stunnel-users

3317 discussions

S-tunnel will not send TLS
by Jan Falk 13 Mar '20

13 Mar '20

Hi. Can someone tell me why Stunnel stops at wating 10s? Log: 2020.03.12 09:43:36 LOG6[main]: Initializing service [x3_x4_DICOM_BFT_client] 2020.03.12 09:43:36 LOG7[main]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2020.03.12 09:43:36 LOG7[main]: TLSv1.3 ciphersuites: TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256 2020.03.12 09:43:36 LOG7[main]: TLS options: 0x02100004 (+0x00000000, -0x00000000) 2020.03.12 09:43:36 LOG6[main]: Loading certificate from file: x1.dc.x2.se_201900604.pem 2020.03.12 09:43:36 LOG6[main]: Certificate loaded from file: x1.dc.x2.se_201900604.pem 2020.03.12 09:43:36 LOG6[main]: Loading private key from file: x1.dc.x2.se_201900604.pem 2020.03.12 09:43:36 LOG6[main]: Private key loaded from file: x1.dc.x2.se_201900604.pem 2020.03.12 09:43:36 LOG7[main]: Private key check succeeded 2020.03.12 09:43:36 LOG4[main]: Service [x3_x4_DICOM_BFT_client] uses "verifyChain" without subject checks 2020.03.12 09:43:36 LOG4[main]: Use "checkHost" or "checkIP" to restrict trusted certificates 2020.03.12 09:43:36 LOG5[main]: Configuration successful 2020.03.12 09:43:36 LOG7[main]: Binding service [x3_x4_HL7_BFT_client] 2020.03.12 09:43:36 LOG7[main]: Listening file descriptor created (FD=380) 2020.03.12 09:43:36 LOG7[main]: Setting accept socket options (FD=380) 2020.03.12 09:43:36 LOG7[main]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2020.03.12 09:43:36 LOG6[main]: Service [x3_x4_HL7_BFT_client] (FD=380) bound to 127.0.0.1:46161 2020.03.12 09:43:36 LOG7[main]: Binding service [x3_x4_DICOM_BFT_client] 2020.03.12 09:43:36 LOG7[main]: Listening file descriptor created (FD=492) 2020.03.12 09:43:36 LOG7[main]: Setting accept socket options (FD=492) 2020.03.12 09:43:36 LOG7[main]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2020.03.12 09:43:36 LOG6[main]: Service [x3_x4_DICOM_BFT_client] (FD=492) bound to 127.0.0.1:46162 2020.03.12 09:43:36 LOG7[cron]: Cron thread initialized 2020.03.12 09:43:36 LOG6[cron]: Executing cron jobs 2020.03.12 09:43:36 LOG6[cron]: Cron jobs completed in 0 seconds 2020.03.12 09:43:36 LOG7[cron]: Waiting 86400 seconds 2020.03.12 09:44:37 LOG7[main]: Found 1 ready file descriptor(s) 2020.03.12 09:44:37 LOG7[main]: FD=380 ifds=r-x ofds=r-- 2020.03.12 09:44:37 LOG7[main]: FD=388 ifds=r-x ofds=--- 2020.03.12 09:44:37 LOG7[main]: Service [SOS_SYNGO_HL7_BFT_client] accepted (FD=508) from 127.0.0.1:50299 2020.03.12 09:44:37 LOG7[main]: Creating a new thread 2020.03.12 09:44:37 LOG7[main]: New thread created 2020.03.12 09:44:37 LOG7[0]: Service [x3_x4_HL7_BFT_client] started 2020.03.12 09:44:37 LOG7[0]: Setting local socket options (FD=508) 2020.03.12 09:44:37 LOG7[0]: Option TCP_NODELAY set on local socket 2020.03.12 09:44:37 LOG5[0]: Service [x3_x4_HL7_BFT_client] accepted connection from 127.0.0.1:50299 2020.03.12 09:44:37 LOG6[0]: s_connect: connecting 10.67.6.106:6161 2020.03.12 09:44:37 LOG7[0]: s_connect: s_poll_wait 10.67.6.106:6161: waiting 10 seconds Thanks in advance //Janne

2 5

Re: [stunnel-users] stunnel-users Digest, Vol 188, Issue 4
by Brent Kimberley 11 Mar '20

11 Mar '20

Hi Kelly. >>Connect = 127.0.0.1:1194? ?#<- this line won't work; but if I replace with 1.2.3.4:1194 then it will work! Generic: The following layers maybe helpful: Cost / People / Process / Infrastructure / Application / Data / Interface ... Specific: Data layer (metadata &/| configuration): Can you please verify that 127.0.01:1194 is present? e.g. netstat -ano | egrep -e Proto -e Active -e 1194 Message: 1 Date: Tue, 10 Mar 2020 13:25:33 +0800 From: Kelly Trinh <kelly(a)trinhonline.com> To: "stunnel-users" <stunnel-users(a)stunnel.org> Subject: [stunnel-users] behaviour when using 127.0.0.1 in the 'connect' field Message-ID: <170c2e7c29d.e9c53ed9127299.5279211261811289922(a)trinhonline.com> Content-Type: text/plain; charset="utf-8" Hi all - just want to report a problem I solved recently but wanted to get some insights on what was causing the problem. About me - learnt some unix at university (20 years ago) but nothing too serious.? Recently (1 month ago) acquired own domain name and now poking around the cloud computing / VPS thing. Project - hand-rolling my own VPN setup on a Ubuntu 18.04 VPS.? OpenVPN is easy since it is a git-clone thing and then just follow the openvpn-install script.? I wanted to add on the Stunnel wrapper because intended to use the VPN in China and apparently their firewall does deep packet inspection and can recognize (and block) openvpn traffic. Problem - when I set up my stunnel using 127.0.0.1 as the connect destination; it doesn't seem to work (I can see from openvpn window that things seem to pipe through stunnel but then immediately the connection is terminated).? If I replace the 127.0.0.1 with IP of the box I am using (say for example 1.2.3.4); everything works!? The FQDN is ok as well; as long as I don't use 127.0.0.1 Specifically the stunnel.conf: [OpenVPN] Accept = 443? # clients connect through 443 to further avoid potential blocking Connect = 127.0.0.1:1194? ?#<- this line won't work; but if I replace with 1.2.3.4:1194 then it will work! Question - My problem is fixed but I am curious if there is any insights on why this is happening given that 1.2.3.4 and 127.0.0.1 are the same machine?

1 0

behaviour when using 127.0.0.1 in the 'connect' field
by Kelly Trinh 10 Mar '20

10 Mar '20

Hi all - just want to report a problem I solved recently but wanted to get some insights on what was causing the problem. About me - learnt some unix at university (20 years ago) but nothing too serious. Recently (1 month ago) acquired own domain name and now poking around the cloud computing / VPS thing. Project - hand-rolling my own VPN setup on a Ubuntu 18.04 VPS. OpenVPN is easy since it is a git-clone thing and then just follow the openvpn-install script. I wanted to add on the Stunnel wrapper because intended to use the VPN in China and apparently their firewall does deep packet inspection and can recognize (and block) openvpn traffic. Problem - when I set up my stunnel using 127.0.0.1 as the connect destination; it doesn't seem to work (I can see from openvpn window that things seem to pipe through stunnel but then immediately the connection is terminated). If I replace the 127.0.0.1 with IP of the box I am using (say for example 1.2.3.4); everything works! The FQDN is ok as well; as long as I don't use 127.0.0.1 Specifically the stunnel.conf: [OpenVPN] Accept = 443 # clients connect through 443 to further avoid potential blocking Connect = 127.0.0.1:1194 #<- this line won't work; but if I replace with 1.2.3.4:1194 then it will work! Question - My problem is fixed but I am curious if there is any insights on why this is happening given that 1.2.3.4 and 127.0.0.1 are the same machine?

3 3

Re: [stunnel-users] (no subject)
by flash＠vicsmba.com 06 Mar '20

06 Mar '20

This can be O/S dependent – some O/S have limits on file descriptors, pipes, etc. I would check that. Second, broken pipes happen when one side closes when there is still action. In Unix C it is easy to do – if you use a piped open but you only want to get the first line of data so your read from the pipe and close … you get a broken pipe every time. This is harmless if that is what you want. Death if not. You might check your Oracle code for premature closing as I doubt it is stunnel. Can you trap the error and resume and see if it works? It well could. Essentially what I am saying is this is not directly a stunnel problem, more likely it is an implementation error. Which could be in the Oracle code as I have had problems with it in the past. More information on the O/S and the Oracle code would help. Eric VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) <http://www.vicsmba.com/> http://www.vicsmba.com <https://www.facebook.com/groups/286143052248115> https://www.facebook.com/groups/286143052248115 From: stunnel-users <stunnel-users-bounces(a)stunnel.org> On Behalf Of Jose Alf. Sent: Wednesday, March 4, 2020 11:09 AM To: stunnel-users(a)stunnel.org; simona vittori <svittori(a)gmail.com> Subject: Re: [stunnel-users] (no subject) Simona, You are not giving enough information for anyone in this list to help you. Please review and apply How To Ask Questions The Smart Way <http://catb.org/~esr/faqs/smart-questions.html> How To Ask Questions The Smart Way and/or How to Report Bugs Effectively <https://www.chiark.greenend.org.uk/~sgtatham/bugs.html> How to Report Bugs Effectively Regards, Jose On Wednesday, March 4, 2020, 4:22:26 AM GMT-5, simona vittori <svittori(a)gmail.com <mailto:[email protected]> > wrote: Hello, I have an encrypted connection through stunnel between client and db server, but in connection I have the following errors: "IO Error: Broken pipe (Write failed) at oracle.jdbc.driver.T4CPreparedStatement.executeForDescribe(T4CPreparedStatement.java:874)" Could you help me, please? Thank you in advance Simona _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org <mailto:[email protected]> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 188, Issue 1
by Brent Kimberley 05 Mar '20

05 Mar '20

You might need to review the documentation for your thin driver. https://www.oracle.com/database/technologies/appdev/jdbc-ucp-19c-downloads.… On Wednesday, March 4, 2020, 6:00:07 a.m. EST, stunnel-users-request(a)stunnel.org <stunnel-users-request(a)stunnel.org> wrote: Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. (no subject) (simona vittori) ---------------------------------------------------------------------- Message: 1 Date: Wed, 4 Mar 2020 10:21:56 +0100 From: simona vittori <svittori(a)gmail.com> To: stunnel-users(a)stunnel.org Subject: [stunnel-users] (no subject) Message-ID: <CAMt_Qybr5aASRw-NokkhiQhe0dALW8kPEV+zCjU_dB7tz=FcYA(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" Hello, I have an encrypted connection through stunnel between client and db server, but in connection I have the following errors: "IO Error: Broken pipe (Write failed) at oracle.jdbc.driver.T4CPreparedStatement.executeForDescribe(T4CPreparedStatement.java:874)" Could you help me, please? Thank you in advance Simona

1 0

(no subject)
by simona vittori 04 Mar '20

04 Mar '20

Hello, I have an encrypted connection through stunnel between client and db server, but in connection I have the following errors: "IO Error: Broken pipe (Write failed) at oracle.jdbc.driver.T4CPreparedStatement.executeForDescribe(T4CPreparedStatement.java:874)" Could you help me, please? Thank you in advance Simona

3 2

Windows Server 2003 issues with stunnel, TLS 1.2 on website(s)
by Sean Kelley 27 Feb '20

27 Feb '20

*Issue:* Old Windows Server cannot be upgraded, but needs TLS 1.2 encryption. Stunnel looks like a solution, but I'm having issues configuring it to work (It is "running" successfully with a pem file and port 442). In IIS Manager btw, the website SSL Port is set to 443. I've tried searching (i.e. google "site: https://www.stunnel.org/pipermail/stunnel-users/ server 2003") and have found a few leads, but nothing that addresses my issues in a way I understand. My ignorance I'm sure. *Server details:* * Windows Server 2003, Standard Edition, Service Pack 2 * IIS web server running 3 websites (ASP, PHP mix) * Valid Certificates from Lets Encrypt in Certificate Store * stunnel 5.49 (latest version I could find that works on 32bit OS's) sorry it's not the latest :( *Working Log with Port 442:* 2020.02.24 15:24:37 LOG7[main]: Running on Windows 5.2 2020.02.24 15:24:37 LOG7[main]: No limit detected for the number of clients 2020.02.24 15:24:37 LOG5[main]: stunnel 5.49 on x86-pc-msvc-1500 platform 2020.02.24 15:24:37 LOG5[main]: Compiled/running with OpenSSL 1.0.2p-fips 14 Aug 2018 2020.02.24 15:24:37 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2020.02.24 15:24:37 LOG7[main]: errno: (*_errno()) 2020.02.24 15:24:37 LOG7[ui]: GUI message loop initialized 2020.02.24 15:24:37 LOG7[main]: Running on Windows 5.2 2020.02.24 15:24:37 LOG5[main]: Reading configuration from file stunnel.conf 2020.02.24 15:24:37 LOG5[main]: UTF-8 byte order mark detected 2020.02.24 15:24:37 LOG5[main]: FIPS mode disabled 2020.02.24 15:24:37 LOG7[main]: Compression disabled 2020.02.24 15:24:37 LOG7[main]: No PRNG seeding was required 2020.02.24 15:24:37 LOG6[main]: Initializing service [https] 2020.02.24 15:24:37 LOG7[main]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2020.02.24 15:24:37 LOG7[main]: TLS options: 0x03004004 (+0x00004000, -0x00000000) 2020.02.24 15:24:37 LOG6[main]: Loading certificate from file: C:\Program Files\stunnel\config\mywebsite.pem 2020.02.24 15:24:37 LOG6[main]: Certificate loaded from file: C:\Program Files\stunnel\config\mywebsite.pem 2020.02.24 15:24:37 LOG6[main]: Loading private key from file: C:\Program Files\stunnel\config\mywebsite.pem 2020.02.24 15:24:37 LOG6[main]: Private key loaded from file: C:\Program Files\stunnel\config\mywebsite.pem 2020.02.24 15:24:37 LOG7[main]: Private key check succeeded 2020.02.24 15:24:37 LOG7[main]: ECDH initialization 2020.02.24 15:24:37 LOG7[main]: ECDH initialized with curve prime256v1 2020.02.24 15:24:37 LOG6[main]: Initializing service [domain] 2020.02.24 15:24:37 LOG7[main]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2020.02.24 15:24:37 LOG7[main]: TLS options: 0x03014004 (+0x00014000, -0x00000000) 2020.02.24 15:24:37 LOG6[main]: Loading certificate from file: C:\Program Files\stunnel\config\mywebsite.pem 2020.02.24 15:24:37 LOG6[main]: Certificate loaded from file: C:\Program Files\stunnel\config\mywebsite.pem 2020.02.24 15:24:37 LOG6[main]: Loading private key from file: C:\Program Files\stunnel\config\mywebsite.pem 2020.02.24 15:24:37 LOG6[main]: Private key loaded from file: C:\Program Files\stunnel\config\mywebsite.pem 2020.02.24 15:24:37 LOG7[main]: Private key check succeeded 2020.02.24 15:24:37 LOG7[main]: ECDH initialization 2020.02.24 15:24:37 LOG7[main]: ECDH initialized with curve prime256v1 2020.02.24 15:24:37 LOG5[main]: Configuration successful 2020.02.24 15:24:37 LOG7[main]: Binding service [https] 2020.02.24 15:24:37 LOG7[main]: Listening file descriptor created (FD=292) 2020.02.24 15:24:38 LOG7[main]: Setting accept socket options (FD=292) 2020.02.24 15:24:38 LOG6[main]: Service [https] (FD=292) bound to 10.0.1.11:442 2020.02.24 15:24:38 LOG7[main]: Skipped SNI slave service [domain] 2020.02.24 15:24:38 LOG7[cron]: Cron thread initialized 2020.02.24 15:25:38 LOG6[cron]: Executing cron jobs 2020.02.24 15:25:38 LOG6[cron]: Cron jobs completed in 0 seconds 2020.02.24 15:25:38 LOG7[cron]: Waiting 86400 seconds *Log Error with port 443:* Binding service [https] to 10.0.1.11:443: Permission denied (WSAEACCES) (10013)* * *Conf:* ; Debugging stuff (may be useful for troubleshooting) debug = 7 ;output = stunnel.log ; TLS front-end to a web server [https] ; doesn't work with 443 below, works with 442 accept = 10.0.1.11:442 connect = 80 cert = C:\Program Files\stunnel\config\mywebsite.pem ; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SChannel ; Microsoft implementations do not use TLS close-notify alert and thus they ; are vulnerable to truncation attacks TIMEOUTclose = 0 [domain] sni = https:mywebsite.com sni = https:www.mywebsite.com cert = C:\Program Files\stunnel\config\mywebsite.pem ; connect = 80 connect = localhost:80 client = no sslVersion = TLSv1.2 -------------- Thanks, Sean

3 3

TLS connection not successful
by maktoob bareed 25 Feb '20

25 Feb '20

Hi I am trying to make TLS connection with a server that supports TLSv1.2. but each time I receive the following error: SSL_connect: ssl/record/ssl3_record.c:331: error:1408F10B:SSL routines:ssl3_get_record:wrong version number Here is my service configuration: sslVersion = TLSv1.2 options = NO_SSLv2 options = -NO_SSLv3 accept = 5512 connect = XXXXXXXXX client = yes

1 0

How to use SNI
by Paul Coshott 17 Feb '20

17 Feb '20

Hi Everyone, I have a single domain on my internet server, but it has 3 sub-domains. A separate web app runs off each one, but I need all 3 to be secured with https. I have the ssl certificates I need, but I don't know how to format the SNI section for all 3 sub-domains. The 3 domains and ports I need are : app1.pcapps.one:449 -> 127.0.0.1:8080 app2.pcapps.one:450 -> 127.0.0.1:81 app3.pcapps.one:451 -> 127.0.0.1:82 each domain has a certificate such as : cert = C:\httpscert\app1.pcapps.one.pfx Can anyone tell me how to write out the SNI section to get this working? Thanks, Paul

2 1

HTTP 404 if I don't add 127.0.0.1 in my /etc/hosts
by Masih Tavassoli 16 Feb '20

16 Feb '20

Hi Experts: I am trying to do http->https proxy for one site only: [example-proxy] client = yes accept = 127.0.0.1:5000 sni =integration-instance-idqxdofnz0ca-ia.integration.ocp.oraclecloud.com checkHost = integration-instance-idqxdofnz0ca-ia.integration.ocp.oraclecloud.com verifyPeer = yes verifyChain = yes connect = 147.154.19.235:443 CAfile = C:\Program Files (x86)\stunnel\config\ca-certs.pem If I add the following in /etc/hosts all works ok 127.0.0.1 integration-instance-idqxdofnz0ca-ia.integration.ocp.oraclecloud.com And then I have to use http://integration-instance-idqxdofnz0ca-ia.integration.ocp.oraclecloud.com… However, I just want this address to work: http://10.0.0.33:5000/ic/ws/integration/v1/flows/soap/SM_INT10_CREAT_EBS_GT… : isn’t the whole point of setting SNI to send servername on your behalf: 2020.02.15 00:46:59 LOG6[46]: SNI: sending servername: integration-instance-idqxdofnz0ca-ia.integration.ocp.oraclecloud.com 2020.02.15 00:46:59 LOG6[46]: Peer certificate required 2020.02.15 00:46:59 LOG7[46]: TLS state (connect): before SSL initialization 2020.02.15 00:46:59 LOG7[46]: TLS state (connect): SSLv3/TLS write client hello 2020.02.15 00:46:59 LOG7[46]: TLS state (connect): SSLv3/TLS write client hello 2020.02.15 00:46:59 LOG7[46]: TLS state (connect): SSLv3/TLS read server hello 2020.02.15 00:46:59 LOG7[46]: TLS state (connect): SSLv3/TLS read change cipher spec 2020.02.15 00:46:59 LOG7[46]: TLS state (connect): SSLv3/TLS read finished 2020.02.15 00:46:59 LOG7[46]: TLS state (connect): SSLv3/TLS write change cipher spec 2020.02.15 00:46:59 LOG7[46]: TLS state (connect): SSLv3/TLS write finished 2020.02.15 00:46:59 LOG7[46]: 3 client connect(s) requested 2020.02.15 00:46:59 LOG7[46]: 3 client connect(s) succeeded 2020.02.15 00:46:59 LOG7[46]: 0 client renegotiation(s) requested 2020.02.15 00:46:59 LOG7[46]: 2 session reuse(s) 2020.02.15 00:46:59 LOG6[46]: TLS connected: previous session reused 2020.02.15 00:46:59 LOG6[46]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2020.02.15 00:46:59 LOG7[46]: Compression: null, expansion: null 2020.02.15 00:46:59 LOG6[46]: Session id: E003BBF100FA809D616B2F69E08BAF0119EA856FCEE6AD209BE95F7C5815380B 2020.02.15 00:48:05 LOG7[46]: TLS alert (read): warning: close notify 2020.02.15 00:48:05 LOG6[46]: TLS closed (SSL_read) What am I missing? Thanks Masi

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users