- stunnel-users - stunnel.org

error compiling stunnel 5.06
by Laura Fried 15 Oct '14

15 Oct '14

/tmp/stunnel-5.06/src/options.c:2123: undefined reference to `SSLv2_client_method' /tmp/stunnel-5.06/src/options.c:2127: undefined reference to `SSLv2_server_method' collect2: ld returned 1 exit status make[2]: *** [stunnel] Error 1 make[2]: Leaving directory `/tmp/stunnel-5.06/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/tmp/stunnel-5.06/src' make: *** [all-recursive] Error 1 Please advise. -- Laura J. Fried Internal Revenue Service Online Fraud Detection and Prevention 202-556-2612 (Voice) 202-552-1226 (Fax) ofdp-laura (Skype)

2 2

stunnel 5.06 released
by Michal Trojnara 15 Oct '14

15 Oct '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.06 of stunnel. This is a security bugfix release. Update is recommended. The ChangeLog entry: Version 5.06, 2014.10.15, urgency: HIGH: * Security bugfixes - OpenSSL DLLs updated to version 1.0.1j. https://www.openssl.org/news/secadv_20141015.txt - The insecure SSLv2 protocol is now disabled by default. It can be enabled with "options = -NO_SSLv2". - The insecure SSLv3 protocol is now disabled by default. It can be enabled with "options = -NO_SSLv3". - Default sslVersion changed to "all" (also in FIPS mode) to autonegotiate the highest supported TLS version. * New features - Added missing SSL options to match OpenSSL 1.0.1j. - New "-options" commandline option to display the list of supported SSL options. * Bugfixes - Fixed FORK threading build regression bug. - Fixed missing periodic Win32 GUI log updates. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 098c2b6db0793ea4fa5b6767ce6ef1853e9f6cc2f32133024be55f6a460b1a40 stunnel-5.06.tar.gz 55afb3013406da1afcc1ab7ccc25bb1c66605ca3e004636a6b49cac555cb4d09 stunnel-5.06-installer.exe a1741eb8bb050d3d29515ddef46a0a6828372a991f2658995dee1e06af8c05c8 stunnel-5.06-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlQ+4v4ACgkQ/NU+nXTHMtFwNwCgvZyndOwkAQqmsWnuL7DcRAPq lSIAnig726aVMrFzFAoQzKXxxmWo/Qo9 =ok3p -----END PGP SIGNATURE-----

1 0

Nasty SSL 3.0 vulnerability to be revealed soon
by 541401＠gmail.com 14 Oct '14

14 Oct '14

Nasty SSL 3.0 vulnerability to be revealed soon http://www.theregister.co.uk/2014/10/14/nasty_ssl_30_vulnerability_to_drop_…

1 0

Mongo Replication using Stunnel
by Danny Hernandez 12 Oct '14

12 Oct '14

Hello, I am trying to create an ssl connection between two mongodb instances both using the mongodb community version. Both instances need to communicate with one another as they need to be able to ping each other. I am getting this error when attempting to connect to Instance A from Instance B and vice versa: connect_blocking: connect <ip address>:27027: Connection refused (111) I have two conf files on each server (one for client and one for server). I am using the latest version of stunnel and the latest version of mongodb. Here are my conf files: *SERVER A* cert=/etc/stunnel/stunnel.pem key = /etc/stunnel/stunnel.pem verify = 2 CAfile = /etc/stunnel/stunnel.pem pid = /client.pid output = /var/log/stunnel4/stunnel.log debug = 7 sslVersion = all [mongo-replication] accept = 27037 connect = 127.0.0.1:27017 retry = yes* * *Server B *cert=/etc/stunnel/stunnel.pem key = /etc/stunnel/stunnel.pem verify = 2 CAfile = /etc/stunnel/stunnel.pem pid = /client.pid output = /var/log/stunnel4/stunnel.log debug = 7 sslVersion = all [mongo-replication] accept = 27027 connect = 127.0.0.1:27027 retry = yes *Client A *cert=/etc/stunnel/client.pem pid = /client.pid output = /var/log/stunnel4/client.log debug = 7 client = yes [mongo-replication] accept = 27037 connect = dbtest2:27027 retry = yes *Client B *cert=/etc/stunnel/client.pem pid = /client.pid output = /var/log/stunnel4/client.log debug = 7 client = yes [mongo-replication] accept = 27037 connect = dbtest1:27037 retry = yes Could someone please assist with troubleshooting the error? Thank you! -- Thank you, Danny Hernandez

1 0

num_clients Undeclared
by Abdelkader Chelouah 12 Oct '14

12 Oct '14

Hello, Build of stunnel 5.04 and 5.05 failed on RHEL 6.2 (prior to 5.04, the build succeded) ... gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/logiciels/postgresql/9.3/lib/openssl/include -DLIBDIR='"/logiciels/postgresql/9.3/lib/stunnel/lib/stunnel"' -DCONFDIR='"/logiciels/postgresql/9.3/lib/stunnel/etc/stunnel"' -I/logiciels/postgresql/9.3/include -I/logiciels/postgresql/9.3/lib/openssl/include -I/logiciels/postgresql/9.3/lib/krb5/include -I/logiciels/postgresql/9.3/lib/cyrus-sasl/include -pthread -fstack-protector -fPIE -O3 -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -march=nocona -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-stunnel.o -MD -MP -MF .deps/stunnel-stunnel.Tpo -c -o stunnel-stunnel.o `test -f 'stunnel.c' || echo './'`stunnel.c stunnel.c: In function ‘main_configure’: stunnel.c:150: error: ‘num_clients’ undeclared (first use in this function) stunnel.c:150: error: (Each undeclared identifier is reported only once stunnel.c:150: error: for each function it appears in.) stunnel.c: At top level: stunnel.c:533: warning: expected [error|warning|ignored] after ‘#pragma GCC diagnostic’ stunnel.c:534: warning: unknown option after ‘#pragma GCC diagnostic’ kind stunnel.c: In function ‘signal_post’: stunnel.c:538: warning: ignoring return value of ‘write’, declared with attribute warn_unused_result stunnel.c: At top level: stunnel.c:541: warning: expected [error|warning|ignored] after ‘#pragma GCC diagnostic’ make[2]: *** [stunnel-stunnel.o] Error 1 make[2]: Leaving directory `/ESA/build/stunnel-5.05/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/ESA/build/stunnel-5.05/src' make: *** [all-recursive] Error 1 It seems that the 'num_clients' variable is undeclared in the main_configure function. Thank you

2 3

Problems with stunnel 5.04 for Windows
by Mark Hannig 11 Oct '14

11 Oct '14

Hi! New to this list and this product. I posted this on the Amazon forums, but I need to fix this fast, so I thought I would post it here as well. I am running stunnel 5.04 for Windows on a Windows 2012 R2 instance. I have it working with SES, but after a while it just keeps timing out. I have to manually reload the configuration file to get it to start working again. What am I doing wrong? Here is a part of the log: 2014.10.09 07:43:57 LOG5964 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> accepted connection from 127.0.0.1:62779 2014.10.09 07:44:07 LOG3964 <https://forums.aws.amazon.com/>: s_connect: s_poll_wait 54.68.86.38:465: TIMEOUTconnect exceeded 2014.10.09 07:44:17 LOG3964 <https://forums.aws.amazon.com/>: s_connect: s_poll_wait 54.68.197.46:465: TIMEOUTconnect exceeded 2014.10.09 07:44:27 LOG3964 <https://forums.aws.amazon.com/>: s_connect: s_poll_wait 54.213.178.250:465: TIMEOUTconnect exceeded 2014.10.09 07:44:27 LOG5964 <https://forums.aws.amazon.com/>: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2014.10.09 11:30:18 LOG53224 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> accepted connection from 127.0.0.1:63014 2014.10.09 11:30:28 LOG33224 <https://forums.aws.amazon.com/>: s_connect: s_poll_wait 54.68.197.46:465: TIMEOUTconnect exceeded 2014.10.09 11:30:38 LOG33224 <https://forums.aws.amazon.com/>: s_connect: s_poll_wait 54.213.178.250:465: TIMEOUTconnect exceeded 2014.10.09 11:30:48 LOG33224 <https://forums.aws.amazon.com/>: s_connect: s_poll_wait 54.68.86.38:465: TIMEOUTconnect exceeded 2014.10.09 11:30:48 LOG53224 <https://forums.aws.amazon.com/>: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2014.10.09 11:31:34 LOG51000 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> accepted connection from 127.0.0.1:63019 2014.10.09 11:31:44 LOG31000 <https://forums.aws.amazon.com/>: s_connect: s_poll_wait 54.213.178.250:465: TIMEOUTconnect exceeded 2014.10.09 11:31:54 LOG31000 <https://forums.aws.amazon.com/>: s_connect: s_poll_wait 54.68.86.38:465: TIMEOUTconnect exceeded 2014.10.09 11:32:01 LOG5388 <https://forums.aws.amazon.com/>: Reading configuration from file stunnel.conf 2014.10.09 11:32:01 LOG5388 <https://forums.aws.amazon.com/>: FIPS mode disabled 2014.10.09 11:32:01 LOG5388 <https://forums.aws.amazon.com/>: Configuration successful 2014.10.09 11:32:04 LOG31000 <https://forums.aws.amazon.com/>: s_connect: s_poll_wait 54.68.197.46:465: TIMEOUTconnect exceeded 2014.10.09 11:32:04 LOG51000 <https://forums.aws.amazon.com/>: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2014.10.09 11:32:14 LOG5964 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> accepted connection from 127.0.0.1:63024 2014.10.09 11:32:14 LOG5964 <https://forums.aws.amazon.com/>: s_connect: connected 54.68.159.203:465 2014.10.09 11:32:14 LOG5964 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> connected remote server from 172.31.3.85:63025 2014.10.09 11:32:14 LOG5964 <https://forums.aws.amazon.com/>: Connection closed: 494 byte(s) sent to SSL, 360 byte(s) sent to socket 2014.10.09 11:32:18 LOG5892 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> accepted connection from 127.0.0.1:63026 2014.10.09 11:32:18 LOG5892 <https://forums.aws.amazon.com/>: s_connect: connected 54.213.190.197:465 2014.10.09 11:32:18 LOG5892 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> connected remote server from 172.31.3.85:63027 2014.10.09 11:32:18 LOG5892 <https://forums.aws.amazon.com/>: Connection closed: 1592 byte(s) sent to SSL, 360 byte(s) sent to socket 2014.10.09 12:41:29 LOG53700 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> accepted connection from 127.0.0.1:63100 2014.10.09 12:41:29 LOG53700 <https://forums.aws.amazon.com/>: s_connect: connected 54.244.8.28:465 2014.10.09 12:41:29 LOG53700 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> connected remote server from 172.31.3.85:63101 2014.10.09 12:41:29 LOG53700 <https://forums.aws.amazon.com/>: Connection closed: 1609 byte(s) sent to SSL, 360 byte(s) sent to socket 2014.10.09 12:46:13 LOG53428 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> accepted connection from 127.0.0.1:63107 2014.10.09 12:46:13 LOG53428 <https://forums.aws.amazon.com/>: s_connect: connected 54.68.159.203:465 2014.10.09 12:46:13 LOG53428 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> connected remote server from 172.31.3.85:63108 2014.10.09 12:46:14 LOG53428 <https://forums.aws.amazon.com/>: Connection closed: 1609 byte(s) sent to SSL, 360 byte(s) sent to socket 2014.10.09 16:32:21 LOG51876 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> accepted connection from 127.0.0.1:63335 2014.10.09 16:32:21 LOG51876 <https://forums.aws.amazon.com/>: s_connect: connected 54.213.190.197:465 2014.10.09 16:32:21 LOG51876 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> connected remote server from 172.31.3.85:63336 2014.10.09 16:32:21 LOG51876 <https://forums.aws.amazon.com/>: Connection closed: 1611 byte(s) sent to SSL, 360 byte(s) sent to socket 2014.10.10 01:52:46 LOG5440 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> accepted connection from 127.0.0.1:64017 2014.10.10 01:52:46 LOG5440 <https://forums.aws.amazon.com/>: s_connect: connected 54.244.8.28:465 2014.10.10 01:52:46 LOG5440 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> connected remote server from 172.31.3.85:64018 2014.10.10 01:52:47 LOG5440 <https://forums.aws.amazon.com/>: Connection closed: 5129 byte(s) sent to SSL, 360 byte(s) sent to socket 2014.10.10 08:32:20 LOG53548 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> accepted connection from 127.0.0.1:64423 2014.10.10 08:32:30 LOG33548 <https://forums.aws.amazon.com/>: s_connect: s_poll_wait 54.68.159.203:465: TIMEOUTconnect exceeded 2014.10.10 08:32:40 LOG33548 <https://forums.aws.amazon.com/>: s_connect: s_poll_wait 54.213.190.197:465: TIMEOUTconnect exceeded 2014.10.10 08:32:50 LOG33548 <https://forums.aws.amazon.com/>: s_connect: s_poll_wait 54.244.8.28:465: TIMEOUTconnect exceeded 2014.10.10 08:32:50 LOG53548 <https://forums.aws.amazon.com/>: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket You can see that it stops, then I reload the configuration and it works again, and then eventually stops. Here is my configuration file: engine = capi cert = stunnel.pem options = NO_SSLv2 ssmtp <https://forums.aws.amazon.com/> accept = 465 connect = 25 smtp-tls-wrapper <https://forums.aws.amazon.com/> accept = 2525 client = yes connect = email-smtp.us-west-2.amazonaws.com:465 Thank you. -- Mark F. Hannig

2 1

stunnel 5.05 released
by Michal Trojnara 10 Oct '14

10 Oct '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.05 of stunnel. The ChangeLog entry: Version 5.05, 2014.10.10, urgency: MEDIUM: * New features - Asynchronous communication with the GUI thread for faster logging on Win32. - systemd socket activation (thx to Mark Theunissen). - The parameter of "options" can now be prefixed with "-" to clear an SSL option, for example: "options = -LEGACY_SERVER_CONNECT". - Improved "transparent = destination" manual page (thx to Vadim Penzin). * Bugfixes - Fixed POLLIN|POLLHUP condition handling error resulting in prematurely closed (truncated) connection. - Fixed a null pointer dereference regression bug in the "transparent = destination" functionality (thx to Vadim Penzin). This bug was introduced in stunnel 5.00. - Fixed startup thread synchronization with Win32 GUI. - Fixed erroneously closed stdin/stdout/stderr if specified as the -fd commandline option parameter. - A number of minor Win32 GUI bugfixes and improvements. - Merged most of the Windows CE patches (thx to Pierre Delaage). - Fixed incorrect CreateService() error message on Win32. - Implemented a workaround for defective Cygwin file descriptor passing breaking the libwrap support: http://wiki.osdev.org/Cygwin_Issues#Passing_file_descriptors Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: c7e1653345150db7e48d00e1129cf571c7c85de8e7e1aa70b21cf1d76b1e31ef stunnel-5.05.tar.gz 19f8b78aecc26c291d90e4fa72807bdb75063a7641fd64f224222b526cfa83aa stunnel-5.05-installer.exe 65129c4c1a73dc04a0f66571a9bda2860d70376cdcc2c1d83fd575dcb0adc7a5 stunnel-5.05-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlQ3ofIACgkQ/NU+nXTHMtHnmQCg8sncLzw4bfiuw3ziL7HGFEdJ luwAoKTF4C3jbUihpz8ODEPvtGbK24Cs =Z+GJ -----END PGP SIGNATURE-----

1 0

CERT: Verification error: unable to get local issuer certificate
by Vivek Gupta 07 Oct '14

07 Oct '14

Hi I am getting error - Below is the log: ******************************** Service [LMAX-fix-tunnel-DEMO-MktData] connected remote server from 192.168.1.5:49819 Remote socket (FD=276) initialized SNI: sending servername: fix-md-ate.lmaxtrader.com SSL state (connect): before/connect initialization SSL state (connect): SSLv3 write client hello A SSL state (connect): SSLv3 read server hello A Verification started at depth=1: C=US, O=DigiCert Inc, CN=DigiCert Secure Server CA CERT: Verification error: unable to get local issuer certificate Rejected by CERT at depth=1: C=US, O=DigiCert Inc, CN=DigiCert Secure Server CA SSL alert (write): fatal: unknown CA SSL_connect: 14090086: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket Remote socket (FD=276) closed Local socket (FD=524) closed Service [LMAX-fix-tunnel-DEMO-MktData] finished (0 left) *************************************************** and below is the conf file: ************ ; Certificate/key is needed in server mode and optional in client mode ;cert = stunnel.pem ;key = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 3 CApath = C:\Program Files (x86)\stunnel\ CAfile = C:\Program Files (x86)\stunnel\peer-LMAX-fix-tunnel-DEMO-MktData.pem ;CRLpath = crls ;CRLfile = crls.pem options = NO_SSLv2 ************************************ Please suggest how to solve verification error. Thanks &Regards Vivek Gupta 9971514343

1 0

STunnel Connection closed: 150 byte(s) sent to SSL, 0 byte(s) sent to socket
by Vivek Gupta 07 Oct '14

07 Oct '14

Hi I am using sTunnel for communication betweem my TCP client and a remote SERVER but I am getting error as always- Signal pipe is empty Service [LMAX-fix-tunnel-DEMO-MktData] accepted (FD=348) from 127.0.0.1:55919 2014.10.06 :34:56 LOG7[4220]: Creating a new thread New thread created Service [LMAX-fix-tunnel-DEMO-MktData] started Service [LMAX-fix-tunnel-DEMO-MktData] accepted connection from 127.0.0.1:55919 s_connect: connecting 91.215.165.69:443 s_connect: s_poll_wait 91.215.165.69:443: waiting 10 seconds s_connect: connected 91.215.165.69:443 Service [LMAX-fix-tunnel-DEMO-MktData] connected remote server from 192.168.1.5:55920 Remote socket (FD=352) initialized SNI: sending servername: fix-md-ate.lmaxtrader.com SSL state (connect): before/connect initialization SSL state (connect): SSLv3 write client hello A SSL state (connect): SSLv3 read server hello A SSL state (connect): SSLv3 read server certificate A SSL state (connect): SSLv3 read server done A SSL state (connect): SSLv3 write client key exchange A SSL state (connect): SSLv3 write change cipher spec A SSL state (connect): SSLv3 write finished A SSL state (connect): SSLv3 flush data SSL state (connect): SSLv3 read finished A 1 items in the session cache 1 client connects (SSL_connect()) 1 client connects that finished 0 client renegotiations requested 0 server connects (SSL_accept()) 0 server connects that finished 0 server renegotiations requested 0 session cache hits 0 external session cache hits 0 session cache misses 0 session cache timeouts Peer certificate was cached (3944 bytes) SSL connected: new session negotiated Negotiated TLSv1/SSLv3 ciphersuite: AES128-SHA (128-bit encryption) Compression: null, expansion: null SSL_read returned WANT_READ: retrying SSL socket closed (SSL_read) Sent socket write shutdown Connection closed: 150 byte(s) sent to SSL, 0 byte(s) sent to socket Remote socket (FD=352) closed Local socket (FD=348) closed Service [LMAX-fix-tunnel-DEMO-MktData] finished (0 left) Please suggest.

3 4

trojan in stunnel-5.04-installer.exe ?
by oVPN.to Support 03 Oct '14

03 Oct '14

Hi stunnel folks, a client informed us about trojan warning in stunnel-5.04-installer.exe can anybody explain this "behavioural information"? DNS requests VBOXSVR.ovh.net https://www.virustotal.com/en/file/045145b4e6ef66d29774b558837bd693a0dbab9f… additonal: https://anubis.iseclab.org/?action=result&task_id=1beba124664d67ea4914aa2b2… stunnel-5.05b4-installer.exe does not have it, but flagged as trojan by 2 AVs too https://www.virustotal.com/en/file/ac4f98c13a0a9f62cc118faa91483a1a5c0a7128… stunnel-5.03-installer.exe https://www.virustotal.com/en/file/803bc85fbc80f22d71b13d4180e2d51c02586b2c… Thanks

1 0