- stunnel-users - stunnel.org

Re: [stunnel-users] One Time Password for https two factor authentication
by hamburg-barmbek＠gmx.de 02 Nov '15

02 Nov '15

2 2

One Time Password for https two factor authentication
by hamburg-barmbek＠gmx.de 30 Oct '15

30 Oct '15

2 1

Re: [stunnel-users] stunnel-users Digest, Vol 135, Issue 19
by Reese Wilson 30 Oct '15

30 Oct '15

Unfortunately that's not an option for our use case On Thu, Oct 29, 2015 at 4:00 AM <stunnel-users-request(a)stunnel.org> wrote: > Send stunnel-users mailing list submissions to > stunnel-users(a)stunnel.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)stunnel.org > > You can reach the person managing the list at > stunnel-users-owner(a)stunnel.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. hex key support for psk (Reese Wilson) > 2. Re: hex key support for psk (Michal Trojnara) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 28 Oct 2015 23:12:01 +0000 > From: Reese Wilson <reesew(a)tzmedical.com> > To: stunnel-users(a)stunnel.org > Subject: [stunnel-users] hex key support for psk > Message-ID: > < > CAJU_q421ksnS8mCtkc6tApdTwUXJrNBZ+69Zt_HxJMpJLGBoiA(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > I ran into an issue with PSK reading the key as ascii instead of hex. I had > a gnutls-serv and gnutls-cli set up with a hex key, and I switched the > server for one wrapped using stunnel, but using the same key in psk.txt was > failing. I eventually got it working by converting the hex characters to > binary and placing that in the contents of the file specified by PSKsecrets > (psk.txt), but this won't work for certain scenarios. For example, what if > the key contains ascii newline characters? >

1 0

hex key support for psk
by Reese Wilson 29 Oct '15

29 Oct '15

I ran into an issue with PSK reading the key as ascii instead of hex. I had a gnutls-serv and gnutls-cli set up with a hex key, and I switched the server for one wrapped using stunnel, but using the same key in psk.txt was failing. I eventually got it working by converting the hex characters to binary and placing that in the contents of the file specified by PSKsecrets (psk.txt), but this won't work for certain scenarios. For example, what if the key contains ascii newline characters?

2 1

stunnel: symbol lookup error: stunnel undefined symbol: X509_check_host
by Ryan McLeod 20 Oct '15

20 Oct '15

Hello. I get the error in the subject on 64bit Ubuntu and Debian system (32bit is fine). I've installed from source: -openssl-1.0.2.d -stunnel-5.24 When first install stunnel, it complained about not being able to find an ssl library during the configure stage and said to reinstall openssl with -fPIC. I did that using the following line: CFLAG=-fPIC ./config shared Once I did that, stunnel installed just fine. But when I run stunnel, I get the error in the subject. I tried reinstalling stunnel with a configure option: --with-ssl=/usr/local/ssl/. But no change. Any suggestions would be great. Thanks. Ryan

2 2

Windows Mobile 6.5
by Jeffrey McCain 19 Oct '15

19 Oct '15

Hello, Does Anyone know if the makece.bat for ARM actually functions anymore? I'd like to build the latest possible version of stunnel for a client that uses Window Mobile 6.5, but not if I have to go back to stunnel version 4.15, which appears to be the last time someone built binaries for it... Thanks! Jeff.

4 7

100 percent CPU usage
by asdf 17 Oct '15

17 Oct '15

Dear subscribers I am new to this so I dont know if this is just wrong configuration (that does not trigger an error message). Searching on the web for the following problem shows someone reporting sth similar on a Linux machine. I am using the newest version of stunnel (5.24) on Windows 7 and there is an stunnel thread starting that takes 100% of one core forever. I have attached a ProcMon trace with activated Registry/Filesystem/Network/Process events. The thread starts at 22:03:55 (which is 30 seconds after stunnel-start and at a time at which I did not use stunnel). The events after that follow that event are my pressing exit. Attachements: stunnel config, procMon-trace Thank you! Ben [myEmailIn] client = yes accept = 127.0.0.1:180 connect = imap.gmx.net:993 verify = 2 CAfile = ca-certs.pem checkHost = mail.gmx.net [myEmailOut] client = yes accept = 127.0.0.1:181 connect = mail.gmx.net:465 verify = 2 CAfile = ca-certs.pem checkHost = mail.gmx.net ; ***************************************** Example TLS server mode services [myServer] accept = 9999 connect = 7777 cert = stunnel.pem

1 0

Question about "forground = yes" and "output = FILE" combined options
by Michael Gebis 16 Oct '15

16 Oct '15

Hello. I have a question about the combination of the "foreground = yes" option combined with the "output = FILE" option. The man page says this: foreground = yes | no (Unix only) foreground mode Stay in foreground (don’t fork) and log to stderr instead of via syslog (unless output is specified). This implies that if you set both "foreground = yes" and "output = FILE", the log messages will not be sent to stderr and will instead be sent to the log file only. We'd like this behavior--it makes it easier for our scripts to distinguish startup errors parsing the config file (which are sent to stderr, since the log file isn't configured yet) vs. normal operation after the config file is parsed and the log file is established. However, it appears that if you specify "foreground = yes" and "output = FILE", log messages will go to *both* stderr and the output file. I guess I'm asking: is the documentation in conflict with the behavior, and if so, which is correct? It's possible I'm just misreading the man page. But in any case, here is a simple patch which changes the behavior to match our reading of the man page. It is against stunnel-5.22 but I believe it should be applicable to later versions as well. Thank you, Michael diff -ru stunnel-5.22.orig/src/log.c stunnel-5.22-foreground-outfile/src/log.c --- stunnel-5.22.orig/src/log.c 2015-06-16 06:16:35.000000000 -0700 +++ stunnel-5.22-foreground-outfile/src/log.c 2015-10-14 11:54:58.998254974 -0700 @@ -243,7 +243,8 @@ level<=opt->log_level #else (level<=opt->log_level && - global_options.option.foreground) + global_options.option.foreground && + !outfile) #endif ) ui_new_log(line);

3 7

Can stunnel do this and if so, how?
by Jason Lacoss-Arnold 15 Oct '15

15 Oct '15

I have a client and a server where the client isn't very good and the server requires a MASSL (Mutual Auth SSL aka client certificate authenticated) connection. I need to get one of two things to work. Either: 1) The client makes a non-SSL connection to stunnel on the local machine which then performs a MASSL connection to the server using a client certificate or 2) The client makes a plain SSL connection to stunnel on the local machine which then performs a MASSL connection to the server using a client certificate. Can stunnel be used in this manner? If so, would someone please give me some hints on configuration? For extra credit, it would be awesome if the client private key were stored in a pkcs11 device (HSM). Thank you, --Jason

1 0

Unable to authenticate with Outlook.com servers (SMTP)
by Aerowinder 15 Oct '15

15 Oct '15

Greetings, Running stunnel 5.25 latest beta (2015-10-15), but also had the same issues on 5.24 final. My config file looks like this: debug = debug output = xxxxx client = yes cert = stunnel.pem [outlook-smtp] accept = 127.0.0.1:25 connect = smtp-mail.outlook.com:587 protocol = smtp ;protocolUsername = xxxx ;protocolPassword = xxxx CAfile = ca-certs.pem checkHost = smtp-mail.outlook.com OCSPaia = yes verify = 2 I am testing functionality to make sure that I am able to send mail with my Outlook.com address. I currently have User/Pass field commented out, but I've tried with them not commented out, and the actual values instead of "xxxx" (the app I'm using has fields for username and password). My log: 2015.10.15 11:01:24 LOG7[cron]: Cron started 2015.10.15 11:01:24 LOG7[main]: No limit detected for the number of clients 2015.10.15 11:01:24 LOG5[main]: stunnel 5.25 on x86-pc-msvc-1500 platform 2015.10.15 11:01:24 LOG5[main]: Compiled/running with OpenSSL 1.0.2d-fips 9 Jul 2015 2015.10.15 11:01:24 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2015.10.15 11:01:24 LOG7[main]: errno: (*_errno()) 2015.10.15 11:01:24 LOG7[ui]: GUI message loop initialized 2015.10.15 11:01:24 LOG5[main]: Reading configuration from file stunnel.conf 2015.10.15 11:01:24 LOG5[main]: UTF-8 byte order mark detected 2015.10.15 11:01:24 LOG5[main]: FIPS mode disabled 2015.10.15 11:01:24 LOG7[main]: Compression disabled 2015.10.15 11:01:24 LOG7[main]: PRNG seeded successfully 2015.10.15 11:01:24 LOG6[main]: Initializing service [outlook-smtp] 2015.10.15 11:01:24 LOG6[main]: Loading certificate from file: stunnel.pem 2015.10.15 11:01:24 LOG6[main]: Loading key from file: stunnel.pem 2015.10.15 11:01:24 LOG7[main]: Private key check succeeded 2015.10.15 11:01:24 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2015.10.15 11:01:24 LOG5[main]: Configuration successful 2015.10.15 11:01:24 LOG7[main]: Listening file descriptor created (FD=652) 2015.10.15 11:01:24 LOG7[main]: Service [outlook-smtp] (FD=652) bound to 127.0.0.1:25 2015.10.15 11:01:31 LOG7[main]: Found 1 ready file descriptor(s) 2015.10.15 11:01:31 LOG7[main]: FD=408 ifds=r-x ofds=--- 2015.10.15 11:01:31 LOG7[main]: Service [outlook-smtp] accepted (FD=692) from 127.0.0.1:58065 2015.10.15 11:01:31 LOG7[main]: Creating a new thread 2015.10.15 11:01:31 LOG7[main]: New thread created 2015.10.15 11:01:31 LOG7[0]: Service [outlook-smtp] started 2015.10.15 11:01:31 LOG5[0]: Service [outlook-smtp] accepted connection from 127.0.0.1:58065 2015.10.15 11:01:31 LOG6[0]: s_connect: connecting 65.55.176.126:587 2015.10.15 11:01:31 LOG7[0]: s_connect: s_poll_wait 65.55.176.126:587: waiting 10 seconds 2015.10.15 11:01:31 LOG5[0]: s_connect: connected 65.55.176.126:587 2015.10.15 11:01:31 LOG5[0]: Service [outlook-smtp] connected remote server from 172.26.1.51:58066 2015.10.15 11:01:31 LOG7[0]: Remote descriptor (FD=704) initialized 2015.10.15 11:01:31 LOG7[0]: <- 220 BLU436-SMTP245.smtp.hotmail.com Microsoft ESMTP MAIL Service, Version: 8.0.9200.16384 ready at Thu, 15 Oct 2015 08:01:34 -0700 2015.10.15 11:01:31 LOG7[0]: -> 220 BLU436-SMTP245.smtp.hotmail.com Microsoft ESMTP MAIL Service, Version: 8.0.9200.16384 ready at Thu, 15 Oct 2015 08:01:34 -0700 2015.10.15 11:01:31 LOG7[0]: -> EHLO localhost 2015.10.15 11:01:31 LOG7[0]: <- 250-BLU436-SMTP245.smtp.hotmail.com Hello [70.90.151.129] 2015.10.15 11:01:31 LOG7[0]: <- 250-TURN 2015.10.15 11:01:31 LOG7[0]: <- 250-SIZE 41943040 2015.10.15 11:01:31 LOG7[0]: <- 250-ETRN 2015.10.15 11:01:31 LOG7[0]: <- 250-PIPELINING 2015.10.15 11:01:31 LOG7[0]: <- 250-DSN 2015.10.15 11:01:31 LOG7[0]: <- 250-ENHANCEDSTATUSCODES 2015.10.15 11:01:31 LOG7[0]: <- 250-8bitmime 2015.10.15 11:01:31 LOG7[0]: <- 250-BINARYMIME 2015.10.15 11:01:31 LOG7[0]: <- 250-CHUNKING 2015.10.15 11:01:31 LOG7[0]: <- 250-VRFY 2015.10.15 11:01:31 LOG7[0]: <- 250-TLS 2015.10.15 11:01:31 LOG7[0]: <- 250-STARTTLS 2015.10.15 11:01:31 LOG7[0]: <- 250 OK 2015.10.15 11:01:31 LOG7[0]: -> STARTTLS 2015.10.15 11:01:31 LOG7[0]: <- 220 2.0.0 SMTP server ready 2015.10.15 11:01:31 LOG6[0]: SNI: sending servername: smtp-mail.outlook.com 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): before/connect initialization 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv2/v3 write client hello A 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 read server hello A 2015.10.15 11:01:31 LOG7[0]: Verification started at depth=2: C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA 2015.10.15 11:01:31 LOG7[0]: CERT: Pre-verification succeeded 2015.10.15 11:01:31 LOG7[0]: OCSP: Ignoring root certificate 2015.10.15 11:01:31 LOG6[0]: Certificate accepted at depth=2: C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA 2015.10.15 11:01:31 LOG7[0]: Verification started at depth=1: C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - G2 2015.10.15 11:01:31 LOG7[0]: CERT: Pre-verification succeeded 2015.10.15 11:01:31 LOG5[0]: OCSP: Connecting the AIA responder "http://ocsp.globalsign.com/rootr1" 2015.10.15 11:01:31 LOG6[0]: s_connect: connecting 108.162.232.204:80 2015.10.15 11:01:31 LOG7[0]: s_connect: s_poll_wait 108.162.232.204:80: waiting 10 seconds 2015.10.15 11:01:31 LOG5[0]: s_connect: connected 108.162.232.204:80 2015.10.15 11:01:31 LOG7[0]: OCSP: Connected ocsp.globalsign.com:80 2015.10.15 11:01:31 LOG7[0]: OCSP: Response received 2015.10.15 11:01:31 LOG6[0]: OCSP: Status: good 2015.10.15 11:01:31 LOG6[0]: OCSP: This update: Oct 15 10:27:35 2015 GMT 2015.10.15 11:01:31 LOG6[0]: OCSP: Next update: Oct 19 10:27:35 2015 GMT 2015.10.15 11:01:31 LOG5[0]: OCSP: Certificate accepted 2015.10.15 11:01:31 LOG6[0]: Certificate accepted at depth=1: C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - G2 2015.10.15 11:01:31 LOG7[0]: Verification started at depth=0: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=*.hotmail.com 2015.10.15 11:01:31 LOG7[0]: CERT: Pre-verification succeeded 2015.10.15 11:01:31 LOG6[0]: CERT: Host name "smtp-mail.outlook.com" matched with "*.outlook.com" 2015.10.15 11:01:31 LOG5[0]: OCSP: Connecting the AIA responder "http://ocsp2.globalsign.com/gsorganizationvalg2" 2015.10.15 11:01:31 LOG6[0]: s_connect: connecting 108.162.232.196:80 2015.10.15 11:01:31 LOG7[0]: s_connect: s_poll_wait 108.162.232.196:80: waiting 10 seconds 2015.10.15 11:01:31 LOG5[0]: s_connect: connected 108.162.232.196:80 2015.10.15 11:01:31 LOG7[0]: OCSP: Connected ocsp2.globalsign.com:80 2015.10.15 11:01:31 LOG7[0]: OCSP: Response received 2015.10.15 11:01:31 LOG6[0]: OCSP: Status: good 2015.10.15 11:01:31 LOG6[0]: OCSP: This update: Oct 15 08:26:15 2015 GMT 2015.10.15 11:01:31 LOG6[0]: OCSP: Next update: Oct 16 08:26:15 2015 GMT 2015.10.15 11:01:31 LOG5[0]: OCSP: Certificate accepted 2015.10.15 11:01:31 LOG5[0]: Certificate accepted at depth=0: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=*.hotmail.com 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 read server certificate A 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 read server key exchange A 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 read server done A 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 write client key exchange A 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 write change cipher spec A 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 write finished A 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 flush data 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 read finished A 2015.10.15 11:01:31 LOG7[0]: 1 client connect(s) requested 2015.10.15 11:01:31 LOG7[0]: 1 client connect(s) succeeded 2015.10.15 11:01:31 LOG7[0]: 0 client renegotiation(s) requested 2015.10.15 11:01:31 LOG7[0]: 0 session reuse(s) 2015.10.15 11:01:31 LOG6[0]: SSL connected: new session negotiated 2015.10.15 11:01:31 LOG7[0]: Peer certificate was cached (3461 bytes) 2015.10.15 11:01:31 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-SHA384 (256-bit encryption) 2015.10.15 11:01:31 LOG7[0]: Compression: null, expansion: null 2015.10.15 11:01:31 LOG6[0]: SSL socket closed (SSL_read) 2015.10.15 11:01:31 LOG7[0]: Sent socket write shutdown 2015.10.15 11:01:31 LOG5[0]: Connection closed: 139 byte(s) sent to SSL, 351 byte(s) sent to socket 2015.10.15 11:01:31 LOG7[0]: Remote descriptor (FD=704) closed 2015.10.15 11:01:31 LOG7[0]: Local descriptor (FD=692) closed 2015.10.15 11:01:31 LOG7[0]: Service [outlook-smtp] finished (0 left) I don't see any errors in the log, but Outlook is reporting an incorrect password on the security section of my Microsoft Account. More specifically, I'm seeing error 5.7.3: Requested action aborted, user not authenticated," I know the password works because I set it up as an account in Outlook 2010 and tested sending the email. It works great. I am using 2FA with an app-specific password. But I have also tried without 2FA. I am 100% certain the account name xxxx(a)outlook.com and the password are correct. As far as the config file goes, I've tried just about everything I could find on Google. Nothing works, always the same error message. I also experienced similar failures with Gmail. Any ideas?

2 1

prng_init failure
by Philip Craig 15 Oct '15

15 Oct '15

prng_init() is failing in 5.24 when cross-compiling with openssl due to a combination of two reasons: 1. The --with-random configure option is not supported when cross compiling. 2. The hardcoded /dev/urandom is no longer used if OPENSSL_NO_EGD is not defined. The following patch reverts the behaviour to how it was in 5.23, but probably the --with-random configure option should be supported too. --- stunnel-5.25.orig/src/ssl.c +++ stunnel-5.25/src/ssl.c @@ -207,7 +207,8 @@ NOEXPORT int prng_init(GLOBAL_OPTIONS *g return 0; /* success */ } s_log(LOG_DEBUG, "RAND_screen failed to sufficiently seed PRNG"); -#elif !defined(OPENSSL_NO_EGD) +#else +#ifndef OPENSSL_NO_EGD if(global->egd_sock) { if((bytes=RAND_egd(global->egd_sock))==-1) { s_log(LOG_WARNING, "EGD Socket %s failed", global->egd_sock); @@ -220,7 +221,7 @@ NOEXPORT int prng_init(GLOBAL_OPTIONS *g so no need to check if seeded sufficiently */ } } -#else +#endif /* try the good-old default /dev/urandom, if available */ totbytes+=add_rand_file(global, "/dev/urandom"); if(RAND_status())

2 1

[PATCH] only use aysnc-signal-safe functions after fork
by Philip Craig 15 Oct '15

15 Oct '15

POSIX requires that multi-threaded processes only use async-signal-safe functions after calling fork(). For more info on the problems this avoids, see the rationale at: http://pubs.opengroup.org/onlinepubs/9699919799/functions/pthread_atfork.ht… The specific problem this patch solves is that, when there are multiple simultaneous requests, stunnel is often hanging on a futex syscall when a child process calls free as a result of tls_alloc(). This problem is experienced when using uClibc. I haven't tested, but I believe the malloc implementation in glibc does not have this problem. --- stunnel-5.24.orig/src/client.c +++ stunnel-5.24/src/client.c @@ -1100,6 +1100,8 @@ NOEXPORT SOCKET connect_local(CLI *c) { NOEXPORT SOCKET connect_local(CLI *c) { /* spawn local process */ char *name, host[40], port[6]; + char *env[10]; + int i, envc; int fd[2], pid; X509 *peer_cert; #ifdef HAVE_PTHREAD_SIGMASK @@ -1115,19 +1117,55 @@ NOEXPORT SOCKET connect_local(CLI *c) { } else if(make_sockets(fd)) longjmp(c->err, 1); + set_nonblock(fd[1], 0); /* switch back to blocking mode */ + + envc = 0; + + if(!getnameinfo(&c->peer_addr.sa, c->peer_addr_len, + host, 40, port, 6, NI_NUMERICHOST|NI_NUMERICSERV)) { + /* just don't set these variables if getnameinfo() fails */ + env[envc++] = str_printf("REMOTE_HOST=%s", host); + env[envc++] = str_printf("REMOTE_PORT=%s", port); + if(c->opt->option.transparent_src) { +#ifndef LIBDIR +#define LIBDIR "." +#endif +#ifdef MACH64 + env[envc++] = str_dup("LD_PRELOAD_32=" LIBDIR "/libstunnel.so"); + env[envc++] = str_dup("LD_PRELOAD_64=" LIBDIR "/" MACH64 "/libstunnel.so"); +#elif __osf /* for Tru64 _RLD_LIST is used instead */ + env[envc++] = str_dup("_RLD_LIST=" LIBDIR "/libstunnel.so:DEFAULT"); +#else + env[envc++] = str_dup("LD_PRELOAD=" LIBDIR "/libstunnel.so"); +#endif + } + } + + if(c->ssl) { + peer_cert=SSL_get_peer_certificate(c->ssl); + if(peer_cert) { + name=X509_NAME2text(X509_get_subject_name(peer_cert)); + env[envc++] = str_printf("SSL_CLIENT_DN=%s", name); + name=X509_NAME2text(X509_get_issuer_name(peer_cert)); + env[envc++] = str_printf("SSL_CLIENT_I_DN=%s", name); + X509_free(peer_cert); + } + } + + env[envc] = NULL; pid=fork(); c->pid=(unsigned long)pid; switch(pid) { case -1: /* error */ + for (i = 0; i < envc; i++) + str_free(env[i]); closesocket(fd[0]); closesocket(fd[1]); ioerror("fork"); longjmp(c->err, 1); case 0: /* child */ - tls_alloc(NULL, c->tls, NULL); /* reuse thread-local storage */ closesocket(fd[0]); - set_nonblock(fd[1], 0); /* switch back to blocking mode */ /* dup2() does not copy FD_CLOEXEC flag */ dup2(fd[1], 0); dup2(fd[1], 1); @@ -1135,36 +1173,6 @@ NOEXPORT SOCKET connect_local(CLI *c) { dup2(fd[1], 2); closesocket(fd[1]); /* not really needed due to FD_CLOEXEC */ - if(!getnameinfo(&c->peer_addr.sa, c->peer_addr_len, - host, 40, port, 6, NI_NUMERICHOST|NI_NUMERICSERV)) { - /* just don't set these variables if getnameinfo() fails */ - putenv(str_printf("REMOTE_HOST=%s", host)); - putenv(str_printf("REMOTE_PORT=%s", port)); - if(c->opt->option.transparent_src) { -#ifndef LIBDIR -#define LIBDIR "." -#endif -#ifdef MACH64 - putenv("LD_PRELOAD_32=" LIBDIR "/libstunnel.so"); - putenv("LD_PRELOAD_64=" LIBDIR "/" MACH64 "/libstunnel.so"); -#elif __osf /* for Tru64 _RLD_LIST is used instead */ - putenv("_RLD_LIST=" LIBDIR "/libstunnel.so:DEFAULT"); -#else - putenv("LD_PRELOAD=" LIBDIR "/libstunnel.so"); -#endif - } - } - - if(c->ssl) { - peer_cert=SSL_get_peer_certificate(c->ssl); - if(peer_cert) { - name=X509_NAME2text(X509_get_subject_name(peer_cert)); - putenv(str_printf("SSL_CLIENT_DN=%s", name)); - name=X509_NAME2text(X509_get_issuer_name(peer_cert)); - putenv(str_printf("SSL_CLIENT_I_DN=%s", name)); - X509_free(peer_cert); - } - } #ifdef HAVE_PTHREAD_SIGMASK sigemptyset(&newmask); sigprocmask(SIG_SETMASK, &newmask, NULL); @@ -1176,11 +1184,13 @@ NOEXPORT SOCKET connect_local(CLI *c) { signal(SIGTERM, SIG_DFL); signal(SIGQUIT, SIG_DFL); signal(SIGINT, SIG_DFL); - execvp(c->opt->exec_name, c->opt->exec_args); + execve(c->opt->exec_name, c->opt->exec_args, env); ioerror(c->opt->exec_name); /* execvp failed */ _exit(1); default: /* parent */ s_log(LOG_INFO, "Local mode child started (PID=%lu)", c->pid); + for (i = 0; i < envc; i++) + str_free(env[i]); closesocket(fd[1]); return fd[0]; }

2 2

Re: [stunnel-users] (no subject)
by Adrián Mihálko 10 Oct '15

10 Oct '15

Some good news, I remove client = yes as you suggested: 2015.10.09 12:39:29 LOG5[main]: Configuration successful 2015.10.09 12:39:29 LOG5[main]: Logging to C:\Users\adrianmihalko\AppData\Local\stunnel.log 2015.10.09 12:39:34 LOG6[57]: SSL socket closed (SSL_read) 2015.10.09 12:39:34 LOG5[57]: Connection closed: 0 byte(s) sent to SSL, 445 byte(s) sent to socket 2015.10.09 12:39:34 LOG5[60]: Service [myservice] accepted connection from 192.168.1.25:49671 2015.10.09 12:39:34 LOG6[60]: SSL accepted: new session negotiated 2015.10.09 12:39:34 LOG6[60]: No peer certificate received 2015.10.09 12:39:34 LOG6[60]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES128-GCM-SHA256 (128-bit encryption) 2015.10.09 12:39:34 LOG6[60]: failover: round-robin, starting at entry #0 2015.10.09 12:39:34 LOG6[60]: s_connect: connecting ::1:41952 2015.10.09 12:39:34 LOG5[60]: s_connect: connected ::1:41952 2015.10.09 12:39:34 LOG6[60]: persistence: ::1:41952 cached 2015.10.09 12:39:34 LOG5[60]: Service [myservice] connected remote server from ::1:50598 2015.10.09 12:39:34 LOG6[60]: SSL socket closed (SSL_read) 2015.10.09 12:39:34 LOG5[60]: Connection closed: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2015.10.09 12:39:34 LOG5[61]: Service [myservice] accepted connection from 192.168.1.25:49672 2015.10.09 12:39:34 LOG6[61]: SSL accepted: new session negotiated 2015.10.09 12:39:34 LOG6[61]: No peer certificate received 2015.10.09 12:39:34 LOG6[61]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES128-GCM-SHA256 (128-bit encryption) 2015.10.09 12:39:34 LOG6[61]: failover: round-robin, starting at entry #1 2015.10.09 12:39:34 LOG6[61]: s_connect: connecting 127.0.0.1:41952 2015.10.09 12:39:34 LOG5[61]: s_connect: connected 127.0.0.1:41952 2015.10.09 12:39:34 LOG6[61]: persistence: 127.0.0.1:41952 cached 2015.10.09 12:39:34 LOG5[61]: Service [myservice] connected remote server from 127.0.0.1:50599 openssl_client log: http://pastebin.com/7bg3sf7J The problem is now that the site loads forever, nothing happens. (this certificate (:1988) is other than the original (:41952). This is not problem? curl test: $ curl https://192.168.1.17:1988/DYMO/DLS/Printing/Check -vk * Trying 192.168.1.17... * Connected to 192.168.1.17 (192.168.1.17) port 1988 (#0) * TLS 1.2 connection using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 * Server certificate: localhost > GET /DYMO/DLS/Printing/Check HTTP/1.1 > Host: 192.168.1.17:1988 > User-Agent: curl/7.43.0 > Accept: */* > waiting forever. 2015-10-09 12:34 GMT+02:00 Adrián Mihálko <adriankoooo(a)gmail.com>: > In the first mail I wrote ports bad, of course in the log I am using the > good ones. > > [myservice] > cert = stunnel.pem > client = yes > accept = 0.0.0.0:1988 > connect = localhost:41952 > > > 2015-10-09 12:32 GMT+02:00 Adrián Mihálko <adriankoooo(a)gmail.com>: > >> Sorry, curl was only for testing. >> >> Adrians-MacBook-Pro:~ adrianmihalko$ openssl s_client -connect >> 192.168.1.17:1988 >> CONNECTED(00000003) >> 1130:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown >> protocol:/BuildRoot/Library/Caches/com.apple.xbs/Sources/OpenSSL098/OpenSSL098-59/src/ssl/s23_clnt.c:618: >> >> 2015.10.09 12:23:21 LOG5[main]: Reading configuration from file >> stunnel.conf >> 2015.10.09 12:23:21 LOG5[main]: UTF-8 byte order mark detected >> 2015.10.09 12:23:21 LOG5[main]: FIPS mode disabled >> 2015.10.09 12:23:21 LOG6[main]: Initializing service [gmail-pop3] >> 2015.10.09 12:23:21 LOG6[main]: Initializing service [gmail-imap] >> 2015.10.09 12:23:21 LOG6[main]: Initializing service [gmail-smtp] >> 2015.10.09 12:23:21 LOG6[main]: Initializing service [myservice] >> 2015.10.09 12:23:21 LOG6[main]: Loading certificate from file: stunnel.pem >> 2015.10.09 12:23:21 LOG6[main]: Loading key from file: stunnel.pem >> 2015.10.09 12:23:21 LOG4[main]: Service [myservice] needs authentication >> to prevent MITM attacks >> 2015.10.09 12:23:21 LOG5[main]: Configuration successful >> 2015.10.09 12:23:21 LOG5[main]: Logging to >> C:\Users\adrianmihalko\AppData\Local\stunnel.log >> 2015.10.09 12:23:42 LOG5[39]: Service [myservice] accepted connection >> from 192.168.1.25:49454 >> 2015.10.09 12:23:42 LOG6[39]: failover: round-robin, starting at entry #0 >> 2015.10.09 12:23:42 LOG6[39]: s_connect: connecting ::1:41952 >> 2015.10.09 12:23:42 LOG5[39]: s_connect: connected ::1:41952 >> 2015.10.09 12:23:42 LOG5[39]: Service [myservice] connected remote server >> from ::1:50564 >> 2015.10.09 12:23:42 LOG6[39]: SNI: sending servername: localhost >> 2015.10.09 12:23:42 LOG6[39]: Certificate verification disabled >> 2015.10.09 12:23:42 LOG6[39]: Certificate verification disabled >> 2015.10.09 12:23:42 LOG6[39]: SSL connected: new session negotiated >> 2015.10.09 12:23:42 LOG6[39]: Negotiated TLSv1 ciphersuite AES128-SHA >> (128-bit encryption) >> 2015.10.09 12:23:42 LOG6[39]: SSL socket closed (SSL_read) >> 2015.10.09 12:23:42 LOG5[39]: Connection closed: 130 byte(s) sent to SSL, >> 505 byte(s) sent to socket >> >> If I am connecting to the :41952: >> >> openssl s_client -connect 192.168.1.17:41952 >> ... >> >> --- >> No client certificate CA names sent >> --- >> SSL handshake has read 1724 bytes and written 712 bytes >> --- >> New, TLSv1/SSLv3, Cipher is AES128-SHA >> Server public key is 4096 bit >> Secure Renegotiation IS supported >> Compression: NONE >> Expansion: NONE >> SSL-Session: >> Protocol : TLSv1 >> Cipher : AES128-SHA >> ... >> >> >> 2015-10-09 10:55 GMT+02:00 test rig <testrig(a)z1p.biz>: >> >>> >>> Ouch #2 missing... >>> >>> Hi Adrian, looks good to me so far - mostly. Try to replace the >>> client=yes with a client=no on the server >>> >>> You are connection to :9999 with curl(?) >>> Try verify it via "openssl s_client -connect yourserverip:1988" command >>> >>> Best Regards >>> Michael >>> >>> --- Ursprüngliche Nachricht --- >>> *Von:* "test rig" <testrig(a)z1p.biz> >>> *Datum:* 09.10.2015 09:48:02 >>> *An:* "stunnel-users(a)stunnel.org." <stunnel-users(a)stunnel.org> >>> *Betreff:* Re: [stunnel-users] (no subject) >>> >>> Hi Adrian, looks good to me so far - mostly. Try to replace the >>> client=yes with a client=no on the server >>> >>> --- Ursprüngliche Nachricht --- >>> *Von:* Adrián Mihálko >>> *Datum:* 09.10.2015 08:15:19 >>> *An:* stunnel-users(a)stunnel.org >>> *Betreff:* [stunnel-users] (no subject) >>> >>> Dear stunnel users, >>> >>> I have a little service which listen only on https://localhost:4952 and >>> checks source hostname. I want to connect on "listen:1988" and redirect >>> requests with stunnel to "localhost:4952" >>> >>> https://192.168.1.10:1988 -> redirect https://localhost:4952 >>> >>> >>> I am trying to configure stunnel like this >>> >>> [myservice] >>> cert = stunnel.pem >>> client = yes >>> accept = 0.0.0.0:1988 >>> connect = localhost:4952 >>> >>> remote machine$ curl https://192.168.1.25:9999/DYMO/DLS/Printing/Check >>> -v >>> * Trying 192.168.1.25... >>> * Connected to 192.168.1.25 (192.168.1.25) port 9999 (#0) >>> * WARNING: using IP address, SNI is being disabled by the OS. >>> * Unknown SSL protocol error in connection to 192.168.1.25:-9847 >>> * Closing connection 0 >>> curl: (35) Unknown SSL protocol error in connection to 192.168.1.25: >>> -9847 >>> >>> stunnel.log: >>> 2015.10.09 09:05:42 LOG5[38]: Service [myservice] accepted connection >>> from 192.168.1.24:60748 >>> 2015.10.09 09:05:42 LOG6[38]: failover: round-robin, starting at entry #1 >>> 2015.10.09 09:05:42 LOG6[38]: s_connect: connecting 127.0.0.1:41952 >>> 2015.10.09 09:05:42 LOG5[38]: s_connect: connected 127.0.0.1:41952 >>> 2015.10.09 09:05:42 LOG5[38]: Service [myservice] connected remote >>> server from 127.0.0.1:50503 >>> 2015.10.09 09:05:42 LOG6[38]: SNI: sending servername: localhost >>> 2015.10.09 09:05:42 LOG6[38]: Certificate verification disabled >>> 2015.10.09 09:05:42 LOG6[38]: Certificate verification disabled >>> 2015.10.09 09:05:42 LOG6[38]: SSL connected: new session negotiated >>> 2015.10.09 09:05:42 LOG6[38]: Negotiated TLSv1 ciphersuite AES128-SHA >>> (128-bit encryption) >>> 2015.10.09 09:05:42 LOG6[38]: SSL socket closed (SSL_read) >>> 2015.10.09 09:05:42 LOG5[38]: Connection closed: 230 byte(s) sent to >>> SSL, 505 byte(s) sent to socket >>> >>> I am tried verify = 1 to 4, either works. :( >>> >>> Best Regards, >>> Adrian >>> >>> >>> >>> ______________________________________________________ >>> powered by Perfect-Privacy.com / Secure-Mail.biz - anonymous and secure >>> internet. >>> >>> >>> >>> ______________________________________________________ >>> powered by Perfect-Privacy.com / Secure-Mail.biz - anonymous and secure >>> internet. >>> >>> _______________________________________________ >>> stunnel-users mailing list >>> stunnel-users(a)stunnel.org >>> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >>> >>> >> >

3 6

(no subject)
by Adrián Mihálko 09 Oct '15

09 Oct '15

Dear stunnel users, I have a little service which listen only on https://localhost:4952 and checks source hostname. I want to connect on "listen:1988" and redirect requests with stunnel to "localhost:4952" https://192.168.1.10:1988 -> redirect https://localhost:4952 I am trying to configure stunnel like this [myservice] cert = stunnel.pem client = yes accept = 0.0.0.0:1988 connect = localhost:4952 remote machine$ curl https://192.168.1.25:9999/DYMO/DLS/Printing/Check -v * Trying 192.168.1.25... * Connected to 192.168.1.25 (192.168.1.25) port 9999 (#0) * WARNING: using IP address, SNI is being disabled by the OS. * Unknown SSL protocol error in connection to 192.168.1.25:-9847 * Closing connection 0 curl: (35) Unknown SSL protocol error in connection to 192.168.1.25:-9847 stunnel.log: 2015.10.09 09:05:42 LOG5[38]: Service [myservice] accepted connection from 192.168.1.24:60748 2015.10.09 09:05:42 LOG6[38]: failover: round-robin, starting at entry #1 2015.10.09 09:05:42 LOG6[38]: s_connect: connecting 127.0.0.1:41952 2015.10.09 09:05:42 LOG5[38]: s_connect: connected 127.0.0.1:41952 2015.10.09 09:05:42 LOG5[38]: Service [myservice] connected remote server from 127.0.0.1:50503 2015.10.09 09:05:42 LOG6[38]: SNI: sending servername: localhost 2015.10.09 09:05:42 LOG6[38]: Certificate verification disabled 2015.10.09 09:05:42 LOG6[38]: Certificate verification disabled 2015.10.09 09:05:42 LOG6[38]: SSL connected: new session negotiated 2015.10.09 09:05:42 LOG6[38]: Negotiated TLSv1 ciphersuite AES128-SHA (128-bit encryption) 2015.10.09 09:05:42 LOG6[38]: SSL socket closed (SSL_read) 2015.10.09 09:05:42 LOG5[38]: Connection closed: 230 byte(s) sent to SSL, 505 byte(s) sent to socket I am tried verify = 1 to 4, either works. :( Best Regards, Adrian

2 3

Stunnel for windows dependencies
by test rig 09 Oct '15

09 Oct '15

2 2

stunnel 5.24 released
by Michal Trojnara 08 Oct '15

08 Oct '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear Users, I have released version 5.24 of stunnel. The ChangeLog entry: Version 5.24, 2015.10.08, urgency: MEDIUM * New features - Custom CRL verification was replaced with the internal OpenSSL functionality. - *BSD support for "transparent = destination" and client-side "protocol = socks". This feature should work at least on FreeBSD, OpenBSD and OS X. - Added a new "protocolDomain" option for the NTLM authentication (thx to Andreas Botsikas). - Improved compatibility of the NTLM phase 1 message (thx to Andreas Botsikas). - "setuid" and "setgid" options are now also available in service sections. They can be used to set owner and group of the Unix socket specified with "accept". - Added support for the new OpenSSL 1.0.2 SSL options. - Added OPENSSL_NO_EGD support (thx to Bernard Spil). - VC autodetection added to makew32.bat (thx to Andreas Botsikas). * Bugfixes - Fixed the RESOLVE [F0] TOR extension support in SOCKS5. - Fixed the error code reported on the failed bind() requests. - Fixed the sequential log id with the FORK threading. - Restored the missing Microsoft.VC90.CRT.manifest file. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: ab2e5a1034d422951ddad21b572eb7fa8efb4c4ce04bc86536c6845f3d02b07e stunnel-5.24.tar.gz f6c38d51c2708f3eddbad651091bf0b59e4149a1d0c1e3b227b033f126c6dbee stunnel-5.24-installer.exe ed2a2c5f280970bd5f5efcecbc1dbbd06f66efb68102af31c27d33e3beb48bb5 stunnel-5.24-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWFoHsAAoJEC78f/DUFuAUQrAP/iUz2fHvvjkIcJvoR2kMeJfZ NFHE/zGIP6qHbf5Fe5SvOA/ygzQcBppa+FJN9S0uL5z0rLkDghqeWoFzPfLIVrfM y2IJ4SZ1HEESyjaZkCxY0C7Ow1kKdlMPLHv81p+Tk/Zm4qKJ/lIkP+q7XMbNmWjW BOYBLeWPtro1OjKm7v07VkzRGJupj1PHjUgPDAQRxdzqsl6fO7xY9n8b9Nh7Cwc2 1mJhsx8J40M7abftYwpG6Mycu2EOo0lIJ9rm6xZahyekzatsaIhlw2o5gx5GWJvN xj9zpkxntTVQysgP4QVdJZ+Kl17ZZmOS4k+3OqXDgdt51Ck2ty46y9NbhkulIUA8 BzH3KXZCaiBFb/sPdBtW8qmvv0azJLR0b1HfKsZQrtIB/SH0slB9rgsLkidjekKG n7FHf5dlncfAbf8KstJRv41PTYcbtQMGI/+sre2YsqG2/MSJgPfCL2Wj0bTOSmOR 7t6jHX6SItnWtAJ4+3yhlh33B4WYOYBbu3FA3Pw7Wgxur9AOV63MH/Mf96KdMFGS dqoLQh+fp/KoSw1A9OUREtQnxHnbF5MMoU4Z1pTO0FxvdCMnYCg4okiwLqbOKcuM J0T543Deq9XU7v9jDkcgUyQzBYU8lG+G9UdSH11B8phuP7pBUQ35cd62Fl9NWv9I zNjRZIOnbBp6F6hqilb4 =F+az -----END PGP SIGNATURE-----

1 0

Log File Not Appending
by K Monz 06 Oct '15

06 Oct '15

Hi, I am a new STUNNEL user, so I apologize if this is a ridiculously simple and insignificant problem. I have STUNNEL running in a Windows 7 (32 bit) environment, and have the following in stunnel.conf: output = C:\STUNNEL\stunnel.log log = append The log file is placed where I've asked, but the contents represent only the most current STUNNEL execution. I am trying to have a running log in this file. STUNNEL is, of course, doing what it is supposed to do, it is only the logging that has me puzzled. Thanks, in advance.

2 1

Error on Windows 2008r2
by Chris 01 Oct '15

01 Oct '15

Just downloaded and installed the latest windows version. When trying to run stunnel I get the following error: The application has failed to start because its side-by-side configuration is incorrect..... When I check the application event view logs I see "Activation context generation failed for "C:\Program Files (x86)\stunnel\bin\stunnel.exe". Dependent Assembly Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8" could not be found. Please use sxstrace.exe for detailed diagnosis." It seems I might be missing a pre-req but I can't not determine what that is. Any ideas? Thanks, Chris

1 0

Support for DTLS
by Kanungo, Rajesh 25 Sep '15

25 Sep '15

Hi, I am looking for support for a DTLS proxy. Does Stunnel support DTLS and, if yes, how do I configure it? Here is the scenario: 1. Remote Server supports DTLS. 2. My client does not support DTLS (yet). Support all our platforms is a pretty arduous task. Possible solutions: 1. Ask customer to use Stunnel, drop DTLS and use plain UDP, and use Stunnel/TCP. Other clients support only DTLS so this does not work. 2. Use VPN. Requires customer configuration. Less painful than 1. 3. Use a UDP-DTLS proxy. Regards Rajesh Kanungo North America Security CTO Department, Itron, Inc. (408) 431-3035 Rajesh.kanungo(a)itron.com

1 0

Missing pid from log file since ~5.19
by Philippe Anctil 17 Sep '15

17 Sep '15

Hi, After upgrading to stunnel 5.19 I noticed the log file no long reports the pid of stunnel processes. Instead I find the constant string [0]. Sep 14 12:15:30 hostname stunnel: LOG6[0]: SSL closed (SSL_read) This information is very useful to isolate individual connections. Do later stunnel versions report the pid correctly? I am using fork mode. My syslog is defined as local6.debug and stunnel.conf contains debug=local6.info. Thank you. -- Philippe Anctil

2 3

How to install CA at client side?
by MingHeng Wang 15 Sep '15

15 Sep '15

Hello Stunnel maintainers, I try to use real certificates of my web server for stunnel. I combine private key, my site's cert, and ca-bundle into a pem file, and it works fine when the client doesn't verify any certificate. Then I specify CAfile which is the ca bundle file from my registrar, at client side and turn on verification and always get errors below, whatever level 2 or 3: Sep 15 14:53:28 y400 stunnel[11666]: LOG5[11]: Service [http-proxy3] connected remote server from 192.168.1.104:45746 Sep 15 14:53:28 y400 stunnel[11666]: LOG4[11]: CERT: Pre-verification error: unable to get issuer certificate Sep 15 14:53:28 y400 stunnel[11666]: LOG4[11]: Rejected by CERT at depth=2: However, level 4 works. I want to prevent man-in-middle-attack, so can level 4 achieve that regarding to my current setup? Both server and client side use stunnel 5.17 which are fairly recent.

2 1

Windows 2012 R2 Error on startup
by Han-Earl Guhm 13 Sep '15

13 Sep '15

I installed the latest version of stunnel and am having problems starting it up. I have attached an error log and my config file. I tested on Windows 7 and it worked with no problems, but I would really like it to work on my Windows 2012 server. Thank you, Han-Earl Guhm Coventry Christian Schools hanguhm(a)educatingforlife.com

2 1

The Error with Engine
by Donne, Ann 08 Sep '15

08 Sep '15

Hi all, Need your help. When I configured the Stunnel without the Engine LunaCA3 (product from SafeNet), everything worked fine. After add the global option with the engine: engine=LunaCA3 engineCtrl=SO_PATH:/usr/local/ssl/lib/engines/liblunaca3.so I got the following error. I also searched previous engine issues and saw someone else with the similar issues. Hope that the issue was resolved. The Stunnel and the open SSL info: stunnel 5.20 on x86_64 Linux. Compiled/running with OpenSSL 1.0.1i-fips. The setting is for server with sslVersion = TLSv1 and ciphers = AES128-SHA. 2015.09.08 11:11:01 LOG7[0]: SSL state (accept): SSLv3 read client certificate A 2015.09.08 11:11:01 LOG7[0]: SSL state (accept): SSLv3 read client key exchange A 2015.09.08 11:11:01 LOG7[0]: SSL state (accept): SSLv3 read certificate verify A 2015.09.08 11:11:01 LOG7[0]: SSL alert (write): fatal: bad record mac 2015.09.08 11:11:01 LOG3[0]: SSL_accept: 1408F119: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2015.09.08 11:11:01 LOG5[0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2015.09.08 11:11:01 LOG7[0]: Deallocating application specific data for addr index 2015.09.08 11:11:01 LOG7[0]: Local socket (FD=3) closed Any help and info are greatly appreciated!! Thanks Ann Donne ---------------------------------------------------------------------- This message, and any attachments, is for the intended recipient(s) only, may contain information that is privileged, confidential and/or proprietary and subject to important terms and conditions available at http://www.bankofamerica.com/emaildisclaimer. If you are not the intended recipient, please delete this message.

1 0

stunnel 5.23 released
by Michal Trojnara 02 Sep '15

02 Sep '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear Users, I have released version 5.23 of stunnel. The ChangeLog entry: Version 5.23, 2015.09.02, urgency: LOW * New features - Client-side support for the SOCKS protocol. See https://www.stunnel.org/socksvpn.html for details. - Reject SOCKS requests to connect loopback addresses. - New service-level option "OCSPnonce". The default value is "OCSPnonce = no". - Win32 directory structure rearranged. The installer script provides automatic migration for common setups. - Added Win32 installer option to install stunnel for the current user only. This feature does not deploy the NT service, but it also does not require aministrative privileges to install and configure stunnel. - stunnel.cnf was renamed to openssl.cnf in order to to prevent users from mixing it up with stunnel.conf. - Win32 desktop is automatically refreshed when the icon is created or removed. - The ca-certs.pem file is now updated on stunnel upgrade. - Inactive ports were removed from the PORTS file. - Added IPv6 support to the transparent proxy code. * Bugfixes - Compilation fix for OpenSSL version older than 1.0.0. - Compilation fix for mingw. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 0fc4a702afd2e857bae8ad1f39c51546eb282c3d0ff4f4d55d62aece7328ddea stunnel-5.23.tar.gz 40739ac4124bbe5192d7f68b020758295586ae65a16c1612829bffd1d3873363 stunnel-5.23-installer.exe 001e7d0a6d53b05b64fe62b0ca0623077d89f090b473e2cabed1eafa49196725 stunnel-5.23-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJV5q76AAoJEC78f/DUFuAUG54P/2ycqSOKbP3CN1MMKJj9NxBM 1uDuv/voF9OT/Y064X2bjy6dApo5HA9a4VHr1EaF+3x+Wofemhc5puLsgbfuFJKl nogN8cNdR2sk+GLooytfKp+jRZ8NAl2Rv5lLi/YE57RsMe91wI5kRxWKpeIDeG4L y7LhsCLmHNYkffsGSeOaXfc3rBBWOY39Lc78t3kezK14jIGZiCH/V32HRHMaWGiw 9oLBIRxGOVAscKcC2+MOGtXelKeJFrnAfW+v6qcZE1/SL4JnGHz8jBxOcvFbfrko 5yJfWYpgQg7NeLNovY+o1EXVxxw4Ty9ppLob9cRTGmx1Fgb6eE1uYVSAbx53lYKF 2z0J2MkKgMj07Mao5j45DiqRqa/kWDzKIN4sTCm5atDKB2ozrcfuDLLEU3W6XKrw 7XHPSs+FdkXQXYsfK7wbftLKfNEu8ojGKyMTMuKQcX/SkxyQuV6rYXA8gBm3HJCY dNp5lU5FdoiMv9S+uQpDL2j9GjOSNAV7qPzyRk8ivl1a1LonkbjQxHApvktSwkHt Gey6xweW5vt7FsKb15mFhx6ctBldM9lR7u4EacXWy+hq5UY6/5Rr/rbyCkCvG/NU Oq5LD2bqX22Xl4XeiVCW2gpLcqPWdbREY3YklGt22ln+PdyA+iGpxbeczUHjV5qX a6P76JpGk/pL5lhWfRV4 =i2gK -----END PGP SIGNATURE-----

1 0

(no subject)
by Eric Poythress 02 Sep '15

02 Sep '15

I am having some issues with getting Stunnel to work for my application. I'm using a logger that is able to email out alarms but it is not encrypted. I have Stunnel on the PC that connects to the logger. Both are able to see each other just fine but I have the following error in the log: Service [SMTP Outgoing] needs authentication to prevent MITM attacks I only want mail to go out and on the logger side of things my only inputs are SMTP Server, Use SMTP Authentication check box, Username, Password and Port. Any help or suggests would be greatly appreciated. Thank you, Eric Poythress Test Manager 1600 West Tacoma Street Broken Arrow, Oklahoma 74012 [Description: Air Hygiene Office - email signature] Direct - (918) 994-4171 Fax - (918) 307-9131 Mobile - (573) 587-0226 Toll Free - (888) 461-8778 virtual tour Air Hygiene: http://host.newspin360.net/airhygiene/ e-mail: epoythress(a)airhygiene.com<mailto:[email protected]> website: www.airhygiene.com<http://www.airhygiene.com/>

2 3

Security suggestions on stunnel with SSL/TLS and SNI configuration
by Secure-Mail User 28 Aug '15

28 Aug '15

2 2

Re: [stunnel-users] stunk closing connections with RST
by Ade Ajibade 26 Aug '15

26 Aug '15

> > Hi All, > > I am having the same problem in my lab. > > I am trying to set up a secure connection between my Bluecoat proxy and stunnel running on windows. I need to encrypt the connection between the 2 devices. > > I am new to stunnel. > > My Bluecoat is configured to do health checks to the stunnel on the specified stunnel port. However every now and again, it reports the server is down. Looking at the capture, I can see the stunnel is sending RESETS back to the proxy. > > The TLS connection to the proxy appears to be working fine. But I need to be able to monitor the servers health. > > How do I do this? > > You have mentioned in your post the stunnel configured of client = yes. > > On what side does this need to be configured and what exactly does this mean? If it is configured as client = no what will be the implication. > > I have been looking at how you solved the F5 issue but how does that apply to what I am doing from my proxy. > > Please any help will be useful. I just subscribed to your site. > > Thank you > > > > Adekunle

1 0

New Windows installer
by Michal Trojnara 19 Aug '15

19 Aug '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have performed a major rewrite of the stunnel installer for Windows. It now allows installing stunnel for all users (as before), and also for the current user (in the user's home directory). It also no longer installs all the files into a single directory. The installer attempts to automatically migrate the previous layout into the new one. https://www.stunnel.org/downloads/beta/stunnel-5.23b4-installer.exe Please give it a try and let me know your comments and any bugs you can find. Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVziEpAAoJEC78f/DUFuAUFFIP/1CN9Bh5PFvpUlmnC67exLA4 CfPLXK4jj3PjFISF3scKAGJJjaCmyWQzF3mmTTn5HXprCfwOtZXf3jJQVI0YFZjE 8OgxpdcWhAyuOr2wQLSs5DX+WBILuxHBpIIJrjYIlrAsKMwmB7ucLHf17K+AkCjb j++ctJdFDQygpX0w9Qp0oyIbiEGlgaFHAn/aeYKdLSzTGaDkTptswMsM+SZzNcHF bK9VxQ15xFE6EwOp45roxc7eMuOd6VGQ9uyj1DcLaHygE0m5ALzXFN2Xsnii9UIq ZbzoOMBYlGYAya8Hbgrrb3D+53CwwQrhjVgE27FbMp3qc4ijboaBlfSzd+Bci3Rg B84EkJjBNC1cOcl5JvB/QAuJgXReBbFecS5+8PYNTzii6HU4bFXKb9JlbxCA7eGm HiCkn+DM4GJ3RXtWYjcyWfhlgCx69SUaEJvtphHl9QLbyGnDsJTE7rLlmpnp4B2N MNvZFhxuZrBsMmDRydQSYKaJ7S5e9H6soi630OfLxHDIbOGD+vDVvO9XrjtdYWBO 6Fm4ed0lDuTcqTzCxy93vbwPkWzvPyOykQPCED/UQ1RgtC8AIi6JVXhCwLs30pwj rSHgBKGxC5E19MXYwrNq3cr0nJdkw4oh8NShaXiplfhdCMdjRZHZz1HpbQzW0WP/ Z5BrUzv9yYpA/aAk4r7V =RSFJ -----END PGP SIGNATURE-----

2 3

net::ERR_TIMED_OUT error when connecting to a websocket via stunnel
by Mike Alhayek 17 Aug '15

17 Aug '15

Hi, I hope someone can help me here as I have been stuck for the past 3 days. I need to allow a client to connect to a websocket running on server 10.0.4.160 on port 8080. I need to setup a secure tunnel to allow the client to connect to the websocket via port 58443. I installed the latest version of stunnel on my windows Server 2008 R2. Then I changed my stunnel.conf file to look like this [websockets] client = yes accept = 58443 connect = 8080 verify = 2 checkIP = 10.0.4.195 CAfile = ca-certs.pem debug = 7 OCSPaia = yes ##The rest have been removed I am expecting to open a connection from the user's console on port 58443 and the stunnel will allow the client to connect to port 8080 This is the code that I use in the client's console "Of course, the console is on a PC that is on my internal network" var conn = new WebSocket('wss://10.0.4.160:58443'); conn.onopen = function(e) { console.log("Connection established!"); }; conn.onmessage = function(e) { console.log(e.data); }; While on the server, I open up a command line and I execute this telnet localhost 8080 to open up a command line where I can see the incoming request. As soon as I fire the code above from a client javascript's console I see this in the server's command line [cid:[email protected]] But few seconds later I get this error in the client's console WebSocket connection to 'wss://10.0.4.160:58443/' failed: Error in connection establishment: net::ERR_TIMED_OUT If I try to send a command using conn.sent('Hello') I get this error VM289:2 Uncaught DOMException: Failed to execute 'send' on 'WebSocket': Still in CONNECTING state. at Error (native) at <anonymous>:2:6 at Object.InjectedScript._evaluateOn (<anonymous>:905:140) at Object.InjectedScript._evaluateAndWrap (<anonymous>:838:34) at Object.InjectedScript.evaluate (<anonymous>:694:21) Additionally, I tried to turn on debugging in strunnel by adding debug = 7 to the config file This is what I got in the stunnel console. I don't understand what is wrong as the logs show that the client is connected but I can't send messages from the client to the server 2015.08.16 16:40:06 LOG7[36]: Service [websockets] started 2015.08.16 16:40:06 LOG5[36]: Service [websockets] accepted connection from 10.0.4.195:21963 2015.08.16 16:40:06 LOG6[36]: s_connect: connecting 127.0.0.1:8080 2015.08.16 16:40:06 LOG7[36]: s_connect: s_poll_wait 127.0.0.1:8080: waiting 10 seconds 2015.08.16 16:40:06 LOG5[36]: s_connect: connected 127.0.0.1:8080 2015.08.16 16:40:06 LOG5[36]: Service [websockets] connected remote server from 127.0.0.1:50891 2015.08.16 16:40:06 LOG7[36]: Remote socket (FD=668) initialized 2015.08.16 16:40:06 LOG6[36]: SNI: sending servername: localhost 2015.08.16 16:40:06 LOG7[36]: SSL state (connect): before/connect initialization 2015.08.16 16:40:06 LOG7[36]: SSL state (connect): SSLv2/v3 write client hello A What am I doing wrong here? How come the connection keeps failing?

1 0

Accept connection from sub-net?
by v v 12 Aug '15

12 Aug '15

Hi, Is it possible to configure stunnel server to accept connection from any IP in some subnet. For example, 111.22.33.xx. The proxy I connect through every time uses the different IP (from some IP pool) to connect to stunnel server. I don't want to add to the config file 255 possible host addresses. I don't see any suitable option in the stunnel documentation. Do I miss something? Any idea it could be done? Thanks, vov

1 0

Problem in connecting with root directory with stunnel connection in Mac OS
by Saurabh Beriwal 07 Aug '15

07 Aug '15

Hello All I am installing stunnel as client in Mac machine. I am using below configuration. accept=127.0.0.1:119 connect=target server information I am able to start stunnel service and its getting bound also. Now when I try to open the remote server directory with root folder , this does not work. However if I specify a shared folder name then this does work. I am facing this problem in Mac OS 10.10. smb://127.0.0.1:119/ does not work. smb://127.0.0.1:119/folderName works fine. However, both cases work fine in case of windows using stunnel. Please let me know if someone has faced similar issue in Mac OS with stunnel connection. Kindly help. Regards Saurabh Beriwal

1 0

STunnel nCipher openssl chil problems
by Marc Phillips 06 Aug '15

06 Aug '15

Has anyone managed to get STunnel to work with nCipher using the chil engine? STunnel appears to load the engine just fine, but failes when loading the key: [ ] Enabling support for engine "chil" [ ] Initializing engine #1 (chil) [ ] Engine #1 (chil) initialized [.] FIPS mode disabled [ ] Compression disabled [ ] PRNG seeded successfully [ ] Initializing service [https-server] [ ] Loading certificate from file: /usr/local/stunnel/etc/keystores/servercert.crt [ ] Loading key from engine: /usr/local/stunnel/etc/keystores/servercert.key [!] error queue: 26096080: error:26096080:engine routines:ENGINE_load_private_key:failed loading private key [!] ENGINE_load_private_key: 80069066: error:80069066:CHIL engine:HWCRHK_LOAD_PRIVKEY:chil error [!] Service [https-server]: Failed to initialize SSL context Using openssl directly, the key works fine (both with s_server and s_client). My stunnel config is pretty simple: pid = /usr/local/var/log/stunnel.pid debug = 7 output = /usr/local/var/log/stunnel.log options = -NO_SSLv3 engine = chil CApath = /usr/local/etc/cacerts/ [https-server] engineNum=1 accept = 4466 connect = 4433 cert=/usr/local/stunnel/etc/keystores/servercert.crt key=/usr/local/stunnel/etc/keystores/servercert.key R. Marc

1 0

Install Guide for STunnel Version 5.22
by Deepak Subbanarasimha 05 Aug '15

05 Aug '15

All, Is there an install guide for Stunnel version 5.22 for windows? If so, could you point me to it? -Deepak IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately return the original message to the sender at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Although Kewill takes reasonable precautions to minimize the risk, Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code.

2 2

"Chained" stunnel instances
by Michael Gebis 01 Aug '15

01 Aug '15

Hello. I have a question about a strange stunnel configuration; specifically, I'm like to use 'chained' stunnel instances, and I'm running into an issue. We have a conceptually simple setup: a client that connects to a server. We use stunnel both for encryption and for the failover mechanism. Here's a diagram of our simplest setup: /----S1 / C--st0-----S2 \ \----S3 We have a client that connects to stunnel. Our stunnel configuration lists three connections with "prio" failover mode. So usually, connections go from C thru st and onto Server 1. If S1 is down, st0 fails to connect to S1 and instead tries S2, and all is good. However, sometimes we may place an optional second instance of stunnel in front of the servers. /----st1--S1 / C--st0-----st2--S2 \ \----st3--S3 The failover mode of stunnel does not work so well in this configuration. If S1 is down, st0's failover algorithm does not kick in. Instead, st0 happily connects to st1, which is still alive and running. st1 then detects S1 is down and immediately closes the connection, but st0 does not care. Since the initial connection was successful, it does not initiate the failover algorithm. You may ask "why not change to round-robin mode?" The answer is that S1 is a dedicated machine, and S2/S3 are underpowered backups that have other primary responsibilities. We really want to direct all connections to S1 and only use S2/S3 in emergencies. You may also ask, "Why the second layer of stunnel?"--unfortunately, there are several hairy implementation-specific details that make this hard to change. My question is: is there any stunnel configuration option that can help us out? We would like the failover to work with and without the second layer of stunnel. From looking at the source code, I think I'm out of luck, but I figured it couldn't hurt to ask. Thanks! Michael

3 3

stunnel 5.21 - fails to listen on both IPv4/IPv6 (Linux)
by Lonnie Abelbeck 30 Jul '15

30 Jul '15

Very long-time user with the AstLinux project... stunnel 5.19 works fine, when upgrading to stunnel 5.21 with the same config I get: -- Starting Stunnel Server Proxy... [.] stunnel 5.21 on i586-pc-linux-gnu platform [.] Compiled/running with OpenSSL 1.0.1p 9 Jul 2015 [.] Threading:FORK Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI [ ] errno: (*__errno_location ()) [.] Reading configuration from file /etc/stunnel/server.conf [.] UTF-8 byte order mark not detected [ ] Compression disabled [ ] PRNG seeded successfully [!] Error resolving "::": Address family for nodename not supported (EAI_ADDRFAMILY) [!] /etc/stunnel/server.conf:14: "accept = :::8443": Failed to resolve accepting address -- Has the syntax changed to listen on both IPv4/IPv6 ? Lonnie

2 2

Configuring stunnel on multi tenant server
by Saurabh Beriwal 30 Jul '15

30 Jul '15

Hi All, I want to configure stunnel on multi tenant server. Please let us know the best possible way to do this. Also is it OK if I keep multiple accept and connect parameters in stunnel configuration file. Thank you.

2 1

stunnel 5.22 released
by Michal Trojnara 30 Jul '15

30 Jul '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.22 of stunnel. The ChangeLog entry: Version 5.22, 2015.07.30, urgency: HIGH * New features - "OCSPaia = yes" added to the configuration file templates. - Improved double free detection. * Bugfixes - Fixed a number of OCSP bugs. The most severe of those bugs caused stunnel to treat OCSP responses that failed OCSP_basic_verify() checks as if they were successful. - Fixed the passive IPv6 resolver (broken in stunnel 5.21). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 8ad628a6948153cdb2044283f6988384a30585ea7e14778c2ee616a6678cb83f stunnel-5.22.tar.gz 9b3fe70bcfeb64b013b7b926e475a7d100ef1fdf5ce352ad90ac1034f780ea2a stunnel-5.22-installer.exe 2f49313debe7af27feeab246a771dc513e5e368e1839e92fba4cfe0b2735aeba stunnel-5.22-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVufy2AAoJEC78f/DUFuAUHVYQAK+keyqWyllv3ky5hRi8DlXe LLtuUdTYTalI64Fg5/TYL6+fbrEjWoAWtGwg+X/muVNj7KW4twlKrakMtkDpSDNd 0xSh94/u/PCrPVThxCq7AUbTPLyrG6ox5RKYDkOKfyGQ3q5ix6yba0l6fQqHXPCr OAbaRuwn5U6u7lPxXa69ozwyY5JHIiGqhMfQJBRXwFoeNbWak3HM7+Pe5DZ0ACLa SRY0iCseR1aQ12pZaaNoknkAAL9kmHgRP+fuPFqKMkp8TgZ2469qg30s/Bzn7n0U h5GvAuhYkQdDDbC7ozWgqaNxRNpOe+3RZ50fpCueyAlZESe8agHcyXchoj4JUVx+ 5ihOms4WujamCtP4MzHrRo6eQpeoGbw1EZ2P//Q9TlxX4METgEfV0lzaR7n376jr y24xIFEMl2tnqJ81lKQZWlxAP4MiKZgr//GOueRewRCtYSSQcK/mHvxZMDFfHAc7 N2LUmzm+PpsHwto7VkUy1m4eEAb34Tr3QubzvrT1yD4YMQDR6tID+xkRmuJWjMhf qBcXecKetIQq70KuI+VVqJxdP3Ekgjb+xnNOSKelUP/TkHpvubjTViSIVPu+5DSb x2viDBKAbgWcER2aZsB6UWXfQwjT/apDhqu6XrwjAcFfBk0ul0QazmH0HMc9ouVd yziOHVATYgcXYcTIQvj9 =DTOg -----END PGP SIGNATURE-----

1 0

Questions between stunnel 4.56 and 5.21 (current version)
by Guy.Gaudreau.TCR06＠ssss.gouv.qc.ca 28 Jul '15

28 Jul '15

Will a 4.56 installation be able to establish a tunnel to a 5.21 version. Will a 5.21 installation be able to establsih a tunnel to a 4.56 version What happends If I have a server that is currently running a 4.56 version and we install the 5.21 version on the same server. Will both versions co-exist on the same server peacefully or will the install process uninstall the 4.56 version. in that last scenario will the tunnels already configured under versio 4.56 work under the 5.21 install? Thank you Guy Gaudreau

1 0

stunnel 5.21 released
by Michal Trojnara 27 Jul '15

27 Jul '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.21 of stunnel. The ChangeLog entry: Version 5.21, 2015.07.27, urgency: MEDIUM * New features - Signal names are displayed instead of numbers. - First resolve IPv4 addresses on passive resolver requests. This speeds up stunnel startup on Win32 with a slow/defunct DNS service. - The "make check" target was modified to only build Win32 executables when stunnel is built from a git repository (thx to Peter Pentchev). - More elaborate descriptions were added to the warning about using "verify = 2" without "checkHost" or "checkIP". - Performance optimization was performed on the debug code. * Bugfixes - Fixed the FORK and UCONTEXT threading support. - Fixed "failover=prio" (broken since stunnel 5.15). - Added a retry when sleep(3) was interrupted by a signal in the cron thread scheduler. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 2aef568b1955f5e233f6a8e17ebce3d30755f1be44c813f5a48e621f785596e3 stunnel-5.21.tar.gz d5ec83140060af2b373a82abab0f7fd34c76a68c4f2990d46be460526b325de6 stunnel-5.21-installer.exe 2788d9e11b65dd4b111616bab1d7f09943916c924ba023cc3ad4260ac1f6f6d7 stunnel-5.21-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVtfz2AAoJEC78f/DUFuAUey4P/0tQ8yj3Yt7K5yLIorDGu9lI w95Vs2MtyOvFQyoX24dPKrDULKmxE28Dg8RJt51ZuT9q8mIfPdBA+jphyfjbpzl0 BeNQNbzEfN36dhOa2+dvr4+fcna/lnRpNMQg6sP/z4KHDLoI72lAg9vVwv5VX/4X JAMAaTxbrOXuXOmVPLSdHBeug7Y/0Q/+jPg9tSEslMtBaJvMd4CcHs4q8dCW9OQv AUWLtOiSsubfCvQ9rwGODObFJCA3BINrmh3a9EyhKJTov+8JKHlJY02r4zGJYMC4 PIVAVZWit9mEFefG6BuEWwOw4gohAInDXpsN2X9BNNDfUAVlUtp6OoxATcGv/H45 Uf25Dz2Bu8WtKIuuCIhN79PBfqSG8f2mSwNsec8OcYNOTzkAHKoFQQfKbJ1FUD5+ lTBhOFfo/B5haQA1EHNf0z8JxDulnsL7JsQQo4hF3ShSiCZpEAVvSkixpwCjm2kR WCtQ0w5eLccD/CnfjNrcOp3QKGLacZ+PCm9MH+cQDQvnmhAaelWK+OL67L9FKwBf hbJMA2RwwjN7efwEeUlnzVTBiJS9fsPTJghh8CzYuDWlnhEEnB9WX2FI1yVZVxM+ 8tGifpdOkRCFhpQSQkj0pWy/qf/cU8mL2uM31hBNcsRjCt6PfjQfKQ7jyMFvicmc rWJhvWvAfLAJXl+rgn5r =WvhQ -----END PGP SIGNATURE-----

1 0

Disable TLSv1
by Smith, Michael 23 Jul '15

23 Jul '15

I am running stunnel version 5.20. How do I disable TLSv1 and leave only TLSv1.2 and TSLv2 enabled? Michael Smith System Specialist II 281-283-2930

2 1

Question about behavior with "failover = prio"
by Michael Gebis 22 Jul '15

22 Jul '15

Hello again. We recently noticed a behavior in stunnel that surprised us, and seems to be inconsistent with the man page description. We use "failover = prio" in our configuration file. To refresh everyone's memory, the man page describes this option here: failover = rr | prio Failover strategy for multiple "connect" targets. rr (round robin) - fair load distribution prio (priority) - use the order specified in config file default: rr Our config file contains a list of connect targets, like this: [...] connect = h1.example.com connect = h2.example.com connect = h3.example.com connect = h4.example.com [...] Based on the description, we expect the connection to try h1 first, and if h1 fails, failover through the remainder of the list, in-order. However, what we observe is that the connections start at a seemingly random place in the list. It does appear to proceed in-order...it's just the starting place that seems incorrect. For example, we might get a sequence that proceeds "h3->h4->h1->h2". Please let me know if I am misunderstanding the intended behavior of the 'prio' failover strategy. Here is a trial patch that hard-codes the starting place for the failover to the beginning of the list. I am not sure if this change has any unintended consequences for other configurations. But as a proof-of-concept, it does seem to fix the behavior to be consistent with our reading of the man page. This patch is against 5.20 but it appears that 5.21b2 acts the same way. Thanks! Michael diff -ru stunnel-5.20.orig/src/client.c stunnel-5.20-prio-fix/src/client.c --- stunnel-5.20.orig/src/client.c 2015-07-16 15:55:52.213064746 -0700 +++ stunnel-5.20-prio-fix/src/client.c 2015-07-17 16:13:12.129184507 -0700 @@ -1285,7 +1285,8 @@ *c->connect_addr.rr_ptr=(i+1)%c->connect_addr.num; s_log(LOG_INFO, "failover: round-robin"); } else { - s_log(LOG_INFO, "failover: priority"); + s_log(LOG_INFO, "failover: priority, starting at first entry"); + i=0; } return i; }

2 1

stunnel 5.20 issue using "--with-threads=ucontext"
by Michael Gebis 21 Jul '15

21 Jul '15

Hello. We recently upgraded from stunnel 5.10 to 5.20. We compile using "--with-threads=ucontext" and with this flag, compilation of 5.20 fails in two places. Both failures seem like minor oversights. Here is a proposed patch to fix the two failures. This patch is against 5.20, but I just checked the most recent 5.21b2 and it appears to require the same changes. Thanks! Michael diff -ru stunnel-5.20.orig/src/cron.c stunnel-5.20-ucontext-fix/src/cron.c --- stunnel-5.20.orig/src/cron.c 2015-07-16 15:55:52.214064748 -0700 +++ stunnel-5.20-ucontext-fix/src/cron.c 2015-07-16 16:15:56.593107354 -0700 @@ -47,7 +47,9 @@ #if defined(USE_PTHREAD) || defined(USE_WIN32) NOEXPORT void cron_worker(void); NOEXPORT void cron_dh_param(void); -#endif +#elif !defined(OPENSSL_NO_DH) +NOEXPORT void cron_dh_param(void); +#endif #if defined(USE_PTHREAD) diff -ru stunnel-5.20.orig/src/tls.c stunnel-5.20-ucontext-fix/src/tls.c --- stunnel-5.20.orig/src/tls.c 2015-07-16 15:55:52.180064660 -0700 +++ stunnel-5.20-ucontext-fix/src/tls.c 2015-07-16 15:56:30.520164252 -0700 @@ -110,7 +110,7 @@ if(ready_head) ready_head->tls=tls_data; else /* ucontext threads not initialized */ - global_tls=tls; + global_tls=tls_data; } TLS_DATA *tls_get() {

2 1

Unable to open log file
by Matt brancato 16 Jul '15

16 Jul '15

Hi all, Did a search but didn't see an answer so i figured i'd ask. I'm trying to runstunnel but am having some issues. I attempt to run stunnel but i run into an issue where it can't read the log file and then closes up. Any ideas? sudo stunnel stunnel.conf [ ] Clients allowed=500 [.] stunnel 5.19 on x86_64-unknown-linux-gnu platform [.] Compiled/running with OpenSSL 1.0.1 14 Mar 2012 [.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*__errno_location ()) [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark not detected [.] FIPS mode disabled [ ] Compression disabled [ ] Snagged 64 random bytes from /root/.rnd [ ] Wrote 1024 new random bytes to /root/.rnd [ ] PRNG seeded successfully [ ] Initializing service [<service>] [ ] Loading certificate from file: /etc/stunnel/server.pem [ ] Loading key from file: /etc/stunnel/server.pem [ ] Private key check succeeded [ ] DH initialization [ ] Could not load DH parameters from /etc/stunnel/server.pem [ ] DH parameters will be generated [ ] Cron started [ ] ECDH initialization [ ] ECDH initialized with curve prime256v1 [ ] SSL options: 0x03004004 (+0x03004000, -0x00000000) [.] Configuration successful [ ] Listening file descriptor created (FD=7) [ ] Service [<service>] (FD=7) bound to 127.0.0.1:9999 [ ] Executing cron jobs [.] Updating DH parameters [!] Cannot open log file: /home/tim/Desktop/stunnel.log [ ] Closing service [<service>] [ ] Service [<service>] closed (FD=7) [ ] Service [<service>] closed -- *CONFIDENTIALITY NOTICE* THE INFORMATION CONTAINED IN THIS COMMUNICATION IS INTENDED FOR THE NAMED RECEIVER ONLY. THE TRANSMISSION MAY CONTAIN PRIVILEGED AND CONFIDENTIAL MATERIAL. IF YOU ARE NOT THE NAMED RECIPIENT, PLEASE BE ADVISED THAT ANY USE, DISSEMINATION OR UNAUTHORIZED COPYING OF THE MATERIAL IS STRICTLY PROHIBITED. IF YOU HAVE RECEIVED THIS TRANSMISSION IN ERROR, PLEASE NOTIFY SUPPORT(a)TRUEEX.COM AND DESTROY THE RECEIVED COPY. THANK YOU.

1 0

stunnel 5.20 released
by Michal Trojnara 15 Jul '15

15 Jul '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.20 of stunnel. The ChangeLog entry: Version 5.20, 2015.07.09, urgency: HIGH * Security bugfixes - OpenSSL DLLs updated to version 1.0.2d. https://www.openssl.org/news/secadv_20150709.txt * New features - poll(2) re-enabled on MacOS X 10.5 and later. - Xcode SDK is automatically used on MacOS X if no other locally installed OpenSSL directory is found. - The SSL library detection algorithm was made a bit smarter. - Warnings about insecure authentication were modified to include the name of the affected service section. - A warning was added to stunnel.init if no pid file was specified in the configuration file (thx to Peter Pentchev). - Optional debugging symbols are included in the Win32 installer. - Documentation updates (closes Debian bug #781669). * Bugfixes - Signal pipe reinitialization added to prevent turning the main accepting thread into a busy wait loop when an external condition breaks the signal pipe. This bug was found to surface on Win32, but other platforms may also be affected. - Fixed removing the disabled taskbar icon. - Generated temporary DH parameters are used for configuration reload instead of the static defaults. - LSB compatibility fixes added to the stunnel.init script (thx to Peter Pentchev). - Fixed the manual page headers (thx to Gleydson Soares). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 4a36a3729a7287d9d82c4b38bf72c4d3496346cb969b86129c5deac22b20292b stunnel-5.20.tar.gz 9d9d38241e972713cd0937e2cf66fdacf3adcb357fbea82d8e46648de4e26fa4 stunnel-5.20-installer.exe cfc1e94cb7c7bf14c832ac8799db4a3438ae7542aa04ec5e9c6695a1a3c3843d stunnel-5.20-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVnoXOAAoJEC78f/DUFuAUGvoP/1WQ2DliVyQQNGDYPkE2Rbqk BJ7lMEseYdPLjZVtkNPQIuH9PCc/qbWMrDFK1sJg+R7d0yyp+Ip+ucH4i5GCfW6o xIZQ00WVa/qV52AcEDGTZ+43EBPBIFNMkSeJlkwyj81ISZ+my0YpqPNSF77fZFdN IqGln9e+1n4gM+8SOgPnJs2XiR2EsbQzmwaZcTCOoKp56j6q2bLXlYC802B9KezJ ex2dmbGV2JEHmNarSUxWO45VnFdqhjhz4qHySm6KnLD2hoyS9Ex2XyynuuyIiIVx yU9M1zliZvgQSQ4RTpO3Ko2b9Qy2cYDECrFwk7i5rlwmiCw1zH5zWGh1rnAsLJHn 7SAxc5BfiB3VQl16CgoLM65no2mJ60f499ab3LA0uTNbt03PrPkc5cK8w+ec3YNU 6E59R4FXC6ae5T4iR7b9mBGifUHWtg53I1H7qbD6Pye/EH5QciSSPizEHeORYlPy fC3jOMEIUDlXjqI7k/XMGVPJ7SSKFkBNiqHKTKoM12QhiZXLLh4Ig3aQJgqX5IBQ VdML1/W9MdBlZNAHYaUBrkSls99aVbIsHJ5yAE0gsF5Lgi6hK6zDkXiKoVEozN5A N6MtfQHs/JS2nvlmCbtGWrK66EXKxW409f0JS3AJG6tjOquuSZYmR944EPzQD+zA WPivIUH2TVk63kULw/ui =Uw+D -----END PGP SIGNATURE-----

3 10

keyfile is not encrypted
by Madhava Gaikwad (madgaikw) 15 Jul '15

15 Jul '15

Hello, I am asking too much, but keyfile with stunnel is required to be stored on disk (I am aware about file permission applied) and is in plain text. Is there any way we can encrypt the keyfile and then store, and then subsequently ask stunnel to obtain the decryption key somehow and then use it. For encryption/decryption of the key, stunnel (or some other program) can give network based ability(service over socket) to provide the key so key can be encrypted by the third party(who generates the config for stunnel). Stunnel config option will specify key is encrypted and therefore stunnel knows why and how to decrypt it. Of course you will ask me to implement my own custom algo for this, but I am checking if anybody has thought about it or in such case, how they have worked on it. I was told, there is also basic level of FIPS compliance requirement that requires key not to be stored on disk in plain text irrespective of file permission. Thank you. Madhava

2 1

please remove me from the mailing list
by Kjell Osness 14 Jul '15

14 Jul '15

Thank you. Kjell Osness IT Technician American Home Entertainment cell (619) 520-9417 office (858) 430-1701 fax (858) 430-1702

1 0

help on options and sslversion
by Madhava Gaikwad (madgaikw) 13 Jul '15

13 Jul '15

Hi, I am using stunnel 5.03 version. I want to understand how the config option "sslVersion " and "options " works. The problem I am trying to solve is: I want to enable say only particular ssl connect methods, for example sslv3 and TLs1.2. I am not able to do it. For me if I do below setting: Options = all Option = NO_SSLv2 Option = NO_SSLv3 Option = NO_TLSv1 Option = NO_TLSv1.1 Option = NO_TLSv1.2 Still I see all methods are being enabled. I removed Option = all, but no effect. What is expected behavior? Also, The sslVersion seems enables either particular sslversion, or else all the versions. So wondering what can be the escape mechanism. Any help will be highly appreciated. Thank you. Madhava

2 2

"make check" tries to build Windows binary on Unix
by Dagobert Michelsen 13 Jul '15

13 Jul '15

Hi, I just tries to build stunnel 5.20 on Solaris 10 Sparc and noticed a strange behaviour during „make check“ which yields in a try to build Windows executables: > dam@unstable10s [unstable10s]:/home/dam/mgar/pkg/stunnel/trunk/work/solaris10-sparc/build-isa-sparcv8plus/stunnel-5.20 > gmake check > Making check in src > gmake[1]: Entering directory '/home/dam/mgar/pkg/stunnel/trunk/work/solaris10-sparc/build-isa-sparcv8plus/stunnel-5.20/src' > gmake stunnel.exe tstunnel.exe > gmake[2]: Entering directory '/home/dam/mgar/pkg/stunnel/trunk/work/solaris10-sparc/build-isa-sparcv8plus/stunnel-5.20/src' > i686-w64-mingw32-gcc -c -I/usr/src/openssl-1.0.2d-i686/include -mthreads -fstack-protector -O2 -Wall -Wextra -Wpedantic -Wformat=2 -Wconversion -Wno-long-long -D_FORTIFY_SOURCE=2 -DUNICODE -D_UNICODE -o tls.obj tls.c > /bin/bash: i686-w64-mingw32-gcc: command not found > Makefile:1206: recipe for target 'tls.obj' failed > gmake[2]: *** [tls.obj] Error 127 > gmake[2]: Leaving directory '/home/dam/mgar/pkg/stunnel/trunk/work/solaris10-sparc/build-isa-sparcv8plus/stunnel-5.20/src' > Makefile:1054: recipe for target 'check-am' failed I think this comes from these lines in src/Makefile.am: > # Just check if the programs can be built, don't perform any actual tests > check_PROGRAMS = stunnel.exe tstunnel.exe Essentially the „check“ phase could just not be called during build, but it would be cleaner to not bail out on Unix. Best regards — Dago -- "You don't become great by trying to be great, you become great by wanting to do something, and then doing it so hard that you become great in the process." - xkcd #896

3 6

Re: [stunnel-users] problem with buffering data on stunnel
by Michal Trojnara 10 Jul '15

10 Jul '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 10.07.2015 20:17, wujot/Adalbert wrote: > But unencrypted session on path between Stunnel server and hi-speed > end server (both in LAN) is using TcpWindowSize on level 64KB - > 131KB Did you consider also tuning SO_SNDBUF of the sending application? > (in Windows 2008 or newer it is calculated automatically). So I > steel have at least 64KB buffer in stunnel. IMHO Windows is probably not the best server platform... > Is there any possibility to force stunnel to use on faster part of > connection (LAN side) the value of TcpWindowSize similar to > calculated on slower part (on WAN side)? I don't think such tricks are possible with BSD sockets. BTW: You can also change BUFFSIZE in common.h and rebuild stunnel. Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJVoDm6AAoJEC78f/DUFuAURJQQAM1ix6ZkSqOCa9iLiBDIFvrS DajgeGDGeSE75WkyI+IQrPYjWJGNielOeXhCPjYdQh+5o/bddYPaRlQRsu0HlY6F Nncj1kP8Xy0WNO4uxz1YWpnnJtE/Ph9VUVLqS/63tJgkrhmvXF1HODeu677JLzEb wjOn0kv6SmPnzkFMpjbBmkRPt5GeSRc43POGoHcuqFKijeaTDGoqhBLo+tGLhtNV ezYN+QFvyyzMVPe8tscWa+vyXYdbMzgLBXXCHFMbFmlpu6QKHKb0823Q7g7OgMCb DYkVbw0a0ys6hdreBHejvAbgfG8fTKOtYfdOa7lnjCuivGpVKLa018yTk/1qjUbs dmr08MFPGkkMSfV/sQ+PMgZ0Dxaoczt1yXanzURNDXC4eiUlgEXfs4S5J2NYxTOe g4ZG7ZXQIHrux1AcQD9TQF+G9h7YxXeRMt0K29qA54dH+x+Xie920OJMXohMAZJ0 ddkblmt7SHO2XiEV6C2ie1VvB/roZ+aeqKQME4T8oZliy/kaDgXgs/eFLT2Kxw9B WwlWt4r4pLHFkJfExJF/nMWe0qRt/tlVoqyvOFE1hnTxOGr5pGLnY0XOoHX13kr/ ow1TC0N0UPWV++Uydm2oJwXA+o7a/TRs8O+PEhhHTqLDi4O/apC7kL9fM6DjESGr Zj+br1nUiaF+LscAiC/D =kA2M -----END PGP SIGNATURE-----

1 0

Cannot open log file
by Matt brancato 10 Jul '15

10 Jul '15

Hi all, Did a search but didn't see an answer so i figured i'd ask. I'm trying to run stunnel but am having some issues. I attempt to run stunnel but i run into an issue where it can't read the log file and then closes up. Any ideas? sudo stunnel stunnel.conf [ ] Clients allowed=500 [.] stunnel 5.19 on x86_64-unknown-linux-gnu platform [.] Compiled/running with OpenSSL 1.0.1 14 Mar 2012 [.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*__errno_location ()) [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark not detected [.] FIPS mode disabled [ ] Compression disabled [ ] Snagged 64 random bytes from /root/.rnd [ ] Wrote 1024 new random bytes to /root/.rnd [ ] PRNG seeded successfully [ ] Initializing service [<service>] [ ] Loading certificate from file: /etc/stunnel/server.pem [ ] Loading key from file: /etc/stunnel/server.pem [ ] Private key check succeeded [ ] DH initialization [ ] Could not load DH parameters from /etc/stunnel/server.pem [ ] DH parameters will be generated [ ] Cron started [ ] ECDH initialization [ ] ECDH initialized with curve prime256v1 [ ] SSL options: 0x03004004 (+0x03004000, -0x00000000) [.] Configuration successful [ ] Listening file descriptor created (FD=7) [ ] Service [<service>] (FD=7) bound to 127.0.0.1:9999 [ ] Executing cron jobs [.] Updating DH parameters [!] Cannot open log file: /home/tim/Desktop/stunnel.log [ ] Closing service [<service>] [ ] Service [<service>] closed (FD=7) [ ] Service [<service>] closed -- *CONFIDENTIALITY NOTICE* THE INFORMATION CONTAINED IN THIS COMMUNICATION IS INTENDED FOR THE NAMED RECEIVER ONLY. THE TRANSMISSION MAY CONTAIN PRIVILEGED AND CONFIDENTIAL MATERIAL. IF YOU ARE NOT THE NAMED RECIPIENT, PLEASE BE ADVISED THAT ANY USE, DISSEMINATION OR UNAUTHORIZED COPYING OF THE MATERIAL IS STRICTLY PROHIBITED. IF YOU HAVE RECEIVED THIS TRANSMISSION IN ERROR, PLEASE NOTIFY SUPPORT(a)TRUEEX.COM AND DESTROY THE RECEIVED COPY. THANK YOU.

1 0

Support for SHA-2 256
by Deepak Subbanarasimha 10 Jul '15

10 Jul '15

Does Stunnel support VeriSign SHA-2 256 certificate? If so, which version was this added in? Thanks, Deepak IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately return the original message to the sender at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Although Kewill takes reasonable precautions to minimize the risk, Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code.

2 1

problem with buffering data on stunnel
by wujot 09 Jul '15

09 Jul '15

I have a problem with transmission from LAN server, which use another server on LAN with running stunnel, to pass encrypted data to remote SSL clients if they are on very slow GPRS network. If server in LAN starts to transfer big amount of data to such slow remote client, stunnel is buffering data and slowly transmits them to the GPRS client. TCP Window on connection from LAN server to stunnel is big (64 - 131kB), and TCP Window on connection from stunnel to slow client is small (about 5kB). And additionally stunnel is buffering data. So, server is finishing transmission in seconds, but in fact most of data are still in buffers of stunnel. And it makes a timeout problem (server is waiting for the confirmation from client if it received all data, but time between last byte sent from server and confirmation from client could be even several minutes). So, stunnel is working in "store and forward" model. Is it possible to switch it to something like "cut through"? Or how to force stunnel to more synchronized transmission between client and server? Regards, Adalbert

2 1

password protected key in client certificate
by Giona Il Profeta 03 Jul '15

03 Jul '15

Hi all, I have inherited an old stunnel installation, configured for mutual authentication (verify=3) and I'm trying to figure out some of the choices of the old sysadmin. One of the client certificates in the CApath directory has its private key encrypted with a password. Is the client supposed to provide the password to decrypt the key when it connects? Thank you G

2 2

Older versions of stunnel
by daninho dj 03 Jul '15

03 Jul '15

Hi guys, Where can I find some older versions of stunnel? I would like to get 5.17 version. Thanks, Daninho

2 1

Problem with read and unreald mails via POP3 SSL
by David Tedjo 30 Jun '15

30 Jun '15

Hi everybody, i bought an Logitech keyboard with display. I use now stunnel to bring my email account to my display. Logitech got a applet for this. Now i can use it but i got a problem with the unread mails. My display shows me 6 unread messages, but thats all my messages in my in-box and i read it already. Is this a problem of stunnel or a problem in the software of the keyboard? Best Regards David

2 1

automation of installation of loopback adapter
by Saurabh Beriwal 29 Jun '15

29 Jun '15

Hi All, I'd like to programmatically install the MS loopback adapter to automate tunneling of SMB over SSH. All the code which i found on net uses MS devcon utility. Please let us know if there is any simple way to automate the installation of MS loopback adapter. Thank you. Regards, Saurabh Beriwal

2 1

Re: [stunnel-users] installing stunnel on Mac Machine
by William Dockery 26 Jun '15

26 Jun '15

1. I’m an stunnel newbie. 2. I thought I would give the Mac install script a try: downloaded it to ~/Documents, did the chmod, and ran script; looks like it can’t create/find the config file? Is that something I need to do manually? WDDMBPW80336XHAGV:Documents williamdockery$ ./stunnel-5.20b8-osx [ ] Cron started [ ] Clients allowed=125 [.] stunnel 5.20 on x86_64-apple-darwin14.3.0 platform [.] Compiled/running with OpenSSL 0.9.8zd 8 Jan 2015 [.] Threading:PTHREAD Sockets:SELECT,IPv6 TLS:ENGINE,OCSP [ ] errno: (*__error()) [.] Reading configuration from file /etc/stunnel/stunnel.conf [!] Cannot open configuration file [.] [.] Syntax: [.] stunnel [<filename>] ] -fd <n> | -help | -version | -sockets [.] <filename> - use specified config file [.] -fd <n> - read the config file from a file descriptor [.] -help - get config file help [.] -version - display version and defaults [.] -sockets - display default socket options Thoughts? Thanks, William > > Message: 1 > Date: Thu, 25 Jun 2015 12:48:02 +0200 > From: Michal Trojnara <Michal.Trojnara(a)mirt.net> > Cc: stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] installing stunnel on Mac Machine > Message-ID: <558BDC62.9080606(a)mirt.net> > Content-Type: text/plain; charset=utf-8 > > Signed PGP part > On 25.06.2015 08:04, Saurabh Beriwal wrote: > > Is it possible to automate the installation on Mac machine? > > I built an executable for you: > ftp://ftp.stunnel.org/stunnel/stunnel-5.20b8-osx > Just copy to a directory, chmod a+x, and run it. > > Mike > >

1 0

installing stunnel on Mac Machine
by Saurabh Beriwal 25 Jun '15

25 Jun '15

Hi All, I need to install stunnel on Mac machine. If someone has already done this in past , then please share the installation steps with me. Do we need to install anything like loopback adopter in Mac Machine. Regards, Saurabh Beriwal

4 5

How to upgrade OpenSSL version that comes with Stunnel
by Paul Randall 24 Jun '15

24 Jun '15

Hi folks, Can you please tell me the process for swapping out the version of OpenSSL that comes with Stunnel for a newer version of OpenSSL? Is there a quick way to do this or does it require recompiling Stunnel? Thanks. Paul

1 0

Stunnel windows installer
by Deepak Subbanarasimha 22 Jun '15

22 Jun '15

Hi, Is there an MSI installer available for Stunnel version 5.19 ? If so, has anyone tried to call the stunnel MSI installer from an Install shield installer? Thanks, DEEPAK SUBBANARASIMHA Kewill DDI: +00 (1) 978 482 2625 Email: deepak.subbanarasimha(a)kewill.com<mailto:[email protected]> www.kewill.com<http://www.kewill.com/> Tel: +00 (1) 978 482 2500 | Fax: +00 (1) 978 482 2501 1 Executive Drive, Chelmsford, MA 01824, USA IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately notify us by telephone at (978) 482-2500 and return the original message to us at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code. Thank You. Copyright (c) 2013 by Kewill Inc IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately return the original message to the sender at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Although Kewill takes reasonable precautions to minimize the risk, Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code.

1 0

Re: [stunnel-users] stunnel 5.18 may keep high CPU usage
by Dod 22 Jun '15

22 Jun '15

Hello Michal, Same problem with 5.19b4 and nothing special in the logs. Now I know how to reproduce the problem instantly, I just have to put my computer in StanBy mode and Awake it. Using Process Explorer from Sysinternals I see that stunnel produce a permanent "Other I/O" flow when problem appear. I/O Other : "The rate at which the process is issuing bytes to I/O operations that do not involve data such as control operations. This counter counts all I/O activity generated by the process to include file, network and device I/Os." OtherI/O is confirmed by Process Monitor that trace no File nor Registry nor Network activity. But as stunnel still respond correctly to a Quit menu or any other menus and SSL requests I assumed that it may be some Thread going crazy so I compared running thread between normal stunnel behavior with the 25% CPU behavior and found that in fact there is a thread that do no terminate correctly. Here is the Thread's stack : MSVCR90.dll!_endThread+0x7d ntoskrnl.exe!memset+0x61a ntoskrnl.exe!KeWaitForMultipleObjects+0xd52 ntoskrnl.exe!KeWaitForSingleObject+0x19f ntoskrnl.exe!PoStartNextPowerIrp+0xba4 ntoskrnl.exe!PoStartNextPowerIrp+0x1821 ntoskrnl.exe!PoStartNextPowerIrp+0x1a97 ntoskrnl.exe!KeReleaseInStackQueuedSpinLock+0x5a afd.sys+0x61c1c afd.sys+0x51d3b ntoskrnl.exe!NtMapViewOfSection+0x15b7 ntoskrnl.exe!NtDeviceIoControlFile+0x56 ntoskrnl.exe!KeSynchronizeExecution+0x3a23 wow64cpu.dll!TurboDispatchJumpAddressEnd+0x6c0 wow64cpu.dll!TurboDispatchJumpAddressEnd+0x1fb wow64.dll!Wow64SystemServiceEx+0x1ce wow64.dll!Wow64LdrpInitialize+0x42a ntdll.dll!RtlIsDosDeviceName_U+0x1f5c4 ntdll.dll!LdrInitializeThunk+0xe ntdll.dll!NtDeviceIoControlFile+0x15 WS2_32.dll!select+0x9f stunnel.exe!OPENSSL_Applink+0xd3ec stunnel.exe!OPENSSL_Applink+0x961 Hope it help... regards. MT> Please try stunnel 5.19b4: MT> https://www.stunnel.org/downloads.html

2 2

Fwd: Disabling window server service
by Saurabh Beriwal 22 Jun '15

22 Jun '15

Hi All, I am using stunnel to connect with SAMBA server and getting error in binding with server. Please let me know if it is mandatory to disable window server service for using stunnel. Also i would appreciate if some one can share knowledge\articles on window to SAMBA server connectivity through stunnel. Thank you. Regards, Saurabh Beriwal

1 0

Generate CONNECT
by reiner otto 22 Jun '15

22 Jun '15

I have following problem: I want to avoid the user to explicitly specify a https-proxy in his browser. Let me explain: For http, a transparent proxy can be interfaced via iptables DNAT, for example.Same for https will not work, without certificates installed etc.However, I only want some basic info about the https-session, like traffic volume or destination domain. In case, there is an explicit https-proxy defined in the browser, I can get this info from the connect request, preceding the secure data exchange.But I want to avoid this explicit declararion. Most likely I will need some custom programming for this, but may be there is a specialist here to give some direction.

2 2

Default Ciphers
by Clayton Keller 17 Jun '15

17 Jun '15

Looking at the Changelog I see the following from the 5.15 info: "MEDIUM ciphers (currently SEED and RC4) are removed from the default cipher list." And this from the 5.00 info: "Default "ciphers" updated to "HIGH:MEDIUM:+3DES:+DH:!aNULL:!SSLv2" due to AlFBPPS attack and bad performance of DH ciphersuites." Given these to comments would it be accurate to say that the current default "ciphers" value is: "HIGH:+3DES:+DH:!aNULL:!SSLv2" Also, some of the docs indicate what the default value currently is. Is there an easier way to determine that value via CLI or other means? Thanks Clay

2 1

stunnel 5.18 may keep high CPU usage
by Dod 17 Jun '15

17 Jun '15

Hello, I use sTunnel for years and ujpdated from 5.17 to 5.18 on my Win7 64bits. I use sTunnel for POP-SSL and SMTP-SSL for 12 accounts (gmail, yahoo ...) but I noticed that after a few connexions sTunnel may keep high CPU, 25% as reported by TaskManager (50% on core 1 and 3 on my Core-i5 quad-core). The problem, may appear after 10 cnx sometime more. The reading order the POP-S accounts that are checked do not matter. The POP accounts are never high loaded I mean I do not receive tons of e-mails and they are not oversized. Sometime the 25% CPU usage disappear by its own, sometime it can stay forever. Never noticed such problem on previous versions. Standard logs show nothing special. regards.

3 10

Stunnel 5.17 builds, 5.18 does not - AIX 6.1 - pod2man does not accept "-v"
by Rob Lockhart 17 Jun '15

17 Jun '15

Michal, I was able to build Stunnel 5.17 on AIX 6.1 using the "build" command, after completely removing the entire section for "-fstack-protector" in "configure" (my "stunnel-5.17.patch" file below). I used the following commands: mkdir $HOME/stunnel-bin-5.17 gzip -dc stunnel-5.17.tar.gz | tar xvf - patch -p0 <stunnel-5.17.patch cd stunnel-5.17 chmod 755 configure; ./configure --prefix=$HOME/stunnel-bin-5.17 make; make install However, for 5.18, those same commands (and patch file) no longer result in a successful compile due to AIX 6.1 not accepting the "-u" (Unicode) for pod2man. I looked into 5.17 and it looks like the same Makefiles are used in both (doc/Makefile.in and doc/Makefile.am) so perhaps the top-level Makefile for 5.18 adds the ".pod.8" file to the build process. Removing the "-u" in both files enables the build to complete. I just tested against Stunnel 5.19 but it looks like the step that ran "pod2html" was skipped by default (i.e., just "make") so I am able to compile stunnel correctly. Thanks for fixing this in Stunnel 5.19! For those that need the .pod.8 man pages on AIX 6.1, you'll need to remove the "-u" in the pod2man command. Regards, -Rob

2 1

stunnel 5.19 release
by Michal Trojnara 16 Jun '15

16 Jun '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.19 of stunnel. The ChangeLog entry: Version 5.19, 2015.06.16, urgency: MEDIUM: * New features - OpenSSL DLLs updated to version 1.0.2c. - Added a runtime check whether COMP_zlib() method is implemented in order to improve compatibility with the Debian OpenSSL build. * Bugfixes - Improved socket error handling. - Cron thread priority on Win32 platform changed to THREAD_PRIORITY_LOWEST to improve portability. - Makefile bugfixes for stunnel 5.18 regressions. - Fixed some typos in docs and scripts (thx to Peter Pentchev). - Fixed a log level check condition (thx to Peter Pentchev). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 0b543242cf26649acfdd9f00de564c3e8de7ac2237d53935ffdc7eb24f4d556d stunnel-5.19.tar.gz 310fb015c3884dd19a1905ed84d5fbcd1579507c98ee2ba43955aa45311bc056 stunnel-5.19-installer.exe 990e636a869f4de8a55c43e7f2fa24ebbf81c1c221473106e8e6b5d89d720627 stunnel-5.19-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVgCeVAAoJEC78f/DUFuAUi98P/1cPUAg1ehgZkDXIxwIxTt/t sxYOWEmX/ajmimornRygim9HHGPB4HzDMFu1B1qCT01GE4uR+ogYZMYJAdZ+LRua J0wuDawuKgnJvWpdDGnX4Mfz/zUcV8L4T4iJvBnC8xXTQeto7+qU9YTmbYhms4xy u1CPpAXUHnwrNMkI5nqBtB8TSIEeHgmfS456/7oe9Kl+0F8hq7FkZ+1/IYxQOAPC 0drl8A8tfUroBiw+aI2aWJAq2gUoQFVpyAYi7IUBXnmGZ7H1CMcO+KpG+33L0glH oz5DxsuzHyYZYWD1NiKfre4QxMHrT9xXWoNQIHkwgEjDlQXTAqd5rhz9b13TjMmn hiHG3XtF+FvSwFJeTNk/yVYe8ZvjbXUS3BWS65HqTiRKx0iEtkkf2Z1VsieVMUGO LiWvxztz9Z4OSIUWxOFcC8WLTlIDTcIqMM79JLC33o22YSwIRqsE7u5mGiG6yZBN s78ILkqXauxQ1MSDXPArOIZr6iJIqHtuAJbnZvmAQwSKbks/gnzY4WAX0SAw9M64 hhbEnr+zsiRSq30uGrU7fxFHr4MynagEiNaAbNG2kQEJ4nSgHoY0W59dXAuVVYFM UtYgsEeMnPlaBij+ecgmk/xfpEZDQ/phaHtTKzTQUE3JWLkB/VsLz1gwZO1poH8e dOuvm5RULY29YlHcEoM+ =V456 -----END PGP SIGNATURE-----

1 0

Re: [stunnel-users] stunnel 5.18 may keep high CPU usage
by Dod 14 Jun '15

14 Jun '15

Hello Michal, MT> for developers, so don't worry if you don't understand all of the output. After 5 hours of 25% CPU I decided to stunnel (again) with debug=info 2015.06.14 19:15:10 LOG6[cron]: Executing cron jobs 2015.06.14 19:19:39 LOG5[cron]: DH parameters updated 2015.06.14 19:19:39 LOG6[cron]: Cron jobs completed in 269 seconds This time DH calculation ran for 4 minutes, which is the expected behavior. btw I am developer too so no problem with the log file ;-) regards. MT> -----BEGIN PGP SIGNED MESSAGE----- MT> Hash: SHA1 MT> Hi Dod, >> 2015.06.14 10:55:06 LOG5[cron]: DH parameters updated >> >> btw if there is some message to tell about DH calculation >> ended, shouldn't be one to say that DH calculation started ? >> this could be usefull. MT> I have added logging it while replying the previous email. 8-) >> Is there some interesting higher log level I could activate to >> get more (but not too much) logs that may help me to >> understand this strange behavior ? MT> Yes. Use "debug = info" or "debug = debug". The latter is intended MT> for developers, so don't worry if you don't understand all of the output. MT> Best regards, MT> Mike MT> -----BEGIN PGP SIGNATURE----- MT> Version: GnuPG v1 MT> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ MT> iQIcBAEBAgAGBQJVfasGAAoJEC78f/DUFuAU78MP/2WTHetqYubWkhEC9OykxVji MT> rTcps69fyE+904T/sSkRWoEiZFX2MFkQQuIwHsVuRdQecxhfqOGmj5R8xpDJQPBB MT> HsT/G/xgCRqCmWbO0HlQg2Tz5td9gsfIRJi9g1T8dHkImUXQUNC2gcqRowmMvcKx MT> Ly2YF8opHZZwA/p305hjuKM6+ziXn7eLdW0yp24LTfXxZigr0QiWvmMjtxhhJ7P0 MT> UgywVTKFBJ1/mJw1TXArOrk/sFiynooLLbYIEhS2rsyXo9m2UHCIRnbvwI9iXCuz MT> foiTPjFRtkWKSsKkcFXHIRpXD3WP07XjtaIzP2XyyK7JVFAsUQNhIBJBBUATJ18r MT> GtzyRIU/zHbmbL/jem9AJkyuw+eQ5E65QhA5eTI8fAKcceFmCq7Pu/HsN1Zk3enV MT> l6NbHSuY0eyvChQ44dzM4UyiNNMBFJczfmPbM5KdwbvLHHtxvbdlLH81HAe7TmVK MT> JuxHVYHZma9PZ/+19dhScl785Ae1TxoCRab9HeShhC6SFdPZ4HV4mZHleYMNCZvP MT> f7d75qDHQZYxZhunP9xqcsoHdhY1rTO0AWZC9TMER+0jbqCcpdEzMaD2L2F8glP2 MT> PUR2StD1EHlVlpzVZL63EJK0vi91dwI/AUiuoolhPkSRtxEwGUc+eNYKcBru8Ca+ MT> O+3Sq6GcWknVd6xu+fNs MT> =ucCs MT> -----END PGP SIGNATURE----- mailto:[email protected]

1 0

stunnel 5.18 release
by Michal Trojnara 12 Jun '15

12 Jun '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.18 of stunnel. The ChangeLog entry: Version 5.18, 2015.06.12, urgency: MEDIUM: * New features - OpenSSL DLLs updated to version 1.0.2b. https://www.openssl.org/news/secadv_20150611.txt - Added "include" configuration file option to include all configuration file parts located in a specified directory. - Log file is reopened every 24 hours. With "log = overwrite" this feature can be used to prevent filling up disk space. - Temporary DH parameters are refreshed every 24 hours, unless static DH parameters were provided in the certificate file. - Unique initial DH parameters are distributed with each release. - Warnings are logged on potentially insecure authentication. - Improved compatibility with the current OpenSSL 1.1.0-dev tree: removed RLE compression support, etc. - Updated stunnel.spec (thx to Bill Quayle). * Bugfixes - Fixed handling of dynamic connect targets. - Fixed handling of trailing whitespaces in the Content-Length header of the NTLM authentication. - Fixed --sysconfdir and --localstatedir handling (thx to Dagobert Michelsen). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 0532c0a2f8de3da1ab625e384146501ce5936fac63d01561c3a9bf652b692317 stunnel-5.18.tar.gz 9b9a64f30d4dc72f19a2f6482f5bcf76bb67cf3dd859bdd615e0345e1bb8dd41 stunnel-5.18-installer.exe a73befed476f423dee0ff25f38449570fb9f6a07ab90321d9c38e3962f833939 stunnel-5.18-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVeuE3AAoJEC78f/DUFuAU88wP/jfyOCsCBwCcIxNoQhEU5k4d mczXvWtaw0gBrOivrzgBZS0w621D66DGoXt6yMwMp1suWY9spTWZ+VjQJM8oFCul iFwYWyFyxiTOGRFXGCPEff8f4OGbGoxHfDaIrHR5AGvTzguznKTDXzM7cjixqWF9 vL/t08ZjoDWOZIVJuN8M9sVQWn7gzPnyJpvpW2D240aITBx348ZWt/QGqX4yOSzL tQCojXRO6W+rOq0WUdeDFp7CAMB7IZgZsZljqOUn4Q0wHgzuar0Kq1ZLQEkgoX5V lGJ99yZ74/H1RUDcVKGrdksX0atuf6SfzbTvZ/Osp0z7/NlWzhbCt6emYpSLxyzr 2IMX4T8Y593rDovT6AjOb2D4W0sJqAMfUMrs7+T43lYvEbQY8CoEBOH2St5h6X7Y 2ZIa1XMvMmaN08/QyUq6WqxEz0se9BPtUCC+oFjDlGw0oWrqKs1zzJAIpg0HHPOy j1NpBVPnuZz1WlTT/oGLIIVm6w8wATSKthIXstNtofXpSvJ1J94UntC3+0xga7KD SzaOm9w9kpDEtD0EwArLwak5cSevzdXQR4xfmU5OK/UohsdyTLBOab6iY3htmokk JOWIKZztATN7dq8YGvMfJvIiM1ij8Eg14wsahlwfwMZ+eGSvS5lTWvYsSirnnNFi XTrCfpnrKgrfLkUXhbtH =CdmE -----END PGP SIGNATURE-----

1 0

TLS version
by Deepak Subbanarasimha 11 Jun '15

11 Jun '15

Does Stunnel version 4.1 support sslVersion "TLSv1.2 " and above? If not, what version of stunnel supports "TLSv1.2" Thanks, DEEPAK SUBBANARASIMHA Kewill DDI: +00 (1) 978 482 2625 Email: deepak.subbanarasimha(a)kewill.com<mailto:[email protected]> www.kewill.com<http://www.kewill.com/> Tel: +00 (1) 978 482 2500 | Fax: +00 (1) 978 482 2501 1 Executive Drive, Chelmsford, MA 01824, USA IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately notify us by telephone at (978) 482-2500 and return the original message to us at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code. Thank You. Copyright (c) 2013 by Kewill Inc IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately return the original message to the sender at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Although Kewill takes reasonable precautions to minimize the risk, Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code.

2 1

INTERNAL ERROR: s_poll_wait returned 1, but no descriptor is ready
by Florian Gossin 10 Jun '15

10 Jun '15

HI, I'm trying to setup a connection from JDBC to pgbouncer through stunnel. Unfortunately, I get the above error message when I try to connect. Here are the logs from stunnel: 2015.06.09 16:56:13 LOG7[3]: SSL state (accept): SSLv3 read client certificate A 2015.06.09 16:56:13 LOG7[3]: SSL state (accept): SSLv3 read client key exchange A 2015.06.09 16:56:13 LOG7[3]: SSL state (accept): SSLv3 read certificate verify A 2015.06.09 16:56:13 LOG7[3]: SSL state (accept): SSLv3 read finished A 2015.06.09 16:56:13 LOG7[3]: SSL state (accept): SSLv3 write change cipher spec A 2015.06.09 16:56:13 LOG7[3]: SSL state (accept): SSLv3 write finished A 2015.06.09 16:56:13 LOG7[3]: SSL state (accept): SSLv3 flush data 2015.06.09 16:56:13 LOG7[3]: 4 server accept(s) requested 2015.06.09 16:56:13 LOG7[3]: 4 server accept(s) succeeded 2015.06.09 16:56:13 LOG7[3]: 0 server renegotiation(s) requested 2015.06.09 16:56:13 LOG7[3]: 0 session reuse(s) 2015.06.09 16:56:13 LOG7[3]: 3 internal session cache item(s) 2015.06.09 16:56:13 LOG7[3]: 0 internal session cache fill-up(s) 2015.06.09 16:56:13 LOG7[3]: 0 internal session cache miss(es) 2015.06.09 16:56:13 LOG7[3]: 0 external session cache hit(s) 2015.06.09 16:56:13 LOG7[3]: 0 expired session(s) retrieved 2015.06.09 16:56:13 LOG6[3]: SSL accepted: new session negotiated 2015.06.09 16:56:13 LOG6[3]: Negotiated TLSv1 ciphersuite ECDHE-RSA-AES256-SHA (256-bit encryption) 2015.06.09 16:56:13 LOG7[3]: Compression: null, expansion: null 2015.06.09 16:56:13 LOG6[3]: Failover strategy: round-robin 2015.06.09 16:56:13 LOG6[3]: s_connect: connecting 127.0.0.1:46432 2015.06.09 16:56:13 LOG7[3]: s_connect: s_poll_wait 127.0.0.1:46432: waiting 10 seconds 2015.06.09 16:56:13 LOG5[3]: s_connect: connected 127.0.0.1:46432 2015.06.09 16:56:13 LOG5[3]: Service [pgbouncer-client] connected remote server from 127.0.0.1:54633 2015.06.09 16:56:13 LOG7[3]: Remote socket (FD=9) initialized 2015.06.09 16:56:13 LOG6[3]: Read socket closed (read hangup) 2015.06.09 16:56:13 LOG7[3]: Sending close_notify alert 2015.06.09 16:56:13 LOG7[3]: SSL alert (write): warning: close notify 2015.06.09 16:56:13 LOG6[3]: SSL_shutdown successfully sent close_notify alert 2015.06.09 16:56:13 LOG3[3]: INTERNAL ERROR: s_poll_wait returned 1, but no descriptor is ready 2015.06.09 16:56:13 LOG5[3]: Connection reset: 58 byte(s) sent to SSL, 164 byte(s) sent to socket 2015.06.09 16:56:13 LOG7[3]: Remote socket (FD=9) closed 2015.06.09 16:56:13 LOG7[3]: Local socket (FD=8) closed 2015.06.09 16:56:13 LOG7[3]: Service [pgbouncer-client] finished (0 left) In pgbouncer, I get the following error: Pooler Error: bad packet header: '70' And in JDBC, the following exception: GRAVE: ERROR: bad packet header: '70' org.postgresql.util.PSQLException: ERROR: bad packet header: '70' Where might be the problem ? Does the stunnel parameter protocol=pgsql work with JDBC ? Thank you

2 1

How to tell what Ciphers are supported?
by Del Benjamin 06 Jun '15

06 Jun '15

I am using the pre-compiled windows binary version of stunnel in client mode, how do I tell on that version what cipher versions I can use? Essentially the equivalent of this command in openssl *openssl* *ciphers* [*-s*] [*-v*] [*-V*] [*-ssl3*] [*-tls1*] [*-stdname*] [ *cipherlist*]

2 2

Rework "Honor --sysconfdir and --localstatedir in stunnel.conf-sample.in"
by Dagobert Michelsen 01 Jun '15

01 Jun '15

Hi, I took the liberty of reworking the patch presented in http://www.stunnel.org/pipermail/stunnel-users/2010-July/002711.html to fix the issues raised in http://www.stunnel.org/pipermail/stunnel-users/2010-August/002719.html The main reason why the substitution didn't work is because it should not be done during configure-time but inside the Makefile as described in the Autoconf manual http://www.gnu.org/savannah-checkouts/gnu/autoconf/manual/autoconf-2.69/htm… The patch is attached to this email or you can browse the patch at https://github.com/dago/stunnel/compare/master...sysconfdir The patch is against 5.18b3 (is there a public repo available to make patches?) It would be great if the change could be applied. Best regards -- Dago

2 6

Incompatibility - Content-length parsing
by Marcin Gryszkalis 25 May '15

25 May '15

Hi, I noticed that parsing of HTTP header fields is not robust enough and not RFC compliant - and that way it casues incompatibility with Microsoft TMG proxy with NTLM authentication. The symptom is "Proxy-Authenticate: Invalid Content-Length" message while the header received is "Content-Length: 0 " <- note trailing spaces. The responsible piece of code is in protocol.c: if(tmpstr==line+16 || *tmpstr || content_length<0) { (tmpstr contains trailing spaces in this case). According to RFC 7230 trailing space is allowed and should be discarded by parser: A field value might be preceded and/or followed by optional whitespace (OWS); a single SP preceding the field-value is preferred for consistent readability by humans. The field value does not include any leading or trailing whitespace: OWS occurring before the first non-whitespace octet of the field value or after the last non-whitespace octet of the field value ought to be excluded by parsers when extracting the field value from a header field. best regards -- Marcin Gryszkalis, PGP 0xA5DBEEC7 jabber jid:[email protected]

2 3

Compiling for Android
by Pio Tofanelli 21 May '15

21 May '15

Hi, I'm new to stunnel and I'd like to compile it to ARM and x86 platforms. I downloaded the stunnel-5.17 package and I'm using the build-android.sh and android-ndk-r10e script to compile it: ../../configure --with-sysroot=/home/ptofanelli/android-ndk-r10e/platforms/android-18/arch-arm/ --build=i686-pc-linux-gnu --host=arm-linux-androideabi --prefix=/data/local I'm getting the message "The C compiler cannot create executables" and checking the logs I've found that the problem is this: configure:3538: arm-linux-androideabi-gcc conftest.c >&5 /home/ptofanelli/android-ndk-r10e/toolchains/arm-linux-androideabi-4.8/prebuilt/linux-x86/bin/../lib/gcc/arm-linux-androideabi/4.8/../../../../arm-linux-androideabi/bin/ld: error: cannot open crtbegin_dynamic.o: No such file or directory /home/ptofanelli/android-ndk-r10e/toolchains/arm-linux-androideabi-4.8/prebuilt/linux-x86/bin/../lib/gcc/arm-linux-androideabi/4.8/../../../../arm-linux-androideabi/bin/ld: error: cannot open crtend_android.o: No such file or directory /home/ptofanelli/android-ndk-r10e/toolchains/arm-linux-androideabi-4.8/prebuilt/linux-x86/bin/../lib/gcc/arm-linux-androideabi/4.8/../../../../arm-linux-androideabi/bin/ld: error: cannot find -lc /home/ptofanelli/android-ndk-r10e/toolchains/arm-linux-androideabi-4.8/prebuilt/linux-x86/bin/../lib/gcc/arm-linux-androideabi/4.8/../../../../arm-linux-androideabi/bin/ld: error: cannot find -ldl collect2: error: ld returned 1 exit status I searched for this problem and a topic in stackoverflow ( http://stackoverflow.com/questions/16795583/android-error-cannot-open-crtbe…) is said that the problem is the sysroot, so I tried to use the option --with-sysroot, but I'm getting the same problem. Can you help me? Thanks and regards, Pio Tofanelli

1 0

Stunnel not working with Office 365
by Hannu Viitala 19 May '15

19 May '15

Hi, We cannot get stunnel SMTP to work with Office 365 mail server. We are using Stunnel 5.13 and below are the config file content and the the client PC logs. The mail server logs do not reveal anything more. Two observations of the test setup: 1) Using e.g. Mozilla Firebird mail client directly SLL/SMTP on the same PC connection to same Office 365 mail server works ok, but via Stunnel it outputs the error log below. 2) Also, on the same PC, SSL/SMTP connection via stunnel to Gmail server works ok. Stunnel conf-file: ============== output = stunnel_log.txt debug = debug cert = tstunnel.pem client = yes [SSMTP] accept = 127.0.0.1:54500 connect = xxx.xxx.xxx.xxx:587 (Hannu V: removed IP address from this mail) protocol = smtp Client PC logs: =========== 2015.04.28 09:17:36 LOG7[ui]: No limit detected for the number of clients 2015.04.28 09:17:36 LOG5[ui]: stunnel 5.13 on x86-pc-msvc-1500 platform 2015.04.28 09:17:36 LOG5[ui]: Compiled/running with OpenSSL 1.0.2a 19 Mar 2015 2015.04.28 09:17:36 LOG5[ui]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2015.04.28 09:17:36 LOG7[ui]: errno: (*_errno()) 2015.04.28 09:17:36 LOG5[ui]: Reading configuration from file tstunnelSmtp_SAUX1_0.conf 2015.04.28 09:17:36 LOG5[ui]: UTF-8 byte order mark not detected 2015.04.28 09:17:36 LOG5[ui]: FIPS mode disabled 2015.04.28 09:17:36 LOG7[ui]: Compression disabled 2015.04.28 09:17:36 LOG7[ui]: PRNG seeded successfully 2015.04.28 09:17:36 LOG6[ui]: Initializing service [SSmtp] 2015.04.28 09:17:36 LOG6[ui]: Loading certificate from file: tstunnel.pem 2015.04.28 09:17:36 LOG6[ui]: Loading key from file: tstunnel.pem 2015.04.28 09:17:36 LOG7[ui]: Private key check succeeded 2015.04.28 09:17:36 LOG7[ui]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2015.04.28 09:17:36 LOG5[ui]: Configuration successful 2015.04.28 09:17:36 LOG7[ui]: Listening file descriptor created (FD=448) 2015.04.28 09:17:36 LOG7[ui]: Service [SSmtp] (FD=448) bound to 127.0.0.1:8030 2015.04.28 09:17:36 LOG7[ui]: Service [SSmtp] accepted (FD=456) from 127.0.0.1:54500 2015.04.28 09:17:36 LOG7[ui]: Creating a new thread 2015.04.28 09:17:36 LOG7[ui]: New thread created 2015.04.28 09:17:36 LOG7[0]: Service [SSmtp] started 2015.04.28 09:17:36 LOG5[0]: Service [SSmtp] accepted connection from 127.0.0.1:54500 2015.04.28 09:17:36 LOG6[0]: s_connect: connecting xxx.xxx.xxx.xxx:587 (Hannu V: removed IP address from this mail) 2015.04.28 09:17:36 LOG7[0]: s_connect: s_poll_wait connecting xxx.xxx.xxx.xxx:587 : waiting 10 seconds (Hannu V: removed IP address from this mail) 2015.04.28 09:17:37 LOG5[0]: s_connect: connected connecting xxx.xxx.xxx.xxx:587 (Hannu V: removed IP address from this mail) 2015.04.28 09:17:37 LOG5[0]: Service [SSmtp] connected remote server from yyy.yyy.yyy.yyy:54503 (Hannu V: removed IP address from this mail) 2015.04.28 09:17:37 LOG7[0]: Remote socket (FD=472) initialized 2015.04.28 09:17:37 LOG7[0]: <- 220 NNN.outlook.office365.com Microsoft ESMTP MAIL Service ready at Tue, 28 Apr 2015 14:17:38 +0000 2015.04.28 09:17:37 LOG7[0]: -> 220 NNN.outlook.office365.com Microsoft ESMTP MAIL Service ready at Tue, 28 Apr 2015 14:17:38 +0000 2015.04.28 09:17:37 LOG7[0]: -> EHLO localhost 2015.04.28 09:17:37 LOG7[0]: <- 250-NNN.outlook.office365.com Hello [xxx.xxx.xxx.161] (Hannu V: removed IP address from this mail) 2015.04.28 09:17:37 LOG7[0]: <- 250-SIZE 157286400 2015.04.28 09:17:37 LOG7[0]: <- 250-PIPELINING 2015.04.28 09:17:37 LOG7[0]: <- 250-DSN 2015.04.28 09:17:37 LOG7[0]: <- 250-ENHANCEDSTATUSCODES 2015.04.28 09:17:37 LOG7[0]: <- 250-STARTTLS 2015.04.28 09:17:37 LOG7[0]: <- 250-8BITMIME 2015.04.28 09:17:37 LOG7[0]: <- 250-BINARYMIME 2015.04.28 09:17:37 LOG7[0]: <- 250 CHUNKING 2015.04.28 09:17:37 LOG7[0]: -> STARTTLS 2015.04.28 09:17:37 LOG7[0]: <- 220 2.0.0 SMTP server ready 2015.04.28 09:17:37 LOG6[0]: SNI: sending servername: NNN.office365.com 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): before/connect initialization 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv2/v3 write client hello A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 read server hello A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 read server certificate A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 read server key exchange A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 read server certificate request A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 read server done A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 write client certificate A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 write client key exchange A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 write certificate verify A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 write change cipher spec A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 write finished A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 flush data 2015.04.28 09:17:37 LOG3[0]: SSL_connect: Peer suddenly disconnected 2015.04.28 09:17:37 LOG5[0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2015.04.28 09:17:37 LOG7[0]: Remote socket (FD=472) closed 2015.04.28 09:17:37 LOG7[0]: Local socket (FD=456) closed 2015.04.28 09:17:37 LOG7[0]: Service [SSmtp] finished (0 left) --- Hannu

2 1

Authentication methods
by Michal Trojnara 15 May '15

15 May '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, While reading various 3rd party stunnel tutorials I noticed that they either don't configure authentication, or they recommend insecure configurations. I wrote a short overview of authentication methods available in stunnel: https://www.stunnel.org/auth.html Proper authentication is essential to TLS security. Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJVVXk5AAoJEC78f/DUFuAUN/QP/3m4HX4zWS8SehukDNWw54AB ySAT+XmT8SEo/iuGer/CRYbUWoMDpmwaI9x+whXMg+EBsxGd+nmyE9fkFiFSqOsV vnXc14zuMkQYorWbGtduXdnQ0/jQzWPDOIeKgpyXIsN/OvEhx1A6med9Go/SqaFz couW55wysqpJ9a+3YMtxIjLoCMzIGOZ8TKIHWJiZaBcgp93YCABeoE5hKR4RlxVj OrgHhuyA8yz1EIYUPKTEMuJwqnCl9Mk3FVskKIXgfEcxBzism2n/xJpEIYAWVPRW N8JaaZDojk6dt5oMiMzXUeobigZ82SKuV9MG3aQjuxXAP7IX2vuOa6rQ/85T1OFI PMZMKENM1aAcOVpiq/4OMNKhIG+OuhDm/dla5NC8lsfxDuJ3YESVp/Z0VeW1EWYA BFHxjGw8OA65izTYcvJKl1j7flfSgRELOCf1SMakR+VIUhkWlPQjdHWuW2V5NKgv 5aU0fwPGEpudKdsLFzgaYzhVPjTNfavl8k+xUWHOQyrNvEM9SNbOTyorxY7QA2aQ uyAOrUF8whboBTX59/3gXYI9vaepvT00ktCtQEz3XelkYT9SzCRYV+I+mUqquBd+ 0JQdiSMvOzfNraxT03rzYA6h/Iey9+tj9WnffpmYU5eyTt2bCp+xavzCyEmdQZlq 4LfAPgFYII9+59444dY2 =m51O -----END PGP SIGNATURE-----

1 0

Stunnel4 not working?
by David H. Durgee 13 May '15

13 May '15

Given a lack of other suggestions here and elsewhere that yielded any progress, I decided to download the current source and attempt to build it on my system. I didn't see a routine to check for prerequisites being met, so I wound up running ./configure several times and adding the libssl-dev, libwrap0-dev and libsystemd-daemon-dev packages based on what I saw in the output. Perhaps a check routine could be added later? I then ran make and the output contains neither errors nor warnings, so that looks good. As suggested in the INSTALL file, I next ran make check and received neither errors nor warnings. At this point the next step appears to be make install as root, but I am wondering if I should uninstall the stunnel4 package from the repository first. I am also wondering if I can simply use the existing /etc/stunnel/stunnel.conf that I included in my first post in this thread or if I should start over with one of the examples included with this version. I would appreciate input from the list on this. If you want to see further details, such as ./configure or make outputs or configuration files just let me know and I will put them in a follow-up post. Dave

2 1

Re: [stunnel-users] Stunnel 5.17 on AIX
by Eckert, Doug 13 May '15

13 May '15

Thanks! I applied the patch to tls.c and I'm able to create sessions with no problem. The version of OpenSSL provided by IBM is built off the 1.0.1e codebase, with backported security fixes via "iFixes" for announced CVEs. They apparently don't backport new functionality or maybe even non-CVE bugfixes. I'm guessing an un-patched stunnel 5.17 would work once/if they release OpenSSL built off 1.0.1j or later. > On Tue, May 12, 2015 at 3:40 PM, Michal Trojnara <Michal.Trojnara(a)mirt.net > > wrote: > >> On 12.05.2015 18:29, Eckert, Doug wrote: >> > With that in mind, I compiled stunnel v5.03 with same OpenSSL 1.0.1.513 >> > and iFix IV71446m9a applied as with the v5.17 attempt. I'm able to >> > create sessions with no problem. The internal error/bad magic does not >> > occur. >> >> Additional security checks to the OpenSSL memory management functions >> were introduced in stunnel 5.09. The enclosed patch disables them in >> the latest stunnel 5.17. >> >> Mike >> >> _______________________________________________ >> stunnel-users mailing list >> stunnel-users(a)stunnel.org >> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >> >> > > > -- > > > >

1 0

Stunnel 5.17 on AIX
by Eckert, Doug 12 May '15

12 May '15

I've gotten v5.17 compiled on AIX 5.3 & 6.1 with the following xlccmp.13.1.0 13.1.0.3 COMMITTED XL C compiler openssl.base 1.0.1.513 COMMITTED Open Secure Socket Layer IV71446m9a Ifix for Openssl CVE Everything seems to have compiled fine. I packaged it up, installed, and set up a quick config. The server side aborts on me. Debug output follows. Need some direction on where to look next. Thanks in advance! 2015.05.06 12:08:03 LOG7[ui]: Clients allowed=31999 2015.05.06 12:08:03 LOG5[ui]: stunnel 5.17 on powerpc-ibm-aix5.3.0.0 platform 2015.05.06 12:08:03 LOG5[ui]: Compiled/running with OpenSSL 1.0.1e 11 Feb 2013 2015.05.06 12:08:03 LOG5[ui]: Threading:PTHREAD Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI 2015.05.06 12:08:03 LOG7[ui]: errno: (*_Errno()) 2015.05.06 12:08:03 LOG5[ui]: Reading configuration from file /opt/freeware/etc/stunnel/stunnel.conf 2015.05.06 12:08:03 LOG5[ui]: UTF-8 byte order mark not detected 2015.05.06 12:08:03 LOG7[ui]: Compression disabled 2015.05.06 12:08:03 LOG7[ui]: Snagged 64 random bytes from //.rnd 2015.05.06 12:08:03 LOG7[ui]: Wrote 1024 new random bytes to //.rnd 2015.05.06 12:08:03 LOG7[ui]: PRNG seeded successfully 2015.05.06 12:08:03 LOG6[ui]: Initializing service [client] 2015.05.06 12:08:03 LOG6[ui]: Loading certificate from file: /usr/share/ssl/certs/skdkgesaix53-client-cert.pem 2015.05.06 12:08:03 LOG6[ui]: Loading key from file: /usr/share/ssl/certs/skdkgesaix53-client-key.pem 2015.05.06 12:08:03 LOG7[ui]: Private key check succeeded 2015.05.06 12:08:03 LOG7[ui]: Verify directory set to /usr/share/ssl/certs 2015.05.06 12:08:03 LOG7[ui]: Added /usr/share/ssl/certs revocation lookup directory 2015.05.06 12:08:03 LOG6[ui]: Peer certificate location /usr/share/ssl/certs 2015.05.06 12:08:03 LOG7[ui]: SSL options: 0x01000004 (+0x03000000, -0x02000000) 2015.05.06 12:08:03 LOG6[ui]: Initializing service [server] 2015.05.06 12:08:03 LOG6[ui]: Loading certificate from file: /usr/share/ssl/certs/skdkgesaix53-server-cert.pem 2015.05.06 12:08:03 LOG6[ui]: Loading key from file: /usr/share/ssl/certs/skdkgesaix53-server-key.pem 2015.05.06 12:08:03 LOG7[ui]: Private key check succeeded 2015.05.06 12:08:03 LOG7[ui]: Verify directory set to /usr/share/ssl/certs 2015.05.06 12:08:03 LOG7[ui]: Added /usr/share/ssl/certs revocation lookup directory 2015.05.06 12:08:03 LOG6[ui]: Peer certificate location /usr/share/ssl/certs 2015.05.06 12:08:03 LOG7[ui]: DH initialization 2015.05.06 12:08:03 LOG7[ui]: Could not load DH parameters from /usr/share/ssl/certs/skdkgesaix53-server-cert.pem 2015.05.06 12:08:03 LOG7[ui]: Using hardcoded DH parameters 2015.05.06 12:08:03 LOG7[ui]: DH initialized with 2048-bit key 2015.05.06 12:08:03 LOG7[ui]: ECDH initialization 2015.05.06 12:08:03 LOG7[ui]: ECDH initialized with curve prime256v1 2015.05.06 12:08:03 LOG7[ui]: SSL options: 0x01004004 (+0x03004000, -0x02000000) 2015.05.06 12:08:03 LOG5[ui]: Configuration successful 2015.05.06 12:08:03 LOG7[ui]: Listening file descriptor created (FD=7) 2015.05.06 12:08:03 LOG7[ui]: Service [client] (FD=7) bound to 127.0.0.1:22 2015.05.06 12:08:03 LOG7[ui]: Listening file descriptor created (FD=8) 2015.05.06 12:08:03 LOG7[ui]: Service [server] (FD=8) bound to 172.26.85.13:2222 2015.05.06 12:08:04 LOG7[main]: Created pid file /var/pid/stunnel.pid 2015.05.06 12:08:29 LOG7[main]: Service [server] accepted (FD=3) from 172.26.85.14:52649 2015.05.06 12:08:29 LOG7[0]: Service [server] started 2015.05.06 12:08:29 LOG5[0]: Service [server] accepted connection from 172.26.85.14:52649 2015.05.06 12:08:29 LOG7[0]: SSL state (accept): before/accept initialization 2015.05.06 12:08:29 LOG7[0]: SNI: no virtual services defined 2015.05.06 12:08:29 LOG7[0]: SSL state (accept): SSLv3 read client hello A 2015.05.06 12:08:29 LOG7[0]: SSL state (accept): SSLv3 write server hello A 2015.05.06 12:08:29 LOG7[0]: SSL state (accept): SSLv3 write certificate A INTERNAL ERROR: Bad magic at tls.c, line 182 --Doug

2 4

Stunnel4 not working?
by David H. Durgee 09 May '15

09 May '15

> Please see highlighted below: > > On Fri, May 8, 2015 at 5:27 PM, David H. Durgee <dhdurgee at verizon.net <https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users>> > wrote: > > >/ At some point in the near past stunnel stopped working on my laptop. The > />/ laptop is running Linux Mint 17.1 Rebecca x64 and stunnel from the > />/ repositories. I enabled debug=7, but I am not getting much from the log: > />/ > />/ > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Clients allowed=500 > />/ > />/ > />/ > />/ *2015.05.08 17 <2015.05.08%2017>:12:06 LOG5[10804:140318864611136]: > />/ stunnel 4.53 on x86_64-pc-linux-gnu platform 2015.05.08 17 > />/ <2015.05.08%2017>:12:06 LOG5[10804:140318864611136]: Compiled with OpenSSL > />/ 1.0.1e 11 Feb 2013 2015.05.08 17 <2015.05.08%2017>:12:06 > />/ LOG5[10804:140318864611136]: Running with OpenSSL 1.0.1f 6 Jan 2014 > />/ 2015.05.08 17 <2015.05.08%2017>:12:06 LOG5[10804:140318864611136]: Update > />/ OpenSSL shared libraries or rebuild stunnel* > / > > Is there a reason that you're using libraries from a different compiled > Stunnel? In fact, isn't there another Stunnel package you can use that is > more up-to-date? If not, perhaps compile your own using the OpenSSL > libraries that comes with Mint. I am using the package from the Mint repository, which in this case is the Ubuntu Trusty repository. If you know of a repository I can add with a more current package I will do so. If necessary I guess I could build from source, but I don't do that often and would prefer to locate a binary. > >/ > />/ 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Threading:PTHREAD > />/ SSL:+ENGINE+OCSP Auth:LIBWRAP Sockets:POLL+IPv6 > />/ 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Reading configuration > />/ from file /etc/stunnel/stunnel.conf > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Compression not enabled > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: PRNG seeded successfully > />/ 2015.05.08 17:12:06 LOG6[10804:140318864611136]: Initializing service > />/ section [telnets] > />/ *2015.05.08 17 <2015.05.08%2017>:12:06 LOG4[10804:140318864611136]: > />/ Insecure file permissions on /etc/ssl/certs/stunnel.pem* > / > > Warning: the permissions may be too wide-open (should be 700 I assume) > > > >/ > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate: > />/ /etc/ssl/certs/stunnel.pem > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate loaded > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Key file: > />/ /etc/ssl/certs/stunnel.pem > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Private key loaded > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: SSL options set: > />/ 0x00000004 > />/ 2015.05.08 17:12:06 LOG6[10804:140318864611136]: Initializing service > />/ section [dsp3270s] > />/ *2015.05.08 17 <2015.05.08%2017>:12:06 LOG4[10804:140318864611136]: > />/ Insecure file permissions on /etc/ssl/certs/stunnel.pem* > / > > Same as above, perhaps too wide open, permissions should be 700 I assume. > > > >/ > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate: > />/ /etc/ssl/certs/stunnel.pem > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate loaded > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Key file: > />/ /etc/ssl/certs/stunnel.pem > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Private key loaded > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: SSL options set: > />/ 0x00000004 > />/ 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Configuration successful > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Service [telnets] > />/ (FD=12) bound to 0.0.0.0:3141 > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Service [dsp3270s] > />/ (FD=13) bound to 0.0.0.0:7490 > />/ 2015.05.08 17:12:06 LOG7[10810:140318864611136]: Created pid file > />/ /stunnel4.pid > />/ 2015.05.08 17:12:31 LOG7[10810:140318864611136]: Service [telnets] > />/ accepted (FD=3) from 127.0.0.1:40090 > />/ 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Service [telnets] started > />/ 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Waiting for a libwrap > />/ process > />/ 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Acquired libwrap process > />/ #0 > />/ > />/ > />/ *2015.05.08 17 <2015.05.08%2017>:12:31 LOG3[10810:140318864770816]: > />/ Unexpected socket close (read_blocking) 2015.05.08 17 > />/ <2015.05.08%2017>:12:31 LOG5[10810:140318864770816]: Connection reset: 0 > />/ byte(s) sent to SSL, 0 byte(s) sent to socket 2015.05.08 17 > />/ <2015.05.08%2017>:12:31 LOG7[10810:140318864770816]: Local socket (FD=3) > />/ closed* > / > > that sounds like SELinux permissions perhaps? Have you tried temporarily > disabling SELinux, or perhaps you have a firewall (iptables) set up? You'll > have to allow the incoming port and possibly an entry in /etc/services > IIRC. I don't know if this helps but this is what I found: > https://sites.google.com/site/easylinuxtipsproject/security > A link to "ufw" may prove useful, if your system has that installed. Most > systems have locked-down privileged ports (any port less than 1024, like in > your example). I do have ufw here, but I have the same problem with it enabled or disabled. The telnets service is listening on port 3141 and the dsp3270s on port 7490, so neither of them are privileged ports. > >/ > />/ 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Service [telnets] > />/ finished (0 left) > />/ 2015.05.08 17:12:31 LOG7[10810:140318864770816]: str_stats: 1 block(s), > />/ 32 data byte(s), 58 control byte(s) > />/ 2015.05.08 17:13:32 LOG7[10810:140318864611136]: Service [dsp3270s] > />/ accepted (FD=3) from 127.0.0.1:48534 > />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Service [dsp3270s] > />/ started > />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Waiting for a libwrap > />/ process > />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Acquired libwrap process > />/ #1 > />/ *2015.05.08 17 <2015.05.08%2017>:13:32 LOG3[10810:140318864770816]: > />/ Unexpected socket close (read_blocking)* > />/ > / > That sounds like some kind of firewall issue (like above). As noted above, same behavior with ufw enabled or disabled. > >/ 2015.05.08 17:13:32 LOG5[10810:140318864770816]: Connection reset: 0 > />/ byte(s) sent to SSL, 0 byte(s) sent to socket > />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Local socket (FD=3) > />/ closed > />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Service [dsp3270s] > />/ finished (0 left) > />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: str_stats: 1 block(s), > />/ 32 data byte(s), 58 control byte(s) > />/ > />/ > / When in a situation like this, I would first try unprivileged ports with > localhost using iperf, just to generate some dummy traffic. A good > technique I use when debugging stunnel versus debugging networking or other > security issues is to do local traffic only like this: > > 1. iperf client connect to localhost port 5000 > 2. Stunnel client listen on port 5000, connect to localhost port 6000 > 3. Stunnel server listen on port 6000, connect to localhost port 7000 > 4. iperf server listening on localhost port 7000 > > As you can see from that, running iperf client for a few seconds, it should > be able to connect to the iperf server. If not, stunnel is not working. > Debug this FIRST before proceeding to working with non-localhost IP > addresses. The actual procedure would be as follows: > > 1. Download/install iperf > 2. Verify iperf works by having one shell run as server, listening on > localhost port 7000, and another shell setup iperf client sending on port > 7000. If that works, then proceed. Don't use iperf to connect to port 7000 > again. > 3. Set up two config files, one for stunnel client and one for stunnel > server, with different ports and the "client=yes" in the client config > file. For easier detection with "ps" or "top", you can copy the executable > file to another name (i.e., "s4client" for the stunnel 4 client, and > "s4server" for the stunnel 4 server). Similarly for iperf, you can copy the > exe to "iperfc" and "iperfs" for iperf server, for easier process detection. > 4. Start up the stunnel server first, then stunnel client, with the > appropriate config files per the port enumeration mentioned above. > 5. Start iperf server listening on port 7000. > 6. Start iperf client sending on port 5000. If you get some really large > value or nothing, then your stunnel config (client/server) needs to be > debugged first before proceeding to non-localhost IPs. I usually get > something like 3GB/sec when using a Windows 7 VM inside Windows 7 doing > this from DOS prompts with appropriate server/client configs set up. I > usually use four windows: two for iperf (c/s), two for stunnel (c/s). > > Hope that helps... > -Rob I have an stunnel server on another system on the LAN and that is the one I am having the client with the problem connect to while trying to find the problem. I know that server is working, as I have seen other incoming traffic handled by it. I suspect the problem is related to the message you pointed out that I missed about SSL libraries. I would very much appreciate a pointer to a more current package in a repository. Thanks for your response, Rob. Dave

1 0

Stunnel 5.17 build on AIX - libssp missing
by Rob Lockhart 09 May '15

09 May '15

I have AIX 6.1 (64-bit) with GCC 4.2.0. It has an older version of OpenSSL (0.9.8) installed from IBM but I'm trying to compile Stunnel 5.17 with OpenSSL 1.0.2a-fips as non-root. I proceed as follows: cd ~; [ -d openssl ] && rm -rf openssl; mkdir openssl cd ~/OpenSSL; [ -d openssl-fips-2.0.9 ] && rm -rf openssl-fips-2.0.9 gzip -dc openssl-fips-2.0.9.tar.gz | tar xvf - cd openssl-fips-2.0.9; chmod 755 Configure ./Configure aix64-gcc --openssldir=$HOME/openssl make make install NOTE: the above is just the FIPS canister (library), not the executable. cd ~/OpenSSL; [ -d openssl-1.0.2a ] && rm -rf openssl-1.0.2a gzip -dc openssl-1.0.2a.tar.gz | tar xvf - cd openssl-1.0.2a; chmod 755 Configure ./Configure aix64-gcc fips shared --openssldir=$HOME/openssl --with-fipsdir=$HOME/openssl make depend make make test make install cd ~/openssl/bin; ./openssl version; ./openssl speed NOTE: Look for "ALL OCSP TESTS SUCCESSFUL" after "make test" to verify the test build was successful, and it was. NOTE: "./openssl version" should show "OpenSSL 1.0.2a-fips 19 Mar 2015" NOTE: "./openssl speed" should take a while as it's measuring the speed for all algorithms Final test of OpenSSL 1.0.2a-fips: ./openssl sha1 -hmac etaonrishdlcupfm ~/OpenSSL/openssl-fips-2.0.9.tar.gz - should return: 54552e9a3ed8d1561341e8945fcdec55af961322 Now, I try to compile Stunnel: rm -rf $HOME/stunnel-bin; mkdir $HOME/stunnel-bin cd ~/Stunnel; [ -f stunnel-5.17 ] && rm -rf stunnel-5.17 gzip -dc stunnel-5.17.tar.gz | tar xvf - ; cd stunnel-5.17 ./configure --enable-fips --prefix=$HOME/stunnel-bin --with-ssl=$HOME/openssl make I get a failure at make for a library not found: /bin/sh ../libtool --tag=CC --mode=link gcc -g -O2 -D_THREAD_SAFE -Wall -Wextra -Wformat=2 -Wconversion -Wno-long-long -Wno-deprecated-declarations -fstack-protector -fPIE -D_FORTIFY_SOURCE=2 -L/home/lockharr/openssl/lib64 -L/home/lockharr/openssl/lib -lssl -lcrypto -o stunnel stunnel-tls.o stunnel-str.o stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-fd.o stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o stunnel-ui_unix.o -lpthreads libtool: link: gcc -g -O2 -D_THREAD_SAFE -Wall -Wextra -Wformat=2 -Wconversion -Wno-long-long -Wno-deprecated-declarations -fstack-protector -fPIE -D_FORTIFY_SOURCE=2 -o stunnel stunnel-tls.o stunnel-str.o stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-fd.o stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o stunnel-ui_unix.o -L/home/lockharr/openssl/lib64 -L/home/lockharr/openssl/lib -lssl -lcrypto -lpthreads collect2: library libssp_nonshared not found The interesting part is that doing a "grep -R libssp" of the source tree only shows one reference to libssp: $ grep -R libssp * stunnel-5.17/tools/stunnel.nsi: # MINGW builds requires libssp-0.dll instead of msvcr90.dll Googling showed some really old links that had libssp skipped for GCC on AIX: http://gcc.gnu.org/ml/gcc-patches/2005-09/msg01231.html and another that added it back in: http://marc.info/?l=gcc-patches&m=130168534803966 Can anyone who has compiled this for AIX give me a clue about what's going on? This looks like a reference to a non-existent library but I would think that if GCC needed that, it wouldn't allow the RPM for GCC to be installed. Thanks, -Rob

2 1

Stunnel4 not working?
by David H. Durgee 08 May '15

08 May '15

At some point in the near past stunnel stopped working on my laptop. The laptop is running Linux Mint 17.1 Rebecca x64 and stunnel from the repositories. I enabled debug=7, but I am not getting much from the log: 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Clients allowed=500 2015.05.08 17:12:06 LOG5[10804:140318864611136]: stunnel 4.53 on x86_64-pc-linux-gnu platform 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Compiled with OpenSSL 1.0.1e 11 Feb 2013 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Running with OpenSSL 1.0.1f 6 Jan 2014 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Update OpenSSL shared libraries or rebuild stunnel 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Threading:PTHREAD SSL:+ENGINE+OCSP Auth:LIBWRAP Sockets:POLL+IPv6 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Reading configuration from file /etc/stunnel/stunnel.conf 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Compression not enabled 2015.05.08 17:12:06 LOG7[10804:140318864611136]: PRNG seeded successfully 2015.05.08 17:12:06 LOG6[10804:140318864611136]: Initializing service section [telnets] 2015.05.08 17:12:06 LOG4[10804:140318864611136]: Insecure file permissions on /etc/ssl/certs/stunnel.pem 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate: /etc/ssl/certs/stunnel.pem 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate loaded 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Key file: /etc/ssl/certs/stunnel.pem 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Private key loaded 2015.05.08 17:12:06 LOG7[10804:140318864611136]: SSL options set: 0x00000004 2015.05.08 17:12:06 LOG6[10804:140318864611136]: Initializing service section [dsp3270s] 2015.05.08 17:12:06 LOG4[10804:140318864611136]: Insecure file permissions on /etc/ssl/certs/stunnel.pem 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate: /etc/ssl/certs/stunnel.pem 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate loaded 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Key file: /etc/ssl/certs/stunnel.pem 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Private key loaded 2015.05.08 17:12:06 LOG7[10804:140318864611136]: SSL options set: 0x00000004 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Configuration successful 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Service [telnets] (FD=12) bound to 0.0.0.0:3141 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Service [dsp3270s] (FD=13) bound to 0.0.0.0:7490 2015.05.08 17:12:06 LOG7[10810:140318864611136]: Created pid file /stunnel4.pid 2015.05.08 17:12:31 LOG7[10810:140318864611136]: Service [telnets] accepted (FD=3) from 127.0.0.1:40090 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Service [telnets] started 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Waiting for a libwrap process 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Acquired libwrap process #0 2015.05.08 17:12:31 LOG3[10810:140318864770816]: Unexpected socket close (read_blocking) 2015.05.08 17:12:31 LOG5[10810:140318864770816]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Local socket (FD=3) closed 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Service [telnets] finished (0 left) 2015.05.08 17:12:31 LOG7[10810:140318864770816]: str_stats: 1 block(s), 32 data byte(s), 58 control byte(s) 2015.05.08 17:13:32 LOG7[10810:140318864611136]: Service [dsp3270s] accepted (FD=3) from 127.0.0.1:48534 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Service [dsp3270s] started 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Waiting for a libwrap process 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Acquired libwrap process #1 2015.05.08 17:13:32 LOG3[10810:140318864770816]: Unexpected socket close (read_blocking) 2015.05.08 17:13:32 LOG5[10810:140318864770816]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Local socket (FD=3) closed 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Service [dsp3270s] finished (0 left) 2015.05.08 17:13:32 LOG7[10810:140318864770816]: str_stats: 1 block(s), 32 data byte(s), 58 control byte(s) I don't even see the IP address for the outbound connection, so it seems as if it is hitting a problem even before it gets that far. Configuration is pretty simple: ; Sample stunnel configuration file by Michal Trojnara 2002-2009 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of the chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /etc/ssl/certs/stunnel.pem ;key = /etc/ssl/certs/stunnel.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = TLSv1 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 ; PID is created inside the chroot jail pid = /stunnel4.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 socket = l:SO_KEEPALIVE=1 socket = r:SO_KEEPALIVE=1 socket = l:TCP_KEEPCNT=5 socket = r:TCP_KEEPCNT=5 socket = l:TCP_KEEPIDLE=10 socket = r:TCP_KEEPIDLE=10 socket = l:TCP_KEEPINTVL=2 socket = r:TCP_KEEPINTVL=2 ;compression = zlib ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [telnets] accept = 3141 ;connect = 192.168.80.11:992 ;connect = DurgeeEnterprises.publicvm.com:992 connect = 192.168.80.5:992 [dsp3270s] accept = 7490 ;connect = 192.168.80.11:246 ;connect = DurgeeEnterprises.publicvm.com:246 connect = 192.168.80.5:246 ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini Any thoughts on how to track this down and get this working? Dave

2 1

problem migrating from 4.54 to 5.x
by Scott Weisman 04 May '15

04 May '15

Hi there. I have a program I have used successfully with Stunnel for many years. A while back, I discovered that my program, which is a pure stdio console program, stopped working with 5.x versions of Stunnel. I have spent many hours but have been unable to solve the problem, so I regretfully continue to use the 4.x branch. I was wondering if anyone had similar experiences? Relevant data is pasted below. I comment in the log output where the problem occurs. Any help at all would be greatly appreciated. stunnel.conf: setuid = stunnel setgid = stunnel pid = /var/run/stunnel/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 foreground = no debug = 7 output = /var/log/stunnel.log [CF2] client = no accept = 21 verify = 3 sslVersion = all cert = /etc/stunnel/demo.pem key = /etc/stunnel/demo.pem CApath = /etc/stunnel/certs CRLpath = /etc/stunnel/crls TIMEOUTbusy = 60 TIMEOUTclose = 0 TIMEOUTconnect = 60 TIMEOUTidle = 60 exec = /opt/cmf/bin/cf-server execargs = /opt/cmf/bin/cf-server -p /opt/jail/stunnel/pipes/ Log of successful session with 4.54: 2015.05.01 15:39:39 LOG7[3080:140402563495680]: Starting certificate verification: depth=0, /C=US/L=Bryan/ST=TX/O=Demo Account/emailAddress= demo(a)demo.com/CN=demo 2015.05.01 15:39:39 LOG6[3080:140402563495680]: CERT: Locally installed certificate matched 2015.05.01 15:39:39 LOG5[3080:140402563495680]: Certificate accepted: depth=0, /C=US/L=Bryan/ST=TX/O=Demo Account/emailAddress= demo(a)demo.com/CN=demo 2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3 read client certificate A 2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3 read client key exchange A 2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3 read certificate verify A 2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3 read finished A 2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3 write session ticket A 2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3 write change cipher spec A 2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3 write finished A 2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3 flush data 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 items in the session cache 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 client connects (SSL_connect()) 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 client connects that finished 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 client renegotiations requested 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 1 server connects (SSL_accept()) 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 1 server connects that finished 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 server renegotiations requested 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 session cache hits 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 external session cache hits 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 session cache misses 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 session cache timeouts 2015.05.01 15:39:39 LOG6[3080:140402563495680]: SSL accepted: new session negotiated 2015.05.01 15:39:39 LOG6[3080:140402563495680]: Negotiated TLSv1/SSLv3 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2015.05.01 15:39:39 LOG6[3080:140402563495680]: Compression: null, expansion: null 2015.05.01 15:39:39 LOG6[3080:140402563495680]: Local mode child started (PID=3118) 2015.05.01 15:39:39 LOG7[3080:140402563495680]: Remote socket (FD=11) initialized *** the connection is established and stable; i explicitly disconnect several seconds later 2015.05.01 15:39:45 LOG7[3080:140402563495680]: SSL socket closed on SSL_read 2015.05.01 15:39:45 LOG7[3080:140402563495680]: Sent socket write shutdown 2015.05.01 15:39:45 LOG5[3080:140402563495680]: Connection closed: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2015.05.01 15:39:45 LOG7[3080:140402563495680]: Remote socket (FD=11) closed 2015.05.01 15:39:45 LOG7[3080:140402563495680]: Local socket (FD=3) closed 2015.05.01 15:39:45 LOG7[3080:140402563495680]: Service [CF2] finished (0 left) Log of unsuccessful session with 5.16: 2015.05.01 15:37:33 LOG7[0]: Verification started at depth=0: C=US, L=Bryan, ST=TX, O=Demo Account, emailAddress=demo(a)demo.com, CN=demo 2015.05.01 15:37:33 LOG7[0]: CERT: Pre-verification succeeded 2015.05.01 15:37:33 LOG6[0]: CERT: Locally installed certificate matched 2015.05.01 15:37:33 LOG5[0]: Certificate accepted at depth=0: C=US, L=Bryan, ST=TX, O=Demo Account, emailAddress=demo(a)demo.com, CN=demo 2015.05.01 15:37:33 LOG7[0]: SSL state (accept): SSLv3 read client certificate A 2015.05.01 15:37:33 LOG7[0]: SSL state (accept): SSLv3 read client key exchange A 2015.05.01 15:37:33 LOG7[0]: SSL state (accept): SSLv3 read certificate verify A 2015.05.01 15:37:33 LOG7[0]: SSL state (accept): SSLv3 read finished A 2015.05.01 15:37:33 LOG7[0]: SSL state (accept): SSLv3 write change cipher spec A 2015.05.01 15:37:33 LOG7[0]: SSL state (accept): SSLv3 write finished A 2015.05.01 15:37:33 LOG7[0]: SSL state (accept): SSLv3 flush data 2015.05.01 15:37:33 LOG7[0]: 1 server accept(s) requested 2015.05.01 15:37:33 LOG7[0]: 1 server accept(s) succeeded 2015.05.01 15:37:33 LOG7[0]: 0 server renegotiation(s) requested 2015.05.01 15:37:33 LOG7[0]: 0 session reuse(s) 2015.05.01 15:37:33 LOG7[0]: 0 internal session cache item(s) 2015.05.01 15:37:33 LOG7[0]: 0 internal session cache fill-up(s) 2015.05.01 15:37:33 LOG7[0]: 0 internal session cache miss(es) 2015.05.01 15:37:33 LOG7[0]: 0 external session cache hit(s) 2015.05.01 15:37:33 LOG7[0]: 0 expired session(s) retrieved 2015.05.01 15:37:33 LOG6[0]: SSL accepted: new session negotiated 2015.05.01 15:37:33 LOG7[0]: Peer certificate was cached (1610 bytes) 2015.05.01 15:37:33 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2015.05.01 15:37:33 LOG7[0]: Compression: null, expansion: null 2015.05.01 15:37:33 LOG6[0]: Local mode child started (PID=2899) 2015.05.01 15:37:33 LOG7[0]: Remote socket (FD=11) initialized *** immediately after successful connection, something happens; my program has no log output either, which seems to indicate that stunnel is closing it 2015.05.01 15:37:33 LOG6[0]: Read socket closed (readsocket) 2015.05.01 15:37:33 LOG7[main]: Dispatching signals from the signal pipe 2015.05.01 15:37:33 LOG7[0]: Sending close_notify alert 2015.05.01 15:37:33 LOG7[main]: Processing SIGCHLD 2015.05.01 15:37:33 LOG7[0]: SSL alert (write): warning: close notify 2015.05.01 15:37:33 LOG6[main]: Child process 2899 terminated on signal 11 2015.05.01 15:37:33 LOG6[0]: SSL_shutdown successfully sent close_notify alert 2015.05.01 15:37:33 LOG7[main]: Signal pipe is empty 2015.05.01 15:37:33 LOG3[0]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing 2015.05.01 15:37:33 LOG5[0]: Connection closed: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2015.05.01 15:37:33 LOG7[0]: Remote socket (FD=11) closed 2015.05.01 15:37:33 LOG7[0]: Local socket (FD=3) closed 2015.05.01 15:37:33 LOG7[0]: Service [CF2] finished (0 left)

2 2

Segfault in stunnel
by Miroslaw Pietrzyk 03 May '15

03 May '15

Hi, I have a problem with one of the stunnel installation (debian7). After some time of operation automatically turns itself off with the message: (...) Apr 24 21:03:45 routerpri kernel: [177332.400502] stunnel[34426]: segfault at 0 ip 00007f1f99ca9e20 sp 00007f1f99c16c68 error 4 in stunnel[7f1f99c94000+24000] (...) Apr 24 21:21:36 routerpri kernel: [178402.360532] stunnel[34795]: segfault at 0 ip 00007f84d6b8be20 sp 00007f84d6b49c68 error 4 in stunnel[7f84d6b76000+24000] (...) Apr 24 21:23:31 routerpri kernel: [178517.215345] stunnel[34908]: segfault at 0 ip 00007f150c5b3e20 sp 00007f150c58cc68 error 4 in stunnel[7f150c59e000+24000] (...) stunnel 5.15 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.1e 11 Feb 2013 stunnel.conf: pid = /var/run/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel.log syslog = yes client = no fips = no verify = 0 CAfile = /etc/stunnel/SubCA2.crt CRLfile = /etc/stunnel/SubCA2_CRL.pem [service_1] accept = 192.168.1.10:1000 connect = 192.168.1.10:1234 cert = /etc/stunnel/cert1.crt key = /etc/stunnel/cert1_key.pem ciphers = HIGH:!SSLv2:!ADH:!Exp:!aNULL:!eNULL:!NULL sslVersion = TLSv1.2 When I use the lower level of encryption for example SSLv3, problem occurs after a longer period of normal operation. I will only add that the problem has also appeared on the previous version 4.54, which I was updating to the newest. Do you have any idea what could be causing the problem. Regards Mirek

2 2

HSM usage
by Vedat Nommaz 01 May '15

01 May '15

>> What would be the equivalent of below s_server command in stunnel? >> >> openssl s_server -accept 5003 -engine chil -keyform engine -key rsa-priv -cert public.pem -tls1_2 >> >> In this example "rsa-priv" references the private key inside a hardware security module, not a pem file. >> >> I saw an option for engineid in the documentation, but nothing for keyform parameter.

1 0

stunnel 5.17 release
by Michal Trojnara 29 Apr '15

29 Apr '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.17 of stunnel. The ChangeLog entry: Version 5.17, 2015.04.29, urgency: HIGH: * Bugfixes - Fixed a NULL pointer dereference causing the service to crash. This bug was introduced in stunnel 5.15. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: c3e79e582621a0827125e35e1c00450190104fc02dc3c5274cb02b05859fd472 stunnel-5.17.tar.gz 07a508de3807663f71e4793fd5edb4c57b6c82b4c9008753f8f6c85a17acbeea stunnel-5.17-installer.exe 49d2cc11aefe2062576a0bbfafa3beb5ae541683d90972c6ed457b19a455c346 stunnel-5.17-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVQSIlAAoJEC78f/DUFuAU5XEP/R2d2gXCeKk7d/466dOYF//A YlXC6oDbs7OB8qEHH3u5u5hl8WIZJOmbPb79APSJKd7ESREoRk97UBJZYoH+QuEB CHOs0czty5IE2QyMibHJZ4Zed23q/QHrTRL9GpZd8EPkmiRG/dq7M+vC0gJJuF+N 4CPCNj464ATtjFB3mPju+wQinnWj8s57kNAazifAQNvM/jhdJOMH+BOvXIGEwUlt iZ8MBwO707j81UWkSFANxn1GMTOoJY2pTTAmJr/eKun9sLbuN7v4ec8Mtwdcj16P 5CeXD1g7gOK5q2FizIUWfBD38nPRVBXMqfSAkjtezwqZJb1K4bfa505E4SY3bKzL CJstbH206rQriqhpV4hrsuGVmb6M7lt57zAJZ746NQtlRm1gLdf/56JclsHqmkqo Z6zAuXRAiarkn88OsERp8r84Y4l8q/D8dkZwYPObSCT+SAMimPzLxhu9sjIKsb1I lSFNS2P9sEw/MhM9yQGfyC0GKzQWrQIONFHP2iCS8+ySEc+6/1b9tB9oiOcsAL1c edWV3m5SQzG7TbsbtApRy6Pvb30O7/5zAJOiBN6Yf5OQ8OyjL4M9+ZKd75qQxsQj IEZNJW/caVz9QwNWc2BQtaUVy7RC0CaTmbebsoQWlKQmzosXMU2QgC/WJ3jQdslz Vc3C3rKKvwGPw1DZLX95 =tC15 -----END PGP SIGNATURE-----

1 0

startup issues
by Coviello, Paul 24 Apr '15

24 Apr '15

Hi, Well I got it started on VMS and wanted to put it in debug mode, so I shut it down made my changes to the conf file and now well I can't start it with the command procedure. I even tried the old conf and same thing... $ @STUNNEL_STARTUP_SERVER Is the private key (in the PEM file) encrypted? [Y/N]: Y Enter the password to decrypt the key (please use paired double quotes with it): ""XXXXXXXXX"" Starting up a Stunnel %RUN-S-PROC_ID, identification of created process is 209FCA70 Stunnel server failed to start up-- check the configuration, etc. Nothing is logged... But if I do the following $ stunnel STUNNEL_SERVER.CONF And the output to the screen... 2015.04.24 10:35:24 LOG7[547326662:2071228096]: Snagged 64 random bytes from sys$common:[sysmgr].rnd 2015.04.24 10:35:24 LOG7[547326662:2071228096]: Wrote 1024 new random bytes to sys$common:[sysmgr].rnd 2015.04.24 10:35:24 LOG7[547326662:2071228096]: RAND_status claims sufficient entropy for the PRNG 2015.04.24 10:35:24 LOG7[547326662:2071228096]: PRNG seeded successfully 2015.04.24 10:35:24 LOG7[547326662:2071228096]: Certificate: stunnel.pem 2015.04.24 10:35:24 LOG7[547326662:2071228096]: Certificate loaded 2015.04.24 10:35:24 LOG7[547326662:2071228096]: Key file: stunnel.pem Enter PEM pass phrase: 2015.04.24 10:35:31 LOG7[547326662:2071228096]: Private key loaded 2015.04.24 10:35:31 LOG7[547326662:2071228096]: SSL context initialized for service telnet This is where it sits unless I do a ctrl-c to cancel and get back to the system prompt. And when I do my telnet session I cannot connect. Well I connect but no prompts for me to login But now I have log output! :) 2015.04.24 10:08:31 LOG5[547326662:2071228096]: stunnel undefined on vax-openvms with OpenSSL 0.9.8h 28 May 2008 2015.04.24 10:08:31 LOG5[547326662:2071228096]: Threading:PTHREAD Sockets:POLL,IPv4 2015.04.24 10:08:31 LOG6[547326662:2071228096]: file ulimit = 512 (can be changed with 'ulimit -n') 2015.04.24 10:08:31 LOG6[547326662:2071228096]: poll() used - no FD_SETSIZE limit for file descriptors 2015.04.24 10:08:31 LOG5[547326662:2071228096]: 250 clients allowed 2015.04.24 10:08:31 LOG7[547326662:2071228096]: FD 5 in non-blocking mode 2015.04.24 10:08:31 LOG7[547326662:2071228096]: FD 4 in non-blocking mode 2015.04.24 10:08:31 LOG7[547326662:2071228096]: FD 6 in non-blocking mode 2015.04.24 10:08:31 LOG7[547326662:2071228096]: SO_REUSEADDR option set on accept socket 2015.04.24 10:08:31 LOG7[547326662:2071228096]: telnet bound to 0.0.0.0: 2015.04.24 10:15:00 LOG3[547326662:2071228096]: Received signal 2; terminating 2015.04.24 10:18:18 LOG5[547326662:2071228096]: stunnel undefined on vax-openvms with OpenSSL 0.9.8h 28 May 2008 2015.04.24 10:18:18 LOG5[547326662:2071228096]: Threading:PTHREAD Sockets:POLL,IPv4 2015.04.24 10:18:18 LOG6[547326662:2071228096]: file ulimit = 512 (can be changed with 'ulimit -n') 2015.04.24 10:18:18 LOG6[547326662:2071228096]: poll() used - no FD_SETSIZE limit for file descriptors 2015.04.24 10:18:18 LOG5[547326662:2071228096]: 250 clients allowed 2015.04.24 10:18:18 LOG7[547326662:2071228096]: FD 5 in non-blocking mode 2015.04.24 10:18:18 LOG7[547326662:2071228096]: FD 4 in non-blocking mode 2015.04.24 10:18:18 LOG7[547326662:2071228096]: FD 6 in non-blocking mode 2015.04.24 10:18:18 LOG7[547326662:2071228096]: SO_REUSEADDR option set on accept socket 2015.04.24 10:18:19 LOG7[547326662:2071228096]: telnet bound to 0.0.0.0: 2015.04.24 10:21:08 LOG6[547326662:2071228096]: going to accept mode 2015.04.24 10:21:08 LOG7[547326662:2071228096]: telnet accepted FD=7 from 192.168.20.140:59281 2015.04.24 10:21:08 LOG6[547326662:2071228096]: accepted connection 2015.04.24 10:21:08 LOG7[547326662:8966656]: telnet started 2015.04.24 10:21:08 LOG7[547326662:8966656]: FD 7 in non-blocking mode 2015.04.24 10:21:08 LOG7[547326662:8966656]: TCP_NODELAY option set on local socket 2015.04.24 10:21:08 LOG5[547326662:8966656]: telnet accepted connection from 0.0.0.0: 2015.04.24 10:21:08 LOG7[547326662:8966656]: SSL state (accept): before/accept initialization 2015.04.24 10:21:30 LOG3[547326662:8966656]: SSL_accept: Peer suddenly disconnected 2015.04.24 10:21:30 LOG5[547326662:8966656]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2015.04.24 10:21:30 LOG7[547326662:8966656]: telnet finished (0 left) 2015.04.24 10:21:31 LOG6[547326662:2071228096]: going to accept mode 2015.04.24 10:21:31 LOG7[547326662:2071228096]: telnet accepted FD=7 from 192.168.20.140:59283 2015.04.24 10:21:31 LOG6[547326662:2071228096]: accepted connection 2015.04.24 10:21:31 LOG7[547326662:8966656]: telnet started 2015.04.24 10:21:31 LOG7[547326662:8966656]: FD 7 in non-blocking mode 2015.04.24 10:21:31 LOG7[547326662:8966656]: TCP_NODELAY option set on local socket 2015.04.24 10:21:31 LOG5[547326662:8966656]: telnet accepted connection from 0.0.0.0: 2015.04.24 10:21:31 LOG7[547326662:8966656]: SSL state (accept): before/accept initialization 2015.04.24 10:21:32 LOG3[547326662:8966656]: SSL_accept: Peer suddenly disconnected 2015.04.24 10:21:32 LOG5[547326662:8966656]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2015.04.24 10:21:32 LOG7[547326662:8966656]: telnet finished (0 left) 2015.04.24 10:21:33 LOG6[547326662:2071228096]: going to accept mode 2015.04.24 10:21:33 LOG7[547326662:2071228096]: telnet accepted FD=7 from 192.168.20.140:59284 2015.04.24 10:21:33 LOG6[547326662:2071228096]: accepted connection 2015.04.24 10:21:33 LOG7[547326662:8966656]: telnet started 2015.04.24 10:21:33 LOG7[547326662:8966656]: FD 7 in non-blocking mode 2015.04.24 10:21:33 LOG7[547326662:8966656]: TCP_NODELAY option set on local socket 2015.04.24 10:21:33 LOG5[547326662:8966656]: telnet accepted connection from 0.0.0.0: 2015.04.24 10:21:33 LOG7[547326662:8966656]: SSL state (accept): before/accept initialization 2015.04.24 10:21:34 LOG3[547326662:8966656]: SSL_accept: Peer suddenly disconnected 2015.04.24 10:21:34 LOG5[547326662:8966656]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2015.04.24 10:21:34 LOG7[547326662:8966656]: telnet finished (0 left) Paul J Coviello Senior System Administrator CCS Corporate Headquarters Two Wells Avenue, Newton, MA 02459 617.965.2000, Ext. 4004 [cid:[email protected]] [cid:[email protected]] CCS Commercial, LLC | CCS Resources, Inc. | ClaimAssist, LLC | Credit Control Services, Inc. Customer Contact Solutions, LLC | Enterprise Associates, LLC

2 4

Fwd: Comments/questions to Debian patches
by Michal Trojnara 24 Apr '15

24 Apr '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, Peter Pentchev, the Debian package maintainer for the "stunnel4" package, does not reply to my emails. I hope he is still alive and well, just too busy to maintain the package. I decided to share with you my comments to the patches that are applied to the Debian package. Hopefully, someone will find them useful. Mike - -------- Forwarded Message -------- Subject: Comments/questions to Debian patches Date: Tue, 28 Oct 2014 21:13:25 +0100 From: Michal Trojnara <Michal.Trojnara(a)mirt.net> To: Peter Pentchev <roam(a)ringlet.net> Hi Peter, Just a few comments/questions to improve the quality of Debian package. I'll be glad to discuss if you disagree with my opinions. 01-fix-paths.patch The patch description is quite outdated. Translation from sbin to bin was performed upstream in stunnel 4.21 released 27 Oct 2007. 8-) I guess: /usr/bin/stunnel -fd 10 \ should be: /usr/bin/stunnel4 -fd 10 \ Probably this should be added to the next patch: 02-rename-binary.patch 05-logrotate-warning-in-sample-conf.patch Good idea. I'll add it to stunnel 5.07. 08-client-example.patch I've already added this example in stunnel 5.02. Your patch adds it once again. Just remove it. 10-no-zlib-compression.patch I'm completely confused by this patch. According to my tests it only makes stunnel reporting different errors when a user tries to enable compression on Debian. Why would anyone need this patch? 11-no-rle-compression.patch IMHO OpenSSL bugs should be fixed in OpenSSL, and not in stunnel. YMMV 12-restore-pidfile-default.patch I strongly disagree with this approach, as it breaks configuration file compatibility with the upstream. Debian should instead rewrite stunnel.conf when upgrading from stunnel 4.xx. 14-lsb-init-functions.patch 8-) 15-upstream-systemd-libs.patch This (and more) will be included in stunnel 5.07. 16-upstream-sslv23-method.patch This will be included in stunnel 5.07. Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJVNsCAAAoJEC78f/DUFuAUpfUP/j13koMgtnVLfsACIqUEaZw3 1uADOP/Dugqbn/QcwSqWAlcTrf7So98AQrB88xAhN8C3fwP375GmcNmPgJx4RRme fU/Wo0aFaCq0JOReiQkNiyj3pqf+J2NxZlZM5ZpzzpA80x8AlyLqBwPfBAtxgYNJ rb5AyIoGPkzfXM8OSz8YJXZtgXT4lrSCE5djlWHHBqy9ioUZCEuyVXeT5Y90sXOg wOA/EX3fTKEJZckoiNoTPAh9pLZ9M29lLM7wLEu5BFWwh/TtHk0ZFADo3Kzi/+4G Q6h9236DmH1NHA/FzMfFbKEYz/0yeOUMfet8LsRNNRRrFJEp+miMemSYajGMA3IT UVW4UNOa+CppVgkRpVMGfl/Lw53GP63xbLIRuZs17py03hNBHz2pyZneWWKTJEun xJQC4QJ3Z3YYXd71jpHIKjcDBXmIzcG8Z9QylaTywk8MBBBpjuRTXkIAlWWj2Iyk LVRsAgtooUKlQzUoAoseRygDv+Wbp/qVNL1Zogy7PmfORmqZOz08jRpDlXFgjPjR evGztgApTR+FSMO9f052z/Sql0chb5mhtdAtdBKpRE3CgtIrCHfcalSOyeCleHJK NMEbqfed9Oq2WA0/W89ilGtJWRH4v0GnYCfbYhbSoXp9DytdHPbhRUsiJL8LO34b 1cuMSsQ9LjF+3WyRie4m =SrZs -----END PGP SIGNATURE-----

2 2

Redis with stunnel, need to reset a client connection if the remote server drops
by Cocytus 20 Apr '15

20 Apr '15

Hello all, I've spent some time digging through the archives, but have yet to turn up a solution to the issue I'm having. We're using Redis instances on 'cloud' resources, and have successfully gotten stunnel setup as a server on these nodes. Additionally an internal process runs and connects to a local stunnel client that then connects to the remote cloud instance. This is working well enough at the moment, however there is one issue I'm bumping into. If the remote EC2 node goes dark for a bit (ie: reboot), the local stunnel client will reconnect, however the internal process which is establishing its connection to the local stunnel client does not get disconnected and therefore doesn't know that redis became unavailable and needs to re-subscribe to the redis stream. I need to invalidate the established session when the remote reconnects. Can this be accomplished with either a TIMEOUT value or session statement? Below is a sample of the configuration: ########### [some-ec2-node.com] client = yes verify = 2 CApath = /etc/ssl/certs sslVersion = TLSv1 accept = 127.0.0.1:10008 connect = some-ec2-node.com:6379 ########### $ stunnel4 -version stunnel 4.53 on x86_64-pc-linux-gnu platform Compiled with OpenSSL 1.0.1e 11 Feb 2013 Running with OpenSSL 1.0.1f 6 Jan 2014 Update OpenSSL shared libraries or rebuild stunnel Threading:PTHREAD SSL:+ENGINE+OCSP Auth:LIBWRAP Sockets:POLL+IPv6 Global options: debug = daemon.notice pid = /var/run/stunnel4.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = ALL:!SSLv2:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH curve = prime256v1 session = 300 seconds sslVersion = TLSv1 for client, all for server stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none -- Josh

2 1

stunnel 5.16 release
by Michal Trojnara 19 Apr '15

19 Apr '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.16 of stunnel. This release only fixes a compilation issue with old versions of gcc. The Win32/Android binaries are basically the same as for version 5.15. The ChangeLog entry: Version 5.16, 2015.04.19, urgency: MEDIUM: * Bugfixes - Fixed compilation with old versions of gcc. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: b6b7e93fb2626eaabae1c8474e1dfa23962cfde8fa35c8602289fcaa4f53608d stunnel-5.16.tar.gz a701e6421c3020cc832ecb0e3a897c427a3838e0e180999ed8d905a9283fbb97 stunnel-5.16-installer.exe 2e559cc300b678fb2d05c2d2d3dc13d16cb44915f0165bea6290f741fccaa54c stunnel-5.16-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVM7KGAAoJEC78f/DUFuAUWwoQAJUnjUpyNLhjUQxRwScKjgNx AJ5OPZHXwVjX+xvtSSOjlkK/pk5l4SaEbNtq6hwMGliDpowXXDGXeYwNbmACXGuM sZWzdTUC69WKLQcwfTmn5BmsPQtczaCDQdyBVGSII4qg0mFIU4e1GYT0t8od7OcU n17nnRCLEaS2xlDwR5ImMuRjD+BdpEgZdiRXqtJkyjX8+aSRsEtSVjDBJ5wtsYNN 9pyMp8xU+7+sxX5GiLQ8+IcqcUq+W53nMJQZmN5vQ8O2ShxuBeZYdvembPhybvlE NrnfmjvDtl6A0iFs8ZhRRPTJZTKqj88UGhn49g3eQBH+CbNK08GalWCwR/uX8yFb +Z801mNIxJQrPnSlSaWLDPGNQ9GBqxliui1IR+Biv1KpmcPWBDAOI+Y7Hqyy1/5r MUDT9GB4HLZTC6aWtR0IyG30w3CvUmNr+sENu91ewvl0I1Z04yWyK+wQ3L3CbWyk aVBaNmt09pR8zgU9nvw8aAE2MLJ5oCgoangGpO6rEL0frh7TZhzD9sOMMVefKZDY rPPApyOiphH+3nnh9EiM357S9saXJMFe8/gNh6+lNXmYJ0ngMcPybz9mNV+RbbZU P1itA5RYBAwDTEJcpvATEj8ni9YPdDdFVmMrvC7ay5KZo0HWHxH23ryShBN9XYjC diuX4vtV2LMVYV5dlmAj =Eer2 -----END PGP SIGNATURE-----

1 0

Rewriting HTTP host header
by Veit Guna 19 Apr '15

19 Apr '15

Hi. After disabling SSLv3 I've got the same problem as: https://www.stunnel.org/pipermail/stunnel-users/2014-October/004814.html Sadly, he never got an answer. So I ask again, is it possible that stunnel could set the HTTP Host header to match the "connect = " setting? This way, Apache would accept that request instead of returning BAD REQUEST with AH02032. Thanks Veit

2 1

openvms and stunnel
by Coviello, Paul 17 Apr '15

17 Apr '15

Hello I'm trying to setup stunnel 4.20 yes it is an old version but the only one on HP's website for VMS. I need a little help in the conf files. Since I will be using telnet, do I need to put in each machines ip address that will be connecting? So in the example below do I create a listing of connects? [telnet] accept = 999 connect = 192.168.0.1:993 Thanks Paul Paul J Coviello Senior System Administrator CCS Corporate Headquarters Two Wells Avenue, Newton, MA 02459 617.965.2000, Ext. 4004 [cid:[email protected]] [cid:[email protected]] CCS Commercial, LLC | CCS Resources, Inc. | ClaimAssist, LLC | Credit Control Services, Inc. Customer Contact Solutions, LLC | Enterprise Associates, LLC

4 21

stunnel 5.15 release
by Michal Trojnara 16 Apr '15

16 Apr '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.15 of stunnel. The ChangeLog entry: Version 5.15, 2015.04.16, urgency: LOW: * New features - Added new service-level options "checkHost", "checkEmail" and "checkIP" for additional checks of the peer certificate subject. These options require OpenSSL version 1.0.2 or higher. - Win32 binary distribution now ships with the Mozilla root CA bundle. This bundle is intended be used together with the new "checkHost" option to validate server certs accepted by Mozilla. - New commandline options "-reload" to reload the configuration file and "-reopen" to reopen the log file of stunnel running as a Windows service (thx to Marc McLaughlin). - Added session persistence based on negotiated TLS sessions. https://en.wikipedia.org/wiki/Load_balancing_%28computing%29#Persistence The current implementation does not support external TLS session caching with sessiond. - MEDIUM ciphers (currently SEED and RC4) are removed from the default cipher list. - The "redirect" option was improved to not only redirect sessions established with an untrusted certificate, but also sessions established without a client certificate. - OpenSSL version checking modified to distinguish FIPS and non-FIPS builds. - Improved compatibility with the current OpenSSL 1.1.0-dev tree. - Removed support for OpenSSL versions older than 0.9.7. The final update for the OpenSSL 0.9.6 branch was 17 Mar 2004. - "sessiond" support improved to also work in OpenSSL 0.9.7. - Randomize the initial value of the round-robin counter. - New stunnel.conf templates are provided for Windows and Unix. * Bugfixes - Fixed compilation against old versions of OpenSSL. - Fixed memory leaks in certificate verification. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 58ff4645eb5d6bd64e6ddedaa683534302f75625c531e8a6364badcac0541cba stunnel-5.15.tar.gz 08316dc39f72f10f7b28a67e25ddf90f3f189208b09562c12d81478c6ca2e782 stunnel-5.15-installer.exe db96edbe66f1c3524e51f21b47cc541953d1659e746765a43d0272cfe60712b0 stunnel-5.15-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVL7wqAAoJEC78f/DUFuAU+30P/Ar197tSUJC0+sLBXwddWkm4 J7d9lFThQFECDDSIqaFYfCuecIgGHk8LUVq8nQHh21H1tvpPp7SnYHkzOLsb2w/y G7rLdA+a8BgRTUF3rMxTyghL78Yor88OLI8J93U7pkQkl0bIZpiITn838R5x9/NP +nGTgqy3U5tNoXALBQ/tLZCNML/XaEyxfrbdStOslV5Ay3m23RPw9wqgD4tJoWqe 5x52sMmLh0nhE5lX3xAKxzabVcioAaqVlBEgK1/ZKJj709Olcv14HZcOWzWhWkka MR0ItrZMkYf3lLk/StDm3s2BakKRraRustxlK8wAV4ci7t/IBnWshIpYIij9Nzct HNOT10GjWpN6pwwixNcMBUn7/wDNjiRVw/1n/keL84qSYry54Czo1LpBra1lMCmg 8WENkpJbaNFHvXI4rEzZkiPdlG16tXHF33CcYxwrT8bCXa+Uk4i8c98TJ2jfOaUv VFVLWxFtK4ydoppgOo2eRuymVPNK4HbLZnLPL874xPlHpYjRl5ndClLeDpkDzgJv 8y6zdYwJLFbinWGGHTZIVlyQQfKzB1NDCfXxknsbxtCpZt5Ja0Ka+oS6kcOMZz6f CjYpmd52wjEtAoxxxsjGGrYsO3q0sn0UU3Kc97lGGS/MsgbXFYDnSGqP+p8lzDoq urHG9EjMxXNMcnmKp9JQ =XLyZ -----END PGP SIGNATURE-----

1 0

Re: [stunnel-users] Understanding communication
by josealf＠rocketmail.com 16 Apr '15

16 Apr '15

Claudia, Yes, to create a tunnel you need to configure stunnel on both sides, except in those cases when one of the extremes already supports TLS. Looks like yours is not one of those cases. Regards, Jose -----Original Message----- From: "Claudia Porta" <claudia.porta(a)bancaakros.it> Sender: "stunnel-users" <stunnel-users-bounces(a)stunnel.org> Date: Wed, 15 Apr 2015 14:51:07 To: <stunnel-users(a)stunnel.org> Subject: [stunnel-users] Understanding communication _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Verifying TLS authentication via stunnel logs
by shanmuganathan sedukumar 16 Apr '15

16 Apr '15

We have a requirement to send emails via a SMTP server which requires TLS authentication. Going through some logs we tried changing the parameter "SSLversion = TLSv1", but still getting authentication failure. So, we would like to verify if stunnel is trying to sending request via TLS method before looking for any issues at SMTP end. Is there a way we can verify from stunnel logs if the request is sent via TLS? Thanks & Regards,Shanmu

1 0

Session is active but I cannot connect
by daninho dj 09 Apr '15

09 Apr '15

Hi guys, I am struggling with a problem for some time. I searched about this problem in the stunnel mails archives and also on Google but couldn't find a solution and I ran out of ideas so I was thinking to write you about it. I am using Eclipse to access and manipulate the data from a linux server. I want to use stunnel when I connect to the server via Eclipse, so I installed and configured everything as it follows: The server I am using is SuSE Linux and the stunnel version which I installed is this one: *stunnel 4.27 on x86_64-suse-linux-gnu with OpenSSL 0.9.8j-fips 07 Jan 2009* The stunnel version on Windows 7 is: *stunnel version 5.10* In the conf file from linux (server) I have the following configuration for stunnel.conf: *client = no* *chroot = /var/lib/stunnel/* *setuid = root* *setgid = root* *pid = /var/run/stunnel.pid* *debug = 7* *output = /var/log/stunnel/stunnel.log* *cert = /etc/ssl/certs/stunnel.pem* *sslVersion = SSLv3* *[test]* *accept = 2404* *connect = 2406* In the conf file from windows (client) I have the following configuration in stunnel.conf: *debug = 7* *output = C:\Program Files (x86)\stunnel\stunnel.log* *cert = C:\Program Files (x86)\stunnel\stunnel.pem* *sslVersion = SSLv3* *[test]* *client = yes* *accept = 127.0.0.1:2404 <http://127.0.0.1:2404>* *connect = xx.xxx.xxx.xxx:2406* In the log I have this: 2015.04.09 13:48:04 LOG5[11060]: Configuration successful 2015.04.09 13:48:04 LOG7[11060]: Listening file descriptor created (FD=452) 2015.04.09 13:48:04 LOG7[11060]: Service [test] (FD=452) bound to 127.0.0.1:2404 2015.04.09 13:48:07 LOG7[11060]: Service [test] accepted (FD=496) from 127.0.0.1:56675 2015.04.09 13:48:07 LOG7[11060]: Creating a new thread 2015.04.09 13:48:07 LOG7[11060]: New thread created 2015.04.09 13:48:07 LOG7[2088]: Service [test] started 2015.04.09 13:48:07 LOG5[2088]: Service [test] accepted connection from 127.0.0.1:56675 2015.04.09 13:48:07 LOG6[2088]: s_connect: connecting xx.xxx.xxx.xxx:2406 2015.04.09 13:48:07 LOG7[2088]: s_connect: s_poll_wait xx.xxx.xxx.xxx:2406: waiting 10 seconds 2015.04.09 13:48:07 LOG5[2088]: s_connect: connected xx.xxx.xxx.xxx:2406 2015.04.09 13:48:07 LOG5[2088]: Service [test] connected remote server from 127.0.0.1:56676 2015.04.09 13:48:07 LOG7[2088]: Remote socket (FD=516) initialized 2015.04.09 13:48:07 LOG6[2088]: SNI: sending servername: *my_server_name* 2015.04.09 13:48:07 LOG7[2088]: SSL state (connect): before/connect initialization 2015.04.09 13:48:07 LOG7[2088]: SSL state (connect): SSLv3 write client hello A 2015.04.09 13:48:08 LOG3[2088]: SSL_connect: Peer suddenly disconnected 2015.04.09 13:48:08 LOG5[2088]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2015.04.09 13:48:08 LOG7[2088]: Remote socket (FD=516) closed 2015.04.09 13:48:08 LOG7[2088]: Local socket (FD=496) closed 2015.04.09 13:48:08 LOG7[2088]: Service [test] finished (0 left) Although in the stunnel log it's showing *s_connect: connected* I cannot connect at all. When I try to connect via port 2406, the stunnel icon shows that the server is idle and I have nothing in the log about it. When I try to connect via port 2404, the stunnel icon shows that the there are 2 active sessions but I cannot connect to the server. I tried switching the ports (2404 with 2406 and 2406 with 2404 in the stunnel.conf file) but stunnel doesn't even open in that case. Do you have any idea what might could be the problem and how could I solve it? Thanks in advance! Best Regards, Daninho --

3 6

Stunnel 5.0x compile issues
by Michael Curran 06 Apr '15

06 Apr '15

Hello -- I am running the following commands to compile openssl (with FIPS support) and stunnel * Base config for FIPS cd openssl-fips-2.0.9 echo "./config" ./config * OpenSSL with shared and custom install location cd openssl-1.0.1m echo "./config fips --openssldir=/usr/local/openssl-100 --with-fipslibdir=/usr/local/ssl/fips-2.0/lib" ./config fips shared --openssldir=/usr/local/openssl-100 --with-fipslibdir=/usr/local/ssl/fips-2.0/lib/ * Stunnel with FIPs (autodetect is working , I just added it to force it) cd stunnel-5.09 echo "make clean" make clean echo "./configure --with-ssl=/usr/local/openssl-100 --disable-libwrap --enable-fips" ./configure --with-ssl=/usr/local/openssl-100 --disable-libwrap --enable-fips You can see that my custom OpenSSL is reporting that it is built with -fips root@host:/var/tmp# /usr/local/openssl-100/bin/openssl version OpenSSL 1.0.1m-fips 19 Mar 2015 But when I'm done with all the compile options -- I only see the base version of OpenSSL 1.0.1m , and this same script with Stunnel 4.53 shows OpenSSL 1.0.1m-fips Is there something I am missing during the configure for Stunnel that is causing it to NOT see openssl is compiled with FIPs? root@host:/var/tmp# stunnel -version stunnel 5.09 on x86_64-unknown-linux-gnu platform Compiled with OpenSSL 1.0.1m 19 Mar 2015 Running with OpenSSL 1.0.1 14 Mar 2012 Update OpenSSL shared libraries or rebuild stunnel Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Global options: debug = daemon.notice RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = HIGH:MEDIUM:+3DES:+DH:!aNULL:!SSLv2 (with "fips = no") curve = prime256v1 options = NO_SSLv2 options = NO_SSLv3 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none

1 0

Disconnect immediately after sending a message successfully
by Swallow 02 Apr '15

02 Apr '15

Hi, Can you give me a hand? We sent messages to a server over SSL. But stunnel showed disconnect from remote server as soon as we sent out logon message correctly. We close down the fire wall. Dose we misunderstand the mechanism of stunnel? Could someone help me? Thank you very much. Regards, Yan

1 0

Log rotation for Windows
by John Smith 31 Mar '15

31 Mar '15

Hi I came across this thread, I know it's old... http://mailing.unix.stunnel-users.narkive.com/QOEx4XQz/stunnel-users-log-ro… And it says that's it's on the todo list, though I don't see anything indicating this on the list. So is log rotation implemented for Windows and if so what is the config parameter? Thanks

2 5