- stunnel-users - stunnel.org

stunnel 5.19 release
by Michal Trojnara 16 Jun '15

16 Jun '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.19 of stunnel. The ChangeLog entry: Version 5.19, 2015.06.16, urgency: MEDIUM: * New features - OpenSSL DLLs updated to version 1.0.2c. - Added a runtime check whether COMP_zlib() method is implemented in order to improve compatibility with the Debian OpenSSL build. * Bugfixes - Improved socket error handling. - Cron thread priority on Win32 platform changed to THREAD_PRIORITY_LOWEST to improve portability. - Makefile bugfixes for stunnel 5.18 regressions. - Fixed some typos in docs and scripts (thx to Peter Pentchev). - Fixed a log level check condition (thx to Peter Pentchev). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 0b543242cf26649acfdd9f00de564c3e8de7ac2237d53935ffdc7eb24f4d556d stunnel-5.19.tar.gz 310fb015c3884dd19a1905ed84d5fbcd1579507c98ee2ba43955aa45311bc056 stunnel-5.19-installer.exe 990e636a869f4de8a55c43e7f2fa24ebbf81c1c221473106e8e6b5d89d720627 stunnel-5.19-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVgCeVAAoJEC78f/DUFuAUi98P/1cPUAg1ehgZkDXIxwIxTt/t sxYOWEmX/ajmimornRygim9HHGPB4HzDMFu1B1qCT01GE4uR+ogYZMYJAdZ+LRua J0wuDawuKgnJvWpdDGnX4Mfz/zUcV8L4T4iJvBnC8xXTQeto7+qU9YTmbYhms4xy u1CPpAXUHnwrNMkI5nqBtB8TSIEeHgmfS456/7oe9Kl+0F8hq7FkZ+1/IYxQOAPC 0drl8A8tfUroBiw+aI2aWJAq2gUoQFVpyAYi7IUBXnmGZ7H1CMcO+KpG+33L0glH oz5DxsuzHyYZYWD1NiKfre4QxMHrT9xXWoNQIHkwgEjDlQXTAqd5rhz9b13TjMmn hiHG3XtF+FvSwFJeTNk/yVYe8ZvjbXUS3BWS65HqTiRKx0iEtkkf2Z1VsieVMUGO LiWvxztz9Z4OSIUWxOFcC8WLTlIDTcIqMM79JLC33o22YSwIRqsE7u5mGiG6yZBN s78ILkqXauxQ1MSDXPArOIZr6iJIqHtuAJbnZvmAQwSKbks/gnzY4WAX0SAw9M64 hhbEnr+zsiRSq30uGrU7fxFHr4MynagEiNaAbNG2kQEJ4nSgHoY0W59dXAuVVYFM UtYgsEeMnPlaBij+ecgmk/xfpEZDQ/phaHtTKzTQUE3JWLkB/VsLz1gwZO1poH8e dOuvm5RULY29YlHcEoM+ =V456 -----END PGP SIGNATURE-----

1 0

Re: [stunnel-users] stunnel 5.18 may keep high CPU usage
by Dod 14 Jun '15

14 Jun '15

Hello Michal, MT> for developers, so don't worry if you don't understand all of the output. After 5 hours of 25% CPU I decided to stunnel (again) with debug=info 2015.06.14 19:15:10 LOG6[cron]: Executing cron jobs 2015.06.14 19:19:39 LOG5[cron]: DH parameters updated 2015.06.14 19:19:39 LOG6[cron]: Cron jobs completed in 269 seconds This time DH calculation ran for 4 minutes, which is the expected behavior. btw I am developer too so no problem with the log file ;-) regards. MT> -----BEGIN PGP SIGNED MESSAGE----- MT> Hash: SHA1 MT> Hi Dod, >> 2015.06.14 10:55:06 LOG5[cron]: DH parameters updated >> >> btw if there is some message to tell about DH calculation >> ended, shouldn't be one to say that DH calculation started ? >> this could be usefull. MT> I have added logging it while replying the previous email. 8-) >> Is there some interesting higher log level I could activate to >> get more (but not too much) logs that may help me to >> understand this strange behavior ? MT> Yes. Use "debug = info" or "debug = debug". The latter is intended MT> for developers, so don't worry if you don't understand all of the output. MT> Best regards, MT> Mike MT> -----BEGIN PGP SIGNATURE----- MT> Version: GnuPG v1 MT> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ MT> iQIcBAEBAgAGBQJVfasGAAoJEC78f/DUFuAU78MP/2WTHetqYubWkhEC9OykxVji MT> rTcps69fyE+904T/sSkRWoEiZFX2MFkQQuIwHsVuRdQecxhfqOGmj5R8xpDJQPBB MT> HsT/G/xgCRqCmWbO0HlQg2Tz5td9gsfIRJi9g1T8dHkImUXQUNC2gcqRowmMvcKx MT> Ly2YF8opHZZwA/p305hjuKM6+ziXn7eLdW0yp24LTfXxZigr0QiWvmMjtxhhJ7P0 MT> UgywVTKFBJ1/mJw1TXArOrk/sFiynooLLbYIEhS2rsyXo9m2UHCIRnbvwI9iXCuz MT> foiTPjFRtkWKSsKkcFXHIRpXD3WP07XjtaIzP2XyyK7JVFAsUQNhIBJBBUATJ18r MT> GtzyRIU/zHbmbL/jem9AJkyuw+eQ5E65QhA5eTI8fAKcceFmCq7Pu/HsN1Zk3enV MT> l6NbHSuY0eyvChQ44dzM4UyiNNMBFJczfmPbM5KdwbvLHHtxvbdlLH81HAe7TmVK MT> JuxHVYHZma9PZ/+19dhScl785Ae1TxoCRab9HeShhC6SFdPZ4HV4mZHleYMNCZvP MT> f7d75qDHQZYxZhunP9xqcsoHdhY1rTO0AWZC9TMER+0jbqCcpdEzMaD2L2F8glP2 MT> PUR2StD1EHlVlpzVZL63EJK0vi91dwI/AUiuoolhPkSRtxEwGUc+eNYKcBru8Ca+ MT> O+3Sq6GcWknVd6xu+fNs MT> =ucCs MT> -----END PGP SIGNATURE----- mailto:[email protected]

1 0

stunnel 5.18 release
by Michal Trojnara 12 Jun '15

12 Jun '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.18 of stunnel. The ChangeLog entry: Version 5.18, 2015.06.12, urgency: MEDIUM: * New features - OpenSSL DLLs updated to version 1.0.2b. https://www.openssl.org/news/secadv_20150611.txt - Added "include" configuration file option to include all configuration file parts located in a specified directory. - Log file is reopened every 24 hours. With "log = overwrite" this feature can be used to prevent filling up disk space. - Temporary DH parameters are refreshed every 24 hours, unless static DH parameters were provided in the certificate file. - Unique initial DH parameters are distributed with each release. - Warnings are logged on potentially insecure authentication. - Improved compatibility with the current OpenSSL 1.1.0-dev tree: removed RLE compression support, etc. - Updated stunnel.spec (thx to Bill Quayle). * Bugfixes - Fixed handling of dynamic connect targets. - Fixed handling of trailing whitespaces in the Content-Length header of the NTLM authentication. - Fixed --sysconfdir and --localstatedir handling (thx to Dagobert Michelsen). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 0532c0a2f8de3da1ab625e384146501ce5936fac63d01561c3a9bf652b692317 stunnel-5.18.tar.gz 9b9a64f30d4dc72f19a2f6482f5bcf76bb67cf3dd859bdd615e0345e1bb8dd41 stunnel-5.18-installer.exe a73befed476f423dee0ff25f38449570fb9f6a07ab90321d9c38e3962f833939 stunnel-5.18-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVeuE3AAoJEC78f/DUFuAU88wP/jfyOCsCBwCcIxNoQhEU5k4d mczXvWtaw0gBrOivrzgBZS0w621D66DGoXt6yMwMp1suWY9spTWZ+VjQJM8oFCul iFwYWyFyxiTOGRFXGCPEff8f4OGbGoxHfDaIrHR5AGvTzguznKTDXzM7cjixqWF9 vL/t08ZjoDWOZIVJuN8M9sVQWn7gzPnyJpvpW2D240aITBx348ZWt/QGqX4yOSzL tQCojXRO6W+rOq0WUdeDFp7CAMB7IZgZsZljqOUn4Q0wHgzuar0Kq1ZLQEkgoX5V lGJ99yZ74/H1RUDcVKGrdksX0atuf6SfzbTvZ/Osp0z7/NlWzhbCt6emYpSLxyzr 2IMX4T8Y593rDovT6AjOb2D4W0sJqAMfUMrs7+T43lYvEbQY8CoEBOH2St5h6X7Y 2ZIa1XMvMmaN08/QyUq6WqxEz0se9BPtUCC+oFjDlGw0oWrqKs1zzJAIpg0HHPOy j1NpBVPnuZz1WlTT/oGLIIVm6w8wATSKthIXstNtofXpSvJ1J94UntC3+0xga7KD SzaOm9w9kpDEtD0EwArLwak5cSevzdXQR4xfmU5OK/UohsdyTLBOab6iY3htmokk JOWIKZztATN7dq8YGvMfJvIiM1ij8Eg14wsahlwfwMZ+eGSvS5lTWvYsSirnnNFi XTrCfpnrKgrfLkUXhbtH =CdmE -----END PGP SIGNATURE-----

1 0

TLS version
by Deepak Subbanarasimha 11 Jun '15

11 Jun '15

Does Stunnel version 4.1 support sslVersion "TLSv1.2 " and above? If not, what version of stunnel supports "TLSv1.2" Thanks, DEEPAK SUBBANARASIMHA Kewill DDI: +00 (1) 978 482 2625 Email: deepak.subbanarasimha(a)kewill.com<mailto:[email protected]> www.kewill.com<http://www.kewill.com/> Tel: +00 (1) 978 482 2500 | Fax: +00 (1) 978 482 2501 1 Executive Drive, Chelmsford, MA 01824, USA IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately notify us by telephone at (978) 482-2500 and return the original message to us at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code. Thank You. Copyright (c) 2013 by Kewill Inc IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately return the original message to the sender at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Although Kewill takes reasonable precautions to minimize the risk, Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code.

2 1

INTERNAL ERROR: s_poll_wait returned 1, but no descriptor is ready
by Florian Gossin 10 Jun '15

10 Jun '15

HI, I'm trying to setup a connection from JDBC to pgbouncer through stunnel. Unfortunately, I get the above error message when I try to connect. Here are the logs from stunnel: 2015.06.09 16:56:13 LOG7[3]: SSL state (accept): SSLv3 read client certificate A 2015.06.09 16:56:13 LOG7[3]: SSL state (accept): SSLv3 read client key exchange A 2015.06.09 16:56:13 LOG7[3]: SSL state (accept): SSLv3 read certificate verify A 2015.06.09 16:56:13 LOG7[3]: SSL state (accept): SSLv3 read finished A 2015.06.09 16:56:13 LOG7[3]: SSL state (accept): SSLv3 write change cipher spec A 2015.06.09 16:56:13 LOG7[3]: SSL state (accept): SSLv3 write finished A 2015.06.09 16:56:13 LOG7[3]: SSL state (accept): SSLv3 flush data 2015.06.09 16:56:13 LOG7[3]: 4 server accept(s) requested 2015.06.09 16:56:13 LOG7[3]: 4 server accept(s) succeeded 2015.06.09 16:56:13 LOG7[3]: 0 server renegotiation(s) requested 2015.06.09 16:56:13 LOG7[3]: 0 session reuse(s) 2015.06.09 16:56:13 LOG7[3]: 3 internal session cache item(s) 2015.06.09 16:56:13 LOG7[3]: 0 internal session cache fill-up(s) 2015.06.09 16:56:13 LOG7[3]: 0 internal session cache miss(es) 2015.06.09 16:56:13 LOG7[3]: 0 external session cache hit(s) 2015.06.09 16:56:13 LOG7[3]: 0 expired session(s) retrieved 2015.06.09 16:56:13 LOG6[3]: SSL accepted: new session negotiated 2015.06.09 16:56:13 LOG6[3]: Negotiated TLSv1 ciphersuite ECDHE-RSA-AES256-SHA (256-bit encryption) 2015.06.09 16:56:13 LOG7[3]: Compression: null, expansion: null 2015.06.09 16:56:13 LOG6[3]: Failover strategy: round-robin 2015.06.09 16:56:13 LOG6[3]: s_connect: connecting 127.0.0.1:46432 2015.06.09 16:56:13 LOG7[3]: s_connect: s_poll_wait 127.0.0.1:46432: waiting 10 seconds 2015.06.09 16:56:13 LOG5[3]: s_connect: connected 127.0.0.1:46432 2015.06.09 16:56:13 LOG5[3]: Service [pgbouncer-client] connected remote server from 127.0.0.1:54633 2015.06.09 16:56:13 LOG7[3]: Remote socket (FD=9) initialized 2015.06.09 16:56:13 LOG6[3]: Read socket closed (read hangup) 2015.06.09 16:56:13 LOG7[3]: Sending close_notify alert 2015.06.09 16:56:13 LOG7[3]: SSL alert (write): warning: close notify 2015.06.09 16:56:13 LOG6[3]: SSL_shutdown successfully sent close_notify alert 2015.06.09 16:56:13 LOG3[3]: INTERNAL ERROR: s_poll_wait returned 1, but no descriptor is ready 2015.06.09 16:56:13 LOG5[3]: Connection reset: 58 byte(s) sent to SSL, 164 byte(s) sent to socket 2015.06.09 16:56:13 LOG7[3]: Remote socket (FD=9) closed 2015.06.09 16:56:13 LOG7[3]: Local socket (FD=8) closed 2015.06.09 16:56:13 LOG7[3]: Service [pgbouncer-client] finished (0 left) In pgbouncer, I get the following error: Pooler Error: bad packet header: '70' And in JDBC, the following exception: GRAVE: ERROR: bad packet header: '70' org.postgresql.util.PSQLException: ERROR: bad packet header: '70' Where might be the problem ? Does the stunnel parameter protocol=pgsql work with JDBC ? Thank you

2 1

How to tell what Ciphers are supported?
by Del Benjamin 06 Jun '15

06 Jun '15

I am using the pre-compiled windows binary version of stunnel in client mode, how do I tell on that version what cipher versions I can use? Essentially the equivalent of this command in openssl *openssl* *ciphers* [*-s*] [*-v*] [*-V*] [*-ssl3*] [*-tls1*] [*-stdname*] [ *cipherlist*]

2 2

Rework "Honor --sysconfdir and --localstatedir in stunnel.conf-sample.in"
by Dagobert Michelsen 01 Jun '15

01 Jun '15

Hi, I took the liberty of reworking the patch presented in http://www.stunnel.org/pipermail/stunnel-users/2010-July/002711.html to fix the issues raised in http://www.stunnel.org/pipermail/stunnel-users/2010-August/002719.html The main reason why the substitution didn't work is because it should not be done during configure-time but inside the Makefile as described in the Autoconf manual http://www.gnu.org/savannah-checkouts/gnu/autoconf/manual/autoconf-2.69/htm… The patch is attached to this email or you can browse the patch at https://github.com/dago/stunnel/compare/master...sysconfdir The patch is against 5.18b3 (is there a public repo available to make patches?) It would be great if the change could be applied. Best regards -- Dago

2 6

Incompatibility - Content-length parsing
by Marcin Gryszkalis 25 May '15

25 May '15

Hi, I noticed that parsing of HTTP header fields is not robust enough and not RFC compliant - and that way it casues incompatibility with Microsoft TMG proxy with NTLM authentication. The symptom is "Proxy-Authenticate: Invalid Content-Length" message while the header received is "Content-Length: 0 " <- note trailing spaces. The responsible piece of code is in protocol.c: if(tmpstr==line+16 || *tmpstr || content_length<0) { (tmpstr contains trailing spaces in this case). According to RFC 7230 trailing space is allowed and should be discarded by parser: A field value might be preceded and/or followed by optional whitespace (OWS); a single SP preceding the field-value is preferred for consistent readability by humans. The field value does not include any leading or trailing whitespace: OWS occurring before the first non-whitespace octet of the field value or after the last non-whitespace octet of the field value ought to be excluded by parsers when extracting the field value from a header field. best regards -- Marcin Gryszkalis, PGP 0xA5DBEEC7 jabber jid:[email protected]

2 3

Compiling for Android
by Pio Tofanelli 21 May '15

21 May '15

Hi, I'm new to stunnel and I'd like to compile it to ARM and x86 platforms. I downloaded the stunnel-5.17 package and I'm using the build-android.sh and android-ndk-r10e script to compile it: ../../configure --with-sysroot=/home/ptofanelli/android-ndk-r10e/platforms/android-18/arch-arm/ --build=i686-pc-linux-gnu --host=arm-linux-androideabi --prefix=/data/local I'm getting the message "The C compiler cannot create executables" and checking the logs I've found that the problem is this: configure:3538: arm-linux-androideabi-gcc conftest.c >&5 /home/ptofanelli/android-ndk-r10e/toolchains/arm-linux-androideabi-4.8/prebuilt/linux-x86/bin/../lib/gcc/arm-linux-androideabi/4.8/../../../../arm-linux-androideabi/bin/ld: error: cannot open crtbegin_dynamic.o: No such file or directory /home/ptofanelli/android-ndk-r10e/toolchains/arm-linux-androideabi-4.8/prebuilt/linux-x86/bin/../lib/gcc/arm-linux-androideabi/4.8/../../../../arm-linux-androideabi/bin/ld: error: cannot open crtend_android.o: No such file or directory /home/ptofanelli/android-ndk-r10e/toolchains/arm-linux-androideabi-4.8/prebuilt/linux-x86/bin/../lib/gcc/arm-linux-androideabi/4.8/../../../../arm-linux-androideabi/bin/ld: error: cannot find -lc /home/ptofanelli/android-ndk-r10e/toolchains/arm-linux-androideabi-4.8/prebuilt/linux-x86/bin/../lib/gcc/arm-linux-androideabi/4.8/../../../../arm-linux-androideabi/bin/ld: error: cannot find -ldl collect2: error: ld returned 1 exit status I searched for this problem and a topic in stackoverflow ( http://stackoverflow.com/questions/16795583/android-error-cannot-open-crtbe…) is said that the problem is the sysroot, so I tried to use the option --with-sysroot, but I'm getting the same problem. Can you help me? Thanks and regards, Pio Tofanelli

1 0

Stunnel not working with Office 365
by Hannu Viitala 19 May '15

19 May '15

Hi, We cannot get stunnel SMTP to work with Office 365 mail server. We are using Stunnel 5.13 and below are the config file content and the the client PC logs. The mail server logs do not reveal anything more. Two observations of the test setup: 1) Using e.g. Mozilla Firebird mail client directly SLL/SMTP on the same PC connection to same Office 365 mail server works ok, but via Stunnel it outputs the error log below. 2) Also, on the same PC, SSL/SMTP connection via stunnel to Gmail server works ok. Stunnel conf-file: ============== output = stunnel_log.txt debug = debug cert = tstunnel.pem client = yes [SSMTP] accept = 127.0.0.1:54500 connect = xxx.xxx.xxx.xxx:587 (Hannu V: removed IP address from this mail) protocol = smtp Client PC logs: =========== 2015.04.28 09:17:36 LOG7[ui]: No limit detected for the number of clients 2015.04.28 09:17:36 LOG5[ui]: stunnel 5.13 on x86-pc-msvc-1500 platform 2015.04.28 09:17:36 LOG5[ui]: Compiled/running with OpenSSL 1.0.2a 19 Mar 2015 2015.04.28 09:17:36 LOG5[ui]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2015.04.28 09:17:36 LOG7[ui]: errno: (*_errno()) 2015.04.28 09:17:36 LOG5[ui]: Reading configuration from file tstunnelSmtp_SAUX1_0.conf 2015.04.28 09:17:36 LOG5[ui]: UTF-8 byte order mark not detected 2015.04.28 09:17:36 LOG5[ui]: FIPS mode disabled 2015.04.28 09:17:36 LOG7[ui]: Compression disabled 2015.04.28 09:17:36 LOG7[ui]: PRNG seeded successfully 2015.04.28 09:17:36 LOG6[ui]: Initializing service [SSmtp] 2015.04.28 09:17:36 LOG6[ui]: Loading certificate from file: tstunnel.pem 2015.04.28 09:17:36 LOG6[ui]: Loading key from file: tstunnel.pem 2015.04.28 09:17:36 LOG7[ui]: Private key check succeeded 2015.04.28 09:17:36 LOG7[ui]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2015.04.28 09:17:36 LOG5[ui]: Configuration successful 2015.04.28 09:17:36 LOG7[ui]: Listening file descriptor created (FD=448) 2015.04.28 09:17:36 LOG7[ui]: Service [SSmtp] (FD=448) bound to 127.0.0.1:8030 2015.04.28 09:17:36 LOG7[ui]: Service [SSmtp] accepted (FD=456) from 127.0.0.1:54500 2015.04.28 09:17:36 LOG7[ui]: Creating a new thread 2015.04.28 09:17:36 LOG7[ui]: New thread created 2015.04.28 09:17:36 LOG7[0]: Service [SSmtp] started 2015.04.28 09:17:36 LOG5[0]: Service [SSmtp] accepted connection from 127.0.0.1:54500 2015.04.28 09:17:36 LOG6[0]: s_connect: connecting xxx.xxx.xxx.xxx:587 (Hannu V: removed IP address from this mail) 2015.04.28 09:17:36 LOG7[0]: s_connect: s_poll_wait connecting xxx.xxx.xxx.xxx:587 : waiting 10 seconds (Hannu V: removed IP address from this mail) 2015.04.28 09:17:37 LOG5[0]: s_connect: connected connecting xxx.xxx.xxx.xxx:587 (Hannu V: removed IP address from this mail) 2015.04.28 09:17:37 LOG5[0]: Service [SSmtp] connected remote server from yyy.yyy.yyy.yyy:54503 (Hannu V: removed IP address from this mail) 2015.04.28 09:17:37 LOG7[0]: Remote socket (FD=472) initialized 2015.04.28 09:17:37 LOG7[0]: <- 220 NNN.outlook.office365.com Microsoft ESMTP MAIL Service ready at Tue, 28 Apr 2015 14:17:38 +0000 2015.04.28 09:17:37 LOG7[0]: -> 220 NNN.outlook.office365.com Microsoft ESMTP MAIL Service ready at Tue, 28 Apr 2015 14:17:38 +0000 2015.04.28 09:17:37 LOG7[0]: -> EHLO localhost 2015.04.28 09:17:37 LOG7[0]: <- 250-NNN.outlook.office365.com Hello [xxx.xxx.xxx.161] (Hannu V: removed IP address from this mail) 2015.04.28 09:17:37 LOG7[0]: <- 250-SIZE 157286400 2015.04.28 09:17:37 LOG7[0]: <- 250-PIPELINING 2015.04.28 09:17:37 LOG7[0]: <- 250-DSN 2015.04.28 09:17:37 LOG7[0]: <- 250-ENHANCEDSTATUSCODES 2015.04.28 09:17:37 LOG7[0]: <- 250-STARTTLS 2015.04.28 09:17:37 LOG7[0]: <- 250-8BITMIME 2015.04.28 09:17:37 LOG7[0]: <- 250-BINARYMIME 2015.04.28 09:17:37 LOG7[0]: <- 250 CHUNKING 2015.04.28 09:17:37 LOG7[0]: -> STARTTLS 2015.04.28 09:17:37 LOG7[0]: <- 220 2.0.0 SMTP server ready 2015.04.28 09:17:37 LOG6[0]: SNI: sending servername: NNN.office365.com 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): before/connect initialization 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv2/v3 write client hello A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 read server hello A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 read server certificate A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 read server key exchange A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 read server certificate request A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 read server done A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 write client certificate A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 write client key exchange A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 write certificate verify A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 write change cipher spec A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 write finished A 2015.04.28 09:17:37 LOG7[0]: SSL state (connect): SSLv3 flush data 2015.04.28 09:17:37 LOG3[0]: SSL_connect: Peer suddenly disconnected 2015.04.28 09:17:37 LOG5[0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2015.04.28 09:17:37 LOG7[0]: Remote socket (FD=472) closed 2015.04.28 09:17:37 LOG7[0]: Local socket (FD=456) closed 2015.04.28 09:17:37 LOG7[0]: Service [SSmtp] finished (0 left) --- Hannu

2 1

Authentication methods
by Michal Trojnara 15 May '15

15 May '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, While reading various 3rd party stunnel tutorials I noticed that they either don't configure authentication, or they recommend insecure configurations. I wrote a short overview of authentication methods available in stunnel: https://www.stunnel.org/auth.html Proper authentication is essential to TLS security. Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJVVXk5AAoJEC78f/DUFuAUN/QP/3m4HX4zWS8SehukDNWw54AB ySAT+XmT8SEo/iuGer/CRYbUWoMDpmwaI9x+whXMg+EBsxGd+nmyE9fkFiFSqOsV vnXc14zuMkQYorWbGtduXdnQ0/jQzWPDOIeKgpyXIsN/OvEhx1A6med9Go/SqaFz couW55wysqpJ9a+3YMtxIjLoCMzIGOZ8TKIHWJiZaBcgp93YCABeoE5hKR4RlxVj OrgHhuyA8yz1EIYUPKTEMuJwqnCl9Mk3FVskKIXgfEcxBzism2n/xJpEIYAWVPRW N8JaaZDojk6dt5oMiMzXUeobigZ82SKuV9MG3aQjuxXAP7IX2vuOa6rQ/85T1OFI PMZMKENM1aAcOVpiq/4OMNKhIG+OuhDm/dla5NC8lsfxDuJ3YESVp/Z0VeW1EWYA BFHxjGw8OA65izTYcvJKl1j7flfSgRELOCf1SMakR+VIUhkWlPQjdHWuW2V5NKgv 5aU0fwPGEpudKdsLFzgaYzhVPjTNfavl8k+xUWHOQyrNvEM9SNbOTyorxY7QA2aQ uyAOrUF8whboBTX59/3gXYI9vaepvT00ktCtQEz3XelkYT9SzCRYV+I+mUqquBd+ 0JQdiSMvOzfNraxT03rzYA6h/Iey9+tj9WnffpmYU5eyTt2bCp+xavzCyEmdQZlq 4LfAPgFYII9+59444dY2 =m51O -----END PGP SIGNATURE-----

1 0

Stunnel4 not working?
by David H. Durgee 13 May '15

13 May '15

Given a lack of other suggestions here and elsewhere that yielded any progress, I decided to download the current source and attempt to build it on my system. I didn't see a routine to check for prerequisites being met, so I wound up running ./configure several times and adding the libssl-dev, libwrap0-dev and libsystemd-daemon-dev packages based on what I saw in the output. Perhaps a check routine could be added later? I then ran make and the output contains neither errors nor warnings, so that looks good. As suggested in the INSTALL file, I next ran make check and received neither errors nor warnings. At this point the next step appears to be make install as root, but I am wondering if I should uninstall the stunnel4 package from the repository first. I am also wondering if I can simply use the existing /etc/stunnel/stunnel.conf that I included in my first post in this thread or if I should start over with one of the examples included with this version. I would appreciate input from the list on this. If you want to see further details, such as ./configure or make outputs or configuration files just let me know and I will put them in a follow-up post. Dave

2 1

Re: [stunnel-users] Stunnel 5.17 on AIX
by Eckert, Doug 13 May '15

13 May '15

Thanks! I applied the patch to tls.c and I'm able to create sessions with no problem. The version of OpenSSL provided by IBM is built off the 1.0.1e codebase, with backported security fixes via "iFixes" for announced CVEs. They apparently don't backport new functionality or maybe even non-CVE bugfixes. I'm guessing an un-patched stunnel 5.17 would work once/if they release OpenSSL built off 1.0.1j or later. > On Tue, May 12, 2015 at 3:40 PM, Michal Trojnara <Michal.Trojnara(a)mirt.net > > wrote: > >> On 12.05.2015 18:29, Eckert, Doug wrote: >> > With that in mind, I compiled stunnel v5.03 with same OpenSSL 1.0.1.513 >> > and iFix IV71446m9a applied as with the v5.17 attempt. I'm able to >> > create sessions with no problem. The internal error/bad magic does not >> > occur. >> >> Additional security checks to the OpenSSL memory management functions >> were introduced in stunnel 5.09. The enclosed patch disables them in >> the latest stunnel 5.17. >> >> Mike >> >> _______________________________________________ >> stunnel-users mailing list >> stunnel-users(a)stunnel.org >> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >> >> > > > -- > > > >

1 0

Stunnel 5.17 on AIX
by Eckert, Doug 12 May '15

12 May '15

I've gotten v5.17 compiled on AIX 5.3 & 6.1 with the following xlccmp.13.1.0 13.1.0.3 COMMITTED XL C compiler openssl.base 1.0.1.513 COMMITTED Open Secure Socket Layer IV71446m9a Ifix for Openssl CVE Everything seems to have compiled fine. I packaged it up, installed, and set up a quick config. The server side aborts on me. Debug output follows. Need some direction on where to look next. Thanks in advance! 2015.05.06 12:08:03 LOG7[ui]: Clients allowed=31999 2015.05.06 12:08:03 LOG5[ui]: stunnel 5.17 on powerpc-ibm-aix5.3.0.0 platform 2015.05.06 12:08:03 LOG5[ui]: Compiled/running with OpenSSL 1.0.1e 11 Feb 2013 2015.05.06 12:08:03 LOG5[ui]: Threading:PTHREAD Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI 2015.05.06 12:08:03 LOG7[ui]: errno: (*_Errno()) 2015.05.06 12:08:03 LOG5[ui]: Reading configuration from file /opt/freeware/etc/stunnel/stunnel.conf 2015.05.06 12:08:03 LOG5[ui]: UTF-8 byte order mark not detected 2015.05.06 12:08:03 LOG7[ui]: Compression disabled 2015.05.06 12:08:03 LOG7[ui]: Snagged 64 random bytes from //.rnd 2015.05.06 12:08:03 LOG7[ui]: Wrote 1024 new random bytes to //.rnd 2015.05.06 12:08:03 LOG7[ui]: PRNG seeded successfully 2015.05.06 12:08:03 LOG6[ui]: Initializing service [client] 2015.05.06 12:08:03 LOG6[ui]: Loading certificate from file: /usr/share/ssl/certs/skdkgesaix53-client-cert.pem 2015.05.06 12:08:03 LOG6[ui]: Loading key from file: /usr/share/ssl/certs/skdkgesaix53-client-key.pem 2015.05.06 12:08:03 LOG7[ui]: Private key check succeeded 2015.05.06 12:08:03 LOG7[ui]: Verify directory set to /usr/share/ssl/certs 2015.05.06 12:08:03 LOG7[ui]: Added /usr/share/ssl/certs revocation lookup directory 2015.05.06 12:08:03 LOG6[ui]: Peer certificate location /usr/share/ssl/certs 2015.05.06 12:08:03 LOG7[ui]: SSL options: 0x01000004 (+0x03000000, -0x02000000) 2015.05.06 12:08:03 LOG6[ui]: Initializing service [server] 2015.05.06 12:08:03 LOG6[ui]: Loading certificate from file: /usr/share/ssl/certs/skdkgesaix53-server-cert.pem 2015.05.06 12:08:03 LOG6[ui]: Loading key from file: /usr/share/ssl/certs/skdkgesaix53-server-key.pem 2015.05.06 12:08:03 LOG7[ui]: Private key check succeeded 2015.05.06 12:08:03 LOG7[ui]: Verify directory set to /usr/share/ssl/certs 2015.05.06 12:08:03 LOG7[ui]: Added /usr/share/ssl/certs revocation lookup directory 2015.05.06 12:08:03 LOG6[ui]: Peer certificate location /usr/share/ssl/certs 2015.05.06 12:08:03 LOG7[ui]: DH initialization 2015.05.06 12:08:03 LOG7[ui]: Could not load DH parameters from /usr/share/ssl/certs/skdkgesaix53-server-cert.pem 2015.05.06 12:08:03 LOG7[ui]: Using hardcoded DH parameters 2015.05.06 12:08:03 LOG7[ui]: DH initialized with 2048-bit key 2015.05.06 12:08:03 LOG7[ui]: ECDH initialization 2015.05.06 12:08:03 LOG7[ui]: ECDH initialized with curve prime256v1 2015.05.06 12:08:03 LOG7[ui]: SSL options: 0x01004004 (+0x03004000, -0x02000000) 2015.05.06 12:08:03 LOG5[ui]: Configuration successful 2015.05.06 12:08:03 LOG7[ui]: Listening file descriptor created (FD=7) 2015.05.06 12:08:03 LOG7[ui]: Service [client] (FD=7) bound to 127.0.0.1:22 2015.05.06 12:08:03 LOG7[ui]: Listening file descriptor created (FD=8) 2015.05.06 12:08:03 LOG7[ui]: Service [server] (FD=8) bound to 172.26.85.13:2222 2015.05.06 12:08:04 LOG7[main]: Created pid file /var/pid/stunnel.pid 2015.05.06 12:08:29 LOG7[main]: Service [server] accepted (FD=3) from 172.26.85.14:52649 2015.05.06 12:08:29 LOG7[0]: Service [server] started 2015.05.06 12:08:29 LOG5[0]: Service [server] accepted connection from 172.26.85.14:52649 2015.05.06 12:08:29 LOG7[0]: SSL state (accept): before/accept initialization 2015.05.06 12:08:29 LOG7[0]: SNI: no virtual services defined 2015.05.06 12:08:29 LOG7[0]: SSL state (accept): SSLv3 read client hello A 2015.05.06 12:08:29 LOG7[0]: SSL state (accept): SSLv3 write server hello A 2015.05.06 12:08:29 LOG7[0]: SSL state (accept): SSLv3 write certificate A INTERNAL ERROR: Bad magic at tls.c, line 182 --Doug

2 4

Stunnel4 not working?
by David H. Durgee 09 May '15

09 May '15

> Please see highlighted below: > > On Fri, May 8, 2015 at 5:27 PM, David H. Durgee <dhdurgee at verizon.net <https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users>> > wrote: > > >/ At some point in the near past stunnel stopped working on my laptop. The > />/ laptop is running Linux Mint 17.1 Rebecca x64 and stunnel from the > />/ repositories. I enabled debug=7, but I am not getting much from the log: > />/ > />/ > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Clients allowed=500 > />/ > />/ > />/ > />/ *2015.05.08 17 <2015.05.08%2017>:12:06 LOG5[10804:140318864611136]: > />/ stunnel 4.53 on x86_64-pc-linux-gnu platform 2015.05.08 17 > />/ <2015.05.08%2017>:12:06 LOG5[10804:140318864611136]: Compiled with OpenSSL > />/ 1.0.1e 11 Feb 2013 2015.05.08 17 <2015.05.08%2017>:12:06 > />/ LOG5[10804:140318864611136]: Running with OpenSSL 1.0.1f 6 Jan 2014 > />/ 2015.05.08 17 <2015.05.08%2017>:12:06 LOG5[10804:140318864611136]: Update > />/ OpenSSL shared libraries or rebuild stunnel* > / > > Is there a reason that you're using libraries from a different compiled > Stunnel? In fact, isn't there another Stunnel package you can use that is > more up-to-date? If not, perhaps compile your own using the OpenSSL > libraries that comes with Mint. I am using the package from the Mint repository, which in this case is the Ubuntu Trusty repository. If you know of a repository I can add with a more current package I will do so. If necessary I guess I could build from source, but I don't do that often and would prefer to locate a binary. > >/ > />/ 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Threading:PTHREAD > />/ SSL:+ENGINE+OCSP Auth:LIBWRAP Sockets:POLL+IPv6 > />/ 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Reading configuration > />/ from file /etc/stunnel/stunnel.conf > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Compression not enabled > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: PRNG seeded successfully > />/ 2015.05.08 17:12:06 LOG6[10804:140318864611136]: Initializing service > />/ section [telnets] > />/ *2015.05.08 17 <2015.05.08%2017>:12:06 LOG4[10804:140318864611136]: > />/ Insecure file permissions on /etc/ssl/certs/stunnel.pem* > / > > Warning: the permissions may be too wide-open (should be 700 I assume) > > > >/ > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate: > />/ /etc/ssl/certs/stunnel.pem > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate loaded > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Key file: > />/ /etc/ssl/certs/stunnel.pem > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Private key loaded > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: SSL options set: > />/ 0x00000004 > />/ 2015.05.08 17:12:06 LOG6[10804:140318864611136]: Initializing service > />/ section [dsp3270s] > />/ *2015.05.08 17 <2015.05.08%2017>:12:06 LOG4[10804:140318864611136]: > />/ Insecure file permissions on /etc/ssl/certs/stunnel.pem* > / > > Same as above, perhaps too wide open, permissions should be 700 I assume. > > > >/ > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate: > />/ /etc/ssl/certs/stunnel.pem > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate loaded > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Key file: > />/ /etc/ssl/certs/stunnel.pem > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Private key loaded > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: SSL options set: > />/ 0x00000004 > />/ 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Configuration successful > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Service [telnets] > />/ (FD=12) bound to 0.0.0.0:3141 > />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Service [dsp3270s] > />/ (FD=13) bound to 0.0.0.0:7490 > />/ 2015.05.08 17:12:06 LOG7[10810:140318864611136]: Created pid file > />/ /stunnel4.pid > />/ 2015.05.08 17:12:31 LOG7[10810:140318864611136]: Service [telnets] > />/ accepted (FD=3) from 127.0.0.1:40090 > />/ 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Service [telnets] started > />/ 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Waiting for a libwrap > />/ process > />/ 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Acquired libwrap process > />/ #0 > />/ > />/ > />/ *2015.05.08 17 <2015.05.08%2017>:12:31 LOG3[10810:140318864770816]: > />/ Unexpected socket close (read_blocking) 2015.05.08 17 > />/ <2015.05.08%2017>:12:31 LOG5[10810:140318864770816]: Connection reset: 0 > />/ byte(s) sent to SSL, 0 byte(s) sent to socket 2015.05.08 17 > />/ <2015.05.08%2017>:12:31 LOG7[10810:140318864770816]: Local socket (FD=3) > />/ closed* > / > > that sounds like SELinux permissions perhaps? Have you tried temporarily > disabling SELinux, or perhaps you have a firewall (iptables) set up? You'll > have to allow the incoming port and possibly an entry in /etc/services > IIRC. I don't know if this helps but this is what I found: > https://sites.google.com/site/easylinuxtipsproject/security > A link to "ufw" may prove useful, if your system has that installed. Most > systems have locked-down privileged ports (any port less than 1024, like in > your example). I do have ufw here, but I have the same problem with it enabled or disabled. The telnets service is listening on port 3141 and the dsp3270s on port 7490, so neither of them are privileged ports. > >/ > />/ 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Service [telnets] > />/ finished (0 left) > />/ 2015.05.08 17:12:31 LOG7[10810:140318864770816]: str_stats: 1 block(s), > />/ 32 data byte(s), 58 control byte(s) > />/ 2015.05.08 17:13:32 LOG7[10810:140318864611136]: Service [dsp3270s] > />/ accepted (FD=3) from 127.0.0.1:48534 > />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Service [dsp3270s] > />/ started > />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Waiting for a libwrap > />/ process > />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Acquired libwrap process > />/ #1 > />/ *2015.05.08 17 <2015.05.08%2017>:13:32 LOG3[10810:140318864770816]: > />/ Unexpected socket close (read_blocking)* > />/ > / > That sounds like some kind of firewall issue (like above). As noted above, same behavior with ufw enabled or disabled. > >/ 2015.05.08 17:13:32 LOG5[10810:140318864770816]: Connection reset: 0 > />/ byte(s) sent to SSL, 0 byte(s) sent to socket > />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Local socket (FD=3) > />/ closed > />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Service [dsp3270s] > />/ finished (0 left) > />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: str_stats: 1 block(s), > />/ 32 data byte(s), 58 control byte(s) > />/ > />/ > / When in a situation like this, I would first try unprivileged ports with > localhost using iperf, just to generate some dummy traffic. A good > technique I use when debugging stunnel versus debugging networking or other > security issues is to do local traffic only like this: > > 1. iperf client connect to localhost port 5000 > 2. Stunnel client listen on port 5000, connect to localhost port 6000 > 3. Stunnel server listen on port 6000, connect to localhost port 7000 > 4. iperf server listening on localhost port 7000 > > As you can see from that, running iperf client for a few seconds, it should > be able to connect to the iperf server. If not, stunnel is not working. > Debug this FIRST before proceeding to working with non-localhost IP > addresses. The actual procedure would be as follows: > > 1. Download/install iperf > 2. Verify iperf works by having one shell run as server, listening on > localhost port 7000, and another shell setup iperf client sending on port > 7000. If that works, then proceed. Don't use iperf to connect to port 7000 > again. > 3. Set up two config files, one for stunnel client and one for stunnel > server, with different ports and the "client=yes" in the client config > file. For easier detection with "ps" or "top", you can copy the executable > file to another name (i.e., "s4client" for the stunnel 4 client, and > "s4server" for the stunnel 4 server). Similarly for iperf, you can copy the > exe to "iperfc" and "iperfs" for iperf server, for easier process detection. > 4. Start up the stunnel server first, then stunnel client, with the > appropriate config files per the port enumeration mentioned above. > 5. Start iperf server listening on port 7000. > 6. Start iperf client sending on port 5000. If you get some really large > value or nothing, then your stunnel config (client/server) needs to be > debugged first before proceeding to non-localhost IPs. I usually get > something like 3GB/sec when using a Windows 7 VM inside Windows 7 doing > this from DOS prompts with appropriate server/client configs set up. I > usually use four windows: two for iperf (c/s), two for stunnel (c/s). > > Hope that helps... > -Rob I have an stunnel server on another system on the LAN and that is the one I am having the client with the problem connect to while trying to find the problem. I know that server is working, as I have seen other incoming traffic handled by it. I suspect the problem is related to the message you pointed out that I missed about SSL libraries. I would very much appreciate a pointer to a more current package in a repository. Thanks for your response, Rob. Dave

1 0

Stunnel 5.17 build on AIX - libssp missing
by Rob Lockhart 09 May '15

09 May '15

I have AIX 6.1 (64-bit) with GCC 4.2.0. It has an older version of OpenSSL (0.9.8) installed from IBM but I'm trying to compile Stunnel 5.17 with OpenSSL 1.0.2a-fips as non-root. I proceed as follows: cd ~; [ -d openssl ] && rm -rf openssl; mkdir openssl cd ~/OpenSSL; [ -d openssl-fips-2.0.9 ] && rm -rf openssl-fips-2.0.9 gzip -dc openssl-fips-2.0.9.tar.gz | tar xvf - cd openssl-fips-2.0.9; chmod 755 Configure ./Configure aix64-gcc --openssldir=$HOME/openssl make make install NOTE: the above is just the FIPS canister (library), not the executable. cd ~/OpenSSL; [ -d openssl-1.0.2a ] && rm -rf openssl-1.0.2a gzip -dc openssl-1.0.2a.tar.gz | tar xvf - cd openssl-1.0.2a; chmod 755 Configure ./Configure aix64-gcc fips shared --openssldir=$HOME/openssl --with-fipsdir=$HOME/openssl make depend make make test make install cd ~/openssl/bin; ./openssl version; ./openssl speed NOTE: Look for "ALL OCSP TESTS SUCCESSFUL" after "make test" to verify the test build was successful, and it was. NOTE: "./openssl version" should show "OpenSSL 1.0.2a-fips 19 Mar 2015" NOTE: "./openssl speed" should take a while as it's measuring the speed for all algorithms Final test of OpenSSL 1.0.2a-fips: ./openssl sha1 -hmac etaonrishdlcupfm ~/OpenSSL/openssl-fips-2.0.9.tar.gz - should return: 54552e9a3ed8d1561341e8945fcdec55af961322 Now, I try to compile Stunnel: rm -rf $HOME/stunnel-bin; mkdir $HOME/stunnel-bin cd ~/Stunnel; [ -f stunnel-5.17 ] && rm -rf stunnel-5.17 gzip -dc stunnel-5.17.tar.gz | tar xvf - ; cd stunnel-5.17 ./configure --enable-fips --prefix=$HOME/stunnel-bin --with-ssl=$HOME/openssl make I get a failure at make for a library not found: /bin/sh ../libtool --tag=CC --mode=link gcc -g -O2 -D_THREAD_SAFE -Wall -Wextra -Wformat=2 -Wconversion -Wno-long-long -Wno-deprecated-declarations -fstack-protector -fPIE -D_FORTIFY_SOURCE=2 -L/home/lockharr/openssl/lib64 -L/home/lockharr/openssl/lib -lssl -lcrypto -o stunnel stunnel-tls.o stunnel-str.o stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-fd.o stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o stunnel-ui_unix.o -lpthreads libtool: link: gcc -g -O2 -D_THREAD_SAFE -Wall -Wextra -Wformat=2 -Wconversion -Wno-long-long -Wno-deprecated-declarations -fstack-protector -fPIE -D_FORTIFY_SOURCE=2 -o stunnel stunnel-tls.o stunnel-str.o stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-fd.o stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o stunnel-ui_unix.o -L/home/lockharr/openssl/lib64 -L/home/lockharr/openssl/lib -lssl -lcrypto -lpthreads collect2: library libssp_nonshared not found The interesting part is that doing a "grep -R libssp" of the source tree only shows one reference to libssp: $ grep -R libssp * stunnel-5.17/tools/stunnel.nsi: # MINGW builds requires libssp-0.dll instead of msvcr90.dll Googling showed some really old links that had libssp skipped for GCC on AIX: http://gcc.gnu.org/ml/gcc-patches/2005-09/msg01231.html and another that added it back in: http://marc.info/?l=gcc-patches&m=130168534803966 Can anyone who has compiled this for AIX give me a clue about what's going on? This looks like a reference to a non-existent library but I would think that if GCC needed that, it wouldn't allow the RPM for GCC to be installed. Thanks, -Rob

2 1

Stunnel4 not working?
by David H. Durgee 08 May '15

08 May '15

At some point in the near past stunnel stopped working on my laptop. The laptop is running Linux Mint 17.1 Rebecca x64 and stunnel from the repositories. I enabled debug=7, but I am not getting much from the log: 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Clients allowed=500 2015.05.08 17:12:06 LOG5[10804:140318864611136]: stunnel 4.53 on x86_64-pc-linux-gnu platform 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Compiled with OpenSSL 1.0.1e 11 Feb 2013 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Running with OpenSSL 1.0.1f 6 Jan 2014 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Update OpenSSL shared libraries or rebuild stunnel 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Threading:PTHREAD SSL:+ENGINE+OCSP Auth:LIBWRAP Sockets:POLL+IPv6 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Reading configuration from file /etc/stunnel/stunnel.conf 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Compression not enabled 2015.05.08 17:12:06 LOG7[10804:140318864611136]: PRNG seeded successfully 2015.05.08 17:12:06 LOG6[10804:140318864611136]: Initializing service section [telnets] 2015.05.08 17:12:06 LOG4[10804:140318864611136]: Insecure file permissions on /etc/ssl/certs/stunnel.pem 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate: /etc/ssl/certs/stunnel.pem 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate loaded 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Key file: /etc/ssl/certs/stunnel.pem 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Private key loaded 2015.05.08 17:12:06 LOG7[10804:140318864611136]: SSL options set: 0x00000004 2015.05.08 17:12:06 LOG6[10804:140318864611136]: Initializing service section [dsp3270s] 2015.05.08 17:12:06 LOG4[10804:140318864611136]: Insecure file permissions on /etc/ssl/certs/stunnel.pem 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate: /etc/ssl/certs/stunnel.pem 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate loaded 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Key file: /etc/ssl/certs/stunnel.pem 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Private key loaded 2015.05.08 17:12:06 LOG7[10804:140318864611136]: SSL options set: 0x00000004 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Configuration successful 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Service [telnets] (FD=12) bound to 0.0.0.0:3141 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Service [dsp3270s] (FD=13) bound to 0.0.0.0:7490 2015.05.08 17:12:06 LOG7[10810:140318864611136]: Created pid file /stunnel4.pid 2015.05.08 17:12:31 LOG7[10810:140318864611136]: Service [telnets] accepted (FD=3) from 127.0.0.1:40090 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Service [telnets] started 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Waiting for a libwrap process 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Acquired libwrap process #0 2015.05.08 17:12:31 LOG3[10810:140318864770816]: Unexpected socket close (read_blocking) 2015.05.08 17:12:31 LOG5[10810:140318864770816]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Local socket (FD=3) closed 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Service [telnets] finished (0 left) 2015.05.08 17:12:31 LOG7[10810:140318864770816]: str_stats: 1 block(s), 32 data byte(s), 58 control byte(s) 2015.05.08 17:13:32 LOG7[10810:140318864611136]: Service [dsp3270s] accepted (FD=3) from 127.0.0.1:48534 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Service [dsp3270s] started 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Waiting for a libwrap process 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Acquired libwrap process #1 2015.05.08 17:13:32 LOG3[10810:140318864770816]: Unexpected socket close (read_blocking) 2015.05.08 17:13:32 LOG5[10810:140318864770816]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Local socket (FD=3) closed 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Service [dsp3270s] finished (0 left) 2015.05.08 17:13:32 LOG7[10810:140318864770816]: str_stats: 1 block(s), 32 data byte(s), 58 control byte(s) I don't even see the IP address for the outbound connection, so it seems as if it is hitting a problem even before it gets that far. Configuration is pretty simple: ; Sample stunnel configuration file by Michal Trojnara 2002-2009 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of the chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /etc/ssl/certs/stunnel.pem ;key = /etc/ssl/certs/stunnel.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = TLSv1 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 ; PID is created inside the chroot jail pid = /stunnel4.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 socket = l:SO_KEEPALIVE=1 socket = r:SO_KEEPALIVE=1 socket = l:TCP_KEEPCNT=5 socket = r:TCP_KEEPCNT=5 socket = l:TCP_KEEPIDLE=10 socket = r:TCP_KEEPIDLE=10 socket = l:TCP_KEEPINTVL=2 socket = r:TCP_KEEPINTVL=2 ;compression = zlib ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [telnets] accept = 3141 ;connect = 192.168.80.11:992 ;connect = DurgeeEnterprises.publicvm.com:992 connect = 192.168.80.5:992 [dsp3270s] accept = 7490 ;connect = 192.168.80.11:246 ;connect = DurgeeEnterprises.publicvm.com:246 connect = 192.168.80.5:246 ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini Any thoughts on how to track this down and get this working? Dave

2 1

problem migrating from 4.54 to 5.x
by Scott Weisman 04 May '15

04 May '15

Hi there. I have a program I have used successfully with Stunnel for many years. A while back, I discovered that my program, which is a pure stdio console program, stopped working with 5.x versions of Stunnel. I have spent many hours but have been unable to solve the problem, so I regretfully continue to use the 4.x branch. I was wondering if anyone had similar experiences? Relevant data is pasted below. I comment in the log output where the problem occurs. Any help at all would be greatly appreciated. stunnel.conf: setuid = stunnel setgid = stunnel pid = /var/run/stunnel/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 foreground = no debug = 7 output = /var/log/stunnel.log [CF2] client = no accept = 21 verify = 3 sslVersion = all cert = /etc/stunnel/demo.pem key = /etc/stunnel/demo.pem CApath = /etc/stunnel/certs CRLpath = /etc/stunnel/crls TIMEOUTbusy = 60 TIMEOUTclose = 0 TIMEOUTconnect = 60 TIMEOUTidle = 60 exec = /opt/cmf/bin/cf-server execargs = /opt/cmf/bin/cf-server -p /opt/jail/stunnel/pipes/ Log of successful session with 4.54: 2015.05.01 15:39:39 LOG7[3080:140402563495680]: Starting certificate verification: depth=0, /C=US/L=Bryan/ST=TX/O=Demo Account/emailAddress= demo(a)demo.com/CN=demo 2015.05.01 15:39:39 LOG6[3080:140402563495680]: CERT: Locally installed certificate matched 2015.05.01 15:39:39 LOG5[3080:140402563495680]: Certificate accepted: depth=0, /C=US/L=Bryan/ST=TX/O=Demo Account/emailAddress= demo(a)demo.com/CN=demo 2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3 read client certificate A 2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3 read client key exchange A 2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3 read certificate verify A 2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3 read finished A 2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3 write session ticket A 2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3 write change cipher spec A 2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3 write finished A 2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3 flush data 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 items in the session cache 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 client connects (SSL_connect()) 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 client connects that finished 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 client renegotiations requested 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 1 server connects (SSL_accept()) 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 1 server connects that finished 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 server renegotiations requested 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 session cache hits 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 external session cache hits 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 session cache misses 2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 session cache timeouts 2015.05.01 15:39:39 LOG6[3080:140402563495680]: SSL accepted: new session negotiated 2015.05.01 15:39:39 LOG6[3080:140402563495680]: Negotiated TLSv1/SSLv3 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2015.05.01 15:39:39 LOG6[3080:140402563495680]: Compression: null, expansion: null 2015.05.01 15:39:39 LOG6[3080:140402563495680]: Local mode child started (PID=3118) 2015.05.01 15:39:39 LOG7[3080:140402563495680]: Remote socket (FD=11) initialized *** the connection is established and stable; i explicitly disconnect several seconds later 2015.05.01 15:39:45 LOG7[3080:140402563495680]: SSL socket closed on SSL_read 2015.05.01 15:39:45 LOG7[3080:140402563495680]: Sent socket write shutdown 2015.05.01 15:39:45 LOG5[3080:140402563495680]: Connection closed: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2015.05.01 15:39:45 LOG7[3080:140402563495680]: Remote socket (FD=11) closed 2015.05.01 15:39:45 LOG7[3080:140402563495680]: Local socket (FD=3) closed 2015.05.01 15:39:45 LOG7[3080:140402563495680]: Service [CF2] finished (0 left) Log of unsuccessful session with 5.16: 2015.05.01 15:37:33 LOG7[0]: Verification started at depth=0: C=US, L=Bryan, ST=TX, O=Demo Account, emailAddress=demo(a)demo.com, CN=demo 2015.05.01 15:37:33 LOG7[0]: CERT: Pre-verification succeeded 2015.05.01 15:37:33 LOG6[0]: CERT: Locally installed certificate matched 2015.05.01 15:37:33 LOG5[0]: Certificate accepted at depth=0: C=US, L=Bryan, ST=TX, O=Demo Account, emailAddress=demo(a)demo.com, CN=demo 2015.05.01 15:37:33 LOG7[0]: SSL state (accept): SSLv3 read client certificate A 2015.05.01 15:37:33 LOG7[0]: SSL state (accept): SSLv3 read client key exchange A 2015.05.01 15:37:33 LOG7[0]: SSL state (accept): SSLv3 read certificate verify A 2015.05.01 15:37:33 LOG7[0]: SSL state (accept): SSLv3 read finished A 2015.05.01 15:37:33 LOG7[0]: SSL state (accept): SSLv3 write change cipher spec A 2015.05.01 15:37:33 LOG7[0]: SSL state (accept): SSLv3 write finished A 2015.05.01 15:37:33 LOG7[0]: SSL state (accept): SSLv3 flush data 2015.05.01 15:37:33 LOG7[0]: 1 server accept(s) requested 2015.05.01 15:37:33 LOG7[0]: 1 server accept(s) succeeded 2015.05.01 15:37:33 LOG7[0]: 0 server renegotiation(s) requested 2015.05.01 15:37:33 LOG7[0]: 0 session reuse(s) 2015.05.01 15:37:33 LOG7[0]: 0 internal session cache item(s) 2015.05.01 15:37:33 LOG7[0]: 0 internal session cache fill-up(s) 2015.05.01 15:37:33 LOG7[0]: 0 internal session cache miss(es) 2015.05.01 15:37:33 LOG7[0]: 0 external session cache hit(s) 2015.05.01 15:37:33 LOG7[0]: 0 expired session(s) retrieved 2015.05.01 15:37:33 LOG6[0]: SSL accepted: new session negotiated 2015.05.01 15:37:33 LOG7[0]: Peer certificate was cached (1610 bytes) 2015.05.01 15:37:33 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2015.05.01 15:37:33 LOG7[0]: Compression: null, expansion: null 2015.05.01 15:37:33 LOG6[0]: Local mode child started (PID=2899) 2015.05.01 15:37:33 LOG7[0]: Remote socket (FD=11) initialized *** immediately after successful connection, something happens; my program has no log output either, which seems to indicate that stunnel is closing it 2015.05.01 15:37:33 LOG6[0]: Read socket closed (readsocket) 2015.05.01 15:37:33 LOG7[main]: Dispatching signals from the signal pipe 2015.05.01 15:37:33 LOG7[0]: Sending close_notify alert 2015.05.01 15:37:33 LOG7[main]: Processing SIGCHLD 2015.05.01 15:37:33 LOG7[0]: SSL alert (write): warning: close notify 2015.05.01 15:37:33 LOG6[main]: Child process 2899 terminated on signal 11 2015.05.01 15:37:33 LOG6[0]: SSL_shutdown successfully sent close_notify alert 2015.05.01 15:37:33 LOG7[main]: Signal pipe is empty 2015.05.01 15:37:33 LOG3[0]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing 2015.05.01 15:37:33 LOG5[0]: Connection closed: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2015.05.01 15:37:33 LOG7[0]: Remote socket (FD=11) closed 2015.05.01 15:37:33 LOG7[0]: Local socket (FD=3) closed 2015.05.01 15:37:33 LOG7[0]: Service [CF2] finished (0 left)

2 2

Segfault in stunnel
by Miroslaw Pietrzyk 03 May '15

03 May '15

Hi, I have a problem with one of the stunnel installation (debian7). After some time of operation automatically turns itself off with the message: (...) Apr 24 21:03:45 routerpri kernel: [177332.400502] stunnel[34426]: segfault at 0 ip 00007f1f99ca9e20 sp 00007f1f99c16c68 error 4 in stunnel[7f1f99c94000+24000] (...) Apr 24 21:21:36 routerpri kernel: [178402.360532] stunnel[34795]: segfault at 0 ip 00007f84d6b8be20 sp 00007f84d6b49c68 error 4 in stunnel[7f84d6b76000+24000] (...) Apr 24 21:23:31 routerpri kernel: [178517.215345] stunnel[34908]: segfault at 0 ip 00007f150c5b3e20 sp 00007f150c58cc68 error 4 in stunnel[7f150c59e000+24000] (...) stunnel 5.15 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.1e 11 Feb 2013 stunnel.conf: pid = /var/run/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel.log syslog = yes client = no fips = no verify = 0 CAfile = /etc/stunnel/SubCA2.crt CRLfile = /etc/stunnel/SubCA2_CRL.pem [service_1] accept = 192.168.1.10:1000 connect = 192.168.1.10:1234 cert = /etc/stunnel/cert1.crt key = /etc/stunnel/cert1_key.pem ciphers = HIGH:!SSLv2:!ADH:!Exp:!aNULL:!eNULL:!NULL sslVersion = TLSv1.2 When I use the lower level of encryption for example SSLv3, problem occurs after a longer period of normal operation. I will only add that the problem has also appeared on the previous version 4.54, which I was updating to the newest. Do you have any idea what could be causing the problem. Regards Mirek

2 2

HSM usage
by Vedat Nommaz 01 May '15

01 May '15

>> What would be the equivalent of below s_server command in stunnel? >> >> openssl s_server -accept 5003 -engine chil -keyform engine -key rsa-priv -cert public.pem -tls1_2 >> >> In this example "rsa-priv" references the private key inside a hardware security module, not a pem file. >> >> I saw an option for engineid in the documentation, but nothing for keyform parameter.

1 0

stunnel 5.17 release
by Michal Trojnara 29 Apr '15

29 Apr '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.17 of stunnel. The ChangeLog entry: Version 5.17, 2015.04.29, urgency: HIGH: * Bugfixes - Fixed a NULL pointer dereference causing the service to crash. This bug was introduced in stunnel 5.15. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: c3e79e582621a0827125e35e1c00450190104fc02dc3c5274cb02b05859fd472 stunnel-5.17.tar.gz 07a508de3807663f71e4793fd5edb4c57b6c82b4c9008753f8f6c85a17acbeea stunnel-5.17-installer.exe 49d2cc11aefe2062576a0bbfafa3beb5ae541683d90972c6ed457b19a455c346 stunnel-5.17-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVQSIlAAoJEC78f/DUFuAU5XEP/R2d2gXCeKk7d/466dOYF//A YlXC6oDbs7OB8qEHH3u5u5hl8WIZJOmbPb79APSJKd7ESREoRk97UBJZYoH+QuEB CHOs0czty5IE2QyMibHJZ4Zed23q/QHrTRL9GpZd8EPkmiRG/dq7M+vC0gJJuF+N 4CPCNj464ATtjFB3mPju+wQinnWj8s57kNAazifAQNvM/jhdJOMH+BOvXIGEwUlt iZ8MBwO707j81UWkSFANxn1GMTOoJY2pTTAmJr/eKun9sLbuN7v4ec8Mtwdcj16P 5CeXD1g7gOK5q2FizIUWfBD38nPRVBXMqfSAkjtezwqZJb1K4bfa505E4SY3bKzL CJstbH206rQriqhpV4hrsuGVmb6M7lt57zAJZ746NQtlRm1gLdf/56JclsHqmkqo Z6zAuXRAiarkn88OsERp8r84Y4l8q/D8dkZwYPObSCT+SAMimPzLxhu9sjIKsb1I lSFNS2P9sEw/MhM9yQGfyC0GKzQWrQIONFHP2iCS8+ySEc+6/1b9tB9oiOcsAL1c edWV3m5SQzG7TbsbtApRy6Pvb30O7/5zAJOiBN6Yf5OQ8OyjL4M9+ZKd75qQxsQj IEZNJW/caVz9QwNWc2BQtaUVy7RC0CaTmbebsoQWlKQmzosXMU2QgC/WJ3jQdslz Vc3C3rKKvwGPw1DZLX95 =tC15 -----END PGP SIGNATURE-----

1 0

startup issues
by Coviello, Paul 24 Apr '15

24 Apr '15

Hi, Well I got it started on VMS and wanted to put it in debug mode, so I shut it down made my changes to the conf file and now well I can't start it with the command procedure. I even tried the old conf and same thing... $ @STUNNEL_STARTUP_SERVER Is the private key (in the PEM file) encrypted? [Y/N]: Y Enter the password to decrypt the key (please use paired double quotes with it): ""XXXXXXXXX"" Starting up a Stunnel %RUN-S-PROC_ID, identification of created process is 209FCA70 Stunnel server failed to start up-- check the configuration, etc. Nothing is logged... But if I do the following $ stunnel STUNNEL_SERVER.CONF And the output to the screen... 2015.04.24 10:35:24 LOG7[547326662:2071228096]: Snagged 64 random bytes from sys$common:[sysmgr].rnd 2015.04.24 10:35:24 LOG7[547326662:2071228096]: Wrote 1024 new random bytes to sys$common:[sysmgr].rnd 2015.04.24 10:35:24 LOG7[547326662:2071228096]: RAND_status claims sufficient entropy for the PRNG 2015.04.24 10:35:24 LOG7[547326662:2071228096]: PRNG seeded successfully 2015.04.24 10:35:24 LOG7[547326662:2071228096]: Certificate: stunnel.pem 2015.04.24 10:35:24 LOG7[547326662:2071228096]: Certificate loaded 2015.04.24 10:35:24 LOG7[547326662:2071228096]: Key file: stunnel.pem Enter PEM pass phrase: 2015.04.24 10:35:31 LOG7[547326662:2071228096]: Private key loaded 2015.04.24 10:35:31 LOG7[547326662:2071228096]: SSL context initialized for service telnet This is where it sits unless I do a ctrl-c to cancel and get back to the system prompt. And when I do my telnet session I cannot connect. Well I connect but no prompts for me to login But now I have log output! :) 2015.04.24 10:08:31 LOG5[547326662:2071228096]: stunnel undefined on vax-openvms with OpenSSL 0.9.8h 28 May 2008 2015.04.24 10:08:31 LOG5[547326662:2071228096]: Threading:PTHREAD Sockets:POLL,IPv4 2015.04.24 10:08:31 LOG6[547326662:2071228096]: file ulimit = 512 (can be changed with 'ulimit -n') 2015.04.24 10:08:31 LOG6[547326662:2071228096]: poll() used - no FD_SETSIZE limit for file descriptors 2015.04.24 10:08:31 LOG5[547326662:2071228096]: 250 clients allowed 2015.04.24 10:08:31 LOG7[547326662:2071228096]: FD 5 in non-blocking mode 2015.04.24 10:08:31 LOG7[547326662:2071228096]: FD 4 in non-blocking mode 2015.04.24 10:08:31 LOG7[547326662:2071228096]: FD 6 in non-blocking mode 2015.04.24 10:08:31 LOG7[547326662:2071228096]: SO_REUSEADDR option set on accept socket 2015.04.24 10:08:31 LOG7[547326662:2071228096]: telnet bound to 0.0.0.0: 2015.04.24 10:15:00 LOG3[547326662:2071228096]: Received signal 2; terminating 2015.04.24 10:18:18 LOG5[547326662:2071228096]: stunnel undefined on vax-openvms with OpenSSL 0.9.8h 28 May 2008 2015.04.24 10:18:18 LOG5[547326662:2071228096]: Threading:PTHREAD Sockets:POLL,IPv4 2015.04.24 10:18:18 LOG6[547326662:2071228096]: file ulimit = 512 (can be changed with 'ulimit -n') 2015.04.24 10:18:18 LOG6[547326662:2071228096]: poll() used - no FD_SETSIZE limit for file descriptors 2015.04.24 10:18:18 LOG5[547326662:2071228096]: 250 clients allowed 2015.04.24 10:18:18 LOG7[547326662:2071228096]: FD 5 in non-blocking mode 2015.04.24 10:18:18 LOG7[547326662:2071228096]: FD 4 in non-blocking mode 2015.04.24 10:18:18 LOG7[547326662:2071228096]: FD 6 in non-blocking mode 2015.04.24 10:18:18 LOG7[547326662:2071228096]: SO_REUSEADDR option set on accept socket 2015.04.24 10:18:19 LOG7[547326662:2071228096]: telnet bound to 0.0.0.0: 2015.04.24 10:21:08 LOG6[547326662:2071228096]: going to accept mode 2015.04.24 10:21:08 LOG7[547326662:2071228096]: telnet accepted FD=7 from 192.168.20.140:59281 2015.04.24 10:21:08 LOG6[547326662:2071228096]: accepted connection 2015.04.24 10:21:08 LOG7[547326662:8966656]: telnet started 2015.04.24 10:21:08 LOG7[547326662:8966656]: FD 7 in non-blocking mode 2015.04.24 10:21:08 LOG7[547326662:8966656]: TCP_NODELAY option set on local socket 2015.04.24 10:21:08 LOG5[547326662:8966656]: telnet accepted connection from 0.0.0.0: 2015.04.24 10:21:08 LOG7[547326662:8966656]: SSL state (accept): before/accept initialization 2015.04.24 10:21:30 LOG3[547326662:8966656]: SSL_accept: Peer suddenly disconnected 2015.04.24 10:21:30 LOG5[547326662:8966656]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2015.04.24 10:21:30 LOG7[547326662:8966656]: telnet finished (0 left) 2015.04.24 10:21:31 LOG6[547326662:2071228096]: going to accept mode 2015.04.24 10:21:31 LOG7[547326662:2071228096]: telnet accepted FD=7 from 192.168.20.140:59283 2015.04.24 10:21:31 LOG6[547326662:2071228096]: accepted connection 2015.04.24 10:21:31 LOG7[547326662:8966656]: telnet started 2015.04.24 10:21:31 LOG7[547326662:8966656]: FD 7 in non-blocking mode 2015.04.24 10:21:31 LOG7[547326662:8966656]: TCP_NODELAY option set on local socket 2015.04.24 10:21:31 LOG5[547326662:8966656]: telnet accepted connection from 0.0.0.0: 2015.04.24 10:21:31 LOG7[547326662:8966656]: SSL state (accept): before/accept initialization 2015.04.24 10:21:32 LOG3[547326662:8966656]: SSL_accept: Peer suddenly disconnected 2015.04.24 10:21:32 LOG5[547326662:8966656]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2015.04.24 10:21:32 LOG7[547326662:8966656]: telnet finished (0 left) 2015.04.24 10:21:33 LOG6[547326662:2071228096]: going to accept mode 2015.04.24 10:21:33 LOG7[547326662:2071228096]: telnet accepted FD=7 from 192.168.20.140:59284 2015.04.24 10:21:33 LOG6[547326662:2071228096]: accepted connection 2015.04.24 10:21:33 LOG7[547326662:8966656]: telnet started 2015.04.24 10:21:33 LOG7[547326662:8966656]: FD 7 in non-blocking mode 2015.04.24 10:21:33 LOG7[547326662:8966656]: TCP_NODELAY option set on local socket 2015.04.24 10:21:33 LOG5[547326662:8966656]: telnet accepted connection from 0.0.0.0: 2015.04.24 10:21:33 LOG7[547326662:8966656]: SSL state (accept): before/accept initialization 2015.04.24 10:21:34 LOG3[547326662:8966656]: SSL_accept: Peer suddenly disconnected 2015.04.24 10:21:34 LOG5[547326662:8966656]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2015.04.24 10:21:34 LOG7[547326662:8966656]: telnet finished (0 left) Paul J Coviello Senior System Administrator CCS Corporate Headquarters Two Wells Avenue, Newton, MA 02459 617.965.2000, Ext. 4004 [cid:[email protected]] [cid:[email protected]] CCS Commercial, LLC | CCS Resources, Inc. | ClaimAssist, LLC | Credit Control Services, Inc. Customer Contact Solutions, LLC | Enterprise Associates, LLC

2 4

Fwd: Comments/questions to Debian patches
by Michal Trojnara 24 Apr '15

24 Apr '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, Peter Pentchev, the Debian package maintainer for the "stunnel4" package, does not reply to my emails. I hope he is still alive and well, just too busy to maintain the package. I decided to share with you my comments to the patches that are applied to the Debian package. Hopefully, someone will find them useful. Mike - -------- Forwarded Message -------- Subject: Comments/questions to Debian patches Date: Tue, 28 Oct 2014 21:13:25 +0100 From: Michal Trojnara <Michal.Trojnara(a)mirt.net> To: Peter Pentchev <roam(a)ringlet.net> Hi Peter, Just a few comments/questions to improve the quality of Debian package. I'll be glad to discuss if you disagree with my opinions. 01-fix-paths.patch The patch description is quite outdated. Translation from sbin to bin was performed upstream in stunnel 4.21 released 27 Oct 2007. 8-) I guess: /usr/bin/stunnel -fd 10 \ should be: /usr/bin/stunnel4 -fd 10 \ Probably this should be added to the next patch: 02-rename-binary.patch 05-logrotate-warning-in-sample-conf.patch Good idea. I'll add it to stunnel 5.07. 08-client-example.patch I've already added this example in stunnel 5.02. Your patch adds it once again. Just remove it. 10-no-zlib-compression.patch I'm completely confused by this patch. According to my tests it only makes stunnel reporting different errors when a user tries to enable compression on Debian. Why would anyone need this patch? 11-no-rle-compression.patch IMHO OpenSSL bugs should be fixed in OpenSSL, and not in stunnel. YMMV 12-restore-pidfile-default.patch I strongly disagree with this approach, as it breaks configuration file compatibility with the upstream. Debian should instead rewrite stunnel.conf when upgrading from stunnel 4.xx. 14-lsb-init-functions.patch 8-) 15-upstream-systemd-libs.patch This (and more) will be included in stunnel 5.07. 16-upstream-sslv23-method.patch This will be included in stunnel 5.07. Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJVNsCAAAoJEC78f/DUFuAUpfUP/j13koMgtnVLfsACIqUEaZw3 1uADOP/Dugqbn/QcwSqWAlcTrf7So98AQrB88xAhN8C3fwP375GmcNmPgJx4RRme fU/Wo0aFaCq0JOReiQkNiyj3pqf+J2NxZlZM5ZpzzpA80x8AlyLqBwPfBAtxgYNJ rb5AyIoGPkzfXM8OSz8YJXZtgXT4lrSCE5djlWHHBqy9ioUZCEuyVXeT5Y90sXOg wOA/EX3fTKEJZckoiNoTPAh9pLZ9M29lLM7wLEu5BFWwh/TtHk0ZFADo3Kzi/+4G Q6h9236DmH1NHA/FzMfFbKEYz/0yeOUMfet8LsRNNRRrFJEp+miMemSYajGMA3IT UVW4UNOa+CppVgkRpVMGfl/Lw53GP63xbLIRuZs17py03hNBHz2pyZneWWKTJEun xJQC4QJ3Z3YYXd71jpHIKjcDBXmIzcG8Z9QylaTywk8MBBBpjuRTXkIAlWWj2Iyk LVRsAgtooUKlQzUoAoseRygDv+Wbp/qVNL1Zogy7PmfORmqZOz08jRpDlXFgjPjR evGztgApTR+FSMO9f052z/Sql0chb5mhtdAtdBKpRE3CgtIrCHfcalSOyeCleHJK NMEbqfed9Oq2WA0/W89ilGtJWRH4v0GnYCfbYhbSoXp9DytdHPbhRUsiJL8LO34b 1cuMSsQ9LjF+3WyRie4m =SrZs -----END PGP SIGNATURE-----

2 2

Redis with stunnel, need to reset a client connection if the remote server drops
by Cocytus 20 Apr '15

20 Apr '15

Hello all, I've spent some time digging through the archives, but have yet to turn up a solution to the issue I'm having. We're using Redis instances on 'cloud' resources, and have successfully gotten stunnel setup as a server on these nodes. Additionally an internal process runs and connects to a local stunnel client that then connects to the remote cloud instance. This is working well enough at the moment, however there is one issue I'm bumping into. If the remote EC2 node goes dark for a bit (ie: reboot), the local stunnel client will reconnect, however the internal process which is establishing its connection to the local stunnel client does not get disconnected and therefore doesn't know that redis became unavailable and needs to re-subscribe to the redis stream. I need to invalidate the established session when the remote reconnects. Can this be accomplished with either a TIMEOUT value or session statement? Below is a sample of the configuration: ########### [some-ec2-node.com] client = yes verify = 2 CApath = /etc/ssl/certs sslVersion = TLSv1 accept = 127.0.0.1:10008 connect = some-ec2-node.com:6379 ########### $ stunnel4 -version stunnel 4.53 on x86_64-pc-linux-gnu platform Compiled with OpenSSL 1.0.1e 11 Feb 2013 Running with OpenSSL 1.0.1f 6 Jan 2014 Update OpenSSL shared libraries or rebuild stunnel Threading:PTHREAD SSL:+ENGINE+OCSP Auth:LIBWRAP Sockets:POLL+IPv6 Global options: debug = daemon.notice pid = /var/run/stunnel4.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = ALL:!SSLv2:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH curve = prime256v1 session = 300 seconds sslVersion = TLSv1 for client, all for server stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none -- Josh

2 1

stunnel 5.16 release
by Michal Trojnara 19 Apr '15

19 Apr '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.16 of stunnel. This release only fixes a compilation issue with old versions of gcc. The Win32/Android binaries are basically the same as for version 5.15. The ChangeLog entry: Version 5.16, 2015.04.19, urgency: MEDIUM: * Bugfixes - Fixed compilation with old versions of gcc. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: b6b7e93fb2626eaabae1c8474e1dfa23962cfde8fa35c8602289fcaa4f53608d stunnel-5.16.tar.gz a701e6421c3020cc832ecb0e3a897c427a3838e0e180999ed8d905a9283fbb97 stunnel-5.16-installer.exe 2e559cc300b678fb2d05c2d2d3dc13d16cb44915f0165bea6290f741fccaa54c stunnel-5.16-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVM7KGAAoJEC78f/DUFuAUWwoQAJUnjUpyNLhjUQxRwScKjgNx AJ5OPZHXwVjX+xvtSSOjlkK/pk5l4SaEbNtq6hwMGliDpowXXDGXeYwNbmACXGuM sZWzdTUC69WKLQcwfTmn5BmsPQtczaCDQdyBVGSII4qg0mFIU4e1GYT0t8od7OcU n17nnRCLEaS2xlDwR5ImMuRjD+BdpEgZdiRXqtJkyjX8+aSRsEtSVjDBJ5wtsYNN 9pyMp8xU+7+sxX5GiLQ8+IcqcUq+W53nMJQZmN5vQ8O2ShxuBeZYdvembPhybvlE NrnfmjvDtl6A0iFs8ZhRRPTJZTKqj88UGhn49g3eQBH+CbNK08GalWCwR/uX8yFb +Z801mNIxJQrPnSlSaWLDPGNQ9GBqxliui1IR+Biv1KpmcPWBDAOI+Y7Hqyy1/5r MUDT9GB4HLZTC6aWtR0IyG30w3CvUmNr+sENu91ewvl0I1Z04yWyK+wQ3L3CbWyk aVBaNmt09pR8zgU9nvw8aAE2MLJ5oCgoangGpO6rEL0frh7TZhzD9sOMMVefKZDY rPPApyOiphH+3nnh9EiM357S9saXJMFe8/gNh6+lNXmYJ0ngMcPybz9mNV+RbbZU P1itA5RYBAwDTEJcpvATEj8ni9YPdDdFVmMrvC7ay5KZo0HWHxH23ryShBN9XYjC diuX4vtV2LMVYV5dlmAj =Eer2 -----END PGP SIGNATURE-----

1 0