src/options.c:2662: undefined reference to `TLSv1_1_client_method' /apps/stunnel/stunnel-5.35/src/options.c:2663: undefined reference to `TLSv1_1_server_method' stunnel-ctx.o: In function `auth_init': /apps/stunnel/stunnel-5.35/src/ctx.c:442: undefined reference to `SSL_CTX_set_psk_server_callback' stunnel-ctx.o: In function `context_init': /apps/stunnel/stunnel-5.35/src/ctx.c:133: undefined reference to `SSL_CTX_set_client_cert_engine' stunnel-ctx.o: In function `auth_init': /apps/stunnel/stunnel-5.35/src/ctx.c:440: undefined reference to `SSL_CTX_set_psk_client_callback' stunnel-ctx.o: In function `conf_init': /apps/stunnel/stunnel-5.35/src/ctx.c:376: undefined reference to `SSL_CONF_CTX_new' /apps/stunnel/stunnel-5.35/src/ctx.c:381: undefined reference to `SSL_CONF_CTX_set_ssl_ctx' /apps/stunnel/stunnel-5.35/src/ctx.c:382: undefined reference to `SSL_CONF_CTX_set_flags' /apps/stunnel/stunnel-5.35/src/ctx.c:383: undefined reference to `SSL_CONF_CTX_set_flags' /apps/stunnel/stunnel-5.35/src/ctx.c:385: undefined reference to `SSL_CONF_CTX_set_flags' /apps/stunnel/stunnel-5.35/src/ctx.c:392: undefined reference to `SSL_CONF_cmd' /apps/stunnel/stunnel-5.35/src/ctx.c:420: undefined reference to `SSL_CONF_CTX_finish' /apps/stunnel/stunnel-5.35/src/ctx.c:422: undefined reference to `SSL_CONF_CTX_free' stunnel-ctx.o: In function `ecdh_init': /apps/stunnel/stunnel-5.35/src/ctx.c:351: undefined reference to `EC_KEY_new_by_curve_name' /apps/stunnel/stunnel-5.35/src/ctx.c:359: undefined reference to `EC_KEY_free' stunnel-ctx.o: In function `conf_init': /apps/stunnel/stunnel-5.35/src/ctx.c:414: undefined reference to `SSL_CONF_CTX_free' /apps/stunnel/stunnel-5.35/src/ctx.c:409: undefined reference to `SSL_CONF_CTX_free' /apps/stunnel/stunnel-5.35/src/ctx.c:425: undefined reference to `SSL_CONF_CTX_free' stunnel-ctx.o: In function `servername_cb': /apps/stunnel/stunnel-5.35/src/ctx.c:229: undefined reference to `SSL_get_servername' /apps/stunnel/stunnel-5.35/src/ctx.c:253: undefined reference to `SSL_set_SSL_CTX' stunnel-verify.o: In function `ocsp_request': /apps/stunnel/stunnel-5.35/src/verify.c:499: undefined reference to `OCSP_CERTID_dup' stunnel-verify.o: In function `ocsp_get_response': /apps/stunnel/stunnel-5.35/src/verify.c:614: undefined reference to `OCSP_sendreq_new' /apps/stunnel/stunnel-5.35/src/verify.c:625: undefined reference to `OCSP_REQ_CTX_add1_header' /apps/stunnel/stunnel-5.35/src/verify.c:629: undefined reference to `OCSP_REQ_CTX_add1_header' /apps/stunnel/stunnel-5.35/src/verify.c:634: undefined reference to `OCSP_REQ_CTX_set1_req' /apps/stunnel/stunnel-5.35/src/verify.c:641: undefined reference to `OCSP_sendreq_nbio' /apps/stunnel/stunnel-5.35/src/verify.c:668: undefined reference to `OCSP_REQ_CTX_free' stunnel-verify.o: In function `cert_check_subject': /apps/stunnel/stunnel-5.35/src/verify.c:299: undefined reference to `X509_check_host' stunnel-verify.o: In function `ocsp_check': /apps/stunnel/stunnel-5.35/src/verify.c:457: undefined reference to `X509_get1_ocsp' stunnel-verify.o: In function `cert_check_subject': /apps/stunnel/stunnel-5.35/src/verify.c:312: undefined reference to `X509_check_email' /apps/stunnel/stunnel-5.35/src/verify.c:323: undefined reference to `X509_check_ip_asc' stunnel-verify.o: In function `cert_check_local': /apps/stunnel/stunnel-5.35/src/verify.c:356: undefined reference to `X509_STORE_get1_certs' stunnel-sthreads.o: In function `sthreads_init': /apps/stunnel/stunnel-5.35/src/sthreads.c:287: undefined reference to `CRYPTO_THREADID_set_callback' stunnel-sthreads.o: In function `threadid_func': /apps/stunnel/stunnel-5.35/src/sthreads.c:268: undefined reference to `CRYPTO_THREADID_set_numeric' collect2: ld returned 1 exit status make[2]: *** [stunnel] Error 1 make[2]: Leaving directory `/apps/stunnel/stunnel-5.35/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/apps/stunnel/stunnel-5.35/src' make: *** [all-recursive] Error 1 Thanks for your help.

2 2

Hangs when connecting -- advice pls
by Dave Gradwell 14 Sep '16

14 Sep '16

My Stunnel client gets to this point, then hangs indefinitely: SSL state (connect): SSLv2/v3 write client hello A Is this a fault with Stunnel or is it something I’m doing wrong Full client-side output: """"""""""""""""""" Last login: Wed Sep 14 06:50:40 on ttys004 Daves-MBP-2016:~ dave$ /Users/dave/Desktop/stunnel-test/stunnel /Users/dave/Desktop/stunnel-test/stunnel-sender.conf 2016.09.14 06:54:35 LOG7[ui]: Clients allowed=125 2016.09.14 06:54:35 LOG7[cron]: Cron thread initialized 2016.09.14 06:54:35 LOG5[ui]: stunnel 5.35 on x86_64-apple-darwin15.4.0 platform 2016.09.14 06:54:35 LOG5[ui]: Compiled with OpenSSL 0.9.8zd 8 Jan 2015 2016.09.14 06:54:35 LOG5[ui]: Running with OpenSSL 0.9.8zh 14 Jan 2016 2016.09.14 06:54:35 LOG5[ui]: Update OpenSSL shared libraries or rebuild stunnel 2016.09.14 06:54:35 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,SNI 2016.09.14 06:54:35 LOG7[ui]: errno: (*__error()) 2016.09.14 06:54:35 LOG5[ui]: Reading configuration from file /Users/dave/Desktop/stunnel-test/stunnel-sender.conf 2016.09.14 06:54:35 LOG5[ui]: UTF-8 byte order mark not detected 2016.09.14 06:54:35 LOG7[ui]: Compression disabled 2016.09.14 06:54:35 LOG7[ui]: Snagged 64 random bytes from /Users/dave/.rnd 2016.09.14 06:54:35 LOG7[ui]: Wrote 1024 new random bytes to /Users/dave/.rnd 2016.09.14 06:54:35 LOG7[ui]: PRNG seeded successfully 2016.09.14 06:54:35 LOG6[ui]: Initializing inetd mode configuration 2016.09.14 06:54:35 LOG6[ui]: Loading certificate from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG6[ui]: Certificate loaded from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG6[ui]: Loading private key from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG4[ui]: Insecure file permissions on /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG6[ui]: Private key loaded from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG7[ui]: Private key check succeeded 2016.09.14 06:54:35 LOG4[ui]: Service [stunnel] needs authentication to prevent MITM attacks 2016.09.14 06:54:35 LOG7[ui]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2016.09.14 06:54:35 LOG5[ui]: Configuration successful 2016.09.14 06:54:35 LOG7[ui]: Service [stunnel] started 2016.09.14 06:54:35 LOG5[ui]: Service [stunnel] accepted connection 2016.09.14 06:54:35 LOG6[ui]: failover: round-robin, starting at entry #0 2016.09.14 06:54:35 LOG6[ui]: s_connect: connecting ::1:874 2016.09.14 06:54:35 LOG7[ui]: s_connect: s_poll_wait ::1:874: waiting 10 seconds 2016.09.14 06:54:35 LOG5[ui]: s_connect: connected ::1:874 2016.09.14 06:54:35 LOG5[ui]: Service [stunnel] connected remote server from ::1:51362 2016.09.14 06:54:35 LOG7[ui]: Option TCP_NODELAY set on remote socket 2016.09.14 06:54:35 LOG7[ui]: Remote descriptor (FD=3) initialized 2016.09.14 06:54:35 LOG6[ui]: SNI: sending servername: localhost 2016.09.14 06:54:35 LOG6[ui]: Peer certificate not required 2016.09.14 06:54:35 LOG7[ui]: SSL state (connect): before/connect initialization 2016.09.14 06:54:35 LOG7[ui]: SSL state (connect): SSLv2/v3 write client hello A ^C Daves-MBP-2016:~ dave$ """"""""""""""""""" My stunnel-sender.conf: """"""""""""""""""" debug = 7 output = /Users/dave/Desktop/stunnel-test/sender-stunnel-output.log foreground = yes client = yes connect = localhost:874 cert = /Users/dave/Desktop/stunnel-test/cert.pem verify = 0 """"""""""""""""""" My stunnel-receiver.conf: """"""""""""""""""" debug = 7 output = /Users/dave/Desktop/stunnel-test/receiver-stunnels-output.log pid = /Users/dave/Desktop/stunnel-test/stunnel-rsyncd-stunnels.pid cert = /Users/dave/Desktop/stunnel-test/cert.pem verify = 0 delay = yes exec = /Users/dave/Desktop/stunnel-test/rsync execArgs = -vvvv --daemon --server --config=/Users/dave/Desktop/stunnel-test/stunnel-rsyncd.conf . foreground = yes client = no """"""""""""""""""" My receiver-error.log: """"""""""""""""""" 2016.09.14 06:54:35 LOG7[ui]: Clients allowed=125 2016.09.14 06:54:35 LOG7[cron]: Cron thread initialized 2016.09.14 06:54:35 LOG5[ui]: stunnel 5.35 on x86_64-apple-darwin15.4.0 platform 2016.09.14 06:54:35 LOG5[ui]: Compiled with OpenSSL 0.9.8zd 8 Jan 2015 2016.09.14 06:54:35 LOG5[ui]: Running with OpenSSL 0.9.8zh 14 Jan 2016 2016.09.14 06:54:35 LOG5[ui]: Update OpenSSL shared libraries or rebuild stunnel 2016.09.14 06:54:35 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,SNI 2016.09.14 06:54:35 LOG7[ui]: errno: (*__error()) 2016.09.14 06:54:35 LOG5[ui]: Reading configuration from file /Users/dave/Desktop/stunnel-test/stunnel-receiver.conf 2016.09.14 06:54:35 LOG5[ui]: UTF-8 byte order mark not detected 2016.09.14 06:54:35 LOG7[ui]: Compression disabled 2016.09.14 06:54:35 LOG7[ui]: Snagged 64 random bytes from /dev/urandom 2016.09.14 06:54:35 LOG7[ui]: PRNG seeded successfully 2016.09.14 06:54:35 LOG6[ui]: Initializing inetd mode configuration 2016.09.14 06:54:35 LOG6[ui]: Loading certificate from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG6[ui]: Certificate loaded from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG6[ui]: Loading private key from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG4[ui]: Insecure file permissions on /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG6[ui]: Private key loaded from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG7[ui]: Private key check succeeded 2016.09.14 06:54:35 LOG7[ui]: DH initialization 2016.09.14 06:54:35 LOG7[ui]: Using DH parameters from /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG6[ui]: 2048-bit DH parameters loaded 2016.09.14 06:54:35 LOG7[ui]: ECDH initialization 2016.09.14 06:54:35 LOG7[ui]: ECDH initialized with curve prime256v1 2016.09.14 06:54:35 LOG7[ui]: SSL options: 0x03004004 (+0x03004000, -0x00000000) 2016.09.14 06:54:35 LOG5[ui]: Configuration successful 2016.09.14 06:54:35 LOG7[ui]: Service [stunnel] started 2016.09.14 06:54:35 LOG7[ui]: Option TCP_NODELAY set on local socket 2016.09.14 06:54:35 LOG5[ui]: Service [stunnel] accepted connection from ::1:51362 2016.09.14 06:54:35 LOG6[ui]: Peer certificate not required 2016.09.14 06:54:35 LOG7[ui]: SSL state (accept): before/accept initialization 2016.09.14 06:54:35 LOG7[ui]: SNI: no virtual services defined 2016.09.14 06:54:35 LOG7[ui]: SSL state (accept): SSLv3 read client hello A 2016.09.14 06:54:35 LOG7[ui]: SSL state (accept): SSLv3 write server hello A 2016.09.14 06:54:35 LOG7[ui]: SSL state (accept): SSLv3 write certificate A 2016.09.14 06:54:35 LOG7[ui]: SSL state (accept): SSLv3 write certificate request A 2016.09.14 06:54:35 LOG7[ui]: SSL state (accept): SSLv3 flush data 2016.09.14 06:54:40 LOG3[ui]: SSL_accept: Peer suddenly disconnected 2016.09.14 06:54:40 LOG5[ui]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.09.14 06:54:40 LOG7[ui]: Deallocating application specific data for addr index 2016.09.14 06:54:40 LOG7[ui]: Service [stunnel] finished (0 left) """"""""""""""""""" The server-side-Stunnel is invoked via launchd using this LaunchDaemon (but this seems to be working okay — I think): """"""""""""""""""" <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Disabled</key> <false/> <key>StandardErrorPath</key> <string>/Users/dave/Desktop/stunnel-test/receiver-error.log</string> <key>StandardOutPath</key> <string>/Users/dave/Desktop/stunnel-test/receiver-out.log</string> <key>Label</key> <string>com.stunnel.test</string> <key>ProgramArguments</key> <array> <string>/Users/dave/Desktop/stunnel-test/stunnel</string> <string>/Users/dave/Desktop/stunnel-test/stunnel-receiver.conf</string> </array> <key>inetdCompatibility</key> <dict> <key>Wait</key> <false/> </dict> <key>Sockets</key> <dict> <key>Listeners</key> <dict> <key>SockServiceName</key> <string>874</string> <key>SockType</key> <string>stream</string> </dict> </dict> </dict> </plist> """"""""""""""""""" I’ve looked at the output of bash-3.2# tcpdump -i all -XX -xx -vv port 874 but this didn’t give me any obvious clues. I can send it if it’s useful but I’ve omitted it for now as it’s long. I’ve reproduced the same hang on Mac OS X 10.11 and 10.6. I’ve recompiled Stunnel in 10.11 and 10.9 environments but still get this same hang. Any advice appreciated.. — Dave.

1 0