- stunnel-users - stunnel.org

Update docs to remove RLE as compression choice
by Joe Kemp 06 Nov '09

06 Nov '09

I just confirmed that RLE compression is not truly implemented in OpenSSL. It would be helpful to remove it from the stunnel docs so people don't think it's an option to compress data. ZLIB is it. And yes I spent a good bit of time last year with Wireshark to determine RLE vs ZLIB compression ratios in stunnel. Shockingly ZLIB was always better... One other note that may be important for some people is that 0.9.7 openssl is not compatible with 0.9.8 with respect to zlib compression. Joe A. Kemp CapWIN Senior Systems Architect (O) 301-614-3727 (C) 301-502-1281

2 1

Is PSK supported with openssl-1.0.0-beta3 ?
by anders nilsson 05 Nov '09

05 Nov '09

Hello I am running x64 Linux 2.6.18-92.1.22.el5 and installed OpenSSL 1.0.0-beta3 15 Jul 2009 My stunnel -version is: stunnel 4.15 on x86_64-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 I would like to run the ciphers TLS_PSK_WITH_3DES_EDE_CBC_SHA or TLS_PSK_WITH_AES_128_CBC_SHA and I wonder how I do that. My stunnel.conf contains: ciphers = PSK-AES128-CBC-SHA:PSK-3DES-EDE-CBC-SHA and the error I get is: 2009.11.05 11:32:32 LOG3[29268:47461015826624]: SSL_CTX_set_cipher_list: 1410D0B9: error:1410D0B9:SSL routines:SSL_CTX_set_cipher_list:no cipher match Do I compile in the latest OpenSSL to stunnel? Isnt it a problem that the stunnel.conf does not even have the syntax to read PSK-key parameters since its most often run with RSA keys. _________________________________________________________________ Windows Live: Gör det enklare för dina vänner att se vad du håller på med på Facebook. http://www.microsoft.com/sverige/windows/windowslive/see-it-in-action/socia…

1 0

Is PSK supported with openssl-1.0.0-beta3 ?
by anders nilsson 05 Nov '09

05 Nov '09

Hello I am running x64 Linux 2.6.18-92.1.22.el5 and installed OpenSSL 1.0.0-beta3 15 Jul 2009 My stunnel -version is: stunnel 4.15 on x86_64-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 I would like to run the ciphers TLS_PSK_WITH_3DES_EDE_CBC_SHA or TLS_PSK_WITH_AES_128_CBC_SHA and I wonder how I do that. My stunnel.conf contains: ciphers = PSK-AES128-CBC-SHA:PSK-3DES-EDE-CBC-SHA and the error I get is: 2009.11.05 11:32:32 LOG3[29268:47461015826624]: SSL_CTX_set_cipher_list: 1410D0B9: error:1410D0B9:SSL routines:SSL_CTX_set_cipher_list:no cipher match Do I compile in the latest OpenSSL to stunnel? Isnt it a problem that the stunnel.conf does not even have the syntax to read PSK-key parameters since its most often run with RSA keys. Another question is that if there is no support for PSK, how much work is it to download the source and add support for it given that I know C++/C. _________________________________________________________________ Hitta hetaste singlarna på MSN Dejting! http://dejting.se.msn.com/channel/index.aspx?trackingid=1002952

1 0

Tunneling udp over stunnel
by D-503 03 Nov '09

03 Nov '09

Hi, I'm trying to setup some kind of DNS-encryption with the usage of stunnel: https://www.privacyfoundation.de/wiki/HTTPS-DNS/TLS-DNS . This setup is working but pretty pretty slow. One DNS-request takes really long, about 5-6 seconds! I'm wondering why this happens. On the server is running stunnel 4.22 and on the client stunnel 4.25. The config is as described in the link above. What happens in the logs when I do one dns-request, you can see in the attachments of this mail. Something interesting is, if I do a: dig @localhost google.com it takes 5-6 seconds to finish. But if I execute it, abort it directly and execute it again, I get immediatly an answer! This works reproducably. Have you any idea? Could the error be with open/closed connections or some timeouts in stunnel? greetings D-503

1 0

Help with basic stunnel configuration
by Craig Watkinson 30 Oct '09

30 Oct '09

Hello, I have been trying to enable stunnel on a HPUX server, and whilst I thought it was going to be simple, I have not been able to make it work so far. We have a webserver and due to some pages being hardcoded to port 8080 it can't support SSL without a lot of code changes. As a short term workaround I am trying to use stunnel in server mode to provide a HTTPS interface. I expected this to be a very simple matter of accepting connections on port 443 and connecting to port 8080, but it's not working. We're using an old version of stunnel (4.04) however this is the version bundled with the HPUX OS we have. When stunnel is started there are no errors (log file output below) and netstat shows that a process is listening on port 443, however a browser (tried IE6 and Firefox) doesn't display anything. Connecting to port 8080 shows the application as expected. I have run a wireshark trace at the client end, and it seems that the stunnel server is not responding to the initial "Client Hello" message. Only 3 packets are seen: C->S SYN S->C SYN,ACK C->S SSL Client Hello My guess is that the ssl server is not starting up correctly, however everything looks ok in the logfile, although it might not be completing. Nothing is displayed in the log when I try to connect to port 443. Any help would be much appreciated as I am stuck! Thanks Craig Server eSM_CoE# uname -a HP-UX eSM_CoE B.11.23 U ia64 1107767544 unlimited-user license Stunnel Version eSM_CoE# ./sbin/stunnel -version stunnel 4.04 on ia64-hp-hpux11.23 PTHREAD with OpenSSL 0.9.8d 28 Sep 2006 Global options cert = /opt/hpws/apache32/stunnel/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /opt/hpws/apache32/stunnel/etc/stunnel/stunnel.pem pid = /opt/hpws/apache32/stunnel/var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTidle = 43200 seconds Conf file eSM_CoE# cat stunnel.conf # Sample stunnel configuration file RNDfile=/opt/hpws/apache32/stunnel/.stunnel.rnd # Chroot #chroot = /var/chroot/stunnel/ # PID is created inside chroot jail pid = /opt/hpws/apache32/logs/stunnel.pid # Workaround for Eudora bug #options = DONT_INSERT_EMPTY_FRAGMENTS # Client Authentication #verify = 2 # don't forget about c_rehash CApath # it is located inside chroot jail: #CApath = /certs # or simply use CAfile instead: #CAfile = /opt/hpws/apache32/conf/certs.pem # Some debugging stuff debug = 7 output = /opt/hpws/apache32/logs/stunnel.log # Use in client mode client = no # Run in the background foreground = no socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 delay=yes # Service-level configuration [https] accept = 172.20.167.74:443 connect = localhost:8080 TIMEOUTclose = 10 Log file output 2009.10.30 14:32:41 LOG5[4172:1]: stunnel 4.04 on ia64-hp-hpux11.23 PTHREAD with OpenSSL 0.9.8d 28 Sep 2006 2009.10.30 14:32:41 LOG7[4172:1]: Snagged 64 random bytes from /opt/hpws/apache32/stunnel/.stunnel.rnd 2009.10.30 14:32:41 LOG7[4172:1]: Wrote 1024 new random bytes to /opt/hpws/apache32/stunnel/.stunnel.rnd 2009.10.30 14:32:41 LOG7[4172:1]: RAND_status claims sufficient entropy for the PRNG 2009.10.30 14:32:41 LOG6[4172:1]: PRNG seeded successfully 2009.10.30 14:32:41 LOG7[4172:1]: Certificate: /opt/hpws/apache32/stunnel/etc/stunnel/stunnel.pem 2009.10.30 14:32:41 LOG7[4172:1]: Key file: /opt/hpws/apache32/stunnel/etc/stunnel/stunnel.pem 2009.10.30 14:32:41 LOG5[4172:1]: FD_SETSIZE=60000, file ulimit=4096 -> 2000 clients allowed 2009.10.30 14:32:41 LOG7[4172:1]: FD 5 in non-blocking mode 2009.10.30 14:32:41 LOG7[4172:1]: SO_REUSEADDR option set on accept socket 2009.10.30 14:32:41 LOG7[4172:1]: https bound to 172.20.167.74:443 _________________________________________________________________ New Windows 7: Find the right PC for you. Learn more. http://www.microsoft.com/uk/windows/buy/

1 0

stunnel compatibility problems between Windows & Linux ?
by Ewald 30 Oct '09

30 Oct '09

I am running an stunnel in chroot setup on a Red Hat Enterprise Linux Server (v3) : stunnel 4.27 on x86_64-unknown-linux-gnu with OpenSSL 0.9.7a Feb 19 2003 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 And i want to connect from a Windows 2003 system (als version 4.27) When i try to do a basic connect from the Windows stunnel to the Linux stunnel, the connection gets reset each time, ssldump shows: New TCP connection #1: hans13(1363) <-> nada(25000) 1 1 0.0000 (0.0000) C>S Handshake ClientHello Version 3.0 cipher suites Unknown value 0x39 Unknown value 0x38 Unknown value 0x35 SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA SSL_RSA_WITH_3DES_EDE_CBC_SHA Unknown value 0x33 Unknown value 0x32 Unknown value 0x2f SSL_RSA_WITH_RC4_128_SHA SSL_RSA_WITH_RC4_128_MD5 SSL_DHE_RSA_WITH_DES_CBC_SHA SSL_DHE_DSS_WITH_DES_CBC_SHA SSL_RSA_WITH_DES_CBC_SHA SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA SSL_RSA_EXPORT_WITH_DES40_CBC_SHA SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5 SSL_RSA_EXPORT_WITH_RC4_40_MD5 compression methods unknown value NULL 1 2 0.0000 (0.0000) S>C Alert level fatal value handshake_failure 1 0.0000 (0.0000) S>C TCP RST Stunnel logging shows: 2009.10.26 10:37:25 LOG7[29959:1073879408]: xxx started 2009.10.26 10:37:25 LOG7[29959:1073879408]: FD 7 in non-blocking mode 2009.10.26 10:37:25 LOG5[29959:1073879408]: tfe accepted connection from 10.10.10.10:1250 2009.10.26 10:37:25 LOG7[29959:1073879408]: SSL state (accept): before/accept initialization 2009.10.26 10:37:25 LOG7[29959:1073879408]: SSL alert (write): fatal: handshake failure 2009.10.26 10:37:25 LOG3[29959:1073879408]: SSL_accept: 1408A09F: error:1408A09F:SSL routines:SSL3_GET_CLIENT_HELLO:length mismatch 2009.10.26 10:37:25 LOG5[29959:1073879408]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.10.26 10:37:25 LOG7[29959:1073879408]: xxx finished (-1 left) When i explicitly configure the Windows stunnel to use: sslVersion = SSLv2 or sslVersion = TLSv1 (see ssldump logging below) everything works fine. Is this a known bug or an undocumented feature? Ewald... New TCP connection #3: hans13.amc.nl(1367) <-> nada.amc.nl(25000) 3 1 0.0000 (0.0000) C>S Handshake ClientHello Version 3.1 resume [32]= b8 a1 d2 93 6a ae 4a 0d 49 04 cd 88 92 75 f1 6d d7 65 88 c3 01 51 bf eb d4 44 ce b7 fd 75 32 64 cipher suites Unknown value 0x39 Unknown value 0x38 Unknown value 0x35 TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA Unknown value 0x33 Unknown value 0x32 Unknown value 0x2f TLS_RSA_WITH_RC4_128_SHA TLS_RSA_WITH_RC4_128_MD5 TLS_DHE_RSA_WITH_DES_CBC_SHA TLS_DHE_DSS_WITH_DES_CBC_SHA TLS_RSA_WITH_DES_CBC_SHA TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA TLS_RSA_EXPORT_WITH_DES40_CBC_SHA TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 TLS_RSA_EXPORT_WITH_RC4_40_MD5 compression methods unknown value NULL 3 2 0.0000 (0.0000) S>C Handshake ServerHello Version 3.1 session_id[32]= b8 a1 d2 93 6a ae 4a 0d 49 04 cd 88 92 75 f1 6d d7 65 88 c3 01 51 bf eb d4 44 ce b7 fd 75 32 64 cipherSuite Unknown value 0x35 compressionMethod NULL etc...

2 1

Connections begin resetted
by Roman Medina-Heigl Hernandez 26 Oct '09

26 Oct '09

Hello, Till some recent time, I was using "socat" (http://www.dest-unreach.org/socat/) to create a SSL-wrapper (in a way similar to what "stunnel" does). I was using: === socat -ly -d -d openssl-listen:443,bind=X.X.X.X,fork,reuseaddr,cipher=HIGH:3DES:MD5,cert=server-cert.pem,key=server-key.pem,verify=0 tcp4:Y.Y.Y.Y:P === It was working pretty well, without interruptions, although it got some estability problems when passing 1-2 months (server apparently get stuck). So I decided to give a try to "stunnel". I switched to "stunnel" and problems arise... I'm experimenting *very* frequent connection cuts. If I examine daemon.log (I'm using Debian 5), I have: Oct 20 12:06:36 hetzner stunnel: LOG3[3677:3083029392]: SSL_read: 140EC071: error:140EC071:SSL routines:SSL2_READ_INTERNAL:bad mac decode Oct 20 12:06:36 hetzner stunnel: LOG5[3677:3083029392]: Connection reset: 315484 bytes sent to SSL, 50471 bytes sent to socket So it seems stunnel is closing the connection due to a "bad mac decode" error. My environment (client and server) have not changed, I only switched "the transport" (socat -> stunnel). Any idea why is it failing now? Moreover, if I switch back to socat, cuts disappear. Is stunnel buggy? Am I missing some config/tunning at the SSL/socket level? My current config is: roman@hetzner:~$ stunnel4 -sockets Socket option defaults: Option Accept Local Remote OS default SO_DEBUG -- -- -- 0 SO_DONTROUTE -- -- -- 0 SO_KEEPALIVE -- -- -- 0 SO_LINGER -- -- -- 0:0 SO_OOBINLINE -- -- -- 0 SO_RCVBUF -- -- -- 87380 SO_SNDBUF -- -- -- 16384 SO_RCVLOWAT -- -- -- 1 SO_SNDLOWAT -- -- -- 1 SO_RCVTIMEO -- -- -- 0:0 SO_SNDTIMEO -- -- -- 0:0 SO_REUSEADDR 1 -- -- 0 SO_BINDTODEVICE -- -- -- -- IP_TOS -- -- -- 0 IP_TTL -- -- -- 64 TCP_NODELAY -- -- -- 0 root@hetzner:~# stunnel4 -version stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel4.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none My stunnel.conf is very simple. Apart from cert setup, the tunnel is something like: === [tunelserv] accept = X.X.X:X:443 connect = X.X.X.X:P === Any idea? Thank you in advance. Cheers, -Roman

2 2

Re: [stunnel-users] multiple domain certificates
by Ludolf Holzheid 23 Oct '09

23 Oct '09

On Fri, 2009-10-23 15:04:14 -0400, Al Gonzalez wrote: > I apologize for a potentially silly question, but is there any way to > determine if my question made it to the user's group. I sent in a > question (I think last Friday), and other than a auto-reply to myself, I > don't know if anyone really received it. I'm in a bit of a pickle, and > could sure use some help. Thanks. If you are worried about your message may not make it to a mailing list, check the list archive at the URL given in the "List-Archive:" header included in the mails sent from the list server. In case of stunnel-users this is http://stunnel.mirt.net/pipermail/stunnel-users. And yes, your mail from October 20th can be found there. Regarding your problem, I'm afraid I can't help as I use stunnel for 'secure tunnels' only, i.e. I have stunnel on both ends of the connection and I don't have to care about the protocols tunneled through. Sorry, Ludolf. -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

multiple domain certificates
by Andrew Farmer 22 Oct '09

22 Oct '09

Does stunnel support multiple domain certificates? I am trying to get stunnel to work with multiple domains on a machine that can have only one IP address. (It is an amazon EC2 instance - they do not support multiple IPs per instance) It seems to me that the only way to get this to work is with a multiple domain certificate, which I believe is called a "Unified Communications Certificate". Does stunnel support these? Thank you so much, Andrew -- View this message in context: http://www.nabble.com/multiple-domain-certificates-tp25897355p25897355.html Sent from the Stunnel - Users mailing list archive at Nabble.com.

2 2

https problems over TLSv1
by Al Gonzalez 19 Oct '09

19 Oct '09

Thank you in advance for any assistance you can provide... I am trying to talk to a UHF radio (from a PC) over a secure channel, but having some difficulties. Please let me provide just a little background so you know why I’m doing what I’m doing. In the existing system, Internet Explorer (IE) is the client that talks to this radio. When the radio boots up, it sends a webpage over Ethernet to IE and (after the user login), a secure link is established, and the radio can be controlled from IE – the various webpages change as the user maneuvers through the various dropdowns, etc. We’ve been asked to automate this interface now for a production environment. The client is going to be replaced with a PC connected to a great deal of test equipment, and the server will now send XML instead of html to the client. The client is being developed in LabVIEW (from National Instruments) – this has made this task even more challenging. As all of this secure stuff is new to me, I spent many hours just trying to understand the problem(s) and the lingo. As LabVIEW has some limitations in this area, I found that Stunnel was my best option. Using TCP/IP and sending http to the radio (shown below), I’ve been able (in a non-secure mode, without Stunnel) to communicate and get the opening screen (html) to be returned to me (the XML server output is currently being developed) and displayed in a LabVIEW window. GET / HTTP/1.1 Host: 10.4.32.1 Connection: Keep-Alive Authorization: Basic YWRtaW46UgEkJHdvtmQx Credentials: admin:Password I downloaded the binary version of Stunnel.exe (version 4.27 with OpenSSL 0.9.8k dated Mar 2009), then modified the LabVIEW code to call (using a command line approach) Stunnel. In this way, I can’t provide any (dash) options, so it’s completely dependent on the stunnel.conf file. After a number of attempts, I was able to get the client to bind to the server (I think), but I see nothing being returned to me (no html). I must use TLSv1, and ciphers = DES-CBC3-SHA. I’ve seen examples on stunnel.org that show a great deal more handshaking information than I’m seeing, so I’m wondering if I’m missing some detail in my conf file. For example, my log file ends like this 2009.10.16 13:18:49 LOG7[4812:4776]: FD 208 in non-blocking mode 2009.10.16 13:18:49 LOG7[4812:4776]: SO_REUSEADDR option set on accept socket 2009.10.16 13:18:49 LOG7[4812:4776]: https bound to 10.4.1.8:443 But the example I mentioned goes on after the “https bound” and adds things like … 2009.08.04 12:15:55 LOG7[16648:22996]: proxy accepted FD=320 from 127.0.0.1:48086 2009.08.04 12:15:55 LOG7[16648:22996]: Creating a new thread 2009.08.04 12:15:55 LOG7[16648:22996]: New thread created 2009.08.04 12:15:55 LOG7[16648:8540]: proxy started 2009.08.04 12:15:55 LOG7[16648:8540]: FD 320 in non-blocking mode 2009.08.04 12:15:55 LOG7[16648:8540]: TCP_NODELAY option set on local socket 2009.08.04 12:15:55 LOG5[16648:8540]: proxy accepted connection from 127.0.0.1:48086 2009.08.04 12:15:55 LOG7[16648:8540]: FD 340 in non-blocking mode 2009.08.04 12:15:55 LOG7[16648:8540]: proxy connecting 89.149.253.125:8080 2009.08.04 12:15:55 LOG7[16648:8540]: connect_wait: waiting 10 seconds 2009.08.04 12:15:56 LOG7[16648:8540]: connect_wait: connected 2009.08.04 12:15:56 LOG5[16648:8540]: proxy connected remote server from 192.168.2.3:48088 2009.08.04 12:15:56 LOG7[16648:8540]: Remote FD=340 initialized 2009.08.04 12:15:56 LOG7[16648:8540]: TCP_NODELAY option set on remote socket 2009.08.04 12:15:56 LOG7[16648:8540]: SSL state (connect): before/connect initialization 2009.08.04 12:15:56 LOG7[16648:8540]: SSL state (connect): SSLv3 write client hello A 2009.08.04 12:15:56 LOG7[16648:8540]: SSL state (connect): SSLv3 read server hello A . . . 2009.08.04 12:15:57 LOG6[16648:8540]: SSL connected: new session negotiated 2009.08.04 12:15:57 LOG6[16648:8540]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 That make’s me think that I’m not quite there yet. I’ve attached my stunnel.conf, my log file, and the http request I’m making (above). I’m hoping you can find some flaws in my conf file that will get me closer. Other than receiving html, I’m not sure how to know that I truly have a secure connection. I’m thinking I should see a little more in my log file, but I’m not sure. The other thing I’m not sure about (as I’ve heard differing thoughts) is whether I have to Encrypt my http commands, or does stunnel take care of that somehow? If I have to encypt, how would I go about doing this? Also, (and I’m getting ahead of myself) do I have to open and close a session every time I want to talk, or do I somehow leave the channel open? I’ve read about Session Resumption, but I’m not sure if that is something I need to setup in the conf file, or if that can even be controlled by Stunnel. Al Gonzalez Principal Software Engineer Compass Call Programs Offensive Information Warfare Raytheon Company 260.429.4354 260.429.5829 fax Al_Gonzalez(a)raytheon.com

1 0