- stunnel-users - stunnel.org

IP Address on hte Destination
by Stewart Anderson 03 Oct '13

03 Oct '13

Hi, When a source address connects to a remote destination, via stunnel, what IP address is visible to the destination as the source address? The address of the source or the host where stunnel is running? I see some settings for transparency but I just have a plain connect= for my services. My source and stunnel are on different servers. Cheers Stu This message is confidential. It may also contain privileged information. The contents of this e-mail and any attachments are intended for the named addressee only. Unless you are the named addressee or authorised to receive the e-mail of the named addressee you may not disclose, use or copy the contents of the e-mail. If you are not the person for whom the message was intended, please notify the sender immediately at Bradford Teaching Hospitals NHS Foundation Trust and delete the material from your computer. You must not use the message for any other purpose, nor disclose its contents to any person other than the intended recipient. Bradford Teaching Hospitals NHS Foundation Trust does not accept responsibility for this message and any views or opinions contained in this e-mail are solely those of the author unless expressly stated otherwise.

1 0

Issue with TCPmon and Stunnel
by Odays 01 Oct '13

01 Oct '13

Hi all. I need to configure TCPMon+Stunnel to capture the request/response message in the communication with a web services using https. So I download stunnel-4.56-installer.exe and install it. In TCPMon I put that it listen in port 7777 and redirect to port 1234. In Stunnel I put this configuration: client=yes verify=0 [my-https] accept = 127.0.0.1:1234 connect = webservices_server:443 TIMEOUTclose = 0 When i run the scenario I see this log: 2013.09.30 16:12:57 LOG7[8612:6032]: Service [my-https] started 2013.09.30 16:12:57 LOG5[8612:6032]: Service [my-https] accepted connection from 127.0.0.1:51759 2013.09.30 16:12:57 LOG7[8612:6032]: SSL state (accept): before/accept initialization *2013.09.30 16:12:57 LOG3[8612:6032]: SSL_accept: 1407609C: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request* 2013.09.30 16:12:57 LOG5[8612:6032]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2013.09.30 16:12:57 LOG7[8612:6032]: Local socket (FD=448) closed 2013.09.30 16:12:57 LOG7[8612:6032]: Service [my-https] finished (0 left) Any idea about this error? Thanks. -- Este mensaje le ha llegado mediante el servicio de correo electronico que ofrece Infomed para respaldar el cumplimiento de las misiones del Sistema Nacional de Salud. La persona que envia este correo asume el compromiso de usar el servicio a tales fines y cumplir con las regulaciones establecidas Infomed: http://www.sld.cu/

3 2

Generic/general mechanism to forward mail servername, login, port from client to stunnel
by Ben Stover 27 Sep '13

27 Sep '13

Refering to my last posting I want to ask a related question: I read in the past somewhere that I can access stunnel from my local email client in more generic way: At first: stunnel always listens AUTOMATICALLY by default on port 127.0.0.1:9999 für incoming request and forwards the prepared/modified request to the outside world. The core parameter are NOT specified in the .conf file but by the User ID which is passed by the local client to local stunnel service. The syntax is as follows: userid=<servername>/<remotes-ssl-tls-port>/<loginname> Example: userid=pop.mail.yahoo.com/995/myname123 So as soon as stunnel receives at 127.0.0.1:9999 an incoming local connect he accepts the following userid string and tokenize it into the three parts. Given these three tokens stunnel is able to connect in the second step the remote mail server WITHOUT any further need of specification in the .conf file. Do I remember this correct? Is this mechanism described somewhere in detail? Thank you Ben

1 0

PATCH: multiple SNI options per slave section
by David Owen 27 Sep '13

27 Sep '13

Hello and thank you for stunnel! After switching from my web-server's built-in SSL support, I now have a much more secure system and SNI, too! In stunnel(8), I read this about the sni option: "sni option can also be specified more than once within a single slave service." However, I couldn't get it to work, and reading the source code verified that only one sni option is tracked per section. So, I present my patch to allow multiple sni options. It enables configurations like these: [https] ... [group1] sni = https:a.example.org sni = https:b.example.org ... [group2] sni = https:c.example.org sni = https:d.example.org ... If you have a naming scheme that doesn't lend itself to the wildcard matching already supported, this can cut your config size quite a bit. DETAILS The sni option for any section was originally tracked in the section->sni member (a string). Now, a linked-list of sni options is added to the section structure, with every sni option being appended to the end. For server setup, each slave section walks over its list, splitting each sni option and adding that slave section to the master's slave list. Splitting options and adding slaves to masters works as before, but now the slave section iterates over a list instead of referencing a single string. For client setup, each slave section checks that it has either no sni options, or exactly one. Multiple sni options results in an error. If exactly one option is found, it is copied to the old sni field of the section struct. The old sni field has been renamed to servername_to_request, as it is now used only in client mode, and this makes its purpose more clear. When no sni option is found, servername_to_request is initialized from the protocolHost or connect options, as before. I hope this patch is useful to others. Please let me know how I can make it acceptable for inclusing in the stunnel distribution. Thanks, David

1 0

Proxy HTTPS via stunnel without any certificates on proxy/stunnel box
by Gary Chodos 25 Sep '13

25 Sep '13

Greetings, We are trying to decide between SNIProxy and stunnel for the following task: - Client browser hits https://foo.bar.org, which resolves to an IP that corresponds to the stunnel machine listening on 443. - stunnel "forwards" (sorry if this is not the correct technical term) the connection to a different machine, specified by a different IP address, which is also configured to believe it is foo.bar.org and actually has a web server listening on 443 and houses the SSL key/cert. - when stunnel hits the end server, the latter sees the stunnel IP address as source, not the original user's (who initiated the web request for https://foo.bar.org) I believe this is default behavior, but just noting it for completeness. Is it possible to accomplish this (stunnel listening on and connecting to https endpoints) without housing any certs/keys on the stunnel machine itself, because we want the second server to deal with all that and we do not have access to those keys anyway. And of course, the users which go to the https://foo.bar.org should not see any cert mismatches as a result of loading https://foo.bar.org which, for the user, will resolve to the stunnel/proxy IP, rather than the end server which actually had a running web server and keys/cert. Sorry if the above detail is insufficient; do let me know. Thanks for your help. Gary

2 2

Port assignment in .conf file for local email client unique?
by Ben Stover 25 Sep '13

25 Sep '13

Assume I want to connect from my local email client to two (!) remote email servers The corresponding instructions in .conf file looks like (my guess): [smtps-firstacct] accept = 127.0.0.1:259 connect = smtps.myisp1.com:465 [smtps-secondacct] accept = 127.0.0.1:259 connect = smtps.myisp2.com:465 Questions: 1.) a configuration like above with the same "accept" port 259 is NOT possible because stunnel does not know to which remote email server he has to connect. To distinguish two different remote email server I always have to select TWO different accept-ports like [smtps-firstacct] accept = 127.0.0.1:259 connect = smtps.myisp1.com:465 [smtps-secondacct] accept = 127.0.0.1:258 connect = smtps.myisp2.com:465 Correct? 2.) Can I use arbitrary accept-ports like 1242 or 23199 or is there a port range from I have to select one? 3.) Moreover assume I want to make the SSL connection transparent can I select an accept-port 25? 4.) I read somewhere that I have always to specify in email client for POP3/SMTP an address 127.0.0.1:9999 and NOT 127.0.0.1:259 in order to connect to local stunnel service. Because local stunnel service is always listening on port 9999. Is this correct? Thank you Ben

2 2

One "client=yes" instruction per .conf file sufficient?
by Ben Stover 25 Sep '13

25 Sep '13

Is one client=yes instruction line per conf file enough? Does is mean all instructions in current .conf file belong to a client configuration or does it mean only the following command (=lines below) are intended for client usage? Ben

2 1

postgres protocol
by Robert Bernier 21 Sep '13

21 Sep '13

Hi, I've been looking at using stunnel connecting it directly to postgres. As per the man page, https://www.stunnel.org/static/stunnel.html, I was able to get postgres version 8.3 working. However, I've not suceeded using postgres version 9.2. Any insights would be appreciated. Thanks -- Robert Bernier PostgreSQL Business Intelligence Analyst robert7390(a)comcast.net http://www.linkedin.com/pub/robert-bernier/69/6a6/921 http://beknown.com/robert-bernier

1 0

Difference between verify=2, 3 and 4
by Nikolaus Rath 20 Sep '13

20 Sep '13

Hello, Thanks for writing stunnel, it looks like a great tool! I have, however, a really hard time understanding the difference between verify=2,3 and 4. In the manpage, I found verify = level verify peer certificate level 0 - request and ignore peer certificate level 1 - verify peer certificate if present level 2 - verify peer certificate level 3 - verify peer with locally installed certificate level 4 - ignore CA chain and only verify peer certificate default - no verify Levels 0-2 seem pretty clear cut, but then it becomes confusing for me. First, I do not understand how level 3 differs from level2. What does "against a locally installed certificate" mean? It seems to me that I certainly need to have a local copy of the trusted CAs even in level 2 -- at least I hope that they aren't somehow build in to stunnel. But there is also just one CApath option, so will that be used for level 2 or level 3? For level 4, the "ignore the CA chain" path is fine -- but where do I put the peer certificates that I'm willing to accept? CApath seems wrong, but cert is already used for the server's own certificate... Best, -Nikolaus -- »Time flies like an arrow, fruit flies like a Banana.« PGP fingerprint: 5B93 61F8 4EA2 E279 ABF6 02CF A9AD B7F8 AE4E 425C

6 13

Looking for a tech talk speaker on Secure Networking
by Chris Westin 16 Sep '13

16 Sep '13

I organize the speakers for the SF Bay Area Large-Scale Production Engineering meetup (http://www.meetup.com/SF-Bay-Area-Large-Scale-Production-Engineering/ ; take a look at the "PAST" tab to see the kinds of events we've had). For our event on Thursday October 17, 2013, I'm looking for speakers on the topic of "Secure Networking" (event: http://www.meetup.com/SF-Bay-Area-Large-Scale-Production-Engineering/events… ). As you can see from looking at our past events, I pick a topic, and then try to get 2-3 talks on that topic. Talks are usually 20-25 minutes long. This is a technical audience, and they don't appreciate a marketing pitch. They're eager to get into the nuts and bolts of the topic, including demos, code samples, and architecture. If you're going to be in the Bay Area then, and would be interested in giving a talk, please let me know here, or (preferably) through meetup.com. Thanks, Chris Westin

1 0

Re: [stunnel-users] IRC-Reconnect failed with "[10053] Software caused connection abort"(mIRC) and "SSL_connect: Peer suddenly disconnected"(tstunnel.exe)
by ralf29587＠gmx.de 13 Sep '13

13 Sep '13

Could some admin please remove my uploaded VCard and either my Name or my E-Mail-Adress shown on stunnel.org ?? Thanks a million!

1 0

stunnel accept a t3 connection?
by Scott Sikorski 10 Sep '13

10 Sep '13

I am curious if stunnel can support listening for an incoming t3 connection? I am having difficulty getting t3s to work between WebSphere and WebLogic for API calls and am curious if an alternative such as stunnel will work. I have stunnel installed betwen a client and the destination host, but the client doesn't seem to want to accept a t3://127.0.0.1:14010 connection but when I change this to http://127.0.0.1:14010 it works fine. Anything you can share would be appreciated. Mostly, if it will never work, that would be nice to know as to not spend more time troubleshooting. Best Regards, Scott Sikorski scottgsikorski(a)yahoo.com

2 1

Fullduplex in stunnel
by Krzysztof Kwiatkowski 07 Sep '13

07 Sep '13

Hi, I'm planning to use stunnel to do stress testing of my application. I decided to use stunnel because I've noticed that full-duplex has been added to version 3.2 (around 1999) and my application handles high throughput. AFAIK Stunnel uses openssl. Also I know that openssl doesn't handle fullduplex traffic very well. In fact without any tricks, half-duplex is most what I could get from openssl. As the full-duplex feature has been added to stunnel in 1999 (so long time ago) can you confirm that it is still there and full-duplex is still supported? If it is a case, how it is possible that stunnel handles fullduplex? Krzysztof Kwiatkowski

2 1

IRC-Reconnect failed with "[10053] Software caused connection abort"(mIRC) and "SSL_connect: Peer suddenly disconnected"(tstunnel.exe)
by ralf29587＠gmx.de 03 Sep '13

03 Sep '13

Hi, I have a problem using stunnel with mIRC: I was using a pretty old version of stunnel.exe that was packed with a mIRC script and could be ran as a command-line-only application without a configuration file (supplying all necessary informations parameters). I know that current mIRC version have their own ssl support, but I prefer an old version without because it has much better performance. The old one was used by "stunnel.exe -c -d localhost:<localport> -r <irc-server-ip>:<irc-server-port>" in command line and "/server localhost:<localport>" in irc. A few of my servers stopped supporting an old ssl version, this old stunnel.exe is no longer compatible to the new (open)ssl dll files and so I had to upgrade to the most recent version of stunnel - and I have some problems make it run properly. Here you can see my configuration file (stunnel.conf): ; Sample stunnel configuration file for Win32 by Michal Trojnara 2002-2012 ; Some options used here may be inadequate for your particular configuration ; This sample file does *not* represent stunnel.conf defaults ; Please consult the manual for detailed description of available options ; ************************************************************************** ; * Global options * ; ************************************************************************** ; Debugging stuff (may useful for troubleshooting) ;debug = 7 ;output = stunnel.log ; Disable FIPS mode to allow non-approved protocols and algorithms ;fips = no ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Certificate/key is needed in server mode and optional in client mode ;cert = stunnel.pem ;key = stunnel.pem ; Authentication stuff needs to be configured to prevent MITM attacks ; It is not enabled by default! ;verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively CRLfile can be used ;CRLfile = crls.pem ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; These options provide additional security at some performance degradation ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; ************************************************************************** ; * Service definitions (at least one service has to be defined) * ; ************************************************************************** ; Example SSL server mode services ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 ; Example SSL client mode services ;[gmail-pop3] ;client = yes ;accept = 127.0.0.1:110 ;connect = pop.gmail.com:995 ;[gmail-imap] ;client = yes ;accept = 127.0.0.1:143 ;connect = imap.gmail.com:993 ;[gmail-smtp] ;client = yes ;accept = 127.0.0.1:25 ;connect = smtp.gmail.com:465 ; Example SSL front-end to a web server ;[https] ;accept = 443 ;connect = 80 ; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SSL ; Microsoft implementations do not use SSL close-notify alert and thus ; they are vulnerable to truncation attacks ;TIMEOUTclose = 0 ; vim:ft=dosini [abjects] client = yes accept = 127.0.0.1:7001 connect = irc.abjects.net:9999 [Elite-IRC] client = yes accept = 127.0.0.1:7002 connect = SpeedSpace-IRC.eu:6697 [BodenTruppe] client = yes accept = 127.0.0.1:7003 connect = boden-truppe.zapto.org:7001 [LinkNet] client = yes accept = 127.0.0.1:7004 connect = irc.link-net.nl:7000 The first connect always works properly (as shown in the log below): 2013.09.03 12:30:45 LOG5[10696:9140]: stunnel 4.56 on x86-pc-msvc-1500 platform 2013.09.03 12:30:45 LOG5[10696:9140]: Compiled/running with OpenSSL 1.0.1e-fips11 Feb 2013 2013.09.03 12:30:45 LOG5[10696:9140]: Threading:WIN32 Sockets:SELECT,IPv6 SSL:ENGINE,OCSP,FIPS 2013.09.03 12:30:45 LOG5[10696:9140]: Reading configuration from file stunnel.conf 2013.09.03 12:30:45 LOG5[10696:9140]: FIPS mode is enabled 2013.09.03 12:30:45 LOG5[10696:9140]: Configuration successful 2013.09.03 12:30:53 LOG5[10696:10756]: Service [abjects] accepted connection from 127.0.0.1:3397 2013.09.03 12:30:53 LOG5[10696:10756]: connect_blocking: connected 188.126.73.62:9999 2013.09.03 12:30:53 LOG5[10696:10756]: Service [abjects] connected remote server from 192.168.1.10:3398 2013.09.03 12:30:54 LOG5[10696:14396]: Service [LinkNet] accepted connection from 127.0.0.1:3399 2013.09.03 12:30:54 LOG5[10696:14396]: connect_blocking: connected 194.126.217.98:7000 2013.09.03 12:30:54 LOG5[10696:14396]: Service [LinkNet] connected remote server from 192.168.1.10:3400 2013.09.03 12:30:54 LOG5[10696:2916]: Service [BodenTruppe] accepted connectionfrom 127.0.0.1:3401 2013.09.03 12:30:54 LOG5[10696:2916]: connect_blocking: connected 178.254.22.94:7001 2013.09.03 12:30:54 LOG5[10696:2916]: Service [BodenTruppe] connected remote server from 192.168.1.10:3402 2013.09.03 12:30:54 LOG5[10696:12260]: Service [Elite-IRC] accepted connection from 127.0.0.1:3403 2013.09.03 12:30:54 LOG5[10696:12260]: connect_blocking: connected 62.75.235.122:6697 2013.09.03 12:30:54 LOG5[10696:12260]: Service [Elite-IRC] connected remote server from 192.168.1.10:3404 But when I try to reconnect, it doesn't work for 2 of my 4 servers This is an example for what happens to Elite-IRC: 2013.09.03 12:32:22 LOG5[10696:12260]: Connection closed: 1972 byte(s) sent to SSL, 26903 byte(s) sent to socket 2013.09.03 12:32:23 LOG5[10696:17168]: Service [Elite-IRC] accepted connection from 127.0.0.1:3429 2013.09.03 12:32:23 LOG5[10696:17168]: connect_blocking: connected 62.75.235.122:6697 2013.09.03 12:32:23 LOG5[10696:17168]: Service [Elite-IRC] connected remote server from 192.168.1.10:3430 2013.09.03 12:32:23 LOG3[10696:17168]: SSL_connect: Peer suddenly disconnected 2013.09.03 12:32:23 LOG5[10696:17168]: Connection reset: 0 byte(s) sent to SSL,0 byte(s) sent to socket The frist line shows the manual disconnect occured by executing "/server localhost:7002" in mIRC. The second line shows the new incoming connection from my mIRC. The third line? ... I got no clue why it has to block anything. The fourth line: Successfully connected to IRC-Server? And then the fifth line occurs. I'm not sure if I interpret it right, but for some reason tstunnel.exe is kicking out my connected mIRC client which makes mIRC to tell me "[10053] Software caused connection abort". The whole lines in mIRC are: [12:34pm] * Connect retry #1 localhost (7003) ------------------------------------------------------------ [12:34pm] * [10053] Software caused connection abort ------------------------------------------------------------ [12:34pm] * Disconnected By the way, I have packed libeay32.dll, ssleay32.dll, stunnel.conf and tstunnel.exe in a subdir in mIRC directory and I'm starting it using "tstunnel.exe stunnel.conf" When this error occurs, I have to kill tstunnel.exe and start it again - then everything works fine again. For 1 of 4 servers, I also had this error with the old command-line stunnel.exe and I just wrote a script killing (only this) stunnel.exe and restarting it when this mIRC error occurs. Unfortunately this is no longer possible when tstunnel.exe is using a configuration file and one process is managing all connections. Is there any way I can fix this? (Maybe by fixing the logout of my local mIRC from my local tstunnel.exe?) Best regards

2 1

stunnel 4.56 to 4.50 on andriod
by Ronald Ning 03 Sep '13

03 Sep '13

Anyone have any luck running stunnel on android? I'm running the stock JB 4.2.2. I've tried every stunnel version from 4.50 to 4.56. When I try to run: root@andriod: /system/bin/stunnel stunnel.conf -> stunnel root@andriod: netstat -a netstat doesn't show the listening port: My stunnel.conf is this: client = yes debug = 7 [ssh] accept=2222 connect=myserver.com:22

2 1

Init script
by Alan Chester 29 Aug '13

29 Aug '13

Hello, I am currently working on using stunnel. I was wondering what everyones thoughts were on the creation of an init script for stunnel. This would help insure that the connections are brought up after a reboot. Or what is the best way to go about handling this? Thanks, Alan

2 1

no certificate available safari browser
by Scott McKeown 28 Aug '13

28 Aug '13

Hi Libin, If possible can you send over your STunnel config file but my guess would be that you would need to include your Root CA and Intermediate CA certificates into your PEM file. I would check to see what https://www.ssllabs.com/ssltest/analyze.html says about your certificates another quick test would be to have a look at http://www.digicert.com/help/ to see what they also say about the certificate chains. ~Scott Hi all, > > Sever OS: Linux/Centos 5.9 > SSLServer: Stunnel > ErrorMessage: no certificate available > CertType: SSL Web Server Certificate > Client Browser: Safari 5.1. > Client OS: OS X Lion > > When i am trying to hit the URL on safari browser it shows me the messages > "no certificate available" > No certificate meet the application . However, the same link is working > for all other browsers. Moreover, we have checked the stunnel logs, but > couldn't able to get any thing from the logs. > > Apache HTTPS config we have option *SSLVerifyClient none *in Stunnel I > have tried all option non of thing working. > * > * > Please help me.* * > > Thanks > Libin -- With Kind Regards. Scott McKeown Loadbalancer.org http://www.loadbalancer.org

3 2

stunnel 4.56 and 4.55 are not working on Android 4.3.1
by Mohsin Mirza 28 Aug '13

28 Aug '13

I tried both version of stunnel for android on Nexus 4 Build JWR66Y, Is it have to anything to do with SELinux or MAC secuirty model introduce by 4.3 It was working in initial 4.3 build OTA. root@mako:/system/bin # ./sh -c /system/xbin/stunnel root@mako:/system/bin # ________________________________________Disclaimer: This email and any attachments may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately by email and destroy this email. Any unauthorized copying, dissemination, disclosure or distribution of the material in this email is strictly forbidden. Unless expressly stated to the contrary, the sender of this email is not authorized by MBC to make any representations, negotiations or enter into any agreement on behalf of MBC. This e-mail message and any attached files have been scanned for the presence of computer viruses. However, it is the responsibility of the recipient to ensure that it is virus free; we accept no responsibility for any loss or damage arising in any way from its use.________________________________________

1 0

no certificate available safari browser
by Libindas 27 Aug '13

27 Aug '13

Hi Michal, Sever OS: Linux/Centos 5.9 SSLServer: Stunnel ErrorMessage: no certificate available CertType: SSL Web Server Certificate Client Browser: Safari 5.1. Client OS: OS X Lion When i am trying to hit the URL on safari browser it shows me the messages "no certificate available" No certificate meet the application . However, the same link is working for all other browsers. Moreover, we have checked the stunnel logs, but couldn't able to get any thing from the logs. Apache HTTPS config we have option *SSLVerifyClient none *in Stunnel I have tried all option non of thing working. * * Please help me.* * Thanks Libin

1 1

Re: [stunnel-users] Build failure for ARM32 with Yocto
by Ludolf Holzheid 23 Aug '13

23 Aug '13

On Thu, 2013-08-22 15:44:43 +0100, Laszlo Papp wrote: > On Thu, Aug 22, 2013 at 3:34 PM, Ludolf Holzheid < > lholzheid(a)bihl-wiedemann.de> wrote: > > > On Thu, 2013-08-22 14:43:55 +0100, Laszlo Papp wrote: > > > Here you can find the log file in question for details: > > > > > > [..] > > > > > > In file included from /usr//include/features.h:324:0, > > > from /usr//include/pthread.h:23, > > > from common.h:158, > > > from str.c:38: > > > > > /home/lpapp/Projects/Yocto/poky-dylan-9.0.1/build/tmp/sysroots/foo/usr/include/bits/predefs.h:23:3: > > > error: #error "Never use <bits/predefs.h> directly; include > > <stdc-predef.h> > > > > Laszlo, > > > > Are you sure /usr//include is the right include directory for cross- > > compiling? I must confess, I'm not familiar with cross-compiling, but > > this looks fishy. > > > > Most certainly not, but other softwares get it right. I will assume that it > has something to do with how the Makefile is generated for stunnel. Got a > clue in that area? I would try to remove -I/usr//include (and -pedantic) from the compiler flags, but again, I'm no expert in autoconf and cross-compiling. Ludolf -- Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:[email protected] http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

3 3

REMOVE
by Bruce Edwards 22 Aug '13

22 Aug '13

Please remove me from your list server R. Bruce Edwards Communications Manager 1018 Pretlow St Franklin, VA 23851 bedwards(a)franklinpolice.org Office: 757-562-8696 Cell: 757-621-5295

1 0

Build failure for ARM32 with Yocto
by Laszlo Papp 22 Aug '13

22 Aug '13

Hi, if I build stunnel manually on my desktop machine (Archlinux), it works fine. However, when I am trying to use a Yocto/OE recipe for building it for my arm32 target, I am facing the issue below. Anyone any hint? Cheers, L. | /usr//include/linux/sysctl.h:836:20: warning: comma at end of enumerator list [-pedantic] | /usr//include/linux/sysctl.h:849:12: warning: comma at end of enumerator list [-pedantic] | /usr//include/linux/sysctl.h:892:31: warning: comma at end of enumerator list [-pedantic] | /usr//include/linux/sysctl.h:897:32: warning: comma at end of enumerator list [-pedantic] | /usr//include/linux/sysctl.h:912:26: warning: comma at end of enumerator list [-pedantic] | /usr//include/linux/sysctl.h:917:32: warning: comma at end of enumerator list [-pedantic] | /usr//include/linux/sysctl.h:928:20: warning: comma at end of enumerator list [-pedantic] | In file included from /usr//include/linux/netfilter_ipv4.h:8:0, | from common.h:383, | from network.c:38: | /usr//include/linux/netfilter.h:58:18: warning: comma at end of enumerator list [-pedantic] | In file included from common.h:383:0, | from network.c:38: | /usr//include/linux/netfilter_ipv4.h:68:26: warning: comma at end of enumerator list [-pedantic] | make[2]: *** [stunnel-str.o] Error 1 | make[2]: *** Waiting for unfinished jobs.... | make[2]: *** [stunnel-network.o] Error 1 | make[2]: *** [stunnel-resolver.o] Error 1 | make[2]: *** [stunnel-protocol.o] Error 1 | make[2]: *** [stunnel-log.o] Error 1 | make[2]: *** [stunnel-file.o] Error 1 | make[2]: *** [stunnel-options.o] Error 1 | make[2]: *** [stunnel-client.o] Error 1 | make[2]: Leaving directory `/home/lpapp/Projects/Yocto/poky-dylan-9.0.1/build/tmp/work/armv5te-linux-gnueabi/stunnel/4.56-r0/stunnel-4.56/src' | make[1]: *** [all] Error 2 | make[1]: Leaving directory `/home/lpapp/Projects/Yocto/poky-dylan-9.0.1/build/tmp/work/armv5te-linux-gnueabi/stunnel/4.56-r0/stunnel-4.56/src' | make: *** [all-recursive] Error 1 | ERROR: oe_runmake failed | ERROR: Function failed: do_compile (see /home/lpapp/Projects/Yocto/poky-dylan-9.0.1/build/tmp/work/armv5te-linux-gnueabi/stunnel/4.56-r0/temp/log.do_compile.10590 for further information) ERROR: Task 6 (/home/lpapp/Projects/Yocto/poky-dylan-9.0.1/build/../meta-networking/recipes-support/stunnel/ stunnel_4.56.bb, do_compile) failed with exit code '1' NOTE: Tasks Summary: Attempted 561 tasks of which 559 didn't need to be rerun and 1 failed. No currently running tasks (561 of 568) Summary: 1 task failed: /home/lpapp/Projects/Yocto/poky-dylan-9.0.1/build/../meta-networking/recipes-support/stunnel/ stunnel_4.56.bb, do_compile Summary: There was 1 ERROR message shown, returning a non-zero exit code.

2 3

Problem Selecting Only Ecliptic Curve Ciphers
by Carter Browne 07 Aug '13

07 Aug '13

I'm using stunnel 4.56 on Windows 7. When I use the following cipher list: ciphers = ECDHE-ECDSA-AES256-SHA:ECDH-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDH-ECDSA-AES128-SHA to establish a connection, I get a "no shared cipher" response. The following set of ciphers does work: ciphers = ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:ECDH-RSA-AES256-SHA:ECDH-ECDSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDH-RSA-AES128-SHA:ECDH-ECDSA-AES128-SHA Other relevant settings: options = NO_SSLv2 sslVersion = all fips = no verify = 2 If I take out the first ECDHE-RSA-ASE256-SHA cipher from the list, the ECDHE-RSA-AES128-SHA cipher is selected. What am I doing wrong? Thanks. -- Carter Browne cbrowne(a)cbcs-usa.com

2 1

Unable to make SSL connexion work
by OLIVER Patrice 07 Aug '13

07 Aug '13

Hi, Since our company had to migrate to Orange Office365 platform, we cannot send simple SMTP message using smtp.office365.com We have to use SMTP over TLS. While I have to use some applications which cannot use SMTP, I installed and setup STunnel. When I try to send a simple mail like this : telnet myserver 25 ehlo ch-lepuy.fr mail from: toto(a)ch-lepuy.fr I cannot continue with rcpt to syntax and I have the following message : rcpt to:530 5.7.1 Client was not authenticated In the STunnel log file, I can see that : 2013.08.06 19:20:49 LOG7[1352:2832]: SSL state (connect): before/connect initialization 2013.08.06 19:20:49 LOG7[1352:2832]: SSL state (connect): SSLv3 write client hello A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 read server hello A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 read server certificate A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 read server key exchange A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 read server certificate request A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 read server done A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 write client certificate A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 write client key exchange A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 write certificate verify A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 write change cipher spec A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 write finished A 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 flush data 2013.08.06 19:20:50 LOG7[1352:2832]: SSL state (connect): SSLv3 read finished A 2013.08.06 19:20:50 LOG7[1352:2832]: 1 items in the session cache 2013.08.06 19:20:50 LOG7[1352:2832]: 1 client connects (SSL_connect()) 2013.08.06 19:20:50 LOG7[1352:2832]: 1 client connects that finished 2013.08.06 19:20:50 LOG7[1352:2832]: 0 client renegotiations requested 2013.08.06 19:20:50 LOG7[1352:2832]: 0 server connects (SSL_accept()) 2013.08.06 19:20:50 LOG7[1352:2832]: 0 server connects that finished 2013.08.06 19:20:50 LOG7[1352:2832]: 0 server renegotiations requested 2013.08.06 19:20:50 LOG7[1352:2832]: 0 session cache hits 2013.08.06 19:20:50 LOG7[1352:2832]: 0 external session cache hits 2013.08.06 19:20:50 LOG7[1352:2832]: 0 session cache misses 2013.08.06 19:20:50 LOG7[1352:2832]: 0 session cache timeouts 2013.08.06 19:20:50 LOG7[1352:2832]: Peer certificate was cached (6184 bytes) 2013.08.06 19:20:50 LOG6[1352:2832]: SSL connected: new session negotiated 2013.08.06 19:20:50 LOG6[1352:2832]: Negotiated TLSv1/SSLv3 ciphersuite: ECDHE-RSA-AES256-SHA (256-bit encryption) 2013.08.06 19:20:50 LOG6[1352:2832]: Compression: null, expansion: null 2013.08.06 19:21:13 LOG3[1352:2832]: SSL_read: Connection reset by peer (WSAECONNRESET) (10054) 2013.08.06 19:21:13 LOG5[1352:2832]: Connection reset: 65 byte(s) sent to SSL, 231 byte(s) sent to socket 2013.08.06 19:21:13 LOG7[1352:2832]: Remote socket (FD=316) closed 2013.08.06 19:21:13 LOG7[1352:2832]: Local socket (FD=244) closed 2013.08.06 19:21:13 LOG7[1352:2832]: Service [SMTP Outgoing] finished (0 left) Here is my STunnel setup : client = yes output = stunnel-log.txt debug = 7 taskbar = yes ; Disable FIPS mode to allow non-approved protocols and algorithms ;fips = no ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Certificate/key is needed in server mode and optional in client mode cert = stunnel.pem ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 [SMTP Outgoing] protocol = smtp accept = 25 connect = smtp.office365.com:587 Does anyone have an idea ? Regards? Patrice Oliver | Centre Hospitalier Emile Roux Responsable Informatique T. 04 71 04 38 30 12 Bd Andr? Chantemesse - 43012 LE PUY EN VELAY Cedex http://www.ch-lepuy.fr

3 3

Disable SSL session ticket
by dansmith 06 Aug '13

06 Aug '13

Hi, when connecting a stunnel client to a stunnel server, is it possible to disable the use of SSL session tickets? I need to be able to decrypt the stunnel traffic in wireshark. Unfortunately, wireshark still doesn't support SSL session tickets.

2 1