- stunnel-users - stunnel.org

Address already in use (98) error trying to run stunnel client in Ubuntu Docker container
by greg＠yesenergy.com 24 Sep '20

24 Sep '20

Hello all, I'm getting the following error when I try to connect to a remote server from inside a running Docker container: "Binding service [client] to 127.0.0.1:1589: Address already in use (98)". I don't think this port is actually in use, and I've tried other ports with the same results. I know that this configuration works in my Windows dev machine, from which I have consistently connected to the remote server, no problem. I suspect this might be related to Docker's internal networking schema and port-forwarding, but I thought I would ask this group if anyone knows how to overcome this hurdle. Thanks for listening! Here is the config: [client] client = yes accept = 127.0.0.1:1589 connect = nn.nnn.nnn.nnn:443 checkHost = xxxxxxxxx.com sslVersion = TLSv1.2 CAfile = /usr/local/etc/stunnel/my_pemfile.pem verifyPeer = yes Here is the log trace: [ ] Clients allowed=512000 [.] stunnel 5.56 on x86_64-pc-linux-gnu platform [.] Compiled/running with OpenSSL 1.1.1d 10 Sep 2019 [.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*__errno_location ()) [.] Reading configuration from file /usr/local/etc/stunnel/stunnel.conf [.] UTF-8 byte order mark detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [client] [ ] Ciphers: DES-CBC3-SHA:IDEA-CBC-MD5-DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA [ ] TLSv1.3 ciphersuites: TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256 [ ] TLS options: 0x02100004 (+0x00000000, -0x00000000) [ ] No certificate or private key specified [.] Configuration successful [ ] Binding service [client] [ ] Listening file descriptor created (FD=8) [ ] Setting accept socket options (FD=8) [ ] Option SO_REUSEADDR set on accept socket [.] Binding service [client] to 127.0.0.1:1589: Address already in use (98) [ ] Listening file descriptor created (FD=8) [ ] Setting accept socket options (FD=8) [ ] Option SO_REUSEADDR set on accept socket [.] Binding service [client] to 127.0.0.1:1589: Address already in use (98) [!] Binding service [client] failed [ ] Deallocating section defaults [ ] Unbinding service [client] [ ] Service [client] closed [ ] Deallocating section [client]

1 0

Stunnel to smtp-relay.gmail.com
by Anton Palmgård 22 Sep '20

22 Sep '20

Hi, a few days ago up to a week my stunnel connection to smtp-gmail.gmail.com. stopped working with the error: ep 21 17:25:57 stunnel LOG50: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket Sep 21 17:25:57 stunnel LOG30: Remote server is not RFC 1425 compliant Sep 21 17:25:57 stunnel LOG50: Service [to_gmail] connected remote server from xxx.xxx.xxx.xxx:29662 Tried from 2 different Locations / sites (i.e companies) same error. The relay work fine without client settings but that leaves TLS to the endpoint.. Office 365 relay works fine with TLS. Contacted Google support but the claimed nothing have been changed. I assume somehting with the TLS version/ CIPHERS is wrong ? Conf simply looks like this: cert = /usr/local/etc/stunnel/stunnel.pem chroot = /var/tmp/stunnel setuid = stunnel setgid = stunnel [to_gmail] client = yes accept = 0.0.0.0:587 connect = smtp-relay.gmail.com:587 debug = 7 TIMEOUTclose = 0 protocol = smtp BR, Anton.

2 4

Stunnel failover
by Ray 16 Sep '20

16 Sep '20

Stunnel's failover option with prio settings works fine but the application first tries 3 syn to connect to the first endpoint and if failed then it tries the second endpoint. Is there any way to configure stunnel to try only once and failover to the second connection endpoint?

1 0

using Android Keystore with stunnel
by blacksun＠directbox.com 09 Sep '20

09 Sep '20

Hello, i am using stunnel 5.56 on Android 7.0. It is a non-rooted device. Android stores keys and certs in the android keystore. I am using a Let's Encrypt Cert on serverside, and on clients the options veryChain and chechHost. How can i use the System-integrated CA-Certs of Android for verifying the server-cert issued by Let's Encrypt? When i am searching the net, there are infos saying that the certs and keys are not accessible by filestructure, but there would be apis to access the keystore. The keystore would be protected with the PIN of the device. Thanks.

1 0

How to configure stunnel as HTTP proxy on Windows?
by Jason Long 08 Sep '20

08 Sep '20

Hello, I want to use stunnel on Windows as HTTP proxy, I changed the configuration as below: ; Encrypted HTTP proxy authenticated with a client certificate ; located in the Windows certificate store [example-proxy] client = yes accept = 127.0.0.1:8080 connect = google.com:8443 ;engineId = capi ; Encrypted HTTP proxy authenticated with a client certificate ; located in a cryptographic token [example-pkcs11] client = yes accept = 127.0.0.1:8080 connect = google.com:8443 ;engineId = pkcs11 cert = pkcs11:token=MyToken;object=MyCert key = pkcs11:token=MyToken;object=MyKey But, it show me configuration error. How can I solve it? Thank you.

1 0

Stunnel - how to block IPs?
by Brent Kimberley 04 Sep '20

04 Sep '20

Hi James.To the best of my knowledge, your options include Darwin firewall and HAProxy - geoip. >>Just wondering if there is a way to have Stunnel not accept connection from certain IPs? stunnel -version stunnel 5.56 on x86_64-apple-darwin18.7.0 platform Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI

1 0

Stunnel - how to block IPs?
by James Brown 03 Sep '20

03 Sep '20

Just wondering if there is a way to have Stunnel not accept connection from certain IPs? stunnel -version stunnel 5.56 on x86_64-apple-darwin18.7.0 platform Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Thanks, James.

1 0

TLS1.0 fallback when only TLS1.2 allowed
by Wojciech Machula 31 Aug '20

31 Aug '20

So I've configured my stunnel to only use TLS1.2 and usually works ok. However when client gets some bad L7 response it send a TCP RST, after which all subsequent stunnel TLS Client Hellos are some hybrid of TLS1.0/TLS1.2, as can be seen in tshark output below. Once I restart the whole stunnel process subsequent TLS handshakes work fine using TLS1.2, until the next client RST is received. $ stunnel -version stunnel 4.56 on x86_64-redhat-linux-gnu platform $ cat /etc/centos-release CentOS Linux release 7.8.2003 (Core) $cat /etc/stunnel/dsr2rtcg-stunnel.conf output = /var/log/stunnel pid = /etc/stunnel/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [poc] cert = /etc/pki/tls/certs/stunnel/aaa.crt key = /etc/pki/tls/private/stunnel/aaa.key CAfile = /etc/pki/tls/certs/stunnel/bbb.crt client = yes sslVersion = TLSv1.2 options = NO_TLSv1 accept = 172.18.180.78:45154 connect = 10.74.0.196:45154 ciphers = TLSv1.2+HIGH:!aNULL $ tshark -nn -V -d tcp.port==45154,ssl -r 20200729_09:42:44-port45154.pcap -2R "ssl.handshake" -c 1 | grep -i tls -B3 Secure Sockets Layer SSL Record Layer: Handshake Protocol: Client Hello Content Type: Handshake (22) Version: TLS 1.0 (0x0301) -- Handshake Protocol: Client Hello Handshake Type: Client Hello (1) Length: 1610 Version: TLS 1.2 (0x0303)

6 14

Sslkeylog
by Brent Kimberley 22 Aug '20

22 Aug '20

>>Any suggestions on sslkeylog via stunnel application Call SSL_CTX_set_keylog_callback() !? On Thu, Aug 13, 2020, 16:44 tayyib ahmed <tayyib76(a)gmail.com> wrote: > Hi Guys > > Is there any option to set sslkeylog to get ssl session id for stunnel > session? > > Br xx >

2 2

How to archive DNS load balance in stunnel client?
by Peter Zhao 22 Aug '20

22 Aug '20

Hi, We are trying to use DNS load balance in a stunnel client with round-robin algorithm. service.example.com is mapping to two ips. But when we update DNS to remove one of ips for service.example.com stunnel client still forward requests to both ips. How to make stunnel client to resolve domain name and refresh its cache? Here is stunnel configuration. sslVersion=TLSv1.2 cert = /etc/stunnel/stunnel.pem output=/var/log/stunnel.log [service-client] client = yes accept = localhost:4680 connect = service.example.com:4680 [service-server] client = no accept = 10.10.0.16:4680 connect = loclhost:80 Here is the resolving result for service.example.com. ;; ANSWER SECTION: service.example.com. 5 IN A 10.10.0.16 service.example.com. 5 IN A 10.10.0.8

3 3