I have a client and a server where the client isn't very good and the
server requires a MASSL (Mutual Auth SSL aka client certificate
authenticated) connection. I need to get one of two things to work.
Either:
1) The client makes a non-SSL connection to stunnel on the local machine
which then performs a MASSL connection to the server using a client
certificate or
2) The client makes a plain SSL connection to stunnel on the local machine
which then performs a MASSL connection to the server using a client
certificate.
Can stunnel be used in this manner?
If so, would someone please give me some hints on configuration?
For extra credit, it would be awesome if the client private key were stored
in a pkcs11 device (HSM).
Thank you,
--Jason
1
0
Greetings,
Running stunnel 5.25 latest beta (2015-10-15), but also had the same
issues on 5.24 final.
My config file looks like this:
debug = debug
output = xxxxx
client = yes
cert = stunnel.pem
[outlook-smtp]
accept = 127.0.0.1:25
connect = smtp-mail.outlook.com:587
protocol = smtp
;protocolUsername = xxxx
;protocolPassword = xxxx
CAfile = ca-certs.pem
checkHost = smtp-mail.outlook.com
OCSPaia = yes
verify = 2
I am testing functionality to make sure that I am able to send mail
with my Outlook.com address. I currently have User/Pass field
commented out, but I've tried with them not commented out, and the
actual values instead of "xxxx" (the app I'm using has fields for
username and password).
My log:
2015.10.15 11:01:24 LOG7[cron]: Cron started
2015.10.15 11:01:24 LOG7[main]: No limit detected for the number of clients
2015.10.15 11:01:24 LOG5[main]: stunnel 5.25 on x86-pc-msvc-1500 platform
2015.10.15 11:01:24 LOG5[main]: Compiled/running with OpenSSL
1.0.2d-fips 9 Jul 2015
2015.10.15 11:01:24 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6
TLS:ENGINE,FIPS,OCSP,PSK,SNI
2015.10.15 11:01:24 LOG7[main]: errno: (*_errno())
2015.10.15 11:01:24 LOG7[ui]: GUI message loop initialized
2015.10.15 11:01:24 LOG5[main]: Reading configuration from file stunnel.conf
2015.10.15 11:01:24 LOG5[main]: UTF-8 byte order mark detected
2015.10.15 11:01:24 LOG5[main]: FIPS mode disabled
2015.10.15 11:01:24 LOG7[main]: Compression disabled
2015.10.15 11:01:24 LOG7[main]: PRNG seeded successfully
2015.10.15 11:01:24 LOG6[main]: Initializing service [outlook-smtp]
2015.10.15 11:01:24 LOG6[main]: Loading certificate from file: stunnel.pem
2015.10.15 11:01:24 LOG6[main]: Loading key from file: stunnel.pem
2015.10.15 11:01:24 LOG7[main]: Private key check succeeded
2015.10.15 11:01:24 LOG7[main]: SSL options: 0x03000004 (+0x03000000,
-0x00000000)
2015.10.15 11:01:24 LOG5[main]: Configuration successful
2015.10.15 11:01:24 LOG7[main]: Listening file descriptor created (FD=652)
2015.10.15 11:01:24 LOG7[main]: Service [outlook-smtp] (FD=652) bound
to 127.0.0.1:25
2015.10.15 11:01:31 LOG7[main]: Found 1 ready file descriptor(s)
2015.10.15 11:01:31 LOG7[main]: FD=408 ifds=r-x ofds=---
2015.10.15 11:01:31 LOG7[main]: Service [outlook-smtp] accepted
(FD=692) from 127.0.0.1:58065
2015.10.15 11:01:31 LOG7[main]: Creating a new thread
2015.10.15 11:01:31 LOG7[main]: New thread created
2015.10.15 11:01:31 LOG7[0]: Service [outlook-smtp] started
2015.10.15 11:01:31 LOG5[0]: Service [outlook-smtp] accepted
connection from 127.0.0.1:58065
2015.10.15 11:01:31 LOG6[0]: s_connect: connecting 65.55.176.126:587
2015.10.15 11:01:31 LOG7[0]: s_connect: s_poll_wait 65.55.176.126:587:
waiting 10 seconds
2015.10.15 11:01:31 LOG5[0]: s_connect: connected 65.55.176.126:587
2015.10.15 11:01:31 LOG5[0]: Service [outlook-smtp] connected remote
server from 172.26.1.51:58066
2015.10.15 11:01:31 LOG7[0]: Remote descriptor (FD=704) initialized
2015.10.15 11:01:31 LOG7[0]: <- 220 BLU436-SMTP245.smtp.hotmail.com
Microsoft ESMTP MAIL Service, Version: 8.0.9200.16384 ready at Thu,
15 Oct 2015 08:01:34 -0700
2015.10.15 11:01:31 LOG7[0]: -> 220 BLU436-SMTP245.smtp.hotmail.com
Microsoft ESMTP MAIL Service, Version: 8.0.9200.16384 ready at Thu,
15 Oct 2015 08:01:34 -0700
2015.10.15 11:01:31 LOG7[0]: -> EHLO localhost
2015.10.15 11:01:31 LOG7[0]: <- 250-BLU436-SMTP245.smtp.hotmail.com
Hello [70.90.151.129]
2015.10.15 11:01:31 LOG7[0]: <- 250-TURN
2015.10.15 11:01:31 LOG7[0]: <- 250-SIZE 41943040
2015.10.15 11:01:31 LOG7[0]: <- 250-ETRN
2015.10.15 11:01:31 LOG7[0]: <- 250-PIPELINING
2015.10.15 11:01:31 LOG7[0]: <- 250-DSN
2015.10.15 11:01:31 LOG7[0]: <- 250-ENHANCEDSTATUSCODES
2015.10.15 11:01:31 LOG7[0]: <- 250-8bitmime
2015.10.15 11:01:31 LOG7[0]: <- 250-BINARYMIME
2015.10.15 11:01:31 LOG7[0]: <- 250-CHUNKING
2015.10.15 11:01:31 LOG7[0]: <- 250-VRFY
2015.10.15 11:01:31 LOG7[0]: <- 250-TLS
2015.10.15 11:01:31 LOG7[0]: <- 250-STARTTLS
2015.10.15 11:01:31 LOG7[0]: <- 250 OK
2015.10.15 11:01:31 LOG7[0]: -> STARTTLS
2015.10.15 11:01:31 LOG7[0]: <- 220 2.0.0 SMTP server ready
2015.10.15 11:01:31 LOG6[0]: SNI: sending servername: smtp-mail.outlook.com
2015.10.15 11:01:31 LOG7[0]: SSL state (connect): before/connect initialization
2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv2/v3 write client hello A
2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 read server hello A
2015.10.15 11:01:31 LOG7[0]: Verification started at depth=2: C=BE,
O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA
2015.10.15 11:01:31 LOG7[0]: CERT: Pre-verification succeeded
2015.10.15 11:01:31 LOG7[0]: OCSP: Ignoring root certificate
2015.10.15 11:01:31 LOG6[0]: Certificate accepted at depth=2: C=BE,
O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA
2015.10.15 11:01:31 LOG7[0]: Verification started at depth=1: C=BE,
O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - G2
2015.10.15 11:01:31 LOG7[0]: CERT: Pre-verification succeeded
2015.10.15 11:01:31 LOG5[0]: OCSP: Connecting the AIA responder
"http://ocsp.globalsign.com/rootr1"
2015.10.15 11:01:31 LOG6[0]: s_connect: connecting 108.162.232.204:80
2015.10.15 11:01:31 LOG7[0]: s_connect: s_poll_wait
108.162.232.204:80: waiting 10 seconds
2015.10.15 11:01:31 LOG5[0]: s_connect: connected 108.162.232.204:80
2015.10.15 11:01:31 LOG7[0]: OCSP: Connected ocsp.globalsign.com:80
2015.10.15 11:01:31 LOG7[0]: OCSP: Response received
2015.10.15 11:01:31 LOG6[0]: OCSP: Status: good
2015.10.15 11:01:31 LOG6[0]: OCSP: This update: Oct 15 10:27:35 2015 GMT
2015.10.15 11:01:31 LOG6[0]: OCSP: Next update: Oct 19 10:27:35 2015 GMT
2015.10.15 11:01:31 LOG5[0]: OCSP: Certificate accepted
2015.10.15 11:01:31 LOG6[0]: Certificate accepted at depth=1: C=BE,
O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - G2
2015.10.15 11:01:31 LOG7[0]: Verification started at depth=0: C=US,
ST=Washington, L=Redmond, O=Microsoft Corporation, CN=*.hotmail.com
2015.10.15 11:01:31 LOG7[0]: CERT: Pre-verification succeeded
2015.10.15 11:01:31 LOG6[0]: CERT: Host name "smtp-mail.outlook.com"
matched with "*.outlook.com"
2015.10.15 11:01:31 LOG5[0]: OCSP: Connecting the AIA responder
"http://ocsp2.globalsign.com/gsorganizationvalg2"
2015.10.15 11:01:31 LOG6[0]: s_connect: connecting 108.162.232.196:80
2015.10.15 11:01:31 LOG7[0]: s_connect: s_poll_wait
108.162.232.196:80: waiting 10 seconds
2015.10.15 11:01:31 LOG5[0]: s_connect: connected 108.162.232.196:80
2015.10.15 11:01:31 LOG7[0]: OCSP: Connected ocsp2.globalsign.com:80
2015.10.15 11:01:31 LOG7[0]: OCSP: Response received
2015.10.15 11:01:31 LOG6[0]: OCSP: Status: good
2015.10.15 11:01:31 LOG6[0]: OCSP: This update: Oct 15 08:26:15 2015 GMT
2015.10.15 11:01:31 LOG6[0]: OCSP: Next update: Oct 16 08:26:15 2015 GMT
2015.10.15 11:01:31 LOG5[0]: OCSP: Certificate accepted
2015.10.15 11:01:31 LOG5[0]: Certificate accepted at depth=0: C=US,
ST=Washington, L=Redmond, O=Microsoft Corporation, CN=*.hotmail.com
2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 read server
certificate A
2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 read server
key exchange A
2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 read server done A
2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 write client
key exchange A
2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 write change
cipher spec A
2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 write finished A
2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 flush data
2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 read finished A
2015.10.15 11:01:31 LOG7[0]: 1 client connect(s) requested
2015.10.15 11:01:31 LOG7[0]: 1 client connect(s) succeeded
2015.10.15 11:01:31 LOG7[0]: 0 client renegotiation(s) requested
2015.10.15 11:01:31 LOG7[0]: 0 session reuse(s)
2015.10.15 11:01:31 LOG6[0]: SSL connected: new session negotiated
2015.10.15 11:01:31 LOG7[0]: Peer certificate was cached (3461 bytes)
2015.10.15 11:01:31 LOG6[0]: Negotiated TLSv1.2 ciphersuite
ECDHE-RSA-AES256-SHA384 (256-bit encryption)
2015.10.15 11:01:31 LOG7[0]: Compression: null, expansion: null
2015.10.15 11:01:31 LOG6[0]: SSL socket closed (SSL_read)
2015.10.15 11:01:31 LOG7[0]: Sent socket write shutdown
2015.10.15 11:01:31 LOG5[0]: Connection closed: 139 byte(s) sent to
SSL, 351 byte(s) sent to socket
2015.10.15 11:01:31 LOG7[0]: Remote descriptor (FD=704) closed
2015.10.15 11:01:31 LOG7[0]: Local descriptor (FD=692) closed
2015.10.15 11:01:31 LOG7[0]: Service [outlook-smtp] finished (0 left)
I don't see any errors in the log, but Outlook is reporting an
incorrect password on the security section of my Microsoft Account.
More specifically, I'm seeing error 5.7.3: Requested action aborted,
user not authenticated," I know the password works because I set it up
as an account in Outlook 2010 and tested sending the email. It works
great. I am using 2FA with an app-specific password. But I have also
tried without 2FA. I am 100% certain the account name xxxx(a)outlook.com
and the password are correct. As far as the config file goes, I've
tried just about everything I could find on Google. Nothing works,
always the same error message.
I also experienced similar failures with Gmail.
Any ideas?
2
1
prng_init() is failing in 5.24 when cross-compiling with openssl due to
a combination of two reasons:
1. The --with-random configure option is not supported when cross
compiling.
2. The hardcoded /dev/urandom is no longer used if OPENSSL_NO_EGD is not
defined.
The following patch reverts the behaviour to how it was in 5.23, but
probably the --with-random configure option should be supported too.
--- stunnel-5.25.orig/src/ssl.c
+++ stunnel-5.25/src/ssl.c
@@ -207,7 +207,8 @@ NOEXPORT int prng_init(GLOBAL_OPTIONS *g
return 0; /* success */
}
s_log(LOG_DEBUG, "RAND_screen failed to sufficiently seed PRNG");
-#elif !defined(OPENSSL_NO_EGD)
+#else
+#ifndef OPENSSL_NO_EGD
if(global->egd_sock) {
if((bytes=RAND_egd(global->egd_sock))==-1) {
s_log(LOG_WARNING, "EGD Socket %s failed", global->egd_sock);
@@ -220,7 +221,7 @@ NOEXPORT int prng_init(GLOBAL_OPTIONS *g
so no need to check if seeded sufficiently */
}
}
-#else
+#endif
/* try the good-old default /dev/urandom, if available */
totbytes+=add_rand_file(global, "/dev/urandom");
if(RAND_status())
2
1
POSIX requires that multi-threaded processes only use async-signal-safe
functions after calling fork(). For more info on the problems this
avoids, see the rationale at:
http://pubs.opengroup.org/onlinepubs/9699919799/functions/pthread_atfork.ht…
The specific problem this patch solves is that, when there are multiple
simultaneous requests, stunnel is often hanging on a futex syscall when
a child process calls free as a result of tls_alloc().
This problem is experienced when using uClibc. I haven't tested, but I
believe the malloc implementation in glibc does not have this problem.
--- stunnel-5.24.orig/src/client.c
+++ stunnel-5.24/src/client.c
@@ -1100,6 +1100,8 @@ NOEXPORT SOCKET connect_local(CLI *c) {
NOEXPORT SOCKET connect_local(CLI *c) { /* spawn local process */
char *name, host[40], port[6];
+ char *env[10];
+ int i, envc;
int fd[2], pid;
X509 *peer_cert;
#ifdef HAVE_PTHREAD_SIGMASK
@@ -1115,19 +1117,55 @@ NOEXPORT SOCKET connect_local(CLI *c) {
} else
if(make_sockets(fd))
longjmp(c->err, 1);
+ set_nonblock(fd[1], 0); /* switch back to blocking mode */
+
+ envc = 0;
+
+ if(!getnameinfo(&c->peer_addr.sa, c->peer_addr_len,
+ host, 40, port, 6, NI_NUMERICHOST|NI_NUMERICSERV)) {
+ /* just don't set these variables if getnameinfo() fails */
+ env[envc++] = str_printf("REMOTE_HOST=%s", host);
+ env[envc++] = str_printf("REMOTE_PORT=%s", port);
+ if(c->opt->option.transparent_src) {
+#ifndef LIBDIR
+#define LIBDIR "."
+#endif
+#ifdef MACH64
+ env[envc++] = str_dup("LD_PRELOAD_32=" LIBDIR "/libstunnel.so");
+ env[envc++] = str_dup("LD_PRELOAD_64=" LIBDIR "/" MACH64 "/libstunnel.so");
+#elif __osf /* for Tru64 _RLD_LIST is used instead */
+ env[envc++] = str_dup("_RLD_LIST=" LIBDIR "/libstunnel.so:DEFAULT");
+#else
+ env[envc++] = str_dup("LD_PRELOAD=" LIBDIR "/libstunnel.so");
+#endif
+ }
+ }
+
+ if(c->ssl) {
+ peer_cert=SSL_get_peer_certificate(c->ssl);
+ if(peer_cert) {
+ name=X509_NAME2text(X509_get_subject_name(peer_cert));
+ env[envc++] = str_printf("SSL_CLIENT_DN=%s", name);
+ name=X509_NAME2text(X509_get_issuer_name(peer_cert));
+ env[envc++] = str_printf("SSL_CLIENT_I_DN=%s", name);
+ X509_free(peer_cert);
+ }
+ }
+
+ env[envc] = NULL;
pid=fork();
c->pid=(unsigned long)pid;
switch(pid) {
case -1: /* error */
+ for (i = 0; i < envc; i++)
+ str_free(env[i]);
closesocket(fd[0]);
closesocket(fd[1]);
ioerror("fork");
longjmp(c->err, 1);
case 0: /* child */
- tls_alloc(NULL, c->tls, NULL); /* reuse thread-local storage */
closesocket(fd[0]);
- set_nonblock(fd[1], 0); /* switch back to blocking mode */
/* dup2() does not copy FD_CLOEXEC flag */
dup2(fd[1], 0);
dup2(fd[1], 1);
@@ -1135,36 +1173,6 @@ NOEXPORT SOCKET connect_local(CLI *c) {
dup2(fd[1], 2);
closesocket(fd[1]); /* not really needed due to FD_CLOEXEC */
- if(!getnameinfo(&c->peer_addr.sa, c->peer_addr_len,
- host, 40, port, 6, NI_NUMERICHOST|NI_NUMERICSERV)) {
- /* just don't set these variables if getnameinfo() fails */
- putenv(str_printf("REMOTE_HOST=%s", host));
- putenv(str_printf("REMOTE_PORT=%s", port));
- if(c->opt->option.transparent_src) {
-#ifndef LIBDIR
-#define LIBDIR "."
-#endif
-#ifdef MACH64
- putenv("LD_PRELOAD_32=" LIBDIR "/libstunnel.so");
- putenv("LD_PRELOAD_64=" LIBDIR "/" MACH64 "/libstunnel.so");
-#elif __osf /* for Tru64 _RLD_LIST is used instead */
- putenv("_RLD_LIST=" LIBDIR "/libstunnel.so:DEFAULT");
-#else
- putenv("LD_PRELOAD=" LIBDIR "/libstunnel.so");
-#endif
- }
- }
-
- if(c->ssl) {
- peer_cert=SSL_get_peer_certificate(c->ssl);
- if(peer_cert) {
- name=X509_NAME2text(X509_get_subject_name(peer_cert));
- putenv(str_printf("SSL_CLIENT_DN=%s", name));
- name=X509_NAME2text(X509_get_issuer_name(peer_cert));
- putenv(str_printf("SSL_CLIENT_I_DN=%s", name));
- X509_free(peer_cert);
- }
- }
#ifdef HAVE_PTHREAD_SIGMASK
sigemptyset(&newmask);
sigprocmask(SIG_SETMASK, &newmask, NULL);
@@ -1176,11 +1184,13 @@ NOEXPORT SOCKET connect_local(CLI *c) {
signal(SIGTERM, SIG_DFL);
signal(SIGQUIT, SIG_DFL);
signal(SIGINT, SIG_DFL);
- execvp(c->opt->exec_name, c->opt->exec_args);
+ execve(c->opt->exec_name, c->opt->exec_args, env);
ioerror(c->opt->exec_name); /* execvp failed */
_exit(1);
default: /* parent */
s_log(LOG_INFO, "Local mode child started (PID=%lu)", c->pid);
+ for (i = 0; i < envc; i++)
+ str_free(env[i]);
closesocket(fd[1]);
return fd[0];
}
2
2
Some good news, I remove client = yes as you suggested:
2015.10.09 12:39:29 LOG5[main]: Configuration successful
2015.10.09 12:39:29 LOG5[main]: Logging to
C:\Users\adrianmihalko\AppData\Local\stunnel.log
2015.10.09 12:39:34 LOG6[57]: SSL socket closed (SSL_read)
2015.10.09 12:39:34 LOG5[57]: Connection closed: 0 byte(s) sent to SSL, 445
byte(s) sent to socket
2015.10.09 12:39:34 LOG5[60]: Service [myservice] accepted connection from
192.168.1.25:49671
2015.10.09 12:39:34 LOG6[60]: SSL accepted: new session negotiated
2015.10.09 12:39:34 LOG6[60]: No peer certificate received
2015.10.09 12:39:34 LOG6[60]: Negotiated TLSv1.2 ciphersuite
ECDHE-RSA-AES128-GCM-SHA256 (128-bit encryption)
2015.10.09 12:39:34 LOG6[60]: failover: round-robin, starting at entry #0
2015.10.09 12:39:34 LOG6[60]: s_connect: connecting ::1:41952
2015.10.09 12:39:34 LOG5[60]: s_connect: connected ::1:41952
2015.10.09 12:39:34 LOG6[60]: persistence: ::1:41952 cached
2015.10.09 12:39:34 LOG5[60]: Service [myservice] connected remote server
from ::1:50598
2015.10.09 12:39:34 LOG6[60]: SSL socket closed (SSL_read)
2015.10.09 12:39:34 LOG5[60]: Connection closed: 0 byte(s) sent to SSL, 0
byte(s) sent to socket
2015.10.09 12:39:34 LOG5[61]: Service [myservice] accepted connection from
192.168.1.25:49672
2015.10.09 12:39:34 LOG6[61]: SSL accepted: new session negotiated
2015.10.09 12:39:34 LOG6[61]: No peer certificate received
2015.10.09 12:39:34 LOG6[61]: Negotiated TLSv1.2 ciphersuite
ECDHE-RSA-AES128-GCM-SHA256 (128-bit encryption)
2015.10.09 12:39:34 LOG6[61]: failover: round-robin, starting at entry #1
2015.10.09 12:39:34 LOG6[61]: s_connect: connecting 127.0.0.1:41952
2015.10.09 12:39:34 LOG5[61]: s_connect: connected 127.0.0.1:41952
2015.10.09 12:39:34 LOG6[61]: persistence: 127.0.0.1:41952 cached
2015.10.09 12:39:34 LOG5[61]: Service [myservice] connected remote server
from 127.0.0.1:50599
openssl_client log:
http://pastebin.com/7bg3sf7J
The problem is now that the site loads forever, nothing happens.
(this certificate (:1988) is other than the original (:41952). This is not
problem?
curl test:
$ curl https://192.168.1.17:1988/DYMO/DLS/Printing/Check -vk
* Trying 192.168.1.17...
* Connected to 192.168.1.17 (192.168.1.17) port 1988 (#0)
* TLS 1.2 connection using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
* Server certificate: localhost
> GET /DYMO/DLS/Printing/Check HTTP/1.1
> Host: 192.168.1.17:1988
> User-Agent: curl/7.43.0
> Accept: */*
>
waiting forever.
2015-10-09 12:34 GMT+02:00 Adrián Mihálko <adriankoooo(a)gmail.com>:
> In the first mail I wrote ports bad, of course in the log I am using the
> good ones.
>
> [myservice]
> cert = stunnel.pem
> client = yes
> accept = 0.0.0.0:1988
> connect = localhost:41952
>
>
> 2015-10-09 12:32 GMT+02:00 Adrián Mihálko <adriankoooo(a)gmail.com>:
>
>> Sorry, curl was only for testing.
>>
>> Adrians-MacBook-Pro:~ adrianmihalko$ openssl s_client -connect
>> 192.168.1.17:1988
>> CONNECTED(00000003)
>> 1130:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown
>> protocol:/BuildRoot/Library/Caches/com.apple.xbs/Sources/OpenSSL098/OpenSSL098-59/src/ssl/s23_clnt.c:618:
>>
>> 2015.10.09 12:23:21 LOG5[main]: Reading configuration from file
>> stunnel.conf
>> 2015.10.09 12:23:21 LOG5[main]: UTF-8 byte order mark detected
>> 2015.10.09 12:23:21 LOG5[main]: FIPS mode disabled
>> 2015.10.09 12:23:21 LOG6[main]: Initializing service [gmail-pop3]
>> 2015.10.09 12:23:21 LOG6[main]: Initializing service [gmail-imap]
>> 2015.10.09 12:23:21 LOG6[main]: Initializing service [gmail-smtp]
>> 2015.10.09 12:23:21 LOG6[main]: Initializing service [myservice]
>> 2015.10.09 12:23:21 LOG6[main]: Loading certificate from file: stunnel.pem
>> 2015.10.09 12:23:21 LOG6[main]: Loading key from file: stunnel.pem
>> 2015.10.09 12:23:21 LOG4[main]: Service [myservice] needs authentication
>> to prevent MITM attacks
>> 2015.10.09 12:23:21 LOG5[main]: Configuration successful
>> 2015.10.09 12:23:21 LOG5[main]: Logging to
>> C:\Users\adrianmihalko\AppData\Local\stunnel.log
>> 2015.10.09 12:23:42 LOG5[39]: Service [myservice] accepted connection
>> from 192.168.1.25:49454
>> 2015.10.09 12:23:42 LOG6[39]: failover: round-robin, starting at entry #0
>> 2015.10.09 12:23:42 LOG6[39]: s_connect: connecting ::1:41952
>> 2015.10.09 12:23:42 LOG5[39]: s_connect: connected ::1:41952
>> 2015.10.09 12:23:42 LOG5[39]: Service [myservice] connected remote server
>> from ::1:50564
>> 2015.10.09 12:23:42 LOG6[39]: SNI: sending servername: localhost
>> 2015.10.09 12:23:42 LOG6[39]: Certificate verification disabled
>> 2015.10.09 12:23:42 LOG6[39]: Certificate verification disabled
>> 2015.10.09 12:23:42 LOG6[39]: SSL connected: new session negotiated
>> 2015.10.09 12:23:42 LOG6[39]: Negotiated TLSv1 ciphersuite AES128-SHA
>> (128-bit encryption)
>> 2015.10.09 12:23:42 LOG6[39]: SSL socket closed (SSL_read)
>> 2015.10.09 12:23:42 LOG5[39]: Connection closed: 130 byte(s) sent to SSL,
>> 505 byte(s) sent to socket
>>
>> If I am connecting to the :41952:
>>
>> openssl s_client -connect 192.168.1.17:41952
>> ...
>>
>> ---
>> No client certificate CA names sent
>> ---
>> SSL handshake has read 1724 bytes and written 712 bytes
>> ---
>> New, TLSv1/SSLv3, Cipher is AES128-SHA
>> Server public key is 4096 bit
>> Secure Renegotiation IS supported
>> Compression: NONE
>> Expansion: NONE
>> SSL-Session:
>> Protocol : TLSv1
>> Cipher : AES128-SHA
>> ...
>>
>>
>> 2015-10-09 10:55 GMT+02:00 test rig <testrig(a)z1p.biz>:
>>
>>>
>>> Ouch #2 missing...
>>>
>>> Hi Adrian, looks good to me so far - mostly. Try to replace the
>>> client=yes with a client=no on the server
>>>
>>> You are connection to :9999 with curl(?)
>>> Try verify it via "openssl s_client -connect yourserverip:1988" command
>>>
>>> Best Regards
>>> Michael
>>>
>>> --- Ursprüngliche Nachricht ---
>>> *Von:* "test rig" <testrig(a)z1p.biz>
>>> *Datum:* 09.10.2015 09:48:02
>>> *An:* "stunnel-users(a)stunnel.org." <stunnel-users(a)stunnel.org>
>>> *Betreff:* Re: [stunnel-users] (no subject)
>>>
>>> Hi Adrian, looks good to me so far - mostly. Try to replace the
>>> client=yes with a client=no on the server
>>>
>>> --- Ursprüngliche Nachricht ---
>>> *Von:* Adrián Mihálko
>>> *Datum:* 09.10.2015 08:15:19
>>> *An:* stunnel-users(a)stunnel.org
>>> *Betreff:* [stunnel-users] (no subject)
>>>
>>> Dear stunnel users,
>>>
>>> I have a little service which listen only on https://localhost:4952 and
>>> checks source hostname. I want to connect on "listen:1988" and redirect
>>> requests with stunnel to "localhost:4952"
>>>
>>> https://192.168.1.10:1988 -> redirect https://localhost:4952
>>>
>>>
>>> I am trying to configure stunnel like this
>>>
>>> [myservice]
>>> cert = stunnel.pem
>>> client = yes
>>> accept = 0.0.0.0:1988
>>> connect = localhost:4952
>>>
>>> remote machine$ curl https://192.168.1.25:9999/DYMO/DLS/Printing/Check
>>> -v
>>> * Trying 192.168.1.25...
>>> * Connected to 192.168.1.25 (192.168.1.25) port 9999 (#0)
>>> * WARNING: using IP address, SNI is being disabled by the OS.
>>> * Unknown SSL protocol error in connection to 192.168.1.25:-9847
>>> * Closing connection 0
>>> curl: (35) Unknown SSL protocol error in connection to 192.168.1.25:
>>> -9847
>>>
>>> stunnel.log:
>>> 2015.10.09 09:05:42 LOG5[38]: Service [myservice] accepted connection
>>> from 192.168.1.24:60748
>>> 2015.10.09 09:05:42 LOG6[38]: failover: round-robin, starting at entry #1
>>> 2015.10.09 09:05:42 LOG6[38]: s_connect: connecting 127.0.0.1:41952
>>> 2015.10.09 09:05:42 LOG5[38]: s_connect: connected 127.0.0.1:41952
>>> 2015.10.09 09:05:42 LOG5[38]: Service [myservice] connected remote
>>> server from 127.0.0.1:50503
>>> 2015.10.09 09:05:42 LOG6[38]: SNI: sending servername: localhost
>>> 2015.10.09 09:05:42 LOG6[38]: Certificate verification disabled
>>> 2015.10.09 09:05:42 LOG6[38]: Certificate verification disabled
>>> 2015.10.09 09:05:42 LOG6[38]: SSL connected: new session negotiated
>>> 2015.10.09 09:05:42 LOG6[38]: Negotiated TLSv1 ciphersuite AES128-SHA
>>> (128-bit encryption)
>>> 2015.10.09 09:05:42 LOG6[38]: SSL socket closed (SSL_read)
>>> 2015.10.09 09:05:42 LOG5[38]: Connection closed: 230 byte(s) sent to
>>> SSL, 505 byte(s) sent to socket
>>>
>>> I am tried verify = 1 to 4, either works. :(
>>>
>>> Best Regards,
>>> Adrian
>>>
>>>
>>>
>>> ______________________________________________________
>>> powered by Perfect-Privacy.com / Secure-Mail.biz - anonymous and secure
>>> internet.
>>>
>>>
>>>
>>> ______________________________________________________
>>> powered by Perfect-Privacy.com / Secure-Mail.biz - anonymous and secure
>>> internet.
>>>
>>> _______________________________________________
>>> stunnel-users mailing list
>>> stunnel-users(a)stunnel.org
>>> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users
>>>
>>>
>>
>
3
6
Dear stunnel users,
I have a little service which listen only on https://localhost:4952 and
checks source hostname. I want to connect on "listen:1988" and redirect
requests with stunnel to "localhost:4952"
https://192.168.1.10:1988 -> redirect https://localhost:4952
I am trying to configure stunnel like this
[myservice]
cert = stunnel.pem
client = yes
accept = 0.0.0.0:1988
connect = localhost:4952
remote machine$ curl https://192.168.1.25:9999/DYMO/DLS/Printing/Check -v
* Trying 192.168.1.25...
* Connected to 192.168.1.25 (192.168.1.25) port 9999 (#0)
* WARNING: using IP address, SNI is being disabled by the OS.
* Unknown SSL protocol error in connection to 192.168.1.25:-9847
* Closing connection 0
curl: (35) Unknown SSL protocol error in connection to 192.168.1.25:-9847
stunnel.log:
2015.10.09 09:05:42 LOG5[38]: Service [myservice] accepted connection from
192.168.1.24:60748
2015.10.09 09:05:42 LOG6[38]: failover: round-robin, starting at entry #1
2015.10.09 09:05:42 LOG6[38]: s_connect: connecting 127.0.0.1:41952
2015.10.09 09:05:42 LOG5[38]: s_connect: connected 127.0.0.1:41952
2015.10.09 09:05:42 LOG5[38]: Service [myservice] connected remote server
from 127.0.0.1:50503
2015.10.09 09:05:42 LOG6[38]: SNI: sending servername: localhost
2015.10.09 09:05:42 LOG6[38]: Certificate verification disabled
2015.10.09 09:05:42 LOG6[38]: Certificate verification disabled
2015.10.09 09:05:42 LOG6[38]: SSL connected: new session negotiated
2015.10.09 09:05:42 LOG6[38]: Negotiated TLSv1 ciphersuite AES128-SHA
(128-bit encryption)
2015.10.09 09:05:42 LOG6[38]: SSL socket closed (SSL_read)
2015.10.09 09:05:42 LOG5[38]: Connection closed: 230 byte(s) sent to SSL,
505 byte(s) sent to socket
I am tried verify = 1 to 4, either works. :(
Best Regards,
Adrian
2
3
2
2
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Dear Users,
I have released version 5.24 of stunnel.
The ChangeLog entry:
Version 5.24, 2015.10.08, urgency: MEDIUM
* New features
- Custom CRL verification was replaced with the internal
OpenSSL functionality.
- *BSD support for "transparent = destination" and
client-side "protocol = socks". This feature should
work at least on FreeBSD, OpenBSD and OS X.
- Added a new "protocolDomain" option for the NTLM
authentication (thx to Andreas Botsikas).
- Improved compatibility of the NTLM phase 1 message (thx
to Andreas Botsikas).
- "setuid" and "setgid" options are now also available
in service sections. They can be used to set owner
and group of the Unix socket specified with "accept".
- Added support for the new OpenSSL 1.0.2 SSL options.
- Added OPENSSL_NO_EGD support (thx to Bernard Spil).
- VC autodetection added to makew32.bat (thx to Andreas
Botsikas).
* Bugfixes
- Fixed the RESOLVE [F0] TOR extension support in SOCKS5.
- Fixed the error code reported on the failed bind()
requests.
- Fixed the sequential log id with the FORK threading.
- Restored the missing Microsoft.VC90.CRT.manifest file.
Home page: https://www.stunnel.org/
Download: https://www.stunnel.org/downloads.html
SHA-256 hashes:
ab2e5a1034d422951ddad21b572eb7fa8efb4c4ce04bc86536c6845f3d02b07e
stunnel-5.24.tar.gz
f6c38d51c2708f3eddbad651091bf0b59e4149a1d0c1e3b227b033f126c6dbee
stunnel-5.24-installer.exe
ed2a2c5f280970bd5f5efcecbc1dbbd06f66efb68102af31c27d33e3beb48bb5
stunnel-5.24-android.zip
Best regards,
Mike
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAEBCAAGBQJWFoHsAAoJEC78f/DUFuAUQrAP/iUz2fHvvjkIcJvoR2kMeJfZ
NFHE/zGIP6qHbf5Fe5SvOA/ygzQcBppa+FJN9S0uL5z0rLkDghqeWoFzPfLIVrfM
y2IJ4SZ1HEESyjaZkCxY0C7Ow1kKdlMPLHv81p+Tk/Zm4qKJ/lIkP+q7XMbNmWjW
BOYBLeWPtro1OjKm7v07VkzRGJupj1PHjUgPDAQRxdzqsl6fO7xY9n8b9Nh7Cwc2
1mJhsx8J40M7abftYwpG6Mycu2EOo0lIJ9rm6xZahyekzatsaIhlw2o5gx5GWJvN
xj9zpkxntTVQysgP4QVdJZ+Kl17ZZmOS4k+3OqXDgdt51Ck2ty46y9NbhkulIUA8
BzH3KXZCaiBFb/sPdBtW8qmvv0azJLR0b1HfKsZQrtIB/SH0slB9rgsLkidjekKG
n7FHf5dlncfAbf8KstJRv41PTYcbtQMGI/+sre2YsqG2/MSJgPfCL2Wj0bTOSmOR
7t6jHX6SItnWtAJ4+3yhlh33B4WYOYBbu3FA3Pw7Wgxur9AOV63MH/Mf96KdMFGS
dqoLQh+fp/KoSw1A9OUREtQnxHnbF5MMoU4Z1pTO0FxvdCMnYCg4okiwLqbOKcuM
J0T543Deq9XU7v9jDkcgUyQzBYU8lG+G9UdSH11B8phuP7pBUQ35cd62Fl9NWv9I
zNjRZIOnbBp6F6hqilb4
=F+az
-----END PGP SIGNATURE-----
1
0
Hi,
I am a new STUNNEL user, so I apologize if this is a ridiculously simple and insignificant problem.
I have STUNNEL running in a Windows 7 (32 bit) environment, and have the following in stunnel.conf:
output = C:\STUNNEL\stunnel.log
log = append
The log file is placed where I've asked, but the contents represent only the most current STUNNEL execution.
I am trying to have a running log in this file.
STUNNEL is, of course, doing what it is supposed to do, it is only the logging that has me puzzled.
Thanks, in advance.
2
1
Just downloaded and installed the latest windows version. When trying to
run stunnel I get the following error: The application has failed to start
because its side-by-side configuration is incorrect..... When I check the
application event view logs I see "Activation context generation failed for
"C:\Program Files (x86)\stunnel\bin\stunnel.exe". Dependent Assembly
Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"
could not be found. Please use sxstrace.exe for detailed diagnosis."
It seems I might be missing a pre-req but I can't not determine what that
is. Any ideas?
Thanks,
Chris
1
0