- stunnel-users - stunnel.org

stunnel 5.31 released
by Michal Trojnara 01 Mar '16

01 Mar '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear Users, I have released version 5.31 of stunnel. The ChangeLog entry: Version 5.31, 2016.03.01, urgency: HIGH * Security bugfixes - OpenSSL DLLs updated to version 1.0.2g. https://www.openssl.org/news/secadv_20160301.txt * New features - Added logging the list of client CAs requested by the server. - Improved compatibility with the current OpenSSL 1.1.0-dev tree. * Bugfixes - Only reset the watchdog if some data was actually transferred. - A workaround implemented for the unexpected exceptfds set by select() on WinCE 6.0 (thx to Richard Kraemer). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: a746b71ab3dc6c23eacb0daf7342467870e43ac933430905eb1b1d050bbae0b7 stunnel-5.31.tar.gz c662fc1254f22ce5ac3f6e09bf643b3a0a99a884b6414f55cc8ab22d7c680fd5 stunnel-5.31-installer.exe f14d7c9cf23a25bdcef8480f9d35c66233bb9e64f82098f1867edf4b038b41c4 stunnel-5.31-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJW1cIFAAoJEC78f/DUFuAU998P/1LpUY+B/Q4E7XWCctK1XspG zcFi8U5UhaMek9eTPlY0mJWUGihX4qQOeQi+9MV9LqvzLLfWbgMzWSv/rAiWxCzx NbHw7yASK5+xfnGBGoSenvdbvmL6s4RPxM0Qf3lrVj9kpha75JS9aHPnDhq90aLG YXle0uTj/dvDC3aG2UY0TYFQMvvubrx87JyoiTbf9i2f6q85iM76DaeP15mMZSXZ eq+9bP37OVG6RDFrlFSoSSHxOWHA5ebftwvf4MjedrziXld6pzYSzwIJ7eJhZO7Y ob+hRO3D86chiGfynYj1WWws51Q+TE4hg2NQ7vWPEi7HuN+/62CMZg3q1h/LAIT+ 2qzjVFIoVwwl8B3RZ94aJ8AzsFnhWOp5AZJ7nOBFbF69cRAuIT6DQL+GwcJoB+RJ +sxlJAyhu+3/RuAPbZYXzSzr7Lsp4/fhWIxVRW5rBqHSJCBZU+QqSOTu9GP06F9i 7FaUq9p7RxajVjtqn+QmzDpVTgBymkYvc3F1+ATSUZZNLU8KPWG+aYTtSYKKEDQS VBtQJ3BRR0Ne/TqBXStdK3PdG8t8r7hoYhPSAE1IX59F0/4MaKHcAoyDEAH5aKQx rK1Iowb5DUNF/Rcota3CXzLFBfp/ePmZFbjpQd9YcGtMXnMGFk9/Lnc+8If+vHGk p66Kx7ZYLNzkIPf0y8wn =WkNw -----END PGP SIGNATURE-----

1 0

How to build Stunnel on x64 Windows by VC with right alignment memory allocation functions
by zuz666＠gmail.com 28 Feb '16

28 Feb '16

Hello! I need to compile stunnel using VC for Windows x64 platform. I know that I can use MinGW/gcc and it will work, but VC used to build all other libraries and I want to simplify assembly process. I am try build stunnel by VC for Windows x64 platform and it builds fine but after start, stunnel crashed in VC runtime after calling setjmp function in client.c : /* try to process the request */ err=setjmp(c->err); I did some researches of the reason of a problem and found the following comment in prototypes.h: jmp_buf err; /* exception handler needs to be 16-byte aligned on Itanium */ The memory for CLI struct allocated by str_alloc_detached function (jmp_buf uded in definition CLI struct), but jmp_buf for AMD64/x64 must be 16-byte aligned to save state of SSE registers. Function calloc used for memory allocation in str_alloc_detached function and sometimes it return pointers not aligned to 16-byte boundary what causes a problem. I create dummy patch to workaround the problem but am think the best solution in that case is to use malloc instead calloc function (as described in some articles it’s always 16-byte aligned on AMD64 VC builds). Can you suggest some solutions to this problem? prototypes.h @@ -404,6 +404,10 @@ typedef struct { uint64_t sock_bytes, ssl_bytes; /* bytes written to socket and SSL */ s_poll_set *fds; /* file descriptors */ uintptr_t redirect; /* redirect to another destination after failed auth */ + /* New member added by Zuz to work around setjmp alignment issues */ +#if defined(_MSC_VER) && defined(_WIN64) + void *cli_struct_free_ptr; /* Ptr to unaligned address for this struct */ +#endif } CLI; client.c @@ -76,8 +76,14 @@ NOEXPORT void reset(SOCKET, char *); CLI *alloc_client_session(SERVICE_OPTIONS *opt, SOCKET rfd, SOCKET wfd) { static unsigned long long seq=0; CLI *c; - +#if defined(_MSC_VER) && defined(_WIN64) + #define CLI_STRUCT_ALIGNMENT 15 + void *cli_ptr_unaligned = str_alloc_detached(sizeof(CLI) + CLI_STRUCT_ALIGNMENT); + c = (CLI *)(((uintptr_t)cli_ptr_unaligned+CLI_STRUCT_ALIGNMENT) & ~ (uintptr_t)0x0F); + c->cli_struct_free_ptr = cli_ptr_unaligned; +#else c=str_alloc_detached(sizeof(CLI)); +#endif c->opt=opt; c->local_rfd.fd=rfd; c->local_wfd.fd=wfd; @@ -117,7 +123,13 @@ void client_main(CLI *c) { * -> spawn a local program instead of stdio */ for(;;) { SERVICE_OPTIONS *opt=c->opt; +#if defined(_MSC_VER) && defined(_WIN64) + void *cli_ptr_unaligned = c->cli_struct_free_ptr; +#endif memset(c, 0, sizeof(CLI)); /* connect_local needs clean c */ +#if defined(_MSC_VER) && defined(_WIN64) + c->cli_struct_free_ptr = cli_ptr_unaligned; +#endif c->opt=opt; if(!setjmp(c->err)) c->local_rfd.fd=c->local_wfd.fd=connect_local(c); @@ -136,7 +148,11 @@ void client_main(CLI *c) { } } else client_run(c); - str_free(c); +#if defined(_MSC_VER) && defined(_WIN64) + str_free(c->cli_struct_free_ptr); +#else + str_free(c); +#endif } #ifdef __GNUC__ -- Yuris W. Auzins

1 0

Forthcoming stunnel release
by Michal Trojnara 27 Feb '16

27 Feb '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear Users, A quick heads-up before the stunnel 5.31 release scheduled for 01 March 2016. The intended change log entry is: Version 5.31, 2016.03.01, urgency: HIGH * Security bugfixes - OpenSSL DLLs updated to version 1.0.2g. https://www.openssl.org/news/secadv_20160301.txt * New features - Added logging the list of client CAs requested by the server. - Improved compatibility with the current OpenSSL 1.1.0-dev tree. * Bugfixes - Only reset the watchdog if some data was actually transferred. - A workaround implemented for the unexpected exceptfds set by select() on WinCE 6.0 (thx to Richard Kraemer). Feel free download the latest beta from https://www.stunnel.org/downloads.html and report any issues. Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJW0IYYAAoJEC78f/DUFuAUCw4P/20m8FSJcnyls4TIDbn4pbmi ZGTneC1qBt4y/lAbQpQHaUQDmwhmSZ10h1jwIf7IRNWGGiy4oPuFofY8Ee64uwvs +PKI9ZTsXlL9K7gkfusfhGrw2xnmx2j9fiw/bcby+qxTh6qkR7xGAR7kdFGba6iI KLPi/AfsP/lR8BDxKIwIzcE+REOAk4Fzn9cU2HqOlwZOVuBm9k0udsuqtbl4aUO1 35fhYpNaCzMEsYFxQrF7rgUfQzD5m/8LAMk3mvBa8ByGCbSLBenETSOb++xaND92 wjL0Nv4+HDlP/XY0HfLMqhexoG5XCL1fu3cAuTPVf7PT34EGWLtickExY1w1TVKY DsND1YpCffN20ZjYksKj6IBb/dG/72Yz1MzNgbvd/x4l4PJv1O5BJQWQQ4y58+Gg b8sL4LBXXINgQdNptGSJfoQFRA1NtaNKTyOzEbeN+rcSnCcWZXnRVh5nR7rd8C14 A5EofhK0op18uyMuwTbTp1VlEvMNSW5ZGsxa0itaXHaCcF0uF/bbn/JiKYQh/TUo kOxvVu8KOmwoixw5jgGvnBnKfQSA/G7S/fcJ2WlQzBIQJFHyU159bIeTTORWCrIR /yYe/PJYgufCXmKQW7SkNOtcQggRi4IuM87+nxoFLE6u/7GxmFgN2y2kWsmc71Ev sQqDi9BBv7Kag3a7ozif =z3hT -----END PGP SIGNATURE-----

2 1

Version 4.29: First connection fails with "Unexpected socket close (read_blocking)"
by Matthew 26 Feb '16

26 Feb '16

Hi, I am experiencing an issue with version 4.29, which is the version available on yum for centos6. I am getting the following error: "Unexpected socket close (read_blocking)". This error only occurs once per stunnel instance upon the first connection only. More recent versions of stunnel do not have this problem, but I am hoping to work around this issue on the default version for this OS. My hosts.allow and hosts.deny files are both empty. I have tried adding my services to hosts.allow, but it did not have any noticeble effect. This is the version that I am using (installed with "yum install stunnel"): $ stunnel -version stunnel 4.29 on x86_64-redhat-linux-gnu with OpenSSL 1.0.1e-fips 11 Feb 2013 Threading:PTHREAD SSL:ENGINE,FIPS Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = FIPS key = /etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = TLSv1 TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none This is what my demonstration setup looks like: nc_client --TCP--> stunnel_client (2000) --SSL--> stunnel_server (2100) --TCP--> nc_server (2200) Steps to reproduce: (1) Start the netcat TCP server. $ nc -l 2200 (2) Leave the server open and open a new terminal for the rest of the commands. (3) Create “client_config.txt” with the following contents: pid = /tmp/client_stunnel.pid debug = 7 output = /tmp/client_stunnel.log client = yes ciphers = ALL fips = no foreground = no [CLIENT_PROXY_0] accept = 0.0.0.0:2000 connect = 127.0.0.1:2100 (4) Create “server_config.txt” with the following contents: pid = /tmp/server_stunnel.pid debug = 7 output = /tmp/server_stunnel.log client = no ciphers = ALL fips = no cert = /tmp/server_stunnel.pem foreground = no [SVR_PROXY_0] accept = 0.0.0.0:2100 connect = 127.0.0.1:2200 (4) Start the stunnel client: $ cat client_config.txt | stunnel -fd 0 (5) Start the stunnel server: $ cat server_config.txt | stunnel -fd 0 (6) Send three sequential messages through stunnel to the netcat server: $ echo "Test 1" | nc 127.0.0.1 2000 $ echo "Test 2" | nc 127.0.0.1 2000 $ echo "Test 3" | nc 127.0.0.1 2000 (7) You should see only “Test 3” appear at the netcat server. “Test 1” will have failed to pass from the stunnel client to the stunnel server and the log will report an "Unexpected socket close (read_blocking)” error. “Test 2” is not the first connection for the stunnel client, so it will pass through to the stunnel server successfully. But because it is the first connection for the stunnel server, it will fail there with the same error. “Test 3” is not the first connection for either the stunnel client or stunnel server, so it will make it through successfully to the netcat server. All subsequent connections will work. Basically my question is: Is there any way to make this setup work on the first connection with version 4.29, or is a new version necessary? Thanks, Matthew

1 0

How to use stunnel as a HTTPS to HTTPS reverse proxy
by Claudio Beretta 26 Feb '16

26 Feb '16

I'd like Stunnel to act as a reverse proxy that accepts TLS 1.0 and TLS 1.2 for https://example.com and then forwards the traffic to https://example.net, another web server that only accepts TLS 1.2 browser --TLS 1.0 or 1.2--> Stunnel --TLS 1.2--> Web App The browser should have no idea that example.net even exists (only example.com certificate will be presented to the browser). Is this something Stunnel can do? This is what I got so far: cert = example.com.pem ;stunnel.pem [proxy1] client = yes accept = 10.100.4.179:443 connect = localhost:54323 CAfile = sca.server1.crt.pem ;verify = 2 [proxy2] client = no accept = localhost:54323 connect = example.net:443 ;CAfile = SymantecClass3EVSSLCA-G3.pem example.com.pem contains the public and decrypted private key for example.com sca.server1.crt.pem contains the intermediate and root certificates of the CA that issues the example.com.pem certificate It partially works: the browser shows example.com in the address bad and the content of example.net, but the certificate that is returned is from example.net What am I doing wrong? Or do you have other recommendations to get something like this working on Windows Server 2008 R2? (IIS + Application Request Routing + URL Rewrite won't work: TLS1.2 is not properly supported) Thank you Claudio

3 4

Usint Stunnel in combination with tinyproxy and PSK
by Christoph Malin 26 Feb '16

26 Feb '16

Hello, I have tinyproxy running on my server. Now I would like to add stunnel with a pres shared key (username, password combination). Is it possible to use this combination as a Proxy on my normal web browser e.g. firefox? So that stunnel ist only used on server side? greetings Christoph

1 0

User-agent string
by Josh Rabinowitz 22 Feb '16

22 Feb '16

Is there a way to force stunnel to use a specific user-agent string? I have mulled through documentation, this list, and other places with no results. The reason I ask, is the proxy I am going through is super strict, well not really. It will accept 'lynx' as a user-agent (among others), but it needs something. I cannot figure out how to tell stunnel to use something like this. 5.30 on both ends, here is debug 7 from the client (IPs changed for privacy) after a config reload and ssh attempt: 2016.02.22 09:22:08 LOG5[main]: Reading configuration from file stunnel.conf 2016.02.22 09:22:08 LOG5[main]: UTF-8 byte order mark not detected 2016.02.22 09:22:08 LOG5[main]: FIPS mode disabled 2016.02.22 09:22:08 LOG5[main]: Configuration successful 2016.02.22 09:22:15 LOG7[4]: Service [ssh] started 2016.02.22 09:22:15 LOG5[4]: Service [ssh] accepted connection from 127.0.0.1:56690 2016.02.22 09:22:15 LOG6[4]: failover: round-robin, starting at entry #1 2016.02.22 09:22:15 LOG6[4]: s_connect: connecting [webproxyIP]:8080 2016.02.22 09:22:15 LOG7[4]: s_connect: s_poll_wait [webproxyIP]:8080: waiting 10 seconds 2016.02.22 09:22:15 LOG5[4]: s_connect: connected [webproxyIP]:8080 2016.02.22 09:22:15 LOG5[4]: Service [ssh] connected remote server from [clientIP]:56691 2016.02.22 09:22:15 LOG7[4]: Remote descriptor (FD=844) initialized 2016.02.22 09:22:15 LOG7[4]: -> CONNECT [remoteIP]:443 HTTP/1.1 2016.02.22 09:22:15 LOG7[4]: -> Host: [remoteIP]:443 2016.02.22 09:22:15 LOG7[4]: -> 2016.02.22 09:22:15 LOG7[4]: <- HTTP/1.1 403 Forbidden 2016.02.22 09:22:15 LOG3[4]: CONNECT request rejected 2016.02.22 09:22:15 LOG7[4]: <- Cache-Control: no-cache 2016.02.22 09:22:15 LOG7[4]: <- Pragma: no-cache 2016.02.22 09:22:15 LOG7[4]: <- Content-Type: text/html; charset=utf-8 2016.02.22 09:22:15 LOG7[4]: <- Proxy-Connection: close 2016.02.22 09:22:15 LOG7[4]: <- Connection: close 2016.02.22 09:22:15 LOG7[4]: <- Content-Length: 3164 2016.02.22 09:22:15 LOG7[4]: <- 2016.02.22 09:22:15 LOG5[4]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.02.22 09:22:15 LOG7[4]: Remote descriptor (FD=844) closed 2016.02.22 09:22:15 LOG7[4]: Local descriptor (FD=1116) closed 2016.02.22 09:22:15 LOG7[4]: Service [ssh] finished (0 left) client config: cert = stunnel.pem client = yes [ssh] accept = 127.0.0.1:2222 protocol= connect connect = [webproxyIP]:8080 protocolHost = [remoteIP]:443 PSKsecrets = psk1.txt debug = 7 Confirmed working from other hosts outside of this network. Thanks

1 0

Re: [stunnel-users] Using CAPI Engine for client authentication
by Michal Trojnara 22 Feb '16

22 Feb '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 21.02.2016 10:23, Shay Cohen wrote: > LOG6[10]: No client CA list It looks like your server does not request a client certificate. You may try connecting your service with MSIE, which natively uses client certificates from the Windows Certificate Store. If the server is configured correctly, MSIE should be able to establish TLS even if the service does not speak HTTPS. Just use https://1.2.3.4:9000/ Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWyslNAAoJEC78f/DUFuAUKowQALxsJAxHJsiglCmxlu7HevvI I7NE77SwJOh3rCQ7KrZ+HMlq36PpxzeiRmjkwstp2dMJ5KKu8+rzbGqvxcFQjKQG w3P7GE2sn3Kw1aakOj2sJBuzYTCM3mRpl4ARD10yiZv42leggWfhLHh3bU4eFmEn Mr7k2GM51uhjooDpYTY604wloxISC0m4FWcPl3elp0mDpDgYA1TehbsIsd0KxH13 poiCZGB44AuzX1As350fb3D31GLqQmZ9bCrgGY1OGepX14VeH304fFctCSqlrAa9 XGup/cmJy6URWZ26GUP7l3zOJtH5LRXEafbGPRfRKK2ZaDSt+NGCWypKA1pJ3XGK W1u6H8ggf6gER3z9Yvqemi8ukQ4C7zIt4vu10HYZ2hehxv7HpHL5Lkrj5lT+zGQQ nkOy4kckrAlk1RXTh2HO3DXlq5IHjh/8UrP/OhaRv7tb6tRVJ4I5L9Xl3kes9lJj BdgW5fS3E0F6iyJoWanviIUSjAAKT8mOhoxQhu3KvVL6Krm0J59hWTSCfdGjVwPY lMEIy2xLxUyEgDjO1r1XdPWsns5uq1wVz8BnQ6F6dgXrpOZwjUJ0DW4NZyK0m4pv +X9paNAOQaXOsSfMF8dHChL+UFuEIlCO0ILoISh3N+hJCyUJkPw8LK9Lr0cYRhif V8eUxUXA52BUqvGdzUHa =PZNb -----END PGP SIGNATURE-----

1 0

Using CAPI Engine for client authentication
by Shay Cohen 18 Feb '16

18 Feb '16

Hi, I am trying to configure one of my clients to use 'engine = capi', but cannot find a way to define which Key to actually use. debug = 7 does not show engine internal actions and engineCtrl = CAPI_CMD_DEBUG_LEVEL:2 gives an error, as well as engineCtrl = DEBUG_LEVEL:2 I'de appreciate any help with configuring this. Thanks in advance, Shay

2 2

Fw: new message
by mysql.jorge＠decimal.pt 09 Feb '16

09 Feb '16

Hey! Open message <http://sudarena.intelmedia.ro/back.php?5n11v> mysql.jorge(a)decimal.pt

1 0