- stunnel-users - stunnel.org

Re: [stunnel-users] Memory allocated in a different thread at network.c, line 63
by Philippe A. 07 Mar '12

07 Mar '12

Hello Michal, 2012/3/5 Michal Trojnara <Michal.Trojnara(a)mirt.net> > I fixed it: > ftp://ftp.stunnel.org/stunnel/**beta/stunnel-4.53b10.tar.gz<ftp://ftp.stunnel.org/stunnel/beta/stunnel-4.53b10.tar.gz> > Please give it a try and let me know whether it works for you. I tried the beta and the error is definitely gone. However I will stick with 4.45 for now as my next deployment is already prepared. Thanks a lot for your assistance!

1 0

Couple of issues with 4.45
by Philippe A. 07 Mar '12

07 Mar '12

Hello, I have encountered a couple of issues with stunnel 4.45 on RHEL 5.5. I tried configuring stunnel to log messages in /var/log/messages and later found that messages were logged both in that file AND /var/log/messages. In stunnel.conf, I had specified: debug=local6.info In syslog.conf: local6.* /var/log/stunnel.log I could achieve what I wanted only with the combination of the following two options: syslog=no output=/usr/local/app/stunnel/var/stunnel.log Is this expected? The second issue I have noticed is that stunnel seems to have a bit of trouble handling the hup signal. If you start stunnel specifying a relative path to the config, sending hup will cause stunnel to log and error but it won't exit. 2012.03.01 16:31:29 LOG5[19000:0]: Reading configuration from file etc/server.conf 2012.03.01 16:31:29 LOG3[19000:0]: etc/server.conf: No such file or directory (2) 2012.03.01 16:31:29 LOG3[19000:0]: Cannot read configuration 2012.03.01 16:31:29 LOG3[19000:0]: Failed to reload the configuration file If you specify an absolute path, no error will be reported but stunnel will exit anyway.

2 3

No sub folders, calendar or contacts
by Jonathan Harrison 05 Mar '12

05 Mar '12

Dear sirs I am using Ubuntu 11.10 64-bit, Outlook 2007 and 4 x gmail accounts (1 x personal (gmail.com) and 3 x business (baroni-limited.com, hosted by gmail). I have set up Stunnel, I belive the latest version and created a SSL license as instructed. The Stunnel Telnets OK and I can send and recieve eMails (I do send directly via my ISP rather than use Stunnel) without any problem. Where I seem to be having problems is that: I have no sub folders to each account. None are appearing. I have no calendars - I have followed the instructions but they fail to load. I have no contacts. Message from Outlook: Sync error > > Task 'Synchronizing subscribed folders for Baroni.' reported error > (0x800CCC0E) : 'Outlook cannot synchronize subscribed folders for Baroni. > Error: Cannot connect to the server. If you continue to receive this > message, contact your server administrator or Internet service provider > (ISP).' > > Task 'Internet Calendar Subscriptions' reported error (0x8004010F) : 'The > operation failed. An object cannot be found.' > Config attached - I hope. It is most likely I have missed something or done something wrong. I have not found anything to help me on the web or archives, could you please advise. If you feel you need a copy of the the logs, please advise and I shall happily provide what I can. I am assuming I have just missed something. -- Regards Jonathan

1 0

FIPS_mode_set:fingerprint does not match
by Jack 04 Mar '12

04 Mar '12

I have the following problem running stunnel on Centos 6.x 64bit with the following error: I have been search with google to see if there was a solution but nothing was found Thank you for your reply and your help, hopefully I can get this solved. ******************************************************************************** Clients allowed=500 stunnel 4.52 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.0-fips 29 Mar 2010 Threading:PTHREAD SSL:ENGINE,FIPS Auth:none Sockets:POLL,IPv6 Reading configuration from file /usr/local/etc/stunnel/stunnel.conf FIPS_mode_set: 2D06C06E: error:2D06C06E:FIPS routines:FIPS_mode_set:fingerprint does not match *******************************************************************************

3 2

Stunnel in Client / Server configuration
by Michael Curran 04 Mar '12

04 Mar '12

Hello, I have 2 servers in different locations across the country. I am using them as a paired tunnel that both act as server and client Server A has this configuration (cert definitions left out on purpose, but exist and are valid) ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = all ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel4 setuid = stunnel4 setgid = stunnel4 ; PID is created inside chroot jail pid = /stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle TIMEOUTclose=0 ; 128-bit or highter only ciphers = HIGH:MEDIUM ; Workaround for Eudora bug options = DONT_INSERT_EMPTY_FRAGMENTS options = NO_SSLv2 ; Some debugging stuff useful for troubleshooting debug = local7.info ;warning [Tunnel from Server B] accept = 1.2.3.4:443 connect = 127.0.0.1:8082 [Tunnel to Server B] accept = 5.6.7.8:3132 connect = 9.10.11.12:4000 client = yes Server B (cert definitions left out on purpose, but exist and are valid) ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = all ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel4 setuid = stunnel4 setgid = stunnel4 ; PID is created inside chroot jail pid = /stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle TIMEOUTclose=0 ; 128-bit or highter only ciphers = HIGH:MEDIUM ; Workaround for Eudora bug options = DONT_INSERT_EMPTY_FRAGMENTS options = NO_SSLv2 ; Some debugging stuff useful for troubleshooting debug = local7.debug ;warning [Tunnel to Server A] accept = 10.1.2.3:9443 connect = 1.2.3.4:443 client = yes [Tunnel from Server A] accept = 9.10.11.12:4000 connect = 10.4.5.6:3132 Communication through Server A (client) to Server B (server) works as expected Communication through Server B (client) back to Server A (server) recieves this error curl: (35) error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol (this is all the further it gets, the client says hello and the server responds with this) If I skip the local stunnel config and pass the traffic publicly through to Server A (running in client mode), from Server B, I get the expected http response I setup to test the tunnel. Im just assuming that if I am passing from Stunnel from one system to stunnel on another, one of them should be client and the other should be server. This works well on our old configurations and as far as I can see from a stunnel and network route perspective all rules are identical. Why would it work from Server B to Server A on the response if I go directly to Server A, but fail locally? The configuration looks correct, what else could I check?

2 1

Multiple Config Files
by Scott McKeown 02 Mar '12

02 Mar '12

Hi All, I'm new to the STunnel system but I'm loving what I have seen so far. However, I was wondering if its possible to have a setup something along the lines of the following: general.cfg - containing my general server system details http.cfg - containing the details of my HTTP server pop3.cfg - containing the details of my pop3 server etc. etc. but linking them all from one file so that if I want to remove the pop3 service I can just remove the pop3.cfg file and one line from the base file. I hope that someone understands what I'm getting at but if you need any more info please just let me know. Yours, Scott

3 3

Re: [stunnel-users] FIPS_mode_set:fingerprint does not match
by Jake Skinner 01 Mar '12

01 Mar '12

Have you tried disabling FIPS to see if your connection works without? Jake Skinner Telephony Technology Specialist Ontario Systems, LLC Office +1.765.751.7000 Thumbed posthaste from my mobile device; please forgive any typing or grammatical errors. ________________________________ From: stunnel-users-bounces(a)stunnel.org To: stunnel-users(a)stunnel.org Sent: Wed Feb 29 19:41:02 2012 Subject: [stunnel-users] FIPS_mode_set:fingerprint does not match I have the following problem running stunnel on Centos 6.x 64bit with the following error: I have been search with google to see if there was a solution but nothing was found Thank you for your reply and your help, hopefully I can get this solved. ******************************************************************************** Clients allowed=500 stunnel 4.52 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.0-fips 29 Mar 2010 Threading:PTHREAD SSL:ENGINE,FIPS Auth:none Sockets:POLL,IPv6 Reading configuration from file /usr/local/etc/stunnel/stunnel.conf FIPS_mode_set: 2D06C06E: error:2D06C06E:FIPS routines:FIPS_mode_set:fingerprint does not match ******************************************************************************* Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

2 1

linux default installation
by John A. Wallace 29 Feb '12

29 Feb '12

Hello. I am comparing a default installation of "stunnel.conf" in Linux with that in Windows, and I found some differences that I have a couple questions about. The Windows installation installed in client mode by default, but the one for Linux in server mode. I made a backup copy of the default files for both. For now I want to run stunnel in Linux in client mode, so I am making some changes to it. The installed default for these six parameters are as follows: Client=no Chroot=/var/lib/stunnel/ Setuid=stunnel Setgid=nogroup Pid=/var/run/stunnel.pid Cert=/etc/stunnel/stunnel.pem Is it correct to change these settings for testing in client mode so that they match the current Windows' client mode configuration, like so: Client=yes #Chroot=/var/lib/stunnel/ #Setuid=stunnel #Setgid=nogroup #Pid=/var/run/stunnel.pid #Cert=/etc/stunnel/stunnel.pem

1 1

stunnel log delayed
by John A. Wallace 29 Feb '12

29 Feb '12

Hello, I am running stunnel on Linux in client mode, and I have the following setting in "stunnel.conf": output=stunnel.log The log does not get written to periodically while the program is running but is delayed until after I have closed the program. It would be helpful to be able to look at it from time to time, especially while troubleshooting. Any way "to push" the data down into the file sooner? Thanks. John

2 1

Memory allocated in a different thread at network.c, line 63
by Philippe A. 28 Feb '12

28 Feb '12

Hello, I find the following error my syslog when stopping stunnel 4.52. The program seems to be unable to shutdown cleanly (ex: pid file doesn`t get removed). stunnel: INTERNAL ERROR: Memory allocated in a different thread at network.c, line 63 This is how I configured: LDFLAGS=-Wl,-rpath,/usr/local/app/openssl/lib64 \ ./configure --prefix=/usr/local/app/stunnel \ --includedir=$PKG_HOME/openssl/include/ \ --with-ssl=$PKG_HOME/openssl/ \ --with-threads=fork \ --disable-libwrap Where PKG_HOME is a variable of my own. I had the same error with version 4.51. I do not see the error when running in foreground. I do not see the error either if I compile with threads instead of fork. In case this information is needed, this is how I configured openssl. ./config --prefix=/usr/local/app/openssl --libdir=lib64 shared zlib-dynamic no-ssl2 This is on RHEL 5.5 Regards.

2 2

stunnel for WCF services configured for.NETTCP binding
by larisa_y 24 Feb '12

24 Feb '12

Will Stunnel work for WCF services configured for.NETTCP binding? Thank you. -- View this message in context: http://old.nabble.com/stunnel-for-WCF-services-configured-for.NETTCP-bindin… Sent from the Stunnel - Users mailing list archive at Nabble.com.

1 0

SSLv3 on Win32 does not work
by Zdenek Valach (INBOX) 24 Feb '12

24 Feb '12

Hi I am using the latest version of stunnel in server mode (converting POP3S to POP3) I need to make service work in SSLv3 mode. In TLSv1 it works fine, when I add to stunnel.conf tag sslVersion = all, it still works fine, but when I use sslVersion = SSLv3 although config file is loaded properly, process EXE crashed during establishing the connection. It looks like some bug in actual version of stunnel. Does somebody experience same problem? Thank you very much in advance for any advice Thanks Zdenek ____________________________________________________________ Send any screenshot to your friends in seconds... Works in all emails, instant messengers, blogs, forums and social networks. TRY IM TOOLPACK at http://www.imtoolpack.com/default.aspx?rc=if2 for FREE

2 1

Stunnel for Android
by Huzella Balázs 23 Feb '12

23 Feb '12

Hi! I have downloaded the Android port of stunnel: http://mirrors.zerg.biz/stunnel/stunnel-4.52-android.zip I would like to use it on my Android tablet but I don't know how to start or use it. I have root access on the device. I placed the stunnel and openssl files into /data/stunnel/ directory. Both files have execute permission. Can anybody please provide some information on how to use this application? I haven't found any info on stunnel.org. Best Regards, Balázs Huzella

2 1

Multiple Domains for https
by Thomas Manson 23 Feb '12

23 Feb '12

Hi, I want to setup the following architecture : stunnel ---> haproxy --> 2 webserver. I run severa virtual host on the 2 webservers, and a subset of them needs https. I can allocate several IP address for the host that run stunnel. How do I configure a single stunnel process to have a certificate per IP for the port https? I tryed to add several section like the following : [mansonthomas.com] cert = /etc/stunnel/sites/mansonthomas.com/mansonthomas.com.crt accept = 88.190.17.222:443 connect = 127.0.0.1:82 xforwardedfor = yes TIMEOUTclose = 0 So the question is : Is it possible ? do you have a sample configuration file to share for this use case? Thanks, Thomas.

4 9

:o( Stunnel KO on Windows Server 2003 VM
by BOXI31 TEST 22 Feb '12

22 Feb '12

Hi all ! I'm new with Stunnel. It'a nice tool that works perfectly on Windows 7 64-bit host but won't start on Windows Server 2003 guest VM (VMWare Player 3.1.x). When I try to start it, I have a message like "can't initialize...". I'll give you the exact message tomorrow, I don't have now the VM on hand. On Windows 7, when I started Stunnel for the 1st time, I was asked to create a certificate with a kind of wizard but on the Windows Server 2003 VM, it stops before this step. Is it a known problem on VM ? What could I check ? I managed to make the software I'm testing (SMTP sending function) on the VM "talk" to Stunnel on my host by I'd really like to install it on the VM to be independant from host. Thanks by advance, Regards, Steve.

2 1

Stunnel Not supporting DSA key
by Anand Krishnan 16 Feb '12

16 Feb '12

Hi All, I have query regarding Stunnel (version 4) working. We have a windows client application which communicates with a web service via SSL encryption with DSA algorithm. The windows client machine is using a pfx file for authentication with server. Now we need to convert this windows machine with a linux machine and hence we converted the pfx into pem file. But when i tried to start the Stunnel using this pem file it threws up below error. 2012.02.13 18:23:23 LOG3[23972:47049761923264]: error stack: 140B3009 : error:140B3009:SSL routines:SSL_CTX_use_RSAPrivateKey_file:PEM lib 2012.02.13 18:23:23 LOG3[23972:47049761923264]: SSL_CTX_use_RSAPrivateKey_file: 607907F: error:0607907F:digital envelope routines:EVP_PKEY_get1_RSA:expecting an rsa key It seems the .pem file I mapped in the stunnel.conf is expecting RSA algorithm but when I opened it I can see it as DSA coded. Can some body help me on this. I am attaching the pfx and pem file along with this. Regards, Anand K DISCLAIMER: "The information in this e-mail and any attachment is intended only for the person to whom it is addressed and may contain confidential and/or privileged material. If you have received this e-mail in error, kindly contact the sender and destroy all copies of the original communication. IBS makes no warranty, express or implied, nor guarantees the accuracy, adequacy or completeness of the information contained in this email or any attachment and is not liable for any errors, defects, omissions, viruses or for resultant loss or damage, if any, direct or indirect." DISCLAIMER: "The information in this e-mail and any attachment is intended only for the person to whom it is addressed and may contain confidential and/or privileged material. If you have received this e-mail in error, kindly contact the sender and destroy all copies of the original communication. IBS makes no warranty, express or implied, nor guarantees the accuracy, adequacy or completeness of the information contained in this email or any attachment and is not liable for any errors, defects, omissions, viruses or for resultant loss or damage, if any, direct or indirect."

2 1

Key files across NFS
by James Devine 15 Feb '12

15 Feb '12

I have an stunnel config saved on an NFS mount so it can be shared with other servers, it only seems to work if the key file is stored locally, as soon as I move the key onto the NFS mount I get the error: /disks/disk1/stunnel/certs/wildcard.key: Value too large for defined data type (75) Any idea why that might be and what I might do to fix it?

1 1

server does not send its cert?
by Keresztfalvi Laszlo 14 Feb '12

14 Feb '12

Hello, after a day of trying.. - 2 box of *Win7 Pro x64* - fresh install of *stunnel 4.52* - keys generated with C:\Program Files (x86)\stunnel>* **.\openssl.exe req -new -x509 -days 365 -nodes -config stunnel.cnf -out stunnel.pem -keyout stunnel.pem* - *certs.pem* on both box contains certificate part of stunnel.pem from both machine server stunnel.conf (192.168.0.52): debug = 7 cert = stunnel.pem verify = 2 CAfile = certs.pem options = NO_SSLv2 [unison] accept = 10001 connect = 127.0.0.1:10000 client stunnel.conf (192.168.0.216): client = yes debug = 7 cert = stunnel.pem verify = 2 CAfile = certs.pem options = NO_SSLv2 [unison] client = yes accept = 127.0.0.1:10000 connect = 192.168.0.52:10001 Test #1: *OK* C:\Program Files (x86)\stunnel>* .\openssl verify -CAfile certs.pem stunnel.pem* *stunnel.pem: OK* C:\Program Files (x86)\stunnel>* .\openssl verify -CAfile certs.pem certs.pem* *certs.pem: OK* Test #2: *OK* C:\Program Files (x86)\stunnel> *.\openssl s_server -accept 10001 -cert stunnel.pem -verify 2 -CAfile certs.pem -no_ssl2* vs C:\Program Files (x86)\stunnel> *.\openssl s_client -connect 192.168.0.52:10001 -cert stunnel.pem -verify 2 -CAfile certs.pem -no_ssl2* Test #3: *OK - "certificate accepted" * C:\Program Files (x86)\stunnel> *.\openssl s_server -accept 10001 -cert stunnel.pem -verify 2 -CAfile certs.pem -no_ssl2* vs *stunnel client** * Test #4: *OK - "certificate accepted" * *stunnel server* vs C:\Program Files (x86)\stunnel> *.\openssl s_client -connect 192.168.0.52:10001 -cert stunnel.pem -verify 2 -CAfile certs.pem -no_ssl2* Test #5: *FAILED* *stunnel server* Service unison accepted connection from 192.168.0.216:23134 2012.02.14 09:02:39 LOG3[134028:132792]: SSL_accept: 140943F2: error:140943F2:SSL routines:*SSL3_READ_BYTES:sslv3 alert unexpected message* 2012.02.14 09:02:39 LOG5[134028:132792]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket* * vs *stunnel client * 2012.02.14 09:02:33 LOG5[2500:5876]: Service unison connected remote server from 192.168.0.216:23134 2012.02.14 09:02:33 LOG7[2500:5876]: Remote FD=372 initialized 2012.02.14 09:02:33 LOG3[2500:5876]: SSL_connect: 140870E8: error:140870E8:SSL routines:*SSL3_GET_CERTIFICATE_**REQUEST:tls client cert req with anon cipher* 2012.02.14 09:02:33 LOG5[2500:5876]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket After a *stunnel.conf **reload* on both box (yes, only a reload) then the following details and differences appear: *stunnel server* vs *openssl s_client : OK - "certificate accepted" * 2012.02.14 09:42:02 LOG5[134236:132440]: Service unison accepted connection from 192.168.0.216:23698 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): before/accept initialization 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): SSLv3 read client hello B 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): *SSLv3 write server hello A* 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): *SSLv3 write certificate A* 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): *SSLv3 write key exchange A* 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): SSLv3 write certificate request A 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): SSLv3 flush data 2012.02.14 09:42:02 LOG7[134236:132440]: Starting certificate verification: depth=0, /C=HU/ST=Mazovia Province/L=Budapest/O=-/OU=client/CN=x-pc 2012.02.14 09:42:02 LOG5[134236:132440]: Certificate accepted: depth=0, /C=HU/ST=Mazovia Province/L=Budapest/O=-/OU=client/CN=x-pc 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): SSLv3 read client certificate A 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): SSLv3 read client key exchange A 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): SSLv3 read certificate verify A 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): SSLv3 read finished A 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): SSLv3 write session ticket A 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): SSLv3 write change cipher spec A 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): SSLv3 write finished A 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): SSLv3 flush data *stunnel server* vs *stunnel client : FAILED * *server:* 2012.02.14 09:45:24 LOG5[134236:134552]: Service unison accepted connection from 192.168.0.216:23752 2012.02.14 09:45:24 LOG7[134236:134552]: SSL state (accept): before/accept initialization 2012.02.14 09:45:24 LOG7[134236:134552]: SSL state (accept): SSLv3 read client hello B 2012.02.14 09:45:24 LOG7[134236:134552]: SSL state (accept): *SSLv3 write server hello A* 2012.02.14 09:45:24 LOG7[134236:134552]: SSL state (accept): *SSLv3 write key exchange A* 2012.02.14 09:45:24 LOG7[134236:134552]: SSL state (accept): SSLv3 write certificate request A 2012.02.14 09:45:24 LOG7[134236:134552]: SSL state (accept): SSLv3 flush data 2012.02.14 09:45:24 LOG7[134236:134552]: SSL alert (read): fatal: unexpected_message 2012.02.14 09:45:24 LOG3[134236:134552]: SSL_accept: 140943F2: error:140943F2:SSL routines:*SSL3_READ_BYTES:sslv3 alert unexpected message* 2012.02.14 09:45:24 LOG5[134236:134552]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2012.02.14 09:45:24 LOG7[134236:134552]: Service unison finished (0 left) *client:* 2012.02.14 09:45:18 LOG5[1100:7176]: Service unison connected remote server from 192.168.0.216:23752 2012.02.14 09:45:18 LOG7[1100:7176]: Remote FD=452 initialized 2012.02.14 09:45:18 LOG7[1100:7176]: SSL state (connect): before/connect initialization 2012.02.14 09:45:18 LOG7[1100:7176]: SSL state (connect): SSLv3 write client hello A 2012.02.14 09:45:18 LOG7[1100:7176]: SSL state (connect): *SSLv3 read server hello A* 2012.02.14 09:45:18 LOG7[1100:7176]: SSL state (connect): *SSLv3 read server key exchange A* 2012.02.14 09:45:18 LOG7[1100:7176]: SSL alert (write): *fatal: unexpected_message* 2012.02.14 09:45:18 LOG3[1100:7176]: SSL_connect: 140870E8: error:140870E8:SSL routines:*SSL3_GET_CERTIFICATE_**REQUEST:tls client cert req with anon cipher* 2012.02.14 09:45:18 LOG5[1100:7176]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Please, give me some clues. Thank you, Laszlo **

3 5

AUTO: Jean Daros is out of the office (returning 02/13/2012)
by Jean Daros 11 Feb '12

11 Feb '12

I am out of the office until 02/13/2012. If you need immediate assistance, please contact the helpdesk at ext. 1540. Thank you. Note: This is an automated response to your message "stunnel-users Digest, Vol 91, Issue 6" sent on 2/11/2012 6:00:01 AM. This is the only notification you will receive while this person is away.

1 0

(no subject)
by Jean Daros 07 Feb '12

07 Feb '12

We are using version 4.33 with RedRock Software - Tutortrac Stunnel will crash. The stunnel service terminated unexpectedly. Faulting application stunnel.exe, veraion 0.0.0.0, faulting module libeay32.dll, version 1.0.0.0 fault address 0x000731ee. Any ideas? -Jean Berkeley College

2 1

Improving SSL security and protecting against the BEAST attack
by Shannon Carver 06 Feb '12

06 Feb '12

Hi all, Long time lurker, but first time poster on the Stunnel mailing list. I'm currently entering into a business partnership with a prominent media group, and as such they've got some strict guidelines by which their partners should abide by when it comes to Security/Encryption, both for brand protection, and making sure that both sides are sufficiently covered (at least from a general scan point of view). Basically the big thing that is coming up in my testing now (predominantly using the Qualysis tool at www.ssllabs.com) is that I'm vulnerable to the BEAST attack, CBC-Mode vulnerabilities and a potential issue of DoS attack due to server accepting Client Side Re-negotiation. I've spent days now trawling the web looking for a solution, but haven't really found anything of use yet, short of disabling CBC Ciphers completely (e.g 'cipher = RC4-SHA:RC4-MD5:!SSLv2:!ADH:!EDH:!EXP:!aNULL:!eNULL:!NULL' or similar), but I fear this me be too restrictive when it comes to client support. I guess my question is, are there other stunnel users who've been in the same situation, and is there a recommended cipher/options list when using Stunnel for HTTPS? Thanks in advance Shannon

1 0

Re: [stunnel-users] No SSL handshake between stunnel in client mode and SSL server
by Michal Trojnara 06 Feb '12

06 Feb '12

On Wednesday, 1 of February 2012, Jose Alf. wrote: > Looks like your client connects for a very short time, sends just 1 byte, > the disconnects. > > Mike can correct me if I am wrong. [cut] > 2012.01.31 12:57:12 LOG6[6748:6808]: SSL connected: new session negotiated [cut] > 2012.01.31 12:57:22 LOG5[6748:6808]: Connection closed: 200 bytes sent to SSL, 1 bytes sent to socket 2012.01.31 12:57:22 As requested: The log says "SSL connected" (as opposed to "SSL accepted"), so this service was configured in client mode, so SSL=server side and socket=client side. 200 bytes sent to SSL were received from socket (i.e. client), and 1 byte sent to socket were received from SSL (i.e. server). Otherwise you are correct. Mike

2 1

No SSL handshake between stunnel in client mode and SSL server
by Denis Berezhnoy 01 Feb '12

01 Feb '12

Hi guys, I have a quick question. I am trying to use stunnel in client mode to encrypt traffic going to my server. Basically, I have a server which listens for SSL connection. And I have a client which can not do SSL but it needs to communicate with server over SSL. I setup stunnel in client mode to accept unecrypted traffic from client and redirect it to server over SSL. I checked TCP traffic with WireShark between stunnel and my server and I can see that there is no SSL handshake, stunnel makes TCP connection with server and sends some TCP packets but I expect to see SSL handshake. My stunnel conf file is here: [Router] client=yes accept = 192.168.1.121:55555 connect = 192.168.160.168:55443 Can you please comment on this? Best regards, Denis

2 5

Possible use-after-free in stunnel 4.52
by David Shaw 01 Feb '12

01 Feb '12

Hello, I am using stunnel 4.52 in client mode with exec and connect. The client program that stunnel execs periodically exits, and is properly re-started by stunnel, as I have "retry = yes" set. However, after a retry, I occasionally get a segfault inside one of the OpenSSL libraries. It does not happen right away, but once it happens, every retry causes the same segfault. I did some debugging and it seems that what is happening during a retry is that the SSL connection is brought down in client_run(), then is freed via SSL_free(c->ssl). However, it seems that c->ssl is used after this free, for example in connect_local(), which calls SSL_get_peer_certificate(c->ssl). When exec, connect, and retry are all set, client_main() will call connect_local() after client_run() exits. This patch seems to resolve the issue: --- client.c.orig 2012-01-11 10:43:33.000000000 -0500 +++ client.c 2012-01-31 18:02:19.155213010 -0500 @@ -162,6 +162,7 @@ if(c->ssl) { /* SSL initialized */ SSL_set_shutdown(c->ssl, SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN); SSL_free(c->ssl); + c->ssl=NULL; ERR_remove_state(0); } For completeness, here's my stunnel.conf: client = yes sslVersion = SSLv3 pid = /var/run/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 foreground=yes [experiment] connect = x.x.x.x:443 exec = testprog retry = yes David

2 2

stunnel and connection alerts for Windows
by John A. Wallace 31 Jan '12

31 Jan '12

Hello. It would be helpful to me to see a little popup window notification of connections or data transfers made through Stunnel, a small and unobtrusive alert of such kind as not requiring me to open another Window, etc.. One thought I have along these lines is to have the stunnel Log Window to serve this purpose by having a configuration option for it to open in a small window by the system alert toolbar on the bottom right, providing a one-liner or abbreviated rendition of its current logging text. I do not know of a way to make this happen within stunnel itself, but if there is functionality of this sort already available, please advise. Another program that comes to mind with this sort of purpose would be Growl, which allows developers to make plugins to create this effect. http://www.growlforwindows.com/gfw/apps.aspx. Is there anyone else here who would find this useful or who is aware of work along these lines? Thanks. John

2 1