- stunnel-users - stunnel.org

TLS1.0 fallback when only TLS1.2 allowed
by Wojciech Machula 31 Aug '20

31 Aug '20

So I've configured my stunnel to only use TLS1.2 and usually works ok. However when client gets some bad L7 response it send a TCP RST, after which all subsequent stunnel TLS Client Hellos are some hybrid of TLS1.0/TLS1.2, as can be seen in tshark output below. Once I restart the whole stunnel process subsequent TLS handshakes work fine using TLS1.2, until the next client RST is received. $ stunnel -version stunnel 4.56 on x86_64-redhat-linux-gnu platform $ cat /etc/centos-release CentOS Linux release 7.8.2003 (Core) $cat /etc/stunnel/dsr2rtcg-stunnel.conf output = /var/log/stunnel pid = /etc/stunnel/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [poc] cert = /etc/pki/tls/certs/stunnel/aaa.crt key = /etc/pki/tls/private/stunnel/aaa.key CAfile = /etc/pki/tls/certs/stunnel/bbb.crt client = yes sslVersion = TLSv1.2 options = NO_TLSv1 accept = 172.18.180.78:45154 connect = 10.74.0.196:45154 ciphers = TLSv1.2+HIGH:!aNULL $ tshark -nn -V -d tcp.port==45154,ssl -r 20200729_09:42:44-port45154.pcap -2R "ssl.handshake" -c 1 | grep -i tls -B3 Secure Sockets Layer SSL Record Layer: Handshake Protocol: Client Hello Content Type: Handshake (22) Version: TLS 1.0 (0x0301) -- Handshake Protocol: Client Hello Handshake Type: Client Hello (1) Length: 1610 Version: TLS 1.2 (0x0303)

6 14

Sslkeylog
by Brent Kimberley 22 Aug '20

22 Aug '20

>>Any suggestions on sslkeylog via stunnel application Call SSL_CTX_set_keylog_callback() !? On Thu, Aug 13, 2020, 16:44 tayyib ahmed <tayyib76(a)gmail.com> wrote: > Hi Guys > > Is there any option to set sslkeylog to get ssl session id for stunnel > session? > > Br xx >

2 2

How to archive DNS load balance in stunnel client?
by Peter Zhao 22 Aug '20

22 Aug '20

Hi, We are trying to use DNS load balance in a stunnel client with round-robin algorithm. service.example.com is mapping to two ips. But when we update DNS to remove one of ips for service.example.com stunnel client still forward requests to both ips. How to make stunnel client to resolve domain name and refresh its cache? Here is stunnel configuration. sslVersion=TLSv1.2 cert = /etc/stunnel/stunnel.pem output=/var/log/stunnel.log [service-client] client = yes accept = localhost:4680 connect = service.example.com:4680 [service-server] client = no accept = 10.10.0.16:4680 connect = loclhost:80 Here is the resolving result for service.example.com. ;; ANSWER SECTION: service.example.com. 5 IN A 10.10.0.16 service.example.com. 5 IN A 10.10.0.8

3 3

Sslkeylog
by tayyib ahmed 16 Aug '20

16 Aug '20

Hi Guys Is there any option to set sslkeylog to get ssl session id for stunnel session? Br xx

1 1

Stunnel 5.56 Windows 10 Service - Not functioning after Reboot
by Rod Marr 16 Aug '20

16 Aug '20

Hi all, I have installed Stunnel 5.56 win64 on a fully updated Windows 10 machine to work with Blue Iris. Stunnel operates well when I manually start it however I cannot get it to work automatically after a reboot. I have run the run the “stunnel Service Install” and “stunnel Service Start” shortcuts supplied, and in the first instance the service installs and starts. I can then connect through Stunnel to my Blue Iris server. I have found that after I reboot, the Stunnel service appears to start automatically but it is not functional. I cannot connect through it to Blue Iris. Stunnel is visible and Running in the Windows 10 Services list (from services.msc) and the Windows Task Manager shows a Process and Service active. To rectify this I can manually issue the “stunnel Service Stop”, followed by the “stunnel Service Start” shortcuts and the service becomes functional again. I have tried turning on debug info and the stunnel log file in stunnel.conf and see that log entries only begin after I have done the stop/start manual process. Thanks for any insight to what I’m sure I am missing here. Rod Sent from Mail<https://go.microsoft.com/fwlink/?LinkId=550986> for Windows 10

2 2

Sslkeylog
by Brent Kimberley 14 Aug '20

14 Aug '20

No sign of SSL_CTX_set_keylog_callback()... Date: Thu, 13 Aug 2020 16:44:22 +0100 From: tayyib ahmed <tayyib76(a)gmail.com> To: stunnel-users(a)stunnel.org Subject:Hi Guys Is there any option to set sslkeylog to get ssl session id for stunnel session? Br xx

1 0

Timeout issues
by gorf＠hyperfunk.club 05 Aug '20

05 Aug '20

Hi, I'm using stunnel v5.56 on FreeBSD to proxy connections to a web server (running Apache), for a small number of users. Users connecting to the service keep running into issues with timeouts. I see timeout errors in the stunnel log messages: services stunnel[7510]: LOG3[188]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing I tried changing stunnel to use the proxy protocol and enabled it on Apache, too. I don't know if that will help but at least then the web server gets the correct, remote IP address. Can anyone offer ideas/suggestions to fix this problem? Is there anything I can test or check to help diagnose the issue? The configuration is very basic: [apache] accept = 20888 protocol = proxy connect = 192.168.0.10:8000 PSKsecrets = /usr/local/etc/psksecrets.txt

1 0

Getting incoming Exchange online (Office 365) emails to go to port 110 and not 995
by Brent Kimberley 23 Jul '20

23 Jul '20

Office365 IMAP4S + POP3S is dropping legacy authentication in favour of OAUTH2.0 authentication -- effective October 2020. (Some may have longer.) How do you you plan to migrate to authentication? Do you plan to upgrade your client(s) or inject an OAUTH2.0 transparent proxy ? ---------------------------------------------------------------------- Message: 1 Date: Thu, 23 Jul 2020 01:22:06 +0000 From: Mel Gilbert <m.gilbert(a)baymedicalgroup.com.au> To: "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Subject: Re: [stunnel-users] Getting incoming Exchange online (Office 365) emails to go to port 110 and not 995 Message-ID: <SY4P282MB074766F32238B92A3D951499C1760(a)SY4P282MB0747.AUSP282.PROD.OUTLOOK.COM> Content-Type: text/plain; charset="us-ascii" Hi Trying to get an application with inbuilt email to receive emails using POP and port 110. However we use Office 365 and I have tried below config but it is not working. I want people to send email to an Exchange Online Account port 995 and it gets forwarded on to the email app on port 110 client = yes output = stunnel-log.txt debug=7 taskbar=yes [POP3 Incoming] accept = 110 connect = Outlook.office365.com:995 cert = stunnel.pem [SMTP Outgoing] protocol = smtp accept = 25 connect = smtp.office365.com:587 cert = stunnel.pem The outgoing email works fine using SMTP relay that I've set up on Office 365 but cant get the incoming emails to work. Any help would be appreciated Thanks Mel

1 0

Re: [stunnel-users] Getting incoming Exchange online (Office 365) emails to go to port 110 and not 995
by Mel Gilbert 23 Jul '20

23 Jul '20

Hi Trying to get an application with inbuilt email to receive emails using POP and port 110. However we use Office 365 and I have tried below config but it is not working. I want people to send email to an Exchange Online Account port 995 and it gets forwarded on to the email app on port 110 client = yes output = stunnel-log.txt debug=7 taskbar=yes [POP3 Incoming] accept = 110 connect = Outlook.office365.com:995 cert = stunnel.pem [SMTP Outgoing] protocol = smtp accept = 25 connect = smtp.office365.com:587 cert = stunnel.pem The outgoing email works fine using SMTP relay that I've set up on Office 365 but cant get the incoming emails to work. Any help would be appreciated Thanks Mel

1 0

Transparent Proxy help.
by Steven Relf 21 Jul '20

21 Jul '20

Hello List, I am working on a small project where I need to encrypt nfs traffic, and Stunnel looks to be ideal, the only issue I'm having is getting the transparent part to work I have a client machine, running stunnel config below #GLOBAL####################################################### sslVersion = TLSv1.2 TIMEOUTidle = 600 renegotiation = no FIPS = no options = NO_SSLv2 options = NO_SSLv3 options = SINGLE_DH_USE options = SINGLE_ECDH_USE options = CIPHER_SERVER_PREFERENCE syslog = yes debug = 7 ;chroot = /var/empty/stunnel libwrap = yes service = 3d-nfsd curve = secp521r1 #CREDENTIALS################################################## verify = 4 CAfile = /etc/stunnel/nfs-tls.pem cert = /etc/stunnel/nfs-tls.pem #ROLE######################################################### client = yes connect = fqdn:2363 and the client which is running ontop of the nfs-ganesha server config below #GLOBAL####################################################### TIMEOUTidle = 600 renegotiation = no FIPS = no options = NO_SSLv2 options = NO_SSLv3 options = SINGLE_DH_USE options = SINGLE_ECDH_USE options = CIPHER_SERVER_PREFERENCE syslog = yes debug = 7 setuid = nobody setgid = nobody chroot = /var/empty/stunnel libwrap = yes service = MC-nfsd ; cd /var/empty; mkdir -p stunnel/etc; cd stunnel/etc; ; echo 'MC-nfsd: ALL EXCEPT 5.6.7.8' >> hosts.deny; ; chcon -t stunnel_etc_t hosts.deny curve = secp521r1 #CREDENTIALS################################################## verify = 4 CAfile = /etc/stunnel/nfs-tls.pem cert = /etc/stunnel/nfs-tls.pem #ROLE######################################################### connect = 127.0.0.1:2049 I have had a look through the documentation and I believe I need to set transparent = source on the client side, and then set some ip tables firewall rules. Does anyone have a guide, or some advice on how to get this to work. Generally what happens if I set the firewall rules, on the client, and set the transparent to source I just get connection closed by remote host. I never actually see the traffic leave the client host. To confirm, when not using transparent everything works correctly, accept the server side sees the connection coming from 127.0.0.1 Thanks Rgds Steve. The future has already arrived. It's just not evenly distributed yet - William Gibson Steven Relf - Technical Authority: Cloud Native Infrastructure srelf(a)ukcloud.com +44 1252 936019 / +44 7500 085 864 www.ukcloud.com A8, Cody Technology Park, Ively Road, Farnborough, GU14 0LX Notice: This message contains information that may be privileged or confidential and is the property of UKCloud Ltd. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorised to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message. UKCloud reserves the right to monitor all e-mail communications through its networks. UKCloud Ltd is registered in England and Wales: Company No: 07619797. Registered office: Hartham Park, Hartham, Corsham, Wiltshire SN13 0RP.

1 0

Used Multi Service
by Ramin Malekgahsemi 09 Jul '20

09 Jul '20

Hi Dear Friends I used Stunnel 5.49 32 bit For server This Config cert = C:\Program Files\stunnel\config\stunnel.pem fips = no [socks] accept = 443 connect = 1010 If define New Service For example cert = C:\Program Files\stunnel\config\stunnel.pem fips = no [s1] accept = 443 connect = 1010 [s2] accept = 445 connect = 1020 Service Not work How Solve This Problem THX

1 0

Re: [stunnel-users] winsock permissions issue (i.e. WSAEACCES 10013 / 0x271D)
by flash＠vicsmba.com 29 Jun '20

29 Jun '20

It will never be entirely random. Some range more than likely. You may be able to restrict the range. You could certainly set stunnel up for each “random” port. E VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) http://www.vicsmba.com <http://www.vicsmba.com/> https://www.facebook.com/groups/286143052248115 From: stunnel-users <stunnel-users-bounces(a)stunnel.org> On Behalf Of Brent Kimberley Sent: Friday, June 26, 2020 4:11 PM To: Thomas Ward <teward(a)thomas-ward.net>; stunnel-users(a)stunnel.org; Coviello, Paul <pcoviello(a)ccsusa.com> Subject: Re: [stunnel-users] winsock permissions issue (i.e. WSAEACCES 10013 / 0x271D) What are you trying to accomplish? I.e. Is TLS the best wrapper for the job? (i.e. TCP over TCP.) On Thursday, June 25, 2020, 11:44:38 a.m. EDT, Coviello, Paul <pcoviello(a)ccsusa.com <mailto:[email protected]> > wrote: Maybe, I also just found out that the port it goes out is not what I thought it was. It’s a random port. Not sure if it’s doable now. Thanks for your help

1 0

winsock permissions issue (i.e. WSAEACCES 10013 / 0x271D)
by Brent Kimberley 26 Jun '20

26 Jun '20

Hi Paul. With respect to your winsock permissions issue (i.e. WSAEACCES 10013 / 0x271D), did you open the port in your firewall and authorize communication via anti-virus? > Hi I have a windows 10 machine that I?ve got this running on, and the > screen shot below is what I keep getting and I am unable to find the issue, > > Can someone please shed some light as to what is wrong? And what else you may need.

3 4

server is down message
by Coviello, Paul 24 Jun '20

24 Jun '20

Hi I have a windows 10 machine that I've got this running on, and the screen shot below is what I keep getting and I am unable to find the issue, Can someone please shed some light as to what is wrong? And what else you may need. Thanks Paul [cid:[email protected]]

3 4

Fwd: Update Stunnel 5.44 - Ubuntu 18.04
by Juan Amores 19 Jun '20

19 Jun '20

---------- Forwarded message --------- De: Juan Amores <canalamores(a)gmail.com> Date: jue., 18 jun. 2020 a las 20:03 Subject: *Update Stunnel 5.44 - Ubuntu 18.04* I installed Stunnel4 via apt-get install command. The version you installed for me is old (5.44), I have tried updating it via apt-get update but there are no updated packages in Ubuntu 18.04. Is there a way to update it and keep it working as a service like before? Attached screenshot with linux, stunnel and openssl versions. Any other additional data you need to provide just ask me. [image: stunnel.png] Greetings, Juan Amores

2 2

Fw: How to configure STunnel so that new log file is automatically created after a certain threshold
by Muhammad Muneeb Hashmi 17 Jun '20

17 Jun '20

Hi STunnel Team, Is there a way where a new STunnel log file is automatically generated when the current log file reaches a certain threshold in Windows. Any help will be highly appreciated. Regards,Muneeb

1 0

CAPI_GET_KEY:cryptacquirecontext error
by Michael S. Chusovitin 04 Jun '20

04 Jun '20

Dear stunnel users, whereas Stunnel itself looks fine for me, it seems to have some troubles with CAPI engine. The one I cannot manage still is *"CAPI_GET_KEY:cryptacquirecontext error"* logged when attempting to export the client's key. I tried to add *"engineCtrl = csp_name:Microsoft Enhanced RSA and AES Cryptographic Provider"* to stunnel.conf, and then *"CAPI_**CTX_SET_PROVNAME:**cryptacquirecontext error"* was logged instead of the above one. The same certificate is used happily with no-capi configuration. I suppose the problem is somehow related to sha256 signature in the certificate. Are there any chances to workaround? Stunnel version is 5.48 with OpenSSL 1.0.2o-fips. (in this very case I need to use 32bit version, so no possibility to upgrade). Thanks!

2 5

Re: [stunnel-users] Need help connecting Eudora to mail servers
by Phil Smith III 28 May '20

28 May '20

I'm still tinkering here, trying to get Yahoo+stunnel working to help out Joe Slaven. I still can't get it to work. Yahoo userid is y_phsiii. I manually logged into Yahoo and verified that I have the right password. The config section: -- [Yahoo] client = yes accept = localhost:1234 connect = pop.mail.yahoo.com:995 sslVersion = TLSv1.2 -- Eudora has -- POPPort=1234 -- for that personality. Log: -- 2020.05.27 11:36:48 LOG5[29]: Service [Yahoo] accepted connection from 127.0.0.1:50287 2020.05.27 11:36:48 LOG6[29]: failover: priority, starting at entry #0 2020.05.27 11:36:48 LOG6[29]: s_connect: connecting 98.137.157.46:995 2020.05.27 11:36:48 LOG5[29]: s_connect: connected 98.137.157.46:995 2020.05.27 11:36:48 LOG5[29]: Service [Yahoo] connected remote server from 192.168.1.4:50288 2020.05.27 11:36:48 LOG6[29]: SNI: sending servername: pop.mail.yahoo.com 2020.05.27 11:36:48 LOG6[29]: Peer certificate not required 2020.05.27 11:36:48 LOG6[29]: Certificate verification disabled 2020.05.27 11:36:48 LOG6[29]: Certificate verification disabled 2020.05.27 11:36:48 LOG6[29]: Client certificate not requested 2020.05.27 11:36:48 LOG6[29]: Session id: F26CEF81143B96B8BD0D2C504CBB534082242BF337D3D29DE911CD5AC05B6DE0 2020.05.27 11:36:48 LOG6[29]: TLS connected: new session negotiated 2020.05.27 11:36:48 LOG6[29]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2020.05.27 11:37:48 LOG6[29]: TLS socket closed (SSL_read) 2020.05.27 11:37:48 LOG5[29]: Connection closed: 38 byte(s) sent to TLS, 130 byte(s) sent to socket -- Eudora error (Personality is named just "y" since it's just a test): -- y, Logging into POP Server, PASS [11:33:29 AM] There has been an error transferring your mail. I said: PASS <shhhh! Don't tell anyone.> and then the POP server (y_phsiii(a)127.0.0.1) said: ERR [SYS/TEMP] Server error - Please try again later. --

3 3

blackhole problem - please help to tune stunnel
by Michael S. Chusovitin 28 May '20

28 May '20

Dear stunnel users, please advise how to solve the following: - an Application connects to stunnel-client (installed at the same machine); - stunnel-client tries to connect to stunnel-server (remote), fails and sends RST to the App; - but the App has already sent some datagrams to stunnel-client during TIMEOUTconnect period and they aren't transferred to stunnel-server. Is there any way to make stunnel-client delay its ACK to the App until the connection to stunnel-server is established? Thanks!

1 0

Need help connecting Eudora to mail servers
by Joe Slaven 26 May '20

26 May '20

Below are the contents of my config file: Question 1. Is the output statement correct? I cannot find the log file. I expected it to be in the stunnel folder in the Program (x86) folders Question 2. Is it permissable to install code for all three email servers, using the same ports and settings in Eudora? Question 3. All three have error messages in Eudora ie none of them work via stunnel. Can anyone please show me where I am going wrong? I have listed the error message for Gmail below. There is no log file that I can find. Bigpond error message: There has been an error transferring your mail POP server [JoeS4814(a)127.0.0.1 ] said ERR[AUTH] Username and Password not accepted thanks for helping out, Joe ;*************************************************************** ; STUNNEL LOG output = stunnel.log ; ;***************************************************************** ;******************************************************* ;Yahoo connection ;******************************************************* [yahoo-pop3] client = yes accept = 127.0.0.1:110 connect = pop.mail.yahoo.com:995 verify = 2 CAfile = ca-certs.pem checkHost = pop.mail.yahoo.com OCSPaia = yes [yahoo-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.mail.yahoo.com:465 verify = 2 CAfile = ca-certs.pem checkHost = smtp.mail.yahoo.com OCSPaia = yes ; ;******************************************************* ;Bigpond connection ;***************************************************** [bigpond-pop3] client = yes accept = 127.0.0.1:110 connect = pop.bigpond.com:995 verify = 2 CAfile = ca-certs.pem checkHost = pop.bigpond.com OCSPaia = yes [bigpond-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.bigpond.com:465 verify = 2 CAfile = ca-certs.pem checkHost = smtp.bigpond.com OCSPaia = yes ;************************************* ;Gmail connection ;******************************************** [gmail-pop3] client = yes accept = 127.0.0.1:110 connect = pop.gmail.com:995 verifyChain = yes CAfile = ca-certs.pem checkHost = pop.gmail.com OCSPaia = yes [gmail-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.gmail.com:465 verifyChain = yes CAfile = ca-certs.pem checkHost = smtp.gmail.com OCSPaia = yes

3 7

[PATCH] Use libcap to keep CAP_NET_RAW so that IP_TRANSPARENT works after setuid
by Simon Arlott 26 May '20

26 May '20

Use libcap to keep CAP_NET_RAW so that IP_TRANSPARENT works after setuid I'd like to be able to use "transparent = source" and "setuid" to drop full root privileges. It is possible to do this by keeping either the CAP_NET_ADMIN or CAP_NET_RAW capability. This is based on https://github.com/dlundquist/sniproxy/commit/0ab83f8f45f73ba18ea5f84ccccd9… The capability will not be inherited if "exec" is used: Name: stunnel Uid: 996 996 996 996 Gid: 988 988 988 988 ... CapInh: 0000000000000000 CapPrm: 0000000000002000 CapEff: 0000000000002000 --- It would be possible to keep CAP_NET_BIND_SERVICE too, to allow reloading a configuration that binds to ports below 1024. I don't think stunnel should keep this capability unless a service needs it at startup. CREDITS.md | 25 ++++++++++ configure.ac | 33 ++++++++++++++ doc/stunnel.8.in | 2 +- doc/stunnel.html.in | 2 +- doc/stunnel.pod.in | 2 +- src/stunnel.c | 109 ++++++++++++++++++++++++++++++++++++++++++++ 6 files changed, 170 insertions(+), 3 deletions(-) diff --git a/CREDITS.md b/CREDITS.md index 6567392..5f12f92 100644 --- a/CREDITS.md +++ b/CREDITS.md @@ -27,6 +27,31 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. +libcap usage in version 5.57 (from sniproxy): +Copyright 2017 Dustin Lundquist <dustin(a)null-ptr.net> +Copyright 2020 Simon Arlott + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions +are met: +1. Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. +2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE HOLDERS OR +CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, +EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, +PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR +PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF +LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS +SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + Several bugfixes and improvements mostly in versions 3.xx: * Brian Hatch <bri(a)stunnel.org> diff --git a/configure.ac b/configure.ac index 9c2b2b6..f454710 100644 --- a/configure.ac +++ b/configure.ac @@ -352,6 +352,39 @@ AC_ARG_ENABLE(systemd, ] ) +# Disable POSIX capabilities support +AC_MSG_CHECKING([whether to enable POSIX capabilities support]) +AC_ARG_ENABLE(libcap, +[ --disable-libcap disable POSIX capabilities support], + [ + case "$enableval" in + yes) AC_MSG_RESULT([yes]) + AC_SEARCH_LIBS([cap_get_proc], [cap]) + AC_DEFINE([USE_LIBCAP], [1], + [Define to 1 to enable POSIX capabilities]) + ;; + no) AC_MSG_RESULT([no]) + ;; + *) AC_MSG_RESULT([error]) + AC_MSG_ERROR([Bad value \"${enableval}\"]) + ;; + esac + ], + [ + AC_MSG_RESULT([autodetecting]) + AC_SEARCH_LIBS([cap_get_proc], [cap], + [ AC_CHECK_HEADERS([sys/capability.h], [ + AC_DEFINE([USE_LIBCAP], [1], + [Define to 1 to enable POSIX capabilities]) + AC_MSG_NOTICE([libcap support enabled]) + ], [ + AC_MSG_NOTICE([libcap header not found]) + ]) ], [ + AC_MSG_NOTICE([libcap library not found]) + ]) + ] +) + # Disable use of libwrap (TCP wrappers) # it should be the last check! AC_MSG_CHECKING([whether to enable TCP wrappers support]) diff --git a/doc/stunnel.8.in b/doc/stunnel.8.in index b3df016..4b121bc 100644 --- a/doc/stunnel.8.in +++ b/doc/stunnel.8.in @@ -1251,7 +1251,7 @@ setuid .RS 4 .Sp The use of the 'setuid' option will also prevent \fBstunnel\fR from binding to privileged -(<1024) ports during configuration reloading. +(<1024) ports during configuration reloading or enabling of 'transparent = source'. .Sp When the 'chroot' option is used, \fBstunnel\fR will look for all its files (including the configuration file, certificates, the log file and the pid file) within the chroot diff --git a/doc/stunnel.html.in b/doc/stunnel.html.in index ee9e5d9..95a1b51 100644 --- a/doc/stunnel.html.in +++ b/doc/stunnel.html.in @@ -1506,7 +1506,7 @@ </li> </ul> -<p>The use of the 'setuid' option will also prevent <b>stunnel</b> from binding to privileged (<1024) ports during configuration reloading.</p> +<p>The use of the 'setuid' option will also prevent <b>stunnel</b> from binding to privileged (<1024) ports during configuration reloading or enabling of 'transparent = source'.</p> <p>When the 'chroot' option is used, <b>stunnel</b> will look for all its files (including the configuration file, certificates, the log file and the pid file) within the chroot jail.</p> diff --git a/doc/stunnel.pod.in b/doc/stunnel.pod.in index e9abd4f..8f14fd9 100644 --- a/doc/stunnel.pod.in +++ b/doc/stunnel.pod.in @@ -1360,7 +1360,7 @@ setuid =back The use of the 'setuid' option will also prevent B<stunnel> from binding to privileged -(<1024) ports during configuration reloading. +(<1024) ports during configuration reloading or enabling of 'transparent = source'. When the 'chroot' option is used, B<stunnel> will look for all its files (including the configuration file, certificates, the log file and the pid file) within the chroot diff --git a/src/stunnel.c b/src/stunnel.c index 8121e0c..b84ce72 100644 --- a/src/stunnel.c +++ b/src/stunnel.c @@ -58,6 +58,11 @@ #endif /* USE_WIN32 */ +#ifdef USE_LIBCAP +#include <sys/prctl.h> +#include <sys/capability.h> +#endif + /**************************************** prototypes */ #ifdef __INNOTEK_LIBC__ @@ -191,6 +196,59 @@ int drop_privileges(int critical) { #ifdef HAVE_SETGROUPS gid_t gr_list[1]; #endif +#ifdef USE_LIBCAP + SERVICE_OPTIONS *opt; + int need_caps = 0; + cap_t caps; + cap_value_t cap_list[1]; + int keepcaps = 0; +#endif + +#ifdef USE_LIBCAP + for (opt = service_options.next; opt; opt = opt->next) { + if (opt->option.transparent_src) { /* transparent_src is enabled for this service */ + need_caps = 1; + break; + } + } + + /* add permitted flag to capability needed for IP_TRANSPARENT */ + if (CAP_IS_SUPPORTED(CAP_NET_RAW) && need_caps) { + const char *cap_failed = NULL; + + caps = cap_get_proc(); + if (caps != NULL) { + cap_list[0] = CAP_NET_RAW; + if (cap_set_flag(caps, CAP_PERMITTED, 1, cap_list, CAP_SET) == -1) { + cap_failed = "cap_set_flags[before]"; + goto cap_cleanup_before; + } + + if (cap_set_proc(caps) == -1) { + cap_failed = "cap_set_proc[before]"; + goto cap_cleanup_before; + } + + /* keep capabilities after setuid */ + if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0) == -1) { + cap_failed = "prctl[before]"; + goto cap_cleanup_before; + } else { + keepcaps = 1; + } + +cap_cleanup_before: + cap_free(caps); + if (cap_failed != NULL && critical) { + sockerror(cap_failed); + return 1; + } + } else if (critical) { + sockerror("cap_get_proc[before]"); + return 1; + } + } +#endif /* set uid and gid */ if(service_options.gid) { @@ -212,6 +270,57 @@ int drop_privileges(int critical) { return 1; } } + +#ifdef USE_LIBCAP + /* enable capability needed for IP_TRANSPARENT */ + if (CAP_IS_SUPPORTED(CAP_NET_RAW) && need_caps) { + const char *cap_failed = NULL; + + caps = cap_get_proc(); + if (caps != NULL) { + /* remove every capability from the list */ + cap_clear(caps); + cap_list[0] = CAP_NET_RAW; + + /* take back capability */ + if (cap_set_flag(caps, CAP_PERMITTED, 1, cap_list, CAP_SET) == -1) { + cap_failed = "cap_set_flag[after]"; + goto cap_cleanup_after; + } + + if (cap_set_flag(caps, CAP_EFFECTIVE, 1, cap_list, CAP_SET) == -1) { + cap_failed = "cap_set_flag[after]"; + goto cap_cleanup_after; + } + + if (cap_set_proc(caps) == -1) { + cap_failed = "cap_set_proc[after]"; + goto cap_cleanup_after; + } + /* from now on it the new capability list is active, + * no other capabilities may be enabled */ + +cap_cleanup_after: + cap_free(caps); + if (cap_failed != NULL && critical) { + sockerror(cap_failed); + return 1; + } + } else if (critical) { + sockerror("cap_get_proc[after]"); + return 1; + } + } + + /* disable keeping capabilities across setuid */ + if (keepcaps && prctl(PR_SET_KEEPCAPS, 0, 0, 0, 0) == -1) { + if (critical) { + sockerror("prctl"); + return 1; + } + } +#endif + #endif /* standard Unix */ return 0; } -- 2.17.1 -- Simon Arlott

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 190, Issue 13
by Brent Kimberley 24 May '20

24 May '20

Try: * Verifying the openssl version(s) * Verifying the 192.168.1.96:51400 port (nmap, netstat, etc.) * Verifying connection (openssl s_client -connect 192.168.1.96:51400) * Verifying the ciphersuite * Verifying the certificate >>Is there a configuration item in stunnel to at least tell it to chill out a little and not try reconnecting 1000 times a second? Not sure. TIMEOUTclose? On Sunday, May 24, 2020, 6:00:07 a.m. EDT, stunnel-users-request(a)stunnel.org <stunnel-users-request(a)stunnel.org> wrote: Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. /var/log/syslog is filling up with stunnel errors (digitek) 2. Re: /var/log/syslog is filling up with stunnel errors (Thomas Ward) ---------------------------------------------------------------------- Message: 1 Date: Sat, 23 May 2020 18:17:49 -0500 From: digitek <digitek(a)charter.net> To: stunnel-users(a)stunnel.org Subject: [stunnel-users] /var/log/syslog is filling up with stunnel errors Message-ID: <434e3153-d94c-bb71-fc51-1716db588290(a)charter.net> Content-Type: text/plain; charset=windows-1252; format=flowed Hi, I've been running stunnel for years to shuttle my syslogs off to a syslog server. It's performed flawlessly up until a few weeks ago. Recently, rebooting my syslog server results in the clients filling up /var/log/syslog with messages like below[1]. I'm not certain where the issue is. We've gone through some Ubuntu 16.04 > 18.04 upgrades on some hosts, as well as the syslog server. Is there a configuration item in stunnel to at least tell it to chill out a little and not try reconnecting 1000 times a second? My config from a client is here[2] Last time this happened (few weeks ago) I googled around and found the TIMEOUTconnect parameter to try and get stunnel to at least wait 10 seconds before attempting another connect, but guess it doesn't work that way. Any thoughts? The stunnel client is on Ubuntu 18.04. I'd rather not compile out-of-band for the latest stunnel version unless I must. I"m assuming this is a config issue on my end. The version I'm stuck with right now is stunnel 5.44 on x86_64-pc-linux-gnu platform Thanks! [1] May 23 17:42:04 shuriken stunnel: LOG5[44922183]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket May 23 17:42:04 shuriken stunnel: LOG5[44922184]: Service [syslog_tunnel] accepted connection from 127.0.0.1:55440 May 23 17:42:04 shuriken stunnel: LOG3[44922184]: s_connect: connect 192.168.1.96:51400: Connection refused (111) May 23 17:42:04 shuriken stunnel: LOG3[44922184]: No more addresses to connect May 23 17:42:04 shuriken stunnel: LOG5[44922184]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket May 23 17:42:04 shuriken stunnel: LOG5[44922185]: Service [syslog_tunnel] accepted connection from 127.0.0.1:55444 May 23 17:42:04 shuriken stunnel: LOG3[44922185]: s_connect: connect 192.168.1.96:51400: Connection refused (111) May 23 17:42:04 shuriken stunnel: LOG3[44922185]: No more addresses to connect [2] client = yes cert = /etc/stunnel/shared/stunnel.pem pid = /var/run/stunnel4/syslog_stunnel.pid [syslog_tunnel] accept = 127.0.0.1:5140 connect = 192.168.1.96:51400 TIMEOUTconnect = 10 ------------------------------ Message: 2 Date: Sat, 23 May 2020 20:09:48 -0400 From: Thomas Ward <teward(a)thomas-ward.net> To: digitek <digitek(a)charter.net>, stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] /var/log/syslog is filling up with stunnel errors Message-ID: <49V0wH16GWz2QGD(a)mail.syn-ack.link> Content-Type: text/plain; charset="utf-8" This is indicative of the remote server not running on the right ports normally or actively blocking you, given the "Connection Refused" errors.? Verify your system stunnel is on actually can connect to the specified IP and port combo independently of stunnel to start with.Sent from my Sprint Samsung Galaxy Note10+. -------- Original message --------From: digitek <digitek(a)charter.net> Date: 5/23/20 19:18 (GMT-05:00) To: stunnel-users(a)stunnel.org Subject: [stunnel-users] /var/log/syslog is filling up with stunnel errors Hi,I've been running stunnel for years to shuttle my syslogs off to a syslog server. It's performed flawlessly up until a few weeks ago. Recently, rebooting my syslog server results in the clients filling up /var/log/syslog with messages like below[1].I'm not certain where the issue is. We've gone through some Ubuntu 16.04 > 18.04 upgrades on some hosts, as well as the syslog server. Is there a configuration item in stunnel to at least tell it to chill out a little and not try reconnecting 1000 times a second?? My config from a client is here[2]Last time this happened (few weeks ago) I googled around and found the TIMEOUTconnect parameter to try and get stunnel to at least wait 10 seconds before attempting another connect, but guess it doesn't work that way.Any thoughts? The stu nnel client is on Ubuntu 18.04. I'd rather not compile out-of-band for the latest stunnel version unless I must. I"m assuming this is a config issue on my end.? The version I'm stuck with right now is stunnel 5.44 on x86_64-pc-linux-gnu platformThanks![1]May 23 17:42:04 shuriken stunnel: LOG5[44922183]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socketMay 23 17:42:04 shuriken stunnel: LOG5[44922184]: Service [syslog_tunnel] accepted connection from 127.0.0.1:55440May 23 17:42:04 shuriken stunnel: LOG3[44922184]: s_connect: connect 192.168.1.96:51400: Connection refused (111)May 23 17:42:04 shuriken stunnel: LOG3[44922184]: No more addresses to connectMay 23 17:42:04 shuriken stunnel: LOG5[44922184]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socketMay 23 17:42:04 shuriken stunnel: LOG5[44922185]: Service [syslog_tunnel] accepted connection from 127.0.0.1:55444May 23 17:42:04 shuriken stunnel: LOG3[44922185]: s_connect: connect 192.168.1.96:51400: Conn ection refused (111)May 23 17:42:04 shuriken stunnel: LOG3[44922185]: No more addresses to connect[2]client?? = yescert???? = /etc/stunnel/shared/stunnel.pempid????? = /var/run/stunnel4/syslog_stunnel.pid[syslog_tunnel]accept?? = 127.0.0.1:5140connect? = 192.168.1.96:51400TIMEOUTconnect = 10_______________________________________________stunnel-users mailing [email protected]://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

/var/log/syslog is filling up with stunnel errors
by digitek 24 May '20

24 May '20

Hi, I've been running stunnel for years to shuttle my syslogs off to a syslog server. It's performed flawlessly up until a few weeks ago. Recently, rebooting my syslog server results in the clients filling up /var/log/syslog with messages like below[1]. I'm not certain where the issue is. We've gone through some Ubuntu 16.04 > 18.04 upgrades on some hosts, as well as the syslog server. Is there a configuration item in stunnel to at least tell it to chill out a little and not try reconnecting 1000 times a second? My config from a client is here[2] Last time this happened (few weeks ago) I googled around and found the TIMEOUTconnect parameter to try and get stunnel to at least wait 10 seconds before attempting another connect, but guess it doesn't work that way. Any thoughts? The stunnel client is on Ubuntu 18.04. I'd rather not compile out-of-band for the latest stunnel version unless I must. I"m assuming this is a config issue on my end. The version I'm stuck with right now is stunnel 5.44 on x86_64-pc-linux-gnu platform Thanks! [1] May 23 17:42:04 shuriken stunnel: LOG5[44922183]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket May 23 17:42:04 shuriken stunnel: LOG5[44922184]: Service [syslog_tunnel] accepted connection from 127.0.0.1:55440 May 23 17:42:04 shuriken stunnel: LOG3[44922184]: s_connect: connect 192.168.1.96:51400: Connection refused (111) May 23 17:42:04 shuriken stunnel: LOG3[44922184]: No more addresses to connect May 23 17:42:04 shuriken stunnel: LOG5[44922184]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket May 23 17:42:04 shuriken stunnel: LOG5[44922185]: Service [syslog_tunnel] accepted connection from 127.0.0.1:55444 May 23 17:42:04 shuriken stunnel: LOG3[44922185]: s_connect: connect 192.168.1.96:51400: Connection refused (111) May 23 17:42:04 shuriken stunnel: LOG3[44922185]: No more addresses to connect [2] client = yes cert = /etc/stunnel/shared/stunnel.pem pid = /var/run/stunnel4/syslog_stunnel.pid [syslog_tunnel] accept = 127.0.0.1:5140 connect = 192.168.1.96:51400 TIMEOUTconnect = 10

2 3

Re: [stunnel-users] Eudora -> Yahoo problems
by phs3stuff＠cox.net 20 May '20

20 May '20

Have you looked at the stunnel log? FWIW, I use stunnel to cox.net with Eudora (well, my wife does--I get to make it work) and just have the protocol, accept, and connect statements and it works. You might try commenting those out and see, but the log is probably more interesting. -----Original Message----- From: stunnel-users <stunnel-users-bounces(a)stunnel.org> On Behalf Of Joe Slaven Sent: Tuesday, May 19, 2020 8:48 PM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Eudora -> Yahoo problems Hello, new to stunnel, my first attempt is connecting Eudora to Yahoo Mail. My Yahoo Mail password and username are not being recognised when it is trying to access server 127.0.0.1 Can anyone suggest why this will not work? regards, Joe ******************************************************************************************************** ERROR MESSAGE There has been an error transferring your mail. POP Server [joeslaven(a)127.0.0.1] said ERR [AUTH] Username and password not accepted STUNNEL CONFIG FILE SETTINGS [yahoo-pop3] client = yes accept = 127.0.0.1:110 connect = pop.mail.yahoo.com:995 verify = 2 CAfile = ca-certs.pem checkHost = pop.mail.yahoo.com OCSPaia = yes [yahoo-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.mail.yahoo.com:465 verify = 2 CAfile = ca-certs.pem checkHost = smtp.mail.yahoo.com OCSPaia = yes EUDORA SETTINGS Checking Mail->Mail POP Server: 127.0.0.1 Sending Mail->SMTP Server: 127.0.0.1 Use submission port (587) is UNchecked Secure Sockets when Sending or Receiving : Never Default port settings : SMPT Port (25) POP Port (110) _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Eudora -> Yahoo problems
by Joe Slaven 20 May '20

20 May '20

Hello, new to stunnel, my first attempt is connecting Eudora to Yahoo Mail. My Yahoo Mail password and username are not being recognised when it is trying to access server 127.0.0.1 Can anyone suggest why this will not work? regards, Joe ******************************************************************************************************** ERROR MESSAGE There has been an error transferring your mail. POP Server [joeslaven(a)127.0.0.1] said ERR [AUTH] Username and password not accepted STUNNEL CONFIG FILE SETTINGS [yahoo-pop3] client = yes accept = 127.0.0.1:110 connect = pop.mail.yahoo.com:995 verify = 2 CAfile = ca-certs.pem checkHost = pop.mail.yahoo.com OCSPaia = yes [yahoo-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.mail.yahoo.com:465 verify = 2 CAfile = ca-certs.pem checkHost = smtp.mail.yahoo.com OCSPaia = yes EUDORA SETTINGS Checking Mail->Mail POP Server: 127.0.0.1 Sending Mail->SMTP Server: 127.0.0.1 Use submission port (587) is UNchecked Secure Sockets when Sending or Receiving : Never Default port settings : SMPT Port (25) POP Port (110)

1 0

Eudora -> Yahoo problems
by Joe Slaven 20 May '20

20 May '20

Hello, new to stunnel, my first attempt is connecting Eudora to Yahoo Mail. My Yahoo Mail password and username are not being recognised when it is trying to access server 127.0.0.1 Can anyone suggest why this will not work? regards, Joe ******************************************************************************************************** ERROR MESSAGE There has been an error transferring your mail. POP Server [joeslaven(a)127.0.0.1] said ERR [AUTH] Username and password not accepted STUNNEL CONFIG FILE SETTINGS [yahoo-pop3] client = yes accept = 127.0.0.1:110 connect = pop.mail.yahoo.com:995 verify = 2 CAfile = ca-certs.pem checkHost = pop.mail.yahoo.com OCSPaia = yes [yahoo-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.mail.yahoo.com:465 verify = 2 CAfile = ca-certs.pem checkHost = smtp.mail.yahoo.com OCSPaia = yes EUDORA SETTINGS Checking Mail->Mail POP Server: 127.0.0.1 Sending Mail->SMTP Server: 127.0.0.1 Use submission port (587) is UNchecked Secure Sockets when Sending or Receiving : Never Default port settings : SMPT Port (25) POP Port (110)

1 0

Eudora to Yahoo Mail -amended
by Joe Slaven 19 May '20

19 May '20

Hello, totally new to stunnel. Can anyone please point me in the direction of example config code to connect Eudora to POP Yahoo mail? Also what do I put in Eudora ? many thanks, Joe

1 0

Lost password
by Joe Slaven 19 May '20

19 May '20

Hello, I forgot to record my password used to subscribe to the list. Can anyone please tell me how I can reset it? Many thanks, joe

1 0

Eudora to Yahoo Mail
by Joe Slaven 19 May '20

19 May '20

Hello, totally new to stunnel. Can anyone please point me in the direction of example config code to connect Eudora to POP Yahoo mail? many thanks, Joe

1 0

newer version for VMS
by Coviello, Paul 19 May '20

19 May '20

Has anyone put together a package for OpenVMS particularly 8.4-1h1 from VSI? And if not is there a way to use an updated version of SSL in the current version I have? Which I believe is 4.20 FACS1>stunnel -version stunnel undefined on vax-OpenVMS with OpenSSL 0.9.8h 28 May 2008 Threading:PTHREAD Sockets:POLL,IPv4 Global options debug = 5 pid = SYS$LOGIN:STUNNEL.PID RNDbytes = 64 RNDoverwrite = yes Service-level options cert = stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = stunnel.pem session = 300 seconds sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none

1 0

Windows tray icon
by Phil Smith III 19 May '20

19 May '20

If you hover on the stunnel tray icon, it just says "Server is idle". Right-clicking shows various options; none of those say "stunnel". Yes, they can go to "About", but it would be nice if the hover said "Stunnel server is idle" (and, perhaps, the "Exit" option said "Exit stunnel"). My user (my wife!) keeps forgetting what it is, hovering, and then still asking me what it is. Just a WIBNI. stunnel has been a lifesaver: she's wedded to Eudora, which doesn't support modern TLS, so when our ISP went all-TLS we had a problem. I also use it: I have a Bayesian mail proxy (K9) that doesn't support TLS, so my connections go MUA==>K9==>stunnel==>ISP. Any chance of this happening next rev? ...phsiii

1 0

Stunnel 5.57b2 OpenSSL 1.1.1g
by Olaf Brandt 19 May '20

19 May '20

Hi, I have an issue with stunnel since OpenSSL was updated to 1.1.1g. Stunnel has been build from scratch after the update and gives those errors: [ ] Clients allowed=500 [.] stunnel 5.57 on x86_64-pc-linux-gnu platform [.] Compiled/running with OpenSSL 1.1.1g 21 Apr 2020 [.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*__errno_location ()) [.] Reading configuration from file /etc/stunnel/stunnel.conf [.] UTF-8 byte order mark not detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [dns_local] [ ] stunnel default security level set: 2 [ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK [ ] TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 [ ] TLS options: 0x02100004 (+0x00000000, -0x00000000) [ ] No certificate or private key specified [!] error queue: crypto/x509/by_file.c:205: error:0B084009:x509 certificate routines:X509_load_cert_crl_file:PEM lib [!] error queue: crypto/pem/pem_info.c:196: error:0907400D:PEM routines:PEM_X509_INFO_read_bio:ASN1 lib [!] error queue: crypto/asn1/tasn_dec.c:290: error:0D07803A:asn1 encoding routines:asn1_item_embed_d2i:nested asn1 error [!] error queue: crypto/asn1/tasn_dec.c:1118: error:0D068066:asn1 encoding routines:asn1_check_tlen:bad object header [!] SSL_CTX_load_verify_locations: crypto/asn1/asn1_lib.c:91: error:0D07209B:asn1 encoding routines:ASN1_get_object:too long [!] Service [dns_local]: Failed to initialize TLS context [ ] Deallocating section defaults [ ] Deallocating section [dns_local] [ ] Deallocating section defaults Config: chroot=/var/lib/stunnel pid=/var/run/stunnel.pid debug = debug [dns_local] sslVersion = TLSv1.3 client = yes accept = localhost:1053 connect = 185.95.218.42:853 checkHost = dns.digitale-gesellschaft.ch verifyPeer = yes CAfile = /etc/stunnel/cf.crt [dns_local_fallback] sslVersion = TLSv1.3 client = yes accept = localhost:1054 connect = 185.95.218.43:853 checkHost = dns.digitale-gesellschaft.ch verifyPeer = yes CAfile = /etc/stunnel/cf43.crt OpenSSL check of the cert files seems OK: openssl x509 -text -noout -in /etc/stunnel/cf.crt Certificate: Data: Version: 3 (0x2) Serial Number: 03:16:19:87:62:ac:be:ec:92:7b:6e:75:b8:a3:2e:ba:ea:28 Signature Algorithm: sha256WithRSAEncryption Issuer: C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3 Validity Not Before: May 17 21:00:22 2020 GMT Not After : Aug 15 21:00:22 2020 GMT Subject: CN = dns.digitale-gesellschaft.ch Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public-Key: (2048 bit) Modulus: 00:c0:01:03:42:24:5b:07:7e:46:06:fc:e0:21:56: 93:c4:6a:3c:88:c8:df:be:91:d6:d8:7a:b7:fc:3f: 8c:f1:b9:74:ec:c1:3b:2b:02:fe:27:93:1e:d6:d3: a1:95:31:ed:c7:06:26:28:74:60:7e:70:53:39:4b: e5:43:c2:81:dc:50:f3:d7:9e:0b:87:5b:2c:e8:a8: eb:71:bc:7b:04:92:d5:be:66:ba:0e:d8:9f:27:28: 77:9f:7c:68:2f:2f:64:2d:8a:86:f7:cf:c6:3a:c1: 1b:d4:e9:95:d6:c0:f3:77:f3:cd:79:16:40:86:ce: d5:dc:be:b2:c6:5b:7c:fe:e3:68:8d:25:61:41:a8: 99:b3:f4:62:60:19:bf:96:32:46:ef:e4:6a:c2:3d: 00:f6:44:b9:63:94:50:0e:fb:a0:e1:88:eb:79:cf: b7:a5:d1:29:0c:d6:bf:ee:ad:1b:9b:8e:7c:94:4f: f8:5a:0e:a7:5e:62:e7:67:61:9e:83:cb:a0:f7:56: f6:bc:ec:df:4d:60:6a:fe:08:fa:1c:ae:17:05:54: 0f:b0:f8:1f:6c:78:ca:a0:99:ec:4b:06:b3:79:97: 88:d1:7e:c8:93:cf:15:6b:9d:ea:d2:ef:88:da:1b: e8:2b:dd:0d:6e:f2:7e:f3:75:60:03:6a:87:64:79: e6:1f Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Key Usage: critical Digital Signature, Key Encipherment X509v3 Extended Key Usage: TLS Web Server Authentication, TLS Web Client Authentication X509v3 Basic Constraints: critical CA:FALSE X509v3 Subject Key Identifier: 9C:E3:0E:F4:F1:60:60:EC:21:7D:D8:D6:5F:0E:7B:FF:90:DB:68:01 X509v3 Authority Key Identifier: keyid:A8:4A:6A:63:04:7D:DD:BA:E6:D1:39:B7:A6:45:65:EF:F3:A8:EC:A1 Authority Information Access: OCSP - URI:http://ocsp.int-x3.letsencrypt.org CA Issuers - URI:http://cert.int-x3.letsencrypt.org/ X509v3 Subject Alternative Name: DNS:dns.digitale-gesellschaft.ch, DNS:dns1.digitale-gesellschaft.ch, DNS:dns2.digitale-gesellschaft.ch X509v3 Certificate Policies: Policy: 2.23.140.1.2.1 Policy: 1.3.6.1.4.1.44947.1.1.1 CPS: http://cps.letsencrypt.org CT Precertificate SCTs: Signed Certificate Timestamp: Version : v1 (0x0) Log ID : 07:B7:5C:1B:E5:7D:68:FF:F1:B0:C6:1D:23:15:C7:BA: E6:57:7C:57:94:B7:6A:EE:BC:61:3A:1A:69:D3:A2:1C Timestamp : May 17 22:00:22.318 2020 GMT Extensions: none Signature : ecdsa-with-SHA256 30:45:02:20:3D:7F:5A:57:E3:CE:42:A0:2A:16:FD:59: AE:7A:11:19:AE:BE:BE:AA:5A:4A:B0:1E:66:8E:D6:21: A8:35:F8:CB:02:21:00:DB:06:63:54:26:03:76:28:CD: 05:BF:08:8B:1B:95:2B:D2:A1:B3:AC:63:6A:DD:84:E7: 84:3A:70:A6:54:31:2B Signed Certificate Timestamp: Version : v1 (0x0) Log ID : 6F:53:76:AC:31:F0:31:19:D8:99:00:A4:51:15:FF:77: 15:1C:11:D9:02:C1:00:29:06:8D:B2:08:9A:37:D9:13 Timestamp : May 17 22:00:22.412 2020 GMT Extensions: none Signature : ecdsa-with-SHA256 30:45:02:21:00:EA:BC:2D:B6:B1:71:0B:CE:75:A7:15: 86:D2:C0:05:49:08:38:CC:B9:EF:DA:1F:23:53:1A:5F: BD:31:19:A5:0A:02:20:21:2F:94:08:61:D0:A8:CA:3F: 71:D3:54:4D:E3:56:50:91:51:A6:01:16:77:9E:AE:31: 2E:43:E1:68:C0:CE:F2 Signature Algorithm: sha256WithRSAEncryption 9b:b8:24:f8:30:fc:77:5d:67:91:40:c7:bf:58:cf:64:67:7f: 87:33:8e:04:19:93:98:bb:35:cb:4e:b3:78:c0:04:5c:48:f4: 74:38:f2:57:02:38:3b:84:19:aa:9b:39:08:1d:f9:62:f4:c7: af:e4:17:40:02:99:7a:c5:24:fc:ee:b1:d5:95:b0:a2:58:f0: db:44:0f:50:3c:92:81:e8:8f:81:4d:e1:eb:e4:86:5d:d0:c8: 31:d2:30:07:7f:56:48:65:bd:a0:01:38:19:81:e4:80:38:21: 1f:ae:13:96:54:cd:9f:b1:cb:b2:47:00:f0:8b:d4:0d:61:29: 99:cb:71:ee:f6:53:ab:27:45:33:7b:0c:f4:e4:85:58:a7:8e: 58:8e:88:04:0d:e8:03:18:41:e6:8f:b5:c1:c1:9d:da:57:0a: 85:d7:19:05:4f:f9:8f:8c:b5:60:3f:67:f0:d8:fd:10:98:ad: de:25:88:7b:67:0f:bd:e1:7c:21:fb:35:8c:b2:26:78:de:b1: 54:a4:e9:9f:e0:48:d6:1a:0e:60:a6:f6:21:8c:b3:df:21:a1: 0c:16:d4:ab:93:3a:5d:94:22:34:40:5b:7e:ef:ea:f8:a1:15: d6:8d:69:aa:40:fe:ae:6f:79:dd:49:49:1a:88:0f:15:61:19: 00:f8:41:6c openssl x509 -text -noout -in /etc/stunnel/cf43.crt Certificate: Data: Version: 3 (0x2) Serial Number: 03:2b:84:39:5e:99:3d:2d:85:52:63:3a:d2:fa:bc:2e:60:4b Signature Algorithm: sha256WithRSAEncryption Issuer: C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3 Validity Not Before: Mar 16 22:01:15 2020 GMT Not After : Jun 14 22:01:15 2020 GMT Subject: CN = dns.digitale-gesellschaft.ch Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public-Key: (2048 bit) Modulus: 00:bc:0e:73:84:9c:89:7c:f8:2a:db:79:5f:78:ac: 39:a8:c5:25:b4:86:5b:9e:1c:3c:14:a6:17:ae:67: f1:02:17:0b:dc:36:ea:a1:9c:57:91:5b:5a:91:6b: df:7b:4c:74:7e:6c:e2:eb:5f:a5:95:02:25:43:c1: 3e:f0:67:5d:80:27:6f:37:72:0e:1f:b7:c3:13:e2: 3a:a5:13:b6:41:d0:01:aa:d0:7f:68:d4:5e:10:95: ee:17:bb:8d:8b:77:a3:7e:c8:9e:7a:8a:35:8a:09: 00:82:80:67:70:34:ac:f5:bc:24:4a:b9:c4:df:1f: 1e:e4:48:66:a8:76:60:d8:a3:d5:64:3b:9d:7e:7b: 18:99:f7:31:a5:28:4e:a4:47:24:25:af:18:32:d5: f9:98:67:21:f7:49:23:c2:72:00:73:e5:25:ca:af: a5:ae:df:00:62:d8:f2:5e:1e:8a:26:5a:63:5b:22: e1:eb:2d:b4:e9:57:de:16:8c:a0:72:db:ff:82:46: b8:d8:55:ad:55:84:e5:65:b5:86:8b:47:00:ea:85: 0d:74:c6:9d:9f:95:e4:3a:19:fe:3d:8f:5f:4b:f8: ed:a5:93:3f:ea:31:fd:41:74:7e:6b:ae:bf:98:9a: 70:85:d8:9f:51:85:fc:5e:11:eb:b9:60:6a:c3:bf: 81:f7 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Key Usage: critical Digital Signature, Key Encipherment X509v3 Extended Key Usage: TLS Web Server Authentication, TLS Web Client Authentication X509v3 Basic Constraints: critical CA:FALSE X509v3 Subject Key Identifier: DE:64:78:2F:E4:81:84:C3:C9:3F:5C:01:DB:D0:42:E2:0D:CB:48:B8 X509v3 Authority Key Identifier: keyid:A8:4A:6A:63:04:7D:DD:BA:E6:D1:39:B7:A6:45:65:EF:F3:A8:EC:A1 Authority Information Access: OCSP - URI:http://ocsp.int-x3.letsencrypt.org CA Issuers - URI:http://cert.int-x3.letsencrypt.org/ X509v3 Subject Alternative Name: DNS:dns.digitale-gesellschaft.ch, DNS:dns1.digitale-gesellschaft.ch, DNS:dns2.digitale-gesellschaft.ch X509v3 Certificate Policies: Policy: 2.23.140.1.2.1 Policy: 1.3.6.1.4.1.44947.1.1.1 CPS: http://cps.letsencrypt.org CT Precertificate SCTs: Signed Certificate Timestamp: Version : v1 (0x0) Log ID : 5E:A7:73:F9:DF:56:C0:E7:B5:36:48:7D:D0:49:E0:32: 7A:91:9A:0C:84:A1:12:12:84:18:75:96:81:71:45:58 Timestamp : Mar 16 23:01:15.249 2020 GMT Extensions: none Signature : ecdsa-with-SHA256 30:44:02:20:04:32:96:55:70:AB:40:41:3B:E2:6C:E3: 8E:78:1E:82:F7:84:57:6A:76:2C:11:2B:24:A6:BB:72: 59:F1:F9:8A:02:20:67:12:DB:64:C1:D8:15:5D:3F:ED: 8B:8F:01:68:B8:A1:D2:B0:20:2B:32:54:11:14:82:72: 06:B8:E6:1C:1C:69 Signed Certificate Timestamp: Version : v1 (0x0) Log ID : 07:B7:5C:1B:E5:7D:68:FF:F1:B0:C6:1D:23:15:C7:BA: E6:57:7C:57:94:B7:6A:EE:BC:61:3A:1A:69:D3:A2:1C Timestamp : Mar 16 23:01:15.303 2020 GMT Extensions: none Signature : ecdsa-with-SHA256 30:44:02:20:1B:C7:5B:F2:A9:04:12:6A:62:E8:33:F9: BD:08:39:1D:0F:F3:39:8D:F2:F8:37:E3:C8:05:CC:1B: E7:31:F7:83:02:20:12:47:02:D3:E3:93:48:9A:F3:5A: B9:F4:12:85:87:0F:D4:F2:B7:79:F5:8C:DD:77:D4:5E: BE:D0:95:27:83:9C Signature Algorithm: sha256WithRSAEncryption 82:30:ea:0a:6f:45:53:e7:f8:a0:80:69:47:a4:7d:ee:6a:78: a3:34:00:f1:bb:0d:c8:3a:1f:37:8e:25:f9:9d:cc:a5:e0:15: 03:a5:da:2a:28:af:89:97:f9:d6:20:61:ae:1e:16:80:f4:1a: 2c:08:ac:74:f3:80:2f:ae:17:f7:f4:b4:1c:b7:f1:59:f9:73: fd:12:cb:e3:48:36:bd:fe:99:38:69:44:7f:3b:dc:38:98:54: 75:f5:00:d0:de:93:eb:5a:4d:5e:65:d0:99:9e:64:75:8f:cd: e4:6f:1e:22:d5:8f:cb:4d:78:ef:0e:70:38:b7:f0:af:4d:30: 7b:9a:ea:1d:6c:b7:cb:18:2b:de:5a:18:d2:4b:bb:e6:79:b2: 45:8b:01:dc:d1:15:45:cc:cc:f0:5d:a6:98:10:90:72:d2:da: ef:7a:3c:1c:af:42:f0:7f:85:5b:49:53:e8:b3:51:11:e4:93: fc:b3:8a:dc:bc:5c:40:8d:bb:36:be:36:87:09:de:23:19:29: 1d:f3:7e:70:5b:43:43:ad:6e:a4:b4:55:ac:9e:f5:10:05:31: a7:a5:00:66:8a:e7:67:4e:02:2a:2d:40:d4:2c:e8:f1:bb:35: 8d:b7:cf:52:b0:71:04:72:d0:ab:fb:e6:f6:c7:45:33:db:88: d5:90:f0:32 Any suggestions? Thanks.

1 0

client with two source IPs and one destination
by Daniele Basaldella 12 May '20

12 May '20

Dear group, I've to configure a couple of tunneled connections (call them TC1 and TC2), client side, on a linux system. The target of both such connections is the same (destination ip and port are the same, call it DST). At source side (my server) I have a two IP addresses (call them IP1 and IP2) assigned and currently working to its unique NIC. I normally use iptables SNAT to split the traffic between IP1 and IP2 depending on destination addresses but in this case I've to distinguish it at application level (TC1 and TC2). I'd like to get TC1 to set the outgoing traffic with source address IP1 and TC2 to set outgoing traffic with source address IP2. Tunnel Tunnel Client Server TC1: IP1 --\ >--> DST TC2: IP2 --/ I'm thinking to set one entry in stunnel.conf for each TC1 and TC2 and use *transparent* = source clause to set the source address but it seems my case is not so common and I didn't find documentation. Please could you suggest a solution. Thanks

3 3

iOS 13.4.1 Blue Iris now working
by John McClymont 12 May '20

12 May '20

After more research, stunnel and blue iris now working on IOS 13.4.1 sslVersion = TLSv1.2 <--- added this to stunnel.conf [BlueIris] accept=1440 connect=192.168.0.2:8080 <---- tried 8080 failed, tried 127.0.0.1 failed cert = stunnel.pem Like I said not an expert,

1 0

client with two source IPs and one destination
by Brent Kimberley 11 May '20

11 May '20

Hi Daniele.I haven't looked at exact scenario. Have you considered stunnel+HAproxy? Dear group, I've to configure a couple of tunneled connections (call them TC1 and TC2), client side, on a linux system. The target of both such connections is the same (destination ip and port are the same, call it DST). At source side (my server) I have a two IP addresses (call them IP1 and IP2) assigned and currently working to its unique NIC. I normally use iptables SNAT to split the traffic between IP1 and IP2 depending on destination addresses but in this case I've to distinguish it at application level (TC1 and TC2). I'd like to get TC1 to set the outgoing traffic with source address IP1 and TC2 to set outgoing traffic with source address IP2. Tunnel Tunnel Client Server TC1: IP1 --\ >--> DST TC2: IP2 --/ I'm thinking to set one entry in stunnel.conf for each TC1 and TC2 and use *transparent* = source clause to set the source address but it seems my case is not so common and I didn't find documentation. Please could you suggest a solution. Thanks

1 0

iOS 13.4.1 Blue Iris
by John McClymont 11 May '20

11 May '20

Hi I have been using stunnel or a number of years to create a secure connect to CCTV recording software. Today after upgrading to IOS 13.4.1 I can no longer connect I ran generate self signed certificate, still fails. Searching I found others with similar problem, some have created a cert using other providers. I would prefer to generate from stunnel as I have always done config [BlueIris] accept=1440 connect=8080 cert = stunnel.pem I am no expert, basically followed a simple setup read few comments that it maybe due to IOS no longer supporting certain version of ssl Hopefully you can help Log 2020.05.11 22:59:04 LOG5[main]: stunnel 5.56 on x64-pc-mingw32-gnu platform 2020.05.11 22:59:04 LOG5[main]: Compiled/running with OpenSSL 1.1.1c 28 May 2019 2020.05.11 22:59:04 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI 2020.05.11 22:59:04 LOG5[main]: Reading configuration from file stunnel.conf 2020.05.11 22:59:04 LOG5[main]: UTF-8 byte order mark detected 2020.05.11 22:59:04 LOG6[main]: Initializing service [BlueIris] 2020.05.11 22:59:04 LOG6[main]: Loading certificate from file: stunnel.pem 2020.05.11 22:59:04 LOG6[main]: Certificate loaded from file: stunnel.pem 2020.05.11 22:59:04 LOG6[main]: Loading private key from file: stunnel.pem 2020.05.11 22:59:04 LOG6[main]: Private key loaded from file: stunnel.pem 2020.05.11 22:59:04 LOG6[main]: DH initialization not needed 2020.05.11 22:59:04 LOG6[main]: Initializing service [gmail-pop3] 2020.05.11 22:59:04 LOG6[main]: Initializing service [gmail-imap] 2020.05.11 22:59:04 LOG6[main]: Initializing service [gmail-smtp] 2020.05.11 22:59:04 LOG6[main]: Initializing service [meinberg-smtp] 2020.05.11 22:59:04 LOG6[main]: Loading certificate from file: stunnel.pem 2020.05.11 22:59:04 LOG6[main]: Certificate loaded from file: stunnel.pem 2020.05.11 22:59:04 LOG6[main]: Loading private key from file: stunnel.pem 2020.05.11 22:59:04 LOG6[main]: Private key loaded from file: stunnel.pem 2020.05.11 22:59:04 LOG4[main]: Service [meinberg-smtp] needs authentication to prevent MITM attacks 2020.05.11 22:59:04 LOG5[main]: Configuration successful 2020.05.11 22:59:04 LOG6[main]: Service [BlueIris] (FD=564) bound to 0.0.0.0:1440 2020.05.11 22:59:04 LOG6[main]: Service [gmail-pop3] (FD=728) bound to 127.0.0.1:110 2020.05.11 22:59:04 LOG6[main]: Service [gmail-imap] (FD=732) bound to 127.0.0.1:143 2020.05.11 22:59:04 LOG6[main]: Service [gmail-smtp] (FD=736) bound to 0.0.0.0:25 2020.05.11 22:59:04 LOG6[main]: Service [meinberg-smtp] (FD=740) bound to 192.168.0.2:2525 2020.05.11 22:59:04 LOG6[cron]: Executing cron jobs 2020.05.11 22:59:04 LOG6[cron]: Cron jobs completed in 0 seconds 2020.05.11 22:59:55 LOG5[0]: Service [BlueIris] accepted connection from 192.168.0.142:58797 2020.05.11 22:59:55 LOG6[0]: Peer certificate not required 2020.05.11 22:59:55 LOG3[0]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[1]: Service [BlueIris] accepted connection from 192.168.0.142:58798 2020.05.11 22:59:55 LOG6[1]: Peer certificate not required 2020.05.11 22:59:55 LOG3[1]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[1]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[2]: Service [BlueIris] accepted connection from 192.168.0.142:58799 2020.05.11 22:59:55 LOG6[2]: Peer certificate not required 2020.05.11 22:59:55 LOG3[2]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 22:59:55 LOG5[2]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[3]: Service [BlueIris] accepted connection from 192.168.0.142:58800 2020.05.11 22:59:55 LOG6[3]: Peer certificate not required 2020.05.11 22:59:55 LOG3[3]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[3]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[4]: Service [BlueIris] accepted connection from 192.168.0.142:58801 2020.05.11 22:59:55 LOG6[4]: Peer certificate not required 2020.05.11 22:59:55 LOG3[4]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[4]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[5]: Service [BlueIris] accepted connection from 192.168.0.142:58802 2020.05.11 22:59:55 LOG6[5]: Peer certificate not required 2020.05.11 22:59:55 LOG3[5]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 22:59:55 LOG5[5]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[6]: Service [BlueIris] accepted connection from 192.168.0.142:58803 2020.05.11 22:59:55 LOG6[6]: Peer certificate not required 2020.05.11 22:59:55 LOG3[6]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[6]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[7]: Service [BlueIris] accepted connection from 192.168.0.142:58804 2020.05.11 22:59:55 LOG6[7]: Peer certificate not required 2020.05.11 22:59:55 LOG3[7]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[7]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[8]: Service [BlueIris] accepted connection from 192.168.0.142:58805 2020.05.11 22:59:55 LOG6[8]: Peer certificate not required 2020.05.11 22:59:55 LOG3[8]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 22:59:55 LOG5[8]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[9]: Service [BlueIris] accepted connection from 192.168.0.142:58806 2020.05.11 22:59:55 LOG6[9]: Peer certificate not required 2020.05.11 22:59:55 LOG3[9]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[9]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[10]: Service [BlueIris] accepted connection from 192.168.0.142:58807 2020.05.11 22:59:55 LOG6[10]: Peer certificate not required 2020.05.11 22:59:55 LOG3[10]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[10]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[11]: Service [BlueIris] accepted connection from 192.168.0.142:58808 2020.05.11 22:59:55 LOG6[11]: Peer certificate not required 2020.05.11 22:59:55 LOG3[11]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 22:59:55 LOG5[11]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[12]: Service [BlueIris] accepted connection from 192.168.0.142:58809 2020.05.11 22:59:55 LOG6[12]: Peer certificate not required 2020.05.11 22:59:55 LOG3[12]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[12]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[13]: Service [BlueIris] accepted connection from 192.168.0.142:58810 2020.05.11 22:59:55 LOG6[13]: Peer certificate not required 2020.05.11 22:59:55 LOG3[13]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:55 LOG5[13]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:55 LOG5[14]: Service [BlueIris] accepted connection from 192.168.0.142:58811 2020.05.11 22:59:55 LOG6[14]: Peer certificate not required 2020.05.11 22:59:55 LOG3[14]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 22:59:55 LOG5[14]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:56 LOG5[15]: Service [BlueIris] accepted connection from 192.168.0.142:58812 2020.05.11 22:59:56 LOG6[15]: Peer certificate not required 2020.05.11 22:59:56 LOG3[15]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:56 LOG5[15]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:56 LOG5[16]: Service [BlueIris] accepted connection from 192.168.0.142:58813 2020.05.11 22:59:56 LOG6[16]: Peer certificate not required 2020.05.11 22:59:56 LOG3[16]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 22:59:56 LOG5[16]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 22:59:56 LOG5[17]: Service [BlueIris] accepted connection from 192.168.0.142:58814 2020.05.11 22:59:56 LOG6[17]: Peer certificate not required 2020.05.11 22:59:56 LOG3[17]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 22:59:56 LOG5[17]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[18]: Service [BlueIris] accepted connection from 192.168.0.142:58815 2020.05.11 23:00:04 LOG6[18]: Peer certificate not required 2020.05.11 23:00:04 LOG3[18]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[18]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[19]: Service [BlueIris] accepted connection from 192.168.0.142:58816 2020.05.11 23:00:04 LOG6[19]: Peer certificate not required 2020.05.11 23:00:04 LOG3[19]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[19]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[20]: Service [BlueIris] accepted connection from 192.168.0.142:58817 2020.05.11 23:00:04 LOG6[20]: Peer certificate not required 2020.05.11 23:00:04 LOG3[20]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 23:00:04 LOG5[20]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[21]: Service [BlueIris] accepted connection from 192.168.0.142:58818 2020.05.11 23:00:04 LOG6[21]: Peer certificate not required 2020.05.11 23:00:04 LOG3[21]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[21]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[22]: Service [BlueIris] accepted connection from 192.168.0.142:58819 2020.05.11 23:00:04 LOG6[22]: Peer certificate not required 2020.05.11 23:00:04 LOG3[22]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[22]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[23]: Service [BlueIris] accepted connection from 192.168.0.142:58820 2020.05.11 23:00:04 LOG6[23]: Peer certificate not required 2020.05.11 23:00:04 LOG3[23]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 23:00:04 LOG5[23]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[24]: Service [BlueIris] accepted connection from 192.168.0.142:58821 2020.05.11 23:00:04 LOG6[24]: Peer certificate not required 2020.05.11 23:00:04 LOG3[24]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[24]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[25]: Service [BlueIris] accepted connection from 192.168.0.142:58822 2020.05.11 23:00:04 LOG6[25]: Peer certificate not required 2020.05.11 23:00:04 LOG3[25]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[25]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[26]: Service [BlueIris] accepted connection from 192.168.0.142:58823 2020.05.11 23:00:04 LOG6[26]: Peer certificate not required 2020.05.11 23:00:04 LOG3[26]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 23:00:04 LOG5[26]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[27]: Service [BlueIris] accepted connection from 192.168.0.142:58824 2020.05.11 23:00:04 LOG6[27]: Peer certificate not required 2020.05.11 23:00:04 LOG3[27]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[27]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[28]: Service [BlueIris] accepted connection from 192.168.0.142:58825 2020.05.11 23:00:04 LOG6[28]: Peer certificate not required 2020.05.11 23:00:04 LOG3[28]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[28]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[29]: Service [BlueIris] accepted connection from 192.168.0.142:58826 2020.05.11 23:00:04 LOG6[29]: Peer certificate not required 2020.05.11 23:00:04 LOG3[29]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 23:00:04 LOG5[29]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[30]: Service [BlueIris] accepted connection from 192.168.0.142:58827 2020.05.11 23:00:04 LOG6[30]: Peer certificate not required 2020.05.11 23:00:04 LOG3[30]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[30]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[31]: Service [BlueIris] accepted connection from 192.168.0.142:58828 2020.05.11 23:00:04 LOG6[31]: Peer certificate not required 2020.05.11 23:00:04 LOG3[31]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[31]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[32]: Service [BlueIris] accepted connection from 192.168.0.142:58829 2020.05.11 23:00:04 LOG6[32]: Peer certificate not required 2020.05.11 23:00:04 LOG3[32]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 23:00:04 LOG5[32]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[33]: Service [BlueIris] accepted connection from 192.168.0.142:58830 2020.05.11 23:00:04 LOG6[33]: Peer certificate not required 2020.05.11 23:00:04 LOG3[33]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[33]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[34]: Service [BlueIris] accepted connection from 192.168.0.142:58831 2020.05.11 23:00:04 LOG6[34]: Peer certificate not required 2020.05.11 23:00:04 LOG3[34]: SSL_accept: ssl/record/rec_layer_s3.c:1535: error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter 2020.05.11 23:00:04 LOG5[34]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.05.11 23:00:04 LOG5[35]: Service [BlueIris] accepted connection from 192.168.0.142:58832 2020.05.11 23:00:04 LOG6[35]: Peer certificate not required 2020.05.11 23:00:04 LOG3[35]: SSL_accept: ssl/statem/statem_srvr.c:1746: error:14209175:SSL routines:tls_early_post_process_client_hello:inappropriate fallback 2020.05.11 23:00:04 LOG5[35]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket

1 0

Solution: REDIR not Working in Chrome, Edge (new), Opera
by Joe Sterk 08 May '20

08 May '20

I found the solution to the REDIR issue posted in April. You can find more information at https://support.google.com/chrome/forum/AAAAP1KN0B02tttvx4VCDQ/?hl=en&gpf=%…. The issue is going from https --> http or https. Our software company added an additional CRLR at the end so it looks like this now: "HTTP/1.1 301 Moved Permanently\r\n" + "Location: https://www.abc.com<https://www.abc.com/>" + http.req.url.path_and_query.http_url_safe + "\r\n\r\n". Joe Sterk

1 0

Stunnel 4 with Shoutcast 2.6
by Ali 02 May '20

02 May '20

I am trying to add ssl to my shoutcast stream. I get the messages below when I try to start or restart shoutcast. I have purchased an ssl cert and key for this and it did not work via the shoutcast config, so I gave this a shot. The key and certs with combined into the stunnel.pem. See below and thanks for the help. I also added the stunnel config below. client=no [shoutcast] accept=8002 (I also tried 443) connect=localhost:8000 cert = /etc/stunnel/stunnel.pem pid=/etc/stunnel/stunnel.pid -permissions are set to chmod 600 Stunnel Dir root@kwaxstreamserver:/etc/stunnel# l cert.pem key.pem README stunnel.conf stunnel.pem Stunnel on START Clients allowed=500 stunnel 4.53 on x86_64-pc-linux-gnu platform Compiled with OpenSSL 1.0.1e 11 Feb 2013 Running with OpenSSL 1.0.1f 6 Jan 2014 Update OpenSSL shared libraries or rebuild stunnel Threading:PTHREAD SSL:+ENGINE+OCSP Auth:LIBWRAP Sockets:POLL+IPv6 Reading configuration from file stunnel.conf Compression not enabled Snagged 64 random bytes from /root/.rnd Wrote 1024 new random bytes to /root/.rnd PRNG seeded successfully Line 6: "pid = /etc/stunnel/stunnel.pid": Specified option name is not valid here str_stats: 7 block(s), 1063 data byte(s), 406 control byte(s) Stunnel on RESTART root@kwaxstreamserver:/etc/stunnel# /etc/init.d/stunnel4 restart Restarting SSL tunnels: Clients allowed=500 stunnel 4.53 on x86_64-pc-linux-gnu platform Compiled with OpenSSL 1.0.1e 11 Feb 2013 Running with OpenSSL 1.0.1f 6 Jan 2014 Update OpenSSL shared libraries or rebuild stunnel Threading:PTHREAD SSL:+ENGINE+OCSP Auth:LIBWRAP Sockets:POLL+IPv6 Reading configuration from file /etc/stunnel/stunnel.conf Compression not enabled Snagged 64 random bytes from /root/.rnd Wrote 1024 new random bytes to /root/.rnd PRNG seeded successfully Line 6: "pid = /etc/stunnel/stunnel.pid": Specified option name is not valid here str_stats: 7 block(s), 1076 data byte(s), 406 control byte(s) [Failed: /etc/stunnel/stunnel.conf] You should check that you have specified the pid= in you configuration file

2 1

REDIR not Working in Chrome, Edge (new), Opera
by Joe Sterk 30 Apr '20

30 Apr '20

We are running stunnel on a windows 2019 server. When running Chrome/Opera/Edge(new), on our redirect we get the following: Hmmm... can't reach this page It looks like the webpage at https://xx.xxxxxxxx.com/xap/tqv000?NAME=&domain=xxxxxxxx might be having issues, or it may have moved permanently to a new web address. ERR_RESPONSE_HEADERS_TRUNCATED The code that is being called is: !************************************************************************ B$='REDIR https://' + STRIP(HOST$) + '/mainlobby.aspx' We even tried to redirect to www.google.com<http://www.google.com/appserve/mkt/p/AM7kBiVHeOrDhOeWlVMENmuUHTN9kHtm1C15sn…> and got the same error. Our log files shows the following: [04/23/20 14:25:39 409 ]Q.BUTTON1 = Ok [04/23/20 14:25:39 409 ]REDIR http://www.google.com [04/23/20 14:25:39 409 ]Result=+OK REDIR [04/23/20 14:25:42 ]GET /xap/tqv001 HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, */* The stunnel.conf file has the following connection information: sslVersion = all options = NO_SSLv2 options = NO_SSLv3 options = NO_TLSv1 ;header always set x-xss-protection "1; mode=block" ;ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-CAMELLIA256-SHA ciphers = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 ;options = CIPHER_SERVER_PREFERENCE TIMEOUTclose = 0 [https] accept = 443 connect = 8080 I don't see any error messages but the redirect is not working. It still works in IE and Firefox (for now). Joe Sterk CIO (Chief Information Officer) [Description: Description: cid:[email protected]] Insurance Services Corp. ? (972) 896-0384 (Mobile) * (707) 303-8105 (Work) * joes(a)QuieTrack.com<mailto:[email protected]>

1 0

Stunnel Cleanup on Uninstall
by Thomas Eifert 21 Apr '20

21 Apr '20

I've recently removed Stunnel 5.56 from several machines running Windows 10 x64. In every case, the uninstaller leaves behind the stunnel directory, bin subdirectory, and the file libssp-0.dll. Easy enough to remove manually, but I seem to recall in previous versions that the uninstaller managed to get everything. Regards, Thomas -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

1 0

port ? and password
by Coviello, Paul 21 Apr '20

21 Apr '20

It's been awhile since I've played with this and now there is a need to bring it back online. Can I designate any port numbers? I have an application that requires 'a' on the client and 'b' on the server Also is there a way to change the password in the startup of stunnell on VMS? Thanks Paul

1 0

stunnel ignoring config file for port binding
by Tim Turner 18 Apr '20

18 Apr '20

Config and logs below but redacted, this is running on 2016 server, if it matters I am starting it over an RDP session I find that the port is ignored in the config file and it always binds to ports in the 23*** range ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment ;cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = /stunnel.log ; Use it for client mode client = yes ; Service-level configuration [Service Config] accept=127.0.0.1:40001 connect = redacted:443 log file 2020.04.18 10:08:18 LOG7[main]: Dispatching a signal from the signal pipe 2020.04.18 10:08:18 LOG7[main]: Processing SIGNAL_RELOAD_CONFIG 2020.04.18 10:08:18 LOG7[main]: Running on Windows 6.2 2020.04.18 10:08:18 LOG5[main]: Reading configuration from file stunnel.conf 2020.04.18 10:08:18 LOG5[main]: UTF-8 byte order mark detected 2020.04.18 10:08:18 LOG7[main]: Compression disabled 2020.04.18 10:08:18 LOG7[main]: No PRNG seeding was required 2020.04.18 10:08:18 LOG6[main]: Initializing service [Service Config] 2020.04.18 10:08:18 LOG7[main]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2020.04.18 10:08:18 LOG7[main]: TLSv1.3 ciphersuites: TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256 2020.04.18 10:08:18 LOG7[main]: TLS options: 0x02100004 (+0x00000000, -0x00000000) 2020.04.18 10:08:18 LOG7[main]: No certificate or private key specified 2020.04.18 10:08:18 LOG4[main]: Service [Digital-Prod-MTF-FIX-MD] needs authentication to prevent MITM attacks 2020.04.18 10:08:18 LOG5[main]: Configuration successful 2020.04.18 10:08:18 LOG7[main]: Deallocating section defaults 2020.04.18 10:08:18 LOG5[main]: Logging to C:\Users\turnert\AppData\Local\/stunnel.log 2020.04.18 10:08:18 LOG7[main]: Binding service [New Broker FIX Demo-Trading] 2020.04.18 10:08:18 LOG7[main]: Listening file descriptor created (FD=1296) 2020.04.18 10:08:18 LOG7[main]: Setting accept socket options (FD=1296) 2020.04.18 10:08:18 LOG7[main]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2020.04.18 10:08:18 LOG6[main]: Service [New Broker FIX Demo-Trading] (FD=1296) bound to 127.0.0.1:23471 2020.04.18 10:08:18 LOG7[main]: Binding service [Service Config] This message and its attachments are confidential, may not be disclosed or used by any person other than the addressee and are intended only for the named recipient(s). If you are not the intended recipient, please notify the sender immediately and delete any copies of this message. LMAX Group is the holding company of LMAX Exchange, LMAX Global and LMAX Digital. Our registered address is Yellow Building, 1A Nicholas Road, London W11 4AN.

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 189, Issue 3
by Brent Kimberley 10 Apr '20

10 Apr '20

Hi Andre. Can you please post your template? Salut, Brent Friday, April 10, 2020, 6:00:08 a.m. EDT, stunnel-users-request(a)stunnel.org <stunnel-users-request(a)stunnel.org> wrote: Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. CERT: Pre-verification error: unsupported certificate purpose (Andr? L?onard) ---------------------------------------------------------------------- Message: 1 Date: Fri, 10 Apr 2020 09:46:29 +0200 From: Andr? L?onard <andre.leonard(a)celotoise.com> To: stunnel-users(a)stunnel.org Subject: [stunnel-users] CERT: Pre-verification error: unsupported certificate purpose Message-ID: <1a2bba7f82b899d6e208303bc3a8ad6d(a)celotoise.com> Content-Type: text/plain; charset="utf-8"; Format="flowed" Hi, I upgraded stunnel from version 5.44 to 5.56. But now I'm getting the following error : CERT: Pre-verification error: unsupported certificate purpose Rejected by CERT Setting verifiy to 0 slove temporary the issue but is not secure at all. As testing pupose, I recreated new certificate with the following command but ending with the same issue: openssl req -new -x509 -days 365 -nodes -config stunnel.cnf -out stunnel.pem -keyout stunnel.pem How to fix this ? Thanks for you help, Andr?.

1 0

CERT: Pre-verification error: unsupported certificate purpose
by André Léonard 10 Apr '20

10 Apr '20

Hi, I upgraded stunnel from version 5.44 to 5.56. But now I'm getting the following error : CERT: Pre-verification error: unsupported certificate purpose Rejected by CERT Setting verifiy to 0 slove temporary the issue but is not secure at all. As testing pupose, I recreated new certificate with the following command but ending with the same issue: openssl req -new -x509 -days 365 -nodes -config stunnel.cnf -out stunnel.pem -keyout stunnel.pem How to fix this ? Thanks for you help, André.

1 0

Stunnel to accept SSL and connect SSL
by Ray 08 Apr '20

08 Apr '20

Hi everyone, Simple question - How can I configure Stunnel to accept SSL from downlinks and connect to an SSL uplink? Thanks Ray

1 0

Stunnel API hooks
by Ray 31 Mar '20

31 Mar '20

Hi everyone, I want to do some processing over the incoming connection before forwarding the payload to the uplinks. ie. Listen <-> customized processing <-> connect Is there any API/hook structure to write my logic in a clean fashion? Or need to add/integrate my codes to the Stunnel codes? P.S I want this processing to be done in Stunnel and not by adding a 2nd application to achieve the job. Thanks Ray

1 0

Stunnel binary for macOS?
by Shrinidhi Rao 22 Mar '20

22 Mar '20

Greetings! I tried building stunnel in my mac and it was successful since I have all the developer tools installed. What about for those who do not have an 8GB size tool? Is there a way I can simply build a binary that can work in a wide range of macOS versions (including older ones)? Is there someone who has already done this? Any pointers in this regard would be greatly appreciated! -- Shrinidhi S Rao

2 1

stunnel squid proxy without client side stunnel
by claudiu vasadi 13 Mar '20

13 Mar '20

Hello list, I've successfully managed to setup the following: client -> stunnel (local on client) -> stunnel (on server) -> squid (same server) I was wondering however if it would be possible to NOT use stunnel on the client side and connect directly to the server side one. My current, working configs are below. simplified server side stunnel.conf: cert = /etc/stunnel/stunnel.pem debug = 7 output = /var/log/stunnel.log client = no [squid] accept = 3128 connect = 127.0.0.1:3129 client side config: cert = /etc/stunnel/stunnel.pem client = yes [squid] accept = 127.0.0.1:8080 connect = server:3128 On the server side, I've tried specifying: client = yes protocol = connect protocolHost = 127.0.0.1:3129 #SSL terminates on the stunnel server (still unsure about this) but because the proxy needs authentication (it used LDAP), I'm hitting what seems to be stunnel not returning the HTTP407 back to the client. 2020.03.13 20:18:34 LOG6[12306:140677061584640]: Client-mode connect protocol negotiations started 2020.03.13 20:18:34 LOG7[12306:140677061584640]: -> CONNECT 127.0.0.1:3129 HTTP/1.1 2020.03.13 20:18:34 LOG7[12306:140677061584640]: -> Host: 127.0.0.1:3129 2020.03.13 20:18:34 LOG7[12306:140677061584640]: -> 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- HTTP/1.1 407 Proxy Authentication Required 2020.03.13 20:18:34 LOG3[12306:140677061584640]: CONNECT request rejected 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- Server: squid/3.5.20 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- Mime-Version: 1.0 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- Date: Fri, 13 Mar 2020 20:18:34 GMT 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- Content-Type: text/html;charset=utf-8 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- Content-Length: 3431 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- X-Squid-Error: ERR_CACHE_ACCESS_DENIED 0 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- Vary: Accept-Language 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- Content-Language: en 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- Proxy-Authenticate: Basic realm="myproxy" 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- X-Cache: MISS from myproxy 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- X-Cache-Lookup: NONE from myproxy:3129 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- Via: 1.1 myproxy (squid/3.5.20) 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- Connection: keep-alive 2020.03.13 20:18:34 LOG7[12306:140677061584640]: <- 2020.03.13 20:18:34 LOG5[12306:140677061584640]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket I'm testing with the following command from the client side: curl -U mysuer -x http://myproxy:3128 https://www.google.com Any help would be greatly appreciated.

1 0

S-tunnel will not send TLS
by Jan Falk 13 Mar '20

13 Mar '20

Hi. Can someone tell me why Stunnel stops at wating 10s? Log: 2020.03.12 09:43:36 LOG6[main]: Initializing service [x3_x4_DICOM_BFT_client] 2020.03.12 09:43:36 LOG7[main]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2020.03.12 09:43:36 LOG7[main]: TLSv1.3 ciphersuites: TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256 2020.03.12 09:43:36 LOG7[main]: TLS options: 0x02100004 (+0x00000000, -0x00000000) 2020.03.12 09:43:36 LOG6[main]: Loading certificate from file: x1.dc.x2.se_201900604.pem 2020.03.12 09:43:36 LOG6[main]: Certificate loaded from file: x1.dc.x2.se_201900604.pem 2020.03.12 09:43:36 LOG6[main]: Loading private key from file: x1.dc.x2.se_201900604.pem 2020.03.12 09:43:36 LOG6[main]: Private key loaded from file: x1.dc.x2.se_201900604.pem 2020.03.12 09:43:36 LOG7[main]: Private key check succeeded 2020.03.12 09:43:36 LOG4[main]: Service [x3_x4_DICOM_BFT_client] uses "verifyChain" without subject checks 2020.03.12 09:43:36 LOG4[main]: Use "checkHost" or "checkIP" to restrict trusted certificates 2020.03.12 09:43:36 LOG5[main]: Configuration successful 2020.03.12 09:43:36 LOG7[main]: Binding service [x3_x4_HL7_BFT_client] 2020.03.12 09:43:36 LOG7[main]: Listening file descriptor created (FD=380) 2020.03.12 09:43:36 LOG7[main]: Setting accept socket options (FD=380) 2020.03.12 09:43:36 LOG7[main]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2020.03.12 09:43:36 LOG6[main]: Service [x3_x4_HL7_BFT_client] (FD=380) bound to 127.0.0.1:46161 2020.03.12 09:43:36 LOG7[main]: Binding service [x3_x4_DICOM_BFT_client] 2020.03.12 09:43:36 LOG7[main]: Listening file descriptor created (FD=492) 2020.03.12 09:43:36 LOG7[main]: Setting accept socket options (FD=492) 2020.03.12 09:43:36 LOG7[main]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2020.03.12 09:43:36 LOG6[main]: Service [x3_x4_DICOM_BFT_client] (FD=492) bound to 127.0.0.1:46162 2020.03.12 09:43:36 LOG7[cron]: Cron thread initialized 2020.03.12 09:43:36 LOG6[cron]: Executing cron jobs 2020.03.12 09:43:36 LOG6[cron]: Cron jobs completed in 0 seconds 2020.03.12 09:43:36 LOG7[cron]: Waiting 86400 seconds 2020.03.12 09:44:37 LOG7[main]: Found 1 ready file descriptor(s) 2020.03.12 09:44:37 LOG7[main]: FD=380 ifds=r-x ofds=r-- 2020.03.12 09:44:37 LOG7[main]: FD=388 ifds=r-x ofds=--- 2020.03.12 09:44:37 LOG7[main]: Service [SOS_SYNGO_HL7_BFT_client] accepted (FD=508) from 127.0.0.1:50299 2020.03.12 09:44:37 LOG7[main]: Creating a new thread 2020.03.12 09:44:37 LOG7[main]: New thread created 2020.03.12 09:44:37 LOG7[0]: Service [x3_x4_HL7_BFT_client] started 2020.03.12 09:44:37 LOG7[0]: Setting local socket options (FD=508) 2020.03.12 09:44:37 LOG7[0]: Option TCP_NODELAY set on local socket 2020.03.12 09:44:37 LOG5[0]: Service [x3_x4_HL7_BFT_client] accepted connection from 127.0.0.1:50299 2020.03.12 09:44:37 LOG6[0]: s_connect: connecting 10.67.6.106:6161 2020.03.12 09:44:37 LOG7[0]: s_connect: s_poll_wait 10.67.6.106:6161: waiting 10 seconds Thanks in advance //Janne

2 5

Re: [stunnel-users] stunnel-users Digest, Vol 188, Issue 4
by Brent Kimberley 11 Mar '20

11 Mar '20

Hi Kelly. >>Connect = 127.0.0.1:1194? ?#<- this line won't work; but if I replace with 1.2.3.4:1194 then it will work! Generic: The following layers maybe helpful: Cost / People / Process / Infrastructure / Application / Data / Interface ... Specific: Data layer (metadata &/| configuration): Can you please verify that 127.0.01:1194 is present? e.g. netstat -ano | egrep -e Proto -e Active -e 1194 Message: 1 Date: Tue, 10 Mar 2020 13:25:33 +0800 From: Kelly Trinh <kelly(a)trinhonline.com> To: "stunnel-users" <stunnel-users(a)stunnel.org> Subject: [stunnel-users] behaviour when using 127.0.0.1 in the 'connect' field Message-ID: <170c2e7c29d.e9c53ed9127299.5279211261811289922(a)trinhonline.com> Content-Type: text/plain; charset="utf-8" Hi all - just want to report a problem I solved recently but wanted to get some insights on what was causing the problem. About me - learnt some unix at university (20 years ago) but nothing too serious.? Recently (1 month ago) acquired own domain name and now poking around the cloud computing / VPS thing. Project - hand-rolling my own VPN setup on a Ubuntu 18.04 VPS.? OpenVPN is easy since it is a git-clone thing and then just follow the openvpn-install script.? I wanted to add on the Stunnel wrapper because intended to use the VPN in China and apparently their firewall does deep packet inspection and can recognize (and block) openvpn traffic. Problem - when I set up my stunnel using 127.0.0.1 as the connect destination; it doesn't seem to work (I can see from openvpn window that things seem to pipe through stunnel but then immediately the connection is terminated).? If I replace the 127.0.0.1 with IP of the box I am using (say for example 1.2.3.4); everything works!? The FQDN is ok as well; as long as I don't use 127.0.0.1 Specifically the stunnel.conf: [OpenVPN] Accept = 443? # clients connect through 443 to further avoid potential blocking Connect = 127.0.0.1:1194? ?#<- this line won't work; but if I replace with 1.2.3.4:1194 then it will work! Question - My problem is fixed but I am curious if there is any insights on why this is happening given that 1.2.3.4 and 127.0.0.1 are the same machine?

1 0

behaviour when using 127.0.0.1 in the 'connect' field
by Kelly Trinh 10 Mar '20

10 Mar '20

Hi all - just want to report a problem I solved recently but wanted to get some insights on what was causing the problem. About me - learnt some unix at university (20 years ago) but nothing too serious. Recently (1 month ago) acquired own domain name and now poking around the cloud computing / VPS thing. Project - hand-rolling my own VPN setup on a Ubuntu 18.04 VPS. OpenVPN is easy since it is a git-clone thing and then just follow the openvpn-install script. I wanted to add on the Stunnel wrapper because intended to use the VPN in China and apparently their firewall does deep packet inspection and can recognize (and block) openvpn traffic. Problem - when I set up my stunnel using 127.0.0.1 as the connect destination; it doesn't seem to work (I can see from openvpn window that things seem to pipe through stunnel but then immediately the connection is terminated). If I replace the 127.0.0.1 with IP of the box I am using (say for example 1.2.3.4); everything works! The FQDN is ok as well; as long as I don't use 127.0.0.1 Specifically the stunnel.conf: [OpenVPN] Accept = 443 # clients connect through 443 to further avoid potential blocking Connect = 127.0.0.1:1194 #<- this line won't work; but if I replace with 1.2.3.4:1194 then it will work! Question - My problem is fixed but I am curious if there is any insights on why this is happening given that 1.2.3.4 and 127.0.0.1 are the same machine?

3 3

Re: [stunnel-users] (no subject)
by flash＠vicsmba.com 06 Mar '20

06 Mar '20

This can be O/S dependent – some O/S have limits on file descriptors, pipes, etc. I would check that. Second, broken pipes happen when one side closes when there is still action. In Unix C it is easy to do – if you use a piped open but you only want to get the first line of data so your read from the pipe and close … you get a broken pipe every time. This is harmless if that is what you want. Death if not. You might check your Oracle code for premature closing as I doubt it is stunnel. Can you trap the error and resume and see if it works? It well could. Essentially what I am saying is this is not directly a stunnel problem, more likely it is an implementation error. Which could be in the Oracle code as I have had problems with it in the past. More information on the O/S and the Oracle code would help. Eric VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) <http://www.vicsmba.com/> http://www.vicsmba.com <https://www.facebook.com/groups/286143052248115> https://www.facebook.com/groups/286143052248115 From: stunnel-users <stunnel-users-bounces(a)stunnel.org> On Behalf Of Jose Alf. Sent: Wednesday, March 4, 2020 11:09 AM To: stunnel-users(a)stunnel.org; simona vittori <svittori(a)gmail.com> Subject: Re: [stunnel-users] (no subject) Simona, You are not giving enough information for anyone in this list to help you. Please review and apply How To Ask Questions The Smart Way <http://catb.org/~esr/faqs/smart-questions.html> How To Ask Questions The Smart Way and/or How to Report Bugs Effectively <https://www.chiark.greenend.org.uk/~sgtatham/bugs.html> How to Report Bugs Effectively Regards, Jose On Wednesday, March 4, 2020, 4:22:26 AM GMT-5, simona vittori <svittori(a)gmail.com <mailto:[email protected]> > wrote: Hello, I have an encrypted connection through stunnel between client and db server, but in connection I have the following errors: "IO Error: Broken pipe (Write failed) at oracle.jdbc.driver.T4CPreparedStatement.executeForDescribe(T4CPreparedStatement.java:874)" Could you help me, please? Thank you in advance Simona _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org <mailto:[email protected]> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 188, Issue 1
by Brent Kimberley 05 Mar '20

05 Mar '20

You might need to review the documentation for your thin driver. https://www.oracle.com/database/technologies/appdev/jdbc-ucp-19c-downloads.… On Wednesday, March 4, 2020, 6:00:07 a.m. EST, stunnel-users-request(a)stunnel.org <stunnel-users-request(a)stunnel.org> wrote: Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. (no subject) (simona vittori) ---------------------------------------------------------------------- Message: 1 Date: Wed, 4 Mar 2020 10:21:56 +0100 From: simona vittori <svittori(a)gmail.com> To: stunnel-users(a)stunnel.org Subject: [stunnel-users] (no subject) Message-ID: <CAMt_Qybr5aASRw-NokkhiQhe0dALW8kPEV+zCjU_dB7tz=FcYA(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" Hello, I have an encrypted connection through stunnel between client and db server, but in connection I have the following errors: "IO Error: Broken pipe (Write failed) at oracle.jdbc.driver.T4CPreparedStatement.executeForDescribe(T4CPreparedStatement.java:874)" Could you help me, please? Thank you in advance Simona

1 0

(no subject)
by simona vittori 04 Mar '20

04 Mar '20

Hello, I have an encrypted connection through stunnel between client and db server, but in connection I have the following errors: "IO Error: Broken pipe (Write failed) at oracle.jdbc.driver.T4CPreparedStatement.executeForDescribe(T4CPreparedStatement.java:874)" Could you help me, please? Thank you in advance Simona

3 2

Windows Server 2003 issues with stunnel, TLS 1.2 on website(s)
by Sean Kelley 27 Feb '20

27 Feb '20

*Issue:* Old Windows Server cannot be upgraded, but needs TLS 1.2 encryption. Stunnel looks like a solution, but I'm having issues configuring it to work (It is "running" successfully with a pem file and port 442). In IIS Manager btw, the website SSL Port is set to 443. I've tried searching (i.e. google "site: https://www.stunnel.org/pipermail/stunnel-users/ server 2003") and have found a few leads, but nothing that addresses my issues in a way I understand. My ignorance I'm sure. *Server details:* * Windows Server 2003, Standard Edition, Service Pack 2 * IIS web server running 3 websites (ASP, PHP mix) * Valid Certificates from Lets Encrypt in Certificate Store * stunnel 5.49 (latest version I could find that works on 32bit OS's) sorry it's not the latest :( *Working Log with Port 442:* 2020.02.24 15:24:37 LOG7[main]: Running on Windows 5.2 2020.02.24 15:24:37 LOG7[main]: No limit detected for the number of clients 2020.02.24 15:24:37 LOG5[main]: stunnel 5.49 on x86-pc-msvc-1500 platform 2020.02.24 15:24:37 LOG5[main]: Compiled/running with OpenSSL 1.0.2p-fips 14 Aug 2018 2020.02.24 15:24:37 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2020.02.24 15:24:37 LOG7[main]: errno: (*_errno()) 2020.02.24 15:24:37 LOG7[ui]: GUI message loop initialized 2020.02.24 15:24:37 LOG7[main]: Running on Windows 5.2 2020.02.24 15:24:37 LOG5[main]: Reading configuration from file stunnel.conf 2020.02.24 15:24:37 LOG5[main]: UTF-8 byte order mark detected 2020.02.24 15:24:37 LOG5[main]: FIPS mode disabled 2020.02.24 15:24:37 LOG7[main]: Compression disabled 2020.02.24 15:24:37 LOG7[main]: No PRNG seeding was required 2020.02.24 15:24:37 LOG6[main]: Initializing service [https] 2020.02.24 15:24:37 LOG7[main]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2020.02.24 15:24:37 LOG7[main]: TLS options: 0x03004004 (+0x00004000, -0x00000000) 2020.02.24 15:24:37 LOG6[main]: Loading certificate from file: C:\Program Files\stunnel\config\mywebsite.pem 2020.02.24 15:24:37 LOG6[main]: Certificate loaded from file: C:\Program Files\stunnel\config\mywebsite.pem 2020.02.24 15:24:37 LOG6[main]: Loading private key from file: C:\Program Files\stunnel\config\mywebsite.pem 2020.02.24 15:24:37 LOG6[main]: Private key loaded from file: C:\Program Files\stunnel\config\mywebsite.pem 2020.02.24 15:24:37 LOG7[main]: Private key check succeeded 2020.02.24 15:24:37 LOG7[main]: ECDH initialization 2020.02.24 15:24:37 LOG7[main]: ECDH initialized with curve prime256v1 2020.02.24 15:24:37 LOG6[main]: Initializing service [domain] 2020.02.24 15:24:37 LOG7[main]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2020.02.24 15:24:37 LOG7[main]: TLS options: 0x03014004 (+0x00014000, -0x00000000) 2020.02.24 15:24:37 LOG6[main]: Loading certificate from file: C:\Program Files\stunnel\config\mywebsite.pem 2020.02.24 15:24:37 LOG6[main]: Certificate loaded from file: C:\Program Files\stunnel\config\mywebsite.pem 2020.02.24 15:24:37 LOG6[main]: Loading private key from file: C:\Program Files\stunnel\config\mywebsite.pem 2020.02.24 15:24:37 LOG6[main]: Private key loaded from file: C:\Program Files\stunnel\config\mywebsite.pem 2020.02.24 15:24:37 LOG7[main]: Private key check succeeded 2020.02.24 15:24:37 LOG7[main]: ECDH initialization 2020.02.24 15:24:37 LOG7[main]: ECDH initialized with curve prime256v1 2020.02.24 15:24:37 LOG5[main]: Configuration successful 2020.02.24 15:24:37 LOG7[main]: Binding service [https] 2020.02.24 15:24:37 LOG7[main]: Listening file descriptor created (FD=292) 2020.02.24 15:24:38 LOG7[main]: Setting accept socket options (FD=292) 2020.02.24 15:24:38 LOG6[main]: Service [https] (FD=292) bound to 10.0.1.11:442 2020.02.24 15:24:38 LOG7[main]: Skipped SNI slave service [domain] 2020.02.24 15:24:38 LOG7[cron]: Cron thread initialized 2020.02.24 15:25:38 LOG6[cron]: Executing cron jobs 2020.02.24 15:25:38 LOG6[cron]: Cron jobs completed in 0 seconds 2020.02.24 15:25:38 LOG7[cron]: Waiting 86400 seconds *Log Error with port 443:* Binding service [https] to 10.0.1.11:443: Permission denied (WSAEACCES) (10013)* * *Conf:* ; Debugging stuff (may be useful for troubleshooting) debug = 7 ;output = stunnel.log ; TLS front-end to a web server [https] ; doesn't work with 443 below, works with 442 accept = 10.0.1.11:442 connect = 80 cert = C:\Program Files\stunnel\config\mywebsite.pem ; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SChannel ; Microsoft implementations do not use TLS close-notify alert and thus they ; are vulnerable to truncation attacks TIMEOUTclose = 0 [domain] sni = https:mywebsite.com sni = https:www.mywebsite.com cert = C:\Program Files\stunnel\config\mywebsite.pem ; connect = 80 connect = localhost:80 client = no sslVersion = TLSv1.2 -------------- Thanks, Sean

3 3

TLS connection not successful
by maktoob bareed 25 Feb '20

25 Feb '20

Hi I am trying to make TLS connection with a server that supports TLSv1.2. but each time I receive the following error: SSL_connect: ssl/record/ssl3_record.c:331: error:1408F10B:SSL routines:ssl3_get_record:wrong version number Here is my service configuration: sslVersion = TLSv1.2 options = NO_SSLv2 options = -NO_SSLv3 accept = 5512 connect = XXXXXXXXX client = yes

1 0

How to use SNI
by Paul Coshott 17 Feb '20

17 Feb '20

Hi Everyone, I have a single domain on my internet server, but it has 3 sub-domains. A separate web app runs off each one, but I need all 3 to be secured with https. I have the ssl certificates I need, but I don't know how to format the SNI section for all 3 sub-domains. The 3 domains and ports I need are : app1.pcapps.one:449 -> 127.0.0.1:8080 app2.pcapps.one:450 -> 127.0.0.1:81 app3.pcapps.one:451 -> 127.0.0.1:82 each domain has a certificate such as : cert = C:\httpscert\app1.pcapps.one.pfx Can anyone tell me how to write out the SNI section to get this working? Thanks, Paul

2 1

HTTP 404 if I don't add 127.0.0.1 in my /etc/hosts
by Masih Tavassoli 16 Feb '20

16 Feb '20

Hi Experts: I am trying to do http->https proxy for one site only: [example-proxy] client = yes accept = 127.0.0.1:5000 sni =integration-instance-idqxdofnz0ca-ia.integration.ocp.oraclecloud.com checkHost = integration-instance-idqxdofnz0ca-ia.integration.ocp.oraclecloud.com verifyPeer = yes verifyChain = yes connect = 147.154.19.235:443 CAfile = C:\Program Files (x86)\stunnel\config\ca-certs.pem If I add the following in /etc/hosts all works ok 127.0.0.1 integration-instance-idqxdofnz0ca-ia.integration.ocp.oraclecloud.com And then I have to use http://integration-instance-idqxdofnz0ca-ia.integration.ocp.oraclecloud.com… However, I just want this address to work: http://10.0.0.33:5000/ic/ws/integration/v1/flows/soap/SM_INT10_CREAT_EBS_GT… : isn’t the whole point of setting SNI to send servername on your behalf: 2020.02.15 00:46:59 LOG6[46]: SNI: sending servername: integration-instance-idqxdofnz0ca-ia.integration.ocp.oraclecloud.com 2020.02.15 00:46:59 LOG6[46]: Peer certificate required 2020.02.15 00:46:59 LOG7[46]: TLS state (connect): before SSL initialization 2020.02.15 00:46:59 LOG7[46]: TLS state (connect): SSLv3/TLS write client hello 2020.02.15 00:46:59 LOG7[46]: TLS state (connect): SSLv3/TLS write client hello 2020.02.15 00:46:59 LOG7[46]: TLS state (connect): SSLv3/TLS read server hello 2020.02.15 00:46:59 LOG7[46]: TLS state (connect): SSLv3/TLS read change cipher spec 2020.02.15 00:46:59 LOG7[46]: TLS state (connect): SSLv3/TLS read finished 2020.02.15 00:46:59 LOG7[46]: TLS state (connect): SSLv3/TLS write change cipher spec 2020.02.15 00:46:59 LOG7[46]: TLS state (connect): SSLv3/TLS write finished 2020.02.15 00:46:59 LOG7[46]: 3 client connect(s) requested 2020.02.15 00:46:59 LOG7[46]: 3 client connect(s) succeeded 2020.02.15 00:46:59 LOG7[46]: 0 client renegotiation(s) requested 2020.02.15 00:46:59 LOG7[46]: 2 session reuse(s) 2020.02.15 00:46:59 LOG6[46]: TLS connected: previous session reused 2020.02.15 00:46:59 LOG6[46]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2020.02.15 00:46:59 LOG7[46]: Compression: null, expansion: null 2020.02.15 00:46:59 LOG6[46]: Session id: E003BBF100FA809D616B2F69E08BAF0119EA856FCEE6AD209BE95F7C5815380B 2020.02.15 00:48:05 LOG7[46]: TLS alert (read): warning: close notify 2020.02.15 00:48:05 LOG6[46]: TLS closed (SSL_read) What am I missing? Thanks Masi

1 0

How to pass URL parameters in connect to
by Shashank Shekhar 14 Feb '20

14 Feb '20

Hi, I am evaluating stunnel for a project. I want to translate a HTTP call to HTTPS. When I specify the URL to send to in the config file, I get error ""Unknown TCP service "443/api/path""". My config is as below: [https] client = yes accept = 4433 connect = myurl.com:443/api/path When I try the same thing without the sub-paths "/api/path" the connection works, but of course it doesn't hit the URL I want to hit. How do I achieve this? I tried going through the documentation, but couldn't figure it out. Any help will be greatly appreciated. Thank you, Shashank

2 1

Start stunnel services on Solaris
by Erick Alejandro Tovar Rebollo 10 Feb '20

10 Feb '20

Hi. I'm new on stunnel, and I don't know how I can start stunnel on Solaris 11 , with the stunnel version 5.56, I really need help. Thanks. Regards.

1 1

Error Stunnel 5.56 Solaris
by Erick Alejandro Tovar Rebollo 06 Feb '20

06 Feb '20

Hi. I'm trying to install stunnel on a Solaris 11, but when I put the *make install* command, send me the next message. gjgom@t51ldm02:~/tmp/stunnel-5.56$ make install Making install in src /usr/bin/gmkdir -p '/usr/local/bin' /bin/sh ../libtool --mode=install /usr/bin/ginstall -c stunnel '/usr/local/bin' libtool: install: /usr/bin/ginstall -c stunnel /usr/local/bin/stunnel /usr/bin/ginstall: cannot create regular file '/usr/local/bin/stunnel': Permission denied *** Error code 1 The following command caused the error: list='stunnel'; test -n "/usr/local/bin" || list=; \ if test -n "$list"; then \ echo " /usr/bin/gmkdir -p '/usr/local/bin'"; \ /usr/bin/gmkdir -p "/usr/local/bin" || exit 1; \ fi; \ for p in $list; do echo "$p $p"; done | \ sed 's/$//' | \ while read p p1; do if test -f $p \ || test -f $p1 \ ; then echo "$p"; echo "$p"; else :; fi; \ done | \ sed -e 'p;s,.*/,,;n;h' \ -e 's|.*|.|' \ -e 'p;x;s,.*/,,;s/$//;s,x,x,;s/$//' | \ sed 'N;N;N;s,\n, ,g' | \ gawk 'BEGIN { files["."] = ""; dirs["."] = 1 } \ { d=$3; if (dirs[d] != 1) { print "d", d; dirs[d] = 1 } \ if ($2 == $4) files[d] = files[d] " " $1; \ else { print "f", $3 "/" $4, $1; } } \ END { for (d in files) print "f", d, files[d] }' | \ while read type dir files; do \ if test "$dir" = .; then dir=; else dir=/$dir; fi; \ test -z "$files" || { \ echo " /bin/sh ../libtool --mode=install /usr/bin/ginstall -c $files '/usr/local/bin$dir'"; \ /bin/sh ../libtool --mode=install /usr/bin/ginstall -c $files "/usr/local/bin$dir" || exit $?; \ } \ ; done make: Fatal error: Command failed for target `install-binPROGRAMS' Current working directory /export/home/gjgom/tmp/stunnel-5.56/src *** Error code 1 The following command caused the error: make install-exec-am install-data-am make: Fatal error: Command failed for target `install-am' Current working directory /export/home/gjgom/tmp/stunnel-5.56/src *** Error code 1 The following command caused the error: fail=; \ if (target_option=k; case ${target_option-} in ?) ;; *) echo "am__make_running_with_option: internal error: invalid" "target option '${target_option-}' specified" >&2; exit 1;; esac; has_opt=no; sane_makeflags=$MAKEFLAGS; if { if test -z ''; then false; elif test -n ''; then true; elif test -n '' && test -n ''; then true; else false; fi; }; then sane_makeflags=$MFLAGS; else case $MAKEFLAGS in *\\[\ \ ]*) bs=\\; sane_makeflags=`printf '%s\n' "$MAKEFLAGS" | sed "s/$bs$bs[$bs $bs ]*//g"`;; esac; fi; skip_next=no; strip_trailopt () { flg=`printf '%s\n' "$flg" | sed "s/$1.*$//"`; }; for flg in $sane_makeflags; do test $skip_next = yes && { skip_next=no; continue; }; case $flg in *=*|--*) continue;; -*I) strip_trailopt 'I'; skip_next=yes;; -*I?*) strip_trailopt 'I';; -*O) strip_trailopt 'O'; skip_next=yes;; -*O?*) strip_trailopt 'O';; -*l) strip_trailopt 'l'; skip_next=yes;; -*l?*) strip_trailopt 'l';; -[dEDm]) skip_next=yes;; -[JT]) skip_next=yes;; esac; case $flg in *$target_option*) has_opt=yes; break;; esac; done; test $has_opt = yes); then \ failcom='fail=yes'; \ else \ failcom='exit 1'; \ fi; \ dot_seen=no; \ target=`echo install-recursive | sed s/-recursive//`; \ case "install-recursive" in \ distclean-* | maintainer-clean-*) list='src doc tools tests' ;; \ *) list='src doc tools tests' ;; \ esac; \ for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (CDPATH="${ZSH_VERSION+.}:" && cd $subdir && make $local_target) \ || eval $failcom; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `install-recursive' gjgom@t51ldm02:~/tmp/stunnel-5.56$ Can you help me? Note: I´m install stunnel with a user no root, It affects? Regards

1 0

VerifyPeer = yes not working.
by Thomas Eifert 04 Feb '20

04 Feb '20

I'm running Stunnel 5.56 under Windows 10 v1909 x64. I have uncovered a case in which VerifyPeer = yes is not working. What's happening is that the locally installed certificate is old and expired, and does not match the current, up-to-date server certificate, yet Stunnel is letting it pass and verifying okay. I've pasted the certificates, config, and log below, and clearly the certificates are different. Regards, Thomas From my config file: debug = 7 delay = yes socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 socket = l:SO_LINGER=1:60 socket = r:SO_LINGER=1:60 [ircs.3] client = yes sslVersionMin = TLSv1.2 cafile = peer-ircs.3.pem verifyPeer = yes accept = 127.0.0.1:8909 connect = halcyon.il.us.dal.net:6697 From the Stunnel log: 2020.02.04 12:41:50 LOG5[9]: Service [ircs.3] connected remote server from 104.231.234.35:62290 2020.02.04 12:41:50 LOG7[9]: Setting remote socket options (FD=1012) 2020.02.04 12:41:50 LOG7[9]: Option SO_LINGER set on remote socket 2020.02.04 12:41:50 LOG7[9]: Option TCP_NODELAY set on remote socket 2020.02.04 12:41:50 LOG7[9]: Remote descriptor (FD=1012) initialized 2020.02.04 12:41:50 LOG6[9]: SNI: sending servername: halcyon.il.us.dal.net 2020.02.04 12:41:50 LOG6[9]: Peer certificate required 2020.02.04 12:41:50 LOG7[9]: TLS state (connect): before SSL initialization 2020.02.04 12:41:50 LOG7[9]: TLS state (connect): SSLv3/TLS write client hello 2020.02.04 12:41:50 LOG7[9]: TLS state (connect): SSLv3/TLS write client hello 2020.02.04 12:41:50 LOG7[9]: TLS state (connect): SSLv3/TLS read server hello 2020.02.04 12:41:50 LOG7[9]: TLS state (connect): TLSv1.3 read encrypted extensions 2020.02.04 12:41:50 LOG7[9]: Verification started at depth=1: C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3 2020.02.04 12:41:50 LOG6[9]: CERT: Pre-verification error ignored: unable to get issuer certificate 2020.02.04 12:41:50 LOG6[9]: Certificate accepted at depth=1: C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3 2020.02.04 12:41:50 LOG7[9]: Verification started at depth=0: CN=*.dal.net 2020.02.04 12:41:50 LOG7[9]: CERT: Pre-verification succeeded 2020.02.04 12:41:50 LOG6[9]: CERT: No subject checks configured 2020.02.04 12:41:50 LOG6[9]: CERT: Locally installed certificate matched 2020.02.04 12:41:50 LOG5[9]: Certificate accepted at depth=0: CN=*.dal.net Here is the locally installed certificate: -----BEGIN CERTIFICATE----- MIIFeDCCBGCgAwIBAgISA4aqIgapILZTQatLgMyS1gJ7MA0GCSqGSIb3DQEBCwUA MEoxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MSMwIQYDVQQD ExpMZXQncyBFbmNyeXB0IEF1dGhvcml0eSBYMzAeFw0xOTA2MDEwNDEzMjlaFw0x OTA4MzAwNDEzMjlaMBQxEjAQBgNVBAMMCSouZGFsLm5ldDCCASIwDQYJKoZIhvcN AQEBBQADggEPADCCAQoCggEBAKk+ZRY6Kr4GUS9hU+AUvgUrRzffLS4ScDNvk88F HXKe6Yx3oJnMJEGC9a5I9nJATcItOa+Xk6NKFIsGQZhFOTkV9xvbaEw2KZ14SIKK NsffEqZeQ/TUdMaHTeDXJxj1gfa+W9FK6uO1TzKrYQamdegXAv55F6KLeIPTjZj3 77AkdWuddimY3rp0gK/R1e2tkFtP/0ZeWuu1M736b6dtjXFIhzw3G8wurbGfBgfO TebZL3Kw0X5qOlyMQyOyXXUyRZMqgW7PMloGtGQ/PJKoTzqNmyWO93QB28PGHDm8 WgnSdwgXlTmVrL9Vwnzb5FIfcM1ba5nzqDGeg7tG5RcQEGkCAwEAAaOCAowwggKI MA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIw DAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUpVm+qZ/cdM/H1vr7emXvf14+/0AwHwYD VR0jBBgwFoAUqEpqYwR93brm0Tm3pkVl7/Oo7KEwbwYIKwYBBQUHAQEEYzBhMC4G CCsGAQUFBzABhiJodHRwOi8vb2NzcC5pbnQteDMubGV0c2VuY3J5cHQub3JnMC8G CCsGAQUFBzAChiNodHRwOi8vY2VydC5pbnQteDMubGV0c2VuY3J5cHQub3JnLzBD BgNVHREEPDA6ggkqLmRhbC5uZXSCDyouaWwudXMuZGFsLm5ldIIOKi5pcHY2LmRh bC5uZXSCDCoudXMuZGFsLm5ldDBMBgNVHSAERTBDMAgGBmeBDAECATA3BgsrBgEE AYLfEwEBATAoMCYGCCsGAQUFBwIBFhpodHRwOi8vY3BzLmxldHNlbmNyeXB0Lm9y ZzCCAQMGCisGAQQB1nkCBAIEgfQEgfEA7wB2AOJpS64m6OlACeiGG7Y7g9Q+5/50 iPukjyiTAZ3d8dv+AAABaxF1ApUAAAQDAEcwRQIgGvt1P3YI9iDIkicmKnWtdA4J vwiZqB6GoGQEBnFLQuECIQDUzbe30Y4kfobQTA0qLZ85jvNFDtRzbRd9wCPXwcqO uwB1ACk8UZZUyDlluqpQ/FgH1Ldvv1h6KXLcpMMM9OVFR/R4AAABaxF1ArgAAAQD AEYwRAIgQ/jYKgNmSMGEmyVgrVBClbEawnND/kPXIZx82My6ovYCIGctTKC5u6bJ J+zCRH5QrSKMF1lOtXDeNMgYlLx7JOKLMA0GCSqGSIb3DQEBCwUAA4IBAQAcxj0r mrqFY5KluKfki7LzlXLnYGDEnaTCX3WC4trR/zDsKwLT2z/ywWjQ5O/zKk/N1+ad 0Pk9DMe0jc/AmvYPgzII7rOYIv7FF/J8z4UKF0uuxjvwvAhXr/JDKvNMkOn3Rtrw agf0eu3xyXwUty6Iip0WfrSYHcy19OrXzwaSLdMdJ5hz9CY6D+7tLk0g2+xI7XnT D+gU1J+g291HfNJet2hzmJn/I7gUJdareqSI9HtXuHw1f+LcQflAhxaTPRGgm65F XpnF9tQvtRMJFWiIO9YSrKjq9gJaW3YlN7CTDzNqtjnA3+I8gT7jCqFHYAH3ZLMu 6fJy+BkrQctqjWWp -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIEkjCCA3qgAwIBAgIQCgFBQgAAAVOFc2oLheynCDANBgkqhkiG9w0BAQsFADA/ MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT DkRTVCBSb290IENBIFgzMB4XDTE2MDMxNzE2NDA0NloXDTIxMDMxNzE2NDA0Nlow SjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxIzAhBgNVBAMT GkxldCdzIEVuY3J5cHQgQXV0aG9yaXR5IFgzMIIBIjANBgkqhkiG9w0BAQEFAAOC AQ8AMIIBCgKCAQEAnNMM8FrlLke3cl03g7NoYzDq1zUmGSXhvb418XCSL7e4S0EF q6meNQhY7LEqxGiHC6PjdeTm86dicbp5gWAf15Gan/PQeGdxyGkOlZHP/uaZ6WA8 SMx+yk13EiSdRxta67nsHjcAHJyse6cF6s5K671B5TaYucv9bTyWaN8jKkKQDIZ0 Z8h/pZq4UmEUEz9l6YKHy9v6Dlb2honzhT+Xhq+w3Brvaw2VFn3EK6BlspkENnWA a6xK8xuQSXgvopZPKiAlKQTGdMDQMc2PMTiVFrqoM7hD8bEfwzB/onkxEz0tNvjj /PIzark5McWvxI0NHWQWM6r6hCm21AvA2H3DkwIDAQABo4IBfTCCAXkwEgYDVR0T AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwfwYIKwYBBQUHAQEEczBxMDIG CCsGAQUFBzABhiZodHRwOi8vaXNyZy50cnVzdGlkLm9jc3AuaWRlbnRydXN0LmNv bTA7BggrBgEFBQcwAoYvaHR0cDovL2FwcHMuaWRlbnRydXN0LmNvbS9yb290cy9k c3Ryb290Y2F4My5wN2MwHwYDVR0jBBgwFoAUxKexpHsscfrb4UuQdf/EFWCFiRAw VAYDVR0gBE0wSzAIBgZngQwBAgEwPwYLKwYBBAGC3xMBAQEwMDAuBggrBgEFBQcC ARYiaHR0cDovL2Nwcy5yb290LXgxLmxldHNlbmNyeXB0Lm9yZzA8BgNVHR8ENTAz MDGgL6AthitodHRwOi8vY3JsLmlkZW50cnVzdC5jb20vRFNUUk9PVENBWDNDUkwu Y3JsMB0GA1UdDgQWBBSoSmpjBH3duubRObemRWXv86jsoTANBgkqhkiG9w0BAQsF AAOCAQEA3TPXEfNjWDjdGBX7CVW+dla5cEilaUcne8IkCJLxWh9KEik3JHRRHGJo uM2VcGfl96S8TihRzZvoroed6ti6WqEBmtzw3Wodatg+VyOeph4EYpr/1wXKtx8/ wApIvJSwtmVi4MFU5aMqrSDE6ea73Mj2tcMyo5jMd6jmeWUHK8so/joWUoHOUgwu X4Po1QYz+3dszkDqMp4fklxBwXRsW10KXzPMTZ+sOPAveyxindmjkW8lGy+QsRlG PfZ+G6Z6h7mjem0Y+iWlkYcV4PIWL1iwBi8saCbGS5jN2p8M+X+Q7UNKEkROb3N6 KOqkqm57TH2H3eDJAkSnh6/DNFu0Qg== -----END CERTIFICATE----- Here is the remote server certificate: -----BEGIN CERTIFICATE----- MIIFeTCCBGGgAwIBAgISBMC6zEv90htsFIzCbGOKGCpvMA0GCSqGSIb3DQEBCwUA MEoxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MSMwIQYDVQQD ExpMZXQncyBFbmNyeXB0IEF1dGhvcml0eSBYMzAeFw0yMDAxMjgwNTIzMjFaFw0y MDA0MjcwNTIzMjFaMBQxEjAQBgNVBAMMCSouZGFsLm5ldDCCASIwDQYJKoZIhvcN AQEBBQADggEPADCCAQoCggEBAKk+ZRY6Kr4GUS9hU+AUvgUrRzffLS4ScDNvk88F HXKe6Yx3oJnMJEGC9a5I9nJATcItOa+Xk6NKFIsGQZhFOTkV9xvbaEw2KZ14SIKK NsffEqZeQ/TUdMaHTeDXJxj1gfa+W9FK6uO1TzKrYQamdegXAv55F6KLeIPTjZj3 77AkdWuddimY3rp0gK/R1e2tkFtP/0ZeWuu1M736b6dtjXFIhzw3G8wurbGfBgfO TebZL3Kw0X5qOlyMQyOyXXUyRZMqgW7PMloGtGQ/PJKoTzqNmyWO93QB28PGHDm8 WgnSdwgXlTmVrL9Vwnzb5FIfcM1ba5nzqDGeg7tG5RcQEGkCAwEAAaOCAo0wggKJ MA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIw DAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUpVm+qZ/cdM/H1vr7emXvf14+/0AwHwYD VR0jBBgwFoAUqEpqYwR93brm0Tm3pkVl7/Oo7KEwbwYIKwYBBQUHAQEEYzBhMC4G CCsGAQUFBzABhiJodHRwOi8vb2NzcC5pbnQteDMubGV0c2VuY3J5cHQub3JnMC8G CCsGAQUFBzAChiNodHRwOi8vY2VydC5pbnQteDMubGV0c2VuY3J5cHQub3JnLzBD BgNVHREEPDA6ggkqLmRhbC5uZXSCDyouaWwudXMuZGFsLm5ldIIOKi5pcHY2LmRh bC5uZXSCDCoudXMuZGFsLm5ldDBMBgNVHSAERTBDMAgGBmeBDAECATA3BgsrBgEE AYLfEwEBATAoMCYGCCsGAQUFBwIBFhpodHRwOi8vY3BzLmxldHNlbmNyeXB0Lm9y ZzCCAQQGCisGAQQB1nkCBAIEgfUEgfIA8AB3ALIeBcyLos2KIE6HZvkruYolIGdr 2vpw57JJUy3vi5BeAAABb+rRlmkAAAQDAEgwRgIhAOG8C3vcxqEvj3TSqe7Y7peQ OInmtrkR0eQ9OFLVUIeUAiEAp0ONBILMiR2i0dVimSXFJv9NJDa3wi3tt3bRF5OO eDMAdQBvU3asMfAxGdiZAKRRFf93FRwR2QLBACkGjbIImjfZEwAAAW/q0ZafAAAE AwBGMEQCIBxS2C2cCPWFKKzof8BduUN6UFiWnyoRqAGAMG36IgylAiBjFDiXnuJs bVorvhguH6J9+YcPC36yFohKBCh+V7M0nzANBgkqhkiG9w0BAQsFAAOCAQEAnDE3 p/uxes7SKdspdwIhsC4Jwn3ulm4sGcbhJVBRWyYxp7ucGJdy/PxcEfb/CD5sszbw 9hsM56B7gno8ts/yNGvpceIoGEa7oK4AycEeWfapp5M9s11HyE06HwDfTA7wc1Kv g+PkHmbqZkLziN+UdPIlRm8dSljusvsNY1cMGRt5fszMJ5+gOaC3gj2AB6+aGIeN cwwNX3BlX10v88I3OUAkDWNlmPERA5BXo88ucZ75SwRZg7H8s66wdMYFi2LvbTHV GsXyDPVKnyViBtGCNI14UEmTDjUiHmqtzjqK2BTpSzNGYXjuPe1Zz0VIZDERPWin YxseV8k6nrZgr51Eag== -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIEkjCCA3qgAwIBAgIQCgFBQgAAAVOFc2oLheynCDANBgkqhkiG9w0BAQsFADA/ MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT DkRTVCBSb290IENBIFgzMB4XDTE2MDMxNzE2NDA0NloXDTIxMDMxNzE2NDA0Nlow SjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxIzAhBgNVBAMT GkxldCdzIEVuY3J5cHQgQXV0aG9yaXR5IFgzMIIBIjANBgkqhkiG9w0BAQEFAAOC AQ8AMIIBCgKCAQEAnNMM8FrlLke3cl03g7NoYzDq1zUmGSXhvb418XCSL7e4S0EF q6meNQhY7LEqxGiHC6PjdeTm86dicbp5gWAf15Gan/PQeGdxyGkOlZHP/uaZ6WA8 SMx+yk13EiSdRxta67nsHjcAHJyse6cF6s5K671B5TaYucv9bTyWaN8jKkKQDIZ0 Z8h/pZq4UmEUEz9l6YKHy9v6Dlb2honzhT+Xhq+w3Brvaw2VFn3EK6BlspkENnWA a6xK8xuQSXgvopZPKiAlKQTGdMDQMc2PMTiVFrqoM7hD8bEfwzB/onkxEz0tNvjj /PIzark5McWvxI0NHWQWM6r6hCm21AvA2H3DkwIDAQABo4IBfTCCAXkwEgYDVR0T AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwfwYIKwYBBQUHAQEEczBxMDIG CCsGAQUFBzABhiZodHRwOi8vaXNyZy50cnVzdGlkLm9jc3AuaWRlbnRydXN0LmNv bTA7BggrBgEFBQcwAoYvaHR0cDovL2FwcHMuaWRlbnRydXN0LmNvbS9yb290cy9k c3Ryb290Y2F4My5wN2MwHwYDVR0jBBgwFoAUxKexpHsscfrb4UuQdf/EFWCFiRAw VAYDVR0gBE0wSzAIBgZngQwBAgEwPwYLKwYBBAGC3xMBAQEwMDAuBggrBgEFBQcC ARYiaHR0cDovL2Nwcy5yb290LXgxLmxldHNlbmNyeXB0Lm9yZzA8BgNVHR8ENTAz MDGgL6AthitodHRwOi8vY3JsLmlkZW50cnVzdC5jb20vRFNUUk9PVENBWDNDUkwu Y3JsMB0GA1UdDgQWBBSoSmpjBH3duubRObemRWXv86jsoTANBgkqhkiG9w0BAQsF AAOCAQEA3TPXEfNjWDjdGBX7CVW+dla5cEilaUcne8IkCJLxWh9KEik3JHRRHGJo uM2VcGfl96S8TihRzZvoroed6ti6WqEBmtzw3Wodatg+VyOeph4EYpr/1wXKtx8/ wApIvJSwtmVi4MFU5aMqrSDE6ea73Mj2tcMyo5jMd6jmeWUHK8so/joWUoHOUgwu X4Po1QYz+3dszkDqMp4fklxBwXRsW10KXzPMTZ+sOPAveyxindmjkW8lGy+QsRlG PfZ+G6Z6h7mjem0Y+iWlkYcV4PIWL1iwBi8saCbGS5jN2p8M+X+Q7UNKEkROb3N6 KOqkqm57TH2H3eDJAkSnh6/DNFu0Qg== -----END CERTIFICATE----- -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

1 0

performance check list
by Howard, William 23 Jan '20

23 Jan '20

Is there a check list for implementation of stunnel on RHEL 7

1 0

stunnel AIX lastest version
by Erick Alejandro Tovar Rebollo 23 Jan '20

23 Jan '20

Hi. I need to download the latest version of stunnel for AIX, but I can´t find that I have the 7.1 AIX version Can you help me? Regards.

1 0

Connection reset: (maybe the wrong forum)
by Per Gunnarsson 15 Jan '20

15 Jan '20

Hello! I have tried to stream to an icecast server through stunnel usung liquidsoap. Somewhere the stream gets stuck. I want to where. Maybe I should have posted this on the Tor mailing list first, since the traffic is forwarded through Tor. But before the stream went to Tor, it went through stunnel. The liquidsoap snippet which tries to stream (password,mount name, stream description and stream name modified: output.external(id="Tor", fallible=true, reopen_delay=3.0, %vorbis(quality=0.4 , samplerate=48000, channels=2), "/usr/bin/oggfwd -n streamname -d 'stream description' localhost 9887 password /mount", mksafe(buffer(full))) I had a script which was supposed to pick up this stream and forward it on a cloud server (passwords etc. modified): #!/bin/bash /usr/bin/curl -V http://localhost:9887/mount | \ /usr/bin/torsocks /usr/bin/oggfwd -n streamname -d 'stream description' superdupersecret.onion 8000 password /mount #/usr/bin/curl -T - -s --socks5 localhost:9050 http://superdupersecret.onion/mount exec "/home/per/bin/test.sh" stunnel.conf on cloud: setuid = stunnel4 setgid = stunnel4 ; PID file is created inside the chroot jail (if enabled) pid = /var/run/stunnel4/stunnel.pid ; Debugging stuff (may be useful for troubleshooting) ;foreground = yes debug = info output = /var/log/stunnel4/stunnel.log [liquidsoap-client] client = yes accept = localhost:8081 connect = mustafejen.se:9998 PSKsecrets = /etc/stunnel/secrets.txt [hequidtor-client] connect = localhost:9050 accept = 95.216.184.255:9888 PSKsecrets = /etc/stunnel/secrets.txt [Deep Web Radio In] client = yes accept = 95.216.184.255:9887 connect = localhost:9050 PSKsecrets = /etc/stunnel/secrets.txt stunnel.conf in my living room: setuid = stunnel4 setgid = stunnel4 ; PID file is created inside the chroot jail (if enabled) pid = /var/run/stunnel4/stunnel.pid ; Debugging stuff (may be useful for troubleshooting) ;foreground = yes debug = info output = /var/log/stunnel4/stunnel.log [liquidsoap-server] ;client = yes connect = mustafejen.se:8081 accept = mustafejen.se:9998 PSKsecrets = /etc/stunnel/secrets.txt [hequidtor-server] client = yes accept = localhost:9888 connect = 95.216.184.255:9888 PSKsecrets = /etc/stunnel/secrets.txt [Deep Web Radio Out] accept = localhost:9887 connect = 95.216.184.255:9887 PSKsecrets = /etc/stunnel/secrets.txt Log file from cloud: 2020.01.15 06:25:01 LOG5[main]: Log file reopened 2020.01.15 10:29:22 LOG5[main]: Terminated 2020.01.15 10:29:22 LOG5[ui]: stunnel 5.44 on x86_64-pc-linux-gnu platform 2020.01.15 10:29:22 LOG5[ui]: Compiled with OpenSSL 1.1.0g 2 Nov 2017 2020.01.15 10:29:22 LOG5[ui]: Running with OpenSSL 1.1.1 11 Sep 2018 2020.01.15 10:29:22 LOG5[ui]: Update OpenSSL shared libraries or rebuild stunnel 2020.01.15 10:29:22 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP 2020.01.15 10:29:22 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf 2020.01.15 10:29:22 LOG5[ui]: UTF-8 byte order mark detected 2020.01.15 10:29:22 LOG5[ui]: FIPS mode disabled 2020.01.15 10:29:22 LOG6[ui]: Initializing service [liquidsoap-client] 2020.01.15 10:29:23 LOG6[ui]: PSK identities: 1 retrieved 2020.01.15 10:29:23 LOG6[ui]: Initializing service [hequidtor-client] 2020.01.15 10:29:23 LOG6[ui]: PSK identities: 1 retrieved 2020.01.15 10:29:23 LOG6[ui]: Using dynamic DH parameters 2020.01.15 10:29:23 LOG6[ui]: Initializing service [Deep Web Radio In] 2020.01.15 10:29:23 LOG6[ui]: PSK identities: 1 retrieved 2020.01.15 10:29:23 LOG5[ui]: Configuration successful Log file from my living room: 2020.01.15 10:20:13 LOG5[ui]: stunnel 5.56 on x86_64-pc-linux-gnu platform 2020.01.15 10:20:13 LOG5[ui]: Compiled/running with OpenSSL 1.1.1d 10 Sep 2019 2020.01.15 10:20:13 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP 2020.01.15 10:20:13 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf 2020.01.15 10:20:13 LOG5[ui]: UTF-8 byte order mark detected 2020.01.15 10:20:13 LOG5[ui]: FIPS mode disabled 2020.01.15 10:20:13 LOG6[ui]: PSKsecrets line 1: 40-byte ASCII key configured for identity "per" 2020.01.15 10:20:13 LOG6[ui]: Initializing service [liquidsoap-server] 2020.01.15 10:20:13 LOG6[ui]: PSK identities: 1 retrieved 2020.01.15 10:20:13 LOG6[ui]: DH initialization not needed 2020.01.15 10:20:13 LOG6[ui]: PSKsecrets line 1: 40-byte ASCII key configured for identity "per" 2020.01.15 10:20:13 LOG6[ui]: Initializing service [hequidtor-server] 2020.01.15 10:20:13 LOG6[ui]: PSK identities: 1 retrieved 2020.01.15 10:20:13 LOG6[ui]: PSKsecrets line 1: 40-byte ASCII key configured for identity "per" 2020.01.15 10:20:13 LOG6[ui]: Initializing service [Deep Web Radio Out] 2020.01.15 10:20:13 LOG6[ui]: PSK identities: 1 retrieved 2020.01.15 10:20:13 LOG6[ui]: DH initialization not needed 2020.01.15 10:20:13 LOG5[ui]: Configuration successful 2020.01.15 10:20:13 LOG6[ui]: Service [liquidsoap-server] (FD=9) bound to 10.0.0.6:9998 2020.01.15 10:20:13 LOG6[ui]: Service [hequidtor-server] (FD=10) bound to ::1:9888 2020.01.15 10:20:13 LOG6[ui]: Service [hequidtor-server] (FD=11) bound to 127.0.0.1:9888 2020.01.15 10:20:13 LOG6[ui]: Service [Deep Web Radio Out] (FD=12) bound to ::1:9887 2020.01.15 10:20:13 LOG6[ui]: Service [Deep Web Radio Out] (FD=13) bound to 127.0.0.1:9887 2020.01.15 10:20:13 LOG6[cron]: Executing cron jobs 2020.01.15 10:20:13 LOG6[cron]: Cron jobs completed in 0 seconds 2020.01.15 10:32:56 LOG5[0]: Service [Deep Web Radio Out] accepted connection from ::1:44732 2020.01.15 10:32:56 LOG6[0]: Peer certificate not required 2020.01.15 10:32:56 LOG3[0]: SSL_accept: ../ssl/record/ssl3_record.c:331: error:1408F10B:SSL routines:ssl3_get_record:wrong version number 2020.01.15 10:32:56 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:32:56 LOG5[1]: Service [Deep Web Radio Out] accepted connection from ::1:44734 2020.01.15 10:32:56 LOG6[1]: Peer certificate not required 2020.01.15 10:32:56 LOG3[1]: SSL_accept: ../ssl/record/ssl3_record.c:321: error:1408F09C:SSL routines:ssl3_get_record:http request 2020.01.15 10:32:56 LOG5[1]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:32:56 LOG5[2]: Service [Deep Web Radio Out] accepted connection from ::1:44736 2020.01.15 10:32:56 LOG6[2]: Peer certificate not required 2020.01.15 10:32:56 LOG3[2]: SSL_accept: ../ssl/t1_lib.c:2719: error:14201076:SSL routines:tls_choose_sigalg:no suitable signature algorithm 2020.01.15 10:32:56 LOG5[2]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:33:44 LOG5[3]: Service [Deep Web Radio Out] accepted connection from ::1:44760 2020.01.15 10:33:44 LOG6[3]: Peer certificate not required 2020.01.15 10:33:44 LOG3[3]: SSL_accept: ../ssl/record/ssl3_record.c:331: error:1408F10B:SSL routines:ssl3_get_record:wrong version number 2020.01.15 10:33:44 LOG5[3]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:33:44 LOG5[4]: Service [Deep Web Radio Out] accepted connection from ::1:44762 2020.01.15 10:33:44 LOG6[4]: Peer certificate not required 2020.01.15 10:33:44 LOG3[4]: SSL_accept: ../ssl/record/ssl3_record.c:321: error:1408F09C:SSL routines:ssl3_get_record:http request 2020.01.15 10:33:44 LOG5[4]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:33:44 LOG5[5]: Service [Deep Web Radio Out] accepted connection from ::1:44764 2020.01.15 10:33:44 LOG6[5]: Peer certificate not required 2020.01.15 10:33:44 LOG3[5]: SSL_accept: ../ssl/t1_lib.c:2719: error:14201076:SSL routines:tls_choose_sigalg:no suitable signature algorithm 2020.01.15 10:33:44 LOG5[5]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:34:50 LOG5[6]: Service [Deep Web Radio Out] accepted connection from ::1:44788 2020.01.15 10:34:50 LOG6[6]: Peer certificate not required 2020.01.15 10:34:50 LOG3[6]: SSL_accept: ../ssl/record/ssl3_record.c:331: error:1408F10B:SSL routines:ssl3_get_record:wrong version number 2020.01.15 10:34:50 LOG5[6]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:34:50 LOG5[7]: Service [Deep Web Radio Out] accepted connection from ::1:44790 2020.01.15 10:34:50 LOG6[7]: Peer certificate not required 2020.01.15 10:34:50 LOG3[7]: SSL_accept: ../ssl/record/ssl3_record.c:321: error:1408F09C:SSL routines:ssl3_get_record:http request 2020.01.15 10:34:50 LOG5[7]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:34:50 LOG5[8]: Service [Deep Web Radio Out] accepted connection from ::1:44792 2020.01.15 10:34:50 LOG6[8]: Peer certificate not required 2020.01.15 10:34:50 LOG3[8]: SSL_accept: ../ssl/t1_lib.c:2719: error:14201076:SSL routines:tls_choose_sigalg:no suitable signature algorithm 2020.01.15 10:34:50 LOG5[8]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:48:17 LOG5[9]: Service [Deep Web Radio Out] accepted connection from ::1:44854 2020.01.15 10:48:17 LOG6[9]: Peer certificate not required 2020.01.15 10:48:17 LOG3[9]: SSL_accept: ../ssl/record/ssl3_record.c:325: error:1408F09B:SSL routines:ssl3_get_record:https proxy request 2020.01.15 10:48:17 LOG5[9]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:48:17 LOG5[10]: Service [Deep Web Radio Out] accepted connection from ::1:44856 2020.01.15 10:48:17 LOG6[10]: Peer certificate not required 2020.01.15 10:48:17 LOG3[10]: SSL_accept: ../ssl/record/ssl3_record.c:325: error:1408F09B:SSL routines:ssl3_get_record:https proxy request 2020.01.15 10:48:17 LOG5[10]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:48:32 LOG5[11]: Service [Deep Web Radio Out] accepted connection from ::1:44858 2020.01.15 10:48:32 LOG6[11]: Peer certificate not required 2020.01.15 10:48:32 LOG3[11]: SSL_accept: ../ssl/record/ssl3_record.c:325: error:1408F09B:SSL routines:ssl3_get_record:https proxy request 2020.01.15 10:48:32 LOG5[11]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:48:32 LOG5[12]: Service [Deep Web Radio Out] accepted connection from ::1:44860 2020.01.15 10:48:32 LOG6[12]: Peer certificate not required 2020.01.15 10:48:32 LOG3[12]: SSL_accept: ../ssl/record/ssl3_record.c:325: error:1408F09B:SSL routines:ssl3_get_record:https proxy request 2020.01.15 10:48:32 LOG5[12]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:49:01 LOG5[13]: Service [Deep Web Radio Out] accepted connection from ::1:44864 2020.01.15 10:49:01 LOG6[13]: Peer certificate not required 2020.01.15 10:49:01 LOG3[13]: SSL_accept: ../ssl/record/ssl3_record.c:325: error:1408F09B:SSL routines:ssl3_get_record:https proxy request 2020.01.15 10:49:01 LOG5[13]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:49:01 LOG5[14]: Service [Deep Web Radio Out] accepted connection from ::1:44866 2020.01.15 10:49:01 LOG6[14]: Peer certificate not required 2020.01.15 10:49:01 LOG3[14]: SSL_accept: ../ssl/record/ssl3_record.c:325: error:1408F09B:SSL routines:ssl3_get_record:https proxy request 2020.01.15 10:49:01 LOG5[14]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:57:28 LOG5[15]: Service [Deep Web Radio Out] accepted connection from ::1:44914 2020.01.15 10:57:28 LOG6[15]: Peer certificate not required 2020.01.15 10:57:28 LOG3[15]: SSL_accept: ../ssl/record/ssl3_record.c:331: error:1408F10B:SSL routines:ssl3_get_record:wrong version number 2020.01.15 10:57:28 LOG5[15]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:57:28 LOG5[16]: Service [Deep Web Radio Out] accepted connection from ::1:44916 2020.01.15 10:57:28 LOG6[16]: Peer certificate not required 2020.01.15 10:57:28 LOG3[16]: SSL_accept: ../ssl/record/ssl3_record.c:321: error:1408F09C:SSL routines:ssl3_get_record:http request 2020.01.15 10:57:28 LOG5[16]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 10:57:28 LOG5[17]: Service [Deep Web Radio Out] accepted connection from ::1:44918 2020.01.15 10:57:28 LOG6[17]: Peer certificate not required 2020.01.15 10:57:28 LOG3[17]: SSL_accept: ../ssl/t1_lib.c:2719: error:14201076:SSL routines:tls_choose_sigalg:no suitable signature algorithm 2020.01.15 10:57:28 LOG5[17]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:24:24 LOG5[18]: Service [Deep Web Radio Out] accepted connection from ::1:45012 2020.01.15 11:24:24 LOG6[18]: Peer certificate not required 2020.01.15 11:24:24 LOG3[18]: SSL_accept: ../ssl/record/ssl3_record.c:331: error:1408F10B:SSL routines:ssl3_get_record:wrong version number 2020.01.15 11:24:24 LOG5[18]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:24:24 LOG5[19]: Service [Deep Web Radio Out] accepted connection from ::1:45014 2020.01.15 11:24:24 LOG6[19]: Peer certificate not required 2020.01.15 11:24:24 LOG3[19]: SSL_accept: ../ssl/record/ssl3_record.c:321: error:1408F09C:SSL routines:ssl3_get_record:http request 2020.01.15 11:24:24 LOG5[19]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:24:24 LOG5[20]: Service [Deep Web Radio Out] accepted connection from ::1:45016 2020.01.15 11:24:24 LOG6[20]: Peer certificate not required 2020.01.15 11:24:24 LOG3[20]: SSL_accept: ../ssl/t1_lib.c:2719: error:14201076:SSL routines:tls_choose_sigalg:no suitable signature algorithm 2020.01.15 11:24:24 LOG5[20]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:25:16 LOG5[21]: Service [Deep Web Radio Out] accepted connection from ::1:45038 2020.01.15 11:25:16 LOG6[21]: Peer certificate not required 2020.01.15 11:25:16 LOG3[21]: SSL_accept: ../ssl/record/ssl3_record.c:331: error:1408F10B:SSL routines:ssl3_get_record:wrong version number 2020.01.15 11:25:16 LOG5[21]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:25:16 LOG5[22]: Service [Deep Web Radio Out] accepted connection from ::1:45040 2020.01.15 11:25:16 LOG6[22]: Peer certificate not required 2020.01.15 11:25:16 LOG3[22]: SSL_accept: ../ssl/record/ssl3_record.c:321: error:1408F09C:SSL routines:ssl3_get_record:http request 2020.01.15 11:25:16 LOG5[22]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:25:16 LOG5[23]: Service [Deep Web Radio Out] accepted connection from ::1:45042 2020.01.15 11:25:16 LOG6[23]: Peer certificate not required 2020.01.15 11:25:16 LOG3[23]: SSL_accept: ../ssl/t1_lib.c:2719: error:14201076:SSL routines:tls_choose_sigalg:no suitable signature algorithm 2020.01.15 11:25:16 LOG5[23]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:28:38 LOG5[24]: Service [Deep Web Radio Out] accepted connection from ::1:45070 2020.01.15 11:28:38 LOG6[24]: Peer certificate not required 2020.01.15 11:28:38 LOG3[24]: SSL_accept: ../ssl/record/ssl3_record.c:331: error:1408F10B:SSL routines:ssl3_get_record:wrong version number 2020.01.15 11:28:38 LOG5[24]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:28:38 LOG5[25]: Service [Deep Web Radio Out] accepted connection from ::1:45072 2020.01.15 11:28:38 LOG6[25]: Peer certificate not required 2020.01.15 11:28:38 LOG3[25]: SSL_accept: ../ssl/record/ssl3_record.c:321: error:1408F09C:SSL routines:ssl3_get_record:http request 2020.01.15 11:28:38 LOG5[25]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:28:38 LOG5[26]: Service [Deep Web Radio Out] accepted connection from ::1:45074 2020.01.15 11:28:38 LOG6[26]: Peer certificate not required 2020.01.15 11:28:38 LOG3[26]: SSL_accept: ../ssl/t1_lib.c:2719: error:14201076:SSL routines:tls_choose_sigalg:no suitable signature algorithm 2020.01.15 11:28:38 LOG5[26]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:30:06 LOG5[27]: Service [Deep Web Radio Out] accepted connection from ::1:45096 2020.01.15 11:30:06 LOG6[27]: Peer certificate not required 2020.01.15 11:30:06 LOG3[27]: SSL_accept: ../ssl/record/ssl3_record.c:331: error:1408F10B:SSL routines:ssl3_get_record:wrong version number 2020.01.15 11:30:06 LOG5[27]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:30:06 LOG5[28]: Service [Deep Web Radio Out] accepted connection from ::1:45098 2020.01.15 11:30:06 LOG6[28]: Peer certificate not required 2020.01.15 11:30:06 LOG3[28]: SSL_accept: ../ssl/record/ssl3_record.c:321: error:1408F09C:SSL routines:ssl3_get_record:http request 2020.01.15 11:30:06 LOG5[28]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:30:06 LOG5[29]: Service [Deep Web Radio Out] accepted connection from ::1:45100 2020.01.15 11:30:06 LOG6[29]: Peer certificate not required 2020.01.15 11:30:06 LOG3[29]: SSL_accept: ../ssl/t1_lib.c:2719: error:14201076:SSL routines:tls_choose_sigalg:no suitable signature algorithm 2020.01.15 11:30:06 LOG5[29]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:32:34 LOG5[30]: Service [Deep Web Radio Out] accepted connection from ::1:45136 2020.01.15 11:32:34 LOG6[30]: Peer certificate not required 2020.01.15 11:32:34 LOG3[30]: SSL_accept: ../ssl/record/ssl3_record.c:331: error:1408F10B:SSL routines:ssl3_get_record:wrong version number 2020.01.15 11:32:34 LOG5[30]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:32:34 LOG5[31]: Service [Deep Web Radio Out] accepted connection from ::1:45138 2020.01.15 11:32:34 LOG6[31]: Peer certificate not required 2020.01.15 11:32:34 LOG3[31]: SSL_accept: ../ssl/record/ssl3_record.c:321: error:1408F09C:SSL routines:ssl3_get_record:http request 2020.01.15 11:32:34 LOG5[31]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.01.15 11:32:34 LOG5[32]: Service [Deep Web Radio Out] accepted connection from ::1:45140 2020.01.15 11:32:34 LOG6[32]: Peer certificate not required 2020.01.15 11:32:34 LOG3[32]: SSL_accept: ../ssl/t1_lib.c:2719: error:14201076:SSL routines:tls_choose_sigalg:no suitable signature algorithm 2020.01.15 11:32:34 LOG5[32]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket

1 0

stunnel5 to stunnel4 not work
by Tu, Robin 15 Jan '20

15 Jan '20

I'm working on openvpn over stunnel. My configuration can work with windows and linux. both are stunnel4. But it never work out in android. I have ubuntu18.04 and set as stunnel4 server side. I try to get connected with android stunnel: SSLSocks<https://github.com/comp500/SSLSocks/releases/tag/0.0.17-beta>, which should be compiled with stunnel5. It simply not work. I got "NETWORK_EOF_ERROR" time to time. If I remove stunnel tunnel, it will just work. So I think it's stunnel5 to stunnel4 issue. But how to avaoid such issue? Best Regards Robin

1 0

How to start stunnel4 service directly after installation, without reboot
by Tu, Robin 15 Jan '20

15 Jan '20

I'm testing openvpn over stunnel4 and I found a weird issue: I have to restart my Ubuntu 18.04 to be able to start the stunnel service. Don't know why I couldn't start the service dicrectly by : Systemctl start stunnel4 OS: Ubuntu 18.04 #>apt install stunnel4 and generate a conf like this: cert=/etc/stunnel/server.crt key=/etc/stunnel/server.key [openvpn-localhost] accept = 8443 connect = 127.0.0.1:11000 Now start the service: #>systemctl start stunnel4 #>systemctl status stunnel4 stunnel4.service - LSB: Start or stop stunnel 4.x (TLS tunnel for network daemons) Loaded: loaded (/etc/init.d/stunnel4; generated) Active: active (exited) since Wed 2020-01-15 14:40:11 CST; 10min ago Docs: man:systemd-sysv-generator(8) Tasks: 0 (limit: 4915) CGroup: /system.slice/stunnel4.service Jan 15 14:40:11 iZ8vb6j45u355dm236tpibZ systemd[1]: Starting LSB: Start or stop stunnel 4.x (TLS tunnel for network daemons)... Jan 15 14:40:11 iZ8vb6j45u355dm236tpibZ stunnel4[3583]: TLS tunnels disabled, see /etc/default/stunnel4 Jan 15 14:40:11 iZ8vb6j45u355dm236tpibZ systemd[1]: Started LSB: Start or stop stunnel 4.x (TLS tunnel for network daemons). Why it exited? But after reboot, same command will just work. Is it a bug? I want to find a way to start it directly after installation. Please help! Best Regards Robin

1 0

Cannot stop pcs cluster service when stunnel server process start
by d500man 09 Jan '20

09 Jan '20

Dear Support, For captioned, I adopted stunnel server and client socket protection in pcs cluster. I want to stop pacemaker cluster service by command "pcs cluster stop --all" and stop master node in master node servet but the down process is hang up when stunnel server process started, could you help to tell me what's problem and how to fix this problem? Best regards Tony

1 0

stunnel4-5.50 start failed
by Hanhan lee 27 Dec '19

27 Dec '19

I compiled stunnel4-5.50 with openssl 1.1.1d. When I run stunnel, it will print some messages and stop: [ ] Clients allowed=500 [.] stunnel 5.50 on arm-none-linux-gnueabi platform [.] Compiled/running with OpenSSL 1.1.1d 10 Sep 2019 [.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*__errno_location ()) [.] Reading configuration from file /conf/stunnel.conf [.] UTF-8 byte order mark not detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [adviserd] [ ] Ciphers: AES256-SHA256:!RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM [ ] TLS options: 0x02104004 (+0x00004000, -0x00000000) [ ] Loading certificate from file: /conf/certs/server.pem [ ] Certificate loaded from file: /conf/certs/server.pem [ ] Loading private key from file: /conf/certs/privkey.pem [:] Insecure file permissions on /conf/certs/privkey.pem [ ] Private key loaded from file: /conf/certs/privkey.pem [ ] Private key check succeeded [ ] DH initialization needed for DHE-PSK-CHACHA20-POLY1305 [ ] DH initialization [ ] Could not load DH parameters from /conf/certs/server.pem [ ] Using dynamic DH parameters [ ] ECDH initialization [ ] ECDH initialized with curve prime256v1 [.] Configuration successful [ ] Binding service [adviserd] [ ] Listening file descriptor created (FD=8) [ ] Setting accept socket options (FD=8) [ ] Option SO_REUSEADDR set on accept socket [ ] Option TCP_NODELAY set on accept socket [ ] Service [adviserd] (FD=8) bound to :::7582 [!] Cannot open log file: /var/log/stunnel.log [ ] Deallocating section defaults [ ] Unbinding service [adviserd] [ ] Service [adviserd] closed (FD=8) [ ] Service [adviserd] closed [ ] Deallocating section [adviserd] I have no idea what's wrong with this, help! Many thanks

3 2

Re: [stunnel-users] My home ISP blocking ssh protocol
by Eric Eberhard 13 Dec '19

13 Dec '19

Ditto. Eric -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of Mike Sent: Thursday, December 12, 2019 9:08 AM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] My home ISP blocking ssh protocol On 12/11/2019 5:53 PM, Matt Thomas wrote: > Hello:) > >[snip > > All i am trying to do is have a SFTP server that i can access my dang >files from while i am at school, work, friends house, library or >wherever. >[snip] I run a ssh server on my home network. I configure it to use a port other than port 22. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Stunnel-5.55 client close TLS socket before it could read more bytes
by Ming Lu 13 Dec '19

13 Dec '19

Hello, May I please have help on this issue? Thanks in advance! I had a stunnel server and client communicating with TLSv1.2 (both of them are stunnel 5.55 and OpenSSL-1.1.1d) on CentOS 7 based Linux (kernel was updated as 4.19.0). The case is that client sends a HTTP request to server, and then server responds a payload with more than 640KB size. Normally, the server will close the connection by sending an alert firstly. The issue is that sometimes (not 100% reproducible), stunnel client reported: "TLS socket closed (read hangup)". and then closed the TLS socket. So I could find an alert sent from client to server firstly from tcpdump. Consequently, this caused the application reported "unexpected end of input?" as there should be more data to be received. I added a few debug logic and I indeed found that: there were occurrences that if stunnel client did not close the TLS socket, it could read more data from TLS socket in next poll loop: -------------------- 03:59:46 localhost stunnel: LOG6[0]: MingL: POLLRDHUP: 8192 03:59:46 localhost stunnel: LOG6[0]: MingL: ioctlsocket: 0 03:59:46 localhost stunnel: LOG6[0]: MingL: bytes: 0 <== client didn't close the sock in my debug version. 03:59:46 localhost stunnel: LOG6[0]: MingL: after checking 03:59:46 localhost stunnel: LOG6[0]: MingL: s_poll_wait: return 1 03:59:46 localhost stunnel: LOG6[0]: MingL: sock_can_rd: n 03:59:46 localhost stunnel: LOG6[0]: MingL: sock_can_wr: Y 03:59:46 localhost stunnel: LOG6[0]: MingL: ssl_can_rd: n 03:59:46 localhost stunnel: LOG6[0]: MingL: ssl_can_wr: n 03:59:46 localhost stunnel: LOG6[0]: MingL: pending: 1 03:59:46 localhost stunnel: LOG6[0]: MingL: write to sock 18432 03:59:46 localhost stunnel: LOG6[0]: MingL: read_wants_read Y 03:59:46 localhost stunnel: LOG6[0]: MingL: write_wants_writen 03:59:46 localhost stunnel: LOG6[0]: MingL: read from TLS 10168 <== then I observed the further read from TLS. -------------------- Any help will be appreciated! Ming

1 0

Re: [stunnel-users] My home ISP blocking ssh protocol
by Christopher Schultz 12 Dec '19

12 Dec '19

Matt, On 12/12/19 13:43, Matt Thomas wrote: > Not sure if you have read the first post, or maybe i didnt add it, but i > have tried port 22,5022,8022, 25565, 47506 and 443 haha. It wasn't clear if you were changing the port number of the sshd service (on your server) or the port you had open on your firewall/router. I suspect that your ISP is blocking incoming connections to port 22. The port number you use for sshd on the server is not relevant. -chris > On Thu, Dec 12, 2019, 9:44 AM Christopher Schultz > <chris(a)christopherschultz.net <mailto:[email protected]>> wrote: > > Matt, > > On 12/12/19 11:01, Matt Thomas wrote: > > Server is 192.168.0.10 > > Router is 192.168.0.1 > > > > It works fine internally:) > > > > I add a port forward in the router for port 22 pointed at .0.10. > Routers > > firewall all ready is configured to accept ssh on port 22 from any > any. > > > > When ever anyone attempts to connect to the server, a pop up shows > on my > > screen. When i try to have my friends or co-workers try from there > house > > or i try from public place, no pop up or hits on the server log. Just > > times out. > > > > But if i put minecraft on port 22, it works. So certain traffic is > > making it through. Even hamachi vpn works fine BUT i cant install that > > on public PC's haha > > I was about to say "this is clearly an issue with the port number, pick > something other than 22" but if you say you can run Minecraft over port > 22, then that's ... strange. > > I wasn't aware that Minecraft servers could have their ports changed > like that. You can really set up your Minecraft server to listen on > localhost:22 and it doesn't use UPnP or anything like that to > reconfigure your firewall/router? > > My advice is to try configuring things like this: > > Router: 192.168.0.1 > Forward WAN connections to port e.g. 1022 -> 192.168.0.10:1022 > <http://192.168.0.10:1022> > > Server: 192.68.0.1 > Accept stunnel connections on port 1022 > accept=:1022 > connect=localhost:22 > > If that works, I might even try just changing the port number of your > ssh/sftp service from the "standard" port to something else and trying > again without stunnel in the mix. > > I've never encountered an ISP which does deep packet inspection to block > services. They usually just block ports. > > -chris > > > On Thu, Dec 12, 2019, 7:58 AM Christopher Schultz > > <chris(a)christopherschultz.net > <mailto:[email protected]> > <mailto:[email protected] > <mailto:[email protected]>>> wrote: > > > > Matt, > > > > On 12/11/19 17:53, Matt Thomas wrote: > > > I need to know if Stunnel is going to accomplish what i need > to do. My > > > home ISP blocks protocol HTTP and SSH from coming in so that > > people cant > > > run their own website from home without paying the ISP for a > > "Business" line > > > > > > All i am trying to do is have a SFTP server that i can > access my dang > > > files from while i am at school, work, friends house, library or > > > wherever. I have tried ssh on multiple random ports and made > sure all > > > firewall rules and port forward rules were correct in my home > > router. I > > > know they work because i even went as far as setting up a > minecraft > > > server to just test the port forward rules out and sure > enough, my > > > friend 200 miles away can connect just fine to my home minecraft > > > server.. But he can not connect to the ssh server. No logs > are ever > > > created on the server either because something is stoping > the packet > > > from even hitting my router, that something is my ISP > > > > > > Would stunnel allow me to make ssh traffic look like regular > https > > > traffic, thus allowing me to connect to my server at home so > i can > > do my > > > homework?? > > > > Those other servers probably use TLS or plaintext connections. > stunnel > > uses TLS, but ssh/sftp use a slightly different protocol that may > > possibly be distinguishable by a determined ISP. > > > > I would think that using stunnel to tunnel SFTP/SSH would be > possible, > > though not strictly necessary. I suspect some other problem is > > preventing you from succeeding. > > > > Can you be more specific about exactly what you did for > configuration? > > Port numbers, specific things you did, etc? You don't have to > disclose > > your public IP address, but perhaps give the local IPs of your > router > > and home server, etc? > > > > -chris > > > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)stunnel.org <mailto:[email protected]> > <mailto:[email protected] <mailto:[email protected]>> > > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org <mailto:[email protected]> > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >

2 1

Re: [stunnel-users] My home ISP blocking ssh protocol
by Christopher Schultz 12 Dec '19

12 Dec '19

Matt, On 12/12/19 11:01, Matt Thomas wrote: > Server is 192.168.0.10 > Router is 192.168.0.1 > > It works fine internally:) > > I add a port forward in the router for port 22 pointed at .0.10. Routers > firewall all ready is configured to accept ssh on port 22 from any any. > > When ever anyone attempts to connect to the server, a pop up shows on my > screen. When i try to have my friends or co-workers try from there house > or i try from public place, no pop up or hits on the server log. Just > times out. > > But if i put minecraft on port 22, it works. So certain traffic is > making it through. Even hamachi vpn works fine BUT i cant install that > on public PC's haha I was about to say "this is clearly an issue with the port number, pick something other than 22" but if you say you can run Minecraft over port 22, then that's ... strange. I wasn't aware that Minecraft servers could have their ports changed like that. You can really set up your Minecraft server to listen on localhost:22 and it doesn't use UPnP or anything like that to reconfigure your firewall/router? My advice is to try configuring things like this: Router: 192.168.0.1 Forward WAN connections to port e.g. 1022 -> 192.168.0.10:1022 Server: 192.68.0.1 Accept stunnel connections on port 1022 accept=:1022 connect=localhost:22 If that works, I might even try just changing the port number of your ssh/sftp service from the "standard" port to something else and trying again without stunnel in the mix. I've never encountered an ISP which does deep packet inspection to block services. They usually just block ports. -chris > On Thu, Dec 12, 2019, 7:58 AM Christopher Schultz > <chris(a)christopherschultz.net <mailto:[email protected]>> wrote: > > Matt, > > On 12/11/19 17:53, Matt Thomas wrote: > > I need to know if Stunnel is going to accomplish what i need to do. My > > home ISP blocks protocol HTTP and SSH from coming in so that > people cant > > run their own website from home without paying the ISP for a > "Business" line > > > > All i am trying to do is have a SFTP server that i can access my dang > > files from while i am at school, work, friends house, library or > > wherever. I have tried ssh on multiple random ports and made sure all > > firewall rules and port forward rules were correct in my home > router. I > > know they work because i even went as far as setting up a minecraft > > server to just test the port forward rules out and sure enough, my > > friend 200 miles away can connect just fine to my home minecraft > > server.. But he can not connect to the ssh server. No logs are ever > > created on the server either because something is stoping the packet > > from even hitting my router, that something is my ISP > > > > Would stunnel allow me to make ssh traffic look like regular https > > traffic, thus allowing me to connect to my server at home so i can > do my > > homework?? > > Those other servers probably use TLS or plaintext connections. stunnel > uses TLS, but ssh/sftp use a slightly different protocol that may > possibly be distinguishable by a determined ISP. > > I would think that using stunnel to tunnel SFTP/SSH would be possible, > though not strictly necessary. I suspect some other problem is > preventing you from succeeding. > > Can you be more specific about exactly what you did for configuration? > Port numbers, specific things you did, etc? You don't have to disclose > your public IP address, but perhaps give the local IPs of your router > and home server, etc? > > -chris > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org <mailto:[email protected]> > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >

2 1

My home ISP blocking ssh protocol
by Matt Thomas 12 Dec '19

12 Dec '19

Hello:) I need to know if Stunnel is going to accomplish what i need to do. My home ISP blocks protocol HTTP and SSH from coming in so that people cant run their own website from home without paying the ISP for a "Business" line All i am trying to do is have a SFTP server that i can access my dang files from while i am at school, work, friends house, library or wherever. I have tried ssh on multiple random ports and made sure all firewall rules and port forward rules were correct in my home router. I know they work because i even went as far as setting up a minecraft server to just test the port forward rules out and sure enough, my friend 200 miles away can connect just fine to my home minecraft server.. But he can not connect to the ssh server. No logs are ever created on the server either because something is stoping the packet from even hitting my router, that something is my ISP Would stunnel allow me to make ssh traffic look like regular https traffic, thus allowing me to connect to my server at home so i can do my homework?? thanks -- My history test question: Give the number of automobiles produced in America during the year of your choice. My answer? 1806: none Matt Thomas GrillofMyDreams.blogspot.com http://slcc.biz.tm

3 2

Re: [stunnel-users] My home ISP blocking ssh protocol
by pepak＠seznam.cz 12 Dec '19

12 Dec '19

Hi! > I need to know if Stunnel is going to accomplish what i need to do. My home > ISP blocks protocol HTTP and SSH from coming in so that people cant run > their own website from home without paying the ISP for a "Business" line [...] > Would stunnel allow me to make ssh traffic look like regular https traffic, > thus allowing me to connect to my server at home so i can do my homework?? Well, yes and no: Yes: Your SSH traffic will be wrapped in the standard TLS protocol, which would make it impossible for the ISP to determine what's inside. They wouldn't be able to determine the actual contents of the traffic, although they could make good guesses based on the packet metadata (direction, size, frequency, time between packets, etc.). But they won't be able to scan packet headers and determine that "hey, this is SSH, let's block it!". No: Part of the answer lies above: using statistical methods, it may be possible to distinguish SSH from something else. The other part lies in the fact that the ISP doesn't really have to do it - if they feel like it, they could e.g. block all incoming traffic unless it is a response to a prior outgoing traffic, or block all incoming traffic unless it can be determined that it is one of a selected few permitted protocols. Likely you won't run into the "No" part of the answer, and in that case Stunnel will serve nicely (I use it in this scenario, myself). But you might. In that case, you may want to use something like TCP/IP Gender Changer (which basically creates a tunnel with reverse directions), either alone or in combination with Stunnel. Pepak

1 0

updated patch for Start TLS for LDAP clients (RFC 2830)
by Seth Grover 10 Dec '19

10 Dec '19

Back in 2013 Bart Dopheide submitted a patch to the mailing list to add LDAP StartTLS (elevate connection to TLS after initial connection is initiated) support to the list of supported protocols in protocol.c ( https://www.stunnel.org/pipermail/stunnel-users/2013-November/004437.html) It doesn't look like this patch was ever accepted into stunnel. I've run into a similar requirement and have updated the patch to work against stunnel 5.56. In addition, there are a few other minor changes, the most significant being as follows. It would appear that Windows Active Directory servers do not implement the ldap extended response PDU in the same way as OpenLDAP (see this thread: https://www.openldap.org/lists/openldap-software/200401/msg00800.html) With this patch you can specify either "protocol = winldap" or "protocol = openldap" and have it work either way. I haven't modified the logic of Bart's original patch as far as OpenLDAP goes, but I have split the code path where applicable to handle the Windows case. I am testing this against a virtual Windows Server 2016 Active Directory instance with self-signed certificates with the following config: [stunnel.winldap] client = yes accept = localhost:3268 connect =mymachine.example.com:3268 protocol = winldap And the following ldapsearch command: LDAPTLS_REQCERT=never ldapsearch -Z -h localhost -p 3268 -D "nginx_bind_dn(a)localdomain.lan" -W -b "dc=localdomain,dc=lan" -s sub "objectClass=person" The ldapsearch output returns as expected and I can see in wireshark that the LDAP_START_TLS_OID request/response happens as it should. The patch is at the end of this message. -SG diff -Nurp a/src/protocol.c b/src/protocol.c --- a/src/protocol.c 2019-05-15 13:35:16.000000000 -0600 +++ b/src/protocol.c 2019-12-03 13:54:47.536940900 -0700 @@ -64,6 +64,8 @@ NOEXPORT char *pop3_server(CLI *, SERVIC NOEXPORT char *imap_client(CLI *, SERVICE_OPTIONS *, const PHASE); NOEXPORT char *imap_server(CLI *, SERVICE_OPTIONS *, const PHASE); NOEXPORT char *nntp_client(CLI *, SERVICE_OPTIONS *, const PHASE); +NOEXPORT char *openldap_client(CLI *, SERVICE_OPTIONS *, const PHASE); +NOEXPORT char *winldap_client(CLI *, SERVICE_OPTIONS *, const PHASE); NOEXPORT char *connect_server(CLI *, SERVICE_OPTIONS *, const PHASE); NOEXPORT char *connect_client(CLI *, SERVICE_OPTIONS *, const PHASE); #ifndef OPENSSL_NO_MD4 @@ -113,6 +115,14 @@ char *protocol(CLI *c, SERVICE_OPTIONS * return opt->option.client ? nntp_client(c, opt, phase) : "The 'nntp' protocol is not supported in the server mode"; + if(!strcasecmp(opt->protocol, "openldap")) + return opt->option.client ? + openldap_client(c, opt, phase) : + "The 'openldap' protocol is not supported in the server mode"; + if(!strcasecmp(opt->protocol, "winldap")) + return opt->option.client ? + winldap_client(c, opt, phase) : + "The 'winldap' protocol is not supported in the server mode"; if(!strcasecmp(opt->protocol, "connect")) return opt->option.client ? connect_client(c, opt, phase) : @@ -1119,6 +1129,182 @@ NOEXPORT char *nntp_client(CLI *c, SERVI return NULL; } +/**************************************** LDAP, RFC 2830 */ +uint8_t ldap_startssl_message[0x1d + 2] = +{ + 0x30, /* tag = UNIVERSAL SEQUENCE */ + 0x1d, /* len = 29 (the remaining number of bytes in this message) */ + 0x02, /* messageID */ + 0x01, /* len = 1 */ + 0x01, /* value = 1 (this is messageID 1) */ + /* --- */ + 0x77, /* protocolOp = APPLICATION (23) (=ExtendedRequest) + * 0b01xxxxxx => APPLICATION + * 0bxx1xxxxx => ? + * 0xxxx10111 => 23 + */ + 0x18, /* len = 24 */ + 0x80, /* type = requstName? */ + 0x16, /* len = 22 */ + /* OID: 1.3.6.1.4.1.1466.20037 (=LDAP_START_TLS_OID)*/ + '1', '.', + '3', '.', + '6', '.', + '1', '.', + '4', '.', + '1', '.', + '1', '4', '6', '6', '.', + '2', '0', '0', '3', '7' + /* No requestValue, as per RFC2830 (in 2.1: "The requestValue field is absent") */ +}; + +typedef enum { + LDAP_OPENLDAP, + LDAP_WINLDAP +} LDAP_MODE; + +#define LDAP_UNIVERSAL_SEQUENCE 0x30 +#define LDAP_WINLDAP_FOUR_BYTE_LEN_FLAG 0x84 +#define LDAP_RESPONSE_MSG_ID_TYPE_INT 0x02 +#define LDAP_RESPONSE_EXPECTED_MSG_ID_LEN 0x01 +#define LDAP_RESPONSE_EXPECTED_MSG_ID 0x01 +#define LDAP_RESPONSE_EXT_RESP 0x0a +#define LDAP_RESPONSE_EXT_RESP_APPLICATION 0x78 +#define LDAP_RESPONSE_EXPECTED_ERR_LEN 0x01 +#define LDAP_RESPONSE_SUCCESS 0x00 + +NOEXPORT char *ldap_client(CLI *c, SERVICE_OPTIONS *opt, const PHASE phase, const LDAP_MODE ldap_mode) { + + /* thanks to these threads for help with these PDUs + https://www.stunnel.org/pipermail/stunnel-users/2013-November/004437.html + https://www.openldap.org/lists/openldap-software/200401/msg00800.html */ + + uint8_t buffer_8[1]; + uint32_t buffer_32[1]; + uint32_t resp_len; + uint8_t ldap_response[256]; + uint8_t *resp_ptr; + + (void)opt; /* squash the unused parameter warning */ + + if(phase!=PROTOCOL_MIDDLE) + return NULL; + + /* send "Start TLS" request to AD server */ + s_log(LOG_DEBUG, "Requesting LDAP Start TLS"); + s_write(c, c->remote_fd.fd, ldap_startssl_message, (size_t)ldap_startssl_message[1] + 2); + + /* LDAP_UNIVERSAL_SEQUENCE (1 byte) */ + s_read(c, c->remote_fd.fd, buffer_8, 1); + if(buffer_8[0] != LDAP_UNIVERSAL_SEQUENCE) { + s_log(LOG_ERR, "start tag is not UNIVERSAL SEQUENCE"); + throw_exception(c, 1); + } + + if(ldap_mode == LDAP_OPENLDAP) { + /* OpenLDAP - response length (1 byte) */ + s_log(LOG_DEBUG, "Reading OpenLDAP message size (1 byte)"); + s_read(c, c->remote_fd.fd, buffer_8, 1); + resp_len = buffer_8; + + } else if(ldap_mode == LDAP_WINLDAP) { + + /* WinLDAP - "response length is 4 bytes" flag - LDAP_WINLDAP_FOUR_BYTE_LEN_FLAG (1-byte) */ + s_read(c, c->remote_fd.fd, buffer_8, 1); + if(buffer_8[0] != LDAP_WINLDAP_FOUR_BYTE_LEN_FLAG) { + s_log(LOG_ERR, "LDAP message length flag is an unexpected value"); + throw_exception(c, 1); + } + + /* WinLDAP - response length (4 bytes, network byte order) */ + s_log(LOG_DEBUG, "Reading WinLDAP message size (4 bytes)"); + s_read(c, c->remote_fd.fd, buffer_32, 4); + resp_len = ntohl(buffer_32[0]); + + } else { + s_log(LOG_ERR, "Unsupported LDAP mode"); + throw_exception(c, 1); + } + + /* LDAP response message */ + s_log(LOG_DEBUG, "Reading LDAP message (%u byte(s))", resp_len); + s_read(c, c->remote_fd.fd, ldap_response, resp_len); + + resp_ptr = &ldap_response[0]; + + /* LDAP_RESPONSE_MSG_ID_TYPE_INT - 1 byte */ + if(*resp_ptr != LDAP_RESPONSE_MSG_ID_TYPE_INT) { + s_log(LOG_ERR, "LDAP response has an incorrect message ID type"); + throw_exception(c, 1); + } + resp_ptr++; + + /* LDAP_RESPONSE_EXPECTED_MSG_ID_LEN - 1 byte */ + if(*resp_ptr != LDAP_RESPONSE_EXPECTED_MSG_ID_LEN) { + s_log(LOG_ERR, "LDAP response has an unexpected message ID length"); + throw_exception(c, 1); + } + resp_ptr++; + + /* LDAP_RESPONSE_EXPECTED_MSG_ID - 1 byte */ + if(*resp_ptr != LDAP_RESPONSE_EXPECTED_MSG_ID) { + s_log(LOG_ERR, "LDAP response has an unexpected message ID"); + throw_exception(c, 1); + } + resp_ptr++; + + /* LDAP_RESPONSE_EXT_RESP_APPLICATION - 1 byte */ + if(*resp_ptr != LDAP_RESPONSE_EXT_RESP_APPLICATION) { + s_log(LOG_ERR, "LDAP response protocolOp is not APPLICATION"); + throw_exception(c, 1); + } + resp_ptr++; + + if(ldap_mode == LDAP_WINLDAP) { + /* WinLDAP - "response length is 4 bytes" flag - LDAP_WINLDAP_FOUR_BYTE_LEN_FLAG (1-byte) */ + if(*resp_ptr != LDAP_WINLDAP_FOUR_BYTE_LEN_FLAG) { + s_log(LOG_ERR, "LDAP extendedResp length flag is an unexpected value"); + throw_exception(c, 1); + } + /* WinLDAP - extended response message length (4-bytes) */ + resp_ptr += 5; + + } else { + /* OpenLDAP - extended response message length (1-byte) */ + resp_ptr++; + } + + /* LDAP_RESPONSE_EXT_RESP - 1 byte */ + if(*resp_ptr != LDAP_RESPONSE_EXT_RESP) { + s_log(LOG_ERR, "LDAP response type is not EXT_RESP"); + throw_exception(c, 1); + } + resp_ptr++; + + /* LDAP_RESPONSE_EXT_RESP - 1 byte */ + if(*resp_ptr != LDAP_RESPONSE_EXPECTED_ERR_LEN) { + s_log(LOG_ERR, "LDAP response has an unexpected error code length"); + throw_exception(c, 1); + } + resp_ptr++; + + if(*resp_ptr != LDAP_RESPONSE_SUCCESS) { + s_log(LOG_ERR, "LDAP response has indicated an error (%u)", *resp_ptr); + throw_exception(c, 1); + } + + return NULL; +} + + +NOEXPORT char *openldap_client(CLI *c, SERVICE_OPTIONS *opt, const PHASE phase) { + return ldap_client(c, opt, phase, LDAP_OPENLDAP); +} + +NOEXPORT char *winldap_client(CLI *c, SERVICE_OPTIONS *opt, const PHASE phase) { + return ldap_client(c, opt, phase, LDAP_WINLDAP); +} + /**************************************** connect */ NOEXPORT char *connect_server(CLI *c, SERVICE_OPTIONS *opt, const PHASE phase) {

1 1

Stunnel - supports static OpenSSL engines?
by pepak＠seznam.cz 10 Dec '19

10 Dec '19

Hi! Does Stunnel support static-linked engines for OpenSSL? From my experiments, my guess would be that it doesn't, but I may be overlooking something and would welcome a confirmation. Why I need it: During development of an urelated app, after many many failed attempts, I finally managed to get OpenSSL 1.1.x working with a CAPI engine - but the only functional setup involved CAPI built directly into libcrypto. Every other setup, in both Visual Studio and MinGW, led to some problem or another. I would love to extend this success to my Stunnel setup, where I am now forced to stick with version 5.49 because the newer versions use OpenSSL 1.1.x which simply doesn't seem to be able to function correctly with the dynamic CAPI engine. What I need from Stunnel, basically, is for it to try to use ENGINE_by_id('capi') first and only when that fails, attempt to load a dynamic engine using ENGINE_by_id('dynamic') and the necessary ENGINE_ctrl_cmd_string commands. I can build a functional static-built OpenSSL libraries myself. If Stunnel wanted to incorporate that, I am all for it, provided that there is some way of specifying whether a static engine or a dynamic engine is preferred. My Configure command is: perl Configure shared enable-static-engine enable-zlib --with-zlib-include=C:\Zlib --with-zlib-lib=C:\Zlib\zlib.lib VC-WIN64A Pepak

1 0

Re: [stunnel-users] stunnel 5.55 - - - SSL_connect: Peer suddenly disconnected
by Flo Rance 06 Dec '19

06 Dec '19

The full logs of both sides would still be useful. Regards, Flo On Fri, 6 Dec 2019 at 09:48, simona vittori <svittori(a)gmail.com> wrote: > Hi, > port 41521 is the port of stunnel server istance that then redirect > connection in clear on port 1521 of the listener. > > That's all > > Thanks > > Simona > > Il giorno ven 6 dic 2019 alle ore 09:37 Flo Rance <trourance(a)gmail.com> > ha scritto: > >> Hi, >> >> The full logs of the client would be useful. >> >> What are you trying to connect to (on port 41521) ? >> >> Regards, >> Flo >> >> On Thu, 5 Dec 2019 at 12:44, simona vittori <svittori(a)gmail.com> wrote: >> >>> Hello, >>> >>> I have stunnel v 5.55 on linux machine client e linux machine db server, >>> Red Hat Enterprise Linux Server release 6.6. I have noticed that there are >>> many many diconnections by side client (at the bottom of the page). Why >>> there is this behavior? >>> >>> This is the configuration file of client machine: >>> >>> cert = /opt/stunnel-5.55/etc/stunnel/stunnel.pem >>> verify = 3 >>> setuid = stunnel >>> >>> CAfile = /opt/stunnel-5.55/var/certs.pem >>> >>> pid = /opt/stunnel-5.55/var/lib/stunnel/stunnel_client.pid >>> >>> socket = l:TCP_NODELAY=1 >>> socket = r:TCP_NODELAY=1 >>> >>> sslVersion = TLSv1 >>> >>> TIMEOUTconnect = 30 >>> failover = rr >>> >>> ciphers = ECDH@STRENGTH:DH@STRENGTH:HIGH:!RC4:!MD5:!DES:!aNULL:!eNULL >>> >>> debug = 7 >>> output = /opt/stunnel-5.55/var/stunnel.log >>> >>> client = yes >>> >>> [connessione_a_EMPRMDB1-DB2] >>> accept=127.0.0.1:10001 >>> connect=10.56.213.70:41521 >>> connect=10.56.213.72:41521 >>> >>> >>> ####################################################################################### >>> >>> Dec 5 12:31:42 EMWBPAPP2b stunnel: []:LOG3[15001]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:31:52 EMWBPAPP2b stunnel: []:LOG3[15007]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:32:13 EMWBPAPP2b stunnel: []:LOG3[15013]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:32:13 EMWBPAPP2b stunnel: []:LOG3[15014]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:32:22 EMWBPAPP2b stunnel: []:LOG3[15019]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:32:23 EMWBPAPP2b stunnel: []:LOG3[15021]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:32:23 EMWBPAPP2b stunnel: []:LOG3[15023]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:32:24 EMWBPAPP2b stunnel: []:LOG3[15024]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:32:44 EMWBPAPP2b stunnel: []:LOG3[15033]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:32:45 EMWBPAPP2b stunnel: []:LOG3[15035]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:32:55 EMWBPAPP2b stunnel: []:LOG3[15041]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:34:04 EMWBPAPP2b stunnel: []:LOG3[15062]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:34:05 EMWBPAPP2b stunnel: []:LOG3[15063]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:34:06 EMWBPAPP2b stunnel: []:LOG3[15065]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:34:18 EMWBPAPP2b stunnel: []:LOG3[15069]: SSL_connect: Peer >>> suddenly disconnected >>> >>> #####################################################################à >>> >>> Thank for your help >>> >>> Simona >>> _______________________________________________ >>> stunnel-users mailing list >>> stunnel-users(a)stunnel.org >>> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >>> >>

1 0

stunnel 5.55 - - - SSL_connect: Peer suddenly disconnected
by simona vittori 06 Dec '19

06 Dec '19

Hello, I have stunnel v 5.55 on linux machine client e linux machine db server, Red Hat Enterprise Linux Server release 6.6. I have noticed that there are many many diconnections by side client (at the bottom of the page). Why there is this behavior? This is the configuration file of client machine: cert = /opt/stunnel-5.55/etc/stunnel/stunnel.pem verify = 3 setuid = stunnel CAfile = /opt/stunnel-5.55/var/certs.pem pid = /opt/stunnel-5.55/var/lib/stunnel/stunnel_client.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 sslVersion = TLSv1 TIMEOUTconnect = 30 failover = rr ciphers = ECDH@STRENGTH:DH@STRENGTH:HIGH:!RC4:!MD5:!DES:!aNULL:!eNULL debug = 7 output = /opt/stunnel-5.55/var/stunnel.log client = yes [connessione_a_EMPRMDB1-DB2] accept=127.0.0.1:10001 connect=10.56.213.70:41521 connect=10.56.213.72:41521 ####################################################################################### Dec 5 12:31:42 EMWBPAPP2b stunnel: []:LOG3[15001]: SSL_connect: Peer suddenly disconnected Dec 5 12:31:52 EMWBPAPP2b stunnel: []:LOG3[15007]: SSL_connect: Peer suddenly disconnected Dec 5 12:32:13 EMWBPAPP2b stunnel: []:LOG3[15013]: SSL_connect: Peer suddenly disconnected Dec 5 12:32:13 EMWBPAPP2b stunnel: []:LOG3[15014]: SSL_connect: Peer suddenly disconnected Dec 5 12:32:22 EMWBPAPP2b stunnel: []:LOG3[15019]: SSL_connect: Peer suddenly disconnected Dec 5 12:32:23 EMWBPAPP2b stunnel: []:LOG3[15021]: SSL_connect: Peer suddenly disconnected Dec 5 12:32:23 EMWBPAPP2b stunnel: []:LOG3[15023]: SSL_connect: Peer suddenly disconnected Dec 5 12:32:24 EMWBPAPP2b stunnel: []:LOG3[15024]: SSL_connect: Peer suddenly disconnected Dec 5 12:32:44 EMWBPAPP2b stunnel: []:LOG3[15033]: SSL_connect: Peer suddenly disconnected Dec 5 12:32:45 EMWBPAPP2b stunnel: []:LOG3[15035]: SSL_connect: Peer suddenly disconnected Dec 5 12:32:55 EMWBPAPP2b stunnel: []:LOG3[15041]: SSL_connect: Peer suddenly disconnected Dec 5 12:34:04 EMWBPAPP2b stunnel: []:LOG3[15062]: SSL_connect: Peer suddenly disconnected Dec 5 12:34:05 EMWBPAPP2b stunnel: []:LOG3[15063]: SSL_connect: Peer suddenly disconnected Dec 5 12:34:06 EMWBPAPP2b stunnel: []:LOG3[15065]: SSL_connect: Peer suddenly disconnected Dec 5 12:34:18 EMWBPAPP2b stunnel: []:LOG3[15069]: SSL_connect: Peer suddenly disconnected #####################################################################à Thank for your help Simona

2 1

Re: [stunnel-users] Help please.
by Christopher Schultz 03 Dec '19

03 Dec '19

Ajiq, On 12/3/19 09:13, Ajjq . wrote: > Hi Christopher: > > You are right. I needed > C:> TELNET LOCALHOST 80 and expect to be connected to sub.dominio.com:443 > > I modified stunnel.conf with client=yes. I am including stunnel.con and > log. > > I created the service Stunnel service, but when I start it, I get this > error message. > > [Stunnel server is down due to an error. You need to exit and correct the problem. Click OK to see the error log window.] The screenshot shows an error "bind: Address already in use". Do you have stunnel running twice at once? Please stop stunnel, delete your log file, then start it again. Post the resulting log file to the mailing list. -chris > > > stunnel.conf > > debug = 7 > output = stunnel3.log > > ; TLS front-end to a web server > [https] > client=yes > accept = 127.0.0.1:80 > connect = subd.dominio.com:443 > cert = stunnel.pem > TIMEOUTclose = 0 Is TIMEOPUTclose=0 actually on one line? That might be a syntax error. -chris

2 1

Help please.
by Ajjq . 02 Dec '19

02 Dec '19

Hi I need to enable a tunnel_out for UTL_HTTP from http:// to https:// I installed stunnel 5.34 win32 in a windows 2008 server. I am including my stunnel.conf y log file (debug=7) As you can see in the log file, I get this error: 2019.12.01 14:08:12 LOG3[7]: SSL_accept: 1407609C: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request Could you help me please? MY stunnel.conf--- debug = 7 output = stunnel.log [https] accept = 127.0.0.1:80 connect = sub.dominio.com:443 cert = stunnel.pem TIMEOUTclose = 0 This version has openssl[cid:b6de9085-07c4-43d0-b772-bb9beb37c2ac] MY LOG--- 2019.12.01 14:00:37 LOG7[cron]: Cron thread initialized 2019.12.01 14:00:37 LOG7[main]: No limit detected for the number of clients 2019.12.01 14:00:37 LOG5[main]: stunnel 5.34 on x86-pc-msvc-1500 platform 2019.12.01 14:00:37 LOG5[main]: Compiled/running with OpenSSL 1.0.2h-fips 3 May 2016 2019.12.01 14:00:37 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2019.12.01 14:00:37 LOG7[main]: errno: (*_errno()) 2019.12.01 14:00:37 LOG7[ui]: GUI message loop initialized 2019.12.01 14:00:37 LOG5[main]: Reading configuration from file stunnel.conf 2019.12.01 14:00:37 LOG5[main]: UTF-8 byte order mark detected 2019.12.01 14:00:37 LOG5[main]: FIPS mode disabled 2019.12.01 14:00:37 LOG7[main]: Compression disabled 2019.12.01 14:00:37 LOG7[main]: Snagged 64 random bytes from C:/.rnd 2019.12.01 14:00:37 LOG7[main]: Wrote 1024 new random bytes to C:/.rnd 2019.12.01 14:00:37 LOG7[main]: PRNG seeded successfully 2019.12.01 14:00:37 LOG6[main]: Initializing service [https] 2019.12.01 14:00:38 LOG6[main]: Loading certificate from file: stunnel.pem 2019.12.01 14:00:38 LOG6[main]: Certificate loaded from file: stunnel.pem 2019.12.01 14:00:38 LOG6[main]: Loading private key from file: stunnel.pem 2019.12.01 14:00:38 LOG6[main]: Private key loaded from file: stunnel.pem 2019.12.01 14:00:38 LOG7[main]: Private key check succeeded 2019.12.01 14:00:38 LOG7[main]: DH initialization 2019.12.01 14:00:38 LOG7[main]: Could not load DH parameters from stunnel.pem 2019.12.01 14:00:38 LOG6[main]: Using dynamic DH parameters 2019.12.01 14:00:38 LOG7[main]: ECDH initialization 2019.12.01 14:00:38 LOG7[main]: ECDH initialized with curve prime256v1 2019.12.01 14:00:38 LOG7[main]: SSL options: 0x03004004 (+0x03004000, -0x00000000) 2019.12.01 14:00:38 LOG5[main]: Configuration successful 2019.12.01 14:00:38 LOG7[main]: Listening file descriptor created (FD=352) 2019.12.01 14:00:38 LOG7[main]: Service [https] (FD=352) bound to 127.0.0.1:80 2019.12.01 14:00:59 LOG7[main]: Found 1 ready file descriptor(s) 2019.12.01 14:00:59 LOG7[main]: FD=260 ifds=r-x ofds=r-- 2019.12.01 14:00:59 LOG7[main]: Dispatching signals from the signal pipe 2019.12.01 14:00:59 LOG7[main]: Processing SIGNAL_RELOAD_CONFIG 2019.12.01 14:00:59 LOG5[main]: Reading configuration from file stunnel.conf 2019.12.01 14:00:59 LOG5[main]: UTF-8 byte order mark detected 2019.12.01 14:00:59 LOG5[main]: FIPS mode disabled 2019.12.01 14:00:59 LOG7[main]: Compression disabled 2019.12.01 14:00:59 LOG7[main]: Snagged 64 random bytes from C:/.rnd 2019.12.01 14:00:59 LOG7[main]: Wrote 1024 new random bytes to C:/.rnd 2019.12.01 14:00:59 LOG7[main]: PRNG seeded successfully 2019.12.01 14:00:59 LOG6[main]: Initializing service [https] 2019.12.01 14:00:59 LOG6[main]: Loading certificate from file: stunnel.pem 2019.12.01 14:00:59 LOG6[main]: Certificate loaded from file: stunnel.pem 2019.12.01 14:00:59 LOG6[main]: Loading private key from file: stunnel.pem 2019.12.01 14:00:59 LOG6[main]: Private key loaded from file: stunnel.pem 2019.12.01 14:00:59 LOG7[main]: Private key check succeeded 2019.12.01 14:00:59 LOG7[main]: DH initialization 2019.12.01 14:00:59 LOG7[main]: Could not load DH parameters from stunnel.pem 2019.12.01 14:00:59 LOG6[main]: Using dynamic DH parameters 2019.12.01 14:00:59 LOG7[main]: ECDH initialization 2019.12.01 14:00:59 LOG7[main]: ECDH initialized with curve prime256v1 2019.12.01 14:00:59 LOG7[main]: SSL options: 0x03004004 (+0x03004000, -0x00000000) 2019.12.01 14:00:59 LOG5[main]: Configuration successful 2019.12.01 14:00:59 LOG7[main]: Closing service [https] 2019.12.01 14:00:59 LOG7[main]: Service [https] closed (FD=352) 2019.12.01 14:00:59 LOG7[main]: Service [https] closed 2019.12.01 14:00:59 LOG7[main]: Listening file descriptor created (FD=352) 2019.12.01 14:00:59 LOG7[main]: Service [https] (FD=352) bound to 127.0.0.1:80 2019.12.01 14:00:59 LOG7[main]: Signal pipe is empty 2019.12.01 14:01:37 LOG6[cron]: Executing cron jobs 2019.12.01 14:01:37 LOG5[cron]: Updating DH parameters 2019.12.01 14:01:37 LOG7[main]: Found 1 ready file descriptor(s) 2019.12.01 14:01:37 LOG7[main]: FD=260 ifds=r-x ofds=--- 2019.12.01 14:01:37 LOG7[main]: Service [https] accepted (FD=420) from 127.0.0.1:56581 2019.12.01 14:01:37 LOG7[main]: Creating a new thread 2019.12.01 14:01:37 LOG7[main]: New thread created 2019.12.01 14:01:37 LOG7[0]: Service [https] started 2019.12.01 14:01:37 LOG5[0]: Service [https] accepted connection from 127.0.0.1:56581 2019.12.01 14:01:37 LOG7[0]: SSL state (accept): before/accept initialization 2019.12.01 14:01:37 LOG7[main]: Found 1 ready file descriptor(s) 2019.12.01 14:01:37 LOG7[main]: FD=260 ifds=r-x ofds=--- 2019.12.01 14:01:37 LOG7[main]: Service [https] accepted (FD=440) from 127.0.0.1:56582 2019.12.01 14:01:37 LOG7[main]: Creating a new thread 2019.12.01 14:01:37 LOG7[main]: New thread created 2019.12.01 14:01:37 LOG7[1]: Service [https] started 2019.12.01 14:01:37 LOG5[1]: Service [https] accepted connection from 127.0.0.1:56582 2019.12.01 14:01:37 LOG7[1]: SSL state (accept): before/accept initialization 2019.12.01 14:01:37 LOG3[0]: SSL_accept: 1407609C: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request 2019.12.01 14:01:37 LOG5[0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2019.12.01 14:01:37 LOG7[0]: Local descriptor (FD=420) closed 2019.12.01 14:01:37 LOG7[0]: Service [https] finished (1 left) 2019.12.01 14:01:37 LOG3[1]: SSL_accept: 1407609C: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request 2019.12.01 14:01:37 LOG5[1]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2019.12.01 14:01:37 LOG7[1]: Local descriptor (FD=440) closed 2019.12.01 14:01:37 LOG7[1]: Service [https] finished (0 left) 2019.12.01 14:01:37 LOG7[main]: Found 1 ready file descriptor(s) 2019.12.01 14:01:37 LOG7[main]: FD=260 ifds=r-x ofds=--- 2019.12.01 14:01:37 LOG7[main]: Service [https] accepted (FD=448) from 127.0.0.1:56583 2019.12.01 14:01:37 LOG7[main]: Creating a new thread 2019.12.01 14:01:37 LOG7[main]: New thread created 2019.12.01 14:01:37 LOG7[2]: Service [https] started 2019.12.01 14:01:37 LOG5[2]: Service [https] accepted connection from 127.0.0.1:56583 2019.12.01 14:01:37 LOG7[2]: SSL state (accept): before/accept initialization 2019.12.01 14:01:37 LOG3[2]: SSL_accept: 1407609C: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request 2019.12.01 14:01:37 LOG5[2]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2019.12.01 14:01:37 LOG7[2]: Local descriptor (FD=448) closed 2019.12.01 14:01:37 LOG7[2]: Service [https] finished (0 left) 2019.12.01 14:01:37 LOG7[main]: Found 1 ready file descriptor(s) 2019.12.01 14:01:37 LOG7[main]: FD=260 ifds=r-x ofds=--- 2019.12.01 14:01:37 LOG7[main]: Service [https] accepted (FD=452) from 127.0.0.1:56584 2019.12.01 14:01:37 LOG7[main]: Creating a new thread 2019.12.01 14:01:37 LOG7[main]: New thread created 2019.12.01 14:01:37 LOG7[3]: Service [https] started 2019.12.01 14:01:37 LOG5[3]: Service [https] accepted connection from 127.0.0.1:56584 2019.12.01 14:01:37 LOG7[3]: SSL state (accept): before/accept initialization 2019.12.01 14:01:37 LOG3[3]: SSL_accept: 1407609C: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request 2019.12.01 14:01:37 LOG5[3]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2019.12.01 14:01:37 LOG7[3]: Local descriptor (FD=452) closed 2019.12.01 14:01:37 LOG7[3]: Service [https] finished (0 left) Thanks in advance.

2 1

SMTP out via Comcast stopped working
by Carlos Rodriguez 30 Nov '19

30 Nov '19

All: I have had this setup working fine since Comcast blocked port 25 and recently stopped working. This is a MS Small Business Server 2003 with Exchange, I know, old and obsolete but I would like to keep it working until I migrate to Linux. Anyway, right now I also have my desktop, Win10, using the same SMTP settings for the Acronis backup event results and it can send me emails just fine, just tested this. So it is not my firewall or Comcast. I'm missing something in the settings of stunnel. Below are my settings and log file. Any suggestions will be appreciated. Carlos taskbar = yes [SSLsmtp] client = yes accept = localhost:555 connect = smtp.comcast.net:587 protocol = smtp CAfile = ca-certs.pem protocolUsername = verifiedusername protocolPassword = verifiedpassword debug = 7 ================================================ 2019.11.29 16:31:24 LOG5[main]: stunnel 5.49 on x86-pc-msvc-1500 platform 2019.11.29 16:31:24 LOG5[main]: Compiled/running with OpenSSL 1.0.2p-fips 14 Aug 2018 2019.11.29 16:31:24 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2019.11.29 16:31:24 LOG5[main]: Reading configuration from file stunnel.conf 2019.11.29 16:31:24 LOG5[main]: UTF-8 byte order mark detected 2019.11.29 16:31:24 LOG5[main]: FIPS mode disabled 2019.11.29 16:31:26 LOG4[main]: Service [SSLsmtp] needs authentication to prevent MITM attacks 2019.11.29 16:31:26 LOG5[main]: Configuration successful 2019.11.29 16:34:12 LOG7[0]: Service [SSLsmtp] started 2019.11.29 16:34:12 LOG7[0]: Setting local socket options (FD=264) 2019.11.29 16:34:12 LOG7[0]: Option TCP_NODELAY set on local socket 2019.11.29 16:34:12 LOG5[0]: Service [SSLsmtp] accepted connection from 127.0.0.1:1268 2019.11.29 16:34:12 LOG6[0]: s_connect: connecting 96.114.157.81:587 2019.11.29 16:34:12 LOG7[0]: s_connect: s_poll_wait 96.114.157.81:587: waiting 10 seconds 2019.11.29 16:34:12 LOG5[0]: s_connect: connected 96.114.157.81:587 2019.11.29 16:34:12 LOG5[0]: Service [SSLsmtp] connected remote server from 10.10.10.99:1269 2019.11.29 16:34:12 LOG7[0]: Setting remote socket options (FD=288) 2019.11.29 16:34:12 LOG7[0]: Option TCP_NODELAY set on remote socket 2019.11.29 16:34:12 LOG7[0]: Remote descriptor (FD=288) initialized 2019.11.29 16:34:12 LOG7[0]: <- 220 resomta-po-02v.sys.comcast.net resomta-po-02v.sys.comcast.net ESMTP server ready 2019.11.29 16:34:12 LOG7[0]: -> 220 resomta-po-02v.sys.comcast.net resomta-po-02v.sys.comcast.net ESMTP server ready 2019.11.29 16:34:12 LOG7[0]: -> EHLO localhost 2019.11.29 16:34:12 LOG7[0]: <- 250-resomta-po-02v.sys.comcast.net hello [71.206.38.109], pleased to meet you 2019.11.29 16:34:12 LOG7[0]: <- 250-HELP 2019.11.29 16:34:12 LOG7[0]: <- 250-SIZE 36700160 2019.11.29 16:34:12 LOG7[0]: <- 250-ENHANCEDSTATUSCODES 2019.11.29 16:34:12 LOG7[0]: <- 250-8BITMIME 2019.11.29 16:34:12 LOG7[0]: <- 250-STARTTLS 2019.11.29 16:34:12 LOG7[0]: <- 250 OK 2019.11.29 16:34:12 LOG7[0]: -> STARTTLS 2019.11.29 16:34:12 LOG7[0]: <- 220 2.0.0 Ready to start TLS 2019.11.29 16:34:12 LOG6[0]: SNI: sending servername: smtp.comcast.net 2019.11.29 16:34:12 LOG6[0]: Peer certificate not required 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): before/connect initialization 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv2/v3 write client hello A 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 read server hello A 2019.11.29 16:34:12 LOG6[0]: Certificate verification disabled 2019.11.29 16:34:12 LOG6[0]: Certificate verification disabled 2019.11.29 16:34:12 LOG6[0]: Certificate verification disabled 2019.11.29 16:34:12 LOG6[0]: Certificate verification disabled 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 read server certificate A 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 read server key exchange A 2019.11.29 16:34:12 LOG6[0]: Client certificate not requested 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 read server done A 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 write client key exchange A 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 write change cipher spec A 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 write finished A 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 flush data 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 read server session ticket A 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 read finished A 2019.11.29 16:34:12 LOG7[0]: New session callback 2019.11.29 16:34:12 LOG7[0]: Peer certificate was cached (6814 bytes) 2019.11.29 16:34:12 LOG6[0]: Session id: 11C16B28FFB4A3A4EDC164CA65C3F20A896BF61C4D3B09F571E4285CFD0C82B3 2019.11.29 16:34:12 LOG7[0]: 1 client connect(s) requested 2019.11.29 16:34:12 LOG7[0]: 1 client connect(s) succeeded 2019.11.29 16:34:12 LOG7[0]: 0 client renegotiation(s) requested 2019.11.29 16:34:12 LOG7[0]: 0 session reuse(s) 2019.11.29 16:34:12 LOG6[0]: TLS connected: new session negotiated 2019.11.29 16:34:12 LOG6[0]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2019.11.29 16:34:12 LOG7[0]: Compression: null, expansion: null 2019.11.29 16:34:12 LOG7[0]: -> AUTH PLAIN AGNhcmxvc3JyQGNvbWNhc3QubmV0AFNveTFjYXJpZHVybw== 2019.11.29 16:34:12 LOG7[0]: <- 500 command unrecognized 2019.11.29 16:34:12 LOG3[0]: PLAIN Authentication Failed 2019.11.29 16:34:12 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2019.11.29 16:34:12 LOG7[0]: Remote descriptor (FD=288) closed 2019.11.29 16:34:12 LOG7[0]: Local descriptor (FD=264) closed 2019.11.29 16:34:12 LOG7[0]: Service [SSLsmtp] finished (0 left)

2 1

undefined reference to `CRYPTO_set_id_callback'
by Somchai Smythe 29 Nov '19

29 Nov '19

How do I fix this? gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/include -DLIBDIR='"/usr/lib/stunnel"' -DCONFDIR='"/etc/stunnel"' -O3 -m64 -march=x86-64 -mtune=generic -pipe -std=gnu17 -pthread -Wall -Wextra -Wpedantic -Wformat=2 -Wconversion -Wno-long-long -Wno-deprecated-declarations -fPIE -fstack-protector -D_FORTIFY_SOURCE=2 -MT stunnel-sthreads.o -MD -MP -MF .deps/stunnel-sthreads.Tpo -c -o stunnel-sthreads.o `test -f 'sthreads.c' || echo './'`sthreads.c sthreads.c: In function 'thread_id_init': sthreads.c:116:5: warning: implicit declaration of function 'CRYPTO_set_id_callback'; did you mean 'CRYPTO_set_locking_callback'? [-Wimplicit-function-declaration] 116 | CRYPTO_set_id_callback(stunnel_thread_id); | ^~~~~~~~~~~~~~~~~~~~~~ | CRYPTO_set_locking_callback ... libtool: link: ( cd ".libs" && rm -f "libstunnel.la" && ln -s "../libstunnel.la" "libstunnel.la" ) /usr/lib/gcc/x86_64-pc-linux-gnu/9.2.0/../../../../x86_64-pc-linux-gnu/bin/ld: stunnel-sthreads.o: in function `sthreads_init': sthreads.c:(.text+0xb0): undefined reference to `CRYPTO_set_id_callback' /usr/lib/gcc/x86_64-pc-linux-gnu/9.2.0/../../../../x86_64-pc-linux-gnu/bin/ld: stunnel-sthreads.o: in function `thread_id_init': sthreads.c:(.text+0x3a): undefined reference to `CRYPTO_set_id_callback' collect2: error: ld returned 1 exit status make[2]: *** [Makefile:550: stunnel] Error 1 I'm using openssl-1.1.1d if it matters.

2 4

"Address already in use" error
by Phil Smith III 25 Nov '19

25 Nov '19

Rebooted (Windows 7, fully patched) today and stunnel wouldn't start, said "Address already in use". Hmm.nothing much has changed. Rebooted again, same. Tinkered a bit, didn't see anything that looked meaningful. Went to look at deleted digests of this list, saw new version out, installed that, now it's happy. So.a mystery, at least to me; posting in case it helps someone else! .phsiii

1 0

segfault with v5.55
by Francois Robinette 22 Nov '19

22 Nov '19

I've seen other having the same issue without resolution so far... But we do have the same issue: stunnel[7886]: segfault at 21 ip 00007f70aa1efcea sp 00007f6fa7797978 error 6 in libpthread-2.12.so[7f70aa1e5000+17000]

2 4

Windows 10 stunnel does not accept options
by Clodoaldo Neto 22 Nov '19

22 Nov '19

Any option I try in stunnel 5.55 results the same. Say: PS C:\Program Files (x86)\stunnel\bin> .\stunnel \path\to\config\file [ ] Running on Windows 6.2 [ ] No limit detected for the number of clients [.] stunnel 5.55 on x64-pc-mingw32-gnu platform [.] Compiled/running with OpenSSL 1.1.1c 28 May 2019 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] GUI message loop initialized [ ] Running on Windows 6.2 [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark detected [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [ssh] [ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK [ ] TLSv1.3 ciphersuites: TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256 [ ] TLS options: 0x02100004 (+0x00000000, -0x00000000) [ ] No certificate or private key specified [:] Service [ssh] needs authentication to prevent MITM attacks [ ] Initializing service [gmail-imap] [!] Service [gmail-imap]: TLS server needs a certificate [ ] Deallocating section defaults [!] Server is down Same with PS C:\Program Files (x86)\stunnel\bin> .\stunnel nonexistent or PS C:\Program Files (x86)\stunnel\bin> .\stunnel -help Regards, Clodoaldo

1 0

Re: [stunnel-users] Stunnel traffic fails to go via proxy set in
by Andrew Krause 11 Nov '19

11 Nov '19

Hi Jai, If your proxy supports the HTTP CONNECT method, you can try revising your settings to this: [KG_Self-Checkout] key = client.pem cert = client.pem client = yes accept = 127.0.0.1:5001 connect = wproxy.qut.edu.au:3128 protocolHost = ap01.alma.exlibrisgroup.com:6443 TIMEOUTclose = 0 TIMEOUTconnect = 200 TIMEOUTidle = 86400 sslVersion = TLSv1.2 protocol = connect Only the connect protocol supports using the protocolHost option. If this isn't supported by your proxy, you can try using Privoxy or Polipo between stunnel and your proxy. Socat is another option as well. Andrew Krause Schaumburg Township District Library -----Original Message----- At QUT Library we use Stunnel to encrypt SIP2 (ie. book borrowing) traffic from the self-checkout machines through to the Alma library services platform (as per https://developers.exlibrisgroup.com/alma/integrations/stunnel/ ) Our self-checkout machines run Windows 10 and are allowed limited internet access to two hosts (cloud.fetechgroup.com and ap01.alma.exlibrisgroup.com) via our institution's Squid proxy and I have our current WinHTTP proxy settings: Proxy Server(s) : wproxy.qut.edu.au:3128 Bypass List : *.qut.edu.au The proxy server settings are set for all protocols (HTTP, HTTPS, secure and FTP) and I've confirmed that web browser and the FE Technologies software is routing via wproxy.qut.edu.au. However Stunnel is still trying to connect to Alma directly. Our stunnel.conf is as follows (just FYI, the FE Tech software points to 127.0.0.1:5001 as our library services platform address): [KG_Self-Checkout] key = client.pem cert = client.pem client = yes accept = 127.0.0.1:5001 connect = ap01.alma.exlibrisgroup.com:6443 TIMEOUTclose = 0 TIMEOUTconnect = 200 TIMEOUTidle = 86400 sslVersion = TLSv1.2 Is there a way to force Stunnel to either respect the WinHTTP settings or configure it to route traffic to wproxy.qut.edu.au:3128 before initiating the connect = hostname:port? I did try protocolHost as follows, but I'm probably misunderstanding how it works https://www.stunnel.org/static/stunnel.html#SERVICE-LEVEL-OPTIONS [KG_Self-Checkout] key = client.pem cert = client.pem client = yes accept = 127.0.0.1:5001 connect = wproxy.qut.edu.au:3128 protocolHost = ap01.alma.exlibrisgroup.com:6443 TIMEOUTclose = 0 TIMEOUTconnect = 200 TIMEOUTidle = 86400 sslVersion = TLSv1.2 Any advice or assistance gratefully accepted, and apologies if this is a silly question - I'm just a librarian trying to make this thing work. Thanks, Jai Parker | Information Access Librarian QUT Library | Division of Administrative Services QUT | Kelvin Grove | D Block, Level 1 | Victoria Park Rd Kelvin Grove QLD 4059 P: 07 3138 3381 | E: lib.infoaccess at qut.edu.au<mailto:lib.infoaccess at qut.edu.au> | www.qut.edu.au<http://www.qut.edu.au/> ABN: 83 791 724 622 | CRICOS No. 00213J

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 184, Issue 4
by Brent Kimberley 08 Nov '19

08 Nov '19

From: Mark Brookes <mark(a)loadbalancer.org> To: Francois Robinette <frobinette(a)hotmail.com> >> OpenSSL 1.1.0k x Stunnel interaction... See tag 5.56b1Thanks. Can't find the 5.56b1 tag. Is it on a fork?https://github.com/mtrojnar/stunnel/network/members BTW. I had difficulty linking stunnel-5.56 (static) with OpenSSL 1.1.1d (static) as well. >> The stunnel guys have worked tirelessly to get this resolved. Its an >> interaction of openssl 1.1.0k and Stunnel. I think essentially openssl >> is doing something strange. They came up with a fix and its currently>> in the https://www.stunnel.org/downloads/beta/stunnel-5.56b1.tar.gz >> beta. You should give it a try and see if its resolves your issue. On Thu, 7 Nov 2019 at 19:36, Francois Robinette <frobinette(a)hotmail.com> wrote: > > I've seen other having the same issue without resolution so far... > But we do have the same issue: > > stunnel[7886]: segfault at 21 ip 00007f70aa1efcea sp 00007f6fa7797978 error 6 in libpthread-2.12.so[7f70aa1e5000+17000] >

1 0

Stunnel traffic fails to go via proxy set in winhttp (Windows 10)
by Library Information Access Team 06 Nov '19

06 Nov '19

At QUT Library we use Stunnel to encrypt SIP2 (ie. book borrowing) traffic from the self-checkout machines through to the Alma library services platform (as per https://developers.exlibrisgroup.com/alma/integrations/stunnel/ ) Our self-checkout machines run Windows 10 and are allowed limited internet access to two hosts (cloud.fetechgroup.com and ap01.alma.exlibrisgroup.com) via our institution's Squid proxy and I have our current WinHTTP proxy settings: Proxy Server(s) : wproxy.qut.edu.au:3128 Bypass List : *.qut.edu.au The proxy server settings are set for all protocols (HTTP, HTTPS, secure and FTP) and I've confirmed that web browser and the FE Technologies software is routing via wproxy.qut.edu.au. However Stunnel is still trying to connect to Alma directly. Our stunnel.conf is as follows (just FYI, the FE Tech software points to 127.0.0.1:5001 as our library services platform address): [KG_Self-Checkout] key = client.pem cert = client.pem client = yes accept = 127.0.0.1:5001 connect = ap01.alma.exlibrisgroup.com:6443 TIMEOUTclose = 0 TIMEOUTconnect = 200 TIMEOUTidle = 86400 sslVersion = TLSv1.2 Is there a way to force Stunnel to either respect the WinHTTP settings or configure it to route traffic to wproxy.qut.edu.au:3128 before initiating the connect = hostname:port? I did try protocolHost as follows, but I'm probably misunderstanding how it works https://www.stunnel.org/static/stunnel.html#SERVICE-LEVEL-OPTIONS [KG_Self-Checkout] key = client.pem cert = client.pem client = yes accept = 127.0.0.1:5001 connect = wproxy.qut.edu.au:3128 protocolHost = ap01.alma.exlibrisgroup.com:6443 TIMEOUTclose = 0 TIMEOUTconnect = 200 TIMEOUTidle = 86400 sslVersion = TLSv1.2 Any advice or assistance gratefully accepted, and apologies if this is a silly question - I'm just a librarian trying to make this thing work. Thanks, Jai Parker | Information Access Librarian QUT Library | Division of Administrative Services QUT | Kelvin Grove | D Block, Level 1 | Victoria Park Rd Kelvin Grove QLD 4059 P: 07 3138 3381 | E: lib.infoaccess(a)qut.edu.au<mailto:[email protected]> | www.qut.edu.au<http://www.qut.edu.au/> ABN: 83 791 724 622 | CRICOS No. 00213J

1 0

Re: [stunnel-users] Extensions when negotiating TLS
by Christopher Schultz 05 Nov '19

05 Nov '19

Tom, On 11/4/19 17:59, Tom (AST) Watson wrote: > Trying to make the applications want to talk http/1.1 isn't going to > be easy. Both sides (app#1 and app#2) want to talk http2 (*SIGH*). Understood. > I was just hoping stunnel might work. Presently it looks like it > won't so I am looking at alternatives. Part of the object is to look > at the various transactions over the wire (many!) and they are lots. > I assume that is why http2 is used, and I have no influence over > that decision. From the looks of it, making app#2 unencrypted is the > best path. Boo! > It is written in GO, and has little comments to describe things (such > is life!). I think I'm a bit closer to a solution, but if stunnel > can be made to work (ALPN support) it would be nice. Looks like I'll > have to wait. Why isn't it an option to enable encryption directly on the service? It seems like using stunnel should be your last resort. -chris > -----Original Message----- > From: stunnel-users <stunnel-users-bounces(a)stunnel.org> On Behalf Of Christopher Schultz > > Tom, > > On 11/4/19 17:16, Tom (AST) Watson wrote: >> Yes, I understand about ALPN. Sorry I described in detail. >> Unfortunately application #2 wants encrypted http2 (it is a go >> program). Application #1 wants to talk in http2 (I can't change >> that!) and it doesn't encrypt "naturally" (and I want to see what is >> going on [Wireshark] as well) In looking further I might be able to >> get application #2 to go plaintext (I found a pointer). Yes, it seems >> that stunnel doesn't support ALPN, wishful thinking on my part >> >> Back to the salt mines. (*SIGH*) > > How difficult would it be to enable HTTP/1.1 on that application #1? > I've never seen an h2-only service before. h2 is more effective for web applications that make a lot of tiny requests (like small resources for pages, scripts, etc.). Most API-based services don't really get any benefit from using h2. > > -chris > >> -----Original Message----- From: stunnel-users >> <stunnel-users-bounces(a)stunnel.org> On Behalf Of Christopher Schultz >> Sent: Monday, November 4, 2019 13:59 To: stunnel-users(a)stunnel.org >> Subject: [External] Re: [stunnel-users] Extensions when negotiating >> TLS >> >> Tom, >> >> On 11/4/19 16:05, Tom (AST) Watson wrote: >>> Well, I thought it would be "easy", but maybe not. I have an >>> application (#1) that uses http2, and isn't encrypted. No problem >>> here. Now I have another application (#2) that insists on using >>> https to talk to application #1. So I gleefully setup stunnel to >>> connect the two. Well, application #2 starts talking to stunnel with >>> a "Client Hello" packet, and it includes an extension "Application >>> Layer Protocol Extension" of "h2". >> >> This is called ALPN, and is a requirement for h2s. >> >>> While not versed in the minutia, I take this that the client >>> (application #2) wants to talk "http2" to the server (application >>> #1). >> >> Yep, pretty much. >> >>> OK, that is what I want. The problem is that stunnel doesn't respond >>> with ANY "Application Layer Protocol Extension" indicating acceptance >>> of this request in its "server hello". This means that application >>> #2 fails in its negotiation. No joy! >>> >>> Now I know that application #1 will nicely talk http2, but how do I >>> get stunnel to communicate this to application #2 (as encrypted >>> http2). Am I missing something in my (pretty simple) configuration >>> file? >> >> I can't find any references to stunnel supporting ALPN. You may be >> (temporarily) out of luck, at least with stunnel. >> >> You mentioned that app #2 insists on encryption (great, usually). Is >> there a requirement that it use h2? Or can it be configured to use >> HTTP/1.1? >> >> -chris >> >

2 1

Re: [stunnel-users] Extensions when negotiating TLS
by Christopher Schultz 04 Nov '19

04 Nov '19

Tom, On 11/4/19 17:16, Tom (AST) Watson wrote: > Yes, I understand about ALPN. Sorry I described in detail. > Unfortunately application #2 wants encrypted http2 (it is a go > program). Application #1 wants to talk in http2 (I can't change > that!) and it doesn't encrypt "naturally" (and I want to see what is > going on [Wireshark] as well) In looking further I might be able to > get application #2 to go plaintext (I found a pointer). Yes, it seems > that stunnel doesn't support ALPN, wishful thinking on my part > > Back to the salt mines. (*SIGH*) How difficult would it be to enable HTTP/1.1 on that application #1? I've never seen an h2-only service before. h2 is more effective for web applications that make a lot of tiny requests (like small resources for pages, scripts, etc.). Most API-based services don't really get any benefit from using h2. -chris > -----Original Message----- From: stunnel-users > <stunnel-users-bounces(a)stunnel.org> On Behalf Of Christopher Schultz > Sent: Monday, November 4, 2019 13:59 To: stunnel-users(a)stunnel.org > Subject: [External] Re: [stunnel-users] Extensions when negotiating > TLS > > Tom, > > On 11/4/19 16:05, Tom (AST) Watson wrote: >> Well, I thought it would be "easy", but maybe not. I have an >> application (#1) that uses http2, and isn't encrypted. No problem >> here. Now I have another application (#2) that insists on using >> https to talk to application #1. So I gleefully setup stunnel to >> connect the two. Well, application #2 starts talking to stunnel >> with a "Client Hello" packet, and it includes an extension >> "Application Layer Protocol Extension" of "h2". > > This is called ALPN, and is a requirement for h2s. > >> While not versed in the minutia, I take this that the client >> (application #2) wants to talk "http2" to the server (application >> #1). > > Yep, pretty much. > >> OK, that is what I want. The problem is that stunnel doesn't >> respond with ANY "Application Layer Protocol Extension" indicating >> acceptance of this request in its "server hello". This means that >> application #2 fails in its negotiation. No joy! >> >> Now I know that application #1 will nicely talk http2, but how do I >> get stunnel to communicate this to application #2 (as encrypted >> http2). Am I missing something in my (pretty simple) configuration >> file? > > I can't find any references to stunnel supporting ALPN. You may be > (temporarily) out of luck, at least with stunnel. > > You mentioned that app #2 insists on encryption (great, usually). Is > there a requirement that it use h2? Or can it be configured to use > HTTP/1.1? > > -chris >

1 0

Extensions when negotiating TLS
by Tom (AST) Watson 04 Nov '19

04 Nov '19

Well, I thought it would be "easy", but maybe not. I have an application (#1) that uses http2, and isn't encrypted. No problem here. Now I have another application (#2) that insists on using https to talk to application #1. So I gleefully setup stunnel to connect the two. Well, application #2 starts talking to stunnel with a "Client Hello" packet, and it includes an extension "Application Layer Protocol Extension" of "h2". While not versed in the minutia, I take this that the client (application #2) wants to talk "http2" to the server (application #1). OK, that is what I want. The problem is that stunnel doesn't respond with ANY "Application Layer Protocol Extension" indicating acceptance of this request in its "server hello". This means that application #2 fails in its negotiation. No joy! Now I know that application #1 will nicely talk http2, but how do I get stunnel to communicate this to application #2 (as encrypted http2). Am I missing something in my (pretty simple) configuration file? Thanks. -- Tom Watson (I'm at work now) Thomas.3.watson(a)raytheon.com

2 1

Debian 9 static build
by Chris Maciejewski 01 Nov '19

01 Nov '19

Hello, I am trying to build stunnel 5.55 on Debian 9 x64 statistically against latest OpenSSL build from source. The system already has openssl and libssl ver. 1.1.1b installed via apt-get , but I want to build against OpenSSL 1.1.1d instead. What I do is: 1. Build and install OpenSSL: $ cd /usr/src/openssl-1.1.1d $ ./config -fPIC --prefix=/opt/openssl $ make depend && make && make install 2. Build and install Stunnel $ cd /usr/src/stunnel-5.55 $ ./configure --with-ssl=/opt/openssl --enable-static $ make && make install Both 1 and 2 completes OK with no errors, however when I run: $ /usr/local/bin/stunnel [.] Compiled with OpenSSL 1.1.1d 10 Sep 2019 [.] Running with OpenSSL 1.1.1b 26 Feb 2019 .... and indeed when I do: $ ldd /usr/local/bin/stunnel libssl.so.1.1 => /usr/lib/x86_64-linux-gnu/libssl.so.1.1 (0x00007f1083b4f000) libcrypto.so.1.1 => /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1 (0x00007f1083668000) above shows dynamic .so libs are used, rather than static libs libssl.a and libcrypto.a Any suggestions as to what is wrong with my process above and how to make static build of Stunnel to use non-system OpenSSL very much appreciated. Kind regards, Chris

2 1

Re: [stunnel-users] stunnel-users Digest, Vol 183, Issue 4
by Brent Kimberley 26 Oct '19

26 Oct '19

Chris.Does this help? https://stackoverflow.com/questions/40454338/no-shared-cipher-at-ssl-accept… If you can rule out libraries like OpenSSL, then look at your config + initial setup exchange. Date: Fri, 25 Oct 2019 11:11:54 -0400 From: Christopher Schultz <chris(a)christopherschultz.net> Subject: Re: [stunnel-users] Strange connection failure in one environmentOn 10/25/19 10:09, Christopher Schultz wrote: > All, > > I've been using stunnel in two environments (dev, prod) for a long time > without any problems. Recently, my dev environment started acting funny > and I can't connect to it from outside the box. > > Can someone take a look and let me know if you have any suggestions for > where to look for a problem? > > Both environments have the following things in common: > > 1. Hosted in Amazon EC2, no load-balancer in the way > 2. Configuration requires client-certificate to connect > 3. All certificates are valid, self-signed, and properly-trusted by both > sides > 4. TLS configuration has been locked-down to TLSv1.2, selected cipher > suites, FIPS mode=off > 5. All versions are the same: stunnel 4.56 w/OpenSSL 1.0.2k-fips > > The production (working) environment happens to be i686 and the > development environment happens to be x86-86, but I don't believe that > is relevant. > > When I use e.g. "openssl s_client" to connect to the production > environment and I *do not* provide a client certificate, I am able to > perform the initial TLS handshake, get a cipher suite negotiated, etc. > and then the connection fails because I didn't provide the client > certificate, of course. I *can* see in the handshake the list of allowed > client certificates. > > When I do the same in development, I get a handshake failure. No allowed > client certificates are shown. No nothing. > > If I connect on localhost to the dev server, I get what I'm expecting: > allowed client certificates are listed, connection is closed because I'm > not using the client certificate. Connecting from another host gets my a > handshake failure. > > Again, there are no load-balancers or anything between the outside and > the EC2 instance. I'm connecting as directly as it's possible to > connect. The box definitely allows incoming connections on the port I'm > trying to use; the AWS security group is configured correctly. > > I have tried dropping ALL security configuration on the dev server's > stunnel.conf such as client-cert requirements, TLS protocols, cipher > suites, etc. and I get the same behavior every time. I'm starting to > think that it has nothing to do with my stunnel.conf configuration at > all, but I'm at a loss as to where to look, next. > > Any ideas? Some more information: 0. The error I get on the client is "handshake failure" and the stunnel server drops this log message: SSL_accept: 1408A0C1: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher Note that I have disabled all but TLSv1.2 on the server. Removing this restriction does not change the behavior. 1. I have multiple stunnel configuration files on this server. Actually, I have 4 of them. Connections to ports defined in 2 of these files are not connecting successfully. Connections to ports defined in the OTHER two files *are* connecting successfully. The configurations seem to follow a pattern: those using RSA certificates as the server-certificate are working as expected, while those with EC server-certificate are failing. When I say "working" versus "failing", I mean that this command will give me a cipher suite and master key, but still drop the connection because I'm not providing a client-certificate for these tests: $ openssl s_client -connect host:port 2. I have a Java-based service that *is* able to connect through this stunnel instance just fine. It's running on a recent version of Java 8. My CLI client (not OpenSSL) is also running the same version. My CLI client cannot connect. *weird* In both cases, I am using EC client certificates, but the certificates are different from each other. Both of these certificates are trusted by the server. 3. When using OpenSSL 1.0.2t, I *can* connect, get the list of acceptable client certificates, etc. even without providing a client certificate. When using OpenSSL 1.1.1d, I can *not* connect. So perhaps the inside/outside networking thing I was thinking the problem might be is incorrect. AFAIK, both versions of OpenSSL should be able to use EC certificates and cipher suites. Thanks, -chris

1 0

Strange connection failure in one environment
by Christopher Schultz 25 Oct '19

25 Oct '19

All, I've been using stunnel in two environments (dev, prod) for a long time without any problems. Recently, my dev environment started acting funny and I can't connect to it from outside the box. Can someone take a look and let me know if you have any suggestions for where to look for a problem? Both environments have the following things in common: 1. Hosted in Amazon EC2, no load-balancer in the way 2. Configuration requires client-certificate to connect 3. All certificates are valid, self-signed, and properly-trusted by both sides 4. TLS configuration has been locked-down to TLSv1.2, selected cipher suites, FIPS mode=off 5. All versions are the same: stunnel 4.56 w/OpenSSL 1.0.2k-fips The production (working) environment happens to be i686 and the development environment happens to be x86-86, but I don't believe that is relevant. When I use e.g. "openssl s_client" to connect to the production environment and I *do not* provide a client certificate, I am able to perform the initial TLS handshake, get a cipher suite negotiated, etc. and then the connection fails because I didn't provide the client certificate, of course. I *can* see in the handshake the list of allowed client certificates. When I do the same in development, I get a handshake failure. No allowed client certificates are shown. No nothing. If I connect on localhost to the dev server, I get what I'm expecting: allowed client certificates are listed, connection is closed because I'm not using the client certificate. Connecting from another host gets my a handshake failure. Again, there are no load-balancers or anything between the outside and the EC2 instance. I'm connecting as directly as it's possible to connect. The box definitely allows incoming connections on the port I'm trying to use; the AWS security group is configured correctly. I have tried dropping ALL security configuration on the dev server's stunnel.conf such as client-cert requirements, TLS protocols, cipher suites, etc. and I get the same behavior every time. I'm starting to think that it has nothing to do with my stunnel.conf configuration at all, but I'm at a loss as to where to look, next. Any ideas? -chris

1 1

ssl offloading with stunnel
by simona vittori 23 Oct '19

23 Oct '19

Hello,Is it possible to have the following architecture with stunnel? stunnel client --> balancer --> db server Balancer doesn't have stunnel product installed on it. It receives encrypted packages from stunnel client and redirect clear traffico to DB server. Is it possible to realize this configuration? Thank a lot. Regards Simona

1 0

stunnel : user identification in mutual auth
by Denis Polushin 22 Oct '19

22 Oct '19

Hi All, Haven't found the answer for this issue. The scheme is : TLS-client <==tls==> stunnel-server <==open==> App-server In user session stunnel-server perform authorization for client with its certificate (verify=2) and send request further to App-server. How does App-server can identify user in this session? To grand permissions. Ideally it would be good to know CN or EKU of user certificate. Is it possible? Thanks a lot!! Denis

1 0

segfault with v5.55
by Mark Brookes 30 Sep '19

30 Sep '19

We are currently experiencing a segfault with version 5.55 openssl version 1.1.0k and are trying to narrow down what the issue may be. The first 2 segfaults are about 10 mins apart. The below is from the stunnel log just before and then after the event. Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77582]: TLS state (accept): SSLv3/TLS write finished Sep 23 11:47:31 xxxx stunnel: LOG7[77582]: TLS state (accept): SSLv3/TLS read change cipher spec Sep 23 11:47:31 xxxx stunnel: LOG7[77582]: TLS state (accept): SSLv3/TLS read finished Sep 23 11:47:31 xxxx stunnel: LOG7[77580]: TLS state (accept): SSLv3/TLS write finished Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:52:58 xxxx stunnel: LOG7[ui]: Clients allowed=62937 Sep 23 11:52:58 xxxx stunnel: LOG5[ui]: stunnel 5.55 on x86_64-pc-linux-gnu platform Sep 23 11:52:58 xxxx stunnel: LOG5[ui]: Compiled/running with OpenSSL 1.1.0k 28 May 2019 Sep 23 11:52:58 xxxx stunnel: LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI Sep 23 11:52:58 xxxx stunnel: LOG7[ui]: errno: (*__errno_location ()) The following is from the kernel log. stunnel[31253]: segfault at 0 ip 00007f91214cacea sp 00007f91205ea9f8 error 6 in libpthread-2.12.so[7f91214c0000+17000] The kernel log after the second segfault- stunnel[1868]: segfault at 0 ip 00007f5b35398cea sp 00007f5b344c59f8 error 6 in libpthread-2.12.so[7f5b3538e000+17000] This is all the information we have at the moment. -- Mark Brookes Loadbalancer.org Ltd. www.loadbalancer.org +44 (0)330 380 1064 mark(a)loadbalancer.org

1 0

Re: [stunnel-users] stunnel with OpenSSL engine: reload leaks HSM connections
by Lynch, Andrew 27 Sep '19

27 Sep '19

I’ve been digging around the code and I am no longer sure whether stunnel is at fault or it is actually an issue in OpenSSL! load_key_engine() in ctx.c shoves the key into the SSL context – SSL_CTX_use_PrivateKey(section->ctx, pkey). So the key should be freed when that context is disposed of. The SIGHUP ends up in case SIGNAL_RELOAD_CONFIG of signal_pipe_dispatch(), which calls options_free() [stunnel.c line 830]. Eventually there is an SSL_CTX_free() call, but it looks like this does not actually free the private key. Ephemeral keys are freed and loads of other stuff, but not the private key associated with the certificate. I may try to build a hacked OpenSSL on Monday to see what happens if SSL_CTX_free also frees the private key… Regards, Andrew. From: Brent Kimberley [mailto:[email protected]] Sent: Friday, September 27, 2019 4:29 PM To: stunnel-users(a)stunnel.org; Lynch, Andrew Subject: Re: stunnel-users Digest, Vol 182, Issue 14 >> Over time, after numerous reloads of stunnel (kill -HUP) the HSM reports that its connection table is full. >> Logging from the engine shows that stunnel is never freeing the keys and therefore the engine is not closing the associated sessions with the HSM. Each stunnel reload opens 70 new sessions until eventually the HSM's configured limit is exceeded. Where does the signal dispatcher free keys on SIG_HUP? https://github.com/mtrojnar/stunnel/blob/master/src/stunnel.c Date: Fri, 27 Sep 2019 07:23:29 +0000 From: "Lynch, Andrew" <andrew.lynch(a)atos.net<mailto:[email protected]>> To: Eric Eberhard <flash(a)vicsmba.com<mailto:[email protected]>> Cc: "stunnel-users(a)stunnel.org<mailto:[email protected]>" <stunnel-users(a)stunnel.org<mailto:[email protected]>> Subject: Re: [stunnel-users] stunnel with OpenSSL engine: reload leaks HSM connections Hi Eric, Thank you for your suggestion. It is certainly worth looking into, although I suspect it may be impractical in our environment. Now we have a single stunnel.conf with 70 services which would translate into 70 additional entries in inetd.conf. Each of those entries then needs to have its own reduced stunnel.conf so that it will only load the cert and key for its endpoint. The stunnel HOWTO recommends daemon mode over inetd mode due to the overhead for forking and SSL initialization. We would have additional overhead for engine init and HSM connection. Regards, Andrew. -----Original Message----- From: Eric Eberhard [mailto:[email protected]<mailto:[email protected]>] Sent: Thursday, September 26, 2019 7:20 PM To: Lynch, Andrew; stunnel-users(a)stunnel.org<mailto:[email protected]> Subject: RE: [stunnel-users] stunnel with OpenSSL engine: reload leaks HSM connections? Try running in inetd mode -- even if you don't like this you will learn something. Inetd will close connections as needed. E -----Original Message----- From: stunnel-users [mailto:[email protected]<mailto:[email protected]>] On Behalf Of Lynch, Andrew Sent: Thursday, September 26, 2019 5:56 AM To: stunnel-users(a)stunnel.org<mailto:[email protected]> Subject: [stunnel-users] stunnel with OpenSSL engine: reload leaks HSM connections? Hi, We are using stunnel as a server to terminate incoming TLS connections. The config has around 70 services with certificates whose EC private keys are stored in an HSM and accessed using an OpenSSL engine. Over time, after numerous reloads of stunnel (kill -HUP) the HSM reports that its connection table is full. Logging from the engine shows that stunnel is never freeing the keys and therefore the engine is not closing the associated sessions with the HSM. Each stunnel reload opens 70 new sessions until eventually the HSM's configured limit is exceeded. This behaviour has been observed on Suse Enterprise Linux 12.3 with the system-provided stunnel-5.00-4.3.4, but I can reproduce it with my own build of the current version 5.55. Is this a known issue? It appears that other (ephemeral) keys are being freed, just not those associated with the service certificates. Currently our workaround is to perform a full restart instead of a reload. This closes all HSM sessions when the process terminates, but of course it also kills any open client connections so it can only be done during the scheduled maintenance windows. Regards, Andrew. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org<mailto:[email protected]> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users ------------------------------ Subject: Digest Footer _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org<mailto:[email protected]> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users ------------------------------ End of stunnel-users Digest, Vol 182, Issue 14 **********************************************

2 1

Re: [stunnel-users] stunnel-users Digest, Vol 182, Issue 14
by Eric Eberhard 27 Sep '19

27 Sep '19

I don’t suggest it as a final solution – although for me it works great and we have customers exchanging 2-4 million XML documents per day with no performance issues – BUT no matter what it is a good debugging tool. Inetd gets all the initial connections and closes them when done. It might or might or might not be involved with the HSM at all. You might also look at the process table (some form of ps) and grep for stunnel and relatives and see if they are hanging around. In theory, if a process dies, it “should” close it’s connections. If it is floating in space it will not. Inetd will kill the process – at least on Centos and AIX and SCO – for sure and for certain. E From: stunnel-users [mailto:[email protected]] On Behalf Of Brent Kimberley Sent: Friday, September 27, 2019 7:29 AM To: stunnel-users(a)stunnel.org; andrew.lynch(a)atos.net Subject: Re: [stunnel-users] stunnel-users Digest, Vol 182, Issue 14 >> Over time, after numerous reloads of stunnel (kill -HUP) the HSM reports that its connection table is full. >> Logging from the engine shows that stunnel is never freeing the keys and therefore the engine is not closing the associated sessions with the HSM. Each stunnel reload opens 70 new sessions until eventually the HSM's configured limit is exceeded. Where does the signal dispatcher free keys on SIG_HUP? https://github.com/mtrojnar/stunnel/blob/master/src/stunnel.c Date: Fri, 27 Sep 2019 07:23:29 +0000 From: "Lynch, Andrew" <andrew.lynch(a)atos.net <mailto:[email protected]> > To: Eric Eberhard <flash(a)vicsmba.com <mailto:[email protected]> > Cc: "stunnel-users(a)stunnel.org <mailto:[email protected]> " <stunnel-users(a)stunnel.org <mailto:[email protected]> > Subject: Re: [stunnel-users] stunnel with OpenSSL engine: reload leaks HSM connections Hi Eric, Thank you for your suggestion. It is certainly worth looking into, although I suspect it may be impractical in our environment. Now we have a single stunnel.conf with 70 services which would translate into 70 additional entries in inetd.conf. Each of those entries then needs to have its own reduced stunnel.conf so that it will only load the cert and key for its endpoint. The stunnel HOWTO recommends daemon mode over inetd mode due to the overhead for forking and SSL initialization. We would have additional overhead for engine init and HSM connection. Regards, Andrew. -----Original Message----- From: Eric Eberhard [mailto:[email protected] <mailto:[email protected]> ] Sent: Thursday, September 26, 2019 7:20 PM To: Lynch, Andrew; stunnel-users(a)stunnel.org <mailto:[email protected]> Subject: RE: [stunnel-users] stunnel with OpenSSL engine: reload leaks HSM connections? Try running in inetd mode -- even if you don't like this you will learn something. Inetd will close connections as needed. E -----Original Message----- From: stunnel-users [mailto:[email protected] <mailto:[email protected]> ] On Behalf Of Lynch, Andrew Sent: Thursday, September 26, 2019 5:56 AM To: stunnel-users(a)stunnel.org <mailto:[email protected]> Subject: [stunnel-users] stunnel with OpenSSL engine: reload leaks HSM connections? Hi, We are using stunnel as a server to terminate incoming TLS connections. The config has around 70 services with certificates whose EC private keys are stored in an HSM and accessed using an OpenSSL engine. Over time, after numerous reloads of stunnel (kill -HUP) the HSM reports that its connection table is full. Logging from the engine shows that stunnel is never freeing the keys and therefore the engine is not closing the associated sessions with the HSM. Each stunnel reload opens 70 new sessions until eventually the HSM's configured limit is exceeded. This behaviour has been observed on Suse Enterprise Linux 12.3 with the system-provided stunnel-5.00-4.3.4, but I can reproduce it with my own build of the current version 5.55. Is this a known issue? It appears that other (ephemeral) keys are being freed, just not those associated with the service certificates. Currently our workaround is to perform a full restart instead of a reload. This closes all HSM sessions when the process terminates, but of course it also kills any open client connections so it can only be done during the scheduled maintenance windows. Regards, Andrew. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org <mailto:[email protected]> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users ------------------------------ Subject: Digest Footer _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org <mailto:[email protected]> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users ------------------------------ End of stunnel-users Digest, Vol 182, Issue 14 **********************************************

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 182, Issue 14
by Brent Kimberley 27 Sep '19

27 Sep '19

>> Over time, after numerous reloads of stunnel (kill -HUP) the HSM reports that its connection table is full. >> Logging from the engine shows that stunnel is never freeing the keys and therefore the engine is not closing the associated sessions with the HSM. Each stunnel reload opens 70 new sessions until eventually the HSM's configured limit is exceeded. Where does the signal dispatcher free keys on SIG_HUP?https://github.com/mtrojnar/stunnel/blob/master/src/stunnel.c Date: Fri, 27 Sep 2019 07:23:29 +0000 From: "Lynch, Andrew" <andrew.lynch(a)atos.net> To: Eric Eberhard <flash(a)vicsmba.com> Cc: "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Subject: Re: [stunnel-users] stunnel with OpenSSL engine: reload leaks HSM connections Hi Eric, Thank you for your suggestion. It is certainly worth looking into, although I suspect it may be impractical in our environment. Now we have a single stunnel.conf with 70 services which would translate into 70 additional entries in inetd.conf. Each of those entries then needs to have its own reduced stunnel.conf so that it will only load the cert and key for its endpoint. The stunnel HOWTO recommends daemon mode over inetd mode due to the overhead for forking and SSL initialization. We would have additional overhead for engine init and HSM connection. Regards, Andrew. -----Original Message----- From: Eric Eberhard [mailto:[email protected]] Sent: Thursday, September 26, 2019 7:20 PM To: Lynch, Andrew; stunnel-users(a)stunnel.org Subject: RE: [stunnel-users] stunnel with OpenSSL engine: reload leaks HSM connections? Try running in inetd mode -- even if you don't like this you will learn something. Inetd will close connections as needed. E -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of Lynch, Andrew Sent: Thursday, September 26, 2019 5:56 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] stunnel with OpenSSL engine: reload leaks HSM connections? Hi, We are using stunnel as a server to terminate incoming TLS connections. The config has around 70 services with certificates whose EC private keys are stored in an HSM and accessed using an OpenSSL engine. Over time, after numerous reloads of stunnel (kill -HUP) the HSM reports that its connection table is full. Logging from the engine shows that stunnel is never freeing the keys and therefore the engine is not closing the associated sessions with the HSM. Each stunnel reload opens 70 new sessions until eventually the HSM's configured limit is exceeded. This behaviour has been observed on Suse Enterprise Linux 12.3 with the system-provided stunnel-5.00-4.3.4, but I can reproduce it with my own build of the current version 5.55. Is this a known issue? It appears that other (ephemeral) keys are being freed, just not those associated with the service certificates. Currently our workaround is to perform a full restart instead of a reload. This closes all HSM sessions when the process terminates, but of course it also kills any open client connections so it can only be done during the scheduled maintenance windows. Regards, Andrew. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users ------------------------------ Subject: Digest Footer _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users ------------------------------ End of stunnel-users Digest, Vol 182, Issue 14 **********************************************

1 0

Re: [stunnel-users] stunnel with OpenSSL engine: reload leaks HSM connections?
by Eric Eberhard 27 Sep '19

27 Sep '19

Try running in inetd mode -- even if you don't like this you will learn something. Inetd will close connections as needed. E -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of Lynch, Andrew Sent: Thursday, September 26, 2019 5:56 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] stunnel with OpenSSL engine: reload leaks HSM connections? Hi, We are using stunnel as a server to terminate incoming TLS connections. The config has around 70 services with certificates whose EC private keys are stored in an HSM and accessed using an OpenSSL engine. Over time, after numerous reloads of stunnel (kill -HUP) the HSM reports that its connection table is full. Logging from the engine shows that stunnel is never freeing the keys and therefore the engine is not closing the associated sessions with the HSM. Each stunnel reload opens 70 new sessions until eventually the HSM's configured limit is exceeded. This behaviour has been observed on Suse Enterprise Linux 12.3 with the system-provided stunnel-5.00-4.3.4, but I can reproduce it with my own build of the current version 5.55. Is this a known issue? It appears that other (ephemeral) keys are being freed, just not those associated with the service certificates. Currently our workaround is to perform a full restart instead of a reload. This closes all HSM sessions when the process terminates, but of course it also kills any open client connections so it can only be done during the scheduled maintenance windows. Regards, Andrew. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

2 1

stunnel with OpenSSL engine: reload leaks HSM connections?
by Lynch, Andrew 26 Sep '19

26 Sep '19

Hi, We are using stunnel as a server to terminate incoming TLS connections. The config has around 70 services with certificates whose EC private keys are stored in an HSM and accessed using an OpenSSL engine. Over time, after numerous reloads of stunnel (kill -HUP) the HSM reports that its connection table is full. Logging from the engine shows that stunnel is never freeing the keys and therefore the engine is not closing the associated sessions with the HSM. Each stunnel reload opens 70 new sessions until eventually the HSM's configured limit is exceeded. This behaviour has been observed on Suse Enterprise Linux 12.3 with the system-provided stunnel-5.00-4.3.4, but I can reproduce it with my own build of the current version 5.55. Is this a known issue? It appears that other (ephemeral) keys are being freed, just not those associated with the service certificates. Currently our workaround is to perform a full restart instead of a reload. This closes all HSM sessions when the process terminates, but of course it also kills any open client connections so it can only be done during the scheduled maintenance windows. Regards, Andrew.

1 0

Re: [stunnel-users] Problems when using PSK between a version of stunnel usingopenssl 1.0 and a version of stunnel using openssl 1.1.1 in stunnel-users Digest, Vol 182, Issue 7
by Koperberg, J. (Hannah) 25 Sep '19

25 Sep '19

Hi Brent Thank you for your suggestions. I installed stunnel version 5.55 on the client test side (where the openssl version OpenSSL 1.1.1c is). That has solved the problem. Kind regards and thanks again for your help, Hannah Koperberg, de Volksbank N.V., The Netherlands From: Brent Kimberley <brent_kimberley(a)rogers.com> Sent: woensdag 18 september 2019 18:30 To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] stunnel-users Digest, Vol 182, Issue 7 psk_find() and psk_server_callback() are marked NOEXPORT. You can try whitebox - decompile ctx.c:: psk_server_callback() and/or blackbox - breaking the problem into parts to see what works/fails. Decomposing the problem into parts : a) Two differing stunnel versions and a common openssl library. b) One common stunnel version and two differing openssl libraries. On Wednesday, September 18, 2019, 11:28:48 a.m. EDT, Brent Kimberley <brent_kimberley(a)rogers.com<mailto:[email protected]>> wrote: >> 2019.09.16 13:36:28 LOG6[3]: PSK identity not found (session resumption?) Try dumping the symbols for ctx.c::psk_find(), ssl_lib.c::SSL_get_ex_data(), and ctx.c:: psk_server_callback(). ________________________________ Dit e-mailbericht is alleen bestemd voor de geadresseerden. Indien dit bericht niet voor u is bedoeld, wordt u verzocht de afzender hiervan op de hoogte te stellen door het bericht te retourneren en de inhoud niet te gebruiken. This e-mail message is intended to be exclusively for the addressee. If you are not the intended recipient you are kindly requested not to make any use whatsoever of the contents and to notify the sender immediately by returning this e-mail message.

2 1

Re: [stunnel-users] stunnel-users Digest, Vol 182, Issue 11
by Brent Kimberley 24 Sep '19

24 Sep '19

>>We are running stunnel-5.49-1.ppc on AIX 7100-05-03-1846. >>It will stay up awhile and our connection tests work, but it core dumps. Here’s the message in the log file. Thoughts? >>INTERNAL ERROR: Out of memory at s3_both.c, line 626 Hi Gerald. You may have found a memory leak. Try looking at: 1) line 626 of OpenSSL::s3_booth.c https://github.com/openssl/openssl/blob/OpenSSL_1_0_2-stable/ssl/s3_both.c 2) line 296 of stunnel::str.c ; and/or https://github.com/mtrojnar/stunnel/blob/stunnel-5.49/src/str.c 3) dbx, truss, or probevue - in an offline dev environment. http://archive.ibmsystemsmag.com/aix/administrator/performance/debugging-me…

1 0

AIX:stunnel core dumping
by Gerald Shaw 24 Sep '19

24 Sep '19

Hello, We are running stunnel-5.49-1.ppc on AIX 7100-05-03-1846. It will stay up awhile and our connection tests work, but it core dumps. Here’s the message in the log file. Thoughts? INTERNAL ERROR: Out of memory at s3_both.c, line 626 Best, Gerald Shaw

1 0

Cannot create .crt file
by John Khoo 24 Sep '19

24 Sep '19

Hi, I am new to STunnel. I come to know STunnel thru this link: http://www.ibphoenix.com/downloads/Secure_connections_to_Firebird_with_Stun… Based on the instruction, I tried create a certificate using this line below: openssl ca -config "C:\Program Files (x86)\stunnel\config\openssl.conf" -policy policy_anything -notext -in C:\CA\temp\vnc_server\server.req -out C:\CA\temp\vnc_server\server.crt However, no crt file is created and no error is prompted. I hope that someone can help me. Thanks.

1 0

Stunnel and Sophos UTM
by James Brown 20 Sep '19

20 Sep '19

Has anybody been able to use stunnel to update the Sophos UTM’s firewall? I know it has a Restful API , but do not know how to use this with stunnel. https://www.sophos.com/en-us/medialibrary/PDFs/documentation/UTMonAWS/Sopho… <https://www.sophos.com/en-us/medialibrary/PDFs/documentation/UTMonAWS/Sopho…> Any experiences or suggestions? Thanks, James.

2 1

Re: [stunnel-users] Stunnel help and guidance request
by Noonan, M.P. (Mike) 19 Sep '19

19 Sep '19

Hi Gerald, I assume you got stunnel from the oss4aix.org site. We don't use the freeware openssl, but instead the IBM one: [root@duist:/data/O01] lslpp -l | grep openssl openssl.base 1.0.2.1801 COMMITTED Open Secure Socket Layer openssl.license 1.0.2.1801 COMMITTED Open Secure Socket License openssl.man.en_US 1.0.2.1801 COMMITTED Open Secure Socket Layer openssl.base 1.0.2.1801 COMMITTED Open Secure Socket Layer I installed stunnel-5.29 on one of our lpars which I forced with -nodeps: rpm -Uhv --nodeps stunnel-5.29-1.aix5.2.ppc.rpm It picked up the IBM libs, but had the same problem... [root@duist:/data/O01] ldd /usr/bin/stunnel /usr/bin/stunnel needs: /usr/lib/threads/libc.a(shr.o) /usr/lib/libpthreads.a(shr_comm.o) /usr/lib/libpthreads.a(shr_xpg5.o) /usr/lib/libcrypto.a(libcrypto.so.1.0.2) /usr/lib/libssl.a(libssl.so.1.0.2) /unix /usr/lib/libcrypt.a(shr.o) [root@duist:/data/O01] /usr/bin/stunnel Could not load program /usr/bin/stunnel: Symbol resolution failed for stunnel because: Symbol strcmp (number 112) is not exported from dependent module /usr/lib/libcrypto.a(libcrypto.so.1.0.2). Symbol memmove (number 137) is not exported from dependent module /usr/lib/libcrypto.a(libcrypto.so.1.0.2). Symbol strncpy (number 142) is not exported from dependent module /usr/lib/libcrypto.a(libcrypto.so.1.0.2). Symbol strcpy (number 169) is not exported from dependent module /usr/lib/libcrypto.a(libcrypto.so.1.0.2). Symbol bcopy (number 245) is not exported from dependent module /usr/lib/libcrypto.a(libcrypto.so.1.0.2). I then downloaded and installed stunnel-5.49 from oss4aix.org and installed that version which worked fine.. [root@duist:/data/O01] /usr/bin/stunnel [ ] Clients allowed=31999 [.] stunnel 5.49 on powerpc-ibm-aix5.2.0.0 platform [.] Compiled with OpenSSL 1.0.2p 14 Aug 2018 [.] Running with OpenSSL 1.0.2r 26 Feb 2019 [.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_Errno()) [!] Invalid configuration file name "/opt/freeware/etc/stunnel/stunnel.conf" [!] realpath: No such file or directory (2) [ ] Deallocating section defaults I expect that if you upgrade your freeware openssl to at least 1,0,2r and upgrade stunnel to 5.49 your problem should be solved. Met vriendelijke groet, Mike Noonan From: stunnel-users <mailto:[email protected]> On Behalf Of Gerald Shaw Sent: Wednesday, September 18, 2019 11:18 PM To: mailto:[email protected] Subject: [stunnel-users] Stunnel help and guidance request Hello all, I'm new to the mailing list. I'm trying to run stunnel-5.29-1.ppc, and I'm having issues. I'd appreciate your help (or point me to the solution in the archives). OS - AIX 7100-05-03-1846 /home/shawg# rpm -qa|grep -i openssl openssl-1.0.2n-1.ppc /home/shawg# ldd `which stunnel` /usr/bin/stunnel needs: /usr/lib/libc.a(shr.o) /usr/lib/libpthreads.a(shr_comm.o) /usr/lib/libpthreads.a(shr_xpg5.o) /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2) /opt/freeware/lib/libssl.a(libssl.so.1.0.2) /unix /usr/lib/libcrypt.a(shr.o) ** ERROR MESSAGE_- /home/shawg# /usr/bin/stunnel exec(): 0509-036 Cannot load program /usr/bin/stunnel because of the following errors: 0509-130 Symbol resolution failed for stunnel because: 0509-136 Symbol strcmp (number 112) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-136 Symbol memmove (number 137) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-136 Symbol strncpy (number 142) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-136 Symbol strcpy (number 169) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-136 Symbol bcopy (number 245) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-192 Examine .loader section symbols with the 'dump -Tv' command. *** echo $LIBPATH /opt/freeware/lib:/usr/lib ________________________________ Dit e-mailbericht is alleen bestemd voor de geadresseerden. Indien dit bericht niet voor u is bedoeld, wordt u verzocht de afzender hiervan op de hoogte te stellen door het bericht te retourneren en de inhoud niet te gebruiken. This e-mail message is intended to be exclusively for the addressee. If you are not the intended recipient you are kindly requested not to make any use whatsoever of the contents and to notify the sender immediately by returning this e-mail message.

2 1

Stunnel help and guidance request
by Gerald Shaw 18 Sep '19

18 Sep '19

Hello all, I’m new to the mailing list. I’m trying to run stunnel-5.29-1.ppc, and I’m having issues. I’d appreciate your help (or point me to the solution in the archives). OS - AIX 7100-05-03-1846 /home/shawg# rpm -qa|grep -i openssl openssl-1.0.2n-1.ppc /home/shawg# ldd `which stunnel` /usr/bin/stunnel needs: /usr/lib/libc.a(shr.o) /usr/lib/libpthreads.a(shr_comm.o) /usr/lib/libpthreads.a(shr_xpg5.o) /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2) /opt/freeware/lib/libssl.a(libssl.so.1.0.2) /unix /usr/lib/libcrypt.a(shr.o) ** ERROR MESSAGE_- /home/shawg# /usr/bin/stunnel exec(): 0509-036 Cannot load program /usr/bin/stunnel because of the following errors: 0509-130 Symbol resolution failed for stunnel because: 0509-136 Symbol strcmp (number 112) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-136 Symbol memmove (number 137) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-136 Symbol strncpy (number 142) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-136 Symbol strcpy (number 169) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-136 Symbol bcopy (number 245) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-192 Examine .loader section symbols with the 'dump -Tv' command. *** echo $LIBPATH /opt/freeware/lib:/usr/lib ** I’d appreciate any help or guidance. Thanks in advance. R, G. Shaw

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 182, Issue 7
by Brent Kimberley 18 Sep '19

18 Sep '19

>> 2019.09.16 13:36:28 LOG6[3]: PSK identity not found (session resumption?)Try dumping the symbols for ctx.c::psk_find(), ssl_lib.c::SSL_get_ex_data(), and ctx.c:: psk_server_callback(). Date: Tue, 17 Sep 2019 18:18:13 +0200 From: Hannah Koperberg <hannah.koperberg(a)gmail.com> Subject: [stunnel-users] Problems when using PSK between a version of stunnel usingopenssl 1.0 and a version of stunnel using openssl 1.1.1 We encounter problems when using PSK between a version of stunnel using openssl 1.0 and a version of stunnel using openssl 1.1.1 The problem being the following: 2019.09.16 13:36:28 LOG6[3]: PSK identity not found (session resumption?) 2019.09.16 13:36:28 LOG7[3]: TLS alert (write): fatal: unknown PSK identity 2019.09.16 13:36:28 LOG3[3]: SSL_accept: s3_srvr.c:2845: error:1408B0DF:SSL routines:ssl3_get_client_key_exchange:psk identity not found No problems are encountered when using certificates or when the same versions of stunnel and openssl are used. In the latter case neither certificates nor PSK give any problems connecting. Kind regards, Hannah Koperberg, de Volksbank in the Netherlands

1 1

openssl inquiry
by Brent Kimberley 16 Sep '19

16 Sep '19

Can someone please walk me through how to replace 1.1.1c with 1.1.1d ? For example: 1. Download from SLP https://github.com/slproweb/opensslhashes/ 2. Extract & overwrite

1 0

TR: using sTunnel with Chrome (Pierre DUPONT)
by Brent Kimberley 06 Sep '19

06 Sep '19

Dump your stunnel.crt file. <stunnel_home>/bin/openssl x509 -in stunnel.crt -noout -text And, compare with * section 4 of https://tools.ietf.org/html/rfc5280 * Peer-reviewed public sites. https://www.ssllabs.com/ssltest/ Dump your stunnel.cnf file. And, compare with stunnel_home>/config/openssl.cnf file https://access.redhat.com/solutions/28965 https://www.openssl.org/docs/manmaster/man5/x509v3_config.html ---------------------------------------------------------------------- From: Pierre DUPONT <pierre.dupont(a)nedap.fr> De : Pierre DUPONT Envoy? : jeudi 5 septembre 2019 16:55 Cc : _sav.bibli <sav.bibli(a)nedap.fr>; Philippe ANQUETIN <philippe.anquetin(a)nedap.fr> Objet : using sTunnel with Chrome Good day to all. So far, I can't succeed to use Chrome with sTunnel. Here is my configuration for sTunnel.... However, I cannot connect on https I tried several things found browsing the list, like building a certificate with openssl req -new -x509 -days 365 -nodes -config stunnel.cnf -out stunnel.crt -keyout stunnel.crt No result so the only solution I see now is to call you for some help... With kind regards, Cordiales salutations de Pierre Dupont Support S.A.V. & D?veloppement Biblioth?ques Courriel S.A.V. : sav.bibli(a)nedap.fr<mailto:[email protected]> 06 13 99 69 38 - 01.61.03.03 18 8/10 Chemin d'Andr?sy 95610 Eragny sur Oise NEDAP LOGO

1 0

TR: using sTunnel with Chrome
by Pierre DUPONT 06 Sep '19

06 Sep '19

De : Pierre DUPONT Envoyé : jeudi 5 septembre 2019 16:55 À : 'stunnel-users(a)stunnel.org' <stunnel-users(a)stunnel.org> Cc : _sav.bibli <sav.bibli(a)nedap.fr>; Philippe ANQUETIN <philippe.anquetin(a)nedap.fr> Objet : using sTunnel with Chrome Good day to all. So far, I can't succeed to use Chrome with sTunnel. I use these versions sTunnel : 5.55 (downloaded today...) Chrome is 76.0.3809 132 [cid:[email protected]] Here is my configuration for sTunnel : ; Sample stunnel configuration file for Win32 by Michal Trojnara 2002-2019 ; Some options used here may be inadequate for your particular configuration ; This sample file does *not* represent stunnel.conf defaults ; Please consult the manual for detailed description of available options ; ************************************************************************** ; * Global options * ; ************************************************************************** ; Debugging stuff (may be useful for troubleshooting) ;debug = info ;output = stunnel.log ; Enable FIPS 140-2 mode if needed for compliance ;fips = yes ; Microsoft CryptoAPI engine allows for authentication with private keys ; stored in the Windows certificate store ; Each section using this feature also needs the "engineId = capi" option ;engine = capi ; You also need to disable TLS 1.2 or later, because the CryptoAPI engine ; currently does not support PSS ;sslVersionMax = TLSv1.1 ; The pkcs11 engine allows for authentication with cryptographic ; keys isolated in a hardware or software token ; MODULE_PATH specifies the path to the pkcs11 module shared library, ; e.g. softhsm2.dll or opensc-pkcs11.so ; Each section using this feature also needs the "engineId = pkcs11" option ;engine = pkcs11 ;engineCtrl = MODULE_PATH:softhsm2.dll ;engineCtrl = PIN:1234 ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Enable support for the insecure SSLv3 protocol ;options = -NO_SSLv3 ; These options provide additional security at some performance degradation ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; ************************************************************************** ; * Include all configuration file fragments from the specified folder * ; ************************************************************************** ;include = conf.d ; ************************************************************************** ; * Service definitions (at least one service has to be defined) * ; ************************************************************************** ; ***************************************** Example TLS client mode services [gmail-pop3] client = yes accept = 127.0.0.1:110 connect = pop.gmail.com:995 verifyChain = yes CAfile = ca-certs.pem checkHost = pop.gmail.com OCSPaia = yes [gmail-imap] client = yes accept = 127.0.0.1:143 connect = imap.gmail.com:993 verifyChain = yes CAfile = ca-certs.pem checkHost = imap.gmail.com OCSPaia = yes [gmail-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.gmail.com:465 verifyChain = yes CAfile = ca-certs.pem checkHost = smtp.gmail.com OCSPaia = yes ; Encrypted HTTP proxy authenticated with a client certificate ; located in the Windows certificate store ;[example-proxy] ;client = yes ;accept = 127.0.0.1:8080 ;connect = example.com:8443 ;engineId = capi ; Encrypted HTTP proxy authenticated with a client certificate ; located in a cryptographic token ;[example-pkcs11] ;client = yes ;accept = 127.0.0.1:8080 ;connect = example.com:8443 ;engineId = pkcs11 ;cert = pkcs11:token=MyToken;object=MyCert ;key = pkcs11:token=MyToken;object=MyKey ; ***************************************** Example TLS server mode services ;[pop3s] ;accept = 995 ;connect = 110 ;cert = stunnel.pem ;[imaps] ;accept = 993 ;connect = 143 ;cert = stunnel.pem ; Either only expose this service to trusted networks, or require ; authentication when relaying emails originated from loopback. ; Otherwise the following configuration creates an open relay. ;[ssmtp] ;accept = 465 ;connect = 25 ;cert = stunnel.pem ; TLS front-end to a web server [https] accept = 443 connect = 81 cert = stunnel.pem ; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SChannel ; Microsoft implementations do not use TLS close-notify alert and thus they ; are vulnerable to truncation attacks TIMEOUTclose = 0 ; Remote cmd.exe protected with PSK-authenticated TLS ; Create "secrets.txt" containing IDENTITY:KEY pairs ;[cmd] ;accept = 1337 ;exec = c:\windows\system32\cmd.exe ;execArgs = cmd.exe ;PSKsecrets = secrets.txt ; vim:ft=dosini The 81 connect port is used by our local webservice : http://localhost:81/nedaprfidwebservice.asmx which runs OK [cid:[email protected]] The problem is when I try to import the certificate. It looks OK giving these informations [cid:[email protected]] [cid:[email protected]] However, I cannot connect on https [cid:[email protected]] I tried several things found browsing the list, like building a certificate with openssl req -new -x509 -days 365 -nodes -config stunnel.cnf -out stunnel.crt -keyout stunnel.crt No result so the only solution I see now is to call you for some help... With kind regards, Cordiales salutations de Pierre Dupont Support S.A.V. & Développement Bibliothèques Courriel S.A.V. : sav.bibli(a)nedap.fr<mailto:[email protected]> Téléphone : 06 13 99 69 38 - 01.61.03.03 18 8/10 Chemin d'Andrésy 95610 Eragny sur Oise [NEDAP LOGO - INLINE - RGB]

1 0

High cpu usage 2016 server
by Cooper, Dave 02 Sep '19

02 Sep '19

Using latest version of stunnel. Running on 3 separate 2016 servers. On each server stunnel is consuming 40% of the cpu even though no end point is even connected. Sent from my iPhone ____________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________ ***MBS DISCLAIMER*** Multi-Bank Securities, Inc. (MBS) cannot be held responsible for errors regarding time and/or price on buy/sell requests via e-mail. Information provided in this email has been prepared from sources to be reliable, but is not guaranteed and is not a complete summary or statement of all data necessary for making an investment decision. This is for informational purposes only and does not constitute a recommendation, please confirm all information before investing. Securities discussed are subject to availability and change in price and yield. Changes to assumptions may have a material impact on returns. Past performance is not indicative of future returns. Additional information is available upon request. This email is intended only for the entity or person to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of this information by entities or persons other than the intended recipient is prohibited. If you receive this message in error, please contact the sender immediately and delete the material from your computer. If you no longer wish to receive e-mails from MBS, please forward this email to compliance(a)mbssecurities.com and place the word REMOVE in the subject line

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 181, Issue 3
by Eric Eberhard 28 Aug '19

28 Aug '19

No. If it ain’t broke, don’t fix it! Old saying but still relevant. The continual updates in all modern software may fix something – and another broken. IMO. I know I am a minority on this this group but an old tried and true setup has great value. Experience, reduces updates and adds to stability. We don’t change our code unless we must. We think it is more stable. Don’t listen to me if you are the type that must have every update ASAP Listen to me if you don’t need the latest and greatest and your app works properly. Study the new version and make a plan to move forward when the time is right. We often move forward to the previous stable release. Often months or even a year later. If the improvements are for things you don’t use, put them off. Look at exactly what the release notes say to help you decide if the update is worth it, you might find it improves only functionality you don’t use. It saves time and money and does not introduce new bugs. We use a very unpopular method – we use inetd. This releases you from all the server management code which is very very very hard to make work on all systems as they work so differently. We are on IBM with AIX (Unix). I doubt a lot of people are testing that configuration. Stunnel is very good at not requiring you to update one step at a time! You can skip safely. Enough blather. I am sure there are a lot of people that disagree with me. And they are likely correct in certain situations. We suggest you look at your situation and and see if you can skip releases … All opinion, not fact. I am old-school so keep that in mind! Good Luck, Eric From: Brent Kimberley [mailto:[email protected]] Sent: Wednesday, August 28, 2019 8:16 AM To: stunnel-users(a)stunnel.org; Eric Eberhard <flash(a)vicsmba.com> Cc: daniel.trickett(a)milliporesigma.com Subject: Re: [stunnel-users] stunnel-users Digest, Vol 181, Issue 3 Have you tried RFC8410? On Thursday, August 22, 2019, 04:00:43 p.m. EDT, Eric Eberhard <flash(a)vicsmba.com <mailto:[email protected]> > wrote: <snip>We use similar logic with one stunnel and have millions of transactions daily... [4+10+1 mil XML+web calls]. <snip>R

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 181, Issue 3
by Eric Eberhard 28 Aug '19

28 Aug '19

Thanks :) -- I think Daniel can solve his problem. If for some reason he cannot make the app server output clear text he has to do it as you laid out. If he can, he can do one stunnel with TLSv1.2 by making the app output clear text. Both will work and should be secure. I’d do the latter is possible – way less overhead doing encryption. We use similar logic with one stunnel and have millions of transactions daily (XML not cXML but that does not matter – ours are often fairly large as in 100s of MB). Encrypting clear to SSLv3 then back to clear to TLSv1.2 is three encryptions along that path instead of one by making the app output clear text. The app will also shrink if that matters as it won’t need encryption code. E From: stunnel-users [mailto:[email protected]] On Behalf Of Brent Kimberley Sent: Thursday, August 22, 2019 7:29 AM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] stunnel-users Digest, Vol 181, Issue 3 >>there is no reason to connect to localhost with any security Should server/interface consolidation trigger functional/technical rework prior to go live? As per the diagram: the app server node x TLS engine node interface is wrapped in SSL the internal localhost x localhost interface is in the clear the TLS engine node x punchout-vendor node is wrapped in TLSv1.2 >> SNI flag (RFC 3546) Good catch. ---------------------------------------------------------------------- Message: 1 Date: Wed, 21 Aug 2019 08:01:08 -0700 From: "Eric Eberhard" <flash(a)vicsmba.com <mailto:[email protected]> > To: "'Brent Kimberley'" <brent_kimberley(a)rogers.com <mailto:[email protected]> >, <stunnel-users(a)stunnel.org <mailto:[email protected]> > Thank you -- what I had in mind but I am not that fancy with the setups as we use one. We go from our application in clear text to stunnel TLSv1.2 which is clearly easier. I did make this work for a short while a long time ago and did not save the files. Plus no may people's horror we use inetd. Of course we only transfer 4 million XML docs per day and handle 10 million Web calls and another million connections for credit cards, etc. I have been told that if I had serious volume inetd is slower -:) but I have not noticed enough of a slowdown to matter. And inetd (at least on an IBM AIX server) is dead reliable and easy. As a curiosity -- as I often see people coding unnecessarily -- there is no reason to connect to localhost with any security at all unless your app can only output SSLv3 which would imply a 3rd party vendor. The traffic never hits the network in any way -- not even the network card -- it goes directly to/from the TCP/IP stack which is why I mentioned just making the app send clear text to one stunnel that outputs TLSv1.2 ... if possible (may not be if it is something you don't have source to). Eric -----Original Message----- From: Brent Kimberley [mailto:[email protected] <mailto:[email protected]> ] Sent: Tuesday, August 20, 2019 6:42 AM To: stunnel-users(a)stunnel.org <mailto:[email protected]> Cc: daniel.trickett(a)milliporesigma.com <mailto:[email protected]> ; flash(a)vicsmba.com <mailto:[email protected]> Subject: Re: stunnel-users Digest, Vol 181, Issue 1 Your mileage may vary. ############################################################################### # From internal application to external host ############################################################################### # [Int_Init] -> [Int_Term] -> [Ext_Init] -> [Ext_Term] ############################################################################### # [internal_initiator] ---ssl---> [Internal terminator] # [Internal terminator] ---http---> [external Initiator] # [external Initiator] ---tls---> [external terminator] ############################################################################### # https://www.stunnel.org/static/stunnel.html <https://www.stunnel.org/static/stunnel.html%20> ############################################################################### [Internal_Terminator] options = SSLv3 client = no accept = host_ip:443 connect = localhost:54321 CAfile = int_init_wallet.pem cert = int_term_pub.pem key = int_term_priv.pem [External_Initiator] options = SINGLE_ECDH_USE options = SINGLE_DH_USE ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256 verify = 3? client = yes options = TLSv1.2 accept = localhost:54321 connect = externalhostname:443 verifyChain = yes renegotiation = no CAfile = ext_term_wallet.pem cert = ext_init_pub.pem key = ext_init_priv.pem ---------------------------------------------------------------------- Date: Mon, 19 Aug 2019 18:21:18 +0000 From: Daniel Trickett <daniel.trickett(a)milliporesigma.com <mailto:[email protected]> > To: "stunnel-users(a)stunnel.org <mailto:[email protected]> " <stunnel-users(a)stunnel.org <mailto:[email protected]> > Subject: [stunnel-users] https to https proxy Hi, Our punchout vendor switched their site to only accept tls 1.2 over the weekend. Unfortunately our application will only support SSL. We are using stunnel with other vendors but can control the inbound host name. This recent one is one we can't manage as it is the software provider. I found a solution for doing https to https. I'm unclear how I get the first https traffic to route to stunnel as the initial call will be from the application will be to the external host.. Any thoughts on whether this would work for my situation? Appreciate any thoughts.. [Tunnel_in] client = yes accept = host_ip:443 connect = localhost:54321 [Tunnel_out] client = no accept = localhost:54321 connect = externalhostname:443 Best regards, Dan

3 2

Re: [stunnel-users] stunnel-users Digest, Vol 181, Issue 3
by Brent Kimberley 22 Aug '19

22 Aug '19

>>there is no reason to connect to localhost with any security Should server/interface consolidation trigger functional/technical rework prior to go live? As per the diagram: the app server node x TLS engine node interface is wrapped in SSL the internal localhost x localhost interface is in the clear the TLS engine node x punchout-vendor node is wrapped in TLSv1.2 >> SNI flag (RFC 3546)Good catch. ---------------------------------------------------------------------- Message: 1 Date: Wed, 21 Aug 2019 08:01:08 -0700 From: "Eric Eberhard" <flash(a)vicsmba.com> To: "'Brent Kimberley'" <brent_kimberley(a)rogers.com>, <stunnel-users(a)stunnel.org> Thank you -- what I had in mind but I am not that fancy with the setups as we use one. We go from our application in clear text to stunnel TLSv1.2 which is clearly easier. I did make this work for a short while a long time ago and did not save the files. Plus no may people's horror we use inetd. Of course we only transfer 4 million XML docs per day and handle 10 million Web calls and another million connections for credit cards, etc. I have been told that if I had serious volume inetd is slower -:) but I have not noticed enough of a slowdown to matter. And inetd (at least on an IBM AIX server) is dead reliable and easy. As a curiosity -- as I often see people coding unnecessarily -- there is no reason to connect to localhost with any security at all unless your app can only output SSLv3 which would imply a 3rd party vendor. The traffic never hits the network in any way -- not even the network card -- it goes directly to/from the TCP/IP stack which is why I mentioned just making the app send clear text to one stunnel that outputs TLSv1.2 ... if possible (may not be if it is something you don't have source to). Eric -----Original Message----- From: Brent Kimberley [mailto:[email protected]] Sent: Tuesday, August 20, 2019 6:42 AM To: stunnel-users(a)stunnel.org Cc: daniel.trickett(a)milliporesigma.com; flash(a)vicsmba.com Subject: Re: stunnel-users Digest, Vol 181, Issue 1 Your mileage may vary. ############################################################################### # From internal application to external host ############################################################################### # [Int_Init] -> [Int_Term] -> [Ext_Init] -> [Ext_Term] ############################################################################### # [internal_initiator] ---ssl---> [Internal terminator] # [Internal terminator] ---http---> [external Initiator] # [external Initiator] ---tls---> [external terminator] ############################################################################### # https://www.stunnel.org/static/stunnel.html ############################################################################### [Internal_Terminator] options = SSLv3 client = no accept = host_ip:443 connect = localhost:54321 CAfile = int_init_wallet.pem cert = int_term_pub.pem key = int_term_priv.pem [External_Initiator] options = SINGLE_ECDH_USE options = SINGLE_DH_USE ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256 verify = 3? client = yes options = TLSv1.2 accept = localhost:54321 connect = externalhostname:443 verifyChain = yes renegotiation = no CAfile = ext_term_wallet.pem cert = ext_init_pub.pem key = ext_init_priv.pem ---------------------------------------------------------------------- Date: Mon, 19 Aug 2019 18:21:18 +0000 From: Daniel Trickett <daniel.trickett(a)milliporesigma.com> To: "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Subject: [stunnel-users] https to https proxy Hi, Our punchout vendor switched their site to only accept tls 1.2 over the weekend. Unfortunately our application will only support SSL. We are using stunnel with other vendors but can control the inbound host name. This recent one is one we can't manage as it is the software provider. I found a solution for doing https to https. I'm unclear how I get the first https traffic to route to stunnel as the initial call will be from the application will be to the external host.. Any thoughts on whether this would work for my situation? Appreciate any thoughts.. [Tunnel_in] client = yes accept = host_ip:443 connect = localhost:54321 [Tunnel_out] client = no accept = localhost:54321 connect = externalhostname:443 Best regards, Dan

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 181, Issue 1
by Eric Eberhard 21 Aug '19

21 Aug '19

Thank you -- what I had in mind but I am not that fancy with the setups as we use one. We go from our application in clear text to stunnel TLSv1.2 which is clearly easier. I did make this work for a short while a long time ago and did not save the files. Plus no may people's horror we use inetd. Of course we only transfer 4 million XML docs per day and handle 10 million Web calls and another million connections for credit cards, etc. I have been told that if I had serious volume inetd is slower -:) but I have not noticed enough of a slowdown to matter. And inetd (at least on an IBM AIX server) is dead reliable and easy. As a curiosity -- as I often see people coding unnecessarily -- there is no reason to connect to localhost with any security at all unless your app can only output SSLv3 which would imply a 3rd party vendor. The traffic never hits the network in any way -- not even the network card -- it goes directly to/from the TCP/IP stack which is why I mentioned just making the app send clear text to one stunnel that outputs TLSv1.2 ... if possible (may not be if it is something you don't have source to). Eric -----Original Message----- From: Brent Kimberley [mailto:[email protected]] Sent: Tuesday, August 20, 2019 6:42 AM To: stunnel-users(a)stunnel.org Cc: daniel.trickett(a)milliporesigma.com; flash(a)vicsmba.com Subject: Re: stunnel-users Digest, Vol 181, Issue 1 Your mileage may vary. ############################################################################### # From internal application to external host ############################################################################### # [Int_Init] -> [Int_Term] -> [Ext_Init] -> [Ext_Term] ############################################################################### # [internal_initiator] ---ssl---> [Internal terminator] # [Internal terminator] ---http---> [external Initiator] # [external Initiator] ---tls---> [external terminator] ############################################################################### # https://www.stunnel.org/static/stunnel.html ############################################################################### [Internal_Terminator] options = SSLv3 client = no accept = host_ip:443 connect = localhost:54321 CAfile = int_init_wallet.pem cert = int_term_pub.pem key = int_term_priv.pem [External_Initiator] options = SINGLE_ECDH_USE options = SINGLE_DH_USE ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256 verify = 3? client = yes options = TLSv1.2 accept = localhost:54321 connect = externalhostname:443 verifyChain = yes renegotiation = no CAfile = ext_term_wallet.pem cert = ext_init_pub.pem key = ext_init_priv.pem ---------------------------------------------------------------------- Date: Mon, 19 Aug 2019 18:21:18 +0000 From: Daniel Trickett <daniel.trickett(a)milliporesigma.com> To: "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Subject: [stunnel-users] https to https proxy Hi, Our punchout vendor switched their site to only accept tls 1.2 over the weekend. Unfortunately our application will only support SSL. We are using stunnel with other vendors but can control the inbound host name. This recent one is one we can't manage as it is the software provider. I found a solution for doing https to https. I'm unclear how I get the first https traffic to route to stunnel as the initial call will be from the application will be to the external host.. Any thoughts on whether this would work for my situation? Appreciate any thoughts.. [Tunnel_in] client = yes accept = host_ip:443 connect = localhost:54321 [Tunnel_out] client = no accept = localhost:54321 connect = externalhostname:443 Best regards, Dan

1 0

Re: [stunnel-users] https to https proxy
by Eric Eberhard 20 Aug '19

20 Aug '19

I'll bite - probably missing something. Why not have your application output clear text to stunnel and set stunnel to TLSv1.2? In other words, drop the SSL from your application. If that won't work I think you can do it with two stunnels (I got it to work once before I did the above). One accepts SSLv3 and outputs clear text . it is the client=no option. The output goes to a stunnel that is client=yes and is set to TLSv1.2 . which outputs to your final destination. The output from the client=no would be to localhost on some port that fires the second stunnel. I suspect you have to use different port numbers. All guesses as I am not sure exactly what you are doing . but if it helps, great :) Eric From: stunnel-users [mailto:[email protected]] On Behalf Of Daniel Trickett Sent: Monday, August 19, 2019 11:21 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] https to https proxy Hi, Our punchout vendor switched their site to only accept tls 1.2 over the weekend. Unfortunately our application will only support SSL. We are using stunnel with other vendors but can control the inbound host name. This recent one is one we can't manage as it is the software provider. I found a solution for doing https to https. I'm unclear how I get the first https traffic to route to stunnel as the initial call will be from the application will be to the external host.. Any thoughts on whether this would work for my situation? Appreciate any thoughts.. [Tunnel_in] client = yes accept = host_ip:443 connect = localhost:54321 [Tunnel_out] client = no accept = localhost:54321 connect = externalhostname:443 Best regards, Dan

2 1

Re: [stunnel-users] stunnel-users Digest, Vol 181, Issue 1
by Brent Kimberley 20 Aug '19

20 Aug '19

Your mileage may vary. ############################################################################### # From internal application to external host ############################################################################### # [Int_Init] -> [Int_Term] -> [Ext_Init] -> [Ext_Term] ############################################################################### # [internal_initiator] ---ssl---> [Internal terminator] # [Internal terminator] ---http---> [external Initiator] # [external Initiator] ---tls---> [external terminator] ############################################################################### # https://www.stunnel.org/static/stunnel.html ############################################################################### [Internal_Terminator] options = SSLv3 client = no accept = host_ip:443 connect = localhost:54321 CAfile = int_init_wallet.pem cert = int_term_pub.pem key = int_term_priv.pem [External_Initiator] options = SINGLE_ECDH_USE options = SINGLE_DH_USE ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256 verify = 3? client = yes options = TLSv1.2 accept = localhost:54321 connect = externalhostname:443 verifyChain = yes renegotiation = no CAfile = ext_term_wallet.pem cert = ext_init_pub.pem key = ext_init_priv.pem ---------------------------------------------------------------------- Date: Mon, 19 Aug 2019 18:21:18 +0000 From: Daniel Trickett <daniel.trickett(a)milliporesigma.com> To: "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Subject: [stunnel-users] https to https proxy Hi, Our punchout vendor switched their site to only accept tls 1.2 over the weekend. Unfortunately our application will only support SSL. We are using stunnel with other vendors but can control the inbound host name. This recent one is one we can't manage as it is the software provider. I found a solution for doing https to https. I'm unclear how I get the first https traffic to route to stunnel as the initial call will be from the application will be to the external host.. Any thoughts on whether this would work for my situation? Appreciate any thoughts.. [Tunnel_in] client = yes accept = host_ip:443 connect = localhost:54321 [Tunnel_out] client = no accept = localhost:54321 connect = externalhostname:443 Best regards, Dan

1 0

https to https proxy
by Daniel Trickett 19 Aug '19

19 Aug '19

Hi, Our punchout vendor switched their site to only accept tls 1.2 over the weekend. Unfortunately our application will only support SSL. We are using stunnel with other vendors but can control the inbound host name. This recent one is one we can't manage as it is the software provider. I found a solution for doing https to https. I'm unclear how I get the first https traffic to route to stunnel as the initial call will be from the application will be to the external host.. Any thoughts on whether this would work for my situation? Appreciate any thoughts.. [Tunnel_in] client = yes accept = host_ip:443 connect = localhost:54321 [Tunnel_out] client = no accept = localhost:54321 connect = externalhostname:443 Best regards, Dan

1 0

Working OCSP example instructions?
by Mark Currie 24 Jul '19

24 Jul '19

Hi, Does anyone have a link to detailed instructions of a working example of Stunnel with OCSP? (including certificate creation if possible) I came across one some time back but can no longer find it. I would greatly appreciate any help with this. I wasn't able to get any replies to my earlier posting showing my problem: https://www.stunnel.org/pipermail/stunnel-users/2019-July/006451.html

1 0

Is there a latest version Debian stunnel package?
by Miranda Zhang 23 Jul '19

23 Jul '19

Hi everyone, I can only find stunnel4 Debian package: https://packages.debian.org/search?keywords=stunnel https://debian.pkgs.org/10/debian-main-amd64/stunnel4_5.50-3_amd64.deb.html ftp://ftp.stunnel.org/stunnel/archive/5.x/stunnel4_5.28-0ubuntu1_amd64.deb <ftp://ftp.stunnel.org/stunnel/archive/5.x/> Is there a 5.55 package? Thanks, Miranda

2 1

Multiple certificates with same hash
by Marco Göbel 23 Jul '19

23 Jul '19

Hi, we use c_rehash to upgrade client certificates and we have multiple certificates with the same hash (e.g. same subject but different start-/end validity) like: ee98f073.0 ee98f073.1 ee98f073.2 The man-page description for the CApath option seems to be correct what stunnel will do: >Note that the certificates in this directory should be named XXXXXXXX.0 >where XXXXXXXX is the hash value of the DER encoded subject of the cert. It seems only certificates with the ending .0 is used by stunnel and the others certificate hashes with higher numbers are never used/read. Can you confirm? Any idea how to use all certificates with stunnel? BTW. we tested with version 4.56 and latest 5.5 Regards, Marco

1 0

Multi-Mode-Stunnel
by MESSINGSCHLAGER Andreas 17 Jul '19

17 Jul '19

Is it possible to run stunnel in the server-mode und in the client-mode on the same server? ------------------------------------------------------ ADG Apotheken-Dienstleistungsgesellschaft mbH Salzachstrasse 15 D-68199 Mannheim ADG ist Gesamt-Sieger der "markt intern" Umfragen "Apotheken - Software 2009, 2011, 2013, 2016 & 2018". Sitz: Mannheim Registergericht: Amtsgericht Mannheim HRB 701436 USt.-IdNr.: DE132763561 Geschaeftsfuehrer: Joachim von Morstein, Bernd Hess, Dr. Max Schwesig Diese E-Mail und alle Anhaenge enthalten vertrauliche und rechtlich geschuetzte Informationen, die ausschliesslich fuer den Gebrauch des Adressaten bestimmt sind. Das unerlaubte Kopieren, die unbefugte Weitergabe oder sonstiger ungenehmigter Gebrauch der E-Mail nebst den Anhaengen sind nicht gestattet. Sollten Sie nicht der richtige Adressat sein oder die E-Mail irrtuemlich erhalten haben, informieren Sie bitte den Absender unverzueglich telefonisch oder per E-Mail und vernichten diese E-Mail und alle Anhaenge sowie etwaige Kopien und Sicherungskopien. Vielen Dank. This e-mail message and all attachments transmitted with it may contain legally privileged and confidential information intended solely for the use of the addressee. If you are not the intended recipient or have received this e-mail in error, you are hereby notified that any dissemination, distribution, copying, or other use of this message or its attachments is strictly prohibited. If you have received this message in error, please notify the sender immediately by telephone or by electronic mail, and delete this message and all copies and backups thereof. Thank you. ------------------------------------------------------

3 2

feature ? authorizing only given certificates ?
by fmgre-dell＠yahoo.fr 15 Jul '19

15 Jul '19

Hello My european organization is using a certificate chain which signs tens of thousands of user certificates. My local organization counts 300 users ... and i only want these 300 to get in the IT system. I'd like to know if there is a way to restrict the connection to a subset of certificates ( for example based on a list of authorized emails which are written in the certificate ) Sincerely Fred

3 4

Possible to verify client certificate BUT ignore expiration-date?
by Brent Kimberley 11 Jul '19

11 Jul '19

Would libfaketime or run_as_date help? Date: Thu, 11 Jul 2019 10:48:39 -0400 From: Christopher Schultz <chris(a)christopherschultz.net> To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Possible to verify client certificate BUT ignore expiration-date? Eric, (Coming back to this.) On 5/14/19 14:41, Eric Eberhard wrote: > Chris, > > There are "real" certificates you purchase from a certificate authority and pay an annual fee. If this is https you pretty much need that or the user gets errors. By private I meant "self signed." > > However, openssl has an option to create a certificate. You type the name, address, whatever, and it makes a certificate. It is JUST AS GOOD as a purchased certificate (except https or perhaps others that want certificate authority certificates). I use them for FTP and SSH and many things . > > openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 > > You can put your own expire date(days) when you make the cert. A screen will come up and ask 20 questions :-) If you cannot do it (don't have openssl installed) I can do it for you. It certainly will work as a stop-gap. We don't need it for https as it is Apache on a machine that is hosted. So... everything above is exactly what we do with this vendor. We don't have a problem getting a well-known-CA to sign the certificate. We have (had) a problem with the vendor just getting the damned work done. Yes, I know it is a 5-minute process but when you are dealing with a big company where you have to have 6 managers in multiple time zones call each other to confirm the problem, have a meeting about the solution, determine a course of action, allocate a resource to perform the work, QA the solution, then get an IT review of everything before placing something into production, that 5-minute fix can take days or weeks. I just wanted to say "I still trust this certificate, even though it has expired." Is that possible to do without recompiling stunnel? Thanks, -chris

1 0

Re: [stunnel-users] Possible to verify client certificate BUT ignore expiration-date?
by Christopher Schultz 11 Jul '19

11 Jul '19

Eric, (Coming back to this.) On 5/14/19 14:41, Eric Eberhard wrote: > Chris, > > There are "real" certificates you purchase from a certificate authority and pay an annual fee. If this is https you pretty much need that or the user gets errors. By private I meant "self signed." > > However, openssl has an option to create a certificate. You type the name, address, whatever, and it makes a certificate. It is JUST AS GOOD as a purchased certificate (except https or perhaps others that want certificate authority certificates). I use them for FTP and SSH and many things . > > openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 > > You can put your own expire date(days) when you make the cert. A screen will come up and ask 20 questions :-) If you cannot do it (don't have openssl installed) I can do it for you. It certainly will work as a stop-gap. We don't need it for https as it is Apache on a machine that is hosted. So... everything above is exactly what we do with this vendor. We don't have a problem getting a well-known-CA to sign the certificate. We have (had) a problem with the vendor just getting the damned work done. Yes, I know it is a 5-minute process but when you are dealing with a big company where you have to have 6 managers in multiple time zones call each other to confirm the problem, have a meeting about the solution, determine a course of action, allocate a resource to perform the work, QA the solution, then get an IT review of everything before placing something into production, that 5-minute fix can take days or weeks. I just wanted to say "I still trust this certificate, even though it has expired." Is that possible to do without recompiling stunnel? Thanks, -chris > -----Original Message----- > From: stunnel-users [mailto:[email protected]] On Behalf Of Christopher Schultz > Sent: Tuesday, May 14, 2019 6:49 AM > To: stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] Possible to verify client certificate BUT ignore expiration-date? > > Eric, > > On 5/13/19 18:06, Eric Eberhard wrote: >> Use openssl to make a private cert? > > What is a "private cert"? > > Also, I need to trust an existing certificate... If they can create a new certificate, then I can just trust the new one. I'm looking for a stop-gap measure, here. > > Thanks, > -chris > >> -----Original Message----- >> From: stunnel-users [mailto:[email protected]] On >> Behalf Of Christopher Schultz >> Sent: Monday, May 13, 2019 2:28 PM >> To: stunnel-users(a)stunnel.org >> Subject: [stunnel-users] Possible to verify client certificate BUT ignore expiration-date? >> >> All, >> >> Does anyone know if it is possible to perform all other verification of a client certificate EXCEPT allow the certificate to have expired? >> >> We have a vendor whose certificate has expired, and we want to allow >> their old certificate to work while they chase their tails trying to >> figure out the best way to re-issue a new cert for us. *eyeroll* >> >> Is it possible? >> >> Thanks, >> -chris >> >> >> >> > > >

1 0

OCSP problem - wrong cert validated
by Mark Currie 11 Jul '19

11 Jul '19

Hi, I am having a problem using OCSP with Stunnel. client: stunnel-5.55, server: stunnel-5.49, both using openssl-1.0.2k-fips. When I use the openssl ocsp command it works fine e.g.: openssl ocsp -issuer idca-rootca.pem -CAfile idca-rootca.pem -cert server-cert.pem -url http://10.0.0.166:40040 Response verify OK server-cert.pem: good Wireshark: OCSP request contains the server cert serial number, and OCSP response returns "certStatus: good(0)". However, when I use Stunnel the OCSP lookup fails (Connection reset by peer), and in the Stunnel log I get: LOG3[0]: OCSP: OCSP_basic_verify: ocsp_vfy.c:166: error:27069070:OCSP routines:OCSP_basic_verify:root ca not trusted Wireshark: OCSP request now contains the issuer (idca) instead of the server cert serial number, and the OCSP response returns "certStatus: unknown (2)". I have tried various combinations of cert and CA pem files e.g. server cert on its own, then including idca, then including both idca and rootca. I have also tried all combinations of CA cert, even including all certs in it. I am testing Stunnel using SSH over TLS and here are the configs: Stunnel client config: [ssh] CAfile = idca-rootca.pem cert = client-cert.pem key = client-key.pem accept=40010 connect=10.0.0.166:40010 verifyPeer = yes OCSP = http://10.0.0.166:40040 Stunnel server config: [sshd] CAfile = idca-rootca.pem cert = server-cert.pem key = server-key.pem accept = 10.0.0.166:40010 connect = 22 Appreciate any help with this problem.

1 0

Academic doubt about firewall bypass
by Brent Kimberley 09 Jul '19

09 Jul '19

Which scenario did you have in mind? [HTTP CLIENT] -->[STUNNEL CLIENT]--><whatever>-->[STUNNEL SERVER]-->[HTTP Server] OR[HTTP Client] -->[Forward-proxy client]-> [STUNNEL CLIENT]--> <whatever>-->[STUNNEL SERVER]-->[REVERSE-PROXY server]--><whatever>--> [HTTP SERVER ] From: Hugo Marello <hugo.marello(a)gmail.com> To: stunnel-users(a)stunnel.org Hello guys, I'm new to using stunnel but I find it quite a powerful tool. I'm doing a POC on how we can bypass our firewall even with DPI, and chose to use stunnel for an extra layer of cryptography. You don't have to worry about access to any VM mentioned here. Here is my scenario: [CLIENT BROWSER] -->[STUNNEL CLIENT]-->[FIREWALL]-->[STUNNEL SERVER]-->[REVERSE PROXY]-->[FREE INTERNET] So far I succeeded in getting HTTP working using stunnel CONNECT protocol to the firewall and going all the way through. The problem is when I try to access HTTPS, the connection get set to the stunnel server but it keeps waiting for something. Double checked all the logs, firewall can't discern, stunnel server get the connection, reverse proxy also get the socket connection. My hypothesis is that stunnel client gets the CONNECT from the browser and discard it, it uses its own way to connect to the firewall, instead of encrypting the CONNECT all the way through. As it may seems, I need a way to send 2 CONNECT packages. Does anyone know how can I proceed? Follow my configs: client = yes output = /var/log/stunnel4/stunnel.log debug = 7 [bypassclient] accept = 4000 connect = firewall.example:3128 protocolHost = destination.com:443 protocol = connect requireCert = no verifyChain = no verifyPeer = no -------------------------------------------------------------------------------------------------------------------- [bypassserver] accept = 0.0.0.0:443 connect = reverseproxy.com:8888 cert = /etc/ssl/cert.pem key = /etc/ssl/key.pem ----------------------------------------------------------------------------------------------------------------------- Thank you all in advance, already digging throw the source code (quite lost tough), Hugo

1 1

Re: [stunnel-users] stunnel-users Digest, Vol 180, Issue 1
by Hugo Marello 09 Jul '19

09 Jul '19

I was thinking something more simple like the first scenario. [HTTP?CLIENT] -->[STUNNEL CLIENT]--><whatever>-->[STUNNEL SERVER]-->[HTTP Server] But the end would be an HTTPS server, which would require a CONNECT to get things going. So: [HTTP Client] -->[STUNNEL CLIENT]--> <whatever>-->[STUNNEL SERVER]-->[REVERSE-PROXY server]--> [HTTPS SERVER] Em ter, 9 de jul de 2019 às 07:00, <stunnel-users-request(a)stunnel.org> escreveu: > Send stunnel-users mailing list submissions to > stunnel-users(a)stunnel.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)stunnel.org > > You can reach the person managing the list at > stunnel-users-owner(a)stunnel.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. Academic doubt about firewall bypass (Brent Kimberley) > 2. How to turn off logging (David Yunker) > 3. Re: How to turn off logging (Thomas Eifert) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 8 Jul 2019 16:42:39 +0000 (UTC) > From: Brent Kimberley <brent_kimberley(a)rogers.com> > To: <stunnel-users(a)stunnel.org> > Cc: "hugo.marello(a)gmail.com" <hugo.marello(a)gmail.com> > Subject: [stunnel-users] Academic doubt about firewall bypass > Message-ID: <182803560.2815516.1562604159801(a)mail.yahoo.com> > Content-Type: text/plain; charset="utf-8" > > Which scenario did you have in mind? > [HTTP?CLIENT] -->[STUNNEL CLIENT]--><whatever>-->[STUNNEL SERVER]-->[HTTP > Server]?OR[HTTP Client] -->[Forward-proxy client]->?[STUNNEL CLIENT]--> > <whatever>-->[STUNNEL SERVER]-->[REVERSE-PROXY server]--><whatever>--> > [HTTP SERVER ] > > > > From: Hugo Marello <hugo.marello(a)gmail.com> > To: stunnel-users(a)stunnel.org > > Hello guys, > I'm new to using stunnel but I find it quite a powerful tool. I'm doing a > POC on how we can bypass our firewall even with DPI, and chose to use > stunnel for an extra layer of cryptography. You don't have to worry about > access to any VM mentioned here. Here is my scenario: > > [CLIENT BROWSER] -->[STUNNEL CLIENT]-->[FIREWALL]-->[STUNNEL > SERVER]-->[REVERSE PROXY]-->[FREE INTERNET] > > So far I succeeded in getting HTTP working using stunnel CONNECT protocol > to the firewall and going all the way through. The problem is when I try to > access HTTPS, the connection get set to the stunnel server but it keeps > waiting for something. Double checked all the logs, firewall can't discern, > stunnel server get the connection, reverse proxy also get the socket > connection. My hypothesis is that stunnel client gets the CONNECT from the > browser and discard it, it uses its own way to connect to the firewall, > instead of encrypting the CONNECT all the way through. As it may seems, I > need a way to send 2 CONNECT packages. Does anyone know how can I proceed? > > Follow my configs: > client = yes > output = /var/log/stunnel4/stunnel.log > debug = 7 > > [bypassclient] > accept = 4000 > connect = firewall.example:3128 > protocolHost = destination.com:443 > protocol = connect > requireCert = no > verifyChain = no > verifyPeer = no > > -------------------------------------------------------------------------------------------------------------------- > [bypassserver] > accept = 0.0.0.0:443 > connect = reverseproxy.com:8888 > cert = /etc/ssl/cert.pem > key = /etc/ssl/key.pem > > ----------------------------------------------------------------------------------------------------------------------- > > > Thank you all in advance, already digging throw the source code (quite lost > tough), > Hugo >

1 0

Re: [stunnel-users] Error during linking Stunnel 5.55
by Eric Eberhard 09 Jul '19

09 Jul '19

The whole 32 bit vs 64 bit thing is a pain. On Windows and Linux you have to load all kinds of unobvious things. On AIX it just works. Code from 1988 (when I lost source code for half a dozen programs) still works on current machines. Why the others make it SO HARD is beyond me. In AIX old code works. One flag – saying you want 64 bit – is all you need to add to the Makefile. Otherwise is just works as always. It took me MONTHS to figure out how to make Linuc work – had to yum 32 bit, 64 bit, a compat set, etc. Nightmare. Wish people would consider keeping things compatible like IBM does. Ditto on new features. Any new feature you merely need to add a flag, and all is good. Otherwise the old ones keep working. An example is POSIX. With IBM/AIX you could do things the old way, or set a flag for POSIX. Yes, we have had the same source (with updates, I did do the POSIX updates) since 1988. Never a problem. Partly, I think, because they don’t deprecate ANYTHING. Use the old routines if you like. Or not if you chose. Your problem is not having ALL of the required libraries! That is it. Finding what you need is the challenge. Eric From: stunnel-users [mailto:[email protected]] On Behalf Of Heinsbroek, Peter Sent: Tuesday, July 09, 2019 6:20 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Error during linking Stunnel 5.55 I tried to build stunnel from the sources. The compiling goes well ,but the linking gives an error When comping 32bit I get : sthreads.obj : error LNK2019: unresolved external symbol _CRYPTO_set_id_callback referenced in function _sthreads_init ..\bin\win32\stunnel.exe : fatal error LNK1120: 1 unresolved externals NMAKE : fatal error U1077: '"C:\Program Files (x86)\Microsoft Visual Studio\2017\Professional\VC\Tools\MSVC\14.16.27023\bin\HostX86\x86\link.EXE"' : return code '0x460' Stop. Anyone knows how to solve. Met vriendelijke groet, Peter Heinsbroek ICT Specialist – IDM TTS BTN/NL-TEC-Generic-Infra-S2 T: +31 (0) 88 265 9869 M: +31 (0) 6 53753244 Burg. Rijnderslaan 30 – Nederland <https://atos.net/> atos.net <https://www.linkedin.com/in/peter-heinsbroek-10467b52/> This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, Atos’ liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted. On all offers and agreements under which Atos Nederland B.V. supplies goods and/or services of whatever nature, the Terms of Delivery from Atos Nederland B.V. exclusively apply. The Terms of Delivery shall be promptly submitted to you on your request.

1 0

Re: [stunnel-users] How to turn off logging
by Eric Eberhard 09 Jul '19

09 Jul '19

Yes - just difficult :) We have our own logging in our application and we don't want stunnel's logging (or on screen error messages) to occur. We want them to go to our log files. So simply go to log.c and change the log_error() routines. I keep notes of any changes I make so that when I get new version I can repeat them. Eric From: stunnel-users [mailto:[email protected]] On Behalf Of David Yunker Sent: Monday, July 08, 2019 2:47 PM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] How to turn off logging To whom it may concern, I would like to know if there is a way to disable logging or set a size limit or to have it overwrite the log file each time a new log is started? I am using the Windows version of Stunnel. Thank you for your help.

1 0

Error during linking Stunnel 5.55
by Heinsbroek, Peter 09 Jul '19

09 Jul '19

I tried to build stunnel from the sources. The compiling goes well ,but the linking gives an error When comping 32bit I get : sthreads.obj : error LNK2019: unresolved external symbol _CRYPTO_set_id_callback referenced in function _sthreads_init ..\bin\win32\stunnel.exe : fatal error LNK1120: 1 unresolved externals NMAKE : fatal error U1077: '"C:\Program Files (x86)\Microsoft Visual Studio\2017\Professional\VC\Tools\MSVC\14.16.27023\bin\HostX86\x86\link.EXE"' : return code '0x460' Stop. Anyone knows how to solve. Met vriendelijke groet, [Atos logo] Peter Heinsbroek ICT Specialist – IDM TTS BTN/NL-TEC-Generic-Infra-S2 T: +31 (0) 88 265 9869 M: +31 (0) 6 53753244 Burg. Rijnderslaan 30 – Nederland atos.net<https://atos.net/> [LinkedIn icon]<https://www.linkedin.com/in/peter-heinsbroek-10467b52/> This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, Atos’ liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted. On all offers and agreements under which Atos Nederland B.V. supplies goods and/or services of whatever nature, the Terms of Delivery from Atos Nederland B.V. exclusively apply. The Terms of Delivery shall be promptly submitted to you on your request.

1 0

How to turn off logging
by David Yunker 08 Jul '19

08 Jul '19

To whom it may concern, I would like to know if there is a way to disable logging or set a size limit or to have it overwrite the log file each time a new log is started? I am using the Windows version of Stunnel. Thank you for your help.

2 1

Academic doubt about firewall bypass
by Hugo Marello 28 Jun '19

28 Jun '19

Hello guys, I'm new to using stunnel but I find it quite a powerful tool. I'm doing a POC on how we can bypass our firewall even with DPI, and chose to use stunnel for an extra layer of cryptography. You don't have to worry about access to any VM mentioned here. Here is my scenario: [CLIENT BROWSER] -->[STUNNEL CLIENT]-->[FIREWALL]-->[STUNNEL SERVER]-->[REVERSE PROXY]-->[FREE INTERNET] So far I succeeded in getting HTTP working using stunnel CONNECT protocol to the firewall and going all the way through. The problem is when I try to access HTTPS, the connection get set to the stunnel server but it keeps waiting for something. Double checked all the logs, firewall can't discern, stunnel server get the connection, reverse proxy also get the socket connection. My hypothesis is that stunnel client gets the CONNECT from the browser and discard it, it uses its own way to connect to the firewall, instead of encrypting the CONNECT all the way through. As it may seems, I need a way to send 2 CONNECT packages. Does anyone know how can I proceed? Follow my configs: client = yes output = /var/log/stunnel4/stunnel.log debug = 7 [bypassclient] accept = 4000 connect = firewall.example:3128 protocolHost = destination.com:443 protocol = connect requireCert = no verifyChain = no verifyPeer = no -------------------------------------------------------------------------------------------------------------------- [bypassserver] accept = 0.0.0.0:443 connect = reverseproxy.com:8888 cert = /etc/ssl/cert.pem key = /etc/ssl/key.pem ----------------------------------------------------------------------------------------------------------------------- Thank you all in advance, already digging throw the source code (quite lost tough), Hugo

1 0

SOLVED, I cannot get Outlook Express email to work after Cox changes
by Brent Kimberley 28 Jun '19

28 Jun '19

Thank you Brent, >> I found if I have Avast running with mail shield enabled I get this error in the Stunnel log window: >> SSL_connect: 140770FC: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol >> Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket. >> >> This results in no emails being abled to be sent by SMPT. >> >> If I disable Avast's mail shield the mail is sent with no errors. >> Is there a work around for to be able to use Stunnel without disabling Avast's mail shield? >> POP3 Connection >> CERT: Pre-verification error: self signed certificate in certificate chain >> Rejected by CERT at depth=1: OU=generated by Avast Antivirus for SSL/TLS scanning, O=Avast Web/Mail Shield, CN=Avast Web/Mail Shield Root >> SSL_connect: 14090086: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed If you need avast, sign your stunnel leaf with a well known root CA, and exchange certificates accordingly. cox_mail : avast_dpi : stunnel_TLS_proxy : client https://support.postbox-inc.com/hc/en-us/articles/204602300-Invalid-Securit…

1 0

stunnel-users Digest, Vol 179, Issue 11
by David Yunker 28 Jun '19

28 Jun '19

Brent, Here is more log information that occurs when using Avast Mail shield. CERT: Pre-verification error: self signed certificate in certificate chain Rejected by CERT at depth=1: OU=generated by Avast Antivirus for SSL/TLS scanning, O=Avast Web/Mail Shield, CN=Avast Web/Mail Shield Root SSL_connect: 14090086: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed This occurs in the POP3 connection. Hope this helps.

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 179, Issue 11
by Brent Kimberley 28 Jun '19

28 Jun '19

>>Does anybody know how to prevent this from happening? Try adding the following: #verify the peer certificate chain starting from the root CA #pre-requisite #1: checkHost (OR checkIP) #pre-requisite #2: CAfile (OR CApath) verifyChain = yes checkHost = pop.cox.com #verify the peer certificate chain starting from the root CA #pre-requisite #1: checkHost (ORcheckIP) #pre-requisite #2: CAfile (OR CApath) verifyChain = yes checkHost = smtp.cox.net ref: https://www.stunnel.org/config_windows.html https://www.stunnel.org/static/stunnel.html From: David Yunker <davidyunker(a)hotmail.com> Subject: [stunnel-users] SOLVED, I cannot get Outlook Express email to work after Cox changes To anybody interested, Here is how to configure Stunnel for Outlook Express v6 in Windows XP to work: Modify Stunnel configuration to this: [cox-pop3] client = yes accept = 127.0.0.1:110 connect = pop.cox.net:995 CAfile = ca-certs.perm OCSPaia = yes [cox-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.cox.net:587 CAfile = ca-certs.perm OCSPaia = yes Now configure Outlook Express as follows: Set incoming mail(POP3) to 127.0.0.1 Set outgoing mail(SMTP) to 127.0.0.1 Have "Logon using secure password authentication" unchecked. Have "My server requires authentication" unchecked For POP3 set incoming mail (POP3) to port 110. For SMTP set outgoing mail (SMTP) to port 25. Have "This server requires a secure connection(SSL)" for POP3 unchecked. Have "This server requires a secure connection(SSL)" for SMTP unchecked. Everything works except I have the following error message in the Stunnel log: "Service [service name] needs authentication to prevent MITM attacks" Does anybody know how to prevent this from happening? I tried having the "My server requires authentication" checked but I still have the message when Stunnel starts. Thank you for any help.

2 1

openssl integration
by Brent Kimberley 27 Jun '19

27 Jun '19

Try the following: .\openssl engine -vvvv https://github.com/openssl/openssl/blob/OpenSSL_1_1_1-stable/README.ENGINE

2 1

Problem with pkcs11
by Heinsbroek, Peter 25 Jun '19

25 Jun '19

Hallo everybody. I’m running Stunnel 5.44 with pkcs11 on windows ,with the use of a HSM containing the private keys. That’s working fine. Now I want to upgrade to 5.55,so from 32 bit to 64 bit. I replaced the 32 bit cryptoki with a 64 bit cryptoki. But now it isn’t working. I looked with sysinternals ,and it seems the hsm login isn’t working. I also placed the 64bit ssleay32 & libeap32 in the windows\system32 folder. Did I forget something? If anyone can help ,it’s highly appreciated. Met vriendelijke groet, [Atos logo] Peter Heinsbroek ICT Specialist – IDM TTS BTN/NL-TEC-Generic-Infra-S2 T: +31 (0) 88 265 9869 M: +31 (0) 6 53753244 Burg. Rijnderslaan 30 – Nederland atos.net<https://atos.net/> [LinkedIn icon]<https://www.linkedin.com/in/peter-heinsbroek-10467b52/> This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, Atos’ liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted. On all offers and agreements under which Atos Nederland B.V. supplies goods and/or services of whatever nature, the Terms of Delivery from Atos Nederland B.V. exclusively apply. The Terms of Delivery shall be promptly submitted to you on your request.

1 0

last version of stunnel that works on Windows XP
by David Yunker 25 Jun '19

25 Jun '19

What is the last version of stunnel that works on Windows XP? Thank you.

1 0

Latest Stunnel for Windows XP
by David Yunker 24 Jun '19

24 Jun '19

To whom it may concern, What was the last version of stunnel that worked on Windows XP? Thanks for the info.

2 1

SOLVED, I cannot get Outlook Express email to work after Cox changes
by David Yunker 22 Jun '19

22 Jun '19

To anybody interested, Here is how to configure Stunnel for Outlook Express v6 in Windows XP to work: Modify Stunnel configuration to this: [cox-pop3] client = yes accept = 127.0.0.1:110 connect = pop.cox.net:995 CAfile = ca-certs.perm OCSPaia = yes [cox-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.cox.net:587 CAfile = ca-certs.perm OCSPaia = yes Now configure Outlook Express as follows: Set incoming mail(POP3) to 127.0.0.1 Set outgoing mail(SMTP) to 127.0.0.1 Have "Logon using secure password authentication" unchecked. Have "My server requires authentication" unchecked For POP3 set incoming mail (POP3) to port 110. For SMTP set outgoing mail (SMTP) to port 25. Have "This server requires a secure connection(SSL)" for POP3 unchecked. Have "This server requires a secure connection(SSL)" for SMTP unchecked. Everything works except I have the following error message in the Stunnel log: "Service [service name] needs authentication to prevent MITM attacks" Does anybody know how to prevent this from happening? I tried having the "My server requires authentication" checked but I still have the message when Stunnel starts. Thank you for any help.

1 0

Help, I cannot get Outlook Express email to work after Cox changes
by David Yunker 21 Jun '19

21 Jun '19

To anybody who can help, I am currently using Stunnel version 5.24. I cannot update it to the latest version because I am using it on a Windows XP system. My problem is that I am currently using COX for my internet provider and COX recently change the email protocol from SSL to TSL. This is a problem since I am currently using Outlook Express v6 and it does not work with TSL. I recently discovered your Stunnel program and believe it will solve my problem. I tried changing the items in the configuration file to the following: fips = yes [cox-pop3] client = yes accept = 127.0.0.1:995 connect = pop.cox.net:995 verify = 2 CAfile = ca-certs.pem checkHost = pop.cox.net OCSPaia = yes Stunnel shows no errors but my email still does not work. This is what happens when setting up the configuration for Outlook express: My POP account is pop.cox.net. My SMTP account is smtp.cox.net. If I set the POP port to 110 and leave the SMTP port to 25 and I have checked "logon using secure password authentication". But I do NOT have checked "this server requires a secure connection (SSL)". Then when I attempt to send/receive I get the following error: "Unable to logon to the server using secure password authentication account 'pop.cox.net server ...." If I do check "this server requires a secure connection (SSL)" and leave the POP port to 110 then when I attempt to send/receive I get the following error: "Your server has unexpectedly terminated the connection ..." If I change the POP port from 110 to 995 and remove the check mark for "this server require a secure connection (SSL)". Then when I attempt to send/receive I get a time out condition. If I check "this server requires a secure connection (SSL)" and attempt a send/receive I get this error: "Your server has unexpectedly terminated the connection.." No matter how I configure my Outlook Express I do not receive any email. I have a friend who has a Windows 7 system and a virtual windows xp installed in it that he uses for his email but is using Outlook in windows xp and this same configuration works fine for him. Except he has to have "verify = 2" removed from the configuration for Stunnel and his SMTP port is 587. For it to work. What am I doing wrong? Please help!

2 1

Re: [stunnel-users] stunnel client: accept on connect success
by Eric Eberhard 19 Jun '19

19 Jun '19

I'm a dummy so what I do is write a "wrapper" -- you connect to your wrapper and manage your problem. If all is good exec stunnel. If not send appropriate messages back. Dummy idea, Eric -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of mihertz(a)gmx.de Sent: Tuesday, June 18, 2019 11:19 PM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] stunnel client: accept on connect success Hi everyone, could use some help for a stunnel client-mode question. Found no corresponding config directives in the manpage, not sure i am searching with the correct terms... or going for the correct approach at all. So there is a scenario where the stunnel client plaintext side does the tcp-handshake (S/S./.) and directly terminates the connected client afterwards (R.). This is caused because the corresponding connect-target fails to establish a TCP/TLS connection with the server (rejected by target server for whatever reason). This could cause a first regular tcp-packet to be send and lost, before stunnel disconnects on the plaintext-side and the application becomes aware of that eventually. I wonder if there is a way to configure stunnel to behave in a similar way to haproxy /w acl? Where it denies all tcp connects unless at least 1 backend server is available. So that stunnel would like "delay" the accept-side TCP handshake while trying to connect to the connect-side via TLS. Based on TCP/TLS success/failure on the connect-side then continues the accept-side TCP handshake or quits its. This way the client would never have the short moment of "ok, i can start" I know that this behaviour is not optimal/desired with the majority of cases, just have the impression I have a use-case for this in my scenario. There is no way to modify the plaintext-side connected application in any way. Tx/Rx data is just a few bytes, so its always 1 packet for requests/answers. And relatively often that first packet sent goes out before the reset (R.) is received by the stunnel client-mode to the software connected on the accept-side. Would be happy for your input and ideas on how to work around that. Best Regards Michael _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

stunnel client: accept on connect success
by mihertz＠gmx.de 19 Jun '19

19 Jun '19

Hi everyone, could use some help for a stunnel client-mode question. Found no corresponding config directives in the manpage, not sure i am searching with the correct terms... or going for the correct approach at all. So there is a scenario where the stunnel client plaintext side does the tcp-handshake (S/S./.) and directly terminates the connected client afterwards (R.). This is caused because the corresponding connect-target fails to establish a TCP/TLS connection with the server (rejected by target server for whatever reason). This could cause a first regular tcp-packet to be send and lost, before stunnel disconnects on the plaintext-side and the application becomes aware of that eventually. I wonder if there is a way to configure stunnel to behave in a similar way to haproxy /w acl? Where it denies all tcp connects unless at least 1 backend server is available. So that stunnel would like "delay" the accept-side TCP handshake while trying to connect to the connect-side via TLS. Based on TCP/TLS success/failure on the connect-side then continues the accept-side TCP handshake or quits its. This way the client would never have the short moment of "ok, i can start" I know that this behaviour is not optimal/desired with the majority of cases, just have the impression I have a use-case for this in my scenario. There is no way to modify the plaintext-side connected application in any way. Tx/Rx data is just a few bytes, so its always 1 packet for requests/answers. And relatively often that first packet sent goes out before the reset (R.) is received by the stunnel client-mode to the software connected on the accept-side. Would be happy for your input and ideas on how to work around that. Best Regards Michael

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 179, Issue 5
by Brent Kimberley 16 Jun '19

16 Jun '19

>> Is there something missing ? Can you please elaborate? https://www.stunnel.org/auth.html Subject: Using STunnel4 with both SSL/TLS proxy AND PSK authentication Hi, all. We've got a specific use case where we need to implement an stunnel4 'tunnel' in the following format: Client <---> client-side stunnel4 <---> server-side stunnel4 <---> server The specific case for this is because of a server that does NOT support SSL on the remote side nor client side, and we need to use two stunnel4 instances to establish the "secure" tunnel. We can get it working with straight SSL/TLS certificates for a secure connection between the two but can't seem to add authentication to this, we want to get the stunnel4 on the client side and the stunnel4 on the server side to have to have some kind of authentication/exchange between them. Whenever we add the PSK options or client certs to the thing, we immediately get SSL/TLS problems, as it doesn't seem to support SSL/TLS handshakes properly at that point. Is there something I'm missing within the STunnel4 documentation about establishing the SSL/TLS tunnel AND adding an authentication component, or is this not possible?? It doesn't currently seem possible based on my testing... Thomas

2 2

Stunnel 5.55 on Win 10 x64 GUI Mode
by Thomas Eifert 16 Jun '19

16 Jun '19

Tonight, I downloaded and installed Stunnel version 5.55 and installed it on Windows 10 x64 1903. If I run Stunnel as a service, everything works beautifully. No issues whatsoever. However, I just can't seem to get it to run in GUI mode. When I fire up the GUI, the configuration file loads fine with no errors. However, when attempting to establish any connection, the GUI simply crashes and the log file just terminates with nothing revealing: 2019.06.15 20:26:02 LOG7[main]: Service [ircs.3] accepted (FD=956) from 127.0.0.1:52874 2019.06.15 20:26:02 LOG7[main]: Creating a new thread 2019.06.15 20:26:02 LOG7[main]: New thread created 2019.06.15 20:26:02 LOG7[0]: Service [ircs.3] started 2019.06.15 20:26:02 LOG7[0]: Setting local socket options (FD=956) 2019.06.15 20:26:02 LOG7[0]: Option TCP_NODELAY set on local socket 2019.06.15 20:26:02 LOG5[0]: Service [ircs.3] accepted connection from 127.0.0.1:52874 2019.06.15 20:26:02 LOG6[0]: s_connect: connecting 154.35.138.250:6697 2019.06.15 20:26:02 LOG7[0]: s_connect: s_poll_wait 154.35.138.250:6697: waiting 10 seconds 2019.06.15 20:26:02 LOG7[0]: FD=1080 ifds=rwx ofds=--- (end of log) This is, of course, with the service stopped and de-installed. I've tried several remedies, including running Stunnel in compatibility modes, running it as an administrator, and I even tried to install it completely outside of the normal "program files (x86)" location. Also, the firewall is not the issue. Nothing seems to help. I can't figure out what on earth is occurring. Any insight/ideas would be appreciated. Thanks and regards, Thomas -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

1 1

Using STunnel4 with both SSL/TLS proxy AND PSK authentication
by Thomas Ward 14 Jun '19

14 Jun '19

Hi, all. We've got a specific use case where we need to implement an stunnel4 'tunnel' in the following format: Client <---> client-side stunnel4 <---> server-side stunnel4 <---> server The specific case for this is because of a server that does NOT support SSL on the remote side nor client side, and we need to use two stunnel4 instances to establish the "secure" tunnel. We can get it working with straight SSL/TLS certificates for a secure connection between the two but can't seem to add authentication to this, we want to get the stunnel4 on the client side and the stunnel4 on the server side to have to have some kind of authentication/exchange between them. Whenever we add the PSK options or client certs to the thing, we immediately get SSL/TLS problems, as it doesn't seem to support SSL/TLS handshakes properly at that point. Is there something I'm missing within the STunnel4 documentation about establishing the SSL/TLS tunnel AND adding an authentication component, or is this not possible? It doesn't currently seem possible based on my testing... Thomas

1 0

HELP! SSLv3 to TLSv1.2
by Eric Eberhard 07 Jun '19

07 Jun '19

Everyone, It goes to show that even after having used stunnel forever there is more to learn. I have a weird problem. A remote site that has always used SSLv3 wants to use TLSv1.2 - normally that takes 5 seconds in the config file. However, the remote site supplied the software that sends to them . and does not supply a version we can use unless we upgrade O/S and JAVA and who knows what else for hundreds of customers. In four days. Normally stunnel takes in clear text and sends it out in whatever you like (TLSv1.2 in this case). And the reverse. Can it take in SSLv3 and convert to TLSv1.2? Of course conceptually this is easy and just a logical extension of stunnel - in practice, if not there, it would be a job. Which I might tackle - but I first wanted to get community input. And if anyone wants to get paid to do this for me, we can talk :) Thanks All, Eric Eric S Eberhard VICS (Vertical Integrated Computer Systems) Voice: 928 567 3529 Cell : 928 301 7537 (not reliable except for text or if not home) 2933 W Middle Verde Rd Camp Verde, AZ 86322 Oh - help me out and please join this group. I need to get large numbers of members to take to the politicians. https://www.facebook.com/groups/286143052248115/ This might work to just join? <table border="0" width="100%" cellspacing="0" cellpadding="0" style="border-collapse:collapse;"><tr style=""><td height="28" style="line-height:28px;"> </td></tr><tr><td style=""><table border="0" width="280" cellspacing="0" cellpadding="0" style="border-collapse:separate;background-color:#ffffff;border:1px solid #dddfe2;border-radius:3px;font-family:Helvetica, Arial, sans-serif;margin:0px auto;"><tr style="padding-bottom: 8px;"><td style=""><img class="img" src="https://scontent.fhhr1-1.fna.fbcdn.net/v/t1.0-0/c0.0.584.305a/p320x320/ 50521766_10218655229077782_1167298564032823296_n.jpg?_nc_cat=101&_nc_ht= scontent.fhhr1-1.fna&oh=d725734d9126b706d402e635740dcd29&oe=5D00A5A4 " width="280" height="146" alt="" /></td></tr><tr><td style="font-size:14px;font-weight:bold;padding:8px 8px 0px 8px;text-align:center;">Save The Middle Verde</td></tr><tr><td style="color:#90949c;font-size:12px;font-weight:normal;text-align:center;">P ublic group . 228 members</td></tr><tr><td style="padding:8px 12px 12px 12px;"><table border="0" cellspacing="0" cellpadding="0" style="border-collapse:collapse;width:100%;"><tr><td style="background-color:#4267b2;border-radius:3px;text-align:center;"><a style="color:#3b5998;text-decoration:none;cursor:pointer;width:100%;" href="https://www.facebook.com/plugins/group/join/popup/?group_id=2861430522 48115&source=email_campaign_plugin" target="_blank" rel="noopener"><table border="0" cellspacing="0" cellpadding="3" align="center" style="border-collapse:collapse;"><tr><td style="border-bottom:3px solid #4267b2;border-top:3px solid #4267b2;color:#FFF;font-family:Helvetica, Arial, sans-serif;font-size:12px;font-weight:bold;">Join Group</td></tr></table></a></td></tr></table></td></tr><tr><td style="border-top:1px solid #dddfe2;font-size:12px;padding:8px 12px;">This group is to help preserve the Middle Verde River, the Middle Verde Character area as defined in the Town of Camp Verde's General Plan, the 260 co...</td></tr></table></td></tr><tr style=""><td height="28" style="line-height:28px;"> </td></tr></table>

2 1

Re: [stunnel-users] stunnel-users Digest, Vol 179, Issue 1
by Larry Alba 03 Jun '19

03 Jun '19

Please Stop my subscription to the Stunnel list. Sent from Yahoo Mail on Android On Mon, Jun 3, 2019 at 3:00 AM, stunnel-users-request(a)stunnel.org<stunnel-users-request(a)stunnel.org> wrote: Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. latest stable version for Windows (Meike Stone) ---------------------------------------------------------------------- Message: 1 Date: Mon, 3 Jun 2019 11:07:33 +0200 From: Meike Stone <meike.stone(a)googlemail.com> To: stunnel-users(a)stunnel.org Subject: [stunnel-users] latest stable version for Windows Message-ID: <CAFNHiA9=NRqkrBGjS+8sEbMjgQPYqvt4=XKuWxOz=pjYOw+FqA(a)mail.gmail.com> Content-Type: text/plain; charset="UTF-8" Hello dear list, I like to use stunnel under windows. I tried version stunnel-5.54 and it didn't work, it took a long time, until I've realized, that a bug was responsible for that. So two days after, I've seen the version 5.55b1, installed it and it works fine. But I don't see any comments in the change log on the website, in the mailing list "stunnel-announce", there was a note about that release, but now for the new release 5.55b12 not. What was changed there? I like to install a stable release on the server, so is there any recommendation which version I can or should use? Someone stated he will use version 5.49 until a new working version for windows is released .... Thanks Meike ------------------------------ Subject: Digest Footer _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users ------------------------------ End of stunnel-users Digest, Vol 179, Issue 1 *********************************************

1 0

latest stable version for Windows
by Meike Stone 03 Jun '19

03 Jun '19

Hello dear list, I like to use stunnel under windows. I tried version stunnel-5.54 and it didn't work, it took a long time, until I've realized, that a bug was responsible for that. So two days after, I've seen the version 5.55b1, installed it and it works fine. But I don't see any comments in the change log on the website, in the mailing list "stunnel-announce", there was a note about that release, but now for the new release 5.55b12 not. What was changed there? I like to install a stable release on the server, so is there any recommendation which version I can or should use? Someone stated he will use version 5.49 until a new working version for windows is released .... Thanks Meike

2 1

Re: [stunnel-users] RE stunnel process owner
by Eric Eberhard 30 May '19

30 May '19

We use it solely on 100s of our customer’s Unix computers. My suggestion (that not everyone agrees with) is to run it under inetd. Unix does not function without inetd (or related like xinetd). You don’t have to start or manage a server. It is dead reliable and when processes die it cleans it up and so forth. You connect to localhost on some port, have a configuration that directs it to the right place, off to the races. I am not sure what you mean by container hardening. When connecting to localhost it never touches the network – the TCP/IP goes directly to the TCP/IP stack on the local machine. I am really sure I don’t know what check out is :) If you give me more info I can probably be of more use. Eric From: stunnel-users [mailto:[email protected]] On Behalf Of Brent Kimberley Sent: Wednesday, May 29, 2019 11:53 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] RE stunnel process owner Hi Dan. >>Wondering what user people are running the stunnel process under on a unix server? Any suggestions re container hardening & check-out (a la SCAP)?

2 3

Re: [stunnel-users] stunnel process owner
by Daniel Trickett 29 May '19

29 May '19

I'm not running on a Windows server. We are running on unix servers. Get Outlook for Android<https://aka.ms/ghei36> ________________________________ From: Mario Ricciardi <spam(a)ocode.net> Sent: Wednesday, May 29, 2019 4:59:14 PM To: Daniel Trickett; stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] stunnel process owner This runs on a Windows server. The inbound email process needs a win based jde server Sent from my Verizon, Samsung Galaxy smartphone -------- Original message -------- From: Daniel Trickett <daniel.trickett(a)milliporesigma.com> Date: 5/29/19 11:58 AM (GMT-07:00) To: stunnel-users(a)stunnel.org Subject: [stunnel-users] stunnel process owner Hi, Wondering what user people are running the stunnel process under on a unix server? Best regards, Dan

1 1

stunnel process owner
by Daniel Trickett 29 May '19

29 May '19

Hi, Wondering what user people are running the stunnel process under on a unix server? Best regards, Dan

2 1

RE stunnel process owner
by Brent Kimberley 29 May '19

29 May '19

Hi Dan. >>Wondering what user people are running the stunnel process under on a unix server?Any suggestions re container hardening & check-out (a la SCAP)?

1 0

Questions/comments about the 64-bit installer.
by Thomas Eifert 25 May '19

25 May '19

I just upgraded to Windows 10 pro x64. I attempted to install Stunnel version 5.55b1. I made a couple of basic observations that I'd like to pass along. 1. The installer attempts to install Stunnel in the windows "Program Files (x86) directory. I thought Stunnel is now a 64-bit program. As such, why does it attempt to install in that directory? 2. The new version of Stunnel doesn't seem to want to run under Windows 10. If I attempt to run it as an app, the program terminates when I attempt to establish a connection and pass traffic through it. Running it as a service, it passes a few dozen bytes of traffic, then stalls. Changing compatibility modes had little effect. 3. Stunnel version 5.49 runs beautifully under Win 10. I'll continue to use it until i find a newer version that works. Has anyone else had similar experience trying to use Stunnel under Win 10? If so, I'd like to know if you were able to resolve these issues. Regards, Thomas -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

1 0

Re: [stunnel-users] stunnel 5.54 on x64-pc-mingw32-gnu platform
by Brent Kimberley 24 May '19

24 May '19

>> Stunnel v5.54 (local) halts during tunnel setup with stunnel v4.56 (remote) FYI. stunnel-5.55b1-win64-installer.exe does not halt during tunnel setup. Thanks! <Snip><Snip>[ ] Running on Windows 6.2[ ] No limit detected for the number of clients[.] stunnel 5.55 on x64-pc-mingw32-gnu platform[.] Compiled/running with OpenSSL 1.1.1b 26 Feb 2019[.] Reading configuration from file ...[.] UTF-8 byte order mark detected..[ ] Initializing service [..][ ] Ciphers: ..[ ] TLSv1.3 ...[ ] TLS options: ..[ ] Loading certificate from file: [ ] Certificate loaded from file: [ ] Loading private key from file: [ ] Private key loaded from file: [ ] Private key check succeeded[.] Configuration successful[ ] Binding service [ ] Listening file descriptor created [ ] Setting accept socket options [ ] Service bound to 2019.05.23 20:26:54 LOG6[cron]: Executing cron jobs2019.05.23 20:26:54 LOG6[cron]: Cron jobs completed in 0 seconds2019.05.23 20:27:09 LOG5[0]: Service accepted connection from 2019.05.23 20:27:09 LOG6[0]: s_connect: connecting 2019.05.23 20:27:09 LOG6[0]: CERT: 2019.05.23 20:27:09 LOG6[0]: CERT: 2019.05.23 20:27:09 LOG5[0]: Certificate accepted at 2019.05.23 20:27:09 LOG6[0]: Session id: 2019.05.23 20:27:09 LOG6[0]: TLS connected: new session negotiated2019.05.23 20:27:09 LOG6[0]: TLSv1.2 ciphersuite: 2019.05.23 20:27:16 LOG6[0]: Read socket closed 2019.05.23 20:27:16 LOG6[0]: SSL_shutdown successfully sent close_notify alert2019.05.23 20:27:16 LOG3[0]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing2019.05.23 20:27:16 LOG5[0]: Connection closed: </Snip> On Friday, May 17, 2019, 9:18:41 a.m. EDT, Brent Kimberley <brent_kimberley(a)rogers.com> wrote: Hi.Stunnel v5.54 (local) halts during tunnel setup with stunnel v4.56 (remote) whereas stunnel v5.53 (local) successfully establishes tunnels with stunnel v4.56 (remote). Debug 7 (local) doesn't detect any issues. Does remote 4.56 need to be upgraded? Does local 5.54 need to be patched? Best Regards,BK v5.54 x v4.56[local]s_connect: s_poll_wait <someip>:443: waiting 10 secondshalt...[remote]2019.05.17 08:47:34 LOG5[13009:140578290554624]: Service [httpsx] accepted connection from 2019.05.17 08:52:35 LOG6[13009:140578290554624]: init_ssl: s_poll_wait: TIMEOUTbusy exceeded: sending reset 2019.05.17 08:52:35 LOG5[13009:140578290554624]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket v5.53 x v4.56[local] 2019.05.17 08:57:18 LOG7[0]: s_connect: s_poll_wait <someip>:443: waiting 10 seconds2019.05.17 08:57:18 LOG5[0]: s_connect: connected <someip>:443...[remote]2019.05.17 09:11:10 LOG5[13009:140578290333440]: Service [httpsx] accepted connection from 2019.05.17 09:11:10 LOG5[13009:140578290333440]: Certificate accepted: depth=....

1 0

Re: [stunnel-users] Connection never completes
by Joe Fitzgerald 22 May '19

22 May '19

I am observing the same behavior Mario is seeing with STunnel 5.54 on Windows Server 2012 R2 running as a client. In my case I am upgrading the client side from STunnel 5.01. The client and server connected without difficulty when both were at STunnel 5.01. >From the STunnel v 5.54 client log: 2019.05.22 16:58:19 LOG7[main]: Found 1 ready file descriptor(s) 2019.05.22 16:58:19 LOG7[main]: FD=332 ifds=r-x ofds=--- 2019.05.22 16:58:19 LOG7[main]: FD=352 ifds=r-x ofds=--- 2019.05.22 16:58:19 LOG7[main]: Service [EchoClient] accepted (FD=440) from 127.0.0.1:62387 2019.05.22 16:58:19 LOG7[main]: Creating a new thread 2019.05.22 16:58:19 LOG7[main]: New thread created 2019.05.22 16:58:19 LOG7[0]: Service [EchoClient] started 2019.05.22 16:58:19 LOG7[0]: Setting local socket options (FD=440) 2019.05.22 16:58:19 LOG7[0]: Option TCP_NODELAY set on local socket 2019.05.22 16:58:19 LOG5[0]: Service [EchoClient] accepted connection from 127.0.0.1:62387 2019.05.22 16:58:19 LOG6[0]: s_connect: connecting 192.168.128.162:40007 2019.05.22 16:58:19 LOG7[0]: s_connect: s_poll_wait 192.168.128.162:40007: waiting 10 seconds >From the STunnel v 5.01 server log: 2019.05.22 16:58:19 LOG7[5072]: Service [EchoServer] accepted (FD=572) from 192.168.128.104:62388 2019.05.22 16:58:19 LOG7[5072]: Creating a new thread 2019.05.22 16:58:19 LOG7[5072]: New thread created 2019.05.22 16:58:19 LOG7[3724]: Service [EchoServer] started 2019.05.22 16:58:19 LOG5[3724]: Service [EchoServer] accepted connection from 192.168.128.104:62388 2019.05.22 16:58:19 LOG7[3724]: SSL state (accept): before/accept initialization

1 1

Connection never completes
by Mario Ricciardi 22 May '19

22 May '19

I have Stunnel on two computers, both Win10 version 5.54. One works flawlessly on my home network, but the second will not complete the connection to POP3 Office365 on the work network. It gets to s_connect and freezes: 2019.05.21 22:50:19 LOG7[main]: Found 1 ready file descriptor(s) 2019.05.21 22:50:19 LOG7[main]: FD=220 ifds=r-x ofds=--- 2019.05.21 22:50:19 LOG7[main]: Service [POP3 Incoming] accepted (FD=780) from 127.0.0.1:51378 2019.05.21 22:50:19 LOG7[main]: Creating a new thread 2019.05.21 22:50:19 LOG7[main]: New thread created 2019.05.21 22:50:19 LOG7[2]: Service [POP3 Incoming] started 2019.05.21 22:50:19 LOG7[2]: Setting local socket options (FD=780) 2019.05.21 22:50:19 LOG7[2]: Option TCP_NODELAY set on local socket 2019.05.21 22:50:19 LOG5[2]: Service [POP3 Incoming] accepted connection from 127.0.0.1:51378 2019.05.21 22:50:19 LOG6[2]: failover: priority, starting at entry #0 2019.05.21 22:50:19 LOG6[2]: s_connect: connecting 52.96.24.210:995 2019.05.21 22:50:19 LOG7[2]: s_connect: s_poll_wait 52.96.24.210:995: waiting 10 seconds The sessions stay active, but this is as far as they get. I start stunnel GUI and attempt to connect to the active port and the above behavior is what I get. Using OpenSSL I can connect just fine, so there doesn't appear to be a firewall issue: +OK The Microsoft Exchange POP3 service is ready. [WQBRAFgAUABSADAAMQBDAEEAMAAwA DgANgAuAEMAQQBOAFAAUgBEADAAMQAuAFAAUgBPAEQALgBPAFUAVABMAE8ATwBLAC4AQwBPAE0A] user LoadAccept(a)example.com +OK pass LAxxxxxx +OK User successfully logged on. list +OK 4 356828 1 70284 2 70415 3 108104 4 108025 The stunnel config is super simple: ; Debugging stuff (may be useful for troubleshooting) debug = 7 output = stunnel.log ; ************************************************************************** ; * Service definitions (at least one service has to be defined) * ; ************************************************************************** ;Microsoft Outlook [POP3 Incoming] client = yes accept = 127.0.0.1:110 connect = outlook.office365.com:995 verifyChain = yes CAfile = ca-certs.pem checkHost = outlook.office365.com OCSPaia = yes I won't bother showing the log for the working machine, but it has the same config. I'm really hoping there is simply something missing from the Windows install. A coworker has the same problem on their fresh company provided Win10 install. My functioning Win10 pc is my personal machine. Thanks, Mario --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus

1 0

hostapd & stunnel
by Johannes Eckhardt 20 May '19

20 May '19

Hi, I'm running stunnel 5.39 on a Raspberry Pi with Raspbian 9 (stretch). The Pi has two network interfaces (eth0, wlan0) and I'm running an access point with hostapd. What I want to do is to route all traffic from my wifi-clients (connected via wlan0) through stunnel/socks. working iptables configuration to access the internet from eth0/wlan0: iptables -A FORWARD -i eth0 -o wlan0 -m state --state \ RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT iptables -P OUTPUT ACCEPT iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE; if add the following lines (from stunnel.org) local traffic on eth0 goes to the stunnel-server but my wireless clients can't access the internet anymore. I tried several configurations, but without success... # stunnel socks iptables -t nat -A OUTPUT -p tcp -d TARGET-SERVER --dport 9080 -j ACCEPT iptables -t nat -A OUTPUT -o lo -j ACCEPT iptables -t nat -A OUTPUT -p tcp --dport 9050 -j ACCEPT iptables -t nat -A OUTPUT -p tcp -j REDIRECT --to-ports 9051 iptables -t nat -A PREROUTING -p tcp --dport 9050 -j ACCEPT iptables -t nat -A PREROUTING -p tcp -j REDIRECT --to-ports 9051 # /etc/stunnel/stunnel.conf [SOCKS Client Direct] client = yes PSKsecrets = secrets.txt accept = :::9050 connect = TARGET-SERVER:9080 [SOCKS Client Transparent IPv4] client = yes PSKsecrets = secrets.txt accept = 127.0.0.1:9051 connect = TARGET-SERVER:9080 protocol = socks Has anyone a solution for that? Best regards, Johannes

1 0

Version 5.54 'make check' fails test 042_inetd
by James Brown 20 May '19

20 May '19

Sorry, posted with incorrect subject. > On 20 May 2019, at 3:29 pm, James Brown <jlbrown(a)bordo.com.au <mailto:[email protected]>> wrote: > > Having problems installing version 5.54 on macOS X with this configure command: > > ./configure --with-ssl=/usr/local/Cellar/openssl(a)1.1/1.1.1b > > Configure runs OK, as does make. > > But ‘make check’ ends with: > > $ make check > Making check in src > make[1]: Nothing to be done for `check'. > Making check in doc > make[1]: Nothing to be done for `check'. > Making check in tools > make[1]: Nothing to be done for `check'. > Making check in tests > Making check in certs > /Library/Developer/CommandLineTools/usr/bin/make check-local > ./maketestcert.sh > keys & certificates successfully generated > ./maketestcert.sh finished > /Library/Developer/CommandLineTools/usr/bin/make check-local > ./make_test > Mon 20 May 2019 15:21:58 AEST > stunnel 5.54 on x86_64-apple-darwin18.5.0 platform > Compiled/running with OpenSSL 1.1.1b 26 Feb 2019 > Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI > > test 010_require_cert ok > test 011_verify_peer ok > test 012_verify_chain ok > test 013_CRL_file ok > test 014_PSK_secrets ok > test 015_p12_cert ok > test 020_IPv6 skipped > test 021_FIPS skipped > test 022_bind ok > test 030_simple_execute ok > test 031_redirect ok > test 032_no_redirect ok > test 033_redirect_exec ok > test 034_no_redirect_exec ok > test 035_SNI ok > test 036_no_SNI ok > test 037_failover_prio1 ok > test 038_failover_prio2 ok > test 039_failover_rr ok > test 040_reload ok > test 041_exec_connect ok > test 042_inetd failed > error logs logs/042_inetd.log > test 043_session_delay ok > test 044_session_nodelay ok > test 045_include ok > test 046_resume_PSK ok > test 047_resume_redirect ok > test 048_resume_noredirect ok > test 050_ticket_secrets ok > test 110_failure_require_cert ok > test 111_failure_verify_peer ok > test 112_failure_verify_chain ok > test 113_failure_CRL_file ok > test 114_failure_PSK_secrets ok > test 115_failure_wrong_config ok > summary: success 32, skip 2, fail 1 > ./make_test finished > make[3]: *** [check-local] Error 1 > make[2]: *** [check-am] Error 2 > make[1]: *** [check-recursive] Error 1 > make: *** [check-recursive] Error 1 > > How can I fix this 042_ inetd failure? > > Also, why did it skip the IPv6 test? > > Thanks, > > James. > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org <mailto:[email protected]> > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

2 2

5.54 fails - TLS directory not found
by James Brown 20 May '19

20 May '19

Having problems installing version 5.54 on macOS X with this configure command: ./configure --with-ssl=/usr/local/Cellar/openssl(a)1.1/1.1.1b Configure runs OK, as does make. But ‘make check’ ends with: $ make check Making check in src make[1]: Nothing to be done for `check'. Making check in doc make[1]: Nothing to be done for `check'. Making check in tools make[1]: Nothing to be done for `check'. Making check in tests Making check in certs /Library/Developer/CommandLineTools/usr/bin/make check-local ./maketestcert.sh keys & certificates successfully generated ./maketestcert.sh finished /Library/Developer/CommandLineTools/usr/bin/make check-local ./make_test Mon 20 May 2019 15:21:58 AEST stunnel 5.54 on x86_64-apple-darwin18.5.0 platform Compiled/running with OpenSSL 1.1.1b 26 Feb 2019 Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI test 010_require_cert ok test 011_verify_peer ok test 012_verify_chain ok test 013_CRL_file ok test 014_PSK_secrets ok test 015_p12_cert ok test 020_IPv6 skipped test 021_FIPS skipped test 022_bind ok test 030_simple_execute ok test 031_redirect ok test 032_no_redirect ok test 033_redirect_exec ok test 034_no_redirect_exec ok test 035_SNI ok test 036_no_SNI ok test 037_failover_prio1 ok test 038_failover_prio2 ok test 039_failover_rr ok test 040_reload ok test 041_exec_connect ok test 042_inetd failed error logs logs/042_inetd.log test 043_session_delay ok test 044_session_nodelay ok test 045_include ok test 046_resume_PSK ok test 047_resume_redirect ok test 048_resume_noredirect ok test 050_ticket_secrets ok test 110_failure_require_cert ok test 111_failure_verify_peer ok test 112_failure_verify_chain ok test 113_failure_CRL_file ok test 114_failure_PSK_secrets ok test 115_failure_wrong_config ok summary: success 32, skip 2, fail 1 ./make_test finished make[3]: *** [check-local] Error 1 make[2]: *** [check-am] Error 2 make[1]: *** [check-recursive] Error 1 make: *** [check-recursive] Error 1 How can I fix this 042_ inetd failure? Also, why did it skip the IPv6 test? Thanks, James.

1 0

stunnel 5.54 on x64-pc-mingw32-gnu platform vs 5.53
by Brent Kimberley 17 May '19

17 May '19

Hi.Stunnel v5.54 (local) halts during tunnel setup with stunnel v4.56 (remote) whereas stunnel v5.53 (local) successfully establishes tunnels with stunnel v4.56 (remote). Debug 7 (local) doesn't detect any issues. Does remote 4.56 need to be upgraded? Does local 5.54 need to be patched? Best Regards,BK v5.54 x v4.56[local]s_connect: s_poll_wait <someip>:443: waiting 10 secondshalt...[remote]2019.05.17 08:47:34 LOG5[13009:140578290554624]: Service [httpsx] accepted connection from 2019.05.17 08:52:35 LOG6[13009:140578290554624]: init_ssl: s_poll_wait: TIMEOUTbusy exceeded: sending reset 2019.05.17 08:52:35 LOG5[13009:140578290554624]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket v5.53 x v4.56[local] 2019.05.17 08:57:18 LOG7[0]: s_connect: s_poll_wait <someip>:443: waiting 10 seconds2019.05.17 08:57:18 LOG5[0]: s_connect: connected <someip>:443...[remote]2019.05.17 09:11:10 LOG5[13009:140578290333440]: Service [httpsx] accepted connection from 2019.05.17 09:11:10 LOG5[13009:140578290333440]: Certificate accepted: depth=....

1 0

Connection refused, then connects
by James Brown 17 May '19

17 May '19

Can anyone tell me why It tries ::1:25 first and fails before connecting to 127.0.0.1:25? 2019.05.17 13:48:34 LOG5[21]: Service [ssmtp465] accepted connection from ::ffff:192.168.1.76:49170 2019.05.17 13:48:34 LOG3[21]: s_connect: connect ::1:25: Connection refused (61) 2019.05.17 13:48:34 LOG5[21]: s_connect: connected 127.0.0.1:25 2019.05.17 13:48:34 LOG5[21]: Service [ssmtp465] connected remote server from 127.0.0.1:56701 /usr/local/etc/stunnel/stunnel.conf has: [ssmtp465] client = no accept = 465 connect = 25 options = NO_SSLv2 #transparent = source [ssmtp587] client = no accept = 587 connect = 127.0.0.1:25 options = NO_SSLv2 #transparent = source Not sure if this is relevant, but when I startup I get: 2019.05.17 12:45:27 LOG5[ui]: stunnel 5.53 on x86_64-apple-darwin18.5.0 platform 2019.05.17 12:45:27 LOG5[ui]: Compiled/running with OpenSSL 1.0.2r 26 Feb 2019 2019.05.17 12:45:27 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2019.05.17 12:45:27 LOG5[ui]: Reading configuration from file /usr/local/etc/stunnel/stunnel.conf 2019.05.17 12:45:27 LOG5[ui]: UTF-8 byte order mark detected 2019.05.17 12:45:27 LOG5[ui]: FIPS mode disabled 2019.05.17 12:45:27 LOG4[ui]: Insecure file permissions on /usr/local/etc/dovecot/mail.bordo.com.au.pem 2019.05.17 12:45:27 LOG4[ui]: Insecure file permissions on /usr/local/etc/dovecot/mail.bordo.com.au.pem 2019.05.17 12:45:27 LOG5[ui]: Configuration successful 2019.05.17 12:45:27 LOG5[ui]: Binding service [ssmtp465] to 0.0.0.0:465: Address already in use (48) 2019.05.17 12:45:27 LOG5[ui]: Binding service [ssmtp587] to 0.0.0.0:587: Address already in use (48) No idea what is already using those ports. Any suggestions? macOS 10.14.4 Thanks, James.

3 3

stunnel 5.54 released
by Michal Trojnara 15 May '19

15 May '19

Dear Users, I have released version 5.54 of stunnel. Version 5.54, 2019.05.15, urgency: LOW * New features - New "ticketKeySecret" and "ticketMacSecret" options to control confidentiality and integrity protection of the issued session tickets. These options allow for session resumption on other nodes in a cluster. - Added logging the list of active connections on SIGUSR2 or with Windows GUI. - Logging of the assigned bind address instead of the requested bind address. * Bugfixes - Service threads are terminated before OpenSSL cleanup to prevent occasional stunnel crashes at shutdown. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 5e8588a6c274b46b1d63e1b50f0725f4908dec736f6588eb48d1eb3d20c87902 stunnel-5.54.tar.gz ed8424731f7d6e0c9b11f4c7b597a072e558dae7979102d0b213759678079481 stunnel-5.54-win64-installer.exe 7659f605065e5155577a99abe1129dbc89523796196c8bf50d3fa9265ec34d93 stunnel-5.54-android.zip Best regards, Mike

1 0

Re: [stunnel-users] Stunnel 5.44 server side 'exec = pppd' runs second child 'pppd' process after reconnection. Bug?
by Eric Eberhard 15 May '19

15 May '19

Killing anything will change the PID. If the PID needs to be constant a zombie is bad news! Zombies stink! E -----Original Message----- From: Jochen Bern [mailto:[email protected]] Sent: Wednesday, May 15, 2019 1:42 AM To: stunnel-users(a)stunnel.org Cc: Florian Lohoff <f(a)zz.de>; Eric Eberhard <flash(a)vicsmba.com> Subject: Re: [stunnel-users] Stunnel 5.44 server side 'exec = pppd' runs second child 'pppd' process after reconnection. Bug? On 05/15/2019 12:22 AM, Florian Lohoff wrote: > On Tue, May 14, 2019 at 11:30:29AM -0700, Eric Eberhard wrote: >> That is not a bad idea. I'd wrap it in a C program so I could check >> if the pppd is alive and not a zombie. > > pppd is a pretty solid piece of software. Never seen it hang as a > zombie. A zombie process is *terminated* and, basically, just a remaining entry in the kernel's process table. It's not hanging around because of something its own code did wrong, but because its parent process fails to "reap" its child (first and foremost, collect its exit code from the kernel). Killing the parent cleans up zombies because the zombies get re-parented to the init / systemd process (PID 1), which then does the reaping. Regards, -- Jochen Bern Systemingenieur

1 0

Re: [stunnel-users] Stunnel 5.44 server side 'exec = pppd' runs second child 'pppd' process after reconnection. Bug?
by Jochen Bern 15 May '19

15 May '19

On 05/15/2019 12:22 AM, Florian Lohoff wrote: > On Tue, May 14, 2019 at 11:30:29AM -0700, Eric Eberhard wrote: >> That is not a bad idea. I'd wrap it in a C program so I could check >> if the pppd is alive and not a zombie. > > pppd is a pretty solid piece of software. Never seen it hang as a > zombie. A zombie process is *terminated* and, basically, just a remaining entry in the kernel's process table. It's not hanging around because of something its own code did wrong, but because its parent process fails to "reap" its child (first and foremost, collect its exit code from the kernel). Killing the parent cleans up zombies because the zombies get re-parented to the init / systemd process (PID 1), which then does the reaping. Regards, -- Jochen Bern Systemingenieur

1 0

Re: [stunnel-users] Possible to verify client certificate BUT ignore expiration-date?
by Eric Eberhard 14 May '19

14 May '19

Use openssl to make a private cert? E -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of Christopher Schultz Sent: Monday, May 13, 2019 2:28 PM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Possible to verify client certificate BUT ignore expiration-date? All, Does anyone know if it is possible to perform all other verification of a client certificate EXCEPT allow the certificate to have expired? We have a vendor whose certificate has expired, and we want to allow their old certificate to work while they chase their tails trying to figure out the best way to re-issue a new cert for us. *eyeroll* Is it possible? Thanks, -chris

2 1

Re: [stunnel-users] Stunnel 5.44 server side 'exec = pppd' runs second child 'pppd' process after reconnection. Bug?
by Eric Eberhard 14 May '19

14 May '19

Yes. Use inetd (or equivalent). Making an independent server work is difficult due to the problems like you are having. Inetd is in many O/S included and essential, others available. It always works. Always. Yes, there is a tiny amount of overhead for making connections. On an ancient AIX IBM I manage 2-4 million XML documents exchanged per day with no problems, all with inetd. Try it – save yourself some misery. Or maybe it won’t help at all except to add information :) E From: stunnel-users [mailto:[email protected]] On Behalf Of Martin Got Sent: Monday, May 13, 2019 9:08 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Stunnel 5.44 server side 'exec = pppd' runs second child 'pppd' process after reconnection. Bug? I'm trying to make stunnel wrapped ppp connection to achieve bidirectional data transfer over stunnel like shown below. Stunnel client --connect--> Stunnel server pppd client --connect--> pppd server 10.0.1.2 <--data--> 10.0.1.1 OpenBSD 6.4amd64 with Stunnel 5.44 server works till stunnel retries 'exec = pppd' section once stunnel client is reconnected. Also 'exec = pppd' section retries after a short network related communication lag also. Previous 'pppd' child instance haven't killed by stunnel 5.44 before new instance started. So second 'pppd' process started and runs simultaneously with the first 'pppd' and link down. Restarting Stunnel server can clear child 'pppd' processes. So newly reestablished 'pppd' link between 10.0.1.1 <--> 10.0.1.2 endpoints works till next interconnection. Does stunnel server have an option to start only one instance in 'exec' section or what should be done to fix this? Any suggestions highly appreciated. # ps -axu | grep pppd user 43231 0.0 0.0 476 0:00.01 persist lock passive 10.0.1.1:10.0.1.2 local noauth (pppd) user 39187 0.0 0.0 468 0:00.01 persist lock passive 10.0.1.1:10.0.1.2 local noauth (pppd) # tail -n 10 /var/log/daemon pppd[39187] pppd 2.3.5 started by user, uid 0 pppd[43231] Using interface ppp1 pppd[43231] Connect: ppp0 <--> /dev/ttyp2 pppd[43231] Local IP address 10.0.1.1 pppd[43231] Remote IP address 10.0.1.2 pppd[39187] pppd 2.3.5 started by user, uid 0 pppd[39187] Using interface ppp0 pppd[39187] Connect: ppp0 <--> /dev/ttyp5 pppd[39187] Couldn't set interface address: Address 10.0.1.1 or destination 10.0.1.2 already exists Stunnel configurations for server and client: 1. Server's configuration ... foreground = yes debug = 7 socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;socket = l:SO_LINGER=1:60 ; Session cache sessionCacheSize = 100 sessionCacheTimeout = 600 stack = 65536 TIMEOUTbusy = 600 TIMEOUTconnect = 10 TIMEOUTidle = 43200 TIMEOUTclose = 5 [ppp] accept = LOCAL-IP:PORT exec = /usr/sbin/pppd execargs = lock 10.0.1.1:10.0.1.2 local debug noauth ;execargs = lock passive 10.0.1.1:10.0.1.2 local debug noauth pty = yes CAfile = ca.crt cert = server.crt key = server.key verifyChain = yes 2. Stunnel client's configuration ... foreground = yes debug = 7 socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Session cache sessionCacheSize = 1 sessionCacheTimeout = 600 failover = rr [ppp] client = yes retry = yes connect = REMOTE-IP:PORT exec = /usr/sbin/pppd execargs = defaultroute persist lock passive 10.0.1.2:10.0.1.1 local debug noauth name ppp-client pty = yes CAfile = ca.crt cert = client.crt key = client.key verifyChain = yes checkHost = REMOTE-HOSTNAME ;checkIP = 1.2.3.4

2 1

Re: [stunnel-users] Stunnel 5.44 server side 'exec = pppd' runs second child 'pppd' process after reconnection. Bug?
by Eric Eberhard 13 May '19

13 May '19

Sounds good. The inetd will handle the dropping of connections just fine ... but the below sounds like it would help even more. E -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of Peter Pentchev Sent: Monday, May 13, 2019 2:16 PM To: Martin Got <martingot(a)protonmail.com> Cc: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Stunnel 5.44 server side 'exec = pppd' runs second child 'pppd' process after reconnection. Bug? On Mon, May 13, 2019 at 04:07:57PM +0000, Martin Got wrote: > I'm trying to make stunnel wrapped ppp connection to achieve bidirectional data transfer over stunnel like shown below. > > Stunnel client --connect--> Stunnel server > pppd client --connect--> pppd server > 10.0.1.2 <--data--> 10.0.1.1 > > OpenBSD 6.4amd64 with Stunnel 5.44 server works till stunnel retries 'exec = pppd' section once stunnel client is reconnected. Also 'exec = pppd' section retries after a short network related communication lag also. Previous 'pppd' child instance haven't killed by stunnel 5.44 before new instance started. > > So second 'pppd' process started and runs simultaneously with the first 'pppd' and link down. Restarting Stunnel server can clear child 'pppd' processes. So newly reestablished 'pppd' link between 10.0.1.1 <--> 10.0.1.2 endpoints works till next interconnection. > > Does stunnel server have an option to start only one instance in 'exec' section or what should be done to fix this? Unfortunately, stunnel was not designed for your use case; it was designed to allow many different clients to make use of different instances of the same server program, one instance per client. You might try to do something else: if you really only have a single PPP client and you can really guarantee that anything that connects to stunnel must reuse the same connection, you could write a separate program that listens on a TCP port or on a local Unix socket, waits for the first connection, starts an instance of pppd, and then, from that point on, sends all the traffic from this instance to all the connections that it has received, even if a new connection appears before the old one has been torn down. Then you can point stunnel to the local Unix socket of that service, and anything that connects to stunnel will establish a new connection to your service, but it will not matter, since your service will be written in such a way as to send all the traffic to all the connections. So the service should do something like: 1. Create a local Unix socket and start listening on it. 2. Wait for the first connection. 3. Start an instance of pppd (at most one instance shall be running at any point in time) 4. Keep waiting for new connections; accept any and treat them all in the same way. 5. If any data comes from a remote connection, send it to pppd. 6. If any data comes from pppd, send it to *all* the remote connections. 7. If any of the remote connections is closed, well, so be it, good riddance, another one will come along presently (or maybe another one has already come along and has started talking to pppd through this service). 8. If the pppd child process dies, close all the remote connections and go back to step 2. Then you shall only have a problem if there are two "real" connections from different places at the same time - but if I understand your setup correctly, this should not really happen, since it is only you (your laptop or something like that) that connects to the PPP server. If you want, I could try to whip up some simple implementation of such a pseudo-multiplexer. G'luck, Peter -- Peter Pentchev roam(a){ringlet.net,debian.org,FreeBSD.org} pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

1 0

Possible to verify client certificate BUT ignore expiration-date?
by Christopher Schultz 13 May '19

13 May '19

All, Does anyone know if it is possible to perform all other verification of a client certificate EXCEPT allow the certificate to have expired? We have a vendor whose certificate has expired, and we want to allow their old certificate to work while they chase their tails trying to figure out the best way to re-issue a new cert for us. *eyeroll* Is it possible? Thanks, -chris

1 0

Stunnel 5.44 server side 'exec = pppd' runs second child 'pppd' process after reconnection. Bug?
by Martin Got 13 May '19

13 May '19

I'm trying to make stunnel wrapped ppp connection to achieve bidirectional data transfer over stunnel like shown below. Stunnel client --connect--> Stunnel server pppd client --connect--> pppd server 10.0.1.2 <--data--> 10.0.1.1 OpenBSD 6.4amd64 with Stunnel 5.44 server works till stunnel retries 'exec = pppd' section once stunnel client is reconnected. Also 'exec = pppd' section retries after a short network related communication lag also. Previous 'pppd' child instance haven't killed by stunnel 5.44 before new instance started. So second 'pppd' process started and runs simultaneously with the first 'pppd' and link down. Restarting Stunnel server can clear child 'pppd' processes. So newly reestablished 'pppd' link between 10.0.1.1 <--> 10.0.1.2 endpoints works till next interconnection. Does stunnel server have an option to start only one instance in 'exec' section or what should be done to fix this? Any suggestions highly appreciated. # ps -axu | grep pppd user 43231 0.0 0.0 476 0:00.01 persist lock passive 10.0.1.1:10.0.1.2 local noauth (pppd) user 39187 0.0 0.0 468 0:00.01 persist lock passive 10.0.1.1:10.0.1.2 local noauth (pppd) # tail -n 10 /var/log/daemon pppd[39187] pppd 2.3.5 started by user, uid 0 pppd[43231] Using interface ppp1 pppd[43231] Connect: ppp0 <--> /dev/ttyp2 pppd[43231] Local IP address 10.0.1.1 pppd[43231] Remote IP address 10.0.1.2 pppd[39187] pppd 2.3.5 started by user, uid 0 pppd[39187] Using interface ppp0 pppd[39187] Connect: ppp0 <--> /dev/ttyp5 pppd[39187] Couldn't set interface address: Address 10.0.1.1 or destination 10.0.1.2 already exists Stunnel configurations for server and client: 1. Server's configuration ... foreground = yes debug = 7 socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;socket = l:SO_LINGER=1:60 ; Session cache sessionCacheSize = 100 sessionCacheTimeout = 600 stack = 65536 TIMEOUTbusy = 600 TIMEOUTconnect = 10 TIMEOUTidle = 43200 TIMEOUTclose = 5 [ppp] accept = LOCAL-IP:PORT exec = /usr/sbin/pppd execargs = lock 10.0.1.1:10.0.1.2 local debug noauth ;execargs = lock passive 10.0.1.1:10.0.1.2 local debug noauth pty = yes CAfile = ca.crt cert = server.crt key = server.key verifyChain = yes 2. Stunnel client's configuration ... foreground = yes debug = 7 socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Session cache sessionCacheSize = 1 sessionCacheTimeout = 600 failover = rr [ppp] client = yes retry = yes connect = REMOTE-IP:PORT exec = /usr/sbin/pppd execargs = defaultroute persist lock passive 10.0.1.2:10.0.1.1 local debug noauth name ppp-client pty = yes CAfile = ca.crt cert = client.crt key = client.key verifyChain = yes checkHost = REMOTE-HOSTNAME ;checkIP = 1.2.3.4

2 1

Stunnel for O365 Sending Some Reports but not Others
by David Schmidt 10 May '19

10 May '19

Hello, We needed to reconfigure Stunnel for the SAP Business Objects server that sent email reports from G Suite over to a configuration that sends from an O365 account. The problem is that some of the reports work fine after the reconfiguration, while others always fail and I can't find out why and nothing has changed other than the mail settings. Microsoft doesn't even see the failed reports hitting their servers but when I look at Stunnel it seems like the TLS connection is being established correctly and I can see the connection being established from our firewall logs. I've attached the current O365 config as well as the old GSuite conifg, as well as logs of the debug output I see when I run a report that succeeds versus a report that fails. Can anyone give me an idea as to why Stunnel seems to be working to send out some reports but not others? Thank you, David Schmidt | Administrateur TI / IT Administrator | MTYGroup.com<http://mtygroup.com/> T+1 514-336-8885 Ext 8236 | C+1 514-708-7299 | 8210, route Transcanadienne, St. Laurent, QC, H4S 1M5 [http://mtygroup.com/signature/gif/use_this_left.gif]<http://mtygroup.com> [http://mtygroup.com/signature/gif/use_this_right.gif] <http://mtygroup.com> AVERTISSEMENT CONCERNANT LA CONFIDENTIALIT? / WARNING CONCERNING CONFIDENTIALITY Ce message peut contenir des informations confidentielles, privil?gi?es, et seulement pour ses destinataires. Si vous avez re?u ce message par erreur, veuillez en informer imm?diatement l'exp?diteur par retour de courriel et supprimer cette communication de votre syst?me. This email message may contain information that is confidential, privileged, and for communication only to its intended recipient or recipients. If you have received this message in error, please immediately notify the sender and delete the original message without making a copy.

1 0

Problem with stunnel 5.51
by Carter Browne 08 May '19

08 May '19

I received the following error trying to connect to a Windows host using RDP. I use stunnel as a connection point with secure messages coming in and then forwarded as secure messages going the desired end point. Stunnel is running on all three systems, the originator, the relay, and the destination. I have been using stunnel in this role for many years. As an additional point, 5.51 did work properly in the same role for secure telnet. The part of the log showing the failure is below. Thanks, Carter Before 2019.05.03 15:44:02 LOG5[ui]: stunnel 5.50 on armv7l-unknown-linux-gnueabihf platform 2019.05.03 15:44:02 LOG5[ui]: Compiled with OpenSSL 1.1.1a 20 Nov 2018 2019.05.03 15:44:02 LOG5[ui]: Running with OpenSSL 1.1.1b 26 Feb 2019 2019.05.03 15:44:02 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI 2019.05.03 15:44:02 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf 2019.05.03 15:44:02 LOG5[ui]: UTF-8 byte order mark not detected 2019.05.03 15:44:02 LOG5[ui]: FIPS mode disabled 2019.05.03 15:44:52 LOG5[ui]: Configuration successful 2019.05.03 15:44:52 LOG5[ui]: Switched to chroot directory: /var/run/stunnel/ ... 2019.05.08 08:26:08 LOG5[980]: Service [c13alt-rdp] accepted connection from 192.168.179.22:63218 2019.05.08 08:26:09 LOG5[980]: Certificate accepted at depth=0: C=US, ST=Massachusetts, L=Winchester, O=CBCS, OU=MIS, CN=cbrowne-39, emailAddress=cbrowne(a)cbcs-usa.com 2019.05.08 08:26:09 LOG5[981]: Service [cbrowne-13-rdp] accepted connection from 127.0.0.1:49180 2019.05.08 08:26:09 LOG5[980]: s_connect: connected 127.0.1.127:3389 2019.05.08 08:26:09 LOG5[981]: s_connect: connected 10.251.129.118:8001 2019.05.08 08:26:09 LOG5[981]: Service [cbrowne-13-rdp] connected remote server from 10.251.129.84:44796 2019.05.08 08:26:09 LOG5[980]: Service [c13alt-rdp] connected remote server from 127.0.0.1:49180 2019.05.08 08:26:09 LOG5[981]: Certificate accepted at depth=0: C=US, ST=Massachusetts, L=Winchester, O=CBCS, OU=MIS, CN=cbrowne-13.cbcsnet.local, emailAddress=cbrowne(a)cbcs-usa.com 2019.05.08 08:26:23 LOG5[980]: Connection closed: 1615 byte(s) sent to TLS, 1061 byte(s) sent to socket 2019.05.08 08:26:23 LOG5[981]: Connection closed: 1061 byte(s) sent to TLS, 1615 byte(s) sent to socket 2019.05.08 08:26:23 LOG5[982]: Service [c13alt-rdp] accepted connection from 192.168.179.22:63243 2019.05.08 08:26:23 LOG5[983]: Service [cbrowne-13-rdp] accepted connection from 127.0.0.1:49184 2019.05.08 08:26:23 LOG5[982]: s_connect: connected 127.0.1.127:3389 2019.05.08 08:26:23 LOG5[982]: Service [c13alt-rdp] connected remote server from 127.0.0.1:49184 2019.05.08 08:26:23 LOG5[983]: s_connect: connected 10.251.129.118:8001 2019.05.08 08:26:23 LOG5[983]: Service [cbrowne-13-rdp] connected remote server from 10.251.129.84:44800 After 2019.05.08 12:50:18 LOG5[ui]: stunnel 5.51 on armv7l-unknown-linux-gnueabihf platform 2019.05.08 12:50:18 LOG5[ui]: Compiled/running with OpenSSL 1.1.1b 26 Feb 2019 2019.05.08 12:50:18 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI 2019.05.08 12:50:18 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf 2019.05.08 12:50:18 LOG5[ui]: UTF-8 byte order mark not detected 2019.05.08 12:50:18 LOG5[ui]: FIPS mode disabled 2019.05.08 12:50:42 LOG5[ui]: Configuration successful 2019.05.08 12:51:01 LOG5[2]: Service [c13alt-rdp] accepted connection from 192.168.179.22:64139 2019.05.08 12:51:02 LOG5[2]: Certificate accepted at depth=0: C=US, ST=Massachusetts, L=Winchester, O=CBCS, OU=MIS, CN=cbrowne-39, emailAddress=cbrowne(a)cbcs-usa.com 2019.05.08 12:51:02 LOG5[3]: Service [cbrowne-13-rdp] accepted connection from 127.0.0.1:49330 2019.05.08 12:51:02 LOG5[2]: s_connect: connected 127.0.1.127:3389 2019.05.08 12:51:02 LOG5[2]: Service [c13alt-rdp] connected remote server from 127.0.0.1:49330 2019.05.08 12:51:02 LOG5[3]: s_connect: connected 10.251.129.118:8001 2019.05.08 12:51:02 LOG5[3]: Service [cbrowne-13-rdp] connected remote server from 10.251.129.84:44946 2019.05.08 12:51:02 LOG5[3]: Certificate accepted at depth=0: C=US, ST=Massachusetts, L=Winchester, O=CBCS, OU=MIS, CN=cbrowne-13.cbcsnet.local, emailAddress=cbrowne(a)cbcs-usa.com 2019.05.08 12:51:15 LOG5[2]: Connection closed: 1615 byte(s) sent to TLS, 1061 byte(s) sent to socket 2019.05.08 12:51:15 LOG5[3]: Connection closed: 1061 byte(s) sent to TLS, 1615 byte(s) sent to socket 2019.05.08 12:51:15 LOG5[4]: Service [c13alt-rdp] accepted connection from 192.168.179.22:64141 2019.05.08 12:51:15 LOG5[5]: Service [cbrowne-13-rdp] accepted connection from 127.0.0.1:49334 2019.05.08 12:51:15 LOG5[4]: s_connect: connected 127.0.1.127:3389 2019.05.08 12:51:15 LOG5[4]: Service [c13alt-rdp] connected remote server from 127.0.0.1:49334 2019.05.08 12:51:15 LOG5[5]: s_connect: connected 10.251.129.118:8001 2019.05.08 12:51:15 LOG5[5]: Service [cbrowne-13-rdp] connected remote server from 10.251.129.84:44950 2019.05.08 12:51:18 LOG3[4]: transfer() loop executes not transferring any data 2019.05.08 12:51:18 LOG3[4]: please report the problem to Michal.Trojnara(a)stunnel.org 2019.05.08 12:51:18 LOG3[4]: stunnel 5.51 on armv7l-unknown-linux-gnueabihf platform 2019.05.08 12:51:18 LOG3[4]: Compiled/running with OpenSSL 1.1.1b 26 Feb 2019 2019.05.08 12:51:18 LOG3[4]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD TLS:ENGINE,FIPS,OCSP,PSK,SNI 2019.05.08 12:51:18 LOG3[4]: protocol=TLSv1.2, SSL_pending=0 2019.05.08 12:51:18 LOG3[4]: sock_open_rd=Y, sock_open_wr=Y 2019.05.08 12:51:18 LOG3[4]: SSL_RECEIVED_SHUTDOWN=n, SSL_SENT_SHUTDOWN=n 2019.05.08 12:51:18 LOG3[4]: sock_can_rd=n, sock_can_wr=n 2019.05.08 12:51:18 LOG3[4]: ssl_can_rd=n, ssl_can_wr=n 2019.05.08 12:51:18 LOG3[4]: read_wants_read=Y, read_wants_write=n 2019.05.08 12:51:18 LOG3[4]: write_wants_read=n, write_wants_write=n 2019.05.08 12:51:18 LOG3[4]: shutdown_wants_read=n, shutdown_wants_write=n 2019.05.08 12:51:18 LOG3[4]: socket input buffer: 0 byte(s), TLS input buffer: 0 byte(s) 2019.05.08 12:51:18 LOG5[4]: Connection reset: 2786 byte(s) sent to TLS, 5077 byte(s) sent to socket 2019.05.08 12:51:18 LOG5[5]: Connection closed: 5077 byte(s) sent to TLS, 2989 byte(s) sent to socket 2019.05.08 12:52:03 LOG5[6]: Service [c13alt-rdp] accepted connection from 192.168.179.22:64144 2019.05.08 12:52:03 LOG5[6]: s_connect: connected 127.0.1.127:3389 2019.05.08 12:52:03 LOG5[6]: Service [c13alt-rdp] connected remote server from 127.0.0.1:49340 2019.05.08 12:52:03 LOG5[7]: Service [cbrowne-13-rdp] accepted connection from 127.0.0.1:49340 2019.05.08 12:52:03 LOG5[7]: s_connect: connected 10.251.129.118:8001 2019.05.08 12:52:03 LOG5[7]: Service [cbrowne-13-rdp] connected remote server from 10.251.129.84:44956 2019.05.08 12:52:14 LOG5[6]: Connection closed: 1615 byte(s) sent to TLS, 1061 byte(s) sent to socket 2019.05.08 12:52:14 LOG5[7]: Connection closed: 1061 byte(s) sent to TLS, 1615 byte(s) sent to socket 2019.05.08 12:52:14 LOG5[8]: Service [c13alt-rdp] accepted connection from 192.168.179.22:64147 2019.05.08 12:52:14 LOG5[9]: Service [cbrowne-13-rdp] accepted connection from 127.0.0.1:49344 2019.05.08 12:52:14 LOG5[9]: s_connect: connected 10.251.129.118:8001 2019.05.08 12:52:14 LOG5[9]: Service [cbrowne-13-rdp] connected remote server from 10.251.129.84:44960 2019.05.08 12:52:14 LOG5[8]: s_connect: connected 127.0.1.127:3389 2019.05.08 12:52:14 LOG5[8]: Service [c13alt-rdp] connected remote server from 127.0.0.1:49344 2019.05.08 12:52:16 LOG3[8]: transfer() loop executes not transferring any data 2019.05.08 12:52:16 LOG3[8]: please report the problem to Michal.Trojnara(a)stunnel.org

2 2

Automatic stunnel-client reconnect and keep initial session
by Martin Got 01 May '19

01 May '19

Which commands to stunnel can perform keeping session ID in case of stunnel-client reconnection? Do I add commands to both stunnel-client and stunnel-server to keep the initial session?

1 0

Keep initial session-ID when stunnel-client reconnect to a stunnel-server
by Martin Got 01 May '19

01 May '19

Trying to establish link using pppd connection overlapped into stunnel 5.44. Server runs on OpenBSD 6.4, client uses the same stunnel and OS versions. From the client's side I have to reconnect to stunnel-server in case of Internet link is dropped. And expecting that pppd session is kept by stunnel over reconnections possible. But stunnel-server runs another pppd instance when stunnel-client reconnects. After reconnection in system processes I see two pppd processes (as shows below), and pppd link has no pings after it. # ps -aux | grep pppd user 45359 0.0 0.0 440 1672 ?? I Tue11PM 0:00.01 lock passive 10.0.1.1:10.0.1.2 local debug noauth (pppd) user 1156 0.0 0.0 321 1210 ?? I Tue12PM 0:00.01 lock passive 10.0.1.1:10.0.1.2 local debug noauth (pppd) 1. The question is how to keep initial session established by stunnel-client and do not run second pppd process by stunnel-server? 2. May I keep session by cache-ID on the client's side only or do I need to do it on both client and server? Can it help not to run another pppd process? Both server config and client config parts are below: # cat /etc/stunnel/stunnel-server.conf ... [ppp] ;SERVER accept 1.2.3.4:443 exec = /usr/sbin/pppd execargs = lock passive 10.0.1.1:10.0.1.2 local debug noauth pty = yes CAfile = ca.crt cert = server.crt key = server.key verifyChain = yes TIMEOUTclose = 0 ... # cat /etc/stunnel/stunnel-client.conf ... [ppp] ;CLIENT client = yes retry = yes connect = 1.2.3.4:443 exec = /usr/sbin/pppd execargs = persist lock 10.0.1.2:10.0.1.1 local debug noauth name ppp-client pty = yes CAfile = ca.crt cert = client.crt key = client.key verifyChain = yes checkHost = hostname ;checkIP = 1.2.3.4 ... Thank you for answer in advance.

1 0

Re: [stunnel-users] illegal instruction crash 5.50 Debian/Stretch
by Michal Trojnara 29 Apr '19

29 Apr '19

On 24.04.2019 16:06, Florian Lohoff wrote: > with the stunnel4 in Debian/Stretch i am experiencing pretty regular > crashes with illegal instruction. Version is 5.50. > In Bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=880659 > you can see the drill down to a Lock beeing unlocked although > not locked. When i look at the code its some usage of openssl > primitives. (Unlock happens in openssl code) > I had a quick look at the changelog and this: > "Service threads are terminated before OpenSSL cleanup to prevent occasional stunnel crashes at shutdown." > sounds a bit like the issue i am experiencing. > Can you confirm this? Yes, I do confirm this is the issue described in the Debian bug #880659. It wasn't a simple coding error, but rather a design flaw introduced in version 3.0 that took 20 years to identify and fix. Before version 5.18, released almost 4 years ago, the shutdown race condition mostly manifested itself while terminating stunnel under extremely heavy load, such as stress testing. The probability has increased with the introduction of periodic DH parameter regeneration in version 5.18. I didn't test it, but I suspect some changes in the OpenSSL internals may have also cause the crashes to only surface fairly recently, and not 20 years ago. The fix itself involves a major redesign of the stunnel threading subsystem, so I made a beta version and I'd appreciate your help with testing it: https://www.stunnel.org/downloads/beta/stunnel-5.54b2.tar.gz Best regards, Mike

2 1

Either "verifyChain" or "verifyPeer" has to be enabled
by kovacs janos 23 Apr '19

23 Apr '19

sorry to bother, again this is probably something simple, but i couldn't find anything about it. i'm trying to make stunnel NOT verify the certificate of the address it connects to. specifically because the certificate date will give an error, and i know its safe to connect there. whenever i put 'verify = 0' or 'verifyChain = no' or 'verifyPeer = no' in the configuration, i get an error saying 'Either "verifyChain" or "verifyPeer" has to be enabled', and so the configuration can't be applied. and i found nothing about this anywhere. or this could only be set on server Services? and there is no way to not verify if 'client = yes'?

1 0

Stunnel 5.44 client syntax to accept connections on pty?
by Martin Got 18 Apr '19

18 Apr '19

How to use 'stunnel' in client mode to accept connections on pty from local programs like 'ppp' instead of 'accept=IP:PORT'? 'pty = yes' seems work in server mode only, so when I removed 'accept = 127.0.0.1:1723' from 'stunnel' client config I'm getting the error: [!] Service [ppp]: Each service must define two endpoints on stunnel-5.44 I need to call 'stunnel' client from 'pppd' and communicate with 'stunnel' using pty if it was possible by using a command: pppd /dev/ptyp3 10.0.1.2: local debug noauth passive noccp novj novjccomp nopcomp noaccomp name ppp-client connect 'stunnel /etc/stunnel/stunnel-client.conf' Both 'pppd' and 'stunnel' started by executing the command above, but 'pppd' can't communicate to 'stunnel' server using pty. Please advice. [ppp] client = yes accept = [127.0.0.1:1723 ](http://127.0.0.1:1723) ^^^^^^^^^^^^^^^^^^^^^^^ connect = STUNNEL-SERVER-IP:723 CAfile = /etc/stunnel/ca.crt cert = /etc/stunnel/client.crt key = /etc/stunnel/client.key verifyChain = yes checkHost = hostna.me ;checkIP = 1.2.3.4

2 1

Sending original IP (proxy) for smtp
by James Brown 16 Apr '19

16 Apr '19

I’d like stunnel to pass the incoming IP along, not stunnel's IP. My traffic flow is: Stunnel (accept on port 465) -> ASSP (an smtp proxy) -> Postfix (accept on port 10026) I tried: [ssmtp] client = no accept = 465 connect = 25 protocol = proxy But ASSP had: Apr-15-19 18:50:22 [Worker_1] Connected: session:7FE104AA1870 127.0.0.1:58954 > 127.0.0.1:25 > 127.0.0.1:10026 Apr-15-19 18:50:23 [Worker_1] 127.0.0.1 warning: got reply '502 5.5.2 Error: command not recognized' from 127.0.0.1 Apr-15-19 18:50:23 id-18223-03317 [Worker_1] 127.0.0.1 info: sending EHLO instead of HELO to 127.0.0.1 Apr-15-19 18:50:23 id-18223-03317 [Worker_1] 127.0.0.1 disconnected: session:7FE104AA1870 127.0.0.1 - processing time 1 seconds And Postfix had: 2019-04-15 18:50:22.995042+1000 localhost smtpd[33360]: connect from localhost[127.0.0.1] 2019-04-15 18:50:23.108756+1000 localhost smtpd[33360]: improper command pipelining after EHLO from localhost[127.0.0.1]: RSET\r\n 2019-04-15 18:50:23.273664+1000 localhost smtpd[33360]: disconnect from localhost[127.0.0.1] ehlo=2 rset=1 quit=1 unknown=0/1 commands=4/5 So I take it protocol=proxy is not the way to do it. Sounds like this only works with haproxy which I do not have installed. Is there a way to do this? The problem I am trying to solve is ASSP has lines like: warning: SMTP authentication failed on 127.0.0.1 - obviously I don’t want fail2ban to ban 127.0.0.1. Stunnel log has: 2019.04.15 18:52:26 LOG5[23]: Service [ssmtp] accepted connection from ::ffff:185.222.209.66:53642 2019.04.15 18:52:27 LOG3[23]: s_connect: connect ::1:25: Connection refused (61) Any suggestions? Thanks, James.

2 3

Support for TLS 1.3 Early Data?
by hshh 13 Apr '19

13 Apr '19

Is it stunnel 5.54 support for TLS 1.3 Early Data? Stunnel 5.54, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384. I was tested by openssl s_client, return "Early data was not sent".

1 0

Possible memory leak at asn1_lib.c:412: 20417 allocations
by Marc Smith 12 Apr '19

12 Apr '19

Hi, I'm using stunnel version 5.44 with OpenSSL version 1.0.2r on Linux. I noticed if stunnel has been running for a while, we start observing these messages in the logs: Apr 12 19:12:11 localhost stunnel: LOG4[971]: Possible memory leak at asn1_lib.c:412: 20417 allocations Apr 12 19:12:11 localhost stunnel: LOG4[971]: Possible memory leak at tasn_new.c:180: 20416 allocations And indeed, the process is consuming memory at a steady rate, and continues to grow until stopped. I updated to the latest stunnel version (5.53) and I no longer see these "possible memory leak" messages in the logs, yet the process still appears to consume memory as before (until it gets very large and things stop working). Is this actually a bug in the OpenSSL library? I'm using the latest in that release series (1.0.2), but perhaps this is a "known" leak and resolved in OpenSSL 1.1.1? Any help would be greatly appreciated. Thanks, Marc

1 0

OCSP validation via AIA responders through a proxy
by Olops, Daniel 12 Apr '19

12 Apr '19

Hello, stunnel v5.53 ignores proxy settings when performing OCSP validation via AIA responders. An open issue for OpenSSL at their GitHub suggests that this is a feature request for them (https://github.com/openssl/openssl/issues/6965) thus not being a stunnel limitation itself, and I've asked for clarification in the openssl-users mainling list (https://mta.openssl.org/pipermail/openssl-users/2019-April/010285.html) In either case, I want do double-check it with you guys: is this really an OpenSSL limitation, or is this something that can be addressed in stunnel code? Regards, Daniel O. Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg, R.C.S. Luxembourg B186284 Amazon Web Services EMEA SARL, Irish Branch, One Burlington Plaza, Burlington Road, Dublin 4, Ireland, branch registration number 908705

1 0

stunnel 5.44 + pppd client side problem
by Martin Got 12 Apr '19

12 Apr '19

Trying to set up pppd link with stunnel wrapped between two OpenBSD 6.4amd64 machines. I use this reference article as an idea: http://bremford.org/tips/QuickStunnelVPN.html While connecting from client's side by command: /usr/sbin/pppd ptypA 10.0.1.2: local debug noauth passive noccp novj novjccomp nopcomp noaccomp name ppp-clnt connect 'stunnel /etc/stunnel/stunnel-client.conf stunnel-client starts, pppd starts on client's end according to stunnel-clnt.log, but has LCP timeouts: # tail stunnel-clnt.log stunnel: LOG5[ui]: Configuration successful pppd[5421]: Connect: ppp2 <--> /dev/ptypA pppd[5421]: LCP: timeout sending Config-Requests pppd[5421]: Connection terminated. pppd[5421]: Connect script failed It seems no pppd pty client connection to stunnel-local nor remote stunnel-server afterwards. But when I tried to connect to stunnel-client port 1723 using telnet: telnet localhost 1723 I received pppd advertisements from remote stunnel-server. It seems exec = /usr/sbin/pppd on stunnel-server is running when client's stunnel-client connection appeared. Can it be a problem with pppd and stunnel-client using pty? Please advice. # cat /etc/stunnel/stunnel-server.conf ;chroot = /var/stunnel # chroot is disabled for testing ;setuid = _stunnel # stunnel started by root for testing currently ;setgid = _stunnel ; PID file is created inside the chroot jail (if enabled) ;pid = /stunnel.pid foreground = yes debug = 7 ;output = log/stunnel.log # disabled sslVersion = TLSv1.2 socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Enable support for the insecure SSLv3 protocol ;options = NO_SSLv3 options = NO_TLSv1 options = NO_TLSv1.1 ; Fix for Eudora "error reading network" can be useful for changing packet length options = DONT_INSERT_EMPTY_FRAGMENTS ; These options provide additional security at some performance degradation ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; *** TLS server mode services [ppp] accept = 723 exec = /usr/sbin/pppd execargs = 10.0.1.1: local debug noauth pty = yes CAfile = /etc/stunnel/ca.crt cert = /etc/stunnel/srv.crt key = /etc/stunnel/private/srv.key verifyChain = yes TIMEOUTclose = 45 [default] ; HTTP connections ;ciphers = ALL ;options = CIPHER_SERVER_PREFERENCE accept = 1111 connect = 127.0.0.1:80 CAfile = /etc/stunnel/ca.crt cert = /etc/stunnel/srv.crt key = /etc/stunnel/private/srv.key verifyChain = yes TIMEOUTclose = 0 [ntp] connect = 127.0.0.1:123 sni = default:ntp CAfile = /etc/stunnel/ca.crt cert = /etc/stunnel/srv.crt key = /etc/stunnel/private/srv.key verifyChain = yes TIMEOUTclose = 0 -------------------- # cat /etc/stunnel/stunnel-client.conf chroot = /var/stunnel setuid = _stunnel setgid = _stunnel pid = /stunnel-clnt.pid foreground = yes debug = 7 ;output = log/stunnel-clnt.log sslVersion = TLSv1.2 socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Enable support for the insecure SSLv3 protocol ;options = NO_SSLv3 options = NO_TLSv1 options = NO_TLSv1.1 ; Fix for Eudora "error reading network" can be useful for changing packet length options = DONT_INSERT_EMPTY_FRAGMENTS ; These options provide additional security at some performance degradation ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE [ppp] client = yes accept = 127.0.0.1:1723 # 'accept' is absent in client's configuration http://bremford.org/tips/QuickStunnelVPN.htmlbut stunnel reports: [!] Service [ppp]: Each service must define two endpoints on stunnel-5.44 connect = STUNNEL-SERVER-IP:723 CAfile = /etc/stunnel/ca.crt cert = /etc/stunnel/client.crt key = /etc/stunnel/client.key verifyChain = yes checkHost = hostna.me ;checkIP = 1.2.3.4 --------------------

2 1

Stunnel 5.51 Pop3 Problem?
by Colin 10 Apr '19

10 Apr '19

Hello, I'm new to this list and looking for advice/help with release 5.51 for Windows. I have three accounts, Yahoo, Aol and Gmx and I use Foxmail 5 with Stunnel. I use pop3 with all accounts and sometimes when retrieving mail I may decide to 'Not Fetch' any mail on the server that looks 'iffy' untill I've looked at it via the mail providers website. Now I've just upgraded to version 5.51 (over 5.50) and when checking any of the said accounts I can't see any mail that hasn't been fetched (the server looks empty.) But if I login to the mail website the unfetched mail is there to view for all accounts. I reverted to version 5.50 and now I can see the unfetched mail for all accounts in my 3rd party software. Therefore my question is: Is there a problem (bug??) with 5.51 which stops me from seeing unfetched pop3 mail or do I have to add something to the config file to make it work properly? Thanks...Colin ============ The problem of mail not being seen on the server seems fixed in 5.52 but now another glitch has arisen. When trying to download mail from a server the programme keeps freezing at a certain point. Let's say if I have ten mails to download the programme will freeze at maybe the third one and won't download the rest. I can try it several times and everything freezes at the same point. Again I've gone back to 5.50 and all works perfectly. Any ideas on how to fix this or shall I stay with 5.50?

2 1

Connection issues after upgrading to 5.51 (macOS)
by Dennis Preiser 10 Apr '19

10 Apr '19

Hi, I have been using stunnel for quite a long time on macOS without any problems. Specifically, I use this to connect to an nntps server. This is the corresponding config section: | [nntp2] | client = yes | accept = 127.0.0.2:1119 | connect = news.individual.de:563 With 5.50 everything goes well: | 2019.04.06 10:48:05 LOG5[2]: Service [nntp2] accepted connection from 127.0.0.2:49366 | 2019.04.06 10:48:05 LOG5[2]: s_connect: connected 130.133.4.10:563 | 2019.04.06 10:48:05 LOG5[2]: Service [nntp2] connected remote server from 192.168.200.102:49367 I can read news without further log entries. After the upgrade to 5.51 I can not read any news anymore. As soon as I want to read an article the connection breaks down: | 2019.04.06 10:54:09 LOG5[0]: Service [nntp2] accepted connection from 127.0.0.2:49189 | 2019.04.06 10:54:09 LOG5[0]: s_connect: connected 130.133.4.10:563 | 2019.04.06 10:54:09 LOG5[0]: Service [nntp2] connected remote server from 192.168.200.102:49190 | 2019.04.06 10:54:19 LOG3[0]: transfer() loop executes not transferring any data | 2019.04.06 10:54:19 LOG3[0]: please report the problem to Michal.Trojnara(a)stunnel.org | 2019.04.06 10:54:19 LOG3[0]: stunnel 5.51 on x86_64-apple-darwin18.5.0 platform | 2019.04.06 10:54:19 LOG3[0]: Compiled/running with OpenSSL 1.1.1b 26 Feb 2019 | 2019.04.06 10:54:19 LOG3[0]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI | 2019.04.06 10:54:19 LOG3[0]: protocol=TLSv1.2, SSL_pending=0 | 2019.04.06 10:54:19 LOG3[0]: sock_open_rd=Y, sock_open_wr=Y | 2019.04.06 10:54:19 LOG3[0]: SSL_RECEIVED_SHUTDOWN=n, SSL_SENT_SHUTDOWN=n | 2019.04.06 10:54:19 LOG3[0]: sock_can_rd=n, sock_can_wr=n | 2019.04.06 10:54:19 LOG3[0]: ssl_can_rd=n, ssl_can_wr=n | 2019.04.06 10:54:19 LOG3[0]: read_wants_read=Y, read_wants_write=n | 2019.04.06 10:54:19 LOG3[0]: write_wants_read=n, write_wants_write=n | 2019.04.06 10:54:19 LOG3[0]: shutdown_wants_read=n, shutdown_wants_write=n | 2019.04.06 10:54:19 LOG3[0]: socket input buffer: 0 byte(s), TLS input buffer: 0 byte(s) | 2019.04.06 10:54:19 LOG5[0]: Connection reset: 2151 byte(s) sent to TLS, 3546 byte(s) sent to socket | 2019.04.06 10:54:21 LOG5[1]: Service [nntp2] accepted connection from 127.0.0.2:49191 | 2019.04.06 10:54:21 LOG5[1]: s_connect: connected 130.133.4.10:563 | 2019.04.06 10:54:21 LOG5[1]: Service [nntp2] connected remote server from 192.168.200.102:49192 | 2019.04.06 10:54:23 LOG3[1]: transfer() loop executes not transferring any data | 2019.04.06 10:54:23 LOG3[1]: please report the problem to Michal.Trojnara(a)stunnel.org | 2019.04.06 10:54:23 LOG3[1]: stunnel 5.51 on x86_64-apple-darwin18.5.0 platform | 2019.04.06 10:54:23 LOG3[1]: Compiled/running with OpenSSL 1.1.1b 26 Feb 2019 | 2019.04.06 10:54:23 LOG3[1]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI | 2019.04.06 10:54:23 LOG3[1]: protocol=TLSv1.2, SSL_pending=0 | 2019.04.06 10:54:23 LOG3[1]: sock_open_rd=Y, sock_open_wr=Y | 2019.04.06 10:54:23 LOG3[1]: SSL_RECEIVED_SHUTDOWN=n, SSL_SENT_SHUTDOWN=n | 2019.04.06 10:54:23 LOG3[1]: sock_can_rd=n, sock_can_wr=n | 2019.04.06 10:54:23 LOG3[1]: ssl_can_rd=n, ssl_can_wr=n | 2019.04.06 10:54:23 LOG3[1]: read_wants_read=Y, read_wants_write=n | 2019.04.06 10:54:23 LOG3[1]: write_wants_read=n, write_wants_write=n | 2019.04.06 10:54:23 LOG3[1]: shutdown_wants_read=n, shutdown_wants_write=n | 2019.04.06 10:54:23 LOG3[1]: socket input buffer: 0 byte(s), TLS input buffer: 0 byte(s) | 2019.04.06 10:54:23 LOG5[1]: Connection reset: 163 byte(s) sent to TLS, 435 byte(s) sent to socket Downgrading to 5.50 solves this issue for the time being. Are there any changes between 5.50 and 5.51 that could explain this behavior? Dennis

1 1

stunnel 5.53 released
by Michal Trojnara 10 Apr '19

10 Apr '19

Dear Users, I have released version 5.53 of stunnel. Version 5.53, 2019.04.10, urgency: HIGH * Bugfixes - Fixed data transfer stalls introduced in stunnel 5.51. * New features - Android binary updated to support Android 4.x. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 80439896ee14269eb70bc8bc669433c7d619018a62c9f9c5c760a24515302585 stunnel-5.53.tar.gz 4f2d24d08f547943b8a499d411425409a52973a349c9120c650ba77d3f29ef79 stunnel-5.53-win64-installer.exe e619880f4fc25a7a4869cace9f6e6f3f5940cfdb764ed9987d892d9e9b0ea35d stunnel-5.53-android.zip Best regards, Mike

1 0

stunnel 5.52 released
by Michal Trojnara 10 Apr '19

10 Apr '19

Dear Users, I have released version 5.52 of stunnel. Version 5.52, 2019.04.08, urgency: HIGH * Bugfixes - Fixed a transfer() loop bug introduced in stunnel 5.51. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 00b973aa0d48b0707dd722c4e0a20b8378fc9b0ba301fdb785ffb75341024e21 stunnel-5.52.tar.gz c9224c35cdd3a6de8fab7c2844ca0c185ebcc96fd9183a05407e2ba77cadc7c6 stunnel-5.52-win64-installer.exe d4ff581e1547c2e194abd586e9542bfe20399c1287f970eaa5ba1824e4567453 stunnel-5.52-android.zip Best regards, Mike

2 1

stunnel 5.51 released
by Michal Trojnara 10 Apr '19

10 Apr '19

Dear Users, I have released version 5.51 of stunnel. Version 5.51, 2019.04.04, urgency: MEDIUM * New features - Hexadecimal PSK keys are automatically converted to binary. - Session ticket support (requires OpenSSL 1.1.1 or later). "connect" address persistence is currently unsupported with session tickets. - SMTP HELO before authentication (thx to Jacopo Giudici). - New "curves" option to control the list of elliptic curves in OpenSSL 1.1.0 and later. - New "ciphersuites" option to control the list of permitted TLS 1.3 ciphersuites. - Include file name and line number in OpenSSL errors. - Compatibility with the current OpenSSL 3.0.0-dev branch. - Better performance with SSL_set_read_ahead()/SSL_pending(). * Bugfixes - Fixed PSKsecrets as a global option (thx to Teodor Robas). - Fixed a memory allocation bug (thx to matanfih). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 77437cdd1aef1a621824bb3607e966534642fe90c69f4d2279a9da9fa36c3253 stunnel-5.51.tar.gz a0e26fde3ba09d6545cfbb44cab06ebd4ddf9c4b536e7d8eb76615ab54b2339c stunnel-5.51-win64-installer.exe ee90bef40cb47617fe7372707dba119f5176cb0fd9eb1bc00cdd1e2c370041db stunnel-5.51-android.zip Best regards, Mike

2 1

Problems after compiling stunnel 5.16 with openssl 1.0.2k
by simona vittori 09 Apr '19

09 Apr '19

Hello, I have compiled stunnel 5.16 with openssl 1.0.2k on a linux 3.0.101-97-default. When I execute ./stunnel -version I receive the following error: ./stunnel: error while loading shared libraries: libssl.so.1.0.0: cannot open shared object file: No such file or directory Can anyone help me please? Thanks a lot bye bye Simona

2 1

Issues after upgrading stunnel to v5.51 on Windows
by stunnel＠alpiston.com 07 Apr '19

07 Apr '19

Hello, I've been using stunnel v5.50 (x64-pc-mingw32-gnu) to encrypt RTSP traffic between two Win10 Pro computers without any problems. However, after upgrading to stunnel v5.51 the RTSP traffic has started to stutter (as the framerate has dropped to almost nothing, from 20 fps to 0.01 fps to be precise), and the few frames that are actually transferred arrive visually corrupted. After enabling debugging at level 7, I get the following (some parts have been obfuscated for privacy reasons): 2019.04.08 00:53:51 LOG7[main]: Found 1 ready file descriptor(s) 2019.04.08 00:53:51 LOG7[main]: FD=528 ifds=r-x ofds=--- 2019.04.08 00:53:51 LOG7[main]: FD=536 ifds=r-x ofds=--- 2019.04.08 00:53:51 LOG7[main]: FD=544 ifds=r-x ofds=--- 2019.04.08 00:53:51 LOG7[main]: FD=648 ifds=r-x ofds=r-- 2019.04.08 00:53:51 LOG7[main]: FD=664 ifds=r-x ofds=--- 2019.04.08 00:53:51 LOG7[main]: FD=828 ifds=r-x ofds=--- 2019.04.08 00:53:51 LOG7[main]: Service [RTSP] accepted (FD=584) from A.B.C.D:E 2019.04.08 00:53:51 LOG7[main]: Creating a new thread 2019.04.08 00:53:51 LOG7[main]: New thread created 2019.04.08 00:53:51 LOG7[2]: Service [RTSP] started 2019.04.08 00:53:51 LOG7[2]: Setting local socket options (FD=584) 2019.04.08 00:53:51 LOG7[2]: Option TCP_NODELAY set on local socket 2019.04.08 00:53:51 LOG5[2]: Service [RTSP] accepted connection from A.B.C.D:E 2019.04.08 00:53:51 LOG6[2]: s_connect: connecting F.G.H.I:J 2019.04.08 00:53:51 LOG7[2]: s_connect: s_poll_wait F.G.H.I:J: waiting 10 seconds 2019.04.08 00:53:51 LOG5[2]: s_connect: connected F.G.H.I:J 2019.04.08 00:53:51 LOG5[2]: Service [RTSP] connected remote server from A.B.C.D:K 2019.04.08 00:53:51 LOG7[2]: Setting remote socket options (FD=900) 2019.04.08 00:53:51 LOG7[2]: Option TCP_NODELAY set on remote socket 2019.04.08 00:53:51 LOG7[2]: Remote descriptor (FD=900) initialized 2019.04.08 00:53:51 LOG6[2]: SNI: sending servername: LLLL 2019.04.08 00:53:51 LOG6[2]: Peer certificate required 2019.04.08 00:53:51 LOG7[2]: TLS state (connect): before SSL initialization 2019.04.08 00:53:51 LOG7[2]: TLS state (connect): SSLv3/TLS write client hello 2019.04.08 00:53:51 LOG7[2]: TLS state (connect): SSLv3/TLS write client hello 2019.04.08 00:53:51 LOG7[2]: TLS state (connect): SSLv3/TLS read server hello 2019.04.08 00:53:51 LOG7[2]: TLS state (connect): TLSv1.3 read encrypted extensions 2019.04.08 00:53:51 LOG7[2]: Verification started at depth=1: O=O, OU=OU, CN=CN 2019.04.08 00:53:51 LOG7[2]: CERT: Pre-verification succeeded 2019.04.08 00:53:51 LOG6[2]: Certificate accepted at depth=1: O=O, OU=OU, CN=CN 2019.04.08 00:53:51 LOG7[2]: Verification started at depth=0: O=O, OU=OU 2019.04.08 00:53:51 LOG7[2]: CERT: Pre-verification succeeded 2019.04.08 00:53:51 LOG6[2]: CERT: Host name "LLLL" matched with "LLLL" 2019.04.08 00:53:51 LOG5[2]: Certificate accepted at depth=0: O=O, OU=OU 2019.04.08 00:53:51 LOG7[2]: TLS state (connect): SSLv3/TLS read server certificate 2019.04.08 00:53:51 LOG7[2]: TLS state (connect): TLSv1.3 read server certificate verify 2019.04.08 00:53:51 LOG7[2]: TLS state (connect): SSLv3/TLS read finished 2019.04.08 00:53:51 LOG7[2]: TLS state (connect): SSLv3/TLS write change cipher spec 2019.04.08 00:53:51 LOG7[2]: TLS state (connect): SSLv3/TLS write finished 2019.04.08 00:53:51 LOG7[2]: 1 client connect(s) requested 2019.04.08 00:53:51 LOG7[2]: 1 client connect(s) succeeded 2019.04.08 00:53:51 LOG7[2]: 0 client renegotiation(s) requested 2019.04.08 00:53:51 LOG7[2]: 0 session reuse(s) 2019.04.08 00:53:51 LOG6[2]: TLS connected: new session negotiated 2019.04.08 00:53:51 LOG6[2]: TLSv1.3 ciphersuite: TLS_CHACHA20_POLY1305_SHA256 (256-bit encryption) 2019.04.08 00:53:51 LOG7[2]: Compression: null, expansion: null 2019.04.08 00:53:51 LOG7[2]: TLS state (connect): SSL negotiation finished successfully 2019.04.08 00:53:51 LOG7[2]: TLS state (connect): SSL negotiation finished successfully 2019.04.08 00:53:51 LOG7[2]: Deallocating application specific data for session connect address 2019.04.08 00:53:51 LOG7[2]: New session callback 2019.04.08 00:53:51 LOG7[2]: Peer certificate was cached (1509 bytes) 2019.04.08 00:53:51 LOG6[2]: Session id: 08B6A892F03C33D29542A794B1C5B0A7646FB9160318EC39D3F294EEF7CAE4EB 2019.04.08 00:53:51 LOG7[2]: TLS state (connect): SSLv3/TLS read server session ticket 2019.04.08 00:53:51 LOG7[2]: TLS state (connect): SSL negotiation finished successfully 2019.04.08 00:53:51 LOG7[2]: TLS state (connect): SSL negotiation finished successfully 2019.04.08 00:53:51 LOG7[2]: New session callback 2019.04.08 00:53:51 LOG7[2]: Deallocating application specific data for session connect address 2019.04.08 00:53:51 LOG6[2]: Session id: 9A06F5437D7039A32E531DA4976EDE9F8CA44820025221D1CE36E237B71E9AD3 2019.04.08 00:53:51 LOG7[2]: TLS state (connect): SSLv3/TLS read server session ticket 2019.04.08 00:54:02 LOG6[2]: Read socket closed (readsocket) 2019.04.08 00:54:02 LOG7[2]: Sending close_notify alert 2019.04.08 00:54:02 LOG7[2]: TLS alert (write): warning: close notify 2019.04.08 00:54:02 LOG6[2]: SSL_shutdown successfully sent close_notify alert 2019.04.08 00:54:02 LOG7[main]: Found 1 ready file descriptor(s) 2019.04.08 00:54:02 LOG7[main]: FD=528 ifds=r-x ofds=--- 2019.04.08 00:54:02 LOG7[main]: FD=536 ifds=r-x ofds=--- 2019.04.08 00:54:02 LOG7[main]: FD=544 ifds=r-x ofds=--- 2019.04.08 00:54:02 LOG7[main]: FD=648 ifds=r-x ofds=r-- 2019.04.08 00:54:02 LOG7[main]: FD=664 ifds=r-x ofds=--- 2019.04.08 00:54:02 LOG7[main]: FD=828 ifds=r-x ofds=--- 2019.04.08 00:54:02 LOG7[main]: Service [RTSP] accepted (FD=908) from A.B.C.D:L 2019.04.08 00:54:02 LOG7[main]: Creating a new thread 2019.04.08 00:54:02 LOG7[main]: New thread created 2019.04.08 00:54:02 LOG7[3]: Service [RTSP] started 2019.04.08 00:54:02 LOG7[3]: Setting local socket options (FD=908) 2019.04.08 00:54:02 LOG7[3]: Option TCP_NODELAY set on local socket 2019.04.08 00:54:02 LOG5[3]: Service [RTSP] accepted connection from A.B.C.D:L 2019.04.08 00:54:02 LOG7[2]: TLS alert (read): warning: close notify 2019.04.08 00:54:02 LOG6[2]: TLS closed (SSL_read) 2019.04.08 00:54:02 LOG7[2]: Sent socket write shutdown 2019.04.08 00:54:02 LOG5[2]: Connection closed: 1374 byte(s) sent to TLS, 1782 byte(s) sent to socket 2019.04.08 00:54:02 LOG7[2]: Remote descriptor (FD=900) closed 2019.04.08 00:54:02 LOG7[2]: Local descriptor (FD=584) closed 2019.04.08 00:54:02 LOG7[2]: Service [RTSP] finished (1 left) 2019.04.08 00:54:02 LOG6[3]: s_connect: connecting F.G.H.I:J 2019.04.08 00:54:02 LOG7[3]: s_connect: s_poll_wait F.G.H.I:J: waiting 10 seconds 2019.04.08 00:54:02 LOG5[3]: s_connect: connected F.G.H.I:J 2019.04.08 00:54:02 LOG5[3]: Service [RTSP] connected remote server from A.B.C.D:M 2019.04.08 00:54:02 LOG7[3]: Setting remote socket options (FD=592) 2019.04.08 00:54:02 LOG7[3]: Option TCP_NODELAY set on remote socket 2019.04.08 00:54:02 LOG7[3]: Remote descriptor (FD=592) initialized 2019.04.08 00:54:02 LOG6[3]: SNI: sending servername: LLLL 2019.04.08 00:54:02 LOG6[3]: Peer certificate required 2019.04.08 00:54:02 LOG7[3]: TLS state (connect): before SSL initialization 2019.04.08 00:54:02 LOG7[3]: TLS state (connect): SSLv3/TLS write client hello 2019.04.08 00:54:02 LOG7[3]: TLS state (connect): SSLv3/TLS write client hello 2019.04.08 00:54:02 LOG7[3]: TLS state (connect): SSLv3/TLS read server hello 2019.04.08 00:54:02 LOG7[3]: TLS state (connect): TLSv1.3 read encrypted extensions 2019.04.08 00:54:02 LOG7[3]: TLS state (connect): SSLv3/TLS read finished 2019.04.08 00:54:02 LOG7[3]: TLS state (connect): SSLv3/TLS write change cipher spec 2019.04.08 00:54:02 LOG7[3]: TLS state (connect): SSLv3/TLS write finished 2019.04.08 00:54:02 LOG7[3]: Remove session callback 2019.04.08 00:54:02 LOG7[3]: 2 client connect(s) requested 2019.04.08 00:54:02 LOG7[3]: 2 client connect(s) succeeded 2019.04.08 00:54:02 LOG7[3]: 0 client renegotiation(s) requested 2019.04.08 00:54:02 LOG7[3]: 1 session reuse(s) 2019.04.08 00:54:02 LOG6[3]: TLS connected: previous session reused 2019.04.08 00:54:02 LOG6[3]: TLSv1.3 ciphersuite: TLS_CHACHA20_POLY1305_SHA256 (256-bit encryption) 2019.04.08 00:54:02 LOG7[3]: Compression: null, expansion: null 2019.04.08 00:54:02 LOG6[3]: Session id: 9A06F5437D7039A32E531DA4976EDE9F8CA44820025221D1CE36E237B71E9AD3 2019.04.08 00:54:02 LOG7[3]: TLS state (connect): SSL negotiation finished successfully 2019.04.08 00:54:02 LOG7[3]: TLS state (connect): SSL negotiation finished successfully 2019.04.08 00:54:02 LOG7[3]: New session callback 2019.04.08 00:54:02 LOG7[3]: Deallocating application specific data for session connect address 2019.04.08 00:54:02 LOG6[3]: Session id: C0F06C6E894812890045433304AD5880C6512D9FD3E61AA67285009143AFD645 2019.04.08 00:54:02 LOG7[3]: TLS state (connect): SSLv3/TLS read server session ticket 2019.04.08 00:54:05 LOG3[3]: transfer() loop executes not transferring any data 2019.04.08 00:54:05 LOG3[3]: please report the problem to Michal.Trojnara(a)stunnel.org 2019.04.08 00:54:05 LOG3[3]: stunnel 5.51 on x64-pc-mingw32-gnu platform 2019.04.08 00:54:05 LOG3[3]: Compiled/running with OpenSSL 1.1.1b 26 Feb 2019 2019.04.08 00:54:05 LOG3[3]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI 2019.04.08 00:54:05 LOG7[3]: errno: (*_errno()) 2019.04.08 00:54:05 LOG3[3]: protocol=TLSv1.3, SSL_pending=0 2019.04.08 00:54:05 LOG3[3]: sock_open_rd=Y, sock_open_wr=Y 2019.04.08 00:54:05 LOG3[3]: SSL_RECEIVED_SHUTDOWN=n, SSL_SENT_SHUTDOWN=n 2019.04.08 00:54:05 LOG3[3]: sock_can_rd=n, sock_can_wr=n 2019.04.08 00:54:05 LOG3[3]: ssl_can_rd=n, ssl_can_wr=n 2019.04.08 00:54:05 LOG3[3]: read_wants_read=Y, read_wants_write=n 2019.04.08 00:54:05 LOG3[3]: write_wants_read=n, write_wants_write=n 2019.04.08 00:54:05 LOG3[3]: shutdown_wants_read=n, shutdown_wants_write=n 2019.04.08 00:54:05 LOG3[3]: socket input buffer: 0 byte(s), TLS input buffer: 0 byte(s) 2019.04.08 00:54:05 LOG5[3]: Connection reset: 1169 byte(s) sent to TLS, 19088 byte(s) sent to socket 2019.04.08 00:54:05 LOG7[3]: Remote descriptor (FD=592) closed 2019.04.08 00:54:05 LOG7[3]: Local descriptor (FD=908) closed 2019.04.08 00:54:05 LOG7[3]: Service [RTSP] finished (0 left) As you can see, at 00:54:05 there's a log entry that says "transfer() loop executes not transferring any data". Any ideas about why is this happening on v5.51, and how could I solve it? By the way, should I e-mail this issue to Michal Trojnara as the logs suggests, or should I use this mailing list exclusively? Thank you, Ricardo.-- Best regards

1 0

Stunnel 5.51 Pop3 Problem?
by Colin 07 Apr '19

07 Apr '19

Hello, I'm new to this list and looking for advice/help with release 5.51 for Windows. I have three accounts, Yahoo, Aol and Gmx and I use Foxmail 5 with Stunnel. I use pop3 with all accounts and sometimes when retrieving mail I may decide to 'Not Fetch' any mail on the server that looks 'iffy' untill I've looked at it via the mail providers website. Now I've just upgraded to version 5.51 (over 5.50) and when checking any of the said accounts I can't see any mail that hasn't been fetched (the server looks empty.) But if I login to the mail website the unfetched mail is there to view for all accounts. I reverted to version 5.50 and now I can see the unfetched mail for all accounts in my 3rd party software. Therefore my question is: Is there a problem (bug??) with 5.51 which stops me from seeing unfetched pop3 mail or do I have to add something to the config file to make it work properly? Thanks...Colin

1 0

Re: [stunnel-users] V5.51 no support for OpenSSL 1.0.2 ?
by Peter Pentchev 05 Apr '19

05 Apr '19

On Fri, Apr 05, 2019 at 01:39:04PM +0000, Duncan Morris wrote: > Hi, > > The latest version of options.c, in the V5.51 source, uses a new function, which appears to only be present in OpenSSL 1.1.0 onwards. > > key_buf=OPENSSL_hexstr2buf(key_str, &key_len); > > Is it intentional that support for OpenSSL 1.0.2 has been dropped? But there is also this segment of code... #else /* OpenSSL older than 1.1.0 */ #define X509_STORE_CTX_get0_chain(x) X509_STORE_CTX_get_chain(x) #define OPENSSL_hexstr2buf string_to_hex #endif /* OpenSSL 1.1.0 or newer */ So it should build with OpenSSL 1.0.2, too. Have you actually experienced problems building it? G'luck, Peter -- Peter Pentchev roam(a){ringlet.net,debian.org,FreeBSD.org} pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

1 0

Is there a Win32 installer that supports sslVersionMin = TLS1.2?
by kent loving 01 Apr '19

01 Apr '19

I need to run a client on Win XP that connects to a server using TLS 1.2 or higher. Jose Alf posted that he made a test build of 5.50 in a win32 installer but uses OpenSSL 1.0.2p. And it does not seem to be official. The changelog says version 5.49, which has a win32 installer, also uses OpenSSL 1.0.2p. I can't tell if it supports TLS1.2. The man page implies I need OpenSSL 1.1.1 to get the sslVersionMin option. And, OpenSSL says v1.0.2 support ends in 9 months. Any advice is appreciated. Thanks, Kent Loving

3 2

OpenVPN with stunnel
by Heikki Lavaste 25 Mar '19

25 Mar '19

Hi, To bypass the office firewall to access home server, I'm trying to run openvpn over port 443 with stunnel. I managed to get to this point: Log on client side 2019.03.22 22:15:13 LOG5[38]: Connection closed: 352 byte(s) sent to TLS, 2067 byte(s) sent to socket 2019.03.22 22:15:19 LOG5[39]: Service [openvpn] accepted connection from 127.0.0.1:51265 2019.03.22 22:15:19 LOG5[39]: s_connect: connected x.x.x.x:443 2019.03.22 22:15:19 LOG5[39]: Service [openvpn] connected remote server from x.x.x.x:51266 2019.03.22 22:15:19 LOG5[39]: Connection closed: 352 byte(s) sent to TLS, 2067 byte(s) sent to socket Log on server side: Mar 22 22:21:54 ssh-server-heikki stunnel[2797]: LOG5[2797:140127128753920]: connect_blocking: connected 127.0.0.1:8443 Mar 22 22:21:54 ssh-server-heikki stunnel[2797]: LOG5[2797:140127128753920]: Service [openvpn] connected remote server from 127.0.0.1:49366 Mar 22 22:21:54 ssh-server-heikki stunnel[2797]: LOG5[2797:140127128753920]: Connection closed: 2067 byte(s) sent to SSL, 352 byte(s) sent to socket Config: Client [openvpn] client = yes accept = localhost:1337 connect = x.x.x.xg:443 cert = C:\Users\heikki_lavaste\Documents\stunnel\stunnel.pem verifyChain = yes verify = 2 CAfile = C:\Users\heikki_lavaste\Documents\stunnel\ca-cert.pem checkHost = stunnel.heikki-lab.local sslVersion = TLSv1 Server chroot = /var/run/stunnel sslVersion = TLSv1 pid = /stunnel.pid setuid = nobody setgid = nobody socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 cert = /etc/stunnel/stunnel.pem [openvpn] accept = 443 connect = localhost:8443 cert = /etc/stunnel/stunnel.pem The issue is probably nothing to do with stunnel but if somebody can help me figure this out, that'd be appreciated. Kind Regards Heikki

2 1

ERR_SSL_VERSION_INTERFERENCE on Google Chrome v 73.0.3683.86 and stunnel v5.51b1
by Kolan Koala 25 Mar '19

25 Mar '19

I cannot get TLS 1.3 to work with Chrome. TLS 1.3 works fine in firefox quantum v 66.0.1 over the same hardware, so this is not caused by middleboxes. It is a fault with stunnel or Chrome. ERR_SSL_VERSION_INTERFERENCE error occurs in Chrome and will not connect. For now the solution is to turn off TLS v1.3 in stunnel configuration and force TLS v1.2, but this is not a long term solution. Does anyone have a solution to use TLS 1.3 with chrome and stunnel together? Kolan

1 0

No more Win32 stunnel?
by John Hall 21 Mar '19

21 Mar '19

I've only just discovered that stunnel is seemingly no longer being updated for Win32; at any rate there has been no version 5.50 released for Win32. It would have been nice if there had been an announcement to that effect, as until now I was only subscribed to the announcements mailing list and had thus been in blissful ignorance. (For some reason I never saw ANY announcement for 5.50 - in fact I still seem to be on 5.47.) Given that there are a number of ports to different OSs by various people, is there any chance that someone might supply a Win32 port for future versions? (Sadly I lack the knowledge to do that myself.) -- John Hall

3 4