- stunnel-users - stunnel.org

Key and Certificate file issue!
by Hamid.Shahid＠sungard.com 30 Nov '11

30 Nov '11

Hi, I am trying to establish a SSL connection with a remote server on a random port 10170. I have got a public key from the server side. And I have sent my public key to the server. And I am trying to use my certificate file and the public key of the server like this. cert = sunPrimary.pem key = sunStunnel.pem But the problem is both the public key from server and my own certificate file starts with "-----BEGIN CERTIFICATE-----" by default. So now, if I don't change the "-----BEGIN CERTIFICATE-----" header of the my certificate to "-----BEGIN PRIVATE KEY-----" I get errors and if I change it to private key and make the public key of the server as certificate then I still get errors. Please let me know, how can I use the key and certificate together. Thanks. Kind Regards, Hamid Shahid

2 3

Pop3, CAPA before STLS (allow stunnel to work with android devices using proto pop3 option).
by Anthony Morgan 30 Nov '11

30 Nov '11

Hi, I'm running a pop3 server on a non-standard port and having stunnel listen on both 110 and 995 like so: [pop3_ssl] accept = 995 connect = ... [pop3_tls] accept = 110 connect = ... protocol = pop3 When connecting from an android device (2.3 on Nexus S at least), it confirms the server supports STLS using CAPA (and seemingly will not configure otherwise), so I modified protocol.c to announce support: < fdputline(c, c->local_wfd.fd, "+OK Stunnel capability list follows"); < fdputline(c, c->local_wfd.fd, "STLS"); < fdputline(c, c->local_wfd.fd, "."); --- > fdputline(c, c->local_wfd.fd, "-ERR Stunnel does not support capabilities"); It seems to me that there is no harm in this, because the RFC states that the client MUST recheck the servers capabilities with another CAPA command after starting TLS. It may be better to check the servers actual capabilities, add STLS to them and return that, but this does work. Any thoughts or comments? Tony Morgan --- Sent from Post.fm

1 0

FIPS_mode_set error
by Koenraad Lelong 29 Nov '11

29 Nov '11

Hi, I have an application which uses stunnel. Using stunnel 4.25 everything works fine. If I replace this with stunnel 4.49, I get an error, see the log : No limit detected for the number of clients make_sockets: s_socket#1: FD=228 allocated (blocking mode) make_sockets: s_socket#2: FD=232 allocated (blocking mode) make_sockets: s_accept: FD=236 allocated (non-blocking mode) stunnel 4.49 on x86-pc-mingw32-gnu platform Compiled/running with OpenSSL 0.9.8r-fips 8 Feb 2011 Threading:WIN32 SSL:ENGINE,FIPS Auth:none Sockets:SELECT,IPv6 Reading configuration from file stunnel.conf FIPS_mode_set: 2D06906E: error:2D06906E:FIPS routines:FIPS_CHECK_INCORE_FINGERPRINT:fingerprint does not match Server is down My stunnel.conf : cert = my.keycrt socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 3 CApath = certs CAfile = cacert.pem debug = 7 ; output = c:\Program Files\stunnel\stunnel.log client = yes [Server] accept = 6051 connect = server.example.com:8051 What am I doing wrong ? I'm trying this on Win7-64bit. On WinXP-32bit it works fine. Thanks for any clarification, Regards, Koenraad Lelong.

2 2

stunnel 4.49 released
by Michal Trojnara 28 Nov '11

28 Nov '11

Dear Users, I have released version 4.49 of stunnel. The ChangeLog entry: Version 4.49, 2011.11.28, urgency: MEDIUM: * Bugfixes - Missing Microsoft Visual C++ Redistributable (msvcr100.dll) required by FIPS-compliant OpenSSL library was added to the Windows installer. - A bug was fixed causing crashes on MacOS X and some other platforms. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.49.tar.gz: dcb0e1f21e9fcf56f4d67bc7a5a4ef8720845b61063a749953417db2616cb20d Best regards, Mike

1 0

Stunnel compilation issue on Mac OS X 10.5 powerpc
by Cedric Lor 28 Nov '11

28 Nov '11

Hi, I've been trying to compile stunner (4.47) on a power pc Mac OS X Leopard (OS X 10.5) platform after a manual update to openssl v.1.0.0.e ggc is version 4.0.1. I run into an error according to which there would be undefined symbols in stunnel-ctx.o (see make output below). I can't figure out to which feature stunner-ctx.o is related, whether I need this feature and how to disable it in ./configure if I don't need it. Please note that I managed to install stunner 4.46 via fink on the same machine (such fink install of stunnel required installing a specific instance of openssl (v.1.0.0.0.e) within fink). Would anyone be able to identify from the make output below whether the issue comes from stunnel or from my openssl manual install? Many thanks. Cedric Making all in src make all-am /bin/sh ../libtool --tag=CC --mode=compile gcc -DHAVE_CONFIG_H -I. -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT env.lo -MD -MP -MF .deps/env.Tpo -c -o env.lo env.c libtool: compile: gcc -DHAVE_CONFIG_H -I. -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT env.lo -MD -MP -MF .deps/env.Tpo -c env.c -fno-common -DPIC -o .libs/env.o mv -f .deps/env.Tpo .deps/env.Plo /bin/sh ../libtool --tag=CC --mode=link gcc -g -O2 -Wall -Wextra -Wno-long-long -pedantic -avoid-version -o libstunnel.la -rpath /usr/local/lib/stunnel env.lo -lz -ldl -lutil -lpthread -lwrap libtool: link: gcc -dynamiclib -Wl,-undefined -Wl,dynamic_lookup -o .libs/libstunnel.dylib .libs/env.o -lz -ldl -lutil -lpthread -lwrap -install_name /usr/local/lib/stunnel/libstunnel.dylib -Wl,-single_module libtool: link: dsymutil .libs/libstunnel.dylib || : libtool: link: ( cd ".libs" && rm -f "libstunnel.la" && ln -s "../libstunnel.la" "libstunnel.la" ) gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-str.o -MD -MP -MF .deps/stunnel-str.Tpo -c -o stunnel-str.o `test -f 'str.c' || echo './'`str.c mv -f .deps/stunnel-str.Tpo .deps/stunnel-str.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-file.o -MD -MP -MF .deps/stunnel-file.Tpo -c -o stunnel-file.o `test -f 'file.c' || echo './'`file.c mv -f .deps/stunnel-file.Tpo .deps/stunnel-file.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-client.o -MD -MP -MF .deps/stunnel-client.Tpo -c -o stunnel-client.o `test -f 'client.c' || echo './'`client.c mv -f .deps/stunnel-client.Tpo .deps/stunnel-client.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-log.o -MD -MP -MF .deps/stunnel-log.Tpo -c -o stunnel-log.o `test -f 'log.c' || echo './'`log.c mv -f .deps/stunnel-log.Tpo .deps/stunnel-log.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-options.o -MD -MP -MF .deps/stunnel-options.Tpo -c -o stunnel-options.o `test -f 'options.c' || echo './'`options.c mv -f .deps/stunnel-options.Tpo .deps/stunnel-options.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-protocol.o -MD -MP -MF .deps/stunnel-protocol.Tpo -c -o stunnel-protocol.o `test -f 'protocol.c' || echo './'`protocol.c mv -f .deps/stunnel-protocol.Tpo .deps/stunnel-protocol.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-network.o -MD -MP -MF .deps/stunnel-network.Tpo -c -o stunnel-network.o `test -f 'network.c' || echo './'`network.c mv -f .deps/stunnel-network.Tpo .deps/stunnel-network.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-resolver.o -MD -MP -MF .deps/stunnel-resolver.Tpo -c -o stunnel-resolver.o `test -f 'resolver.c' || echo './'`resolver.c mv -f .deps/stunnel-resolver.Tpo .deps/stunnel-resolver.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-ssl.o -MD -MP -MF .deps/stunnel-ssl.Tpo -c -o stunnel-ssl.o `test -f 'ssl.c' || echo './'`ssl.c mv -f .deps/stunnel-ssl.Tpo .deps/stunnel-ssl.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-ctx.o -MD -MP -MF .deps/stunnel-ctx.Tpo -c -o stunnel-ctx.o `test -f 'ctx.c' || echo './'`ctx.c mv -f .deps/stunnel-ctx.Tpo .deps/stunnel-ctx.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-verify.o -MD -MP -MF .deps/stunnel-verify.Tpo -c -o stunnel-verify.o `test -f 'verify.c' || echo './'`verify.c mv -f .deps/stunnel-verify.Tpo .deps/stunnel-verify.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-sthreads.o -MD -MP -MF .deps/stunnel-sthreads.Tpo -c -o stunnel-sthreads.o `test -f 'sthreads.c' || echo './'`sthreads.c mv -f .deps/stunnel-sthreads.Tpo .deps/stunnel-sthreads.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-stunnel.o -MD -MP -MF .deps/stunnel-stunnel.Tpo -c -o stunnel-stunnel.o `test -f 'stunnel.c' || echo './'`stunnel.c stunnel.c: In function 'daemonize': stunnel.c:447: warning: 'daemon' is deprecated (declared at /usr/include/stdlib.h:283) stunnel.c: At top level: stunnel.c:70: warning: 'signal_pipe_redirect' declared 'static' but never defined mv -f .deps/stunnel-stunnel.Tpo .deps/stunnel-stunnel.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-pty.o -MD -MP -MF .deps/stunnel-pty.Tpo -c -o stunnel-pty.o `test -f 'pty.c' || echo './'`pty.c mv -f .deps/stunnel-pty.Tpo .deps/stunnel-pty.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-libwrap.o -MD -MP -MF .deps/stunnel-libwrap.Tpo -c -o stunnel-libwrap.o `test -f 'libwrap.c' || echo './'`libwrap.c mv -f .deps/stunnel-libwrap.Tpo .deps/stunnel-libwrap.Po /bin/sh ../libtool --tag=CC --mode=link gcc -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -L/usr/local/ssl/lib64 -L/usr/local/ssl/lib -lssl -lcrypto -o stunnel stunnel-str.o stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o -lz -ldl -lutil -lpthread -lwrap libtool: link: gcc -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -o stunnel stunnel-str.o stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o -L/usr/local/ssl/lib64 -L/usr/local/ssl/lib -lssl -lcrypto -lz -ldl -lutil -lpthread -lwrap -pthread Undefined symbols: "_EC_KEY_new_by_curve_name", referenced from: _context_init in stunnel-ctx.o "_SSL_get_servername", referenced from: _servername_cb in stunnel-ctx.o "_SSL_CTX_sess_set_get_cb", referenced from: _context_init in stunnel-ctx.o "_SSL_CTX_set_info_callback", referenced from: _context_init in stunnel-ctx.o "_BIO_set_flags", referenced from: _base64 in stunnel-protocol.o "_SSL_set_SSL_CTX", referenced from: _servername_cb in stunnel-ctx.o "_SSL_CTX_sess_set_new_cb", referenced from: _context_init in stunnel-ctx.o "_SSL_CTX_sess_set_remove_cb", referenced from: _context_init in stunnel-ctx.o "_EC_KEY_free", referenced from: _context_init in stunnel-ctx.o ld: symbol(s) not found collect2: ld returned 1 exit status make[2]: *** [stunnel] Error 1 make[1]: *** [all] Error 2 make: *** [all-recursive] Error 1

2 3

Server is down
by Hamid.Shahid＠sungard.com 28 Nov '11

28 Nov '11

Hi, I am trying to connect to a remote SSL enabled server via stunnel. I am using a single file for key and certificate "sunStunnel.pem", just like the default "stunnel.pem" and I am getting following errors. Please let me know, what they mean and what should be done to resolve these? Note: I was able to telnet the machine, so server seems to be working. Thanks. ======= Config ======= debug = 7 output = stunnel.log cert = sunStunnel.pem [GPC-HOST] client = yes [syslog] accept = 127.0.0.1:2525 connect = <ip>:<port> ======= Log ======= No limit detected for the number of clients make_sockets: s_socket#1: FD=652 allocated (blocking mode) make_sockets: s_socket#2: FD=648 allocated (blocking mode) make_sockets: s_accept: FD=604 allocated (non-blocking mode) stunnel 4.47 on x86-pc-mingw32-gnu platform Compiled/running with OpenSSL 1.0.0e 6 Sep 2011 Threading:WIN32 SSL:ENGINE Auth:none Sockets:SELECT,IPv6 Reading configuration from file stunnel.conf Snagged 64 random bytes from C:/.rnd Wrote 1024 new random bytes to C:/.rnd PRNG seeded successfully Initializing SSL context for service GPC-HOST Certificate: sunStunnel.pem Certificate loaded Key file: sunStunnel.pem error queue: 140B0009: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib error queue: 907B00D: error:0907B00D:PEM routines:PEM_READ_BIO_PRIVATEKEY:ASN1 lib error queue: D08303A: error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error error queue: D06C03A: error:0D06C03A:asn1 encoding routines:ASN1_D2I_EX_PRIMITIVE:nested asn1 error SSL_CTX_use_PrivateKey_file: D0680A8: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag Server is down Kind Regards, Hamid Shahid

2 1

error queue: 140B0009: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib
by Hamid.Shahid＠sungard.com 28 Nov '11

28 Nov '11

Hi, I am trying to connect to a remote SSL enabled server via stunnel. I am using a single file for key and certificate "sunStunnel.pem", just like the default "stunnel.pem" and I am getting following errors. Please let me know, what they mean and what should be done to resolve these? Note: I was able to telnet the machine, so server seems to be working. Thanks. ======= Config ======= debug = 7 output = stunnel.log cert = sunStunnel.pem [GPC-HOST] client = yes [syslog] accept = 127.0.0.1:2525 connect = <ip>:<port> ======= Log ======= No limit detected for the number of clients make_sockets: s_socket#1: FD=652 allocated (blocking mode) make_sockets: s_socket#2: FD=648 allocated (blocking mode) make_sockets: s_accept: FD=604 allocated (non-blocking mode) stunnel 4.47 on x86-pc-mingw32-gnu platform Compiled/running with OpenSSL 1.0.0e 6 Sep 2011 Threading:WIN32 SSL:ENGINE Auth:none Sockets:SELECT,IPv6 Reading configuration from file stunnel.conf Snagged 64 random bytes from C:/.rnd Wrote 1024 new random bytes to C:/.rnd PRNG seeded successfully Initializing SSL context for service GPC-HOST Certificate: sunStunnel.pem Certificate loaded Key file: sunStunnel.pem error queue: 140B0009: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib error queue: 907B00D: error:0907B00D:PEM routines:PEM_READ_BIO_PRIVATEKEY:ASN1 lib error queue: D08303A: error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error error queue: D06C03A: error:0D06C03A:asn1 encoding routines:ASN1_D2I_EX_PRIMITIVE:nested asn1 error SSL_CTX_use_PrivateKey_file: D0680A8: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag Server is down Kind Regards, Hamid Shahid [cid:[email protected]]<http://www.sungard.com/ten> Hamid Shahid * Integration Developer * Front Arena * Capital Markets * SunGard * Kungsbron 2, PO Box 70351, SE-107 24 Stockholm, Sweden * Tel +46 (0) 8 454 0167 * Direct +46 (0) 8 454 0167 * Mobile +46 (0) 76 869 2167 * hamid.shahid(a)sungard.com<mailto:[email protected]> * www.sungard.com<http://www.sungard.com/> Join SunGard's customers, partners and industry experts at www.sungard.com/ten<http://www.sungard.com/ten> to discuss how the need for more Transparency, Efficiency and Networks is changing our industry and to register for a city day event near you. VIENNA HOUSTON FRANKFURT BEIJING HONG KONG NEW YORK LONDON SEOUL ZURICH MUMBAI JOHANNESBURG DUBAI SAO PAULO CONFIDENTIALITY: This e-mail (including any attachments) may contain confidential, proprietary and privileged information, and unauthorized disclosure or use is prohibited. If you receive this e-mail in error, please notify the sender and delete this e-mail from your system.Thank you. P Please consider the environment before printing this e-mail.

1 0

stunnel 4.48 released
by Michal Trojnara 26 Nov '11

26 Nov '11

Dear Users, I have released version 4.48 of stunnel. The ChangeLog entry: Version 4.48, 2011.11.26, urgency: MEDIUM: * New features - FIPS support on Win32 platform added. OpenSSL 0.9.8r DLLs based on FIPS 1.2.3 canister are included with this version of stunnel. FIPS mode can be disabled with "fips = no" configuration file option. * Bugfixes - Fixed canary initialization problem on Win32 platform. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.48.tar.gz: 9fa723595726806cbf6547a2c453e695e33bf635f2d4771e80d110a06f27ea37 Best regards, Mike

1 0

stunnel & HAProxy : patch still required ?
by Thomas Manson 24 Nov '11

24 Nov '11

Hi, I'm willing to use this kind of configuration : https client -->stunnel --> haproxy --> 2 web servers in http (or more) I've understand that haproxy can't handle the ssl part, that's why stunnel is needed. I've read that a Patch is required for stunnel to work with haproxy in this kind of confirmation "I run stunnel 4.32 with patch from http://haproxy.1wt.eu/download/patches/ on port 443 and forward it to port 81 on the same machine which is bound to haproxy." Can anyone tell me if this patch is now included in stunnel, in particular, does Ubuntu 11.10 include it ? I really would rather stay with package provided by ubuntu in order to have easy upgrade/security fix. I've experiences the work overload of manually compiling everything in Apache for instance ;) Any advices on this kind of setup ? documentation pointers? best practices ? Regards, Thomas. here is the current package version on ubuntu 11.10 thomas@daisybox:~/Documents$ aptitude show stunnel4 Package: stunnel4 New: yes State: not installed Version: 3:4.35-2build1 Priority: optional Section: universe/net Maintainer: Ubuntu Developers <ubuntu-devel-discuss(a)lists.ubuntu.com> Uncompressed Size: 541 k Depends: libc6 (>= 2.11), libssl1.0.0 (>= 1.0.0), libwrap0 (>= 7.6-4~), openssl, netbase, perl-modules PreDepends: adduser Suggests: logcheck-database Conflicts: stunnel4 Breaks: stunnel (< 3:4.20-3), stunnel (< 3:4.20-3) Replaces: stunnel, stunnel Provides: stunnel Description: Universal SSL tunnel for network daemons The stunnel program is designed to work as SSL encryption wrapper between remote client and local (inetd-startable) or remote server. The concept is that having non-SSL aware daemons running on your system you can easily setup them to communicate with clients over secure SSL channel. stunnel can be used to add SSL functionality to commonly used inetd daemons like POP-2, POP-3 and IMAP servers without any changes in the programs' code. This package contains a wrapper script for compatibility with stunnel 3.x Homepage: http://www.stunnel.org/ thomas@daisybox:~/Documents$ aptitude show stunnel No current or candidate version found for stunnel Package: stunnel State: not a real package Provided by: stunnel4

2 1

Patch: Include source IP in connection failure log lines
by Alex Gottschalk 23 Nov '11

23 Nov '11

I'm setting up an internet-facing server that will be running a service wrapped with stunnel. Given that, it made sense to me to use fail2ban to block repeat connection attempts from clients who don't have the right certificate (the system is using client-certificate authentication). Unfortunately, stunnel4 doesn't put the client source IP in connection failure log lines, so I made this quick patch to enable that. ---cut here---- --- src/client.c.orig 2011-10-05 16:47:48.000000000 -0700 +++ src/client.c 2011-10-05 16:50:37.000000000 -0700 @@ -358,10 +358,13 @@ continue; } } - if(c->opt->option.client) + if(c->opt->option.client) { sslerror("SSL_connect"); - else - sslerror("SSL_accept"); + } else { + char buf[255]; + sprintf(buf, "SSL_accept from %s ", c->accepted_address); + sslerror(buf); + } longjmp(c->err, 1); } if(SSL_session_reused(c->ssl)) { ----cut here----

1 0

Getting Stunnel to work
by Brian Miller 21 Nov '11

21 Nov '11

Hello, I recently moved my Homeseer software from web server 08 to server 08. I had stunnel working on there properly to send out e mails using a hotmail account. I downloaded the new verison of Stunnel and tried to use the same config but Stunnel was crashing. Both versions web server 08 and server 08 are 64bit. Below is the original stunnel config file that I used on web server 08, this is cashing stunnel to crash when I run it. Using the default settings works, but I need to edit the config. I'm not to smart in the whole stunnel / Homeseer side of things. I was told by the Homeseer community that I need this to use my hotmail e mail to send e mails. ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 ;output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [pop3s] accept = 110 connect = pop3.live.com:995 [imaps] accept = 993 connect = 143 [ssmtp] accept = 25 connect = smtp.live.com:587 protocol = smtp ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini

1 0

stunnel 4.47 released
by Michal Trojnara 20 Nov '11

20 Nov '11

Dear Users, I have released version 4.47 of stunnel. This version includes a number of important bugfixes. The ChangeLog entry: Version 4.47, 2011.11.21, urgency: MEDIUM: * Internal improvements - CVE-2010-3864 workaround improved to check runtime version of OpenSSL rather than compiled version, and to allow OpenSSL 0.x.x >= 0.9.8p. - Encoding of man page sources changed to UTF-8. * Bugfixes - Handling of socket/SSL close in transfer() function was fixed. - Logging was modified to save and restore system error codes. - Option "service" was restricted to Unix, as since stunnel 4.42 it wasn't doing anything useful on Windows platform. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.47.tar.gz: 0b70f8bad8b6963e6154606571a83a3f0e0dea88d7dbd7e3b83cde5a07dd95ae Best regards, Mike

1 0

Re: [stunnel-users] expired certificate problem
by Rolf Ruediger 18 Nov '11

18 Nov '11

Yeah, great idea...now the log looks a little different: CRL: verification passed 2011.11.18 14:33:22 LOG5[2517:3077962608]: VERIFY OK: depth=2, /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only [...and so on...] But at the end, same as usual: 2011.11.18 14:33:22 LOG3[2517:3077962608]: SSL_connect: 14094415: error:14094415:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate expired 2011.11.18 14:33:22 LOG5[2517:3077962608]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Maybe there is another reason, why I cant connect? Maybe the lines 2011.11.18 14:33:22 LOG5[2517:3077962608]: connect_blocking: connected example.com:443 2011.11.18 14:33:22 LOG5[2517:3077962608]: https connected remote server from my_outsid_ip:38491 are messing something? -Rolf ________________________________ From: "josealf(a)rocketmail.com" <josealf(a)rocketmail.com> To: Rolf Ruediger <stunnel(a)ymail.com> Sent: Friday, November 18, 2011 2:18 PM Subject: Re: [stunnel-users] expired certificate problem Rolf, Try verify = 0 Regards -----Original Message----- From: Rolf Ruediger <stunnel(a)ymail.com> Sender: stunnel-users-bounces(a)stunnel.org Date: Fri, 18 Nov 2011 05:15:33 To: stunnel-users(a)stunnel.org<stunnel-users(a)stunnel.org> Reply-To: Rolf Ruediger <stunnel(a)ymail.com> Subject: Re: [stunnel-users] expired certificate problem _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

expired certificate problem
by Rolf Ruediger 18 Nov '11

18 Nov '11

Hello there! Some time ago I used stunnel to send the output of a homebrew logging script to a remote server. For a few weeks now, the sever has an expired certificate, so I get an error while connecting to it. The stunnel.log looks like that: 2011.11.18 12:23:36 LOG5[753:3078719168]: stunnel 4.29 on i486-pc-linux-gnu with OpenSSL 0.9.8o 01 Jun 2010 2011.11.18 12:23:36 LOG5[753:3078719168]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2011.11.18 12:23:36 LOG5[753:3078719168]: 500 clients allowed 2011.11.18 12:24:00 LOG5[759:3078716272]: https accepted connection from 127.0.0.1:40691 2011.11.18 12:24:00 LOG5[759:3078716272]: connect_blocking: connected example.com:443 2011.11.18 12:24:00 LOG5[759:3078716272]: https connected remote server from my_outside_ip:38486 2011.11.18 12:24:00 LOG3[759:3078716272]: SSL_connect: 14094415: error:14094415:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate expired 2011.11.18 12:24:00 LOG5[759:3078716272]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket This happens, when connecting manually with "nc -v 127.0.0.1 1234" to make a http-get request. To also provide the config file of my linux client: ; Sample stunnel configuration file by Michal Trojnara 2002-2009 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of the chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /etc/ssl/certs/https.pem ;key = /etc/ssl/certs/stunnel.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = SSLv3 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 ; PID is created inside the chroot jail pid = /stunnel4.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = zlib ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 output = /var/log/stunnel4/stunnel.log ; Use it for client mode client = yes ; Service-level configuration [https] accept = 127.0.0.1:1234 connect = example.com:443 TIMEOUTclose = 0 ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 [ssmtp] accept = 465 connect = 25 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini So, the server is not under my control, where I am logging to. Is there a problem I don't see? I thought, that when I connect to localhost, the data should be forwarded to the https-server. Thanks in advance. -Rolf

2 2

[patch] x-forwarded-for patch for the new stunnel 4.46
by Michel Belleau 18 Nov '11

18 Nov '11

Hi. I use HAProxy and STunnel and I had to do a new installation lately. I took time to check the latest versions available of each product as this is a good time to test it out before production roll-out. I figured out that enough things have changed from STunnel version 4.44 to 4.46 making the X-Forwarded-For patch (that is usually used when STunnel sits in front of HAProxy) reject some parts of the latest 4.44 patch I found on the internet. Here is the patch, applying with no problems on 4.46, for anyone else interested: http://labs.malaiwah.com/stunnel-4.46-xforwarded-for.diff PS: I didn't try it yet for IPv6 connections yet. Michel Belleau

3 2

Re: [stunnel-users] FW: I can't get stunnel working : SSL3_GET_RECORD:wrong version number
by Michal Trojnara 17 Nov '11

17 Nov '11

The Guru wrote: > When I try to connect, > stunnel reports an error "wrong version number". [cut] > read from 0x4b5f98 [0x4cc0a0] (7 bytes => 7 (0x7)) > 0000 - 16 03 00 0d 01 02 ...... Your server reply protocol version is 3.0. You may wish to enable TLS on your server, or to specify: sslVersion = SSLv3 in your stunnel.conf. Best regards, Michal Trojnara

1 0

Multiple Windows Services
by John W 14 Nov '11

14 Nov '11

I upgraded from stunnel 4.34 to 4.46 (Windows) today, which took much more time than expected. First, I was surprised to see that my specified service name (via "service =" was ignored), until I eventually found the note in the 4.42 changelog about "Removed support for changing Windows Service name with "service"". This isn't the end of the world (I changed the display name using sc) but it would be very helpful -- and time saving -- if the man page was updated to reflect this change. A bigger issue I ran into is that because the service can't be renamed, I can have only one stunnel service installed. The only mention of this I found was a reply to a list question saying "Running more than one stunnel service has been obsoleted." What was the motivation behind this change? Though I can specify multiple [service] sections in stunnel.conf, I see no way to control them individually. It has been useful to have separate stunnel (Windows) services installed, which can be stopped and started independently. Thanks.

2 2

[PATCH]: Debugging output
by Andrew Watts 08 Nov '11

08 Nov '11

Hi. According to the manpage for the output=<file> configuration directive, if this is set then it should replace syslog facility logging. However, stunnel 4.45 (and ealier version) on linux send debugging information to both syslog and a logfile when output is specified. The following patch makes stunnel behave according to the manpage "append log messages to a file instead of using syslog": ==================================== --- a/src/log.c +++ b/src/log.c @@ -163,7 +163,7 @@ static void log_raw(const int level, con line=str_printf("%s %s: %s", stamp, id, text); if(level<=global_options.debug_level) { #if !defined(USE_WIN32) && !defined(__vms) - if(global_options.option.syslog) + if(global_options.option.syslog && !global_options.output_file) syslog(level, "%s: %s", id, text); #endif /* USE_WIN32, __vms */ if(outfile) ==================================== ~ Andy

2 2

Error detected on socket (read) file descriptor: Broken pipe (32)
by Alex Magee 08 Nov '11

08 Nov '11

Hello, I'm trying to use stunnel to workaround a wine bug which prevents an old Windows mail client from accessing my mail server through a pop3s 995 port. I'm not an expert on linux, stunnel, sockets or ssl. The process seems to start off well, establishes a connection to the correct remote mail server, and negotiates an ssl connection, but then terminates with: Error detected on socket (read) file descriptor: Broken pipe (32) I've played with various settings in the stunnel.conf file, but with no success. A Google search turned up one other example of this problem back in Nov 2010, but no solution was forthcoming. Does anyone have any suggestions of what might be the problem? The level 7 debug stunnel.log file follows at the end, with TCP addresses masked. The system is SUSE Linux 11.4. Using the latest versions of ssl and stunnel. Thanks, Alex stunnel.log -------------- local socket: FD=0 allocated (non-blocking mode) Service pmail-pop3 accepted FD=0 from 127.0.0.1:48828 Service pmail-pop3 started Option TCP_NODELAY set on local socket Service pmail-pop3 accepted connection from 127.0.0.1:48828 remote socket: FD=1 allocated (non-blocking mode) connect_blocking: connecting xxx.xxx.xxx.xxx:995 connect_blocking: s_poll_wait xxx.xxx.xxx.xxx:995: waiting 10 seconds connect_blocking: connected xxx.xxx.xxx.xxx:995 Service pmail-pop3 connected remote server from 192.168.1.47:46187 Remote FD=1 initialized Option TCP_NODELAY set on remote socket SNI: host name: yyy.yyy.yyy..com SSL state (connect): before/connect initialization SSL state (connect): SSLv3 write client hello A SSL state (connect): SSLv3 read server hello A SSL state (connect): SSLv3 read server certificate A SSL state (connect): SSLv3 read server done A SSL state (connect): SSLv3 write client key exchange A SSL state (connect): SSLv3 write change cipher spec A SSL state (connect): SSLv3 write finished A SSL state (connect): SSLv3 flush data SSL state (connect): SSLv3 read finished A 1 items in the session cache 1 client connects (SSL_connect()) 1 client connects that finished 0 client renegotiations requested 0 server connects (SSL_accept()) 0 server connects that finished 0 server renegotiations requested 0 session cache hits 0 external session cache hits 0 session cache misses 0 session cache timeouts SSL connected: new session negotiated Negotiated ciphers: RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 Socket closed on read Sending SSL write shutdown Error detected on socket (read) file descriptor: Broken pipe (32) Connection reset: 79 bytes sent to SSL, 64 bytes sent to socket Service pmail-pop3 finished (0 left) str_stats: 0 block(s), 0 byte(s)

2 2

stunnel 4.46 released
by Michal Trojnara 07 Nov '11

07 Nov '11

Dear Users, I have released version 4.46 of stunnel. The ChangeLog entry: Version 4.46, 2011.11.04, urgency: LOW: * New features - Added Unix socket support (e.g. "connect = /var/run/stunnel/ socket"). - Added "verify = 4" mode to ignore CA chain and only verify peer certificate. - Removed the limit of 16 IP addresses for a single 'connect' option. - Removed the limit of 256 stunnel.conf sections in PTHREAD threading model. It is still not possible have more than 63 sections on WIN32 platform. http://msdn.microsoft.com/en-us/library/windows/desktop/ms740141(v=vs.85).a… * Optimizations - Reduced per-connection memory usage. - Performed a major refactoring of internal data structures. Extensive internal testing was performed, but some regression bugs are expected. * Bugfixes - Fixed WIN32 compilation with Mingw32. - Fixed non-blocking API emulation layer in UCONTEXT threading model. - Fixed signal handling in UCONTEXT threading model. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.46.tar.gz: 8ea8943bdfcd74a2e66dc00d4ed17b402bbd39d040a125901534f6f4308da99d Best regards, Mike

2 1

Stunnel & Haproxy
by Christophe Rahier 03 Nov '11

03 Nov '11

Hi, I'd like to user Stunnel with Haproxy on a Debian Squeeze server. I downloaded these files: wget ftp://ftp.stunnel.org/stunnel/obsolete/4.x/stunnel-4.44.tar.gz wget http://haproxy.1wt.eu/download/patches/stunnel-4.44-xforwarded-for.diff I patch the file with patch -p1 < ../stunnel-4.44-xforwarded-for.dif After this, I try to "make". I've a lot of errors and I don't understand, I'm not a Linux guru! :-( Errors : Making all in src make[1]: Entering directory `/tmp/stunnel-4.44/src' make all-am make[2]: Entering directory `/tmp/stunnel-4.44/src' gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr//include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-str.o -MD -MP -MF .deps/stunnel-str.Tpo -c -o stunnel-str.o `test -f 'str.c' || echo './'`str.c In file included from str.c:38: common.h:383:19: error: lhash.h: No such file or directory common.h:384:17: error: ssl.h: No such file or directory common.h:386:20: error: crypto.h: No such file or directory common.h:387:17: error: md4.h: No such file or directory common.h:388:17: error: des.h: No such file or directory In file included from str.c:39: prototypes.h:117: error: expected specifier-qualifier-list before 'SSL_CTX' prototypes.h:368: error: expected specifier-qualifier-list before 'SSL' prototypes.h:391: warning: struct has no members prototypes.h:469: error: 'PEM_BUFSIZE' undeclared here (not in a function) str.c: In function 'str_canary': str.c:210: warning: implicit declaration of function 'RAND_bytes' str.c: In function 'str_stats': str.c:239: warning: format '%d' expects type 'int', but argument 3 has type 'size_t' str.c:239: warning: format '%d' expects type 'int', but argument 4 has type 'size_t' str.c:239: warning: format '%d' expects type 'int', but argument 5 has type 'long unsigned int' make[2]: *** [stunnel-str.o] Error 1 make[2]: Leaving directory `/tmp/stunnel-4.44/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/tmp/stunnel-4.44/src' make: *** [all-recursive] Error 1 Could you help me? Thanks for your help. Regards, Christophe

4 6

Why does verify=3 require the entire cert chain to be present in cafile?
by al_9x＠yahoo.com 03 Nov '11

03 Nov '11

If the leaf (server) cert is declared trusted (added to the cafile), there is no point in walking the trust chain.

5 15

[PATCH] Unix socket tunnelling
by Antoine Catton 02 Nov '11

02 Nov '11

Hi, I was looking for solution for tunneling a MySQL socket through encrypted IPv6. And I found this bunch of patches for stunnel <http://www.exceliance.fr/download/free/patches/stunnel/unix-sockets/>. Unfortunately, there's no patch for stunnel 4.44. So I rebased it in order to make it work (I attached it to this email). FYI, I’m not the author of this patch, I just adapted it for stunnel 4.44. The author seems to be this french company <http://www.exceliance.fr/en>. I just glanced over it, I didn't review it. Anyway, I think it would be a great thing to integrate it into stunnel in order to avoid rebasing the patch for every stunnel new version. Besides, it is a very useful feature. Integrating this patch would imply updating the documentation of stunnel configuration. As far as I know it add another general option “unix-sockets-dir” which is “/var/run/” by default. All the socket path must start by a slash, and this path will be appended to “unix-sockets-dir” option. Thank you. Regards, -- Antoine Catton Nexedi Intern

2 1

FD_MAX question
by Eckert, Doug 27 Oct '11

27 Oct '11

Greetings, We're using stunnel-4.15-2.el5.1 as provided on the RHEL 5 update 7 distro. Is there any way to override the FD_MAX setting (64 IIRC), perhaps as a stunnel.conf option? Doug Eckert Technical Architect Global Business & Technology Services Dow Jones | A News Corporation Company P.O. Box 300 | Princeton NJ 08543-0300 (W) 609.520.4993 (C) 732.666.3681 Email: doug.eckert(a)dowjones.com<mailto:[email protected]> [cid:[email protected]]

3 4

Re: [stunnel-users] Why does verify=3 require the entire cert chain to be present in cafile?
by Jochen Bern 26 Oct '11

26 Oct '11

On 10/25/2011 09:54 PM, al_9x(a)yahoo.com wrote: > verify=3 means checking is done against local certs. My point is that > if the actual server cert is stored locally (i.e. trusted) that should > be enough. When I put just the server cert in cafile validation (and > connection) fails, but when I put the whole chain, it succeeds. Why > isn't the server cert sufficient? Mostly guessing here, but: 1. stunnel uses the OpenSSL libraries. The verify(1) manpage says: "The verify program uses the same functions as the internal SSL and S/MIME verification, therefore this description applies to these verify operations too. [...] The verify operation consists of a number of separate steps. Firstly a certificate chain is built up starting from the supplied certificate and ending in the root CA. It is an error if the whole chain cannot be built up. The chain is built up by looking up the issuers certificate of the current certificate. If a certificate is found which is its own issuer it is assumed to be the root CA." -- http://www.openssl.org/docs/apps/verify.html#VERIFY_OPERATION So I'd guess that the algorithm you're at odds with is part of OpenSSL, rather than something stunnel can change. 2. Certificates are to be considered invalid once they have been revoked, and in order to check the CRL, you have to determine the issuing CA. Whose certificate has to be checked against its parent CA, etc. all the way to the Root CA. A "verification" mechanism which does not check for explicit revocation would have to be considered faulty for *most*, if not all, application cases - the fact that automated CRL checking is still pretty much absent in mechanisms which do not *mandate* a working Internet connection notwithstanding. 3. Since you're apparently trying to set up a point-to-point SSL connection with preconfigured direct trust, my guess would be that you'd be better off if the server would use a self-signed cert (either altogether, or in addition to the current one - say, on an additional port). However, since you never mentioned what kind of software you're trying to get to talk to each other, I'm at a loss suggesting *how* you might do that. Regards, J. Bern -- Jochen Bern, Systemingenieur --- LINworks GmbH <http://www.LINworks.de/> Postfach 100121, 64201 Darmstadt | Robert-Koch-Str. 9, 64331 Weiterstadt PGP (1024D/4096g) FP = D18B 41B1 16C0 11BA 7F8C DCF7 E1D5 FAF4 444E 1C27 Tel. +49 6151 9067-231, Zentr. -0, Fax -299 - Amtsg. Darmstadt HRB 85202 Unternehmenssitz Weiterstadt, Geschäftsführer Metin Dogan, Oliver Michel

2 2

Re: [stunnel-users] Why does verify=3 require the entire cert chain to be present in cafile?
by Jean-Yves F. Barbier 26 Oct '11

26 Oct '11

On Tue, 25 Oct 2011 15:54:26 -0400 al_9x(a)yahoo.com wrote: ... > verify=3 means checking is done against local certs. My point is that > if the actual server cert is stored locally (i.e. trusted) that should > be enough. When I put just the server cert in cafile validation (and > connection) fails, but when I put the whole chain, it succeeds. Why > isn't the server cert sufficient? Because the SVR cert is used to signed your own cert, this ensure liability between svr & cli; and if it was only the SVR cert, how could you revoke client by client? You would be obliged to revoke all clients at once - which doesn't look like a very good strategy if you've got 1000's of clients... -- You will be dead within a year.

3 2

stunnel 4.45 released
by Michal Trojnara 24 Oct '11

24 Oct '11

Dear Users, I have released version 4.45 of stunnel. The ChangeLog entry: Version 4.45, 2011.10.24, urgency: LOW: * New features - "protocol = proxy" support to send original client IP address to haproxy: http://haproxy.1wt.eu/download/1.5/doc/proxy-protocol.txt This requires accept-proxy bind option of haproxy 1.5-dev3 or later. - Added Win32 configuration reload without a valid configuration loaded. - Added compatibility with LTS OpenSSL versions 0.9.6 and 0.9.7. Some features are only available in OpenSSL 1.0.0 and later. * Performance optimizations - Use SSL_MODE_RELEASE_BUFFERS if supported by the OpenSSL library. - Libwrap helper processes are no longer started if libwrap is disabled in all sections of the configuration file. * Internal improvements - Protocol negotiation framework was rewritten to support additional code to be executed after SSL_accept()/SSL_connect(). - Handling of memory allocation errors was rewritten to gracefully terminate the process (thx to regenrecht for the idea). * Bugfixes - Fixed -l option handling in stunnel3 script (thx to Kai Gülzau). - Script to build default stunnel.pem was fixed (thx to Sebastian Kayser). - MinGW compilation script (mingw.mak) was fixed (thx to Jose Alf). - MSVC compilation script (vc.mak) was fixed. - A number of problems in WINSOCK error handling were fixed. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.45.tar.gz: cbce8279c1ba7a07bfefeb2e477f682bfd326519f8a7ed296e35210599898a2d Best regards, Mike

1 0

Check IP or Name of Client Or Server by Common Name
by Tigran Petrosyan 21 Oct '11

21 Oct '11

Hi all, I have made patch for stunnel-4.43. It helps you to switch on in the file of stunnell.conf new features, the option name is verify_peer. you can read more about it after patching, compiling and running the command "stunnel --help". The goal of this option to verify clients or servers "ip addreses or names of ip-addreses" with "Common name" of certificate. This option is very flexible and usable. It's possible to switch it of or use it as in field of global options and in service-level options. verify_peer = client_name | client_ip | remote_name | remote_ip -- Tigran Petrosyan

1 0

Attempting to debug slow stunnel connections
by Lamont Lucas 21 Oct '11

21 Oct '11

Hello stunnel-users, I've recently setup stunnel in front of haproxy to handle SSL connections. While it worked fine in testing, my simplistic benchmarks showed it unable to do more than 9 req/s, and as we turned some production traffic on, it appears that threads and connections quickly pile up and eventually timing out. I assume I've made some error in configuration, or there is something odd with my setup, as it appears stunnel has been benchmarked and performs well beyond what we're attempting here. I've read the FAQ and as much from the mailing list archives as I thought applicable, and I was unable to see any red flags or errors similar to what I'm seeing. If you don't mind, I'd like some help debugging the issue or pointers as to what else I could do to debug the issue. I've included details about my compile and configuration as well as the edited startup section from the debug (7) log. I compiled stunnel 4.44 with ./configure --disable-ipv6 --disable-libwrap --disable-fips. It's running on a different box than where it was compiled, but both machines should be identical. openssl version -a OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 built on: Thu Sep 3 14:22:06 EDT 2009 platform: linux-x86_64 options: bn(64,64) md2(int) rc4(ptr,int) des(idx,cisc,16,int) blowfish(ptr2) compiler: gcc -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DKRB5_MIT -I/usr/kerberos/include -DL_ENDIAN -DTERMIO -WallM OPENSSLDIR: "/etc/pki/tls" engines: dynamic stunnel.4.44 -version stunnel 4.44 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 Threading:PTHREAD SSL:ENGINE Auth:none Sockets:POLL,IPv4 Global options: debug = daemon.notice pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = ALL:!SSLv2:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH curve = prime256v1 session = 300 seconds sslVersion = TLSv1 for client, all for server stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none Here's my configuration file: sslVersion = all ciphers = RC4-MD5:HIGH:!aNULL:!SSLv2 options = NO_SSLv2 setuid = root setgid = haproxy pid = /var/run/stunnel.pid #socket = l:TCP_NODELAY=1 #socket = r:TCP_NODELAY=1 output = /var/log/stunnel.log debug = 7 [XXX] CAfile = /etc/stunnel/ca_chain.crt cert = /etc/stunnel/XXX.crt key = /etc/stunnel/XXX.key accept = 443 connect = 127.0.0.1:81 #xforwardedfor = yes #TIMEOUTclose = 5 #TIMEOUTbusy = 2 #TIMEOUTconnect = 2 #TIMEOUTidle = 2 (I was previously running 4.32 with the xforwardedfor patch, but to eliminate potential issues I've upgraded to the latest version, running stock without the patch, hence the commented out xforwardedfor option) here's the startup: 2011.10.01 12:18:38 LOG7[21868:47602610340864]: No limit detected for the number of clients 2011.10.01 12:18:38 LOG7[21868:47602610340864]: signal_pipe: FD=3 allocated (non-blocking mode) 2011.10.01 12:18:38 LOG7[21868:47602610340864]: signal_pipe: FD=4 allocated (non-blocking mode) 2011.10.01 12:18:38 LOG5[21868:47602610340864]: stunnel 4.44 on x86_64-unknown-linux-gnu platform 2011.10.01 12:18:38 LOG5[21868:47602610340864]: Compiled/running with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 2011.10.01 12:18:38 LOG5[21868:47602610340864]: Threading:PTHREAD SSL:ENGINE Auth:none Sockets:POLL,IPv4 2011.10.01 12:18:38 LOG5[21868:47602610340864]: Reading configuration from file /etc/stunnel/stunnel.conf 2011.10.01 12:18:38 LOG7[21868:47602610340864]: PRNG seeded successfully 2011.10.01 12:18:38 LOG6[21868:47602610340864]: Initializing SSL context for service XXX 2011.10.01 12:18:38 LOG4[21868:47602610340864]: Insecure file permissions on /etc/stunnel/XXX.key 2011.10.01 12:18:38 LOG7[21868:47602610340864]: Certificate: /etc/stunnel/XXX.crt 2011.10.01 12:18:38 LOG7[21868:47602610340864]: Certificate loaded 2011.10.01 12:18:38 LOG7[21868:47602610340864]: Key file: /etc/stunnel/XXX.key 2011.10.01 12:18:38 LOG7[21868:47602610340864]: Private key loaded 2011.10.01 12:18:38 LOG7[21868:47602610340864]: Could not load DH parameters from /etc/stunnel/XXX.crt 2011.10.01 12:18:38 LOG7[21868:47602610340864]: Using hardcoded DH parameters 2011.10.01 12:18:38 LOG7[21868:47602610340864]: DH initialized with 2048-bit key 2011.10.01 12:18:38 LOG7[21868:47602610340864]: SSL options set: 0x01000000 2011.10.01 12:18:38 LOG6[21868:47602610340864]: SSL context initialized 2011.10.01 12:18:38 LOG5[21868:47602610340864]: Configuration successful Later, I see logs more or less like this: 2011.10.01 12:41:44 LOG7[29902:1108293952]: str_stats: 0 block(s), 0 data byte(s), 0 control byte(s) 2011.10.01 12:41:43 LOG7[29902:1116580160]: Service XXX started 2011.10.01 12:41:44 LOG7[29902:1116580160]: Option TCP_NODELAY set on local socket 2011.10.01 12:41:44 LOG5[29902:1116580160]: Service XXX accepted connection from YYY1:50059 2011.10.01 12:41:44 LOG7[29902:1108363584]: SSL state (accept): SSLv3 write server done A 2011.10.01 12:41:43 LOG7[29902:47056920704000]: local socket: FD=184 allocated (non-blocking mode) 2011.10.01 12:41:44 LOG7[29902:1108363584]: SSL state (accept): SSLv3 flush data 2011.10.01 12:41:44 LOG7[29902:47056920704000]: Service XXX accepted FD=184 from YYY2:58131 2011.10.01 12:41:44 LOG3[29902:1108363584]: SSL_accept: Peer suddenly disconnected 2011.10.01 12:41:44 LOG7[29902:1108433216]: SSL state (accept): before/accept initialization 2011.10.01 12:41:44 LOG7[29902:47056920704000]: local socket: FD=11 allocated (non-blocking mode) 2011.10.01 12:41:44 LOG7[29902:47056920704000]: Service XXX accepted FD=11 from YYY3:49309 2011.10.01 12:41:44 LOG5[29902:1108363584]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2011.10.01 12:41:44 LOG7[29902:1108363584]: Service XXX finished (173 left) I see the thread count steadily increase: # ps -eLf |grep stun |wc -l 513 later: # ps -eLf |grep stun |wc -l 1020 (the FD ulimit for this proces is only 1024 currently, but that does not appear to be the limiting factor yet) It's almost like stunnel is only processing one connection at a time to the local destination port, which causes stunnel to build up a pile of waiting connections and eventually they start timing out. I've verified with nc and some local tests that the 127.0.0.1:81 port is picking up connections even under load, so I don't believe the issue is on the haproxy side. The firewall is set to allow all localhost connections and the 443 ports are configured the same as the port 80 ports which do hundreds of reqs a second, further ruling out firewall issues. Is there any setting I'm missing that would or wouldn't allow stunnel to process connect calls in parallel? Is there any additional debug information I can provide? Thank you for your time.

2 1

"connect_blocking"
by Maroon Brinks 21 Oct '11

21 Oct '11

Hi Everyone, I was hoping you could help. I cannot for the life of me get my program to connect through stunnel to this ip address. It appears to connect to stunnel just fine, however I constantly recieve: "connect_blocking" and I've found it very very hard to find information on the internet about this error. Here is the log output below followed by my configuration file: ####LOG#### 2011.10.19 09:49:56 LOG7[28234:139956427736816]: local socket: FD=8 allocated (non-blocking mode) 2011.10.19 09:49:56 LOG7[28234:139956427736816]: Service bgcssl accepted FD=8 from 127.0.0.1:58178 2011.10.19 09:49:56 LOG7[28234:139956427839760]: Service bgcssl started 2011.10.19 09:49:56 LOG7[28234:139956427839760]: Option TCP_NODELAY set on local socket 2011.10.19 09:49:56 LOG5[28234:139956427839760]: Service bgcssl accepted connection from 127.0.0.1:58178 2011.10.19 09:49:56 LOG7[28234:139956427839760]: remote socket: FD=9 allocated (non-blocking mode) 2011.10.19 09:49:56 LOG6[28234:139956427839760]: connect_blocking: connecting 148.106.128.90:7631 2011.10.19 09:49:56 LOG7[28234:139956427839760]: connect_blocking: s_poll_wait 148.106.128.90:7631: waiting 10 seconds 2011.10.19 09:50:06 LOG3[28234:139956427839760]: connect_blocking: s_poll_wait 148.106.128.90:7631: TIMEOUTconnect exceeded 2011.10.19 09:50:06 LOG5[28234:139956427839760]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2011.10.19 09:50:06 LOG7[28234:139956427839760]: Service bgcssl finished (0 left) 2011.10.19 09:50:06 LOG7[28234:139956427839760]: str_stats: 0 block(s), 0 data byte(s), 0 control byte(s) ####CONFIG FILE#### ; stunnel.conf pid = /home/stunnel/bin/stunnel.pid ;setuid = nobody ;setgid = nobody foreground = yes sslVersion = TLSv1 service = stunnel client = yes debug = 7 output = stunnel.log [bgcssl] client = yes accept = 127.0.0.1:12347 connect = 148.106.128.90:7631 Any help would be greatly appreciated. Regards, Mark

2 1

Indirect CRL Support
by Sligar, Benjamin 21 Oct '11

21 Oct '11

I have been working, over the past few weeks, with one of my developers, attempting to support Indirect CRL's through OpenSSL/Stunnel. My initial attempts were to support direct CRL, which seems to work fine with the compile options I've listed below for both OpenSSL and Stunnel. ./config --prefix=/u/publish/dev/openssl/openssl-1.0.0d no-idea no-mdc2 no-rc5 no-md2 no-sse2 ./configure --prefix=/usr/local/stunnel-4.44/ --with-ssl=/usr/local/openssl-1.0.0d/ Reading through the FAQ and general documentation, I'm not finding much useful information on how to enable iCRL support. It may be a simple compile option I'm missing, or perhaps I just didn't find the correct page on the site/documentation, yet. If anyone has any useful information, or can point me in the right direction, the help would be greatly appreciated. I can provide configuration files and logs if it's of any use in this. Thank you in advance for any help you may be able to provide! My search continues.... ************************* Benjamin Sligar Manager, Development Support P: 703.453.8324 US_DEV_Support(a)tnsi.com ************************* This e-mail message is for the sole use of the intended recipient(s)and may contain confidential and privileged information of Transaction Network Services. Any unauthorised review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

2 1

NETBIOS over stunnel
by Ronald RiemVis 18 Oct '11

18 Oct '11

Dear all, Stunnel work with all kind of other connections on both side but can't get working the NETBIOS negotiation with the net use command. send like: net use q: \\10.0.0.1\name password /user:username does not work when use net use q: \\10.0.0.1\name /user:username I get the question about password.At the end also will fail Because an ISP blocked all traffic over port 139 and my friend want to attach my external LAN drive (my book live) I need to redirect ports including the netbios protocol. I want: from a local loopback network adapter with IP address 10.0.0.1 port 139 to an external adddres port 1000 This is the configuration on the site where the my book live is connected: client = yes [MyBook] accept = 10.56.10.100:1000 (is my local address) connect = 10.56.10.10:139 (address of the my book live device) On the other side is the coinfiguration: client = yes [MyBook] accept = 10.0.0.1:139 (loopback addapter address) connect = remote address:1000 (external address) What can I do more to let it work? Greetings, Ronald

2 1

default ciphers in stunnel 4.43 vs. stunnel 4.33
by Brian Peterson 14 Oct '11

14 Oct '11

Hello, I recently upgraded stunnel from 4.33 to 4.43 and immediately noticed problems with a particular client trying to connect to my servers. It appears that the client only supports SSLv2 (about which I will be talking to the client developers). In reviewing the stunnel release notes, I find that "!SSLv2" was first added to the default ciphers value in 4.37 and was retained in the default ciphers value in 4.40. What I am trying to find out at this point is what the default cipher list would have been under 4.33. I have grep'd the sources and found STUNNEL_CIPHER_LIST in options.c for 4.43, but there is no corresponding default ciphers config in 4.33. It *appears* that 4.33 is inheriting its default ciphers from whatever the installed OpenSSL uses by default. Is that correct? If I set ciphers to "ALL" under 4.43 would the running stunnel be using the same cipher list as the 4.33 build we were running previously? Thanks, Brian P.S. - No need to discuss the wisdom of our cipher list at the moment... I just want to get this client functioning and then worry about The Right Thing To Do.

1 0

Why 6 processes for single client-mode service configuration?
by Grant Edwards 12 Oct '11

12 Oct '11

I'm configuring stunnel to encrypt a single client-mode connection: client = yes foreground = yes syslog = yes pid = [stunnel-localhost] accept = localhost:4608 connect = localhost:4606 Why does that result in _six_ stunnel processes? [one parent and 5 children]? It's going to look a ridiculous if I have four instances like that configured and end up with _24_ stunnel processes. I can see two processes (one for data flowing in each direction) but six seems way overboard. -- Grant Edwards grant.b.edwards Yow! I feel like a wet at parking meter on Darvon! gmail.com

3 7

Stunnel 4.44 sendproxy patch
by Mark Janssen 11 Oct '11

11 Oct '11

Hi, I've updated the sendproxy patch from (http://haproxy.1wt.eu/ and http://haproxy.1wt.eu/download/patches/stunnel-4.33-exceliance-aloha-sendpr…) to stunnel 4.44 I'd appreciate it if this patch would be included in stunnel proper. -- Mark Janssen -- maniac(at)maniac.nl Unix / Linux Open-Source and Internet Consultant Maniac.nl Sig-IO.nl Vps.Stoned-IT.com

1 0

stunnel 4.35 hangs on slackware64 13.37
by crocket 11 Oct '11

11 Oct '11

If I rotate stunnel logs with logrotate and have logrotate send SIGUSR1 signal to stunnel, stunnel doesn't close and reopen a new log and hangs. If I rotate stunnel logs and have logrotate send SIGHUP to stunnel, stunnel writes two lines to a new log but hangs after then. It could be a CPU problem because my D525 ATOM CPU had a problematic history with other programs. But I'm not sure of this. Can anybody else reproduce the problem?

1 1

problem with configure
by JOSE 05 Oct '11

05 Oct '11

I am trying to compile /stunnel-4.04 and I am having this problem with the configure exiting because opf something it can not set bash-3.2# export LD_LIBRARY_PATH=/lib/:/usr/lib/:/usr/local/lib/:/usr/local/lib/hpux32/:/usr/local/include/:/opt/gtk2.6/lib/:/opt/openssl/0.9.8/lib/ bash-3.2# ./configure checking for a BSD-compatible install... auto/install-sh -c checking whether build environment is sane... yes checking whether make sets ${MAKE}... yes checking for working aclocal... missing checking for working autoconf... missing checking for working automake... missing checking for working autoheader... missing checking for working makeinfo... missing checking build system type... ia64-hp-hpux11.31 checking host system type... ia64-hp-hpux11.31 checking for gcc... no checking for cc... cc checking for C compiler default output... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... no checking whether cc accepts -g... yes checking for a BSD-compatible install... auto/install-sh -c checking whether make sets ${MAKE}... (cached) yes checking for non-GNU ld... /usr/bin/ld checking if the linker (/usr/bin/ld) is GNU ld... no checking for /usr/bin/ld option to reload object files... -r checking for BSD-compatible nm... /usr/bin/nm -p checking whether ln -s works... yes checking how to recognise dependant libraries... file_magic (s[0-9][0-9][0-9]|PA-RISC[0-9].[0-9]) shared library checking command to parse /usr/bin/nm -p output... ok checking how to run the C preprocessor... cc -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking dlfcn.h usability... yes checking dlfcn.h presence... yes checking for dlfcn.h... yes checking for ranlib... ranlib checking for strip... strip checking for objdir... .libs checking for cc option to produce PIC... +Z checking if cc PIC flag +Z works... yes checking if cc static flag -Wl,-a -Wl,archive works... no checking if cc supports -c -o file.o... no checking if we can lock with hard links... yes checking whether the linker (/usr/bin/ld) supports shared libraries... yes checking how to hardcode library paths into programs... relink checking whether stripping libraries is possible... no checking dynamic linker characteristics... hpux11.31 dld.sl checking if libtool supports shared libraries... yes checking whether to build shared libraries... yes checking whether to build static libraries... no creating libtool checking for SSL directory... /usr checking for "/dev/urandom"... yes checking whether to disable RSA support... no checking whether to enable DH support... no checking for gethostbyname in -lnsl... yes checking for socket in -lsocket... no checking for pthread_create in -lpthread... yes checking for pthread_create in -lc_r... no checking for openpty in -lutil... no checking whether to use the libwrap (TCP wrappers) library... (default) checking for hosts_access in -lwrap... yes checking for RSAref library... no checking for "/dev/ptmx"... yes checking for "/dev/ptc"... no checking for unistd.h... (cached) yes checking sys/select.h usability... yes checking sys/select.h presence... yes checking for sys/select.h... yes checking tcpd.h usability... yes checking tcpd.h presence... yes checking for tcpd.h... yes checking pthread.h usability... yes checking pthread.h presence... yes checking for pthread.h... yes checking sys/ioctl.h usability... yes checking sys/ioctl.h presence... yes checking for sys/ioctl.h... yes checking util.h usability... no checking util.h presence... no checking for util.h... no checking pty.h usability... no checking pty.h presence... no checking for pty.h... no checking stropts.h usability... yes checking stropts.h presence... yes checking for stropts.h... yes checking sys/filio.h usability... no checking sys/filio.h presence... no checking for sys/filio.h... no checking sys/resource.h usability... yes checking sys/resource.h presence... yes checking for sys/resource.h... yes checking for snprintf... yes checking for vsnprintf... yes checking for openpty... no checking for _getpty... no checking for daemon... no checking for waitpid... yes checking for wait4... yes checking for sysconf... yes checking for getrlimit... yes checking for pthread_sigmask... yes checking for setgroups... yes checking for localtime_r... yes checking for chroot... yes checking for endhostent... yes checking for unsigned char... yes checking size of unsigned char... configure: error: cannot compute sizeof (unsigned char), 77 I've been reading around and this seems to be a problem with libiconv, but I have it installed, I have attached the configure.log for review bash-3.2# swlist -l product|grep -i lib Libiconv 1.6.1.16 Libiconv - Character set conversion library libiconv 1.12 libiconv I dont wkat else is missing, I am running this on HP-UX 11.31, I would appreciate in advance any help or hints, thanks folks Jose

1 0

Windows 7 64-bit
by Tracy Drake (QI-C) 02 Oct '11

02 Oct '11

Quick inquiry from a Stunnel dummie [?] Can you point me to any doc on compatibility of Stunnel with Windows 7 64-bit? Any particular version required? Any/all feedback is appreciated. -- Tracy Drake BI Senior Consultant GSA-FAS FAME Contractor URSA Support & Training Team Lead 704-987-1211 tracy.drake(a)gsa.gov

1 0

stunnel.exe stops connecting
by Mike Brazil 27 Sep '11

27 Sep '11

I'm running stunnel 4.44 for both POP3 and SMTP with my email client, Outlook Express, and my Spam filter, Cactus Spam. The OS is Win XP SP3. I have added the following to stunnel.conf: client = yes debug = debug [pop3s] accept = 127.0.0.1:11010 connect = camel.arvixe.com:995 [ssmtp] accept = 25 connect = camel.arvixe.com:465 Other than adding those lines, I've not changed anything in the rest of stunnel.conf as it comes with the program. When I boot the computer, Outlook Express, Cactus Spam, and stunnel all start and function correctly. However, after a period of time (a few hours -- I haven't yet pinned down whether there is a specific length to the time period), something goes wrong with stunnel, in that it stops communicating with Outlook Express, and it's CPU usage goes up to 25% (quad-core Intel CPU) and stays at that level indefinitely until I terminate the process. It is only the stunnel.exe process that is affected -- the service continues to run without error. I then restart stunnel.exe, and it works normally once again for a few hours. I usually become aware that stunnel has stopped connecting with Outlook Express when I come back to the computer after a few hours away from it, so I have so far been unable to see whether anything observable occurs when it gets into trouble or whether the length of time it ran properly varies or is constant. -- Mike Brazil mike(a)milibra.net

1 0

stunnel 4.44 - tools/Makefile $(ssldir) vs $(SSLDIR)
by Sebastian Kayser 27 Sep '11

27 Sep '11

Hi, I am building a recent stunnel version for Solaris via opencsw.org and with 4.44 it seems as if --with-ssl is used to AC_SUBST([SSLDIR]), yet tools/Makefile uses lowercase $(ssldir). Lead to an empty expansion and failed calls to openssl in my case. $ grep -i ssldir Makefile tools/Makefile Makefile:SSLDIR = /opt/csw tools/Makefile:SSLDIR = /opt/csw tools/Makefile:openssl = $(ssldir)/bin/openssl Sebastian

1 0

Certificates
by Cary Corse 17 Sep '11

17 Sep '11

I'm trying to use stunnel to connect to a secure server for syslogging. I have a certificate from the central logging server. How do I load this into stunnel so that I can connect? Cheers and thanks Cary

4 4

stunnel 4.44 released
by Michal Trojnara 17 Sep '11

17 Sep '11

Dear Users, I have released version 4.44 of stunnel. The ChangeLog entry: Version 4.44, 2011.09.17, urgency: MEDIUM: * New features - Major automake/autoconf cleanup. - Heap buffer overflow protection with canaries. - Stack buffer overflow protection with -fstack-protector. * Bugfixes - Fixed garbled error messages on errors with setuid/setgid options. - SNI fixes (thx to Alexey Drozdov). - Use after free in fdprintf() (thx to Alexey Drozdov). This issue might cause GPF with "protocol" or "ident" options. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.44.tar.gz: fa0dfc33f323abfbc94aa993d90d37481cd2f652ee93ec2f8c333ac7a496c7b9 Best regards, Mike

1 0

Goldmine 6.7 behind a Server
by Blake Miller 16 Sep '11

16 Sep '11

We are planning to transition our email service to Google Apps with our Goldmine 6.7 Corporate Edition so need to use Stunnel. We have Goldmine setup and run from a central Server and a shared/networked drive F: Each client machine runs Goldmine, BUT via the server path noted earlier. When logged in locally to the server and running Goldmine locally, everything works great. Stunnel is connected, we're able to send/receive email, etc. However from a remote machine, it doesn't work. Have tried installing stunnel on the local machine. Have tried accessing the said ports via the Server's IP address from within the network. And have hacked around different config setups without luck. Being a NOOB with Stunnel, we're at a loss with further configuration without literally 'hacking around' in the dark any further. Our config file is just below Thanks in advance. Blake ; **************************************************************************** * ; * Global Options * ; **************************************************************************** * ; Debugging stuff (may useful for troubleshooting) debug = 7 output = stunnel.log ; **************************************************************************** * ; * Service Defaults (may also be specified in individual service sections) * ; **************************************************************************** * ; Certificate/key is needed in server mode and optional in client mode cert = stunnel.pem ;key = stunnel.pem ; Authentication stuff needs to be configured to prevent MITM attacks ; It is not enabled by default! ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively CRLfile can be used ;CRLfile = crls.pem ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; The following options provide additional security at some performance penalty ; Default ECDH/DH parameters are strong/conservative, so it is quite safe to ; comment out these lines in order to get a performance boost options = SINGLE_ECDH_USE options = SINGLE_DH_USE ; **************************************************************************** * ; * Service Definitions (at least one service has to be defined) * ; **************************************************************************** * ; Example SSL server mode services ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 ; Example SSL client mode services [gmail-pop3] client = yes accept = 127.0.0.1:9995 connect = pop.gmail.com:995 [gmail-smtp] client = yes accept = 127.0.0.1:4465 connect = smtp.gmail.com:465 ;[gmail-imap] ;client = yes ;accept = 127.0.0.1:143 ;connect = imap.gmail.com:993 ; Certificate/key is needed in server mode and optional in client mode cert = stunnel.pem ;key = stunnel.pem

3 4

stunnel claims it needs certificate
by JOSE 14 Sep '11

14 Sep '11

Hi I am trying to get stunnel stunnel 4.36 on ia64-hp-hpux11.23 with OpenSSL 0.9.8o 01 Jun 2010 working on this server and so far I have generated a new pem file as per the instructions, but it is the time to make to run, it keeps looking for a certificate for one of the services: bash-3.2# /opt/iexpress/stunnel/bin/stunnel /opt/iexpress/stunnel/etc/stunnel/stunnel.conf Reading configuration from file /opt/iexpress/stunnel/etc/stunnel/stunnel.conf Snagged 64 random bytes from /opt/iexpress/stunnel/etc/stunnel/stunnel.rnd Wrote 1024 new random bytes to /opt/iexpress/stunnel/etc/stunnel/stunnel.rnd PRNG seeded successfully Line 37: End of section revnet_preprod_sunquest: SSL server needs a certificate my conf file is as follows: bash-3.2# more /opt/iexpress/stunnel/etc/stunnel/stunnel.conf # Sample stunnel configuration file #RNDfile=/opt/hpws/apache/stunnel/.stunnel.rnd RNDfile=/opt/iexpress/stunnel/etc/stunnel/stunnel.rnd # Chroot #chroot = /var/chroot/stunnel/ # PID is created inside chroot jail #pid = /opt/hpws/apache/logs/stunnel.pid pid = /opt/iexpress/stunnel/etc/stunnel/stunnel.pid # Workaround for Eudora bug #options = DONT_INSERT_EMPTY_FRAGMENTS # Client Authentication #verify = 2 # don't forget about c_rehash CApath # it is located inside chroot jail: #CApath = /certs # or simply use CAfile instead: #CAfile = /opt/hpws/apache/conf/certs.pem # Some debugging stuff debug = 7 output = /opt/hpws/apache/logs/stunnel.log # Use in client mode client = no # Run in the background foreground = no # Service-level configuration [revnet_preprod_sunquest] accept = 10.99.10.37:8011 connect = 127.0.0.1:18011 #connect = 18011 [revnet_preprod_funsun] accept = 10.99.10.37:8017 connect = 127.0.0.1:18017 #connect = 18017 any help or tips would be welcome Thanks Jose

2 2

netword.c & fdprintf access access violation fix
by Alexey Drozdov 12 Sep '11

12 Sep '11

Hi, all One more bug was found out at work stunnel through a proxy. There is a reference to already released memory in fdprintf function. Here a small fix of this situation: *** network.c 2011-09-07 20:46:19.000000000 +0400 --- network.c_patch 2011-09-12 23:52:46.015618574 +0400 *************** *** 766,771 **** --- 766,772 ---- int fdprintf(CLI *c, int fd, const char *format, ...) { va_list ap; char *line; + int outsize; va_start(ap, format); line=str_vprintf(format, ap); *************** *** 775,782 **** longjmp(c->err, 1); } fdputline(c, fd, line); str_free(line); ! return strlen(line)+2; } #define INET_SOCKET_PAIR --- 776,784 ---- longjmp(c->err, 1); } fdputline(c, fd, line); + outsize = strlen(line)+2; str_free(line); ! return outsize; } #define INET_SOCKET_PAIR / Alexey Drozdov

1 0

SNI and some troubles solving
by Alexey Drozdov 10 Sep '11

10 Sep '11

Hi All, At first I would like to thank Marzena Trojnara for the useful program! Occurrence of support SNI has especially interest. I have decided to use the given possibility, but have detect pair of bugs which has independently successfully solved. To begin with I dump part of my config: [virtual_server] accept = 443 connect = localhost:1081 cert = /usr/local/etc/stunnel/alexCA.crt key = /usr/local/etc/stunnel/alexCA.key ; need peer verification for default access verify = 2 CAfile = /usr/local/etc/stunnel/alexCA.crt ; use restricted access form some target services [socks5] sni = virtual_server:localhost sni = virtual_server:89.250.5.185 sni = virtual_server:127.0.0.1 sni = virtual_server:server cert = /usr/local/etc/stunnel/alexCA.crt key = /usr/local/etc/stunnel/alexCA.key verify = 2 CAfile = /usr/local/etc/stunnel/alexCA.crt connect = localhost:1081 ; public service [dreamhub_ru] sni = virtual_server:dreamhub.ru sni = virtual_server:pad.dreamhub.ru cert = /usr/local/etc/stunnel/dreamhub.cer key = /usr/local/etc/stunnel/dreamhub.pem connect = localhost:80 I want to use stunnel on 443rd port for ssl-socks5 service with peer certificates verification and use public https web-service (https://dreamhub.ru) And so it has appeared that value for "verify" are always used from global section (in my case [virtual_server]), and values of "verify" parameters from virtual services sections aren't used. Problem it has appeared that in the SNI check callback static int servername_cb(SSL *ssl, int *ad, void *arg) ... for(list=section->servername_list_head; list; list=list->next) if(!strcasecmp(servername, list->servername)) { c=SSL_get_ex_data(ssl, cli_index); c->opt=list->opt; SSL_set_SSL_CTX(ssl, c->opt->ctx); s_log(LOG_NOTICE, "SNI: switched to section %s", c->opt->servname); SSL_set_SSL_CTX(ssl, c->opt->ctx); does not copy ctx->verify_mode (SSL*)s->verify_mode=ctx->verify_mode; It has been solved by explicit calling SSL_set_verify *** ctx.c 2011-09-07 14:43:50.000000000 +0400 --- ctx.c_patched 2011-09-10 01:12:48.000000000 +0400 *************** *** 156,161 **** --- 156,162 ---- c=SSL_get_ex_data(ssl, cli_index); c->opt=list->opt; SSL_set_SSL_CTX(ssl, c->opt->ctx); + SSL_set_verify(ssl, SSL_CTX_get_verify_mode(c->opt->ctx), +NULL); s_log(LOG_NOTICE, "SNI: switched to section %s", c->opt->servname); #ifdef USE_LIBWRAP The second moment concerns uses stunnel as client through HTTPS a proxy (protocol=connect). All works perfectly, only it has appeared that value for SNI used from "connect" parameter instead of value of "protocolHost". On a code all is quite obvious: if(c->opt->host_name) { s_log(LOG_DEBUG, "SNI: host name: %s", c->opt->host_name); if(!SSL_set_tlsext_host_name(c->ssl, c->opt->host_name)) { sslerror("SSL_set_tlsext_host_name"); longjmp(c->err, 1); } } I solved it such: *** options.c 2011-09-07 20:38:56.000000000 +0400 --- options.c_patch 2011-09-10 16:34:56.882619049 +0400 *************** *** 695,700 **** --- 695,705 ---- s_log(LOG_INFO, "Cannot resolve '%s' - delaying DNS lookup", arg); section->option.delayed_lookup=1; } + + /* check - is host_name already filled */ + if (section->host_name != NULL) + return NULL; /* OK */ + tmpstr=strrchr(arg, ':'); if(tmpstr) { *tmpstr='\0'; *************** *** 1077,1082 **** --- 1082,1095 ---- if(strcasecmp(opt, "protocolHost")) break; section->protocol_host=str_dup_err(arg); + + /* Overwrite section->host_nam because of + protocolHost should be used for client SNI */ + tmpstr=strrchr(arg, ':'); + if(tmpstr) { + *tmpstr='\0'; + section->host_name=str_dup_err(arg); + } return NULL; /* OK */ case CMD_DEFAULT: break; I think that the given changes can be useful for other :) / Alexey Drozdov

2 1

SNI and some troubles solving
by Alexey Drozdov 10 Sep '11

10 Sep '11

Hi All, At first I would like to thank Marzena Trojnara for the useful program! Occurrence of support SNI has especially interest. I have decided to use the given possibility, but have detect pair of bugs which has independently successfully solved. To begin with I dump part of my config: [virtual_server] accept = 443 connect = localhost:1081 cert = /usr/local/etc/stunnel/alexCA.crt key = /usr/local/etc/stunnel/alexCA.key ; need peer verification for default access verify = 2 CAfile = /usr/local/etc/stunnel/alexCA.crt ; use restricted access form some target services [socks5] sni = virtual_server:localhost sni = virtual_server:89.250.5.185 sni = virtual_server:127.0.0.1 sni = virtual_server:server cert = /usr/local/etc/stunnel/alexCA.crt key = /usr/local/etc/stunnel/alexCA.key verify = 2 CAfile = /usr/local/etc/stunnel/alexCA.crt connect = localhost:1081 ; public service [dreamhub_ru] sni = virtual_server:dreamhub.ru sni = virtual_server:pad.dreamhub.ru cert = /usr/local/etc/stunnel/dreamhub.cer key = /usr/local/etc/stunnel/dreamhub.pem connect = localhost:80 I want to use stunnel on 443rd port for ssl-socks5 service with peer certificates verification and use public https web-service (https://dreamhub.ru) And so it has appeared that value for "verify" are always used from global section (in my case [virtual_server]), and values of "verify" parameters from virtual services sections aren't used. Problem it has appeared that in the SNI check callback static int servername_cb(SSL *ssl, int *ad, void *arg) ... for(list=section->servername_list_head; list; list=list->next) if(!strcasecmp(servername, list->servername)) { c=SSL_get_ex_data(ssl, cli_index); c->opt=list->opt; SSL_set_SSL_CTX(ssl, c->opt->ctx); s_log(LOG_NOTICE, "SNI: switched to section %s", c->opt->servname); SSL_set_SSL_CTX(ssl, c->opt->ctx); does not copy ctx->verify_mode (SSL*)s->verify_mode=ctx->verify_mode; It has been solved by explicit calling SSL_set_verify *** ctx.c 2011-09-07 14:43:50.000000000 +0400 --- ctx.c_patched 2011-09-10 01:12:48.000000000 +0400 *************** *** 156,161 **** --- 156,162 ---- c=SSL_get_ex_data(ssl, cli_index); c->opt=list->opt; SSL_set_SSL_CTX(ssl, c->opt->ctx); + SSL_set_verify(ssl, SSL_CTX_get_verify_mode(c->opt->ctx), +NULL); s_log(LOG_NOTICE, "SNI: switched to section %s", c->opt->servname); #ifdef USE_LIBWRAP The second moment concerns uses stunnel as client through HTTPS a proxy (protocol=connect). All works perfectly, only it has appeared that value for SNI used from "connect" parameter instead of value of "protocolHost". On a code all is quite obvious: if(c->opt->host_name) { s_log(LOG_DEBUG, "SNI: host name: %s", c->opt->host_name); if(!SSL_set_tlsext_host_name(c->ssl, c->opt->host_name)) { sslerror("SSL_set_tlsext_host_name"); longjmp(c->err, 1); } } I solved it such: *** options.c 2011-09-07 20:38:56.000000000 +0400 --- options.c_patch 2011-09-10 16:34:56.882619049 +0400 *************** *** 695,700 **** --- 695,705 ---- s_log(LOG_INFO, "Cannot resolve '%s' - delaying DNS lookup", arg); section->option.delayed_lookup=1; } + + /* check - is host_name already filled */ + if (section->host_name != NULL) + return NULL; /* OK */ + tmpstr=strrchr(arg, ':'); if(tmpstr) { *tmpstr='\0'; *************** *** 1077,1082 **** --- 1082,1095 ---- if(strcasecmp(opt, "protocolHost")) break; section->protocol_host=str_dup_err(arg); + + /* Overwrite section->host_nam because of + protocolHost should be used for client SNI */ + tmpstr=strrchr(arg, ':'); + if(tmpstr) { + *tmpstr='\0'; + section->host_name=str_dup_err(arg); + } return NULL; /* OK */ case CMD_DEFAULT: break; I think that the given changes can be useful for other :) / Alexey Drozdov

1 0

stunnel 4.43 released
by Michal Trojnara 08 Sep '11

08 Sep '11

Dear Users, I have released version 4.43 of stunnel. The ChangeLog entry: Version 4.43, 2011.09.07, urgency: MEDIUM: * New features - Updated Win32 DLLs for OpenSSL 1.0.0e. - Major optimization of the logging subsystem. Benchmarks indicate up to 15% performance improvement. * Bugfixes - Fixed WIN32 configuration file reload. - Fixed FORK and UCONTEXT threading models. - Corrected INSTALL.W32 file. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.43.tar.gz: 93a002d9e1652d7684756af75b44b00f99aa93574e8a5a2e69f88656221d5ce2 Best regards, Mike

2 1

SSL3_READ_BYTES:tlsv1 alert internal error
by Andrew Heuneman 07 Sep '11

07 Sep '11

Hello, We recently implemented Stunnel on Centos 5.6 for ssl offloading for our java application. The application has applets to communicate java objects over https to a tomcat server on the server side. We have it setup in front of our Alteon/Radware load balancer. This hardware load balancer is capable of ssl load balancing, but has produced a very specific packet reset that only presents itself in ssl processing. We decided to implement Stunnel in front of this load balancer to fix this problem. Ssl offloading was working great with Stunnel until we ran into Java 7. if I run any version of our applets on java 6 they work. If i run java 7 they do not work. I have tried googling and looking for this error but I have only found some references to SNI... is this correct? Is there anything I can do. Please forgive me if i have omitted any details I will be more than happy to include a packet capture or other details if needed. I compiled stunnel with the following options ./configure --disable-libwrap --bindir=/usr/sbin --sbindir=/usr/sbin --sysconfdir=/etc --with-ssl=/usr/local/ssl also i compiled OpenSSL 1.0.0d with the following ./Configure threads shared linux-generic64 stunnel -version No limit detected for the number of clients signal_pipe: FD=3 allocated (non-blocking mode) signal_pipe: FD=4 allocated (non-blocking mode) stunnel 4.42 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.0d 8 Feb 2011 Threading:PTHREAD SSL:ENGINE Auth:none Sockets:POLL,IPv6 stunnel 4.42 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.0d 8 Feb 2011 Threading:PTHREAD SSL:ENGINE Auth:none Sockets:POLL,IPv6 Global option defaults debug = daemon.notice pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level option defaults ciphers = ALL:!SSLv2:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH curve = prime256v1 session = 300 seconds sslVersion = TLSv1 for client, all for server stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none str_stats: 112 block(s), 4046 byte(s) stunnel.conf cert=/etc/stunnel/stunnel.pem debug=7 output=/var/log/stunnel.log socket=l:TCP_NODELAY=1 socket=r:TCP_NODELAY=1 [https] accept=0.0.0.0:443 connect=172.16.18.100:80 session = 300 TIMEOUTbusy = 300 TIMEOUTconnect = 10 TIMEOUTidle = 43200 client = no stunnel.log 2011.08.22 16:58:49 LOG7[438154:47689394220768]: Service https accepted FD=2 from 10.0.11.27:46830 2011.08.22 16:58:49 LOG7[438154:1104877888]: Service https started 2011.08.22 16:58:49 LOG7[438154:1104877888]: Option TCP_NODELAY set on local socket 2011.08.22 16:58:49 LOG5[438154:1104877888]: Service https accepted connection from 10.0.11.27:46830 2011.08.22 16:58:49 LOG7[438154:1104877888]: SSL state (accept): before/accept initialization 2011.08.22 16:58:49 LOG7[438154:1104877888]: SSL state (accept): SSLv3 read client hello A 2011.08.22 16:58:49 LOG7[438154:1104877888]: SSL state (accept): SSLv3 write server hello A 2011.08.22 16:58:49 LOG7[438154:1104877888]: SSL state (accept): SSLv3 write certificate A 2011.08.22 16:58:49 LOG7[438154:1104877888]: SSL state (accept): SSLv3 write key exchange A 2011.08.22 16:58:49 LOG7[438154:1104877888]: SSL state (accept): SSLv3 write certificate request A 2011.08.22 16:58:49 LOG7[438154:1104877888]: SSL state (accept): SSLv3 flush data 2011.08.22 16:58:49 LOG7[438154:1104877888]: SSL alert (read): fatal: internal error 2011.08.22 16:58:49 LOG3[438154:1104877888]: SSL_accept: 14094438: error:14094438:SSL routines:SSL3_READ_BYTES:tlsv1 alert internal error 2011.08.22 16:58:49 LOG5[438154:1104877888]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2011.08.22 16:58:49 LOG7[438154:1104877888]: Service https finished (1 left) 2011.08.22 16:58:49 LOG7[438154:1104877888]: str_stats: 0 block(s), 0 byte(s) 2011.08.22 16:59:01 LOG7[438154:1104947520]: Socket closed on read 2011.08.22 16:59:01 LOG7[438154:1104947520]: Sending SSL write shutdown 2011.08.22 16:59:01 LOG7[438154:1104947520]: SSL alert (write): warning: close notify 2011.08.22 16:59:01 LOG6[438154:1104947520]: SSL_shutdown successfully sent close_notify 2011.08.22 16:59:01 LOG7[438154:1104947520]: SSL alert (read): warning: close notify 2011.08.22 16:59:01 LOG7[438154:1104947520]: SSL closed on SSL_read 2011.08.22 16:59:01 LOG7[438154:1104947520]: Sending socket write shutdown 2011.08.22 16:59:01 LOG5[438154:1104947520]: Connection closed: 49445 bytes sent to SSL, 8175 bytes sent to socket -- Thank You, Andrew Heuneman Senior Systems Administrator Reading Plus®/Taylor Associates Helping students become proficient silent readers. <http://twitter.com/readingplus> <http://www.facebook.com/pages/Reading-Plus/165970877038>

2 1

Internal error after reload modified server mode section
by Javier 07 Sep '11

07 Sep '11

Hi, I didn't found this question, so I hope isn't duplicate. I'm using the latest stable 4.42 version and I'm running Windows 2000 and I want to ask is this is a normal behavior. What is happening is that, after change the server section in the config file (the rest are all client mode), if it has been any connection to that server (and only if it has been a connection), when I reload the modified conf, it gives...: INTERNAL ERROR: get_alloc_list_ptr: Bad magic str_stats: 380 block(s), 96684 byte(s) This happens after no errors in the load (except for DH being hardcoded), SSL context initialized Configuration successful after open every service (clients and server) and then, after the error, closes every service. Trying to reload the conf, doesn't nothing, just stunnel hangs (is not responding to reloads). The only way to restart all is to close stunnel and reopen. Then, the configuration is accepted without problems and works perfectly. This happens, as I said, after modify the conf file and if it was a connection. The section is related to a local test server, where I modify the IP and/or ports where to accept and where to connect. As general options I have: debug = debug delay = yes And the server section: [mySSL] client = no cert = mytestpem.pem accept = 127.0.0.1:443 connect = 127.0.0.1:80 What I'm doing wrong? Is the normal behavior? Is it a new bug? Regards, Javier.

3 5