stunnel-users

3306 discussions

Disable TLSv1
by Smith, Michael 23 Jul '15

23 Jul '15

I am running stunnel version 5.20. How do I disable TLSv1 and leave only TLSv1.2 and TSLv2 enabled? Michael Smith System Specialist II 281-283-2930

2 1

Question about behavior with "failover = prio"
by Michael Gebis 22 Jul '15

22 Jul '15

Hello again. We recently noticed a behavior in stunnel that surprised us, and seems to be inconsistent with the man page description. We use "failover = prio" in our configuration file. To refresh everyone's memory, the man page describes this option here: failover = rr | prio Failover strategy for multiple "connect" targets. rr (round robin) - fair load distribution prio (priority) - use the order specified in config file default: rr Our config file contains a list of connect targets, like this: [...] connect = h1.example.com connect = h2.example.com connect = h3.example.com connect = h4.example.com [...] Based on the description, we expect the connection to try h1 first, and if h1 fails, failover through the remainder of the list, in-order. However, what we observe is that the connections start at a seemingly random place in the list. It does appear to proceed in-order...it's just the starting place that seems incorrect. For example, we might get a sequence that proceeds "h3->h4->h1->h2". Please let me know if I am misunderstanding the intended behavior of the 'prio' failover strategy. Here is a trial patch that hard-codes the starting place for the failover to the beginning of the list. I am not sure if this change has any unintended consequences for other configurations. But as a proof-of-concept, it does seem to fix the behavior to be consistent with our reading of the man page. This patch is against 5.20 but it appears that 5.21b2 acts the same way. Thanks! Michael diff -ru stunnel-5.20.orig/src/client.c stunnel-5.20-prio-fix/src/client.c --- stunnel-5.20.orig/src/client.c 2015-07-16 15:55:52.213064746 -0700 +++ stunnel-5.20-prio-fix/src/client.c 2015-07-17 16:13:12.129184507 -0700 @@ -1285,7 +1285,8 @@ *c->connect_addr.rr_ptr=(i+1)%c->connect_addr.num; s_log(LOG_INFO, "failover: round-robin"); } else { - s_log(LOG_INFO, "failover: priority"); + s_log(LOG_INFO, "failover: priority, starting at first entry"); + i=0; } return i; }

2 1

stunnel 5.20 issue using "--with-threads=ucontext"
by Michael Gebis 21 Jul '15

21 Jul '15

Hello. We recently upgraded from stunnel 5.10 to 5.20. We compile using "--with-threads=ucontext" and with this flag, compilation of 5.20 fails in two places. Both failures seem like minor oversights. Here is a proposed patch to fix the two failures. This patch is against 5.20, but I just checked the most recent 5.21b2 and it appears to require the same changes. Thanks! Michael diff -ru stunnel-5.20.orig/src/cron.c stunnel-5.20-ucontext-fix/src/cron.c --- stunnel-5.20.orig/src/cron.c 2015-07-16 15:55:52.214064748 -0700 +++ stunnel-5.20-ucontext-fix/src/cron.c 2015-07-16 16:15:56.593107354 -0700 @@ -47,7 +47,9 @@ #if defined(USE_PTHREAD) || defined(USE_WIN32) NOEXPORT void cron_worker(void); NOEXPORT void cron_dh_param(void); -#endif +#elif !defined(OPENSSL_NO_DH) +NOEXPORT void cron_dh_param(void); +#endif #if defined(USE_PTHREAD) diff -ru stunnel-5.20.orig/src/tls.c stunnel-5.20-ucontext-fix/src/tls.c --- stunnel-5.20.orig/src/tls.c 2015-07-16 15:55:52.180064660 -0700 +++ stunnel-5.20-ucontext-fix/src/tls.c 2015-07-16 15:56:30.520164252 -0700 @@ -110,7 +110,7 @@ if(ready_head) ready_head->tls=tls_data; else /* ucontext threads not initialized */ - global_tls=tls; + global_tls=tls_data; } TLS_DATA *tls_get() {

2 1

Unable to open log file
by Matt brancato 16 Jul '15

16 Jul '15

Hi all, Did a search but didn't see an answer so i figured i'd ask. I'm trying to runstunnel but am having some issues. I attempt to run stunnel but i run into an issue where it can't read the log file and then closes up. Any ideas? sudo stunnel stunnel.conf [ ] Clients allowed=500 [.] stunnel 5.19 on x86_64-unknown-linux-gnu platform [.] Compiled/running with OpenSSL 1.0.1 14 Mar 2012 [.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*__errno_location ()) [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark not detected [.] FIPS mode disabled [ ] Compression disabled [ ] Snagged 64 random bytes from /root/.rnd [ ] Wrote 1024 new random bytes to /root/.rnd [ ] PRNG seeded successfully [ ] Initializing service [<service>] [ ] Loading certificate from file: /etc/stunnel/server.pem [ ] Loading key from file: /etc/stunnel/server.pem [ ] Private key check succeeded [ ] DH initialization [ ] Could not load DH parameters from /etc/stunnel/server.pem [ ] DH parameters will be generated [ ] Cron started [ ] ECDH initialization [ ] ECDH initialized with curve prime256v1 [ ] SSL options: 0x03004004 (+0x03004000, -0x00000000) [.] Configuration successful [ ] Listening file descriptor created (FD=7) [ ] Service [<service>] (FD=7) bound to 127.0.0.1:9999 [ ] Executing cron jobs [.] Updating DH parameters [!] Cannot open log file: /home/tim/Desktop/stunnel.log [ ] Closing service [<service>] [ ] Service [<service>] closed (FD=7) [ ] Service [<service>] closed -- *CONFIDENTIALITY NOTICE* THE INFORMATION CONTAINED IN THIS COMMUNICATION IS INTENDED FOR THE NAMED RECEIVER ONLY. THE TRANSMISSION MAY CONTAIN PRIVILEGED AND CONFIDENTIAL MATERIAL. IF YOU ARE NOT THE NAMED RECIPIENT, PLEASE BE ADVISED THAT ANY USE, DISSEMINATION OR UNAUTHORIZED COPYING OF THE MATERIAL IS STRICTLY PROHIBITED. IF YOU HAVE RECEIVED THIS TRANSMISSION IN ERROR, PLEASE NOTIFY SUPPORT(a)TRUEEX.COM AND DESTROY THE RECEIVED COPY. THANK YOU.

1 0

stunnel 5.20 released
by Michal Trojnara 15 Jul '15

15 Jul '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.20 of stunnel. The ChangeLog entry: Version 5.20, 2015.07.09, urgency: HIGH * Security bugfixes - OpenSSL DLLs updated to version 1.0.2d. https://www.openssl.org/news/secadv_20150709.txt * New features - poll(2) re-enabled on MacOS X 10.5 and later. - Xcode SDK is automatically used on MacOS X if no other locally installed OpenSSL directory is found. - The SSL library detection algorithm was made a bit smarter. - Warnings about insecure authentication were modified to include the name of the affected service section. - A warning was added to stunnel.init if no pid file was specified in the configuration file (thx to Peter Pentchev). - Optional debugging symbols are included in the Win32 installer. - Documentation updates (closes Debian bug #781669). * Bugfixes - Signal pipe reinitialization added to prevent turning the main accepting thread into a busy wait loop when an external condition breaks the signal pipe. This bug was found to surface on Win32, but other platforms may also be affected. - Fixed removing the disabled taskbar icon. - Generated temporary DH parameters are used for configuration reload instead of the static defaults. - LSB compatibility fixes added to the stunnel.init script (thx to Peter Pentchev). - Fixed the manual page headers (thx to Gleydson Soares). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 4a36a3729a7287d9d82c4b38bf72c4d3496346cb969b86129c5deac22b20292b stunnel-5.20.tar.gz 9d9d38241e972713cd0937e2cf66fdacf3adcb357fbea82d8e46648de4e26fa4 stunnel-5.20-installer.exe cfc1e94cb7c7bf14c832ac8799db4a3438ae7542aa04ec5e9c6695a1a3c3843d stunnel-5.20-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVnoXOAAoJEC78f/DUFuAUGvoP/1WQ2DliVyQQNGDYPkE2Rbqk BJ7lMEseYdPLjZVtkNPQIuH9PCc/qbWMrDFK1sJg+R7d0yyp+Ip+ucH4i5GCfW6o xIZQ00WVa/qV52AcEDGTZ+43EBPBIFNMkSeJlkwyj81ISZ+my0YpqPNSF77fZFdN IqGln9e+1n4gM+8SOgPnJs2XiR2EsbQzmwaZcTCOoKp56j6q2bLXlYC802B9KezJ ex2dmbGV2JEHmNarSUxWO45VnFdqhjhz4qHySm6KnLD2hoyS9Ex2XyynuuyIiIVx yU9M1zliZvgQSQ4RTpO3Ko2b9Qy2cYDECrFwk7i5rlwmiCw1zH5zWGh1rnAsLJHn 7SAxc5BfiB3VQl16CgoLM65no2mJ60f499ab3LA0uTNbt03PrPkc5cK8w+ec3YNU 6E59R4FXC6ae5T4iR7b9mBGifUHWtg53I1H7qbD6Pye/EH5QciSSPizEHeORYlPy fC3jOMEIUDlXjqI7k/XMGVPJ7SSKFkBNiqHKTKoM12QhiZXLLh4Ig3aQJgqX5IBQ VdML1/W9MdBlZNAHYaUBrkSls99aVbIsHJ5yAE0gsF5Lgi6hK6zDkXiKoVEozN5A N6MtfQHs/JS2nvlmCbtGWrK66EXKxW409f0JS3AJG6tjOquuSZYmR944EPzQD+zA WPivIUH2TVk63kULw/ui =Uw+D -----END PGP SIGNATURE-----

3 10

keyfile is not encrypted
by Madhava Gaikwad (madgaikw) 15 Jul '15

15 Jul '15

Hello, I am asking too much, but keyfile with stunnel is required to be stored on disk (I am aware about file permission applied) and is in plain text. Is there any way we can encrypt the keyfile and then store, and then subsequently ask stunnel to obtain the decryption key somehow and then use it. For encryption/decryption of the key, stunnel (or some other program) can give network based ability(service over socket) to provide the key so key can be encrypted by the third party(who generates the config for stunnel). Stunnel config option will specify key is encrypted and therefore stunnel knows why and how to decrypt it. Of course you will ask me to implement my own custom algo for this, but I am checking if anybody has thought about it or in such case, how they have worked on it. I was told, there is also basic level of FIPS compliance requirement that requires key not to be stored on disk in plain text irrespective of file permission. Thank you. Madhava

2 1

please remove me from the mailing list
by Kjell Osness 14 Jul '15

14 Jul '15

Thank you. Kjell Osness IT Technician American Home Entertainment cell (619) 520-9417 office (858) 430-1701 fax (858) 430-1702

1 0

help on options and sslversion
by Madhava Gaikwad (madgaikw) 13 Jul '15

13 Jul '15

Hi, I am using stunnel 5.03 version. I want to understand how the config option "sslVersion " and "options " works. The problem I am trying to solve is: I want to enable say only particular ssl connect methods, for example sslv3 and TLs1.2. I am not able to do it. For me if I do below setting: Options = all Option = NO_SSLv2 Option = NO_SSLv3 Option = NO_TLSv1 Option = NO_TLSv1.1 Option = NO_TLSv1.2 Still I see all methods are being enabled. I removed Option = all, but no effect. What is expected behavior? Also, The sslVersion seems enables either particular sslversion, or else all the versions. So wondering what can be the escape mechanism. Any help will be highly appreciated. Thank you. Madhava

2 2

"make check" tries to build Windows binary on Unix
by Dagobert Michelsen 13 Jul '15

13 Jul '15

Hi, I just tries to build stunnel 5.20 on Solaris 10 Sparc and noticed a strange behaviour during „make check“ which yields in a try to build Windows executables: > dam@unstable10s [unstable10s]:/home/dam/mgar/pkg/stunnel/trunk/work/solaris10-sparc/build-isa-sparcv8plus/stunnel-5.20 > gmake check > Making check in src > gmake[1]: Entering directory '/home/dam/mgar/pkg/stunnel/trunk/work/solaris10-sparc/build-isa-sparcv8plus/stunnel-5.20/src' > gmake stunnel.exe tstunnel.exe > gmake[2]: Entering directory '/home/dam/mgar/pkg/stunnel/trunk/work/solaris10-sparc/build-isa-sparcv8plus/stunnel-5.20/src' > i686-w64-mingw32-gcc -c -I/usr/src/openssl-1.0.2d-i686/include -mthreads -fstack-protector -O2 -Wall -Wextra -Wpedantic -Wformat=2 -Wconversion -Wno-long-long -D_FORTIFY_SOURCE=2 -DUNICODE -D_UNICODE -o tls.obj tls.c > /bin/bash: i686-w64-mingw32-gcc: command not found > Makefile:1206: recipe for target 'tls.obj' failed > gmake[2]: *** [tls.obj] Error 127 > gmake[2]: Leaving directory '/home/dam/mgar/pkg/stunnel/trunk/work/solaris10-sparc/build-isa-sparcv8plus/stunnel-5.20/src' > Makefile:1054: recipe for target 'check-am' failed I think this comes from these lines in src/Makefile.am: > # Just check if the programs can be built, don't perform any actual tests > check_PROGRAMS = stunnel.exe tstunnel.exe Essentially the „check“ phase could just not be called during build, but it would be cleaner to not bail out on Unix. Best regards — Dago -- "You don't become great by trying to be great, you become great by wanting to do something, and then doing it so hard that you become great in the process." - xkcd #896

3 6

Re: [stunnel-users] problem with buffering data on stunnel
by Michal Trojnara 10 Jul '15

10 Jul '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 10.07.2015 20:17, wujot/Adalbert wrote: > But unencrypted session on path between Stunnel server and hi-speed > end server (both in LAN) is using TcpWindowSize on level 64KB - > 131KB Did you consider also tuning SO_SNDBUF of the sending application? > (in Windows 2008 or newer it is calculated automatically). So I > steel have at least 64KB buffer in stunnel. IMHO Windows is probably not the best server platform... > Is there any possibility to force stunnel to use on faster part of > connection (LAN side) the value of TcpWindowSize similar to > calculated on slower part (on WAN side)? I don't think such tricks are possible with BSD sockets. BTW: You can also change BUFFSIZE in common.h and rebuild stunnel. Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJVoDm6AAoJEC78f/DUFuAURJQQAM1ix6ZkSqOCa9iLiBDIFvrS DajgeGDGeSE75WkyI+IQrPYjWJGNielOeXhCPjYdQh+5o/bddYPaRlQRsu0HlY6F Nncj1kP8Xy0WNO4uxz1YWpnnJtE/Ph9VUVLqS/63tJgkrhmvXF1HODeu677JLzEb wjOn0kv6SmPnzkFMpjbBmkRPt5GeSRc43POGoHcuqFKijeaTDGoqhBLo+tGLhtNV ezYN+QFvyyzMVPe8tscWa+vyXYdbMzgLBXXCHFMbFmlpu6QKHKb0823Q7g7OgMCb DYkVbw0a0ys6hdreBHejvAbgfG8fTKOtYfdOa7lnjCuivGpVKLa018yTk/1qjUbs dmr08MFPGkkMSfV/sQ+PMgZ0Dxaoczt1yXanzURNDXC4eiUlgEXfs4S5J2NYxTOe g4ZG7ZXQIHrux1AcQD9TQF+G9h7YxXeRMt0K29qA54dH+x+Xie920OJMXohMAZJ0 ddkblmt7SHO2XiEV6C2ie1VvB/roZ+aeqKQME4T8oZliy/kaDgXgs/eFLT2Kxw9B WwlWt4r4pLHFkJfExJF/nMWe0qRt/tlVoqyvOFE1hnTxOGr5pGLnY0XOoHX13kr/ ow1TC0N0UPWV++Uydm2oJwXA+o7a/TRs8O+PEhhHTqLDi4O/apC7kL9fM6DjESGr Zj+br1nUiaF+LscAiC/D =kA2M -----END PGP SIGNATURE-----

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users