stunnel-users

stunnel-users@stunnel.org

6 participants
3294 discussions

Temporary DH params in stunnel
by Guillermo Rodriguez Garcia 10 May '16

10 May '16

Hi all, The stunnel docs say that starting with stunnel 5.18, DH params are auto-generated every 24 hours and that this "may take several minutes". I see that for this purpose, stunnel uses OpenSSL's DH_generate_parameters[_ex] function. According to the OpenSSL API docs [1], these functions "may run for several hours before finding a suitable prime." [1]: https://www.openssl.org/docs/manmaster/crypto/DH_generate_parameters.html Wouldn't it make sense to use "DSA-like" DH params for this purpose? These are much faster to generate and apparently equally safe. DSA-like DH params are generated using DSA_generate_parameters[ex]. It is the equivalent of passing the -dsaparam option to the openssl dhparam command. Some useful info: - http://security.stackexchange.com/a/95184/109144 - http://dovecot.org/pipermail/dovecot/2015-November/102447.html Best regards, Guillermo Rodriguez Garcia guille.rodriguez(a)gmail.com

1 0

'Integer constant too large' warnings in str.c
by Guillermo Rodriguez Garcia 10 May '16

10 May '16

Hello, Current stunnel (5.32) gives a bunch of warnings in str.c when the CANARY_XXX and MAGIC_XXX constants are used, for example: str.c:101: warning: integer constant is too large for 'long' type Shouldn't these constants be declared with the 'LL' suffix instead of 'L' ? #define CANARY_INITIALIZED 0x0000c0ded0000000LL #define CANARY_UNINTIALIZED 0x0000abadbabe0000LL #define MAGIC_ALLOCATED 0x0000a110c8ed0000LL #define MAGIC_DEALLOCATED 0x0000defec8ed0000LL Best regards, Guillermo Rodriguez Garcia guille.rodriguez(a)gmail.com

2 1

SNI support in OpenSSL
by Guillermo Rodriguez Garcia 08 May '16

08 May '16

Hello all, The stunnel documentation says that SNI requires stunnel to be linked with OpenSSL >= 1.0.0. However, SNI is supported in OpenSSL since 0.9.8f (and actually enabled by default since 0.9.8k). For 0.9.8f and later, OPENSSL_NO_TLSEXT will be defined if TLS extension support (including SNI support) is not compiled into OpenSSL. Taking the above into account, the OpenSSL version check in stunnel (src/common.h) could be relaxed a bit. Instead of: #if OPENSSL_VERSION_NUMBER<0x10000000L #define OPENSSL_NO_TLSEXT #define OPENSSL_NO_PSK #endif /* OpenSSL older than 1.0.0 */ this could be: #if OPENSSL_VERSION_NUMBER<0x00908060L #define OPENSSL_NO_TLSEXT #endif /* OpenSSL older than 0.9.8f */ #if OPENSSL_VERSION_NUMBER<0x10000000L #define OPENSSL_NO_PSK #endif /* OpenSSL older than 1.0.0 */ This would enable SNI on systems using 0.9.8 (Mac OS X for example). Best regards, Guillermo Rodriguez Garcia guille.rodriguez(a)gmail.com

1 0

SSLv3 not working with version 5.06
by Francois Pires 06 May '16

06 May '16

Hi all, We need use of sslv3 but with debian Jessie package version 5.06 this is not working. I have add options -NO_SSLv3 still same. Can you check if my configuration is good and if you have any idea to have sslv3 working with this verison. # stunnel.conf syslog = no cert = /etc/ssl/certs/test.crt.pem key = /etc/ssl/private/test.key.pem CAfile = /etc/ssl/certs/test.ca-bundle # Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = all options = -NO_SSLv3 ciphers = AES256-SHA #ciphers = ECDH@STRENGTH:DH@STRENGTH:HIGH:!RC4:!MD5:!DES:!aNULL:!eNULL # Some debugging stuff useful for troubleshooting debug = 7 output = /stunnel.log # Debian and Ubuntu chroot config chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid # Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 socket = l:SO_KEEPALIVE=1 socket = r:SO_KEEPALIVE=1 [test] accept = 11443 connect = 127.0.0.1:11444 # stunnel log with openssl test SSL_accept: 14076102: error:14076102:SSL routines:SSL23_GET_CLIENT_HELLO:unsupported protocol openssl s_client -connect 127.0.0.1:11443 -ssl3 CONNECTED(00000003) write:errno=104 --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 0 bytes and written 0 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE SSL-Session: Protocol : SSLv3 Cipher : 0000 Session-ID: Session-ID-ctx: Master-Key: Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1462525363 Timeout : 7200 (sec) Verify return code: 0 (ok) -- Cordialement, François PIRES SysAdmin

2 1

how to pass servername openssl parameter
by Dod 04 May '16

04 May '16

Hello, Little question I use openssl s_client mode to call an https with private PKI so private CAFile CERT and also Key, but I also need to use the parameter "servername" but stunnel seems not support it or may be it has an other syntax ? regards.

1 0

Connect to web app with weak crypto
by Pete McEvoy 29 Apr '16

29 Apr '16

Hi. I have a java web app that uses weak crypto. I would like to be able to access it with a modern browser. Currently the only method that seems to work is links on freebsd 9.3, all other browsers give errors such as: Error performing TLS handshake: The Diffie-Hellman prime sent by the server is not acceptable (not long enough). Obviously it would be better if this was fixed but it is not something I have control of. Would it be possible for me to use stunnel to encapsulate the weak connection within a stronger one so the browser does not complain? I have tried this: ; TLS front-end to a web server [https] client = yes accept = 443 connect = 192.168.1.5:443 cert = /usr/local/etc/stunnel/stunnel.pem Which asks me to make an exception for the self signed cert but then proceeds to fail in same way as before. Cheers -- Pete

1 0

Memory Leak in stunnel 5.31
by Fritz Gschwendner 20 Apr '16

20 Apr '16

Thank you. I tried the new version. Between 10:15 and 10:50 stunnel private bytes grew by ~ 85 MB. Log entries regarding "possible memory leak" look like this at the beginning: 2016.04.20 10:17:01 LOG4[937]: Possible memory leak at .\crypto\asn1\tasn_new.c:179: 71652 allocations 2016.04.20 10:17:01 LOG4[937]: Possible memory leak at .\crypto\asn1\asn1_lib.c:412: 70978 allocations 2016.04.20 10:17:01 LOG4[937]: Possible memory leak at .\crypto\asn1\a_object.c:346: 55283 allocations 2016.04.20 10:17:01 LOG4[937]: Possible memory leak at .\crypto\asn1\a_object.c:315: 55283 allocations 2016.04.20 10:17:01 LOG4[937]: Possible memory leak at .\crypto\asn1\asn1_lib.c:376: 56826 allocations 2016.04.20 10:17:01 LOG4[937]: Possible memory leak at .\crypto\stack\stack.c:162: 13761 allocations 2016.04.20 10:17:01 LOG4[937]: Possible memory leak at .\crypto\stack\stack.c:187: 11448 allocations 2016.04.20 10:17:01 LOG4[937]: Possible memory leak at .\crypto\buffer\buffer.c:118: 11172 allocations 2016.04.20 10:17:01 LOG4[937]: Possible memory leak at .\crypto\asn1\tasn_new.c:342: 10501 allocations ..and later like this: 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\tasn_new.c:179: 182132 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\asn1_lib.c:412: 181243 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\a_object.c:346: 138968 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\a_object.c:315: 138968 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\asn1_lib.c:376: 144407 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\stack\stack.c:162: 35294 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\stack\stack.c:187: 29760 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\buffer\buffer.c:118: 28186 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\tasn_new.c:342: 27649 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\bn\bn_lib.c:303: 27405 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\buffer\buffer.c:74: 18971 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\x_name.c:136: 18967 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\x_name.c:383: 18967 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\a_int.c:208: 18406 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\a_bitstr.c:158: 18433 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\bn\bn_lib.c:272: 13616 allocations If there is anything else I can do, please let me know. -----Ursprüngliche Nachricht----- Von: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] Im Auftrag von Michal Trojnara Gesendet: Dienstag, 19. April 2016 23:31 An: stunnel-users(a)stunnel.org Betreff: Re: [stunnel-users] Memory Leak in stunnel 5.31 On 31.03.2016 22:28, Fritz Gschwendner wrote: > we have a memory leak with stunnel 5.31 in server mode on Windows > Server 2012. Page File Bytes of the stunnel process keep growing. [cut] > I suspect it has something to do with clients not closing the > connection correctly. We have a lot of connections ending like > this: [cut] > Is my suspicion plausible? Can you recommend a change in the > configuration to avoid this issue? Anything else I can do to debug? Your suspicion looks plausible. I have added a heuristic algorithm that identifies excessive memory allocations. Please try stunnel-5.32b2: https://www.stunnel.org/downloads.html The logged warnings should allow identification of the leak source. Best regards, Mike _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Stunnel and Eudora error
by EPPack 14 Apr '16

14 Apr '16

I installed stunnel on one of my laptops a few days ago, and it installed uneventfully. I set up one of my gmail accounts in Eudora per directions I got from another Eudora user, and the account works perfectly in Eudora. However, on this machine, I got an unexpected prompt that showed up in a cmd window during the install, which did NOT show up on the other machine: WARNING: can't open config file: /devel/win32/openssl/openssl.cnf Generating a 2048 bit RSA private key ...+++ ..................+++ Writing new private key to 'C:\Program Files (x86)\stunnel\config\stunnel.pem' ---- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank for some fields there will be a default value, If you enter '.', the field will be left blank. ---- Country Name (2 letter code) [PL]: When I try for an inbound in Eudora, I get the "Error reading from network. Cause: connection aborted due to timeout or other failure (10053). Problem of course is that I'm also unsure if it installed fully/correctly. On the other machine, it installed itself uneventfully as a service, and after I started it (it came in as manual, unstarted), it was fine. This time, tho, it didn't show up in the list of services at all, even tho there was a prompt to start it, which I allowed it to do. That said, I did see it in the start menu, and was able to start it. I also rebooted, and it started up OK. However, after configuring one of my accounts the same way as on the other machine, it's not working, getting the timeout error above. Changed it back to the normal settings for GMail in Eudora, it worked fine, so it wasn't any other cause. I tried adding options = DONT_INSERT_EMPTY_FRAGMENTS to the conf, hopefully in the right place :) and also bumped the Eudora Advanced Network params as also suggested.Nada. The only difference between the two machines, both Windows 7 Pro, is that this one is a 64bit, the other not, which may well be the difference. As I'm new to stunnel, I looked for the manual, but got a 403 on the page. Thoughts? elaine ----- Elaine Pack, Web Analyst, Ivy, VA 99 programming bugs in the code 99 programming bugs Fix one bug, compile it again Now there's 100 bugs in the code! (Repeat until bugs=0)

1 0

developpement hints request
by brahim mohamed 06 Apr '16

06 Apr '16

Hello, My name is Mohamed Aymen, i'm an electronic payment engineer . I recently descovered Stunnel and i'm trying to make some developement and modifications and i need your help with points bellow: 1-steps for compilation on IBM AIX-7 plateform 2-possibility of adding a new source code file(.c) and compiling it with native stunnel files ===some clarifications about source code : 3-i would appreciate if you can indicate me : where exactly in source code i can find the code responsible for accepting buffer from client and the code responsible for accepting buffer (response) from server, also the code responsible for sending data to server and the code responsible for sending server's answer to client (all those on socket mode,on ssl mode and on tls mode) warm regards

1 0

blockscript
by Petr Hojzak 05 Apr '16

05 Apr '16

Hello. Is it possible to setup stunel in a way so it is not detected by services like blocksript? Petr Hojzak https://forpsi-vzr-s126463.mojeid.cz/

2 3

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users