- stunnel-users - stunnel.org

stunnel-5.06 fails to build against systemd 215
by Anthony G. Basile 24 Oct '14

24 Oct '14

Hi everyone, We hit a bug in stunnel-5.05 and it continues in 5.06. The problem comes from systemd which moved sd_listen_fds() form libsystemd-daemon.so to libsystemd.so. However, stunnel's configure.ac still has AC_SEARCH_LIBS([sd_listen_fds], [systemd-daemon]) For backwards compatibility, this should probably be AC_SEARCH_LIBS([sd_listen_fds], [systemd], [], [ AC_SEARCH_LIBS([sd_listen_fds], [systemd-daemon]) ]) or similar. Please refer to our downstream bug: https://bugs.gentoo.org/show_bug.cgi?id=525234' Thanks. -- Anthony G. Basile, Ph. D. Chair of Information Technology D'Youville College Buffalo, NY 14201 (716) 829-8197

2 5

stunnel service leaves stale connections to rsync on the server side
by Polyack, Steve 22 Oct '14

22 Oct '14

Hi, We've been running a rsync service over stunnel for some time now. After upgrading our environment, which involved moving from an old version of Linux to FreeBSD 9.3, and from stunnel-4.29 to stunnel-5.06, we've had a problem pop up. Ever since switching over, we see that rsync daemon processes slowly build up over time on our server, each consuming 100% CPU. The vast majority of our clients are working just fine, and the problematic rsync processes just seem to have been dead/aborted connections from the clients (which are using wireless aircard, so connectivity can be shotty). A quick 'truss' on the process shows they are doing nothing but sitting there and read()'ing in a loop indefinitely: # truss -p 14689 | head read(6,0x7fffffff8240,1) = 0 (0x0) read(6,0x7fffffff8240,1) = 0 (0x0) read(6,0x7fffffff8240,1) = 0 (0x0) read(6,0x7fffffff8240,1) = 0 (0x0) read(6,0x7fffffff8240,1) = 0 (0x0) read(6,0x7fffffff8240,1) = 0 (0x0) Furthermore, the connection appears to be closed: # sockstat -4 | grep 14689 root rsync 14689 3 tcp4 127.0.0.1:873 127.0.0.1:27724 netstat -an | grep 27724 netstat: kvm not available: /dev/mem: No such file or directory tcp4 0 0 127.0.0.1.873 127.0.0.1.27724 CLOSED Looking through the stunnel logs, it looks like no data was ever really passed (perhaps the client gave up?): 2014.10.22 10:45:52 LOG7[34384941056]: Service [rsync] started 2014.10.22 10:45:52 LOG5[34384941056]: Service [rsync] accepted connection from 1.1.1.1:63095 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): before/accept initialization 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 read client hello A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 write server hello A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 write certificate A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 write server done A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 flush data 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 read client key exchange A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 read finished A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 write change cipher spec A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 write finished A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 flush data 2014.10.22 10:45:52 LOG7[34384941056]: 41 items in the session cache 2014.10.22 10:45:52 LOG7[34384941056]: 0 client connects (SSL_connect()) 2014.10.22 10:45:52 LOG7[34384941056]: 0 client connects that finished 2014.10.22 10:45:52 LOG7[34384941056]: 0 client renegotiations requested 2014.10.22 10:45:52 LOG7[34384941056]: 110 server connects (SSL_accept()) 2014.10.22 10:45:52 LOG7[34384941056]: 107 server connects that finished 2014.10.22 10:45:52 LOG7[34384941056]: 0 server renegotiations requested 2014.10.22 10:45:52 LOG7[34384941056]: 66 session cache hits 2014.10.22 10:45:52 LOG7[34384941056]: 0 external session cache hits 2014.10.22 10:45:52 LOG7[34384941056]: 32 session cache misses 2014.10.22 10:45:52 LOG7[34384941056]: 0 session cache timeouts 2014.10.22 10:45:52 LOG6[34384941056]: No peer certificate received 2014.10.22 10:45:52 LOG6[34384941056]: SSL accepted: new session negotiated 2014.10.22 10:45:52 LOG6[34384941056]: Negotiated SSLv3 ciphersuite AES256-SHA (256-bit encryption) 2014.10.22 10:45:52 LOG6[34384941056]: Compression: null, expansion: null 2014.10.22 10:45:52 LOG6[34384941056]: s_connect: connecting 127.0.0.1:873 2014.10.22 10:45:52 LOG5[34384941056]: s_connect: connected 127.0.0.1:873 2014.10.22 10:45:52 LOG5[34384941056]: Service [rsync] connected remote server from 127.0.0.1:27724 2014.10.22 10:45:52 LOG7[34384941056]: Remote socket (FD=11) initialized 2014.10.22 11:01:12 LOG3[34384941056]: SSL_read: Connection reset by peer (54) 2014.10.22 11:01:12 LOG5[34384941056]: Connection reset: 56 byte(s) sent to SSL, 56 byte(s) sent to socket 2014.10.22 11:01:12 LOG7[34384941056]: Remote socket (FD=11) closed 2014.10.22 11:01:12 LOG7[34384941056]: Local socket (FD=10) closed 2014.10.22 11:01:12 LOG7[34384941056]: Service [rsync] finished (4 left) The clients are generally field units running stunnel versions in the 4.x range. Unfortunately, updating them is not an easy task and is not really under my control. Either way, this seems like a server side issue, and possibly an issue with rsync (we're running 3.1.0). Has anyone run into anything like this before? Does anyone have any suggestions for additional debugging we can do to try to pinpoint the problem? We are going to try rolling back to stunnel-4.29 to see if the problem still occurs there on the new system. Thanks, Steve

1 1

SSLv3 connections vulnerable in my environment?
by Fritz Gschwendner 21 Oct '14

21 Oct '14

Hello, I have a pretty standard stunnel server configuration with verify = 2 and clients, that don't speak TLS and can't easily be upgraded to support TLS. So disabling SSLv3 leads to handshake errors, I need to leave it enabled for now. The SSL connection is always renegotiated, a proprietary protocol is used inside SSL, and clients can be considered safe. Can the poodle security flaw realistically be used by a man in the middle to decrypt packets send over such an SSLv3 connection? If so, is there any other way to protect against the attack? Thank you.

1 0

Trouble after disabling SSLv3 (another one)
by Koenraad Lelong 21 Oct '14

21 Oct '14

Hi, Last week I disabled SSLv3 on my stunnel-server. I thought I tested it, but this morning I had to use it and I couldn't get access. Now at the office I tried again, with the same result. After enabling SSLv3 again I could get access. So my configuration seems wrong. My server runs Ubuntu 12.04 LTS, stunnel is 4.42-1ubuntu (stock ubuntu). This is my stunnel.conf (tunnels removed/edited) : client = no setuid = stunnel4 setgid = stunnel4 pid = /var/run/stunnel4/stunnel4.pid debug = debug output = /var/log/stunnel4/stunnel.log options = NO_SSLv2 options = NO_SSLv3 socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 3 CApath = /etc/stunnel-certs CAfile = /etc/stunnel/cacert.pem cert = /etc/stunnel/lace3.keycrt [tunnel vnc] accept = 12345 connect = remotehost:5901 The log on the server : 2014.10.21 08:32:15 LOG7[28587:140281088546560]: Service tunnel vnc accepted FD=0 from 192.168.1.14:55708 2014.10.21 08:32:15 LOG7[28587:140281088538368]: Service tunnel vnc started 2014.10.21 08:32:15 LOG7[28587:140281088538368]: Option TCP_NODELAY set on local socket 2014.10.21 08:32:15 LOG7[28587:140281088538368]: Waiting for a libwrap process 2014.10.21 08:32:15 LOG7[28587:140281088538368]: Acquired libwrap process #0 2014.10.21 08:32:15 LOG7[28587:140281088538368]: Releasing libwrap process #0 2014.10.21 08:32:15 LOG7[28587:140281088538368]: Released libwrap process #0 2014.10.21 08:32:15 LOG7[28587:140281088538368]: Service tunnel vnc permitted by libwrap from 192.168.1.14:55708 2014.10.21 08:32:15 LOG5[28587:140281088538368]: Service tunnel vnc accepted connection from 192.168.1.14:55708 2014.10.21 08:32:15 LOG7[28587:140281088538368]: SSL state (accept): before/accept initialization 2014.10.21 08:32:15 LOG7[28587:140281088538368]: SSL alert (write): fatal: handshake failure 2014.10.21 08:32:15 LOG3[28587:140281088538368]: SSL_accept: 1408A10B: error:1408A10B:SSL routines:SSL3_GET_CLIENT_HELLO:wrong version number 2014.10.21 08:32:15 LOG5[28587:140281088538368]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2014.10.21 08:32:15 LOG7[28587:140281088538368]: Service tunnel vnc finished (0 left) 2014.10.21 08:32:15 LOG7[28587:140281088538368]: str_stats: 0 block(s), 0 byte(s) The log on the client (opensuse 13.1) : 2014.10.21 08:47:47 LOG7[978:140089725433664]: local socket: FD=0 allocated (non-blocking mode) 2014.10.21 08:47:47 LOG7[978:140089725433664]: Service tunnel vnc accepted FD=0 from 127.0.0.1:39609 2014.10.21 08:47:47 LOG7[978:140089725630208]: Service tunnel vnc started 2014.10.21 08:47:47 LOG7[978:140089725630208]: Option TCP_NODELAY set on local socket 2014.10.21 08:47:47 LOG7[978:140089725630208]: Waiting for a libwrap process 2014.10.21 08:47:47 LOG7[978:140089725630208]: Acquired libwrap process #0 2014.10.21 08:47:47 LOG7[978:140089725630208]: Releasing libwrap process #0 2014.10.21 08:47:47 LOG7[978:140089725630208]: Released libwrap process #0 2014.10.21 08:47:47 LOG7[978:140089725630208]: Service tunnel vnc permitted by libwrap from 127.0.0.1:39609 2014.10.21 08:47:47 LOG5[978:140089725630208]: Service tunnel vnc accepted connection from 127.0.0.1:39609 2014.10.21 08:47:47 LOG7[978:140089725630208]: remote socket: FD=1 allocated (non-blocking mode) 2014.10.21 08:47:47 LOG6[978:140089725630208]: connect_blocking: connecting 192.168.0.30:12345 2014.10.21 08:47:47 LOG7[978:140089725630208]: connect_blocking: s_poll_wait 192.168.0.30:13001: waiting 10 seconds 2014.10.21 08:47:47 LOG5[978:140089725630208]: connect_blocking: connected 192.168.0.30:12345 2014.10.21 08:47:47 LOG5[978:140089725630208]: Service tunnel vnc connected remote server from 192.168.1.14:55770 2014.10.21 08:47:47 LOG7[978:140089725630208]: Remote FD=1 initialized 2014.10.21 08:47:47 LOG7[978:140089725630208]: Option TCP_NODELAY set on remote socket 2014.10.21 08:47:47 LOG7[978:140089725630208]: SSL state (connect): before/connect initialization 2014.10.21 08:47:47 LOG7[978:140089725630208]: SSL state (connect): SSLv3 write client hello A 2014.10.21 08:47:47 LOG7[978:140089725630208]: SSL alert (read): fatal: handshake failure 2014.10.21 08:47:47 LOG3[978:140089725630208]: SSL_connect: 14094410: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure 2014.10.21 08:47:47 LOG5[978:140089725630208]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2014.10.21 08:47:47 LOG7[978:140089725630208]: Service tunnel vnc finished (0 left) 2014.10.21 08:47:47 LOG7[978:140089725630208]: str_stats: 0 blocks, 0 bytes Am I missing something ? I would like to stay with Ubuntu's standard packages. Thanks for any advice. Koenraad Lelong.

2 4

STOP REMOVING OLD RELEASE TARBALLS FOR GODS SAKE
by John Spencer 21 Oct '14

21 Oct '14

hello, 5 days ago i noticed that my stunnel source package was *again* broken because some clown removed the previous version's download from the download server, so i bite the bullet and upgraded to latest (5.05). today, doing a testbuild i got a again a 404 and was forced again to update to latest stunnel download. this is fucking frustrating. i really have better things to do than to update my package recipes whenever a new stunnel release comes out (and that's not just me). SO COULD YOU PLEASE FINALLY LEAVE YOUR PAST RELEASES ON THE DOWNLOAD MIRROR LIKE ANYONE ELSE DOES ? THANKS. and no, even if a security flaw in non-latest was discovered that's still no reason to silently delete the old tarballs. thanks, --JS P.S. the latest stunnel still does not link against libreSSL instead of openssl, due to bogus usage of RAND_egd() as mentioned a quarter year ago in my blog: http://devsonacid.wordpress.com/2014/07/12/how-compatible-is-libressl/

4 3

Trouble after disabling SSLv3
by Dion Kant 19 Oct '14

19 Oct '14

Dear list, I have stunnel running in a configuration where we use it to connect to a webserver over https while adding client certificates to the requests. This worked fine until recently on the (Apache) webserver SSLv3 was disabled. I installed the latest version of stunnel today (stunnel-5.07b2 <https://www.stunnel.org/downloads/beta/stunnel-5.07b2.tar.gz>) but that did not fix the problem. Now STunnel tries to negotiate a https connection using the TLSv1.2 and I found that because of this Apache does not like the content of the Host variable in the HTTP header which is different from what Apache is expectingto be. With SSLv3 this was not an issue. As a result I get a "HTTP/1.1 400 Bad Request" from the webserver. In my configuration I cannot (easily) apply some form of split DNS to get the hostname correct in the http header already from the client connecting to the stunnel service. I tested using curl sending a request through stunnel to the web server and verified that when I modified the Host field in the request header it does work. To my opinion it is stunnel setting up the HTTPS connection to the webserver and stunnel should take care of setting the correct Host field in the request header. Is there a way to let stunnel take care of setting the correct info in the HTTP header? Best regards, Dion Kant

1 0

Re: [stunnel-users] stunnel 5.06 released
by Dominyk Tiller 16 Oct '14

16 Oct '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi Mike, Latest build seems to be broken for me on OS X 10.10. If it matters here, since the error is SSL related, I'm building against OpenSSL 1.0.1j which is configured without ssl2 ciphers but with ssl3 ciphers enabled. This is the error: libtool: link: clang -pthread -fstack-protector -fPIE -g -O2 -Wall - -Wextra -Wno-long-long -pedantic -o stunnel stunnel-str.o stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-fd.o stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o stunnel-ui_unix.o - -L/usr/local/opt/openssl/lib64 -L/usr/local/opt/openssl/lib -lssl - -lcrypto -lz -lpthread -pthread Undefined symbols for architecture x86_64: "_SSLv2_client_method", referenced from: _parse_service_option in stunnel-options.o "_SSLv2_server_method", referenced from: _parse_service_option in stunnel-options.o ld: symbol(s) not found for architecture x86_64 clang: error: linker command failed with exit code 1 (use -v to see invocation) make[1]: *** [stunnel] Error 1 make[1]: *** Waiting for unfinished jobs.... libtool: link: ( cd ".libs" && rm -f "libstunnel.la" && ln -s "../libstunnel.la" "libstunnel.la" ) make: *** [install-recursive] Error 1 Hope that's useful. Let me know if you need more. Dom -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJUP8tNAAoJEIclJNuddDJsePEP/0tEy5rKsOzpORpawOFDpZAD KaemUgVKbaWpphkldp9tPFsaCRhQrqQPNIjfaUGb/mSAe3mAoV69P1rXYlMQiGne oaCa/p35y1SYYq0RHzflPhlDb/avfz8F5cQsXb1vA3bec8vVyTEjsIjj/pSH+him EysnGZNG61xcD55IOWT4LbcfiBO+L0iwQn4w/fQXqATmMHeYKde95d1t3DCx7Rvw t80hOw7c6xZzkYOPoXZpWPBhBESzifkE3JiapNAtRjyj9EZK+1gukjOa5EB7vrz8 pdpI65lwIAk9Grv8IT2jHIJcj03H7zPzhXoeLJl/OWKTqHVc8X7naT1Tg5kwKWdG CG0keA9hyXHhhSn763OPkKeMG7Ab31IRAlIT3ajEa2o+57KFBb5KVgHn/RWsr+0g Yzv5FjM5ZJjH02Qj/9QqjlhzzdUQDNPGpNk72UKqXbnz3xv8JoQX16PMeUYrgH6h ZjXrtcBh6CXQghyDY1D9m2xFKIVAIcfcAm6XgV6yUawfL76LL/WbreEbCmBlkRHI p17BT7TUE4pfeSpxdfMmIPgMlaAragfT+NYw4/l7XgEqi3sjaf3IpupJ4hjqbl/F dt6W/VCILDW3lnSnbWwWy/7rantCQZldbg4xWsxDMMx1oinwOgk+l92I+9Qas+8z MnuTZ052UiJ9Agn+ZxQs =i1GY -----END PGP SIGNATURE-----

1 0

Window not updating (win32 5.05)
by Javier 16 Oct '14

16 Oct '14

Hi, just reporting that with the latest version the window doesn't get updated when there is activity. It is static. You have to minimize to tray and restore again to view the activity, what, almost, is actually as fast as have a look to the log :/ Can anyone confirm? Regards. P.S.: happening on 2k and XP. Haven't tested any NT6 version.

2 3

error compiling stunnel 5.06
by Laura Fried 15 Oct '14

15 Oct '14

/tmp/stunnel-5.06/src/options.c:2123: undefined reference to `SSLv2_client_method' /tmp/stunnel-5.06/src/options.c:2127: undefined reference to `SSLv2_server_method' collect2: ld returned 1 exit status make[2]: *** [stunnel] Error 1 make[2]: Leaving directory `/tmp/stunnel-5.06/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/tmp/stunnel-5.06/src' make: *** [all-recursive] Error 1 Please advise. -- Laura J. Fried Internal Revenue Service Online Fraud Detection and Prevention 202-556-2612 (Voice) 202-552-1226 (Fax) ofdp-laura (Skype)

2 2

stunnel 5.06 released
by Michal Trojnara 15 Oct '14

15 Oct '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.06 of stunnel. This is a security bugfix release. Update is recommended. The ChangeLog entry: Version 5.06, 2014.10.15, urgency: HIGH: * Security bugfixes - OpenSSL DLLs updated to version 1.0.1j. https://www.openssl.org/news/secadv_20141015.txt - The insecure SSLv2 protocol is now disabled by default. It can be enabled with "options = -NO_SSLv2". - The insecure SSLv3 protocol is now disabled by default. It can be enabled with "options = -NO_SSLv3". - Default sslVersion changed to "all" (also in FIPS mode) to autonegotiate the highest supported TLS version. * New features - Added missing SSL options to match OpenSSL 1.0.1j. - New "-options" commandline option to display the list of supported SSL options. * Bugfixes - Fixed FORK threading build regression bug. - Fixed missing periodic Win32 GUI log updates. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 098c2b6db0793ea4fa5b6767ce6ef1853e9f6cc2f32133024be55f6a460b1a40 stunnel-5.06.tar.gz 55afb3013406da1afcc1ab7ccc25bb1c66605ca3e004636a6b49cac555cb4d09 stunnel-5.06-installer.exe a1741eb8bb050d3d29515ddef46a0a6828372a991f2658995dee1e06af8c05c8 stunnel-5.06-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlQ+4v4ACgkQ/NU+nXTHMtFwNwCgvZyndOwkAQqmsWnuL7DcRAPq lSIAnig726aVMrFzFAoQzKXxxmWo/Qo9 =ok3p -----END PGP SIGNATURE-----

1 0