- stunnel-users - stunnel.org

SSL alert (read): warning: close notify
by Jinming Shao 22 Dec '14

22 Dec '14

I am trying to use stunnel to turn ws into wss. Stunnel is running in client mode. It always got disconnected from remote server. my stunnel configuration: [websocket] client = yes accept = localhost:8676 connect = echo.websocket.org:443 Then I use wsdump.py(https://github.com/liris/websocket-client) to connect it: $ wsdump.py ws://localhost:8676 Handshake status 40 Does anyone know what's wrong? The log file: 2014.12.22 23:13:01 LOG7[4445147136]: Service [websocket] started 2014.12.22 23:13:01 LOG5[4445147136]: Service [websocket] accepted connection from ::1:52132 2014.12.22 23:13:01 LOG6[4445147136]: s_connect: connecting 174.129.224.73:443 2014.12.22 23:13:01 LOG7[4445147136]: s_connect: s_poll_wait 174.129.224.73:443: waiting 10 seconds 2014.12.22 23:13:02 LOG5[4445147136]: s_connect: connected 174.129.224.73:443 2014.12.22 23:13:02 LOG5[4445147136]: Service [websocket] connected remote server from 192.168.1.100:52133 2014.12.22 23:13:02 LOG7[4445147136]: Remote socket (FD=10) initialized 2014.12.22 23:13:02 LOG6[4445147136]: SNI: sending servername: echo.websocket.org 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): before/connect initialization 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): SSLv3 write client hello A 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): SSLv3 read server hello A 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): SSLv3 read server certificate A 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): SSLv3 read server done A 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): SSLv3 write client key exchange A 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): SSLv3 write change cipher spec A 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): SSLv3 write finished A 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): SSLv3 flush data 2014.12.22 23:13:02 LOG7[4445147136]: SSL state (connect): SSLv3 read finished A 2014.12.22 23:13:02 LOG7[4445147136]: 1 items in the session cache 2014.12.22 23:13:02 LOG7[4445147136]: 1 client connects (SSL_connect()) 2014.12.22 23:13:02 LOG7[4445147136]: 1 client connects that finished 2014.12.22 23:13:02 LOG7[4445147136]: 0 client renegotiations requested 2014.12.22 23:13:02 LOG7[4445147136]: 0 server connects (SSL_accept()) 2014.12.22 23:13:02 LOG7[4445147136]: 0 server connects that finished 2014.12.22 23:13:02 LOG7[4445147136]: 0 server renegotiations requested 2014.12.22 23:13:02 LOG7[4445147136]: 0 session cache hits 2014.12.22 23:13:02 LOG7[4445147136]: 0 external session cache hits 2014.12.22 23:13:02 LOG7[4445147136]: 0 session cache misses 2014.12.22 23:13:02 LOG7[4445147136]: 0 session cache timeouts 2014.12.22 23:13:02 LOG7[4445147136]: Peer certificate was cached (6641 bytes) 2014.12.22 23:13:02 LOG6[4445147136]: SSL connected: new session negotiated 2014.12.22 23:13:02 LOG6[4445147136]: Negotiated TLSv1/SSLv3 ciphersuite: RC4-SHA (128-bit encryption) 2014.12.22 23:13:02 LOG6[4445147136]: Compression: null, expansion: null 2014.12.22 23:13:03 LOG7[4445147136]: SSL alert (read): warning: close notify 2014.12.22 23:13:03 LOG6[4445147136]: SSL closed (SSL_read) 2014.12.22 23:13:03 LOG7[4445147136]: Sent socket write shutdown 2014.12.22 23:13:03 LOG6[4445147136]: Read socket closed (readsocket) 2014.12.22 23:13:03 LOG7[4445147136]: Sending close_notify alert 2014.12.22 23:13:03 LOG7[4445147136]: SSL alert (write): warning: close notify 2014.12.22 23:13:03 LOG6[4445147136]: SSL_shutdown successfully sent close_notify alert 2014.12.22 23:13:03 LOG5[4445147136]: Connection closed: 184 byte(s) sent to SSL, 132 byte(s) sent to socket 2014.12.22 23:13:03 LOG7[4445147136]: Remote socket (FD=10) closed 2014.12.22 23:13:03 LOG7[4445147136]: Local socket (FD=3) closed 2014.12.22 23:13:03 LOG7[4445147136]: Service [websocket] finished (0 left) 2014.12.22 23:13:03 LOG7[4445147136]: str_stats: 3 block(s), 18446744073709549504 data byte(s), 222 control byte(s) 2014.12.22 23:13:03 LOG7[4445147136]: str_stats: 128 byte(s) at network.c:413 2014.12.22 23:13:03 LOG7[4445147136]: str_stats: 128 byte(s) at network.c:412 2014.12.22 23:13:03 LOG7[4445147136]: str_stats: 128 byte(s) at network.c:41

1 0

RHEL6 Update stunnel-4.29-3.el6_6.1 breaks functionality?
by H.U.Flück 21 Dec '14

21 Dec '14

Hello I realized that the latest RHEL6 updates including stunnel-4.29-3.el6_6.1 break our Stunnel connections! We are forced to go back to previous version stunnel-4.29-3.el6_4 in order to have the systems running again, and blocking Stunnel updates in /etc/yum.conf for the moment. Our typical client config and server configs are as follows: Client (5.08): ********** client = yes compression = zlib sslversion = TLSv1 delay = yes debug = 7 taskbar = yes cert = my.pem [abas_ssh] accept = 127.0.30.10:5303 connect = firewall.client.dom:5303 Server, xinetd.d: ************* service stunnel_ssh { disable = no socket_type = stream instances = UNLIMITED per_source = UNLIMITED wait = no user = root server = /usr/bin/stunnel server_args = /etc/stunnel/stunnel_ssh.conf log_on_success += HOST DURATION log_on_failure += HOST } Server, stunnel_ssh.conf **************** cert = /support/stunnel/cert/server.pem CApath = / support /stunnel/hash/ verify = 3 debug = 7 connect = 192.168.1.100:22 The error thrown is something like: Dec 17 17:30:23 srvabas stunnel: LOG3[3385:140171595282368]: SSL_accept: 140760FC: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol What are we missing? Do we need to change the configuration? Any help is highly appreciated. Kind regards H.U.Flueck

4 3

Ordinal not found error on new Stunnel install
by Tracy Drake - IQ-C 15 Dec '14

15 Dec '14

Hello Michal! We have just pushed/began to push Stunnel version 5.04 to our user community. This version was extensively tested, pushed/installed on a number of machines both with an older version of Stunnel and no Stunnel at all. We are having a barrage of users encountering the below error. [image: Inline image 1] Can you offer insight/a quick resolution? Bear in mind that although I support the apps that require Stunnel I know very little about the ins and outs of Stunnel. I did google this error and found something to the effect that a newer version of the LIBEAY32.dll is required. Does this perhaps mean that this file did not get replaced on these machines. We were previously running quite an older version - 4.27. Please advise asap! -- Tracy Drake CSM Senior Consultant GSA-FAS CAMEO Contractor URSA & INFOConnect Support & Training Team Lead 704-987-1211 tracy.drake(a)gsa.gov

2 1

building stunnel in FreeBSD
by Mirimir 11 Dec '14

11 Dec '14

In building the stunnel package from the port in FreeBSD 10.1, is it more secure to enable SSL_PORT? In particular, will that ensure that stunnel is using the latest openssl release? And if that is so, why is that build option disabled by default?

1 0

Stunnel PSK authentication
by Michal Trojnara 11 Dec '14

11 Dec '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, Starting with stunnel-5.09b1 it is now possible to use stunnel without certificates. https://www.stunnel.org/downloads.html Example server configuration is: [PSK server] accept = <stunnel_port> connect = <dst_port> PSKsecrets = psk.txt , where the psk.txt may contain the following lines: test1:oaP4EishaeSaishei6rio6xeeph3az test2:yah5uS4aijooxilier8iaphuwah1Lo Example client configuration: [PSK client 1] client = yes accept = 127.0.0.1:<src_port> connect = <stunnel_ip>:<stunnel_port> PSKsecrets = psk1.txt PSKidentity = test1 The psk1.txt file only needs to contain: test1:oaP4EishaeSaishei6rio6xeeph3az Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlSKHNMACgkQ/NU+nXTHMtE72wCg/EZp4NdVnkrQFffGVWZO65lE QucAn3ddp+yTDruP+gNkevf///0olb1+ =o0k3 -----END PGP SIGNATURE-----

1 0

configure.ac patch
by Kip Walraven 11 Dec '14

11 Dec '14

In case others are struggling with CentOS 6.5 configure issues that I had, I'm providing the following unified diff patch -Kip #============================================== --- ../stunnel-5.08/configure.ac 2014-12-03 05:35:16.000000000 -0500 +++ ./configure.ac 2014-12-11 10:32:47.000000000 -0500 @@ -402,13 +402,13 @@ AC_MSG_RESULT([autodetecting]) # the library name has changed to -lsystemd in systemd 209 AC_SEARCH_LIBS([sd_listen_fds], [systemd systemd-daemon], - AC_CHECK_HEADERS([systemd/sd-daemon.h], [ + [ AC_CHECK_HEADERS([systemd/sd-daemon.h], [ AC_DEFINE([USE_SYSTEMD], [1], [Define to 1 to enable systemd socket activation]) AC_MSG_NOTICE([systemd support enabled]) ], [ AC_MSG_NOTICE([systemd header not found]) - ]), [ + ]) ], [ AC_MSG_NOTICE([systemd library not found]) ]) ] @@ -462,7 +462,8 @@ AC_MSG_CHECKING([for compiler sysroot]) if test "$GCC" = yes; then SYSROOT=`$CC --print-sysroot 2>/dev/null` -else +fi +if test -z "$SYSROOT" ; then SYSROOT="/" fi AC_MSG_RESULT([$SYSROOT]) #==============================================

2 1

Can I run stunnel on TWO computers with the same certificates?
by Ben Stover 09 Dec '14

09 Dec '14

I would like to use stunnel from my DEsktop AND my Notebook. Can I run them in parallel (with the same certificates) or do they confuse each other? Ben

1 0

stunnel 5.08 released
by Michal Trojnara 09 Dec '14

09 Dec '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.08 of stunnel. The ChangeLog entry: Version 5.08, 2014.12.09, urgency: MEDIUM: * New features - Added SOCKS4/SOCKS4a protocol support. - Added SOCKS5 protocol support. - Added SOCKS RESOLVE [F0] TOR extension support. - Updated automake to version 1.14.1. - OpenSSL directory searching is now relative to the sysroot. * Bugfixes - Fixed improper hangup condition handling. - Fixed missing -pic linker option. This is required for Android 5.0 and improves security. To setup SOCKS4 VPN configure the following client service: [socks_client] client = yes accept = 127.0.0.1:1080 connect = vpn_server:9080 verify = 4 CAfile = stunnel.pem The corresponding configuration on the vpn_server host: [socks_server] protocol = socks accept = 9080 cert = stunnel.pem key = stunnel.key SOCKS-enabled clients (e.g. web browsers) can now use stunnel client for a VPN service. Encrypted DNS resolver is supported with SOCKS4a, SOCKS5, and SOCKS RESOLVE [F0] TOR extension. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 830b21d24cd237e96f4d7993be43553d4eba4d3cfa2660faa78dec8d41d314fc stunnel-5.08.tar.gz 84c06c8a3f8b6bbb5c1a2b6e352c70bdad1c87f1d5a37476e5dee02f2d65065c stunnel-5.08-installer.exe 28750afe9e5fec4b60b98468ea834cd126e149e8d97074b813b216723a889802 stunnel-5.08-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlSGzsMACgkQ/NU+nXTHMtHQlwCgwsX66e0EU5PMxsfMCdC5sfVt Fy4AnRXe65YLabb7K1XOn6tKncEH0smR =WP5h -----END PGP SIGNATURE-----

1 0

stunnel with TLSv1.2 ciphers
by Jérémy WILLIAME 08 Dec '14

08 Dec '14

Hi, I want to use stunnel with TLSv1.2 ciphers but it doesn't work. I use stunnel 5.07 compiled from source with prefix /opt/stunnel and lastest openssl (1.0.1j) This is my main configuration file: chroot = /opt/stunnel/var/lib/stunnel/ pid = /stunnel4.pid **cert = /opt/stunnel/etc/blabla/bla.pem key = /opt/stunnel/etc/blabla/bla.key ciphers = ECDHE-ECDSA-AES256-GCM-SHA384 options = NO_SSLv2 [imaps] accept = 993 connect = 143 I had to use one of this ciphers: ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES256-SHA384 DHE-RSA-AES256-GCM-SHA384 When i tried to use imaps connection over stunnel : root@bla: imtest -a homer -w homer -p 993 -s localhost SSL_connect error 0 SSL session removed failure: TLS negotiation failed if i use a SSLv3 cipher it works. root@bla: imtest -a homer -w homer -p 993 -s localhost verify error:num=18:self signed certificate TLS connection established: TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits) Someone have any idea ? Thanks. Jeremy

2 1

Stunnel for android
by Neacsu Mihai Adrian 03 Dec '14

03 Dec '14

Hello everyone. I am new to Stunnel, but i would like to compile a working version for Android L. The android version on the website is not compiled with PIE support, thus it does not run on Android L. I tried to look through the source code, and add the flags, -fPie and -pie, but i did not figure out where to do that. Also, after settings 755 on build-android.sh and running it, i get Permission denied on creating folders inside the /bin/android folder, even if i am running as root user. Any help is highly appreciated and i appologize if this has been already write in the archives, but i was not able to find anything related.

2 2

Memory leak on reconfiguration
by Alexander Paramonov 21 Nov '14

21 Nov '14

Hello, colleagues! I suppose there is a memory leak on stunnel reconfiguration when it receives the SIGHUP signal. Here is my experiment with stunnel 5.05 on linux: ~/busybox $ cat /home/posdebug/stunnel.cfg debug=6 options=NO_SSLv2 pid=/tmp/stunnel.pid [57797] accept = 127.0.0.1:57797 connect = 80.90.125.219:64141 key = /usr/unsign/key.pem cert = /usr/unsign/cert.pem CAfile = /usr/unsign/cert.pem verify = 2 ciphers = AES128-SHA:AES256-SHA:DES-CBC3-SHA:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:EDH-RSA-DES-CBC3-SHA sslVersion = all TIMEOUTbusy = 100 TIMEOUTconnect = 100 client = yes ~/busybox $ /usr/postunnel/stunnel /home/posdebug/stunnel.cfg ~/busybox $ top | grep stunnel 986 1 posdebug S *3592* 5.7 0 0.0 /usr/postunnel/stunnel /home/posdebug/stunnel.cfg ~/busybox $ kill -1 986 ~/busybox $ kill -1 986 ~/busybox $ kill -1 986 ~/busybox $ kill -1 986 ~/busybox $ kill -1 986 ~/busybox $ top | grep stunnel 986 1 posdebug S *3720* 5.9 0 0.0 /usr/postunnel/stunnel /home/posdebug/stunnel.cfg ~/busybox $ kill -1 986 ~/busybox $ kill -1 986 ~/busybox $ kill -1 986 ~/busybox $ kill -1 986 ~/busybox $ top | grep stunnel 986 1 posdebug S *3848* 6.2 0 0.0 /usr/postunnel/stunnel /home/posdebug/stunnel.cfg As i noticed, there are a lot of allocs on reconfiguration and only a few free() calls. Why? RAM is not unlimited, as far as i know. Any comments would be highly appreciated. -- Best regards Alexander Paramonov Software Engineer Terminal Technologies

2 4

Errors after upgrading to 5.07
by Mikhail Idris 17 Nov '14

17 Nov '14

Hello, I have recently upgraded to 5.07. But now, the console is spamming with messages such as: SSL_read returned WANT_READ: retrying Is this a critical error? Will it have any impact of any services that are currently using stunnel? Thank you. Regards, Mikhail

2 3

SSLscan does not display a certificate when connecting to stunnel
by Swonk, Glenn 15 Nov '14

15 Nov '14

When I open a connection to display the certificate, it works from openssl. openssl s_client -connect x58.swonk.com:444 However, when I use SSLScan, it only displays the supported server ciphers. SSLScan.exe --no-failed --sslv3 x58.swonk.com:444 I am troubleshooting a problem with a device which cannot connect directly to my https server and am trying to use stunnel to either forward the connection or help understand why it isn't working. The strange thing is that the 'Charles Proxy' (http://www.charlesproxy.com/) seems to forward the requests properly. Can anyone download a copy of SSLscan and test it against their connection? Any other ideas what may be the issue? thanks, glenn ___ ___| |___ ___ __ _ _ __ / __/ __| / __|/ __/ _` | '_ \ \__ \__ \ \__ \ (_| (_| | | | | |___/___/_|___/\___\__,_|_| |_| Version 1.8.2-win http://www.titania.co.uk Copyright Ian Ventura-Whiting 2009 Compiled against OpenSSL 0.9.8m 25 Feb 2010 esting SSL server x58.swonk.com on port 444 Supported Server Cipher(s): Accepted TLSv1 256 bits DHE-RSA-AES256-SHA Accepted TLSv1 256 bits AES256-SHA Accepted TLSv1 128 bits DHE-RSA-AES128-SHA Accepted TLSv1 128 bits AES128-SHA Accepted TLSv1 168 bits EDH-RSA-DES-CBC3-SHA Accepted TLSv1 56 bits EDH-RSA-DES-CBC-SHA Accepted TLSv1 168 bits DES-CBC3-SHA Accepted TLSv1 56 bits DES-CBC-SHA Accepted TLSv1 128 bits IDEA-CBC-SHA Accepted TLSv1 128 bits RC4-SHA Accepted TLSv1 128 bits RC4-MD5 Prefered Server Cipher(s): TLSv1 256 bits DHE-RSA-AES256-SHA ________________________________ This message may contain confidential information. If you are not the intended recipient of this e-mail, do not disseminate, distribute or copy this e-mail and delete this e-mail from your system.

1 0

socks4 support
by Michal Trojnara 15 Nov '14

15 Nov '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, Please take a look at the latest stunnel-5.08b4 available for download on https://www.stunnel.org/downloads.html It adds support for SOCKS4 and SOCKS4a protocols. The SOCKS protocol itself is encapsulated within SSL/TLS encryption layer to protect the final destination address. http://www.openssh.com/txt/socks4.protocol http://www.openssh.com/txt/socks4a.protocol The BIND command of the SOCKS protocol is not supported. The USERID parameter is ignored. To setup SOCKS4 VPN configure the following client service: [socks_client] client = yes accept = 127.0.0.1:1080 connect = vpn_server:9080 verify = 4 CAfile = stunnel.pem The corresponding configuration on the vpn_server host: [socks_server] protocol = socks accept = 9080 cert = stunnel.pem key = stunnel.key Now test your configuration on the client machine with: curl --socks4a localhost http://www.example.com/ Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlRmVXgACgkQ/NU+nXTHMtHuZwCfXlH0YYTHYhThoXPrCgV4OhrE BwsAoLgIpVWDOdBbISzrP53m2H9LUR6W =9DEh -----END PGP SIGNATURE-----

1 1

External validation of client certificates
by Rene Bartsch 15 Nov '14

15 Nov '14

Hi, we're having a special use case and hope to find a solution in stunnel. In our use case clients use self-signed X.509 certificates to authenticate with our TLS-server. We don't have a CA but a database with usernames (DN) and fingerprints of the client-certificates. Is it possible with stunnel not to validate the client certificates against a CA but handover the Distinguished Name to an external application which returns the fingerprint to check the certificate against? -- Best regards, Rene Bartsch, B. Sc. Informatics Current Bitcoin Exchange Rate: https://www.bitcoin.de/de/r/mwfngu

2 1

How to enable weak ciphers in stunnel
by Swonk, Glenn 15 Nov '14

15 Nov '14

When I run stunnel, I would like to enable the weaker ciphers and protocols (SSLv3) for testing purposes. However, adding options to the stunnel.conf file doesn't seem to return new ciphers during the negotiation (using sslscan to generate the report). I have look through the documentation and it doesn't seem to address these options very well. Thanks, glenn options = SSLv2 ;;ciphers = DH+AES ;;ciphers = HIGH:LOW ;;ciphers = HIGH:MEDIUM ciphers = ALL Supported Server Cipher(s): Accepted TLSv1 256 bits DHE-RSA-AES256-SHA Accepted TLSv1 256 bits AES256-SHA Accepted TLSv1 128 bits DHE-RSA-AES128-SHA Accepted TLSv1 128 bits AES128-SHA Accepted TLSv1 168 bits EDH-RSA-DES-CBC3-SHA Accepted TLSv1 56 bits EDH-RSA-DES-CBC-SHA Accepted TLSv1 168 bits DES-CBC3-SHA Accepted TLSv1 56 bits DES-CBC-SHA Accepted TLSv1 128 bits IDEA-CBC-SHA Accepted TLSv1 128 bits RC4-SHA Accepted TLSv1 128 bits RC4-MD5 Prefered Server Cipher(s): TLSv1 256 bits DHE-RSA-AES256-SHA ________________________________ This message may contain confidential information. If you are not the intended recipient of this e-mail, do not disseminate, distribute or copy this e-mail and delete this e-mail from your system.

2 1

capi, other engines not found at runtime
by Derek Cole 14 Nov '14

14 Nov '14

Hello, I am trying to compile stunnel on windows instead of using the pre-built binaries. When I run stunnel.exe, and have engine=capi in my stunnel.conf file, i get the following [ ] Enabling support for engine 'capi' [!] error queue: 2606A074: error:2606A074:engine routines:ENGINE_by_id:no such engine [!] error queue: 260B6084: error:260B6084:engine routines:DYNAMIC_LOAD:dso not found [!] error queue: 25070067: error:25070067:DSO support routines:DSO_load:could not load the shared library [!] ENGINE_by_id: 25078067: error:25078067:DSO support routines:WIN32_LOAD:could not load the shared library [!] Line 17: "engine = capi": Failed to open the engine Is this something wrong at link time in my compile? I used a precompiled version of OpenSSL, and modified this: SSLDIR=C:\OpenSSL-Win32 INCDIR=$(SSLDIR)\include LIBDIR=$(SSLDIR)\lib I thought that was all that would be needed, but apparently not. I then tried to go to make this modification: SSLLIBS=/LIBPATH:"$(LIBDIR)" libeay32.lib ssleay32.lib capi.lib thinking that maybe I need to explicitly add capi in, and again it compiles, but does not run. I have also tried to move the capi.dll from the LIBDIR into the same folder as the stunnel executable to make sure it was found, and I still have had no luck. Any ideas?

1 0

Building stunnel in Visual Studio
by Derek Cole 13 Nov '14

13 Nov '14

Hello, I am interested in tweaking something with stunnel for windows. I was trying to find if there were instructions for building the software on windows using Visual Studio. I found a deprecated FAQ that said that it was possible to compile with Visual C++. Can anyone give me any pointers on how to get up and going? http://www.onsight.com/faq/stunnel/stunnel-faq-3.html Thanks

2 1

Re: [stunnel-users] Certificate
by Vitic Zikica (EXT) 12 Nov '14

12 Nov '14

HI, We are using stunnel to connect to some servers. The client informed us that we have to use new 2048 bit certificate ( XXXXX.crt ) Is it supported by stunnel ? how can I install it ? Thank you . Zikica VITIC BFI-DSI-FIS-ETRADING-ARCHITECTURE 47, quai d'Austerlitz 75648 Paris Cedex 13 Phone: +(33) 1 58 55 31 84 E-mail: flux(a)natixis.com<mailto:[email protected]> L'integrite de ce message n'etant pas assuree sur internet, Natixis ne peut etre tenu responsable de son contenu. Toute utilisation ou diffusion non autorisee est interdite. Si vous n'etes pas destinataire de ce message, merci de le detruire et d'avertir l'expediteur. Ensemble, faisons un geste pour l'environnement : n'imprimons nos mails que si necessaire. The integrity of this message cannot be guaranteed on the Internet. Natixis can not therefore be considered responsible for the contents. Any unauthorized use or dissemination is prohibited. If you are not the intended recipient of this message, then please delete it and notify the sender. Let us mind the environment : let's print our mails only when necessary

1 0

Output to neither stdout nor stderr it seems
by Casper Thomsen 10 Nov '14

10 Nov '14

Hi stunnel-users I run stunnel4 in docker with the following config file: --- /etc/stunnel/stunnel.conf -------------- sslVersion = SSLv3 pid = /var/lib/stunnel4/stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 2 CApath = /etc/ssl/certs debug = notice output = /var/log/stunnel.log client = yes foreground = yes [foo] accept = 1234 connect = 127.0.0.1:2345 TIMEOUTclose = 3 --------------------------------------------------------- When I run stunnel and pipe stdout and stderr to /dev/null, I still get output: root@849b7eb3bbd0:/# /usr/bin/stunnel4 /etc/stunnel/stunnel.conf 2>/dev/null >/dev/null stunnel: LOG5[258:140421949949696]: stunnel 4.53 on x86_64-pc-linux-gnu platform stunnel: LOG5[258:140421949949696]: Compiled/running with OpenSSL 1.0.1e 11 Feb 2013 stunnel: LOG5[258:140421949949696]: Threading:PTHREAD SSL:+ENGINE+OCSP Auth:LIBWRAP Sockets:POLL+IPv6 stunnel: LOG5[258:140421949949696]: Reading configuration from file /etc/stunnel/stunnel.conf stunnel: LOG5[258:140421949949696]: Configuration successful ^Cstunnel: LOG3[258:140421949949696]: Received signal 2; terminating Complete shell output is attached. Any hints on what's happening? Kindly, -- Casper Thomsen

3 4

Truncated responses with stunnel >= 5.05
by Tuomas Silen 07 Nov '14

07 Nov '14

Hi there, After upgrading to stunnel 5.07 I've seen a lot of truncated http responses. I've tested different versions and 5.04 is the last one to work fine. There seems to be fixes to a similar issue in 5.05, but at least for me the result seems to be the opposite. I'm on Ubuntu 12.04. Looking at the logs, the log entries are identical except for one part, the amount of data sent to SSL: stunnel >= 5.05, not working: LOG3[31153]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing LOG5[31153]: Connection closed: 67584 byte(s) sent to SSL, 184 byte(s) sent to socket stunnel 5.04, works: LOG3[6248]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing LOG5[6248]: Connection closed: 113051 byte(s) sent to SSL, 184 byte(s) sent to socket It's worth noting that in both cases the closing happens after TIMEOUTclose has exceeded (probably because of a missing close notify?). In any case, apparently less data is sent to SSL and that's how it seems like; the end of the http responses get truncated. If everything's very fast (e.g. localhost connections only) the problem seems not to happen, not very often at least. With connections between two servers I've been able to reproduce it pretty much every time in my setup (stunnel -> haproxy -> apache -> unicorn). Undefining the POLLRDHUP or reverting the changes in 5.05 to src/client.c seem to fix the problem for me. Any ideas what would be a proper fix? Thanks! Best regards, Tuomas Silen

3 5

[BUG] SSL directory scan breaks cross-compilation
by John Spencer 05 Nov '14

05 Nov '14

it seems between 5.02 and 5.06 a "SSL directory scan" was introduced. for main_dir in /usr/local /usr/lib /usr/pkg /opt/local /opt /usr; do for sub_dir in /ssl /openssl /; do check_ssl_dir "$main_dir$sub_dir" && break 2 this ofc breaks cross-compilation. the concept of searching for a library directory is completely broken. if just adding -lssl -lcrypto to LDFLAGS doesnt find the openssl libraries at link time, the user's compiler toolchain is wrongly set up, and its not the job of a package to work around that by searching through a number of directories. it's the user's job to fix his toolchain by supplying the right -L paths in case he's got his library installed in a non-standard location. also, there's pkg-config (which supports crosscompilation via a PKG_CONFIG_SYSROOT_DIR env var) in case a library needs elaborate CFLAGS. --JS

2 6

slight fix for tools/stunnel.conf-sample.in
by Gleydson Soares 03 Nov '14

03 Nov '14

----- Forwarded message from Gleydson Soares <gsoares(a)gmail.com> ----- Date: Mon, 3 Nov 2014 17:00:38 -0300 From: Gleydson Soares <gsoares(a)gmail.com> To: stunnel-users(a)stunnel.org Cc: Marzena.Trojnara(a)mirt.net Subject: slight fix for tools/stunnel.conf-sample.in User-Agent: Mutt/1.5.23 (2014-03-12) Hi, I noticed unexpected characters in stunnel.conf-sample.in, stunnel 5.07. following diff fix that. --, Gleydson. ----- End forwarded message -----

1 0

stunnel 5.07 released
by Michal Trojnara 01 Nov '14

01 Nov '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.07 of stunnel. The ChangeLog entry: Version 5.07, 2014.11.01, urgency: MEDIUM: * New features - Several SMTP server protocol negotiation improvements. - Added UTF-8 byte order marks to stunnel.conf templates. - DH parameters are no longer generated by "make cert". The hardcoded DH parameters are sufficiently secure, and modern TLS implementations will use ECDH anyway. - Updated manual for the "options" configuration file option. - Added support for systemd 209 or later. - New --disable-systemd ./configure option. - setuid/setgid commented out in stunnel.conf-sample. * Bugfixes - Added support for UTF-8 byte order mark in stunnel.conf. - Compilation fix for OpenSSL with disabled SSLv2 or SSLv3. - Non-blocking mode set on inetd and systemd descriptors. - shfolder.h replaced with shlobj.h for compatibility with modern Microsoft compilers. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 505c6c63c4a20fc0cce8c35ef1ab7626c7b01071e3fca4ac6ea417afe8065309 stunnel-5.07.tar.gz 0e8d41a8102437d2c04a347bfe38ad80408fd2eb1451c559dcc7932ff2d09bd9 stunnel-5.07-installer.exe d3ced258ad35bea656ec178644d83e7d0b9fe8a2e4b2d6511e5c898ac9e6c7fc stunnel-5.07-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlRU61wACgkQ/NU+nXTHMtEwLwCdEprl4s5aleq7+MzK9JmYcnQ+ q+gAniP9aOtMuQtML9zcRPK0LY6Yb/3H =IVK/ -----END PGP SIGNATURE-----

1 0

Help needed to load hierarchical chain of certificates
by Rejuan Masud Masud 31 Oct '14

31 Oct '14

Help needed to load hierarchical chain of certificates(Root, CA) when stunnel running in server mode. We are trying to load. but only server signed certificate is loading which is assigned in cert as below, CAfile=/u01/stunnel/AMEX_all/CA.PEM cert=/u01/stunnel/AMEX_all/cert.pem HOW TO LOAD HIERARCHICAL CHAIN OF CERTIFICATES?

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users