Hello,

I am having difficulting when running stunnel in FIPS mode and using a SIGHUP to get stunnel to re-read it's configuration file (for instance if I've changed a port # or IP address for one of the connections). This causes stunnel to call the SSL routine FIPS_mode_set() a second time after receiving the SIGHUP, which in turn attempts to reinitialize SSL. Unfortunately, OpenSSL does not support calling FIPS_mode_set(1) more than once. The initialization of SSL becomes incomplete as a result of the 2nd call and subsequent attempts to use stunnel to establish encrypted connections fail.

Does anyone have any suggestions on how I can make this work (besides killing and restarting stunnel)?

If not, I have a proposed fix (and there are multiple ways that this could be addressed). Anyway, my suggestion is to add the following two lines to the ssl_configure() function (found in the file "ssl.c"), right before the current FIPS_mode_set() routine is called:

FIPS_mode_set(0); RAND_set_rand_method(NULL);

The function currently looks like:

int ssl_configure(void) { /* configure global SSL settings */ #ifdef USE_FIPS if(!FIPS_mode_set(global_options.option.fips)) { ERR_load_crypto_strings(); sslerror("FIPS_mode_set"); return 0; } s_log(LOG_NOTICE, "FIPS mode %s", global_options.option.fips ? "enabled" : "disabled"); #endif /* USE_FIPS */ : : }

With the suggested fix, it would look as follows:

int ssl_configure(void) { /* configure global SSL settings */ #ifdef USE_FIPS FIPS_mode_set(0); RAND_set_rand_method(NULL); if(!FIPS_mode_set(global_options.option.fips)) { ERR_load_crypto_strings(); sslerror("FIPS_mode_set"); return 0; } s_log(LOG_NOTICE, "FIPS mode %s", global_options.option.fips ? "enabled" : "disabled"); #endif /* USE_FIPS */ : : }

Does the above seem reasonable. Could this change, or some other modification which would support using SIGHUP with FIPS, be considered for a future stunnel update?

Thanks for your help.