- stunnel-users - stunnel.org

stunnel port question
by Stewart Anderson 13 Feb '13

13 Feb '13

Hi all, ty in advance for any help. I have a service that I can connect to a destination over stunnel, but I am not able to get the ack I expect. Internal sending service => stunnel => external listening service I think the problem may be that the firewall is blocking inbound traffic. I need to specify a specific port for the firewall team to open so that traffic can get back to my stunnel service, since every time stunnel starts it will be making a connection from a different port on the external facing side of the SSL encapsulation service/pipe/whatever you want to call it!! What would be the best way to configure stunnel for that scenario. I can see the INETD mode but that does not seem to be what I am looking for, I can also see the transparent option but not sure what that really does. Any advice appreciated. Regards Stewart Your Hospital needs YOU! We need you to register as a Public, Patient or Staff member and help shape the future of your healthcare. Call 0800 280 2581 to register by phone or you can email bradfordhospitals(a)capitaregistrars.com<mailto:[email protected]> and ask to be registered as a new member. For more information about our hospitals and Foundation Trust Membership please visit www.bradfordhospitals.nhs.uk<http://www.bradfordhospitals.nhs.uk> This message is confidential. It may also contain privileged information. The contents of this e-mail and any attachments are intended for the named addressee only. Unless you are the named addressee or authorised to receive the e-mail of the named addressee you may not disclose, use or copy the contents of the e-mail. If you are not the person for whom the message was intended, please notify the sender immediately at Bradford Teaching Hospitals NHS Foundation Trust and delete the material from your computer. You must not use the message for any other purpose, nor disclose its contents to any person other than the intended recipient. Bradford Teaching Hospitals NHS Foundation Trust does not accept responsibility for this message and any views or opinions contained in this e-mail are solely those of the author unless expressly stated otherwise.

1 0

Stunnel over a separate proxy?
by Alex Gottschalk 12 Feb '13

12 Feb '13

I've successfully deployed stunnel4 to wrap rsync for transferring data between remote sites and a central repository. The issue I'm running into, is that some of these sites mandate use of a proxy (HTTP or SOCKS5 usually) for outbound network connections. It seems like there is some proxy support in stunnel with the protocol{Host,Authentication,etc} configuration options, but I have had zero luck getting them to work. For example, I've tried making a simple SOCKS5 proxy using ssh, that I'm successfully able to send HTTP traffic over: ssh -g -D1080 proxy-host # create the proxy, open port 1080 on a public interface then in the client stunnel.conf: [rsync] protocol = connect protocolHost = proxy-host:1080 accept = 127.0.0.1:873 connect = rsync-destination:443 Keep in mind this is an already-working stunnel - the only difference is the addition of the protocol and protocolHost lines above. When I run stunnel in the foreground with that configuration change, I get the following error trying to run rsync: $ rsync -v dev.inst.kvpdata rsync://localhost/putdata/ rsync: read error: Connection reset by peer (104) rsync error: error in rsync protocol data stream (code 12) at io.c(605) [sender=2.6.9] And no log messages appear in stunnel's stderr whatsoever. What am I doing wrong? I get identical results using an HTTP proxy with squid, instead of the socks5 proxy. Thanks, please let me know if there's any more information I should include to help with figuring this out. Alex Gottschalk

3 4

transfer() loop executes not transferring any data and truncated data when using unix sockets
by Stephen Balukoff 08 Feb '13

08 Feb '13

Hello! Recently we started seeing some erroneous behavior in one of our load balancer configurations in which we're using stunnel for SSL tunnel termination with web clients. Specifically, the setup looks like the following: Web client ---(SSL)---> stunnel ---(unix socket)--> haproxy ---(tcp/http)---> web server After extensive troubleshooting we were able to determine that when the following parameters are present: * Client forces non-keepalive connection * Client generates a POST request, the response to which (generated by the back-end web server) is greater than about 8k * stunnel and haproxy communicate via unix socket ...then most responses end up being truncated by an extraneous TCP RST packet from stunnel, and the following log lines are generated: Jan 23 15:24:17 ds420a stunnel: LOG3[22586:139835614443264]: transfer() loop executes not transferring any data Jan 23 15:24:17 ds420a stunnel: LOG3[22586:139835614443264]: please report the problem to Michal.Trojnara(a)mirt.net Jan 23 15:24:17 ds420a stunnel: LOG3[22586:139835614443264]: stunnel 4.54 on x86_64-unknown-linux-gnu platform Jan 23 15:24:17 ds420a stunnel: LOG3[22586:139835614443264]: Compiled/running with OpenSSL 1.0.0-fips 29 Mar 2010 Jan 23 15:24:17 ds420a stunnel: LOG3[22586:139835614443264]: Threading:PTHREAD SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:POLL+IPv6 Jan 23 15:24:17 ds420a stunnel: LOG3[22586:139835614443264]: protocol=TLSv1, SSL_pending=0 Jan 23 15:24:17 ds420a stunnel: LOG3[22586:139835614443264]: sock_open_rd=n, sock_open_wr=Y Jan 23 15:24:17 ds420a stunnel: LOG3[22586:139835614443264]: SSL_RECEIVED_SHUTDOWN=n, SSL_SENT_SHUTDOWN=Y Jan 23 15:24:17 ds420a stunnel: LOG3[22586:139835614443264]: sock_can_rd=Y, sock_can_wr=n Jan 23 15:24:17 ds420a stunnel: LOG3[22586:139835614443264]: ssl_can_rd=n, ssl_can_wr=n Jan 23 15:24:17 ds420a stunnel: LOG3[22586:139835614443264]: read_wants_read=Y, read_wants_write=n Jan 23 15:24:17 ds420a stunnel: LOG3[22586:139835614443264]: write_wants_read=n, write_wants_write=n Jan 23 15:24:17 ds420a stunnel: LOG3[22586:139835614443264]: shutdown_wants_read=n, shutdown_wants_write=n Jan 23 15:24:17 ds420a stunnel: LOG3[22586:139835614443264]: socket input buffer: 0 byte(s), ssl input buffer: 0 byte(s) The work arounds we have found are either: 1. Make stunnel and haproxy communicate over a TCP socket bound to the loopback interface (less ideal, as then we're limited to 65k connections) 2. Add the "reset=no" parameter to our stunnel.conf (which seems to fix the problem, but makes me wonder if we're not opening ourselves up to other problems-- like really getting stuck in an infinite loop that that watchdog is intended to avoid.) In any case based on what "reset=no" is supposed to do as well as where that first line of the error output above is being generated in the code, it's clear that the main client data transfer loop in client.c (starting line 519) is being called too often with no data to transfer, which triggers the infinite loop detection in the transfer() function (client.c, starting line 832). My best hypothesis at this point is that the transfer() code was written only with TCP sockets in mind, and that something about the unix socket in use here is triggering that loop too often. Maybe s_poll_wait on line 541 is being called with parameters which are right for a TCP socket but inappropriate for a unix socket? At this point though, we're at the limit of my socket programming ability, so I'm a little stuck. (Would like to have simply fixed this and submitted a patch... but cest la vie, eh.) We'd like to avoid using a TCP socket to communicate between stunnel and haproxy simply because it's a little less efficient, and because there's an artificial 65k limit on the number of back-end connections we can support per loopback IP if we do that. Alternatively, if someone could verify that "reset=no" is an acceptable / safe work around in this case, I'd appreciate that (though, of course, I'd prefer my logs not to get spammed on every connection. :P ) Is there any other data I can provide to help troubleshoot and fix this? Thanks, Stephen -- Stephen Balukoff Blue Box Group, LLC (800)613-4305 x807

3 3

LZ4
by Death Master 06 Feb '13

06 Feb '13

Do you plan adding LZ4(much faster than gzip) support to stunnel?

2 1

Re: [stunnel-users] fix resource leaks and potential null
by Arthur Mesh 05 Feb '13

05 Feb '13

dereferences in 4.54 Reply-To: In-Reply-To: <mailman.1.1359889202.25775.stunnel-users(a)stunnel.org> On Sun, Feb 03, 2013 at 12:00:02PM +0100, stunnel-users-request(a)stunnel.org wrote: > > - char line_text[CONFLINELEN], *errstr; > > + char line_text[CONFLINELEN], *errstr = NULL; > Were you able to identify a case where it's used without > initialization? This is interesting. > It would be a good idea to fix it there instead of implementing a > workaround here. Hi, I will provide the output of coverity run for these defect: int parse_conf(char *name, CONF_TYPE type) { 1997 DISK_FILE *df; At (1): Declaring variable "errstr" without initializer. 1998 char line_text[CONFLINELEN], *errstr; 1999 char config_line[CONFLINELEN], *config_opt, *config_arg; 2000 int line_number, i; 2001 SERVICE_OPTIONS *section, *new_section; 2002 static char *filename=NULL; /* a copy of config file name for reloading */ 2003#ifndef USE_WIN32 2004 int fd; 2005 char *tmpstr; 2006#endif 2007 At (2): Condition "name", taking true branch 2008 if(name) /* not reload */ 2009 filename=str_dup(name); 2010 At (3): Condition "type == 2U", taking true branch 2011 s_log(LOG_NOTICE, "Reading configuration from %s %s", 2012 type==CONF_FD ? "descriptor" : "file", filename); 2013#ifndef USE_WIN32 At (4): Condition "type == 2U", taking true branch 2014 if(type==CONF_FD) { /* file descriptor */ 2015 fd=strtol(filename, &tmpstr, 10); At (5): Condition "tmpstr == filename", taking false branch At (6): Condition "*tmpstr", taking false branch 2016 if(tmpstr==filename || *tmpstr) { /* not a number */ 2017 s_log(LOG_ERR, "Invalid file descriptor number"); 2018 print_syntax(); 2019 return 1; 2020 } 2021 df=file_fdopen(fd); At (7): Falling through to end of if statement 2022 } else 2023#endif 2024 df=file_open(filename, 0); At (8): Condition "!df", taking false branch 2025 if(!df) { 2026 s_log(LOG_ERR, "Cannot read configuration"); 2027 if(type!=CONF_RELOAD) 2028 print_syntax(); 2029 return 1; 2030 } 2031 2032 memset(&new_global_options, 0, sizeof(GLOBAL_OPTIONS)); /* reset global options */ 2033 memset(&new_service_options, 0, sizeof(SERVICE_OPTIONS)); /* reset local options */ 2034 new_service_options.next=NULL; 2035 section=&new_service_options; 2036 parse_global_option(CMD_BEGIN, NULL, NULL); 2037 parse_service_option(CMD_BEGIN, section, NULL, NULL); At (9): Condition "type != 0U", taking true branch 2038 if(type!=CONF_RELOAD) { /* provide defaults for gui.c */ 2039 memcpy(&global_options, &new_global_options, sizeof(GLOBAL_OPTIONS)); 2040 memcpy(&service_options, &new_service_options, sizeof(SERVICE_OPTIONS)); 2041 } 2042 2043 line_number=0; At (10): Condition "file_getline(df, line_text, 16384) >= 0", taking true branch At (19): Condition "file_getline(df, line_text, 16384) >= 0", taking false branch 2044 while(file_getline(df, line_text, CONFLINELEN)>=0) { 2045 memcpy(config_line, line_text, CONFLINELEN); 2046 ++line_number; 2047 config_opt=config_line; At (11): Condition "__istype((unsigned char)*config_opt, 16384UL)", taking true branch At (12): Condition "__istype((unsigned char)*config_opt, 16384UL)", taking false branch 2048 while(isspace((unsigned char)*config_opt)) 2049 ++config_opt; /* remove initial whitespaces */ At (13): Condition "i >= 0", taking true branch At (14): Condition "__istype((unsigned char)config_opt[i], 16384UL)", taking true branch At (15): Condition "i >= 0", taking true branch At (16): Condition "__istype((unsigned char)config_opt[i], 16384UL)", taking false branch 2050 for(i=strlen(config_opt)-1; i>=0 && isspace((unsigned char)config_opt[i]); --i) 2051 config_opt[i]='\0'; /* remove trailing whitespaces */ At (17): Condition "config_opt[0] == 0", taking true branch 2052 if(config_opt[0]=='\0' || config_opt[0]=='#' || config_opt[0]==';') /* empty or comment */ At (18): Continuing loop 2053 continue; 2054 if(config_opt[0]=='[' && config_opt[strlen(config_opt)-1]==']') { /* new section */ 2055 if(!new_service_options.next) { 2056 errstr=parse_global_option(CMD_END, NULL, NULL); 2057 if(errstr) { 2058 s_log(LOG_ERR, "Line %d: \"%s\": %s", line_number, line_text, errstr); 2059 file_close(df); 2060 return 1; 2061 } 2062 } 2063 ++config_opt; 2064 config_opt[strlen(config_opt)-1]='\0'; 2065 new_section=str_alloc(sizeof(SERVICE_OPTIONS)); 2066 memcpy(new_section, &new_service_options, sizeof(SERVICE_OPTIONS)); 2067 new_section->servname=str_dup(config_opt); 2068 new_section->session=NULL; 2069 new_section->next=NULL; 2070 section->next=new_section; 2071 section=new_section; 2072 continue; 2073 } 2074 config_arg=strchr(config_line, '='); 2075 if(!config_arg) { 2076 s_log(LOG_ERR, "Line %d: \"%s\": No '=' found", line_number, line_text); 2077 file_close(df); 2078 return 1; 2079 } 2080 *config_arg++='\0'; /* split into option name and argument value */ 2081 for(i=strlen(config_opt)-1; i>=0 && isspace((unsigned char)config_opt[i]); --i) 2082 config_opt[i]='\0'; /* remove trailing whitespaces */ 2083 while(isspace((unsigned char)*config_arg)) 2084 ++config_arg; /* remove initial whitespaces */ 2085 errstr=parse_service_option(CMD_EXEC, section, config_opt, config_arg); 2086 if(!new_service_options.next && errstr==option_not_found) 2087 errstr=parse_global_option(CMD_EXEC, config_opt, config_arg); 2088 if(errstr) { 2089 s_log(LOG_ERR, "Line %d: \"%s\": %s", line_number, line_text, errstr); 2090 file_close(df); 2091 return 1; 2092 } 2093 } 2094 file_close(df); 2095 At (20): Condition "new_service_options.next", taking true branch 2096 if(new_service_options.next) { /* daemon mode: initialize sections */ At (21): Condition "section", taking false branch 2097 for(section=new_service_options.next; section; section=section->next) { 2098 s_log(LOG_INFO, "Initializing service [%s]", section->servname); 2099 errstr=parse_service_option(CMD_END, section, NULL, NULL); 2100 if(errstr) 2101 break; 2102 } At (22): Falling through to end of if statement 2103 } else { /* inetd mode: need to initialize global options */ 2104 errstr=parse_global_option(CMD_END, NULL, NULL); 2105 if(errstr) { 2106 s_log(LOG_ERR, "Global options: %s", errstr); 2107 return 1; 2108 } 2109 s_log(LOG_INFO, "Initializing inetd mode configuration"); 2110 section=&new_service_options; 2111 errstr=parse_service_option(CMD_END, section, NULL, NULL); 2112 } CID 32706: Uninitialized pointer read (UNINIT)At (23): Using uninitialized value "errstr". 2113 if(errstr) { CID 32693: Dereference after null check (FORWARD_NULL) [select defect] 2114 s_log(LOG_ERR, "Service [%s]: %s", section->servname, errstr); 2115 return 1; 2116 } > > - s_log(LOG_ERR, "Service [%s]: %s", section->servname, errstr); > > + s_log(LOG_ERR, "Service [%s]: %s", section ? section->servname : "", > > + errstr); > Again it would be useful to fix the root cause instead of implementing a > workaround. Coverity output: At (1): Condition "name", taking true branch 2008 if(name) /* not reload */ 2009 filename=str_dup(name); 2010 At (2): Condition "type == 2U", taking true branch 2011 s_log(LOG_NOTICE, "Reading configuration from %s %s", 2012 type==CONF_FD ? "descriptor" : "file", filename); 2013#ifndef USE_WIN32 At (3): Condition "type == 2U", taking true branch 2014 if(type==CONF_FD) { /* file descriptor */ 2015 fd=strtol(filename, &tmpstr, 10); At (4): Condition "tmpstr == filename", taking false branch At (5): Condition "*tmpstr", taking false branch 2016 if(tmpstr==filename || *tmpstr) { /* not a number */ 2017 s_log(LOG_ERR, "Invalid file descriptor number"); 2018 print_syntax(); 2019 return 1; 2020 } 2021 df=file_fdopen(fd); At (6): Falling through to end of if statement 2022 } else 2023#endif 2024 df=file_open(filename, 0); At (7): Condition "!df", taking false branch 2025 if(!df) { 2026 s_log(LOG_ERR, "Cannot read configuration"); 2027 if(type!=CONF_RELOAD) 2028 print_syntax(); 2029 return 1; 2030 } 2031 2032 memset(&new_global_options, 0, sizeof(GLOBAL_OPTIONS)); /* reset global options */ 2033 memset(&new_service_options, 0, sizeof(SERVICE_OPTIONS)); /* reset local options */ 2034 new_service_options.next=NULL; 2035 section=&new_service_options; 2036 parse_global_option(CMD_BEGIN, NULL, NULL); 2037 parse_service_option(CMD_BEGIN, section, NULL, NULL); At (8): Condition "type != 0U", taking true branch 2038 if(type!=CONF_RELOAD) { /* provide defaults for gui.c */ 2039 memcpy(&global_options, &new_global_options, sizeof(GLOBAL_OPTIONS)); 2040 memcpy(&service_options, &new_service_options, sizeof(SERVICE_OPTIONS)); 2041 } 2042 2043 line_number=0; At (9): Condition "file_getline(df, line_text, 16384) >= 0", taking true branch At (18): Condition "file_getline(df, line_text, 16384) >= 0", taking false branch 2044 while(file_getline(df, line_text, CONFLINELEN)>=0) { 2045 memcpy(config_line, line_text, CONFLINELEN); 2046 ++line_number; 2047 config_opt=config_line; At (10): Condition "__istype((unsigned char)*config_opt, 16384UL)", taking true branch At (11): Condition "__istype((unsigned char)*config_opt, 16384UL)", taking false branch 2048 while(isspace((unsigned char)*config_opt)) 2049 ++config_opt; /* remove initial whitespaces */ At (12): Condition "i >= 0", taking true branch At (13): Condition "__istype((unsigned char)config_opt[i], 16384UL)", taking true branch At (14): Condition "i >= 0", taking true branch At (15): Condition "__istype((unsigned char)config_opt[i], 16384UL)", taking false branch 2050 for(i=strlen(config_opt)-1; i>=0 && isspace((unsigned char)config_opt[i]); --i) 2051 config_opt[i]='\0'; /* remove trailing whitespaces */ At (16): Condition "config_opt[0] == 0", taking true branch 2052 if(config_opt[0]=='\0' || config_opt[0]=='#' || config_opt[0]==';') /* empty or comment */ At (17): Continuing loop 2053 continue; 2054 if(config_opt[0]=='[' && config_opt[strlen(config_opt)-1]==']') { /* new section */ 2055 if(!new_service_options.next) { 2056 errstr=parse_global_option(CMD_END, NULL, NULL); 2057 if(errstr) { 2058 s_log(LOG_ERR, "Line %d: \"%s\": %s", line_number, line_text, errstr); 2059 file_close(df); 2060 return 1; 2061 } 2062 } 2063 ++config_opt; 2064 config_opt[strlen(config_opt)-1]='\0'; 2065 new_section=str_alloc(sizeof(SERVICE_OPTIONS)); 2066 memcpy(new_section, &new_service_options, sizeof(SERVICE_OPTIONS)); 2067 new_section->servname=str_dup(config_opt); 2068 new_section->session=NULL; 2069 new_section->next=NULL; 2070 section->next=new_section; 2071 section=new_section; 2072 continue; 2073 } 2074 config_arg=strchr(config_line, '='); 2075 if(!config_arg) { 2076 s_log(LOG_ERR, "Line %d: \"%s\": No '=' found", line_number, line_text); 2077 file_close(df); 2078 return 1; 2079 } 2080 *config_arg++='\0'; /* split into option name and argument value */ 2081 for(i=strlen(config_opt)-1; i>=0 && isspace((unsigned char)config_opt[i]); --i) 2082 config_opt[i]='\0'; /* remove trailing whitespaces */ 2083 while(isspace((unsigned char)*config_arg)) 2084 ++config_arg; /* remove initial whitespaces */ 2085 errstr=parse_service_option(CMD_EXEC, section, config_opt, config_arg); 2086 if(!new_service_options.next && errstr==option_not_found) 2087 errstr=parse_global_option(CMD_EXEC, config_opt, config_arg); 2088 if(errstr) { 2089 s_log(LOG_ERR, "Line %d: \"%s\": %s", line_number, line_text, errstr); 2090 file_close(df); 2091 return 1; 2092 } 2093 } 2094 file_close(df); 2095 At (19): Condition "new_service_options.next", taking true branch 2096 if(new_service_options.next) { /* daemon mode: initialize sections */ At (20): Comparing "section" to null implies that "section" might be null. At (21): Condition "section", taking false branch 2097 for(section=new_service_options.next; section; section=section->next) { 2098 s_log(LOG_INFO, "Initializing service [%s]", section->servname); 2099 errstr=parse_service_option(CMD_END, section, NULL, NULL); 2100 if(errstr) 2101 break; 2102 } At (22): Falling through to end of if statement 2103 } else { /* inetd mode: need to initialize global options */ 2104 errstr=parse_global_option(CMD_END, NULL, NULL); 2105 if(errstr) { 2106 s_log(LOG_ERR, "Global options: %s", errstr); 2107 return 1; 2108 } 2109 s_log(LOG_INFO, "Initializing inetd mode configuration"); 2110 section=&new_service_options; 2111 errstr=parse_service_option(CMD_END, section, NULL, NULL); 2112 } CID 32706: Uninitialized pointer read (UNINIT) [select defect] At (23): Condition "errstr", taking true branch 2113 if(errstr) { CID 32693: Dereference after null check (FORWARD_NULL)At (24): Dereferencing null pointer "section". 2114 s_log(LOG_ERR, "Service [%s]: %s", section->servname, errstr); 2115 return 1; 2116 } > > - if(!strcasecmp(fl->name, string)) { > > + if(string && !strcasecmp(fl->name, string)) { > Could you give an example parameter where "string" may be NULL here? 2238/* facilities only make sense on Unix */ 2239#if !defined (USE_WIN32) && !defined (__vms) At (1): Condition "strchr(string, 46)", taking true branch 2240 if(strchr(string, '.')) { /* we have a facility specified */ 2241 new_global_options.facility=-1; 2242 string=strtok(arg_copy, "."); /* break it up */ 2243 At (2): Condition "fl->name", taking true branch 2244 for(fl=facilities; fl->name; ++fl) { At (3): Condition "!strcasecmp(fl->name, string)", taking true branch 2245 if(!strcasecmp(fl->name, string)) { 2246 new_global_options.facility=fl->value; At (4): Breaking from loop 2247 break; 2248 } 2249 } At (5): Condition "new_global_options.facility == -1", taking false branch 2250 if(new_global_options.facility==-1) 2251 return 1; /* FAILED */ 2252 string=strtok(NULL, "."); /* set to the remainder */ 2253 } 2254#endif /* USE_WIN32, __vms */ 2255 2256 /* time to check the syslog level */ At (6): Comparing "string" to null implies that "string" might be null. At (7): Condition "string", taking false branch 2257 if(string && strlen(string)==1 && *string>='0' && *string<='7') { 2258 new_global_options.debug_level=*string-'0'; 2259 return 0; /* OK */ 2260 } 2261 new_global_options.debug_level=8; /* illegal level */ At (8): Condition "fl->name", taking true branch 2262 for(fl=levels; fl->name; ++fl) { CID 11183: Dereference after null check (FORWARD_NULL)At (9): Passing null pointer "string" to function "strcasecmp(char const *, char const *)", which dereferences it. 2263 if(!strcasecmp(fl->name, string)) { 2264 new_global_options.debug_level=fl->value; 2265 break; 2266 } 2267 } 2268 if(new_global_options.debug_level==8) 2269 return 1; /* FAILED */ 2270 return 0; /* OK */ 2271} Let me know if more info is required. Thanks

5 16

fix resource leaks and potential null dereferences in 4.54
by Arthur Mesh 03 Feb '13

03 Feb '13

Hi, I am trying to figure out where bug reports should be submitted. https://www.stunnel.org/lists.html references this mailing list, so here is my attempt at a bug report with a potential fix. If this is not an appropriate list, please redirect me. A coverity run has uncovered quite a few memory and other resource leaks, plus some potential NULL dereferences. Inline is an attempt to fix them. Imho, these are mostly self-explanatory, but if someone needs more details, I would be happy to provide those as well. Thanks diff -ru stunnel-4.54/src/options.c stunnel-4.54.p/src/options.c --- stunnel-4.54/src/options.c 2012-10-09 01:50:54.000000000 -0700 +++ stunnel-4.54.p/src/options.c 2013-01-29 16:26:00.000000000 -0800 @@ -1988,7 +1988,7 @@ int parse_conf(char *name, CONF_TYPE type) { DISK_FILE *df; - char line_text[CONFLINELEN], *errstr; + char line_text[CONFLINELEN], *errstr = NULL; char config_line[CONFLINELEN], *config_opt, *config_arg; int line_number, i; SERVICE_OPTIONS *section, *new_section; @@ -2104,7 +2104,8 @@ errstr=parse_service_option(CMD_END, section, NULL, NULL); } if(errstr) { - s_log(LOG_ERR, "Service [%s]: %s", section->servname, errstr); + s_log(LOG_ERR, "Service [%s]: %s", section ? section->servname : "", + errstr); return 1; } @@ -2253,7 +2254,7 @@ } new_global_options.debug_level=8; /* illegal level */ for(fl=levels; fl->name; ++fl) { - if(!strcasecmp(fl->name, string)) { + if(string && !strcasecmp(fl->name, string)) { new_global_options.debug_level=fl->value; break; } @@ -2428,6 +2429,7 @@ if(get_last_socket_error()!=S_ENOPROTOOPT) { s_log(LOG_ERR, "Failed to get %s OS default", ptr->opt_str); sockerror("getsockopt"); + close(fd); return 1; /* FAILED */ } td=str_dup("write-only"); @@ -2442,6 +2444,7 @@ ptr->opt_str, ta, tl, tr, td); str_free(ta); str_free(tl); str_free(tr); str_free(td); } + close(fd); return 0; /* OK */ } Only in stunnel-4.54.p/src: options.c.orig diff -ru stunnel-4.54/src/protocol.c stunnel-4.54.p/src/protocol.c --- stunnel-4.54/src/protocol.c 2012-10-09 01:46:47.000000000 -0700 +++ stunnel-4.54.p/src/protocol.c 2013-01-29 16:26:00.000000000 -0800 @@ -244,30 +244,36 @@ /**************************************** smtp */ static void smtp_client(CLI *c) { - char *line; + char *line = NULL; do { /* copy multiline greeting */ + str_free(line); /* okay to str_free(NULL) */ line=fd_getline(c, c->remote_fd.fd); fd_putline(c, c->local_wfd.fd, line); } while(isprefix(line, "220-")); fd_putline(c, c->remote_fd.fd, "EHLO localhost"); do { /* skip multiline reply */ + str_free(line); line=fd_getline(c, c->remote_fd.fd); } while(isprefix(line, "250-")); if(!isprefix(line, "250 ")) { /* error */ + str_free(line); s_log(LOG_ERR, "Remote server is not RFC 1425 compliant"); longjmp(c->err, 1); } fd_putline(c, c->remote_fd.fd, "STARTTLS"); do { /* skip multiline reply */ + str_free(line); line=fd_getline(c, c->remote_fd.fd); } while(isprefix(line, "220-")); if(!isprefix(line, "220 ")) { /* error */ + str_free(line); s_log(LOG_ERR, "Remote server is not RFC 2487 compliant"); longjmp(c->err, 1); } + str_free(line); } static void smtp_server(CLI *c) { @@ -290,21 +296,27 @@ line=fd_getline(c, c->remote_fd.fd); if(!isprefix(line, "220")) { s_log(LOG_ERR, "Unknown server welcome"); + str_free(line); longjmp(c->err, 1); } fd_printf(c, c->local_wfd.fd, "%s + stunnel", line); + str_free(line); line=fd_getline(c, c->local_rfd.fd); if(!isprefix(line, "EHLO ")) { s_log(LOG_ERR, "Unknown client EHLO"); + str_free(line); longjmp(c->err, 1); } fd_printf(c, c->local_wfd.fd, "250-%s Welcome", line); + str_free(line); fd_putline(c, c->local_wfd.fd, "250 STARTTLS"); line=fd_getline(c, c->local_rfd.fd); if(!isprefix(line, "STARTTLS")) { s_log(LOG_ERR, "STARTTLS expected"); + str_free(line); longjmp(c->err, 1); } + str_free(line); fd_putline(c, c->local_wfd.fd, "220 Go ahead"); } @@ -316,15 +328,19 @@ line=fd_getline(c, c->remote_fd.fd); if(!isprefix(line, "+OK ")) { s_log(LOG_ERR, "Unknown server welcome"); + str_free(line); longjmp(c->err, 1); } fd_putline(c, c->local_wfd.fd, line); + str_free(line); fd_putline(c, c->remote_fd.fd, "STLS"); line=fd_getline(c, c->remote_fd.fd); if(!isprefix(line, "+OK ")) { s_log(LOG_ERR, "Server does not support TLS"); + str_free(line); longjmp(c->err, 1); } + str_free(line); } static void pop3_server(CLI *c) { @@ -332,17 +348,21 @@ line=fd_getline(c, c->remote_fd.fd); fd_printf(c, c->local_wfd.fd, "%s + stunnel", line); + str_free(line); line=fd_getline(c, c->local_rfd.fd); if(isprefix(line, "CAPA")) { /* client wants RFC 2449 extensions */ fd_putline(c, c->local_wfd.fd, "+OK Stunnel capability list follows"); fd_putline(c, c->local_wfd.fd, "STLS"); fd_putline(c, c->local_wfd.fd, "."); + str_free(line); line=fd_getline(c, c->local_rfd.fd); } if(!isprefix(line, "STLS")) { + str_free(line); s_log(LOG_ERR, "Client does not want TLS"); longjmp(c->err, 1); } + str_free(line); fd_putline(c, c->local_wfd.fd, "+OK Stunnel starts TLS negotiation"); } @@ -353,18 +373,22 @@ line=fd_getline(c, c->remote_fd.fd); if(!isprefix(line, "* OK")) { + str_free(line); s_log(LOG_ERR, "Unknown server welcome"); longjmp(c->err, 1); } fd_putline(c, c->local_wfd.fd, line); + str_free(line); fd_putline(c, c->remote_fd.fd, "stunnel STARTTLS"); line=fd_getline(c, c->remote_fd.fd); if(!isprefix(line, "stunnel OK")) { + str_free(line); fd_putline(c, c->local_wfd.fd, "* BYE stunnel: Server does not support TLS"); s_log(LOG_ERR, "Server does not support TLS"); longjmp(c->err, 2); /* don't reset */ } + str_free(line); } static void imap_server(CLI *c) { @@ -387,6 +411,7 @@ /* process server welcome and send it to client */ line=fd_getline(c, c->remote_fd.fd); if(!isprefix(line, "* OK")) { + str_free(line); s_log(LOG_ERR, "Unknown server welcome"); longjmp(c->err, 1); } @@ -396,22 +421,29 @@ if(capa) *capa='K'; /* disable CAPABILITY within greeting */ fd_printf(c, c->local_wfd.fd, "%s (stunnel)", line); + str_free(line); while(1) { /* process client commands */ line=fd_getline(c, c->local_rfd.fd); /* split line into id and tail */ id=str_dup(line); tail=strchr(id, ' '); - if(!tail) + if(!tail) { + str_free(line); + str_free(id); break; + } *tail++='\0'; if(isprefix(tail, "STARTTLS")) { fd_printf(c, c->local_wfd.fd, "%s OK Begin TLS negotiation now", id); + str_free(line); + str_free(id); return; /* success */ } else if(isprefix(tail, "CAPABILITY")) { fd_putline(c, c->remote_fd.fd, line); /* send it to server */ + str_free(line); line=fd_getline(c, c->remote_fd.fd); /* get the capabilites */ if(*line=='*') { /* @@ -421,6 +453,7 @@ * LOGIN would fail as "unexpected command", anyway */ fd_printf(c, c->local_wfd.fd, "%s STARTTLS", line); + str_free(line); line=fd_getline(c, c->remote_fd.fd); /* next line */ } fd_putline(c, c->local_wfd.fd, line); /* forward to the client */ @@ -429,24 +462,35 @@ fd_putline(c, c->local_wfd.fd, "* BYE unexpected server response"); s_log(LOG_ERR, "Unexpected server response: %s", line); + str_free(line); + str_free(id); break; } + str_free(line); + str_free(id); } else if(isprefix(tail, "LOGOUT")) { fd_putline(c, c->local_wfd.fd, "* BYE server terminating"); fd_printf(c, c->local_wfd.fd, "%s OK LOGOUT completed", id); + str_free(id); + str_free(line); break; } else { fd_putline(c, c->local_wfd.fd, "* BYE stunnel: unexpected command"); fd_printf(c, c->local_wfd.fd, "%s BAD %s unexpected", id, tail); s_log(LOG_ERR, "Unexpected client command %s", tail); + str_free(line); + str_free(id); break; } } /* clean server shutdown */ fd_putline(c, c->remote_fd.fd, "stunnel LOGOUT"); line=fd_getline(c, c->remote_fd.fd); - if(*line=='*') + if(*line=='*') { + str_free(line); line=fd_getline(c, c->remote_fd.fd); + } + str_free(line); longjmp(c->err, 2); /* don't reset */ } @@ -458,15 +502,19 @@ line=fd_getline(c, c->remote_fd.fd); if(!isprefix(line, "200 ") && !isprefix(line, "201 ")) { s_log(LOG_ERR, "Unknown server welcome"); + str_free(line); longjmp(c->err, 1); } fd_putline(c, c->local_wfd.fd, line); fd_putline(c, c->remote_fd.fd, "STARTTLS"); + str_free(line); line=fd_getline(c, c->remote_fd.fd); if(!isprefix(line, "382 ")) { s_log(LOG_ERR, "Server does not support TLS"); + str_free(line); longjmp(c->err, 1); } + str_free(line); } /**************************************** connect */ @@ -548,13 +596,17 @@ /* not "HTTP/1.0 200 Connection established" */ s_log(LOG_ERR, "CONNECT request rejected"); do { /* read all headers */ + str_free(line); line=fd_getline(c, c->remote_fd.fd); } while(*line); + str_free(line); longjmp(c->err, 1); } + str_free(line); s_log(LOG_INFO, "CONNECT request accepted"); do { line=fd_getline(c, c->remote_fd.fd); /* read all headers */ + str_free(line); } while(*line); } @@ -588,10 +640,13 @@ if(line[9]!='4' || line[10]!='0' || line[11]!='7') { /* code 407 */ s_log(LOG_ERR, "NTLM authorization request rejected"); do { /* read all headers */ + str_free(line); line=fd_getline(c, c->remote_fd.fd); } while(*line); + str_free(line); longjmp(c->err, 1); } + str_free(line); ntlm2_txt=NULL; do { /* read all headers */ line=fd_getline(c, c->remote_fd.fd); @@ -599,6 +654,7 @@ ntlm2_txt=str_dup(line+25); else if(isprefix(line, "Content-Length: ")) content_length=atol(line+16); + str_free(line); } while(*line); if(!ntlm2_txt) { /* no Proxy-Authenticate: NTLM header */ s_log(LOG_ERR, "Proxy-Authenticate: NTLM header not found"); Only in stunnel-4.54.p/src: protocol.c.orig diff -ru stunnel-4.54/src/stunnel.c stunnel-4.54.p/src/stunnel.c --- stunnel-4.54/src/stunnel.c 2012-08-18 14:11:53.000000000 -0700 +++ stunnel-4.54.p/src/stunnel.c 2013-01-29 16:26:00.000000000 -0800 @@ -119,12 +119,16 @@ fatal("Could not open /dev/null"); #endif /* standard Unix */ main_initialize(); - if(main_configure(argc>1 ? argv[1] : NULL, argc>2 ? argv[2] : NULL)) + if(main_configure(argc>1 ? argv[1] : NULL, argc>2 ? argv[2] : NULL)) { + close(fd); return 1; + } if(service_options.next) { /* there are service sections -> daemon mode */ #if !defined(__vms) && !defined(USE_OS2) - if(daemonize(fd)) + if(daemonize(fd)) { + close(fd); return 1; + } close(fd); /* create_pid() must be called after drop_privileges() * or it won't be possible to remove the file on exit */ Only in stunnel-4.54.p/src: stunnel.c.orig

3 4

X509 certificate info extract and use
by Pierre-Yves Bonnetain 03 Feb '13

03 Feb '13

Hello, We're looking for a way to add some kind of cross-control between an application and the TLS tunnelling tool that protects the data. I'll give an example, that may be easier to understand. My BigDatabase has it's login/password authentication process. Since my customers want to access the database through bad Internet, we set up a SSL/TLS frontend. Each customer has his own X509 certificate, with all proper bells and jingles in it. The frontend checks the certificate (CA sig, validity, revocation, etc.) and then, as it should, passes the unencrypted flow to the application. There is no way (or, rather, we have not found any way) to cross-check that the certificate AND the requested, application-level login, are linked together. This means that my evil neighbour, which bribed my gullible cat to get my login and password, could connect to my account (app-level auth) using his X509 cert (TLS tunnel auth). We would like to perform this cross-check between X509 certificate AND application-level auth. >From our point of view, this means that we need to "extract and send" some parts of the certificate (DN, validity dates, etc.) to some secondary tool/proxy. This one will check if the data is coherent wrt application credentials. M. Henrik Riomar sent a patch (http://www.stunnel.org/pipermail/stunnel-users/2012-October/003909.html) on the list last october that is one step closer to what we are looking for. We could build from it. Maybe some of you have already solved this kind of problem, or know of a tool that answer to this kind of needs ? Tia, -- Pierre-Yves Bonnetain-Nesterenko B&A Consultants - Sécurité informatique - www.ba-consultants.fr Tel. : +33 (0) 563 277 241 - Fax : +33 (0) 567 737 829

2 5

inetd mode endpoint count check
by Michael Weiser 03 Feb '13

03 Feb '13

Hello, a client setup such as this: client = yes foreground = yes connect = example.com:80 exec = cat execargs = cat causes stunnel-4.54 to fail with error: Service [stunnel]: Inetd mode must define one endpoint The attached patch fixes the problem for me. Dunno if the endpoint check is too lax for other cases then, though. -- Thanks, Micha

2 1

transparent proxy ssl for a socket server
by Alex Needham 29 Jan '13

29 Jan '13

Hi I have to figure out how to get some ssl encapsulation for an application we have that only servs on obscure ports, the app needs to retain the source ip adress of the client requests. So i looked at stunnel, its working great in transparent mode where the stunnel server is the default gateway of the socket server, but I would like to get the stunnel server onto the same machine as the socket server and keep the client src ip. Testing with a apache as a backend as its easy to test. running centos 6.3 (2.6.32-279.19.1.el6.x86_64), updated an hour ago, built stunnel 4.54 from src.rpm. The players stunnel-boxen external=192.168.0.1, internal=192.168.1.1 web/socket-boxen internal=192.168.1.11, dg=192.168.1.1 The configs Config A - works ok debug = 7 foreground = yes #not chrooted runnnig as root no setuid,setguid [socket-1234] cert=blarg.crt key=blarg.key accept = 192.168.0.1:1234 connect = 192.168.1.11:80 transparent = source Config B - Not so good connect = 192.168.1.1:80 <- inside interface of stunnel box iptables -t mangle -N DIVERT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 /etc/sysctl.conf no route filtering and forwarding is on am i trying something impossible? or am i missing something? Any help greatly appreciated, if I get this going I'll happily do a nice neater write up for others. Cheers Alex

2 1

child process reaping
by Michael Weiser 29 Jan '13

29 Jan '13

Hello, recent versions (4.47+ I think) of stunnel introduce the following code in stunnel.c: --- stunnel-4.46/src/stunnel.c 2011-11-03 10:06:59.000000000 +0100 +++ stunnel-4.54/src/stunnel.c 2012-08-18 23:11:53.000000000 +0200 [...] } else { /* inetd mode */ [...] + signal(SIGCHLD, SIG_IGN); /* ignore dead children */ + signal(SIGPIPE, SIG_IGN); /* ignore broken pipe */ + client_main(alloc_client_session(&service_options, 0, 1)); } In Linux, child processes seem to inherit their parent's SIGCHLD handler setting. This means that all of stunnel's child processes will be unable to wait for their children. This causes the following uucp-over-stunnel setup I have: CAfile = /etc/ssl/certs/cacert.pem cert = /etc/ssl/certs/suucpcert.pem key = /etc/ssl/private/suucpkey.unenc verify = 2 service = suucp exec = /usr/sbin/uucico execargs = uucico -l to fail horribly with messages such as this: uucico weiser - (2013-01-29 01:25:15.33 3676) Call complete (6 seconds 21620 bytes 35103 bps) uuxqt weiser root (2013-01-29 01:25:17.36 3677) Executing X.weiserSEQ1 (rbsmtp) uuxqt weiser root (2013-01-29 01:25:17.96 3677) ERROR: waitpid: No child processes uuxqt weiser root (2013-01-29 01:25:17.96 3677) Execution failed (X.weiserSEQ1) Restoring SIGCHLD to SIG_DFL just before execvp()'ing the child as in the attached patch seems to fix it. I also attach a small test case for reproducing. It can be run like this: nc -l -p 12345 -e "stunnel sigchldtest.conf" 127.0.0.1 & openssl s_client -quiet -verify 0 -connect 127.0.0.1:12345 and should produce the following output: child: 2654 child 2654 died When automatic child reaping it active it will fail like this: child: 2538 waitpid: No child processes BTW: On Mac OS X, the SIGCHLD handler setting does not seem to be inherited by children. -- Thanks, Micha

1 0

MATCH CERT AGAINST LDAP
by Alejandro Fernandez 26 Jan '13

26 Jan '13

Hi there! I would like to know if it's possible with stunnel, as is, to match a client certificate against a certstore in a directory service, instead of a file, so to be able to revoke from a service such as Fedora 389 some access. Please, understand that the idea is not to access the LDAP itself, but to access some service within a network and grant such access based on a directory service query. Thanks everyone, Alejandro

1 0

Re: [stunnel-users] Stunnel setup for SSL connection with POP3 server
by Ludolf Holzheid 25 Jan '13

25 Jan '13

On Thu, 2013-01-24 21:09:13 +0530, shanmuganathan sedukumar wrote: > > Hi Ludolf, > Thanks for your input. I will try the same :) Hello Shanmuganathan, always reply to the list, so others are able to follow (and to comment). > One more clarification, we have multiple mail accounts configured in the same POP3 server. In our application, for each email account the username/password credentials would vary. So, in stunnel config file do we need to specify the credentials with parameters? If so, how do we need to specify the credentials for all the accounts? As far as I understood, stunnel has nothing to do with the POP3 authentication. It merely provides with an (encrypted) transport layer for the (plain text) POP3 session. I.e., you have to specify the credentials in your application. HTH, Ludolf -- Bihl+Wiedemann GmbH Floßwörthstr. 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 e-mail: lholzheid(a)bihl-wiedemann.de website: www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim HRB 5796

1 0

stunnel for Solaris 10
by shanmuganathan sedukumar 24 Jan '13

24 Jan '13

Hi All, I'm new and about to start with stunnel. We are facing certain issues with our application server (operating on Solaris 10), as it is unable to establish SSL connection with an email exchange server (P0P3). So, we have planned to use stunnel for establishing SSL connection. May I get some guidelines on installation and configuration part, if anything available? Regards,Shanmuganathan

2 2

Hello, I am trying to connect to FIX server, and getting stunnel error.
by 724live 21 Jan '13

21 Jan '13

Hello, I am working on a project with FIX protocol, but have SSL connection error. *This is the stunnel.log info:* 2013.01.21 20:38:09 LOG5[5388:6900]: connect_blocking: connected XX.XX.XX.XX:2525 2013.01.21 20:38:09 LOG5[5388:6900]: Service [demo] connected remote server from 10.0.0.59:9532 2013.01.21 20:38:09 LOG7[5388:6900]: Remote socket (FD=620) initialized 2013.01.21 20:38:09 LOG7[5388:6900]: SNI: host name: XX.XX.XX.XX 2013.01.21 20:38:09 LOG7[5388:6900]: SSL state (connect): before/connect initialization 2013.01.21 20:38:09 LOG7[5388:6900]: SSL state (connect): SSLv3 write client hello A 2013.01.21 20:38:09 LOG7[5388:6900]: SSL state (connect): SSLv3 read server hello A 2013.01.21 20:38:09 LOG7[5388:6900]: SSL state (connect): SSLv3 read server certificate A 2013.01.21 20:38:09 LOG7[5388:6900]: SSL state (connect): SSLv3 read server done A 2013.01.21 20:38:09 LOG3[5388:6900]: error queue: 14098077: error:14098077:SSL routines:SSL3_SEND_CLIENT_KEY_ EXCHANGE:bad rsa encrypt 2013.01.21 20:38:09 LOG3[5388:6900]: SSL_connect: 4068078: error:04068078:rsa routines:RSA_EAY_PUBLIC_ENCRYPT:key size too small 2013.01.21 20:38:09 LOG5[5388:6900]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2013.01.21 20:38:09 LOG7[5388:6900]: Remote socket (FD=620) closed 2013.01.21 20:38:09 LOG7[5388:6900]: Local socket (FD=540) closed 2013.01.21 20:38:09 LOG7[5388:6900]: Service [demo] finished (0 left) I will appreciate if you can guide me with help. It will help to make your Archive Searchable. Thank you, Isaac

2 1

unknown protocol
by Brandon Glenn 11 Jan '13

11 Jan '13

I am currently trying to setup stunnel to help me send emails from a program that sends alerts but does not use SSL, to a cloud email service that I use that requires SSL. I have the configuration setup trying to find out where the error is, and I am down to this last error. SSL23_GET_CLIENT_HELLO:unknown protocol Here is my config file. ; Sample stunnel configuration file for Win32 by Michal Trojnara 2002-2012 ; Some options used here may be inadequate for your particular configuration ; This sample file does *not* represent stunnel.conf defaults ; Please consult the manual for detailed description of available options ; ************************************************************************** ; * Global options * ; ************************************************************************** ; Debugging stuff (may useful for troubleshooting) ;debug = 7 ;output = stunnel.log ; Disable FIPS mode to allow non-approved protocols and algorithms fips = no ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Certificate/key is needed in server mode and optional in client mode cert = stunnel.pem ;key = stunnel.pem ; Authentication stuff needs to be configured to prevent MITM attacks ; It is not enabled by default! ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively CRLfile can be used ;CRLfile = crls.pem sslVersion = all ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; These options provide additional security at some performance degradation ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; ************************************************************************** ; * Service definitions (at least one service has to be defined) * ; ************************************************************************** ; The default certificate cert = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Set client mode client = yes ; GMail ssmtp settings [ssmtp] accept = 25 connect = 174.129.0.38:465 ; GMail pop3s settings [pop3s] accept = 110 connect = 174.129.0.38:995 ; GMail imaps settings [imaps] accept = 143 connect = 174.129.0.38:993 ; Example SSL front-end to a web server ;[https] ;accept = 443 ;connect = 80 ; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SSL ; Microsoft implementations do not use SSL close-notify alert and thus ; they are vulnerable to truncation attacks ;TIMEOUTclose = 0 ; vim:ft=dosini

2 1

Error 111 (net::ERR_TUNNEL_CONNECTION_FAILED): Unknown error.
by Mr Nerdy 03 Jan '13

03 Jan '13

Hi. I installed Stunnel to secure the traffic to my HFS web-server at home. Everything works fine except that if I am trying to connect through a firewall (e.g. from work) Chrome shows an error message: Error 111 (net::ERR_TUNNEL_CONNECTION_FAILED): Unknown error.

1 0

Stunnel v4.54 SSL_connect: Peer suddenly disconnected
by Arun Kumar 02 Jan '13

02 Jan '13

Team, I am configuring stunnel for the first time. My Requirement: "NetApp DataFabricManager" application on SLES10 SP4 platform <------ (LDAP over Stunnel) -----> Windows 2003 Active Directory, for Active Directory user authentication. Stunnel.conf: ----------------------------------------------------------- setuid = root setgid = root client = yes debug = 7 output = /root/stunnel.log cert = /opt/crt_key.pem key = /opt/crt_key.pem pid = /var/run/stunnel.pid verify = 3 CAfile = /opt/crt_key.pem options = NO_SSLv2 [ldap] accept = 389 connect = winad1-197-187:636 [ldap-ha] accept = 8389 connect = winad2-197-189:636 ----------------------------------------------------------- ocm5-197-196:~ # dfm ldap list Address Port Last Use Last Failure ------------------------------------------ ------ -------------------------- -------------------------- 127.0.0.1 389 2013-01-02 14:01:52.000000 127.0.0.1 8389 2013-01-02 13:49:35.000000 ocm5-197-196:~ # ocm5-197-196:~ # dfm ldap find user1 Warning: Failed to bind to ldap server '127.0.0.1' as user 'CN=Administrator,CN=Users,DC=<zz>,DC=<xx>,DC=<yy>,DC=com': Can't contact LDAP server Error: Failed to search for user1. ocm5-197-196:~ # NOTE: If i add active directory server IP in the above list, instead of 127.0.0.1, ldap authentication works fine. ocm5-197-196:~ # cat /etc/services ... ..... ........ #### This is a Manual Entry made by root user for AD authentication services & Stunnel Integration ######## ldap-ha 8389/tcp # 2nd LDAP host for DC redundancy [Redirected to 2nd DC by Stunnel, see /etc/stunnel/stunnel.conf] ldap-ha 8389/udp # 2nd LDAP host for DC redundancy [Redirected to 2nd DC by Stunnel, see /etc/stunnel/stunnel.conf] ocm5-197-196:~ # stunnel /root/stunnel-4.54/tools/stunnel.conf stunnel.log: 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Clients allowed=500 2013.01.02 14:00:42 LOG5[7102:47010476379680]: stunnel 4.54 on x86_64-unknown-linux-gnu platform 2013.01.02 14:00:42 LOG5[7102:47010476379680]: Compiled/running with OpenSSL 0.9.8a 11 Oct 2005 2013.01.02 14:00:42 LOG5[7102:47010476379680]: Threading:PTHREAD SSL:+ENGINE Auth:none Sockets:POLL+IPv6 2013.01.02 14:00:42 LOG5[7102:47010476379680]: Reading configuration from file /root/stunnel-4.54/tools/stunnel.conf 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Compression not enabled 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Snagged 64 random bytes from /root/.rnd 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Wrote 1024 new random bytes to /root/.rnd 2013.01.02 14:00:42 LOG7[7102:47010476379680]: PRNG seeded successfully 2013.01.02 14:00:42 LOG6[7102:47010476379680]: Initializing service [ldap] 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Certificate: /opt/crt_key.pem 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Certificate loaded 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Key file: /opt/crt_key.pem 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Private key loaded 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Loaded verify certificates from /opt/crt_key.pem 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Loaded /opt/crt_key.pem revocation lookup file 2013.01.02 14:00:42 LOG7[7102:47010476379680]: SSL options set: 0x01000004 2013.01.02 14:00:42 LOG6[7102:47010476379680]: Initializing service [ldap-ha] 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Certificate: /opt/crt_key.pem 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Certificate loaded 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Key file: /opt/crt_key.pem 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Private key loaded 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Loaded verify certificates from /opt/crt_key.pem 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Loaded /opt/crt_key.pem revocation lookup file 2013.01.02 14:00:42 LOG7[7102:47010476379680]: SSL options set: 0x01000004 2013.01.02 14:00:42 LOG5[7102:47010476379680]: Configuration successful 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Service [ldap] (FD=7) bound to 0.0.0.0:389 2013.01.02 14:00:42 LOG7[7102:47010476379680]: Service [ldap-ha] (FD=8) bound to 0.0.0.0:8389 2013.01.02 14:00:42 LOG7[7103:47010476379680]: Created pid file /var/run/stunnel.pid 2013.01.02 14:01:52 LOG7[7103:47010476379680]: Service [ldap] accepted (FD=3) from 127.0.0.1:60332 2013.01.02 14:01:52 LOG7[7103:1073809728]: Service [ldap] started 2013.01.02 14:01:52 LOG5[7103:1073809728]: Service [ldap] accepted connection from 127.0.0.1:60332 2013.01.02 14:01:52 LOG6[7103:1073809728]: connect_blocking: connecting 192.168.10.7:636 2013.01.02 14:01:52 LOG7[7103:1073809728]: connect_blocking: s_poll_wait 192.168.10.7:636: waiting 10 seconds 2013.01.02 14:01:52 LOG5[7103:1073809728]: connect_blocking: connected 192.168.10.7:636 2013.01.02 14:01:52 LOG5[7103:1073809728]: Service [ldap] connected remote server from 192.168.10.1:40664 2013.01.02 14:01:52 LOG7[7103:1073809728]: Remote socket (FD=10) initialized 2013.01.02 14:01:52 LOG7[7103:1073809728]: SSL state (connect): before/connect initialization 2013.01.02 14:01:52 LOG7[7103:1073809728]: SSL state (connect): SSLv3 write client hello A 2013.01.02 14:01:52 LOG3[7103:1073809728]: SSL_connect: Peer suddenly disconnected <------------------ 2013.01.02 14:01:52 LOG5[7103:1073809728]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2013.01.02 14:01:52 LOG7[7103:1073809728]: Remote socket (FD=10) closed 2013.01.02 14:01:52 LOG7[7103:1073809728]: Local socket (FD=3) closed 2013.01.02 14:01:52 LOG7[7103:1073809728]: Service [ldap] finished (0 left) I initially started with stunnel-4.14 available with SLES10 GA OS media. Noticed peer disconnected issue. I went through the stunnel mailing list archive for related issues, but didn't get much help. Finally upgraded stunnel to v4.54 & to no progress. google hits mentioned that its configuration issue / client is not accepting sockets.. but finally no clue how to proceed. Kindly assist "SSL_connect: Peer suddenly disconnected" & SSL handshake work. Warm Regards, Arun UNIX admin

2 3

Looking to confirm that stunnel is encrypting traffic via wireshark
by David Trebacz 31 Dec '12

31 Dec '12

I'm using stunnel to encrypt newsgroup traffic. Essentially use stunnel to encrypt port 119 traffic (from the Pan Newsreader) then securely communicate over 563 with astraweb secure servers. The whole set-up is described in detail in this blog post: http://blog.trebacz.com/2012/03/installing-stunnel-to-enable-ssl.html The system has been "working" for several months, but someone on the blog asked how to confirm it. I checked my logs and each time I'm finished using Pan/Stunnel to download anything I get several entries in my syslog like: stunnel: LOG5[2111:140426048358144]: Connection closed: 3259 byte(s) sent to SSL, 16756212 byte(s) sent to socket I started to wonder does this mean some of the traffic was encrypted, but most wasn't? I fired up wireshark filtered the results to show port 563 traffic ( filter set to tcp.port == 563) as was suggested in another post ( http://ubuntuforums.org/showpost.php?p=5400958&postcount=9). Wireshark does show the traffic is correctly flow through port 563 with astrawebs newsservers when requesting data, but how do I know the traffic is encrypted? I inspected likely packets to contain encrypted data and I don't see anything in plain text (but they're zlib compressed also).

1 0

How to set DSCP in stunnel?
by Death Master 30 Dec '12

30 Dec '12

How to set DSCP in stunnel? For some reasons I can't set DSCP via iptables(server side is on ovz VPS). Is there such feature? If no - please add it(it will be very usefull for me ;) )

3 3

Embedded linux run time problem (starting version 4.53), and work around
by Bao, Robert 28 Dec '12

28 Dec '12

To those running stunnel on Embedded Linux ARMv4 platform, You may have noticed that stunnel (starting from version 4.53 to the latest) will crash immediately even if you run as "stunnel -version". The work around is to remove "-pie" and "-fPIE" from CFLAG in Makefile. Michal, You may fix this problem permanently in config file when you roll out the official 5.00 version. Thanks, and happy holidays. Robert Bao Software House Tyco International

1 0

core dump when running stunnel on Arm based board
by ning ji 21 Dec '12

21 Dec '12

Hi everyone, i'm new to this. got a task to update stunnel from 4.52 to 5.00b1. 1. ./configure --host arm-none-linux-gnueabi --target arm-none-linux-gnueabi --prefix= i compared the makefile with the one in our 4.52 code base, same. 2. build with make -C stunnel CROSS_COMPILE=arm-none-linux-gnueabi- ARCH=arm 3. scp to ARM board, run without arugments, core dump. (the line number might be different as i was putting printfs. but as long as it enters parse_commandline, it crashes) [New LWP 867]Cannot access memory at address 0x70797263(gdb) bt#0 parse_commandline (name=0xbefdce29 "/opt/ultra/config/stunnel.conf", parameter=0xbefdce48 "-version") at options.c:1940#1 0x0003ba04 in main_configure (arg1=0xbefdce29 "/opt/ultra/config/stunnel.conf", arg2=0xbefdce48 "-version") at stunnel.c:199#2 0x0003bd44 in main_unix (argv=<optimized out>, argc=<optimized out>)at stunnel.c:135#3 main (argc=3, argv=0xbefdcd24) at stunnel.c:110my question is, it crashed when just entering parse_commandline( ),the 2 arguments look fine to me.How could this happen ?Many thanks !

5 11

public domain [PATCH] to stunnel 500b3 for Windows CE / Windows Mobile, "no log window bug" on WCE, UNICODE wce/w32, and compilation issues fixed
by Pierre DELAAGE 18 Dec '12

18 Dec '12

Dear All, Please find enclosed a patch in "diff -cr orig patched" format, applying to stunnel v500b3 as found here https://www.stunnel.org/downloads.html This patch mainly addresses compilation and unicode issues for Windows CE targets + ONE issue preventing stunnel to display error logs in error Window on WCE. This code has been made common to WCE AND W32, by selecting proper win32 api calls common to both platforms. For example : InsertMenuItem does not exist on WCE, but InsertMenu can do the same job. ShellExecute does not exist on WCE, but...ShellExecuteEx does exist on both platforms and can do the job. I use MS EVC 4sp4 compiler with WCE 420 SDK, on a vista sp2 host platform. Once debugged the code works fine on WM6 HTC smartphones. Should work on WM5. It needs a windows CE openssl lib (I recompiled MY patched version of openssl 1.0.2snap20121213 successfully: I have sent a patch to those openssl gentlemen, hoping that they will integrate it one fine day..., something not so obvious ...). You will find my openssl "patch to port", by following carefully this thread at openssl diffusion list : http://marc.info/?l=openssl-dev&m=135574071824906&w=2 two messages are more important than the others : one containing the patch on the code. Another one containing 2 useful scripts. The present stunnel patch addresses the following issues : ************* I] COMPILATION FAILURES It is important to state that to detect more type mismatching (that can be error prone at runtime), I delibarately use /WX option on both WCE and W32 compilers: this flag takes each warning as an error. This is very useful for UNICODE clean coding as, without this option, the compiler will just warn when seeing a short* (unicode string) used as a char* (ansi string), which leads to big pb at run time. 1/ orig/src/client.c just a warning on missing "return". 2/ evc.mak new SSLDIR to openssl V102snap20121213 Missing flag x86 needed to get inline function InterlockedExchange from winbase.h. Added dependency to evc.mak itself, as in vc.mak Added commctrl.lib for CommandBar routines (although, strangely, the program was running without that !) 3/ gui.c : UNICODE port for W32/WCE. WM_WINDOWSPOSCHHANGED replaces WM_SHOWINDOW, as the latter is unsupported in WCE. some mismatch between prototype and function definition for service_install. Visible now is a BOOL, as it is more consistant with its value and usage. Some "return TRUE" have been replaced by "return 0" as stated in msdn doc. Trick to delete menuitems : itemcount does not exist in WCE, but the delete loop is using the return value of deletemenu. message_boxT created for Tchar vars such as section->help ShellExecute replaced by shellExecuteEx, common to WCE and W32 4/ prototypes.h : declared message_boxT 5/ resolver.c : UNICODE issue on LoadLibrary 6/ stunnel.c type cast for time_t 7/ vc.mak : inc32 for openssl includes /WX warning as error flag to see every potential casting problem around UNICODE ************* II] OPERATIONAL ERRORS (at run-time) 1/ error log windows is displayed empty : cause = WM_SHOWWINDOW does not exist on WCE, although the constant is declared ! solution : use WM_WINDOWPOSCHANGED instead... 2/ Unsolved, unfortunaltely : on WCE only, on start, there is an error message, but no real error behind : "CommandBar_InsertMenuBar : error 120 : this function is only valid in win32 mode" I am still searching... ************* III] MINOR IMPROVMENT 1/replaced some win3.1 ugly fonts See resources.rc : some nice FONT on About and Password dlgbox...to replace ugly windows3.1 style bold font... Note : I use stunnel to establish a simple "vpn" between smartphones and a corporate linux server mainly for HTTPS/POPS/SMTPS support. Stunnel is very relevant in that matter, over solutions based on SSH (although we use also ssh), from a communication cost point of view : ssh establishes permanent socket between client and server, so that the communication is charged by the mobile network provider : and these charges are very expensive. On the contrary stunnel only establishes ssl sockets on demand so that financial charges are limited to strict necessary. Please note that stunnel brings "client based certificate authentication" to POP/SMTP mobile mail user agents which only BASICALLY supports SSL with server authentication, but NO client authentication, such as M$ Outlook for Mobile (unless you pay for an exchange server and exchange client licence). Here again stunnel is very relevant. Note 2 : TODO list and Wish list : 1/ there is a remaining runtime bug on WCE : On start there is a warning that is NOT causing any failure in the software. Very difficult to analyse... 2/ find a notepad for WCE... 3/ in log.c...I really it would be good to replace hard coded values for socket errors by symbolic constant. 4/ fips openssl for WCE and then stunnel for WCE... I hope you will find this patch useful. Michal, thank you for your excellent work, Yours sincerely, Pierre Delaage

2 1

WCE 3.0 run-time error, how to work around it?
by Bao, Robert 12 Dec '12

12 Dec '12

Mike, The stunnel version used in our current product is 4.34. It worked well under Windows CE 3.0 and 5.0. However I got run-time error for 5.00 beta version under WCE 3.0 (even though I disabled IPv6, took out winsock2.h/ws2tcpip.h, included winsock.h, defined "struct addrinfo", etc ). The error is: Error detected on SSL (read) file descriptor: Bad protocol option (WSAENOPROTOOPT) (10042) What else I need to do to resolve or work around it? Thank you. Robert Bao Software House Tyco International

2 2

Win CE build errors: main_execute() removed from stunnel.c file? "hwnd" link error.
by Bao, Robert 07 Dec '12

07 Dec '12

Came across another Win CE build issue in the current stunnel 4.54 version. Got link error for main_execute() referenced in nogui.c file. I noticed that the implementation of "main_execute()" was in stunnel.c file in old versions, but is not there anymore. Also got "hwnd" linking issue. Looks like "hwnd" is initialized/created in gui.c file, and used in log.c/client.c/option.c files. It is not initialized/created in nogui.c file. I am using the NOGUIOBJS/tstunnel.exe option in building the stunnel, and got this linking error. Any suggestions on how to fix these or work around them? Thanks. Robert Bao Software House Tyco International 978-577-4202 Explore our new Tyco Online Learning Center Web-based Training Bundles at: www.swhouse.com/support/tyco_online_learning_center.aspx This e-mail may contain or have attached to it information or technology the export or re-export of which is restricted by U.S. laws and regulations. By viewing this e-mail and any attachments, the recipient agrees to the following: (i) the recipients use of the contents of this e-mail and any attachments shall comply with all applicable laws, rules and regulations, including, without limitation, U.S. international trade laws and regulations, and (ii) the recipient may not transfer or otherwise export or re-export any information or technology contained in this e-mail or any attachment except in full compliance with the export controls administered by the U.S. and other countries and any applicable import and use restrictions.

3 12

protocols options clarification
by John A. Wallace 06 Dec '12

06 Dec '12

The Service Level Options of the manual includes the following points: protocol = proto application protocol to negotiate SSL (e.g. starttls or stls) protocol option should not be used with SSL encryption on a separate port. Currently supported protocols: CIFS Connect Etc.. However, in the listed protocols supported neither "starttls" or "stls" appears, even though they appear to be options as far as I can see from the above explanation. Am I missing something here, or should they be among those in the list, and can one use this setting: Protocol=starttls Also, I don't really understand what this statement is telling me: "protocol option should not be used with SSL encryption on a separate port." John A. Wallace

3 2

Re: [stunnel-users] protocols options clarification
by jw72253＠verizon.net 06 Dec '12

06 Dec '12

2 1

how to use My Own Signed Wildcard cert
by robbi3j 05 Dec '12

05 Dec '12

Can anyone help ... have looked through the forums but cannot get this to work I want to configure Stunnel to use my already signed wildcard cert how to I go about importing it ? .. i have the cert file with the private key attached which is password protected can anyone help as its driving me nuts ! -- View this message in context: http://old.nabble.com/how-to-use-My-Own-Signed-Wildcard-cert-tp34756779p347… Sent from the Stunnel - Users mailing list archive at Nabble.com.

3 3

Console-only version for Windows
by Clodo 03 Dec '12

03 Dec '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 There is a binary version of stunnel for Windows WITHOUT the gui, console/terminal only? I have some different problems with the GUI edition: - - Fail to read filename with spaces? - - If is already in execution and i run stunnel.exe with some other parameters, they are ignored and simply give the focus to the current instance, so issue with launching multiple instances. Why there isn't any console-only version, exacly like the standard linux distribution? The Cygwin version works great, but isn't portable, doesn't work without Cygwin environment. There are some big trouble about that, or simply doesn't exists the .mak project file? I'm also available to pay with a donation a build like that. I'm waiting for feedback. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (MingW32) Comment: Using GnuPG with Mozilla - http://www.enigmail.net/ iQEVAwUBUKPN8i/ixHrG0m4LAQLxdwf/RF1faK3tksXnl6qm8Bi6HIFaG72tmFMJ LwQuY0gJh7rYDJs3NUQwh4XczMqi+5a8/SRZFojSewI2WfeZgLuXC58iq5nkAULm quaEN5ynjen80RJ7MtGg9weoHcpV1kug5HKJUwYZLU0lp8CvEGNhl8sgGT/bCUS7 gzdfi1d3YohBbEn8XZZgmmUmp1oShY4dh47Sd4vVlzaL3WkxqNIasCJJCwWk7lUz dPuy8XCi6y+Aes1T2SF87GAwvdkr0FbPiN0GcCXGczZxNjOiGNGOwqaHnxDknibr kHoGU/vv1PKWU5AYGiryD/YiUt0nHC/7I7IKU3tFu3smmFR8BTOwKA== =lLyE -----END PGP SIGNATURE-----

4 5

Patch to fix: Wildcard SSL certificates + SNI broken on Firefox
by Stephen Balukoff 29 Nov '12

29 Nov '12

Hello! I noticed that when dealing with wildcard certs in stunnel where an SNI configuration is being used, unless a specific servername context that exactly matches the browser's requested servername is in the stunnel.conf, stunnel responds to the client (web browser in this case) with a SSL_TLSEXT_ERR_ALERT_FATAL. Most browsers fall back to a non-SNI request, at which point, stunnel responds with whatever the master service's certificate is (which, if it's a wildcard cert, just works). However, at least one popularly-used web browser (Firefox) does not do this, and instead returns an error message to the user which they cannot (and should not need to) override to view the site contents. Since it's impractical to list all the possible servernames that can match at wildcard cert, and it's also impractical to expect the Firefox developers to change the behavior of their browser (when they shouldn't have to), and even more impractical to expect all the current users of Firefox to upgrade in a timely manner... I went ahead and wrote a patch for stunnel which instructs it to look for a matching wildcard certificate, if an exactly-matching servername isn't found. I've attached this patch to this message. Beyond fixing the stunnel+wildcard cert+SNI+firefox problem above, the secondary benefits of this patch are: * stunnel now responds immediately with a matching cert in the case of a wildcard cert, thus eliminating that first exchange which results in the SSL_TLSEXT_ERR_ALERT_FATAL error above. For stupid browsers and configurations with keepalive turned off + lots of requests per page and high latency, this should help to significantly improve performance. * stunnel will still choose an exactly matching cert if it's available and configured. (ie. if the browser requests 'subdomain.example.com', and there's a certificate configured in stunnel for 'subdomain.example.com' and another for '*.example.com', stunnel will respond with the ' subdomain.example.com' cert.) * one can now use multiple wildcard certs on a single IP:Port combination thanks to SNI. (Without this patch, you can effectively only use one wildcard cert per IP:Port combination with stunnel.) One note: It's been years since I've written any C code, so can't really vouch for the quality of my patch. I'm hoping at least the maintainers of this project see the utility of the patch I'm providing and write something similar in non-stupid C. Thanks, Stephen -- Stephen Balukoff Blue Box Group, LLC (800)613-4305 x807

1 0

Question : prevent close-nofity alerts from stunnel-server
by bhakta79 29 Nov '12

29 Nov '12

Hello, I was trying MITM on a windows application (which talks to a M$ server). Stunnel was running on my windows xp machine. windows-client-app -> stunnel server ---> stunnel client --> M$ Server What I found is that stunnel server sends close notify alert to the windows client app which causes the client to suspend all further communication (busted windows-client of course!). I tried setting the TimeoutClose option to high values but I always saw the server sending close notify alert (is the timeout close only a client-side parameter?) Is there a way to configure server to not send close notify? stullen logs: 2012.11.28 18:32:12 LOG7[3908:5904]: SSL socket closed on SSL_read 2012.11.28 18:32:12 LOG7[3908:5904]: Sent socket write shutdown 2012.11.28 18:32:12 LOG7[3908:4232]: Socket closed on read 2012.11.28 18:32:12 LOG5[3908:5904]: Connection closed: 901 byte(s) sent to SSL, 38020 byte(s) sent to socket 2012.11.28 18:32:12 LOG7[3908:4232]: Sending close_notify alert 2012.11.28 18:32:12 LOG7[3908:4232]: SSL alert (write): warning: close notify 2012.11.28 18:32:12 LOG6[3908:4232]: SSL_shutdown successfully sent close_notify alert 2012.11.28 18:32:12 LOG7[3908:5904]: Remote socket (FD=356) closed <mailto:[email protected]> I finally ended up making this one line code-change to stop server from sending close alert that helped my MITM progress. src/client.c: if(!(SSL_get_shutdown(c->ssl)&SSL_SENT_SHUTDOWN) && !sock_open_rd && !c->sock_ptr) { s_log(LOG_DEBUG, "BHAKTA - HACK -> Skip Sending close_notify alert"); *! if(0 && SSL_version(c->ssl)!=SSL2_VERSION) { /* SSLv3, TLSv1 */* s_log(LOG_DEBUG, "Sending close_notify alert"); shutdown_wants_write=1; } else { /* no alerts in SSLv2, including the close_notify alert */ s_log(LOG_DEBUG, "Closing SSLv2 socket"); if(c->ssl_rfd->is_socket) shutdown(c->ssl_rfd->fd, SHUT_RD); /* notify the kernel */ if(c->ssl_wfd->is_socket) shutdown(c->ssl_wfd->fd, SHUT_WR); /* send TCP FIN */ /* notify the OpenSSL library */ SSL_set_shutdown(c->ssl, SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN); } } Is there a way to prevent server from sending close notify alert by means of stunel.conf parameters? stunnel.conf: debug = 7 output = stunnel.log cert = fakecert.pem key = fakecert.key options = DONT_INSERT_EMPTY_FRAGMENTS socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [https] sslVersion = TLSv1 accept = 0.0.0.0:443 connect = 127.0.0.1:446 [https-client] client = yes sslVersion = TLSv1 accept = 127.0.0.1:446 connect = 172.24.244.11:443 TIMEOUTclose = 300

1 0

Re: [stunnel-users] WinCE link errors
by Bao, Robert 28 Nov '12

28 Nov '12

Brian, You are right. After changing the order, all wcecompatex.lib related link errors are gone! Thanks a lot. Also thank Pierre for dropping me another suggestion. Mike, When you get chance to update next time, you may consider changing this line (in evc.mak): From: LIBS=/NODEFAULTLIB coredll.lib corelibc.lib winsock.lib wcecompatex.lib libeay32.lib ssleay32.lib To: LIBS=/NODEFAULTLIB winsock.lib wcecompatex.lib libeay32.lib ssleay32.lib coredll.lib corelibc.lib Thank you all. Robert From: Brian Wilkins [mailto:[email protected]] Sent: Wednesday, November 28, 2012 5:15 PM To: Bao, Robert Subject: Re: [stunnel-users] WinCE link errors Maybe try changing the link order...? On Nov 28, 2012 5:10 PM, "Bao, Robert" <rbao(a)tycoint.com> wrote: Dear Mike and WinCE stunnel users out there, I am currently in the process of compiling/linking the latest stunnel (4.54) for our ARM and WinCE 5.0 based device. I noticed that this version requires coredll.lib and corelibc.lib in the final link process (defined in the LIBS variable), which the old ones (e.g., version 4.33) didn't. Anyway, I got a lot of linking errors (see below), and just wondering any of you have seen the same errors and how you get around with these errors. If you have any other suggestions please feel free to let me know too. Note: I could resolve the errors at the bottom, but I have trouble get rid of the errors relating to wcecompatex.lib(redir.obj). Thank you for your time. wcecompatex.lib(redir.obj) : error LNK2005: fopen already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: fclose already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: fread already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: fwrite already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: _getstdfilex already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: _fileno already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: fflush already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: feof already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: ferror already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: clearerr already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: fseek already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: ftell already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: _setmode already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: fgets already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: fprintf already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : warning LNK4006: fopen already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: fclose already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: fread already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: fwrite already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: _getstdfilex already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: _fileno already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: fflush already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: feof already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: ferror already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: clearerr already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: fseek already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: ftell already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: _setmode already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: fgets already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: fprintf already defined in coredll.lib(COREDLL.dll); second definition ignored Creating library ..\bin\ARMV4I\tstunnel.lib and object ..\bin\ARMV4I\tstunnel.exp options.obj : error LNK2001: unresolved external symbol WSAGetLastError network.obj : error LNK2001: unresolved external symbol WSAGetLastError stunnel.obj : error LNK2019: unresolved external symbol WSAGetLastError referenced in function daemon_loop ctx.obj : error LNK2001: unresolved external symbol WSAGetLastError client.obj : error LNK2019: unresolved external symbol WSAGetLastError referenced in function init_remote log.obj : error LNK2001: unresolved external symbol WSAGetLastError client.obj : error LNK2019: unresolved external symbol hwnd referenced in function win_new_chain log.obj : error LNK2019: unresolved external symbol hwnd referenced in function s_strerror options.obj : error LNK2001: unresolved external symbol hwnd log.obj : error LNK2019: unresolved external symbol WSASetLastError referenced in function s_log nogui.obj : error LNK2019: unresolved external symbol main_execute referenced in function main ..\bin\ARMV4I\tstunnel.exe : fatal error LNK1120: 4 unresolved externals NMAKE : fatal error U1077: 'link' : return code '0x460' Robert Bao Software House Tyco International 978-577-4202 Explore our new Tyco Online Learning Center Web-based Training Bundles at: www.swhouse.com/support/tyco_online_learning_center.aspx This e-mail may contain or have attached to it information or technology the export or re-export of which is restricted by U.S. laws and regulations. By viewing this e-mail and any attachments, the recipient agrees to the following: (i) the recipients use of the contents of this e-mail and any attachments shall comply with all applicable laws, rules and regulations, including, without limitation, U.S. international trade laws and regulations, and (ii) the recipient may not transfer or otherwise export or re-export any information or technology contained in this e-mail or any attachment except in full compliance with the export controls administered by the U.S. and other countries and any applicable import and use restrictions. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

WinCE link errors
by Bao, Robert 28 Nov '12

28 Nov '12

Dear Mike and WinCE stunnel users out there, I am currently in the process of compiling/linking the latest stunnel (4.54) for our ARM and WinCE 5.0 based device. I noticed that this version requires coredll.lib and corelibc.lib in the final link process (defined in the LIBS variable), which the old ones (e.g., version 4.33) didn't. Anyway, I got a lot of linking errors (see below), and just wondering any of you have seen the same errors and how you get around with these errors. If you have any other suggestions please feel free to let me know too. Note: I could resolve the errors at the bottom, but I have trouble get rid of the errors relating to wcecompatex.lib(redir.obj). Thank you for your time. wcecompatex.lib(redir.obj) : error LNK2005: fopen already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: fclose already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: fread already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: fwrite already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: _getstdfilex already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: _fileno already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: fflush already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: feof already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: ferror already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: clearerr already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: fseek already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: ftell already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: _setmode already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: fgets already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: fprintf already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : warning LNK4006: fopen already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: fclose already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: fread already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: fwrite already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: _getstdfilex already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: _fileno already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: fflush already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: feof already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: ferror already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: clearerr already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: fseek already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: ftell already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: _setmode already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: fgets already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: fprintf already defined in coredll.lib(COREDLL.dll); second definition ignored Creating library ..\bin\ARMV4I\tstunnel.lib and object ..\bin\ARMV4I\tstunnel.exp options.obj : error LNK2001: unresolved external symbol WSAGetLastError network.obj : error LNK2001: unresolved external symbol WSAGetLastError stunnel.obj : error LNK2019: unresolved external symbol WSAGetLastError referenced in function daemon_loop ctx.obj : error LNK2001: unresolved external symbol WSAGetLastError client.obj : error LNK2019: unresolved external symbol WSAGetLastError referenced in function init_remote log.obj : error LNK2001: unresolved external symbol WSAGetLastError client.obj : error LNK2019: unresolved external symbol hwnd referenced in function win_new_chain log.obj : error LNK2019: unresolved external symbol hwnd referenced in function s_strerror options.obj : error LNK2001: unresolved external symbol hwnd log.obj : error LNK2019: unresolved external symbol WSASetLastError referenced in function s_log nogui.obj : error LNK2019: unresolved external symbol main_execute referenced in function main ..\bin\ARMV4I\tstunnel.exe : fatal error LNK1120: 4 unresolved externals NMAKE : fatal error U1077: 'link' : return code '0x460' Robert Bao Software House Tyco International 978-577-4202 Explore our new Tyco Online Learning Center Web-based Training Bundles at: www.swhouse.com/support/tyco_online_learning_center.aspx This e-mail may contain or have attached to it information or technology the export or re-export of which is restricted by U.S. laws and regulations. By viewing this e-mail and any attachments, the recipient agrees to the following: (i) the recipients use of the contents of this e-mail and any attachments shall comply with all applicable laws, rules and regulations, including, without limitation, U.S. international trade laws and regulations, and (ii) the recipient may not transfer or otherwise export or re-export any information or technology contained in this e-mail or any attachment except in full compliance with the export controls administered by the U.S. and other countries and any applicable import and use restrictions.

2 1

equivalent to SSLHonorcipherorder in stunnel?
by Mehdi Bennani 28 Nov '12

28 Nov '12

Hi, I was wondering if there were a flag available in stunnel, that would be the equivalent of the Apache directive 'SSLHonorcipherorder' ? I would like to basically be able to 'force' server preferences, rather then client ones, during cipher negotiation SSL handshake. Thank you, Elextra-

2 1

Max Cookie Size
by Scott McKeown 20 Nov '12

20 Nov '12

Hi All, I was wondering if anyone knows if its possible to pass a 'really' large cookie through STunnel. I've just built the latest version again (output below). However, we have a client that is looking to pass 16Kb (yes I know please don't tell me this is a bad idea a I know this!) via a cookie. Since we are looking to include STunnel in our offerings I was wondering if we could increase or change the maximum allowed size. I have a script that will generate a test cookie of any size that I require to test with but I can only get an 8K cookie to work. Any help would be great. ~Yours, Scott [root@localhost ~]# stunnel -version stunnel 4.54 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.0-fips 29 Mar 2010 Threading:PTHREAD SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:POLL+IPv6 Global options: debug = daemon.notice pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = ALL:!SSLv2:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH (with "fips = no") sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds sslVersion = TLSv1 (with "fips = yes") sslVersion = TLSv1 for client, all for server (with "fips = no") stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none [root@localhost ~]# -- With Kind Regards. Scott McKeown Loadbalancer.org http://www.loadbalancer.org

2 2

Problem using stunnel on Windows 7
by Hal Hovland 18 Nov '12

18 Nov '12

I've spent days googling this and read everything relevant in the archives. I'm developing a Windows 7 program that connects to a financial trading exchange that expects all communication to be SSL'd. Everything I read said that stunnel is the answer because of ease of installation and use. After a day of abortive attempts to link to the exchange, I decided to create a much simpler test environment involving two Windows 7 computers next to each other here. One, let's call it Riven-II (192.168.1.9), is set up with a simple Listener program that listens on port 8000. From stunnel's viewpoint this will be a server. The second machine, Lightning (192.168.1.158), has a simple Sender program that sends a text message via port 7999 to Riven-II (192.168.1.9:8000) - this will be the Client. In the absence of stunnel, all messages sent from Lightning/Sender appears on the window of Listener. So far so good. I've downloaded and installed the very latest version (4.54) of stunnel on both machines. On installation I entered the same responses to the certificate generating process. On the Server machine, hard wired to a Broadband Router, I configured stunnel.conf as (removing comments for simplicity) debug = 7 output = stunnel.log socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 cert = stunnel.pem key = stunnel.pem options = NO_SSLv2 taskbar=yes [Listener] connect=8000 accept=8001 On the Client machine, connected to the router via wi-fi, we have in stunnel.conf debug = 7 output = stunnel.log cert = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 fips=no options = NO_SSLv2 delay=yes taskbar=yes client=yes [sender] accept = 0.0.0.0:7999 (I've tried just 7999 and 192.168.1.158:7999, here. Makes no difference) connect = 192.168.1.9:8001 I've tried many variations with the same result, but the above is where they have ended up. My understanding of this is that stunnel both ends will be intercepting port 8000 on the Server and port 7999 on the Client and presenting/receiving SSL encoded messages across the wire on port 8001. Starting stunnel in the Server (not as a Windows service, although I did try that as well) the following log appears: 2012.11.16 22:34:08 LOG7[3484:6184]: No limit detected for the number of clients 2012.11.16 22:34:08 LOG5[3484:6184]: stunnel 4.54 on x86-pc-msvc-1500 platform 2012.11.16 22:34:08 LOG5[3484:6184]: Compiled/running with OpenSSL 1.0.1c-fips 10 May 2012 2012.11.16 22:34:08 LOG5[3484:6184]: Threading:WIN32 SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:SELECT+IPv6 2012.11.16 22:34:08 LOG5[3484:6184]: Reading configuration from file stunnel.conf 2012.11.16 22:34:08 LOG5[3484:6184]: FIPS mode is enabled 2012.11.16 22:34:08 LOG7[3484:6184]: Compression not enabled 2012.11.16 22:34:08 LOG7[3484:6184]: Snagged 64 random bytes from C:/.rnd 2012.11.16 22:34:08 LOG7[3484:6184]: Wrote 1024 new random bytes to C:/.rnd 2012.11.16 22:34:08 LOG7[3484:6184]: PRNG seeded successfully 2012.11.16 22:34:08 LOG6[3484:6184]: Initializing service [Listener] 2012.11.16 22:34:08 LOG7[3484:6184]: Certificate: stunnel.pem 2012.11.16 22:34:08 LOG7[3484:6184]: Certificate loaded 2012.11.16 22:34:08 LOG7[3484:6184]: Key file: stunnel.pem 2012.11.16 22:34:08 LOG7[3484:6184]: Private key loaded 2012.11.16 22:34:08 LOG7[3484:6184]: Could not load DH parameters from stunnel.pem 2012.11.16 22:34:08 LOG7[3484:6184]: Using hardcoded DH parameters 2012.11.16 22:34:08 LOG7[3484:6184]: DH initialized with 2048-bit key 2012.11.16 22:34:08 LOG7[3484:6184]: ECDH initialized with curve prime256v1 2012.11.16 22:34:08 LOG7[3484:6184]: SSL options set: 0x01000004 2012.11.16 22:34:08 LOG5[3484:6184]: Configuration successful 2012.11.16 22:34:08 LOG7[3484:6184]: Service [Listener] (FD=272) bound to 0.0.0.0:8001 On the Client, the log shows: 2012.11.16 22:25:53 LOG7[4184:4948]: No limit detected for the number of clients 2012.11.16 22:25:53 LOG5[4184:4948]: stunnel 4.54 on x86-pc-msvc-1500 platform 2012.11.16 22:25:53 LOG5[4184:4948]: Compiled/running with OpenSSL 1.0.1c-fips 10 May 2012 2012.11.16 22:25:53 LOG5[4184:4948]: Threading:WIN32 SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:SELECT+IPv6 2012.11.16 22:25:53 LOG5[4184:4948]: Reading configuration from file stunnel.conf 2012.11.16 22:25:53 LOG5[4184:4948]: FIPS mode is disabled 2012.11.16 22:25:53 LOG7[4184:4948]: Compression not enabled 2012.11.16 22:25:53 LOG7[4184:4948]: Snagged 64 random bytes from C:/.rnd 2012.11.16 22:25:53 LOG7[4184:4948]: Wrote 1024 new random bytes to C:/.rnd 2012.11.16 22:25:53 LOG7[4184:4948]: PRNG seeded successfully 2012.11.16 22:25:53 LOG6[4184:4948]: Initializing service [sender] 2012.11.16 22:25:53 LOG7[4184:4948]: Certificate: stunnel.pem 2012.11.16 22:25:53 LOG7[4184:4948]: Certificate loaded 2012.11.16 22:25:53 LOG7[4184:4948]: Key file: stunnel.pem 2012.11.16 22:25:53 LOG7[4184:4948]: Private key loaded 2012.11.16 22:25:53 LOG7[4184:4948]: SSL options set: 0x01000004 2012.11.16 22:25:53 LOG5[4184:4948]: Configuration successful 2012.11.16 22:25:53 LOG7[4184:4948]: Service [sender] (FD=224) bound to 0.0.0.0:7999 Running the Listener on the Server and Sender on the Client adds nothing to the log, and port sniffers on both machines show traffic between 7999 and 8000 (exactly the same as when stunnel is not running). No sign of the use of port 8001. I'd appreciate any input on this. I'm sure I must be doing something stupid, but I've watched hours of YouTube videos, read many hundreds of web pages, and been through the documentation quite a few times, to no avail. I have a Java based version, running in a JVM in the same Windows machines, that talks perfectly to the exchange using some inbuilt SSL capabilities of an included library, so that should probably eliminate any hardware/router issues? Regards, Hal

4 10

log rotation
by Michael Curran 11 Nov '12

11 Nov '12

Are there any built in stunnel.conf parameters for log rotation? Im looking for windows based -- not logrotate on unix -- thats simple Do I need to use windows third party logrotate tools to make this happen instead?

2 1

High memory usage problem.
by Jeremy Frady 11 Nov '12

11 Nov '12

Thanks for taking the time to read this. We're operating on a low spec system that can not be modified at this point. stunnel was introduced at the last minute, without consideration to resource requirements and now consumes enough ram to cause the kernel to issue OOM exceptions. So in short, we are trying to trade increased CPU usage for less memory usage and have tried setting “sessions” to 3600 to reduce memory pressure, but unfortunately it doesn't last. Our current solution is to cron a restart of stunnel on a regular basis, but would prefer to limit number of threads or number of cache entries or something else altogether similarly gentler. Thanks again for your consideration and assistance in this! If there's any specific information I can give, please let me know. Regards, Jeremy

2 1

How do I re-encrypt ssl traffic with stunel?
by Arsen Zahray 11 Nov '12

11 Nov '12

I'm trying to set up wireshark debugging of ssl traffic by following this article: http://www.webos-internals.org/wiki/Decrypt_SSL_(trusted_man-in-the-middle_t echnique) It lists following stunnel commands to do the job: Listen on local IP and de-SSL traffic to localhost:8080 sudo stunnel -p ps.pem -d 443 -r 8080 Listen on 8080, re-SSL to remote server on 443 sudo stunnel -c -d 8080 -r ps.palmws.com:443 The article seems outdated, and stunnel does not react on these commands anymore. Can anyone provide me with a proper configuration file to do the same?

3 2

FIPS enablement
by Michael Curran 05 Nov '12

05 Nov '12

Hello I think there is a bit of confusion within my company on what stunnel can do in regards to FIPS 140-2 out of the box. I know there are configuration options that can enable or disable FIPS 140-2 mode, but as the man page indicates fips = yes | no Enable or disable FIPS 140-2 mode. This option allows to disable entering FIPS mode if stunnel was compiled with FIPS 140-2 support. default: yesWhich to me says I have to compile stunnel on my own using openssl with fips libraries to build a Stunnel binary that can support FIPS 140-2 compliance -- if I download just the windows or unix binaries and install them -- then I am not going to be 140-2 compliant where I set the config file to yes or no , since the FIPS modules wont be compiled into the binary. I'm just looking for confirmation before I take this back to the rest of my group. Thanks!! Michael Curran

3 2

Re: [stunnel-users] Fw: Using stunnel to add https to a webserver that doesn't have ssl setup
by mkanet＠yahoo.com 02 Nov '12

02 Nov '12

Thanks for the reply. Lots of friendly people on here. I should have probably posted my solution when I figured it out. I was already using a server-based method to handle redirection. However, what I didn't consider is adding a one line exception that distinguishes incoming requests from stunnel on 127.0.0.1 in order to prevent an endless loop. I did this by modifying my IIS URL Rewrite module rule to look like below. URL Rewrite module 2.0 is highly optimized; and is ideal for this kind of thing; works perfect under any circumstance; so long as webpages contain relative elements. Works like a charm. <rewrite> <rules> <rule name="HTTP to HTTPS redirect" stopProcessing="true"> <match url="(.*)" /> <conditions logicalGrouping="MatchAll"> <add input="{HTTPS}" pattern="off" ignoreCase="true" /> <add input="{REMOTE_ADDR}" pattern="127.0.0.1" negate="true" /> </conditions> <action type="Redirect" redirectType="Found" url="https://{HTTP_HOST}/{R:1}" /> </rule> </rules> </rewrite> ----- Forwarded Message ----- On Tue, 30 Oct 2012 15:05:54 -0700 (PDT) <mkanet(a)yahoo.com> wrote: > Thanks. I typically let my webserver handle SSL whenever I can since > it's much easier that way; especially since I know how to handle > http->https urlrewrites that way already; and, plenty of examples on > the web for IIS. The reasons for adding stunnel into the mix in this > scenerio completely outweight not having it at all. I couldn't find > any examples anywhere showing how to handle a simple http to https URL redirect if stunnel is involved; not even in javascript. > Hopefully someone here has the expertise to offer a solution at least in html. The easiest way is to use a server side language as PHP and ASP or CGI/perl (if ISS is capable, that I don't know). If you relay on client (javascript, meta refresh) you can't control the behavior of the client (javascript disabled by user or meta redirects). ISS is capable of PHP and, if you are using it, because you didn't tell, is easy (easy, but I haven't done as I don't know much of PHP (I just played a couple of times with it following tutorials)). With ASP, I don't know, but should be possible too. Here you have an example with PHP: http://www.iis-aid.com/articles/how_to_guides/three_methods_redirect_http_h… or this one: http://stackoverflow.com/questions/5106313/redirecting-from-http-to-https-w… (second message). As I said, you have to do it transparent to the user without relying on them.

1 0

Fw: Using stunnel to add https to a webserver that doesn't have ssl setup
by Michael Avanessian 02 Nov '12

02 Nov '12

Thanks. I typically let my webserver handle SSL whenever I can since it's much easier that way; especially since I know how to handle http->https urlrewrites that way already; and, plenty of examples on the web for IIS. The reasons for adding stunnel into the mix in this scenerio completely outweight not having it at all. I couldn't find any examples anywhere showing how to handle a simple http to https URL redirect if stunnel is involved; not even in javascript. Hopefully someone here has the expertise to offer a solution at least in html. On 30.10.2012 20:39, MKANET wrote > Thanks for the quick reply! So... what http code do I use to break > out the infinite loop so it loads only once? I'm afraid I can't answer that one, as you're using IIS and I'm Unices centered. FWIW, in situations where the port-80 service does *nothing but* hand out redirects to port 443, I typically let the full-blown webserver handle the HTTPS (whether natively or behind an SSL wrapper) and use a boilerplate PERL script (alas, not readily usable on Windows) for the redirecting. I've seen too many kinds of webserver doing redirections to autodetermined URLs that happen to miss some vital part of the originally requested URL, including some that *cause* the browser to drop from HTTPS back to HTTP in the first place. :-S Regards, ----- Forwarded Message ---- Thanks for the quick reply! So... what http code do I use to break out the infinite loop so it loads only once? I think the other 2 circumstances may have something similar happening to them (which are forwarded using the web server instead). If I use the webserver to rewrite the URL, the web browser tries to do something (I can't tell what), then returns the error below: The page isn't redirecting properly Firefox has detected that the server is redirecting the request for this address in a way that will never complete. > Normally, I could do this a few different ways (provided my webserver > had ssl added to it natively in a normal way) 1. webserver URL Rewrite > plugin 2. webserver redirect plugin > 3: > > For whatever reason, I'm having all sorts of weird issues when > trying the three methods above if I use stunnel for ssl instead of > using the webserver's builtin ssl. Please note that traffic coming out of the stunnel looks - and actually *is* - just as port-80-ish to the actual webserver as native HTTP requests do, so unless you take special measures to break the loop, the webserver will try to (re-)redirect *that, too*. Regards, J. Bern --

2 1

enabling https capability
by John A. Wallace 01 Nov '12

01 Nov '12

Not sure if this is the right place to ask, but I will give it a try because it seems likely that someone here can point me in the right direction if need be. I am not a programmer. I have an application that can make http connections but not https. The connections are made from a Windows command line interface, not a browser. I would like to enable it to make https connections too without having to reinvent the wheel. If there is some way to connect it to an intermediary proxy program that does have built-in support for the https protocol, that would be swell. Is such a thing possible or is there another solution I don't see? Thanks. John

2 1

Fwd: Trying to minimize memory usage for a scenario where we have several long-lived HTTPS connections.
by Jeremy Frady 31 Oct '12

31 Oct '12

Hello all, Thanks for taking the time to read this. We're operating on a low spec system that can not be modified at this point. stunnel was introduced at the last minute, without consideration to resource requirements and now consumes enough ram to cause the kernel to issue OOM exceptions. So in short, we are trying to trade increased CPU usage for less memory usage and have tried setting “sessions” to 3600 to reduce memory pressure, but unfortunately it doesn't last. Our current solution is to cron a restart of stunnel on a regular basis, but would prefer to limit number of threads or number of cache entries or something else altogether similarly gentler. Thanks again for your consideration and assistance in this! Regards, Jeremy

1 0

6 processes + out of memory issues on CentOS 6 stunnel (4.29)
by Todd Rinaldo 31 Oct '12

31 Oct '12

I'm experimenting with using the stunnel that comes with CentOS 6 (4.29). I have a config file that is successfully being used on stunnel version 4.15 on the same host without any issues. My issues: 1. starting stunnel creates 6 processes. I assume this has something to do with libwrap, but I'm not finding much discussion about it by doing a search. I'm also assuming that the binaries are forking after load, so it's not a significant memory expense to do this due to COW. Is this correct? 2. I'm getting 't of memory' (no "ou" in the error) messages from syslog when I do more than one request via chrome to port 2087. The process indicated from the message points to the stunnel process that has ownership of the open ports. A single request to this port doesn't seem to spawn the issue. Can anyone suggest what might be causing this? Upgrading to a newer version of stunnel is possible, but I would prefer to keep the version Red Hat provides so they can be on the hook for CVE issues. My config file follows: ----- cert = /var/cpanel/ssl/cpanel/cpanel.pem chroot = /usr/local/cpanel/var/run/stunnel/ # PID is created inside chroot jail pid = /stunnel.pid setuid = cpanel setgid = cpanel # Service-level configuration [cpanelhttps] accept = 2083 connect = 2082 TIMEOUTclose = 0 [whmhttps] accept = 2087 connect = 2086 TIMEOUTclose = 0 [webmailhttps] accept = 2096 connect = 2095 TIMEOUTclose = 0

1 0

Re: [stunnel-users] Using stunnel to add https to a webserver that doesn't have ssl setup
by Michael Avanessian 30 Oct '12

30 Oct '12

Thanks for the quick reply! So... what http code do I use to break out the infinite loop so it loads only once? I think the other 2 circumstances may have something similar happening to them (which are forwarded using the web server instead). If I use the webserver to rewrite the URL, the web browser tries to do something (I can't tell what), then returns the error below: The page isn't redirecting properly Firefox has detected that the server is redirecting the request for this address in a way that will never complete. > Normally, I could do this a few different ways (provided my webserver > had ssl added to it natively in a normal way) 1. webserver URL Rewrite > plugin 2. webserver redirect plugin > 3: > > For whatever reason, I'm having all sorts of weird issues when > trying the three methods above if I use stunnel for ssl instead of > using the webserver's builtin ssl. Please note that traffic coming out of the stunnel looks - and actually *is* - just as port-80-ish to the actual webserver as native HTTP requests do, so unless you take special measures to break the loop, the webserver will try to (re-)redirect *that, too*. Regards, J. Bern --

2 1

Using stunnel to add https to a webserver that doesn't have ssl setup
by Michael Avanessian 30 Oct '12

30 Oct '12

Hi there. I appreciate that you guys are all helping each other out. I am brand new to stunnel. Currently, I'm using stunnel to add https to a webserver that doesn't have ssl setup; which works great. I prefer to do that instead of using the webserver's builtin ssl feature. CONFIGURATION: Stunnel.conf includes (which adds ssl to incoming http traffic on port 443) [https] accept = 443 connect = 80 Also, incoming http:80 traffic can also come in; which would bypass stunnel, and go directly to the webserver as http. OBJECTIVE: I am trying to make it so when someone visits: http://mywebsite.com (it forwards automatically to https://mywebsite.com). Normally, I could do this a few different ways (provided my webserver had ssl added to it natively in a normal way) 1. webserver URL Rewrite plugin 2. webserver redirect plugin 3: <meta http-equiv="refresh" content="0; url=https://mywebsite.com"> For whatever reason, I'm having all sorts of weird issues when trying the three methods above if I use stunnel for ssl instead of using the webserver's builtin ssl. The first two methods result in web browser redirect errors, the third method result in an infinite loop reloading the https website. Can someone please tell me what extra accommodation I need to make considering that using stunnel for https can complicate things. I'm using IIS 7.5 as my webserver. I've tried using the the URL rewrite 2.0 mod using the below rule (which works for normal builtin ssl support in the webserver: <rule name="Redirect to HTTPS" stopProcessing="true"> <match url="(.*)" /> <conditions><add input="{HTTPS}" pattern="^OFF$" /> </conditions> </rule> I have also tried the "http redirect" mod; which I can forward to any website except for the one I'm trying to do. Both take me to the https equivalent and give a redirect error. Could someone please be kind enough to tell me what I'm missing? Thanks!

2 1

How upgrade stunnel?
by magali morales 30 Oct '12

30 Oct '12

Hi!! I have installed the version 4.44 of stunnel, haproxy I am currently using 1.4.22. I need to update stunnel most recent version. How do I update stunnel to the latest version? And I want to know How do I uninstall stunnel? I hope you can help me, I thank you in advance!

7 7

TIMEOUTclose exceeded: closing
by Michael Wittig 25 Oct '12

25 Oct '12

Hi, I am using stunnes 4.54, my config looks like this: chroot = /opt/stunnel/jail/ setuid = stunnel setgid = stunnel pid = /stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 syslog = yes debug = local1.warning fips = no [http] cert = /opt/stunnel/www.crt key = /opt/stunnel/www.key sslVersion = all options = NO_SSLv2 renegotiation = no accept = 192.168.72.10:443 connect = 192.168.71.10:80 TIMEOUTclose = 0 xforwardedfor = yes My log is full with: Oct 25 14:49:33 www stunnel: LOG3[15114:140668359968512]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing Oct 25 14:49:36 www stunnel: LOG3[15114:140668360591104]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing Oct 25 14:50:08 www stunnel: LOG3[15114:140668360812288]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing Oct 25 14:50:13 www stunnel: LOG3[15114:140668360591104]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing The doc suggests to "set to 0 for buggy MSIE" the mailing list tells me "You requested close timeout of 0 seconds and that's exactly what you get." But i still don't understand why this is an error and what can I do to get rid of it? Or is it okay to don't look for errors in the log? Regards, Michael

2 1

some version issue
by Sergey Pimenov 25 Oct '12

25 Oct '12

Hello, I have a little problem, working with stunnel. The problem is: 25 10:50:53 LOG3[2612:1972]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number and the full log: 25 10:50:32 LOG7[2612:2988]: No limit detected for the number of clients 2012.10.25 10:50:32 LOG5[2612:2988]: stunnel 4.53 on x86-pc-mingw32-gnu platform 2012.10.25 10:50:32 LOG5[2612:2988]: Compiled/running with OpenSSL 0.9.8s-fips 4 Jan 2012 2012.10.25 10:50:32 LOG5[2612:2988]: Threading:WIN32 SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:SELECT+IPv6 2012.10.25 10:50:32 LOG5[2612:2988]: Reading configuration from file stunnel.conf 2012.10.25 10:50:33 LOG5[2612:2988]: FIPS mode is enabled 2012.10.25 10:50:33 LOG7[2612:2988]: Compression not enabled 2012.10.25 10:50:33 LOG7[2612:2988]: PRNG seeded successfully 2012.10.25 10:50:33 LOG6[2612:2988]: Initializing service section [POS] 2012.10.25 10:50:33 LOG7[2612:2988]: Certificate: C:\Arcus2\SSL\pos3135pem.pem 2012.10.25 10:50:33 LOG7[2612:2988]: Certificate loaded 2012.10.25 10:50:33 LOG7[2612:2988]: Key file: C:\Arcus2\SSL\pos3135key.pem 2012.10.25 10:50:33 LOG7[2612:2988]: Private key loaded 2012.10.25 10:50:33 LOG7[2612:2988]: SSL options set: 0x00000004 2012.10.25 10:50:33 LOG5[2612:2988]: Configuration successful 2012.10.25 10:50:33 LOG7[2612:2988]: Service [POS] (FD=180) bound to 127.0.0.1:9021 2012.10.25 10:50:53 LOG7[2612:2988]: Service [POS] accepted (FD=260) from 127.0.0.1:3645 2012.10.25 10:50:53 LOG7[2612:2988]: Creating a new thread 2012.10.25 10:50:53 LOG7[2612:2988]: New thread created 2012.10.25 10:50:53 LOG7[2612:1972]: Service [POS] started 2012.10.25 10:50:53 LOG5[2612:1972]: Service [POS] accepted connection from 127.0.0.1:3645 2012.10.25 10:50:53 LOG6[2612:1972]: connect_blocking: connecting 217.69.205.63:9021 2012.10.25 10:50:53 LOG7[2612:1972]: connect_blocking: s_poll_wait 217.69.205.63:9021: waiting 10 seconds 2012.10.25 10:50:53 LOG5[2612:1972]: connect_blocking: connected 217.69.205.63:9021 2012.10.25 10:50:53 LOG5[2612:1972]: Service [POS] connected remote server from 213.156.128.147:3646 2012.10.25 10:50:53 LOG7[2612:1972]: Remote socket (FD=284) initialized 2012.10.25 10:50:53 LOG3[2612:1972]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2012.10.25 10:50:53 LOG5[2612:1972]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2012.10.25 10:50:53 LOG7[2612:1972]: Remote socket (FD=284) closed 2012.10.25 10:50:53 LOG7[2612:1972]: Local socket (FD=260) closed 2012.10.25 10:50:53 LOG7[2612:1972]: Service [POS] finished (0 left) my .conf file is: cert = C:\Arcus2\SSL\pos3135pem.pem key = C:\Arcus2\SSL\pos3135key.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 CAfile = C:\Arcus2\SSL\cacert.pem debug = 7 output = stunnel.log [POS] client = yes accept = 127.0.0.1:9021 connect = xxx.xxx.xxx.xxx:9021 if I change conf file, adding sslVersion = all or sslVersion = SSLv3, I have another error Section POS: sslVersion = TLSv1 is required in FIPS mode Thank your for help, Sergey Pimenov

2 1

Stunnel 4.54 manifest
by John A. Wallace 24 Oct '12

24 Oct '12

Hi, Michal. Good news about the update! I noticed that this version, the one for Windows installation, has many more files in it than the last version. It's no problem, but I was just wondering why the change this time? Thanks. John > -----Original Message----- > From: stunnel-announce-bounces(a)stunnel.org [mailto:stunnel-announce- > bounces(a)stunnel.org] On Behalf Of stunnel-announce-request(a)stunnel.org > Sent: Wednesday, October 10, 2012 5:00 AM > To: stunnel-announce(a)stunnel.org > Subject: stunnel-announce Digest, Vol 48, Issue 1 > > Send stunnel-announce mailing list submissions to > stunnel-announce(a)stunnel.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-announce > or, via email, send a message with subject or body 'help' to > stunnel-announce-request(a)stunnel.org > > You can reach the person managing the list at > stunnel-announce-owner(a)stunnel.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-announce digest..." > > > Today's Topics: > > 1. stunnel 4.54 released (Michal Trojnara) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 09 Oct 2012 23:37:41 +0200 > From: Michal Trojnara <Michal.Trojnara(a)mirt.net> > To: stunnel-users(a)stunnel.org, stunnel-announce(a)stunnel.org, > openssl-users(a)openssl.org > Subject: [stunnel-announce] stunnel 4.54 released > Message-ID: <50749925.8030905(a)mirt.net> > Content-Type: text/plain; charset="iso-8859-1" > > Dear Users, > > > I have released version 4.54 of stunnel. The ChangeLog entry: > > > Version 4.54, 2012.10.09, urgency: MEDIUM: > * New Win32 features > - FIPS module updated to version 2.0. > - OpenSSL DLLs updated to version 1.0.1c. > - zlib DLL updated to version 1.2.7. > - Engine DLLs added: 4758cca, aep, atalla, capi, chil, cswift, gmp, > gost, nuron, padlock, sureware, ubsec. > * Other new features > - "session" option renamed to more readable "sessionCacheTimeout". > The old name remains accepted for backward compatibility. > - New service-level "sessionCacheSize" option to control session cache > size. > - New service-level option "reset" to control whether TCP RST flag is > used to indicate errors. The default value is "reset = yes". > - New service-level option "renegotiation" to disable SSL > renegotiation. > This feature is based on a public-domain patch by Janusz Dziemidowicz. > - New FreeBSD socket options: IP_FREEBIND, IP_BINDANY, IPV6_BINDANY > (thx to Janusz Dziemidowicz). > - New parameters to configure TLS v1.1/v1.2 with OpenSSL version 1.0.1 > or higher (thx to Henrik Riomar). > * Bugfixes > - Fixed "Application Failed to Initialize Properly (0xc0150002)" error. > - Fixed missing SSL state debug log entries. > - Fixed a race condition in libwrap code resulting in random stalls > (thx to Andrew Skalski). > - Session cache purged at configuration file reload to reduce memory > leak. > Remaining leak of a few kilobytes per section is yet to be fixed. > - Fixed regression bug in "transparent = destination" functionality > (thx to Stefan Lauterbach). This bug was introduced in stunnel 4.51. > - "transparent = destination" is now a valid endpoint in inetd mode. > - "delay = yes" fixed to work even if specified *after* "connect" > option. > - Multiple "connect" targets fixed to also work with delayed resolver. > - The number of resolver retries of EAI_AGAIN error has been limited > to > 3 in order to prevent infinite loops.. > > > Home page: https://www.stunnel.org/ <http://stunnel.mirt.net/> > Download: https://www.stunnel.org/downloads.html > <ftp://stunnel.mirt.net/stunnel/> > > > SHA-256 hash for stunnel-4.54.tar.gz: > > b7e1b9e63569574dbdabee8af90b8ab88db3fe13dcb1268d59a1408c56e6de7b > > > Best regards, > > Mike > > > -------------- next part -------------- A non-text attachment was > scrubbed... > Name: signature.asc > Type: application/pgp-signature > Size: 196 bytes > Desc: OpenPGP digital signature > URL: <http://www.stunnel.org/pipermail/stunnel- > announce/attachments/20121009/f9eac1e3/attachment-0001.pgp> > > ------------------------------ > > _______________________________________________ > stunnel-announce mailing list > stunnel-announce(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-announce > > > End of stunnel-announce Digest, Vol 48, Issue 1 > ***********************************************

3 6

Re: [stunnel-users] (no subject)
by John 23 Oct '12

23 Oct '12

wrote in message news:... Path: news.gmane.org!not-for-mail From: Leandro Avila <leandro.avila(a)ymail.com> Newsgroups: gmane.network.stunnel.user Subject: Re: Safest suggested client/server stunnel configurations to prevent MITM attacks Date: Mon, 22 Oct 2012 12:50:07 -0700 (PDT) Lines: 52 Approved: news(a)gmane.org Message-ID: <1350935407.72221.YahooMailNeo(a)web111004.mail.gq1.yahoo.com> References: <4B5D7F24543C2E4DB3172B1F82446E56C8473D31(a)CBMBOX1.cloudblock.com> Reply-To: Leandro Avila <leandro.avila(a)ymail.com> NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 X-Trace: ger.gmane.org 1350935423 5511 80.91.229.3 (22 Oct 2012 19:50:23 GMT) X-Complaints-To: usenet(a)ger.gmane.org NNTP-Posting-Date: Mon, 22 Oct 2012 19:50:23 +0000 (UTC) To: "Michael K. Avanessian" <michael(a)mka.net>, "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Original-X-From: stunnel-users-bounces(a)stunnel.org Mon Oct 22 21:50:30 2012 Return-path: <stunnel-users-bounces(a)stunnel.org> Envelope-to: gnsu-stunnel-users(a)m.gmane.org Original-Received: from linode.mirt.net ([207.192.69.165]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from <stunnel-users-bounces(a)stunnel.org>) id 1TQO15-0006Lq-PI for gnsu-stunnel-users(a)m.gmane.org; Mon, 22 Oct 2012 21:50:28 +0200 Original-Received: from linode.mirt.net (localhost [127.0.0.1]) by linode.mirt.net (Postfix) with ESMTP id E06E11C115; Mon, 22 Oct 2012 21:50:13 +0200 (CEST) X-Original-To: stunnel-users(a)stunnel.org Delivered-To: stunnel-users(a)stunnel.org Original-Received: from nm7-vm0.bullet.mail.ne1.yahoo.com (nm7-vm0.bullet.mail.ne1.yahoo.com [98.138.91.66]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by linode.mirt.net (Postfix) with ESMTPS id 2914F1C0F8 for <stunnel-users(a)stunnel.org>; Mon, 22 Oct 2012 21:50:09 +0200 (CEST) Original-Received: from [98.138.90.52] by nm7.bullet.mail.ne1.yahoo.com with NNFMP; 22 Oct 2012 19:50:08 -0000 Original-Received: from [98.138.89.195] by tm5.bullet.mail.ne1.yahoo.com with NNFMP; 22 Oct 2012 19:50:08 -0000 Original-Received: from [127.0.0.1] by omp1053.mail.ne1.yahoo.com with NNFMP; 22 Oct 2012 19:50:08 -0000 X-Yahoo-Newman-Property: ymail-3 X-Yahoo-Newman-Id: 65068.27023.bm(a)omp1053.mail.ne1.yahoo.com Original-Received: (qmail 75038 invoked by uid 60001); 22 Oct 2012 19:50:07 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ymail.com; s=s1024; t=1350935407; bh=0Y+VdggsIVZOwOr4EaEYksE57qG+K4Xf7m79PQuMl/4=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type:Content-Transfer-Encoding; b=uUP64Hu7MIb0ahLEqKeQ2rUov8flXv6sjA7h5DanB+bxl2m8dRHLsiUrFHiPFhWcsNIUGtevpvfsxYifmZPjIMTiOvHyxZPxQo2uXvlAzOZKwPuaNEvXrYVNiwVO0nZjG00eA+Gpo8dJCS50OObUbvjympoIhG60TioBD4rSw5U= DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=ymail.com; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type:Content-Transfer-Encoding; b=wx17KKam+BlR2A3orpl30Y8/UU3T1ZQ5cDajNEkq008Ppz1baFHK10kwWYt35qPShDTswy2xduxRIzGN/JTVdE8Vb9hFmfmWPtOkptIRxMf26YV6r/x53AKs8rACXc8tNyJVeczxzNSAE1/iycwLc4Q5lwdUda4qUe8+09gtNa0=; X-YMail-OSG: b3DSDKgVM1mQHP5ZBTfIr3A5W2ZGXp385_N0YTtfmQmY8Tx PSFpP624fQl9zaJm1NcwnCvuFSUunTJ.Q6u_X6ZqnTdr.J_LYAj5IOqyykQ2 l4Al99RB4Au24agY5aySFUQj2AVKVLlThmnaaZKrM2O6i4lQj42kjXE9SjCN Ko1OE8i8SRI1X8s_OszQhSFqPwpJVxJ6a8XwsT.HHRvnjCN5oawxLfeYhi8I Nc497s5NZ3BjLmS2ddO1rE_aDEXfeZZf5G4FssKYeY.CR5XmhczPnRsqEOO0 nYj_KNi6UlLDyqhpRuMqUJYBD.JQXLJzN9IG3zKYBdvkip2LXSMmutoKPT8Z oEEAd3OEom9Rew5fODminUDtopQjgJUGkRl5fJPz2xthop6HA8XuKHCMTM6B d1YYbS_V1c5QklFH6aN6XbAYJRG36RA9gKBGsO2BVZ_5t36738Y3Bff.0ySt 6iW79amGPEIc__mjy0VELbOmQ3WPpHOPdBiH.GuHKGcmpVqApD5u2dHxOWa0 cJzYLcE0Fdfsdr6YOWGOh9jGD.P.St5QItI4sMxAhQ9WROechXtibFdHjrFO _Md3OgU8mIpgCFwIbK4b2K4cyPAiM5Kl1P_uFLQ5HE9uAg_8I64GtaSYyTGM 1aFaD9IVrniBqWo.oWvM2Lp.7TyGddU7.olqsc6MmSljcf4b.Rx5cRTwDw2R Kqc1fDQWPPxDDd1pMa1Nasg27P2qGUEy1DSofVwCgDn9MSKvSGj8- Original-Received: from [134.161.133.36] by web111004.mail.gq1.yahoo.com via HTTP; Mon, 22 Oct 2012 12:50:07 PDT X-Rocket-MIMEInfo: 001.001, Pl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCj4gRnJvbTogTWljaGFlbCBLLiBBdmFuZXNzaWFuIDxtaWNoYWVsQG1rYS5uZXQ.Cj5UbzogInN0dW5uZWwtdXNlcnNAc3R1bm5lbC5vcmciIDxzdHVubmVsLXVzZXJzQHN0dW5uZWwub3JnPiAKPlNlbnQ6IEZyaWRheSwgT2N0b2JlciAxOSwgMjAxMiAxMDo0MSBQTQo.U3ViamVjdDogW3N0dW5uZWwtdXNlcnNdIFNhZmVzdCBzdWdnZXN0ZWQgY2xpZW50L3NlcnZlciBzdHVubmVsIGNvbmZpZ3VyYXRpb25zIHRvIHByZXZlbnQgTUlUTSBhdHRhY2tzCgoBMAEBAQE- X-Mailer: YahooMailWebService/0.8.123.460 In-Reply-To: <4B5D7F24543C2E4DB3172B1F82446E56C8473D31(a)CBMBOX1.cloudblock.com> X-BeenThere: stunnel-users(a)stunnel.org X-Mailman-Version: 2.1.13 Precedence: list List-Id: "public, moderate-volume list - general discussion, problem reports, patches" <stunnel-users.stunnel.org> List-Unsubscribe: <https://www.stunnel.org/cgi-bin/mailman/options/stunnel-users>, <mailto:[email protected]?subject=unsubscribe> List-Archive: <http://www.stunnel.org/pipermail/stunnel-users> List-Post: <mailto:[email protected]> List-Help: <mailto:[email protected]?subject=help> List-Subscribe: <https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users>, <mailto:[email protected]?subject=subscribe> Original-Sender: stunnel-users-bounces(a)stunnel.org Errors-To: stunnel-users-bounces(a)stunnel.org Xref: news.gmane.org gmane.network.stunnel.user:5976 Archived-At: <http://permalink.gmane.org/gmane.network.stunnel.user/5976> Pl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCj4gRnJvbTogTWljaGFlbCBLLiBBdmFu ZXNzaWFuIDxtaWNoYWVsQG1rYS5uZXQ+Cj5UbzogInN0dW5uZWwtdXNlcnNAc3R1bm5lbC5vcmci IDxzdHVubmVsLXVzZXJzQHN0dW5uZWwub3JnPiAKPlNlbnQ6IEZyaWRheSwgT2N0b2JlciAxOSwg MjAxMiAxMDo0MSBQTQo+U3ViamVjdDogW3N0dW5uZWwtdXNlcnNdIFNhZmVzdCBzdWdnZXN0ZWQg Y2xpZW50L3NlcnZlciBzdHVubmVsIGNvbmZpZ3VyYXRpb25zIHRvIHByZXZlbnQgTUlUTSBhdHRh Y2tzCgo+SeKAmW0gY3VycmVudGx5IHR1bm5lbGluZyBTU0ggb3ZlciBTU0wgdXNpbmcgc3R1bm5l bC4KPkkgdGhvdWdodCB0aGF0IHN0dW5uZWxlZCBzc2ggZGF0YSB3YXMgc2FmZS7CoCBIb3dldmVy LCByZWNlbnRseSBJ4oCZdmUgcmVhZCB0aGF0IGlmIGdvaW5nIHRocm91Z2ggYSBzb3BoaXN0aWNh dGVkIGh0dHAvaHR0cHMgcHJveHksIGl04oCZcyBwb3NzaWJsZSB0byBiZSBoYWNrZWQgYnkgYSDi gJxsZWdpdGltYXRl4oCdIG1pdG0gYXR0YWNrIHRvIGZvb2wgYW4gU1NMIGNsaWVudC4KClR1bm5l bGVkIGFuZCBub3QtdHVubmVsZWQgU1NIIGRhdGEgX2lzXyBzYWZlLiBUaGUgU1NIIHByb3RvY29s IGlzIHByZXR0eSBzZWN1cmUgYnkgaXRzZWxmLsKgCgpNeSB1bmRlcnN0YW5kaW5nIGlzIHRoYXQg dG8gcHVsbCBvZmYgdGhlIHR5cGUgb2YgU1NML1RMUyBkYXRhIGluc3BlY3Rpb24gdGhhdCB5b3Ug bWVudGlvbgpodHRwOi8vd3d3LnNvdXJjZWZpcmUuY29tL3NlY3VyaXR5LXRlY2hub2xvZ2llcy9u ZXR3b3JrLXNlY3VyaXR5L3NzbC1lbmNyeXB0aW9uLWRlY3J5cHRpb24KCnRoZXJlIGhhcyB0byBi ZSBzb21lIHdvcmsgZG9uZSBvbiB0aGUgY2xpZW50IHNpZGUgb2YgdGhlIGNvbm5lY3Rpb24uIChJ bnN0YWxsIGEgY3VzdG9tCgpDQSBjZXJ0aWZpY2F0ZSBpbiB0aGUgdHJ1c3RlZCBjZXJ0aWZpY2F0 ZSBzdG9yZSBvZiB0aGUgY2xpZW50IG1hY2hpbmUpCgpTbyBldmVuIGlmIHlvdSB3ZXJlIG9uIHN1 Y2ggYSBuZXR3b3JrLCBhcyBsb25nIGFzIHlvdXIgImF0dGFja2VyIiBkb2VzIG5vdCBoYXZlIGNv bnRyb2wKb2YgeW91ciBtYWNoaW5lLiB0aGUgU1NML1RMUyBwcm90b2NvbCB3aWxsIHByb3RlY3Qg eW91IGJlY2F1c2Ugb2YgdGhlIHdheSBrZXlzIChjZXJ0aWZpY2F0ZXMpCmFyZSB2ZXJpZmllZC4g KE5vdGljZSB0aGUga2V5IHdvcmQgaGVyZSBpcyB2ZXJpZmllZCkKCj7CoAo+SXMgaXQgc3RpbGwg cG9zc2libGUgdG8gY29uZmlndXJlIHN0dW5uZWwgc28gdGhhdCBzc2wgY2Fu4oCZdCBiZSBjb21w cm9taXNlZCBiZXR3ZWVuIGJvdGggZW5kcz8KPsKgCj5J4oCZbSBnb2luZyB0byB0YWtlIGEgd2ls ZCBndWVzcyBoZXJlOyB3aGljaCBJ4oCZbSBzdXJlIEnigJltIHByb2JhYmx5IHdyb25nLsKgIEJ1 dCwgY291bGQgSSBqdXN0IGluc3RhbGwgc3R1bm5lbDsgYW5kLCBsZXQgaXQgY3JlYXRlIGF1dG9t YXRpY2FsbHkgYSBzZWxmLXNpZ25lZCAoc3R1bm5lbC5wZW0pIGNlcnRpZmljYXRlIGZpbGXigKYg dGhlbiBqdXN0IGNvcHkgdGhhdCBmaWxlIHRvIHRoZSBzdHVubmVsIGluc3RhbGwgb24gdGhlIG90 aGVyIGVuZD/CoCBUaGF0IHdheSBib3RoIHNpZGVzIGFyZSBhbHJlYWR5IGF3YXJlIG9mIGVhY2gg b3RoZXLigJlzIHB1YmxpYyBrZXlzOyBhbmQsIHdvdWxkbuKAmXQgYmUgdnVsbmVyYWJsZSBkdXJp bmcgdGhlIGluaXRpYWwgdW5lbmNyeXB0ZWQgaGFuZHNoYWtlPwo+wqAKPknigJltIHN1cmUgSeKA mW0gcHJvYmFibHkgd2F5IG9mZjsgYW5kLCB0aGVyZeKAmXMgbW9yZSBJIG5lZWQgdG8gZG8gaW4g c3R1bm5lbOKAmXMgY29uZmlndXJhdGlvbiB0byBmdXJ0aGVyIGVuc3VyZSB0aGUgU1NMIHdvbuKA mXQgYmUgY29tcHJvbWlzZWQuLiBzdWNoIGFzIHRoZSBzdHVubmVsIOKAnHZlcmlmeeKAnSBzZXR0 aW5nLsKgIEnigJltIG5vdCBzdXJlIHdoaWNoIHNldHRpbmcgdG8gaGF2ZSBpdDsgYW5kLCB3aGF0 IGl0IGFjdHVhbGx5IGRvZXMuCj7CoAo+SeKAmW0gaG9waW5nIHNvbWVvbmUgY291bGQgc2hlZCBz b21lIGxpZ2h0IG9uIHRoaXMgd2l0aCBzaW1wbGUgc3VnZ2VzdGVkIGNsaWVudMOgIHNlcnZlciBj b25maWdzIHRoYXQgd291bGQga2VlcCBzc2wgdW5jb21wcm9taXNlZCBhcyBtdWNoIGFzIHBvc3Np YmxlLgo+wqAKPlRoYW5rcyBpbiBhZHZhbmNlIQoKVGhlIGNvbmZpZ3VyYXRpb24geW91IGFyZSBs b29raW5nIGZvciBzdHVubmVsIGludm9sdmVzIHRoZSB2ZXJpZnkgbGV2ZWwgMyBzZXR0aW5nIG9u IHRoZSBjb25maWcKKFZlcmlmeSBwZWVyIHdpdGggbG9jYWxseSBpbnN0YWxsZWQgY2VydGlmaWNh dGUpCgpQbHVzIHRoZSBrZXkgbWFuYWdlbWVudCBpbnZvbHZlZCB0byBzZXQgdGhhdCB1cC4KClRh a2UgYSBsb29rIGEgdGhpcyBkb2N1bWVudC4gSXQgaXMgYSBsaXR0bGUgb3V0IG9mIGRhdGUuIEJV VCB0aGUgcGFydCBhYm91dCBzZXR0aW5nIHVwIHRoZQpjZXJ0aWZpY2F0ZXMgb24gY2xpZW50IGFu ZCBzZXJ2ZXIgc3RpbGwgYXBwbGllcy4gYW5kIGlzIGEgZ29vZCB3YXkgdG8gc3RhcnQKaHR0cDov L3d3dy5zeW1hbnRlYy5jb20vY29ubmVjdC9hcnRpY2xlcy9yZW1vdGUtZGVza3RvcC1tYW5hZ2Vt ZW50LXNvbHV0aW9uLW1pY3Jvc29mdAoKSG9wZSB0aGlzIGhlbHBzCgoKCkxlYW5kcm8gQXZpbGEK LS0tLS0tLS0tLS0tLS0tLQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXwpzdHVubmVsLXVzZXJzIG1haWxpbmcgbGlzdApzdHVubmVsLXVzZXJzQHN0dW5uZWwu b3JnCmh0dHBzOi8vd3d3LnN0dW5uZWwub3JnL2NnaS1iaW4vbWFpbG1hbi9saXN0aW5mby9zdHVu bmVsLXVzZXJzCg== ------------------------ In the above data, I do not see any legible information at all. What am I missing?

2 1

Safest suggested client/server stunnel configurations to prevent MITM attacks
by Michael K. Avanessian 22 Oct '12

22 Oct '12

I'm currently tunneling SSH over SSL using stunnel. I thought that stunneled ssh data was safe. However, recently I've read that if going through a sophisticated http/https proxy, it's possible to be hacked by a "legitimate" mitm attack to fool an SSL client. Is it still possible to configure stunnel so that ssl can't be compromised between both ends? I'm going to take a wild guess here; which I'm sure I'm probably wrong. But, could I just install stunnel; and, let it create automatically a self-signed (stunnel.pem) certificate file... then just copy that file to the stunnel install on the other end? That way both sides are already aware of each other's public keys; and, wouldn't be vulnerable during the initial unencrypted handshake? I'm sure I'm probably way off; and, there's more I need to do in stunnel's configuration to further ensure the SSL won't be compromised.. such as the stunnel "verify" setting. I'm not sure which setting to have it; and, what it actually does. I'm hoping someone could shed some light on this with simple suggested client--> server configs that would keep ssl uncompromised as much as possible. Thanks in advance!

3 2

Need help building FIPS capable Stunnel for Windows CE
by Bao, Robert 18 Oct '12

18 Oct '12

I am attempting to build a FIPS-capable Openssl for an XScale processor (ARMV4I) running under Windows CE 5.0 (using openssl-1.0.1c and openssl-fips-2.0.1), that was successful. Then I built the latest Stunnel (just released few days ago) with FIPS option turned on. The build appears to complete successfully. However, at run-time, entering FIPS mode fails and the following messages are produced: error stack: 2D079089 : error:2D079089:FIPS routines:fips_pkey_signature_test:test failure FIPS_mode_set: 2D06B06F: error:2D06B06F:FIPS routines:FIPS_check_incore_fingerprint:fingerprint does not match I have reviewed the build instructions outlined in the OpenSSL FIPS user guide carefully and believe all the build instructions have been adhered to. What needs to be changed for the signature to be properly embedded? Robert Bao Tyco

2 2

Unable to Stop Service - Windows XP SP3 x86
by Thomas Eifert 16 Oct '12

16 Oct '12

I just uninstalled Stunnel version 4.53 and replaced it with 4.54 on my Windows XP SP3 x86 machine. What I generally do is stop the service, uninstall the service, then uninstall Stunnel prior to installing the new version. When I attempted to stop the version 4.53 service via the start menu shortcut, I was unsuccessful; all that happened was that the Stunnel status/log window would launch. This was repeatable. Likewise, when I attempted to stop it from an elevated command prompt using stunnel.exe -stop, the result was the same. I am administrator on this machine. I launched services.msc, and was able to stop it from there without any difficulty. After I installed 4.54, just to see what would happen, I attempted to stop the service again using the same methods. Same result.. I just can't do it in the conventional manner. I checked to ensure that there was only one Stunnel service/process running, and that checks out okay. Not sure if others are seeing this issue, but thought I'd better let someone know about it. Thanks for the new version! Regards, Thomas -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

1 0

X-Forwarded-For stunnel 4.54 patch
by Michael Wittig 16 Oct '12

16 Oct '12

Hi, I created the X-Forwarded-For stunnel 4.54 patch: https://gist.github.com/3899818 Could someone else check it? -- Michael

1 0

Client Authentication and CRL Verification
by Jean-Philippe Constant 16 Oct '12

16 Oct '12

Hi, I am using stunnel in server mode with mutual authentication. The PKI used to authenticate my client is the following : root CA -> Intermediate CA -> Client. My stunnel configuration is : CAfile = RootCA.pem CRLfile = IntermediateCACRL.pem verify = 2 RootCA.pem contains the Root CA certificate IntermediateCACRL.pem contains the CRL file of the Intermediate CA The client authentication with client certificate goes well. The problem occurs when a client certificate is revoked. After the Intermediate CA CRL updates, the client certificate is still accepted whereas it should be refused. With the following configuration the revoked certificate is refused : CAfile = IntermediateCA.pem CRLfile = IntermediateCACRL.pem verify = 2 but I would prefer using the first configuration. Everything happens like if stunnel checks the crl only for the CA certificate and not for the whole certification chain. Thank you for your answers, Jean-Philippe Constant

1 0

SSL proxy in Windows - IP Address Issue
by Brian McGinity 16 Oct '12

16 Oct '12

Thank you so much for stunnel. This program is amazing!!!! In Windows, I'd like to move SSL processing out of Apache and into stunnel. Is there a way for Apache to know the client's ip address? - In Windows, "transparent" mode is unavailable - "xforwardedfor" is for smtp and not https connections - "protocol = proxy" is for Haproxy only? Brian

2 3

Asterisk with stunnel
by manjula hettiarachchi 15 Oct '12

15 Oct '12

Hi List I am new to stunnel, Just tried today to send Asterisk SIP request to stunnel client and forward to stunnel-server --> asterisk on another machine. (server ip=x.x.x.x) (client ip=y.y.y.y) Client config: cert=/etc/stunnel/stunnel.pem client=yes pid=/tmp/stunnel.pid debug=7 output=/etc/stunnel/stunnel.log [sip] accept=16380 connect=x.x.x.x:17380 ================================ Server Config: cert=/etc/stunnel/stunnel.pem #client=no pid=/tmp/stunnel.pid debug=7 output=/etc/stunnel/stunel.log [sip-IN] accept=17380 connect=5060 When tried 'telnet localhost 16380 from client machine i could see packets coming to server. However when Asterisk sends a sip request to port 16380, exten => _X.,1,Dial(SIP/${EXTEN}@y.y.y.y:16380,20,rt) i dont see packets forwaded to the server. Pls advise if anyone has used this scenario Best Regards Manjula

2 1

Re: [stunnel-users] stunnel-users Digest, Vol 99, Issue 2
by Scott McKeown 10 Oct '12

10 Oct '12

Hi Michal, Thats great news and thank you for update. I think the 'renegotiation' option will be a great addition. -- With Kind Regards. Scott McKeown Loadbalancer.org http://www.loadbalancer.org

1 0

stunnel 4.54 released
by Michal Trojnara 09 Oct '12

09 Oct '12

Dear Users, I have released version 4.54 of stunnel. The ChangeLog entry: Version 4.54, 2012.10.09, urgency: MEDIUM: * New Win32 features - FIPS module updated to version 2.0. - OpenSSL DLLs updated to version 1.0.1c. - zlib DLL updated to version 1.2.7. - Engine DLLs added: 4758cca, aep, atalla, capi, chil, cswift, gmp, gost, nuron, padlock, sureware, ubsec. * Other new features - "session" option renamed to more readable "sessionCacheTimeout". The old name remains accepted for backward compatibility. - New service-level "sessionCacheSize" option to control session cache size. - New service-level option "reset" to control whether TCP RST flag is used to indicate errors. The default value is "reset = yes". - New service-level option "renegotiation" to disable SSL renegotiation. This feature is based on a public-domain patch by Janusz Dziemidowicz. - New FreeBSD socket options: IP_FREEBIND, IP_BINDANY, IPV6_BINDANY (thx to Janusz Dziemidowicz). - New parameters to configure TLS v1.1/v1.2 with OpenSSL version 1.0.1 or higher (thx to Henrik Riomar). * Bugfixes - Fixed "Application Failed to Initialize Properly (0xc0150002)" error. - Fixed missing SSL state debug log entries. - Fixed a race condition in libwrap code resulting in random stalls (thx to Andrew Skalski). - Session cache purged at configuration file reload to reduce memory leak. Remaining leak of a few kilobytes per section is yet to be fixed. - Fixed regression bug in "transparent = destination" functionality (thx to Stefan Lauterbach). This bug was introduced in stunnel 4.51. - "transparent = destination" is now a valid endpoint in inetd mode. - "delay = yes" fixed to work even if specified *after* "connect" option. - Multiple "connect" targets fixed to also work with delayed resolver. - The number of resolver retries of EAI_AGAIN error has been limited to 3 in order to prevent infinite loops.. Home page: https://www.stunnel.org/ <http://stunnel.mirt.net/> Download: https://www.stunnel.org/downloads.html <ftp://stunnel.mirt.net/stunnel/> SHA-256 hash for stunnel-4.54.tar.gz: b7e1b9e63569574dbdabee8af90b8ab88db3fe13dcb1268d59a1408c56e6de7b Best regards, Mike

1 0

How to forward client's IP address with stunnel on Windows
by Emmanuel Egensperger 08 Oct '12

08 Oct '12

Dear stunnel's users, I have search on google and try many things on stunnel's configuration to forward ip address, but nothing works ? I have found this option in the FAQ : transparent = source But it seems that it doesn't work on windows ? >Line 22: "transparent = source": Specified option name is not valid here >Server is down Is there any solution to my problem ? Have I done something wrong ? Best regards, Manu Egen

2 1

Timeouts and inetd mode
by Bruce Guenter 28 Sep '12

28 Sep '12

Hi. As far as I can tell, if stunnel is running in "inetd mode", at least TIMEOUTbusy does not work. In particularl, stunnel will never timeout waiting for the SSL handshake to complete. If I'm reading the sources right, this is because the code to set up the SSL session calls SSL_accept before checking for data on stdin, and stdin is never set to non-blocking mode (only newly created sockets and/or pipes are). Would it make sense to set stdin (and stdout) to non-blocking mode when timeouts are enabled? Something in init_local maybe? -- Bruce Guenter <bruce(a)untroubled.org> http://untroubled.org/

1 0

SNI with wildcard certificates
by Gustavo Machado 27 Sep '12

27 Sep '12

Hi, I would like to use SNI in combination with wildcard certificates. I currently have the following configuration: [https] accept = 443 connect = 80 TIMEOUTclose = 0 cert = C:\default.pem key = C:\default.key ;SNI Config ;========== [https_a] sni = https:one.org connect = 80 cert = C:\a.pem key = C:\a.key [https_a_wc] sni = https:*.one.org connect = 80 cert = C:\b.pem key = C:\b.key If I go to https://one.org then I can see a.pem in the browser. If I go to https://mysubdomain.one.org I see default.pem. What am I missing?? Thanks! Gustavo

2 1

Chain pem files
by Gustavo Machado 27 Sep '12

27 Sep '12

Hi guys, Sorry for the newbie question, but I have the following configuration for an HTTPS endpoint: [https_one] sni = https:one.org connect = 44300 cert = D:\node\https\default.crt key = D:\node\https\default.key It works wonders, however I need to provide to this configuration two more .pem files for "chain". How would go about doing that? Thanks, Gustavo

1 1

Stunnel build with openssl 1.0+
by Gustavo Machado 27 Sep '12

27 Sep '12

Hi guys, I would like to use SNI and looks like I need a build with openssl 1.0+ Can you guys point me to a download link to the installer for that build? Thanks, Gustavo

2 2

(no subject)
by larisaka＠yahoo.com 25 Sep '12

25 Sep '12

http://www.steam-n-gleam.com/wp-content/plugins/bookingbug/google.html?fs=z…

1 0

Stunnel blocks booting process when no network connectivity
by Muschi Stevenson 25 Sep '12

25 Sep '12

My stunnel implementation works fine when the network is plugged in but it does not start at all, which stops the whole boot process, when there is no network connected on the machine (as a client). As extra information: - I'm using "delay=yes" - I'm using an fqdn (e.g: stunnel.mydomain.com) for the connections - Using stunnel 4.53 - Using ubuntu 12.04 but this also happened with centos5 previously however after some time it did boot on centos which doesn't happen in ubuntu How can this be avoided or a timeout specified? Doing an strace as suggested by symcbean shows the following (including the last part where it hangs): [...] --- SIGCHLD (Child exited) @ 0 (0) --- rt_sigreturn(0x11) = 0 close(3) = 0 wait4(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 6039 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7ff9ce0c79d0) = 6046 wait4(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 6046 --- SIGCHLD (Child exited) @ 0 (0) --- rt_sigreturn(0x11) = 6046 write(1, "[Started: /etc/stunnel/stunnel.c"..., 37) = 37 write(1, "stunnel.\n", 9) = 9 exit_group(0) = ? [...] stunnel hangs in this line: wait4(-1, and when i plug in the network cable it continues to show [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 6046 Any help would be appreciated as this is critically blocking our deployment http://serverfault.com/questions/429072/stunnel-delaying-boot

2 6

[patch] options-related-to-TLS-v1.1-v1.2
by Henrik Riomar 21 Sep '12

21 Sep '12

Hi, When building stunnel against OpenSSL 1.0.1 support for TLS v1.1/v1.2 gets included. This patch adds options to configure these protocols in stunnel.conf. The patch is against 4.53 and under public domain. Best Regards, Henrik

2 3

"Broken pipe" issue
by Kai M. Becker 20 Sep '12

20 Sep '12

Hi :) although several postings state that this issue has been fixed, I'm still getting this error message: Error detected on SSL (read) file descriptor: Broken pipe (32) OS: OpenSuSE 11.4 stunnel: 4.53 The original problem for taking a closer look though, are hanging incoming connections. I.e. a https request is not forwarded to the backend application, but hangs somewhere in limbo. My current workaround are TIMEOUT* settings to kill these connections. Does anyone have some suggestions how to solve these issues? Kai -- == Kai M. Becker == kmb(a)kai-m-becker.de == Bremen, Germany == "Any technology distinguishable from magic is insufficiently advanced"

2 2

SSL renegotiation patch
by Janusz Dziemidowicz 19 Sep '12

19 Sep '12

Hi, since I couldn't find a better place I'm sending a simple patch that allows to disable SSL renegotiation here. Possible reasons for this: - famous renegotiation SSL flaw, patched in OpenSSL a long time ago, but not everyone can or want to upgrade OpenSSL - renegotiation makes some DoS attacks much easier (see http://www.thc.org/thc-ssl-dos/), regardless of it being a secure one or not - it is really not needed in many cases The approach is based on what is being done in Apache. The default is to allow renegotation, so there should be no surprises for anyone after upgrade. Patch applies on latest (4.54b4) stunnel beta. Feel free to comment:) -- Janusz Dziemidowicz

3 13

Re: [stunnel-users] Binding to non-local sockets
by Janusz Dziemidowicz 19 Sep '12

19 Sep '12

2012/9/12 Willy Tarreau <w(a)1wt.eu>: > Janusz, > > I just saw your mail on stunnel-users. You don't need to use IP_FREEBIND > to bind to a non-existent address under Linux. You can simply enable > sys.net.ipv4.ip_nonlocal_bind to do this. This is how most users deal > with VRRP setups. It does not allow the backup server to receive the > traffic aimed at the missing address, but it allows the process to bind > even when the address is missing so that it becomes operational upon a > switchover. I am aware of this sysctl. However, this will allows any process on the system to bind to any address. In my case I prefer to enable this on per process basis to avoid any possible configuration errors in any other service running on my machines. Since stunnel already had low level socket options exposed I've simply added IP_FREEBIND to the list;) -- Janusz Dziemidowicz

1 0

Re: [stunnel-users] Trouble with smtp client connection and TLS inWindows
by David Schomaker 13 Sep '12

13 Sep '12

Adding "protocol = smtp" was the solution to my problem. Thank you Leonardo! Regards, David Schomaker ----- Original Message ----- From: "Leandro Avila" <leandro.avila(a)ymail.com> To: "David Schomaker" <david(a)schomaker.net>, "stunnel" <stunnel-users(a)stunnel.org> Date: Thu, 13 Sep 2012 09:26:00 -0700 Subject: Re: [stunnel-users] Trouble with smtp client connection and TLS inWindows David, Perhaps the issue is on the server side. A quick look to the SMTP server on smtp.smarshmail.com will show 220 smtp.smarshmail.com ESMTP Service is ready on Server 1 (EQ). EHLO 250-smtp.smarshmail.com Hello [123.456.790.101] 250-SIZE 36700160 250-PIPELINING 250-DSN 250-ENHANCEDSTATUSCODES 250-STARTTLS 250-AUTH GSSAPI NTLM 250-8BITMIME 250-BINARYMIME 250 CHUNKING QUIT 221 2.0.0 Service closing transmission channel I would try adding the following option to your stunnel configuration protocol = smtp I'm not certain but looks like you need to issue the STARTTLS to negociate the secure connection with this server. Check the stunnel manual for further explanation on the option http://www.stunnel.org/static/stunnel.html Hope this helps ----------------- Leandro Avila ----- Original Message ----- From: David Schomaker <david(a)schomaker.net> To: stunnel <stunnel-users(a)stunnel.org> Cc: Sent: Monday, September 10, 2012 10:32 PM Subject: [stunnel-users] Trouble with smtp client connection and TLS in Windows I need to configure stunnel to connect to smtp via TLS and am not able to get it to work either running 4.53 or 4.54beta. Perhaps I have the conf file created incorrectly. The stunnel.conf is as follows: +++++++++++++++++++++++++++++++++++++++ ; Debugging stuff (may useful for troubleshooting) debug = 7 output = c:\temp\stunnel.log ; Disable FIPS mode to allow non-approved protocols and algorithms ;fips = no ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 [SMARSH-pop3] client = yes accept = 127.0.0.1:110 connect = pop.smarshmail.com:995 [SMARSH-smtp] client = yes SSLversion=TLSv1 accept = 127.0.0.1:25 connect = smtp.smarshmail.com:587 +++++++++++++++++++++++++ Pop works great. The log on an smtp session is as follows: +++++++++++++++++++++++++ 2012.09.10 12:48:31 LOG7[1984:300]: Service [SMARSH-smtp] accepted (FD=508) from 127.0.0.1:49517 2012.09.10 12:48:31 LOG7[1984:300]: Creating a new thread 2012.09.10 12:48:31 LOG7[1984:300]: New thread created 2012.09.10 12:48:31 LOG7[1984:2796]: Service [SMARSH-smtp] started 2012.09.10 12:48:31 LOG5[1984:2796]: Service [SMARSH-smtp] accepted connection from 127.0.0.1:49517 2012.09.10 12:48:31 LOG6[1984:2796]: connect_blocking: connecting 199.47.168.58:587 2012.09.10 12:48:31 LOG7[1984:2796]: connect_blocking: s_poll_wait 199.47.168.58:587: waiting 10 seconds 2012.09.10 12:48:31 LOG5[1984:2796]: connect_blocking: connected 199.47.168.58:587 2012.09.10 12:48:31 LOG5[1984:2796]: Service [SMARSH-smtp] connected remote server from 192.168.108.158:49518 2012.09.10 12:48:31 LOG7[1984:2796]: Remote socket (FD=528) initialized 2012.09.10 12:48:31 LOG7[1984:2796]: SNI: host name: smtp.smarshmail.com 2012.09.10 12:48:31 LOG7[1984:2796]: SSL state (connect): before/connect initialization 2012.09.10 12:48:31 LOG7[1984:2796]: SSL state (connect): SSLv3 write client hello A 2012.09.10 12:48:31 LOG7[1984:2796]: SSL alert (write): fatal: protocol version 2012.09.10 12:48:31 LOG3[1984:2796]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2012.09.10 12:48:31 LOG5[1984:2796]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2012.09.10 12:48:31 LOG7[1984:2796]: Remote socket (FD=528) closed 2012.09.10 12:48:31 LOG7[1984:2796]: Local socket (FD=508) closed 2012.09.10 12:48:31 LOG7[1984:2796]: Service [SMARSH-smtp] finished (0 left) 2012.09.10 12:48:40 LOG7[1984:300]: Dispatching signals from the signal pipe 2012.09.10 12:48:43 LOG7[1984:300]: Processing SIGNAL_TERMINATE 2012.09.10 12:48:43 LOG5[1984:300]: Terminated ++++++++++++++++++++++++++ Is sTunnel using SSLv3 rather than TLSv1? If so how do I force TLS? Thanks... _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Trouble with smtp client connection and TLS in Windows
by David Schomaker 13 Sep '12

13 Sep '12

I need to configure stunnel to connect to smtp via TLS and am not able to get it to work either running 4.53 or 4.54beta. Perhaps I have the conf file created incorrectly. The stunnel.conf is as follows: +++++++++++++++++++++++++++++++++++++++ ; Debugging stuff (may useful for troubleshooting) debug = 7 output = c:\temp\stunnel.log ; Disable FIPS mode to allow non-approved protocols and algorithms ;fips = no ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 [SMARSH-pop3] client = yes accept = 127.0.0.1:110 connect = pop.smarshmail.com:995 [SMARSH-smtp] client = yes SSLversion=TLSv1 accept = 127.0.0.1:25 connect = smtp.smarshmail.com:587 +++++++++++++++++++++++++ Pop works great. The log on an smtp session is as follows: +++++++++++++++++++++++++ 2012.09.10 12:48:31 LOG7[1984:300]: Service [SMARSH-smtp] accepted (FD=508) from 127.0.0.1:49517 2012.09.10 12:48:31 LOG7[1984:300]: Creating a new thread 2012.09.10 12:48:31 LOG7[1984:300]: New thread created 2012.09.10 12:48:31 LOG7[1984:2796]: Service [SMARSH-smtp] started 2012.09.10 12:48:31 LOG5[1984:2796]: Service [SMARSH-smtp] accepted connection from 127.0.0.1:49517 2012.09.10 12:48:31 LOG6[1984:2796]: connect_blocking: connecting 199.47.168.58:587 2012.09.10 12:48:31 LOG7[1984:2796]: connect_blocking: s_poll_wait 199.47.168.58:587: waiting 10 seconds 2012.09.10 12:48:31 LOG5[1984:2796]: connect_blocking: connected 199.47.168.58:587 2012.09.10 12:48:31 LOG5[1984:2796]: Service [SMARSH-smtp] connected remote server from 192.168.108.158:49518 2012.09.10 12:48:31 LOG7[1984:2796]: Remote socket (FD=528) initialized 2012.09.10 12:48:31 LOG7[1984:2796]: SNI: host name: smtp.smarshmail.com 2012.09.10 12:48:31 LOG7[1984:2796]: SSL state (connect): before/connect initialization 2012.09.10 12:48:31 LOG7[1984:2796]: SSL state (connect): SSLv3 write client hello A 2012.09.10 12:48:31 LOG7[1984:2796]: SSL alert (write): fatal: protocol version 2012.09.10 12:48:31 LOG3[1984:2796]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2012.09.10 12:48:31 LOG5[1984:2796]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2012.09.10 12:48:31 LOG7[1984:2796]: Remote socket (FD=528) closed 2012.09.10 12:48:31 LOG7[1984:2796]: Local socket (FD=508) closed 2012.09.10 12:48:31 LOG7[1984:2796]: Service [SMARSH-smtp] finished (0 left) 2012.09.10 12:48:40 LOG7[1984:300]: Dispatching signals from the signal pipe 2012.09.10 12:48:43 LOG7[1984:300]: Processing SIGNAL_TERMINATE 2012.09.10 12:48:43 LOG5[1984:300]: Terminated ++++++++++++++++++++++++++ Is sTunnel using SSLv3 rather than TLSv1? If so how do I force TLS? Thanks...

2 1

Stunnel message
by Philip Wong 13 Sep '12

13 Sep '12

Hi all, I'm still learning stunnel for my company support. l feel difficult to understand what's the meaning of some stunnel log message. Is there any doc listed the log messages with some explanation? Thanks, Philip

1 0

stunnel conf alternatives
by John A. Wallace 11 Sep '12

11 Sep '12

I have stunnel 4.53 on x86-pc-mingw32-gnu platform on Win7 OS. I use it minimally at this point but I would like to see whether I can expand my use of it if possible. When I installed it, I simply saved all the program's files into one folder without actually using the Windows installer program, and then I made some entries in the "stunnel.conf" to make it serve my purpose. Right now to start the program I can go to a Windows command prompt in the stunnel folder and type "stunnel stunnel.conf". Then a little icon appears in the notification area of Windows Taskbar. What would happen, I mean how would it differ, if I just typed "stunnel" instead of having to specify the "stunnel.conf" file too? And how would I be able to make use of it in that case? Thanks.

2 1

Binding to non-local sockets
by Janusz Dziemidowicz 09 Sep '12

09 Sep '12

Hi, attached is very simple patch that allows to set IP_FREEBIND under Linux (IP_BINDANY/IPV6_BINDANY under FreeBSD) on an accept socket. I've stumbled upon this need due to the following situation (which I believe might be quite common): - I've already had stunnel instance happily serving one website on port 443, single domain - a need occurred to set up another domain - SNI cannot be used, because Windows XP doesn't support it (and it is still a very large user base) - no problem, I thought, I have a few public IPs available, just set stunnel up on another IP - and here comes the problem, I have two frontend servers with VRRP configured to migrate public IP between them, only one server has the public IP at a time - under normal circumstances it is impossible to bind to an address that does not exist on the server (in case of one domain I've simply bound stunnel to 0.0.0.0) - starting stunnel manually when the address migrates is not an option (VRRP daemon probably can start it, but I was not happy with that solution, I want all services working constantly on both servers so there are no surprises in case of a failover) - setting IP_FREEBIND on accept socket solves the problem, stunnel is working on both machines and I can migrate the public IPs however I want As stunnel already exposes low level socket options, adding support for IP_FREEBIND is very simple. I've also added similar FreeBSD options (tested on FreeBSD 9.0). Oh, and the patch is public domain;) -- Janusz Dziemidowicz

1 0

SSL3_GET_RECORD:wrong version number
by Bob Tentinger 06 Sep '12

06 Sep '12

I have a POS application (SWIFTLINK) that uses Stunnel to send email on Windows XP. This is the error**************** SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number ***************** I have searched the Internet and none of the resolutions help.

2 1

Race condition in libwrap_auth can hang threads waiting on libwrap process
by Andrew Skalski 05 Sep '12

05 Sep '12

I ran into an issue with stunnel (verified with the latest version) where under certain conditions, client connections will hang in the "Waiting for a libwrap process" state. The problem is a race condition in src/libwrap.c: 170 --num_busy; /* the child process has been released */ 171 if(num_busy==num_processes-1) { /* need to wake up a thread */ 172 retval=pthread_cond_signal(&cond); /* signal waiting threads */ 173 if(retval) { 174 errno=retval; 175 ioerror("pthread_cond_signal"); 176 longjmp(c->err, 1); 177 } 178 } Removing the statement "if (num_busy==num_processes-1)" is one way to fix the problem. The conditions under which the race condition occur are: - All libwrap processes are busy, and multiple threads are waiting [num_busy == num_processes] - One thread releases its libwrap process (this signals one of the waiting threads) - Another thread releases its libwrap process before the signaled thread has a chance to acquire and increment num_busy. Once that happens, all queued threads are stuck waiting on the condition variable, until stunnel is hit with enough concurrent connections to max out num_busy again. (Depending on traffic patterns, this may not happen for a long time.) Andy Skalski

2 1

transpartent=destination setting fails with runtime error
by Stefan Lauterbach 03 Sep '12

03 Sep '12

*In the latest versions of stunnel including stunnel-4.54b8, activating the option for transparent destination with transparent=destination fails. The following error is found in the log with this configuration (tested on CentOS 6.2 and 6.3): INTERNAL ERROR: No target for remote socket This bug seems to be introduced with version 4.51 by rewriting the code and introducing additional sanity checks for the configuration. The following patch seems to resolve the problem: --- src/client.c.~1~ 2012-03-05 12:11:06.000000000 +0100 +++ src/client.c 2012-08-27 00:29:36.000000000 +0200 @@ -303,7 +303,7 @@ c->bind_addr=NULL; /* don't bind */ /* setup c->remote_fd, now */ - if(c->opt->option.remote) { /* try remote first for exec+connect targets */ + if(c->opt->option.remote || c->opt->option.transparent_dst) { /* try remote first for exec+connect targets */ c->remote_fd.fd=connect_remote(c); } else if(c->opt->option.program) { /* exec+connect uses local fd */ c->remote_fd.fd=connect_local(c); *

1 0

MySQL replication + SSL/stunnel
by Gareth Evans 27 Aug '12

27 Aug '12

Hello, I'm failing miserably to implement replication over any kind of SSL (that is, MySQL's native (alleged) SSL support) or stunnel. I'd be grateful for any tips or advice. I have tried using OpenSSL and MySQL in various flavours: CentOS 6.2, OpenSSL v1.0.0, MySQL v5.1.63 Ubuntu 12.04, OpenSSL v1.0.1, MySQL v 5.5.24 and stunnel4 on both - certs created with OpenSSL in each case. I get an eror 1045 access denied from the MySQL native SSL approach, and mysql -u ejbkslave -pejbkslavepw -h127.0.0.1 -P3307 ERROR 2013 (HY000): Lost connection to MySQL server at 'reading initial communication packet', system error: 104 from stunnel (connecting two Ubuntu 12.04 VM's on my PC, with the latest updates) - if you know what causes this error and/or could point me towards some good documentation, I'd be grateful. I've copied and amended stunnel.conf-sample and just added debug and accept/connect info in each case. I've seen various reports around the web that OpenSSL+MySQL don't work together at the moment, but it seems some people can repicate the problem while others can't - I've tried the previous version of OpenSSL (1.0.0e on Ubuntu) still without success. Most frustrating!! Thanks Gareth

2 1

Stunnel performance about multiple session
by Yuqiong Sun 27 Aug '12

27 Aug '12

Hi, I am using stunnel as an encrypted channel between one server and multiple clients. Each client will transfer a very small piece of data every 20 seconds. Therefore I want to compare the tradeoff between maintaining multiple sessions with tearing down and re-establish connection every time. I read the performance table in stunnel doc and got a brief idea, but I hope to evaluate the performance for my specific hardware and software setup to make a better decision. I guess my question is how to measure the Max. concurrent sessions? Should I start multiple stunnel instances on client side? Also, how can I tear down a connection automatically after each time data transfer? Thanks Yuqiong

2 1

Behavior
by Javier 17 Aug '12

17 Aug '12

Hi, I want to report 2 different behaviors, one, related to logs and, the other, to close delay. - About the logs, there is a funny thing. If you reload stunnel.conf the log style and amount of information differs from the starting one. I'm under Windows 2000 and these are the general options in stunnel.conf: debug = debug delay = yes output = stunnel.log fips = no The differences can be seen in the attached text file. First part is how is being seen if you don't reload the conf file. The second, after you reload. I, by myself, prefer the second log style. - About the close delay, I don't know when it started to happen (maybe in the version you removed the multiple instance of stunnel or maybe later), but what happens is that stunnel delays about 1-2 seconds to close. It didn't happen before. It was immediately. And has nothing to do with how many services you have, it delays with one service or ten services or… whatever. My system specs, the same as above. But it happens in Windows XP as well, and with the latest 4.54 beta too (the one that has removed the annoying app error (thank you so much for this :-) )). Have a look to them ;-) and confirm if possible :-) Thanks.

1 0

Stunnel high memory usage?
by Matt Wise 16 Aug '12

16 Aug '12

We use Stunnel 4.5.2 in our environment of Ubuntu 10.04/12.04 systems in various clouds. We're leveraging PGPool for SSL encryption of a lot of different types of traffic ... Zookeeper, Postgresql, and AMQP traffic are some examples for us. Mostly everything works great .. its fast, and very reliable. I've just noticed though that on a particular group of machines we are seeing really high memory usage on the Stunnel process that seems to grow and grow over time. I found this Stunnel process using over 350MB of ram yesterday ... and on an m1.small in Amazon, thats a big chunk! Here's our client config file: > cert = /etc/stunnel/localhost-pgpool.pem > key = /etc/stunnel/localhost-pgpool.key > CAfile = /etc/stunnel/localhost-pgpool_ca.pem > verify = 2 > delay = no > sslVersion = TLSv1 > client = yes > setuid = stunnel4 > setgid = stunnel4 > pid = /var/lib/stunnel4/localhost-pgpool.stunnel4.pid > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > TIMEOUTconnect = 2 > session = 86400 > debug = 4 > [localhost-pgpool] > accept = 127.0.0.1:5001 > failover = rr > connect = prod-pgpool1-uswest1:6433 > connect = prod-pgpool2-uswest1:6433 My first thought was that perhaps the Session cache was too large... so I dropped it to '3600'. Now instead of 360MB, I'm seeing Stunnel sit at around 170MB. Is the session ID cache just caching thousands and thousands of new session IDs without properly re-using them? It seems like the session ID cache should never have more than: Currently_Used_Session_IDs + Session_IDs_unused_but_last_used_within_the_last_hour Any thoughts on what might be going on? --Matt

1 0

Application Failed to Initialize Properly (0xc0150002)
by Thomas Eifert 09 Aug '12

09 Aug '12

New problem here. Stunnel version 4.53. I just did a fresh install of Windows XP Pro x86 SP3, and did all the Windows updates as well. Whenever I try to launch Stunnel or install the service, I get the error: "Application Failed to Initialize Properly (0xc0150002)" I've never seen this before. I thought it might have something to do with not having the Visual C++ Redistributables, so I installed those too, with the same result. Has anyone else seen this issue? Regards, Thomas -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

3 4

Stunnel waits for a long time if client does not negotiate SSL
by Denis Solovyov 09 Aug '12

09 Aug '12

Hello, I use stunnel 4.53 to provide pop3s for existing pop3 service. I start stunnel from xinetd, and then exec pop3 utility from stunnel. If a legal pop3s client connects to a server, everything's fine. But if I try to do "telnet host 995" with a simple telnet client and then just do nothing (or even close telnet client without quitting) stunnel process keeps waiting for a very long time (actually maybe forever, I just kill it). The last line in log in such case "Service [stunnel] accepted connection from xx.xx.xx.xx:xxxx". No stunnel TIMEOUT* options have effect in this situation. What can I do to avoid such "waiting"? Maybe stunnel should have something like "SSL negotiation timeout"? Or is there a way to emulate it? (Analyzing `ps` or `netstat` is a bad idea of course.) With the best regards, Denis Solovyov

2 3

Re: [stunnel-users] Application Failed to Initialize Properly (0xc0150002)
by Generic Poster 08 Aug '12

08 Aug '12

Hi Thomas, I have the exact same error when trying to run stunnel on a virtual XP machine under windows 7. I asked here and the only reply I got was that it sounded like a configuration problem. I have tried everything I can think of, but to no avail. I just gave up trying in the end. Wednesday, August 8, 2012, 2:20:43 AM, you wrote: > New problem here. Stunnel version 4.53. > I just did a fresh install of Windows XP Pro x86 SP3, and did all the > Windows updates as well. > Whenever I try to launch Stunnel or install the service, I get the error: > "Application Failed to Initialize Properly (0xc0150002)" > I've never seen this before. I thought it might have something to do > with not having the Visual C++ Redistributables, so I installed those too, > with the same result. > Has anyone else seen this issue? > Regards, > Thomas -- Best regards, GP

2 1

Getting Stunnel to Work Under Windows 7 64-bit
by Hacker, Dietmar 06 Aug '12

06 Aug '12

Some thoughts about a thread from may: Stunnel works ok under Windows7 64bit. But: There are some windows7-specific security restraints one should be aware of: Windows7 does not allow programs to have write-access to c:\program files and c:\program files (x86) (win7 64bit). You can find the logfile in hidden directory c:\users\Youruser\appdata\local\virtualstore\program files\stunnel\stunnel.log ( Youruser is the windows user which started stunnel ) If you want a common logfile for all users, either you install stunnel in another writeable directory (security risk ?) or if installing in program files change your stunnel.conf file to have the log file in a writeable directory e.g. c:\temp or the standard common data directory c:\programData (also a hidden directory ) I use stunnel as a service and defined "output = c:\programData\stunnel\stunnel.log" stunnel writes there and only users with admin access could change the logfile. Dietmar Hacker

1 0

Build stunnel 4.53 binaries for windows error
by Anton Tkachev 01 Aug '12

01 Aug '12

Hey Guys, I'm trying to build stunnel 4.53 binaries for windows on Debian Squeeze x86 using instructions in INSTALL.W32 file. I use the latest openssl-1.0.1c (libssl-dev debian package installed also). At the last step 'make stunnel.exe' returns following error: # make stunnel.exe i586-mingw32msvc-gcc -c -I/usr/src/openssl-0.9.8s-fips/inc32 -mthreads -fstack-protector -O2 -Wall -Wextra -Wno-long-long -pedantic -o str.obj str.c In file included from str.c:38: common.h:392:33: error: openssl/opensslconf.h: No such file or directory common.h:405:27: error: openssl/lhash.h: No such file or directory common.h:406:25: error: openssl/ssl.h: No such file or directory common.h:407:25: error: openssl/err.h: No such file or directory common.h:408:66: error: openssl/crypto.h: No such file or directory common.h:409:26: error: openssl/rand.h: No such file or directory common.h:411:25: error: openssl/md4.h: No such file or directory common.h:413:25: error: openssl/des.h: No such file or directory common.h:417:28: error: openssl/engine.h: No such file or directory In file included from str.c:38: common.h:449: warning: return type defaults to ‘int’ common.h: In function ‘STACK_OF’: common.h:449: error: expected declaration specifiers before ‘*’ token In file included from str.c:39: prototypes.h:50: error: storage class specified for parameter ‘LOG_MODE’ prototypes.h:61: error: storage class specified for parameter ‘SOCKADDR_UNION’ prototypes.h:64: error: expected specifier-qualifier-list before ‘SOCKADDR_UNION’ prototypes.h:67: warning: struct has no members prototypes.h:67: error: storage class specified for parameter ‘SOCKADDR_LIST’ prototypes.h:72: error: storage class specified for parameter ‘COMP_TYPE’ prototypes.h:78: error: expected specifier-qualifier-list before ‘COMP_TYPE’ prototypes.h:114: warning: struct has no members prototypes.h:114: error: storage class specified for parameter ‘GLOBAL_OPTIONS’ prototypes.h:116: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘global_options’ prototypes.h:124: error: expected specifier-qualifier-list before ‘SSL_CTX’ prototypes.h:222: error: storage class specified for parameter ‘SERVICE_OPTIONS’ prototypes.h:224: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘service_options’ prototypes.h:236: error: storage class specified for parameter ‘VAL_TYPE’ prototypes.h:244: error: storage class specified for parameter ‘OPT_UNION’ prototypes.h:250: error: expected specifier-qualifier-list before ‘VAL_TYPE’ prototypes.h:252: error: storage class specified for parameter ‘SOCK_OPT’ prototypes.h:256: error: storage class specified for parameter ‘CONF_TYPE’ prototypes.h:269: error: storage class specified for parameter ‘s_poll_set’ prototypes.h:278: error: storage class specified for parameter ‘DISK_FILE’ prototypes.h:285: error: storage class specified for parameter ‘FD’ prototypes.h:290: error: storage class specified for parameter ‘max_clients’ prototypes.h:291: error: storage class specified for parameter ‘num_clients’ prototypes.h:327: warning: parameter names (without types) in function declaration prototypes.h:347: error: storage class specified for parameter ‘cli_index’ prototypes.h:347: error: storage class specified for parameter ‘opt_index’ prototypes.h:350: error: expected ‘)’ before ‘*’ token prototypes.h:355: error: expected declaration specifiers or ‘...’ before ‘CONF_TYPE’ prototypes.h:361: error: expected specifier-qualifier-list before ‘SERVICE_OPTIONS’ prototypes.h:363: warning: struct has no members prototypes.h:363: error: storage class specified for parameter ‘UI_DATA’ prototypes.h:365: error: expected ‘)’ before ‘*’ token prototypes.h:370: error: expected ‘)’ before ‘*’ token prototypes.h:374: error: expected declaration specifiers before ‘s_poll_set’ prototypes.h:375: error: expected ‘)’ before ‘*’ token prototypes.h:376: error: expected ‘)’ before ‘*’ token prototypes.h:377: error: expected ‘)’ before ‘*’ token prototypes.h:378: error: expected ‘)’ before ‘*’ token prototypes.h:379: error: expected ‘)’ before ‘*’ token prototypes.h:380: error: expected ‘)’ before ‘*’ token prototypes.h:381: error: expected ‘)’ before ‘*’ token prototypes.h:401: error: expected specifier-qualifier-list before ‘SSL’ prototypes.h:422: error: storage class specified for parameter ‘CLI’ prototypes.h:424: error: expected declaration specifiers before ‘CLI’ prototypes.h:426: error: expected ‘)’ before ‘*’ token prototypes.h:430: error: expected ‘)’ before ‘*’ token prototypes.h:431: error: expected ‘)’ before ‘*’ token prototypes.h:432: error: expected ‘)’ before ‘*’ token prototypes.h:433: error: expected ‘)’ before ‘*’ token prototypes.h:434: error: expected ‘)’ before ‘*’ token prototypes.h:436: error: expected ‘)’ before ‘*’ token prototypes.h:450: error: storage class specified for parameter ‘PROTOCOL_TYPE’ prototypes.h:453: error: expected ‘)’ before ‘*’ token prototypes.h:457: error: expected ‘)’ before ‘*’ token prototypes.h:458: error: expected ‘)’ before ‘*’ token prototypes.h:459: error: expected ‘)’ before ‘*’ token prototypes.h:460: error: expected ‘)’ before ‘*’ token prototypes.h:461: error: expected ‘)’ before ‘*’ token prototypes.h:462: warning: type defaults to ‘int’ in declaration of ‘SOCKADDR_UNION’ prototypes.h:462: error: expected ‘;’, ‘,’ or ‘)’ before ‘*’ token prototypes.h:493: error: storage class specified for parameter ‘SECTION_CODE’ prototypes.h:495: warning: parameter names (without types) in function declaration prototypes.h:496: warning: parameter names (without types) in function declaration prototypes.h:500: error: expected declaration specifiers or ‘...’ before ‘CLI’ prototypes.h:526: error: storage class specified for parameter ‘hwnd’ prototypes.h:530: error: expected ‘)’ before ‘*’ token prototypes.h:535: error: storage class specified for parameter ‘GETADDRINFO’ prototypes.h:536: error: storage class specified for parameter ‘FREEADDRINFO’ prototypes.h:538: error: storage class specified for parameter ‘GETNAMEINFO’ prototypes.h:539: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘s_getaddrinfo’ prototypes.h:540: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘s_freeaddrinfo’ prototypes.h:541: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘s_getnameinfo’ prototypes.h:550: error: expected declaration specifiers before ‘DISK_FILE’ prototypes.h:551: error: expected ‘)’ before ‘*’ token prototypes.h:552: error: expected ‘)’ before ‘*’ token prototypes.h:553: error: expected ‘)’ before ‘*’ token prototypes.h:563: error: expected ‘)’ before ‘*’ token str.c:49: error: storage class specified for parameter ‘canary’ str.c:50: error: storage class specified for parameter ‘canary_initialized’ str.c:50: error: parameter ‘canary_initialized’ is initialized str.c:52: error: storage class specified for parameter ‘ALLOC_LIST’ str.c:55: error: expected specifier-qualifier-list before ‘ALLOC_LIST’ str.c:57: warning: struct has no members str.c:57: error: storage class specified for parameter ‘ALLOC_TLS’ str.c:60: error: expected specifier-qualifier-list before ‘ALLOC_LIST’ str.c:67: warning: struct has no members str.c:59: warning: empty declaration str.c:73: error: expected ‘)’ before ‘*’ token str.c:74: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘*’ token str.c:75: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘*’ token str.c:77: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:85: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:95: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:175: error: storage class specified for parameter ‘tls_index’ str.c:177: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:181: error: expected ‘)’ before ‘*’ token str.c:185: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘*’ token str.c:191: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:198: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:210: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:228: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:262: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:291: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:315: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:326: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘*’ token common.h:449: warning: type of ‘SSL_COMP’ defaults to ‘int’ str.c:175: error: declaration for parameter ‘tls_index’ but no such parameter str.c:57: error: declaration for parameter ‘ALLOC_TLS’ but no such parameter str.c:52: error: declaration for parameter ‘ALLOC_LIST’ but no such parameter str.c:50: error: declaration for parameter ‘canary_initialized’ but no such parameter str.c:49: error: declaration for parameter ‘canary’ but no such parameter prototypes.h:581: error: declaration for parameter ‘str_printf’ but no such parameter prototypes.h:580: error: declaration for parameter ‘str_vprintf’ but no such parameter prototypes.h:579: error: declaration for parameter ‘str_dup’ but no such parameter prototypes.h:577: error: declaration for parameter ‘str_free_debug’ but no such parameter prototypes.h:575: error: declaration for parameter ‘str_detach_debug’ but no such parameter prototypes.h:573: error: declaration for parameter ‘str_realloc_debug’ but no such parameter prototypes.h:571: error: declaration for parameter ‘str_alloc_debug’ but no such parameter prototypes.h:570: error: declaration for parameter ‘str_stats’ but no such parameter prototypes.h:569: error: declaration for parameter ‘str_cleanup’ but no such parameter prototypes.h:568: error: declaration for parameter ‘str_canary_init’ but no such parameter prototypes.h:567: error: declaration for parameter ‘str_init’ but no such parameter prototypes.h:562: error: declaration for parameter ‘libwrap_init’ but no such parameter prototypes.h:557: error: declaration for parameter ‘tstr2str’ but no such parameter prototypes.h:556: error: declaration for parameter ‘str2tstr’ but no such parameter prototypes.h:537: error: declaration for parameter ‘GETNAMEINFO’ but no such parameter prototypes.h:536: error: declaration for parameter ‘FREEADDRINFO’ but no such parameter prototypes.h:534: error: declaration for parameter ‘GETADDRINFO’ but no such parameter prototypes.h:528: error: declaration for parameter ‘passwd_cb’ but no such parameter prototypes.h:526: error: declaration for parameter ‘hwnd’ but no such parameter prototypes.h:500: error: declaration for parameter ‘create_client’ but no such parameter prototypes.h:499: error: declaration for parameter ‘stunnel_thread_id’ but no such parameter prototypes.h:498: error: declaration for parameter ‘stunnel_process_id’ but no such parameter prototypes.h:497: error: declaration for parameter ‘sthreads_init’ but no such parameter prototypes.h:496: error: declaration for parameter ‘leave_critical_section’ but no such parameter prototypes.h:495: error: declaration for parameter ‘enter_critical_section’ but no such parameter prototypes.h:493: error: declaration for parameter ‘SECTION_CODE’ but no such parameter prototypes.h:479: error: declaration for parameter ‘local_getnameinfo’ but no such parameter prototypes.h:463: error: declaration for parameter ‘s_gai_strerror’ but no such parameter prototypes.h:452: error: declaration for parameter ‘find_protocol_id’ but no such parameter prototypes.h:450: error: declaration for parameter ‘PROTOCOL_TYPE’ but no such parameter prototypes.h:425: error: declaration for parameter ‘client_thread’ but no such parameter prototypes.h:422: error: declaration for parameter ‘CLI’ but no such parameter prototypes.h:395: error: declaration for parameter ‘make_sockets’ but no such parameter prototypes.h:394: error: declaration for parameter ‘get_socket_error’ but no such parameter prototypes.h:393: error: declaration for parameter ‘set_socket_options’ but no such parameter prototypes.h:366: error: declaration for parameter ‘sslerror’ but no such parameter prototypes.h:363: error: declaration for parameter ‘UI_DATA’ but no such parameter prototypes.h:356: error: declaration for parameter ‘apply_conf’ but no such parameter prototypes.h:355: error: declaration for parameter ‘parse_conf’ but no such parameter prototypes.h:354: error: declaration for parameter ‘parse_commandline’ but no such parameter prototypes.h:349: error: declaration for parameter ‘ssl_init’ but no such parameter prototypes.h:347: error: declaration for parameter ‘opt_index’ but no such parameter prototypes.h:347: error: declaration for parameter ‘cli_index’ but no such parameter prototypes.h:343: error: declaration for parameter ‘pty_allocate’ but no such parameter prototypes.h:339: error: declaration for parameter ‘s_strerror’ but no such parameter prototypes.h:338: error: declaration for parameter ‘log_error’ but no such parameter prototypes.h:337: error: declaration for parameter ‘sockerror’ but no such parameter prototypes.h:336: error: declaration for parameter ‘ioerror’ but no such parameter prototypes.h:334: error: declaration for parameter ‘fatal_debug’ but no such parameter prototypes.h:328: error: declaration for parameter ‘s_log’ but no such parameter prototypes.h:327: error: declaration for parameter ‘log_flush’ but no such parameter prototypes.h:326: error: declaration for parameter ‘log_close’ but no such parameter prototypes.h:325: error: declaration for parameter ‘log_open’ but no such parameter prototypes.h:317: error: declaration for parameter ‘set_nonblock’ but no such parameter prototypes.h:316: error: declaration for parameter ‘s_accept’ but no such parameter prototypes.h:315: error: declaration for parameter ‘s_socketpair’ but no such parameter prototypes.h:314: error: declaration for parameter ‘s_pipe’ but no such parameter prototypes.h:313: error: declaration for parameter ‘s_socket’ but no such parameter prototypes.h:311: error: declaration for parameter ‘get_limits’ but no such parameter prototypes.h:306: error: declaration for parameter ‘stunnel_info’ but no such parameter prototypes.h:302: error: declaration for parameter ‘signal_post’ but no such parameter prototypes.h:298: error: declaration for parameter ‘bind_ports’ but no such parameter prototypes.h:297: error: declaration for parameter ‘unbind_ports’ but no such parameter prototypes.h:296: error: declaration for parameter ‘daemon_loop’ but no such parameter prototypes.h:295: error: declaration for parameter ‘main_configure’ but no such parameter prototypes.h:294: error: declaration for parameter ‘main_initialize’ but no such parameter prototypes.h:291: error: declaration for parameter ‘num_clients’ but no such parameter prototypes.h:290: error: declaration for parameter ‘max_clients’ but no such parameter prototypes.h:285: error: declaration for parameter ‘FD’ but no such parameter prototypes.h:278: error: declaration for parameter ‘DISK_FILE’ but no such parameter prototypes.h:269: error: declaration for parameter ‘s_poll_set’ but no such parameter prototypes.h:256: error: declaration for parameter ‘CONF_TYPE’ but no such parameter prototypes.h:252: error: declaration for parameter ‘SOCK_OPT’ but no such parameter prototypes.h:244: error: declaration for parameter ‘OPT_UNION’ but no such parameter prototypes.h:236: error: declaration for parameter ‘VAL_TYPE’ but no such parameter prototypes.h:222: error: declaration for parameter ‘SERVICE_OPTIONS’ but no such parameter prototypes.h:114: error: declaration for parameter ‘GLOBAL_OPTIONS’ but no such parameter prototypes.h:72: error: declaration for parameter ‘COMP_TYPE’ but no such parameter prototypes.h:67: error: declaration for parameter ‘SOCKADDR_LIST’ but no such parameter prototypes.h:61: error: declaration for parameter ‘SOCKADDR_UNION’ but no such parameter prototypes.h:50: error: declaration for parameter ‘LOG_MODE’ but no such parameter str.c:342: error: expected ‘{’ at end of input common.h:449: warning: unused parameter ‘SSL_COMP’ str.c:175: warning: unused parameter ‘tls_index’ str.c:57: warning: unused parameter ‘ALLOC_TLS’ str.c:52: warning: unused parameter ‘ALLOC_LIST’ str.c:50: warning: unused parameter ‘canary_initialized’ str.c:49: warning: unused parameter ‘canary’ prototypes.h:581: warning: unused parameter ‘str_printf’ prototypes.h:580: warning: unused parameter ‘str_vprintf’ prototypes.h:579: warning: unused parameter ‘str_dup’ prototypes.h:577: warning: unused parameter ‘str_free_debug’ prototypes.h:575: warning: unused parameter ‘str_detach_debug’ prototypes.h:573: warning: unused parameter ‘str_realloc_debug’ prototypes.h:571: warning: unused parameter ‘str_alloc_debug’ prototypes.h:570: warning: unused parameter ‘str_stats’ prototypes.h:569: warning: unused parameter ‘str_cleanup’ prototypes.h:568: warning: unused parameter ‘str_canary_init’ prototypes.h:567: warning: unused parameter ‘str_init’ prototypes.h:562: warning: unused parameter ‘libwrap_init’ prototypes.h:557: warning: unused parameter ‘tstr2str’ prototypes.h:556: warning: unused parameter ‘str2tstr’ prototypes.h:537: warning: unused parameter ‘GETNAMEINFO’ prototypes.h:536: warning: unused parameter ‘FREEADDRINFO’ prototypes.h:534: warning: unused parameter ‘GETADDRINFO’ prototypes.h:528: warning: unused parameter ‘passwd_cb’ prototypes.h:526: warning: unused parameter ‘hwnd’ prototypes.h:500: warning: unused parameter ‘create_client’ prototypes.h:499: warning: unused parameter ‘stunnel_thread_id’ prototypes.h:498: warning: unused parameter ‘stunnel_process_id’ prototypes.h:497: warning: unused parameter ‘sthreads_init’ prototypes.h:496: warning: unused parameter ‘leave_critical_section’ prototypes.h:495: warning: unused parameter ‘enter_critical_section’ prototypes.h:493: warning: unused parameter ‘SECTION_CODE’ prototypes.h:479: warning: unused parameter ‘local_getnameinfo’ prototypes.h:463: warning: unused parameter ‘s_gai_strerror’ prototypes.h:452: warning: unused parameter ‘find_protocol_id’ prototypes.h:450: warning: unused parameter ‘PROTOCOL_TYPE’ prototypes.h:425: warning: unused parameter ‘client_thread’ prototypes.h:422: warning: unused parameter ‘CLI’ prototypes.h:395: warning: unused parameter ‘make_sockets’ prototypes.h:394: warning: unused parameter ‘get_socket_error’ prototypes.h:393: warning: unused parameter ‘set_socket_options’ prototypes.h:366: warning: unused parameter ‘sslerror’ prototypes.h:363: warning: unused parameter ‘UI_DATA’ prototypes.h:356: warning: unused parameter ‘apply_conf’ prototypes.h:355: warning: unused parameter ‘parse_conf’ prototypes.h:354: warning: unused parameter ‘parse_commandline’ prototypes.h:349: warning: unused parameter ‘ssl_init’ prototypes.h:347: warning: unused parameter ‘opt_index’ prototypes.h:347: warning: unused parameter ‘cli_index’ prototypes.h:343: warning: unused parameter ‘pty_allocate’ prototypes.h:339: warning: unused parameter ‘s_strerror’ prototypes.h:338: warning: unused parameter ‘log_error’ prototypes.h:337: warning: unused parameter ‘sockerror’ prototypes.h:336: warning: unused parameter ‘ioerror’ prototypes.h:334: warning: unused parameter ‘fatal_debug’ prototypes.h:328: warning: unused parameter ‘s_log’ prototypes.h:327: warning: unused parameter ‘log_flush’ prototypes.h:326: warning: unused parameter ‘log_close’ prototypes.h:325: warning: unused parameter ‘log_open’ prototypes.h:317: warning: unused parameter ‘set_nonblock’ prototypes.h:316: warning: unused parameter ‘s_accept’ prototypes.h:315: warning: unused parameter ‘s_socketpair’ prototypes.h:314: warning: unused parameter ‘s_pipe’ prototypes.h:313: warning: unused parameter ‘s_socket’ prototypes.h:311: warning: unused parameter ‘get_limits’ prototypes.h:306: warning: unused parameter ‘stunnel_info’ prototypes.h:302: warning: unused parameter ‘signal_post’ prototypes.h:298: warning: unused parameter ‘bind_ports’ prototypes.h:297: warning: unused parameter ‘unbind_ports’ prototypes.h:296: warning: unused parameter ‘daemon_loop’ prototypes.h:295: warning: unused parameter ‘main_configure’ prototypes.h:294: warning: unused parameter ‘main_initialize’ prototypes.h:291: warning: unused parameter ‘num_clients’ prototypes.h:290: warning: unused parameter ‘max_clients’ prototypes.h:285: warning: unused parameter ‘FD’ prototypes.h:278: warning: unused parameter ‘DISK_FILE’ prototypes.h:269: warning: unused parameter ‘s_poll_set’ prototypes.h:256: warning: unused parameter ‘CONF_TYPE’ prototypes.h:252: warning: unused parameter ‘SOCK_OPT’ prototypes.h:244: warning: unused parameter ‘OPT_UNION’ prototypes.h:236: warning: unused parameter ‘VAL_TYPE’ prototypes.h:222: warning: unused parameter ‘SERVICE_OPTIONS’ prototypes.h:114: warning: unused parameter ‘GLOBAL_OPTIONS’ prototypes.h:72: warning: unused parameter ‘COMP_TYPE’ prototypes.h:67: warning: unused parameter ‘SOCKADDR_LIST’ prototypes.h:61: warning: unused parameter ‘SOCKADDR_UNION’ prototypes.h:50: warning: unused parameter ‘LOG_MODE’ make: *** [str.obj] Error 1 It seems it has hardcoded path to openssl (/usr/src/openssl-0.9.8s-fips). I tried to change this path to the right one in Makefile*, but with no luck - I get the same error. I also tried to build stunnel with openssl-0.9.8s, but openssl configure command from the instruction doesn't work: root@debian:/usr/src/openssl-0.9.8s-i586# ./Configure --cross-compile-prefix=i586-mingw32msvc- mingw shared zlib-dynamic Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [experimental-<cipher> ...] [-Dxxx] [-lxxx] [-Lxxx] [-fxxx] [-Kxxx] [no-hw-xxx|no-hw] [[no-]threads] [[no-]shared] [[no-]zlib|zlib-dynamic] [enable-montasm] [no-asm] [no-dso] [no-krb5] [386] [--prefix=DIR] [--openssldir=OPENSSLDIR] [--with-xxx[=vvv]] [--test-sanity] os/compiler[:flags] Regards, Anton.

3 11

"application failed to initialize properly"
by Generic Poster 31 Jul '12

31 Jul '12

Hello Stunnel-users, Whenever I run Stunnel from a Windows 7 Virtual XP machine I receive the following error message: --------------------------- stunnel.exe - Application Error --------------------------- The application failed to initialize properly (0xc0150002). Click on OK to terminate the application. --------------------------- Any ideas as to what causes it or how I can get around the problem? The result is the same regardless of version. -- Best regards, Generic

2 1

Newbie: Success, now failure???
by Roger Bohl (Sr.) 25 Jul '12

25 Jul '12

For several days, I've been using Stunnel (with Blat) successfully (possibly with no intervening re-boots). A day or so ago, the system was re booted Today, however, Stunnel failed. I got the following Stunnel reply message: No limit detected for the number of clients stunnel 4.53 on x86-pc-mingw32-gnu platform Compiled/running with OpenSSL 0.9.8s-fips 4 Jan 2012 Threading:WIN32 SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:SELECT+IPv6 Reading configuration from file stunnel.conf FIPS mode is enabled Compression not enabled Snagged 64 random bytes from .rnd Wrote 1024 new random bytes to .rnd PRNG seeded successfully Initializing inetd mode configuration Certificate: client.pem Certificate loaded Key file: client.pem Private key loaded SSL options set: 0x00000004 Accept option is not allowed in inetd mode Remove accept option or define a [section] Server is down The stunnel.conf file in the Stunnel directory is: CAfile = cert.pem cert = client.pem client = yes RNDfile = .rnd [gmail smtp] ; (I may have had this in or out before. In "cleaning up" various files, I may have thought this to be a comment, and removed it.) accept = 25 connect = smtp.gmail.com:465 The program fails both with and without the [gmail smtp] line included. Except, possibly, for removing ;[comment] lines, no other changes occurred. Can somebody give me a clue as to the cause, and suggest the fix. I'm running Windows Vista. (I found the 17+ page instruction file, by Michal Trojnara, but didn't see a solution, there.) Thanks. Roger Bohl rhbohl(a)gmail.com 707-939-8459 PDT

1 0

please unsubscribe my email - thx
by Rüdiger Konte 24 Jul '12

24 Jul '12

1 0

stunnel and http
by John 23 Jul '12

23 Jul '12

I am running the latest stunnel for Windows on 64-bit Win7 as an application, not as a service. I simply unzipped everything to one folder, configured the "stunnel.conf" file; and when I need to run the program, I can open a command prompt in its folder and type "stunnel stunnel.conf". It then reads my stunnel.conf file and works its magic. This works fine for capturing the data from those programs which I can configure to use localhost and a specific port because I can configure stunnel.conf with accept = ip.address:port Now I have a program that I want to use to download some text files from the internet using http or https. However, this program cannot be manually configured to make a connection with a certain IP and port. Instead, I have to give it an alias-like name, which it then maps to one of several different domain names, makes a DNS query for the IP and transmits to that address the instructions for downloading some text files. So, is it possible to have stunnel "capture" any and all http transports (port 80) or https transports (port 443) from a specific program, regardless of which IP that connection was destined for, so that I can then direct this data traffic from stunnel to socat or from stunnel to an http proxy which I can manually direct to a specific connection? Is this a kind of thing for which stunnel can be used? If so, where can I find the instructions for setting it up? Thanks.

2 2

Reboot Requires Manual: "service stunnel restart"
by John Vasko 21 Jul '12

21 Jul '12

On FreeBSD 9.0 stunnel 4.43 works fine after running "service stunnel restart", but stunnel fails loading on boot. My desired config includes: /usr/local/etc/stunnel/stunnel.conf -------------------------------------------- [attsmtp] client = yes verify = 0 accept = 2525 connect = smtp.att.yahoo.com:465 delay = yes Please advise. See below for messages after bootup: /var/run/stunnel/stunnel.log ------------------------------------ 2012.07.21 02:52:06 LOG7[1378:675300096]: No limit detected for the number of clients 2012.07.21 02:52:06 LOG7[1378:675300096]: signal_pipe: FD=3 allocated (non-blocking mode) 2012.07.21 02:52:06 LOG7[1378:675300096]: signal_pipe: FD=4 allocated (non-blocking mode) 2012.07.21 02:52:06 LOG5[1378:675300096]: stunnel 4.43 on i386-portbld-freebsd9.0 platform 2012.07.21 02:52:06 LOG5[1378:675300096]: Compiled/running with OpenSSL 1.0.0e 6 Sep 2011 2012.07.21 02:52:06 LOG5[1378:675300096]: Threading:PTHREAD SSL:ENGINE Auth:LIBWRAP Sockets:POLL,IPv6 2012.07.21 02:52:06 LOG5[1378:675300096]: Reading configuration from file /usr/local/etc/stunnel/stunnel.conf 2012.07.21 02:52:06 LOG7[1378:675300096]: Snagged 64 random bytes from //.rnd 2012.07.21 02:52:06 LOG7[1378:675300096]: Wrote 1024 new random bytes to //.rnd 2012.07.21 02:52:06 LOG7[1378:675300096]: PRNG seeded successfully 2012.07.21 02:52:08 LOG6[1378:675300096]: Initializing SSL context for service attsmtp 2012.07.21 02:52:08 LOG7[1378:675300096]: SSL options set: 0x00000004 2012.07.21 02:52:08 LOG6[1378:675300096]: SSL context initialized 2012.07.21 02:52:08 LOG5[1378:675300096]: Configuration successful 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=5 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=6 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=6 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=7 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=7 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=8 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=8 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=9 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=9 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=10 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: accept socket: FD=11 allocated (non-blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: Option SO_REUSEADDR set on accept socket 2012.07.21 02:52:08 LOG7[1378:675300096]: Service attsmtp bound to 0.0.0.0:2525 2012.07.21 02:52:08 LOG7[1378:675300096]: Service attsmtp opened FD=11 2012.07.21 02:52:08 LOG7[1378:675300096]: Created pid file /stunnel.pid 2012.07.21 02:52:15 LOG7[1378:675300096]: Dispatching signals from the signal pipe 2012.07.21 02:52:15 LOG3[1378:675300096]: Received signal 2; terminating 2012.07.21 02:52:15 LOG7[1378:675300096]: str_stats: 43 block(s), 3554 byte(s) 2012.07.21 02:52:15 LOG7[1378:675300096]: removing pid file /stunnel.pid

1 1

Re: [stunnel-users] Reverse tunnel with middle server
by Javier 19 Jul '12

19 Jul '12

[To the mailing list: Sorry for these non-english messages, I started, previously, a private communication to avoid it] On Thu, 19 Jul 2012 20:26:45 +0200 "Jorge A." <curruscataphractus(a)gmail.com> wrote: > Hola Javier, > > Igual no me he explicado bien. Lo que quiero es conectar dos > máquinas, una dentro de una NAT detrás de un router que no tiene > redirigidos los puertos a la máquina claro, pero que sí tiene > Internet y acceso a la máquina servidor. Esto me sigue sin quedar claro. Ya perdonarás. Una (Objetivo) está conectada a un router, que sirve internet a una red local, pero que no tiene redirigidos los puertos a la máquina que tiene el servidor http. Esta no tiene acceso a internet porque no se le ha configurado una puerta de enlace y además no la pueden alcanzar porque no hay puertos redirigidos hacia ella. Hasta ahí, todo bien ;) Lo que quería saber es si la máquina que hace de Servidor hacia internet está en la misma subred local o no que la máquina objetivo. El que la máquina objetivo vea al servidor no implica necesariamente que el servidor vea al objetivo. Además, si está conectada al mismo router, porque decías que era accesible desde internet. Lo que entiendo es que quieres redirigir el tráfico proveniente al servidor desde el exterior al objetivo http. Si el servidor, ve a la máquina http, bastaría con decir en la configuración de stunnel que conecte con el servidor http de esa maquina indicándole la ip:puerto. Por eso te dije que no tenía mayor complicación. En esa configuración no hace falta que la máquina objetivo tenga un servidor stunnel y viceversa para comunicarse entre ellos. La comunicación entre el servidor y la máquina objetivo puede ser abierta sin problemas. Lo importante ya existe, que el servidor haga de puente ssl entre internet y el objetivo http. > Durante el día de hoy lo he conseguido hacer más o menos usando > pppd y stunnel entre 2 linux pero no sé si sería posible hacerlo > sólo con stunnel (y *ifconfig*, *ip*, *route* o similares). Sobre > todo porque la máquina cliente objetivo está bastante limitada y no > puedo instalar de manera fácil pppd (tiene un kernel custom, hay > que compilar el módulo pppd del kernel, el demonio, etc). > > Lo que estoy mirando ahora es el comando *ip tunnel* para per si > puedo hacer algo parecido con pppd pero no sé si me estoy dando > golpes contra la pared. > > Muchas gracias de antemano por tu ayuda. De nada, aunque con Linux he topado. Conozco muy por encima los comandos. Pero, olvidándonos de las herramientas a utilizar, sabiendo exactamente el entorno en el que están esas máquinas, todo es coser y cantar, a no ser que sea un imposible ;) De ahí la importancia de saber si están en la misma red local o no, etc. Saludos.

1 1

Reverse tunnel with middle server
by Jorge A. 18 Jul '12

18 Jul '12

Hi everyone, I've search into archives trying to found a solution for my problem without success. The problem is simple: make a machine available on HTTP port when it's behind a e.g. common DSL. I have a middle server for which I have full access to install any program, linux. What I was trying to do is the following: Three machines: Middle server (Server), Target (linux machine behind DSL) and Client. Same stunnel version on both Server and Target. Latests. Server is available on the Internet, running stunnel Target is behind a nat router, e.g. inside a common DSL. I assume this must run stunnel as well. Client connects to Server and Server forwards traffic to Target seamlessly. As far as I know, running stunnel on client mode from e.g. Target and trying to connect to whichever service on Server does not work on reverse: you cannot connect backwards to target. Am I correct? If not, how do I configure both ends and how do I know port to use to connect to Target (log file?) ? What I've tested: 1. Run stunnel on Server on server mode accepting ('accept') connections on a fixed port, e.g. 5000. Here, as far as I know, you must define the 'connect' directive to forward traffic to either local or remote host. The problem is, from Server, you don't know Target ip nor it's accessible 2. Run stunnel on Server and, on Target launch stunnel on client mode to try Thanks in advance and congratulations as it's a great piece of software. Best regards, Jorge

1 0

Stunnel on WIndows Server 2008 R2 SP1 x 64 fails - Microsoft.VC90.CRT.MANIFEST
by Rüdiger Konte 15 Jul '12

15 Jul '12

Hi Stunnel users, I am trying to run stunnel "4.53 installer.exe" on a MS Windows Server 2008 R2 SP1 64 Bit (under VMWARE Workstation 6.5 as a virtual system; Physical Host OS is WIN7 Ultimate 32 BIT) The installation of stunnel was done as an "Administrator" and it ran through without issues. But I cannot se any service running. And when I try to launch the stunnel shortcut on the desktop, i got a error message like: "The application was unable to start correctly (0xc0150002). Click OK to close the application." I assume it has something to do with the Microsoft.VC90.CRT.MANIFEST file. But i am not an expert. This is shown in the Event log: ########################## Protokollname: Application Quelle: SideBySide Datum: 15.07.2012 12:17:01 Ereignis-ID: 35 Aufgabenkategorie:Keine Ebene: Fehler Schlüsselwörter:Klassisch Benutzer: Nicht zutreffend Computer: WIN-C1K2E115MV1 Beschreibung: Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files (x86)\stunnel\LIBEAY32.dll". Fehler in Manifest- oder Richtliniendatei "C:\Program Files (x86)\stunnel\Microsoft.VC90.CRT.MANIFEST" in Zeile 4. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8". Definition: Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Ereignis-XML: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="SideBySide" /> <EventID Qualifiers="49409">35</EventID> <Level>2</Level> <Task>0</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2012-07-15T10:17:01.000000000Z" /> <EventRecordID>197</EventRecordID> <Channel>Application</Channel> <Computer>WIN-C1K2E115MV1</Computer> <Security /> </System> <EventData> <Data>Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"</Data> <Data>Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161"</Data> <Data>C:\Program Files (x86)\stunnel\LIBEAY32.dll</Data> <Data>C:\Program Files (x86)\stunnel\Microsoft.VC90.CRT.MANIFEST</Data> <Data>4</Data> ########################## I ran the MS tool sxstrace.exe to get more details: See the outcome below: ######################################### INFORMATION: Die Manifestsdefinitionsidentität ist "Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161"". FEHLER: Die im Manifest gefundene Komponentenidentität stimmt nicht mit der Identität der angeforderten Komponente überein. Verweis: Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8". Definition: Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161". FEHLER: Bei der Generierung des Aktivierungskontextes ist ein Fehler aufgetreten. Beendet die Generierung des Aktivierungskontextes. ######################################### Is anything missing? .NET or another library ? Note: I installed on the same server in a different snapshot stunnel version 4.4 and it seems to work, at least no error message. But i want to use the latest version. Any help would be nice. Best Rudi

1 0

Conf question: HTTP to HTTPS with SNI
by John Moser 03 Jul '12

03 Jul '12

I have a particular task I need to accomplish in which an HTTP-only caching proxy server is to accept SSL. The architecture in mind is as follows: - Receive request { HTTP request: - Received by caching proxy at localhost:80 HTTPS request: - Received by Pound - Decoded to HTTP - X-FROM-SSL header added - Forwarded to localhost:80 (caching proxy) } Proxy receives HTTP request - Perform caching - If X-FROM-SSL, forward to localhost:8088 - Else forward to HTTP server It is at this point that two design options come into play, both using stunnel. Either use SNI or use stunnel and HTTP. Via SNI, this would appear as follows: Stunnel receives HTTP request - Forward to https://http-server:443/ with SNI This of course requires that stunnel can read the 'Host' header out of an HTTP request and use that for SNI automatically (there's some 300 virtual hosts on that server). If not, this is infeasible. Which is my question, of course: can this be done? If this isn't an option, then the next logical way to handle this problem is: Stunnel receives HTTP request: - SSL encrypt - Forward to http-server:8443 http-server receives HTTP over stunnel - stunnel receives on http-server:8443 - Decrypt and forward to http://localhost:80/ In this way the entire connection would be encrypted, and the HTTP server would see the Host: header and use that to figure out the virtual host etc. Is that the better/only way?

1 0

more than 1000 concurrent connections?
by Trenton Ashburn 03 Jul '12

03 Jul '12

Hi There - I'd like to use stunnel as the SSL termination point for a bunch of persistent TCP connections. I'm running it on an EC2 instance and it's only allowing me about 1000 concurrent connections. It doesn't matter if the connections come from one client IP or two. How can I raise this limit? I've already raised the OS tcp connection limit with ulimit and it doesn't improve things. Thanks, T

4 5

Re: [stunnel-users] Interoperability problems with .net client software
by josealf＠rocketmail.com 30 Jun '12

30 Jun '12

Not as far as I know. You need to check with the client application developers. Maybe they can use a debugger to trace the program flow and see where and why it fails (assuming they understand the protocols and the tools). The application must be coded to present the certificate, and my guess (just a guess), is that it isn't or is blocking before getting to that point. -----Original Message----- From: ProPharma Systems AG - Gregor Bürgisser <g.buergisser(a)propharma.ch> Date: Fri, 29 Jun 2012 06:59:14 To: <josealf(a)rocketmail.com> Subject: Re: [stunnel-users] Interoperability problems with .net client software Yes I did. Also the CA used to sign the server cert. All to no avail. Do you know if there are any (known) interoperability issues between stunnel and .net applications? On 06/28/2012 02:05 PM, josealf(a)rocketmail.com wrote: > Looks like your client is not presenting the certificate to the stunnel server. Maybe because it does not trust the server certificate? Did you import your stunnel server cert into windows certificate store? > > > -----Original Message----- > From: ProPharma Systems AG - Gregor Bürgisser > <g.buergisser(a)propharma.ch> > Sender: stunnel-users-bounces(a)stunnel.org > Date: Thu, 28 Jun 2012 12:48:53 > To:<stunnel-users(a)stunnel.org> > Subject: [stunnel-users] Interoperability problems with .net client software > > Hi all, > > I'm using stunnel 4.53 under Linux to secure a service. There are two > different clients connecting to this service: My own client, also Linux > based and using libcurl and another (third party!) client being > developed using Microsoft .net stuff. > > Of course with my own client all works well. But we are not able to get > the Microsoft client running. stunnel keeps on telling: > > SSL_accept: 140890C7: error:140890C7:SSL > routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate > > We have tried diffierent things... I will outline them here if you think > it is helpful (in short: tried using certificates generated on the > Microsoft side, then tried using certificates created on the Linux side). > If "verify" ist set to 0 or 1 it works (of course) but with a higher > value the above message is logged. > > Are there any known pitfalls, problems or whatsoever when using stunnel > with a .net client? > Any advice would be appreciated! > > Regards, > Gregor > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

clean installation on Windows
by John 29 Jun '12

29 Jun '12

Hello. I would like to install stunnel on 64-bit Win7, and I would like to know whether it is possible to do so by just unzipping the downloaded files into one folder and then clicking on the main executable, that is, to avoid making registry entries, etc. I would like to have a minimal impact to whatever extent is possible. Can it be done in this way, or does it need the whole shebang installer procedure to be run?

4 5