- stunnel-users - stunnel.org

problem with buffering data on stunnel
by wujot 09 Jul '15

09 Jul '15

I have a problem with transmission from LAN server, which use another server on LAN with running stunnel, to pass encrypted data to remote SSL clients if they are on very slow GPRS network. If server in LAN starts to transfer big amount of data to such slow remote client, stunnel is buffering data and slowly transmits them to the GPRS client. TCP Window on connection from LAN server to stunnel is big (64 - 131kB), and TCP Window on connection from stunnel to slow client is small (about 5kB). And additionally stunnel is buffering data. So, server is finishing transmission in seconds, but in fact most of data are still in buffers of stunnel. And it makes a timeout problem (server is waiting for the confirmation from client if it received all data, but time between last byte sent from server and confirmation from client could be even several minutes). So, stunnel is working in "store and forward" model. Is it possible to switch it to something like "cut through"? Or how to force stunnel to more synchronized transmission between client and server? Regards, Adalbert

2 1

password protected key in client certificate
by Giona Il Profeta 03 Jul '15

03 Jul '15

Hi all, I have inherited an old stunnel installation, configured for mutual authentication (verify=3) and I'm trying to figure out some of the choices of the old sysadmin. One of the client certificates in the CApath directory has its private key encrypted with a password. Is the client supposed to provide the password to decrypt the key when it connects? Thank you G

2 2

Older versions of stunnel
by daninho dj 03 Jul '15

03 Jul '15

Hi guys, Where can I find some older versions of stunnel? I would like to get 5.17 version. Thanks, Daninho

2 1

Problem with read and unreald mails via POP3 SSL
by David Tedjo 30 Jun '15

30 Jun '15

Hi everybody, i bought an Logitech keyboard with display. I use now stunnel to bring my email account to my display. Logitech got a applet for this. Now i can use it but i got a problem with the unread mails. My display shows me 6 unread messages, but thats all my messages in my in-box and i read it already. Is this a problem of stunnel or a problem in the software of the keyboard? Best Regards David

2 1

automation of installation of loopback adapter
by Saurabh Beriwal 29 Jun '15

29 Jun '15

Hi All, I'd like to programmatically install the MS loopback adapter to automate tunneling of SMB over SSH. All the code which i found on net uses MS devcon utility. Please let us know if there is any simple way to automate the installation of MS loopback adapter. Thank you. Regards, Saurabh Beriwal

2 1

Re: [stunnel-users] installing stunnel on Mac Machine
by William Dockery 26 Jun '15

26 Jun '15

1. I’m an stunnel newbie. 2. I thought I would give the Mac install script a try: downloaded it to ~/Documents, did the chmod, and ran script; looks like it can’t create/find the config file? Is that something I need to do manually? WDDMBPW80336XHAGV:Documents williamdockery$ ./stunnel-5.20b8-osx [ ] Cron started [ ] Clients allowed=125 [.] stunnel 5.20 on x86_64-apple-darwin14.3.0 platform [.] Compiled/running with OpenSSL 0.9.8zd 8 Jan 2015 [.] Threading:PTHREAD Sockets:SELECT,IPv6 TLS:ENGINE,OCSP [ ] errno: (*__error()) [.] Reading configuration from file /etc/stunnel/stunnel.conf [!] Cannot open configuration file [.] [.] Syntax: [.] stunnel [<filename>] ] -fd <n> | -help | -version | -sockets [.] <filename> - use specified config file [.] -fd <n> - read the config file from a file descriptor [.] -help - get config file help [.] -version - display version and defaults [.] -sockets - display default socket options Thoughts? Thanks, William > > Message: 1 > Date: Thu, 25 Jun 2015 12:48:02 +0200 > From: Michal Trojnara <Michal.Trojnara(a)mirt.net> > Cc: stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] installing stunnel on Mac Machine > Message-ID: <558BDC62.9080606(a)mirt.net> > Content-Type: text/plain; charset=utf-8 > > Signed PGP part > On 25.06.2015 08:04, Saurabh Beriwal wrote: > > Is it possible to automate the installation on Mac machine? > > I built an executable for you: > ftp://ftp.stunnel.org/stunnel/stunnel-5.20b8-osx > Just copy to a directory, chmod a+x, and run it. > > Mike > >

1 0

installing stunnel on Mac Machine
by Saurabh Beriwal 25 Jun '15

25 Jun '15

Hi All, I need to install stunnel on Mac machine. If someone has already done this in past , then please share the installation steps with me. Do we need to install anything like loopback adopter in Mac Machine. Regards, Saurabh Beriwal

4 5

How to upgrade OpenSSL version that comes with Stunnel
by Paul Randall 24 Jun '15

24 Jun '15

Hi folks, Can you please tell me the process for swapping out the version of OpenSSL that comes with Stunnel for a newer version of OpenSSL? Is there a quick way to do this or does it require recompiling Stunnel? Thanks. Paul

1 0

Stunnel windows installer
by Deepak Subbanarasimha 22 Jun '15

22 Jun '15

Hi, Is there an MSI installer available for Stunnel version 5.19 ? If so, has anyone tried to call the stunnel MSI installer from an Install shield installer? Thanks, DEEPAK SUBBANARASIMHA Kewill DDI: +00 (1) 978 482 2625 Email: deepak.subbanarasimha(a)kewill.com<mailto:deepak.subbanarasimha@kewill.com> www.kewill.com<http://www.kewill.com/> Tel: +00 (1) 978 482 2500 | Fax: +00 (1) 978 482 2501 1 Executive Drive, Chelmsford, MA 01824, USA IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately notify us by telephone at (978) 482-2500 and return the original message to us at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code. Thank You. Copyright (c) 2013 by Kewill Inc IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately return the original message to the sender at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Although Kewill takes reasonable precautions to minimize the risk, Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code.

1 0

Re: [stunnel-users] stunnel 5.18 may keep high CPU usage
by Dod 22 Jun '15

22 Jun '15

Hello Michal, Same problem with 5.19b4 and nothing special in the logs. Now I know how to reproduce the problem instantly, I just have to put my computer in StanBy mode and Awake it. Using Process Explorer from Sysinternals I see that stunnel produce a permanent "Other I/O" flow when problem appear. I/O Other : "The rate at which the process is issuing bytes to I/O operations that do not involve data such as control operations. This counter counts all I/O activity generated by the process to include file, network and device I/Os." OtherI/O is confirmed by Process Monitor that trace no File nor Registry nor Network activity. But as stunnel still respond correctly to a Quit menu or any other menus and SSL requests I assumed that it may be some Thread going crazy so I compared running thread between normal stunnel behavior with the 25% CPU behavior and found that in fact there is a thread that do no terminate correctly. Here is the Thread's stack : MSVCR90.dll!_endThread+0x7d ntoskrnl.exe!memset+0x61a ntoskrnl.exe!KeWaitForMultipleObjects+0xd52 ntoskrnl.exe!KeWaitForSingleObject+0x19f ntoskrnl.exe!PoStartNextPowerIrp+0xba4 ntoskrnl.exe!PoStartNextPowerIrp+0x1821 ntoskrnl.exe!PoStartNextPowerIrp+0x1a97 ntoskrnl.exe!KeReleaseInStackQueuedSpinLock+0x5a afd.sys+0x61c1c afd.sys+0x51d3b ntoskrnl.exe!NtMapViewOfSection+0x15b7 ntoskrnl.exe!NtDeviceIoControlFile+0x56 ntoskrnl.exe!KeSynchronizeExecution+0x3a23 wow64cpu.dll!TurboDispatchJumpAddressEnd+0x6c0 wow64cpu.dll!TurboDispatchJumpAddressEnd+0x1fb wow64.dll!Wow64SystemServiceEx+0x1ce wow64.dll!Wow64LdrpInitialize+0x42a ntdll.dll!RtlIsDosDeviceName_U+0x1f5c4 ntdll.dll!LdrInitializeThunk+0xe ntdll.dll!NtDeviceIoControlFile+0x15 WS2_32.dll!select+0x9f stunnel.exe!OPENSSL_Applink+0xd3ec stunnel.exe!OPENSSL_Applink+0x961 Hope it help... regards. MT> Please try stunnel 5.19b4: MT> https://www.stunnel.org/downloads.html

2 2

Fwd: Disabling window server service
by Saurabh Beriwal 22 Jun '15

22 Jun '15

Hi All, I am using stunnel to connect with SAMBA server and getting error in binding with server. Please let me know if it is mandatory to disable window server service for using stunnel. Also i would appreciate if some one can share knowledge\articles on window to SAMBA server connectivity through stunnel. Thank you. Regards, Saurabh Beriwal

1 0

Generate CONNECT
by reiner otto 22 Jun '15

22 Jun '15

I have following problem: I want to avoid the user to explicitly specify a https-proxy in his browser. Let me explain: For http, a transparent proxy can be interfaced via iptables DNAT, for example.Same for https will not work, without certificates installed etc.However, I only want some basic info about the https-session, like traffic volume or destination domain. In case, there is an explicit https-proxy defined in the browser, I can get this info from the connect request, preceding the secure data exchange.But I want to avoid this explicit declararion. Most likely I will need some custom programming for this, but may be there is a specialist here to give some direction.

2 2

Default Ciphers
by Clayton Keller 17 Jun '15

17 Jun '15

Looking at the Changelog I see the following from the 5.15 info: "MEDIUM ciphers (currently SEED and RC4) are removed from the default cipher list." And this from the 5.00 info: "Default "ciphers" updated to "HIGH:MEDIUM:+3DES:+DH:!aNULL:!SSLv2" due to AlFBPPS attack and bad performance of DH ciphersuites." Given these to comments would it be accurate to say that the current default "ciphers" value is: "HIGH:+3DES:+DH:!aNULL:!SSLv2" Also, some of the docs indicate what the default value currently is. Is there an easier way to determine that value via CLI or other means? Thanks Clay

2 1

stunnel 5.18 may keep high CPU usage
by Dod 17 Jun '15

17 Jun '15

Hello, I use sTunnel for years and ujpdated from 5.17 to 5.18 on my Win7 64bits. I use sTunnel for POP-SSL and SMTP-SSL for 12 accounts (gmail, yahoo ...) but I noticed that after a few connexions sTunnel may keep high CPU, 25% as reported by TaskManager (50% on core 1 and 3 on my Core-i5 quad-core). The problem, may appear after 10 cnx sometime more. The reading order the POP-S accounts that are checked do not matter. The POP accounts are never high loaded I mean I do not receive tons of e-mails and they are not oversized. Sometime the 25% CPU usage disappear by its own, sometime it can stay forever. Never noticed such problem on previous versions. Standard logs show nothing special. regards.

3 10

Stunnel 5.17 builds, 5.18 does not - AIX 6.1 - pod2man does not accept "-v"
by Rob Lockhart 17 Jun '15

17 Jun '15

Michal, I was able to build Stunnel 5.17 on AIX 6.1 using the "build" command, after completely removing the entire section for "-fstack-protector" in "configure" (my "stunnel-5.17.patch" file below). I used the following commands: mkdir $HOME/stunnel-bin-5.17 gzip -dc stunnel-5.17.tar.gz | tar xvf - patch -p0 <stunnel-5.17.patch cd stunnel-5.17 chmod 755 configure; ./configure --prefix=$HOME/stunnel-bin-5.17 make; make install However, for 5.18, those same commands (and patch file) no longer result in a successful compile due to AIX 6.1 not accepting the "-u" (Unicode) for pod2man. I looked into 5.17 and it looks like the same Makefiles are used in both (doc/Makefile.in and doc/Makefile.am) so perhaps the top-level Makefile for 5.18 adds the ".pod.8" file to the build process. Removing the "-u" in both files enables the build to complete. I just tested against Stunnel 5.19 but it looks like the step that ran "pod2html" was skipped by default (i.e., just "make") so I am able to compile stunnel correctly. Thanks for fixing this in Stunnel 5.19! For those that need the .pod.8 man pages on AIX 6.1, you'll need to remove the "-u" in the pod2man command. Regards, -Rob

2 1

stunnel 5.19 release
by Michal Trojnara 16 Jun '15

16 Jun '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.19 of stunnel. The ChangeLog entry: Version 5.19, 2015.06.16, urgency: MEDIUM: * New features - OpenSSL DLLs updated to version 1.0.2c. - Added a runtime check whether COMP_zlib() method is implemented in order to improve compatibility with the Debian OpenSSL build. * Bugfixes - Improved socket error handling. - Cron thread priority on Win32 platform changed to THREAD_PRIORITY_LOWEST to improve portability. - Makefile bugfixes for stunnel 5.18 regressions. - Fixed some typos in docs and scripts (thx to Peter Pentchev). - Fixed a log level check condition (thx to Peter Pentchev). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 0b543242cf26649acfdd9f00de564c3e8de7ac2237d53935ffdc7eb24f4d556d stunnel-5.19.tar.gz 310fb015c3884dd19a1905ed84d5fbcd1579507c98ee2ba43955aa45311bc056 stunnel-5.19-installer.exe 990e636a869f4de8a55c43e7f2fa24ebbf81c1c221473106e8e6b5d89d720627 stunnel-5.19-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVgCeVAAoJEC78f/DUFuAUi98P/1cPUAg1ehgZkDXIxwIxTt/t sxYOWEmX/ajmimornRygim9HHGPB4HzDMFu1B1qCT01GE4uR+ogYZMYJAdZ+LRua J0wuDawuKgnJvWpdDGnX4Mfz/zUcV8L4T4iJvBnC8xXTQeto7+qU9YTmbYhms4xy u1CPpAXUHnwrNMkI5nqBtB8TSIEeHgmfS456/7oe9Kl+0F8hq7FkZ+1/IYxQOAPC 0drl8A8tfUroBiw+aI2aWJAq2gUoQFVpyAYi7IUBXnmGZ7H1CMcO+KpG+33L0glH oz5DxsuzHyYZYWD1NiKfre4QxMHrT9xXWoNQIHkwgEjDlQXTAqd5rhz9b13TjMmn hiHG3XtF+FvSwFJeTNk/yVYe8ZvjbXUS3BWS65HqTiRKx0iEtkkf2Z1VsieVMUGO LiWvxztz9Z4OSIUWxOFcC8WLTlIDTcIqMM79JLC33o22YSwIRqsE7u5mGiG6yZBN s78ILkqXauxQ1MSDXPArOIZr6iJIqHtuAJbnZvmAQwSKbks/gnzY4WAX0SAw9M64 hhbEnr+zsiRSq30uGrU7fxFHr4MynagEiNaAbNG2kQEJ4nSgHoY0W59dXAuVVYFM UtYgsEeMnPlaBij+ecgmk/xfpEZDQ/phaHtTKzTQUE3JWLkB/VsLz1gwZO1poH8e dOuvm5RULY29YlHcEoM+ =V456 -----END PGP SIGNATURE-----

1 0

Re: [stunnel-users] stunnel 5.18 may keep high CPU usage
by Dod 14 Jun '15

14 Jun '15

Hello Michal, MT> for developers, so don't worry if you don't understand all of the output. After 5 hours of 25% CPU I decided to stunnel (again) with debug=info 2015.06.14 19:15:10 LOG6[cron]: Executing cron jobs 2015.06.14 19:19:39 LOG5[cron]: DH parameters updated 2015.06.14 19:19:39 LOG6[cron]: Cron jobs completed in 269 seconds This time DH calculation ran for 4 minutes, which is the expected behavior. btw I am developer too so no problem with the log file ;-) regards. MT> -----BEGIN PGP SIGNED MESSAGE----- MT> Hash: SHA1 MT> Hi Dod, >> 2015.06.14 10:55:06 LOG5[cron]: DH parameters updated >> >> btw if there is some message to tell about DH calculation >> ended, shouldn't be one to say that DH calculation started ? >> this could be usefull. MT> I have added logging it while replying the previous email. 8-) >> Is there some interesting higher log level I could activate to >> get more (but not too much) logs that may help me to >> understand this strange behavior ? MT> Yes. Use "debug = info" or "debug = debug". The latter is intended MT> for developers, so don't worry if you don't understand all of the output. MT> Best regards, MT> Mike MT> -----BEGIN PGP SIGNATURE----- MT> Version: GnuPG v1 MT> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ MT> iQIcBAEBAgAGBQJVfasGAAoJEC78f/DUFuAU78MP/2WTHetqYubWkhEC9OykxVji MT> rTcps69fyE+904T/sSkRWoEiZFX2MFkQQuIwHsVuRdQecxhfqOGmj5R8xpDJQPBB MT> HsT/G/xgCRqCmWbO0HlQg2Tz5td9gsfIRJi9g1T8dHkImUXQUNC2gcqRowmMvcKx MT> Ly2YF8opHZZwA/p305hjuKM6+ziXn7eLdW0yp24LTfXxZigr0QiWvmMjtxhhJ7P0 MT> UgywVTKFBJ1/mJw1TXArOrk/sFiynooLLbYIEhS2rsyXo9m2UHCIRnbvwI9iXCuz MT> foiTPjFRtkWKSsKkcFXHIRpXD3WP07XjtaIzP2XyyK7JVFAsUQNhIBJBBUATJ18r MT> GtzyRIU/zHbmbL/jem9AJkyuw+eQ5E65QhA5eTI8fAKcceFmCq7Pu/HsN1Zk3enV MT> l6NbHSuY0eyvChQ44dzM4UyiNNMBFJczfmPbM5KdwbvLHHtxvbdlLH81HAe7TmVK MT> JuxHVYHZma9PZ/+19dhScl785Ae1TxoCRab9HeShhC6SFdPZ4HV4mZHleYMNCZvP MT> f7d75qDHQZYxZhunP9xqcsoHdhY1rTO0AWZC9TMER+0jbqCcpdEzMaD2L2F8glP2 MT> PUR2StD1EHlVlpzVZL63EJK0vi91dwI/AUiuoolhPkSRtxEwGUc+eNYKcBru8Ca+ MT> O+3Sq6GcWknVd6xu+fNs MT> =ucCs MT> -----END PGP SIGNATURE----- mailto:dodfr@yahoo.com

1 0

stunnel 5.18 release
by Michal Trojnara 12 Jun '15

12 Jun '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.18 of stunnel. The ChangeLog entry: Version 5.18, 2015.06.12, urgency: MEDIUM: * New features - OpenSSL DLLs updated to version 1.0.2b. https://www.openssl.org/news/secadv_20150611.txt - Added "include" configuration file option to include all configuration file parts located in a specified directory. - Log file is reopened every 24 hours. With "log = overwrite" this feature can be used to prevent filling up disk space. - Temporary DH parameters are refreshed every 24 hours, unless static DH parameters were provided in the certificate file. - Unique initial DH parameters are distributed with each release. - Warnings are logged on potentially insecure authentication. - Improved compatibility with the current OpenSSL 1.1.0-dev tree: removed RLE compression support, etc. - Updated stunnel.spec (thx to Bill Quayle). * Bugfixes - Fixed handling of dynamic connect targets. - Fixed handling of trailing whitespaces in the Content-Length header of the NTLM authentication. - Fixed --sysconfdir and --localstatedir handling (thx to Dagobert Michelsen). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 0532c0a2f8de3da1ab625e384146501ce5936fac63d01561c3a9bf652b692317 stunnel-5.18.tar.gz 9b9a64f30d4dc72f19a2f6482f5bcf76bb67cf3dd859bdd615e0345e1bb8dd41 stunnel-5.18-installer.exe a73befed476f423dee0ff25f38449570fb9f6a07ab90321d9c38e3962f833939 stunnel-5.18-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVeuE3AAoJEC78f/DUFuAU88wP/jfyOCsCBwCcIxNoQhEU5k4d mczXvWtaw0gBrOivrzgBZS0w621D66DGoXt6yMwMp1suWY9spTWZ+VjQJM8oFCul iFwYWyFyxiTOGRFXGCPEff8f4OGbGoxHfDaIrHR5AGvTzguznKTDXzM7cjixqWF9 vL/t08ZjoDWOZIVJuN8M9sVQWn7gzPnyJpvpW2D240aITBx348ZWt/QGqX4yOSzL tQCojXRO6W+rOq0WUdeDFp7CAMB7IZgZsZljqOUn4Q0wHgzuar0Kq1ZLQEkgoX5V lGJ99yZ74/H1RUDcVKGrdksX0atuf6SfzbTvZ/Osp0z7/NlWzhbCt6emYpSLxyzr 2IMX4T8Y593rDovT6AjOb2D4W0sJqAMfUMrs7+T43lYvEbQY8CoEBOH2St5h6X7Y 2ZIa1XMvMmaN08/QyUq6WqxEz0se9BPtUCC+oFjDlGw0oWrqKs1zzJAIpg0HHPOy j1NpBVPnuZz1WlTT/oGLIIVm6w8wATSKthIXstNtofXpSvJ1J94UntC3+0xga7KD SzaOm9w9kpDEtD0EwArLwak5cSevzdXQR4xfmU5OK/UohsdyTLBOab6iY3htmokk JOWIKZztATN7dq8YGvMfJvIiM1ij8Eg14wsahlwfwMZ+eGSvS5lTWvYsSirnnNFi XTrCfpnrKgrfLkUXhbtH =CdmE -----END PGP SIGNATURE-----

1 0

TLS version
by Deepak Subbanarasimha 11 Jun '15

11 Jun '15

Does Stunnel version 4.1 support sslVersion "TLSv1.2 " and above? If not, what version of stunnel supports "TLSv1.2" Thanks, DEEPAK SUBBANARASIMHA Kewill DDI: +00 (1) 978 482 2625 Email: deepak.subbanarasimha(a)kewill.com<mailto:deepak.subbanarasimha@kewill.com> www.kewill.com<http://www.kewill.com/> Tel: +00 (1) 978 482 2500 | Fax: +00 (1) 978 482 2501 1 Executive Drive, Chelmsford, MA 01824, USA IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately notify us by telephone at (978) 482-2500 and return the original message to us at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code. Thank You. Copyright (c) 2013 by Kewill Inc IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately return the original message to the sender at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Although Kewill takes reasonable precautions to minimize the risk, Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code.

2 1

INTERNAL ERROR: s_poll_wait returned 1, but no descriptor is ready
by Florian Gossin 10 Jun '15

10 Jun '15

HI, I'm trying to setup a connection from JDBC to pgbouncer through stunnel. Unfortunately, I get the above error message when I try to connect. Here are the logs from stunnel: 2015.06.09 16:56:13 LOG7[3]: SSL state (accept): SSLv3 read client certificate A 2015.06.09 16:56:13 LOG7[3]: SSL state (accept): SSLv3 read client key exchange A 2015.06.09 16:56:13 LOG7[3]: SSL state (accept): SSLv3 read certificate verify A 2015.06.09 16:56:13 LOG7[3]: SSL state (accept): SSLv3 read finished A 2015.06.09 16:56:13 LOG7[3]: SSL state (accept): SSLv3 write change cipher spec A 2015.06.09 16:56:13 LOG7[3]: SSL state (accept): SSLv3 write finished A 2015.06.09 16:56:13 LOG7[3]: SSL state (accept): SSLv3 flush data 2015.06.09 16:56:13 LOG7[3]: 4 server accept(s) requested 2015.06.09 16:56:13 LOG7[3]: 4 server accept(s) succeeded 2015.06.09 16:56:13 LOG7[3]: 0 server renegotiation(s) requested 2015.06.09 16:56:13 LOG7[3]: 0 session reuse(s) 2015.06.09 16:56:13 LOG7[3]: 3 internal session cache item(s) 2015.06.09 16:56:13 LOG7[3]: 0 internal session cache fill-up(s) 2015.06.09 16:56:13 LOG7[3]: 0 internal session cache miss(es) 2015.06.09 16:56:13 LOG7[3]: 0 external session cache hit(s) 2015.06.09 16:56:13 LOG7[3]: 0 expired session(s) retrieved 2015.06.09 16:56:13 LOG6[3]: SSL accepted: new session negotiated 2015.06.09 16:56:13 LOG6[3]: Negotiated TLSv1 ciphersuite ECDHE-RSA-AES256-SHA (256-bit encryption) 2015.06.09 16:56:13 LOG7[3]: Compression: null, expansion: null 2015.06.09 16:56:13 LOG6[3]: Failover strategy: round-robin 2015.06.09 16:56:13 LOG6[3]: s_connect: connecting 127.0.0.1:46432 2015.06.09 16:56:13 LOG7[3]: s_connect: s_poll_wait 127.0.0.1:46432: waiting 10 seconds 2015.06.09 16:56:13 LOG5[3]: s_connect: connected 127.0.0.1:46432 2015.06.09 16:56:13 LOG5[3]: Service [pgbouncer-client] connected remote server from 127.0.0.1:54633 2015.06.09 16:56:13 LOG7[3]: Remote socket (FD=9) initialized 2015.06.09 16:56:13 LOG6[3]: Read socket closed (read hangup) 2015.06.09 16:56:13 LOG7[3]: Sending close_notify alert 2015.06.09 16:56:13 LOG7[3]: SSL alert (write): warning: close notify 2015.06.09 16:56:13 LOG6[3]: SSL_shutdown successfully sent close_notify alert 2015.06.09 16:56:13 LOG3[3]: INTERNAL ERROR: s_poll_wait returned 1, but no descriptor is ready 2015.06.09 16:56:13 LOG5[3]: Connection reset: 58 byte(s) sent to SSL, 164 byte(s) sent to socket 2015.06.09 16:56:13 LOG7[3]: Remote socket (FD=9) closed 2015.06.09 16:56:13 LOG7[3]: Local socket (FD=8) closed 2015.06.09 16:56:13 LOG7[3]: Service [pgbouncer-client] finished (0 left) In pgbouncer, I get the following error: Pooler Error: bad packet header: '70' And in JDBC, the following exception: GRAVE: ERROR: bad packet header: '70' org.postgresql.util.PSQLException: ERROR: bad packet header: '70' Where might be the problem ? Does the stunnel parameter protocol=pgsql work with JDBC ? Thank you

2 1

How to tell what Ciphers are supported?
by Del Benjamin 06 Jun '15

06 Jun '15

I am using the pre-compiled windows binary version of stunnel in client mode, how do I tell on that version what cipher versions I can use? Essentially the equivalent of this command in openssl *openssl* *ciphers* [*-s*] [*-v*] [*-V*] [*-ssl3*] [*-tls1*] [*-stdname*] [ *cipherlist*]

2 2

Rework "Honor --sysconfdir and --localstatedir in stunnel.conf-sample.in"
by Dagobert Michelsen 01 Jun '15

01 Jun '15

Hi, I took the liberty of reworking the patch presented in http://www.stunnel.org/pipermail/stunnel-users/2010-July/002711.html to fix the issues raised in http://www.stunnel.org/pipermail/stunnel-users/2010-August/002719.html The main reason why the substitution didn't work is because it should not be done during configure-time but inside the Makefile as described in the Autoconf manual http://www.gnu.org/savannah-checkouts/gnu/autoconf/manual/autoconf-2.69/htm… The patch is attached to this email or you can browse the patch at https://github.com/dago/stunnel/compare/master...sysconfdir The patch is against 5.18b3 (is there a public repo available to make patches?) It would be great if the change could be applied. Best regards -- Dago

2 6

Incompatibility - Content-length parsing
by Marcin Gryszkalis 25 May '15

25 May '15

Hi, I noticed that parsing of HTTP header fields is not robust enough and not RFC compliant - and that way it casues incompatibility with Microsoft TMG proxy with NTLM authentication. The symptom is "Proxy-Authenticate: Invalid Content-Length" message while the header received is "Content-Length: 0 " <- note trailing spaces. The responsible piece of code is in protocol.c: if(tmpstr==line+16 || *tmpstr || content_length<0) { (tmpstr contains trailing spaces in this case). According to RFC 7230 trailing space is allowed and should be discarded by parser: A field value might be preceded and/or followed by optional whitespace (OWS); a single SP preceding the field-value is preferred for consistent readability by humans. The field value does not include any leading or trailing whitespace: OWS occurring before the first non-whitespace octet of the field value or after the last non-whitespace octet of the field value ought to be excluded by parsers when extracting the field value from a header field. best regards -- Marcin Gryszkalis, PGP 0xA5DBEEC7 jabber jid:mg@fork.pl

2 3

Compiling for Android
by Pio Tofanelli 21 May '15

21 May '15

Hi, I'm new to stunnel and I'd like to compile it to ARM and x86 platforms. I downloaded the stunnel-5.17 package and I'm using the build-android.sh and android-ndk-r10e script to compile it: ../../configure --with-sysroot=/home/ptofanelli/android-ndk-r10e/platforms/android-18/arch-arm/ --build=i686-pc-linux-gnu --host=arm-linux-androideabi --prefix=/data/local I'm getting the message "The C compiler cannot create executables" and checking the logs I've found that the problem is this: configure:3538: arm-linux-androideabi-gcc conftest.c >&5 /home/ptofanelli/android-ndk-r10e/toolchains/arm-linux-androideabi-4.8/prebuilt/linux-x86/bin/../lib/gcc/arm-linux-androideabi/4.8/../../../../arm-linux-androideabi/bin/ld: error: cannot open crtbegin_dynamic.o: No such file or directory /home/ptofanelli/android-ndk-r10e/toolchains/arm-linux-androideabi-4.8/prebuilt/linux-x86/bin/../lib/gcc/arm-linux-androideabi/4.8/../../../../arm-linux-androideabi/bin/ld: error: cannot open crtend_android.o: No such file or directory /home/ptofanelli/android-ndk-r10e/toolchains/arm-linux-androideabi-4.8/prebuilt/linux-x86/bin/../lib/gcc/arm-linux-androideabi/4.8/../../../../arm-linux-androideabi/bin/ld: error: cannot find -lc /home/ptofanelli/android-ndk-r10e/toolchains/arm-linux-androideabi-4.8/prebuilt/linux-x86/bin/../lib/gcc/arm-linux-androideabi/4.8/../../../../arm-linux-androideabi/bin/ld: error: cannot find -ldl collect2: error: ld returned 1 exit status I searched for this problem and a topic in stackoverflow ( http://stackoverflow.com/questions/16795583/android-error-cannot-open-crtbe…) is said that the problem is the sysroot, so I tried to use the option --with-sysroot, but I'm getting the same problem. Can you help me? Thanks and regards, Pio Tofanelli

1 0

Stunnel not working with Office 365
by Hannu Viitala 19 May '15

19 May '15

Hi, We cannot get stunnel SMTP to work with Office 365 mail server. We are using Stunnel 5.13 and below are the config file content and the the client PC logs. The mail server logs do not reveal anything more. Two observations of the test setup: 1) Using e.g. Mozilla Firebird mail client directly SLL/SMTP on the same PC connection to same Office 365 mail server works ok, but via Stunnel it outputs the error log below. 2) Also, on the same PC, SSL/SMTP connection via stunnel to Gmail server works ok. Stunnel conf-file: ============== output = stunnel_log.txt debug = debug cert = tstunnel.pem client = yes [SSMTP] accept = 127.0.0.1:54500 connect = xxx.xxx.xxx.xxx:587 (Hannu V: removed IP address from this mail) protocol = smtp Client PC logs: =========== 2015.04.28 09:17:36 LOG7[ui]: No limit detected for the number of clients 2015.04.28 09:17:36 LOG5[ui]: stunnel 5.13 on x86-pc-msvc-1500 platform 2015.04.28 09:17:36 LOG5[ui]: Compiled/running with OpenSSL 1.0.2a 19 Mar 2015 2015.04.28 09:17:36 LOG5[ui]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2015.04.28 09:17:36 LOG7[ui]: errno: (*_errno()) 2015.04.28 09:17:36 LOG5[ui]: Reading configuration from file tstunnelSmtp_SAUX1_0.conf 2015.04.28 09:17:36 LOG5[ui]: UTF-8 byte order mark not detected 2015.04.28 09:17:36 LOG5[ui]: FIPS mode disabled 2015.04.28 09:17:36 LOG7[ui]: Compression disabled 2015.04.28 09:17:36 LOG7[ui]: PRNG seeded successfully 2015.04.28 09:17:36 LOG6[ui]: Initializing service [SSmtp] 2015.04.28 09:17:36 LOG6[ui]: Loading certificate from file: tstunnel.pem 2015.04.28 09:17:36 LOG6[ui]: Loading key from file: tstunnel.pem 2015.04.28 09:17:36 LOG7[ui]: Private key check succeeded 2015.04.28 09:17:36 LOG7[ui]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2015.04.28 09:17:36 LOG5[ui]: Configuration successful 2015.04.28 09:17:36 LOG7[ui]: Listening file descriptor created (FD=448) 2015.04.28 09:17:36 LOG7[ui]: Service [SSmtp] (FD=448) bound to 127.0.0.1:8030 2015.04.28 09:17:36 LOG7[ui]: Service [SSmtp] accepted (FD=456) from 127.0.0.1:54500 2015.04.28 09:17:36 LOG7[ui]: Creating a new thread 2015.04.28 09:17:36 LOG7[ui]: New thread created 2015.04.28 09:17:36 LOG7[0]: Service [SSmtp] started 2015.04.28 09:17:36 LOG5[0]: Service [SSmtp] accepted connection from 127.0.0.1:54500 2015.04.28 09:17:36 LOG6[0]: s_connect: connecting xxx.xxx.xxx.xxx:587 (Hannu V: removed IP address from this mail) 2015.04.28 09:17:36 LOG7[0]: s_connect: s_poll_wait connecting xxx.xxx.xxx.xxx:587 : waiting 10 seconds (Hannu V: removed IP address from this mail) 2015.04.28 09:17:37 LOG5[0]: s_connect: connected connecting xxx.xxx.xxx.xxx:587 (Hannu V: removed IP address from this mail) 2015.04.28 09:17:37 LOG5[0]: Service [SSmtp] connected remote server from yyy.yyy.yyy.yyy:54503 (Hannu V: removed IP address from this mail) 2015.04.28 09:17:37 LOG7[0]: Remote socket (FD=472) initialized 2015.04.28 09:17:37 LOG7[0]: <- 220 NNN.outlook.office365.com Microsoft ESMTP MAIL Service ready at Tue, 28 Apr 2015 14:17:38 +0000 2015.04.28 09:17:37 LOG7[0]: -> 220 NNN.outlook.office365.com Microsoft ESMTP MAIL Service ready at Tue, 28 Apr 2015 14:17:38 +0000 2015.04.28 09:17:37 LOG7[0]: -> EHLO localhost 2015.04.28 09:17:37 LOG7[0]: <- 250-NNN.outlook.office365.com Hello [xxx.xxx.xxx.161] (Hannu V: removed IP address from this mail) 2015.04.28 09:17:37 LOG7[0]: <- 250-SIZE 157286400 2015.04.28 09:17:37 LOG7[0]: <- 250-PIPELINING 2015.04.28 09:17:37 LOG7[0]: <- 250-DSN 2015.04.28 09:17:37 LOG7[0]: <- 250-ENHANCEDSTATUSCODES 2015.04.28 09:17:37 LOG7[0]: <- 250-STARTTLS 2015.04.28 09:17:37 LOG7[0]: <- 250-8BITMIME 2015.04.28 09:17:37 LOG7[0]: <- 250-BINARYMIME 2015.04.28 09:17:37 LOG7[0]: <- 250 CHUNKING 2015.04.28 09:17:37 LOG7[0]: -> STARTTLS 2015.04.28 09:17:37 LOG7[0]: <- 220 2.0.0 SMTP server ready 2015.04.28 09:17:37 LOG6[0]: SNI: sending servername: NNN.office365.com 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): before/connect initialization 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv2/v3 write client hello A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 read server hello A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 read server certificate A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 read server key exchange A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 read server certificate request A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 read server done A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 write client certificate A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 write client key exchange A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 write certificate verify A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 write change cipher spec A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 write finished A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 flush data 2015.04.28 09:17:37 LOG3[0]: SSL_connect: Peer suddenly disconnected 2015.04.28 09:17:37 LOG5[0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2015.04.28 09:17:37 LOG7[0]: Remote socket (FD=472) closed 2015.04.28 09:17:37 LOG7[0]: Local socket (FD=456) closed 2015.04.28 09:17:37 LOG7[0]: Service [SSmtp] finished (0 left) --- Hannu

2 1

Authentication methods
by Michal Trojnara 15 May '15

15 May '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, While reading various 3rd party stunnel tutorials I noticed that they either don't configure authentication, or they recommend insecure configurations. I wrote a short overview of authentication methods available in stunnel: https://www.stunnel.org/auth.html Proper authentication is essential to TLS security. Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJVVXk5AAoJEC78f/DUFuAUN/QP/3m4HX4zWS8SehukDNWw54AB ySAT+XmT8SEo/iuGer/CRYbUWoMDpmwaI9x+whXMg+EBsxGd+nmyE9fkFiFSqOsV vnXc14zuMkQYorWbGtduXdnQ0/jQzWPDOIeKgpyXIsN/OvEhx1A6med9Go/SqaFz couW55wysqpJ9a+3YMtxIjLoCMzIGOZ8TKIHWJiZaBcgp93YCABeoE5hKR4RlxVj OrgHhuyA8yz1EIYUPKTEMuJwqnCl9Mk3FVskKIXgfEcxBzism2n/xJpEIYAWVPRW N8JaaZDojk6dt5oMiMzXUeobigZ82SKuV9MG3aQjuxXAP7IX2vuOa6rQ/85T1OFI PMZMKENM1aAcOVpiq/4OMNKhIG+OuhDm/dla5NC8lsfxDuJ3YESVp/Z0VeW1EWYA BFHxjGw8OA65izTYcvJKl1j7flfSgRELOCf1SMakR+VIUhkWlPQjdHWuW2V5NKgv 5aU0fwPGEpudKdsLFzgaYzhVPjTNfavl8k+xUWHOQyrNvEM9SNbOTyorxY7QA2aQ uyAOrUF8whboBTX59/3gXYI9vaepvT00ktCtQEz3XelkYT9SzCRYV+I+mUqquBd+ 0JQdiSMvOzfNraxT03rzYA6h/Iey9+tj9WnffpmYU5eyTt2bCp+xavzCyEmdQZlq 4LfAPgFYII9+59444dY2 =m51O -----END PGP SIGNATURE-----

1 0

Stunnel4 not working?
by David H. Durgee 13 May '15

13 May '15

Given a lack of other suggestions here and elsewhere that yielded any progress, I decided to download the current source and attempt to build it on my system. I didn't see a routine to check for prerequisites being met, so I wound up running ./configure several times and adding the libssl-dev, libwrap0-dev and libsystemd-daemon-dev packages based on what I saw in the output. Perhaps a check routine could be added later? I then ran make and the output contains neither errors nor warnings, so that looks good. As suggested in the INSTALL file, I next ran make check and received neither errors nor warnings. At this point the next step appears to be make install as root, but I am wondering if I should uninstall the stunnel4 package from the repository first. I am also wondering if I can simply use the existing /etc/stunnel/stunnel.conf that I included in my first post in this thread or if I should start over with one of the examples included with this version. I would appreciate input from the list on this. If you want to see further details, such as ./configure or make outputs or configuration files just let me know and I will put them in a follow-up post. Dave

2 1

Re: [stunnel-users] Stunnel 5.17 on AIX
by Eckert, Doug 13 May '15

13 May '15

Thanks! I applied the patch to tls.c and I'm able to create sessions with no problem. The version of OpenSSL provided by IBM is built off the 1.0.1e codebase, with backported security fixes via "iFixes" for announced CVEs. They apparently don't backport new functionality or maybe even non-CVE bugfixes. I'm guessing an un-patched stunnel 5.17 would work once/if they release OpenSSL built off 1.0.1j or later. > On Tue, May 12, 2015 at 3:40 PM, Michal Trojnara <Michal.Trojnara(a)mirt.net > > wrote: > >> On 12.05.2015 18:29, Eckert, Doug wrote: >> > With that in mind, I compiled stunnel v5.03 with same OpenSSL 1.0.1.513 >> > and iFix IV71446m9a applied as with the v5.17 attempt. I'm able to >> > create sessions with no problem. The internal error/bad magic does not >> > occur. >> >> Additional security checks to the OpenSSL memory management functions >> were introduced in stunnel 5.09. The enclosed patch disables them in >> the latest stunnel 5.17. >> >> Mike >> >> _______________________________________________ >> stunnel-users mailing list >> stunnel-users(a)stunnel.org >> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >> >> > > > -- > > > >

1 0

Stunnel 5.17 on AIX
by Eckert, Doug 12 May '15

12 May '15

I've gotten v5.17 compiled on AIX 5.3 & 6.1 with the following xlccmp.13.1.0 13.1.0.3 COMMITTED XL C compiler openssl.base 1.0.1.513 COMMITTED Open Secure Socket Layer IV71446m9a Ifix for Openssl CVE Everything seems to have compiled fine. I packaged it up, installed, and set up a quick config. The server side aborts on me. Debug output follows. Need some direction on where to look next. Thanks in advance! 2015.05.06 12:08:03 LOG7[ui]: Clients allowed=31999 2015.05.06 12:08:03 LOG5[ui]: stunnel 5.17 on powerpc-ibm-aix5.3.0.0 platform 2015.05.06 12:08:03 LOG5[ui]: Compiled/running with OpenSSL 1.0.1e 11 Feb 2013 2015.05.06 12:08:03 LOG5[ui]: Threading:PTHREAD Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI 2015.05.06 12:08:03 LOG7[ui]: errno: (*_Errno()) 2015.05.06 12:08:03 LOG5[ui]: Reading configuration from file /opt/freeware/etc/stunnel/stunnel.conf 2015.05.06 12:08:03 LOG5[ui]: UTF-8 byte order mark not detected 2015.05.06 12:08:03 LOG7[ui]: Compression disabled 2015.05.06 12:08:03 LOG7[ui]: Snagged 64 random bytes from //.rnd 2015.05.06 12:08:03 LOG7[ui]: Wrote 1024 new random bytes to //.rnd 2015.05.06 12:08:03 LOG7[ui]: PRNG seeded successfully 2015.05.06 12:08:03 LOG6[ui]: Initializing service [client] 2015.05.06 12:08:03 LOG6[ui]: Loading certificate from file: /usr/share/ssl/certs/skdkgesaix53-client-cert.pem 2015.05.06 12:08:03 LOG6[ui]: Loading key from file: /usr/share/ssl/certs/skdkgesaix53-client-key.pem 2015.05.06 12:08:03 LOG7[ui]: Private key check succeeded 2015.05.06 12:08:03 LOG7[ui]: Verify directory set to /usr/share/ssl/certs 2015.05.06 12:08:03 LOG7[ui]: Added /usr/share/ssl/certs revocation lookup directory 2015.05.06 12:08:03 LOG6[ui]: Peer certificate location /usr/share/ssl/certs 2015.05.06 12:08:03 LOG7[ui]: SSL options: 0x01000004 (+0x03000000, -0x02000000) 2015.05.06 12:08:03 LOG6[ui]: Initializing service [server] 2015.05.06 12:08:03 LOG6[ui]: Loading certificate from file: /usr/share/ssl/certs/skdkgesaix53-server-cert.pem 2015.05.06 12:08:03 LOG6[ui]: Loading key from file: /usr/share/ssl/certs/skdkgesaix53-server-key.pem 2015.05.06 12:08:03 LOG7[ui]: Private key check succeeded 2015.05.06 12:08:03 LOG7[ui]: Verify directory set to /usr/share/ssl/certs 2015.05.06 12:08:03 LOG7[ui]: Added /usr/share/ssl/certs revocation lookup directory 2015.05.06 12:08:03 LOG6[ui]: Peer certificate location /usr/share/ssl/certs 2015.05.06 12:08:03 LOG7[ui]: DH initialization 2015.05.06 12:08:03 LOG7[ui]: Could not load DH parameters from /usr/share/ssl/certs/skdkgesaix53-server-cert.pem 2015.05.06 12:08:03 LOG7[ui]: Using hardcoded DH parameters 2015.05.06 12:08:03 LOG7[ui]: DH initialized with 2048-bit key 2015.05.06 12:08:03 LOG7[ui]: ECDH initialization 2015.05.06 12:08:03 LOG7[ui]: ECDH initialized with curve prime256v1 2015.05.06 12:08:03 LOG7[ui]: SSL options: 0x01004004 (+0x03004000, -0x02000000) 2015.05.06 12:08:03 LOG5[ui]: Configuration successful 2015.05.06 12:08:03 LOG7[ui]: Listening file descriptor created (FD=7) 2015.05.06 12:08:03 LOG7[ui]: Service [client] (FD=7) bound to 127.0.0.1:22 2015.05.06 12:08:03 LOG7[ui]: Listening file descriptor created (FD=8) 2015.05.06 12:08:03 LOG7[ui]: Service [server] (FD=8) bound to 172.26.85.13:2222 2015.05.06 12:08:04 LOG7[main]: Created pid file /var/pid/stunnel.pid 2015.05.06 12:08:29 LOG7[main]: Service [server] accepted (FD=3) from 172.26.85.14:52649 2015.05.06 12:08:29 LOG7[0]: Service [server] started 2015.05.06 12:08:29 LOG5[0]: Service [server] accepted connection from 172.26.85.14:52649 2015.05.06 12:08:29 LOG7[0]: SSL state (accept): before/accept initialization 2015.05.06 12:08:29 LOG7[0]: SNI: no virtual services defined 2015.05.06 12:08:29 LOG7[0]: SSL state (accept): SSLv3 read client hello A 2015.05.06 12:08:29 LOG7[0]: SSL state (accept): SSLv3 write server hello A 2015.05.06 12:08:29 LOG7[0]: SSL state (accept): SSLv3 write certificate A INTERNAL ERROR: Bad magic at tls.c, line 182 --Doug

2 4

Stunnel4 not working?
by David H. Durgee 09 May '15

09 May '15

> Please see highlighted below: > > On Fri, May 8, 2015 at 5:27 PM, David H. Durgee <dhdurgee at verizon.net <https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users>> > wrote: > > >/ At some point in the near past stunnel stopped working on my laptop. The > />/ laptop is running Linux Mint 17.1 Rebecca x64 and stunnel from the > />/ repositories. I enabled debug=7, but I am not getting much from the log: > />/ > />/ > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Clients allowed=500 > />/ > />/ > />/ > />/ *2015.05.08 17 <2015.05.08%2017>:12:06 LOG5[10804:140318864611136]: > />/ stunnel 4.53 on x86_64-pc-linux-gnu platform 2015.05.08 17 > />/ <2015.05.08%2017>:12:06 LOG5[10804:140318864611136]: Compiled with OpenSSL > />/ 1.0.1e 11 Feb 2013 2015.05.08 17 <2015.05.08%2017>:12:06 > />/ LOG5[10804:140318864611136]: Running with OpenSSL 1.0.1f 6 Jan 2014 > />/ 2015.05.08 17 <2015.05.08%2017>:12:06 LOG5[10804:140318864611136]: Update > />/ OpenSSL shared libraries or rebuild stunnel* > / > > Is there a reason that you're using libraries from a different compiled > Stunnel? In fact, isn't there another Stunnel package you can use that is > more up-to-date? If not, perhaps compile your own using the OpenSSL > libraries that comes with Mint. I am using the package from the Mint repository, which in this case is the Ubuntu Trusty repository. If you know of a repository I can add with a more current package I will do so. If necessary I guess I could build from source, but I don't do that often and would prefer to locate a binary. > >/ > />/ 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Threading:PTHREAD > />/ SSL:+ENGINE+OCSP Auth:LIBWRAP Sockets:POLL+IPv6 > />/ 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Reading configuration > />/ from file /etc/stunnel/stunnel.conf > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Compression not enabled > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: PRNG seeded successfully > />/ 2015.05.08 17:12:06 LOG6[10804:140318864611136]: Initializing service > />/ section [telnets] > />/ *2015.05.08 17 <2015.05.08%2017>:12:06 LOG4[10804:140318864611136]: > />/ Insecure file permissions on /etc/ssl/certs/stunnel.pem* > / > > Warning: the permissions may be too wide-open (should be 700 I assume) > > > >/ > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate: > />/ /etc/ssl/certs/stunnel.pem > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate loaded > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Key file: > />/ /etc/ssl/certs/stunnel.pem > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Private key loaded > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: SSL options set: > />/ 0x00000004 > />/ 2015.05.08 17:12:06 LOG6[10804:140318864611136]: Initializing service > />/ section [dsp3270s] > />/ *2015.05.08 17 <2015.05.08%2017>:12:06 LOG4[10804:140318864611136]: > />/ Insecure file permissions on /etc/ssl/certs/stunnel.pem* > / > > Same as above, perhaps too wide open, permissions should be 700 I assume. > > > >/ > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate: > />/ /etc/ssl/certs/stunnel.pem > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate loaded > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Key file: > />/ /etc/ssl/certs/stunnel.pem > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Private key loaded > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: SSL options set: > />/ 0x00000004 > />/ 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Configuration successful > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Service [telnets] > />/ (FD=12) bound to 0.0.0.0:3141 > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Service [dsp3270s] > />/ (FD=13) bound to 0.0.0.0:7490 > />/ 2015.05.08 17:12:06 LOG7[10810:140318864611136]: Created pid file > />/ /stunnel4.pid > />/ 2015.05.08 17:12:31 LOG7[10810:140318864611136]: Service [telnets] > />/ accepted (FD=3) from 127.0.0.1:40090 > />/ 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Service [telnets] started > />/ 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Waiting for a libwrap > />/ process > />/ 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Acquired libwrap process > />/ #0 > />/ > />/ > />/ *2015.05.08 17 <2015.05.08%2017>:12:31 LOG3[10810:140318864770816]: > />/ Unexpected socket close (read_blocking) 2015.05.08 17 > />/ <2015.05.08%2017>:12:31 LOG5[10810:140318864770816]: Connection reset: 0 > />/ byte(s) sent to SSL, 0 byte(s) sent to socket 2015.05.08 17 > />/ <2015.05.08%2017>:12:31 LOG7[10810:140318864770816]: Local socket (FD=3) > />/ closed* > / > > that sounds like SELinux permissions perhaps? Have you tried temporarily > disabling SELinux, or perhaps you have a firewall (iptables) set up? You'll > have to allow the incoming port and possibly an entry in /etc/services > IIRC. I don't know if this helps but this is what I found: > https://sites.google.com/site/easylinuxtipsproject/security > A link to "ufw" may prove useful, if your system has that installed. Most > systems have locked-down privileged ports (any port less than 1024, like in > your example). I do have ufw here, but I have the same problem with it enabled or disabled. The telnets service is listening on port 3141 and the dsp3270s on port 7490, so neither of them are privileged ports. > >/ > />/ 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Service [telnets] > />/ finished (0 left) > />/ 2015.05.08 17:12:31 LOG7[10810:140318864770816]: str_stats: 1 block(s), > />/ 32 data byte(s), 58 control byte(s) > />/ 2015.05.08 17:13:32 LOG7[10810:140318864611136]: Service [dsp3270s] > />/ accepted (FD=3) from 127.0.0.1:48534 > />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Service [dsp3270s] > />/ started > />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Waiting for a libwrap > />/ process > />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Acquired libwrap process > />/ #1 > />/ *2015.05.08 17 <2015.05.08%2017>:13:32 LOG3[10810:140318864770816]: > />/ Unexpected socket close (read_blocking)* > />/ > / > That sounds like some kind of firewall issue (like above). As noted above, same behavior with ufw enabled or disabled. > >/ 2015.05.08 17:13:32 LOG5[10810:140318864770816]: Connection reset: 0 > />/ byte(s) sent to SSL, 0 byte(s) sent to socket > />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Local socket (FD=3) > />/ closed > />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Service [dsp3270s] > />/ finished (0 left) > />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: str_stats: 1 block(s), > />/ 32 data byte(s), 58 control byte(s) > />/ > />/ > / When in a situation like this, I would first try unprivileged ports with > localhost using iperf, just to generate some dummy traffic. A good > technique I use when debugging stunnel versus debugging networking or other > security issues is to do local traffic only like this: > > 1. iperf client connect to localhost port 5000 > 2. Stunnel client listen on port 5000, connect to localhost port 6000 > 3. Stunnel server listen on port 6000, connect to localhost port 7000 > 4. iperf server listening on localhost port 7000 > > As you can see from that, running iperf client for a few seconds, it should > be able to connect to the iperf server. If not, stunnel is not working. > Debug this FIRST before proceeding to working with non-localhost IP > addresses. The actual procedure would be as follows: > > 1. Download/install iperf > 2. Verify iperf works by having one shell run as server, listening on > localhost port 7000, and another shell setup iperf client sending on port > 7000. If that works, then proceed. Don't use iperf to connect to port 7000 > again. > 3. Set up two config files, one for stunnel client and one for stunnel > server, with different ports and the "client=yes" in the client config > file. For easier detection with "ps" or "top", you can copy the executable > file to another name (i.e., "s4client" for the stunnel 4 client, and > "s4server" for the stunnel 4 server). Similarly for iperf, you can copy the > exe to "iperfc" and "iperfs" for iperf server, for easier process detection. > 4. Start up the stunnel server first, then stunnel client, with the > appropriate config files per the port enumeration mentioned above. > 5. Start iperf server listening on port 7000. > 6. Start iperf client sending on port 5000. If you get some really large > value or nothing, then your stunnel config (client/server) needs to be > debugged first before proceeding to non-localhost IPs. I usually get > something like 3GB/sec when using a Windows 7 VM inside Windows 7 doing > this from DOS prompts with appropriate server/client configs set up. I > usually use four windows: two for iperf (c/s), two for stunnel (c/s). > > Hope that helps... > -Rob I have an stunnel server on another system on the LAN and that is the one I am having the client with the problem connect to while trying to find the problem. I know that server is working, as I have seen other incoming traffic handled by it. I suspect the problem is related to the message you pointed out that I missed about SSL libraries. I would very much appreciate a pointer to a more current package in a repository. Thanks for your response, Rob. Dave

1 0

Stunnel 5.17 build on AIX - libssp missing
by Rob Lockhart 09 May '15

09 May '15

I have AIX 6.1 (64-bit) with GCC 4.2.0. It has an older version of OpenSSL (0.9.8) installed from IBM but I'm trying to compile Stunnel 5.17 with OpenSSL 1.0.2a-fips as non-root. I proceed as follows: cd ~; [ -d openssl ] && rm -rf openssl; mkdir openssl cd ~/OpenSSL; [ -d openssl-fips-2.0.9 ] && rm -rf openssl-fips-2.0.9 gzip -dc openssl-fips-2.0.9.tar.gz | tar xvf - cd openssl-fips-2.0.9; chmod 755 Configure ./Configure aix64-gcc --openssldir=$HOME/openssl make make install NOTE: the above is just the FIPS canister (library), not the executable. cd ~/OpenSSL; [ -d openssl-1.0.2a ] && rm -rf openssl-1.0.2a gzip -dc openssl-1.0.2a.tar.gz | tar xvf - cd openssl-1.0.2a; chmod 755 Configure ./Configure aix64-gcc fips shared --openssldir=$HOME/openssl --with-fipsdir=$HOME/openssl make depend make make test make install cd ~/openssl/bin; ./openssl version; ./openssl speed NOTE: Look for "ALL OCSP TESTS SUCCESSFUL" after "make test" to verify the test build was successful, and it was. NOTE: "./openssl version" should show "OpenSSL 1.0.2a-fips 19 Mar 2015" NOTE: "./openssl speed" should take a while as it's measuring the speed for all algorithms Final test of OpenSSL 1.0.2a-fips: ./openssl sha1 -hmac etaonrishdlcupfm ~/OpenSSL/openssl-fips-2.0.9.tar.gz - should return: 54552e9a3ed8d1561341e8945fcdec55af961322 Now, I try to compile Stunnel: rm -rf $HOME/stunnel-bin; mkdir $HOME/stunnel-bin cd ~/Stunnel; [ -f stunnel-5.17 ] && rm -rf stunnel-5.17 gzip -dc stunnel-5.17.tar.gz | tar xvf - ; cd stunnel-5.17 ./configure --enable-fips --prefix=$HOME/stunnel-bin --with-ssl=$HOME/openssl make I get a failure at make for a library not found: /bin/sh ../libtool --tag=CC --mode=link gcc -g -O2 -D_THREAD_SAFE -Wall -Wextra -Wformat=2 -Wconversion -Wno-long-long -Wno-deprecated-declarations -fstack-protector -fPIE -D_FORTIFY_SOURCE=2 -L/home/lockharr/openssl/lib64 -L/home/lockharr/openssl/lib -lssl -lcrypto -o stunnel stunnel-tls.o stunnel-str.o stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-fd.o stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o stunnel-ui_unix.o -lpthreads libtool: link: gcc -g -O2 -D_THREAD_SAFE -Wall -Wextra -Wformat=2 -Wconversion -Wno-long-long -Wno-deprecated-declarations -fstack-protector -fPIE -D_FORTIFY_SOURCE=2 -o stunnel stunnel-tls.o stunnel-str.o stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-fd.o stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o stunnel-ui_unix.o -L/home/lockharr/openssl/lib64 -L/home/lockharr/openssl/lib -lssl -lcrypto -lpthreads collect2: library libssp_nonshared not found The interesting part is that doing a "grep -R libssp" of the source tree only shows one reference to libssp: $ grep -R libssp * stunnel-5.17/tools/stunnel.nsi: # MINGW builds requires libssp-0.dll instead of msvcr90.dll Googling showed some really old links that had libssp skipped for GCC on AIX: http://gcc.gnu.org/ml/gcc-patches/2005-09/msg01231.html and another that added it back in: http://marc.info/?l=gcc-patches&m=130168534803966 Can anyone who has compiled this for AIX give me a clue about what's going on? This looks like a reference to a non-existent library but I would think that if GCC needed that, it wouldn't allow the RPM for GCC to be installed. Thanks, -Rob

2 1

Stunnel4 not working?
by David H. Durgee 08 May '15

08 May '15

At some point in the near past stunnel stopped working on my laptop. The laptop is running Linux Mint 17.1 Rebecca x64 and stunnel from the repositories. I enabled debug=7, but I am not getting much from the log: 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Clients allowed=500 2015.05.08 17:12:06 LOG5[10804:140318864611136]: stunnel 4.53 on x86_64-pc-linux-gnu platform 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Compiled with OpenSSL 1.0.1e 11 Feb 2013 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Running with OpenSSL 1.0.1f 6 Jan 2014 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Update OpenSSL shared libraries or rebuild stunnel 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Threading:PTHREAD SSL:+ENGINE+OCSP Auth:LIBWRAP Sockets:POLL+IPv6 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Reading configuration from file /etc/stunnel/stunnel.conf 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Compression not enabled 2015.05.08 17:12:06 LOG7[10804:140318864611136]: PRNG seeded successfully 2015.05.08 17:12:06 LOG6[10804:140318864611136]: Initializing service section [telnets] 2015.05.08 17:12:06 LOG4[10804:140318864611136]: Insecure file permissions on /etc/ssl/certs/stunnel.pem 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate: /etc/ssl/certs/stunnel.pem 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate loaded 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Key file: /etc/ssl/certs/stunnel.pem 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Private key loaded 2015.05.08 17:12:06 LOG7[10804:140318864611136]: SSL options set: 0x00000004 2015.05.08 17:12:06 LOG6[10804:140318864611136]: Initializing service section [dsp3270s] 2015.05.08 17:12:06 LOG4[10804:140318864611136]: Insecure file permissions on /etc/ssl/certs/stunnel.pem 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate: /etc/ssl/certs/stunnel.pem 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate loaded 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Key file: /etc/ssl/certs/stunnel.pem 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Private key loaded 2015.05.08 17:12:06 LOG7[10804:140318864611136]: SSL options set: 0x00000004 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Configuration successful 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Service [telnets] (FD=12) bound to 0.0.0.0:3141 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Service [dsp3270s] (FD=13) bound to 0.0.0.0:7490 2015.05.08 17:12:06 LOG7[10810:140318864611136]: Created pid file /stunnel4.pid 2015.05.08 17:12:31 LOG7[10810:140318864611136]: Service [telnets] accepted (FD=3) from 127.0.0.1:40090 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Service [telnets] started 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Waiting for a libwrap process 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Acquired libwrap process #0 2015.05.08 17:12:31 LOG3[10810:140318864770816]: Unexpected socket close (read_blocking) 2015.05.08 17:12:31 LOG5[10810:140318864770816]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Local socket (FD=3) closed 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Service [telnets] finished (0 left) 2015.05.08 17:12:31 LOG7[10810:140318864770816]: str_stats: 1 block(s), 32 data byte(s), 58 control byte(s) 2015.05.08 17:13:32 LOG7[10810:140318864611136]: Service [dsp3270s] accepted (FD=3) from 127.0.0.1:48534 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Service [dsp3270s] started 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Waiting for a libwrap process 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Acquired libwrap process #1 2015.05.08 17:13:32 LOG3[10810:140318864770816]: Unexpected socket close (read_blocking) 2015.05.08 17:13:32 LOG5[10810:140318864770816]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Local socket (FD=3) closed 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Service [dsp3270s] finished (0 left) 2015.05.08 17:13:32 LOG7[10810:140318864770816]: str_stats: 1 block(s), 32 data byte(s), 58 control byte(s) I don't even see the IP address for the outbound connection, so it seems as if it is hitting a problem even before it gets that far. Configuration is pretty simple: ; Sample stunnel configuration file by Michal Trojnara 2002-2009 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of the chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /etc/ssl/certs/stunnel.pem ;key = /etc/ssl/certs/stunnel.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = TLSv1 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 ; PID is created inside the chroot jail pid = /stunnel4.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 socket = l:SO_KEEPALIVE=1 socket = r:SO_KEEPALIVE=1 socket = l:TCP_KEEPCNT=5 socket = r:TCP_KEEPCNT=5 socket = l:TCP_KEEPIDLE=10 socket = r:TCP_KEEPIDLE=10 socket = l:TCP_KEEPINTVL=2 socket = r:TCP_KEEPINTVL=2 ;compression = zlib ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [telnets] accept = 3141 ;connect = 192.168.80.11:992 ;connect = DurgeeEnterprises.publicvm.com:992 connect = 192.168.80.5:992 [dsp3270s] accept = 7490 ;connect = 192.168.80.11:246 ;connect = DurgeeEnterprises.publicvm.com:246 connect = 192.168.80.5:246 ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini Any thoughts on how to track this down and get this working? Dave

2 1

problem migrating from 4.54 to 5.x
by Scott Weisman 04 May '15

04 May '15

Hi there. I have a program I have used successfully with Stunnel for many years. A while back, I discovered that my program, which is a pure stdio console program, stopped working with 5.x versions of Stunnel. I have spent many hours but have been unable to solve the problem, so I regretfully continue to use the 4.x branch. I was wondering if anyone had similar experiences? Relevant data is pasted below. I comment in the log output where the problem occurs. Any help at all would be greatly appreciated. stunnel.conf: setuid = stunnel setgid = stunnel pid = /var/run/stunnel/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 foreground = no debug = 7 output = /var/log/stunnel.log [CF2] client = no accept = 21 verify = 3 sslVersion = all cert = /etc/stunnel/demo.pem key = /etc/stunnel/demo.pem CApath = /etc/stunnel/certs CRLpath = /etc/stunnel/crls TIMEOUTbusy = 60 TIMEOUTclose = 0 TIMEOUTconnect = 60 TIMEOUTidle = 60 exec = /opt/cmf/bin/cf-server execargs = /opt/cmf/bin/cf-server -p /opt/jail/stunnel/pipes/ Log of successful session with 4.54: 2015.05.01 15:39:39 LOG7[3080:140402563495680]: Starting certificate verification: depth=0, /C=US/L=Bryan/ST=TX/O=Demo Account/emailAddress= demo(a)demo.com/CN=demo 2015.05.01 15:39:39 LOG6[3080:140402563495680]: CERT: Locally installed certificate matched 2015.05.01 15:39:39 LOG5[3080:140402563495680]: Certificate accepted: depth=0, /C=US/L=Bryan/ST=TX/O=Demo Account/emailAddress= demo(a)demo.com/CN=demo 2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3 read client certificate A 2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3 read client key exchange A 2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3 read certificate verify A 2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3 read finished A 2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3 write session ticket A 2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3 write change cipher spec A 2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3 write finished A 2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3 flush data 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 items in the session cache 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 client connects (SSL_connect()) 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 client connects that finished 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 client renegotiations requested 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 1 server connects (SSL_accept()) 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 1 server connects that finished 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 server renegotiations requested 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 session cache hits 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 external session cache hits 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 session cache misses 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 session cache timeouts 2015.05.01 15:39:39 LOG6[3080:140402563495680]: SSL accepted: new session negotiated 2015.05.01 15:39:39 LOG6[3080:140402563495680]: Negotiated TLSv1/SSLv3 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2015.05.01 15:39:39 LOG6[3080:140402563495680]: Compression: null, expansion: null 2015.05.01 15:39:39 LOG6[3080:140402563495680]: Local mode child started (PID=3118) 2015.05.01 15:39:39 LOG7[3080:140402563495680]: Remote socket (FD=11) initialized *** the connection is established and stable; i explicitly disconnect several seconds later 2015.05.01 15:39:45 LOG7[3080:140402563495680]: SSL socket closed on SSL_read 2015.05.01 15:39:45 LOG7[3080:140402563495680]: Sent socket write shutdown 2015.05.01 15:39:45 LOG5[3080:140402563495680]: Connection closed: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2015.05.01 15:39:45 LOG7[3080:140402563495680]: Remote socket (FD=11) closed 2015.05.01 15:39:45 LOG7[3080:140402563495680]: Local socket (FD=3) closed 2015.05.01 15:39:45 LOG7[3080:140402563495680]: Service [CF2] finished (0 left) Log of unsuccessful session with 5.16: 2015.05.01 15:37:33 LOG7[0]: Verification started at depth=0: C=US, L=Bryan, ST=TX, O=Demo Account, emailAddress=demo(a)demo.com, CN=demo 2015.05.01 15:37:33 LOG7[0]: CERT: Pre-verification succeeded 2015.05.01 15:37:33 LOG6[0]: CERT: Locally installed certificate matched 2015.05.01 15:37:33 LOG5[0]: Certificate accepted at depth=0: C=US, L=Bryan, ST=TX, O=Demo Account, emailAddress=demo(a)demo.com, CN=demo 2015.05.01 15:37:33 LOG7[0]: SSL state (accept): SSLv3 read client certificate A 2015.05.01 15:37:33 LOG7[0]: SSL state (accept): SSLv3 read client key exchange A 2015.05.01 15:37:33 LOG7[0]: SSL state (accept): SSLv3 read certificate verify A 2015.05.01 15:37:33 LOG7[0]: SSL state (accept): SSLv3 read finished A 2015.05.01 15:37:33 LOG7[0]: SSL state (accept): SSLv3 write change cipher spec A 2015.05.01 15:37:33 LOG7[0]: SSL state (accept): SSLv3 write finished A 2015.05.01 15:37:33 LOG7[0]: SSL state (accept): SSLv3 flush data 2015.05.01 15:37:33 LOG7[0]: 1 server accept(s) requested 2015.05.01 15:37:33 LOG7[0]: 1 server accept(s) succeeded 2015.05.01 15:37:33 LOG7[0]: 0 server renegotiation(s) requested 2015.05.01 15:37:33 LOG7[0]: 0 session reuse(s) 2015.05.01 15:37:33 LOG7[0]: 0 internal session cache item(s) 2015.05.01 15:37:33 LOG7[0]: 0 internal session cache fill-up(s) 2015.05.01 15:37:33 LOG7[0]: 0 internal session cache miss(es) 2015.05.01 15:37:33 LOG7[0]: 0 external session cache hit(s) 2015.05.01 15:37:33 LOG7[0]: 0 expired session(s) retrieved 2015.05.01 15:37:33 LOG6[0]: SSL accepted: new session negotiated 2015.05.01 15:37:33 LOG7[0]: Peer certificate was cached (1610 bytes) 2015.05.01 15:37:33 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2015.05.01 15:37:33 LOG7[0]: Compression: null, expansion: null 2015.05.01 15:37:33 LOG6[0]: Local mode child started (PID=2899) 2015.05.01 15:37:33 LOG7[0]: Remote socket (FD=11) initialized *** immediately after successful connection, something happens; my program has no log output either, which seems to indicate that stunnel is closing it 2015.05.01 15:37:33 LOG6[0]: Read socket closed (readsocket) 2015.05.01 15:37:33 LOG7[main]: Dispatching signals from the signal pipe 2015.05.01 15:37:33 LOG7[0]: Sending close_notify alert 2015.05.01 15:37:33 LOG7[main]: Processing SIGCHLD 2015.05.01 15:37:33 LOG7[0]: SSL alert (write): warning: close notify 2015.05.01 15:37:33 LOG6[main]: Child process 2899 terminated on signal 11 2015.05.01 15:37:33 LOG6[0]: SSL_shutdown successfully sent close_notify alert 2015.05.01 15:37:33 LOG7[main]: Signal pipe is empty 2015.05.01 15:37:33 LOG3[0]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing 2015.05.01 15:37:33 LOG5[0]: Connection closed: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2015.05.01 15:37:33 LOG7[0]: Remote socket (FD=11) closed 2015.05.01 15:37:33 LOG7[0]: Local socket (FD=3) closed 2015.05.01 15:37:33 LOG7[0]: Service [CF2] finished (0 left)

2 2

Segfault in stunnel
by Miroslaw Pietrzyk 03 May '15

03 May '15

Hi, I have a problem with one of the stunnel installation (debian7). After some time of operation automatically turns itself off with the message: (...) Apr 24 21:03:45 routerpri kernel: [177332.400502] stunnel[34426]: segfault at 0 ip 00007f1f99ca9e20 sp 00007f1f99c16c68 error 4 in stunnel[7f1f99c94000+24000] (...) Apr 24 21:21:36 routerpri kernel: [178402.360532] stunnel[34795]: segfault at 0 ip 00007f84d6b8be20 sp 00007f84d6b49c68 error 4 in stunnel[7f84d6b76000+24000] (...) Apr 24 21:23:31 routerpri kernel: [178517.215345] stunnel[34908]: segfault at 0 ip 00007f150c5b3e20 sp 00007f150c58cc68 error 4 in stunnel[7f150c59e000+24000] (...) stunnel 5.15 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.1e 11 Feb 2013 stunnel.conf: pid = /var/run/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel.log syslog = yes client = no fips = no verify = 0 CAfile = /etc/stunnel/SubCA2.crt CRLfile = /etc/stunnel/SubCA2_CRL.pem [service_1] accept = 192.168.1.10:1000 connect = 192.168.1.10:1234 cert = /etc/stunnel/cert1.crt key = /etc/stunnel/cert1_key.pem ciphers = HIGH:!SSLv2:!ADH:!Exp:!aNULL:!eNULL:!NULL sslVersion = TLSv1.2 When I use the lower level of encryption for example SSLv3, problem occurs after a longer period of normal operation. I will only add that the problem has also appeared on the previous version 4.54, which I was updating to the newest. Do you have any idea what could be causing the problem. Regards Mirek

2 2

HSM usage
by Vedat Nommaz 01 May '15

01 May '15

>> What would be the equivalent of below s_server command in stunnel? >> >> openssl s_server -accept 5003 -engine chil -keyform engine -key rsa-priv -cert public.pem -tls1_2 >> >> In this example "rsa-priv" references the private key inside a hardware security module, not a pem file. >> >> I saw an option for engineid in the documentation, but nothing for keyform parameter.

1 0

stunnel 5.17 release
by Michal Trojnara 29 Apr '15

29 Apr '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.17 of stunnel. The ChangeLog entry: Version 5.17, 2015.04.29, urgency: HIGH: * Bugfixes - Fixed a NULL pointer dereference causing the service to crash. This bug was introduced in stunnel 5.15. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: c3e79e582621a0827125e35e1c00450190104fc02dc3c5274cb02b05859fd472 stunnel-5.17.tar.gz 07a508de3807663f71e4793fd5edb4c57b6c82b4c9008753f8f6c85a17acbeea stunnel-5.17-installer.exe 49d2cc11aefe2062576a0bbfafa3beb5ae541683d90972c6ed457b19a455c346 stunnel-5.17-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVQSIlAAoJEC78f/DUFuAU5XEP/R2d2gXCeKk7d/466dOYF//A YlXC6oDbs7OB8qEHH3u5u5hl8WIZJOmbPb79APSJKd7ESREoRk97UBJZYoH+QuEB CHOs0czty5IE2QyMibHJZ4Zed23q/QHrTRL9GpZd8EPkmiRG/dq7M+vC0gJJuF+N 4CPCNj464ATtjFB3mPju+wQinnWj8s57kNAazifAQNvM/jhdJOMH+BOvXIGEwUlt iZ8MBwO707j81UWkSFANxn1GMTOoJY2pTTAmJr/eKun9sLbuN7v4ec8Mtwdcj16P 5CeXD1g7gOK5q2FizIUWfBD38nPRVBXMqfSAkjtezwqZJb1K4bfa505E4SY3bKzL CJstbH206rQriqhpV4hrsuGVmb6M7lt57zAJZ746NQtlRm1gLdf/56JclsHqmkqo Z6zAuXRAiarkn88OsERp8r84Y4l8q/D8dkZwYPObSCT+SAMimPzLxhu9sjIKsb1I lSFNS2P9sEw/MhM9yQGfyC0GKzQWrQIONFHP2iCS8+ySEc+6/1b9tB9oiOcsAL1c edWV3m5SQzG7TbsbtApRy6Pvb30O7/5zAJOiBN6Yf5OQ8OyjL4M9+ZKd75qQxsQj IEZNJW/caVz9QwNWc2BQtaUVy7RC0CaTmbebsoQWlKQmzosXMU2QgC/WJ3jQdslz Vc3C3rKKvwGPw1DZLX95 =tC15 -----END PGP SIGNATURE-----

1 0

startup issues
by Coviello, Paul 24 Apr '15

24 Apr '15

Hi, Well I got it started on VMS and wanted to put it in debug mode, so I shut it down made my changes to the conf file and now well I can't start it with the command procedure. I even tried the old conf and same thing... $ @STUNNEL_STARTUP_SERVER Is the private key (in the PEM file) encrypted? [Y/N]: Y Enter the password to decrypt the key (please use paired double quotes with it): ""XXXXXXXXX"" Starting up a Stunnel %RUN-S-PROC_ID, identification of created process is 209FCA70 Stunnel server failed to start up-- check the configuration, etc. Nothing is logged... But if I do the following $ stunnel STUNNEL_SERVER.CONF And the output to the screen... 2015.04.24 10:35:24 LOG7[547326662:2071228096]: Snagged 64 random bytes from sys$common:[sysmgr].rnd 2015.04.24 10:35:24 LOG7[547326662:2071228096]: Wrote 1024 new random bytes to sys$common:[sysmgr].rnd 2015.04.24 10:35:24 LOG7[547326662:2071228096]: RAND_status claims sufficient entropy for the PRNG 2015.04.24 10:35:24 LOG7[547326662:2071228096]: PRNG seeded successfully 2015.04.24 10:35:24 LOG7[547326662:2071228096]: Certificate: stunnel.pem 2015.04.24 10:35:24 LOG7[547326662:2071228096]: Certificate loaded 2015.04.24 10:35:24 LOG7[547326662:2071228096]: Key file: stunnel.pem Enter PEM pass phrase: 2015.04.24 10:35:31 LOG7[547326662:2071228096]: Private key loaded 2015.04.24 10:35:31 LOG7[547326662:2071228096]: SSL context initialized for service telnet This is where it sits unless I do a ctrl-c to cancel and get back to the system prompt. And when I do my telnet session I cannot connect. Well I connect but no prompts for me to login But now I have log output! :) 2015.04.24 10:08:31 LOG5[547326662:2071228096]: stunnel undefined on vax-openvms with OpenSSL 0.9.8h 28 May 2008 2015.04.24 10:08:31 LOG5[547326662:2071228096]: Threading:PTHREAD Sockets:POLL,IPv4 2015.04.24 10:08:31 LOG6[547326662:2071228096]: file ulimit = 512 (can be changed with 'ulimit -n') 2015.04.24 10:08:31 LOG6[547326662:2071228096]: poll() used - no FD_SETSIZE limit for file descriptors 2015.04.24 10:08:31 LOG5[547326662:2071228096]: 250 clients allowed 2015.04.24 10:08:31 LOG7[547326662:2071228096]: FD 5 in non-blocking mode 2015.04.24 10:08:31 LOG7[547326662:2071228096]: FD 4 in non-blocking mode 2015.04.24 10:08:31 LOG7[547326662:2071228096]: FD 6 in non-blocking mode 2015.04.24 10:08:31 LOG7[547326662:2071228096]: SO_REUSEADDR option set on accept socket 2015.04.24 10:08:31 LOG7[547326662:2071228096]: telnet bound to 0.0.0.0: 2015.04.24 10:15:00 LOG3[547326662:2071228096]: Received signal 2; terminating 2015.04.24 10:18:18 LOG5[547326662:2071228096]: stunnel undefined on vax-openvms with OpenSSL 0.9.8h 28 May 2008 2015.04.24 10:18:18 LOG5[547326662:2071228096]: Threading:PTHREAD Sockets:POLL,IPv4 2015.04.24 10:18:18 LOG6[547326662:2071228096]: file ulimit = 512 (can be changed with 'ulimit -n') 2015.04.24 10:18:18 LOG6[547326662:2071228096]: poll() used - no FD_SETSIZE limit for file descriptors 2015.04.24 10:18:18 LOG5[547326662:2071228096]: 250 clients allowed 2015.04.24 10:18:18 LOG7[547326662:2071228096]: FD 5 in non-blocking mode 2015.04.24 10:18:18 LOG7[547326662:2071228096]: FD 4 in non-blocking mode 2015.04.24 10:18:18 LOG7[547326662:2071228096]: FD 6 in non-blocking mode 2015.04.24 10:18:18 LOG7[547326662:2071228096]: SO_REUSEADDR option set on accept socket 2015.04.24 10:18:19 LOG7[547326662:2071228096]: telnet bound to 0.0.0.0: 2015.04.24 10:21:08 LOG6[547326662:2071228096]: going to accept mode 2015.04.24 10:21:08 LOG7[547326662:2071228096]: telnet accepted FD=7 from 192.168.20.140:59281 2015.04.24 10:21:08 LOG6[547326662:2071228096]: accepted connection 2015.04.24 10:21:08 LOG7[547326662:8966656]: telnet started 2015.04.24 10:21:08 LOG7[547326662:8966656]: FD 7 in non-blocking mode 2015.04.24 10:21:08 LOG7[547326662:8966656]: TCP_NODELAY option set on local socket 2015.04.24 10:21:08 LOG5[547326662:8966656]: telnet accepted connection from 0.0.0.0: 2015.04.24 10:21:08 LOG7[547326662:8966656]: SSL state (accept): before/accept initialization 2015.04.24 10:21:30 LOG3[547326662:8966656]: SSL_accept: Peer suddenly disconnected 2015.04.24 10:21:30 LOG5[547326662:8966656]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2015.04.24 10:21:30 LOG7[547326662:8966656]: telnet finished (0 left) 2015.04.24 10:21:31 LOG6[547326662:2071228096]: going to accept mode 2015.04.24 10:21:31 LOG7[547326662:2071228096]: telnet accepted FD=7 from 192.168.20.140:59283 2015.04.24 10:21:31 LOG6[547326662:2071228096]: accepted connection 2015.04.24 10:21:31 LOG7[547326662:8966656]: telnet started 2015.04.24 10:21:31 LOG7[547326662:8966656]: FD 7 in non-blocking mode 2015.04.24 10:21:31 LOG7[547326662:8966656]: TCP_NODELAY option set on local socket 2015.04.24 10:21:31 LOG5[547326662:8966656]: telnet accepted connection from 0.0.0.0: 2015.04.24 10:21:31 LOG7[547326662:8966656]: SSL state (accept): before/accept initialization 2015.04.24 10:21:32 LOG3[547326662:8966656]: SSL_accept: Peer suddenly disconnected 2015.04.24 10:21:32 LOG5[547326662:8966656]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2015.04.24 10:21:32 LOG7[547326662:8966656]: telnet finished (0 left) 2015.04.24 10:21:33 LOG6[547326662:2071228096]: going to accept mode 2015.04.24 10:21:33 LOG7[547326662:2071228096]: telnet accepted FD=7 from 192.168.20.140:59284 2015.04.24 10:21:33 LOG6[547326662:2071228096]: accepted connection 2015.04.24 10:21:33 LOG7[547326662:8966656]: telnet started 2015.04.24 10:21:33 LOG7[547326662:8966656]: FD 7 in non-blocking mode 2015.04.24 10:21:33 LOG7[547326662:8966656]: TCP_NODELAY option set on local socket 2015.04.24 10:21:33 LOG5[547326662:8966656]: telnet accepted connection from 0.0.0.0: 2015.04.24 10:21:33 LOG7[547326662:8966656]: SSL state (accept): before/accept initialization 2015.04.24 10:21:34 LOG3[547326662:8966656]: SSL_accept: Peer suddenly disconnected 2015.04.24 10:21:34 LOG5[547326662:8966656]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2015.04.24 10:21:34 LOG7[547326662:8966656]: telnet finished (0 left) Paul J Coviello Senior System Administrator CCS Corporate Headquarters Two Wells Avenue, Newton, MA 02459 617.965.2000, Ext. 4004 [cid:image001.png@01D07E7A.602FCE40] [cid:image002.gif@01D07E7A.602FCE40] CCS Commercial, LLC | CCS Resources, Inc. | ClaimAssist, LLC | Credit Control Services, Inc. Customer Contact Solutions, LLC | Enterprise Associates, LLC

2 4

Fwd: Comments/questions to Debian patches
by Michal Trojnara 24 Apr '15

24 Apr '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, Peter Pentchev, the Debian package maintainer for the "stunnel4" package, does not reply to my emails. I hope he is still alive and well, just too busy to maintain the package. I decided to share with you my comments to the patches that are applied to the Debian package. Hopefully, someone will find them useful. Mike - -------- Forwarded Message -------- Subject: Comments/questions to Debian patches Date: Tue, 28 Oct 2014 21:13:25 +0100 From: Michal Trojnara <Michal.Trojnara(a)mirt.net> To: Peter Pentchev <roam(a)ringlet.net> Hi Peter, Just a few comments/questions to improve the quality of Debian package. I'll be glad to discuss if you disagree with my opinions. 01-fix-paths.patch The patch description is quite outdated. Translation from sbin to bin was performed upstream in stunnel 4.21 released 27 Oct 2007. 8-) I guess: /usr/bin/stunnel -fd 10 \ should be: /usr/bin/stunnel4 -fd 10 \ Probably this should be added to the next patch: 02-rename-binary.patch 05-logrotate-warning-in-sample-conf.patch Good idea. I'll add it to stunnel 5.07. 08-client-example.patch I've already added this example in stunnel 5.02. Your patch adds it once again. Just remove it. 10-no-zlib-compression.patch I'm completely confused by this patch. According to my tests it only makes stunnel reporting different errors when a user tries to enable compression on Debian. Why would anyone need this patch? 11-no-rle-compression.patch IMHO OpenSSL bugs should be fixed in OpenSSL, and not in stunnel. YMMV 12-restore-pidfile-default.patch I strongly disagree with this approach, as it breaks configuration file compatibility with the upstream. Debian should instead rewrite stunnel.conf when upgrading from stunnel 4.xx. 14-lsb-init-functions.patch 8-) 15-upstream-systemd-libs.patch This (and more) will be included in stunnel 5.07. 16-upstream-sslv23-method.patch This will be included in stunnel 5.07. Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJVNsCAAAoJEC78f/DUFuAUpfUP/j13koMgtnVLfsACIqUEaZw3 1uADOP/Dugqbn/QcwSqWAlcTrf7So98AQrB88xAhN8C3fwP375GmcNmPgJx4RRme fU/Wo0aFaCq0JOReiQkNiyj3pqf+J2NxZlZM5ZpzzpA80x8AlyLqBwPfBAtxgYNJ rb5AyIoGPkzfXM8OSz8YJXZtgXT4lrSCE5djlWHHBqy9ioUZCEuyVXeT5Y90sXOg wOA/EX3fTKEJZckoiNoTPAh9pLZ9M29lLM7wLEu5BFWwh/TtHk0ZFADo3Kzi/+4G Q6h9236DmH1NHA/FzMfFbKEYz/0yeOUMfet8LsRNNRRrFJEp+miMemSYajGMA3IT UVW4UNOa+CppVgkRpVMGfl/Lw53GP63xbLIRuZs17py03hNBHz2pyZneWWKTJEun xJQC4QJ3Z3YYXd71jpHIKjcDBXmIzcG8Z9QylaTywk8MBBBpjuRTXkIAlWWj2Iyk LVRsAgtooUKlQzUoAoseRygDv+Wbp/qVNL1Zogy7PmfORmqZOz08jRpDlXFgjPjR evGztgApTR+FSMO9f052z/Sql0chb5mhtdAtdBKpRE3CgtIrCHfcalSOyeCleHJK NMEbqfed9Oq2WA0/W89ilGtJWRH4v0GnYCfbYhbSoXp9DytdHPbhRUsiJL8LO34b 1cuMSsQ9LjF+3WyRie4m =SrZs -----END PGP SIGNATURE-----

2 2

Redis with stunnel, need to reset a client connection if the remote server drops
by Cocytus 20 Apr '15

20 Apr '15

Hello all, I've spent some time digging through the archives, but have yet to turn up a solution to the issue I'm having. We're using Redis instances on 'cloud' resources, and have successfully gotten stunnel setup as a server on these nodes. Additionally an internal process runs and connects to a local stunnel client that then connects to the remote cloud instance. This is working well enough at the moment, however there is one issue I'm bumping into. If the remote EC2 node goes dark for a bit (ie: reboot), the local stunnel client will reconnect, however the internal process which is establishing its connection to the local stunnel client does not get disconnected and therefore doesn't know that redis became unavailable and needs to re-subscribe to the redis stream. I need to invalidate the established session when the remote reconnects. Can this be accomplished with either a TIMEOUT value or session statement? Below is a sample of the configuration: ########### [some-ec2-node.com] client = yes verify = 2 CApath = /etc/ssl/certs sslVersion = TLSv1 accept = 127.0.0.1:10008 connect = some-ec2-node.com:6379 ########### $ stunnel4 -version stunnel 4.53 on x86_64-pc-linux-gnu platform Compiled with OpenSSL 1.0.1e 11 Feb 2013 Running with OpenSSL 1.0.1f 6 Jan 2014 Update OpenSSL shared libraries or rebuild stunnel Threading:PTHREAD SSL:+ENGINE+OCSP Auth:LIBWRAP Sockets:POLL+IPv6 Global options: debug = daemon.notice pid = /var/run/stunnel4.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = ALL:!SSLv2:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH curve = prime256v1 session = 300 seconds sslVersion = TLSv1 for client, all for server stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none -- Josh

2 1

stunnel 5.16 release
by Michal Trojnara 19 Apr '15

19 Apr '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.16 of stunnel. This release only fixes a compilation issue with old versions of gcc. The Win32/Android binaries are basically the same as for version 5.15. The ChangeLog entry: Version 5.16, 2015.04.19, urgency: MEDIUM: * Bugfixes - Fixed compilation with old versions of gcc. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: b6b7e93fb2626eaabae1c8474e1dfa23962cfde8fa35c8602289fcaa4f53608d stunnel-5.16.tar.gz a701e6421c3020cc832ecb0e3a897c427a3838e0e180999ed8d905a9283fbb97 stunnel-5.16-installer.exe 2e559cc300b678fb2d05c2d2d3dc13d16cb44915f0165bea6290f741fccaa54c stunnel-5.16-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVM7KGAAoJEC78f/DUFuAUWwoQAJUnjUpyNLhjUQxRwScKjgNx AJ5OPZHXwVjX+xvtSSOjlkK/pk5l4SaEbNtq6hwMGliDpowXXDGXeYwNbmACXGuM sZWzdTUC69WKLQcwfTmn5BmsPQtczaCDQdyBVGSII4qg0mFIU4e1GYT0t8od7OcU n17nnRCLEaS2xlDwR5ImMuRjD+BdpEgZdiRXqtJkyjX8+aSRsEtSVjDBJ5wtsYNN 9pyMp8xU+7+sxX5GiLQ8+IcqcUq+W53nMJQZmN5vQ8O2ShxuBeZYdvembPhybvlE NrnfmjvDtl6A0iFs8ZhRRPTJZTKqj88UGhn49g3eQBH+CbNK08GalWCwR/uX8yFb +Z801mNIxJQrPnSlSaWLDPGNQ9GBqxliui1IR+Biv1KpmcPWBDAOI+Y7Hqyy1/5r MUDT9GB4HLZTC6aWtR0IyG30w3CvUmNr+sENu91ewvl0I1Z04yWyK+wQ3L3CbWyk aVBaNmt09pR8zgU9nvw8aAE2MLJ5oCgoangGpO6rEL0frh7TZhzD9sOMMVefKZDY rPPApyOiphH+3nnh9EiM357S9saXJMFe8/gNh6+lNXmYJ0ngMcPybz9mNV+RbbZU P1itA5RYBAwDTEJcpvATEj8ni9YPdDdFVmMrvC7ay5KZo0HWHxH23ryShBN9XYjC diuX4vtV2LMVYV5dlmAj =Eer2 -----END PGP SIGNATURE-----

1 0

Rewriting HTTP host header
by Veit Guna 19 Apr '15

19 Apr '15

Hi. After disabling SSLv3 I've got the same problem as: https://www.stunnel.org/pipermail/stunnel-users/2014-October/004814.html Sadly, he never got an answer. So I ask again, is it possible that stunnel could set the HTTP Host header to match the "connect = " setting? This way, Apache would accept that request instead of returning BAD REQUEST with AH02032. Thanks Veit

2 1

openvms and stunnel
by Coviello, Paul 17 Apr '15

17 Apr '15

Hello I'm trying to setup stunnel 4.20 yes it is an old version but the only one on HP's website for VMS. I need a little help in the conf files. Since I will be using telnet, do I need to put in each machines ip address that will be connecting? So in the example below do I create a listing of connects? [telnet] accept = 999 connect = 192.168.0.1:993 Thanks Paul Paul J Coviello Senior System Administrator CCS Corporate Headquarters Two Wells Avenue, Newton, MA 02459 617.965.2000, Ext. 4004 [cid:image001.png@01D071ED.C6122490] [cid:image002.gif@01D071ED.C6122490] CCS Commercial, LLC | CCS Resources, Inc. | ClaimAssist, LLC | Credit Control Services, Inc. Customer Contact Solutions, LLC | Enterprise Associates, LLC

4 21

stunnel 5.15 release
by Michal Trojnara 16 Apr '15

16 Apr '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.15 of stunnel. The ChangeLog entry: Version 5.15, 2015.04.16, urgency: LOW: * New features - Added new service-level options "checkHost", "checkEmail" and "checkIP" for additional checks of the peer certificate subject. These options require OpenSSL version 1.0.2 or higher. - Win32 binary distribution now ships with the Mozilla root CA bundle. This bundle is intended be used together with the new "checkHost" option to validate server certs accepted by Mozilla. - New commandline options "-reload" to reload the configuration file and "-reopen" to reopen the log file of stunnel running as a Windows service (thx to Marc McLaughlin). - Added session persistence based on negotiated TLS sessions. https://en.wikipedia.org/wiki/Load_balancing_%28computing%29#Persistence The current implementation does not support external TLS session caching with sessiond. - MEDIUM ciphers (currently SEED and RC4) are removed from the default cipher list. - The "redirect" option was improved to not only redirect sessions established with an untrusted certificate, but also sessions established without a client certificate. - OpenSSL version checking modified to distinguish FIPS and non-FIPS builds. - Improved compatibility with the current OpenSSL 1.1.0-dev tree. - Removed support for OpenSSL versions older than 0.9.7. The final update for the OpenSSL 0.9.6 branch was 17 Mar 2004. - "sessiond" support improved to also work in OpenSSL 0.9.7. - Randomize the initial value of the round-robin counter. - New stunnel.conf templates are provided for Windows and Unix. * Bugfixes - Fixed compilation against old versions of OpenSSL. - Fixed memory leaks in certificate verification. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 58ff4645eb5d6bd64e6ddedaa683534302f75625c531e8a6364badcac0541cba stunnel-5.15.tar.gz 08316dc39f72f10f7b28a67e25ddf90f3f189208b09562c12d81478c6ca2e782 stunnel-5.15-installer.exe db96edbe66f1c3524e51f21b47cc541953d1659e746765a43d0272cfe60712b0 stunnel-5.15-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVL7wqAAoJEC78f/DUFuAU+30P/Ar197tSUJC0+sLBXwddWkm4 J7d9lFThQFECDDSIqaFYfCuecIgGHk8LUVq8nQHh21H1tvpPp7SnYHkzOLsb2w/y G7rLdA+a8BgRTUF3rMxTyghL78Yor88OLI8J93U7pkQkl0bIZpiITn838R5x9/NP +nGTgqy3U5tNoXALBQ/tLZCNML/XaEyxfrbdStOslV5Ay3m23RPw9wqgD4tJoWqe 5x52sMmLh0nhE5lX3xAKxzabVcioAaqVlBEgK1/ZKJj709Olcv14HZcOWzWhWkka MR0ItrZMkYf3lLk/StDm3s2BakKRraRustxlK8wAV4ci7t/IBnWshIpYIij9Nzct HNOT10GjWpN6pwwixNcMBUn7/wDNjiRVw/1n/keL84qSYry54Czo1LpBra1lMCmg 8WENkpJbaNFHvXI4rEzZkiPdlG16tXHF33CcYxwrT8bCXa+Uk4i8c98TJ2jfOaUv VFVLWxFtK4ydoppgOo2eRuymVPNK4HbLZnLPL874xPlHpYjRl5ndClLeDpkDzgJv 8y6zdYwJLFbinWGGHTZIVlyQQfKzB1NDCfXxknsbxtCpZt5Ja0Ka+oS6kcOMZz6f CjYpmd52wjEtAoxxxsjGGrYsO3q0sn0UU3Kc97lGGS/MsgbXFYDnSGqP+p8lzDoq urHG9EjMxXNMcnmKp9JQ =XLyZ -----END PGP SIGNATURE-----

1 0

Re: [stunnel-users] Understanding communication
by josealf＠rocketmail.com 16 Apr '15

16 Apr '15

Claudia, Yes, to create a tunnel you need to configure stunnel on both sides, except in those cases when one of the extremes already supports TLS. Looks like yours is not one of those cases. Regards, Jose -----Original Message----- From: "Claudia Porta" <claudia.porta(a)bancaakros.it> Sender: "stunnel-users" <stunnel-users-bounces(a)stunnel.org> Date: Wed, 15 Apr 2015 14:51:07 To: <stunnel-users(a)stunnel.org> Subject: [stunnel-users] Understanding communication _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Verifying TLS authentication via stunnel logs
by shanmuganathan sedukumar 16 Apr '15

16 Apr '15

We have a requirement to send emails via a SMTP server which requires TLS authentication. Going through some logs we tried changing the parameter "SSLversion = TLSv1", but still getting authentication failure. So, we would like to verify if stunnel is trying to sending request via TLS method before looking for any issues at SMTP end. Is there a way we can verify from stunnel logs if the request is sent via TLS? Thanks & Regards,Shanmu

1 0

Session is active but I cannot connect
by daninho dj 09 Apr '15

09 Apr '15

Hi guys, I am struggling with a problem for some time. I searched about this problem in the stunnel mails archives and also on Google but couldn't find a solution and I ran out of ideas so I was thinking to write you about it. I am using Eclipse to access and manipulate the data from a linux server. I want to use stunnel when I connect to the server via Eclipse, so I installed and configured everything as it follows: The server I am using is SuSE Linux and the stunnel version which I installed is this one: *stunnel 4.27 on x86_64-suse-linux-gnu with OpenSSL 0.9.8j-fips 07 Jan 2009* The stunnel version on Windows 7 is: *stunnel version 5.10* In the conf file from linux (server) I have the following configuration for stunnel.conf: *client = no* *chroot = /var/lib/stunnel/* *setuid = root* *setgid = root* *pid = /var/run/stunnel.pid* *debug = 7* *output = /var/log/stunnel/stunnel.log* *cert = /etc/ssl/certs/stunnel.pem* *sslVersion = SSLv3* *[test]* *accept = 2404* *connect = 2406* In the conf file from windows (client) I have the following configuration in stunnel.conf: *debug = 7* *output = C:\Program Files (x86)\stunnel\stunnel.log* *cert = C:\Program Files (x86)\stunnel\stunnel.pem* *sslVersion = SSLv3* *[test]* *client = yes* *accept = 127.0.0.1:2404 <http://127.0.0.1:2404>* *connect = xx.xxx.xxx.xxx:2406* In the log I have this: 2015.04.09 13:48:04 LOG5[11060]: Configuration successful 2015.04.09 13:48:04 LOG7[11060]: Listening file descriptor created (FD=452) 2015.04.09 13:48:04 LOG7[11060]: Service [test] (FD=452) bound to 127.0.0.1:2404 2015.04.09 13:48:07 LOG7[11060]: Service [test] accepted (FD=496) from 127.0.0.1:56675 2015.04.09 13:48:07 LOG7[11060]: Creating a new thread 2015.04.09 13:48:07 LOG7[11060]: New thread created 2015.04.09 13:48:07 LOG7[2088]: Service [test] started 2015.04.09 13:48:07 LOG5[2088]: Service [test] accepted connection from 127.0.0.1:56675 2015.04.09 13:48:07 LOG6[2088]: s_connect: connecting xx.xxx.xxx.xxx:2406 2015.04.09 13:48:07 LOG7[2088]: s_connect: s_poll_wait xx.xxx.xxx.xxx:2406: waiting 10 seconds 2015.04.09 13:48:07 LOG5[2088]: s_connect: connected xx.xxx.xxx.xxx:2406 2015.04.09 13:48:07 LOG5[2088]: Service [test] connected remote server from 127.0.0.1:56676 2015.04.09 13:48:07 LOG7[2088]: Remote socket (FD=516) initialized 2015.04.09 13:48:07 LOG6[2088]: SNI: sending servername: *my_server_name* 2015.04.09 13:48:07 LOG7[2088]: SSL state (connect): before/connect initialization 2015.04.09 13:48:07 LOG7[2088]: SSL state (connect): SSLv3 write client hello A 2015.04.09 13:48:08 LOG3[2088]: SSL_connect: Peer suddenly disconnected 2015.04.09 13:48:08 LOG5[2088]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2015.04.09 13:48:08 LOG7[2088]: Remote socket (FD=516) closed 2015.04.09 13:48:08 LOG7[2088]: Local socket (FD=496) closed 2015.04.09 13:48:08 LOG7[2088]: Service [test] finished (0 left) Although in the stunnel log it's showing *s_connect: connected* I cannot connect at all. When I try to connect via port 2406, the stunnel icon shows that the server is idle and I have nothing in the log about it. When I try to connect via port 2404, the stunnel icon shows that the there are 2 active sessions but I cannot connect to the server. I tried switching the ports (2404 with 2406 and 2406 with 2404 in the stunnel.conf file) but stunnel doesn't even open in that case. Do you have any idea what might could be the problem and how could I solve it? Thanks in advance! Best Regards, Daninho --

3 6

Stunnel 5.0x compile issues
by Michael Curran 06 Apr '15

06 Apr '15

Hello -- I am running the following commands to compile openssl (with FIPS support) and stunnel * Base config for FIPS cd openssl-fips-2.0.9 echo "./config" ./config * OpenSSL with shared and custom install location cd openssl-1.0.1m echo "./config fips --openssldir=/usr/local/openssl-100 --with-fipslibdir=/usr/local/ssl/fips-2.0/lib" ./config fips shared --openssldir=/usr/local/openssl-100 --with-fipslibdir=/usr/local/ssl/fips-2.0/lib/ * Stunnel with FIPs (autodetect is working , I just added it to force it) cd stunnel-5.09 echo "make clean" make clean echo "./configure --with-ssl=/usr/local/openssl-100 --disable-libwrap --enable-fips" ./configure --with-ssl=/usr/local/openssl-100 --disable-libwrap --enable-fips You can see that my custom OpenSSL is reporting that it is built with -fips root@host:/var/tmp# /usr/local/openssl-100/bin/openssl version OpenSSL 1.0.1m-fips 19 Mar 2015 But when I'm done with all the compile options -- I only see the base version of OpenSSL 1.0.1m , and this same script with Stunnel 4.53 shows OpenSSL 1.0.1m-fips Is there something I am missing during the configure for Stunnel that is causing it to NOT see openssl is compiled with FIPs? root@host:/var/tmp# stunnel -version stunnel 5.09 on x86_64-unknown-linux-gnu platform Compiled with OpenSSL 1.0.1m 19 Mar 2015 Running with OpenSSL 1.0.1 14 Mar 2012 Update OpenSSL shared libraries or rebuild stunnel Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Global options: debug = daemon.notice RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = HIGH:MEDIUM:+3DES:+DH:!aNULL:!SSLv2 (with "fips = no") curve = prime256v1 options = NO_SSLv2 options = NO_SSLv3 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none

1 0

Disconnect immediately after sending a message successfully
by Swallow 02 Apr '15

02 Apr '15

Hi, Can you give me a hand? We sent messages to a server over SSL. But stunnel showed disconnect from remote server as soon as we sent out logon message correctly. We close down the fire wall. Dose we misunderstand the mechanism of stunnel? Could someone help me? Thank you very much. Regards, Yan

1 0

Log rotation for Windows
by John Smith 31 Mar '15

31 Mar '15

Hi I came across this thread, I know it's old... http://mailing.unix.stunnel-users.narkive.com/QOEx4XQz/stunnel-users-log-ro… And it says that's it's on the todo list, though I don't see anything indicating this on the list. So is log rotation implemented for Windows and if so what is the config parameter? Thanks

2 5

Stunnel not receiving connections on ports 465 & 587
by James Brown 31 Mar '15

31 Mar '15

I am running Stunnel 5.14 on my Mac mail server (OS X 10.7.5), but trying to send emails using ports 465 & 587 does not work: Mail.app says: Mail was unable to connect to server “mail.bordo.com.au <http://mail.bordo.com.au/>” using SSL on port 587. Verify that this server supports SSL and that your account settings are correct. Log from Stunnel is: 2015.03.31 09:27:56 LOG7[ui]: Clients allowed=500 2015.03.31 09:27:56 LOG5[ui]: stunnel 5.14 on x86_64-apple-darwin11.4.2 platform 2015.03.31 09:27:56 LOG5[ui]: Compiled/running with OpenSSL 1.0.2a 19 Mar 2015 2015.03.31 09:27:56 LOG5[ui]: Threading:PTHREAD Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP 2015.03.31 09:27:56 LOG7[ui]: errno: (*__error()) 2015.03.31 09:27:56 LOG5[ui]: Reading configuration from file /usr/local/etc/stunnel/stunnel.conf 2015.03.31 09:27:56 LOG5[ui]: UTF-8 byte order mark not detected 2015.03.31 09:27:56 LOG5[ui]: FIPS mode disabled 2015.03.31 09:27:56 LOG7[ui]: Compression disabled 2015.03.31 09:27:56 LOG7[ui]: Snagged 64 random bytes from /dev/urandom 2015.03.31 09:27:56 LOG7[ui]: PRNG seeded successfully 2015.03.31 09:27:56 LOG6[ui]: Initializing service [ssmtp] 2015.03.31 09:27:56 LOG6[ui]: Loading certificate from file: /usr/local/etc/postfix/smtpd.cert 2015.03.31 09:27:56 LOG6[ui]: Loading key from file: /usr/local/etc/postfix/smtpd.key 2015.03.31 09:27:56 LOG7[ui]: Private key check succeeded 2015.03.31 09:27:56 LOG7[ui]: DH initialization 2015.03.31 09:27:56 LOG7[ui]: Using DH parameters from /usr/local/etc/postfix/smtpd.cert 2015.03.31 09:27:56 LOG7[ui]: DH initialized with 2048-bit key 2015.03.31 09:27:56 LOG7[ui]: ECDH initialization 2015.03.31 09:27:56 LOG7[ui]: ECDH initialized with curve prime256v1 2015.03.31 09:27:56 LOG7[ui]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2015.03.31 09:27:56 LOG6[ui]: Initializing service [ssmtp2] 2015.03.31 09:27:56 LOG6[ui]: Loading certificate from file: /usr/local/etc/postfix/smtpd.cert 2015.03.31 09:27:56 LOG6[ui]: Loading key from file: /usr/local/etc/postfix/smtpd.key 2015.03.31 09:27:56 LOG7[ui]: Private key check succeeded 2015.03.31 09:27:56 LOG7[ui]: DH initialization 2015.03.31 09:27:56 LOG7[ui]: Using DH parameters from /usr/local/etc/postfix/smtpd.cert 2015.03.31 09:27:56 LOG7[ui]: DH initialized with 2048-bit key 2015.03.31 09:27:56 LOG7[ui]: ECDH initialization 2015.03.31 09:27:56 LOG7[ui]: ECDH initialized with curve prime256v1 2015.03.31 09:27:56 LOG7[ui]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2015.03.31 09:27:56 LOG5[ui]: Configuration successful 2015.03.31 09:27:56 LOG7[ui]: Listening file descriptor created (FD=6) 2015.03.31 09:27:56 LOG7[ui]: Service [ssmtp] (FD=6) bound to 0.0.0.0:465 2015.03.31 09:27:56 LOG7[ui]: Listening file descriptor created (FD=7) 2015.03.31 09:27:56 LOG7[ui]: Service [ssmtp2] (FD=7) bound to 0.0.0.0:587 /usr/local/etc/stunnel/stunnel.conf has: [ssmtp] client = no accept = 465 connect = 127.0.0.1:25 [ssmtp2] client = no accept = 587 connect = 127.0.0.1:25 The mail server is running on the same machine. I can send emails using port 25 with no SSL. (I have to have the ‘Allow insecure authentication’ ticked). When I try to send using ports 587 or 465 there is nothing logged by stunnel (or anywhere else that I can see). Firewall is not blocking anything: sudo ipfw list 65535 allow ip from any to any Postfix is the SMTP server, Dovecot for IMAP. Any suggestions? Thanks, James.

2 2

5.xx Windows binaries - FIPS compliant?
by Rob Lockhart 30 Mar '15

30 Mar '15

I apologize if this was asked in the past. I couldn't find any references to my question in the lists except this (related but not answering the question): http://www.stunnel.org/pipermail/stunnel-users/2014-July/004673.html http://www.stunnel.org/pipermail/stunnel-users/2012-November/003963.html I understand how to compile Stunnel from source, and the FIPS canister for OpenSSL, then build OpenSSL with this FIPS canister, then build Stunnel using that OpenSSL. My question is for the Windows version with filename "stunnel-5.13-installer.exe". That compiled version doesn't seem to be built with FIPS canister, as the log shows: "Compiled/running with OpenSSL 1.0.2a 19 Mar 2015" without a "-fips" appendage after the OpenSSL version. In other words, if it was built as FIPS-compliant, it would show: "Compiled/running with OpenSSL 1.0.2a-fips 19 Mar 2015" It may support the FIPS options (in the config file) but it's not FIPS-compliant. I also assume that this doesn't preclude the FIPS options in the config file from working. Specifically, FIPS-compliant does NOT imply that FIPS mode cannot be enabled. Am I understanding this correctly? Thanks, -Rob

2 2

Libressl with stunnel
by jungle Boogie 29 Mar '15

29 Mar '15

Hello All, It appears that stunnel still requires openssl and cannot use libressl. Have the developers considered this patch: https://github.com/sabotage-linux/sabotage/commit/9b47cbbf3ce903dee042c45c8… This is from stunnel 5.02 days but are there any issues with applying this with 5.14? -- ------- inum: 883510009027723 sip: jungleboogie(a)sip2sip.info xmpp: jungle-boogie(a)jit.si

2 2

stunnel 5.14 release
by Michal Trojnara 25 Mar '15

25 Mar '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.14 of stunnel. The ChangeLog entry: Version 5.14, 2015.03.25, urgency: HIGH: * Security bugfixes - The "redirect" option now also redirects clients on SSL session reuse. In stunnel versions 5.00 to 5.12 reused sessions were never redirected regardless of their certificate verification result. This vulnerability was reported by Johan Olofsson. * New features - Windows service is automatically restarted after upgrade. * Bugfixes - Fixed a memory allocation error during Unix daemon shutdown. - Fixed handling multiple connect/redirect destinations. - OpenSSL FIPS builds are now correctly reported on startup. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 2197b4fc1db82eba69c8baf1fac30f0767af26e9f8c7e9e1d5a4a8fbb264695a stunnel-5.14.tar.gz 29364b3f07a84245fe1b0f8373d96c9924650a8058e602670a67a2da07a801bd stunnel-5.14-installer.exe e3b48534bb4a5f8237e4ed1aa4990ed8485bdf97f6e0b8da2507dbd9b5cad34c stunnel-5.14-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVEs/mAAoJEC78f/DUFuAUNq4P/A7Ap1NkzfhZQJWJMJthar1P hoVHIzuH7dGbRt4C5s0PgbC4S9UOz8wdcKbsNcPJRQf0PXP5oVARo2bx+3dV9uAC /6GRL+a5Rj8HU5vG4UX/9D5D0pvwcyFkk7sIxUhyeKSHcEH354Vgw0AlJM6GiWKG nwE5RJ3JTdxi8A4e10p3ZKnPg4Y0eWmpkm1qkqH9RWKj9+BbLaPt7ZvRBNYNicq3 3BtVaJ5KLGvWaQRww+llhvPnR2K+h7PnJiaIKm/cIHzbP8VLjoVWy/Dk5EOku6Zg iCfz8uFzezz+9NwwjjEl2KfGUNdBaZf02R2LqN57pTZyBPZNVH9G7IE1/BGJh7Ai f440LTC29OB7qnJThDRdU16x/Iz+NTcc1QFK4x7eTD+nTouUuyZh9Md0x4DD9jwk CL3dHZ6abUO9j7V04Sb8+wfWzP/pZdilWLyY1jj8L41EPXyb0DE3ZsrHyN7lJ2Fx OihfevJhB9bzCzXiLg0oW61YRUm5prRTxMaeTAC53fITlvx0yf9pHFNy0OtoTNr+ t0Skf/LMaZnvU0rE0UBSjqQbpKNaRff5zsGrI/NLgk98X/NTdakgrgsS0jjaQgYm 7mgH4mKoI9qL2YUMw7d9eGg8j8I9qewhaQYjVz4kGoq9YOCVhh69XormcGMAXXjY gf3RNVLzQH4N19TYz5a8 =lrVy -----END PGP SIGNATURE-----

1 0

Multiple versions of TLS in config?
by Rob Lockhart 25 Mar '15

25 Mar '15

Unless I'm mistaken, stunnel version 5 currently supports the options shown below for sslVersion: all => TLS v1.0, TLS v1.1, TLS v1.2, SSLv2, SSLv3 TLSv1 => TLS v1.0 only (not TLS v1.1, TLSv1.2, SSLv2 or SSLv3) TLSv1.1 => TLS v1.1 only TLSv1.2 => TLS v1.2 only In order to support TLS v1.0, TLS v1.1 and TLS v1.2 but disable SSLv2 and SSLv3, you should have in the config file: sslVersion = all options = NO_SSLv2 options = NO_SSLv3 (those last two lines may be default in the new Stunnel). However, what if I want to just have TLSv1.1 and TLSv1.2 but NOT TLSv1.0? I last tried this with Stunnel v5.10 but nothing in the changelogs tells me that this behavior has been changed to choose a list of protocols; only one parameter is accepted. Is there a way to allow TLSv1.1 and TLSv1.2 but disallow TLSv1.0? Thanks, -Rob

2 1

Stunnel urgency: HIGH versus LOW
by Rob Lockhart 24 Mar '15

24 Mar '15

Hello, I just noticed a urgency discrepancy for Stunnel 5.12 on the website (both of these links are under the Downloads section): https://www.stunnel.org/versions.html - shows 5.12 urgency as HIGH https://www.stunnel.org/sdf_ChangeLog.html - shows 5.12 urgency as LOW I don't know if it makes a difference with 5.13 available (assuming urgency = LOW) but I think 5.12 should have urgency=HIGH. Thanks, -Rob

1 0

Definition of accept/local/remote sockets
by David Wittman 21 Mar '15

21 Mar '15

Is there a clear definition of what stunnel defines as the accept, local, and remote sockets below? > socket = a|l|r:OPTION=VALUE[:VALUE] > Set an option on accept/local/remote socket From: http://www.stunnel.org/static/stunnel.html It seems to me that the accept and local socket would be the same thing. Thanks, Dave

3 3

Receive from secure servers
by Info ITsatWork 21 Mar '15

21 Mar '15

Hello, A company which we work with wants to send secure (TLS) mails to our server. I think stunnel can do the trick for me, as our own server (Scalix) doesn't support TLS for itself. Now I set up stunnel and it looks like its working, except it's not receiving secured mails. I can still receive normal mails, so somehow it is not working. I used the sample config and filled in the things I thought I needed. My config: ; Sample stunnel configuration file for Unix by Michal Trojnara 2002-2015 ; Some options used here may be inadequate for your particular configuration ; This sample file does *not* represent stunnel.conf defaults ; Please consult the manual for detailed description of available options ; ************************************************************************** ; * Global options * ; ************************************************************************** ; A copy of some devices and system files is needed within the chroot jail ; Chroot conflicts with configuration file reload and many other features ; Remember also to update the logrotate configuration. ;chroot = /usr/local/var/lib/stunnel/ ; Chroot jail can be escaped if setuid option is not used ;setuid = nobody ;setgid = nogroup ; PID file is created inside the chroot jail (if enabled) ;pid = /usr/local/var/run/stunnel.pid ; Debugging stuff (may be useful for troubleshooting) debug = 7 output = stunnel.log ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** client = no ; Certificate/key is needed in server mode and optional in client mode cert = /usr/local/etc/stunnel/stunnel.pem ;key = /usr/local/etc/stunnel/mail.pem ; Authentication stuff needs to be configured to prevent MITM attacks ; It is not enabled by default! ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /usr/local/etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively CRLfile can be used ;CRLfile = /usr/local/etc/stunnel/crls.pem ;sslVersion = all ; Enable support for the insecure SSLv2 protocol ;options = NO_SSLv2 ; Enable support for the insecure SSLv3 protocol ;options = NO_SSLv3 ; Workaround for Eudora bug ; options = DONT_INSERT_EMPTY_FRAGMENTS ; These options provide additional security at some performance degradation ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; ************************************************************************** ; * Service definitions (remove all services for inetd mode) * ; ************************************************************************** ; Example SSL server mode services ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 [ssmtp] accept = 192.168.1.102:25 connect = 192.168.1.102:26 protocol = smtp ; Example SSL client mode services ;[gmail-pop3] ;client = yes ;accept = 127.0.0.1:110 ;connect = pop.gmail.com:995 ;[gmail-imap] ;client = yes ;accept = 127.0.0.1:143 ;connect = imap.gmail.com:993 ;[gmail-smtp] ;client = yes ;accept = 127.0.0.1:25 ;connect = smtp.gmail.com:465 ; Example SSL front-end to a web server ;[https] ;accept = 443 ;connect = 80 ; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SSL ; Microsoft implementations do not use SSL close-notify alert and thus ; they are vulnerable to truncation attacks ;TIMEOUTclose = 0 ; vim:ft=dosini This is what I see in the logfiles for the mails I don't receive: 2015.03.21 14:56:46 LOG7[main]: Service [ssmtp] accepted (FD=12) from 207.46.163.207:8478 2015.03.21 14:56:46 LOG7[2]: <- EHLO na01-by2-obe.outbound.protection.outlook.com 2015.03.21 14:56:46 LOG7[2]: -> 250-mailserver.mydomain.nl 2015.03.21 14:56:46 LOG7[2]: -> 250 STARTTLS 2015.03.21 14:56:46 LOG7[1]: SSL state (accept): SSLv3 read client key exchange A 2015.03.21 14:56:46 LOG7[1]: SSL state (accept): SSLv3 read finished A 2015.03.21 14:56:46 LOG7[1]: SSL state (accept): SSLv3 write change cipher spec A 2015.03.21 14:56:46 LOG7[1]: SSL state (accept): SSLv3 write finished A 2015.03.21 14:56:46 LOG7[1]: SSL state (accept): SSLv3 flush data 2015.03.21 14:56:46 LOG7[1]: 1 items in the session cache 2015.03.21 14:56:46 LOG7[1]: 0 client connects (SSL_connect()) 2015.03.21 14:56:46 LOG7[1]: 0 client connects that finished 2015.03.21 14:56:46 LOG7[1]: 0 client renegotiations requested 2015.03.21 14:56:46 LOG7[1]: 1 server connects (SSL_accept()) 2015.03.21 14:56:46 LOG7[1]: 1 server connects that finished 2015.03.21 14:56:46 LOG7[1]: 0 server renegotiations requested 2015.03.21 14:56:46 LOG7[1]: 0 session cache hits 2015.03.21 14:56:46 LOG7[1]: 0 external session cache hits 2015.03.21 14:56:46 LOG7[1]: 0 session cache misses 2015.03.21 14:56:46 LOG7[1]: 0 session cache timeouts 2015.03.21 14:56:46 LOG6[1]: No peer certificate received 2015.03.21 14:56:46 LOG6[1]: SSL accepted: new session negotiated 2015.03.21 14:56:46 LOG6[1]: Negotiated TLSv1 ciphersuite AES256-SHA (256-bit encryption) 2015.03.21 14:56:46 LOG7[1]: Compression: null, expansion: null 2015.03.21 14:56:46 LOG7[3]: Service [ssmtp] started 2015.03.21 14:56:46 LOG5[3]: Service [ssmtp] accepted connection from 207.46.163.207:8478 2015.03.21 14:56:46 LOG6[3]: s_connect: connecting 192.168.1.102:26 2015.03.21 14:56:46 LOG7[3]: s_connect: s_poll_wait 192.168.1.102:26: waiting 10 seconds 2015.03.21 14:56:46 LOG5[3]: s_connect: connected 192.168.1.102:26 2015.03.21 14:56:46 LOG5[3]: Service [ssmtp] connected remote server from 192.168.1.102:22148 2015.03.21 14:56:46 LOG7[3]: Remote socket (FD=13) initialized 2015.03.21 14:56:46 LOG6[1]: Read socket closed (readsocket) 2015.03.21 14:56:46 LOG7[1]: Sending close_notify alert 2015.03.21 14:56:46 LOG7[1]: SSL alert (write): warning: close notify 2015.03.21 14:56:46 LOG6[1]: SSL_shutdown successfully sent close_notify alert 2015.03.21 14:56:46 LOG7[2]: <- STARTTLS 2015.03.21 14:56:46 LOG7[2]: -> 220 Go ahead 2015.03.21 14:56:46 LOG7[2]: SSL state (accept): before/accept initialization 2015.03.21 14:56:46 LOG7[3]: RFC 2487 detected 2015.03.21 14:56:46 LOG7[3]: <- 220 mailserver.rsconsultancy.nl ESMTP Scalix SMTP Relay 11.4.6.13676; Sat, 21 Mar 2015 14:56:46 +0100 (CET) 2015.03.21 14:56:46 LOG7[3]: -> 220 mailserver.rsconsultancy.nl stunnel for ESMTP Scalix SMTP Relay 11.4.6.13676; Sat, 21 Mar 2015 14:56:46 2015.03.21 14:56:46 LOG6[1]: SSL socket closed (SSL_read) 2015.03.21 14:56:46 LOG7[1]: Sent socket write shutdown 2015.03.21 14:56:46 LOG5[1]: Connection closed: 52 byte(s) sent to SSL, 6 byte(s) sent to socket 2015.03.21 14:56:46 LOG7[1]: Remote socket (FD=9) closed 2015.03.21 14:56:46 LOG7[1]: Local socket (FD=3) closed 2015.03.21 14:56:46 LOG7[1]: Service [ssmtp] finished (2 left) Could anyone please tell me what I'm doing wrong? Jeroen

2 1

stunnel 5.13 released
by Michal Trojnara 20 Mar '15

20 Mar '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.13 of stunnel. The ChangeLog entry: Version 5.13, 2015.03.20, urgency: MEDIUM: * New features - The "service" option was modified to also control the syslog service name. * Bugfixes - Fixed Windows service crash. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 71b4efb3814ec298124ec78386d756ee2cba9c999e7f9571bb8abcef317f04b5 stunnel-5.13.tar.gz bc5e8dc34ef32d92fb088afd18bae504ae4619b860f2a3ebb5e0af5e6b3531cd stunnel-5.13-installer.exe 1740861d1ff0e6f0146d181e832a4634ed4a13fdf52b50e12bb63c41d550579e stunnel-5.13-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJVC/XkAAoJEC78f/DUFuAUtvwP/jUHwfoKRfT9eF5q8KV/gINx DxIs6bEf84hjw43n+tHCuPEJgXp8p9UYKR2MF5wHrYv7Wv0MqvRGZZvImY9qIwU/ ev3ZXpZTCo3hOn+kNeeQczuBfLfdNx/O11J0BxkSAJFz9mTeM4mxWoPqx/PP/Q54 mih/Jg17VobRPJXJRZlX8pabevO3wPteGT2t8Vd+JB3jTZzVgZBZXI+S9tr9evuD G2vHVz2f7aLRIw9wXIcM5k4HgNM4F8Oe0t9Y/RPkugvLJq7UZ5tskhNIa5+So3qG O/sYQSGfL77KI82N/k89tMj2ksGK9oNvKLCI1rpCKJOIIv58m3zyMlaXWWTJkETP vxxeSzwCvGkoL2Jzwomi2a1ev1Tqjwia2zjzFexPgHZCTxVLa4rGRJDBZcwWDtAl So7g7JjKI9QASP38ZT0G/0X8LQjtrMiKrfcU7eDhgRLfiQbyaV5h1g5GNJv4uAac 0qA8ho0VwOLXHT4Ny1V2d/wDuWTrcUl8f2wqlRnUGcEfoHH9ejkoLw0FcQ7RFm51 B9QCE/ntTKXknMWys9A/NSEmQ02KYGlVnTq++gjfvR927Wkr1dFCW3xj3fx8K+JW uWRLf61VjT72s2Qsx6HxyoYw3Yh9ehJo5Xm48iFAkvSnnk/7rQu8c1lazDtuRgRr YYViDon00Bx1ktaxlJPN =Q4iO -----END PGP SIGNATURE-----

1 0

stunnel 5.12 released
by Michal Trojnara 19 Mar '15

19 Mar '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.12 of stunnel. The ChangeLog entry: Version 5.12, 2015.03.19, urgency: HIGH: * Security bugfixes - OpenSSL DLLs updated to version 1.0.2a. https://www.openssl.org/news/secadv_20150319.txt * New features - New service-level option "logId" to specify the connection identifier type. Currently supported types: "sequential" (default), "unique", and "thread". - New service-level option "debug" to individually control logging verbosity of defined services. * Bugfixes - OCSP fixed on Windows platform (thx to Alec Kosky). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 80c3d350c9b3e4438143fcc77c915026ae338f8174bb730ff117ca438ba84847 stunnel-5.12.tar.gz aa1a241009172636e07eb2260e43cec28ba1da4348e74abae52598a41eed478a stunnel-5.12-installer.exe 6c377c045768007ef14830227ae8637ba97a2bb225e3bad98179febd020ef6b2 stunnel-5.12-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVCuLXAAoJEC78f/DUFuAUDPkQAM22z+jWYIfzUHqg5o2cDzLS KBinjzmymoYw2mpGRjjBW/dNIVcBBnk2DhaYMaTrVFSxdFhDjZATXekFxiIotBGn YjM5EKmdkiguNQcEcR+a72Lh+fjDB3w7o0tDtXoD9+cfLr7tiwV7WLo1WwqeAdOi Do4u0RJZE6INd7O5EMKDMWpsEp1AxIGEXyEY9brZxptS6pow0+fwJnIaLcE3ZYje 6XAIFw4nSIyvfEhe6d7vmB5pmSidNrJlvOpi2ui3MxdS1ZBYEhNbwiPujeG3mb02 5i0RnJLocY0gBa/j5wTWnpamQt8HdO6L2MP/vo7Wqg66663/4k0KtfaNmY5azQ98 JrCibZNU9GlXkhgAz65ORVHVr4Bh7Aq65W5mlrKt1DRopnI4/dawWORjKN6rJYeU vcwsStAG/adukFO++TaDq+4NJTZ9GEn7XrNp3cgfVkd8L68vTTgbwRzQ1kWoAlz4 D2AozchqPfe2QIlsGQ7JfcnZsEgAy34HSLpst5LntudXDwZiHmxRzcg0604YWe2I 7Y4XGs1SxVBsURRi/KCLRKDwH8SiAqB4SP79tOtxEqMEIN6kpiagsKn0yMgFzVBH Irdbz/WfFmJzwh1YZ2uXjBT9U6H7lYrkz1AEMJ7DzKwGcP8B1sdDBzBtppkfZdam Y4NUI7wsPUexvBb8AB8h =dqXf -----END PGP SIGNATURE-----

1 0

STunnel v5.11 Multi SNI
by Scott McKeown 18 Mar '15

18 Mar '15

Hi Michal, Thank you for the update and yes this does work but I feel that this is incorrect. Lets say that I have two domains domain.com newdomain.com If I'm load balancing these domains to different backend servers this will not work as it will always hit domain.com using this style of wildcard. I think it should be: sni = http:*.domain.com This will then split out the domains, I know that the chance of this being the case is low but I do believe that this should be how SNI is handled for this type of case. Regards, Scott -- With Kind Regards. Scott McKeown Loadbalancer.org http://www.loadbalancer.org Tel (UK) - +44 (0) 3303801064 (24x7) Tel (US) - +1 888.867.9504 (Toll Free)(24x7)

1 0

STunnel v5.11 Multi SNI
by Scott McKeown 17 Mar '15

17 Mar '15

Hi Guys, I've got a small issue where I'm trying to use multiple SNI rules in an STunnel frontend: STunnel Version is: stunnel -version stunnel 5.11 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.1e 11 Feb 2013 Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Global options: debug = daemon.notice RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = HIGH:MEDIUM:+3DES:+DH:!aNULL:!SSLv2 (with "fips = no") curve = prime256v1 options = NO_SSLv2 options = NO_SSLv3 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none stunnel.conf is: [https] accept = 443 connect = 80 [www_test] sni = https:test.com sni = https:www.test.com connect = 192.168.64.220:80 [testing] sni = https:testing.com sni = https:www.testing.com connect = 192.168.64.253:80 I've created local DNS rules for each of these Hosts but the problem is that only the last entered sni rule gets matched so for example www.test.com works but test.com does not. Its the same for testing.com and www.testing.com This is what the log file show too: 2015.03.03 20:01:19 LOG7[12776]: Service [https] accepted (FD=21) from 192.168.63.50:53123 2015.03.03 20:01:19 LOG7[12808]: Service [https] started 2015.03.03 20:01:19 LOG5[12808]: Service [https] accepted connection from 192.168.63.50:53123 2015.03.03 20:01:19 LOG7[12808]: SSL state (accept): before/accept initialization 2015.03.03 20:01:19 LOG6[12808]: SNI: requested servername: testing.com 2015.03.03 20:01:19 LOG3[12808]: SNI: no pattern matched servername: testing.com 2015.03.03 20:01:19 LOG7[12808]: SSL alert (write): fatal: unrecognized name 2015.03.03 20:01:19 LOG3[12808]: SSL_accept: 1408A0E2: error:1408A0E2:SSL routines:SSL3_GET_CLIENT_HELLO:clienthello tlsext 2015.03.03 20:01:19 LOG5[12808]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2015.03.03 20:01:19 LOG7[12808]: Local socket (FD=21) closed 2015.03.03 20:01:19 LOG7[12808]: Service [https] finished (7 left) 2015.03.03 20:01:29 LOG6[12805]: Read socket closed (readsocket) 2015.03.03 20:01:29 LOG7[12805]: Sending close_notify alert 2015.03.03 20:01:29 LOG7[12805]: SSL alert (write): warning: close notify 2015.03.03 20:01:29 LOG6[12805]: SSL_shutdown successfully sent close_notify alert 2015.03.03 20:01:30 LOG6[12805]: SSL socket closed (SSL_read) 2015.03.03 20:01:30 LOG7[12805]: Sent socket write shutdown 2015.03.03 20:01:30 LOG5[12805]: Connection closed: 485 byte(s) sent to SSL, 642 byte(s) sent to socket 2015.03.03 20:01:30 LOG7[12805]: Remote socket (FD=14) closed 2015.03.03 20:01:30 LOG7[12805]: Local socket (FD=13) closed 2015.03.03 20:01:30 LOG7[12805]: Service [www_test] finished (6 left) 2015.03.03 20:01:49 LOG7[12776]: Service [https] accepted (FD=13) from 192.168.63.50:53128 2015.03.03 20:01:49 LOG7[12809]: Service [https] started 2015.03.03 20:01:49 LOG5[12809]: Service [https] accepted connection from 192.168.63.50:53128 2015.03.03 20:01:49 LOG7[12809]: SSL state (accept): before/accept initialization 2015.03.03 20:01:49 LOG6[12809]: SNI: requested servername: testing.com 2015.03.03 20:01:49 LOG3[12809]: SNI: no pattern matched servername: testing.com 2015.03.03 20:01:49 LOG7[12809]: SSL alert (write): fatal: unrecognized name 2015.03.03 20:01:49 LOG3[12809]: SSL_accept: 1408A0E2: error:1408A0E2:SSL routines:SSL3_GET_CLIENT_HELLO:clienthello tlsext 2015.03.03 20:01:49 LOG5[12809]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2015.03.03 20:01:49 LOG7[12809]: Local socket (FD=13) closed 2015.03.03 20:01:49 LOG7[12809]: Service [https] finished (6 left) I have seen a couple of patch files floating around but they are for older versions and I can't get them to compile into the v5.11 version. Any thoughts? -- With Kind Regards. Scott McKeown Loadbalancer.org http://www.loadbalancer.org Tel (UK) - +44 (0) 3303801064 (24x7) Tel (US) - +1 888.867.9504 (Toll Free)(24x7)

2 1

SSH connection problems inside stunnel
by debian＠bercot.org 13 Mar '15

13 Mar '15

Hello, I've installed a stunnel between my laptop and my server (both in Debian SID) [v5.06-2]. Here is my client stunnel.conf : pid = /var/run/stunnel.pid client = yes sslVersion = TLSv1.2 debug = 7 [ssh] accept = 5000 protocol = connect protocolHost = myserver:443 connect = myproxy:8080 The server one : cert = mycert key = mykey chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 sslVersion = TLSv1.2 ; https ou ssh encapsulé dans du ssl [sslh] accept = 443 connect = myserver:444 And my .ssh/config : Host myserver HostName localhost Port 5000 IdentityFile ~/.ssh/mykey ProtocolKeepAlives 6 At home (I use tinyproxy to test), everything is OK. At work, with a "true" proxy, sometimes I can connect (but I'm quickly disconnected), sometimes I can't... I've watch the logs but find nothing. Do you have any idea ? Something to look in the logs ? Here is an example of a short connection : ~ $ ssh myserver root@myserver:~# cat /var/log/syslog | grep stunnel [...] root@myserver~# Timeout, server localhost not responding. More often I have : ~ $ ssh myserver ssh_exchange_identification: Connection closed by remote host In my local logs : Mar 12 13:24:41 mylaptop stunnel: LOG7[3984]: Service [ssh] accepted (FD=3) from 127.0.0.1:44794 Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: Service [ssh] started Mar 12 13:24:41 mylaptop stunnel: LOG5[3223]: Service [ssh] accepted connection from 127.0.0.1:44794 Mar 12 13:24:41 mylaptop stunnel: LOG6[3223]: s_connect: connecting myproxy:8080 Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: s_connect: s_poll_wait myproxy:8080: waiting 10 seconds Mar 12 13:24:41 mylaptop stunnel: LOG5[3223]: s_connect: connected myproxy:8080 Mar 12 13:24:41 mylaptop stunnel: LOG5[3223]: Service [ssh] connected remote server from myIP:58282 Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: Remote socket (FD=8) initialized Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: -> CONNECT myserver:443 HTTP/1.1 Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: -> Host: myserver:443 Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: -> Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: <- HTTP/1.1 200 Connection established Mar 12 13:24:41 mylaptop stunnel: LOG6[3223]: CONNECT request accepted Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: <- Mar 12 13:24:41 mylaptop stunnel: LOG6[3223]: SNI: sending servername: myserver Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: SSL state (connect): before/connect initialization Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: SSL state (connect): unknown state Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: SSL state (connect): unknown state Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: SSL state (connect): unknown state Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: SSL state (connect): unknown state Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: SSL state (connect): unknown state Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: SSL state (connect): unknown state Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: 54 items in the session cache Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: 109 client connects (SSL_connect()) Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: 110 client connects that finished Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: 0 client renegotiations requested Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: 0 server connects (SSL_accept()) Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: 0 server connects that finished Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: 0 server renegotiations requested Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: 56 session cache hits Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: 0 external session cache hits Mar 12 13:24:41 mylaptop stunnel: LOG7[3223]: 0 session cache misses Mar 12 13:24:43 mylaptop stunnel: LOG7[3223]: SSL alert (read): warning: close notify Mar 12 13:24:43 mylaptop stunnel: LOG6[3223]: SSL closed (SSL_read) Mar 12 13:24:43 mylaptop stunnel: LOG7[3223]: Sent socket write shutdown Mar 12 13:24:43 mylaptop stunnel: LOG6[3223]: Read socket closed (readsocket) Mar 12 13:24:43 mylaptop stunnel: LOG6[3223]: Read socket closed (hangup) Mar 12 13:24:43 mylaptop stunnel: LOG6[3223]: Write socket closed (hangup) Mar 12 13:24:43 mylaptop stunnel: LOG7[3223]: Sending close_notify alert Mar 12 13:24:43 mylaptop stunnel: LOG7[3223]: SSL alert (write): warning: close notify Mar 12 13:24:43 mylaptop stunnel: LOG6[3223]: SSL_shutdown successfully sent close_notify alert Mar 12 13:24:43 mylaptop stunnel: LOG5[3223]: Connection closed: 32 byte(s) sent to SSL, 0 byte(s) sent to socket Mar 12 13:24:43 mylaptop stunnel: LOG7[3223]: Remote socket (FD=8) closed Mar 12 13:24:43 mylaptop stunnel: LOG7[3223]: Local socket (FD=3) closed Mar 12 13:24:43 mylaptop stunnel: LOG7[3223]: Service [ssh] finished (0 left) Thank you. David.

4 5

stunnel 5.11 released
by Michal Trojnara 11 Mar '15

11 Mar '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.11 of stunnel. The ChangeLog entry: Version 5.11, 2015.03.11, urgency: LOW: * New features - OpenSSL DLLs updated to version 1.0.2. - Removed dereferences of internal OpenSSL data structures. - PSK key lookup algorithm performance improved from O(N) (linear) to O(log N) (logarithmic). * Bugfixes - Fixed peer certificate list in the main window on Win32 (thx to @fyer for reporting it). - Fixed console logging in tstunnel.exe. - _tputenv_s() replaced with more portable _tputenv() on Win32. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 71a8bc37e58e34509b0267ade02292994c7a127f14d6e5ba03081db695edff8c stunnel-5.11.tar.gz 3511a4bf27bcffdb69c3b2b2d5989d0b1d7b033a28f0c8d53cdd622555326487 stunnel-5.11-installer.exe ccebef146d5c28854aa538e2ff8f7d1d1eb822d2ab51689aa88d39a1c3026776 stunnel-5.11-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVAG9SAAoJEC78f/DUFuAUT2YP+weeIxK38dCe5O49Tj/2Yh5p msWRsK3JPcLe9uFobCYfpuSvm5+rWKAF+tOBjPkKL024z1V9XTFca4aRK+0EJWdp 8ndM0HBKW9LzlQZ7IR1jIV23BWwKnBJi3D4xpTVFgxFHn6fO/WJzggOBSLsp299o pE643meivz8O182b54EhD4shLCm5XTtrltYSoi0fVMZ2MIBH4LoLVTknF3pH4St1 GrqAcV+5KgsMInRtJjtgkCDPsVYbCYze+8U+Lq1wehdZ/8n90rCsPqLvzDtff76O 99ohHSIPyhnZM5C1VWb1XADIrdsXoaS5hjcWv2ujS8h4zSW4wcugYC+LRTrDqrOo OaRuHvPF/vdHu8Jok+roxHh7IKxBSJ/W58+ubjwKVYRP+JRKn6JkK4FRcMVy9kMM HRFr/o1rzXk0O6epogSLuGT/mSJhy+o/VV781Ce5d+QkUswviVT6WSAjvT3/3VMM odkm2t7JIpvC06naVjjKzMg84BLLW8Phuyp3+6LBCqoTRj7FbjsRd1pSFYn3D/3L GMWt1kZ6YHam2mWE0j9AlW9hOyfbqlsgX4nux1x6ckUs0KvRMm34RONaECqV/VuU swf0PciswFa3739Ln3O47uDHVfPviW/CT4+HHMVXN7xmqMSnWqYkh9/oE05mNLFY xtbFUaOMt1K0phJkBsx9 =u9oG -----END PGP SIGNATURE-----

2 3

Download page broken
by Lukáš Helebrandt 09 Mar '15

09 Mar '15

Dear all, Downloads on https://www.stunnel.org/downloads.html seem to be broken. Clicking any link brings one back to the Downloads page (serves the downloads.html file). I noticed when deploying Streisand ( https://github.com/jlund/streisand ), which mirrors stunnel on each installation. Best, Lukas

3 2

Re: [stunnel-users] [stunnel-announce] stunnel 5.10 released - Problem compiling stunnel 5.10 with openssl 1.0.2
by WNSDEV 26 Feb '15

26 Feb '15

stunnel 5.10 openssl 1.0.2 Ubuntu 10.04 Server lucid after installing automake-1.14.1 (required as of 5.08) and running configure without a problem, make fails with this message: /usr/bin/ld: /ssl-1.0.2/lib/libssl.a(s2_srvr.o): relocation R_X86_64_32 against `.rodata' can not be used when making a shared object; recompile with -fPIC /ssl-1.0.2/lib/libssl.a: could not read symbols: Bad value I can resolve this issue by commenting the assignment of CFLAGS and LDFLAGS in the stunnel configure script so -fPIE and -pie -fPIE are not implemented. # stunnel_CFLAGS="$stunnel_CFLAGS -fPIE" # stunnel_LDFLAGS="$stunnel_LDFLAGS -pie -fPIE" This is not required in stunnel 5.07 or earlier versions. I'm not sure exactly what the issue is here.. can anyone explain what the conflict is? Thx Pete -----Original Message----- From: Michal Trojnara [mailto:Michal.Trojnara@mirt.net] Sent: Thursday, January 22, 2015 9:20 AM To: stunnel-users(a)stunnel.org; stunnel-announce(a)stunnel.org; openssl-users(a)openssl.org Subject: [stunnel-announce] stunnel 5.10 released -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.10 of stunnel. The ChangeLog entry: Version 5.10, 2015.01.22, urgency: LOW: * New features - OCSP AIA (Authority Information Access) support. This feature can be enabled with the new service-level option "OCSPaia". - Additional security features of the linker are enabled: "-z relro", "-z now", "-z noexecstack". * Bugfixes - OpenSSL DLLs updated to version 1.0.1l. https://www.openssl.org/news/secadv_20150108.txt - FIPS canister updated to version 2.0.9 in the Win32 binary build. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 032bfc1854f8a0b9e452343c36ec6b52c7e0daef0863423c6b13a61a7c92eb23 stunnel-5.10.tar.gz 7c29753b6488f37b29f365e9c4a6060c3da8a89000af1cd29eab7c37d419d148 stunnel-5.10-installer.exe 93cd0941580eaa7815ed62ec88a111cb449e9bad97cd1a35d7524867a8238234 stunnel-5.10-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlTBMTsACgkQ/NU+nXTHMtE+uQCg9N0butSpAQ2mM1M5ySe7T18i oe8AoOAHKJ9F7jMlUfHnmuzBtIPbbghN =e9ed -----END PGP SIGNATURE----- _______________________________________________ stunnel-announce mailing list stunnel-announce(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-announce

2 1

Gmail POP3 retrieval, SSL-Error and Cert Chain
by Tobias Ruch 24 Feb '15

24 Feb '15

Hi, I want to use stunnel to enable ssl on port 995. Unfortunately, I got "SSL error: Unable to verify the first certificate." when using the gmail pop3 retrieval My Certificate is signed by wosign and included in the mozialla truststore list. https://www.ssllabs.com/ssltest/analyze.html gives me a grad A for my apache configuration and chrome and firefox are also fine with this certificate. So it's no self signed one. For a test I have configured stunnel to serve https. I get than the message that the chain is incomplete. According to https://www.digicert.com/ssl-support/gmail-pop3-troubleshooting.htm this could be one reason for this error. My Apache-config looks like this SSLCertificateFile /etc/apache2/ssl/mydomain.crt SSLCertificateKeyFile /etc/apache2/ssl//mydomain.key SSLCertificateChainFile /etc/apache2/ssl/1_root_bundle.crt SSLCACertificateFile /etc/apache2/ssl/ca-certs.pem for stunnel I used cert = /etc/apache2/ssl/mydomain.crt key = /etc/apache2/ssl//mydomain.key CAfile = /etc/apache2/ssl/1_root_bundle.crt or ca-certs.pem (I have tried both). What is the a similar configuration in stunnel? The Post https://www.stunnel.org/pipermail/stunnel-users/2010-February/002594.html mentioned, that the chain must be completely in the crt-file. But a description how to achieve this is missing and I found no other resources describing this. Thanks a lot Tobias

1 0

Stunnel for EWS servers?
by shanmuganathan sedukumar 20 Feb '15

20 Feb '15

HI, We are already using stunnel as SSL wrapper for retrieving emails from POP3 servers to our application server. In future the mailboxes are planned to be migrated to EWS servers. Would like to know if stunnel holds good for EWS servers as well. Regards,Shanmuganathan

2 1

TLSv1 - Linux vs Windows ?
by Brian Ipsen 16 Feb '15

16 Feb '15

Hi I have a strange issue with stunnel 5.09 - which connects up to a F5 loadbalancer/SSL-offloading engine. In my config, I specify that the protocol must be TLSv1 - from Linux, I can connect - but it does not work from Windows.. Linux log: 2015.02.10 15:58:29 LOG7[22779]: Service [rb20] accepted (FD=3) from 127.0.0.1:33247 2015.02.10 15:58:29 LOG7[22887]: Service [rb20] started 2015.02.10 15:58:29 LOG5[22887]: Service [rb20] accepted connection from 127.0.0.1:33247 2015.02.10 15:58:29 LOG6[22887]: s_connect: connecting A.B.C.D:443 2015.02.10 15:58:29 LOG7[22887]: s_connect: s_poll_wait A.B.C.D:443: waiting 10 seconds 2015.02.10 15:58:29 LOG5[22887]: s_connect: connected A.B.C.D:443 2015.02.10 15:58:29 LOG5[22887]: Service [rb20] connected remote server from 10.11.12.101:33477 2015.02.10 15:58:29 LOG7[22887]: Remote socket (FD=11) initialized 2015.02.10 15:58:29 LOG6[22887]: SNI: sending servername: host.domain.com 2015.02.10 15:58:29 LOG7[22887]: SSL state (connect): before/connect initialization 2015.02.10 15:58:29 LOG7[22887]: SSL state (connect): SSLv3 write client hello A 2015.02.10 15:58:29 LOG7[22887]: SSL state (connect): SSLv3 read server hello A 2015.02.10 15:58:29 LOG7[22887]: SSL state (connect): SSLv3 read finished A 2015.02.10 15:58:29 LOG7[22887]: SSL state (connect): SSLv3 write change cipher spec A 2015.02.10 15:58:29 LOG7[22887]: SSL state (connect): SSLv3 write finished A 2015.02.10 15:58:29 LOG7[22887]: SSL state (connect): SSLv3 flush data 2015.02.10 15:58:29 LOG7[22887]: 1 items in the session cache 2015.02.10 15:58:29 LOG7[22887]: 5 client connects (SSL_connect()) 2015.02.10 15:58:29 LOG7[22887]: 5 client connects that finished 2015.02.10 15:58:29 LOG7[22887]: 0 client renegotiations requested 2015.02.10 15:58:29 LOG7[22887]: 0 server connects (SSL_accept()) 2015.02.10 15:58:29 LOG7[22887]: 0 server connects that finished 2015.02.10 15:58:29 LOG7[22887]: 0 server renegotiations requested 2015.02.10 15:58:29 LOG7[22887]: 4 session cache hits 2015.02.10 15:58:29 LOG7[22887]: 0 external session cache hits 2015.02.10 15:58:29 LOG7[22887]: 0 session cache misses 2015.02.10 15:58:29 LOG7[22887]: 0 session cache timeouts 2015.02.10 15:58:29 LOG6[22887]: SSL connected: previous session reused 2015.02.10 15:58:29 LOG7[22779]: Service [rb20] accepted (FD=12) from 127.0.0.1:33249 2015.02.10 15:58:29 LOG6[22887]: Read socket closed (read hangup) 2015.02.10 15:58:29 LOG7[22887]: Sending close_notify alert 2015.02.10 15:58:29 LOG7[22887]: SSL alert (write): warning: close notify 2015.02.10 15:58:29 LOG6[22887]: SSL_shutdown successfully sent close_notify alert 2015.02.10 15:58:29 LOG7[22888]: Service [rb20] started 2015.02.10 15:58:29 LOG5[22888]: Service [rb20] accepted connection from 127.0.0.1:33249 2015.02.10 15:58:29 LOG6[22888]: s_connect: connecting A.B.C.D:443 2015.02.10 15:58:29 LOG7[22888]: s_connect: s_poll_wait A.B.C.D:443: waiting 10 seconds 2015.02.10 15:58:29 LOG5[22888]: s_connect: connected A.B.C.D:443 2015.02.10 15:58:29 LOG5[22888]: Service [rb20] connected remote server from 10.11.12.101:33479 2015.02.10 15:58:29 LOG7[22888]: Remote socket (FD=13) initialized 2015.02.10 15:58:29 LOG6[22888]: SNI: sending servername: ssl39.dmsave.com 2015.02.10 15:58:29 LOG7[22888]: SSL state (connect): before/connect initialization 2015.02.10 15:58:29 LOG7[22888]: SSL state (connect): SSLv3 write client hello A 2015.02.10 15:58:29 LOG6[22887]: SSL socket closed (SSL_read) 2015.02.10 15:58:29 LOG7[22887]: Sent socket write shutdown 2015.02.10 15:58:29 LOG5[22887]: Connection closed: 136 byte(s) sent to SSL, 52 byte(s) sent to socket 2015.02.10 15:58:29 LOG7[22887]: Remote socket (FD=11) closed 2015.02.10 15:58:29 LOG7[22887]: Local socket (FD=3) closed 2015.02.10 15:58:29 LOG7[22887]: Service [rb20] finished (1 left) 2015.02.10 15:58:29 LOG7[22888]: SSL state (connect): SSLv3 read server hello A 2015.02.10 15:58:29 LOG7[22888]: SSL state (connect): SSLv3 read finished A 2015.02.10 15:58:29 LOG7[22888]: SSL state (connect): SSLv3 write change cipher spec A 2015.02.10 15:58:29 LOG7[22888]: SSL state (connect): SSLv3 write finished A 2015.02.10 15:58:29 LOG7[22888]: SSL state (connect): SSLv3 flush data 2015.02.10 15:58:29 LOG7[22888]: 1 items in the session cache 2015.02.10 15:58:29 LOG7[22888]: 6 client connects (SSL_connect()) 2015.02.10 15:58:29 LOG7[22888]: 6 client connects that finished 2015.02.10 15:58:29 LOG7[22888]: 0 client renegotiations requested 2015.02.10 15:58:29 LOG7[22888]: 0 server connects (SSL_accept()) 2015.02.10 15:58:29 LOG7[22888]: 0 server connects that finished 2015.02.10 15:58:29 LOG7[22888]: 0 server renegotiations requested 2015.02.10 15:58:29 LOG7[22888]: 5 session cache hits 2015.02.10 15:58:29 LOG7[22888]: 0 external session cache hits 2015.02.10 15:58:29 LOG7[22888]: 0 session cache misses 2015.02.10 15:58:29 LOG7[22888]: 0 session cache timeouts 2015.02.10 15:58:29 LOG6[22888]: SSL connected: previous session reused Windows log: 2015.02.10 16:07:36 LOG7[9528]: Service [rb20] accepted (FD=1128) from 127.0.0.1:50353 2015.02.10 16:07:36 LOG7[9528]: Creating a new thread 2015.02.10 16:07:36 LOG7[9528]: New thread created 2015.02.10 16:07:36 LOG7[7056]: Service [rb20] started 2015.02.10 16:07:36 LOG5[7056]: Service [rb20] accepted connection from 127.0.0.1:50353 2015.02.10 16:07:36 LOG6[7056]: s_connect: connecting A.B.C.D:443 2015.02.10 16:07:36 LOG7[7056]: s_connect: s_poll_wait A.B.C.D:443: waiting 10 seconds 2015.02.10 16:07:36 LOG5[7056]: s_connect: connected A.B.C.D:443 2015.02.10 16:07:36 LOG5[7056]: Service [rb20] connected remote server from 192.168.225.103:50354 2015.02.10 16:07:36 LOG7[7056]: Remote socket (FD=1124) initialized 2015.02.10 16:07:36 LOG6[7056]: SNI: sending servername: host.domain.com 2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): before/connect initialization 2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): SSLv3 write client hello A 2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): SSLv3 read server hello A 2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): SSLv3 read server certificate A 2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): SSLv3 read server done A 2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): SSLv3 write client key exchange A 2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): SSLv3 write change cipher spec A 2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): SSLv3 write finished A 2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): SSLv3 flush data 2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): SSLv3 read finished A 2015.02.10 16:07:36 LOG7[7056]: 1 items in the session cache 2015.02.10 16:07:36 LOG7[7056]: 1 client connects (SSL_connect()) 2015.02.10 16:07:36 LOG7[7056]: 1 client connects that finished 2015.02.10 16:07:36 LOG7[7056]: 0 client renegotiations requested 2015.02.10 16:07:36 LOG7[7056]: 0 server connects (SSL_accept()) 2015.02.10 16:07:36 LOG7[7056]: 0 server connects that finished 2015.02.10 16:07:36 LOG7[7056]: 0 server renegotiations requested 2015.02.10 16:07:36 LOG7[7056]: 0 session cache hits 2015.02.10 16:07:36 LOG7[7056]: 0 external session cache hits 2015.02.10 16:07:36 LOG7[7056]: 0 session cache misses 2015.02.10 16:07:36 LOG7[7056]: 0 session cache timeouts 2015.02.10 16:07:36 LOG7[7056]: Peer certificate was cached (1521 bytes) 2015.02.10 16:07:36 LOG6[7056]: SSL connected: new session negotiated 2015.02.10 16:07:36 LOG6[7056]: Negotiated TLSv1 ciphersuite RC4-MD5 (128-bit encryption) 2015.02.10 16:07:36 LOG7[7056]: Compression: null, expansion: null 2015.02.10 16:07:36 LOG6[7056]: Read socket closed (readsocket) 2015.02.10 16:07:36 LOG7[7056]: Sending close_notify alert 2015.02.10 16:07:36 LOG7[7056]: SSL alert (write): warning: close notify 2015.02.10 16:07:36 LOG6[7056]: SSL_shutdown successfully sent close_notify alert 2015.02.10 16:07:36 LOG7[9528]: Service [rb20] accepted (FD=1132) from 127.0.0.1:50355 2015.02.10 16:07:36 LOG7[9528]: Creating a new thread 2015.02.10 16:07:36 LOG7[9528]: New thread created 2015.02.10 16:07:36 LOG7[2164]: Service [rb20] started 2015.02.10 16:07:36 LOG5[2164]: Service [rb20] accepted connection from 127.0.0.1:50355 2015.02.10 16:07:36 LOG6[2164]: s_connect: connecting A.B.C.D:443 2015.02.10 16:07:36 LOG7[2164]: s_connect: s_poll_wait A.B.C.D:443: waiting 10 seconds 2015.02.10 16:07:36 LOG5[2164]: s_connect: connected A.B.C.D:443 2015.02.10 16:07:36 LOG5[2164]: Service [rb20] connected remote server from 192.168.225.103:50356 2015.02.10 16:07:36 LOG7[2164]: Remote socket (FD=1152) initialized 2015.02.10 16:07:36 LOG6[2164]: SNI: sending servername: host.domain.com 2015.02.10 16:07:36 LOG7[2164]: SSL state (connect): before/connect initialization 2015.02.10 16:07:36 LOG7[2164]: SSL state (connect): SSLv3 write client hello A 2015.02.10 16:07:36 LOG6[7056]: SSL socket closed (SSL_read) 2015.02.10 16:07:36 LOG7[7056]: Sent socket write shutdown 2015.02.10 16:07:36 LOG5[7056]: Connection closed: 89 byte(s) sent to SSL, 52 byte(s) sent to socket 2015.02.10 16:07:36 LOG7[7056]: Remote socket (FD=1124) closed 2015.02.10 16:07:36 LOG7[7056]: Local socket (FD=1128) closed 2015.02.10 16:07:36 LOG7[7056]: Service [rb20] finished (1 left) The main difference I can see, is that on Linux I get: 2015.02.10 15:58:29 LOG6[22887]: SSL connected: previous session reused Whereas Windows gives me: 2015.02.10 16:07:36 LOG7[7056]: Peer certificate was cached (1521 bytes) 2015.02.10 16:07:36 LOG6[7056]: SSL connected: new session negotiated Any idea why this happens ? The final result is that connections are possible from linux - but not Windows - and this is a problem for me... Regards /Brian

2 2

stunnel transparent mode stuck in timeout
by shushant.kakkar＠lhsystems.com 09 Feb '15

09 Feb '15

Hi, we would like to use stunnel in transpartent mode. Therefore we already applied iptable changes as mentioned in the man page : Re-write address to appear as if wrapped daemon is connecting from the SSL client machine instead of the machine running stunnel. This option is currently available in: remote mode (I<connect> option) on Linux >=2.6.28 Linux >=2.6.28 requires the following setup for iptables and routing (possibly in /etc/rc.local or equivalent file): iptables -t mangle -N DIVERT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 However the connection to the services cannot be established and we run into a timeout. 2015.02.09 10:00:03 LOG7[6658:139940568909760]: ldaps-in accepted FD=12 from xxxxxx:51018 2015.02.09 10:00:03 LOG7[6658:139940568905472]: ldaps-in started 2015.02.09 10:00:03 LOG7[6658:139940568905472]: FD 12 in non-blocking mode 2015.02.09 10:00:03 LOG7[6658:139940568905472]: Waiting for a libwrap process 2015.02.09 10:00:03 LOG7[6658:139940568905472]: Acquired libwrap process #0 2015.02.09 10:00:03 LOG7[6658:139940568905472]: Releasing libwrap process #0 2015.02.09 10:00:03 LOG7[6658:139940568905472]: Released libwrap process #0 2015.02.09 10:00:03 LOG7[6658:139940568905472]: ldaps-in permitted by libwrap from xxxxxxx:51018 2015.02.09 10:00:03 LOG5[6658:139940568905472]: ldaps-in accepted connection from xxxxxxx:51018 2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): before/accept initialization 2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 read client hello A 2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 write server hello A 2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 write certificate A 2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 write server done A 2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 flush data 2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 read client key exchange A 2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 read finished A 2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 write change cipher spec A 2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 write finished A 2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 flush data 2015.02.09 10:00:03 LOG7[6658:139940568905472]: 1 items in the session cache 2015.02.09 10:00:03 LOG7[6658:139940568905472]: 0 client connects (SSL_connect()) 2015.02.09 10:00:03 LOG7[6658:139940568905472]: 0 client connects that finished 2015.02.09 10:00:03 LOG7[6658:139940568905472]: 0 client renegotiations requested 2015.02.09 10:00:03 LOG7[6658:139940568905472]: 1 server connects (SSL_accept()) 2015.02.09 10:00:03 LOG7[6658:139940568905472]: 1 server connects that finished 2015.02.09 10:00:03 LOG7[6658:139940568905472]: 0 server renegotiations requested 2015.02.09 10:00:03 LOG7[6658:139940568905472]: 0 session cache hits 2015.02.09 10:00:03 LOG7[6658:139940568905472]: 0 external session cache hits 2015.02.09 10:00:03 LOG7[6658:139940568905472]: 0 session cache misses 2015.02.09 10:00:03 LOG7[6658:139940568905472]: 0 session cache timeouts 2015.02.09 10:00:03 LOG6[6658:139940568905472]: SSL accepted: new session negotiated 2015.02.09 10:00:03 LOG6[6658:139940568905472]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2015.02.09 10:00:03 LOG7[6658:139940568905472]: FD 13 in non-blocking mode 2015.02.09 10:00:03 LOG6[6658:139940568905472]: local_bind succeeded on the original port 2015.02.09 10:00:03 LOG6[6658:139940568905472]: connect_blocking: connecting 127.0.0.1:10389 2015.02.09 10:00:03 LOG7[6658:139940568905472]: connect_blocking: s_poll_wait 127.0.0.1:10389: waiting 10 seconds 2015.02.09 10:00:13 LOG3[6658:139940568905472]: connect_blocking: s_poll_wait 127.0.0.1:10389: timeout 2015.02.09 10:00:13 LOG5[6658:139940568905472]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2015.02.09 10:00:13 LOG7[6658:139940568905472]: ldaps-in finished (0 left) Any idea why the timeout is occuring? Best regards, Shushant

1 0

New PGP key
by Michal Trojnara 06 Feb '15

06 Feb '15

Dear Users, As of now I'm starting to sign my emails and code with a new PGP key. The new key is attached to this email message, and available at https://www.stunnel.org/pgp.asc Key fingerprint = AC91 5EA3 0645 D9D3 D4DA E4FE B104 8932 DD3A AAA3 The new key is also signed with my previous PGP key. This and other signatures can be verified with: gpg --check-sigs "AC91 5EA3 0645 D9D3 D4DA E4FE B104 8932 DD3A AAA3" Best regards, Mike

1 0

stunnel keeps using SSLv3 even after disabling it
by Or Yarimi 04 Feb '15

04 Feb '15

Hi, I'm using stunnel to communicate with FIX server. In order to do that, I disabled SSLv2 and SSLv3 and set the sslVersion to TLSv1. It seems like stunnel keeps trying using SSLv3 handshake, which isn't working. This is the configuration: client = yes debug = 7 output=stunnel.log cert = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Turning for LMAX options = NO_SSLv2 options = NO_SSLv3 [LMAX-fix-tunnel-DEMO-Trading] sslVersion = TLSv1 accept = 40001 connect = fix-ate.lmaxtrader.com:443 stunnel log: 2015.02.04 12:10:31 LOG7[12516]: Service [LMAX-fix-tunnel-DEMO-MktData] started 2015.02.04 12:10:31 LOG5[12516]: Service [LMAX-fix-tunnel-DEMO-MktData] accepted connection from 127.0.0.1:59475 2015.02.04 12:10:31 LOG6[12516]: s_connect: connecting 91.215.165.69:443 2015.02.04 12:10:31 LOG7[12516]: s_connect: s_poll_wait 91.215.165.69:443: waiting 10 seconds 2015.02.04 12:10:31 LOG5[12516]: s_connect: connected 91.215.165.69:443 2015.02.04 12:10:31 LOG5[12516]: Service [LMAX-fix-tunnel-DEMO-MktData] connected remote server from 10.0.0.62:59476 2015.02.04 12:10:31 LOG7[12516]: Remote socket (FD=620) initialized 2015.02.04 12:10:31 LOG6[12516]: SNI: sending servername: fix-md-ate.lmaxtrader.com 2015.02.04 12:10:31 LOG7[12516]: SSL state (connect): before/connect initialization 2015.02.04 12:10:31 LOG7[12516]: SSL state (connect): SSLv3 write client hello A Already burned around 4 hours understanding what I'm doing wrong, will be glad if you could help me. Thanks in advance, Or. -- *Attention:* This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error, please notify the sender immediately by replying to this message, and delete the original message from your system without making a copy. This e-mail is attributed to the sender and does not necessarily reflect the view of Markets Pulse P.S. Ltd. or any affiliate. Please consider the environment before printing this email.

1 0

Can't compile stunnel 5.10 on Linux ... got fatal signal 11 error
by amontaron 03 Feb '15

03 Feb '15

Hi everybody ! I tried to compile stunnel 5.10 (latest) on my old Suse 7 Linux distrib and got "a fatal signal 11 error message" when doing the make command. Just before, openssl 1.0.2 (latest) compile fine with no errors. Also, I add some stuffs like xemacs 21.4.22 (latest) just to say that that rather old distrib is able to do all that :-D So, here is the latest messages from make I got : > Making all in src > make[1]: Entering directory `/root/stunnel-5.10/src' > make all-am > make[2]: Entering directory `/root/stunnel-5.10/src' > source='stunnel.c' object='stunnel-stunnel.o' libtool=no \ > DEPDIR=.deps depmode=gcc /bin/sh ../auto/depcomp \ > gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include > -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' > -DCONFDIR='"/usr/local/etc/stunnel"' -g -O2 -pthread -Wall > -Wformat=2 -Wconversion -Wno-long-long -Wno-deprecated-declarations > -D_FORTIFY_SOURCE=2 -c -o stunnel-stunnel.o `test -f 'stunnel.c' || > echo './'`stunnel.c > In file included from /usr/include/string.h:346, > from common.h:201, > from stunnel.c:38: > /usr/include/bits/string2.h: In function `__strsep_g': > /usr/include/bits/string2.h:1171: warning: passing arg 2 of > `__strpbrk_c2' with different width due to prototype > /usr/include/bits/string2.h:1171: warning: passing arg 3 of > `__strpbrk_c2' with different width due to prototype > /usr/include/bits/string2.h:1171: warning: passing arg 2 of > `__strpbrk_c3' with different width due to prototype > /usr/include/bits/string2.h:1171: warning: passing arg 3 of > `__strpbrk_c3' with different width due to prototype > /usr/include/bits/string2.h:1171: warning: passing arg 4 of > `__strpbrk_c3' with different width due to prototype > gcc: Internal compiler error: program cc1 got fatal signal 11 > make[2]: *** [stunnel-stunnel.o] Error 1 > make[2]: Leaving directory `/root/stunnel-5.10/src' > make[1]: *** [all] Error 2 > make[1]: Leaving directory `/root/stunnel-5.10/src' > make: *** [all-recursive] Error 1 Previously got lots of warning messages. Perhaps need "make report" also ? I've look at stunnel-users(a)stunnel.org mail archive up to July 2011 with no success. So, that's why I'm writting to you there... Then, I tried different versions of stunnel 4.xx like 4.00, 4.56, 4.28 and more. All simply don't compile with differents errors messages. The only one I could compile completly is stunnel 3.22 (so latest 3.xx) Note that I'm happy with that because I was running stunnel 3.3 just before and that everything works with the latest openssl version I download and everything works fine for what I would ! Remark: Suse7 distrib (not OpenSuse) is Linux 2.2.16 kernel (not latest :-D) Alex. PS: Another things, on the same machine I ran stunnel 4.56 on (old) Windows 98 with no problems. --- Ce courrier électronique ne contient aucun virus ou logiciel malveillant parce que la protection avast! Antivirus est active. http://www.avast.com

2 2

stunnel log shows SSLv3 protocol level even when TLSv1 was negotiated
by christian.tenvenne＠lhsystems.com 03 Feb '15

03 Feb '15

I'm running stunnel in server-mode with options "NO_SSLV2" and "NO_SSLV3" and sslVersion=all. My client also explicitly disables SSLv2 and SSLv3. My client's ssl-log (-Djavax.net.debug=ssl) confirms that, during handshake and for application data, the highest TLS protocol version is being used. How come, stunnel log still shows "SSLv3" ? 2015.02.03 14:42:46 LOG5[8415:140561397376768]: ldaps-in accepted connection from X.X.X.X:65158 2015.02.03 14:42:46 LOG7[8415:140561397376768]: SSL state (accept): before/accept initialization 2015.02.03 14:42:46 LOG7[8415:140561397376768]: SSL state (accept): SSLv3 read client hello A 2015.02.03 14:42:46 LOG7[8415:140561397376768]: SSL state (accept): SSLv3 write server hello A 2015.02.03 14:42:46 LOG7[8415:140561397376768]: SSL state (accept): SSLv3 write certificate A 2015.02.03 14:42:46 LOG7[8415:140561397376768]: SSL state (accept): SSLv3 write server done A 2015.02.03 14:42:46 LOG7[8415:140561397376768]: SSL state (accept): SSLv3 flush data 2015.02.03 14:42:46 LOG7[8415:140561397376768]: SSL state (accept): SSLv3 read client key exchange A 2015.02.03 14:42:46 LOG7[8415:140561397376768]: SSL state (accept): SSLv3 read finished A 2015.02.03 14:42:46 LOG7[8415:140561397376768]: SSL state (accept): SSLv3 write change cipher spec A 2015.02.03 14:42:46 LOG7[8415:140561397376768]: SSL state (accept): SSLv3 write finished A 2015.02.03 14:42:46 LOG7[8415:140561397376768]: SSL state (accept): SSLv3 flush data 2015.02.03 14:42:46 LOG7[8415:140561397376768]: 9 items in the session cache 2015.02.03 14:42:46 LOG7[8415:140561397376768]: 0 client connects (SSL_connect()) 2015.02.03 14:42:46 LOG7[8415:140561397376768]: 0 client connects that finished 2015.02.03 14:42:46 LOG7[8415:140561397376768]: 0 client renegotiations requested 2015.02.03 14:42:46 LOG7[8415:140561397376768]: 12 server connects (SSL_accept()) 2015.02.03 14:42:46 LOG7[8415:140561397376768]: 9 server connects that finished 2015.02.03 14:42:46 LOG7[8415:140561397376768]: 0 server renegotiations requested 2015.02.03 14:42:46 LOG7[8415:140561397376768]: 0 session cache hits 2015.02.03 14:42:46 LOG7[8415:140561397376768]: 0 external session cache hits 2015.02.03 14:42:46 LOG7[8415:140561397376768]: 0 session cache misses 2015.02.03 14:42:46 LOG7[8415:140561397376768]: 0 session cache timeouts 2015.02.03 14:42:46 LOG6[8415:140561397376768]: SSL accepted: new session negotiated 2015.02.03 14:42:46 LOG6[8415:140561397376768]: Negotiated ciphers: AES128-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 Is my client's ssl-log wrong? Or stunnel's? Kind regards, Christian Tenvenne

2 1

issue with stunnel forwarding
by David 03 Feb '15

03 Feb '15

I am trying to configure stunnel on a bridge server which needs to use ssl to talk to 3 others servers. below is my conf file: ; ***************************************** Example SSL server mode services [ xyz ] accept=10.10.10.74:9908 connect= 127.0.0.10:1040 transparent = source[ hp ] accept=10.10.10.218:9904 connect=127.0.0.10:1041 transparent = source[ sql] accept=10.10.10.214:59053 connect=127.0.0.10:1042 transparent = source when I run the stunnel GUI start I get following message: [ ] No limit detected for the number of clients [.] stunnel 5.10 on x86-pc-msvc-1500 platform [.] Compiled/running with OpenSSL 1.0.1l 15 Jan 2015 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_errno()) [.] Reading configuration from file stunnel.conf [ ] GUI message loop initialized [.] UTF-8 byte order mark detected [ ] Enabling support for engine "capi" [ ] Initializing engine #1 (capi) [ ] Engine #1 (capi) initialized [.] FIPS mode disabled [ ] Compression disabled [ ] Snagged 64 random bytes from C:/.rnd [ ] Wrote 1024 new random bytes to C:/.rnd [ ] PRNG seeded successfully [!] Line 62: "transparent = source": Specified option name is not valid here[!] Server is down what am I missing here? thanks! nazja2015

2 1

stunnel-5.10, FreeBsd Package building, missing openssl and perl packages and config menue for Stunnel is missing ssl port
by mugetsu shinde 03 Feb '15

03 Feb '15

so ive noticed in the previous stunnel 5.07 i was able to select SSL_PORT when making the config for Stunnel , well now after downloading stunnel 5.10 with FreeBsd 10.1 over portsnap fetch extract , Stunnel is missing the option: SSL_PORT why , whats going on ? btw ive noticed openssl and perl arent downloaded from the portsnap server either apparently , help please , i need this for my pfsense 2.2 release vm to work with Stunnel again

2 1

Re: [stunnel-users] Centos 6.6 Final stunnel-4.29-3.el6_6.1.x86_64 - options set problem SSLv3
by Sebastian Ochsenkühn 29 Jan '15

29 Jan '15

Hi Mike, thanks for your fast response, but I think there is a big issue. The latest version that is available in the CENTOS 6 Base Repo is "stunnel-4.29-3.el6_6.1.x86_64" - In this version the SSLv3 is disabled by default, but there is not option to enable it. I hope you understand my situation :-) ________________________________ Von: stunnel-users <stunnel-users-bounces(a)stunnel.org> im Auftrag von Michal Trojnara <Michal.Trojnara(a)mirt.net> Gesendet: Donnerstag, 29. Januar 2015 11:44 An: stunnel-users(a)stunnel.org Betreff: Re: [stunnel-users] Centos 6.6 Final stunnel-4.29-3.el6_6.1.x86_64 - options set problem SSLv3 Hi Sebastian, My documentation describes the latest version of stunnel. For an old version please refer to the appropriate manual page distributed with the specific version you're using. Mike On 29.01.2015 11:40, Sebastian Ochsenkühn wrote: Hi, I have a big problem with the new stunnel version on CentOS 6.6 (stunnel-4.29-3.el6_6.1.x86_64) that is available in the CentOS base repository. You describe in your documentation that SSLv3 is disabled by default. -> OK for me, but I need SSLv3 and the option with -NO_SSLv3 is not working?! PS: this is also not working with -NO_SSLv2 option. options = -NO_SSLv3 = NOT Working option = NO_SSLv3 = Working. Currently i have installed an older version, where the SSLv3 protocoll is not disabled by default. Is there anything that I'm doing wrong? Thanks and Regards, Sebastian. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org<mailto:stunnel-users@stunnel.org> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

2 1

Re: [stunnel-users] Centos 6.6 Final stunnel-4.29-3.el6_6.1.x86_64 - options set problem SSLv3
by Sebastian Ochsenkühn 29 Jan '15

29 Jan '15

Hi Mike, yes your correct, but I have forced the installation with "stunnel-4.29-3.el6_4.x86_64" ( all other packages openssl, etc. updated) and SSLv3 is working again. So, for my understanding there must be a bug or they have disabled SSLv3 in version "stunnel-4.29-3.el6_6.1.x86_64". Regards, Sebastian. ________________________________ Von: stunnel-users <stunnel-users-bounces(a)stunnel.org> im Auftrag von Michal Trojnara <Michal.Trojnara(a)mirt.net> Gesendet: Donnerstag, 29. Januar 2015 12:12 An: stunnel-users(a)stunnel.org Betreff: Re: [stunnel-users] Centos 6.6 Final stunnel-4.29-3.el6_6.1.x86_64 - options set problem SSLv3 Hi Sebastian, The ChangeLog does not say anything about disabling SSLv3: http://rpmfind.net/linux/RPM/centos/updates/6.6/x86_64/Packages/stunnel-4.2… I guess it may be disabled in the OpenSSL rather than in stunnel. Anyway, if you connect stunnel with some software that's so old that it doesn't support TLS, the software is almost certainly no longer supported, and most likely vulnerable to attacks. This is a serious risk! Mike On 29.01.2015 11:58, Sebastian Ochsenkühn wrote: Hi Mike, thanks for your fast response, but I think there is a big issue. The latest version that is available in the CENTOS 6 Base Repo is "stunnel-4.29-3.el6_6.1.x86_64" - In this version the SSLv3 is disabled by default, but there is not option to enable it. I hope you understand my situation :-) ________________________________ Von: stunnel-users <stunnel-users-bounces(a)stunnel.org><mailto:stunnel-users-bounces@stunnel.org> im Auftrag von Michal Trojnara <Michal.Trojnara(a)mirt.net><mailto:Michal.Trojnara@mirt.net> Gesendet: Donnerstag, 29. Januar 2015 11:44 An: stunnel-users(a)stunnel.org<mailto:stunnel-users@stunnel.org> Betreff: Re: [stunnel-users] Centos 6.6 Final stunnel-4.29-3.el6_6.1.x86_64 - options set problem SSLv3 Hi Sebastian, My documentation describes the latest version of stunnel. For an old version please refer to the appropriate manual page distributed with the specific version you're using. Mike On 29.01.2015 11:40, Sebastian Ochsenkühn wrote: Hi, I have a big problem with the new stunnel version on CentOS 6.6 (stunnel-4.29-3.el6_6.1.x86_64) that is available in the CentOS base repository. You describe in your documentation that SSLv3 is disabled by default. -> OK for me, but I need SSLv3 and the option with -NO_SSLv3 is not working?! PS: this is also not working with -NO_SSLv2 option. options = -NO_SSLv3 = NOT Working option = NO_SSLv3 = Working. Currently i have installed an older version, where the SSLv3 protocoll is not disabled by default. Is there anything that I'm doing wrong? Thanks and Regards, Sebastian. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org<mailto:stunnel-users@stunnel.org> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Centos 6.6 Final stunnel-4.29-3.el6_6.1.x86_64 - options set problem SSLv3
by Sebastian Ochsenkühn 29 Jan '15

29 Jan '15

Hi, I have a big problem with the new stunnel version on CentOS 6.6 (stunnel-4.29-3.el6_6.1.x86_64) that is available in the CentOS base repository. You describe in your documentation that SSLv3 is disabled by default. -> OK for me, but I need SSLv3 and the option with -NO_SSLv3 is not working?! PS: this is also not working with -NO_SSLv2 option. options = -NO_SSLv3 = NOT Working option = NO_SSLv3 = Working. Currently i have installed an older version, where the SSLv3 protocoll is not disabled by default. Is there anything that I'm doing wrong? Thanks and Regards, Sebastian.

1 0

Blue Iris
by Patrick wickline 22 Jan '15

22 Jan '15

I have stunnel set up on my machine. It works locally and lets me connect to my Blue Iris server with https. However, I am unable to do this remotely. I have forwarded the port in my router to stunnel, from stunnel to blue iris, but still doesn't work. Below is part of my conf file [Blue Iris] accept = 8344 (forwarded this in the router to my static IP of my machine) connect = 127.0.0.1:8081 (8081 is my blue iris web server) I hope someone is able to give some advice

2 1

stunnel 5.10 released
by Michal Trojnara 22 Jan '15

22 Jan '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.10 of stunnel. The ChangeLog entry: Version 5.10, 2015.01.22, urgency: LOW: * New features - OCSP AIA (Authority Information Access) support. This feature can be enabled with the new service-level option "OCSPaia". - Additional security features of the linker are enabled: "-z relro", "-z now", "-z noexecstack". * Bugfixes - OpenSSL DLLs updated to version 1.0.1l. https://www.openssl.org/news/secadv_20150108.txt - FIPS canister updated to version 2.0.9 in the Win32 binary build. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 032bfc1854f8a0b9e452343c36ec6b52c7e0daef0863423c6b13a61a7c92eb23 stunnel-5.10.tar.gz 7c29753b6488f37b29f365e9c4a6060c3da8a89000af1cd29eab7c37d419d148 stunnel-5.10-installer.exe 93cd0941580eaa7815ed62ec88a111cb449e9bad97cd1a35d7524867a8238234 stunnel-5.10-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlTBMTsACgkQ/NU+nXTHMtE+uQCg9N0butSpAQ2mM1M5ySe7T18i oe8AoOAHKJ9F7jMlUfHnmuzBtIPbbghN =e9ed -----END PGP SIGNATURE-----

1 0

Re: [stunnel-users] No DNS lookup?
by Colin van der Zanden 21 Jan '15

21 Jan '15

Ludolf, Thanks for your quick response. I have no clue on how to respond on the stunnel users list, so i'll try it this way. The support on the host we are trying to reach states to following: It really sounds like the stunnel is not connecting to "something.host.com" but perhaps to the IP address behind it? The use of the hostname something.host.com is however an requirement. Is there anyway we can force the stunnel to connect to the hostname instead of resolving it as an IP adress? Met vriendelijke groeten, H.N. Post en Zonen Colin van der Zanden c.vanderzanden(a)duurzaam-transport.com c.vanderzanden(a)hnpostenzonen.nl <dm.post(a)hnpostenzonen.nl> ---------------------------------------------- Dit e-mailbericht is uitsluitend bestemd voor de geadresseerde(n). Wilt u direct contact met ons opnemen indien deze e-mail bij vergissing bij u terecht is gekomen? Wij verzoeken u in dat geval de e-mail te vernietigen, de inhoud ervan niet te gebruiken en niet onder derden te verspreiden, omdat het bericht vertrouwelijke informatie kan bevatten, beschermd door een beroepsgeheim.

5 5

No DNS lookup?
by Colin vd Zanden 20 Jan '15

20 Jan '15

Hi, We've got a bit of a problem working with Stunnel. We are trying to connect to a domain, but the stunnel is somehow translating it to a IP adres. (We didn't know, we saw it in the log file). This is causing our connection to fail. Is there any way to prevent stunnel from translating the domain into a IP, and just connect to the domain name?

2 1

Stunnel, please add me to your LinkedIn network
by Neacsu Mihai Adrian 17 Jan '15

17 Jan '15

Hi Stunnel, I'd like to connect with you on LinkedIn. Neacsu Mihai Adrian Software Developer at RND Software Accept: https://www.linkedin.com/blink?simpleRedirect=0Qd3ASe34VcjAPcPsMcjcOdzARfkh… View Neacsu Mihai Adrian's profile: https://www.linkedin.com/blink?simpleRedirect=d3gTdPANcP8Ofkh9sClyrmlJ9C56m… You are receiving Invitation emails. Unsubscribe here: https://www.linkedin.com/blink?simpleRedirect=7wQbmcVemZCcjlFbj1SqPsRdjRAqm… This email was intended for Stunnel Users (stunnel user at n/a). Learn why we included this at the following link: https://www.linkedin.com/blink?simpleRedirect=0Ue3sQfmh9pmNzqnhOoioUcBZOpm9… © 2014, LinkedIn Corporation. 2029 Stierlin Ct. Mountain View, CA 94043, USA

2 1

HTTPS support for the webserver using STUNNEL
by Siva Kumar 13 Jan '15

13 Jan '15

Hi All, I am fairly new to stunnel and also to the networking concepts. Currently we are working on a surveillance device running on monta vista linux on the ARM11 architecture. We have crossed compiled and deployed a THTTPD server which is working fine. Once you connect to the device using any of the web client (from a windows PC), it will take you to a web page where you can select and stream live video's from all the camera's connected to the device. So far everything is working fine now.. Now the real problem is that we need to support https as well along with http. Since THTTPD web server doesn't support secure connection we thought we would accomplish that using the stunnel application. We were able to download and cross compile the stunnel application for the device. Now the doubts I have here is:- 1) Do we need a stunnel server application running on the windows PC from where we will be using the web browser to connect to the client? 2) Where should be the stunnel server and stunnel client be running. I mean should the linux device be running the stunnel client and the windows PC be running the stunnel server? In that case what should be the correct accept and connect parameters in the stunnel.conf file in both the device and the windows PC? 3) Since the device and the machine can have any random IP and port, so is it feasible to dynamically set the accept and connect parameters in the stunnel.conf file? 4) Can the stunnel be considered as a solution to the problem which I have reported here. The point 3 above makes me thing otherwise. I have tried all combinations mentioned in the point 1 and 2 without success. In none of the case my web browser was able to talk to the device using HTTPS (ie https://my_device_ip). I could see a "client hello" request from the browser to which the client sends an ACK and RST. In some combination an HTTPS request from the browser only triggered a TCP connection request for which the client responded with ACK and RST. Sorry for the long mail. Any inputs would be deeply appreciated. Regards, Siva

2 2

Using stunnel to secure clients instead of servers
by Leon Smith 07 Jan '15

07 Jan '15

Hi, this may be a slightly unusual request, but I was curious if stunnel could be used for securing clients that do not support TLS, to connect to services that optionally support TLS. So, really, stunnel already does almost everything that would be needed; except that in this use case, it would be listening for incoming unencrypted connections, and then serve as a proxy to an encrypted connection to the actual service. While it might be nice to offer certificate-based authentication options in this scenario, it wouldn't be necessary for my intended use case, so stunnel wouldn't need access to any private certificates. However, certificate pinning would be pretty essential to what I have in mind. Best, Leon.

2 5

stunnel 5.09 released
by Michal Trojnara 02 Jan '15

02 Jan '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.09 of stunnel. The ChangeLog entry: Version 5.09, 2015.01.02, urgency: LOW: * New features - Added PSK authentication with two new service-level configuration file options "PSKsecrets" and "PSKidentity". - Added additional security checks to the OpenSSL memory management functions. - Added support for the OPENSSL_NO_OCSP and OPENSSL_NO_ENGINE OpenSSL configuration flags. - Added compatibility with the current OpenSSL 1.1.0-dev tree. * Bugfixes - Removed defective s_poll_error() code occasionally causing connections to be prematurely closed (truncated). This bug was introduced in stunnel 4.34. - Fixed ./configure systemd detection (thx to Kip Walraven). - Fixed ./configure sysroot detection (thx to Kip Walraven). - Fixed compilation against old versions of OpenSSL. - Removed outdated French manual page. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 87b34a74061861d1edd2ab238c73eb989b3d0a17e44574b7b6ead1a16aae38c8 stunnel-5.09.tar.gz 4abbddf3c1dbedf54b14fa5a18ead11e4df6387f13189b665c2ec5759c4afd30 stunnel-5.09-installer.exe 23c33dc46cc1bfb1df77c88d3c48901822bc113dd1e67d138bcf5fb1bb3d4197 stunnel-5.09-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlSmt98ACgkQ/NU+nXTHMtGZowCfTspj4OZn8DRBUboG2S+1Qy2A ocoAoLdZpjJU7BjERXqQakhNIPOXFojN =/MD9 -----END PGP SIGNATURE-----

1 0

help with xforwarded-for
by Senthil Naidu 30 Dec '14

30 Dec '14

Hi, I am trying to use stunnel 5.08 can we enable xforwarded-for option using some patches , the last patch I see is in haproxy website for version stunnel version 4.32 Regards Senthil

2 1

SSL alert (read): warning: close notify
by Jinming Shao 22 Dec '14

22 Dec '14

I am trying to use stunnel to turn ws into wss. Stunnel is running in client mode. It always got disconnected from remote server. my stunnel configuration: [websocket] client = yes accept = localhost:8676 connect = echo.websocket.org:443 Then I use wsdump.py(https://github.com/liris/websocket-client) to connect it: $ wsdump.py ws://localhost:8676 Handshake status 40 Does anyone know what's wrong? The log file: 2014.12.22 23:13:01 LOG7[4445147136]: Service [websocket] started 2014.12.22 23:13:01 LOG5[4445147136]: Service [websocket] accepted connection from ::1:52132 2014.12.22 23:13:01 LOG6[4445147136]: s_connect: connecting 174.129.224.73:443 2014.12.22 23:13:01 LOG7[4445147136]: s_connect: s_poll_wait 174.129.224.73:443: waiting 10 seconds 2014.12.22 23:13:02 LOG5[4445147136]: s_connect: connected 174.129.224.73:443 2014.12.22 23:13:02 LOG5[4445147136]: Service [websocket] connected remote server from 192.168.1.100:52133 2014.12.22 23:13:02 LOG7[4445147136]: Remote socket (FD=10) initialized 2014.12.22 23:13:02 LOG6[4445147136]: SNI: sending servername: echo.websocket.org 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): before/connect initialization 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): SSLv3 write client hello A 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): SSLv3 read server hello A 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): SSLv3 read server certificate A 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): SSLv3 read server done A 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): SSLv3 write client key exchange A 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): SSLv3 write change cipher spec A 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): SSLv3 write finished A 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): SSLv3 flush data 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): SSLv3 read finished A 2014.12.22 23:13:02 LOG7[4445147136]: 1 items in the session cache 2014.12.22 23:13:02 LOG7[4445147136]: 1 client connects (SSL_connect()) 2014.12.22 23:13:02 LOG7[4445147136]: 1 client connects that finished 2014.12.22 23:13:02 LOG7[4445147136]: 0 client renegotiations requested 2014.12.22 23:13:02 LOG7[4445147136]: 0 server connects (SSL_accept()) 2014.12.22 23:13:02 LOG7[4445147136]: 0 server connects that finished 2014.12.22 23:13:02 LOG7[4445147136]: 0 server renegotiations requested 2014.12.22 23:13:02 LOG7[4445147136]: 0 session cache hits 2014.12.22 23:13:02 LOG7[4445147136]: 0 external session cache hits 2014.12.22 23:13:02 LOG7[4445147136]: 0 session cache misses 2014.12.22 23:13:02 LOG7[4445147136]: 0 session cache timeouts 2014.12.22 23:13:02 LOG7[4445147136]: Peer certificate was cached (6641 bytes) 2014.12.22 23:13:02 LOG6[4445147136]: SSL connected: new session negotiated 2014.12.22 23:13:02 LOG6[4445147136]: Negotiated TLSv1/SSLv3 ciphersuite: RC4-SHA (128-bit encryption) 2014.12.22 23:13:02 LOG6[4445147136]: Compression: null, expansion: null 2014.12.22 23:13:03 LOG7[4445147136]: SSL alert (read): warning: close notify 2014.12.22 23:13:03 LOG6[4445147136]: SSL closed (SSL_read) 2014.12.22 23:13:03 LOG7[4445147136]: Sent socket write shutdown 2014.12.22 23:13:03 LOG6[4445147136]: Read socket closed (readsocket) 2014.12.22 23:13:03 LOG7[4445147136]: Sending close_notify alert 2014.12.22 23:13:03 LOG7[4445147136]: SSL alert (write): warning: close notify 2014.12.22 23:13:03 LOG6[4445147136]: SSL_shutdown successfully sent close_notify alert 2014.12.22 23:13:03 LOG5[4445147136]: Connection closed: 184 byte(s) sent to SSL, 132 byte(s) sent to socket 2014.12.22 23:13:03 LOG7[4445147136]: Remote socket (FD=10) closed 2014.12.22 23:13:03 LOG7[4445147136]: Local socket (FD=3) closed 2014.12.22 23:13:03 LOG7[4445147136]: Service [websocket] finished (0 left) 2014.12.22 23:13:03 LOG7[4445147136]: str_stats: 3 block(s), 18446744073709549504 data byte(s), 222 control byte(s) 2014.12.22 23:13:03 LOG7[4445147136]: str_stats: 128 byte(s) at network.c:413 2014.12.22 23:13:03 LOG7[4445147136]: str_stats: 128 byte(s) at network.c:412 2014.12.22 23:13:03 LOG7[4445147136]: str_stats: 128 byte(s) at network.c:41

1 0

RHEL6 Update stunnel-4.29-3.el6_6.1 breaks functionality?
by H.U.Flück 21 Dec '14

21 Dec '14

Hello I realized that the latest RHEL6 updates including stunnel-4.29-3.el6_6.1 break our Stunnel connections! We are forced to go back to previous version stunnel-4.29-3.el6_4 in order to have the systems running again, and blocking Stunnel updates in /etc/yum.conf for the moment. Our typical client config and server configs are as follows: Client (5.08): ********** client = yes compression = zlib sslversion = TLSv1 delay = yes debug = 7 taskbar = yes cert = my.pem [abas_ssh] accept = 127.0.30.10:5303 connect = firewall.client.dom:5303 Server, xinetd.d: ************* service stunnel_ssh { disable = no socket_type = stream instances = UNLIMITED per_source = UNLIMITED wait = no user = root server = /usr/bin/stunnel server_args = /etc/stunnel/stunnel_ssh.conf log_on_success += HOST DURATION log_on_failure += HOST } Server, stunnel_ssh.conf **************** cert = /support/stunnel/cert/server.pem CApath = / support /stunnel/hash/ verify = 3 debug = 7 connect = 192.168.1.100:22 The error thrown is something like: Dec 17 17:30:23 srvabas stunnel: LOG3[3385:140171595282368]: SSL_accept: 140760FC: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol What are we missing? Do we need to change the configuration? Any help is highly appreciated. Kind regards H.U.Flueck

4 3

Ordinal not found error on new Stunnel install
by Tracy Drake - IQ-C 15 Dec '14

15 Dec '14

Hello Michal! We have just pushed/began to push Stunnel version 5.04 to our user community. This version was extensively tested, pushed/installed on a number of machines both with an older version of Stunnel and no Stunnel at all. We are having a barrage of users encountering the below error. [image: Inline image 1] Can you offer insight/a quick resolution? Bear in mind that although I support the apps that require Stunnel I know very little about the ins and outs of Stunnel. I did google this error and found something to the effect that a newer version of the LIBEAY32.dll is required. Does this perhaps mean that this file did not get replaced on these machines. We were previously running quite an older version - 4.27. Please advise asap! -- Tracy Drake CSM Senior Consultant GSA-FAS CAMEO Contractor URSA & INFOConnect Support & Training Team Lead 704-987-1211 tracy.drake(a)gsa.gov

2 1

building stunnel in FreeBSD
by Mirimir 12 Dec '14

12 Dec '14

In building the stunnel package from the port in FreeBSD 10.1, is it more secure to enable SSL_PORT? In particular, will that ensure that stunnel is using the latest openssl release? And if that is so, why is that build option disabled by default?

1 0

Stunnel PSK authentication
by Michal Trojnara 11 Dec '14

11 Dec '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, Starting with stunnel-5.09b1 it is now possible to use stunnel without certificates. https://www.stunnel.org/downloads.html Example server configuration is: [PSK server] accept = <stunnel_port> connect = <dst_port> PSKsecrets = psk.txt , where the psk.txt may contain the following lines: test1:oaP4EishaeSaishei6rio6xeeph3az test2:yah5uS4aijooxilier8iaphuwah1Lo Example client configuration: [PSK client 1] client = yes accept = 127.0.0.1:<src_port> connect = <stunnel_ip>:<stunnel_port> PSKsecrets = psk1.txt PSKidentity = test1 The psk1.txt file only needs to contain: test1:oaP4EishaeSaishei6rio6xeeph3az Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlSKHNMACgkQ/NU+nXTHMtE72wCg/EZp4NdVnkrQFffGVWZO65lE QucAn3ddp+yTDruP+gNkevf///0olb1+ =o0k3 -----END PGP SIGNATURE-----

1 0

configure.ac patch
by Kip Walraven 11 Dec '14

11 Dec '14

In case others are struggling with CentOS 6.5 configure issues that I had, I'm providing the following unified diff patch -Kip #============================================== --- ../stunnel-5.08/configure.ac 2014-12-03 05:35:16.000000000 -0500 +++ ./configure.ac 2014-12-11 10:32:47.000000000 -0500 @@ -402,13 +402,13 @@ AC_MSG_RESULT([autodetecting]) # the library name has changed to -lsystemd in systemd 209 AC_SEARCH_LIBS([sd_listen_fds], [systemd systemd-daemon], - AC_CHECK_HEADERS([systemd/sd-daemon.h], [ + [ AC_CHECK_HEADERS([systemd/sd-daemon.h], [ AC_DEFINE([USE_SYSTEMD], [1], [Define to 1 to enable systemd socket activation]) AC_MSG_NOTICE([systemd support enabled]) ], [ AC_MSG_NOTICE([systemd header not found]) - ]), [ + ]) ], [ AC_MSG_NOTICE([systemd library not found]) ]) ] @@ -462,7 +462,8 @@ AC_MSG_CHECKING([for compiler sysroot]) if test "$GCC" = yes; then SYSROOT=`$CC --print-sysroot 2>/dev/null` -else +fi +if test -z "$SYSROOT" ; then SYSROOT="/" fi AC_MSG_RESULT([$SYSROOT]) #==============================================

2 1

Can I run stunnel on TWO computers with the same certificates?
by Ben Stover 09 Dec '14

09 Dec '14

I would like to use stunnel from my DEsktop AND my Notebook. Can I run them in parallel (with the same certificates) or do they confuse each other? Ben

1 0

stunnel 5.08 released
by Michal Trojnara 09 Dec '14

09 Dec '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.08 of stunnel. The ChangeLog entry: Version 5.08, 2014.12.09, urgency: MEDIUM: * New features - Added SOCKS4/SOCKS4a protocol support. - Added SOCKS5 protocol support. - Added SOCKS RESOLVE [F0] TOR extension support. - Updated automake to version 1.14.1. - OpenSSL directory searching is now relative to the sysroot. * Bugfixes - Fixed improper hangup condition handling. - Fixed missing -pic linker option. This is required for Android 5.0 and improves security. To setup SOCKS4 VPN configure the following client service: [socks_client] client = yes accept = 127.0.0.1:1080 connect = vpn_server:9080 verify = 4 CAfile = stunnel.pem The corresponding configuration on the vpn_server host: [socks_server] protocol = socks accept = 9080 cert = stunnel.pem key = stunnel.key SOCKS-enabled clients (e.g. web browsers) can now use stunnel client for a VPN service. Encrypted DNS resolver is supported with SOCKS4a, SOCKS5, and SOCKS RESOLVE [F0] TOR extension. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 830b21d24cd237e96f4d7993be43553d4eba4d3cfa2660faa78dec8d41d314fc stunnel-5.08.tar.gz 84c06c8a3f8b6bbb5c1a2b6e352c70bdad1c87f1d5a37476e5dee02f2d65065c stunnel-5.08-installer.exe 28750afe9e5fec4b60b98468ea834cd126e149e8d97074b813b216723a889802 stunnel-5.08-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlSGzsMACgkQ/NU+nXTHMtHQlwCgwsX66e0EU5PMxsfMCdC5sfVt Fy4AnRXe65YLabb7K1XOn6tKncEH0smR =WP5h -----END PGP SIGNATURE-----

1 0

stunnel with TLSv1.2 ciphers
by Jérémy WILLIAME 08 Dec '14

08 Dec '14

Hi, I want to use stunnel with TLSv1.2 ciphers but it doesn't work. I use stunnel 5.07 compiled from source with prefix /opt/stunnel and lastest openssl (1.0.1j) This is my main configuration file: chroot = /opt/stunnel/var/lib/stunnel/ pid = /stunnel4.pid **cert = /opt/stunnel/etc/blabla/bla.pem key = /opt/stunnel/etc/blabla/bla.key ciphers = ECDHE-ECDSA-AES256-GCM-SHA384 options = NO_SSLv2 [imaps] accept = 993 connect = 143 I had to use one of this ciphers: ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES256-SHA384 DHE-RSA-AES256-GCM-SHA384 When i tried to use imaps connection over stunnel : root@bla: imtest -a homer -w homer -p 993 -s localhost SSL_connect error 0 SSL session removed failure: TLS negotiation failed if i use a SSLv3 cipher it works. root@bla: imtest -a homer -w homer -p 993 -s localhost verify error:num=18:self signed certificate TLS connection established: TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits) Someone have any idea ? Thanks. Jeremy

2 1

Stunnel for android
by Neacsu Mihai Adrian 03 Dec '14

03 Dec '14

Hello everyone. I am new to Stunnel, but i would like to compile a working version for Android L. The android version on the website is not compiled with PIE support, thus it does not run on Android L. I tried to look through the source code, and add the flags, -fPie and -pie, but i did not figure out where to do that. Also, after settings 755 on build-android.sh and running it, i get Permission denied on creating folders inside the /bin/android folder, even if i am running as root user. Any help is highly appreciated and i appologize if this has been already write in the archives, but i was not able to find anything related.

2 2

Memory leak on reconfiguration
by Alexander Paramonov 21 Nov '14

21 Nov '14

Hello, colleagues! I suppose there is a memory leak on stunnel reconfiguration when it receives the SIGHUP signal. Here is my experiment with stunnel 5.05 on linux: ~/busybox $ cat /home/posdebug/stunnel.cfg debug=6 options=NO_SSLv2 pid=/tmp/stunnel.pid [57797] accept = 127.0.0.1:57797 connect = 80.90.125.219:64141 key = /usr/unsign/key.pem cert = /usr/unsign/cert.pem CAfile = /usr/unsign/cert.pem verify = 2 ciphers = AES128-SHA:AES256-SHA:DES-CBC3-SHA:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:EDH-RSA-DES-CBC3-SHA sslVersion = all TIMEOUTbusy = 100 TIMEOUTconnect = 100 client = yes ~/busybox $ /usr/postunnel/stunnel /home/posdebug/stunnel.cfg ~/busybox $ top | grep stunnel 986 1 posdebug S *3592* 5.7 0 0.0 /usr/postunnel/stunnel /home/posdebug/stunnel.cfg ~/busybox $ kill -1 986 ~/busybox $ kill -1 986 ~/busybox $ kill -1 986 ~/busybox $ kill -1 986 ~/busybox $ kill -1 986 ~/busybox $ top | grep stunnel 986 1 posdebug S *3720* 5.9 0 0.0 /usr/postunnel/stunnel /home/posdebug/stunnel.cfg ~/busybox $ kill -1 986 ~/busybox $ kill -1 986 ~/busybox $ kill -1 986 ~/busybox $ kill -1 986 ~/busybox $ top | grep stunnel 986 1 posdebug S *3848* 6.2 0 0.0 /usr/postunnel/stunnel /home/posdebug/stunnel.cfg As i noticed, there are a lot of allocs on reconfiguration and only a few free() calls. Why? RAM is not unlimited, as far as i know. Any comments would be highly appreciated. -- Best regards Alexander Paramonov Software Engineer Terminal Technologies

2 4

Errors after upgrading to 5.07
by Mikhail Idris 17 Nov '14

17 Nov '14

Hello, I have recently upgraded to 5.07. But now, the console is spamming with messages such as: SSL_read returned WANT_READ: retrying Is this a critical error? Will it have any impact of any services that are currently using stunnel? Thank you. Regards, Mikhail

2 3

SSLscan does not display a certificate when connecting to stunnel
by Swonk, Glenn 15 Nov '14

15 Nov '14

When I open a connection to display the certificate, it works from openssl. openssl s_client -connect x58.swonk.com:444 However, when I use SSLScan, it only displays the supported server ciphers. SSLScan.exe --no-failed --sslv3 x58.swonk.com:444 I am troubleshooting a problem with a device which cannot connect directly to my https server and am trying to use stunnel to either forward the connection or help understand why it isn't working. The strange thing is that the 'Charles Proxy' (http://www.charlesproxy.com/) seems to forward the requests properly. Can anyone download a copy of SSLscan and test it against their connection? Any other ideas what may be the issue? thanks, glenn ___ ___| |___ ___ __ _ _ __ / __/ __| / __|/ __/ _` | '_ \ \__ \__ \ \__ \ (_| (_| | | | | |___/___/_|___/\___\__,_|_| |_| Version 1.8.2-win http://www.titania.co.uk Copyright Ian Ventura-Whiting 2009 Compiled against OpenSSL 0.9.8m 25 Feb 2010 esting SSL server x58.swonk.com on port 444 Supported Server Cipher(s): Accepted TLSv1 256 bits DHE-RSA-AES256-SHA Accepted TLSv1 256 bits AES256-SHA Accepted TLSv1 128 bits DHE-RSA-AES128-SHA Accepted TLSv1 128 bits AES128-SHA Accepted TLSv1 168 bits EDH-RSA-DES-CBC3-SHA Accepted TLSv1 56 bits EDH-RSA-DES-CBC-SHA Accepted TLSv1 168 bits DES-CBC3-SHA Accepted TLSv1 56 bits DES-CBC-SHA Accepted TLSv1 128 bits IDEA-CBC-SHA Accepted TLSv1 128 bits RC4-SHA Accepted TLSv1 128 bits RC4-MD5 Prefered Server Cipher(s): TLSv1 256 bits DHE-RSA-AES256-SHA ________________________________ This message may contain confidential information. If you are not the intended recipient of this e-mail, do not disseminate, distribute or copy this e-mail and delete this e-mail from your system.

1 0

socks4 support
by Michal Trojnara 15 Nov '14

15 Nov '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, Please take a look at the latest stunnel-5.08b4 available for download on https://www.stunnel.org/downloads.html It adds support for SOCKS4 and SOCKS4a protocols. The SOCKS protocol itself is encapsulated within SSL/TLS encryption layer to protect the final destination address. http://www.openssh.com/txt/socks4.protocol http://www.openssh.com/txt/socks4a.protocol The BIND command of the SOCKS protocol is not supported. The USERID parameter is ignored. To setup SOCKS4 VPN configure the following client service: [socks_client] client = yes accept = 127.0.0.1:1080 connect = vpn_server:9080 verify = 4 CAfile = stunnel.pem The corresponding configuration on the vpn_server host: [socks_server] protocol = socks accept = 9080 cert = stunnel.pem key = stunnel.key Now test your configuration on the client machine with: curl --socks4a localhost http://www.example.com/ Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlRmVXgACgkQ/NU+nXTHMtHuZwCfXlH0YYTHYhThoXPrCgV4OhrE BwsAoLgIpVWDOdBbISzrP53m2H9LUR6W =9DEh -----END PGP SIGNATURE-----

1 1

External validation of client certificates
by Rene Bartsch 15 Nov '14

15 Nov '14

Hi, we're having a special use case and hope to find a solution in stunnel. In our use case clients use self-signed X.509 certificates to authenticate with our TLS-server. We don't have a CA but a database with usernames (DN) and fingerprints of the client-certificates. Is it possible with stunnel not to validate the client certificates against a CA but handover the Distinguished Name to an external application which returns the fingerprint to check the certificate against? -- Best regards, Rene Bartsch, B. Sc. Informatics Current Bitcoin Exchange Rate: https://www.bitcoin.de/de/r/mwfngu

2 1

How to enable weak ciphers in stunnel
by Swonk, Glenn 15 Nov '14

15 Nov '14

When I run stunnel, I would like to enable the weaker ciphers and protocols (SSLv3) for testing purposes. However, adding options to the stunnel.conf file doesn't seem to return new ciphers during the negotiation (using sslscan to generate the report). I have look through the documentation and it doesn't seem to address these options very well. Thanks, glenn options = SSLv2 ;;ciphers = DH+AES ;;ciphers = HIGH:LOW ;;ciphers = HIGH:MEDIUM ciphers = ALL Supported Server Cipher(s): Accepted TLSv1 256 bits DHE-RSA-AES256-SHA Accepted TLSv1 256 bits AES256-SHA Accepted TLSv1 128 bits DHE-RSA-AES128-SHA Accepted TLSv1 128 bits AES128-SHA Accepted TLSv1 168 bits EDH-RSA-DES-CBC3-SHA Accepted TLSv1 56 bits EDH-RSA-DES-CBC-SHA Accepted TLSv1 168 bits DES-CBC3-SHA Accepted TLSv1 56 bits DES-CBC-SHA Accepted TLSv1 128 bits IDEA-CBC-SHA Accepted TLSv1 128 bits RC4-SHA Accepted TLSv1 128 bits RC4-MD5 Prefered Server Cipher(s): TLSv1 256 bits DHE-RSA-AES256-SHA ________________________________ This message may contain confidential information. If you are not the intended recipient of this e-mail, do not disseminate, distribute or copy this e-mail and delete this e-mail from your system.

2 1

capi, other engines not found at runtime
by Derek Cole 14 Nov '14

14 Nov '14

Hello, I am trying to compile stunnel on windows instead of using the pre-built binaries. When I run stunnel.exe, and have engine=capi in my stunnel.conf file, i get the following [ ] Enabling support for engine 'capi' [!] error queue: 2606A074: error:2606A074:engine routines:ENGINE_by_id:no such engine [!] error queue: 260B6084: error:260B6084:engine routines:DYNAMIC_LOAD:dso not found [!] error queue: 25070067: error:25070067:DSO support routines:DSO_load:could not load the shared library [!] ENGINE_by_id: 25078067: error:25078067:DSO support routines:WIN32_LOAD:could not load the shared library [!] Line 17: "engine = capi": Failed to open the engine Is this something wrong at link time in my compile? I used a precompiled version of OpenSSL, and modified this: SSLDIR=C:\OpenSSL-Win32 INCDIR=$(SSLDIR)\include LIBDIR=$(SSLDIR)\lib I thought that was all that would be needed, but apparently not. I then tried to go to make this modification: SSLLIBS=/LIBPATH:"$(LIBDIR)" libeay32.lib ssleay32.lib capi.lib thinking that maybe I need to explicitly add capi in, and again it compiles, but does not run. I have also tried to move the capi.dll from the LIBDIR into the same folder as the stunnel executable to make sure it was found, and I still have had no luck. Any ideas?

1 0

Building stunnel in Visual Studio
by Derek Cole 13 Nov '14

13 Nov '14

Hello, I am interested in tweaking something with stunnel for windows. I was trying to find if there were instructions for building the software on windows using Visual Studio. I found a deprecated FAQ that said that it was possible to compile with Visual C++. Can anyone give me any pointers on how to get up and going? http://www.onsight.com/faq/stunnel/stunnel-faq-3.html Thanks

2 1

Re: [stunnel-users] Certificate
by Vitic Zikica (EXT) 12 Nov '14

12 Nov '14

HI, We are using stunnel to connect to some servers. The client informed us that we have to use new 2048 bit certificate ( XXXXX.crt ) Is it supported by stunnel ? how can I install it ? Thank you . Zikica VITIC BFI-DSI-FIS-ETRADING-ARCHITECTURE 47, quai d'Austerlitz 75648 Paris Cedex 13 Phone: +(33) 1 58 55 31 84 E-mail: flux(a)natixis.com<mailto:flux@natixis.com> L'integrite de ce message n'etant pas assuree sur internet, Natixis ne peut etre tenu responsable de son contenu. Toute utilisation ou diffusion non autorisee est interdite. Si vous n'etes pas destinataire de ce message, merci de le detruire et d'avertir l'expediteur. Ensemble, faisons un geste pour l'environnement : n'imprimons nos mails que si necessaire. The integrity of this message cannot be guaranteed on the Internet. Natixis can not therefore be considered responsible for the contents. Any unauthorized use or dissemination is prohibited. If you are not the intended recipient of this message, then please delete it and notify the sender. Let us mind the environment : let's print our mails only when necessary

1 0

Output to neither stdout nor stderr it seems
by Casper Thomsen 10 Nov '14

10 Nov '14

Hi stunnel-users I run stunnel4 in docker with the following config file: --- /etc/stunnel/stunnel.conf -------------- sslVersion = SSLv3 pid = /var/lib/stunnel4/stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 2 CApath = /etc/ssl/certs debug = notice output = /var/log/stunnel.log client = yes foreground = yes [foo] accept = 1234 connect = 127.0.0.1:2345 TIMEOUTclose = 3 --------------------------------------------------------- When I run stunnel and pipe stdout and stderr to /dev/null, I still get output: root@849b7eb3bbd0:/# /usr/bin/stunnel4 /etc/stunnel/stunnel.conf 2>/dev/null >/dev/null stunnel: LOG5[258:140421949949696]: stunnel 4.53 on x86_64-pc-linux-gnu platform stunnel: LOG5[258:140421949949696]: Compiled/running with OpenSSL 1.0.1e 11 Feb 2013 stunnel: LOG5[258:140421949949696]: Threading:PTHREAD SSL:+ENGINE+OCSP Auth:LIBWRAP Sockets:POLL+IPv6 stunnel: LOG5[258:140421949949696]: Reading configuration from file /etc/stunnel/stunnel.conf stunnel: LOG5[258:140421949949696]: Configuration successful ^Cstunnel: LOG3[258:140421949949696]: Received signal 2; terminating Complete shell output is attached. Any hints on what's happening? Kindly, -- Casper Thomsen

3 4

Truncated responses with stunnel >= 5.05
by Tuomas Silen 07 Nov '14

07 Nov '14

Hi there, After upgrading to stunnel 5.07 I've seen a lot of truncated http responses. I've tested different versions and 5.04 is the last one to work fine. There seems to be fixes to a similar issue in 5.05, but at least for me the result seems to be the opposite. I'm on Ubuntu 12.04. Looking at the logs, the log entries are identical except for one part, the amount of data sent to SSL: stunnel >= 5.05, not working: LOG3[31153]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing LOG5[31153]: Connection closed: 67584 byte(s) sent to SSL, 184 byte(s) sent to socket stunnel 5.04, works: LOG3[6248]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing LOG5[6248]: Connection closed: 113051 byte(s) sent to SSL, 184 byte(s) sent to socket It's worth noting that in both cases the closing happens after TIMEOUTclose has exceeded (probably because of a missing close notify?). In any case, apparently less data is sent to SSL and that's how it seems like; the end of the http responses get truncated. If everything's very fast (e.g. localhost connections only) the problem seems not to happen, not very often at least. With connections between two servers I've been able to reproduce it pretty much every time in my setup (stunnel -> haproxy -> apache -> unicorn). Undefining the POLLRDHUP or reverting the changes in 5.05 to src/client.c seem to fix the problem for me. Any ideas what would be a proper fix? Thanks! Best regards, Tuomas Silen

3 5

[BUG] SSL directory scan breaks cross-compilation
by John Spencer 05 Nov '14

05 Nov '14

it seems between 5.02 and 5.06 a "SSL directory scan" was introduced. for main_dir in /usr/local /usr/lib /usr/pkg /opt/local /opt /usr; do for sub_dir in /ssl /openssl /; do check_ssl_dir "$main_dir$sub_dir" && break 2 this ofc breaks cross-compilation. the concept of searching for a library directory is completely broken. if just adding -lssl -lcrypto to LDFLAGS doesnt find the openssl libraries at link time, the user's compiler toolchain is wrongly set up, and its not the job of a package to work around that by searching through a number of directories. it's the user's job to fix his toolchain by supplying the right -L paths in case he's got his library installed in a non-standard location. also, there's pkg-config (which supports crosscompilation via a PKG_CONFIG_SYSROOT_DIR env var) in case a library needs elaborate CFLAGS. --JS

2 6

slight fix for tools/stunnel.conf-sample.in
by Gleydson Soares 03 Nov '14

03 Nov '14

----- Forwarded message from Gleydson Soares <gsoares(a)gmail.com> ----- Date: Mon, 3 Nov 2014 17:00:38 -0300 From: Gleydson Soares <gsoares(a)gmail.com> To: stunnel-users(a)stunnel.org Cc: Marzena.Trojnara(a)mirt.net Subject: slight fix for tools/stunnel.conf-sample.in User-Agent: Mutt/1.5.23 (2014-03-12) Hi, I noticed unexpected characters in stunnel.conf-sample.in, stunnel 5.07. following diff fix that. --, Gleydson. ----- End forwarded message -----

1 0

stunnel 5.07 released
by Michal Trojnara 01 Nov '14

01 Nov '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.07 of stunnel. The ChangeLog entry: Version 5.07, 2014.11.01, urgency: MEDIUM: * New features - Several SMTP server protocol negotiation improvements. - Added UTF-8 byte order marks to stunnel.conf templates. - DH parameters are no longer generated by "make cert". The hardcoded DH parameters are sufficiently secure, and modern TLS implementations will use ECDH anyway. - Updated manual for the "options" configuration file option. - Added support for systemd 209 or later. - New --disable-systemd ./configure option. - setuid/setgid commented out in stunnel.conf-sample. * Bugfixes - Added support for UTF-8 byte order mark in stunnel.conf. - Compilation fix for OpenSSL with disabled SSLv2 or SSLv3. - Non-blocking mode set on inetd and systemd descriptors. - shfolder.h replaced with shlobj.h for compatibility with modern Microsoft compilers. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 505c6c63c4a20fc0cce8c35ef1ab7626c7b01071e3fca4ac6ea417afe8065309 stunnel-5.07.tar.gz 0e8d41a8102437d2c04a347bfe38ad80408fd2eb1451c559dcc7932ff2d09bd9 stunnel-5.07-installer.exe d3ced258ad35bea656ec178644d83e7d0b9fe8a2e4b2d6511e5c898ac9e6c7fc stunnel-5.07-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlRU61wACgkQ/NU+nXTHMtEwLwCdEprl4s5aleq7+MzK9JmYcnQ+ q+gAniP9aOtMuQtML9zcRPK0LY6Yb/3H =IVK/ -----END PGP SIGNATURE-----

1 0

Help needed to load hierarchical chain of certificates
by Rejuan Masud Masud 31 Oct '14

31 Oct '14

Help needed to load hierarchical chain of certificates(Root, CA) when stunnel running in server mode. We are trying to load. but only server signed certificate is loading which is assigned in cert as below, CAfile=/u01/stunnel/AMEX_all/CA.PEM cert=/u01/stunnel/AMEX_all/cert.pem HOW TO LOAD HIERARCHICAL CHAIN OF CERTIFICATES?

2 1

special characters in output path -> error
by "Dirk Löning [CSB-Bruns&Börjes GmbH ]" 31 Oct '14

31 Oct '14

It's seems to be a problem in the new stunnel version 5.06 When I use the USERPROFILE directory, which contains special characters like "ö", i get an error: *[!] Cannot open log file: C:\Users\Bl?d\CSB\SSL\SmtpLog(0).txt* Is this a bug or must i change something ? The configuration file " SmtpConfig(0).txt" : ; Configuration file output = C:\Users\Blöd\CSB\SSL\SmtpLog(0).txt taskbar = yes cert = C:\Users\Blöd\CSB\SSL\stunnel.pem client = yes [ssmtp] accept = 8801 connect = smtp.1und1.de:465 The log says: [ ] No limit detected for the number of clients [.] stunnel 5.06 on x86-pc-msvc-1500 platform [.] Compiled/running with OpenSSL 1.0.1j-fips 15 Oct 2014 [.] Threading:WIN32 Sockets:SELECT,IPv6 SSL:ENGINE,OCSP,FIPS [ ] errno: (*_errno()) [.] Reading configuration from file C:\Users\Blöd\CSB\SSL\SmtpConfig(0).txt [.] FIPS mode disabled [ ] Compression disabled [ ] GUI message loop initialized [ ] Snagged 64 random bytes from C:/.rnd [ ] Wrote 0 new random bytes to C:/.rnd [ ] PRNG seeded successfully [ ] Initializing service [ssmtp] [ ] Loading cert from file: C:\Users\Bl?d\CSB\SSL\stunnel.pem [ ] Loading key from file: C:\Users\Bl?d\CSB\SSL\stunnel.pem [ ] Private key check succeeded [ ] SSL options: 0x03000004 (+0x03000000, -0x00000000) [.] Configuration successful [ ] Listening file descriptor created (FD=456) [ ] Service [ssmtp] (FD=456) bound to 0.0.0.0:8801 *[!] Cannot open log file: C:\Users\Bl?d\CSB\SSL\SmtpLog(0).txt* [ ] Closing service [ssmtp] [ ] Service [ssmtp] closed (FD=456) [ ] Service [ssmtp] closed [!] Server is down greetings dirk

1 0

Re: [stunnel-users] Exchange Online - SSLv3 and Sophos UTM 120 firewall update
by Michal Trojnara 31 Oct '14

31 Oct '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Stephen Hogan wrote: > 2014.10.28 14:35:55 LOG7[4156]: SSL state (connect): SSLv3 write > client hello A [cut] > I have a basic (shaky) understanding that the "handshake" for TLS > does downgrade to SSLv3 if newer versions of TLS fail, but I am > wondering if I apply the update recommended on the firewall, will > this cut the communication for the SMTP relay, the way I am using > it? The debug messages produced by stunnel can sometimes be confusing. They are intended to be helpful to developers, and not end-users. OpenSSL implements the SSL/TLS/DTLS protocols with three separate finite state machines: SSLv2, SSLv3, and DTLS1. http://en.wikipedia.org/wiki/Automata-based_programming All TLS protocols use the SSLv3 state machine, thus the state name does not reflect the actual protocol being negotiated. See the source for details: https://github.com/openssl/openssl/blob/master/ssl/ssl_stat.c Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlRREk8ACgkQ/NU+nXTHMtGLPwCgiA1tfq7LhNC600d5eVbWugLk coUAn1mGA4mWBAchUu5+d6nYfxe0isgr =p4hH -----END PGP SIGNATURE-----

2 1

Configuring Stunnel 4.1 to use TLS
by Deepak Subbanarasimha 30 Oct '14

30 Oct '14

Hello, I had some questions on Stunnel version for Windows. 1. Does Stunnel 4.1 support TLS? 2. If yes, what version of TLS does it support(TLS1.0, TLS1,1 or TLS 1.2 ) 3. How can I tell if an Stunnel instance is using SSL or TLS 4. Does anyone have instructions to configure Stunnel 4.1 to use TLS 5. Can you share an example of stunnel.conf with TLS turned on Thanks, DEEPAK SUBBANARASIMHA Kewill DDI: +00 (1) 978 482 2625 Email: deepak.subbanarasimha(a)kewill.com<mailto:deepak.subbanarasimha@kewill.com> www.kewill.com<http://www.kewill.com/> Tel: +00 (1) 978 482 2500 | Fax: +00 (1) 978 482 2501 1 Executive Drive, Chelmsford, MA 01824, USA IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately notify us by telephone at (978) 482-2500 and return the original message to us at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code. Thank You. Copyright (c) 2013 by Kewill Inc IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately return the original message to the sender at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Although Kewill takes reasonable precautions to minimize the risk, Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code.

1 0

Stunnel server as transparent proxy
by Derek Cole 28 Oct '14

28 Oct '14

Hello, Is it possible to use stunnel server as a transparent proxy? I was digging through the manpage and I see the transparent= option. What I would like to do is have an stunnel client connect to the stunnel server, and once traffic is at the server, go to the original destination that the traffic going to the stunnel client was destined for. I.E. Can I have firefox proxy to my stunnel client, which connects to my stunnel server, and then that traffic goes to whatever website the end user was trying to hit in firefox? My Stunnel server is on a CentOS box: [root@CentOSTunTest ~]# uname -a Linux CentOSTunTest 2.6.32-431.el6.x86_64 #1 SMP Fri Nov 22 03:15:09 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux And my stunnel.conf foreground = yes > debug = 7 > options = NO_SSLv2 > fips = no > output=/usr/local/etc/stunnel/stunnel.log > > > [https] > cert=/usr/local/etc/stunnel/stunnel.pem > accept = 443 > connect = 80 > > [Internet] > cert=/usr/local/etc/stunnel/stunnel.pem > sni = https:Internet > transparent=destination > So basically in the transparent option is Internet is what I am wondering if it works the way I expect. I see this in the log file: 2014.10.23 09:57:05 LOG3[11414]: setsockopt SO_ORIGINAL_DST: Protocol not available (92) 2014.10.23 09:57:05 LOG5[11414]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket I see this in the stunnel manpage: For a connect target installed on the same host: /sbin/iptables -t nat -I OUTPUT -p tcp --dport <redirected_port> \ -m ! --uid-owner <stunnel_user_id> \ -j DNAT --to-destination <local_ip>:<stunnel_port> For a connect target installed on a remote host: /sbin/iptables -I INPUT -i eth0 -p tcp --dport <stunnel_port> -j ACCEPT /sbin/iptables -t nat -I PREROUTING -p tcp --dport <redirected_port> \ -i eth0 -j DNAT --to-destination <local_ip>:<stunnel_port> What does it mean "for a connect target installed on the same host" I thought transparent meant I was not using a connect target except the original destination. Does this mean I should implement the IPTables for a remote host, since I want my client to just reach the internet? Thanks for the help in advance!

2 4

VS 2010 compilation issue due to shfolder.h
by nnposter＠users.sourceforge.net 28 Oct '14

28 Oct '14

I am running into a compilation problem on MS C/C++ 16 (aka VS 2010). Specifically, I am getting the following error due to an include that has been added in 5.01: C:\Program Files (x86)\Microsoft SDKs\Windows\v7.0A\include\shfolder.h(14) : fatal error C1189: #error : shfolder.h/shfolder.lib provide platform independence with versions prior to Windows 2000. Use shlobj.h/shell32.lib if targetting Windows 2000 or higher. The following primitive patch seems to address the issue: --- common.h.orig 2014-10-02 04:12:48.000000000 -0600 +++ common.h 2014-10-27 16:02:22.536329500 -0600 @@ -228,7 +228,13 @@ #include <windows.h> #include <process.h> /* _beginthread */ + +#if defined _MSC_VER && _MSC_VER >= 1600 +#include <shlobj.h> /* SHGetFolderPath */ +#else #include <shfolder.h> /* SHGetFolderPath */ +#endif + #include <tchar.h> #include "resources.h" Cheers, nnposter

2 1

stunnel-5.06 fails to build against systemd 215
by Anthony G. Basile 24 Oct '14

24 Oct '14

Hi everyone, We hit a bug in stunnel-5.05 and it continues in 5.06. The problem comes from systemd which moved sd_listen_fds() form libsystemd-daemon.so to libsystemd.so. However, stunnel's configure.ac still has AC_SEARCH_LIBS([sd_listen_fds], [systemd-daemon]) For backwards compatibility, this should probably be AC_SEARCH_LIBS([sd_listen_fds], [systemd], [], [ AC_SEARCH_LIBS([sd_listen_fds], [systemd-daemon]) ]) or similar. Please refer to our downstream bug: https://bugs.gentoo.org/show_bug.cgi?id=525234' Thanks. -- Anthony G. Basile, Ph. D. Chair of Information Technology D'Youville College Buffalo, NY 14201 (716) 829-8197

2 5

stunnel service leaves stale connections to rsync on the server side
by Polyack, Steve 22 Oct '14

22 Oct '14

Hi, We've been running a rsync service over stunnel for some time now. After upgrading our environment, which involved moving from an old version of Linux to FreeBSD 9.3, and from stunnel-4.29 to stunnel-5.06, we've had a problem pop up. Ever since switching over, we see that rsync daemon processes slowly build up over time on our server, each consuming 100% CPU. The vast majority of our clients are working just fine, and the problematic rsync processes just seem to have been dead/aborted connections from the clients (which are using wireless aircard, so connectivity can be shotty). A quick 'truss' on the process shows they are doing nothing but sitting there and read()'ing in a loop indefinitely: # truss -p 14689 | head read(6,0x7fffffff8240,1) = 0 (0x0) read(6,0x7fffffff8240,1) = 0 (0x0) read(6,0x7fffffff8240,1) = 0 (0x0) read(6,0x7fffffff8240,1) = 0 (0x0) read(6,0x7fffffff8240,1) = 0 (0x0) read(6,0x7fffffff8240,1) = 0 (0x0) Furthermore, the connection appears to be closed: # sockstat -4 | grep 14689 root rsync 14689 3 tcp4 127.0.0.1:873 127.0.0.1:27724 netstat -an | grep 27724 netstat: kvm not available: /dev/mem: No such file or directory tcp4 0 0 127.0.0.1.873 127.0.0.1.27724 CLOSED Looking through the stunnel logs, it looks like no data was ever really passed (perhaps the client gave up?): 2014.10.22 10:45:52 LOG7[34384941056]: Service [rsync] started 2014.10.22 10:45:52 LOG5[34384941056]: Service [rsync] accepted connection from 1.1.1.1:63095 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): before/accept initialization 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 read client hello A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 write server hello A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 write certificate A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 write server done A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 flush data 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 read client key exchange A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 read finished A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 write change cipher spec A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 write finished A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 flush data 2014.10.22 10:45:52 LOG7[34384941056]: 41 items in the session cache 2014.10.22 10:45:52 LOG7[34384941056]: 0 client connects (SSL_connect()) 2014.10.22 10:45:52 LOG7[34384941056]: 0 client connects that finished 2014.10.22 10:45:52 LOG7[34384941056]: 0 client renegotiations requested 2014.10.22 10:45:52 LOG7[34384941056]: 110 server connects (SSL_accept()) 2014.10.22 10:45:52 LOG7[34384941056]: 107 server connects that finished 2014.10.22 10:45:52 LOG7[34384941056]: 0 server renegotiations requested 2014.10.22 10:45:52 LOG7[34384941056]: 66 session cache hits 2014.10.22 10:45:52 LOG7[34384941056]: 0 external session cache hits 2014.10.22 10:45:52 LOG7[34384941056]: 32 session cache misses 2014.10.22 10:45:52 LOG7[34384941056]: 0 session cache timeouts 2014.10.22 10:45:52 LOG6[34384941056]: No peer certificate received 2014.10.22 10:45:52 LOG6[34384941056]: SSL accepted: new session negotiated 2014.10.22 10:45:52 LOG6[34384941056]: Negotiated SSLv3 ciphersuite AES256-SHA (256-bit encryption) 2014.10.22 10:45:52 LOG6[34384941056]: Compression: null, expansion: null 2014.10.22 10:45:52 LOG6[34384941056]: s_connect: connecting 127.0.0.1:873 2014.10.22 10:45:52 LOG5[34384941056]: s_connect: connected 127.0.0.1:873 2014.10.22 10:45:52 LOG5[34384941056]: Service [rsync] connected remote server from 127.0.0.1:27724 2014.10.22 10:45:52 LOG7[34384941056]: Remote socket (FD=11) initialized 2014.10.22 11:01:12 LOG3[34384941056]: SSL_read: Connection reset by peer (54) 2014.10.22 11:01:12 LOG5[34384941056]: Connection reset: 56 byte(s) sent to SSL, 56 byte(s) sent to socket 2014.10.22 11:01:12 LOG7[34384941056]: Remote socket (FD=11) closed 2014.10.22 11:01:12 LOG7[34384941056]: Local socket (FD=10) closed 2014.10.22 11:01:12 LOG7[34384941056]: Service [rsync] finished (4 left) The clients are generally field units running stunnel versions in the 4.x range. Unfortunately, updating them is not an easy task and is not really under my control. Either way, this seems like a server side issue, and possibly an issue with rsync (we're running 3.1.0). Has anyone run into anything like this before? Does anyone have any suggestions for additional debugging we can do to try to pinpoint the problem? We are going to try rolling back to stunnel-4.29 to see if the problem still occurs there on the new system. Thanks, Steve

1 1

SSLv3 connections vulnerable in my environment?
by Fritz Gschwendner 21 Oct '14

21 Oct '14

Hello, I have a pretty standard stunnel server configuration with verify = 2 and clients, that don't speak TLS and can't easily be upgraded to support TLS. So disabling SSLv3 leads to handshake errors, I need to leave it enabled for now. The SSL connection is always renegotiated, a proprietary protocol is used inside SSL, and clients can be considered safe. Can the poodle security flaw realistically be used by a man in the middle to decrypt packets send over such an SSLv3 connection? If so, is there any other way to protect against the attack? Thank you.

1 0

Trouble after disabling SSLv3 (another one)
by Koenraad Lelong 21 Oct '14

21 Oct '14

Hi, Last week I disabled SSLv3 on my stunnel-server. I thought I tested it, but this morning I had to use it and I couldn't get access. Now at the office I tried again, with the same result. After enabling SSLv3 again I could get access. So my configuration seems wrong. My server runs Ubuntu 12.04 LTS, stunnel is 4.42-1ubuntu (stock ubuntu). This is my stunnel.conf (tunnels removed/edited) : client = no setuid = stunnel4 setgid = stunnel4 pid = /var/run/stunnel4/stunnel4.pid debug = debug output = /var/log/stunnel4/stunnel.log options = NO_SSLv2 options = NO_SSLv3 socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 3 CApath = /etc/stunnel-certs CAfile = /etc/stunnel/cacert.pem cert = /etc/stunnel/lace3.keycrt [tunnel vnc] accept = 12345 connect = remotehost:5901 The log on the server : 2014.10.21 08:32:15 LOG7[28587:140281088546560]: Service tunnel vnc accepted FD=0 from 192.168.1.14:55708 2014.10.21 08:32:15 LOG7[28587:140281088538368]: Service tunnel vnc started 2014.10.21 08:32:15 LOG7[28587:140281088538368]: Option TCP_NODELAY set on local socket 2014.10.21 08:32:15 LOG7[28587:140281088538368]: Waiting for a libwrap process 2014.10.21 08:32:15 LOG7[28587:140281088538368]: Acquired libwrap process #0 2014.10.21 08:32:15 LOG7[28587:140281088538368]: Releasing libwrap process #0 2014.10.21 08:32:15 LOG7[28587:140281088538368]: Released libwrap process #0 2014.10.21 08:32:15 LOG7[28587:140281088538368]: Service tunnel vnc permitted by libwrap from 192.168.1.14:55708 2014.10.21 08:32:15 LOG5[28587:140281088538368]: Service tunnel vnc accepted connection from 192.168.1.14:55708 2014.10.21 08:32:15 LOG7[28587:140281088538368]: SSL state (accept): before/accept initialization 2014.10.21 08:32:15 LOG7[28587:140281088538368]: SSL alert (write): fatal: handshake failure 2014.10.21 08:32:15 LOG3[28587:140281088538368]: SSL_accept: 1408A10B: error:1408A10B:SSL routines:SSL3_GET_CLIENT_HELLO:wrong version number 2014.10.21 08:32:15 LOG5[28587:140281088538368]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2014.10.21 08:32:15 LOG7[28587:140281088538368]: Service tunnel vnc finished (0 left) 2014.10.21 08:32:15 LOG7[28587:140281088538368]: str_stats: 0 block(s), 0 byte(s) The log on the client (opensuse 13.1) : 2014.10.21 08:47:47 LOG7[978:140089725433664]: local socket: FD=0 allocated (non-blocking mode) 2014.10.21 08:47:47 LOG7[978:140089725433664]: Service tunnel vnc accepted FD=0 from 127.0.0.1:39609 2014.10.21 08:47:47 LOG7[978:140089725630208]: Service tunnel vnc started 2014.10.21 08:47:47 LOG7[978:140089725630208]: Option TCP_NODELAY set on local socket 2014.10.21 08:47:47 LOG7[978:140089725630208]: Waiting for a libwrap process 2014.10.21 08:47:47 LOG7[978:140089725630208]: Acquired libwrap process #0 2014.10.21 08:47:47 LOG7[978:140089725630208]: Releasing libwrap process #0 2014.10.21 08:47:47 LOG7[978:140089725630208]: Released libwrap process #0 2014.10.21 08:47:47 LOG7[978:140089725630208]: Service tunnel vnc permitted by libwrap from 127.0.0.1:39609 2014.10.21 08:47:47 LOG5[978:140089725630208]: Service tunnel vnc accepted connection from 127.0.0.1:39609 2014.10.21 08:47:47 LOG7[978:140089725630208]: remote socket: FD=1 allocated (non-blocking mode) 2014.10.21 08:47:47 LOG6[978:140089725630208]: connect_blocking: connecting 192.168.0.30:12345 2014.10.21 08:47:47 LOG7[978:140089725630208]: connect_blocking: s_poll_wait 192.168.0.30:13001: waiting 10 seconds 2014.10.21 08:47:47 LOG5[978:140089725630208]: connect_blocking: connected 192.168.0.30:12345 2014.10.21 08:47:47 LOG5[978:140089725630208]: Service tunnel vnc connected remote server from 192.168.1.14:55770 2014.10.21 08:47:47 LOG7[978:140089725630208]: Remote FD=1 initialized 2014.10.21 08:47:47 LOG7[978:140089725630208]: Option TCP_NODELAY set on remote socket 2014.10.21 08:47:47 LOG7[978:140089725630208]: SSL state (connect): before/connect initialization 2014.10.21 08:47:47 LOG7[978:140089725630208]: SSL state (connect): SSLv3 write client hello A 2014.10.21 08:47:47 LOG7[978:140089725630208]: SSL alert (read): fatal: handshake failure 2014.10.21 08:47:47 LOG3[978:140089725630208]: SSL_connect: 14094410: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure 2014.10.21 08:47:47 LOG5[978:140089725630208]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2014.10.21 08:47:47 LOG7[978:140089725630208]: Service tunnel vnc finished (0 left) 2014.10.21 08:47:47 LOG7[978:140089725630208]: str_stats: 0 blocks, 0 bytes Am I missing something ? I would like to stay with Ubuntu's standard packages. Thanks for any advice. Koenraad Lelong.

2 4

STOP REMOVING OLD RELEASE TARBALLS FOR GODS SAKE
by John Spencer 21 Oct '14

21 Oct '14

hello, 5 days ago i noticed that my stunnel source package was *again* broken because some clown removed the previous version's download from the download server, so i bite the bullet and upgraded to latest (5.05). today, doing a testbuild i got a again a 404 and was forced again to update to latest stunnel download. this is fucking frustrating. i really have better things to do than to update my package recipes whenever a new stunnel release comes out (and that's not just me). SO COULD YOU PLEASE FINALLY LEAVE YOUR PAST RELEASES ON THE DOWNLOAD MIRROR LIKE ANYONE ELSE DOES ? THANKS. and no, even if a security flaw in non-latest was discovered that's still no reason to silently delete the old tarballs. thanks, --JS P.S. the latest stunnel still does not link against libreSSL instead of openssl, due to bogus usage of RAND_egd() as mentioned a quarter year ago in my blog: http://devsonacid.wordpress.com/2014/07/12/how-compatible-is-libressl/

4 3

Trouble after disabling SSLv3
by Dion Kant 19 Oct '14

19 Oct '14

Dear list, I have stunnel running in a configuration where we use it to connect to a webserver over https while adding client certificates to the requests. This worked fine until recently on the (Apache) webserver SSLv3 was disabled. I installed the latest version of stunnel today (stunnel-5.07b2 <https://www.stunnel.org/downloads/beta/stunnel-5.07b2.tar.gz>) but that did not fix the problem. Now STunnel tries to negotiate a https connection using the TLSv1.2 and I found that because of this Apache does not like the content of the Host variable in the HTTP header which is different from what Apache is expectingto be. With SSLv3 this was not an issue. As a result I get a "HTTP/1.1 400 Bad Request" from the webserver. In my configuration I cannot (easily) apply some form of split DNS to get the hostname correct in the http header already from the client connecting to the stunnel service. I tested using curl sending a request through stunnel to the web server and verified that when I modified the Host field in the request header it does work. To my opinion it is stunnel setting up the HTTPS connection to the webserver and stunnel should take care of setting the correct Host field in the request header. Is there a way to let stunnel take care of setting the correct info in the HTTP header? Best regards, Dion Kant

1 0

Re: [stunnel-users] stunnel 5.06 released
by Dominyk Tiller 16 Oct '14

16 Oct '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi Mike, Latest build seems to be broken for me on OS X 10.10. If it matters here, since the error is SSL related, I'm building against OpenSSL 1.0.1j which is configured without ssl2 ciphers but with ssl3 ciphers enabled. This is the error: libtool: link: clang -pthread -fstack-protector -fPIE -g -O2 -Wall - -Wextra -Wno-long-long -pedantic -o stunnel stunnel-str.o stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-fd.o stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o stunnel-ui_unix.o - -L/usr/local/opt/openssl/lib64 -L/usr/local/opt/openssl/lib -lssl - -lcrypto -lz -lpthread -pthread Undefined symbols for architecture x86_64: "_SSLv2_client_method", referenced from: _parse_service_option in stunnel-options.o "_SSLv2_server_method", referenced from: _parse_service_option in stunnel-options.o ld: symbol(s) not found for architecture x86_64 clang: error: linker command failed with exit code 1 (use -v to see invocation) make[1]: *** [stunnel] Error 1 make[1]: *** Waiting for unfinished jobs.... libtool: link: ( cd ".libs" && rm -f "libstunnel.la" && ln -s "../libstunnel.la" "libstunnel.la" ) make: *** [install-recursive] Error 1 Hope that's useful. Let me know if you need more. Dom -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJUP8tNAAoJEIclJNuddDJsePEP/0tEy5rKsOzpORpawOFDpZAD KaemUgVKbaWpphkldp9tPFsaCRhQrqQPNIjfaUGb/mSAe3mAoV69P1rXYlMQiGne oaCa/p35y1SYYq0RHzflPhlDb/avfz8F5cQsXb1vA3bec8vVyTEjsIjj/pSH+him EysnGZNG61xcD55IOWT4LbcfiBO+L0iwQn4w/fQXqATmMHeYKde95d1t3DCx7Rvw t80hOw7c6xZzkYOPoXZpWPBhBESzifkE3JiapNAtRjyj9EZK+1gukjOa5EB7vrz8 pdpI65lwIAk9Grv8IT2jHIJcj03H7zPzhXoeLJl/OWKTqHVc8X7naT1Tg5kwKWdG CG0keA9hyXHhhSn763OPkKeMG7Ab31IRAlIT3ajEa2o+57KFBb5KVgHn/RWsr+0g Yzv5FjM5ZJjH02Qj/9QqjlhzzdUQDNPGpNk72UKqXbnz3xv8JoQX16PMeUYrgH6h ZjXrtcBh6CXQghyDY1D9m2xFKIVAIcfcAm6XgV6yUawfL76LL/WbreEbCmBlkRHI p17BT7TUE4pfeSpxdfMmIPgMlaAragfT+NYw4/l7XgEqi3sjaf3IpupJ4hjqbl/F dt6W/VCILDW3lnSnbWwWy/7rantCQZldbg4xWsxDMMx1oinwOgk+l92I+9Qas+8z MnuTZ052UiJ9Agn+ZxQs =i1GY -----END PGP SIGNATURE-----

1 0

Window not updating (win32 5.05)
by Javier 16 Oct '14

16 Oct '14

Hi, just reporting that with the latest version the window doesn't get updated when there is activity. It is static. You have to minimize to tray and restore again to view the activity, what, almost, is actually as fast as have a look to the log :/ Can anyone confirm? Regards. P.S.: happening on 2k and XP. Haven't tested any NT6 version.

2 3

error compiling stunnel 5.06
by Laura Fried 15 Oct '14

15 Oct '14

/tmp/stunnel-5.06/src/options.c:2123: undefined reference to `SSLv2_client_method' /tmp/stunnel-5.06/src/options.c:2127: undefined reference to `SSLv2_server_method' collect2: ld returned 1 exit status make[2]: *** [stunnel] Error 1 make[2]: Leaving directory `/tmp/stunnel-5.06/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/tmp/stunnel-5.06/src' make: *** [all-recursive] Error 1 Please advise. -- Laura J. Fried Internal Revenue Service Online Fraud Detection and Prevention 202-556-2612 (Voice) 202-552-1226 (Fax) ofdp-laura (Skype)

2 2

stunnel 5.06 released
by Michal Trojnara 15 Oct '14

15 Oct '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.06 of stunnel. This is a security bugfix release. Update is recommended. The ChangeLog entry: Version 5.06, 2014.10.15, urgency: HIGH: * Security bugfixes - OpenSSL DLLs updated to version 1.0.1j. https://www.openssl.org/news/secadv_20141015.txt - The insecure SSLv2 protocol is now disabled by default. It can be enabled with "options = -NO_SSLv2". - The insecure SSLv3 protocol is now disabled by default. It can be enabled with "options = -NO_SSLv3". - Default sslVersion changed to "all" (also in FIPS mode) to autonegotiate the highest supported TLS version. * New features - Added missing SSL options to match OpenSSL 1.0.1j. - New "-options" commandline option to display the list of supported SSL options. * Bugfixes - Fixed FORK threading build regression bug. - Fixed missing periodic Win32 GUI log updates. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 098c2b6db0793ea4fa5b6767ce6ef1853e9f6cc2f32133024be55f6a460b1a40 stunnel-5.06.tar.gz 55afb3013406da1afcc1ab7ccc25bb1c66605ca3e004636a6b49cac555cb4d09 stunnel-5.06-installer.exe a1741eb8bb050d3d29515ddef46a0a6828372a991f2658995dee1e06af8c05c8 stunnel-5.06-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlQ+4v4ACgkQ/NU+nXTHMtFwNwCgvZyndOwkAQqmsWnuL7DcRAPq lSIAnig726aVMrFzFAoQzKXxxmWo/Qo9 =ok3p -----END PGP SIGNATURE-----

1 0

Nasty SSL 3.0 vulnerability to be revealed soon
by 541401＠gmail.com 14 Oct '14

14 Oct '14

Nasty SSL 3.0 vulnerability to be revealed soon http://www.theregister.co.uk/2014/10/14/nasty_ssl_30_vulnerability_to_drop_…

1 0

Mongo Replication using Stunnel
by Danny Hernandez 12 Oct '14

12 Oct '14

Hello, I am trying to create an ssl connection between two mongodb instances both using the mongodb community version. Both instances need to communicate with one another as they need to be able to ping each other. I am getting this error when attempting to connect to Instance A from Instance B and vice versa: connect_blocking: connect <ip address>:27027: Connection refused (111) I have two conf files on each server (one for client and one for server). I am using the latest version of stunnel and the latest version of mongodb. Here are my conf files: *SERVER A* cert=/etc/stunnel/stunnel.pem key = /etc/stunnel/stunnel.pem verify = 2 CAfile = /etc/stunnel/stunnel.pem pid = /client.pid output = /var/log/stunnel4/stunnel.log debug = 7 sslVersion = all [mongo-replication] accept = 27037 connect = 127.0.0.1:27017 retry = yes* * *Server B *cert=/etc/stunnel/stunnel.pem key = /etc/stunnel/stunnel.pem verify = 2 CAfile = /etc/stunnel/stunnel.pem pid = /client.pid output = /var/log/stunnel4/stunnel.log debug = 7 sslVersion = all [mongo-replication] accept = 27027 connect = 127.0.0.1:27027 retry = yes *Client A *cert=/etc/stunnel/client.pem pid = /client.pid output = /var/log/stunnel4/client.log debug = 7 client = yes [mongo-replication] accept = 27037 connect = dbtest2:27027 retry = yes *Client B *cert=/etc/stunnel/client.pem pid = /client.pid output = /var/log/stunnel4/client.log debug = 7 client = yes [mongo-replication] accept = 27037 connect = dbtest1:27037 retry = yes Could someone please assist with troubleshooting the error? Thank you! -- Thank you, Danny Hernandez

1 0

num_clients Undeclared
by Abdelkader Chelouah 12 Oct '14

12 Oct '14

Hello, Build of stunnel 5.04 and 5.05 failed on RHEL 6.2 (prior to 5.04, the build succeded) ... gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/logiciels/postgresql/9.3/lib/openssl/include -DLIBDIR='"/logiciels/postgresql/9.3/lib/stunnel/lib/stunnel"' -DCONFDIR='"/logiciels/postgresql/9.3/lib/stunnel/etc/stunnel"' -I/logiciels/postgresql/9.3/include -I/logiciels/postgresql/9.3/lib/openssl/include -I/logiciels/postgresql/9.3/lib/krb5/include -I/logiciels/postgresql/9.3/lib/cyrus-sasl/include -pthread -fstack-protector -fPIE -O3 -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -march=nocona -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-stunnel.o -MD -MP -MF .deps/stunnel-stunnel.Tpo -c -o stunnel-stunnel.o `test -f 'stunnel.c' || echo './'`stunnel.c stunnel.c: In function ‘main_configure’: stunnel.c:150: error: ‘num_clients’ undeclared (first use in this function) stunnel.c:150: error: (Each undeclared identifier is reported only once stunnel.c:150: error: for each function it appears in.) stunnel.c: At top level: stunnel.c:533: warning: expected [error|warning|ignored] after ‘#pragma GCC diagnostic’ stunnel.c:534: warning: unknown option after ‘#pragma GCC diagnostic’ kind stunnel.c: In function ‘signal_post’: stunnel.c:538: warning: ignoring return value of ‘write’, declared with attribute warn_unused_result stunnel.c: At top level: stunnel.c:541: warning: expected [error|warning|ignored] after ‘#pragma GCC diagnostic’ make[2]: *** [stunnel-stunnel.o] Error 1 make[2]: Leaving directory `/ESA/build/stunnel-5.05/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/ESA/build/stunnel-5.05/src' make: *** [all-recursive] Error 1 It seems that the 'num_clients' variable is undeclared in the main_configure function. Thank you

2 3

Problems with stunnel 5.04 for Windows
by Mark Hannig 11 Oct '14

11 Oct '14

Hi! New to this list and this product. I posted this on the Amazon forums, but I need to fix this fast, so I thought I would post it here as well. I am running stunnel 5.04 for Windows on a Windows 2012 R2 instance. I have it working with SES, but after a while it just keeps timing out. I have to manually reload the configuration file to get it to start working again. What am I doing wrong? Here is a part of the log: 2014.10.09 07:43:57 LOG5964 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> accepted connection from 127.0.0.1:62779 2014.10.09 07:44:07 LOG3964 <https://forums.aws.amazon.com/>: s_connect: s_poll_wait 54.68.86.38:465: TIMEOUTconnect exceeded 2014.10.09 07:44:17 LOG3964 <https://forums.aws.amazon.com/>: s_connect: s_poll_wait 54.68.197.46:465: TIMEOUTconnect exceeded 2014.10.09 07:44:27 LOG3964 <https://forums.aws.amazon.com/>: s_connect: s_poll_wait 54.213.178.250:465: TIMEOUTconnect exceeded 2014.10.09 07:44:27 LOG5964 <https://forums.aws.amazon.com/>: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2014.10.09 11:30:18 LOG53224 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> accepted connection from 127.0.0.1:63014 2014.10.09 11:30:28 LOG33224 <https://forums.aws.amazon.com/>: s_connect: s_poll_wait 54.68.197.46:465: TIMEOUTconnect exceeded 2014.10.09 11:30:38 LOG33224 <https://forums.aws.amazon.com/>: s_connect: s_poll_wait 54.213.178.250:465: TIMEOUTconnect exceeded 2014.10.09 11:30:48 LOG33224 <https://forums.aws.amazon.com/>: s_connect: s_poll_wait 54.68.86.38:465: TIMEOUTconnect exceeded 2014.10.09 11:30:48 LOG53224 <https://forums.aws.amazon.com/>: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2014.10.09 11:31:34 LOG51000 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> accepted connection from 127.0.0.1:63019 2014.10.09 11:31:44 LOG31000 <https://forums.aws.amazon.com/>: s_connect: s_poll_wait 54.213.178.250:465: TIMEOUTconnect exceeded 2014.10.09 11:31:54 LOG31000 <https://forums.aws.amazon.com/>: s_connect: s_poll_wait 54.68.86.38:465: TIMEOUTconnect exceeded 2014.10.09 11:32:01 LOG5388 <https://forums.aws.amazon.com/>: Reading configuration from file stunnel.conf 2014.10.09 11:32:01 LOG5388 <https://forums.aws.amazon.com/>: FIPS mode disabled 2014.10.09 11:32:01 LOG5388 <https://forums.aws.amazon.com/>: Configuration successful 2014.10.09 11:32:04 LOG31000 <https://forums.aws.amazon.com/>: s_connect: s_poll_wait 54.68.197.46:465: TIMEOUTconnect exceeded 2014.10.09 11:32:04 LOG51000 <https://forums.aws.amazon.com/>: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2014.10.09 11:32:14 LOG5964 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> accepted connection from 127.0.0.1:63024 2014.10.09 11:32:14 LOG5964 <https://forums.aws.amazon.com/>: s_connect: connected 54.68.159.203:465 2014.10.09 11:32:14 LOG5964 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> connected remote server from 172.31.3.85:63025 2014.10.09 11:32:14 LOG5964 <https://forums.aws.amazon.com/>: Connection closed: 494 byte(s) sent to SSL, 360 byte(s) sent to socket 2014.10.09 11:32:18 LOG5892 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> accepted connection from 127.0.0.1:63026 2014.10.09 11:32:18 LOG5892 <https://forums.aws.amazon.com/>: s_connect: connected 54.213.190.197:465 2014.10.09 11:32:18 LOG5892 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> connected remote server from 172.31.3.85:63027 2014.10.09 11:32:18 LOG5892 <https://forums.aws.amazon.com/>: Connection closed: 1592 byte(s) sent to SSL, 360 byte(s) sent to socket 2014.10.09 12:41:29 LOG53700 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> accepted connection from 127.0.0.1:63100 2014.10.09 12:41:29 LOG53700 <https://forums.aws.amazon.com/>: s_connect: connected 54.244.8.28:465 2014.10.09 12:41:29 LOG53700 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> connected remote server from 172.31.3.85:63101 2014.10.09 12:41:29 LOG53700 <https://forums.aws.amazon.com/>: Connection closed: 1609 byte(s) sent to SSL, 360 byte(s) sent to socket 2014.10.09 12:46:13 LOG53428 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> accepted connection from 127.0.0.1:63107 2014.10.09 12:46:13 LOG53428 <https://forums.aws.amazon.com/>: s_connect: connected 54.68.159.203:465 2014.10.09 12:46:13 LOG53428 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> connected remote server from 172.31.3.85:63108 2014.10.09 12:46:14 LOG53428 <https://forums.aws.amazon.com/>: Connection closed: 1609 byte(s) sent to SSL, 360 byte(s) sent to socket 2014.10.09 16:32:21 LOG51876 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> accepted connection from 127.0.0.1:63335 2014.10.09 16:32:21 LOG51876 <https://forums.aws.amazon.com/>: s_connect: connected 54.213.190.197:465 2014.10.09 16:32:21 LOG51876 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> connected remote server from 172.31.3.85:63336 2014.10.09 16:32:21 LOG51876 <https://forums.aws.amazon.com/>: Connection closed: 1611 byte(s) sent to SSL, 360 byte(s) sent to socket 2014.10.10 01:52:46 LOG5440 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> accepted connection from 127.0.0.1:64017 2014.10.10 01:52:46 LOG5440 <https://forums.aws.amazon.com/>: s_connect: connected 54.244.8.28:465 2014.10.10 01:52:46 LOG5440 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> connected remote server from 172.31.3.85:64018 2014.10.10 01:52:47 LOG5440 <https://forums.aws.amazon.com/>: Connection closed: 5129 byte(s) sent to SSL, 360 byte(s) sent to socket 2014.10.10 08:32:20 LOG53548 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> accepted connection from 127.0.0.1:64423 2014.10.10 08:32:30 LOG33548 <https://forums.aws.amazon.com/>: s_connect: s_poll_wait 54.68.159.203:465: TIMEOUTconnect exceeded 2014.10.10 08:32:40 LOG33548 <https://forums.aws.amazon.com/>: s_connect: s_poll_wait 54.213.190.197:465: TIMEOUTconnect exceeded 2014.10.10 08:32:50 LOG33548 <https://forums.aws.amazon.com/>: s_connect: s_poll_wait 54.244.8.28:465: TIMEOUTconnect exceeded 2014.10.10 08:32:50 LOG53548 <https://forums.aws.amazon.com/>: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket You can see that it stops, then I reload the configuration and it works again, and then eventually stops. Here is my configuration file: engine = capi cert = stunnel.pem options = NO_SSLv2 ssmtp <https://forums.aws.amazon.com/> accept = 465 connect = 25 smtp-tls-wrapper <https://forums.aws.amazon.com/> accept = 2525 client = yes connect = email-smtp.us-west-2.amazonaws.com:465 Thank you. -- Mark F. Hannig

2 1

stunnel 5.05 released
by Michal Trojnara 10 Oct '14

10 Oct '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.05 of stunnel. The ChangeLog entry: Version 5.05, 2014.10.10, urgency: MEDIUM: * New features - Asynchronous communication with the GUI thread for faster logging on Win32. - systemd socket activation (thx to Mark Theunissen). - The parameter of "options" can now be prefixed with "-" to clear an SSL option, for example: "options = -LEGACY_SERVER_CONNECT". - Improved "transparent = destination" manual page (thx to Vadim Penzin). * Bugfixes - Fixed POLLIN|POLLHUP condition handling error resulting in prematurely closed (truncated) connection. - Fixed a null pointer dereference regression bug in the "transparent = destination" functionality (thx to Vadim Penzin). This bug was introduced in stunnel 5.00. - Fixed startup thread synchronization with Win32 GUI. - Fixed erroneously closed stdin/stdout/stderr if specified as the -fd commandline option parameter. - A number of minor Win32 GUI bugfixes and improvements. - Merged most of the Windows CE patches (thx to Pierre Delaage). - Fixed incorrect CreateService() error message on Win32. - Implemented a workaround for defective Cygwin file descriptor passing breaking the libwrap support: http://wiki.osdev.org/Cygwin_Issues#Passing_file_descriptors Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: c7e1653345150db7e48d00e1129cf571c7c85de8e7e1aa70b21cf1d76b1e31ef stunnel-5.05.tar.gz 19f8b78aecc26c291d90e4fa72807bdb75063a7641fd64f224222b526cfa83aa stunnel-5.05-installer.exe 65129c4c1a73dc04a0f66571a9bda2860d70376cdcc2c1d83fd575dcb0adc7a5 stunnel-5.05-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlQ3ofIACgkQ/NU+nXTHMtHnmQCg8sncLzw4bfiuw3ziL7HGFEdJ luwAoKTF4C3jbUihpz8ODEPvtGbK24Cs =Z+GJ -----END PGP SIGNATURE-----

1 0

CERT: Verification error: unable to get local issuer certificate
by Vivek Gupta 07 Oct '14

07 Oct '14

Hi I am getting error - Below is the log: ******************************** Service [LMAX-fix-tunnel-DEMO-MktData] connected remote server from 192.168.1.5:49819 Remote socket (FD=276) initialized SNI: sending servername: fix-md-ate.lmaxtrader.com SSL state (connect): before/connect initialization SSL state (connect): SSLv3 write client hello A SSL state (connect): SSLv3 read server hello A Verification started at depth=1: C=US, O=DigiCert Inc, CN=DigiCert Secure Server CA CERT: Verification error: unable to get local issuer certificate Rejected by CERT at depth=1: C=US, O=DigiCert Inc, CN=DigiCert Secure Server CA SSL alert (write): fatal: unknown CA SSL_connect: 14090086: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket Remote socket (FD=276) closed Local socket (FD=524) closed Service [LMAX-fix-tunnel-DEMO-MktData] finished (0 left) *************************************************** and below is the conf file: ************ ; Certificate/key is needed in server mode and optional in client mode ;cert = stunnel.pem ;key = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 3 CApath = C:\Program Files (x86)\stunnel\ CAfile = C:\Program Files (x86)\stunnel\peer-LMAX-fix-tunnel-DEMO-MktData.pem ;CRLpath = crls ;CRLfile = crls.pem options = NO_SSLv2 ************************************ Please suggest how to solve verification error. Thanks &Regards Vivek Gupta 9971514343

1 0

STunnel Connection closed: 150 byte(s) sent to SSL, 0 byte(s) sent to socket
by Vivek Gupta 07 Oct '14

07 Oct '14

Hi I am using sTunnel for communication betweem my TCP client and a remote SERVER but I am getting error as always- Signal pipe is empty Service [LMAX-fix-tunnel-DEMO-MktData] accepted (FD=348) from 127.0.0.1:55919 2014.10.06 :34:56 LOG7[4220]: Creating a new thread New thread created Service [LMAX-fix-tunnel-DEMO-MktData] started Service [LMAX-fix-tunnel-DEMO-MktData] accepted connection from 127.0.0.1:55919 s_connect: connecting 91.215.165.69:443 s_connect: s_poll_wait 91.215.165.69:443: waiting 10 seconds s_connect: connected 91.215.165.69:443 Service [LMAX-fix-tunnel-DEMO-MktData] connected remote server from 192.168.1.5:55920 Remote socket (FD=352) initialized SNI: sending servername: fix-md-ate.lmaxtrader.com SSL state (connect): before/connect initialization SSL state (connect): SSLv3 write client hello A SSL state (connect): SSLv3 read server hello A SSL state (connect): SSLv3 read server certificate A SSL state (connect): SSLv3 read server done A SSL state (connect): SSLv3 write client key exchange A SSL state (connect): SSLv3 write change cipher spec A SSL state (connect): SSLv3 write finished A SSL state (connect): SSLv3 flush data SSL state (connect): SSLv3 read finished A 1 items in the session cache 1 client connects (SSL_connect()) 1 client connects that finished 0 client renegotiations requested 0 server connects (SSL_accept()) 0 server connects that finished 0 server renegotiations requested 0 session cache hits 0 external session cache hits 0 session cache misses 0 session cache timeouts Peer certificate was cached (3944 bytes) SSL connected: new session negotiated Negotiated TLSv1/SSLv3 ciphersuite: AES128-SHA (128-bit encryption) Compression: null, expansion: null SSL_read returned WANT_READ: retrying SSL socket closed (SSL_read) Sent socket write shutdown Connection closed: 150 byte(s) sent to SSL, 0 byte(s) sent to socket Remote socket (FD=352) closed Local socket (FD=348) closed Service [LMAX-fix-tunnel-DEMO-MktData] finished (0 left) Please suggest.

3 4

trojan in stunnel-5.04-installer.exe ?
by oVPN.to Support 03 Oct '14

03 Oct '14

Hi stunnel folks, a client informed us about trojan warning in stunnel-5.04-installer.exe can anybody explain this "behavioural information"? DNS requests VBOXSVR.ovh.net https://www.virustotal.com/en/file/045145b4e6ef66d29774b558837bd693a0dbab9f… additonal: https://anubis.iseclab.org/?action=result&task_id=1beba124664d67ea4914aa2b2… stunnel-5.05b4-installer.exe does not have it, but flagged as trojan by 2 AVs too https://www.virustotal.com/en/file/ac4f98c13a0a9f62cc118faa91483a1a5c0a7128… stunnel-5.03-installer.exe https://www.virustotal.com/en/file/803bc85fbc80f22d71b13d4180e2d51c02586b2c… Thanks

1 0

Support on windows 2012 SR (32/64b)
by Soudant, Erik 03 Oct '14

03 Oct '14

Hi All, I would like to know if Stunnel supports Windows 2012 SR (32/64). I cannot find any information about this in the archives/Documentation. Thanx in advance. Regards Erik Soudant Application Designer [cid:image009.jpg@01CFDF01.B845D7A0] E Erik.soudant(a)pinkroccade.nl<mailto:Erik.soudant@pinkroccade.nl> l M 06 46091160 l T +31 (0)88 110 1500 | W www.pinkroccadelocalgovernment.nl<http://www.pinkroccadelocalgovernment.nl/> [cid:image010.jpg@01CFDF01.B845D7A0]<http://www.linkedin.com/groups?mostPopular=&gid=1811286&trk=myg_ugrp_ovr>[cid:image011.jpg@01CFDF01.B845D7A0]<http://www.twitter.com/pinkroccadelg> Disclaimer | De informatie verzonden met dit e-mail bericht is confidentieel en uitsluitend bestemd voor de geadresseerde. Gebruik van deze informatie door anderen dan de geadresseerde en gebruik door hen die niet gerechtigd zijn van de informatie kennis te nemen, is verboden. Indien u niet de geadresseerde bent of niet gerechtigd bent tot kennisneming, (a) is openbaarmaking, vermenigvuldiging, verspreiding en/of verstrekking van deze informatie aan derden, niet toegestaan, en (b) wordt u verzocht de afzender daarvan onmiddellijk op de hoogte te brengen en het bericht te vernietigen. PinkRoccade Local Government B.V. staat niet in voor de juiste en volledige overbrenging van de inhoud van een verzonden e-mail, noch voor tijdige ontvangst daarvan. [cid:image012.jpg@01CFDF01.B845D7A0]Denk alstublieft aan het milieu voordat u deze e-mail print.

1 0

Configuring the STunnel for a TCP Client
by Vivek Gupta 01 Oct '14

01 Oct '14

Hi I have installed STunnel version 5.xx and using a TCP client to connect with it but no success. My details are as follows: 1. Configuration of STunnel.conf verify = 3 CAfile = peer-LMAX-fix-tunnel-DEMO-MktData.pem [LMAX-fix-tunnel-DEMO-MktData] client = yes accept = 127.0.0.1:40003 connect = fix-md-ate.lmaxtrader.com:443 cert = stunnel.pem key = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 Certificate file stunnel.pem was generated by software itself. 2. I have written a TCP client as follows:Only part of code is given below *********************************************** // Resolve the server address and port iResult = getaddrinfo("127.0.0.1", 40003, NULL, &servinfo); // Attempt to connect to an address until one succeeds for(ptr=servinfo; ptr != NULL ;ptr=ptr->ai_next) { // Create a SOCKET for connecting to server ConnectSocket = socket(ptr->ai_family,ptr->ai_socktype,ptr-ai_protocol); // Connect to server. iResult = connect( ConnectSocket, ptr->ai_addr, (int)ptr->ai_addrlen); break; } // Send an initial buffer iResult = send( ConnectSocket, sendbuf, (int)strlen(sendbuf), 0 ); printf("Bytes Sent: %ld\n", iResult); // Receive until the peer closes the connection do { iResult = recv(ConnectSocket, recvbuf, recvbuflen, 0); if ( iResult > 0 ) printf("Bytes received: %d\n", iResult); else if ( iResult == 0 ) printf("Connection closed\n"); else printf("recv failed with error: %d\n", WSAGetLastError()); } while( iResult > 0 ); ******************************************************** Here I would like to tell you that I have used 127.0.0.1 and 40003 in getaddrinfo and same has been configured in conf file. Whenever I try to connect I am receiving iResult =0 from recv(). Could anybody please let me know is there anything wrong with my configuration and how to get resolve the current issue?

1 0

No Taskbar Icon
by Carter Browne 26 Sep '14

26 Sep '14

I have updated stunnel to version 5.04 on Windows 7 32 & 64 bit, Windows Server 2008R2, Windows Server 2012 and Windows Server 2012R2 and in no case does the icon appear. I explicitly set taskbar = yes in the configuration file. -- Carter Browne cbrowne(a)cbcs-usa.com

5 13

"Socket operation on non-socket" when trying to pass the configuration file as a file descriptor on OSX
by Guylhem 24 Sep '14

24 Sep '14

Hello I'm trying to pass the configuration file with option fd. However, I get the following errors when I do : echo my configuration | stunnel -fd 0 This is not related to echo since I get the same errors with: cat conf | stunnel -fd 0 stunnel is just filling my logs with : 2014-07-13 6:48:46.675 PM stunnel[1959]: LOG3[140735238959888]: local socket: Socket operation on non-socket (38) 2014-07-13 6:48:46.676 PM stunnel[1959]: LOG3[140735238959888]: local socket: Socket operation on non-socket (38) (...) stunnel ./conf works fine I found a reference to a bug that caused this same error message on OSX when run in inetd mode, but nothing else. Any help is appreciated I'm using stunnel 5.02 on x86_64-apple-darwin13.2.0 platform with the following in -sockets: Socket option defaults: Option Name | Accept | Local | Remote |OS default ----------------+----------+----------+----------+---------- SO_DEBUG | -- | -- | -- | no SO_DONTROUTE | -- | -- | -- | no SO_KEEPALIVE | -- | -- | -- | no SO_LINGER | -- | -- | -- | 0:0 SO_OOBINLINE | -- | -- | -- | no SO_RCVBUF | -- | -- | -- | 131072 SO_SNDBUF | -- | -- | -- | 131072 SO_RCVLOWAT | -- | -- | -- | 1 SO_SNDLOWAT | -- | -- | -- | 2048 SO_RCVTIMEO | -- | -- | -- | 0:0 SO_SNDTIMEO | -- | -- | -- | 0:0 SO_REUSEADDR | yes| -- | -- | no TCP_KEEPCNT | -- | -- | -- |write-only TCP_KEEPINTVL | -- | -- | -- |write-only IP_TOS | -- | -- | -- | 0 IP_TTL | -- | -- | -- | 64 TCP_NODELAY | -- | yes| yes| no My configuration is quite simple : I just echo CAfile=/path/to/file.pem verify = 3 fips = no options = NO_SSLv2 debug = 7 [test] client = yes accept = 127.0.0.1:4443 connect = remoteip:443

2 1

Stunnel as windows service doesn't start on restart.
by John Smith 24 Sep '14

24 Sep '14

Running stunnel 5.03 on Windows 2008 R2. Everything is installed and working fine. I can even start/stop the service no problem... (Pretty sure the service is set to start Automatically) When I reboot my server stunnel service shows as started but nothing gets logged and none of my connections work. Once I restart the service through service manager, everything works. So on startup it doesn't seem to run... This only happens if i reboot the machine. I also asked the same question here: http://serverfault.com/questions/627932/stunnel-as-windows-service-doesnt-s… Output of my logs proving it works. 2014.09.11 15:57:48 LOG5[1612]: stunnel 5.03 on x86-pc-msvc-1500 platform 2014.09.11 15:57:48 LOG5[1612]: Compiled/running with OpenSSL 1.0.1i-fips 6 Aug 2014 2014.09.11 15:57:48 LOG5[1612]: Threading:WIN32 Sockets:SELECT,IPv6 SSL:ENGINE,OCSP,FIPS 2014.09.11 15:57:48 LOG5[1612]: Reading configuration from file stunnel.conf 2014.09.11 15:57:48 LOG5[1612]: FIPS mode disabled 2014.09.11 15:57:49 LOG5[1612]: Configuration successful

8 27

Possible problem found in init script with 'dirty' config file
by F. J. Blanco 23 Sep '14

23 Sep '14

Hi there. Perhaps this is a foolishness, but it happens to me, triggering a great headache. I'm Debian (Wheezy) user, using stunnel 4.53-1.1. I copied the stunnel configuration from another machine for a simple LAN SMTP relay. When I tried to reload the script, I got this: # /etc/init.d/stunnel4 start > Reloading configuration SSL tunnels: /etc/init.d/stunnel4: 34: test: /var/lib/stunnel4/: unexpected operator A few hours laters, I discovered the problem was in config file, in the chroot parameter: chroot = /var/lib/stunnel4 Specifically, with a hide space at the end of the line: chroot = /var/lib/stunnel4[ ] In the init script, in the function get_pids(), this mistake caused that this checkout fails: --- if test -f $CHROOT/$PIDFILE; then cat $CHROOT/$PIDFILE fi --- 'cat /var/lib/stunnel4///stunnel.pid' is not the same as 'cat /var/lib/stunnel4/[ ]//stunnel.pid' Perhaps a suggestion, a little change here: CHROOT=`grep "^chroot" $file|sed "s;.*= *;;"` Adding a space filter: CHROOT=`grep "^chroot" $file|sed "s;.*= *;;" | tr -d " "` Regards.

4 10

Re: [stunnel-users] Stunnel as windows service doesn't start on restart.
by josealf＠rocketmail.com 22 Sep '14

22 Sep '14

John. Looks fine to me. Same configuration works in my Windows 7 64 bits. I have no access to Windows Server 2008 R2, but I would expect it to work the same. What are you securing with stunnel?... Perhaps the service you are securing is starting after stunnel? -----Original Message----- From: John Smith <java.dev.mtl(a)gmail.com> Date: Mon, 22 Sep 2014 11:09:21 To: Jose Diaz<josealf(a)rocketmail.com> Subject: Re: [stunnel-users] Stunnel as windows service doesn't start on restart. SERVICE_NAME: stunnel TYPE : 110 WIN32_OWN_PROCESS (interactive) START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : "C:\Program Files (x86)\stunnel\stunnel.exe" -service -install LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Stunnel SSL wrapper DEPENDENCIES : TCPIP SERVICE_START_NAME : LocalSystem On 22 September 2014 11:02, John Smith <java.dev.mtl(a)gmail.com> wrote: > After reboot? > > On 22 September 2014 10:11, <josealf(a)rocketmail.com> wrote: > >> >> Interesting. Please execute >> >> sc qc stunnel >> >> And post the output. >> >> >> >> -----Original Message----- >> From: John Smith <java.dev.mtl(a)gmail.com> >> Sender: "stunnel-users" <stunnel-users-bounces(a)stunnel.org> >> Date: Mon, 22 Sep 2014 09:54:10 >> To: Michal Trojnara<Michal.Trojnara(a)mirt.net> >> Cc: <stunnel-users(a)stunnel.org> >> Subject: Re: [stunnel-users] Stunnel as windows service doesn't start on >> restart. >> >> _______________________________________________ >> stunnel-users mailing list >> stunnel-users(a)stunnel.org >> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >> >> >> >> >

2 3

stunnel beta (5.04b1) is available for testing
by Michal Trojnara 22 Sep '14

22 Sep '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Guys, Please feel free to try the beta version I just made available for download: https://www.stunnel.org/downloads/beta/stunnel-5.04b1.tar.gz https://www.stunnel.org/downloads/beta/stunnel-5.04b1-installer.exe The list of changes includes most of the issues recently discussed on the stunnel-users mailing list and more. * New features - Support for local mode ("exec" option) on Win32. - A more explicit service description provided for the Windows SCM (thx to Pierre Delaage). - TCP/IP dependency added for NT service in order to (hopefully) prevent initialization failure at boot time. - FIPS canister updated to version 2.0.8 in the Win32 binary build. * Bugfixes - load_icon_default() modified to return copies of default icons instead of the original resources to prevent the resources from being destroyed. - Reportedly more compatible values used for the dwDesiredAccess parameter of the CreateFile() function (thx to Pierre Delaage). - Partially merged UNICODE compilation fixes (thx to Pierre Delaage). - Partially merged Windows CE patches (thx to Pierre Delaage). - Fixed typos in stunnel.init.in and vc.mak. - Fixed incorrect memory allocation statistics update in str_realloc(). - Missing REMOTE_PORT environmental variable is provided to processes spawned with "exec" on Unix platforms. - Taskbar icon is no longer disabled for NT service. Some basic examples for local mode ("exec" option) on Windows: ; Service based on a command-line tool [netstat] accept = 8015 exec = c:\windows\system32\netstat.exe execargs = netstat -a ; Remote cmd.exe protected with SSL ; Certificate-based authentication needs to be configured here! [cmd] accept = 1337 exec = c:\windows\system32\cmd.exe Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlQYYkoACgkQ/NU+nXTHMtGmfwCfSdHFmK8q5IRcS/CoFmYMZ40G zUEAoNUrIp0KAJ4+0LPwx+/1lJG6q2q/ =aSXM -----END PGP SIGNATURE-----

3 11

Support for PSK
by Thomas Conté 21 Sep '14

21 Sep '14

Hello everyone, In the context of an embedded project, I have developed a lightweight, PolarSSL-based TLS-PSK client running on an Arduino board. Now I am looking for a generic server-side solution to connect the TLK-PSK client to a few Web services living in various app servers (Node.JS, IIS, and others). Since PSK support is not widespread, I am thinking about using stunnel as a generic front-end to these services. I have done a quick-and-dirty POC of adding PSK support to stunnel and it looks like this could be done with minor modifications, e.g. adding a call to SSL_CTX_set_psk_server_callback and the corresponding callback to ctx.c. Right now the psk_key and psk_identity values are hard-coded, so of course those need to be added to the configuration file. Is the community interested in further work in that area? Or is PSK support already in the stunnel roadmap? Cheers, -- Thomas Conté.

2 1

stunnel 5.04 released
by Michal Trojnara 21 Sep '14

21 Sep '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.04 of stunnel. The ChangeLog entry: Version 5.04, 2014.09.21, urgency: LOW: * New features - Support for local mode ("exec" option) on Win32. - Support for UTF-8 config file and log file. - Win32 UTF-16 build (thx to Pierre Delaage for support). - Support for Unicode file names on Win32. - A more explicit service description provided for the Windows SCM (thx to Pierre Delaage). - TCP/IP dependency added for NT service in order to prevent initialization failure at boot time. - FIPS canister updated to version 2.0.8 in the Win32 binary build. * Bugfixes - load_icon_default() modified to return copies of default icons instead of the original resources to prevent the resources from being destroyed. - Partially merged Windows CE patches (thx to Pierre Delaage). - Fixed typos in stunnel.init.in and vc.mak. - Fixed incorrect memory allocation statistics update in str_realloc(). - Missing REMOTE_PORT environmental variable is provided to processes spawned with "exec" on Unix platforms. - Taskbar icon is no longer disabled for NT service. - Fixed taskbar icon initialization when commandline options are specified. - Reportedly more compatible values used for the dwDesiredAccess parameter of the CreateFile() function (thx to Pierre Delaage). - A number of minor Win32 GUI bugfixes and improvements. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: ee9702e073cb8d5940a1310ae171a38d3264f1ce3b087160728bbbcf5710cec1 stunnel-5.04.tar.gz 045145b4e6ef66d29774b558837bd693a0dbab9f7295586da9e5f0de4c5a7481 stunnel-5.04-installer.exe d1bc5c00278f31c64ad4a601d9e398b21284777f9079e91b8cbaef1e8e91f538 stunnel-5.04-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlQfAqsACgkQ/NU+nXTHMtH1cACeLEi7tFSEoxYJCfZROeaTLD4J +8sAoKK+l/6Bjl2sLwPRTcmw/Vj4+PYy =F0H9 -----END PGP SIGNATURE-----

1 0

GnuTLS port
by Max 20 Sep '14

20 Sep '14

Pardon if that was asked before, but are there port of stunnel to GnuTLS available somewhere? With recent fallout from heartbleed I'm looking into getting rid of openssl (besides I've never liked the license anyway :) and stunnel is one of the very few programs which got dependency on it. cheers, Max.

2 1

stunnel beta (5.04b2) is available for testing
by Michal Trojnara 19 Sep '14

19 Sep '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Guys, Please feel free to try the second beta version: https://www.stunnel.org/downloads/beta/stunnel-5.04b2.tar.gz https://www.stunnel.org/downloads/beta/stunnel-5.04b2-installer.exe I have finished implementing Win32 UNICODE support. The following planned features depend on UNICODE support: - Non-ASCII path names (this is already partially implemented) - UTF8 stunnel.conf - Windows CE GUI stunnel 5.04b2 also fixes missing taskbar icon when stunnel is executed with commandline switches (for example "stunnel -help"). Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlQcnAcACgkQ/NU+nXTHMtHOnQCeJFPogmAyhDFQ+CoLT17nhd1I CSIAni1tOnInyScnXwB/d876RF0o9YYt =PJ+o -----END PGP SIGNATURE-----

1 0

400 - Bad Request
by j nasty 17 Sep '14

17 Sep '14

I'm trying to access a web service endpoint using sTunnel to handle all the SSL traffic. For my other connection setups this works perfectly fine. But for this one particular client I'm getting a 400 - Bad Request Error. Client Configuration looks like this: [Connection1] client = yes accept = 127.0.0.1:9006 connect = server.com:443 Response I get back is: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>400 Bad Request</title> </head><body> <h1>Bad Request</h1> <p>Your browser sent a request that this server could not understand.<br /> Reason: You're speaking plain HTTP to an SSL-enabled server port.<br /> Instead use the HTTPS scheme to access this URL, please.<br /> <blockquote>Hint: <a href="https://server.com/"><b>https://server.com/</b></a></blockquote></p> </body></html> Is there a setting configuration I can use so that sTunnel redirects to https://server.com instead of server.com:443? Thanks in advance, Jake

2 1

Re: [stunnel-users] Stunnel Windows Server 2008 R2
by Pierre DELAAGE 01 Sep '14

01 Sep '14

Ok, thank you very much. I am pushing our mails to the forum, just in case it may help someone. Yours sincerely Pierre Le 01/09/2014 00:53, 541401(a)gmail.com a écrit : > Sorry for my lack of clarity. > > Your patched 5.02 works as a service. The official 5.03 does not work > as a service. > > > On 31.Aug.14 15:13, Pierre DELAAGE wrote: >> Hello, >> Thanks for the feedback. >> >> So...are you saying that it is now working with MY patched 502 and >> NOT with the official 503 (except for the "not configured msg") ? >> >> Or, finally, are you saying that they work the same, my patched 502 >> and the official 503 ? >> >> Yours sincerely >> Pierre >> >> >> >> Le 31/08/2014 22:46, 541401(a)gmail.com a écrit : >>> Hello Pierre, >>> >>> Today I downloaded the file you sent. I installed 5.03 on the server >>> (replacing 4.35), copied your 5.02 executable over the 5.03 exe. >>> >>> I then copied the 4.35 conf file into the 5.03 directory and finally >>> I installed and started the service. The service installed and ran, >>> but there was a message on the notification window saying it was not >>> configured. >>> >>> HOWEVER, I believe that message was wrong because the service works >>> just fine. I was able to send email from the Event log, through the >>> Windows virtual SMTP server and finally on through a gmail account! >>> >>> I did have to uncheck the service option "allow to interact with >>> desktop" because Server 2008 R2 will not allow a service to interact >>> with the desktop. >>> >>> Thank you very much, I am sorry it took a couple of days to do this >>> and report back to you! >>> >>> >>> On 29.Aug.14 07:38, Pierre DELAAGE wrote: >>>> Hello, >>>> have you tried the patched 502 version I sent you last week ? >>>> Regards >>>> Pierre >>>> >>>> Le 28 août 2014 à 21:20, "541401(a)gmail.com" <541401(a)gmail.com> a >>>> écrit : >>>> >>>>> Hopefully you were smarter than I and didn't piss away several >>>>> hours trying to solve the issue before turning to this forum? I >>>>> felt kind of foolish for wasting so much time trying to fix it on >>>>> my own. >>>>> >>>>> On 28.Aug.14 10:50, WNSDEV wrote: >>>>>> Hi, >>>>>> >>>>>> I ran into the same problem with Stunnel 5.03 on Windows 7 and >>>>>> downgrading >>>>>> to V 4.35 fixed it. Is there a new version to address this issue >>>>>> going to >>>>>> be available at some point? >>>>>> >>>>>> Thanks, >>>>>> Pete >>>>>> >>>>>> -----Original Message----- >>>>>> From: 541401(a)gmail.com [mailto:541401@gmail.com] >>>>>> Sent: Thursday, August 21, 2014 4:43 PM >>>>>> To: stunnel-users(a)stunnel.org >>>>>> Subject: [stunnel-users] Stunnel Windows Server 2008 R2 >>>>>> >>>>>> I have installed stunnel 5.03 on Windows Server 2008 R2 X64. >>>>>> When I run it >>>>>> as an application it works perfectly. When I install and run the >>>>>> service, >>>>>> it starts but the start notice window, title bar, says Stunnel >>>>>> 5.03 win32 (not configured). It appears that the stunnel service >>>>>> is not >>>>>> reading the stunnel.conf. >>>>>> >>>>>> If anyone has any suggestions how I can successfully run stunnel >>>>>> as a >>>>>> service, I would be very appreciative. >>>>>> >>>>>> Thank you! >>>>>> _______________________________________________ >>>>>> stunnel-users mailing list >>>>>> stunnel-users(a)stunnel.org >>>>>> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >>>>>> >>>>>> _______________________________________________ >>>>>> stunnel-users mailing list >>>>>> stunnel-users(a)stunnel.org >>>>>> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >>>>>> >>>>> >>>>> _______________________________________________ >>>>> stunnel-users mailing list >>>>> stunnel-users(a)stunnel.org >>>>> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >>>> >>> >>> >> >> > >

1 0

Stunnel Windows Server 2008 R2
by 541401＠gmail.com 29 Aug '14

29 Aug '14

I have installed stunnel 5.03 on Windows Server 2008 R2 X64. When I run it as an application it works perfectly. When I install and run the service, it starts but the start notice window, title bar, says Stunnel 5.03 win32 (not configured). It appears that the stunnel service is not reading the stunnel.conf. If anyone has any suggestions how I can successfully run stunnel as a service, I would be very appreciative. Thank you!

5 12

SSL Server Allows Anonymous Authentication Vulnerability
by Michael Curran 25 Aug '14

25 Aug '14

I am looking at this vulnerability reported from McAfee -- but we use stunnel to secure our communications and not the application directly. Are these settings that I can make within the stunnel config -- or something comparable? SSLProtocol -ALL +SSLv3 +TLSv1 SSLCipherSuite ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM

2 2

Odd complication between VM clients, same host
by afpteam＠sbcglobal.net 24 Aug '14

24 Aug '14

Hi, Much appreciation to Stunnel and OpenSSL for a long, successful provision. I can't be sure yet if the concern below is Stunnel or OpenSSL related. I've surfed Google and found nothing similar. Stunnel package with integral OpenSSL is current release. I recently had to secure and connect two public facing client machines on the same Citrix Xen 6.2 release, running Server 2003 x 64 bit. I typically use Stunnel with self generated Pem, for securing short term TightVNC sessions. The config is always fairly generic, loopback allowed, securing across 127.0.0.1 Typically I don't make name references in the .conf profile, just accept / connect on related ports. This is the first time I recall ever pointing two VM's at each other. I have tried both service and gui on both Stunnel and VNC. Tried both application listing and discrete port listing in the server's windows firewall. I have tried updating security to the Admin account as owner or Administrators, in general. I have tried launching either or both as Administrator. When VNC client viewer calls to Server, Stunnel sees the connect, succeeds the Pem and stops. If I restart the stunnel service at the server, the viewer auth dialog suddenly succeeds. I question if this remains secured but clearly isn't practical for application. Both VM's are connected to me via RDP at the time, if this might relate to an Auth violation. I tried multiple VMs to eliminate anything related to a bungled VM config. I'm guessing there is some kind of circular routing restriction possibly. Citrix does use an X-window console to each VM on the control path, but in other instances there's never been any conflict. Not sure how to determine if the issue is config, Stunnel or OpenSSL or how to resolve it. Any suggestions would be appreciated. Regards and thank you again, Mike

1 0

Server side SNI and Windows problem
by Slava 17 Aug '14

17 Aug '14

I'm trying use SNI on Windows (server 2003 R2 or XP) stunnel 5.01 on x86-pc-msvc-1500 platform Compiled/running with OpenSSL 1.0.1g-fips 7 Apr 2014 stunnel.config ... [main] accept = 60000 connect = 10.0.21.1:80 [ssh] connect = 10.0.21.1:22 sni=main:ssh Client has line sni=ssh, but server not see this and attempt connect to :80. I'm try connect from linux and windows, same result For server on linux all work fine. ?

3 4

verify=4
by oweijr oweirj 12 Aug '14

12 Aug '14

Hello, In the stunnel documentation, I see the following: level 4 Ignore CA chain and only verify peer certificate. My interpretation of level 4 was that only the server certificate had to be installed on the client in order for the cert verification to pass. No issuer/CA certificates were needed. However, when I do this, the connection fails. I see this following in the logs with verify=4: 2014.08.12 21:17:57 LOG7[26768]: Starting certificate verification: depth=0, subject=/C=US/CN=a.b.com 2014.08.12 21:17:57 LOG4[26768]: CERT: Verification error: unable to get local issuer certificate 2014.08.12 21:17:57 LOG4[26768]: Certificate check failed: depth=0, subject=/C=US/CN=a.b.com 2014.08.12 21:17:57 LOG7[26768]: SSL alert (write): fatal: unknown CA 2014.08.12 21:17:57 LOG3[26768]: SSL_connect: 14090086: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed My config file contains the following: verify = 4 CAfile = /opt/stunnel/certs/clients.pem chroot = /opt/stunnel setuid = stunnel setgid = stunnel pid = /run/stunnel.pid debug = 7 output = stunnel.log options = NO_SSLv2 cert = /opt/stunnel/certs/server.pem key = /opt/stunnel/certs/server.pem If I append the issuer certificate to the CAfile, after the peer certificate, then the connection is successful with verify=4. Is this expected behavior? Is there a verify level that works as I described above: only the peer certificate needs to be present, no CA/issuer certificates at all? Thank you for your help.

1 0

unable to send SMTP over SSL
by Paul Hargrove 08 Aug '14

08 Aug '14

Hi, I'm a new user using stunnel-5.03 on Windows SBS 2003. I can't send email from Exchange but can from Outlook with same credentials on same network. Email gets stuck in the exchange smtp queue. Simple config: ; * Global options debug = 7 output = stunnel.log engine = capi options = NO_SSLv2 ; * Service definition [SMTP] client = yes accept = 8465 connect = smtp.virginmedia.com:465 protocol = smtp Logs look good but nothing seems to go: 2014.08.08 22:15:07 LOG7[7284]: Dispatching signals from the signal pipe 2014.08.08 22:15:07 LOG7[7284]: Processing SIGNAL_RELOAD_CONFIG 2014.08.08 22:15:07 LOG5[7284]: Reading configuration from file stunnel.conf 2014.08.08 22:15:07 LOG7[7284]: Enabling support for engine 'capi' 2014.08.08 22:15:07 LOG7[7284]: Initializing engine #1 (capi) 2014.08.08 22:15:07 LOG6[7284]: Engine #1 (capi) initialized 2014.08.08 22:15:07 LOG5[7284]: FIPS mode disabled 2014.08.08 22:15:07 LOG7[7284]: Compression disabled 2014.08.08 22:15:07 LOG7[7284]: Snagged 64 random bytes from C:/.rnd 2014.08.08 22:15:07 LOG7[7284]: Wrote 1024 new random bytes to C:/.rnd 2014.08.08 22:15:07 LOG7[7284]: PRNG seeded successfully 2014.08.08 22:15:07 LOG6[7284]: Initializing service [SMTP] 2014.08.08 22:15:08 LOG7[7284]: No private key specified 2014.08.08 22:15:08 LOG7[7284]: SSL options set: 0x01000004 2014.08.08 22:15:08 LOG5[7284]: Configuration successful 2014.08.08 22:15:08 LOG7[7284]: Closing service [SMTP] 2014.08.08 22:15:08 LOG7[7284]: Service [SMTP] closed (FD=292) 2014.08.08 22:15:08 LOG7[7284]: Sessions cached before flush: 7 2014.08.08 22:15:08 LOG7[7284]: Sessions cached after flush: 0 2014.08.08 22:15:08 LOG7[7284]: Service [SMTP] closed 2014.08.08 22:15:08 LOG7[7284]: Service [SMTP] (FD=292) bound to 0.0.0.0:8465 2014.08.08 22:15:08 LOG7[7284]: Signal pipe is empty 2014.08.08 22:16:03 LOG7[7284]: Service [SMTP] accepted (FD=392) from 127.0.0.1:26642 2014.08.08 22:16:03 LOG7[7284]: Creating a new thread 2014.08.08 22:16:03 LOG7[7284]: New thread created 2014.08.08 22:16:03 LOG7[7184]: Service [SMTP] started 2014.08.08 22:16:03 LOG5[7184]: Service [SMTP] accepted connection from 127.0.0.1:26642 2014.08.08 22:16:03 LOG6[7184]: s_connect: connecting 62.254.26.219:465 2014.08.08 22:16:03 LOG7[7184]: s_connect: s_poll_wait 62.254.26.219:465: waiting 10 seconds 2014.08.08 22:16:03 LOG5[7184]: s_connect: connected 62.254.26.219:465 2014.08.08 22:16:03 LOG5[7184]: Service [SMTP] connected remote server from 10.0.0.2:26643 2014.08.08 22:16:03 LOG7[7184]: Remote socket (FD=688) initialized 2014.08.08 22:16:14 LOG3[7184]: fd_getline: Unexpected socket close 2014.08.08 22:16:14 LOG5[7184]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2014.08.08 22:16:14 LOG7[7184]: Remote socket (FD=688) closed 2014.08.08 22:16:14 LOG7[7184]: Local socket (FD=392) closed 2014.08.08 22:16:14 LOG7[7184]: Service [SMTP] finished (0 left) 2014.08.08 22:16:14 LOG7[7184]: str_stats: 3 block(s), 4294966138 data byte(s), 150 control byte(s) 2014.08.08 22:16:14 LOG7[7184]: str_stats: 20 byte(s) at ..\src\network.c:413 2014.08.08 22:16:14 LOG7[7184]: str_stats: 20 byte(s) at ..\src\network.c:412 2014.08.08 22:16:14 LOG7[7184]: str_stats: 20 byte(s) at ..\src\network.c:411 If I rem out the protocol = smtp then the mails go from the queue and the logs seem to indicate a success: 2014.08.08 22:02:14 LOG7[7284]: Service [SMTP] accepted (FD=688) from 127.0.0.1:54520 2014.08.08 22:02:14 LOG7[7284]: Creating a new thread 2014.08.08 22:02:14 LOG7[7284]: New thread created 2014.08.08 22:02:14 LOG7[10072]: Service [SMTP] started 2014.08.08 22:02:14 LOG5[10072]: Service [SMTP] accepted connection from 127.0.0.1:54520 2014.08.08 22:02:14 LOG6[10072]: s_connect: connecting 62.254.26.219:465 2014.08.08 22:02:14 LOG7[10072]: s_connect: s_poll_wait 62.254.26.219:465: waiting 10 seconds 2014.08.08 22:02:14 LOG5[10072]: s_connect: connected 62.254.26.219:465 2014.08.08 22:02:14 LOG5[10072]: Service [SMTP] connected remote server from 10.0.0.2:54521 2014.08.08 22:02:14 LOG7[10072]: Remote socket (FD=456) initialized 2014.08.08 22:02:14 LOG6[10072]: SNI: sending servername: smtp.virginmedia.com 2014.08.08 22:02:14 LOG7[10072]: SSL state (connect): before/connect initialization 2014.08.08 22:02:14 LOG7[10072]: SSL state (connect): SSLv3 write client hello A 2014.08.08 22:02:14 LOG7[10072]: SSL state (connect): SSLv3 read server hello A 2014.08.08 22:02:14 LOG7[10072]: SSL state (connect): SSLv3 read finished A 2014.08.08 22:02:14 LOG7[10072]: SSL state (connect): SSLv3 write change cipher spec A 2014.08.08 22:02:14 LOG7[10072]: SSL state (connect): SSLv3 write finished A 2014.08.08 22:02:14 LOG7[10072]: SSL state (connect): SSLv3 flush data 2014.08.08 22:02:14 LOG7[10072]: 6 items in the session cache 2014.08.08 22:02:14 LOG7[10072]: 13 client connects (SSL_connect()) 2014.08.08 22:02:14 LOG7[10072]: 13 client connects that finished 2014.08.08 22:02:14 LOG7[10072]: 0 client renegotiations requested 2014.08.08 22:02:14 LOG7[10072]: 0 server connects (SSL_accept()) 2014.08.08 22:02:14 LOG7[10072]: 0 server connects that finished 2014.08.08 22:02:14 LOG7[10072]: 0 server renegotiations requested 2014.08.08 22:02:14 LOG7[10072]: 7 session cache hits 2014.08.08 22:02:14 LOG7[10072]: 0 external session cache hits 2014.08.08 22:02:14 LOG7[10072]: 0 session cache misses 2014.08.08 22:02:14 LOG7[10072]: 0 session cache timeouts 2014.08.08 22:02:14 LOG6[10072]: SSL connected: previous session reused 2014.08.08 22:02:16 LOG6[10072]: Read socket closed (readsocket) 2014.08.08 22:02:16 LOG7[10072]: Sending close_notify alert 2014.08.08 22:02:16 LOG7[10072]: SSL alert (write): warning: close notify 2014.08.08 22:02:16 LOG6[10072]: SSL_shutdown successfully sent close_notify alert 2014.08.08 22:02:16 LOG6[10072]: SSL socket closed (SSL_read) 2014.08.08 22:02:16 LOG7[10072]: Sent socket write shutdown 2014.08.08 22:02:16 LOG5[10072]: Connection closed: 80 byte(s) sent to SSL, 298 byte(s) sent to socket 2014.08.08 22:02:16 LOG7[10072]: Remote socket (FD=456) closed 2014.08.08 22:02:16 LOG7[10072]: Local socket (FD=688) closed 2014.08.08 22:02:16 LOG7[10072]: Service [SMTP] finished (0 left) 2014.08.08 22:02:16 LOG7[10072]: str_stats: 3 block(s), 4294963672 data byte(s), 150 control byte(s) 2014.08.08 22:02:16 LOG7[10072]: str_stats: 20 byte(s) at ..\src\network.c:413 2014.08.08 22:02:16 LOG7[10072]: str_stats: 20 byte(s) at ..\src\network.c:412 2014.08.08 22:02:16 LOG7[10072]: str_stats: 20 byte(s) at ..\src\network.c:411 but all Mails bounce with: There was a SMTP communication problem with the recipient's email server. Please contact your system administrator. <server.domain.local #5.5.0 smtp;530 Authentication Required (VM401)> Any ideas?

1 0

Re: [stunnel-users] stunnel 5.03 released
by Michal Trojnara 08 Aug '14

08 Aug '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Peter Pentchev wrote: > Um, there's just one little problem with this; what do you think > about the attached public-domain patch that removes what looks very > much like a stray quote character? Argh! Thank you. Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlPlP0MACgkQ/NU+nXTHMtG61QCgrh8w889DGai/Xbc7y42vTkQ/ /BQAnRsl60djjKX2O3PJWzRrVkLXDnEt =yKfI -----END PGP SIGNATURE-----

1 0

Re: [stunnel-users] stunnel 5.03 released
by Peter Pentchev 08 Aug '14

08 Aug '14

On Thu, Aug 07, 2014 at 10:15:47PM +0200, Michal Trojnara wrote: > Dear Users, > > I have released version 5.03 of stunnel. Hi, (-announce and openssl-users dropped from CC) Thanks a lot - and thanks for saving downstream distro maintainers the trouble of releasing an intermediate package update for the init script fix ;) > > The ChangeLog entry: [snip] > * Bugfixes [snip] > - Fixed whitespace handling in the stunnel.init script. Um, there's just one little problem with this; what do you think about the attached public-domain patch that removes what looks very much like a stray quote character? Once again, thanks for writing and maintaining stunnel! G'luck, Peter PS. I tried to send this from my <roam(a)ringlet.net> address, but mx1.mirt.net bounced my message due to a junkemailfilter.com blacklist problem that I've taken up with the folks over there (at junkemailfilter.com, not mirt.net, obviously ;) -- Peter Pentchev roam(a)ringlet.net roam(a)FreeBSD.org p.penchev(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

1 0

Windows Certificate Store
by j nasty 07 Aug '14

07 Aug '14

I haven't been able to get a definitive answer and can't find the information I need through traditional searching around. Anyways, is it possible to have sTunnel access the Windows certificate store to get the certificate that will be used for client authentication? If so, how can this be configured in sTunnel's configuration file? Or can you at least point me in the direction I can find the information I'm looking for? Many thanks in advance everyone!

2 1

stunnel 5.03 released
by Michal Trojnara 07 Aug '14

07 Aug '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.03 of stunnel. The ChangeLog entry: Version 5.03, 2014.08.07, urgency: HIGH: * Security bugfixes - OpenSSL DLLs updated to version 1.0.1i. See https://www.openssl.org/news/secadv_20140806.txt * New features - FIPS autoconfiguration cleanup. - FIPS canister updated to version 2.0.6. - Improved SNI diagnostic logging. * Bugfixes - Compilation fixes for old versions of OpenSSL. - Fixed whitespace handling in the stunnel.init script. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 5e8196f913bf7460082c1c7e5d436fbfba7f65d56c60065e6ccf0df9057294ef stunnel-5.03-android.zip 803bc85fbc80f22d71b13d4180e2d51c02586b2cc611169961a2745e47e31c4f stunnel-5.03-installer.exe 9a1e369466fa756e6f48b11480a3338c1fa4717e6472871bf4a3a96c483edd03 stunnel-5.03.tar.gz Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlPj3nMACgkQ/NU+nXTHMtGM3ACfdFm7k754Pzo1rhDkVb6rT5nO EEUAoJoSXbRPHu3jphxXYVA5SeJ05BXj =tFws -----END PGP SIGNATURE-----

1 0

Re: [stunnel-users] cert verification problem
by n n 07 Aug '14

07 Aug '14

Hi! I want to authenticate server, using valid cert from StartSSL, and I receive error: ## sie 07 16:24:17 yabba stunnel[4247]: LOG4[5495]: CERT: Verification error: unable to get local issuer certificate sie 07 16:24:17 yabba stunnel[4247]: LOG4[5495]: Certificate check failed: depth=1, subject=/C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Class 1 Primary Intermediate Server CA sie 07 16:24:17 yabba stunnel[4247]: LOG3[5495]: SSL_connect: 14090086: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed sie 07 16:24:17 yabba stunnel[4247]: LOG5[5495]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket ## I don't know what's wrong. There is server's config: ## chroot = /var/run/stunnel/ pid=/stunnel.pid setuid = nobody setgid = nobody [squid] accept = 80 connect = 127.0.0.1:3128 verify=0 ## Client's config: ## client = yes [proxy] accept = 127.0.0.1:8005 connect = server:80 ##

1 0

Possible false positive trojan detection on stunnel-5.02-installer.exe
by Drew Mayo 06 Aug '14

06 Aug '14

Hi all, This is just an FYI. I'm a recent user of stunnel, and one of my team has just alerted me that f-prot (and unfortunately hence google drive) detects the current windows installer for stunnel 5.02 as a trojan. virustotal (which confirms it matches the sha256) tells me that the file is detected as: W32/Trojan.TDWH-2255 W32/Trojan3.JUA I've raised a misclassification request with f-prot, but of course that will probably take some time to get resolved. Of course, it is remotely possible it's not false, but i'm betting the other way. -d

2 2

More peer cert info export, new verify option
by Michal Vaško 05 Aug '14

05 Aug '14

Hello, for our current use-case we needed to add functionality to stunnel and therefore have made few patches. We distribute these patches with our software and were wondering what do you think about including them directly in stunnel. Firstly, we need peer certificate fingerprints in MD5, SHA1, SHA224, SHA256, SHA384 and SHA512. Patched stunnel exports all these in separate variables "SSL_CLIENT_*". Secondly, we could need subjectAltName values. Patched stunnel exports these in "SSL_CLIENT_SAN", but only rfc822Name, iPAddress and dNSName as we need only these. It could easily be expanded to all the values. Lastly, we required verification as if we first used verify = 2 and after failing trying verify = 4 (verify = 3 is technically verify = 2 AND verify = 4, if I am not wrong, and we need verify = 2 OR verify = 4). For this purpose my patch adds new verify = 5 option. I want to say that we did not just make all these requirements up, but we want to conform to RFCs describing NETCONF over TLS and its configuration. All the patches are included so you can go through them. Thank you. Kind regards, Michal Vasko

1 0

Re: [stunnel-users] FIPS compliant Stunnel build
by Michael Curran 24 Jul '14

24 Jul '14

I have already requested the CD of software from OpenSSL -- that section does not really assist with the build functions. The FIPSDIR= option still did not allow Stunnel to autodiscover FIPS.h -- this is my openssl1.0.1h configure command openssl-fips-2.0.7 ./config ; make ; make install openssl-1.0.1h./config fips --openssldir=/usr/local/openssl-100 --with-fipslibdir=/usr/local/ssl/fips-2.0/lib --with-fipsdir=/usr/local/ssl/fips-2.0/ ; make depend ; make ; make test ; make install Stunnel5.02 I am not installling the newer copy of openssl to the rest of the system, just as libraries accessible to Stunnel for building with a version that is different than the OS installed openssl so as not to risk breaking ssh or OS Upgrade capabilities ./configure --with-ssl=/usr/local/openssl-100 --disable-libwrap ; make ; make install During the Make phase it just says it cannot find fips.h but it says fips enabled -- but when I tell it to use FIPS I get checking whether to enable FIPS mode support... yesconfigure: **************************************** SSLchecking for SSL directory... /usr/local/openssl-100checking /usr/local/openssl-100/include/openssl/engine.h usability... yeschecking /usr/local/openssl-100/include/openssl/engine.h presence... yeschecking for /usr/local/openssl-100/include/openssl/engine.h... yeschecking /usr/local/openssl-100/include/openssl/ocsp.h usability... yeschecking /usr/local/openssl-100/include/openssl/ocsp.h presence... yeschecking for /usr/local/openssl-100/include/openssl/ocsp.h... yeschecking /usr/local/openssl-100/include/openssl/fips.h usability... nochecking /usr/local/openssl-100/include/openssl/fips.h presence... nochecking for /usr/local/openssl-100/include/openssl/fips.h... noconfigure: WARNING: OpenSSL fips header not foundconfigure: **************************************** write the resultsconfigure: creating ./config.status Restarting Stunnel with fips=yes gives me this [!] FIPS_mode_set: F06D065: error:0F06D065:common libcrypto routines:FIPS_mode_set:fips mode not supported[!] Line 35: "[webapp]": Failed to initialize SSL The TODO file in Stunnel5.02 tarball has this * Support static FIPS-enabled build. Does this mean that it can only currently support a system that is fully fips enabled and not my static libraries that I use for building Stunnel? Thats what I get out of this. And upon further reading of the INSTALL.FIPS file I confirm this Unix HOWTO:* Only dynamic linking of the FIPS-enabled OpenSSL is currently supported, i.e. FIPS-enabled OpenSSL has to be configured with "shared" parameter. I cannot install it with dynamic libraries as I am required to build via the actual instructions for FIPS 140-2 compliance which implicitly states I cannot call out shared as part of the config options. Mike Curran From: mike_curran(a)hotmail.com To: nobody(a)dizum.com Subject: RE: FIPS compliant Stunnel build Date: Wed, 23 Jul 2014 17:34:08 -0500 I have already requested the CD of software from OpenSSL -- that section does not really assist with the build functions. The FIPSDIR= option still did not allow Stunnel to autodiscover FIPS.h -- this is my openssl1.0.1h configure command openssl-fips-2.0.7 ./config ; make ; make install openssl-1.0.1h./config fips --openssldir=/usr/local/openssl-100 --with-fipslibdir=/usr/local/ssl/fips-2.0/lib --with-fipsdir=/usr/local/ssl/fips-2.0/ ; make depend ; make ; make test ; make install Stunnel5.02 I am not installling the newer copy of openssl to the rest of the system, just as libraries accessible to Stunnel for building with a version that is different than the OS installed openssl so as not to risk breaking ssh or OS Upgrade capabilities ./configure --with-ssl=/usr/local/openssl-100 --disable-libwrap ; make ; make install During the Make phase it just says it cannot find fips.h but it says fips enabled -- but when I tell it to use FIPS I get checking whether to enable FIPS mode support... yesconfigure: **************************************** SSLchecking for SSL directory... /usr/local/openssl-100checking /usr/local/openssl-100/include/openssl/engine.h usability... yeschecking /usr/local/openssl-100/include/openssl/engine.h presence... yeschecking for /usr/local/openssl-100/include/openssl/engine.h... yeschecking /usr/local/openssl-100/include/openssl/ocsp.h usability... yeschecking /usr/local/openssl-100/include/openssl/ocsp.h presence... yeschecking for /usr/local/openssl-100/include/openssl/ocsp.h... yeschecking /usr/local/openssl-100/include/openssl/fips.h usability... nochecking /usr/local/openssl-100/include/openssl/fips.h presence... nochecking for /usr/local/openssl-100/include/openssl/fips.h... noconfigure: WARNING: OpenSSL fips header not foundconfigure: **************************************** write the resultsconfigure: creating ./config.status Restarting Stunnel with fips=yes gives me this [!] FIPS_mode_set: F06D065: error:0F06D065:common libcrypto routines:FIPS_mode_set:fips mode not supported[!] Line 35: "[webapp]": Failed to initialize SSL The TODO file in Stunnel5.02 tarball has this * Support static FIPS-enabled build. Does this mean that it can only currently support a system that is fully fips enabled and not my static libraries that I use for building Stunnel? Thats what I get out of this. Mike Curran > From: nobody(a)dizum.com > To: mike_curran(a)hotmail.com > Subject: Re: FIPS compliant Stunnel build > Date: Thu, 24 Jul 2014 00:00:37 +0200 > > it IS possible... > > use FIPSDIR environment variable -- > NOT any change to FIPS Object Module ./config command > > BUT most important see: > > 6.6 The "Secure Installation" Issue > > of > > User Guide for the OpenSSL FIPS Object Module v2.0 > (including v2.0.1, v2.0.2, v2.0.3, v2.0.4, v2.0.5, v2.0.6, v2.0.7) >

2 1

OpenVPN over stunnel
by Derek Cole 24 Jul '14

24 Jul '14

Hello, I am doing something similar to what is happening in this scenario: http://kyl191.net/2012/12/tunneling-openvpn-through-stunnel/ That is, I have set my openvpn client configuration to be "remote localhost port" where port is the port my stunnel client is listening on the same box as my openvpn client. This seems to work - I get connected to OpenVPN server fine, however, I don't seem to be able to ping the openvpn server by either of it's public or private ip addresses. In fact, it seems like when I do a tcpdump on the stunnel server, I don't see any incoming traffic on port 443. How is it possible that I am getting the VPN connection, but then the rest of the traffic just sort of stops going through stunnel? My stunnel client service looks like the following: [openvpn] accept = 127.0.0.1:5150 connect = stunnelserver:443 and my stunnel server looks like: [ovpnout] cert = mycert.pem accept = 443 connect = openvpn server Any ideas?

2 3

FIPS compliant Stunnel build
by Michael Curran 23 Jul '14

23 Jul '14

Hello -- Is Stunnel (any version) compatible with Fips-2.0 for compliance? I have found one individuals instructions for compiling fips-2.0.5 , but he calls out a prefix= in his configure for FIPS which breaks 140-2 compliance rules and makes the build no longer viable >From the Fips-2.0 userguide "Note that as a condition of the FIPS 140-2 validation no other user specified configuration optionsmay be specified. This restriction means that an optional install prefix cannot be specified –however, there is no restriction on subsequent manual relocation of the generated files to thedesired final location." I know that Stunnel compiles just fine with OpenSSL1.0.1 versions, but there appears to have been a difference in the method of validation and installation of FIPS modules into a seperate modular directory, and is not located in the openssl/include files after build now The stunnel configure script only looks for fips-1.0 as well , so my base assumption is might not be capable of handling FIPS-2.0 at this time.

1 0

CApath not working anymore
by Jordan Paschalidis 17 Jul '14

17 Jul '14

Hello, i have an existing stunnel-installation with CApath. I tried to setup a new stunnel-version, and copied all certifictes and had allwas an error like 2014.07.16 09:50:36 LOG7[15937:0]: Starting certificate verification: depth=1, /C=DE/emailAddress=ssladmin(a)v.de 2014.07.16 09:50:36 LOG4[15937:0]: CERT: Verification error: self signed certificate in certificate chain 2014.07.16 09:50:36 LOG4[15937:0]: Certificate check failed: depth=1, /C=DE/emailAddress=ssladmin(a)v.de 2014.07.16 09:50:36 LOG7[15937:0]: SSL alert (write): fatal: bad certificate 2014.07.16 09:50:36 LOG3[15937:0]: SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned 2014.07.16 09:50:36 LOG5[15937:0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket i had an hard time to find out that CApath is not working anymore. I put for test all certificates into a file and used CAfile and immediately the connection was established. Does somebody know why CApath is not working anymore? Tested with stunnel 5.02, 4.56, 4.55, 4.54 cheers, jordan

2 2

telnet-ssl protocol?
by Edoardo Spadolini 11 Jul '14

11 Jul '14

I'm disappointed by the lack of customization available in telnetd-ssl, so I wanted to add a "telnet-ssl" protocol to stunnel. Can anyone give me some pointers on how to go about doing that? Kerio

1 0

Question in using stunnel
by Sara Baghbanzadeh 02 Jul '14

02 Jul '14

Hi there, I have a proxy (PHP file) which I want it to work as a server for me. I have PhantomJS as my client which loads particular url and instead of sending its requests to the main server it will send them to my proxy. I am going to send it back its responses. I have no problem when the website is based on HTTP. But, since my proxy cannot deal with SSL, I have problem with HTTPS websites. Actually, I have a database contains all the requests and responses which I captured by Fiddler. I use this database when I want to send a response to PhantomJS. Now, I cannot fill out my database since I cannot capture completely decrypted traffic using none of existing tools. Also I need to receive decrypted request from PhantomJS! Therefore, I decided to use stunnel for solving my problem. I am going to use it in order to decrypt all the requests from PhantomJS, and then, send them to my proxy, and also encrypt all my responses, before sending back to PhantomJS. I have installed latest version of stunnel on my Ubuntu machine and have generated a config file. I could not solve my problem using stunnel so far and my question is: Can stunnel solve my problem? I mean, can I use stunnel in order to decrypt PhantomJS's requests and encrypt my responses? ... If yes, could you please tell me how? Thank you so much and I am eagerly waiting to receive your response. Thanks in advance, Best regards, Sara

1 0

Re: [stunnel-users] OpenSSL FIPS header not found - version 5.02
by Hui Yu 26 Jun '14

26 Jun '14

No, you don't need to do "make depend". Just follow my exact steps, it is enough to compile a FIPS enabled stunnel. I did it on the 64 bits centos linux (linux-x86_64) and redhat linux (linux-generic32) , so that is probably the only change you need. Good luck.

2 1

Re: [stunnel-users] OpenSSL FIPS header not found - version 5.02
by Hui Yu 26 Jun '14

26 Jun '14

You need to follow these steps: 1.1.1 Build openssl-fips package >From https://www.openssl.org/source/, download latest openssl-fips package and unzip under tar -zxvf openssl-fips-2.0.5.tar.gz<https://www.openssl.org/source/openssl-fips-2.0.5.tar.gz> cd /home/user/openssl-fips-2.0.5 /Configure --prefix=/usr/local linux-generic32 make make install 1.1.2 Build FIPS capable openssl package >From https://www.openssl.org/source/, download latest openssl package and unzip under tar -zxvf openssl-1.0.1h.tar.gz<https://www.openssl.org/source/openssl-1.0.1h.tar.gz> Cd /home/user/openssl-1.0.1h ./Configure --prefix=/usr/local --with-fipsdir=/usr/local fips linux-generic32 make CC=fipsld FIPSLD_CC=gcc -j 8 make install the binary openssl can be found at /usr/local/bin/openssl [root@ssl86 hyu]# openssl version OpenSSL 1.0.1h-fips 5 Jun 2014 #######here is tricky, go back to FIPS directory make install again. cd /home/user/openssl-fips-2.0.5 make install 1.1.3 Build stunnel package >From https://www.stunnel.org/downloads.html, Download latest stunnel version 5.02 package and unzip under tar -zxvf stunnel-5.02.tar.gz<https://www.stunnel.org/downloads/stunnel-5.02.tar.gz> cd /home/user/stunnel-5.02 ./configure --enable-fips --with-ssl=/usr/local/ --prefix=/usr/local make CC=fipsld FIPSLD_CC=gcc -j 8 make install the stunnel binary can be found at /usr/local/bin/stunnel

2 1

(no subject)
by Paulraj Samikannu 25 Jun '14

25 Jun '14

I see the following messages on the production server, any special log setting requirement or is our stunnel generating too many messages too fast? Jun 25 06:13:35 pprccmfaap001 rsyslogd-2177: imuxsock begins to drop messages from pid 171059 due to rate-limiting Jun 25 06:15:34 pprccmfaap001 rsyslogd-2177: imuxsock lost 47 messages from pid 171059 due to rate-limiting Jun 25 06:15:36 pprccmfaap001 rsyslogd-2177: imuxsock begins to drop messages from pid 171059 due to rate-limiting

4 6

public domain [PATCH] to stunnel v456 to clear SSL_OP_LEGACY_SERVER_CONNECT
by Simner, John 25 Jun '14

25 Jun '14

Dear Michal, Dear All, Please find attached a patch to stunnel 4.56 to clear SSL_OP_LEGACY_SERVER_CONNECT. There was a security requirement to ensure that the stunnel client could not connect to unpatched servers. I am aware from OpenSSL (https://www.openssl.org/docs/ssl/SSL_CTX_set_options.html ) that this parameter is currently set by default and has to be manually cleared by calling SSL_CTX_clear_options() or SSL_clear_options()if an OpenSSL client applications wants to ensure they can not connect to unpatched servers (and thus avoid any security issues). The attached patch achieves this. OpenSSL also state "As more servers become patched the option SSL_OP_LEGACY_SERVER_CONNECT will not be set by default in a future version of OpenSSL" so this patch is only required until OpenSSL change the default value. Thanks.. John [Unify: Harmonize your enterprise] John Simner BSc(Hons) MSc CEng. MIET Software Engineer, Devices Development Unify Enterprise Communications Ltd. Tel.: +44 (1908) 817378 (One Number Service) Email: john.simner(a)unify.com <mailto:vorname.name@unify.com> www.unify.co.uk<http://www.unify.co.uk/> Follow us: [Social_media_icons] <http://www.unify.com/social-media> Unify Enterprise Communications Limited. Registered Office: Brickhill Street, Willen Lake, Milton Keynes, MK15 0DJ Registered No: 5903714, England. This email contains confidential information and is for the exclusive use of the addressee. If you are not the addressee then any distribution, copying, or use of this email is prohibited. If received in error, please advise the sender and delete immediately. We accept no liability for any loss or damage suffered by any person arising from use of this email.

1 0

Can not get TLS1.2 work in FIPS mode.
by Hui Yu 19 Jun '14

19 Jun '14

Hi all: Base on this link https://www.stunnel.org/sdf_ChangeLog.html, to make TLS 1.2 work, I need to put stunnel in FIPS enable mode. In stunnel config file, I have following to enable FIPS mode and select TLS 1.2. sslVersion=TLSv1.2 FIPS = yes But when my TLS 1.2 client send "client hello" with version TLS 1.2 to stunnel, stunnel still send "server hello" with TLS 1.0 back. Could somebody help on why stunnel does not support TLS 1.2 ? My stunnel is verstion 5.02, compiled with latest OpenSSL version 1.0.1h FIPS mode library. Following is the log file: ################### 2014.06.19 11:09:13 LOG7[15491]: Clients allowed=500 2014.06.19 11:09:13 LOG5[15491]: stunnel 5.02 on i686-pc-linux-gnu platform 2014.06.19 11:09:13 LOG5[15491]: Compiled with OpenSSL 1.1.0-fips-dev xx XXX xxxx 2014.06.19 11:09:13 LOG5[15491]: Running with OpenSSL 1.0.1h-fips 5 Jun 2014 2014.06.19 11:09:13 LOG5[15491]: Update OpenSSL shared libraries or rebuild stunnel 2014.06.19 11:09:13 LOG5[15491]: Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Auth:LIBWRAP 2014.06.19 11:09:13 LOG7[15491]: errno: (*__errno_location ()) 2014.06.19 11:09:13 LOG5[15491]: Reading configuration from file stunnel.K.tacacs+.conf 2014.06.19 11:09:13 LOG5[15491]: FIPS mode enabled ##################FIPS mode enabled############ 2014.06.19 11:09:13 LOG7[15491]: Compression disabled 2014.06.19 11:09:13 LOG7[15491]: Snagged 64 random bytes from /root/.rnd 2014.06.19 11:09:13 LOG7[15491]: Wrote 1024 new random bytes to /root/.rnd 2014.06.19 11:09:13 LOG7[15491]: PRNG seeded successfully 2014.06.19 11:09:13 LOG6[15491]: Initializing service [encrypted_tacplus] 2014.06.19 11:09:13 LOG6[15491]: Loading cert from file: /tftpboot/cacert-hyu.pem 2014.06.19 11:09:13 LOG6[15491]: Loading key from file: /tftpboot/privkey-hyu.pem 2014.06.19 11:09:13 LOG4[15491]: Insecure file permissions on /tftpboot/privkey-hyu.pem 2014.06.19 11:09:13 LOG7[15491]: Private key check succeeded 2014.06.19 11:09:13 LOG7[15491]: DH initialization 2014.06.19 11:09:13 LOG7[15491]: Could not load DH parameters from /tftpboot/cacert-hyu.pem 2014.06.19 11:09:13 LOG7[15491]: Using hardcoded DH parameters 2014.06.19 11:09:13 LOG7[15491]: DH initialized with 2048-bit key 2014.06.19 11:09:13 LOG7[15491]: ECDH initialization 2014.06.19 11:09:13 LOG7[15491]: ECDH initialized with curve prime256v1 2014.06.19 11:09:13 LOG7[15491]: SSL options set: 0x00000004 2014.06.19 11:09:13 LOG5[15491]: Configuration successful 2014.06.19 11:09:13 LOG7[15491]: Service [encrypted_tacplus] (FD=7) bound to 0.0.0.0:2249 2014.06.19 11:09:14 LOG7[15491]: No pid file being created 2014.06.19 11:17:52 LOG7[15506]: Service [encrypted_tacplus] accepted (FD=3) from 10.25.105.82:636 2014.06.19 11:17:52 LOG7[15509]: Service [encrypted_tacplus] started 2014.06.19 11:17:52 LOG5[15509]: Service [encrypted_tacplus] accepted connection from 10.25.105.82:636 2014.06.19 11:17:52 LOG7[15509]: SSL state (accept): before/accept initialization 2014.06.19 11:17:52 LOG7[15509]: SNI: no virtual services defined 2014.06.19 11:17:52 LOG7[15509]: SSL state (accept): SSLv3 read client hello B ##########wireshark shows "client hello" version is TLS1.2, stunnel log shows it is TLS1.0. 2014.06.19 11:17:52 LOG7[15509]: SSL state (accept): SSLv3 write server hello A 2014.06.19 11:17:52 LOG7[15509]: SSL state (accept): SSLv3 write certificate A 2014.06.19 11:17:52 LOG7[15509]: SSL state (accept): SSLv3 write key exchange A 2014.06.19 11:17:52 LOG7[15509]: SSL state (accept): SSLv3 write server done A 2014.06.19 11:17:52 LOG7[15509]: SSL state (accept): SSLv3 flush data 2014.06.19 11:17:55 LOG7[15509]: SSL state (accept): SSLv3 read client key exchange A 2014.06.19 11:17:55 LOG7[15509]: SSL state (accept): SSLv3 read finished A 2014.06.19 11:17:55 LOG7[15509]: SSL state (accept): SSLv3 write change cipher spec A 2014.06.19 11:17:55 LOG7[15509]: SSL state (accept): SSLv3 write finished A 2014.06.19 11:17:55 LOG7[15509]: SSL state (accept): SSLv3 flush data 2014.06.19 11:17:55 LOG7[15509]: 1 items in the session cache 2014.06.19 11:17:55 LOG7[15509]: 0 client connects (SSL_connect()) 2014.06.19 11:17:55 LOG7[15509]: 0 client connects that finished 2014.06.19 11:17:55 LOG7[15509]: 0 client renegotiations requested 2014.06.19 11:17:55 LOG7[15509]: 1 server connects (SSL_accept()) 2014.06.19 11:17:55 LOG7[15509]: 1 server connects that finished 2014.06.19 11:17:55 LOG7[15509]: 0 server renegotiations requested 2014.06.19 11:17:55 LOG7[15509]: 0 session cache hits 2014.06.19 11:17:55 LOG7[15509]: 0 external session cache hits 2014.06.19 11:17:55 LOG7[15509]: 1 session cache misses 2014.06.19 11:17:55 LOG7[15509]: 0 session cache timeouts 2014.06.19 11:17:55 LOG6[15509]: No peer certificate received 2014.06.19 11:17:55 LOG6[15509]: SSL accepted: new session negotiated 2014.06.19 11:17:55 LOG6[15509]: Negotiated TLSv1/SSLv3 ciphersuite: DHE-RSA-AES128-SHA (128-bit encryption) ##############negotiated as TLS1.0 2014.06.19 11:17:55 LOG6[15509]: Compression: null, expansion: null 2014.06.19 11:17:55 LOG6[15509]: s_connect: connecting 127.0.0.1:2250 2014.06.19 11:17:55 LOG7[15509]: s_connect: s_poll_wait 127.0.0.1:2250: waiting 10 seconds 2014.06.19 11:17:55 LOG5[15509]: s_connect: connected 127.0.0.1:2250 2014.06.19 11:17:55 LOG5[15509]: Service [encrypted_tacplus] connected remote server from 127.0.0.1:47369 2014.06.19 11:17:55 LOG7[15509]: Remote socket (FD=8) initialized

1 0

Configure stunnel to clear SSL_OP_LEGACY_SERVER_CONNECT to prevent connections to unpatched servers.
by Simner, John 19 Jun '14

19 Jun '14

Hi, I have a requirement for a stunnel client built with openSSL 0.9.8y to not connect to unpatched servers. I know this is a simple matter of using SSL_CTX_clear_options(ctx, SSL_OP_LEGACY_SERVER_CONNECT); Is there any way of configuring stunnel to clear this option? If this is the wrong approach, how can I prevent stunnel connecting to unpatched servers? Thank you for your assistance and look forward to your response. John Simner [Unify: Harmonize your enterprise] John Simner BSc(Hons) MSc CEng. MIET Software Engineer, Devices Development Unify Enterprise Communications Ltd. Tel.: +44 (1908) 817378 (One Number Service) Email: john.simner(a)unify.com <mailto:vorname.name@unify.com> www.unify.co.uk<http://www.unify.co.uk/> Follow us: [Social_media_icons] <http://www.unify.com/social-media> Unify Enterprise Communications Limited. Registered Office: Brickhill Street, Willen Lake, Milton Keynes, MK15 0DJ Registered No: 5903714, England. This email contains confidential information and is for the exclusive use of the addressee. If you are not the addressee then any distribution, copying, or use of this email is prohibited. If received in error, please advise the sender and delete immediately. We accept no liability for any loss or damage suffered by any person arising from use of this email.

1 0

Re: [stunnel-users] Trouble wrapping samba SWAT...
by Ludolf Holzheid 17 Jun '14

17 Jun '14

On Mon, 2014-06-16 12:53:36 +0200, Marco Gaiarin wrote: > > [..] > > and in /etc/stunnel/swat.conf.inetd: > > cert = /etc/ssl/certs/LNFFVGNobel.pem > key = /etc/ssl/private/LNFFVGNobel.pem > CAfile = /etc/ssl/certs/LNFFVG.pem > > service = swat > exec = /usr/sbin/swat > execargs = swat -P > > [..] > > the only thing i suppose is that for some reason stunnel4, run by root > in inetd, then switch to an unprivileged user before running swat, > preventing access to /var/lib/samba/secrets.tdb . Marco, I don't think stunnel changes the user ID without a 'setuid = ' statement in the configuration file (as it does not know which user ID to switch to). Are you sure, swat isn't changing the user ID? Does it work without being wrapped by stunnel? Ludolf -- Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:lholzheid@bihl-wiedemann.de http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

2 1

OpenSSL tips header not found - version 5.02
by James Brown 17 Jun '14

17 Jun '14

I’ve installed OpenSSL 1.0.1h (using "./configure darwin64-x86_64-cc”) and now when I go to upgrade stunned from 4.56 to 5.02, configure gives me: checking whether to enable FIPS mode support... autodetecting configure: **************************************** SSL checking for SSL directory... /usr/local/ssl checking /usr/local/ssl/include/openssl/engine.h usability... yes checking /usr/local/ssl/include/openssl/engine.h presence... yes checking for /usr/local/ssl/include/openssl/engine.h... yes checking /usr/local/ssl/include/openssl/ocsp.h usability... yes checking /usr/local/ssl/include/openssl/ocsp.h presence... yes checking for /usr/local/ssl/include/openssl/ocsp.h... yes checking /usr/local/ssl/include/openssl/fips.h usability... no checking /usr/local/ssl/include/openssl/fips.h presence... no checking for /usr/local/ssl/include/openssl/fips.h... no configure: WARNING: OpenSSL fips header not found checking for FIPS_mode_set... yes configure: FIPS mode detected Do I need to worry about the tips header not being found? Is there anything I should do to fix this? (Running on a Mac OS X 10.7.5 machine). Thanks, James.

1 1

Client SSL certificate
by reg14＠rambler.ru 13 Jun '14

13 Jun '14

If a client application is behind NAT, it does not have a real IP address. Certificate field 'common name' is supposed to contain a fully qualified domain name or a real IP address. Could the value of this field be ignored on SSL verification?

2 3

Using SNI in stunnel server
by Derek Cole 13 Jun '14

13 Jun '14

Hello, I have the following config on my stunnel server: Dereks-MacBook-Pro:server derek$ cat server.conf ;setuid = stunnel setgid = nogroup foreground = yes pid = /etc/stunnel/stunnel.pid debug = 7 output = /etc/stunnel/stunnel.log options = NO_SSLv2 verify = 3 fips=no CAfile=/Users/derek/cert_attempts/root_certs/cacert.pem CApath=/Users/derek/cert_attempts/server/trusted/ [https] cert = /Users/derek/cert_attempts/server/domain.local.pem accept = 443 connect = 80 ;connect is the far-end openvpn connection [exit1] sni = https:exit1.domain.local cert = /Users/derek/cert_attempts/server/exit1.domain.local.pem connect=ovpn1:16081 [exit2] sni = https:exit2.domain.local cert=/Users/derek/cert_attempts/server/exit2.domain.local.pem connect=ovpn2:1195 I am trying to test whether this is working by using openssl s_client with something similar to the following: openssl s_client -connect 10.22.1.219:443 -cert ./server/domain.local.pem -servername exit2.domain.local Maybe I misunderstand - but why do I have to specify -servername there? I thought that if I specified -cert and it matched any of the cert= in my services that are in my stunnel configuration, it would automatically know to do that connect? It seems like if I level off -servername entirely, it always defaults to https no matter what cert I specify, and if I do have -servername, it always goes to that SNI regardless of what cert I use (or whether that cert is even valid). All three of these .pem files were generated and signed by the same CA that I created, and they all contain the public and private key. What am I doing wrong here? Thanks

2 1

Re: [stunnel-users] [patch] Systemd socket activation support in daemon mode
by Mark Theunissen 10 Jun '14

10 Jun '14

Hi all, Is there any chance of this functionality getting in upstream? Mark

2 1

Expired Certificate
by Andrew Smith 09 Jun '14

09 Jun '14

I am pretty new to Stunnel as I have inherited the project at my company. Yesterday the certificate expired on our Windows Server 2008 for Stunnel. What are the steps to renew this certificate? ________________________________ Andrew Smith Support Technical Services Analyst P: 614-875-4910 x109 F: 614-875-4088 E: andrew.smith(a)harriscomputer.com [http://www.harriscomputer.com/images/signatures/HarrisSchools.jpg] [http://www.harriscomputer.com/images/signatures/DivisionofHarris.gif]<http://www.harriscomputer.com/> 6110 Enterprise Parkway Grove City, OH 43123 www.harris-schoolsolutions.com<http://www.harris-schoolsolutions.com> This message is intended exclusively for the individual or entity to which it is addressed. This communication may contain information that is proprietary, privileged or confidential or otherwise legally exempt from disclosure. If you are not the named addressee, you are not authorized to read, print, retain, copy or disseminate this message or any part of it. If you have received this message in error, please notify the sender immediately by e-mail and delete all copies of the message.

2 1

none cipher
by Mark Sullivan 09 Jun '14

09 Jun '14

How can I use the none cipher with SSL? which ciphers allow for the best throughput?

2 1

stunnel 5.02 released
by Michal Trojnara 09 Jun '14

09 Jun '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.02 of stunnel. The ChangeLog entry: Version 5.02, 2014.06.09, urgency: HIGH: * Security bugfixes - OpenSSL DLLs updated to version 1.0.1h. See http://www.openssl.org/news/secadv_20140605.txt * New features - Major rewrite of the protocol.c interface: it is now possible to add protocol negotiations at multiple connection phases, protocols can individually decide whether the remote connection will be established before or after SSL/TLS is negotiated. - Heap memory blocks are wiped before release. This only works for block allocated by stunnel, and not by OpenSSL or other libraries. - The safe_memcmp() function implemented with execution time not dependent on the compared data. - Updated the stunnel.conf and stunnel.init templates. - Added a client-mode example to the manual. * Bugfixes - Fixed "failover = rr" broken since version 5.00. - Fixed "taskbar = no" broken since version 5.00. - Compilation fix for missing SSL_OP_MSIE_SSLV2_RSA_PADDING option. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: c258b71d7f82bba5b0a4ccc69fbda632f1fefe9108589a92aa1016f33985973e stunnel-5.02.tar.gz 2125bf8e9241cb9f7969cb74f8409ce77f2c49e1390d363aa46bc436b9d908aa stunnel-5.02-installer.exe f962a2f4a0e16f07ff10339066ec89d7686734dcabba88654f2e71da4f658529 stunnel-5.02-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlOVrZkACgkQ/NU+nXTHMtHBIQCfefzazgvECg8p4qoHgsMjw/KM gTQAoM0mYm+S7exolJjiBBfSlx2G8Rjn =hyr4 -----END PGP SIGNATURE-----

1 0

OpenSSL dlls update for Windows (security advisory 20140605)
by Javier 07 Jun '14

07 Jun '14

Hi, as a mere user I ask, should we expect a new Stunnel version in a few days even it is not an Stunnel vulnerability or is it enough to just update ssleay and libeay with 1.0.1h by us under Windows? Just in case ssleay and libeay are compiled different than official builds. Regards. http://www.openssl.org/news/secadv_20140605.txt

1 0

behavior change after enabling proxy protocol
by Philippe Anctil 05 Jun '14

05 Jun '14

Hello, We use stunnel to secure a proprietary tcp/ip protocol over the internet. More specifially we have - 1 balancer - 2 stunnel boxes - 1 app server The load balancer 'pings' stunnel boxes regularly to know if one is down. Recently, we have added support for the proxy protocol in our app and turned it on in our stunnel config. It works great except for one small new behavior: upon receiving a load balancer ping, stunnel performs a connection on our app (and sends the proxy header). I ran a tcpdump for a telnet on the stunnel port (8000). With proxy protocol disabled, stunnel does nothing while it waits for the certificate. The connection ended at my request. 17:33:08.537385 IP 127.0.0.1.6015 > 127.0.0.1.8000: S 356922015:356922015(0) win 32792 <mss 16396,sackOK,timestamp 1085620573 0,nop,wscale 7> 17:33:08.537386 IP 127.0.0.1.8000 > 127.0.0.1.6015: S 1525966521:1525966521(0) ack 356922016 win 32768 <mss 16396,sackOK,timestamp 1085620573 1085620573,nop,wscale 7> 17:33:08.537393 IP 127.0.0.1.6015 > 127.0.0.1.8000: . ack 1 win 257 <nop,nop,timestamp 1085620573 1085620573> 17:33:19.750431 IP 127.0.0.1.6015 > 127.0.0.1.8000: F 1:1(0) ack 1 win 257 <nop,nop,timestamp 1085631785 1085620573> 17:33:19.751065 IP 127.0.0.1.8000 > 127.0.0.1.6015: . ack 2 win 256 <nop,nop,timestamp 1085631786 1085631785> 17:33:19.751794 IP 127.0.0.1.8000 > 127.0.0.1.6015: R 1:1(0) ack 2 win 256 <nop,nop,timestamp 1085631787 1085631785> With proxy protocol enabled, stunnel establishes a connection to my app and sends the proxy protocol before even receiving the certificate. 17:34:35.370462 IP 127.0.0.1.6026 > 127.0.0.1.8000: S 2949098861:2949098861(0) win 32792 <mss 16396,sackOK,timestamp 1085707402 0,nop,wscale 7> 17:34:35.370475 IP 127.0.0.1.8000 > 127.0.0.1.6026: S 1044893129:1044893129(0) ack 2949098862 win 32768 <mss 16396,sackOK,timestamp 1085707402 1085707402,nop,wscale 7> 17:34:35.370481 IP 127.0.0.1.6026 > 127.0.0.1.8000: . ack 1 win 257 <nop,nop,timestamp 1085707402 1085707402> 17:34:35.371035 IP 127.0.0.1.37654 > 127.0.0.1.9000: S 801705083:801705083(0) win 32792 <mss 16396,sackOK,timestamp 1085707402 0,nop,wscale 7> 17:34:35.371046 IP 127.0.0.1.9000 > 127.0.0.1.37654: S 4068822820:4068822820(0) ack 801705084 win 32768 <mss 16396,sackOK,timestamp 1085707402 1085707402,nop,wscale 7> 17:34:35.371052 IP 127.0.0.1.37654 > 127.0.0.1.9000: . ack 1 win 257 <nop,nop,timestamp 1085707402 1085707402> 17:34:35.371583 IP 127.0.0.1.37654 > 127.0.0.1.9000: P 1:44(43) ack 1 win 257 <nop,nop,timestamp 1085707403 1085707402> 17:34:35.371595 IP 127.0.0.1.9000 > 127.0.0.1.37654: . ack 44 win 256 <nop,nop,timestamp 1085707403 1085707403> 17:34:50.484991 IP 127.0.0.1.9000 > 127.0.0.1.37654: F 1:1(0) ack 44 win 256 <nop,nop,timestamp 1085722515 1085707403> 17:34:50.485892 IP 127.0.0.1.37654 > 127.0.0.1.9000: . ack 2 win 257 <nop,nop,timestamp 1085722516 1085722515> 17:35:08.824661 IP 127.0.0.1.6026 > 127.0.0.1.8000: F 1:1(0) ack 1 win 257 <nop,nop,timestamp 1085740854 1085707402> 17:35:08.824906 IP 127.0.0.1.8000 > 127.0.0.1.6026: . ack 2 win 256 <nop,nop,timestamp 1085740854 1085740854> 17:35:08.824972 IP 127.0.0.1.37654 > 127.0.0.1.9000: R 44:44(0) ack 2 win 257 <nop,nop,timestamp 1085740854 1085722515> 17:35:08.825013 IP 127.0.0.1.8000 > 127.0.0.1.6026: R 1:1(0) ack 2 win 256 <nop,nop,timestamp 1085740855 1085740854> Note I used 'tcpdump -i lo -nn port 8000 or port 9000' for both traces. I see no good reason to connect to the application before the ssl session is established. Thank you for reading! -- Philippe Anctil

2 2

log format
by Philippe Anctil 04 Jun '14

04 Jun '14

I have noticed stunnel 5.01 log format is different when I run it under my account vs when I run it on the system. I don't remember seeing this with stunnel 4.56 and older. Format under my account: 2014.06.02 11:38:50 LOG6[26855]: SSL accepted: new session negotiated Format on the system: Jun 4 16:27:14 hostname stunnel: LOG6[11100:0]: SSL accepted: new session negotiated When I run under my account I normally save output to a separate file with output=. I guess this is what is having an influence on the log format? Is there any way I can have logging format in my account consistent with what I have in syslog? Thanks. -- Philippe Anctil

1 0

Problem with pidfile
by reg14＠rambler.ru 30 May '14

30 May '14

I run stunnel (version 5.00) as a non-root user which does not have write permissions to /var/run. So I created file /var/run/stunnel.log with right access for that user -rw-r--r--. 1 stunnel stunnel 0 May 28 21:31 stunnel.pid When I start daemon, it writes to logfile the following 2014.05.28 22:18:44 LOG3[8878]: Cannot create pid file /var/run/stunnel.pid 2014.05.28 22:18:44 LOG3[8878]: create: File exists (17) It seems that it tries to create pidfile in /var/run, and ignores that the file is already exists. As a result, pid is not written to stunnel.pid, and daemon crashes. Could this be fixed?

3 7

Possible Mail Relay (port 465/tcp-SSL) after stunnel install
by Sven Schulte 28 May '14

28 May '14

Dear colleagues, after installing stunnel (v 5.01) an PCI Security Scan finished with finding that port 465 allows mail relaying. (CVE-1999-0512, CVE-2002-1278, CVE-2003-0285). Any comments/ideas how to comly? Thanks in advance! Sven

1 0

Strange performance problem, need help troubleshooting
by Paulo Azevedo 24 May '14

24 May '14

I have a strange performance problem with stunnel, could you help me? Here is my setup: PC1 & PC2 -- Switch (GbE) -- Switch (100mbps) -- Router -- modem -- Internet PC1 has stunnel and HFS installed, sharing a folder to the internet.My internet upload speed is 20Mbps. With this setup, I can serve files at 8Mbps over the internet, but if I disable stunnel the speed doubles to 16Mbps. However, with stunnel active, if I try the same with PC2, I get 82Mbps (using the internet IP, it goes all the way to the router), so this does not appear to be a performance problem on the hardware. Can you give me some hints on what is limiting my speed here?

2 1

[patch] Systemd socket activation support in daemon mode
by Mark Theunissen 14 May '14

14 May '14

Hi, This patch allows stunnel to be started in daemon mode by systemd's socket activation. This is superior to inetd mode, for all the reasons specified in the stunnel howto. Since systemd is now the default in most of the major Linux distros, it would be great to have this committed upstream. https://gist.github.com/marktheunissen/7ce9426e66aa8f0ec2e1 Example systemd unit files: ### stunnel.socket [Unit] Description=Stunnel socket After=network.target [Socket] ListenStream=9999 ### stunnel.service [Unit] Description=Stunnel service After=network.target [Service] Type=forking ExecStart=stunnel /etc/stunnel/stunnel.conf Thanks, Mark Theunissen

1 1

Re: [stunnel-users] certificate verify failed
by Aaron Haywood 05 May '14

05 May '14

The following is an excerpt from my log's slightly modified to hide company specific data: 2014.05.01 10:11:05 LOG7[5956]: Starting certificate verification: depth=2, subject=/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority 2014.05.01 10:11:05 LOG6[5956]: Certificate accepted: depth=2, subject=/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority 2014.05.01 10:11:05 LOG7[5956]: Starting certificate verification: depth=1, subject=/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=######## 2014.05.01 10:11:05 LOG6[5956]: Certificate accepted: depth=1, subject=/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=######## 2014.05.01 10:11:05 LOG7[5956]: Starting certificate verification: depth=0, subject=/O=*.somedomain.com/OU=Domain Control Validated/CN=*.somedomain.com 2014.05.01 10:11:05 LOG3[5956]: CERT: X509_STORE_get1_certs: Peer suddenly disconnected 2014.05.01 10:11:05 LOG4[5956]: Certificate check failed: depth=0, subject=/O=*.somedomain.com/OU=Domain Control Validated/CN=*.somedomain.com 2014.05.01 10:11:05 LOG7[5956]: SSL alert (write): fatal: certificate unknown Respectfully, Aaron Haywood | Systems Administrator [cid:image002.png@01CEDA11.E935A7F0] O: 858.614.1547 | M: 858.699.8302 | www.sdhealthconnect.org CONNECT WITH US: Facebook<https://www.facebook.com/SDHealthConnect?filter=1> | Twitter<https://twitter.com/SDHealthConnect> | LinkedIn<http://www.linkedin.com/company/san-diego-health-connect?trk=company_logo> | Google+<https://plus.google.com/u/0/b/112077458420951237937/112077458420951237937/p…> | YouTube<http://www.youtube.com/SDHealthConnect>

1 0

Re: [stunnel-users] certificate verify failed
by Aaron Haywood 05 May '14

05 May '14

Roman, I was wondering if you changed your verify from level 3 to level 2, and if this resolved your peer disconnection error with stunnel. We're experiencing a similar problem but was wondering if anyone out there has resolved this issue already; and if so..how? :) Respectfully, Aaron Haywood | Systems Administrator [cid:image002.png@01CEDA11.E935A7F0] O: 858.614.1547 | M: 858.699.8302 | www.sdhealthconnect.org CONNECT WITH US: Facebook<https://www.facebook.com/SDHealthConnect?filter=1> | Twitter<https://twitter.com/SDHealthConnect> | LinkedIn<http://www.linkedin.com/company/san-diego-health-connect?trk=company_logo> | Google+<https://plus.google.com/u/0/b/112077458420951237937/112077458420951237937/p…> | YouTube<http://www.youtube.com/SDHealthConnect>

1 0

New stunnel how-to
by Patrick J. 30 Apr '14

30 Apr '14

Hi all, I've spent some time to write a new stunnel how-to. - Install and configure stunnel on a Raspberry Pi - Run stunnel in a chroot jail - Limit allowed ciphers and force Forward Secrecy - Restrict access to the stunnel server (verify = 3) - Disguise SSH as HTTPS traffic http://stunnel.qnea.net/ Regards from Germany, Patrick

1 1

Error 126 compiling on Mac OS X 10.7.5
by James Brown 29 Apr '14

29 Apr '14

I’ve just tried to install version 5.01 and encountered an error. I had no problems installing 5.01b1 previously. I just thought I’d install the release version. System is running Mac OS X 10.7.5. make ends with a warning, and make install fails: ld: warning: directory not found for option '-L/usr//lib64' Making all in doc make[1]: Nothing to be done for `all'. Making all in tools make[1]: Nothing to be done for `all'. make[1]: Nothing to be done for `all-am'. mail:stunnel-5.01 2 jlbrown$ sudo make install Password: Making install in src ../auto/install-sh -c -d '/usr/local/bin' /bin/sh ../libtool --mode=install /usr/bin/install -c stunnel '/usr/local/bin' libtool: install: /usr/bin/install -c stunnel /usr/local/bin/stunnel ../auto/install-sh -c -d '/usr/local/bin' /usr/bin/install -c stunnel3 '/usr/local/bin' ../auto/install-sh -c -d '/usr/local/lib/stunnel' /bin/sh ../libtool --mode=install /usr/bin/install -c libstunnel.la '/usr/local/lib/stunnel' libtool: install: /usr/bin/install -c .libs/libstunnel.dylib /usr/local/lib/stunnel/libstunnel.dylib libtool: install: /usr/bin/install -c .libs/libstunnel.lai /usr/local/lib/stunnel/libstunnel.la /Users/jlbrown/Downloads/stunnel-5.01: /Users/jlbrown/Downloads/stunnel-5.01: is a directory make[2]: *** [install-pkglibLTLIBRARIES] Error 126 make[1]: *** [install-am] Error 2 make: *** [install-recursive] Error 1 I just used ./configure with no arguments. Any suggestions? Thanks, James.

1 0

Verify=2 and Verification Depth...
by Matt Wise 28 Apr '14

28 Apr '14

It was my understanding that when you have an Stunnel Server configured with 'verify=2', that the client that connects must have a certificate signed by the same CA/SubCA combination that the server does. So for example: - My_Root_Ca (private CA) - Some_Random_Cert.pem - Stunnel_Sub_Ca: - Server.pem - Client.pem - Postgres_Sub_Ca: - Server.pem - postgres_user.pem With the above structure in place (and the stunnel server using Stunnel_Sub_Ca/Server.pem) if someone tried to connect in with the Stunnel_Sub_Ca/Client.pem cert, it would work... but if they tried to connect in with Postgres_Sub_Ca/Server.pem, it wouldn't. Unfortunately we're not seeing that behavior... we're seeing a behavior where *every* cert signed by the overall Root CA is validated. We're able to connect in using Some_Random_Cert.pem, Postgres_Sub_Ca/Server.pem and Postgres_Sub_Ca/postgres_user.pem. This feels wrong ... what am I missing? (We're using Stunnel 4.55 btw) Matt Wise Sr. Systems Architect Nextdoor.com

1 1

ephemeral port limit
by Frank Liu 28 Apr '14

28 Apr '14

Hi, I am trying to use stunnel to add ssl support to my app. My app and linux server are tuned to accept 200k+ connections without a problem. When adding stunnel on the same server, the connection stops when it reaches 64k due to stunnel uses ephemeral ports to connect to my app on the localhost. Any suggestions how to get around this limit? One thing I am thinking of is to add 10 virtual interfaces on loopback: lo0:2, lo0:3, etc with ip 127.0.0.2, 127.0.0.3 etc. Can stunnel be configured to cycle through a pool of ip for outbound connection to my app listening on 127.0.0.1? That would give 10x64k of ephemeral ports. I see stunnel has "local" to specify outgoing ip, but I am not sure if it supports a list of ip or use multiple times. If so, will it round robin the list? Thanks Frank

2 2

Syringe
by Michal Trojnara 21 Apr '14

21 Apr '14

Hi Guys, I'm glad to announce syringe, a service for testing client-side heartbleed. It allows to easily examine most of the obscure TLS clients (for example embedded devices). The service is available online at https://www.stunnel.org:4433/ Best regards, Mike

2 2

hardware random
by ios dev 20 Apr '14

20 Apr '14

Hello. I am using GOST engine and set it as default for ALL. At the same time i want to use hardware RNG from other engine. How can i do this? -- BR, Dev.

1 0

Problem with round robin on stunnel 5.0 and 5.1
by WNSDEV 14 Apr '14

14 Apr '14

When I use either of these two versions of stunnel the round-robin for "connect" only sends connections to the first host listed on the configuration file. However the round-robin works in Stunnel 4.56,4.55,4.54 and 4.53. Anyone else have this issue? Thank you, Pete Sangas ./stunnel -version stunnel 5.00 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.1g 7 Apr 2014 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Global options: debug = daemon.notice RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = HIGH:MEDIUM:+3DES:+DH:!aNULL:!SSLv2 (with "fips = no") curve = prime256v1 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds sslVersion = TLSv1 (with "fips = yes") sslVersion = TLSv1 for client, all for server (with "fips = no") stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none Config file : CApath = /xxx/certs/trusted CAfile = /yyy/cacert.pem ciphers = RC4-SHA debug = daemon.7 pid = /zzz/stunnel.pid options = NO_SSLv2 foreground = yes setgid = gid1 setuid = uid1 delay = no fips=no [stunnel] TIMEOUTidle=86400 verify = 3 cert = /path/servercert.pem accept = 443 failover=rr connect = 10.1.1.50:23 connect = 10.1.1.60:23

2 2

DH not working, although initialized correctly
by Ovidiu Lixandru 14 Apr '14

14 Apr '14

Hello, I'm trying to enable Forward Secrecy. have an stunnel 4.56 instance compiled with authpriv and xforwardedfor patches, configured as follows: sslVersion = all options = NO_SSLv2 ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4 renegotiation = no setuid = nobody setgid = nobody socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 libwrap = no TIMEOUTbusy = 120 xforwardedfor = yes [domain.com] accept = X.X.X.X:443 connect = 127.0.0.1:91 cert = /etc/pki/tls/certs/domain.pem key = /etc/pki/tls/private/domain.key domain.pem contains both the SSL certificate and the DH parameters (generated with "openssl dhparams 2048"). stunnel initializes the DH parameters correctly: 2014.04.14 12:08:18 LOG6[16629:140355580176320]: Initializing service [domain.com] 2014.04.14 12:08:18 LOG7[16629:140355580176320]: Certificate: /etc/pki/tls/certs/domain.pem 2014.04.14 12:08:18 LOG7[16629:140355580176320]: Certificate loaded 2014.04.14 12:08:18 LOG7[16629:140355580176320]: Key file: /etc/pki/tls/private/domain.key 2014.04.14 12:08:18 LOG7[16629:140355580176320]: Private key loaded 2014.04.14 12:08:18 LOG7[16629:140355580176320]: Using DH parameters from /etc/pki/tls/certs/domain.pem 2014.04.14 12:08:18 LOG7[16629:140355580176320]: DH initialized with 2048-bit key 2014.04.14 12:08:18 LOG7[16629:140355580176320]: SSL options set: 0x01000004 When I try to connect using openssl s_client, the connections fails with it unable to negotiate a cipher. On the client side: # openssl s_client -cipher ECDH -tls1 -connect www.domain.com:443 CONNECTED(00000003) 140735113126752:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1256:SSL alert number 40 140735113126752:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:596: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 7 bytes and written 0 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1 Cipher : 0000 Session-ID: Session-ID-ctx: Master-Key: Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1397471905 Timeout : 7200 (sec) Verify return code: 0 (ok) --- On the server side: 2014.04.14 11:57:10 LOG5[9647:140038728394496]: Service [domain.com] accepted connection from X.X.X.X:56678 2014.04.14 11:57:10 LOG7[9647:140038728394496]: SSL state (accept): before/accept initialization 2014.04.14 11:57:10 LOG7[9647:140038728394496]: SNI: no virtual services defined 2014.04.14 11:57:10 LOG7[9647:140038728394496]: SSL alert (write): fatal: handshake failure 2014.04.14 11:57:10 LOG3[9647:140038728394496]: SSL_accept: 1408A0C1: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher 2014.04.14 11:57:10 LOG5[9647:140038728394496]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket The client and the server have the same openssl version (1.0.1e), with the same supported ciphers. I tried different cipher combinations (i.e. "HIGH:!aNULL:!MD5"), but no lock. FWIW, the initial DH cipher list in the stunnel config file works correctly in an SSL nginx instance and openssl s_client negotiates "ECDHE-RSA-AES256-SHA". Any idea what may be wrong with stunnel? Thanks, Ovidiu

1 0

Re: [stunnel-users] Some troubles with PROXY protocol
by Alexey V. Drozdov 13 Apr '14

13 Apr '14

Hi, Mike! In spite of new changes, it's still work incorrect because of init_remote(c) connect to the address from root config section: protocol(c, PROTOCOL_PRE_CONNECT); init_remote(c); <<<<<<<<<< destination address from root section protocol(c, PROTOCOL_PRE_SSL); init_ssl(c); <<<<<<<<<<< switch to target SNI config section only there protocol(c, PROTOCOL_POST_SSL); <<<<<<<<<<< send PROXY protocol to incorrect address Context switch to target section parameters after init_ssl(c) only. /Alexey V. Drozdov e-mail: anyquist(a)yandex.ru

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users