- stunnel-users - stunnel.org

setting permissions on a unix socket
by David Mandelberg 03 Nov '21

03 Nov '21

Hi, Is there any way for stunnel to set permissions on a unix socket created with the `accept` option? I see setuid and setgid at https://www.stunnel.org/static/stunnel.html but nothing about a umask or permissions. P.S. The link on https://www.stunnel.org/lists.html to see the archive is broken. Apologies if this has come up before.

1 0

Stunnel connection to Akamai Cloud Servers (Hostheaders) with SNI
by Alan C. Bonnici 06 Oct '21

06 Oct '21

Hi, I am trying to use stunnel to exchange data with a service hosted on Akamai Servers. There is a need to implement SNI. In posts dated from 2016 which I found online, Stunnel did not support Host Headers. Is there a workaround, or has Stunnel implemented this functionality? I will be testing using postman. A sample config to get me going would really be appreciated. The URL is related to plivo. It is ak-api.plivo.com. Thank you in anticipation.

3 6

Is it possible to inhibit writing the stunnel logs to the / var / log / messages file?
by simona vittori 28 Sep '21

28 Sep '21

Hello, I ask you if it's possible to inhibit writing the stunnel logs to the / var / log / messages file. How do you it? Thank you in advance Bye Simona

2 1

Need a clean way to reject a client IP
by robin.kerdiles＠emanrisk.fr 28 Sep '21

28 Sep '21

Hello everyone, I'm doing a few tests on a dockerized service for stunnel under Alpine. stunnel -version stunnel 5.60 on x86_64-alpine-linux-musl platform Compiled with OpenSSL 1.1.1k 25 Mar 2021 Running with OpenSSL 1.1.1l 24 Aug 2021 Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI If I set a wrong certificate on client side, my server logs get spammed with these lines : 2021.09.28 07:43:52 LOG5[66]: Service [***] accepted connection from *** 2021.09.28 07:43:52 LOG4[66]: CERT: Pre-verification error: unable to get local issuer certificate 2021.09.28 07:43:52 LOG4[66]: Rejected by CERT at depth=2: C=***, O=***, CN=*** 2021.09.28 07:43:52 LOG3[66]: SSL_accept: ssl/statem/statem_srvr.c:3711: error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed 2021.09.28 07:43:52 LOG5[66]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket The cpu usage goes up to 35% and it seems there is no way to set a timeout before trying to reconnect on client side (which is not the perfect fix by the way). On server side, I don't know if we are supposed to be able to do something about that (for example rate limiting the requests ?). Even the fail2ban filter doesn't seem to support this case. And anyway it seems it requires manual patching on stunnel source code for the logs. Would it be possible to put on the same line the client IP and a message about the connection which has been rejected ? fail2ban filter : https://github.com/fail2ban/fail2ban/blob/master/config/filter.d/stunnel.co… What would be appreciated -> a log line in this format : 2021.09.28 07:43:52 LOG4[66]: HOST has been rejected by CERT at depth=2: C=***, O=***, CN=*** Of course, I don't have in mind the other possible cases (missing cert, etc...). Thank you in advance, Robin KERDILES

2 1

Disguising HTTP 503 services unavailable
by Haruka Takagi 18 Sep '21

18 Sep '21

It is my understanding that; stunnel clients give up connecting servers because of HTTP 503 services unavailable, tunneling failure causes stunnel clients to notify original senders of errors, and original senders acknowledge communication failure and stop program. I would like stunnel clients to reconnecting servers in cases of 503 and not to notify original senders of failure, in order that original senders are unaware of failure and can continue program. If possible, I want to do this by writing stunnel.conf without modifying souce codes. Is this configuration possible?

4 5

protocol = proxy with redirect
by Rob Hoes 15 Sep '21

15 Sep '21

Hi, I am using client certificate verification with the redirect option, so that the connection gets transferred to a separate socket in case the certificate is not accepted (rather than dropping the connection). This works well, unless I add the option “protocol = proxy” in order to get the client’s TCP params passed on. In this case, the redirect option seems to be ignored. Are the “redirect” and “protocol = proxy” options incompatible with one another? Is there an alternative? Thanks, Rob

2 1

How to resolve DNS by stunnel?
by shiga＠smart-cast.co.jp 14 Sep '21

14 Sep '21

Hi, I'm facing DNS issues when connecting to a server using a dynamic IP address. I think stunnel refers to DNS at startup, so if the IP address changes in the middle, it will get a connection error. Can this be resolved with the "delay=on" option? I'm looking for a way to handle a dynamic IP address in stunnel. Thanks.

2 1

Session reuse problem
by Alen Loncaric 10 Sep '21

10 Sep '21

Hi guys, any reason my stunnel would not reuse sessions? 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): before SSL initialization 2021.09.09 13:14:00 LOG6[8]: writesocket: Socket is closed 2021.09.09 13:14:00 LOG7[9]: Initializing application specific data for session authenticated 2021.09.09 13:14:00 LOG5[8]: Connection closed: 170 byte(s) sent to TLS, 32768 byte(s) sent to socket 2021.09.09 13:14:00 LOG7[8]: Remote descriptor (FD=10) closed 2021.09.09 13:14:00 LOG7[8]: Local descriptor (FD=3) closed 2021.09.09 13:14:00 LOG7[8]: Service [squid] finished 2021.09.09 13:14:00 LOG7[ui]: Found 1 ready file descriptor(s) 2021.09.09 13:14:00 LOG7[ui]: FD=4 events=0x1 revents=0x1 2021.09.09 13:14:00 LOG7[ui]: FD=10 events=0x1 revents=0x0 2021.09.09 13:14:00 LOG7[ui]: Dispatching a signal from the signal pipe 2021.09.09 13:14:00 LOG7[ui]: Processing SIGCHLD 2021.09.09 13:14:00 LOG7[ui]: Retrieving pid statuses with waitpid() 2021.09.09 13:14:00 LOG6[ui]: Process 1933 finished with code 0 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS write client hello 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS write client hello 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS read server hello 2021.09.09 13:14:00 LOG6[9]: Certificate verification disabled 2021.09.09 13:14:00 LOG6[9]: Certificate verification disabled 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS read server certificate 2021.09.09 13:14:00 LOG6[9]: Client certificate not requested 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS read server done 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS write client key exchange 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS write change cipher spec 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS write finished 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS write finished 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS read server session ticket 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS read change cipher spec 2021.09.09 13:14:00 LOG7[9]: TLS state (connect): SSLv3/TLS read finished 2021.09.09 13:14:00 LOG7[9]: New session callback 2021.09.09 13:14:00 LOG7[9]: Peer certificate was cached (2037 bytes) 2021.09.09 13:14:00 LOG6[9]: Session id: DC783240F69C6910A2F8B9829504840EF619E30A14FEA982C944FBFB6828555F 2021.09.09 13:14:00 LOG7[9]: 1 client connect(s) requested 2021.09.09 13:14:00 LOG7[9]: 1 client connect(s) succeeded 2021.09.09 13:14:00 LOG7[9]: 0 client renegotiation(s) requested 2021.09.09 13:14:00 LOG7[9]: 0 session reuse(s) 2021.09.09 13:14:00 LOG6[9]: TLS connected: new session negotiated 2021.09.09 13:14:00 LOG6[9]: TLSv1.2 ciphersuite: AES128-GCM-SHA256 (128-bit encryption) 2021.09.09 13:14:00 LOG3[9]: SSL_get_peer_tmp_key: Peer suddenly disconnected 2021.09.09 13:14:00 LOG7[9]: Compression: null, expansion: null 2021.09.09 13:14:01 LOG6[9]: Read socket closed (readsocket) 2021.09.09 13:14:01 LOG7[9]: Sending close_notify alert 2021.09.09 13:14:01 LOG6[9]: socket fd: Broken pipe (32) 2021.09.09 13:14:01 LOG7[9]: TLS alert (write): warning: close notify 2021.09.09 13:14:01 LOG6[9]: SSL_shutdown successfully sent close_notify alert 2021.09.09 13:14:01 LOG6[9]: writesocket: Socket is closed 2021.09.09 13:14:01 LOG5[9]: Connection closed: 170 byte(s) sent to TLS, 32768 byte(s) sent to socket 2021.09.09 13:14:01 LOG7[9]: Remote descriptor (FD=10) closed 2021.09.09 13:14:01 LOG7[9]: Local descriptor (FD=3) closed 2021.09.09 13:14:01 LOG7[9]: Service [squid] finished 2021.09.09 13:14:01 LOG7[ui]: Found 1 ready file descriptor(s) 2021.09.09 13:14:01 LOG7[ui]: FD=4 events=0x1 revents=0x1 2021.09.09 13:14:01 LOG7[ui]: FD=10 events=0x1 revents=0x0 2021.09.09 13:14:01 LOG7[ui]: Dispatching a signal from the signal pipe 2021.09.09 13:14:01 LOG7[ui]: Processing SIGCHLD 2021.09.09 13:14:01 LOG7[ui]: Retrieving pid statuses with waitpid() 2021.09.09 13:14:01 LOG6[ui]: Process 1934 finished with code 0 2021.09.09 13:14:03 LOG7[ui]: Found 1 ready file descriptor(s) 2021.09.09 13:14:03 LOG7[ui]: FD=4 events=0x1 revents=0x0 2021.09.09 13:14:03 LOG7[ui]: FD=10 events=0x1 revents=0x1 2021.09.09 13:14:03 LOG7[ui]: Service [squid] accepted (FD=3) from 127.0.0.1:49567 2021.09.09 13:14:03 LOG7[10]: Service [squid] started 2021.09.09 13:14:03 LOG7[10]: Setting local socket options (FD=3) 2021.09.09 13:14:03 LOG7[10]: Option TCP_NODELAY set on local socket 2021.09.09 13:14:03 LOG5[10]: Service [squid] accepted connection from 127.0.0.1:49567 2021.09.09 13:14:03 LOG6[10]: s_connect: connecting 44.44.44.44:522 2021.09.09 13:14:03 LOG7[10]: s_connect: s_poll_wait 44.44.44.44:522: waiting 10 seconds 2021.09.09 13:14:03 LOG7[10]: FD=6 events=0x1 revents=0x0 2021.09.09 13:14:03 LOG7[10]: FD=10 events=0x5 revents=0x0 2021.09.09 13:14:03 LOG5[10]: s_connect: connected 44.44.44.44:522 2021.09.09 13:14:03 LOG5[10]: Service [squid] connected remote server from 10.1.3.57:42843 2021.09.09 13:14:03 LOG7[10]: Setting remote socket options (FD=10) 2021.09.09 13:14:03 LOG7[10]: Option TCP_NODELAY set on remote socket 2021.09.09 13:14:03 LOG7[10]: Remote descriptor (FD=10) initialized 2021.09.09 13:14:03 LOG6[10]: SNI: sending servername: 44.44.44.44 2021.09.09 13:14:03 LOG6[10]: Peer certificate not required 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): before SSL initialization 2021.09.09 13:14:03 LOG7[10]: Initializing application specific data for session authenticated 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS write client hello 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS write client hello 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS read server hello 2021.09.09 13:14:03 LOG6[10]: Certificate verification disabled 2021.09.09 13:14:03 LOG6[10]: Certificate verification disabled 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS read server certificate 2021.09.09 13:14:03 LOG6[10]: Client certificate not requested 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS read server done 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS write client key exchange 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS write change cipher spec 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS write finished 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS write finished 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS read server session ticket 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS read change cipher spec 2021.09.09 13:14:03 LOG7[10]: TLS state (connect): SSLv3/TLS read finished 2021.09.09 13:14:03 LOG7[10]: New session callback 2021.09.09 13:14:03 LOG7[10]: Peer certificate was cached (2037 bytes) 2021.09.09 13:14:03 LOG6[10]: Session id: 85FD50E2A9D57B12D315C834EBA949CF015B7776C6A18486B06CE53F4C52D689 2021.09.09 13:14:03 LOG7[10]: 1 client connect(s) requested 2021.09.09 13:14:03 LOG7[10]: 1 client connect(s) succeeded 2021.09.09 13:14:03 LOG7[10]: 0 client renegotiation(s) requested 2021.09.09 13:14:03 LOG7[10]: 0 session reuse(s) 2021.09.09 13:14:03 LOG6[10]: TLS connected: new session negotiated 2021.09.09 13:14:03 LOG6[10]: TLSv1.2 ciphersuite: AES128-GCM-SHA256 (128-bit encryption) 2021.09.09 13:14:03 LOG3[10]: SSL_get_peer_tmp_key: Peer suddenly disconnected 2021.09.09 13:14:03 LOG7[10]: Compression: null, expansion: null 2021.09.09 13:14:03 LOG7[ui]: Found 1 ready file descriptor(s) 2021.09.09 13:14:03 LOG7[ui]: FD=4 events=0x1 revents=0x0 2021.09.09 13:14:03 LOG7[ui]: FD=10 events=0x1 revents=0x1 2021.09.09 13:14:03 LOG7[ui]: Service [squid] accepted (FD=3) from 127.0.0.1:49569 2021.09.09 13:14:03 LOG7[11]: Service [squid] started 2021.09.09 13:14:03 LOG7[11]: Setting local socket options (FD=3) 2021.09.09 13:14:03 LOG7[11]: Option TCP_NODELAY set on local socket 2021.09.09 13:14:03 LOG5[11]: Service [squid] accepted connection from 127.0.0.1:49569 2021.09.09 13:14:03 LOG6[11]: s_connect: connecting 44.44.44.44:522 2021.09.09 13:14:03 LOG7[11]: s_connect: s_poll_wait 44.44.44.44:522: waiting 10 seconds 2021.09.09 13:14:03 LOG7[11]: FD=6 events=0x1 revents=0x0 2021.09.09 13:14:03 LOG7[11]: FD=10 events=0x5 revents=0x0 2021.09.09 13:14:03 LOG5[11]: s_connect: connected 44.44.44.44:522 2021.09.09 13:14:03 LOG5[11]: Service [squid] connected remote server from 10.1.3.57:42845 2021.09.09 13:14:03 LOG6[10]: Read socket closed (readsocket) 2021.09.09 13:14:03 LOG7[11]: Setting remote socket options (FD=10) 2021.09.09 13:14:03 LOG7[11]: Option TCP_NODELAY set on remote socket 2021.09.09 13:14:03 LOG7[11]: Remote descriptor (FD=10) initialized 2021.09.09 13:14:03 LOG7[10]: Sending close_notify alert 2021.09.09 13:14:03 LOG6[11]: SNI: sending servername: 44.44.44.44 2021.09.09 13:14:03 LOG6[10]: socket fd: Broken pipe (32) 2021.09.09 13:14:03 LOG6[11]: Peer certificate not required 2021.09.09 13:14:03 LOG7[10]: TLS alert (write): warning: close notify 2021.09.09 13:14:03 LOG6[10]: SSL_shutdown successfully sent close_notify alert 2021.09.09 13:14:03 LOG6[10]: writesocket: Socket is closed 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): before SSL initialization2021.09.09 13:14:03 LOG5[10]: Connection closed: 170 byte(s) sent to TLS, 32768 byte(s) sent to socket 2021.09.09 13:14:03 LOG7[11]: Initializing application specific data for session authenticated 2021.09.09 13:14:03 LOG7[10]: Remote descriptor (FD=10) closed 2021.09.09 13:14:03 LOG7[10]: Local descriptor (FD=3) closed 2021.09.09 13:14:03 LOG7[10]: Service [squid] finished 2021.09.09 13:14:03 LOG7[ui]: Found 1 ready file descriptor(s) 2021.09.09 13:14:03 LOG7[ui]: FD=4 events=0x1 revents=0x1 2021.09.09 13:14:03 LOG7[ui]: FD=10 events=0x1 revents=0x0 2021.09.09 13:14:03 LOG7[ui]: Dispatching a signal from the signal pipe 2021.09.09 13:14:03 LOG7[ui]: Processing SIGCHLD 2021.09.09 13:14:03 LOG7[ui]: Retrieving pid statuses with waitpid() 2021.09.09 13:14:03 LOG6[ui]: Process 1937 finished with code 0 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS write client hello 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS write client hello 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS read server hello 2021.09.09 13:14:03 LOG6[11]: Certificate verification disabled 2021.09.09 13:14:03 LOG6[11]: Certificate verification disabled 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS read server certificate 2021.09.09 13:14:03 LOG6[11]: Client certificate not requested 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS read server done 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS write client key exchange 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS write change cipher spec 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS write finished 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS write finished 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS read server session ticket 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS read change cipher spec 2021.09.09 13:14:03 LOG7[11]: TLS state (connect): SSLv3/TLS read finished 2021.09.09 13:14:03 LOG7[11]: New session callback 2021.09.09 13:14:03 LOG7[11]: Peer certificate was cached (2037 bytes) 2021.09.09 13:14:03 LOG6[11]: Session id: B171BF0D4CDB808D50C3CE4CDAA6AE53F2396068A9BD947D8277294F91CCFBFE 2021.09.09 13:14:03 LOG7[11]: 1 client connect(s) requested 2021.09.09 13:14:03 LOG7[11]: 1 client connect(s) succeeded 2021.09.09 13:14:03 LOG7[11]: 0 client renegotiation(s) requested 2021.09.09 13:14:03 LOG7[11]: 0 session reuse(s) 2021.09.09 13:14:03 LOG6[11]: TLS connected: new session negotiated 2021.09.09 13:14:03 LOG6[11]: TLSv1.2 ciphersuite: AES128-GCM-SHA256 (128-bit encryption) 2021.09.09 13:14:03 LOG3[11]: SSL_get_peer_tmp_key: Peer suddenly disconnected 2021.09.09 13:14:03 LOG7[11]: Compression: null, expansion: null 2021.09.09 13:14:03 LOG6[11]: Read socket closed (readsocket) 2021.09.09 13:14:03 LOG7[11]: Sending close_notify alert 2021.09.09 13:14:03 LOG6[11]: socket fd: Broken pipe (32) 2021.09.09 13:14:03 LOG7[11]: TLS alert (write): warning: close notify 2021.09.09 13:14:03 LOG6[11]: SSL_shutdown successfully sent close_notify alert 2021.09.09 13:14:03 LOG6[11]: writesocket: Socket is closed 2021.09.09 13:14:03 LOG5[11]: Connection closed: 170 byte(s) sent to TLS, 32768 byte(s) sent to socket 2021.09.09 13:14:03 LOG7[11]: Remote descriptor (FD=10) closed 2021.09.09 13:14:03 LOG7[11]: Local descriptor (FD=3) closed 2021.09.09 13:14:03 LOG7[11]: Service [squid] finished 2021.09.09 13:14:03 LOG7[ui]: Found 1 ready file descriptor(s) 2021.09.09 13:14:03 LOG7[ui]: FD=4 events=0x1 revents=0x1 2021.09.09 13:14:03 LOG7[ui]: FD=10 events=0x1 revents=0x0 2021.09.09 13:14:03 LOG7[ui]: Dispatching a signal from the signal pipe 2021.09.09 13:14:03 LOG7[ui]: Processing SIGCHLD 2021.09.09 13:14:03 LOG7[ui]: Retrieving pid statuses with waitpid() 2021.09.09 13:14:03 LOG6[ui]: Process 1938 finished with code 0 If i test with s_client: openssl s_client -connect 44.44.44.44:522 -reconnect I see TLS reused every time. Thank you!

1 0

stunnel logfile and setuid/setgid
by Norbert Hanke 02 Sep '21

02 Sep '21

Hi, I'm new to this list and hope I don't raise a question that has been raised many times before. I searched the archive and couldn't find that discussed previously... I want to configure stunnel using setuid = nobody setgid = nobody while having it write its output to its own logfile, not using syslog, with output = /var/log/stunnel.log log = append syslog = no This works when user nobody has write-access to an existing logfile, or user nobody is allowed to create the file in the directory. Both is not a good idea: user nobody should not have write access there. I could limit potential damage by having a separate directory with such access to nobody, but that is still kind of wrong. Or I could create a separate user only for stunnel and give that user full access to a separate directory: that would be more secure, only a hijacked (hopefully not) stunnel could tamper with its own logfiles. Shouldn't stunnel create and/or open the logfile while it is still running as root, and only then switch to user nobody? Or is there an option that I did not see so far allowing for what I'm trying? Thanks for any help. Regards, Norbert

1 0

Stunnel 5.60 started via Stunnel TLS wrapper on Windows 10 machine doesn't seem to be working
by ling＠aliko.com 01 Sep '21

01 Sep '21

Hi, I am trying to get Stunnel 5.60 started automatically as a service. My stunnel.conf is stored under C:\Program Files (x86)\stunnel\config works fine if I run stunnel.exe manually from CMD or bring up the GUI and reload configuration. Now I would like it to start automatically after reboots. I tried running stunnel.exe -install which installs the Stunnel TLS wrapper service. Starting the service does not however do anything. The "Path to execute" it installs for the service is "C:\Program Files (x86)\stunnel\config" -service -install. I don't see anything in the log. I can see that the stunnel.exe process is running in task manager. But running netstat -ao shows that no port is being listened to by the PID. Tried removing my stunnel.conf file and the service will still starts but stunnel doesn't seem to be doing anything. What could be the problem?

2 2

Minor bugfix: parameter type
by Peter Pentchev 19 Aug '21

19 Aug '21

Hi, Thanks a lot for the continued development of stunnel! While checking whether my Debian packages can be built with the upcoming GCC 11, I found (or rather, GCC reported) a minor discrepancy in the type of the "hash" parameter to the crypt_DES() function in protocol.c. What do you think about the attached patch? It is also available at: https://salsa.debian.org/debian/stunnel/-/blob/master/debian/patches/06-des… Thanks again, and keep up the great work! G'luck, Peter -- Peter Pentchev roam(a)ringlet.net roam(a)debian.org pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

1 0

stunnel 60 released
by Michał Trojnara 16 Aug '21

16 Aug '21

Dear Users, I have released version 5.60 of stunnel. ### Version 5.60, 2021.08.16, urgency: LOW * New features - New 'sessionResume' service-level option to allow or disallow session resumption - Added support for the new SSL_set_options() values. - Download fresh ca-certs.pem for each new release. * Bugfixes - Fixed 'redirect' with 'protocol'. This combination is not supported by 'smtp', 'pop3' and 'imap' protocols. - Enforced minimum WIN32 log window size. - Fixed support for password-protected private keys with OpenSSL 3.0 (thx to Dmitry Belyavskiy). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: c45d765b1521861fea9b03b425b9dd7d48b3055128c0aec673bba5ef9b8f787d stunnel-5.60.tar.gz 190b79cb94a4f70f362e44c32d150edf8ae660734d3fa0cbd990c3821e8f3083 stunnel-5.60-win64-installer.exe bac9bb4503cc5091d78c9deb6aa013fc07e39d67db0dfcc073b098db52f54427 stunnel-5.60-android.zip Best regards, Mike

1 0

Is it possible to tunnel all tcp sessions of docker containers
by Yichun Ding 15 Aug '21

15 Aug '21

Hi, We are looking for the possibility to encrypt all the tcp sessions of containers between hosts with stunnel. So far I had no luck to come up with an iptables rule to route the packets to stunnel running on the host. We cannot change the container code as there are too many of them. Any advice would be appreciated! -yd

1 0

stunnel ignores chroot /etc/hosts
by kmx1818＠gmail.com 10 Aug '21

10 Aug '21

Hello all! On my localhost I've got a java 1.4 tls1.0 app/service running, which is hard-coded to http-call a soap service (tls1.0 level too) running on a remote host, say, svchost. Host resolution is "files" only (ie /etc/hosts) - no dns. The aim is to make this java client tls1.2-compliant. My solution is: 1/ configure svchost to be (an alias of) localhost - in global /etc/hosts 127.0.0.1 localhost svchost 2/ configure a chroot env for stunell with its own /etc/hosts 1.2.3.4 svchost (needless to say that to make it work I had to copy /etc's nsswitch.conf resolv.conf, a bunch of libraries, esp libnsl and nsl_files etc, and create another lot of /dev entries) I've tested it with the native getent command: $ getent hosts svchost 127.0.0.1 $ chroot /var/run/stunnel/chroot getent hosts svchost 1.2.3.4 3/ run stunnel in chroot mode: # /opt/csw/bin/stunnel -version stunnel 5.59 on sparc-sun-solaris2.10 platform Compiled/running with OpenSSL 1.0.2u 20 Dec 2019 ; for tls1 clients client = yes sslVersion = TLSv1.2 delay = yes chroot = /var/run/stunnel/chroot [tls12] accept = localhost:80 connect = svchost:443 ; Alas, stunnel still resolves svchost from the global /etc/hosts - not from chroot's!: $ curl -kL http://svchost/service curl: (52) Empty reply from server ...and in /var/adm/messages: …LOG[4]: Service [tls12] accepted connection from 127.0.0.1:47944 …LOG[4]: s_connect: connecting 127.0.0.1:443 …LOG[4]: s_connect: s_poll_wait 127.0.0.1:443: waiting 10 seconds …LOG[4]: s_connect: connect 127.0.0.1:443: Connection refused (146) …LOG[4]: No more addresses to connect I've tried foreground yes/no, truss/strace - nothing useful... What am I missing!? Thank you in advance!

2 2

Unexpected socket close while sending mail
by zfefm＠gmx.de 27 Jul '21

27 Jul '21

Hi, since several days I try to get stunnel working to add TLS1.2 or higher support to my outdated email client program (Applemail 4.6) as my service provider will stop supporting the old protocols soon. The protocol of stunnel looks as if the connection gets established well. But as soon I want to send a mail my mail program tries for 10-15s to send an then gives up. In the stunnel protocol (time stamp 16:54:22) the server seems to accept the connection, but about 10-15s later I get: Unexpected socket close (s_read) Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket Any ideas what could be the problem? Thanks. conf and protocol attached. conf: setuid = nobody setgid = nogroup foreground = yes debug = 7 output = /usr/local/etc/stunnel/stunnel.log [strato-pop3] client = yes verifyChain = yes accept = 127.0.0.1:110 connect = pop3.strato.de:995 CApath = /usr/local/etc/stunnel/ cert = /usr/local/etc/stunnel/stunnel.pem checkHost = pop3.strato.de protocol = pop3 [strato-smtp] client = yes verifyChain = yes accept = 127.0.0.1:25 connect = smtp.strato.de:465 checkHost = smtp.strato.de CApath = /usr/local/etc/stunnel/ cert = /usr/local/etc/stunnel/stunnel.pem protocol = smtp protocol : 2021.07.22 16:53:49 LOG6[ui]: Initializing inetd mode configuration 2021.07.22 16:53:49 LOG7[ui]: Clients allowed=125 2021.07.22 16:53:49 LOG5[ui]: stunnel 5.59 on x86_64-apple-darwin10.8.0 platform 2021.07.22 16:53:49 LOG5[ui]: Compiled/running with OpenSSL 1.1.1k 25 Mar 2021 2021.07.22 16:53:49 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI Auth:LIBWRAP 2021.07.22 16:53:49 LOG7[ui]: errno: (*__error()) 2021.07.22 16:53:49 LOG6[ui]: Initializing inetd mode configuration 2021.07.22 16:53:49 LOG5[ui]: Reading configuration from file /usr/local/etc/stunnel/stunnel.conf 2021.07.22 16:53:49 LOG5[ui]: UTF-8 byte order mark detected 2021.07.22 16:53:49 LOG5[ui]: FIPS mode disabled 2021.07.22 16:53:49 LOG6[ui]: Compression enabled: 0 methods 2021.07.22 16:53:49 LOG7[ui]: No PRNG seeding was required 2021.07.22 16:53:49 LOG6[ui]: Initializing service [strato-pop3] 2021.07.22 16:53:49 LOG6[ui]: stunnel default security level set: 2 2021.07.22 16:53:49 LOG7[ui]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2021.07.22 16:53:49 LOG7[ui]: TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 2021.07.22 16:53:49 LOG7[ui]: TLS options: 0x02100004 (+0x00000000, -0x00000000) 2021.07.22 16:53:49 LOG6[ui]: Loading certificate from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:49 LOG6[ui]: Certificate loaded from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:49 LOG6[ui]: Loading private key from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:49 LOG6[ui]: Private key loaded from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:49 LOG7[ui]: Private key check succeeded 2021.07.22 16:53:49 LOG6[ui]: DH initialization skipped: client section 2021.07.22 16:53:49 LOG7[ui]: ECDH initialization 2021.07.22 16:53:49 LOG7[ui]: ECDH initialized with curves X25519:P-256:X448:P-521:P-384 2021.07.22 16:53:49 LOG6[ui]: Initializing service [strato-smtp] 2021.07.22 16:53:50 LOG6[ui]: stunnel default security level set: 2 2021.07.22 16:53:50 LOG7[ui]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2021.07.22 16:53:50 LOG7[ui]: TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256 2021.07.22 16:53:50 LOG7[ui]: TLS options: 0x02100004 (+0x00000000, -0x00000000) 2021.07.22 16:53:50 LOG6[ui]: Loading certificate from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:50 LOG6[ui]: Certificate loaded from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:50 LOG6[ui]: Loading private key from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:50 LOG6[ui]: Private key loaded from file: /usr/local/etc/stunnel/stunnel.pem 2021.07.22 16:53:50 LOG7[ui]: Private key check succeeded 2021.07.22 16:53:50 LOG6[ui]: DH initialization skipped: client section 2021.07.22 16:53:50 LOG7[ui]: ECDH initialization 2021.07.22 16:53:50 LOG7[ui]: ECDH initialized with curves X25519:P-256:X448:P-521:P-384 2021.07.22 16:53:50 LOG5[ui]: Configuration successful 2021.07.22 16:53:50 LOG7[ui]: Deallocating deployed section defaults 2021.07.22 16:53:50 LOG7[ui]: Binding service [strato-pop3] 2021.07.22 16:53:50 LOG7[ui]: Listening file descriptor created (FD=8) 2021.07.22 16:53:50 LOG7[ui]: Setting accept socket options (FD=8) 2021.07.22 16:53:50 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2021.07.22 16:53:50 LOG6[ui]: Service [strato-pop3] (FD=8) bound to 127.0.0.1:110 2021.07.22 16:53:50 LOG7[ui]: Binding service [strato-smtp] 2021.07.22 16:53:50 LOG7[ui]: Listening file descriptor created (FD=10) 2021.07.22 16:53:50 LOG7[ui]: Setting accept socket options (FD=10) 2021.07.22 16:53:50 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2021.07.22 16:53:50 LOG6[ui]: Service [strato-smtp] (FD=10) bound to 127.0.0.1:25 2021.07.22 16:53:50 LOG7[ui]: No pid file being created 2021.07.22 16:53:50 LOG7[cron]: Cron thread initialized 2021.07.22 16:53:50 LOG6[cron]: Executing cron jobs 2021.07.22 16:53:50 LOG6[cron]: Cron jobs completed in 0 seconds 2021.07.22 16:53:50 LOG7[cron]: Waiting 86400 seconds 2021.07.22 16:54:22 LOG7[ui]: Found 1 ready file descriptor(s) 2021.07.22 16:54:22 LOG7[ui]: FD=4 events=0x1 revents=0x0 2021.07.22 16:54:22 LOG7[ui]: FD=8 events=0x1 revents=0x1 2021.07.22 16:54:22 LOG7[ui]: FD=10 events=0x1 revents=0x0 2021.07.22 16:54:22 LOG7[ui]: Service [strato-pop3] accepted (FD=3) from 127.0.0.1:49864 2021.07.22 16:54:22 LOG7[0]: Service [strato-pop3] started 2021.07.22 16:54:22 LOG7[0]: Setting local socket options (FD=3) 2021.07.22 16:54:22 LOG7[0]: Option TCP_NODELAY set on local socket 2021.07.22 16:54:22 LOG5[0]: Service [strato-pop3] accepted connection from 127.0.0.1:49864 2021.07.22 16:54:22 LOG6[0]: s_connect: connecting 81.169.145.131:995 2021.07.22 16:54:22 LOG7[0]: s_connect: s_poll_wait 81.169.145.131:995: waiting 10 seconds 2021.07.22 16:54:22 LOG7[0]: FD=6 events=0x1 revents=0x0 2021.07.22 16:54:22 LOG7[0]: FD=13 events=0x5 revents=0x0 2021.07.22 16:54:22 LOG5[0]: s_connect: connected 81.169.145.131:995 2021.07.22 16:54:22 LOG5[0]: Service [strato-pop3] connected remote server from 192.168.17.130:49865 2021.07.22 16:54:22 LOG7[0]: Setting remote socket options (FD=13) 2021.07.22 16:54:22 LOG7[0]: Option TCP_NODELAY set on remote socket 2021.07.22 16:54:22 LOG7[0]: Remote descriptor (FD=13) initialized 2021.07.22 16:55:22 LOG3[0]: Unexpected socket close (s_read) 2021.07.22 16:55:22 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2021.07.22 16:55:22 LOG7[0]: Remote descriptor (FD=13) closed 2021.07.22 16:55:22 LOG7[0]: Local descriptor (FD=3) closed 2021.07.22 16:55:22 LOG7[0]: Service [strato-pop3] finished (0 left) 2021.07.22 16:55:22 LOG7[0]: str_stats: 1 block(s), 32 data byte(s), 90 control byte(s) 2021.07.22 16:55:22 LOG7[0]: str_stats: 32 byte(s) at network.c:735

2 3

Equivalence of verify=2
by Yann RESCOURIO 22 Jul '21

22 Jul '21

Hello I would like to authenticate a server with only its CA file. What is the equivalence of verify=2 ? requireCert = yes verifyChain = no verifyPeer = yes Regards Yann

3 5

idea: linux stunnel mini-GUI
by Dmitry Bakshaev 13 Jul '21

13 Jul '21

we need start stunnel on linux desktop by ordinary user (like on windows): 1 click stunnel icon on system menu 2 enter user certificate password 3 use opened tunnels with users applications 4 on desktop session ends close all tunnels make XDG menu entry file: [Desktop Entry] Type=Application Name=stunnel Categories=Network; GenericName=TLS/SSL - Port Wrapper Comment[ru_RU]=Секретный туннель Icon=stunnel Exec=/usr/bin/stunnel Terminal=true X-KeepTerminal=true but only problem is how stunnel react on signals: HUP is daemon's "reload config". in X-session HUP signal is "session end" and stunnel is not exited on closing terminal or logout. attached patch change this behavior: if "foreground=yes" specified in stunnel.conf HUP signal is treated as TERM and stunnel exited. foreground=yes is "debug" or "desktop" mode of stunnel. XDG-desktop file and icon file may be included in default stunnel distributions.

1 0

Difficulty to select exact Cipher
by Sachin Deshmukh 12 Jul '21

12 Jul '21

Hello Together, I had been trying to use a stunnel to set PSK encrypted TLS. Below is my conf file. [client] client = yes accept = 127.0.0.1:8888 connect = 192.168.1.100:443 ciphers = PSK-AES128-CBC-SHA256 PSKsecrets = /data/dummy.txt I can see communication, but client e.g. Stunnel from Client side offer several other cipher in addition to exact one which is expected as per conf. I wish PSK-AES128-CBC-SHA256 (0x00ae) But I see the list below in actual communication. [image: image.png] Please let me know 1 .how we can inform stunnel to use exact and only 1 cipher provided in the conf file. Or 2. How can we state hex id instead of string. If I see a cipher list, with the same keyword as a part or whole there are more than 1 ciphers, I suppose this causes stunnel to take a list as per string match. ECDHE-PSK-AES128-CBC-SHA256 TLSv1 Kx=ECDHEPSK Au=PSK Enc=AES(128) Mac=SHA256 RSA-PSK-AES128-CBC-SHA256 TLSv1 Kx=RSAPSK Au=RSA Enc=AES(128) Mac=SHA256 DHE-PSK-AES128-CBC-SHA256 TLSv1 Kx=DHEPSK Au=PSK Enc=AES(128) Mac=SHA256 *PSK-AES128-CBC-SHA256 * TLSv1 Kx=PSK Au=PSK Enc=AES(128) Mac=SHA256 Can we make a stunnel to select only one exact cipher?

1 0

curl 7.61 exit status 8 from stunnel service of tls1
by kmx1818＠gmail.com 09 Jul '21

09 Jul '21

Hello all, For a remote tls1 web service : $ # openssl s_client -connect myremote:7002 -tls1 CONNECTED(00000004) depth=0 CN = xxx, OU = xxx, O = xxx, C = xxx verify error:num=18:self signed certificate verify return:1 depth=0 CN = xxx, OU = xxx, O = xxx, C = xxx verify return:1 --- Certificate chain ... --- Server certificate -----BEGIN CERTIFICATE----- MIIC8zCCAdsCBGCvjhEwDQYJKoZIhvcNAQEFBQAwPjEOMAwGA1UEAxMFRUZXRUIx ... QG9sNNhQW65rRVmdqy/g0cBbLKRKhmRCS+ajRIzBcO9ZmMe42TES -----END CERTIFICATE----- subject=XXX issuer=XXX --- No client certificate CA names sent --- SSL handshake has read 889 bytes and written 509 bytes --- New, TLSv1/SSLv3, Cipher is RC4-MD5 Server public key is 2048 bit Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1 Cipher : RC4-MD5 Session-ID: 2D9F8D8833A459C16C1D01F0C92F8EB7 Session-ID-ctx: Master-Key: 1BF68D1AAEEC291A60252ECD63C374661FBBE028FB39A75DDA29E4E3FB6FE34CFC80F875F9E16F9D7C840F185757F583 Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1625842735 Timeout : 7200 (sec) Verify return code: 18 (self signed certificate) --- closed $ I can test it alright with an "old" curl $ curl --version curl 7.15.4 (sparc-sun-solaris2.9) libcurl/7.15.4 OpenSSL/0.9.7g zlib/1.2.3 Protocols: tftp ftp telnet dict ldap http file https ftps Features: IPv6 Largefile NTLM SSL libz ...like this $ curl -skL https://myremote:7002/MyWebService?WSDL <?xml version="1.0" encoding="UTF-8"?> ... </soap:address> </port> </service> </definitions> I want to tls1.2-enable myremote:7002 with stunnel, and run a tls1.2 curl instead. My stunnel installation $ /opt/csw/bin/stunnel -version Initializing inetd mode configuration stunnel 5.59 on sparc-sun-solaris2.10 platform Compiled with OpenSSL 1.0.2u 20 Dec 2019 Running with OpenSSL 1.0.2o 27 Mar 2018 Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI Auth:LIBWRAP Global options: RNDbytes = 1024 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK curves = prime256v1 debug = daemon.notice logId = sequential options = NO_SSLv2 I start it with this service config: [my12] client = no accept = 7002 connect = myremote:7002 cert = /etc/opt/csw/stunnel/stunnel.crt key = /etc/opt/csw/stunnel/stunnel.key sslVersion = TLSv1.2 debug = 7 and test it with a fairly recent curl $ /opt/csw/bin/curl --version curl 7.61.0 (sparc-sun-solaris2.10) libcurl/7.61.0 OpenSSL/1.0.2o zlib/1.2.8 libidn2/2.0.4 libpsl/0.19.1 (+libidn2/2.0.4) Release-Date: 2018-07-11 Protocols: dict file ftp ftps gopher http https imap imaps pop3 pop3s rtsp smb smbs smtp smtps telnet tftp Features: AsynchDNS IDN IPv6 Largefile NTLM NTLM_WB SSL libz TLS-SRP UnixSockets HTTPS-proxy PSL Metalink Alas, the recent curl call $ /opt/csw/bin/curl -skL https://myremote:7002/MyWebService?WSDL ...fails with exit status 23 In verbose mode we get * Trying 127.0.0.1... * TCP_NODELAY set * Failed to set TCP_KEEPALIVE on fd 4 * Connected to localhost (127.0.0.1) port 7002 (#0) * ALPN, offering http/1.1 * Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH * successfully set certificate verify locations: * CAfile: none CApath: /etc/opt/csw/ssl/certs * TLSv1.2 (OUT), TLS header, Certificate Status (22): * TLSv1.2 (OUT), TLS handshake, Client hello (1): * TLSv1.2 (IN), TLS handshake, Server hello (2): * TLSv1.2 (IN), TLS handshake, Certificate (11): * TLSv1.2 (IN), TLS handshake, Server key exchange (12): * TLSv1.2 (IN), TLS handshake, Server finished (14): * TLSv1.2 (OUT), TLS handshake, Client key exchange (16): * TLSv1.2 (OUT), TLS change cipher, Client hello (1): * TLSv1.2 (OUT), TLS handshake, Finished (20): * TLSv1.2 (IN), TLS change cipher, Client hello (1): * TLSv1.2 (IN), TLS handshake, Finished (20): * SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384 * ALPN, server did not agree to a protocol * Server certificate: * subject: C=TS; ST=Westfarthing; L=Hobbiton; O=Thorin and Company; OU=Burglars; CN=ahost.theshire.net; emailAddress=bilbo(a)theshire.net * start date: Jun 30 09:24:25 2021 GMT * expire date: Jun 30 09:24:25 2022 GMT * issuer: C=TS; ST=Westfarthing; L=Hobbiton; O=Thorin and Company; OU=Burglars; CN=ahost.theshire.net; emailAddress=bilbo(a)theshire.net * SSL certificate verify result: self signed certificate (18), continuing anyway. > GET /MyWebService?WSDL HTTP/1.1 > Host: localhost:7002 > User-Agent: curl/7.61.0 > Accept: */* > Warning: Binary output can mess up your terminal. Use "--output -" to tell Warning: curl to output it to your terminal anyway, or consider "--output Warning: <FILE>" to save to a file. * Failed writing body (0 != 7) * Closing connection 0 * TLSv1.2 (OUT), TLS alert, Client hello (1): $ I tried various curl flags - nothing works. In the meantime stunnel logs no errors Jul 9 16:16:45 acuapd30 stunnel: [ID 801593 daemon.notice] LOG5[18]: Service [my12] accepted connection from 127.0.0.1:39165 Jul 9 16:16:45 acuapd30 stunnel: [ID 801593 daemon.notice] LOG5[18]: s_connect: connected 10.240.28.69:7002 Jul 9 16:16:45 acuapd30 stunnel: [ID 801593 daemon.notice] LOG5[18]: Service [my12] connected remote server from xxx.yyy.zzz.www:39166 Jul 9 16:17:10 acuapd30 stunnel: [ID 801593 daemon.notice] LOG5[18]: Connection closed: 7 byte(s) sent to TLS, 116 byte(s) sent to socket What am i doing wrong!? Thanks in advance!

1 0

stunnel and rsyslog
by Yann RESCOURIO 28 Jun '21

28 Jun '21

Hello I use stunnel for rsyslog. And on the client equipment, I use also rsyslog queues for buffering in case of disconnection. But in case of reboot: * without stunnel, the buffered log messages are received on the rsyslog server * with stunnel, no buffered log messages are received on the rsyslog server On the client equipment, is it possible to refuse the local stunnel connections as long as the remote stunnel connection is down ? Regards Yann Rescourio

3 2

FIPS 140-2 & Ubuntu Pro
by Patrick Kaeding 23 Jun '21

23 Jun '21

Hi I am trying to set up stunnel with FIPS 140-2 compliance. I found some discussion of this on this mailing list from many years ago, but I'm not sure how much of that is still relevant today. I am running Ubuntu Pro 18.04, with FIPS mode (including the userspace modules: https://security-certs.docs.ubuntu.com/en/fips) If I simply `apt-get install stunnel4`, I can create a config with `fips = yes`, and when I start it up, I see this line logged: 2021.06.23 15:45:24 LOG5[ui]: FIPS mode enabled Does this mean I am all set, without needing to compile anything from source? In this message (from almost a decade ago), it sounds like this might be the validation I need: > BTW: "fips" option is only available when stunnel is built with FIPS support. FIPS mode is also clearly logged on startup https://www.stunnel.org/pipermail/stunnel-users/2012-November/003963.html Or do I need to build stunnel from scratch, using my local openssl distribution? Thanks! -- Patrick Kaeding pkaeding(a)launchdarkly.com

1 0

Number of tunnels open in Stunnel
by Moti Berger 21 Jun '21

21 Jun '21

Hi Is there a command I can run to get the current number of opened tunnels? I'm running Stunnel version 5.57. Thanks, Moti

1 0

Help needed for email client
by Ian Huysman 15 Jun '21

15 Jun '21

Hi, I just tried to configure stunnel as proxy between an email client (Outlook Express) and the email server (SMTP and IMAP). The problem is that the connection times out in the client while synchronising the IMAP folders. But I can send emails from the client. This is my relatively basic configuration: [SMTP] client = yes accept = 25 connect = smtp.office365.com:587 protocol = smtp [IMAP] client = yes accept = 143 connect = outlook.office365.com:993 protocol = imap Any help would be greatly appreciated! Regards, Ian.

3 2

SFTP over stunnel
by sameer_rm90＠hotmail.com 13 Jun '21

13 Jun '21

Hi, Is SFTP works over stunnel? If yes, how can configure it ?

2 1

connect with hostname obtains incorrect IP address
by stunnel＠dsbconsulting.com 11 Jun '21

11 Jun '21

Hello everyone. I'm trying to use stunnel to forward smtp traffic from an old webcam to an smtp server that requires TLS. Everything works fine if I put the IP address of the smtp server in the connect= line, but if I put the hostname there, stunnel tries to connect to a seemingly random IP address. This happens using stunnel on Windows 10 and also on my router with OpenWrt (linux) Here is the config file: [smtp] client = yes accept = 192.0.0.1:25 ;connect = 199.193.7.228:465 connect = smtp.privateemil.com:465 And here is the failing part of the stunnel log file: 2021.06.11 18:24:54 LOG5[0]: Service [smtp] accepted connection from 192.0.0.111:49334 2021.06.11 18:24:54 LOG6[0]: s_connect: connecting 47.91.170.222:465 2021.06.11 18:24:54 LOG7[0]: s_connect: s_poll_wait 47.91.170.222:465: waiting 10 seconds 2021.06.11 18:24:54 LOG7[0]: FD=6 events=0x2001 revents=0x0 2021.06.11 18:24:54 LOG7[0]: FD=10 events=0x2005 revents=0x0 2021.06.11 18:25:04 LOG3[0]: s_connect: s_poll_wait 47.91.170.222:465: TIMEOUTconnect exceeded Here is the result of ping for the smtp server: PING smtp.privateemail.com (199.193.7.228): 56 data bytes 64 bytes from 199.193.7.228: seq=0 ttl=237 time=103.059 ms

2 1

encrypted connection between application server and db server drops exactly after 300
by simona vittori 09 Jun '21

09 Jun '21

Hello, the encrypted connection between application server and db server drops exactly after 300 seconds. why? without stunnel this does not happen. we cannot understand why Thank a lot Simona

1 0

How to get high-precision timestamps in the stunnel logs
by jori.gielis＠telenetgroup.be 27 May '21

27 May '21

Hi, I want to use more accurate timestamps in the logs of stunnel. It would be nice to have milliseconds. Current format: 2021.05.27 19:00:59 LOG7[3]: Remote descriptor (FD=70) closed Needed format: 2021.05.27 19:00:59,718 LOG7[3]: Remote descriptor (FD=70) closed Is it possible to accomplish this in stunnel version 5.56? Thanks! Best regards

1 0

stunnel.pem Failure
by waynesmith philosophical-vistas.net 27 May '21

27 May '21

I preface this message to alert the reader that I remain a novice both in use of STunnel and Linux. I am trying to generate an SSL/TLS certificate for use w/ my various e-mail clients. I downloaded and extracted STunnel 5.59 on my Linux Mint Debian box. After perusing the files I issued the following command sudo ./configure --enable-fips Without repeating all the verbiage, it seemed to run properly. I then issued the following command make cert It returned the usual information requests (though it didn't ask for an e-mail address) but returned the following: /usr/bin/install -c -b -m 600 stunnel.pem /usr/local/etc/stunnel/stunnel.pem /usr/bin/install: cannot create regular file ‘/usr/local/etc/stunnel/stunnel.pem’: No such file or directory Makefile:549: recipe for target 'cert' failed make[1]: *** [cert] Error 1 make[1]: Leaving directory '/home/was/stunnel-5.59/tools' Makefile:883: recipe for target 'cert' failed make: *** [cert] Error 2 I negotiated through </usr/local/etc> and ascertained there was no </stunnel> folder. Unfortunately the permissions prevent me from creating this folder. I am thus stumped. Suggestions?

2 2

fixes for Solaris
by Pavel Heimlich 25 May '21

25 May '21

Hi, please find attached two patches that make stunnel 5.59 work better with Oracle Solaris. The first one fixes a few issues with the tests* - it removes unnecessary warning/error messages and adjusts the calls to netcat and ifconfig to what works on Solaris. The second one adds the location of 64 bit shared libraries for linking OpenSSL, similar to what has been added for Fedora. best regards P. * test result: test 010_require_cert ok test 011_verify_peer ok test 012_verify_chain ok test 013_CRL_file ok test 014_PSK_secrets ok test 015_p12_cert ok test 020_IPv6 ok test 021_FIPS skipped test 022_bind ok test 028_redirect_chain ok test 029_no_redirect_chain ok test 030_simple_execute ok test 031_redirect ok test 032_no_redirect ok test 033_redirect_exec ok test 034_no_redirect_exec ok test 035_SNI ok test 036_no_SNI ok test 037_failover_prio1 ok test 038_failover_prio2 ok test 039_failover_rr ok test 040_reload ok test 041_exec_connect ok test 042_inetd ok test 043_session_delay ok test 044_session_nodelay ok test 045_include ok test 046_resume_PSK ok test 047_resume_redirect ok test 048_resume_noredirect ok test 049_redirect_nocert ok test 050_ticket_secrets ok test 051_resume_cache_old skipped test 052_resume_cache ok test 053_resume_ticket ok test 054_resume_TLSv1_3 ok test 055_socket_close ok test 110_failure_require_cert ok test 111_failure_verify_peer ok test 112_failure_verify_chain ok test 113_failure_CRL_file ok test 114_failure_PSK_secrets ok test 115_failure_wrong_config ok test 121_failure_FIPS_ciphers skipped test 122_failure_FIPS_curves skipped summary: success 41, skip 4, fail 0 -- Pavel Heimlich | SW Developer Security Compliance & Globalization Oracle Czech s. r. o., U Trezorky 921/2, 158 00 Praha 5, Czech Republic

1 0

Stunnel stopped working..
by Alastair ＠ Expert Geeks 23 May '21

23 May '21

Hi all, I've been happily using stunnel for the same purpose and the same config for over year but it's suddenly stopped working. I was using it to wrap http shoutcast (port 8000) to https (port 8444). I'm using a letsencrypt cert. config: client = no [shoutcast] accept = 8444 connect = 127.0.0.1:8000 cert = /etc/letsencrypt/live/*server name*/fullchain.pem key = /etc/letsencrypt/live/*server name*/privkey.pem This keeps getting repeated in the log: 2021.05.22 22:18:27 LOG7[main]: Found 1 ready file descriptor(s) 2021.05.22 22:18:27 LOG7[main]: FD=4 events=0x2001 revents=0x0 2021.05.22 22:18:27 LOG7[main]: FD=9 events=0x2001 revents=0x1 2021.05.22 22:18:27 LOG7[main]: Service [shoutcast] accepted (FD=3) from *server ip*:40506 2021.05.22 22:18:27 LOG7[4]: Service [shoutcast] started 2021.05.22 22:18:27 LOG7[4]: Setting local socket options (FD=3) 2021.05.22 22:18:27 LOG7[4]: Option TCP_NODELAY set on local socket 2021.05.22 22:18:27 LOG5[4]: Service [shoutcast] accepted connection from *server ip*:40506 2021.05.22 22:18:27 LOG6[4]: Peer certificate not required 2021.05.22 22:18:27 LOG7[4]: TLS state (accept): before SSL initialization 2021.05.22 22:18:27 LOG3[4]: SSL_accept: ../ssl/record/ssl3_record.c:322: error:1408F09C:SSL routines:ssl3_get_record:http request 2021.05.22 22:18:27 LOG5[4]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2021.05.22 22:18:27 LOG7[4]: Local descriptor (FD=3) closed 2021.05.22 22:18:27 LOG7[4]: Service [shoutcast] finished (0 left) (server ip & server name removed) Suggestions and recommendations gratefully received! Thanks.

2 1

Re: stunnel in Citrix Environment
by Eberhard 21 May '21

21 May '21

It is pretty much impossible for users to hijack each other. The connections are persistent and if a user drops it is gone. It won’t hijack or share. Having said that, if your app works like a Web browser (not persistent) then of course they will interleave and of course you need to use the same technique as browsers – cookies, hidden fields, whatever. E VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) <http://www.vicsmba.com/> http://www.vicsmba.com <https://www.facebook.com/groups/286143052248115> https://www.facebook.com/groups/286143052248115 From: Bruce Liptak <bliptakjr(a)gmail.com> Sent: Friday, May 21, 2021 10:35 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] stunnel in Citrix Environment Hello stunnel-users, Currently we have an application using stunnel being presented by a Citrix presentation server. The first user authenticates over stunnel with a PKI cert and every user thereafter creates a prompt for the first user again and again for each user that also tries to get into the app. Is there a way for stunnel to be separated based on something that pertains to the user trying to get access? We are using a PKI solution based on certificates. It's like every new user is hijacking the first users' stunnel session. Any help would be appreciated! Thank you, Bruce Liptak <mailto:[email protected]> bliptakjr(a)gmail.com CCNA R&S | VCA-DCV | Linux+ | Security+ | Network+

1 0

stunnel in Citrix Environment
by Bruce Liptak 21 May '21

21 May '21

Hello stunnel-users, Currently we have an application using stunnel being presented by a Citrix presentation server. The first user authenticates over stunnel with a PKI cert and every user thereafter creates a prompt for the first user again and again for each user that also tries to get into the app. Is there a way for stunnel to be separated based on something that pertains to the user trying to get access? We are using a PKI solution based on certificates. It's like every new user is hijacking the first users' stunnel session. Any help would be appreciated! Thank you, Bruce Liptak bliptakjr(a)gmail.com CCNA R&S | VCA-DCV | Linux+ | Security+ | Network+

1 0

Unable to connect after upgrade of server
by Christopher Schultz 13 May '21

13 May '21

All, I upgraded one of my servers from Debian stretch to Debian buster yesterday and I've been unable to establish stunnel connections to it since then. When I connect, I get this log message on the server end: LOG5[0]: Service [svn-name] accepted connection from [client ip]:45382 LOG5[0]: Certificate accepted at depth=0: [cert dn] LOG3[0]: SSL_accept: 1414D17A: error:1414D17A:SSL routines:tls12_check_peer_sigalg:wrong curve LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket We are using EC certs and it's complaining about a curve. So, probably curve-related :) Our private key on the client side is using the secp256k1 curve. The client is using OpenSSL 1.0.2. The server is running OpenSSL 1.1.1. Both client and server support secp256k1. I tried specifying: curves = secp256k1 On the server side, but stunnel won't start, telling me that the configuration option isn't valid. I tried it in the global scope, and also in the service-scope and got the same error. Am I missing something? Minting new certificates (e.g. using prime256v1/secp256r1) is definitely an option, as my client openssl says it supports the NIST P-256 curve. $ openssl ecparam -list_curves secp256k1 : SECG curve over a 256 bit prime field secp384r1 : NIST/SECG curve over a 384 bit prime field secp521r1 : NIST/SECG curve over a 521 bit prime field prime256v1: X9.62/SECG curve over a 256 bit prime field That last one is NIST P-256. Is my best bet to mint a new certificate? Or is it possible to configure the server to allow this secp256k1 curve? -chris

1 0

Stunnel static compile with open ssl error while running make command
by snainwar＠rediffmail.com 30 Apr '21

30 Apr '21

I am running RHEL release v 7.9 and have successfully compiled OpenSSL version 1.1.1k using the following configuration: ##> ./config --prefix=/usr/src/openssl-1.1.1 --openssldir=/etc/openssl The following paths are shown when I run command whereis openssl # whereis openssl openssl: /usr/lib64/openssl /usr/local/bin/openssl /usr/include/openssl /opt/openssl/bin/openssl /usr/src/openssl-1.1.1k/openssl.pc ]# I have download and prepared Stunnel version 5.59 from https://www.stunnel.org/ I am using the following configuration: ##> ./configure --with-ssl=/opt/openssl --enable-static When I compile Stunnel I get the following error message when we run Make install make[2]: Nothing to be done for `install-exec-am'. /bin/mkdir -p '/usr/local/share/doc/stunnel' /bin/install -c -m 644 README.md TODO.md COPYING.md AUTHORS.md NEWS.md PORTS.md BUGS.md COPYRIGHT.md CREDITS.md INSTALL.W32.md INSTALL.WCE.md INSTALL.FIPS.md '/usr/local/share/doc/stunnel' make install-data-hook make[3]: Entering directory `/usr/src/stunnel-5.59' ********************************************************* * Type 'make cert' to also install a sample certificate * ********************************************************* make[3]: Leaving directory `/usr/src/stunnel-5.59' make[2]: Leaving directory `/usr/src/stunnel-5.59' make[1]: Leaving directory `/usr/src/stunnel-5.59' [root@tvdcltmp001 stunnel-5.59]# Looks like Stunnel cannot link (probably because it can’t find the library) Does anyone know what the error might be? What changes do I need to make to configure for compilation.

1 0

5.59 on win64
by Joe Phillips 29 Apr '21

29 Apr '21

I'm running win64 version 5.59. Installed service and it is started and running (set to automatic). But when I try to open the stunnel allUsers I get the error : stunnel server is down sue to an error, you need to exit and correct the problem. Click ok to see the error log. Shouldn't I be able to open the log window if the service is running? Also when the service is running there is no stunnel icon in the system tray. Please advise. Thanks [cid:[email protected]]

1 0

Load Balancing
by Ramin Malekgahsemi 28 Apr '21

28 Apr '21

Hi Dear friend If have one stunnel client and have three Stunnel server My question IS How by RR user three server For client ? Forward and handle connection on three server (Client and access Port is once) thanks

1 0

Stunnel static compile error while running Make command
by snainwar＠rediffmail.com 28 Apr '21

28 Apr '21

We are trying to static compile stunnel 5.59 with open ssl 1.1.1 on RHEl 6 and RHEL7 we are getting below error running command Make on the server /stunnel-5.59/src/cron.c:239: undefined reference to `BN_GENCB_new' /stunnel-5.59/src/cron.c:244: undefined reference to `BN_GENCB_set' stunnel-cron.o: In function `cron_dh_param': /stunnel-5.59/src/cron.c:219: undefined reference to `CRYPTO_THREAD_write_lock' /stunnel-5.59/src/cron.c:222: undefined reference to `CRYPTO_THREAD_unlock' /stunnel-5.59/src/cron.c:225: undefined reference to `CRYPTO_THREAD_read_lock' /stunnel-5.59/src/cron.c:229: undefined reference to `CRYPTO_THREAD_unlock' stunnel-cron.o: In function `cron_init': /stunnel-5.59/src/cron.c:78: undefined reference to `CRYPTO_THREAD_write_lock' /stunnel-5.59/src/cron.c:81: undefined reference to `CRYPTO_THREAD_unlock' stunnel-stunnel.o: In function `main_cleanup': /stunnel-5.59/src/stunnel.c:249: undefined reference to `CRYPTO_THREAD_write_lock' /stunnel-5.59/src/stunnel.c:263: undefined reference to `CRYPTO_THREAD_unlock' stunnel-stunnel.o: In function `process_connections': /stunnel-5.59/src/stunnel.c:889: undefined reference to `CRYPTO_THREAD_write_lock' /stunnel-5.59/src/stunnel.c:898: undefined reference to `CRYPTO_THREAD_unlock' stunnel-stunnel.o: In function `stunnel_info': /stunnel-5.59/src/stunnel.c:1034: undefined reference to `OpenSSL_version' /stunnel-5.59/src/stunnel.c:1036: undefined reference to `OpenSSL_version' /stunnel-5.59/src/stunnel.c:1041: undefined reference to `OpenSSL_version_num' collect2: error: ld returned 1 exit status make[2]: *** [stunnel] Error 1 make[2]: Leaving directory `/stunnel-5.59/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/stunnel-5.59/src' make: *** [all-recursive] Error 1 [root@tvdcltmp001 stunnel-5.59]#

1 0

Stunnel static compile error while running Make command
by snainwar＠rediffmail.com 28 Apr '21

28 Apr '21

We are trying to static compile stunnel 5.59 with open ssl 1.1.1 on RHEl 6 and RHEL7 we are getting below error running command Make on the server /stunnel-5.59/src/cron.c:239: undefined reference to `BN_GENCB_new' /stunnel-5.59/src/cron.c:244: undefined reference to `BN_GENCB_set' stunnel-cron.o: In function `cron_dh_param': /stunnel-5.59/src/cron.c:219: undefined reference to `CRYPTO_THREAD_write_lock' /stunnel-5.59/src/cron.c:222: undefined reference to `CRYPTO_THREAD_unlock' /stunnel-5.59/src/cron.c:225: undefined reference to `CRYPTO_THREAD_read_lock' /stunnel-5.59/src/cron.c:229: undefined reference to `CRYPTO_THREAD_unlock' stunnel-cron.o: In function `cron_init': /stunnel-5.59/src/cron.c:78: undefined reference to `CRYPTO_THREAD_write_lock' /stunnel-5.59/src/cron.c:81: undefined reference to `CRYPTO_THREAD_unlock' stunnel-stunnel.o: In function `main_cleanup': /stunnel-5.59/src/stunnel.c:249: undefined reference to `CRYPTO_THREAD_write_lock' /stunnel-5.59/src/stunnel.c:263: undefined reference to `CRYPTO_THREAD_unlock' stunnel-stunnel.o: In function `process_connections': /stunnel-5.59/src/stunnel.c:889: undefined reference to `CRYPTO_THREAD_write_lock' /stunnel-5.59/src/stunnel.c:898: undefined reference to `CRYPTO_THREAD_unlock' stunnel-stunnel.o: In function `stunnel_info': /stunnel-5.59/src/stunnel.c:1034: undefined reference to `OpenSSL_version' /stunnel-5.59/src/stunnel.c:1036: undefined reference to `OpenSSL_version' /stunnel-5.59/src/stunnel.c:1041: undefined reference to `OpenSSL_version_num' collect2: error: ld returned 1 exit status make[2]: *** [stunnel] Error 1 make[2]: Leaving directory `/stunnel-5.59/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/stunnel-5.59/src' make: *** [all-recursive] Error 1 [root@tvdcltmp001 stunnel-5.59]#

1 0

Unable to reload Stunnel in Linux
by gorf＠hyperfunk.club 27 Apr '21

27 Apr '21

Hi, Normally, I would call "kill -HUP" with Stunnel's process ID to make it reload the configuration in Linux. I was very surprised when I tried that and the process stopped. Why would HUP cause it to exit, rather than reload the config? It doesn't do that on every machine. Thanks.

2 4

Questions about two host connection using stunnel
by yfmao＠seas.upenn.edu 24 Apr '21

24 Apr '21

I am using stunnel4 to build a secure connection between two ubuntu hosts. One of the hosts (sender) will send "hello world" to another host (receiver). When I am using tcpdump in receiver to capture the packets sending from sender, I find out that one of the packets contains "hello world" in plaintext. From my understanding, stunnel will encrypt the content of "hello world" if everything is correct, so I shouldn't be able to see "hello world" in plaintext among any incoming packets. Any ideas about what is going wrong here? Here I will put my stunnel.config for your reference: cert = /home/ubuntu/client_server/stunnel.pem key = /home/ubuntu/client_server/stunnel.key debug = 7 output = /home/ubuntu/client_server/stunnel.log socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 options = ALL [services] accept = 6667 connect = some_ip_address:6666 TIMEOUTclose = 0

4 6

Paid work
by David Rose (dsr) 24 Apr '21

24 Apr '21

I need an Stunnel config that will allow my Windows app that only can send SMTP without any authentication or encryption to be able to send email via Gmail or Office 365. Is this something that someone would be able to write for me and if so, what would you charge ? Thanks David --

3 2

Does stunnel support OCSP stapling?
by koalabearguo＠gmail.com 24 Apr '21

24 Apr '21

Will it plan to support in the future? Thanks.

3 2

Re: Fwd: Re: Local socket keeps listening
by Eberhard 16 Apr '21

16 Apr '21

I’ll toss in an unpopular opinion here. I have used stunnel since day one. I had over the years problems with it not answering or the parent process dying altogether and other issues. I finally decided to run it from inetd rather than as a service. It is logical that this is a little slower but with modern machines I don’t notice it. inetd always is running. Always. If it is not you pretty much cannot use the machine. It has been a service program forever and is dead reliable. What you get is total reliability for an unnoticeable loss of speed. I suppose a heavily loaded machine running at capacity might not like this – my answer is throw hardware at it. I need reliable more than anything else. I’d at least try it! E VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) <http://www.vicsmba.com/> http://www.vicsmba.com <https://www.facebook.com/groups/286143052248115> https://www.facebook.com/groups/286143052248115 From: Jorge Redondo Flames <jorge.redondo(a)gmail.com> Sent: Wednesday, April 14, 2021 11:49 AM To: Peter Pentchev <roam(a)ringlet.net> Cc: stunnel-users(a)stunnel.org Subject: [stunnel-users] Re: Fwd: Re: Local socket keeps listening Got it. Thank you very much! On Wed, 14 Apr 2021 at 20:41, Peter Pentchev <roam(a)ringlet.net <mailto:[email protected]> > wrote: On Wed, Apr 14, 2021 at 08:24:51PM +0200, Jorge Redondo Flames wrote: > On Wed, 14 Apr 2021 at 20:19, Jochen Bern <Jochen.Bern(a)binect.de <mailto:[email protected]> > wrote: > > On 14.04.21 19:58, Jorge Redondo Flames wrote: > > > Stunnel could listen on its local port *only* when the peer server is > > > listening on its corresponding server socket. So if there is no serve on > > > the other side, there should not be local listening socket. Does not that > > > make sense? > > > > No. > > > > In the general situation (server *not* being on the same machine as > > stunnel), stunnel CANNOT know whether the server's listening short of > > trying to connect to it - which it will only do on behalf of an incoming > > client request, which would never happen if stunnel weren't listening. > > > > Even if server and stunnel run on the same machine/OS, finding out about > > the server's state would require a bunch of special-purpose code. > > > > Assuming that they *are* on a common Linux (or at least unixoid) system, > > however, it would be rather trivial to write a root cron job that checks > > the output of "ss"/"netstat" for the server's LISTEN and simply > > terminates stunnel if it isn't found. > > > > Or even better, have the server *restarted* automatically whenever it > > croaks ... > > Understood. Although it still seems to me that the code doing more or less > what the cron job would do might worth. So, three points here. 1. There are some services (some servers) that do not react very nicely to somebody connecting to them and disconnecting immediately. Some of them do some work at the moment of the connection (e.g. resolve the client's IP address, check it against firewall rules, or even do some actual, service-specific, work, e.g. allocate buffers, prepare some kind of data...). Some of them are configured in such ways as to avoid portscanners or denial of service attacks or spam or flood or... many other things. In general, unless you *know* that it is safe to connect and immediately disconnect from the remote service, it is very unwise to try to do that. In your particular case, you know that, but in general, it is not a good idea. 2. Even if stunnel would try to connect to the remote service, what happens if the connection fails? OK, you say stunnel should close its local listening socket, but what then - will it never open it again? And if here's the part when you say "it can try to connect to the remote server again and start listening again" - okay, how much time passes between these connection attempts? Even something like a second may be bad if a real client chooses exactly this second to try to connect to stunnel and... stunnel is not listening... even though the remote server has started listening immediately after stunnel's last unsuccessful attempt. So... whatever interval you pick, closing the local listening socket *will* result in real, live clients failing to connect. 3. A more general point: if you really want to check whether a service is operational, only checking whether it will accept a connection is not enough. I've seen *many* failure modes over the years: from an overloaded machine where the OS kernel will accept the connection, but none of the actual server processes will react, through an overloaded service process that accepts the connection but spends too much time processing other requests to pay any attention to it, to a firewall host gone crazy that will pass connection packets, but will then refuse to pass the actual payload (yes, I've seen that happen for at least three different reasons). So an actual service check would be to connect and then send some kind of simple request to the server that you know will not take it too much time and resources to process, but will give you some measure of confidence that the server is actually serving requests and data. But in short, it is impossible for stunnel to know whether a remote server is listening for a connection without trying to connect, it may not be "polite" for it to try to connect too often, and trying to connect not-too-often *will* result in real clients being unable to connect in the intermediate intervals. G'luck, Peter -- Peter Pentchev roam(a)ringlet.net <mailto:[email protected]> roam(a)debian.org <mailto:[email protected]> pp(a)storpool.com <mailto:[email protected]> PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

2 3

Fwd: Re: Local socket keeps listening
by Jorge Redondo Flames 14 Apr '21

14 Apr '21

---------- Forwarded message --------- From: Jorge Redondo Flames <jorge.redondo(a)gmail.com> Date: Wed, 14 Apr 2021 at 19:45 Subject: Re: [stunnel-users] Re: Local socket keeps listening To: Ludolf Holzheid <lholzheid(a)bihl-wiedemann.de> Stunnel could listen on its local port *only* when the peer server is listening on its corresponding server socket. So if there is no serve on the other side, there should not be local listening socket. Does not that make sense? On Wed, 14 Apr 2021 at 19:38, Ludolf Holzheid <lholzheid(a)bihl-wiedemann.de> wrote: > On Wed, 2021-04-14 19:13:03 +0200, Jorge Redondo Flames wrote: > > [..] > > > > Is there a way to configure Stunnel to *close* the local socket (not > > listening anymore) whenever the peer process (i.e. the server) has closed > > its socket? > > Stunnel listens for connection request from the client(s) and connects > to the server on behalf of the client(s). How will a client ever be > able to connect through Stunnel again if Stunnel closes the listening > socket? > > Ludolf > > -- > > Ludolf Holzheid > > Bihl+Wiedemann GmbH > Floßwörthstraße 41 > 68199 Mannheim, Germany > > Tel: +49 621 33996-0 > Fax: +49 621 3392239 > > mailto:[email protected] > https://www.bihl-wiedemann.de > > Sitz der Gesellschaft: Mannheim > Geschäftsführer: Jochen Bihl, Bernhard Wiedemann > Amtsgericht Mannheim, HRB 5796 > > Datenschutzerklärung: https://www.bihl-wiedemann.de/de/meta/datenschutz > _______________________________________________ > stunnel-users mailing list -- stunnel-users(a)stunnel.org > To unsubscribe send an email to stunnel-users-leave(a)stunnel.org >

3 4

Re: Local socket keeps listening
by Ludolf Holzheid 14 Apr '21

14 Apr '21

On Wed, 2021-04-14 19:45:06 +0200, Jorge Redondo Flames wrote: > Stunnel could listen on its local port *only* when the peer server is > listening on its corresponding server socket. So if there is no serve on > the other side, there should not be local listening socket. Does not that > make sense? Stunnel connects to the server only when a client connects to Stunnel. If Stunnel is not listening for clients, it does not try to connect to the server. If it does not try to connect to the server, it does not know if the server is listening. Ludolf > On Wed, 14 Apr 2021 at 19:38, Ludolf Holzheid <lholzheid(a)bihl-wiedemann.de> > wrote: > > > On Wed, 2021-04-14 19:13:03 +0200, Jorge Redondo Flames wrote: > > > [..] > > > > > > Is there a way to configure Stunnel to *close* the local socket (not > > > listening anymore) whenever the peer process (i.e. the server) has closed > > > its socket? > > > > Stunnel listens for connection request from the client(s) and connects > > to the server on behalf of the client(s). How will a client ever be > > able to connect through Stunnel again if Stunnel closes the listening > > socket? > > > > Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:[email protected] https://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796 Datenschutzerklärung: https://www.bihl-wiedemann.de/de/meta/datenschutz

2 1

Local socket keeps listening
by Jorge Redondo Flames 14 Apr '21

14 Apr '21

Hey there, thanks for being there. I have a Client/Server services originally communicating over TCP. The client periodically monitors the socket connection by reading from the socket and, in the case the connection has been lost, the client retries the connection a given amount of times, after which it realizes that the server is definitely down. Now I have implemented secure communication using Stunnel and everything works fine except for the fact that, whenever the server process crashes (which is eventually expected), the client is no longer able to successfully monitor the connection as expected since, no matter what happens to the server process, the local Stunnel daemon keeps listening on its local socket. So, when the client retries connection, it successfully connects to the local socket. Although it soon receives connection reset, this successful connection attempt happening even when the server process is actually down completely breaks the client logic. I could change this logic but I really would like to avoid that path. So here is my question: Is there a way to configure Stunnel to *close* the local socket (not listening anymore) whenever the peer process (i.e. the server) has closed its socket? Thank you very much in advance.

2 1

Connection stops after 20 minutes
by erik.delanghe＠outlook.com 07 Apr '21

07 Apr '21

We use Stunnel between a windows server server and a windows client. Everything is working fine exept, after 20 minutes the connection is broken. (Cannot reach the server)

1 1

stunnel 5.59 released
by Michał Trojnara 05 Apr '21

05 Apr '21

Dear Users, I have released version 5.59 of stunnel. ### Version 5.59, 2021.04.05, urgency: HIGH * Security bugfixes - OpenSSL DLLs updated to version 1.1.1k. * New features - Client-side "protocol = ldap" support (thx to Bart Dopheide and Seth Grover). * Bugfixes - The test suite fixed not to require external connectivity. - Fixed paths in generated manuals (thx to Tatsuki Makino). - Fixed configuration reload when compression is used. - Fixed compilation with early releases of OpenSSL 1.1.1. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 137776df6be8f1701f1cd590b7779932e123479fb91e5192171c16798815ce9f stunnel-5.59.tar.gz c45fa3f70ecf0628d1f5985f2c11fedfc989bbc64db857def82ca7ee602fd8e0 stunnel-5.59-win64-installer.exe b56d91493631ff2b18e3e596fbb491892847f5671335c3f5e2307e174742ae44 stunnel-5.59-android.zip Best regards, Mike

1 0

Vulnerabilities cve-2021-3449 and cve-2021-3450
by erik.soudant＠pinkroccade.nl 31 Mar '21

31 Mar '21

Hi, Is there any chance that there will be a new stunnel version (windows) using openssl 1.1.1 k in order to be protected from at least vulnarability cve-2021-3449. And if so when can that be expected? Issue 3450 only concerns1.1.1 H-J so that is not a risk at this moment because the most recent Stunnel version is compiled against 1.1.1c.

2 1

SSL_get_peer_tmp_key fail
by stunnel＠paapnet.nl 28 Mar '21

28 Mar '21

Hai, I just tried compiling stunnel 5.58 but it bails out: CC stunnel-client.o client.c: In function 'print_tmp_key': client.c:670:10: warning: implicit declaration of function 'SSL_get_peer_tmp_key'; did you mean 'SSL_get_server_tmp_key'? [-Wimplicit-function-declaration] if (!SSL_get_peer_tmp_key(s, &key)) { ^~~~~~~~~~~~~~~~~~~~ SSL_get_server_tmp_key CCLD stunnel stunnel-client.o: In function `print_tmp_key': /try/stunnel-5.58/src/client.c:670: undefined reference to `SSL_get_peer_tmp_key' Running Ubuntu Ubuntu 18.04.5 LTS gcc version 7.5.0 (Ubuntu 7.5.0-3ubuntu1~18.04) OpenSSL 1.1.1 11 Sep 2018 Version 5.49 compiles ok no issues there Am I missing something here ? Changing it into 'SSL_get_server_tmp_key works' or remming it out probably causes issues... bt it compiles well. Would be great if someone can point me in the right direction. Cheers...

1 0