- stunnel-users - stunnel.org

Using Chrome directly as an STunnel Client to connect to an STunnel Server
by Dipen Doshi 05 Oct '17

05 Oct '17

Hello, I am new to STunnel and I am running into a problem. Here is my setup. I use an ASUS router with Merlin firmware. I have STunnel installed via Entware on this router. Running "stunnel -version" gives me: stunnel 5.41 on mipsel-openwrt-linux-gnu platform Compiled/running with OpenSSL 1.0.2k 26 Jan 2017 Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Global options: RNDbytes = 64 RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = HIGH:!DH:!aNULL:!SSLv2 (with "fips = no") curve = prime256v1 debug = daemon.notice logId = sequential options = NO_SSLv2 options = NO_SSLv3 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none ------------------------------------------------------------------------------------------- I use my own server certificate signed by my own CA. This cert has the proper SANs with correct DNS/IP entries. I use this server certificate both for my router's HTTPS web gui and for the "cert" and "key" files listed in the config file below. Also, the "CAfile" in the config is pointing to my Root CA's certificate. My Root CA is also imported in my Windows box's certificate store. I can directly access my router's web gui from LAN side via these ports: 80 (HTTP), 2000 (HTTPS). Router's LAN subnet is 10.49.49.0/24 and the router's WAN IP is 10.76.5.3 (it is double NAT for testing, this router is for testing) Also, STunnel is running as a server accepting connections on port 443 (all interfaces) on the router. ------------------------------------------------------------------------------------------- I want to use Chrome directly as an STunnel client on my Windows box. So, I don't run STunnel on my Windows box in the client mode. SITUATION 1: WORKS FINE!! -- PURPOSE: Use Chrome to connect to "https://WAN_IP:443" This should forward to the router's port 80 (HTTP protocol used). My STunnel config file on the router has: setuid = nobody setgid = nobody foreground foreground = yes syslog = yes debug = 7 [Test-Service] accept = 443 connect = 10.49.49.1:80 requireCert = yes verifyChain = yes CAfile = /mnt/Merlin/entware/etc/stunnel/ca.crt cert = /mnt/Merlin/entware/etc/stunnel/server.crt key = /mnt/Merlin/entware/etc/stunnel/server.key SITUATION 2: DOES NOT WORK!! -- PURPOSE: Use Chrome to connect to "https://WAN_IP:443" This should forward to the router's port 2000 (HTTPS protocol used). There is only one change from the Situation 1 config file. The line for "connect" changed to "connect = 10.49.49.1:2000) This does not work. Note that I can directly access my router's web gui over https with "https://LAN_IP:2000" via Chrome, with no warnings. ------------------------------------------------------------------------------ My thoughts: So, my current path is Chrome (Acting as STunnel Client) --> STunnel Server (on the router) --> Router's Web GUI. The "Chrome --> STunnel" Server connection is fine. Chrome prompts for private key and STunnel server correctly shows this incoming Chrome connection. The problem is the "STunnel Server --> Router" relay that uses HTTPS protocol. 1. STunnel does not like HTTPS to HTTPS relay. HTTP to HTTPS works, but not HTTPS to HTTPS. 2. STunnel server on my router is a client to my router's web gui. Is STunnel verifying the certificate of my router's HTTPS certificate? 3. If the above answer is yes, my guess is that STunnel sees a self signed certificate for this router and kills the connection? 4. How do I tell STunnel server to ignore certificate warnings for a remote connection, like when connecting to this router? 5. Or how do I explicitly tell STunnel to trust my Root CA while making this connection to my router? I couldn't find any options in STunnel for this. Regards, Dipen Doshi

2 3

Missing librairies
by Heinsbroek, Peter 26 Sep '17

26 Sep '17

I’m getting unresolved external symbol errors. I like to know what library I need for s_log. log.obj : error LNK2019: unresolved external symbol _stunnel_process_id referenced in function _log_id log.obj : error LNK2019: unresolved external symbol _stunnel_thread_id referenced in function _log_id log.obj : error LNK2019: unresolved external symbol _file_open referenced in function _log_open log.obj : error LNK2019: unresolved external symbol _file_close referenced in function _log_close log.obj : error LNK2019: unresolved external symbol _file_putline referenced in function _log_raw log.obj : error LNK2019: unresolved external symbol _tls_alloc referenced in function _s_log str.obj : error LNK2001: unresolved external symbol _tls_alloc log.obj : error LNK2019: unresolved external symbol _tls_get referenced in function _s_log str.obj : error LNK2001: unresolved external symbol _tls_get log.obj : error LNK2019: unresolved external symbol _ui_new_log referenced in function _log_raw log.obj : error LNK2019: unresolved external symbol _message_box referenced in function _fatal_debug log.obj : error LNK2019: unresolved external symbol _global_options referenced in function _log_open log.obj : error LNK2019: unresolved external symbol _stunnel_locks referenced in function _log_close str.obj : error LNK2001: unresolved external symbol _stunnel_locks str.obj : error LNK2019: unresolved external symbol _num_clients referenced in function _leak_threshold str.obj : error LNK2019: unresolved external symbol _number_of_sections referenced in function _str_leak_debug str.obj : error LNK2019: unresolved external symbol _tls_initialized referenced in function _str_stats __________________ With regards Peter Heinsbroek Tel. +31 (0)88 265 9869 This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, Atos’ liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted. On all offers and agreements under which Atos Nederland B.V. supplies goods and/or services of whatever nature, the Terms of Delivery from Atos Nederland B.V. exclusively apply. The Terms of Delivery shall be promptly submitted to you on your request.

1 0

Bug: Modifying configure.ac results in error
by Reschke, Sven (VWIF G-TS/P) 22 Sep '17

22 Sep '17

Hallo, I've encounter a problem when editing the configure.ac. I've upgraded to Stunnel 5.42, the problem wasn't existent with Stunnel 5.41. The normal operation is that "./configure" and "make" will run without an error. So far, so good. Now, if I edit the configure.ac, running again "./configure" and "make", "make" will report: CDPATH="${ZSH_VERSION+.}:" && cd . && /bin/sh <path_to_stunnel_sources>/stunnel-5.42 /auto/missing aclocal-1.14 -I m4 cd . && /bin/sh <path_to_stunnel_sources>/stunnel-5.42 /auto/missing automake-1.14 --gnu CDPATH="${ZSH_VERSION+.}:" && cd . && /bin/sh <path_to_stunnel_sources>/stunnel-5.42 /auto/missing autoconf configure.ac:4: error: possibly undefined macro: AC_MSG_NOTICE If this token and others are legitimate, please use m4_pattern_allow. See the Autoconf documentation. configure.ac:23: error: possibly undefined macro: AC_DEFINE make: *** [configure] Error 1 Here it doesn't matter what I change in configure.ac. Even the slightest modification results in the error. After some investigation, running "make" with "-d" showed that it will call auto/missing, because of the newer version of configure.ac. Comparing aclocal.m4 before and after calling "make" shows, that mainly the lines added between the version 5.41 and 5.42 are missing now (lines #23 - #741). As I'm not so familiar with the whole compile process, I found a simple hack, which solves the problem for the moment: Adding these missing lines to a new file named m4/acinclude.m4. After that, compiling, installing and running Stunnel works fine. Can someone verify? If you have questions, I'll try my best to answer them :) Best Regards, Sven Reschke Embedded System SW Developer G-TS/P

1 0

Help with connectivity issue
by Rob Allen 15 Sep '17

15 Sep '17

I’ve installed stunnel on an Amazon EC2 instance: stunnel 4.56 on x86_64-redhat-linux-gnu platform Compiled/running with OpenSSL 1.0.1e-fips 11 Feb 2013 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Auth:LIBWRAP Global options: debug = daemon.notice pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = ALL:!SSLv2:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH (with "fips = no") curve = prime256v1 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds sslVersion = TLSv1 (with "fips = yes") sslVersion = TLSv1 for client, all for server (with "fips = no") stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none I’ve created the stunnel.conf file: [smtp-tls-wrapper] accept = 2525 client = yes connect = email-smtp.us-west-2.amazonaws.com:465 protocol=smtp delay = yes I’ve tested the connection to SES (successfully) via openssl: [ec2-user@ip-172-31-4-68 ~]$ openssl s_client -quiet -crlf -connect email-smtp.us-west-2.amazonaws.com:465 depth=2 C = US, O = "VeriSign, Inc.", OU = VeriSign Trust Network, OU = "(c) 2006 VeriSign, Inc. - For authorized use only", CN = VeriSign Class 3 Public Primary Certification Authority - G5 verify return:1 depth=1 C = US, O = Symantec Corporation, OU = Symantec Trust Network, CN = Symantec Class 3 Secure Server CA - G4 verify return:1 depth=0 C = US, ST = Washington, L = Seattle, O = "Amazon.com, Inc.", CN = email-smtp.us-west-2.amazonaws.com verify return:1 220 email-smtp.amazonaws.com ESMTP SimpleEmailService-2370111491 wa7VtNk9b7c4TX0jNpdG But when I try to access through stunnel via localhost with telnet, I get this: [ec2-user@ip-172-31-4-68 ~]$ telnet localhost 2525 Trying ::1... telnet: connect to address ::1: Connection refused Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Connection closed by foreign host. I’ve tried everything I can think of; I’ve read all the blogs and pages related to connecting from ec2 to SES via stunnel and I just can’t get it to work. Does anyone have any suggestions for other things I could try? Thanks in advance, Rob Allen, CPO Software Engineer | Eyefinity NOTICE: This message is intended only for the individual to whom it is addressed and may contain information that is confidential or privileged. If you are not the intended recipient, or the employee or person responsible for delivering it to the intended recipient, you are hereby notified that any dissemination, distribution, copying or use is strictly prohibited. If you have received this communication in error, please notify the sender and destroy or delete this communication immediately.

2 2

Stunnel Config Error
by Jay Jenney 21 Aug '17

21 Aug '17

Trying to see why Stunnel like this config file (attached) for an office365 email account [cid:[email protected]] Harriscomputer Register today<http://www.harriscomputer.com/en/conference/> for HCTC2017 - Early Bird deadline is August 31! Jay Jenney Support Specialist P: 800-274-2911 x64272 F: E: jjenney(a)caliberpublicsafety.com [cid:Caliber_PS_left_CMYK_247aef3c-9961-4e6c-a9f4-053e52f0093f.jpg] , Iowa www.caliberpublicsafety.com<http://www.caliberpublicsafety.com> This message has been sent on behalf of a company that is part of the Harris Operating Group of Constellation Software Inc. These companies are listed at the following link: http://subscribe.harriscomputer.com Unsubscribe Option: If you do not wish to receive any future email, please unsubscribe by clicking on the following link:http://subscribe.harriscomputer.com This message is intended exclusively for the individual or entity to which it is addressed. This communication may contain information that is proprietary, privileged or confidential or otherwise legally exempt from disclosure. If you are not the named addressee, you are not authorized to read, print, retain, copy or disseminate this message or any part of it. If you have received this message in error, please notify the sender immediately by e-mail and delete all copies of the message.

1 0

stunnel w & w/o data compression
by Daniele Basaldella 18 Aug '17

18 Aug '17

Dear all, I use stunnel in clinet configuration to get data feeds from several sources. Until now none of them requested data compression, so the configuration was easy. Now I need to connect to a new data feeder that requires zlib compression. I found the compression method is a global setting, so it will be not compatible with current setup. The server runs Ubuntu 16.04LTS, ker 4.4.0.92.lowlatency, stunnel 5.30, openssl 1.0.2.g. I looked for a solution on internet but seems no one have my issue. Someone could suggest how to get both compressed/uncompressed data feed connections on same system. Thank you Best Regards Daniele

2 1

Timeout issue I think
by Ben Bazian 16 Aug '17

16 Aug '17

I have a legacy server that uses IMAP but does not support TLS. I am using stunnel and since implementation I am getting errors when an email has a larger attachment. My application process these attachments and when done (sometimes can take 5-10 minutes) it marks the message for deletion. When all messages are completed it purges the emails from the box. My app is throwing an error when it tries to delete the message (see below). I think it may be due to stunnel closing the connection to the server? Not quite sure. javax.mail.FolderClosedException at com.sun.mail.imap.IMAPMessage.getProtocol(IMAPMessage.java:105) at com.sun.mail.imap.IMAPMessage.loadEnvelope(IMAPMessage.java:941) at com.sun.mail.imap.IMAPMessage.getSubject(IMAPMessage.java:238) at com.softlinx.docurouter.source.email.EmailSourceConnector.processMess ages(EmailSourceConnector.java:1213) at com.softlinx.docurouter.source.email.EmailSourceConnector.process(Ema ilSourceConnector.java:1455) at com.softlinx.docurouter.source.email.EmailSourceConnector.main(EmailS ourceConnector.java:1622) My configuration is pretty simple. I saw somewhere that I could put a timeoutidle on the connector but that does not seem to help. Any ideas are appreciated. Here is the config. # Stunnel configuration file for Office 365 SMTP and POP3 # Author: MessageOps, www.messageops.com<http://www.messageops.com> # GLOBAL OPTIONS client = yes output = /etc/stunnel/stunnel-log.txt debug=3 # taskbar=yes # SERVICE-LEVEL OPTIONS [POP3 Incoming] accept = 110 connect = outlook.office365.com:995 timeoutidle = 14400 [SMTP Outgoing] protocol = smtp accept = 25 connect = outlook.office365.com:587 [IMAP] accept = 143 connect = outlook.office365.com:993 timeoutidle = 14400 Here is a printout of the global options. Global options: debug = daemon.notice pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = ALL:!SSLv2:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH (with "fips = no") curve = prime256v1 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds sslVersion = TLSv1 (with "fips = yes") sslVersion = TLSv1 for client, all for server (with "fips = no") stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none -Ben

1 0

logging real client IP in Apache
by Stoyan Stoyanov 07 Jul '17

07 Jul '17

I have an Apache server serving only HTTP requests on port 80 and an stunnel daemon on the same server listening on port 443 and tunneling HTTPS requests to Apache. Is there a way for the client IP to be passed on to Apache so that I can capture and log that instead of the IP of stunnel, which in this case is 127.0.0.1? Ability to add a variable to the HTTP header would be perfect, but any other suggestions to solve this problem are welcome. Thanks! Stoyan

2 2

Error on startup of Stunnel
by Shelstone Lorde 30 Jun '17

30 Jun '17

I installed version 5.41, the latest version, on a Windows 10 Pro machine. I placed a link to the Stunnel.exe file in the Startup folder. I am getting the error "The ordinal 3253 could not be located in the dynamic link library c:\Users\...Programs\Startup\stunnel.exe". May be there has been a previous posting concerning this error but I have not been able to find it. Any help or suggestion will be appreciated. Thanks.

1 0

Re: [stunnel-users] Stunnel Connectivity Issue
by Ludolf Holzheid 13 Jun '17

13 Jun '17

On Tue, 2017-06-13 22:51:27 +0530, Dheeraj Gautam wrote: > Hi Browne, > > > > I am not understand like what config I have to do in stunnel config file. > > > > As per application it will trigger 8228 port of remote server, but at the momen stunnel is working only when I am trying to telnet localhost on 9233 port. > Dheeraj, I'm afraid you confused the directions: In you configuration file, you told Stunnel to accept connections on localhost, port 9233 ("accept = 127.0.0.1:9233"). Then, you told Stunnel, if such a connection is accepted, to connect to a remote server at port 8228 ("connect = 69.191.198.34:8228"). As long as both connections are established, Stunnel will forward data from localhost to 69.191.198.34 and vice versa, while encrypting the data in the localhost -> 69.191.198.34 direction and decrypting the data in the opposite direction (69.191.198.34 -> localhost). With this setup, a client program (such as Thunderbird) sends and receives plain-text data to/from a Stunnel instance on the same machine, while a server program on a remote machine (such as the Google mail server) sends and receives encrypted data to/from Stunnel. Is this about the setup you have in mind? Is your application server or client? Does it send and receive plain-text data or encrypted data? Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:[email protected] http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

1 0

Configuring stunnel and openssl on Windows to support TLS 1.2
by Liz Turi 13 Jun '17

13 Jun '17

Good morning, I'm hoping you can help point me in the right direction. The problem I'm trying to solve is enabling TLS 1.2 connections on a Windows (environment has both Windows 2008 and Windows 10 environments) platform. Currently, my private keys are managed by the Windows certificate store, using the capi engineId within stunnel (v 5.41), which uses OpenSSL 1.0.1. Because of this, stunnel can only negotiate a TLS 1.1 connection. I've tried compiling OpenSSL 1.1.0f and stunnel 5.41, but no luck either cross compiling under CentOS, nor under Windows using either MSYS2/MINGW32 or Cygwin. What I'm looking for is any one of the following 1) solid current cross-compiling examples or references 2) solid current Windows compiling examples or references using extant versions 3) a way to manage the pfx/p12 (private key) in stunnel without resorting to the Windows certificate store. Option 3 is preferred. I see how to manage pkcs11, but not pkcs12. Thank you in advance! Liz Turi Sr. Consultant Massachusetts eHealth Collaborative 860 Winter Street, Waltham, MA 02451 (m) 339-222-6614 (o) 781-907-7204 (f) 781-207-8589 www.maehc.org<http://www.maehc.org> [fb_icon]<https://www.facebook.com/massachusettsehealthcollab?fref=nf>[li_icon]<https://www.linkedin.com/company/massachusetts-ehealth-collaborative?trk=ty…>[tw_icon]<https://twitter.com/MAeHC_org> CONFIDENTIALITY NOTICE The information contained in this email transmission is legally privileged and confidential information intended only for the use of the addressee named above. If the reader of this message is not the intended recipient you are hereby notified that any dissemination, distribution or copying of this email transmission is strictly prohibited. If you have received this email transmission in error, please notify us immediately. Thank you.

1 1

Memleak sTunnel Win32 5.41 ?
by Dod 12 Jun '17

12 Jun '17

Hello, I just noticed that stunnel memory usage is growing slowly but surely using 5.41 on Win7 64 Bits. Using a few POP3 SSL tunnels. Now it is using 290MB memory I don't know if it is since 5.41 (didn't pay attention). Is there a way to trace/log something that could be useful ? (apart from the process memory usage curve that I guess will not help). regards.

1 0

TLS-SRP patch
by Kevin Sheldrake 06 Jun '17

06 Jun '17

Hello I recently produced a patch that permits use of TLS-SRP; it is based on the TLS-PSK code and this blog post: https://matthewarcus.wordpress.com/2014/05/10/srp-in-openssl/ It’s not the cleanest of code but it does work as a POC. The patch is available here: https://github.com/rtfcode/tls-srp The README.txt provides some info on testing the patch and how it might be used to help dev web browsers and servers that support TLS-SRP (for IoT work). There is a page on the forthcoming OWASP Summit ‘TLS for Local IoT’ workshop (for which it was developed) at: https://owaspsummit.org/Working-Sessions/IoT/TLS-for-Local-IoT.html In terms of using TLS-SRP support in stunnel as a proxy, it might be useful as a replacement for TLS-PSK where the credentials are user-memorable (pass phrase, for example) as TLS-SRP has lower entropy requirements than TLS-PSK. For example, the creds could be stored in the user’s head rather than in a file and be less open to compromise if a device was seized. I don’t know if that’s useful for anyone; it’s just a thought. Thanks Kev

1 0

Connect to sub-directory path
by Shamim Uz Zaman 25 May '17

25 May '17

Hi Looking for an example to connect to subdirectory path such that [connect] client = yes accept = 127.0.0.1:441 connect = xxx.website.com:443/Connect/topath verifyChain = yes verifyPeer=yes CAfile = ca-certs.pem checkHost = xxx.mywebsite.com OCSPaia = yes When I only use xxx.mywebsite.com:443 it works. However, below three url gives TCP error (Unknown TCP service) xxx.mywebsite.com:443/Connect/topath xxx.mywebsite.com/Connect/topath https://xxx.mywebsite.com/Connect/topath My proxy connection requires to translate to the directory path of the domain. Regards, *Shamim Zaman*

2 1

Stunnel Connectivity Issue
by Dheeraj Gautam 24 May '17

24 May '17

Hi Team, We are using 5.41 release of Stunnel software to establish TCP connection with remote server using by TLSV1.2 protocol. Enclosed configuration file wherein we are trying to establish TCP connection with one my server along with provided certificate and key which are pointed in config file. Could you please let us know what parameters we are missing here due to which connection is not establishing with remote server. Although, stunnel logs indicating that configuration successful, but in logs no where is mentioned about the connection is it connected or not, below is the artifact for your easy ref. Could you please help us here to resolve this issue. Regards, Dheeraj Gautam -- www.arborfs.com This e-mail and any attachment are confidential and contain proprietary information, some or all of which may be legally privileged. It is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient, please notify the author immediately by telephone or by replying to this e-mail, and then delete all copies of the e-mail on your system. If you are not the intended recipient, you must not use, disclose, distribute, copy, print or rely on this e-mail. Whilst we have taken reasonable precautions to ensure that this e-mail and any attachment has been checked for viruses, we cannot guarantee that they are virus free and we cannot accept liability for any damage sustained as a result of software viruses. We would advise that you carry out your own virus checks, especially before opening an attachment.

1 0

Stunnel on Suse 8.1, connections refused, pid remains
by InvalidPath 09 May '17

09 May '17

So I have this server, I can start stunnel via /etc/rc.d/stunnel start. The pid is there as witnessed by ps -aux | grep stunnel, I have 4 customers that access this server. The customers pull data files that contain certain client records. Anyway my test user connects to the server and is able to pull a handful of files before their process begins timing out. When this happens I can no longer SSH to the host without restarting stunnel. Weird thing is, is that I can see the pid still running when this happens. I have the debug = 7 but the log files according to stunnel - version is set to a level of 5. No clue where it''s getting a 5 from. But I am unable to determine why or what is causing this. And it's starting to cost the company lost revenue. Any help would be greatly appreciated. Ben

1 0

Graceful config reload when -fd option was used
by z a 09 May '17

09 May '17

Hi, Since version 4.30, sending a HUP signal to a running stunnel process will cause it to gracefully reload with the given config file. Is there a way to accomplish this when the running stunnel process was started with the "-fd" flag as in the example below? cat foo.conf | stunnel-fd 0 I tried writing to /proc/$pid/fd/0 but that didn't work. I'm hoping someone here has overcome this issue and might be able to whisper a hint in my direction. I am on Centos 7.2. Thanks

1 0

Trouble with stunnel.conf (version 5.41)
by Mark Garciano 02 May '17

02 May '17

Hi Stunnel users, Any ideas why I get a "server down" message"? Below is the conf file: ;--------------------------------------------------------------------------- ; ************************************************************************** ; * Global options * ; ************************************************************************** ; ; Debugging stuff (may useful for troubleshooting) debug = 7 output = stunnel.log ;Disable FIPS mode to allow non-approved protocols and algorithms fips = no ;************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 key = stunnel.pem cert = stunnel.pem client = yes accept = 5001 connect = XXXXXXXXXXX.com:6443 TIMEOUTclose = 0 TIMEOUTconnect = 200 TIMEOUTidle = 86400 ;--------------------------------------------------------------------------- HERE IS THE LOG WINDOW MESSAGE: [!] Server is down [ ] Running on Windows 6.1 [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark detected [.] FIPS mode disabled [ ] Compression disabled [ ] Snagged 64 random bytes from C:/.rnd [ ] Wrote 1024 new random bytes to C:/.rnd [ ] PRNG seeded successfully [ ] Initializing inetd mode configuration [!] Service [(null)]: 'accept' option is only allowed in a [section] Mark Garciano Systems Programmer II USC Libraries Integrated Library Systems 213-740-3568

2 1

Re: [stunnel-users] Help in setting stunnel in client mode to connect webservice in mutual authentication
by Chokkalingam, Jothish 28 Apr '17

28 Apr '17

Hi Can you help in sorting it out below scenario We have a URL whose TLS is 1.0 and now it is being upgraded to 1.2. Since the current application doesn't support V1.0 I am planning to use stunnel in between to fix the gap. Can you help if my below config is correct or not. The communication between client and server is MASSL(mutual authentication SSL) [Billpay46200] client = yes CApath = /apps/bss/CCBTrustStore-->trust store where the remote webservice certificates are stored in cert format accept = 46200-->port configured from client machine to connect using http connect = xxx.in.xxx.com.au:46200-->port where the incoming http request need to be changed from http to https cert = /stunnel/bin/client.pem-->identity certificate used for client key = /stunnel/bin/key.pem-->corresponding key for the above identity certificate. While hitting using the URL http://localhost:46200 it is shown in stunnel log as below 2017.04.28 17:17:51 LOG5[2627:3]: Billpay46200 accepted connection from 127.0.0.1:58382 2017.04.28 17:17:51 LOG5[2627:3]: Billpay46200 connected remote server from 10.116.194.24:58383 2017.04.28 17:17:51 LOG3[2627:3]: SSL_connect: Peer suddenly disconnected 2017.04.28 17:17:51 LOG5[2627:3]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Thanks and Regards, Jothish TIBCO TSD Ph. : +91 44 39263958 Mobile : +91 9884040171 Support : +91 9962007110 OC : jothish.chokkalingam Group mail:- Telstra.psm.tsd.tibco(a)accenture.com ________________________________ This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. ______________________________________________________________________________________ www.accenture.com

1 0

Remove session callback
by Florian Gossin 19 Apr '17

19 Apr '17

Hi, I have updated to the latest 5.41 version. I was troubleshooting another problem and I discovered dozens of lines in the log file with "Remove session callback, Deallocating application specific data for session connect address": 2017.04.19 14:49:49 LOG7[17483]: Service [pgbouncer-client] started 2017.04.19 14:49:49 LOG7[17483]: Option TCP_NODELAY set on local socket 2017.04.19 14:49:49 LOG5[17483]: Service [pgbouncer-client] accepted connection from x.x.x.x:36018 2017.04.19 14:49:49 LOG6[17483]: Peer certificate required 2017.04.19 14:49:49 LOG7[17483]: TLS state (accept): before/accept initialization 2017.04.19 14:49:49 LOG7[17483]: SNI: no virtual services defined 2017.04.19 14:49:49 LOG7[17483]: TLS state (accept): SSLv3 read client hello A 2017.04.19 14:49:49 LOG7[17483]: TLS state (accept): SSLv3 write server hello A 2017.04.19 14:49:49 LOG7[17483]: TLS state (accept): SSLv3 write change cipher spec A 2017.04.19 14:49:49 LOG7[17483]: TLS state (accept): SSLv3 write finished A 2017.04.19 14:49:49 LOG7[17483]: TLS state (accept): SSLv3 flush data 2017.04.19 14:49:49 LOG7[17483]: TLS state (accept): SSLv3 read finished A 2017.04.19 14:49:49 LOG7[17483]: Remove session callback 2017.04.19 14:49:49 LOG7[17483]: Deallocating application specific data for session connect address 2017.04.19 14:49:49 LOG7[17483]: Remove session callback 2017.04.19 14:49:49 LOG7[17483]: Deallocating application specific data for session connect address ... Can anyone explain me what it is about ? Thank you, Florian

1 0

Windows Server 2012 stunnel service
by Adam Shackleton 18 Apr '17

18 Apr '17

Hi All I'm running stunnel on Windows Server 2012 R2 with the following config: [test-qa] client = yes accept = 127.0.0.1:8080 connect = webaddress.com:443 cert = API-q-response.pfx CAfile = ca-certs.pem OCSPaia = yes When I start the GUI I'm prompted for the certificate password then and then stunnel works fine, but I need it to run as a service. I've tried using the start menu stunnel Service Install button, I've also tried opening a command prompt in C:\Program Files (x86)\stunnel\config and running C:\Program Files (x86)\stunnel\bin\stunnel.exe -install, and I've also tried moving the config file and certs to the \bin directory and running stunnel -install there as well. In all case the service installs ok, and when you run it, it starts (I can see it in the services tool), you can click the stunnel Configuration File Reload button in the start menu and it says the configuration was successfully reloaded, but it doesn't work when I try to use it. I've noticed two things that might be relevant: 1. At no point does it prompt me for the certificate password like it does when I load the GUI 2. The dialog boxes that open when the service is installed or started say "stunnel 5.40 on Win32 (not configured) [cid:[email protected]] If anyone has any advice that would be greatly appreciated. Thanks Adam

2 1

SOCKS connection to the IPv4 loopback rejected.
by Robert de Bath 15 Apr '17

15 Apr '17

Hi everyone, How do I get rid of this message? I have a stunnel server setup on a remote machine using the socks protocol. I use two keys plus the certificates and a private CA to protect the SSL link. On a local machine I have an stunnel client running without a protocol option set. If I try to make a socks connection to an interface IP of the remote server it works perfectly, bypassing the intervening firewalls through the protected tunnel. But the interface IP changes and I only want to allow connections to the remote server through the tunnel. I could setup traditional tunnels, but while one of the services (remote desktop to the Windows server) is constant the others are dynamically configurable. I have even considered using SNI to distinguish the incoming connections to the various services but while this allows there to be just one tunnel port it will still need a remote reconfiguration of stunnel every time a service port is added or removed. The best way to express this limit is that the socks server should ONLY connect to localhost; but it's "rejected". In actual operation I will probably need to allow the local network too which will probably be an rfc1597 address. Looking at the source it appears that this condition is hard coded into the "validate" function so my question becomes: can you please remove this or add a flag to turn it off? -- Robert de Bath robert(a)tvisiontech.co.uk

1 0

Configure Error
by Kenway Ng 12 Apr '17

12 Apr '17

Hi I am running into an issue when I go into the src directory and I run the configure command, I get configure: error: Could not find your TLS library installation dir Use --with-ssl option to fix this problem I am trying to upgrade our version of stunnel. Our SME left and now I am trying to upgrade stunnel to fix a vulnerability . I am being told to use TLS1.1 or higher Here is our current version of stunnel $ ./stunnel -version stunnel 4.15 on x86_64-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Any help would be appreciated. Kenway

1 0

PSK, verifying the client
by Mike 05 Apr '17

05 Apr '17

Is it possible to verify the client using PSK? On the stunnel server I specify a PSKsecrets file with two lines in it, one for client01 and one for client02. The secret is about 36 characters long. On a client, I have a similar PSKsecrets file, but only containing the client01 line. Now, if I try to connect with, say, a client03, i.e., any client that does not have a matching line in the server's PSKsecrets file, how can I assure that the client connection will be rejected? What I'd like to see would be the following: any client that tries to connect, and does not present a PSK that is present in the server's PSKsecrets file, then that client's connection request is rejected, with an appropriate message logged. Can I do that with the current stunnel? thx.

1 0

Scan to email failure: RapbianPi3 to Office365
by Graeme Ellisson 03 Apr '17

03 Apr '17

Hi. I recently bought a Pi3 and have loaded Raspbian with Doobs (Previously I had this running faultlessly under a Windows Server for my Canon multi function printer that does not support SSL/TLS but only authentication). After about 8 attempts to get Stunnel4 working (there doesn't seem to be a later version to install via the command line) I eventually found that Stunnel4 works fine as long as one doesn't update Dabian from the initial Doobs install. So, I now have the service running and listening on port 25 with the following config file: debug=7 output=/etc/stunnel/stunnel.log client=yes options=NO_SSLv2 (I added this last night after reading a blog) [SMTP OUT] sslVersion=TLSv1 (I added this last night after reading a blog) protocol=smtp accept=25 connect=smtp.office365.com:587 On restarting the service I see the following which looks okay to my untrained eye: 2017.04.03 09:42:09 LOG7[3570]: Dispatching signals from the signal pipe 2017.04.03 09:42:09 LOG7[3570]: Processing SIGNAL_TERMINATE 2017.04.03 09:42:09 LOG5[3570]: Terminated 2017.04.03 09:42:09 LOG7[3570]: Closing service [SMTP OUT] 2017.04.03 09:42:09 LOG7[3570]: Service [SMTP OUT] closed (FD=7) 2017.04.03 09:42:09 LOG7[3570]: Service [SMTP OUT] closed 2017.04.03 09:42:09 LOG7[3570]: removing pid file /var/run/stunnel4.pid 2017.04.03 09:42:09 LOG7[3926]: Clients allowed=500 2017.04.03 09:42:09 LOG5[3926]: stunnel 5.06 on arm-unknown-linux-gnueabihf platform 2017.04.03 09:42:09 LOG5[3926]: Compiled with OpenSSL 1.0.1k 8 Jan 2015 2017.04.03 09:42:09 LOG5[3926]: Running with OpenSSL 1.0.1t 3 May 2016 2017.04.03 09:42:09 LOG5[3926]: Update OpenSSL shared libraries or rebuild stunnel 2017.04.03 09:42:09 LOG5[3926]: Threading:PTHREAD Sockets:POLL,IPv6,SYSTEMD SSL:ENGINE,OCSP,FIPS Auth:LIB$ 2017.04.03 09:42:09 LOG7[3926]: errno: (*__errno_location ()) 2017.04.03 09:42:09 LOG5[3926]: Reading configuration from file /etc/stunnel/stunnel4.conf 2017.04.03 09:42:09 LOG5[3926]: FIPS mode disabled 2017.04.03 09:42:09 LOG7[3926]: Compression disabled 2017.04.03 09:42:09 LOG7[3926]: Snagged 64 random bytes from /dev/urandom 2017.04.03 09:42:09 LOG7[3926]: PRNG seeded successfully 2017.04.03 09:42:09 LOG6[3926]: Initializing service [SMTP OUT] 2017.04.03 09:42:09 LOG7[3926]: No private key specified 2017.04.03 09:42:09 LOG7[3926]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2017.04.03 09:42:09 LOG5[3926]: Configuration successful 2017.04.03 09:42:09 LOG7[3926]: Listening file descriptor created (FD=7) 2017.04.03 09:42:09 LOG7[3926]: Service [SMTP OUT] (FD=7) bound to 0.0.0.0:25 2017.04.03 09:42:09 LOG7[3927]: Created pid file /var/run/stunnel4.pid When sending a scan from the printer to an email address I see the following in the log file: 2017.04.03 10:00:05 LOG7[3927]: Service [SMTP OUT] accepted (FD=3) from 192.168.8.99:1085 2017.04.03 10:00:05 LOG7[3960]: Service [SMTP OUT] started 2017.04.03 10:00:05 LOG5[3960]: Service [SMTP OUT] accepted connection from 192.168.8.99:1085 2017.04.03 10:00:05 LOG6[3960]: s_connect: connecting 40.101.73.162:587 2017.04.03 10:00:05 LOG7[3960]: s_connect: s_poll_wait 40.101.73.162:587: waiting 10 seconds 2017.04.03 10:00:05 LOG5[3960]: s_connect: connected 40.101.73.162:587 2017.04.03 10:00:05 LOG5[3960]: Service [SMTP OUT] connected remote server from 192.168.8.33:59792 2017.04.03 10:00:05 LOG7[3960]: Remote socket (FD=9) initialized 2017.04.03 10:00:05 LOG7[3960]: <- 220 DB6PR07CA0179.outlook.office365.com Microsoft ESMTP MAIL Service $ 2017.04.03 10:00:05 LOG7[3960]: -> 220 DB6PR07CA0179.outlook.office365.com Microsoft ESMTP MAIL Service $ 2017.04.03 10:00:05 LOG7[3960]: -> EHLO localhost 2017.04.03 10:00:05 LOG7[3960]: <- 250-DB6PR07CA0179.outlook.office365.com Hello [46.208.253.189] 2017.04.03 10:00:05 LOG7[3960]: <- 250-SIZE 157286400 2017.04.03 10:00:05 LOG7[3960]: <- 250-PIPELINING 2017.04.03 10:00:05 LOG7[3960]: <- 250-DSN 2017.04.03 10:00:05 LOG7[3960]: <- 250-ENHANCEDSTATUSCODES 2017.04.03 10:00:05 LOG7[3960]: <- 250-STARTTLS 2017.04.03 10:00:05 LOG7[3960]: <- 250-8BITMIME 2017.04.03 10:00:05 LOG7[3960]: <- 250-BINARYMIME 2017.04.03 10:00:05 LOG7[3960]: <- 250-CHUNKING 2017.04.03 10:00:05 LOG7[3960]: <- 250 SMTPUTF8 2017.04.03 10:00:05 LOG7[3960]: -> STARTTLS 2017.04.03 10:00:05 LOG7[3960]: <- 220 2.0.0 SMTP server ready 2017.04.03 10:00:05 LOG6[3960]: SNI: sending servername: outlook.office365.com 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): before/connect initialization 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: SSL state (connect): unknown state 2017.04.03 10:00:05 LOG7[3960]: 0 items in the session cache 2017.04.03 10:00:05 LOG7[3960]: 2 client connects (SSL_connect()) 2017.04.03 10:00:05 LOG7[3960]: 2 client connects that finished 2017.04.03 10:00:05 LOG7[3960]: 0 client renegotiations requested 2017.04.03 10:00:05 LOG7[3960]: 0 server connects (SSL_accept()) 2017.04.03 10:00:05 LOG7[3960]: 0 server connects that finished 2017.04.03 10:00:05 LOG7[3960]: 0 server renegotiations requested 2017.04.03 10:00:05 LOG7[3960]: 0 session cache hits 2017.04.03 10:00:05 LOG7[3960]: 0 external session cache hits 2017.04.03 10:00:05 LOG7[3960]: 0 session cache misses 2017.04.03 10:00:05 LOG7[3960]: 0 session cache timeouts 2017.04.03 10:00:05 LOG6[3960]: SSL connected: new session negotiated 2017.04.03 10:00:05 LOG6[3960]: Negotiated TLSv1 ciphersuite ECDHE-RSA-AES128-SHA (128-bit encryption) 2017.04.03 10:00:05 LOG6[3960]: Compression: null, expansion: null 2017.04.03 10:00:10 LOG6[3960]: SSL socket closed (SSL_read) 2017.04.03 10:00:10 LOG7[3960]: Sent socket write shutdown 2017.04.03 10:00:10 LOG5[3960]: Connection closed: 23 byte(s) sent to SSL, 79 byte(s) sent to socket 2017.04.03 10:00:10 LOG7[3960]: Remote socket (FD=9) closed 2017.04.03 10:00:10 LOG7[3960]: Local socket (FD=3) closed 2017.04.03 10:00:10 LOG7[3960]: Service [SMTP OUT] finished (0 left) 2017.04.03 10:00:20 LOG7[3927]: Service [SMTP OUT] accepted (FD=3) from 192.168.8.99:1086 2017.04.03 10:00:20 LOG7[3961]: Service [SMTP OUT] started 2017.04.03 10:00:20 LOG5[3961]: Service [SMTP OUT] accepted connection from 192.168.8.99:1086 2017.04.03 10:00:20 LOG6[3961]: s_connect: connecting 40.101.72.194:587 2017.04.03 10:00:20 LOG7[3961]: s_connect: s_poll_wait 40.101.72.194:587: waiting 10 seconds 2017.04.03 10:00:20 LOG5[3961]: s_connect: connected 40.101.72.194:587 2017.04.03 10:00:20 LOG5[3961]: Service [SMTP OUT] connected remote serve from 192.168.8.33:57422 2017.04.03 10:00:20 LOG7[3961]: Remote socket (FD=9) initialized 2017.04.03 10:00:21 LOG7[3961]: <- 220 DB6PR07CA0014.outlook.office365.com Microsoft ESMTP MAIL Service $ 2017.04.03 10:00:21 LOG7[3961]: -> 220 DB6PR07CA0014.outlook.office365.com Microsoft ESMTP MAIL Service $ 2017.04.03 10:00:21 LOG7[3961]: -> EHLO localhost 2017.04.03 10:00:21 LOG7[3961]: <- 250-DB6PR07CA0014.outlook.office365.com Hello [46.208.253.189] 2017.04.03 10:00:21 LOG7[3961]: <- 250-SIZE 157286400 2017.04.03 10:00:21 LOG7[3961]: <- 250-PIPELINING 2017.04.03 10:00:21 LOG7[3961]: <- 250-DSN 2017.04.03 10:00:21 LOG7[3961]: <- 250-ENHANCEDSTATUSCODES 2017.04.03 10:00:21 LOG7[3961]: <- 250-STARTTLS 2017.04.03 10:00:21 LOG7[3961]: <- 250-8BITMIME 2017.04.03 10:00:21 LOG7[3961]: <- 250-BINARYMIME 2017.04.03 10:00:21 LOG7[3961]: <- 250-CHUNKING 2017.04.03 10:00:21 LOG7[3961]: <- 250 SMTPUTF8 2017.04.03 10:00:21 LOG7[3961]: -> STARTTLS 2017.04.03 10:00:21 LOG7[3961]: <- 220 2.0.0 SMTP server ready 2017.04.03 10:00:21 LOG6[3961]: SNI: sending servername: outlook.office365.com 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): before/connect initialization 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: SSL state (connect): unknown state 2017.04.03 10:00:21 LOG7[3961]: 0 items in the session cache 2017.04.03 10:00:21 LOG7[3961]: 3 client connects (SSL_connect()) 2017.04.03 10:00:21 LOG7[3961]: 3 client connects that finished 2017.04.03 10:00:21 LOG7[3961]: 0 client renegotiations requested 2017.04.03 10:00:21 LOG7[3961]: 0 server connects (SSL_accept()) 2017.04.03 10:00:21 LOG7[3961]: 0 server connects that finished 2017.04.03 10:00:21 LOG7[3961]: 0 server renegotiations requested 2017.04.03 10:00:21 LOG7[3961]: 0 session cache hits 2017.04.03 10:00:21 LOG7[3961]: 0 external session cache hits 2017.04.03 10:00:21 LOG7[3961]: 0 session cache misses 2017.04.03 10:00:21 LOG7[3961]: 0 session cache timeouts 2017.04.03 10:00:21 LOG6[3961]: SSL connected: new session negotiated 2017.04.03 10:00:21 LOG6[3961]: Negotiated TLSv1 ciphersuite ECDHE-RSA-AES128-SHA (128-bit encryption) 2017.04.03 10:00:21 LOG6[3961]: Compression: null, expansion: null 2017.04.03 10:00:26 LOG6[3961]: SSL socket closed (SSL_read) 2017.04.03 10:00:26 LOG7[3961]: Sent socket write shutdown 2017.04.03 10:00:26 LOG5[3961]: Connection closed: 23 byte(s) sent to SSL, 79 byte(s) sent to socket 2017.04.03 10:00:26 LOG7[3961]: Remote socket (FD=9) closed 2017.04.03 10:00:26 LOG7[3961]: Local socket (FD=3) closed 2017.04.03 10:00:26 LOG7[3961]: Service [SMTP OUT] finished (0 left) At the end of this, no email is received. I can't tell from the above if the document is not being received by Stunnel from the printer or if Stunnel can not pass the document to Office365. It looks like TLSv1 is being negotiated and some data is being sent but then it closes the connection. Any help would be much appreciated. Regards, Graeme

2 1

Stunnel Version Vulnerability-Currently using 5.04
by Tracy Drake - IQGC-C 28 Mar '17

28 Mar '17

Hello Stunnel Users Forum! I wonder if anyone may have suggestions of what, if anything can be done to surmount a reported vulnerability for Stunnel versions prior to 5.34. I have limited savvy in this arena so please excuse this "Stunnel for Dummies" question. The following statements surfaced in a "security vulnerabilities" report... The version of stunnel installed on the remote host is 4.46 or later but prior to 5.34. It is, therefore, affected by a security bypass vulnerability related to the validation of level 4 peer certificates. An unauthenticated, remote attacker can exploit this to have an impact on confidentiality, integrity, and/or availability. No other details are available. I am of the mind that perhaps an entry in Stunnel.conf until we can deploy an upgrade? Thanks in advance for any feedback! Upgrade to stunnel version 5.34 or later. -- Tracy Drake CSM Senior Consultant GSA-FAS CAMEO Contractor URSA & INFOConnect Support & Training Team Lead 704-987-1211 tracy.drake(a)gsa.gov

1 0

Multi source VPN connectivity
by Aykut SAY 24 Mar '17

24 Mar '17

Hi, We are working on a integration project and we need to connect our application to three different sources. These three sources have their own VPN. Can stunnel connect to three different vpn from one server? If yes, which version of stunnel we need to install to our server? Thanks, Aykut

1 0

stunnel public private key authentication like ssh
by Michael Power 23 Mar '17

23 Mar '17

Is there a way to configure stunnel just to check the public key of the provided certificate? I want authentication between the server and the client to take place by public key only, no PKI just like ssh. Is this possible? Is this verify level 4, or does that still check the CN against the host that I am connecting to? Michael Power

1 0

update stunnel with engine pkcs11
by Heinsbroek, Peter 20 Mar '17

20 Mar '17

Hallo, I’m a newbee in C programming. I have to upgrade stunnel 5.31 with engine_pkcs11 (0.1.8) for windows to the latest versions. (5.40 & 0.2.2) My engine_pkcs.c contains an subroutine my_get_pin (see attachment line 707) that reads a pin from a file in the windows folder. After reading it ,it transforms the pin to hexadecimal, if not already done, and writes it back in the file. After adjusting the new source it compiles without errors, but when executing it doesn’t work anymore. I also attached the old engine_pkcs11.c as we used it. Can someone help me with this problem. After compairing the old and new source I noticed that there have been major improvements to the source With regards, Peter Heinsbroek Application manager NT / SQL20xx Tel. +31 (0)88 265 9869 Mob. +31 6 5375 3244 Werner von Siemensstraat 3 2712 PN Zoetermeer, Nederland Org. unit PS Central Fin Services Unit 02 SI NL Email peter.heinsbroek(a)atos.net<mailto:[email protected]> Web www.nl.atos.net<UrlBlockedError.aspx> Atos IT Solutions and Services B.V. Comm. Register The Hague no. 27380688 This e-mail is intended exclusively for the addressee(s), and may not be forwarded or made available for use to any person other than the addressee(s). If you are not the intended recipient, please notify the sender thereof and destroy/delete the message. The sender disclaims any liability as regards (the content of) this e-mail. This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, Atos’ liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted. On all offers and agreements under which Atos Nederland B.V. supplies goods and/or services of whatever nature, the Terms of Delivery from Atos Nederland B.V. exclusively apply. The Terms of Delivery shall be promptly submitted to you on your request.

1 0

Fwd: Stunnel Performance strangeness
by Scott McKeown 10 Mar '17

10 Mar '17

Hi All, We have been doing some throughput testing and are wondering of you can help explain some of the results we have been getting. We are trying to establish the maximum number of handshakes per second our appliances can do when using Stunnel. Our tests have been done on a 4 core Intel(R) Xeon(R) CPU E3-1230 v5 @ 3.40GHz machine with 8Gb ram. Using stunnel 5.33 openssl 1.0.2j (We use stunnel 5.33 here, but this was also tested with stunnel 5.40 and we got the same issue) Stunnel was compiled with - ./configure --enable-fips --enable-ipv6 --with-threads=pthread --sysconfdir=/etc --with-ssl=/usr/src/built/OpenSSL_1_0_2j-no_march/usr/local/ --disable-libwrap --disable-systemd I was using a python script of my own design for load testing when I noticed the problem we then switched to an open source package called vegeta https://github.com/tsenart/vegeta the command I was using to run it was - echo "GET https://10.10.10.10:443" | ./vegeta attack -workers=30 -rate=3000 -duration=300s -insecure > test.out We are essentially seeing a degradation in throughput at a fixed point in time. I am seeing the problem when using 3000 transactions per second. We are doing https gets through stunnel to a http backend, 1 transaction is an ssl handshake the http get and waiting for the response. Interestingly if I try 5.06 it works fine I get a smooth constant loading. Please take a look at 30worker3000rate5.33-300s.png where you can see after about 55 seconds there is a jump in latency. I get the same issue if I run the test with 2000 transactions. Please see 30worker20005.33-700s.png but with the lower transaction rate the issue takes longer to rear its head. The issue doesnt happen if I run the test with 3000 transaction using 5.06. Please see 30worker3000rate5.06-300s.png >From looking at the graphs our thoughts were that we were hitting some sort of cache limit and used that as a starting point. We have taken a look at the code changes between versions we know were working and the problematic version and the main thing that stands out is the changes to the leak detection. Previously this was partially based on the number of clients but has been changed to use the sections. This led to the decision to try a different limit value and found the number of connections we saw before seeing an issue corresponds to the change of the limit value. We think we have identified the code that is causing the problem/doing something funny it was added in 5.33 NOEXPORT long leak_threshold() { long limit; limit=10000*((int)number_of_sections+1); #ifndef USE_FORK limit+=100*num_clients; #endif return limit; } its src/str.c when increasing the limit number so limit=10000*((int)number_of_sections+1) to limit=20000*((int)number_of_sections+1) This still results in an increase in response time but at a later time in the test, please see 30worker3000rate5.33-ben-highlimit.png Interestingly once I end up in this state I am stuck with high latencies until I restart stunnel. (The box I am testing on was left over night to make sure its not any hanging tcp connections or anything like that) I must admit we are at the limit of our C understanding and your imput would be welcomed. -- With Kind Regards. Scott McKeown Loadbalancer.org http://www.loadbalancer.org Tel (UK) - +44 (0) 3303801064 <0330%20380%201064> (24x7) Tel (US) - +1 888.867.9504 <+1%20888-867-9504> (Toll Free)(24x7)

1 0

Segfault after connecting
by Andrew Culver 23 Feb '17

23 Feb '17

I had my stunnel instance working as expected last week. Since then I've moved the server behind a load balancer, which is doing regular health checks (opens a tcp connection, then disconnects) to see that stunnel is up. I don't believe the health checks are a problem, but they're the only change I've made since I had stunnel working. I can see the health checks connecting and disconnecting. However when I open a new connection, either by telnet or by: openssl s_client -connect mtar.uwo.ca:587 -starttls smtp ... stunnel says it fails to verify the server certificate, then seg faults. I'm running stunnel 5.40 and I'm having the same problem on 2 different servers running openssl 1.1.0d and 1.1.0e. Here's my config: [root@mtar1 stunnel]# egrep -v '^;|^ *$' stunnel.conf ; Sample stunnel configuration file for Unix by Michal Trojnara 2002-2017 setuid = stunnel setgid = stunnel pid = /usr/local/var/run/stunnel/stunnel.pid foreground = yes debug = debug [uwo2local] accept = 587 cert = /usr/local/etc/stunnel/mtar-withprivatekey.pem connect = 20587 protocol = smtp [local2o365] client = yes accept = 127.0.0.1:20587 connect = smtp.office365.com:587 checkHost = smtp.office365.com verifyChain = yes CApath = /etc/ssl/certs OCSPaia = yes protocol = smtp Here's my debug log: The health checks are from 172.18.58.5 and my test connection which leads to the seg fault is from 129.100.6.17. [root@mtar1 stunnel]# /usr/local/bin/stunnel /usr/local/etc/stunnel/stunnel.conf 2017.02.23 11:28:48 LOG7[ui]: Clients allowed=500 2017.02.23 11:28:48 LOG5[ui]: stunnel 5.40 on x86_64-unknown-linux-gnu platform 2017.02.23 11:28:48 LOG5[ui]: Compiled/running with OpenSSL 1.1.0d 26 Jan 2017 2017.02.23 11:28:48 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2017.02.23 11:28:48 LOG7[ui]: errno: (*__errno_location ()) 2017.02.23 11:28:48 LOG5[ui]: Reading configuration from file /usr/local/etc/stunnel/stunnel.conf 2017.02.23 11:28:48 LOG5[ui]: UTF-8 byte order mark detected 2017.02.23 11:28:48 LOG5[ui]: FIPS mode disabled 2017.02.23 11:28:48 LOG7[ui]: Compression disabled 2017.02.23 11:28:48 LOG7[ui]: PRNG seeded successfully 2017.02.23 11:28:48 LOG7[cron]: Cron thread initialized 2017.02.23 11:28:48 LOG6[ui]: Initializing service [uwo2local] 2017.02.23 11:28:48 LOG7[ui]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2017.02.23 11:28:48 LOG7[ui]: TLS options: 0x02020004 (+0x02000000, -0x00000000) 2017.02.23 11:28:48 LOG6[ui]: Loading certificate from file: /usr/local/etc/stunnel/mtar-withprivatekey.pem 2017.02.23 11:28:48 LOG6[ui]: Certificate loaded from file: /usr/local/etc/stunnel/mtar-withprivatekey.pem 2017.02.23 11:28:48 LOG6[ui]: Loading private key from file: /usr/local/etc/stunnel/mtar-withprivatekey.pem 2017.02.23 11:28:48 LOG6[ui]: Private key loaded from file: /usr/local/etc/stunnel/mtar-withprivatekey.pem 2017.02.23 11:28:48 LOG7[ui]: Private key check succeeded 2017.02.23 11:28:48 LOG7[ui]: DH initialization 2017.02.23 11:28:48 LOG7[ui]: Could not load DH parameters from /usr/local/etc/stunnel/mtar-withprivatekey.pem 2017.02.23 11:28:48 LOG6[ui]: Using dynamic DH parameters 2017.02.23 11:28:48 LOG7[ui]: ECDH initialization 2017.02.23 11:28:48 LOG7[ui]: ECDH initialized with curve prime256v1 2017.02.23 11:28:48 LOG6[ui]: Initializing service [local2o365] 2017.02.23 11:28:48 LOG7[ui]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2017.02.23 11:28:48 LOG7[ui]: TLS options: 0x02020004 (+0x02000000, -0x00000000) 2017.02.23 11:28:48 LOG7[ui]: No certificate or private key specified 2017.02.23 11:28:48 LOG5[ui]: Configuration successful 2017.02.23 11:28:48 LOG7[ui]: Listening file descriptor created (FD=7) 2017.02.23 11:28:48 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2017.02.23 11:28:48 LOG7[ui]: Service [uwo2local] (FD=7) bound to 0.0.0.0:587 2017.02.23 11:28:48 LOG7[ui]: Listening file descriptor created (FD=8) 2017.02.23 11:28:48 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2017.02.23 11:28:48 LOG7[ui]: Service [local2o365] (FD=8) bound to 127.0.0.1:20587 2017.02.23 11:28:48 LOG6[cron]: Executing cron jobs 2017.02.23 11:28:48 LOG5[cron]: Updating DH parameters 2017.02.23 11:28:48 LOG7[ui]: Created pid file /usr/local/var/run/stunnel/stunnel.pid 2017.02.23 11:28:51 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:28:51 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:28:51 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:28:51 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:28:51 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:40161 2017.02.23 11:28:51 LOG7[0]: Service [uwo2local] started 2017.02.23 11:28:51 LOG7[0]: Option TCP_NODELAY set on local socket 2017.02.23 11:28:51 LOG5[0]: Service [uwo2local] accepted connection from 172.18.58.5:40161 2017.02.23 11:28:51 LOG6[0]: failover: round-robin, starting at entry #0 2017.02.23 11:28:51 LOG6[0]: s_connect: connecting ::1:20587 2017.02.23 11:28:51 LOG7[0]: s_connect: s_poll_wait ::1:20587: waiting 10 seconds 2017.02.23 11:28:51 LOG3[0]: s_connect: connect ::1:20587: Connection refused (111) 2017.02.23 11:28:51 LOG6[0]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:28:51 LOG7[0]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:28:51 LOG5[0]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:28:51 LOG5[0]: Service [uwo2local] connected remote server from 127.0.0.1:33132 2017.02.23 11:28:51 LOG7[0]: Option TCP_NODELAY set on remote socket 2017.02.23 11:28:51 LOG7[0]: Remote descriptor (FD=9) initialized 2017.02.23 11:28:51 LOG7[0]: RFC 2487 not detected 2017.02.23 11:28:51 LOG6[0]: Peer certificate not required 2017.02.23 11:28:51 LOG7[0]: TLS state (accept): before SSL initialization 2017.02.23 11:28:51 LOG3[0]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:28:51 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:28:51 LOG7[0]: Remote descriptor (FD=9) closed 2017.02.23 11:28:51 LOG7[0]: Local descriptor (FD=3) closed 2017.02.23 11:28:51 LOG7[0]: Service [uwo2local] finished (0 left) 2017.02.23 11:28:51 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:28:51 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:28:51 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:28:51 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:28:51 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33132 2017.02.23 11:28:51 LOG7[1]: Service [local2o365] started 2017.02.23 11:28:51 LOG3[1]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:28:51 LOG5[1]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:28:51 LOG7[1]: Local descriptor (FD=3) closed 2017.02.23 11:28:51 LOG7[1]: Service [local2o365] finished (0 left) 2017.02.23 11:28:56 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:28:56 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:28:56 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:28:56 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:28:56 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:19333 2017.02.23 11:28:56 LOG7[2]: Service [uwo2local] started 2017.02.23 11:28:56 LOG7[2]: Option TCP_NODELAY set on local socket 2017.02.23 11:28:56 LOG5[2]: Service [uwo2local] accepted connection from 172.18.58.5:19333 2017.02.23 11:28:56 LOG6[2]: failover: round-robin, starting at entry #1 2017.02.23 11:28:56 LOG6[2]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:28:56 LOG7[2]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:28:56 LOG5[2]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:28:56 LOG5[2]: Service [uwo2local] connected remote server from 127.0.0.1:33134 2017.02.23 11:28:56 LOG7[2]: Option TCP_NODELAY set on remote socket 2017.02.23 11:28:56 LOG7[2]: Remote descriptor (FD=9) initialized 2017.02.23 11:28:56 LOG7[2]: RFC 2487 not detected 2017.02.23 11:28:56 LOG6[2]: Peer certificate not required 2017.02.23 11:28:56 LOG7[2]: TLS state (accept): before SSL initialization 2017.02.23 11:28:56 LOG3[2]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:28:56 LOG5[2]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:28:56 LOG7[2]: Remote descriptor (FD=9) closed 2017.02.23 11:28:56 LOG7[2]: Local descriptor (FD=3) closed 2017.02.23 11:28:56 LOG7[2]: Service [uwo2local] finished (0 left) 2017.02.23 11:28:56 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:28:56 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:28:56 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:28:56 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:28:56 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33134 2017.02.23 11:28:56 LOG7[3]: Service [local2o365] started 2017.02.23 11:28:56 LOG3[3]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:28:56 LOG5[3]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:28:56 LOG7[3]: Local descriptor (FD=3) closed 2017.02.23 11:28:56 LOG7[3]: Service [local2o365] finished (0 left) 2017.02.23 11:29:01 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:01 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:01 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:01 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:01 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:46315 2017.02.23 11:29:01 LOG7[4]: Service [uwo2local] started 2017.02.23 11:29:01 LOG7[4]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:01 LOG5[4]: Service [uwo2local] accepted connection from 172.18.58.5:46315 2017.02.23 11:29:01 LOG6[4]: failover: round-robin, starting at entry #0 2017.02.23 11:29:01 LOG6[4]: s_connect: connecting ::1:20587 2017.02.23 11:29:01 LOG7[4]: s_connect: s_poll_wait ::1:20587: waiting 10 seconds 2017.02.23 11:29:01 LOG3[4]: s_connect: connect ::1:20587: Connection refused (111) 2017.02.23 11:29:01 LOG6[4]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:01 LOG7[4]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:01 LOG5[4]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:01 LOG5[4]: Service [uwo2local] connected remote server from 127.0.0.1:33138 2017.02.23 11:29:01 LOG7[4]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:01 LOG7[4]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:01 LOG7[4]: RFC 2487 not detected 2017.02.23 11:29:01 LOG6[4]: Peer certificate not required 2017.02.23 11:29:01 LOG7[4]: TLS state (accept): before SSL initialization 2017.02.23 11:29:01 LOG3[4]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:01 LOG5[4]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:01 LOG7[4]: Remote descriptor (FD=9) closed 2017.02.23 11:29:01 LOG7[4]: Local descriptor (FD=3) closed 2017.02.23 11:29:01 LOG7[4]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:01 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:01 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:01 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:01 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:01 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33138 2017.02.23 11:29:01 LOG7[5]: Service [local2o365] started 2017.02.23 11:29:01 LOG3[5]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:01 LOG5[5]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:01 LOG7[5]: Local descriptor (FD=3) closed 2017.02.23 11:29:01 LOG7[5]: Service [local2o365] finished (0 left) 2017.02.23 11:29:06 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:06 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:06 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:06 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:06 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:55003 2017.02.23 11:29:06 LOG7[6]: Service [uwo2local] started 2017.02.23 11:29:06 LOG7[6]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:06 LOG5[6]: Service [uwo2local] accepted connection from 172.18.58.5:55003 2017.02.23 11:29:06 LOG6[6]: failover: round-robin, starting at entry #1 2017.02.23 11:29:06 LOG6[6]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:06 LOG7[6]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:06 LOG5[6]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:06 LOG5[6]: Service [uwo2local] connected remote server from 127.0.0.1:33140 2017.02.23 11:29:06 LOG7[6]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:06 LOG7[6]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:06 LOG7[6]: RFC 2487 not detected 2017.02.23 11:29:06 LOG6[6]: Peer certificate not required 2017.02.23 11:29:06 LOG7[6]: TLS state (accept): before SSL initialization 2017.02.23 11:29:06 LOG3[6]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:06 LOG5[6]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:06 LOG7[6]: Remote descriptor (FD=9) closed 2017.02.23 11:29:06 LOG7[6]: Local descriptor (FD=3) closed 2017.02.23 11:29:06 LOG7[6]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:06 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:06 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:06 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:06 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:06 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33140 2017.02.23 11:29:06 LOG7[7]: Service [local2o365] started 2017.02.23 11:29:06 LOG3[7]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:06 LOG5[7]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:06 LOG7[7]: Local descriptor (FD=3) closed 2017.02.23 11:29:06 LOG7[7]: Service [local2o365] finished (0 left) 2017.02.23 11:29:11 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:11 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:11 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:11 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:11 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:52586 2017.02.23 11:29:11 LOG7[8]: Service [uwo2local] started 2017.02.23 11:29:11 LOG7[8]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:11 LOG5[8]: Service [uwo2local] accepted connection from 172.18.58.5:52586 2017.02.23 11:29:11 LOG6[8]: failover: round-robin, starting at entry #0 2017.02.23 11:29:11 LOG6[8]: s_connect: connecting ::1:20587 2017.02.23 11:29:11 LOG7[8]: s_connect: s_poll_wait ::1:20587: waiting 10 seconds 2017.02.23 11:29:11 LOG3[8]: s_connect: connect ::1:20587: Connection refused (111) 2017.02.23 11:29:11 LOG6[8]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:11 LOG7[8]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:11 LOG5[8]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:11 LOG5[8]: Service [uwo2local] connected remote server from 127.0.0.1:33144 2017.02.23 11:29:11 LOG7[8]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:11 LOG7[8]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:11 LOG7[8]: RFC 2487 not detected 2017.02.23 11:29:11 LOG6[8]: Peer certificate not required 2017.02.23 11:29:11 LOG7[8]: TLS state (accept): before SSL initialization 2017.02.23 11:29:11 LOG3[8]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:11 LOG5[8]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:11 LOG7[8]: Remote descriptor (FD=9) closed 2017.02.23 11:29:11 LOG7[8]: Local descriptor (FD=3) closed 2017.02.23 11:29:11 LOG7[8]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:11 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:11 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:11 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:11 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:11 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33144 2017.02.23 11:29:11 LOG7[9]: Service [local2o365] started 2017.02.23 11:29:11 LOG3[9]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:11 LOG5[9]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:11 LOG7[9]: Local descriptor (FD=3) closed 2017.02.23 11:29:11 LOG7[9]: Service [local2o365] finished (0 left) 2017.02.23 11:29:16 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:16 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:16 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:16 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:16 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:60425 2017.02.23 11:29:16 LOG7[10]: Service [uwo2local] started 2017.02.23 11:29:16 LOG7[10]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:16 LOG5[10]: Service [uwo2local] accepted connection from 172.18.58.5:60425 2017.02.23 11:29:16 LOG6[10]: failover: round-robin, starting at entry #1 2017.02.23 11:29:16 LOG6[10]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:16 LOG7[10]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:16 LOG5[10]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:16 LOG5[10]: Service [uwo2local] connected remote server from 127.0.0.1:33146 2017.02.23 11:29:16 LOG7[10]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:16 LOG7[10]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:16 LOG7[10]: RFC 2487 not detected 2017.02.23 11:29:16 LOG6[10]: Peer certificate not required 2017.02.23 11:29:16 LOG7[10]: TLS state (accept): before SSL initialization 2017.02.23 11:29:16 LOG3[10]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:16 LOG5[10]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:16 LOG7[10]: Remote descriptor (FD=9) closed 2017.02.23 11:29:16 LOG7[10]: Local descriptor (FD=3) closed 2017.02.23 11:29:16 LOG7[10]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:16 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:16 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:16 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:16 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:16 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33146 2017.02.23 11:29:16 LOG7[11]: Service [local2o365] started 2017.02.23 11:29:16 LOG3[11]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:16 LOG5[11]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:16 LOG7[11]: Local descriptor (FD=3) closed 2017.02.23 11:29:16 LOG7[11]: Service [local2o365] finished (0 left) 2017.02.23 11:29:21 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:21 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:21 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:21 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:21 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:50381 2017.02.23 11:29:21 LOG7[12]: Service [uwo2local] started 2017.02.23 11:29:21 LOG7[12]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:21 LOG5[12]: Service [uwo2local] accepted connection from 172.18.58.5:50381 2017.02.23 11:29:21 LOG6[12]: failover: round-robin, starting at entry #0 2017.02.23 11:29:21 LOG6[12]: s_connect: connecting ::1:20587 2017.02.23 11:29:21 LOG7[12]: s_connect: s_poll_wait ::1:20587: waiting 10 seconds 2017.02.23 11:29:21 LOG3[12]: s_connect: connect ::1:20587: Connection refused (111) 2017.02.23 11:29:21 LOG6[12]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:21 LOG7[12]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:21 LOG5[12]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:21 LOG5[12]: Service [uwo2local] connected remote server from 127.0.0.1:33150 2017.02.23 11:29:21 LOG7[12]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:21 LOG7[12]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:21 LOG7[12]: RFC 2487 not detected 2017.02.23 11:29:21 LOG6[12]: Peer certificate not required 2017.02.23 11:29:21 LOG7[12]: TLS state (accept): before SSL initialization 2017.02.23 11:29:21 LOG3[12]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:21 LOG5[12]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:21 LOG7[12]: Remote descriptor (FD=9) closed 2017.02.23 11:29:21 LOG7[12]: Local descriptor (FD=3) closed 2017.02.23 11:29:21 LOG7[12]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:21 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:21 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:21 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:21 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:21 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33150 2017.02.23 11:29:21 LOG7[13]: Service [local2o365] started 2017.02.23 11:29:21 LOG3[13]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:21 LOG5[13]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:21 LOG7[13]: Local descriptor (FD=3) closed 2017.02.23 11:29:21 LOG7[13]: Service [local2o365] finished (0 left) 2017.02.23 11:29:26 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:26 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:26 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:26 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:26 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:7384 2017.02.23 11:29:26 LOG7[14]: Service [uwo2local] started 2017.02.23 11:29:26 LOG7[14]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:26 LOG5[14]: Service [uwo2local] accepted connection from 172.18.58.5:7384 2017.02.23 11:29:26 LOG6[14]: failover: round-robin, starting at entry #1 2017.02.23 11:29:26 LOG6[14]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:26 LOG7[14]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:26 LOG5[14]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:26 LOG5[14]: Service [uwo2local] connected remote server from 127.0.0.1:33152 2017.02.23 11:29:26 LOG7[14]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:26 LOG7[14]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:26 LOG7[14]: RFC 2487 not detected 2017.02.23 11:29:26 LOG6[14]: Peer certificate not required 2017.02.23 11:29:26 LOG7[14]: TLS state (accept): before SSL initialization 2017.02.23 11:29:26 LOG3[14]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:26 LOG5[14]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:26 LOG7[14]: Remote descriptor (FD=9) closed 2017.02.23 11:29:26 LOG7[14]: Local descriptor (FD=3) closed 2017.02.23 11:29:26 LOG7[14]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:26 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:26 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:26 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:26 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:26 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33152 2017.02.23 11:29:26 LOG7[15]: Service [local2o365] started 2017.02.23 11:29:26 LOG3[15]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:26 LOG5[15]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:26 LOG7[15]: Local descriptor (FD=3) closed 2017.02.23 11:29:26 LOG7[15]: Service [local2o365] finished (0 left) 2017.02.23 11:29:31 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:31 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:31 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:31 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:31 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:40920 2017.02.23 11:29:31 LOG7[16]: Service [uwo2local] started 2017.02.23 11:29:31 LOG7[16]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:31 LOG5[16]: Service [uwo2local] accepted connection from 172.18.58.5:40920 2017.02.23 11:29:31 LOG6[16]: failover: round-robin, starting at entry #0 2017.02.23 11:29:31 LOG6[16]: s_connect: connecting ::1:20587 2017.02.23 11:29:31 LOG7[16]: s_connect: s_poll_wait ::1:20587: waiting 10 seconds 2017.02.23 11:29:31 LOG3[16]: s_connect: connect ::1:20587: Connection refused (111) 2017.02.23 11:29:31 LOG6[16]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:31 LOG7[16]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:31 LOG5[16]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:31 LOG5[16]: Service [uwo2local] connected remote server from 127.0.0.1:33156 2017.02.23 11:29:31 LOG7[16]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:31 LOG7[16]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:31 LOG7[16]: RFC 2487 not detected 2017.02.23 11:29:31 LOG6[16]: Peer certificate not required 2017.02.23 11:29:31 LOG7[16]: TLS state (accept): before SSL initialization 2017.02.23 11:29:31 LOG3[16]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:31 LOG5[16]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:31 LOG7[16]: Remote descriptor (FD=9) closed 2017.02.23 11:29:31 LOG7[16]: Local descriptor (FD=3) closed 2017.02.23 11:29:31 LOG7[16]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:31 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:31 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:31 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:31 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:31 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33156 2017.02.23 11:29:31 LOG7[17]: Service [local2o365] started 2017.02.23 11:29:31 LOG3[17]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:31 LOG5[17]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:31 LOG7[17]: Local descriptor (FD=3) closed 2017.02.23 11:29:31 LOG7[17]: Service [local2o365] finished (0 left) 2017.02.23 11:29:36 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:36 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:36 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:36 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:36 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:23632 2017.02.23 11:29:36 LOG7[18]: Service [uwo2local] started 2017.02.23 11:29:36 LOG7[18]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:36 LOG5[18]: Service [uwo2local] accepted connection from 172.18.58.5:23632 2017.02.23 11:29:36 LOG6[18]: failover: round-robin, starting at entry #1 2017.02.23 11:29:36 LOG6[18]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:36 LOG7[18]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:36 LOG5[18]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:36 LOG5[18]: Service [uwo2local] connected remote server from 127.0.0.1:33158 2017.02.23 11:29:36 LOG7[18]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:36 LOG7[18]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:36 LOG7[18]: RFC 2487 not detected 2017.02.23 11:29:36 LOG6[18]: Peer certificate not required 2017.02.23 11:29:36 LOG7[18]: TLS state (accept): before SSL initialization 2017.02.23 11:29:36 LOG3[18]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:36 LOG5[18]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:36 LOG7[18]: Remote descriptor (FD=9) closed 2017.02.23 11:29:36 LOG7[18]: Local descriptor (FD=3) closed 2017.02.23 11:29:36 LOG7[18]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:36 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:36 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:36 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:36 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:36 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33158 2017.02.23 11:29:36 LOG7[19]: Service [local2o365] started 2017.02.23 11:29:36 LOG3[19]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:36 LOG5[19]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:36 LOG7[19]: Local descriptor (FD=3) closed 2017.02.23 11:29:36 LOG7[19]: Service [local2o365] finished (0 left) 2017.02.23 11:29:41 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:41 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:41 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:41 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:41 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:2134 2017.02.23 11:29:41 LOG7[20]: Service [uwo2local] started 2017.02.23 11:29:41 LOG7[20]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:41 LOG5[20]: Service [uwo2local] accepted connection from 172.18.58.5:2134 2017.02.23 11:29:41 LOG6[20]: failover: round-robin, starting at entry #0 2017.02.23 11:29:41 LOG6[20]: s_connect: connecting ::1:20587 2017.02.23 11:29:41 LOG7[20]: s_connect: s_poll_wait ::1:20587: waiting 10 seconds 2017.02.23 11:29:41 LOG3[20]: s_connect: connect ::1:20587: Connection refused (111) 2017.02.23 11:29:41 LOG6[20]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:41 LOG7[20]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:41 LOG5[20]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:41 LOG5[20]: Service [uwo2local] connected remote server from 127.0.0.1:33162 2017.02.23 11:29:41 LOG7[20]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:41 LOG7[20]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:41 LOG7[20]: RFC 2487 not detected 2017.02.23 11:29:41 LOG6[20]: Peer certificate not required 2017.02.23 11:29:41 LOG7[20]: TLS state (accept): before SSL initialization 2017.02.23 11:29:41 LOG3[20]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:41 LOG5[20]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:41 LOG7[20]: Remote descriptor (FD=9) closed 2017.02.23 11:29:41 LOG7[20]: Local descriptor (FD=3) closed 2017.02.23 11:29:41 LOG7[20]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:41 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:41 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:41 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:41 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:41 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33162 2017.02.23 11:29:41 LOG7[21]: Service [local2o365] started 2017.02.23 11:29:41 LOG3[21]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:41 LOG5[21]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:41 LOG7[21]: Local descriptor (FD=3) closed 2017.02.23 11:29:41 LOG7[21]: Service [local2o365] finished (0 left) 2017.02.23 11:29:46 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:46 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:46 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:46 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:46 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:4464 2017.02.23 11:29:46 LOG7[22]: Service [uwo2local] started 2017.02.23 11:29:46 LOG7[22]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:46 LOG5[22]: Service [uwo2local] accepted connection from 172.18.58.5:4464 2017.02.23 11:29:46 LOG6[22]: failover: round-robin, starting at entry #1 2017.02.23 11:29:46 LOG6[22]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:46 LOG7[22]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:46 LOG5[22]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:46 LOG5[22]: Service [uwo2local] connected remote server from 127.0.0.1:33164 2017.02.23 11:29:46 LOG7[22]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:46 LOG7[22]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:46 LOG7[22]: RFC 2487 not detected 2017.02.23 11:29:46 LOG6[22]: Peer certificate not required 2017.02.23 11:29:46 LOG7[22]: TLS state (accept): before SSL initialization 2017.02.23 11:29:46 LOG3[22]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:46 LOG5[22]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:46 LOG7[22]: Remote descriptor (FD=9) closed 2017.02.23 11:29:46 LOG7[22]: Local descriptor (FD=3) closed 2017.02.23 11:29:46 LOG7[22]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:46 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:46 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:46 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:46 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:46 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33164 2017.02.23 11:29:46 LOG7[23]: Service [local2o365] started 2017.02.23 11:29:46 LOG3[23]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:46 LOG5[23]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:46 LOG7[23]: Local descriptor (FD=3) closed 2017.02.23 11:29:46 LOG7[23]: Service [local2o365] finished (0 left) 2017.02.23 11:29:51 LOG5[cron]: DH parameters updated 2017.02.23 11:29:51 LOG6[cron]: Cron jobs completed in 63 seconds 2017.02.23 11:29:51 LOG7[cron]: Waiting 86337 seconds 2017.02.23 11:29:51 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:51 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:51 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:51 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:51 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:28318 2017.02.23 11:29:51 LOG7[24]: Service [uwo2local] started 2017.02.23 11:29:51 LOG7[24]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:51 LOG5[24]: Service [uwo2local] accepted connection from 172.18.58.5:28318 2017.02.23 11:29:51 LOG6[24]: failover: round-robin, starting at entry #0 2017.02.23 11:29:51 LOG6[24]: s_connect: connecting ::1:20587 2017.02.23 11:29:51 LOG7[24]: s_connect: s_poll_wait ::1:20587: waiting 10 seconds 2017.02.23 11:29:51 LOG3[24]: s_connect: connect ::1:20587: Connection refused (111) 2017.02.23 11:29:51 LOG6[24]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:51 LOG7[24]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:51 LOG5[24]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:51 LOG5[24]: Service [uwo2local] connected remote server from 127.0.0.1:33168 2017.02.23 11:29:51 LOG7[24]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:51 LOG7[24]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:51 LOG7[24]: RFC 2487 not detected 2017.02.23 11:29:51 LOG6[24]: Peer certificate not required 2017.02.23 11:29:51 LOG7[24]: TLS state (accept): before SSL initialization 2017.02.23 11:29:51 LOG3[24]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:51 LOG5[24]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:51 LOG7[24]: Remote descriptor (FD=9) closed 2017.02.23 11:29:51 LOG7[24]: Local descriptor (FD=3) closed 2017.02.23 11:29:51 LOG7[24]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:51 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:51 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:51 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:51 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:51 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33168 2017.02.23 11:29:51 LOG7[25]: Service [local2o365] started 2017.02.23 11:29:51 LOG3[25]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:51 LOG5[25]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:51 LOG7[25]: Local descriptor (FD=3) closed 2017.02.23 11:29:51 LOG7[25]: Service [local2o365] finished (0 left) 2017.02.23 11:29:56 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:56 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:56 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:29:56 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:29:56 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 172.18.58.5:32441 2017.02.23 11:29:56 LOG7[26]: Service [uwo2local] started 2017.02.23 11:29:56 LOG7[26]: Option TCP_NODELAY set on local socket 2017.02.23 11:29:56 LOG5[26]: Service [uwo2local] accepted connection from 172.18.58.5:32441 2017.02.23 11:29:56 LOG6[26]: failover: round-robin, starting at entry #1 2017.02.23 11:29:56 LOG6[26]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:29:56 LOG7[26]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:29:56 LOG5[26]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:29:56 LOG5[26]: Service [uwo2local] connected remote server from 127.0.0.1:33170 2017.02.23 11:29:56 LOG7[26]: Option TCP_NODELAY set on remote socket 2017.02.23 11:29:56 LOG7[26]: Remote descriptor (FD=9) initialized 2017.02.23 11:29:56 LOG7[26]: RFC 2487 not detected 2017.02.23 11:29:56 LOG6[26]: Peer certificate not required 2017.02.23 11:29:56 LOG7[26]: TLS state (accept): before SSL initialization 2017.02.23 11:29:56 LOG3[26]: SSL_accept: Peer suddenly disconnected 2017.02.23 11:29:56 LOG5[26]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:56 LOG7[26]: Remote descriptor (FD=9) closed 2017.02.23 11:29:56 LOG7[26]: Local descriptor (FD=3) closed 2017.02.23 11:29:56 LOG7[26]: Service [uwo2local] finished (0 left) 2017.02.23 11:29:56 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:29:56 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:29:56 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:29:56 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:29:56 LOG7[ui]: Service [local2o365] accepted (FD=3) from 127.0.0.1:33170 2017.02.23 11:29:56 LOG7[27]: Service [local2o365] started 2017.02.23 11:29:56 LOG3[27]: getpeerbyname (local_rfd): Transport endpoint is not connected (107) 2017.02.23 11:29:56 LOG5[27]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:29:56 LOG7[27]: Local descriptor (FD=3) closed 2017.02.23 11:29:56 LOG7[27]: Service [local2o365] finished (0 left) 2017.02.23 11:30:00 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:30:00 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:30:00 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2017.02.23 11:30:00 LOG7[ui]: FD=8 events=0x2001 revents=0x0 2017.02.23 11:30:00 LOG7[ui]: Service [uwo2local] accepted (FD=3) from 129.100.6.17:16594 2017.02.23 11:30:00 LOG7[28]: Service [uwo2local] started 2017.02.23 11:30:00 LOG7[28]: Option TCP_NODELAY set on local socket 2017.02.23 11:30:00 LOG5[28]: Service [uwo2local] accepted connection from 129.100.6.17:16594 2017.02.23 11:30:00 LOG6[28]: failover: round-robin, starting at entry #0 2017.02.23 11:30:00 LOG6[28]: s_connect: connecting ::1:20587 2017.02.23 11:30:00 LOG7[28]: s_connect: s_poll_wait ::1:20587: waiting 10 seconds 2017.02.23 11:30:00 LOG3[28]: s_connect: connect ::1:20587: Connection refused (111) 2017.02.23 11:30:00 LOG6[28]: s_connect: connecting 127.0.0.1:20587 2017.02.23 11:30:00 LOG7[28]: s_connect: s_poll_wait 127.0.0.1:20587: waiting 10 seconds 2017.02.23 11:30:00 LOG5[28]: s_connect: connected 127.0.0.1:20587 2017.02.23 11:30:00 LOG5[28]: Service [uwo2local] connected remote server from 127.0.0.1:33176 2017.02.23 11:30:00 LOG7[28]: Option TCP_NODELAY set on remote socket 2017.02.23 11:30:00 LOG7[28]: Remote descriptor (FD=9) initialized 2017.02.23 11:30:00 LOG7[ui]: Found 1 ready file descriptor(s) 2017.02.23 11:30:00 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2017.02.23 11:30:00 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2017.02.23 11:30:00 LOG7[ui]: FD=8 events=0x2001 revents=0x1 2017.02.23 11:30:00 LOG7[ui]: Service [local2o365] accepted (FD=10) from 127.0.0.1:33176 2017.02.23 11:30:00 LOG7[29]: Service [local2o365] started 2017.02.23 11:30:00 LOG7[29]: Option TCP_NODELAY set on local socket 2017.02.23 11:30:00 LOG5[29]: Service [local2o365] accepted connection from 127.0.0.1:33176 2017.02.23 11:30:00 LOG6[29]: failover: round-robin, starting at entry #13 2017.02.23 11:30:00 LOG6[29]: s_connect: connecting 2603:1036:405:4a::2:587 2017.02.23 11:30:00 LOG3[29]: s_connect: connect 2603:1036:405:4a::2:587: Network is unreachable (101) 2017.02.23 11:30:00 LOG6[29]: s_connect: connecting 2603:1036:3:11e::2:587 2017.02.23 11:30:00 LOG3[29]: s_connect: connect 2603:1036:3:11e::2:587: Network is unreachable (101) 2017.02.23 11:30:00 LOG6[29]: s_connect: connecting 2603:1036:404:56::2:587 2017.02.23 11:30:00 LOG3[29]: s_connect: connect 2603:1036:404:56::2:587: Network is unreachable (101) 2017.02.23 11:30:00 LOG6[29]: s_connect: connecting 40.97.132.210:587 2017.02.23 11:30:00 LOG7[29]: s_connect: s_poll_wait 40.97.132.210:587: waiting 10 seconds 2017.02.23 11:30:00 LOG5[29]: s_connect: connected 40.97.132.210:587 2017.02.23 11:30:00 LOG5[29]: Service [local2o365] connected remote server from 172.18.58.248:52538 2017.02.23 11:30:00 LOG7[29]: Option TCP_NODELAY set on remote socket 2017.02.23 11:30:00 LOG7[29]: Remote descriptor (FD=11) initialized 2017.02.23 11:30:00 LOG7[29]: <- 220 MWHPR2001CA0006.outlook.office365.com Microsoft ESMTP MAIL Service ready at Thu, 23 Feb 2017 16:30:00 +0000 2017.02.23 11:30:00 LOG7[29]: -> 220 MWHPR2001CA0006.outlook.office365.com Microsoft ESMTP MAIL Service ready at Thu, 23 Feb 2017 16:30:00 +0000 2017.02.23 11:30:00 LOG7[29]: -> EHLO localhost 2017.02.23 11:30:00 LOG7[28]: RFC 2487 detected 2017.02.23 11:30:00 LOG7[28]: <- 220 MWHPR2001CA0006.outlook.office365.com Microsoft ESMTP MAIL Service ready at Thu, 23 Feb 2017 16:30:00 +0000 2017.02.23 11:30:00 LOG7[28]: -> 220 MWHPR2001CA0006.outlook.office365.com stunnel for Microsoft ESMTP MAIL Service ready at Thu, 23 Feb 2017 16:30:00 +0000 2017.02.23 11:30:00 LOG7[29]: <- 250-MWHPR2001CA0006.outlook.office365.com Hello [129.100.1.192] 2017.02.23 11:30:00 LOG7[29]: <- 250-SIZE 157286400 2017.02.23 11:30:00 LOG7[29]: <- 250-PIPELINING 2017.02.23 11:30:00 LOG7[29]: <- 250-DSN 2017.02.23 11:30:00 LOG7[29]: <- 250-ENHANCEDSTATUSCODES 2017.02.23 11:30:00 LOG7[29]: <- 250-STARTTLS 2017.02.23 11:30:00 LOG7[29]: <- 250-8BITMIME 2017.02.23 11:30:00 LOG7[29]: <- 250-BINARYMIME 2017.02.23 11:30:00 LOG7[29]: <- 250-CHUNKING 2017.02.23 11:30:00 LOG7[29]: <- 250 SMTPUTF8 2017.02.23 11:30:00 LOG7[29]: -> STARTTLS 2017.02.23 11:30:00 LOG7[29]: <- 220 2.0.0 SMTP server ready 2017.02.23 11:30:00 LOG6[29]: SNI: sending servername: smtp.office365.com 2017.02.23 11:30:00 LOG6[29]: Peer certificate required 2017.02.23 11:30:00 LOG7[29]: TLS state (connect): before SSL initialization 2017.02.23 11:30:00 LOG7[29]: TLS state (connect): SSLv3/TLS write client hello 2017.02.23 11:30:00 LOG7[29]: TLS state (connect): SSLv3/TLS write client hello 2017.02.23 11:30:00 LOG7[29]: TLS state (connect): SSLv3/TLS read server hello 2017.02.23 11:30:00 LOG7[29]: Verification started at depth=1: C=US, O=DigiCert Inc, CN=DigiCert Cloud Services CA-1 2017.02.23 11:30:00 LOG4[29]: CERT: Pre-verification error: unable to get local issuer certificate 2017.02.23 11:30:00 LOG4[29]: Rejected by CERT at depth=1: C=US, O=DigiCert Inc, CN=DigiCert Cloud Services CA-1 2017.02.23 11:30:00 LOG7[29]: Remove session callback 2017.02.23 11:30:00 LOG7[29]: Deallocating application specific data for addr index 2017.02.23 11:30:00 LOG7[29]: TLS alert (write): fatal: unknown CA 2017.02.23 11:30:00 LOG3[29]: SSL_connect: 1416F086: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed 2017.02.23 11:30:00 LOG5[29]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2017.02.23 11:30:00 LOG7[29]: Deallocating application specific data for addr index Segmentation fault [root@mtar1 stunnel]# *Andrew Culver* System Administrator Information Technology Services <https://www.uwo.ca/its> University of Western Ontario <https://www.uwo.ca> e: aculver(a)uwo.ca p: 519-661-2111 x80265 <15196612111,80265> cal: html <http://goo.gl/wVoDlo> | ics <http://goo.gl/ncUjV0>

1 0

Bad Magic
by Melzer, Jacob 21 Feb '17

21 Feb '17

I'm trying to do a proof of concept using Stunnel on AIX 6.1. Without stunnel I'd have: Telnet session -> listening service With stunnel, I want: telnet session -> stunnel client -[secure connection]--> Stunnel server -->listening service. The stunnel client seems to be working fine, but the stunnel server abends as soon as it receives a secure connection. Client: Accepts non-secure on port 33342. Forwards to secure socket 33343 stunnel stunnel.conf.2 2017.02.21 09:31:35 LOG5[ui]: stunnel 5.40 on powerpc-ibm-aix6.1.0.0 platform 2017.02.21 09:31:35 LOG5[ui]: Compiled/running with OpenSSL 1.0.2j 26 Sep 2016 2017.02.21 09:31:35 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2017.02.21 09:31:35 LOG5[ui]: Reading configuration from file /bmo/stunnel/bin/stunnel.conf.2 2017.02.21 09:31:35 LOG5[ui]: UTF-8 byte order mark detected 2017.02.21 09:31:35 LOG5[ui]: FIPS mode disabled 2017.02.21 09:31:35 LOG6[ui]: Initializing service [hif] 2017.02.21 09:31:35 LOG6[ui]: Loading certificate from file: /bmo/stunnel/stunnel.pem 2017.02.21 09:31:35 LOG6[ui]: Certificate loaded from file: /bmo/stunnel/stunnel.pem 2017.02.21 09:31:35 LOG6[ui]: Loading private key from file: /bmo/stunnel/stunnel.pem 2017.02.21 09:31:35 LOG4[ui]: Insecure file permissions on /bmo/stunnel/stunnel.pem 2017.02.21 09:31:35 LOG6[ui]: Private key loaded from file: /bmo/stunnel/stunnel.pem 2017.02.21 09:31:35 LOG4[ui]: Service [hif] needs authentication to prevent MITM attacks 2017.02.21 09:31:35 LOG5[ui]: Configuration successful 2017.02.21 09:31:38 LOG5[0]: Service [hif] accepted connection from 127.0.0.1:34749 2017.02.21 09:31:38 LOG6[0]: s_connect: connecting 127.0.0.1:33343 2017.02.21 09:31:38 LOG6[0]: s_connect: connected 127.0.0.1:33343 2017.02.21 09:31:38 LOG5[0]: Service [hif] connected remote server from 127.0.0.1:34750 2017.02.21 09:31:38 LOG6[0]: SNI: sending servername: localhost 2017.02.21 09:31:38 LOG6[0]: Peer certificate not required 2017.02.21 09:31:38 LOG3[0]: SSL_connect: Peer suddenly disconnected 2017.02.21 09:31:38 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket Server Accepts SSL connections on port 33343, connects to a non-secure service. stunnel stunnel.conf.1 2017.02.21 09:31:25 LOG5[ui]: stunnel 5.40 on powerpc-ibm-aix6.1.0.0 platform 2017.02.21 09:31:25 LOG5[ui]: Compiled/running with OpenSSL 1.0.2j 26 Sep 2016 2017.02.21 09:31:25 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2017.02.21 09:31:25 LOG5[ui]: Reading configuration from file /bmo/stunnel/bin/stunnel.conf.1 2017.02.21 09:31:25 LOG5[ui]: UTF-8 byte order mark detected 2017.02.21 09:31:25 LOG5[ui]: FIPS mode disabled 2017.02.21 09:31:25 LOG6[ui]: Initializing service [hif] 2017.02.21 09:31:25 LOG6[ui]: Loading certificate from file: /bmo/stunnel/stunnel.pem 2017.02.21 09:31:25 LOG6[ui]: Certificate loaded from file: /bmo/stunnel/stunnel.pem 2017.02.21 09:31:25 LOG6[ui]: Loading private key from file: /bmo/stunnel/stunnel.pem 2017.02.21 09:31:25 LOG4[ui]: Insecure file permissions on /bmo/stunnel/stunnel.pem 2017.02.21 09:31:25 LOG6[ui]: Private key loaded from file: /bmo/stunnel/stunnel.pem 2017.02.21 09:31:25 LOG5[ui]: Configuration successful 2017.02.21 09:31:38 LOG5[0]: Service [hif] accepted connection from 127.0.0.1:34750 2017.02.21 09:31:38 LOG6[0]: Peer certificate not required INTERNAL ERROR: Bad magic at OpenSSL, line 0 (this is an abend - core file gets created). log file exactly matches the standard output. Any idea what's going wrong here? dbx of the core file: tbs@netcbccadvwvr01 /bmo/hif/stunnel-5.40/src>dbx /bmo/stunnel/bin/stunnel core Type 'help' for help. [using memory image in core] reading symbolic information ... IOT/Abort trap in abort at 0xd01af1f8 ($t3) 0xd01af1f8 (abort+0xf8) 80410014 lwz r2,0x14(r1) (dbx) where abort() at 0xd01af1f8 fatal_debug(txt = "Bad magic", file = "OpenSSL", line = 0), line 359 in "log.c" get_alloc_list_ptr(ptr = 0x2007e1c8, file = "OpenSSL", line = 0), line 399 in "str.c" str_detach_debug(ptr = 0x2007e1c8, file = "OpenSSL", line = 0), line 348 in "str.c" str_free_debug(ptr = 0x2007e1c8, file = "OpenSSL", line = 0), line 383 in "str.c" free_function(ptr = 0x2007e1c8), line 191 in "tls.c" mem.CRYPTO_free() at 0xd97dd8d8 bn_lib.bn_expand2@AF37_5() at 0xd97e8da4 bn_mont.BN_mod_mul_montgomery() at 0xd981e150 ecp_mont.ec_GFp_mont_field_mul() at 0xd9837a18 ecp_smpl.ec_GFp_simple_point_get_affine_coordinates() at 0xd9839890 ec_lib.EC_POINT_get_affine_coordinates_GFp() at 0xd9a81dfc ecp_oct.ec_GFp_simple_point2oct() at 0xd9acc0d4 ec_oct.EC_POINT_point2oct() at 0xd9acb754 ssl3_send_server_key_exchange() at 0xd99e7c28 ssl3_accept() at 0xd99e9950 SSL_accept() at 0xd99c0b98 ssl23_get_client_hello() at 0xd9a003f4 ssl23_accept() at 0xd9a00c5c SSL_accept() at 0xd99c0b98 ssl_start(c = 0x20084cb8), line 431 in "client.c" client_try(c = 0x20084cb8), line 273 in "client.c" client_run(c = 0x20084cb8), line 181 in "client.c" client_main(c = 0x20084cb8), line 140 in "client.c" client_thread(arg = 0x20084cb8), line 99 in "client.c" (dbx) thread thread state-k wchan state-u k-tid mode held scope function $t1 run running 26279997 u no sys __fd_poll $t2 run running 45088879 u no sys _p_nsleep >$t3 run running 19070997 k no sys abort (dbx) list free_function 186 187 #if OPENSSL_VERSION_NUMBER<0x10100000L 188 NOEXPORT void free_function(void *ptr) { 189 /* CRYPTO_set_mem_ex_functions() needs a function rather than a macro */ 190 /* unfortunately, OpenSSL provides no file:line information here */ 191 str_free_debug(ptr, "OpenSSL", 0); 192 } 193 #endif 194 195 /* end of tls.c */ Should I be concerned that it looks like it is executing "free_function" from within an if statement "if OPENSSL_VERSION_NUMBER<0x1010000L but my openssl version is 2017.02.21 09:31:35 LOG5[ui]: Compiled/running with OpenSSL 1.0.2j 26 Sep 2016 Troubleshooting so far: - I had the same problem with earlier versions of openssl. - I've tried this with 5.37 as well (based on Brian McGinity's post from a few days ago), but get the same error. Jacob

1 0

stunnel on Windows Client: Changing active network interface (wired, wireless)
by b.koch.kemper 17 Feb '17

17 Feb '17

Dear stunnel community, we are running an application on our windows clients. The application needs a remote connection to our server (linux) for remote function calls. We could successfully secure this connection via stunnel. However, when our windows users change their network connection (e.g. they disconnect their notebook from the docking station to our corporate wifi) the connection and hence the whole application breaks. The users actually have to restart stunnel to make the application work again, which is really inconvenient. As the application on the notebook is always using the same port, is it somehow possible to make stunnel establish a new connection using the new active network interface? Kind regards, Bernhard

1 0

RSA too big problem
by Vikrant Agarwal 16 Feb '17

16 Feb '17

Hi, I upgraded my Stunnel server machine to CentOS 6.8 and post upgrade , the stunnel too got upgraded to stunnel 4.29 on x86_64-redhat-linux-gnu with OpenSSL 1.0.1e-fips 11 Feb 2013 . Now since then many of the stunnel client using newer stunnel client (those uses TLSv1.2 for Negotiation) are not able to connect . I get below error on the server in logs RSA_sign:digest too big for rsa key:rsa_sign’ How to fix this please? Regards, Vikrant

1 0

Re: [stunnel-users] Problem with 5.40 and Peer suddenly disconnected
by Brian McGinity 08 Feb '17

08 Feb '17

I found the archives and downgraded to 5.37 and this fixed the problem. Before going this route I tried 5.40 and 5.41 beta and both had the same issues with 'Peer suddenly disconnected'. Strange that it this was only happening for one particular connection (1 out of 7). It would happen with every test. If you would like for me to beta test another version, I would be happy to try. Bran

1 0

Problem with 5.40 and Peer suddenly disconnected
by Brian McGinity 07 Feb '17

07 Feb '17

After updating to stunnel 5.40 on x86-pc-msvc-1500 platform, I am getting a Peer suddenly disconnected each time I post data to a particular url. [VISION_WEB] client = yes accept = 127.0.0.1:1935 connect = xx.xx.web.com:443 sslVersion = TLSv1 2017.02.07 16:30:08 LOG5[160]: Service [XX_WEB] accepted connection from 192.168.100.21:53507 2017.02.07 16:30:08 LOG5[160]: s_connect: connected 11.11.111.36:443 2017.02.07 16:30:08 LOG5[160]: Service [XX_WEB] connected remote server from 192.168.100.21:53508 2017.02.07 16:30:08 LOG3[160]: SSL_connect: Peer suddenly disconnected 2017.02.07 16:30:08 LOG5[160]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket This is a production issue and is causing a lot of problems for a lot of people and I need to do something quickly. Is it possible to download stunnel 5.37 installed to see if going back to this version will fix this issue? Where is it? Or does anyone possibly know why this might be happening? Thank you for your help. Brian

1 0

Default passthrough to different destination?
by Mark Boyce 03 Feb '17

03 Feb '17

Hi All Wondering if there’s a way to pass an unencrypted connections traffic to an alternative location if a client does not SSL/TLS with the stunnel server? So considering stunnel running as a server to wrap an unencrypted SMTP server. If the SMTP client/server talks SSL/TLS all is good and as expected. If the client tries to talk without encryption it gets disconnect. Is there any way to send this traffic elsewhere rather than disconnecting the client? So that stunnel is adding an SSL/TLS option to a service rather than enforcing it. Splitting the traffic to destination servers based on if the client was encrypted or not. Thoughts? Thanks Mark

2 3

Mixed cert/PSKsecrets & TLS/SSL before proxy
by Varda Zklir 02 Feb '17

02 Feb '17

Hello Gentlemen. Needs help in configuration or negative clarifications on two issues. 1) First question whether is mixed use of cert/PSKsecrets auth possible? The same method (ether cert or PSKsecrets explicitly) serverside trough the parent [TLS] and inherited services works properly. But mixed cert/PSKsecrets like in config snippet below doesn't work. [TLS] client = no accept = 0.0.0.0:https connect = localhost:http cert = /etc/opt/stunnel/stunnel.pem [ssh] client = no sni = TLS:ssh connect = localhost:ssh [socks] client = no sni = TLS:socks protocol = socks PSKsecrets = /etc/opt/stunnel/auth/passwd The idea is to pass insensibly all incorrect or non-SNI aware requests to main http server and hide other multiplexed services. And at the same time to establish encryption and password access control to [socks] service. 2) And the second question is it possible proxy CONNECT after establishing SSL/TLS encryption? The configuration section: [ssh] accept = 22222 protocol = connect protocolHost = server.tld:443 protocolUsername = usernamehere protocolPassword = passwordhere connect = proxy.tld:8080 Say to establish unencrypted connection with proxy, pass username and password, tell proxy to establish CONNECT to target 443 and then transmit SSL/TLS to it. Goal is if I have SSL/TLS termination server/proxy on port 443 so we at first speak SSL/TLS with proxy and only then proceed to proxy requests phase. Thanks for future explanations.

1 0

installation problems
by HOFFMAN, GEOFFREY 30 Jan '17

30 Jan '17

I am having trouble installing stunnel on CentOS 7.3. I was given a directive to "use the latest OpenSSL" so on one target machine, it has 1.0.2k built from source. On the machine with OpenSSL 1.0.2k, when attempting to install stunnel, when I run ./configure, it passes with this info: configure: FIPS support not found Then make fails with: /usr/bin/ld: /usr/local/ssl/lib/libssl.a(s3_srvr.o): relocation R_X86_64_32 against `.rodata' can not be used when making a shared object; recompile with -fPIC On another target machine, it has 1.0.1e-fips, installed via yum package. On the machine with OpenSSL 1.0.1e-fips, ./configure fails with: checking for TLS directory... not found configure: error: Could not find your TLS library installation dir Advice on installing with the latest OpenSSL (1.0.2k) would be much appreciated. This e-mail, including any attachments, is meant only for the intended recipient of the transmission, and may be a confidential communication or a communication privileged by law. If you received this e-mail in error, any review, use, dissemination, distribution, or copying of this e-mail is strictly prohibited. Please notify us immediately of the error by return e-mail and please delete this message from your system. Thank you in advance for your cooperation.

1 0

Life cycle information
by Ben Harper 30 Jan '17

30 Jan '17

Greetings, I am trying to confirm some life cycle information, mainly supported version(s) and what versions do not insure backwards compatibility. It would appear that only the latest version is supported, per the first item under 'Before you send your question to stunnel-users' on the Mailing Lists page[0]. Does this project use semantic versioning? Will incompatibilities only come when a 6.x.x version is released? It seems at one point this was the case per the 'Upgrading to stunnel 4' link on the Documentation page[1]. Are my assumptions correct? Thanks, Ben [0]: https://www.stunnel.org/lists.html [1]: https://www.stunnel.org/docs.html

1 0

Proxy one site to HTTPS?
by Jeffrey Walton 30 Jan '17

30 Jan '17

Hi Everyone, I'm having trouble setting up a proxy for one site. The client is MacPorts on OS X 10.5. It makes some requests for files over port 80, but they apparently need to be made over port 443. Also see https://trac.macports.org/ticket/53423 and https://trac.macports.org/ticket/53347. My first question is, is it possible to proxy one site to HTTPS? My second question is, how does one do so if it is possible? The concrete example from the 53423 bug report is, I need to proxy requests from http://distfiles.macports.org/... to https://distfiles.macports.org/... I also need the opposite on the responses. Thanks in advance, Jeff

1 0

Client certificate using CAPI
by stunnel.org＠pepak.net 29 Jan '17

29 Jan '17

Hi! I am trying to use stunnel to connect to my own server using both a server and a client certificate. I got the tunnel to work, provided that the client uses a PEM certificate stored in a file. However, I would like to use CAPI, because that would allow me to use a smart card, which I finally got Windows to recognize (a nightmare of its own). Unfortunately, it seems that the client-side stunnel won't send a client certificate because the server-side stunnel will always close the connection with: SSL_accept: 140890C7: error:140890C7:SSL routines:ssl3_get_client_certificate:peer did not return a certificate My client-side stunnel log shows that server sent some kind of identification of all the supported client certificates to the client, but that's all - the client stunnel fails to follow through: TLS state (connect): SSLv3 read server key exchange A Client CA: emailAddress=some(a)email.com, O=Some name, CN=Pepak Yubico 4 White Client CA: emailAddress=root(a)email.com, CN=Pepak (root CA) TLS state (connect): SSLv3 read server certificate request A TLS state (connect): SSLv3 read server done A TLS state (connect): SSLv3 write client certificate A TLS state (connect): SSLv3 write client key exchange A TLS state (connect): SSLv3 write change cipher spec A TLS state (connect): SSLv3 write finished A TLS state (connect): SSLv3 flush data SSL_connect: Peer suddenly disconnected As far as I can tell, the CN=Pepak Yubico 4 White matches what my Windows show as the name of the certificate on the smartcard. Following up on https://www.stunnel.org/pipermail/stunnel-users/2016-February/005393.html, I tried to add a "key = Pepak Yubico 4 White" line to the client-side stunnel's config, but it doesn't seem to have any effect. What could be the problem? The client-side config file is: compression = deflate debug = debug fips = no taskbar = no options = NO_SSLv2 engine = capi [echo-client] client = yes accept = 3000 connect = 10.0.0.1:30000 requireCert = yes verifyChain = yes verifyPeer = yes CAfile = desktop.pem engineId = capi key = Pepak Yubico 4 White The only suspicious thing that I see is that my client certificate says that its only purpose is to verify the identity of the remote computer. Could that be the reason the handshake fails? Thanks for any help. Pepak

1 0

SSL errors do not trigger failover?
by Richard Monk 27 Jan '17

27 Jan '17

Hello! We are using stunnel to work around an SSL issue in another service, and set stunnel.conf up to do prio failover. We noticed something unusual. If the TCP session connects, but the SSL negotiation fails, it doesn't fail over to the next server on the list. I looked at the code for the latest version and this doesn't seem to be caught anywhere. What I saw in client.c shows that it only checks failover after trying to establish the TCP session, but then the SSL session happens later and doesn't give any info back to the failover code should something go wrong. Is this expected behavior, or should I look into a bug report / patch? I was thinking maybe a configurable option to allow SSL errors to trigger failover just like TCP errors. -- Richard Monk (rmonk(a)redhat.com) - Senior Principal Security Analyst Red Hat Inc. - Raleigh NC GPG Key ID: 0x942CDB25

1 0

Please Help to configure Stunnel for SHOUTcast
by Frans Rehl 24 Jan '17

24 Jan '17

Hello Stunnel Members I am wondering if any of you can help me to configure stunnel for shoutcast. I have a VPS with Windows Server 2012 R2 and I cannot find the correct configuration for windows server. Can someone help me please? My shoutcast is currently streaming on port 8000 however, I don't understand some part of the configuration, such as; cert -pem and ca-pem Could someone guide me? Best

1 0

Creating tunnel to smtp.office365.com:587
by Andrew Culver 17 Jan '17

17 Jan '17

Hello, This is my first time using stunnel so I'm still learning how it works. This may have already been asked, but I'm not sure what to search for in the archives. We have a number of hosts in private IP space that we'd like to be able to send mail to smtp.office365.com:587. I'm trying to configure stunnel for this purpose. What I'd like is to set up a stunnel instance on a server which will accept TLS connections on port 50025. Stunnel will then connect to smtp.office365.com:587 which also uses TLS. How can I do this? I am able to configure stunnel to accept my connection on 587, but the connection is immediately closed (below). If I add client = yes, then I just get: aculver stunnel # openssl s_client -starttls smtp -connect localhost:50025 CONNECTED(00000003) didn't found starttls in server response, try anyway... Here is my config: aculver stunnel # egrep -v '^;|^$' stunnel.conf ; Sample stunnel configuration file for Unix by Michal Trojnara 2002-2015 setuid = nobody setgid = nogroup pid = /usr/local/var/run/stunnel/stunnel.pid [o365-smtp] accept = 50025 cert = /usr/local/etc/stunnel/stunnel.pem connect = smtp.office365.com:587 verifyChain = yes CApath = /etc/ssl/certs protocol = smtp What am I doing wrong? Here's what I get when I don't have client = yes: aculver stunnel # openssl s_client -starttls smtp -connect localhost:50025 CONNECTED(00000003) depth=0 C = CA, ST = Ontario, L = London, O = The University of Western Ontario, OU = ITS, CN = aculver.ws.its.uwo.ca, emailAddress = aculver(a)uwo.ca verify error:num=18:self signed certificate verify return:1 depth=0 C = CA, ST = Ontario, L = London, O = The University of Western Ontario, OU = ITS, CN = aculver.ws.its.uwo.ca, emailAddress = aculver(a)uwo.ca verify return:1 139954991064736:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1263:SSL alert number 40 139954991064736:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177: --- Certificate chain 0 s:/C=CA/ST=Ontario/L=London/O=The University of Western Ontario/OU=ITS/CN=aculver.ws.its.uwo.ca/emailAddress=aculver(a)uwo.ca i:/C=CA/ST=Ontario/L=London/O=The University of Western Ontario/OU=ITS/CN=aculver.ws.its.uwo.ca/emailAddress=aculver(a)uwo.ca --- Server certificate -----BEGIN CERTIFICATE----- MIIEJzCCAw+gAwIBAgIJAM0DgGLDIh5lMA0GCSqGSIb3DQEBCwUAMIGpMQswCQYD VQQGEwJDQTEQMA4GA1UECAwHT250YXJpbzEPMA0GA1UEBwwGTG9uZG9uMSowKAYD VQQKDCFUaGUgVW5pdmVyc2l0eSBvZiBXZXN0ZXJuIE9udGFyaW8xDDAKBgNVBAsM A0lUUzEeMBwGA1UEAwwVYWN1bHZlci53cy5pdHMudXdvLmNhMR0wGwYJKoZIhvcN AQkBFg5hY3VsdmVyQHV3by5jYTAeFw0xNzAxMTcxODAwNTdaFw0yMDAxMTcxODAw NTdaMIGpMQswCQYDVQQGEwJDQTEQMA4GA1UECAwHT250YXJpbzEPMA0GA1UEBwwG TG9uZG9uMSowKAYDVQQKDCFUaGUgVW5pdmVyc2l0eSBvZiBXZXN0ZXJuIE9udGFy aW8xDDAKBgNVBAsMA0lUUzEeMBwGA1UEAwwVYWN1bHZlci53cy5pdHMudXdvLmNh MR0wGwYJKoZIhvcNAQkBFg5hY3VsdmVyQHV3by5jYTCCASIwDQYJKoZIhvcNAQEB BQADggEPADCCAQoCggEBAL2A3QEU7ReMc+2dTJdxVnQx33dIomQvO6QOAaFkI9pt XF/UhSBCg3ZD2yZeKe5GQ0+KqSCjuxTZE+BMTIeNUtaFEDr9bMAx0toknm29ve1B wTErWoIjE4yqQ+j/D9JLp4BzBcptz1zaEdvhzzZo2zWVpqHrUHSXzoIELD4xyZyF UgbQ057diKr1fqM7q3ozCofslFGEjWtc8SsfwgToT72g7bRhx8a6F6SSX8afcVx0 hvvC998QbTNUCpJO6GPzWWCsITc3RPMZK3OJsbI4NNBKDZ8eE2NTSkcKjnibRWFx bwCTlSZ5XABQrgXmEO51cx6DBAK/8cV8W2H/VNr9SXkCAwEAAaNQME4wHQYDVR0O BBYEFMPXcnQduKdorSNrFIR1up+a5V7RMB8GA1UdIwQYMBaAFMPXcnQduKdorSNr FIR1up+a5V7RMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAKqmaC+g RD1KEWT2yJit0FRIuwzFYmh/jgQ0ofabWQIuQtyNeqVnATU5FMOmox9MgbbsBanC SBVxuiLsWruk6VTjByHaIPAfsdWVKYMfLXO2Rku8GTp1X0B+HcNxh18tKr9s72rB AmapnD1GrYDAlBBgwQz+Ei1iRz+rqKsPvvJ/IEzZ02uhxV0ZWxBi5gTqAQc+pi3y I8DNBTxev2BMw+YCeNnrH3ryrJ8vKYlUmxE0k2POH1ihlpzdx9jtKC9TKR1kahMP 3lbldSHmW9DWeOfzQZ6NDHADSI698HaYfWQXUqbXjNJsxFb47pnjmyWgKseAT9iw w9nPDtkCmUihuBM= -----END CERTIFICATE----- subject=/C=CA/ST=Ontario/L=London/O=The University of Western Ontario/OU=ITS/CN=aculver.ws.its.uwo.ca/emailAddress=aculver(a)uwo.ca issuer=/C=CA/ST=Ontario/L=London/O=The University of Western Ontario/OU=ITS/CN=aculver.ws.its.uwo.ca/emailAddress=aculver(a)uwo.ca --- No client certificate CA names sent --- SSL handshake has read 1741 bytes and written 138 bytes --- New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384 Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES256-GCM-SHA384 Session-ID: Session-ID-ctx: Master-Key: 9B6FC3BBEEADF6673416272CA03FA44A2B10BADB3B843317403C03904F0E45E922EA2581F313BF5282C0A47498E43C8D Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1484680413 Timeout : 300 (sec) Verify return code: 18 (self signed certificate) --- aculver stunnel # Thanks, Andrew

1 0

Forwarding ip without HAProxy protocol
by John BYaka 06 Jan '17

06 Jan '17

Is it possible to forward real ip in special header? I know about 'protocol=proxy' but for using this i need to implement HAProxy protocol in app.

1 0

Stunnel and tokens on Windows
by stunnel.org＠pepak.net 31 Dec '16

31 Dec '16

Hi! I would very much like to switch my Stunnel setup to use hardware tokens. Stunnel apparently supports that using a PKCS11 engine, but I am having hard luck trying to figure it out for Windows, because 1) my practical experience with tokens is nonexistent at the moment, and 2) there are very few pages with a relevant information (basically, I was only able to find the very ancient http://martlaak.wikia.com/wiki/Stunnel_and_engine_pkcs11 and two russian pages http://forum.rutoken.ru/topic/1639/ and https://habrahabr.ru/post/135369/ which probably do just what I need, but I am not so sure they are applicable to my needs as I do not have a rutoken). I guess I would be satified if someone told me, "yes, these pages are applicable, just buy a xxxtoken instead of rutoken"; I would be happier with a full guide, but I can't expect anyone to write it - with the possible exception of Michal Trojnara's paid support (would that be possible?). Thanks, pepak

1 0

Re: [stunnel-users] Public domain [PATCH] support environment variables in config file
by Dmitry Bakshaev 21 Dec '16

21 Dec '16

2016-05-31 12:02 GMT+04:00 Pierre Delaage <delaage.pierre(a)free.fr>: > Did not have a look at the code yet, but should it be possible to replace > envvars usage by some keys in the registry on windows platform and/or > %userprofile%/config-file ? > > Anyway, my opinion on the patch is that there is no real interest for > "generic/self-expanding" config file , and it is even dangerous : > I would not trust stunnel if, at run time, its config could be modified by > USER envvars... > which difference between %userprofile%/config-file and USER envvars? both are USER owned and USER controlled. certificate and keys also USER private data. and stunnel started by USER owned by USER. if stunnel started by SYSTEM/ADMIN he uses SYSTEM/ADMIN envvars (if needed), certs, keys, etc. global "generic/self-expanding" config file is ADMIN owned. USER has permissions to substitute some values, restricted by ADMIN.

2 10

problem running stunnel as windows service
by Jeff Saxton 09 Dec '16

09 Dec '16

stunnel 5.38 on x86-pc-msvc-1500 platform compiled/running with OpenSSL 1.0.2j-fips 26 Sep 2016 Windows Server 2012R2 Standard When I try and start the service I get: Windows could not start the Secure Socket Tunneling Protocol Service on the Local Computer. Error: 1079: The account specified for this service is different from the account specified for other services running in the same process. So after a little reading I went into Services->Logon and checked: Allow Service to interact with desktop Same Error So I created an account in the Local Administrators group and gave it logon as a service Same thing Any ideas? -- Jeff Saxton Tanium CELL: +US 650.235.0776

1 0

Using transparent destination option with multiple network interfaces.
by Rodney Lott 08 Dec '16

08 Dec '16

Hi, there. Base server details: - Using the latest stunnel 5.37 - Ubuntu Trusty - The computers communicating with each other use bridged interface addresses that are configured by the clustering software (i.e. to ensure that at least one of the nodes is master and host to some common addresses) - For discussion purposes, let's say that each server has an eth0 and eth1, and that the master node has two additional bridged address (ie. eth0:shared-ip1, eth1:shared-ip2) - The slave nodes will try to connect to eth0:shared-ip1:20001 and eth1:shared-ip2:20001 that are hosted on the master - The master node will also try to connect to these as well, while listening on port 20001 - Not running in a chroot and am running stunnel as stunnel4 user - I have created a working solution using 4 services in the stunnel config and using hard-coded destinations in the iptables rules and the stunnel config. I want to create something more dynamic and versatile. I am trying to insert a stunnel instance between my server application that attempts to connect to its twin on another server, using the bridging addresses. I am trying to avoid hard-coding destination IP addresses in my stunnel configuration file and the iptables rules. I also don't want to have separate rules for each interface. For example, from server A's perspective (i.e. the master node), the desirable sequence of events are: - Attempt to connect to port 20001 using the bridge addresses as destinations (in this case, they would be local interfaces). - Intercept the requests to port 20001 on server A and divert them to port 40000 for encryption (i.e. the local stunnel instance). - Send unencrypted data from stunnel directly to local 20001. At the same time, server B is doing the same, except that the bridge addresses reside on server A and are not local. So, server A would also need to do this: - Intercept external request for port 20001 and send it to stunnel port 40000 for encryption - Send decrypted packets to local port 20001 This same type of sequence would also be happening My stunnel configuration looks like this: fips=yes pid=/var/run/stunnel4/testsrv.pid debug=7 output=/var/log/stunnel4/testsrv.log sslVersion = TLSv1.2 key = <private-key-location> cert = <cert-location> CAfile = <ca-file-location> ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA256:ECDH-RSA-AES256-GCM-SHA384:ECDH-ECDSA-AES256-GCM-SHA384:ECDH-RSA-AES256-SHA384:ECDH-ECDSA-AES256-SHA384:AES256-GCM-SHA384:AES256-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:DHE-DSS-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-DSS-AES128-SHA256:ECDH-RSA-AES128-GCM-SHA256:ECDH-ECDSA-AES128-GCM-SHA256:ECDH-RSA-AES128-SHA256:ECDH-ECDSA-AES128-SHA256:AES128-GCM-SHA256:AES128-SHA256 [test-srv] client=yes accept=40000 transparent=destination My iptables rules, base on what I read in the man page, are this: STUNNEL_UID=$(id -u stunnel4) # Redirect any incoming requests to port 20001 iptables -t nat -A PREROUTING -p tcp --dport 20001 ! -i lo -j DNAT --to-destination 127.0.0.1:40000 iptables -A INPUT -p tcp --dport 40000 -j ACCEPT # Redirect any outgoing locally generated requests for 20001 to stunnel port 40000 iptables -t nat -A OUTPUT -p tcp --dport 20001 -m owner ! --uid-owner $STUNNEL_UID -j DNAT --to-destination 127.0.0.1:40000 # Redirect the output of stunnel to the local 20001 port iptables -t nat -A OUTPUT -p tcp --dport 20001 -m owner --uid-owner $STUNNEL_UID -j REDIRECT --to-ports 20001 iptables -t nat -A INPUT -p tcp -d 127.0.0.1 --dport 20001 -j ACCEPT These rules are not completely adequate. For now, I'm just trying to get server A's connection to port 20001 working without having to worry about incoming from server B. When I do this and start stunnel and my process, server A's stuff appears to loop endlessly. I think this is happening because the packets that come out of stunnel, due to the transparency configuration, look exactly the same as the original. If I log stuff using iptables, I see repeat entries like this: nat-OUTPUT: IN= OUT=lo SRC=150.150.242.26 DST=150.150.242.27 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=30541 DF PROTO=TCP SPT=50101 DPT=20001 WINDOW=43690 RES=0x00 SYN URGP=0 filter-OUTPUT: IN= OUT=lo SRC=150.150.242.26 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=30541 DF PROTO=TCP SPT=50101 DPT=40000 WINDOW=43690 RES=0x00 SYN URGP=0 nat-POSTROUTING: IN= OUT=lo SRC=150.150.242.26 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=30541 DF PROTO=TCP SPT=50101 DPT=40000 WINDOW=43690 RES=0x00 SYN URGP=0 filter-INPUT: IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=150.150.242.26 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=30541 DF PROTO=TCP SPT=50101 DPT=40000 WINDOW=43690 RES=0x00 SYN URGP=0 filter-OUTPUT: IN= OUT=lo SRC=150.150.242.26 DST=127.0.0.1 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=30542 DF PROTO=TCP SPT=50101 DPT=40000 WINDOW=342 RES=0x00 ACK URGP=0 filter-INPUT: IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=150.150.242.26 DST=127.0.0.1 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=30542 DF PROTO=TCP SPT=50101 DPT=40000 WINDOW=342 RES=0x00 ACK URGP=0 nat-OUTPUT: IN= OUT=lo SRC=150.150.242.26 DST=150.150.242.27 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=48827 DF PROTO=TCP SPT=50102 DPT=20001 WINDOW=43690 RES=0x00 SYN URGP=0 filter-OUTPUT: IN= OUT=lo SRC=150.150.242.26 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=48827 DF PROTO=TCP SPT=50102 DPT=40000 WINDOW=43690 RES=0x00 SYN URGP=0 nat-POSTROUTING: IN= OUT=lo SRC=150.150.242.26 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=48827 DF PROTO=TCP SPT=50102 DPT=40000 WINDOW=43690 RES=0x00 SYN URGP=0 filter-INPUT: IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=150.150.242.26 DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=48827 DF PROTO=TCP SPT=50102 DPT=40000 WINDOW=43690 RES=0x00 SYN URGP=0 filter-OUTPUT: IN= OUT=lo SRC=150.150.242.26 DST=127.0.0.1 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=48828 DF PROTO=TCP SPT=50102 DPT=40000 WINDOW=342 RES=0x00 ACK URGP=0 filter-INPUT: IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=150.150.242.26 DST=127.0.0.1 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=48828 DF PROTO=TCP SPT=50102 DPT=40000 WINDOW=342 RES=0x00 ACK URGP=0 filter-OUTPUT: IN= OUT=lo SRC=150.150.242.26 DST=127.0.0.1 LEN=269 TOS=0x00 PREC=0x00 TTL=64 ID=48829 DF PROTO=TCP SPT=50102 DPT=40000 WINDOW=342 RES=0x00 ACK PSH URGP=0 filter-INPUT: IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=150.150.242.26 DST=127.0.0.1 LEN=269 TOS=0x00 PREC=0x00 TTL=64 ID=48829 DF PROTO=TCP SPT=50102 DPT=40000 WINDOW=342 RES=0x00 ACK PSH URGP=0 ... As can be seen, line 1 and line 7 are virtually identical. In the stunnel log, I can see that stunnel is receiving multiple requests for port 20001 in rapid succession but is not actually receiving any reply from the final destination. So, if anyone has any ideas, tweaks or suggestions for how to solve this problem or where I am going wrong, I would appreciate it. I can use a static configuration with hard-coded destination IP's but if there is an alternative, I would like to know. I have tried for several days to figure this out and have searched Google extensively, including stunnel-users postings, to figure out how to do this without success. Thanks, Rodney Lott

1 1

setgroups: notowner (1)
by Jones, Russell - NONEMP 08 Dec '16

08 Dec '16

I am working on a project where we are migrating to a new datacenter. The new datacenter will not allow compilers on their servers, so I am unable to do a new stunnel build on the new server. I am attempting to move the stunnel install/executables from the old server to the new one. I got past several errors for libraries not found, but now I am stuck. stunnel process will not start, and gets several messages "setgoups: Not owner (1)" I am not sure what I need to do with permissions, ownership, etc to make this work. log attached Thanks for your help, Russell J. This electronic message transmission contains information from CSRA that may be attorney-client privileged, proprietary or confidential. The information in this message is intended only for use by the individual(s) to whom it is addressed. If you believe you have received this message in error, please contact me immediately and be aware that any use, disclosure, copying or distribution of the contents of this message is strictly prohibited. NOTE: Regardless of content, this email shall not operate to bind CSRA to any order or other contract unless pursuant to explicit written agreement or government initiative expressly permitting the use of email for such purpose.

1 0

Stunnel in inetd mode and PID in logs
by Bruce Guenter 02 Dec '16

02 Dec '16

Hi. I am running stunnel in inetd mode (under tcpserver). Prior to version 5.12 (as far as I can tell), the logs output by stunnel would include the tag LOG#[PID]. As of version 5.12, the logs now say LOG#[main] (and later LOG#[ui]). Is there any way to get the PID back in the logs? I have tried all different choices for the logId configuration option, and it doesn't seem to make a difference there. Thanks. -- Bruce Guenter <bruce(a)untroubled.org> http://untroubled.org/

1 0

Re: [stunnel-users] stunnel 5.38 released
by Javier 26 Nov '16

26 Nov '16

Hi there. Dumb error I just found. Dumb because I just found it and maybe it was earlier among us. Or maybe it is "a feature". But I'd swear it worked as expected in the past. Testing the new SNI option I made a mistake and I had to edit and reload the configuration file. Nothing strange until here. The problem is comming because I load a custom .conf file as "stunnel.exe file.conf" for the server mode, so when a parsing error is found, Stunnel lose the track of the custom .conf file and when you reload the corrected configuration through the "Reload configuration" menu option, it doesn't load the custom .conf but the default stunnel.conf. But before reloading, the "Edit configuration" menu option points correctly to the correct configuration file and opens it to edit. Only "Reload configuration" lose the track of the file. This is happening in the windows environment (just if it wasn't clear enough by the .exe extension ;) ). Windows 2000 (yet). I can't tested versions beyond. Regards.

1 0

Re: [stunnel-users] Help in setting stunnel in server mode to over come TLSV2 compatibility
by Jose Alf. 25 Nov '16

25 Nov '16

Jothish, 1. You are using a very outdated version of OpenSSL (openssl 0.9.8 is EOL). I suggest you use a newer, supported version. 2. On a DOS Window, try this:openssl dhparam -rand randfile1;randfile2;randfile3 1024 where randfile1,randfile2.... are existing files or directories to use as entrophy sources. If you're on Linux you can use dd if=/dev/urandom count=2 | openssl dhparam -rand - 1024 This will print something like this:WARNING: can't open config file: c:\openssl-vc/ssl/openssl.cnf Loading 'screen' into random state - done 0 semi-random bytes loaded Generating DH parameters, 1024 bit long safe prime, generator 2 This is going to take a long time ..+.. bla, bla....++* unable to write 'random state' -----BEGIN DH PARAMETERS----- MIGHAoGBAJJ+QAYkKQd0pG1lxZKDYVZaURkTINQho8CWCUYOMp2ZEwZeMrEv+kjd PVb4Ilnah1TmZQOxu1v8HtSWmKpclhlTDKjmDbhznUFkQhmRGjxXDCfrhnvNI4hV kOB/3lGcWo50ttf+ZqNaXd0lKf9YfnjkRUSUtrHiMRL9CdecxQXbAgEC -----END DH PARAMETERS----- Now, cut from ---BEGIN... all the way to PARAMETERS--- and add it to your cert PEM file. 3. Try again, your check command: openssl dhparam -inform PEM -in ./training_client.pem -check -textShould print something like: DH Parameters: (1024 bit) prime: 00:92:7e:40:06:24:29:07:74:a4:6d:65:c5:92:83: ... 31:12:fd:09:d7:9c:c5:05:db generator: 2 (0x2) DH parameters appear to be ok. -----BEGIN DH PARAMETERS----- MIGHAoGBAJJ+QAYkKQd0pG1lxZKDYVZaURkTINQho8CWCUYOMp2ZEwZeMrEv+kjd ....-----END DH PARAMETERS----- 4. Now, try connecting from SFDC to tibco and let us know. SaludosJose From: "jothish.chokkalingam(a)accenture.com" <jothish.chokkalingam(a)accenture.com> To: josealf(a)rocketmail.com Cc: cbrowne(a)cbcs-usa.com; stunnel-users(a)stunnel.org Sent: Thursday, November 24, 2016 6:45 AM Subject: RE: [stunnel-users] Help in setting stunnel in server mode to over come TLSV2 compatibility #yiv9373448809 #yiv9373448809 -- _filtered #yiv9373448809 {font-family:Wingdings;panose-1:5 0 0 0 0 0 0 0 0 0;} _filtered #yiv9373448809 {panose-1:2 4 5 3 5 4 6 3 2 4;} _filtered #yiv9373448809 {font-family:Calibri;panose-1:2 15 5 2 2 2 4 3 2 4;} _filtered #yiv9373448809 {font-family:Consolas;panose-1:2 11 6 9 2 2 4 3 2 4;}#yiv9373448809 #yiv9373448809 p.yiv9373448809MsoNormal, #yiv9373448809 li.yiv9373448809MsoNormal, #yiv9373448809 div.yiv9373448809MsoNormal {margin:0in;margin-bottom:.0001pt;font-size:11.0pt;color:black;}#yiv9373448809 a:link, #yiv9373448809 span.yiv9373448809MsoHyperlink {color:#0563C1;text-decoration:underline;}#yiv9373448809 a:visited, #yiv9373448809 span.yiv9373448809MsoHyperlinkFollowed {color:#954F72;text-decoration:underline;}#yiv9373448809 p {margin-right:0in;margin-left:0in;font-size:11.0pt;color:black;}#yiv9373448809 pre {margin:0in;margin-bottom:.0001pt;font-size:10.0pt;color:black;}#yiv9373448809 p.yiv9373448809MsoListParagraph, #yiv9373448809 li.yiv9373448809MsoListParagraph, #yiv9373448809 div.yiv9373448809MsoListParagraph {margin-top:0in;margin-right:0in;margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt;font-size:11.0pt;color:black;}#yiv9373448809 span.yiv9373448809HTMLPreformattedChar {font-family:Consolas;color:black;}#yiv9373448809 span.yiv9373448809EmailStyle20 {color:windowtext;}#yiv9373448809 span.yiv9373448809EmailStyle21 {color:#1F497D;}#yiv9373448809 span.yiv9373448809EmailStyle22 {color:#1F497D;}#yiv9373448809 span.yiv9373448809EmailStyle23 {color:#1F497D;}#yiv9373448809 .yiv9373448809MsoChpDefault {font-size:10.0pt;} _filtered #yiv9373448809 {margin:1.0in 1.0in 1.0in 1.0in;}#yiv9373448809 div.yiv9373448809WordSection1 {}#yiv9373448809 _filtered #yiv9373448809 {} _filtered #yiv9373448809 {} _filtered #yiv9373448809 {} _filtered #yiv9373448809 {} _filtered #yiv9373448809 {} _filtered #yiv9373448809 {} _filtered #yiv9373448809 {} _filtered #yiv9373448809 {} _filtered #yiv9373448809 {} _filtered #yiv9373448809 {}#yiv9373448809 ol {margin-bottom:0in;}#yiv9373448809 ul {margin-bottom:0in;}#yiv9373448809 Jose, For the issue as mentioned in below down mail I am following below two approaches, 1. Move the TLSv1.2 enabled traffic to an intermediate port and then to target port which has TLS1 enabled, in that ssl handshake from intermediate to target port getting below error. While triaging with openssl command, it is observed that the DH parameters are not proper. So we are trying to add the dh parameters C:\Users\robin.johnson\Documents\SSL\SSL>C:\openssl-0.9.8k_X64\bin\openssl dhparam -inform PEM -in ./training_client.pem -check -text unable to load DH parameters 1800:error:0906D06C:PEM routines:PEM_read_bio:no start line:.\crypto\pem\pem_lib.c:650:Expecting: DH PARAMETERS stunnel.logà2016.11.23 23:08:32 LOG3[131]: SSL_connect: 14082174: error:14082174:SSL routines:ssl3_check_cert_and_algorithm:dh key too small 2. Using https service in stunnel traffic is received by TLS V1.1 divert to non ssl enabled port. Thanks and Regards, Jothish TIBCO TSD Ph. : +91 44 39263958 Mobile : +91 9884040171 Support : +91 9962007110 OC : jothish.chokkalingam Group mail:- Telstra.psm.tsd.tibco(a)accenture.com From: Josealf.rm [mailto:[email protected]] Sent: Thursday, November 24, 2016 4:36 PM To: Chokkalingam, Jothish <jothish.chokkalingam(a)accenture.com> Cc: cbrowne(a)cbcs-usa.com; stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Help in setting stunnel in server mode to over come TLSV2 compatibility Can you please elaborate? If you want us to help, you need to provide enough information. Regards Jose El 24/11/2016, a las 5:03 a.m., <jothish.chokkalingam(a)accenture.com> <jothish.chokkalingam(a)accenture.com> escribió: Jose, J you are right.i was trying but I thought it will work as a client and it worked as a workaround. But will check for the dh key small error while forwarding the traffic with SSL from intermediate port to another port. Thanks and Regards, Jothish TIBCO TSD Ph. : +91 44 39263958 Mobile : +91 9884040171 Support : +91 9962007110 OC : jothish.chokkalingam Group mail:- Telstra.psm.tsd.tibco(a)accenture.com From: Josealf.rm [mailto:[email protected]] Sent: Thursday, November 24, 2016 2:48 PM To: Chokkalingam, Jothish <jothish.chokkalingam(a)accenture.com> Cc: cbrowne(a)cbcs-usa.com; stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Help in setting stunnel in server mode to over come TLSV2 compatibility Jothish, Stunnel in server mode is what you need, with 99.9% confidence. When you write: [https] Accept=443 Connect=local host:80 Client=no Stunnnel will expect TLS connections on port 443 and will forward then to your normal web server running on loopback port 80. Is that clear? Regards, Jose El 24/11/2016, a las 2:29 a.m., <jothish.chokkalingam(a)accenture.com> <jothish.chokkalingam(a)accenture.com> escribió: Is there a way to forward a Secure connection from one port to non secure port using stunnel. I am googling but unable to find. If you have can you let me know Thanks and Regards, Jothish TIBCO TSD Ph. : +91 44 39263958 Mobile : +91 9884040171 Support : +91 9962007110 OC : jothish.chokkalingam Group mail:- Telstra.psm.tsd.tibco(a)accenture.com From: stunnel-users [mailto:[email protected]]On Behalf Of Carter Browne Sent: Wednesday, November 23, 2016 9:30 PM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Help in setting stunnel in server mode to over come TLSV2 compatibility There are other tools for performing port forwarding with less overhead (I believe tappipe is one), although I make use stunnel to do this extensively. In order forward a secure connection from one port to another is a two step process with stunnel: A sample configuration segment would be: [SFDC reverse in] client = no accept = 8008 connect = localhost:48008 [SFDC reverse out] client = yes accept = localhost:48008 connect = localhost:8009 On 11/23/2016 10:18 AM, Rodney Lott wrote: Hi, there. I'm no stunnel expert, but here's my $0.05 (we have no pennies in Canada anymore ;-) ): - I would try including the key as well as the cert in your stunnel config - I would enable debug on the openssl s_client call to see if it will indicate why it is reseting. Same with your SFDC client to get more info. - Question: is the "WARNING: can't open config file" message below indicative of a permissions or path problem? - Question: Is the stunnel cert and key compatible with the TIBCO server's certificate? They need to be using certs generated from the same key source, don't they? - You might want to fix the SSL version in the stunnel config file (i.e. sslVersion = TLSv1.2) Good luck with your debugging. Rodney On 2016-11-22 07:43 PM, jothish.chokkalingam(a)accenture.com wrote: HI all, There is a problem we have currently connecting tibco client to SFDC sever via TLS v1.2 and that’s solved by using stunnel in client mode. And the communication from SFDC client to tibco server applications w.r.t TLS V1.2 I am unable to solve using stunnel. Below is the configuration in stunnel in server end to divert the traffic from 8008 to 8009, can you help here with the logs is the stunnel configuration is correct or there any missed/need to alter. [SFDC reverse proxy test] debug=7 ;client = yes accept = 8008àport used by sfdc client to connect to TIBCO server connect = localhost:8009 àTibco server that’s running cert = stunnel.pem 2016.11.23 08:31:56 LOG7[118]: Service [SFDC reverse proxy test] started 2016.11.23 08:31:56 LOG7[118]: Option TCP_NODELAY set on local socket 2016.11.23 08:31:56 LOG5[118]: Service [SFDC reverse proxy test] accepted connection from 101.167.198.14:54477 2016.11.23 08:31:56 LOG6[118]: Peer certificate not required 2016.11.23 08:31:56 LOG7[118]: SSL state (accept): before/accept initialization 2016.11.23 08:31:56 LOG3[118]: SSL_accept: Peer suddenly disconnected 2016.11.23 08:31:56 LOG5[118]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.11.23 08:31:56 LOG7[118]: Local descriptor (FD=696) closed 2016.11.23 08:31:56 LOG7[118]: Service [SFDC reverse proxy test] finished (0 left) PFB the openssl snap shot looks odd C:\Program Files (x86)\stunnel\bin>openssl s_client -connect localhost:8008 -prexit -showcerts WARNING: can't open config file: /devel/win32/openssl/openssl.cnf CONNECTED(0000016C) Thanks and Regards, Jothish TIBCO TSD Ph. : +91 44 39263958 Mobile : +91 9884040171 Support : +91 9962007110 OC : jothish.chokkalingam Group mail:- Telstra.psm.tsd.tibco(a)accenture.com This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. ______________________________________________________________________________________ www.accenture.com _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Re: [stunnel-users] Help in setting stunnel in server mode to over come TLSV2 compatibility
by Josealf.rm 24 Nov '16

24 Nov '16

Can you please elaborate? If you want us to help, you need to provide enough information. Regards Jose > El 24/11/2016, a las 5:03 a.m., <jothish.chokkalingam(a)accenture.com> <jothish.chokkalingam(a)accenture.com> escribió: > > Jose, > J you are right.i was trying but I thought it will work as a client and it worked as a workaround. But will check for the dh key small error while forwarding the traffic with SSL from intermediate port to another port. > > Thanks and Regards, > Jothish > TIBCO TSD > Ph. : +91 44 39263958 > Mobile : +91 9884040171 > Support : +91 9962007110 > OC : jothish.chokkalingam > Group mail:- Telstra.psm.tsd.tibco(a)accenture.com > > From: Josealf.rm [mailto:[email protected]] > Sent: Thursday, November 24, 2016 2:48 PM > To: Chokkalingam, Jothish <jothish.chokkalingam(a)accenture.com> > Cc: cbrowne(a)cbcs-usa.com; stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] Help in setting stunnel in server mode to over come TLSV2 compatibility > > Jothish, > > Stunnel in server mode is what you need, with 99.9% confidence. > > When you write: > > [https] > Accept=443 > Connect=local host:80 > Client=no > > Stunnnel will expect TLS connections on port 443 and will forward then to your normal web server running on loopback port 80. > > Is that clear? > > Regards, > Jose > > El 24/11/2016, a las 2:29 a.m., <jothish.chokkalingam(a)accenture.com> <jothish.chokkalingam(a)accenture.com> escribió: > > > Is there a way to forward a Secure connection from one port to non secure port using stunnel. I am googling but unable to find. If you have can you let me know > > Thanks and Regards, > Jothish > TIBCO TSD > Ph. : +91 44 39263958 > Mobile : +91 9884040171 > Support : +91 9962007110 > OC : jothish.chokkalingam > Group mail:- Telstra.psm.tsd.tibco(a)accenture.com > > From: stunnel-users [mailto:[email protected]] On Behalf Of Carter Browne > Sent: Wednesday, November 23, 2016 9:30 PM > To: stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] Help in setting stunnel in server mode to over come TLSV2 compatibility > > There are other tools for performing port forwarding with less overhead (I believe tappipe is one), although I make use stunnel to do this extensively. > > In order forward a secure connection from one port to another is a two step process with stunnel: > > A sample configuration segment would be: > > [SFDC reverse in] > > client = no > > accept = 8008 > > connect = localhost:48008 > > > [SFDC reverse out] > client = yes > accept = localhost:48008 > connect = localhost:8009 > > On 11/23/2016 10:18 AM, Rodney Lott wrote: > Hi, there. > > I'm no stunnel expert, but here's my $0.05 (we have no pennies in Canada anymore ;-) ): > - I would try including the key as well as the cert in your stunnel config > - I would enable debug on the openssl s_client call to see if it will indicate why it is reseting. Same with your SFDC client to get more info. > - Question: is the "WARNING: can't open config file" message below indicative of a permissions or path problem? > - Question: Is the stunnel cert and key compatible with the TIBCO server's certificate? They need to be using certs generated from the same key source, don't they? > - You might want to fix the SSL version in the stunnel config file (i.e. sslVersion = TLSv1.2) > > Good luck with your debugging. > > Rodney > > On 2016-11-22 07:43 PM, jothish.chokkalingam(a)accenture.com wrote: > HI all, > > There is a problem we have currently connecting tibco client to SFDC sever via TLS v1.2 and that’s solved by using stunnel in client mode. And the communication from SFDC client to tibco server applications w.r.t TLS V1.2 I am unable to solve using stunnel. Below is the configuration in stunnel in server end to divert the traffic from 8008 to 8009, can you help here with the logs is the stunnel configuration is correct or there any missed/need to alter. > > [SFDC reverse proxy test] > debug=7 > ;client = yes > accept = 8008àport used by sfdc client to connect to TIBCO server > connect = localhost:8009 àTibco server that’s running > cert = stunnel.pem > 2016.11.23 08:31:56 LOG7[118]: Service [SFDC reverse proxy test] started > 2016.11.23 08:31:56 LOG7[118]: Option TCP_NODELAY set on local socket > 2016.11.23 08:31:56 LOG5[118]: Service [SFDC reverse proxy test] accepted connection from 101.167.198.14:54477 > 2016.11.23 08:31:56 LOG6[118]: Peer certificate not required > 2016.11.23 08:31:56 LOG7[118]: SSL state (accept): before/accept initialization > 2016.11.23 08:31:56 LOG3[118]: SSL_accept: Peer suddenly disconnected > 2016.11.23 08:31:56 LOG5[118]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket > 2016.11.23 08:31:56 LOG7[118]: Local descriptor (FD=696) closed > 2016.11.23 08:31:56 LOG7[118]: Service [SFDC reverse proxy test] finished (0 left) > > PFB the openssl snap shot looks odd > C:\Program Files (x86)\stunnel\bin>openssl s_client -connect localhost:8008 -prexit -showcerts > WARNING: can't open config file: /devel/win32/openssl/openssl.cnf > CONNECTED(0000016C) > > Thanks and Regards, > Jothish > TIBCO TSD > Ph. : +91 44 39263958 > Mobile : +91 9884040171 > Support : +91 9962007110 > OC : jothish.chokkalingam > Group mail:- Telstra.psm.tsd.tibco(a)accenture.com > > > > This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. > ______________________________________________________________________________________ > > www.accenture.com > > > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > > > > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Help in setting stunnel in server mode to over come TLSV2 compatibility
by jothish.chokkalingam＠accenture.com 24 Nov '16

24 Nov '16

HI all, There is a problem we have currently connecting tibco client to SFDC sever via TLS v1.2 and that's solved by using stunnel in client mode. And the communication from SFDC client to tibco server applications w.r.t TLS V1.2 I am unable to solve using stunnel. Below is the configuration in stunnel in server end to divert the traffic from 8008 to 8009, can you help here with the logs is the stunnel configuration is correct or there any missed/need to alter. [SFDC reverse proxy test] debug=7 ;client = yes accept = 8008-->port used by sfdc client to connect to TIBCO server connect = localhost:8009 -->Tibco server that's running cert = stunnel.pem 2016.11.23 08:31:56 LOG7[118]: Service [SFDC reverse proxy test] started 2016.11.23 08:31:56 LOG7[118]: Option TCP_NODELAY set on local socket 2016.11.23 08:31:56 LOG5[118]: Service [SFDC reverse proxy test] accepted connection from 101.167.198.14:54477 2016.11.23 08:31:56 LOG6[118]: Peer certificate not required 2016.11.23 08:31:56 LOG7[118]: SSL state (accept): before/accept initialization 2016.11.23 08:31:56 LOG3[118]: SSL_accept: Peer suddenly disconnected 2016.11.23 08:31:56 LOG5[118]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.11.23 08:31:56 LOG7[118]: Local descriptor (FD=696) closed 2016.11.23 08:31:56 LOG7[118]: Service [SFDC reverse proxy test] finished (0 left) PFB the openssl snap shot looks odd C:\Program Files (x86)\stunnel\bin>openssl s_client -connect localhost:8008 -prexit -showcerts WARNING: can't open config file: /devel/win32/openssl/openssl.cnf CONNECTED(0000016C) Thanks and Regards, Jothish TIBCO TSD Ph. : +91 44 39263958 Mobile : +91 9884040171 Support : +91 9962007110 OC : jothish.chokkalingam Group mail:- Telstra.psm.tsd.tibco(a)accenture.com ________________________________ This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. ______________________________________________________________________________________ www.accenture.com

4 4

uninstall.exe
by Michael Curran 22 Nov '16

22 Nov '16

With the distrubuted version of stunnel, there is an uninstall.exe Are there any options for this uninstaller, so I can automate removal and upgrade processes ? Like a /quiet or /Q ?? Which uninstaller application is this based off of?

1 0

Connection failure on IPv4-only box with IPv6-address in RR DNS record
by Michael Weiser 18 Nov '16

18 Nov '16

Hi, the server I connect to using stunnel has just been upgraded to IPv6. In the process an AAAA record was added to its DNS entry. The box I run stunnel on is IPv4-only, meaning, the kernel does not have any IPv6 support at all. The DNS stub resolver is still looking for AAAA records though. Consequently stunnel connections now fail about half of the time with error: 2016.11.18 20:10:57 LOG3[ui]: remote socket: Address family not supported by protocol (97) >From looking at client.c I can see that stunnel supports trying all target addresses in turn but will bail if the socket cannot be created: for(ind_try=0; ind_try<c->connect_addr.num; ind_try++) { c->fd=s_socket(c->connect_addr.addr[ind_cur].sa.sa_family, SOCK_STREAM, 0, 1, "remote socket"); if(c->fd==INVALID_SOCKET) longjmp(c->err, 1); [...] if(s_connect(c, &c->connect_addr.addr[ind_cur], [...] continue; /* next IP */ } [...] return fd; /* success! */ So I guess the problem would go away if I enabled IPv6 in the kernel of my client box: s_socket() would succeed but connect() would fail with ENETUNREACH. But couldn't stunnel just continue with the next IP if s_socket() failed with EAFNOSUPPORT? -- Thanks, Michael

1 0

Deactivate expiry date check, Have CA check with verify = 3
by Mark Shine 18 Nov '16

18 Nov '16

Hello, I would like to setup stunnel but the certificate from my other tunnel is expired. How would I tell stunnel to ignore verification of expiry date of the certificate coming from stunnel client mode to the stunnel server mode? I want to be able to verify the certificate but ignore the expiry date. Not disable cert check all the way I have a stunnel setup by someone else that has done this exact thing but I have no clue how they did it. Stunnel seems to use openssl for the verification so I guess the question should be how to bypass openssl expiry check. Please see the below link for my issue on stackexchange. http://unix.stackexchange.com/questions/323997/stunnel-how-to-ignore-the-ce… [http://cdn.sstatic.net/Sites/unix/img/[email protected]?v=32fb07f7ce26…]<http://unix.stackexchange.com/questions/323997/stunnel-how-to-ignore-the-ce…> Stunnel: How to ignore the cert expiry date<http://unix.stackexchange.com/questions/323997/stunnel-how-to-ignore-the-ce…> unix.stackexchange.com I would like to setup stunnel but the certificate from my other tunnel is expired. How would I tell stunnel to ignore verification of expiry date of the certificate coming from stunnel client mode ...

1 0

Windows builds
by Michael Curran 16 Nov '16

16 Nov '16

Hello -- Are there some solid instructions for building stunnel on windows? I am using Microsoft VS 2015 and the 64-bit compilers -- This is the basic error I am running into, but could be that stunnel wont work with 64-bit? C:\stunnel_build\stunnel-5.36.tar\stunnel-5.36\src>.\makew32.bat W32 ENVIRONMENT OK Microsoft (R) Program Maintenance Utility Version 14.00.24210.0 Copyright (C) Microsoft Corporation. All rights reserved. Detected target: win64 cl /MD /W3 /O2 /nologo /I"\devel\win64\openssl\include" /DUNICODE /D_UNICODE -Fo..\obj\win64\stunnel.obj -c ..\src\stunnel.c stunnel.c c:\stunnel_build\stunnel-5.36.tar\stunnel-5.36\src\common.h(414): fatal error C1083: Cannot open include file: 'openssl/opensslconf.h': No such file or directory NMAKE : fatal error U1077: '"C:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\BIN\amd64\cl.EXE"' : return code '0x2' Stop.

2 2

Stunnel-5.x on windows 10
by Michael Curran 15 Nov '16

15 Nov '16

I have a method with VS to compile Stunnel as 64-bit for use with Windows Are there any decent instructions for compiling it as 64-bit? Michael Curran | Systems Architect Office: 614-568-2285 Mobile: 614-403-6320 ConnectSolutions | 126 Post St. Ste. 400 | San Francisco, CA 94108

1 0

Assistance needed debugging Stunnel AWS EC2 Interface
by Donald F. Coffin 15 Nov '16

15 Nov '16

I am using stunnel as a proxy to support SoapUI mock services which are used to test an SSL based application. The SoapUI and stunnel proxy are running on an AWS Ubuntu 14.04 EC2 Instance communicating to a Tomcat server running on a second AWS Ubuntu 14.04 EC2 Instance. The target application uses a wildcard SSL Certificate and works successfully when accessed using a desktop browser (Chrome or Firefox). The issue I am encountering is that the stunnel connection logs a "SSL closed on SSL_read" message as soon as the cipher suite is negotiated as shown in the following stunnel.log: 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Clients allowed=2000 2016.11.14 21:34:19 LOG5[5287:140430154716992]: stunnel 4.53 on x86_64-pc-linux-gnu platform 2016.11.14 21:34:19 LOG5[5287:140430154716992]: Compiled with OpenSSL 1.0.1e 11 Feb 2013 2016.11.14 21:34:19 LOG5[5287:140430154716992]: Running with OpenSSL 1.0.1f 6 Jan 2014 2016.11.14 21:34:19 LOG5[5287:140430154716992]: Update OpenSSL shared libraries or rebuild stunnel 2016.11.14 21:34:19 LOG5[5287:140430154716992]: Threading:PTHREAD SSL:+ENGINE+OCSP Auth:LIBWRAP Sockets:POLL+IPv6 2016.11.14 21:34:19 LOG5[5287:140430154716992]: Reading configuration from file /etc/stunnel/stunnel.conf 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Compression not enabled 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Snagged 64 random bytes from /home/ubuntu/.rnd 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Wrote 1024 new random bytes to /home/ubuntu/.rnd 2016.11.14 21:34:19 LOG7[5287:140430154716992]: PRNG seeded successfully 2016.11.14 21:34:19 LOG6[5287:140430154716992]: Initializing service section [resourceServer] 2016.11.14 21:34:19 LOG4[5287:140430154716992]: Insecure file permissions on /etc/stunnel/stunnel.pem 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Certificate: /etc/stunnel/stunnel.pem 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Certificate loaded 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Key file: /etc/stunnel/stunnel.pem 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Private key loaded 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Verify directory set to /etc/ssl/certs 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Added /etc/ssl/certs revocation lookup directory 2016.11.14 21:34:19 LOG7[5287:140430154716992]: SSL options set: 0x00000004 2016.11.14 21:34:19 LOG6[5287:140430154716992]: Initializing service section [tpserver] 2016.11.14 21:34:19 LOG4[5287:140430154716992]: Insecure file permissions on /etc/stunnel/stunnel.pem 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Certificate: /etc/stunnel/stunnel.pem 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Certificate loaded 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Key file: /etc/stunnel/stunnel.pem 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Private key loaded 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Verify directory set to /etc/ssl/certs 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Added /etc/ssl/certs revocation lookup directory 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Could not load DH parameters from /etc/stunnel/stunnel.pem 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Using hardcoded DH parameters 2016.11.14 21:34:19 LOG7[5287:140430154716992]: DH initialized with 2048-bit key 2016.11.14 21:34:19 LOG7[5287:140430154716992]: ECDH initialized with curve prime256v1 2016.11.14 21:34:19 LOG7[5287:140430154716992]: SSL options set: 0x00000004 2016.11.14 21:34:19 LOG5[5287:140430154716992]: Configuration successful 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Service [resourceServer] (FD=12) bound to 127.0.0.1:8080 2016.11.14 21:34:19 LOG7[5287:140430154716992]: Service [tpserver] (FD=13) bound to 127.0.0.1:8444 2016.11.14 21:34:19 LOG7[5293:140430154716992]: Created pid file /var/run/stunnel4.pid 2016.11.14 21:34:25 LOG7[5293:140430154716992]: Service [resourceServer] accepted (FD=3) from 127.0.0.1:41256 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Service [resourceServer] started 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Waiting for a libwrap process 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Acquired libwrap process #0 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Releasing libwrap process #0 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Released libwrap process #0 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Service [resourceServer] permitted by libwrap from 127.0.0.1:41256 2016.11.14 21:34:25 LOG5[5293:140430154827520]: Service [resourceServer] accepted connection from 127.0.0.1:41256 2016.11.14 21:34:25 LOG6[5293:140430154827520]: connect_blocking: connecting 52.43.245.161:8443 2016.11.14 21:34:25 LOG7[5293:140430154827520]: connect_blocking: s_poll_wait 52.43.245.161:8443: waiting 10 seconds 2016.11.14 21:34:25 LOG5[5293:140430154827520]: connect_blocking: connected 52.43.245.161:8443 2016.11.14 21:34:25 LOG5[5293:140430154827520]: Service [resourceServer] connected remote server from 172.31.44.97:34077 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Remote socket (FD=15) initialized 2016.11.14 21:34:25 LOG7[5293:140430154827520]: SNI: host name: 52.43.245.161 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Starting certificate verification: depth=2, /C=US/O=GeoTrust Inc./CN=GeoTrust Global CA 2016.11.14 21:34:25 LOG6[5293:140430154827520]: CERT: Verification not enabled 2016.11.14 21:34:25 LOG5[5293:140430154827520]: Certificate accepted: depth=2, /C=US/O=GeoTrust Inc./CN=GeoTrust Global CA 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Starting certificate verification: depth=1, /C=US/O=GeoTrust Inc./CN=RapidSSL SHA256 CA 2016.11.14 21:34:25 LOG6[5293:140430154827520]: CERT: Verification not enabled 2016.11.14 21:34:25 LOG5[5293:140430154827520]: Certificate accepted: depth=1, /C=US/O=GeoTrust Inc./CN=RapidSSL SHA256 CA 2016.11.14 21:34:25 LOG7[5293:140430154827520]: Starting certificate verification: depth=0, /CN=*.greenbuttonalliance.org 2016.11.14 21:34:25 LOG6[5293:140430154827520]: CERT: Verification not enabled 2016.11.14 21:34:25 LOG5[5293:140430154827520]: Certificate accepted: depth=0, /CN=*.greenbuttonalliance.org 2016.11.14 21:34:25 LOG6[5293:140430154827520]: SSL connected: new session negotiated 2016.11.14 21:34:25 LOG6[5293:140430154827520]: Negotiated TLSv1/SSLv3 ciphersuite: AES128-SHA (128-bit encryption) 2016.11.14 21:34:25 LOG6[5293:140430154827520]: Compression: null, expansion: null 2016.11.14 21:34:45 LOG7[5293:140430154827520]: SSL closed on SSL_read 2016.11.14 21:34:45 LOG7[5293:140430154827520]: Sent socket write shutdown 2016.11.14 21:34:56 LOG7[5293:140430154827520]: Socket closed on read 2016.11.14 21:34:56 LOG7[5293:140430154827520]: Sending close_notify alert 2016.11.14 21:34:56 LOG6[5293:140430154827520]: SSL_shutdown successfully sent close_notify alert 2016.11.14 21:34:56 LOG5[5293:140430154827520]: Connection closed: 342 byte(s) sent to SSL, 250 byte(s) sent to socket 2016.11.14 21:34:56 LOG7[5293:140430154827520]: Remote socket (FD=15) closed 2016.11.14 21:34:56 LOG7[5293:140430154827520]: Local socket (FD=3) closed 2016.11.14 21:34:56 LOG7[5293:140430154827520]: Service [resourceServer] finished (0 left) The stunnel.conf file contains the following configuration: ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** CApath = /etc/ssl/certs ; ************************************************************************** ; * Logging * ; ************************************************************************** debug = 7 output = /home/ubuntu/Git/energyos/OpenESPI-GreenButtonCMDTest/SOAPUI/stunnel.log ; ************************************************************************** ; * Service definitions (at least one service has to be defined) * ; ************************************************************************** ; ************************************************************************** ; * Resource Server * ; ************************************************************************** [resourceServer] accept=localhost:8080 connect=52.43.245.161:8443 ciphers=AES128-SHA client = yes cert=/etc/stunnel/stunnel.pem verify=0 [tpserver] accept=127.0.0.1:8444 connect=localhost:8081 cert=/etc/stunnel/stunnel.pem verify=0 client=no ciphers=AES128-SHA Are there any additional stunnel logging options or debugging techniques you can recommend to help determine why the session is being closed? Does stunnel support wildcard based certificates (i.e. *.greenbuttonalliance.org)? Best regards, Don Donald F. Coffin Technical Manager Green Button Alliance 2335 Dunwoody Crossing Suite E Dunwoody, GA 30338-8221 http://www.greenbuttonalliance.org <http://www.greenbuttonalliance.org/> (949) 636-8571 Mobile

1 0

rpmbuild errors using stunnel.spec
by Wiest, Damian 07 Nov '16

07 Nov '16

I noticed a few issues with the stunnel.spec file included with the distribution that I wanted to report. I'm building on an Amazon Linux host. There appears to be a bad date entry in the changelog section, warning: bogus date in %changelog: Sun Jun 24 2000 Brian Hatch <bri(a)stunnel.org> Sunday is the 25th? The stunnel.init and stunnel.logrotate files are being installed from the rpmbuild/SOURCES/ directory and not rpmbuild/BUILD/stunnel-5.37/tools/. Copying the files from the build area and retrying resolves this. stunnel.spec:Source1: %{name}.init stunnel.spec:Source2: %{name}.logrotate ... stunnel.spec:%{__install} -p -m0755 %{SOURCE1} $RPM_BUILD_ROOT%{_initrddir}/%{name} stunnel.spec:%{__install} -p -m0644 %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/%{name} + /usr/bin/install -p -m0755 /home/ec2-user/rpmbuild/SOURCES/stunnel.init /home/ec2-user/rpmbuild/BUILDROOT/stunnel-5.37-1.amzn1.x86_64/etc/rc.d/init.d/stunnel /usr/bin/install: cannot stat '/home/ec2-user/rpmbuild/SOURCES/stunnel.init': No such file or directory + /usr/bin/install -p -m0644 /home/ec2-user/rpmbuild/SOURCES/stunnel.logrotate /home/ec2-user/rpmbuild/BUILDROOT/stunnel-5.37-1.amzn1.x86_64/etc/logrotate.d/stunnel /usr/bin/install: cannot stat '/home/ec2-user/rpmbuild/SOURCES/stunnel.logrotate': No such file or directory rpmbuild also complains that the files under /usr/share/doc/stunnel/ are unpackaged. I added %{_docdir}/* at the end of the files section to correct this. -Damian -- Confidentiality Notice: This e-mail transmission may contain confidential or legally privileged information that is intended only for the individual or entity named in the e-mail address. If you have received this communication in error, please notify me by return e-mail, and destroy this communication and all copies thereof, including any attachments. Apervita ® is a registered trademark of Apervita Inc.

1 0

Bulk Requests - Stunnel throwing exceptions
by Lakshmi Narayana Lanka 03 Nov '16

03 Nov '16

Hello, I'm using Stunnel infront of a TCP/IP connection. When we receive bulk requests simultaneously it starts throwing exceptions. Is it something by design with Stunnel? -- Thanks & Regards, Lakshmi N Lanka

2 4

Use SNI
by Benjamin Hartwich 31 Oct '16

31 Oct '16

Hi, I´ve found the SNI parameter at stunnel, but it doesn´t work at my Ubuntu 16.04. My goal is, to use one dfn cert for the stunnel cert, which has 4 hostnames. This cert is on both servers. At the client server this cert works, because at the cert this is first hostname. At the second server I use the same cert, but it can´t be verified, because stunnel doesn´t recognize the correct hostname from the cert. Can anyone send me an example for a working SNI configuration? My Configs: Server one: client = yes cert = /etc/stunnel/cert.pem service = test debug = debug output = /var/log/stunnel4/stunnel.log foreground = no sslVersion = TLSv1 options = NO_SSLv3 options = NO_SSLv2 CAfile = /etc/ssl/web/chain.pem verify = 2 socket = r:TCP_NODELAY=1 [app1] accept = localhost:8090 connect = 10.1.2.1:8085´ ----- Server 2 (fails): client = no cert = /etc/stunnel/cert.pem service = test debug = debug output = /var/log/stunnel4/stunnel.log sslVersion = TLSv1 options = NO_SSLv3 options = NO_SSLv2 foreground = no CAfile = /etc/ssl/web/chain.pem verify = 2 socket = l:TCP_NODELAY=1 [ajp] accept = 8085 connect = 127.0.0.1:8009 --- Error: 2016.10.31 15:01:40 LOG7[9]: SNI: no virtual services defined 2016.10.31 15:01:40 LOG4[9]: CERT: Pre-verification error: unsupported certificate purpose Regards, Benjamin Hartwich Referat Basisdienste Zentrum für Informationstechnologie und Medienmanagement Universität Passau Innstr. 33, 94032 Passau Telefon +49 (0)851/509-3285, Telefax +49 (0)851/509-1802 E-Mail: benjamin.hartwich(a)uni-passau.de

1 0

Running Stunnel 5.23 as multiple windows services
by David Jones 25 Oct '16

25 Oct '16

Hi, I'm trying to run stunnel as a windows service. I have used the stunnel -install and one service has successfully been setup. We now have a need to run a second instance of stunnel and so that we are able to stop/start this instance and not affect the connectivity of the other one we would like to install it as a separate service. On an older version of stunnel we simply named the stunnel.exe differently and it ran both services separately. But with 5.23 it is not allowing us to do so. Coming up the error "CreateService: error 1073: The specified service already exists". I've tried adding service = into the .conf file and also using service= on the command line for the install but nothing works. So what have I missed? Thanks David Config: Service = Stunnel_TLS_Generic CApath = ./ debug=7 #debug = 1 output = TLS_Generic.log # Use it for client mode client = yes # Service-level configuration [Service_Name] options = NO_SSLv2 options = NO_SSLv3 sslVersion = TLSv1 accept = 20002 connect = URLtoserver:443

1 0

Re: [stunnel-users] JHH re: Server down? [GishPuppy]
by gmane.bl4＠gishpuppy.com 20 Oct '16

20 Oct '16

John H Hoffmann wrote: > upgraded to latest sTunnel v 5.36. > > In restarting sTunnel I immediately got a > 'server down' error > > [ ] Service [pop3s] (FD=432) bound to 0.0.0.0:995 > > > [!] bind: Permission denied (WSAEACCES) (10013) > > [!] Error binding service [comcast-pop3] to 127.0.0.1:995 > You probably have in the stunnel.conf something similar to: [pop3s] accept=995 {...} [comcast-pop3] accept=127.0.0.1:995 {...} accept=995 == 0.0.0.0:995 == (all localhost IPv4 addresses):995 Which includes 127.0.0.1:995 When the [comcast-pop3] service tries to bind to port 995 it fails because it is already bound at the [pop3s] service. Gishpuppy | To change the delivery settings for this email, click here: http://www.gishpuppy.com/cgi-bin/[email protected]

2 1

JHH re: Server down?
by John H Hoffmann | 847.998.6198 18 Oct '16

18 Oct '16

Hi .. I have been having spotty access to my main ISP email account the last two days so I upgraded to latest sTunnel v 5.36. I use sTunnel to help get emails from my ISP, Comcast, to load into an older version of GoldMine CRM. sTunnel has worked like a charm since 09/2013. In restarting sTunnel I immediately got a 'server down' error, log included below. Ideas? Suggestions? [ ] Cron thread initialized [ ] Running on Windows 6.1 [ ] No limit detected for the number of clients [.] stunnel 5.36 on x86-pc-msvc-1500 platform [.] Compiled/running with OpenSSL 1.0.2i-fips 22 Sep 2016 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] GUI message loop initialized [ ] Running on Windows 6.1 [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark not detected [.] FIPS mode disabled [ ] Compression disabled [ ] Snagged 64 random bytes from C:/.rnd [ ] Wrote 1024 new random bytes to C:/.rnd [ ] PRNG seeded successfully [ ] Initializing service [pop3s] [ ] Loading certificate from file: stunnel.pem [ ] Certificate loaded from file: stunnel.pem [ ] Loading private key from file: stunnel.pem [ ] Private key loaded from file: stunnel.pem [ ] Private key check succeeded [ ] DH initialization [ ] Could not load DH parameters from stunnel.pem [ ] Using dynamic DH parameters [ ] ECDH initialization [ ] ECDH initialized with curve prime256v1 [ ] SSL options: 0x03004004 (+0x03004000, -0x00000000) [ ] Initializing service [imaps] [ ] Loading certificate from file: stunnel.pem [ ] Certificate loaded from file: stunnel.pem [ ] Loading private key from file: stunnel.pem [ ] Private key loaded from file: stunnel.pem [ ] Private key check succeeded [ ] DH initialization [ ] Could not load DH parameters from stunnel.pem [ ] Using dynamic DH parameters [ ] ECDH initialization [ ] ECDH initialized with curve prime256v1 [ ] SSL options: 0x03004004 (+0x03004000, -0x00000000) [ ] Initializing service [ssmtp] [ ] Loading certificate from file: stunnel.pem [ ] Certificate loaded from file: stunnel.pem [ ] Loading private key from file: stunnel.pem [ ] Private key loaded from file: stunnel.pem [ ] Private key check succeeded [ ] DH initialization [ ] Could not load DH parameters from stunnel.pem [ ] Using dynamic DH parameters [ ] ECDH initialization [ ] ECDH initialized with curve prime256v1 [ ] SSL options: 0x03004004 (+0x03004000, -0x00000000) [ ] Initializing service [comcast-pop3] [ ] Loading certificate from file: stunnel.pem [ ] Certificate loaded from file: stunnel.pem [ ] Loading private key from file: stunnel.pem [ ] Private key loaded from file: stunnel.pem [ ] Private key check succeeded [:] Service [comcast-pop3] needs authentication to prevent MITM attacks [ ] SSL options: 0x03000004 (+0x03000000, -0x00000000) [ ] Initializing service [comcast-smtp] [ ] Loading certificate from file: stunnel.pem [ ] Certificate loaded from file: stunnel.pem [ ] Loading private key from file: stunnel.pem [ ] Private key loaded from file: stunnel.pem [ ] Private key check succeeded [:] Service [comcast-smtp] needs authentication to prevent MITM attacks [ ] SSL options: 0x03000004 (+0x03000000, -0x00000000) [.] Configuration successful [ ] Listening file descriptor created (FD=432) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [ ] Service [pop3s] (FD=432) bound to 0.0.0.0:995 [ ] Listening file descriptor created (FD=436) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [ ] Service [imaps] (FD=436) bound to 0.0.0.0:993 [ ] Listening file descriptor created (FD=440) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [ ] Service [ssmtp] (FD=440) bound to 0.0.0.0:465 [ ] Listening file descriptor created (FD=444) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [!] bind: Permission denied (WSAEACCES) (10013) [!] Error binding service [comcast-pop3] to 127.0.0.1:995 [ ] Closing service [pop3s] [ ] Service [pop3s] closed (FD=432) [ ] Service [pop3s] closed [ ] Closing service [imaps] [ ] Service [imaps] closed (FD=436) [ ] Service [imaps] closed [ ] Closing service [ssmtp] [ ] Service [ssmtp] closed (FD=440) [ ] Service [ssmtp] closed [ ] Closing service [comcast-pop3] [ ] Service [comcast-pop3] closed [ ] Closing service [comcast-smtp] [ ] Service [comcast-smtp] closed [!] Server is down Respectfully, John John H Hoffmann

2 1

Stunnel stops on Windows Server 2012
by Sam Ash 03 Oct '16

03 Oct '16

I've upgraded Stunnel from 5.35 to 5.36 on a server running windows server 2012. Since the upgrade it appears to stop running once i log out. I installed it as a service and set the service start to automatic. It has no problems running when someone is logged into the server. I'm not sure what i changed when i updated the version. Thanks

1 0

No cert?
by Dave Gradwell 27 Sep '16

27 Sep '16

Is there any way to configure a Stunnel server so that it doesn’t require a cert at all? I implement peer authentication using other means; I just want session encryption from Stunnel. Ideally, I’d like keys to be generated on-the-fly for each new connection. I don’t mind if this takes a few seconds… Thanks, Dave.

1 0

Re: [stunnel-users] Hangs when connecting -- advice pls
by Scott McKeown 21 Sep '16

21 Sep '16

Hi Guys, To me this looks like a cipher issue. There are a few options that you can try to resolve this if it is. I would try adding the following lines into your STunnel Configuration file: delay = yes options = NO_SSLv2 options = NO_SSLv3 options = NO_TLSv1 options = CIPHER_SERVER_PREFERENCE options = DONT_INSERT_EMPTY_FRAGMENTS Delay will delay and DNS lookups that maybe actioned by the request (not normally needed but I always include if for sanity sake) The three 'options' sections turn off all the known problematic cipher lists if you need a key that is in one of these block feel free to remove that directive but I think a good start would be to leave the 'NO_SSLv3' option in place The 'CIPHER_SERVER_PREFERENCE' option will make set whether the client is allowed to renegotiat the ciphers that are to be used between the client and the server process. And finally 'DONT_INSERT_EMPTY_FRAGMENTS' will mitigate an issue in the CBC ciphers that was in the SSLv3 and TLS1.0 cipher lists again I only include it for sanity sake now but its better to have than to go without. -- With Kind Regards. Scott McKeown Loadbalancer.org http://www.loadbalancer.org Tel (UK) - +44 (0) 3303801064 (24x7) Tel (US) - +1 888.867.9504 (Toll Free)(24x7)

2 1

Re: [stunnel-users] stunnel-users Digest, Vol 146, Issue 10
by Hon Quach 16 Sep '16

16 Sep '16

Can I be please removed from the mailing list? Sent from my iPhone > On Sep 16, 2016, at 12:14 PM, stunnel-users-request(a)stunnel.org wrote: > > Send stunnel-users mailing list submissions to > stunnel-users(a)stunnel.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)stunnel.org > > You can reach the person managing the list at > stunnel-users-owner(a)stunnel.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. Re: compilation error with stunnel-5.35 (Josealf.rm) > 2. Re: compilation error with stunnel-5.35 (Viorel Panaite) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 16 Sep 2016 13:04:09 -0500 > From: "Josealf.rm" <josealf(a)rocketmail.com> > To: Viorel Panaite <Viorel.Panaite(a)tecsys.com> > Cc: "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> > Subject: Re: [stunnel-users] compilation error with stunnel-5.35 > Message-ID: <6CE9A3F0-EE74-4CF0-ACCE-C5941B6B40A2(a)rocketmail.com> > Content-Type: text/plain; charset="utf-8" > > > Visorel, > > Did you compile OpenSSL yourself? Did you enable shared library support? > Maybe you system is picking system installed OpenSSL headers (0.9.8) instead of the new ones. > > Regards > Jose > > > Enviado desde mi iPhone >> El 16/09/2016, a las 9:39 a.m., Viorel Panaite <Viorel.Panaite(a)tecsys.com> escribió: >> >> I downloaded stunnel-5.35 and I’m trying to compile using openssl-1.0.2h on RedHat EL linux 5.4 >> >> I get this error when I’m trying to compile them together, >> >> Configure log >> ./configure --prefix=/apps/stunnel/535 --with-ssl=/apps/openssl/1.0.2h/ >> ……………………. >> hecking for broken poll() implementation... no >> checking for pipe2... no >> checking for accept4... no >> configure: **************************************** optional features >> checking whether to enable IPv6 support... yes (default) >> checking whether to enable FIPS support... autodetecting >> checking whether to enable systemd socket activation support... autodetecting >> checking for library containing sd_listen_fds... no >> configure: systemd library not found >> checking whether to enable TCP wrappers support... autodetecting >> checking for hosts_access in -lwrap... yes >> configure: libwrap support enabled >> configure: **************************************** SSL >> checking for compiler sysroot... / >> checking for SSL directory... /apps/openssl/1.0.2h/ >> checking for FIPS_mode_set... yes >> configure: FIPS support enabled >> configure: **************************************** write the results >> checking that generated files are newer than configure... done >> configure: creating ./config.status >> config.status: creating Makefile >> config.status: creating src/Makefile >> config.status: creating doc/Makefile >> config.status: creating tools/Makefile >> config.status: creating src/config.h >> config.status: src/config.h is unchanged >> config.status: executing depfiles commands >> config.status: executing libtool commands >> configure: **************************************** success >> >> make log >> >> [root@mybox stunnel-5.35]# make >> Making all in src >> make[1]: Entering directory `/apps/stunnel/stunnel-5.35/src' >> make all-am >> make[2]: Entering directory `/apps/stunnel/stunnel-5.35/src' >> CCLD stunnel >> /usr/bin/ld: skipping incompatible /apps/openssl/1.0.2h//lib/libssl.a when searching for -lssl >> /usr/bin/ld: skipping incompatible /apps/openssl/1.0.2h//lib/libcrypto.a when searching for -lcrypto >> stunnel-client.o: In function `client_run': >> /apps/stunnel/stunnel-5.35/src/client.c:201: undefined reference to `ERR_remove_thread_state' >> stunnel-options.o: In function `parse_service_option': >> /apps/stunnel/stunnel-5.35/src/options.c:2669: undefined reference to `TLSv1_2_client_method' >> /apps/stunnel/stunnel-5.35/src/options.c:2670: undefined reference to `TLSv1_2_server_method' >> /apps/stunnel/stunnel-5.35/src/options.c:2662: undefined reference to `TLSv1_1_client_method' >> /apps/stunnel/stunnel-5.35/src/options.c:2663: undefined reference to `TLSv1_1_server_method' >> stunnel-ctx.o: In function `auth_init': >> /apps/stunnel/stunnel-5.35/src/ctx.c:442: undefined reference to `SSL_CTX_set_psk_server_callback' >> stunnel-ctx.o: In function `context_init': >> /apps/stunnel/stunnel-5.35/src/ctx.c:133: undefined reference to `SSL_CTX_set_client_cert_engine' >> stunnel-ctx.o: In function `auth_init': >> /apps/stunnel/stunnel-5.35/src/ctx.c:440: undefined reference to `SSL_CTX_set_psk_client_callback' >> stunnel-ctx.o: In function `conf_init': >> /apps/stunnel/stunnel-5.35/src/ctx.c:376: undefined reference to `SSL_CONF_CTX_new' >> /apps/stunnel/stunnel-5.35/src/ctx.c:381: undefined reference to `SSL_CONF_CTX_set_ssl_ctx' >> /apps/stunnel/stunnel-5.35/src/ctx.c:382: undefined reference to `SSL_CONF_CTX_set_flags' >> /apps/stunnel/stunnel-5.35/src/ctx.c:383: undefined reference to `SSL_CONF_CTX_set_flags' >> /apps/stunnel/stunnel-5.35/src/ctx.c:385: undefined reference to `SSL_CONF_CTX_set_flags' >> /apps/stunnel/stunnel-5.35/src/ctx.c:392: undefined reference to `SSL_CONF_cmd' >> /apps/stunnel/stunnel-5.35/src/ctx.c:420: undefined reference to `SSL_CONF_CTX_finish' >> /apps/stunnel/stunnel-5.35/src/ctx.c:422: undefined reference to `SSL_CONF_CTX_free' >> stunnel-ctx.o: In function `ecdh_init': >> /apps/stunnel/stunnel-5.35/src/ctx.c:351: undefined reference to `EC_KEY_new_by_curve_name' >> /apps/stunnel/stunnel-5.35/src/ctx.c:359: undefined reference to `EC_KEY_free' >> stunnel-ctx.o: In function `conf_init': >> /apps/stunnel/stunnel-5.35/src/ctx.c:414: undefined reference to `SSL_CONF_CTX_free' >> /apps/stunnel/stunnel-5.35/src/ctx.c:409: undefined reference to `SSL_CONF_CTX_free' >> /apps/stunnel/stunnel-5.35/src/ctx.c:425: undefined reference to `SSL_CONF_CTX_free' >> stunnel-ctx.o: In function `servername_cb': >> /apps/stunnel/stunnel-5.35/src/ctx.c:229: undefined reference to `SSL_get_servername' >> /apps/stunnel/stunnel-5.35/src/ctx.c:253: undefined reference to `SSL_set_SSL_CTX' >> stunnel-verify.o: In function `ocsp_request': >> /apps/stunnel/stunnel-5.35/src/verify.c:499: undefined reference to `OCSP_CERTID_dup' >> stunnel-verify.o: In function `ocsp_get_response': >> /apps/stunnel/stunnel-5.35/src/verify.c:614: undefined reference to `OCSP_sendreq_new' >> /apps/stunnel/stunnel-5.35/src/verify.c:625: undefined reference to `OCSP_REQ_CTX_add1_header' >> /apps/stunnel/stunnel-5.35/src/verify.c:629: undefined reference to `OCSP_REQ_CTX_add1_header' >> /apps/stunnel/stunnel-5.35/src/verify.c:634: undefined reference to `OCSP_REQ_CTX_set1_req' >> /apps/stunnel/stunnel-5.35/src/verify.c:641: undefined reference to `OCSP_sendreq_nbio' >> /apps/stunnel/stunnel-5.35/src/verify.c:668: undefined reference to `OCSP_REQ_CTX_free' >> stunnel-verify.o: In function `cert_check_subject': >> /apps/stunnel/stunnel-5.35/src/verify.c:299: undefined reference to `X509_check_host' >> stunnel-verify.o: In function `ocsp_check': >> /apps/stunnel/stunnel-5.35/src/verify.c:457: undefined reference to `X509_get1_ocsp' >> stunnel-verify.o: In function `cert_check_subject': >> /apps/stunnel/stunnel-5.35/src/verify.c:312: undefined reference to `X509_check_email' >> /apps/stunnel/stunnel-5.35/src/verify.c:323: undefined reference to `X509_check_ip_asc' >> stunnel-verify.o: In function `cert_check_local': >> /apps/stunnel/stunnel-5.35/src/verify.c:356: undefined reference to `X509_STORE_get1_certs' >> stunnel-sthreads.o: In function `sthreads_init': >> /apps/stunnel/stunnel-5.35/src/sthreads.c:287: undefined reference to `CRYPTO_THREADID_set_callback' >> stunnel-sthreads.o: In function `threadid_func': >> /apps/stunnel/stunnel-5.35/src/sthreads.c:268: undefined reference to `CRYPTO_THREADID_set_numeric' >> collect2: ld returned 1 exit status >> make[2]: *** [stunnel] Error 1 >> make[2]: Leaving directory `/apps/stunnel/stunnel-5.35/src' >> make[1]: *** [all] Error 2 >> make[1]: Leaving directory `/apps/stunnel/stunnel-5.35/src' >> make: *** [all-recursive] Error 1 >> >> Thanks for your help. >> >> >> _______________________________________________ >> stunnel-users mailing list >> stunnel-users(a)stunnel.org >> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >

2 1

compilation error with stunnel-5.35
by Viorel Panaite 16 Sep '16

16 Sep '16

I downloaded stunnel-5.35 and I'm trying to compile using openssl-1.0.2h on RedHat EL linux 5.4 I get this error when I'm trying to compile them together, Configure log ./configure --prefix=/apps/stunnel/535 --with-ssl=/apps/openssl/1.0.2h/ ......................... hecking for broken poll() implementation... no checking for pipe2... no checking for accept4... no configure: **************************************** optional features checking whether to enable IPv6 support... yes (default) checking whether to enable FIPS support... autodetecting checking whether to enable systemd socket activation support... autodetecting checking for library containing sd_listen_fds... no configure: systemd library not found checking whether to enable TCP wrappers support... autodetecting checking for hosts_access in -lwrap... yes configure: libwrap support enabled configure: **************************************** SSL checking for compiler sysroot... / checking for SSL directory... /apps/openssl/1.0.2h/ checking for FIPS_mode_set... yes configure: FIPS support enabled configure: **************************************** write the results checking that generated files are newer than configure... done configure: creating ./config.status config.status: creating Makefile config.status: creating src/Makefile config.status: creating doc/Makefile config.status: creating tools/Makefile config.status: creating src/config.h config.status: src/config.h is unchanged config.status: executing depfiles commands config.status: executing libtool commands configure: **************************************** success make log [root@mybox stunnel-5.35]# make Making all in src make[1]: Entering directory `/apps/stunnel/stunnel-5.35/src' make all-am make[2]: Entering directory `/apps/stunnel/stunnel-5.35/src' CCLD stunnel /usr/bin/ld: skipping incompatible /apps/openssl/1.0.2h//lib/libssl.a when searching for -lssl /usr/bin/ld: skipping incompatible /apps/openssl/1.0.2h//lib/libcrypto.a when searching for -lcrypto stunnel-client.o: In function `client_run': /apps/stunnel/stunnel-5.35/src/client.c:201: undefined reference to `ERR_remove_thread_state' stunnel-options.o: In function `parse_service_option': /apps/stunnel/stunnel-5.35/src/options.c:2669: undefined reference to `TLSv1_2_client_method' /apps/stunnel/stunnel-5.35/src/options.c:2670: undefined reference to `TLSv1_2_server_method' /apps/stunnel/stunnel-5.35/src/options.c:2662: undefined reference to `TLSv1_1_client_method' /apps/stunnel/stunnel-5.35/src/options.c:2663: undefined reference to `TLSv1_1_server_method' stunnel-ctx.o: In function `auth_init': /apps/stunnel/stunnel-5.35/src/ctx.c:442: undefined reference to `SSL_CTX_set_psk_server_callback' stunnel-ctx.o: In function `context_init': /apps/stunnel/stunnel-5.35/src/ctx.c:133: undefined reference to `SSL_CTX_set_client_cert_engine' stunnel-ctx.o: In function `auth_init': /apps/stunnel/stunnel-5.35/src/ctx.c:440: undefined reference to `SSL_CTX_set_psk_client_callback' stunnel-ctx.o: In function `conf_init': /apps/stunnel/stunnel-5.35/src/ctx.c:376: undefined reference to `SSL_CONF_CTX_new' /apps/stunnel/stunnel-5.35/src/ctx.c:381: undefined reference to `SSL_CONF_CTX_set_ssl_ctx' /apps/stunnel/stunnel-5.35/src/ctx.c:382: undefined reference to `SSL_CONF_CTX_set_flags' /apps/stunnel/stunnel-5.35/src/ctx.c:383: undefined reference to `SSL_CONF_CTX_set_flags' /apps/stunnel/stunnel-5.35/src/ctx.c:385: undefined reference to `SSL_CONF_CTX_set_flags' /apps/stunnel/stunnel-5.35/src/ctx.c:392: undefined reference to `SSL_CONF_cmd' /apps/stunnel/stunnel-5.35/src/ctx.c:420: undefined reference to `SSL_CONF_CTX_finish' /apps/stunnel/stunnel-5.35/src/ctx.c:422: undefined reference to `SSL_CONF_CTX_free' stunnel-ctx.o: In function `ecdh_init': /apps/stunnel/stunnel-5.35/src/ctx.c:351: undefined reference to `EC_KEY_new_by_curve_name' /apps/stunnel/stunnel-5.35/src/ctx.c:359: undefined reference to `EC_KEY_free' stunnel-ctx.o: In function `conf_init': /apps/stunnel/stunnel-5.35/src/ctx.c:414: undefined reference to `SSL_CONF_CTX_free' /apps/stunnel/stunnel-5.35/src/ctx.c:409: undefined reference to `SSL_CONF_CTX_free' /apps/stunnel/stunnel-5.35/src/ctx.c:425: undefined reference to `SSL_CONF_CTX_free' stunnel-ctx.o: In function `servername_cb': /apps/stunnel/stunnel-5.35/src/ctx.c:229: undefined reference to `SSL_get_servername' /apps/stunnel/stunnel-5.35/src/ctx.c:253: undefined reference to `SSL_set_SSL_CTX' stunnel-verify.o: In function `ocsp_request': /apps/stunnel/stunnel-5.35/src/verify.c:499: undefined reference to `OCSP_CERTID_dup' stunnel-verify.o: In function `ocsp_get_response': /apps/stunnel/stunnel-5.35/src/verify.c:614: undefined reference to `OCSP_sendreq_new' /apps/stunnel/stunnel-5.35/src/verify.c:625: undefined reference to `OCSP_REQ_CTX_add1_header' /apps/stunnel/stunnel-5.35/src/verify.c:629: undefined reference to `OCSP_REQ_CTX_add1_header' /apps/stunnel/stunnel-5.35/src/verify.c:634: undefined reference to `OCSP_REQ_CTX_set1_req' /apps/stunnel/stunnel-5.35/src/verify.c:641: undefined reference to `OCSP_sendreq_nbio' /apps/stunnel/stunnel-5.35/src/verify.c:668: undefined reference to `OCSP_REQ_CTX_free' stunnel-verify.o: In function `cert_check_subject': /apps/stunnel/stunnel-5.35/src/verify.c:299: undefined reference to `X509_check_host' stunnel-verify.o: In function `ocsp_check': /apps/stunnel/stunnel-5.35/src/verify.c:457: undefined reference to `X509_get1_ocsp' stunnel-verify.o: In function `cert_check_subject': /apps/stunnel/stunnel-5.35/src/verify.c:312: undefined reference to `X509_check_email' /apps/stunnel/stunnel-5.35/src/verify.c:323: undefined reference to `X509_check_ip_asc' stunnel-verify.o: In function `cert_check_local': /apps/stunnel/stunnel-5.35/src/verify.c:356: undefined reference to `X509_STORE_get1_certs' stunnel-sthreads.o: In function `sthreads_init': /apps/stunnel/stunnel-5.35/src/sthreads.c:287: undefined reference to `CRYPTO_THREADID_set_callback' stunnel-sthreads.o: In function `threadid_func': /apps/stunnel/stunnel-5.35/src/sthreads.c:268: undefined reference to `CRYPTO_THREADID_set_numeric' collect2: ld returned 1 exit status make[2]: *** [stunnel] Error 1 make[2]: Leaving directory `/apps/stunnel/stunnel-5.35/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/apps/stunnel/stunnel-5.35/src' make: *** [all-recursive] Error 1 Thanks for your help.

2 2

Hangs when connecting -- advice pls
by Dave Gradwell 14 Sep '16

14 Sep '16

My Stunnel client gets to this point, then hangs indefinitely: SSL state (connect): SSLv2/v3 write client hello A Is this a fault with Stunnel or is it something I’m doing wrong Full client-side output: """"""""""""""""""" Last login: Wed Sep 14 06:50:40 on ttys004 Daves-MBP-2016:~ dave$ /Users/dave/Desktop/stunnel-test/stunnel /Users/dave/Desktop/stunnel-test/stunnel-sender.conf 2016.09.14 06:54:35 LOG7[ui]: Clients allowed=125 2016.09.14 06:54:35 LOG7[cron]: Cron thread initialized 2016.09.14 06:54:35 LOG5[ui]: stunnel 5.35 on x86_64-apple-darwin15.4.0 platform 2016.09.14 06:54:35 LOG5[ui]: Compiled with OpenSSL 0.9.8zd 8 Jan 2015 2016.09.14 06:54:35 LOG5[ui]: Running with OpenSSL 0.9.8zh 14 Jan 2016 2016.09.14 06:54:35 LOG5[ui]: Update OpenSSL shared libraries or rebuild stunnel 2016.09.14 06:54:35 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,SNI 2016.09.14 06:54:35 LOG7[ui]: errno: (*__error()) 2016.09.14 06:54:35 LOG5[ui]: Reading configuration from file /Users/dave/Desktop/stunnel-test/stunnel-sender.conf 2016.09.14 06:54:35 LOG5[ui]: UTF-8 byte order mark not detected 2016.09.14 06:54:35 LOG7[ui]: Compression disabled 2016.09.14 06:54:35 LOG7[ui]: Snagged 64 random bytes from /Users/dave/.rnd 2016.09.14 06:54:35 LOG7[ui]: Wrote 1024 new random bytes to /Users/dave/.rnd 2016.09.14 06:54:35 LOG7[ui]: PRNG seeded successfully 2016.09.14 06:54:35 LOG6[ui]: Initializing inetd mode configuration 2016.09.14 06:54:35 LOG6[ui]: Loading certificate from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG6[ui]: Certificate loaded from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG6[ui]: Loading private key from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG4[ui]: Insecure file permissions on /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG6[ui]: Private key loaded from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG7[ui]: Private key check succeeded 2016.09.14 06:54:35 LOG4[ui]: Service [stunnel] needs authentication to prevent MITM attacks 2016.09.14 06:54:35 LOG7[ui]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2016.09.14 06:54:35 LOG5[ui]: Configuration successful 2016.09.14 06:54:35 LOG7[ui]: Service [stunnel] started 2016.09.14 06:54:35 LOG5[ui]: Service [stunnel] accepted connection 2016.09.14 06:54:35 LOG6[ui]: failover: round-robin, starting at entry #0 2016.09.14 06:54:35 LOG6[ui]: s_connect: connecting ::1:874 2016.09.14 06:54:35 LOG7[ui]: s_connect: s_poll_wait ::1:874: waiting 10 seconds 2016.09.14 06:54:35 LOG5[ui]: s_connect: connected ::1:874 2016.09.14 06:54:35 LOG5[ui]: Service [stunnel] connected remote server from ::1:51362 2016.09.14 06:54:35 LOG7[ui]: Option TCP_NODELAY set on remote socket 2016.09.14 06:54:35 LOG7[ui]: Remote descriptor (FD=3) initialized 2016.09.14 06:54:35 LOG6[ui]: SNI: sending servername: localhost 2016.09.14 06:54:35 LOG6[ui]: Peer certificate not required 2016.09.14 06:54:35 LOG7[ui]: SSL state (connect): before/connect initialization 2016.09.14 06:54:35 LOG7[ui]: SSL state (connect): SSLv2/v3 write client hello A ^C Daves-MBP-2016:~ dave$ """"""""""""""""""" My stunnel-sender.conf: """"""""""""""""""" debug = 7 output = /Users/dave/Desktop/stunnel-test/sender-stunnel-output.log foreground = yes client = yes connect = localhost:874 cert = /Users/dave/Desktop/stunnel-test/cert.pem verify = 0 """"""""""""""""""" My stunnel-receiver.conf: """"""""""""""""""" debug = 7 output = /Users/dave/Desktop/stunnel-test/receiver-stunnels-output.log pid = /Users/dave/Desktop/stunnel-test/stunnel-rsyncd-stunnels.pid cert = /Users/dave/Desktop/stunnel-test/cert.pem verify = 0 delay = yes exec = /Users/dave/Desktop/stunnel-test/rsync execArgs = -vvvv --daemon --server --config=/Users/dave/Desktop/stunnel-test/stunnel-rsyncd.conf . foreground = yes client = no """"""""""""""""""" My receiver-error.log: """"""""""""""""""" 2016.09.14 06:54:35 LOG7[ui]: Clients allowed=125 2016.09.14 06:54:35 LOG7[cron]: Cron thread initialized 2016.09.14 06:54:35 LOG5[ui]: stunnel 5.35 on x86_64-apple-darwin15.4.0 platform 2016.09.14 06:54:35 LOG5[ui]: Compiled with OpenSSL 0.9.8zd 8 Jan 2015 2016.09.14 06:54:35 LOG5[ui]: Running with OpenSSL 0.9.8zh 14 Jan 2016 2016.09.14 06:54:35 LOG5[ui]: Update OpenSSL shared libraries or rebuild stunnel 2016.09.14 06:54:35 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,SNI 2016.09.14 06:54:35 LOG7[ui]: errno: (*__error()) 2016.09.14 06:54:35 LOG5[ui]: Reading configuration from file /Users/dave/Desktop/stunnel-test/stunnel-receiver.conf 2016.09.14 06:54:35 LOG5[ui]: UTF-8 byte order mark not detected 2016.09.14 06:54:35 LOG7[ui]: Compression disabled 2016.09.14 06:54:35 LOG7[ui]: Snagged 64 random bytes from /dev/urandom 2016.09.14 06:54:35 LOG7[ui]: PRNG seeded successfully 2016.09.14 06:54:35 LOG6[ui]: Initializing inetd mode configuration 2016.09.14 06:54:35 LOG6[ui]: Loading certificate from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG6[ui]: Certificate loaded from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG6[ui]: Loading private key from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG4[ui]: Insecure file permissions on /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG6[ui]: Private key loaded from file: /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG7[ui]: Private key check succeeded 2016.09.14 06:54:35 LOG7[ui]: DH initialization 2016.09.14 06:54:35 LOG7[ui]: Using DH parameters from /Users/dave/Desktop/stunnel-test/cert.pem 2016.09.14 06:54:35 LOG6[ui]: 2048-bit DH parameters loaded 2016.09.14 06:54:35 LOG7[ui]: ECDH initialization 2016.09.14 06:54:35 LOG7[ui]: ECDH initialized with curve prime256v1 2016.09.14 06:54:35 LOG7[ui]: SSL options: 0x03004004 (+0x03004000, -0x00000000) 2016.09.14 06:54:35 LOG5[ui]: Configuration successful 2016.09.14 06:54:35 LOG7[ui]: Service [stunnel] started 2016.09.14 06:54:35 LOG7[ui]: Option TCP_NODELAY set on local socket 2016.09.14 06:54:35 LOG5[ui]: Service [stunnel] accepted connection from ::1:51362 2016.09.14 06:54:35 LOG6[ui]: Peer certificate not required 2016.09.14 06:54:35 LOG7[ui]: SSL state (accept): before/accept initialization 2016.09.14 06:54:35 LOG7[ui]: SNI: no virtual services defined 2016.09.14 06:54:35 LOG7[ui]: SSL state (accept): SSLv3 read client hello A 2016.09.14 06:54:35 LOG7[ui]: SSL state (accept): SSLv3 write server hello A 2016.09.14 06:54:35 LOG7[ui]: SSL state (accept): SSLv3 write certificate A 2016.09.14 06:54:35 LOG7[ui]: SSL state (accept): SSLv3 write certificate request A 2016.09.14 06:54:35 LOG7[ui]: SSL state (accept): SSLv3 flush data 2016.09.14 06:54:40 LOG3[ui]: SSL_accept: Peer suddenly disconnected 2016.09.14 06:54:40 LOG5[ui]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.09.14 06:54:40 LOG7[ui]: Deallocating application specific data for addr index 2016.09.14 06:54:40 LOG7[ui]: Service [stunnel] finished (0 left) """"""""""""""""""" The server-side-Stunnel is invoked via launchd using this LaunchDaemon (but this seems to be working okay — I think): """"""""""""""""""" <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Disabled</key> <false/> <key>StandardErrorPath</key> <string>/Users/dave/Desktop/stunnel-test/receiver-error.log</string> <key>StandardOutPath</key> <string>/Users/dave/Desktop/stunnel-test/receiver-out.log</string> <key>Label</key> <string>com.stunnel.test</string> <key>ProgramArguments</key> <array> <string>/Users/dave/Desktop/stunnel-test/stunnel</string> <string>/Users/dave/Desktop/stunnel-test/stunnel-receiver.conf</string> </array> <key>inetdCompatibility</key> <dict> <key>Wait</key> <false/> </dict> <key>Sockets</key> <dict> <key>Listeners</key> <dict> <key>SockServiceName</key> <string>874</string> <key>SockType</key> <string>stream</string> </dict> </dict> </dict> </plist> """"""""""""""""""" I’ve looked at the output of bash-3.2# tcpdump -i all -XX -xx -vv port 874 but this didn’t give me any obvious clues. I can send it if it’s useful but I’ve omitted it for now as it’s long. I’ve reproduced the same hang on Mac OS X 10.11 and 10.6. I’ve recompiled Stunnel in 10.11 and 10.9 environments but still get this same hang. Any advice appreciated.. — Dave.

1 0

Re: [stunnel-users] stunnel 5.x no answer in server mode?
by Ulli Horlacher 14 Sep '16

14 Sep '16

On Tue 2016-09-13 (22:25), Micha?? Trojnara wrote: > On 13.09.2016 20:35, Ulli Horlacher wrote: > >> It is impossible to say anything without analysis of the executed fexsrv > >> program. > > > > The problem cannot be in fexsrv, because it works with stunnel 4.27 > > What is the point of sending an email to the mailing list when you > ignore our effort to help you? Where do I ignore help? > fexsrv terminates immediately with exit code 1. No. It does not start at all, so it does not terminate. fexsrv logs everything and when running with stunnel 5.x the log file is empty. But meanwhile I found the error: stunnel 5.x needs the a full path for the exec statement: exec = /usr/bin/perl For stunnel 4.x it was sufficent to use: exec = perl -- Ullrich Horlacher Server und Virtualisierung Rechenzentrum TIK Universitaet Stuttgart E-Mail: horlacher(a)tik.uni-stuttgart.de Allmandring 30a Tel: ++49-711-68565868 70569 Stuttgart (Germany) WWW: http://www.tik.uni-stuttgart.de/ REF:<45835cd9-b239-d80c-38a0-3f978132e40e(a)stunnel.org>

2 1

Errors in log
by Mark Hannig 13 Sep '16

13 Sep '16

Can you please help me. Stunnel has been working fine for months and I just started getting these errors in the last day or two. Thank you: 2016.09.11 13:43:38 LOG5[10]: Service [ssmtp] accepted connection from 46.101.193.127:33818 2016.09.11 13:43:40 LOG3[10]: SSL_accept: Peer suddenly disconnected 2016.09.11 13:43:40 LOG5[10]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.09.11 13:43:40 LOG5[11]: Service [ssmtp] accepted connection from 46.101.193.127:34154 2016.09.11 13:43:40 LOG3[11]: SSL_accept: 1408A10B: error:1408A10B:SSL routines:ssl3_get_client_hello:wrong version number 2016.09.11 13:43:40 LOG5[11]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.09.11 13:43:40 LOG5[12]: Service [ssmtp] accepted connection from 46.101.193.127:34254 2016.09.11 13:43:42 LOG3[12]: s_connect: connect 127.0.0.1:25: Connection refused (WSAECONNREFUSED) (10061) 2016.09.11 13:43:42 LOG5[12]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.09.11 17:22:39 LOG5[13]: Service [smtp-tls-wrapper] accepted connection from 127.0.0.1:58020 2016.09.11 17:22:39 LOG5[13]: s_connect: connected 52.35.228.26:465 2016.09.11 17:22:39 LOG5[13]: Service [smtp-tls-wrapper] connected remote server from 172.31.10.223:58021 2016.09.11 17:22:40 LOG5[13]: Connection closed: 7072 byte(s) sent to SSL, 369 byte(s) sent to socket 2016.09.11 17:22:40 LOG5[14]: Service [smtp-tls-wrapper] accepted connection from 127.0.0.1:58022 2016.09.11 17:22:40 LOG5[14]: s_connect: connected 52.35.58.187:465 2016.09.11 17:22:40 LOG5[14]: Service [smtp-tls-wrapper] connected remote server from 172.31.10.223:58023 2016.09.11 17:22:40 LOG5[14]: Connection closed: 7302 byte(s) sent to SSL, 361 byte(s) sent to socket -- Mark F. Hannig mhannig(a)gmail.com

2 2

Re: [stunnel-users] stunnel 5.x no answer in server mode?
by Ulli Horlacher 13 Sep '16

13 Sep '16

On Tue 2016-09-13 (12:10), Ma??gorzata Olszówka wrote: > > I use stunnel as a https proxy for my own http server (*). > > > > The server mode of stunnel 5.x does not work any more. > > It accepts the connection and then immediatelly closes it without sending > > back any data. > > stunnel 4.x is working fine (for many years!), with the same configuration. > > The client receives no data at all, the connection is closed by the server > > (stunnel). > > > > As I wrote: with stunnel 4.27 everything works as expected. Does stunnel > > 5.x need another configuration? > > The log messages show, that the child process terminated with code 1. > This is the point where you should start looking for the cause. The client fexsrv does not start at all with stunnel 5.x, whereas with stunnel 4.27 everything works fine. > It is impossible to say anything without analysis of the executed fexsrv > program. The problem cannot be in fexsrv, because it works with stunnel 4.27 -- Ullrich Horlacher Server und Virtualisierung Rechenzentrum TIK Universitaet Stuttgart E-Mail: horlacher(a)tik.uni-stuttgart.de Allmandring 30a Tel: ++49-711-68565868 70569 Stuttgart (Germany) WWW: http://www.tik.uni-stuttgart.de/ REF:<f0622f17-fd11-bdb8-4a82-9665463c0d64(a)olszowka.net>

1 0

Upgrade from 5.03 to 5.35
by Hon Quach 07 Sep '16

07 Sep '16

Hi, When I perform the upgrade the stunnel service won't start, it tries to load the pem files but it is failing. I noticed when I install stunnel on my test system, the conf file is different from the version 5.03. I'm looking for documentation a on how to perform a clean upgrade but I'm having difficulty finding that information. Thanks! Sent from my iPhone

1 0

stunnel 5.x no answer in server mode?
by Ulli Horlacher 31 Aug '16

31 Aug '16

I use stunnel as a https proxy for my own http server (*). The server mode of stunnel 5.x does not work any more. It accepts the connection and then immediatelly closes it without sending back any data. stunnel 4.x is working fine (for many years!), with the same configuration. Here is my (test) config which shows the problem (host is Ubuntu 16.04): root@xerus:/tmp# cat stunnel.conf pid = /tmp/stunnel.pid output = /home/fex/spool/stunneld.log debug = debug fips = no foreground = yes [https] accept = 443 cert = /home/fex/etc/stunnel.pem sslVersion = all TIMEOUTclose = 1 exec = perl execargs = perl -T /home/fex/bin/fexsrv stunnel root@xerus:/tmp# /opt/stunnel-5.35/bin/stunnel stunnel.conf 2016.08.30 18:58:55 LOG7[ui]: Clients allowed=500 2016.08.30 18:58:55 LOG5[ui]: stunnel 5.35 on x86_64-unknown-linux-gnu platform 2016.08.30 18:58:55 LOG5[ui]: Compiled/running with OpenSSL 1.0.2g-fips 1 Mar 2016 2016.08.30 18:58:55 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2016.08.30 18:58:55 LOG7[ui]: errno: (*__errno_location ()) 2016.08.30 18:58:55 LOG5[ui]: Reading configuration from file /tmp/stunnel.conf 2016.08.30 18:58:55 LOG5[ui]: UTF-8 byte order mark not detected 2016.08.30 18:58:55 LOG5[ui]: FIPS mode disabled 2016.08.30 18:58:55 LOG7[ui]: Compression disabled 2016.08.30 18:58:55 LOG7[ui]: Snagged 64 random bytes from /root/.rnd 2016.08.30 18:58:55 LOG7[ui]: Wrote 1024 new random bytes to /root/.rnd 2016.08.30 18:58:55 LOG7[ui]: PRNG seeded successfully 2016.08.30 18:58:55 LOG6[ui]: Initializing service [https] 2016.08.30 18:58:55 LOG6[ui]: Loading certificate from file: /home/fex/etc/stunnel.pem 2016.08.30 18:58:55 LOG6[ui]: Certificate loaded from file: /home/fex/etc/stunnel.pem 2016.08.30 18:58:55 LOG6[ui]: Loading private key from file: /home/fex/etc/stunnel.pem 2016.08.30 18:58:55 LOG6[ui]: Private key loaded from file: /home/fex/etc/stunnel.pem 2016.08.30 18:58:55 LOG7[ui]: Private key check succeeded 2016.08.30 18:58:55 LOG7[ui]: DH initialization 2016.08.30 18:58:55 LOG7[ui]: Using DH parameters from /home/fex/etc/stunnel.pem 2016.08.30 18:58:55 LOG6[ui]: 1024-bit DH parameters loaded 2016.08.30 18:58:55 LOG7[ui]: ECDH initialization 2016.08.30 18:58:55 LOG7[ui]: ECDH initialized with curve prime256v1 2016.08.30 18:58:55 LOG7[ui]: SSL options: 0x03004004 (+0x03004000, -0x00000000) 2016.08.30 18:58:55 LOG5[ui]: Configuration successful 2016.08.30 18:58:55 LOG7[ui]: Listening file descriptor created (FD=7) 2016.08.30 18:58:55 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2016.08.30 18:58:55 LOG7[ui]: Service [https] (FD=7) bound to 0.0.0.0:443 2016.08.30 18:58:55 LOG7[ui]: Created pid file /tmp/stunnel.pid (here comes the https client connect) 2016.08.30 18:59:20 LOG7[ui]: Found 1 ready file descriptor(s) 2016.08.30 18:59:20 LOG7[ui]: FD=4 events=0x2001 revents=0x0 2016.08.30 18:59:20 LOG7[ui]: FD=7 events=0x2001 revents=0x1 2016.08.30 18:59:20 LOG7[ui]: Service [https] accepted (FD=3) from 127.0.0.1:44166 2016.08.30 18:59:20 LOG7[0]: Service [https] started 2016.08.30 18:59:20 LOG7[0]: Option TCP_NODELAY set on local socket 2016.08.30 18:59:20 LOG5[0]: Service [https] accepted connection from 127.0.0.1:44166 2016.08.30 18:59:20 LOG6[0]: Peer certificate not required 2016.08.30 18:59:20 LOG7[0]: SSL state (accept): before/accept initialization 2016.08.30 18:59:20 LOG7[0]: SNI: no virtual services defined 2016.08.30 18:59:20 LOG7[0]: New session callback 2016.08.30 18:59:20 LOG7[0]: 1 server accept(s) requested 2016.08.30 18:59:20 LOG7[0]: 1 server accept(s) succeeded 2016.08.30 18:59:20 LOG7[0]: 0 server renegotiation(s) requested 2016.08.30 18:59:20 LOG7[0]: 0 session reuse(s) 2016.08.30 18:59:20 LOG7[0]: 0 internal session cache item(s) 2016.08.30 18:59:20 LOG7[0]: 0 internal session cache fill-up(s) 2016.08.30 18:59:20 LOG7[0]: 0 internal session cache miss(es) 2016.08.30 18:59:20 LOG7[0]: 0 external session cache hit(s) 2016.08.30 18:59:20 LOG7[0]: 0 expired session(s) retrieved 2016.08.30 18:59:20 LOG6[0]: SSL accepted: new session negotiated 2016.08.30 18:59:20 LOG6[0]: No peer certificate received 2016.08.30 18:59:20 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES128-SHA256 (128-bit encryption) 2016.08.30 18:59:20 LOG7[0]: Compression: null, expansion: null 2016.08.30 18:59:20 LOG6[0]: Local mode child started (PID=30833) 2016.08.30 18:59:20 LOG7[0]: Option TCP_NODELAY set on remote socket 2016.08.30 18:59:20 LOG7[0]: Remote descriptor (FD=11) initialized 2016.08.30 18:59:20 LOG6[0]: Read socket closed (readsocket) 2016.08.30 18:59:20 LOG7[0]: Sending close_notify alert 2016.08.30 18:59:20 LOG7[0]: SSL alert (write): warning: close notify 2016.08.30 18:59:20 LOG6[0]: SSL_shutdown successfully sent close_notify alert 2016.08.30 18:59:20 LOG7[ui]: Found 1 ready file descriptor(s) 2016.08.30 18:59:20 LOG7[ui]: FD=4 events=0x2001 revents=0x1 2016.08.30 18:59:20 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2016.08.30 18:59:20 LOG7[ui]: Dispatching signals from the signal pipe 2016.08.30 18:59:20 LOG7[ui]: Processing SIGCHLD 2016.08.30 18:59:20 LOG6[ui]: Child process 30833 finished with code 1 2016.08.30 18:59:20 LOG7[ui]: Signal pipe is empty 2016.08.30 18:59:20 LOG3[0]: socket fd: Broken pipe (32) 2016.08.30 18:59:20 LOG6[0]: writesocket: Socket is closed 2016.08.30 18:59:20 LOG5[0]: Connection closed: 0 byte(s) sent to SSL, 23 byte(s) sent to socket 2016.08.30 18:59:20 LOG7[0]: Remote descriptor (FD=11) closed 2016.08.30 18:59:20 LOG7[0]: Local descriptor (FD=3) closed 2016.08.30 18:59:20 LOG7[0]: Service [https] finished (0 left) The client receives no data at all, the connection is closed by the server (stunnel). As I wrote: with stunnel 4.27 everything works as expected. Does stunnel 5.x need another configuration? (*) http://fex.rus.uni-stuttgart.de/ -- Ullrich Horlacher Server und Virtualisierung Rechenzentrum TIK Universitaet Stuttgart E-Mail: horlacher(a)tik.uni-stuttgart.de Allmandring 30a Tel: ++49-711-68565868 70569 Stuttgart (Germany) WWW: http://www.tik.uni-stuttgart.de/ REF:<20160831074057.GA13703(a)rus.uni-stuttgart.de>

1 0

Issue with stunnel over squid
by Mike McPhee 30 Aug '16

30 Aug '16

Hello, I have a windows machine running as a stunnel client that establishes a session but then, when launching an SSH session to my loopback crashes. Putty reports that the "Server unexpectedly closed the network connection." Here are the logs: 2016.08.30 16:06:08 LOG5[main]: Reading configuration from file stunnel.conf 2016.08.30 16:06:08 LOG5[main]: UTF-8 byte order mark detected 2016.08.30 16:06:08 LOG5[main]: FIPS mode disabled 2016.08.30 16:06:08 LOG4[main]: Service [squid] needs authentication to prevent MITM attacks 2016.08.30 16:06:08 LOG5[main]: Configuration successful 2016.08.30 16:06:17 LOG5[2]: Service [squid] accepted connection from 127.0.0.1:55791 2016.08.30 16:06:17 LOG5[2]: s_connect: connected 10.5.8.74:8888 2016.08.30 16:06:17 LOG5[2]: Service [squid] connected remote server from 10.5.8.69:55792 2016.08.30 16:06:17 LOG5[2]: Connection closed: 28 byte(s) sent to SSL, 0 byte(s) sent to socket Here is the server-side stunnel.conf: sslVersion = all options = NO_SSLv2 client = no cert = /etc/stunnel/server.pem pid = /var/run/stunnel.pid output = /var/log/stunnel [squid] accept = 8888 connect = 127.0.0.1:3128 cert = /etc/stunnel/stunnel.pem [openvpn] client = no accept = 993 connect = 34567 Here is the client side (Windows 7): cert = stunnel.pem client = yes [squid] accept = 127.0.0.1:8080 connect = 10.5.8.74:8443 I seem to be negotiating all of the appropriate keys, openvpn and squid3 are verified running, and have iptables configured, so I am not sure what I am missing. Can anyone assist? Thanks in advance! Mike

1 0

-reopen for Ubuntu?
by mguyre＠comcast.net 24 Aug '16

24 Aug '16

Are there any plans to add the -reopen functionality to other operating systems? Thanks Mike

1 0

[Stunnel] [Android x86] Compilation
by John Fisherman 22 Aug '16

22 Aug '16

Dear all, I am currently trying to make stunnel work for an Android x86 architecture. The android binary found on the stunnel official website is not supported on x86 architecture, so I'd like to cross-compile it myself using the 'configure' options. I did not find much informations about this around the web, could you give me some advices or at least tell me if it is possible to make Stunnel work on an Android x86 device ? Thanks in advance, Regards, - John

1 0

Stunnel exits with timeout
by SP 19 Aug '16

19 Aug '16

Summary of problem (configuration and log details below): I am attempting to configure Stunnel to run a pop3s service on our server so that users can retrieve email securely. Stunnel is started as a systemctl service. If I include both the following in the stunnel.conf: accept = mail.myserver.net:995 connect = localhost:110 then systemctl will exit immediately with: Service [pop3s]: Each service must define two endpoints stunnel.service: Control process exited, code=exited status=1 Failed to start SSL tunnel for network daemons. If I comment the connect to 110 then it will start and hang then eventually timeout: stunnel.service: Failed with result 'timeout'. Below is my stunnel.conf and log excerpt from the start with the connect to 110 commented out. I would greatly appreciate any advice. ---stunnel.conf setuid = nobody setgid = nobody pid = /usr/local/var/lib/stunnel/var/run/stunnel.pid foreground = yes ;debug = info debug = 7 sslVersion = TLSv1.2 output = /usr/local/var/lib/stunnel/var/log/stunnel.log ;ciphers = HIGH:MEDIUM:+DH:!SSLv2:!aNULL:+SHA256:+SHA1:+MD5 ciphers = HIGH:+3DES:+DH:!aNULL:!SSLv2 transparent = yes delay = no fips = no compression = deflate client = no [pop3s] accept = mail.myserver.net:995 ;connect = localhost:110 cert = /etc/stunnel/stunnel.pem key = /etc/stunnel/stunnel.pem exec = /usr/local/sbin/gnu-pop3d execargs = --debug=000 --mdn --timeout=60 --ipv6 ----log excerpt ----- 2016.08.17 15:08:55 LOG7[ui]: Clients allowed=500 2016.08.17 15:08:55 LOG5[ui]: stunnel 5.35 on x86_64-unknown-linux-gnu platform 2016.08.17 15:08:55 LOG5[ui]: Compiled/running with OpenSSL 1.0.2h 3 May 2016 2016.08.17 15:08:55 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2016.08.17 15:08:55 LOG7[ui]: errno: (*__errno_location ()) 2016.08.17 15:08:55 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf 2016.08.17 15:08:55 LOG5[ui]: UTF-8 byte order mark not detected 2016.08.17 15:08:55 LOG7[cron]: Cron thread initialized 2016.08.17 15:08:55 LOG5[ui]: FIPS mode disabled 2016.08.17 15:08:55 LOG6[ui]: Compression enabled: 1 method(s) 2016.08.17 15:08:55 LOG7[ui]: Snagged 64 random bytes from /dev/urandom 2016.08.17 15:08:55 LOG7[ui]: PRNG seeded successfully 2016.08.17 15:08:55 LOG6[ui]: Initializing service [pop3s] 2016.08.17 15:08:55 LOG6[ui]: Loading certificate from file: /etc/stunnel/stunnel.pem 2016.08.17 15:08:55 LOG6[ui]: Certificate loaded from file: /etc/stunnel/stunnel.pem 2016.08.17 15:08:55 LOG6[ui]: Loading private key from file: /etc/stunnel/stunnel.pem 2016.08.17 15:08:55 LOG6[ui]: Private key loaded from file: /etc/stunnel/stunnel.pem 2016.08.17 15:08:55 LOG7[ui]: Private key check succeeded 2016.08.17 15:08:55 LOG7[ui]: DH initialization 2016.08.17 15:08:55 LOG7[ui]: Could not load DH parameters from /etc/stunnel/stunnel.pem 2016.08.17 15:08:55 LOG6[ui]: Using dynamic DH parameters 2016.08.17 15:08:55 LOG7[ui]: ECDH initialization 2016.08.17 15:08:55 LOG7[ui]: ECDH initialized with curve prime256v1 2016.08.17 15:08:55 LOG7[ui]: SSL options: 0x03004004 (+0x03004000, -0x00000000) 2016.08.17 15:08:55 LOG5[ui]: Configuration successful 2016.08.17 15:08:55 LOG7[ui]: Listening file descriptor created (FD=7) 2016.08.17 15:08:55 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2016.08.17 15:08:55 LOG7[ui]: Service [pop3s] (FD=7) bound to 60.62.114.105:995 2016.08.17 15:08:55 LOG6[cron]: Executing cron jobs 2016.08.17 15:08:55 LOG7[ui]: Created pid file /usr/local/var/lib/stunnel/var/run/stunnel.pid 2016.08.17 15:08:55 LOG5[cron]: Updating DH parameters 2016.08.17 15:10:01 LOG5[cron]: DH parameters updated 2016.08.17 15:10:01 LOG6[cron]: Cron jobs completed in 66 seconds 2016.08.17 15:10:01 LOG7[cron]: Waiting 86334 seconds 2016.08.17 15:10:25 LOG7[ui]: Found 1 ready file descriptor(s) 2016.08.17 15:10:25 LOG7[ui]: FD=4 events=0x2001 revents=0x1 2016.08.17 15:10:25 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2016.08.17 15:10:25 LOG7[ui]: Dispatching signals from the signal pipe 2016.08.17 15:10:25 LOG7[ui]: Processing SIGNAL_TERMINATE 2016.08.17 15:10:25 LOG5[ui]: Terminated 2016.08.17 15:10:25 LOG7[ui]: Closing service [pop3s] 2016.08.17 15:10:25 LOG7[ui]: Service [pop3s] closed (FD=7) 2016.08.17 15:10:25 LOG7[ui]: Service [pop3s] closed 2016.08.17 15:10:25 LOG7[ui]: removing pid file /usr/local/var/lib/stunnel/var/run/stunnel.pid

2 6

Logging Issues Causing Crash?
by Randall LeJeune 08 Aug '16

08 Aug '16

Hello all, Has anyone experienced a full log file causing stunnel issues in the past? We tried upgrading from 4.56 to 5.17 and the upgrade seemed to go fine at first, but a day or so later we began to have some disconnects. Later we downgraded to 5.01 which worked OK at first, but then we ran into the same kinds of problems again after a few days. We eventually put the stunnel.log file on a separate filesystem, but I am curious, has anyone else experienced any issues like this? Thanks, Randy

3 2

Config was working. Now it isn't after reboot
by Lee Savidge 02 Aug '16

02 Aug '16

I just reinstalled stunnel the latest version. When running I went through the creation of the pem file. I put in UK for the country code and the company name and put a . for everything else. It finished, I start the GUI and it works. I edited the config file to comment out the gmail IMAP section and reload it and it was fine. I rebooted, now it tells me tehre is an error in the config file. Why? I keep getting this problem. Rebooting seems to break the config somehow. Log shows this when stunnel starts: [ ] Cron thread initialized [ ] Running on Windows 6.1 [ ] No limit detected for the number of clients [.] stunnel 5.35 on x86-pc-msvc-1500 platform [.] Compiled/running with OpenSSL 1.0.2h-fips 3 May 2016 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] GUI message loop initialized [ ] Running on Windows 6.1 [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark detected [.] FIPS mode disabled [ ] Compression disabled [ ] Snagged 64 random bytes from C:/.rnd [ ] Wrote 1024 new random bytes to C:/.rnd [ ] PRNG seeded successfully [ ] Initializing service [gmail-pop3] [ ] No certificate or private key specified [ ] SSL options: 0x03000004 (+0x03000000, -0x00000000) [ ] Initializing service [gmail-smtp] [ ] No certificate or private key specified [ ] SSL options: 0x03000004 (+0x03000000, -0x00000000) [.] Configuration successful [ ] Listening file descriptor created (FD=388) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [ ] Service [gmail-pop3] (FD=388) bound to 127.0.0.1:110 [ ] Listening file descriptor created (FD=392) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [!] bind: Permission denied (WSAEACCES) (10013) [!] Error binding service [gmail-smtp] to 127.0.0.1:25 [ ] Closing service [gmail-pop3] [ ] Service [gmail-pop3] closed (FD=388) [ ] Service [gmail-pop3] closed [ ] Closing service [gmail-smtp] [ ] Service [gmail-smtp] closed [!] Server is down [ ] Executing cron jobs [ ] Cron jobs completed in 0 seconds [ ] Waiting 86400 seconds The config file contains this: debug = debug output = stunnel.log [gmail-pop3] client = yes accept = 127.0.0.1:110 connect = pop.gmail.com:995 verifyChain = yes CAfile = ca-certs.pem checkHost = pop.gmail.com OCSPaia = yes [gmail-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.gmail.com:465 verifyChain = yes CAfile = ca-certs.pem checkHost = smtp.gmail.com OCSPaia = yes I have pasted in only the stuff that isn't commented out. Why does this not work after a reboot? It makes no sense. -- =-----------------= Lee Savidge =-----------------= --

2 2

Installation problem on Windows 2003
by Tom Eberhard 01 Aug '16

01 Aug '16

Hello stunnel-users: I'm trying to install stunnel 5.35 on a Windows 2003 box, 32-bit. The installer runs to completion, but we get an error from SimpleFC: SimpleFC::AddApplication failed to add stunnel What is causing this error to come up, and what do I have to do to fix it? Googling just showed that SimpleFC is a plugin to interact with the Windows Firewall. Thanks, Tom This e-mail is intended solely for the person or entity to which it is addressed and may contain confidential and/or privileged information. Any review, dissemination, copying, printing or other use of this e-mail by persons or entities other than the addressee is prohibited. If you have received this e-mail in error, please contact the sender immediately and delete the material from any computer.

1 0

Client-side SNI
by Vincent Deschenes 01 Aug '16

01 Aug '16

Hi, Anyone know if there is anything special to do to get ServerName sent when using stunnel in client mode to be able to connect to SNI enabled server? Using latest version of stunnel and openssl. Will stunnel use the name specified in the "connect=" config ? Thanks, Regards, Vincent Deschenes Ing. PMP Director of Operations Stelvio Inc. (+1) 514-281-8570

1 2

stunnel only sends some emails, not all, and only on second attempt
by Martin Jaquess 28 Jul '16

28 Jul '16

Hi I'm using the latest Stunnel (5.35), running under Windows Server 2000, to download emails from Outlook(Office365)/Outlook 2016 to another email client called OfficeTalk which only supports unencrypted POP3, so it can't access Outlook directly. First problem is that although most emails are downloaded without problem, some stubbornly and consistently refuse to be downloaded. This omission doesn't seem related to attachments, encoding, size, date, or anything else that I can see. Has anyone else experienced this or have any idea why it might be happening?? Second problem is that the first download doesn't produce anything, but if I run the request again, it works - the only difference in the log files is the IP addresses I'd greatly appreciate any advice on this - I've checked the threads but can't find anything similar. Many thanks in advance Martin Config file for all attempts is:debug=7 output = c:\program files\stunnel\stunnel.log [outlook-pop3] client = yes accept = 127.0.0.1:110 connect = outlook.office365.com:995 Logfile for successful download of one email is:12:49:50 LOG7[cron]: Cronthread initialized12:49:50 LOG7[main]: Runningon Windows 5.012:49:50 LOG7[main]: No limitdetected for the number of clients12:49:50 LOG5[main]: stunnel5.35 on x86-pc-msvc-1500 platform12:49:50 LOG5[main]:Compiled/running with OpenSSL 1.0.2h-fips 3 May 201612:49:50 LOG5[main]:Threading:WIN32 Sockets:SELECT,IPv4 TLS:ENGINE,FIPS,OCSP,PSK,SNI12:49:50 LOG7[main]: errno:(*_errno())12:49:50 LOG7[ui]: GUImessage loop initialized12:49:50 LOG7[main]: Runningon Windows 5.012:49:50 LOG5[main]: Reading configurationfrom file stunnel.conf12:49:50 LOG5[main]: UTF-8byte order mark detected12:49:50 LOG5[main]: FIPSmode disabled12:49:50 LOG7[main]:Compression disabled12:49:50 LOG7[main]: Snagged64 random bytes from C:/.rnd12:49:50 LOG7[main]: Wrote1024 new random bytes to C:/.rnd12:49:50 LOG7[main]: PRNGseeded successfully12:49:50 LOG6[main]:Initializing service [outlook-pop3]12:49:50 LOG7[main]: Nocertificate or private key specified12:49:50 LOG4[main]: Service[outlook-pop3] needs authentication to prevent MITM attacks12:49:50 LOG7[main]: SSLoptions: 0x03000004 (+0x03000000, -0x00000000)12:49:50 LOG5[main]:Configuration successful12:49:50 LOG7[main]:Listening file descriptor created (FD=344)12:49:50 LOG7[main]: Service[outlook-pop3] (FD=344) bound to 127.0.0.1:11012:49:53 LOG7[main]: Found 1ready file descriptor(s)12:49:53 LOG7[main]: FD=204ifds=r-x ofds=---12:49:53 LOG7[main]: Service[outlook-pop3] accepted (FD=356) from 127.0.0.1:380112:49:53 LOG7[main]: Creatinga new thread12:49:53 LOG7[main]: Newthread created12:49:53 LOG7[0]: Service[outlook-pop3] started12:49:53 LOG7[0]: OptionTCP_NODELAY set on local socket12:49:53 LOG5[0]: Service[outlook-pop3] accepted connection from 127.0.0.1:380112:49:53 LOG6[0]: failover:round-robin, starting at entry #112:49:53 LOG6[0]: s_connect:connecting 132.245.224.162:99512:49:53 LOG7[0]: s_connect:s_poll_wait 132.245.224.162:995: waiting 10 seconds12:49:53 LOG5[0]: s_connect:connected 132.245.224.162:99512:49:53 LOG5[0]: Service[outlook-pop3] connected remote server from 192.168.15.102:380212:49:53 LOG7[0]: OptionTCP_NODELAY set on remote socket12:49:53 LOG7[0]: Remotedescriptor (FD=380) initialized12:49:53 LOG6[0]: SNI:sending servername: outlook.office365.com12:49:53 LOG6[0]: Peercertificate not required12:49:53 LOG7[0]: SSL state(connect): before/connect initialization12:49:53 LOG7[0]: SSL state(connect): SSLv2/v3 write client hello A12:49:53 LOG7[0]: SSL state(connect): SSLv3 read server hello A12:49:53 LOG6[0]: Certificateverification disabled12:49:53 LOG6[0]: Certificateverification disabled12:49:53 LOG7[0]: SSL state(connect): SSLv3 read server certificate A12:49:53 LOG7[0]: SSL state(connect): SSLv3 read server key exchange A12:49:53 LOG6[0]: Clientcertificate not requested12:49:53 LOG7[0]: SSL state(connect): SSLv3 read server done A12:49:53 LOG7[0]: SSL state(connect): SSLv3 write client key exchange A12:49:53 LOG7[0]: SSL state(connect): SSLv3 write change cipher spec A12:49:53 LOG7[0]: SSL state(connect): SSLv3 write finished A12:49:53 LOG7[0]: SSL state(connect): SSLv3 flush data12:49:53 LOG7[0]: SSL state(connect): SSLv3 read finished A12:49:53 LOG7[0]: 1 client connect(s) requested12:49:53 LOG7[0]: 1 client connect(s) succeeded12:49:53 LOG7[0]: 0 client renegotiation(s) requested12:49:53 LOG7[0]: 0 session reuse(s)12:49:53 LOG6[0]: SSLconnected: new session negotiated12:49:53 LOG7[0]: Peercertificate was cached (4882 bytes)12:49:53 LOG6[0]: NegotiatedTLSv1.2 ciphersuite ECDHE-RSA-AES256-SHA384 (256-bit encryption)12:49:53 LOG7[0]:Compression: null, expansion: null12:49:54 LOG6[0]: Read socketclosed (readsocket)12:49:54 LOG7[0]: Sendingclose_notify alert12:49:54 LOG7[0]: SSL alert(write): warning: close notify12:49:54 LOG6[0]:SSL_shutdown successfully sent close_notify alert12:49:54 LOG7[main]: Found 1ready file descriptor(s)12:49:54 LOG7[main]: FD=204ifds=r-x ofds=---12:49:54 LOG7[main]: Service[outlook-pop3] accepted (FD=404) from 127.0.0.1:380312:49:54 LOG7[main]: Creatinga new thread12:49:54 LOG7[main]: Newthread created12:49:54 LOG7[1]: Service[outlook-pop3] started12:49:54 LOG7[1]: OptionTCP_NODELAY set on local socket12:49:54 LOG5[1]: Service[outlook-pop3] accepted connection from 127.0.0.1:380312:49:54 LOG6[1]: failover:round-robin, starting at entry #212:49:54 LOG6[1]: s_connect:connecting 132.245.212.98:99512:49:54 LOG7[1]: s_connect:s_poll_wait 132.245.212.98:995: waiting 10 seconds12:49:54 LOG6[0]: SSL socketclosed (SSL_read)12:49:54 LOG7[0]: Sent socketwrite shutdown12:49:54 LOG5[0]: Connectionclosed: 67 byte(s) sent to SSL, 11900 byte(s) sent to socket12:49:54 LOG7[0]: Remotedescriptor (FD=380) closed12:49:54 LOG7[0]: Local descriptor(FD=356) closed12:49:54 LOG7[0]: Service[outlook-pop3] finished (1 left)12:49:54 LOG5[1]: s_connect:connected 132.245.212.98:99512:49:54 LOG5[1]: Service[outlook-pop3] connected remote server from 192.168.15.102:380412:49:54 LOG7[1]: OptionTCP_NODELAY set on remote socket12:49:54 LOG7[1]: Remotedescriptor (FD=428) initialized12:49:54 LOG6[1]: SNI:sending servername: outlook.office365.com12:49:54 LOG6[1]: Peercertificate not required12:49:54 LOG7[1]: SSL state(connect): before/connect initialization12:49:54 LOG7[1]: SSL state(connect): SSLv3 write client hello A12:49:54 LOG7[1]: SSL state(connect): SSLv3 read server hello A12:49:54 LOG6[1]: Certificateverification disabled12:49:54 LOG6[1]: Certificateverification disabled12:49:54 LOG7[1]: SSL state(connect): SSLv3 read server certificate A12:49:54 LOG7[1]: SSL state(connect): SSLv3 read server key exchange A12:49:54 LOG6[1]: Clientcertificate not requested12:49:54 LOG7[1]: SSL state(connect): SSLv3 read server done A12:49:54 LOG7[1]: SSL state(connect): SSLv3 write client key exchange A12:49:54 LOG7[1]: SSL state(connect): SSLv3 write change cipher spec A12:49:54 LOG7[1]: SSL state(connect): SSLv3 write finished A12:49:54 LOG7[1]: SSL state(connect): SSLv3 flush data12:49:54 LOG7[1]: SSL state(connect): SSLv3 read finished A12:49:54 LOG7[1]: 2 client connect(s) requested12:49:54 LOG7[1]: 2 client connect(s) succeeded12:49:54 LOG7[1]: 0 client renegotiation(s) requested12:49:54 LOG7[1]: 0 session reuse(s)12:49:54 LOG6[1]: SSLconnected: new session negotiated12:49:54 LOG7[1]:Deallocating application specific data for addr index12:49:54 LOG6[1]: NegotiatedTLSv1.2 ciphersuite ECDHE-RSA-AES256-SHA384 (256-bit encryption)12:49:54 LOG7[1]:Compression: null, expansion: null12:49:56 LOG6[1]: Read socketclosed (readsocket)12:49:56 LOG7[1]: Sendingclose_notify alert12:49:56 LOG7[1]: SSL alert(write): warning: close notify12:49:56 LOG6[1]:SSL_shutdown successfully sent close_notify alert12:49:56 LOG6[1]: SSL socketclosed (SSL_read)12:49:56 LOG7[1]: Sent socketwrite shutdown12:49:56 LOG5[1]: Connectionclosed: 67 byte(s) sent to SSL, 11884 byte(s) sent to socket12:49:56 LOG7[1]: Remotedescriptor (FD=428) closed12:49:56 LOG7[1]: Localdescriptor (FD=404) closed12:49:56 LOG7[1]: Service[outlook-pop3] finished (0 left)

1 0

HTTPS proxy tunnel. ssl handshake failure
by Kirill Franko 22 Jul '16

22 Jul '16

1 1

AiX 7.1 TL3 SP6 - Stunnel Memory Usages grows after 24 hours
by Benjamin, Earl 19 Jul '16

19 Jul '16

Hello Everyone, I am running Stunnel-5.29 in AiX 7.1 TL3 SP6. I have added the DH param to the bottom of my CERT file. After approximately 24 hours or so the Stunnel CPU usage jumps to about 50% and after a few days to about 90%. Is there a configuration setting I've missed or compile option I need to consider? Thanks for your assistance in advance. Below is a cleaned up version of my config file. -Earl ------------------------------------------------- ; Verify peer certificate verify = 2 ; Certificate/key is needed in server mode and in client mode cert = /Server-certificate-all.pem key = /Server-certificate-all.pem CAfile = /all_root_ca.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = TLSv1 ; PID path pid = /etc/oraserver_stunnel.pid ; Turn off Nagle algorithm socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Debug level debug = 2 ; Use it for client mode client = no ; Ciphers ciphers = DHE-RSA-AES256-SHA ; Service-level configuration [ oraserver_DB ] accept = 15210 connect = server:1622 [ oraserver_ASM ] accept = 15211 connect = server:1621 This message and any attachments are solely for the use of intended recipients. The information contained herein may include trade secrets, protected health or personal information, privileged or otherwise confidential information. Unauthorized review, forwarding, printing, copying, distributing, or using such information is strictly prohibited and may be unlawful. If you are not an intended recipient, you are hereby notified that you received this email in error, and that any review, dissemination, distribution or copying of this email and any attachment is strictly prohibited. If you have received this email in error, please contact the sender and delete the message and any attachment from your system. Thank you for your cooperation

1 0

Man in the middle attack possibility
by Abhinav Srivastava 19 Jul '16

19 Jul '16

Hi, I'm trying to use stunnel to provide encryption for my application to server communication. Server is already ssl aware. I configured my app to talk to localhost:xyz, and configured stunnel in client mode to relay traffic from localhost:<xyz> to actual service. The stunnel to service ssl protocol would use the server certificate, as server is already ssl aware. For any reason if stunnel is not running it would become possible for a non-elevated attacker/malware to spin up a tcp server listening to xyz, essentially taking advantage of my re-configuration of app to talk to localhost:xyz, and spoof the actual server. Even if my app to server protocol had some anti-spoofing mechanism say e.g., reverse CHAP, the malware can easily relay the challenge and response by using the actual service. In my case the actual app is iscsi initiator software that is not in my control and cant be modified, while the server is an iscsi tcp server which I am free to modify. Are there any guidance/best practices around preventing this attack with stunnel? Thanks Abhinav

1 0

Client certificates now required by default?
by Wiest, Damian 07 Jul '16

07 Jul '16

After building stunnel 5.34 from source I noticed that my old config (5.22) was not working. [dwiest@716161-compute2 ~]$ sudo ./stunnel /etc/stunnel/stunnel.conf 2016.07.07 14:07:41 LOG5[ui]: stunnel 5.34 on x86_64-unknown-linux-gnu platform 2016.07.07 14:07:41 LOG5[ui]: Compiled/running with OpenSSL 1.0.1e-fips 11 Feb 2013 2016.07.07 14:07:41 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP 2016.07.07 14:07:41 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf 2016.07.07 14:07:41 LOG5[ui]: UTF-8 byte order mark not detected 2016.07.07 14:07:41 LOG5[ui]: FIPS mode disabled 2016.07.07 14:07:41 LOG5[ui]: Configuration successful 2016.07.07 14:07:41 LOG5[cron]: Updating DH parameters 2016.07.07 14:07:42 LOG5[0]: Service [rabbitmq] accepted connection from 192.168.237.81:49535 2016.07.07 14:07:42 LOG3[0]: SSL_accept: Peer suddenly disconnected 2016.07.07 14:07:42 LOG5[0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.07.07 14:07:42 LOG5[1]: Service [rabbitmq] accepted connection from 192.168.237.81:49536 2016.07.07 14:07:42 LOG3[1]: SSL_accept: 140890C7: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate But I haven't enabled client certificate verification! [dwiest@716161-compute2 ~]$ sudo grep verify /etc/stunnel/stunnel.conf ; verify = 2 I have to explicitly set verify to 0 or 1 in order to connect without a client cert. Is this intentional? The documentation suggests that by default no verification should be taking place. -Damian -- Confidentiality Notice: This e-mail transmission may contain confidential or legally privileged information that is intended only for the individual or entity named in the e-mail address. If you have received this communication in error, please notify me by return e-mail, and destroy this communication and all copies thereof, including any attachments. Apervita ® is a registered trademark of Apervita Inc.

1 0

stunnel and hosts.allow
by Yousef Alhashemi 05 Jul '16

05 Jul '16

Hi, This may be a little bit off-topic, but does anyone here use stunnel with pan? My connections to stunnel (in pan) are always refused by libwrap. I was looking for the right rule to add to /etc/hosts.allow but nothing seems to work aside from "ALL : ALL" (which is obviously not good) and "nntps: KNOWN". Is the latter reasonable? The hosts_access(5) manpage is confusing to say the least. It mentions that daemon (the first token on any line) is the name of the daemon running the process, which would be "stunnel" in my case, but using "stunnel : LOCAL" or even "stunnel : ALL" doesn't work. The rule that seems to work, as mentioned, is "nntps : KNOWN" ("nntps" being the group name in stunnel.conf). What's even more confusing to me is that "nntps : LOCAL" does not work either. Nor does "nntps : localhost 127.0.0.1", "nntps : localhost", "nntps : 127.0.0.1", or "nntps : 192.168.1.". Pan is running on the same machine as stunnel so all connections must be coming from localhost. Why do these rules not trigger? Either way, I'd like to know the "least permissive" hosts.allow rule that would allow me to connect to my news provider from pan, and/or whether "nntps : KNOWN" is a safe option. Thanks, Yousef

3 6

Another OpenSSL 1.1.x patch - no ssl23.h any more
by Peter Pentchev 27 Jun '16

27 Jun '16

Hi, What do you think about the attached patch that fixes yet another OpenSSL 1.1.x compilation problem: the OpenSSL developers dropped the ssl23.h file altogether? Thanks for your work on stunnel! G'luck, Peter -- Peter Pentchev roam(a)ringlet.net roam(a)FreeBSD.org pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

1 0

Failed to redirect http to https
by Doris Hongmei 27 Jun '16

27 Jun '16

Hi Support, I setup stunnel to a web server with apache Configuration like below, --- /usr/local/etc/stunnel/stunnel.conf ---------- ; It is recommended to drop root privileges if stunnel is started by root setuid = nobody setgid = nobody ; TLS front-end to a web server [https] accept = 443 connect = 127.0.0.1:80 cert = /usr/local/etc/stunnel/stunnel.pem --- end of /usr/local/etc/stunnel/stunnel.conf ---------- After stunnel started, https://xxx/ is working, http://xxx/ is also still working , which doesn't redirect to https://xxx automatically. As my understanding, all the connections from http should redirect to https through stunnel, right? What steps did I miss? I need your help. Thanks. [Ericsson]<http://www.ericsson.com/> DORIS HONGMEI Software Configuration Mgmt Engineer BUSS SA OSS&BSS BL CPM DU SEP GZ RelGrp Ericsson 5&6F, No 44-46 Jianzhong Road 510630,Guangzhou,Tian He Software Park, China Mobile +8613922114721 Office +862085117729 doris.hongmei(a)ericsson.com www.ericsson.com [http://www.ericsson.com/current_campaign]<http://www.ericsson.com/current_campaign> Legal entity: Ericsson, registered office in CGC . This Communication is Confidential. We only send and receive email on the basis of the terms set out at www.ericsson.com/email_disclaimer<http://www.ericsson.com/email_disclaimer>

2 2

Re: [stunnel-users] FW: Stunnel with IIS8 on server 2012 64 bit
by J. Michael Drew 24 Jun '16

24 Jun '16

Jose, I have discovered what I did wrong. I did the original stunnel installs from the command line and then installed the stunnel service from the command line as well. When I installed the stunnel service it would break the website. So I removed the service (I thought) then I copied a shortcut to stunnel.exe to the Win start up> program folder. Both sites started working on the servers as long as I was logged in through an RDP session. I uninstalled everything and reinstalled. Stunnel 5.32 installs a Windows GUI on Server 2012 as well so I went back and used the Windows server 2012 desktop applications to install the windows service and to stop the GUI application. Everything is now working as expected. It appears that I was running two instances of stunnel at the same time and I didn’t completely remove the original stunnel service. Thanks for all of your help, Cheers, Michael From: Josealf.rm [mailto:[email protected]] Sent: Thursday, June 23, 2016 2:37 PM To: J. Michael Drew Subject: Re: [stunnel-users] FW: Stunnel with IIS8 on server 2012 64 bit Hi Michael, Did my last suggestions help with your issue? Regards El 20 jun 2016, a las 18:00, J. Michael Drew <jmichaeldrew(a)hotmail.com> escribió: .Jose, I appreciate your patience. Internet - Clients : 443 -> : https://website.company.com/website/ ________Firewall___________ Web\Presentation Layer 2 Win 2012 Webservers (443) not currently connected to the production LB, application needs to work before connecting to LB. This configuration is first time on 64 bit OS… Win 2012. IIS 8 running Jakarta ISAPI Filter\Stunnel to redirect 9001 to 9009: _________Firewall\App Layer________ Port 9009 Connects to App server running Apache Application is working as expected as long as I am logged in to the IIS 8 server. I can telnet to the APP layer over 9009 and I can reach these websites externally as expected. Firewalls are good. Please let me know any other information you need. Thank you again, Michael From: Jose Alf. [mailto:[email protected]] Sent: Monday, June 20, 2016 4:32 PM To: J. Michael Drew Subject: Re: [stunnel-users] FW: Stunnel with IIS8 on server 2012 64 bit Michael, Please take this in constructive way. I am trying to help, but it looks like you need to do some reading and homework. Please check http://catb.org/~esr/faqs/smart-questions.html <http://catb.org/%7Eesr/faqs/smart-questions.html> I suggest you draw a picture of your environment and explain well what you're trying to achieve. Show your client, your backend server, your stunnel server, include the IPs and ports they're listening to and everything should be easier. Don't forget any firewalls thay may be in the way. Regards, Jose. _____ From: J. Michael Drew <jmichaeldrew(a)hotmail.com> To: 'Jose Alf.' <josealf(a)rocketmail.com> Sent: Monday, June 20, 2016 1:00 PM Subject: RE: [stunnel-users] FW: Stunnel with IIS8 on server 2012 64 bit Hi Jose, I made the changes you suggested, but I am still getting the same behavior. My external address is: https://website.company.com/website I am not adding any ports to the address. Thanks so much for your help! Michael From: Jose Alf. [mailto:[email protected]] Sent: Monday, June 20, 2016 12:10 PM To: J. Michael Drew; stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] FW: Stunnel with IIS8 on server 2012 64 bit Michael, I guess what you want to do is to be able to connect to your internal Webserver via your Win2012 stunnel proxy using a URL like: https://yourwin2012dnsname:9001/ <https://yourwin2012dnsname:9009/> if that is correct, I suggest to adjust your configuration as follows: 1. Your stunnel mode must be server, not client. So adjust your service stanza as follows: [CLI9F529A0A] accept=9001 connect=10.xxx.xxx.xxx:9009 client=no 2. In your current configuration stunnel is listening only in the localhost ipv4 address (127.0.0.1). Therefore, you can only connect when you are logged on the server, you can't connect from a remote client. Hope this helps you clarify what's going on. Regards, Jose From: J. Michael Drew [mailto:[email protected]] Sent: Monday, June 20, 2016 9:54 AM To: 'Josealf.rm' Subject: RE: [stunnel-users] Stunnel with IIS8 on server 2012 64 bit Jose, Once logged in to the server I can open a browser on the server and connect through https://localhost/website and I can log in to the site externally as expected. Here are the log files from IIS and stunnel where stunnel is running as a service on the Windows 2012 server: When I am not logged in to the server it fails: #Software: Microsoft Internet Information Services 8.5 #Version: 1.0 #Date: 2016-06-20 00:30:21 #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken 2016-06-20 00:30:21 159.xxx.xxx.xxx HEAD / - 443 - 190.xxx.xxx.xxx - - 200 0 0 1218 #Software: Microsoft Internet Information Services 8.5 #Version: 1.0 #Date: 2016-06-20 05:41:01 #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken 2016-06-20 05:41:01 10.xxx.xxx.xxx OPTIONS /C$/windows/system32/NTDLL.DLL - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 200 0 0 500 2016-06-20 05:41:01 10.xxx.xxx.xxx PROPFIND /C$/windows/system32/NTDLL.DLL - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 46 2016-06-20 05:41:01 10.xxx.xxx.xxx PROPFIND /C$/windows/system32 - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 218 2016-06-20 05:41:16 10.xxx.xxx.xxx PROPFIND /patch-{682810b5-36dc-4e5d-81dd-6c02cd8f445b}-patchtoolsd.exe - 80 - 159.82.156.241 Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 64 62 2016-06-20 05:41:27 10.xxx.xxx.xxx PROPFIND /N$cl64.exe - 80 - 159.xxx.xxx.xxx 1 Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 62 2016-06-20 05:41:27 10.xxx.xxx.xxx PROPFIND /C$rome.dll - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 296 Stunell.conf: cert = extwebsvr_ver.pem ; Some performance tuning socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Peer Authentication verify = 2 CAfile = extwebsvr_root.pem ; Debug mode - useful for troubleshooting debug = 7 output = stunnel.log ; Client mode client = yes ; Setup tunnels to each EMS node [CLIxxxxxxxx)] accept=127.0.0.1:9001 connect=10.xxx.xxx.xxx:9009 Stunnel.log: 2016.06.20 09:17:39 LOG7[main]: No limit detected for the number of clients 2016.06.20 09:17:39 LOG5[main]: stunnel 5.27 on x86-pc-msvc-1500 platform 2016.06.20 09:17:39 LOG5[main]: Compiled/running with OpenSSL 1.0.2e-fips 3 Dec 2015 2016.06.20 09:17:39 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2016.06.20 09:17:39 LOG7[main]: errno: (*_errno()) 2016.06.20 09:17:39 LOG5[main]: Reading configuration from file stunnel.conf 2016.06.20 09:17:39 LOG7[ui]: GUI message loop initialized 2016.06.20 09:17:39 LOG7[cron]: Cron thread initialized 2016.06.20 09:17:39 LOG5[main]: UTF-8 byte order mark detected 2016.06.20 09:17:39 LOG6[main]: Initializing service [CLI9F529A0A] 2016.06.20 09:17:39 LOG6[main]: Loading certificate from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Certificate loaded from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Loading private key from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Private key loaded from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG7[main]: Private key check succeeded 2016.06.20 09:17:39 LOG4[main]: Service [CLIxxxxxxxx] uses "verify = 2" without subject checks 2016.06.20 09:17:39 LOG4[main]: Use "checkHost" or "checkIP" to restrict trusted certificates 2016.06.20 09:17:39 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2016.06.20 09:17:39 LOG5[main]: Configuration successful Thanks for your help, Michael From: Josealf.rm [mailto:[email protected]] Sent: Monday, June 20, 2016 8:01 AM To: J. Michael Drew Cc: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Stunnel with IIS8 on server 2012 64 bit Michael, Is your stunnel running as a service? Please post sanitized logs and configuration for a better diagnostic ... Regards Jose El 20 jun 2016, a las 6:39, J. Michael Drew <jmichaeldrew(a)hotmail.com> escribió: Hi, I have a website on IIS8 and am using stunnel to forward requests over 9009 inside to my application server. When I log in to the IIS server and stay logged in everything works as expected. When I log off the IIS 8 web server my site is unreachable with a “service is unavailable”. Can someone help me? Sincere thanks, Michael _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

2 1

Re: [stunnel-users] FW: Stunnel with IIS8 on server 2012 64 bit
by J. Michael Drew 22 Jun '16

22 Jun '16

.Jose, I appreciate your patience. Internet - Clients : 443 -> : https://website.company.com/website/ ________Firewall___________ Web\Presentation Layer 2 Win 2012 Webservers (443) not currently connected to the production LB, application needs to work before connecting to LB. This configuration is first time on 64 bit OS… Win 2012. IIS 8 running Jakarta ISAPI Filter\Stunnel to redirect 9001 to 9009: _________Firewall\App Layer________ Port 9009 Connects to App server running Apache Application is working as expected as long as I am logged in to the IIS 8 server. I can telnet to the APP layer over 9009 and I can reach these websites externally as expected. Firewalls are good. Please let me know any other information you need. Thank you again, Michael From: Jose Alf. [mailto:[email protected]] Sent: Monday, June 20, 2016 4:32 PM To: J. Michael Drew Subject: Re: [stunnel-users] FW: Stunnel with IIS8 on server 2012 64 bit Michael, Please take this in constructive way. I am trying to help, but it looks like you need to do some reading and homework. Please check http://catb.org/~esr/faqs/smart-questions.html <http://catb.org/%7Eesr/faqs/smart-questions.html> I suggest you draw a picture of your environment and explain well what you're trying to achieve. Show your client, your backend server, your stunnel server, include the IPs and ports they're listening to and everything should be easier. Don't forget any firewalls thay may be in the way. Regards, Jose. _____ From: J. Michael Drew <jmichaeldrew(a)hotmail.com> To: 'Jose Alf.' <josealf(a)rocketmail.com> Sent: Monday, June 20, 2016 1:00 PM Subject: RE: [stunnel-users] FW: Stunnel with IIS8 on server 2012 64 bit Hi Jose, I made the changes you suggested, but I am still getting the same behavior. My external address is: https://website.company.com/website I am not adding any ports to the address. Thanks so much for your help! Michael From: Jose Alf. [mailto:[email protected]] Sent: Monday, June 20, 2016 12:10 PM To: J. Michael Drew; stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] FW: Stunnel with IIS8 on server 2012 64 bit Michael, I guess what you want to do is to be able to connect to your internal Webserver via your Win2012 stunnel proxy using a URL like: https://yourwin2012dnsname:9001/ <https://yourwin2012dnsname:9009/> if that is correct, I suggest to adjust your configuration as follows: 1. Your stunnel mode must be server, not client. So adjust your service stanza as follows: [CLI9F529A0A] accept=9001 connect=10.xxx.xxx.xxx:9009 client=no 2. In your current configuration stunnel is listening only in the localhost ipv4 address (127.0.0.1). Therefore, you can only connect when you are logged on the server, you can't connect from a remote client. Hope this helps you clarify what's going on. Regards, Jose From: J. Michael Drew [mailto:[email protected]] Sent: Monday, June 20, 2016 9:54 AM To: 'Josealf.rm' Subject: RE: [stunnel-users] Stunnel with IIS8 on server 2012 64 bit Jose, Once logged in to the server I can open a browser on the server and connect through https://localhost/website and I can log in to the site externally as expected. Here are the log files from IIS and stunnel where stunnel is running as a service on the Windows 2012 server: When I am not logged in to the server it fails: #Software: Microsoft Internet Information Services 8.5 #Version: 1.0 #Date: 2016-06-20 00:30:21 #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken 2016-06-20 00:30:21 159.xxx.xxx.xxx HEAD / - 443 - 190.xxx.xxx.xxx - - 200 0 0 1218 #Software: Microsoft Internet Information Services 8.5 #Version: 1.0 #Date: 2016-06-20 05:41:01 #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken 2016-06-20 05:41:01 10.xxx.xxx.xxx OPTIONS /C$/windows/system32/NTDLL.DLL - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 200 0 0 500 2016-06-20 05:41:01 10.xxx.xxx.xxx PROPFIND /C$/windows/system32/NTDLL.DLL - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 46 2016-06-20 05:41:01 10.xxx.xxx.xxx PROPFIND /C$/windows/system32 - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 218 2016-06-20 05:41:16 10.xxx.xxx.xxx PROPFIND /patch-{682810b5-36dc-4e5d-81dd-6c02cd8f445b}-patchtoolsd.exe - 80 - 159.82.156.241 Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 64 62 2016-06-20 05:41:27 10.xxx.xxx.xxx PROPFIND /N$cl64.exe - 80 - 159.xxx.xxx.xxx 1 Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 62 2016-06-20 05:41:27 10.xxx.xxx.xxx PROPFIND /C$rome.dll - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 296 Stunell.conf: cert = extwebsvr_ver.pem ; Some performance tuning socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Peer Authentication verify = 2 CAfile = extwebsvr_root.pem ; Debug mode - useful for troubleshooting debug = 7 output = stunnel.log ; Client mode client = yes ; Setup tunnels to each EMS node [CLIxxxxxxxx)] accept=127.0.0.1:9001 connect=10.xxx.xxx.xxx:9009 Stunnel.log: 2016.06.20 09:17:39 LOG7[main]: No limit detected for the number of clients 2016.06.20 09:17:39 LOG5[main]: stunnel 5.27 on x86-pc-msvc-1500 platform 2016.06.20 09:17:39 LOG5[main]: Compiled/running with OpenSSL 1.0.2e-fips 3 Dec 2015 2016.06.20 09:17:39 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2016.06.20 09:17:39 LOG7[main]: errno: (*_errno()) 2016.06.20 09:17:39 LOG5[main]: Reading configuration from file stunnel.conf 2016.06.20 09:17:39 LOG7[ui]: GUI message loop initialized 2016.06.20 09:17:39 LOG7[cron]: Cron thread initialized 2016.06.20 09:17:39 LOG5[main]: UTF-8 byte order mark detected 2016.06.20 09:17:39 LOG6[main]: Initializing service [CLI9F529A0A] 2016.06.20 09:17:39 LOG6[main]: Loading certificate from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Certificate loaded from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Loading private key from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Private key loaded from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG7[main]: Private key check succeeded 2016.06.20 09:17:39 LOG4[main]: Service [CLIxxxxxxxx] uses "verify = 2" without subject checks 2016.06.20 09:17:39 LOG4[main]: Use "checkHost" or "checkIP" to restrict trusted certificates 2016.06.20 09:17:39 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2016.06.20 09:17:39 LOG5[main]: Configuration successful Thanks for your help, Michael From: Josealf.rm [mailto:[email protected]] Sent: Monday, June 20, 2016 8:01 AM To: J. Michael Drew Cc: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Stunnel with IIS8 on server 2012 64 bit Michael, Is your stunnel running as a service? Please post sanitized logs and configuration for a better diagnostic ... Regards Jose El 20 jun 2016, a las 6:39, J. Michael Drew <jmichaeldrew(a)hotmail.com> escribió: Hi, I have a website on IIS8 and am using stunnel to forward requests over 9009 inside to my application server. When I log in to the IIS server and stay logged in everything works as expected. When I log off the IIS 8 web server my site is unreachable with a “service is unavailable”. Can someone help me? Sincere thanks, Michael _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

2 1

MAC OS 32 bits
by Francisco Pereira 21 Jun '16

21 Jun '16

Is stunnel compatible with Mac Os 32-bit?Which installer should I consider for that?

1 0

FW: FW: Stunnel with IIS8 on server 2012 64 bit
by J. Michael Drew 20 Jun '16

20 Jun '16

From: J. Michael Drew [mailto:[email protected]] Sent: Monday, June 20, 2016 2:01 PM To: 'Jose Alf.' Subject: RE: [stunnel-users] FW: Stunnel with IIS8 on server 2012 64 bit Hi Jose, I made the changes you suggested, but I am still getting the same behavior. My external address is: https://website.company.com/website I am not adding any ports to the address. Thanks so much for your help! Michael From: Jose Alf. [mailto:[email protected]] Sent: Monday, June 20, 2016 12:10 PM To: J. Michael Drew; stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] FW: Stunnel with IIS8 on server 2012 64 bit Michael, I guess what you want to do is to be able to connect to your internal Webserver via your Win2012 stunnel proxy using a URL like: https://yourwin2012dnsname:9001/ <https://yourwin2012dnsname:9009/> if that is correct, I suggest to adjust your configuration as follows: 1. Your stunnel mode must be server, not client. So adjust your service stanza as follows: [CLI9F529A0A] accept=9001 connect=10.xxx.xxx.xxx:9009 client=no 2. In your current configuration stunnel is listening only in the localhost ipv4 address (127.0.0.1). Therefore, you can only connect when you are logged on the server, you can't connect from a remote client. Hope this helps you clarify what's going on. Regards, Jose From: J. Michael Drew [mailto:[email protected]] Sent: Monday, June 20, 2016 9:54 AM To: 'Josealf.rm' Subject: RE: [stunnel-users] Stunnel with IIS8 on server 2012 64 bit Jose, Once logged in to the server I can open a browser on the server and connect through https://localhost/website and I can log in to the site externally as expected. Here are the log files from IIS and stunnel where stunnel is running as a service on the Windows 2012 server: When I am not logged in to the server it fails: #Software: Microsoft Internet Information Services 8.5 #Version: 1.0 #Date: 2016-06-20 00:30:21 #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken 2016-06-20 00:30:21 159.xxx.xxx.xxx HEAD / - 443 - 190.xxx.xxx.xxx - - 200 0 0 1218 #Software: Microsoft Internet Information Services 8.5 #Version: 1.0 #Date: 2016-06-20 05:41:01 #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken 2016-06-20 05:41:01 10.xxx.xxx.xxx OPTIONS /C$/windows/system32/NTDLL.DLL - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 200 0 0 500 2016-06-20 05:41:01 10.xxx.xxx.xxx PROPFIND /C$/windows/system32/NTDLL.DLL - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 46 2016-06-20 05:41:01 10.xxx.xxx.xxx PROPFIND /C$/windows/system32 - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 218 2016-06-20 05:41:16 10.xxx.xxx.xxx PROPFIND /patch-{682810b5-36dc-4e5d-81dd-6c02cd8f445b}-patchtoolsd.exe - 80 - 159.82.156.241 Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 64 62 2016-06-20 05:41:27 10.xxx.xxx.xxx PROPFIND /N$cl64.exe - 80 - 159.xxx.xxx.xxx 1 Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 62 2016-06-20 05:41:27 10.xxx.xxx.xxx PROPFIND /C$rome.dll - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 296 Stunell.conf: cert = extwebsvr_ver.pem ; Some performance tuning socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Peer Authentication verify = 2 CAfile = extwebsvr_root.pem ; Debug mode - useful for troubleshooting debug = 7 output = stunnel.log ; Client mode client = yes ; Setup tunnels to each EMS node [CLIxxxxxxxx)] accept=127.0.0.1:9001 connect=10.xxx.xxx.xxx:9009 Stunnel.log: 2016.06.20 09:17:39 LOG7[main]: No limit detected for the number of clients 2016.06.20 09:17:39 LOG5[main]: stunnel 5.27 on x86-pc-msvc-1500 platform 2016.06.20 09:17:39 LOG5[main]: Compiled/running with OpenSSL 1.0.2e-fips 3 Dec 2015 2016.06.20 09:17:39 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2016.06.20 09:17:39 LOG7[main]: errno: (*_errno()) 2016.06.20 09:17:39 LOG5[main]: Reading configuration from file stunnel.conf 2016.06.20 09:17:39 LOG7[ui]: GUI message loop initialized 2016.06.20 09:17:39 LOG7[cron]: Cron thread initialized 2016.06.20 09:17:39 LOG5[main]: UTF-8 byte order mark detected 2016.06.20 09:17:39 LOG6[main]: Initializing service [CLI9F529A0A] 2016.06.20 09:17:39 LOG6[main]: Loading certificate from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Certificate loaded from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Loading private key from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Private key loaded from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG7[main]: Private key check succeeded 2016.06.20 09:17:39 LOG4[main]: Service [CLIxxxxxxxx] uses "verify = 2" without subject checks 2016.06.20 09:17:39 LOG4[main]: Use "checkHost" or "checkIP" to restrict trusted certificates 2016.06.20 09:17:39 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2016.06.20 09:17:39 LOG5[main]: Configuration successful Thanks for your help, Michael From: Josealf.rm [mailto:[email protected]] Sent: Monday, June 20, 2016 8:01 AM To: J. Michael Drew Cc: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Stunnel with IIS8 on server 2012 64 bit Michael, Is your stunnel running as a service? Please post sanitized logs and configuration for a better diagnostic ... Regards Jose El 20 jun 2016, a las 6:39, J. Michael Drew <jmichaeldrew(a)hotmail.com> escribió: Hi, I have a website on IIS8 and am using stunnel to forward requests over 9009 inside to my application server. When I log in to the IIS server and stay logged in everything works as expected. When I log off the IIS 8 web server my site is unreachable with a “service is unavailable”. Can someone help me? Sincere thanks, Michael _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Stunnel connection host address not appearing in sent message.
by Donald F. Coffin 20 Jun '16

20 Jun '16

I am using stunnel to enable SoapUI Mock Servers to support SSL connections. I am attempting to send the following SSL message: https://services.greenbuttondata.org/oauth/token?grant_type=client_credentia ls <https://services.greenbuttondata.org/oauth/token?grant_type=client_credenti als&scope=FB=39_40> &scope=FB=39_40 Using Wireshark, it appears the message being sent is POST /oauth/token?grant_type=client_credentials&scope=FB=39_40 which is receiving the following response: Error 404 (Not Found) The contents of the stunnel.conf file is: ; ***************************************************************** : * Service definitions (at least one service has to be defined) * ; ***************************************************************** ; ***************************************************************** ; * Resource Server * ; ***************************************************************** [resourceServer] accept=localhost:8080 connect=services.greenbuttondata.org:443 ciphers=AES128-SHA client=yes cert=/etc/stunnel/stunnel.pem verify=0 ; ***************************************************************** ; * Authorization Server * ; ***************************************************************** [authorizationServer] accept=localhost:8082 connect=services.greenbuttondata.org:443 ciphers=AES128-SHA client=yes cert=/etc/stunnel/stunnel.pem verify=0 [tpserver] accept=localhost:8444 connect=localhost:8081 cert=/etc/stunnel/stunnel.pem ciphers=AES128-SHA client=no verify=0 The HTTP log from SoapUI shows the following: "POST /oauth/token?grant_type=client_credentials&scope=FB=36_40 HTTP/1.1" "Accept-Encoding: gzip.deflate" "Content-Type: application/json" "Authorization: Basic UkVHSV... " (not shown for security) "Content-Length: 0" "Host: localhost:8082" "Connection: Keep-Alive" "User-Agent: Apache-HttpClient/4.1.1 (java 1.5)" "HTTP/1.1 404 Not Found" "Content-Type: text/html: charset=UTF-8" "Server: ghs" "Content-Length: 1623" "X-XSS-Protection: 1; mode=block" "X-Frame-Options: SAMEORIGIN" Through experimentation, the request only fails when using the stunnel proxy server, but works when sent directly to the targeted endpoint. Any assistance would be greatly appreciated. Best regards, Don Donald F. Coffin Technical Manager Green Button Alliance 2335 Dunwoody Crossing Suite E Dunwoody, GA 30338-8221 http://www.greenbuttonalliance.org <http://www.greenbuttonalliance.org/> (949) 636-8571 Mobile

1 0

FW: Stunnel with IIS8 on server 2012 64 bit
by J. Michael Drew 20 Jun '16

20 Jun '16

From: J. Michael Drew [mailto:[email protected]] Sent: Monday, June 20, 2016 9:54 AM To: 'Josealf.rm' Subject: RE: [stunnel-users] Stunnel with IIS8 on server 2012 64 bit Jose, Once logged in to the server I can open a browser on the server and connect through https://localhost/website and I can log in to the site externally as expected. Here are the log files from IIS and stunnel where stunnel is running as a service on the Windows 2012 server: When I am not logged in to the server it fails: #Software: Microsoft Internet Information Services 8.5 #Version: 1.0 #Date: 2016-06-20 00:30:21 #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken 2016-06-20 00:30:21 159.xxx.xxx.xxx HEAD / - 443 - 190.xxx.xxx.xxx - - 200 0 0 1218 #Software: Microsoft Internet Information Services 8.5 #Version: 1.0 #Date: 2016-06-20 05:41:01 #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken 2016-06-20 05:41:01 10.xxx.xxx.xxx OPTIONS /C$/windows/system32/NTDLL.DLL - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 200 0 0 500 2016-06-20 05:41:01 10.xxx.xxx.xxx PROPFIND /C$/windows/system32/NTDLL.DLL - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 46 2016-06-20 05:41:01 10.xxx.xxx.xxx PROPFIND /C$/windows/system32 - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 218 2016-06-20 05:41:16 10.xxx.xxx.xxx PROPFIND /patch-{682810b5-36dc-4e5d-81dd-6c02cd8f445b}-patchtoolsd.exe - 80 - 159.82.156.241 Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 64 62 2016-06-20 05:41:27 10.xxx.xxx.xxx PROPFIND /N$cl64.exe - 80 - 159.xxx.xxx.xxx 1 Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 62 2016-06-20 05:41:27 10.xxx.xxx.xxx PROPFIND /C$rome.dll - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 296 Stunell.conf: cert = extwebsvr_ver.pem ; Some performance tuning socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Peer Authentication verify = 2 CAfile = extwebsvr_root.pem ; Debug mode - useful for troubleshooting debug = 7 output = stunnel.log ; Client mode client = yes ; Setup tunnels to each EMS node [CLIxxxxxxxx)] accept=127.0.0.1:9001 connect=10.xxx.xxx.xxx:9009 Stunnel.log: 2016.06.20 09:17:39 LOG7[main]: No limit detected for the number of clients 2016.06.20 09:17:39 LOG5[main]: stunnel 5.27 on x86-pc-msvc-1500 platform 2016.06.20 09:17:39 LOG5[main]: Compiled/running with OpenSSL 1.0.2e-fips 3 Dec 2015 2016.06.20 09:17:39 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2016.06.20 09:17:39 LOG7[main]: errno: (*_errno()) 2016.06.20 09:17:39 LOG5[main]: Reading configuration from file stunnel.conf 2016.06.20 09:17:39 LOG7[ui]: GUI message loop initialized 2016.06.20 09:17:39 LOG7[cron]: Cron thread initialized 2016.06.20 09:17:39 LOG5[main]: UTF-8 byte order mark detected 2016.06.20 09:17:39 LOG6[main]: Initializing service [CLI9F529A0A] 2016.06.20 09:17:39 LOG6[main]: Loading certificate from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Certificate loaded from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Loading private key from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Private key loaded from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG7[main]: Private key check succeeded 2016.06.20 09:17:39 LOG4[main]: Service [CLIxxxxxxxx] uses "verify = 2" without subject checks 2016.06.20 09:17:39 LOG4[main]: Use "checkHost" or "checkIP" to restrict trusted certificates 2016.06.20 09:17:39 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2016.06.20 09:17:39 LOG5[main]: Configuration successful Thanks for your help, Michael From: Josealf.rm [mailto:[email protected]] Sent: Monday, June 20, 2016 8:01 AM To: J. Michael Drew Cc: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Stunnel with IIS8 on server 2012 64 bit Michael, Is your stunnel running as a service? Please post sanitized logs and configuration for a better diagnostic ... Regards Jose El 20 jun 2016, a las 6:39, J. Michael Drew <jmichaeldrew(a)hotmail.com> escribió: Hi, I have a website on IIS8 and am using stunnel to forward requests over 9009 inside to my application server. When I log in to the IIS server and stay logged in everything works as expected. When I log off the IIS 8 web server my site is unreachable with a “service is unavailable”. Can someone help me? Sincere thanks, Michael _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

2 1

FW: Stunnel with IIS8 on server 2012 64 bit
by J. Michael Drew 20 Jun '16

20 Jun '16

From: J. Michael Drew [mailto:[email protected]] Sent: Monday, June 20, 2016 9:54 AM To: 'Josealf.rm' Subject: RE: [stunnel-users] Stunnel with IIS8 on server 2012 64 bit Jose, Once logged in to the server I can open a browser on the server and connect through https://localhost/website and I can log in to the site externally as expected. Here are the log files from IIS and stunnel where stunnel is running as a service on the Windows 2012 server: When I am not logged in to the server it fails: #Software: Microsoft Internet Information Services 8.5 #Version: 1.0 #Date: 2016-06-20 00:30:21 #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken 2016-06-20 00:30:21 159.xxx.xxx.xxx HEAD / - 443 - 190.xxx.xxx.xxx - - 200 0 0 1218 #Software: Microsoft Internet Information Services 8.5 #Version: 1.0 #Date: 2016-06-20 05:41:01 #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken 2016-06-20 05:41:01 10.xxx.xxx.xxx OPTIONS /C$/windows/system32/NTDLL.DLL - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 200 0 0 500 2016-06-20 05:41:01 10.xxx.xxx.xxx PROPFIND /C$/windows/system32/NTDLL.DLL - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 46 2016-06-20 05:41:01 10.xxx.xxx.xxx PROPFIND /C$/windows/system32 - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 218 2016-06-20 05:41:16 10.xxx.xxx.xxx PROPFIND /patch-{682810b5-36dc-4e5d-81dd-6c02cd8f445b}-patchtoolsd.exe - 80 - 159.82.156.241 Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 64 62 2016-06-20 05:41:27 10.xxx.xxx.xxx PROPFIND /N$cl64.exe - 80 - 159.xxx.xxx.xxx 1 Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 62 2016-06-20 05:41:27 10.xxx.xxx.xxx PROPFIND /C$rome.dll - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 296 Stunell.conf: cert = extwebsvr_ver.pem ; Some performance tuning socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Peer Authentication verify = 2 CAfile = extwebsvr_root.pem ; Debug mode - useful for troubleshooting debug = 7 output = stunnel.log ; Client mode client = yes ; Setup tunnels to each EMS node [CLIxxxxxxxx)] accept=127.0.0.1:9001 connect=10.xxx.xxx.xxx:9009 Stunnel.log: 2016.06.20 09:17:39 LOG7[main]: No limit detected for the number of clients 2016.06.20 09:17:39 LOG5[main]: stunnel 5.27 on x86-pc-msvc-1500 platform 2016.06.20 09:17:39 LOG5[main]: Compiled/running with OpenSSL 1.0.2e-fips 3 Dec 2015 2016.06.20 09:17:39 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2016.06.20 09:17:39 LOG7[main]: errno: (*_errno()) 2016.06.20 09:17:39 LOG5[main]: Reading configuration from file stunnel.conf 2016.06.20 09:17:39 LOG7[ui]: GUI message loop initialized 2016.06.20 09:17:39 LOG7[cron]: Cron thread initialized 2016.06.20 09:17:39 LOG5[main]: UTF-8 byte order mark detected 2016.06.20 09:17:39 LOG6[main]: Initializing service [CLI9F529A0A] 2016.06.20 09:17:39 LOG6[main]: Loading certificate from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Certificate loaded from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Loading private key from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Private key loaded from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG7[main]: Private key check succeeded 2016.06.20 09:17:39 LOG4[main]: Service [CLIxxxxxxxx] uses "verify = 2" without subject checks 2016.06.20 09:17:39 LOG4[main]: Use "checkHost" or "checkIP" to restrict trusted certificates 2016.06.20 09:17:39 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2016.06.20 09:17:39 LOG5[main]: Configuration successful Thanks for your help, Michael From: Josealf.rm [mailto:[email protected]] Sent: Monday, June 20, 2016 8:01 AM To: J. Michael Drew Cc: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Stunnel with IIS8 on server 2012 64 bit Michael, Is your stunnel running as a service? Please post sanitized logs and configuration for a better diagnostic ... Regards Jose El 20 jun 2016, a las 6:39, J. Michael Drew <jmichaeldrew(a)hotmail.com> escribió: Hi, I have a website on IIS8 and am using stunnel to forward requests over 9009 inside to my application server. When I log in to the IIS server and stay logged in everything works as expected. When I log off the IIS 8 web server my site is unreachable with a “service is unavailable”. Can someone help me? Sincere thanks, Michael _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Stunnel with IIS8 on server 2012 64 bit
by J. Michael Drew 20 Jun '16

20 Jun '16

Hi, I have a website on IIS8 and am using stunnel to forward requests over 9009 inside to my application server. When I log in to the IIS server and stay logged in everything works as expected. When I log off the IIS 8 web server my site is unreachable with a "service is unavailable". Can someone help me? Sincere thanks, Michael

2 1

Compiling for Windows CE
by Bart de Waal 15 Jun '16

15 Jun '16

Hello, Are there more up to date instructions for compiling on Windows CE? I found the version here that works but is old and missing one of the features I need to connect to the server: http://www.usenix.org.uk/mirrors/stunnel/wce/ The instructions for building say you need evt2002web_min.exe, which as far as I can tell is no longer available. I can't get the newer version (evc4.exe) to work on a modern windows system (or under linux using wine) either. I think the CE version is still being used, as I saw references to it in the latest changelog. If someone has a more modern guide to building it I would appreciate it. Thanks, Bart de Waal

1 0

SSL Error
by Randall LeJeune 14 Jun '16

14 Jun '16

Hello. I am getting the following error when I try to run stunnel: [root@doadmzqas stunnel]# stunnel [ ] Clients allowed=31999 [.] stunnel 5.17 on powerpc-ibm-aix5.2.0.0 platform [.] Compiled/running with OpenSSL 1.0.1s 1 Mar 2016 [.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_Errno()) [.] Reading configuration from file /opt/freeware/etc/stunnel/stunnel.conf [.] UTF-8 byte order mark not detected [.] FIPS mode disabled [ ] Compression disabled [ ] Snagged 64 random bytes from /home/root/.rnd [ ] Wrote 1024 new random bytes to /home/root/.rnd [ ] PRNG seeded successfully [ ] Initializing service [sapdp3202] [ ] Loading certificate from file: /opt/freeware/etc/stunnel/stunnel.pem [!] error queue: 140DC002: error:140DC002:SSL routines:SSL_CTX_use_certificate_chain_file:system lib [!] error queue: 20074002: error:20074002:BIO routines:FILE_CTRL:system lib [!] SSL_CTX_use_certificate_chain_file: 2001002: error:02001002:system library:fopen:No such file or directory [!] Service [sapdp3202]: Failed to initialize SSL context The version is 5.17 as you can see above. My config file looks like this: ; Log file (enable for troubleshooting) output = /var/log/stunnel.log ; SSL Certificate and key files cert = /opt/freeware/etc/stunnel/stunnel.pem key = /opt/freeware/etc/stunnel/stunnel.key ; Restrict to FIPS compliant ciphers only ciphers = FIPS ; Force the SSL version to TLSv1 only sslVersion = TLSv1 ; The cipher list and SSL version restrictions above should make us ; _de_facto_ FIPS compliant; our OpenSSL library is *not* FIPS ; compliant, so this cannot be set to 'yes' fips = no [sapdp3202] client = yes accept = 127.0.0.1:3202 connect = doaprdssl.dot.com.gov:4709 The OS is AIX version 7. Does anybody have any idea what this means? Thanks in advance.

1 0

HTTP Strict Transport Security (HSTS) header
by Andrey 06 Jun '16

06 Jun '16

Hi! How I can enable HTTP Strict Transport Security (HSTS) header on stunnel ? Thank you Best regards, Andrey

2 1

openssl warning
by Vpn Bekhar 06 Jun '16

06 Jun '16

Hi, When I install stunnel on my windows server i see this error: stunnel warning can't open config file: /devel/win32/openssl/openssl.cnf please help me thank you so much best regards,

1 0

Broadband and stunnel weird behavior
by Javier 04 Jun '16

04 Jun '16

Hi, I was in doubt if post this or not because I couldn't replicate with enough similarities. But as it may be worth, if it is an actual bug, or help others... why not? Here I have to say that it is more noticeable under Windows 2000. That doesn’t mean doesn’t happen on higher OSs, but, from XP, it isn’t as noticeable. So, please, don’t stop reading here. But, hey, I know it is obsolete, and I know this is long and I’ll understand if you don’t want to read this. I tend to make a lot of “speed tests” because ISPs in my country… well, if you have luck, great, if not, brace yourself with the fights. Maybe as other countries :/ About February my download broadband was enhanced from 30Mb to 50Mb. This is important because is when it started all. With only 30Mb I didn’t notice any problem. “Speed tests“ were fine with “only” 30Mb and all matched the contracted speed and even a bit more. But when I had 50Mb I started to see some annoyances that sometimes was over 50Mb and others... if I had the luck to have 30Mb, it was a miracle. It wasn’t the test used. It was any test, with any technology (flash, html5, java, etc). The difference was just a couple of Mb. But all reflected the problems. They were so random, but something in common is that the tests didn’t show the correct speed at the end of my PC usage day. So I thought, something in memory, maybe, was causing it. But, also, it didn’t happen all days. At the end of the day, sometimes, I topped the 50Mb. And here starts the discarding process. I have a humble Pentium 4 and, even it is not powerful, one of the things I do (that I won’t explain why) is to throttle it (decrease speed). It is one of the first things I discarded, because as higher the broadband, the CPU load at full speed is higher as well. I only noticed a little improvement. This wasn’t the problem. Even I uninstalled the filter driver. So, if the CPU wasn’t the problem, programs should be. And I started with everything. And I left Stunnel as one of the latest. And there was the problem. When Stunnel is open, the speed cuts at about 30Mb. Yeah, I couldn’t believe myself either. After several tests, I discovered that Stunnel isn’t either the problem itself. The problem comes from the amount of services in .conf file. The more you have, the more speed problems you’ll have. I discovered this with the second instance of Stunnel I use for servers, which only has 7 services (3 SNI). I mainly use Stunnel as client for non-SSL aware programs and I have set 16 services. The options of .conf file, or services options, seems to don’t have much effect on speed tests. At the end, one way or another, the result is that if I open Stunnel, I can’t top full speed. I close it and voilà!, even during the same speed test. What is causing it? Probably just Windows 2000, or maybe not. Windows 2000 doesn’t have a connection limit as XP, one of the things I thought about. Anyway, I just wanted to shared this with you, just in case helps or anything. Regards. System specifications: Windows 2000 SP4 // XP SP2 (testing purposes) P4 2.8Ghz RAM 2GB RTL8139 Fast Ethernet Full Duplex

1 0

Re: [stunnel-users] Public domain [PATCH] support environment variables in config file
by Dmitry Bakshaev 31 May '16

31 May '16

2016-05-31 12:02 GMT+04:00 Pierre Delaage <delaage.pierre(a)free.fr>: > Hi Michal, > Did not have a look at the code yet, but should it be possible to replace > envvars usage by some keys in the registry on windows platform and/or > %userprofile%/config-file ? > why not just start stunnel with config parameter on command line? stunnel %USERPROFILE%/stunnel-config-file (windows) stunnel ${HOME}/stunnel-config-file (*nix)

2 1

Re: [stunnel-users] IPv4 and IPv6
by Konstantin Belousov 31 May '16

31 May '16

On Tue, May 31, 2016 at 08:04:24AM +0200, Micha?? Trojnara wrote: > On 31.05.2016 00:42, Konstantin Belousov wrote: > > I have a following configuration for the outgoing connection > > [XXX-1] > > client = yes > > accept = 127.0.0.1:1564 > > connect = some-server:9999 > > local = some-other-address > [cut] > > The socket was created with INET6 address family, but bind was done for > > INET AF. > > This is pretty much expected if "some-server:9999" is an IPv6 address > and "some-other-address" is an IPv4 address. The "local" option indeed > cannot handle a mix of IPv4 and IPv6 "connect" addresses. Usually some-server is the list of addresses, one of them is IPv4, and another is IPv6. This is the only reasonable way to name dual-stack host. > > What do you think might be a proper solution? I would expect that the code which binds the socket for connect(2), matched the address types before binding. A good implementation needs to iterate over the results of getaddrinfo(3) for remote host to try to connect to each returned address. In the same manner, when one outgoing address is attempted to connect to, the getaddrinfo(3) list for the local address would be iterated over, and first matched compatible address selected for binding. It seems that it is enough to match addrinfo pairs by ai_family/ai_socktype/ai_protocol, but you might also need to e.g. pay some attention to filter out IPv4 mapped to IPv6 entries. I am not sure how much additional plumbing is required to have local getaddrinfo(3) result in the local_bind().

1 0

IPv4 and IPv6
by Konstantin Belousov 30 May '16

30 May '16

Hi. I have a following configuration for the outgoing connection [XXX-1] client = yes accept = 127.0.0.1:1564 connect = some-server:9999 local = some-other-address Sometimes, or rather, quite regular, the connection to localhost port 1564 results in immediate connection close and logging the following: May 30 23:06:58 tom stunnel: LOG5[4]: Service [XXX-1] accepted connection from 127.0.0.1:12848 May 30 23:06:58 tom stunnel: LOG3[4]: local_bind (ephemeral port): Invalid argument (22) I traced the syscalls and see the following: 28196 stunnel CALL socket(PF_INET6,SOCK_STREAM,IPPROTO_IP) 28196 stunnel RET socket 10/0xa 28196 stunnel CALL fcntl(0xa,F_GETFL,0) 28196 stunnel RET fcntl 2 28196 stunnel CALL fcntl(0xa,F_SETFL,0x6<O_RDWR|O_NONBLOCK>) 28196 stunnel RET fcntl 0 28196 stunnel CALL fcntl(0xa,F_SETFD,FD_CLOEXEC) 28196 stunnel RET fcntl 0 28196 stunnel CALL bind(0xa,0x802808a6c,0x10) 28196 stunnel STRU struct sockaddr { AF_INET, 176.36.249.139:0 } 28196 stunnel RET bind -1 errno 22 Invalid argument The socket was created with INET6 address family, but bind was done for INET AF. Indeed, both some-server and some-other-address have both A and AAAA records, corresponding addresses are configured and functional. OS is FreeBSD, I was ensured that this combination (INET6 socket and INET bind) is not correct. It probably works sometime when first resolved addresses for names happen to come from the same address family, but when resolvers return different order, the situation above occurs. Disabling ipv6 support makes the connection work reliably, which confirms my observations. I am using stunnel 5.31. Would be nice to have this fixed. Thanks.

1 0

Public domain [PATCH] support environment variables in config file
by Dmitry Bakshaev 28 May '16

28 May '16

the problem frequently occurs on the client side: admin need to configure stunnel for multiple users. every user has own key, certificate, own permissions on file system (for log-files, etc) this patch allow to write flexible config. some examples: cert = %USERPROFILE%\.config\my.pem (windows) cert = ${HOME}/.config/my.pem (other) output = %APPDATA%\stunnel.log (windows) output = ${HOME}/stunnel.log (other) CAfile = %ALLUSERSPROFILE%\ourCAbundle.crt (windows) CAfile = /etc/ssl/certs/ourCAbundle.crt (other, not using variables) "secure" :) random port example: ... [srv1] accept = 127.0.0.1:%SRV1_PORT% (windows) accept = 127.0.0.1:${SRV1_PORT} (other) ... start stunnel (batch-file or shell-script): set SRV1_PORT=%RANDOM% (windows) limitations: 1. don't support unicode on windows (localized usernames, files, etc) 2. only ${NAME} syntax supported on *nix (not $NAME).

2 1

Potential performance degradation moving from Stunnel 5.06 to 5.32
by Mark Brookes 24 May '16

24 May '16

There might be a throughput degradation in the more recent versions of stunnel. I have recently been testing the 5.32 version of stunnel and have noticed that the tps drop quite significantly when moving from 5.06 to 5.32. Im willing to admit it could be something to do with my config or testing. But if anyone could offer some suggestions it would be much appreciated. The config is setup as follows - Stunnel VIP -> Haproxy. (I have configured haproxy to return a simple page). I am using a self signed 1024 bit certificate and the cipher I am using is ECDHE-RSA-AES256-GCM-SHA384 (I also tested with aNull:eNULL:MD5:LOW:HIGH and noticed a similar drop in performance) My Stunnel config is - setuid = stunnel pid = /var/run/stunnel/stunnel.pid debug = local1.0 socket = a:IP_FREEBIND=yes socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [VIP_Name-1] cert = /root/server1024.pem ciphers = ECDHE-RSA-AES256-GCM-SHA384 accept = 192.168.80.131:443 connect = 127.0.0.1:80 connect = 127.0.0.2:80 delay = no options = CIPHER_SERVER_PREFERENCE options = DONT_INSERT_EMPTY_FRAGMENTS renegotiation = no TIMEOUTclose = 0 My HAProxy config is - global daemon stats socket /var/run/haproxy.stat mode 600 level admin pidfile /var/run/haproxy.pid maxconn 100000 tune.maxrewrite 1024 nbproc 3 defaults #mode http #balance roundrobin timeout connect 4000 timeout client 42000 timeout server 43000 peers loadbalancer_replication peer lbmaster localhost:7778 peer lbslave localhost:7778 listen VIP_Name bind 127.0.0.1:80 transparent #bind 192.168.80.121:80 transparent monitor-uri / mode http errorfile 200 /etc/haproxy/200.http listen VIP_Name_2 monitor-uri / mode http bind 127.0.0.2:80 transparent errorfile 200 /etc/haproxy/200.http All the versions of stunnel mentioned here have been built against Openssl1.0.1s I am using siege to generate the load and issuing the following command - siege https://192.168.80.131 -t1M -c 15 -b The test is stop stunnel service, replace stunnel binary with different version, restart service, run test. The results im seeing are as follows (All results are quoted in transactions per second as reported by siege). v5.06 - 2233 v5.07 - 2229 v5.25 - 2171 v5.30 - 2092 v5.32 - 302 In my results you can see roughly a 200 tps drop from version 5.06 to v5.30 then when we get to v5.32 it drops further. To reiterate the only thing I am changing in my configuration is the stunnel binary. Everything else is remaining the same. Does anyone have any ideas what could be happening? Thankyou Mark

1 0

stunnel on AIX 7
by Randall LeJeune 19 May '16

19 May '16

Does anyone here have any experience in installing and/or running stunnel on AIX? I have version 4.56 installed on my AIX v.7 box, but I checked when this was released and it was over three years ago. I found a version 5.17-2 binary available on Perzl.org but nothing more recent (this version is slightly over a year old). I did try a compile of the newest version but got some errors when I tried to run make (1254-004 error on collect2). Does anyone have any ideas on what would be the best way to proceed here? Thanks in advance.

2 1

PKCS12 support patch
by Dmitry Bakshaev 19 May '16

19 May '16

googling internet about using certificate and keys from PKCS12 file lead to convert it to PEM. it requires some additional utilities (openssl not default windows application) and manual steps to convert. this patch allow using PKCS12 directly from stunnel. example configuration: cert = /home/dab/.certs/my.p12 PKCS12-files detected by file extension (.p12 or .pfx, no case sensetive) and load specially. password prompted if needed, empty password also supported. code based on examples from: https://groups.google.com/forum/#!topic/mailing.openssl.users/iuBmSqwsIG4 http://openssl-users.openssl.narkive.com/J0bR3cMA/ssl-ctx-use-privatekey-fi… patch tested on stunnel working on linux (gentoo: from our overlay http://bbgentoo.ilb.ru/repos/bbgentoo/bbgentoo_overlay/branches/drafts/net-… ) and windows.

1 1

Re: [stunnel-users] Configuring Stunnel to work between client and server - possible certificate issue
by Ludolf Holzheid 18 May '16

18 May '16

On Wed, 2016-05-18 07:24:52 +0000, David Faizulaev wrote: > Do you concatenate the self-signed certificate to the current CA? This self-signed certificate /is/ the current CA certificate, as it is the root of the peer's certificate chain and you trust it. Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:[email protected] http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

1 0

SSL Labs: Session resumption IDs assigned but not accepted
by Brandon Jackson 17 May '16

17 May '16

Trying to find out why SSL Labs is giving this message Session resumption (caching): No (IDs assigned but not accepted) I have this in the config. sessionCacheSize = 1000 sessionCacheTimeout = 86400 ---------------------------------- Brandon Jackson bojack1437(a)gmail.com

1 0

Re: [stunnel-users] Configuring Stunnel to work between client and server - possible certificate issue
by Ludolf Holzheid 17 May '16

17 May '16

On Tue, 2016-05-17 13:50:04 +0000, David Faizulaev wrote: > Hello, > > I've tried changing the value of 'verify' to 0 & 1, in both cases I get the following: > > 2016.05.17 16:40:25 LOG3[285]: SSL_connect: 14090086: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed > 2016.05.17 16:40:25 LOG5[285]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket > 2016.05.17 16:40:25 LOG4[285]: Possible memory leak at .\crypto\asn1\tasn_new.c:179: 11859 allocations > 2016.05.17 16:40:25 LOG4[285]: Possible memory leak at .\crypto\asn1\asn1_lib.c:408: 11241 allocations Strange. I never used verify = 0, but I had the understanding, stunnel should accept a connection even if the peer's certificate can't be verified. Anyhow, what happens if you add the self-signed certificate presented by the peer to the CA file? Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:[email protected] http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

1 0

Re: [stunnel-users] Configuring Stunnel to work between client and server - possible certificate issue
by Ludolf Holzheid 17 May '16

17 May '16

On Tue, 2016-05-17 13:33:31 +0000, David Faizulaev wrote: > Between each certificate block I have the following block: > > Bag Attributes > friendlyName: trustcenterclass2caii > 2.16.840.1.113894.746875.1.1: <Unsupported tag 6> > subject=/C=DE/O=TC TrustCenter GmbH/OU=TC TrustCenter Class 2 CA/CN=TC TrustCenter Class 2 CA II > issuer=/C=DE/O=TC TrustCenter GmbH/OU=TC TrustCenter Class 2 CA/CN=TC TrustCenter Class 2 CA II > > possible cause? No, this should be ignored as a comment. But you instructed stunnel to check the peer's certificate against the trusted ones (verify = 2), and the certificate chain the peer presents ends with a certificate not found in the CA file. Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:[email protected] http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

1 0

Re: [stunnel-users] Configuring Stunnel to work between client and server - possible certificate issue
by Ludolf Holzheid 17 May '16

17 May '16

On Tue, 2016-05-17 13:24:38 +0000, David Faizulaev wrote: > Logs messages are generated upon connection attempt. Then the server presents a certificate that can't be validated against the trusted certificates stored to the file you specified with CAfile=... Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:[email protected] http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

1 0

Re: [stunnel-users] Configuring Stunnel to work between client and server - possible certificate issue
by Ludolf Holzheid 17 May '16

17 May '16

On Tue, 2016-05-17 13:08:33 +0000, David Faizulaev wrote: > Latest update: > After further investigation, it became evident that Stunnel should run as client. > Therefore, I've converted my existing certs file (from my application) into a PEM file. > The file includes -----BEGIN CERTIFICATE----- & -----END CERTIFICATE-----. > > But I still get an error: > > 2016.05.17 15:57:24 LOG4[281]: CERT: Pre-verification error: self signed certificate in certificate chain > 2016.05.17 15:57:24 LOG4[281]: Rejected by CERT at depth=1: CN=NextnineCA > 2016.05.17 15:57:24 LOG3[281]: SSL_connect: 14090086: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed > > Here is the current configuration: > > [custom] > client = yes > accept = 127.0.0.1:8449 > connect = 192.168.220.62:443 > verify = 2 > CAfile = myapp.pem David, CAfile should point to a list of trusted certificates. The file(s) for your pair of certificate and key should be specified with cert=... (and key=..., if certificate and key are stored to separate files). Are the log messages generated at stunnel startup or at connection establishment? Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:[email protected] http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

1 0

Re: [stunnel-users] Configuring Stunnel to work between client and server - possible certificate issue
by Ludolf Holzheid 17 May '16

17 May '16

On Tue, 2016-05-17 11:13:26 +0000, David Faizulaev wrote: > I see, I have a keystore file for the server, can it be set as KEY ? can I convert keystore to PEM? I don't know. Some key/certificate repositories don't allow to export private keys. Maybe there is a PKCS11 plug-in for OpenSSL to access the keystore. If this is the case, you don't have to export your private key. But again, I don't know. > Additionally, I've thought about configuring Stunnel in client mode. > Here is the configuration: > [..] Running stunnel in client or server mode makes no difference w.r.t. certificate and key files. As long as stunnel is not able to access your private key, the client mode won't work either. HTH, Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:[email protected] http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

1 0

Re: [stunnel-users] Configuring Stunnel to work between client and server - possible certificate issue
by Ludolf Holzheid 17 May '16

17 May '16

On Tue, 2016-05-17 08:29:17 +0000, David Faizulaev wrote: > Hello Ludolf, > > I've printed the content of certificate file and the lines: "-----BEGIN CERTIFICATE-----" "-----END CERTIFICATE-----" exist. > In addition, I've compared the default certificate provided by Stunnel with the one I wish to use, they're structure is identical. Hello David, Please reply to the list, so others are able to comment too. I don't know the 'default certificate provided by Stunnel'. I expect it to be depending on the distribution. However, if there are "BEGIN/END CERTIFICATE" lines in your file, but no "BEGIN/END RSA PRIVATE KEY", then the file is in PEM format, but the key is missing. Maybe you have separate files for private key and certificate. If this is the case, you may either concatenate key and certificate to a single file or specify both files in the stunnel configuration: >> key = my-private-key.pem >> cert = my-certificate.pem Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:[email protected] http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

1 0

Configuring Stunnel to work between client and server - possible certificate issue
by David Faizulaev 17 May '16

17 May '16

Hello, I've found Stunnel as a potential answer to securely moving traffic between two machines. But I'm having some difficulties configuring the software. I've installed it on to the client machine and configured the client to connect to 127.0.0.1:8449 while the Server to which the client needs to connect is 192.168.220.72:8447 In the stunnel.conf I've set the following: [custom] accept = 127.0.0.1:8449 connect = 192.168.220.72:8447 cert = 220.72.cer TIMEOUTclose = 0 Upon initializing Stunnel I get the following error: 2016.05.16 19:14:04 LOG3[main]: error queue: 140B0009: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib 2016.05.16 19:14:04 LOG3[main]: SSL_CTX_use_PrivateKey_file: 906D06C: error:0906D06C:PEM routines:PEM_read_bio:no start line 2016.05.16 19:14:04 LOG3[main]: Service [custom]: Failed to initialize SSL context 2016.05.16 19:14:04 LOG3[main]: Failed to reload the configuration file What can be the cause? Thanks in advance. Best Regards, David. [logo_tagline_Sig] David Faizulaev | PL/SQL Developer | T +972 (3) 767 3026<tel:%2B97237673012> | M +972 (54) 7314<tel:%2B972528466746>687 Centralized OT Security Management for Distributed SCADA/ICS Networks P Please consider the environment before printing this e-mail

2 1

TIMEOUTBusy exceeded
by James Brown 17 May '16

17 May '16

Running OpenSSL 1.0.2h, and stunnel 5.32 I often get: ssl_start: s_poll_wait: TIMEOUTbusy exceeded: sending reset 2016.05.17 16:51:46 LOG5[21]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.05.17 16:51:46 LOG7[21]: Local descriptor (FD=15) closed 2016.05.17 16:51:46 LOG7[21]: Service [ssmtp2] finished (3 left) 2016.05.17 16:51:46 LOG6[22]: ssl_start: s_poll_wait: TIMEOUTbusy exceeded: sending reset 2016.05.17 16:51:46 LOG5[22]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.05.17 16:51:46 LOG7[22]: Local descriptor (FD=16) closed 2016.05.17 16:51:46 LOG7[22]: Service [ssmtp2] finished (2 left) when a user is sending an email. The email actually makes it to our mail server and gets sent, but the sender’s mail app says that it could not be sent. Upgraded to 5.33b2, no change. It is not all the time - I suspect it is with emails with large attachments. Any suggestions? Mac OS X 10.7.5. Thanks, James.

1 0

stunnel v5.32 (and older) strange session cache behavior on memory (de)allocation
by Adrian Irimescu 16 May '16

16 May '16

I am using stunnel v5.32 compiled on a RHEL 6.7 with openssl-1.0.1e-42.el6.x86_64. The stunnel.conf cache settings are (for testing cache behaviour): *sessionCacheSize = 3sessionCacheTimeout = 60* What I expect is that after sessioncache size is reached, the memory (RSS) allocated to stunnel process does not grow with new sessions which are not in cache. Instead of this the stunnel allocates about 28K for any new session which does not have a stored session in cache and does not free this anymore. For new connections, but with session stored in cache, the memory does not grow. This lead me to a problem in memory deallocation for expired session in internal session cache.( I know that openssl frees expired session cache entries at every 255 sessions). See example below: --> stunnel start (see RSS) USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND stunnel 20655 0.0 0.0 117760 1440 ? Ss 15:49 0:00 /usr/local/bin/stunnel5 --> after 3 sessions with no cache hits stunnel 20655 0.0 0.0 117828 2976 ? Ss 15:49 0:00 /usr/local/bin/stunnel5 - stunnel log 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: New session callback 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 4 server accept(s) requested 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 4 server accept(s) succeeded 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 0 server renegotiation(s) requested 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 0 session reuse(s) 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 3 internal session cache item(s) 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 0 internal session cache fill-up(s) 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 0 internal session cache miss(es) 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 0 external session cache hit(s) 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 0 expired session(s) retrieved 2016.05.11 15:50:57 LOG6[kngHAM6DLUpVRXEqHcUMIt]: SSL accepted: new session negotiated 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: Remove session callback ----------------------------------------------------- --> after another 1 request with cache hit: as you can see no RSS memory was added stunnel 20655 0.0 0.0 117828 2976 ? Ss 15:49 0:00 /usr/local/bin/stunnel5 - stunnel log 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: SSL state (accept): SSLv3 read finished A 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 5 server accept(s) requested 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 5 server accept(s) succeeded 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 0 server renegotiation(s) requested 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 1 session reuse(s) 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 3 internal session cache item(s) 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 1 internal session cache fill-up(s) 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 0 internal session cache miss(es) 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 0 external session cache hit(s) 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 0 expired session(s) retrieved 2016.05.11 15:51:57 LOG6[Slq6WdqS97Ox4G8eOKfGg0]: SSL accepted: previous session reused ---------------------------------------------------- --> after another 1 request with no cache hit (now we have the first cache fill-up) stunnel 20655 0.0 0.0 117828 3000 ? Ss 15:49 0:00 /usr/local/bin/stunnel5 - stunnel log 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: New session callback 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 6 server accept(s) requested 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 6 server accept(s) succeeded 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 0 server renegotiation(s) requested 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 1 session reuse(s) 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 3 internal session cache item(s) 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 1 internal session cache fill-up(s) 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 0 internal session cache miss(es) 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 0 external session cache hit(s) 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 0 expired session(s) retrieved 2016.05.11 15:53:31 LOG6[P8n33mFxzHVAZEeRwnFccK]: SSL accepted: new session negotiated 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: Remove session callback ---------------------------------------------------- --> after another 300 new session with no cache hits and after waiting 1 minute for entries in session cache to expire (as said in documentation openssl must free expired entries every 255 sessions) stunnel 20655 0.0 0.2 117828 11632 ? Ss 15:49 0:03 /usr/local/bin/stunnel5 - stunnel log 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: New session callback 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 306 server accept(s) requested 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 306 server accept(s) succeeded 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 0 server renegotiation(s) requested 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 1 session reuse(s) 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 3 internal session cache item(s) 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 301 internal session cache fill-up(s) 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 0 internal session cache miss(es) 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 0 external session cache hit(s) 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 0 expired session(s) retrieved 2016.05.11 16:13:26 LOG6[vWvoFT1DXuJ9x0eEfFnQBf]: SSL accepted: new session negotiated 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: Remove session callback ---------------------------------------------------- What I can see is tat memory grows with ~28K for every new session after session cache was filled and never deallocates this memory. In my production env. this really creates problems because after 2 weeks stunnel fils all 32GB of server RAM. *Anyone has encountered a similar problem? * Of course the stunnel service restart clears the memory but I loose all cache entries and is not acceptable. After some code analysis between different versions of stunnel I can see that between v5.26 ans v5.27 the ctx callbacks functions was changed. In my tests with versions prior to 5.27 I can see that this memory problems does not appear. See logs below: ---- stunnel v5.26 -------- 2016.05.12 13:08:14 LOG5[ui]: stunnel 5.26 on x86_64-unknown-linux-gnu platform 2016.05.12 13:08:14 LOG5[ui]: Compiled/running with OpenSSL 1.0.1e-fips 11 Feb 2013 stunnel 27402 0.0 0.0 117604 1316 ? Ss 13:08 0:00 /usr/local/bin/stunnel5 stunnel 27402 0.0 0.0 117672 2756 ? Ss 13:08 0:00 /usr/local/bin/stunnel5 stunnel 27402 0.0 0.0 117672 2804 ? Ss 13:08 0:00 /usr/local/bin/stunnel5 stunnel 27402 0.0 0.0 117672 2828 ? Ss 13:08 0:00 /usr/local/bin/stunnel5 stunnel 27402 0.0 0.0 117672 2868 ? Ss 13:08 0:00 /usr/local/bin/stunnel5 cache fill-up 2016.05.12 13:11:01 LOG7[FdNYw7uGlV9xNElZSPBfyh]: 0 session reuse(s) 2016.05.12 13:11:01 LOG7[FdNYw7uGlV9xNElZSPBfyh]: 3 internal session cache item(s) 2016.05.12 13:11:01 LOG7[FdNYw7uGlV9xNElZSPBfyh]: 1 internal session cache fill-up(s) stunnel 27402 0.0 0.0 117672 2868 ? Ss 13:08 0:00 /usr/local/bin/stunnel5 stunnel 27402 0.0 0.0 117672 2868 ? Ss 13:08 0:00 /usr/local/bin/stunnel5 after 100 fill-ups 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: SSL state (accept): SSLv3 flush data 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 107 server accept(s) requested 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 107 server accept(s) succeeded 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 0 server renegotiation(s) requested 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 1 session reuse(s) 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 3 internal session cache item(s) 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 102 internal session cache fill-up(s) 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 0 internal session cache miss(es) 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 0 external session cache hit(s) 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 0 expired session(s) retrieved 2016.05.12 13:13:55 LOG6[TWO1OFFPYvsW4qdjyJ0IZK]: SSL accepted: new session negotiated stunnel 27402 0.1 0.0 117672 2872 ? Ss 13:08 0:00 /usr/local/bin/stunnel5 after another 100 fill-ups 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: SSL state (accept): SSLv3 flush data 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 207 server accept(s) requested 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 207 server accept(s) succeeded 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 0 server renegotiation(s) requested 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 1 session reuse(s) 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 3 internal session cache item(s) 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 202 internal session cache fill-up(s) 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 0 internal session cache miss(es) 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 0 external session cache hit(s) 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 0 expired session(s) retrieved 2016.05.12 13:19:03 LOG6[InwkBBOxJrfptxYx6wXTxU]: SSL accepted: new session negotiated stunnel 27402 0.0 0.0 117672 2872 ? Ss 13:08 0:01 /usr/local/bin/stunnel5 Code: --->>> callbacks in v5.26 L605 *NOEXPORT int sess_new_cb(SSL *ssl, SSL_SESSION *sess) { unsigned char *val, *val_tmp; ssize_t val_len; const unsigned char *session_id; unsigned int session_id_length; val_len=i2d_SSL_SESSION(sess, NULL); val_tmp=val=str_alloc((size_t)val_len); i2d_SSL_SESSION(sess, &val_tmp);#if OPENSSL_VERSION_NUMBER>=0x0090800fL session_id=SSL_SESSION_get_id(sess, &session_id_length);#else session_id=(const unsigned char *)sess->session_id; session_id_length=sess->session_id_length;#endif cache_transfer(SSL_get_SSL_CTX(ssl), CACHE_CMD_NEW, SSL_SESSION_get_timeout(sess), session_id, session_id_length, val, (size_t)val_len, NULL, NULL); str_free(val); return 1; /* leave the session in local cache for reuse */}NOEXPORT SSL_SESSION *sess_get_cb(SSL *ssl, unsigned char *key, int key_len, int *do_copy) { unsigned char *val, *val_tmp=NULL; ssize_t val_len=0; SSL_SESSION *sess; *do_copy = 0; /* allow the session to be freed autmatically */ cache_transfer(SSL_get_SSL_CTX(ssl), CACHE_CMD_GET, 0, key, (size_t)key_len, NULL, 0, &val, (size_t *)&val_len); if(!val) return NULL; val_tmp=val; sess=d2i_SSL_SESSION(NULL,#if OPENSSL_VERSION_NUMBER>=0x0090800fL (const unsigned char **)#endif /* OpenSSL version >= 0.8.0 */ &val_tmp, val_len); str_free(val);* --->>> callbacks in v5.32 /**************************************** session callbacks */ *NOEXPORT int sess_new_cb(SSL *ssl, SSL_SESSION *sess) { CLI *c; s_log(LOG_DEBUG, "New session callback"); c=SSL_get_ex_data(ssl, index_cli); if(c->opt->option.sessiond) cache_new(ssl, sess); return 1; /* leave the session in local cache for reuse */}NOEXPORT SSL_SESSION *sess_get_cb(SSL *ssl,#if OPENSSL_VERSION_NUMBER>=0x10100000L const#endif unsigned char *key, int key_len, int *do_copy) { CLI *c; s_log(LOG_DEBUG, "Get session callback"); *do_copy=0; /* allow the session to be freed automatically */ c=SSL_get_ex_data(ssl, index_cli); if(c->opt->option.sessiond) return cache_get(ssl, key, key_len); return NULL; /* no session to resume */}NOEXPORT void sess_remove_cb(SSL_CTX *ctx, SSL_SESSION *sess) { SERVICE_OPTIONS *opt; s_log(LOG_DEBUG, "Remove session callback"); opt=SSL_CTX_get_ex_data(ctx, index_opt); if(opt->option.sessiond) cache_remove(ctx, sess);}* In production env. I have downgraded today at stunnel v5.26 and memory seems to be OK (untill now). Regards, Adrian Irimescu

1 0

Re: [stunnel-users] stunnel and MSIE
by Brugman, Matt 13 May '16

13 May '16

This is a perfect example of "do not post until you've tried the latest version"... I apologize again, I missed the update. Stunnel is working correctly on my WCE device with all browsers now. Thanks again for the help and the awesome product! Matt -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of Michal Trojnara Sent: Thursday, May 12, 2016 15:16 To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] stunnel and MSIE On 12.05.2016 15:57, Brugman, Matt wrote: > I’ve compiled stunnel for Windows CE 5.0 and 6.0, and am running it on > an ARM device. Which version of stunnel have you compiled? Make sure to use stunnel 5.32, as it contains an important WCE fix. Best regards, Mike

1 0

Re: [stunnel-users] stunnel and MSIE
by Brugman, Matt 12 May '16

12 May '16

I am running 5.31. I apologize; I missed the release of 5.32. I'll build and let you know what I find. Thanks very much! Matt -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of Michal Trojnara Sent: Thursday, May 12, 2016 15:16 To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] stunnel and MSIE On 12.05.2016 15:57, Brugman, Matt wrote: > I’ve compiled stunnel for Windows CE 5.0 and 6.0, and am running it on > an ARM device. Which version of stunnel have you compiled? Make sure to use stunnel 5.32, as it contains an important WCE fix. Best regards, Mike

1 0

stunnel and MSIE
by Brugman, Matt 12 May '16

12 May '16

I've compiled stunnel for Windows CE 5.0 and 6.0, and am running it on an ARM device. It is being used in client mode to secure communications to various external servers with not problems. It is also being used to secure Windows CE's webserver. All of the client mode connections are working flawlessly (thanks for the awesome work, by the way!). The webserver is working properly for all browsers except MSIE 11. Everything I've seen tells me that the problem is not really with stunnel or openssl, but with Internet Explorer. I've spent some time searching the mailing list archives and on Google, but haven't really found a solution to this, besides the obvious "well, don't use IE." I'd love to go with the answer, but some of our users are locked into IE, and let's must make it a given that the choice of browser can't be changed. The browser connects, negotiates a connection, and then exchanges keys and certificates. Using the debug console in IE I see that it sends the initial "GET /". Then the browser sees the response header, but no "body" data. Again, I realize this isn't a specific stunnel issue, but I'm hoping someone on the list has seen a similar issue and found a resolution. I've stripped stunnel.conf down to the very basics (some paths removed for clarity): ; Stunnel config for device debug = 7 output = <path removed>stunnel.log options = -NO_SSLv3 log = overwrite ;********* SERVICES *********** [https-server] client = no accept = 443 connect = 127.0.0.1:9975 cert = <path removed>stunnel.pem delay = yes TIMEOUTbusy = 5 TIMEOUTclose = 0 TIMEOUTidle = 30 Stunnel log output. I do see the "Peer suddenly disconnected" messages, but again; I'm not sure why. The last two lines of the log are the "transfer() loop executes not transferring any data": 3916.06.12 08:21:19 LOG7[ui]: Service [https-server] accepted (FD=9) from 192.168.55.77:12377 3916.06.12 08:21:19 LOG7[ui]: Creating a new thread 3916.06.12 08:21:19 LOG7[ui]: New thread created 3916.06.12 08:21:19 LOG7[0]: Service [https-server] started 3916.06.12 08:21:19 LOG5[0]: Service [https-server] accepted connection from 192.168.55.77:12377 3916.06.12 08:21:19 LOG7[0]: SSL state (accept): before/accept initialization 3916.06.12 08:21:19 LOG7[0]: SNI: no virtual services defined 3916.06.12 08:21:19 LOG7[0]: SSL state (accept): SSLv3 read client hello A 3916.06.12 08:21:19 LOG7[0]: SSL state (accept): SSLv3 write server hello A 3916.06.12 08:21:19 LOG7[0]: SSL state (accept): SSLv3 write certificate A 3916.06.12 08:21:19 LOG7[0]: SSL state (accept): SSLv3 write key exchange A 3916.06.12 08:21:19 LOG7[0]: SSL state (accept): SSLv3 write server done A 3916.06.12 08:21:19 LOG7[0]: SSL state (accept): SSLv3 flush data 3916.06.12 08:21:19 LOG7[0]: SSL state (accept): SSLv3 read client certificate A 3916.06.12 08:21:20 LOG7[0]: SSL state (accept): SSLv3 read client key exchange A 3916.06.12 08:21:20 LOG7[0]: SSL state (accept): SSLv3 read certificate verify A 3916.06.12 08:21:20 LOG7[0]: SSL state (accept): SSLv3 read finished A 3916.06.12 08:21:20 LOG7[0]: SSL state (accept): SSLv3 write change cipher spec A 3916.06.12 08:21:20 LOG7[0]: SSL state (accept): SSLv3 write finished A 3916.06.12 08:21:20 LOG7[0]: SSL state (accept): SSLv3 flush data 3916.06.12 08:21:20 LOG7[0]: New session callback 3916.06.12 08:21:20 LOG7[0]: 1 server accept(s) requested 3916.06.12 08:21:20 LOG7[0]: 1 server accept(s) succeeded 3916.06.12 08:21:20 LOG7[0]: 0 server renegotiation(s) requested 3916.06.12 08:21:20 LOG7[0]: 0 session reuse(s) 3916.06.12 08:21:20 LOG7[0]: 0 internal session cache item(s) 3916.06.12 08:21:20 LOG7[0]: 0 internal session cache fill-up(s) 3916.06.12 08:21:20 LOG7[0]: 0 internal session cache miss(es) 3916.06.12 08:21:20 LOG7[0]: 0 external session cache hit(s) 3916.06.12 08:21:20 LOG7[0]: 0 expired session(s) retrieved 3916.06.12 08:21:20 LOG6[0]: SSL accepted: new session negotiated 3916.06.12 08:21:20 LOG6[0]: No peer certificate received 3916.06.12 08:21:20 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-SHA384 (256-bit encryption) 3916.06.12 08:21:20 LOG7[0]: Compression: null, expansion: null 3916.06.12 08:21:20 LOG6[0]: s_connect: connecting 127.0.0.1:9775 3916.06.12 08:21:20 LOG6[0]: s_connect: connected 127.0.0.1:9775 3916.06.12 08:21:20 LOG6[0]: persistence: 127.0.0.1:9775 cached 3916.06.12 08:21:20 LOG5[0]: Service [https-server] connected remote server from 127.0.0.1:49277 3916.06.12 08:21:20 LOG7[0]: Remote descriptor (FD=11) initialized 3916.06.12 08:21:20 LOG6[0]: SSL socket closed (SSL_read) 3916.06.12 08:21:20 LOG7[0]: Sent socket write shutdown 3916.06.12 08:21:20 LOG5[0]: Connection closed: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 3916.06.12 08:21:20 LOG7[0]: Remote descriptor (FD=11) closed 3916.06.12 08:21:20 LOG7[0]: Local descriptor (FD=9) closed 3916.06.12 08:21:20 LOG7[0]: Service [https-server] finished (0 left) 3916.06.12 08:21:22 LOG7[ui]: Found 1 ready file descriptor(s) 3916.06.12 08:21:22 LOG7[ui]: FD=5 ifds=r-x ofds=--- 3916.06.12 08:21:22 LOG7[ui]: Service [https-server] accepted (FD=13) from 192.168.55.77:30351 3916.06.12 08:21:22 LOG7[ui]: Creating a new thread 3916.06.12 08:21:22 LOG7[ui]: New thread created 3916.06.12 08:21:22 LOG7[1]: Service [https-server] started 3916.06.12 08:21:22 LOG5[1]: Service [https-server] accepted connection from 192.168.55.77:30351 3916.06.12 08:21:22 LOG7[1]: SSL state (accept): before/accept initialization 3916.06.12 08:21:22 LOG7[1]: SNI: no virtual services defined 3916.06.12 08:21:22 LOG7[1]: SSL state (accept): SSLv3 read client hello A 3916.06.12 08:21:22 LOG7[1]: SSL state (accept): SSLv3 write server hello A 3916.06.12 08:21:22 LOG7[1]: SSL state (accept): SSLv3 write change cipher spec A 3916.06.12 08:21:22 LOG7[1]: SSL state (accept): SSLv3 write finished A 3916.06.12 08:21:22 LOG7[1]: SSL state (accept): SSLv3 flush data 3916.06.12 08:21:22 LOG7[1]: SSL state (accept): SSLv3 read finished A 3916.06.12 08:21:22 LOG7[1]: 2 server accept(s) requested 3916.06.12 08:21:22 LOG7[1]: 2 server accept(s) succeeded 3916.06.12 08:21:22 LOG7[1]: 0 server renegotiation(s) requested 3916.06.12 08:21:22 LOG7[1]: 1 session reuse(s) 3916.06.12 08:21:22 LOG7[1]: 1 internal session cache item(s) 3916.06.12 08:21:22 LOG7[1]: 0 internal session cache fill-up(s) 3916.06.12 08:21:22 LOG7[1]: 0 internal session cache miss(es) 3916.06.12 08:21:22 LOG7[1]: 0 external session cache hit(s) 3916.06.12 08:21:22 LOG7[1]: 0 expired session(s) retrieved 3916.06.12 08:21:22 LOG6[1]: SSL accepted: previous session reused 3916.06.12 08:21:22 LOG6[1]: s_connect: connecting 127.0.0.1:9775 3916.06.12 08:21:22 LOG6[1]: s_connect: connected 127.0.0.1:9775 3916.06.12 08:21:22 LOG6[1]: persistence: 127.0.0.1:9775 cached 3916.06.12 08:21:22 LOG5[1]: Service [https-server] connected remote server from 127.0.0.1:49278 3916.06.12 08:21:22 LOG7[1]: Remote descriptor (FD=15) initialized 3916.06.12 08:21:22 LOG6[1]: SSL socket closed (SSL_read) 3916.06.12 08:21:22 LOG7[1]: Sent socket write shutdown 3916.06.12 08:21:22 LOG5[1]: Connection closed: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 3916.06.12 08:21:22 LOG7[1]: Remote descriptor (FD=15) closed 3916.06.12 08:21:22 LOG7[1]: Local descriptor (FD=13) closed 3916.06.12 08:21:22 LOG7[1]: Service [https-server] finished (0 left) 3916.06.12 08:21:22 LOG7[ui]: Found 1 ready file descriptor(s) 3916.06.12 08:21:22 LOG7[ui]: FD=5 ifds=r-x ofds=--- 3916.06.12 08:21:22 LOG7[ui]: Service [https-server] accepted (FD=17) from 192.168.55.77:30352 3916.06.12 08:21:22 LOG7[ui]: Creating a new thread 3916.06.12 08:21:22 LOG7[ui]: New thread created 3916.06.12 08:21:22 LOG7[2]: Service [https-server] started 3916.06.12 08:21:22 LOG5[2]: Service [https-server] accepted connection from 192.168.55.77:30352 3916.06.12 08:21:22 LOG7[2]: SSL state (accept): before/accept initialization 3916.06.12 08:21:22 LOG7[2]: SNI: no virtual services defined 3916.06.12 08:21:22 LOG7[2]: SSL state (accept): SSLv3 read client hello A 3916.06.12 08:21:22 LOG7[2]: SSL state (accept): SSLv3 write server hello A 3916.06.12 08:21:22 LOG7[2]: SSL state (accept): SSLv3 write change cipher spec A 3916.06.12 08:21:22 LOG7[2]: SSL state (accept): SSLv3 write finished A 3916.06.12 08:21:22 LOG7[2]: SSL state (accept): SSLv3 flush data 3916.06.12 08:21:22 LOG7[2]: SSL state (accept): SSLv3 read finished A 3916.06.12 08:21:22 LOG7[2]: 3 server accept(s) requested 3916.06.12 08:21:22 LOG7[2]: 3 server accept(s) succeeded 3916.06.12 08:21:22 LOG7[2]: 0 server renegotiation(s) requested 3916.06.12 08:21:22 LOG7[2]: 2 session reuse(s) 3916.06.12 08:21:22 LOG7[2]: 1 internal session cache item(s) 3916.06.12 08:21:22 LOG7[2]: 0 internal session cache fill-up(s) 3916.06.12 08:21:22 LOG7[2]: 0 internal session cache miss(es) 3916.06.12 08:21:22 LOG7[2]: 0 external session cache hit(s) 3916.06.12 08:21:22 LOG7[2]: 0 expired session(s) retrieved 3916.06.12 08:21:22 LOG6[2]: SSL accepted: previous session reused 3916.06.12 08:21:22 LOG6[2]: s_connect: connecting 127.0.0.1:9775 3916.06.12 08:21:22 LOG6[2]: s_connect: connected 127.0.0.1:9775 3916.06.12 08:21:22 LOG6[2]: persistence: 127.0.0.1:9775 cached 3916.06.12 08:21:22 LOG5[2]: Service [https-server] connected remote server from 127.0.0.1:49279 3916.06.12 08:21:22 LOG7[2]: Remote descriptor (FD=19) initialized 3916.06.12 08:21:22 LOG3[2]: SSL socket closed (SSL_read) with 10137 unsent byte(s) 3916.06.12 08:21:22 LOG5[2]: Connection reset: 239 byte(s) sent to SSL, 553 byte(s) sent to socket 3916.06.12 08:21:22 LOG7[2]: Remote descriptor (FD=19) closed 3916.06.12 08:21:22 LOG7[2]: Local descriptor (FD=17) closed 3916.06.12 08:21:22 LOG7[2]: Service [https-server] finished (0 left) 3916.06.12 08:21:23 LOG7[ui]: Found 1 ready file descriptor(s) 3916.06.12 08:21:23 LOG7[ui]: FD=5 ifds=r-x ofds=--- 3916.06.12 08:21:23 LOG7[ui]: Service [https-server] accepted (FD=21) from 192.168.55.77:30353 3916.06.12 08:21:23 LOG7[ui]: Creating a new thread 3916.06.12 08:21:23 LOG7[ui]: New thread created 3916.06.12 08:21:23 LOG7[3]: Service [https-server] started 3916.06.12 08:21:23 LOG5[3]: Service [https-server] accepted connection from 192.168.55.77:30353 3916.06.12 08:21:23 LOG7[3]: SSL state (accept): before/accept initialization 3916.06.12 08:21:23 LOG7[3]: SNI: no virtual services defined 3916.06.12 08:21:23 LOG7[3]: SSL state (accept): SSLv3 read client hello A 3916.06.12 08:21:23 LOG7[3]: SSL state (accept): SSLv3 write server hello A 3916.06.12 08:21:23 LOG7[3]: SSL state (accept): SSLv3 write change cipher spec A 3916.06.12 08:21:23 LOG7[3]: SSL state (accept): SSLv3 write finished A 3916.06.12 08:21:23 LOG7[3]: SSL state (accept): SSLv3 flush data 3916.06.12 08:21:23 LOG7[3]: SSL state (accept): SSLv3 read finished A 3916.06.12 08:21:23 LOG7[3]: 4 server accept(s) requested 3916.06.12 08:21:23 LOG7[3]: 4 server accept(s) succeeded 3916.06.12 08:21:23 LOG7[3]: 0 server renegotiation(s) requested 3916.06.12 08:21:23 LOG7[3]: 3 session reuse(s) 3916.06.12 08:21:23 LOG7[3]: 1 internal session cache item(s) 3916.06.12 08:21:23 LOG7[3]: 0 internal session cache fill-up(s) 3916.06.12 08:21:23 LOG7[3]: 0 internal session cache miss(es) 3916.06.12 08:21:23 LOG7[3]: 0 external session cache hit(s) 3916.06.12 08:21:23 LOG7[3]: 0 expired session(s) retrieved 3916.06.12 08:21:23 LOG6[3]: SSL accepted: previous session reused 3916.06.12 08:21:23 LOG6[3]: s_connect: connecting 127.0.0.1:9775 3916.06.12 08:21:23 LOG6[3]: s_connect: connected 127.0.0.1:9775 3916.06.12 08:21:23 LOG6[3]: persistence: 127.0.0.1:9775 cached 3916.06.12 08:21:23 LOG5[3]: Service [https-server] connected remote server from 127.0.0.1:49280 3916.06.12 08:21:23 LOG7[3]: Remote descriptor (FD=23) initialized 3916.06.12 08:21:23 LOG6[3]: Read socket closed (readsocket) 3916.06.12 08:21:23 LOG7[3]: Sending close_notify alert 3916.06.12 08:21:23 LOG7[3]: SSL alert (write): warning: close notify 3916.06.12 08:21:23 LOG6[3]: SSL_shutdown successfully sent close_notify alert 3916.06.12 08:21:23 LOG3[3]: transfer() loop executes not transferring any data 3916.06.12 08:21:23 LOG3[3]: please report the problem to Michal.Trojnara(a)mirt.net

1 0

Multiple accept parameter, or Ipv4 and v6 in one statement.
by Brandon Jackson 12 May '16

12 May '16

Hi, I'm looking to expand my usage of stunnel. One thing i'm wondering, is there a way to use multiple accepts for the same service. Like: [httpsmain] accept = 443 accept = :::443 connect = 10.0.1.1:9443 or even something like. [httpsmain] accept = 443,:::443 connect = 10.0.1.1:8443 The reason is I'm about to setup some service with sni with a few domains and certs, but if I have to have them on v4 and v6 it looks like i'll have to double everything up. Is there a better way? ---------------------------------- Brandon Jackson bojack1437(a)gmail.com <https://mail.google.com/mail/?view=cm&fs=1&tf=1&[email protected]>

1 0

Timeout when connecting to
by Khan, Mohammed 10 May '16

10 May '16

Hi, I have installed v5.32 Stunnel on my Windows server which is hosted on AWS. I am trying to connect from here using a Emailer app which uses POP3 to try to connect to this server Outlook.Office365.com on port 995, but I keep on getting this error logged in Stunnel logs: [cid:[email protected]] Does anyone have any ideas as to why this connection is timing out please? Any help would be much appreciated thanks in advance! Rgds Mo Khan / Software Engineer / FootFall Tel: +44 121 712 1428 / Mobile: +44 776 692 7120 Yorke House, Arleston Way / Solihull, B90 4LH / United Kingdom mohammedkhan(a)tycoint.com<mailto:%[email protected]> / www.footfall.com<http://www.footfall.com/> [Description: Fieldworks Marketing]<https://urldefense.proofpoint.com/v2/url?u=http-3A__tycoretailsolutions.com…> [Description: Fieldworks Marketing]<http://www.footfall.com/> [Description: http://www.footfall.com/wp-content/uploads/2015/09/LinkedIn.png]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.linkedin.com_compa…> [Description: http://www.footfall.com/wp-content/uploads/2015/09/Twitter.png] <https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_footfallin…> [Description: http://www.footfall.com/wp-content/uploads/2015/09/YouTube.png] <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.youtube.com_channe…> [Description: http://www.footfall.com/wp-content/uploads/2015/09/Facebook.png] <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.facebook.com_footf…> [Description: http://www.footfall.com/wp-content/uploads/2015/09/Google-.png] <https://urldefense.proofpoint.com/v2/url?u=https-3A__plus.google.com_-2BFoo…> ________________________________ This e-mail contains privileged and confidential information intended for the use of the addressees named above. If you are not the intended recipient of this e-mail, you are hereby notified that you must not disseminate, copy or take any action in respect of any information contained in it. If you have received this e-mail in error, please notify the sender immediately by e-mail and immediately destroy this e-mail and its attachments.

1 0

Temporary DH params in stunnel
by Guillermo Rodriguez Garcia 10 May '16

10 May '16

Hi all, The stunnel docs say that starting with stunnel 5.18, DH params are auto-generated every 24 hours and that this "may take several minutes". I see that for this purpose, stunnel uses OpenSSL's DH_generate_parameters[_ex] function. According to the OpenSSL API docs [1], these functions "may run for several hours before finding a suitable prime." [1]: https://www.openssl.org/docs/manmaster/crypto/DH_generate_parameters.html Wouldn't it make sense to use "DSA-like" DH params for this purpose? These are much faster to generate and apparently equally safe. DSA-like DH params are generated using DSA_generate_parameters[ex]. It is the equivalent of passing the -dsaparam option to the openssl dhparam command. Some useful info: - http://security.stackexchange.com/a/95184/109144 - http://dovecot.org/pipermail/dovecot/2015-November/102447.html Best regards, Guillermo Rodriguez Garcia guille.rodriguez(a)gmail.com

1 0

'Integer constant too large' warnings in str.c
by Guillermo Rodriguez Garcia 10 May '16

10 May '16

Hello, Current stunnel (5.32) gives a bunch of warnings in str.c when the CANARY_XXX and MAGIC_XXX constants are used, for example: str.c:101: warning: integer constant is too large for 'long' type Shouldn't these constants be declared with the 'LL' suffix instead of 'L' ? #define CANARY_INITIALIZED 0x0000c0ded0000000LL #define CANARY_UNINTIALIZED 0x0000abadbabe0000LL #define MAGIC_ALLOCATED 0x0000a110c8ed0000LL #define MAGIC_DEALLOCATED 0x0000defec8ed0000LL Best regards, Guillermo Rodriguez Garcia guille.rodriguez(a)gmail.com

2 1

SNI support in OpenSSL
by Guillermo Rodriguez Garcia 08 May '16

08 May '16

Hello all, The stunnel documentation says that SNI requires stunnel to be linked with OpenSSL >= 1.0.0. However, SNI is supported in OpenSSL since 0.9.8f (and actually enabled by default since 0.9.8k). For 0.9.8f and later, OPENSSL_NO_TLSEXT will be defined if TLS extension support (including SNI support) is not compiled into OpenSSL. Taking the above into account, the OpenSSL version check in stunnel (src/common.h) could be relaxed a bit. Instead of: #if OPENSSL_VERSION_NUMBER<0x10000000L #define OPENSSL_NO_TLSEXT #define OPENSSL_NO_PSK #endif /* OpenSSL older than 1.0.0 */ this could be: #if OPENSSL_VERSION_NUMBER<0x00908060L #define OPENSSL_NO_TLSEXT #endif /* OpenSSL older than 0.9.8f */ #if OPENSSL_VERSION_NUMBER<0x10000000L #define OPENSSL_NO_PSK #endif /* OpenSSL older than 1.0.0 */ This would enable SNI on systems using 0.9.8 (Mac OS X for example). Best regards, Guillermo Rodriguez Garcia guille.rodriguez(a)gmail.com

1 0

SSLv3 not working with version 5.06
by Francois Pires 06 May '16

06 May '16

Hi all, We need use of sslv3 but with debian Jessie package version 5.06 this is not working. I have add options -NO_SSLv3 still same. Can you check if my configuration is good and if you have any idea to have sslv3 working with this verison. # stunnel.conf syslog = no cert = /etc/ssl/certs/test.crt.pem key = /etc/ssl/private/test.key.pem CAfile = /etc/ssl/certs/test.ca-bundle # Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = all options = -NO_SSLv3 ciphers = AES256-SHA #ciphers = ECDH@STRENGTH:DH@STRENGTH:HIGH:!RC4:!MD5:!DES:!aNULL:!eNULL # Some debugging stuff useful for troubleshooting debug = 7 output = /stunnel.log # Debian and Ubuntu chroot config chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid # Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 socket = l:SO_KEEPALIVE=1 socket = r:SO_KEEPALIVE=1 [test] accept = 11443 connect = 127.0.0.1:11444 # stunnel log with openssl test SSL_accept: 14076102: error:14076102:SSL routines:SSL23_GET_CLIENT_HELLO:unsupported protocol openssl s_client -connect 127.0.0.1:11443 -ssl3 CONNECTED(00000003) write:errno=104 --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 0 bytes and written 0 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE SSL-Session: Protocol : SSLv3 Cipher : 0000 Session-ID: Session-ID-ctx: Master-Key: Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1462525363 Timeout : 7200 (sec) Verify return code: 0 (ok) -- Cordialement, François PIRES SysAdmin

2 1

how to pass servername openssl parameter
by Dod 04 May '16

04 May '16

Hello, Little question I use openssl s_client mode to call an https with private PKI so private CAFile CERT and also Key, but I also need to use the parameter "servername" but stunnel seems not support it or may be it has an other syntax ? regards.

1 0

Connect to web app with weak crypto
by Pete McEvoy 29 Apr '16

29 Apr '16

Hi. I have a java web app that uses weak crypto. I would like to be able to access it with a modern browser. Currently the only method that seems to work is links on freebsd 9.3, all other browsers give errors such as: Error performing TLS handshake: The Diffie-Hellman prime sent by the server is not acceptable (not long enough). Obviously it would be better if this was fixed but it is not something I have control of. Would it be possible for me to use stunnel to encapsulate the weak connection within a stronger one so the browser does not complain? I have tried this: ; TLS front-end to a web server [https] client = yes accept = 443 connect = 192.168.1.5:443 cert = /usr/local/etc/stunnel/stunnel.pem Which asks me to make an exception for the self signed cert but then proceeds to fail in same way as before. Cheers -- Pete

1 0

Memory Leak in stunnel 5.31
by Fritz Gschwendner 20 Apr '16

20 Apr '16

Thank you. I tried the new version. Between 10:15 and 10:50 stunnel private bytes grew by ~ 85 MB. Log entries regarding "possible memory leak" look like this at the beginning: 2016.04.20 10:17:01 LOG4[937]: Possible memory leak at .\crypto\asn1\tasn_new.c:179: 71652 allocations 2016.04.20 10:17:01 LOG4[937]: Possible memory leak at .\crypto\asn1\asn1_lib.c:412: 70978 allocations 2016.04.20 10:17:01 LOG4[937]: Possible memory leak at .\crypto\asn1\a_object.c:346: 55283 allocations 2016.04.20 10:17:01 LOG4[937]: Possible memory leak at .\crypto\asn1\a_object.c:315: 55283 allocations 2016.04.20 10:17:01 LOG4[937]: Possible memory leak at .\crypto\asn1\asn1_lib.c:376: 56826 allocations 2016.04.20 10:17:01 LOG4[937]: Possible memory leak at .\crypto\stack\stack.c:162: 13761 allocations 2016.04.20 10:17:01 LOG4[937]: Possible memory leak at .\crypto\stack\stack.c:187: 11448 allocations 2016.04.20 10:17:01 LOG4[937]: Possible memory leak at .\crypto\buffer\buffer.c:118: 11172 allocations 2016.04.20 10:17:01 LOG4[937]: Possible memory leak at .\crypto\asn1\tasn_new.c:342: 10501 allocations ..and later like this: 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\tasn_new.c:179: 182132 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\asn1_lib.c:412: 181243 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\a_object.c:346: 138968 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\a_object.c:315: 138968 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\asn1_lib.c:376: 144407 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\stack\stack.c:162: 35294 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\stack\stack.c:187: 29760 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\buffer\buffer.c:118: 28186 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\tasn_new.c:342: 27649 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\bn\bn_lib.c:303: 27405 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\buffer\buffer.c:74: 18971 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\x_name.c:136: 18967 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\x_name.c:383: 18967 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\a_int.c:208: 18406 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\a_bitstr.c:158: 18433 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\bn\bn_lib.c:272: 13616 allocations If there is anything else I can do, please let me know. -----Ursprüngliche Nachricht----- Von: stunnel-users [mailto:[email protected]] Im Auftrag von Michal Trojnara Gesendet: Dienstag, 19. April 2016 23:31 An: stunnel-users(a)stunnel.org Betreff: Re: [stunnel-users] Memory Leak in stunnel 5.31 On 31.03.2016 22:28, Fritz Gschwendner wrote: > we have a memory leak with stunnel 5.31 in server mode on Windows > Server 2012. Page File Bytes of the stunnel process keep growing. [cut] > I suspect it has something to do with clients not closing the > connection correctly. We have a lot of connections ending like > this: [cut] > Is my suspicion plausible? Can you recommend a change in the > configuration to avoid this issue? Anything else I can do to debug? Your suspicion looks plausible. I have added a heuristic algorithm that identifies excessive memory allocations. Please try stunnel-5.32b2: https://www.stunnel.org/downloads.html The logged warnings should allow identification of the leak source. Best regards, Mike _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Stunnel and Eudora error
by EPPack 14 Apr '16

14 Apr '16

I installed stunnel on one of my laptops a few days ago, and it installed uneventfully. I set up one of my gmail accounts in Eudora per directions I got from another Eudora user, and the account works perfectly in Eudora. However, on this machine, I got an unexpected prompt that showed up in a cmd window during the install, which did NOT show up on the other machine: WARNING: can't open config file: /devel/win32/openssl/openssl.cnf Generating a 2048 bit RSA private key ...+++ ..................+++ Writing new private key to 'C:\Program Files (x86)\stunnel\config\stunnel.pem' ---- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank for some fields there will be a default value, If you enter '.', the field will be left blank. ---- Country Name (2 letter code) [PL]: When I try for an inbound in Eudora, I get the "Error reading from network. Cause: connection aborted due to timeout or other failure (10053). Problem of course is that I'm also unsure if it installed fully/correctly. On the other machine, it installed itself uneventfully as a service, and after I started it (it came in as manual, unstarted), it was fine. This time, tho, it didn't show up in the list of services at all, even tho there was a prompt to start it, which I allowed it to do. That said, I did see it in the start menu, and was able to start it. I also rebooted, and it started up OK. However, after configuring one of my accounts the same way as on the other machine, it's not working, getting the timeout error above. Changed it back to the normal settings for GMail in Eudora, it worked fine, so it wasn't any other cause. I tried adding options = DONT_INSERT_EMPTY_FRAGMENTS to the conf, hopefully in the right place :) and also bumped the Eudora Advanced Network params as also suggested.Nada. The only difference between the two machines, both Windows 7 Pro, is that this one is a 64bit, the other not, which may well be the difference. As I'm new to stunnel, I looked for the manual, but got a 403 on the page. Thoughts? elaine ----- Elaine Pack, Web Analyst, Ivy, VA 99 programming bugs in the code 99 programming bugs Fix one bug, compile it again Now there's 100 bugs in the code! (Repeat until bugs=0)

1 0

developpement hints request
by brahim mohamed 06 Apr '16

06 Apr '16

Hello, My name is Mohamed Aymen, i'm an electronic payment engineer . I recently descovered Stunnel and i'm trying to make some developement and modifications and i need your help with points bellow: 1-steps for compilation on IBM AIX-7 plateform 2-possibility of adding a new source code file(.c) and compiling it with native stunnel files ===some clarifications about source code : 3-i would appreciate if you can indicate me : where exactly in source code i can find the code responsible for accepting buffer from client and the code responsible for accepting buffer (response) from server, also the code responsible for sending data to server and the code responsible for sending server's answer to client (all those on socket mode,on ssl mode and on tls mode) warm regards

1 0

blockscript
by Petr Hojzak 05 Apr '16

05 Apr '16

Hello. Is it possible to setup stunel in a way so it is not detected by services like blocksript? Petr Hojzak https://forpsi-vzr-s126463.mojeid.cz/

2 3

Memory Leak in stunnel 5.31
by Fritz Gschwendner 31 Mar '16

31 Mar '16

Hello, we have a memory leak with stunnel 5.31 in server mode on Windows Server 2012. Page File Bytes of the stunnel process keep growing. The more traffic the faster it's growing, until memory is exhausted and client connects start to fail with: 2016.03.31 15:50:30 LOG3[main]: _beginthread: Exec format error (8) 2016.03.31 15:50:30 LOG3[main]: Connection rejected: create_client failed I suspect it has something to do with clients not closing the connection correctly. We have a lot of connections ending like this: 2016.03.31 09:21:48 LOG3[5156]: SSL_shutdown: Connection reset by peer (WSAECONNRESET) (10054) 2016.03.31 09:21:48 LOG5[5156]: Connection reset: 239 byte(s) sent to SSL, 722 byte(s) sent to socket Is my suspicion plausible? Can you recommend a change in the configuration to avoid this issue? Anything else I can do to debug? The config looks something like this: cert = C:\crt.pem key = C:\key.key ciphers = ALL:!DH:!aNULL:!eNULL:!LOW:!EXP socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 2 CAfile = C:\All-In-One.pem [test] accept = 23456 connect = 10.10.10.10

1 0

Incoming port ignored
by Ivan De Masi 31 Mar '16

31 Mar '16

Hello, I have a strange problem with my stunnel since a view days: I installed stunnel, because my AV-Scanner (Avira) is not able to scan e-mail traffic of encrypted connections to my mailprovider. So I configured both mail-clients (Thunderbird & Outlook) and AV-Scanner to listen on localhost and stunnel to connect to my mailprovider. This was working fine for a view days, but stoped some days ago and I'm not shure why. Maybe when I installed stunnel as a daemon I run into trouble (will bw another subject). The encrypted connection to my mailprovider is working and e-mails are recived and sent, but the AV-scanner doesn't "see" them anymore. I examined the log and what makes me wonder is, that the when fetching the e-mails, the configured ports (110/143/25) seem to be ignored: "Service [df-pop3s] accepted connection from 127.0.0.1:1878" or "Service [df-pop3s] accepted (FD=472) from 127.0.0.1:1882" The mails on my host are always bypassed on another port (the longer I run stunnel they change/increase) - see the log file. I have installed latest stunnel version (5.31) on Windows 7 (x86). Any ideas? Kind regards, Ivan Main-config: [df-pop3s] client = yes accept = 127.0.0.1:110 connect = sslin.df.eu:995 verify = 3 CAfile = peer-df-pop3s.pem checkHost = sslin.df.eu OCSPaia = yes [df-imaps] client = yes accept = 127.0.0.1:143 connect = sslin.df.eu:993 verify = 3 CAfile = peer-df-imaps.pem checkHost = sslin.df.eu OCSPaia = yes [df-smtps] client = yes accept = 127.0.0.1:25 connect = sslout.df.eu:465 verify = 3 CAfile = peer-df-smtps.pem checkHost = sslout.df.eu OCSPaia = yes Log: 2016.03.30 09:22:21 LOG7[main]: No limit detected for the number of clients 2016.03.30 09:22:21 LOG7[cron]: Cron thread initialized 2016.03.30 09:22:21 LOG5[main]: stunnel 5.31 on x86-pc-msvc-1500 platform 2016.03.30 09:22:21 LOG5[main]: Compiled/running with OpenSSL 1.0.2g-fips 1 Mar 2016 2016.03.30 09:22:21 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2016.03.30 09:22:21 LOG7[main]: errno: (*_errno()) 2016.03.30 09:22:21 LOG7[ui]: GUI message loop initialized 2016.03.30 09:22:21 LOG5[main]: Reading configuration from file stunnel.conf 2016.03.30 09:22:21 LOG5[main]: UTF-8 byte order mark detected 2016.03.30 09:22:21 LOG5[main]: FIPS mode enabled 2016.03.30 09:22:21 LOG7[main]: Compression disabled 2016.03.30 09:22:21 LOG7[main]: Snagged 64 random bytes from C:/.rnd 2016.03.30 09:22:21 LOG7[main]: Wrote 0 new random bytes to C:/.rnd 2016.03.30 09:22:21 LOG7[main]: PRNG seeded successfully 2016.03.30 09:22:21 LOG6[main]: Initializing service [df-pop3s] 2016.03.30 09:22:23 LOG7[main]: No certificate or private key specified 2016.03.30 09:22:23 LOG7[main]: SSL options: 0x03000004 (+0x03000000l, -0x00000000) 2016.03.30 09:22:23 LOG6[main]: Initializing service [df-imaps] 2016.03.30 09:22:23 LOG7[main]: No certificate or private key specified 2016.03.30 09:22:23 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2016.03.30 09:22:23 LOG6[main]: Initializing service [df-smtps] 2016.03.30 09:22:23 LOG7[main]: No certificate or private key specified 2016.03.30 09:22:23 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2016.03.30 09:22:23 LOG5[main]: Configuration successful 2016.03.30 09:22:23 LOG7[main]: Listening file descriptor created (FD=428) 2016.03.30 09:22:23 LOG7[main]: Service [df-pop3s] (FD=428) bound to 127.0.0.1:110 2016.03.30 09:22:23 LOG7[main]: Listening file descriptor created (FD=432) 2016.03.30 09:22:23 LOG7[main]: Service [df-imaps] (FD=432) bound to 127.0.0.1:143 2016.03.30 09:22:23 LOG7[main]: Listening file descriptor created (FD=436) 2016.03.30 09:22:23 LOG7[main]: Service [df-smtps] (FD=436) bound to 127.0.0.1:25 2016.03.30 09:22:42 LOG7[main]: Found 1 ready file descriptor(s) 2016.03.30 09:22:42 LOG7[main]: FD=352 ifds=r-x ofds=--- 2016.03.30 09:22:42 LOG7[main]: FD=428 ifds=r-x ofds=r-- 2016.03.30 09:22:42 LOG7[main]: FD=432 ifds=r-x ofds=--- 2016.03.30 09:22:42 LOG7[main]: Service [df-pop3s] accepted (FD=460) from 127.0.0.1:1878 2016.03.30 09:22:42 LOG7[main]: Creating a new thread 2016.03.30 09:22:42 LOG7[main]: New thread created 2016.03.30 09:22:42 LOG7[0]: Service [df-pop3s] started 2016.03.30 09:22:42 LOG5[0]: Service [df-pop3s] accepted connection from 127.0.0.1:1878 2016.03.30 09:22:42 LOG6[0]: s_connect: connecting 134.119.18.26:995 2016.03.30 09:22:42 LOG7[0]: s_connect: s_poll_wait 134.119.18.26:995: waiting 10 seconds 2016.03.30 09:22:42 LOG5[0]: s_connect: connected 134.119.18.26:995 2016.03.30 09:22:42 LOG5[0]: Service [df-pop3s] connected remote server from 192.168.1.2:1879 2016.03.30 09:22:42 LOG7[0]: Remote descriptor (FD=484) initialized 2016.03.30 09:22:42 LOG6[0]: SNI: sending servername: sslin.df.eu 2016.03.30 09:22:42 LOG7[0]: SSL state (connect): before/connect initialization 2016.03.30 09:22:42 LOG7[0]: SSL state (connect): SSLv2/v3 write client hello A 2016.03.30 09:22:42 LOG7[0]: SSL state (connect): SSLv3 read server hello A 2016.03.30 09:22:42 LOG7[0]: Verification started at depth=2: C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA 2016.03.30 09:22:42 LOG7[0]: CERT: Pre-verification succeeded 2016.03.30 09:22:42 LOG7[0]: OCSP: Ignoring root certificate 2016.03.30 09:22:42 LOG6[0]: Certificate accepted at depth=2: C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA 2016.03.30 09:22:42 LOG7[0]: Verification started at depth=1: C=BE, O=GlobalSign nv-sa, CN=AlphaSSL CA - SHA256 - G2 2016.03.30 09:22:42 LOG7[0]: CERT: Pre-verification succeeded 2016.03.30 09:22:42 LOG5[0]: OCSP: Connecting the AIA responder "http://ocsp.globalsign.com/rootr1" 2016.03.30 09:22:46 LOG6[0]: s_connect: connecting 104.16.25.216:80 2016.03.30 09:22:46 LOG7[0]: s_connect: s_poll_wait 104.16.25.216:80: waiting 10 seconds 2016.03.30 09:22:46 LOG5[0]: s_connect: connected 104.16.25.216:80 2016.03.30 09:22:46 LOG7[0]: OCSP: Connected ocsp.globalsign.com:80 2016.03.30 09:22:46 LOG7[0]: OCSP: Response received 2016.03.30 09:22:46 LOG6[0]: OCSP: Status: good 2016.03.30 09:22:46 LOG6[0]: OCSP: This update: Mar 30 05:42:27 2016 GMT 2016.03.30 09:22:46 LOG6[0]: OCSP: Next update: Apr 3 05:42:27 2016 GMT 2016.03.30 09:22:46 LOG5[0]: OCSP: Certificate accepted 2016.03.30 09:22:46 LOG6[0]: Certificate accepted at depth=1: C=BE, O=GlobalSign nv-sa, CN=AlphaSSL CA - SHA256 - G2 2016.03.30 09:22:46 LOG7[0]: Verification started at depth=0: C=DE, OU=Domain Control Validated, CN=sslin.df.eu 2016.03.30 09:22:46 LOG7[0]: CERT: Pre-verification succeeded 2016.03.30 09:22:46 LOG6[0]: CERT: Host name "sslin.df.eu" matched with "sslin.df.eu" 2016.03.30 09:22:46 LOG6[0]: CERT: Locally installed certificate matched 2016.03.30 09:22:46 LOG5[0]: OCSP: Connecting the AIA responder "http://ocsp2.globalsign.com/gsalphasha2g2" 2016.03.30 09:22:46 LOG6[0]: s_connect: connecting 104.16.25.216:80 2016.03.30 09:22:46 LOG7[0]: s_connect: s_poll_wait 104.16.25.216:80: waiting 10 seconds 2016.03.30 09:22:46 LOG5[0]: s_connect: connected 104.16.25.216:80 2016.03.30 09:22:46 LOG7[0]: OCSP: Connected ocsp2.globalsign.com:80 2016.03.30 09:22:46 LOG7[0]: OCSP: Response received 2016.03.30 09:22:46 LOG6[0]: OCSP: Status: good 2016.03.30 09:22:46 LOG6[0]: OCSP: This update: Mar 27 21:09:59 2016 GMT 2016.03.30 09:22:46 LOG6[0]: OCSP: Next update: Mar 31 21:09:59 2016 GMT 2016.03.30 09:22:46 LOG5[0]: OCSP: Certificate accepted 2016.03.30 09:22:46 LOG5[0]: Certificate accepted at depth=0: C=DE, OU=Domain Control Validated, CN=sslin.df.eu 2016.03.30 09:22:46 LOG7[0]: SSL state (connect): SSLv3 read server certificate A 2016.03.30 09:22:46 LOG7[0]: SSL state (connect): SSLv3 read server key exchange A 2016.03.30 09:22:46 LOG6[0]: Client certificate not requested 2016.03.30 09:22:46 LOG7[0]: SSL state (connect): SSLv3 read server done A 2016.03.30 09:22:46 LOG7[0]: SSL state (connect): SSLv3 write client key exchange A 2016.03.30 09:22:46 LOG7[0]: SSL state (connect): SSLv3 write change cipher spec A 2016.03.30 09:22:46 LOG7[0]: SSL state (connect): SSLv3 write finished A 2016.03.30 09:22:46 LOG7[0]: SSL state (connect): SSLv3 flush data 2016.03.30 09:22:46 LOG7[0]: SSL state (connect): SSLv3 read server session ticket A 2016.03.30 09:22:46 LOG7[0]: SSL state (connect): SSLv3 read finished A 2016.03.30 09:22:46 LOG7[0]: 1 client connect(s) requested 2016.03.30 09:22:46 LOG7[0]: 1 client connect(s) succeeded 2016.03.30 09:22:46 LOG7[0]: 0 client renegotiation(s) requested 2016.03.30 09:22:46 LOG7[0]: 0 session reuse(s) 2016.03.30 09:22:46 LOG6[0]: SSL connected: new session negotiated 2016.03.30 09:22:46 LOG7[0]: Peer certificate was cached (4539 bytes) 2016.03.30 09:22:46 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES128-GCM-SHA256 (128-bit encryption) 2016.03.30 09:22:46 LOG7[0]: Compression: null, expansion: null 2016.03.30 09:23:01 LOG7[0]: SSL alert (read): warning: close notify 2016.03.30 09:23:01 LOG6[0]: SSL closed (SSL_read) 2016.03.30 09:23:01 LOG7[0]: Sent socket write shutdown 2016.03.30 09:23:01 LOG6[0]: Read socket closed (readsocket) 2016.03.30 09:23:01 LOG7[0]: Sending close_notify alert 2016.03.30 09:23:01 LOG7[0]: SSL alert (write): warning: close notify 2016.03.30 09:23:01 LOG6[0]: SSL_shutdown successfully sent close_notify alert 2016.03.30 09:23:01 LOG5[0]: Connection closed: 304 byte(s) sent to SSL, 545297 byte(s) sent to socket 2016.03.30 09:23:01 LOG7[0]: Remote descriptor (FD=484) closed 2016.03.30 09:23:01 LOG7[0]: Local descriptor (FD=460) closed 2016.03.30 09:23:01 LOG7[0]: Service [df-pop3s] finished (0 left) 2016.03.30 09:23:02 LOG7[main]: Found 1 ready file descriptor(s) 2016.03.30 09:23:02 LOG7[main]: FD=352 ifds=r-x ofds=--- 2016.03.30 09:23:02 LOG7[main]: FD=428 ifds=r-x ofds=r-- 2016.03.30 09:23:02 LOG7[main]: FD=432 ifds=r-x ofds=--- 2016.03.30 09:23:02 LOG7[main]: Service [df-pop3s] accepted (FD=472) from 127.0.0.1:1882 2016.03.30 09:23:02 LOG7[main]: Creating a new thread 2016.03.30 09:23:02 LOG7[main]: New thread created 2016.03.30 09:23:02 LOG7[1]: Service [df-pop3s] started 2016.03.30 09:23:02 LOG5[1]: Service [df-pop3s] accepted connection from 127.0.0.1:1882 2016.03.30 09:23:02 LOG6[1]: s_connect: connecting 134.119.18.26:995 2016.03.30 09:23:02 LOG7[1]: s_connect: s_poll_wait 134.119.18.26:995: waiting 10 seconds 2016.03.30 09:23:02 LOG5[1]: s_connect: connected 134.119.18.26:995 2016.03.30 09:23:02 LOG5[1]: Service [df-pop3s] connected remote server from 192.168.1.2:1883 2016.03.30 09:23:02 LOG7[1]: Remote descriptor (FD=468) initialized 2016.03.30 09:23:02 LOG6[1]: SNI: sending servername: sslin.df.eu 2016.03.30 09:23:02 LOG7[1]: SSL state (connect): before/connect initialization 2016.03.30 09:23:02 LOG7[1]: SSL state (connect): SSLv3 write client hello A 2016.03.30 09:23:02 LOG7[1]: SSL state (connect): SSLv3 read server hello A 2016.03.30 09:23:02 LOG7[1]: SSL state (connect): SSLv3 read finished A 2016.03.30 09:23:02 LOG7[1]: SSL state (connect): SSLv3 write change cipher spec A 2016.03.30 09:23:02 LOG7[1]: SSL state (connect): SSLv3 write finished A 2016.03.30 09:23:02 LOG7[1]: SSL state (connect): SSLv3 flush data 2016.03.30 09:23:02 LOG7[1]: 2 client connect(s) requested 2016.03.30 09:23:02 LOG7[1]: 2 client connect(s) succeeded 2016.03.30 09:23:02 LOG7[1]: 0 client renegotiation(s) requested 2016.03.30 09:23:02 LOG7[1]: 1 session reuse(s) 2016.03.30 09:23:02 LOG6[1]: SSL connected: previous session reused 2016.03.30 09:23:08 LOG7[1]: SSL alert (read): warning: close notify 2016.03.30 09:23:08 LOG6[1]: SSL closed (SSL_read) 2016.03.30 09:23:08 LOG7[1]: Sent socket write shutdown 2016.03.30 09:23:08 LOG6[1]: Read socket closed (readsocket) 2016.03.30 09:23:08 LOG7[1]: Sending close_notify alert 2016.03.30 09:23:08 LOG7[1]: SSL alert (write): warning: close notify 2016.03.30 09:23:08 LOG6[1]: SSL_shutdown successfully sent close_notify alert 2016.03.30 09:23:08 LOG5[1]: Connection closed: 149 byte(s) sent to SSL, 336471 byte(s) sent to socket 2016.03.30 09:23:08 LOG7[1]: Remote descriptor (FD=468) closed 2016.03.30 09:23:08 LOG7[1]: Local descriptor (FD=472) closed 2016.03.30 09:23:08 LOG7[1]: Service [df-pop3s] finished (0 left) 2016.03.30 09:23:21 LOG6[cron]: Executing cron jobs 2016.03.30 09:23:21 LOG6[cron]: Cron jobs completed in 0 seconds 2016.03.30 09:23:21 LOG7[cron]: Waiting 86400 seconds

4 10

Re: [stunnel-users] Connecting stunnels
by Ludolf Holzheid 31 Mar '16

31 Mar '16

On Thu, 2016-03-31 09:39:49 -0400, Carter Browne wrote: > A single instance of stunnel can be a server or a client depending on > the settings. For this configuration, you would want host3 to be a > server not a client. > Thus, you need the intermediate port on server2 to server as both a > client and a server: > > In your configuration files you would need: > > Host1: > [secure_telnet] > accept = local:23 > connect = host2:host2port1 > client = yes > > Host2: > [incoming_telnet_relay] > accept = host2:host2port1 > connect = local:host2port2 > client = no > > [outgoing_telnet_relay] > accept =local:host2port2 > connect = host3:host3port1 > client = yes > > Host3: > [incoming_telnet] > accept = host3:host3port1 > connect = local:23 Carter, What's the advantage of this setup over a direct connection from Host1 to Host3? Host1: [secure_telnet] accept = local:23 connect = host3:host3port1 client = yes Host3: [incoming_telnet] accept = host3:host3port1 connect = local:23 client = no If e.g. Host3 isn't directly reachable from Host1, a simple port forwarding (without decryption and re-encryption) on Host2 would suffice. Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:[email protected] http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

2 3

Connecting stunnels
by Juhasz Gabor 31 Mar '16

31 Mar '16

Hi, I am newbie in stunnel world so sorry for my question if it was already answered earlier. I have the following task to solve somehow : We have 1 server with 2 stunnel connections (any kind). We have e.g. http communicatoin via tunnels. Is there any support in stunnel to connect them somehow. Probably we do not need bidirectional communication. [client1]----- stunnel 1---> [server]------stunnel2 ----->[client2] So [client1] --> [client2] If there is no support in stunnel do you have any idea how to do it? Kind regards, Gabor

2 9

Please help
by Steve Wollan 30 Mar '16

30 Mar '16

Installed stunnel-5.31 (stunnel-5.31-installer) so that I can get MT4, a Forex trade platform, to send me mails to my Gmail account. I was told this was necessary because MT4 doesn't support SSL Authentication. I attempted to start and received this; [image: Inline image 1] It looks like a config file issue but also would not bind? Is this one issue? I was told all I needed to do with the config file is this; [image: Inline image 2] Can you please simply help me with the config file? I'm lost and need help. Thanks to all in advance for your help.

3 2

Using stunnel for TLS with Geotrust cert?
by Jon Bogaty 28 Mar '16

28 Mar '16

Hey stunnel-users, I'm having an issue both on stunnel4 and on 5 which I think is more related to a lack of understanding of the difference between how stunnel uses intermediate chain certs and root CA certs. I have from Geotrust, who signs my SSL certs, an intermediate.crt which by the stunnel docs should be catted into one stunnel.pem with the cert for my domain and the private key. The issue is when I setup everything on the server and try to connect with a client I either get for "verify 2" warnings about MiTM authentication problems, or for "verify 3" or "verify 4", which should disable CA checking altogether to my understanding, "Please specify CApath". I feel like I'm missing something critical in terms of pieces. The goal is to use stunnel as a proxy for mysql and the conf is pretty barebones: sslVersion = TLSv1 setuid = stunnel4 setgid = stunnel4 pid = /var/lib/stunnel4/stunnel4.pid debug = 7 foreground = yes socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 cert = /etc/stunnel/stunnel.pem verify = 3 [mysqls] accept = 3307 connect = localhost:3306 It runs just fine using supervisor. Any thoughts and how I could make the handshake work between server and client using geotrust's intermediate crt as the CA cert, or something similar? It contains certs down to the root level. Thanks! Jon

1 0

Install directory with /S /D=[path]
by Yoshitake, Aaron 23 Mar '16

23 Mar '16

Hi all, I'm making an installer that installs stunnel as a dependency, and I'd like to customize its install directory while running it in silent mode. Per the NSIS docs, my command has the /S switch for silent mode, but when I try /D=[path], the installer ignores it and installs to Program Files (x86)/stunnel anyway. Is there a workaround for this? Thanks, Aaron

2 2

Latest x-forwarded-for patch for Stunnel 5.31
by Nelson 20 Mar '16

20 Mar '16

Hi, Has anyone knows a compatible patch for the latest version 5.31? Can anyone provide the link? The patch that I have only works on 5.02 but not on 5.31

1 0

Minor bug in resolver.c
by Jose Alf. 16 Mar '16

16 Mar '16

Hello Michal, I found a small bug on resolver.c. In function addrlist_resolve, in source line 318 for version 5.31, there is the instruction: num+=name2addrlist(addr_list, host->name) I think It should be: num = name2addrlist(addr_list, host->name) I found this because I created a service with three connect lines, like this: [ldaps] client=yes accept=127.0.0.1:7000 connect=10.1.1.1:636 connect=10.2.2.2:636 connect=10.3.2.3:636 And I found this line in the log: 2016.03.15 22:23:34 LOG6[0]: failover: round-robin, starting at entry #6 #6? It should be <= #2 ! I checked the source code, added some s_log instructions and found that the problem. For 3 addresses num variable was set to 6 (1 + 2 + 3) and that was returned by addrlist_resolve. Hope this helps. And thanks again for your hard work on stunnel. Best Regards Jose A. Diaz

1 0

Possible signal handling bug in fork mode
by Philippe Anctil 15 Mar '16

15 Mar '16

Hi, In fork mode, sending a sigterm signal to a child is caught by the parent. I suspect it has something to do with signal_pipe being shared by the child and parent after the fork. Here I sent a signal to the parent while a child process was also running. The parent shut down as expected. After sending sigterm, the child remains. Processes before sigterm: UID PID PPID C STIME TTY STAT TIME CMD user 1423 1 0 10:32 ? Ss 0:00 /usr/local/stunnel/bin/stunnel.bin /usr/local/stunnel/etc/server.conf user 1921 1423 0 10:37 ? S 0:00 \_ /usr/local/stunnel/bin/stunnel.bin /usr/local/stunnel/etc/server.conf selected pid 1423 Processes after: UID PID PPID C STIME TTY STAT TIME CMD user 1921 1 0 10:37 ? S 0:00 /usr/local/stunnel/bin/stunnel.bin /usr/local/stunnel/etc/server.conf Here I sent the signal to the child. The parent shut down and the child completed normally. Processes before: UID PID PPID C STIME TTY STAT TIME CMD user 1276 1 0 10:31 ? Ss 0:00 /usr/local/stunnel/bin/stunnel.bin /usr/local/stunnel/etc/server.conf user 1309 1276 0 10:31 ? S 0:00 \_ /usr/local/stunnel/bin/stunnel.bin /usr/local/stunnel/etc/server.conf selected pid 1309 Processes after: UID PID PPID C STIME TTY STAT TIME CMD user 1309 1 0 10:31 ? S 0:00 /usr/local/stunnel/bin/stunnel.bin /usr/local/stunnel/etc/server.conf I know I should be trying threads. I will eventually. I can only switch once I validate it can sustain our level of traffic. Fork has done that flawlessly for many years now. Best regards, -- Philippe Anctil

2 5

windows certificate store
by Jim Howland 11 Mar '16

11 Mar '16

Hi I am running a windows instance of stunnel as a client and A Linux version as the server When I set this on the Windows side : engine = capi and this in my section: engineId = capi I get an error message that CApath or CAFile still needs to be set. My understanding is that these setting should make stunnel use the Windows certificate store to find a root and intermediate certificate to authenticate my (Symantec generated) certificate and should not require a CAfile. Here is my windows config : ; ************************************************************************** ; * Global options * ; ************************************************************************** ; Debugging stuff (may be useful for troubleshooting) debug = debug ;output = stunnel.log ; Enable FIPS 140-2 mode if needed for compliance ;fips = yes ; Microsoft CryptoAPI engine allows for authentication with private keys ; stored in the Windows certificate store ; Each section using this feature also needs the "engineId = capi" option engine = capi [FIX] client = yes accept = 9021 connect = fixuat.au.abnamroclearing.com:9443<http://fixuat.au.abnamroclearing.com:9443> cert = C:\certs\jim.howland.cer key = C:\certs\jim.howland.key verify = 3 ; CAfile = C:\certs\veriSign_root_certificates\symantec-class3-G5.cer engineId = capi and here is the error [ ] Cron thread initialized [ ] No limit detected for the number of clients [.] stunnel 5.31 on x86-pc-msvc-1500 platform [.] Compiled/running with OpenSSL 1.0.2g-fips 1 Mar 2016 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] GUI message loop initialized [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark detected [ ] Enabling support for engine "capi" [ ] Initializing engine #1 (capi) [ ] Engine #1 (capi) initialized [.] FIPS mode disabled [ ] Compression disabled [ ] Snagged 64 random bytes from C:/.rnd [ ] Wrote 0 new random bytes to C:/.rnd [ ] PRNG seeded successfully [ ] Initializing service [FIX] [!] Service [FIX]: Either "CAfile" or "CApath" has to be configured [!] Server is down Any ideas? Kind Regards, Jim Howland | Linux Engineer ABN AMRO | ABN AMRO Clearing Sydney Pty Ltd Level 8, 50 Bridge Street | Sydney NSW 2000 | Australia Tel: +61 (0)2 9151 3124 | Mobile: +61 (0)417 885818 | Internet abnamroclearing.com ******** This message (including any attachments ) is confidential and is intended solely for the use of the individual or entity to whom it is addressed. If you have received this message by mistake please notify the sender by return email and delete this message from your system. Any unauthorised use or dissemination of this message in whole or in part is strictly prohibited. ********

1 0

Error 1408F10B talking to Active Directory on port 636
by Matthew Slowe 07 Mar '16

07 Mar '16

Hi all! We’ve been using stunnel as part of a vendor supplied product for some time to connect a large application running in an application server on Windows to Active Directory for authentication via LDAPS (for some reason, it only natively supports LDAP!). Anyway, it’s been working fine until a couple of weeks ago when we started getting intermittent failures against all of our configured Domain Controllers (the upstream LDAPS servers). With no change in STunnel or DC config, some connections would abort with the following log: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number … while others worked fine. The error is not limited to any one of the upstream DCs nor does it occur for every request. We’ve updated STunnel to the latest version (5.31) and the problem remains running on Windows 2008 R2 SP1. Below are two transactions from the same instance of STunnel connecting to the same DC one which works and one which doesn’t (IP addresses obfuscated). Config in use: {{{ client = yes debug = 7 output = e:\prog\stunnel\stunnel.log options = NO_SSLv2 [ldaps] accept = localhost:389 connect = domain.local:636 }}} Any thoughts gratefully received! Thanks, Matthew Fails ==== 2016.03.04 15:20:25 LOG7[14]: Service [ldaps] started 2016.03.04 15:20:25 LOG5[14]: Service [ldaps] accepted connection from 127.0.0.1:63130 2016.03.04 15:20:25 LOG6[14]: failover: round-robin, starting at entry #2 2016.03.04 15:20:25 LOG6[14]: s_connect: connecting 10.10.1.254:636 2016.03.04 15:20:25 LOG7[14]: s_connect: s_poll_wait 10.10.1.254:636: waiting 10 seconds 2016.03.04 15:20:25 LOG5[14]: s_connect: connected 10.10.1.254:636 2016.03.04 15:20:25 LOG5[14]: Service [ldaps] connected remote server from 10.10.1.225:63131 2016.03.04 15:20:25 LOG7[14]: Remote socket (FD=448) initialized 2016.03.04 15:20:25 LOG6[14]: SNI: sending servername: ad.kent.ac.uk 2016.03.04 15:20:25 LOG7[14]: SSL state (connect): before/connect initialization 2016.03.04 15:20:25 LOG7[14]: SSL state (connect): SSLv3 write client hello A 2016.03.04 15:20:25 LOG7[14]: SSL alert (write): fatal: protocol version 2016.03.04 15:20:25 LOG3[14]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2016.03.04 15:20:25 LOG5[14]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.03.04 15:20:25 LOG7[14]: Remote socket (FD=448) closed 2016.03.04 15:20:25 LOG7[14]: Local socket (FD=492) closed 2016.03.04 15:20:25 LOG7[14]: Service [ldaps] finished (0 left) Works ====== 2016.03.02 18:18:01 LOG7[204]: Service [ldaps] started 2016.03.02 18:18:01 LOG5[204]: Service [ldaps] accepted connection from 127.0.0.1:52873 2016.03.02 18:18:01 LOG6[204]: failover: round-robin, starting at entry #0 2016.03.02 18:18:01 LOG6[204]: s_connect: connecting 10.10.1.254:636 2016.03.02 18:18:01 LOG7[204]: s_connect: s_poll_wait 10.10.1.254:636: waiting 10 seconds 2016.03.02 18:18:01 LOG5[204]: s_connect: connected 10.10.1.254:636 2016.03.02 18:18:01 LOG5[204]: Service [ldaps] connected remote server from 10.10.1.223:52874 2016.03.02 18:18:01 LOG7[204]: Remote socket (FD=492) initialized 2016.03.02 18:18:01 LOG6[204]: SNI: sending servername: ad.kent.ac.uk 2016.03.02 18:18:01 LOG7[204]: SSL state (connect): before/connect initialization 2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 write client hello A 2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 read server hello A 2016.03.02 18:18:01 LOG6[204]: Certificate verification disabled 2016.03.02 18:18:01 LOG6[204]: Certificate verification disabled 2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 read server certificate A 2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 read server key exchange A 2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 read server certificate request A 2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 read server done A 2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 write client certificate A 2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 write client key exchange A 2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 write change cipher spec A 2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 write finished A 2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 flush data 2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 read finished A 2016.03.02 18:18:01 LOG7[204]: 205 client connect(s) requested 2016.03.02 18:18:01 LOG7[204]: 205 client connect(s) succeeded 2016.03.02 18:18:01 LOG7[204]: 0 client renegotiation(s) requested 2016.03.02 18:18:01 LOG7[204]: 0 session reuse(s) 2016.03.02 18:18:01 LOG6[204]: SSL connected: new session negotiated 2016.03.02 18:18:01 LOG7[204]: Deallocating application specific data for addr index 2016.03.02 18:18:01 LOG6[204]: Negotiated TLSv1 ciphersuite ECDHE-RSA-AES256-SHA (256-bit encryption) 2016.03.02 18:18:01 LOG7[204]: Compression: null, expansion: null 2016.03.02 18:18:01 LOG6[204]: Read socket closed (readsocket) 2016.03.02 18:18:01 LOG7[204]: Sending close_notify alert 2016.03.02 18:18:01 LOG7[204]: SSL alert (write): warning: close notify 2016.03.02 18:18:01 LOG6[204]: SSL_shutdown successfully sent close_notify alert 2016.03.02 18:18:01 LOG3[204]: SSL_read: Connection reset by peer (WSAECONNRESET) (10054) 2016.03.02 18:18:01 LOG5[204]: Connection reset: 276 byte(s) sent to SSL, 44 byte(s) sent to socket 2016.03.02 18:18:01 LOG7[204]: Remote socket (FD=492) closed 2016.03.02 18:18:01 LOG7[204]: Local socket (FD=456) closed 2016.03.02 18:18:01 LOG7[204]: Service [ldaps] finished (0 left) -- Matthew Slowe | Server Infrastructure Officer IT Infrastructure, Information Services, University of Kent Room S21, Cornwallis South Canterbury, Kent, CT2 7NZ, UK Tel: +44 (0)1227 824265 www.kent.ac.uk/is | @UnikentUnseenIT | @UKCLibraryIt PGP: https://keybase.io/fooflington

1 0

CRL checking
by Fritz Gschwendner 03 Mar '16

03 Mar '16

Hello, I noticed a change in functionality of CRL checking in server mode somewhere between stunnel version 5.2.00 and 5.31.00. We have multiple services listening for incoming connections and a global option CRLfile = crls.pem, with crls.pem containing a few CRLs but not one for every possible client certificate, and client certificates not all having a CRL distribution point configured. This worked with the old version in the sense that all clients could connect. I don't know If CRL checking really worked, they are all empty and I can't test. With the new version client certificates with no CRL and no CRL distribution point configured got rejected with errors "CERT: Pre-verification error: unable to get certificate CRL" and "SSL_accept: 14089086: error:14089086:SSL routines:ssl3_get_client_certificate:certificate verify failed" If I remove the global entry for CRLfile with the new version, all clients can connect again. I guess I could enter the CRLfile option on service level, but it could be that some client certificates connecting to a specific service have a CRL and some don't. My questions: Is this intended behaviour? I find it logical to check the CRL of a client certificate, if there is one in the CRLfile, if there isn't, to not check. Does a CRL distribution point configured in a client certificate play any role?

2 1

Problem with Stunnel 5.31 and Openssl 1.0.2g
by Carter Browne 02 Mar '16

02 Mar '16

I have a confusing problem I cannot figure out: I have two systems: one Redhat 5.10 x86, the other CentOs 5.10 x86 I compiled openssl version 1.0.2g on both systems I compiled stunnel 5.31 on both systems In both cases, this was updating older working verions of openssl and stunnel. On the Redhat system I used gcc44 On the CentOS system i used gcc4.1 The CentOS system works as before. On the Redhat system all self signed certificates are rejected. As I only use self-signed certificates to identify a set of known hosts, this is a problem for me. I tried various verify optios (2 3 4) both nothing changed. Any idea on how to fix this problem. What information can I provide you with to help? Thanks, Carter Carter Browne cbrowne(a)cbcs-usa.com

2 1

Slow sending email through stunnel to Office365
by ajreynolds＠san.rr.com 01 Mar '16

01 Mar '16

After a bit of experimentation, I've succeeded in getting stunnel 5.31 running on my Windows 2008 r2 server and sending email through SMTP through Office365. My problem now is that it's quite slow. I can see a point in the log file where it stops for 5 seconds or more for each email message. Are there any parameter for stunnel that might help, or do I have to just accept that Office365 is slow? Here is my stunnel.conf file: debug = 7 output = stunnel.log [ms-smtp] protocol = smtp client = yes accept = 587 connect = smtp.office365.com:587 And here is the log file for an email transmission. Notice the 5 second pause at 12:31:04. Is there a way to eliminate this pause? 2016.03.01 12:30:21 LOG7[cron]: Cron thread initialized 2016.03.01 12:30:21 LOG7[main]: No limit detected for the number of clients 2016.03.01 12:30:21 LOG5[main]: stunnel 5.31 on x86-pc-msvc-1500 platform 2016.03.01 12:30:21 LOG5[main]: Compiled/running with OpenSSL 1.0.2g-fips 1 Mar 2016 2016.03.01 12:30:21 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2016.03.01 12:30:21 LOG7[main]: errno: (*_errno()) 2016.03.01 12:30:21 LOG7[service]: GUI message loop initialized 2016.03.01 12:30:21 LOG5[main]: Reading configuration from file stunnel.conf 2016.03.01 12:30:21 LOG5[main]: UTF-8 byte order mark detected 2016.03.01 12:30:21 LOG5[main]: FIPS mode disabled 2016.03.01 12:30:21 LOG7[main]: Compression disabled 2016.03.01 12:30:21 LOG7[main]: Snagged 64 random bytes from C:/.rnd 2016.03.01 12:30:21 LOG7[main]: Wrote 1024 new random bytes to C:/.rnd 2016.03.01 12:30:21 LOG7[main]: PRNG seeded successfully 2016.03.01 12:30:21 LOG6[main]: Initializing service [ms-smtp] 2016.03.01 12:30:21 LOG7[main]: No certificate or private key specified 2016.03.01 12:30:21 LOG4[main]: Service [ms-smtp] needs authentication to prevent MITM attacks 2016.03.01 12:30:21 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2016.03.01 12:30:21 LOG5[main]: Configuration successful 2016.03.01 12:30:21 LOG7[main]: Listening file descriptor created (FD=424) 2016.03.01 12:30:21 LOG7[main]: Service [ms-smtp] (FD=424) bound to 0.0.0.0:587 2016.03.01 12:30:58 LOG7[main]: Found 1 ready file descriptor(s) 2016.03.01 12:30:58 LOG7[main]: FD=388 ifds=r-x ofds=--- 2016.03.01 12:30:58 LOG7[main]: Service [ms-smtp] accepted (FD=440) from 192.168.8.58:55266 2016.03.01 12:30:58 LOG7[main]: Creating a new thread 2016.03.01 12:30:58 LOG7[main]: New thread created 2016.03.01 12:30:58 LOG7[0]: Service [ms-smtp] started 2016.03.01 12:30:58 LOG5[0]: Service [ms-smtp] accepted connection from 192.168.8.58:55266 2016.03.01 12:30:58 LOG6[0]: failover: round-robin, starting at entry #3 2016.03.01 12:30:58 LOG6[0]: s_connect: connecting 132.245.34.194:587 2016.03.01 12:30:58 LOG7[0]: s_connect: s_poll_wait 132.245.34.194:587: waiting 10 seconds 2016.03.01 12:30:58 LOG5[0]: s_connect: connected 132.245.34.194:587 2016.03.01 12:30:58 LOG5[0]: Service [ms-smtp] connected remote server from 192.168.8.14:55477 2016.03.01 12:30:58 LOG7[0]: Remote descriptor (FD=460) initialized 2016.03.01 12:30:59 LOG7[0]: <- 220 CY1PR21CA0008.outlook.office365.com Microsoft ESMTP MAIL Service ready at Tue, 1 Mar 2016 20:30:58 +0000 2016.03.01 12:30:59 LOG7[0]: -> 220 CY1PR21CA0008.outlook.office365.com Microsoft ESMTP MAIL Service ready at Tue, 1 Mar 2016 20:30:58 +0000 2016.03.01 12:30:59 LOG7[0]: -> EHLO localhost 2016.03.01 12:30:59 LOG7[0]: <- 250-CY1PR21CA0008.outlook.office365.com Hello [#.#.#.#] 2016.03.01 12:30:59 LOG7[0]: <- 250-SIZE 157286400 2016.03.01 12:30:59 LOG7[0]: <- 250-PIPELINING 2016.03.01 12:30:59 LOG7[0]: <- 250-DSN 2016.03.01 12:30:59 LOG7[0]: <- 250-ENHANCEDSTATUSCODES 2016.03.01 12:30:59 LOG7[0]: <- 250-STARTTLS 2016.03.01 12:30:59 LOG7[0]: <- 250-8BITMIME 2016.03.01 12:30:59 LOG7[0]: <- 250-BINARYMIME 2016.03.01 12:30:59 LOG7[0]: <- 250 CHUNKING 2016.03.01 12:30:59 LOG7[0]: -> STARTTLS 2016.03.01 12:30:59 LOG7[0]: <- 220 2.0.0 SMTP server ready 2016.03.01 12:30:59 LOG6[0]: SNI: sending servername: smtp.office365.com 2016.03.01 12:30:59 LOG7[0]: SSL state (connect): before/connect initialization 2016.03.01 12:30:59 LOG7[0]: SSL state (connect): SSLv2/v3 write client hello A 2016.03.01 12:30:59 LOG7[0]: SSL state (connect): SSLv3 read server hello A 2016.03.01 12:30:59 LOG6[0]: Certificate verification disabled 2016.03.01 12:30:59 LOG6[0]: Certificate verification disabled 2016.03.01 12:30:59 LOG7[0]: SSL state (connect): SSLv3 read server certificate A 2016.03.01 12:30:59 LOG7[0]: SSL state (connect): SSLv3 read server key exchange A 2016.03.01 12:30:59 LOG6[0]: Empty client CA list 2016.03.01 12:30:59 LOG7[0]: SSL state (connect): SSLv3 read server certificate request A 2016.03.01 12:30:59 LOG7[0]: SSL state (connect): SSLv3 read server done A 2016.03.01 12:30:59 LOG7[0]: SSL state (connect): SSLv3 write client certificate A 2016.03.01 12:30:59 LOG7[0]: SSL state (connect): SSLv3 write client key exchange A 2016.03.01 12:30:59 LOG7[0]: SSL state (connect): SSLv3 write change cipher spec A 2016.03.01 12:30:59 LOG7[0]: SSL state (connect): SSLv3 write finished A 2016.03.01 12:30:59 LOG7[0]: SSL state (connect): SSLv3 flush data 2016.03.01 12:30:59 LOG7[0]: SSL state (connect): SSLv3 read finished A 2016.03.01 12:30:59 LOG7[0]: 1 client connect(s) requested 2016.03.01 12:30:59 LOG7[0]: 1 client connect(s) succeeded 2016.03.01 12:30:59 LOG7[0]: 0 client renegotiation(s) requested 2016.03.01 12:30:59 LOG7[0]: 0 session reuse(s) 2016.03.01 12:30:59 LOG6[0]: SSL connected: new session negotiated 2016.03.01 12:30:59 LOG7[0]: Peer certificate was cached (4882 bytes) 2016.03.01 12:30:59 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-SHA384 (256-bit encryption) 2016.03.01 12:30:59 LOG7[0]: Compression: null, expansion: null 2016.03.01 12:31:04 LOG6[0]: Read socket closed (readsocket) 2016.03.01 12:31:04 LOG7[0]: Sending close_notify alert 2016.03.01 12:31:04 LOG7[0]: SSL alert (write): warning: close notify 2016.03.01 12:31:04 LOG6[0]: SSL_shutdown successfully sent close_notify alert 2016.03.01 12:31:04 LOG6[0]: SSL socket closed (SSL_read) 2016.03.01 12:31:04 LOG7[0]: Sent socket write shutdown 2016.03.01 12:31:04 LOG5[0]: Connection closed: 413 byte(s) sent to SSL, 635 byte(s) sent to socket 2016.03.01 12:31:04 LOG7[0]: Remote descriptor (FD=460) closed 2016.03.01 12:31:04 LOG7[0]: Local descriptor (FD=440) closed 2016.03.01 12:31:04 LOG7[0]: Service [ms-smtp] finished (0 left) Thanks very much, Andy

1 0

stunnel 5.31 released
by Michal Trojnara 01 Mar '16

01 Mar '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear Users, I have released version 5.31 of stunnel. The ChangeLog entry: Version 5.31, 2016.03.01, urgency: HIGH * Security bugfixes - OpenSSL DLLs updated to version 1.0.2g. https://www.openssl.org/news/secadv_20160301.txt * New features - Added logging the list of client CAs requested by the server. - Improved compatibility with the current OpenSSL 1.1.0-dev tree. * Bugfixes - Only reset the watchdog if some data was actually transferred. - A workaround implemented for the unexpected exceptfds set by select() on WinCE 6.0 (thx to Richard Kraemer). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: a746b71ab3dc6c23eacb0daf7342467870e43ac933430905eb1b1d050bbae0b7 stunnel-5.31.tar.gz c662fc1254f22ce5ac3f6e09bf643b3a0a99a884b6414f55cc8ab22d7c680fd5 stunnel-5.31-installer.exe f14d7c9cf23a25bdcef8480f9d35c66233bb9e64f82098f1867edf4b038b41c4 stunnel-5.31-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJW1cIFAAoJEC78f/DUFuAU998P/1LpUY+B/Q4E7XWCctK1XspG zcFi8U5UhaMek9eTPlY0mJWUGihX4qQOeQi+9MV9LqvzLLfWbgMzWSv/rAiWxCzx NbHw7yASK5+xfnGBGoSenvdbvmL6s4RPxM0Qf3lrVj9kpha75JS9aHPnDhq90aLG YXle0uTj/dvDC3aG2UY0TYFQMvvubrx87JyoiTbf9i2f6q85iM76DaeP15mMZSXZ eq+9bP37OVG6RDFrlFSoSSHxOWHA5ebftwvf4MjedrziXld6pzYSzwIJ7eJhZO7Y ob+hRO3D86chiGfynYj1WWws51Q+TE4hg2NQ7vWPEi7HuN+/62CMZg3q1h/LAIT+ 2qzjVFIoVwwl8B3RZ94aJ8AzsFnhWOp5AZJ7nOBFbF69cRAuIT6DQL+GwcJoB+RJ +sxlJAyhu+3/RuAPbZYXzSzr7Lsp4/fhWIxVRW5rBqHSJCBZU+QqSOTu9GP06F9i 7FaUq9p7RxajVjtqn+QmzDpVTgBymkYvc3F1+ATSUZZNLU8KPWG+aYTtSYKKEDQS VBtQJ3BRR0Ne/TqBXStdK3PdG8t8r7hoYhPSAE1IX59F0/4MaKHcAoyDEAH5aKQx rK1Iowb5DUNF/Rcota3CXzLFBfp/ePmZFbjpQd9YcGtMXnMGFk9/Lnc+8If+vHGk p66Kx7ZYLNzkIPf0y8wn =WkNw -----END PGP SIGNATURE-----

1 0

How to build Stunnel on x64 Windows by VC with right alignment memory allocation functions
by zuz666＠gmail.com 28 Feb '16

28 Feb '16

Hello! I need to compile stunnel using VC for Windows x64 platform. I know that I can use MinGW/gcc and it will work, but VC used to build all other libraries and I want to simplify assembly process. I am try build stunnel by VC for Windows x64 platform and it builds fine but after start, stunnel crashed in VC runtime after calling setjmp function in client.c : /* try to process the request */ err=setjmp(c->err); I did some researches of the reason of a problem and found the following comment in prototypes.h: jmp_buf err; /* exception handler needs to be 16-byte aligned on Itanium */ The memory for CLI struct allocated by str_alloc_detached function (jmp_buf uded in definition CLI struct), but jmp_buf for AMD64/x64 must be 16-byte aligned to save state of SSE registers. Function calloc used for memory allocation in str_alloc_detached function and sometimes it return pointers not aligned to 16-byte boundary what causes a problem. I create dummy patch to workaround the problem but am think the best solution in that case is to use malloc instead calloc function (as described in some articles it’s always 16-byte aligned on AMD64 VC builds). Can you suggest some solutions to this problem? prototypes.h @@ -404,6 +404,10 @@ typedef struct { uint64_t sock_bytes, ssl_bytes; /* bytes written to socket and SSL */ s_poll_set *fds; /* file descriptors */ uintptr_t redirect; /* redirect to another destination after failed auth */ + /* New member added by Zuz to work around setjmp alignment issues */ +#if defined(_MSC_VER) && defined(_WIN64) + void *cli_struct_free_ptr; /* Ptr to unaligned address for this struct */ +#endif } CLI; client.c @@ -76,8 +76,14 @@ NOEXPORT void reset(SOCKET, char *); CLI *alloc_client_session(SERVICE_OPTIONS *opt, SOCKET rfd, SOCKET wfd) { static unsigned long long seq=0; CLI *c; - +#if defined(_MSC_VER) && defined(_WIN64) + #define CLI_STRUCT_ALIGNMENT 15 + void *cli_ptr_unaligned = str_alloc_detached(sizeof(CLI) + CLI_STRUCT_ALIGNMENT); + c = (CLI *)(((uintptr_t)cli_ptr_unaligned+CLI_STRUCT_ALIGNMENT) & ~ (uintptr_t)0x0F); + c->cli_struct_free_ptr = cli_ptr_unaligned; +#else c=str_alloc_detached(sizeof(CLI)); +#endif c->opt=opt; c->local_rfd.fd=rfd; c->local_wfd.fd=wfd; @@ -117,7 +123,13 @@ void client_main(CLI *c) { * -> spawn a local program instead of stdio */ for(;;) { SERVICE_OPTIONS *opt=c->opt; +#if defined(_MSC_VER) && defined(_WIN64) + void *cli_ptr_unaligned = c->cli_struct_free_ptr; +#endif memset(c, 0, sizeof(CLI)); /* connect_local needs clean c */ +#if defined(_MSC_VER) && defined(_WIN64) + c->cli_struct_free_ptr = cli_ptr_unaligned; +#endif c->opt=opt; if(!setjmp(c->err)) c->local_rfd.fd=c->local_wfd.fd=connect_local(c); @@ -136,7 +148,11 @@ void client_main(CLI *c) { } } else client_run(c); - str_free(c); +#if defined(_MSC_VER) && defined(_WIN64) + str_free(c->cli_struct_free_ptr); +#else + str_free(c); +#endif } #ifdef __GNUC__ -- Yuris W. Auzins

1 0

Forthcoming stunnel release
by Michal Trojnara 27 Feb '16

27 Feb '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear Users, A quick heads-up before the stunnel 5.31 release scheduled for 01 March 2016. The intended change log entry is: Version 5.31, 2016.03.01, urgency: HIGH * Security bugfixes - OpenSSL DLLs updated to version 1.0.2g. https://www.openssl.org/news/secadv_20160301.txt * New features - Added logging the list of client CAs requested by the server. - Improved compatibility with the current OpenSSL 1.1.0-dev tree. * Bugfixes - Only reset the watchdog if some data was actually transferred. - A workaround implemented for the unexpected exceptfds set by select() on WinCE 6.0 (thx to Richard Kraemer). Feel free download the latest beta from https://www.stunnel.org/downloads.html and report any issues. Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJW0IYYAAoJEC78f/DUFuAUCw4P/20m8FSJcnyls4TIDbn4pbmi ZGTneC1qBt4y/lAbQpQHaUQDmwhmSZ10h1jwIf7IRNWGGiy4oPuFofY8Ee64uwvs +PKI9ZTsXlL9K7gkfusfhGrw2xnmx2j9fiw/bcby+qxTh6qkR7xGAR7kdFGba6iI KLPi/AfsP/lR8BDxKIwIzcE+REOAk4Fzn9cU2HqOlwZOVuBm9k0udsuqtbl4aUO1 35fhYpNaCzMEsYFxQrF7rgUfQzD5m/8LAMk3mvBa8ByGCbSLBenETSOb++xaND92 wjL0Nv4+HDlP/XY0HfLMqhexoG5XCL1fu3cAuTPVf7PT34EGWLtickExY1w1TVKY DsND1YpCffN20ZjYksKj6IBb/dG/72Yz1MzNgbvd/x4l4PJv1O5BJQWQQ4y58+Gg b8sL4LBXXINgQdNptGSJfoQFRA1NtaNKTyOzEbeN+rcSnCcWZXnRVh5nR7rd8C14 A5EofhK0op18uyMuwTbTp1VlEvMNSW5ZGsxa0itaXHaCcF0uF/bbn/JiKYQh/TUo kOxvVu8KOmwoixw5jgGvnBnKfQSA/G7S/fcJ2WlQzBIQJFHyU159bIeTTORWCrIR /yYe/PJYgufCXmKQW7SkNOtcQggRi4IuM87+nxoFLE6u/7GxmFgN2y2kWsmc71Ev sQqDi9BBv7Kag3a7ozif =z3hT -----END PGP SIGNATURE-----

2 1

Version 4.29: First connection fails with "Unexpected socket close (read_blocking)"
by Matthew 26 Feb '16

26 Feb '16

Hi, I am experiencing an issue with version 4.29, which is the version available on yum for centos6. I am getting the following error: "Unexpected socket close (read_blocking)". This error only occurs once per stunnel instance upon the first connection only. More recent versions of stunnel do not have this problem, but I am hoping to work around this issue on the default version for this OS. My hosts.allow and hosts.deny files are both empty. I have tried adding my services to hosts.allow, but it did not have any noticeble effect. This is the version that I am using (installed with "yum install stunnel"): $ stunnel -version stunnel 4.29 on x86_64-redhat-linux-gnu with OpenSSL 1.0.1e-fips 11 Feb 2013 Threading:PTHREAD SSL:ENGINE,FIPS Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = FIPS key = /etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = TLSv1 TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none This is what my demonstration setup looks like: nc_client --TCP--> stunnel_client (2000) --SSL--> stunnel_server (2100) --TCP--> nc_server (2200) Steps to reproduce: (1) Start the netcat TCP server. $ nc -l 2200 (2) Leave the server open and open a new terminal for the rest of the commands. (3) Create “client_config.txt” with the following contents: pid = /tmp/client_stunnel.pid debug = 7 output = /tmp/client_stunnel.log client = yes ciphers = ALL fips = no foreground = no [CLIENT_PROXY_0] accept = 0.0.0.0:2000 connect = 127.0.0.1:2100 (4) Create “server_config.txt” with the following contents: pid = /tmp/server_stunnel.pid debug = 7 output = /tmp/server_stunnel.log client = no ciphers = ALL fips = no cert = /tmp/server_stunnel.pem foreground = no [SVR_PROXY_0] accept = 0.0.0.0:2100 connect = 127.0.0.1:2200 (4) Start the stunnel client: $ cat client_config.txt | stunnel -fd 0 (5) Start the stunnel server: $ cat server_config.txt | stunnel -fd 0 (6) Send three sequential messages through stunnel to the netcat server: $ echo "Test 1" | nc 127.0.0.1 2000 $ echo "Test 2" | nc 127.0.0.1 2000 $ echo "Test 3" | nc 127.0.0.1 2000 (7) You should see only “Test 3” appear at the netcat server. “Test 1” will have failed to pass from the stunnel client to the stunnel server and the log will report an "Unexpected socket close (read_blocking)” error. “Test 2” is not the first connection for the stunnel client, so it will pass through to the stunnel server successfully. But because it is the first connection for the stunnel server, it will fail there with the same error. “Test 3” is not the first connection for either the stunnel client or stunnel server, so it will make it through successfully to the netcat server. All subsequent connections will work. Basically my question is: Is there any way to make this setup work on the first connection with version 4.29, or is a new version necessary? Thanks, Matthew

1 0

How to use stunnel as a HTTPS to HTTPS reverse proxy
by Claudio Beretta 26 Feb '16

26 Feb '16

I'd like Stunnel to act as a reverse proxy that accepts TLS 1.0 and TLS 1.2 for https://example.com and then forwards the traffic to https://example.net, another web server that only accepts TLS 1.2 browser --TLS 1.0 or 1.2--> Stunnel --TLS 1.2--> Web App The browser should have no idea that example.net even exists (only example.com certificate will be presented to the browser). Is this something Stunnel can do? This is what I got so far: cert = example.com.pem ;stunnel.pem [proxy1] client = yes accept = 10.100.4.179:443 connect = localhost:54323 CAfile = sca.server1.crt.pem ;verify = 2 [proxy2] client = no accept = localhost:54323 connect = example.net:443 ;CAfile = SymantecClass3EVSSLCA-G3.pem example.com.pem contains the public and decrypted private key for example.com sca.server1.crt.pem contains the intermediate and root certificates of the CA that issues the example.com.pem certificate It partially works: the browser shows example.com in the address bad and the content of example.net, but the certificate that is returned is from example.net What am I doing wrong? Or do you have other recommendations to get something like this working on Windows Server 2008 R2? (IIS + Application Request Routing + URL Rewrite won't work: TLS1.2 is not properly supported) Thank you Claudio

3 4

Usint Stunnel in combination with tinyproxy and PSK
by Christoph Malin 26 Feb '16

26 Feb '16

Hello, I have tinyproxy running on my server. Now I would like to add stunnel with a pres shared key (username, password combination). Is it possible to use this combination as a Proxy on my normal web browser e.g. firefox? So that stunnel ist only used on server side? greetings Christoph

1 0

User-agent string
by Josh Rabinowitz 22 Feb '16

22 Feb '16

Is there a way to force stunnel to use a specific user-agent string? I have mulled through documentation, this list, and other places with no results. The reason I ask, is the proxy I am going through is super strict, well not really. It will accept 'lynx' as a user-agent (among others), but it needs something. I cannot figure out how to tell stunnel to use something like this. 5.30 on both ends, here is debug 7 from the client (IPs changed for privacy) after a config reload and ssh attempt: 2016.02.22 09:22:08 LOG5[main]: Reading configuration from file stunnel.conf 2016.02.22 09:22:08 LOG5[main]: UTF-8 byte order mark not detected 2016.02.22 09:22:08 LOG5[main]: FIPS mode disabled 2016.02.22 09:22:08 LOG5[main]: Configuration successful 2016.02.22 09:22:15 LOG7[4]: Service [ssh] started 2016.02.22 09:22:15 LOG5[4]: Service [ssh] accepted connection from 127.0.0.1:56690 2016.02.22 09:22:15 LOG6[4]: failover: round-robin, starting at entry #1 2016.02.22 09:22:15 LOG6[4]: s_connect: connecting [webproxyIP]:8080 2016.02.22 09:22:15 LOG7[4]: s_connect: s_poll_wait [webproxyIP]:8080: waiting 10 seconds 2016.02.22 09:22:15 LOG5[4]: s_connect: connected [webproxyIP]:8080 2016.02.22 09:22:15 LOG5[4]: Service [ssh] connected remote server from [clientIP]:56691 2016.02.22 09:22:15 LOG7[4]: Remote descriptor (FD=844) initialized 2016.02.22 09:22:15 LOG7[4]: -> CONNECT [remoteIP]:443 HTTP/1.1 2016.02.22 09:22:15 LOG7[4]: -> Host: [remoteIP]:443 2016.02.22 09:22:15 LOG7[4]: -> 2016.02.22 09:22:15 LOG7[4]: <- HTTP/1.1 403 Forbidden 2016.02.22 09:22:15 LOG3[4]: CONNECT request rejected 2016.02.22 09:22:15 LOG7[4]: <- Cache-Control: no-cache 2016.02.22 09:22:15 LOG7[4]: <- Pragma: no-cache 2016.02.22 09:22:15 LOG7[4]: <- Content-Type: text/html; charset=utf-8 2016.02.22 09:22:15 LOG7[4]: <- Proxy-Connection: close 2016.02.22 09:22:15 LOG7[4]: <- Connection: close 2016.02.22 09:22:15 LOG7[4]: <- Content-Length: 3164 2016.02.22 09:22:15 LOG7[4]: <- 2016.02.22 09:22:15 LOG5[4]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.02.22 09:22:15 LOG7[4]: Remote descriptor (FD=844) closed 2016.02.22 09:22:15 LOG7[4]: Local descriptor (FD=1116) closed 2016.02.22 09:22:15 LOG7[4]: Service [ssh] finished (0 left) client config: cert = stunnel.pem client = yes [ssh] accept = 127.0.0.1:2222 protocol= connect connect = [webproxyIP]:8080 protocolHost = [remoteIP]:443 PSKsecrets = psk1.txt debug = 7 Confirmed working from other hosts outside of this network. Thanks

1 0

Re: [stunnel-users] Using CAPI Engine for client authentication
by Michal Trojnara 22 Feb '16

22 Feb '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 21.02.2016 10:23, Shay Cohen wrote: > LOG6[10]: No client CA list It looks like your server does not request a client certificate. You may try connecting your service with MSIE, which natively uses client certificates from the Windows Certificate Store. If the server is configured correctly, MSIE should be able to establish TLS even if the service does not speak HTTPS. Just use https://1.2.3.4:9000/ Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWyslNAAoJEC78f/DUFuAUKowQALxsJAxHJsiglCmxlu7HevvI I7NE77SwJOh3rCQ7KrZ+HMlq36PpxzeiRmjkwstp2dMJ5KKu8+rzbGqvxcFQjKQG w3P7GE2sn3Kw1aakOj2sJBuzYTCM3mRpl4ARD10yiZv42leggWfhLHh3bU4eFmEn Mr7k2GM51uhjooDpYTY604wloxISC0m4FWcPl3elp0mDpDgYA1TehbsIsd0KxH13 poiCZGB44AuzX1As350fb3D31GLqQmZ9bCrgGY1OGepX14VeH304fFctCSqlrAa9 XGup/cmJy6URWZ26GUP7l3zOJtH5LRXEafbGPRfRKK2ZaDSt+NGCWypKA1pJ3XGK W1u6H8ggf6gER3z9Yvqemi8ukQ4C7zIt4vu10HYZ2hehxv7HpHL5Lkrj5lT+zGQQ nkOy4kckrAlk1RXTh2HO3DXlq5IHjh/8UrP/OhaRv7tb6tRVJ4I5L9Xl3kes9lJj BdgW5fS3E0F6iyJoWanviIUSjAAKT8mOhoxQhu3KvVL6Krm0J59hWTSCfdGjVwPY lMEIy2xLxUyEgDjO1r1XdPWsns5uq1wVz8BnQ6F6dgXrpOZwjUJ0DW4NZyK0m4pv +X9paNAOQaXOsSfMF8dHChL+UFuEIlCO0ILoISh3N+hJCyUJkPw8LK9Lr0cYRhif V8eUxUXA52BUqvGdzUHa =PZNb -----END PGP SIGNATURE-----

1 0

Using CAPI Engine for client authentication
by Shay Cohen 18 Feb '16

18 Feb '16

Hi, I am trying to configure one of my clients to use 'engine = capi', but cannot find a way to define which Key to actually use. debug = 7 does not show engine internal actions and engineCtrl = CAPI_CMD_DEBUG_LEVEL:2 gives an error, as well as engineCtrl = DEBUG_LEVEL:2 I'de appreciate any help with configuring this. Thanks in advance, Shay

2 2

Fw: new message
by mysql.jorge＠decimal.pt 09 Feb '16

09 Feb '16

Hey! Open message <http://sudarena.intelmedia.ro/back.php?5n11v> mysql.jorge(a)decimal.pt

1 0

User-defined headers to CONNECT
by Jason Whitener 05 Feb '16

05 Feb '16

"Add user-defined headers to CONNECT proxy requests. This can be used to impersonate other software (e.g. web browsers)." My search skills are lacking today apparently. I can't find any documentation or examples about sending custom headers back to the server. Can someone please provide an example or a link to an example? I need to send "WL-Proxy-SSL:true" back to a Web Logic server in the header with each request. Nothing too tricky I assume. Jason

1 0

Log to file WSS Websocket packet traffic
by Francesco Alfano 05 Feb '16

05 Feb '16

How can I log to file all packet traffic coming from a wss web socket on port 1234 using stunnel, openssl and tcpdump ? I have already seen https://gist.github.com/jeremiahsnapp/6426298#file-stunnel-mitm-proxy-conf , but I would like to know how to configure it

1 0

Microsoft Exchange 2010 - SMTP issue
by mahdi＠kadtekautomation.com 04 Feb '16

04 Feb '16

Hey all, Has anybody here been successful connecting to Microsoft Exchange 2010 servers usnig STunnel? Here is what I have in my stunnel.conf: ******************** cert = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 client = yes [ssmtp] accept = 127.0.0.1:587 connect = smtp.ex3.secureserver.net:587 ******************* And this is what I see in the log: ******************* 2016.02.03 18:55:14 LOG5[63]: Service [ssmtp] accepted connection from 127.0.0.1:57314 2016.02.03 18:55:14 LOG5[63]: s_connect: connected 184.168.131.205:587 2016.02.03 18:55:14 LOG5[63]: Service [ssmtp] connected remote server from 10.10.10.10:57315 2016.02.03 18:55:14 LOG3[63]: SSL_connect: 140770FC: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol 2016.02.03 18:55:14 LOG5[63]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket ******************* I am quite sure that my server address and port is correct, and obviously the other application is pushing data to stunnel. Seems like what's coming back from server is puzzling. Any help regarding this? Thanks, Mahdi.

1 0

stunnel 5.30 released
by Michal Trojnara 28 Jan '16

28 Jan '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear Users, I have released version 5.30 of stunnel. The ChangeLog entry: Version 5.30, 2016.01.28, urgency: HIGH * Security bugfixes - OpenSSL DLLs updated to version 1.0.2f. https://www.openssl.org/news/secadv_20160128.txt * New features - Improved compatibility with the current OpenSSL 1.1.0-dev tree. - Added OpenSSL autodetection for the recent versions of Xcode. * Bugfixes - Fixed references to /etc removed from stunnel.init.in. - Stopped even trying -fstack-protector on unsupported platforms (thx to Rob Lockhart). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 7d6eb389f6a1954b3bcf6c71d4ae3c5f9dde1990dd0b9e0cb1c7caf138d60570 stunnel-5.30.tar.gz cf13a881d2f19b8db5e70fafac6e5dad31f041ee6b9c0316dbd8f9f425c16418 stunnel-5.30-installer.exe 102c54d0f58937fc3c3de2a6fb6295622222e48eae200123d6357889defa45c1 stunnel-5.30-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWqkhcAAoJEC78f/DUFuAUbZoP/iH+4dndQdh5SSpSH8NR2dUf Nx10nPHP9WXZIVF9C0pISDGpRcpRi6k+4p3NU8SblGsTRm78zCpWYmeEso46Q9ve IHCrUrmQntygZ5xL5Igij9rvN8s6VeucxiMX1pZBJWAvtV5Mj2XDWFEgGiUc+sPC leCJIhj+2G6hNZJzl5whptW48+smqQvh8LC5jEtFaAUp5C0ptjrmz/vebEDlVKOs qZOZMwLmNojP3WGWWrt5fkBCLZXKvkDipgI4ln3aro/fCYQZ5fikGYbW7dTOvNCT lFmCS2vXg1hqFNM3qBWp8HKqiyYR9nVYNesW5vQW/INp6wRSqul9QSJQwsVge37N wbl19KLZL0bqXYV5a5OTovi5X1X+wRbKkcGE8yozptifV4n1AgZL4rbLkKqFu/BF zHHUmOi1m5SkRAoN8pmaTmNFe/Zp72o6unN1kfrXyvJj6NCiDKXMqTmYw4bfoSBM UUg6uKtc7k7XGPvgca/HrdEu8DJPQIWcRqNVqQ5AxVnub9gBFsJC15XdgutHJK97 XuLhZhHBdm10Frf2u/nk2Q2GpPdHAPK67QgERzO2Nr35KGOxwMXahyxKK0jI5ue5 bekTLYjZYUKS94Lt/uUgxaVmwG0x1qjurfhdXoUemuYKUAzv2tZlNF1NiGme3feP WqLyTnuGhYIxEbltnFif =gYXk -----END PGP SIGNATURE-----

1 0

Re: [stunnel-users] Access an arbitrary https website on http://localhost:3000 via stunnel.
by Hongyi Zhao 15 Jan '16

15 Jan '16

2016-01-14 16:51 GMT+08:00 Michal Trojnara <Michal.Trojnara(a)stunnel.org>: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA256 > > Hi Hongyi, > > My hint: > > $ curl -s http://localhost:3000/ > Cannot GET / > > $ curl -s -H 'Host: coolaj86.com' http://localhost:3000/ Thanks a lot, I still have some issues: 1- Why must we use the ''-H 'Host: coolaj86.com' '' in this command for getting the correct result? 2- If I want to use internet explorer, such as firefox/chrome to open the corresponding url, i.e., http://localhost:3000/, how should I do? 3- There are 3 certificates given by the owner of the website https://coolaj86.com/. They are all stored here: https://gist.github.com/coolaj86/327cee3eee6fc119b389/ Just as you can see, the 3 certificates are named as follows: cert.pem chain.pem root.pem What's the relationship between the above 3 certificates? And the first certificate, i.e., the cert.pem, is the one used for the website https://coolaj86.com/. So, I just want to know why we must the root.pem in the stunnel's conf file? Regards > <!DOCTYPE html> > <html lang="en"> > <head> > <meta charset="utf-8"> > <title>AJ ONeal</title> > ... > > Best regards, > Mike > > On 14.01.2016 05:51, Hongyi Zhao wrote: >> Hi all, >> >> Based on the descriptions on the following webpage: >> >> http://plug.org/pipermail/plug/2015-August/033939.html >> >> I do the following testing: >> >> 1- Complile and install the lastest stunnel, i.e., the >> stunnel-5.29. >> >> 2- Obtaining the root cert >> >> wget -q >> https://gist.githubusercontent.com/coolaj86/327cee3eee6fc119b389/raw/r > oot.pem >> >> > - -O /tmp/root.pem >> >> 3- Prepare the following config file for stunnel: >> >> pid = /tmp/stunnel-tlsvpn.pid >> >> client = yes verify = 1 foreground = yes >> >> [tlsvpn] accept = localhost:3000 sni = coolaj86.com connect = >> coolaj86.com:443 CAfile = /tmp/root.pem >> >> 4- Starting the stunnel: >> >> $ stunnel ./stunnel-tlsvpn.conf >> >> 5- Testing: >> >> At this moment, I use the firefox to open the following url: >> >> http://localhost:3000 >> >> But the firefox will only give the following line in its windows: >> >> Cannot GET / >> >> Any hints on this issue? >> >> Regards >> > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v2 > > iQIcBAEBCAAGBQJWl2GYAAoJEC78f/DUFuAUwlAP/3w4sq5u4Wp1SV9mbB4Sr7D4 > nP++WO10HLpSFQRnO85BaX2XHwU5aC+AxDI9wztvkEXLE9gup3KfT9Dvk9cfrHHv > Vb+EmOnspKslsOI1X/pHbSxB7tuc816aqqW9Q2Vmwh9RoVnt0djFIIB/GpKQa/0m > YhJrfcpT+WmZ3xrKQUcsahVFTzgxWxZCbDO26c/B3n/ORSmCvs4lRuYXtAuqfGlX > q0+qHt4+gi69lc6PMLeGWEonFhgHCl3Mc2Oa5Y3atb52uWG3KS2b4KF+ZQWfhPFK > qMggrXNnGgtxrb52rTw8C0/e14v3ZmENB2NX3qZGOvgiS4YujbjE2yGOgjeJzaxo > x/UEOFY2X879TECrThEWS87e6BiMog5iKYw8VneJ6rAYn40vGPEji5Lg8kTUU3kC > Du5u2zyIdPmqHhTKqpSoIgFKt1w80VpM7wZ/Z8H12yJJh1MHvh7EFUZTZ987nMpt > UNf8wCTTDxMEnQI/kMODLBLO9ntGnCHF0PXQ3s24zQ10/BftLyNbTMMTs14bktQG > hyWV/aGqF7+dtgcTgirLn1cypxKW5wrF8JOt5I/B1c3/fafHny/I4NyuF5MQuEB9 > GDDjYwbcQrU4shSA4Hoe5mWQDpdBJUBb5+8wHkgZg2neU8wcfyzEPucS960eG46Q > zSbvpAgUjmvP91qZhWyI > =oyVS > -----END PGP SIGNATURE----- -- Hongyi Zhao <hongyi.zhao(a)gmail.com> Xinjiang Technical Institute of Physics and Chemistry Chinese Academy of Sciences GnuPG DSA: 0xD108493

3 6

Access an arbitrary https website on http://localhost:3000 via stunnel.
by Hongyi Zhao 14 Jan '16

14 Jan '16

Hi all, Based on the descriptions on the following webpage: http://plug.org/pipermail/plug/2015-August/033939.html I do the following testing: 1- Complile and install the lastest stunnel, i.e., the stunnel-5.29. 2- Obtaining the root cert wget -q https://gist.githubusercontent.com/coolaj86/327cee3eee6fc119b389/raw/root.p… -O /tmp/root.pem 3- Prepare the following config file for stunnel: pid = /tmp/stunnel-tlsvpn.pid client = yes verify = 1 foreground = yes [tlsvpn] accept = localhost:3000 sni = coolaj86.com connect = coolaj86.com:443 CAfile = /tmp/root.pem 4- Starting the stunnel: $ stunnel ./stunnel-tlsvpn.conf 5- Testing: At this moment, I use the firefox to open the following url: http://localhost:3000 But the firefox will only give the following line in its windows: Cannot GET / Any hints on this issue? Regards -- Hongyi Zhao <hongyi.zhao(a)gmail.com> Xinjiang Technical Institute of Physics and Chemistry Chinese Academy of Sciences GnuPG DSA: 0xD108493

2 1

Re: [stunnel-users] Fwd: Stunnel log file format
by Ludolf Holzheid 12 Jan '16

12 Jan '16

On Tue, 2016-01-12 11:23:43 -0430, Jesús Alfredo Cambera wrote: > Hello Ludof, > > Thanks for answering so fast. I think this information would be really > useful for other users. I'd would be great if it could be included the the > manual page (https://www.stunnel.org/static/stunnel.html) > > I had just completed the logstash filters but still I have one last > question: What do the log levels correspond to: error, warning, info? Hi Alfredo, always answer to the list, so others may read along and/or chime in. >From the stunnel man page: >> >> Level is a one of the syslog level names or numbers emerg (0), alert (1), crit (2), >> err (3), warning (4), notice (5), info (6), or debug (7). All logs for the specified >> level and all levels numerically less than it will be shown. Use debug = debug or >> debug = 7 for greatest debugging output. The default is notice (5). This seems to perfectly match the 'conventional meaning of the log level' used for most POSIX system log daemons (e.g. the linux syslogd). I don't know how significant the level /names/ actually are - Maybe all you can read from this is that level 0 gives the fewest and level 7 gives the most messages. Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:[email protected] http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

2 1

Fwd: Stunnel log file format
by Jesús Alfredo Cambera 12 Jan '16

12 Jan '16

Hi everybody, I'm pretty new on stunnel and I'm still learning a lot through the documentation. One of the tasks that i need to accomplish is to consolidate all the log information using logstash and ELK. So far I had managed to figure out most of the log file format. Here is an example of my log file 2013.01.11 11:26:35 LOG5[13520:140223486400256]: stunnel3 accepted connection from 127.0.0.1:45939 2013.01.11 11:26:35 LOG6[13520:140223486400256]: connect_blocking: connecting 123.4.5.6:9130 2013.01.11 11:26:35 LOG5[13520:140223486498560]: connect_blocking: connected 7.8.9.10:9130 The first two fields are date and hour but I don't understand what do the next field means (LOG5, LOG6). Next is the pid, but I don't know anything about the next field. The last one is the error explanation. Is there documentation about log file format? I'd really appreciate your help. Greetings from Venezuela, Alfredo

2 1

Re: [stunnel-users] Help: sTunnel http to Apache https?
by Hathor27 11 Jan '16

11 Jan '16

Please everybody out there, can anybody tell me, if I can wrap a http-proxy request into http over ssl (https, with sTunnel) and receive it by an Apache https server (without sTunnel server)? Best regards Hathor27

1 0

stunnel 5.29 released
by Michal Trojnara 08 Jan '16

08 Jan '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear Users, I have released version 5.29 of stunnel. The ChangeLog entry: Version 5.29, 2016.01.08, urgency: LOW * New features - New WIN32 icons. - Performance improvement: rwlocks used for locking with pthreads. * Bugfixes - Compilation fix for *BSD. - Fixed configuration file reload for relative stunnel.conf path on Unix. - Fixed ignoring CRLfile unless CAfile was also specified (thx to Strukov Petr). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 43909625403ea634fa7cb8399d58faf8e7f11c1b7b29097491469951f56df551 stunnel-5.29.tar.gz c92ccc98cc9eb0c5d95d9550af39ab502e7ea45ed4d9ccc821aa261856f958b1 stunnel-5.29-installer.exe f9db8676e8e2ec6db355bae41eb625eb8ebd45a836ad8cbf06ce60a3c305fde2 stunnel-5.29-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWj/AqAAoJEC78f/DUFuAUZagQAMbBLW8VSgB8x8WGK1ZueSun HJAqXQgCYFY3+Vdz/41gdGy4T8kMB0MHarCwUbI4Wuk/JEvJLIs7OtFzycm1pTBU vXOgk962OkKs/RGD6tygnzIMmYU+BjxPLcfuj0JZR8Z3/Skt2ssFh4RrgCwoFM7/ VxseTRf487dBTU8n2EduWS1naNSIZCN6MlM0Ql1NNenZIGUSYlOfpxXSYo2ZTbe9 At+oVJ5J23eZrv5Vd48cZY7ArfXqCFDkUsCVyBOjUoSSJQ3qZ7srr7tWj4AVY6Pp Nk4Q1w1o7vWpEMDovjEmiLJMUGY2AUiQMpKoZDyfTnDRdtEfEDb7+P9sa++sruSY uauMZ4IL2zjUhWh2RJVnYHgCYCvjAWVw3GeUoM092svR0NXqf0fnBqAGgXNA/uHg zXy2Ljp8yLSK73oR3z7BaSmM3+q1NS2fZBEfWOVpZoOdG+hoyCZvsvuvDpNXh+y8 7WBPiGMl+Umti8HxKDsF/HEiLoSRrBZFZ1t2jwmLM+kZAsA06j3s5ExttK+FNsSC s/yoISPBGIRJyM/xOwYugyO2mDI8xLm3w7YbJADlJ0R2UiaRFVRqJErITv1/i18c Xek1mhk6HgyhQSCns4gxjM/Xc3VuOGJCP6umwUuiXQvyHvP+oypAyYlgshxNmKD1 Ccn+1DCtt3jw83qNLrZE =yIQ7 -----END PGP SIGNATURE-----

1 0

Re: [stunnel-users] Help: sTunnel http to Apache https?
by Hathor27 05 Jan '16

05 Jan '16

Thank you for your fast response, Jhon. My target https-server is a Synology DS211+ with Apache 2.2(Unix). Its VirtualHost config looks like: <VirtualHost *:443> ServerName myhost.mydomain.com ServerAlias internal.name.local DocumentRoot /somepath/not/used/at/all/ SSLEngine On SSLProtocol all -SSLv2 -SSLv3 # TLSv1 or higher SSLProxyEngine On ProxyRequests On ProxyBadHeader Ignore ProxyVia Full AllowCONNECT myInternalPort <Proxy *> Order deny,allow Deny from all </Proxy> <ProxyMatch (internal\.name\.local)> Order allow,deny Allow from all </ProxyMatch> LogLevel debug ErrorLog /logpath/sshserver-proxy_error_log CustomLog /logpath/sshserver-proxy_request_log combined </VirtualHost> The sTunnel client config on Win7 is: debug = 7 log = overwrite output = C:\userpath\stunnel\stunnel.log socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 client = yes [http-2-ssl] accept = 127.0.0.1:80 connect = proxy.gateway:gwPort protocol = connect protocolHost = myhost.mydomain.com:443 retry = yes config = Protocol:ALL config = Protocol:-SSLv3 Finally still remains my initial question: Can I wrap my http-proxy request into http over ssl (https) and receive it on an Apache https server? If 'yes', how? Best regards Hathor27 Btw: Hopefully better posted

1 0

Upcoming stunnel 5.29 release
by Michal Trojnara 05 Jan '16

05 Jan '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi Guys, This Friday I intend to release stunnel 5.29. The planned list of changes: * New features - New WIN32 icons. - Performance improvement: rwlocks used for locking with pthreads. * Bugfixes - Compilation fix for *BSD. - Fixed configuration file reload for relative stunnel.conf path on Unix. - Fixed ignoring CRLfile unless CAfile was also specified (thx to Strukov Petr). Feel free to try stunnel 5.29b3, so I can fix any discovered issues before the final release: https://www.stunnel.org/downloads.html Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBCAAGBQJWit/iAAoJEC78f/DUFuAUtv8P/izyH0DIhUsDCWbYlyWRJDjr 2lwE1sYwmmMqtArM31N25QtRidEbZgTbuWQXaXY7/HALTnnI1VbDrbtAntVkovQr FDXGlVvkife2IuSDS92b8ezEuq5swCQoT6KoHJDj9yLBSTQdZNxGHv9GfbS90mmv fX3zcWmh+SklYnVgGrnc3GfgecaUS261KArdW1BTfA5ucydzse9z9X+2/iA7zl7i wwvSHkfH3+Q3VsmJaSmoHTiMqzRzvH0NpKnbm0J5OfOql/fT9Mfn57U5ZGnC5iWP bLlPmmP+fC7WLX8Cwl2DWESJ8kxPn2xEJbDGeCn9uzI0feKXMLwF/yrJopYVetIx fJDgts4iR8eFRcFcSIpBrnWxNoTi4RhCzuIj8U/zYOBsHJPs6gPcuDG9fYtPXhF8 D93e8HeOW7naNyi+mTDjBo8qdiGGh+/ITp1PkNonVgFCWkxLIpfS2k6iQ/DqNTXd szMU+uLeub5vt3ifRnSieTpIDTAsSbp0jarlXFRQNrUB0Cl8sgv/Ssl+ZYnDRyIa 2aTrK00eSc1nk+kZGJg5kTJM/t6PzfxtDUhVo5Pr6u9gwa94c34AHQ04W5dA7rTV 4pD4DxpFEk+2Syndjt6lncT/O2at3aYUkhyTZ/tN8/P22v1OWp+ci1WIpNXp/zVX z12IUAFfyQPIuvdwLzZr =CEXd -----END PGP SIGNATURE-----

2 4

Help: sTunnel http to Apache https?
by Hathor27 02 Jan '16

02 Jan '16

Dear List Members, I searched, tried and recovered for several days and found no solution that works. My topic is to establish an ssh remote session through a http-proxy (http connect). In case of port restrictions I can only use pure https (443). So I try to wrap my http-proxy request into http over ssl (https) and receive it on an Apache https server. I can establish a connection between sTunnel Client (Win7 Prof) and sTunnel Server (Synology, Linux), both on 443 - that works fine. But if I try to connect from sTunnel Client (443) to Apache Server https, they seem to speek not the same protocol. .are there any examples for that? - or are sTunnel and Apache two different things of SSL? I would be very glad to get some help here :) Best Regards Hathor27

1 0

Do Not Make Stunnel on El Capitan
by WATANABE Takeo 02 Jan '16

02 Jan '16

Dear all. Hi. My name is WATANABE, Takeo in Japan. There is a thing that is very troubled, it will post to this ML. It is in OS X El Capitan(10.11.x), it is stunnel of make it is that does not pass. The rootkill mechanism I think is causing, but tried again to disable this, even doing several times, not as make is. Even latest Stunnel, make will fail. Where everyone is, what you can well Build. If you have person there know what measures and successes such as a, please tell me. Warm Regards. Sincerely yours.

1 0

transfer: s_poll_wait: TIMEOUTclose exceeded: closing
by Michael Calder 29 Dec '15

29 Dec '15

Hi, I'm new to stunnel and I'm trying to troubleshoot why it currently isn't working. When I first set it up and tested it everything worked fine. I rebuilt everything to do it all again and now it's not working. I'm pretty sure I set everything up the same way. I'm trying to get it to work with AWS SES. Here is my stunnel config: ; Sample stunnel configuration file for Win32 by Michal Trojnara 2002-2015 ; Some options used here may be inadequate for your particular configuration ; This sample file does *not* represent stunnel.conf defaults ; Please consult the manual for detailed description of available options ; ************************************************************************** ; * Global options * ; ************************************************************************** ; Debugging stuff (may be useful for troubleshooting) debug = debug ;output = stunnel.log ; Enable FIPS 140-2 mode if needed for compliance ;fips = yes ; Microsoft CryptoAPI engine allows for authentication with private keys ; stored in the Windows certificate store ; Each section using this feature also needs the "engineId = capi" option ;engine = capi ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Enable support for the insecure SSLv3 protocol ;options = -NO_SSLv3 ; These options provide additional security at some performance degradation ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; ************************************************************************** ; * Include all configuration file fragments from the specified folder * ; ************************************************************************** ;include = conf.d ; ************************************************************************** ; * Service definitions (at least one service has to be defined) * ; ************************************************************************** ; ***************************************** Example TLS client mode services [gmail-pop3] client = yes accept = 127.0.0.1:110 connect = pop.gmail.com:995 verify = 2 CAfile = ca-certs.pem checkHost = pop.gmail.com OCSPaia = yes [gmail-imap] client = yes accept = 127.0.0.1:143 connect = imap.gmail.com:993 verify = 2 CAfile = ca-certs.pem checkHost = imap.gmail.com OCSPaia = yes [gmail-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.gmail.com:465 verify = 2 CAfile = ca-certs.pem checkHost = smtp.gmail.com OCSPaia = yes ; Encrypted HTTP proxy authenticated with a client certificate ; located in the Windows certificate store ;[example-proxy] ;client = yes ;accept = 127.0.0.1:8080 ;connect = example.com:8443 ;engineId = capi ; ***************************************** Example TLS server mode services ;[pop3s] ;accept = 995 ;connect = 110 ;cert = stunnel.pem ;[imaps] ;accept = 993 ;connect = 143 ;cert = stunnel.pem ;[ssmtp] ;accept = 465 ;connect = 25 ;cert = stunnel.pem ; TLS front-end to a web server ;[https] ;accept = 443 ;connect = 80 ;cert = stunnel.pem ; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SChannel ; Microsoft implementations do not use TLS close-notify alert and thus they ; are vulnerable to truncation attacks ;TIMEOUTclose = 0 ; Remote cmd.exe protected with PSK-authenticated TLS ; Create "secrets.txt" containing IDENTITY:KEY pairs ;[cmd] ;accept = 1337 ;exec = c:\windows\system32\cmd.exe ;execArgs = cmd.exe ;ciphers = PSK ;PSKsecrets = secrets.txt ; vim:ft=dosini [smtp-tls-wrapper] accept = 2525 client = yes connect = email-smtp.us-east-1.amazonaws.com:2465 delay = yes Here is the debug from the log file: 2015.12.29 17:42:38 LOG7[main]: No limit detected for the number of clients 2015.12.29 17:42:38 LOG5[main]: stunnel 5.28 on x86-pc-msvc-1500 platform 2015.12.29 17:42:38 LOG5[main]: Compiled/running with OpenSSL 1.0.2e-fips 3 Dec 2015 2015.12.29 17:42:38 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2015.12.29 17:42:38 LOG7[main]: errno: (*_errno()) 2015.12.29 17:42:38 LOG5[main]: Reading configuration from file stunnel.conf 2015.12.29 17:42:38 LOG5[main]: UTF-8 byte order mark detected 2015.12.29 17:42:38 LOG5[main]: FIPS mode disabled 2015.12.29 17:42:38 LOG7[main]: Compression disabled 2015.12.29 17:42:38 LOG7[main]: Snagged 64 random bytes from C:/.rnd 2015.12.29 17:42:38 LOG7[main]: Wrote 1024 new random bytes to C:/.rnd 2015.12.29 17:42:38 LOG7[main]: PRNG seeded successfully 2015.12.29 17:42:38 LOG6[main]: Initializing service [gmail-pop3] 2015.12.29 17:42:38 LOG7[ui]: GUI message loop initialized 2015.12.29 17:42:38 LOG7[cron]: Cron thread initialized 2015.12.29 17:42:38 LOG7[main]: No certificate or private key specified 2015.12.29 17:42:38 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2015.12.29 17:42:38 LOG6[main]: Initializing service [gmail-imap] 2015.12.29 17:42:38 LOG7[main]: No certificate or private key specified 2015.12.29 17:42:38 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2015.12.29 17:42:38 LOG6[main]: Initializing service [gmail-smtp] 2015.12.29 17:42:38 LOG7[main]: No certificate or private key specified 2015.12.29 17:42:38 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2015.12.29 17:42:38 LOG6[main]: Initializing service [smtp-tls-wrapper] 2015.12.29 17:42:38 LOG7[main]: No certificate or private key specified 2015.12.29 17:42:38 LOG4[main]: Service [smtp-tls-wrapper] needs authentication to prevent MITM attacks 2015.12.29 17:42:38 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2015.12.29 17:42:38 LOG5[main]: Configuration successful 2015.12.29 17:42:38 LOG7[main]: Listening file descriptor created (FD=372) 2015.12.29 17:42:38 LOG7[main]: Service [gmail-pop3] (FD=372) bound to 127.0.0.1:110 2015.12.29 17:42:38 LOG7[main]: Listening file descriptor created (FD=376) 2015.12.29 17:42:38 LOG7[main]: Service [gmail-imap] (FD=376) bound to 127.0.0.1:143 2015.12.29 17:42:38 LOG7[main]: Listening file descriptor created (FD=380) 2015.12.29 17:42:38 LOG7[main]: Service [gmail-smtp] (FD=380) bound to 127.0.0.1:25 2015.12.29 17:42:38 LOG7[main]: Listening file descriptor created (FD=384) 2015.12.29 17:42:38 LOG7[main]: Service [smtp-tls-wrapper] (FD=384) bound to 0.0.0.0:2525 2015.12.29 17:43:25 LOG7[main]: Found 1 ready file descriptor(s) 2015.12.29 17:43:25 LOG7[main]: FD=332 ifds=r-x ofds=--- 2015.12.29 17:43:25 LOG7[main]: FD=372 ifds=r-x ofds=--- 2015.12.29 17:43:25 LOG7[main]: FD=376 ifds=r-x ofds=--- 2015.12.29 17:43:25 LOG7[main]: FD=380 ifds=r-x ofds=--- 2015.12.29 17:43:25 LOG7[main]: Service [smtp-tls-wrapper] accepted (FD=444) from 127.0.0.1:49510 2015.12.29 17:43:25 LOG7[main]: Creating a new thread 2015.12.29 17:43:25 LOG7[main]: New thread created 2015.12.29 17:43:25 LOG7[0]: Service [smtp-tls-wrapper] started 2015.12.29 17:43:25 LOG5[0]: Service [smtp-tls-wrapper] accepted connection from 127.0.0.1:49510 2015.12.29 17:43:25 LOG6[0]: failover: round-robin, starting at entry #0 2015.12.29 17:43:25 LOG6[0]: s_connect: connecting 54.243.71.143:2465 2015.12.29 17:43:25 LOG7[0]: s_connect: s_poll_wait 54.243.71.143:2465: waiting 10 seconds 2015.12.29 17:43:25 LOG5[0]: s_connect: connected 54.243.71.143:2465 2015.12.29 17:43:25 LOG5[0]: Service [smtp-tls-wrapper] connected remote server from 172.31.49.212:49511 2015.12.29 17:43:25 LOG7[0]: Remote descriptor (FD=468) initialized 2015.12.29 17:43:25 LOG6[0]: SNI: sending servername: email-smtp.us-east-1.amazonaws.com 2015.12.29 17:43:25 LOG7[0]: SSL state (connect): before/connect initialization 2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv2/v3 write client hello A 2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 read server hello A 2015.12.29 17:43:25 LOG6[0]: Certificate verification disabled 2015.12.29 17:43:25 LOG6[0]: Certificate verification disabled 2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 read server certificate A 2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 read server key exchange A 2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 read server done A 2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 write client key exchange A 2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 write change cipher spec A 2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 write finished A 2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 flush data 2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 read server session ticket A 2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 read finished A 2015.12.29 17:43:25 LOG7[0]: 1 client connect(s) requested 2015.12.29 17:43:25 LOG7[0]: 1 client connect(s) succeeded 2015.12.29 17:43:25 LOG7[0]: 0 client renegotiation(s) requested 2015.12.29 17:43:25 LOG7[0]: 0 session reuse(s) 2015.12.29 17:43:25 LOG6[0]: SSL connected: new session negotiated 2015.12.29 17:43:25 LOG7[0]: Peer certificate was cached (3667 bytes) 2015.12.29 17:43:25 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES128-GCM-SHA256 (128-bit encryption) 2015.12.29 17:43:25 LOG7[0]: Compression: null, expansion: null 2015.12.29 17:43:36 LOG7[0]: SSL alert (read): warning: close notify 2015.12.29 17:43:36 LOG6[0]: SSL closed (SSL_read) 2015.12.29 17:43:36 LOG7[0]: Sent socket write shutdown 2015.12.29 17:43:38 LOG6[cron]: Executing cron jobs 2015.12.29 17:43:38 LOG6[cron]: Cron jobs completed in 0 seconds 2015.12.29 17:43:38 LOG7[cron]: Waiting 86400 seconds 2015.12.29 17:44:36 LOG3[0]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing 2015.12.29 17:44:36 LOG5[0]: Connection closed: 995 byte(s) sent to SSL, 397 byte(s) sent to socket 2015.12.29 17:44:36 LOG7[0]: Remote descriptor (FD=468) closed 2015.12.29 17:44:36 LOG7[0]: Local descriptor (FD=444) closed 2015.12.29 17:44:36 LOG7[0]: Service [smtp-tls-wrapper] finished (0 left) I've searched the web for that TIMEOUTclose message and haven't come up with a solution. I've also attached a packet capture. Any suggestions would be helpful. Thanks! Mike

1 0

stunnel 5.28 released
by Michal Trojnara 14 Dec '15

14 Dec '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear Users, I have released version 5.28 of stunnel. This is a bugfix release. I highly recommend upgrading your stunnel. The ChangeLog entry: Version 5.28, 2015.12.11, urgency: HIGH * New features - Build matrix (.travis.yml) extended with ./configure options. - mingw.mak updated to build tstunnel.exe (thx to Jose Alf.). * Bugfixes - Fixed incomplete initialization. - Fixed UCONTEXT threading on OSX. - Fixed exit codes for information requests (as in "stunnel -version" or "stunnel -help"). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 9a25b87b1ef0c08fa3d796edce07b4408e6a8acece23de2eb7ee9285b78852b5 stunnel-5.28.tar.gz 020b5bd8a97a1da91e9b379c0d2fa8a14606402e2b0c1eb9191fe99c7f4665f9 stunnel-5.28-installer.exe 0af65879343b37bcda89dbbde51f6cfde016a044a533f7bdec229f4e1ec25eb9 stunnel-5.28-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWarN7AAoJEC78f/DUFuAUKhcQAJ62DQW+GMpAmtggO42LhaEj NcAdpgYvCAJnemRnTj+YMHHAGGIn7MY7VQZVzIIHL0y4CS6yy8kg1WVQeDgxS7PM zil/CViLayNQUnEaUSpoD3yFlb5i6wqofPa5/ohObAvUwTejN/XtOlyT6OMTEovF ZWWLsqYnVTCkbrY1Usu9DNRlSWaCgGeqL5ZqhbiJHk7hDHIH5Yy8KXKw3dVuOxBZ 86uYNH0WW3qNHKJrI1z70cA+18c6Kab5/4NnzzmWG+TyYCVVLL8JVkahEHhCX5mc yBYcMyBrSkrUoS++IdEZtOKYjwxfiEFdre0junC1m5DqtbOc+vWcvqZRGUfCszHK bg4LlCoNs6VhaAFzY9dyXKWqFP+HvH1cqcVcagCaofcdAEaFrwP4dqwUUBKCT44z JNhEzyrI6+coGq92SZUeSiko2bj+rQWDf3s5pY+zWQVvUe12rTo427Mhbge3sBhQ QykwMsihtrP9s25YkDQHqlpBV85W3axq/O2veb15QlbETDM6eGfnMCFjqhxpBBMO sSgHOr9E1E4pxN4kcokPhwKizxSe0EHVQYM27qGfNXJkzVAvHE+mz0WR2kMPpjT5 N6th9lOMgrjXGo6aTBQO3DIEkw+BB0C9OVWnNXMWqmUnsKp80QVeZKZXgK5c2t1y Y8e0W7HH2xdaQemUQp+n =GrPO -----END PGP SIGNATURE-----

3 3

Upcoming stunnel 5.28 release
by Michal Trojnara 11 Dec '15

11 Dec '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi Guys, I have found a serious bug in stunnel 5.27. The bug results in incomplete (partial) service initialization. The bugfix 5.28 release is scheduled for tomorrow. Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBCAAGBQJWac5NAAoJEC78f/DUFuAUcRUP/A1dOJW8Sag4YRfxnOZfW6bt SouaKMkFQDkQkLrZzQkUhkOFL35DNmesvA+HgCSp+StO/TagcLA34ZrpR355qcZ7 QjEXYftagy85c7DjDek4CU9vfb9u3J3kTcvhtpy6l5CPYV0TWCjApk438xk+saOn xItijYRVcpHbSUof0/E99Gb9mZ3qiI4AVkdSHT4qw3GV8GCdo9R66cHBNDKsYQy1 XWe7VJCEmXw9n0bmj2Soi1TWlU39Q2GcostWK2GuH9fzFyGqnde7RbMHeJ9KYvY/ oSnMjCRblJtoRn4Ucw/1FuOdEZSalpRuPSarmhKCkgc+tKgkK6mvhSbILUbwOMLL hO2nWbMrOhLOlu4UnM32A1djWQCiVRxTO87IAkd5jTTz8sNLCoJHqzcirug68Kjy ljuNf/A/LhkimkfCvZtY5ErMP6TzJ37iaXhaGRLZLoZtK75yKggXnJcJUAEI8ggI RR/mArBHyHG3IwcfdMt4a+AJvsHOJAApCB+0uCGwJnfnuqHJ41Z6WEHuwpBitN/0 4nTGLoOBOyUX/cnrpsx9FLxRdCKAVbGoebXBM5sA9qhCDskp7MMDUFU1pVER5QbZ VKzCpIdeyGKKvCOA5WiNOt3bBBmOGJKB4CXYyMEyDAbr8SL2FTNo5nJ2iUO/2iaU 6a5MITgIc1C6GacMauvo =rb0T -----END PGP SIGNATURE-----

3 3

Re: [stunnel-users] How do I use the Stunnel download on android?
by Research | FrenchFlorida 09 Dec '15

09 Dec '15

Thanks for the reply. I'm not sure what " statically linked ELF executable for Android/ARM" means yet, but I will look it up. ;) Since I sent the message I did a lot of digging that yielded me very little details. In fact I only came a cross a few mentions that stunnel could be used on android but no examples of how that was implemented. After a vague hint I managed to deduced how the file worked, but it took me a little more independent research to understand how to make it, at least execute. I'm not new to linux but am new to android so not as familiar to how the system works in general. I did see that an android app was on your todo list. In the meanwhile however, may I suggest a little howto for Android that could get a user started in using the app. Stunnel is an amazing application and since I was able to figure it out I made myself a guide on how to set it up (Minus actually creating the configuration) so that I can at least know how to execute stunnel. Since I already did the research I offer you my very unorganized primer on how to set it up below. Perhaps it would be useful for some to have a better version of this doc on the site, and if not, well at least a well determined person can find this topic in the mailing list, because there will be only one other topic with the word "Android" in the title so it can perhaps get a user out of jam more quickly without. Here is my guide: ----------------------------- Chances are that "It is a statically linked ELF executable for Android/ARM." Means that within the stunnel-android.zip resides one file, and that file is the executable file for stunnel. It is in fact the defacto program that under linux you would see in /etc/local/bin/stunnel if that was where you installed it. This means that the requirements to use this file are as such: 1. Your phone probably needs to be rooted 2. You will need access to a terminal on your phone (Terminal Emulator) 3. There is no "APP" to run stunnel it is a command line file There are probably two reasons you would want to use stunnel on your phone. 1. You are an app developer that wants to use stunnel to connect one part of your app to something else, and therefore will incorporate this script within your app. I don't know how to make apps yet so that's probably as useful as I can make the description for you. 2. You are a user that has already used stunnel on your machine and wants to use it on your phone too. [The rest of the guide assumes this is the case.] Assuming the latter, what do you need to do to get it running? 1. Move the stunnel application to your phone. 2. As you would do in linux open the terminal 3. Run stunnel like a command If you get an error message saying it is not executable, or that permission is denied it is because of one of two things. Maybe you need to mark the file as executable Chmod +x ./stunnel Terminal Emulator's chmod does not understand "+x" so you will have to change the permission to Chmod 700 ./stunnel 700 means Read-Write-Execute for the user. If it doesn't work try 770 and 777 However you are likely to still receive that error on some phones. (I'm guessing, just because it happened to my phone I am not assuming it will happen to all phones.) Some phones forbid there to be an executable script within the /sdcard/ directory. Therefore you have to move it somewhere else. I don’t know where the proper place for such a file is, I moved mine to /system/bin/ therefore the script is callable by /system/bin/stunnel Another Caveat!! My phone's /system folder is not writable!! Therefore before you can even move the file you need to make the system folder writable: mount -o rw,remount /system Once moved needs to be made readonly again: mount -o ro,remount /system So In summary, here is a step-by-step of what might work in getting the script to an executable state on Android: 1. Root phone 2. install terminal emulator 3. get stunnel script onto your phone somehow 4. mount -o rw,remount /system 5. cp /sdcard/Download/stunnel /system/bin/stunnel 6. chown 700 /system/bin/stunnel 7. mount -o ro,remount /system 8. /system/bin/stunnel /path/to/conf/file* Now as if you are on linux you should probably** be able to run stunnel. *I haven't tested it out with conf files yet. ** I'm able to run stunnel --version so stunnel in and of itself is "working" ----------------------------- If this guide is any good to you guys, please feel free to use, I would love to contribute in some way. :) Thanks! -Cotex -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of stunnel-users-request(a)stunnel.org Sent: Tuesday, December 08, 2015 7:00 PM To: stunnel-users(a)stunnel.org Subject: stunnel-users Digest, Vol 137, Issue 10 Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. Re: How do I use the Stunnel download on android? (Michal Trojnara) ---------------------------------------------------------------------- Message: 1 Date: Mon, 7 Dec 2015 16:14:05 +0100 From: Michal Trojnara <Michal.Trojnara(a)mirt.net> To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] How do I use the Stunnel download on android? Message-ID: <5665A23D.8050408(a)mirt.net> Content-Type: text/plain; charset=utf-8 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi cotex, It is a statically linked ELF executable for Android/ARM. It is only useful for people who customize their Android, and not for end-users. A proper Android GUI is on my TODO list: https://www.stunnel.org/sdf_todo.html Best regards, Mike On 04.12.2015 11:02, Research | FrenchFlorida wrote: > In the download section of the site, there is a zip for android. > > Inside this file is a single file, without any extention. > > How do I install this, I have found no documentation anywhere on the > web. > > > > Can anybody guide me, or give me a hint. Is this something I do on the > phone, or that I do from the computer first? > > > > -cotex > > > > _______________________________________________ stunnel-users mailing > list stunnel-users(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBCAAGBQJWZaI9AAoJEC78f/DUFuAUJiAQAKYo2XM39WbeebhZlYa4pER2 hYfCkybWypYlOdiqRo5UGthG4SD/G74MXMJNR5ggKiApW6YBe4/Q983hKMWRSbp6 X803HQPyN8BxwnkZM9tzAcCh57SQXH/Y+VjTD9necLK9bOMMZlZsWg5u3TSp9qP1 jpV7+5NkMlID0KaKzpjaw+ruIY1zwmBUDrs0xT713TEZnVvaqhFDv2vYB8szG0p0 fe5Ppm/ZU/7vWMbFO8eWsWj6TpeoVpq2EI/4iK7VbnCVnSEosJi/C4C5nZ3GrcTv xRk0xDK9I733FfBTmHU5Dkzx6fcDqFekWyea+qYT+JhOmtRqdnyrQM0OCRv3z/b/ fOv36zkuru6DhoO1El2QwQOZlTqFnWYfgvfYDWI1zeIMCSz/qqpn5ojQXk7i87zH cMVG9whVZGWf0DXjwRo9/cHkmjdX46UA5FZwhxADY6Atu9OtdEabTcbNj6BPPh8Q xX7GNEgRFnbZsz50wqZbZJZfE4ticWFkLH37eT7z3WeEU8+HdFk1w24JNGFaZt3H GcJ6TN6/fMTkQP2ch0l0X2vXhWLkBh5puYOVBnsnKKUl8UUzeGa1T3OJAnKJF07Q 0mtP6lyPtuEGy9vUiP+2h0yIICJD1IGhEdkEm3xWJcagp3XJ+0PFN5Mo2juDfg4S FHvDTHxF4/y4PQodabav =+omM -----END PGP SIGNATURE----- ------------------------------ Subject: Digest Footer _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users ------------------------------ End of stunnel-users Digest, Vol 137, Issue 10 **********************************************

1 0

SSL compression in 5.27
by Udo Erdelhoff 08 Dec '15

08 Dec '15

Hi, while testing the upgrade from stunnel 5.26 to stunnel 5.27 on Solaris, one of the tools I use reported that SSL compression was now supported/possible on connections to an stunnel 5.27 instance; this was not the case with 5.26 or earlier. Unfortunately, it is not possible to demonstrate this using openssl as client, I found this using TestSSLServer, which is java-based and available from http://www.bolet.org/TestSSLServer/. With 5.26: | $ java -jar TestSSLServer.jar $server 443 | Supported versions: TLSv1.2 | Deflate compression: no | Supported cipher suites (ORDER IS NOT SIGNIFICANT): | TLSv1.2 | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 | ---------------------- | Server certificate(s): | 4c57045b3f8f9cdd6f487e59a5b008ccb9d38693: CN=***, OU=***, O=***, C=*** | ---------------------- | Minimal encryption strength: strong encryption (96-bit or more) | Achievable encryption strength: strong encryption (96-bit or more) | BEAST status: protected | CRIME status: protected Note: "Deflate compression: no", "CRIME status: protected" With 5.27: | $ java -jar /prod/certmon2/bin/TestSSLServer.jar $server 443 | Supported versions: TLSv1.2 | Deflate compression: YES | Supported cipher suites (ORDER IS NOT SIGNIFICANT): | TLSv1.2 | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 | ---------------------- | Server certificate(s): | 4c57045b3f8f9cdd6f487e59a5b008ccb9d38693: CN=***, OU=***, O=***, C=*** | ---------------------- | Minimal encryption strength: strong encryption (96-bit or more) | Achievable encryption strength: strong encryption (96-bit or more) | BEAST status: protected | CRIME status: vulnerable With 5.27, I get "Deflate compression: YES" and "CRIME status: vulnerable". Server OS: Solaris 10/SPARC or Solaris 11/SPARC (others not tested) OpenSSL: 1.0.1p or 1.0.1q (others not tested) Client: TestSSLServer Both stunnel and OpenSSL are self-compiled using Solaris Studio 12.4. The stunnel.conf in question: sslVersion = TLSv1.2 ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256 cert = test1.crt key = test1.key verify = 2 [test] client = no accept = A.B.C.D:443 connect = 127.0.0.1:8080 The scanner from SSL Labs should be able to check this as well, but I do not have the neccessary modern Python available. I will check if I can reproduce the problem on something a little more mainstream than Solaris 10/11 over the weekend. --

2 1

How do I use the Stunnel download on android?
by Research | FrenchFlorida 07 Dec '15

07 Dec '15

In the download section of the site, there is a zip for android. Inside this file is a single file, without any extention. How do I install this, I have found no documentation anywhere on the web. Can anybody guide me, or give me a hint. Is this something I do on the phone, or that I do from the computer first? -cotex

2 1

stunnel for syslogd of busybox
by Girish Kumar 06 Dec '15

06 Dec '15

Hi All, Stunnel expects TCP-based syslog. Please let me know whether syslogd of busybox supports TCP communication. The busybox version is 1.24.1 If it doesn't support , can it be enhanced to support TCP communication Regards, Girish

1 1

stunnel 5.27 released
by Michal Trojnara 03 Dec '15

03 Dec '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear Users, I have released version 5.27 of stunnel. The ChangeLog entry: Version 5.27, 2015.12.03, urgency: MEDIUM * Security bugfixes - OpenSSL DLLs updated to version 1.0.2e. https://www.openssl.org/news/secadv_20151203.txt * New features - Automated build testing configured with .travis.yml. - Added reading server certificates from hardware engines. For example: cert = id_45 - Only attempt to use potentially harmful compiler or linker options if gcc was detected. - /opt/csw added to the OpenSSL directory lookup list. - mingw.mak updates (thx to Jose Alf.). - TODO list updated. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 7474e986710e88a5cc3330b6b1762f9449f01eccf826fa0f97e56d064c05ead3 stunnel-5.27.tar.gz 04b11dea9a29e7a16d46b2c4e6c66a5ca6f588abb29a827dcca2c6f6456eb4c6 stunnel-5.27-installer.exe 76e4297212eaa99a674191f3e955ec3959abcdd0c081d2df0ce8786a577a6883 stunnel-5.27-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWYG/VAAoJEC78f/DUFuAUKloP/jRcbtEuSpiLbFTg2hQqJcZf T6C6x+pCRDqefPZMQNgN5HIU9TBUAm1dGNH3KxRqrfCTlYKnhqafDoj66fsQe6sm vUDOxxxwCcKBZaiO4II5cLxd05d9GX9FnI86GBfiztSX0nr2wMLu1EdKHdTO2R5s VXsjRl1ey2X0ukhzQ+gsD2bOf2tz0gkCjrcoAZZyGqBE+Zy3hMGSlK8mXeTfU8Of ygUT+nEcUmQb+zbEBrJCp+Q2TP0dMzXSgpKz67toH1wJJ85iTpxqPa6L6LcKwHXd kA2c75Y7HXmc4C+eKpXessifbHTHdJXbsF4ZOc06IxIg2+v47Fqqz13sL2rMKdYQ aldOP7NiOyCxywjQ3bZElvF8f8Q1RJz/+qMKG0QEWwe1cRHmDOweZ2BrqsBsZNbE Pxx2lavAqRruREL9PnL12mH/u9e0SBIaXsgmN1xo9IvaVy98K9+VL23m2GpXeVMp cPGOtfwX2M0NWRIU6keQ8FOqszuP0A7CSFTKwmM2/ZGNjPOk00/NCJk9qchyqZcr 8RDnkMOknvqEp5Uf0PWpBafK0yUps7aPwyTQX9SQ8uvz3ra/30ghkpEyAeIeEP3p Y5DqlSXupIbPAmUw3fNblU7E7SgflPP4LXF8oznLUkWFmPpR/wPUiHC1EnEOGtEQ GHF3H9CS1fr51rPm0UaK =hfT6 -----END PGP SIGNATURE-----

1 0

Client Authentication and CRL Verification
by Mehdi B. 02 Dec '15

02 Dec '15

Hello everybody I am using stunnel in server mode with mutual authentication. Auth is ok, but the crl didn't work, and I need it in production next week.... I do many tries with CRLpath/CRLfile, with my production version (5.08), the last one (5.26) Same result. With a revoked certificate, my client connect on the server. Do you have some idea? Or maybe found my mistake? If you need something else please contact me. Stunnel 1 is the server. Stunnel 1 certificate is revoked ** Configuration ** *** root@auditd:/var/lib/stunnel/2/ca# cat /etc/stunnel/1.conf *** ; * Global options * chroot = /var/lib/stunnel/1/ ; Chroot jail can be escaped if setuid option is not used setuid = stunnel5 setgid = stunnel5 pid = /pid/1.pid ;debug = 0 debug = 7 output = /log/1.log ;foreground = yes options = NO_SSLv2 options = NO_SSLv3 options = DONT_INSERT_EMPTY_FRAGMENTS [1] verify = 2 CAFile = /root/CA/CA.cert cert = /root/CA/1.cert key = /root/CA/1.key client = no accept = 127.0.0.1:59062 connect = 127.0.0.1:22 ciphers = ECDHE-RSA-AES256-GCM-SHA384 sslVersion = TLSv1.2 *** root@auditd:/var/lib/stunnel/2/ca# cat /etc/stunnel/2.conf *** ; * Global options * chroot = /var/lib/stunnel/2/ ; Chroot jail can be escaped if setuid option is not used setuid = stunnel5 setgid = stunnel5 pid = /pid/2.pid ;debug = 0 debug = 7 output = /log/2.log ;foreground = yes options = NO_SSLv2 options = NO_SSLv3 options = DONT_INSERT_EMPTY_FRAGMENTS [2] verify = 2 ;CRLfile = /var/lib/stunnel/2/CA.crl.pem ;CAFile = /var/lib/stunnel/2/CA.pem CRLpath = /crl/ CApath = /ca/ cert = /var/lib/stunnel/2/2.cert key = /var/lib/stunnel/2/2.key client = yes accept = 127.0.0.1:23 connect = 127.0.0.1:59062 ciphers = ECDHE-RSA-AES256-GCM-SHA384 sslVersion = TLSv1.2 ** Logs ** ==> /var/lib/stunnel/1/log/1.log <== 2015.12.02 12:11:46 LOG7[25595]: Clients allowed=500 2015.12.02 12:11:46 LOG5[25595]: stunnel 5.08 on x86_64-unknown-linux-gnu platform 2015.12.02 12:11:46 LOG5[25595]: Compiled/running with OpenSSL 1.0.1e 11 Feb 2013 2015.12.02 12:11:46 LOG5[25595]: Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Auth:LIBWRAP 2015.12.02 12:11:46 LOG7[25595]: errno: (*__errno_location ()) 2015.12.02 12:11:46 LOG5[25595]: Reading configuration from file /etc/stunnel/1.conf 2015.12.02 12:11:46 LOG5[25595]: UTF-8 byte order mark not detected 2015.12.02 12:11:46 LOG5[25595]: FIPS mode disabled 2015.12.02 12:11:46 LOG7[25595]: Compression disabled 2015.12.02 12:11:46 LOG7[25595]: Snagged 64 random bytes from /root/.rnd 2015.12.02 12:11:46 LOG7[25595]: Wrote 1024 new random bytes to /root/.rnd 2015.12.02 12:11:46 LOG7[25595]: PRNG seeded successfully 2015.12.02 12:11:46 LOG6[25595]: Initializing service [1] 2015.12.02 12:11:46 LOG6[25595]: Loading cert from file: /root/CA/1.cert 2015.12.02 12:11:46 LOG6[25595]: Loading key from file: /root/CA/1.key 2015.12.02 12:11:46 LOG7[25595]: Private key check succeeded 2015.12.02 12:11:46 LOG7[25595]: Loaded /root/CA/CA.cert revocation lookup file 2015.12.02 12:11:46 LOG7[25595]: Client CA list: /root/CA/CA.cert 2015.12.02 12:11:46 LOG6[25595]: Client CA: C=FR, ST=Some-State, O=Internet Widgits Pty Ltd 2015.12.02 12:11:46 LOG7[25595]: DH initialization 2015.12.02 12:11:46 LOG7[25595]: Could not load DH parameters from /root/CA/1.cert 2015.12.02 12:11:46 LOG7[25595]: Using hardcoded DH parameters 2015.12.02 12:11:46 LOG7[25595]: DH initialized with 2048-bit key 2015.12.02 12:11:46 LOG7[25595]: ECDH initialization 2015.12.02 12:11:46 LOG7[25595]: ECDH initialized with curve prime256v1 2015.12.02 12:11:46 LOG7[25595]: SSL options: 0x03000804 (+0x03000800, -0x00000000) 2015.12.02 12:11:46 LOG5[25595]: Configuration successful 2015.12.02 12:11:46 LOG7[25595]: Listening file descriptor created (FD=6) 2015.12.02 12:11:46 LOG7[25595]: Service [1] (FD=6) bound to 127.0.0.1:59062 2015.12.02 12:11:46 LOG7[25596]: Created pid file /pid/1.pid ==> /var/lib/stunnel/2/log/2.log <== 2015.12.02 12:11:46 LOG7[25604]: Clients allowed=500 2015.12.02 12:11:46 LOG5[25604]: stunnel 5.08 on x86_64-unknown-linux-gnu platform 2015.12.02 12:11:46 LOG5[25604]: Compiled/running with OpenSSL 1.0.1e 11 Feb 2013 2015.12.02 12:11:46 LOG5[25604]: Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Auth:LIBWRAP 2015.12.02 12:11:46 LOG7[25604]: errno: (*__errno_location ()) 2015.12.02 12:11:46 LOG5[25604]: Reading configuration from file /etc/stunnel/2.conf 2015.12.02 12:11:46 LOG5[25604]: UTF-8 byte order mark not detected 2015.12.02 12:11:46 LOG5[25604]: FIPS mode disabled 2015.12.02 12:11:46 LOG7[25604]: Compression disabled 2015.12.02 12:11:46 LOG7[25604]: Snagged 64 random bytes from /root/.rnd 2015.12.02 12:11:46 LOG7[25604]: Wrote 1024 new random bytes to /root/.rnd 2015.12.02 12:11:46 LOG7[25604]: PRNG seeded successfully 2015.12.02 12:11:46 LOG6[25604]: Initializing service [2] 2015.12.02 12:11:46 LOG6[25604]: Loading cert from file: /var/lib/stunnel/2/2.cert 2015.12.02 12:11:46 LOG6[25604]: Loading key from file: /var/lib/stunnel/2/2.key 2015.12.02 12:11:46 LOG7[25604]: Private key check succeeded 2015.12.02 12:11:46 LOG7[25604]: Verify directory set to /ca/ 2015.12.02 12:11:46 LOG7[25604]: Added /ca/ revocation lookup directory 2015.12.02 12:11:46 LOG7[25604]: Added /crl/ revocation lookup directory 2015.12.02 12:11:46 LOG7[25604]: SSL options: 0x03000804 (+0x03000800, -0x00000000) 2015.12.02 12:11:46 LOG5[25604]: Configuration successful 2015.12.02 12:11:46 LOG7[25604]: Listening file descriptor created (FD=6) 2015.12.02 12:11:46 LOG7[25604]: Service [2] (FD=6) bound to 127.0.0.1:23 2015.12.02 12:11:46 LOG7[25605]: Created pid file /pid/2.pid ** ls ** root@auditd:/var/lib/stunnel/2/ca# ll total 4 lrwxrwxrwx 1 root root 6 Dec 2 12:05 1a870aad.0 -> CA.pem lrwxrwxrwx 1 root root 6 Dec 2 12:05 aeb35906.0 -> CA.pem -rw-r----- 1 stunnel5 root 1919 Dec 1 16:55 CA.pem root@auditd:/var/lib/stunnel/2/ca# ll ../crl/ total 4 lrwxrwxrwx 1 root root 10 Dec 2 12:04 aeb35906.r0 -> CA.crl.pem -rw-r----- 1 stunnel5 root 1129 Dec 2 11:42 CA.crl.pem ** check openssl ** root@auditd:~/stunnel-5.26# openssl verify -crl_check -CAfile /var/lib/stunnel/2/ca/aeb35906.0 -CRLfile /var/lib/stunnel/2/crl/aeb35906.r0 /root/CA/1.cert /root/CA/1.cert: C = FR, ST = FR, O = PLOP, CN = 1 error 23 at 0 depth lookup:certificate revoked ** other :** root@auditd:~/CA# openssl crl -in /opt/syslog-ng/etc/crl/1a870aad.r0 -text Certificate Revocation List (CRL): Version 2 (0x1) Signature Algorithm: sha256WithRSAEncryption Issuer: /C=FR/ST=Some-State/O=Internet Widgits Pty Ltd Last Update: Dec 2 09:04:38 2015 GMT Next Update: Jan 1 09:04:38 2016 GMT CRL extensions: X509v3 CRL Number: 2 Revoked Certificates: Serial Number: 01 Revocation Date: Dec 1 14:46:38 2015 GMT Serial Number: 02 Revocation Date: Dec 2 09:04:29 2015 GMT Serial Number: 03 Revocation Date: Dec 2 07:25:34 2015 GMT Serial Number: 04 Revocation Date: Dec 2 07:27:45 2015 GMT Serial Number: 05 Revocation Date: Dec 2 07:32:21 2015 GMT Serial Number: 06 Revocation Date: Dec 2 08:21:48 2015 GMT Signature Algorithm: sha256WithRSAEncryption 16:24:d4:f8:77:82:7b:ca:70:1a:01:26:5f:83:9f:13:6f:51: 67:85:b0:2c:a7:25:c1:46:66:ca:b8:46:74:85:4a:ca:26:2b: ff:46:e7:91:a3:10:09:ce:6b:84:1d:58:a1:4a:1c:38:ac:1a: 58:fc:50:0a:7a:1e:1c:5c:f9:2b:ef:25:7a:93:27:b3:5e:65: d6:66:89:33:23:52:fd:0d:38:7e:66:d6:74:d7:e4:b2:72:d8: 74:49:73:d3:2a:b5:e0:23:8a:03:b5:c6:ce:2a:f4:03:ef:8c: 50:83:be:9f:68:04:47:79:ff:5d:4b:cb:8a:cd:3c:6a:5f:02: 33:e6:61:86:ff:4c:f3:74:2c:81:70:c1:13:05:43:54:1a:04: a0:7b:df:fe:f8:e5:50:53:ce:2c:04:86:36:ed:0a:98:24:72: 5e:68:1a:23:7f:8e:85:5c:2c:2b:7b:df:23:56:fe:2f:c7:da: ec:ca:8f:48:a0:29:15:72:38:e3:ff:48:1e:89:30:b1:72:1b: 21:3f:0b:e0:ad:eb:89:c3:65:70:cc:29:03:f0:6e:73:be:c8: 24:64:93:b8:7b:af:21:a0:67:24:5a:be:e8:b0:ec:e0:a1:5f: 0c:a9:e5:de:09:39:08:23:60:d9:d9:4e:07:a2:f2:1e:4f:96: 0c:b7:c6:bb:5b:2a:e3:78:92:2e:fa:39:9c:ae:d4:4c:b2:b2: e3:7f:2a:58:14:86:80:97:fd:5e:95:b1:9d:d6:23:3d:cc:ce: 2b:0b:65:b2:43:f5:15:fb:20:2c:72:8f:fd:62:7d:7f:54:80: 54:22:22:42:15:7b:27:18:2f:24:70:81:ca:44:cc:c4:d8:9c: d8:99:69:f2:fd:4a:7f:3e:11:57:91:25:d8:6f:42:ae:b0:d5: bc:fd:cd:0b:9b:a5:c2:f6:d0:ce:8b:e3:66:7b:78:03:90:a6: ca:44:f9:e1:cb:80:70:2e:db:b0:3c:d1:fc:5a:d8:f5:fd:c6: 44:5f:4f:19:f5:da:13:a5:2f:11:f3:db:73:22:a1:98:83:b0: 44:0d:2b:59:2f:3a:54:fb:00:a0:8f:1b:19:2b:c0:3c:9d:fb: f0:80:50:9a:9e:7b:b6:46:84:d3:df:b2:36:6b:d2:97:53:f9: da:1e:8c:7a:e8:40:15:17:3b:17:b7:c6:0d:e0:64:e4:68:96: 11:43:d2:d8:d4:f8:1b:7b:44:15:29:d9:ca:e5:3a:97:b6:b4: c6:b9:2b:c2:8a:6d:47:62:75:33:a1:dd:e9:93:28:eb:82:00: 8d:ef:0d:b6:17:72:a6:59:95:4c:97:fa:47:a8:ff:27:60:dd: c1:6e:6a:62:dc:1b:a8:e7 -----BEGIN X509 CRL----- MIIDGTCCAQECAQEwDQYJKoZIhvcNAQELBQAwRTELMAkGA1UEBhMCRlIxEzARBgNV BAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0 ZBcNMTUxMjAyMDkwNDM4WhcNMTYwMTAxMDkwNDM4WjB4MBICAQEXDTE1MTIwMTE0 NDYzOFowEgIBAhcNMTUxMjAyMDkwNDI5WjASAgEDFw0xNTEyMDIwNzI1MzRaMBIC AQQXDTE1MTIwMjA3Mjc0NVowEgIBBRcNMTUxMjAyMDczMjIxWjASAgEGFw0xNTEy MDIwODIxNDhaoA4wDDAKBgNVHRQEAwIBAjANBgkqhkiG9w0BAQsFAAOCAgEAFiTU +HeCe8pwGgEmX4OfE29RZ4WwLKclwUZmyrhGdIVKyiYr/0bnkaMQCc5rhB1YoUoc OKwaWPxQCnoeHFz5K+8lepMns15l1maJMyNS/Q04fmbWdNfksnLYdElz0yq14COK A7XGzir0A++MUIO+n2gER3n/XUvLis08al8CM+Zhhv9M83QsgXDBEwVDVBoEoHvf /vjlUFPOLASGNu0KmCRyXmgaI3+OhVwsK3vfI1b+L8fa7MqPSKApFXI44/9IHokw sXIbIT8L4K3ricNlcMwpA/Buc77IJGSTuHuvIaBnJFq+6LDs4KFfDKnl3gk5CCNg 2dlOB6LyHk+WDLfGu1sq43iSLvo5nK7UTLKy438qWBSGgJf9XpWxndYjPczOKwtl skP1FfsgLHKP/WJ9f1SAVCIiQhV7JxgvJHCBykTMxNic2Jlp8v1Kfz4RV5El2G9C rrDVvP3NC5ulwvbQzovjZnt4A5CmykT54cuAcC7bsDzR/FrY9f3GRF9PGfXaE6Uv EfPbcyKhmIOwRA0rWS86VPsAoI8bGSvAPJ378IBQmp57tkaE09+yNmvSl1P52h6M euhAFRc7F7fGDeBk5GiWEUPS2NT4G3tEFSnZyuU6l7a0xrkrwoptR2J1M6Hd6ZMo 64IAje8NthdyplmVTJf6R6j/J2DdwW5qYtwbqOc= -----END X509 CRL----- root@auditd:~/CA# openssl x509 -in /opt/syslog-ng/etc/cert.d/1.cert -text Certificate: Data: Version: 3 (0x2) Serial Number: 6 (0x6) Signature Algorithm: sha256WithRSAEncryption Issuer: C=FR, ST=Some-State, O=Internet Widgits Pty Ltd Validity Not Before: Dec 2 07:32:36 2015 GMT Not After : Nov 29 07:32:36 2025 GMT Subject: C=FR, ST=FR, O=PLOP, CN=1 Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (4096 bit) Modulus: 00:ae:2a:9e:a6:6f:54:eb:f7:1f:7f:d6:67:b5:68: 11:9d:a8:79:93:78:e8:b6:48:f6:64:7e:e5:bf:72: 33:61:6f:4a:e9:c0:25:f6:61:47:de:f7:a3:5d:3d: da:fa:2d:97:08:20:5b:b1:a9:10:2b:50:18:ca:40: ea:16:f8:3d:a5:5e:cc:18:d4:80:30:62:cc:4c:b7: 2b:99:9e:6a:3a:09:97:2b:1d:79:36:d2:53:7a:8d: 96:4f:20:c0:f3:ac:e9:01:d1:a0:d7:00:37:83:1f: 64:ee:df:4f:27:61:a2:5f:94:66:be:35:58:9e:52: a0:91:0a:00:57:13:d5:b4:b3:90:10:8c:42:4f:34: 69:3f:9c:1b:7d:9b:ae:eb:79:8d:d9:9d:2c:3c:74: 58:c2:ba:a5:34:e5:15:01:45:d3:47:85:82:eb:34: b2:21:ba:97:2b:4e:90:92:4f:85:19:c7:b0:7f:cd: 8c:49:08:4e:32:d0:9e:34:af:b9:02:aa:40:2e:af: f5:6b:41:92:9f:5a:ab:09:b5:bd:7a:73:fe:4d:f4: 1b:c6:23:22:15:7c:b5:47:e1:88:bd:8a:b7:d7:1b: 5e:4a:53:f9:41:33:e9:30:97:ce:9b:b4:88:77:f6: 35:9c:47:a7:12:5d:98:9e:e4:1c:27:bf:bd:e5:85: b1:c1:1f:dc:17:03:c0:00:9f:0b:d8:40:c3:1c:31: f3:9b:60:17:05:0d:ac:79:9e:53:2b:aa:da:78:e7: f4:a8:3e:f9:14:f1:40:1f:47:df:45:c7:57:14:3d: 26:68:9c:a7:77:da:29:50:85:1c:e3:62:e6:66:f0: 5e:59:6f:35:61:32:e4:a8:7d:a1:30:b5:85:69:0e: e3:fd:8e:67:78:c3:47:58:5d:88:36:65:85:09:52: 46:47:bb:48:03:9c:e5:42:48:66:7d:34:7d:01:9c: 67:ea:82:f0:d5:4e:9b:64:0c:c6:db:1c:0d:2a:de: 67:ba:a5:04:44:4a:fc:12:94:77:b0:30:fc:d0:06: 26:d4:e8:94:ed:a1:78:4d:cd:fa:8b:a4:4e:45:fc: cf:2b:d8:47:11:e0:68:e0:78:36:34:4f:76:5c:76: 4b:69:02:4c:22:47:57:10:92:ce:b9:d8:20:7e:80: 80:a7:ca:55:7c:41:a4:0a:0e:08:e0:86:e2:63:9f: e4:f6:e0:13:fd:67:7a:14:f7:e2:fe:6e:14:2a:ba: 80:e1:29:0d:7c:5a:36:91:60:ae:9b:14:6f:1e:2d: 40:b9:28:03:e5:d6:f8:f4:64:6d:ca:8b:1d:38:48: 30:92:fa:6f:75:c9:7a:62:61:47:0e:32:3e:e5:7e: 0a:3b:d5 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: 33:1A:1E:42:87:07:1F:05:83:C6:14:DE:5D:BC:90:89:8C:10:39:44 X509v3 Authority Key Identifier: keyid:C0:B7:97:89:CD:42:1E:6A:FB:7D:AE:3B:1E:A1:30:7E:94:FA:FB:35 X509v3 CRL Distribution Points: Full Name: URI:https://deb.plop.net/ssl/ Signature Algorithm: sha256WithRSAEncryption ad:d7:d0:1f:d1:f2:10:88:d4:4c:5e:fe:80:88:96:35:55:26: 12:8d:1f:1f:38:d2:36:6e:75:00:37:e8:45:28:eb:c3:b5:e7: 71:90:91:5a:96:2d:b6:3e:5b:c0:45:84:e5:dc:07:65:63:54: b1:06:4b:6a:ee:63:80:54:63:4c:72:1a:2f:eb:00:7c:36:0b: 18:22:3a:d2:90:e6:3f:69:9a:cf:b7:50:72:19:f6:3d:d5:19: fa:2a:46:09:cf:86:f7:12:0e:2c:4a:59:6c:26:45:2b:52:90: 72:55:a9:7d:16:27:db:ba:19:cb:c8:96:4c:e1:42:79:6b:ab: f9:87:97:43:e0:d1:71:2d:ef:fc:c9:f0:02:b1:7d:6c:59:ef: fd:00:76:4b:a7:f9:9c:1a:05:90:5b:df:2e:35:52:c7:79:f9: f3:31:d5:3f:60:2a:93:78:48:19:3b:53:43:ed:ee:f0:39:c8: fa:88:b8:7e:b0:5e:ce:73:c2:b2:c2:da:95:39:d9:1e:b7:02: d7:98:20:31:d2:91:c2:c9:61:45:cd:9b:f1:54:3d:17:df:96: 09:3d:11:96:b4:97:2a:9f:e8:9e:77:d4:1b:67:d9:a1:9d:1e: b8:d9:58:3a:b4:26:24:23:d5:a0:d6:52:78:1d:2f:d9:ce:f4: 41:66:82:7c:56:d9:df:a0:08:cb:b4:ae:2a:79:16:bf:91:09: 46:be:35:17:44:73:7b:48:e0:3e:f4:03:45:a7:36:3e:8e:8e: 58:7c:02:a9:c7:9d:22:98:bc:d3:05:90:81:39:d6:00:09:a4: 33:58:0f:57:b9:a5:e2:d0:3f:e4:ad:4e:47:a4:af:98:b6:d0: 49:f0:f9:d5:9b:b1:18:c6:fb:7d:3d:18:6c:90:62:1f:cb:c9: 97:00:92:57:29:32:1d:be:02:61:af:1f:17:48:eb:6a:b0:a2: f4:96:e1:0f:24:63:11:c7:66:2f:bc:7e:c2:e0:fd:25:3c:ac: 83:5b:05:35:b3:45:64:8e:93:21:3d:ed:1c:95:ae:24:55:98: 07:5f:99:71:28:8e:01:5d:94:16:62:03:a1:63:1f:08:88:6f: 9b:0b:db:43:21:31:4a:08:a2:a2:f6:af:7a:b3:20:94:5f:7d: 2f:53:3a:20:ea:08:5f:db:38:89:24:83:bd:9c:a0:78:ea:68: cd:39:47:b8:b6:f3:f4:bb:14:cc:e8:d0:24:59:7e:fc:0f:05: e9:73:18:5b:5d:31:0b:d2:e0:17:0f:ff:0d:b8:39:54:32:42: a2:07:b3:d3:53:5c:89:f7:b4:c3:44:60:7e:0c:5f:d1:80:e8: d2:6b:89:8d:1f:a9:79:7b -----BEGIN CERTIFICATE----- MIIFnDCCA4SgAwIBAgIBBjANBgkqhkiG9w0BAQsFADBFMQswCQYDVQQGEwJGUjET MBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQ dHkgTHRkMB4XDTE1MTIwMjA3MzIzNloXDTI1MTEyOTA3MzIzNlowNDELMAkGA1UE BhMCRlIxCzAJBgNVBAgMAkZSMQwwCgYDVQQKDANPVkgxCjAIBgNVBAMMATEwggIi MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCuKp6mb1Tr9x9/1me1aBGdqHmT eOi2SPZkfuW/cjNhb0rpwCX2YUfe96NdPdr6LZcIIFuxqRArUBjKQOoW+D2lXswY 1IAwYsxMtyuZnmo6CZcrHXk20lN6jZZPIMDzrOkB0aDXADeDH2Tu308nYaJflGa+ NVieUqCRCgBXE9W0s5AQjEJPNGk/nBt9m67reY3ZnSw8dFjCuqU05RUBRdNHhYLr NLIhupcrTpCST4UZx7B/zYxJCE4y0J40r7kCqkAur/VrQZKfWqsJtb16c/5N9BvG IyIVfLVH4Yi9irfXG15KU/lBM+kwl86btIh39jWcR6cSXZie5Bwnv73lhbHBH9wX A8AAnwvYQMMcMfObYBcFDax5nlMrqtp45/SoPvkU8UAfR99Fx1cUPSZonKd32ilQ hRzjYuZm8F5ZbzVhMuSofaEwtYVpDuP9jmd4w0dYXYg2ZYUJUkZHu0gDnOVCSGZ9 NH0BnGfqgvDVTptkDMbbHA0q3me6pQRESvwSlHewMPzQBibU6JTtoXhNzfqLpE5F /M8r2EcR4GjgeDY0T3ZcdktpAkwiR1cQks652CB+gICnylV8QaQKDgjghuJjn+T2 4BP9Z3oU9+L+bhQquoDhKQ18WjaRYK6bFG8eLUC5KAPl1vj0ZG3Kix04SDCS+m91 yXpiYUcOMj7lfgo71QIDAQABo4GnMIGkMAkGA1UdEwQCMAAwLAYJYIZIAYb4QgEN BB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0GA1UdDgQWBBQzGh5C hwcfBYPGFN5dvJCJjBA5RDAfBgNVHSMEGDAWgBTAt5eJzUIeavt9rjseoTB+lPr7 NTApBgNVHR8EIjAgMB6gHKAahhhodHRwczovL2RlYi5vdmgubmV0L3NzbC8wDQYJ KoZIhvcNAQELBQADggIBAK3X0B/R8hCI1Exe/oCIljVVJhKNHx840jZudQA36EUo 68O153GQkVqWLbY+W8BFhOXcB2VjVLEGS2ruY4BUY0xyGi/rAHw2CxgiOtKQ5j9p ms+3UHIZ9j3VGfoqRgnPhvcSDixKWWwmRStSkHJVqX0WJ9u6GcvIlkzhQnlrq/mH l0Pg0XEt7/zJ8AKxfWxZ7/0Adkun+ZwaBZBb3y41Usd5+fMx1T9gKpN4SBk7U0Pt 7vA5yPqIuH6wXs5zwrLC2pU52R63AteYIDHSkcLJYUXNm/FUPRfflgk9EZa0lyqf 6J531Btn2aGdHrjZWDq0JiQj1aDWUngdL9nO9EFmgnxW2d+gCMu0rip5Fr+RCUa+ NRdEc3tI4D70A0WnNj6Ojlh8AqnHnSKYvNMFkIE51gAJpDNYD1e5peLQP+StTkek r5i20Enw+dWbsRjG+309GGyQYh/LyZcAklcpMh2+AmGvHxdI62qwovSW4Q8kYxHH Zi+8fsLg/SU8rINbBTWzRWSOkyE97RyVriRVmAdfmXEojgFdlBZiA6FjHwiIb5sL 20MhMUoIoqL2r3qzIJRffS9TOiDqCF/bOIkkg72coHjqaM05R7i28/S7FMzo0CRZ fvwPBelzGFtdMQvS4BcP/w24OVQyQqIHs9NTXIn3tMNEYH4MX9GA6NJriY0fqXl7 -----END CERTIFICATE-----

2 7

Upcoming stunnel 5.27 release
by Michal Trojnara 01 Dec '15

01 Dec '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi Guys, stunnel 5.27 will be made available on 3rd December. Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWXHz/AAoJEC78f/DUFuAUcxAQAK5PrsoU4i0n25IYfFnuGWm/ R9Y4BJKO6/4+VHjRN9Yi4gJb0t7QpVxYQH9RuQAYVWp5RYeYqnxyb55m5iZ5IYBl V5ke5+DjTtPpMuTDShLz9BkL01lyrw8c+mwLy1IZM4nUgAQHyWp4lgcKgKukoY6N DYxloE5GmWW3ylGLAJUFlcVZmNayo8pmmVeWLbhsCRt0OyFJbrS8XUcVviZVcxAD q3Lly63NFC0Nsl+5MGmKxO8sRCu3UW0WkT4P5MbJr2f5b9AuTlrBmBNZ/fmyPAV9 5/LvAc5vdh9DwJEgGF3yvFqdFghR8TNuGNqBJaDn5pk+6rmc0qNeQkFFsq0CRX34 jSwNCl0A0SuXp4YGPTOFK9rp8bKjxq5VDUAGa6OyEhd92H2pSLxDA/aJqlY6f1vs MZQb6az60lrUq1JNnoYeUfO9AFMCFpqyFV4kqmfUOlnJox99JbZ5/U38CeaO9n8P tIz7jgijYRDK6itaCuf1QaWJxCU5S7yCUL1dtyi2nTDTvrG8WmTr93SniyGXScix fXIIb4Aa7mg3/p9J9TFONzxw0CySj/32ZBIgiLAWcAaa1Gnuy3+ARSAu1U6t9to8 Unnzppd1B7qn0qk1QANtktz4JAu63FUg7RSPHFt8+nLcABtslkjHdcVvzGl3F02k zjYq9bMufBOqlCDctGQO =rtq3 -----END PGP SIGNATURE-----

2 1

Failover behavior with stunnel
by Thireus 30 Nov '15

30 Nov '15

Hi, I have a couple of questions regarding failover with stunnel: 1. I would like to know if there is a way to use failover with two servers with two different set of TLS cert/key. The following rule doesn't work, because the cert and key parameters are overwritten, but it shows what I would like to achieve: [failover] accept = 127.0.0.1:4441 <http://127.0.0.1:4441/> cert = cert_1.cert key = key_1.pem connect = server-1:1234 cert = cert_2.cert key = key_2.pem connect = server-2:1234 2. On the same topic, I would like to know if there is an option that could open the local port (accept) only when the connection (connect) is established? The problem I'm facing is that I use a PAC profile with failover on several stunnel entries: "return PROXY 127.0.0.1:4441 <http://127.0.0.1:4441/>; PROXY 127.0.0.1:4442 <http://127.0.0.1:4442/>; PROXY 127.0.0.1:4443 <http://127.0.0.1:4443/>;". However, when one of the remote server is down (i.e. server-1), it is not easily detected by web-browsers (Chrome does not seem to detect it well), and so instead of switching to the next PROXY, it simply dies on the first one. If the port 4441 relative to server-1 (which is unavailable) was closed, then the webrowser could easily detect it and switch to the second server with port 4442. 3. Is there another way to tweak stunnel behavior when a remote server is down? I'm thinking about a couple of things, like being able to switch to a different rule set: [failover1] accept = 127.0.0.1:4441 <http://127.0.0.1:4441/> cert = cert_1.cert key = key_1.pem connect = server-1:1234 connect = 127.0.0.1:4442 <http://127.0.0.1:4442/> ; This is failover2 [failover2] accept = 127.0.0.1:4442 <http://127.0.0.1:4442/> cert = cert_2.cert key = key_2.pem connect = server-2:1234 Or maybe there are some options that I'm not aware of to timeout connections more efficiently: so that Chrome (or other clients using HTTP proxies) will immediately know that stunnel cannot connect to the remote server and so that the proxy is down. Thank you for your help. Cheers, Thireus.

2 3

Where is stunnel.exe ?
by Manu Egen 25 Nov '15

25 Nov '15

Hello, Can you tell me from which stunnel version, the "bin" folder and the "config" folder appeared ? The change is between the version 4.53 and 5.26, but which one ? Thanks a lot for the answer Best regards, Manu

1 0

syslog communication using TLS with the help of stunnel
by Girish Kumar 24 Nov '15

24 Nov '15

Dear All, Currently we are using syslog communication without any security. That is using UDP protocol with the server listening on port number 514. This is unsecure. I want to use syslog over TLS that is over TCP . As of now in my project syslogd daemon is used. I am planning to use stunnel to achieve this. I have few questions. Please clarify * To support stunnel, syslogd should be on TCP and not on UDP? * Is stunnel is a daemon ? * My understanding is syslogd forwards messages to the stunnel local portal at port 61514. The local stunnel forwards data via the network to port 60514 to its remote peer. * I assume stunnel-5.26(stunnel-5.26.tar.gz) is the latest version and this can be used on linux Regards, Girish

2 1

A trivial patch for two minor typos in 5.26
by Peter Pentchev 19 Nov '15

19 Nov '15

Hi, Once again, thanks a lot for taking care of stunnel! Attached is a trivial patch for two minor typo fixes. Thanks in advance for looking over it :) G'luck, Peter -- Peter Pentchev roam(a)ringlet.net roam(a)FreeBSD.org pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

1 0

OCSP stapling
by Joó Ádám 17 Nov '15

17 Nov '15

Hi, The website and the documentation does not indicate and a Google search does not give any relevant results, so I would like to ask if Stunnel supports OCSP stapling? Thank you, Ádám

2 1

STunnel 5.22
by Deepak Subbanarasimha 17 Nov '15

17 Nov '15

Is STunnel 5.22 supported on Windows 2003 server? Thanks, DEEPAK SUBBANARASIMHA Kewill DDI: +00 (1) 978 482 2625 Email: deepak.subbanarasimha(a)kewill.com<mailto:[email protected]> www.kewill.com<http://www.kewill.com/> Tel: +00 (1) 978 482 2500 | Fax: +00 (1) 978 482 2501 1 Executive Drive, Chelmsford, MA 01824, USA IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately notify us by telephone at (978) 482-2500 and return the original message to us at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code. Thank You. Copyright (c) 2013 by Kewill Inc IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately return the original message to the sender at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Although Kewill takes reasonable precautions to minimize the risk, Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code.

1 0

Compilation issues - AIX 6.1 XLC and GXLC
by Rob Lockhart 16 Nov '15

16 Nov '15

On AIX 6.1 using IBM's XLC compiler, I do "configure" and that successfully completes. However, when I "make", it fails due to the parameters "-fstack-protector" and "-fPIE"... apparently it couldn't find the files "stack-protector" and "PIE" as "-f" specifies a file. However, gcc and perhaps many other cc variants, "-f" specifies a compile option. I was able to compile with XLC by ripping out the "stack-protector" and "PIE" sections of "configure" and running "make" but it would be best to use the stack protector mechanisms used for AIX's XLC: https://www.ibm.com/developerworks/mydeveloperworks/blogs/b10932b4-0edd-4e6… Has anyone compiled Stunnel 5.26 using IBM's XLC without removing the stack-protector and PIE sections in the configure file? The other option is to use gxlc instead of xlc to map the GNU C compiler options to XLC options. Would that be preferred (less modification of configure file)? I was able to get that working, but still an unusually high number of warnings. http://geco.mines.edu/files/manuals/xlc/mapping.pdf The article above (from IBM) has "-qstackprotect=size=N" - what suggestion parameter to use for "N"? To be nice to everyone's mailbox, I have posted the logs here: Stunnel 5.26 AIX XLC - fails http://pastebin.ca/3250237 Stunnel 5.26 AIX GXLC - passes http://pastebin.ca/3250242 Thanks, -Rob

3 5

Virtual Machine/Server
by Duane Moody - Global Data Specialists 13 Nov '15

13 Nov '15

We are currently using Stunnel on a stand-alone PC to link a 3rd party application that monitors a Graphical User Interface application for alarm notification. Stunnel is used to link this 3rd party alarm notification software to be able to send message to Amazon Web Services for email distribution to the users/operators that need this information. IT would like to investigate having all applications operate from a server possibly running 2012 OS, in a virtual environment. The GUI and 3rd party software will operate in this environment and I wanted to see if Stunnel would have any issues continuing to send messages out to Amazon. Thank you, Duane Moody Global Data Specialists 1815 W. 1st Ave, Suite 110 Mesa, AZ 85202 PH: 480-461-3401, Ext 223 Fax: 480-461-3411 Cell: 602-696-9457 www.gbl-data.com

2 1

stunnel 5.26 released
by Michal Trojnara 06 Nov '15

06 Nov '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear Users, I have released version 5.26 of stunnel. The ChangeLog entry: Version 5.26, 2015.11.06, urgency: MEDIUM * Bugfixes - Compilation fixes for OSX, *BSD and Solaris. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 2c90d469011eed8dc94f003013e3c055de6fdb687ef1e71fa004281d7f7c2726 stunnel-5.26.tar.gz 797e89783bbab29d5eedbd3193da2cb2461bcf47d314a9ee671b228e207e2b15 stunnel-5.26-installer.exe cd62a3ed4818677e7eeab36017accbae697a67cfd85f58eae82d2ad2db781664 stunnel-5.26-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWPJBJAAoJEC78f/DUFuAUSWUQAKglnyE5OkITYqd7deO768mv AC7DvDrP+mwmICbl/ZQhVzuUB4E9WYUnbyrOduIbCoN3FrDr1hROcO6Tuf63DFXa 5Qal5tFFEgVm5LKi7MxPn022d5e8Q04RADtJ7DNzSrJNltyivHG3h6jAVlXcmlui BkFORjWbZAZ2AUvKBbUYYdjfR2rnpqlrUNIcZwMz0hR5e4JT5Yw5WHa3NfAcXknh XZ27+BoKg6jDyEx+mk2aXYFpeCvWPx5vaKmtAqbIkEaNKhmolpYxf02JespwmvpJ Y/rD0kko+r8zSwMQRZ8FSNncVbQ1Zir3rZM6IE78TkNeGnJKiq29H3dzrUuZP4uW Hv5qjAW7IaVMFUMUOsM/eyKTyh7ibgXLIshb7byn9zm5BHmlY4PgVUyeAXVVbYfK qgfMq43VjgXcyvFw4osQx5xYnA0P3edxFyx1v+GMeHssxh2CLv5MwrcmTcnf5SSm t2COdxi+4gA0mJwsSrdw8d7fuTLg/zhzWKSwB9XZqZ+xM+nTNVI3hzoQJ+Fhe/KP kfJ6qPrSHMj2WX740DDY/tGDTdxKnOEgJb0sJepEJyprIm8LFMSrBBt5fAdqgrPy a9znXn7RG+C71oxoaP/Q77fdAUQ9147SfGOO18ooYDzev5w5nHRg0kaPRrMDHxUg CyNsej8I/7CSXCH4PtjL =KQPP -----END PGP SIGNATURE-----

1 0

stunnel 5.25 released
by Michal Trojnara 05 Nov '15

05 Nov '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear Users, I have released version 5.25 of stunnel. The ChangeLog entry: Version 5.25, 2015.11.02, urgency: MEDIUM * New features - SMTP client protocol negotiation support for "protocolUsername", "protocolPassword", and "protocolAuthentication" (thx to Douglas Harris). - New service-level option "config" to specify OpenSSL >=1.0.2 configuration commands (thx to Stephen Wall). - The global option "foreground" now also accepts "quiet" parameter, which does not enable logging to stderr. - Manual page updated. - Obsolete OpenSSL engines removed from the Windows build: 4758cca, aep, atalla, cswift, nuron, sureware. - Improved compatibility with the current OpenSSL 1.1.0-dev tree: gracefully handle symbols renamed from SSLeay* to OpenSSL*. * Bugfixes - Fixed the "s_poll_wait returned 1, but no descriptor is ready" internal error. - Fixed "exec" hangs due to incorrect thread-local storage handling (thx to Philip Craig). - Fixed PRNG initialization (thx to Philip Craig). - Setting socket options no longer performed on PTYs. - Fixed 64-bit Windows build. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 1fb2209f1e006cc01813e1688599c4d0fb0adde4434c31ab95745b1db97484b7 stunnel-5.25.tar.gz 506846a28154e5111c6f374de5861c51221a5c9ddcf012952eaf7b4819176cd9 stunnel-5.25-installer.exe 58e79879a5fa922e2ae28ef0892f447d92d27517dfc0f921095b7180a7fd6905 stunnel-5.25-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWN2IVAAoJEC78f/DUFuAUhBoP/ifLB0Bl8yz13uGyy7mFghTN qwGLfLc5Nmu/flGOnynGWj6gXdRQT7WFaVkPCEoeNpttXEHzt+Q9psNAM4syOhBx KqiGJvq3atGfwGZwrIwUKZIXWT2jZldwL2vIctNe4i2oh6iWROcuTJqVa8eyLobw NJyuWCJqs60UK6IZN0ByrrO5Hc6Z7aTgJRkKmaWYY52ZeFrEUBY56yodfw8wvzAi JL/drDdJCyx4Q7ZQR14ZjhegAIqiEJ7GsbfosxBq3eApJKX/5L7zTP+BHL/jrFCu kiU/BhnjeYIuZ+R2j4tFWVhReMYjYIvjMAvPEo7GG1Z6xuVPpCQ90VW376cPbh8N 918Q/Gh/PF60covJmNYdW8Wn4L84vJrOM5uHkDCH2ZVFWWXUBGHZ0ZxBb1lB+kVC 69AzbK5hwHwEyfs/JjXjaIW3Tih9/Ig9t/+CD/131eWEqjGAxGtCGYgJMi0JgAt0 ei/kXeNuq39DxhTquGD1QOn98rVyrFsvvvV7aaMIECPri2MTHnZyMAF+N7txpcT2 UhD8Dlfnif6nF3JJ08/KWRh7x2tvmsFyZyqNV+uw3q3unUvZD6lcW7DCWAuXK4ap 5+fFJsxdvMUlqKZWrPrA2xrpObKAVdRdlLjDTl/oD3DuT9xfW3UQ6WKB76aLlnkL MdkEcOQuN+oCQNSlAv// =WhEM -----END PGP SIGNATURE-----

5 15