- stunnel-users - stunnel.org

Re: [stunnel-users] CPU 100%
by Eric Eberhard 19 Oct '18

19 Oct '18

Somewhere there is a physical network card - checking the firewall/router for traffic is a good idea no matter what it is running on. VMs have lots of clever software to isolate each instance (including resources) and you may be being streamed at a rate the VM as whole can handle, and your isolated VM cannot. And setting the debug level up is still a good idea. And forcing core files and using a debugger is still a good idea. And trying inetd mode is still a good idea. You need to narrow your focus and each of these suggestions will tell you something that narrows the problem. Eric From: Murrey, Brian J. [mailto:Brian.Murrey@trimedx.com] Sent: Thursday, October 18, 2018 7:14 AM To: Eric Eberhard <flash(a)vicsmba.com>; stunnel-users(a)stunnel.org Subject: RE: [stunnel-users] CPU 100% Thank you Eric, this server is a VM running under vSphere 6.5 and has no physical network card. From: Eric Eberhard <flash(a)vicsmba.com <mailto:flash@vicsmba.com> > Sent: Wednesday, October 17, 2018 7:56 PM To: Murrey, Brian J. <Brian.Murrey(a)trimedx.com <mailto:Brian.Murrey@trimedx.com> >; stunnel-users(a)stunnel.org <mailto:stunnel-users@stunnel.org> Subject: RE: [stunnel-users] CPU 100% Long ago I had a server with a bad network card. Every once in a while it would spew uncontrollable bytes onto the network. If you open a stunnel connection and it does that this could very well be the problem. If it cheap, try changing the network card. If not, you should be able to look in your firewall/router and it will tell you who is sending what bytes to whomever. See if that machine is indeed streaming the bytes in massive quantities. If not, I would suspect your stunnel is getting stuck in it's own loop. There are a million reasons this can happen (well a few less than a million) - such as maybe a bad library in the FreeBSD or a bad choice in the Makefile - such as doing threads or something in a way your O/S does not like (I use threads=fork or whatever it is, instead of actual threading). You might tinker with some of the options that make the stunnel build and try different ones. Especially if stunnel was compiled on a different version of the O/S - could be differences in bytes in things and who knows what. That is all I can suggest beyond setting the debug level to 7 (I think is highest) and then watching the log file. Eric From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Murrey, Brian J. Sent: Wednesday, October 17, 2018 10:57 AM To: stunnel-users(a)stunnel.org <mailto:stunnel-users@stunnel.org> Subject: [stunnel-users] CPU 100% We are running stunnel 5.49 on FreeBSD 11.2 and we're running into a problem once in a while. CPU pegs at 100% when we get an stunnel connection from one of our external devices. This affects 100% of all cores and we can't even log in to console. To mitigate this temporarily, we have a script running in the background to watch when stunnel begins to spike and restarts the daemon. It doesn't happen 100% of the time, and so far I have been unable to distinguish what makes the connection do this to the CPU. Have any of you run in to this issue? Sincerely, Brian Murrey System Engineer II, IT Infrastructure _____ NOTICE: This message may contain privileged and confidential information and/or protected health information intended solely for the use of the named recipient and may be privileged or otherwise protected by law. If you are not the intended recipient of this message, you should immediately notify the sender and delete this message. Do not disseminate, reproduce, or review this message or attachments if you are not the intended recipient. The sender or others may have legal rights restricting the dissemination of the information contained in this message and, as a result, remedies against you in the event of the improper dissemination of confidential information, trade secrets, personal information or privileged communications. This message is the work of the sender and does not necessarily reflect the position, views, or policies of TriMedx LLC or its affiliates. WARNING: The integrity and security of this message cannot be guaranteed and may contain or transmit a virus or other illicit code. Neither TriMedx LLC or its affiliates accept liability for any damage attributable to viruses or illicit code transmitted through this message or an attachment. _____ CAUTION: This email originated from outside of the organization. Do not open links or attachments you were not expecting, even from known senders, and use caution when responding. Please contact the Service Desk if in doubt regarding the legitimacy of this email. _____ NOTICE: This message may contain privileged and confidential information and/or protected health information intended solely for the use of the named recipient and may be privileged or otherwise protected by law. If you are not the intended recipient of this message, you should immediately notify the sender and delete this message. Do not disseminate, reproduce, or review this message or attachments if you are not the intended recipient. The sender or others may have legal rights restricting the dissemination of the information contained in this message and, as a result, remedies against you in the event of the improper dissemination of confidential information, trade secrets, personal information or privileged communications. This message is the work of the sender and does not necessarily reflect the position, views, or policies of TriMedx LLC or its affiliates. WARNING: The integrity and security of this message cannot be guaranteed and may contain or transmit a virus or other illicit code. Neither TriMedx LLC or its affiliates accept liability for any damage attributable to viruses or illicit code transmitted through this message or an attachment.

2 1

Re: [stunnel-users] Windows stunnel Command Line Configuration File Location
by Eric Eberhard 18 Oct '18

18 Oct '18

If it reading from .\config . then I would try putting the path in quotes. If it fails to read the one in \temp but is not reading anything, I would check permissions on the directory and file (easy test is set "everyone" to full permissions, at least as a test). You have to do the entire directory tree (in the case of c:\temp it is just that directory) and the file. Eric From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Steve Jones Sent: Wednesday, October 17, 2018 1:59 PM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Windows stunnel Command Line Configuration File Location I would like to be able to run stunnel interactively on Windows, but specify a different location for the configuration file. When I looked at the help output, it stated that you could pass a parameter for "[<filename>]". I assumed I could put a path on there, but it does not appear to work. For example, I tried running "stunnel.exe C:\temp\stunnel.conf", but it would not find the configuration file even though it is there. Is there a way to do what I am trying to do or does the config file have to be in a folder "..\config"? Thanks.

2 1

Re: [stunnel-users] CPU 100%
by Eric Eberhard 18 Oct '18

18 Oct '18

One other suggestion - run it in inetd mode. This is MUCH simpler, stunnel will not have to do as much forking and managing and so forth. The O/S will do all that. I know - it is a little less efficient. However, I have found on modern Centos and AIX computers that even with very high volumes it makes no measurable difference. If nothing else, it is another debugging technique. Especially if the runaway process is the parent process . because that does not exist under inetd mode. Eric From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Murrey, Brian J. Sent: Wednesday, October 17, 2018 11:09 AM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] CPU 100% We have one service, connecting stunnel to another application. Relevant configuration: [vpn] client = no accept = 172.17.102.122:443 exec = /usr/sbin/ppp execargs = ppp -direct vpn pty = yes Brian From: Vincent Deschenes <vdeschenes(a)stelvio.com <mailto:vdeschenes@stelvio.com> > Sent: Wednesday, October 17, 2018 2:05 PM To: Murrey, Brian J. <Brian.Murrey(a)trimedx.com <mailto:Brian.Murrey@trimedx.com> >; stunnel-users(a)stunnel.org <mailto:stunnel-users@stunnel.org> Subject: RE: [stunnel-users] CPU 100% Just a silly idea, but is it possible you have a re-entrant configuration for one service, one that connect back to itself creating a loop? Vincent Deschenes Ing. PMP From: stunnel-users <stunnel-users-bounces(a)stunnel.org <mailto:stunnel-users-bounces@stunnel.org> > On Behalf Of Murrey, Brian J. Sent: Wednesday, 17 October 2018 1:57 PM To: stunnel-users(a)stunnel.org <mailto:stunnel-users@stunnel.org> Subject: [stunnel-users] CPU 100% We are running stunnel 5.49 on FreeBSD 11.2 and we're running into a problem once in a while. CPU pegs at 100% when we get an stunnel connection from one of our external devices. This affects 100% of all cores and we can't even log in to console. To mitigate this temporarily, we have a script running in the background to watch when stunnel begins to spike and restarts the daemon. It doesn't happen 100% of the time, and so far I have been unable to distinguish what makes the connection do this to the CPU. Have any of you run in to this issue? Sincerely, Brian Murrey System Engineer II, IT Infrastructure _____ NOTICE: This message may contain privileged and confidential information and/or protected health information intended solely for the use of the named recipient and may be privileged or otherwise protected by law. If you are not the intended recipient of this message, you should immediately notify the sender and delete this message. Do not disseminate, reproduce, or review this message or attachments if you are not the intended recipient. The sender or others may have legal rights restricting the dissemination of the information contained in this message and, as a result, remedies against you in the event of the improper dissemination of confidential information, trade secrets, personal information or privileged communications. This message is the work of the sender and does not necessarily reflect the position, views, or policies of TriMedx LLC or its affiliates. WARNING: The integrity and security of this message cannot be guaranteed and may contain or transmit a virus or other illicit code. Neither TriMedx LLC or its affiliates accept liability for any damage attributable to viruses or illicit code transmitted through this message or an attachment. _____ CAUTION: This email originated from outside of the organization. Do not open links or attachments you were not expecting, even from known senders, and use caution when responding. Please contact the Service Desk if in doubt regarding the legitimacy of this email. _____ NOTICE: This message may contain privileged and confidential information and/or protected health information intended solely for the use of the named recipient and may be privileged or otherwise protected by law. If you are not the intended recipient of this message, you should immediately notify the sender and delete this message. Do not disseminate, reproduce, or review this message or attachments if you are not the intended recipient. The sender or others may have legal rights restricting the dissemination of the information contained in this message and, as a result, remedies against you in the event of the improper dissemination of confidential information, trade secrets, personal information or privileged communications. This message is the work of the sender and does not necessarily reflect the position, views, or policies of TriMedx LLC or its affiliates. WARNING: The integrity and security of this message cannot be guaranteed and may contain or transmit a virus or other illicit code. Neither TriMedx LLC or its affiliates accept liability for any damage attributable to viruses or illicit code transmitted through this message or an attachment.

1 0

Re: [stunnel-users] CPU 100%
by Eric Eberhard 18 Oct '18

18 Oct '18

Also a good idea. That would be found in the log ASAP certainly with a high debug level. Might fill the filesystem for the log if that is so :) Does FreeBSD support kill -9 (or is it 11?) that forces a core dump? If so, when you kill it and leave a core file, you can use the debugger on that core file and see what it is doing. Look at the stack trace. You may need several to catch the problem. If it is simply in a read() type state then the other machine is streaming you. If it is loop around you should see it in a different place in each core file (the odds of hitting the same line of code when kill it every time are not good). I do not know what debuggers you have (gdb?) but that is another trick. Eric From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Vincent Deschenes Sent: Wednesday, October 17, 2018 11:05 AM To: Murrey, Brian J. <Brian.Murrey(a)trimedx.com>; stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] CPU 100% Just a silly idea, but is it possible you have a re-entrant configuration for one service, one that connect back to itself creating a loop? Vincent Deschenes Ing. PMP From: stunnel-users <stunnel-users-bounces(a)stunnel.org <mailto:stunnel-users-bounces@stunnel.org> > On Behalf Of Murrey, Brian J. Sent: Wednesday, 17 October 2018 1:57 PM To: stunnel-users(a)stunnel.org <mailto:stunnel-users@stunnel.org> Subject: [stunnel-users] CPU 100% We are running stunnel 5.49 on FreeBSD 11.2 and we're running into a problem once in a while. CPU pegs at 100% when we get an stunnel connection from one of our external devices. This affects 100% of all cores and we can't even log in to console. To mitigate this temporarily, we have a script running in the background to watch when stunnel begins to spike and restarts the daemon. It doesn't happen 100% of the time, and so far I have been unable to distinguish what makes the connection do this to the CPU. Have any of you run in to this issue? Sincerely, Brian Murrey System Engineer II, IT Infrastructure _____ NOTICE: This message may contain privileged and confidential information and/or protected health information intended solely for the use of the named recipient and may be privileged or otherwise protected by law. If you are not the intended recipient of this message, you should immediately notify the sender and delete this message. Do not disseminate, reproduce, or review this message or attachments if you are not the intended recipient. The sender or others may have legal rights restricting the dissemination of the information contained in this message and, as a result, remedies against you in the event of the improper dissemination of confidential information, trade secrets, personal information or privileged communications. This message is the work of the sender and does not necessarily reflect the position, views, or policies of TriMedx LLC or its affiliates. WARNING: The integrity and security of this message cannot be guaranteed and may contain or transmit a virus or other illicit code. Neither TriMedx LLC or its affiliates accept liability for any damage attributable to viruses or illicit code transmitted through this message or an attachment.

1 0

Windows stunnel Command Line Configuration File Location
by Steve Jones 17 Oct '18

17 Oct '18

I would like to be able to run stunnel interactively on Windows, but specify a different location for the configuration file. When I looked at the help output, it stated that you could pass a parameter for "[<filename>]". I assumed I could put a path on there, but it does not appear to work. For example, I tried running "stunnel.exe C:\temp\stunnel.conf", but it would not find the configuration file even though it is there. Is there a way to do what I am trying to do or does the config file have to be in a folder "..\config"? Thanks.

1 0

CPU 100%
by Murrey, Brian J. 17 Oct '18

17 Oct '18

We are running stunnel 5.49 on FreeBSD 11.2 and we're running into a problem once in a while. CPU pegs at 100% when we get an stunnel connection from one of our external devices. This affects 100% of all cores and we can't even log in to console. To mitigate this temporarily, we have a script running in the background to watch when stunnel begins to spike and restarts the daemon. It doesn't happen 100% of the time, and so far I have been unable to distinguish what makes the connection do this to the CPU. Have any of you run in to this issue? Sincerely, Brian Murrey System Engineer II, IT Infrastructure ________________________________ NOTICE: This message may contain privileged and confidential information and/or protected health information intended solely for the use of the named recipient and may be privileged or otherwise protected by law. If you are not the intended recipient of this message, you should immediately notify the sender and delete this message. Do not disseminate, reproduce, or review this message or attachments if you are not the intended recipient. The sender or others may have legal rights restricting the dissemination of the information contained in this message and, as a result, remedies against you in the event of the improper dissemination of confidential information, trade secrets, personal information or privileged communications. This message is the work of the sender and does not necessarily reflect the position, views, or policies of TriMedx LLC or its affiliates. WARNING: The integrity and security of this message cannot be guaranteed and may contain or transmit a virus or other illicit code. Neither TriMedx LLC or its affiliates accept liability for any damage attributable to viruses or illicit code transmitted through this message or an attachment.

2 2

stunnel 5.49 on Win32 (invalid configuration file)
by Hardik Mehta 10 Oct '18

10 Oct '18

Hi, can you please help, I was able to send a mail using blat, stunnel and gmail and then i tried adding Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Name: Stunnel Type: REG_SZ Value: "c:\Program Files (x86)\stunnel\bin\stunnel.exe" to run on windows startup, but as soon as i restarted the system gave me following message stunnel 5.49 on Win32 (invalid configuration file) Stunnel server is down due to an error. you need to exit and correct the problem. click of to see the error lg window this is the log that i'm getting on stunnel [ ] Running on Windows 6.2 [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [SMTP Gmail] [ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK [ ] TLS options: 0x03000004 (+0x00000000, -0x00000000) [ ] No certificate or private key specified [:] Service [SMTP Gmail] needs authentication to prevent MITM attacks [ ] Initializing service [POP3 Gmail] [ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK [ ] TLS options: 0x03000004 (+0x00000000, -0x00000000) [ ] No certificate or private key specified [:] Service [POP3 Gmail] needs authentication to prevent MITM attacks [.] Configuration successful [ ] Binding service [SMTP Gmail] [ ] Listening file descriptor created (FD=1800) [ ] Setting accept socket options (FD=1800) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [ ] Service [SMTP Gmail] (FD=1800) bound to ::1:1099 [ ] Listening file descriptor created (FD=1516) [ ] Setting accept socket options (FD=1516) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [.] Binding service [SMTP Gmail] to 127.0.0.1:1099: Address already in use (WSAEADDRINUSE) (10048) [ ] Binding service [POP3 Gmail] [ ] Listening file descriptor created (FD=1516) [ ] Setting accept socket options (FD=1516) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [.] Binding service [POP3 Gmail] to 127.0.0.1:1109: Address already in use (WSAEADDRINUSE) (10048) [!] Binding service [POP3 Gmail] failed [ ] Deallocating section defaults [ ] Unbinding service [SMTP Gmail] [ ] Service [SMTP Gmail] closed (FD=1800) [ ] Service [SMTP Gmail] closed [ ] Deallocating section [SMTP Gmail] [ ] Unbinding service [POP3 Gmail] [ ] Service [POP3 Gmail] closed [ ] Deallocating section [POP3 Gmail] [!] Server is down I also tried changing 1099 to some other random ports but nothing works tried stopping gui, service & service uninstall, then service reinstall, service start & open gui, but the same log appears an early help will be highly appreciated. -- Regards Quick Support <https://get.teamviewer.com/66sdg3u>, Buy Tally Online <http://experts.tallysolutions.com/tallyweb/modules/sd/docmgmt/COnlineOrderE…> , Buy Addons Online <http://www.tallysolutions.com/tallyweb/modules/sd/docmgmt/CMktPlaceHomepage…> , Tally Solutions Website <http://www.tallysolutions.com>, Hardik Printers Youtube Channel <https://www.youtube.com/user/hardikcomp>, Twitter Handle <https://twitter.com/hardikcomp>, Quora Answers <https://www.quora.com/profile/Hardik-N-Mehta-Vadalia> Legal Disclaimer The information contained in this electronic communication is intended solely for the individual(s) or entity to which it is addressed. It may contain proprietary, confidential and/or legally privileged information. Any review, retransmission, dissemination, printing, copying or other use of, or taking any action in reliance on the contents of this information by person(s) or entities other than the intended recipient is strictly prohibited and may be unlawful. If you are not the addressee, or person responsible for delivering it to the addressee, you should not copy or deliver this to anyone else. If you receive this message by mistake, please notify us by responding to this email or telephone and immediately and permanently delete all copies of this message and any attachments from your system(s). We appreciate your assistance in preserving the confidentiality of our correspondence. Any information in this message that does not relate to the official business of the organization shall be understood as neither given nor endorsed by it. The contents of this message do not necessarily represent the views or policies of the Hardik Printers. Computer viruses can be transmitted via email. Hardik Printers attempts to sweep e-mails and attachments for viruses, it does not guarantee that either are virus free. The recipient should check this email and any attachments for the presence of viruses. Hardik Printers shall neither be liable for security of any information transmitted electronically nor be liable or responsible for the proper, timely and complete transmission thereof.

2 1

Re: [stunnel-users] build static stunnel with openssl
by Peter Pentchev 08 Oct '18

08 Oct '18

On Mon, Oct 08, 2018 at 03:09:07PM +0800, White Little wrote: > Thanks, Eric > > But I did not put it on /usr/local/opensl or /usr/local/stunnel > > > Below is my configuration log > > > [root@Stunnel-Fedora stunnel-5.49]# ./configure --enable-static > --with-ssl=/root/stunnel/openssl-1.1.0i [snip] > configure: **************************************** TLS [snip] > checking for TLS directory... /root/stunnel/openssl-1.1.0i [snip] > > I tested on ubuntu14.04, 16.04 64bit and fedora 32bit, all of them are > them are not include opennssl. What exactly makes you think that this does not include OpenSSL support? The configure script seemed to find the include/openssl/ directory in the directory that you specified; does the build fail somehow later? If it does, show us the logs from the failed build. Or does the compiled executable does not say "Compiled with OpenSSL 1.1.0i"? If it does not, show us the full build log (maybe use a pastebin-like service somewhere, e.g. paste.debian.net).. BTW a question: is /root/stunnel/openssl-1.1.0i the place you extracted and compiled OpenSSL, or the place you installed it after building it? If you just built it there, you also need to install it somewhere and point the stunnel configure script at the directory where it is installed, not at the build tree. This might mean that you may need to rebuild it again after specifying a --prefix or something like that (I do not remember exactly how the OpenSSL build works). G'luck, Peter -- Peter Pentchev roam(a){ringlet.net,debian.org,FreeBSD.org} pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

1 0

Re: [stunnel-users] build static stunnel with openssl
by Eric Eberhard 06 Oct '18

06 Oct '18

Make openssl and stunnel static. That is what I do and I consider it MUCH smarter than dynamic. I got tired of getting support calls because stunnel stopped working because the user installed a new openssl. Static will always work. Another piece of advice – do NOT put it on /usr/local/opensl or /usr/local/stunnel (or whatever the defaults are). Before building make your OWN directories. Our short name for our product is “met” so we use /usr/local/met/obj and /usr/local/met/bin for the object and binary files, respectively. This ensures nobody will install over you. This is also a real security issue mostly ignored. Most people have heard of SQL injection (where SQL is modified to do what the developer never intended). However, DLL injection (e.g. dynamic library injection) is a real problem. I could easily install an openssl DLL that does exactly what it should do … and sends the same data in clear text (or with my own encryption) to my machine. A thief could simply install one dynamic library and then OWN your data. E From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of White Little Sent: Sunday, September 30, 2018 11:33 PM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] build static stunnel with openssl Hi All I try to build a static (portable) stunnel that contain opensll. I know there are some similar questions long ago, but I still fail on how to build it. I try to link the stunnel to latest openssl, so I download the openssl-1.0.2p and make it. And then I type ./configure --enable-static --with-ssl= openssl-1.0.2p_dir And typing make, I found there is a stunnel binary under /src folder, but it still not include the openssl. Do I miss something that I did not notice? Thanks

1 0

server mode support for both ECC and RSA server certificates
by Tom Hood 02 Oct '18

02 Oct '18

Hi, Can one stunnel service in server mode be configured with both ECDSA and RSA server certs? The stunnel man page Certificates section suggests only one can be specified along with its CA chain. Use case is some legacy clients don't support ECDSA, but it would be nice to support ECDSA when a client does support it. It appears that HAProxy supports this <https://www.haproxy.com/blog/serving-ecc-and-rsa-certificates-on-same-ip-wi…>,but I'm hoping there is an equivalent way to do this with stunnel. I'm currently testing with stunnel 5.49 with OpenSSL 1.0.2p on Solaris 11.3, but can rebuild with any version of openssl if that helps. Thanks, -- Tom

1 0

build static stunnel with openssl
by White Little 01 Oct '18

01 Oct '18

Hi All I try to build a static (portable) stunnel that contain opensll. I know there are some similar questions long ago, but I still fail on how to build it. I try to link the stunnel to latest openssl, so I download the openssl-1.0.2p and make it. And then I type *./configure --enable-static --with-ssl= openssl-1.0.2p_dir* And typing make, I found there is a stunnel binary under /src folder, but it still not include the openssl. Do I miss something that I did not notice? Thanks

1 0

Re: [stunnel-users] stunnel log rolling
by Eric Eberhard 17 Sep '18

17 Sep '18

Most O/S will either prevent renaming a file that is in use (or deleting it). Some will – but they will actually continue to write to the old file (and if that file was deleted then it writes to a file you can nexer see). Since I generally use AIX it is the second feature I see. We have systems with over 500 connections via stunnel – it never rests, and rolling the log file is not easy. I can easily provide a code fix for stunnel that we use in out software. It allows daily logs, sized logs, etc. And it rolls properly. The downside is we open the log, write to it, and close it – each time – which is not efficient. Given modern computers I have come to not care. So the open routine either opens (append) a daily file or it looks up the file and gets the size and decides to move it (or not). The second is not perfect … if three other processes have it open at the moment they will finish writing to that log. Who cares? As long as the logging is always opening and closing the “bleed over” is minimized. If people want me to do this, I will – if they can tell me the log routines it would speed me some, preventing from having to search for them. We like and prefer the daily logs – it is clean as you get one per day. As long as one day is never too huge it is great and we have daemons that remove logs over xx number of days (although I could add a simple parameter for that as well and simply kill those files). This is an annoying problem – especially for multi-O/S software – but one I am good at. Eric From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Daniel Trickett Sent: Wednesday, September 12, 2018 11:16 AM To: Tom Hood <tom.w.hood(a)gmail.com> Cc: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] stunnel log rolling Hi Tom, Is what you refer to? I think the open and re-open only happen when the service is stopped and restarted. It hasn’t rolled over like Apache in my short experience. log = append | overwrite log file handling This option allows you to choose whether the log file (specified with the output option) is appended or overwritten when opened or re-opened. default: append Best regards, Dan Daniel Trickett Head of Database Services | MBS Business Technology BX-TCS-O Oracle ERP Business Services of Merck KGaA, Darmstadt, Germany Planned Absence – MilliporeSigma A business of Merck KGaA, Darmstadt, Germany EMD Millipore Corporation | 80 Ashby Road | Bedford, MA 01730 | USA office 781-533-3017 |cell 978-761-3506 |email <mailto:daniel.trickett@emdmillipore.com> daniel.trickett(a)emdmillipore.com From: Tom Hood <tom.w.hood(a)gmail.com <mailto:tom.w.hood@gmail.com> > Sent: Wednesday, September 12, 2018 1:10 PM To: Daniel Trickett <daniel.trickett(a)emdmillipore.com <mailto:daniel.trickett@emdmillipore.com> > Cc: stunnel-users(a)stunnel.org <mailto:stunnel-users@stunnel.org> Subject: Re: [stunnel-users] stunnel log rolling Hi Daniel, The trick is how to roll the logs without an interruption of service (i.e. without a stunnel restart). I believe stunnel claims to support this, but I think the feature might be broken in 5.49 Thanks, -- Tom On Wed, Sep 12, 2018 at 5:43 AM Daniel Trickett <daniel.trickett(a)emdmillipore.com <mailto:daniel.trickett@emdmillipore.com> > wrote: Tom, Kill the stunnel process. Then mv the log. This will allow stunnel to right to a new log file. Best regards, Dan Daniel Trickett Head of Database Services | MBS Business Technology BX-TCS-O Oracle ERP Business Services of Merck KGaA, Darmstadt, Germany Planned Absence – MilliporeSigma A business of Merck KGaA, Darmstadt, Germany EMD Millipore Corporation | 80 Ashby Road | Bedford, MA 01730 | USA office 781-533-3017 |cell 978-761-3506 |email <mailto:daniel.trickett@emdmillipore.com> daniel.trickett(a)emdmillipore.com From: stunnel-users <stunnel-users-bounces(a)stunnel.org <mailto:stunnel-users-bounces@stunnel.org> > On Behalf Of Tom Hood Sent: Tuesday, September 11, 2018 5:02 PM To: stunnel-users(a)stunnel.org <mailto:stunnel-users@stunnel.org> Subject: [stunnel-users] stunnel log rolling Hi, I'm new to stunnel and it isn't clear to me how the log rolling feature works. I built stunnel 5.49 with gcc 4.2.0 on Solaris 10. I'm running it on Solaris 11.3 SPARC. Using openssl 1.0.2p The config file has disabled syslog and is logging to stunnel.log. Command line is: stunnel stunnel.conf where stunnel.conf contains the following: syslog = no output = stunnel.log debug = 7 [service-exterior] client = no options = NO_SSLv2 options = NO_SSLv3 options = NO_TLSv1 options = NO_TLSv1.1 options = -NO_TLSv1.2 cert = /path/to/stunnel.pem curve = zzz accept = testhost:32100 connect = 127.0.0.1:32200 <http://127.0.0.1:32200> [service-interior] client = yes options = NO_SSLv2 options = NO_SSLv3 accept = 127.0.0.1:32200 <http://127.0.0.1:32200> connect = 127.0.0.1:32100 <http://127.0.0.1:32100> sslVersion = TLSv1 ciphers = zzz TIMEOUTconnect = 60 The log rollowing steps I tried that don't work are: mv stunnel.log stunnel.log.1 kill -USR1 <stunnelpid> The log message "LOG7[main]: Processing SIGNAL_REOPEN_LOG" shows up in stunnel.log.1. However, new client connections to host:32100 do not trigger creation of a new stunnel.log file. In fact, logging stops to stunnel.log.1 as soon as the USR1 is processed. The new client connections work as before, but there isn't any logging. I restarted stunnel and tried the test again with these steps: mv stunnel.log stunnel.log.1 touch stunnel.log kill -USR1 <stunnelpid> That also doesn't work. Please let me know the correct sequence of steps to roll the stunnel.log Thank you, -- Tom This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click http://www.emdgroup.com/emd/imprint/mail_disclaimer.html to access the German, French, Spanish and Portuguese versions of this disclaimer. This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click http://www.emdgroup.com/emd/imprint/mail_disclaimer.html to access the German, French, Spanish and Portuguese versions of this disclaimer.

2 1

stunnel log rolling
by Tom Hood 12 Sep '18

12 Sep '18

Hi, I'm new to stunnel and it isn't clear to me how the log rolling feature works. I built stunnel 5.49 with gcc 4.2.0 on Solaris 10. I'm running it on Solaris 11.3 SPARC. Using openssl 1.0.2p The config file has disabled syslog and is logging to stunnel.log. Command line is: stunnel stunnel.conf where stunnel.conf contains the following: syslog = no output = stunnel.log debug = 7 [service-exterior] client = no options = NO_SSLv2 options = NO_SSLv3 options = NO_TLSv1 options = NO_TLSv1.1 options = -NO_TLSv1.2 cert = /path/to/stunnel.pem curve = zzz accept = testhost:32100 connect = 127.0.0.1:32200 [service-interior] client = yes options = NO_SSLv2 options = NO_SSLv3 accept = 127.0.0.1:32200 connect = 127.0.0.1:32100 sslVersion = TLSv1 ciphers = zzz TIMEOUTconnect = 60 The log rollowing steps I tried that don't work are: mv stunnel.log stunnel.log.1 kill -USR1 <stunnelpid> The log message "LOG7[main]: Processing SIGNAL_REOPEN_LOG" shows up in stunnel.log.1. However, new client connections to host:32100 do not trigger creation of a new stunnel.log file. In fact, logging stops to stunnel.log.1 as soon as the USR1 is processed. The new client connections work as before, but there isn't any logging. I restarted stunnel and tried the test again with these steps: mv stunnel.log stunnel.log.1 touch stunnel.log kill -USR1 <stunnelpid> That also doesn't work. Please let me know the correct sequence of steps to roll the stunnel.log Thank you, -- Tom

2 4

stunnel 5.49 released
by Michal Trojnara 03 Sep '18

03 Sep '18

Dear Users, I have released version 5.49 of stunnel. Version 5.49, 2018.09.03, urgency: MEDIUM * New features - Performance optimizations. - Logging of negotiated or resumed TLS session IDs (thx to ANSSI - National Cybersecurity Agency of France). - Merged Debian 10-enabled.patch and 11-killproc.patch (thx to Peter Pentchev). - OpenSSL DLLs updated to version 1.0.2p. - PKCS#11 engine DLL updated to version 0.4.9. * Bugfixes - Fixed a crash in the session persistence implementation. - Fixed syslog identifier after configuration file reload. - Fixed non-interactive "make check" invocations. - Fixed reloading syslog configuration. - stunnel.pem created with SHA-256 instead of SHA-1. - SHA-256 "make check" certificates. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 3d6641213a82175c19f23fde1c3d1c841738385289eb7ca1554f4a58b96d955e stunnel-5.49.tar.gz 459bbb212baf0b9821c80e0664c830246ef6e97c7329fb08160e87ff11ae9692 stunnel-5.49-win32-installer.exe 72416c6664106ad815a8da67a525c6593247fc06cbca3b8918ffc87ae92595e8 stunnel-5.49-android.zip Best regards, Mike

1 0

Adding custom HTTP headers to a proxy'ed HTTP request when stunnel is used as an endpoint for a HTTP proxy
by Tony Cheneau 02 Sep '18

02 Sep '18

Good evening folks, Michal was kind enough to review and rewrite/integrate one of my patches for logging session IDs [1] and post the remaining ones on the website [2]! So, I feel I should also contribute to this list a little program I wrote. It is meant to be used with the exec= directive. It is mostly useful when stunnel is used to secure a connexion between a client and a HTTP proxy. A stunnel instance can run locally on the client while a stunnel server runs on the HTTP proxy: HTTP client (proxy'ed) <- > stunnel client <--> stunnel server <-> HTTP proxy Here, the "exec=" program will run on the stunnel server and add some extra headers to each HTTP request. One of this headers is the client's Distinguished Name (from its X.509 certificate). The HTTP proxy (squid for example) can then make some decision based on this HTTP header (authorisation, etc.). It relies heavily on PicoHTTPParser. Regards, Tony Cheneau [1]: to appear in version 5.49, see https://www.stunnel.org/sdf_ChangeLog.html [2]: patches 0002 and 0003 on https://www.stunnel.org/patches.html

1 0

OpenSSL 1.1.1 secure level and also an old problem rearing up
by Peter Pentchev 26 Aug '18

26 Aug '18

Hi, Sorry to be the bearer of a "those OS vendors did something again and now we have to catch up with them... again..." type of news, but, well, the maintainers of the Debian package of OpenSSL upgraded it to a prerelease 1.1.1 version and, in the process, changed the default cipher selection in the openssl.cnf file to 'SECLEVEL=2'. Unfortunately, this means that the server certificate used in the stunnel test suite is not considered strong enough, so the test suite is failing. More details may be found in the description of the Debian bug https://bugs.debian.org/906981 and the error message itself is at https://ci.debian.net/data/autopkgtest/testing/amd64/s/stunnel4/865956/log.… (look for all the lines containing "SSL_CTX_use_certificate:ca md too weak") So my first reaction was to stop running the stunnel test suite and only leave my functional test script; however, I then had another idea and tried to get the stunnel test suite to explicitly specify SECLEVEL=1 using the attached patch. This actually helped a bit - it made most of the tests pass - but then I hit a problem with e.g. 037_failover_prio1: if there is a "ciphers" option in the config file, stunnel eventually dies with an error that I seem to remember having seen before; take a look at this gdb backtrace from stunnel 5.48: (gdb) bt #0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51 #1 0x00007f0a349882f1 in __GI_abort () at abort.c:79 #2 0x000055b1aa3ad645 in fatal_debug (txt=0x55b1aa3c503c "Bad magic", file=0x55b1aa3ca6dd "ssl.c", line=118) at log.c:379 #3 0x000055b1aa3ae066 in get_alloc_list_ptr (ptr=0x7f0a24014520, file=0x55b1aa3ca6dd "ssl.c", line=118) at str.c:429 #4 0x000055b1aa3ae229 in str_detach_debug (ptr=ptr@entry=0x7f0a24014520, file=file@entry=0x55b1aa3ca6dd "ssl.c", line=line@entry=118) at str.c:378 #5 0x000055b1aa3ae884 in str_detach_debug (line=118, file=0x55b1aa3ca6dd "ssl.c", ptr=0x7f0a24014520) at str.c:413 #6 str_free_debug (ptr=0x7f0a24014520, file=0x55b1aa3ca6dd "ssl.c", line=118) at str.c:413 #7 0x00007f0a34f7661a in CRYPTO_free_ex_data () from /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1 #8 0x00007f0a35112a98 in SSL_SESSION_free () from /usr/lib/x86_64-linux-gnu/libssl.so.1.1 #9 0x00007f0a34f7a1bc in OPENSSL_LH_doall_arg () from /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1 #10 0x00007f0a35114177 in SSL_CTX_flush_sessions () from /usr/lib/x86_64-linux-gnu/libssl.so.1.1 #11 0x000055b1aa3c3701 in unbind_ports () at stunnel.c:439 #12 0x000055b1aa3c3799 in main_cleanup () at stunnel.c:224 #13 0x000055b1aa3ad720 in main (argc=<optimized out>, argv=<optimized out>) at ui_unix.c:79 (gdb) (the line numbers may be a bit off from the stock stunnel source, since I also added a setrlimit(RLIMIT_CORE, infinity) patch) So, yeah, what would be the best way forward here? I guess I might create a new certificate specifically for the Debian package's test suite, but I think the double-free problem may also need to be fixed. Let me know if you need any more information about reproducing it or any more data in case it doesn't happen on your end. Thanks for everything you're doing for stunnel, and keep up the great work! G'luck, Peter -- Peter Pentchev roam(a){ringlet.net,debian.org,FreeBSD.org} pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

2 2

Log to syslog without process name, after reloading the configuration (sighup)
by Reschke, Sven (VWIF G-TS/P) 22 Aug '18

22 Aug '18

Hi, I've upgraded my stunnel from version 5.44 to 5.45. After reloading the configuration of stunnel (via pkill -sighup stunnel) several times, I've stumbled about missing syslogs. Only the loading of the configuration file was still visible. Then I've noticed, that greping the syslog for stunnel was my mistake. Stunnel doesn't log its process name after reloading the configuration file the second time (see logs below) Can someone verify, or is it just me, or some configuration I'm missing? BTW: I've reproduced the "problem" also for the version 5.48 as you can see from the logs. With version 5.44 stunnel always logged its process name to syslog. Syslog output for greping after "stunnel": Aug 17 13:41:14 <user> stunnel: LOG5[ui]: stunnel 5.48 on armv7l-unknown-linux-gnueabihf platform Aug 17 13:41:14 <user> stunnel: LOG5[ui]: Compiled/running with OpenSSL 1.0.2p 14 Aug 2018 Aug 17 13:41:14 <user> stunnel: LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Aug 17 13:41:14 <user> stunnel: LOG5[ui]: Reading configuration from file /home/pi/stunnel.conf Aug 17 13:41:14 <user> stunnel: LOG5[ui]: UTF-8 byte order mark not detected Aug 17 13:41:14 <user> stunnel: LOG5[ui]: FIPS mode disabled Aug 17 13:41:14 <user> stunnel: LOG4[ui]: Insecure file permissions on /home/pi/psk.txt Aug 17 13:41:14 <user> stunnel: LOG4[ui]: Insecure file permissions on /home/pi/psk.txt Aug 17 13:41:14 <user> stunnel: LOG5[ui]: Configuration successful ---------------- Reloading the configuration the first time ----------------------- Aug 17 13:41:21 <user> stunnel: LOG5[main]: Reading configuration from file /home/pi/stunnel.conf Aug 17 13:41:21 <user> stunnel: LOG5[main]: UTF-8 byte order mark not detected Aug 17 13:41:21 <user> stunnel: LOG5[main]: FIPS mode disabled Aug 17 13:41:21 <user> stunnel: LOG4[main]: Insecure file permissions on /home/pi/psk.txt Aug 17 13:41:21 <user> stunnel: LOG4[main]: Insecure file permissions on /home/pi/psk.txt Aug 17 13:41:21 <user> stunnel: LOG5[main]: Configuration successful ---------------- Reloading the configuration a second time ------------------------ Aug 17 13:41:26 <user> : LOG5[main]: Reading configuration from file /home/pi/stunnel.conf My configuration file: [PSK client] client = yes accept = <listen address> connect = <remote address> PSKsecrets = /home/pi/psk.txt [PSK server] accept = <listen address> connect = <remote address> PSKsecrets = /home/pi/psk.txt Sven Reschke Embedded System SW Developer G-TS/P Volkswagen Infotainment GmbH Universitätsstr. 140 44799 Bochum Mobile +49 1525-887 2762 sven.reschke(a)volkswagen-infotainment.com<mailto:sven.reschke@volkswagen-infotainment.com> http://www.volkswagen-infotainment.com<http://www.volkswagen-infotainment.com/> Sitz der Gesellschaft: Wolfsburg Amtsgericht Braunschweig: HRB 204780 Geschäftsführung: Bernhard Krauße (Sprecher), Tobias Nadjib

2 2

OFFICE 365
by Mark Brezinski 15 Aug '18

15 Aug '18

Hello, Anyone have any luck connecting stunnel to office 365 I keep getting a socket 10061 error Mark Brezinski IT / EDI Manager [cid:image003.png@01D147BB.817FAE20]Healthcare, Inc. Proud Winner of the US National Minority Manufacturer of the Year Award 2012, MBDA, US Dept of Commerce Proud Winner of the Supplier of the Year Award 2012, Chicago Minority Supplier Development Council (Class IV >$50MM) Manufacturer of Medical Devices & Disposable Kits 5535 N. Wolcott Avenue Chicago, IL 60640 Tel : (773) 878-1100 ext.277 Fax: (773) 878-9100 mark.brezinski(a)lslhealthcare.com<mailto:mark.brezinski@lslhealthcare.com> www.LSLHealthcare.com<http://www.lslhealthcare.com/> Notice: If you are not the intended recipient, please note that any dissemination, disclosure, distribution, or copying of this communication is strictly prohibited. Anyone who receives this message in error should notify the sender immediately by telephone or by return e-mail and delete it from their computer. This communication may contain information that is privileged, confidential or exempt from disclosure. P LSL Healthcare, Inc.is dedicated to preserving our environment. Please join us and consider not printing this e-mail unless necessary.

1 0

x64 Installers and Upgrade HowTo
by Cynthia Davis 07 Aug '18

07 Aug '18

Two questions for the mailing list: 1. Are win64 installers available for stunnel? I only see win32 installers on the downloads page. 2. Are there formal (or informal) instructions for upgrading an existing stunnel installation? Thanks in advance, CJD

1 0

zlib1.dll not installed
by Gonzalo Costantini 01 Aug '18

01 Aug '18

Hi, The installer stunnel-5.48-win32-installer.exe do not copy zlib1.dll in any directory; this problem begins with the installer stunnel-5.44-win32-installer. Thaks. -- Luis Gonzalo Costantini Rickel Clave GPG (GPG Key): Fingerprint: 081069E0C552DFBDF53A0D2046ECD11A960D250F Key-ID.: 0x960D250F

1 0

Re: [stunnel-users] Is there a way to specify certificate content in stunnel config
by Eric S Eberhard 24 Jul '18

24 Jul '18

Use stunnel in inetd mode. Execute a script (or better C program). Copy the certificates for making the stunnel connection to a directory that is OK … then delete them immediately after stunnel starts. Hack – but might be OK for what you are doing. I am not sure why anyone would think it more secure to put the keys into the stunnel command than to just use them from a file … but I likely do not know enough about your application to make a judgement. Eric Eric S Eberhard VICS (Vertical Integrated Computer Systems) Voice: 928 567 3529 Cell : 928 301 7537 (not reliable except for text or if not home) 2933 W Middle Verde Rd Camp Verde, AZ 86322 From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Hari Sent: Thursday, July 19, 2018 4:42 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Is there a way to specify certificate content in stunnel config Hi, I have a requirement where in i cannot specify the certificate and/or private key details as "files" to stunnel configuration, owing to the location and/or file system availability for stunnel to access them. Is there a way to specify the actual certificate content in stunnel configuration (similar to other parameters like port numbers etc.,) so that the same can be leveraged. Thanks Hari <http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_cam…> Virus-free. <http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_cam…> www.avg.com

3 2

Grok log parsing
by Manuele Trimarchi 24 Jul '18

24 Jul '18

I would ask if someone use Grok log parsing for stunnel and, if yes, what kind of filter statement are you using? At the moment I've just created 2 parser: STUNNEL_AcceptedConnectionParser %{date("yyyy.MM.dd HH:mm:ss"):date} LOG%{integer:loglevel}\[%{integer:session_id}\]\: Service \[%{word:csb_name}\-%{word:csb_port}\] accepted connection from %{ipv4:caller_ip}\:%{port:caller_port} and STUNNEL_ConnectionClosedParser %{date("yyyy.MM.dd HH:mm:ss"):date} LOG%{integer:loglevel}\[%{integer:session_id}\]\: Connection closed\: %{integer:byte_tx} byte$s$ sent to SSL\, %{integer:byte_rx} byte$s$ sent to socket I'm new with Grok and all the things related to log match-and-parse, so I think that there will be a much better solution than mine, anyway Google this time doesn't help unfortunately. Thank you so much to all those who will help me with this stuff! Manuele

1 1

Cross Compiling Stunnel-5.48 Using BoringSSL
by Jaymin D 24 Jul '18

24 Jul '18

Hi All, I want to cross compile the Stunnel-5.48 for my Android AOSP (arch64) platform using BoringSSL's 'libssl.so' and 'libcrypto.so' libraries. I have successfully cross compiled the BoringSSL in my AOSP and both .so file was generated for arch64 platform. Am using BoringSSL which was delivered with Android AOSP (Android 7). Am cross compiling using "build-android.sh" script. But, while cross compiling the Stunnel-5.48 facing error as below: ------------------------------------------------------------------------------------------------ VERSION=5.48 > DST=stunnel-$VERSION-android > # to build OpenSSL: > # ./Configure threads no-shared no-dso > --cross-compile-prefix=arm-linux-androideabi- > --prefix=/opt/androideabi/sysroot linux-armv4 > # make install > LDFLAGS="$LDFLAGS -L/home/jaymin/Desktop/boringssl_lib -fPIE" > export LDFLAGS > test -f Makefile && make distclean > mkdir -p bin/android > cd bin/android > ../../configure --with-pic --enable-shared --with-sysroot > --host=aarch64-linux-android --with-ssl=/home/jaymin/Desktop/boringssl_lib > configure: **************************************** initialization > checking for a BSD-compatible install... /usr/bin/install -c > checking whether build environment is sane... yes > checking for aarch64-linux-android-strip... no > checking for strip... strip > checking for a thread-safe mkdir -p... /bin/mkdir -p > checking for gawk... gawk > checking whether make sets $(MAKE)... yes > checking whether make supports nested variables... yes > checking build system type... x86_64-pc-linux-gnu > checking host system type... aarch64-unknown-linux-android > checking for aarch64-linux-android-gcc... no > checking for gcc... gcc > checking whether the C compiler works... yes > checking for C compiler default output file name... a.out > checking for suffix of executables... > checking whether we are cross compiling... no > checking for suffix of object files... o > checking whether we are using the GNU C compiler... yes > checking whether gcc accepts -g... yes > checking for gcc option to accept ISO C89... none needed > checking whether gcc understands -c and -o together... yes > checking for style of include used by make... GNU > checking dependency style of gcc... gcc3 > checking whether make sets $(MAKE)... (cached) yes > checking whether make supports nested variables... (cached) yes > configure: **************************************** thread model > checking for a sed that does not truncate output... /bin/sed > checking how to run the C preprocessor... gcc -E > checking for grep that handles long lines and -e... /bin/grep > checking for egrep... /bin/grep -E > checking whether gcc is Clang... no > checking whether pthreads work with -pthread... yes > checking for joinable pthread attribute... PTHREAD_CREATE_JOINABLE > checking whether more special flags are required for pthreads... no > checking for PTHREAD_PRIO_INHERIT... yes > configure: PTHREAD thread model detected > configure: **************************************** compiler/linker flags > checking whether C compiler accepts -Wall... yes > checking whether C compiler accepts -Wextra... yes > checking whether C compiler accepts -Wpedantic... yes > checking whether C compiler accepts -Wformat=2... yes > checking whether C compiler accepts -Wconversion... yes > checking whether C compiler accepts -Wno-long-long... yes > checking whether C compiler accepts -Wno-deprecated-declarations... yes > checking whether C compiler accepts -fPIE... yes > checking whether C compiler accepts -fstack-protector... yes > checking whether the linker accepts -fPIE... yes > checking whether the linker accepts -pie... yes > checking whether the linker accepts -Wl,-z,relro... yes > checking whether the linker accepts -Wl,-z,now... yes > checking whether the linker accepts -Wl,-z,noexecstack... yes > checking whether C compiler accepts -D_FORTIFY_SOURCE=2... yes > configure: **************************************** libtool > checking how to print strings... printf > checking for a sed that does not truncate output... (cached) /bin/sed > checking for fgrep... /bin/grep -F > checking for ld used by gcc... /usr/bin/ld > checking if the linker (/usr/bin/ld) is GNU ld... yes > checking for BSD- or MS-compatible name lister (nm)... no > checking for aarch64-linux-android-dumpbin... no > checking for aarch64-linux-android-link... no > checking for dumpbin... no > checking for link... link -dump > checking the name lister (nm) interface... BSD nm > checking whether ln -s works... yes > checking the maximum length of command line arguments... 1572864 > checking how to convert x86_64-pc-linux-gnu file names to > aarch64-unknown-linux-android format... func_convert_file_noop > checking how to convert x86_64-pc-linux-gnu file names to toolchain > format... func_convert_file_noop > checking for /usr/bin/ld option to reload object files... -r > checking for aarch64-linux-android-objdump... no > checking for objdump... objdump > checking how to recognize dependent libraries... pass_all > checking for aarch64-linux-android-dlltool... no > checking for dlltool... no > checking how to associate runtime and link libraries... printf %s\n > checking for aarch64-linux-android-ar... no > checking for ar... ar > checking for archiver @FILE support... @ > checking for aarch64-linux-android-strip... strip > checking for aarch64-linux-android-ranlib... no > checking for ranlib... ranlib > checking command to parse nm output from gcc object... ok > checking for sysroot... / > checking for a working dd... /bin/dd > checking how to truncate binary pipes... /bin/dd bs=4096 count=1 > checking for aarch64-linux-android-mt... no > checking for mt... mt > checking if mt is a manifest tool... no > checking for ANSI C header files... yes > checking for sys/types.h... yes > checking for sys/stat.h... yes > checking for stdlib.h... yes > checking for string.h... yes > checking for memory.h... yes > checking for strings.h... yes > checking for inttypes.h... yes > checking for stdint.h... yes > checking for unistd.h... yes > checking for dlfcn.h... yes > checking for objdir... .libs > checking if gcc supports -fno-rtti -fno-exceptions... no > checking for gcc option to produce PIC... -fPIC -DPIC > checking if gcc PIC flag -fPIC -DPIC works... yes > checking if gcc static flag -static works... no > checking if gcc supports -c -o file.o... yes > checking if gcc supports -c -o file.o... (cached) yes > checking whether the gcc linker (/usr/bin/ld) supports shared libraries... > yes > checking whether -lc should be explicitly linked in... no > checking dynamic linker characteristics... Android linker > checking how to hardcode library paths into programs... immediate > checking whether stripping libraries is possible... yes > checking if libtool supports shared libraries... yes > checking whether to build shared libraries... yes > checking whether to build static libraries... no > configure: **************************************** types > checking for int8_t... yes > checking for int16_t... yes > checking for int32_t... yes > checking for int64_t... yes > checking for uint8_t... yes > checking for uint16_t... yes > checking for uint32_t... yes > checking for uint64_t... yes > checking for size_t... yes > checking for ssize_t... yes > checking for uid_t in sys/types.h... yes > checking for socklen_t... yes > checking for struct sockaddr_un... yes > checking for struct addrinfo... yes > configure: **************************************** PTY device files > checking for "/dev/ptmx"... yes > checking for "/dev/ptc"... no > configure: **************************************** entropy sources > checking for "/dev/urandom"... yes > configure: **************************************** default group > checking for default group... nogroup > checking for special C compiler options needed for large files... no > checking for _FILE_OFFSET_BITS value needed for large files... no > configure: **************************************** header files > checking for stdint.h... (cached) yes > checking for inttypes.h... (cached) yes > checking malloc.h usability... yes > checking malloc.h presence... yes > checking for malloc.h... yes > checking ucontext.h usability... yes > checking ucontext.h presence... yes > checking for ucontext.h... yes > checking pthread.h usability... yes > checking pthread.h presence... yes > checking for pthread.h... yes > checking poll.h usability... yes > checking poll.h presence... yes > checking for poll.h... yes > checking tcpd.h usability... no > checking tcpd.h presence... no > checking for tcpd.h... no > checking stropts.h usability... yes > checking stropts.h presence... yes > checking for stropts.h... yes > checking grp.h usability... yes > checking grp.h presence... yes > checking for grp.h... yes > checking for unistd.h... (cached) yes > checking util.h usability... no > checking util.h presence... no > checking for util.h... no > checking libutil.h usability... no > checking libutil.h presence... no > checking for libutil.h... no > checking pty.h usability... yes > checking pty.h presence... yes > checking for pty.h... yes > checking limits.h usability... yes > checking limits.h presence... yes > checking for limits.h... yes > checking for sys/types.h... (cached) yes > checking sys/select.h usability... yes > checking sys/select.h presence... yes > checking for sys/select.h... yes > checking sys/poll.h usability... yes > checking sys/poll.h presence... yes > checking for sys/poll.h... yes > checking sys/socket.h usability... yes > checking sys/socket.h presence... yes > checking for sys/socket.h... yes > checking sys/un.h usability... yes > checking sys/un.h presence... yes > checking for sys/un.h... yes > checking sys/ioctl.h usability... yes > checking sys/ioctl.h presence... yes > checking for sys/ioctl.h... yes > checking sys/filio.h usability... no > checking sys/filio.h presence... no > checking for sys/filio.h... no > checking sys/resource.h usability... yes > checking sys/resource.h presence... yes > checking for sys/resource.h... yes > checking sys/uio.h usability... yes > checking sys/uio.h presence... yes > checking for sys/uio.h... yes > checking sys/syscall.h usability... yes > checking sys/syscall.h presence... yes > checking for sys/syscall.h... yes > checking linux/sched.h usability... yes > checking linux/sched.h presence... yes > checking for linux/sched.h... yes > checking for struct msghdr.msg_control... yes > checking for linux/netfilter_ipv4.h... yes > configure: **************************************** libraries > checking for library containing gethostbyname... none required > checking for library containing yp_get_default_domain... -lnsl > checking for library containing socket... none required > checking for library containing openpty... -lutil > checking for library containing dlopen... -ldl > checking for library containing shl_load... no > configure: **************************************** library functions > checking for snprintf... yes > checking for vsnprintf... yes > checking for openpty... yes > checking for _getpty... no > checking for daemon... yes > checking for waitpid... yes > checking for wait4... yes > checking for setsid... yes > checking for setgroups... yes > checking for chroot... yes > checking for realpath... yes > checking for sysconf... yes > checking for getrlimit... yes > checking for pthread_sigmask... yes > checking for localtime_r... yes > checking for getcontext... yes > checking for __makecontext_v2... no > checking for poll... yes > checking for gethostbyname2... yes > checking for endhostent... yes > checking for getnameinfo... yes > checking for getaddrinfo... yes > checking for broken poll() implementation... no > checking for pipe2... yes > checking for accept4... yes > configure: **************************************** optional features > checking whether to enable IPv6 support... yes (default) > checking whether to enable FIPS support... autodetecting > checking whether to enable systemd socket activation support... > autodetecting > checking for library containing sd_listen_fds... no > configure: systemd library not found > checking whether to enable TCP wrappers support... autodetecting > checking for hosts_access in -lwrap... no > configure: libwrap library not found > configure: **************************************** TLS > checking for compiler sysroot... / > checking for TLS directory... /home/jaymin/Desktop/boringssl_lib > checking for FIPS_mode_set... yes > configure: FIPS support enabled > configure: **************************************** write the results > checking that generated files are newer than configure... done > configure: creating ./config.status > config.status: creating Makefile > config.status: creating src/Makefile > config.status: creating doc/Makefile > config.status: creating tools/Makefile > config.status: creating tests/Makefile > config.status: creating src/config.h > config.status: src/config.h is unchanged > config.status: executing depfiles commands > config.status: executing libtool commands > configure: **************************************** success > make clean > Making clean in src > make[1]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/src' > rm -f stunnel > test -z "stunnel3" || rm -f stunnel3 > rm -rf .libs _libs > rm -rf ../obj ../bin > test -z "libstunnel.la" || rm -f libstunnel.la > rm -f ./so_locations > rm -f *.o > rm -f *.lo > make[1]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/src' > Making clean in doc > make[1]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/doc' > test -z "stunnel.8 stunnel.pl.8 stunnel.html stunnel.pl.html" || rm -f > stunnel.8 stunnel.pl.8 stunnel.html stunnel.pl.html > rm -rf .libs _libs > rm -f *.lo > make[1]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/doc' > Making clean in tools > make[1]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/tools' > test -z "stunnel.conf-sample stunnel.init stunnel.service" || rm -f > stunnel.conf-sample stunnel.init stunnel.service > rm -rf .libs _libs > rm -f *.lo > make[1]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/tools' > Making clean in tests > make[1]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/tests' > rm -rf .libs _libs > rm -f *.lo > make[1]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/tests' > make[1]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android' > rm -rf .libs _libs > rm -f *.lo > make[1]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android' > make > Making all in src > make[1]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/src' > make all-am > make[2]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/src' > CC env.lo > CCLD libstunnel.la > CC stunnel-tls.o > CC stunnel-str.o > CC stunnel-file.o > CC stunnel-client.o > CC stunnel-log.o > CC stunnel-options.o > CC stunnel-protocol.o > CC stunnel-network.o > CC stunnel-resolver.o > CC stunnel-ssl.o > CC stunnel-ctx.o > CC stunnel-verify.o > CC stunnel-sthreads.o > CC stunnel-fd.o > CC stunnel-dhparam.o > CC stunnel-cron.o > CC stunnel-stunnel.o > CC stunnel-pty.o > CC stunnel-libwrap.o > CC stunnel-ui_unix.o > CCLD stunnel > /usr/bin/ld: skipping incompatible > /home/jaymin/Desktop/boringssl_lib/libssl.so when searching for -lssl > /usr/bin/ld: skipping incompatible > /home/jaymin/Desktop/boringssl_lib/libcrypto.so when searching for -lcrypto > stunnel-str.o: In function `str_leak_debug': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/str.c:459: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/str.c:470: > undefined reference to `CRYPTO_THREAD_unlock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/str.c:501: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/str.c:509: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-client.o: In function `session_cache_retrieve': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:568: > undefined reference to `CRYPTO_THREAD_read_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:581: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-client.o: In function `ssl_start': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:501: > undefined reference to `OpenSSL_version_num' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:519: > undefined reference to `CRYPTO_THREAD_unlock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:511: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:502: > undefined reference to `OpenSSL_version_num' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:503: > undefined reference to `OpenSSL_version_num' > stunnel-client.o: In function `print_cipher': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:595: > undefined reference to `SSL_session_reused' > stunnel-client.o: In function `idx_cache_retrieve': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1446: > undefined reference to `SSL_session_reused' > stunnel-client.o: In function `idx_cache_save': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1432: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1436: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-client.o: In function `idx_cache_retrieve': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1447: > undefined reference to `CRYPTO_THREAD_read_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1453: > undefined reference to `CRYPTO_THREAD_unlock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1469: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-client.o: In function `client_run': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:224: > undefined reference to `CRYPTO_atomic_add' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:323: > undefined reference to `CRYPTO_atomic_add' > stunnel-log.o: In function `log_close': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:109: > undefined reference to `CRYPTO_THREAD_write_lock' > stunnel-log.o: In function `s_log': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:165: > undefined reference to `CRYPTO_THREAD_read_lock' > stunnel-log.o: In function `log_queue': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:194: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:201: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-log.o: In function `s_log': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:170: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-log.o: In function `log_flush': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:205: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:211: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:219: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-log.o: In function `log_close': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:115: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-log.o: In function `log_flush': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:220: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-options.o: In function `engine_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:4219: > undefined reference to `OPENSSL_init_crypto' > stunnel-options.o: In function `service_up_ref': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:614: > undefined reference to `CRYPTO_atomic_add' > stunnel-options.o: In function `parse_global_option': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:681: > undefined reference to `OpenSSL_version_num' > stunnel-options.o: In function `tls_methods_set': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:3514: > undefined reference to `TLS_client_method' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:3515: > undefined reference to `TLS_server_method' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:3506: > undefined reference to `TLS_client_method' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:3507: > undefined reference to `TLS_server_method' > stunnel-options.o: In function `service_up_ref': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:614: > undefined reference to `CRYPTO_atomic_add' > stunnel-options.o: In function `service_free': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:624: > undefined reference to `CRYPTO_atomic_add' > stunnel-ssl.o: In function `ssl_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ssl.c:56: > undefined reference to `OPENSSL_init_ssl' > stunnel-ssl.o: In function `sk_SSL_COMP_pop': > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:846: undefined > reference to `OPENSSL_sk_pop' > stunnel-ssl.o: In function `sk_SSL_COMP_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:846: undefined > reference to `OPENSSL_sk_num' > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:846: undefined > reference to `OPENSSL_sk_num' > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:846: undefined > reference to `OPENSSL_sk_num' > stunnel-ssl.o: In function `sk_SSL_COMP_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:846: undefined > reference to `OPENSSL_sk_value' > stunnel-ssl.o: In function `compression_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ssl.c:217: > undefined reference to `SSL_COMP_get0_name' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ssl.c:221: > undefined reference to `SSL_COMP_get_id' > stunnel-ssl.o: In function `ssl_configure': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ssl.c:127: > undefined reference to `OPENSSL_init_crypto' > stunnel-ssl.o: In function `compression_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ssl.c:201: > undefined reference to `COMP_get_type' > stunnel-ctx.o: In function `info_callback': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:1231: > undefined reference to `SSL_get_state' > stunnel-ctx.o: In function `session_cache_save': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:981: > undefined reference to `SSL_SESSION_up_ref' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:986: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:999: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-ctx.o: In function `sk_X509_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_value' > stunnel-ctx.o: In function `sk_X509_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_num' > stunnel-ctx.o: In function `session_cache_save': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:999: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-ctx.o: In function `context_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:154: > undefined reference to `SSL_CTX_set_options' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:157: > undefined reference to `SSL_CTX_clear_options' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:161: > undefined reference to `SSL_CTX_set_options' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:164: > undefined reference to `SSL_CTX_clear_options' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:170: > undefined reference to `SSL_CTX_get_options' > stunnel-ctx.o: In function `dh_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:328: > undefined reference to `SSL_CTX_get_ciphers' > stunnel-ctx.o: In function `sk_SSL_CIPHER_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:845: undefined > reference to `OPENSSL_sk_num' > stunnel-ctx.o: In function `sk_SSL_CIPHER_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:845: undefined > reference to `OPENSSL_sk_value' > stunnel-ctx.o: In function `dh_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:356: > undefined reference to `CRYPTO_THREAD_read_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:358: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-verify.o: In function `ocsp_request': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/verify.c:539: > undefined reference to `X509_STORE_CTX_get0_chain' > stunnel-verify.o: In function `get_current_issuer': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/verify.c:701: > undefined reference to `X509_STORE_CTX_get0_chain' > stunnel-verify.o: In function `sk_X509_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_num' > stunnel-verify.o: In function `sk_X509_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_value' > stunnel-verify.o: In function `sk_OPENSSL_STRING_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/safestack.h:151: > undefined reference to `OPENSSL_sk_value' > stunnel-verify.o: In function `sk_OPENSSL_STRING_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/safestack.h:151: > undefined reference to `OPENSSL_sk_num' > stunnel-verify.o: In function `cert_check_local': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/verify.c:353: > undefined reference to `X509_STORE_CTX_get1_certs' > stunnel-verify.o: In function `sk_X509_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_num' > stunnel-verify.o: In function `sk_X509_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_value' > stunnel-verify.o: In function `sk_X509_pop_free': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_pop_free' > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_pop_free' > stunnel-verify.o: In function `sk_X509_NAME_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:75: undefined > reference to `OPENSSL_sk_num' > stunnel-verify.o: In function `sk_X509_NAME_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:75: undefined > reference to `OPENSSL_sk_value' > stunnel-sthreads.o: In function `locking_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/sthreads.c:358: > undefined reference to `CRYPTO_THREAD_lock_new' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/sthreads.c:358: > undefined reference to `CRYPTO_THREAD_lock_new' > stunnel-dhparam.o: In function `get_dh2048': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/dhparam.c:49: > undefined reference to `DH_set0_pqg' > stunnel-cron.o: In function `cron_dh_param': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/cron.c:193: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/cron.c:196: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-stunnel.o: In function `stunnel_info': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/stunnel.c:887: > undefined reference to `OpenSSL_version' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/stunnel.c:889: > undefined reference to `OpenSSL_version' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/stunnel.c:890: > undefined reference to `OpenSSL_version_num' > collect2: error: ld returned 1 exit status > Makefile:538: recipe for target 'stunnel' failed > make[2]: *** [stunnel] Error 1 > make[2]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/src' > Makefile:401: recipe for target 'all' failed > make[1]: *** [all] Error 2 > make[1]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/src' > Makefile:447: recipe for target 'all-recursive' failed > make: *** [all-recursive] Error 1 ------------------------------------------------------------------------------------------------ As I want to use SSL, did modification as below: --------------------------------------------------------------------------------------------- #!/bin/sh > set -ev > VERSION=5.48 > DST=stunnel-$VERSION-android > # to build OpenSSL: > # ./Configure threads no-shared no-dso > --cross-compile-prefix=arm-linux-androideabi- > --prefix=/opt/androideabi/sysroot linux-armv4 > # make install > LDFLAGS="$LDFLAGS -L/home/jaymin/Desktop/boringssl_lib -fPIE" > export LDFLAGS > test -f Makefile && make distclean > mkdir -p bin/android > cd bin/android > ../../configure --with-pic --enable-shared --with-sysroot > --host=aarch64-linux-android --with-ssl=/home/jaymin/Desktop/boringssl_lib > make clean > make > cd ../.. > mkdir $DST > cp bin/android/src/stunnel $DST > # arm-linux-androideabi-strip $DST/stunnel $DST/openssl > # cp /opt/androideabi/sysroot/bin/openssl $DST > # arm-linux-androideabi-strip $DST/openssl > zip -r $DST.zip $DST > rm -rf $DST > # sha256sum $DST.zip > # mv $DST.zip ../dist/ --------------------------------------------------------------------------------------------- How can I cross compile the Stunnel-5.48 using this BoringSSL? Are my BoringSSL's .so files incompatible? Any suggestions. Regards, Jaymin

1 0

"Reverse" tunneling with stunnel.
by C. Petro 20 Jul '18

20 Jul '18

I have a client who is setting up a logging infrastructure involving a couple of DMZs forwarding logs into central logging points. They have to pass compliance audits (SOX, PCI at least) and have some rather specific desires in regards to how they want the log traffic to move, and which servers *initiate* the connections. Which is to say they want the internal servers to set up tunnels to the DMZ servers and then the forwarders use that tunnel to deliver logs back. Lemme see if I can ascii art this: central1----------------------------------dmz1 \____________________ / _____________________\ _/ / \ central2----------------------------------dmz2 Something like that. Central1=10.10.1.2 Central2=10.9.1.2 DMZ1=172.18.0.5 DMZ2=172.20.0.5 Firewalls are in effect. I have gotten it set up so that I can initiate a connection FROM Central1 to DMZ2. [Tunnel_to_DMZ2] client = yes accept = 3002 connect = 172.20.0.5:5000 And [Tunnel_from_Central1] accept = 5000 connect = 3000 Like I said, I can open a tunnel from Central1 to DMZ2, but can't get traffic to pass backwards--I get a message in the log saying the session is closed. Is it possible to set stunnel up in a "reverse tunnel" mode--one where the connect is initiated from one end, but the other does most of the message passing? What I am missing? Thanks, Petro.

2 2

TLS alert (read): fatal: bad record mac (windows)
by Per Gunnarsson 19 Jul '18

19 Jul '18

I found it after looking once more in the log file. PSK client configured for identity "ï»¿user2" (the identity in the secrets.txt is user2:secretkey, somehow those three weird characters are added on windows) I got around it by copying the secrets.txt file to the server so that the secrets.txt on the server also begins with "ï»¿user2" but I suspect it's a bug. Regards, Per Gunnarsson

1 0

Is there a way to specify certificate content in stunnel config
by Hari 19 Jul '18

19 Jul '18

Hi, I have a requirement where in i cannot specify the certificate and/or private key details as "files" to stunnel configuration, owing to the location and/or file system availability for stunnel to access them. Is there a way to specify the actual certificate content in stunnel configuration (similar to other parameters like port numbers etc.,) so that the same can be leveraged. ThanksHari | | Virus-free. www.avg.com |

1 0

TLS alert (read): fatal: bad record mac (windows)
by Per Gunnarsson 19 Jul '18

19 Jul '18

Hello! I am trying to set up stunnel from a windows box to a VPS. I have working tunnels from a FreeBSD box to the VPS. On the VPS, the config looks like: [socks_server] protocol = socks PSKsecrets = /my/secret/location/secrets.txt accept = xxx.xxx.xxx.xxx:xxxx [ssh] PSKsecrets = /my/secret/location/hecrets.txt accept = xxx.xxx.xxx.xxx:xxxx connect = 127.0.0.1:22 On the windows box, the config looks like this: [socks_client2] debug = 7 client = yes PSKsecrets = c:\my\secret\location\secrets.txt accept = 127.0.0.1:1080 connect = xxx.xxx.xxx.xxx:xxxx The log on Windows looks like this: 2018.07.19 13:13:09 LOG5[main]: stunnel 5.48 on x86-pc-msvc-1500 platform 2018.07.19 13:13:09 LOG5[main]: Compiled/running with OpenSSL 1.0.2o-fips 27 Mar 2018 2018.07.19 13:13:09 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2018.07.19 13:13:09 LOG5[main]: Reading configuration from file stunnel.conf 2018.07.19 13:13:09 LOG5[main]: UTF-8 byte order mark detected 2018.07.19 13:13:09 LOG5[main]: FIPS mode disabled 2018.07.19 13:13:09 LOG5[main]: Configuration successful 2018.07.19 13:13:11 LOG7[0]: Service [socks_client2] started 2018.07.19 13:13:11 LOG7[0]: Setting local socket options (FD=460) 2018.07.19 13:13:11 LOG7[0]: Option TCP_NODELAY set on local socket 2018.07.19 13:13:11 LOG5[0]: Service [socks_client2] accepted connection from 127.0.0.1:56598 2018.07.19 13:13:11 LOG6[0]: s_connect: connecting xxx.xxx.xxx.xxx:xxxx 2018.07.19 13:13:11 LOG7[0]: s_connect: s_poll_wait xxx.xxx.xxx.xxx:xxxx: waiting 10 seconds 2018.07.19 13:13:11 LOG5[0]: s_connect: connected xxx.xxx.xxx.xxx:xxxx 2018.07.19 13:13:11 LOG5[0]: Service [socks_client2] connected remote server from 192.168.1.65:56599 2018.07.19 13:13:11 LOG7[0]: Setting remote socket options (FD=508) 2018.07.19 13:13:11 LOG7[0]: Option TCP_NODELAY set on remote socket 2018.07.19 13:13:11 LOG7[0]: Remote descriptor (FD=508) initialized 2018.07.19 13:13:11 LOG6[0]: SNI: sending servername: xxx.xxx.xxx.xxx 2018.07.19 13:13:11 LOG6[0]: Peer certificate not required 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): before/connect initialization 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv2/v3 write client hello A 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv3 read server hello A 2018.07.19 13:13:11 LOG6[0]: Client certificate not requested 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv3 read server done A 2018.07.19 13:13:11 LOG6[0]: PSK client configured for identity "ï»¿user2" 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv3 write client key exchange A 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv3 write change cipher spec A 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv3 write finished A 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv3 flush data 2018.07.19 13:13:11 LOG3[0]: SSL_connect: Peer suddenly disconnected 2018.07.19 13:13:11 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.07.19 13:13:11 LOG7[0]: Deallocating application specific data for session connect address 2018.07.19 13:13:11 LOG7[0]: Remote descriptor (FD=508) closed 2018.07.19 13:13:11 LOG7[0]: Local descriptor (FD=460) closed 2018.07.19 13:13:11 LOG7[0]: Service [socks_client2] finished (0 left) 2018.07.19 13:13:34 LOG7[1]: Service [socks_client2] started 2018.07.19 13:13:34 LOG7[1]: Setting local socket options (FD=528) 2018.07.19 13:13:34 LOG7[1]: Option TCP_NODELAY set on local socket 2018.07.19 13:13:34 LOG5[1]: Service [socks_client2] accepted connection from 127.0.0.1:56601 2018.07.19 13:13:34 LOG6[1]: s_connect: connecting xxx.xxx.xxx.xxx:xxxx 2018.07.19 13:13:34 LOG7[1]: s_connect: s_poll_wait xxx.xxx.xxx.xxx:xxxx: waiting 10 seconds 2018.07.19 13:13:34 LOG5[1]: s_connect: connected xxx.xxx.xxx.xxx:xxxx 2018.07.19 13:13:34 LOG5[1]: Service [socks_client2] connected remote server from 192.168.1.65:56602 2018.07.19 13:13:34 LOG7[1]: Setting remote socket options (FD=536) 2018.07.19 13:13:34 LOG7[1]: Option TCP_NODELAY set on remote socket 2018.07.19 13:13:34 LOG7[1]: Remote descriptor (FD=536) initialized 2018.07.19 13:13:34 LOG6[1]: SNI: sending servername: xxx.xxx.xxx.xxx 2018.07.19 13:13:34 LOG6[1]: Peer certificate not required 2018.07.19 13:13:34 LOG7[1]: TLS state (connect): before/connect initialization 2018.07.19 13:13:34 LOG7[1]: TLS state (connect): SSLv2/v3 write client hello A 2018.07.19 13:13:35 LOG7[1]: TLS state (connect): SSLv3 read server hello A 2018.07.19 13:13:35 LOG6[1]: Client certificate not requested 2018.07.19 13:13:35 LOG7[1]: TLS state (connect): SSLv3 read server done A 2018.07.19 13:13:35 LOG6[1]: PSK client configured for identity "ï»¿user2" 2018.07.19 13:13:35 LOG7[1]: TLS state (connect): SSLv3 write client key exchange A 2018.07.19 13:13:35 LOG7[1]: TLS state (connect): SSLv3 write change cipher spec A 2018.07.19 13:13:35 LOG7[1]: TLS state (connect): SSLv3 write finished A 2018.07.19 13:13:35 LOG7[1]: TLS state (connect): SSLv3 flush data 2018.07.19 13:13:35 LOG7[1]: TLS alert (read): fatal: bad record mac 2018.07.19 13:13:35 LOG3[1]: SSL_connect: 140943FC: error:140943FC:SSL routines:ssl3_read_bytes:sslv3 alert bad record mac 2018.07.19 13:13:35 LOG5[1]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.07.19 13:13:35 LOG7[1]: Deallocating application specific data for session connect address 2018.07.19 13:13:35 LOG7[1]: Remote descriptor (FD=536) closed 2018.07.19 13:13:35 LOG7[1]: Local descriptor (FD=528) closed 2018.07.19 13:13:35 LOG7[1]: Service [socks_client2] finished (0 left) 2018.07.19 13:14:06 LOG7[2]: Service [socks_client2] started 2018.07.19 13:14:06 LOG7[2]: Setting local socket options (FD=1880) 2018.07.19 13:14:06 LOG7[2]: Option TCP_NODELAY set on local socket 2018.07.19 13:14:06 LOG5[2]: Service [socks_client2] accepted connection from 127.0.0.1:56604 2018.07.19 13:14:06 LOG6[2]: s_connect: connecting xxx.xxx.xxx.xxx:xxxx 2018.07.19 13:14:06 LOG7[2]: s_connect: s_poll_wait xxx.xxx.xxx.xxx:xxxx: waiting 10 seconds 2018.07.19 13:14:06 LOG5[2]: s_connect: connected xxx.xxx.xxx.xxx:xxxx 2018.07.19 13:14:06 LOG5[2]: Service [socks_client2] connected remote server from 192.168.1.65:56605 2018.07.19 13:14:06 LOG7[2]: Setting remote socket options (FD=2044) 2018.07.19 13:14:06 LOG7[2]: Option TCP_NODELAY set on remote socket 2018.07.19 13:14:06 LOG7[2]: Remote descriptor (FD=2044) initialized 2018.07.19 13:14:06 LOG6[2]: SNI: sending servername: xxx.xxx.xxx.xxx 2018.07.19 13:14:06 LOG6[2]: Peer certificate not required 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): before/connect initialization 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv2/v3 write client hello A 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv3 read server hello A 2018.07.19 13:14:06 LOG6[2]: Client certificate not requested 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv3 read server done A 2018.07.19 13:14:06 LOG6[2]: PSK client configured for identity "ï»¿user2" 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv3 write client key exchange A 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv3 write change cipher spec A 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv3 write finished A 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv3 flush data 2018.07.19 13:14:06 LOG7[2]: TLS alert (read): fatal: bad record mac 2018.07.19 13:14:06 LOG3[2]: SSL_connect: 140943FC: error:140943FC:SSL routines:ssl3_read_bytes:sslv3 alert bad record mac 2018.07.19 13:14:06 LOG5[2]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.07.19 13:14:06 LOG7[2]: Deallocating application specific data for session connect address 2018.07.19 13:14:06 LOG7[2]: Remote descriptor (FD=2044) closed 2018.07.19 13:14:06 LOG7[2]: Local descriptor (FD=1880) closed 2018.07.19 13:14:06 LOG7[2]: Service [socks_client2] finished (0 left)

1 0

Loss of ability to use Stunnel-Blat, and a solution
by Roger Bohl 10 Jul '18

10 Jul '18

Early in 2018, around the time when I upgraded my system to Windows 10, the Stunnel and Blat files that had worked fine with my Vista PC would not work with the new PC. However, the "bug" turned out to be unrelated to the change in operating systems, but rather an "upgrade" to Gmail: Coincidentally, about that time, Gmail evidently decided to stop accepting e-mails from apps deemed "a less secure app", including Stunnel-Blat, with Blat then displaying messages: *** Warning *** The SMTP server did not accept Auth PLAIN value. *** Warning *** Are your login userid and password correct? *** Warning *** The SMTP server did not accept Auth LOGIN PASSWD value. Only a failure message sent to my "backup e-mail address" led me to explore this as a possible cause for what I had thought was, but turned out not to be, a Stunnel-Blat problem. Gmail has an option to suppress this heightened security feature, and when I activated this option, my Stunnel-Blat tools immediately began to function as intended. While I was at first able to enable Gmail to "Allow access from "less secure accounts," I have been unable to get through Gmail options consistently to turn this on and off and share this info with others. (I would welcome instructions that work consistently.) I would also welcome guidance on how to include Stunnel-Blat as a specific alllowed app, without having to enable Gmail to enable *all* "less secure apps" Roger Bohl

3 3

Re: [stunnel-users] Intermittent error in 042_inetd
by Eric S Eberhard 10 Jul '18

10 Jul '18

The 50% could be because the server side is not fully updated - we have this problem a lot with very large companies that should know better (and in reality should overlap instead of changing over - meaning allow SSLv3 for 3 months or something while also accepting TLSv2. A very good way to test is to get a telnet program. Then "telnent localhost port#" - the port # being the port number stunnel is running on. This will remove all variables except stunnel and allow you to see the output. It could be you are connecting fine and failing some other authentication like a login - which you can see often with telnet. And set your firewall to not allow telnet on port 23. Also, we have found stunnel MUCH more reliable under inetd (if you are on Unix of course) than as a stand-alone server. A little performance loss that is unnoticeable to us - big customers exchange 2-4 million XML documents a day (using stunnel) so inetd is definitely not the most efficient way, but the machines are so darn fast it seems not to matter. The certificates have become more painful but I have never had to use an official signed one. I make my own with openssl. However, there are intermediate ones that are needed from whomever you connect to if they have a signed certificate - say from Verisign - you may need your certificate and Verisigns, etc - in a chain. I use "cacert" to set to a large file of .pem certificates - which I simply download from the Web (available all over, some work, some don't. When you get one that works . then use it. You can modify them by adding anything not found in the file. Supposedly the cacert file I have now is good till 2020 for the big names. You can also use openssl to get the certificate from the server - just ask and you shall receive. It should have the entire chain. I used to have on massive cacert for everyone and it was getting out of hand. As tacky as it is, I just make a cacert.pem file for every connection (e.g. Walmart, Fedex, Target, whatever). This allows working connections to keep working while you fiddle with a tricky one. Eric Eric S Eberhard VICS (Vertical Integrated Computer Systems) Voice: 928 567 3529 Cell : 928 301 7537 (not reliable except for text or if not home) 2933 W Middle Verde Rd Camp Verde, AZ 86322 From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Ian Bamforth Sent: Wednesday, July 04, 2018 9:00 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Intermittent error in 042_inetd Afternoon, Until recently we'd disabled `make test` because of certificate problems - we've re-enabled it (using `make check`) but are getting intermittent failures (around 50% of CI runs). Below is the output from the logs - I can't see what's gone wrong, can anyone shed any light? 2018.07.04 09:59:36 LOG7[ui]: Clients allowed=14648 2018.07.04 09:59:36 LOG7[ui]: errno: (*__errno_location ()) 2018.07.04 09:59:36 LOG7[ui]: Compression disabled 2018.07.04 09:59:36 LOG7[ui]: No PRNG seeding was required 2018.07.04 09:59:36 LOG7[ui]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2018.07.04 09:59:36 LOG7[ui]: TLS options: 0x02004004 (+0x00004000, -0x00000000) 2018.07.04 09:59:36 LOG7[ui]: Private key check succeeded 2018.07.04 09:59:36 LOG7[ui]: ECDH initialization 2018.07.04 09:59:36 LOG7[ui]: ECDH initialized with curve prime256v1 2018.07.04 09:59:36 LOG7[ui]: Binding service [server] 2018.07.04 09:59:36 LOG7[ui]: Listening file descriptor created (FD=6) 2018.07.04 09:59:36 LOG7[ui]: Setting accept socket options (FD=6) 2018.07.04 09:59:36 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2018.07.04 09:59:36 LOG7[main]: Created pid file /opt/stunnel/stunnel-5.48/tests/logs/stunnel.pid 2018.07.04 09:59:36 LOG7[cron]: Cron thread initialized 2018.07.04 09:59:36 LOG7[main]: Found 1 ready file descriptor(s) 2018.07.04 09:59:36 LOG7[main]: FD=4 events=0x2001 revents=0x0 2018.07.04 09:59:36 LOG7[main]: FD=6 events=0x2001 revents=0x1 2018.07.04 09:59:36 LOG7[main]: Service [server] accepted (FD=3) from 127.0.0.1:58890 2018.07.04 09:59:36 LOG7[0]: Service [server] started 2018.07.04 09:59:36 LOG7[0]: Setting local socket options (FD=3) 2018.07.04 09:59:36 LOG7[0]: Option TCP_NODELAY set on local socket 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): before SSL initialization 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): before SSL initialization 2018.07.04 09:59:36 LOG7[0]: SNI: no virtual services defined 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS read client hello 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write server hello 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write certificate 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write key exchange 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write server done 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write server done 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS read client key exchange 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS read change cipher spec 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS read finished 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write change cipher spec 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write finished 2018.07.04 09:59:36 LOG7[0]: New session callback 2018.07.04 09:59:36 LOG7[0]: 1 server accept(s) requested 2018.07.04 09:59:36 LOG7[0]: 1 server accept(s) succeeded 2018.07.04 09:59:36 LOG7[0]: 0 server renegotiation(s) requested 2018.07.04 09:59:36 LOG7[0]: 0 session reuse(s) 2018.07.04 09:59:36 LOG7[0]: 1 internal session cache item(s) 2018.07.04 09:59:36 LOG7[0]: 0 internal session cache fill-up(s) 2018.07.04 09:59:36 LOG7[0]: 0 internal session cache miss(es) 2018.07.04 09:59:36 LOG7[0]: 0 external session cache hit(s) 2018.07.04 09:59:36 LOG7[0]: 0 expired session(s) retrieved 2018.07.04 09:59:36 LOG7[0]: Compression: null, expansion: null 2018.07.04 09:59:36 LOG7[0]: Setting remote socket options (FD=10) 2018.07.04 09:59:36 LOG7[0]: Option TCP_NODELAY set on remote socket 2018.07.04 09:59:36 LOG7[0]: Remote descriptor (FD=10) initialized 2018.07.04 09:59:36 LOG7[0]: TLS alert (read): warning: close notify 2018.07.04 09:59:36 LOG7[0]: Sent socket write shutdown 2018.07.04 09:59:36 LOG7[0]: Remote descriptor (FD=10) closed 2018.07.04 09:59:36 LOG7[0]: Local descriptor (FD=3) closed 2018.07.04 09:59:36 LOG7[0]: Service [server] finished (0 left) 2018.07.04 09:59:36 LOG7[main]: Found 1 ready file descriptor(s) 2018.07.04 09:59:36 LOG7[main]: FD=4 events=0x2001 revents=0x1 2018.07.04 09:59:36 LOG7[main]: FD=6 events=0x2001 revents=0x0 2018.07.04 09:59:36 LOG7[main]: Dispatching a signal from the signal pipe 2018.07.04 09:59:36 LOG7[main]: Processing SIGCHLD 2018.07.04 09:59:36 LOG7[main]: Retrieving pid statuses with waitpid() 2018.07.04 09:59:36 LOG7[ui]: Clients allowed=14648 2018.07.04 09:59:36 LOG7[ui]: errno: (*__errno_location ()) 2018.07.04 09:59:36 LOG7[ui]: Compression disabled 2018.07.04 09:59:36 LOG7[ui]: No PRNG seeding was required 2018.07.04 09:59:36 LOG7[ui]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2018.07.04 09:59:36 LOG7[ui]: TLS options: 0x02000004 (+0x00000000, -0x00000000) 2018.07.04 09:59:36 LOG7[ui]: No certificate or private key specified 2018.07.04 09:59:36 LOG7[0]: Service [inetd client] started 2018.07.04 09:59:36 LOG7[0]: s_connect: s_poll_wait 127.0.0.1:4433: waiting 10 seconds 2018.07.04 09:59:36 LOG7[0]: Setting remote socket options (FD=3) 2018.07.04 09:59:36 LOG7[0]: Option TCP_NODELAY set on remote socket 2018.07.04 09:59:36 LOG7[0]: Remote descriptor (FD=3) initialized 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): before SSL initialization 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write client hello 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write client hello 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read server hello 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read server certificate 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read server key exchange 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read server done 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write client key exchange 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write change cipher spec 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write finished 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write finished 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read change cipher spec 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read finished 2018.07.04 09:59:36 LOG7[0]: New session callback 2018.07.04 09:59:36 LOG7[0]: Peer certificate was cached (1241 bytes) 2018.07.04 09:59:36 LOG7[0]: 1 client connect(s) requested 2018.07.04 09:59:36 LOG7[0]: 1 client connect(s) succeeded 2018.07.04 09:59:36 LOG7[0]: 0 client renegotiation(s) requested 2018.07.04 09:59:36 LOG7[0]: 0 session reuse(s) 2018.07.04 09:59:36 LOG7[0]: Compression: null, expansion: null 2018.07.04 09:59:36 LOG7[0]: Sending close_notify alert 2018.07.04 09:59:36 LOG7[0]: TLS alert (write): warning: close notify 2018.07.04 09:59:36 LOG7[0]: Remote descriptor (FD=3) closed 2018.07.04 09:59:36 LOG7[0]: Service [inetd client] finished (0 left) 2018.07.04 09:59:36 LOG7[0]: Deallocating section defaults 2018.07.04 09:59:36 LOG7[main]: Found 1 ready file descriptor(s) 2018.07.04 09:59:36 LOG7[main]: FD=4 events=0x2001 revents=0x1 2018.07.04 09:59:36 LOG7[main]: FD=6 events=0x2001 revents=0x0 2018.07.04 09:59:36 LOG7[main]: Dispatching a signal from the signal pipe 2018.07.04 09:59:36 LOG7[main]: Processing SIGNAL_TERMINATE 2018.07.04 09:59:36 LOG7[main]: Leak detection table utilization: 86/997, 8.63% 2018.07.04 09:59:36 LOG7[main]: Removed pid file /opt/stunnel/stunnel-5.48/tests/logs/stunnel.pid 2018.07.04 09:59:36 LOG7[main]: Deallocating section defaults Regards, Ian Bamforth Senior Software Engineer Operations & Planning Systems Division T: <tel:00441133443970> +44 (0)113 344 3970 M: <tel:00447852404240> +44 (0)7852 404240 E: <mailto:Ian.Bamforth@tracsis.com> Ian.Bamforth(a)tracsis.com W: <https://www.tracsis.com> www.tracsis.com <http://www.tracsisops.com> www.tracsisops.com Follow Us <https://www.linkedin.com/company/972873?trk=tyah&trkInfo=idx:1-1-1,tarId:14 20795682492,tas:tracsis> <https://www.twitter.com/tracsis> Tracsis plc Leeds Innovation Centre 103 Clarendon Road Leeds LS2 9DF <https://static.tracsis.com/email/award4.png> Tracsis Operations and Planning Systems Division is a Division of Tracsis plc and comprises Tracsis plc (05019106), Tracsis Rail Consultancy Limited (05047148), Safety Information Systems Limited trading as COMPASS (02588404) and Tracsis Retail and Operations Limited (04225250), all subsidiaries of Tracsis plc with a registered office at Leeds Innovation Centre,103 Clarendon Road, Leeds, LS2 9DF. VAT Registration No: 945 7876 61. This email and its attachments may be confidential and are intended solely for the use of the individual(s) to whom it is addressed. If you are not the intended recipient of this email and its attachments, you must take no action based upon them, nor must you copy or show them to anyone. Please contact the sender if you believe you have received this email in error.

2 1

Re: [stunnel-users] [EXTERNAL] Re: Stunnel connection issue?
by Eric S Eberhard 09 Jul '18

09 Jul '18

Exactly. Eric Eric S Eberhard VICS (Vertical Integrated Computer Systems) Voice: 928 567 3529 Cell : 928 301 7537 (not reliable except for text or if not home) 2933 W Middle Verde Rd Camp Verde, AZ 86322 -----Original Message----- From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Peter Pentchev Sent: Thursday, July 05, 2018 5:47 AM To: Spies, Will <Will_Spies(a)comcast.com> Cc: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] [EXTERNAL] Re: Stunnel connection issue? On Thu, Jul 05, 2018 at 11:41:18AM +0000, Spies, Will wrote: > Thanks for the quick response. The client is an Echo Show device and > there is no log. It is an RTSP connection and my backend (behind > Stunnel) is Live555ProxyServer. I read somewhere there is some bug > related to MSIE that closed the connection like this and the fix is to > use TIMEOUTclose=0 which I did but this did not help. This is the > earlier (startup) portion of my log: Hi, Unfortunately, without more information about what the client doesn't like about the established connection, I don't think there is anything more I can help you with :( You *might* try playing with stunnel's cipher settings (OpenSSL options), on the off chance that the client is somewhat confused and offers for negotiation a cipher or something that it later realizes it cannot support... but that would be really weird. G'luck, Peter -- Peter Pentchev roam(a){ringlet.net,debian.org,FreeBSD.org} pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

1 0

Re: [stunnel-users] [EXTERNAL] Re: Stunnel connection issue?
by Eric S Eberhard 09 Jul '18

09 Jul '18

I should also point out that the cipher suite is related to openssl version stunnel is compiled with. Again, we had customers that connected with TLSv1.3 and then could not negotiate a cipher suite ... leading to lost connection. Make sure you update openssl first -- then compile stunnel. Eric Eric S Eberhard VICS (Vertical Integrated Computer Systems) Voice: 928 567 3529 Cell : 928 301 7537 (not reliable except for text or if not home) 2933 W Middle Verde Rd Camp Verde, AZ 86322 -----Original Message----- From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Javier Sent: Monday, July 09, 2018 9:55 AM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] [EXTERNAL] Re: Stunnel connection issue? On Mon, 9 Jul 2018 12:26:08 +0000 Daniel Trickett <daniel.trickett(a)emdmillipore.com> wrote: > > Will, > > I was told to ignore the SSLv3 stuff in the log. I have options set to > allow only TLS1.2 and still see SSLv3 references in the log. > > Best regards, > > Dan Hi, in fact, the version can be disclosed from following lines in the log, where is told the cipher used, but not where you usually look: LOG6[1]: TLSv(1-1.1-1.2-1.3-whatever) ciphersuite: (whatever) Regards. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Stunnel connection issue?
by Spies, Will 09 Jul '18

09 Jul '18

I've been trying to get Stunnel to work for some time now. I have avoided using the mail list - but I see no recourse now. I think I've tried just about every setting I could find. I appear to be getting a connection issue - but as you will see the log just doesn't indicate clearly what is going on. The behavior is my client is failing to get a connection through Stunnel to my backend. The log appears to be closing a socket (but can't tell which one frontend or backend). Nothing wrong happens up until a client connects - 443 binds fine and later a connection to my backend 554 appears to connect find. If someone/anyone can help direct me to how to trouble shoot this better I would greatly appreciate it. As you will see in the log - the client attempts twice to get through. An excerpt of my log and the conf is below. /etc/stunnel.conf: socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 output = /var/log/stunnel.log debug=7 [rtsp] cert = /etc/stunnel/stunnel.pem accept=192.168.112.16:443 connect=192.168.112.16:554 TIMEOUTclose = 0 TIMEOUTbusy = 5 TIMEOUTidle = 30 delay = yes sslVersion = TLSv1.2 /var/log/stunnel.log: 2018.07.05 05:31:01 LOG7[main]: Service [rtsp] accepted (FD=3) from 192.168.112.197:43869 2018.07.05 05:31:01 LOG7[5]: Service [rtsp] started 2018.07.05 05:31:01 LOG7[5]: Setting local socket options (FD=3) 2018.07.05 05:31:01 LOG7[5]: Option TCP_NODELAY set on local socket 2018.07.05 05:31:01 LOG5[5]: Service [rtsp] accepted connection from 192.168.112.197:43869 2018.07.05 05:31:01 LOG6[5]: Peer certificate not required 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): before SSL initialization 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): before SSL initialization 2018.07.05 05:31:01 LOG7[5]: SNI: no virtual services defined 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS read client hello 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS write server hello 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS write certificate 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS write key exchange 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS write server done 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS write server done 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS read client key exchange 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS read change cipher spec 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS read finished 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS write change cipher spec 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS write finished 2018.07.05 05:31:01 LOG7[5]: New session callback 2018.07.05 05:31:01 LOG6[5]: No peer certificate received 2018.07.05 05:31:01 LOG7[5]: 6 server accept(s) requested 2018.07.05 05:31:01 LOG7[5]: 3 server accept(s) succeeded 2018.07.05 05:31:01 LOG7[5]: 0 server renegotiation(s) requested 2018.07.05 05:31:01 LOG7[5]: 0 session reuse(s) 2018.07.05 05:31:01 LOG7[5]: 3 internal session cache item(s) 2018.07.05 05:31:01 LOG7[5]: 0 internal session cache fill-up(s) 2018.07.05 05:31:01 LOG7[5]: 0 internal session cache miss(es) 2018.07.05 05:31:01 LOG7[5]: 0 external session cache hit(s) 2018.07.05 05:31:01 LOG7[5]: 0 expired session(s) retrieved 2018.07.05 05:31:01 LOG6[5]: TLS accepted: new session negotiated 2018.07.05 05:31:01 LOG6[5]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.07.05 05:31:01 LOG7[5]: Compression: null, expansion: null 2018.07.05 05:31:01 LOG6[5]: s_connect: connecting 192.168.112.16:554 2018.07.05 05:31:01 LOG7[5]: s_connect: s_poll_wait 192.168.112.16:554: waiting 10 seconds 2018.07.05 05:31:01 LOG5[5]: s_connect: connected 192.168.112.16:554 2018.07.05 05:31:01 LOG6[5]: persistence: 192.168.112.16:554 cached 2018.07.05 05:31:01 LOG5[5]: Service [rtsp] connected remote server from 192.168.112.16:58594 2018.07.05 05:31:01 LOG7[5]: Setting remote socket options (FD=9) 2018.07.05 05:31:01 LOG7[5]: Option TCP_NODELAY set on remote socket 2018.07.05 05:31:01 LOG7[5]: Remote descriptor (FD=9) initialized 2018.07.05 05:31:02 LOG6[5]: TLS socket closed (SSL_read) 2018.07.05 05:31:02 LOG7[5]: Sent socket write shutdown 2018.07.05 05:31:02 LOG5[5]: Connection closed: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.07.05 05:31:02 LOG7[5]: Remote descriptor (FD=9) closed 2018.07.05 05:31:02 LOG7[5]: Local descriptor (FD=3) closed 2018.07.05 05:31:02 LOG7[5]: Service [rtsp] finished (0 left) 2018.07.05 05:31:02 LOG7[main]: Found 1 ready file descriptor(s) 2018.07.05 05:31:02 LOG7[main]: FD=4 events=0x2001 revents=0x0 2018.07.05 05:31:02 LOG7[main]: FD=7 events=0x2001 revents=0x1 2018.07.05 05:31:02 LOG7[main]: Service [rtsp] accepted (FD=3) from 192.168.112.197:43870 2018.07.05 05:31:02 LOG7[6]: Service [rtsp] started 2018.07.05 05:31:02 LOG7[6]: Setting local socket options (FD=3) 2018.07.05 05:31:02 LOG7[6]: Option TCP_NODELAY set on local socket 2018.07.05 05:31:02 LOG5[6]: Service [rtsp] accepted connection from 192.168.112.197:43870 2018.07.05 05:31:02 LOG6[6]: Peer certificate not required 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): before SSL initialization 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): before SSL initialization 2018.07.05 05:31:02 LOG7[6]: SNI: no virtual services defined 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS read client hello 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS write server hello 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS write certificate 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS write key exchange 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS write server done 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS write server done 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS read client key exchange 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS read change cipher spec 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS read finished 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS write change cipher spec 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS write finished 2018.07.05 05:31:02 LOG7[6]: New session callback 2018.07.05 05:31:02 LOG6[6]: No peer certificate received 2018.07.05 05:31:02 LOG7[6]: 7 server accept(s) requested 2018.07.05 05:31:02 LOG7[6]: 4 server accept(s) succeeded 2018.07.05 05:31:02 LOG7[6]: 0 server renegotiation(s) requested 2018.07.05 05:31:02 LOG7[6]: 0 session reuse(s) 2018.07.05 05:31:02 LOG7[6]: 4 internal session cache item(s) 2018.07.05 05:31:02 LOG7[6]: 0 internal session cache fill-up(s) 2018.07.05 05:31:02 LOG7[6]: 0 internal session cache miss(es) 2018.07.05 05:31:02 LOG7[6]: 0 external session cache hit(s) 2018.07.05 05:31:02 LOG7[6]: 0 expired session(s) retrieved 2018.07.05 05:31:02 LOG6[6]: TLS accepted: new session negotiated 2018.07.05 05:31:02 LOG6[6]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.07.05 05:31:02 LOG7[6]: Compression: null, expansion: null 2018.07.05 05:31:02 LOG6[6]: s_connect: connecting 192.168.112.16:554 2018.07.05 05:31:02 LOG7[6]: s_connect: s_poll_wait 192.168.112.16:554: waiting 10 seconds 2018.07.05 05:31:02 LOG5[6]: s_connect: connected 192.168.112.16:554 2018.07.05 05:31:02 LOG6[6]: persistence: 192.168.112.16:554 cached 2018.07.05 05:31:02 LOG5[6]: Service [rtsp] connected remote server from 192.168.112.16:58596 2018.07.05 05:31:02 LOG7[6]: Setting remote socket options (FD=9) 2018.07.05 05:31:02 LOG7[6]: Option TCP_NODELAY set on remote socket 2018.07.05 05:31:02 LOG7[6]: Remote descriptor (FD=9) initialized 2018.07.05 05:31:02 LOG6[6]: TLS socket closed (SSL_read) 2018.07.05 05:31:02 LOG7[6]: Sent socket write shutdown 2018.07.05 05:31:02 LOG5[6]: Connection closed: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.07.05 05:31:02 LOG7[6]: Remote descriptor (FD=9) closed 2018.07.05 05:31:02 LOG7[6]: Local descriptor (FD=3) closed 2018.07.05 05:31:02 LOG7[6]: Service [rtsp] finished (0 left) 2018.07.05 05:31:05 LOG7[main]: Found 1 ready file descriptor(s) 2018.07.05 05:31:05 LOG7[main]: FD=4 events=0x2001 revents=0x0 2018.07.05 05:31:05 LOG7[main]: FD=7 events=0x2001 revents=0x1

6 12

Fwd: stunnel-users Digest, Vol 168, Issue 2
by Avinash Kumar 05 Jul '18

05 Jul '18

Regards, Avinash Kumar ---------- Forwarded message ---------- From: Avinash Kumar <avinash14331(a)gmail.com> Date: Wed, Jul 4, 2018 at 11:59 AM Subject: Re: [stunnel-users] stunnel-users Digest, Vol 168, Issue 2 To: "Jose Alf." <josealf(a)rocketmail.com> Hi, I commented sslVersion but still getting the same issue. Please find below my configuration details for both client and server: Server conf: Client Conf: Regards, Avinash Kumar On Tue, Jul 3, 2018 at 6:26 PM, Jose Alf. <josealf(a)rocketmail.com> wrote: > Kumar, > > Probably you are trying to connect to a server that dos not allow TLs > v1.0m a protocol that has been deprecated. Please Comment out the > sslVersion line and try again. > > regards, > > Jose > > > > On Tuesday, July 3, 2018, 6:37:53 AM GMT-5, Avinash Kumar < > avinash14331(a)gmail.com> wrote: > > > Hi, > > As requested, Posting my configuration. > [https-App-setup] client = yes accept = 9898 connect = > <<source-ipaddress>>:9898 cert = <<stunnel-installationdirectory>>\config\App\morpheus.pem > key = <<stunnel-installationdirectory>>\config\App\morpheus.key CAfile = > <<stunnel-installationdirectory>>\config\App\root-ca.pem sslVersion = > TLSv1 options = NO_SSLv3 > > > Regards, > Avinash Kumar > > On Tue, Jul 3, 2018 at 3:30 PM, <stunnel-users-request(a)stunnel.org> wrote: > > Send stunnel-users mailing list submissions to > stunnel-users(a)stunnel.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.stunnel.org/cgi- bin/mailman/listinfo/stunnel- users > <https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users> > or, via email, send a message with subject or body 'help' to > stunnel-users-request@stunnel. org > <stunnel-users-request(a)stunnel.org> > > You can reach the person managing the list at > stunnel-users-owner@stunnel. org <stunnel-users-owner(a)stunnel.org> > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. Re: Stunnel Issue (Flo Rance) > > > ------------------------------ ------------------------------ ---------- > > Message: 1 > Date: Tue, 3 Jul 2018 11:18:03 +0200 > From: Flo Rance <trourance(a)gmail.com> > To: Avinash Kumar <avinash14331(a)gmail.com> > Cc: stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] Stunnel Issue > Message-ID: > <CAHogYcUn6BzfBr75X- DuteetppESv2KOjGJmGO7mc=SuHVaE > Xw(a)mail.gmail.com <SuHVaEXw(a)mail.gmail.com>> > Content-Type: text/plain; charset="utf-8" > > Please post your configuration. Without that, it's not obvious. > > Regards, > Flo > > On Tue, Jul 3, 2018 at 10:42 AM, Avinash Kumar <avinash14331(a)gmail.com> > wrote: > > > Attaching the screenshot > > > > Regards, > > Avinash Kumar > > > > On Tue, Jul 3, 2018 at 2:11 PM, Avinash Kumar <avinash14331(a)gmail.com> > > wrote: > > > >> Hi, > >> > >> I am getting below error while connecting through stunnel: > >> > >> > >> > >> Regards, > >> Avinash Kumar > >> > > > > > > ______________________________ _________________ > > stunnel-users mailing list > > stunnel-users(a)stunnel.org > > https://www.stunnel.org/cgi- bin/mailman/listinfo/stunnel- users > <https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users> > > > > >

3 3

Intermittent error in 042_inetd
by Ian Bamforth 04 Jul '18

04 Jul '18

Afternoon, Until recently we'd disabled `make test` because of certificate problems - we've re-enabled it (using `make check`) but are getting intermittent failures (around 50% of CI runs). Below is the output from the logs - I can't see what's gone wrong, can anyone shed any light? 2018.07.04 09:59:36 LOG7[ui]: Clients allowed=14648 2018.07.04 09:59:36 LOG7[ui]: errno: (*__errno_location ()) 2018.07.04 09:59:36 LOG7[ui]: Compression disabled 2018.07.04 09:59:36 LOG7[ui]: No PRNG seeding was required 2018.07.04 09:59:36 LOG7[ui]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2018.07.04 09:59:36 LOG7[ui]: TLS options: 0x02004004 (+0x00004000, -0x00000000) 2018.07.04 09:59:36 LOG7[ui]: Private key check succeeded 2018.07.04 09:59:36 LOG7[ui]: ECDH initialization 2018.07.04 09:59:36 LOG7[ui]: ECDH initialized with curve prime256v1 2018.07.04 09:59:36 LOG7[ui]: Binding service [server] 2018.07.04 09:59:36 LOG7[ui]: Listening file descriptor created (FD=6) 2018.07.04 09:59:36 LOG7[ui]: Setting accept socket options (FD=6) 2018.07.04 09:59:36 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2018.07.04 09:59:36 LOG7[main]: Created pid file /opt/stunnel/stunnel-5.48/tests/logs/stunnel.pid 2018.07.04 09:59:36 LOG7[cron]: Cron thread initialized 2018.07.04 09:59:36 LOG7[main]: Found 1 ready file descriptor(s) 2018.07.04 09:59:36 LOG7[main]: FD=4 events=0x2001 revents=0x0 2018.07.04 09:59:36 LOG7[main]: FD=6 events=0x2001 revents=0x1 2018.07.04 09:59:36 LOG7[main]: Service [server] accepted (FD=3) from 127.0.0.1:58890 2018.07.04 09:59:36 LOG7[0]: Service [server] started 2018.07.04 09:59:36 LOG7[0]: Setting local socket options (FD=3) 2018.07.04 09:59:36 LOG7[0]: Option TCP_NODELAY set on local socket 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): before SSL initialization 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): before SSL initialization 2018.07.04 09:59:36 LOG7[0]: SNI: no virtual services defined 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS read client hello 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write server hello 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write certificate 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write key exchange 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write server done 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write server done 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS read client key exchange 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS read change cipher spec 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS read finished 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write change cipher spec 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write finished 2018.07.04 09:59:36 LOG7[0]: New session callback 2018.07.04 09:59:36 LOG7[0]: 1 server accept(s) requested 2018.07.04 09:59:36 LOG7[0]: 1 server accept(s) succeeded 2018.07.04 09:59:36 LOG7[0]: 0 server renegotiation(s) requested 2018.07.04 09:59:36 LOG7[0]: 0 session reuse(s) 2018.07.04 09:59:36 LOG7[0]: 1 internal session cache item(s) 2018.07.04 09:59:36 LOG7[0]: 0 internal session cache fill-up(s) 2018.07.04 09:59:36 LOG7[0]: 0 internal session cache miss(es) 2018.07.04 09:59:36 LOG7[0]: 0 external session cache hit(s) 2018.07.04 09:59:36 LOG7[0]: 0 expired session(s) retrieved 2018.07.04 09:59:36 LOG7[0]: Compression: null, expansion: null 2018.07.04 09:59:36 LOG7[0]: Setting remote socket options (FD=10) 2018.07.04 09:59:36 LOG7[0]: Option TCP_NODELAY set on remote socket 2018.07.04 09:59:36 LOG7[0]: Remote descriptor (FD=10) initialized 2018.07.04 09:59:36 LOG7[0]: TLS alert (read): warning: close notify 2018.07.04 09:59:36 LOG7[0]: Sent socket write shutdown 2018.07.04 09:59:36 LOG7[0]: Remote descriptor (FD=10) closed 2018.07.04 09:59:36 LOG7[0]: Local descriptor (FD=3) closed 2018.07.04 09:59:36 LOG7[0]: Service [server] finished (0 left) 2018.07.04 09:59:36 LOG7[main]: Found 1 ready file descriptor(s) 2018.07.04 09:59:36 LOG7[main]: FD=4 events=0x2001 revents=0x1 2018.07.04 09:59:36 LOG7[main]: FD=6 events=0x2001 revents=0x0 2018.07.04 09:59:36 LOG7[main]: Dispatching a signal from the signal pipe 2018.07.04 09:59:36 LOG7[main]: Processing SIGCHLD 2018.07.04 09:59:36 LOG7[main]: Retrieving pid statuses with waitpid() 2018.07.04 09:59:36 LOG7[ui]: Clients allowed=14648 2018.07.04 09:59:36 LOG7[ui]: errno: (*__errno_location ()) 2018.07.04 09:59:36 LOG7[ui]: Compression disabled 2018.07.04 09:59:36 LOG7[ui]: No PRNG seeding was required 2018.07.04 09:59:36 LOG7[ui]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2018.07.04 09:59:36 LOG7[ui]: TLS options: 0x02000004 (+0x00000000, -0x00000000) 2018.07.04 09:59:36 LOG7[ui]: No certificate or private key specified 2018.07.04 09:59:36 LOG7[0]: Service [inetd client] started 2018.07.04 09:59:36 LOG7[0]: s_connect: s_poll_wait 127.0.0.1:4433: waiting 10 seconds 2018.07.04 09:59:36 LOG7[0]: Setting remote socket options (FD=3) 2018.07.04 09:59:36 LOG7[0]: Option TCP_NODELAY set on remote socket 2018.07.04 09:59:36 LOG7[0]: Remote descriptor (FD=3) initialized 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): before SSL initialization 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write client hello 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write client hello 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read server hello 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read server certificate 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read server key exchange 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read server done 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write client key exchange 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write change cipher spec 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write finished 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write finished 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read change cipher spec 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read finished 2018.07.04 09:59:36 LOG7[0]: New session callback 2018.07.04 09:59:36 LOG7[0]: Peer certificate was cached (1241 bytes) 2018.07.04 09:59:36 LOG7[0]: 1 client connect(s) requested 2018.07.04 09:59:36 LOG7[0]: 1 client connect(s) succeeded 2018.07.04 09:59:36 LOG7[0]: 0 client renegotiation(s) requested 2018.07.04 09:59:36 LOG7[0]: 0 session reuse(s) 2018.07.04 09:59:36 LOG7[0]: Compression: null, expansion: null 2018.07.04 09:59:36 LOG7[0]: Sending close_notify alert 2018.07.04 09:59:36 LOG7[0]: TLS alert (write): warning: close notify 2018.07.04 09:59:36 LOG7[0]: Remote descriptor (FD=3) closed 2018.07.04 09:59:36 LOG7[0]: Service [inetd client] finished (0 left) 2018.07.04 09:59:36 LOG7[0]: Deallocating section defaults 2018.07.04 09:59:36 LOG7[main]: Found 1 ready file descriptor(s) 2018.07.04 09:59:36 LOG7[main]: FD=4 events=0x2001 revents=0x1 2018.07.04 09:59:36 LOG7[main]: FD=6 events=0x2001 revents=0x0 2018.07.04 09:59:36 LOG7[main]: Dispatching a signal from the signal pipe 2018.07.04 09:59:36 LOG7[main]: Processing SIGNAL_TERMINATE 2018.07.04 09:59:36 LOG7[main]: Leak detection table utilization: 86/997, 8.63% 2018.07.04 09:59:36 LOG7[main]: Removed pid file /opt/stunnel/stunnel-5.48/tests/logs/stunnel.pid 2018.07.04 09:59:36 LOG7[main]: Deallocating section defaults Regards, Ian Bamforth Senior Software Engineer Operations & Planning Systems Division T: +44 (0)113 344 3970<tel:00441133443970> M: +44 (0)7852 404240<tel:00447852404240> E: Ian.Bamforth(a)tracsis.com<mailto:Ian.Bamforth@tracsis.com> W: www.tracsis.com<https://www.tracsis.com> www.tracsisops.com<http://www.tracsisops.com> Follow Us [https://static.tracsis.com/email/lin2.png]<https://www.linkedin.com/company/972873?trk=tyah&trkInfo=idx:1-1-1,tarId:14…> [https://static.tracsis.com/email/twi2.png] <https://www.twitter.com/tracsis> Tracsis plc Leeds Innovation Centre 103 Clarendon Road Leeds LS2 9DF [https://static.tracsis.com/email/award4.png] Tracsis Operations and Planning Systems Division is a Division of Tracsis plc and comprises Tracsis plc (05019106), Tracsis Rail Consultancy Limited (05047148), Safety Information Systems Limited trading as COMPASS (02588404) and Tracsis Retail and Operations Limited (04225250), all subsidiaries of Tracsis plc with a registered office at Leeds Innovation Centre,103 Clarendon Road, Leeds, LS2 9DF. VAT Registration No: 945 7876 61. This email and its attachments may be confidential and are intended solely for the use of the individual(s) to whom it is addressed. If you are not the intended recipient of this email and its attachments, you must take no action based upon them, nor must you copy or show them to anyone. Please contact the sender if you believe you have received this email in error.

1 0

stunnel on Windows - using CAPI - tls v1.2?==?utf-8?q? ?
by Brian Ipsen 04 Jul '18

04 Jul '18

Hi Does anyone know whether there is a fix pending for being able to use the Windows built-in certificate store (by CAPI) for client authentication - and using TLS v1.2 ? Currently I need to force the stunnel client to use TLS v1.1, as there seem to be a limitation somewhere if using TLS v1.2... Regards Brian

1 0

tls linger
by Daniel Trickett 03 Jul '18

03 Jul '18

Hi, We are using stunnel to allow us to punchout to suppliers using TLS 1.2 protocol. We are seeing the following with this particular supplier. 2018.07.02 08:49:05 LOG6[4]: TLS connected: previous session reused 2018.07.02 08:49:05 LOG6[4]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-SHA384 (256-bit encryption) 2018.07.02 08:49:05 LOG7[4]: Compression: null, expansion: null 2018.07.02 08:49:15 LOG3[4]: SSL_read: Connection reset by peer (131) 2018.07.02 08:49:15 LOG5[4]: Connection reset: 1720 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.07.02 08:49:15 LOG7[4]: linger (remote): Invalid argument (22) 2018.07.02 08:49:15 LOG7[4]: Remote descriptor (FD=13) closed 2018.07.02 08:49:15 LOG7[4]: Local descriptor (FD=3) closed 2018.07.02 08:49:15 LOG7[4]: Service [dell-https] finished (0 left) We have set socket = l:SO_LINGER=1:60, but still occasionally have an issue. Is there anything else that we may need to set? Since the below is default, would not expect to set it.. socket = a:SO_REUSEADDR=no disable address reuse (enabled by default) Best regards, Dan This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click http://www.emdgroup.com/emd/imprint/mail_disclaimer.html to access the German, French, Spanish and Portuguese versions of this disclaimer.

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 168, Issue 2
by Avinash Kumar 03 Jul '18

03 Jul '18

Hi, As requested, Posting my configuration. [https-App-setup] client = yes accept = 9898 connect = <<source-ipaddress>>:9898 cert = <<stunnel-installationdirectory>>\config\App\morpheus.pem key = <<stunnel-installationdirectory>>\config\App\morpheus.key CAfile = <<stunnel-installationdirectory>>\config\App\root-ca.pem sslVersion = TLSv1 options = NO_SSLv3 Regards, Avinash Kumar On Tue, Jul 3, 2018 at 3:30 PM, <stunnel-users-request(a)stunnel.org> wrote: > Send stunnel-users mailing list submissions to > stunnel-users(a)stunnel.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)stunnel.org > > You can reach the person managing the list at > stunnel-users-owner(a)stunnel.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. Re: Stunnel Issue (Flo Rance) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 3 Jul 2018 11:18:03 +0200 > From: Flo Rance <trourance(a)gmail.com> > To: Avinash Kumar <avinash14331(a)gmail.com> > Cc: stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] Stunnel Issue > Message-ID: > <CAHogYcUn6BzfBr75X-DuteetppESv2KOjGJmGO7mc=SuHVaE > Xw(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > Please post your configuration. Without that, it's not obvious. > > Regards, > Flo > > On Tue, Jul 3, 2018 at 10:42 AM, Avinash Kumar <avinash14331(a)gmail.com> > wrote: > > > Attaching the screenshot > > > > Regards, > > Avinash Kumar > > > > On Tue, Jul 3, 2018 at 2:11 PM, Avinash Kumar <avinash14331(a)gmail.com> > > wrote: > > > >> Hi, > >> > >> I am getting below error while connecting through stunnel: > >> > >> > >> > >> Regards, > >> Avinash Kumar > >> > > > > > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)stunnel.org > > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > > > > >

2 1

Stunnel Issue
by Avinash Kumar 03 Jul '18

03 Jul '18

Hi, I am getting below error while connecting through stunnel: Regards, Avinash Kumar

2 2

stunnel 5.48 released
by Michal Trojnara 02 Jul '18

02 Jul '18

Dear Users, I have released version 5.48 of stunnel. Version 5.48, 2018.07.02, urgency: HIGH * Security bugfixes - Fixed requesting client certificate when specified as a global option. * New features - Certificate subject checks modified to accept certificates if at least one of the specified checks matches. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 1011d5a302ce6a227882d094282993a3187250f42f8a801dcc1620da63b2b8df stunnel-5.48.tar.gz eb160fdf28061eb509e09824ab9cd26f4f0ca9be3b90008bba32274d5136c7eb stunnel-5.48-win32-installer.exe 667ee8c8d5440117285eb5a5ddf0d305a6dd1dbb93dcf5b7bac62f84ddba7466 stunnel-5.48-android.zip Best regards, Mike

1 0

tls question
by Daniel Trickett 02 Jul '18

02 Jul '18

Hi, If I use stunnel 5.44, how do I know that the protocol being used is TLS1.2? Is it the default? Working with supplier sites which still accept 1.0/1.1, but want to make sure that I am using 1.2, as they will be disabling the older protocols. Thanks and Best regards, Dan This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click http://www.emdgroup.com/emd/imprint/mail_disclaimer.html to access the German, French, Spanish and Portuguese versions of this disclaimer.

4 3

Potentially dangerous change of behavior in handling "global option" in stunnel after version 5.45
by Tony Cheneau 29 Jun '18

29 Jun '18

Hello everyone, I was updating my version of stunnel and playing my regression suite and I was surprised to see some tests fail. We usually apply "verify = 2" as global option at the beginning of the configuration file on our stunnel "server" so as to enforce the client certificate verification. So I was a little bit surprise to see I could establish a TLS connection with my test server without providing a client certificate. The "verify = 2" as a "global option" is parsed at some point, because I can trigger an error message if I place a bogus value ("verify = 8"). Yet, it seems to be ignored when accepting connections. If I move the "verify = 2" from the "global option" to a service-level option for a specific service/tunnel, it works as expected (and documented): it rejects my certificate-less client. After a little bit of investigation, I was able to narrow down the change of behavior in version 5.45 (meaning that 5.44 still follow the old behavior). All the newer version follow this new behavior. I haven't seen any public CVS/SVN/git for stunnel, so I was not able to narrow it down further and I could not identify the exact change in the code that modified the behavior. While I understand that this option is documented in the manpage as a service-level option, in practice, "verify" could be used as a global option for years (my oldest documented usage at my company dates back from stunnel 4.54). (I know this option is going to be replaced by verifyChain/requireCert, the observed behavior reported in this email also applies on these options: they can't be applied program wide as a "global option") Am I missing something obvious here ? I haven't seen the change documented in the changelog, so it looks like a regression to me. Thank you in advance (and thank you for the great piece of software, obviously!). Regards, Tony Cheneau

1 0

Re: [stunnel-users] stunnel 5.47 released
by Eric S Eberhard 28 Jun '18

28 Jun '18

Query -- how does this relate to TLSv1.3 and the alpha version (which is not going to work with the final version -- and does not exist I think) -- and what version of openssl do you recommend? Thanks, Eric Eric S Eberhard VICS (Vertical Integrated Computer Systems) Voice: 928 567 3529 Cell : 928 301 7537 (not reliable except for text or if not home) 2933 W Middle Verde Rd Camp Verde, AZ 86322 -----Original Message----- From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Michal Trojnara Sent: Friday, June 22, 2018 11:10 PM To: stunnel-users(a)stunnel.org; stunnel-announce(a)stunnel.org; openssl-users(a)openssl.org Subject: [stunnel-users] stunnel 5.47 released Dear Users, I have released version 5.47 of stunnel. Version 5.47, 2018.06.23, urgency: HIGH * New features - Fast add_lock_callback for OpenSSL < 1.1.0. This largely improves performance on heavy load. - Automatic detection of Homebrew OpenSSL. - Clarified port binding error logs. - Various "make test" improvements. * Bugfixes - Fixed a crash on switching to SNI slave sections. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: c4e675db996eb92beef885f72a3ed8af3c7603fea6b99d2873198dd6c0021d0b stunnel-5.47.tar.gz 985e1d65a3f4a7599cc78630960e1b2c97981f91ce6bc41f2eefcd371b4067a3 stunnel-5.47-win32-installer.exe 309cfb79329448f0c134aece0d10d0737e3728b25c288e9a76650837cd6f839c stunnel-5.47-android.zip Best regards, Mike

1 0

question regarding TLS connection.
by Daniel Trickett 26 Jun '18

26 Jun '18

Hi We are using stunnel 5.44. We are having an issue connecting with a customer who is not supporting TLS 1.1, only 1.2 and 1.3. When I look in the log, I see the following. Why do I see the SSLv3 note in the line? The below leads me to believe that we connect to the customer, but they say that we are not. 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 read server certificate A 2018.06.25 11:37:24 LOG6[7]: Client certificate not requested 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 read server done A 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 write client key exchange A 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 write change cipher spec A 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 write finished A 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 flush data 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 read finished A 2018.06.25 11:37:24 LOG7[7]: 1 client connect(s) requested 2018.06.25 11:37:24 LOG7[7]: 1 client connect(s) succeeded 2018.06.25 11:37:24 LOG7[7]: 0 client renegotiation(s) requested 2018.06.25 11:37:24 LOG7[7]: 0 session reuse(s) 2018.06.25 11:37:24 LOG6[7]: TLS connected: new session negotiated Best regards, Dan Daniel Trickett Head of Database Services | MBS Business Technology BX-TCS-O Oracle ERP Business Services of Merck KGaA, Darmstadt, Germany Planned Absence - 7/2/2018 - 7/6/2018 MilliporeSigma A business of Merck KGaA, Darmstadt, Germany EMD Millipore Corporation | 80 Ashby Road | Bedford, MA 01730 | USA office 781-533-3017 |cell 978-761-3506 |email daniel.trickett(a)emdmillipore.com<mailto:daniel.trickett@emdmillipore.com> This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click http://www.emdgroup.com/emd/imprint/mail_disclaimer.html to access the German, French, Spanish and Portuguese versions of this disclaimer.

2 1

stunnel 5.47 released
by Michal Trojnara 23 Jun '18

23 Jun '18

Dear Users, I have released version 5.47 of stunnel. Version 5.47, 2018.06.23, urgency: HIGH * New features - Fast add_lock_callback for OpenSSL < 1.1.0. This largely improves performance on heavy load. - Automatic detection of Homebrew OpenSSL. - Clarified port binding error logs. - Various "make test" improvements. * Bugfixes - Fixed a crash on switching to SNI slave sections. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: c4e675db996eb92beef885f72a3ed8af3c7603fea6b99d2873198dd6c0021d0b stunnel-5.47.tar.gz 985e1d65a3f4a7599cc78630960e1b2c97981f91ce6bc41f2eefcd371b4067a3 stunnel-5.47-win32-installer.exe 309cfb79329448f0c134aece0d10d0737e3728b25c288e9a76650837cd6f839c stunnel-5.47-android.zip Best regards, Mike

2 1

Stunnel 5.45 and 5.46 crashes upon reconnect HTTPS
by Javier 22 Jun '18

22 Jun '18

Hi, isn't annoying when you are using an old version, 5.44, and all goes fine, you notice you are outdated and then comes the problems after update? :-P The thing is that yesterday I needed the HTTPS server so I run Stunnel 5.44 for my non-SSL app and all was fine. I updated to 5.46 just because I forgot the last time and didn't even run again because I didn't need it. Today I used it and... I had a crash. I tested 5.45 to trace versions back, and it crashes as well. Back to 5.44 and no crash. The crash happens when there is a reload/reconnect/multiconnect (example, 2 connections html+images) by the browser when connects to an HTTPS server. It only happens when using a SNI service. I've been able to trace back the log on those versions and when fails in 5.45 and 5.46 is at the time when it needs to switch to the SNI service. (log from 5.44) SNI: requested servername: xxx SNI: matched pattern: xxx SNI: switched to service [xxx] <<<<----- BEFORE SWITCH, IT CRASHES on 5.45 and 5.46 Imagine you load https://xxx/. The first time is fine, the second, crashes stunnel. Not happening with 5.44. I haven't seen any change to SNI in manual so... :-? These are the configs for the used virtual servers. Nothing has been changed, anyway: [SSL] client = no accept = y.y.y.1:4747 connect = y.y.y.2:443 [SSL-xxx-SNI] client = no sni = SSL:xxx connect = y.y.y.2:443 cert = pem key = pem Don't mind the port numbers. They aren't in conflict. Running on Windows 2000. Regards.

3 4

Reg : Stunnel + RSYNC Usage with TLSv1.2
by Sakthivel Ganesamoorthy 20 Jun '18

20 Jun '18

Hi, I have configured a server and client for Stunnel + Rsync usage over TLSv1.2. It is working fine, but I wanted to verify the "Cipher Key" exchange mechanism between "Server & Client" via "Wireshark". When I captured the logs via "Wireshark", it shows everything as TCP messages and I don't see any "Client Hello message (or) Cipher Key exchange message (or) any of the TLSv1.2" handshake messages. Please let me know whether I'm missing something here. Thanks, Sakthi

1 0

stunnel used as jump host for SFTP
by Schultz, Cecilia 20 Jun '18

20 Jun '18

Hello, I am trying to test stunnel to see if it can provide the functionality we need. We are a Windows shop. What we need is for multiple client machines (I call these C1, C2, C3) to connect to our server (S). Server S will connect to a remote SFTP server (port 22). I call the remote SFTP server "R". C1, C2, C3 and S are all inside our firewall. Currently S can connect and send files to R using SFTP (port 22). The problem is that R does not accept a range of IP addresses, and has a limit on the number of IP addresses they can accept. So, what I need is for C1, C2, C3 to be able to connect to server R using S as a jump host. >From R's perspective, it should be like the connection is coming from S. Question 1: can stunnel be used to accomplish this? Question 2: I have installed stunnel in a test server ("stunnel -install" actually from the bin folder), and configured the conf like this: [sftp] accept=127.0.0.1:22 connect=some.remote.server.com:22 I tried to use Winscp SFTP client to test a connection, but it times out. I then checked S, and I don't see anything listening on port 22. I did "netstat -a" and I don't see anything listening on port 22. Was something wrong in the "stunnel -install" command? Shouldn't it be listening on port 22? Also, I uncommented the entry for log, but I don't see any log file in the stunnel folder/subfolders ; Debugging stuff (may be useful for troubleshooting) debug = info output = stunnel.log Thanks for your help, Cecilia

3 3

Re: [stunnel-users] stunnel used as jump host for SFTP
by Schultz, Cecilia 20 Jun '18

20 Jun '18

Thank you so much for the info! I will try this out. From: stunnel-users <stunnel-users-bounces(a)stunnel.org> On Behalf Of Harris, Douglas (SSC/SPC) Sent: Wednesday, June 20, 2018 5:08 AM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] stunnel used as jump host for SFTP You can accomplish this in Windows. Just add a port forwarding rule to S: netsh interface portproxy add v4tov4 listenport=22 listenaddress=[IP of S] connectport=22 connectaddress=[IP of R] -Doug

1 0

stunnel PSK support via custome openssl engine
by Tarakeshwar Rao 14 Jun '18

14 Jun '18

Dear Stunnel-users, >From Stunnel man pages, I could see that we could read PSK secret from plain text file with following option: PSKsecrets = psk.txt Could it possible to use custom openssl engine to read PSK file from HSM. I know that this works for reading TLS keys. I am not sure how I could do it for PSK. Thanks for your support, Regards, Tarak

1 0

is it possible to make stunnel works for dbmail timsieved?
by cktmwe＠gmail.com 12 Jun '18

12 Jun '18

hello everyone, I'm currently try to stunnel sieve traffic to local dbmail timsieved, unfortunately I couldn't get it to work, my first question, does stunnel support sieve manage protocol? secondly if it does, how can I config the service? what I've done so far. timsieved started on 127.0.0.1:2000, connect and manage all works, I saw connection in dbmail log, then define sieve service block in stunnel.conf, restart stunnel, but if I connect our.public.ip:4190, timsieved becames no connection at all, dbmail log kept silent. traffic from port 4190 is already accepted in iptables. config that I used. > [sieve] > accept = our.public.ip:4190 > connect = 127.0.0.1:2000 > software version: stunnel-5.43 dbmail-3.2.3 Thanks.

2 1

Slow DNS lookups when DNS does not respond
by Guillermo Rodriguez Garcia 08 Jun '18

08 Jun '18

Hi all, I have stunnel setup on a Linux box and I am experiencing very slow DNS lookup times when DNS does not respond. On this same system, anything that results in a DNS lookup (e.g. ping, ...) takes about 20 seconds before it times out and fails. However with stunnel (and a single service configured) the lookup takes more than 1 minute (approx 80 seconds). Is there any way to configure this? Thank you, Guillermo Rodriguez Garcia guille.rodriguez(a)gmail.com

1 0

Windows 2016 Server: [!] bind: Address already in use (WSAEADDRINUSE) (10048)
by Martin Schweizer 06 Jun '18

06 Jun '18

Hello List My problem: If I run stunnel I regular get the below error: [.] stunnel 5.46 on x86-pc-msvc-1500 platform [.] Compiled/running with OpenSSL 1.0.2o-fips 27 Mar 2018 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] Running on Windows 6.2 [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [smtps] [ ] GUI message loop initialized [ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK [ ] TLS options: 0x03000004 (+0x00000000, -0x00000000) [ ] Loading certificate from file: stunnel.pem [ ] Certificate loaded from file: stunnel.pem [ ] Loading private key from file: stunnel.pem [ ] Private key loaded from file: stunnel.pem [ ] Private key check succeeded [:] Service [smtps] needs authentication to prevent MITM attacks [.] Configuration successful [ ] Binding service [smtps] [ ] Listening file descriptor created (FD=676) [ ] Setting accept socket options (FD=676) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket >>> [!] bind: Address already in use (WSAEADDRINUSE) (10048) <<<< [!] Error binding service [smtps] to 192.168.10.62:11465 [!] Could not bind any accepting port [ ] Deallocating section defaults [ ] Unbinding service [smtps] [ ] Service [smtps] closed [ ] Deallocating section [smtps] I had the same problem with the previous versions aswell. To temporary resolv the problem I have to change the listen port to another number. Reread the config file and let the stunnel GUI open. Then all is working until I close the GUI (not each time but most of). My system: - Windows 2016 Server - stunnel-5.46 - stunnel installed as service and GUI My config file (relevant part): taskbar = yes client=yes [smtps] ;delay = yes accept = 192.168.10.62:11466 connect = server.domain.ch:465 cert = stunnel.pem local = 192.168.10.53 (this is dedicated address) I found a similar threat in the archives (but on Linux): https://www.stunnel.org/pipermail/stunnel-users/2018-February/005935.html Here is Microsoft's describtion about WSAEADDRINUSE) (10048): https://msdn.microsoft.com/en-us/library/windows/desktop/ms740668(v=vs.85).… All helps are welcome. Kind regards, -- Martin Schweizer PC-Service M. Schweizer GmbH; Bannholzstrasse 6; Postfach 132; CH-8608 Bubikon; Tel. +41 55 243 30 00; Fax: +41 55 243 33 22

1 0

port-only accept value binds to 127.0.0.1, instead of the wildcard address
by Poor Yorick 30 May '18

30 May '18

The stunnel 6.45 documentation for "accept" states, "If no host specified, defaults to all IPv4 addresses for the local host." In this case, stunnel actually binds to 127.0.0.1. Indeed, inspection of the relevant code paths reveals that addr_list->passive is never set to 1 in this case. To get stunnel to bind to all addresses, 0.0.0.0 must be explicitly specified. Furthermore, inspection of the code path for the "local" option reveals that addr_list->passive is set to 1 in this case, which seems to be backwards: The documentation for getaddrinfo states that AI_PASSIVE is ignored in this case. The logic for these two cases seems to be reversed. -- Yorick

1 0

stunnel 5.46 released
by Michal Trojnara 28 May '18

28 May '18

Dear Users, I have released version 5.46 of stunnel. Version 5.46, 2018.05.28, urgency: MEDIUM * New features - The default cipher list was updated to a safer value: "HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK". * Bugfixes - Default accept address restored to INADDR_ANY. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 76aab48c28743d78e4b2f6b2dfe49994b6ca74126046c179444f699fae7a84c7 stunnel-5.46.tar.gz 721cc4d7c385743df767a32a53c11477def2440ae20ad4538d8e685f7b7d6538 stunnel-5.46-win32-installer.exe d08a3b3598868064db08d6f0e3a97e3c49dedbf6c8d7f348a613b832eca16dd6 stunnel-5.46-android.zip Best regards, Mike

1 0

Stunnel stopps in Windows Failover Cluster
by Tobias Gillstöm 28 May '18

28 May '18

Hi, I'm having problems with Stunnel in a Windows Failover Cluster. When a failover happens and the stunnel service changes node that it's running on, the service changes node just fine but the stunnel service dosen't appear to be doing anything? If anyone has some prior knowledge about Stunnel in a Windows Failover Cluster i would appreciate the help :)

1 0

stunnel and CAPI on Windows
by Brian Ipsen 23 May '18

23 May '18

Hi I am trying to use the Microsoft certificate store/API for client validation of Windows hosts towards an F5. Everything works, when we use file-based certificates - but for security purposes I would prefer to use the windows certificate store, and set the private key on the client as non-exportable... I have enabled the engineId = capi in the global section of stunnel.conf - and for the required client/service I have: [F5CertAdmin] client=yes accept = 127.0.0.1:1679 connect = w.x.y.z:443 delay = yes sni = ssl79admpki.xxxx.com CApath = C:\Program Files (x86)\stunnel\config\certs CAFile = C:\Program Files (x86)\stunnel\config\certs\GlobalSign-Cert-Chain.pem verify = 2 engineId = capi key = BaaSClientCertificateCP cert = BaaSClientCertificateCP I have a certificate in the local computer certificate store with the supplied name - but stunnel is not able to locate it... Is it because it will look under the user account? If yes, will it look under the local machine when running as local system ? The output from stunnel says: [ ] Initializing service [F5CertAdmin] [ ] Ciphers: HIGH:!DH:!aNULL:!SSLv2 [ ] TLS options: 0x03000004 (+0x03000000, -0x00000000) [ ] Client certificate engine (capi) enabled [ ] Loading certificate from engine ID: BaaSClientCertificateCP [!] ENGINE_ctrl_cmd: Peer suddenly disconnected [ ] Initializing private key on engine ID: BaaSClientCertificateCP [!] ENGINE_load_private_key: 26096080: error:26096080:engine routines:ENGINE_load_private_key:failed loading private key [ ] Loading certificate from file: BaaSClientCertificateCP [!] error queue: 140DC002: error:140DC002:SSL routines:SSL_CTX_use_certificate_chain_file:system lib [!] error queue: 20074002: error:20074002:BIO routines:FILE_CTRL:system lib [!] SSL_CTX_use_certificate_chain_file: 2001002: error:02001002:system library:fopen:No such file or directory [!] Service [F5CertAdmin]: Failed to initialize TLS context @am6pr03mb3813.eurprd03.prod.outlook.com>Any advice appreciated... Thanks Brian

1 0

stunnel 5.45 released
by Michal Trojnara 21 May '18

21 May '18

Dear Users, I have released version 5.45 of stunnel. Version 5.45, 2018.05.21, urgency: MEDIUM * New feature sponsored by https://loadbalancer.org/ - Implemented delayed deallocation of service sections after configuration file reload. * Other new features - OpenSSL DLLs updated to version 1.0.2o. - Deprecated the sslVersion option. - The "socket" option is now also available in service sections. - Implemented try-restart in the SysV init script (thx to Peter Pentchev). - TLS 1.3 compliant session handling for OpenSSL 1.1.1. - Default "failover" value changed from "rr" to "prio". - New "make check" tests. * Bugfixes - A service no longer refuses to start if binding fails for some (but not all) addresses:ports. - Fixed compression handling with OpenSSL 1.1.0 and later. - _beginthread() replaced with safer _beginthreadex(). - Fixed exception handling in libwrap. - Fixed exec+connect services. - Fixed automatic resolver delaying. - Fixed a Gentoo cross-compilation bug (thx to Joe Harvell). - A number of "make check" framework fixes. - Fixed false postive memory leak logs. - Build fixes for OpenSSL versions down to 0.9.7. - Fixed (again) round-robin failover in the FORK threading model. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 548244839b8a4bf4dffea46c97893b203d1b9eed118c3dd6a9ac4d8d02592ee3 stunnel-5.45.tar.gz fc13a224c7ec1290035efe8317c53d62a0980a5ab2efe8930b06aae269fbe873 stunnel-5.45-win32-installer.exe 29025eaed007c62856f16c7a8a22f9713eee9762ed95009f6f91f729c35c0bc0 stunnel-5.45-android.zip Best regards, Mike

1 0

configuring Stunnel
by support 20 May '18

20 May '18

The config as described hereby did work properly a few times giving a secured connection. All of a sudden this is no longer working? Any suggestions? Namens IMS evba Paul Waegemans +32475341310 <mailto:support@imseuro.be> support(a)imseuro.be <http://eu.ntrsupport.com/inquiero/web/digisign/digisign.asp?login=I23EBF509 C6B51A9E700D43&lang=nl>

1 0

UTF8 BOM in PSKsecrets file
by Jakob Hirsch 17 May '18

17 May '18

Hi! I just found out (after a while of troubleshooting) that stunnel does not handle UTF-8 BOM in the PSKsecrets file, i.e. the BOM is considered part of the identity (tested with 5.44, 5.45b4 and 5.45b6 on Windows 10 1709). It was a little tricky to figure this out, as the BOM is apparently filtered out in the logs, e.g. the server just says 'No key found for PSK identity "client1"'. Ok, nobody says that this is supported or that you should do it, it just happens automatically when you click "Edit Configuration" in the Windows GUI and click "Save as" (out of convenience, because you will already be in the config directory then), because the sample config has a BOM and Notepad will also insert a BOM in the new file. I don't know how much work it would be to handle the BOM correctly or at least print a warning (didn't look at the code, sorry), a warning in the manual would probably sufficient, as it could be that I'm the first one to stumble over this (at least I didn't find anything about it on the net). Regards (and thanks for this nice piece of software) Jakob

1 0

Windows Server 2012 R2
by Daniel McArdell 17 May '18

17 May '18

Hello, I have joined the mail group in the hope that someone can help with problems I am having running on our Server machine. I downloaded "stunnel-5.45b6-win64-installer" and installed it on our Server. When I run the executable I get: 2018.05.17 12:48:33 LOG5[main]: stunnel 5.45 on x64-pc-msvc-1913 platform 2018.05.17 12:48:33 LOG5[main]: Compiled/running with OpenSSL 1.1.0g 2 Nov 2017 2018.05.17 12:48:33 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI 2018.05.17 12:48:33 LOG5[main]: Reading configuration from file stunnel.conf 2018.05.17 12:48:33 LOG5[main]: UTF-8 byte order mark detected 2018.05.17 12:48:33 LOG5[main]: Configuration successful The shortcut [cid:image001.png@01D3EDDE.6F3D0930] I was expecting to get a GUI interface but that does not happen. Can someone tell me what is going wrong. I feel as though I have missed something obvious. Daniel McArdell | Senior Analyst Programmer | Products & Technology | BNZ<http://www.bnz.co.nz/> L6 Custom House, 17 Whitmore St, Wellington 6011 DDI +64 4 4746679 (extn 76679) | F +64 4 4746023 | M +64 29 2220451 | E Daniel_McArdell(a)bnz.co.nz<mailto:Daniel_McArdell@bnz.co.nz?Subject=> CAUTION - This message may contain privileged and confidential information intended only for the use of the addressee named above. If you are not the intended recipient of this message you are hereby notified that any use, dissemination, distribution or reproduction of this message is prohibited. This email was sent by the Bank of New Zealand. You can contact us on 0800 ASK BNZ (0800 275 269). Any views expressed in this message are those of the individual sender and may not necessarily reflect the views of Bank of New Zealand.

1 0

stunnel with client-auth via proxy-server
by jack.reacher＠gmx.de 16 May '18

16 May '18

2 1

Stunnel running as service on Windows Server 2008 R2 but Stunnel All Users shortcut on the desktop reports that it server is down?
by Alex Birchall 16 May '18

16 May '18

Hello, I have Stunnel running as a service on a Windows Server 2008 R2. But the shortcut on the desktop "Stunnel All Users", when launched, informs me that the server is down due to an "invalid configuration file". In the config file, if Stunnel is being run as a service, should it be "client = no" or "server = yes"? Many thanks. Best regards, Alex

2 2

SMTP Authentication failed
by Ian Coetzee 15 May '18

15 May '18

Hi List, I have just joined the stunnel community. I am in the process of migrating our mailserver's public facing ports to stunnel for PCI compliance reasons. So far i have managed to get working: - imap (143/tcp) with starttls - imaps (993/tcp) - pop3 (110/tcp) with starttls - pop3s (995/tcp) My trouble is with smtp(25/tcp,587/tcp) with starttls. I have now tried a couple different mail clients and everyone of them tells me that the server does not support the authentication protocols. I have installed stunnel 5.44. Tee relevant parts in my config: [mail2-imap] protocol = imap accept = 143 connect = <mail-fqdn>:143 [mail2-imaps] accept = 993 connect = <mail-fqdn>:143 [mail2-pop3] protocol = pop3 accept = 110 connect = <mail-fqdn>:110 [mail2-pop3s] accept = 995 connect = <mail-fqdn>:110 [mail2-smtp] protocol = smtp accept = 25 connect = <mail-fqdn>:25 [mail2-smtps] accept = 465 connect = <mail-fqdn>:465 [mail2-smtps-submission] debug = 7 protocol = smtp accept = 587 connect = <mail-fqdn>:587 In the logfile I have the following entries upon connecting 2018.04.30 09:20:50 LOG7[5]: Service [mail2-smtps-submission] started 2018.04.30 09:20:50 LOG7[5]: Option TCP_NODELAY set on local socket 2018.04.30 09:20:50 LOG5[5]: Service [mail2-smtps-submission] accepted connection from 41.13.8.49:56890 2018.04.30 09:20:50 LOG6[5]: s_connect: connecting 10.10.11.2:587 2018.04.30 09:20:50 LOG7[5]: s_connect: s_poll_wait 10.10.11.2:587: waiting 10 seconds 2018.04.30 09:20:50 LOG5[5]: s_connect: connected 10.10.11.2:587 2018.04.30 09:20:50 LOG5[5]: Service [mail2-smtps-submission] connected remote server from 10.10.11.11:42466 2018.04.30 09:20:50 LOG7[5]: Option TCP_NODELAY set on remote socket 2018.04.30 09:20:50 LOG7[5]: Remote descriptor (FD=23) initialized 2018.04.30 09:20:50 LOG7[5]: RFC 2487 detected 2018.04.30 09:20:50 LOG7[5]: <- 220 <mail-fqdn> ESMTP Postfix 2018.04.30 09:20:50 LOG7[5]: -> 220 <mail-fqdn> stunnel for ESMTP Postfix 2018.04.30 09:20:51 LOG7[5]: <- EHLO [100.125.153.220] 2018.04.30 09:20:51 LOG7[5]: -> 250-<mail-fqdn> 2018.04.30 09:20:51 LOG7[5]: -> 250 STARTTLS 2018.04.30 09:20:51 LOG7[5]: <- STARTTLS 2018.04.30 09:20:51 LOG7[5]: -> 220 Go ahead 2018.04.30 09:20:51 LOG6[5]: Peer certificate not required 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): before/accept initialization 2018.04.30 09:20:51 LOG7[5]: SNI: no virtual services defined 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 read client hello A 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 write server hello A 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 write certificate A 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 write key exchange A 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 write server done A 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 flush data 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 read client certificate A 2018.04.30 09:20:52 LOG7[5]: TLS state (accept): SSLv3 read client key exchange A 2018.04.30 09:20:52 LOG7[5]: TLS state (accept): SSLv3 read certificate verify A 2018.04.30 09:20:52 LOG7[5]: TLS state (accept): SSLv3 read finished A 2018.04.30 09:20:52 LOG7[5]: TLS state (accept): SSLv3 write change cipher spec A 2018.04.30 09:20:52 LOG7[5]: TLS state (accept): SSLv3 write finished A 2018.04.30 09:20:52 LOG7[5]: TLS state (accept): SSLv3 flush data 2018.04.30 09:20:52 LOG7[5]: New session callback 2018.04.30 09:20:52 LOG7[5]: 2 server accept(s) requested 2018.04.30 09:20:52 LOG7[5]: 2 server accept(s) succeeded 2018.04.30 09:20:52 LOG7[5]: 0 server renegotiation(s) requested 2018.04.30 09:20:52 LOG7[5]: 0 session reuse(s) 2018.04.30 09:20:52 LOG7[5]: 2 internal session cache item(s) 2018.04.30 09:20:52 LOG7[5]: 0 internal session cache fill-up(s) 2018.04.30 09:20:52 LOG7[5]: 0 internal session cache miss(es) 2018.04.30 09:20:52 LOG7[5]: 0 external session cache hit(s) 2018.04.30 09:20:52 LOG7[5]: 0 expired session(s) retrieved 2018.04.30 09:20:52 LOG6[5]: TLS accepted: new session negotiated 2018.04.30 09:20:52 LOG6[5]: No peer certificate received 2018.04.30 09:20:52 LOG6[5]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES128-GCM-SHA256 (128-bit encryption) 2018.04.30 09:20:52 LOG7[5]: Compression: null, expansion: null 2018.04.30 09:20:52 LOG6[5]: Read socket closed (read hangup) 2018.04.30 09:20:52 LOG7[5]: Sending close_notify alert 2018.04.30 09:20:52 LOG7[5]: TLS alert (write): warning: close notify 2018.04.30 09:20:52 LOG6[5]: SSL_shutdown successfully sent close_notify alert 2018.04.30 09:20:52 LOG6[5]: TLS fd: Connection reset by peer (104) 2018.04.30 09:20:52 LOG6[5]: TLS socket closed (SSL_read) 2018.04.30 09:20:52 LOG7[5]: Sent socket write shutdown 2018.04.30 09:20:52 LOG5[5]: Connection closed: 156 byte(s) sent to TLS, 30 byte(s) sent to socket 2018.04.30 09:20:52 LOG7[5]: Remote descriptor (FD=23) closed 2018.04.30 09:20:52 LOG7[5]: Local descriptor (FD=22) closed 2018.04.30 09:20:52 LOG7[5]: Service [mail2-smtps-submission] finished (4 left) This is the error I am getting from K9-Mail The google mail app just tells me: Alpine (linux commandline smtp client) Any advise from the gurus? Kind regards Ian

1 1

Error with negotiation OK
by Alix Janeth Jerez 15 May '18

15 May '18

Hi I am using lastest stunnel version. When i try to send an email, i get: "error permanente de SMTP: 503 Bad sequence of commands". This is the trace generated when I try to send an email. 2018.05.14 12:59:08 LOG5[main]: Reading configuration from file stunnel.conf 2018.05.14 12:59:08 LOG5[main]: UTF-8 byte order mark not detected 2018.05.14 12:59:08 LOG5[main]: FIPS mode disabled 2018.05.14 12:59:08 LOG5[main]: Configuration successful 2018.05.14 12:59:08 LOG7[main]: Binding service [pseudo-ssmtp] 2018.05.14 12:59:08 LOG7[main]: Listening file descriptor created (FD=568) 2018.05.14 12:59:08 LOG7[main]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2018.05.14 12:59:08 LOG7[main]: Service [pseudo-ssmtp] (FD=568) bound to 172.31.41.84:116 2018.05.14 12:59:08 LOG7[main]: Signal pipe is empty 2018.05.14 12:59:22 LOG7[main]: Found 1 ready file descriptor(s) 2018.05.14 12:59:22 LOG7[main]: FD=324 ifds=r-x ofds=r-- 2018.05.14 12:59:22 LOG7[main]: Dispatching signals from the signal pipe 2018.05.14 12:59:22 LOG7[main]: Processing SIGNAL_RELOAD_CONFIG 2018.05.14 12:59:22 LOG7[main]: Running on Windows 6.1 2018.05.14 12:59:22 LOG5[main]: Reading configuration from file stunnel.conf 2018.05.14 12:59:22 LOG5[main]: UTF-8 byte order mark not detected 2018.05.14 12:59:22 LOG5[main]: FIPS mode disabled 2018.05.14 12:59:22 LOG7[main]: Compression disabled 2018.05.14 12:59:22 LOG7[main]: Snagged 64 random bytes from C:/.rnd 2018.05.14 12:59:22 LOG7[main]: Wrote 1024 new random bytes to C:/.rnd 2018.05.14 12:59:22 LOG7[main]: PRNG seeded successfully 2018.05.14 12:59:22 LOG6[main]: Initializing service [pseudo-ssmtp] 2018.05.14 12:59:22 LOG7[main]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2018.05.14 12:59:22 LOG7[main]: TLS options: 0x03000004 (+0x03000000, 0x00000000) 2018.05.14 12:59:22 LOG6[main]: Loading certificate from file: stunnel.pem 2018.05.14 12:59:22 LOG6[main]: Certificate loaded from file: stunnel.pem 2018.05.14 12:59:22 LOG6[main]: Loading private key from file: stunnel.pem 2018.05.14 12:59:22 LOG6[main]: Private key loaded from file: stunnel.pem 2018.05.14 12:59:22 LOG7[main]: Private key check succeeded 2018.05.14 12:59:22 LOG5[main]: Configuration successful 2018.05.14 12:59:22 LOG7[main]: Unbinding service [pseudo-ssmtp] 2018.05.14 12:59:22 LOG7[main]: Service [pseudo-ssmtp] closed (FD=568) 2018.05.14 12:59:22 LOG7[main]: Service [pseudo-ssmtp] closed 2018.05.14 12:59:22 LOG7[main]: Binding service [pseudo-ssmtp] 2018.05.14 12:59:22 LOG7[main]: Listening file descriptor created (FD=568) 2018.05.14 12:59:22 LOG7[main]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2018.05.14 12:59:22 LOG7[main]: Service [pseudo-ssmtp] (FD=568) bound to 172.31.41.84:116 2018.05.14 12:59:22 LOG7[main]: Signal pipe is empty 2018.05.14 12:59:34 LOG7[main]: Found 1 ready file descriptor(s) 2018.05.14 12:59:34 LOG7[main]: FD=324 ifds=r-x ofds=--- 2018.05.14 12:59:34 LOG7[main]: Service [pseudo-ssmtp] accepted (FD=584) from 172.31.41.84:53557 2018.05.14 12:59:34 LOG7[main]: Creating a new thread 2018.05.14 12:59:34 LOG7[main]: New thread created 2018.05.14 12:59:34 LOG7[37]: Service [pseudo-ssmtp] started 2018.05.14 12:59:34 LOG7[37]: Option TCP_NODELAY set on local socket 2018.05.14 12:59:34 LOG5[37]: Service [pseudo-ssmtp] accepted connection from 172.31.41.84:53557 2018.05.14 12:59:34 LOG6[37]: failover: round-robin, starting at entry #1 2018.05.14 12:59:34 LOG6[37]: s_connect: connecting 212.227.15.158:465 2018.05.14 12:59:34 LOG7[37]: s_connect: s_poll_wait 212.227.15.158:465: waiting 10 seconds 2018.05.14 12:59:34 LOG5[37]: s_connect: connected 212.227.15.158:465 2018.05.14 12:59:34 LOG5[37]: Service [pseudo-ssmtp] connected remote server from 172.31.41.84:53558 2018.05.14 12:59:34 LOG7[37]: Option TCP_NODELAY set on remote socket 2018.05.14 12:59:34 LOG7[37]: Remote descriptor (FD=552) initialized 2018.05.14 12:59:34 LOG6[37]: SNI: sending servername: smtp.1and1.es 2018.05.14 12:59:34 LOG6[37]: Peer certificate required 2018.05.14 12:59:34 LOG7[37]: TLS state (connect): before/connect initialization 2018.05.14 12:59:34 LOG7[37]: TLS state (connect): SSLv2/v3 write client hello A 2018.05.14 12:59:34 LOG7[37]: TLS state (connect): SSLv3 read server hello A 2018.05.14 12:59:34 LOG7[37]: Verification started at depth=2: C=US, O="thawte, Inc.", OU=Certification Services Division, OU="(c) 2006 thawte, Inc. - For authorized use only", CN=thawte Primary Root CA 2018.05.14 12:59:34 LOG7[37]: CERT: Pre-verification succeeded 2018.05.14 12:59:34 LOG7[37]: OCSP: Ignoring root certificate 2018.05.14 12:59:34 LOG6[37]: Certificate accepted at depth=2: C=US, O="thawte, Inc.", OU=Certification Services Division, OU="(c) 2006 thawte, Inc. - For authorized use only", CN=thawte Primary Root CA 2018.05.14 12:59:34 LOG7[37]: Verification started at depth=1: C=US, O="thawte, Inc.", CN=thawte SSL CA - G2 2018.05.14 12:59:34 LOG7[37]: CERT: Pre-verification succeeded 2018.05.14 12:59:34 LOG5[37]: OCSP: Connecting the AIA responder "http://t2.symcb.com" 2018.05.14 12:59:34 LOG6[37]: s_connect: connecting 23.5.251.27:80 2018.05.14 12:59:34 LOG7[37]: s_connect: s_poll_wait 23.5.251.27:80: waiting 10 seconds 2018.05.14 12:59:34 LOG5[37]: s_connect: connected 23.5.251.27:80 2018.05.14 12:59:34 LOG7[37]: OCSP: Connected t2.symcb.com:80 2018.05.14 12:59:34 LOG7[37]: OCSP: Response received 2018.05.14 12:59:34 LOG6[37]: OCSP: Status: good 2018.05.14 12:59:34 LOG6[37]: OCSP: This update: May 13 18:15:02 2018 GMT 2018.05.14 12:59:34 LOG6[37]: OCSP: Next update: May 20 18:15:02 2018 GMT 2018.05.14 12:59:34 LOG5[37]: OCSP: Certificate accepted 2018.05.14 12:59:34 LOG6[37]: Certificate accepted at depth=1: C=US, O="thawte, Inc.", CN=thawte SSL CA - G2 2018.05.14 12:59:34 LOG7[37]: Verification started at depth=0: C=DE, ST=Rheinland-Pfalz, L=Montabaur, O=1&1 Internet SE, CN=smtp.1and1.es 2018.05.14 12:59:34 LOG7[37]: CERT: Pre-verification succeeded 2018.05.14 12:59:34 LOG6[37]: CERT: Host name "smtp.1and1.es" matched with "smtp.1and1.es" 2018.05.14 12:59:34 LOG5[37]: OCSP: Connecting the AIA responder "http://tj.symcd.com" 2018.05.14 12:59:34 LOG6[37]: s_connect: connecting 23.5.251.27:80 2018.05.14 12:59:34 LOG7[37]: s_connect: s_poll_wait 23.5.251.27:80: waiting 10 seconds 2018.05.14 12:59:35 LOG5[37]: s_connect: connected 23.5.251.27:80 2018.05.14 12:59:35 LOG7[37]: OCSP: Connected tj.symcd.com:80 2018.05.14 12:59:35 LOG7[37]: OCSP: Response received 2018.05.14 12:59:35 LOG6[37]: OCSP: Status: good 2018.05.14 12:59:35 LOG6[37]: OCSP: This update: May 14 01:38:59 2018 GMT 2018.05.14 12:59:35 LOG6[37]: OCSP: Next update: May 21 01:38:59 2018 GMT 2018.05.14 12:59:35 LOG5[37]: OCSP: Certificate accepted 2018.05.14 12:59:35 LOG5[37]: Certificate accepted at depth=0: C=DE, ST=Rheinland-Pfalz, L=Montabaur, O=1&1 Internet SE, CN=smtp.1and1.es 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 read server certificate A 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 read server key exchange A 2018.05.14 12:59:35 LOG6[37]: Client certificate not requested 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 read server done A 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 write client key exchange A 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 write change cipher spec A 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 write finished A 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 flush data 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 read finished A 2018.05.14 12:59:35 LOG7[37]: 1 client connect(s) requested 2018.05.14 12:59:35 LOG7[37]: 1 client connect(s) succeeded 2018.05.14 12:59:35 LOG7[37]: 0 client renegotiation(s) requested 2018.05.14 12:59:35 LOG7[37]: 0 session reuse(s) 2018.05.14 12:59:35 LOG6[37]: TLS connected: new session negotiated 2018.05.14 12:59:35 LOG7[37]: Peer certificate was cached (5543 bytes) 2018.05.14 12:59:35 LOG6[37]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.05.14 12:59:35 LOG7[37]: Compression: null, expansion: null 2018.05.14 12:59:53 LOG3[36]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing 2018.05.14 12:59:53 LOG5[36]: Connection closed: 15 byte(s) sent to TLS, 166 byte(s) sent to socket I can't find the error. Thanks in advance for your help. Best regards, Alix

2 5

stunnel-5.44 fails cross compile due to wrong include path in Gentoo....fix available
by Joe Harvell 14 May '18

14 May '18

The src/Makefile.am hardcodes -I/usr/kerberos/include. When cross compiling it should be including -I$(SYSROOT)//usr/kerberos/include. I patched configure.ac and Makefile.am, taking advantage of the existing --with-sysroot configure option. The Gentoo bug report: https://bugs.gentoo.org/654374 The patch to configure.ac and Makefile.am: https://654374.bugs.gentoo.org/attachment.cgi?id=528968 I was unable to find a bug reporting system for stunnel. So I guess this is it. Please source this fix. --- Joe Harvell

1 1

help with tls config in stunnel
by Daniel Trickett 10 May '18

10 May '18

Hi, We are running stunnel 5.44 on Solaris. Our b2b legacy system is using TLS 1.0. We have a supplier who recently switched to TLS 1.2 and we can no longer connect to the site from our b2b. How can I configure stunnel to connect to the supplier site using TLS 1.2? TIA. Dan T This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click http://www.emdgroup.com/emd/imprint/mail_disclaimer.html to access the German, French, Spanish and Portuguese versions of this disclaimer.

1 0

How to tell if commuications are encrypted?
by Alex Birchall 10 May '18

10 May '18

Hello, I have Stunnel installed on Windows Server 2008 R2, running as a service. I have it installed as a client on a Windows POS 2009 device. This setup is working, in that the client is operating correctly and using Stunnel. But how can I tell if communications between the Stunnel client and the Stunnel server are being encrypted, rather than Stunnel just doing port forwarding? I did read the client needs to have access to the server's certificate, but at the moment it does not. Alex

2 1

Stunnel to Outlook
by DPS Support 09 May '18

09 May '18

I am trying to get a device on my network to send pop email notifications to my outlook account but can't seem to get it to work. I have enabled the outlook account to accept pop and enabled the client to send them. I'm not sure if I'm missing something or what, any help would be greatly appreciated. Here is my config: debug = info output = stunnel.log [outlook-pop3] client = yes accept = 110 connect = pop-mail.outlook.com:995 [outlook-imap] client = yes accept = 143 connect = imap-mail.outlook.com:993 [outlook-smtp] protocol = smtp client = yes accept = 25 connect = smtp-mail.outlook.com:587 Here is the log as well: 2018.05.08 15:15:03 LOG5[main]: stunnel 5.44 on x86-pc-msvc-1500 platform 2018.05.08 15:15:03 LOG5[main]: Compiled/running with OpenSSL 1.0.2m-fips 2 Nov 2017 2018.05.08 15:15:03 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2018.05.08 15:15:03 LOG5[main]: Reading configuration from file stunnel.conf 2018.05.08 15:15:03 LOG5[main]: UTF-8 byte order mark detected 2018.05.08 15:15:03 LOG5[main]: FIPS mode disabled 2018.05.08 15:15:03 LOG6[main]: Initializing service [outlook-pop3] 2018.05.08 15:15:03 LOG4[main]: Service [outlook-pop3] needs authentication to prevent MITM attacks 2018.05.08 15:15:03 LOG6[main]: Initializing service [outlook-imap] 2018.05.08 15:15:03 LOG4[main]: Service [outlook-imap] needs authentication to prevent MITM attacks 2018.05.08 15:15:03 LOG6[main]: Initializing service [outlook-smtp] 2018.05.08 15:15:03 LOG4[main]: Service [outlook-smtp] needs authentication to prevent MITM attacks 2018.05.08 15:15:03 LOG5[main]: Configuration successful 2018.05.08 15:15:03 LOG5[main]: Logging to C:\Users\dps_engineer\AppData\Local\stunnel.log 2018.05.08 15:15:53 LOG5[0]: Service [outlook-pop3] accepted connection from 126.10.230.254:52629 2018.05.08 15:15:53 LOG6[0]: failover: round-robin, starting at entry #1 2018.05.08 15:15:53 LOG6[0]: s_connect: connecting 40.97.135.130:995 2018.05.08 15:15:53 LOG5[0]: s_connect: connected 40.97.135.130:995 2018.05.08 15:15:53 LOG5[0]: Service [outlook-pop3] connected remote server from 126.10.218.222:60145 2018.05.08 15:15:53 LOG6[0]: SNI: sending servername: pop-mail.outlook.com 2018.05.08 15:15:53 LOG6[0]: Peer certificate not required 2018.05.08 15:15:54 LOG6[0]: Certificate verification disabled 2018.05.08 15:15:54 LOG6[0]: Certificate verification disabled 2018.05.08 15:15:54 LOG6[0]: Client certificate not requested 2018.05.08 15:15:54 LOG6[0]: TLS connected: new session negotiated 2018.05.08 15:15:54 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.05.08 15:15:55 LOG6[0]: Read socket closed (readsocket) 2018.05.08 15:15:55 LOG6[0]: SSL_shutdown successfully sent close_notify alert 2018.05.08 15:15:55 LOG6[0]: TLS socket closed (SSL_read) 2018.05.08 15:15:55 LOG5[0]: Connection closed: 58 byte(s) sent to TLS, 253 byte(s) sent to socket 2018.05.08 15:15:55 LOG5[1]: Service [outlook-smtp] accepted connection from 126.10.230.254:52639 2018.05.08 15:15:55 LOG6[1]: failover: round-robin, starting at entry #2 2018.05.08 15:15:55 LOG6[1]: s_connect: connecting 40.97.162.162:587 2018.05.08 15:15:55 LOG5[1]: s_connect: connected 40.97.162.162:587 2018.05.08 15:15:55 LOG5[1]: Service [outlook-smtp] connected remote server from 126.10.218.222:60147 2018.05.08 15:15:55 LOG6[1]: SNI: sending servername: smtp-mail.outlook.com 2018.05.08 15:15:55 LOG6[1]: Peer certificate not required 2018.05.08 15:15:55 LOG6[1]: Certificate verification disabled 2018.05.08 15:15:55 LOG6[1]: Certificate verification disabled 2018.05.08 15:15:55 LOG6[1]: Empty client CA list 2018.05.08 15:15:55 LOG6[1]: TLS connected: new session negotiated 2018.05.08 15:15:55 LOG6[1]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.05.08 15:16:00 LOG6[1]: TLS socket closed (SSL_read) 2018.05.08 15:16:00 LOG5[1]: Connection closed: 50 byte(s) sent to TLS, 194 byte(s) sent to socket 2018.05.08 15:16:00 LOG5[2]: Service [outlook-pop3] accepted connection from 126.10.230.254:52644 2018.05.08 15:16:00 LOG6[2]: failover: round-robin, starting at entry #2 2018.05.08 15:16:00 LOG6[2]: s_connect: connecting 40.97.161.50:995 2018.05.08 15:16:00 LOG5[2]: s_connect: connected 40.97.161.50:995 2018.05.08 15:16:00 LOG5[2]: Service [outlook-pop3] connected remote server from 126.10.218.222:60149 2018.05.08 15:16:00 LOG6[2]: SNI: sending servername: pop-mail.outlook.com 2018.05.08 15:16:00 LOG6[2]: Peer certificate not required 2018.05.08 15:16:00 LOG6[2]: Certificate verification disabled 2018.05.08 15:16:00 LOG6[2]: Certificate verification disabled 2018.05.08 15:16:00 LOG6[2]: Client certificate not requested 2018.05.08 15:16:00 LOG6[2]: TLS connected: new session negotiated 2018.05.08 15:16:00 LOG6[2]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.05.08 15:16:01 LOG6[2]: TLS socket closed (SSL_read) 2018.05.08 15:16:01 LOG5[2]: Connection closed: 58 byte(s) sent to TLS, 253 byte(s) sent to socket 2018.05.08 15:16:01 LOG5[3]: Service [outlook-smtp] accepted connection from 126.10.230.254:52647 2018.05.08 15:16:01 LOG6[3]: failover: round-robin, starting at entry #3 2018.05.08 15:16:01 LOG6[3]: s_connect: connecting 40.97.162.146:587 2018.05.08 15:16:01 LOG5[3]: s_connect: connected 40.97.162.146:587 2018.05.08 15:16:01 LOG5[3]: Service [outlook-smtp] connected remote server from 126.10.218.222:60150 2018.05.08 15:16:01 LOG6[3]: SNI: sending servername: smtp-mail.outlook.com 2018.05.08 15:16:01 LOG6[3]: Peer certificate not required 2018.05.08 15:16:01 LOG6[3]: Certificate verification disabled 2018.05.08 15:16:01 LOG6[3]: Certificate verification disabled 2018.05.08 15:16:01 LOG6[3]: Empty client CA list 2018.05.08 15:16:01 LOG6[3]: TLS connected: new session negotiated 2018.05.08 15:16:01 LOG6[3]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.05.08 15:16:03 LOG6[cron]: Executing cron jobs 2018.05.08 15:16:03 LOG6[cron]: Cron jobs completed in 0 seconds 2018.05.08 15:16:06 LOG6[3]: TLS socket closed (SSL_read) 2018.05.08 15:16:06 LOG5[3]: Connection closed: 50 byte(s) sent to TLS, 194 byte(s) sent to socket 2018.05.08 15:16:06 LOG5[4]: Service [outlook-pop3] accepted connection from 126.10.230.254:52653 2018.05.08 15:16:06 LOG6[4]: failover: round-robin, starting at entry #3 2018.05.08 15:16:06 LOG6[4]: s_connect: connecting 40.97.134.18:995 2018.05.08 15:16:06 LOG5[4]: s_connect: connected 40.97.134.18:995 2018.05.08 15:16:06 LOG5[4]: Service [outlook-pop3] connected remote server from 126.10.218.222:60153 2018.05.08 15:16:06 LOG6[4]: SNI: sending servername: pop-mail.outlook.com 2018.05.08 15:16:06 LOG6[4]: Peer certificate not required 2018.05.08 15:16:06 LOG6[4]: Certificate verification disabled 2018.05.08 15:16:06 LOG6[4]: Certificate verification disabled 2018.05.08 15:16:06 LOG6[4]: Client certificate not requested 2018.05.08 15:16:06 LOG6[4]: TLS connected: new session negotiated 2018.05.08 15:16:06 LOG6[4]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.05.08 15:16:07 LOG6[4]: Read socket closed (readsocket) 2018.05.08 15:16:07 LOG6[4]: SSL_shutdown successfully sent close_notify alert 2018.05.08 15:16:07 LOG6[4]: TLS socket closed (SSL_read) 2018.05.08 15:16:07 LOG5[4]: Connection closed: 58 byte(s) sent to TLS, 253 byte(s) sent to socket 2018.05.08 15:16:07 LOG5[5]: Service [outlook-smtp] accepted connection from 126.10.230.254:52656 2018.05.08 15:16:07 LOG6[5]: failover: round-robin, starting at entry #4 2018.05.08 15:16:07 LOG6[5]: s_connect: connecting 2603:1036:101::2:587 2018.05.08 15:16:07 LOG3[5]: s_connect: connect 2603:1036:101::2:587: Network is unreachable (WSAENETUNREACH) (10051) 2018.05.08 15:16:07 LOG6[5]: s_connect: connecting 2603:1036:102:108::2:587 2018.05.08 15:16:07 LOG3[5]: s_connect: connect 2603:1036:102:108::2:587: Network is unreachable (WSAENETUNREACH) (10051) 2018.05.08 15:16:07 LOG6[5]: s_connect: connecting 2603:1036:102:cc::2:587 2018.05.08 15:16:07 LOG3[5]: s_connect: connect 2603:1036:102:cc::2:587: Network is unreachable (WSAENETUNREACH) (10051) 2018.05.08 15:16:07 LOG6[5]: s_connect: connecting 2603:1036:102:8f::2:587 2018.05.08 15:16:07 LOG3[5]: s_connect: connect 2603:1036:102:8f::2:587: Network is unreachable (WSAENETUNREACH) (10051) 2018.05.08 15:16:07 LOG6[5]: s_connect: connecting 40.97.161.50:587 2018.05.08 15:16:08 LOG5[5]: s_connect: connected 40.97.161.50:587 2018.05.08 15:16:08 LOG5[5]: Service [outlook-smtp] connected remote server from 126.10.218.222:60158 2018.05.08 15:16:08 LOG6[5]: SNI: sending servername: smtp-mail.outlook.com 2018.05.08 15:16:08 LOG6[5]: Peer certificate not required 2018.05.08 15:16:08 LOG6[5]: Certificate verification disabled 2018.05.08 15:16:08 LOG6[5]: Certificate verification disabled 2018.05.08 15:16:08 LOG6[5]: Empty client CA list 2018.05.08 15:16:08 LOG6[5]: TLS connected: new session negotiated 2018.05.08 15:16:08 LOG6[5]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.05.08 15:16:13 LOG6[5]: TLS socket closed (SSL_read) 2018.05.08 15:16:13 LOG5[5]: Connection closed: 50 byte(s) sent to TLS, 194 byte(s) sent to socket Sent from Outlook<http://aka.ms/weboutlook>

2 1

Stunnel Time out Error
by Sedick Cloete 07 May '18

07 May '18

HI All, We recently moved our email server from an in-house server to Office 365. We are now in the process of replacing all our XP boxes with Windows 10. One of the boxes are running the email service which collects emails from Office 365, that we have just recently upgraded. This process works on the XP but times out on windows 10. Attached, is the time out the log file. Below is the code I am using: Basic program code * variables ChannelNo = 0 Pop3Server = 'outlook.office365.com' Pop3User = UserName Pop3Pass = Password Pop3Port = '995' ProxYServer = '127.0.0.1' ProxyPort = '110' ProxyDir = 'C:\see4OI\SSL\' ProxyExe = 'stunnel.exe' ProxyCert = 'stunnel.pem' * retreives mail in MIME format Gosub GET_EMAILS return Mail_Rec * ---------------------------------------------------------------------------- ------------- GET_EMAILS: * close previous session If it wasnt closed properly Code = seeClose(ChannelNo) Code = seeRelease() * attach key code Code = seeAttach(1, KeyCode) if Code < 0 then RetFlag = 1 return end * start stunnel Code = seeSetProxySSL(0, 1, ProxyDir, ProxyCert, ProxyExe) If Code < 0 Then RETURN end * connect to email server Code = seePop3ConnectSSL(ChannelNo, ProxyPort, Pop3Port, Pop3Server, Pop3User, Pop3Pass, ProxyServer) If Code < 0 Then RETURN End Your assistance in this regard will be highly appreciated. Thank you. Kind Regards, Logicore SEDICK CLOETE IT Business Consultant Cell: 083 228 7058 Fax: 086 515 9695 email: sedick(a)logicore.co.za If you are not the intended recipient of this communication, please notify the sender immediately. The information and/or attachment contained in this email is confidential and may contain proprietary and/or personal information. It is meant solely for the intended recipient. Access to this email by anyone else is unauthorised. If you are not the intended recipient, any processing of the email or the information contained therein (including disclosure, copying, distribution, storage) or any action taken or omitted in reliance on this, is prohibited and may be unlawful.

2 1

How to configure stunnel client on Mac
by Mark Foley 04 May '18

04 May '18

I've successfully set up stunnel for Windows and Linux clients. Now to set up for Mac. I've gone to the website http://macappstore.org/stunnel/ and followed the instructions there which are: 1. Press Command+Space and type Terminal and press enter/return key. 2. Run in Terminal app: ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)" < /dev/null 2> /dev/null and press enter/return key. 3. Run: brew install stunnel And then it says, "Done! You can now use stunnel." Well, not exactly. Where do I put my stunnel.conf and certificate.pem? How do I make stunnel run automatically at boot time? The web instructions aren't very complete. Need additional assistance. THX --Mark

1 1

Stunnel in Windows Failover cluster
by Tobias Gillstöm 27 Apr '18

27 Apr '18

Hi, I'm currently using stunnel in a windows fail over cluster: My problem is that when a fail over occurs stunnel switches too the other node and says that stunnel is running and everything is fine. But when I check the logs for stunnel and the program that uses stunnel, it does not appear to be running or sending any data. In the screenshot you can see my stunnel configuration, in the startup parameters section it says "-service -install" my question is if it shouldn't say "-service -start" instead, has anyone else encountered this problem? And if this is the problem why does the stunnel service install with these parameters?

1 0

Ubuntu 16.04.4 LTS SSLv3 and SSlv2 running stunnel 5.44
by Joe Phillips 25 Apr '18

25 Apr '18

I am running stunnel 5.44 on Ubuntu 16.04.4 LTS with all updates. I cannot get devices to connect using sslv2 or 3. My conf file Options line as seen below : ;Enable support for inecure SSLv3 protocol Options = -NO_SSLv3 Options = -NO_SSLv2 I continuously get error 1408A10B SSL routines: ssl3_get_client_hello:wrong version number Do I not have SSL3 and 2 correctly defined in my conf file? I realize 2 and 3 are no longer secure, but I need to support them while I transition to TLS 1.2 thanks [cid:image001.png@01D3DC17.D1AFBC30]

2 1

stunnel as a Windows Service
by Paul Muller 20 Apr '18

20 Apr '18

Does anyone have any documentation on how to setup stunnel as a Windows Service? I currently have it installed on a Windows Server 2012 R2 Standard. I noticed that stunnel stops running as soon as I log off of my RDP session on the server. [logo1] Paul A. Muller * Systems and Networking Consultant Earnest & Associates * Profitability Improvement Specialists Voice: 305.822.5353 x354 * Fax: 305.822.5848 Email: paul.muller(a)earnestassoc.com<mailto:paul.muller@earnestassoc.com> * Web: earnestassoc.com<http://www.earnestassoc.com/> * Twitter: @earnestassoc<http://twitter.com/earnestassoc>

2 1

Rapid subsequent DNS resolution fails within stunnel
by Vincent Deschenes 20 Apr '18

20 Apr '18

Hi, We have had this weird problem for a long time where sometime DNS resolution will fail with this error: Error resolving 'domain name printed here': Neither nodename nor servname known (EAI_NONAME) Today I found out that this will happen when stunnel get 2 calls for the same outgoing endpoint very fast one after the other. One call will work no problem. But if you do 2 one after the other then the second one and all other subsequent will fail. Wait a bit and try again, the first one will pass and then others will fail. DNS resolution on the server (linux) itself work without problem, nslookup in loops no problem. But with stunnel we always have the problem. The only working solution is to add a record to the server host file. Any idea ? Could this be a bug in stunnel ? Thanks, Vincent

1 1

Authentication
by Paul Muller 20 Apr '18

20 Apr '18

When I first setup stunnel, I changed my software to reflect the [gmail-smtp] entries in my configuration file. When I tried to send an email from my application I received the following message: "No Email sent, Error 535-5.7.8 Username and Password not accepted." Then I remarked out the authentication credentials in my software. When I tried to send an email I received the following message: "No Email sent, Error-5.5.1 Authentication Required." My question is, can place my authentication credentials in the "stunnel.conf" file? And if so, where? Thanks, [logo1] Paul A. Muller * Systems and Networking Consultant Earnest & Associates * Profitability Improvement Specialists Voice: 305.822.5353 x354 * Fax: 305.822.5848 Email: paul.muller(a)earnestassoc.com<mailto:paul.muller@earnestassoc.com> * Web: earnestassoc.com<http://www.earnestassoc.com/> * Twitter: @earnestassoc<http://twitter.com/earnestassoc>

2 2

/etc/hosts setting
by White Little 17 Apr '18

17 Apr '18

Hi All I found a interesting issue with /etc/hosts setting in different Linux system. My stunnel.conf setting like below [HOST] cert = client.crt key = client.key CAfile = server.crt client = yes accept = 10.160.160.88:57853 connect = 10.136.160.21:3520 I would like to connect server 10.136.160.21:3520 via stunnel 10.160.160.88:57853 Part A If my hostname and /etc/hosts setting in different System as followings all will works well 1. CentOS 7 32bit $hostname localhost.localdomain $ cat /etc/hosts 127.0.0.1 localhost localhost4 localhost4.localdomain4 10.136.160.88 localhost.localadmin 2. Redhat 7 64bit $hostname localhost.localdomain $ cat /etc/hosts 127.0.0.1 localhost localhost4 localhost4.localdomain4 10.136.160.88 localhost.localadmin 3. Ubuntu15.10 64bit $hostname virtual-machine $ cat /etc/hosts 127.0.0.1 localhost 10.136.160.88 virtual-machine Part B. If the "127.0.0.1" include the hostname in /etc/hosts, both CentOS and Fedora will fail, but Ubuntu still work 1. CentOS 7 32bit $hostname localhost.localdomain $ cat /etc/hosts 127.0.0.1 localhost* localhost.localdomain* localhost4 localhost4.localdomain4 10.136.160.253 localhost.localdomain 2. Redhat 7 64bit $hostname localhost.localdomain $ cat /etc/hosts 127.0.0.1 localhost *localhost.localdomain* localhost4 localhost4.localdomain4 10.136.160.88 localhost.localadmin 3. Ubuntu15.10 64bit $hostname virtual-machine $ cat /etc/hosts 127.0.0.1 localhost *virtual-machine* 10.136.160.88 virtual-machine I think it maybe not a stunnel issue, but I'd like to know why it has different behavior Thanks Jay

2 2

make_test failing
by Ian Bamforth 16 Apr '18

16 Apr '18

Morning, Our CI has been failing since Friday with the same errors seen at https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/stunnel4…. make_test fails on 012_verify_chain and 013_CRL_file. Anyone else seeing the same thing? We run Ubuntu 14.04, stunnel v5.44, automatically applying apt security patches to the OS. My initial assumption is that some dependency of stunnel has been updated, but I've not had chance to find out. We have been using the same version of stunnel since the day it was released without any other problems. Ian

2 2

Invalid certificate in tests, prevents make_test from running
by Ian Bamforth 16 Apr '18

16 Apr '18

Morning, I posted earlier about `make_test` failing, apologies for not replying to that thread but I didn't receive the email myself. I've tracked this down to `tests/certs/CACert.pem` containing an expired certificate - see below output: openssl x509 -in tests/certs/CACert.pem -text -noout Certificate: Data: Version: 3 (0x2) Serial Number: 1 (0x1) Signature Algorithm: sha1WithRSAEncryption Issuer: C=pl, O=CA_cert, OU=CA_cert, CN=CA_cert/emailAddress=CA_cert(a)example.com Validity Not Before: Apr 26 18:41:00 2017 GMT Not After : Apr 13 15:45:00 2018 GMT Subject: C=pl, O=CA_cert, OU=CA_cert, CN=CA_cert/emailAddress=CA_cert(a)example.com Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: 00:af:cc:61:f5:73:2b:49:3c:62:c0:b0:d6:1b:0f: 5e:32:d1:49:48:01:b2:35:36:a8:04:a3:e0:7e:e4: 1d:f9:cb:fe:11:0a:c3:2e:b1:3e:87:4c:b0:72:d7: 73:04:ba:28:c7:2b:b4:67:13:0e:5d:05:7f:67:bd: ba:7f:c5:89:b0:48:d6:21:4b:e8:3a:70:ac:dc:e4: f5:43:c3:c9:57:7f:73:f1:3b:b0:e5:a5:90:44:9f: 6e:c3:2a:f5:ab:e6:15:f3:de:cd:44:23:5e:4f:c2: eb:44:59:6c:f5:76:46:b0:7c:fc:59:df:20:97:0c: 0f:43:ae:df:47:f6:d2:78:fd:c6:be:11:cf:26:a1: 8d:87:74:2f:c9:b5:1b:2b:9d:a4:95:44:0c:54:de: 0c:12:d4:8d:14:57:31:a7:a8:70:11:68:6e:20:3d: 76:c9:c8:45:50:d5:4e:2f:f1:6e:78:25:23:05:45: 6e:7d:11:2a:b3:e8:88:6e:68:29:2c:a2:c2:3d:cf: 41:50:b5:e1:51:8f:8e:f4:36:0f:f5:a8:63:5e:29: 1d:b4:fe:71:43:d0:2a:be:2a:2c:b1:62:c6:b9:bc: 4d:95:80:4e:60:ec:e9:79:92:19:31:9c:b2:00:74: 3b:a1:80:57:b4:22:45:c8:d3:1a:a7:4f:f6:00:12: 35:b7 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: CA:TRUE Signature Algorithm: sha1WithRSAEncryption 97:03:b2:c1:a2:44:8a:2a:9c:1d:3c:cb:61:a6:f9:bc:7f:4f: 21:fc:69:d8:f3:31:7b:4b:e5:2b:34:42:19:03:1a:40:af:fa: 7e:18:93:99:a8:78:cb:32:15:23:75:6e:49:6d:ac:ee:ca:5e: d6:d2:69:5a:b5:4a:13:cd:7c:77:e4:f2:6d:a0:2d:63:2f:62: b5:be:24:ee:12:d7:22:3e:dd:d2:56:07:81:ca:c4:cf:4c:2c: 36:64:32:52:b1:76:76:5f:c7:45:86:b9:34:1a:c7:37:0c:38: ce:8b:20:8b:70:a1:33:a0:e1:3d:ed:9a:26:c0:04:e7:35:c5: 41:ab:bd:f9:cc:10:8d:12:3f:7a:ee:b3:a3:98:35:09:b2:e5: 5f:aa:22:16:7e:18:df:61:ac:3d:30:48:f7:77:41:5c:25:bd: 6f:dc:53:d0:f3:d7:cc:33:f6:77:36:99:0b:e4:8f:3e:83:e4: ca:3a:58:6f:73:55:83:6e:a7:01:b2:21:bf:09:54:28:e3:e0: a5:4f:bd:d7:66:a2:f8:c2:81:6f:0d:aa:ba:6f:7d:a9:cf:6f: 06:a8:a2:b1:5b:3b:f9:7b:89:bf:f5:c4:ed:f0:5e:cf:64:87: 39:84:90:6c:c9:e0:5d:b4:54:ae:a7:6c:e7:b4:2a:29:fe:ab: 62:4f:91:d0 As a (horrible) workaround I've had to skip "make_test" in my CI - if there are any better ideas please let me know! Ian

1 0

Possible memory leak with stunnel reload
by Mark Brookes 06 Apr '18

06 Apr '18

Hi all, we have noticed that when reloading (note reloading not restarting) stunnel it appears to be leaking between 12 and 32 bytes of memory (ish) per reload. There does not need to be any traffic passing through it at the time to view this problem. If its reloaded enough times the system will eventually run out of memory. Unless an stunnel restart if performed inbetween. We are running 5.41 tried with the latest 5.44 and have the same result. We are using openssl 1.0.2j-fips ive tried with 1.0.2n and 1.1.0e (to try and rule out openssl) We are reloading by running: kill -s HUP <pid> The stunnel configuration is - pid = /var/run/stunnel/stunnel.pid debug = 7 syslog = no output = /var/log/stunnel.log socket = a:IP_FREEBIND=yes fips = no sslVersion = all [VIP_Name] cert = /etc/loadbalancer.org/certs/server.pem ciphers = ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DHE-RSA-AES256-SHA256:!RC4:!MD5:!aNULL:!EDH:!3DES accept = 192.168.80.16:443 connect = 127.0.0.5:80 delay = yes options = NO_SSLv3 options = NO_TLSv1 options = DONT_INSERT_EMPTY_FRAGMENTS renegotiation = no local = 192.168.80.16 TIMEOUTclose = 0 The stunnel log file is as follows - 2018.04.03 11:09:59 LOG7[ui]: Clients allowed=62937 2018.04.03 11:09:59 LOG5[ui]: stunnel 5.44 on x86_64-pc-linux-gnu platform 2018.04.03 11:09:59 LOG5[ui]: Compiled/running with OpenSSL 1.0.2j-fips 26 Sep 2016 2018.04.03 11:09:59 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2018.04.03 11:09:59 LOG7[ui]: errno: (*__errno_location ()) 2018.04.03 11:09:59 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf 2018.04.03 11:09:59 LOG5[ui]: UTF-8 byte order mark not detected 2018.04.03 11:09:59 LOG5[ui]: FIPS mode disabled 2018.04.03 11:09:59 LOG7[ui]: Compression disabled 2018.04.03 11:09:59 LOG7[ui]: Snagged 64 random bytes from /dev/urandom 2018.04.03 11:09:59 LOG7[ui]: PRNG seeded successfully 2018.04.03 11:09:59 LOG6[ui]: Initializing service [VIP_Name] 2018.04.03 11:09:59 LOG7[ui]: Ciphers: ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DHE-RSA-AES256-SHA256:!RC4:!MD5:!aNULL:!EDH:!3DES 2018.04.03 11:09:59 LOG7[ui]: TLS options: 0x07004804 (+0x07004800, -0x00000000) 2018.04.03 11:09:59 LOG6[ui]: Loading certificate from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:09:59 LOG6[ui]: Certificate loaded from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:09:59 LOG6[ui]: Loading private key from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:09:59 LOG6[ui]: Private key loaded from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:09:59 LOG7[ui]: Private key check succeeded 2018.04.03 11:09:59 LOG7[ui]: ECDH initialization 2018.04.03 11:09:59 LOG7[ui]: ECDH initialized with curve prime256v1 2018.04.03 11:09:59 LOG5[ui]: Configuration successful 2018.04.03 11:09:59 LOG7[ui]: Binding service [VIP_Name] 2018.04.03 11:09:59 LOG7[ui]: Listening file descriptor created (FD=6) 2018.04.03 11:09:59 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2018.04.03 11:09:59 LOG7[ui]: Option IP_FREEBIND set on accept socket 2018.04.03 11:09:59 LOG7[ui]: Service [VIP_Name] (FD=6) bound to 192.168.80.16:443 2018.04.03 11:09:59 LOG7[main]: Created pid file /var/run/stunnel/stunnel.pid 2018.04.03 11:09:59 LOG7[cron]: Cron thread initialized 2018.04.03 11:10:59 LOG6[cron]: Executing cron jobs 2018.04.03 11:10:59 LOG6[cron]: Cron jobs completed in 0 seconds 2018.04.03 11:10:59 LOG7[cron]: Waiting 86400 seconds 2018.04.03 11:11:08 LOG7[main]: Found 1 ready file descriptor(s) 2018.04.03 11:11:08 LOG7[main]: FD=4 events=0x2001 revents=0x1 2018.04.03 11:11:08 LOG7[main]: FD=6 events=0x2001 revents=0x0 2018.04.03 11:11:08 LOG7[main]: Dispatching signals from the signal pipe 2018.04.03 11:11:08 LOG7[main]: Processing SIGNAL_RELOAD_CONFIG 2018.04.03 11:11:08 LOG5[main]: Reading configuration from file /etc/stunnel/stunnel.conf 2018.04.03 11:11:08 LOG5[main]: UTF-8 byte order mark not detected 2018.04.03 11:11:08 LOG5[main]: FIPS mode disabled 2018.04.03 11:11:08 LOG7[main]: Compression disabled 2018.04.03 11:11:08 LOG7[main]: Snagged 64 random bytes from /dev/urandom 2018.04.03 11:11:08 LOG7[main]: PRNG seeded successfully 2018.04.03 11:11:08 LOG6[main]: Initializing service [VIP_Name] 2018.04.03 11:11:08 LOG7[main]: Ciphers: ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DHE-RSA-AES256-SHA256:!RC4:!MD5:!aNULL:!EDH:!3DES 2018.04.03 11:11:08 LOG7[main]: TLS options: 0x07004804 (+0x07004800, -0x00000000) 2018.04.03 11:11:08 LOG6[main]: Loading certificate from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:11:08 LOG6[main]: Certificate loaded from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:11:08 LOG6[main]: Loading private key from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:11:08 LOG6[main]: Private key loaded from file: /etc/ loadbalancer.org/certs/server.pem 2018.04.03 11:11:08 LOG7[main]: Private key check succeeded 2018.04.03 11:11:08 LOG7[main]: ECDH initialization 2018.04.03 11:11:08 LOG7[main]: ECDH initialized with curve prime256v1 2018.04.03 11:11:08 LOG5[main]: Configuration successful 2018.04.03 11:11:08 LOG7[main]: Unbinding service [VIP_Name] 2018.04.03 11:11:08 LOG7[main]: Service [VIP_Name] closed (FD=6) 2018.04.03 11:11:08 LOG7[main]: Service [VIP_Name] closed 2018.04.03 11:11:08 LOG7[main]: Binding service [VIP_Name] 2018.04.03 11:11:08 LOG7[main]: Listening file descriptor created (FD=6) 2018.04.03 11:11:08 LOG7[main]: Option SO_REUSEADDR set on accept socket 2018.04.03 11:11:08 LOG7[main]: Option IP_FREEBIND set on accept socket 2018.04.03 11:11:08 LOG7[main]: Service [VIP_Name] (FD=6) bound to 192.168.80.16:443 2018.04.03 11:11:08 LOG7[main]: Signal pipe is empty Any help would be appreciated. Thanks -- Mark Brookes Loadbalancer.org Ltd. www.loadbalancer.org +44 (0)330 380 1064 mark(a)loadbalancer.org

2 2

Motion and Stunnel Query
by Vidya Govindan 04 Apr '18

04 Apr '18

Hi Everyone, I am trying to work on a video streaming project which uses the motion software to stream images from a usb camera. By default the streaming is done in a non-secure manner. So I installed Stunnel , generated a self signed certificate and I am not using it on top of the motion software to securely stream images. Now, I want to know exactly how Stunnel encrypts/decrypts image data that is generated by motion? I know that motion sends the data on port 8081 and Stunnel tunnels it to another port 8443. I can not understand where exactly the Openssl library functions are used to add the security feature in this scenario. Can anyone with a better understanding throw some light on the same? Thanks & Regards, Vidya

1 0

proxy with authentication
by Andreas Meier 03 Apr '18

03 Apr '18

3 3

First Time Troubles.
by me＠kilosierracharlie.me 22 Mar '18

22 Mar '18

Hello All, I'm trying to configure STunnel4 on Windows to connect to my VPS installed with STunnel, so I can use SSH through a DPI laden network. The configuration works if I try at home, or on a mobile data hotspot, but if I attempt within the DPI network, it does not work, and provides this console output: 2018.03.22 09:30:15 LOG5[main]: stunnel 5.44 on x86-pc-msvc-1500 platform 2018.03.22 09:30:15 LOG5[main]: Compiled/running with OpenSSL 1.0.2m-fips 2 Nov 2017 2018.03.22 09:30:15 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2018.03.22 09:30:15 LOG5[main]: Reading configuration from file stunnel.conf 2018.03.22 09:30:15 LOG5[main]: UTF-8 byte order mark detected 2018.03.22 09:30:15 LOG5[main]: FIPS mode disabled 2018.03.22 09:30:15 LOG5[main]: Configuration successful 2018.03.22 09:30:24 LOG5[0]: Service [ssh] accepted connection from 127.0.0.1:65086 2018.03.22 09:30:24 LOG5[0]: s_connect: connected 130.185.251.28:443 2018.03.22 09:30:24 LOG5[0]: Service [ssh] connected remote server from 172.28.1.25:65087 2018.03.22 09:30:25 LOG4[0]: CERT: Certificate not found in local repository 2018.03.22 09:30:25 LOG4[0]: Rejected by CERT at depth=0: CN=130.185.251.28 2018.03.22 09:30:25 LOG3[0]: SSL_connect: 14090086: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed 2018.03.22 09:30:25 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket This is the configuration I'm using: [ssh] client = yes accept = 443 connect = 130.185.251.28:443 CAfile = peer-ssh.pem verifyPeer = yes The odd thing, is that if I connect using my mobile data, and then switch over to filtered internet and try again, it works fine, and adds the following lines to the log: 2018.03.22 09:36:46 LOG5[1]: Service [ssh] accepted connection from 127.0.0.1:65237 2018.03.22 09:36:46 LOG5[1]: s_connect: connected 130.185.251.28:443 2018.03.22 09:36:46 LOG5[1]: Service [ssh] connected remote server from 192.168.43.115:65238 2018.03.22 09:36:46 LOG5[1]: Certificate accepted at depth=0: C=GB, ST=Lincolnshire, L=Horncastle, O=N/A, OU=N/A, CN=personal.kilosierracharlie.me, emailAddress=webmaster(a)kilosierracharlie.me Has anyone got any ideas regarding this issue? It's not mission critical, but it's quite annoyingly repetitive! Cheers, Kieran.

1 0

sTunnel client connecting to load balanced URL - stunnel 5.02 on x86-pc-msvc-1500 platform
by Tony 19 Mar '18

19 Mar '18

Hi all, I have a situation where I'm trying to use sTunnel as the client to connect to a service on a secure URL, but the hiccup is that the secure URL is load balanced. If a do an nslookup on the URL, the response comes back as it being an alias. Non-authoritative answer: Name: eu1571393051174.ssl.ondemand.com Address: 155.56.210.164 Aliases: l4884-iflmap.hcisbp.eu1.hana.ondemand.com Looking at the sTunnel log, it resolves to the IP of the server. But the IP itself does not host the service so I'm getting http:503 errors. 2018.03.16 14:44:44 LOG7[18796]: Service [ssl-OSRdev] (FD=564) bound to 0.0.0.0:8085 2018.03.16 14:44:55 LOG7[18796]: Service [ssl-OSRdev] accepted (FD=572) from 192.168.0.22:61093 2018.03.16 14:44:55 LOG7[18796]: Creating a new thread 2018.03.16 14:44:55 LOG7[18796]: New thread created 2018.03.16 14:44:55 LOG7[30864]: Service [ssl-OSRdev] started 2018.03.16 14:44:55 LOG5[30864]: Service [ssl-OSRdev] accepted connection from 192.168.0.22:61093 2018.03.16 14:44:55 LOG6[30864]: s_connect: connecting 155.56.210.164:443 2018.03.16 14:44:55 LOG7[30864]: s_connect: s_poll_wait 155.56.210.164:443: waiting 10 seconds 2018.03.16 14:44:56 LOG5[30864]: s_connect: connected 155.56.210.164:443 2018.03.16 14:44:56 LOG5[30864]: Service [ssl-OSRdev] connected remote server from 192.168.0.32:30269 2018.03.16 14:44:56 LOG7[30864]: Remote socket (FD=588) initialized 2018.03.16 14:44:56 LOG7[30864]: SNI: sending servername: l4884-iflmap.hcisbp.eu1.hana.ondemand.com 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): before/connect initialization 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv2/v3 write client hello A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 read server hello A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 read server certificate A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 read server key exchange A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 read server certificate request A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 read server done A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 write client certificate A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 write client key exchange A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 write certificate verify A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 write change cipher spec A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 write finished A 2018.03.16 14:44:56 LOG7[30864]: SSL state (connect): SSLv3 flush data 2018.03.16 14:44:57 LOG7[30864]: SSL state (connect): SSLv3 read finished A 2018.03.16 14:44:57 LOG7[30864]: 1 items in the session cache 2018.03.16 14:44:57 LOG7[30864]: 1 client connects (SSL_connect()) 2018.03.16 14:44:57 LOG7[30864]: 1 client connects that finished 2018.03.16 14:44:57 LOG7[30864]: 0 client renegotiations requested 2018.03.16 14:44:57 LOG7[30864]: 0 server connects (SSL_accept()) 2018.03.16 14:44:57 LOG7[30864]: 0 server connects that finished 2018.03.16 14:44:57 LOG7[30864]: 0 server renegotiations requested 2018.03.16 14:44:57 LOG7[30864]: 0 session cache hits 2018.03.16 14:44:57 LOG7[30864]: 0 external session cache hits 2018.03.16 14:44:57 LOG7[30864]: 0 session cache misses 2018.03.16 14:44:57 LOG7[30864]: 0 session cache timeouts 2018.03.16 14:44:57 LOG7[30864]: Peer certificate was cached (3826 bytes) 2018.03.16 14:44:57 LOG6[30864]: SSL connected: new session negotiated 2018.03.16 14:44:57 LOG6[30864]: Negotiated TLSv1/SSLv3 ciphersuite: ECDHE-RSA-AES128-GCM-SHA256 (128-bit encryption) 2018.03.16 14:44:57 LOG6[30864]: Compression: null, expansion: null 2018.03.16 14:44:58 LOG6[30864]: SSL socket closed (SSL_read) 2018.03.16 14:44:58 LOG7[30864]: Sent socket write shutdown 2018.03.16 14:44:58 LOG5[30864]: Connection closed: 1730 byte(s) sent to SSL, 274 byte(s) sent to socket 2018.03.16 14:44:58 LOG7[30864]: Remote socket (FD=588) closed 2018.03.16 14:44:58 LOG7[30864]: Local socket (FD=572) closed 2018.03.16 14:44:58 LOG7[30864]: Service [ssl-OSRdev] finished (0 left) 2018.03.16 14:44:58 LOG7[30864]: str_stats: 3 block(s), 4294962489 data byte(s), 150 control byte(s) 2018.03.16 14:44:58 LOG7[30864]: str_stats: 20 byte(s) at ..\src\network.c:413 2018.03.16 14:44:58 LOG7[30864]: str_stats: 20 byte(s) at ..\src\network.c:412 2018.03.16 14:44:58 LOG7[30864]: str_stats: 20 byte(s) at ..\src\network.c:411 I have tested the service using SoapUI and it works. Is it possible to have sTunnel follow the URL redirection? Regards, Tony

2 1

Re: [stunnel-users] basic usage question
by Mark Foley 19 Mar '18

19 Mar '18

Solved! I've fixed up the various ports and now I am able to connect. For the edification of other list readers I'll summarize. I have a local Linux host acting as firewall/router. It routes requests on port 1234 to port 3389 on a local Linux workstation which is running x11vnc server listening on its local port 5900. I want to connect to this VNC server from a remote vnc viewer. (Why does the router forward to port 3389? Because the workstaion can dual-boot Windows, so the forward works regardless of booted OS.) Remote vnc viewer, stunnel client stunnel.conf: verify = 2 pid = /home/mfoley/.stunnel/stunnel.pid CAfile = /home/mfoley/.stunnel/certificate.pem client = yes [x11vnc] accept = 5900 connect = router.obfuscate.org:1234 Local workstation vnc server, stunnel server stunnel.conf: pid = /var/run/stunnel.pid debug = 7 [x11vnc] accept = 3389 key = /root/privatekey.pem cert = /root/certificate.pem connect = 127.0.0.1:5900 The certificate is self-signed and created on the stunnel/vnc server host using the following commands: openssl genrsa -out privatekey.pem 2048 openssl req -new -x509 -days 365 -key privatekey.pem -out certificate.pem The certificate.pem is copied to the stunnel client host. With x11vnc listening on 5900 on the local workstation and with 'stunnel stunnel.conf' running on both stunnel client (as the normal user) and server hosts, I use the remote vnc viewer, logged in as a normal user, with the connection 127.0.0.1:5900 I'm guessing I could configure my vnc viewers to connect to multiple clients with difference [service] sections, for example: verify = 2 pid = /home/mfoley/.stunnel/stunnel.pid CAfile = /home/mfoley/.stunnel/certificate.pem client = yes [remoteHost1] accept = 5900 connect = router.obfuscate.org:1234 [remoteHost2] accept = 5901 connect = router.obfuscate.org:4321 I haven't tried that, but I will. I futher guess that I could have different CAfiles per server if I moved that directive to the respective service defintions (can someone confirm?), but I haven't tried that either. Thanks especially to Flo Rance for helping me work through this. Now, I have to figure out how to do this from a Windows client! --Mark

2 1

Creating CSR for GoDaddy
by John McClymont 15 Mar '18

15 Mar '18

Good Morning, As a novice user of stunnel. I use stunnel to make and encrypted video connection to home security system. I wish to create an SSL certificate request to obtain an SSL from GoDaddy I use the following command openssl req -new -newkey rsa:2048 -nodes -keyout c:\key\private_key.key -out c:\key\request.csr Is this correct? thanks in advance for suggestions

2 1

Re: [stunnel-users] basic usage question
by Mark Foley 15 Mar '18

15 Mar '18

Nitin - sorry, I didn't realize this was a response to my message and I sent a followup message before reading this one. I have your patch in a previous message. I'm not familiar with "patching". Can you give me quickie instructions on doing that, or refer me to a link that explains it? I assume I need to patch the source code, right? If so, I have stunnel version 5.35. Do I need to apply this patch to a more recent version? Are there any other sslVersions stunnel supports? Thanks --Mark -----Original Message----- On Tue, 13 Mar 2018 22:21:24 +0400 Nitin Mutkawoa <jmutkawoa(a)hackers.mu> wrote: > > hello > > Sorry, I was not clear enough in my previous mail. > The patch allows you to specify TLS 1.3 in the configuration file and do a > TLS 1.3 only. > > regards > > Nitin J Mutkawoa > > https://tunnelix.com > https://hackers.mu > > Twitter: @TheTunnelix > > On Tue, Mar 13, 2018 at 3:13 PM, Ma??gorzata Olszówka < > Malgorzata.Olszowka(a)stunnel.org> wrote: > > > I'm also working on TLS 1.3 compatibility with Stunnel. I will reach the > >> mailing list as soon as possible with a tested patch. > >> > > > > Hello Nitin, > > Could you specify what problem do you have with TLS 1.3. > > It works for me: > > > > 2018.03.13 11:39:06 LOG5[ui]: stunnel 5.44 on x86_64-unknown-linux-gnu > > platform > > 2018.03.13 11:39:06 LOG5[ui]: Compiled/running with OpenSSL > > 1.1.1-pre2-dev xx XXX xxxx > > ??? > > 2018.03.13 11:39:23 LOG6[0]: Negotiated TLSv1.3 ciphersuite > > TLS13-AES-256-GCM-SHA384 (256-bit encryption) > > > > > > Regards, > > Ma??gorzata > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)stunnel.org > > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > >

1 1

Re: [stunnel-users] basic usage question
by Mark Foley 14 Mar '18

14 Mar '18

Thanks to help from Nitin, I've made a tiny bit of progress with stunnel. I've created the certificates per Nitin's instructions at https://tunnelix.com/securing-mysql-traffic-with-stunnel-in-a-jail-environm… Certificates have permissions 0600. I want to use a VNC client on Linux to connect to a VNC Server also on Linux. In between these two computers I have a Linux router which routes all request to port 1914 to port 3389 on the VNC Server. stunnel on the server is run at the command line by root: 'stunnel /root/stunnel.conf'. Here is my VNC Server computer's stunnel.conf: foreground = yes pid = /var/run/stunnel.pid debug = 7 ; output = /root/stunnel.log output = /dev/stdout [x11vnc] accept = 3389 key = /root/privatekey.pem cert = /root/certificate.pem connect = 127.0.0.1:5900 stunnel on the client is run by a normal user, stunnel $HOME/.stunnel/stunnel.conf. Below is my client stunnel.conf: foreground = yes verify = 2 pid = /home/mfoley/.stunnel/stunnel.pid CAfile = /home/mfoley/.stunnel/certificate.pem client = yes [x11vnc] accept = 5900 connect = mail.ohprs.org:1914 When I run stunnel on the client I get: 2018.03.13 13:21:17 LOG5[ui]: stunnel 5.35 on x86_64-slackware-linux-gnu platform 2018.03.13 13:21:17 LOG5[ui]: Compiled with OpenSSL 1.0.2h 3 May 2016 2018.03.13 13:21:17 LOG5[ui]: Running with OpenSSL 1.0.2n 7 Dec 2017 2018.03.13 13:21:17 LOG5[ui]: Update OpenSSL shared libraries or rebuild stunnel 2018.03.13 13:21:17 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP 2018.03.13 13:21:17 LOG5[ui]: Reading configuration from file /home/mfoley/.stunnel/stunnel.conf 2018.03.13 13:21:17 LOG5[ui]: UTF-8 byte order mark not detected 2018.03.13 13:21:17 LOG5[ui]: FIPS mode disabled 2018.03.13 13:21:17 LOG4[ui]: Service [x11vnc] uses "verify = 2" without subject checks 2018.03.13 13:21:17 LOG4[ui]: Use "checkHost" or "checkIP" to restrict trusted certificates 2018.03.13 13:21:17 LOG5[ui]: Configuration successful On the client, I then run tigerVNCViewer connecting to 127.0.0.1::5900. I get the following messages on the client: 2018.03.13 13:22:03 LOG5[0]: Service [x11vnc] accepted connection from 127.0.0.1:35034 2018.03.13 13:22:03 LOG5[0]: s_connect: connected 98.102.63.107:1914 2018.03.13 13:22:03 LOG5[0]: Service [x11vnc] connected remote server from 192.168.0.17:40512 2018.03.13 13:22:03 LOG3[0]: SSL_connect: 140770FC: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol 2018.03.13 13:22:03 LOG5[0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket Just guessing, but is it failing with the SSLVersion? Help appreciated. Thanks, Mark

1 1

[PATCH] TLS 1.3 Compatibility
by Nitin Mutkawoa 13 Mar '18

13 Mar '18

Hello, To add TLS 1.3 compatibility on Stunnel, the following patch was applied and tested. --- options.c.orig 2018-03-13 04:06:01.410477727 +0000 +++ options.c 2018-03-13 05:42:51.883782519 +0000 @@ -2675,6 +2675,18 @@ NOEXPORT char *parse_service_option(CMD #else /* defined(OPENSSL_NO_TLS1_2) */ return "TLSv1.2 not supported"; #endif /* !defined(OPENSSL_NO_TLS1_2) */ + } else if(!strcasecmp(arg, "TLSv1.3")) { +#ifndef OPENSSL_NO_TLS1_3 + section->client_method=(SSL_METHOD *)TLS_client_method(); + section->server_method=(SSL_METHOD *)TLS_server_method(); + section->ssl_options_set|= SSL_OP_NO_SSLv2; + section->ssl_options_set|= SSL_OP_NO_SSLv3; + section->ssl_options_set|= SSL_OP_NO_TLSv1; + section->ssl_options_set|= SSL_OP_NO_TLSv1_1; + section->ssl_options_set|= SSL_OP_NO_TLSv1_2; +#else /* defined(OPENSSL_NO_TLS1_3) */ + return "TLSv1.3 not supported"; +#endif #endif /* OPENSSL_API_COMPAT<0x10100000L */ } else return "Incorrect version of TLS protocol"; Please see this link for more info about the test for TLS 1.3 https://gist.github.com/jmutkawoa/c97f5d67ded592f6ad04389a3ade623e Regards Nitin J Mutkawoa https://tunnelix.com https://hackers.mu Twitter: @TheTunnelix

1 0

basic usage question
by Mark Foley 10 Mar '18

10 Mar '18

I'm trying to set up an ssl tunnel for VNC per the instructions at https://www.ibm.com/developerworks/library/l-sslvnc/index.html. I've not gotten very far into the steps. I tried: # stunnel -d 5905 -r 5900 -p /root/combined.pem [ ] Clients allowed=500 [.] stunnel 5.35 on x86_64-slackware-linux-gnu platform [.] Compiled with OpenSSL 1.0.2h 3 May 2016 [.] Running with OpenSSL 1.0.2n 7 Dec 2017 [.] Update OpenSSL shared libraries or rebuild stunnel [.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP [ ] errno: (*__errno_location ()) [!] Invalid configuration file name "-d" [!] realpath: No such file or directory (2) [ ] Cron thread initialized I find nothing on the -d, -r or -p options in the manpage. This is my 1st posting to this list. I have very rudimentary skills with ssl, ssh, and certificates, mainly limited to getting certificates from a provider and installing for web and email; and creating public keys for ssh login using ssh-keygen. That's about it, so I'm pretty much a certified newbie. Help getting past the starting gate would be greatly appreciated. THX --Mark

1 0

[PATCH] Spectre v2 Vulnerability Mitigations
by Nitin Mutkawoa 07 Mar '18

07 Mar '18

Hello To prevent any leakage (Spectre v2) from a compromised VM on same physical host, this patch would mitigate the impact. --- configure.ac.orig 2018-03-04 01:46:55.877067173 +0400 +++ configure.ac 2018-03-04 01:49:26.422625147 +0400 @@ -101,6 +101,11 @@ if test "$GCC" = yes; then fi AX_APPEND_COMPILE_FLAGS([-D_FORTIFY_SOURCE=2]) +# Spectre v2 mitigations +AX_APPEND_COMPILE_FLAGS([-mfunction-return=thunk]) +AX_APPEND_COMPILE_FLAGS([-mindirect-branch=thunk]) + AC_MSG_NOTICE([**************************************** libtool]) LT_INIT([disable-static]) AC_SUBST([LIBTOOL_DEPS]) Kind regards, Nitin J Mutkawoa https://tunnelix.com https://hackers.mu

1 0

Re: [stunnel-users] Connect using TLS with public Web Server
by peter＠easthope.ca 06 Mar '18

06 Mar '18

From: Carlos Castro <carlos.castro.guerrero(a)gmail.com> Date: Fri, 2 Feb 2018 12:04:08 +0100 > I have older application and now I need connect with external server HTTPS > using TLS . My application doesn't support with TLS and I think use Stunnel > to connect with this Server HTTPS. Same requirement here. Have you tried this configuration? ; yourhost:/etc/stunnel4/stunnel.conf ... [https] client = yes accept = 443 transparent = destination Regards, ... Peter E. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca https://en.wikibooks.org/wiki/Medical_Suction_Machines https://en.wikibooks.org/wiki/Oberon

3 6

Stunnel in server mode with certificate from the Windows Certificate Store
by merlin＠mp3merlin.net 06 Mar '18

06 Mar '18

Hello, I'm trying to use stunnel in server mode with certificates from the Windows Certificate Store. I have a basic configuration which is working with a PEM certificate file and I'm trying to get it to use a cert via the CAPI engine. Here is my basic (working) config: debug = debug output = C:\stunnel\stunnel.log options = -NO_SSLv3 [https] accept = 443 connect = 80 cert = stunnel.pem Here is my config using the CAPI engine: debug = debug output = C:\stunnel\stunnel.log engine = capi engineCtrl = debug_level:2 engineCtrl = debug_file:c:\stunnel\capi.log engineCtrl = store_flags:1 engineCtrl = list_certs options = -NO_SSLv3 [https] accept = 443 connect = 80 engineId = capi However stunnel does not seem to find a certificate to use: [...] 2018.03.06 10:22:05 LOG7[main]: Enabling support for engine "capi" 2018.03.06 10:22:05 LOG7[main]: Executing engine control command debug_level:2 2018.03.06 10:22:05 LOG7[main]: Executing engine control command debug_file:c:\stunnel\capi.log 2018.03.06 10:22:05 LOG7[main]: Executing engine control command store_flags:1 2018.03.06 10:22:05 LOG7[main]: Executing engine control command list_certs 2018.03.06 10:22:05 LOG7[main]: Initializing engine #1 (capi) 2018.03.06 10:22:05 LOG6[main]: Engine #1 (capi) initialized [...] 2018.03.06 10:22:05 LOG6[main]: Initializing service [https] 2018.03.06 10:22:05 LOG7[main]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2018.03.06 10:22:05 LOG7[main]: TLS options: 0x01004004 (+0x03004000, -0x02000000) 2018.03.06 10:22:05 LOG7[main]: No certificate or private key specified [...] And I have no certificates listed in the CAPI debug log: Setting debug level to 2 Setting debug file to c:\stunnel\capi.log Setting flags to 1 Listing certs for store MY Opening certificate store MY capi_cert_get_fname When I load the engine via OpenSSL, I can see that a certificate is present in the store: C:\stunnel\bin>openssl.exe engine -t dynamic -pre "SO_PATH:C:\stunnel\engines\capi.dll" -pre LOAD -post store_flags:1 -post store_name:MY -post list_certs WARNING: can't open config file: /devel/win32/openssl/openssl.cnf (dynamic) Dynamic engine loading support [Success]: SO_PATH:C:\stunnel\engines\capi.dll [Success]: LOAD Loaded: (capi) CryptoAPI ENGINE [ available ] [Success]: store_flags:1 Certificate 0 Friendly Name "test" Subject: CN = test Issuer: CN = test [Success]: list_certs This certificate (and the associated private key) has been generated via the IIS Manager console and I have imported it in the Local Computer Store (with the private key). Does anybody have any idea what I am missing to get this to work ? I can provide more logs and run more tests if necessary. I'm using Stunnel 5.44 on Windows 2008 R2. I tried with an older version (5.40) but same problem. Thanks. Kevin

1 0

Re: [stunnel-users] Re: Connect using TLS with public Web Server
by Carlos Castro 06 Mar '18

06 Mar '18

Hi All , it's mandatory for use stunnel wich the infrastructure has client stunnel and server stunnel ?? Or I can have client stunnel vs Web server HTTPS without stunnel server , only web server https . I newbie in stunnel , but i think is mandatory install stunnel in both sites , that's is correct? Regards On 05/03/18 20:23, Carlos Castro wrote: > > Thanks @Mike > > If possible use Squid + stunnel to solve the problem with host > header? The application is very very old . > > Thanks > > > On 05/03/18 20:06, Mike Spooner wrote: >> >> The problem is the "Host: ..." header that is being sent to the >> remote server. You need to configure 127.0.0.1:19021 as a proxy in >> your app (and curl) and then have the app (curl) fetch >> https://ctm.omego.net >> >> >> Not sure how to do that in curl, but search the curl manpage for any >> mentions of "proxy". >> >> -- Mike Spooner >> >> --------- Original Message --------- >> *From*: Carlos Castro >> *Date*: Mon Mar 05 12:28:15 GMT+00:00 2018 >> *Subject*: Re: [stunnel-users] Connect using TLS with public Web Server >> Hello >> >> Thanks @Peter >> >> >> Yes , my application not support TLS and I need the application connect >> using TLS , for this i using stunnel (i hope) >> >> When I make curl -v http://127.0.0.1:19021 : >> >> curl -v http://127.0.0.1:19201 >> * Rebuilt URL to: http://127.0.0.1:19201/ >> * Trying 127.0.0.1... >> * Connected to 127.0.0.1 (127.0.0.1) port 19201 (#0) >> > GET / HTTP/1.1 >> > Host: 127.0.0.1:19201 >> > User-Agent: curl/7.47.0 >> > Accept: */* >> > >> * HTTP 1.0, assume close after body >> < HTTP/1.0 400 Bad Request >> < Server: AkamaiGHost >> < Mime-Version: 1.0 >> < Content-Type: text/html >> < Content-Length: 208 >> < Expires: Mon, 05 Mar 2018 12:25:53 GMT >> < Date: Mon, 05 Mar 2018 12:25:53 GMT >> < Connection: close >> >> The web ctm.omgeo.net only works in mode HTTPS , . >> >> Thanks Peter >> >> >> On 05/03/18 13:22, Peter Pentchev wrote: >> > On Mon, Mar 05, 2018 at 12:32:41PM +0100, Carlos Castro wrote: >> >> Hello , >> >> >> >> Thanks @Peter >> >> >> >> I'm trying to configure to connect with my PC to this Public server >> >> https://ctm.omgeo.net using TLS1.2 but i don't can. >> >> >> >> I'm need setup stunnel for old application doesn't support TLS , >> and this >> >> application need connect with this public server to send data. >> >> >> >> >> >> I'm using the Peter config , but nothing . I try this config : >> >> >> >> [omgeo] >> >> client = yes >> >> accept = 127.0.0.1:19201 >> >> connect = ctm.omgeo.net:443 >> >> verify = 2 >> >> CApath = /etc/ssl/certs/ >> >> >> >> >> >> I'm using Curl to try connect , I'm recive this error >> >> >> >> /etc/ssl/certs# curl -v https://127.0.0.1:19201 >> > Maybe I'm reading this wrong, but if your client application does not >> > support TLS, then it won't speak HTTPS, it would speak plain HTTP. >> > That's what the configuration you're using does - it tells stunnel to >> > run in client mode, i.e. something will connect to stunnel using >> > an unencrypted connection and stunnel will connect to a TLS server >> > (in this case an HTTPS server). >> > >> > So what happens when you try almost the same query, but with the "http" >> > scheme instead of the "https" one? >> > >> > curl -v http://127.0.0.1:19201 >> > >> > G'luck, >> > Peter >> > >> >> _______________________________________________ >> stunnel-users mailing list >> stunnel-users(a)stunnel.org >> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >

2 1

Client cert auth ?
by Brian Ipsen 27 Feb '18

27 Feb '18

Hi I am trying to see if I can get stunnel to authenticate using a client certificate towards a F5 setup - but I am having trouble getting it to work. Certificates are issued froma Microsoft PKI - where the F5 checks validity via an OCSP responder. In my stunnel config file, I have: [F5Cert] client=yes accept = 127.0.0.1:1598 connect = F5test.xxx.dk:443 delay = yes CAFile = GlobalSign-cert-Chain.pem Cert = BaaSClientCertificatePlain.pem key = BaaSClientCertificatePlain.key verify = 2 In the CAFile, I have the root CA and issuing certificate from GlobalSign - which have created the SSL certificate being used on the F5 (server side). Cert and Key points to the certificate and private key from my internal Microsoft based PKI.. But should the certificate chain from my internal PKI be listed somewhere as well ? Is this the way to do it - and is stunnel capable of handling client certificate validation ? Regards Brian

3 2

Question on reconnection after TCP RST
by Chawla, Vikas 27 Feb '18

27 Feb '18

Hi, We ran into an issue where stunnel after TCP RST from server, retries to re-establish connection after 5 seconds with exponential back off. Wanted to check if there is configuration parameter for us to modify the reconnection time to be a lower number. Thanks, Vikas

1 0

[PATCH] Address already in use (98) when binding to localhost
by Christian Kujau 06 Feb '18

06 Feb '18

Hi, I reported the following to the Fedora bugtracker[0], but only then realized that this happens with the upstream version too. In short: since stunnel 5.44 I am no longer able to have stunnel bind to localhost, when "localhost" is literally mentioned in the configuration file: $ cat stunnel.test [test] client = yes protocol = smtp accept = localhost:12345 connect = localhost:2025 $ stunnel-5.44 stunnel.test [...] [ ] Binding service [test] [ ] Listening file descriptor created (FD=6) [ ] Option SO_REUSEADDR set on accept socket [ ] Service [test] (FD=6) bound to 127.0.0.1:12345 [ ] Listening file descriptor created (FD=7) [ ] Option SO_REUSEADDR set on accept socket [!] bind: Address already in use (98) [!] Error binding service [test] to 127.0.0.1:12345 [ ] Unbinding service [test] [ ] Service [test] closed (FD=6) [ ] Service [test] closed When using "127.0.0.1" or "::1" instead of "localhost" in the configuration file, stunnel-5.44 works. However, then one can only connect to either the IPv4 _or_ the IPv6 address, depending on what's configured. With stunnel-5.43 and "accept=localhost:12345" both IPv4 and IPv6 was available. I suspect that this is related to the following change log entry for 5.44: > Default accept address restored to INADDR_ANY. I have attached a patch to revert that (?) change and also included a test script that fails on my system when the patch is not applied. I see "Version 5.45" already mention in the changelog on the website, but now download yet? Thanks, Christian. [0] https://bugzilla.redhat.com/show_bug.cgi?id=1542361 -- BOFH excuse #424: operation failed because: there is no message for this error (#1014)

1 0

Re: [stunnel-users] stunnel.log not generated in window server 2012 R2
by Zhang, Joanne 02 Feb '18

02 Feb '18

Hello. I installed a Stunnel-5.44-win32 on a Window Server 2012 R2 box. I am using it in client mode only as it is required by the Vendor. It works fine, I can connect to my Vendor's server via Stunnel . However, I don't see any stunnel.log generated when it is run as a service and I searched the entire directory on the server. I know the output path is working . As when I run Stunnel GUI Start, the log is created in the output folder specified in the conf file. Have anyone seen this problem before please? Here is my setting for stunnel.conf that relates to the debug log. debug = 7 output = C:\Program Files (x86)\stunnel\stunnel.log Thanks very much for your help ahead. Joanne _______________________________________________________________________ If you received this email in error, please advise the sender (by return email or otherwise) immediately. You have consented to receive the attached electronically at the above-noted email address; please retain a copy of this confirmation for future reference. Si vous recevez ce courriel par erreur, veuillez en aviser l'expéditeur immédiatement, par retour de courriel ou par un autre moyen. Vous avez accepté de recevoir le(s) document(s) ci-joint(s) par voie électronique à l'adresse courriel indiquée ci-dessus; veuillez conserver une copie de cette confirmation pour les fins de reference future.

1 0

Connect using TLS with public Web Server
by Carlos Castro 02 Feb '18

02 Feb '18

Hi All, I have older application and now I need connect with external server HTTPS using TLS . My application doesn't support with TLS and I think use Stunnel to connect with this Server HTTPS. Wich is the mode I should choose to configurate this connection ? Proxy mode? or like examples created over gmail in default configuration File? The external server , is public server for all people ? should be necesary special certs ? or whit predeterminate certs inside windows (for use IE, chroome , firefox etc..etcc) is necesary ? Many thanks Regards

1 0

Re (2): Relationship to Netfilter.
by peter＠easthope.ca 26 Jan '18

26 Jan '18

From: Ludolf Holzheid <lholzheid(a)bihl-wiedemann.de> Date: Thu, 25 Jan 2018 18:23:58 +0100 > If it was in this diagram, it would be a 'local process' on the > application layer. So, two softwares, netfilter and stunnel, in a computer system. stunnel in the OSI application layer and netfilter in the protocol, network and link layers. That's a relationship. > Obviously nowhere. (Stunnel is not related to the Linux Netfilter.). Depends on your personal definition of a relationship. Thanks for explaining, ... Peter E. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca https://en.wikibooks.org/wiki/Medical_Suction_Machines https://en.wikibooks.org/wiki/Oberon

1 0

Relationship to Netfilter.
by Peter Easthope 25 Jan '18

25 Jan '18

Where is stunnel in this diagram? https://en.wikipedia.org/wiki/Netfilter#/media/File:Netfilter-packet-flow.s… Thanks, ... Peter E. -- Telephone 1 360 639 0202 or +13606390202. Bcc: peter at easthope.ca http://easthope.ca/Shop.html

2 1

stunnel + mjpeg_streamer issue
by Akos Schneemaier 23 Jan '18

23 Jan '18

HI stunnel users, i hope somebody have an idea what is going wrong in my config: I am runnung debian on an arm box with kernel 4.4.89 and stunnel 5.44. I use mjpeg_streamer to stream webcam images. mjpeg streamer is attaches to port 8080 for http, but for external access connection goes through stunnel on port 2970. The problem is when i connect to mjpeg streamer to get a snapshot via stunnel i receive a broken image 8 time out of 10: https:/ipaddress:2970/?action=snapshot. When i do this via http:/ipaddress:8080/?action=snapshot everything works fine. it seems when image size is below ~11k then it works fine with stunnel, when the size goes above then the chance to receive a broken image increases with stunnel, normal image size is around 22k. Futuremore when i connect to the mjpeg stream of mjpeg stream then everything works fine even over stunnel https:/ipaddress:2970/?action=stream Here is the service config file: pid=/tmp/cam.pid ;foreground=yes ;debug=7 [cam0] cert = /etc/letsencrypt/live/..../fullchain.pem key = /etc/letsencrypt/live/..../privkey.pem sslVersion = all client = no accept = 2970 connect = 8080 [cam1] cert = /etc/letsencrypt/live/..../fullchain.pem key = /etc/letsencrypt/live/..../privkey.pem sslVersion = all client = no accept = 2971 connect = 8081 [cam2] cert = /etc/letsencrypt/live/..../fullchain.pem key = /etc/letsencrypt/live/..../privkey.pem sslVersion = all client = no accept = 2972 connect = 8082 Any ideas welcome! Thanks

1 0

Update on my stunnel problems
by Phil Smith III 21 Jan '18

21 Jan '18

As I'm sure all of you were thinking, the localhost vs. 127.0.0.1 shouldn't have made a difference, and probably didn't: that was across two different machines, as I'd had to switch horses mid-stream (always a bad idea, I realize). Mind you, both machines are the same hardware, same OS, etc. And the 127.0.0.1 version started working on the first machine after a while; I suspect I was seeing Cox's authentication server problems muddying the waters-it has that problem from time to time. BTW, I did check, and I have localhost entries for both IPv4 and IPv6 in my hosts file. This morning when I finally got access to my wife's machine, I installed stunnel with the same config that was working on machine#2 and changed Eudora to point to localhost. I could see Eudora happily connecting to stunnel, but then nothing happened. After the usual checking everything, I decided to try port 1110 instead of 110 for one of the POP accounts. That necessitated closing and reopening Eudora so I could hack the .ini file. After doing so, it worked. Then I changed the other accounts to localhost and they kept working. "Odd", sez I: "I haven't changed them to port 1110!" Still not sure how they were working, since localhost is definitely not serving port 110 that I know of. As my wife was getting antsy about getting her machine back, I didn't investigate further (wish I'd had time): I just changed the stunnel port back to 110, put the one account back to 110, restarted Eudora and refreshed the stunnel config.and all is now working fine. So something was stuck in an old setting, but that doesn't explain either why it was connecting to stunnel but not getting past it, or how it was going to localhost 110 and still working. In any case, it's functioning beautifully (in time for the Wednesday shutdown of non-encrypted POP), and I share this in case it helps someone else down the line! I don't care about SMTP, as I don't use Cox's SMTP anyway. Thanks again for all the helpful suggestions. There wasn't any single "Aha!" moment, but they all helped lead me to the happy place. .phsiii

1 0

Re: [stunnel-users] Re (2): Problems with stunnel and cox.net on Windows 7
by Phil Smith III 18 Jan '18

18 Jan '18

Huh. It does have it. But why didn’t 127.0.0.1 work, I wonder? From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Carter Browne Sent: Thursday, January 18, 2018 2:11 PM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Re (2): Problems with stunnel and cox.net on Windows 7 You should check your hosts file in \windows\system32\drivers\etc. Make sure it has an entry: 127.0.0.1 localhost The text claims it doesn't need it, but it doesn't hurt to have it, and I'm not sure I totally believe the text. Carter On 1/18/2018 1:55 PM, Phil Smith III wrote: Oh, the logging works--it just doesn't like it there in the file. I have it earlier and it's fine. -------------- C:\Users\phsiii>ls -ld \temp\stunnel-log.txt -rw-r--r-- 1 phsiii None 266835 Jan 18 08:52 \temp\stunnel-log.txt # That's Cygwin ls -- remember, this is Windows 7 C:\Users\phsiii>nslookup localhost Server: UnKnown Address: 2001:4860:4860::8888 *** UnKnown can't find localhost: No response from server # Windows nslookup (per "which nslookup") -------------- Odd. -----Original Message----- From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of peter(a)easthope.ca <mailto:peter@easthope.ca> Sent: Thursday, January 18, 2018 1:13 PM To: stunnel-users(a)stunnel.org <mailto:stunnel-users@stunnel.org> Subject: [stunnel-users] Re (2): Problems with stunnel and cox.net on Windows 7 From: "Phil Smith III" <mailto:phs3stuff@cox.net> <phs3stuff(a)cox.net> Date: Thu, 18 Jan 2018 12:47:47 -0500 while the output= wasn't accepted (it said it wasn't valid there), Does the file exist? If not, can stunnel create it? Can you read it with an editor. Can you write into it interactively? What does "ls -ld C:\temp\stunnel-log.txt" or Win equivalent give? changing 127.0.0.1 to localhost seems to have fixed it! What does "nslookup localhost" report? Regards, ... P.

1 0

Re: [stunnel-users] Re (2): Problems with stunnel and cox.net on Windows 7
by Phil Smith III 18 Jan '18

18 Jan '18

Now that's interesting. Note that the failed nslookup looked v6-ish. I wonder if Cox is doing some v6 stuff that I don't know about! -----Original Message----- From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Vincent Deschenes Sent: Thursday, January 18, 2018 1:17 PM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Re (2): Problems with stunnel and cox.net on Windows 7 >From my experience, this relates to IPv4 vs IPv6. 127.0.0.1 is explicitly V4. While localhost can be V6. Vincent Deschenes -----Original Message----- From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of peter(a)easthope.ca Sent: Thursday, 18 January 2018 1:08 PM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Re (2): Problems with stunnel and cox.net on Windows 7 From: "Phil Smith III" <phs3stuff(a)cox.net> Date: Thu, 18 Jan 2018 12:47:47 -0500 > while the output= wasn't accepted (it said it wasn't valid there), Does the file exist? If not, can stunnel create it? Can you read it with an editor. Can you write into it interactively? > changing 127.0.0.1 to localhost seems to have fixed it! What does "nslookup localhost" report? Regards, ... P. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Re: [stunnel-users] Re (2): Problems with stunnel and cox.net on Windows 7
by Phil Smith III 18 Jan '18

18 Jan '18

Oh, the logging works--it just doesn't like it there in the file. I have it earlier and it's fine. -------------- C:\Users\phsiii>ls -ld \temp\stunnel-log.txt -rw-r--r-- 1 phsiii None 266835 Jan 18 08:52 \temp\stunnel-log.txt # That's Cygwin ls -- remember, this is Windows 7 C:\Users\phsiii>nslookup localhost Server: UnKnown Address: 2001:4860:4860::8888 *** UnKnown can't find localhost: No response from server # Windows nslookup (per "which nslookup") -------------- Odd. -----Original Message----- From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of peter(a)easthope.ca Sent: Thursday, January 18, 2018 1:13 PM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Re (2): Problems with stunnel and cox.net on Windows 7 From: "Phil Smith III" <phs3stuff(a)cox.net> Date: Thu, 18 Jan 2018 12:47:47 -0500 > while the output= wasn't accepted (it said it wasn't valid there), Does the file exist? If not, can stunnel create it? Can you read it with an editor. Can you write into it interactively? What does "ls -ld C:\temp\stunnel-log.txt" or Win equivalent give? > changing 127.0.0.1 to localhost seems to have fixed it! What does "nslookup localhost" report? Regards, ... P. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

2 1

Re (2): Problems with stunnel and cox.net on Windows 7
by peter＠easthope.ca 18 Jan '18

18 Jan '18

From: "Phil Smith III" <phs3stuff(a)cox.net> Date: Thu, 18 Jan 2018 12:47:47 -0500 > while the output= wasn't accepted (it said it wasn't valid there), Does the file exist? If not, can stunnel create it? Can you read it with an editor. Can you write into it interactively? > changing 127.0.0.1 to localhost seems to have fixed it! What does "nslookup localhost" report? Regards, ... P. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca

2 1

Re (2): Problems with stunnel and cox.net on Windows 7
by peter＠easthope.ca 18 Jan '18

18 Jan '18

From: "Phil Smith III" <phs3stuff(a)cox.net> Date: Thu, 18 Jan 2018 12:47:47 -0500 > while the output= wasn't accepted (it said it wasn't valid there), Does the file exist? If not, can stunnel create it? Can you read it with an editor. Can you write into it interactively? What does "ls -ld C:\temp\stunnel-log.txt" or Win equivalent give? > changing 127.0.0.1 to localhost seems to have fixed it! What does "nslookup localhost" report? Regards, ... P. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca

1 0

Re: [stunnel-users] Problems with stunnel and cox.net on Windows 7
by Phil Smith III 18 Jan '18

18 Jan '18

Well, I'm stunned (pun intended): while the output= wasn't accepted (it said it wasn't valid there), changing 127.0.0.1 to localhost seems to have fixed it! -----Original Message----- From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of peter(a)easthope.ca Sent: Thursday, January 18, 2018 12:20 AM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Problems with stunnel and cox.net on Windows 7 From: "Phil Smith III" <phs3stuff(a)cox.net> Date: Wed, 17 Jan 2018 21:59:42 -0500 > Here's my stunnel.conf, with blank lines and comments removed: > client = yes > output = C:\temp\stunnel-log.txt > taskbar = yes > debug = 7 > [POP3 Incoming] > protocol = pop3 > accept = 127.0.0.1:1110 > connect = pop.cox.net:995 > protocol = smtp > accept = 127.0.0.1:25 > connect = smtp.cox.net:465 Here it worked for POP3 immediately. Not needed for SMTP. https://en.wikibooks.org/wiki/Oberon/Oberon#Receiving_and_Sending_Email Before using 1110, check. netstat -tulpn | grep 1110 Correct id, passwd and port are in the MUA? Separate configurations for POP3 and SMTP. Troubleshoot one at a time. "protocol" shouldn't be necessary. Try this. [POP3] client = yes output = C:\temp\stunnel-log.txt accept = localhost:1110 connect = pop.cox.net:995 Regards, ... Peter E. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Re (2): Problems with stunnel and cox.net on Windows 7
by peter＠easthope.ca 18 Jan '18

18 Jan '18

From: Andrew Culver <aculver(a)uwo.ca> Date: Thu, 18 Jan 2018 11:39:20 -0500 > Some protocols use a protocol-specific command to begin TLS negotiation > (STARTTLS for SMTP and POP3), so stunnel needs to know how (and be told) to > use that command. Phil, General troubleshooting rule, always try for a most elementary, ordinary case before resorting to a special case. Regards, ... Peter E. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca

1 0

Re: [stunnel-users] Problems with stunnel and cox.net on Windows 7
by peter＠easthope.ca 18 Jan '18

18 Jan '18

P.s. From: "Phil Smith III" <phs3stuff(a)cox.net> Date: Wed, 17 Jan 2018 21:59:42 -0500 > protocol = pop3 The stunnel(8) manual has this. "protocol = PROTO application protocol to negotiate TLS This option enables initial, protocol-specific negotiation of the TLS encryption." Is there any need for protocol-specific negotiation? Why? Stunnel provides a tunnel and POP3 works inside. That's all. Try the configuration without the protocol option. Regards, ... Peter E. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca

2 1

Re: [stunnel-users] Problems with stunnel and cox.net on Windows 7
by Phil Smith III 18 Jan '18

18 Jan '18

Right, I had done that: >Yes, I have protocol = pop3 and protocol = smtp; I’ve tried >commenting them out individually, no change that I can see. The doc really isn't clear about why you'd want/need these, by the way. But your earlier suggestion (localhost instead of 127.0.0.1) seems to have worked. Still a mystery. I'll be tinkering on machine2 tonight, and then will try on the wife's machine! -----Original Message----- From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of peter(a)easthope.ca Sent: Thursday, January 18, 2018 9:51 AM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Problems with stunnel and cox.net on Windows 7 P.s. From: "Phil Smith III" <phs3stuff(a)cox.net> Date: Wed, 17 Jan 2018 21:59:42 -0500 > protocol = pop3 The stunnel(8) manual has this. "protocol = PROTO application protocol to negotiate TLS This option enables initial, protocol-specific negotiation of the TLS encryption." Is there any need for protocol-specific negotiation? Why? Stunnel provides a tunnel and POP3 works inside. That's all. Try the configuration without the protocol option. Regards, ... Peter E. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Re: [stunnel-users] Problems with stunnel and cox.net on Windows 7
by peter＠easthope.ca 18 Jan '18

18 Jan '18

From: "Phil Smith III" <phs3stuff(a)cox.net> Date: Wed, 17 Jan 2018 21:59:42 -0500 > Here's my stunnel.conf, with blank lines and comments removed: > client = yes > output = C:\temp\stunnel-log.txt > taskbar = yes > debug = 7 > [POP3 Incoming] > protocol = pop3 > accept = 127.0.0.1:1110 > connect = pop.cox.net:995 > protocol = smtp > accept = 127.0.0.1:25 > connect = smtp.cox.net:465 Here it worked for POP3 immediately. Not needed for SMTP. https://en.wikibooks.org/wiki/Oberon/Oberon#Receiving_and_Sending_Email Before using 1110, check. netstat -tulpn | grep 1110 Correct id, passwd and port are in the MUA? Separate configurations for POP3 and SMTP. Troubleshoot one at a time. "protocol" shouldn't be necessary. Try this. [POP3] client = yes output = C:\temp\stunnel-log.txt accept = localhost:1110 connect = pop.cox.net:995 Regards, ... Peter E. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca

1 0

Problems with stunnel and cox.net on Windows 7
by Phil Smith III 18 Jan '18

18 Jan '18

Cox has been warning us that as of next week, we need to use encrypted POP and SMTP. I have two reasons to use stunnel now: 1) I use the K9 Bayesian email proxy for spam filtering, and it doesn't do TLS 2) My wife still uses Eudora and doesn't want to switch, and while Eudora allegedly supports TLS, it's not trivial to make it work (and Cox certainly won't help) Thus stunnel looks like an ideal solution. But after tinkering for a few hours on two machines, I'm stumped. While I can type an SMTP or POP transaction in my sleep, I'm not so good at typing a TLS handshake, so I'm using Outlook 2013 as my test platform (and that's what I'll be using myself later anyway). I setup a new account, point to the right ports on 127.0.0.1, and the test times out, with: Log onto incoming mail server (POP3): The operation timed out waiting for a response from the receiving (POP) server. If you continue to receive this message, contact your server administrator or Internet service provider (ISP). Send test e-mail message: The operation timed out waiting for a response from the sending (SMTP) server. If you continue to receive this message, contact your server administrator or Internet service provider (ISP). Here's my stunnel.conf, with blank lines and comments removed: client = yes output = C:\temp\stunnel-log.txt taskbar = yes debug = 7 [POP3 Incoming] protocol = pop3 accept = 127.0.0.1:1110 connect = pop.cox.net:995 protocol = smtp accept = 127.0.0.1:25 connect = smtp.cox.net:465 Yes, that's port 1110, since K9 is using 110. Shouldn't matter, right? (As long as I point the client at 1110, obviously!) Yes, I have protocol = pop3 and protocol = smtp; I've tried commenting them out individually, no change that I can see. Yes, I'm running stunnel explicitly, not as a service-I found threads suggesting that it just doesn't work as a service on Windows 7 for some reason (and in fact beat my head against that wall for a while first). And here's the stunnel log: 2018.01.17 21:29:24 LOG7[main]: Running on Windows 6.1 2018.01.17 21:29:24 LOG7[main]: No limit detected for the number of clients 2018.01.17 21:29:24 LOG5[main]: stunnel 5.44 on x86-pc-msvc-1500 platform 2018.01.17 21:29:24 LOG5[main]: Compiled/running with OpenSSL 1.0.2m-fips 2 Nov 2017 2018.01.17 21:29:24 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2018.01.17 21:29:24 LOG7[main]: errno: (*_errno()) 2018.01.17 21:29:24 LOG7[ui]: GUI message loop initialized 2018.01.17 21:29:24 LOG7[main]: Running on Windows 6.1 2018.01.17 21:29:24 LOG5[main]: Reading configuration from file stunnel.conf 2018.01.17 21:29:24 LOG5[main]: UTF-8 byte order mark not detected 2018.01.17 21:29:24 LOG5[main]: FIPS mode disabled 2018.01.17 21:29:24 LOG7[main]: Compression disabled 2018.01.17 21:29:24 LOG7[main]: Snagged 64 random bytes from C:/.rnd 2018.01.17 21:29:24 LOG7[main]: Wrote 0 new random bytes to C:/.rnd 2018.01.17 21:29:24 LOG7[main]: PRNG seeded successfully 2018.01.17 21:29:24 LOG6[main]: Initializing service [POP3 Incoming] 2018.01.17 21:29:24 LOG7[main]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2018.01.17 21:29:24 LOG7[main]: TLS options: 0x03000004 (+0x03000000, -0x00000000) 2018.01.17 21:29:24 LOG7[main]: No certificate or private key specified 2018.01.17 21:29:24 LOG4[main]: Service [POP3 Incoming] needs authentication to prevent MITM attacks 2018.01.17 21:29:24 LOG5[main]: Configuration successful 2018.01.17 21:29:24 LOG7[main]: Binding service [POP3 Incoming] 2018.01.17 21:29:24 LOG7[main]: Listening file descriptor created (FD=460) 2018.01.17 21:29:24 LOG7[main]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2018.01.17 21:29:24 LOG7[main]: Service [POP3 Incoming] (FD=460) bound to 127.0.0.1:1110 2018.01.17 21:29:24 LOG7[main]: Listening file descriptor created (FD=464) 2018.01.17 21:29:24 LOG7[main]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2018.01.17 21:29:24 LOG7[main]: Service [POP3 Incoming] (FD=464) bound to 127.0.0.1:25 2018.01.17 21:29:24 LOG7[cron]: Cron thread initialized 2018.01.17 21:29:50 LOG7[main]: Found 1 ready file descriptor(s) 2018.01.17 21:29:50 LOG7[main]: FD=424 ifds=r-x ofds=--- 2018.01.17 21:29:50 LOG7[main]: FD=460 ifds=r-x ofds=r-- 2018.01.17 21:29:50 LOG7[main]: Service [POP3 Incoming] accepted (FD=488) from 127.0.0.1:54855 2018.01.17 21:29:50 LOG7[main]: Creating a new thread 2018.01.17 21:29:50 LOG7[main]: New thread created 2018.01.17 21:29:50 LOG7[0]: Service [POP3 Incoming] started 2018.01.17 21:29:50 LOG7[0]: Option TCP_NODELAY set on local socket 2018.01.17 21:29:50 LOG5[0]: Service [POP3 Incoming] accepted connection from 127.0.0.1:54855 2018.01.17 21:29:50 LOG6[0]: failover: round-robin, starting at entry #1 2018.01.17 21:29:50 LOG6[0]: s_connect: connecting 68.6.19.8:465 2018.01.17 21:29:50 LOG7[0]: s_connect: s_poll_wait 68.6.19.8:465: waiting 10 seconds 2018.01.17 21:29:50 LOG5[0]: s_connect: connected 68.6.19.8:465 2018.01.17 21:29:50 LOG5[0]: Service [POP3 Incoming] connected remote server from 192.168.1.17:54856 2018.01.17 21:29:50 LOG7[0]: Option TCP_NODELAY set on remote socket 2018.01.17 21:29:50 LOG7[0]: Remote descriptor (FD=508) initialized 2018.01.17 21:30:24 LOG6[cron]: Executing cron jobs 2018.01.17 21:30:24 LOG6[cron]: Cron jobs completed in 0 seconds 2018.01.17 21:30:24 LOG7[cron]: Waiting 86400 seconds 2018.01.17 21:31:05 LOG7[main]: Found 1 ready file descriptor(s) 2018.01.17 21:31:05 LOG7[main]: FD=424 ifds=r-x ofds=--- 2018.01.17 21:31:05 LOG7[main]: FD=460 ifds=r-x ofds=--- 2018.01.17 21:31:05 LOG7[main]: Service [POP3 Incoming] accepted (FD=528) from 127.0.0.1:54891 2018.01.17 21:31:05 LOG7[main]: Creating a new thread 2018.01.17 21:31:05 LOG7[main]: New thread created 2018.01.17 21:31:05 LOG7[1]: Service [POP3 Incoming] started 2018.01.17 21:31:05 LOG7[1]: Option TCP_NODELAY set on local socket 2018.01.17 21:31:05 LOG5[1]: Service [POP3 Incoming] accepted connection from 127.0.0.1:54891 2018.01.17 21:31:05 LOG6[1]: failover: round-robin, starting at entry #0 2018.01.17 21:31:05 LOG6[1]: s_connect: connecting 146.20.147.245:995 2018.01.17 21:31:05 LOG7[1]: s_connect: s_poll_wait 146.20.147.245:995: waiting 10 seconds 2018.01.17 21:31:05 LOG5[1]: s_connect: connected 146.20.147.245:995 2018.01.17 21:31:05 LOG5[1]: Service [POP3 Incoming] connected remote server from 192.168.1.17:54892 2018.01.17 21:31:05 LOG7[1]: Option TCP_NODELAY set on remote socket 2018.01.17 21:31:05 LOG7[1]: Remote descriptor (FD=336) initialized 2018.01.17 21:34:05 LOG3[1]: Unexpected socket close (s_read) 2018.01.17 21:34:05 LOG5[1]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.01.17 21:34:05 LOG7[1]: Remote descriptor (FD=336) closed 2018.01.17 21:34:05 LOG7[1]: Local descriptor (FD=528) closed 2018.01.17 21:34:05 LOG7[1]: Service [POP3 Incoming] finished (1 left) 2018.01.17 21:34:05 LOG7[1]: str_stats: 1 block(s), 32 data byte(s), 58 control byte(s) 2018.01.17 21:34:05 LOG7[1]: str_stats: 32 byte(s) at ..\src\network.c:680 2018.01.17 21:34:50 LOG6[0]: s_read: s_poll_wait: TIMEOUTbusy exceeded: sending reset 2018.01.17 21:34:50 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.01.17 21:34:50 LOG7[0]: Remote descriptor (FD=508) closed 2018.01.17 21:34:50 LOG7[0]: Local descriptor (FD=488) closed 2018.01.17 21:34:50 LOG7[0]: Service [POP3 Incoming] finished (0 left) 2018.01.17 21:34:50 LOG7[0]: str_stats: 1 block(s), 32 data byte(s), 58 control byte(s) 2018.01.17 21:34:50 LOG7[0]: str_stats: 32 byte(s) at ..\src\network.c:680 It looks like it connects, but then just sits there?! I see these: No certificate or private key specified Service [POP3 Incoming] needs authentication to prevent MITM attacks but that's during startup. Or are those significant? I feel like I'm one setting away from having this all work.! Thanks in advance for any suggestions. -- ...phsiii

1 0

TLS socket closed (SSL_write) with unsent byte(s)
by Cotswold Group - Stephen Murray 16 Jan '18

16 Jan '18

Hi All, We use stunnel to send emails from our scanners to our hosted mail provider (that now only accept TLS connections). This has been working well for a number of years, but just recently the scanners (all Lexmark) have sporadically been giving errors of 'connection failed'. If I check the stunnel logs, the failed send has an extra line in of TLS socket closed (SSL_write) with 418 unsent byte(s) Below are 2 examples, 59 was sent successfully, 60 was not. 2018.01.16 14:37:24 LOG5[59]: Service [fasthosts-smtp] accepted connection from 10.226.174.95:11473 2018.01.16 14:37:24 LOG5[59]: s_connect: connected 213.171.216.50:465 2018.01.16 14:37:24 LOG5[59]: Service [fasthosts-smtp] connected remote server from 10.226.150.9:52577 2018.01.16 14:37:24 LOG5[59]: OCSP: Connecting the AIA responder "http://t2.symcb.com" 2018.01.16 14:37:24 LOG5[59]: s_connect: connected 23.55.155.27:80 2018.01.16 14:37:24 LOG5[59]: OCSP: Certificate accepted 2018.01.16 14:37:24 LOG5[59]: OCSP: Connecting the AIA responder "http://tj.symcd.com" 2018.01.16 14:37:25 LOG5[59]: s_connect: connected 23.55.155.27:80 2018.01.16 14:37:25 LOG5[59]: OCSP: Certificate accepted 2018.01.16 14:37:25 LOG5[59]: Certificate accepted at depth=0: C=GB, ST=Gloucestershire, L=Gloucester, O=Fasthosts Internet Limited, OU=NOC, CN=smtp.livemail.co.uk 2018.01.16 14:37:29 LOG5[59]: Connection closed: 167106 byte(s) sent to TLS, 376 byte(s) sent to socket 2018.01.16 14:38:19 LOG5[60]: Service [fasthosts-smtp] accepted connection from 10.226.174.95:11483 2018.01.16 14:38:19 LOG5[60]: s_connect: connected 213.171.216.50:465 2018.01.16 14:38:19 LOG5[60]: Service [fasthosts-smtp] connected remote server from 10.226.150.9:52620 2018.01.16 14:38:19 LOG5[60]: OCSP: Connecting the AIA responder "http://t2.symcb.com" 2018.01.16 14:38:19 LOG5[60]: s_connect: connected 23.55.155.27:80 2018.01.16 14:38:19 LOG5[60]: OCSP: Certificate accepted 2018.01.16 14:38:19 LOG5[60]: OCSP: Connecting the AIA responder "http://tj.symcd.com" 2018.01.16 14:38:19 LOG5[60]: s_connect: connected 23.55.155.27:80 2018.01.16 14:38:19 LOG5[60]: OCSP: Certificate accepted 2018.01.16 14:38:19 LOG5[60]: Certificate accepted at depth=0: C=GB, ST=Gloucestershire, L=Gloucester, O=Fasthosts Internet Limited, OU=NOC, CN=smtp.livemail.co.uk 2018.01.16 14:38:24 LOG3[60]: TLS socket closed (SSL_write) with 418 unsent byte(s) 2018.01.16 14:38:24 LOG5[60]: Connection reset: 964 byte(s) sent to TLS, 392 byte(s) sent to socket Has anyone come across this before? Our mail provider has send limits in place of 50 every 10 minutes, but I am confident we are not reaching those amounts. Any help appreciated. Regards, Stephen

1 0

Connecting a HTTP browser to a HTTPS server.
by peter＠easthope.ca 12 Jan '18

12 Jan '18

Hello, I'm interested to configure stunnel to allow my local non-TLS Web browser to receive pages from a remote server providing only HTTPS. This section of https://www.stunnel.org/static/stunnel.html appears relevant. transparent = none | source | destination | both (Unix only) enable transparent proxy support on selected platforms ... destination The original destination is used instead of the connect option. A service section for transparent destination may look like this: [transparent] client = yes accept = <stunnel_port> transparent = destination This configuration requires iptables setup to work, possibly in /etc/rc.local or equivalent file. ... For a connect target installed on a remote host: /sbin/iptables -I INPUT -i eth0 -p tcp --dport <stunnel_port> -j ACCEPT /sbin/iptables -t nat -I PREROUTING -p tcp --dport <redirected_port> \ -i eth0 -j DNAT --to-destination <local_ip>:<stunnel_port> The transparent destination option is currently only supported on Linux. ==================================== Substitution of parameters for my context gives these configurations.. [transparent] client = yes accept = 127.0.0.1:954 transparent = destination /sbin/iptables -I INPUT -i eth0 -p tcp --dport 954 -j ACCEPT /sbin/iptables -t nat -I PREROUTING -p tcp --dport 443 \ -i eth0 -j DNAT --to-destination 127.0.0.1:954 The non-TLS browser would address http://www.stunnel.org:954/ and receive the page from https://www.stunnel.org:443/. According to Wikipedia, 954 is not assigned. The browser would continue to receive the page http://www.website.org/ without involvement of stunnel or iptables. Plausible? Thanks, ... P. -- 123456789 123456789 123456789 123456789 123456789 123456789 123456789 Tel: +1 360 639 0202 Pender Is.: +1 250 629 3757 http://easthope.ca/Peter.html Bcc: peter at easthope. ca

1 0

Versions
by Editor 04 Jan '18

04 Jan '18

Hi: On the various repo sites for Redhat-CentOS-Oracle Linux, etc., they are only providing version 4.29 of stunnel. Is there anyway to push them an updated version? I normally use these repo providers: Oracle Linux repo EPEL 6 Repo rpmforce Repo In the end, I tried to compile the latest version on Linux but I get this somewhat cryptic message about a TLS installation directory. I never had this issue before but to be honest, I normally used Solaris (8-9-10) in the past. "Could not find your TLS library installation dir Use --with-ssl option to fix this problem" I tried pointing it at /usr/bin/openssl and also at /usr/lib64/openssl without any luck. Sorry for bothering the list if this has been answered in the past. Thanks. Kevin

2 1

Re: [stunnel-users] outgoing mail solution?
by Parker Brooks 02 Jan '18

02 Jan '18

Douglas, it worked! Thank you! I had not turned on gmail's allow less secure apps, so my first try netted this 2018.01.02 09:00:27 LOG5[main]: stunnel 5.44 on x86-pc-msvc-1500 platform 2018.01.02 09:00:27 LOG5[main]: Compiled/running with OpenSSL 1.0.2m-fips 2 Nov 2017 2018.01.02 09:00:27 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2018.01.02 09:00:27 LOG5[main]: Reading configuration from file stunnel.conf 2018.01.02 09:00:27 LOG5[main]: UTF-8 byte order mark not detected 2018.01.02 09:00:27 LOG5[main]: FIPS mode disabled 2018.01.02 09:00:27 LOG5[main]: Configuration successful 2018.01.02 09:03:09 LOG5[0]: Service [gmail-smtp] accepted connection from 127.0.0.1:1046 2018.01.02 09:03:09 LOG5[0]: s_connect: connected 173.194.78.108:587 2018.01.02 09:03:09 LOG5[0]: Service [gmail-smtp] connected remote server from 192.168.1.103:1047 2018.01.02 09:03:09 LOG5[0]: OCSP: Connecting the AIA responder " http://ocsp.pki.goog/gsr2" 2018.01.02 09:03:10 LOG5[0]: s_connect: connected 172.217.12.78:80 2018.01.02 09:03:10 LOG5[0]: OCSP: Certificate accepted 2018.01.02 09:03:10 LOG5[0]: OCSP: Connecting the AIA responder " http://ocsp.pki.goog/GTSGIAG3" 2018.01.02 09:03:10 LOG5[0]: s_connect: connected 172.217.12.78:80 2018.01.02 09:03:10 LOG5[0]: OCSP: Certificate accepted 2018.01.02 09:03:10 LOG5[0]: Certificate accepted at depth=0: C=US, ST=California, L=Mountain View, O=Google Inc, CN=smtp.gmail.com 2018.01.02 09:03:10 LOG3[0]: PLAIN Authentication Failed 2018.01.02 09:03:10 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket my monitoring s/w showed To = xxxxxx(a)gmail.com Connecting to mail server... 127.0.0.1 E-mail Failed. Error: 25058 / [10057] Socket is not connected 1/2/2018 9:03:10 AM there was a security alert from gmail with the instructions to enabling the less secure apps. turned it on and tried again... 2018.01.02 09:17:45 LOG5[1]: Service [gmail-smtp] accepted connection from 127.0.0.1:1050 2018.01.02 09:17:45 LOG5[1]: s_connect: connected 173.194.78.109:587 2018.01.02 09:17:45 LOG5[1]: Service [gmail-smtp] connected remote server from 192.168.1.103:1051 2018.01.02 09:17:47 LOG5[1]: Connection closed: 306 byte(s) sent to TLS, 508 byte(s) sent to socket again, thank you! On Tue, Jan 2, 2018 at 7:35 AM, Harris, Douglas (SSC/SPC) < douglas.harris(a)canada.ca> wrote: > Try this… > > > > [gmail-smtp] > > client = yes > > accept = 127.0.0.1:25 > > connect = smtp.gmail.com:587 <http://smtp.gmail.com:465> > > verifyChain = yes > > CAfile = ca-certs.pem > > checkHost = smtp.gmail.com > > OCSPaia = yes > > protocol = smtp > > protocolUsername = [your gmail userid] > > protocolPassword = [your gmail password] > > > > > > > > > > *From:* stunnel-users [mailto:stunnel-users-bounces@stunnel.org] *On > Behalf Of *Parker Brooks > *Sent:* January 2, 2018 12:34 AM > *To:* stunnel-users(a)stunnel.org > *Subject:* [stunnel-users] outgoing mail solution? > > > > hello and happy new year! > > > > it seemed this question has been asked before in various ways, however > with the frequent version updates i'm still unclear if stunnel is meant as > a fix to my issue. > > > > i have a outdated home monitoring program running on a winxp box. when an > error occurs it sends an email. it's setup screen (besides the destination > email field) only have a) smtp server, b) undeliverable email address and > c) port # fields to configure. > > > > my workaround for several years (when port 25 became blocked or needed > authetication) has been to use LOApost but they've recently ceased. that > program, also running in the background, and if i understand correctly > acted as a local host. i configured the monitoring program's smtp for > 127.0.0.1 and LOApost did the rest > > > > other searches suggest cloud solutions like sendgrid and authsmtp. but > those sites need a login/ password with the outgoing message. perhaps this > is where i'm getting confused between the differences of SSL and smtp > authentication? > > > > i have gotten gsuite's restricted smtp server to work, but i hoped stunnel > would provide a better solution (ability to send besides gmail/ gsuite > addresses). > > > > below are my conf and log files of my attempt. again, i can't tell if i've > missed a step, or if this is not intended to work. > > > > PS: i've also tried to understand if this feature is on the todo list? > > tia, > > parker > > > > stunnel.conf > > > > [gmail-pop3] > > client = yes > > accept = 127.0.0.1:110 > > connect = pop.gmail.com:995 > > verifyChain = yes > > CAfile = ca-certs.pem > > checkHost = pop.gmail.com > > OCSPaia = yes > > > > [gmail-imap] > > client = yes > > accept = 127.0.0.1:143 > > connect = imap.gmail.com:993 > > verifyChain = yes > > CAfile = ca-certs.pem > > checkHost = imap.gmail.com > > OCSPaia = yes > > > > [gmail-smtp] > > client = yes > > accept = 127.0.0.1:25 > > connect = smtp.gmail.com:465 > > verifyChain = yes > > CAfile = ca-certs.pem > > checkHost = smtp.gmail.com > > OCSPaia = yes > > > > log file > > > > 2017.12.31 16:22:45 LOG5[main]: stunnel 5.44 on x86-pc-msvc-1500 platform > > 2017.12.31 16:22:45 LOG5[main]: Compiled/running with OpenSSL 1.0.2m-fips > 2 Nov 2017 > > 2017.12.31 16:22:45 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 > TLS:ENGINE,FIPS,OCSP,PSK,SNI > > 2017.12.31 16:22:45 LOG5[main]: Reading configuration from file > stunnel.conf > > 2017.12.31 16:22:45 LOG5[main]: UTF-8 byte order mark not detected > > 2017.12.31 16:22:45 LOG5[main]: FIPS mode disabled > > 2017.12.31 16:22:45 LOG5[main]: Configuration successful > > 2017.12.31 16:25:03 LOG5[0]: Service [gmail-smtp] accepted connection from > 127.0.0.1:1141 > > 2017.12.31 16:25:03 LOG5[0]: s_connect: connected 173.194.67.108:465 > > 2017.12.31 16:25:03 LOG5[0]: Service [gmail-smtp] connected remote server > from 192.168.1.103:1142 > > 2017.12.31 16:25:03 LOG5[0]: OCSP: Connecting the AIA responder " > http://ocsp.pki.goog/gsr2" > > 2017.12.31 16:25:04 LOG5[0]: s_connect: connected 172.217.14.174:80 > > 2017.12.31 16:25:04 LOG5[0]: OCSP: Certificate accepted > > 2017.12.31 16:25:04 LOG5[0]: OCSP: Connecting the AIA responder " > http://ocsp.pki.goog/GTSGIAG3" > > 2017.12.31 16:25:04 LOG5[0]: s_connect: connected 172.217.14.174:80 > > 2017.12.31 16:25:04 LOG5[0]: OCSP: Certificate accepted > > 2017.12.31 16:25:04 LOG5[0]: Certificate accepted at depth=0: C=US, > ST=California, L=Mountain View, O=Google Inc, CN=smtp.gmail.com > > 2017.12.31 16:25:04 LOG5[0]: Connection closed: 55 byte(s) sent to TLS, > 514 byte(s) sent to socket > > > > > > and this is what shows up on my monitoring program log file... > > > > To = xxxxxx(a)gmail.com > > Connecting to mail server... 127.0.0.1 > > Sending message... > > E-mail Failed. Error: 20162 / 530 5.5.1 https://support.google.com/ > mail/?p=WantAuthError 51sm9558225oti.10 - gsmtp > > 12/31/2017 4:25:04 PM >

1 0

Re: [stunnel-users] outgoing mail solution?
by Josealf.rm 02 Jan '18

02 Jan '18

Cool! I was not aware that stunnel fully supported SMTP authentication. Thanks Parker! Saludos Jose Alfredo Diaz > On Jan 2, 2018, at 8:35 AM, Harris, Douglas (SSC/SPC) <douglas.harris(a)canada.ca> wrote: > > Try this… > > [gmail-smtp] > client = yes > accept = 127.0.0.1:25 > connect = smtp.gmail.com:587 > verifyChain = yes > CAfile = ca-certs.pem > checkHost = smtp.gmail.com > OCSPaia = yes > protocol = smtp > protocolUsername = [your gmail userid] > protocolPassword = [your gmail password] > > > > > From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Parker Brooks > Sent: January 2, 2018 12:34 AM > To: stunnel-users(a)stunnel.org > Subject: [stunnel-users] outgoing mail solution? > > hello and happy new year! > > it seemed this question has been asked before in various ways, however with the frequent version updates i'm still unclear if stunnel is meant as a fix to my issue. > > i have a outdated home monitoring program running on a winxp box. when an error occurs it sends an email. it's setup screen (besides the destination email field) only have a) smtp server, b) undeliverable email address and c) port # fields to configure. > > my workaround for several years (when port 25 became blocked or needed authetication) has been to use LOApost but they've recently ceased. that program, also running in the background, and if i understand correctly acted as a local host. i configured the monitoring program's smtp for 127.0.0.1 and LOApost did the rest > > other searches suggest cloud solutions like sendgrid and authsmtp. but those sites need a login/ password with the outgoing message. perhaps this is where i'm getting confused between the differences of SSL and smtp authentication? > > i have gotten gsuite's restricted smtp server to work, but i hoped stunnel would provide a better solution (ability to send besides gmail/ gsuite addresses). > > below are my conf and log files of my attempt. again, i can't tell if i've missed a step, or if this is not intended to work. > > PS: i've also tried to understand if this feature is on the todo list? > tia, > parker > > stunnel.conf > > [gmail-pop3] > client = yes > accept = 127.0.0.1:110 > connect = pop.gmail.com:995 > verifyChain = yes > CAfile = ca-certs.pem > checkHost = pop.gmail.com > OCSPaia = yes > > [gmail-imap] > client = yes > accept = 127.0.0.1:143 > connect = imap.gmail.com:993 > verifyChain = yes > CAfile = ca-certs.pem > checkHost = imap.gmail.com > OCSPaia = yes > > [gmail-smtp] > client = yes > accept = 127.0.0.1:25 > connect = smtp.gmail.com:465 > verifyChain = yes > CAfile = ca-certs.pem > checkHost = smtp.gmail.com > OCSPaia = yes > > log file > > 2017.12.31 16:22:45 LOG5[main]: stunnel 5.44 on x86-pc-msvc-1500 platform > 2017.12.31 16:22:45 LOG5[main]: Compiled/running with OpenSSL 1.0.2m-fips 2 Nov 2017 > 2017.12.31 16:22:45 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI > 2017.12.31 16:22:45 LOG5[main]: Reading configuration from file stunnel.conf > 2017.12.31 16:22:45 LOG5[main]: UTF-8 byte order mark not detected > 2017.12.31 16:22:45 LOG5[main]: FIPS mode disabled > 2017.12.31 16:22:45 LOG5[main]: Configuration successful > 2017.12.31 16:25:03 LOG5[0]: Service [gmail-smtp] accepted connection from 127.0.0.1:1141 > 2017.12.31 16:25:03 LOG5[0]: s_connect: connected 173.194.67.108:465 > 2017.12.31 16:25:03 LOG5[0]: Service [gmail-smtp] connected remote server from 192.168.1.103:1142 > 2017.12.31 16:25:03 LOG5[0]: OCSP: Connecting the AIA responder "http://ocsp.pki.goog/gsr2" > 2017.12.31 16:25:04 LOG5[0]: s_connect: connected 172.217.14.174:80 > 2017.12.31 16:25:04 LOG5[0]: OCSP: Certificate accepted > 2017.12.31 16:25:04 LOG5[0]: OCSP: Connecting the AIA responder "http://ocsp.pki.goog/GTSGIAG3" > 2017.12.31 16:25:04 LOG5[0]: s_connect: connected 172.217.14.174:80 > 2017.12.31 16:25:04 LOG5[0]: OCSP: Certificate accepted > 2017.12.31 16:25:04 LOG5[0]: Certificate accepted at depth=0: C=US, ST=California, L=Mountain View, O=Google Inc, CN=smtp.gmail.com > 2017.12.31 16:25:04 LOG5[0]: Connection closed: 55 byte(s) sent to TLS, 514 byte(s) sent to socket > > > and this is what shows up on my monitoring program log file... > > To = xxxxxx(a)gmail.com > Connecting to mail server... 127.0.0.1 > Sending message... > E-mail Failed. Error: 20162 / 530 5.5.1 https://support.google.com/mail/?p=WantAuthError 51sm9558225oti.10 - gsmtp > 12/31/2017 4:25:04 PM > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

outgoing mail solution?
by Parker Brooks 02 Jan '18

02 Jan '18

hello and happy new year! it seemed this question has been asked before in various ways, however with the frequent version updates i'm still unclear if stunnel is meant as a fix to my issue. i have a outdated home monitoring program running on a winxp box. when an error occurs it sends an email. it's setup screen (besides the destination email field) only have a) smtp server, b) undeliverable email address and c) port # fields to configure. my workaround for several years (when port 25 became blocked or needed authetication) has been to use LOApost but they've recently ceased. that program, also running in the background, and if i understand correctly acted as a local host. i configured the monitoring program's smtp for 127.0.0.1 and LOApost did the rest other searches suggest cloud solutions like sendgrid and authsmtp. but those sites need a login/ password with the outgoing message. perhaps this is where i'm getting confused between the differences of SSL and smtp authentication? i have gotten gsuite's restricted smtp server to work, but i hoped stunnel would provide a better solution (ability to send besides gmail/ gsuite addresses). below are my conf and log files of my attempt. again, i can't tell if i've missed a step, or if this is not intended to work. PS: i've also tried to understand if this feature is on the todo list? tia, parker stunnel.conf [gmail-pop3] client = yes accept = 127.0.0.1:110 connect = pop.gmail.com:995 verifyChain = yes CAfile = ca-certs.pem checkHost = pop.gmail.com OCSPaia = yes [gmail-imap] client = yes accept = 127.0.0.1:143 connect = imap.gmail.com:993 verifyChain = yes CAfile = ca-certs.pem checkHost = imap.gmail.com OCSPaia = yes [gmail-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.gmail.com:465 verifyChain = yes CAfile = ca-certs.pem checkHost = smtp.gmail.com OCSPaia = yes log file 2017.12.31 16:22:45 LOG5[main]: stunnel 5.44 on x86-pc-msvc-1500 platform 2017.12.31 16:22:45 LOG5[main]: Compiled/running with OpenSSL 1.0.2m-fips 2 Nov 2017 2017.12.31 16:22:45 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2017.12.31 16:22:45 LOG5[main]: Reading configuration from file stunnel.conf 2017.12.31 16:22:45 LOG5[main]: UTF-8 byte order mark not detected 2017.12.31 16:22:45 LOG5[main]: FIPS mode disabled 2017.12.31 16:22:45 LOG5[main]: Configuration successful 2017.12.31 16:25:03 LOG5[0]: Service [gmail-smtp] accepted connection from 127.0.0.1:1141 2017.12.31 16:25:03 LOG5[0]: s_connect: connected 173.194.67.108:465 2017.12.31 16:25:03 LOG5[0]: Service [gmail-smtp] connected remote server from 192.168.1.103:1142 2017.12.31 16:25:03 LOG5[0]: OCSP: Connecting the AIA responder " http://ocsp.pki.goog/gsr2" 2017.12.31 16:25:04 LOG5[0]: s_connect: connected 172.217.14.174:80 2017.12.31 16:25:04 LOG5[0]: OCSP: Certificate accepted 2017.12.31 16:25:04 LOG5[0]: OCSP: Connecting the AIA responder " http://ocsp.pki.goog/GTSGIAG3" 2017.12.31 16:25:04 LOG5[0]: s_connect: connected 172.217.14.174:80 2017.12.31 16:25:04 LOG5[0]: OCSP: Certificate accepted 2017.12.31 16:25:04 LOG5[0]: Certificate accepted at depth=0: C=US, ST=California, L=Mountain View, O=Google Inc, CN=smtp.gmail.com 2017.12.31 16:25:04 LOG5[0]: Connection closed: 55 byte(s) sent to TLS, 514 byte(s) sent to socket and this is what shows up on my monitoring program log file... To = xxxxxx(a)gmail.com Connecting to mail server... 127.0.0.1 Sending message... E-mail Failed. Error: 20162 / 530 5.5.1 https://support.google.com/ mail/?p=WantAuthError 51sm9558225oti.10 - gsmtp 12/31/2017 4:25:04 PM

3 2

Updating stunnel 5.43 to 5.44 fails on Win7prof(32)
by tagtraeumer 15 Dec '17

15 Dec '17

Hello, removing compression = zlib did fix the starting issue for v5.44, update worked, thanks. Is 'deflate' affected too? Is compression recommended at this stage of mail processing? Thanks once more, regards! > Hello, > The compression is not recommended with TLS because of the CRIME or > BREACH attacks. > From stunnel v 5.44 in Windows the zlib compression is not supported. > So you should remove the option: > compression = zlib > > If you want to use this compression, please place the file zlib1.dll > (from the previous version) in the stunnel / bin directory. > > Best regards, > Malgorzata

1 0

Updating stunnel 5.43 to 5.44 fails on Win7prof(32)
by tagtraeumer 14 Dec '17

14 Dec '17

Hello, I did try updating stunnel 5.43 to 5.44 on a Win7prof (32bit) system, but it fails... Log before update (v5.43): 2017.12.14 20:46:39 LOG5[main]: stunnel 5.43 on x86-pc-msvc-1500 platform 2017.12.14 20:46:39 LOG5[main]: Compiled/running with OpenSSL 1.0.2m-fips 2 Nov 2017 2017.12.14 20:46:39 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2017.12.14 20:46:39 LOG5[main]: Reading configuration from file stunnel.conf 2017.12.14 20:46:39 LOG5[main]: UTF-8 byte order mark detected 2017.12.14 20:46:39 LOG6[main]: UI not supported by engine #1 (capi) 2017.12.14 20:46:39 LOG6[main]: Engine #1 (capi) initialized 2017.12.14 20:46:39 LOG5[main]: FIPS mode disabled 2017.12.14 20:46:39 LOG6[main]: Compression enabled: 2 method(s) 2017.12.14 20:46:39 LOG6[main]: Initializing service [HostEurope_SMTPs] 2017.12.14 20:46:39 LOG6[main]: Loading certificate from file: stunnel.pem 2017.12.14 20:46:39 LOG6[main]: Certificate loaded from file: stunnel.pem 2017.12.14 20:46:39 LOG6[main]: Loading private key from file: stunnel.pem 2017.12.14 20:46:39 LOG6[main]: Private key loaded from file: stunnel.pem 2017.12.14 20:46:39 LOG4[main]: Service [HostEurope_SMTPs] uses "verifyChain" without subject checks 2017.12.14 20:46:39 LOG4[main]: Use "checkHost" or "checkIP" to restrict trusted certificates 2017.12.14 20:46:39 LOG5[main]: Configuration successful Log after 5.44 update: Pls refer to screenshot at: https://imgur.com/hCOKES7 "Invalid configuration file" errno: (*_errno()) stunnel.conf:65: ["name"]: Failed to initialize TLS How to solve this issue? Thx + regards!

1 0

Exception 40000015 STATUS_FATAL_APP_EXIT
by alexwaskilledfriendlyfire＠gmail.com 11 Dec '17

11 Dec '17

Hello Stunnel-users, Well, I have a problem with latest stunnel-5.44-win32 build. Both GUI and console versions won't to start throwing unhandled exception: tstunnel.exe: Problem signature: Problem Event Name: APPCRASH Application Name: tstunnel.exe Application Version: 0.0.0.0 Application Timestamp: 5a18f4f5 Fault Module Name: tstunnel.exe Fault Module Version: 0.0.0.0 Fault Module Timestamp: 5a18f4f5 Exception Code: 40000015 Exception Offset: 0000e43d OS Version: 6.1.7601.2.1.0.256.4 Locale ID: 1049 Additional Information 1: 57b4 Additional Information 2: 57b4bc5bbe66a065d3bc087357c09646 Additional Information 3: f6bb Additional Information 4: f6bb7b9b6fcf2c5cdb238bc389e9ede9 And GUI version stunnel.exe: --------------------------- Microsoft Visual C++ Runtime Library --------------------------- Runtime Error! Program: C:\Progs\Stunnel\bin\stunnel.exe This application has requested the Runtime to terminate it in an unusual way. Please contact the application's support team for more information. --------------------------- OK --------------------------- Problem signature: Problem Event Name: APPCRASH Application Name: stunnel.exe Application Version: 5.44.0.0 Application Timestamp: 5a18f4f3 Fault Module Name: stunnel.exe Fault Module Version: 5.44.0.0 Fault Module Timestamp: 5a18f4f3 Exception Code: 40000015 Exception Offset: 0000e43d OS Version: 6.1.7601.2.1.0.256.4 Locale ID: 1049 Additional Information 1: 2de9 Additional Information 2: 2de98e0ccee9cc0b77f8fe3f51196ec8 Additional Information 3: 42db Additional Information 4: 42db6f5f1de1e71ee661917dbb7cc0c8 Completely fresh isntallation (or deleting config folder) doesn't solve my problem. My OS is legal Windows 7 x64 with latest updates. There are screenshots just for case. https://i.imgur.com/N1kPI9J.jpg https://i.imgur.com/CqMXWtx.jpg Probably I missing some DLL or service running but it's not an option to turn everything ON (and copy every single DLL ever made to my PC) to determine which one is not running. Probably it's something else. I need help. Thanks. -- Best regards, Alexwaskilledfriendlyfire mailto:alexwaskilledfriendlyfire@gmail.com

2 3

[patch] Fix build with LibreSSL
by Piotr Kubaj 06 Dec '17

06 Dec '17

Building against LibreSSL currently fails. Could you commit this patch? It builds fine on FreeBSD 11.1-RELEASE against LibreSSL 2.6.3. Since it doesn't change anything for OpenSSL, it should build against it too. -- ______________________________________ / A nickel ain't worth a dime anymore. \ | | \ -- Yogi Berra / -------------------------------------- \ ^__^ \ (oo)\_______ (__)\ )\/\ ||----w | || ||

1 0

possibility to delay connect to host
by Paavo Sild 04 Dec '17

04 Dec '17

Hello! I am a bit new to stunnel and while I tried to search the message archive I did not find any possible reference to the issue I try to solve. I am running a bit older version of stunnel as a simple reverse proxy. It accepts incoming TLS connection and opens clear TCP connection to a host specified by "connect" parameter in config. I wander - it is possible to delay the opening of TCP connection to a host until the actual data is received from client? I haven't found any reference to such a possibility in stunnel but thought that it worth to ask from community. The issue is that due to the nature of traffic there are instances then client negotiates the SSL connection but there is no actual data to be sent by the client. By opening the connection to host only when actual data is present would filter out unnecessary connections towards the application. Anybody had such an issue to solve? -- rgds, Paavo Sild --------------------- paavo.sild(a)estcard.ee ---------------------

1 0

routines:ssl3_read_bytes:sslv3 alert certificate unknown
by Ziad Badawi 04 Dec '17

04 Dec '17

Greetings, I am trying to capture clear text pcaps from client (browser) - server (java appserver) traffic. The java appserver is jboss using https. I'm running jboss and stunnel on the same machine. # stunnel.conf debug = 3 foreground = yes [jboss] client = yes cert= stunnel.pem # generated using makecert.sh accept = 1234 connect = 127.0.0.1:443 Version: stunnel 5.44 on x86_64-pc-linux-gnu platform Compiled/running with OpenSSL 1.0.2k-fips 26 Jan 2017 Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Global options: RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = HIGH:!DH:!aNULL:!SSLv2 (with "fips = no") curve = prime256v1 debug = daemon.notice logId = sequential options = NO_SSLv2 options = NO_SSLv3 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none When I try to test it usng firefox by browsing to https://localhost:1234, FF returns "Secure Connection Failed" and stunnel spits 2017.12.01 20:35:10 LOG3[0]: SSL_connect: 14094416: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown What am I missing / doing wrong? Regards Z

2 2

Stunnel 5.43 problem
by Carter Browne 15 Nov '17

15 Nov '17

When running stunnel 5.43 on Linux 4.14 (arm), accept = port only listens on 127.0.0.1:port. I don't know if other operating systems are affected. Carter

1 0

Re: [stunnel-users] TLS "translation" & 2-way auth
by Igor Gatis 15 Nov '17

15 Nov '17

It would be nice to know whether it is actually possible to achieve this with stunnel. If not, is there any other tool I could use or combine? On Nov 13, 2017 08:58, "Igor Gatis" <igorgatis(a)gmail.com> wrote: Yep, that's exactly what I'm seeking for help here. If we can abstract the 2-way bit for a second, I'd call this a "certificate transcription" TLS tunnel. On Thu, Nov 9, 2017 at 5:19 PM, Vincent Deschenes <vdeschenes(a)stelvio.com> wrote: > Ho, > > But that does not account for the A ->[TLS] ->B part. > > I believe that my sample will listen for unencrypted connection only. > > > > > > *From:* stunnel-users [mailto:stunnel-users-bounces@stunnel.org] *On > Behalf Of *Vincent Deschenes > *Sent:* Thursday, 9 November 2017 3:16 PM > *To:* Igor Gatis <igorgatis(a)gmail.com>; stunnel-users(a)stunnel.org > *Subject:* Re: [stunnel-users] TLS "translation" & 2-way auth > > > > You need to have a section in your config file which listen for requests > but also have the “client = yes” option with a cert and key like this: > > > > [http_a_to_c] > > client = yes > > accept = port_number_to_listen_on_server_b > > connect = server_c_address:443 > > cert = certificate.crt > > key = private.key > > > > > > cert and key are the certificate and private key server B uses to identify > itself on server C. > > You could also add more options to specify a trustore to specify which > cert coming from server C server B will trust, otherwise server B will > simply allow the connection. > > > > Good Luck > > > > > > *From:* stunnel-users [mailto:stunnel-users-bounces@stunnel.org > <stunnel-users-bounces(a)stunnel.org>] *On Behalf Of *Igor Gatis > *Sent:* Thursday, 9 November 2017 1:14 PM > *To:* stunnel-users(a)stunnel.org > *Subject:* [stunnel-users] TLS "translation" & 2-way auth > > > > Consider scenario below: > > > > Server A ==TLS==> Server B ==TLS+2WayAuth==> Server C > > > > Server A needs to connect to Server C through Server B which runs Stunnel. > Server C requires 2-way authentication. I have full control over Server A > and Server B and Server C belongs to a third-party. > > > > What does Stunnel config should look like? > > >

3 2

Re: [stunnel-users] Possible stunnel 5.43 bug ?
by Bezspam 15 Nov '17

15 Nov '17

Hello, The patch fixed the problem. Thank you very much! Best regards, Bez Spam Sent with [ProtonMail](https://protonmail.com) Secure Email. > -------- Original Message -------- > Subject: Re: [stunnel-users] Possible stunnel 5.43 bug ? > Local Time: November 15, 2017 7:15 AM > UTC Time: November 15, 2017 7:15 AM > From: Michal.Trojnara(a)stunnel.org > To: stunnel-users(a)stunnel.org <stunnel-users(a)stunnel.org> > > On 11/14/2017 01:33 PM, Bezspam wrote: > >> Is this a bug or expected behaviour? >> Best regards, >> Bez Spam >> >> Dear Bez, >> >> I confirm this is a bug. A patch that fixes it is: >> ftp://ftp.stunnel.org/stunnel/accept.patch >> >> There will be a bugfix release of stunnel later this week. >> >> Best regards, >> Mike > > --------------------------------------------------------------- > > stunnel-users mailing list > stunnel-users(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Ubuntu 16.04 problem
by Carter Browne 14 Nov '17

14 Nov '17

I have a very confusing problem with stunnel on Ubuntu. I have a configuration file that I have used in both Windows and Arch Linux. In the Arch version, I use a single file with all the certificates for the partner systems, in the Windows version I use a capath directory. I have tried both here and I always get the response "tlsv1 alert unknown ca". The beginning of the stunnel.conf file is below. Any hints would be appreciated. Carter cert = /etc/stunnel/xxxxxxx.pem key = /etc/stunnel/xxxxxxx.pem fips = no # Enable client mode client = yes ; Some security enhancements for UNIX systems - comment them out on Win32 #chroot = /var/run/stunnel/ #setuid = stunnel #setgid = stunnel ; PID is created inside chroot jail pid = /etc/stunnel/stunnel.pid ; Some performance tunings # Debug and Foreground are for testing socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 # Uncomment for debugging stunnel problems debug = 5 output = /etc/stunnel/stunnel.log ##foreground = yes ; NO SSLv2 options = NO_SSLv3 sslVersion = all Ciphers = ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:ECDH-RSA-AES256-SHA:ECDH-ECDSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDH-RSA-AES128-SHA:ECDH-ECDSA-AES128-SHA # # Uncomment and modify the CAFile to point to your ca.txt file #CAFile = /etc/stunnel/all.pem CAPath = /etc/stunnel/capath #CAPath = @sysconfdir/ssl/certs # Uncomment and modify the verify to enable CA validation # verifyChain = no VerifyPeer = yes

1 0

Possible stunnel 5.43 bug ?
by Bezspam 14 Nov '17

14 Nov '17

Hello, I use stunnel on FreeBSD 11.1. I install it from ports. Yesterday I updated to stunnel 5.43. However it stopped working. I investigated the problem and found the issue- instead on all network interfaces, "accept" listens on 127.0.0.1 : sockstat -4 USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS stunnel stunnel 43945 7 tcp4 127.0.0.1:2222 *:* stunnel stunnel 43945 8 tcp4 127.0.0.1:3128 *:* stunnel stunnel 43945 9 tcp4 127.0.0.1:8080 *:* stunnel stunnel 43945 10 tcp4 127.0.0.1:1616 *:* A workaround is to modify "accept = 0.0.0.0:3128" explicitly to listen on 0.0.0.0. Is this a bug or expected behaviour? Best regards, Bez Spam

2 1

TLS "translation" & 2-way auth
by Igor Gatis 13 Nov '17

13 Nov '17

Consider scenario below: Server A ==TLS==> Server B ==TLS+2WayAuth==> Server C Server A needs to connect to Server C through Server B which runs Stunnel. Server C requires 2-way authentication. I have full control over Server A and Server B and Server C belongs to a third-party. What does Stunnel config should look like?

2 3

Email Solution Needed
by Jon Kinne 11 Nov '17

11 Nov '17

I am running Windows 7, 32-bit and I have an email problem I'm trying to solve. I will describe what I need to do and hopefully someone can tell me if stunnel will solve it or if not, where else I might find a solution. I need to send emails out of a database program called Sage Act. It requires that the outgoing SMTP server be on port 25, and be named "smtp.xxx..." My ISP (Charter) blocks port 25, and their SMTP server is called "mobile.charter.net" on port 587. I need to have a way to enter an address like "SMTP.charter.net" (Port 25) in ACT, and when I send that email, it actually goes to "mobile.charter.net" or perhaps my gmail SMTP server on port 587 (Charter) or whatever port the gmail SMTP server requires. I'll certainly appreciate any help anyone can offer me. Thanks, Jon

1 0

Running Stunnel GUI as a service
by Stunnel User999 11 Nov '17

11 Nov '17

Hi, I'm running stunnel 5.43 on Windows 2012 R2 server and trying to run stunnel GUI as a service. Whenever I close my user session, it shuts down the GUI service. Installing the Stunnel TLS Wrapper Windows service does not seem to start the GUI service. How to run GUI in the background as a service? Any information is highly appreciated. Thanks, SN

1 0

Tunnelblick over stunnel - connects but does not work
by Anton Kantsel 10 Nov '17

10 Nov '17

Hi! As OpenVPN seems to become banned in increasing number of countries, I had to look for a way to foil DPI. Wrapping OpenVPN traffic into stunnel SSL-secured connection seems promising but... On Windows machine it really works just fine. But on macOS it connects, but then no surfing or other Internet application works whatsoever. Looks like DNS problem but may be it's different... Moreover, in 40 secs or so Tunnelblick disconnects with message "2017-11-10 00:08:54 *Tunnelblick: After 30.0 seconds, gave up trying to fetch IP address information using the ipInfo host's name after connecting. 2017-11-10 00:09:30 *Tunnelblick: After 30.0 seconds, gave up trying to fetch IP address information using the ipInfo host's IP address after connecting". Then it tries to connect again but never succeeds and cycles forever. Please find stunnel config and Tunnelblik full log below. Would appreciate any help! [STUNNEL] $ stunnel -version stunnel 5.23 on x86_64-apple-darwin14.5.0 platform Compiled with OpenSSL 0.9.8zd 8 Jan 2015 Running with OpenSSL 0.9.8zh 14 Jan 2016 Update OpenSSL shared libraries or rebuild stunnel Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP Global options: debug = daemon.notice RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = HIGH:+3DES:+DH:!aNULL:!SSLv2 curve = prime256v1 debug = notice logId = sequential options = NO_SSLv2 options = NO_SSLv3 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none stunnel.conf file: cert=stunnel.pem options=NO_SSLv2 [openvpn] client=yes accept=localhost:989 connect=X.X.X.X:990 [TUNNELBLICK] *Tunnelblick: OS X 10.12.6; Tunnelblick 3.7.4 (build 4900); prior version 3.7.3 (build 4880); Standard user git commit 0f68fae3cabe6b2ebdc9fbb3054232074c03bbfb Configuration client2_pc_stunnel "Sanitized" condensed configuration file for /Library/Application Support/Tunnelblick/Shared/client2_pc_stunnel.tblk: client dev tun proto tcp remote 127.0.0.1 989 resolv-retry infinite nobind persist-key persist-tun verb 3 remote-cert-tls server keepalive 10 120 tls-client key-direction 1 <ca> [Security-related line(s) omitted] </ca> <cert> [Security-related line(s) omitted] </cert> <key> [Security-related line(s) omitted] </key> <tls-auth> [Security-related line(s) omitted] </tls-auth> ================================================================================ XXX ================================================================================ There are no unusual files in client2_pc_stunnel.tblk ================================================================================ Configuration preferences: useDNS = 1 -notMonitoringConnection = 0 -resetPrimaryInterfaceAfterDisconnect = 1 -routeAllTrafficThroughVpn = 1 -runMtuTest = 0 -doNotFlushCache = 0 -useRouteUpInsteadOfUp = 1 -openvpnVersion = - -notOKToCheckThatIPAddressDidNotChangeAfterConnection = 0 -keepConnected = 1 -lastConnectionSucceeded = 1 -prependDomainNameToSearchDomains = 1 ================================================================================ Wildcard preferences: -notOKToCheckThatIPAddressDidNotChangeAfterConnection = 0 ================================================================================ Program preferences: skipWarningAboutNonAdminUpdatingTunnelblick = 1 skipWarningThatIPANotFetchedBeforeConnection = 1 skipWarningThatInternetIsNotReachable = 1 skipWarningAboutPlacingIconNearTheSpotlightIcon = 1 placeIconInStandardPositionInStatusBar = 0 launchAtNextLogin = 1 notOKToCheckThatIPAddressDidNotChangeAfterConnection = 0 tunnelblickVersionHistory = ( "3.7.4 (build 4900)", "3.7.3 (build 4880)", "3.7.2a (build 4851)", "3.7.2 (build 4850)", "3.7.1b (build 4813)", "3.7.1a (build 4812)", "3.7.1 (build 4811)", "3.7.0 (build 4790)", "3.6.9 (build 4685)", "3.6.8 (build 4625)" ) statusDisplayNumber = 0 lastLaunchTime = 531944638.592689 showConnectedDurations = 1 lastLanguageAtLaunchWasRTL = 0 connectionWindowDisplayCriteria = showWhenConnecting maxLogDisplaySize = 102400 lastConnectedDisplayName = client2_pc_stunnel keyboardShortcutIndex = 1 updateCheckAutomatically = 1 NSWindow Frame SettingsSheetWindow = 367 167 829 524 0 0 1280 777 NSWindow Frame ConnectingWindow = 469 442 389 187 0 0 1280 777 NSWindow Frame SUStatusFrame = 624 664 400 129 0 0 1600 877 NSWindow Frame SUUpdateAlert = 516 363 620 392 0 0 1600 877 NSWindow Frame ListingWindow = 64 330 500 422 0 0 1280 777 detailsWindowFrameVersion = 4900 detailsWindowFrame = {{48, 0}, {1232, 777}} detailsWindowLeftFrame = {{0, 0}, {224, 659}} detailsWindowViewIndex = 0 detailsWindowConfigurationsTabIdentifier = log leftNavSelectedDisplayName = client2_pc_stunnel AdvancedWindowTabIdentifier = whileConnected haveDealtWithOldTunTapPreferences = 1 haveDealtWithOldLoginItem = 1 SUEnableAutomaticChecks = 1 SUFeedURL = https://www.tunnelblick.net/appcast-s.rss SUScheduledCheckInterval = 86400 SUSendProfileInfo = 1 SULastCheckTime = 2017-11-09 18:24:28 +0000 SULastProfileSubmissionDate = 2017-11-08 18:10:57 +0000 SUHasLaunchedBefore = 1 WebKitDefaultFontSize = 11 WebKitStandardFont = .AppleSystemUIFont askedUserIfOKToCheckThatIPAddressDidNotChangeAfterConnection = 1 haveDealtWithSparkle1dot5b6 = 1 tunnelblickdHash = 004cdba8e08abd144bc48409040bc80e29c12ee9741ed7d73754f51d2547f7ea tunnelblickdPlistHash = ce400d395d1801b003398461b5420021f4d591822783a04b79b2f43956d28620 updateSendProfileInfo = 1 ================================================================================ Tunnelblick Log: *Tunnelblick: OS X 10.12.6; Tunnelblick 3.7.4 (build 4900); prior version 3.7.3 (build 4880) 2017-11-10 00:08:03 *Tunnelblick: Attempting connection with client2_pc_stunnel; Set nameserver = 769; monitoring connection 2017-11-10 00:08:03 *Tunnelblick: openvpnstart start client2_pc_stunnel.tblk 1337 769 0 3 0 1099696 -ptADGNWradsgnw 2.4.4-libressl-2.5.5 2017-11-10 00:08:03 *Tunnelblick: openvpnstart log: OpenVPN started successfully. Command used to start OpenVPN (one argument per displayed line): /Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.4.4-libressl-2.5.5/openvpn --daemon --log /Library/Application Support/Tunnelblick/Logs/-SLibrary-SApplication Support-STunnelblick-SShared-Sclient2_pc_stunnel.tblk-SContents-SResources-Sconfig.ovpn.769_0_3_0_1099696.1337.openvpn.log --cd /Library/Application Support/Tunnelblick/Shared/client2_pc_stunnel.tblk/Contents/Resources --setenv IV_GUI_VER "net.tunnelblick.tunnelblick 4900 3.7.4 (build 4900)" --verb 3 --config /Library/Application Support/Tunnelblick/Shared/client2_pc_stunnel.tblk/Contents/Resources/config.ovpn --verb 3 --cd /Library/Application Support/Tunnelblick/Shared/client2_pc_stunnel.tblk/Contents/Resources --management 127.0.0.1 1337 --management-query-passwords --management-hold --redirect-gateway def1 --script-security 2 --route-up /Applications/Tunnelblick.app/Contents/Resources/ client.up.tunnelblick.sh -9 -d -f -m -p -r -w -ptADGNWradsgnw --down /Applications/Tunnelblick.app/Contents/Resources/ client.down.tunnelblick.sh -9 -d -f -m -p -r -w -ptADGNWradsgnw 2017-11-10 00:08:03 OpenVPN 2.4.4 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD] built on Nov 2 2017 2017-11-10 00:08:03 library versions: LibreSSL 2.5.5, LZO 2.10 2017-11-10 00:08:03 MANAGEMENT: TCP Socket listening on [AF_INET] 127.0.0.1:1337 2017-11-10 00:08:03 Need hold release from management interface, waiting... 2017-11-10 00:08:03 MANAGEMENT: Client connected from [AF_INET] 127.0.0.1:1337 2017-11-10 00:08:03 *Tunnelblick: openvpnstart starting OpenVPN 2017-11-10 00:08:04 *Tunnelblick: Established communication with OpenVPN 2017-11-10 00:08:04 MANAGEMENT: CMD 'pid' 2017-11-10 00:08:04 MANAGEMENT: CMD 'state on' 2017-11-10 00:08:04 MANAGEMENT: CMD 'state' 2017-11-10 00:08:04 MANAGEMENT: CMD 'bytecount 1' 2017-11-10 00:08:04 MANAGEMENT: CMD 'hold release' 2017-11-10 00:08:04 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts 2017-11-10 00:08:04 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication 2017-11-10 00:08:04 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication 2017-11-10 00:08:04 TCP/UDP: Preserving recently used remote address: [AF_INET]127.0.0.1:989 2017-11-10 00:08:04 Socket Buffers: R=[131072->131072] S=[131072->131072] 2017-11-10 00:08:04 Attempting to establish TCP connection with [AF_INET] 127.0.0.1:989 [nonblock] 2017-11-10 00:08:04 MANAGEMENT: >STATE:1510254484,TCP_CONNECT,,,,,, 2017-11-10 00:08:04 TCP connection established with [AF_INET]127.0.0.1:989 2017-11-10 00:08:04 TCP_CLIENT link local: (not bound) 2017-11-10 00:08:04 TCP_CLIENT link remote: [AF_INET]127.0.0.1:989 2017-11-10 00:08:04 MANAGEMENT: >STATE:1510254484,WAIT,,,,,, 2017-11-10 00:08:07 MANAGEMENT: >STATE:1510254487,AUTH,,,,,, 2017-11-10 00:08:07 TLS: Initial packet from [AF_INET]127.0.0.1:989, sid=db4e0f35 f615606b 2017-11-10 00:08:07 VERIFY OK: depth=1, C=UZ, ST=UZ, L=XXX, O=XXX, OU=VPNUnit, CN=XXX <http://talk.ingichkimetals.com>, name=EasyRSA, emailAddress=XXX 2017-11-10 00:08:07 VERIFY KU OK 2017-11-10 00:08:07 Validating certificate extended key usage 2017-11-10 00:08:07 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication 2017-11-10 00:08:07 VERIFY EKU OK 2017-11-10 00:08:07 VERIFY OK: depth=0, C=UZ, ST=UZ, L=XXX, O=IngMet, OU=VPNUnit, CN=server, name=EasyRSA, emailAddress=XXX 2017-11-10 00:08:08 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA 2017-11-10 00:08:08 [server] Peer Connection Initiated with [AF_INET] 127.0.0.1:989 2017-11-10 00:08:09 MANAGEMENT: >STATE:1510254489,GET_CONFIG,,,,,, 2017-11-10 00:08:09 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1) 2017-11-10 00:08:10 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway local def1,route 10.0.26.0 255.255.255.0,dhcp-option DNS 10.0.26.1,route 10.0.26.1,topology net30,ping 10,ping-restart 120,ifconfig 10.0.26.10 10.0.26.9,peer-id 0,cipher AES-256-GCM' 2017-11-10 00:08:10 OPTIONS IMPORT: timers and/or timeouts modified 2017-11-10 00:08:10 OPTIONS IMPORT: --ifconfig/up options modified 2017-11-10 00:08:10 OPTIONS IMPORT: route options modified 2017-11-10 00:08:10 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified 2017-11-10 00:08:10 OPTIONS IMPORT: peer-id set 2017-11-10 00:08:10 OPTIONS IMPORT: adjusting link_mtu to 1626 2017-11-10 00:08:10 OPTIONS IMPORT: data channel crypto options modified 2017-11-10 00:08:10 Data Channel: using negotiated cipher 'AES-256-GCM' 2017-11-10 00:08:10 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key 2017-11-10 00:08:10 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key 2017-11-10 00:08:10 Opening utun (connect(AF_SYS_CONTROL)): Resource busy (errno=16) 2017-11-10 00:08:10 Opened utun device utun1 2017-11-10 00:08:10 do_ifconfig, tt->did_ifconfig_ipv6_setup=0 2017-11-10 00:08:10 MANAGEMENT: >STATE:1510254490,ASSIGN_IP,,10.0.26.10,,,, 2017-11-10 00:08:10 /sbin/ifconfig utun1 delete ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address 2017-11-10 00:08:10 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure 2017-11-10 00:08:10 /sbin/ifconfig utun1 10.0.26.10 10.0.26.9 mtu 1500 netmask 255.255.255.255 up 2017-11-10 00:08:10 /sbin/route add -net 0.0.0.0 10.0.26.9 128.0.0.0 add net 0.0.0.0: gateway 10.0.26.9 2017-11-10 00:08:10 /sbin/route add -net 128.0.0.0 10.0.26.9 128.0.0.0 add net 128.0.0.0: gateway 10.0.26.9 2017-11-10 00:08:10 MANAGEMENT: >STATE:1510254490,ADD_ROUTES,,,,,, 2017-11-10 00:08:10 /sbin/route add -net 10.0.26.0 10.0.26.9 255.255.255.0 add net 10.0.26.0: gateway 10.0.26.9 2017-11-10 00:08:10 /sbin/route add -net 10.0.26.1 10.0.26.9 255.255.255.255 add net 10.0.26.1: gateway 10.0.26.9 ********************************************** Start of output from client.up.tunnelblick.sh Retrieved from OpenVPN: name server(s) [ 10.0.26.1 ], search domain(s) [ ] and SMB server(s) [ ] and using default domain name [ openvpn ] Not aggregating ServerAddresses because running on OS X 10.6 or higher Prepending 'openvpn' to search domains '' because the search domains were not set manually (or are allowed to be changed) and 'Prepend domain name to search domains' was selected Saved the DNS and SMB configurations so they can be restored Changed DNS ServerAddresses setting from '172.20.10.1' to '10.0.26.1' Changed DNS SearchDomains setting from '' to 'openvpn' Changed DNS DomainName setting from '' to 'openvpn' Did not change SMB NetBIOSName setting of '' Did not change SMB Workgroup setting of '' Did not change SMB WINSAddresses setting of '' DNS servers '10.0.26.1' will be used for DNS queries when the VPN is active NOTE: The DNS servers do not include any free public DNS servers known to Tunnelblick. This may cause DNS queries to fail or be intercepted or falsified even if they are directed through the VPN. Specify only known public DNS servers or DNS servers located on the VPN network to avoid such problems. Flushed the DNS cache via dscacheutil /usr/sbin/discoveryutil not present. Not flushing the DNS cache via discoveryutil Notified mDNSResponder that the DNS cache was flushed Setting up to monitor system configuration with process-network-changes End of output from client.up.tunnelblick.sh ********************************************** 2017-11-10 00:08:13 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this 2017-11-10 00:08:13 Initialization Sequence Completed 2017-11-10 00:08:13 MANAGEMENT: >STATE:1510254493,CONNECTED,SUCCESS,10.0.26.10,127.0.0.1,989,127.0.0.1,50665 2017-11-10 00:08:14 *Tunnelblick: No 'connected.sh' script to execute 2017-11-10 00:08:54 *Tunnelblick: After 30.0 seconds, gave up trying to fetch IP address information using the ipInfo host's name after connecting. 2017-11-10 00:09:30 *Tunnelblick: After 30.0 seconds, gave up trying to fetch IP address information using the ipInfo host's IP address after connecting. 2017-11-10 00:10:13 [server] Inactivity timeout (--ping-restart), restarting 2017-11-10 00:10:13 SIGUSR1[soft,ping-restart] received, process restarting 2017-11-10 00:10:13 MANAGEMENT: >STATE:1510254613,RECONNECTING,ping-restart,,,,, 2017-11-10 00:10:14 *Tunnelblick: No 'reconnecting.sh' script to execute 2017-11-10 00:10:14 MANAGEMENT: CMD 'hold release' 2017-11-10 00:10:14 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts 2017-11-10 00:10:14 TCP/UDP: Preserving recently used remote address: [AF_INET]127.0.0.1:989 2017-11-10 00:10:14 Socket Buffers: R=[131072->131072] S=[131072->131072] 2017-11-10 00:10:14 Attempting to establish TCP connection with [AF_INET] 127.0.0.1:989 [nonblock] 2017-11-10 00:10:14 MANAGEMENT: >STATE:1510254614,TCP_CONNECT,,,,,, 2017-11-10 00:10:15 TCP connection established with [AF_INET]127.0.0.1:989 2017-11-10 00:10:15 TCP_CLIENT link local: (not bound) 2017-11-10 00:10:15 TCP_CLIENT link remote: [AF_INET]127.0.0.1:989 2017-11-10 00:10:15 MANAGEMENT: >STATE:1510254615,WAIT,,,,,, 2017-11-10 00:10:24 Connection reset, restarting [-1] 2017-11-10 00:10:24 SIGUSR1[soft,connection-reset] received, process restarting 2017-11-10 00:10:24 MANAGEMENT: >STATE:1510254624,RECONNECTING,connection-reset,,,,, 2017-11-10 00:10:24 *Tunnelblick: No 'reconnecting.sh' script to execute 2017-11-10 00:10:24 MANAGEMENT: CMD 'hold release' 2017-11-10 00:10:24 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts 2017-11-10 00:10:24 TCP/UDP: Preserving recently used remote address: [AF_INET]127.0.0.1:989 2017-11-10 00:10:24 Socket Buffers: R=[131072->131072] S=[131072->131072] 2017-11-10 00:10:24 Attempting to establish TCP connection with [AF_INET] 127.0.0.1:989 [nonblock] 2017-11-10 00:10:24 MANAGEMENT: >STATE:1510254624,TCP_CONNECT,,,,,, 2017-11-10 00:10:25 TCP connection established with [AF_INET]127.0.0.1:989 2017-11-10 00:10:25 TCP_CLIENT link local: (not bound) 2017-11-10 00:10:25 TCP_CLIENT link remote: [AF_INET]127.0.0.1:989 2017-11-10 00:10:25 MANAGEMENT: >STATE:1510254625,WAIT,,,,,, 2017-11-10 00:10:32 *Tunnelblick: Disconnecting; notification window disconnect button pressed 2017-11-10 00:10:33 *Tunnelblick: No 'pre-disconnect.sh' script to execute 2017-11-10 00:10:33 *Tunnelblick: Disconnecting using 'kill' 2017-11-10 00:10:33 event_wait : Interrupted system call (code=4) 2017-11-10 00:10:33 /sbin/route delete -net 10.0.26.0 10.0.26.9 255.255.255.0 delete net 10.0.26.0: gateway 10.0.26.9 2017-11-10 00:10:33 /sbin/route delete -net 10.0.26.1 10.0.26.9 255.255.255.255 delete net 10.0.26.1: gateway 10.0.26.9 2017-11-10 00:10:33 /sbin/route delete -net 0.0.0.0 10.0.26.9 128.0.0.0 delete net 0.0.0.0: gateway 10.0.26.9 2017-11-10 00:10:33 /sbin/route delete -net 128.0.0.0 10.0.26.9 128.0.0.0 delete net 128.0.0.0: gateway 10.0.26.9 2017-11-10 00:10:33 Closing TUN/TAP interface 2017-11-10 00:10:33 /Applications/Tunnelblick.app/Contents/Resources/ client.down.tunnelblick.sh -9 -d -f -m -p -r -w -ptADGNWradsgnw utun1 1500 1623 10.0.26.10 10.0.26.9 init ********************************************** Start of output from client.down.tunnelblick.sh Cancelled monitoring of system configuration changes Restored the DNS and SMB configurations Flushed the DNS cache via dscacheutil /usr/sbin/discoveryutil not present. Not flushing the DNS cache via discoveryutil Notified mDNSResponder that the DNS cache was flushed Resetting primary interface 'en0' via networksetup -setairportpower en0 off/on... End of output from client.down.tunnelblick.sh ********************************************** 2017-11-10 00:10:36 SIGTERM[hard,] received, process exiting 2017-11-10 00:10:36 MANAGEMENT: >STATE:1510254636,EXITING,SIGTERM,,,,, 2017-11-10 00:10:36 *Tunnelblick: No 'post-disconnect.sh' script to execute 2017-11-10 00:10:36 *Tunnelblick: Expected disconnection occurred. ================================================================================ "Sanitized" full configuration file client dev tun proto tcp remote 127.0.0.1 989 resolv-retry infinite nobind persist-key persist-tun verb 3 remote-cert-tls server keepalive 10 120 tls-client key-direction 1 <ca> [Security-related line(s) omitted] </ca> <cert> [Security-related line(s) omitted] </cert> <key> [Security-related line(s) omitted] </key> <tls-auth> [Security-related line(s) omitted] </tls-auth> ================================================================================ ifconfig output: lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384 options=1203<RXCSUM,TXCSUM,TXSTATUS,SW_TIMESTAMP> inet 127.0.0.1 netmask 0xff000000 inet6 ::1 prefixlen 128 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1 nd6 options=201<PERFORMNUD,DAD> gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280 stf0: flags=0<> mtu 1280 en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500 ether 60:03:08:a6:ca:5a inet 172.20.10.2 netmask 0xfffffff0 broadcast 172.20.10.15 media: autoselect status: active en1: flags=963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX> mtu 1500 options=60<TSO4,TSO6> ether 72:00:01:d9:43:00 media: autoselect <full-duplex> status: inactive en2: flags=963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX> mtu 1500 options=60<TSO4,TSO6> ether 72:00:01:d9:43:01 media: autoselect <full-duplex> status: inactive p2p0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 2304 ether 02:03:08:a6:ca:5a media: autoselect status: inactive awdl0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1484 ether c2:f1:c7:85:b6:9d inet6 fe80::c0f1:c7ff:fe85:b69d%awdl0 prefixlen 64 scopeid 0x8 nd6 options=201<PERFORMNUD,DAD> media: autoselect status: active bridge0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500 options=63<RXCSUM,TXCSUM,TSO4,TSO6> ether 72:00:01:d9:43:00 Configuration: id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0 maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200 root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0 ipfilter disabled flags 0x2 member: en1 flags=3<LEARNING,DISCOVER> ifmaxaddr 0 port 5 priority 0 path cost 0 member: en2 flags=3<LEARNING,DISCOVER> ifmaxaddr 0 port 6 priority 0 path cost 0 media: <unknown type> status: inactive utun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 2000 inet6 fe80::6c50:d369:e570:bf02%utun0 prefixlen 64 scopeid 0xa nd6 options=201<PERFORMNUD,DAD> ================================================================================ Console Log: 2017-11-09 23:23:57 Tunnelblick[1595] Tunnelblick: OS X 10.12.6; Tunnelblick 3.7.4 (build 4900) 2017-11-09 23:23:57 Tunnelblick[1595] Warning: preferences contain unknown preference 'PMPrintingExpandedStateForPrint2' 2017-11-09 23:23:57 Tunnelblick[1595] Warning: preferences contain unknown preference 'userAgreementVersionAgreedTo' 2017-11-10 00:08:54 Tunnelblick[1595] currentIPInfo(Name): IP address info could not be fetched within 35.4 seconds; the error was 'Error Domain=NSURLErrorDomain Code=-1001 "The request timed out." UserInfo={NSUnderlyingError=0x60800024a200 {Error Domain=kCFErrorDomainCFNetwork Code=-1001 "The request timed out." UserInfo={NSErrorFailingURLStringKey=https://tunnelblick.net/ipinfo, NSErrorFailingURLKey=https://tunnelblick.net/ipinfo, _kCFStreamErrorCodeKey=-2102, _kCFStreamErrorDomainKey=4, NSLocalizedDescription=The request timed out.}}, NSErrorFailingURLStringKey= https://tunnelblick.net/ipinfo, NSErrorFailingURLKey= https://tunnelblick.net/ipinfo, _kCFStreamErrorDomainKey=4, _kCFStreamErrorCodeKey=-2102, NSLocalizedDescription=The request timed out.}'; the response was '(null)' 2017-11-10 00:09:30 Tunnelblick[1595] currentIPInfo(Address): IP address info could not be fetched within 35.5 seconds; the error was 'Error Domain=NSURLErrorDomain Code=-1001 "The request timed out." UserInfo={NSUnderlyingError=0x60000044cea0 {Error Domain=kCFErrorDomainCFNetwork Code=-1001 "The request timed out." UserInfo={NSErrorFailingURLStringKey=http://205.233.73.116/ipinfo, NSErrorFailingURLKey=http://205.233.73.116/ipinfo, _kCFStreamErrorCodeKey=-2102, _kCFStreamErrorDomainKey=4, NSLocalizedDescription=The request timed out.}}, NSErrorFailingURLStringKey= http://205.233.73.116/ipinfo, NSErrorFailingURLKey= http://205.233.73.116/ipinfo, _kCFStreamErrorDomainKey=4, _kCFStreamErrorCodeKey=-2102, NSLocalizedDescription=The request timed out.}'; the response was '(null)'

1 0

Re: [stunnel-users] Web browsing over stunnel
by Osvald Brko 08 Nov '17

08 Nov '17

> From: Josealf.rm <josealf(a)rocketmail.com> > Sent: Tuesday, November 7, 2017 10:41 AM > To: Peter Pentchev > Cc: Osvald Brko; stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] Web browsing over stunnel > Osvald, > Peter made a very clear explanation. Note that your connect statement should be something like: > connect=104.239.213.7:443 > And you should test using something like: > http://www.stunnel.net:8888/ O.K., I understand it. www.stunnel.org still refuse connection (see below), but I was able to open www.wikipedia.org: http://www.wikipedia.org:8888/ [https_test] client = yes accept = 127.0.0.1:8888 connect = 91.198.174.192:443 #127.0.0.1 localhost #127.0.0.1 www.stunnel.org 127.0.0.1 www.wikipedia.org But of course I am not able to use any web link, and I can see only default main page without any path. So stunnel is completely unusable for web browsing, I am right? O.B. ===== http://www.stunnel.org:8888/ [https_test] client = yes accept = 127.0.0.1:8888 connect = 207.192.69.165:443 #127.0.0.1 localhost 127.0.0.1 www.stunnel.org #127.0.0.1 www.wikipedia.org 2017.11.07 15:51:37 LOG7[main]: Service [https_test] (FD=260) bound to 127.0.0.1:8888 2017.11.07 15:51:37 LOG7[cron]: Cron thread initialized 2017.11.07 15:51:53 LOG7[main]: Found 1 ready file descriptor(s) 2017.11.07 15:51:53 LOG7[main]: FD=232 ifds=r-x ofds=--- 2017.11.07 15:51:53 LOG7[main]: FD=248 ifds=r-x ofds=--- 2017.11.07 15:51:53 LOG7[main]: Service [https_test] accepted (FD=300) from 127.0.0.1:3197 2017.11.07 15:51:53 LOG7[main]: Creating a new thread 2017.11.07 15:51:53 LOG7[main]: New thread created 2017.11.07 15:51:53 LOG7[0]: Service [https_test] started 2017.11.07 15:51:53 LOG7[0]: Option TCP_NODELAY set on local socket 2017.11.07 15:51:53 LOG5[0]: Service [https_test] accepted connection from 127.0.0.1:3197 2017.11.07 15:51:53 LOG6[0]: s_connect: connecting 207.192.69.165:443 2017.11.07 15:51:53 LOG7[0]: s_connect: s_poll_wait 207.192.69.165:443: waiting 10 seconds 2017.11.07 15:51:53 LOG5[0]: s_connect: connected 207.192.69.165:443 2017.11.07 15:51:53 LOG5[0]: Service [https_test] connected remote server from XX.XXX.XXX.XXX:3198 2017.11.07 15:51:53 LOG7[0]: Option TCP_NODELAY set on remote socket 2017.11.07 15:51:53 LOG7[0]: Remote descriptor (FD=320) initialized 2017.11.07 15:51:53 LOG6[0]: SNI: sending servername: 207.192.69.165 2017.11.07 15:51:53 LOG6[0]: Peer certificate not required 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): before/connect initialization 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv2/v3 write client hello A 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 read server hello A 2017.11.07 15:51:53 LOG6[0]: Certificate verification disabled 2017.11.07 15:51:53 LOG6[0]: Certificate verification disabled 2017.11.07 15:51:53 LOG6[0]: Certificate verification disabled 2017.11.07 15:51:53 LOG6[0]: Certificate verification disabled 2017.11.07 15:51:53 LOG6[0]: Certificate verification disabled 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 read server certificate A 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 read server key exchange A 2017.11.07 15:51:53 LOG6[0]: Client certificate not requested 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 read server done A 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 write client key exchange A 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 write change cipher spec A 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 write finished A 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 flush data 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 read server session ticket A 2017.11.07 15:51:53 LOG7[0]: TLS state (connect): SSLv3 read finished A 2017.11.07 15:51:53 LOG7[0]: 1 client connect(s) requested 2017.11.07 15:51:53 LOG7[0]: 1 client connect(s) succeeded 2017.11.07 15:51:53 LOG7[0]: 0 client renegotiation(s) requested 2017.11.07 15:51:53 LOG7[0]: 0 session reuse(s) 2017.11.07 15:51:53 LOG6[0]: TLS connected: new session negotiated 2017.11.07 15:51:53 LOG7[0]: Peer certificate was cached (7519 bytes) 2017.11.07 15:51:53 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2017.11.07 15:51:53 LOG7[0]: Compression: null, expansion: null 2017.11.07 15:51:58 LOG7[0]: TLS alert (read): warning: close notify 2017.11.07 15:51:58 LOG6[0]: TLS closed (SSL_read) 2017.11.07 15:51:58 LOG7[0]: Sent socket write shutdown 2017.11.07 15:51:59 LOG3[0]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2017.11.07 15:51:59 LOG5[0]: Connection reset: 483 byte(s) sent to TLS, 429 byte(s) sent to socket 2017.11.07 15:51:59 LOG7[0]: Remote descriptor (FD=320) closed 2017.11.07 15:51:59 LOG7[0]: Local descriptor (FD=300) closed 2017.11.07 15:51:59 LOG7[0]: Service [https_test] finished (0 left)

2 2

Re: [stunnel-users] stunnel 5.43 released
by Ian Bamforth 07 Nov '17

07 Nov '17

Hi, I'm having trouble installing the new release on Ubuntu 14.04. The command I'm running is: execute ./configure --with-ssl=/usr/local/openssl-1.1.0g && make && make check && sudo make install I get this output: 15:13:06 stunnel 5.43 on x86_64-pc-linux-gnu platform 15:13:06 Compiled/running with OpenSSL 1.1.0g 2 Nov 2017 15:13:06 Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 15:13:06 15:13:06 test 010_require_cert ok 15:13:06 test 011_verify_peer ok 15:13:06 test 012_verify_chain ok 15:13:06 test 013_CRL_file failed 15:13:06 error logs logs/013_CRL_file.log 15:13:06 test 014_PSK_secrets ok 15:13:06 test 015_p12_cert ok 15:13:06 test 020_IPv6 skipped 15:13:06 test 021_FIPS skipped 15:13:06 test 030_simple_execute ok 15:13:06 test 031_redirect ok 15:13:06 test 032_no_redirect ok 15:13:06 test 033_redirect_exec ok 15:13:06 test 034_no_redirect_exec ok 15:13:06 test 035_SNI ok 15:13:06 test 036_no_SNI ok 15:13:06 test 037_failover_prio1 failed 15:13:06 error logs logs/037_failover_prio1.log 15:13:06 test 038_failover_prio2 failed 15:13:06 error logs logs/038_failover_prio2.log 15:13:06 test 039_failover_rr ok 15:13:06 test 040_reload ok 15:13:06 test 110_failure_require_cert ok 15:13:06 test 111_failure_verify_peer ok 15:13:06 test 112_failure_verify_chain ok 15:13:06 test 113_failure_CRL_file ok 15:13:06 test 114_failure_PSK_secrets ok 15:13:06 test 120_failure_no_cert ok 15:13:06 test 121_failure_wrong_config ok 15:13:06 summary: success 21, skip 2, fail 3 15:13:06 ./make_test finished 15:13:06 make[2]: Leaving directory `/opt/stunnel/stunnel-5.43/tests' 15:13:06 make[1]: Leaving directory `/opt/stunnel/stunnel-5.43/tests' 15:13:06 STDERR: make[2]: *** [check-local] Error 1 15:13:06 make[1]: *** [check-am] Error 2 15:13:06 make: *** [check-recursive] Error 1 15:13:06 ---- End output of ./configure --with-ssl=/usr/local/openssl-1.1.0g && make && make check && sudo make install ---- 15:13:06 Ran ./configure --with-ssl=/usr/local/openssl-1.1.0g && make && make check && sudo make install returned 2 This was working until the new release (we were on 5.42), is there some change required? Regards, Ian Bamforth Senior Software Engineer Operations & Planning Systems Division W: www.tracsis.com www.tracsisops.com Tracsis plc Leeds Innovation Centre 103 Clarendon Road Leeds LS2 9DF Tracsis Operations and Planning Systems Division is a Division of Tracsis plc and comprises Tracsis plc (05019106), Tracsis Rail Consultancy Limited (05047148), Safety Information Systems Limited trading as COMPASS (02588404) and Tracsis Retail and Operations Limited (04225250), all subsidiaries of Tracsis plc with a registered office at Leeds Innovation Centre,103 Clarendon Road, Leeds, LS2 9DF. VAT Registration No: 945 7876 61. This email and its attachments may be confidential and are intended solely for the use of the individual(s) to whom it is addressed. If you are not the intended recipient of this email and its attachments, you must take no action based upon them, nor must you copy or show them to anyone. Please contact the sender if you believe you have received this email in error. -----Original Message----- From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Michal Trojnara Sent: 05 November 2017 23:03 To: stunnel-users(a)stunnel.org; stunnel-announce(a)stunnel.org; openssl-users(a)openssl.org Subject: [stunnel-users] stunnel 5.43 released Dear Users, I have released version 5.43 of stunnel. Version 5.43, 2017.11.05, urgency: LOW * New features - OpenSSL DLLs updated to version 1.0.2m. - Android build updated to OpenSSL 1.1.0g. - Allow for multiple "accept" ports per section. - Self-test framework (make check). - Added config load before OpenSSL init (thx to Dmitrii Pichulin). - OpenSSL 1.1.0 support for Travis CI. - OpenSSL 1.1.1-dev compilation fixes. * Bugfixes - Fixed a memory fault on Solaris. - Fixed round-robin failover in the FORK threading model. - Fixed handling SSL_ERROR_ZERO_RETURN in SSL_shutdown(). - Minor fixes of the logging subsystem. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 05915babf705a0494886a72a7367913d403d07fc908ebb7b380d639e2d8bcee2 stunnel-5.43.tar.gz 5249479d295f482ecac9cd3d5c89c0e5d41ae6ff8e265d4634ecfd8761834201 stunnel-5.43-win32-installer.exe e628fa7027d19bf4f0a62392f9dc042d97959498c292e13ebdf30c65a545dd6d stunnel-5.43-android.zip Best regards, Mike

1 0

Web browsing over stunnel
by Osvald Brko 02 Nov '17

02 Nov '17

Hello, I try to use stunnel for web browsing (https), and I am not successful. (While mail client against IMAP server works fine). Can anybody give me a hint what to try? The situation: Windows XP SP3, MSIE 8 (or Firefox 43.0.1. for check), stunnel 5.42 stunnel.conf : debug = 7 [https_test] client = yes accept = 127.0.0.1:8888 connect = www.stunnel.org:443 http://127.0.0.1:8888/ -> Error HTTP 404 Not Found 2017.11.02 13:01:50 LOG7[main]: Running on Windows 5.1 2017.11.02 13:01:50 LOG7[main]: No limit detected for the number of clients 2017.11.02 13:01:50 LOG5[main]: stunnel 5.42 on x86-pc-msvc-1500 platform 2017.11.02 13:01:50 LOG5[main]: Compiled/running with OpenSSL 1.0.2l-fips 25 May 2017 2017.11.02 13:01:50 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2017.11.02 13:01:50 LOG7[main]: errno: (*_errno()) 2017.11.02 13:01:50 LOG7[ui]: GUI message loop initialized 2017.11.02 13:01:50 LOG7[main]: Running on Windows 5.1 2017.11.02 13:01:50 LOG5[main]: Reading configuration from file stunnel.conf 2017.11.02 13:01:50 LOG5[main]: UTF-8 byte order mark detected 2017.11.02 13:01:50 LOG5[main]: FIPS mode disabled 2017.11.02 13:01:50 LOG7[main]: Compression disabled 2017.11.02 13:01:50 LOG7[main]: PRNG seeded successfully 2017.11.02 13:01:50 LOG6[main]: Initializing service [XXXXXX-imap] 2017.11.02 13:01:50 LOG7[main]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2017.11.02 13:01:50 LOG7[main]: TLS options: 0x03000004 (+0x03000000, -0x00000000) 2017.11.02 13:01:50 LOG7[main]: No certificate or private key specified 2017.11.02 13:01:50 LOG6[main]: Initializing service [https_test] 2017.11.02 13:01:50 LOG7[main]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2017.11.02 13:01:50 LOG7[main]: TLS options: 0x03000004 (+0x03000000, -0x00000000) 2017.11.02 13:01:50 LOG7[main]: No certificate or private key specified 2017.11.02 13:01:50 LOG4[main]: Service [https_test] needs authentication to prevent MITM attacks 2017.11.02 13:01:50 LOG5[main]: Configuration successful 2017.11.02 13:01:50 LOG7[main]: Listening file descriptor created (FD=236) 2017.11.02 13:01:50 LOG7[main]: Service [XXXXXX-imap] (FD=236) bound to 127.0.0.1:143 2017.11.02 13:01:50 LOG7[main]: Listening file descriptor created (FD=260) 2017.11.02 13:01:50 LOG7[main]: Service [https_test] (FD=260) bound to 127.0.0.1:8888 2017.11.02 13:01:50 LOG7[cron]: Cron thread initialized 2017.11.02 13:02:11 LOG7[main]: Found 1 ready file descriptor(s) 2017.11.02 13:02:11 LOG7[main]: FD=236 ifds=r-x ofds=--- 2017.11.02 13:02:11 LOG7[main]: FD=248 ifds=r-x ofds=--- 2017.11.02 13:02:11 LOG7[main]: Service [https_test] accepted (FD=304) from 127.0.0.1:3424 2017.11.02 13:02:11 LOG7[main]: Creating a new thread 2017.11.02 13:02:11 LOG7[main]: New thread created 2017.11.02 13:02:11 LOG7[0]: Service [https_test] started 2017.11.02 13:02:11 LOG7[0]: Option TCP_NODELAY set on local socket 2017.11.02 13:02:11 LOG5[0]: Service [https_test] accepted connection from 127.0.0.1:3424 2017.11.02 13:02:11 LOG6[0]: s_connect: connecting 207.192.69.165:443 2017.11.02 13:02:11 LOG7[0]: s_connect: s_poll_wait 207.192.69.165:443: waiting 10 seconds 2017.11.02 13:02:11 LOG5[0]: s_connect: connected 207.192.69.165:443 2017.11.02 13:02:11 LOG5[0]: Service [https_test] connected remote server from XX.XXX.XXX.XXX:3425 2017.11.02 13:02:11 LOG7[0]: Option TCP_NODELAY set on remote socket 2017.11.02 13:02:11 LOG7[0]: Remote descriptor (FD=320) initialized 2017.11.02 13:02:11 LOG6[0]: SNI: sending servername: www.stunnel.org 2017.11.02 13:02:11 LOG6[0]: Peer certificate not required 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): before/connect initialization 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv2/v3 write client hello A 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 read server hello A 2017.11.02 13:02:11 LOG6[0]: Certificate verification disabled 2017.11.02 13:02:11 LOG6[0]: Certificate verification disabled 2017.11.02 13:02:11 LOG6[0]: Certificate verification disabled 2017.11.02 13:02:11 LOG6[0]: Certificate verification disabled 2017.11.02 13:02:11 LOG6[0]: Certificate verification disabled 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 read server certificate A 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 read server key exchange A 2017.11.02 13:02:11 LOG6[0]: Client certificate not requested 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 read server done A 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 write client key exchange A 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 write change cipher spec A 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 write finished A 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 flush data 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 read server session ticket A 2017.11.02 13:02:11 LOG7[0]: TLS state (connect): SSLv3 read finished A 2017.11.02 13:02:11 LOG7[0]: 1 client connect(s) requested 2017.11.02 13:02:11 LOG7[0]: 1 client connect(s) succeeded 2017.11.02 13:02:11 LOG7[0]: 0 client renegotiation(s) requested 2017.11.02 13:02:11 LOG7[0]: 0 session reuse(s) 2017.11.02 13:02:11 LOG6[0]: TLS connected: new session negotiated 2017.11.02 13:02:11 LOG7[0]: Peer certificate was cached (7519 bytes) 2017.11.02 13:02:11 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2017.11.02 13:02:11 LOG7[0]: Compression: null, expansion: null 2017.11.02 13:02:16 LOG7[0]: TLS alert (read): warning: close notify 2017.11.02 13:02:16 LOG6[0]: TLS closed (SSL_read) 2017.11.02 13:02:16 LOG7[0]: Sent socket write shutdown 2017.11.02 13:02:21 LOG3[0]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2017.11.02 13:02:21 LOG5[0]: Connection reset: 565 byte(s) sent to TLS, 399 byte(s) sent to socket 2017.11.02 13:02:21 LOG7[0]: Remote descriptor (FD=320) closed 2017.11.02 13:02:21 LOG7[0]: Local descriptor (FD=304) closed 2017.11.02 13:02:21 LOG7[0]: Service [https_test] finished (0 left) 2017.11.02 13:02:50 LOG6[cron]: Executing cron jobs 2017.11.02 13:02:50 LOG6[cron]: Cron jobs completed in 0 seconds 2017.11.02 13:02:50 LOG7[cron]: Waiting 86400 seconds

1 0

Problem: eMail over SMTP on port 587 accepted without error but not forwarded
by Ben Stover 02 Nov '17

02 Nov '17

After a long time of successful usage of stunnel on a Windows 7 system I experienced now permanent problems with sending messages from my local email client over stunnel + SMTP to the remote smtp-server on port 587. Again: my local client+stunnel setup is/was untouched. When I send now messages to remote port 587 (as before) they are silently accepted but NOT forwarded to the final destination. No error messages was returned. The only thing I could imagine is that the webhoster changed the mail server certificate. How does stunnel handle this scenario? Do I have to tell stunnel that the remote certificate changed? how? Receiving eMails through POP3 on port 995 works. WebHoster has no clue what the reason is. The (anonymized) log below shows the transfer Any help is welcomed. Thank you Peter 2017.11.02 13:03:51 LOG7[main]: Found 1 ready file descriptor(s) 2017.11.02 13:03:51 LOG7[main]: FD=388 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=464 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=468 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=472 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=476 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=480 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=484 ifds=r-x ofds=r-- 2017.11.02 13:03:51 LOG7[main]: FD=488 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=492 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=496 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=500 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=504 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=508 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=512 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=516 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=520 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=524 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: FD=528 ifds=r-x ofds=--- 2017.11.02 13:03:51 LOG7[main]: Service [mail-smtp] accepted (FD=904) from 127.0.0.1:47872 2017.11.02 13:03:51 LOG7[main]: Creating a new thread 2017.11.02 13:03:51 LOG7[main]: New thread created 2017.11.02 13:03:51 LOG7[537]: Service [mail-smtp] started 2017.11.02 13:03:51 LOG7[537]: Option TCP_NODELAY set on local socket 2017.11.02 13:03:51 LOG5[537]: Service [mail-smtp] accepted connection from 127.0.0.1:47872 2017.11.02 13:03:51 LOG6[537]: s_connect: connecting 195.54.77.83:587 2017.11.02 13:03:51 LOG7[537]: s_connect: s_poll_wait 195.54.77.83:587: waiting 10 seconds 2017.11.02 13:03:51 LOG5[537]: s_connect: connected 195.54.77.83:587 2017.11.02 13:03:51 LOG5[537]: Service [mail-smtp] connected remote server from 192.168.0.10:47873 2017.11.02 13:03:51 LOG7[537]: Option TCP_NODELAY set on remote socket 2017.11.02 13:03:51 LOG7[537]: Remote descriptor (FD=876) initialized 2017.11.02 13:03:51 LOG7[537]: <- 220 foobar.testserver.com ESMTP Postfix 2017.11.02 13:03:51 LOG7[537]: -> 220 foobar.testserver.com ESMTP Postfix 2017.11.02 13:03:51 LOG7[537]: -> EHLO localhost 2017.11.02 13:03:51 LOG7[537]: <- 250-foobar.testserver.com 2017.11.02 13:03:51 LOG7[537]: <- 250-PIPELINING 2017.11.02 13:03:51 LOG7[537]: <- 250-SIZE 104857600 2017.11.02 13:03:51 LOG7[537]: <- 250-ETRN 2017.11.02 13:03:51 LOG7[537]: <- 250-STARTTLS 2017.11.02 13:03:51 LOG7[537]: <- 250-ENHANCEDSTATUSCODES 2017.11.02 13:03:51 LOG7[537]: <- 250-8BITMIME 2017.11.02 13:03:51 LOG7[537]: <- 250 DSN 2017.11.02 13:03:51 LOG7[537]: -> STARTTLS 2017.11.02 13:03:51 LOG7[537]: <- 220 2.0.0 Ready to start TLS 2017.11.02 13:03:51 LOG6[537]: SNI: sending servername: foobar.testserver.com 2017.11.02 13:03:51 LOG6[537]: Peer certificate not required 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): before/connect initialization 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 write client hello A 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 read server hello A 2017.11.02 13:03:51 LOG6[537]: Certificate verification disabled 2017.11.02 13:03:51 LOG6[537]: Certificate verification disabled 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 read server certificate A 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 read server key exchange A 2017.11.02 13:03:51 LOG6[537]: Client certificate not requested 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 read server done A 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 write client key exchange A 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 write change cipher spec A 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 write finished A 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 flush data 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 read server session ticket A 2017.11.02 13:03:51 LOG7[537]: TLS state (connect): SSLv3 read finished A 2017.11.02 13:03:51 LOG7[537]: 2 client connect(s) requested 2017.11.02 13:03:51 LOG7[537]: 2 client connect(s) succeeded 2017.11.02 13:03:51 LOG7[537]: 0 client renegotiation(s) requested 2017.11.02 13:03:51 LOG7[537]: 0 session reuse(s) 2017.11.02 13:03:51 LOG6[537]: TLS connected: new session negotiated 2017.11.02 13:03:51 LOG7[537]: Deallocating application specific data for session connect address 2017.11.02 13:03:51 LOG6[537]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2017.11.02 13:03:51 LOG7[537]: Compression: null, expansion: null 2017.11.02 13:03:52 LOG6[537]: Read socket closed (readsocket) 2017.11.02 13:03:52 LOG7[537]: Sending close_notify alert 2017.11.02 13:03:52 LOG7[537]: TLS alert (write): warning: close notify 2017.11.02 13:03:52 LOG6[537]: SSL_shutdown successfully sent close_notify alert 2017.11.02 13:03:52 LOG7[537]: TLS alert (read): warning: close notify 2017.11.02 13:03:52 LOG6[537]: TLS closed (SSL_read) 2017.11.02 13:03:52 LOG7[537]: Sent socket write shutdown 2017.11.02 13:03:52 LOG5[537]: Connection closed: 2954 byte(s) sent to TLS, 337 byte(s) sent to socket 2017.11.02 13:03:52 LOG7[537]: Remote descriptor (FD=876) closed 2017.11.02 13:03:52 LOG7[537]: Local descriptor (FD=904) closed 2017.11.02 13:03:52 LOG7[537]: Service [mailo-smtp] finished (0 left)

1 0

Re: [stunnel-users] How to distinguish stunnel definition between SMTP through SSL-TLS vs. STARTTLS?
by Harris, Douglas (SSC/SPC) 26 Oct '17

26 Oct '17

> Ok, if I specify > > protocol=smtp > > what does that mean: "Connect through SSL-TLS protocol" or "connect through STARTTLS protocol"? That means connect using STARTTLS. > It seems to me that I ALWAYS have to specify "protocol=smtp" for ALL smtp-server connects. You don't. If you are not using STARTTLS you don't specify "protocol=". > Is this done only by port number 465 vs 587? No. > That would mean there is a hidden configuration by convention! Indeed. That would be bad. > What if the webhoster would set up a special mail server at port 8888? Then you would specify port 8888 in your "connect=" config

1 0

How to distinguish stunnel definition between SMTP through SSL-TLS vs. STARTTLS?
by Ben Stover 26 Oct '17

26 Oct '17

As yyou know there are two types of letting a local email client connect to remote secured SMTP server: 1.) through SSL-TLS and 2.) through STARTTLS How do I distinguish betwen these connection types in the stunnel.conf setup file? In a previous post I was told to look at the "protocol" parameter. Ok, if I specify protocol=smtp what does that mean: "Connect through SSL-TLS protocol" or "connect through STARTTLS protocol"? It seems to me that I ALWAYS have to specify "protocol=smtp" for ALL smtp-server connects. The stunnel documentation does not explain how to setup the *.conf file for each of the variants. Is this done only by port number 465 vs 587? That would mean there is a hidden configuration by convention! What if the webhoster would set up a special mail server at port 8888? Ben

1 0

stunnel and TLS1.2 for IE
by Thomas GMX 20 Oct '17

20 Oct '17

Hello. I have successfully configured my email client (Outlook 2010) to my provider with TLS1.2 via stunnel running as a service. config: debug = 5 engine = capi [freenet-pop3s] client = yes EngineID = capi accept = localhost:2110 connect = mx.freenet.de:995 [freenet-smpts] client = yes EngineID = capi accept = localhost:2025 connect = mx.freenet.de:465 That was no problem. But at this point I am wondering if it is possible and how I can configure stunnel so that "all" https traffic from Internet Explorer is going through stunnel and connect to internet with highest secure level supported. Not only to one specific server (connect = xyz.net) but to all servers given in IE address. By now I guess that I have to set IE so that it uses a https-proxy at "localhost:xxx" with stunnel config "accept = localhost:xxx". But how is stunnel config for "connect x.x.x.x:443" that it connect to the right server in internet I specified in IE address line? Can someone give me a hint? Or impossible? Thanks a lot Thomas

2 1

Connection setup for STARTTLS vs. SSL/TLS for POP3/SMTP mail servers?
by Ben Stover 20 Oct '17

20 Oct '17

In stunnels *.conf file I can specify the mail server name and the port for a connection. How can I tell stunnel to use STARTTLS as connect type? How can I tell stunnel to use SSL/TLS as connect type? Does stunnel support both connect types at all or only one? Is the connect type for SMTP completely determined by port e.g.: STARTTLS over port 587 and SSL/TLS over port 465 or can both connect types use both ports? Assume I do not get the supported connect type information from my webhoster: How can I find it out from my (client) side? What are there error messages? Ben

2 1

Stunnel on Android 7.x not working?
by John Appleseed 14 Oct '17

14 Oct '17

Hello, I have trouble with stunnel on Android 7.x.. I'm trying to connect to OpenVPN server through SSL tunneling with stunnel. On phone I'm using stunnel installed in Termux and OpenVPN. Everything is correctly configured, Im using the same config on other devices in same network and it works perfectly. I tried it with different devices with Android 7.x and it is not working at all :( Immediately after succesful connection I am receiving: TLS fd: Software caused connection abort (103) TLS socket closed (SSL_read) And it is still reconnecting again and again with the same error. I also tried it with stunnel downloaded directly from stunnel.org site.. Anyone with new Android who have working stunnel? Where can be the problem? Example stunnel.conf on Android: socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = debug [openvpn] client = yes accept = 1337 connect = *****.ddns.net:993 cert = /path/to/stunnel.pem and on server: chroot = /var/lib/stunnel4 pid = /stunnel.pid output = /stunnel.log setuid = stunnel4 setgid = stunnel4 socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [openvpn] client = no accept = 993 connect = 127.0.0.1:1194 cert = /etc/stunnel/stunnel.pem Example stunnel.log is in attachment. Thank you very much

1 0

No certificate or private key specified
by Hugo Darley 12 Oct '17

12 Oct '17

Hi, After overcoming some initial more obvious problems I have still been unable to get this client's stunnel configured correctly. "No certificate or private key specified" - is this significant? Stunnel.conf looks like the below: debug = 2 output = stunnel.log CAfile=.\ca-verisign.crt client=yes verify=0 sslVersion = TLSv1.2 options = NO_SSLv2 options = NO_SSLv3 [TRD] accept=16002 connect= our.ip.com:443 [INV] accept=16003 connect= our.ip.com:443 Stunnel output log below 2017.10.12 10:53:22 LOG7[main]: Found 1 ready file descriptor(s) 2017.10.12 10:53:22 LOG7[main]: FD=276 ifds=r-x ofds=--- 2017.10.12 10:53:22 LOG7[main]: FD=284 ifds=r-x ofds=--- 2017.10.12 10:53:22 LOG7[main]: Dispatching signals from the signal pipe 2017.10.12 10:53:22 LOG7[main]: Processing SIGNAL_RELOAD_CONFIG 2017.10.12 10:53:22 LOG7[main]: Running on Windows 6.1 2017.10.12 10:53:22 LOG5[main]: Reading configuration from file stunnel.conf 2017.10.12 10:53:22 LOG5[main]: UTF-8 byte order mark detected 2017.10.12 10:53:22 LOG5[main]: FIPS mode disabled 2017.10.12 10:53:22 LOG7[main]: Compression disabled 2017.10.12 10:53:22 LOG7[main]: Snagged 64 random bytes from C:/.rnd 2017.10.12 10:53:22 LOG7[main]: Wrote 1024 new random bytes to C:/.rnd 2017.10.12 10:53:22 LOG7[main]: PRNG seeded successfully 2017.10.12 10:53:22 LOG6[main]: Initializing service [TRD] 2017.10.12 10:53:22 LOG7[main]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2017.10.12 10:53:22 LOG7[main]: TLS options: 0x03000004 (+0x03000000, -0x00000000) 2017.10.12 10:53:22 LOG7[main]: No certificate or private key specified 2017.10.12 10:53:22 LOG4[main]: Service [TRD] needs authentication to prevent MITM attacks 2017.10.12 10:53:22 LOG6[main]: Initializing service [INV] 2017.10.12 10:53:22 LOG7[main]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2017.10.12 10:53:22 LOG7[main]: TLS options: 0x03000004 (+0x03000000, -0x00000000) 2017.10.12 10:53:22 LOG7[main]: No certificate or private key specified 2017.10.12 10:53:22 LOG4[main]: Service [INV] needs authentication to prevent MITM attacks 2017.10.12 10:53:22 LOG5[main]: Configuration successful 2017.10.12 10:53:22 LOG7[main]: Closing service [TRD] 2017.10.12 10:53:22 LOG7[main]: Service [TRD] closed (FD=284) 2017.10.12 10:53:22 LOG7[main]: Service [TRD] closed 2017.10.12 10:53:22 LOG7[main]: Closing service [INV] 2017.10.12 10:53:22 LOG7[main]: Service [INV] closed (FD=276) 2017.10.12 10:53:22 LOG7[main]: Service [INV] closed We tried giving the certification a hard location but still it seems unable to find it. Is there anything in the cfg you can see missing? Bearing in mind this is standard cfg for our clients connecting in. Kind regards, Hugo Darley The information contained in and accompanying this communication is strictly confidential and intended solely for the use of the intended recipient(s). If you have received it by mistake please let us know by reply and then delete it from your system; you should not copy the message or disclose its content to anyone. MarketAxess reserves the right to monitor the content of emails sent to or from its systems. Any comments or statements made are not necessarily those of MarketAxess. For more information, please visit www.marketaxess.com. MarketAxess Europe Limited is authorised and regulated by the UK Financial Conduct Authority, registered in England no. 4017610, registered office at 5 Aldermanbury Square, London EC2V 7HR. Telephone (020) 7709 3100. MarketAxess Corporation is regulated in the USA by the SEC and FINRA, incorporated in Delaware, executive offices at 299 Park Avenue, New York, NY 10171. Telephone (1) 212 813 6000.

1 0

OpenService: Error 1060: The specified service does not exist as an installed service.
by Hugo Darley 09 Oct '17

09 Oct '17

User has recently installed v5.4.2 on a windows machine and gets this error: [cid:image001.gif@01D33EA5.DF25F8D0] Downloaded the .exe file from the website, installed into a D: drive folder (not the C: program files x86 folder), edited the config file to what we have advised countless users in the past and added the verisign crt to the same folder. Has reinstalled a couple of times to no avail. I have searched on the net for help but nothing specific to STunnel. Can anyone advise? Many thanks Hugo The information contained in and accompanying this communication is strictly confidential and intended solely for the use of the intended recipient(s). If you have received it by mistake please let us know by reply and then delete it from your system; you should not copy the message or disclose its content to anyone. MarketAxess reserves the right to monitor the content of emails sent to or from its systems. Any comments or statements made are not necessarily those of MarketAxess. For more information, please visit www.marketaxess.com. MarketAxess Europe Limited is authorised and regulated by the UK Financial Conduct Authority, registered in England no. 4017610, registered office at 5 Aldermanbury Square, London EC2V 7HR. Telephone (020) 7709 3100. MarketAxess Corporation is regulated in the USA by the SEC and FINRA, incorporated in Delaware, executive offices at 299 Park Avenue, New York, NY 10171. Telephone (1) 212 813 6000.

1 1

Re: [stunnel-users] Need some info
by Heinsbroek, Peter 09 Oct '17

09 Oct '17

I know. I have a module that reads and writes the pin encrypted from/into a disk file. Till stunnel 5.38 it worked via engine_pkcs and now I try to build it into stunnel. I works ,but the only thing now is where to store the pin after decrypting it. __________________ With regards Peter Heinsbroek Tel. +31 (0)88 265 9869 -----Original Message----- From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Malgorzata Olszówka Sent: Thursday, October 05, 2017 3:03 PM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Need some info W dniu 05.10.2017 o 14:39, Heinsbroek, Peter pisze: > How can I get the pin info from the config file entry “engineCtrl = > PIN:12345” into a variable in the ctx.c source With regards, Peter > Heinsbroek SQL & Unix Administrator Hello Peter, This is an example pin to the SoftHSM token. Regards, Malgorzata Olszowka _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, Atos’ liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted. On all offers and agreements under which Atos Nederland B.V. supplies goods and/or services of whatever nature, the Terms of Delivery from Atos Nederland B.V. exclusively apply. The Terms of Delivery shall be promptly submitted to you on your request.

1 0

Professional support agreement
by alper erbakan 07 Oct '17

07 Oct '17

Hi, I am trying to find a company that willing to glve professional support for stunnel Windows version. I tried to reach from stunnel.org e-mail addresses is not working. Would you please help? Best regards iPhone'umdan gönderildi

2 1

Comments on daily DH Parameters regeneration...
by Taed Wynnell 06 Oct '17

06 Oct '17

We've been experiencing pain due to the daily STunnel regeneration of the DH Parameters. On our single-core machines in the field, this process will use 100% of the CPU for possibly an extended time. This interferes with other tasks that the machine is intended for. What's odd is that this process time ranges wildly, ranging from as low as 3 seconds to 90 minutes, even on the same machine. We see this behavior on all (thousands) of our machines, now that we know what to look for (the "Cron jobs completed in" trace in stunnel.log). We now know that we can set the DH Parameters in the configuration file, and that's what we'll be doing going forward. (Unless someone has another idea to offer.) I'd like to suggest some ideas for the future since I've seen on the mailing list that there are others who have run into this issue: * If the DH Parameter regeneration would run at Idle priority instead of Normal priority, it would not be nearly as noticeable, in that the CPU usage would still be there, but it wouldn't impact other services. The recomputation may be done in a separate thread, if so, this is straight-forward. * If there were a configuration file parameter to specify the regeneration interval. It would default to 24 hours (which is the current behavior), but could be set to a longer interval, a shorter interval for extreme security, or even to never. STunnel would still regenerate at the time of the service starting, unless a fixed DH is found in the configuration file. If a fixed DH were specified in the configuration file, that would avoid the service start computation and the interval would default to never. If both a fixed DH and the interval were specified in the configuration file, it would use the specified interval and recompute only after that interval.

1 0

Need some info
by Heinsbroek, Peter 05 Oct '17

05 Oct '17

How can I get the pin info from the config file entry “engineCtrl = PIN:12345” into a variable in the ctx.c source With regards, Peter Heinsbroek SQL & Unix Administrator Tel. +31 (0)88 265 9869 Mob. +31 6 5375 3244 Werner von Siemensstraat 3 2712 PN Zoetermeer, Nederland Org. unit B&PS-BTN/NL-TS-PS Central Unit 04 Email peter.heinsbroek(a)atos.net<mailto:peter.heinsbroek@atos.netm> Web www.nl.atos.net<UrlBlockedError.aspx> Atos IT Solutions and Services B.V. Comm. Register The Hague no. 27380688 This e-mail is intended exclusively for the addressee(s), and may not be forwarded or made available for use to any person other than the addressee(s). If you are not the intended recipient, please notify the sender thereof and destroy/delete the message. The sender disclaims any liability as regards (the content of) this e-mail. This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, Atos’ liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted. On all offers and agreements under which Atos Nederland B.V. supplies goods and/or services of whatever nature, the Terms of Delivery from Atos Nederland B.V. exclusively apply. The Terms of Delivery shall be promptly submitted to you on your request.

1 0

Using Chrome directly as an STunnel Client to connect to an STunnel Server
by Dipen Doshi 05 Oct '17

05 Oct '17

Hello, I am new to STunnel and I am running into a problem. Here is my setup. I use an ASUS router with Merlin firmware. I have STunnel installed via Entware on this router. Running "stunnel -version" gives me: stunnel 5.41 on mipsel-openwrt-linux-gnu platform Compiled/running with OpenSSL 1.0.2k 26 Jan 2017 Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Global options: RNDbytes = 64 RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = HIGH:!DH:!aNULL:!SSLv2 (with "fips = no") curve = prime256v1 debug = daemon.notice logId = sequential options = NO_SSLv2 options = NO_SSLv3 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none ------------------------------------------------------------------------------------------- I use my own server certificate signed by my own CA. This cert has the proper SANs with correct DNS/IP entries. I use this server certificate both for my router's HTTPS web gui and for the "cert" and "key" files listed in the config file below. Also, the "CAfile" in the config is pointing to my Root CA's certificate. My Root CA is also imported in my Windows box's certificate store. I can directly access my router's web gui from LAN side via these ports: 80 (HTTP), 2000 (HTTPS). Router's LAN subnet is 10.49.49.0/24 and the router's WAN IP is 10.76.5.3 (it is double NAT for testing, this router is for testing) Also, STunnel is running as a server accepting connections on port 443 (all interfaces) on the router. ------------------------------------------------------------------------------------------- I want to use Chrome directly as an STunnel client on my Windows box. So, I don't run STunnel on my Windows box in the client mode. SITUATION 1: WORKS FINE!! -- PURPOSE: Use Chrome to connect to "https://WAN_IP:443" This should forward to the router's port 80 (HTTP protocol used). My STunnel config file on the router has: setuid = nobody setgid = nobody foreground foreground = yes syslog = yes debug = 7 [Test-Service] accept = 443 connect = 10.49.49.1:80 requireCert = yes verifyChain = yes CAfile = /mnt/Merlin/entware/etc/stunnel/ca.crt cert = /mnt/Merlin/entware/etc/stunnel/server.crt key = /mnt/Merlin/entware/etc/stunnel/server.key SITUATION 2: DOES NOT WORK!! -- PURPOSE: Use Chrome to connect to "https://WAN_IP:443" This should forward to the router's port 2000 (HTTPS protocol used). There is only one change from the Situation 1 config file. The line for "connect" changed to "connect = 10.49.49.1:2000) This does not work. Note that I can directly access my router's web gui over https with "https://LAN_IP:2000" via Chrome, with no warnings. ------------------------------------------------------------------------------ My thoughts: So, my current path is Chrome (Acting as STunnel Client) --> STunnel Server (on the router) --> Router's Web GUI. The "Chrome --> STunnel" Server connection is fine. Chrome prompts for private key and STunnel server correctly shows this incoming Chrome connection. The problem is the "STunnel Server --> Router" relay that uses HTTPS protocol. 1. STunnel does not like HTTPS to HTTPS relay. HTTP to HTTPS works, but not HTTPS to HTTPS. 2. STunnel server on my router is a client to my router's web gui. Is STunnel verifying the certificate of my router's HTTPS certificate? 3. If the above answer is yes, my guess is that STunnel sees a self signed certificate for this router and kills the connection? 4. How do I tell STunnel server to ignore certificate warnings for a remote connection, like when connecting to this router? 5. Or how do I explicitly tell STunnel to trust my Root CA while making this connection to my router? I couldn't find any options in STunnel for this. Regards, Dipen Doshi

2 3

Missing librairies
by Heinsbroek, Peter 26 Sep '17

26 Sep '17

I’m getting unresolved external symbol errors. I like to know what library I need for s_log. log.obj : error LNK2019: unresolved external symbol _stunnel_process_id referenced in function _log_id log.obj : error LNK2019: unresolved external symbol _stunnel_thread_id referenced in function _log_id log.obj : error LNK2019: unresolved external symbol _file_open referenced in function _log_open log.obj : error LNK2019: unresolved external symbol _file_close referenced in function _log_close log.obj : error LNK2019: unresolved external symbol _file_putline referenced in function _log_raw log.obj : error LNK2019: unresolved external symbol _tls_alloc referenced in function _s_log str.obj : error LNK2001: unresolved external symbol _tls_alloc log.obj : error LNK2019: unresolved external symbol _tls_get referenced in function _s_log str.obj : error LNK2001: unresolved external symbol _tls_get log.obj : error LNK2019: unresolved external symbol _ui_new_log referenced in function _log_raw log.obj : error LNK2019: unresolved external symbol _message_box referenced in function _fatal_debug log.obj : error LNK2019: unresolved external symbol _global_options referenced in function _log_open log.obj : error LNK2019: unresolved external symbol _stunnel_locks referenced in function _log_close str.obj : error LNK2001: unresolved external symbol _stunnel_locks str.obj : error LNK2019: unresolved external symbol _num_clients referenced in function _leak_threshold str.obj : error LNK2019: unresolved external symbol _number_of_sections referenced in function _str_leak_debug str.obj : error LNK2019: unresolved external symbol _tls_initialized referenced in function _str_stats __________________ With regards Peter Heinsbroek Tel. +31 (0)88 265 9869 This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, Atos’ liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted. On all offers and agreements under which Atos Nederland B.V. supplies goods and/or services of whatever nature, the Terms of Delivery from Atos Nederland B.V. exclusively apply. The Terms of Delivery shall be promptly submitted to you on your request.

1 0

Bug: Modifying configure.ac results in error
by Reschke, Sven (VWIF G-TS/P) 22 Sep '17

22 Sep '17

Hallo, I've encounter a problem when editing the configure.ac. I've upgraded to Stunnel 5.42, the problem wasn't existent with Stunnel 5.41. The normal operation is that "./configure" and "make" will run without an error. So far, so good. Now, if I edit the configure.ac, running again "./configure" and "make", "make" will report: CDPATH="${ZSH_VERSION+.}:" && cd . && /bin/sh <path_to_stunnel_sources>/stunnel-5.42 /auto/missing aclocal-1.14 -I m4 cd . && /bin/sh <path_to_stunnel_sources>/stunnel-5.42 /auto/missing automake-1.14 --gnu CDPATH="${ZSH_VERSION+.}:" && cd . && /bin/sh <path_to_stunnel_sources>/stunnel-5.42 /auto/missing autoconf configure.ac:4: error: possibly undefined macro: AC_MSG_NOTICE If this token and others are legitimate, please use m4_pattern_allow. See the Autoconf documentation. configure.ac:23: error: possibly undefined macro: AC_DEFINE make: *** [configure] Error 1 Here it doesn't matter what I change in configure.ac. Even the slightest modification results in the error. After some investigation, running "make" with "-d" showed that it will call auto/missing, because of the newer version of configure.ac. Comparing aclocal.m4 before and after calling "make" shows, that mainly the lines added between the version 5.41 and 5.42 are missing now (lines #23 - #741). As I'm not so familiar with the whole compile process, I found a simple hack, which solves the problem for the moment: Adding these missing lines to a new file named m4/acinclude.m4. After that, compiling, installing and running Stunnel works fine. Can someone verify? If you have questions, I'll try my best to answer them :) Best Regards, Sven Reschke Embedded System SW Developer G-TS/P

1 0

Help with connectivity issue
by Rob Allen 15 Sep '17

15 Sep '17

I’ve installed stunnel on an Amazon EC2 instance: stunnel 4.56 on x86_64-redhat-linux-gnu platform Compiled/running with OpenSSL 1.0.1e-fips 11 Feb 2013 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Auth:LIBWRAP Global options: debug = daemon.notice pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = ALL:!SSLv2:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH (with "fips = no") curve = prime256v1 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds sslVersion = TLSv1 (with "fips = yes") sslVersion = TLSv1 for client, all for server (with "fips = no") stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none I’ve created the stunnel.conf file: [smtp-tls-wrapper] accept = 2525 client = yes connect = email-smtp.us-west-2.amazonaws.com:465 protocol=smtp delay = yes I’ve tested the connection to SES (successfully) via openssl: [ec2-user@ip-172-31-4-68 ~]$ openssl s_client -quiet -crlf -connect email-smtp.us-west-2.amazonaws.com:465 depth=2 C = US, O = "VeriSign, Inc.", OU = VeriSign Trust Network, OU = "(c) 2006 VeriSign, Inc. - For authorized use only", CN = VeriSign Class 3 Public Primary Certification Authority - G5 verify return:1 depth=1 C = US, O = Symantec Corporation, OU = Symantec Trust Network, CN = Symantec Class 3 Secure Server CA - G4 verify return:1 depth=0 C = US, ST = Washington, L = Seattle, O = "Amazon.com, Inc.", CN = email-smtp.us-west-2.amazonaws.com verify return:1 220 email-smtp.amazonaws.com ESMTP SimpleEmailService-2370111491 wa7VtNk9b7c4TX0jNpdG But when I try to access through stunnel via localhost with telnet, I get this: [ec2-user@ip-172-31-4-68 ~]$ telnet localhost 2525 Trying ::1... telnet: connect to address ::1: Connection refused Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Connection closed by foreign host. I’ve tried everything I can think of; I’ve read all the blogs and pages related to connecting from ec2 to SES via stunnel and I just can’t get it to work. Does anyone have any suggestions for other things I could try? Thanks in advance, Rob Allen, CPO Software Engineer | Eyefinity NOTICE: This message is intended only for the individual to whom it is addressed and may contain information that is confidential or privileged. If you are not the intended recipient, or the employee or person responsible for delivering it to the intended recipient, you are hereby notified that any dissemination, distribution, copying or use is strictly prohibited. If you have received this communication in error, please notify the sender and destroy or delete this communication immediately.

2 2

Stunnel Config Error
by Jay Jenney 21 Aug '17

21 Aug '17

Trying to see why Stunnel like this config file (attached) for an office365 email account [cid:image001.jpg@01D31A6F.5FD0FC60] Harriscomputer Register today<http://www.harriscomputer.com/en/conference/> for HCTC2017 - Early Bird deadline is August 31! Jay Jenney Support Specialist P: 800-274-2911 x64272 F: E: jjenney(a)caliberpublicsafety.com [cid:Caliber_PS_left_CMYK_247aef3c-9961-4e6c-a9f4-053e52f0093f.jpg] , Iowa www.caliberpublicsafety.com<http://www.caliberpublicsafety.com> This message has been sent on behalf of a company that is part of the Harris Operating Group of Constellation Software Inc. These companies are listed at the following link: http://subscribe.harriscomputer.com Unsubscribe Option: If you do not wish to receive any future email, please unsubscribe by clicking on the following link:http://subscribe.harriscomputer.com This message is intended exclusively for the individual or entity to which it is addressed. This communication may contain information that is proprietary, privileged or confidential or otherwise legally exempt from disclosure. If you are not the named addressee, you are not authorized to read, print, retain, copy or disseminate this message or any part of it. If you have received this message in error, please notify the sender immediately by e-mail and delete all copies of the message.

1 0

stunnel w & w/o data compression
by Daniele Basaldella 18 Aug '17

18 Aug '17

Dear all, I use stunnel in clinet configuration to get data feeds from several sources. Until now none of them requested data compression, so the configuration was easy. Now I need to connect to a new data feeder that requires zlib compression. I found the compression method is a global setting, so it will be not compatible with current setup. The server runs Ubuntu 16.04LTS, ker 4.4.0.92.lowlatency, stunnel 5.30, openssl 1.0.2.g. I looked for a solution on internet but seems no one have my issue. Someone could suggest how to get both compressed/uncompressed data feed connections on same system. Thank you Best Regards Daniele

2 1

Timeout issue I think
by Ben Bazian 16 Aug '17

16 Aug '17

I have a legacy server that uses IMAP but does not support TLS. I am using stunnel and since implementation I am getting errors when an email has a larger attachment. My application process these attachments and when done (sometimes can take 5-10 minutes) it marks the message for deletion. When all messages are completed it purges the emails from the box. My app is throwing an error when it tries to delete the message (see below). I think it may be due to stunnel closing the connection to the server? Not quite sure. javax.mail.FolderClosedException at com.sun.mail.imap.IMAPMessage.getProtocol(IMAPMessage.java:105) at com.sun.mail.imap.IMAPMessage.loadEnvelope(IMAPMessage.java:941) at com.sun.mail.imap.IMAPMessage.getSubject(IMAPMessage.java:238) at com.softlinx.docurouter.source.email.EmailSourceConnector.processMess ages(EmailSourceConnector.java:1213) at com.softlinx.docurouter.source.email.EmailSourceConnector.process(Ema ilSourceConnector.java:1455) at com.softlinx.docurouter.source.email.EmailSourceConnector.main(EmailS ourceConnector.java:1622) My configuration is pretty simple. I saw somewhere that I could put a timeoutidle on the connector but that does not seem to help. Any ideas are appreciated. Here is the config. # Stunnel configuration file for Office 365 SMTP and POP3 # Author: MessageOps, www.messageops.com<http://www.messageops.com> # GLOBAL OPTIONS client = yes output = /etc/stunnel/stunnel-log.txt debug=3 # taskbar=yes # SERVICE-LEVEL OPTIONS [POP3 Incoming] accept = 110 connect = outlook.office365.com:995 timeoutidle = 14400 [SMTP Outgoing] protocol = smtp accept = 25 connect = outlook.office365.com:587 [IMAP] accept = 143 connect = outlook.office365.com:993 timeoutidle = 14400 Here is a printout of the global options. Global options: debug = daemon.notice pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = ALL:!SSLv2:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH (with "fips = no") curve = prime256v1 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds sslVersion = TLSv1 (with "fips = yes") sslVersion = TLSv1 for client, all for server (with "fips = no") stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none -Ben

1 0

logging real client IP in Apache
by Stoyan Stoyanov 07 Jul '17

07 Jul '17

I have an Apache server serving only HTTP requests on port 80 and an stunnel daemon on the same server listening on port 443 and tunneling HTTPS requests to Apache. Is there a way for the client IP to be passed on to Apache so that I can capture and log that instead of the IP of stunnel, which in this case is 127.0.0.1? Ability to add a variable to the HTTP header would be perfect, but any other suggestions to solve this problem are welcome. Thanks! Stoyan

2 2

Error on startup of Stunnel
by Shelstone Lorde 30 Jun '17

30 Jun '17

I installed version 5.41, the latest version, on a Windows 10 Pro machine. I placed a link to the Stunnel.exe file in the Startup folder. I am getting the error "The ordinal 3253 could not be located in the dynamic link library c:\Users\...Programs\Startup\stunnel.exe". May be there has been a previous posting concerning this error but I have not been able to find it. Any help or suggestion will be appreciated. Thanks.

1 0

Re: [stunnel-users] Stunnel Connectivity Issue
by Ludolf Holzheid 13 Jun '17

13 Jun '17

On Tue, 2017-06-13 22:51:27 +0530, Dheeraj Gautam wrote: > Hi Browne, > > > > I am not understand like what config I have to do in stunnel config file. > > > > As per application it will trigger 8228 port of remote server, but at the momen stunnel is working only when I am trying to telnet localhost on 9233 port. > Dheeraj, I'm afraid you confused the directions: In you configuration file, you told Stunnel to accept connections on localhost, port 9233 ("accept = 127.0.0.1:9233"). Then, you told Stunnel, if such a connection is accepted, to connect to a remote server at port 8228 ("connect = 69.191.198.34:8228"). As long as both connections are established, Stunnel will forward data from localhost to 69.191.198.34 and vice versa, while encrypting the data in the localhost -> 69.191.198.34 direction and decrypting the data in the opposite direction (69.191.198.34 -> localhost). With this setup, a client program (such as Thunderbird) sends and receives plain-text data to/from a Stunnel instance on the same machine, while a server program on a remote machine (such as the Google mail server) sends and receives encrypted data to/from Stunnel. Is this about the setup you have in mind? Is your application server or client? Does it send and receive plain-text data or encrypted data? Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:lholzheid@bihl-wiedemann.de http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

1 0

Configuring stunnel and openssl on Windows to support TLS 1.2
by Liz Turi 13 Jun '17

13 Jun '17

Good morning, I'm hoping you can help point me in the right direction. The problem I'm trying to solve is enabling TLS 1.2 connections on a Windows (environment has both Windows 2008 and Windows 10 environments) platform. Currently, my private keys are managed by the Windows certificate store, using the capi engineId within stunnel (v 5.41), which uses OpenSSL 1.0.1. Because of this, stunnel can only negotiate a TLS 1.1 connection. I've tried compiling OpenSSL 1.1.0f and stunnel 5.41, but no luck either cross compiling under CentOS, nor under Windows using either MSYS2/MINGW32 or Cygwin. What I'm looking for is any one of the following 1) solid current cross-compiling examples or references 2) solid current Windows compiling examples or references using extant versions 3) a way to manage the pfx/p12 (private key) in stunnel without resorting to the Windows certificate store. Option 3 is preferred. I see how to manage pkcs11, but not pkcs12. Thank you in advance! Liz Turi Sr. Consultant Massachusetts eHealth Collaborative 860 Winter Street, Waltham, MA 02451 (m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589 www.maehc.org<http://www.maehc.org> [fb_icon]<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[li_icon]<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=ty…>[tw_icon]<https://twitter.com/MAeHC_org> CONFIDENTIALITY NOTICE The information contained in this email transmission is legally privileged and confidential information intended only for the use of the addressee named above. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution or copying of this email transmission is strictly prohibited. If you have received this email transmission in error, please notify us immediately. Thank you.

1 1

Memleak sTunnel Win32 5.41 ?
by Dod 12 Jun '17

12 Jun '17

Hello, I just noticed that stunnel memory usage is growing slowly but surely using 5.41 on Win7 64 Bits. Using a few POP3 SSL tunnels. Now it is using 290MB memory I don't know if it is since 5.41 (didn't pay attention). Is there a way to trace/log something that could be useful ? (apart from the process memory usage curve that I guess will not help). regards.

1 0

TLS-SRP patch
by Kevin Sheldrake 06 Jun '17

06 Jun '17

Hello I recently produced a patch that permits use of TLS-SRP; it is based on the TLS-PSK code and this blog post: https://matthewarcus.wordpress.com/2014/05/10/srp-in-openssl/ It’s not the cleanest of code but it does work as a POC. The patch is available here: https://github.com/rtfcode/tls-srp The README.txt provides some info on testing the patch and how it might be used to help dev web browsers and servers that support TLS-SRP (for IoT work). There is a page on the forthcoming OWASP Summit ‘TLS for Local IoT’ workshop (for which it was developed) at: https://owaspsummit.org/Working-Sessions/IoT/TLS-for-Local-IoT.html In terms of using TLS-SRP support in stunnel as a proxy, it might be useful as a replacement for TLS-PSK where the credentials are user-memorable (pass phrase, for example) as TLS-SRP has lower entropy requirements than TLS-PSK. For example, the creds could be stored in the user’s head rather than in a file and be less open to compromise if a device was seized. I don’t know if that’s useful for anyone; it’s just a thought. Thanks Kev

1 0

Connect to sub-directory path
by Shamim Uz Zaman 25 May '17

25 May '17

Hi Looking for an example to connect to subdirectory path such that [connect] client = yes accept = 127.0.0.1:441 connect = xxx.website.com:443/Connect/topath verifyChain = yes verifyPeer=yes CAfile = ca-certs.pem checkHost = xxx.mywebsite.com OCSPaia = yes When I only use xxx.mywebsite.com:443 it works. However, below three url gives TCP error (Unknown TCP service) xxx.mywebsite.com:443/Connect/topath xxx.mywebsite.com/Connect/topath https://xxx.mywebsite.com/Connect/topath My proxy connection requires to translate to the directory path of the domain. Regards, *Shamim Zaman*

2 1

Stunnel Connectivity Issue
by Dheeraj Gautam 24 May '17

24 May '17

Hi Team, We are using 5.41 release of Stunnel software to establish TCP connection with remote server using by TLSV1.2 protocol. Enclosed configuration file wherein we are trying to establish TCP connection with one my server along with provided certificate and key which are pointed in config file. Could you please let us know what parameters we are missing here due to which connection is not establishing with remote server. Although, stunnel logs indicating that configuration successful, but in logs no where is mentioned about the connection is it connected or not, below is the artifact for your easy ref. Could you please help us here to resolve this issue. Regards, Dheeraj Gautam -- www.arborfs.com This e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged. It is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system. If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail. Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses. We would advise that you carry out your own virus checks, especially before opening an attachment.

1 0

Stunnel on Suse 8.1, connections refused, pid remains
by InvalidPath 09 May '17

09 May '17

So I have this server, I can start stunnel via /etc/rc.d/stunnel start. The pid is there as witnessed by ps -aux | grep stunnel, I have 4 customers that access this server. The customers pull data files that contain certain client records. Anyway my test user connects to the server and is able to pull a handful of files before their process begins timing out. When this happens I can no longer SSH to the host without restarting stunnel. Weird thing is, is that I can see the pid still running when this happens. I have the debug = 7 but the log files according to stunnel - version is set to a level of 5. No clue where it''s getting a 5 from. But I am unable to determine why or what is causing this. And it's starting to cost the company lost revenue. Any help would be greatly appreciated. Ben

1 0

Graceful config reload when -fd option was used
by z a 09 May '17

09 May '17

Hi, Since version 4.30, sending a HUP signal to a running stunnel process will cause it to gracefully reload with the given config file. Is there a way to accomplish this when the running stunnel process was started with the "-fd" flag as in the example below? cat foo.conf | stunnel-fd 0 I tried writing to /proc/$pid/fd/0 but that didn't work. I'm hoping someone here has overcome this issue and might be able to whisper a hint in my direction. I am on Centos 7.2. Thanks

1 0

Trouble with stunnel.conf (version 5.41)
by Mark Garciano 02 May '17

02 May '17

Hi Stunnel users, Any ideas why I get a "server down" message"? Below is the conf file: ;--------------------------------------------------------------------------- ; ************************************************************************** ; * Global options * ; ************************************************************************** ; ; Debugging stuff (may useful for troubleshooting) debug = 7 output = stunnel.log ;Disable FIPS mode to allow non-approved protocols and algorithms fips = no ;************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 key = stunnel.pem cert = stunnel.pem client = yes accept = 5001 connect = XXXXXXXXXXX.com:6443 TIMEOUTclose = 0 TIMEOUTconnect = 200 TIMEOUTidle = 86400 ;--------------------------------------------------------------------------- HERE IS THE LOG WINDOW MESSAGE: [!] Server is down [ ] Running on Windows 6.1 [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark detected [.] FIPS mode disabled [ ] Compression disabled [ ] Snagged 64 random bytes from C:/.rnd [ ] Wrote 1024 new random bytes to C:/.rnd [ ] PRNG seeded successfully [ ] Initializing inetd mode configuration [!] Service [(null)]: 'accept' option is only allowed in a [section] Mark Garciano Systems Programmer II USC Libraries Integrated Library Systems 213-740-3568

2 1

Re: [stunnel-users] Help in setting stunnel in client mode to connect webservice in mutual authentication
by Chokkalingam, Jothish 28 Apr '17

28 Apr '17

Hi Can you help in sorting it out below scenario We have a URL whose TLS is 1.0 and now it is being upgraded to 1.2. Since the current application doesn't support V1.0 I am planning to use stunnel in between to fix the gap. Can you help if my below config is correct or not. The communication between client and server is MASSL(mutual authentication SSL) [Billpay46200] client = yes CApath = /apps/bss/CCBTrustStore-->trust store where the remote webservice certificates are stored in cert format accept = 46200-->port configured from client machine to connect using http connect = xxx.in.xxx.com.au:46200-->port where the incoming http request need to be changed from http to https cert = /stunnel/bin/client.pem-->identity certificate used for client key = /stunnel/bin/key.pem-->corresponding key for the above identity certificate. While hitting using the URL http://localhost:46200 it is shown in stunnel log as below 2017.04.28 17:17:51 LOG5[2627:3]: Billpay46200 accepted connection from 127.0.0.1:58382 2017.04.28 17:17:51 LOG5[2627:3]: Billpay46200 connected remote server from 10.116.194.24:58383 2017.04.28 17:17:51 LOG3[2627:3]: SSL_connect: Peer suddenly disconnected 2017.04.28 17:17:51 LOG5[2627:3]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Thanks and Regards, Jothish TIBCO TSD Ph. : +91 44 39263958 Mobile : +91 9884040171 Support : +91 9962007110 OC : jothish.chokkalingam Group mail:- Telstra.psm.tsd.tibco(a)accenture.com ________________________________ This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. ______________________________________________________________________________________ www.accenture.com

1 0

Remove session callback
by Florian Gossin 19 Apr '17

19 Apr '17

Hi, I have updated to the latest 5.41 version. I was troubleshooting another problem and I discovered dozens of lines in the log file with "Remove session callback, Deallocating application specific data for session connect address": 2017.04.19 14:49:49 LOG7[17483]: Service [pgbouncer-client] started 2017.04.19 14:49:49 LOG7[17483]: Option TCP_NODELAY set on local socket 2017.04.19 14:49:49 LOG5[17483]: Service [pgbouncer-client] accepted connection from x.x.x.x:36018 2017.04.19 14:49:49 LOG6[17483]: Peer certificate required 2017.04.19 14:49:49 LOG7[17483]: TLS state (accept): before/accept initialization 2017.04.19 14:49:49 LOG7[17483]: SNI: no virtual services defined 2017.04.19 14:49:49 LOG7[17483]: TLS state (accept): SSLv3 read client hello A 2017.04.19 14:49:49 LOG7[17483]: TLS state (accept): SSLv3 write server hello A 2017.04.19 14:49:49 LOG7[17483]: TLS state (accept): SSLv3 write change cipher spec A 2017.04.19 14:49:49 LOG7[17483]: TLS state (accept): SSLv3 write finished A 2017.04.19 14:49:49 LOG7[17483]: TLS state (accept): SSLv3 flush data 2017.04.19 14:49:49 LOG7[17483]: TLS state (accept): SSLv3 read finished A 2017.04.19 14:49:49 LOG7[17483]: Remove session callback 2017.04.19 14:49:49 LOG7[17483]: Deallocating application specific data for session connect address 2017.04.19 14:49:49 LOG7[17483]: Remove session callback 2017.04.19 14:49:49 LOG7[17483]: Deallocating application specific data for session connect address ... Can anyone explain me what it is about ? Thank you, Florian

1 0

Windows Server 2012 stunnel service
by Adam Shackleton 18 Apr '17

18 Apr '17

Hi All I'm running stunnel on Windows Server 2012 R2 with the following config: [test-qa] client = yes accept = 127.0.0.1:8080 connect = webaddress.com:443 cert = API-q-response.pfx CAfile = ca-certs.pem OCSPaia = yes When I start the GUI I'm prompted for the certificate password then and then stunnel works fine, but I need it to run as a service. I've tried using the start menu stunnel Service Install button, I've also tried opening a command prompt in C:\Program Files (x86)\stunnel\config and running C:\Program Files (x86)\stunnel\bin\stunnel.exe -install, and I've also tried moving the config file and certs to the \bin directory and running stunnel -install there as well. In all case the service installs ok, and when you run it, it starts (I can see it in the services tool), you can click the stunnel Configuration File Reload button in the start menu and it says the configuration was successfully reloaded, but it doesn't work when I try to use it. I've noticed two things that might be relevant: 1. At no point does it prompt me for the certificate password like it does when I load the GUI 2. The dialog boxes that open when the service is installed or started say "stunnel 5.40 on Win32 (not configured) [cid:image001.png@01D2B81E.BD3E6BC0] If anyone has any advice that would be greatly appreciated. Thanks Adam

2 1

SOCKS connection to the IPv4 loopback rejected.
by Robert de Bath 15 Apr '17

15 Apr '17

Hi everyone, How do I get rid of this message? I have a stunnel server setup on a remote machine using the socks protocol. I use two keys plus the certificates and a private CA to protect the SSL link. On a local machine I have an stunnel client running without a protocol option set. If I try to make a socks connection to an interface IP of the remote server it works perfectly, bypassing the intervening firewalls through the protected tunnel. But the interface IP changes and I only want to allow connections to the remote server through the tunnel. I could setup traditional tunnels, but while one of the services (remote desktop to the Windows server) is constant the others are dynamically configurable. I have even considered using SNI to distinguish the incoming connections to the various services but while this allows there to be just one tunnel port it will still need a remote reconfiguration of stunnel every time a service port is added or removed. The best way to express this limit is that the socks server should ONLY connect to localhost; but it's "rejected". In actual operation I will probably need to allow the local network too which will probably be an rfc1597 address. Looking at the source it appears that this condition is hard coded into the "validate" function so my question becomes: can you please remove this or add a flag to turn it off? -- Robert de Bath robert(a)tvisiontech.co.uk

1 0

Configure Error
by Kenway Ng 12 Apr '17

12 Apr '17

Hi I am running into an issue when I go into the src directory and I run the configure command, I get configure: error: Could not find your TLS library installation dir Use --with-ssl option to fix this problem I am trying to upgrade our version of stunnel. Our SME left and now I am trying to upgrade stunnel to fix a vulnerability . I am being told to use TLS1.1 or higher Here is our current version of stunnel $ ./stunnel -version stunnel 4.15 on x86_64-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Any help would be appreciated. Kenway

1 0

PSK, verifying the client
by Mike 05 Apr '17

05 Apr '17

Is it possible to verify the client using PSK? On the stunnel server I specify a PSKsecrets file with two lines in it, one for client01 and one for client02. The secret is about 36 characters long. On a client, I have a similar PSKsecrets file, but only containing the client01 line. Now, if I try to connect with, say, a client03, i.e., any client that does not have a matching line in the server's PSKsecrets file, how can I assure that the client connection will be rejected? What I'd like to see would be the following: any client that tries to connect, and does not present a PSK that is present in the server's PSKsecrets file, then that client's connection request is rejected, with an appropriate message logged. Can I do that with the current stunnel? thx.

1 0

Scan to email failure: RapbianPi3 to Office365
by Graeme Ellisson 03 Apr '17

03 Apr '17

Hi. I recently bought a Pi3 and have loaded Raspbian with Doobs (Previously I had this running faultlessly under a Windows Server for my Canon multi function printer that does not support SSL/TLS but only authentication). After about 8 attempts to get Stunnel4 working (there doesn't seem to be a later version to install via the command line) I eventually found that Stunnel4 works fine as long as one doesn't update Dabian from the initial Doobs install. So, I now have the service running and listening on port 25 with the following config file: debug=7 output=/etc/stunnel/stunnel.log client=yes options=NO_SSLv2 (I added this last night after reading a blog) [SMTP OUT] sslVersion=TLSv1 (I added this last night after reading a blog) protocol=smtp accept=25 connect=smtp.office365.com:587 On restarting the service I see the following which looks okay to my untrained eye: 2017.04.03 09:42:09 LOG7[3570]: Dispatching signals from the signal pipe 2017.04.03 09:42:09 LOG7[3570]: Processing SIGNAL_TERMINATE 2017.04.03 09:42:09 LOG5[3570]: Terminated 2017.04.03 09:42:09 LOG7[3570]: Closing service [SMTP OUT] 2017.04.03 09:42:09 LOG7[3570]: Service [SMTP OUT] closed (FD=7) 2017.04.03 09:42:09 LOG7[3570]: Service [SMTP OUT] closed 2017.04.03 09:42:09 LOG7[3570]: removing pid file /var/run/stunnel4.pid 2017.04.03 09:42:09 LOG7[3926]: Clients allowed=500 2017.04.03 09:42:09 LOG5[3926]: stunnel 5.06 on arm-unknown-linux-gnueabihf platform 2017.04.03 09:42:09 LOG5[3926]: Compiled with OpenSSL 1.0.1k 8 Jan 2015 2017.04.03 09:42:09 LOG5[3926]: Running with OpenSSL 1.0.1t 3 May 2016 2017.04.03 09:42:09 LOG5[3926]: Update OpenSSL shared libraries or rebuild stunnel 2017.04.03 09:42:09 LOG5[3926]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD SSL:ENGINE,OCSP,FIPS Auth:LIB$ 2017.04.03 09:42:09 LOG7[3926]: errno: (*__errno_location ()) 2017.04.03 09:42:09 LOG5[3926]: Reading configuration from file /etc/stunnel/stunnel4.conf 2017.04.03 09:42:09 LOG5[3926]: FIPS mode disabled 2017.04.03 09:42:09 LOG7[3926]: Compression disabled 2017.04.03 09:42:09 LOG7[3926]: Snagged 64 random bytes from /dev/urandom 2017.04.03 09:42:09 LOG7[3926]: PRNG seeded successfully 2017.04.03 09:42:09 LOG6[3926]: Initializing service [SMTP OUT] 2017.04.03 09:42:09 LOG7[3926]: No private key specified 2017.04.03 09:42:09 LOG7[3926]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2017.04.03 09:42:09 LOG5[3926]: Configuration successful 2017.04.03 09:42:09 LOG7[3926]: Listening file descriptor created (FD=7) 2017.04.03 09:42:09 LOG7[3926]: Service [SMTP OUT] (FD=7) bound to 0.0.0.0:25 2017.04.03 09:42:09 LOG7[3927]: Created pid file /var/run/stunnel4.pid When sending a scan from the printer to an email address I see the following in the log file: 2017.04.03 10:00:05 LOG7[3927]: Service [SMTP OUT] accepted (FD=3) from 192.168.8.99:1085 2017.04.03 10:00:05 LOG7[3960]: Service [SMTP OUT] started 2017.04.03 10:00:05 LOG5[3960]: Service [SMTP OUT] accepted connection from 192.168.8.99:1085 2017.04.03 10:00:05 LOG6[3960]: s_connect: connecting 40.101.73.162:587 2017.04.03 10:00:05 LOG7[3960]: s_connect: s_poll_wait 40.101.73.162:587: waiting 10 seconds 2017.04.03 10:00:05 LOG5[3960]: s_connect: connected 40.101.73.162:587 2017.04.03 10:00:05 LOG5[3960]: Service [SMTP OUT] connected remote server from 192.168.8.33:59792 2017.04.03 10:00:05 LOG7[3960]: Remote socket (FD=9) initialized 2017.04.03 10:00:05 LOG7[3960]: <- 220 DB6PR07CA0179.outlook.office365.com Microsoft ESMTP MAIL Service $ 2017.04.03 10:00:05 LOG7[3960]: -> 220 DB6PR07CA0179.outlook.office365.com Microsoft ESMTP MAIL Service $ 2017.04.03 10:00:05 LOG7[3960]: -> EHLO localhost 2017.04.03 10:00:05 LOG7[3960]: <- 250-DB6PR07CA0179.outlook.office365.com Hello [46.208.253.189] 2017.04.03 10:00:05 LOG7[3960]: <- 250-SIZE 157286400 2017.04.03 10:00:05 LOG7[3960]: <- 250-PIPELINING 2017.04.03 10:00:05 LOG7[3960]: <- 250-DSN 2017.04.03 10:00:05 LOG7[3960]: <- 250-ENHANCEDSTATUSCODES 2017.04.03 10:00:05 LOG7[3960]: <- 250-STARTTLS 2017.04.03 10:00:05 LOG7[3960]: <- 250-8BITMIME 2017.04.03 10:00:05 LOG7[3960]: <- 250-BINARYMIME 2017.04.03 10:00:05 LOG7[3960]: <- 250-CHUNKING 2017.04.03 10:00:05 LOG7[3960]: <- 250 SMTPUTF8 2017.04.03 10:00:05 LOG7[3960]: -> STARTTLS 2017.04.03 10:00:05 LOG7[3960]: <- 220 2.0.0 SMTP server ready 2017.04.03 10:00:05 LOG6[3960]: SNI: sending servername: outlook.office365.com 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): before/connect initialization 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: 0 items in the session cache 2017.04.03 10:00:05 LOG7[3960]: 2 client connects (SSL_connect()) 2017.04.03 10:00:05 LOG7[3960]: 2 client connects that finished 2017.04.03 10:00:05 LOG7[3960]: 0 client renegotiations requested 2017.04.03 10:00:05 LOG7[3960]: 0 server connects (SSL_accept()) 2017.04.03 10:00:05 LOG7[3960]: 0 server connects that finished 2017.04.03 10:00:05 LOG7[3960]: 0 server renegotiations requested 2017.04.03 10:00:05 LOG7[3960]: 0 session cache hits 2017.04.03 10:00:05 LOG7[3960]: 0 external session cache hits 2017.04.03 10:00:05 LOG7[3960]: 0 session cache misses 2017.04.03 10:00:05 LOG7[3960]: 0 session cache timeouts 2017.04.03 10:00:05 LOG6[3960]: SSL connected: new session negotiated 2017.04.03 10:00:05 LOG6[3960]: Negotiated TLSv1 ciphersuite ECDHE-RSA-AES128-SHA (128-bit encryption) 2017.04.03 10:00:05 LOG6[3960]: Compression: null, expansion: null 2017.04.03 10:00:10 LOG6[3960]: SSL socket closed (SSL_read) 2017.04.03 10:00:10 LOG7[3960]: Sent socket write shutdown 2017.04.03 10:00:10 LOG5[3960]: Connection closed: 23 byte(s) sent to SSL, 79 byte(s) sent to socket 2017.04.03 10:00:10 LOG7[3960]: Remote socket (FD=9) closed 2017.04.03 10:00:10 LOG7[3960]: Local socket (FD=3) closed 2017.04.03 10:00:10 LOG7[3960]: Service [SMTP OUT] finished (0 left) 2017.04.03 10:00:20 LOG7[3927]: Service [SMTP OUT] accepted (FD=3) from 192.168.8.99:1086 2017.04.03 10:00:20 LOG7[3961]: Service [SMTP OUT] started 2017.04.03 10:00:20 LOG5[3961]: Service [SMTP OUT] accepted connection from 192.168.8.99:1086 2017.04.03 10:00:20 LOG6[3961]: s_connect: connecting 40.101.72.194:587 2017.04.03 10:00:20 LOG7[3961]: s_connect: s_poll_wait 40.101.72.194:587: waiting 10 seconds 2017.04.03 10:00:20 LOG5[3961]: s_connect: connected 40.101.72.194:587 2017.04.03 10:00:20 LOG5[3961]: Service [SMTP OUT] connected remote serve from 192.168.8.33:57422 2017.04.03 10:00:20 LOG7[3961]: Remote socket (FD=9) initialized 2017.04.03 10:00:21 LOG7[3961]: <- 220 DB6PR07CA0014.outlook.office365.com Microsoft ESMTP MAIL Service $ 2017.04.03 10:00:21 LOG7[3961]: -> 220 DB6PR07CA0014.outlook.office365.com Microsoft ESMTP MAIL Service $ 2017.04.03 10:00:21 LOG7[3961]: -> EHLO localhost 2017.04.03 10:00:21 LOG7[3961]: <- 250-DB6PR07CA0014.outlook.office365.com Hello [46.208.253.189] 2017.04.03 10:00:21 LOG7[3961]: <- 250-SIZE 157286400 2017.04.03 10:00:21 LOG7[3961]: <- 250-PIPELINING 2017.04.03 10:00:21 LOG7[3961]: <- 250-DSN 2017.04.03 10:00:21 LOG7[3961]: <- 250-ENHANCEDSTATUSCODES 2017.04.03 10:00:21 LOG7[3961]: <- 250-STARTTLS 2017.04.03 10:00:21 LOG7[3961]: <- 250-8BITMIME 2017.04.03 10:00:21 LOG7[3961]: <- 250-BINARYMIME 2017.04.03 10:00:21 LOG7[3961]: <- 250-CHUNKING 2017.04.03 10:00:21 LOG7[3961]: <- 250 SMTPUTF8 2017.04.03 10:00:21 LOG7[3961]: -> STARTTLS 2017.04.03 10:00:21 LOG7[3961]: <- 220 2.0.0 SMTP server ready 2017.04.03 10:00:21 LOG6[3961]: SNI: sending servername: outlook.office365.com 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): before/connect initialization 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: 0 items in the session cache 2017.04.03 10:00:21 LOG7[3961]: 3 client connects (SSL_connect()) 2017.04.03 10:00:21 LOG7[3961]: 3 client connects that finished 2017.04.03 10:00:21 LOG7[3961]: 0 client renegotiations requested 2017.04.03 10:00:21 LOG7[3961]: 0 server connects (SSL_accept()) 2017.04.03 10:00:21 LOG7[3961]: 0 server connects that finished 2017.04.03 10:00:21 LOG7[3961]: 0 server renegotiations requested 2017.04.03 10:00:21 LOG7[3961]: 0 session cache hits 2017.04.03 10:00:21 LOG7[3961]: 0 external session cache hits 2017.04.03 10:00:21 LOG7[3961]: 0 session cache misses 2017.04.03 10:00:21 LOG7[3961]: 0 session cache timeouts 2017.04.03 10:00:21 LOG6[3961]: SSL connected: new session negotiated 2017.04.03 10:00:21 LOG6[3961]: Negotiated TLSv1 ciphersuite ECDHE-RSA-AES128-SHA (128-bit encryption) 2017.04.03 10:00:21 LOG6[3961]: Compression: null, expansion: null 2017.04.03 10:00:26 LOG6[3961]: SSL socket closed (SSL_read) 2017.04.03 10:00:26 LOG7[3961]: Sent socket write shutdown 2017.04.03 10:00:26 LOG5[3961]: Connection closed: 23 byte(s) sent to SSL, 79 byte(s) sent to socket 2017.04.03 10:00:26 LOG7[3961]: Remote socket (FD=9) closed 2017.04.03 10:00:26 LOG7[3961]: Local socket (FD=3) closed 2017.04.03 10:00:26 LOG7[3961]: Service [SMTP OUT] finished (0 left) At the end of this, no email is received. I can't tell from the above if the document is not being received by Stunnel from the printer or if Stunnel can not pass the document to Office365. It looks like TLSv1 is being negotiated and some data is being sent but then it closes the connection. Any help would be much appreciated. Regards, Graeme

2 1

Stunnel Version Vulnerability-Currently using 5.04
by Tracy Drake - IQGC-C 28 Mar '17

28 Mar '17

Hello Stunnel Users Forum! I wonder if anyone may have suggestions of what, if anything can be done to surmount a reported vulnerability for Stunnel versions prior to 5.34. I have limited savvy in this arena so please excuse this "Stunnel for Dummies" question. The following statements surfaced in a "security vulnerabilities" report... The version of stunnel installed on the remote host is 4.46 or later but prior to 5.34. It is, therefore, affected by a security bypass vulnerability related to the validation of level 4 peer certificates. An unauthenticated, remote attacker can exploit this to have an impact on confidentiality, integrity, and/or availability. No other details are available. I am of the mind that perhaps an entry in Stunnel.conf until we can deploy an upgrade? Thanks in advance for any feedback! Upgrade to stunnel version 5.34 or later. -- Tracy Drake CSM Senior Consultant GSA-FAS CAMEO Contractor URSA & INFOConnect Support & Training Team Lead 704-987-1211 tracy.drake(a)gsa.gov

1 0

Multi source VPN connectivity
by Aykut SAY 24 Mar '17

24 Mar '17

Hi, We are working on a integration project and we need to connect our application to three different sources. These three sources have their own VPN. Can stunnel connect to three different vpn from one server? If yes, which version of stunnel we need to install to our server? Thanks, Aykut

1 0

stunnel public private key authentication like ssh
by Michael Power 23 Mar '17

23 Mar '17

Is there a way to configure stunnel just to check the public key of the provided certificate? I want authentication between the server and the client to take place by public key only, no PKI just like ssh. Is this possible? Is this verify level 4, or does that still check the CN against the host that I am connecting to? Michael Power

1 0

update stunnel with engine pkcs11
by Heinsbroek, Peter 20 Mar '17

20 Mar '17

Hallo, I’m a newbee in C programming. I have to upgrade stunnel 5.31 with engine_pkcs11 (0.1.8) for windows to the latest versions. (5.40 & 0.2.2) My engine_pkcs.c contains an subroutine my_get_pin (see attachment line 707) that reads a pin from a file in the windows folder. After reading it ,it transforms the pin to hexadecimal, if not already done, and writes it back in the file. After adjusting the new source it compiles without errors, but when executing it doesn’t work anymore. I also attached the old engine_pkcs11.c as we used it. Can someone help me with this problem. After compairing the old and new source I noticed that there have been major improvements to the source With regards, Peter Heinsbroek Application manager NT / SQL20xx Tel. +31 (0)88 265 9869 Mob. +31 6 5375 3244 Werner von Siemensstraat 3 2712 PN Zoetermeer, Nederland Org. unit PS Central Fin Services Unit 02 SI NL Email peter.heinsbroek(a)atos.net<mailto:peter.heinsbroek@atos.netm> Web www.nl.atos.net<UrlBlockedError.aspx> Atos IT Solutions and Services B.V. Comm. Register The Hague no. 27380688 This e-mail is intended exclusively for the addressee(s), and may not be forwarded or made available for use to any person other than the addressee(s). If you are not the intended recipient, please notify the sender thereof and destroy/delete the message. The sender disclaims any liability as regards (the content of) this e-mail. This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, Atos’ liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted. On all offers and agreements under which Atos Nederland B.V. supplies goods and/or services of whatever nature, the Terms of Delivery from Atos Nederland B.V. exclusively apply. The Terms of Delivery shall be promptly submitted to you on your request.

1 0

Fwd: Stunnel Performance strangeness
by Scott McKeown 10 Mar '17

10 Mar '17

Hi All, We have been doing some throughput testing and are wondering of you can help explain some of the results we have been getting. We are trying to establish the maximum number of handshakes per second our appliances can do when using Stunnel. Our tests have been done on a 4 core Intel(R) Xeon(R) CPU E3-1230 v5 @ 3.40GHz machine with 8Gb ram. Using stunnel 5.33 openssl 1.0.2j (We use stunnel 5.33 here, but this was also tested with stunnel 5.40 and we got the same issue) Stunnel was compiled with - ./configure --enable-fips --enable-ipv6 --with-threads=pthread --sysconfdir=/etc --with-ssl=/usr/src/built/OpenSSL_1_0_2j-no_march/usr/local/ --disable-libwrap --disable-systemd I was using a python script of my own design for load testing when I noticed the problem we then switched to an open source package called vegeta https://github.com/tsenart/vegeta the command I was using to run it was - echo "GET https://10.10.10.10:443" | ./vegeta attack -workers=30 -rate=3000 -duration=300s -insecure > test.out We are essentially seeing a degradation in throughput at a fixed point in time. I am seeing the problem when using 3000 transactions per second. We are doing https gets through stunnel to a http backend, 1 transaction is an ssl handshake the http get and waiting for the response. Interestingly if I try 5.06 it works fine I get a smooth constant loading. Please take a look at 30worker3000rate5.33-300s.png where you can see after about 55 seconds there is a jump in latency. I get the same issue if I run the test with 2000 transactions. Please see 30worker20005.33-700s.png but with the lower transaction rate the issue takes longer to rear its head. The issue doesnt happen if I run the test with 3000 transaction using 5.06. Please see 30worker3000rate5.06-300s.png >From looking at the graphs our thoughts were that we were hitting some sort of cache limit and used that as a starting point. We have taken a look at the code changes between versions we know were working and the problematic version and the main thing that stands out is the changes to the leak detection. Previously this was partially based on the number of clients but has been changed to use the sections. This led to the decision to try a different limit value and found the number of connections we saw before seeing an issue corresponds to the change of the limit value. We think we have identified the code that is causing the problem/doing something funny it was added in 5.33 NOEXPORT long leak_threshold() { long limit; limit=10000*((int)number_of_sections+1); #ifndef USE_FORK limit+=100*num_clients; #endif return limit; } its src/str.c when increasing the limit number so limit=10000*((int)number_of_sections+1) to limit=20000*((int)number_of_sections+1) This still results in an increase in response time but at a later time in the test, please see 30worker3000rate5.33-ben-highlimit.png Interestingly once I end up in this state I am stuck with high latencies until I restart stunnel. (The box I am testing on was left over night to make sure its not any hanging tcp connections or anything like that) I must admit we are at the limit of our C understanding and your imput would be welcomed. -- With Kind Regards. Scott McKeown Loadbalancer.org http://www.loadbalancer.org Tel (UK) - +44 (0) 3303801064 <0330%20380%201064> (24x7) Tel (US) - +1 888.867.9504 <+1%20888-867-9504> (Toll Free)(24x7)

1 0

Segfault after connecting
by Andrew Culver 23 Feb '17

23 Feb '17

I had my stunnel instance working as expected last week. Since then I've moved the server behind a load balancer, which is doing regular health checks (opens a tcp connection, then disconnects) to see that stunnel is up. I don't believe the health checks are a problem, but they're the only change I've made since I had stunnel working. I can see the health checks connecting and disconnecting. However when I open a new connection, either by telnet or by: openssl s_client -connect mtar.uwo.ca:587 -starttls smtp ... stunnel says it fails to verify the server certificate, then seg faults. I'm running stunnel 5.40 and I'm having the same problem on 2 different servers running openssl 1.1.0d and 1.1.0e. Here's my config: [root@mtar1 stunnel]# egrep -v '^;|^ *$' stunnel.conf ; Sample stunnel configuration file for Unix by Michal Trojnara 2002-2017 setuid = stunnel setgid = stunnel pid = /usr/local/var/run/stunnel/stunnel.pid foreground = yes debug = debug [uwo2local] accept = 587 cert = /usr/local/etc/stunnel/mtar-withprivatekey.pem connect = 20587 protocol = smtp [local2o365] client = yes accept = 127.0.0.1:20587 connect = smtp.office365.com:587 checkHost = smtp.office365.com verifyChain = yes CApath = /etc/ssl/certs OCSPaia = yes protocol = smtp Here's my debug log: The health checks are from 172.18.58.5 and my test connection which leads to the seg fault is from 129.100.6.17. [root@mtar1 stunnel]# /usr/local/bin/stunnel /usr/local/etc/stunnel/stunnel.conf 2017.02.23 11:28:48 LOG7[ui]: Clients allowed=500 2017.02.23 11:28:48 LOG5[ui]: stunnel 5.40 on x86_64-unknown-linux-gnu platform 2017.02.23 11:28:48 LOG5[ui]: Compiled/running with OpenSSL 1.1.0d 26 Jan 2017 2017.02.23 11:28:48 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2017.02.23 11:28:48 LOG7[ui]: errno: (*__errno_location ()) 2017.02.23 11:28:48 LOG5[ui]: Reading configuration from file /usr/local/etc/stunnel/stunnel.conf 2017.02.23 11:28:48 LOG5[ui]: UTF-8 byte order mark detected 2017.02.23 11:28:48 LOG5[ui]: FIPS mode disabled 2017.02.23 11:28:48 LOG7[ui]: Compression disabled 2017.02.23 11:28:48 LOG7[ui]: PRNG seeded successfully 2017.02.23 11:28:48 LOG7[cron]: Cron thread initialized 2017.02.23 11:28:48 LOG6[ui]: Initializing service [uwo2local] 2017.02.23 11:28:48 LOG7[ui]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2017.02.23 11:28:48 LOG7[ui]: TLS options: 0x02020004 (+0x02000000, -0x00000000) 2017.02.23 11:28:48 LOG6[ui]: Loading certificate from file: /usr/local/etc/stunnel/mtar-withprivatekey.pem 2017.02.23 11:28:48 LOG6[ui]: Certificate loaded from file: /usr/local/etc/stunnel/mtar-withprivatekey.pem 2017.02.23 11:28:48 LOG6[ui]: Loading private key from file: /usr/local/etc/stunnel/mtar-withprivatekey.pem 2017.02.23 11:28:48 LOG6[ui]: Private key loaded from file: /usr/local/etc/stunnel/mtar-withprivatekey.pem 2017.02.23 11:28:48 LOG7[ui]: Private key check succeeded 2017.02.23 11:28:48 LOG7[ui]: DH initialization 2017.02.23 11:28:48 LOG7[ui]: Could not load DH parameters from /usr/local/etc/stunnel/mtar-withprivatekey.pem 2017.02.23 11:28:48 LOG6[ui]: Using dynamic DH parameters 2017.02.23 11:28:48 LOG7[ui]: ECDH initialization 2017.02.23 11:28:48 LOG7[ui]: ECDH initialized with curve prime256v1 2017.02.23 11:28:48 LOG6[ui]: Initializing service [local2o365] 2017.02.23 11:28:48 LOG7[ui]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2017.02.23 11:28:48 LOG7[ui]: TLS options: 0x02020004 (+0x02000000, -0x00000000) 2017.02.23 11:28:48 LOG7[ui]: No certificate or private key specified 2017.02.23 11:28:48 LOG5[ui]: Configuration successful 2017.02.23 11:28:48 LOG7[ui]: Listening file descriptor created (FD=7) 2017.02.23 11:28:48 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2017.02.23 11:28:48 LOG7[ui]: Service [uwo2local] (FD=7) bound to 0.0.0.0:587 2017.02.23 11:28:48 LOG7[ui]: Listening file descriptor created (FD=8) 2017.02.23 11:28:48 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2017.02.23 11:28:48 LOG7[ui]: Service [local2o365] (FD=8) bound to 127.0.0.1:20587 2017.02.23 11:28:48 LOG6[cron]: Executing cron jobs 2017.02.23 11:28:48 LOG5[cron]: Updating DH parameters 2017.02.23 11:28:48 LOG7[ui]: Created pid file /usr/local/var/run/stunnel/stunnel.pid 2017.02.23 11:28:51 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:28:51 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:28:51 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:28:51 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:28:51 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:40161 2017.02.23 11:28:51 LOG7[0]: Service [uwo2local] started 2017.02.23 11:28:51 LOG7[0]: Option TCP_NODELAY set on local socket 2017.02.23 11:28:51 LOG5[0]: Service [uwo2local] accepted connection from 172.18.58.5:40161 2017.02.23 11:28:51 LOG6[0]: failover: round-robin, starting at entry #0 2017.02.23 11:28:51 LOG6[0]: s_connect: connecting ::1:20587 2017.02.23 11:28:51 LOG7[0]: s_connect: s_poll_wait ::1:20587: waiting 10 seconds 2017.02.23 11:28:51 LOG3[0]: s_connect: connect ::1:20587: Connection refused (111) 2017.02.23 11:28:51 LOG6[0]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:28:51 LOG7[0]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:28:51 LOG5[0]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:28:51 LOG5[0]: Service [uwo2local] connected remote server from 127.0.0.1:33132 2017.02.23 11:28:51 LOG7[0]: Option TCP_NODELAY set on remote socket 2017.02.23 11:28:51 LOG7[0]: Remote descriptor (FD=9) initialized 2017.02.23 11:28:51 LOG7[0]: RFC 2487 not detected 2017.02.23 11:28:51 LOG6[0]: Peer certificate not required 2017.02.23 11:28:51 LOG7[0]: TLS state (accept): before SSL initialization 2017.02.23 11:28:51 LOG3[0]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:28:51 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:28:51 LOG7[0]: Remote descriptor (FD=9) closed 2017.02.23 11:28:51 LOG7[0]: Local descriptor (FD=3) closed 2017.02.23 11:28:51 LOG7[0]: Service [uwo2local] finished (0 left) 2017.02.23 11:28:51 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:28:51 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:28:51 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:28:51 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:28:51 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33132 2017.02.23 11:28:51 LOG7[1]: Service [local2o365] started 2017.02.23 11:28:51 LOG3[1]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:28:51 LOG5[1]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:28:51 LOG7[1]: Local descriptor (FD=3) closed 2017.02.23 11:28:51 LOG7[1]: Service [local2o365] finished (0 left) 2017.02.23 11:28:56 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:28:56 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:28:56 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:28:56 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:28:56 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:19333 2017.02.23 11:28:56 LOG7[2]: Service [uwo2local] started 2017.02.23 11:28:56 LOG7[2]: Option TCP_NODELAY set on local socket 2017.02.23 11:28:56 LOG5[2]: Service [uwo2local] accepted connection from 172.18.58.5:19333 2017.02.23 11:28:56 LOG6[2]: failover: round-robin, starting at entry #1 2017.02.23 11:28:56 LOG6[2]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:28:56 LOG7[2]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:28:56 LOG5[2]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:28:56 LOG5[2]: Service [uwo2local] connected remote server from 127.0.0.1:33134 2017.02.23 11:28:56 LOG7[2]: Option TCP_NODELAY set on remote socket 2017.02.23 11:28:56 LOG7[2]: Remote descriptor (FD=9) initialized 2017.02.23 11:28:56 LOG7[2]: RFC 2487 not detected 2017.02.23 11:28:56 LOG6[2]: Peer certificate not required 2017.02.23 11:28:56 LOG7[2]: TLS state (accept): before SSL initialization 2017.02.23 11:28:56 LOG3[2]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:28:56 LOG5[2]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:28:56 LOG7[2]: Remote descriptor (FD=9) closed 2017.02.23 11:28:56 LOG7[2]: Local descriptor (FD=3) closed 2017.02.23 11:28:56 LOG7[2]: Service [uwo2local] finished (0 left) 2017.02.23 11:28:56 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:28:56 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:28:56 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:28:56 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:28:56 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33134 2017.02.23 11:28:56 LOG7[3]: Service [local2o365] started 2017.02.23 11:28:56 LOG3[3]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:28:56 LOG5[3]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:28:56 LOG7[3]: Local descriptor (FD=3) closed 2017.02.23 11:28:56 LOG7[3]: Service [local2o365] finished (0 left) 2017.02.23 11:29:01 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:01 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:01 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:01 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:01 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:46315 2017.02.23 11:29:01 LOG7[4]: Service [uwo2local] started 2017.02.23 11:29:01 LOG7[4]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:01 LOG5[4]: Service [uwo2local] accepted connection from 172.18.58.5:46315 2017.02.23 11:29:01 LOG6[4]: failover: round-robin, starting at entry #0 2017.02.23 11:29:01 LOG6[4]: s_connect: connecting ::1:20587 2017.02.23 11:29:01 LOG7[4]: s_connect: s_poll_wait ::1:20587: waiting 10 seconds 2017.02.23 11:29:01 LOG3[4]: s_connect: connect ::1:20587: Connection refused (111) 2017.02.23 11:29:01 LOG6[4]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:01 LOG7[4]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:01 LOG5[4]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:01 LOG5[4]: Service [uwo2local] connected remote server from 127.0.0.1:33138 2017.02.23 11:29:01 LOG7[4]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:01 LOG7[4]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:01 LOG7[4]: RFC 2487 not detected 2017.02.23 11:29:01 LOG6[4]: Peer certificate not required 2017.02.23 11:29:01 LOG7[4]: TLS state (accept): before SSL initialization 2017.02.23 11:29:01 LOG3[4]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:01 LOG5[4]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:01 LOG7[4]: Remote descriptor (FD=9) closed 2017.02.23 11:29:01 LOG7[4]: Local descriptor (FD=3) closed 2017.02.23 11:29:01 LOG7[4]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:01 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:01 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:01 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:01 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:01 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33138 2017.02.23 11:29:01 LOG7[5]: Service [local2o365] started 2017.02.23 11:29:01 LOG3[5]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:01 LOG5[5]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:01 LOG7[5]: Local descriptor (FD=3) closed 2017.02.23 11:29:01 LOG7[5]: Service [local2o365] finished (0 left) 2017.02.23 11:29:06 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:06 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:06 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:06 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:06 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:55003 2017.02.23 11:29:06 LOG7[6]: Service [uwo2local] started 2017.02.23 11:29:06 LOG7[6]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:06 LOG5[6]: Service [uwo2local] accepted connection from 172.18.58.5:55003 2017.02.23 11:29:06 LOG6[6]: failover: round-robin, starting at entry #1 2017.02.23 11:29:06 LOG6[6]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:06 LOG7[6]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:06 LOG5[6]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:06 LOG5[6]: Service [uwo2local] connected remote server from 127.0.0.1:33140 2017.02.23 11:29:06 LOG7[6]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:06 LOG7[6]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:06 LOG7[6]: RFC 2487 not detected 2017.02.23 11:29:06 LOG6[6]: Peer certificate not required 2017.02.23 11:29:06 LOG7[6]: TLS state (accept): before SSL initialization 2017.02.23 11:29:06 LOG3[6]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:06 LOG5[6]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:06 LOG7[6]: Remote descriptor (FD=9) closed 2017.02.23 11:29:06 LOG7[6]: Local descriptor (FD=3) closed 2017.02.23 11:29:06 LOG7[6]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:06 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:06 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:06 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:06 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:06 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33140 2017.02.23 11:29:06 LOG7[7]: Service [local2o365] started 2017.02.23 11:29:06 LOG3[7]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:06 LOG5[7]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:06 LOG7[7]: Local descriptor (FD=3) closed 2017.02.23 11:29:06 LOG7[7]: Service [local2o365] finished (0 left) 2017.02.23 11:29:11 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:11 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:11 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:11 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:11 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:52586 2017.02.23 11:29:11 LOG7[8]: Service [uwo2local] started 2017.02.23 11:29:11 LOG7[8]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:11 LOG5[8]: Service [uwo2local] accepted connection from 172.18.58.5:52586 2017.02.23 11:29:11 LOG6[8]: failover: round-robin, starting at entry #0 2017.02.23 11:29:11 LOG6[8]: s_connect: connecting ::1:20587 2017.02.23 11:29:11 LOG7[8]: s_connect: s_poll_wait ::1:20587: waiting 10 seconds 2017.02.23 11:29:11 LOG3[8]: s_connect: connect ::1:20587: Connection refused (111) 2017.02.23 11:29:11 LOG6[8]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:11 LOG7[8]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:11 LOG5[8]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:11 LOG5[8]: Service [uwo2local] connected remote server from 127.0.0.1:33144 2017.02.23 11:29:11 LOG7[8]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:11 LOG7[8]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:11 LOG7[8]: RFC 2487 not detected 2017.02.23 11:29:11 LOG6[8]: Peer certificate not required 2017.02.23 11:29:11 LOG7[8]: TLS state (accept): before SSL initialization 2017.02.23 11:29:11 LOG3[8]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:11 LOG5[8]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:11 LOG7[8]: Remote descriptor (FD=9) closed 2017.02.23 11:29:11 LOG7[8]: Local descriptor (FD=3) closed 2017.02.23 11:29:11 LOG7[8]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:11 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:11 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:11 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:11 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:11 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33144 2017.02.23 11:29:11 LOG7[9]: Service [local2o365] started 2017.02.23 11:29:11 LOG3[9]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:11 LOG5[9]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:11 LOG7[9]: Local descriptor (FD=3) closed 2017.02.23 11:29:11 LOG7[9]: Service [local2o365] finished (0 left) 2017.02.23 11:29:16 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:16 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:16 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:16 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:16 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:60425 2017.02.23 11:29:16 LOG7[10]: Service [uwo2local] started 2017.02.23 11:29:16 LOG7[10]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:16 LOG5[10]: Service [uwo2local] accepted connection from 172.18.58.5:60425 2017.02.23 11:29:16 LOG6[10]: failover: round-robin, starting at entry #1 2017.02.23 11:29:16 LOG6[10]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:16 LOG7[10]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:16 LOG5[10]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:16 LOG5[10]: Service [uwo2local] connected remote server from 127.0.0.1:33146 2017.02.23 11:29:16 LOG7[10]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:16 LOG7[10]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:16 LOG7[10]: RFC 2487 not detected 2017.02.23 11:29:16 LOG6[10]: Peer certificate not required 2017.02.23 11:29:16 LOG7[10]: TLS state (accept): before SSL initialization 2017.02.23 11:29:16 LOG3[10]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:16 LOG5[10]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:16 LOG7[10]: Remote descriptor (FD=9) closed 2017.02.23 11:29:16 LOG7[10]: Local descriptor (FD=3) closed 2017.02.23 11:29:16 LOG7[10]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:16 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:16 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:16 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:16 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:16 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33146 2017.02.23 11:29:16 LOG7[11]: Service [local2o365] started 2017.02.23 11:29:16 LOG3[11]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:16 LOG5[11]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:16 LOG7[11]: Local descriptor (FD=3) closed 2017.02.23 11:29:16 LOG7[11]: Service [local2o365] finished (0 left) 2017.02.23 11:29:21 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:21 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:21 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:21 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:21 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:50381 2017.02.23 11:29:21 LOG7[12]: Service [uwo2local] started 2017.02.23 11:29:21 LOG7[12]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:21 LOG5[12]: Service [uwo2local] accepted connection from 172.18.58.5:50381 2017.02.23 11:29:21 LOG6[12]: failover: round-robin, starting at entry #0 2017.02.23 11:29:21 LOG6[12]: s_connect: connecting ::1:20587 2017.02.23 11:29:21 LOG7[12]: s_connect: s_poll_wait ::1:20587: waiting 10 seconds 2017.02.23 11:29:21 LOG3[12]: s_connect: connect ::1:20587: Connection refused (111) 2017.02.23 11:29:21 LOG6[12]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:21 LOG7[12]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:21 LOG5[12]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:21 LOG5[12]: Service [uwo2local] connected remote server from 127.0.0.1:33150 2017.02.23 11:29:21 LOG7[12]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:21 LOG7[12]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:21 LOG7[12]: RFC 2487 not detected 2017.02.23 11:29:21 LOG6[12]: Peer certificate not required 2017.02.23 11:29:21 LOG7[12]: TLS state (accept): before SSL initialization 2017.02.23 11:29:21 LOG3[12]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:21 LOG5[12]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:21 LOG7[12]: Remote descriptor (FD=9) closed 2017.02.23 11:29:21 LOG7[12]: Local descriptor (FD=3) closed 2017.02.23 11:29:21 LOG7[12]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:21 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:21 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:21 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:21 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:21 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33150 2017.02.23 11:29:21 LOG7[13]: Service [local2o365] started 2017.02.23 11:29:21 LOG3[13]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:21 LOG5[13]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:21 LOG7[13]: Local descriptor (FD=3) closed 2017.02.23 11:29:21 LOG7[13]: Service [local2o365] finished (0 left) 2017.02.23 11:29:26 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:26 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:26 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:26 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:26 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:7384 2017.02.23 11:29:26 LOG7[14]: Service [uwo2local] started 2017.02.23 11:29:26 LOG7[14]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:26 LOG5[14]: Service [uwo2local] accepted connection from 172.18.58.5:7384 2017.02.23 11:29:26 LOG6[14]: failover: round-robin, starting at entry #1 2017.02.23 11:29:26 LOG6[14]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:26 LOG7[14]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:26 LOG5[14]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:26 LOG5[14]: Service [uwo2local] connected remote server from 127.0.0.1:33152 2017.02.23 11:29:26 LOG7[14]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:26 LOG7[14]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:26 LOG7[14]: RFC 2487 not detected 2017.02.23 11:29:26 LOG6[14]: Peer certificate not required 2017.02.23 11:29:26 LOG7[14]: TLS state (accept): before SSL initialization 2017.02.23 11:29:26 LOG3[14]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:26 LOG5[14]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:26 LOG7[14]: Remote descriptor (FD=9) closed 2017.02.23 11:29:26 LOG7[14]: Local descriptor (FD=3) closed 2017.02.23 11:29:26 LOG7[14]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:26 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:26 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:26 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:26 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:26 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33152 2017.02.23 11:29:26 LOG7[15]: Service [local2o365] started 2017.02.23 11:29:26 LOG3[15]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:26 LOG5[15]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:26 LOG7[15]: Local descriptor (FD=3) closed 2017.02.23 11:29:26 LOG7[15]: Service [local2o365] finished (0 left) 2017.02.23 11:29:31 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:31 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:31 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:31 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:31 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:40920 2017.02.23 11:29:31 LOG7[16]: Service [uwo2local] started 2017.02.23 11:29:31 LOG7[16]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:31 LOG5[16]: Service [uwo2local] accepted connection from 172.18.58.5:40920 2017.02.23 11:29:31 LOG6[16]: failover: round-robin, starting at entry #0 2017.02.23 11:29:31 LOG6[16]: s_connect: connecting ::1:20587 2017.02.23 11:29:31 LOG7[16]: s_connect: s_poll_wait ::1:20587: waiting 10 seconds 2017.02.23 11:29:31 LOG3[16]: s_connect: connect ::1:20587: Connection refused (111) 2017.02.23 11:29:31 LOG6[16]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:31 LOG7[16]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:31 LOG5[16]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:31 LOG5[16]: Service [uwo2local] connected remote server from 127.0.0.1:33156 2017.02.23 11:29:31 LOG7[16]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:31 LOG7[16]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:31 LOG7[16]: RFC 2487 not detected 2017.02.23 11:29:31 LOG6[16]: Peer certificate not required 2017.02.23 11:29:31 LOG7[16]: TLS state (accept): before SSL initialization 2017.02.23 11:29:31 LOG3[16]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:31 LOG5[16]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:31 LOG7[16]: Remote descriptor (FD=9) closed 2017.02.23 11:29:31 LOG7[16]: Local descriptor (FD=3) closed 2017.02.23 11:29:31 LOG7[16]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:31 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:31 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:31 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:31 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:31 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33156 2017.02.23 11:29:31 LOG7[17]: Service [local2o365] started 2017.02.23 11:29:31 LOG3[17]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:31 LOG5[17]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:31 LOG7[17]: Local descriptor (FD=3) closed 2017.02.23 11:29:31 LOG7[17]: Service [local2o365] finished (0 left) 2017.02.23 11:29:36 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:36 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:36 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:36 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:36 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:23632 2017.02.23 11:29:36 LOG7[18]: Service [uwo2local] started 2017.02.23 11:29:36 LOG7[18]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:36 LOG5[18]: Service [uwo2local] accepted connection from 172.18.58.5:23632 2017.02.23 11:29:36 LOG6[18]: failover: round-robin, starting at entry #1 2017.02.23 11:29:36 LOG6[18]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:36 LOG7[18]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:36 LOG5[18]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:36 LOG5[18]: Service [uwo2local] connected remote server from 127.0.0.1:33158 2017.02.23 11:29:36 LOG7[18]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:36 LOG7[18]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:36 LOG7[18]: RFC 2487 not detected 2017.02.23 11:29:36 LOG6[18]: Peer certificate not required 2017.02.23 11:29:36 LOG7[18]: TLS state (accept): before SSL initialization 2017.02.23 11:29:36 LOG3[18]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:36 LOG5[18]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:36 LOG7[18]: Remote descriptor (FD=9) closed 2017.02.23 11:29:36 LOG7[18]: Local descriptor (FD=3) closed 2017.02.23 11:29:36 LOG7[18]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:36 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:36 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:36 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:36 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:36 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33158 2017.02.23 11:29:36 LOG7[19]: Service [local2o365] started 2017.02.23 11:29:36 LOG3[19]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:36 LOG5[19]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:36 LOG7[19]: Local descriptor (FD=3) closed 2017.02.23 11:29:36 LOG7[19]: Service [local2o365] finished (0 left) 2017.02.23 11:29:41 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:41 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:41 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:41 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:41 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:2134 2017.02.23 11:29:41 LOG7[20]: Service [uwo2local] started 2017.02.23 11:29:41 LOG7[20]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:41 LOG5[20]: Service [uwo2local] accepted connection from 172.18.58.5:2134 2017.02.23 11:29:41 LOG6[20]: failover: round-robin, starting at entry #0 2017.02.23 11:29:41 LOG6[20]: s_connect: connecting ::1:20587 2017.02.23 11:29:41 LOG7[20]: s_connect: s_poll_wait ::1:20587: waiting 10 seconds 2017.02.23 11:29:41 LOG3[20]: s_connect: connect ::1:20587: Connection refused (111) 2017.02.23 11:29:41 LOG6[20]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:41 LOG7[20]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:41 LOG5[20]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:41 LOG5[20]: Service [uwo2local] connected remote server from 127.0.0.1:33162 2017.02.23 11:29:41 LOG7[20]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:41 LOG7[20]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:41 LOG7[20]: RFC 2487 not detected 2017.02.23 11:29:41 LOG6[20]: Peer certificate not required 2017.02.23 11:29:41 LOG7[20]: TLS state (accept): before SSL initialization 2017.02.23 11:29:41 LOG3[20]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:41 LOG5[20]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:41 LOG7[20]: Remote descriptor (FD=9) closed 2017.02.23 11:29:41 LOG7[20]: Local descriptor (FD=3) closed 2017.02.23 11:29:41 LOG7[20]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:41 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:41 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:41 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:41 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:41 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33162 2017.02.23 11:29:41 LOG7[21]: Service [local2o365] started 2017.02.23 11:29:41 LOG3[21]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:41 LOG5[21]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:41 LOG7[21]: Local descriptor (FD=3) closed 2017.02.23 11:29:41 LOG7[21]: Service [local2o365] finished (0 left) 2017.02.23 11:29:46 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:46 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:46 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:46 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:46 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:4464 2017.02.23 11:29:46 LOG7[22]: Service [uwo2local] started 2017.02.23 11:29:46 LOG7[22]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:46 LOG5[22]: Service [uwo2local] accepted connection from 172.18.58.5:4464 2017.02.23 11:29:46 LOG6[22]: failover: round-robin, starting at entry #1 2017.02.23 11:29:46 LOG6[22]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:46 LOG7[22]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:46 LOG5[22]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:46 LOG5[22]: Service [uwo2local] connected remote server from 127.0.0.1:33164 2017.02.23 11:29:46 LOG7[22]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:46 LOG7[22]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:46 LOG7[22]: RFC 2487 not detected 2017.02.23 11:29:46 LOG6[22]: Peer certificate not required 2017.02.23 11:29:46 LOG7[22]: TLS state (accept): before SSL initialization 2017.02.23 11:29:46 LOG3[22]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:46 LOG5[22]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:46 LOG7[22]: Remote descriptor (FD=9) closed 2017.02.23 11:29:46 LOG7[22]: Local descriptor (FD=3) closed 2017.02.23 11:29:46 LOG7[22]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:46 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:46 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:46 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:46 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:46 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33164 2017.02.23 11:29:46 LOG7[23]: Service [local2o365] started 2017.02.23 11:29:46 LOG3[23]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:46 LOG5[23]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:46 LOG7[23]: Local descriptor (FD=3) closed 2017.02.23 11:29:46 LOG7[23]: Service [local2o365] finished (0 left) 2017.02.23 11:29:51 LOG5[cron]: DH parameters updated 2017.02.23 11:29:51 LOG6[cron]: Cron jobs completed in 63 seconds 2017.02.23 11:29:51 LOG7[cron]: Waiting 86337 seconds 2017.02.23 11:29:51 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:51 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:51 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:51 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:51 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:28318 2017.02.23 11:29:51 LOG7[24]: Service [uwo2local] started 2017.02.23 11:29:51 LOG7[24]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:51 LOG5[24]: Service [uwo2local] accepted connection from 172.18.58.5:28318 2017.02.23 11:29:51 LOG6[24]: failover: round-robin, starting at entry #0 2017.02.23 11:29:51 LOG6[24]: s_connect: connecting ::1:20587 2017.02.23 11:29:51 LOG7[24]: s_connect: s_poll_wait ::1:20587: waiting 10 seconds 2017.02.23 11:29:51 LOG3[24]: s_connect: connect ::1:20587: Connection refused (111) 2017.02.23 11:29:51 LOG6[24]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:51 LOG7[24]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:51 LOG5[24]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:51 LOG5[24]: Service [uwo2local] connected remote server from 127.0.0.1:33168 2017.02.23 11:29:51 LOG7[24]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:51 LOG7[24]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:51 LOG7[24]: RFC 2487 not detected 2017.02.23 11:29:51 LOG6[24]: Peer certificate not required 2017.02.23 11:29:51 LOG7[24]: TLS state (accept): before SSL initialization 2017.02.23 11:29:51 LOG3[24]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:51 LOG5[24]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:51 LOG7[24]: Remote descriptor (FD=9) closed 2017.02.23 11:29:51 LOG7[24]: Local descriptor (FD=3) closed 2017.02.23 11:29:51 LOG7[24]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:51 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:51 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:51 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:51 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:51 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33168 2017.02.23 11:29:51 LOG7[25]: Service [local2o365] started 2017.02.23 11:29:51 LOG3[25]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:51 LOG5[25]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:51 LOG7[25]: Local descriptor (FD=3) closed 2017.02.23 11:29:51 LOG7[25]: Service [local2o365] finished (0 left) 2017.02.23 11:29:56 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:56 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:56 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:56 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:56 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:32441 2017.02.23 11:29:56 LOG7[26]: Service [uwo2local] started 2017.02.23 11:29:56 LOG7[26]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:56 LOG5[26]: Service [uwo2local] accepted connection from 172.18.58.5:32441 2017.02.23 11:29:56 LOG6[26]: failover: round-robin, starting at entry #1 2017.02.23 11:29:56 LOG6[26]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:56 LOG7[26]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:56 LOG5[26]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:56 LOG5[26]: Service [uwo2local] connected remote server from 127.0.0.1:33170 2017.02.23 11:29:56 LOG7[26]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:56 LOG7[26]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:56 LOG7[26]: RFC 2487 not detected 2017.02.23 11:29:56 LOG6[26]: Peer certificate not required 2017.02.23 11:29:56 LOG7[26]: TLS state (accept): before SSL initialization 2017.02.23 11:29:56 LOG3[26]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:56 LOG5[26]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:56 LOG7[26]: Remote descriptor (FD=9) closed 2017.02.23 11:29:56 LOG7[26]: Local descriptor (FD=3) closed 2017.02.23 11:29:56 LOG7[26]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:56 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:56 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:56 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:56 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:56 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33170 2017.02.23 11:29:56 LOG7[27]: Service [local2o365] started 2017.02.23 11:29:56 LOG3[27]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:56 LOG5[27]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:56 LOG7[27]: Local descriptor (FD=3) closed 2017.02.23 11:29:56 LOG7[27]: Service [local2o365] finished (0 left) 2017.02.23 11:30:00 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:30:00 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:30:00 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:30:00 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:30:00 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 129.100.6.17:16594 2017.02.23 11:30:00 LOG7[28]: Service [uwo2local] started 2017.02.23 11:30:00 LOG7[28]: Option TCP_NODELAY set on local socket 2017.02.23 11:30:00 LOG5[28]: Service [uwo2local] accepted connection from 129.100.6.17:16594 2017.02.23 11:30:00 LOG6[28]: failover: round-robin, starting at entry #0 2017.02.23 11:30:00 LOG6[28]: s_connect: connecting ::1:20587 2017.02.23 11:30:00 LOG7[28]: s_connect: s_poll_wait ::1:20587: waiting 10 seconds 2017.02.23 11:30:00 LOG3[28]: s_connect: connect ::1:20587: Connection refused (111) 2017.02.23 11:30:00 LOG6[28]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:30:00 LOG7[28]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:30:00 LOG5[28]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:30:00 LOG5[28]: Service [uwo2local] connected remote server from 127.0.0.1:33176 2017.02.23 11:30:00 LOG7[28]: Option TCP_NODELAY set on remote socket 2017.02.23 11:30:00 LOG7[28]: Remote descriptor (FD=9) initialized 2017.02.23 11:30:00 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:30:00 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:30:00 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:30:00 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:30:00 LOG7[ui]: Service [local2o365] accepted (FD=10) from 127.0.0.1:33176 2017.02.23 11:30:00 LOG7[29]: Service [local2o365] started 2017.02.23 11:30:00 LOG7[29]: Option TCP_NODELAY set on local socket 2017.02.23 11:30:00 LOG5[29]: Service [local2o365] accepted connection from 127.0.0.1:33176 2017.02.23 11:30:00 LOG6[29]: failover: round-robin, starting at entry #13 2017.02.23 11:30:00 LOG6[29]: s_connect: connecting 2603:1036:405:4a::2:587 2017.02.23 11:30:00 LOG3[29]: s_connect: connect 2603:1036:405:4a::2:587: Network is unreachable (101) 2017.02.23 11:30:00 LOG6[29]: s_connect: connecting 2603:1036:3:11e::2:587 2017.02.23 11:30:00 LOG3[29]: s_connect: connect 2603:1036:3:11e::2:587: Network is unreachable (101) 2017.02.23 11:30:00 LOG6[29]: s_connect: connecting 2603:1036:404:56::2:587 2017.02.23 11:30:00 LOG3[29]: s_connect: connect 2603:1036:404:56::2:587: Network is unreachable (101) 2017.02.23 11:30:00 LOG6[29]: s_connect: connecting 40.97.132.210:587 2017.02.23 11:30:00 LOG7[29]: s_connect: s_poll_wait 40.97.132.210:587: waiting 10 seconds 2017.02.23 11:30:00 LOG5[29]: s_connect: connected 40.97.132.210:587 2017.02.23 11:30:00 LOG5[29]: Service [local2o365] connected remote server from 172.18.58.248:52538 2017.02.23 11:30:00 LOG7[29]: Option TCP_NODELAY set on remote socket 2017.02.23 11:30:00 LOG7[29]: Remote descriptor (FD=11) initialized 2017.02.23 11:30:00 LOG7[29]: <- 220 MWHPR2001CA0006.outlook.office365.com Microsoft ESMTP MAIL Service ready at Thu, 23 Feb 2017 16:30:00 +0000 2017.02.23 11:30:00 LOG7[29]: -> 220 MWHPR2001CA0006.outlook.office365.com Microsoft ESMTP MAIL Service ready at Thu, 23 Feb 2017 16:30:00 +0000 2017.02.23 11:30:00 LOG7[29]: -> EHLO localhost 2017.02.23 11:30:00 LOG7[28]: RFC 2487 detected 2017.02.23 11:30:00 LOG7[28]: <- 220 MWHPR2001CA0006.outlook.office365.com Microsoft ESMTP MAIL Service ready at Thu, 23 Feb 2017 16:30:00 +0000 2017.02.23 11:30:00 LOG7[28]: -> 220 MWHPR2001CA0006.outlook.office365.com stunnel for Microsoft ESMTP MAIL Service ready at Thu, 23 Feb 2017 16:30:00 +0000 2017.02.23 11:30:00 LOG7[29]: <- 250-MWHPR2001CA0006.outlook.office365.com Hello [129.100.1.192] 2017.02.23 11:30:00 LOG7[29]: <- 250-SIZE 157286400 2017.02.23 11:30:00 LOG7[29]: <- 250-PIPELINING 2017.02.23 11:30:00 LOG7[29]: <- 250-DSN 2017.02.23 11:30:00 LOG7[29]: <- 250-ENHANCEDSTATUSCODES 2017.02.23 11:30:00 LOG7[29]: <- 250-STARTTLS 2017.02.23 11:30:00 LOG7[29]: <- 250-8BITMIME 2017.02.23 11:30:00 LOG7[29]: <- 250-BINARYMIME 2017.02.23 11:30:00 LOG7[29]: <- 250-CHUNKING 2017.02.23 11:30:00 LOG7[29]: <- 250 SMTPUTF8 2017.02.23 11:30:00 LOG7[29]: -> STARTTLS 2017.02.23 11:30:00 LOG7[29]: <- 220 2.0.0 SMTP server ready 2017.02.23 11:30:00 LOG6[29]: SNI: sending servername: smtp.office365.com 2017.02.23 11:30:00 LOG6[29]: Peer certificate required 2017.02.23 11:30:00 LOG7[29]: TLS state (connect): before SSL initialization 2017.02.23 11:30:00 LOG7[29]: TLS state (connect): SSLv3/TLS write client hello 2017.02.23 11:30:00 LOG7[29]: TLS state (connect): SSLv3/TLS write client hello 2017.02.23 11:30:00 LOG7[29]: TLS state (connect): SSLv3/TLS read server hello 2017.02.23 11:30:00 LOG7[29]: Verification started at depth=1: C=US, O=DigiCert Inc, CN=DigiCert Cloud Services CA-1 2017.02.23 11:30:00 LOG4[29]: CERT: Pre-verification error: unable to get local issuer certificate 2017.02.23 11:30:00 LOG4[29]: Rejected by CERT at depth=1: C=US, O=DigiCert Inc, CN=DigiCert Cloud Services CA-1 2017.02.23 11:30:00 LOG7[29]: Remove session callback 2017.02.23 11:30:00 LOG7[29]: Deallocating application specific data for addr index 2017.02.23 11:30:00 LOG7[29]: TLS alert (write): fatal: unknown CA 2017.02.23 11:30:00 LOG3[29]: SSL_connect: 1416F086: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed 2017.02.23 11:30:00 LOG5[29]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:30:00 LOG7[29]: Deallocating application specific data for addr index Segmentation fault [root@mtar1 stunnel]# *Andrew Culver* System Administrator Information Technology Services <https://www.uwo.ca/its> University of Western Ontario <https://www.uwo.ca> e: aculver(a)uwo.ca p: 519-661-2111 x80265 <15196612111,80265> cal: html <http://goo.gl/wVoDlo> | ics <http://goo.gl/ncUjV0>

1 0

Bad Magic
by Melzer, Jacob 21 Feb '17

21 Feb '17

I'm trying to do a proof of concept using Stunnel on AIX 6.1. Without stunnel I'd have: Telnet session -> listening service With stunnel, I want: telnet session -> stunnel client -[secure connection]--> Stunnel server -->listening service. The stunnel client seems to be working fine, but the stunnel server abends as soon as it receives a secure connection. Client: Accepts non-secure on port 33342. Forwards to secure socket 33343 stunnel stunnel.conf.2 2017.02.21 09:31:35 LOG5[ui]: stunnel 5.40 on powerpc-ibm-aix6.1.0.0 platform 2017.02.21 09:31:35 LOG5[ui]: Compiled/running with OpenSSL 1.0.2j 26 Sep 2016 2017.02.21 09:31:35 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2017.02.21 09:31:35 LOG5[ui]: Reading configuration from file /bmo/stunnel/bin/stunnel.conf.2 2017.02.21 09:31:35 LOG5[ui]: UTF-8 byte order mark detected 2017.02.21 09:31:35 LOG5[ui]: FIPS mode disabled 2017.02.21 09:31:35 LOG6[ui]: Initializing service [hif] 2017.02.21 09:31:35 LOG6[ui]: Loading certificate from file: /bmo/stunnel/stunnel.pem 2017.02.21 09:31:35 LOG6[ui]: Certificate loaded from file: /bmo/stunnel/stunnel.pem 2017.02.21 09:31:35 LOG6[ui]: Loading private key from file: /bmo/stunnel/stunnel.pem 2017.02.21 09:31:35 LOG4[ui]: Insecure file permissions on /bmo/stunnel/stunnel.pem 2017.02.21 09:31:35 LOG6[ui]: Private key loaded from file: /bmo/stunnel/stunnel.pem 2017.02.21 09:31:35 LOG4[ui]: Service [hif] needs authentication to prevent MITM attacks 2017.02.21 09:31:35 LOG5[ui]: Configuration successful 2017.02.21 09:31:38 LOG5[0]: Service [hif] accepted connection from 127.0.0.1:34749 2017.02.21 09:31:38 LOG6[0]: s_connect: connecting 127.0.0.1:33343 2017.02.21 09:31:38 LOG6[0]: s_connect: connected 127.0.0.1:33343 2017.02.21 09:31:38 LOG5[0]: Service [hif] connected remote server from 127.0.0.1:34750 2017.02.21 09:31:38 LOG6[0]: SNI: sending servername: localhost 2017.02.21 09:31:38 LOG6[0]: Peer certificate not required 2017.02.21 09:31:38 LOG3[0]: SSL_connect: Peer suddenly disconnected 2017.02.21 09:31:38 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket Server Accepts SSL connections on port 33343, connects to a non-secure service. stunnel stunnel.conf.1 2017.02.21 09:31:25 LOG5[ui]: stunnel 5.40 on powerpc-ibm-aix6.1.0.0 platform 2017.02.21 09:31:25 LOG5[ui]: Compiled/running with OpenSSL 1.0.2j 26 Sep 2016 2017.02.21 09:31:25 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2017.02.21 09:31:25 LOG5[ui]: Reading configuration from file /bmo/stunnel/bin/stunnel.conf.1 2017.02.21 09:31:25 LOG5[ui]: UTF-8 byte order mark detected 2017.02.21 09:31:25 LOG5[ui]: FIPS mode disabled 2017.02.21 09:31:25 LOG6[ui]: Initializing service [hif] 2017.02.21 09:31:25 LOG6[ui]: Loading certificate from file: /bmo/stunnel/stunnel.pem 2017.02.21 09:31:25 LOG6[ui]: Certificate loaded from file: /bmo/stunnel/stunnel.pem 2017.02.21 09:31:25 LOG6[ui]: Loading private key from file: /bmo/stunnel/stunnel.pem 2017.02.21 09:31:25 LOG4[ui]: Insecure file permissions on /bmo/stunnel/stunnel.pem 2017.02.21 09:31:25 LOG6[ui]: Private key loaded from file: /bmo/stunnel/stunnel.pem 2017.02.21 09:31:25 LOG5[ui]: Configuration successful 2017.02.21 09:31:38 LOG5[0]: Service [hif] accepted connection from 127.0.0.1:34750 2017.02.21 09:31:38 LOG6[0]: Peer certificate not required INTERNAL ERROR: Bad magic at OpenSSL, line 0 (this is an abend - core file gets created). log file exactly matches the standard output. Any idea what's going wrong here? dbx of the core file: tbs@netcbccadvwvr01 /bmo/hif/stunnel-5.40/src>dbx /bmo/stunnel/bin/stunnel core Type 'help' for help. [using memory image in core] reading symbolic information ... IOT/Abort trap in abort at 0xd01af1f8 ($t3) 0xd01af1f8 (abort+0xf8) 80410014 lwz r2,0x14(r1) (dbx) where abort() at 0xd01af1f8 fatal_debug(txt = "Bad magic", file = "OpenSSL", line = 0), line 359 in "log.c" get_alloc_list_ptr(ptr = 0x2007e1c8, file = "OpenSSL", line = 0), line 399 in "str.c" str_detach_debug(ptr = 0x2007e1c8, file = "OpenSSL", line = 0), line 348 in "str.c" str_free_debug(ptr = 0x2007e1c8, file = "OpenSSL", line = 0), line 383 in "str.c" free_function(ptr = 0x2007e1c8), line 191 in "tls.c" mem.CRYPTO_free() at 0xd97dd8d8 bn_lib.bn_expand2@AF37_5() at 0xd97e8da4 bn_mont.BN_mod_mul_montgomery() at 0xd981e150 ecp_mont.ec_GFp_mont_field_mul() at 0xd9837a18 ecp_smpl.ec_GFp_simple_point_get_affine_coordinates() at 0xd9839890 ec_lib.EC_POINT_get_affine_coordinates_GFp() at 0xd9a81dfc ecp_oct.ec_GFp_simple_point2oct() at 0xd9acc0d4 ec_oct.EC_POINT_point2oct() at 0xd9acb754 ssl3_send_server_key_exchange() at 0xd99e7c28 ssl3_accept() at 0xd99e9950 SSL_accept() at 0xd99c0b98 ssl23_get_client_hello() at 0xd9a003f4 ssl23_accept() at 0xd9a00c5c SSL_accept() at 0xd99c0b98 ssl_start(c = 0x20084cb8), line 431 in "client.c" client_try(c = 0x20084cb8), line 273 in "client.c" client_run(c = 0x20084cb8), line 181 in "client.c" client_main(c = 0x20084cb8), line 140 in "client.c" client_thread(arg = 0x20084cb8), line 99 in "client.c" (dbx) thread thread state-k wchan state-u k-tid mode held scope function $t1 run running 26279997 u no sys __fd_poll $t2 run running 45088879 u no sys _p_nsleep >$t3 run running 19070997 k no sys abort (dbx) list free_function 186 187 #if OPENSSL_VERSION_NUMBER<0x10100000L 188 NOEXPORT void free_function(void *ptr) { 189 /* CRYPTO_set_mem_ex_functions() needs a function rather than a macro */ 190 /* unfortunately, OpenSSL provides no file:line information here */ 191 str_free_debug(ptr, "OpenSSL", 0); 192 } 193 #endif 194 195 /* end of tls.c */ Should I be concerned that it looks like it is executing "free_function" from within an if statement "if OPENSSL_VERSION_NUMBER<0x1010000L but my openssl version is 2017.02.21 09:31:35 LOG5[ui]: Compiled/running with OpenSSL 1.0.2j 26 Sep 2016 Troubleshooting so far: - I had the same problem with earlier versions of openssl. - I've tried this with 5.37 as well (based on Brian McGinity's post from a few days ago), but get the same error. Jacob

1 0

stunnel on Windows Client: Changing active network interface (wired, wireless)
by b.koch.kemper 17 Feb '17

17 Feb '17

Dear stunnel community, we are running an application on our windows clients. The application needs a remote connection to our server (linux) for remote function calls. We could successfully secure this connection via stunnel. However, when our windows users change their network connection (e.g. they disconnect their notebook from the docking station to our corporate wifi) the connection and hence the whole application breaks. The users actually have to restart stunnel to make the application work again, which is really inconvenient. As the application on the notebook is always using the same port, is it somehow possible to make stunnel establish a new connection using the new active network interface? Kind regards, Bernhard

1 0

RSA too big problem
by Vikrant Agarwal 16 Feb '17

16 Feb '17

Hi, I upgraded my Stunnel server machine to CentOS 6.8 and post upgrade , the stunnel too got upgraded to stunnel 4.29 on x86_64-redhat-linux-gnu with OpenSSL 1.0.1e-fips 11 Feb 2013 . Now since then many of the stunnel client using newer stunnel client (those uses TLSv1.2 for Negotiation) are not able to connect . I get below error on the server in logs RSA_sign:digest too big for rsa key:rsa_sign’ How to fix this please? Regards, Vikrant

1 0

Re: [stunnel-users] Problem with 5.40 and Peer suddenly disconnected
by Brian McGinity 08 Feb '17

08 Feb '17

I found the archives and downgraded to 5.37 and this fixed the problem. Before going this route I tried 5.40 and 5.41 beta and both had the same issues with 'Peer suddenly disconnected'. Strange that it this was only happening for one particular connection (1 out of 7). It would happen with every test. If you would like for me to beta test another version, I would be happy to try. Bran

1 0

Problem with 5.40 and Peer suddenly disconnected
by Brian McGinity 07 Feb '17

07 Feb '17

After updating to stunnel 5.40 on x86-pc-msvc-1500 platform, I am getting a Peer suddenly disconnected each time I post data to a particular url. [VISION_WEB] client = yes accept = 127.0.0.1:1935 connect = xx.xx.web.com:443 sslVersion = TLSv1 2017.02.07 16:30:08 LOG5[160]: Service [XX_WEB] accepted connection from 192.168.100.21:53507 2017.02.07 16:30:08 LOG5[160]: s_connect: connected 11.11.111.36:443 2017.02.07 16:30:08 LOG5[160]: Service [XX_WEB] connected remote server from 192.168.100.21:53508 2017.02.07 16:30:08 LOG3[160]: SSL_connect: Peer suddenly disconnected 2017.02.07 16:30:08 LOG5[160]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket This is a production issue and is causing a lot of problems for a lot of people and I need to do something quickly. Is it possible to download stunnel 5.37 installed to see if going back to this version will fix this issue? Where is it? Or does anyone possibly know why this might be happening? Thank you for your help. Brian

1 0

Default passthrough to different destination?
by Mark Boyce 03 Feb '17

03 Feb '17

Hi All Wondering if there’s a way to pass an unencrypted connections traffic to an alternative location if a client does not SSL/TLS with the stunnel server? So considering stunnel running as a server to wrap an unencrypted SMTP server. If the SMTP client/server talks SSL/TLS all is good and as expected. If the client tries to talk without encryption it gets disconnect. Is there any way to send this traffic elsewhere rather than disconnecting the client? So that stunnel is adding an SSL/TLS option to a service rather than enforcing it. Splitting the traffic to destination servers based on if the client was encrypted or not. Thoughts? Thanks Mark

2 3

Mixed cert/PSKsecrets & TLS/SSL before proxy
by Varda Zklir 02 Feb '17

02 Feb '17

Hello Gentlemen. Needs help in configuration or negative clarifications on two issues. 1) First question whether is mixed use of cert/PSKsecrets auth possible? The same method (ether cert or PSKsecrets explicitly) serverside trough the parent [TLS] and inherited services works properly. But mixed cert/PSKsecrets like in config snippet below doesn't work. [TLS] client = no accept = 0.0.0.0:https connect = localhost:http cert = /etc/opt/stunnel/stunnel.pem [ssh] client = no sni = TLS:ssh connect = localhost:ssh [socks] client = no sni = TLS:socks protocol = socks PSKsecrets = /etc/opt/stunnel/auth/passwd The idea is to pass insensibly all incorrect or non-SNI aware requests to main http server and hide other multiplexed services. And at the same time to establish encryption and password access control to [socks] service. 2) And the second question is it possible proxy CONNECT after establishing SSL/TLS encryption? The configuration section: [ssh] accept = 22222 protocol = connect protocolHost = server.tld:443 protocolUsername = usernamehere protocolPassword = passwordhere connect = proxy.tld:8080 Say to establish unencrypted connection with proxy, pass username and password, tell proxy to establish CONNECT to target 443 and then transmit SSL/TLS to it. Goal is if I have SSL/TLS termination server/proxy on port 443 so we at first speak SSL/TLS with proxy and only then proceed to proxy requests phase. Thanks for future explanations.

1 0

installation problems
by HOFFMAN, GEOFFREY 30 Jan '17

30 Jan '17

I am having trouble installing stunnel on CentOS 7.3. I was given a directive to "use the latest OpenSSL" so on one target machine, it has 1.0.2k built from source. On the machine with OpenSSL 1.0.2k, when attempting to install stunnel, when I run ./configure, it passes with this info: configure: FIPS support not found Then make fails with: /usr/bin/ld: /usr/local/ssl/lib/libssl.a(s3_srvr.o): relocation R_X86_64_32 against `.rodata' can not be used when making a shared object; recompile with -fPIC On another target machine, it has 1.0.1e-fips, installed via yum package. On the machine with OpenSSL 1.0.1e-fips, ./configure fails with: checking for TLS directory... not found configure: error: Could not find your TLS library installation dir Advice on installing with the latest OpenSSL (1.0.2k) would be much appreciated. This e-mail, including any attachments, is meant only for the intended recipient of the transmission, and may be a confidential communication or a communication privileged by law. If you received this e-mail in error, any review, use, dissemination, distribution, or copying of this e-mail is strictly prohibited. Please notify us immediately of the error by return e-mail and please delete this message from your system. Thank you in advance for your cooperation.

1 0

Life cycle information
by Ben Harper 30 Jan '17

30 Jan '17

Greetings, I am trying to confirm some life cycle information, mainly supported version(s) and what versions do not insure backwards compatibility. It would appear that only the latest version is supported, per the first item under 'Before you send your question to stunnel-users' on the Mailing Lists page[0]. Does this project use semantic versioning? Will incompatibilities only come when a 6.x.x version is released? It seems at one point this was the case per the 'Upgrading to stunnel 4' link on the Documentation page[1]. Are my assumptions correct? Thanks, Ben [0]: https://www.stunnel.org/lists.html [1]: https://www.stunnel.org/docs.html

1 0

Proxy one site to HTTPS?
by Jeffrey Walton 30 Jan '17

30 Jan '17

Hi Everyone, I'm having trouble setting up a proxy for one site. The client is MacPorts on OS X 10.5. It makes some requests for files over port 80, but they apparently need to be made over port 443. Also see https://trac.macports.org/ticket/53423 and https://trac.macports.org/ticket/53347. My first question is, is it possible to proxy one site to HTTPS? My second question is, how does one do so if it is possible? The concrete example from the 53423 bug report is, I need to proxy requests from http://distfiles.macports.org/... to https://distfiles.macports.org/... I also need the opposite on the responses. Thanks in advance, Jeff

1 0

Client certificate using CAPI
by stunnel.org＠pepak.net 29 Jan '17

29 Jan '17

Hi! I am trying to use stunnel to connect to my own server using both a server and a client certificate. I got the tunnel to work, provided that the client uses a PEM certificate stored in a file. However, I would like to use CAPI, because that would allow me to use a smart card, which I finally got Windows to recognize (a nightmare of its own). Unfortunately, it seems that the client-side stunnel won't send a client certificate because the server-side stunnel will always close the connection with: SSL_accept: 140890C7: error:140890C7:SSL routines:ssl3_get_client_certificate:peer did not return a certificate My client-side stunnel log shows that server sent some kind of identification of all the supported client certificates to the client, but that's all - the client stunnel fails to follow through: TLS state (connect): SSLv3 read server key exchange A Client CA: emailAddress=some(a)email.com, O=Some name, CN=Pepak Yubico 4 White Client CA: emailAddress=root(a)email.com, CN=Pepak (root CA) TLS state (connect): SSLv3 read server certificate request A TLS state (connect): SSLv3 read server done A TLS state (connect): SSLv3 write client certificate A TLS state (connect): SSLv3 write client key exchange A TLS state (connect): SSLv3 write change cipher spec A TLS state (connect): SSLv3 write finished A TLS state (connect): SSLv3 flush data SSL_connect: Peer suddenly disconnected As far as I can tell, the CN=Pepak Yubico 4 White matches what my Windows show as the name of the certificate on the smartcard. Following up on https://www.stunnel.org/pipermail/stunnel-users/2016-February/005393.html, I tried to add a "key = Pepak Yubico 4 White" line to the client-side stunnel's config, but it doesn't seem to have any effect. What could be the problem? The client-side config file is: compression = deflate debug = debug fips = no taskbar = no options = NO_SSLv2 engine = capi [echo-client] client = yes accept = 3000 connect = 10.0.0.1:30000 requireCert = yes verifyChain = yes verifyPeer = yes CAfile = desktop.pem engineId = capi key = Pepak Yubico 4 White The only suspicious thing that I see is that my client certificate says that its only purpose is to verify the identity of the remote computer. Could that be the reason the handshake fails? Thanks for any help. Pepak

1 0

SSL errors do not trigger failover?
by Richard Monk 27 Jan '17

27 Jan '17

Hello! We are using stunnel to work around an SSL issue in another service, and set stunnel.conf up to do prio failover. We noticed something unusual. If the TCP session connects, but the SSL negotiation fails, it doesn't fail over to the next server on the list. I looked at the code for the latest version and this doesn't seem to be caught anywhere. What I saw in client.c shows that it only checks failover after trying to establish the TCP session, but then the SSL session happens later and doesn't give any info back to the failover code should something go wrong. Is this expected behavior, or should I look into a bug report / patch? I was thinking maybe a configurable option to allow SSL errors to trigger failover just like TCP errors. -- Richard Monk (rmonk(a)redhat.com) - Senior Principal Security Analyst Red Hat Inc. - Raleigh NC GPG Key ID: 0x942CDB25

1 0

Please Help to configure Stunnel for SHOUTcast
by Frans Rehl 24 Jan '17

24 Jan '17

Hello Stunnel Members I am wondering if any of you can help me to configure stunnel for shoutcast. I have a VPS with Windows Server 2012 R2 and I cannot find the correct configuration for windows server. Can someone help me please? My shoutcast is currently streaming on port 8000 however, I don't understand some part of the configuration, such as; cert -pem and ca-pem Could someone guide me? Best

1 0

Creating tunnel to smtp.office365.com:587
by Andrew Culver 17 Jan '17

17 Jan '17

Hello, This is my first time using stunnel so I'm still learning how it works. This may have already been asked, but I'm not sure what to search for in the archives. We have a number of hosts in private IP space that we'd like to be able to send mail to smtp.office365.com:587. I'm trying to configure stunnel for this purpose. What I'd like is to set up a stunnel instance on a server which will accept TLS connections on port 50025. Stunnel will then connect to smtp.office365.com:587 which also uses TLS. How can I do this? I am able to configure stunnel to accept my connection on 587, but the connection is immediately closed (below). If I add client = yes, then I just get: aculver stunnel # openssl s_client -starttls smtp -connect localhost:50025 CONNECTED(00000003) didn't found starttls in server response, try anyway... Here is my config: aculver stunnel # egrep -v '^;|^$' stunnel.conf ; Sample stunnel configuration file for Unix by Michal Trojnara 2002-2015 setuid = nobody setgid = nogroup pid = /usr/local/var/run/stunnel/stunnel.pid [o365-smtp] accept = 50025 cert = /usr/local/etc/stunnel/stunnel.pem connect = smtp.office365.com:587 verifyChain = yes CApath = /etc/ssl/certs protocol = smtp What am I doing wrong? Here's what I get when I don't have client = yes: aculver stunnel # openssl s_client -starttls smtp -connect localhost:50025 CONNECTED(00000003) depth=0 C = CA, ST = Ontario, L = London, O = The University of Western Ontario, OU = ITS, CN = aculver.ws.its.uwo.ca, emailAddress = aculver(a)uwo.ca verify error:num=18:self signed certificate verify return:1 depth=0 C = CA, ST = Ontario, L = London, O = The University of Western Ontario, OU = ITS, CN = aculver.ws.its.uwo.ca, emailAddress = aculver(a)uwo.ca verify return:1 139954991064736:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1263:SSL alert number 40 139954991064736:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177: --- Certificate chain 0 s:/C=CA/ST=Ontario/L=London/O=The University of Western Ontario/OU=ITS/CN=aculver.ws.its.uwo.ca/emailAddress=aculver(a)uwo.ca i:/C=CA/ST=Ontario/L=London/O=The University of Western Ontario/OU=ITS/CN=aculver.ws.its.uwo.ca/emailAddress=aculver(a)uwo.ca --- Server certificate -----BEGIN CERTIFICATE----- MIIEJzCCAw+gAwIBAgIJAM0DgGLDIh5lMA0GCSqGSIb3DQEBCwUAMIGpMQswCQYD VQQGEwJDQTEQMA4GA1UECAwHT250YXJpbzEPMA0GA1UEBwwGTG9uZG9uMSowKAYD VQQKDCFUaGUgVW5pdmVyc2l0eSBvZiBXZXN0ZXJuIE9udGFyaW8xDDAKBgNVBAsM A0lUUzEeMBwGA1UEAwwVYWN1bHZlci53cy5pdHMudXdvLmNhMR0wGwYJKoZIhvcN AQkBFg5hY3VsdmVyQHV3by5jYTAeFw0xNzAxMTcxODAwNTdaFw0yMDAxMTcxODAw NTdaMIGpMQswCQYDVQQGEwJDQTEQMA4GA1UECAwHT250YXJpbzEPMA0GA1UEBwwG TG9uZG9uMSowKAYDVQQKDCFUaGUgVW5pdmVyc2l0eSBvZiBXZXN0ZXJuIE9udGFy aW8xDDAKBgNVBAsMA0lUUzEeMBwGA1UEAwwVYWN1bHZlci53cy5pdHMudXdvLmNh MR0wGwYJKoZIhvcNAQkBFg5hY3VsdmVyQHV3by5jYTCCASIwDQYJKoZIhvcNAQEB BQADggEPADCCAQoCggEBAL2A3QEU7ReMc+2dTJdxVnQx33dIomQvO6QOAaFkI9pt XF/UhSBCg3ZD2yZeKe5GQ0+KqSCjuxTZE+BMTIeNUtaFEDr9bMAx0toknm29ve1B wTErWoIjE4yqQ+j/D9JLp4BzBcptz1zaEdvhzzZo2zWVpqHrUHSXzoIELD4xyZyF UgbQ057diKr1fqM7q3ozCofslFGEjWtc8SsfwgToT72g7bRhx8a6F6SSX8afcVx0 hvvC998QbTNUCpJO6GPzWWCsITc3RPMZK3OJsbI4NNBKDZ8eE2NTSkcKjnibRWFx bwCTlSZ5XABQrgXmEO51cx6DBAK/8cV8W2H/VNr9SXkCAwEAAaNQME4wHQYDVR0O BBYEFMPXcnQduKdorSNrFIR1up+a5V7RMB8GA1UdIwQYMBaAFMPXcnQduKdorSNr FIR1up+a5V7RMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAKqmaC+g RD1KEWT2yJit0FRIuwzFYmh/jgQ0ofabWQIuQtyNeqVnATU5FMOmox9MgbbsBanC SBVxuiLsWruk6VTjByHaIPAfsdWVKYMfLXO2Rku8GTp1X0B+HcNxh18tKr9s72rB AmapnD1GrYDAlBBgwQz+Ei1iRz+rqKsPvvJ/IEzZ02uhxV0ZWxBi5gTqAQc+pi3y I8DNBTxev2BMw+YCeNnrH3ryrJ8vKYlUmxE0k2POH1ihlpzdx9jtKC9TKR1kahMP 3lbldSHmW9DWeOfzQZ6NDHADSI698HaYfWQXUqbXjNJsxFb47pnjmyWgKseAT9iw w9nPDtkCmUihuBM= -----END CERTIFICATE----- subject=/C=CA/ST=Ontario/L=London/O=The University of Western Ontario/OU=ITS/CN=aculver.ws.its.uwo.ca/emailAddress=aculver(a)uwo.ca issuer=/C=CA/ST=Ontario/L=London/O=The University of Western Ontario/OU=ITS/CN=aculver.ws.its.uwo.ca/emailAddress=aculver(a)uwo.ca --- No client certificate CA names sent --- SSL handshake has read 1741 bytes and written 138 bytes --- New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384 Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES256-GCM-SHA384 Session-ID: Session-ID-ctx: Master-Key: 9B6FC3BBEEADF6673416272CA03FA44A2B10BADB3B843317403C03904F0E45E922EA2581F313BF5282C0A47498E43C8D Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1484680413 Timeout : 300 (sec) Verify return code: 18 (self signed certificate) --- aculver stunnel # Thanks, Andrew

1 0

Forwarding ip without HAProxy protocol
by John BYaka 06 Jan '17

06 Jan '17

Is it possible to forward real ip in special header? I know about 'protocol=proxy' but for using this i need to implement HAProxy protocol in app.

1 0

Stunnel and tokens on Windows
by stunnel.org＠pepak.net 31 Dec '16

31 Dec '16

Hi! I would very much like to switch my Stunnel setup to use hardware tokens. Stunnel apparently supports that using a PKCS11 engine, but I am having hard luck trying to figure it out for Windows, because 1) my practical experience with tokens is nonexistent at the moment, and 2) there are very few pages with a relevant information (basically, I was only able to find the very ancient http://martlaak.wikia.com/wiki/Stunnel_and_engine_pkcs11 and two russian pages http://forum.rutoken.ru/topic/1639/ and https://habrahabr.ru/post/135369/ which probably do just what I need, but I am not so sure they are applicable to my needs as I do not have a rutoken). I guess I would be satified if someone told me, "yes, these pages are applicable, just buy a xxxtoken instead of rutoken"; I would be happier with a full guide, but I can't expect anyone to write it - with the possible exception of Michal Trojnara's paid support (would that be possible?). Thanks, pepak

1 0

Re: [stunnel-users] Public domain [PATCH] support environment variables in config file
by Dmitry Bakshaev 21 Dec '16

21 Dec '16

2016-05-31 12:02 GMT+04:00 Pierre Delaage <delaage.pierre(a)free.fr>: > Did not have a look at the code yet, but should it be possible to replace > envvars usage by some keys in the registry on windows platform and/or > %userprofile%/config-file ? > > Anyway, my opinion on the patch is that there is no real interest for > "generic/self-expanding" config file , and it is even dangerous : > I would not trust stunnel if, at run time, its config could be modified by > USER envvars... > which difference between %userprofile%/config-file and USER envvars? both are USER owned and USER controlled. certificate and keys also USER private data. and stunnel started by USER owned by USER. if stunnel started by SYSTEM/ADMIN he uses SYSTEM/ADMIN envvars (if needed), certs, keys, etc. global "generic/self-expanding" config file is ADMIN owned. USER has permissions to substitute some values, restricted by ADMIN.

2 10

problem running stunnel as windows service
by Jeff Saxton 09 Dec '16

09 Dec '16

stunnel 5.38 on x86-pc-msvc-1500 platform compiled/running with OpenSSL 1.0.2j-fips 26 Sep 2016 Windows Server 2012R2 Standard When I try and start the service I get: Windows could not start the Secure Socket Tunneling Protocol Service on the Local Computer. Error: 1079: The account specified for this service is different from the account specified for other services running in the same process. So after a little reading I went into Services->Logon and checked: Allow Service to interact with desktop Same Error So I created an account in the Local Administrators group and gave it logon as a service Same thing Any ideas? -- Jeff Saxton Tanium CELL: +US 650.235.0776

1 0

Using transparent destination option with multiple network interfaces.
by Rodney Lott 08 Dec '16

08 Dec '16

Hi, there. Base server details: - Using the latest stunnel 5.37 - Ubuntu Trusty - The computers communicating with each other use bridged interface addresses that are configured by the clustering software (i.e. to ensure that at least one of the nodes is master and host to some common addresses) - For discussion purposes, let's say that each server has an eth0 and eth1, and that the master node has two additional bridged address (ie. eth0:shared-ip1, eth1:shared-ip2) - The slave nodes will try to connect to eth0:shared-ip1:20001 and eth1:shared-ip2:20001 that are hosted on the master - The master node will also try to connect to these as well, while listening on port 20001 - Not running in a chroot and am running stunnel as stunnel4 user - I have created a working solution using 4 services in the stunnel config and using hard-coded destinations in the iptables rules and the stunnel config. I want to create something more dynamic and versatile. I am trying to insert a stunnel instance between my server application that attempts to connect to its twin on another server, using the bridging addresses. I am trying to avoid hard-coding destination IP addresses in my stunnel configuration file and the iptables rules. I also don't want to have separate rules for each interface. For example, from server A's perspective (i.e. the master node), the desirable sequence of events are: - Attempt to connect to port 20001 using the bridge addresses as destinations (in this case, they would be local interfaces). - Intercept the requests to port 20001 on server A and divert them to port 40000 for encryption (i.e. the local stunnel instance). - Send unencrypted data from stunnel directly to local 20001. At the same time, server B is doing the same, except that the bridge addresses reside on server A and are not local. So, server A would also need to do this: - Intercept external request for port 20001 and send it to stunnel port 40000 for encryption - Send decrypted packets to local port 20001 This same type of sequence would also be happening My stunnel configuration looks like this: fips=yes pid=/var/run/stunnel4/testsrv.pid debug=7 output=/var/log/stunnel4/testsrv.log sslVersion = TLSv1.2 key = <private-key-location> cert = <cert-location> CAfile = <ca-file-location> ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA256:ECDH-RSA-AES256-GCM-SHA384:ECDH-ECDSA-AES256-GCM-SHA384:ECDH-RSA-AES256-SHA384:ECDH-ECDSA-AES256-SHA384:AES256-GCM-SHA384:AES256-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:DHE-DSS-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-DSS-AES128-SHA256:ECDH-RSA-AES128-GCM-SHA256:ECDH-ECDSA-AES128-GCM-SHA256:ECDH-RSA-AES128-SHA256:ECDH-ECDSA-AES128-SHA256:AES128-GCM-SHA256:AES128-SHA256 [test-srv] client=yes accept=40000 transparent=destination My iptables rules, base on what I read in the man page, are this: STUNNEL_UID=$(id -u stunnel4) # Redirect any incoming requests to port 20001 iptables -t nat -A PREROUTING -p tcp --dport 20001 ! -i lo -j DNAT --to-destination 127.0.0.1:40000 iptables -A INPUT -p tcp --dport 40000 -j ACCEPT # Redirect any outgoing locally generated requests for 20001 to stunnel port 40000 iptables -t nat -A OUTPUT -p tcp --dport 20001 -m owner ! --uid-owner $STUNNEL_UID -j DNAT --to-destination 127.0.0.1:40000 # Redirect the output of stunnel to the local 20001 port iptables -t nat -A OUTPUT -p tcp --dport 20001 -m owner --uid-owner $STUNNEL_UID -j REDIRECT --to-ports 20001 iptables -t nat -A INPUT -p tcp -d 127.0.0.1 --dport 20001 -j ACCEPT These rules are not completely adequate. For now, I'm just trying to get server A's connection to port 20001 working without having to worry about incoming from server B. When I do this and start stunnel and my process, server A's stuff appears to loop endlessly. I think this is happening because the packets that come out of stunnel, due to the transparency configuration, look exactly the same as the original. If I log stuff using iptables, I see repeat entries like this: nat-OUTPUT: IN= OUT=lo SRC=150.150.242.26 DST=150.150.242.27 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=30541 DF PROTO=TCP SPT=50101 DPT=20001 WINDOW=43690 RES=0x00 SYN URGP=0 filter-OUTPUT: IN= OUT=lo SRC=150.150.242.26 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=30541 DF PROTO=TCP SPT=50101 DPT=40000 WINDOW=43690 RES=0x00 SYN URGP=0 nat-POSTROUTING: IN= OUT=lo SRC=150.150.242.26 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=30541 DF PROTO=TCP SPT=50101 DPT=40000 WINDOW=43690 RES=0x00 SYN URGP=0 filter-INPUT: IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=150.150.242.26 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=30541 DF PROTO=TCP SPT=50101 DPT=40000 WINDOW=43690 RES=0x00 SYN URGP=0 filter-OUTPUT: IN= OUT=lo SRC=150.150.242.26 DST=127.0.0.1 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=30542 DF PROTO=TCP SPT=50101 DPT=40000 WINDOW=342 RES=0x00 ACK URGP=0 filter-INPUT: IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=150.150.242.26 DST=127.0.0.1 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=30542 DF PROTO=TCP SPT=50101 DPT=40000 WINDOW=342 RES=0x00 ACK URGP=0 nat-OUTPUT: IN= OUT=lo SRC=150.150.242.26 DST=150.150.242.27 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=48827 DF PROTO=TCP SPT=50102 DPT=20001 WINDOW=43690 RES=0x00 SYN URGP=0 filter-OUTPUT: IN= OUT=lo SRC=150.150.242.26 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=48827 DF PROTO=TCP SPT=50102 DPT=40000 WINDOW=43690 RES=0x00 SYN URGP=0 nat-POSTROUTING: IN= OUT=lo SRC=150.150.242.26 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=48827 DF PROTO=TCP SPT=50102 DPT=40000 WINDOW=43690 RES=0x00 SYN URGP=0 filter-INPUT: IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=150.150.242.26 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=48827 DF PROTO=TCP SPT=50102 DPT=40000 WINDOW=43690 RES=0x00 SYN URGP=0 filter-OUTPUT: IN= OUT=lo SRC=150.150.242.26 DST=127.0.0.1 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=48828 DF PROTO=TCP SPT=50102 DPT=40000 WINDOW=342 RES=0x00 ACK URGP=0 filter-INPUT: IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=150.150.242.26 DST=127.0.0.1 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=48828 DF PROTO=TCP SPT=50102 DPT=40000 WINDOW=342 RES=0x00 ACK URGP=0 filter-OUTPUT: IN= OUT=lo SRC=150.150.242.26 DST=127.0.0.1 LEN=269 TOS=0x00 PREC=0x00 TTL=64 ID=48829 DF PROTO=TCP SPT=50102 DPT=40000 WINDOW=342 RES=0x00 ACK PSH URGP=0 filter-INPUT: IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=150.150.242.26 DST=127.0.0.1 LEN=269 TOS=0x00 PREC=0x00 TTL=64 ID=48829 DF PROTO=TCP SPT=50102 DPT=40000 WINDOW=342 RES=0x00 ACK PSH URGP=0 ... As can be seen, line 1 and line 7 are virtually identical. In the stunnel log, I can see that stunnel is receiving multiple requests for port 20001 in rapid succession but is not actually receiving any reply from the final destination. So, if anyone has any ideas, tweaks or suggestions for how to solve this problem or where I am going wrong, I would appreciate it. I can use a static configuration with hard-coded destination IP's but if there is an alternative, I would like to know. I have tried for several days to figure this out and have searched Google extensively, including stunnel-users postings, to figure out how to do this without success. Thanks, Rodney Lott

1 1

setgroups: notowner (1)
by Jones, Russell - NONEMP 08 Dec '16

08 Dec '16

I am working on a project where we are migrating to a new datacenter. The new datacenter will not allow compilers on their servers, so I am unable to do a new stunnel build on the new server. I am attempting to move the stunnel install/executables from the old server to the new one. I got past several errors for libraries not found, but now I am stuck. stunnel process will not start, and gets several messages "setgoups: Not owner (1)" I am not sure what I need to do with permissions, ownership, etc to make this work. log attached Thanks for your help, Russell J. This electronic message transmission contains information from CSRA that may be attorney-client privileged, proprietary or confidential. The information in this message is intended only for use by the individual(s) to whom it is addressed. If you believe you have received this message in error, please contact me immediately and be aware that any use, disclosure, copying or distribution of the contents of this message is strictly prohibited. NOTE: Regardless of content, this email shall not operate to bind CSRA to any order or other contract unless pursuant to explicit written agreement or government initiative expressly permitting the use of email for such purpose.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users