- stunnel-users - stunnel.org

Delay before sending server hello
by Dan Price 28 Apr '11

28 Apr '11

I am using stunnel to accept TLS connections. I'm opening eight connections at virtually the same time, and occasionally see that for one of the connections, the handshake does not complete - stunnel does not send the server hello, and the client usually resets the connection. I did manage to capture one instance where stunnel sends the server hello, but it is delayed by over a minute. I upgraded to version 4.35, and I see the same behavior. I set debug=debug, and captured what I think are the relevant logs (through write server hello). I kept the logs for the successful connection (59924) that came in after the failed one (59923). Apr 27 13:21:22 cm stunnel: LOG7[10357:1431918272]: local socket: FD=15 allocated (non-blocking mode) Apr 27 13:21:22 cm stunnel: LOG7[10357:1431918272]: Service msrp accepted FD=15 from ::ffff:10.50.2.11:59923 Apr 27 13:21:22 cm stunnel: LOG7[10357:1431918272]: local socket: FD=16 allocated (non-blocking mode) Apr 27 13:21:22 cm stunnel: LOG7[10357:1431918272]: Service msrp accepted FD=16 from ::ffff:10.50.2.11:59924 Apr 27 13:21:22 cm stunnel: LOG7[10357:1431989136]: Service msrp started Apr 27 13:21:22 cm stunnel: LOG7[10357:1431989136]: Waiting for a libwrap process Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: Service msrp started Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: Waiting for a libwrap process Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: Acquired libwrap process #1 Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: Releasing libwrap process #1 Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: Released libwrap process #1 Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: Service msrp permitted by libwrap from ::ffff:10.50.2.11:59924 Apr 27 13:21:22 cm stunnel: LOG5[10357:1433471888]: Service msrp accepted connection from ::ffff:10.50.2.11:59924 Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: SSL state (accept): before/accept initialization Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: SSL state (accept): SSLv3 read client hello A Apr 27 13:21:22 cm stunnel: LOG7[10357:1433471888]: SSL state (accept): SSLv3 write server hello A Apr 27 13:22:38 cm stunnel: LOG7[10357:1431989136]: Acquired libwrap process #4 Apr 27 13:22:38 cm stunnel: LOG7[10357:1431989136]: Releasing libwrap process #4 Apr 27 13:22:38 cm stunnel: LOG7[10357:1431989136]: Released libwrap process #4 Apr 27 13:22:38 cm stunnel: LOG7[10357:1431989136]: Service msrp permitted by libwrap from ::ffff:10.50.2.11:59923 Apr 27 13:22:38 cm stunnel: LOG5[10357:1431989136]: Service msrp accepted connection from ::ffff:10.50.2.11:59923 Apr 27 13:22:38 cm stunnel: LOG7[10357:1431989136]: SSL state (accept): before/accept initialization Apr 27 13:22:38 cm stunnel: LOG7[10357:1431989136]: SSL state (accept): SSLv3 read client hello A Apr 27 13:22:38 cm stunnel: LOG7[10357:1431989136]: SSL state (accept): SSLv3 write server hello A Thanks, Dan

1 0

Does stunnel support startTLS?
by Markus Borst 28 Apr '11

28 Apr '11

Stunnel supports encryption in the "old" ssl style extra port configuration (i.e. imaps on port 993) where the encryption is negotiated immediately upon start of the connection. Does stunnel also support the startTLS method? i.e. a clear text connection is established (imap on port 143) and one of the first imap commands is startTLS, which negotiates the encryption and protects the connection from that time onwards. I know that supporting startTLS is a lot harder, since it means sniffing commands in the higher level protocol, but we need it nevertheless. (In fact, our imap server does support startTLS, but it does _not_ support importing an external certificate, which is why I'm looking for an external solution.) From reading the documentation I'm not sure whether stunnel supports startTLS, there are a few option descriptions which might point to startTLS, but I'm not sure. Anybody knows the definite answer? Greetings Markus Borst -- TU Darmstadt Hochschulrechenzentrum (HRZ) Markus Borst Adresse: Petersenstrasse 30, 64287 Darmstadt, Germany Tel.: 06151/16-2056 Email: M.Borst(a)hrz.tu-darmstadt.de

2 3

Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/accept initialization
by Jack Liu 27 Apr '11

27 Apr '11

Thx for continuing reply my msg, Yes, there is var/log/messages Inside there only has some iptables log, FTP, SMTP application log and nothing else. I am positive that this problem is not cause by iptables, becuase I tried with iptables off. Nothing else related to stunnel is found in that folder. Any other suggestions? Mr. Jack > From: sunyucong(a)gmail.com > Date: Mon, 25 Apr 2011 20:00:30 -0700 > Subject: Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/accept initialization > To: jackliu92(a)hotmail.com > CC: stunnel-users(a)stunnel.org > > I guess in centos that's /var/log/messages > but in general, you should probably check everything in /var/log to make sure. > > On Mon, Apr 25, 2011 at 5:38 PM, Jack Liu <jackliu92(a)hotmail.com> wrote: > > Thank you for helping, but both logs r not presented in my var/log/ dir. Any > > other suggestions? > > > > > > Mr. Jack > > > > > > > > > > > >> From: sunyucong(a)gmail.com > >> Date: Mon, 25 Apr 2011 16:25:20 -0700 > >> Subject: Re: [stunnel-users] Stunnel stuck at SSL state (accept): > >> before/accept initialization > >> To: jackliu92(a)hotmail.com > >> CC: stunnel-users(a)stunnel.org > >> > >> Are you sure that's entire log? check /var/log/daemons.log and > >> syslog.log as well. > >> > >> On Sun, Apr 24, 2011 at 1:30 AM, Jack Liu <jackliu92(a)hotmail.com> wrote: > >> > It anyone knows how to fix Stunnel stuck at SSL state (accept): > >> > before/accept initialization??? > >> > > >> > Here is the log: > >> > > >> > ----------------------------------------------------------------------------------------------------------- > >> > [root@vps1 ~]#stunnel /etc/stunnel/stunnel.conf > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Snagged 64 random bytes from > >> > /root/.rnd > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Wrote 1024 new random bytes > >> > to > >> > /root/.rnd > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: RAND_status claims > >> > sufficient > >> > entropy for the PRNG > >> > 2011.04.24 02:25:13 LOG6[32174:3085993680]: PRNG seeded successfully > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Certificate: > >> > /etc/stunnel/stunnel.pem > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Key file: > >> > /etc/stunnel/stunnel.pem > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Verify directory set to > >> > /etc/stunnel/CA > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: CRL directory set to > >> > /etc/stunnel/CRL > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: SSL context initialized for > >> > service 3proxy > >> > 2011.04.24 02:25:13 LOG5[32174:3085993680]: stunnel 4.15 on > >> > i686-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 > >> > 2011.04.24 02:25:13 LOG5[32174:3085993680]: Threading:PTHREAD SSL:ENGINE > >> > Sockets:POLL,IPv6 Auth:LIBWRAP > >> > 2011.04.24 02:25:13 LOG6[32174:3085993680]: file ulimit = 1024 (can be > >> > changed with 'ulimit -n') > >> > 2011.04.24 02:25:13 LOG6[32174:3085993680]: poll() used - no FD_SETSIZE > >> > limit for file descriptors > >> > 2011.04.24 02:25:13 LOG5[32174:3085993680]: 500 clients allowed > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 3 in non-blocking mode > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 4 in non-blocking mode > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 5 in non-blocking mode > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: SO_REUSEADDR option set on > >> > accept socket > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: 3proxy bound to > >> > 0.0.0.0:30001 > >> > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Created pid file > >> > /var/run/stunnel.pid > >> > 2011.04.24 02:25:20 LOG7[32174:3085993680]: 3proxy accepted FD=6 from > >> > xx.xxx.xxx.xx:41165 > >> > 2011.04.24 02:25:20 LOG7[32174:3085990800]: 3proxy started > >> > 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 6 in non-blocking mode > >> > 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 7 in non-blocking mode > >> > 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 8 in non-blocking mode > >> > 2011.04.24 02:25:20 LOG7[32174:3085993680]: Cleaning up the signal pipe > >> > 2011.04.24 02:25:20 LOG6[32174:3085993680]: Child process 32176 finished > >> > with code 0 > >> > 2011.04.24 02:25:20 LOG7[32174:3085990800]: Connection from > >> > xx.xxx.xxx.xx:41165 permitted by libwrap > >> > 2011.04.24 02:25:20 LOG5[32174:3085990800]: 3proxy connected from > >> > xx.xxx.xxx.xx:41165 > >> > 2011.04.24 02:25:20 LOG7[32174:3085990800]: SSL state (accept): > >> > before/accept initialization <-----------------------Stuck here > >> > forever!!! > >> > 2011.04.24 02:25:22 LOG3[32174:3085990800]: SSL_accept: Peer suddenly > >> > disconnected > >> > 2011.04.24 02:25:22 LOG5[32174:3085990800]: Connection reset: 0 bytes > >> > sent > >> > to SSL, 0 bytes sent to socket > >> > 2011.04.24 02:25:22 LOG7[32174:3085990800]: 3proxy finished (0 left) > >> > 2011.04.24 02:25:25 LOG3[32174:3085993680]: Received signal 2; > >> > terminating > >> > 2011.04.24 02:25:25 LOG7[32174:3085993680]: removing pid file > >> > /var/run/stunnel.pid > >> > [root@vps1 ~]# > >> > > >> > ----------------------------------------------------------------------------------------------------------- > >> > stunnel.conf: > >> > cert = /etc/stunnel/stunnel.pem > >> > key = /etc/stunnel/stunnel.pem > >> > CApath = /etc/stunnel/CA > >> > CRLpath = /etc/stunnel/CRL > >> > debug = 7 > >> > foreground = yes > >> > verify = 1 > >> > # > >> > [3proxy] > >> > accept = 30001 > >> > connect = 127.0.0.1:33135 > >> > > >> > ----------------------------------------------------------------------------------------------------------- > >> > > >> > I am hosting with CentOS 5.5, and installed Stunnel via yum. > >> > Planning to use it with 3Proxy. However I experience the problem above, > >> > can > >> > someone please help with that? > >> > Thank you very much! > >> > > >> > > >> > > >> > Mr. Jack > >> > > >> > _______________________________________________ > >> > stunnel-users mailing list > >> > stunnel-users(a)stunnel.org > >> > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > >> > > >> > > >

3 6

Patch to enhance verify=3 with SHA-1 check
by Philipp Hartwig 27 Apr '11

27 Apr '11

As indicated in a previous mail to this list I was surprised by the following behavior: With "verify=3" stunnel doesn't compare the peer's certificate with the locally installed certificate for actual equality but it only checks whether they have the same subject. The recent Comodo incident[1] has shown that it is not impossible to get a certificate which matches the subject of the certificate of some interesting server and is signed by a trusted CA. That's why I was interested in a stricter form of verification (at least in client mode). I have attached a small patch, derived from code in the file "mutt_ssl.c" of the Mutt[2] mail client, which adds a check for equality of SHA-1 hashes to the "verify=3" certificate check. I mainly wrote it for personal use but maybe someone else will find it useful or has some comments. Regards, Philipp [1] http://blog.mozilla.com/security/2011/03/25/comodo-certificate-issue-follow… [2] http://www.mutt.org/

1 0

Re: [stunnel-users] Réf. : Re: Need some informations about stunnel (AC,?crl?files)
by Ludolf Holzheid 27 Apr '11

27 Apr '11

On Wed, 2011-04-27 13:06:43 +0200, laurent.uk(a)bnpparibas.com wrote: > Dear ludolf thanks you for your response. > > So if i use verify = 3, the crl files is useless. > > I went to the url http://crl.verisign.com , and there were a lot of files. > > what are the files corresponding of the crl list please? Those with the ".crl" extension, I suppose ;-) You'll need to look for the CRLs matching the certificates you want to use. Note, there may be CRLs for intermediate certificates too. At least (the randomly selected) Class3SoftwarePublishers.crl seems to be in DES format, you might have to convert it to PEM for use with stunnel. Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Re: [stunnel-users] Need some informations about stunnel (AC, crl files)
by Ludolf Holzheid 27 Apr '11

27 Apr '11

On Wed, 2011-04-27 10:47:42 +0200, laurent.uk(a)bnpparibas.com wrote: > Hi all, > > I need some informations about stunnel. > > First, when the client's software use a certificate signed by a CA like > veriSign. Did we need to add the certificates of this CA? or it is not > neccessary because it is a knowned CA. If you are using verify=3, stunnel checks client certificates against the set of certificates in CApath or CAfile, not against CAs and CRLs. In order to have stunnel check the certificate chain of client certificates, you'll have to use verify=2. For that, stunnel needs access to the CA's root certificate and the intermediate certificates (i.e. they have to be locally installed to CApath/CAfile). > Secondally, i need to download and update the crl files, and also (if it's > possible) the certificates of knowed CA. How can i do that in my AIX's > machine please? This depends on the way the CA publishes its certificates and CRLs. For VeriSign, my first idea is to use wget to download them from http://crl.verisign.com. There may be better ways, though. And I don't know AIX. Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Re: [stunnel-users] need help for the error VERIFY ERROR ONLY MY: no cert fo (verify = 3)
by Ludolf Holzheid 26 Apr '11

26 Apr '11

On Tue, 2011-04-26 17:00:06 +0200, laurent.uk(a)bnpparibas.com wrote: > Hi, > > I tried to configure my STUNNEL server, with my client's software test but > i always have the the following error : > > 2011.04.26 14:23:09 LOG4[1683500:258]: VERIFY ERROR ONLY MY: no cert for > /C=ww/O=swift/OU=personalid/OU=bnpafrpp/CN=crl-3skey-ebics-ts > > [..] > > I tried to extract the public certificate from the crl-3skey-ebics-ts and > add it in the keystore and in the folder /usr/local/ssl/certs/trusted/ > > [..] > > verify = 3 > ; Don't forget to c_rehash CApath > ; CApath is located inside chroot jail > ;CApath = /opt/freeware/etc/stunnel/ > ; It's often easier to use CAfile > CAfile = /opt/freeware/etc/stunnel/ca.pem > ; Don't forget to c_rehash CRLpath Laurent, If you specify a CAfile in 'verify=3' mode, you need to add the client's certificates to this file. You could also store the client's certificates in PEM format files (one file per certificate) in a directory stunnel can reach at connection time. You have to specify the name of this directory as CApath then (in contrast to CAfile), and you'll have to run c_rehash on this directory. Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Temporary failure in name resolution
by Phil Wieland 26 Apr '11

26 Apr '11

I think I've done something stupid but I can't work out what. I'm running stunnel4 version 4.29 on an Ubuntu server box, using it to tunnel smtp connections to my ISP's mail server. Everything works perfectly until I reboot the server, when it stops working. In syslog, I get: Apr 24 15:56:11 friedbread stunnel: LOG5[1101:3074997104]: ssmtp accepted connection from 127.0.0.1:50681 Apr 24 15:56:11 friedbread stunnel: LOG3[1101:3074997104]: Error resolving 'smtp.blueyonder.co.uk': Temporary failure in name resolution (EAI_AGAIN) Apr 24 15:56:11 friedbread stunnel: LOG3[1101:3074997104]: No host resolved Apr 24 15:56:11 friedbread stunnel: LOG5[1101:3074997104]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket every time I attempt to send mail. I can ping smtp.blueyonder.co.uk no problem. The problem persists until I restart stunnel4, after which it works perfectly for weeks on end. Looking at syslog for boot time, it looks like stunnel tries to resolve smtp.blueyonder.co.uk as soon as it starts, but dhcp hasn't finished at this time so it fails. It seems to cache something from the failure and not try again? Even though the error is "Temporary". All advice gratefully received. Phil Wieland Liverpool, UK. ###@friedbread:~$ stunnel4 -version stunnel 4.29 on i486-pc-linux-gnu with OpenSSL 0.9.8k 25 Mar 2009 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel4.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none ###@friedbread:~$ cat /etc/stunnel/stunnel.conf ; Sample stunnel configuration file by Michal Trojnara 2002-2009 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of the chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /etc/ssl/certs/stunnel.pem ;key = /etc/ssl/certs/stunnel.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = SSLv3 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 ; PID is created inside the chroot jail pid = /stunnel4.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = zlib ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 ;output = /var/log/stunnel4/stunnel.log ; Use it for client mode client = yes ; Service-level configuration ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 [ssmtp] accept = 55899 connect = smtp.blueyonder.co.uk:465 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini ###@friedbread:~$

3 2

Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/accept initialization
by Jack Liu 25 Apr '11

25 Apr '11

Thank you for helping, but both logs r not presented in my var/log/ dir. Any other suggestions? Mr. Jack > From: sunyucong(a)gmail.com > Date: Mon, 25 Apr 2011 16:25:20 -0700 > Subject: Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/accept initialization > To: jackliu92(a)hotmail.com > CC: stunnel-users(a)stunnel.org > > Are you sure that's entire log? check /var/log/daemons.log and > syslog.log as well. > > On Sun, Apr 24, 2011 at 1:30 AM, Jack Liu <jackliu92(a)hotmail.com> wrote: > > It anyone knows how to fix Stunnel stuck at SSL state (accept): > > before/accept initialization??? > > > > Here is the log: > > ----------------------------------------------------------------------------------------------------------- > > [root@vps1 ~]#stunnel /etc/stunnel/stunnel.conf > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Snagged 64 random bytes from > > /root/.rnd > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Wrote 1024 new random bytes to > > /root/.rnd > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: RAND_status claims sufficient > > entropy for the PRNG > > 2011.04.24 02:25:13 LOG6[32174:3085993680]: PRNG seeded successfully > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Certificate: > > /etc/stunnel/stunnel.pem > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Key file: > > /etc/stunnel/stunnel.pem > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Verify directory set to > > /etc/stunnel/CA > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: CRL directory set to > > /etc/stunnel/CRL > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: SSL context initialized for > > service 3proxy > > 2011.04.24 02:25:13 LOG5[32174:3085993680]: stunnel 4.15 on > > i686-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 > > 2011.04.24 02:25:13 LOG5[32174:3085993680]: Threading:PTHREAD SSL:ENGINE > > Sockets:POLL,IPv6 Auth:LIBWRAP > > 2011.04.24 02:25:13 LOG6[32174:3085993680]: file ulimit = 1024 (can be > > changed with 'ulimit -n') > > 2011.04.24 02:25:13 LOG6[32174:3085993680]: poll() used - no FD_SETSIZE > > limit for file descriptors > > 2011.04.24 02:25:13 LOG5[32174:3085993680]: 500 clients allowed > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 3 in non-blocking mode > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 4 in non-blocking mode > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 5 in non-blocking mode > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: SO_REUSEADDR option set on > > accept socket > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: 3proxy bound to 0.0.0.0:30001 > > 2011.04.24 02:25:13 LOG7[32174:3085993680]: Created pid file > > /var/run/stunnel.pid > > 2011.04.24 02:25:20 LOG7[32174:3085993680]: 3proxy accepted FD=6 from > > xx.xxx.xxx.xx:41165 > > 2011.04.24 02:25:20 LOG7[32174:3085990800]: 3proxy started > > 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 6 in non-blocking mode > > 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 7 in non-blocking mode > > 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 8 in non-blocking mode > > 2011.04.24 02:25:20 LOG7[32174:3085993680]: Cleaning up the signal pipe > > 2011.04.24 02:25:20 LOG6[32174:3085993680]: Child process 32176 finished > > with code 0 > > 2011.04.24 02:25:20 LOG7[32174:3085990800]: Connection from > > xx.xxx.xxx.xx:41165 permitted by libwrap > > 2011.04.24 02:25:20 LOG5[32174:3085990800]: 3proxy connected from > > xx.xxx.xxx.xx:41165 > > 2011.04.24 02:25:20 LOG7[32174:3085990800]: SSL state (accept): > > before/accept initialization <-----------------------Stuck here > > forever!!! > > 2011.04.24 02:25:22 LOG3[32174:3085990800]: SSL_accept: Peer suddenly > > disconnected > > 2011.04.24 02:25:22 LOG5[32174:3085990800]: Connection reset: 0 bytes sent > > to SSL, 0 bytes sent to socket > > 2011.04.24 02:25:22 LOG7[32174:3085990800]: 3proxy finished (0 left) > > 2011.04.24 02:25:25 LOG3[32174:3085993680]: Received signal 2; terminating > > 2011.04.24 02:25:25 LOG7[32174:3085993680]: removing pid file > > /var/run/stunnel.pid > > [root@vps1 ~]# > > ----------------------------------------------------------------------------------------------------------- > > stunnel.conf: > > cert = /etc/stunnel/stunnel.pem > > key = /etc/stunnel/stunnel.pem > > CApath = /etc/stunnel/CA > > CRLpath = /etc/stunnel/CRL > > debug = 7 > > foreground = yes > > verify = 1 > > # > > [3proxy] > > accept = 30001 > > connect = 127.0.0.1:33135 > > ----------------------------------------------------------------------------------------------------------- > > > > I am hosting with CentOS 5.5, and installed Stunnel via yum. > > Planning to use it with 3Proxy. However I experience the problem above, can > > someone please help with that? > > Thank you very much! > > > > > > > > Mr. Jack > > > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)stunnel.org > > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > >

1 0

Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization
by Jack Liu 25 Apr '11

25 Apr '11

I installed the 4.35 one into my CentOS, it seems like the same problem still exist. Is there anything I can do to fix it? Mr. Jack Date: Sun, 24 Apr 2011 19:09:35 -0700 From: josealf(a)rocketmail.com Subject: Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization To: jackliu92(a)hotmail.com Hi Mr Jack, RPMS attached. Let me know if you need further help. Regards, Jose From: Jack Liu <jackliu92(a)hotmail.com> To: josealf(a)rocketmail.com; stunnel-users(a)stunnel.org Sent: Sun, April 24, 2011 1:08:44 PM Subject: RE: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization Yes sure, please provide the binary. Thank you very much! One additional information, running socket5 on 3Proxy. Mr. Jack > Subject: Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization > To: jackliu92(a)hotmail.com; stunnel-users(a)stunnel.org > From: josealf(a)rocketmail.com > Date: Sun, 24 Apr 2011 11:49:05 +0000 > > If you ruled out a configuration error, You should try with a more recent version of stunnel. You can recompile the SRPM (4.29) from redhat 6 (or scientific linux 6) and it works fine under CentOS 5. I can provide binaries if needed. > > -----Original Message----- > From: Jack Liu <jackliu92(a)hotmail.com> > Sender: stunnel-users-bounces(a)stunnel.org > Date: Sun, 24 Apr 2011 02:30:24 > To: <stunnel-users(a)stunnel.org> > Subject: [stunnel-users] Stunnel stuck at SSL state (accept): before/accept > initialization > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > >

1 0

Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization
by Jack Liu 25 Apr '11

25 Apr '11

Thank you! Mr. Jack Date: Sun, 24 Apr 2011 19:09:35 -0700 From: josealf(a)rocketmail.com Subject: Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization To: jackliu92(a)hotmail.com Hi Mr Jack, RPMS attached. Let me know if you need further help. Regards, Jose From: Jack Liu <jackliu92(a)hotmail.com> To: josealf(a)rocketmail.com; stunnel-users(a)stunnel.org Sent: Sun, April 24, 2011 1:08:44 PM Subject: RE: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization Yes sure, please provide the binary. Thank you very much! One additional information, running socket5 on 3Proxy. Mr. Jack > Subject: Re: [stunnel-users] Stunnel stuck at SSL state (accept): before/acceptinitialization > To: jackliu92(a)hotmail.com; stunnel-users(a)stunnel.org > From: josealf(a)rocketmail.com > Date: Sun, 24 Apr 2011 11:49:05 +0000 > > If you ruled out a configuration error, You should try with a more recent version of stunnel. You can recompile the SRPM (4.29) from redhat 6 (or scientific linux 6) and it works fine under CentOS 5. I can provide binaries if needed. > > -----Original Message----- > From: Jack Liu <jackliu92(a)hotmail.com> > Sender: stunnel-users-bounces(a)stunnel.org > Date: Sun, 24 Apr 2011 02:30:24 > To: <stunnel-users(a)stunnel.org> > Subject: [stunnel-users] Stunnel stuck at SSL state (accept): before/accept > initialization > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > >

1 0

Stunnel stuck at SSL state (accept): before/accept initialization
by Jack Liu 24 Apr '11

24 Apr '11

It anyone knows how to fix Stunnel stuck at SSL state (accept): before/accept initialization??? Here is the log: ----------------------------------------------------------------------------------------------------------- [root@vps1 ~]#stunnel /etc/stunnel/stunnel.conf 2011.04.24 02:25:13 LOG7[32174:3085993680]: Snagged 64 random bytes from /root/.rnd 2011.04.24 02:25:13 LOG7[32174:3085993680]: Wrote 1024 new random bytes to /root/.rnd 2011.04.24 02:25:13 LOG7[32174:3085993680]: RAND_status claims sufficient entropy for the PRNG 2011.04.24 02:25:13 LOG6[32174:3085993680]: PRNG seeded successfully 2011.04.24 02:25:13 LOG7[32174:3085993680]: Certificate: /etc/stunnel/stunnel.pem 2011.04.24 02:25:13 LOG7[32174:3085993680]: Key file: /etc/stunnel/stunnel.pem 2011.04.24 02:25:13 LOG7[32174:3085993680]: Verify directory set to /etc/stunnel/CA 2011.04.24 02:25:13 LOG7[32174:3085993680]: CRL directory set to /etc/stunnel/CRL 2011.04.24 02:25:13 LOG7[32174:3085993680]: SSL context initialized for service 3proxy 2011.04.24 02:25:13 LOG5[32174:3085993680]: stunnel 4.15 on i686-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 2011.04.24 02:25:13 LOG5[32174:3085993680]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2011.04.24 02:25:13 LOG6[32174:3085993680]: file ulimit = 1024 (can be changed with 'ulimit -n') 2011.04.24 02:25:13 LOG6[32174:3085993680]: poll() used - no FD_SETSIZE limit for file descriptors 2011.04.24 02:25:13 LOG5[32174:3085993680]: 500 clients allowed 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 3 in non-blocking mode 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 4 in non-blocking mode 2011.04.24 02:25:13 LOG7[32174:3085993680]: FD 5 in non-blocking mode 2011.04.24 02:25:13 LOG7[32174:3085993680]: SO_REUSEADDR option set on accept socket 2011.04.24 02:25:13 LOG7[32174:3085993680]: 3proxy bound to 0.0.0.0:30001 2011.04.24 02:25:13 LOG7[32174:3085993680]: Created pid file /var/run/stunnel.pid 2011.04.24 02:25:20 LOG7[32174:3085993680]: 3proxy accepted FD=6 from xx.xxx.xxx.xx:41165 2011.04.24 02:25:20 LOG7[32174:3085990800]: 3proxy started 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 6 in non-blocking mode 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 7 in non-blocking mode 2011.04.24 02:25:20 LOG7[32174:3085990800]: FD 8 in non-blocking mode 2011.04.24 02:25:20 LOG7[32174:3085993680]: Cleaning up the signal pipe 2011.04.24 02:25:20 LOG6[32174:3085993680]: Child process 32176 finished with code 0 2011.04.24 02:25:20 LOG7[32174:3085990800]: Connection from xx.xxx.xxx.xx:41165 permitted by libwrap 2011.04.24 02:25:20 LOG5[32174:3085990800]: 3proxy connected from xx.xxx.xxx.xx:41165 2011.04.24 02:25:20 LOG7[32174:3085990800]: SSL state (accept): before/accept initialization <-----------------------Stuck here forever!!! 2011.04.24 02:25:22 LOG3[32174:3085990800]: SSL_accept: Peer suddenly disconnected 2011.04.24 02:25:22 LOG5[32174:3085990800]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2011.04.24 02:25:22 LOG7[32174:3085990800]: 3proxy finished (0 left) 2011.04.24 02:25:25 LOG3[32174:3085993680]: Received signal 2; terminating 2011.04.24 02:25:25 LOG7[32174:3085993680]: removing pid file /var/run/stunnel.pid [root@vps1 ~]# ----------------------------------------------------------------------------------------------------------- stunnel.conf: cert = /etc/stunnel/stunnel.pem key = /etc/stunnel/stunnel.pem CApath = /etc/stunnel/CA CRLpath = /etc/stunnel/CRL debug = 7 foreground = yes verify = 1 # [3proxy] accept = 30001 connect = 127.0.0.1:33135 ----------------------------------------------------------------------------------------------------------- I am hosting with CentOS 5.5, and installed Stunnel via yum. Planning to use it with 3Proxy. However I experience the problem above, can someone please help with that? Thank you very much! Mr. Jack

3 3

Stunnel 4.33 released
by Michal Trojnara 22 Apr '11

22 Apr '11

The ChangeLog entry: Version 4.33, 2010.04.05, urgency: MEDIUM: * New features - Win32 DLLs for OpenSSL 1.0.0. This library requires to c_rehash CApath/CRLpath directories on upgrade. - Win32 DLLs for zlib 1.2.4. - Experimental support for local mode on WIN32 platform. Try "exec = c:\windows\system32\cmd.exe". * Bugfixes - Inetd mode fixed SHA-1 value for stunnel-4.33.tar.gz: 695c7ef834952cb8ddbc790e10b6e32798fc2767 Home page: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ Best regards, Michal Trojnara

4 6

Possible leak in client.c:init_ssl()
by Sven Ulland 16 Apr '11

16 Apr '11

Quick summary: Stunnel 4.35 configured with four services. As clients connect, the main stunnel process grows a lot in vsz/rss memory. With a lot of clients connecting, it quickly grows to several gigabytes rss. The use case is quite special: The multithreaded download accelerator 'axel' is used to download large files using 800 simultaneous threads. The downloads are from China, so the network performance is horrible, and connections are reset/broken all the time, so there is lots of new connections created constantly. Up to four axel instances run at the same time, so we're talking 3200 simultaneous connections. Over a short 2h timespan, nearly 30000 connections have been set up (ref attached stunnel.log). The memory use increases over time, often in very large steps. As connections finish and the transfers stop (i.e. no active connections at all), the memory is not released. A similar issue was reported in 2008 [1]. Attached are the following files: stunnel.conf: Four services, no special config. Debug level 5. massif.out.excerpt.txt: Valgrind Massif output. The Massif log indicates that most of the memory is allocated through client.c:init_ssl(), by libssl and zlib. I haven't looked too much at the code yet, but could this be related to the high rate of connection resets/timeouts, combined with connection/session reuse? sven [1]: possible stunnel memory leak Message-ID: <47E8E0AD.8010709(a)eu.citrix.com> http://www.stunnel.org/pipermail/stunnel-users/2008-March/001903.html

4 5

Re: [stunnel-users] Weird error when trying to use 512bit RSA key
by Leandro Avila 11 Apr '11

11 Apr '11

The problem seems to be the key size If you use a 512 key for stunnel it works However, when the key used by stunnel is 1024 and you try to use the EXP-RC4-MD5 cipher, a temporary 512 key is generated BUT that fails. So I tested: Stunnel 4.35 and OpenSSL 1.0.0d Using a 512 RSA key and EXP-RC4-MD5 works Using a 1025 RSA key and EXP-RC4-MD5 fails Looks more like an OpenSSL thing. I'm uncertain about how this situation is handled in the protocol spec. When the server has a 1024 key but the client wants to negotiate with a smaller key. Cheers ----------------- Leandro Avila ----- Original Message ----- From:Outofwall.com <root(a)outofwall.com> To:[email protected]; stunnel-users(a)stunnel.org Cc: Sent:Monday, April 11, 2011 10:39 PM Subject:Re: [stunnel-users] Weird error when trying to use 512bit RSA key In fact, I'm using TLSv1, just use the custom ciphers list. Here's what I have on the server side: ciphers EXP-RC4-MD5:ALL and test sunyc@www:~$ openssl s_client -tls1 -connect ssl.sgivpn.info:443 -cipher EXP-RC4-MD5 CONNECTED(00000003) depth=0 /C=US/ST=CA/O=XXX verify error:num=18:self signed certificate verify return:1 depth=0 /C=US/ST=CA/O=XXX verify return:1 32684:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1093:SSL alert number 40 32684:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:530: Error: Apr 11 18:57:35 localhost stunnel: LOG3[8319:139884220368640]: SSL_accept: 1409B11A: error:1409B11A:SSL routines:SSL3_SEND_SERVER_KEY_EXCHANGE:error generating tmp rsa key Both client and server is running ubuntu 10.04, with openssl 0.9.8k I think. Cheers. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

Re: [stunnel-users] Weird error when trying to use 512bit RSA key
by Outofwall.com 11 Apr '11

11 Apr '11

In fact, I'm using TLSv1, just use the custom ciphers list. Here's what I have on the server side: ciphers EXP-RC4-MD5:ALL and test sunyc@www:~$ openssl s_client -tls1 -connect ssl.sgivpn.info:443 -cipher EXP-RC4-MD5 CONNECTED(00000003) depth=0 /C=US/ST=CA/O=XXX verify error:num=18:self signed certificate verify return:1 depth=0 /C=US/ST=CA/O=XXX verify return:1 32684:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1093:SSL alert number 40 32684:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:530: Error: Apr 11 18:57:35 localhost stunnel: LOG3[8319:139884220368640]: SSL_accept: 1409B11A: error:1409B11A:SSL routines:SSL3_SEND_SERVER_KEY_EXCHANGE:error generating tmp rsa key Both client and server is running ubuntu 10.04, with openssl 0.9.8k I think. Cheers.

1 0

The verify=3 option in client mode
by Philipp Hartwig 09 Apr '11

09 Apr '11

Hello, I'm using stunnel in client mode to provide an SSL connection for offlineimap[1] which does not support verification of SSL certificates. As I've read stunnel does not compare the name of the server offering the certificate to the server name mentioned in the certificate (in the CN field for example). So if I used the following section in my stunnel.conf client=yes [imaps] accept = 127.0.0.1:4322 connect = imap.gmail.com:993 CAfile = /usr/share/ca-certificates/mozilla/Equifax_Secure_CA.crt verify = 2 stunnel would happily accept any certificate signed by Equifax for an arbitrary website. Is this correct? So I've switched to using the verify=3 option and I just want to make sure I configured it correctly. I'm now using the following section client=yes [imaps] accept = 127.0.0.1:4322 connect = imap.gmail.com:993 CAfile= /home/ph/.certs/imaps.pem verify = 3 imaps.pem is a file containing two certificates, namely the first and the last certificate in the certificate chain of imap.gmail.com, that is the Equifax CA certificate and the server certificate itself. I then use offlineimap to establish an unencrypted connection to 127.0.0.1:4322. My understanding is that stunnel will now exclusively accept the server certificate stored in the imaps.pem file rendering all MITM attacks impossible. I'd be grateful if someone could confirm that this setup makes sense. Is this the way the verify=3 option is supposed to use? First I thought that it should be enough to just provide the server certificate in the imaps.pem file, but then openssl would complain about a self-signed certificate, so I included the CA certificate as well. Regards, Philipp [1] https://github.com/jgoerzen/offlineimap/wiki/

2 3

Is local mode on WIN32 working?
by Joerg Behrend 09 Apr '11

09 Apr '11

The changelog of stunnel 4.33 states that "Experimental support for local mode on WIN32 platform" is working and that should be tried exec = c:\windows\system32\cmd.exe In practice, it is for me not working, a connection is accepted but always reset with the stunnel log message: readsocket: Connection reset by peer (WSAECONNRESET) (10054) It was tested using the 4.35 Windows installer. Are there other requirements or settings necessary? Is a recompilation with special options senseful? Thanks! Joerg

1 0

issue making stunnel 4.35 use an apache http proxy to go out?
by Matt Wise 08 Apr '11

08 Apr '11

I've got an Apache proxy on port 3128 that will allow our clients to get outbound with a 'CONNECT" to a few services.. I'm trying to make stunnel use this service, and it seems to be ignoring my configuration completely. Tcpdumps show NO packets going outbound on port 3128... any ideas what i'm doing wrong? This config allows an inbound connection to port 1234 to hit port 2345 (a local service), while also handling the setup of an inbound connection to localhost:514 to a remote host on port 1514... debug = 7 pid = /var/run/stunnel.pid service = stunnel syslog = yes foreground = no socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 fips = no # Localhost:1234 hits localhost:2345 [cseservices] client = no accept = 1234 connect = 127.0.0.1:2345 CAfile = /etc/stunnel/ssl/tunnel-CAs.cert.pem cert = /etc/stunnel/ssl/server.pub key = /etc/stunnel/ssl/server.key verify = 2 ## Localhost:514 hits remotehost:1514 [syslog] client = yes accept = 514 connect = xxx:1514 CAfile = /var/lib/puppet/ssl/certs/ca.pem key = /var/lib/puppet/ssl/private_keys/xxx.pem cert = /var/lib/puppet/ssl/certs/xxx.pem session = 5 TIMEOUTidle = 600 TIMEOUTbusy = 600 TIMEOUTclose = 300 TIMEOUTconnect = 10 verify = 2 protocol=connect protocolHost=proxy:3128 protocolAuthentication=basic —Matt

1 1

Re: [stunnel-users] stunnel through elb.. need packets sent semi-frequently
by Leandro Avila 08 Apr '11

08 Apr '11

Hi I'm not sure this will work, but have you checked the option TIMEOUTidle = <num_seconds> ? Sounds to me like the setting you might be looking for ----------------- Leandro Avila ----- Original Message ----- From:Matt Wise <mwise(a)netflix.com> To:"stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Cc: Sent:Thursday, April 7, 2011 6:04 PM Subject:Re: [stunnel-users] stunnel through elb.. need packets sent semi-frequently I'm using stunnel to pass some data through an Amazon ELB. Unfortunately, there are times when the session times out due to packets not passing for 60 seconds (an amazon ELB timeout). I'm wondering whether theres some way I can configure stunnel itself to pass some whitespaces or something back and forth every few seconds to make sure the session stays open and live? (and yes, I'm posing the same question to the app developer who's ap we're passing through.. but I'm looking at both avenues.. ) _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users

3 2

stunnel through elb.. need packets sent semi-frequently
by Matt Wise 08 Apr '11

08 Apr '11

I'm using stunnel to pass some data through an Amazon ELB. Unfortunately, there are times when the session times out due to packets not passing for 60 seconds (an amazon ELB timeout). I'm wondering whether theres some way I can configure stunnel itself to pass some whitespaces or something back and forth every few seconds to make sure the session stays open and live? (and yes, I'm posing the same question to the app developer who's ap we're passing through.. but I'm looking at both avenues.. )

2 2

Re: [stunnel-users] STunnel server handshake fails
by Leandro Avila 07 Apr '11

07 Apr '11

Hello, I think you probably want to use the sslVersion = TLSv1 setting in your configuration. Instead of the options for OpenSSL Hope that helps ----------------- Leandro Avila ________________________________ From: John C. Kadyk <jckadyk(a)pacbell.net> To: stunnel-users(a)stunnel.org Sent: Thursday, April 7, 2011 7:06 PM Subject: Re: [stunnel-users] STunnel server handshake fails STunnel server handshake fails I'm trying to set up STunnel so our non-SSL network scanner can email scans through our email server, which requires TLS. A desktop email client with the same server/port settings can send email OK. I think I have STunnel configured correctly, but there's a handshake failure when it tries to connect to the server. STunnel seems to be attempting an SSLv3 connection even though I turned that option off in the config file. I want to force it to use TLS but not sure how to do that. Any suggestions greatly appreciated. Here's the config file: cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS options = NO_SSLv2 options = NO_SSLv3 ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 ;output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 1025 connect = mail022-1.exch022.serverdata.net:1025 <http://mail022-1.exch022.serverdata.net:1025> ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini and here's the log: 2011.04.07 16:41:04 LOG5[3744:516]: Reading configuration from file stunnel.conf 2011.04.07 16:41:04 LOG7[3744:516]: Snagged 64 random bytes from C:/.rnd 2011.04.07 16:41:04 LOG7[3744:516]: Wrote 1024 new random bytes to C:/.rnd 2011.04.07 16:41:04 LOG7[3744:516]: PRNG seeded successfully 2011.04.07 16:41:04 LOG7[3744:516]: Configuration SSL options: 0x03000000 2011.04.07 16:41:04 LOG7[3744:516]: SSL options set: 0x03000004 2011.04.07 16:41:04 LOG7[3744:516]: Certificate: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Certificate loaded 2011.04.07 16:41:04 LOG7[3744:516]: Key file: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Private key loaded 2011.04.07 16:41:04 LOG7[3744:516]: SSL context initialized for service pop3s 2011.04.07 16:41:04 LOG7[3744:516]: Configuration SSL options: 0x03000000 2011.04.07 16:41:04 LOG7[3744:516]: SSL options set: 0x03000004 2011.04.07 16:41:04 LOG7[3744:516]: Certificate: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Certificate loaded 2011.04.07 16:41:04 LOG7[3744:516]: Key file: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Private key loaded 2011.04.07 16:41:04 LOG7[3744:516]: SSL context initialized for service imaps 2011.04.07 16:41:04 LOG7[3744:516]: Configuration SSL options: 0x03000000 2011.04.07 16:41:04 LOG7[3744:516]: SSL options set: 0x03000004 2011.04.07 16:41:04 LOG7[3744:516]: Certificate: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Certificate loaded 2011.04.07 16:41:04 LOG7[3744:516]: Key file: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Private key loaded 2011.04.07 16:41:04 LOG7[3744:516]: SSL context initialized for service ssmtp 2011.04.07 16:41:04 LOG5[3744:516]: Configuration successful 2011.04.07 16:41:04 LOG5[3744:516]: No limit detected for the number of clients 2011.04.07 16:41:04 LOG7[3744:516]: accept socket: FD=136 allocated (non-blocking mode) 2011.04.07 16:41:04 LOG7[3744:516]: Option SO_REUSEADDR set on accept socket 2011.04.07 16:41:04 LOG7[3744:516]: Service pop3s bound to 0.0.0.0:995 <http://0.0.0.0:995> 2011.04.07 16:41:04 LOG7[3744:516]: Service pop3s opened FD=136 2011.04.07 16:41:04 LOG7[3744:516]: accept socket: FD=124 allocated (non-blocking mode) 2011.04.07 16:41:04 LOG7[3744:516]: Option SO_REUSEADDR set on accept socket 2011.04.07 16:41:04 LOG7[3744:516]: Service imaps bound to 0.0.0.0:993 <http://0.0.0.0:993> 2011.04.07 16:41:04 LOG7[3744:516]: Service imaps opened FD=124 2011.04.07 16:41:04 LOG7[3744:516]: accept socket: FD=148 allocated (non-blocking mode) 2011.04.07 16:41:04 LOG7[3744:516]: Option SO_REUSEADDR set on accept socket 2011.04.07 16:41:04 LOG7[3744:516]: Service ssmtp bound to 0.0.0.0:1025 <http://0.0.0.0:1025> 2011.04.07 16:41:04 LOG7[3744:516]: Service ssmtp opened FD=148 2011.04.07 16:41:04 LOG5[3744:516]: stunnel 4.35 on x86-pc-mingw32-gnu with OpenSSL 1.0.0c 2 Dec 2010 2011.04.07 16:41:04 LOG5[3744:516]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2011.04.07 16:41:17 LOG7[3744:2436]: local socket: FD=232 allocated (non-blocking mode) 2011.04.07 16:41:17 LOG7[3744:2436]: Service ssmtp accepted FD=232 from 10.10.17.57:49968 <http://10.10.17.57:49968> 2011.04.07 16:41:17 LOG7[3744:2436]: Creating a new thread 2011.04.07 16:41:17 LOG7[3744:2436]: New thread created 2011.04.07 16:41:17 LOG7[3744:4012]: Service ssmtp started 2011.04.07 16:41:17 LOG7[3744:4012]: Option TCP_NODELAY set on local socket 2011.04.07 16:41:17 LOG5[3744:4012]: Service ssmtp accepted connection from 10.10.17.57:49968 <http://10.10.17.57:49968> 2011.04.07 16:41:17 LOG7[3744:4012]: remote socket: FD=268 allocated (non-blocking mode) 2011.04.07 16:41:17 LOG6[3744:4012]: connect_blocking: connecting 64.78.22.98:1025 <http://64.78.22.98:1025> 2011.04.07 16:41:17 LOG5[3744:4012]: connect_blocking: connected 64.78.22.98:1025 <http://64.78.22.98:1025> 2011.04.07 16:41:17 LOG5[3744:4012]: Service ssmtp connected remote server from 10.10.17.249:4081 <http://10.10.17.249:4081> 2011.04.07 16:41:17 LOG7[3744:4012]: Remote FD=268 initialized 2011.04.07 16:41:17 LOG7[3744:4012]: Option TCP_NODELAY set on remote socket 2011.04.07 16:41:17 LOG7[3744:4012]: SSL state (connect): before/connect initialization 2011.04.07 16:41:17 LOG7[3744:4012]: SSL state (connect): SSLv3 write client hello A 2011.04.07 16:41:17 LOG7[3744:4012]: SSL alert (write): fatal: handshake failure 2011.04.07 16:41:17 LOG3[3744:4012]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2011.04.07 16:41:17 LOG5[3744:4012]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2011.04.07 16:41:17 LOG7[3744:4012]: Service ssmtp finished (0 left) Any suggestions greatly appreciated. Thanks! John _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

STunnel server handshake fails
by John C. Kadyk 07 Apr '11

07 Apr '11

I'm trying to set up STunnel so our non-SSL network scanner can email scans through our email server, which requires TLS. A desktop email client with the same server/port settings can send email OK. I think I have STunnel configured correctly, but there's a handshake failure when it tries to connect to the server. STunnel seems to be attempting an SSLv3 connection even though I turned that option off in the config file. I want to force it to use TLS but not sure how to do that. Any suggestions greatly appreciated. Here's the config file: cert = stunnel.pem ;key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS options = NO_SSLv2 options = NO_SSLv3 ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 ;output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [pop3s] accept = 995 connect = 110 [imaps] accept = 993 connect = 143 [ssmtp] accept = 1025 connect = mail022-1.exch022.serverdata.net:1025 <http://mail022-1.exch022.serverdata.net:1025> ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini and here's the log: 2011.04.07 16:41:04 LOG5[3744:516]: Reading configuration from file stunnel.conf 2011.04.07 16:41:04 LOG7[3744:516]: Snagged 64 random bytes from C:/.rnd 2011.04.07 16:41:04 LOG7[3744:516]: Wrote 1024 new random bytes to C:/.rnd 2011.04.07 16:41:04 LOG7[3744:516]: PRNG seeded successfully 2011.04.07 16:41:04 LOG7[3744:516]: Configuration SSL options: 0x03000000 2011.04.07 16:41:04 LOG7[3744:516]: SSL options set: 0x03000004 2011.04.07 16:41:04 LOG7[3744:516]: Certificate: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Certificate loaded 2011.04.07 16:41:04 LOG7[3744:516]: Key file: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Private key loaded 2011.04.07 16:41:04 LOG7[3744:516]: SSL context initialized for service pop3s 2011.04.07 16:41:04 LOG7[3744:516]: Configuration SSL options: 0x03000000 2011.04.07 16:41:04 LOG7[3744:516]: SSL options set: 0x03000004 2011.04.07 16:41:04 LOG7[3744:516]: Certificate: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Certificate loaded 2011.04.07 16:41:04 LOG7[3744:516]: Key file: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Private key loaded 2011.04.07 16:41:04 LOG7[3744:516]: SSL context initialized for service imaps 2011.04.07 16:41:04 LOG7[3744:516]: Configuration SSL options: 0x03000000 2011.04.07 16:41:04 LOG7[3744:516]: SSL options set: 0x03000004 2011.04.07 16:41:04 LOG7[3744:516]: Certificate: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Certificate loaded 2011.04.07 16:41:04 LOG7[3744:516]: Key file: stunnel.pem 2011.04.07 16:41:04 LOG7[3744:516]: Private key loaded 2011.04.07 16:41:04 LOG7[3744:516]: SSL context initialized for service ssmtp 2011.04.07 16:41:04 LOG5[3744:516]: Configuration successful 2011.04.07 16:41:04 LOG5[3744:516]: No limit detected for the number of clients 2011.04.07 16:41:04 LOG7[3744:516]: accept socket: FD=136 allocated (non-blocking mode) 2011.04.07 16:41:04 LOG7[3744:516]: Option SO_REUSEADDR set on accept socket 2011.04.07 16:41:04 LOG7[3744:516]: Service pop3s bound to 0.0.0.0:995 <http://0.0.0.0:995> 2011.04.07 16:41:04 LOG7[3744:516]: Service pop3s opened FD=136 2011.04.07 16:41:04 LOG7[3744:516]: accept socket: FD=124 allocated (non-blocking mode) 2011.04.07 16:41:04 LOG7[3744:516]: Option SO_REUSEADDR set on accept socket 2011.04.07 16:41:04 LOG7[3744:516]: Service imaps bound to 0.0.0.0:993 <http://0.0.0.0:993> 2011.04.07 16:41:04 LOG7[3744:516]: Service imaps opened FD=124 2011.04.07 16:41:04 LOG7[3744:516]: accept socket: FD=148 allocated (non-blocking mode) 2011.04.07 16:41:04 LOG7[3744:516]: Option SO_REUSEADDR set on accept socket 2011.04.07 16:41:04 LOG7[3744:516]: Service ssmtp bound to 0.0.0.0:1025 <http://0.0.0.0:1025> 2011.04.07 16:41:04 LOG7[3744:516]: Service ssmtp opened FD=148 2011.04.07 16:41:04 LOG5[3744:516]: stunnel 4.35 on x86-pc-mingw32-gnu with OpenSSL 1.0.0c 2 Dec 2010 2011.04.07 16:41:04 LOG5[3744:516]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2011.04.07 16:41:17 LOG7[3744:2436]: local socket: FD=232 allocated (non-blocking mode) 2011.04.07 16:41:17 LOG7[3744:2436]: Service ssmtp accepted FD=232 from 10.10.17.57:49968 <http://10.10.17.57:49968> 2011.04.07 16:41:17 LOG7[3744:2436]: Creating a new thread 2011.04.07 16:41:17 LOG7[3744:2436]: New thread created 2011.04.07 16:41:17 LOG7[3744:4012]: Service ssmtp started 2011.04.07 16:41:17 LOG7[3744:4012]: Option TCP_NODELAY set on local socket 2011.04.07 16:41:17 LOG5[3744:4012]: Service ssmtp accepted connection from 10.10.17.57:49968 <http://10.10.17.57:49968> 2011.04.07 16:41:17 LOG7[3744:4012]: remote socket: FD=268 allocated (non-blocking mode) 2011.04.07 16:41:17 LOG6[3744:4012]: connect_blocking: connecting 64.78.22.98:1025 <http://64.78.22.98:1025> 2011.04.07 16:41:17 LOG5[3744:4012]: connect_blocking: connected 64.78.22.98:1025 <http://64.78.22.98:1025> 2011.04.07 16:41:17 LOG5[3744:4012]: Service ssmtp connected remote server from 10.10.17.249:4081 <http://10.10.17.249:4081> 2011.04.07 16:41:17 LOG7[3744:4012]: Remote FD=268 initialized 2011.04.07 16:41:17 LOG7[3744:4012]: Option TCP_NODELAY set on remote socket 2011.04.07 16:41:17 LOG7[3744:4012]: SSL state (connect): before/connect initialization 2011.04.07 16:41:17 LOG7[3744:4012]: SSL state (connect): SSLv3 write client hello A 2011.04.07 16:41:17 LOG7[3744:4012]: SSL alert (write): fatal: handshake failure 2011.04.07 16:41:17 LOG3[3744:4012]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2011.04.07 16:41:17 LOG5[3744:4012]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2011.04.07 16:41:17 LOG7[3744:4012]: Service ssmtp finished (0 left) Any suggestions greatly appreciated. Thanks! John

1 0

Can't get transparent mode to work from remote IP
by Ben Schmidt 02 Apr '11

02 Apr '11

Hello stunnel Mailinglist, I'm new to stunnel and so far it works just fine. What impressed me the most is that is faster then Apache's mod_ssl. My only Problem is that I can't get stunnel to work in transparent mode. When I try to access it from a remote IP I get timeouts connecting to the Non-SSL Server. I'm prettymuch relying on the manual in section "transparent": http://www.stunnel.org/static/stunnel.html Scenario: local 10.0.0.0/22 > Server with stunnel (10.0.3.48/22) > local apache My config: http://pastebin.com/BQmXeT5b Log: http://pastebin.com/enQTAWB9 "stunnel -sockets": http://pastebin.com/Zbz9FTr6 "iptables -L -v": http://pastebin.com/0b90Nay8 executing iptables, again: http://pastebin.com/T87cGPBX The apache listening on port 80 reporting hits from the Computers private IP but not from any remote IPs in the same network. Firewalls and stuff like that are not the Problem. The remote Computer can access port 80 without any Problems and it works fine when I switch from stunnel to apaches mod_ssl. My Testsetup is using 4.29 on ubuntu 10.10 GNU/Linux amd64 with kernel 2.6.35 and OpenSSL 0.9.8o Could anybody please point me in the rigth direction, I know that I'm missing something but I just can't figure it out. Thanks a lot, Ben

1 0

stunnel maximum clients to server
by bruce bushby 26 Mar '11

26 Mar '11

Hi I'm about to add stunnel to my buildroot embedded project (ARM926EJ-S) and I was hoping the list could answer a few performance questions? I've been looking for a way to encrypt the connections between my embedded units and my server. From what I understood about openvpn, the server starts to give problems beyond 1024 "concurrent sessions" .... I'm looking at a design that can handle 4K concurrent sessions....although it'll take a few years to get that big. My embedded devices have a GSM modem and setup a ppp0 interface over gprs. I'm considering stunnel in the hope that I could have up to 3000 stunnel connections coming into my servers. I say 3K because by the tike I reach this figure I hope to have implemented better switches and off load the overhead of the encrypted connection to the switch. The requirement is that the embedded "non-ssl aware client" will be able to communicate with the server over a secure tunnel. Am I completely on the wrong road? .... could stunnel cater for something like this? Thanks in advance!

3 2

Certificate request popup when clicking on MS Office links in a stunnel HTTPS redirect to Domino HTTP server?
by Josiah Fizer 25 Mar '11

25 Mar '11

We have a Lotus Domino server hosting some Microsoft Office documents. For improved security, I started using stunnel to redirect pacts from the HTTP servers via HTTPS. Everything works perfectly, however when a user clicks a document link they are prompted for login credentials or a certificate. This would seem to be because MS Office is trying to open the remote document in edit mode rather then downloading it locally or opening it in read mode. I've tried a number of stunnel configuration options but nothing seems to work. At current I am using the following simple configuration. Any insight into the issue would be appreciated. cert = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify=0 [https] accept = 443 connect = localhost:80 TIMEOUTclose = 0

1 0

Re: [stunnel-users] Windows Firewall has blocked some features of thisprogram
by jay＠experts-exchange.com 22 Mar '11

22 Mar '11

Hi Josealf, Thank you for your response and for this information. Is there a VB script or other method I can use for this purpose? I use a signed Java applet to download, install, and execute stunnel, but can insert a step to run a VB or other script on the host prior. I suspect the stunnel installer may do this already, but after looking, did not see anything. Thank you > You can add the required firewall exceptions as part of your installation > tasks. You just need to allow connections to the incoming port(s) your > stunnel config use. > > -----Original Message----- > From: jay(a)experts-exchange.com > Sender: stunnel-users-bounces(a)stunnel.org > Date: Mon, 21 Mar 2011 17:39:11 > To: <stunnel-users(a)stunnel.org> > Subject: [stunnel-users] Windows Firewall has blocked some features of > this > program > > Folks, > > While bundling stunnel with my user application, upon kick off I see this > error message.*1 Is there a way to avoid this security warning? I am > trying to figure out if signing the binaries will escape this situation, > or if it is related to the binary not containing a string table. I > investigated linking the win32 binary with MS Visual Studio 2005 to see > if > the presence of the version string info in the binary would help*2, but > so > far I have been unable to directly link. I originally built stunnel using > cygwin's mingw32-gcc*3, so linking using MSDEV is not too easy.*4 > > Thanks > > > Refs: > *1 "Windows Security Alert. To help protect your computer, Windows > Firewall has blocked some features of this program. Do you want to keep > blocking this program? Name: stunnel Publisher: Unknown" > > *2 stunnel/src/version.rc, > > // pdelaage TODO 20101111: this file works with MS VC / EVC > // But with MINGW, properties are NOT displayed in Windows Explorer > // although they are embedded in the final exe program. > // anyway, using a .o coming from MS VC does not change anything, > // and linking the gcc version.o with ms tools works! > // so the problem is in fact in gcc-linking, not in version.o. > > > *2 mingw64-i686-gcc-core 4.5.1-2 > > Administrator@MSDN-2005-DEV /cygdrive/c/dl/stunnel/stunnel-4.35/src > $ i686-w64-mingw32-gcc-4.5.1 -s -o stunnel.exe file.obj client.obj > log.obj > options.obj protocol.obj network.obj resolver.obj ssl.obj ctx.obj > verify.obj sthreads.obj stunnel.obj gui.obj resources.obj > -L/cygdrive/c/openssl/lib -L/cygdrive/c/dl/stunnel/zlib-1.2.5 > -lcrypto.dll > -lssl.dll -lz -lws2_32 -lgdi32 -mwindows -v > Using built-in specs. > COLLECT_GCC=i686-w64-mingw32-gcc-4.5.1 > COLLECT_LTO_WRAPPER=/usr/lib/gcc/i686-w64-mingw32/4.5.1/lto-wrapper.exe > Target: i686-w64-mingw32 > Configured with: > /cygdrive/c/nnnew/gcc32/mingw64-i686-gcc-4.5.1-2/src/gcc-4.5.1/configure > --srcdir=/cygdrive/c/nnnew/gcc32/mingw64-i686-gcc-4.5.1-2/src/gcc-4.5.1 > --prefix=/usr --exec-prefix=/usr --bindir=/usr/bin --sbindir=/usr/sbin > --libexecdir=/usr/lib --datadir=/usr/share --localstatedir=/var > --sysconfdir=/etc --datarootdir=/usr/share > --docdir=/usr/share/doc/mingw64-i686-gcc -C --build=i686-pc-cygwin > --host=i686-pc-cygwin --target=i686-w64-mingw32 > --with-sysroot=/usr/i686-w64-mingw32/sys-root > --with-build-sysroot=/usr/i686-w64-mingw32/sys-root --disable-multilib > --disable-win32-registry > --enable-languages=c,ada,c++,fortran,objc,obj-c++ > --enable-fully-dynamic-strings --enable-libgomp --enable-sjlj-exceptions > --enable-version-specific-runtime-libs --with-dwarf2 > --enable-decimal-float=bid --enable-lto > Thread model: win32 > gcc version 4.5.1 (GCC) > COMPILER_PATH=/usr/lib/gcc/i686-w64-mingw32/4.5.1/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/:/usr/lib/gcc/i686-w64-mingw32/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/:/usr/lib/gcc/i686-w64-mingw32/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/bin/ > LIBRARY_PATH=/usr/lib/gcc/i686-w64-mingw32/4.5.1/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/lib/../lib32/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/lib/:/usr/i686-w64-mingw32/sys-root/mingw/lib/ > COLLECT_GCC_OPTIONS='-s' '-o' 'stunnel.exe' '-L/cygdrive/c/openssl/lib' > '-L/cygdrive/c/dl/stunnel/zlib-1.2.5' '-mwindows' '-v' '-mtune=generic' > '-march=pentiumpro' > /usr/lib/gcc/i686-w64-mingw32/4.5.1/collect2.exe > --sysroot=/usr/i686-w64-mingw32/sys-root -m i386pe --subsystem windows > -Bdynamic -o stunnel.exe -s > /usr/i686-w64-mingw32/sys-root/mingw/lib/crt2.o > /usr/lib/gcc/i686-w64-mingw32/4.5.1/crtbegin.o -L/cygdrive/c/openssl/lib > -L/cygdrive/c/dl/stunnel/zlib-1.2.5 -L/usr/lib/gcc/i686-w64-mingw32/4.5.1 > -L/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/lib/../lib32 > -L/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/lib > -L/usr/i686-w64-mingw32/sys-root/mingw/lib file.obj client.obj log.obj > options.obj protocol.obj network.obj resolver.obj ssl.obj ctx.obj > verify.obj sthreads.obj stunnel.obj gui.obj resources.obj -lcrypto.dll > -lssl.dll -lz -lws2_32 -lgdi32 -lmingw32 -lgcc_eh -lgcc -lmoldname > -lmingwex -lmsvcrt -lgdi32 -lcomdlg32 -luser32 -lkernel32 -ladvapi32 > -lshell32 -lmingw32 -lgcc_eh -lgcc -lmoldname -lmingwex -lmsvcrt > /usr/lib/gcc/i686-w64-mingw32/4.5.1/crtend.o > > Administrator@MSDN-2005-DEV /cygdrive/c/dl/stunnel/stunnel-4.35/src > $ > > *4 Link attempt under windows: > > C:\dl\stunnel\stunnel-4.35\src>link /libpath:"C:\openssl\lib" > /libpath:"c:\dl\stunnel\zlib-1.2.5" /machine:I386 /nologo > /out:"stunnel.exe" /incremental:no /release /mapinfo:exports > /subsystem:windows /opt:ref /opt:icf wsock32.lib kernel32.lib user32.lib > gdi32.lib comdlg32.lib advapi32.lib shell32.lib msvcrt.lib libcmt.lib > libcrypto.a libssl.a libz.a file.obj client.obj log.obj options.obj > protocol.obj network.obj resolver.obj ssl.obj ctx.obj verify.obj > sthreads.obj stunnel.obj gui.obj resources.obj > msvcrt.lib(_stat.obj) : warning LNK4078: multiple '.drectve' sections > found with different attributes (00000A00) > options.obj : error LNK2019: unresolved external symbol ___chkstk > referenced in function _parse_conf > gui.obj : error LNK2019: unresolved external symbol _strdup referenced in > function _WinMain@16 > libcrypto.a(asn_mime.o) : error LNK2001: unresolved external symbol > __alloca > libcrypto.a(bss_file.o) : error LNK2019: unresolved external symbol > __alloca referenced in function _BIO_new_file > libcrypto.a(cryptlib.o) : error LNK2001: unresolved external symbol > __alloca > libcrypto.a(err_prn.o) : error LNK2001: unresolved external symbol > __alloca > libcrypto.a(bn_prime.o) : error LNK2001: unresolved external symbol > __alloca > libcrypto.a(b_print.o) : error LNK2019: unresolved external symbol > ___umoddi3 referenced in function _fmtint > libcrypto.a(bn_word.o) : error LNK2001: unresolved external symbol > ___umoddi3 > libcrypto.a(b_print.o) : error LNK2019: unresolved external symbol > ___udivdi3 referenced in function _fmtint > stunnel.exe : fatal error LNK1120: 5 unresolved externals > > C:\dl\stunnel\stunnel-4.35\src> > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > http://stunnel.mirt.net/mailman/listinfo/stunnel-users >

2 1

Windows Firewall has blocked some features of this program
by jay＠experts-exchange.com 22 Mar '11

22 Mar '11

Folks, While bundling stunnel with my user application, upon kick off I see this error message.*1 Is there a way to avoid this security warning? I am trying to figure out if signing the binaries will escape this situation, or if it is related to the binary not containing a string table. I investigated linking the win32 binary with MS Visual Studio 2005 to see if the presence of the version string info in the binary would help*2, but so far I have been unable to directly link. I originally built stunnel using cygwin's mingw32-gcc*3, so linking using MSDEV is not too easy.*4 Thanks Refs: *1 "Windows Security Alert. To help protect your computer, Windows Firewall has blocked some features of this program. Do you want to keep blocking this program? Name: stunnel Publisher: Unknown" *2 stunnel/src/version.rc, // pdelaage TODO 20101111: this file works with MS VC / EVC // But with MINGW, properties are NOT displayed in Windows Explorer // although they are embedded in the final exe program. // anyway, using a .o coming from MS VC does not change anything, // and linking the gcc version.o with ms tools works! // so the problem is in fact in gcc-linking, not in version.o. *2 mingw64-i686-gcc-core 4.5.1-2 Administrator@MSDN-2005-DEV /cygdrive/c/dl/stunnel/stunnel-4.35/src $ i686-w64-mingw32-gcc-4.5.1 -s -o stunnel.exe file.obj client.obj log.obj options.obj protocol.obj network.obj resolver.obj ssl.obj ctx.obj verify.obj sthreads.obj stunnel.obj gui.obj resources.obj -L/cygdrive/c/openssl/lib -L/cygdrive/c/dl/stunnel/zlib-1.2.5 -lcrypto.dll -lssl.dll -lz -lws2_32 -lgdi32 -mwindows -v Using built-in specs. COLLECT_GCC=i686-w64-mingw32-gcc-4.5.1 COLLECT_LTO_WRAPPER=/usr/lib/gcc/i686-w64-mingw32/4.5.1/lto-wrapper.exe Target: i686-w64-mingw32 Configured with: /cygdrive/c/nnnew/gcc32/mingw64-i686-gcc-4.5.1-2/src/gcc-4.5.1/configure --srcdir=/cygdrive/c/nnnew/gcc32/mingw64-i686-gcc-4.5.1-2/src/gcc-4.5.1 --prefix=/usr --exec-prefix=/usr --bindir=/usr/bin --sbindir=/usr/sbin --libexecdir=/usr/lib --datadir=/usr/share --localstatedir=/var --sysconfdir=/etc --datarootdir=/usr/share --docdir=/usr/share/doc/mingw64-i686-gcc -C --build=i686-pc-cygwin --host=i686-pc-cygwin --target=i686-w64-mingw32 --with-sysroot=/usr/i686-w64-mingw32/sys-root --with-build-sysroot=/usr/i686-w64-mingw32/sys-root --disable-multilib --disable-win32-registry --enable-languages=c,ada,c++,fortran,objc,obj-c++ --enable-fully-dynamic-strings --enable-libgomp --enable-sjlj-exceptions --enable-version-specific-runtime-libs --with-dwarf2 --enable-decimal-float=bid --enable-lto Thread model: win32 gcc version 4.5.1 (GCC) COMPILER_PATH=/usr/lib/gcc/i686-w64-mingw32/4.5.1/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/:/usr/lib/gcc/i686-w64-mingw32/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/:/usr/lib/gcc/i686-w64-mingw32/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/bin/ LIBRARY_PATH=/usr/lib/gcc/i686-w64-mingw32/4.5.1/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/lib/../lib32/:/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/lib/:/usr/i686-w64-mingw32/sys-root/mingw/lib/ COLLECT_GCC_OPTIONS='-s' '-o' 'stunnel.exe' '-L/cygdrive/c/openssl/lib' '-L/cygdrive/c/dl/stunnel/zlib-1.2.5' '-mwindows' '-v' '-mtune=generic' '-march=pentiumpro' /usr/lib/gcc/i686-w64-mingw32/4.5.1/collect2.exe --sysroot=/usr/i686-w64-mingw32/sys-root -m i386pe --subsystem windows -Bdynamic -o stunnel.exe -s /usr/i686-w64-mingw32/sys-root/mingw/lib/crt2.o /usr/lib/gcc/i686-w64-mingw32/4.5.1/crtbegin.o -L/cygdrive/c/openssl/lib -L/cygdrive/c/dl/stunnel/zlib-1.2.5 -L/usr/lib/gcc/i686-w64-mingw32/4.5.1 -L/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/lib/../lib32 -L/usr/lib/gcc/i686-w64-mingw32/4.5.1/../../../../i686-w64-mingw32/lib -L/usr/i686-w64-mingw32/sys-root/mingw/lib file.obj client.obj log.obj options.obj protocol.obj network.obj resolver.obj ssl.obj ctx.obj verify.obj sthreads.obj stunnel.obj gui.obj resources.obj -lcrypto.dll -lssl.dll -lz -lws2_32 -lgdi32 -lmingw32 -lgcc_eh -lgcc -lmoldname -lmingwex -lmsvcrt -lgdi32 -lcomdlg32 -luser32 -lkernel32 -ladvapi32 -lshell32 -lmingw32 -lgcc_eh -lgcc -lmoldname -lmingwex -lmsvcrt /usr/lib/gcc/i686-w64-mingw32/4.5.1/crtend.o Administrator@MSDN-2005-DEV /cygdrive/c/dl/stunnel/stunnel-4.35/src $ *4 Link attempt under windows: C:\dl\stunnel\stunnel-4.35\src>link /libpath:"C:\openssl\lib" /libpath:"c:\dl\stunnel\zlib-1.2.5" /machine:I386 /nologo /out:"stunnel.exe" /incremental:no /release /mapinfo:exports /subsystem:windows /opt:ref /opt:icf wsock32.lib kernel32.lib user32.lib gdi32.lib comdlg32.lib advapi32.lib shell32.lib msvcrt.lib libcmt.lib libcrypto.a libssl.a libz.a file.obj client.obj log.obj options.obj protocol.obj network.obj resolver.obj ssl.obj ctx.obj verify.obj sthreads.obj stunnel.obj gui.obj resources.obj msvcrt.lib(_stat.obj) : warning LNK4078: multiple '.drectve' sections found with different attributes (00000A00) options.obj : error LNK2019: unresolved external symbol ___chkstk referenced in function _parse_conf gui.obj : error LNK2019: unresolved external symbol _strdup referenced in function _WinMain@16 libcrypto.a(asn_mime.o) : error LNK2001: unresolved external symbol __alloca libcrypto.a(bss_file.o) : error LNK2019: unresolved external symbol __alloca referenced in function _BIO_new_file libcrypto.a(cryptlib.o) : error LNK2001: unresolved external symbol __alloca libcrypto.a(err_prn.o) : error LNK2001: unresolved external symbol __alloca libcrypto.a(bn_prime.o) : error LNK2001: unresolved external symbol __alloca libcrypto.a(b_print.o) : error LNK2019: unresolved external symbol ___umoddi3 referenced in function _fmtint libcrypto.a(bn_word.o) : error LNK2001: unresolved external symbol ___umoddi3 libcrypto.a(b_print.o) : error LNK2019: unresolved external symbol ___udivdi3 referenced in function _fmtint stunnel.exe : fatal error LNK1120: 5 unresolved externals C:\dl\stunnel\stunnel-4.35\src>

2 1

stunnel in DMZ : accept=22 / connect=other.server.net:22 - gets stuck! - need help!
by Bernhard.Baeumle＠mt.com 17 Mar '11

17 Mar '11

Hi I use stunnel on a DMZ server for tunnelling/forwarding/proxying... (whatever term is correct). The situation is as follows: Hardware : External PC <==> DMZ server <==> company-internal server Operational : https://xxx.yy.zz (443) <==> (443) stunnel (80) <==> (80) SVN Server listening on port 80 NEW/NEED HELP : plink (22) <==> (22) stunnel (22) <==> (22) sshd listening on port 22 stunnel.conf (on the DMZ server) looks like this: cert = my_tunnel.pem key = my_tunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 socket = a:SO_REUSEADDR=0 debug = 7 output = C:\Program Files (x86)\stunnel\stunnel.log ;client = yes [forward_443_to_80] accept = 443 connect = my.company-server.net:80 [forward_22] accept = 22 connect = my.company-server.net:22 NOTE: Forwarding 443 to my.company-server.net:80 => WORKS FINE! NOW I try SSH with my PC connected to the company's network (without hopping at the DMZ): "plink -A -v -l username -i cert_file -P 22 dmz-server-name.net" => THIS WORKS FINE! NOW I try SSH with my PC from external network (which needs hopping at the DMZ): "plink -A -v -l username -i cert_file -P 22 dmz-server-name.net" Firewalls and ports seem to be open. The stunnel.log looks like this: <<starting stunnel service>> 2011.03.17 15:27:09 LOG5[4772:3852]: Reading configuration from file stunnel.conf 2011.03.17 15:27:09 LOG7[4772:3852]: Snagged 64 random bytes from C:/.rnd 2011.03.17 15:27:09 LOG7[4772:3852]: Wrote 1024 new random bytes to C:/.rnd 2011.03.17 15:27:09 LOG7[4772:3852]: PRNG seeded successfully 2011.03.17 15:27:09 LOG6[4772:3852]: Could not load DH parameters from my_tunnel.pem 2011.03.17 15:27:09 LOG7[4772:3852]: ECDH initialized 2011.03.17 15:27:09 LOG7[4772:3852]: Certificate: my_tunnel.pem 2011.03.17 15:27:09 LOG7[4772:3852]: Certificate loaded 2011.03.17 15:27:09 LOG7[4772:3852]: Key file: my_tunnel.pem 2011.03.17 15:27:09 LOG7[4772:3852]: Private key loaded 2011.03.17 15:27:09 LOG7[4772:3852]: SSL context initialized for service forward_443_to_80 2011.03.17 15:27:09 LOG6[4772:3852]: Could not load DH parameters from my_tunnel.pem 2011.03.17 15:27:09 LOG7[4772:3852]: ECDH initialized 2011.03.17 15:27:09 LOG7[4772:3852]: Certificate: my_tunnel.pem 2011.03.17 15:27:09 LOG7[4772:3852]: Certificate loaded 2011.03.17 15:27:09 LOG7[4772:3852]: Key file: my_tunnel.pem 2011.03.17 15:27:09 LOG7[4772:3852]: Private key loaded 2011.03.17 15:27:09 LOG7[4772:3852]: SSL context initialized for service forward_22 2011.03.17 15:27:09 LOG5[4772:3852]: Configuration successful 2011.03.17 15:27:09 LOG5[4772:3852]: No limit detected for the number of clients 2011.03.17 15:27:09 LOG7[4772:3852]: accept socket: FD=168 allocated (non-blocking mode) 2011.03.17 15:27:09 LOG7[4772:3852]: Option SO_REUSEADDR set on accept socket 2011.03.17 15:27:09 LOG7[4772:3852]: Service forward_443_to_80 bound to 0.0.0.0:443 2011.03.17 15:27:09 LOG7[4772:3852]: Service forward_443_to_80 opened FD=168 2011.03.17 15:27:09 LOG7[4772:3852]: accept socket: FD=280 allocated (non-blocking mode) 2011.03.17 15:27:09 LOG7[4772:3852]: Option SO_REUSEADDR set on accept socket 2011.03.17 15:27:09 LOG7[4772:3852]: Service forward_22 bound to 0.0.0.0:22 2011.03.17 15:27:09 LOG7[4772:3852]: Service forward_22 opened FD=280 2011.03.17 15:27:09 LOG5[4772:3852]: stunnel 4.35 on x86-pc-mingw32-gnu with OpenSSL 1.0.0c 2 Dec 2010 2011.03.17 15:27:09 LOG5[4772:3852]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 <<calling plink...>> 2011.03.17 15:27:26 LOG7[4772:4208]: local socket: FD=320 allocated (non-blocking mode) 2011.03.17 15:27:26 LOG7[4772:4208]: Service forward_22 accepted FD=320 from 123.4.5.6:2950 2011.03.17 15:27:26 LOG7[4772:4208]: Creating a new thread 2011.03.17 15:27:26 LOG7[4772:4208]: New thread created 2011.03.17 15:27:26 LOG7[4772:4756]: Service forward_22 started 2011.03.17 15:27:26 LOG7[4772:4756]: Option TCP_NODELAY set on local socket 2011.03.17 15:27:26 LOG5[4772:4756]: Service forward_22 accepted connection from 123.4.5.6:2950 2011.03.17 15:27:26 LOG7[4772:4756]: SSL state (accept): before/accept initialization <<and here it gets stuck!!!!!!!>> plink says: Looking up host "dmz-server-name.net" Connecting to 123.12.1.1 port 22 <<and here it gets stuck!!!!!!!>> PLEASE HELP!!!

2 1

SSL_read: 140D5042: error:140D5042:SSL routines:SSL3_CTRL:called a function you should not call
by Julian Ramirez 16 Mar '11

16 Mar '11

Hello all, I am using stunnel in order to send encrypted http request/response messages to an external system called Tradeweb. Our python program sends the message to stunnel and stunnel sends it to Tradeweb through a proxy. My version of stunnel is the following stunnel 4.35 on sparc-sun-solaris2.10 with OpenSSL 0.9.8r 8 Feb 2011 and it has been installed in a Solaris 10 operating system. My configuration file looks like this CAfile=/home/aps/tfk/stunnel/etc/stunnel/tradeweb_ca.cer client=yes verify=2 debug=7 output=stunnel.log [TradeXpress] # Port on which STUNNEL listens for local connections accept=stunnelserveripaddress:17000 # Destination address and port of TW data-center libwrap=no connect=proxyipaddress:80 protocol=connect protocolHost=tradewebipaddress:443 I have a python program that sends a http post message to stunnel. When I send the message I can see the following in the log (see below) The message gets to the other end (tradeweb system), but it looks like the encryption does not work properly. The relevant lines of the log are (see full log below) 2011.03.14 18:24:19 LOG7[6089:2]: SSL alert (write): warning: no certificate 2011.03.14 18:29:25 LOG3[6089:2]: SSL_read: 140D5042: error:140D5042:SSL routines:SSL3_CTRL:called a function you should not call 2011.03.14 18:29:25 LOG5[6089:2]: Connection reset: 521 bytes sent to SSL, 0 bytes sent to socket Do you know what is the problem? Thank you, Julian 2011.03.14 18:23:54 LOG5[6083:1]: Reading configuration from file stunnel.conf 2011.03.14 18:23:54 LOG7[6083:1]: Snagged 64 random bytes from /home/usr/vptfk/.rnd 2011.03.14 18:23:54 LOG7[6083:1]: Wrote 1024 new random bytes to /home/usr/vptfk/.rnd 2011.03.14 18:23:54 LOG7[6083:1]: PRNG seeded successfully 2011.03.14 18:23:54 LOG7[6083:1]: Loaded verify certificates from /home/aps/tfk/stunnel/etc/stunnel/tradeweb_ca.cer 2011.03.14 18:23:54 LOG7[6083:1]: Loaded /home/aps/tfk/stunnel/etc/stunnel/tradeweb_ca.cer revocation lookup file 2011.03.14 18:23:54 LOG7[6083:1]: SSL context initialized for service TradeXpress 2011.03.14 18:23:54 LOG5[6083:1]: Configuration successful 2011.03.14 18:23:54 LOG5[6083:1]: No limit detected for the number of clients 2011.03.14 18:23:54 LOG7[6083:1]: libwrap_init: FD=5 allocated (blocking mode) 2011.03.14 18:23:54 LOG7[6083:1]: libwrap_init: FD=4 allocated (blocking mode) 2011.03.14 18:23:54 LOG7[6083:1]: libwrap_init: FD=6 allocated (blocking mode) 2011.03.14 18:23:54 LOG7[6083:1]: libwrap_init: FD=4 allocated (blocking mode) 2011.03.14 18:23:54 LOG7[6083:1]: libwrap_init: FD=7 allocated (blocking mode) 2011.03.14 18:23:54 LOG7[6083:1]: libwrap_init: FD=4 allocated (blocking mode) 2011.03.14 18:23:54 LOG7[6083:1]: libwrap_init: FD=8 allocated (blocking mode) 2011.03.14 18:23:54 LOG7[6083:1]: libwrap_init: FD=4 allocated (blocking mode) 2011.03.14 18:23:54 LOG7[6083:1]: libwrap_init: FD=9 allocated (blocking mode) 2011.03.14 18:23:54 LOG7[6083:1]: libwrap_init: FD=4 allocated (blocking mode) 2011.03.14 18:23:54 LOG7[6083:1]: signal_pipe: FD=4 allocated (blocking mode) 2011.03.14 18:23:54 LOG7[6083:1]: signal_pipe: FD=10 allocated (blocking mode) 2011.03.14 18:23:54 LOG7[6083:1]: accept socket: FD=11 allocated (non-blocking mode) 2011.03.14 18:23:54 LOG7[6083:1]: Option SO_REUSEADDR set on accept socket 2011.03.14 18:23:54 LOG7[6083:1]: Service TradeXpress bound to 0.0.0.0:17000 2011.03.14 18:23:54 LOG7[6083:1]: Service TradeXpress opened FD=11 2011.03.14 18:23:54 LOG7[6089:1]: Created pid file /home/aps/tfk/stunnel/var/run/stunnel/stunnel.pid 2011.03.14 18:23:54 LOG5[6089:1]: stunnel 4.35 on sparc-sun-solaris2.10 with OpenSSL 0.9.8r 8 Feb 2011 2011.03.14 18:23:54 LOG5[6089:1]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2011.03.14 18:23:54 LOG7[6089:1]: Dispatching signals from the signal pipe 2011.03.14 18:23:54 LOG7[6089:1]: Signal pipe is empty 2011.03.14 18:24:19 LOG7[6089:1]: local socket: FD=0 allocated (non-blocking mode) 2011.03.14 18:24:19 LOG7[6089:1]: Service TradeXpress accepted FD=0 from stunnelserveripaddress:61449 2011.03.14 18:24:19 LOG7[6089:2]: Service TradeXpress started 2011.03.14 18:24:19 LOG5[6089:2]: Service TradeXpress accepted connection from stunnelserveripaddress:61449 2011.03.14 18:24:19 LOG7[6089:2]: remote socket: FD=1 allocated (non-blocking mode) 2011.03.14 18:24:19 LOG6[6089:2]: connect_blocking: connecting proxyipaddress:80 2011.03.14 18:24:19 LOG7[6089:2]: connect_blocking: s_poll_wait proxyipaddress:80: waiting 10 seconds 2011.03.14 18:24:19 LOG5[6089:2]: connect_blocking: connected proxyipaddress:80 2011.03.14 18:24:19 LOG5[6089:2]: Service TradeXpress connected remote server from stunnelserveripaddress:61450 2011.03.14 18:24:19 LOG7[6089:2]: Remote FD=1 initialized 2011.03.14 18:24:19 LOG5[6089:2]: Negotiations for connect (client side) started 2011.03.14 18:24:19 LOG7[6089:2]: -> CONNECT tradewebipaddress:443 HTTP/1.1 2011.03.14 18:24:19 LOG7[6089:2]: -> Host: tradewebipaddress:443 2011.03.14 18:24:19 LOG7[6089:2]: -> 2011.03.14 18:24:19 LOG7[6089:2]: <- HTTP/1.1 200 Connection established 2011.03.14 18:24:19 LOG6[6089:2]: CONNECT request accepted 2011.03.14 18:24:19 LOG7[6089:2]: <- 2011.03.14 18:24:19 LOG5[6089:2]: Protocol negotiations succeeded 2011.03.14 18:24:19 LOG7[6089:2]: SSL state (connect): before/connect initialization 2011.03.14 18:24:19 LOG7[6089:2]: SSL state (connect): SSLv3 write client hello A 2011.03.14 18:24:19 LOG7[6089:2]: SSL state (connect): SSLv3 read server hello A 2011.03.14 18:24:19 LOG7[6089:2]: Starting certificate verification: depth=1, /C=US/ST=New York/L=New York/O=TradeWeb LLC - The Online Bond Markets/OU=Network Administration/CN=TradeWeb LLC - The Online Bond Markets/emailAddress=bruce.mackinnon(a)tradeweb.c 2011.03.14 18:24:19 LOG5[6089:2]: Certificate accepted: depth=1, /C=US/ST=New York/L=New York/O=TradeWeb LLC - The Online Bond Markets/OU=Network Administration/CN=TradeWeb LLC - The Online Bond Markets/emailAddress=bruce.mackinnon(a)tradeweb.com 2011.03.14 18:24:19 LOG7[6089:2]: Starting certificate verification: depth=0, /C=US/ST=New Jersey/L=Jersey City/O=TradeWeb LLC - The Online Bond Markets/OU=STP Production/CN=62.189.50.234 2011.03.14 18:24:19 LOG5[6089:2]: Certificate accepted: depth=0, /C=US/ST=New Jersey/L=Jersey City/O=TradeWeb LLC - The Online Bond Markets/OU=STP Production/CN=62.189.50.234 2011.03.14 18:24:19 LOG7[6089:2]: SSL state (connect): SSLv3 read server certificate A 2011.03.14 18:24:19 LOG7[6089:2]: SSL state (connect): SSLv3 read server certificate request A 2011.03.14 18:24:19 LOG7[6089:2]: SSL state (connect): SSLv3 read server done A 2011.03.14 18:24:19 LOG7[6089:2]: SSL alert (write): warning: no certificate 2011.03.14 18:24:19 LOG7[6089:2]: SSL state (connect): SSLv3 write client certificate A 2011.03.14 18:24:19 LOG7[6089:2]: SSL state (connect): SSLv3 write client key exchange A 2011.03.14 18:24:19 LOG7[6089:2]: SSL state (connect): SSLv3 write change cipher spec A 2011.03.14 18:24:19 LOG7[6089:2]: SSL state (connect): SSLv3 write finished A 2011.03.14 18:24:19 LOG7[6089:2]: SSL state (connect): SSLv3 flush data 2011.03.14 18:24:19 LOG7[6089:2]: SSL state (connect): SSLv3 read finished A 2011.03.14 18:24:19 LOG7[6089:2]: 0 items in the session cache 2011.03.14 18:24:19 LOG7[6089:2]: 1 client connects (SSL_connect()) 2011.03.14 18:24:19 LOG7[6089:2]: 1 client connects that finished 2011.03.14 18:24:19 LOG7[6089:2]: 0 client renegotiations requested 2011.03.14 18:24:19 LOG7[6089:2]: 0 server connects (SSL_accept()) 2011.03.14 18:24:19 LOG7[6089:2]: 0 server connects that finished 2011.03.14 18:24:19 LOG7[6089:2]: 0 server renegotiations requested 2011.03.14 18:24:19 LOG7[6089:2]: 0 session cache hits 2011.03.14 18:24:19 LOG7[6089:2]: 0 external session cache hits 2011.03.14 18:24:19 LOG7[6089:2]: 0 session cache misses 2011.03.14 18:24:19 LOG7[6089:2]: 0 session cache timeouts 2011.03.14 18:24:19 LOG6[6089:2]: SSL connected: new session negotiated 2011.03.14 18:24:19 LOG6[6089:2]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2011.03.14 18:29:25 LOG3[6089:2]: SSL_read: 140D5042: error:140D5042:SSL routines:SSL3_CTRL:called a function you should not call 2011.03.14 18:29:25 LOG5[6089:2]: Connection reset: 521 bytes sent to SSL, 0 bytes sent to socket 2011.03.14 18:29:25 LOG7[6089:2]: Service TradeXpress finished (0 left) RAMIREZ Julián Technical Consultant Wall Street Systems <http://www.wallstreetsystems.com/> - Empowering Treasury, Trading and Settlement

1 0

Stunnel configuration for multiple domains on single IP
by Amol 11 Mar '11

11 Mar '11

I was trying to configure stunnel to work for multiple domains on the same IP address, just wanted to know how to configure stunnel to listen on different ports? has anyone done it yet? [https-lo] cert=/etc/stunnel/ssl/group-cert.pem key = /etc/stunnel/ssl/lo.key accept=x.x.x.x:443 connect=x.xxx.xx.11:8000 TIMEOUTclose=0 xforwardedfor=yes [https-lo2] cert=/etc/stunnel/ssl/group2-cert.pem key = /etc/stunnel/ssl/lo2.key accept=xx.xx.xx.xx:444 connect=x.xxx.xx.11:80 TIMEOUTclose=0 xforwardedfor=yes but i still get this error when i access the second domain (lo2) (Error code: ssl_error_bad_cert_domain)

1 1

Periodic stunnel 4.34 core dumps on AIX 5.3
by Allex, Paul M (USA E D EA STS) 11 Mar '11

11 Mar '11

Hello, I have noticed that stunnel will periodically core dump on AIX 5.3. My configuration: stunnel 4.34 AIX 5.3 OpenSSL 0.9.8m After some initial investigation, I did find the following post about stunnel core dumps on AIX 5.3: http://www.stunnel.org/pipermail/stunnel-users/2007-April/001528.html Some of the core dumps were definitely due to this issue, so I rebuilt stunnel using the steps outlined in the post. Now I do not see the stack overflow core dumps, however I am still seeing other cores. These cores have little to no valuable information in them, so I do not have a lot to go off of. The one thing I have noticed is that stunnel seems to be consuming more and more memory over time. I set up several tests to see what would be causing this. Tests: 1. Send large amounts of data through stunnel using a simple client and server. This seemed to have no affect on the long term memory usage of stunnel. 2. Repeatedly create and drop connections to stunnel. For this I wrote a short script that simply creates a connection to stunnel using telnet in a a tight loop. I did not start anything for the stunnel instance to connect to, so telnet would create a connection and get it closed immediately. telnet --> stunnel --> nothing The process started with a size of 836 KB and seems to increase by about .1 to .2 KB per connection. $ count=1; while true; do tn localhost 10500; echo $count; count=$(( count + 1 )); done Trying... Escape character is '^T'. Connection closed. 1 ... Trying... Connected to loopback. Escape character is '^T'. Connection closed. 15475 Trying... Connected to loopback. Escape character is '^T'. Connection closed. 15476 Trying... Connected to loopback. Escape character is '^T'. Connection closed. 15477 $ monitor_process test_stunnel Size: 836 ... Size: 2556 Size: 2564 Size: 2564 Size: 2564 Size: 2568 Size: 2572 Size: 2572 Size: 2592 I have not dug into the code yet, so I suppose that will be my next task. If anyone has any ideas or suggestions on what else to look at, I would really appreciate it. Thanks, Paul Allex

2 2

Re: [stunnel-users] Periodic stunnel 4.34 core dumps on AIX 5.3
by Allex, Paul M (USA E D EA STS) 10 Mar '11

10 Mar '11

I let the connection/memory script run over night and it appears that stunnel's memory usage has plateaued at 131,432 KB. I'm not sure how many connections had occurred when the memory usage leveled of, but currently there have been over 1.7 million connections to stunnel. I guess for now, please don't waste any time on this issue until I gather more information. Paul Allex

1 0

error:14094412:SSL routines:SSL3_READ_BYTES:sslv3
by don-stunnel-zyx＠isis.cs3-inc.com 04 Mar '11

04 Mar '11

stuff in [brackets] is replaced to protect the innocent stunnel.conf: ================ debug=5 output=/root/stunnel.log cert=/etc/pki/tls/certs/[certfile] CAfile=/etc/pki/tls/certs/[bundle].crt key=/etc/pki/tls/private/[private-key].key [debug] accept=801 client=yes connect=[...].com:443 ================ I then connect to localhost:801 and stunnel.log contains: ================ 2011.02.28 19:18:45 LOG5[20520:3086252944]: debug connected from 127.0.0.1:38472 2011.02.28 19:18:46 LOG3[20520:3086252944]: SSL_connect: 14094412: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate 2011.02.28 19:18:46 LOG5[20520:3086252944]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket ================ I don't see anything wrong with the cert or private key - the following demo shows that at least openssl is happy with them: ================ echo "hello there" | openssl rsautl -certin -inkey /etc/pki/tls/certs/[certfile] -encrypt |openssl rsautl -inkey /etc/pki/tls/private/[private-key].key -decrypt hello there I've captured the packets sent between stunnel and the server and wireshark shows (at ssl level) client SSLv3 Client Hello server SSLv3 Server Hello, Certificate, Certificate Request, Server Hello Done client SSLv3 Certificate, Client Key Exchange, Certificate Verify, Change Cipher Spec, Encrypted Handshake Message server SSLv3 Alert (Level: Fatal, Description: Bad Certificate) followed by TCP resets So the server is complaining about my certificate. This is certainly not what I would have guessed the message in the log meant. It looks like an error from stunnel. So is it an error from stunnel or is it stunnel reporting a complaint from the server? And if the latter, what exactly did the server send? The entire message starting with error? or starting with 14094412? or what? Could this mean that the server doesn't understand the certificate (cause it's a 2K certificate instead of 1K?) or could it mean that the server doesn't like it for some other reason?

2 2

curl: (35) error:14094412:SSL routines:SSL3_READ_BYTES:sslv3
by don-stunnel-zyx＠isis.cs3-inc.com 01 Mar '11

01 Mar '11

Here's my command curl -E /root/key-cert https://ewsg-cert.prudent... and the result: curl: (35) error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate This seems weird to me: Note that this certificate is the private key and the private certificate concatenated! I assume the private certificate is just the certificate. In any case my file key-cert looks like -----BEGIN RSA PRIVATE KEY----- ... -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- What does the error above mean and what could I possibly be doing wrong to cause it?

1 1

forcing my untangle server to scan my https traffic
by Bing H Bang 01 Mar '11

01 Mar '11

I'm so close to making this work, I can taste it. I also need some suggestions on how to fix the last hurdle. My setup 10.0.0.10 ip of my webserver 24.159.165.122 static ip of my untangle server (router mode) untangle server port forwards 443 to 10.0.0.10:10443 80 to 10.0.0.10:80 (web server only listens on 443) stunnel config file on the web server [https-terminate] client = no cert = /var/lib/stroot/cypherdog.com.pem accept = 10.0.0.10:10443 connect = 24.159.165.122:80 [https-re-engage] client = yes accept = 10.0.0.10:80 connect = 10.0.0.10:443 What I'm trying to do is accept https traffic, decrypt it, pass it through untangle, then encrypt it back as it gets delivered to the https port of the web server. This setup works in that I can point my browser at the https port of my untangle server and the web pages work properly. What doesn't work is the untangle server shows no scanning activity when I access the web pages. I think the path webserver->untangle->webserver does not trigger the scanning in untangle because the traffic it sees is from an internal ip going to the same internal ip. Is there a way to fix this, anyone?

3 3

Upgrade of evil.patch for version 4.35
by Jeremie Le Hen 22 Feb '11

22 Feb '11

Hi Michal, One of my former coworker and now friend undertook the upgrade of contrib/misc/evil.patch against the latest stunnel version. Would you mine putting this new version on your FTP site please? Thanks a lot. Regards, -- Jeremie Le Hen Humans are born free and equal. But some are more equal than others. Coluche

1 0

Problems SSLifying an "exec" Service without KeepAlive
by Jochen Bern 22 Feb '11

22 Feb '11

Hello everyone, today I tried to set up network access to a service using stunnel 4.35. The underlying service, by default, exits after every request+reply. When running stunnel in daemon mode, this seems to upset things such that subsequent connections hang. I cannot quite pinpoint whether it's a config problem, design (of my setup) problem, or bug, so any help's welcome ... More info: The underlying service accesses a Nagios' livestatus interface > http://mathias-kettner.de/checkmk_livestatus.html#H1:Remote%20access%20to%2… using the "unixcat" tool provided. Unless you specifically request connection keepalives, unixcat will close/exit after answering one request, *or* timing out waiting for one. That "exit procedure", AFAICT, isn't different from what the imapd or pppd in the stunnel(8) manpage's EXAMPLES section do ... I need to secure access to the service, so I'm throwing client cert verification and libwrap at the connections. The current daemon mode configuration (with several commented-out attempts) reads, slightly anonymized: client=no verify=3 pid=/var/run/stunnel/livestatus.pid #setuid=stunnel #socket = a:SO_REUSEADDR=0 #foreground= yes [livestatus] accept = [...PORT...] cert = [...SERVER...].pem key = [...SERVER...].key CAfile = [...CA...].pem CApath = [...TempStagingDirectory...] exec = /usr/local/bin/unixcat execargs = unixcat /var/lib/nagios3/rw/live pty = yes retry = no session = 3 #TIMEOUTclose = 0 #TIMEOUTbusy = 5 #TIMEOUTidle = 5 After starting the stunnel daemon, I can perform *one* normal connection: > # openssl s_client -CAfile [...CA...].pem -showcerts \ > > -connect [...SERVER...]:[...PORT...] -cert [...CLIENT...].cert \ > > -key [...CLIENT...].key -state > CONNECTED(00000003) > SSL_connect:before/connect initialization > SSL_connect:SSLv2/v3 write client hello A > SSL_connect:SSLv3 read server hello A [...] > SSL handshake has read 1743 bytes and written 1933 bytes > --- > New, TLSv1/SSLv3, Cipher is AES256-SHA > Server public key is 1024 bit > Compression: NONE > Expansion: NONE > SSL-Session: > Protocol : TLSv1 > Cipher : AES256-SHA > Session-ID: 1B4221E2917E3BD49AA2102C2CCE60A624DB256D6B4D61F9D0D77EA843DC31BC > Session-ID-ctx: > Master-Key: 57E6DF8E7E0A741B718E356467450DD00969465295A9C6FE03416ED16E74AF93058EC168EF6DF1B9F3F637F505FF6EF4 > Key-Arg : None > Start Time: 1298390481 > Timeout : 300 (sec) > Verify return code: 0 (ok) > --- At that point, I can type in one request, then unixcat terminates, stunnel closes the connection and s_client (?) reports: > read:errno=104 Typical log output on the server side: > LOG5[30042:139819109037792]: Reading configuration from file /etc/stunnel/livestatus.conf > LOG5[30042:139819109037792]: Peer certificate location [...TempStagingDirectory...] > LOG5[30042:139819109037792]: Configuration successful > LOG5[30042:139819109037792]: No limit detected for the number of clients > LOG5[30043:139819109037792]: stunnel 4.35 on x86_64-unknown-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 > LOG5[30043:139819109037792]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 [...] > LOG5[30043:1075198288]: Service livestatus accepted connection from [...CLIENT...]:39287 > LOG5[30043:1075198288]: Certificate accepted: depth=1, [...CA...] > LOG5[30043:1075198288]: Certificate accepted: depth=0, [...CLIENT...] > LOG3[30043:1075198288]: readsocket: Input/output error (5) > LOG5[30043:1075198288]: Connection reset: 2293 bytes sent to SSL, 33 bytes sent to socket Rerunning the exact same command stops dead after the > CONNECTED(00000003) and manually "telnet"ing to the port from a different host doesn't behave in a normal way (closing the connection after I type the first line of non-SSL stuff) anymore, either. Running the unixcat command from a local command line, however, still works normally. I tried running stunnel off inetd, which seems to work, so I'd guess it's the server-side SSL session cacheing which interferes. However, I don't see any related stunnel config keywords in the manpage, and stunnel offering a cached session to a connection *from a different client host* sound odd to me, too ... ? Kind regards, J. Bern -- Jochen Bern, Systemingenieur --- LINworks GmbH <http://www.LINworks.de/> Postfach 100121, 64201 Darmstadt | Robert-Koch-Str. 9, 64331 Weiterstadt PGP (1024D/4096g) FP = D18B 41B1 16C0 11BA 7F8C DCF7 E1D5 FAF4 444E 1C27 Tel. +49 6151 9067-231, Zentr. -0, Fax -299 - Amtsg. Darmstadt HRB 85202 Unternehmenssitz Weiterstadt, Geschäftsführer Metin Dogan, Oliver Michel

1 0

New and Utterly Confused on Ubuntu Linux
by Traps 20 Feb '11

20 Feb '11

I am totally new to stunnel and am quite confused. I use Ubuntu 10.04 and have installed the stunnel4 deb package. I need to do a couple of things. At boot up I need to accept ssl connections on an inbound port and forward it to a non-ssl compliant app listening on another port. The second thing I need to do is make an ssl required connection to a pop server on another host out of a non-ssl mail client on the local machine. I have no problem with the ports, port forwarding, etc. I just do not know how to set up stunnel to accomplish this. Let's just use this as an example: 1. I need to accept inbound ssl connections on 995 (port 995 is open) and send them to the local machine non-ssl client listening on 2995. 2. I need to ssl connect to pop.gmail.com:995 via a non-ssl mail client on the local machine and I want the mail client to connect to stunnel on port 3995. 3. I need both of these scenarios to start at boot up. I don't even know where to start with stunnel4 to do this. Actually I can set up stunnel.conf for either but one's a server operation and the other is a client operation and can't get them both to work simultaneously. To start stunnel at boot up I simply edited /etc/default/stunnel and /etc/init.d/stunnel4 and changed ENABLED=0 to ENABLED=1 in both files. Something tells me this is entirely the wrong way to do what I want to do. It works for either the client task or the server task, depending on which one I have enabled in stunnel.conf but I just know this is not how I am suppose to be doing it. Will someone help? -- View this message in context: http://old.nabble.com/New-and-Utterly-Confused-on-Ubuntu-Linux-tp30970693p3… Sent from the Stunnel - Users mailing list archive at Nabble.com.

2 1

fips=no
by dominic.schweizer＠zkb.ch 18 Feb '11

18 Feb '11

Hi All, I have the problem that when I start Stunnel, the following error pops up: FIPS_mode_set: 2D06C06E: error:2D06C06E:FIPS routines:FIPS_mode_set:fingerprint does not match I now added in my config file: fips=no and it works. My question is now, what is the difference between with fips and without fips? stunnel version 4.34 openssl 0.9.8 redhat 5 Thanks in advance for the answer Regards Dominic Freundliche Grüsse Dominic Schweizer Zürcher Kantonalbank Unix System Engineer, LIOEU Neue Hard 9, 8005 Zürich Telefon 044 292 83 52, Fax 044 292 80 34 Briefadresse: Postfach 8010 Zürich, http://www.zkb.ch Sie drucken dieses E-Mail nicht aus? Die Umwelt dankt! ___________________________________________________________________ Disclaimer : Diese Mitteilung ist nur fuer die Empfaengerin / den Empfaenger bestimmt. Fuer den Fall, dass sie von nichtberechtigten Personen empfangen wird, bitten wir diese hoeflich, die Mitteilung an die ZKB zurueckzusenden und anschliessend die Mitteilung mit allen Anhaengen sowie allfaellige Kopien zu vernichten bzw. zu loeschen. Der Gebrauch der Information ist verboten. This message is intended only for the named recipient and may contain confidential or privileged information. If you have received it in error, please advise the sender by return e-mail and delete this message and any attachments. Any unauthorised use or dissemination of this information is strictly prohibited.

2 1

openvpn with stunnel
by Guy Sapir 17 Feb '11

17 Feb '11

Hi all, Is it possible to use openvpn on port 80 or 443 using stunnel so the packets on openvpn will be wrapped as http or https pure packets. What should I do in the config file. Guy Sapir

2 1

Wireshark didn't show TLSv1 traffic?
by Bao, Robert 17 Feb '11

17 Feb '11

Hi, I have "ciphers = AES256-SHA" option in stunnel.conf file. And when the server/client established the connection, I see this line in the log file: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 However when I use Wireshark to sniff the traffic, I only see "TCP" in the <Protocol> column for the traffics between the server and the client. Is this normal? What did I do wrong? Thanks. Robert Bao Software House Tyco International 978-577-4202 Explore our new Tyco Online Learning Center Web-based Training Bundles at: www.swhouse.com/support/tyco_online_learning_center.aspx This e-mail may contain or have attached to it information or technology the export or re-export of which is restricted by U.S. laws and regulations. By viewing this e-mail and any attachments, the recipient agrees to the following: (i) the recipients use of the contents of this e-mail and any attachments shall comply with all applicable laws, rules and regulations, including, without limitation, U.S. international trade laws and regulations, and (ii) the recipient may not transfer or otherwise export or re-export any information or technology contained in this e-mail or any attachment except in full compliance with the export controls administered by the U.S. and other countries and any applicable import and use restrictions.

2 2

key+cert+dh risks
by Jean-Yves F. Barbier 15 Feb '11

15 Feb '11

Hi list, I'm using stunnel between two machines only, so is there a risk to reuse the server stunnel.pem on the client? (and if it's risky, why?) JY -- Have a coke and a smile! -- John DeLorean

3 6

Confusion regarding part of stunnel.conf
by Dave 12 Feb '11

12 Feb '11

I've set up a test of stunnel with the latest stunnel and latest openssl, and if I set "verify=0" or "verify=1" I can get it to work (I'm tunneling a pop3 session), but if I set it any higher (to 2 or 3) it won't work for me. Now, I'm not sure which level is "necessary" because in stunnel.conf I read: ------------------------- ; authentication stuff needs to be configured to prevent MITM attacks ; it is not enabled by default! ;verify = 2 ------------------------- ... which sounds like verify defaults to 0. But is a verify level of 1 enough to solve the man-in-the-middle problem? It seems like it would not be (since level 1 will allow absence of a certificate), but I am not sure. I guess my questions boil down to: 1) What are the necessary settings for "authentication stuff" to prevent the MITM attack vector mentioned in stunnel.conf? 2) What is the proper way to set up (self-signed) certs to prevent such an attack? Can a self-signed cert be used at a verify level of 2 or 3? Dave

2 11

[patch] Unix socket support for Stunnel
by Stefan Behte 11 Feb '11

11 Feb '11

Hi, yet another request for a patch inclusion... Quoting from http://haproxy.1wt.eu/#down : "This patch contributed by Exceliance adds to stunnel the ability to connect to haproxy over a UNIX stream socket instead of using TCP. Sometimes this can be more convenient and/or more secure. " I think it would be nice to have it upstream. And I hope I am not bothering Michals yet. ;) Best regards, Stefan Behte

1 0

Security Problems with 4.35
by Stefan Behte 10 Feb '11

10 Feb '11

Hi, in the announcement of 4.35, I saw: "CLOEXEC file descriptor leaks fixed on Linux >= 2.6.28 with glibc >= 2.10. Irreparable race condition leaks remain on other Unix platforms. This issue may have security implications on some deployments." I searched a bit, but did not find an exploit or more information on the severity of this issue. Could someone elaborate the problem a bit? I could diff to the previous version and have a look, but that will take quite some time, and my C is weak... Best regards, Stefan Behte

2 1

use somaxconn in stunnel
by Stefan Behte 10 Feb '11

10 Feb '11

Hi, attached you will find a patch from Thomas Franco to honor SOMAXCONN. It defaults to 128, which is not enough for some setups. It defines the maximum number of requests that can be queued to a listening socket and can be changed with sysctl via net.core.somaxconn. I think it would be nice to have it in stunnel-4.36 to make it usable in bigger installations. It's available online here: https://github.com/op4g/stunnel/commit/e200bebaf92c068aa319c43fdd50cddd6816… Best regards, Stefan Behte

2 4

publish/subscribe with stunnel
by Dam Dam 10 Feb '11

10 Feb '11

Hello, I am having a problem to configure stunnel in a publish/subscribe architecture. Basically, I have a publisher service configured with stunnel as a server. Its configuration is close to: [publisher] accept = p1 connect = 127.0.0.1:p2 This service publishes data to a subscriber. As far I as understood, the subscriber should be configured as a client with stunnel with a configuration close to this: [subscriber] accept = p3 connect = remote:p1 client = yes Now, my problem is that the subscriber does not listen on any port. So p3 does not actually exist. When the subscriber starts, it automatically connects and subscribes to the publisher and waits for data from the publisher service. I would like to secure the connection between the publisher and the subscriber but I am stuck with the configuration. Any ideas? Regards, Damien

2 1

stunnel, haproxy and ssl cert
by Amol 10 Feb '11

10 Feb '11

i got the SSL setup done with the stunnel, but when i connect from the url i always see this entry in my stunnel.log 2011.02.09 14:52:34 LOG3[2433:139832543721216]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing my stunnel config is cert=/etc/stunnel/ssl/group-cert.pem key = /etc/stunnel/ssl/l.key ;setuid = nobody ;setgid = nogroup pid = /etc/stunnel/stunnel.pid debug = 3 output = /etc/stunnel/stunnel.log socket=l:TCP_NODELAY=1 socket=r:TCP_NODELAY=1 [https] accept=443 connect=80 TIMEOUTclose=0 xforwardedfor=yes i have just got familiar to stunnel to not sure i that error is ok?

2 3

Help with stunnel configuration
by Rohler, Brian L 09 Feb '11

09 Feb '11

I'm looking to see if the windows version of stunnel (4.34) can be executed from a command line and have it configured to connect and accept on different ports?

1 0

X-Forwarded-For / X-Forwarded-Proto
by Stefan Behte 09 Feb '11

09 Feb '11

Hello Michal, I've read that you prefer not to support X-Forwarded-For because an old code had a buffer overflow and did not support keep-alive functions of HTTP/1.1. I believe the overflow was fixed in the newer version of the patch I've attached. IMHO the patch will still be very useful, even if it does not support keep-alive: often in high-performence setups keep-alive is not even desired because it fills up ressources needlessly. Even if this does not provide all features, a lot of people would be satisfied with it. There is a great desire for this patch, if one searches for "stunnel x-forwarded-for" on google, you will find more than 60 pages and not only a few dozens of blogs/mailing lists that discuss applying the patch and getting it to work as an SSL terminator for loadbalancing software. And last, I know that the patch (the one Willy Tarreau is hosting on haproxy.1wt.eu and is attached) is in use at several high-traffic websites and runs stable. ;) If it's too much of a hassle for you to review and/or integrate the patch, I can understand that very well, I'd just like to open a discussion and would like to know if you have concerns regarding the patch quality, even if you do not want to include the patch at this time. :) Best regards, Stefan Behte

2 1

stunnel HUP bug
by Stefan Behte 09 Feb '11

09 Feb '11

Hi, kill -HUP does not seem to work for me with 4.35, I always get: 2011.02.07 17:51:25 LOG5[14988:139705784043264]: Received signal 15; terminating Best regards, Stefan Behte Babiel GmbH Moskauer Str. 27 D-40227 Düsseldorf Tel: 0211-179349 0 Fax: 0211-179349 29 E-Mail: S.Behte(a)babiel.com Internet: http://www.babiel.com

2 6

stunnel libwrap/tcpwrapper bug (patch included)
by Stefan Behte 09 Feb '11

09 Feb '11

Hi, I stumbled upon a really old bug in stunnel: ./configure --enable-libwrap && make [...] mv -f .deps/pty.Tpo .deps/pty.Po gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.35\" -DPACKAGE_STRING=\"stunnel\ 4.35\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE_URL=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.35\" -D_GNU_SOURCE=1 -DHOST=\"i686-pc-linux-gnu\" -DCPU_I686=1 -DVENDOR_PC=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DLT_OBJDIR=\".libs/\" -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_TCPD_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LINUX_NETFILTER_IPV4_H=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBZ=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_GETCONTEXT=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_PIPE2=1 -DHAVE_ACCEPT4=1 -DHAVE_OPENSSL=1 -Dssldir=\"/usr\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_IPv6=1 -DHAVE_LIBWRAP=1 -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wextra -pedantic -Wno-long-long -I/usr/include -MT libwrap.o -MD -MP -MF .deps/libwrap.Tpo -c -o libwrap.o libwrap.c libwrap.c: In function 'libwrap_init': libwrap.c:91: warning: ignoring return value of 'write', declared with attribute warn_unused_result mv -f .deps/libwrap.Tpo .deps/libwrap.Po /bin/sh ../libtool --tag=CC --mode=link gcc -g -O2 -Wall -Wextra -pedantic -Wno-long-long -I/usr/include -o stunnel file.o client.o log.o options.o protocol.o network.o resolver.o ssl.o ctx.o verify.o sthreads.o stunnel.o pty.o libwrap.o -lz -ldl -lutil -lnsl -lpthread -L/usr/lib64 -L/usr/lib -lssl -lcrypto /bin/sh: warning: setlocale: LC_ALL: cannot change locale (c) libtool: link: gcc -g -O2 -Wall -Wextra -pedantic -Wno-long-long -I/usr/include -o stunnel file.o client.o log.o options.o protocol.o network.o resolver.o ssl.o ctx.o verify.o sthreads.o stunnel.o pty.o libwrap.o -lz -ldl -lutil -lnsl -lpthread -L/usr/lib64 -L/usr/lib -lssl -lcrypto libwrap.o: In function `check': /usr/portage/distfiles/stunnel-4.35/src/libwrap.c:194: undefined reference to `request_init' /usr/portage/distfiles/stunnel-4.35/src/libwrap.c:195: undefined reference to `sock_host' /usr/portage/distfiles/stunnel-4.35/src/libwrap.c:196: undefined reference to `hosts_access' collect2: ld returned 1 exit status make[1]: *** [stunnel] Error 1 make[1]: Leaving directory `/usr/portage/distfiles/stunnel-4.35/src' make: *** [all-recursive] Error 1 The attached patch solves the problem; it would be cool, if you could include it in the next release. Best regards Stefan Behte Babiel GmbH Moskauer Strasse 27 D-40227 Düsseldorf Tel: 0211-179349 0 Fax: 0211-179349 29 E-Mail: S.Behte(a)babiel.com Internet: http://www.babiel.com Geschäftsführer: Georg Babiel, Dr. Rainer Babiel, Harald Babiel Amtsgericht Düsseldorf HRB 38633 ~~~~~~~~~~~~~~ DISCLAIMER ~~~~~~~~~~~~~~~ The information transmitted in this electronic mail message may contain confidential and or privileged materials. Any review, retransmission, dissemination or other use of or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you receive such e-mails in error, please contact the sender and delete the material from any computer.

2 2

Using CA intyermediate on stunnel problem
by Abdelkarim Mateos Sanchez 08 Feb '11

08 Feb '11

Hi. We are using RapidSSL certificate for my hosts. We are using stunnel for ASSP (AntiSpam Proxy System) We are trying use this certificate but get some errors. We are looking for solution but problem persist, cert = /etc/stunnel/cpanel.pem chroot = /usr/local/cpanel/var/run/stunnel-assp/ pid = /stunnel.pid setuid = stunnel setgid = stunnel output = /var/log/stunnel.log [ssmtp] accept = 465 connect = 127.0.0.2:26 #CAfile = /etc/stunnel/cpanel.cabundle #CApath = /etc/stunnel/rapidssl/ When try connect get this error depth=0 /serialNumber=cso/HwRW/nTj87jIivvttDvfpI7rUt2c/C=ES/O=genesis.islaserver.com/OU=GT15685418/OU=See www.rapidssl.com/resources/cps (c)11/OU=Domain Control Validated - RapidSSL(R)/CN=genesis.islaserver.com verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 /serialNumber=cso/HwRW/nTj87jIivvttDvfpI7rUt2c/C=ES/O=genesis.islaserver.com/OU=GT15685418/OU=See www.rapidssl.com/resources/cps (c)11/OU=Domain Control Validated - RapidSSL(R)/CN=genesis.islaserver.com verify error:num=27:certificate not trusted verify return:1 depth=0 /serialNumber=cso/HwRW/nTj87jIivvttDvfpI7rUt2c/C=ES/O=genesis.islaserver.com/OU=GT15685418/OU=See www.rapidssl.com/resources/cps (c)11/OU=Domain Control Validated - RapidSSL(R)/CN=genesis.islaserver.com verify error:num=21:unable to verify the first certificate verify return:1 Of /etc/stunnel/cpanel.pem there're KEY and CERT for host CA intermediate certificate for RapidSSL I'm lost. Apreciate help.

2 1

stunnel 4.35 released
by Michal Trojnara 05 Feb '11

05 Feb '11

Dear Users, I'm pleased to announce long-awaited version 4.35 of stunnel. The ChangeLog entry: * New features - Updated Win32 DLLs for OpenSSL 1.0.0c. - Transparent source (non-local bind) added for FreeBSD 8.x. - Transparent destination ("transparent = destination") added for Linux. * Bugfixes - Fixed reload of FIPS-enabled stunnel. - Compiler options are now auto-detected by ./configure script in order to support obsolete versions of gcc. - Async-signal-unsafe s_log() removed from SIGTERM/SIGQUIT/SIGINT handler. - CLOEXEC file descriptor leaks fixed on Linux >= 2.6.28 with glibc >= 2.10. Irreparable race condition leaks remain on other Unix platforms. This issue may have security implications on some deployments. - Directory lib64 included in the OpenSSL library search path. - Windows CE compilation fixes (thx to Pierre Delaage). - Deprecated RSA_generate_key() replaced with RSA_generate_key_ex(). * Domain name changes (courtesy of Bri Hatch) - http://stunnel.mirt.net/ --> http://www.stunnel.org/ - ftp://stunnel.mirt.net/ --> http://ftp.stunnel.org/ - stunnel.mirt.net::stunnel --> rsync.stunnel.org::stunnel - stunnel-users(a)mirt.net --> stunnel-users(a)stunnel.org - stunnel-announce(a)mirt.net --> stunnel-announce(a)stunnel.org Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.35.tar.gz: a810e220498239483e14fae24eeb2a188a6167e9118958b903f8793768c4460f Best regards, Mike

1 0

Compiling with ./configure --enable-fips option
by Lewis, Joseph E Sr Mr CTR USA USA 01 Feb '11

01 Feb '11

I am having a problem with compiling with fips enable mode on. The default is suppose to fips enabled but when the configure runs with no options it states that fips is not enabled and the make runs successfully. When I use the –enable-fips option, the configure runs just fine but the make fails with : In file included from common.h:374, from file.c:38: /usr/include/openssl/fips.h:69:2: error: #error FIPS is disabled. make: 1254-004 The error code from the last command is 1. Stop. make: 1254-004 The error code from the last command is 1. Stop. IBM support assures me that FIPS is enabled. At this point I am stuck and do not know what to do next. Can anyone offer any suggestions? My system, oslevel, ssl level, etc… are as follows: $ uname -a AIX velssi02 3 5 00C866124C00 $oslevel –s AIX 5300-12-02-1036 $ lslpp -l | grep libc bos.rte.libc 5.3.12.2 COMMITTED libc Library bos.rte.libcfg 5.3.12.1 COMMITTED libcfg Library bos.rte.libcur 5.3.11.0 COMMITTED libcurses Library $ gcc -v Using built-in specs. Target: powerpc-ibm-aix5.3.0.0 Configured with: ../configure --with-as=/usr/bin/as --with-ld=/usr/bin/ld --enable-languages=c,c++,java --prefix=/opt/freeware --enable-threads --enable-version-specific-runtime-libs --host=powerpc-ibm-aix5.3.0.0 --target=powerpc-ibm-aix5.3.0.0 --build=powerpc-ibm-aix5.3.0.0 --disable-libjava-multilib Thread model: aix gcc version 4.2.0 $ ssh –V OpenSSH_5.2p1, OpenSSL 0.9.8k-fips 25 Mar 2009 stunnel-4.34 $ /usr/local/bin/stunnel/stunnel -version stunnel 4.32 on powerpc-ibm-aix5.3.0.0 with OpenSSL 0.9.8k-fips 25 Mar 2009 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Global options debug = daemon.notice pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none

2 2

malformed packets - follow-up
by Jean-Yves F. Barbier 01 Feb '11

01 Feb '11

Hi list, After asking a friend about these errors, it appear they come from large packets reassembly; so my questions are: does it come from stunnel or http-tunnel? & if it is stunnel, is there an easy way to fine tune the max packet size? JY -- We totally deny the allegations, and we're trying to identify the allegators.

1 0

Stunnel to IRC (quakenet)
by s 31 Jan '11

31 Jan '11

Greetings all, I'm trying to set up stunnel for use with IRC for the first time, and everything appears to work dandy until I try to connect to connect to the various servers, I which I receive errors of the following type: 2011.01.31 16:06:39 LOG5[2212:2640]: Service 6001 accepted connection from 127.0.0.1:37345 2011.01.31 16:06:39 LOG5[2212:2640]: connect_blocking: connected 213.131.156.50:6667 2011.01.31 16:06:39 LOG5[2212:2640]: Service 6001 connected remote server from 10.1.4.13:37346 2011.01.31 16:06:40 LOG3[2212:2640]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2011.01.31 16:06:40 LOG5[2212:2640]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Below is my stunnel.conf: cert = C:\temp\downloads\stunnel\stunnel.pem key = C:\temp\downloads\stunnel\stunnel.pem client = yes [6001] accept = 6001 connect = irc.quakenet.org:6667 [6002] accept = 6002 connect = irc.fu-berlin.de:6667 [6003] accept = 6003 connect = eu.undernet.org:6667 [6004] accept = 6004 connect = irc.servercentral.net:6667 Can anyone explain to me the significance of my error? Thank you very much, S

1 0

malformed packets
by Jean-Yves F. Barbier 30 Jan '11

30 Jan '11

server: xp sp3, 4.34, http-tunnel (192.168.1.251) client: vm virtualbox xp sp3 under Debian Linux sid, 4.34, http-tunnel purpose: secured tunneling of an RDP access =================== Hi list, As I made a wireshark packet analysis, I noticed that *every* packet coming from the server id tagged [Malformed Packet], ie: No Time Source SrcP Destination DstP Protocol 620 37.247880 192.168.1.251 443 192.168.1.26 1062 SSLv3 Info Continuation Data [Malformed Packet] The protocols analyse window says 25% packets are malformed. Could you tell me where it comes from, if it generates extra traffic and if so, how I can fix that? (this setup will be used on a laptop that connect to the internet with a cell phone, so each byte has a cost.) JY -- You will be dead within a year.

1 0

How to define stunnel.conf so openvpn packet will go thru stunnel to as HTTP?
by Guy Sapir 22 Jan '11

22 Jan '11

Hi, >From what I read the examples in stunnel site it possible to wrap VPN's using Stunnel tool. Is it possible to do it for openvpn packets? I can configure thru the openvpn configurations that it packets will go thru port 80 and use TCP but the packets are not http pure. I need to wrap this packets using the stunnel tool. The purpose is to use openvpn over http. I will appreceate if someone can give me a solution for combinig Stunnel and openvpn if possible. Thanks

2 1

s_poll_wait timeout: connection reset
by manoj kumar 19 Jan '11

19 Jan '11

Hi, We have a problem in our production system. Need help to isolate the cause. Want to know whether issue is with stunnel. We are not in situation to upgrade, since we are in production. Your help is appreciated. Environment: 1) Client program(java in win desktops) connect to server (solaris) Stunnel port which is forwarded locally to an inetd program which connects to oracle database. ( 2 Tier Architecture ) 2) Setup worked for almost 2 years without any issue, suddenly since last September, we have connection reset issue on app clients intermittently. 3) almost lots of clients ( in 100's ) get reset and we find 100's of below messages in /var/adm/messages file of solaris. stunnel: [ID 821868 daemon.info] LOG6[21204:5272]: s_poll_wait timeout: connection reset stunnel: [ID 821868 daemon.notice] LOG5[21204:4804]: Connecti on reset: 1867341 bytes sent to SSL, 55211 bytes sent to socket 4) After reset, Client attempt to relogin works without any issue. there is no pattern of load, time, no of users. 5) all the database, inetd program, stunnel runs with oracle userid 6) No other OS related, resource related errors in /var/adm/messages. 7) At this point, i dont have stunnel debug log during the problem occurrence , since we have cron job that recycles logs. if required will send later. 8) Interms of change happend before the first occurance of issue, we did CPU/RAM upgrade, Oracle Database CPU Patch. But database team says no errors reported on oracle side during reset. 9) Max users on database is around 1024, which our max users is 300. ******************************************************************** Config: #/usr/local/bin/stunnel -version stunnel 4.25 on sparc-sun-solaris2.10 with OpenSSL 0.9.7d 17 Mar 2004 (+ security fixes for: CVE-2005-2969 CVE-2006-2937 CVE-2006-2940 CVE-2006-3738 CVE-2006-4339 CVE-2006-4343 CVE-2007-5135 CVE-2007-3108 CVE-2008-5077 CVE-2009-0590 CVE-2009-3555) Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!DHE-RSA-AES256-SHA:!DHE-DSS-AES256-SHA:!AES256-SHA:!ADH:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none ------------------------------------------------- #uname -a SunOS xxxxxxxxxx 5.10 Generic_144488-02 sun4u sparc SUNW,SPARC-Enterprise --------------------------------------------------------------------- # gcc -v Reading specs from /usr/sfw/lib/gcc/sparc-sun-solaris2.10/3.4.3/specs Configured with: /sfw10/builds/build/sfw10-patch/usr/src/cmd/gcc/gcc-3.4.3/configure --prefix=/usr/sfw --with-as=/usr/ccs/bin/as --without-gnu-as --with-ld=/usr/ccs/bin/ld --without-gnu-ld --enable-languages=c,c++ --enable-shared Thread model: posix gcc version 3.4.3 (csl-sol210-3_4-branch+sol_rpath) ------------------------------------------------------------------------ # openssl version OpenSSL 0.9.7d 17 Mar 2004 (+ security fixes for: CVE-2005-2969 CVE-2006-2937 CVE-2006-2940 CVE-2006-3738 CVE-2006-4339 CVE-2006-4343 CVE-2007-5135 CVE-2007-3108 CVE-2008-5077 CVE-2009-0590 CVE-2009-3555) ----------------------------------------------------------------------------- # more avaloq.conf ( Ssl config file we use /usr/local/bin/stunnel /opt/app/ssl/stunnel.conf ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /opt/app/ssl/cert.pem key = /opt/app/ssl/cert.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = all ; Some security enhancements for UNIX systems - comment them out on Win32 ;chroot = /usr/local/var/lib/stunnel/ ;setuid = nobody ;setgid = nogroup ; PID is created inside chroot jail pid = /opt/app/ssl/avaloq_ssl/avaloq.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /usr/local/etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /usr/local/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = /db/avaloq/export/stunnel.log ; Use it for client mode ;client = yes ; Service-level configuration [application] accept =7766 connect =localhost:7767 TIMEOUTconnect = 60 ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini -------------------------------------------------------------------------------- #netstat -an |grep 7766 |wc -l 249 Regards, kumar

2 5

What legal issues come up if I use GPL-incompatible libraries with GPL software?
by Michal Trojnara 17 Jan '11

17 Jan '11

Dear Users, I just noticed some people declare GPL license on stunnel patches. Since stunnel uses GPL license *with OpenSSL exception* (OpenSSL license is not GPL-compatible), it cannot be distributed if it is linked against any GPL code (patches, libraries) without this exception. It is still legal to distribute stunnel with patches that use GPL license with OpenSSL exception. Such patches constitute forks of stunnel and will *never* be accepted to my source tree. Third party patches rarely meet my quality criteria, but I occasionally accept patches released as public domain or having their copyright ownership transferred to me. Also see: http://www.gnu.org/licenses/gpl-faq.html#GPLIncompatibleLibs https://secure.wikimedia.org/wikipedia/en/wiki/Fork_%28software_development… Mike

1 0

Re: [stunnel-users] Multi Tunnel Support in STunnel
by Narendra Prasad Madanapalli 16 Jan '11

16 Jan '11

I'm sorry, if my previous mail explained the problem differently. Stunnel does load balancing when multiple connect statements are specified in a section as in the below mail. The scenario is something like http://mirt.net/pipermail/stunnel-users/2006-May/001139.html and explained below N servers each running a service of the same service-program (e.g: ip1:2345, ip2:2345, ... ipN:2345) A management server running on a different server (ipM:6789) is required to connect to all or a subset of the above servers through stunnel based on the user request. I couldn't find this feature supported by stunnel in the man page. I would appreciate if you provide any information on this. Thanks, Narendra. > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Narendra Prasad Madanapalli wrote: > > connect = ip1:5678,ip2:5678,ip3:5678,...ipn:5678 > > > > Anyone can please let me know the steps to configure the stunnel if > > the support is already in place or provide your thoughts on the new > > support? > > > Use multiple "connect" options within a single section: > connect = ip1:5678 > connect = ip2:5678 > connect = ip3:5678 > ... > connect = ipn:5678 > > Reading The Fine Manual would answer your question. It's not that > hard to read the manual for "connect" before proposing any extensions > for this option. > Thanks, Narendra.

2 1

Stunnel forwarding IP
by oscaruser＠programmer.net 15 Jan '11

15 Jan '11

Folks, For my server daemon process, I am accepting incoming requests only from pre-seeded IP addrs. Using Stunnel, I am finding connecting IPs are '127.0.0.1' or localhost. Is there any configuration or solution to represent incoming IPs for the given file descriptor belonging to their originating IP addrs? Thank you.

4 5

stunnel with FIPS and SIGHUP
by Eric Lambert 15 Jan '11

15 Jan '11

Hello, I am having difficulting when running stunnel in FIPS mode and using a SIGHUP to get stunnel to re-read it's configuration file (for instance if I've changed a port # or IP address for one of the connections). This causes stunnel to call the SSL routine FIPS_mode_set() a second time after receiving the SIGHUP, which in turn attempts to reinitialize SSL. Unfortunately, OpenSSL does not support calling FIPS_mode_set(1) more than once. The initialization of SSL becomes incomplete as a result of the 2nd call and subsequent attempts to use stunnel to establish encrypted connections fail. Does anyone have any suggestions on how I can make this work (besides killing and restarting stunnel)? If not, I have a proposed fix (and there are multiple ways that this could be addressed). Anyway, my suggestion is to add the following two lines to the ssl_configure() function (found in the file "ssl.c"), right before the current FIPS_mode_set() routine is called: FIPS_mode_set(0); RAND_set_rand_method(NULL); The function currently looks like: int ssl_configure(void) { /* configure global SSL settings */ #ifdef USE_FIPS if(!FIPS_mode_set(global_options.option.fips)) { ERR_load_crypto_strings(); sslerror("FIPS_mode_set"); return 0; } s_log(LOG_NOTICE, "FIPS mode %s", global_options.option.fips ? "enabled" : "disabled"); #endif /* USE_FIPS */ : : } With the suggested fix, it would look as follows: int ssl_configure(void) { /* configure global SSL settings */ #ifdef USE_FIPS FIPS_mode_set(0); RAND_set_rand_method(NULL); if(!FIPS_mode_set(global_options.option.fips)) { ERR_load_crypto_strings(); sslerror("FIPS_mode_set"); return 0; } s_log(LOG_NOTICE, "FIPS mode %s", global_options.option.fips ? "enabled" : "disabled"); #endif /* USE_FIPS */ : : } Does the above seem reasonable. Could this change, or some other modification which would support using SIGHUP with FIPS, be considered for a future stunnel update? Thanks for your help.

2 1

Multi Tunnel Support in STunnel
by Narendra Prasad Madanapalli 15 Jan '11

15 Jan '11

Hi, Current stunnel implementation is based on peer-to-peer communication and it cannot be used in the environment where a management server wants to talk to multi-site server (i.e. an instance of server running in different sites). Multi Tunnel support for Stunnel enables a Management Server to communicate with Multisite Server. But it requires extending Stunnel with a new protocol whereby Management Server & Client Stunnel Process communicates. 1. The new stunnel conf for multi tunnel (keeping backward compatibility) look like [singleTunnelServiceName] accept = aport connect = ip:cport [serviceName] multitunnel = yes accept = 1234 connect = ip1:5678,ip2:5678,ip3:5678,...ipn:5678 Anyone can please let me know the steps to configure the stunnel if the support is already in place or provide your thoughts on the new support? Thanks, Narendra.

2 1

Re: [stunnel-users] Problem with a signed certificate by CA andcurl/wget
by Gabriel Sosa 13 Jan '11

13 Jan '11

perfect! that made the trick!!! thank you for your time Saludos On Thu, Jan 13, 2011 at 3:00 PM, <josealf(a)rocketmail.com> wrote: > Maybe your curl client is trying to negotiate SSLv2... Did you try addding --sslv3 to the command line? Openssl fips disables sslv2.. > > > -----Original Message----- > From: Gabriel Sosa <sosagabriel(a)gmail.com> > Sender: stunnel-users-bounces(a)mirt.net > Date: Thu, 13 Jan 2011 01:39:15 > To: <stunnel-users(a)mirt.net> > Subject: [stunnel-users] Problem with a signed certificate by CA and > curl/wget > > hello, > > I bought an ssl certificate on thawte and installed to stunnel. > > When I go to the site with any browser the ssl is established without > any issue, however when I try to call an url using curl or wget I'm > not able to download the content > > here are the output of curl/wget > > [root@www ~]$ curl https://secure.example.com/test.php > curl: (35) Unknown SSL protocol error in connection to secure.example.com:443 > [root@www1 ~]$ wget https://secure.example.com/test.php > --23:27:15-- https://secure.example.com/test.php > Resolving secure.example.com... xxx.xxx.xxx.xxx > Connecting to secure.example.com|xxx.xxx.xxx.xxx|:443... connected. > Unable to establish SSL connection. > [root@www ~]$ > > > my stunnel config file looks like > > ;setuid=nobody > ;setgid=nobody > fips=no > > pid=/var/run/stunnel.pid > debug=3 > output=/var/log/stunnel.log > cert=/etc/ssl/certs/stunnel.pem > CAfile=/etc/ssl/certs/ssl123.crt > > socket=l:TCP_NODELAY=1 > socket=r:TCP_NODELAY=1 > > > [secure.example.com] > accept=xxx.xxx.xxx.xxx:443 > connect=zzz.zzz.zzz.zzz:8443 > TIMEOUTclose=0 > xforwardedfor=yes > > I'm using the version 4.34 + xforwardedfor patch > > the file ssl123.crt contains the root CA of thawte > > uname -a output > > Linux secure.example.com 2.6.18-164.6.1.el5 #1 SMP Tue Nov 3 16:12:36 > EST 2009 x86_64 x86_64 x86_64 GNU/Linux > > gcc -v output > > Using built-in specs. > Target: x86_64-redhat-linux > Configured with: ../configure --prefix=/usr --mandir=/usr/share/man > --infodir=/usr/share/info --enable-shared --enable-threads=posix > --enable-checking=release --with-system-zlib --enable-__cxa_atexit > --disable-libunwind-exceptions --enable-libgcj-multifile > --enable-languages=c,c++,objc,obj-c++,java,fortran,ada > --enable-java-awt=gtk --disable-dssi --enable-plugin > --with-java-home=/usr/lib/jvm/java-1.4.2-gcj-1.4.2.0/jre > --with-cpu=generic --host=x86_64-redhat-linux > Thread model: posix > gcc version 4.1.2 20080704 (Red Hat 4.1.2-46) > > openssl version > > OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 > > > Does anyone have some clue about what could be causing the problem. > Any help will be really appreciated. > > Thank you > > -- > Gabriel Sosa > Si buscas resultados distintos, no hagas siempre lo mismo. - Einstein > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > -- Gabriel Sosa Si buscas resultados distintos, no hagas siempre lo mismo. - Einstein

1 0

Re: [stunnel-users] Problem with a signed certificate by CA andcurl/wget
by Gabriel Sosa 13 Jan '11

13 Jan '11

Jose, thanks for your reply here is the output of curl --verbose [root@www ~]$ curl --verbose https://secure.example.com/test.php * About to connect() to secure.example.com port 443 * Trying xxx.xxx.xxx.xxx... connected * Connected to secure.example.com (xxx.xxx.xxx.xxx) port 443 * successfully set certificate verify locations: * CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none * SSLv2, Client hello (1): Unknown SSL protocol error in connection to secure.example.com:443 * Closing connection #0 curl: (35) Unknown SSL protocol error in connection to secure.example.com:443 if is there any other info you need please just let me know. Thank you On Thu, Jan 13, 2011 at 8:42 AM, <josealf(a)rocketmail.com> wrote: > Gabriel, > > Can you add the --verbose flag to your curl command and post the result? > > > Jose > -----Original Message----- > From: Gabriel Sosa <sosagabriel(a)gmail.com> > Sender: stunnel-users-bounces(a)mirt.net > Date: Thu, 13 Jan 2011 01:39:15 > To: <stunnel-users(a)mirt.net> > Subject: [stunnel-users] Problem with a signed certificate by CA and > curl/wget > > hello, > > I bought an ssl certificate on thawte and installed to stunnel. > > When I go to the site with any browser the ssl is established without > any issue, however when I try to call an url using curl or wget I'm > not able to download the content > > here are the output of curl/wget > > [root@www ~]$ curl https://secure.example.com/test.php > curl: (35) Unknown SSL protocol error in connection to secure.example.com:443 > [root@www1 ~]$ wget https://secure.example.com/test.php > --23:27:15-- https://secure.example.com/test.php > Resolving secure.example.com... xxx.xxx.xxx.xxx > Connecting to secure.example.com|xxx.xxx.xxx.xxx|:443... connected. > Unable to establish SSL connection. > [root@www ~]$ > > > my stunnel config file looks like > > ;setuid=nobody > ;setgid=nobody > fips=no > > pid=/var/run/stunnel.pid > debug=3 > output=/var/log/stunnel.log > cert=/etc/ssl/certs/stunnel.pem > CAfile=/etc/ssl/certs/ssl123.crt > > socket=l:TCP_NODELAY=1 > socket=r:TCP_NODELAY=1 > > > [secure.example.com] > accept=xxx.xxx.xxx.xxx:443 > connect=zzz.zzz.zzz.zzz:8443 > TIMEOUTclose=0 > xforwardedfor=yes > > I'm using the version 4.34 + xforwardedfor patch > > the file ssl123.crt contains the root CA of thawte > > uname -a output > > Linux secure.example.com 2.6.18-164.6.1.el5 #1 SMP Tue Nov 3 16:12:36 > EST 2009 x86_64 x86_64 x86_64 GNU/Linux > > gcc -v output > > Using built-in specs. > Target: x86_64-redhat-linux > Configured with: ../configure --prefix=/usr --mandir=/usr/share/man > --infodir=/usr/share/info --enable-shared --enable-threads=posix > --enable-checking=release --with-system-zlib --enable-__cxa_atexit > --disable-libunwind-exceptions --enable-libgcj-multifile > --enable-languages=c,c++,objc,obj-c++,java,fortran,ada > --enable-java-awt=gtk --disable-dssi --enable-plugin > --with-java-home=/usr/lib/jvm/java-1.4.2-gcj-1.4.2.0/jre > --with-cpu=generic --host=x86_64-redhat-linux > Thread model: posix > gcc version 4.1.2 20080704 (Red Hat 4.1.2-46) > > openssl version > > OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 > > > Does anyone have some clue about what could be causing the problem. > Any help will be really appreciated. > > Thank you > > -- > Gabriel Sosa > Si buscas resultados distintos, no hagas siempre lo mismo. - Einstein > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > -- Gabriel Sosa Si buscas resultados distintos, no hagas siempre lo mismo. - Einstein

1 0

Problem with a signed certificate by CA and curl/wget
by Gabriel Sosa 12 Jan '11

12 Jan '11

hello, I bought an ssl certificate on thawte and installed to stunnel. When I go to the site with any browser the ssl is established without any issue, however when I try to call an url using curl or wget I'm not able to download the content here are the output of curl/wget [root@www ~]$ curl https://secure.example.com/test.php curl: (35) Unknown SSL protocol error in connection to secure.example.com:443 [root@www1 ~]$ wget https://secure.example.com/test.php --23:27:15-- https://secure.example.com/test.php Resolving secure.example.com... xxx.xxx.xxx.xxx Connecting to secure.example.com|xxx.xxx.xxx.xxx|:443... connected. Unable to establish SSL connection. [root@www ~]$ my stunnel config file looks like ;setuid=nobody ;setgid=nobody fips=no pid=/var/run/stunnel.pid debug=3 output=/var/log/stunnel.log cert=/etc/ssl/certs/stunnel.pem CAfile=/etc/ssl/certs/ssl123.crt socket=l:TCP_NODELAY=1 socket=r:TCP_NODELAY=1 [secure.example.com] accept=xxx.xxx.xxx.xxx:443 connect=zzz.zzz.zzz.zzz:8443 TIMEOUTclose=0 xforwardedfor=yes I'm using the version 4.34 + xforwardedfor patch the file ssl123.crt contains the root CA of thawte uname -a output Linux secure.example.com 2.6.18-164.6.1.el5 #1 SMP Tue Nov 3 16:12:36 EST 2009 x86_64 x86_64 x86_64 GNU/Linux gcc -v output Using built-in specs. Target: x86_64-redhat-linux Configured with: ../configure --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info --enable-shared --enable-threads=posix --enable-checking=release --with-system-zlib --enable-__cxa_atexit --disable-libunwind-exceptions --enable-libgcj-multifile --enable-languages=c,c++,objc,obj-c++,java,fortran,ada --enable-java-awt=gtk --disable-dssi --enable-plugin --with-java-home=/usr/lib/jvm/java-1.4.2-gcj-1.4.2.0/jre --with-cpu=generic --host=x86_64-redhat-linux Thread model: posix gcc version 4.1.2 20080704 (Red Hat 4.1.2-46) openssl version OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 Does anyone have some clue about what could be causing the problem. Any help will be really appreciated. Thank you -- Gabriel Sosa Si buscas resultados distintos, no hagas siempre lo mismo. - Einstein

1 0

Win32 FIPS Question
by pk＠cliffhanger.com 12 Jan '11

12 Jan '11

Hello, Greetings. I am new to STUNNEL and working on a proof of concept to compile the latest FIPS Compliant 1.2.2 OpenSSL with STUNNEL 4.34. in Windows 32 Bit environment. In the install.FIPS file it is mentioned that Win32 is not supported with FIPS. Is it still the case or it is fixed now? Have anybody done this? I greatly appreciate your time and help. Thank you. PK

1 0

Re: [stunnel-users] Question of stunnel/openssl for X86 processor -- Pierre's patch
by Pierre DELAAGE 11 Jan '11

11 Jan '11

Hi Jiehua, Please review the instructions on my webpage : in particular use my compilation scripts, and look inside them to know the syntax. It is quite simple : makece X86 for stunnel. For openssl, run the command "mywcebuild X86". It works. Pierre Le 10/01/2011 17:40, Li, Jiehua a écrit : > Dear Pierre and Dear Stunnel Users, > > We are trying to build stunnel for WinCE on X86 processor. After reviewing messages on the board, I found your article published in late November. I've downloaded packages from your personal website athttp://delaage.pierre.free.fr/ > > These packages include: > 1. Precompiled wcecompat library > 2. Source code foropenssl v100a for WCE <http://delaage.pierre.free.fr/contrib/openssl/wce/openssl100a_WCEpatched3.z…>. > 3. Source code forstunnel v434 for WCE <http://delaage.pierre.free.fr/contrib/stunnel/wce/stunnel434_WCEpatched2X86…>. > > I was hoping to the get the precompiled openssl library files, but it seems there are only library files for ARM processor under the folder of "out32dll_ARMV4" and there's no precompiled version for X86. So I tried to compile the openssl downloaded from your website for the X86 processor after customizing a few parameters (OSVERSION, PLATFORM, WCEROOT, SDKROOT, WCECOMPAT) as you suggested. But the compilation failed, I got error messages as below. I'm also including all options for cl.exe in the email as well. I wonder if you have seen similar issues before. Any suggestion is appreciated. Thanks for the help. > > Regards, > > Jiehua > > cl.exe /Fotmp32dll_x86\cryptlib.obj -Iinc32 -Itmp32dll_x86 /MC /O1 /Oi > /W3 /WX /GF /Gy /nologo -DUNICODE -D_UNICODE -DOPENSSL_SYSNAME_WINCE -DWIN32_LE > AN_AND_MEAN -DL_ENDIAN -DDSO_WIN32 -DNO_CHMOD -DOPENSSL_SMALL_FOOTPRINT -D_WIN32 > _WCE=420 -DUNDER_CE=420 -DWCE_PLATFORM_STANDARDSDK_420 -Dx86 -D_ -IC:\STunnel\wc > ecompat12_patched2X86\patchedX86/include -DOPENSSL_NO_RC5 -DOPENSSL_NO_MD2 -DOPE > NSSL_NO_KRB5 -DOPENSSL_NO_JPAKE -DOPENSSL_NO_STATIC_ENGINE /Zi /Fdtmp32dll_x86/l > ib -D_WINDLL -D_DLL -DOPENSSL_BUILD_SHLIBCRYPTO -c .\crypto\cryptlib.c > Command line warning D4002 : ignoring unknown option '/MC' > cryptlib.c > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winnt.h(301 > 9) : error C2061: syntax error : identifier 'PCONTEXT' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winnt.h(302 > 0) : error C2059: syntax error : '}' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(1 > 481) : error C2061: syntax error : identifier 'LPCONTEXT' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(1 > 481) : error C2059: syntax error : ';' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 222) : error C2146: syntax error : missing ')' before identifier 'lpContext' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 222) : error C2081: 'LPCONTEXT' : name in formal parameter list illegal > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 222) : error C2061: syntax error : identifier 'lpContext' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 222) : error C2059: syntax error : ';' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 223) : error C2059: syntax error : ')' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 230) : error C2143: syntax error : missing ')' before '*' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 230) : error C2143: syntax error : missing '{' before '*' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 231) : error C2059: syntax error : ')' > NMAKE : fatal error U1077: 'cl.exe' : return code '0x2' > Stop. > > ---------------------------------------------------------------------------------------- > Dear Michal, Dear all, > I have continued to work on my WCE version of stunnel 4.34, after having > received some request for help to compile for other TARGET CPU than ARM, > typically WCE/X86. > > That led me to a few more compilation bug fixes and some improvments in > makefiles, proper usage of winsock2 library, automatisation and > management of "make/build" process > for multiple targets WCE (ARM|X86...) and Win32 (with MS VC and > Gnu-mingw32 !). > I added also, as a practical feature, the inclusion of > "version/copyright" properties in the exe files, properties that are > displayable in the Windows Explorer or by right-clicking on the exefile. > This is not only a "beautifying" feature: this allows automatic version > checking by external tools without having to run the stunnel program, > particularly useful when the targetcpu does not match the host cpu... > > I also worked to have "as close as possible" evc.mak, vc.mak, and > mingw.mak files. > A lot of work and test-fail-adapt cycles have been performed to have a > common code working with the various flavors of C-PREPROCESSORS ! > because there are subtle differences between MS EVC, MS VC, Borland BCC > and GNU-GCC preprocessors. > > THE ATTACHMENT has been sent in zip format, because it contains a few > scripts and other files that exceed the 100KB limit of the mailing list. > it contains the files : > version.h : contains the #define version numbers, major and minor > version.rc : version displayable by Windows Explorer property sheet > makew32.bat : an helper for build wih MS VC > > Michal: > patched2X86.txt : a FULL diff -cr between your last 4.34 official > version and my last patched > patched2X86_incr.txt : an INCREMENTAL diff -cr between my previous > patched version sent on 27/09/2010 and the present one. > > > For the impatient, my patched version of stunnel 4.34 is available here : > http://delaage.pierre.free.fr/contrib/stunnel/wce/stunnel434_WCEpatched2X86… > > IT COVERS both WCE and Win32 versions of stunnel. > > NEW FILES have been added to the sources: see attachments: > - version.h is NOW the CENTRAL point to define major and minor versions > of stunnel (NO MORE definition is makefile, which is logical : you > modify the version of the product, without necessarily modifying the > production process). > - version.rc is the resource file required by windows as the repository > of the stunnel.exe properties displayed in Windows Explorer. > Compiled with evc for wce or with VC for win32, this works perfectly. > But compiled and linked with gcc, those properties are unfortunately not > displayed by Windows Explorer, although embedded in the exe file. I have > established that it is a bug in "gnu-link" stage. > - makew32 : the equivalent of makece for Win32, which avoid repetitive > and error prone pollution of env vars when repetitively compiling for > w32. It is very useful in frequent recompilation at dev/test time. > > *** SOME PRACTICAL INFO : > - now to compile, or clean up things, for a particular WCE TARGET CPU : > just type things like : > makece ARMV4, eg for ARMV4 CPU > makece ARMV4 clean > makece X86, eg for ARMV4 CPU > makece X86clean > ===> this create ../bin/ARMV4/stunnel.exe and ../obj/ARMV4/all objs > files, or the like with X86 cpu and so on. > See list of all supported target cpu in evc.mak. ARMV4 and X86 go well; > more cpu may be checked by experts vs compilation flags... > This is very practical to compile for various targets without modifying, > deleting, renaming, anything and with no side effects between targets. > > - For Win32, yes for Windows PC, just type : > makew32 > makew32 clean > ===> this create ../bin/W32/stunnel.exe and ../obj/W32/all objs files. > This tool uses MS-VC 2008 express as compiler/linker. > > - For Win32, but with MINGW32 tools (and GNU-WIN32 coreutils !!!), just > type : > mingw32-make -f mingw.mak > mingw32-make -f mingw.mak clean > ===> this create ../bin/MGW32/stunnel.exe and ../obj/MGW32/objs files. > GOODIE: I have tricked the mingw.mak to work EITHER on a Windows > compilation HOST MACHINE, OR a LINUX/UN*X compilation HOST. > On windows mingw.mak properly checks and warns about potential missing > of gnu-win32 tools. > Note: the make.bat file is just a shortcut for mingw32-make -f mingw.mak. > > *** MODIFICATIONS of FILES : > > So, since my previous version of the patch, here are my adds : > > 1/ evc.mak : > 1.1/linking with a recompiled version of Essemer/wcecompat: > this library has been customized to compile in SEPARATE folders for > MULTIPLE targets. > So path to proper libs have been changed. > My customized version of wcecompat is available here : > http://delaage.pierre.free.fr/contrib/wcecompat/wcecompat12_patched2X86.zip > > IT HAS ALSO been adapted to have separate folders for distinct targets > pre-compiled versions. > Please note that this philosophy is shared with openssl. > > 1.2/ linking with winsock2 library instead of winsock1: at first to be > consistent with the C code, and second because winsock2 is more close to > socket standard than ws1. > > 1.3/ linking with COREDLL.lib and CORELIBC.lib ONLY: whatever /MC or /MT > or other flag you put for CLxxx command, the set of default libs > expected to be linked is WRONG. > This is a bug of CLxxx tools, inconsitent with MS doc. > SO we have to overwrite the default lib list by always the same ones. > You can verify that this is the right way to do it by searching for a > libc.lib in various evc/libs : you will NOT find any although clxxx /? > talks about it. > > 1.3/ change in VERSION management : now there is a version.h and > version.rc souce file for this. > One that wants to change version has just to edit version.h and then > version info will be propagated as usual in resource.h, AND also > in the exe itself to be displayable in Windows Explorer. > Now people will have a simple mean to check the version of stunnel. > > Michal: have you noticed that there was a vestige "version.h" file > mentioned in vc.mak ! > now it makes sense in evc.mak, vc.mak and mingw.mak, for wce or win32 > targets. > > 1.4/ link /machine : IX86 is improper with WCE, it is X86. > > 1.5/ Multiple WCE CPU targets supported by giving targetcpu on the make > command line like this : > makece ARMV4 all > targetcpu is now mandatory. > makece without options, as usual, will show the new syntax (very simple). > > 1.6/ improved clean target with some rmdirs and proper redirection of > error messages. > proper use of make flags -@. > > 1.7/ added explicit "inference rules" that are compatible MS nmake/ > Borland make, > to be sure of the proper options, and to manage multiple subdirs > management matching TARGETCPU. > Now stunnel.exe is build in stunnel/bin/TARGETCPU subdir > objs are build in stunnel/obj/TARGETCPU > > I really think it is practical and good policy : on my host machine I > have been able to test efficiently at the same time > three flavors of stunnel : win32, wce/arm, wce/x86 without > erasing/renaming/recompiling each time and wondering for what platform > was my stunnel.Exe built for. > > 1.8/ HOST flag put in $(DEFINES) for CC and RC to add more info to exe > info property shhet in Windows Explorer "this stunnel is for THIS type > of target" > > > 2/ makece.bat: > protection against pollution of environment when makece is repeatedly > run with the same targetcpu. > + Env is updated only when one is switching targetcpu. > This is not perfect, but a step in the good direction. > To understand what I mean, perform "set" to see all the env vars after > each makece call... > > PRACTICALLY : you can type makece ARMV4 and then makece X86 in the same > command line window, without polluting "too much" the environment, > only when changing target. No need, reasonably, to have multiple command > line windows opened. > > 3/ vc.mak: for win32 > "multiple target" support by putting w32 obj and exe files in obj/w32 > and bin/w32 subdirs, version.rc support, winsock2 lib integration. > > crypt32 was missing .lib SUFFIX ! > > improper use of winsock1 : it is better to take winsock2 lib, and it is > what the code requires (#includes...) ! > > version management through version.h /.rc instead of /DVERSION > > general logic now close to that of WCE evc.mak, as can be (evc and vc > are very close in their syntax, flags...). > HOST flag to add more info to exe info property sheet in Windows > Explorer "this stunnel is for THIS type of target" > > 4/ created a makew32.bat script > as a wrapper to setenv vars for MSVC 2008 Express, and nmake call. > This has to be improved in the future: presently it cannot be called > after a previous compilation for WCE : > pollution of PATH and INCLUDE env vars requires to reopen a shell via > cmd.exe. > One day I will check if there a simple way to clean env vars from some > path (not so simple). > > 5/ adapted mingw.mak to link with WINSOCK 2 (!!) and use of > version.rc/.h + general processing made similar to that of vc.mak. > I tested with mingw for windows and it works. Someone should test with > gcc under linux, this should work... > HOST flag to add more info to exe info property sheet in Windows > Explorer "this stunnel is for THIS type of target" > Some rewriting to have a mingw.mak close to vc.mak, to ease maintenance... > I checked gnu make syntax, and it is close to ms nmake and borland make, > except for ifdef directives and inference rules syntax, unfortunately. > I am somehow skilled in this boring exercise of comparing various make > tools and syntax. > > MINGW.MAK bugs: incorrect reference to "Makefile.w32", incorrect INC > path for openssl/win32 (this is NOT "outinc" but "inc32"! since a long > time). > > NOTE : to compile on windows I commented "-l zdll" lib in the mingw.mak. > Michal, may you restore it if it is useful (I do not see why anyway). > > Added a testenv pseudo-target to check for gnu-win32 proper installation. > Added some tricks to enable proper execution with the same makefile > either on a Windows HOST or a Linux HOST. > When I say host, I mean "production machine" , and NOT TARGET machine > which is always win32 with mingw.mak. > > 6/ make.bat: this script is ONLY meaningful with mingw.mak and MINGW32 > gnu environment. > Due to various improvments I MADE in mingw.mak, mingw.mak is now only > compatible with mingw32-make, > and not just "make.exe", which is Borland make on Windows... > > > TODO : I did not deal with stunnel making for linux, and/or rpm packaging. > But I guess that makefile.in etc...should be updated... > Anyway, on linux, NOT including version.rc is not a problem, as this > file is useless in that target environment. > But I think that having ../obj/UNX and ../bin/UNX folders should be a > good practice... > > 7/ common.h : > Eureka ! I finally understood and cleaned up the mess around the > redefinition of various Socket Error codes. > This comes from the fact that, previously, those codes were defined in > MS winsock1 header files, but disappeared in winsock2 header files (they > are commented) > Apparently, stunnel code was including winsock1 for w32 but winsock2 for > WCE, although winsock2 is in fact available on both platforms. > So I decided to move to winsock2 for WCE, and re-declaring (again) SOME > of those constants. > Some clean up of the makefile has been done also to REALLY link to ws2 > lib instead of ws1 (because there was also a confusion there!). > > 8/ ctx.c : htons is requesting "short". so a cast was required to avoid > warnings from the compiler. > > 9/ resolver.c : here we are: > many routines have been reimplemented when they are in fact available in > winsock2 both for w32 AND WCE. > Michal: I expect that you review this with particular attention. > In fact I have modified the logic of "masking" local_routines when > already defined in winsock2. > the previous code was HIDING winsock2 instead of the local_routines. > It seemed not logical. > It is important to note that the three routines "getaddrinfo, > freeaddrinfo, getnameinfo" are FOR INSTANT used only in resolver.c, > BUT the previous code was preventing them from being used by other modules. > Now, with my code, it is possible. > My code also avoid compilation warnings (because, as getaddrinfo REALLY > exist in win32, such a "#define getaddrinfo localgetaddrinfo" > inevitably raises a warning of the compiler for redef of an existing > symbol; and hence it reveals a problem of conflict..., while my solution > avoids all this pitfalls). > > Removed also the restriction "AND IPV6" on win32 conditional #IF: > winsock2 supports ipv6. > Michal: a review on these conditional #IF should be useful... > > I wanted to add that those routines are also parts of the POSIX standard > API, so they are available almost everywhere... > so I hardly understand their purpose today. > > 10/ version.h : > I have used some preprocessor tricks to have a VERSION string correctly > defined BOTH with MS evc preprocessor, MS vc preprocessor: > AND GNU preprocessor. > those preprocessors have some differences...particularly when called > from a rc compiler through a "pipe" like gnu windres. > In ms VC and EVC the rc preprocessing is NOT the same as that of the > compiler... > Now it works with every build system, and either in .c compilation or > .rc compilation. > > > USEFUL : openssl team is desperately ignoring any WCE patch, so if you > want an openssl 100a source tree compatible with WCE, > just download mine there : > http://delaage.pierre.free.fr/contrib/openssl/wce/openssl100a_WCEpatched3.z… > FYI, my patch to openssl is registered here : > http://rt.openssl.org/index.html?q=2350 (login guest/password guest). > > TODO : gui.c contains code to dynamically load ws2 getaddrinfo > why not rely only on static linking for that, as ws2 is available > everywhere since w95 and wce4.1 ? > we have to harmonize the code there with resolver.c and various makefiles > In resolver.c: code remains to load dynamically ws2 getaddrinfo etc..at > run-time only on win32, and not in CE while it is ALSO available! > I suggest to have "static" linking to ws2.lib both in w32 and wce . but > more code has to be modified to be definitely clean and clear. > When I say "static linking" I mean "Load-Time Dynamic Linking", ie link > with ws2.lib stub at build time, not "link with static lib"... > > I thank you for your good work and attention, > Yours sincerely, > > Pierre Delaage > > > Le 27/09/2010 00:40, Pierre DELAAGE a écrit : > > Dear All, > > Please find enclosed a patch in "diff -cr orig patched" format, > > applying to stunnel4.34 as found hereftp://stunnel.mirt.net/stunnel/. > > This patch mainly addresses compilation and unicode issues for Windows > > CE targets + ONE critical issue preventing stunnel to service anything > > (!). > > > > I use MS EVC 4sp2 compiler with WCE 420 SDK, on a vista host platform. > > Once debugged the code works fine on WM6 HTC smartphones. > > Should work on WM5. > > It needs a windows CE openssl lib (I recompiled MY patched version of > > openssl 1.0.0a successfully: I will have to log a patch to those > > gentlemen, hoping that they are open to integrate it, something not so > > obvious in the past). > > > > I will later post here a link to my patch for openssl 100a pointing to > > the openssl mailing list. THIS OPENSSL PATCH IS ESSENTIAL : with my > > older version of openssl 098pre_j for wce, stunnel does not work > > anymore (it crashes after first cnx). > > > > > > The present stunnel patch addresses the following issues : > > > > ************* > > I] COMPILATION FAILURES > > > > 1/ on common.h "EINVAL redefinition" : > > in fact the compile options WX (see evc.mak) does not tolerate any > > warning : > > The MS evc420 compiler ALWAYS issues a warning on this symbol > > redefinition. > > Michal and I are dealing with it since month... > > But, considering that NEITHER Exxx error codes are used in stunnel, > > I suggest that in fact ALL these redef should be suppressed. > > > > TODO: In the future a proper rewrite of code in log.c, where hardcoded > > values of WSA error codes are used instead of symbolic constant, will > > have to be done. > > > > > > 2/ client.c > > CreateProcess is a UNICODE function: code was ascii only. > > Code has been adapted to work in unicode. > > > > 3/ evc.mak > > path to new openssl lib has been redefined. > > proper location for the libs in openssl tree has been set in the > > make-install block (although this block is presently USELESS and needs > > a complete rewrite). > > > > 4/ gui.c > > All code using hmainmenu is OFF under winCE. > > So some new lines involving it were not compiling. > > > > 5/ options.c > > > > linger_val.l_linger and linger_val.l_onoff require ushort values. > > Strict type checking of the compiler required a proper cast to ushort > > of the r-values. > > > > > > stralloc uses "strdup": > > on Win32 and winCE strdup is _strdup (!). > > > > 6/ prototypes.h : > > _beginthread was defined as returning an int, an a long in sthread.c. > > After some checking in various documentations, long is the correct type, > > in particular because _beginthread can return the special error value > > "-1L". So that unsigned types are illogical. > > This simplifies the code in some locations, by saving some -now > > useless- casts. > > > > 7/ sthread.c > > > > create_client: suppressed some useless cast to (long) for beginthread. > > > > ************* > > II] OPERATIONAL ERRORS (at run-time) > > This is a reminder of previous notification to the mailing list : > > due to beginthread improper code and/or use, > > It is presently IMPOSSIBLE for stunnel 434 to be used in production on > > WCE: > > it is just unable to service any...service. > > Nothing happens if, for example, you use it to connect to an https > > server. No log either ! > > > > I corrected the code with both Michal patch to gui.c and mine to > > sthread.c: > > > > gui.c (Michal patch) : > > _beginthread was called with 0 as stacksize which, cumulated to an > > improper coding of sthread/beginthread, led to FAILURE of service > > thread creation. > > > > sthread.c: > > _beginthread : now supports "0" stacksize value, leading to default > > linker stack size (1MB by default unless specified differently on the > > linker command line, something we do not yet perform but could). > > > > ************* > > III] MINOR IMPROVMENT > > _beginthread: added a log on critical event of "failure" to create a > > service thread. because I think it is a critical event, isn't it? > > > > > > I hope you will find this patch useful. > > Thank you for your excellent work, > > Yours sincerely, > > > > Pierre Delaage > > > > Note : I use stunnel to establish a simple "vpn" between smartphones and > > a corporate linux server mainly for HTTPS/POPS/SMTPS support. > > Stunnel is very relevant in that matter, over solutions based on SSH > > (although we use also ssh), from a communication cost point of view : > > ssh establishes permanent socket between client and server, so that the > > communication is charged by the mobile network provider : and these > > charges are very expensive. > > On the contrary stunnel only establishes ssl sockets on demand so that > > financial charges are limited to strict necessary. > > Please note that stunnel brings "client based certificate > > authentication" to POP/SMTP mobile mail user agents which only > > BASICALLY supports SSL with server authentication, but NO client > > authentication, such as M$ Outlook forMobile (unless you pay for an > > exchange server and exchange client licence). > > Here again stunnel is very relevant. > > > > Note 2 : the strdup and unicode bug fixes should benefit also to the > > win32 (for PC) stunnel version for PC. > > > > > > > > > > > *["stunnel434patch20101117.zip" (application/x-zip-compressed)]* <http://marc.info/?l=stunnel-users&m=129002593426045&q=p3> > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > *[prev in list <http://marc.info/?l=stunnel-users&m=129001288405228&w=2>] [next in list <http://marc.info/?l=stunnel-users&m=129010241218147&w=2>] [prev in thread <http://marc.info/?l=stunnel-users&m=128554087819713&w=2>] [**next in thread]* > > Configure <http://marc.info/?q=configure> | About > <http://marc.info/?q=about> | News <http://marc.info/?q=news> | >

2 1

Re: [stunnel-users] Question of stunnel/openssl for X86 processor -- Pierre's patch
by Pierre DELAAGE 10 Jan '11

10 Jan '11

Hi Jiehua, Please review the instructions on my webpage : in particular use my compilation scripts, and look inside them to know the syntax. It is quite simple : makece X86 for stunnel. For openssl, "mywcebuild X86". It works. Let me know if you have problems. Pierre Le 10/01/2011 17:40, Li, Jiehua a écrit : > Dear Pierre and Dear Stunnel Users, > > We are trying to build stunnel for WinCE on X86 processor. After reviewing messages on the board, I found your article published in late November. I've downloaded packages from your personal website athttp://delaage.pierre.free.fr/ > > These packages include: > 1. Precompiled wcecompat library > 2. Source code foropenssl v100a for WCE <http://delaage.pierre.free.fr/contrib/openssl/wce/openssl100a_WCEpatched3.z…>. > 3. Source code forstunnel v434 for WCE <http://delaage.pierre.free.fr/contrib/stunnel/wce/stunnel434_WCEpatched2X86…>. > > I was hoping to the get the precompiled openssl library files, but it seems there are only library files for ARM processor under the folder of "out32dll_ARMV4" and there's no precompiled version for X86. So I tried to compile the openssl downloaded from your website for the X86 processor after customizing a few parameters (OSVERSION, PLATFORM, WCEROOT, SDKROOT, WCECOMPAT) as you suggested. But the compilation failed, I got error messages as below. I'm also including all options for cl.exe in the email as well. I wonder if you have seen similar issues before. Any suggestion is appreciated. Thanks for the help. > > Regards, > > Jiehua > > cl.exe /Fotmp32dll_x86\cryptlib.obj -Iinc32 -Itmp32dll_x86 /MC /O1 /Oi > /W3 /WX /GF /Gy /nologo -DUNICODE -D_UNICODE -DOPENSSL_SYSNAME_WINCE -DWIN32_LE > AN_AND_MEAN -DL_ENDIAN -DDSO_WIN32 -DNO_CHMOD -DOPENSSL_SMALL_FOOTPRINT -D_WIN32 > _WCE=420 -DUNDER_CE=420 -DWCE_PLATFORM_STANDARDSDK_420 -Dx86 -D_ -IC:\STunnel\wc > ecompat12_patched2X86\patchedX86/include -DOPENSSL_NO_RC5 -DOPENSSL_NO_MD2 -DOPE > NSSL_NO_KRB5 -DOPENSSL_NO_JPAKE -DOPENSSL_NO_STATIC_ENGINE /Zi /Fdtmp32dll_x86/l > ib -D_WINDLL -D_DLL -DOPENSSL_BUILD_SHLIBCRYPTO -c .\crypto\cryptlib.c > Command line warning D4002 : ignoring unknown option '/MC' > cryptlib.c > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winnt.h(301 > 9) : error C2061: syntax error : identifier 'PCONTEXT' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winnt.h(302 > 0) : error C2059: syntax error : '}' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(1 > 481) : error C2061: syntax error : identifier 'LPCONTEXT' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(1 > 481) : error C2059: syntax error : ';' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 222) : error C2146: syntax error : missing ')' before identifier 'lpContext' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 222) : error C2081: 'LPCONTEXT' : name in formal parameter list illegal > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 222) : error C2061: syntax error : identifier 'lpContext' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 222) : error C2059: syntax error : ';' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 223) : error C2059: syntax error : ')' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 230) : error C2143: syntax error : missing ')' before '*' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 230) : error C2143: syntax error : missing '{' before '*' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 231) : error C2059: syntax error : ')' > NMAKE : fatal error U1077: 'cl.exe' : return code '0x2' > Stop. > >

1 0

RFC: purge use of keyword 'transparent'
by oscaruser＠programmer.net 08 Jan '11

08 Jan '11

Folks, After searching, installing various Linuces (in the 2.6 family), e.g. CentOS, Ubuntu, and so on, I have not been able to get transparent proxy working at all. As such since it the function does not work, and there is great debate as to whether it ever worked, I would like to propose that this keyword and reference to its function be discarded entirely. This will save many folks a great deal of time and effort attempting to try and get it to work, myself having spent over 80 hours (including my precious holiday time) trying to dig, scratch, research up old posts that say it works or someone has it working under such and such a configuration! The documentation itself has folks claiming that it works and does not, which is really a bad practice. Why did you perpetuate this option in the first place?! I hope you see the importance and reason with my request and act immediately. ... Unless someone really really does have it working. Thank you

3 7

How can I configure Intermediate Certificate
by Carlos García Villate 04 Jan '11

04 Jan '11

Hi. Two months ago, we installed our SSL certificate with stunnel succesfully. That certificate was issued by Verisign. We did not experience any issues. A few weeks ago, we had to renew that certficate and after doing that, we started to get 'Invalid certificate' errors form our web site users. It seems that the new certificate issued by Verisign, has changed its hierarchy, and browsers like FF that do not have one of the necessary intermediate certificate registered fail. This is the new hierarchy: - VeriSign Class 3 Public Primary Certification Authority - G5 - VeriSign Class 3 Secure Server CA - G3 - www.b-kin.com It is the 'VeriSign Class 3 Secure Server CA - G3' certificate the one that most FF browsers do not have registered, and so the browsers reject the request with an 'Invalid certificate' message. To solve this issue, we are trying to incorporate the 'VeriSign Class 3 Secure Server CA - G3' certificate in the .pem file, where our www.b-kin.comcertificate is installed. We have tried to include the Verisign certificate first and then the other one; and the other way round, first our certificate and then the Verisign one, but without success. The Verisign certificate has been directly taken from the Verisign web site. The .pem file has following structure: Bag Attributes heading section ..... -----BEGIN RSA PRIVATE KEY----- ..... -----END RSA PRIVATE KEY----- Bag Attributes heading section -----BEGIN CERTIFICATE----- /*We have alternated to put here the www.b-kin.com or the Verisign certificate*/ ..... -----END CERTIFICATE----- Bag Attributes heading section -----BEGIN CERTIFICATE----- /*We have alternated to put here the www.b-kin.com or the Verisign certificate*/ ..... -----END CERTIFICATE----- We are running stunnel on CentOS with the following configuration: stunnel 4.32 on i686-pc-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 Threading:PTHREAD SSL:ENGINE,FIPS Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = daemon.notice pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = FIPS session = 300 seconds stack = 65536 bytes sslVersion = TLSv1 TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none As we have seen in the documentation, it is possible to include a certificate hierarchy in a .pem file. What we do not know is the order nor the values to set int Bag Attributes heading section, for the Verisign certificate. Best regards, Carlos.

1 0

Is it possible to encrypt the Web server IP , URL , Data???
by cpu.lin 19 Dec '10

19 Dec '10

Dear Michal Trojnara, Some protocols (e.g. ssh,vpn...) must install software in SERVER side. I want to understand the fact below: If only the CLIENT side can install the special software. What is the special software? Is it possible to encrypt the Web server IP ,URL ,Data??? If stunnel can solve this issue. How to configure? Merry X'mas, Best regards, cpu.lin(a)gmail.com > 2010/12/17 Michal Trojnara <Michal.Trojnara(a)mirt.net>: > Dear cpu.lin, > >> No response to the problem: >> > http://stunnel.mirt.net/pipermail/stunnel-users/2010-December/002860.html >> Could you please help me? > > This is how the protocol works: > http://tools.ietf.org/id/draft-luotonen-ssl-tunneling-02.txt > You need a different protocol (e.g. ssh) if you don't like it. > > Mike

1 0

Stunnel 4.05 "SSL write shutdown (output buffer empty)"
by Issam ourrai 17 Dec '10

17 Dec '10

Hi guys, For My apps I'm using a SSL connection using STunnel 4.05 on a windows box. I have the following errors while running a connection : 2010.12.17 14:28:55 LOG7[2764:6312]: Socket closed on read 2010.12.17 14:28:55 LOG7[2764:6312]: SSL write shutdown (output buffer empty) 2010.12.17 14:28:55 LOG7[2764:6312]: SSL alert (write): warning: close notify 2010.12.17 14:28:55 LOG7[2764:6312]: SSL_shutdown retrying 2010.12.17 14:28:55 LOG7[2764:5588]: tradingscreen_connection accepted FD=1728 from 127.0.0.1:2231 2010.12.17 14:28:55 LOG7[2764:5588]: FD 1728 in non-blocking mode 2010.12.17 14:28:55 LOG7[2764:5588]: Creating a new thread 2010.12.17 14:28:55 LOG7[2764:5588]: New thread created 2010.12.17 14:28:55 LOG7[2764:3860]: tradingscreen_connection started 2010.12.17 14:28:55 LOG7[2764:3860]: TCP_NODELAY option set on local socket 2010.12.17 14:28:55 LOG5[2764:3860]: tradingscreen_connection connected from 127.0.0.1:2231 2010.12.17 14:28:55 LOG7[2764:3860]: FD 1708 in non-blocking mode 2010.12.17 14:28:55 LOG7[2764:3860]: tradingscreen_connection connecting XX.XX.XX.XX:9500 2010.12.17 14:28:55 LOG7[2764:3860]: remote connect #1: EWOULDBLOCK: retrying 2010.12.17 14:28:55 LOG7[2764:3860]: waitforsocket: FD=1708, DIR=write 2010.12.17 14:28:55 LOG7[2764:3860]: waitforsocket: ok 2010.12.17 14:28:55 LOG7[2764:3860]: Remote FD=1708 initialized 2010.12.17 14:28:55 LOG7[2764:3860]: TCP_NODELAY option set on remote socket 2010.12.17 14:28:55 LOG7[2764:3860]: SSL state (connect): before/connect initialization 2010.12.17 14:28:55 LOG7[2764:3860]: SSL state (connect): SSLv3 write client hello A 2010.12.17 14:28:55 LOG7[2764:3860]: waitforsocket: FD=1708, DIR=read 2010.12.17 14:28:55 LOG7[2764:3860]: waitforsocket: ok 2010.12.17 14:28:55 LOG7[2764:3860]: SSL state (connect): SSLv3 read server hello A 2010.12.17 14:28:55 LOG7[2764:3860]: waitforsocket: FD=1708, DIR=read 2010.12.17 14:28:56 LOG7[2764:3860]: waitforsocket: ok 2010.12.17 14:28:56 LOG7[2764:3860]: SSL state (connect): SSLv3 read finished A 2010.12.17 14:28:56 LOG7[2764:3860]: SSL state (connect): SSLv3 write change cipher spec A 2010.12.17 14:28:56 LOG7[2764:3860]: SSL state (connect): SSLv3 write finished A 2010.12.17 14:28:56 LOG7[2764:3860]: SSL state (connect): SSLv3 flush data 2010.12.17 14:28:56 LOG7[2764:3860]: 1 items in the session cache 2010.12.17 14:28:56 LOG7[2764:3860]: 2 client connects (SSL_connect()) 2010.12.17 14:28:56 LOG7[2764:3860]: 2 client connects that finished 2010.12.17 14:28:56 LOG7[2764:3860]: 0 client renegotiatations requested 2010.12.17 14:28:56 LOG7[2764:3860]: 0 server connects (SSL_accept()) 2010.12.17 14:28:56 LOG7[2764:3860]: 0 server connects that finished 2010.12.17 14:28:56 LOG7[2764:3860]: 0 server renegotiatiations requested 2010.12.17 14:28:56 LOG7[2764:3860]: 1 session cache hits 2010.12.17 14:28:56 LOG7[2764:3860]: 0 session cache misses 2010.12.17 14:28:56 LOG7[2764:3860]: 0 session cache timeouts 2010.12.17 14:28:56 LOG6[2764:3860]: Negotiated ciphers: DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 2010.12.17 14:28:56 LOG7[2764:6312]: SSL alert (read): warning: close notify 2010.12.17 14:28:56 LOG7[2764:6312]: SSL closed on SSL_read 2010.12.17 14:28:56 LOG7[2764:6312]: Socket write shutdown (*output buffer empty*) 2010.12.17 14:28:56 LOG5[2764:6312]: Connection closed: 31795 bytes sent to SSL, 35089 bytes sent to socket 2010.12.17 14:28:56 LOG7[2764:6312]: tradingscreen_connection finished (1 left) 2010.12.17 14:39:01 LOG7[2764:3860]: Socket closed on read 2010.12.17 14:39:01 LOG7[2764:3860]: SSL write shutdown (*output buffer empty*) 2010.12.17 14:39:01 LOG7[2764:3860]: SSL alert (write): warning: close notify 2010.12.17 14:39:01 LOG7[2764:3860]: SSL_shutdown retrying 2010.12.17 14:39:01 LOG7[2764:5588]: tradingscreen_connection accepted FD=1732 from 127.0.0.1:2362 2010.12.17 14:39:01 LOG7[2764:5588]: FD 1732 in non-blocking mode 2010.12.17 14:39:01 LOG7[2764:5588]: Creating a new thread Did some one ever face this kind of issue, I'm a neube using this connector, thanks for your kind help, -- Cheers Sam

1 0

Re: [stunnel-users] Experimental stunnel-4.35b1
by Michal Trojnara 17 Dec '10

17 Dec '10

Dear cpu.lin, > No response to the problem: > http://stunnel.mirt.net/pipermail/stunnel-users/2010-December/002860.html > Could you please help me? This is how the protocol works: http://tools.ietf.org/id/draft-luotonen-ssl-tunneling-02.txt You need a different protocol (e.g. ssh) if you don't like it. Mike

1 0

Experimental stunnel-4.35b1
by Michal Trojnara 15 Dec '10

15 Dec '10

Dear Users, I have uploaded stunnel-4.35b1 to ftp://stunnel.mirt.net/stunnel/ for your testing. Please give it a shot and submit any problems to stunnel-users mailing list. This is the way you can not only help me improve production 4.35, but also make sure it's going to work on your platform! Please consider version 4.35b1 highly experimental and not ready for production. Specifically it is no supposed to be packaged for any OS distribution (e.g. *BSD ports). Best regards, Michal Trojnara

1 0

endpoints using different versions of stunnel
by nishith n 15 Dec '10

15 Dec '10

Hello all, We have a client who would like to send us data using stunnel 4.33 at their end of the connection. Can we establish connection from our end using stunnel 4.11 version. We are working on a sun machine. I know I can simply download the latest stunnel version but it has to go through an authorization process which probably will take more time than I have and hence this question. What could be the impacts to connectivity or otherwise with such a setup? Thanks for your replies, Nishith

1 0

Examples of stunnel and lighttpd
by fanboy 14 Dec '10

14 Dec '10

Apparently lighttpd ssl support isn't so flash, I'm been attempting (I'm a newb) to use stunnel instead, are there any examples? I have a free startssl cert also (ssl.key / ssl.cert) What information do I need to setup a reliable connection?

1 0

How to encrypt the URL?
by cpu.lin 07 Dec '10

07 Dec '10

Dear friends, After reading mailing lists & Web & FAQ I couldn't find answers to these: stunnel.conf as follows: debug=7 client = yes [proxy] accept=1111 connect=62.215.5.69:8080 (Public SSL Proxy) protocol=connect protocolHost=stunnel.mirt.net:443 CLIENT(Browser+Special software)<->firewall<->(Internet)<->Public SSL Proxy<->WEB SERVER Public SSL Proxy as follows: http://tools.rosinstrument.com/raw_free_db.htm?t=2 Only the CLIENT side have stunnel. After running stunnel 4.34 (Windows binaries). Then. Browser http://localhost:1111/ But Sniffer can monitor the command-(CONNECT stunnel.mirt.net:443). The problem as follows: Only the CLIENT side can install special software. Special software including but not limited to stunnel. If the firewall can block many websites depend on Web IP & URL. How to pass through the firewall base on Public SSL Proxy? How to encrypt the URL-(stunnel.mirt.net:443)? What is the special software? If stunnel can solve this issue. How to configure? Best regards, cpu

1 0

stunnel and IE6 issue
by Bill Tindal 05 Dec '10

05 Dec '10

Hi, I have stunnel running in front of HaProxy and everything is working fine however IE6 users cannot access our HTTPS pages and are instead shown a 'Page cannot be found'. They can access normal pages. Obviously there's something that stunnel doesn't like about IE6 (who doesn't) but I'm at a loss as to what changes to make to the stunnel conf. My conf for stunnel is below: ------------------------------------------------ sslVersion = all options = NO_SSLv2 fips = no setuid = root setgid = stunnel pid = /var/run/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 output = /var/log/stunnel.log [secure.domain.com] cert = /usr/local/openssl/certs/secure.domain.com.crt key = /usr/local/openssl/certs/secure.domain.com.key accept = X.X.X.X:443 connect = X.X.X.X:81 xforwardedfor = yes TIMEOUTclose = 0

1 0

How to define stunnel.conf so openvpn packet will go thru stunnel to as HTTP?
by UARE1234 29 Nov '10

29 Nov '10

Hi, >From what I read the examples in stunnel site it possible to wrap VPN's using Stunnel tool. Is it possible to do it for openvpn packets? I can configure thru the openvpn configurations that it packets will go thru port 80 and use TCP but the packets are not http pure. I need to wrap this packets using the stunnel tool. The purpose is to use openvpn over http. I will appreceate if someone can give me a solution for combinig Stunnel and openvpn if possible. Thanks -- View this message in context: http://old.nabble.com/How-to-define-stunnel.conf-so-openvpn-packet-will-go-… Sent from the Stunnel - Users mailing list archive at Nabble.com.

1 0

Is it possible to wrap openvpn thru stunnel to HTTP-Like
by UARE1234 27 Nov '10

27 Nov '10

Hi, I understand that it is possible to wrap VPN's using Stunnel tool. How Can I do that for openvpn. The purpose is to use openvpn over http like. OpenVPN can establish an HTTP connection to a proxy server, where it will issue a CONNECT to establish a binary connection to the VPN server on port 443/TCP. This works in 99,9% but not in this case since I am talking about a very restrictive network but yet Skype for example works on it since it works in a way of http like. I will appreceate if someone can give me a solution for combinig Stunnel and openvpn or other tool if possible. Thanks -- View this message in context: http://old.nabble.com/Is-it-possible-to-wrap-openvpn-thru-stunnel-to-HTTP-L… Sent from the Stunnel - Users mailing list archive at Nabble.com.

1 0

Stunnel resource usage
by Avinash Gaonkar 25 Nov '10

25 Nov '10

Hi All, I need to understand how can we calculate the throughput for stunnel based on allocated CPU and memory. For e.g if we allocate 512Mb of RAM and 1 core for the stunnel in Vmware, what would be the throughput in Mbps. Regards, Avinash gaonkar

1 0

Enhance description of transparent mode in FAQ
by Ivan Trancik 25 Nov '10

25 Nov '10

Hello, I would suggest to improve 'transparent = yes | no (Unix only)' section of http://www.stunnel.org/faq/stunnel.html#service_level_options and how this option work on OS X. I think that this part remote mode (I<connect> option) on Linux >=2.6.28 remote mode (I<connect> option) 2.2.x local mode (I<exec> option) is not clear. Remote mode is a "I<connect> option"? What the heck? And local mode is a "I<exec> option"? Does this "I" thingie stand for unnamed pipe or capital "i" or small cap "L"?? I ran to this problem when I tried to set up stunnel on Mac OS X and carelessly used some example config on web. Setting "transparent = yes" in Mac OS X will result in very funny behavior. Consider this conf debug=7 output=stunnel.log verify=0 foreground=yes client=yes pid= [https] accept=localhost:8080 connect=google.com:443 transparent=yes will result in unbelievable error - "local_bind (original port): Address family not supported by protocol family (47)" Using 127.0.0.1 instead of localhost will do better - "Service https bound to 127.0.0.1:8080" - BUT when you try to access 127.0.0.1:8080 nothing reasonable happens and log will show another strange error "connect_blocking: connect <ip_address>: Network is unreachable (51)" The next spectacular thing is that when you use only localhost connect and accept parameter, than transparent=yes works OK. I would suggest rewriting that part to reflect these kind of situations in more clear way - they are very hard to debug, and honestly I couldn't figure it out even though I read FAQ several times. Final question - is it possible on OS X (which doesn't have iptables interface, but has ipfw) to set up transparent proxy tunnel with stunnel? Thanks.

2 1

Problems with cert
by Ross 25 Nov '10

25 Nov '10

Hello, we were using Stunnel 4.25 for a long time without any problems. We used "verify=3". Our client config file: service = stunnel-client cert = client.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 3 CApath = certificates CAfile = CAcert.pem client = yes [rdp] accept = 3398 connect = XX.XX.XX.XX:3398 But after switching to Stunnel 4.34 (preserving configuration) we started to get errors: 2010.11.25 13:13:30 LOG5[8332:5336]: Service rdp-database accepted connection from 127.0.0.1:30082 2010.11.25 13:13:30 LOG5[8332:5336]: connect_blocking: connected 95.130.236.42:3398 2010.11.25 13:13:30 LOG5[8332:5336]: Service rdp-database connected remote server from XX.XX.XX.XX:30083 2010.11.25 13:13:30 LOG5[8332:5336]: Certificate accepted: depth=1, /C=UA/ST=Lviv/L=Lviv region/O=ROSS/OU=IT/emailAddress=bla(a)bla.com 2010.11.25 13:13:30 LOG4[8332:5336]: CERT: Certificate not found in local repository 2010.11.25 13:13:30 LOG4[8332:5336]: Certificate check failed: depth=0, /C=UA/ST=Lviv/L=Lviv region/O=ROSS/OU=IT/CN=OURSERVER/emailAddress=bala(a)bla.com 2010.11.25 13:13:30 LOG3[8332:5336]: SSL_connect: 14090086: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed 2010.11.25 13:13:30 LOG5[8332:5336]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Main error is: CERT: Certificate not found in local repository Looks like stunnel cannot find the hashed server's certificate in C:\Program Files\stunnel\certificates (CApath = certificates) We tried specifying full paths, but it does not help. Switching to "verify=2" (do not check server's cert) works ok. Also stunnel 4.25 (with verify=3) works ok on this configuration. Could you help? Ross

2 1

Re: [stunnel-users] ssl renegotiation
by Jason Haar 24 Nov '10

24 Nov '10

On 11/25/2010 05:42 AM, Joe Williams wrote: > > Got it, so there's no way to configure stunnel to disable it without building a new openssl from source. I was thinking there might be an SSL option I could pass in. > That kind of feature was only introduced into the newer versions of OpenSSL, so by definition, older versions can't have an option to disable it ;-) FYI I still have to run fully patched Apache with "SSLInsecureRenegotiation on" due to MSIE still not supporting proper optional client cert renegotiation. It's only *2 years* since the vulnerability was discovered... (Chrome, Firefox are fine of course) -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

1 0

ssl renegotiation
by Joe Williams 24 Nov '10

24 Nov '10

List, How does one secure stunnel from man in the middle attacks regarding ssl renegotiation. I have seen http://www.openssl.org/docs/ssl/SSL_CTX_set_options.html#SECURE_RENEGOTIATI… but I couldn't tell if stunnel is affected by it, nor what I could do outside of installing a newer version of openssl to prevent it. Additionally I did a scan on www.ssllabs.com and it stated that insecure renegotiation was supported, which isn't good. I am running 0.9.8k-7ubuntu8.4, the standard version that ships with ubuntu 10.04, and stunnel 4.32. What can I do to configure stunnel to protect myself? My current config is below. Thanks. -Joe ; Certificate/key is needed in server mode and optional in client mode cert = /etc/stunnel/file.crt key = /etc/stunnel/file.key foreground = yes debug = 5 ciphers = DES-CBC3-SHA:AES256-SHA:AES128-SHA:RC4-SHA:RC4-MD5 ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = all options = NO_SSLv2 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 ; PID is created inside chroot jail pid = /stunnel4.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Service-level configuration [https] accept = 443 connect = localhost:80 TIMEOUTclose = 0 Name: Joseph A. Williams Email: joe(a)joetify.com Blog: http://www.joeandmotorboat.com/ Twitter: http://twitter.com/williamsjoe

2 2

SSLPassPhraseDialog
by Avinash Gaonkar 23 Nov '10

23 Nov '10

Hi Team, How can we configure ssl key passphrase in stunnel config file. for. eg SSLPassPhraseDialog exec:/path/to/passphrase-file parameter we have in apache, so no need to key in password every time when we restart service. Regards, Avinash Gaonkar

3 2

SMPP Protocol and STunnel
by Pathak, Apurva (Apu) 22 Nov '10

22 Nov '10

Hello, I would like to find out if I can use STunnel as follows: I have a stand alone C# executable program that uses a third party SDK that implements SMPP protocol and sends SMS text messages with wireless carriers. Recently, one of the wireless carriers wants us to implement SSL Client Authentication and wants SMPP messages that are exchanged with them to be encrypted after the client authentication is done. I want to find out if I can use STunnel running so that STunnel can encrypt and decrypt the messages exchanged between my program and the carrier's SMS server. (1) Is this possible with STunnel? (2) What are the steps involved? I am on the Windows Server 2003 platform. I would really appreciate a reply. Thanks, Apu

3 12

Re: [stunnel-users] Error: faulting application stunnel.exe, version 0.0.0.0, faulting module libeay32.dll, version 1.0.0.1, fault address 0x0007331e.
by Pathak, Apurva (Apu) 21 Nov '10

21 Nov '10

Ok...I may keep it....at the moment things are very stable so I am not touching any thing for the moment. The client mentioned it...and they examined the stunnel.conf of some of their other customers...so...otherwise it made sense to me to keep it. Thanks again for your help! Apurva ====== Hi Apurva, Good news. Just to mention: SslVersion=all OFTEN SOLVES MANY PROBLEMS in various circumstances. So I would keep it... Just search for it in the mailing list and you will see... This is just an advice... Yours sincerely, Pierre -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of stunnel-users-request(a)mirt.net Sent: Sunday, November 21, 2010 1:27 PM To: stunnel-users(a)mirt.net Subject: stunnel-users Digest, Vol 76, Issue 13 Send stunnel-users mailing list submissions to stunnel-users(a)mirt.net To subscribe or unsubscribe via the World Wide Web, visit http://stunnel.mirt.net/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)mirt.net You can reach the person managing the list at stunnel-users-owner(a)mirt.net When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..."

1 0

public domain [PATCH] to stunnel 4.34 for Windows CE / Windows Mobile, "no service" CRITICAL bug and unicode bugs fixed
by Pierre DELAAGE 17 Nov '10

17 Nov '10

Dear All, Please find enclosed a patch in "diff -cr orig patched" format, applying to stunnel4.34 as found here ftp://stunnel.mirt.net/stunnel/. This patch mainly addresses compilation and unicode issues for Windows CE targets + ONE critical issue preventing stunnel to service anything (!). I use MS EVC 4sp2 compiler with WCE 420 SDK, on a vista host platform. Once debugged the code works fine on WM6 HTC smartphones. Should work on WM5. It needs a windows CE openssl lib (I recompiled MY patched version of openssl 1.0.0a successfully: I will have to log a patch to those gentlemen, hoping that they are open to integrate it, something not so obvious in the past). I will later post here a link to my patch for openssl 100a pointing to the openssl mailing list. THIS OPENSSL PATCH IS ESSENTIAL : with my older version of openssl 098pre_j for wce, stunnel does not work anymore (it crashes after first cnx). The present stunnel patch addresses the following issues : ************* I] COMPILATION FAILURES 1/ on common.h "EINVAL redefinition" : in fact the compile options WX (see evc.mak) does not tolerate any warning : The MS evc420 compiler ALWAYS issues a warning on this symbol redefinition. Michal and I are dealing with it since month... But, considering that NEITHER Exxx error codes are used in stunnel, I suggest that in fact ALL these redef should be suppressed. TODO: In the future a proper rewrite of code in log.c, where hardcoded values of WSA error codes are used instead of symbolic constant, will have to be done. 2/ client.c CreateProcess is a UNICODE function: code was ascii only. Code has been adapted to work in unicode. 3/ evc.mak path to new openssl lib has been redefined. proper location for the libs in openssl tree has been set in the make-install block (although this block is presently USELESS and needs a complete rewrite). 4/ gui.c All code using hmainmenu is OFF under winCE. So some new lines involving it were not compiling. 5/ options.c linger_val.l_linger and linger_val.l_onoff require ushort values. Strict type checking of the compiler required a proper cast to ushort of the r-values. stralloc uses "strdup": on Win32 and winCE strdup is _strdup (!). 6/ prototypes.h : _beginthread was defined as returning an int, an a long in sthread.c. After some checking in various documentations, long is the correct type, in particular because _beginthread can return the special error value "-1L". So that unsigned types are illogical. This simplifies the code in some locations, by saving some -now useless- casts. 7/ sthread.c create_client: suppressed some useless cast to (long) for beginthread. ************* II] OPERATIONAL ERRORS (at run-time) This is a reminder of previous notification to the mailing list : due to beginthread improper code and/or use, It is presently IMPOSSIBLE for stunnel 434 to be used in production on WCE: it is just unable to service any...service. Nothing happens if, for example, you use it to connect to an https server. No log either ! I corrected the code with both Michal patch to gui.c and mine to sthread.c: gui.c (Michal patch) : _beginthread was called with 0 as stacksize which, cumulated to an improper coding of sthread/beginthread, led to FAILURE of service thread creation. sthread.c: _beginthread : now supports "0" stacksize value, leading to default linker stack size (1MB by default unless specified differently on the linker command line, something we do not yet perform but could). ************* III] MINOR IMPROVMENT _beginthread: added a log on critical event of "failure" to create a service thread. because I think it is a critical event, isn't it? I hope you will find this patch useful. Thank you for your excellent work, Yours sincerely, Pierre Delaage Note : I use stunnel to establish a simple "vpn" between smartphones and a corporate linux server mainly for HTTPS/POPS/SMTPS support. Stunnel is very relevant in that matter, over solutions based on SSH (although we use also ssh), from a communication cost point of view : ssh establishes permanent socket between client and server, so that the communication is charged by the mobile network provider : and these charges are very expensive. On the contrary stunnel only establishes ssl sockets on demand so that financial charges are limited to strict necessary. Please note that stunnel brings "client based certificate authentication" to POP/SMTP mobile mail user agents which only BASICALLY supports SSL with server authentication, but NO client authentication, such as M$ Outlook for Mobile (unless you pay for an exchange server and exchange client licence). Here again stunnel is very relevant. Note 2 : the strdup and unicode bug fixes should benefit also to the win32 (for PC) stunnel version for PC.

1 1

CApath hash calculation broken (ver 4.34)?
by Konstantin Suvorov 17 Nov '10

17 Nov '10

Hello, I’m trying to setup client-server SSL connection with “level 3” verification on server side. I use 4.34 precompiled binary package for win32. I put client certificates into CApath folder with hashed filenames (I use openssl x509 -hash to get them). And nothing works: I get “bad certificate”. After sniffing for filenames stunnel server is looking for I found out that they are not matching the hash values I got with openssl tool. I downloaded openssl binaries (ver. 0.9.8o) and put them into the stunnel folder. This fixed the bug with wrong filename request inside stunnel, but it started to crash after connection is initiated. I tried to install stunnel (fresh download of 4.34) on another computer – the same problem: requested hash-filename is not equal to actual one. Does anybody know how to fix this? Regards, Konstantin.

1 0

STunnel / Memory Usage / 4 Second Lag
by Jesse Proudman 16 Nov '10

16 Nov '10

We have an account running on STunnel that has been operating just fine for the last 9 days. This morning, all of a sudden, stunnel memory usage spiked to consume the entire available memory on the machine, and response time went from sub 1 second to 4+ seconds. Nothing has changed in the load balanced service itself, the configuration, or any of the traffic numbers. Restarting stunnel gets us between 5 and 60 seconds of normal response times before spiking in memory and going back to 4 seconds. Has any one seen this before? Thanks - Jesse

1 0

Difficulty to compile with alternate 64 bit openssl libraries
by Philippe A. 12 Nov '10

12 Nov '10

Hello, I am having a problem when I compile stunnel against 64 bit openssl libraries: ./configure --prefix $HOME/tls --with-threads=fork --with-ssl=/opt2/openssl stunnel will end up using default libraries in /lib (which I can't remove from my environment). The workaround we have found is to modify the configure script and to force the LIBS variable to use "lib64" instead of "lib". # Add SSL includes and libraries CFLAGS="$CFLAGS -I$ssldir/include" LIBS="$LIBS -L$ssldir/lib64 -lssl -lcrypto" #- <---- Is this a known problem? Is there another way around this without changing the configure script? Thanks!

2 1

Reg:libwrap is not working with stunnel 4.34
by mohan raj 09 Nov '10

09 Nov '10

Hi, I successfully cross compiled the Stunnel version 4.34 with OpenSSL version 1.0.0a for arm-linux.i want to use this stunnel with my own application which will communicate with outer world through LAN or GPRS.currently i am testing stunnel with telnet application.Its working fine.I am able to telnet to arm board through SSL enabled telnet terminal software.Now i want restrict the access.so i used the /etc/hosts/allow and /etc/hosts.deny files with my chrroot directory as "/".but stunnel is not at all cared about libwrap service.its not checking those files.if i give libwrap=yes in stunnel.conf file its says "specified option name is not valid here".i compiled stunnel with the option --enable-libwrap and gave the libwrap lib also through LDFLAGS.here with i attached my stunnel version information file, stunnel .conf file also.i think its due to configuration???still i don`t know what to do???so please guys help me out. Thanks & Regards S.Thiyagarajan.

3 4

Error Reading Certificate File
by Ken Davidson 04 Nov '10

04 Nov '10

Hi, I am trying to update my companies Certificate in STunnel and I'm getting the following error messages: Certificate: pass-web_new.pem Error reading certificate file: pass-web_new.pem error queue: 140DC009 : error:140DC009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib error queue: 906700D : error:0906700D:PEM routines:PEM_ASN1_read_bio:ASN1 lib error queue: D08303A : error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error error queue: D07803A : error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error SSL_CTX_use_certificate_chain_file: D0680A8: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag We are currently using STunnel without issue; but my certificate is due to expire November 15th. I submitted my request via a CSR file created with OPENSSL. I've attempted to put the data into the file pointed at in the stunnel.conf file but this error continues to haunt me. My previous key was 256, but when making this key I created a 1024 key and used that for the CSR file. I've also added the Intermediate certificate information to the file. Any information on what could be the problem is greatly appreciated. Version: 4.34 Thanks, Ken

1 0

FD_SETSIZE still an option in stunnel 4.34?
by Saikat Chakrabarti 04 Nov '10

04 Nov '10

Hi, I am having some issues with my server where connections are getting dropped once I hit a hard limit of around 350 connections. This may or may not be an issue with my stunnel configuration, but I ran across some old posts saying that stunnel by default has a hard limit of around 500 connections and, to get around this, to set FD_SETSIZE at compile time (I found this on the troubleshooting page - http://www.stunnel.org/faq/troubleshooting.html) However, one of the release notes recently also had a comment saying 'no more FD_SETSIZE limit!' - http://www.mail-archive.com/[email protected]/msg38373.html. So my questions are: 1) Does FD_SETSIZE still exist in Stunnel 4.34 and could it be a reason why I am seeing a limit on the number of people that can make a connection? I already tried running stunnel after setting ulimit -Hn and ulimit -Sn to 4096, and it did not seem to make a difference. 2) More noobish question - how do I set the FD_SETSIZE at compile time? I saw in the troubleshooting that it said to do "-DFD_SETSIZE=4096" at compile time. Is this something I should be adding in one of the Makefiles? Some more info about my setup: - I am using stunnel as a layer in front of Node.js to secure websockets and HTTP connections. - I'm running stunnel 4.34 - I am running stunnel from a startup script in /etc/init.d - it runs as a daemon process - I run stunnel with no params, but with this config file - http://pastebin.com/3Yr80ma1 - uname -a output: Linux gomockingbird.com 2.6.18.8-linode22 #1 SMP Tue Nov 10 16:12:12 UTC 2009 i686 GNU/Linux - gcc -v output: Using built-in specs. Target: i486-linux-gnu Configured with: ../src/configure -v --with-pkgversion='Ubuntu 4.3.3-5ubuntu4' --with-bugurl=file:///usr/share/doc/gcc-4.3/README.Bugs --enable-languages=c,c++,fortran,objc,obj-c++ --prefix=/usr --enable-shared --with-system-zlib --libexecdir=/usr/lib --without-included-gettext --enable-threads=posix --enable-nls --with-gxx-include-dir=/usr/include/c++/4.3 --program-suffix=-4.3 --enable-clocale=gnu --enable-libstdcxx-debug --enable-objc-gc --enable-mpfr --enable-targets=all --with-tune=generic --enable-checking=release --build=i486-linux-gnu --host=i486-linux-gnu --target=i486-linux-gnu Thread model: posix gcc version 4.3.3 (Ubuntu 4.3.3-5ubuntu4) - openssl version output: OpenSSL 0.9.8g 19 Oct 2007 Thanks in advance for any help! -- Saikat

2 3

Many services on the same port (VirtualHost)
by Hugo 01 Nov '10

01 Nov '10

Hello all! Does anyone knows a way to make many services listening on the same port? I've got one stunnel4 server which allows me to crypt two http servers. The first service bind on port 465 and the second on 470. What I will is to let user access on the port 465 using 2 different ServerNames. Thank you in anticipation, and excuse me for my quite bad english =D

4 3

Re: [stunnel-users] stunnel-users Digest, Vol 75, Issue 13
by Hugo 31 Oct '10

31 Oct '10

It's what I wanted to do: redirect the public 443 port on the correct local stunnel "accept:" port or service. I'd set 3 services with 3 different certificates on 3 ports. By eg, my first domain is ssl.example.com and the second admin.example.com. These two records point on the same IP. Stunnel has two services on that, so it binds two ports (!=443) (eg, 7100 and 7200) Is there a way to stunnel (or another program) bind on port 443 and, if user connects on ssl.example.com, forward frames/respond using the service/port 7100, and the same for admin.example.com on 7200? https://ssl.example.com ==> https://ssl.example.com:7100 https://admin.example.com ==>https://admin.example.com:7200 ? Thanks Message: 2 Date: Sat, 30 Oct 2010 11:45:19 -0400 (EDT) From: Jon Daley <stunnel(a)jon.limedaley.com> To: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] Many services on the same port (VirtualHost) Message-ID: <alpine.DEB.2.00.1010301139120.19689(a)orange.limedaley.com> Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed On Sat, 30 Oct 2010, Hugo wrote: > Does anyone knows a way to make many services listening on the same port? > I've got one stunnel4 server which allows me to crypt two http servers. > The first service bind on port 465 and the second on 470. > What I will is to let user access on the port 465 using 2 different > ServerNames. I am not sure what you are trying to do. You want clients to connect via https to ports 465 on two different IPs and then stunnel to forward them to the appropriate http daemon? I am not sure if stunnel works in that method - that is the reverse of what I use stunnel for - I connect via an unencrypted connection, and forward via stunnel to an encrypted daemon. And if you are talking about virtually hosting https connections, that will work, as long as the certificate contains both servernames - you can't use two different certificates, because you don't know which certificate to serve until after the connection is encrypted.

2 2

Re: [stunnel-users] Many services on the same port (VirtualHost)
by Hugo 30 Oct '10

30 Oct '10

Thanks for the answer, but it seems I haven't got access to IPTables (my stunnel is on a remote shell service) and I think using a webserver is not a good solution for that case. So does anyone knows a program able to bind on a single port, and redirect requests on another depending on the domain name? Thanks you in anticipation Hugo On 30/10/2010 17:02, Pierre DELAAGE wrote: > Hello, > The answer is simply NO in stunnel, > but yes in Apache. > If you are joining one "http server", hosting many virtual hosts, > it should be "trivial". > I recommend using IP based hosting. > > I guess you want to act as a transparent gateway/proxy to https servers : > there is another way to proceed if you have a linux PC on your network > that can act as a routing/gateway: > with iptables you can do redirection to stunnel and get what you want. > Sorry but it is a little bit complicated to develop more now. > > Hope this helps, > Pierre Delaage > > > Le 30/10/2010 17:12, Hugo a écrit : >> Hello all! >> >> Does anyone knows a way to make many services listening on the same port? >> I've got one stunnel4 server which allows me to crypt two http servers. >> The first service bind on port 465 and the second on 470. >> What I will is to let user access on the port 465 using 2 different >> ServerNames. >> >> Thank you in anticipation, and excuse me for my quite bad english =D >> >> >> >> _______________________________________________ >> stunnel-users mailing list >> stunnel-users(a)mirt.net >> http://stunnel.mirt.net/mailman/listinfo/stunnel-users >

2 1

Re: [stunnel-users] openssl cross compiling for windows
by Jon Daley 29 Oct '10

29 Oct '10

On Wed, 27 Oct 2010, Jon Daley wrote: > On Wed, 27 Oct 2010, Michal Trojnara wrote: >> Jon Daley wrote: >>>> 3. Cross-compile OpenSSL: >>>> ./Configure --cross-compile-prefix=i586-mingw32msvc- mingw shared >>>> zlib-dynamic >>>> make >>> And you end up with 3 dlls in the openssl directory? >> >> Not really. Just 2 of them. Zlib is produced in step 2. > Hrm. I wasn't talking about the zlib1.dll. I meant: > ssleay32.dll, libssl32.dll and libeay32.dll. Maybe I got mixed up the names, > and am using one that I don't need. I thought I put them in one at a time, > and waited for Windows to ask me for them, but I'll check again. Ah, yes. I am dumb. I can compile and run it without problems with just the two *eay32 dlls. And we've finally figured out the other bug, where it works on my computer, and not on someone else's. It has to do with ipv6 support, and it didn't go away even after I ./config --disable-ipv6, which that flag is (mostly?) ignored in the windows builds, due to the dynamic LoadLibrary calls. On one computer, stunnel connects on the ipv6 port, but then when running "telnet localhost 7000", it connects via the ipv4 port, and so fails. If we force stunnel to use ipv4 by using 127.0.0.1 instead of localhost, everything works fine. My guess is that his computer is partially/incorrectly configured for ipv6, and so that is the reason for the failure. I'm planning on removing the LoadLibrary calls to force ipv6 to be off, though it'd be nice to not do that, since someday, there will be an ipv6-only network that we'll have to deal with presumably. -- Jon Daley http://jon.limedaley.com ~~ For many people, one of the most frustrating aspects of life is not being to understand other people's behavior. We see them as "guilty" instead of "innocent." -- Unknown

2 2

Re: [stunnel-users] openssl cross compiling for windows
by Jon Daley 27 Oct '10

27 Oct '10

On Wed, 27 Oct 2010, Michal Trojnara wrote: > 1. Install mingw32 tools: > apt-get install mingw32 Yes, I did that. > 2. Cross-compile and install zlib > (see the zlib documentation for details) Yes, I was doing that, but then was leaving it out since I don't need it (AFAIK). > 3. Cross-compile OpenSSL: > ./Configure --cross-compile-prefix=i586-mingw32msvc- mingw shared > zlib-dynamic > make And you end up with 3 dlls in the openssl directory? > 4. Cross-compile stunnel: > cd src > make stunnel.exe I can compile stunnel.exe fine, I just can't run it, because I don't have all three of the dlls. -- Jon Daley http://jon.limedaley.com ~~ If you do a job too well, you will get stuck with it. -- Slous

2 1

openssl cross compiling for windows
by Jon Daley 27 Oct '10

27 Oct '10

I am trying to compile openssl and stunnel for Win32, using my Debian host. openssl compilation: ./Configure --cross-compile-prefix=i586-mingw32msvc- mingw shared no-zlib && make The only problem I'm having is that libssl32.dll is not being created. I have the other libssl* files: libssl.a libssl.dll.a libssl.pc So, then I download the precompiled dlls of openssl from here: http://www.slproweb.com/products/Win32OpenSSL.html But, they require an additional vc redistributable, and since it seems like I'm so close, it'd be nice to finish it off the rest of the way. stunnel compiles fine pointing it at the openssl directory, but on run-time, it complains that libssl32.dll can't be found. Thanks. -- Jon Daley http://jon.limedaley.com ~~ There are no traffic jams when you go the extra mile. -- Anonymous

2 1

Stunnel dropping data on binary uploads from most browsers.
by Bill Crowell 16 Oct '10

16 Oct '10

All, I'm hoping that someone can assist with this. I'm using Stunnel on 2 different systems: Mac and FC 13 to front-end my web server for a custom database system. It works flawlessly except for uploading large binary files. The problem comes when trying to upload say a 2.5MB image file. The number of bytes actually transferred to the exec program is usually under 1K or right at about 33K. Using Firefox on Windows works all the time. I can observe the transfer by watching the stunnel.log file. When the data is piped into the openSSL engine, the number of bytes written to socket is being picked up by the exec program and processed so the loss is between the browser and the output side of Stunnel. The message itself is a multi-part message that is not mime-encoded. The part with the image is set in the boundary properly and contains the JPEG binary. (Thanks to HTTPwatch!) My Stunnel Version is: [root@linux log]# stunnel -version stunnel 4.33 on i386-redhat-linux-gnu with OpenSSL 1.0.0a-fips 1 Jun 2010 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = daemon.notice pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!aNULL:!eNULL:!SSLv2 session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none My configuration file on the Linux box is: cert = /etc/stunnel/server.crt key = /etc/stunnel/server.key debug = 7 output = /var/log/stunnel.log ;socket = l:SO_LINGER=1:60 ;socket = r:TCP_NODELAY=1 client = no sslVersion = SSLv3 [https] libwrap = no accept = 443 exec = /usr/qmsys/bin/qm execargs = /usr/qmsys/bin/qm -b7 -quiet -aPAVUK "P.HTTP" options = DONT_INSERT_EMPTY_FRAGMENTS TIMEOUTidle = 30 TIMEOUTbusy = 5 TIMEOUTclose = 0 *** A RANDOM SUCCESSFUL TRANSFER *** 2010.10.15 10:03:12 LOG7[946:3078133552]: Service https accepted FD=0 from 24.171.161.99:1998 2010.10.15 10:03:12 LOG7[946:3078241136]: Service https started 2010.10.15 10:03:12 LOG7[946:3078241136]: FD=0 in non-blocking mode 2010.10.15 10:03:12 LOG5[946:3078241136]: Service https accepted connection from 24.171.161.99:1998 2010.10.15 10:03:12 LOG7[946:3078241136]: SSL state (accept): before accept initialization 2010.10.15 10:03:12 LOG7[946:3078241136]: SSL state (accept): SSLv3 read client hello A 2010.10.15 10:03:12 LOG7[946:3078241136]: SSL state (accept): SSLv3 write server hello A 2010.10.15 10:03:12 LOG7[946:3078241136]: SSL state (accept): SSLv3 write change cipher spec A 2010.10.15 10:03:12 LOG7[946:3078241136]: SSL state (accept): SSLv3 write finished A 2010.10.15 10:03:12 LOG7[946:3078241136]: SSL state (accept): SSLv3 flush data 2010.10.15 10:03:12 LOG7[946:3078241136]: SSL state (accept): SSLv3 read finished A 2010.10.15 10:03:12 LOG7[946:3078241136]: 8 items in the session cache 2010.10.15 10:03:12 LOG7[946:3078241136]: 0 client connects (SSL_connect()) 2010.10.15 10:03:12 LOG7[946:3078241136]: 0 client connects that finished 2010.10.15 10:03:12 LOG7[946:3078241136]: 0 client renegotiations requested 2010.10.15 10:03:12 LOG7[946:3078241136]: 35 server connects (SSL_accept()) 2010.10.15 10:03:12 LOG7[946:3078241136]: 35 server connects that finished 2010.10.15 10:03:12 LOG7[946:3078241136]: 0 server renegotiations requested 2010.10.15 10:03:12 LOG7[946:3078241136]: 27 session cache hits 2010.10.15 10:03:12 LOG7[946:3078241136]: 0 external session cache hits 2010.10.15 10:03:12 LOG7[946:3078241136]: 0 session cache misses 2010.10.15 10:03:12 LOG7[946:3078241136]: 0 session cache timeouts 2010.10.15 10:03:12 LOG6[946:3078241136]: SSL accepted: previous session reused 2010.10.15 10:03:12 LOG6[946:3078241136]: Local mode child started (PID=1179) 2010.10.15 10:03:12 LOG7[946:3078241136]: Remote FD=13 initialized 2010.10.15 10:03:13 LOG7[946:3078241136]: Socket closed on read 2010.10.15 10:03:13 LOG7[946:3078241136]: SSL write shutdown 2010.10.15 10:03:13 LOG7[946:3078241136]: SSL alert (write): warning: close notify 2010.10.15 10:03:13 LOG6[946:3078241136]: SSL_shutdown successfully sent close_notify 2010.10.15 10:03:13 LOG6[946:3078241136]: s_poll_wait timeout: connection close 2010.10.15 10:03:13 LOG5[946:3078241136]: Connection closed: 2895 bytes sent to SSL, 2469539 bytes sent to socket 2010.10.15 10:03:13 LOG7[946:3078241136]: Service https finished (0 left) 2010.10.15 10:03:13 LOG7[946:3078133552]: Cleaning up the signal pipe 2010.10.15 10:03:13 LOG6[946:3078133552]: Child process 1179 finished with code 0 2010.10.15 10:03:13 LOG7[946:3078133552]: Signal pipe is empty *** MOST OF THE TIME - AN UNSUCCESSFUL TRANSFER *** 2010.10.15 10:05:01 LOG7[946:3078133552]: Service https accepted FD=0 from 24.171.161.99:1985 2010.10.15 10:05:01 LOG7[946:3077921648]: Service https started 2010.10.15 10:05:01 LOG7[946:3077921648]: FD=0 in non-blocking mode 2010.10.15 10:05:01 LOG5[946:3077921648]: Service https accepted connection from 24.171.161.99:1985 2010.10.15 10:05:01 LOG7[946:3077921648]: SSL state (accept): before/ accept initialization 2010.10.15 10:05:01 LOG7[946:3077921648]: SSL state (accept): SSLv3 read client hello A 2010.10.15 10:05:01 LOG7[946:3077921648]: SSL state (accept): SSLv3 write server hello A 2010.10.15 10:05:01 LOG7[946:3077921648]: SSL state (accept): SSLv3 write change cipher spec A 2010.10.15 10:05:01 LOG7[946:3077921648]: SSL state (accept): SSLv3 write finished A 2010.10.15 10:05:01 LOG7[946:3077921648]: SSL state (accept): SSLv3 flush data 2010.10.15 10:05:01 LOG7[946:3077921648]: SSL state (accept): SSLv3 read finished A 2010.10.15 10:05:01 LOG7[946:3077921648]: 9 items in the session cache 2010.10.15 10:05:01 LOG7[946:3077921648]: 0 client connects (SSL_connect()) 2010.10.15 10:05:01 LOG7[946:3077921648]: 0 client connects that finished 2010.10.15 10:05:01 LOG7[946:3077921648]: 0 client renegotiations requested 2010.10.15 10:05:01 LOG7[946:3077921648]: 44 server connects (SSL_accept()) 2010.10.15 10:05:01 LOG7[946:3077921648]: 44 server connects that finished 2010.10.15 10:05:01 LOG7[946:3077921648]: 0 server renegotiations requested 2010.10.15 10:05:01 LOG7[946:3077921648]: 35 session cache hits 2010.10.15 10:05:01 LOG7[946:3077921648]: 0 external session cache hits 2010.10.15 10:05:01 LOG7[946:3077921648]: 0 session cache misses 2010.10.15 10:05:01 LOG7[946:3077921648]: 0 session cache timeouts 2010.10.15 10:05:01 LOG6[946:3077921648]: SSL accepted: previous session reused 2010.10.15 10:05:01 LOG6[946:3077921648]: Local mode child started (PID=1213) 2010.10.15 10:05:01 LOG7[946:3077921648]: Remote FD=13 initialized 2010.10.15 10:05:04 LOG7[946:3077921648]: Socket closed on read 2010.10.15 10:05:04 LOG7[946:3077921648]: SSL write shutdown 2010.10.15 10:05:04 LOG7[946:3077921648]: SSL alert (write): warning: close notify 2010.10.15 10:05:04 LOG6[946:3077921648]: SSL_shutdown successfully sent close_notify 2010.10.15 10:05:04 LOG6[946:3077921648]: s_poll_wait timeout: connection close 2010.10.15 10:05:04 LOG5[946:3077921648]: Connection closed: 2895 bytes sent to SSL, 66703 bytes sent to socket 2010.10.15 10:05:04 LOG7[946:3077921648]: Service https finished (0 left) 2010.10.15 10:05:04 LOG7[946:3078133552]: Cleaning up the signal pipe 2010.10.15 10:05:04 LOG6[946:3078133552]: Child process 1213 finished with code 0 2010.10.15 10:05:04 LOG7[946:3078133552]: Signal pipe is empty *** All test cases are the same upload of the same image file. In all tests the number of bytes sent to socket matches what the exec program is receiving in its pipe. My feeling is that there is a connection issue between the browser and Stunnel. The successful upload of the test occurs sometimes with all browsers and appears to always work with Firefox for Windows. It has a 90% failure rate on Safari for Windows, Safari for Mac, Opera for Windows, Opera for Mac, etc. In all cases of testing, the number of bytes "sent to socket" is received by my exec program and consists of a truncated message from the browser. It appears that the data is simply being truncated somewhere in the Stunnel process. Any help is always appreciated! If there are more tests to be run to track down the problem, please advise and I will run them. Regards, Bill Bill Crowell, President Pavuk Technologies, LLC PO Box 33097 Charlotte, NC 28233-3097 Office +1 704.248.0024 Mobile +1 704.607.6077 Skype pavuk.com

2 1

Recompiling Stunnel at version 4.34 appears to fix dropped data problem
by Bill Crowell 15 Oct '10

15 Oct '10

I reported a consistent data loss from most browsers when transferring large files. Compiling version 4.34 on Mac OS X 10.6.4 with the latest Xcode toolkit has resolved the connection problem for all browsers that I have tested except for Safari 5.0 on both Windows and Mac. It has also fixed a connection problem with IE 6 which was not accepting any connection to Stunnel prior to this installation. *** This problem still persists on my linux box running 4.33 installed from FC13. I will attempt a compile of 4.34 and see if this fixes the problem there as well. Fedora does not yet have a package for 4.34. Bill Bill Crowell, President Pavuk Technologies, LLC PO Box 33097 Charlotte, NC 28233-3097 Office +1 704.248.0024 Mobile +1 704.607.6077 Skype pavuk.com

1 0

Re: [stunnel-users] stunnel daemon mode
by Joe Williams 08 Oct '10

08 Oct '10

> In inetd mode, you get a new Stunnel process for every connection. > Initialization must occur in *each* new process - they don't share > any state, including any session ids. > > In daemon mode, there's one stunnel process (threaded) which can > share state between threads, so it is much better. Ah I see, so running a single process (w/ pthreads) under runit I get the same effect as daemon mode. Correct? -Joe Name: Joseph A. Williams Email: joe(a)joetify.com Blog: http://www.joeandmotorboat.com/ Twitter: http://twitter.com/williamsjoe

1 0

stunnel daemon mode
by Joe Williams 07 Oct '10

07 Oct '10

According to http://www.sans.org/reading_room/whitepapers/vpns/stunnel-ssling-internet-s… In addition, Stunnel performance is improved by running it in daemon mode instead of inetd. Running Stunnel in daemon mode provides the following benefits: no SSL initialization necessary with every connection, and SSL session caching. Is this still the case? Running in the foreground you don't get these? Thanks. -Joe Name: Joseph A. Williams Email: joe(a)joetify.com Blog: http://www.joeandmotorboat.com/ Twitter: http://twitter.com/williamsjoe

1 0

fingerprint does not match
by Nelson 02 Oct '10

02 Oct '10

I have a running machine with stunnel installed for HTTPS services. Now, I want to setup another machine using the same configuration and key from my 1ST machine. I have installed stunnel patch with x-forwarded-for. However, everytime I try to start it up, it shows: Starting universal SSL tunnel: stunnelReading configuration from file /usr/local/etc/stunnel/stunnel.conf FIPS_mode_set: 2D06C06E: error:2D06C06E:FIPS routines:FIPS_mode_set:fingerprint does not match failed. I'm using the same key and cert that my 1ST machine is using. Would there be a problem? I've no problem starting stunnel yesterday. I just encountered this error when I change my ip address. I make sure that my config also listen to this ip address. Would anyone know how to fix this problem? Tried to Google but to no avail.

3 2

pop3 stunnel nmh to gmail
by Joseph Brenner 27 Sep '10

27 Sep '10

I'm an nmh user running ubuntu jaunty, and I want to get my local email working over SSL connections to a gmail account (POP3/SMTP). So I'm trying to get some form of mh to talk over SSL using stunnel4. I'm looking for suggestions on what I might be doing wrong, and hints on how to go about isolating the problems. I've succeeded in using slypheed to get mail from gmail, so I know the gmail account is working and is set-up for pop3 and so on. When I run mh's inc command, though, it just reports: "inc: no servers available" I can see that I've got stunnel running by doing a: ps ax | egrep stun | egrep -v egrep 5937 ? SN 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf 5938 ? SN 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf 5939 ? SN 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf 5940 ? SN 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf 5941 ? SN 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf 5942 ? SNs 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf Google has some instructions up about servers and port numbers (but no examples specific to stunnel): http://mail.google.com/support/bin/answer.py?hl=en&answer=13287 Here's a summary of the kind of configurations I've been trying: /etc/default/stunnel4: ENABLED=1 FILES="/etc/stunnel/*.conf" OPTIONS="" PPP_RESTART=0 /etc/stunnel/stunnel.conf: sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [pop3s] accept = 127.0.0.1:995 connect = pop.gmail.com:110 [smtps] accept = 127.0.0.1:465 connect = smtp.gmail.com:25 /etc/nmh/mts.conf: mts: smtp hostable: /etc/nmh/hosts localname: smtp.gmail.com # localname: gmail.com masquerade: mmdfldir: /var/mail mmdflfil: # pophost: localhost # pophost: pop.gmail.com:995 pophost: pop.gmail.com:110 # pophost: pop.gmail.com # servers: localhost servers: smtp.gmail.com /var/log/stunnel4/stunnel.log 2010.09.21 11:11:41 LOG7[6528:140533218399984]: Snagged 64 random bytes from /dev/urandom 2010.09.21 11:11:41 LOG7[6528:140533218399984]: RAND_status claims sufficient entropy for the PRNG 2010.09.21 11:11:41 LOG7[6528:140533218399984]: PRNG seeded successfully 2010.09.21 11:11:41 LOG7[6528:140533218399984]: SSL context initialized for service pop3s 2010.09.21 11:11:41 LOG7[6528:140533218399984]: SSL context initialized for service imaps 2010.09.21 11:11:41 LOG7[6528:140533218399984]: SSL context initialized for service smtps 2010.09.21 11:11:41 LOG5[6528:140533218399984]: stunnel 4.22 on x86_64-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2010.09.21 11:11:41 LOG5[6528:140533218399984]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2010.09.21 11:11:41 LOG6[6528:140533218399984]: file ulimit = 1024 (can be changed with 'ulimit -n') 2010.09.21 11:11:41 LOG6[6528:140533218399984]: poll() used - no FD_SETSIZE limit for file descriptors 2010.09.21 11:11:41 LOG5[6528:140533218399984]: 500 clients allowed 2010.09.21 11:11:41 LOG7[6528:140533218399984]: FD 10 in non-blocking mode 2010.09.21 11:11:41 LOG7[6528:140533218399984]: FD 11 in non-blocking mode 2010.09.21 11:11:41 LOG7[6528:140533218399984]: FD 12 in non-blocking mode 2010.09.21 11:11:41 LOG7[6528:140533218399984]: SO_REUSEADDR option set on accept socket 2010.09.21 11:11:41 LOG7[6528:140533218399984]: pop3s bound to 127.0.0.1:1109 2010.09.21 11:11:41 LOG7[6528:140533218399984]: FD 13 in non-blocking mode 2010.09.21 11:11:41 LOG7[6528:140533218399984]: SO_REUSEADDR option set on accept socket 2010.09.21 11:11:41 LOG7[6528:140533218399984]: imaps bound to 0.0.0.0:993 2010.09.21 11:11:41 LOG7[6528:140533218399984]: FD 14 in non-blocking mode 2010.09.21 11:11:41 LOG7[6528:140533218399984]: SO_REUSEADDR option set on accept socket 2010.09.21 11:11:41 LOG7[6528:140533218399984]: smtps bound to 127.0.0.1:259 2010.09.21 11:11:41 LOG7[6534:140533218399984]: Created pid file /stunnel4.pid /var/log/mail.log Sep 21 13:40:32 fineline gnu-pop3d[15484]: Incoming connection opened Sep 21 13:40:32 fineline gnu-pop3d[15484]: connect from 127.0.0.1 Sep 21 13:40:32 fineline gnu-pop3d[15484]: User `doomvox(a)gmail.com': nonexistent Sep 21 13:40:32 fineline gnu-pop3d[15484]: Session ended for no user I'm using the "stunnel4" package for ubuntu jaunty: /usr/bin/stunnel4 -version stunnel 4.22 on x86_64-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel4.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none uname -a Linux fineline 2.6.24-16-generic #1 SMP Thu Apr 10 12:47:45 UTC 2008 x86_64 GNU/Linux gcc -v Using built-in specs. Target: x86_64-linux-gnu Configured with: ../src/configure -v --with-pkgversion='Ubuntu 4.3.3-5ubuntu4' --with-bugurl=file:///usr/share/doc/gcc-4.3/README.Bugs --enable-languages=c,c++,fortran,objc,obj-c++ --prefix=/usr --enable-shared --with-system-zlib --libexecdir=/usr/lib --without-included-gettext --enable-threads=posix --enable-nls --with-gxx-include-dir=/usr/include/c++/4.3 --program-suffix=-4.3 --enable-clocale=gnu --enable-libstdcxx-debug --enable-objc-gc --enable-mpfr --with-tune=generic --enable-checking=release --build=x86_64-linux-gnu --host=x86_64-linux-gnu --target=x86_64-linux-gnu Thread model: posix gcc version 4.3.3 (Ubuntu 4.3.3-5ubuntu4) openssl version OpenSSL 0.9.8g 19 Oct 2007

2 1

Critical error on stunnel 434 for WinCE/Windows Mobile: no service at all, because of failure in thread creation
by Pierre DELAAGE 26 Sep '10

26 Sep '10

Hello Michal, Maybe you remember me, I am the man that refreshed stunnel for winCE up to 4.27 version. Thank you for having included my code to your mainstream at that time. As a win32 regular programmer I always check that my code is as close as possible as that of the main win32 stream for PC. I am writing you today to point out a critical bug that prevent stunnel 4.34 from servicing any service at all . I have fixed that bug and will send you a refresh of all the sources (that needed some after some win32 PC version updates) soon. SO DO NOT DO ANYTHING. the bug is in sthread.c: the wince _beginthread port has been modified (by someone else but me) as this : v434: handle=CreateThread(NULL, stack_size, (LPTHREAD_START_ROUTINE)start_address, arglist, STACK_SIZE_PARAM_IS_A_RESERVATION, &thread_id); the "STACK_SIZE_PARAM_IS_A_RESERVATION" flag is the novelty from 4.27. The problem is that beginthread is being called from gui.c with stacksize=0 SO THAT a stack of 0 size "TRIES to be RESERVED" and then CreateThread FAILS to return a valid handle. That is to say that no thread is created, and thus NO TUNNELING SERVICE at all can be delivered. So stunnel cannot work at all. Solution : the proper call is : handle=CreateThread(NULL, stack_size, (LPTHREAD_START_ROUTINE)start_address, arglist, (stack_size > 0) ? STACK_SIZE_PARAM_IS_A_RESERVATION:0, &thread_id); I repeat and insist : please DO NOT DO anything to the code, as I will send soon a refresh with various other updates (because apart from that critical bug, the code needs other refresh to compile properly), and as I am also working on a refresh of openssl up to 1.0.0a (those gentlemen at openssl never included any wce patch to their mainstream, which is really a pity, but another story). See you soon, Thank you again for all the work you do for the community of people, Pierre

2 4

stunnel v4.32 & mac v10.6.3
by Cherry Ngai 24 Sep '10

24 Sep '10

Hello, I am new to stunnel. My stunnel v4.32 is installed to my mac v10.6.3 using MacPort. I am trying to setup active directory, but there is no process start when i run sudo /opt/local/bin/stunnel /opt/local/etc/stunnel/stunnel.conf There is no error msg after i run the command. I believe it could have something to do with my configuration? Having it running in debug mode, I can't find the created output file. Could someone help me? Or tell me where i can find the output file? Thanks! Stunnel seems successfully installed, as it has returned the following with the command "sudo stunnel -version" stunnel 4.32 on i686-apple-darwin10.3.0 with OpenSSL 1.0.0a 1 Jun 2010 Threading:PTHREAD SSL:ENGINE Sockets:SELECT,IPv6 Auth:LIBWRAP Global options debug = daemon.notice pid = /opt/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /opt/local/etc/stunnel/stunnel.pem ciphers = ALL:!aNULL:!eNULL:!SSLv2 session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none Here is my config: cert = /opt/local/etc/stunnel/stunnel.pem key = /opt/local/etc/stunnel/stunnel.pem sslVersion = SSLv3 chroot = /opt/local/var/lib/stunnel/ setuid = nobody setgid = nogroup pid = /stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = stunnel.log client = yes [ActiveDirectory1] accept = 391 connect = SOME_IP:636 Cheers, Cherry

1 0

Target version/timeframe for drawing identity certs from Windows cert store?
by Bucci, David G 22 Sep '10

22 Sep '10

Hi - in an exchange last week, Michal, it sounded like you might be planning on adding the capability/option to the Windows version to select an identity certificate from the Windows certificate store (because it turns out OpenSSL added some supporting infrastructure for doing so, if I understood correctly). For planning purposes, do you have any sense yet of whether that's really going to happen, and in what timeframe or what target version? I think that'd be a change of high interest to a lot of people ... one suggestion, it would help integrators if there was a way to configure a msg into whatever selection dialog that comes up, asking the user to select a certificate from their identity store. Thinking out loud -- probably also, in the case where multiple client tunnels are being set up, a way to make it either a global selection (for all client services), or a service specific selection -- hmm, though global only is probably fine, thinking about, since an integrator could always create a 2nd config, if a 2nd tunnel is needed Thinking further, you would probably want to be careful that it would work early on during login, since I imagine like us, integrators would want to start it from a user's Startup folder, or from a login script. I don't know Windows well enough to know if that constrains you (if the window mgr is up during login script exec, etc.). Thx! ---- David G. Bucci If you can't think of anything kind to say, could you at least have the decency to be vague?

1 0

Server side logging, no connection details logged
by Bucci, David G 22 Sep '10

22 Sep '10

Hi - using Stunnel to enforce client certificate based authentication, and as part of that, we want to log accesses, and the CN used to access, on the server side (kind of an audit log). On the client side, with debug set to 7, we get details about the connection, the SSL steps in the handshake, etc. - but on the server side, even with debug = 7, we're not seeing any info at all about the connections that are occurring. Sooo ... is there a way to enable such logging on the server side of the tunnel? Or possibly turn on independent logging in the OpenSSL libs that are used? I looked, but haven't found anything online about this. Thx! ---- David G. Bucci If you can't say anything nice, at least have the decency to be vague.

1 2

FIPS compliance
by Bucci, David G 21 Sep '10

21 Sep '10

The documentation on fips= seems ambiguous to me ... does leaving it at the default of "yes" /prevent/ FIPS 140-2 compliance mode, or mandate it? Or does it do something else I'm not understanding? Basically, the q. is, what do you have to configure to ensure that you're operating in a FIPS 140-2 compliant manner (at least, as the version of OpenSSL libs bundled understood it)? Do you have to specify ciphers that are validated, etc.? Or just set that config option to "yes" ("no"?)? And how can one tell if the stunnel binary in use was compiled with FIPS support active? (I'm using the Windows 4.33 binary d/l'ed from mirt.net) Tia! ---- David G. Bucci Chuck Norris can kick through all 6 degrees of separation, hitting anyone, anywhere, in the face, at any time. -- ChuckNorrisFacts.com

2 1

Large performance difference: Solaris vs Linux
by Cliffe, Stephen 20 Sep '10

20 Sep '10

Hi, I've just been comparing the performance of stunnel on Solaris 10 & Linux (Centos 5.5) and am seeing a big difference. I'm using stunnel 4.33 compiled with the same options on both platforms and the tcpstress benchmarking tool (http://stunnel.mirt.net/?page=perf) On a Dell 780 running Solaris 10 I got 163.31 connections/second but on an older, slower Dell 620 running Linux I got 408.01 connections/second. Both machines were otherwise idle. Does anyone know why there would be such a big difference between the two OS's? Thanks, Steve. Steve Cliffe Senior Engineer - Development Infrastructure Team Andrew Network Solutions Asia Pacific [ Address : Andrew Corporation Building (39), Northfields Avenue, Wollongong University, NSW, Australia 2500 ] [ Postal Address : PO Box U40, Wollongong University, NSW, Australia 2500 ] [ Tel : +61 2 4221 2991] [ Fax : +61 2 4221 2901 ] [ Email : Stephen.Cliffe(a)andrew.com] Visit Andrew on the Web at www.andrew.com<http://www.andrew.com/> [cid:[email protected]][cid:[email protected]]

3 5

Generically referencing file locations in stunnel.conf
by Bucci, David G 20 Sep '10

20 Sep '10

Hi - I'm back to trying to run Stunnel with a different user certificate for each user. So far, the best technique I've found is to have a separate stunnel.conf for each user (in their home directory, which is referenced by envvar %USERPROFILE%), and run stunnel using that configuration file. As part of that, I'm trying to generically reference file locations (log, user certificates) in the .conf. But I haven't found a way short of fully pathing the locations in the .conf e.g. "output=c:\users\dbucci\stunnel\stunnel.log". That's undesirable, because it means I have to make every user's .conf unique. So ... is there a generic way to accomplish this? I've tried setting the "Start In" location in the Windows shortcut to that location (via envvar %USERPROFILE%, which allows me to make every user's shortcut generic), then saying "output=.\stunnel.log", but without success - it seems to always be using c:\program files\stunnel as it's starting point for reference. Likewise, the envvar isn't usable in the .conf Note that I thought about creating a subdir per user in C:\program files\stunnel (with appropriate perms for that user), but can't, because in many of our deployment locations, users aren't permitted to write to c:\program files. Btw, this is why I'm asking about the commandline parms in Windows - I don't seem to be able to get them to work, but if I could, I could say e.g. "-o %USERPROFILE%\stunnel\stunnel.log", and that would work generically for every user. Likewise, I could use "-A %USERPROFILE&\stunnel\usercert.pem" and have a generic way of installing user certs. Heck, if I could set ALL the options via command line (-c, -r, etc.) I would love to simply do away with a user-specific .conf file. So ... sorry for rambling a bit, but any help with the intent of what I'm trying to accomplish, make as generic as possible a user-specific config setup? Thx! ---- David G. Bucci Chuck Norris can kick through all 6 degrees of separation, hitting anyone, anywhere, in the face, at any time. -- ChuckNorrisFacts.com

2 2

Command line args available on Windows version 4.33?
by Bucci, David G 20 Sep '10

20 Sep '10

Hi - are all the command line arguments documented at http://www.stunnel.org/faq/args.html#ToC1 available in the Windows 4.33 version? When you execute stunnel -V, very few are listed. And if they are available, do they take precedence over a configuration file, if one is used? (Is a .conf mandatory, or can you set all the required options via command line in the Windows version?) Thx! ---- David G. Bucci Chuck Norris can kick through all 6 degrees of separation, hitting anyone, anywhere, in the face, at any time. -- ChuckNorrisFacts.com

2 1

Accept connections only from local processes?
by Bucci, David G 20 Sep '10

20 Sep '10

Hi - I'm looking to configure Stunnel in client mode to accept connections only from the PC it's running on. Would the config option "socket = a:SO_BINDTODEVICE=lo" accomplish that? And would this work on Windows? (is there a "lo" interface on Windows?) I'm going to do some testing, but thought I'd ask in case someone already knows I'll be pounding sand. And before anyone asks, turning on a firewall isn't an option - we don't have control of all the PCs involved. ---- David G. Bucci Chuck Norris can kick through all 6 degrees of separation, hitting anyone, anywhere, in the face, at any time. -- ChuckNorrisFacts.com

2 1

(no subject)
by Sunil Karumuri 16 Sep '10

16 Sep '10

Hello- I am new to Stunnel and have a basic architecture question. I have Stunnel installed on box A where it receives http messages from multiple client processes . Stunnel sends them to box B via https (mutual ssl). We are seeing that Stunnel opens one connection for each client processes. Can we configure Stunnel to have only ONE SSL connection (or a pool of connections) between box A and B and have Stunnel use the open connection for all traffic from various clients ? We would like to avoid the overhead of SSL-handshake for each new client process. Thanks for the help. Sunil

3 2

Hey buddy, can you review a log file?
by Jay Sprenkle 08 Sep '10

08 Sep '10

Good afterrnoon, Can anyone review the stunnel log file below and see if there's any indication of a problem? What we're doing with stunnel: We're using stunnel to encrypt a tcp connection between a client and our server. What's happening: A client is reporting the connection fails. I believe it's a timeout issue on the client software. My interpretation of this log is that the session is open about 4 seconds then closed by the client. Is that correct? Thanks in advance Stunnel Log: 2010.09.08 14:34:38 LOG7[1392:2328]: Service exchange started 2010.09.08 14:34:38 LOG7[1392:2328]: FD=200 in non-blocking mode 2010.09.08 14:34:38 LOG5[1392:2328]: Service exchange accepted connection from 127.0.0.1:2340 2010.09.08 14:34:38 LOG7[1392:2328]: FD=224 in non-blocking mode 2010.09.08 14:34:38 LOG6[1392:2328]: connect_blocking: connecting xxx.242.123.150:7443 2010.09.08 14:34:38 LOG7[1392:2328]: connect_blocking: s_poll_wait xxx.242.123.150:7443: waiting 10 seconds 2010.09.08 14:34:38 LOG5[1392:2328]: connect_blocking: connected xxx.242.123.150:7443 2010.09.08 14:34:38 LOG5[1392:2328]: Service exchange connected remote server from 192.168.1.29:2341 2010.09.08 14:34:38 LOG7[1392:2328]: Remote FD=224 initialized 2010.09.08 14:34:38 LOG7[1392:2328]: SSL state (connect): before/connect initialization 2010.09.08 14:34:38 LOG7[1392:2328]: SSL state (connect): SSLv3 write client hello A 2010.09.08 14:34:38 LOG7[1392:2328]: SSL state (connect): SSLv3 read server hello A 2010.09.08 14:34:39 LOG7[1392:2328]: SSL state (connect): SSLv3 read server certificate A 2010.09.08 14:34:39 LOG7[1392:2328]: SSL state (connect): SSLv3 read server done A 2010.09.08 14:34:39 LOG7[1392:2328]: SSL state (connect): SSLv3 write client key exchange A 2010.09.08 14:34:39 LOG7[1392:2328]: SSL state (connect): SSLv3 write change cipher spec A 2010.09.08 14:34:39 LOG7[1392:2328]: SSL state (connect): SSLv3 write finished A 2010.09.08 14:34:39 LOG7[1392:2328]: SSL state (connect): SSLv3 flush data 2010.09.08 14:34:39 LOG7[1392:2328]: SSL state (connect): SSLv3 read finished A 2010.09.08 14:34:39 LOG7[1392:2328]: 1 items in the session cache 2010.09.08 14:34:39 LOG7[1392:2328]: 1 client connects (SSL_connect()) 2010.09.08 14:34:39 LOG7[1392:2328]: 1 client connects that finished 2010.09.08 14:34:39 LOG7[1392:2328]: 0 client renegotiations requested 2010.09.08 14:34:39 LOG7[1392:2328]: 0 server connects (SSL_accept()) 2010.09.08 14:34:39 LOG7[1392:2328]: 0 server connects that finished 2010.09.08 14:34:39 LOG7[1392:2328]: 0 server renegotiations requested 2010.09.08 14:34:39 LOG7[1392:2328]: 0 session cache hits 2010.09.08 14:34:39 LOG7[1392:2328]: 0 external session cache hits 2010.09.08 14:34:39 LOG7[1392:2328]: 0 session cache misses 2010.09.08 14:34:39 LOG7[1392:2328]: 0 session cache timeouts 2010.09.08 14:34:39 LOG6[1392:2328]: SSL connected: new session negotiated 2010.09.08 14:34:39 LOG6[1392:2328]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2010.09.08 14:34:44 LOG7[1392:2328]: SSL socket closed on SSL_read 2010.09.08 14:34:44 LOG7[1392:2328]: Socket write shutdown 2010.09.08 14:34:44 LOG5[1392:2328]: Connection closed: 8 bytes sent to SSL, 48 bytes sent to socket 2010.09.08 14:34:44 LOG7[1392:2328]: Service exchange finished (0 left) -- --- "Is real reporting dead? News at 11!"

1 0

Re: [stunnel-users] Individual user certs for each person who uses Windows PC
by Bucci, David G 07 Sep '10

07 Sep '10

Thx for replying, Scott ... how did you handle multiple users on the PC, though? They all shared that cert? I thought about having a single location and copying to there on user login (from a standard location in a user's home dir, e.g.) ... then firing up stunnel ... but it seems like so much can go wrong, resulting in User B accessing using User A's certificate (because the copy failed, e.g.). And we're leery of exposing User A's cert to User B - especially since stunnel doesn't support encryption of the user's key, right? So the permissions would be a little tricky and maybe fragile. Seems like there should be a straightforward way to do it, dadnabit! ________________________________ From: Scott Gifford <sgifford(a)suspectclass.com> To: Bucci, David G Cc: stunnel-users(a)mirt.net <stunnel-users(a)mirt.net> Sent: Mon Aug 30 17:41:09 2010 Subject: EXTERNAL: Re: [stunnel-users] Individual user certs for each person who uses Windows PC On Mon, Aug 30, 2010 at 3:41 PM, Bucci, David G <david.g.bucci(a)lmco.com<mailto:[email protected]>> wrote: [ ... ] I've tried using envvars in the stunnel.conf (e.g., cert = %USERPROFILE%\usercert.pem), tried adjusting the command line to include "-p %USERPROFILE%\usercert.pem" as an option ... We implemented something similar by simply making a "C:\stunnel" directory on each PC, naming the certificate the same thing on all machines, then hardcoding that path into the stunnel configuration (e.g. "C:\stunnel\usercert.pem"). Not quite as nice as %USERPROFILE%\usercert.pem, but it worked. :-) Hope this is helpful, ----Scott.

5 11

Honor --sysconfdir and --localstatedir in stunnel.conf-sample.in
by Sebastian Kayser 01 Sep '10

01 Sep '10

Hi, I am packaging stunnel for opencsw.org. Would you guys mind merging a patch [1] to make use of --sysconfdir and --localstatedir (instead of @prefix@/{etc,var}) in the sample configuration file? Currently, if --sysconfdir and --localstatedir are passed to ./configure and are not a directory below prefix, the configuration file doesn't reflect this layout. The patch is against 4.33. Fedora seems to carry the same change [2]. Sebastian [1]http://gar.svn.sf.net/svnroot/gar/csw/mgar/pkg/stunnel/trunk/files/0001-M… [2]http://lists.fedoraproject.org/pipermail/scm-commits/2010-March/413078.ht…

3 4

[[email protected]: Bug#594876: stunnel4: Fails to connect, "Input line too long"]
by Rodrigo Gallardo 31 Aug '10

31 Aug '10

----- Forwarded message from Harri Kiiskinen <harri.kiiskinen(a)utu.fi> ----- Date: Mon, 30 Aug 2010 13:26:07 +0300 From: Harri Kiiskinen <harri.kiiskinen(a)utu.fi> To: Debian Bug Tracking System <submit(a)bugs.debian.org> Subject: Bug#594876: stunnel4: Fails to connect, "Input line too long" Package: stunnel4 Version: 3:4.29-1local1 Severity: normal My Univ. recently updated their mail servers, and I could not read my mails anymore with Emacs/mew, that uses stunnel4 for encryption. It turned out the reason was, that the server responded with this string: * OK [CAPABILITY STARTTLS CAPABILITY IMAP4 IMAP4rev1 ACL QUOTA LITERAL+ NAMESPACE UIDPLUS CHILDREN BINARY UNSELECT SORT LANGUAGE IDLE XSENDER X-NETSCAPE XSERVERINFO X-SUN-SORT X-SUN-IMAP X-ANNOTATEMORE X-UNAUTHENTICATE XUM1 AUTH=PLAIN AUTH=PLAIN] Messaging Multiplexor (Sun Java(tm) System Messaging Server 7.3-11.01 (built Sep 1 2009)) It turned out that this was way much longer than what stunnel4 expects. In common.h, one finds #define STRLEN 256 When this is changed to #define STRLEN 512 and the package recompiled, everything works well. Perhaps the length of accepted strings should be increased? Or is this long a response against some standard? All the best, Harri K. -- System Information: Debian Release: squeeze/sid APT prefers testing APT policy: (990, 'testing') Architecture: i386 (i686) Kernel: Linux 2.6.32-3-686 (SMP w/1 CPU core) Locale: LANG=en_IE.UTF-8, LC_CTYPE=en_IE.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/bash Versions of packages stunnel4 depends on: ii adduser 3.112 add and remove users and groups ii libc6 2.11.2-2 Embedded GNU C Library: Shared lib ii libssl0.9.8 0.9.8o-1 SSL shared libraries ii libwrap0 7.6.q-19 Wietse Venema's TCP wrappers libra ii netbase 4.42 Basic TCP/IP networking system ii openssl 0.9.8o-1 Secure Socket Layer (SSL) binary a ii perl-modules 5.10.1-14 Core Perl modules stunnel4 recommends no packages. Versions of packages stunnel4 suggests: pn logcheck-database <none> (no description available) -- Configuration Files: /etc/stunnel/stunnel.conf changed [not included] -- no debconf information ----- End forwarded message ----- -- Rodrigo Gallardo

2 1

Individual user certs for each person who uses Windows PC
by Bucci, David G 30 Aug '10

30 Aug '10

Hi, all - I've searched, but can't find any answer on this. Is it possible to configure stunnel with client certificates on, and in such a way that individual users who logon have their own individual certificate used? I've tried using envvars in the stunnel.conf (e.g., cert = %USERPROFILE%\usercert.pem), tried adjusting the command line to include "-p %USERPROFILE%\usercert.pem" as an option ... the closest I've been able to think of (and it's a pretty blunt sword) is to create individual services, one per user and listening on different ports, then having each user access a different URL (well, different port#) ... I would prefer this all work when running as a Windows service, but if it's necessary to train the users to hit a start menu entry or something (e.g., if there's a way to do it using envvars on command line parameters), then the world probably won't end ... This is on Windows, but I'd also appreciate knowing how to do the same on Linux. Thx! ---- David G. Bucci When Dr. Bruce Banner becomes angry, he changes into the Incredible Hulk; when the Incredible Hulk becomes angry, he changes into Chuck Norris. -- ChuckNorrisFacts.com

2 1

Cross-compiling stunnel woes feedback
by Martin van den Nieuwelaar 30 Aug '10

30 Aug '10

Hi everyone (again). I thought I'd post some feedback regarding cross-compiling stunnel, which I have successfully done for an Arm based embedded system we use. I had to edit the 'configure' script in order to remove three sections of code that just check for the cross compiling option, and if set simply exit (message 'cannot check for file existence when cross compiling'). This behaviour really isn't condusive to successful cross compiling. :-) So as I say I removed these sections of code. Next, I configured with './configure --host=arm-linux', then 'make' and the rest are standard as usual. Perhaps the configure script for future releases could be a little more friendly for those cross compiling? Editing the configure file shouldn't be necessary. -- R A Ward Ltd. | We take the privacy of our customers seriously. Christchurch | All sensitive E-Mail attachments MUST be encrypted. New Zealand

2 2

"stunnel -version"
by Felix E. Klee 30 Aug '10

30 Aug '10

I installed the official stunnel 4.33 binary on Windows XP/32. And, when I execute "stunnel -version", a popup window appears with the following message: --------------------------- stunnel 4.33 on Win32 (not configured) --------------------------- Stunnel server is down due to an error. You need to exit and correct the problem. Click OK to see the error log window. --------------------------- OK --------------------------- Shouldn't that just work? What may be the cause for the problem? Indeed, I didn't configure stunnel yet. But I also realized that when I change something - for example the log level - in "stunnel.conf", then this is ignored by "stunnel -version". After clicking "OK" to close the popup message, I get some more info, though meaningless to me: stunnel 4.33 on x86-pc-mingw32-gnu with OpenSSL 1.0.0 29 Mar 2010 Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 Global options debug = notice RNDbytes = 64 RNDoverwrite = yes service = stunnel taskbar = yes Service-level options cert = stunnel.pem ciphers = ALL:!aNULL:!eNULL:!SSLv2 session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none Server is down

2 4

Updated stunnel version in Debian experimental
by Rodrigo Gallardo 27 Aug '10

27 Aug '10

I have just uploaded stunnel 4.33 to Debian experimental. amd64 packages will be available for download as soon as the automated processing is done (6-12 hours). Other architectures will follow as the autobuilders get time in their queues for us. Aside from the updates in stunnel itself, the packaging has been updated somewhat. In particular, the start/stop scripts in /etc/init.d have grown shinny new options to take advantage of configuration file reloading and the log rotation config takes advantage of them to avoid the long standing issue of having to either live with ever-growing logs, or killing long lived connections when rotating. I would be very glad if you would test those new scripts and report any and all bugs. To Debian's BTS, of course, as none of them are at all the fault of our most excellent upstream ;) As much as I'd have liked to upload it to unstable, the distribution is now in freeze in preparation for the upcoming release, and thus uploading a completely new version of stunnel, together with the packaging changes I made would be completely unacceptable. I will upload this version, together with any bug fixes we collect, as soon as the release is over and sid is unfrozen again. Sadly, that means that the next Debian stable will release with 4.29. For that I am sorry, and I promise to make a backport of 4.33 available as soon as possible after the release. -- Rodrigo yes-I-have-been-remise-as-maintainer Gallardo

1 0

Is it possible for stunnel to reject client connections if the server end cannot connect?
by Martin van den Nieuwelaar 26 Aug '10

26 Aug '10

Hi all. I took a look (manually) through the last year of archives, but didn't find anything on this issue. The situation is as follows. Say we have two machines set up, ClientPC and ServerPC. On ClientPC I run stunnel accepting a connection on a local port and connecting to an stunnel port on ServerPC. On ServerPC I run stunnel accepting a connection on the local stunnel port and connecting to the 'encryption unaware' server on another port on the same ServerPC machine. OK, pretty simple stuff so far. The problem is, when I connect to ClientPC with the 'encryption unaware' client app. then I always get a successful connection, even if there is no server running on ServerPC. Of course once the client has a successful connection, it then performs a write(), and that fails with 'Connection reset by peer'. Really, since there is no server running on ServerPC, I want the connect() to stunnel on ClientPC to fail. Is there a way to do this? The alternative (which is a kludge), is to make the client 'stunnel aware' (yuk!), and to tell it whether it's connecting over stunnel on a per connection basis (yuk!). Then it can know whether it needs to look at the connect() or the write() to know whether the server is not running. Yuk! Or am I overlooking something simple? :-) -- R A Ward Ltd. | We take the privacy of our customers seriously. Christchurch | All sensitive E-Mail attachments MUST be encrypted. New Zealand

1 0

Problem with 2048 bits SSL sertificate with stunnel
by Georgi Georgiev 23 Aug '10

23 Aug '10

Hello to all, We get 2048 bits wildcard certificate for our domain *.domain.com .. And we are using thawte as Certificate Authority . So they send as two certificates .. One for SSL web and one intermediate certificate .. The stunnel configuration is : [https1] cert = /etc/stunnel/domain.crt CAfile = /etc/stunnel/domain.intermediate.crt key = /etc/stunnel/domain.key.nopass verify = 0 accept = x.x.x.x:443 connect = x.x.x.x:81 xforwardedfor=yes even I use verify = 0 some of our clients still complains that on some pages ( like blabla.domain.com ) server wants some of their private certificate to be send to the server !! and it's happens only with Internet Explorer 8.0 without verify and CAfile commands IE 8.0 works fine but Mozilla Firefox claim that can find CA be trusted ! wildcard certificate cannot be reissued with 1024 bits key . So is there some mistake in my configuration ? If not what can I do about it ? Thanks in advance .. P.S.: version of stunnel is 4.20 with XForwardedFor patch ..

2 1

stunnel and loading keys from hw devices
by Victor Wagner 20 Aug '10

20 Aug '10

Hello, all I've tried to use stunnel with keys on the hardware device, supported by OpenSSL engine and encountered some minor problems: 1. Under Unix systems stunnel doesn't provide UI_METHOD for ENGINE_load_private_key. It passes NULL there and engine complains that no user interface provided. On Unix in many cases default UI_METHOD provided by OpenSSL would do So, replacing line 302 in the ctx.c (line number are given for release 4.33) from uim=NULL ; to uim=UI_OpenSSL(); would significanly improve stunnel functionality. 2. OpenSSL UI objects have two methods to pass arbitraty pointers along 1. generic ex_data based macros UI_set_app_data/UI_get_app_data 2. UI-specific UI_add_user_data/UI_get0_user_data Unfortunately app-specific pointer is set inside engine and retrieved inside a callback, which belongs to application. So author of an engine and author of an application should somehow agree on which metod to use. All engines shipped with OpenSSL (ones which do provide load_private_key method) use UI_add_user_data to pass data to the callback. stunnel's pin_cb (for Win32 version of stunnel in the gui.c) uses UI_get_app_data to retrieve ui_data. I wonder what engine was used when this code was developed and debugged. And it does no check if any meaningful pointer is obtained. I suggest to add following code after line 602 in gui.c: /* if set_app_Data haven't-return anything */ if (!ui_data) ui_data=UI_get0_user_data(ui); /* if still no avail */ if (!ui_data) { s_log(LOG_ERR,"Engine haven't passed our callback data to callback. Sorry!"); return 0; } Or instead of complaining we can use some structure, local to function pin_cb as fallback UI_DATA - just as password buffer, and check if ui_data->section is not NULL before reading ui_data->section->key in the pass_proc (line 543 of gui.c) Thus it would work even with really broken engines which do not pass userdata from ENGINE_load_private_key to UI callbacks at all. ----- End forwarded message -----

2 1

stunnel and mod_gnutls
by Yclept Nemo 15 Aug '10

15 Aug '10

I run a mod_gnutls (0.5.5)<->apache (2.2.8) webserver which behaves perfectly normally outside of stunnel: GnuTLSEnable on GnuTLSPriorities SECURE256 GnuTLSExportCertificates on .. When a connection is closed and apache signals the mod_gnutls process to quit, the log records: GnuTLS: Handshake Failed (-8) 'A record packet with illegal version was received.' Invalid method in request NS * HTTP/1.0 ::1 - - [15/Aug/2010:03:31:26 -0400] "NS * HTTP/1.0" 501 512 "-" "Apache/2.2.8 (Ubuntu) ... (internal dummy connection)" This lets me easily identify apache2 process turnovers However, when I connect to this server through stunnel, I receive random dropouts. For example, if I were to upload 200 test files to this server, on average 15 transfers would fail. Stunnel logs (excerpt): 2010.08.15 04:11:25 LOG5[29287:3074030448]: Connection reset: 94 bytes sent to SSL, 523 bytes sent to socket 2010.08.15 04:12:21 LOG5[29287:3074448240]: Connection reset: 94 bytes sent to SSL, 523 bytes sent to socket 2010.08.15 04:12:34 LOG5[29287:3074030448]: Connection reset: 94 bytes sent to SSL, 523 bytes sent to socket And my apache2 logs are flooded with: Invalid method in request \x16\x03\x01 # ... over and over and over ... Invalid method in request \x16\x03\x01 # ... this is a tls hello sequence, as though the webserver were not running mod_gnutls ::1 - - [15/Aug/2010:03:31:26 -0400] "NS * HTTP/1.0" 501 512 "-" "Apache/2.2.8 (Ubuntu) ... (internal dummy connection)" The apache logs show new apache2 processes / new ssl connections being created every 2-5 seconds. A normal connections lasts much longer. stunnel configuration debug=7 foreground=yes client=yes syslog=no pid=/absolute/path/to/stunnel.pid libwrap=no [https] accept=127.0.0.1:11111 connect=my.website.net:myport sslVersion=TLSv1 an excerpt from the stunnel log: 2010.08.15 04:11:25 LOG6[29287:3074030448]: SSL connected: previous session reused 2010.08.15 04:11:25 LOG7[29287:3073960816]: Service https started 2010.08.15 04:11:25 LOG7[29287:3073960816]: FD=19 in non-blocking mode 2010.08.15 04:11:25 LOG5[29287:3073960816]: Service https accepted connection from 127.0.0.1:52674 2010.08.15 04:11:25 LOG7[29287:3073960816]: FD=20 in non-blocking mode 2010.08.15 04:11:25 LOG6[29287:3073960816]: connect_blocking: connecting 44.205.51.83:12389 2010.08.15 04:11:25 LOG7[29287:3073960816]: connect_blocking: s_poll_wait 44.205.51.83:12389: waiting 10 seconds 2010.08.15 04:11:25 LOG5[29287:3073960816]: connect_blocking: connected 44.205.51.83:12389 2010.08.15 04:11:25 LOG5[29287:3073960816]: Service https connected remote server from 192.168.1.8:51590 2010.08.15 04:11:25 LOG7[29287:3073960816]: Remote FD=20 initialized 2010.08.15 04:11:25 LOG7[29287:3073960816]: SSL state (connect): before/connect initialization 2010.08.15 04:11:25 LOG7[29287:3073960816]: SSL state (connect): SSLv3 write client hello A 2010.08.15 04:11:25 LOG7[29287:3073960816]: SSL state (connect): SSLv3 read server hello A 2010.08.15 04:11:25 LOG7[29287:3073960816]: SSL state (connect): SSLv3 read finished A 2010.08.15 04:11:25 LOG7[29287:3073960816]: SSL state (connect): SSLv3 write change cipher spec A 2010.08.15 04:11:25 LOG7[29287:3073960816]: SSL state (connect): SSLv3 write finished A 2010.08.15 04:11:25 LOG7[29287:3073960816]: SSL state (connect): SSLv3 flush data 2010.08.15 04:11:25 LOG7[29287:3073960816]: 1 items in the session cache 2010.08.15 04:11:25 LOG7[29287:3073960816]: 42 client connects (SSL_connect()) 2010.08.15 04:11:25 LOG7[29287:3073960816]: 42 client connects that finished 2010.08.15 04:11:25 LOG7[29287:3073960816]: 0 client renegotiations requested 2010.08.15 04:11:25 LOG7[29287:3073960816]: 0 server connects (SSL_accept()) 2010.08.15 04:11:25 LOG7[29287:3073960816]: 0 server connects that finished 2010.08.15 04:11:25 LOG7[29287:3073960816]: 0 server renegotiations requested 2010.08.15 04:11:25 LOG7[29287:3073960816]: 41 session cache hits 2010.08.15 04:11:25 LOG7[29287:3073960816]: 0 external session cache hits 2010.08.15 04:11:25 LOG7[29287:3073960816]: 0 session cache misses 2010.08.15 04:11:25 LOG7[29287:3073960816]: 0 session cache timeouts 2010.08.15 04:11:25 LOG6[29287:3073960816]: SSL connected: previous session reused 2010.08.15 04:11:25 LOG3[29287:3074030448]: SSL socket closed on SSL_read with 7 byte(s) in buffer 2010.08.15 04:11:25 LOG5[29287:3074030448]: Connection reset: 94 bytes sent to SSL, 523 bytes sent to socket 2010.08.15 04:11:25 LOG7[29287:3074030448]: Service https finished (4 left) 2010.08.15 04:11:25 LOG7[29287:3073960816]: SSL socket closed on SSL_read 2010.08.15 04:11:25 LOG7[29287:3073960816]: Socket write shutdown 2010.08.15 04:11:25 LOG5[29287:3073960816]: Connection closed: 94 bytes sent to SSL, 523 bytes sent to socket 2010.08.15 04:11:25 LOG7[29287:3073960816]: Service https finished (3 left) 2010.08.15 04:11:26 LOG7[29287:3074448240]: SSL socket closed on SSL_read 2010.08.15 04:11:26 LOG7[29287:3074448240]: Socket write shutdown 2010.08.15 04:11:26 LOG5[29287:3074448240]: Connection closed: 1110 bytes sent to SSL, 77962 bytes sent to socket 2010.08.15 04:11:26 LOG7[29287:3074517872]: SSL socket closed on SSL_read 2010.08.15 04:11:26 LOG7[29287:3074517872]: Socket write shutdown 2010.08.15 04:11:26 LOG7[29287:3074448240]: Service https finished (2 left) 2010.08.15 04:11:26 LOG5[29287:3074517872]: Connection closed: 575 bytes sent to SSL, 4889 bytes sent to socket 2010.08.15 04:11:26 LOG7[29287:3074517872]: Service https finished (1 left) 2010.08.15 04:11:26 LOG7[29287:3074378608]: SSL socket closed on SSL_read 2010.08.15 04:11:26 LOG7[29287:3074378608]: Socket write shutdown 2010.08.15 04:11:26 LOG5[29287:3074378608]: Connection closed: 573 bytes sent to SSL, 48787 bytes sent to socket 2010.08.15 04:11:26 LOG7[29287:3074378608]: Service https finished (0 left) 2010.08.15 04:11:26 LOG7[29287:3074520768]: Service https accepted FD=11 from 127.0.0.1:52676 2010.08.15 04:11:26 LOG7[29287:3074378608]: Service https started 2010.08.15 04:11:26 LOG7[29287:3074378608]: FD=11 in non-blocking mode 2010.08.15 04:11:26 LOG5[29287:3074378608]: Service https accepted connection from 127.0.0.1:52676 2010.08.15 04:11:26 LOG7[29287:3074378608]: FD=12 in non-blocking mode 2010.08.15 04:11:26 LOG6[29287:3074378608]: connect_blocking: connecting 44.205.51.83:12389 2010.08.15 04:11:26 LOG7[29287:3074378608]: connect_blocking: s_poll_wait 44.205.51.83:12389: waiting 10 seconds 2010.08.15 04:11:26 LOG5[29287:3074378608]: connect_blocking: connected 44.205.51.83:12389 2010.08.15 04:11:26 LOG5[29287:3074378608]: Service https connected remote server from 192.168.1.8:51592 2010.08.15 04:11:26 LOG7[29287:3074378608]: Remote FD=12 initialized 2010.08.15 04:11:26 LOG7[29287:3074378608]: SSL state (connect): before/connect initialization 2010.08.15 04:11:26 LOG7[29287:3074378608]: SSL state (connect): SSLv3 write client hello A 2010.08.15 04:11:26 LOG7[29287:3074378608]: SSL state (connect): SSLv3 read server hello A 2010.08.15 04:11:26 LOG7[29287:3074378608]: SSL state (connect): SSLv3 read finished A 2010.08.15 04:11:26 LOG7[29287:3074378608]: SSL state (connect): SSLv3 write change cipher spec A 2010.08.15 04:11:26 LOG7[29287:3074378608]: SSL state (connect): SSLv3 write finished A 2010.08.15 04:11:26 LOG7[29287:3074378608]: SSL state (connect): SSLv3 flush data My questions are: Why does this happen (why only with stunnel), and how can I prevent/avoid this? Sincerely,

2 2

help - SSL bandwidth overhead with using different ciphers
by Slim Ben Mahmoud 30 Jul '10

30 Jul '10

Dear SSL experts, In order to assess the performances of an adaptive security algorithm using SSL, I need to measure the network overhead induced by the establishment of SSL tunnels. The experiment aims to measure the bandwidth consumptions (or throughputs) when SSL tunnels are established using the different ciphers implemented in Stunnel (AES256-SHA or RC4-SHA for instance). Do you think that I have to expect a different throughput when I use different ciphers for every tunnels or the overhead is the pretty much the same? In fact, the first results show no difference between the throughputs no matter the cipher I use. I know that SSL overhead is traditionally measured in delay or latency because of the handshake phase (the encryption process time is negligible on the new CPUs) but this is not what i want to show. I hope that my request is enough clear, let me know if it is not the case. Best regards. --Slim

2 1

Proxy for content filtering
by Raj 29 Jul '10

29 Jul '10

Hi All I want to build a proxy server, which acts as man in the middle proxy. The main intention of application is to do content filtering, whether it is an http or https request. I want to block some specified URL. Can anybody tell me what is the best approach of doing this Thanks, Raj Rajmohan SK

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 72, Issue 2
by TONY WESTENHOFER 07 Jul '10

07 Jul '10

stunnel-users-request(a)mirt.net wrote: >Send stunnel-users mailing list submissions to > stunnel-users(a)mirt.net > >To subscribe or unsubscribe via the World Wide Web, visit > http://stunnel.mirt.net/mailman/listinfo/stunnel-users >or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)mirt.net > >You can reach the person managing the list at > stunnel-users-owner(a)mirt.net > >When replying, please edit your Subject line so it is more specific >than "Re: Contents of stunnel-users digest..." > > >Today's Topics: > > 1. Re: telnetd and tcp_wrappers (Spence, Thomas Civ 844 CS/SCOX) > 2. change openssl version with configure (Bhavna Jhunjhunwala) > > >---------------------------------------------------------------------- > >Message: 1 >Date: Tue, 6 Jul 2010 08:28:11 -0400 >From: "Spence, Thomas Civ 844 CS/SCOX" <Thomas.Spence(a)pentagon.af.mil> >Subject: Re: [stunnel-users] telnetd and tcp_wrappers >To: "stunnel-users(a)mirt.net" <stunnel-users(a)mirt.net> >Message-ID: > <751B1F405F4AFF4D907BD567538A83FB04FFE0B6DA(a)tequilasunrise.pentagon.ncr.ds.af.mil> > >Content-Type: text/plain; charset="us-ascii" > >2 guys did help me and still no luck... > >Anyone who tried this: > >[tssl] >accept = 992 >exec = /usr/sbin/telnetd > >Let me know... Reason why I am asking you because when I log off the server then stunnel's process stopped running but I want it keep running after logoff. Before I changed 'exec = /usr/sbin/telnetd', it was 'connect = 23' and the stunnel's process ran great and never stop running... Strange. > >I really need your help. Thanks. > >--------------- >Tom Spence >ABIDES SYSTEM SUPPORT >844th CS/SCOX > > > >------------------------------ > >Message: 2 >Date: Tue, 6 Jul 2010 17:41:42 -0400 >From: Bhavna Jhunjhunwala <bhavnaj(a)quantitativebrokers.com> >Subject: [stunnel-users] change openssl version with configure >To: stunnel-users(a)mirt.net >Message-ID: > <AANLkTikGWuO2XbF8-rtOTMyfeHVdeUV8TZGJvmYfKekB(a)mail.gmail.com> >Content-Type: text/plain; charset="iso-8859-1" > >Hi, > >I have stunnel version as below installed on Mac: > >s*tunnel 4.33 on i386-apple-darwin10.2.0 with OpenSSL 0.9.8k 25 Mar 2009* >*Threading:PTHREAD SSL:ENGINE Sockets:SELECT,IPv6 Auth:LIBWRAP* >* * >*Global options* >*debug = daemon.notice* >*pid = /usr/local/var/run/stunnel/stunnel.pid* >*RNDbytes = 64* >*RNDfile = /dev/urandom* >*RNDoverwrite = yes* >* * >*Service-level options* >*cert = /usr/local/etc/stunnel/stunnel.pem* >*ciphers = ALL:!aNULL:!eNULL:!SSLv2* >*session = 300 seconds* >*stack = 65536 bytes* >*sslVersion = SSLv3 for client, all for server* >*TIMEOUTbusy = 300 seconds* >*TIMEOUTclose = 60 seconds* >*TIMEOUTconnect = 10 seconds* >*TIMEOUTidle = 43200 seconds* >*verify = none* > >I would like to upgrade the openssl version to 1.0.0a, so I do >./configure --with-ssl=dir >make >make install > >After make install i get below error: > >*make install* >*Making install in src* >*test -z "/usr/local/bin" || ../auto/install-sh -c -d "/usr/local/bin"* >* /bin/sh ../libtool --mode=install /usr/bin/install -c 'stunnel' >'/usr/local/bin/stunnel'* >*/usr/bin/install -c stunnel /usr/local/bin/stunnel* >*test -z "/usr/local/bin" || ../auto/install-sh -c -d "/usr/local/bin"* >* /usr/bin/install -c 'stunnel3' '/usr/local/bin/stunnel3'* >*test -z "/usr/local/lib/stunnel" || ../auto/install-sh -c -d >"/usr/local/lib/stunnel"* >* /bin/sh ../libtool --mode=install /usr/bin/install -c 'libstunnel.la' >'/usr/local/lib/stunnel/libstunnel.la'* >*/usr/bin/install -c .libs/libstunnel.dylib >/usr/local/lib/stunnel/libstunnel.dylib* >*/usr/bin/install -c .libs/libstunnel.lai /usr/local/lib/stunnel/ >libstunnel.la* >*----------------------------------------------------------------------* >*Libraries have been installed in:* >* /usr/local/lib/stunnel* >* >* >*If you ever happen to want to link against installed libraries* >*in a given directory, LIBDIR, you must either use libtool, and* >*specify the full pathname of the library, or use the `-LLIBDIR'* >*flag during linking and do at least one of the following:* >* - add LIBDIR to the `DYLD_LIBRARY_PATH' environment variable* >* during execution* >* >* >*See any operating system documentation about shared libraries for* >*more information, such as the ld(1) and ld.so(8) manual pages.* >*----------------------------------------------------------------------* >*make[2]: Nothing to be done for `install-data-am'.* >*Making install in doc* >*make[2]: Nothing to be done for `install-exec-am'.* >*test -z "/usr/local/share/doc/stunnel" || ../auto/install-sh -c -d >"/usr/local/share/doc/stunnel"* >* /usr/bin/install -c -m 644 'stunnel.html' >'/usr/local/share/doc/stunnel/stunnel.html'* >* /usr/bin/install -c -m 644 'stunnel.pl.html' >'/usr/local/share/doc/stunnel/stunnel.pl.html'* >* /usr/bin/install -c -m 644 'stunnel.fr.html' >'/usr/local/share/doc/stunnel/stunnel.fr.html'* >*test -z "/usr/local/share/man/man8" || ../auto/install-sh -c -d >"/usr/local/share/man/man8"* >*mkdir: /usr/local/share/man/man8: Permission denied* >*make[2]: *** [install-man8] Error 1* >*make[1]: *** [install-am] Error 2* > > > >and when I check the stunnel version it still uses the old ssl version. >Am I doing something wrong here? > >-- >Thanks, >Bhavna >Quantitative Brokers >646 293 1808 > > >DISCLAIMER: >This e-mail and any attachments are for the confidential use of the >intended recipient. If you are not the intended recipient of this >message you are hereby notified that any review, dissemination, >distribution or copying of this message is strictly prohibited. This >communication is for information purposes only and should not be >regarded as an offer to sell or as a solicitation of an offer to buy >any investment product, an official confirmation of any transaction >or an official statement of Quantitative Brokers, LLC. > >E-mail transmissions cannot be guaranteed to be secure or error-free. >Therefore, we do not represent that this information is complete or >accurate and it should not be relied upon as such. > >All information is subject to change without notice. >Quantitative Brokers may, at its discretion, monitor and review the >content of all e-mail communications. >

1 0

problem with "verify=0"
by wujot＠home.pl 07 Jul '10

07 Jul '10

Hello everybody, The basic SSL negotiation requires the exchange of nine SSL messages. If client authentication is required, server can send additional message "certificate request". But this message is optional. I'm using stunnel ver. 4.27 for Win and 4.28 for Linux. In both cases stunnel, working as server, is sending "certificate request" message to the client, regardless of "verify" state, even with "verify=0". When "verify=0", server doesn't care about client's certificate. So, what for server sends this message? The part of my configuration and log is bellow: [test] accept = 60000 connect = 192.168.3.15:4679 client = no ;verify = 0 verify = none ciphers=DES-CBC3-SHA session = 3600 2010.07.07 12:53:35 LOG7[2412:4280]: SSL state (accept): before/accept initialization 2010.07.07 12:53:35 LOG7[2412:4280]: SSL state (accept): SSLv3 read client hello A 2010.07.07 12:53:35 LOG7[2412:4280]: SSL state (accept): SSLv3 write server hello A 2010.07.07 12:53:35 LOG7[2412:4280]: SSL state (accept): SSLv3 write certificate A 2010.07.07 12:53:35 LOG7[2412:4280]: SSL state (accept): SSLv3 write certificate request A <-------------???!!! 2010.07.07 12:53:35 LOG7[2412:4280]: SSL state (accept): SSLv3 flush data 2010.07.07 12:53:42 LOG6[2412:4280]: VERIFY IGNORE: depth=1, /C= .............. 2010.07.07 12:53:42 LOG5[2412:4280]: CRL: verification passed 2010.07.07 12:53:42 LOG5[2412:4280]: VERIFY OK: depth=1, /C= .......... 2010.07.07 12:53:42 LOG6[2412:4280]: VERIFY IGNORE: depth=0, /C= ................ 2010.07.07 12:53:42 LOG5[2412:4280]: CRL: verification passed 2010.07.07 12:53:42 LOG5[2412:4280]: VERIFY OK: depth=0, /C= .......................... 2010.07.07 12:53:42 LOG7[2412:4280]: SSL state (accept): SSLv3 read client certificate A 2010.07.07 12:53:42 LOG7[2412:4280]: SSL state (accept): SSLv3 read client key exchange a 2010.07.07 12:53:42 LOG7[2412:4280]: SSL state (accept): SSLv3 read certificate verify A 2010.07.07 12:53:42 LOG7[2412:4280]: SSL state (accept): SSLv3 read finished A 2010.07.07 12:53:42 LOG7[2412:4280]: SSL state (accept): SSLv3 write change cipher spec A 2010.07.07 12:53:42 LOG7[2412:4280]: SSL state (accept): SSLv3 write finished A So, my question is: how to remove "certificate request" message from stunnel-as-server negotiation? Regards, Wojtek

1 0

change openssl version with configure
by Bhavna Jhunjhunwala 06 Jul '10

06 Jul '10

Hi, I have stunnel version as below installed on Mac: s*tunnel 4.33 on i386-apple-darwin10.2.0 with OpenSSL 0.9.8k 25 Mar 2009* *Threading:PTHREAD SSL:ENGINE Sockets:SELECT,IPv6 Auth:LIBWRAP* * * *Global options* *debug = daemon.notice* *pid = /usr/local/var/run/stunnel/stunnel.pid* *RNDbytes = 64* *RNDfile = /dev/urandom* *RNDoverwrite = yes* * * *Service-level options* *cert = /usr/local/etc/stunnel/stunnel.pem* *ciphers = ALL:!aNULL:!eNULL:!SSLv2* *session = 300 seconds* *stack = 65536 bytes* *sslVersion = SSLv3 for client, all for server* *TIMEOUTbusy = 300 seconds* *TIMEOUTclose = 60 seconds* *TIMEOUTconnect = 10 seconds* *TIMEOUTidle = 43200 seconds* *verify = none* I would like to upgrade the openssl version to 1.0.0a, so I do ./configure --with-ssl=dir make make install After make install i get below error: *make install* *Making install in src* *test -z "/usr/local/bin" || ../auto/install-sh -c -d "/usr/local/bin"* * /bin/sh ../libtool --mode=install /usr/bin/install -c 'stunnel' '/usr/local/bin/stunnel'* */usr/bin/install -c stunnel /usr/local/bin/stunnel* *test -z "/usr/local/bin" || ../auto/install-sh -c -d "/usr/local/bin"* * /usr/bin/install -c 'stunnel3' '/usr/local/bin/stunnel3'* *test -z "/usr/local/lib/stunnel" || ../auto/install-sh -c -d "/usr/local/lib/stunnel"* * /bin/sh ../libtool --mode=install /usr/bin/install -c 'libstunnel.la' '/usr/local/lib/stunnel/libstunnel.la'* */usr/bin/install -c .libs/libstunnel.dylib /usr/local/lib/stunnel/libstunnel.dylib* */usr/bin/install -c .libs/libstunnel.lai /usr/local/lib/stunnel/ libstunnel.la* *----------------------------------------------------------------------* *Libraries have been installed in:* * /usr/local/lib/stunnel* * * *If you ever happen to want to link against installed libraries* *in a given directory, LIBDIR, you must either use libtool, and* *specify the full pathname of the library, or use the `-LLIBDIR'* *flag during linking and do at least one of the following:* * - add LIBDIR to the `DYLD_LIBRARY_PATH' environment variable* * during execution* * * *See any operating system documentation about shared libraries for* *more information, such as the ld(1) and ld.so(8) manual pages.* *----------------------------------------------------------------------* *make[2]: Nothing to be done for `install-data-am'.* *Making install in doc* *make[2]: Nothing to be done for `install-exec-am'.* *test -z "/usr/local/share/doc/stunnel" || ../auto/install-sh -c -d "/usr/local/share/doc/stunnel"* * /usr/bin/install -c -m 644 'stunnel.html' '/usr/local/share/doc/stunnel/stunnel.html'* * /usr/bin/install -c -m 644 'stunnel.pl.html' '/usr/local/share/doc/stunnel/stunnel.pl.html'* * /usr/bin/install -c -m 644 'stunnel.fr.html' '/usr/local/share/doc/stunnel/stunnel.fr.html'* *test -z "/usr/local/share/man/man8" || ../auto/install-sh -c -d "/usr/local/share/man/man8"* *mkdir: /usr/local/share/man/man8: Permission denied* *make[2]: *** [install-man8] Error 1* *make[1]: *** [install-am] Error 2* and when I check the stunnel version it still uses the old ssl version. Am I doing something wrong here? -- Thanks, Bhavna Quantitative Brokers 646 293 1808 DISCLAIMER: This e-mail and any attachments are for the confidential use of the intended recipient. If you are not the intended recipient of this message you are hereby notified that any review, dissemination, distribution or copying of this message is strictly prohibited. This communication is for information purposes only and should not be regarded as an offer to sell or as a solicitation of an offer to buy any investment product, an official confirmation of any transaction or an official statement of Quantitative Brokers, LLC. E-mail transmissions cannot be guaranteed to be secure or error-free. Therefore, we do not represent that this information is complete or accurate and it should not be relied upon as such. All information is subject to change without notice. Quantitative Brokers may, at its discretion, monitor and review the content of all e-mail communications.

1 0

Re: [stunnel-users] telnetd and tcp_wrappers
by Spence, Thomas Civ 844 CS/SCOX 06 Jul '10

06 Jul '10

2 guys did help me and still no luck... Anyone who tried this: [tssl] accept = 992 exec = /usr/sbin/telnetd Let me know... Reason why I am asking you because when I log off the server then stunnel's process stopped running but I want it keep running after logoff. Before I changed 'exec = /usr/sbin/telnetd', it was 'connect = 23' and the stunnel's process ran great and never stop running... Strange. I really need your help. Thanks. --------------- Tom Spence ABIDES SYSTEM SUPPORT 844th CS/SCOX

1 0

Re: [stunnel-users] telnetd and tcp_wrappers
by Spence, Thomas Civ 844 CS/SCOX 02 Jul '10

02 Jul '10

Hi Again, I tried: [tssl] accept = 992 exec = /usr/sbin/telnetd It works. When I log into the server with no problem. When I am ready to log off then the process stopped running??? How can it stays running in process (/usr/local/bin/stunnel)? Thanks. Tom -----Original Message----- From: Spence, Thomas Civ 844 CS/SCOX Sent: Thursday, July 01, 2010 11:53 AM To: 'stunnel-users(a)mirt.net' Subject: telnetd and tcp_wrappers Hi all.. They requested us to turn off the telnetd from inetd.conf and not allowing to use tcp_wrappers... We are still using stunnel 4.33... We can't connect our server from PC with PowerTerm WebConnect because telnetd is off. Is there any way for all users to connect the server by using PowerTerm WebConnect? stunnel.conf: [tssl] accept = 992 connect = 23 (can't use telnet port) I know I can't use "connect = 22" because it doesn't work. Any idea? I really need your help... --------------- Tom Spence

2 1

telnetd and tcp_wrappers
by Spence, Thomas Civ 844 CS/SCOX 01 Jul '10

01 Jul '10

Hi all.. They requested us to turn off the telnetd from inetd.conf and not allowing to use tcp_wrappers... We are still using stunnel 4.33... We can't connect our server from PC with PowerTerm WebConnect because telnetd is off. Is there any way for all users to connect the server by using PowerTerm WebConnect? stunnel.conf: [tssl] accept = 992 connect = 23 (can't use telnet port) I know I can't use "connect = 22" because it doesn't work. Any idea? I really need your help... --------------- Tom Spence

1 0

Re: [stunnel-users] Connecting to stunnel with SQLServer
by Mohit Anchlia 29 Jun '10

29 Jun '10

Has anyone else tried using Java SSL or anything using Java that will not require stunnel on the client side? On Fri, Jun 25, 2010 at 12:13 PM, Carter Browne <cbrowne(a)cbcs-usa.com> wrote: > On 6/24/2010 11:00 PM, Mohit Anchlia wrote: >> On Thu, Jun 24, 2010 at 10:27 AM, Carter Browne <cbrowne(a)cbcs-usa.com> wrote: >> >>> On 6/24/2010 12:09 PM, Mohit Anchlia wrote: >>> >>>> On Thu, Jun 24, 2010 at 5:14 AM, Carter Browne <cbrowne(a)cbcs-usa.com> wrote: >>>> >>>> >>>>> It is very easy to do if you have stunnel running on both ends. On the >>>>> client side in the configuration file you could have: >>>>> >>>>> [MSSQL-OUT] >>>>> accept = localhost:1433 >>>>> connect = remote:20000 >>>>> client = yes >>>>> >>>>> >>>> Thanks. So if I have stunnel running on both ends how do I connect to >>>> SQL server? Just open a JDBC connection on the local port and it will >>>> automatically connect on the remote side? >>>> >>>> >>> In this example, I would define an alias using the configuration manager >>> giving it your name for the data base, and having it connect to port >>> 1433 on localhost. For my systems, >>> I usually use a dummy name defined in the 127.0.0.0/8 net and some port >>> other than 1433. This approach does require stunnel on both ends. I >>> haven't tried any other approaches. >>> MS SQL server does have some options for encrypting the traffic as well >>> - I did not think they would work for my mixed Linux/Windows >>> environment, but it might work for your environment. >>> >>> >>> >>>> Also, are there any other options? We have 20 servers from which we >>>> need to connect. I was trying to avoid install of another binary and >>>> relying on it for being up and running. Is it possible to use Java >>>> SSL? Or is that too complicated and not proven to work? Not sure if >>>> there is any other option. >>>> >>>> >>>> >>>>> on the remote side have: >>>>> >>>>> [MSSQL-IN] >>>>> accept = 20000 >>>>> connect = 1433 >>>>> client = no >>>>> >>>>> In this example port 20000 would have to be open to any firewalls >>>>> including the Windows firewall and assumes you are using the standard >>>>> MSSQL port on the server. >>>>> >>>>> You would probably want to use the SQL Server Configuration Manager on >>>>> the client computer to add an alias for your data base. >>>>> >>>>> >> Our client will be on Linux box. I am trying to understand if I am >> using JDBC the connection URL is something like: >> >> jdbc:sqlserver://[serverName[\instanceName][:portNumber]][;property=value[;property=value]] >> >> So if I use stunnel on both sides then how will this work? What will I >> give in my connection string? >> > > I don't have a Java DB connection, so I cannot speak from experience. > For both the Windows and the Linux ODBC drivers, using the example above > the server name would be > localhost:1433. The Instance name and any properties that you send > would not change. Again, using the values in the example, stunnel is > simply mapping localhost:1433 to remote:1433. > > Carter >> >>>>> Carter >>>>> >>>>> Carter Browne >>>>> CBCS >>>>> cbrowne(a)cbcs-usa.com >>>>> 781-721-2890 >>>>> >>>>> >>>>> On 6/23/2010 11:32 PM, Mohit Anchlia wrote: >>>>> >>>>> >>>>>> We have a requirement to connect to a SQLServer that is connected >>>>>> through stunnel on the other end. Can I use java SSL to talk to >>>>>> stunnel? What are my options? >>>>>> _______________________________________________ >>>>>> stunnel-users mailing list >>>>>> stunnel-users(a)mirt.net >>>>>> http://stunnel.mirt.net/mailman/listinfo/stunnel-users >>>>>> >>>>>> >>>>>> >>>>>> >>>>> >>>> >>> >> >

1 1

stunnel question and behaviour
by eni-urgence 25 Jun '10

25 Jun '10

Hello all. I want to use stunnel as ssl terminatation for https and pass httpd request to haproxy. I have compiled stunnel (source http://www.stunnel.org/download/stunnel/src/stunnel-4.32.tar.gz ) and apply this patch http://haproxy.1wt.eu/download/patches/stunnel-4.32-xforwarded-for.diff. I have placed the binary in /usr/local/bin . I want to use the heartbeat capabilities and start stunnel only if VIP is on the node. In order to make that, the init script of stunnel must be LSB compatible like said http://www.linux-ha.org/LSBResourceAgent. When i made a /etc/init.d/stunnel stop then a /etc/init.d/stunnel start, the service wont start . in order to reproduce make a //etc/init.d/stunnel start/ /ps -ef/ said stunnel 30301 1 0 13:21 pts/2 00:00:00 /usr/local/bin/stunnel /etc/stunnel/stunnel.conf stunnel 30302 1 0 13:21 pts/2 00:00:00 /usr/local/bin/stunnel /etc/stunnel/stunnel.conf stunnel 30303 1 0 13:21 pts/2 00:00:00 /usr/local/bin/stunnel /etc/stunnel/stunnel.conf stunnel 30304 1 0 13:21 pts/2 00:00:00 /usr/local/bin/stunnel /etc/stunnel/stunnel.conf stunnel 30305 1 0 13:21 pts/2 00:00:00 /usr/local/bin/stunnel /etc/stunnel/stunnel.conf stunnel 30306 1 0 13:21 ? 00:00:00 /usr/local/bin/stunnel /etc/stunnel/stunnel.conf Is it normal there is many process of stunnel ? And only the last pid process with ? in place of pts/2 is on the pid file. //etc/init.d/stunnel stop/ /ps -ef /said /stunnel 30306 1 0 13:21 ? 00:00:00 /usr/local/bin/stunnel /etc/stunnel/stunnel.conf/ /and / //etc/init.d/stunnel start/ / DÃ©marrage de stunnel :Reading configuration from file /etc/stunnel/stunnel.conf FIPS mode disabled RAND_status claims sufficient entropy for the PRNG PRNG seeded successfully Certificate: /path_to_mycrt Certificate loaded Key file: /path_to_my_key Private key loaded SSL context initialized for servicemy_domaine_name Configuration successful No limit detected for the number of clients FD=9 in non-blocking mode FD=10 in non-blocking mode FD=11 in non-blocking mode Option SO_REUSEADDR set on accept socket Error binding secure.scan-prod.com to 192.168.100.156:443 bind: Address already in use (98)/ return code 1 after stop there is a remaining stunnel process. It appears that this process is the one which the pid had been added to pidfile a /file /usr/local/bin/stunnel /said //usr/local/bin/stunnel: ELF 64-bit LSB executable, AMD x86-64, version 1 (SYSV), for GNU/Linux 2.6.9, dynamically linked (uses shared libs), for GNU/Linux 2.6.9, stripped/ /usr/local/bin/stunnel -version said /stunnel 4.32 on x86_64-unknown-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008/ /Threading:PTHREAD SSL:ENGINE,FIPS Sockets:POLL,IPv6 Auth:LIBWRAP/ /Global options/ /debug = daemon.notice/ /pid = /usr/local/var/run/stunnel/stunnel.pid/ /RNDbytes = 64/ /RNDfile = /dev/urandom/ /RNDoverwrite = yes/ /Service-level options/ /cert = /usr/local/etc/stunnel/stunnel.pem/ /ciphers = FIPS/ /session = 300 seconds/ /stack = 65536 bytes/ /sslVersion = TLSv1/ /TIMEOUTbusy = 300 seconds/ /TIMEOUTclose = 60 seconds/ /TIMEOUTconnect = 10 seconds/ /TIMEOUTidle = 43200 seconds/ /verify = none/ my stunnel.conf is like that /; Protocol version (all, SSLv2, SSLv3, TLSv1)/ /sslVersion = all/ /setuid = stunnel/ /setgid = stunnel/ /chroot = /var/chroot/stunnel/ /pid = /var/run/stunnel.pid/ /output = /var/log/stunnel.log/ /debug = 5/ /fips = no/ /socket=l:TCP_NODELAY=1/ /socket=r:TCP_NODELAY=1/ /[my_domain]/ /key = /path_to_my_key/ /cert = /path_to_mycrt/ /accept = 192.168.100.156:443/ /connect = 192.168.100.156:10443/ /xforwardedfor = yes/ /TIMEOUTclose = 0 Thanks for your help /

1 0

stunnel and heartbeat
by eni-urgence 25 Jun '10

25 Jun '10

Hello all. I want to use stunnel as ssl terminatation for https and pass httpd request to haproxy. I have compiled stunnel (source http://www.stunnel.org/download/stunnel/src/stunnel-4.32.tar.gz ) and apply this patch http://haproxy.1wt.eu/download/patches/stunnel-4.32-xforwarded-for.diff. I have placed the binary in /usr/local/bin . I want to use the heartbeat capabilities and start stunnel only if VIP is on the node. In order to make that, the init script of stunnel must be LSB compatible like said http://www.linux-ha.org/LSBResourceAgent. When i made a /etc/init.d/stunnel stop then a /etc/init.d/stunnel start, the service wont start . in order to reproduce make a //etc/init.d/stunnel start/ /ps -ef/ said stunnel 30301 1 0 13:21 pts/2 00:00:00 /usr/local/bin/stunnel /etc/stunnel/stunnel.conf stunnel 30302 1 0 13:21 pts/2 00:00:00 /usr/local/bin/stunnel /etc/stunnel/stunnel.conf stunnel 30303 1 0 13:21 pts/2 00:00:00 /usr/local/bin/stunnel /etc/stunnel/stunnel.conf stunnel 30304 1 0 13:21 pts/2 00:00:00 /usr/local/bin/stunnel /etc/stunnel/stunnel.conf stunnel 30305 1 0 13:21 pts/2 00:00:00 /usr/local/bin/stunnel /etc/stunnel/stunnel.conf stunnel 30306 1 0 13:21 ? 00:00:00 /usr/local/bin/stunnel /etc/stunnel/stunnel.conf Is it normal there is many process of stunnel ? And only the last pid process with ? in place of pts/2 is on the pid file. //etc/init.d/stunnel stop/ /ps -ef /said /stunnel 30306 1 0 13:21 ? 00:00:00 /usr/local/bin/stunnel /etc/stunnel/stunnel.conf/ /and / //etc/init.d/stunnel start/ / DÃ©marrage de stunnel :Reading configuration from file /etc/stunnel/stunnel.conf FIPS mode disabled RAND_status claims sufficient entropy for the PRNG PRNG seeded successfully Certificate: /path_to_mycrt Certificate loaded Key file: /path_to_my_key Private key loaded SSL context initialized for servicemy_domaine_name Configuration successful No limit detected for the number of clients FD=9 in non-blocking mode FD=10 in non-blocking mode FD=11 in non-blocking mode Option SO_REUSEADDR set on accept socket Error binding secure.scan-prod.com to 192.168.100.156:443 bind: Address already in use (98)/ return code 1 after stop there is a remaining stunnel process. It appears that this process is the one which the pid had been added to pidfile a /file /usr/local/bin/stunnel /said //usr/local/bin/stunnel: ELF 64-bit LSB executable, AMD x86-64, version 1 (SYSV), for GNU/Linux 2.6.9, dynamically linked (uses shared libs), for GNU/Linux 2.6.9, stripped/ /usr/local/bin/stunnel -version said /stunnel 4.32 on x86_64-unknown-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008/ /Threading:PTHREAD SSL:ENGINE,FIPS Sockets:POLL,IPv6 Auth:LIBWRAP/ /Global options/ /debug = daemon.notice/ /pid = /usr/local/var/run/stunnel/stunnel.pid/ /RNDbytes = 64/ /RNDfile = /dev/urandom/ /RNDoverwrite = yes/ /Service-level options/ /cert = /usr/local/etc/stunnel/stunnel.pem/ /ciphers = FIPS/ /session = 300 seconds/ /stack = 65536 bytes/ /sslVersion = TLSv1/ /TIMEOUTbusy = 300 seconds/ /TIMEOUTclose = 60 seconds/ /TIMEOUTconnect = 10 seconds/ /TIMEOUTidle = 43200 seconds/ /verify = none/ my stunnel.conf is like that /; Protocol version (all, SSLv2, SSLv3, TLSv1)/ /sslVersion = all/ /setuid = stunnel/ /setgid = stunnel/ /chroot = /var/chroot/stunnel/ /pid = /var/run/stunnel.pid/ /output = /var/log/stunnel.log/ /debug = 5/ /fips = no/ /socket=l:TCP_NODELAY=1/ /socket=r:TCP_NODELAY=1/ /[my_domain]/ /key = /path_to_my_key/ /cert = /path_to_mycrt/ /accept = 192.168.100.156:443/ /connect = 192.168.100.156:10443/ /xforwardedfor = yes/ /TIMEOUTclose = 0 Thanks for your help /

1 0

error during multithreaded operation
by Bhavna Jhunjhunwala 24 Jun '10

24 Jun '10

Hi Users, I am having the same problem as listed in below thread. Is there a resolution? Appreciate any help in this matter! http://stunnel.mirt.net/pipermail/stunnel-users/2009-April/002353.html open ssl version: OpenSSL 0.9.8k 25 Mar 2009 stunnel version: stunnel -version stunnel 4.33 on i386-apple-darwin10.2.0 with OpenSSL 0.9.8k 25 Mar 2009 Threading:PTHREAD SSL:ENGINE Sockets:SELECT,IPv6 Auth:LIBWRAP Global options debug = daemon.notice pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!aNULL:!eNULL:!SSLv2 session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none -- Thanks, Bhavna Quantitative Brokers DISCLAIMER: This e-mail and any attachments are for the confidential use of the intended recipient. If you are not the intended recipient of this message you are hereby notified that any review, dissemination, distribution or copying of this message is strictly prohibited. This communication is for information purposes only and should not be regarded as an offer to sell or as a solicitation of an offer to buy any investment product, an official confirmation of any transaction or an official statement of Quantitative Brokers, LLC. E-mail transmissions cannot be guaranteed to be secure or error-free. Therefore, we do not represent that this information is complete or accurate and it should not be relied upon as such. All information is subject to change without notice. Quantitative Brokers may, at its discretion, monitor and review the content of all e-mail communications.

1 0

Connecting to stunnel with SQLServer
by Mohit Anchlia 23 Jun '10

23 Jun '10

We have a requirement to connect to a SQLServer that is connected through stunnel on the other end. Can I use java SSL to talk to stunnel? What are my options?

1 0

transfer() loop executes not transferring any data
by Nelson 21 Jun '10

21 Jun '10

I just setup stunnel to partner with haproxy to handle https. My concern is I saw the logs below on my stunnel logs. I don't know if I need to worry about this since my testing using https is doing fine. stunnel is forwarding https request to haproxy. 2010.06.22 07:57:27 LOG3[1363:2083728]: transfer() loop executes not transferring any data 2010.06.22 07:57:27 LOG3[1363:2083728]: please report the problem to Michal.Trojnara(a)mirt.net 2010.06.22 07:57:27 LOG3[1363:2083728]: protocol=TLSv1, check_SSL_pending=no 2010.06.22 07:57:27 LOG3[1363:2083728]: socket open: rd=yes wr=no, ssl open: rd=no wr=yes 2010.06.22 07:57:27 LOG3[1363:2083728]: socket ready: rd=no wr=no, ssl ready: rd=yes wr=no 2010.06.22 07:57:27 LOG3[1363:2083728]: wants: SSL_read rd=no wr=no, SSL_write rd=no wr=yes, SSL_shutdown rd=no wr=no 2010.06.22 07:57:27 LOG3[1363:2083728]: socket input buffer: 16384 byte(s), ssl input buffer: 0 byte(s) Thanks, Nelson

1 0

"choose a digital certificate" pop-up in IE
by KumpelJ 21 Jun '10

21 Jun '10

Hello I have browsed the archives but have not found the answer to this question... I have stunnel set up to handle https connections. It sits on a Debian server alongside HAProxy and works fine with every browser except for Internet Explorer. When I connect with Internet Explorer, I get a blank "Please choose a digital certificate" pop-up. How do we turn off the request for the client certificate in IE? Here are my details....thanks in advance. #vi /etc/stunnel/stunnel.conf verify=0 CAfile=/etc/ssl/certs/chain.pem cert=/etc/ssl/certs/multidomain.pem CApath=/etc/ssl/certs/ pid = /etc/stunnel/stunnel.pid debug = 3 output = /etc/stunnel/stunnel.log socket=l:TCP_NODELAY=1 socket=r:TCP_NODELAY=1 client=no [https] accept=192.168.11.32:443 connect=localhost:444 TIMEOUTclose=0 xforwardedfor=yes #usr/local/bin/stunnel -version stunnel 4.32 on x86_64-unknown-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Global options debug = daemon.notice pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none -- View this message in context: http://old.nabble.com/%22choose-a-digital-certificate%22-pop-up-in-IE-tp286… Sent from the Stunnel - Users mailing list archive at Nabble.com.

4 8

stunnel dies on logoff
by Bhavna Jhunjhunwala 17 Jun '10

17 Jun '10

Hi, I am using quickfix application to connect to an exchange and receive market data. The connectivity to exchange is through SSL and am using stunnel 4.15. I see that stunnel dies, every time my quickfix application is restarted or sends a logout to server. Please let me know if a solution is in place. *Below is the stunnel.conf file:* cert = /home/bhavna/workspace/stunnel/str10100str.pem key = /home/bhavna/workspace/stunnel/str10100str.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Some debugging stuff useful for troubleshooting debug = 7 output = /home/bhavna/workspace/stunnel/stunnel.log pid = /home/bhavna/workspace/stunnel/stunnel.pid ; Use it for client mode client = yes ; Service-level configuration [currenex_stream] ;accept = 127.0.0.1:1109 accept = 1110 ;prod details connect = server_IP:port TIMEOUTclose = 10 *Below are the version details of stunnel:* > ./stunnel -version stunnel 4.15 on x86_64-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none *Logs:* 2010.06.16 18:59:23 LOG7[6401:1084586304]: SSL alert (read): warning: close notify 2010.06.16 18:59:23 LOG7[6401:1084586304]: SSL closed on SSL_read 2010.06.16 18:59:23 LOG7[6401:1084586304]: Socket write shutdown 2010.06.16 18:59:23 LOG7[6401:1084586304]: SSL write shutdown 2010.06.16 18:59:23 LOG7[6401:1084586304]: SSL alert (write): warning: close notify 2010.06.16 18:59:23 LOG6[6401:1084586304]: SSL_shutdown successfully sent close_notify 2010.06.16 18:59:23 LOG5[6401:1084586304]: Connection closed: 109 bytes sent to SSL, 129 bytes sent to socket 2010.06.16 18:59:23 LOG7[6401:1084586304]: currenex_stream finished (0 left) -- Thanks, Bhavna DISCLAIMER: This e-mail and any attachments are for the confidential use of the intended recipient. If you are not the intended recipient of this message you are hereby notified that any review, dissemination, distribution or copying of this message is strictly prohibited. This communication is for information purposes only and should not be regarded as an offer to sell or as a solicitation of an offer to buy any investment product, an official confirmation of any transaction or an official statement of Quantitative Brokers, LLC. E-mail transmissions cannot be guaranteed to be secure or error-free. Therefore, we do not represent that this information is complete or accurate and it should not be relied upon as such. All information is subject to change without notice. Quantitative Brokers may, at its discretion, monitor and review the content of all e-mail communications.

1 1

Re: [stunnel-users] Stunnel supports ECC certificate?
by Bao, Robert 08 Jun '10

08 Jun '10

To those who may find it useful: Mike came to rescure. He provided some new code and gave me the modified file to try out. It worked very well so far, problem solved. He plans to release the change in the next revision. Thanks a lot Mike. Robert Bao > _____________________________________________ > From: Bao, Robert > Sent: Thursday, June 03, 2010 2:14 PM > To: 'stunnel-users(a)mirt.net' > Subject: Stunnel supports ECC certificate? > > I searched the entire archive, couldn't find the answer/solution I am > looking for. I have to post to this group, and appreciate any > help/suggestion from any you. > > I use the latest 1.0.0 OpenSSL and 4.33 Stunnel. > > I used OpenSSL commands that very similar to what is described in the > following link to create the ECC certificate and the private key file. > http://src.opensolaris.org/source/xref/sfw/usr/src/lib/openssl/openssl > -0.9.8n/demos/ssltest-ecc/ECC-RSAcertgen.sh > > Start Stunnel, see the following errors: > Key file: (actual path to the private key file)\HOST.KEY > error stack: 140B3009 : error:140B3009:SSL > routines:SSL_CTX_use_RSAPrivateKey_file:PEM lib > SSL_CTX_use_RSAPrivateKey_file: 607907F: error:0607907F:digital > envelope routines:EVP_PKEY_get1_RSA:expecting an rsa key > > There was a similar posting 4-5 years ago, and Mike answered it (the > answer was: Stunnel didn't support ECC at that time). > http://stunnel.mirt.net/pipermail/stunnel-users/2005-October/000817.ht > ml > > Seems like this is still true today. Then, when the ECC support will > be added to Stunnel? > > If Stunnel already supports ECC certificate, how do I make it work? > > Thanks. > > Robert Bao > Software House > Tyco International > 978-577-4202 > > Explore our new Tyco Online Learning Center Web-based Training Bundles > at: www.swhouse.com/support/tyco_online_learning_center.aspx > > This e-mail may contain or have attached to it information or > technology the export or re-export of which is restricted by U.S. laws > and regulations. By viewing this e-mail and any attachments, the > recipient agrees to the following: (i) the recipient's use of the > contents of this e-mail and any attachments shall comply with all > applicable laws, rules and regulations, including, without limitation, > U.S. international trade laws and regulations, and (ii) the recipient > may not transfer or otherwise export or re-export any information or > technology contained in this e-mail or any attachment except in full > compliance with the export controls administered by the U.S. and other > countries and any applicable import and use restrictions. >

1 0

STunnel client on Android?
by Marcel Bokhorst 08 Jun '10

08 Jun '10

Hi, Is it possible to use STunnel as client on Android? Regards, Marcel

2 1

stunnel 4.33 stops (crashes?) after undetermined running time
by Markus Borst 07 Jun '10

07 Jun '10

Hi, I have a strange problem with current stunnel (4.33): It just crashes after some time. The time is variable, I suspect it stops after a number of connections. System: - Windows Server 2003 SP2 (also happens on Windows Server 2008R2) - stunnel runs as service - stunnel is configured to run as ssl server for imap and pop3 with our certificate (including key-chain) stunnel was running fine for years on the Windows Server 2003. After upgrade to stunnel 4.33, the stunnel service process first worked fine, the just stopped working after some time: - The windows service "stunnel" was stopped - the stunnel.log (standard debug level) showed not error or other entry at the time of the stop. - The windows eventlog shows: ====== Event 7034, Service Control Manager The stunnel service terminated unexpectedly. It has done this 1 time(s). ====== (I'm not 100% sure, whether this event log message corresponds to the stunnel crash I described or to another crash.) I have downgrade to version 4.32, the stunnel service now runs uninterrupted as before. Since the time of crash varies somewhat, seemingly with the current load of the server, I suspect that stunnel crashes after a certain amount of ssl connections, but I'm not sure. This has happened on two different servers (Windows Server 2003 SP2 and Windows Server 2008 R2). Is this a known problem? I'd love to do some further tests, but since this is a production system, I cannot test it in our normal environment. A program to generate random ssl connections would come handy to further analyze the problem. Greetings Markus Borst -- TU Darmstadt Hochschulrechenzentrum (HRZ) Markus Borst Adresse: Petersentrasse 30, 64287 Darmstadt, Germany Tel.: 06151/16-2056 Email: M.Borst(a)hrz.tu-darmstadt.de

2 2

Three patches: DNS CommonName verification support, separated stderr/foreground options, and support for minimal ssl libs
by Tristan Schmelcher 07 Jun '10

07 Jun '10

Hello, Recently I started using stunnel in an embedded Linux product and I had need to add several features that I think other users would benefit from. I have attached them as separate patches against 4.33. I hereby release them into the public domain. Here is a description of each: stunnel-4.33-handle-minimal-ssl-libs.patch: Add support for building against a libssl/libcrypo that has had various non-essential features removed via the "no-<feature>" Configure options for openssl. This requires disabling non-essential Stunnel features at compile-time if they have dependencies on disabled libssl/libcrypto features. For memory-constrained embedded systems, this is a big win. With this patch I was able to cut the memory footprint of stunnel+openssl by about a third simply by disabling openssl features that I didn't need. stunnel-4.33-separate-stderr-option.patch This splits the stderr logging effect of the "foreground" option into a separate option named "stderr", so that users have the freedom to enable foreground without stderr logging, or vice versa. For backwards compatibility though, specifying foreground = yes implies stderr = yes unless followed in the config by stderr = no. This is useful on embedded Linux systems that lack an implementation of fork() (due to the processor not having an MMU), because on such systems every daemon has to be launched in a foreground mode and pre-daemonized with the simpler vfork() function, e.g. using "&" from a shell. In this mode, logging to stderr does not make sense, because in reality the process is still a daemon so the logging clutters the terminal. stunnel-4.33-dns-commonname-verify-support.patch: I saved the best for last. ;) This adds a "verify_dns" option to check the CommonName in peer certificates against their DNS name when verifying, much as web browsers do. I have seen posts from users asking for this feature in the past, so I think it's value is self-evident. I'd also like to take this opportunity to say that I'm a long-time user of Stunnel on my personal Linux desktop machine and it is a really excellent piece of software. Thank you for making it free and open source.

3 8

Stunnel supports ECC certificate?
by Bao, Robert 03 Jun '10

03 Jun '10

I searched the entire archive, couldn't find the answer/solution I am looking for. I have to post to this group, and appreciate any help/suggestion from any you. I use the latest 1.0.0 OpenSSL and 4.33 Stunnel. I used OpenSSL commands that very similar to what is described in the following link to create the ECC certificate and the private key file. http://src.opensolaris.org/source/xref/sfw/usr/src/lib/openssl/openssl-0 .9.8n/demos/ssltest-ecc/ECC-RSAcertgen.sh Start Stunnel, see the following errors: Key file: (actual path to the private key file)\HOST.KEY error stack: 140B3009 : error:140B3009:SSL routines:SSL_CTX_use_RSAPrivateKey_file:PEM lib SSL_CTX_use_RSAPrivateKey_file: 607907F: error:0607907F:digital envelope routines:EVP_PKEY_get1_RSA:expecting an rsa key There was a similar posting 4-5 years ago, and Mike answered it (the answer was: Stunnel didn't support ECC at that time). http://stunnel.mirt.net/pipermail/stunnel-users/2005-October/000817.html Seems like this is still true today. Then, when the ECC support will be added to Stunnel? If Stunnel already supports ECC certificate, how do I make it work? Thanks. Robert Bao Software House Tyco International 978-577-4202 Explore our new Tyco Online Learning Center Web-based Training Bundles at: www.swhouse.com/support/tyco_online_learning_center.aspx This e-mail may contain or have attached to it information or technology the export or re-export of which is restricted by U.S. laws and regulations. By viewing this e-mail and any attachments, the recipient agrees to the following: (i) the recipient's use of the contents of this e-mail and any attachments shall comply with all applicable laws, rules and regulations, including, without limitation, U.S. international trade laws and regulations, and (ii) the recipient may not transfer or otherwise export or re-export any information or technology contained in this e-mail or any attachment except in full compliance with the export controls administered by the U.S. and other countries and any applicable import and use restrictions.

1 0

deploy stunnel
by Arko-Quick, Patricia K 02 Jun '10

02 Jun '10

Is there a way to deploy stunnel to all users versus the current user logged in? I would like to deploy it with sms to all users of the machine.

1 0

Default for TIMEOUTidle?
by Markus Borst 27 May '10

27 May '10

I want to modify TIMEOUTidle in our configuration. To be sure to set it to sensible values, I need to know the default value, but I can't find it in the docs. Greetings Markus Borst -- TU Darmstadt Hochschulrechenzentrum (HRZ) Markus Borst Adresse: Petersentrasse 30, 64287 Darmstadt, Germany Tel.: 06151/16-2056 Email: M.Borst(a)hrz.tu-darmstadt.de

1 0

Transparent mode, alternative env.c
by Hans Werner Strube 25 May '10

25 May '10

The method for passing the remote address and port to an exec'ed program through getenv() calls in the preloaded libstunnel.so fails for programs that clean the environment initially. This can be circumvented placing getenv() in an _init() function and storing the results in static variables. Here is my alternative env.c (without the copyright and license), which I have been using for more than a year: * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * /* getpeername() can't be declared in the following includes */ #define getpeername no_getpeername #include <sys/types.h> #include <sys/socket.h> /* for AF_INET */ #include <netinet/in.h> #include <arpa/inet.h> /* for inet_addr() */ #include <stdlib.h> /* for getenv() */ #ifdef __BEOS__ #include <be/bone/arpa/inet.h> /* for AF_INET */ #include <be/bone/sys/socket.h> /* for AF_INET */ #else #include <sys/socket.h> /* for AF_INET */ #endif #undef getpeername static uint32_t rem_host=0; static uint16_t rem_port=0; /* Requires shared-library linking by ld, not cc (except with gcc -nostdlib) */ void _init() { char *value; if((value=getenv("REMOTE_HOST")) && *value != '\0') rem_host = inet_addr(value); if((value=getenv("REMOTE_PORT")) && *value != '\0') rem_port = htons(atoi(value)); } int getpeername(int s, struct sockaddr_in *name, int *len) { char *value; name->sin_family = AF_INET; name->sin_addr.s_addr = rem_host; name->sin_port = rem_port; return 0; } /* End of env.c */

1 0

STRLEN in common.h may be too small
by Hans Werner Strube 25 May '10

25 May '10

In common.h of stunnel-4.x, the parameter STRLEN (used for many buffers) is set to 256. This is insufficient in some cases, e.g., the CAPABILITY response of an IMAP server or the pathname of a file may be too long, resulting in errors. If you encounter such cases (e.g., messages "Input line too long"), increase STRLEN, e.g., to 512.

1 0

Using stunnel to RDP into a SSL-enabled Windows box
by Daren Krive 11 May '10

11 May '10

Hi everyone, First of all I apologize if this has been asked before or if I am totally misunderstanding the purpose of stunnel altogether. If so please bear with my ignorance. I am an IT consultant and I manage about 20+ Windows-based servers. Some of these servers are accessible via VPN while others are accessible directly via RDP over the Internet. For those that are exposed to the net I am using the SSL certificate feature of Remote Desktop by going into “Terminal Services Configuration” and configuring the connection to use an SSL (most of the time a self-signed cert). I can connect to these machines no problem from Windows and I get a “lock” icon in my RDP client. However I cannot connect to these machines using rdestkop under Ubuntu. I have determined that if I turn off the requirement to use SSL on the server side (and instead allow the connection to use the built-in encryption of RDP) then I am able to connect with rdesktop. I would very much like to avoid rebooting just to connect to these servers. I am also not willing to remove the requirement for the SSL connection. Is there a way I can use stunnel on my Ubuntu box to first establish a secure SSL connection and then use rdesktop over that connection? I have searched high and low for info on this and found nothing. I have found instructions on how to use the Windows version of stunnel to secure RDP but that isn’t what I am trying to do. The server is already using an SSL cert to encrypt the connection (not sure how many people know Windows 2003 and up can do this). I am looking to get around the apparent lack of SSL support in rdesktop. Best regards, Daren.

3 3

running as a windows service
by Graham Chiu 10 May '10

10 May '10

I downloaded and ran the windows binary 4.33. When I use the stunnel.pem it runs fine as a service. I created my own pem ( using Openssl on OpenSolaris ) and it won't run now as a service. I get a timeout message. If I then uninstall it as a service, and run it as an application, it works. Ideas on getting to run as a service with my pem? The log says nothing of note. -- Graham Chiu

2 1

Safari SSL Problems
by Rene Plattner 05 May '10

05 May '10

Hi, has anyone Problems with Safari? I habe Problems with Safari 3 + 4 on Windows with stunnel Version 4.27 + 4.33 Everytime if I want to connect to an SSL terminated (stunnel) webservice, Safari asks for an client certificate, allthough I set the option verify to default (=none). Kind regards, René Plattner -- -------------------------------------------------------------- Dipl.-Ing. René Plattner Zentraler Informatikdienst (Central IT-Services) Universität Innsbruck Technikerstrasse 23 Tel: ++43512/507-2360 6020 Innsbruck Fax: ++43512/507-2944 Austria E-Mail: rene.plattner(a)uibk.ac.at Homepage: http://www.uibk.ac.at/zid -------------------------------------------------------------- D92E 1AE3 A8AA 9A57 8E5B 9204 F5D0 95DB 4030 742D http://homepage.uibk.ac.at/~c1021058/keys/0x4030742D.pub --------------------------------------------------------------

1 0

zlib error in build for W32
by J F 04 May '10

04 May '10

Hi, I'm trying to build from source stunnel-4.33 for W32 in a machine with Debian lenny following the guidelines provided in INSTALL.W32. First I received complains from the compiler about zlib.h not found. Then I copied the zlib headers from /usr/include in include directory under openssl tree. Now openssl 1.0 compiles smoothly but when I try to compile stunnel I received the following error: i586-mingw32msvc-gcc -s -o stunnel.exe file.obj client.obj log.obj options.obj protocol.obj network.obj resolver.obj ssl.obj ctx.obj verify.obj sthreads.obj stunnel.obj gui.obj resources.obj -L/usr/src/openssl-1.0.0 -lzdll -lcrypto.dll -lssl.dll -lws2_32 -lgdi32 -mwindows /usr/lib/gcc/i586-mingw32msvc/4.2.1-sjlj/../../../../i586-mingw32msvc/bin/ld: cannot find -lzdll collect2: ld returned 1 exit status make: *** [stunnel.exe] Error 1 Am I doing some basic mistake? JF

2 1

How to start windows service with realtime priority?
by Ryan Dunn 20 Apr '10

20 Apr '10

I've been trying to figure out how to start the stunnel service on windows with a realtime priority, and so far, all attempts have failed. I've tried setting the ImagePath to 'start /realtime "C:\Program Files\stunnel\stunnel.exe" -service -install' and inserting that into a bat file and calling that instead, but that didn't work either. Does anyone know how to specify the startup priority of a windows service? Is that something that the program would need to support? Thanks, Ryan

1 0

newb: setting up and debugging a windows stunnel
by Jay Sprenkle 19 Apr '10

19 Apr '10

Good afternoon, I'm trying to use stunnel to secure a legacy application's communications. I can't seem to get it setup and working. Can anyone provide any hints where I'm going wrong? Here's what I'm trying to accomplish: A windows service on a client machine connects to a server on port 7000 using TCP. I'd like to encrypt the communication between client and server. Here's what I've tried: Created a new server that accepts ssl connections on port 7443. Got a certificate for the server and installed it. Installed stunnel on my windows machine (version 7.43 from the distribution archive file). Installed libssl32.dll and libeay32.dll in the same directory as stunnel.exe ( from the openssl-0.9.8h-1 binary distribution). Installed it as a service using "stunnel -install" Configured stunnel as follows: debug=7 output=C:\p4\internal\Utility\Proxy\proxy.log service=Proxy taskbar=no [exchange] accept=7000 client=yes connect=proxy.blah.com:7443 I changed my hosts file to trick the old application: server.blah.com 127.0.0.1 proxy.blah.com IP-address-of-server.blah.com "server.blah.com" now resolves to the machine it's running on (i.e. stunnel). "proxy.blah.com" goes to the real server. stunnel should connect to the server. I start the stunnel service and try to connect. It looks like it's working but the stunnel service just shuts down with no message. 2010.04.19 13:16:21 LOG5[4924:3716]: stunnel 4.33 on x86-pc-mingw32-gnu with OpenSSL 0.9.8h 28 May 2008 2010.04.19 13:16:21 LOG5[4924:3716]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2010.04.19 13:16:49 LOG5[4924:3748]: Service exchange accepted connection from 127.0.0.1:4134 2010.04.19 13:16:49 LOG6[4924:3748]: connect_blocking: connecting x.80.60.32:7443 2010.04.19 13:16:49 LOG5[4924:3748]: connect_blocking: connected x.80.60.32:7443 2010.04.19 13:16:49 LOG5[4924:3748]: Service exchange connected remote server from x.253.120.19:4135 2010.04.19 13:20:24 LOG5[3668:3856]: Reading configuration from file stunnel.conf 2010.04.19 13:20:24 LOG7[3668:3856]: Snagged 64 random bytes from C:/.rnd 2010.04.19 13:20:24 LOG7[3668:3856]: Wrote 1024 new random bytes to C:/.rnd 2010.04.19 13:20:24 LOG7[3668:3856]: RAND_status claims sufficient entropy for the PRNG 2010.04.19 13:20:24 LOG7[3668:3856]: PRNG seeded successfully 2010.04.19 13:20:24 LOG7[3668:3856]: SSL context initialized for service exchange 2010.04.19 13:20:24 LOG5[3668:3856]: Configuration successful 2010.04.19 13:20:24 LOG5[3668:3856]: No limit detected for the number of clients 2010.04.19 13:20:24 LOG7[3668:3856]: FD=312 in non-blocking mode 2010.04.19 13:20:24 LOG7[3668:3856]: Option SO_REUSEADDR set on accept socket 2010.04.19 13:20:24 LOG7[3668:3856]: Service exchange bound to 0.0.0.0:7000 2010.04.19 13:20:24 LOG7[3668:3856]: Service exchange opened FD=312 2010.04.19 13:20:24 LOG5[3668:3856]: stunnel 4.33 on x86-pc-mingw32-gnu with OpenSSL 0.9.8h 28 May 2008 2010.04.19 13:20:24 LOG5[3668:3856]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2010.04.19 13:21:02 LOG7[3668:4556]: Service exchange accepted FD=372 from 127.0.0.1:4156 2010.04.19 13:21:02 LOG7[3668:4556]: Creating a new thread 2010.04.19 13:21:02 LOG7[3668:4556]: New thread created 2010.04.19 13:21:02 LOG7[3668:3756]: Service exchange started 2010.04.19 13:21:02 LOG7[3668:3756]: FD=372 in non-blocking mode 2010.04.19 13:21:02 LOG5[3668:3756]: Service exchange accepted connection from 127.0.0.1:4156 2010.04.19 13:21:02 LOG7[3668:3756]: FD=396 in non-blocking mode 2010.04.19 13:21:02 LOG6[3668:3756]: connect_blocking: connecting x.80.60.32:7443 2010.04.19 13:21:02 LOG7[3668:3756]: connect_blocking: s_poll_wait x.80.60.32:7443: waiting 10 seconds 2010.04.19 13:21:02 LOG5[3668:3756]: connect_blocking: connected x.80.60.32:7443 2010.04.19 13:21:02 LOG5[3668:3756]: Service exchange connected remote server from x.253.120.19:4157 2010.04.19 13:21:02 LOG7[3668:3756]: Remote FD=396 initialized 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): before/connect initialization 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): SSLv3 write client hello A 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): SSLv3 read server hello A 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): SSLv3 read server certificate A 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): SSLv3 read server done A 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): SSLv3 write client key exchange A 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): SSLv3 write change cipher spec A 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): SSLv3 write finished A 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): SSLv3 flush data 2010.04.19 13:21:02 LOG7[3668:3756]: SSL state (connect): SSLv3 read finished A The client thinks the connection is closed: No connection could be made because the target machine actively refused it 127.0.0.1:7000 at System.Net.Sockets.Socket.DoConnect(EndPoint endPointSnapshot, SocketAddress socketAddress) at System.Net.Sockets.Socket.Connect(EndPoint remoteEP) at Service.ConnUtility.Connect() Any suggestions? Thanks

1 0

Stunnel connection from A to B but direction from B to A?
by Carsten Krüger 13 Apr '10

13 Apr '10

Hi, is it possible with stunnel to connect from host A to host B but to have the port redirection the other way? host A has a webserver on 127.0.0.1:80 host A connects to Host B (example.dyndns.org:8000) Host B opens a browser on page http://127.0.0.1:80 and reaches the webserver on A If yes, how do I have to configure A and B? The manpage didn't enlighten me. The normal way A connects to B and A reaches webserver on B works perfectly. greetings Carsten

2 1

multiple systems
by tony westenhofer 12 Apr '10

12 Apr '10

Hello, My currently working setup is using verify=2 (at client only )and the server1's info is in my .pem on the clients. This works fine, but if need to have server2 act as backup when server1 is down. Can I just add server2's info to the .pem or do I need to setup multiple files for the different keys? Thanks in advance for saving me some lab time! Noob _________________________________________________________________ The New Busy think 9 to 5 is a cute idea. Combine multiple calendars with Hotmail. http://www.windowslive.com/campaign/thenewbusy?tile=multicalendar&ocid=PID2…

1 0

"bind: Address already in use (48)"
by Dino Buzzetti 12 Apr '10

12 Apr '10

Please pardon me if this is an improper question to the list. But I am a freshman who uses stunnel to connect to his university library proxy from abroad. I had stunnel installed and it worked properly, but after an upgrade of all old ports, solicited by the installation process of a new application requiring MacPorts, stunnel doesn't work anymore. I have tried to re-install it, but I still get the same error message > Error binding squidssl to ::1:8095 > bind: Address already in use (48) Any clue as to what might have engaged the 8095 address and on how I might try to solve the problem? Best, -dino buzzetti

3 2

Stunnel doesn't work at all since 4.30
by Denis Solovyov 05 Apr '10

05 Apr '10

Dear friends, I use stunnel for a long time to provide pop3s connections inside a local network. It is quite an old linux server under 2.4 kernel. Stunnel is started from xinetd. xinetd.conf: service pop3s { socket_type = stream wait = no user = root server = /usr/local/bin/stunnel server_args = /usr/local/etc/stunnel/pop3s.conf bind = [ip_address] } /usr/local/etc/stunnel/pop3s.conf: cert = /usr/local/etc/stunnel/mail.pem debug = debug exec = /usr/local/sbin/popa3d execargs = popa3d Everything worked perfectly before 4.30, but when I installed 4.30 pop3s connections just stopped. There is absolutely nothing in logs, just start and stop; example: Mar 24 20:29:51 aldema xinetd[2235]: START: pop3s pid=19123 from=[ip] Mar 24 20:29:51 aldema xinetd[2235]: EXIT: pop3s status=1 pid=19123 duration=0(sec) It is "all.log", i.e. syslog puts everything (*.*) into this file. If starting xinetd with '-v' option, nothing interesting is shown in its own verbose output. When I use 4.29 all.log looks like (with debug = info): Mar 21 09:40:04 aldema xinetd[2235]: START: pop3s pid=32516 from=[ip] Mar 21 09:40:04 aldema stunnel: LOG5[32516:16384]: stunnel 4.29 on i686-pc-linux-gnu with OpenSSL 0.9.7e Mar 21 09:40:04 aldema stunnel: LOG5[32516:16384]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Mar 21 09:40:04 aldema stunnel: LOG5[32516:16384]: stunnel accepted connection from[ip]:4020 Mar 21 09:40:04 aldema stunnel: LOG6[32516:16384]: SSL accepted: new session negotiated Mar 21 09:40:04 aldema stunnel: LOG6[32516:16384]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 Mar 21 09:40:04 aldema stunnel: LOG6[32516:16384]: Local mode child started (PID=32517) Mar 21 09:40:05 aldema popa3d[32517]: Authentication passed for [username] from 127.0.0.1 Mar 21 09:40:05 aldema popa3d[32517]: 0 messages (0 bytes) loaded Mar 21 09:40:05 aldema popa3d[32517]: 0 (0) deleted, 0 (0) left Mar 21 09:40:05 aldema stunnel: LOG6[32516:16384]: SSL_shutdown successfully sent close_notify Mar 21 09:40:05 aldema stunnel: LOG5[32516:16384]: Connection closed: 29 bytes sent to SSL, 48 bytes sent to socket Mar 21 09:40:05 aldema xinetd[2235]: EXIT: pop3s status=0 pid=32516 duration=1(sec) When 4.30 was released I thought it may be buggy because it was marked "experimental", but now I see 4.32 and the same behaviour. Actually, I don't know what to do... nothing in logs really confuses me. Does it mean stunnel crashes at startup (running "stunnel -version" is OK)? Any ideas? Thank you. With the best regards, Denis Solovyov

1 1

Openssl-1.0.0 incompatibility
by Carter Browne 01 Apr '10

01 Apr '10

Is there any update on the compatibility issues between openssl-0.9.8n and openssl-1.0.0? The same configuration file was used in both cases. Linux CentOS 5.4 and SuSE 11.1. Stunnel and openssl both built from sources. I have a number of self-signed certificates in a sub-directory. With openssl-1.0.0, the error is: VERIFY ERROR: depth=0, error= self signed certificate:... SSL_accept: 140890B2: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned With openssl-0.9.8n VERIFY OK: depth=0, ... I have compiled and linked a version of openssh-5.4p1 from sources with openssl-1.0.0 and it works correctly. Carter -- Carter Browne CBCS cbrowne(a)cbcs-usa.com 781-721-2890

2 1

Re: [stunnel-users] stunnel sends empty list of trusted CAs
by Sebastian Bork 01 Apr '10

01 Apr '10

2010/3/31 Michal Trojnara <Michal.Trojnara(a)mirt.net> > You should have implemented it the other way around: The "cert" option should contain the complete certificate chain of stunnel, > and "CApath"/"CAfile" should only contain the trusted CA certificate for "verify > = 2", and the trusted peer certificate for "verify = 3". Hi, thank you for your quick reply! Alas, I think we started with a misunderstanding. I know how the own certificate and the partner certificates are configured, and the instance with verify=3 works for some thirty partners. All client certificates are validated just as they should be. The file I set in "cert" contains the three certificates in the server certificate chain for stunnel, in the correct order. "CApath" is set to a directory that has all the symlinks with md5 hashes for the client certificates (the certificates themselves are all in their own subdirectories, with another set of symlinks, so I can use the subdirectory for an stunnel client process, and the directory at the top for the server). So when I wrote I put the whole certificate chain for each partner in the CA path, I meant in the directory there is the partner certificate as well as the certificate(s) of the CA that they got their certificate from. With "openssl verify -CApath . partner.crt" I check if everything is complete. Maybe this is overkill, if I do not really need a self-signed certificate at the top, but it shouldn't hurt either. The problem is this: their SAP software (I think they use the Business Connector, but it might be their PI directly, as indicated by the "XI" at the end of the capture file - I am no SAP guru) does not send a partner certificate. The partner claims this is because the "Distinguished Names" list is empty. In this list the server is supposed to send all the CAs it accepts, so the client can then chose one of the certificates it has installed to present it to the server. Since the list is empty, no certificate is found. So I need to find a way to send back a list of accepted root CA certificates. What I tried, and described in the mail, was this: I set up a second stunnel with verify=2. For this, I use the same file in "cert", but a new directory for CApath. In this directory, I have put the symlink for the CA certificate of the partner (their own company-wide CA) , in the hope that this is not only used to verify their client certificate when they present it, but also sent in the Distinguished Names list of accepted CAs. Unfortunately, this did not work, that list is still empty. I have attached the data of the connection attempt, including a screenshot the partner sent us, which shows the field they are talking about with a size of "0", Is there any way, regardless of how complex, to send the DNs? I'll gladly patch the source and compile instead of using a binary package, as long as it helps.

1 0

More Issues with Openssl 1.0.0
by Carter Browne 31 Mar '10

31 Mar '10

My standard configurations of stunnel use the verify=2 option. With recent versions of stunnel and openssl-0.9.8 for Linux systems, I have capath = /capath and stunnel searches directory /capath relative to chroot for the certificates. Using the same configuration file and openssl-1.0.0, this directory is no longer being searched. Any ideas about how to specify the location of capath with openssl-1.0.0? Thanks, Carter -- Carter Browne CBCS cbrowne(a)cbcs-usa.com 781-721-2890

2 1

stunnel sends empty list of trusted CAs
by Sebastian Bork 31 Mar '10

31 Mar '10

Hi, I have a problem which Google did not help me with. A communications partner of one of our customers wants to connect their SAP Business Connector to our platform using HTTPS. Our software does not have SSL/TLS implemented, we rather use stunnel for all communications links, inbound or outbound, where the customer or partner wants to use HTTPS with client authentication. The normal setup is "verify = 3" and the complete certificate chain for each partner is put into the CA path. In most cases, this works without problems. However, in the handshake, after the server certificate is sent and stunnel asks the client to send a client certificate, stunnel sends an empty list of triusted CAs. SAP BC expects the list of supported CAs to contain certificates, instead of being empty. My hope was that using "verify = 2" might help, so I have configured a new server instance of stunnel, and have copied the certificate of the partner's own CA into the CA path. Unfortunately, the partner says it still does not work, and the log file shows they still do not send their certificate when the server asks for a client cert. It seems that stunnel still returns an empty list of trusted CAs, which causes SAP BC to find no certificate to send. Is there any way I can configure stunnel to send back either every certificate found in a path or file, or at least to send back some fixed value for the trusted CAs?

2 1

Problem with openssl-1.0.0
by Carter Browne 30 Mar '10

30 Mar '10

For the Windows version of stunnel-4.31 and 4.32 I tried running stunnel with openssl-1.0.0 compiled for Windows and ssleay32.dll renamed to libssl32.dll. When I make a connection using using stunnel, I get a invalid memory reference to location 0 in libeay32.dll. I have had no problem with this approach with many versions of openssl up through and including openssl-0.9.8n. Any ideas? Carter -- Carter Browne CBCS cbrowne(a)cbcs-usa.com 781-721-2890

2 1

error:1408F10B
by Greg Groth 29 Mar '10

29 Mar '10

I'm having similar issues recently on two separate machines that are producing similar errors. In both instances, /var/log/messages starts filling up with lines similar to the following: SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number I can give further details on both systems, as well as the exact issue, if warranted. First off, can anyone explain what a 1408F10B error is? My gut feeling is that in both instances something changed on the client end (in both instances the client is a version of outlook). Any help would be greatly appreciated. Greg Groth

1 0

Re: [stunnel-users] GNU (clarification)
by tony westenhofer 27 Mar '10

27 Mar '10

Mr. Trojnara, That is what I was after: > Please simply include stunnel source (stunnel-4.xx.tar.gz) on whatever media > (e.g. CD, DVD, web page, etc.) you use to distribute your product together > with stunnel binary. Thank you again for such a wonderful piece of work-- And supporting it!!!!! Best Regards Tony > From: stunnel-users-request(a)mirt.net > Subject: stunnel-users Digest, Vol 68, Issue 9 > To: stunnel-users(a)mirt.net > Date: Sat, 27 Mar 2010 12:00:02 +0100 > > Send stunnel-users mailing list submissions to > stunnel-users(a)mirt.net > > To subscribe or unsubscribe via the World Wide Web, visit > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)mirt.net > > You can reach the person managing the list at > stunnel-users-owner(a)mirt.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. Re: GNU (Michal Trojnara) > 2. Re: auto-disconnecting people when CRL updated (Michal Trojnara) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 26 Mar 2010 22:27:51 +0100 > From: Michal Trojnara <Michal.Trojnara(a)mirt.net> > Subject: Re: [stunnel-users] GNU > To: stunnel-users(a)mirt.net > Message-ID: <201003262228.10766.Michal.Trojnara(a)mirt.net> > Content-Type: text/plain; charset="utf-8" > > tony westenhofer wrote: > > I am using stunnel (no code modifications) to encrypt communications > > for some applications to eventually be sold. First off outstanding work, > > stunnel saved hours of work having to figure out how to add the security > > desired. > > Thank you. That's exactly why I wrote it. 8-) > > > Now I am wanting to make sure to comply with licensing. > > Can someone be specific and help on this? > > As the author of stunnel I'll be glad to help. > > > I know we have to post a few things on the website for the > > product. (what? a link, an actually dl > > for stunnel...) > > Please simply include stunnel source (stunnel-4.xx.tar.gz) on whatever media > (e.g. CD, DVD, web page, etc.) you use to distribute your product together > with stunnel binary. > > > What about paper distribution for the product, what > > about stunnel must be included? > > I'm not sure I understand your question. > Do you distribute your software on paper? > > Do you mean any advertisement or documentation for your product? > The license does not require that you do anything about it, but it would be > nice of you to mention my name. > > Best regards, > Michal Trojnara > the author of stunnel >

1 0

auto-disconnecting people when CRL updated
by David van Zijl 26 Mar '10

26 Mar '10

Hello Is it possible to get stunnel to disconnect people on a graceful restart when a certificate has expired? Stunnel version 4.30 added the graceful reload option which is great because it will allow us to reload the CRLs, keep everybody connected and prevent new people connecting when their certs have expired (tested and working) - however existing connections are not terminated even though they have just expired... I'm not sure if we've missed a configuration option or if this is just not possible. A little background: We host an IRC server listening on localhost:6667, on top of that we have stunnel listening on the external interface port 6697 We're using the CAfile and CRLpath options to ensure that people are connecting with a valid certificate. Every hour a job runs to download the latest CRL files, if there is a change it restarts stunnel and kicks everybody off (we'd like to use a graceful restart instead) We are running stunnel on Red Hat Linux using the following line inside an init script to run it as a daemon: daemon /usr/local/bin/stunnel /etc/stunnel/stunnel.conf Excerpt from stunnel.conf: setuid = daemon setgid = daemon ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [irc-in] CAfile = /etc/ca/our-chains.pem CRLpath = /etc/crl accept = 192.168.0.1:6697setuid = daemon setgid = daemon connect = localhost:6667 verify = 2 Running stunnel -version tells me: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = daemon.notice pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none Kind Regards Dave

2 1

GNU
by tony westenhofer 26 Mar '10

26 Mar '10

Hello, I am using stunnel (no code modifications) to encrypt communications for some applications to eventually be sold. First off outstanding work, stunnel saved hours of work having to figure out how to add the security desired. Now I am wanting to make sure to comply with licensing. Can someone be specific and help on this? I know we have to post a few things on the website for the product. (what? a link, an actually dl for stunnel...) What about paper distribution for the product, what about stunnel must be included? Please be as specific as you can or better yet point me to an example of someone else already giving proper credit where due. Again thank you for your hard work (all involved). Second question, any recommendations for securing the stunnel folder without interfering with its functionality on Windows systems. Have not had time to try locking down different ntfs setting yet. Thanks in advance and I do apologies if my questions have already been covered in the past. If so please provide url. Tony _________________________________________________________________ Hotmail is redefining busy with tools for the New Busy. Get more from your inbox. http://www.windowslive.com/campaign/thenewbusy?ocid=PID27925::T:WLMTAGL:ON:…

2 1

Re: [stunnel-users] Stunnel 4.32 released
by Jose Alf. 25 Mar '10

25 Mar '10

Hi Michal, Thanks for the new 4.32 version. I tested beta 1 and 2 and everything worked fine on my side. Should have been released a day after because OpenSSL released a new version (0.9.8n) the same day. I compiled mine against it on Windows and it works. regards, Jose.

1 0

Still not working with client certificates
by Ron Cordell 24 Mar '10

24 Mar '10

Hello, I'm hoping that someone can give me a hint of where to look at this issue because I'm totally stuck and have been for a few days. When I attempt to use sTunnel in client mode with client certificates, the SSL seems to negotiate the certs and ciphers and then nothing else happens; the services hang. I'm hoping that someone has some insights about something that I haven't looked at, yet. My setup: Server: Windows Server, IIS 7 running SOAP services set for SSL Required, Client Certificate required (transport level client certificate, not SOAP message level). client: Windows machine, simple web application acting as a test client for the SOAP service. In between: sTunnel v4.32 Testing Scenario #1 -- Client configured to use client certificates directly against the IIS 7 service instance. This works as expected. Testing Scenario #2 -- Server configured to not require client certificates, but require SSL. sTunnel configured to listen on local port 8090 and forward to the IIS 7 server. This works as expected. Testing Scenario #3 -- Server configured to require client certificates. sTunnel configured to use client certificate as issued by a local CA in addition to the setup as before. This does not work, but hangs. sTunnel.conf: ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = C:\certs\client-cert-for-internal-environments.pem ;key = c:\certs\test_cert.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = c:\temp\stunnel.log ; Use it for client mode client = yes ; Service-level configuration ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 [http] accept = 8090 ;connect = 10.12.32.164:443 connect = 10.12.32.68:1443 TIMEOUTclose = 0 ; vim:ft=dosini sTunnel log: 2010.03.24 11:54:31 LOG5[5616:5992]: Reading configuration from file stunnel.conf 2010.03.24 11:54:31 LOG7[5616:5992]: RAND_status claims sufficient entropy for the PRNG 2010.03.24 11:54:31 LOG7[5616:5992]: PRNG seeded successfully 2010.03.24 11:54:31 LOG7[5616:5992]: Certificate: C:\certs\client-cert-for-internal-environments.pem 2010.03.24 11:54:31 LOG7[5616:5992]: Certificate loaded 2010.03.24 11:54:31 LOG7[5616:5992]: Key file: C:\certs\client-cert-for-internal-environments.pem 2010.03.24 11:54:38 LOG7[5616:5992]: Private key loaded 2010.03.24 11:54:38 LOG7[5616:5992]: SSL context initialized for service http 2010.03.24 11:54:38 LOG5[5616:5992]: Configuration successful 2010.03.24 11:54:38 LOG5[5616:5992]: No limit detected for the number of clients 2010.03.24 11:54:38 LOG7[5616:5992]: FD=176 in non-blocking mode 2010.03.24 11:54:38 LOG7[5616:5992]: Option SO_REUSEADDR set on accept socket 2010.03.24 11:54:38 LOG7[5616:5992]: Service http bound to 0.0.0.0:8090 2010.03.24 11:54:38 LOG7[5616:5992]: Service http opened FD=176 2010.03.24 11:54:38 LOG3[5616:5992]: c:\temp\stunnel.log: Input/output error (5) 2010.03.24 11:54:38 LOG3[5616:5992]: Unable to open output file: c:\temp\stunnel.log 2010.03.24 11:54:38 LOG5[5616:5992]: stunnel 4.32 on x86-pc-mingw32-gnu with OpenSSL 0.9.8l 5 Nov 2009 2010.03.24 11:54:38 LOG5[5616:5992]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2010.03.24 11:54:54 LOG7[5616:6192]: Service http accepted FD=436 from 127.0.0.1:56102 2010.03.24 11:54:54 LOG7[5616:6192]: Creating a new thread 2010.03.24 11:54:54 LOG7[5616:6192]: New thread created 2010.03.24 11:54:54 LOG7[5616:6696]: Service http started 2010.03.24 11:54:54 LOG7[5616:6696]: FD=436 in non-blocking mode 2010.03.24 11:54:54 LOG7[5616:6696]: Option TCP_NODELAY set on local socket 2010.03.24 11:54:54 LOG5[5616:6696]: Service http accepted connection from 127.0.0.1:56102 2010.03.24 11:54:54 LOG7[5616:6696]: FD=456 in non-blocking mode 2010.03.24 11:54:54 LOG6[5616:6696]: connect_blocking: connecting 10.12.32.68:1443 2010.03.24 11:54:54 LOG7[5616:6696]: connect_blocking: s_poll_wait 10.12.32.68:1443: waiting 10 seconds 2010.03.24 11:54:54 LOG5[5616:6696]: connect_blocking: connected 10.12.32.68:1443 2010.03.24 11:54:54 LOG5[5616:6696]: Service http connected remote server from 10.12.47.109:56103 2010.03.24 11:54:54 LOG7[5616:6696]: Remote FD=456 initialized 2010.03.24 11:54:54 LOG7[5616:6696]: Option TCP_NODELAY set on remote socket 2010.03.24 11:54:54 LOG7[5616:6696]: SSL state (connect): before/connect initialization 2010.03.24 11:54:54 LOG7[5616:6696]: SSL state (connect): SSLv3 write client hello A 2010.03.24 11:54:54 LOG7[5616:6696]: SSL state (connect): SSLv3 read server hello A 2010.03.24 11:54:54 LOG7[5616:6696]: SSL state (connect): SSLv3 read server certificate A 2010.03.24 11:54:54 LOG7[5616:6696]: SSL state (connect): SSLv3 read server done A 2010.03.24 11:54:54 LOG7[5616:6696]: SSL state (connect): SSLv3 write client key exchange A 2010.03.24 11:54:54 LOG7[5616:6696]: SSL state (connect): SSLv3 write change cipher spec A 2010.03.24 11:54:54 LOG7[5616:6696]: SSL state (connect): SSLv3 write finished A 2010.03.24 11:54:54 LOG7[5616:6696]: SSL state (connect): SSLv3 flush data 2010.03.24 11:54:54 LOG7[5616:6696]: SSL state (connect): SSLv3 read finished A 2010.03.24 11:54:54 LOG7[5616:6696]: 1 items in the session cache 2010.03.24 11:54:54 LOG7[5616:6696]: 1 client connects (SSL_connect()) 2010.03.24 11:54:54 LOG7[5616:6696]: 1 client connects that finished 2010.03.24 11:54:54 LOG7[5616:6696]: 0 client renegotiations requested 2010.03.24 11:54:54 LOG7[5616:6696]: 0 server connects (SSL_accept()) 2010.03.24 11:54:54 LOG7[5616:6696]: 0 server connects that finished 2010.03.24 11:54:54 LOG7[5616:6696]: 0 server renegotiations requested 2010.03.24 11:54:54 LOG7[5616:6696]: 0 session cache hits 2010.03.24 11:54:54 LOG7[5616:6696]: 0 external session cache hits 2010.03.24 11:54:54 LOG7[5616:6696]: 0 session cache misses 2010.03.24 11:54:54 LOG7[5616:6696]: 0 session cache timeouts 2010.03.24 11:54:54 LOG6[5616:6696]: SSL connected: new session negotiated 2010.03.24 11:54:54 LOG6[5616:6696]: Negotiated ciphers: RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 This is where things time out; nothing happens beyond this point.

1 0

Stunnel 4.32 released
by Michal Trojnara 24 Mar '10

24 Mar '10

Dear Users, I'm glad to announce a new version of stunnel. The ChangeLog entry: Version 4.32, 2010.03.24, urgency: MEDIUM: * New features - New service-level "libwrap" option for run-time control whether /etc/hosts.allow and /etc/hosts.deny are used for access control. Disabling libwrap significantly increases performance of stunnel. - Win32 DLLs for OpenSSL 0.9.8m. * Bugfixes - Fixed a transfer() loop issue with SSLv2 connections. - Fixed a "setsockopt IP_TRANSPARENT" warning with "local" option. - Logging subsystem bugfixes and cleanup. - Installer bugfixes for Vista and later versions of Windows. - FIPS mode can be enabled/disabled at runtime. SHA-1 value for stunnel-4.32.tar.gz: e9be8b9150d1c901a7c37b58494e351815147a79 Home page: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ Best regards, Michal Trojnara

1 0

Trying to use client certificates but no success so far
by Ron Cordell 19 Mar '10

19 Mar '10

Hello, I'm trying to set up sTunnel to use client certificates in the following arrangement: Client Java Server (HTTP) --> sTunnel (HTTPS w/client cert) --> Windows IIS SOAP service, requires client cert The client certificate was generated from a MS CA cert generation tool, one we use for our internal certificates and our internal CA. The client cert was generated as a .pfx file and I used OpenSSL to convert it to a .pem file with the -nodes option. Testing without the client certificates shows that if the IIS hosted SOAP service is set to not require a client certificate, the sTunnel configuration works and we're able to communicate between the HTTP only client and the HTTPS IIS hosted service. However, once we add the certificate, the communication stops at the handshake. I'm wondering if I need to change the client .pem cert to have the private key (don't use the -nodes option when converting using OpenSSL). Here is the contents of the .conf file: ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = user_cert.pem key = user_cert.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = c:\temp\stunnel.log ; Use it for client mode client = yes ; Service-level configuration ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 [http] accept = 8090 connect = 10.12.32.164:443 TIMEOUTclose = 0 ; vim:ft=dosini Here is the output from the log file showing two attempts to hit the service with the client cert, one from a browser and one from a bit of client code: 2010.03.19 09:58:27 LOG5[5864:4032]: Reading configuration from file stunnel.conf 2010.03.19 09:58:27 LOG7[5864:4032]: RAND_status claims sufficient entropy for the PRNG 2010.03.19 09:58:27 LOG7[5864:4032]: PRNG seeded successfully 2010.03.19 09:58:27 LOG7[5864:4032]: Certificate: user_cert.pem 2010.03.19 09:58:27 LOG7[5864:4032]: Certificate loaded 2010.03.19 09:58:27 LOG7[5864:4032]: Key file: user_cert.pem 2010.03.19 09:58:27 LOG7[5864:4032]: Private key loaded 2010.03.19 09:58:27 LOG7[5864:4032]: SSL context initialized for service http 2010.03.19 09:58:27 LOG5[5864:4032]: Configuration successful 2010.03.19 09:58:27 LOG5[5864:4032]: No limit detected for the number of clients 2010.03.19 09:58:27 LOG7[5864:4032]: FD=176 in non-blocking mode 2010.03.19 09:58:27 LOG7[5864:4032]: Option SO_REUSEADDR set on accept socket 2010.03.19 09:58:27 LOG7[5864:4032]: Service http bound to 0.0.0.0:8090 2010.03.19 09:58:27 LOG7[5864:4032]: Service http opened FD=176 2010.03.19 09:58:27 LOG5[5864:4032]: stunnel 4.31 on x86-pc-mingw32-gnu with OpenSSL 0.9.8l 5 Nov 2009 2010.03.19 09:58:27 LOG5[5864:4032]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2010.03.19 09:59:42 LOG7[5864:3864]: Service http accepted FD=440 from 127.0.0.1:49886 2010.03.19 09:59:42 LOG7[5864:3864]: Creating a new thread 2010.03.19 09:59:42 LOG7[5864:3864]: New thread created 2010.03.19 09:59:42 LOG7[5864:4328]: Service http started 2010.03.19 09:59:42 LOG7[5864:4328]: FD=440 in non-blocking mode 2010.03.19 09:59:42 LOG7[5864:4328]: Option TCP_NODELAY set on local socket 2010.03.19 09:59:42 LOG5[5864:4328]: Service http accepted connection from 127.0.0.1:49886 2010.03.19 09:59:42 LOG7[5864:4328]: FD=460 in non-blocking mode 2010.03.19 09:59:42 LOG6[5864:4328]: connect_blocking: connecting 10.12.32.164:443 2010.03.19 09:59:42 LOG7[5864:4328]: connect_blocking: s_poll_wait 10.12.32.164:443: waiting 10 seconds 2010.03.19 09:59:42 LOG5[5864:4328]: connect_blocking: connected 10.12.32.164:443 2010.03.19 09:59:42 LOG5[5864:4328]: Service http connected remote server from 10.12.47.109:49887 2010.03.19 09:59:42 LOG7[5864:4328]: Remote FD=460 initialized 2010.03.19 09:59:42 LOG7[5864:4328]: Option TCP_NODELAY set on remote socket 2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): before/connect initialization 2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): SSLv3 write client hello A 2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): SSLv3 read server hello A 2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): SSLv3 read server certificate A 2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): SSLv3 read server done A 2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): SSLv3 write client key exchange A 2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): SSLv3 write change cipher spec A 2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): SSLv3 write finished A 2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): SSLv3 flush data 2010.03.19 09:59:42 LOG7[5864:4328]: SSL state (connect): SSLv3 read finished A 2010.03.19 09:59:42 LOG7[5864:4328]: 1 items in the session cache 2010.03.19 09:59:42 LOG7[5864:4328]: 1 client connects (SSL_connect()) 2010.03.19 09:59:42 LOG7[5864:4328]: 1 client connects that finished 2010.03.19 09:59:42 LOG7[5864:4328]: 0 client renegotiations requested 2010.03.19 09:59:42 LOG7[5864:4328]: 0 server connects (SSL_accept()) 2010.03.19 09:59:42 LOG7[5864:4328]: 0 server connects that finished 2010.03.19 09:59:42 LOG7[5864:4328]: 0 server renegotiations requested 2010.03.19 09:59:42 LOG7[5864:4328]: 0 session cache hits 2010.03.19 09:59:42 LOG7[5864:4328]: 0 external session cache hits 2010.03.19 09:59:42 LOG7[5864:4328]: 0 session cache misses 2010.03.19 09:59:42 LOG7[5864:4328]: 0 session cache timeouts 2010.03.19 09:59:42 LOG6[5864:4328]: SSL connected: new session negotiated 2010.03.19 09:59:42 LOG6[5864:4328]: Negotiated ciphers: RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 2010.03.19 10:01:54 LOG3[5864:4328]: SSL_read: Connection reset by peer (WSAECONNRESET) (10054) 2010.03.19 10:01:54 LOG5[5864:4328]: Connection reset: 568 bytes sent to SSL, 0 bytes sent to socket 2010.03.19 10:01:54 LOG7[5864:4328]: Service http finished (0 left) 2010.03.19 10:03:28 LOG7[5864:3864]: Service http accepted FD=476 from 127.0.0.1:50155 2010.03.19 10:03:28 LOG7[5864:3864]: Creating a new thread 2010.03.19 10:03:28 LOG7[5864:3864]: New thread created 2010.03.19 10:03:28 LOG7[5864:1216]: Service http started 2010.03.19 10:03:28 LOG7[5864:1216]: FD=476 in non-blocking mode 2010.03.19 10:03:28 LOG7[5864:1216]: Option TCP_NODELAY set on local socket 2010.03.19 10:03:28 LOG5[5864:1216]: Service http accepted connection from 127.0.0.1:50155 2010.03.19 10:03:28 LOG7[5864:1216]: FD=440 in non-blocking mode 2010.03.19 10:03:28 LOG6[5864:1216]: connect_blocking: connecting 10.12.32.164:443 2010.03.19 10:03:28 LOG7[5864:1216]: connect_blocking: s_poll_wait 10.12.32.164:443: waiting 10 seconds 2010.03.19 10:03:28 LOG5[5864:1216]: connect_blocking: connected 10.12.32.164:443 2010.03.19 10:03:28 LOG5[5864:1216]: Service http connected remote server from 10.12.47.109:50156 2010.03.19 10:03:28 LOG7[5864:1216]: Remote FD=440 initialized 2010.03.19 10:03:28 LOG7[5864:1216]: Option TCP_NODELAY set on remote socket 2010.03.19 10:03:28 LOG7[5864:1216]: SSL state (connect): before/connect initialization 2010.03.19 10:03:28 LOG7[5864:1216]: SSL state (connect): SSLv3 write client hello A 2010.03.19 10:03:28 LOG7[5864:1216]: SSL state (connect): SSLv3 read server hello A 2010.03.19 10:03:28 LOG7[5864:1216]: SSL state (connect): SSLv3 read finished A 2010.03.19 10:03:28 LOG7[5864:1216]: SSL state (connect): SSLv3 write change cipher spec A 2010.03.19 10:03:28 LOG7[5864:1216]: SSL state (connect): SSLv3 write finished A 2010.03.19 10:03:28 LOG7[5864:1216]: SSL state (connect): SSLv3 flush data 2010.03.19 10:03:28 LOG7[5864:1216]: 1 items in the session cache 2010.03.19 10:03:28 LOG7[5864:1216]: 2 client connects (SSL_connect()) 2010.03.19 10:03:28 LOG7[5864:1216]: 2 client connects that finished 2010.03.19 10:03:28 LOG7[5864:1216]: 0 client renegotiations requested 2010.03.19 10:03:28 LOG7[5864:1216]: 0 server connects (SSL_accept()) 2010.03.19 10:03:28 LOG7[5864:1216]: 0 server connects that finished 2010.03.19 10:03:29 LOG7[5864:1216]: 0 server renegotiations requested 2010.03.19 10:03:29 LOG7[5864:1216]: 1 session cache hits 2010.03.19 10:03:29 LOG7[5864:1216]: 0 external session cache hits 2010.03.19 10:03:29 LOG7[5864:1216]: 0 session cache misses 2010.03.19 10:03:29 LOG7[5864:1216]: 0 session cache timeouts 2010.03.19 10:03:29 LOG6[5864:1216]: SSL connected: previous session reused 2010.03.19 10:04:28 LOG7[5864:1216]: Socket closed on read 2010.03.19 10:04:28 LOG7[5864:1216]: SSL write shutdown 2010.03.19 10:04:28 LOG7[5864:1216]: SSL alert (write): warning: close notify 2010.03.19 10:04:28 LOG6[5864:1216]: SSL_shutdown successfully sent close_notify 2010.03.19 10:04:28 LOG6[5864:1216]: s_poll_wait timeout: connection close 2010.03.19 10:04:28 LOG5[5864:1216]: Connection closed: 1541 bytes sent to SSL, 25 bytes sent to socket 2010.03.19 10:04:28 LOG7[5864:1216]: Service http finished (0 left) Any hints would be appreciated!

1 0

How to have multiple HTTPS connection with different PEM file
by Andrew Culross 18 Mar '10

18 Mar '10

We are running sTunnel 4.2 and want to have two HTTPS connection that use different PEM certs and are having difficulty doing this - how do you set this up? We have something like ---- Cert = cert1.pem [https] connect = xxx.xxx.xxx.xxx:442 connect = yyy.yyy.yyy.yyy:443 accept = 9876 ------ and we need something like this? -------- [https] connect = xxx.xxx.xxx.xxx:442 cert = cert1.pem accept = 9876 [https] connect = yyy.yyy.yyy.yyy:443 cert = cert2.pem accept = 9877 ----- Can we do that in the config file? If not, how does one specify ? Thanks! Andrew Culross TwoFour Systems 445 Hamilton Ave White Plains, NY 10601 Direct +1 (914) 220-8849 Main +1 (914) 220-8800 Fax +1 (914) 220-8899 <http://www.twofour.com/> www.TwoFour.com <http://www.twofour.com/emaildisclaimer.aspx> http://www.twofour.com/emaildisclaimer.aspx

2 1

Stunnel server with access from Firefox
by Ricky I 15 Mar '10

15 Mar '10

Hi, I am trying to use Stunnel to provide HTTPS access to a web site (my router configurations). That is, stunnel is used to accept HTTPS connection and it forwards the request using HTTP to the web site. The problem seems to be that one connection is opened and it performs an HTTP GET. Afterwards Stunnel does not accept any more connections and I have to restart. I'm not sure what I'm doing wrong. The strange thing I notice is that service router is finished with -1. What does minus one mean? I am using Firefox as the client. What I see is that Firefox is trying to load the page. Using wireshark, I was able to see that all the HTML data from the web page was loaded but Firefox was having trouble performing HTTP GET for the images on the site. I need to restart Stunnel in order to have another connection open. This is confirmed where I made a test by restarting Stunnel and then I tried to just load images from the Web site: e.g. https://192.168.1.88:8880/image1.jpg and https://192.168.1.88:8880/image2.jpg. I get image1.jpg but Firefox can't access image2.jpg, unless I restart then get image2. Here's the logs showing that I am able to make one access to the site. 2010.03.16 00:47:41 LOG5[3266:1024]: stunnel 4.31 on armv5tejl-unknown-linux-gnu with OpenSSL 0.9.8k 25 Mar 2009 2010.03.16 00:47:41 LOG5[3266:1024]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 2010.03.16 00:47:41 LOG7[3266:1024]: Cleaning up the signal pipe 2010.03.16 00:47:41 LOG7[3266:1024]: Signal pipe is empty 2010.03.16 00:47:46 LOG7[3266:1024]: Service router accepted FD=0 from 192.168.1.80:2821 2010.03.16 00:47:46 LOG7[3268:1026]: Service router started 2010.03.16 00:47:46 LOG7[3268:1026]: FD=0 in non-blocking mode 2010.03.16 00:47:46 LOG7[3268:1026]: Option TCP_NODELAY set on local socket 2010.03.16 00:47:46 LOG5[3268:1026]: Service router accepted connection from 192.168.1.80:2821 2010.03.16 00:47:46 LOG7[3268:1026]: SSL state (accept): before/accept initialization 2010.03.16 00:47:46 LOG7[3268:1026]: SSL state (accept): SSLv3 read client hello A 2010.03.16 00:47:46 LOG7[3268:1026]: SSL state (accept): SSLv3 write server hello A 2010.03.16 00:47:46 LOG7[3268:1026]: SSL state (accept): SSLv3 write certificate A 2010.03.16 00:47:46 LOG7[3268:1026]: SSL state (accept): SSLv3 write server done A 2010.03.16 00:47:46 LOG7[3268:1026]: SSL state (accept): SSLv3 flush data 2010.03.16 00:47:46 LOG7[3268:1026]: SSL state (accept): SSLv3 read client key exchange A 2010.03.16 00:47:46 LOG7[3268:1026]: SSL state (accept): SSLv3 read finished A 2010.03.16 00:47:46 LOG7[3268:1026]: SSL state (accept): SSLv3 write change cipher spec A 2010.03.16 00:47:46 LOG7[3268:1026]: SSL state (accept): SSLv3 write finished A 2010.03.16 00:47:46 LOG7[3268:1026]: SSL state (accept): SSLv3 flush data 2010.03.16 00:47:46 LOG7[3268:1026]: 1 items in the session cache 2010.03.16 00:47:46 LOG7[3268:1026]: 0 client connects (SSL_connect()) 2010.03.16 00:47:46 LOG7[3268:1026]: 0 client connects that finished 2010.03.16 00:47:46 LOG7[3268:1026]: 0 client renegotiations requested 2010.03.16 00:47:46 LOG7[3268:1026]: 1 server connects (SSL_accept()) 2010.03.16 00:47:46 LOG7[3268:1026]: 1 server connects that finished 2010.03.16 00:47:46 LOG7[3268:1026]: 0 server renegotiations requested 2010.03.16 00:47:46 LOG7[3268:1026]: 0 session cache hits 2010.03.16 00:47:46 LOG7[3268:1026]: 0 external session cache hits 2010.03.16 00:47:46 LOG7[3268:1026]: 1 session cache misses 2010.03.16 00:47:46 LOG7[3268:1026]: 0 session cache timeouts 2010.03.16 00:47:46 LOG6[3268:1026]: SSL accepted: new session negotiated 2010.03.16 00:47:46 LOG6[3268:1026]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2010.03.16 00:47:46 LOG7[3268:1026]: FD=9 in non-blocking mode 2010.03.16 00:47:46 LOG6[3268:1026]: connect_blocking: connecting 192.168.1.1:80 2010.03.16 00:47:46 LOG7[3268:1026]: connect_blocking: s_poll_wait 192.168.1.1:80: waiting 10 seconds 2010.03.16 00:47:46 LOG5[3268:1026]: connect_blocking: connected 192.168.1.1:80 2010.03.16 00:47:46 LOG5[3268:1026]: Service router connected remote server from 192.168.1.88:1133 2010.03.16 00:47:46 LOG7[3268:1026]: Remote FD=9 initialized 2010.03.16 00:47:46 LOG7[3268:1026]: Option TCP_NODELAY set on remote socket 2010.03.16 00:47:46 LOG7[3268:1026]: Socket closed on read 2010.03.16 00:47:46 LOG7[3268:1026]: SSL write shutdown 2010.03.16 00:47:46 LOG7[3268:1026]: SSL alert (write): warning: close notify 2010.03.16 00:47:46 LOG6[3268:1026]: SSL_shutdown successfully sent close_notify 2010.03.16 00:47:46 LOG6[3268:1026]: s_poll_wait timeout: connection close 2010.03.16 00:47:46 LOG5[3268:1026]: Connection closed: 4675 bytes sent to SSL, 445 bytes sent to socket 2010.03.16 00:47:46 LOG7[3268:1026]: Service router finished (-1 left) ============ Finally here's my stunnel.conf: cert = /mnt/HD_a2/ffp/etc/stunnel/stunnel.pem sslVersion = SSLv3 pid = /stunnel.pid ; performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; debugging stuff (may useful for troubleshooting) debug = 7 output = /ffp/etc/stunnel/stunnel.log ; service-level configuration [router] accept = 8880 connect = 192.168.1.1:80 TIMEOUTclose = 0 Thank you very much for any help you can provide. Rick _________________________________________________________________ Check your Hotmail from your phone. http://go.microsoft.com/?linkid=9712957

1 0

DSA server certificate
by Carl 15 Mar '10

15 Mar '10

Hi, Does stunnel support server certificate with a DSA private key? When I try to use a self generated one, stunnel responds with: error stack: 140B3009 : error:140B3009:SSL routines:SSL_CTX_use_RSAPrivateKey_file:PEM lib SSL_CTX_use_RSAPrivateKey_file: 607907F: error:0607907F:digital envelope routines:EVP_PKEY_get1_RSA:expecting an rsa key Is this bug report relevant? http://www.mail-archive.com/[email protected]/msg43770.ht… Thanks, Carl

1 0

How do you configure Stunnel Ver 4.31 for TLSv1 - More Info
by David M. Douglass 11 Mar '10

11 Mar '10

Reference: Stunnel Ver 4.31 Windows Binaries This is the actual configuration file I am using. There is not too much to it. As shown below, this WORKS for Gmail's SSL port.. Port 465. Notice that the sslVersion statement is remarked "out". +++++++++++++++++++++++++++ output = STUNNEL.log taskbar = NO cert = stunnel.pem client = yes [SSMTP] accept=DADSXPPRO:8025 connect=smtp.gmail.com:465 ;sslVersion = TLSv1 ++++++++++++++++++++++++++++ In theory (as I have read it...), to change this to TLS, I enable the sslVersion line, And change the port (for Gmail) to 587. Port 587 and TLS for Gmail have been tested and verified via Microsoft Outlook testing. But when I do so, I cannot even log onto the Gmail server. I get the error message referenced in the first message: 2010.02.25 10:35:44 LOG3[2696:2740]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number It occurs to me that I am only using the "stunnel.pem" file, as supplied by the installer program. Do I have a certificate issue? David M. Douglass david(a)az-douglass.net Home (480) 839-2629 Cell (602) 908-9092

4 5

Problem with openssl engine
by Nick Sayer 27 Feb '10

27 Feb '10

I'm trying to use a smart card to hold on to the private key for my server. Since access to the smart card is restricted to one process at a time (not sure why it can't be shared, but that's a whole separate discussion), I'd like to use stunnel as the machine-wide SSL proxy. The problem is that with the pkcs11 engine configuration set up, it fails. 2010.02.27 00:15:03 LOG5[91580:0]: imaps accepted connection from 71.141.64.2:32934 2010.02.27 00:15:03 LOG7[91580:0]: SSL state (accept): before/accept initialization 2010.02.27 00:15:03 LOG7[91580:0]: SSL state (accept): SSLv3 read client hello A 2010.02.27 00:15:03 LOG7[91580:0]: SSL state (accept): SSLv3 write server hello A 2010.02.27 00:15:03 LOG7[91580:0]: SSL state (accept): SSLv3 write certificate A 2010.02.27 00:15:03 LOG7[91580:0]: SSL state (accept): SSLv3 write server done A 2010.02.27 00:15:03 LOG7[91580:0]: SSL state (accept): SSLv3 flush data 2010.02.27 00:15:03 LOG7[91580:0]: SSL state (accept): SSLv3 read client key exchange A 2010.02.27 00:15:03 LOG7[91580:0]: SSL alert (write): fatal: bad record mac 2010.02.27 00:15:03 LOG3[91580:0]: SSL_accept: 1408F119: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2010.02.27 00:15:03 LOG5[91580:0]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2010.02.27 00:15:03 LOG7[91576:0]: Cleaning up the signal pipe 2010.02.27 00:15:03 LOG7[91576:0]: Process 91580 finished with code 0 (0 left) ^C2010.02.27 00:15:42 LOG3[91576:0]: Received signal 2; terminating This happens *whether or not* I use the private key on the smart card itself. If I load the private key from a disk file, it still happens - even if there is no engineNum statement in the service configuration block. The only way to make it not happen is to comment out the engineCtrl lines. engine=dynamic engineCtrl=SO_PATH:/usr/local/lib/engines/engine_pkcs11.so engineCtrl=ID:pkcs11 engineCtrl=LIST_ADD:1 engineCtrl=LOAD engineCtrl=MODULE_PATH:/usr/local/lib/pkcs11/opensc-pkcs11.so engineCtrl=INIT engineCtrl=PIN:12345678 [imaps] accept = 4993 connect = 143 engineNum = 1 key = id_10 ;cert = id_10 cert = /www.crt It's also worth noting that stunnel seems unable to pull the cert out of the card - that cert=id_10 line should work (works with openssl s_server). This stunnel was compiled last night from the FreeBSD ports tree with WITH_STUNNEL_SSL_ENGINE turned on. stunnel 4.29 on i386-portbld-freebsd8.0 with OpenSSL 0.9.8k 25 Mar 2009 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Global options debug = 5 pid = /var/tmp/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none Note that the same card in the same system can successfully provide ssl server sockets with Java using the Sun PKCS11 JCE provider configured to talk to the opensc PKCS11 module. So there's nothing wrong with the card.

1 0

stunnel-4.15-2.el5.1 zombie when xinetd
by tatiana philippova 25 Feb '10

25 Feb '10

Hi All, I have a problem with stunnel in xinetd mode. It cannot connect to specified localhost:port - always getting child stunnel defunct as a result.. 4789 ? Ss 0:00 \_ stunnel /etc/stunnel/stunnel.conf 4790 ? Z 0:00 \_ [stunnel] <defunct> I'm trying use rsync via stunnel (!ssh for rsync does not suits me in this particular case, but I need encrypt backup traffic anyway.. so have chosen stunnel) client config: cert = /etc/stunnel/stunnel_client_cert.pem client = yes pid = /var/run/stunnel.pid debug = 7 output = /var/log/stunnel.log sslVersion = SSLv2 [ssync] accept = 873 connect = myhost.somewhere.net:273 server config: cert = /etc/stunnel/certs/host.pem key = /etc/stunnel/certs/private/cakey.pem client = no pid = /var/run/stunnel.pid debug = 7 #foreground = yes output = /var/log/stunel.log connect = 873 xinetd config: # default: off # description: SSL wrapper for rsyncd service ssync { disable = no socket_type = stream wait = no user = root server = /usr/sbin/stunnel server_args = /etc/stunnel/stunnel.conf log_on_success += HOST DURATION log_on_failure += HOST only_from = 192.168.5.15 127.0.0.1 } on server side /etc/services: ssync 273/tcp # rsync over stunnel # ps axf | grep rsyn 15637 ? S 0:00 /usr/bin/rsync -4 --daemon --no-detach # netstat -an --program | grep 273 tcp 0 0 0.0.0.0:273 0.0.0.0:* LISTEN 4751/xinetd # netstat -an --program | grep 873 tcp 0 0 127.0.0.1:873 0.0.0.0:* LISTEN 15637/rsync In case of server stunnel running as standalone - everything works perfectly well, but I need it working as xinetd service rather than standalone Could somebody kindly advise what I'm doing wrong? soft on server side: stunnel-4.15-2.el5.1, openssl-0.9.8e-7.el5 OS CentOS release 5.3 (Final), kernel 2.6.18-128.1.6.el5 on client side: stunnel-4.30-1.i386.rpm (compiled as rpmbuild -ta stunnel-4.30.tar.gz) openssl-0.9.8g-9.14.fc9.i686 OS Fedora release 9 (Sulphur) kernel 2.6.28 Many thanks in advance Taphy

1 0

How do you configure Stunnel Ver 4.31 for TLSv1
by David M. Douglass 25 Feb '10

25 Feb '10

I am using the Windows Binary of Version 4.31, and an external email utility that sends SMTP outgoing email. I can configure for specific ports (no problem). and I can send SSMTP SSLv3 with success. That is GOOD ! I am trying to configure Stunnel for sending TLSv1 without success. I understand (via the Version command and screen) that Stunnel defaults to SSLv3. How do I change that to TLSv1 ?? I found the parameter : sslVersion = version select version of SSL protocol Allowed options: all, SSLv2, SSLv3, TLSv1 This appears to be a "SERVICE LEVEL" option, and I have tried to use the line: sslVersion = TLSv1 in the [SSMTP] group of options (along with accept = and connect = ), but get an error message in the log file, which is shown next: 2010.02.25 10:35:44 LOG3[2696:2740]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number I have also tried to put the sslVersion = line in the general configuration area, but generate the same error message. The outbound email does, in fact, fail. Can anyone suggest what I am doing wrong ?? Or offer a solution for configuring Stunnel (V4.31) for TLSv1 ?? David M. Douglass david(a)az-douglass.net Home (480) 839-2629 Cell (602) 908-9092

1 0

How to use stunnel
by Gabriel kamega 24 Feb '10

24 Feb '10

Hello sir, Thank you for my subscription. This is the issue: I want to sent automaticly email via smtp.gmail.com server, And I think I need stunnel program. My questions are : *How to use stunnel ?* ; *How to configure the stunnel.conf file ?* I have dowloaded stunnel.exe version 431, but I can't download the * stunnel.pem* file. on the net I see that I have to install with this command : stunnel -install is that all ? on WXP Professionnel SP2 Regards merci

1 0

Access control/TCP wrappers
by Craig Watkinson 23 Feb '10

23 Feb '10

Hi, We're using stunnel to provide a secure interface to an old server that doesn't support HTTPS natively. I'd like to implement some access control so that connections are only supported from specific IP addresses. I am using v4.27 of stunnel that I downloaded from HPs website, and am running it from inittab to ensure it is always running. Unfortunately I don't think it's compiled with libwrap. Should I see libwrap listed when I run ldd against the binary (see below for output)? I think it's possible to run stunnel from inetd. Could I wrapper it here? Is the following entry correct? stunnel stream tcp nowait root /usr/lbin/tcpd /opt/iexpress/stunnel/bin/stunnel stunnel I think this would work, but I'm concerned that if stunnel was to crash or be killed that there would be nothing restarting it if we ran it from inetd. Any advice much appreciated Craig ------------------------------------- # ./stunnel -version stunnel 4.27 on ia64-hp-hpux11.23 with OpenSSL 0.9.7m 23 Feb 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Global options debug = 5 pid = /opt/iexpress/stunnel/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /opt/iexpress/stunnel/etc/stunnel/stunnel.pem ciphers = ALL:!aNULL:!eNULL+RC4:@STRENGTH key = /opt/iexpress/stunnel/etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none # ldd ./stunnel libdl.so.1 => /usr/lib/hpux32/libdl.so.1 libnsl.so.1 => /usr/lib/hpux32/libnsl.so.1 libpthread.so.1 => /usr/lib/hpux32/libpthread.so.1 libunwind.so.1 => /usr/lib/hpux32/libunwind.so.1 libc.so.1 => /usr/lib/hpux32/libc.so.1 libxti.so.1 => /usr/lib/hpux32/libxti.so.1 libuca.so.1 => /usr/lib/hpux32/libuca.so.1 libdl.so.1 => /usr/lib/hpux32/libdl.so.1 _________________________________________________________________ Do you have a story that started on Hotmail? Tell us now http://clk.atdmt.com/UKM/go/195013117/direct/01/

2 2

4.26 and commercial certificate - Now working.
by Editor (Kevin) 19 Feb '10

19 Feb '10

Hi: Thanks. Everything is working now. > Message: 1 > Date: Wed, 17 Feb 2010 07:11:16 -0800 (PST) > From: Leandro Avila <leandro.avila(a)ymail.com> > Subject: Re: [stunnel-users] Small challenge with version 4.26 and a > commercial certificate > To: stunnel-users(a)mirt.net > Message-ID: <544640.49520.qm(a)web111011.mail.gq1.yahoo.com> > Content-Type: text/plain; charset=us-ascii > > Hi Kevin, > > I think there is ambiguous information about this. > The man page states that the private key should be unencrypted > However, the changelog states that the support for pass phrases was fixed in v4.20 > > I'll do some testing see what I can find. Or maybe someone can shed some light on the issue. > > Best regards > > ----------------- > Leandro Avila

1 0

Re: [stunnel-users] Make reports an error on Aix with stunnel-4.30
by Michal Trojnara 19 Feb '10

19 Feb '10

Derek Nicholls wrote: > gcc -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith > -I/opt/freeware/include -o stunnel file.o client.o log.o options.o > protocol.o network.o resolver.o ssl.o ctx.o verify.o sthreads.o stunnel.o > pty.o libwrap.o -lz -ldl -L/opt/freeware/lib -lssl -lcrypto > ld: 0711-317 ERROR: Undefined symbol: .SSL_CTX_set_info_callback > ld: 0711-317 ERROR: Undefined symbol: .SSL_CTX_sess_set_new_cb > ld: 0711-317 ERROR: Undefined symbol: .SSL_CTX_sess_set_get_cb > ld: 0711-317 ERROR: Undefined symbol: .SSL_CTX_sess_set_remove_cb > ld: 0711-317 ERROR: Undefined symbol: .BIO_set_flags > ld: 0711-345 Use the -bloadmap or -bnoquiet option to obtain more > information. > collect2: ld returned 8 exit status > make: 1254-004 The error code from the last command is 1. What it means is that the linker has found on its path another version of libssl, older than your headers in /opt/freeware/include. Mike

1 0

Cert Chain Question
by Craig Kelley 18 Feb '10

18 Feb '10

I've been attempting to include an intermediate chain for my stunnel setup. First, I previously used an entrust-signed certificate with stunnel just fine, but now I've purchased one from godaddy ($190 for 3 certs for 5 years!). The only problem is that the server has multiple certificates to install. Under Apache, I solved it with this: SSLCertificateFile /etc/httpd/conf/ssl.crt/server.crt SSLCertificateKeyFile /etc/httpd/conf/ssl.key/server.key SSLCertificateChainFile /etc/httpd/conf/ssl.crt/godaddy.crt Which works just fine. With stunnel I attempted this configuration: cert = /etc/stunnel/server.crt key = /etc/stunnel/server.key CAfile = /etc/stunnel/godaddy.crt All those files are identical to the Apache configuration. Stunnel starts up, but clients loudly complain that the certificate is not valid. If I examine the certificate in Thunderbird (I use stunnel for IMAPS and POP3S), it correctly identifies the cert as being from GoDaddy and that it will expire in 2015. But for some reason, the chain to its root server is broken. What am I doing wrong? -- Craig Kelley http://inconnu.islug.org/~ink finger same server for PGP block

2 2

Small challenge with version 4.26 and a commercial certificate
by editor 17 Feb '10

17 Feb '10

Hi: I decided to spend the money and get a commercial certificate from Thawte. It was not a bad price. I have installed in the Sun host and while it works perfectly for Apache but I can not get the file to work for stunnel. The idea is to allow mobile users to access their mail without annoying certificate warnings. This is what happens: # /usr/local/bin/stunnel & [1] 13704 # Enter PEM pass phrase: 2010.02.14 05:32:46 LOG7[13704:1]: Snagged 64 random bytes from /export/home/kgreene/.rnd 2010.02.14 05:32:46 LOG7[13704:1]: Wrote 1024 new random bytes to /export/home/kgreene/.rnd 2010.02.14 05:32:46 LOG7[13704:1]: RAND_status claims sufficient entropy for the PRNG 2010.02.14 05:32:46 LOG7[13704:1]: PRNG seeded successfully 2010.02.14 05:32:46 LOG7[13704:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2010.02.14 05:32:46 LOG7[13704:1]: Certificate loaded 2010.02.14 05:32:46 LOG7[13704:1]: Key file: /usr/local/etc/stunnel/stunnel.pem 2010.02.14 05:32:46 LOG3[13704:1]: error stack: 140B3009 : error:140B3009:SSL routines:SSL_CTX_use_RSAPrivateKey_file:PEM lib 2010.02.14 05:32:46 LOG3[13704:1]: error stack: 906A068 : error:0906A068:PEM routines:PEM_do_header:bad password read 2010.02.14 05:32:46 LOG3[13704:1]: SSL_CTX_use_RSAPrivateKey_file: 906406D: error:0906406D:PEM routines:PEM_def_callback:problems getting password [1]+ Exit 1 /usr/local/bin/stunnel # It never pauses to let me enter the PEM pass phase. As in instructed in the man pages, I created the pem file by merging the private key and the certificate from Thawte. This is the version statement: # /usr/local/bin/stunnel -version stunnel 4.26 on sparc-sun-solaris2.9 with OpenSSL 0.9.8l 5 Nov 2009 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none ------------------------------- Any ideas would be great. Thanks. Kevin

3 2

nessus crashes stunnel
by Roger Cruz 12 Feb '10

12 Feb '10

We ran Nessus on a Linux system and found that stunnel crashes when the weak certificate suite is enabled. GDB shows the stack trace below and it appears to be in the SSL library. My search on this mailing list led me to this message that appears to report a similar problem http://mirt.net/pipermail/stunnel-users/2008-January/001830.html Am I to understand that the problem is really with OpenSSL and that's what needs to be upgraded? If so, do we know what version will have the fixed problem? I'm going to post in the OpenSSL forum as well, but I wanted to start here since from our perspective, Stunnel is the one crashing. Thank you Roger Cruz 2010.02.05 12:49:11 LOG7[13524:3086718672]: Cleaning up the signal pipe 2010.02.05 12:49:11 LOG6[13524:3086718672]: Child process 13575 finished with code 0 Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0xb7fa7b90 (LWP 13574)] 0x007b24a7 in krb5_is_referral_realm () from /usr/lib/libkrb5.so.3 (gdb) bt #0 0x007b24a7 in krb5_is_referral_realm () from /usr/lib/libkrb5.so.3 #1 0x0089d338 in kssl_keytab_is_available () from /lib/libssl.so.6 #2 0x008803b1 in ssl3_choose_cipher () from /lib/libssl.so.6 #3 0x0087b2a2 in ssl3_get_client_hello () from /lib/libssl.so.6 #4 0x0087bc85 in ssl3_accept () from /lib/libssl.so.6 #5 0x0089109a in SSL_accept () from /lib/libssl.so.6 #6 0x00884d0d in ssl23_get_client_hello () from /lib/libssl.so.6 #7 0x0088554b in ssl23_accept () from /lib/libssl.so.6 #8 0x0089109a in SSL_accept () from /lib/libssl.so.6 #9 0x003628e2 in ?? () from /usr/sbin/stunnel #10 0x00363acd in ?? () from /usr/sbin/stunnel #11 0x003645ba in ?? () from /usr/sbin/stunnel #12 0x003646a8 in client () from /usr/sbin/stunnel #13 0x0025f45b in start_thread () from /lib/libpthread.so.0 #14 0x00448e5e in clone () from /lib/libc.so.6 (gdb) quit [root@p20xen1 current_hq]# stunnel -version stunnel 4.15 on i686-redhat-linux-gnu with OpenSSL 0.9.8b 04 May 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none

1 0

using ECDH with stunnel
by Carl 11 Feb '10

11 Feb '10

Is is possible to use ECDH with stunnel? When using s_server and specifying the cipher I can establish a connection. But when using stunnel and specifing the same cipher, the connection is rejected with "no shared cipher". e.g. openssl s_server -cert server.pem -cipher DHE-RSA-AES256-SHA It appears the difference is that s_server uses "default temp ECDH parameters" while stunnel doesn't have a default nor is there a way to specify the ECDH parameters. >From what I understand the ECDH parameters cannot be included with the certificate, unlike DH parameters. Is my understanding correct? Thanks, Carl

2 2

SSL connection through Proxy server with authentication
by Girish Kolari 09 Feb '10

09 Feb '10

Hi I am trying to create a SSL connection through Proxy server with authentication. my stunnel.conf file ----- part of the conf file connect = <Proxy server IP: Port number> protocol=connect protocolHost=<Destination server:Port number> protocolUsername = useme protocolPassword = test ----- but it fails to establish connection. Log details: ----- part of log generated 2010.02.09 16:07:49 LOG5[14506:2952859648]: Negotiations for connect (client side) started 2010.02.09 16:07:49 LOG7[14506:2952859648]: -> CONNECT <Destination server:Port number> HTTP/1.1 2010.02.09 16:07:49 LOG7[14506:2952859648]: -> Host: 6<Destination server:Port number> 2010.02.09 16:07:49 LOG7[14506:2952859648]: -> Proxy-Authorization: basic dXNlbWU6dGVzdA== 2010.02.09 16:07:49 LOG7[14506:2952859648]: -> 2010.02.09 16:07:49 LOG3[14506:2952859648]: Unexpected socket close (fdgetline) 2010.02.09 16:07:49 LOG5[14506:2952859648]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2010.02.09 16:07:49 LOG7[14506:2952859648]: Service IDrive finished (0 left) ----- I tried with proxy server without authentication it works great, but not sure why Proxy server with authentication is not working. Is it I am missing some thing or am I doing something wrong? I appreciate all suggestion and help on this. Thanks & Regards Girish Kolari

1 0

Stunnel and multiple endpoints.
by Richard Harvey 08 Feb '10

08 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi guys, I'm new to stunnel and I'm looking for a way to run stunnel on a single port. Then based on the client certificate, proxy that connection (in clear) to a different IP:port. If this something I can do with stunnel or am i barking up the wrong tree so to speak. Any help would be a appreciated guys. Cheers Ric - -- Richard Harvey European Linux Administrator Core Systems Ticketmaster +44 (0)207 9804328 80228 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAktv5ZIACgkQlh7dZJ0PyjcfxQCfWA5PO0d/uDf/Mqq2BrFsu5wf xBYAoKmKW8760P91JR3oeviKwjd/1o/A =o+/U -----END PGP SIGNATURE-----

3 5

Re: [stunnel-users] Memory problems
by Peter Griffin 05 Feb '10

05 Feb '10

A portion of the messages in /var/log/stunnel.log before I disabled logging as I thought it would help: 2010.02.04 22:46:28 LOG3[1615:140132721108752]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:46:32 LOG3[1615:140132721108752]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:46:55 LOG3[1615:140132734469904]: getpeerbyname: Transport endpoint is not connected (107) 2010.02.04 22:46:57 LOG3[1615:140132734400272]: SSL_read: Connection reset by peer (104) 2010.02.04 22:47:12 LOG3[1615:140132734261008]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:47:35 LOG3[1615:140132735235856]: SSL_read: Connection reset by peer (104) 2010.02.04 22:48:08 LOG3[1615:140132733982480]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:48:09 LOG3[1615:140132721108752]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:48:09 LOG3[1615:140132721108752]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:48:09 LOG3[1615:140132721108752]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:48:23 LOG3[1615:140132735235856]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:48:42 LOG3[1615:140132733982480]: transfer() loop executes not transferring any data 2010.02.04 22:48:42 LOG3[1615:140132733982480]: please report the problem to Michal.Trojnara(a)mirt.net 2010.02.04 22:48:42 LOG3[1615:140132733982480]: socket open: rd=yes wr=no, ssl open: rd=no wr=yes 2010.02.04 22:48:42 LOG3[1615:140132733982480]: socket ready: rd=no wr=no, ssl ready: rd=yes wr=no 2010.02.04 22:48:42 LOG3[1615:140132733982480]: wants: SSL_read rd=no wr=no, SSL_write rd=no wr=yes, SSL_shutdown rd=no wr=no 2010.02.04 22:48:42 LOG3[1615:140132733982480]: socket input buffer: 16384 byte(s), ssl input buffer: 0 byte(s) 2010.02.04 22:48:42 LOG3[1615:140132733982480]: check_SSL_pending=0 2010.02.04 22:48:52 LOG3[1615:140132734261008]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:48:56 LOG3[1615:140132734261008]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:01 LOG3[1615:140132734330640]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:03 LOG3[1615:140132734400272]: SSL socket closed on SSL_read with 7294 byte(s) in buffer 2010.02.04 22:49:05 LOG3[1615:140132734469904]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:16 LOG3[1615:140132721108752]: SSL socket closed on SSL_read with 16384 byte(s) in buffer 2010.02.04 22:49:26 LOG3[1615:140132733982480]: SSL socket closed on SSL_read with 16384 byte(s) in buffer 2010.02.04 22:49:28 LOG3[1615:140132733982480]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:29 LOG3[1615:140132733982480]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:29 LOG3[1615:140132733982480]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:29 LOG3[1615:140132733982480]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:29 LOG3[1615:140132733982480]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:34 LOG3[1615:140132733982480]: getpeerbyname: Transport endpoint is not connected (107) 2010.02.04 22:49:35 LOG3[1615:140132720899856]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:35 LOG3[1615:140132733982480]: SSL_accept: Peer suddenly disconnected

1 0

Does stunnel support IPv6, and proxying from IPv4 to IPv6?
by Jeff Schmidt 05 Feb '10

05 Feb '10

Hello, I was wondering, does stunnel have IPv6 support? If so, does such support extend to the point of allowing the 'local' side of the connection (e.g. from a server process, or from a client application) to be made with IPv4, while the 'global' side is IPv6? If so, is it possible to use stunnel in an unencrypting mode (that is, not encrypting the data with SSL, but just using stunnel to proxy traffic between IPv4 and IPv6)? The reason I ask is that I am looking for a solution to allow me to IPv6-enable 'legacy' IPv4 applications. When I started thinking about this problem, I almost immediately remembered using stunnel in the past to SSL-enable IPv4 applications which didn't have built-in SSL support, and it occured to me that there was a lot of similarity between the non-SSL application problem, and the non-IPv6 application problem - that is, it seems like possibly, you could setup a sort of IPv6 tunnel using stunnel (or something similar), where the legacy application makes an local IPv4 connection to the stunnel/proxy software, and the proxy then makes an IPv6 connection, just like stunnel accepts local IPv4 connections (unecrypted) and then creates a second, proxied connection which is encrypted. Does that make any sense? (I hope so). So, can stunnel be used with both IPv4 and IPv6 simultaneously?

1 0