- stunnel-users - stunnel.org

Patch to fix: Wildcard SSL certificates + SNI broken on Firefox
by Stephen Balukoff 29 Nov '12

29 Nov '12

Hello! I noticed that when dealing with wildcard certs in stunnel where an SNI configuration is being used, unless a specific servername context that exactly matches the browser's requested servername is in the stunnel.conf, stunnel responds to the client (web browser in this case) with a SSL_TLSEXT_ERR_ALERT_FATAL. Most browsers fall back to a non-SNI request, at which point, stunnel responds with whatever the master service's certificate is (which, if it's a wildcard cert, just works). However, at least one popularly-used web browser (Firefox) does not do this, and instead returns an error message to the user which they cannot (and should not need to) override to view the site contents. Since it's impractical to list all the possible servernames that can match at wildcard cert, and it's also impractical to expect the Firefox developers to change the behavior of their browser (when they shouldn't have to), and even more impractical to expect all the current users of Firefox to upgrade in a timely manner... I went ahead and wrote a patch for stunnel which instructs it to look for a matching wildcard certificate, if an exactly-matching servername isn't found. I've attached this patch to this message. Beyond fixing the stunnel+wildcard cert+SNI+firefox problem above, the secondary benefits of this patch are: * stunnel now responds immediately with a matching cert in the case of a wildcard cert, thus eliminating that first exchange which results in the SSL_TLSEXT_ERR_ALERT_FATAL error above. For stupid browsers and configurations with keepalive turned off + lots of requests per page and high latency, this should help to significantly improve performance. * stunnel will still choose an exactly matching cert if it's available and configured. (ie. if the browser requests 'subdomain.example.com', and there's a certificate configured in stunnel for 'subdomain.example.com' and another for '*.example.com', stunnel will respond with the ' subdomain.example.com' cert.) * one can now use multiple wildcard certs on a single IP:Port combination thanks to SNI. (Without this patch, you can effectively only use one wildcard cert per IP:Port combination with stunnel.) One note: It's been years since I've written any C code, so can't really vouch for the quality of my patch. I'm hoping at least the maintainers of this project see the utility of the patch I'm providing and write something similar in non-stupid C. Thanks, Stephen -- Stephen Balukoff Blue Box Group, LLC (800)613-4305 x807

1 0

Question : prevent close-nofity alerts from stunnel-server
by bhakta79 29 Nov '12

29 Nov '12

Hello, I was trying MITM on a windows application (which talks to a M$ server). Stunnel was running on my windows xp machine. windows-client-app -> stunnel server ---> stunnel client --> M$ Server What I found is that stunnel server sends close notify alert to the windows client app which causes the client to suspend all further communication (busted windows-client of course!). I tried setting the TimeoutClose option to high values but I always saw the server sending close notify alert (is the timeout close only a client-side parameter?) Is there a way to configure server to not send close notify? stullen logs: 2012.11.28 18:32:12 LOG7[3908:5904]: SSL socket closed on SSL_read 2012.11.28 18:32:12 LOG7[3908:5904]: Sent socket write shutdown 2012.11.28 18:32:12 LOG7[3908:4232]: Socket closed on read 2012.11.28 18:32:12 LOG5[3908:5904]: Connection closed: 901 byte(s) sent to SSL, 38020 byte(s) sent to socket 2012.11.28 18:32:12 LOG7[3908:4232]: Sending close_notify alert 2012.11.28 18:32:12 LOG7[3908:4232]: SSL alert (write): warning: close notify 2012.11.28 18:32:12 LOG6[3908:4232]: SSL_shutdown successfully sent close_notify alert 2012.11.28 18:32:12 LOG7[3908:5904]: Remote socket (FD=356) closed <mailto:[email protected]> I finally ended up making this one line code-change to stop server from sending close alert that helped my MITM progress. src/client.c: if(!(SSL_get_shutdown(c->ssl)&SSL_SENT_SHUTDOWN) && !sock_open_rd && !c->sock_ptr) { s_log(LOG_DEBUG, "BHAKTA - HACK -> Skip Sending close_notify alert"); *! if(0 && SSL_version(c->ssl)!=SSL2_VERSION) { /* SSLv3, TLSv1 */* s_log(LOG_DEBUG, "Sending close_notify alert"); shutdown_wants_write=1; } else { /* no alerts in SSLv2, including the close_notify alert */ s_log(LOG_DEBUG, "Closing SSLv2 socket"); if(c->ssl_rfd->is_socket) shutdown(c->ssl_rfd->fd, SHUT_RD); /* notify the kernel */ if(c->ssl_wfd->is_socket) shutdown(c->ssl_wfd->fd, SHUT_WR); /* send TCP FIN */ /* notify the OpenSSL library */ SSL_set_shutdown(c->ssl, SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN); } } Is there a way to prevent server from sending close notify alert by means of stunel.conf parameters? stunnel.conf: debug = 7 output = stunnel.log cert = fakecert.pem key = fakecert.key options = DONT_INSERT_EMPTY_FRAGMENTS socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [https] sslVersion = TLSv1 accept = 0.0.0.0:443 connect = 127.0.0.1:446 [https-client] client = yes sslVersion = TLSv1 accept = 127.0.0.1:446 connect = 172.24.244.11:443 TIMEOUTclose = 300

1 0

Re: [stunnel-users] WinCE link errors
by Bao, Robert 28 Nov '12

28 Nov '12

Brian, You are right. After changing the order, all wcecompatex.lib related link errors are gone! Thanks a lot. Also thank Pierre for dropping me another suggestion. Mike, When you get chance to update next time, you may consider changing this line (in evc.mak): From: LIBS=/NODEFAULTLIB coredll.lib corelibc.lib winsock.lib wcecompatex.lib libeay32.lib ssleay32.lib To: LIBS=/NODEFAULTLIB winsock.lib wcecompatex.lib libeay32.lib ssleay32.lib coredll.lib corelibc.lib Thank you all. Robert From: Brian Wilkins [mailto:[email protected]] Sent: Wednesday, November 28, 2012 5:15 PM To: Bao, Robert Subject: Re: [stunnel-users] WinCE link errors Maybe try changing the link order...? On Nov 28, 2012 5:10 PM, "Bao, Robert" <rbao(a)tycoint.com> wrote: Dear Mike and WinCE stunnel users out there, I am currently in the process of compiling/linking the latest stunnel (4.54) for our ARM and WinCE 5.0 based device. I noticed that this version requires coredll.lib and corelibc.lib in the final link process (defined in the LIBS variable), which the old ones (e.g., version 4.33) didn't. Anyway, I got a lot of linking errors (see below), and just wondering any of you have seen the same errors and how you get around with these errors. If you have any other suggestions please feel free to let me know too. Note: I could resolve the errors at the bottom, but I have trouble get rid of the errors relating to wcecompatex.lib(redir.obj). Thank you for your time. wcecompatex.lib(redir.obj) : error LNK2005: fopen already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: fclose already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: fread already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: fwrite already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: _getstdfilex already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: _fileno already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: fflush already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: feof already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: ferror already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: clearerr already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: fseek already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: ftell already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: _setmode already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: fgets already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: fprintf already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : warning LNK4006: fopen already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: fclose already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: fread already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: fwrite already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: _getstdfilex already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: _fileno already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: fflush already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: feof already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: ferror already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: clearerr already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: fseek already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: ftell already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: _setmode already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: fgets already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: fprintf already defined in coredll.lib(COREDLL.dll); second definition ignored Creating library ..\bin\ARMV4I\tstunnel.lib and object ..\bin\ARMV4I\tstunnel.exp options.obj : error LNK2001: unresolved external symbol WSAGetLastError network.obj : error LNK2001: unresolved external symbol WSAGetLastError stunnel.obj : error LNK2019: unresolved external symbol WSAGetLastError referenced in function daemon_loop ctx.obj : error LNK2001: unresolved external symbol WSAGetLastError client.obj : error LNK2019: unresolved external symbol WSAGetLastError referenced in function init_remote log.obj : error LNK2001: unresolved external symbol WSAGetLastError client.obj : error LNK2019: unresolved external symbol hwnd referenced in function win_new_chain log.obj : error LNK2019: unresolved external symbol hwnd referenced in function s_strerror options.obj : error LNK2001: unresolved external symbol hwnd log.obj : error LNK2019: unresolved external symbol WSASetLastError referenced in function s_log nogui.obj : error LNK2019: unresolved external symbol main_execute referenced in function main ..\bin\ARMV4I\tstunnel.exe : fatal error LNK1120: 4 unresolved externals NMAKE : fatal error U1077: 'link' : return code '0x460' Robert Bao Software House Tyco International 978-577-4202 Explore our new Tyco Online Learning Center Web-based Training Bundles at: www.swhouse.com/support/tyco_online_learning_center.aspx This e-mail may contain or have attached to it information or technology the export or re-export of which is restricted by U.S. laws and regulations. By viewing this e-mail and any attachments, the recipient agrees to the following: (i) the recipients use of the contents of this e-mail and any attachments shall comply with all applicable laws, rules and regulations, including, without limitation, U.S. international trade laws and regulations, and (ii) the recipient may not transfer or otherwise export or re-export any information or technology contained in this e-mail or any attachment except in full compliance with the export controls administered by the U.S. and other countries and any applicable import and use restrictions. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

WinCE link errors
by Bao, Robert 28 Nov '12

28 Nov '12

Dear Mike and WinCE stunnel users out there, I am currently in the process of compiling/linking the latest stunnel (4.54) for our ARM and WinCE 5.0 based device. I noticed that this version requires coredll.lib and corelibc.lib in the final link process (defined in the LIBS variable), which the old ones (e.g., version 4.33) didn't. Anyway, I got a lot of linking errors (see below), and just wondering any of you have seen the same errors and how you get around with these errors. If you have any other suggestions please feel free to let me know too. Note: I could resolve the errors at the bottom, but I have trouble get rid of the errors relating to wcecompatex.lib(redir.obj). Thank you for your time. wcecompatex.lib(redir.obj) : error LNK2005: fopen already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: fclose already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: fread already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: fwrite already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: _getstdfilex already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: _fileno already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: fflush already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: feof already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: ferror already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: clearerr already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: fseek already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: ftell already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: _setmode already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: fgets already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : error LNK2005: fprintf already defined in coredll.lib(COREDLL.dll) wcecompatex.lib(redir.obj) : warning LNK4006: fopen already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: fclose already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: fread already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: fwrite already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: _getstdfilex already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: _fileno already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: fflush already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: feof already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: ferror already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: clearerr already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: fseek already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: ftell already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: _setmode already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: fgets already defined in coredll.lib(COREDLL.dll); second definition ignored wcecompatex.lib(redir.obj) : warning LNK4006: fprintf already defined in coredll.lib(COREDLL.dll); second definition ignored Creating library ..\bin\ARMV4I\tstunnel.lib and object ..\bin\ARMV4I\tstunnel.exp options.obj : error LNK2001: unresolved external symbol WSAGetLastError network.obj : error LNK2001: unresolved external symbol WSAGetLastError stunnel.obj : error LNK2019: unresolved external symbol WSAGetLastError referenced in function daemon_loop ctx.obj : error LNK2001: unresolved external symbol WSAGetLastError client.obj : error LNK2019: unresolved external symbol WSAGetLastError referenced in function init_remote log.obj : error LNK2001: unresolved external symbol WSAGetLastError client.obj : error LNK2019: unresolved external symbol hwnd referenced in function win_new_chain log.obj : error LNK2019: unresolved external symbol hwnd referenced in function s_strerror options.obj : error LNK2001: unresolved external symbol hwnd log.obj : error LNK2019: unresolved external symbol WSASetLastError referenced in function s_log nogui.obj : error LNK2019: unresolved external symbol main_execute referenced in function main ..\bin\ARMV4I\tstunnel.exe : fatal error LNK1120: 4 unresolved externals NMAKE : fatal error U1077: 'link' : return code '0x460' Robert Bao Software House Tyco International 978-577-4202 Explore our new Tyco Online Learning Center Web-based Training Bundles at: www.swhouse.com/support/tyco_online_learning_center.aspx This e-mail may contain or have attached to it information or technology the export or re-export of which is restricted by U.S. laws and regulations. By viewing this e-mail and any attachments, the recipient agrees to the following: (i) the recipients use of the contents of this e-mail and any attachments shall comply with all applicable laws, rules and regulations, including, without limitation, U.S. international trade laws and regulations, and (ii) the recipient may not transfer or otherwise export or re-export any information or technology contained in this e-mail or any attachment except in full compliance with the export controls administered by the U.S. and other countries and any applicable import and use restrictions.

2 1

equivalent to SSLHonorcipherorder in stunnel?
by Mehdi Bennani 28 Nov '12

28 Nov '12

Hi, I was wondering if there were a flag available in stunnel, that would be the equivalent of the Apache directive 'SSLHonorcipherorder' ? I would like to basically be able to 'force' server preferences, rather then client ones, during cipher negotiation SSL handshake. Thank you, Elextra-

2 1

Max Cookie Size
by Scott McKeown 20 Nov '12

20 Nov '12

Hi All, I was wondering if anyone knows if its possible to pass a 'really' large cookie through STunnel. I've just built the latest version again (output below). However, we have a client that is looking to pass 16Kb (yes I know please don't tell me this is a bad idea a I know this!) via a cookie. Since we are looking to include STunnel in our offerings I was wondering if we could increase or change the maximum allowed size. I have a script that will generate a test cookie of any size that I require to test with but I can only get an 8K cookie to work. Any help would be great. ~Yours, Scott [root@localhost ~]# stunnel -version stunnel 4.54 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.0-fips 29 Mar 2010 Threading:PTHREAD SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:POLL+IPv6 Global options: debug = daemon.notice pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = ALL:!SSLv2:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH (with "fips = no") sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds sslVersion = TLSv1 (with "fips = yes") sslVersion = TLSv1 for client, all for server (with "fips = no") stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none [root@localhost ~]# -- With Kind Regards. Scott McKeown Loadbalancer.org http://www.loadbalancer.org

2 2

Problem using stunnel on Windows 7
by Hal Hovland 18 Nov '12

18 Nov '12

I've spent days googling this and read everything relevant in the archives. I'm developing a Windows 7 program that connects to a financial trading exchange that expects all communication to be SSL'd. Everything I read said that stunnel is the answer because of ease of installation and use. After a day of abortive attempts to link to the exchange, I decided to create a much simpler test environment involving two Windows 7 computers next to each other here. One, let's call it Riven-II (192.168.1.9), is set up with a simple Listener program that listens on port 8000. From stunnel's viewpoint this will be a server. The second machine, Lightning (192.168.1.158), has a simple Sender program that sends a text message via port 7999 to Riven-II (192.168.1.9:8000) - this will be the Client. In the absence of stunnel, all messages sent from Lightning/Sender appears on the window of Listener. So far so good. I've downloaded and installed the very latest version (4.54) of stunnel on both machines. On installation I entered the same responses to the certificate generating process. On the Server machine, hard wired to a Broadband Router, I configured stunnel.conf as (removing comments for simplicity) debug = 7 output = stunnel.log socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 cert = stunnel.pem key = stunnel.pem options = NO_SSLv2 taskbar=yes [Listener] connect=8000 accept=8001 On the Client machine, connected to the router via wi-fi, we have in stunnel.conf debug = 7 output = stunnel.log cert = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 fips=no options = NO_SSLv2 delay=yes taskbar=yes client=yes [sender] accept = 0.0.0.0:7999 (I've tried just 7999 and 192.168.1.158:7999, here. Makes no difference) connect = 192.168.1.9:8001 I've tried many variations with the same result, but the above is where they have ended up. My understanding of this is that stunnel both ends will be intercepting port 8000 on the Server and port 7999 on the Client and presenting/receiving SSL encoded messages across the wire on port 8001. Starting stunnel in the Server (not as a Windows service, although I did try that as well) the following log appears: 2012.11.16 22:34:08 LOG7[3484:6184]: No limit detected for the number of clients 2012.11.16 22:34:08 LOG5[3484:6184]: stunnel 4.54 on x86-pc-msvc-1500 platform 2012.11.16 22:34:08 LOG5[3484:6184]: Compiled/running with OpenSSL 1.0.1c-fips 10 May 2012 2012.11.16 22:34:08 LOG5[3484:6184]: Threading:WIN32 SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:SELECT+IPv6 2012.11.16 22:34:08 LOG5[3484:6184]: Reading configuration from file stunnel.conf 2012.11.16 22:34:08 LOG5[3484:6184]: FIPS mode is enabled 2012.11.16 22:34:08 LOG7[3484:6184]: Compression not enabled 2012.11.16 22:34:08 LOG7[3484:6184]: Snagged 64 random bytes from C:/.rnd 2012.11.16 22:34:08 LOG7[3484:6184]: Wrote 1024 new random bytes to C:/.rnd 2012.11.16 22:34:08 LOG7[3484:6184]: PRNG seeded successfully 2012.11.16 22:34:08 LOG6[3484:6184]: Initializing service [Listener] 2012.11.16 22:34:08 LOG7[3484:6184]: Certificate: stunnel.pem 2012.11.16 22:34:08 LOG7[3484:6184]: Certificate loaded 2012.11.16 22:34:08 LOG7[3484:6184]: Key file: stunnel.pem 2012.11.16 22:34:08 LOG7[3484:6184]: Private key loaded 2012.11.16 22:34:08 LOG7[3484:6184]: Could not load DH parameters from stunnel.pem 2012.11.16 22:34:08 LOG7[3484:6184]: Using hardcoded DH parameters 2012.11.16 22:34:08 LOG7[3484:6184]: DH initialized with 2048-bit key 2012.11.16 22:34:08 LOG7[3484:6184]: ECDH initialized with curve prime256v1 2012.11.16 22:34:08 LOG7[3484:6184]: SSL options set: 0x01000004 2012.11.16 22:34:08 LOG5[3484:6184]: Configuration successful 2012.11.16 22:34:08 LOG7[3484:6184]: Service [Listener] (FD=272) bound to 0.0.0.0:8001 On the Client, the log shows: 2012.11.16 22:25:53 LOG7[4184:4948]: No limit detected for the number of clients 2012.11.16 22:25:53 LOG5[4184:4948]: stunnel 4.54 on x86-pc-msvc-1500 platform 2012.11.16 22:25:53 LOG5[4184:4948]: Compiled/running with OpenSSL 1.0.1c-fips 10 May 2012 2012.11.16 22:25:53 LOG5[4184:4948]: Threading:WIN32 SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:SELECT+IPv6 2012.11.16 22:25:53 LOG5[4184:4948]: Reading configuration from file stunnel.conf 2012.11.16 22:25:53 LOG5[4184:4948]: FIPS mode is disabled 2012.11.16 22:25:53 LOG7[4184:4948]: Compression not enabled 2012.11.16 22:25:53 LOG7[4184:4948]: Snagged 64 random bytes from C:/.rnd 2012.11.16 22:25:53 LOG7[4184:4948]: Wrote 1024 new random bytes to C:/.rnd 2012.11.16 22:25:53 LOG7[4184:4948]: PRNG seeded successfully 2012.11.16 22:25:53 LOG6[4184:4948]: Initializing service [sender] 2012.11.16 22:25:53 LOG7[4184:4948]: Certificate: stunnel.pem 2012.11.16 22:25:53 LOG7[4184:4948]: Certificate loaded 2012.11.16 22:25:53 LOG7[4184:4948]: Key file: stunnel.pem 2012.11.16 22:25:53 LOG7[4184:4948]: Private key loaded 2012.11.16 22:25:53 LOG7[4184:4948]: SSL options set: 0x01000004 2012.11.16 22:25:53 LOG5[4184:4948]: Configuration successful 2012.11.16 22:25:53 LOG7[4184:4948]: Service [sender] (FD=224) bound to 0.0.0.0:7999 Running the Listener on the Server and Sender on the Client adds nothing to the log, and port sniffers on both machines show traffic between 7999 and 8000 (exactly the same as when stunnel is not running). No sign of the use of port 8001. I'd appreciate any input on this. I'm sure I must be doing something stupid, but I've watched hours of YouTube videos, read many hundreds of web pages, and been through the documentation quite a few times, to no avail. I have a Java based version, running in a JVM in the same Windows machines, that talks perfectly to the exchange using some inbuilt SSL capabilities of an included library, so that should probably eliminate any hardware/router issues? Regards, Hal

4 10

log rotation
by Michael Curran 11 Nov '12

11 Nov '12

Are there any built in stunnel.conf parameters for log rotation? Im looking for windows based -- not logrotate on unix -- thats simple Do I need to use windows third party logrotate tools to make this happen instead?

2 1

High memory usage problem.
by Jeremy Frady 11 Nov '12

11 Nov '12

Thanks for taking the time to read this. We're operating on a low spec system that can not be modified at this point. stunnel was introduced at the last minute, without consideration to resource requirements and now consumes enough ram to cause the kernel to issue OOM exceptions. So in short, we are trying to trade increased CPU usage for less memory usage and have tried setting “sessions” to 3600 to reduce memory pressure, but unfortunately it doesn't last. Our current solution is to cron a restart of stunnel on a regular basis, but would prefer to limit number of threads or number of cache entries or something else altogether similarly gentler. Thanks again for your consideration and assistance in this! If there's any specific information I can give, please let me know. Regards, Jeremy

2 1

How do I re-encrypt ssl traffic with stunel?
by Arsen Zahray 11 Nov '12

11 Nov '12

I'm trying to set up wireshark debugging of ssl traffic by following this article: http://www.webos-internals.org/wiki/Decrypt_SSL_(trusted_man-in-the-middle_t echnique) It lists following stunnel commands to do the job: Listen on local IP and de-SSL traffic to localhost:8080 sudo stunnel -p ps.pem -d 443 -r 8080 Listen on 8080, re-SSL to remote server on 443 sudo stunnel -c -d 8080 -r ps.palmws.com:443 The article seems outdated, and stunnel does not react on these commands anymore. Can anyone provide me with a proper configuration file to do the same?

3 2

FIPS enablement
by Michael Curran 05 Nov '12

05 Nov '12

Hello I think there is a bit of confusion within my company on what stunnel can do in regards to FIPS 140-2 out of the box. I know there are configuration options that can enable or disable FIPS 140-2 mode, but as the man page indicates fips = yes | no Enable or disable FIPS 140-2 mode. This option allows to disable entering FIPS mode if stunnel was compiled with FIPS 140-2 support. default: yesWhich to me says I have to compile stunnel on my own using openssl with fips libraries to build a Stunnel binary that can support FIPS 140-2 compliance -- if I download just the windows or unix binaries and install them -- then I am not going to be 140-2 compliant where I set the config file to yes or no , since the FIPS modules wont be compiled into the binary. I'm just looking for confirmation before I take this back to the rest of my group. Thanks!! Michael Curran

3 2

Re: [stunnel-users] Fw: Using stunnel to add https to a webserver that doesn't have ssl setup
by mkanet＠yahoo.com 02 Nov '12

02 Nov '12

Thanks for the reply. Lots of friendly people on here. I should have probably posted my solution when I figured it out. I was already using a server-based method to handle redirection. However, what I didn't consider is adding a one line exception that distinguishes incoming requests from stunnel on 127.0.0.1 in order to prevent an endless loop. I did this by modifying my IIS URL Rewrite module rule to look like below. URL Rewrite module 2.0 is highly optimized; and is ideal for this kind of thing; works perfect under any circumstance; so long as webpages contain relative elements. Works like a charm. <rewrite> <rules> <rule name="HTTP to HTTPS redirect" stopProcessing="true"> <match url="(.*)" /> <conditions logicalGrouping="MatchAll"> <add input="{HTTPS}" pattern="off" ignoreCase="true" /> <add input="{REMOTE_ADDR}" pattern="127.0.0.1" negate="true" /> </conditions> <action type="Redirect" redirectType="Found" url="https://{HTTP_HOST}/{R:1}" /> </rule> </rules> </rewrite> ----- Forwarded Message ----- On Tue, 30 Oct 2012 15:05:54 -0700 (PDT) <mkanet(a)yahoo.com> wrote: > Thanks. I typically let my webserver handle SSL whenever I can since > it's much easier that way; especially since I know how to handle > http->https urlrewrites that way already; and, plenty of examples on > the web for IIS. The reasons for adding stunnel into the mix in this > scenerio completely outweight not having it at all. I couldn't find > any examples anywhere showing how to handle a simple http to https URL redirect if stunnel is involved; not even in javascript. > Hopefully someone here has the expertise to offer a solution at least in html. The easiest way is to use a server side language as PHP and ASP or CGI/perl (if ISS is capable, that I don't know). If you relay on client (javascript, meta refresh) you can't control the behavior of the client (javascript disabled by user or meta redirects). ISS is capable of PHP and, if you are using it, because you didn't tell, is easy (easy, but I haven't done as I don't know much of PHP (I just played a couple of times with it following tutorials)). With ASP, I don't know, but should be possible too. Here you have an example with PHP: http://www.iis-aid.com/articles/how_to_guides/three_methods_redirect_http_h… or this one: http://stackoverflow.com/questions/5106313/redirecting-from-http-to-https-w… (second message). As I said, you have to do it transparent to the user without relying on them.

1 0

Fw: Using stunnel to add https to a webserver that doesn't have ssl setup
by Michael Avanessian 02 Nov '12

02 Nov '12

Thanks. I typically let my webserver handle SSL whenever I can since it's much easier that way; especially since I know how to handle http->https urlrewrites that way already; and, plenty of examples on the web for IIS. The reasons for adding stunnel into the mix in this scenerio completely outweight not having it at all. I couldn't find any examples anywhere showing how to handle a simple http to https URL redirect if stunnel is involved; not even in javascript. Hopefully someone here has the expertise to offer a solution at least in html. On 30.10.2012 20:39, MKANET wrote > Thanks for the quick reply! So... what http code do I use to break > out the infinite loop so it loads only once? I'm afraid I can't answer that one, as you're using IIS and I'm Unices centered. FWIW, in situations where the port-80 service does *nothing but* hand out redirects to port 443, I typically let the full-blown webserver handle the HTTPS (whether natively or behind an SSL wrapper) and use a boilerplate PERL script (alas, not readily usable on Windows) for the redirecting. I've seen too many kinds of webserver doing redirections to autodetermined URLs that happen to miss some vital part of the originally requested URL, including some that *cause* the browser to drop from HTTPS back to HTTP in the first place. :-S Regards, ----- Forwarded Message ---- Thanks for the quick reply! So... what http code do I use to break out the infinite loop so it loads only once? I think the other 2 circumstances may have something similar happening to them (which are forwarded using the web server instead). If I use the webserver to rewrite the URL, the web browser tries to do something (I can't tell what), then returns the error below: The page isn't redirecting properly Firefox has detected that the server is redirecting the request for this address in a way that will never complete. > Normally, I could do this a few different ways (provided my webserver > had ssl added to it natively in a normal way) 1. webserver URL Rewrite > plugin 2. webserver redirect plugin > 3: > > For whatever reason, I'm having all sorts of weird issues when > trying the three methods above if I use stunnel for ssl instead of > using the webserver's builtin ssl. Please note that traffic coming out of the stunnel looks - and actually *is* - just as port-80-ish to the actual webserver as native HTTP requests do, so unless you take special measures to break the loop, the webserver will try to (re-)redirect *that, too*. Regards, J. Bern --

2 1

enabling https capability
by John A. Wallace 01 Nov '12

01 Nov '12

Not sure if this is the right place to ask, but I will give it a try because it seems likely that someone here can point me in the right direction if need be. I am not a programmer. I have an application that can make http connections but not https. The connections are made from a Windows command line interface, not a browser. I would like to enable it to make https connections too without having to reinvent the wheel. If there is some way to connect it to an intermediary proxy program that does have built-in support for the https protocol, that would be swell. Is such a thing possible or is there another solution I don't see? Thanks. John

2 1

Fwd: Trying to minimize memory usage for a scenario where we have several long-lived HTTPS connections.
by Jeremy Frady 31 Oct '12

31 Oct '12

Hello all, Thanks for taking the time to read this. We're operating on a low spec system that can not be modified at this point. stunnel was introduced at the last minute, without consideration to resource requirements and now consumes enough ram to cause the kernel to issue OOM exceptions. So in short, we are trying to trade increased CPU usage for less memory usage and have tried setting “sessions” to 3600 to reduce memory pressure, but unfortunately it doesn't last. Our current solution is to cron a restart of stunnel on a regular basis, but would prefer to limit number of threads or number of cache entries or something else altogether similarly gentler. Thanks again for your consideration and assistance in this! Regards, Jeremy

1 0

6 processes + out of memory issues on CentOS 6 stunnel (4.29)
by Todd Rinaldo 31 Oct '12

31 Oct '12

I'm experimenting with using the stunnel that comes with CentOS 6 (4.29). I have a config file that is successfully being used on stunnel version 4.15 on the same host without any issues. My issues: 1. starting stunnel creates 6 processes. I assume this has something to do with libwrap, but I'm not finding much discussion about it by doing a search. I'm also assuming that the binaries are forking after load, so it's not a significant memory expense to do this due to COW. Is this correct? 2. I'm getting 't of memory' (no "ou" in the error) messages from syslog when I do more than one request via chrome to port 2087. The process indicated from the message points to the stunnel process that has ownership of the open ports. A single request to this port doesn't seem to spawn the issue. Can anyone suggest what might be causing this? Upgrading to a newer version of stunnel is possible, but I would prefer to keep the version Red Hat provides so they can be on the hook for CVE issues. My config file follows: ----- cert = /var/cpanel/ssl/cpanel/cpanel.pem chroot = /usr/local/cpanel/var/run/stunnel/ # PID is created inside chroot jail pid = /stunnel.pid setuid = cpanel setgid = cpanel # Service-level configuration [cpanelhttps] accept = 2083 connect = 2082 TIMEOUTclose = 0 [whmhttps] accept = 2087 connect = 2086 TIMEOUTclose = 0 [webmailhttps] accept = 2096 connect = 2095 TIMEOUTclose = 0

1 0

Re: [stunnel-users] Using stunnel to add https to a webserver that doesn't have ssl setup
by Michael Avanessian 30 Oct '12

30 Oct '12

Thanks for the quick reply! So... what http code do I use to break out the infinite loop so it loads only once? I think the other 2 circumstances may have something similar happening to them (which are forwarded using the web server instead). If I use the webserver to rewrite the URL, the web browser tries to do something (I can't tell what), then returns the error below: The page isn't redirecting properly Firefox has detected that the server is redirecting the request for this address in a way that will never complete. > Normally, I could do this a few different ways (provided my webserver > had ssl added to it natively in a normal way) 1. webserver URL Rewrite > plugin 2. webserver redirect plugin > 3: > > For whatever reason, I'm having all sorts of weird issues when > trying the three methods above if I use stunnel for ssl instead of > using the webserver's builtin ssl. Please note that traffic coming out of the stunnel looks - and actually *is* - just as port-80-ish to the actual webserver as native HTTP requests do, so unless you take special measures to break the loop, the webserver will try to (re-)redirect *that, too*. Regards, J. Bern --

2 1

Using stunnel to add https to a webserver that doesn't have ssl setup
by Michael Avanessian 30 Oct '12

30 Oct '12

Hi there. I appreciate that you guys are all helping each other out. I am brand new to stunnel. Currently, I'm using stunnel to add https to a webserver that doesn't have ssl setup; which works great. I prefer to do that instead of using the webserver's builtin ssl feature. CONFIGURATION: Stunnel.conf includes (which adds ssl to incoming http traffic on port 443) [https] accept = 443 connect = 80 Also, incoming http:80 traffic can also come in; which would bypass stunnel, and go directly to the webserver as http. OBJECTIVE: I am trying to make it so when someone visits: http://mywebsite.com (it forwards automatically to https://mywebsite.com) Normally, I could do this a few different ways (provided my webserver had ssl added to it natively in a normal way) 1. webserver URL Rewrite plugin 2. webserver redirect plugin 3: <meta http-equiv="refresh" content="0; url=https://mywebsite.com"> For whatever reason, I'm having all sorts of weird issues when trying the three methods above if I use stunnel for ssl instead of using the webserver's builtin ssl. The first two methods result in web browser redirect errors, the third method result in an infinite loop reloading the https website. Can someone please tell me what extra accommodation I need to make considering that using stunnel for https can complicate things. I'm using IIS 7.5 as my webserver. I've tried using the the URL rewrite 2.0 mod using the below rule (which works for normal builtin ssl support in the webserver: <rule name="Redirect to HTTPS" stopProcessing="true"> <match url="(.*)" /> <conditions><add input="{HTTPS}" pattern="^OFF$" /> </conditions> </rule> I have also tried the "http redirect" mod; which I can forward to any website except for the one I'm trying to do. Both take me to the https equivalent and give a redirect error. Could someone please be kind enough to tell me what I'm missing? Thanks!

2 1

How upgrade stunnel?
by magali morales 30 Oct '12

30 Oct '12

Hi!! I have installed the version 4.44 of stunnel, haproxy I am currently using 1.4.22. I need to update stunnel most recent version. How do I update stunnel to the latest version? And I want to know How do I uninstall stunnel? I hope you can help me, I thank you in advance!

7 7

TIMEOUTclose exceeded: closing
by Michael Wittig 25 Oct '12

25 Oct '12

Hi, I am using stunnes 4.54, my config looks like this: chroot = /opt/stunnel/jail/ setuid = stunnel setgid = stunnel pid = /stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 syslog = yes debug = local1.warning fips = no [http] cert = /opt/stunnel/www.crt key = /opt/stunnel/www.key sslVersion = all options = NO_SSLv2 renegotiation = no accept = 192.168.72.10:443 connect = 192.168.71.10:80 TIMEOUTclose = 0 xforwardedfor = yes My log is full with: Oct 25 14:49:33 www stunnel: LOG3[15114:140668359968512]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing Oct 25 14:49:36 www stunnel: LOG3[15114:140668360591104]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing Oct 25 14:50:08 www stunnel: LOG3[15114:140668360812288]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing Oct 25 14:50:13 www stunnel: LOG3[15114:140668360591104]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing The doc suggests to "set to 0 for buggy MSIE" the mailing list tells me "You requested close timeout of 0 seconds and that's exactly what you get." But i still don't understand why this is an error and what can I do to get rid of it? Or is it okay to don't look for errors in the log? Regards, Michael

2 1

some version issue
by Sergey Pimenov 25 Oct '12

25 Oct '12

Hello, I have a little problem, working with stunnel. The problem is: 25 10:50:53 LOG3[2612:1972]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number and the full log: 25 10:50:32 LOG7[2612:2988]: No limit detected for the number of clients 2012.10.25 10:50:32 LOG5[2612:2988]: stunnel 4.53 on x86-pc-mingw32-gnu platform 2012.10.25 10:50:32 LOG5[2612:2988]: Compiled/running with OpenSSL 0.9.8s-fips 4 Jan 2012 2012.10.25 10:50:32 LOG5[2612:2988]: Threading:WIN32 SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:SELECT+IPv6 2012.10.25 10:50:32 LOG5[2612:2988]: Reading configuration from file stunnel.conf 2012.10.25 10:50:33 LOG5[2612:2988]: FIPS mode is enabled 2012.10.25 10:50:33 LOG7[2612:2988]: Compression not enabled 2012.10.25 10:50:33 LOG7[2612:2988]: PRNG seeded successfully 2012.10.25 10:50:33 LOG6[2612:2988]: Initializing service section [POS] 2012.10.25 10:50:33 LOG7[2612:2988]: Certificate: C:\Arcus2\SSL\pos3135pem.pem 2012.10.25 10:50:33 LOG7[2612:2988]: Certificate loaded 2012.10.25 10:50:33 LOG7[2612:2988]: Key file: C:\Arcus2\SSL\pos3135key.pem 2012.10.25 10:50:33 LOG7[2612:2988]: Private key loaded 2012.10.25 10:50:33 LOG7[2612:2988]: SSL options set: 0x00000004 2012.10.25 10:50:33 LOG5[2612:2988]: Configuration successful 2012.10.25 10:50:33 LOG7[2612:2988]: Service [POS] (FD=180) bound to 127.0.0.1:9021 2012.10.25 10:50:53 LOG7[2612:2988]: Service [POS] accepted (FD=260) from 127.0.0.1:3645 2012.10.25 10:50:53 LOG7[2612:2988]: Creating a new thread 2012.10.25 10:50:53 LOG7[2612:2988]: New thread created 2012.10.25 10:50:53 LOG7[2612:1972]: Service [POS] started 2012.10.25 10:50:53 LOG5[2612:1972]: Service [POS] accepted connection from 127.0.0.1:3645 2012.10.25 10:50:53 LOG6[2612:1972]: connect_blocking: connecting 217.69.205.63:9021 2012.10.25 10:50:53 LOG7[2612:1972]: connect_blocking: s_poll_wait 217.69.205.63:9021: waiting 10 seconds 2012.10.25 10:50:53 LOG5[2612:1972]: connect_blocking: connected 217.69.205.63:9021 2012.10.25 10:50:53 LOG5[2612:1972]: Service [POS] connected remote server from 213.156.128.147:3646 2012.10.25 10:50:53 LOG7[2612:1972]: Remote socket (FD=284) initialized 2012.10.25 10:50:53 LOG3[2612:1972]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2012.10.25 10:50:53 LOG5[2612:1972]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2012.10.25 10:50:53 LOG7[2612:1972]: Remote socket (FD=284) closed 2012.10.25 10:50:53 LOG7[2612:1972]: Local socket (FD=260) closed 2012.10.25 10:50:53 LOG7[2612:1972]: Service [POS] finished (0 left) my .conf file is: cert = C:\Arcus2\SSL\pos3135pem.pem key = C:\Arcus2\SSL\pos3135key.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 CAfile = C:\Arcus2\SSL\cacert.pem debug = 7 output = stunnel.log [POS] client = yes accept = 127.0.0.1:9021 connect = xxx.xxx.xxx.xxx:9021 if I change conf file, adding sslVersion = all or sslVersion = SSLv3, I have another error Section POS: sslVersion = TLSv1 is required in FIPS mode Thank your for help, Sergey Pimenov

2 1

Stunnel 4.54 manifest
by John A. Wallace 24 Oct '12

24 Oct '12

Hi, Michal. Good news about the update! I noticed that this version, the one for Windows installation, has many more files in it than the last version. It's no problem, but I was just wondering why the change this time? Thanks. John > -----Original Message----- > From: stunnel-announce-bounces(a)stunnel.org [mailto:stunnel-announce- > bounces(a)stunnel.org] On Behalf Of stunnel-announce-request(a)stunnel.org > Sent: Wednesday, October 10, 2012 5:00 AM > To: stunnel-announce(a)stunnel.org > Subject: stunnel-announce Digest, Vol 48, Issue 1 > > Send stunnel-announce mailing list submissions to > stunnel-announce(a)stunnel.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-announce > or, via email, send a message with subject or body 'help' to > stunnel-announce-request(a)stunnel.org > > You can reach the person managing the list at > stunnel-announce-owner(a)stunnel.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-announce digest..." > > > Today's Topics: > > 1. stunnel 4.54 released (Michal Trojnara) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 09 Oct 2012 23:37:41 +0200 > From: Michal Trojnara <Michal.Trojnara(a)mirt.net> > To: stunnel-users(a)stunnel.org, stunnel-announce(a)stunnel.org, > openssl-users(a)openssl.org > Subject: [stunnel-announce] stunnel 4.54 released > Message-ID: <50749925.8030905(a)mirt.net> > Content-Type: text/plain; charset="iso-8859-1" > > Dear Users, > > > I have released version 4.54 of stunnel. The ChangeLog entry: > > > Version 4.54, 2012.10.09, urgency: MEDIUM: > * New Win32 features > - FIPS module updated to version 2.0. > - OpenSSL DLLs updated to version 1.0.1c. > - zlib DLL updated to version 1.2.7. > - Engine DLLs added: 4758cca, aep, atalla, capi, chil, cswift, gmp, > gost, nuron, padlock, sureware, ubsec. > * Other new features > - "session" option renamed to more readable "sessionCacheTimeout". > The old name remains accepted for backward compatibility. > - New service-level "sessionCacheSize" option to control session cache > size. > - New service-level option "reset" to control whether TCP RST flag is > used to indicate errors. The default value is "reset = yes". > - New service-level option "renegotiation" to disable SSL > renegotiation. > This feature is based on a public-domain patch by Janusz Dziemidowicz. > - New FreeBSD socket options: IP_FREEBIND, IP_BINDANY, IPV6_BINDANY > (thx to Janusz Dziemidowicz). > - New parameters to configure TLS v1.1/v1.2 with OpenSSL version 1.0.1 > or higher (thx to Henrik Riomar). > * Bugfixes > - Fixed "Application Failed to Initialize Properly (0xc0150002)" error. > - Fixed missing SSL state debug log entries. > - Fixed a race condition in libwrap code resulting in random stalls > (thx to Andrew Skalski). > - Session cache purged at configuration file reload to reduce memory > leak. > Remaining leak of a few kilobytes per section is yet to be fixed. > - Fixed regression bug in "transparent = destination" functionality > (thx to Stefan Lauterbach). This bug was introduced in stunnel 4.51. > - "transparent = destination" is now a valid endpoint in inetd mode. > - "delay = yes" fixed to work even if specified *after* "connect" > option. > - Multiple "connect" targets fixed to also work with delayed resolver. > - The number of resolver retries of EAI_AGAIN error has been limited > to > 3 in order to prevent infinite loops.. > > > Home page: https://www.stunnel.org/ <http://stunnel.mirt.net/> > Download: https://www.stunnel.org/downloads.html > <ftp://stunnel.mirt.net/stunnel/> > > > SHA-256 hash for stunnel-4.54.tar.gz: > > b7e1b9e63569574dbdabee8af90b8ab88db3fe13dcb1268d59a1408c56e6de7b > > > Best regards, > > Mike > > > -------------- next part -------------- A non-text attachment was > scrubbed... > Name: signature.asc > Type: application/pgp-signature > Size: 196 bytes > Desc: OpenPGP digital signature > URL: <http://www.stunnel.org/pipermail/stunnel- > announce/attachments/20121009/f9eac1e3/attachment-0001.pgp> > > ------------------------------ > > _______________________________________________ > stunnel-announce mailing list > stunnel-announce(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-announce > > > End of stunnel-announce Digest, Vol 48, Issue 1 > ***********************************************

3 6

Re: [stunnel-users] (no subject)
by John 23 Oct '12

23 Oct '12

wrote in message news:... Path: news.gmane.org!not-for-mail From: Leandro Avila <leandro.avila(a)ymail.com> Newsgroups: gmane.network.stunnel.user Subject: Re: Safest suggested client/server stunnel configurations to prevent MITM attacks Date: Mon, 22 Oct 2012 12:50:07 -0700 (PDT) Lines: 52 Approved: news(a)gmane.org Message-ID: <1350935407.72221.YahooMailNeo(a)web111004.mail.gq1.yahoo.com> References: <4B5D7F24543C2E4DB3172B1F82446E56C8473D31(a)CBMBOX1.cloudblock.com> Reply-To: Leandro Avila <leandro.avila(a)ymail.com> NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 X-Trace: ger.gmane.org 1350935423 5511 80.91.229.3 (22 Oct 2012 19:50:23 GMT) X-Complaints-To: usenet(a)ger.gmane.org NNTP-Posting-Date: Mon, 22 Oct 2012 19:50:23 +0000 (UTC) To: "Michael K. Avanessian" <michael(a)mka.net>, "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Original-X-From: stunnel-users-bounces(a)stunnel.org Mon Oct 22 21:50:30 2012 Return-path: <stunnel-users-bounces(a)stunnel.org> Envelope-to: gnsu-stunnel-users(a)m.gmane.org Original-Received: from linode.mirt.net ([207.192.69.165]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from <stunnel-users-bounces(a)stunnel.org>) id 1TQO15-0006Lq-PI for gnsu-stunnel-users(a)m.gmane.org; Mon, 22 Oct 2012 21:50:28 +0200 Original-Received: from linode.mirt.net (localhost [127.0.0.1]) by linode.mirt.net (Postfix) with ESMTP id E06E11C115; Mon, 22 Oct 2012 21:50:13 +0200 (CEST) X-Original-To: stunnel-users(a)stunnel.org Delivered-To: stunnel-users(a)stunnel.org Original-Received: from nm7-vm0.bullet.mail.ne1.yahoo.com (nm7-vm0.bullet.mail.ne1.yahoo.com [98.138.91.66]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by linode.mirt.net (Postfix) with ESMTPS id 2914F1C0F8 for <stunnel-users(a)stunnel.org>; Mon, 22 Oct 2012 21:50:09 +0200 (CEST) Original-Received: from [98.138.90.52] by nm7.bullet.mail.ne1.yahoo.com with NNFMP; 22 Oct 2012 19:50:08 -0000 Original-Received: from [98.138.89.195] by tm5.bullet.mail.ne1.yahoo.com with NNFMP; 22 Oct 2012 19:50:08 -0000 Original-Received: from [127.0.0.1] by omp1053.mail.ne1.yahoo.com with NNFMP; 22 Oct 2012 19:50:08 -0000 X-Yahoo-Newman-Property: ymail-3 X-Yahoo-Newman-Id: 65068.27023.bm(a)omp1053.mail.ne1.yahoo.com Original-Received: (qmail 75038 invoked by uid 60001); 22 Oct 2012 19:50:07 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ymail.com; s=s1024; t=1350935407; bh=0Y+VdggsIVZOwOr4EaEYksE57qG+K4Xf7m79PQuMl/4=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type:Content-Transfer-Encoding; b=uUP64Hu7MIb0ahLEqKeQ2rUov8flXv6sjA7h5DanB+bxl2m8dRHLsiUrFHiPFhWcsNIUGtevpvfsxYifmZPjIMTiOvHyxZPxQo2uXvlAzOZKwPuaNEvXrYVNiwVO0nZjG00eA+Gpo8dJCS50OObUbvjympoIhG60TioBD4rSw5U= DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=ymail.com; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type:Content-Transfer-Encoding; b=wx17KKam+BlR2A3orpl30Y8/UU3T1ZQ5cDajNEkq008Ppz1baFHK10kwWYt35qPShDTswy2xduxRIzGN/JTVdE8Vb9hFmfmWPtOkptIRxMf26YV6r/x53AKs8rACXc8tNyJVeczxzNSAE1/iycwLc4Q5lwdUda4qUe8+09gtNa0=; X-YMail-OSG: b3DSDKgVM1mQHP5ZBTfIr3A5W2ZGXp385_N0YTtfmQmY8Tx PSFpP624fQl9zaJm1NcwnCvuFSUunTJ.Q6u_X6ZqnTdr.J_LYAj5IOqyykQ2 l4Al99RB4Au24agY5aySFUQj2AVKVLlThmnaaZKrM2O6i4lQj42kjXE9SjCN Ko1OE8i8SRI1X8s_OszQhSFqPwpJVxJ6a8XwsT.HHRvnjCN5oawxLfeYhi8I Nc497s5NZ3BjLmS2ddO1rE_aDEXfeZZf5G4FssKYeY.CR5XmhczPnRsqEOO0 nYj_KNi6UlLDyqhpRuMqUJYBD.JQXLJzN9IG3zKYBdvkip2LXSMmutoKPT8Z oEEAd3OEom9Rew5fODminUDtopQjgJUGkRl5fJPz2xthop6HA8XuKHCMTM6B d1YYbS_V1c5QklFH6aN6XbAYJRG36RA9gKBGsO2BVZ_5t36738Y3Bff.0ySt 6iW79amGPEIc__mjy0VELbOmQ3WPpHOPdBiH.GuHKGcmpVqApD5u2dHxOWa0 cJzYLcE0Fdfsdr6YOWGOh9jGD.P.St5QItI4sMxAhQ9WROechXtibFdHjrFO _Md3OgU8mIpgCFwIbK4b2K4cyPAiM5Kl1P_uFLQ5HE9uAg_8I64GtaSYyTGM 1aFaD9IVrniBqWo.oWvM2Lp.7TyGddU7.olqsc6MmSljcf4b.Rx5cRTwDw2R Kqc1fDQWPPxDDd1pMa1Nasg27P2qGUEy1DSofVwCgDn9MSKvSGj8- Original-Received: from [134.161.133.36] by web111004.mail.gq1.yahoo.com via HTTP; Mon, 22 Oct 2012 12:50:07 PDT X-Rocket-MIMEInfo: 001.001, Pl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCj4gRnJvbTogTWljaGFlbCBLLiBBdmFuZXNzaWFuIDxtaWNoYWVsQG1rYS5uZXQ.Cj5UbzogInN0dW5uZWwtdXNlcnNAc3R1bm5lbC5vcmciIDxzdHVubmVsLXVzZXJzQHN0dW5uZWwub3JnPiAKPlNlbnQ6IEZyaWRheSwgT2N0b2JlciAxOSwgMjAxMiAxMDo0MSBQTQo.U3ViamVjdDogW3N0dW5uZWwtdXNlcnNdIFNhZmVzdCBzdWdnZXN0ZWQgY2xpZW50L3NlcnZlciBzdHVubmVsIGNvbmZpZ3VyYXRpb25zIHRvIHByZXZlbnQgTUlUTSBhdHRhY2tzCgoBMAEBAQE- X-Mailer: YahooMailWebService/0.8.123.460 In-Reply-To: <4B5D7F24543C2E4DB3172B1F82446E56C8473D31(a)CBMBOX1.cloudblock.com> X-BeenThere: stunnel-users(a)stunnel.org X-Mailman-Version: 2.1.13 Precedence: list List-Id: "public, moderate-volume list - general discussion, problem reports, patches" <stunnel-users.stunnel.org> List-Unsubscribe: <https://www.stunnel.org/cgi-bin/mailman/options/stunnel-users>, <mailto:[email protected]?subject=unsubscribe> List-Archive: <http://www.stunnel.org/pipermail/stunnel-users> List-Post: <mailto:[email protected]> List-Help: <mailto:[email protected]?subject=help> List-Subscribe: <https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users>, <mailto:[email protected]?subject=subscribe> Original-Sender: stunnel-users-bounces(a)stunnel.org Errors-To: stunnel-users-bounces(a)stunnel.org Xref: news.gmane.org gmane.network.stunnel.user:5976 Archived-At: <http://permalink.gmane.org/gmane.network.stunnel.user/5976> Pl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCj4gRnJvbTogTWljaGFlbCBLLiBBdmFu ZXNzaWFuIDxtaWNoYWVsQG1rYS5uZXQ+Cj5UbzogInN0dW5uZWwtdXNlcnNAc3R1bm5lbC5vcmci IDxzdHVubmVsLXVzZXJzQHN0dW5uZWwub3JnPiAKPlNlbnQ6IEZyaWRheSwgT2N0b2JlciAxOSwg MjAxMiAxMDo0MSBQTQo+U3ViamVjdDogW3N0dW5uZWwtdXNlcnNdIFNhZmVzdCBzdWdnZXN0ZWQg Y2xpZW50L3NlcnZlciBzdHVubmVsIGNvbmZpZ3VyYXRpb25zIHRvIHByZXZlbnQgTUlUTSBhdHRh Y2tzCgo+SeKAmW0gY3VycmVudGx5IHR1bm5lbGluZyBTU0ggb3ZlciBTU0wgdXNpbmcgc3R1bm5l bC4KPkkgdGhvdWdodCB0aGF0IHN0dW5uZWxlZCBzc2ggZGF0YSB3YXMgc2FmZS7CoCBIb3dldmVy LCByZWNlbnRseSBJ4oCZdmUgcmVhZCB0aGF0IGlmIGdvaW5nIHRocm91Z2ggYSBzb3BoaXN0aWNh dGVkIGh0dHAvaHR0cHMgcHJveHksIGl04oCZcyBwb3NzaWJsZSB0byBiZSBoYWNrZWQgYnkgYSDi gJxsZWdpdGltYXRl4oCdIG1pdG0gYXR0YWNrIHRvIGZvb2wgYW4gU1NMIGNsaWVudC4KClR1bm5l bGVkIGFuZCBub3QtdHVubmVsZWQgU1NIIGRhdGEgX2lzXyBzYWZlLiBUaGUgU1NIIHByb3RvY29s IGlzIHByZXR0eSBzZWN1cmUgYnkgaXRzZWxmLsKgCgpNeSB1bmRlcnN0YW5kaW5nIGlzIHRoYXQg dG8gcHVsbCBvZmYgdGhlIHR5cGUgb2YgU1NML1RMUyBkYXRhIGluc3BlY3Rpb24gdGhhdCB5b3Ug bWVudGlvbgpodHRwOi8vd3d3LnNvdXJjZWZpcmUuY29tL3NlY3VyaXR5LXRlY2hub2xvZ2llcy9u ZXR3b3JrLXNlY3VyaXR5L3NzbC1lbmNyeXB0aW9uLWRlY3J5cHRpb24KCnRoZXJlIGhhcyB0byBi ZSBzb21lIHdvcmsgZG9uZSBvbiB0aGUgY2xpZW50IHNpZGUgb2YgdGhlIGNvbm5lY3Rpb24uIChJ bnN0YWxsIGEgY3VzdG9tCgpDQSBjZXJ0aWZpY2F0ZSBpbiB0aGUgdHJ1c3RlZCBjZXJ0aWZpY2F0 ZSBzdG9yZSBvZiB0aGUgY2xpZW50IG1hY2hpbmUpCgpTbyBldmVuIGlmIHlvdSB3ZXJlIG9uIHN1 Y2ggYSBuZXR3b3JrLCBhcyBsb25nIGFzIHlvdXIgImF0dGFja2VyIiBkb2VzIG5vdCBoYXZlIGNv bnRyb2wKb2YgeW91ciBtYWNoaW5lLiB0aGUgU1NML1RMUyBwcm90b2NvbCB3aWxsIHByb3RlY3Qg eW91IGJlY2F1c2Ugb2YgdGhlIHdheSBrZXlzIChjZXJ0aWZpY2F0ZXMpCmFyZSB2ZXJpZmllZC4g KE5vdGljZSB0aGUga2V5IHdvcmQgaGVyZSBpcyB2ZXJpZmllZCkKCj7CoAo+SXMgaXQgc3RpbGwg cG9zc2libGUgdG8gY29uZmlndXJlIHN0dW5uZWwgc28gdGhhdCBzc2wgY2Fu4oCZdCBiZSBjb21w cm9taXNlZCBiZXR3ZWVuIGJvdGggZW5kcz8KPsKgCj5J4oCZbSBnb2luZyB0byB0YWtlIGEgd2ls ZCBndWVzcyBoZXJlOyB3aGljaCBJ4oCZbSBzdXJlIEnigJltIHByb2JhYmx5IHdyb25nLsKgIEJ1 dCwgY291bGQgSSBqdXN0IGluc3RhbGwgc3R1bm5lbDsgYW5kLCBsZXQgaXQgY3JlYXRlIGF1dG9t YXRpY2FsbHkgYSBzZWxmLXNpZ25lZCAoc3R1bm5lbC5wZW0pIGNlcnRpZmljYXRlIGZpbGXigKYg dGhlbiBqdXN0IGNvcHkgdGhhdCBmaWxlIHRvIHRoZSBzdHVubmVsIGluc3RhbGwgb24gdGhlIG90 aGVyIGVuZD/CoCBUaGF0IHdheSBib3RoIHNpZGVzIGFyZSBhbHJlYWR5IGF3YXJlIG9mIGVhY2gg b3RoZXLigJlzIHB1YmxpYyBrZXlzOyBhbmQsIHdvdWxkbuKAmXQgYmUgdnVsbmVyYWJsZSBkdXJp bmcgdGhlIGluaXRpYWwgdW5lbmNyeXB0ZWQgaGFuZHNoYWtlPwo+wqAKPknigJltIHN1cmUgSeKA mW0gcHJvYmFibHkgd2F5IG9mZjsgYW5kLCB0aGVyZeKAmXMgbW9yZSBJIG5lZWQgdG8gZG8gaW4g c3R1bm5lbOKAmXMgY29uZmlndXJhdGlvbiB0byBmdXJ0aGVyIGVuc3VyZSB0aGUgU1NMIHdvbuKA mXQgYmUgY29tcHJvbWlzZWQuLiBzdWNoIGFzIHRoZSBzdHVubmVsIOKAnHZlcmlmeeKAnSBzZXR0 aW5nLsKgIEnigJltIG5vdCBzdXJlIHdoaWNoIHNldHRpbmcgdG8gaGF2ZSBpdDsgYW5kLCB3aGF0 IGl0IGFjdHVhbGx5IGRvZXMuCj7CoAo+SeKAmW0gaG9waW5nIHNvbWVvbmUgY291bGQgc2hlZCBz b21lIGxpZ2h0IG9uIHRoaXMgd2l0aCBzaW1wbGUgc3VnZ2VzdGVkIGNsaWVudMOgIHNlcnZlciBj b25maWdzIHRoYXQgd291bGQga2VlcCBzc2wgdW5jb21wcm9taXNlZCBhcyBtdWNoIGFzIHBvc3Np YmxlLgo+wqAKPlRoYW5rcyBpbiBhZHZhbmNlIQoKVGhlIGNvbmZpZ3VyYXRpb24geW91IGFyZSBs b29raW5nIGZvciBzdHVubmVsIGludm9sdmVzIHRoZSB2ZXJpZnkgbGV2ZWwgMyBzZXR0aW5nIG9u IHRoZSBjb25maWcKKFZlcmlmeSBwZWVyIHdpdGggbG9jYWxseSBpbnN0YWxsZWQgY2VydGlmaWNh dGUpCgpQbHVzIHRoZSBrZXkgbWFuYWdlbWVudCBpbnZvbHZlZCB0byBzZXQgdGhhdCB1cC4KClRh a2UgYSBsb29rIGEgdGhpcyBkb2N1bWVudC4gSXQgaXMgYSBsaXR0bGUgb3V0IG9mIGRhdGUuIEJV VCB0aGUgcGFydCBhYm91dCBzZXR0aW5nIHVwIHRoZQpjZXJ0aWZpY2F0ZXMgb24gY2xpZW50IGFu ZCBzZXJ2ZXIgc3RpbGwgYXBwbGllcy4gYW5kIGlzIGEgZ29vZCB3YXkgdG8gc3RhcnQKaHR0cDov L3d3dy5zeW1hbnRlYy5jb20vY29ubmVjdC9hcnRpY2xlcy9yZW1vdGUtZGVza3RvcC1tYW5hZ2Vt ZW50LXNvbHV0aW9uLW1pY3Jvc29mdAoKSG9wZSB0aGlzIGhlbHBzCgoKCkxlYW5kcm8gQXZpbGEK LS0tLS0tLS0tLS0tLS0tLQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXwpzdHVubmVsLXVzZXJzIG1haWxpbmcgbGlzdApzdHVubmVsLXVzZXJzQHN0dW5uZWwu b3JnCmh0dHBzOi8vd3d3LnN0dW5uZWwub3JnL2NnaS1iaW4vbWFpbG1hbi9saXN0aW5mby9zdHVu bmVsLXVzZXJzCg== ------------------------ In the above data, I do not see any legible information at all. What am I missing?

2 1

Safest suggested client/server stunnel configurations to prevent MITM attacks
by Michael K. Avanessian 22 Oct '12

22 Oct '12

I'm currently tunneling SSH over SSL using stunnel. I thought that stunneled ssh data was safe. However, recently I've read that if going through a sophisticated http/https proxy, it's possible to be hacked by a "legitimate" mitm attack to fool an SSL client. Is it still possible to configure stunnel so that ssl can't be compromised between both ends? I'm going to take a wild guess here; which I'm sure I'm probably wrong. But, could I just install stunnel; and, let it create automatically a self-signed (stunnel.pem) certificate file... then just copy that file to the stunnel install on the other end? That way both sides are already aware of each other's public keys; and, wouldn't be vulnerable during the initial unencrypted handshake? I'm sure I'm probably way off; and, there's more I need to do in stunnel's configuration to further ensure the SSL won't be compromised.. such as the stunnel "verify" setting. I'm not sure which setting to have it; and, what it actually does. I'm hoping someone could shed some light on this with simple suggested client--> server configs that would keep ssl uncompromised as much as possible. Thanks in advance!

3 2

Need help building FIPS capable Stunnel for Windows CE
by Bao, Robert 18 Oct '12

18 Oct '12

I am attempting to build a FIPS-capable Openssl for an XScale processor (ARMV4I) running under Windows CE 5.0 (using openssl-1.0.1c and openssl-fips-2.0.1), that was successful. Then I built the latest Stunnel (just released few days ago) with FIPS option turned on. The build appears to complete successfully. However, at run-time, entering FIPS mode fails and the following messages are produced: error stack: 2D079089 : error:2D079089:FIPS routines:fips_pkey_signature_test:test failure FIPS_mode_set: 2D06B06F: error:2D06B06F:FIPS routines:FIPS_check_incore_fingerprint:fingerprint does not match I have reviewed the build instructions outlined in the OpenSSL FIPS user guide carefully and believe all the build instructions have been adhered to. What needs to be changed for the signature to be properly embedded? Robert Bao Tyco

2 2