- stunnel-users - stunnel.org

How to start stunnel4 service directly after installation, without reboot
by Tu, Robin 15 Jan '20

15 Jan '20

I'm testing openvpn over stunnel4 and I found a weird issue: I have to restart my Ubuntu 18.04 to be able to start the stunnel service. Don't know why I couldn't start the service dicrectly by : Systemctl start stunnel4 OS: Ubuntu 18.04 #>apt install stunnel4 and generate a conf like this: cert=/etc/stunnel/server.crt key=/etc/stunnel/server.key [openvpn-localhost] accept = 8443 connect = 127.0.0.1:11000 Now start the service: #>systemctl start stunnel4 #>systemctl status stunnel4 stunnel4.service - LSB: Start or stop stunnel 4.x (TLS tunnel for network daemons) Loaded: loaded (/etc/init.d/stunnel4; generated) Active: active (exited) since Wed 2020-01-15 14:40:11 CST; 10min ago Docs: man:systemd-sysv-generator(8) Tasks: 0 (limit: 4915) CGroup: /system.slice/stunnel4.service Jan 15 14:40:11 iZ8vb6j45u355dm236tpibZ systemd[1]: Starting LSB: Start or stop stunnel 4.x (TLS tunnel for network daemons)... Jan 15 14:40:11 iZ8vb6j45u355dm236tpibZ stunnel4[3583]: TLS tunnels disabled, see /etc/default/stunnel4 Jan 15 14:40:11 iZ8vb6j45u355dm236tpibZ systemd[1]: Started LSB: Start or stop stunnel 4.x (TLS tunnel for network daemons). Why it exited? But after reboot, same command will just work. Is it a bug? I want to find a way to start it directly after installation. Please help! Best Regards Robin

1 0

Cannot stop pcs cluster service when stunnel server process start
by d500man 09 Jan '20

09 Jan '20

Dear Support, For captioned, I adopted stunnel server and client socket protection in pcs cluster. I want to stop pacemaker cluster service by command "pcs cluster stop --all" and stop master node in master node servet but the down process is hang up when stunnel server process started, could you help to tell me what's problem and how to fix this problem? Best regards Tony

1 0

stunnel4-5.50 start failed
by Hanhan lee 27 Dec '19

27 Dec '19

I compiled stunnel4-5.50 with openssl 1.1.1d. When I run stunnel, it will print some messages and stop: [ ] Clients allowed=500 [.] stunnel 5.50 on arm-none-linux-gnueabi platform [.] Compiled/running with OpenSSL 1.1.1d 10 Sep 2019 [.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*__errno_location ()) [.] Reading configuration from file /conf/stunnel.conf [.] UTF-8 byte order mark not detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [adviserd] [ ] Ciphers: AES256-SHA256:!RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM [ ] TLS options: 0x02104004 (+0x00004000, -0x00000000) [ ] Loading certificate from file: /conf/certs/server.pem [ ] Certificate loaded from file: /conf/certs/server.pem [ ] Loading private key from file: /conf/certs/privkey.pem [:] Insecure file permissions on /conf/certs/privkey.pem [ ] Private key loaded from file: /conf/certs/privkey.pem [ ] Private key check succeeded [ ] DH initialization needed for DHE-PSK-CHACHA20-POLY1305 [ ] DH initialization [ ] Could not load DH parameters from /conf/certs/server.pem [ ] Using dynamic DH parameters [ ] ECDH initialization [ ] ECDH initialized with curve prime256v1 [.] Configuration successful [ ] Binding service [adviserd] [ ] Listening file descriptor created (FD=8) [ ] Setting accept socket options (FD=8) [ ] Option SO_REUSEADDR set on accept socket [ ] Option TCP_NODELAY set on accept socket [ ] Service [adviserd] (FD=8) bound to :::7582 [!] Cannot open log file: /var/log/stunnel.log [ ] Deallocating section defaults [ ] Unbinding service [adviserd] [ ] Service [adviserd] closed (FD=8) [ ] Service [adviserd] closed [ ] Deallocating section [adviserd] I have no idea what's wrong with this, help! Many thanks

3 2

Re: [stunnel-users] My home ISP blocking ssh protocol
by Eric Eberhard 13 Dec '19

13 Dec '19

Ditto. Eric -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of Mike Sent: Thursday, December 12, 2019 9:08 AM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] My home ISP blocking ssh protocol On 12/11/2019 5:53 PM, Matt Thomas wrote: > Hello:) > >[snip > > All i am trying to do is have a SFTP server that i can access my dang >files from while i am at school, work, friends house, library or >wherever. >[snip] I run a ssh server on my home network. I configure it to use a port other than port 22. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Stunnel-5.55 client close TLS socket before it could read more bytes
by Ming Lu 13 Dec '19

13 Dec '19

Hello, May I please have help on this issue? Thanks in advance! I had a stunnel server and client communicating with TLSv1.2 (both of them are stunnel 5.55 and OpenSSL-1.1.1d) on CentOS 7 based Linux (kernel was updated as 4.19.0). The case is that client sends a HTTP request to server, and then server responds a payload with more than 640KB size. Normally, the server will close the connection by sending an alert firstly. The issue is that sometimes (not 100% reproducible), stunnel client reported: "TLS socket closed (read hangup)". and then closed the TLS socket. So I could find an alert sent from client to server firstly from tcpdump. Consequently, this caused the application reported "unexpected end of input?" as there should be more data to be received. I added a few debug logic and I indeed found that: there were occurrences that if stunnel client did not close the TLS socket, it could read more data from TLS socket in next poll loop: -------------------- 03:59:46 localhost stunnel: LOG6[0]: MingL: POLLRDHUP: 8192 03:59:46 localhost stunnel: LOG6[0]: MingL: ioctlsocket: 0 03:59:46 localhost stunnel: LOG6[0]: MingL: bytes: 0 <== client didn't close the sock in my debug version. 03:59:46 localhost stunnel: LOG6[0]: MingL: after checking 03:59:46 localhost stunnel: LOG6[0]: MingL: s_poll_wait: return 1 03:59:46 localhost stunnel: LOG6[0]: MingL: sock_can_rd: n 03:59:46 localhost stunnel: LOG6[0]: MingL: sock_can_wr: Y 03:59:46 localhost stunnel: LOG6[0]: MingL: ssl_can_rd: n 03:59:46 localhost stunnel: LOG6[0]: MingL: ssl_can_wr: n 03:59:46 localhost stunnel: LOG6[0]: MingL: pending: 1 03:59:46 localhost stunnel: LOG6[0]: MingL: write to sock 18432 03:59:46 localhost stunnel: LOG6[0]: MingL: read_wants_read Y 03:59:46 localhost stunnel: LOG6[0]: MingL: write_wants_writen 03:59:46 localhost stunnel: LOG6[0]: MingL: read from TLS 10168 <== then I observed the further read from TLS. -------------------- Any help will be appreciated! Ming

1 0

Re: [stunnel-users] My home ISP blocking ssh protocol
by Christopher Schultz 12 Dec '19

12 Dec '19

Matt, On 12/12/19 13:43, Matt Thomas wrote: > Not sure if you have read the first post, or maybe i didnt add it, but i > have tried port 22,5022,8022, 25565, 47506 and 443 haha. It wasn't clear if you were changing the port number of the sshd service (on your server) or the port you had open on your firewall/router. I suspect that your ISP is blocking incoming connections to port 22. The port number you use for sshd on the server is not relevant. -chris > On Thu, Dec 12, 2019, 9:44 AM Christopher Schultz > <chris(a)christopherschultz.net <mailto:[email protected]>> wrote: > > Matt, > > On 12/12/19 11:01, Matt Thomas wrote: > > Server is 192.168.0.10 > > Router is 192.168.0.1 > > > > It works fine internally:) > > > > I add a port forward in the router for port 22 pointed at .0.10. > Routers > > firewall all ready is configured to accept ssh on port 22 from any > any. > > > > When ever anyone attempts to connect to the server, a pop up shows > on my > > screen. When i try to have my friends or co-workers try from there > house > > or i try from public place, no pop up or hits on the server log. Just > > times out. > > > > But if i put minecraft on port 22, it works. So certain traffic is > > making it through. Even hamachi vpn works fine BUT i cant install that > > on public PC's haha > > I was about to say "this is clearly an issue with the port number, pick > something other than 22" but if you say you can run Minecraft over port > 22, then that's ... strange. > > I wasn't aware that Minecraft servers could have their ports changed > like that. You can really set up your Minecraft server to listen on > localhost:22 and it doesn't use UPnP or anything like that to > reconfigure your firewall/router? > > My advice is to try configuring things like this: > > Router: 192.168.0.1 > Forward WAN connections to port e.g. 1022 -> 192.168.0.10:1022 > <http://192.168.0.10:1022> > > Server: 192.68.0.1 > Accept stunnel connections on port 1022 > accept=:1022 > connect=localhost:22 > > If that works, I might even try just changing the port number of your > ssh/sftp service from the "standard" port to something else and trying > again without stunnel in the mix. > > I've never encountered an ISP which does deep packet inspection to block > services. They usually just block ports. > > -chris > > > On Thu, Dec 12, 2019, 7:58 AM Christopher Schultz > > <chris(a)christopherschultz.net > <mailto:[email protected]> > <mailto:[email protected] > <mailto:[email protected]>>> wrote: > > > > Matt, > > > > On 12/11/19 17:53, Matt Thomas wrote: > > > I need to know if Stunnel is going to accomplish what i need > to do. My > > > home ISP blocks protocol HTTP and SSH from coming in so that > > people cant > > > run their own website from home without paying the ISP for a > > "Business" line > > > > > > All i am trying to do is have a SFTP server that i can > access my dang > > > files from while i am at school, work, friends house, library or > > > wherever. I have tried ssh on multiple random ports and made > sure all > > > firewall rules and port forward rules were correct in my home > > router. I > > > know they work because i even went as far as setting up a > minecraft > > > server to just test the port forward rules out and sure > enough, my > > > friend 200 miles away can connect just fine to my home minecraft > > > server.. But he can not connect to the ssh server. No logs > are ever > > > created on the server either because something is stoping > the packet > > > from even hitting my router, that something is my ISP > > > > > > Would stunnel allow me to make ssh traffic look like regular > https > > > traffic, thus allowing me to connect to my server at home so > i can > > do my > > > homework?? > > > > Those other servers probably use TLS or plaintext connections. > stunnel > > uses TLS, but ssh/sftp use a slightly different protocol that may > > possibly be distinguishable by a determined ISP. > > > > I would think that using stunnel to tunnel SFTP/SSH would be > possible, > > though not strictly necessary. I suspect some other problem is > > preventing you from succeeding. > > > > Can you be more specific about exactly what you did for > configuration? > > Port numbers, specific things you did, etc? You don't have to > disclose > > your public IP address, but perhaps give the local IPs of your > router > > and home server, etc? > > > > -chris > > > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)stunnel.org <mailto:[email protected]> > <mailto:[email protected] <mailto:[email protected]>> > > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org <mailto:[email protected]> > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >

2 1

Re: [stunnel-users] My home ISP blocking ssh protocol
by Christopher Schultz 12 Dec '19

12 Dec '19

Matt, On 12/12/19 11:01, Matt Thomas wrote: > Server is 192.168.0.10 > Router is 192.168.0.1 > > It works fine internally:) > > I add a port forward in the router for port 22 pointed at .0.10. Routers > firewall all ready is configured to accept ssh on port 22 from any any. > > When ever anyone attempts to connect to the server, a pop up shows on my > screen. When i try to have my friends or co-workers try from there house > or i try from public place, no pop up or hits on the server log. Just > times out. > > But if i put minecraft on port 22, it works. So certain traffic is > making it through. Even hamachi vpn works fine BUT i cant install that > on public PC's haha I was about to say "this is clearly an issue with the port number, pick something other than 22" but if you say you can run Minecraft over port 22, then that's ... strange. I wasn't aware that Minecraft servers could have their ports changed like that. You can really set up your Minecraft server to listen on localhost:22 and it doesn't use UPnP or anything like that to reconfigure your firewall/router? My advice is to try configuring things like this: Router: 192.168.0.1 Forward WAN connections to port e.g. 1022 -> 192.168.0.10:1022 Server: 192.68.0.1 Accept stunnel connections on port 1022 accept=:1022 connect=localhost:22 If that works, I might even try just changing the port number of your ssh/sftp service from the "standard" port to something else and trying again without stunnel in the mix. I've never encountered an ISP which does deep packet inspection to block services. They usually just block ports. -chris > On Thu, Dec 12, 2019, 7:58 AM Christopher Schultz > <chris(a)christopherschultz.net <mailto:[email protected]>> wrote: > > Matt, > > On 12/11/19 17:53, Matt Thomas wrote: > > I need to know if Stunnel is going to accomplish what i need to do. My > > home ISP blocks protocol HTTP and SSH from coming in so that > people cant > > run their own website from home without paying the ISP for a > "Business" line > > > > All i am trying to do is have a SFTP server that i can access my dang > > files from while i am at school, work, friends house, library or > > wherever. I have tried ssh on multiple random ports and made sure all > > firewall rules and port forward rules were correct in my home > router. I > > know they work because i even went as far as setting up a minecraft > > server to just test the port forward rules out and sure enough, my > > friend 200 miles away can connect just fine to my home minecraft > > server.. But he can not connect to the ssh server. No logs are ever > > created on the server either because something is stoping the packet > > from even hitting my router, that something is my ISP > > > > Would stunnel allow me to make ssh traffic look like regular https > > traffic, thus allowing me to connect to my server at home so i can > do my > > homework?? > > Those other servers probably use TLS or plaintext connections. stunnel > uses TLS, but ssh/sftp use a slightly different protocol that may > possibly be distinguishable by a determined ISP. > > I would think that using stunnel to tunnel SFTP/SSH would be possible, > though not strictly necessary. I suspect some other problem is > preventing you from succeeding. > > Can you be more specific about exactly what you did for configuration? > Port numbers, specific things you did, etc? You don't have to disclose > your public IP address, but perhaps give the local IPs of your router > and home server, etc? > > -chris > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org <mailto:[email protected]> > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >

2 1

My home ISP blocking ssh protocol
by Matt Thomas 12 Dec '19

12 Dec '19

Hello:) I need to know if Stunnel is going to accomplish what i need to do. My home ISP blocks protocol HTTP and SSH from coming in so that people cant run their own website from home without paying the ISP for a "Business" line All i am trying to do is have a SFTP server that i can access my dang files from while i am at school, work, friends house, library or wherever. I have tried ssh on multiple random ports and made sure all firewall rules and port forward rules were correct in my home router. I know they work because i even went as far as setting up a minecraft server to just test the port forward rules out and sure enough, my friend 200 miles away can connect just fine to my home minecraft server.. But he can not connect to the ssh server. No logs are ever created on the server either because something is stoping the packet from even hitting my router, that something is my ISP Would stunnel allow me to make ssh traffic look like regular https traffic, thus allowing me to connect to my server at home so i can do my homework?? thanks -- My history test question: Give the number of automobiles produced in America during the year of your choice. My answer? 1806: none Matt Thomas GrillofMyDreams.blogspot.com http://slcc.biz.tm

3 2

Re: [stunnel-users] My home ISP blocking ssh protocol
by pepak＠seznam.cz 12 Dec '19

12 Dec '19

Hi! > I need to know if Stunnel is going to accomplish what i need to do. My home > ISP blocks protocol HTTP and SSH from coming in so that people cant run > their own website from home without paying the ISP for a "Business" line [...] > Would stunnel allow me to make ssh traffic look like regular https traffic, > thus allowing me to connect to my server at home so i can do my homework?? Well, yes and no: Yes: Your SSH traffic will be wrapped in the standard TLS protocol, which would make it impossible for the ISP to determine what's inside. They wouldn't be able to determine the actual contents of the traffic, although they could make good guesses based on the packet metadata (direction, size, frequency, time between packets, etc.). But they won't be able to scan packet headers and determine that "hey, this is SSH, let's block it!". No: Part of the answer lies above: using statistical methods, it may be possible to distinguish SSH from something else. The other part lies in the fact that the ISP doesn't really have to do it - if they feel like it, they could e.g. block all incoming traffic unless it is a response to a prior outgoing traffic, or block all incoming traffic unless it can be determined that it is one of a selected few permitted protocols. Likely you won't run into the "No" part of the answer, and in that case Stunnel will serve nicely (I use it in this scenario, myself). But you might. In that case, you may want to use something like TCP/IP Gender Changer (which basically creates a tunnel with reverse directions), either alone or in combination with Stunnel. Pepak

1 0

updated patch for Start TLS for LDAP clients (RFC 2830)
by Seth Grover 10 Dec '19

10 Dec '19

Back in 2013 Bart Dopheide submitted a patch to the mailing list to add LDAP StartTLS (elevate connection to TLS after initial connection is initiated) support to the list of supported protocols in protocol.c ( https://www.stunnel.org/pipermail/stunnel-users/2013-November/004437.html) It doesn't look like this patch was ever accepted into stunnel. I've run into a similar requirement and have updated the patch to work against stunnel 5.56. In addition, there are a few other minor changes, the most significant being as follows. It would appear that Windows Active Directory servers do not implement the ldap extended response PDU in the same way as OpenLDAP (see this thread: https://www.openldap.org/lists/openldap-software/200401/msg00800.html) With this patch you can specify either "protocol = winldap" or "protocol = openldap" and have it work either way. I haven't modified the logic of Bart's original patch as far as OpenLDAP goes, but I have split the code path where applicable to handle the Windows case. I am testing this against a virtual Windows Server 2016 Active Directory instance with self-signed certificates with the following config: [stunnel.winldap] client = yes accept = localhost:3268 connect =mymachine.example.com:3268 protocol = winldap And the following ldapsearch command: LDAPTLS_REQCERT=never ldapsearch -Z -h localhost -p 3268 -D "nginx_bind_dn(a)localdomain.lan" -W -b "dc=localdomain,dc=lan" -s sub "objectClass=person" The ldapsearch output returns as expected and I can see in wireshark that the LDAP_START_TLS_OID request/response happens as it should. The patch is at the end of this message. -SG diff -Nurp a/src/protocol.c b/src/protocol.c --- a/src/protocol.c 2019-05-15 13:35:16.000000000 -0600 +++ b/src/protocol.c 2019-12-03 13:54:47.536940900 -0700 @@ -64,6 +64,8 @@ NOEXPORT char *pop3_server(CLI *, SERVIC NOEXPORT char *imap_client(CLI *, SERVICE_OPTIONS *, const PHASE); NOEXPORT char *imap_server(CLI *, SERVICE_OPTIONS *, const PHASE); NOEXPORT char *nntp_client(CLI *, SERVICE_OPTIONS *, const PHASE); +NOEXPORT char *openldap_client(CLI *, SERVICE_OPTIONS *, const PHASE); +NOEXPORT char *winldap_client(CLI *, SERVICE_OPTIONS *, const PHASE); NOEXPORT char *connect_server(CLI *, SERVICE_OPTIONS *, const PHASE); NOEXPORT char *connect_client(CLI *, SERVICE_OPTIONS *, const PHASE); #ifndef OPENSSL_NO_MD4 @@ -113,6 +115,14 @@ char *protocol(CLI *c, SERVICE_OPTIONS * return opt->option.client ? nntp_client(c, opt, phase) : "The 'nntp' protocol is not supported in the server mode"; + if(!strcasecmp(opt->protocol, "openldap")) + return opt->option.client ? + openldap_client(c, opt, phase) : + "The 'openldap' protocol is not supported in the server mode"; + if(!strcasecmp(opt->protocol, "winldap")) + return opt->option.client ? + winldap_client(c, opt, phase) : + "The 'winldap' protocol is not supported in the server mode"; if(!strcasecmp(opt->protocol, "connect")) return opt->option.client ? connect_client(c, opt, phase) : @@ -1119,6 +1129,182 @@ NOEXPORT char *nntp_client(CLI *c, SERVI return NULL; } +/**************************************** LDAP, RFC 2830 */ +uint8_t ldap_startssl_message[0x1d + 2] = +{ + 0x30, /* tag = UNIVERSAL SEQUENCE */ + 0x1d, /* len = 29 (the remaining number of bytes in this message) */ + 0x02, /* messageID */ + 0x01, /* len = 1 */ + 0x01, /* value = 1 (this is messageID 1) */ + /* --- */ + 0x77, /* protocolOp = APPLICATION (23) (=ExtendedRequest) + * 0b01xxxxxx => APPLICATION + * 0bxx1xxxxx => ? + * 0xxxx10111 => 23 + */ + 0x18, /* len = 24 */ + 0x80, /* type = requstName? */ + 0x16, /* len = 22 */ + /* OID: 1.3.6.1.4.1.1466.20037 (=LDAP_START_TLS_OID)*/ + '1', '.', + '3', '.', + '6', '.', + '1', '.', + '4', '.', + '1', '.', + '1', '4', '6', '6', '.', + '2', '0', '0', '3', '7' + /* No requestValue, as per RFC2830 (in 2.1: "The requestValue field is absent") */ +}; + +typedef enum { + LDAP_OPENLDAP, + LDAP_WINLDAP +} LDAP_MODE; + +#define LDAP_UNIVERSAL_SEQUENCE 0x30 +#define LDAP_WINLDAP_FOUR_BYTE_LEN_FLAG 0x84 +#define LDAP_RESPONSE_MSG_ID_TYPE_INT 0x02 +#define LDAP_RESPONSE_EXPECTED_MSG_ID_LEN 0x01 +#define LDAP_RESPONSE_EXPECTED_MSG_ID 0x01 +#define LDAP_RESPONSE_EXT_RESP 0x0a +#define LDAP_RESPONSE_EXT_RESP_APPLICATION 0x78 +#define LDAP_RESPONSE_EXPECTED_ERR_LEN 0x01 +#define LDAP_RESPONSE_SUCCESS 0x00 + +NOEXPORT char *ldap_client(CLI *c, SERVICE_OPTIONS *opt, const PHASE phase, const LDAP_MODE ldap_mode) { + + /* thanks to these threads for help with these PDUs + https://www.stunnel.org/pipermail/stunnel-users/2013-November/004437.html + https://www.openldap.org/lists/openldap-software/200401/msg00800.html */ + + uint8_t buffer_8[1]; + uint32_t buffer_32[1]; + uint32_t resp_len; + uint8_t ldap_response[256]; + uint8_t *resp_ptr; + + (void)opt; /* squash the unused parameter warning */ + + if(phase!=PROTOCOL_MIDDLE) + return NULL; + + /* send "Start TLS" request to AD server */ + s_log(LOG_DEBUG, "Requesting LDAP Start TLS"); + s_write(c, c->remote_fd.fd, ldap_startssl_message, (size_t)ldap_startssl_message[1] + 2); + + /* LDAP_UNIVERSAL_SEQUENCE (1 byte) */ + s_read(c, c->remote_fd.fd, buffer_8, 1); + if(buffer_8[0] != LDAP_UNIVERSAL_SEQUENCE) { + s_log(LOG_ERR, "start tag is not UNIVERSAL SEQUENCE"); + throw_exception(c, 1); + } + + if(ldap_mode == LDAP_OPENLDAP) { + /* OpenLDAP - response length (1 byte) */ + s_log(LOG_DEBUG, "Reading OpenLDAP message size (1 byte)"); + s_read(c, c->remote_fd.fd, buffer_8, 1); + resp_len = buffer_8; + + } else if(ldap_mode == LDAP_WINLDAP) { + + /* WinLDAP - "response length is 4 bytes" flag - LDAP_WINLDAP_FOUR_BYTE_LEN_FLAG (1-byte) */ + s_read(c, c->remote_fd.fd, buffer_8, 1); + if(buffer_8[0] != LDAP_WINLDAP_FOUR_BYTE_LEN_FLAG) { + s_log(LOG_ERR, "LDAP message length flag is an unexpected value"); + throw_exception(c, 1); + } + + /* WinLDAP - response length (4 bytes, network byte order) */ + s_log(LOG_DEBUG, "Reading WinLDAP message size (4 bytes)"); + s_read(c, c->remote_fd.fd, buffer_32, 4); + resp_len = ntohl(buffer_32[0]); + + } else { + s_log(LOG_ERR, "Unsupported LDAP mode"); + throw_exception(c, 1); + } + + /* LDAP response message */ + s_log(LOG_DEBUG, "Reading LDAP message (%u byte(s))", resp_len); + s_read(c, c->remote_fd.fd, ldap_response, resp_len); + + resp_ptr = &ldap_response[0]; + + /* LDAP_RESPONSE_MSG_ID_TYPE_INT - 1 byte */ + if(*resp_ptr != LDAP_RESPONSE_MSG_ID_TYPE_INT) { + s_log(LOG_ERR, "LDAP response has an incorrect message ID type"); + throw_exception(c, 1); + } + resp_ptr++; + + /* LDAP_RESPONSE_EXPECTED_MSG_ID_LEN - 1 byte */ + if(*resp_ptr != LDAP_RESPONSE_EXPECTED_MSG_ID_LEN) { + s_log(LOG_ERR, "LDAP response has an unexpected message ID length"); + throw_exception(c, 1); + } + resp_ptr++; + + /* LDAP_RESPONSE_EXPECTED_MSG_ID - 1 byte */ + if(*resp_ptr != LDAP_RESPONSE_EXPECTED_MSG_ID) { + s_log(LOG_ERR, "LDAP response has an unexpected message ID"); + throw_exception(c, 1); + } + resp_ptr++; + + /* LDAP_RESPONSE_EXT_RESP_APPLICATION - 1 byte */ + if(*resp_ptr != LDAP_RESPONSE_EXT_RESP_APPLICATION) { + s_log(LOG_ERR, "LDAP response protocolOp is not APPLICATION"); + throw_exception(c, 1); + } + resp_ptr++; + + if(ldap_mode == LDAP_WINLDAP) { + /* WinLDAP - "response length is 4 bytes" flag - LDAP_WINLDAP_FOUR_BYTE_LEN_FLAG (1-byte) */ + if(*resp_ptr != LDAP_WINLDAP_FOUR_BYTE_LEN_FLAG) { + s_log(LOG_ERR, "LDAP extendedResp length flag is an unexpected value"); + throw_exception(c, 1); + } + /* WinLDAP - extended response message length (4-bytes) */ + resp_ptr += 5; + + } else { + /* OpenLDAP - extended response message length (1-byte) */ + resp_ptr++; + } + + /* LDAP_RESPONSE_EXT_RESP - 1 byte */ + if(*resp_ptr != LDAP_RESPONSE_EXT_RESP) { + s_log(LOG_ERR, "LDAP response type is not EXT_RESP"); + throw_exception(c, 1); + } + resp_ptr++; + + /* LDAP_RESPONSE_EXT_RESP - 1 byte */ + if(*resp_ptr != LDAP_RESPONSE_EXPECTED_ERR_LEN) { + s_log(LOG_ERR, "LDAP response has an unexpected error code length"); + throw_exception(c, 1); + } + resp_ptr++; + + if(*resp_ptr != LDAP_RESPONSE_SUCCESS) { + s_log(LOG_ERR, "LDAP response has indicated an error (%u)", *resp_ptr); + throw_exception(c, 1); + } + + return NULL; +} + + +NOEXPORT char *openldap_client(CLI *c, SERVICE_OPTIONS *opt, const PHASE phase) { + return ldap_client(c, opt, phase, LDAP_OPENLDAP); +} + +NOEXPORT char *winldap_client(CLI *c, SERVICE_OPTIONS *opt, const PHASE phase) { + return ldap_client(c, opt, phase, LDAP_WINLDAP); +} + /**************************************** connect */ NOEXPORT char *connect_server(CLI *c, SERVICE_OPTIONS *opt, const PHASE phase) {

1 1

Stunnel - supports static OpenSSL engines?
by pepak＠seznam.cz 10 Dec '19

10 Dec '19

Hi! Does Stunnel support static-linked engines for OpenSSL? From my experiments, my guess would be that it doesn't, but I may be overlooking something and would welcome a confirmation. Why I need it: During development of an urelated app, after many many failed attempts, I finally managed to get OpenSSL 1.1.x working with a CAPI engine - but the only functional setup involved CAPI built directly into libcrypto. Every other setup, in both Visual Studio and MinGW, led to some problem or another. I would love to extend this success to my Stunnel setup, where I am now forced to stick with version 5.49 because the newer versions use OpenSSL 1.1.x which simply doesn't seem to be able to function correctly with the dynamic CAPI engine. What I need from Stunnel, basically, is for it to try to use ENGINE_by_id('capi') first and only when that fails, attempt to load a dynamic engine using ENGINE_by_id('dynamic') and the necessary ENGINE_ctrl_cmd_string commands. I can build a functional static-built OpenSSL libraries myself. If Stunnel wanted to incorporate that, I am all for it, provided that there is some way of specifying whether a static engine or a dynamic engine is preferred. My Configure command is: perl Configure shared enable-static-engine enable-zlib --with-zlib-include=C:\Zlib --with-zlib-lib=C:\Zlib\zlib.lib VC-WIN64A Pepak

1 0

Re: [stunnel-users] stunnel 5.55 - - - SSL_connect: Peer suddenly disconnected
by Flo Rance 06 Dec '19

06 Dec '19

The full logs of both sides would still be useful. Regards, Flo On Fri, 6 Dec 2019 at 09:48, simona vittori <svittori(a)gmail.com> wrote: > Hi, > port 41521 is the port of stunnel server istance that then redirect > connection in clear on port 1521 of the listener. > > That's all > > Thanks > > Simona > > Il giorno ven 6 dic 2019 alle ore 09:37 Flo Rance <trourance(a)gmail.com> > ha scritto: > >> Hi, >> >> The full logs of the client would be useful. >> >> What are you trying to connect to (on port 41521) ? >> >> Regards, >> Flo >> >> On Thu, 5 Dec 2019 at 12:44, simona vittori <svittori(a)gmail.com> wrote: >> >>> Hello, >>> >>> I have stunnel v 5.55 on linux machine client e linux machine db server, >>> Red Hat Enterprise Linux Server release 6.6. I have noticed that there are >>> many many diconnections by side client (at the bottom of the page). Why >>> there is this behavior? >>> >>> This is the configuration file of client machine: >>> >>> cert = /opt/stunnel-5.55/etc/stunnel/stunnel.pem >>> verify = 3 >>> setuid = stunnel >>> >>> CAfile = /opt/stunnel-5.55/var/certs.pem >>> >>> pid = /opt/stunnel-5.55/var/lib/stunnel/stunnel_client.pid >>> >>> socket = l:TCP_NODELAY=1 >>> socket = r:TCP_NODELAY=1 >>> >>> sslVersion = TLSv1 >>> >>> TIMEOUTconnect = 30 >>> failover = rr >>> >>> ciphers = ECDH@STRENGTH:DH@STRENGTH:HIGH:!RC4:!MD5:!DES:!aNULL:!eNULL >>> >>> debug = 7 >>> output = /opt/stunnel-5.55/var/stunnel.log >>> >>> client = yes >>> >>> [connessione_a_EMPRMDB1-DB2] >>> accept=127.0.0.1:10001 >>> connect=10.56.213.70:41521 >>> connect=10.56.213.72:41521 >>> >>> >>> ####################################################################################### >>> >>> Dec 5 12:31:42 EMWBPAPP2b stunnel: []:LOG3[15001]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:31:52 EMWBPAPP2b stunnel: []:LOG3[15007]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:32:13 EMWBPAPP2b stunnel: []:LOG3[15013]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:32:13 EMWBPAPP2b stunnel: []:LOG3[15014]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:32:22 EMWBPAPP2b stunnel: []:LOG3[15019]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:32:23 EMWBPAPP2b stunnel: []:LOG3[15021]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:32:23 EMWBPAPP2b stunnel: []:LOG3[15023]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:32:24 EMWBPAPP2b stunnel: []:LOG3[15024]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:32:44 EMWBPAPP2b stunnel: []:LOG3[15033]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:32:45 EMWBPAPP2b stunnel: []:LOG3[15035]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:32:55 EMWBPAPP2b stunnel: []:LOG3[15041]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:34:04 EMWBPAPP2b stunnel: []:LOG3[15062]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:34:05 EMWBPAPP2b stunnel: []:LOG3[15063]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:34:06 EMWBPAPP2b stunnel: []:LOG3[15065]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:34:18 EMWBPAPP2b stunnel: []:LOG3[15069]: SSL_connect: Peer >>> suddenly disconnected >>> >>> #####################################################################à >>> >>> Thank for your help >>> >>> Simona >>> _______________________________________________ >>> stunnel-users mailing list >>> stunnel-users(a)stunnel.org >>> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >>> >>

1 0

stunnel 5.55 - - - SSL_connect: Peer suddenly disconnected
by simona vittori 06 Dec '19

06 Dec '19

Hello, I have stunnel v 5.55 on linux machine client e linux machine db server, Red Hat Enterprise Linux Server release 6.6. I have noticed that there are many many diconnections by side client (at the bottom of the page). Why there is this behavior? This is the configuration file of client machine: cert = /opt/stunnel-5.55/etc/stunnel/stunnel.pem verify = 3 setuid = stunnel CAfile = /opt/stunnel-5.55/var/certs.pem pid = /opt/stunnel-5.55/var/lib/stunnel/stunnel_client.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 sslVersion = TLSv1 TIMEOUTconnect = 30 failover = rr ciphers = ECDH@STRENGTH:DH@STRENGTH:HIGH:!RC4:!MD5:!DES:!aNULL:!eNULL debug = 7 output = /opt/stunnel-5.55/var/stunnel.log client = yes [connessione_a_EMPRMDB1-DB2] accept=127.0.0.1:10001 connect=10.56.213.70:41521 connect=10.56.213.72:41521 ####################################################################################### Dec 5 12:31:42 EMWBPAPP2b stunnel: []:LOG3[15001]: SSL_connect: Peer suddenly disconnected Dec 5 12:31:52 EMWBPAPP2b stunnel: []:LOG3[15007]: SSL_connect: Peer suddenly disconnected Dec 5 12:32:13 EMWBPAPP2b stunnel: []:LOG3[15013]: SSL_connect: Peer suddenly disconnected Dec 5 12:32:13 EMWBPAPP2b stunnel: []:LOG3[15014]: SSL_connect: Peer suddenly disconnected Dec 5 12:32:22 EMWBPAPP2b stunnel: []:LOG3[15019]: SSL_connect: Peer suddenly disconnected Dec 5 12:32:23 EMWBPAPP2b stunnel: []:LOG3[15021]: SSL_connect: Peer suddenly disconnected Dec 5 12:32:23 EMWBPAPP2b stunnel: []:LOG3[15023]: SSL_connect: Peer suddenly disconnected Dec 5 12:32:24 EMWBPAPP2b stunnel: []:LOG3[15024]: SSL_connect: Peer suddenly disconnected Dec 5 12:32:44 EMWBPAPP2b stunnel: []:LOG3[15033]: SSL_connect: Peer suddenly disconnected Dec 5 12:32:45 EMWBPAPP2b stunnel: []:LOG3[15035]: SSL_connect: Peer suddenly disconnected Dec 5 12:32:55 EMWBPAPP2b stunnel: []:LOG3[15041]: SSL_connect: Peer suddenly disconnected Dec 5 12:34:04 EMWBPAPP2b stunnel: []:LOG3[15062]: SSL_connect: Peer suddenly disconnected Dec 5 12:34:05 EMWBPAPP2b stunnel: []:LOG3[15063]: SSL_connect: Peer suddenly disconnected Dec 5 12:34:06 EMWBPAPP2b stunnel: []:LOG3[15065]: SSL_connect: Peer suddenly disconnected Dec 5 12:34:18 EMWBPAPP2b stunnel: []:LOG3[15069]: SSL_connect: Peer suddenly disconnected #####################################################################à Thank for your help Simona

2 1

Re: [stunnel-users] Help please.
by Christopher Schultz 03 Dec '19

03 Dec '19

Ajiq, On 12/3/19 09:13, Ajjq . wrote: > Hi Christopher: > > You are right. I needed > C:> TELNET LOCALHOST 80 and expect to be connected to sub.dominio.com:443 > > I modified stunnel.conf with client=yes. I am including stunnel.con and > log. > > I created the service Stunnel service, but when I start it, I get this > error message. > > [Stunnel server is down due to an error. You need to exit and correct the problem. Click OK to see the error log window.] The screenshot shows an error "bind: Address already in use". Do you have stunnel running twice at once? Please stop stunnel, delete your log file, then start it again. Post the resulting log file to the mailing list. -chris > > > stunnel.conf > > debug = 7 > output = stunnel3.log > > ; TLS front-end to a web server > [https] > client=yes > accept = 127.0.0.1:80 > connect = subd.dominio.com:443 > cert = stunnel.pem > TIMEOUTclose = 0 Is TIMEOPUTclose=0 actually on one line? That might be a syntax error. -chris

2 1

Help please.
by Ajjq . 02 Dec '19

02 Dec '19

Hi I need to enable a tunnel_out for UTL_HTTP from http:// to https:// I installed stunnel 5.34 win32 in a windows 2008 server. I am including my stunnel.conf y log file (debug=7) As you can see in the log file, I get this error: 2019.12.01 14:08:12 LOG3[7]: SSL_accept: 1407609C: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request Could you help me please? MY stunnel.conf--- debug = 7 output = stunnel.log [https] accept = 127.0.0.1:80 connect = sub.dominio.com:443 cert = stunnel.pem TIMEOUTclose = 0 This version has openssl[cid:b6de9085-07c4-43d0-b772-bb9beb37c2ac] MY LOG--- 2019.12.01 14:00:37 LOG7[cron]: Cron thread initialized 2019.12.01 14:00:37 LOG7[main]: No limit detected for the number of clients 2019.12.01 14:00:37 LOG5[main]: stunnel 5.34 on x86-pc-msvc-1500 platform 2019.12.01 14:00:37 LOG5[main]: Compiled/running with OpenSSL 1.0.2h-fips 3 May 2016 2019.12.01 14:00:37 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2019.12.01 14:00:37 LOG7[main]: errno: (*_errno()) 2019.12.01 14:00:37 LOG7[ui]: GUI message loop initialized 2019.12.01 14:00:37 LOG5[main]: Reading configuration from file stunnel.conf 2019.12.01 14:00:37 LOG5[main]: UTF-8 byte order mark detected 2019.12.01 14:00:37 LOG5[main]: FIPS mode disabled 2019.12.01 14:00:37 LOG7[main]: Compression disabled 2019.12.01 14:00:37 LOG7[main]: Snagged 64 random bytes from C:/.rnd 2019.12.01 14:00:37 LOG7[main]: Wrote 1024 new random bytes to C:/.rnd 2019.12.01 14:00:37 LOG7[main]: PRNG seeded successfully 2019.12.01 14:00:37 LOG6[main]: Initializing service [https] 2019.12.01 14:00:38 LOG6[main]: Loading certificate from file: stunnel.pem 2019.12.01 14:00:38 LOG6[main]: Certificate loaded from file: stunnel.pem 2019.12.01 14:00:38 LOG6[main]: Loading private key from file: stunnel.pem 2019.12.01 14:00:38 LOG6[main]: Private key loaded from file: stunnel.pem 2019.12.01 14:00:38 LOG7[main]: Private key check succeeded 2019.12.01 14:00:38 LOG7[main]: DH initialization 2019.12.01 14:00:38 LOG7[main]: Could not load DH parameters from stunnel.pem 2019.12.01 14:00:38 LOG6[main]: Using dynamic DH parameters 2019.12.01 14:00:38 LOG7[main]: ECDH initialization 2019.12.01 14:00:38 LOG7[main]: ECDH initialized with curve prime256v1 2019.12.01 14:00:38 LOG7[main]: SSL options: 0x03004004 (+0x03004000, -0x00000000) 2019.12.01 14:00:38 LOG5[main]: Configuration successful 2019.12.01 14:00:38 LOG7[main]: Listening file descriptor created (FD=352) 2019.12.01 14:00:38 LOG7[main]: Service [https] (FD=352) bound to 127.0.0.1:80 2019.12.01 14:00:59 LOG7[main]: Found 1 ready file descriptor(s) 2019.12.01 14:00:59 LOG7[main]: FD=260 ifds=r-x ofds=r-- 2019.12.01 14:00:59 LOG7[main]: Dispatching signals from the signal pipe 2019.12.01 14:00:59 LOG7[main]: Processing SIGNAL_RELOAD_CONFIG 2019.12.01 14:00:59 LOG5[main]: Reading configuration from file stunnel.conf 2019.12.01 14:00:59 LOG5[main]: UTF-8 byte order mark detected 2019.12.01 14:00:59 LOG5[main]: FIPS mode disabled 2019.12.01 14:00:59 LOG7[main]: Compression disabled 2019.12.01 14:00:59 LOG7[main]: Snagged 64 random bytes from C:/.rnd 2019.12.01 14:00:59 LOG7[main]: Wrote 1024 new random bytes to C:/.rnd 2019.12.01 14:00:59 LOG7[main]: PRNG seeded successfully 2019.12.01 14:00:59 LOG6[main]: Initializing service [https] 2019.12.01 14:00:59 LOG6[main]: Loading certificate from file: stunnel.pem 2019.12.01 14:00:59 LOG6[main]: Certificate loaded from file: stunnel.pem 2019.12.01 14:00:59 LOG6[main]: Loading private key from file: stunnel.pem 2019.12.01 14:00:59 LOG6[main]: Private key loaded from file: stunnel.pem 2019.12.01 14:00:59 LOG7[main]: Private key check succeeded 2019.12.01 14:00:59 LOG7[main]: DH initialization 2019.12.01 14:00:59 LOG7[main]: Could not load DH parameters from stunnel.pem 2019.12.01 14:00:59 LOG6[main]: Using dynamic DH parameters 2019.12.01 14:00:59 LOG7[main]: ECDH initialization 2019.12.01 14:00:59 LOG7[main]: ECDH initialized with curve prime256v1 2019.12.01 14:00:59 LOG7[main]: SSL options: 0x03004004 (+0x03004000, -0x00000000) 2019.12.01 14:00:59 LOG5[main]: Configuration successful 2019.12.01 14:00:59 LOG7[main]: Closing service [https] 2019.12.01 14:00:59 LOG7[main]: Service [https] closed (FD=352) 2019.12.01 14:00:59 LOG7[main]: Service [https] closed 2019.12.01 14:00:59 LOG7[main]: Listening file descriptor created (FD=352) 2019.12.01 14:00:59 LOG7[main]: Service [https] (FD=352) bound to 127.0.0.1:80 2019.12.01 14:00:59 LOG7[main]: Signal pipe is empty 2019.12.01 14:01:37 LOG6[cron]: Executing cron jobs 2019.12.01 14:01:37 LOG5[cron]: Updating DH parameters 2019.12.01 14:01:37 LOG7[main]: Found 1 ready file descriptor(s) 2019.12.01 14:01:37 LOG7[main]: FD=260 ifds=r-x ofds=--- 2019.12.01 14:01:37 LOG7[main]: Service [https] accepted (FD=420) from 127.0.0.1:56581 2019.12.01 14:01:37 LOG7[main]: Creating a new thread 2019.12.01 14:01:37 LOG7[main]: New thread created 2019.12.01 14:01:37 LOG7[0]: Service [https] started 2019.12.01 14:01:37 LOG5[0]: Service [https] accepted connection from 127.0.0.1:56581 2019.12.01 14:01:37 LOG7[0]: SSL state (accept): before/accept initialization 2019.12.01 14:01:37 LOG7[main]: Found 1 ready file descriptor(s) 2019.12.01 14:01:37 LOG7[main]: FD=260 ifds=r-x ofds=--- 2019.12.01 14:01:37 LOG7[main]: Service [https] accepted (FD=440) from 127.0.0.1:56582 2019.12.01 14:01:37 LOG7[main]: Creating a new thread 2019.12.01 14:01:37 LOG7[main]: New thread created 2019.12.01 14:01:37 LOG7[1]: Service [https] started 2019.12.01 14:01:37 LOG5[1]: Service [https] accepted connection from 127.0.0.1:56582 2019.12.01 14:01:37 LOG7[1]: SSL state (accept): before/accept initialization 2019.12.01 14:01:37 LOG3[0]: SSL_accept: 1407609C: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request 2019.12.01 14:01:37 LOG5[0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2019.12.01 14:01:37 LOG7[0]: Local descriptor (FD=420) closed 2019.12.01 14:01:37 LOG7[0]: Service [https] finished (1 left) 2019.12.01 14:01:37 LOG3[1]: SSL_accept: 1407609C: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request 2019.12.01 14:01:37 LOG5[1]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2019.12.01 14:01:37 LOG7[1]: Local descriptor (FD=440) closed 2019.12.01 14:01:37 LOG7[1]: Service [https] finished (0 left) 2019.12.01 14:01:37 LOG7[main]: Found 1 ready file descriptor(s) 2019.12.01 14:01:37 LOG7[main]: FD=260 ifds=r-x ofds=--- 2019.12.01 14:01:37 LOG7[main]: Service [https] accepted (FD=448) from 127.0.0.1:56583 2019.12.01 14:01:37 LOG7[main]: Creating a new thread 2019.12.01 14:01:37 LOG7[main]: New thread created 2019.12.01 14:01:37 LOG7[2]: Service [https] started 2019.12.01 14:01:37 LOG5[2]: Service [https] accepted connection from 127.0.0.1:56583 2019.12.01 14:01:37 LOG7[2]: SSL state (accept): before/accept initialization 2019.12.01 14:01:37 LOG3[2]: SSL_accept: 1407609C: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request 2019.12.01 14:01:37 LOG5[2]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2019.12.01 14:01:37 LOG7[2]: Local descriptor (FD=448) closed 2019.12.01 14:01:37 LOG7[2]: Service [https] finished (0 left) 2019.12.01 14:01:37 LOG7[main]: Found 1 ready file descriptor(s) 2019.12.01 14:01:37 LOG7[main]: FD=260 ifds=r-x ofds=--- 2019.12.01 14:01:37 LOG7[main]: Service [https] accepted (FD=452) from 127.0.0.1:56584 2019.12.01 14:01:37 LOG7[main]: Creating a new thread 2019.12.01 14:01:37 LOG7[main]: New thread created 2019.12.01 14:01:37 LOG7[3]: Service [https] started 2019.12.01 14:01:37 LOG5[3]: Service [https] accepted connection from 127.0.0.1:56584 2019.12.01 14:01:37 LOG7[3]: SSL state (accept): before/accept initialization 2019.12.01 14:01:37 LOG3[3]: SSL_accept: 1407609C: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request 2019.12.01 14:01:37 LOG5[3]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2019.12.01 14:01:37 LOG7[3]: Local descriptor (FD=452) closed 2019.12.01 14:01:37 LOG7[3]: Service [https] finished (0 left) Thanks in advance.

2 1

SMTP out via Comcast stopped working
by Carlos Rodriguez 30 Nov '19

30 Nov '19

All: I have had this setup working fine since Comcast blocked port 25 and recently stopped working. This is a MS Small Business Server 2003 with Exchange, I know, old and obsolete but I would like to keep it working until I migrate to Linux. Anyway, right now I also have my desktop, Win10, using the same SMTP settings for the Acronis backup event results and it can send me emails just fine, just tested this. So it is not my firewall or Comcast. I'm missing something in the settings of stunnel. Below are my settings and log file. Any suggestions will be appreciated. Carlos taskbar = yes [SSLsmtp] client = yes accept = localhost:555 connect = smtp.comcast.net:587 protocol = smtp CAfile = ca-certs.pem protocolUsername = verifiedusername protocolPassword = verifiedpassword debug = 7 ================================================ 2019.11.29 16:31:24 LOG5[main]: stunnel 5.49 on x86-pc-msvc-1500 platform 2019.11.29 16:31:24 LOG5[main]: Compiled/running with OpenSSL 1.0.2p-fips 14 Aug 2018 2019.11.29 16:31:24 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2019.11.29 16:31:24 LOG5[main]: Reading configuration from file stunnel.conf 2019.11.29 16:31:24 LOG5[main]: UTF-8 byte order mark detected 2019.11.29 16:31:24 LOG5[main]: FIPS mode disabled 2019.11.29 16:31:26 LOG4[main]: Service [SSLsmtp] needs authentication to prevent MITM attacks 2019.11.29 16:31:26 LOG5[main]: Configuration successful 2019.11.29 16:34:12 LOG7[0]: Service [SSLsmtp] started 2019.11.29 16:34:12 LOG7[0]: Setting local socket options (FD=264) 2019.11.29 16:34:12 LOG7[0]: Option TCP_NODELAY set on local socket 2019.11.29 16:34:12 LOG5[0]: Service [SSLsmtp] accepted connection from 127.0.0.1:1268 2019.11.29 16:34:12 LOG6[0]: s_connect: connecting 96.114.157.81:587 2019.11.29 16:34:12 LOG7[0]: s_connect: s_poll_wait 96.114.157.81:587: waiting 10 seconds 2019.11.29 16:34:12 LOG5[0]: s_connect: connected 96.114.157.81:587 2019.11.29 16:34:12 LOG5[0]: Service [SSLsmtp] connected remote server from 10.10.10.99:1269 2019.11.29 16:34:12 LOG7[0]: Setting remote socket options (FD=288) 2019.11.29 16:34:12 LOG7[0]: Option TCP_NODELAY set on remote socket 2019.11.29 16:34:12 LOG7[0]: Remote descriptor (FD=288) initialized 2019.11.29 16:34:12 LOG7[0]: <- 220 resomta-po-02v.sys.comcast.net resomta-po-02v.sys.comcast.net ESMTP server ready 2019.11.29 16:34:12 LOG7[0]: -> 220 resomta-po-02v.sys.comcast.net resomta-po-02v.sys.comcast.net ESMTP server ready 2019.11.29 16:34:12 LOG7[0]: -> EHLO localhost 2019.11.29 16:34:12 LOG7[0]: <- 250-resomta-po-02v.sys.comcast.net hello [71.206.38.109], pleased to meet you 2019.11.29 16:34:12 LOG7[0]: <- 250-HELP 2019.11.29 16:34:12 LOG7[0]: <- 250-SIZE 36700160 2019.11.29 16:34:12 LOG7[0]: <- 250-ENHANCEDSTATUSCODES 2019.11.29 16:34:12 LOG7[0]: <- 250-8BITMIME 2019.11.29 16:34:12 LOG7[0]: <- 250-STARTTLS 2019.11.29 16:34:12 LOG7[0]: <- 250 OK 2019.11.29 16:34:12 LOG7[0]: -> STARTTLS 2019.11.29 16:34:12 LOG7[0]: <- 220 2.0.0 Ready to start TLS 2019.11.29 16:34:12 LOG6[0]: SNI: sending servername: smtp.comcast.net 2019.11.29 16:34:12 LOG6[0]: Peer certificate not required 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): before/connect initialization 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv2/v3 write client hello A 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 read server hello A 2019.11.29 16:34:12 LOG6[0]: Certificate verification disabled 2019.11.29 16:34:12 LOG6[0]: Certificate verification disabled 2019.11.29 16:34:12 LOG6[0]: Certificate verification disabled 2019.11.29 16:34:12 LOG6[0]: Certificate verification disabled 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 read server certificate A 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 read server key exchange A 2019.11.29 16:34:12 LOG6[0]: Client certificate not requested 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 read server done A 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 write client key exchange A 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 write change cipher spec A 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 write finished A 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 flush data 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 read server session ticket A 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 read finished A 2019.11.29 16:34:12 LOG7[0]: New session callback 2019.11.29 16:34:12 LOG7[0]: Peer certificate was cached (6814 bytes) 2019.11.29 16:34:12 LOG6[0]: Session id: 11C16B28FFB4A3A4EDC164CA65C3F20A896BF61C4D3B09F571E4285CFD0C82B3 2019.11.29 16:34:12 LOG7[0]: 1 client connect(s) requested 2019.11.29 16:34:12 LOG7[0]: 1 client connect(s) succeeded 2019.11.29 16:34:12 LOG7[0]: 0 client renegotiation(s) requested 2019.11.29 16:34:12 LOG7[0]: 0 session reuse(s) 2019.11.29 16:34:12 LOG6[0]: TLS connected: new session negotiated 2019.11.29 16:34:12 LOG6[0]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2019.11.29 16:34:12 LOG7[0]: Compression: null, expansion: null 2019.11.29 16:34:12 LOG7[0]: -> AUTH PLAIN AGNhcmxvc3JyQGNvbWNhc3QubmV0AFNveTFjYXJpZHVybw== 2019.11.29 16:34:12 LOG7[0]: <- 500 command unrecognized 2019.11.29 16:34:12 LOG3[0]: PLAIN Authentication Failed 2019.11.29 16:34:12 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2019.11.29 16:34:12 LOG7[0]: Remote descriptor (FD=288) closed 2019.11.29 16:34:12 LOG7[0]: Local descriptor (FD=264) closed 2019.11.29 16:34:12 LOG7[0]: Service [SSLsmtp] finished (0 left)

2 1

undefined reference to `CRYPTO_set_id_callback'
by Somchai Smythe 29 Nov '19

29 Nov '19

How do I fix this? gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/include -DLIBDIR='"/usr/lib/stunnel"' -DCONFDIR='"/etc/stunnel"' -O3 -m64 -march=x86-64 -mtune=generic -pipe -std=gnu17 -pthread -Wall -Wextra -Wpedantic -Wformat=2 -Wconversion -Wno-long-long -Wno-deprecated-declarations -fPIE -fstack-protector -D_FORTIFY_SOURCE=2 -MT stunnel-sthreads.o -MD -MP -MF .deps/stunnel-sthreads.Tpo -c -o stunnel-sthreads.o `test -f 'sthreads.c' || echo './'`sthreads.c sthreads.c: In function 'thread_id_init': sthreads.c:116:5: warning: implicit declaration of function 'CRYPTO_set_id_callback'; did you mean 'CRYPTO_set_locking_callback'? [-Wimplicit-function-declaration] 116 | CRYPTO_set_id_callback(stunnel_thread_id); | ^~~~~~~~~~~~~~~~~~~~~~ | CRYPTO_set_locking_callback ... libtool: link: ( cd ".libs" && rm -f "libstunnel.la" && ln -s "../libstunnel.la" "libstunnel.la" ) /usr/lib/gcc/x86_64-pc-linux-gnu/9.2.0/../../../../x86_64-pc-linux-gnu/bin/ld: stunnel-sthreads.o: in function `sthreads_init': sthreads.c:(.text+0xb0): undefined reference to `CRYPTO_set_id_callback' /usr/lib/gcc/x86_64-pc-linux-gnu/9.2.0/../../../../x86_64-pc-linux-gnu/bin/ld: stunnel-sthreads.o: in function `thread_id_init': sthreads.c:(.text+0x3a): undefined reference to `CRYPTO_set_id_callback' collect2: error: ld returned 1 exit status make[2]: *** [Makefile:550: stunnel] Error 1 I'm using openssl-1.1.1d if it matters.

2 4

"Address already in use" error
by Phil Smith III 25 Nov '19

25 Nov '19

Rebooted (Windows 7, fully patched) today and stunnel wouldn't start, said "Address already in use". Hmm.nothing much has changed. Rebooted again, same. Tinkered a bit, didn't see anything that looked meaningful. Went to look at deleted digests of this list, saw new version out, installed that, now it's happy. So.a mystery, at least to me; posting in case it helps someone else! .phsiii

1 0

segfault with v5.55
by Francois Robinette 22 Nov '19

22 Nov '19

I've seen other having the same issue without resolution so far... But we do have the same issue: stunnel[7886]: segfault at 21 ip 00007f70aa1efcea sp 00007f6fa7797978 error 6 in libpthread-2.12.so[7f70aa1e5000+17000]

2 4

Windows 10 stunnel does not accept options
by Clodoaldo Neto 22 Nov '19

22 Nov '19

Any option I try in stunnel 5.55 results the same. Say: PS C:\Program Files (x86)\stunnel\bin> .\stunnel \path\to\config\file [ ] Running on Windows 6.2 [ ] No limit detected for the number of clients [.] stunnel 5.55 on x64-pc-mingw32-gnu platform [.] Compiled/running with OpenSSL 1.1.1c 28 May 2019 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] GUI message loop initialized [ ] Running on Windows 6.2 [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark detected [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [ssh] [ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK [ ] TLSv1.3 ciphersuites: TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256 [ ] TLS options: 0x02100004 (+0x00000000, -0x00000000) [ ] No certificate or private key specified [:] Service [ssh] needs authentication to prevent MITM attacks [ ] Initializing service [gmail-imap] [!] Service [gmail-imap]: TLS server needs a certificate [ ] Deallocating section defaults [!] Server is down Same with PS C:\Program Files (x86)\stunnel\bin> .\stunnel nonexistent or PS C:\Program Files (x86)\stunnel\bin> .\stunnel -help Regards, Clodoaldo

1 0

Re: [stunnel-users] Stunnel traffic fails to go via proxy set in
by Andrew Krause 11 Nov '19

11 Nov '19

Hi Jai, If your proxy supports the HTTP CONNECT method, you can try revising your settings to this: [KG_Self-Checkout] key = client.pem cert = client.pem client = yes accept = 127.0.0.1:5001 connect = wproxy.qut.edu.au:3128 protocolHost = ap01.alma.exlibrisgroup.com:6443 TIMEOUTclose = 0 TIMEOUTconnect = 200 TIMEOUTidle = 86400 sslVersion = TLSv1.2 protocol = connect Only the connect protocol supports using the protocolHost option. If this isn't supported by your proxy, you can try using Privoxy or Polipo between stunnel and your proxy. Socat is another option as well. Andrew Krause Schaumburg Township District Library -----Original Message----- At QUT Library we use Stunnel to encrypt SIP2 (ie. book borrowing) traffic from the self-checkout machines through to the Alma library services platform (as per https://developers.exlibrisgroup.com/alma/integrations/stunnel/ ) Our self-checkout machines run Windows 10 and are allowed limited internet access to two hosts (cloud.fetechgroup.com and ap01.alma.exlibrisgroup.com) via our institution's Squid proxy and I have our current WinHTTP proxy settings: Proxy Server(s) : wproxy.qut.edu.au:3128 Bypass List : *.qut.edu.au The proxy server settings are set for all protocols (HTTP, HTTPS, secure and FTP) and I've confirmed that web browser and the FE Technologies software is routing via wproxy.qut.edu.au. However Stunnel is still trying to connect to Alma directly. Our stunnel.conf is as follows (just FYI, the FE Tech software points to 127.0.0.1:5001 as our library services platform address): [KG_Self-Checkout] key = client.pem cert = client.pem client = yes accept = 127.0.0.1:5001 connect = ap01.alma.exlibrisgroup.com:6443 TIMEOUTclose = 0 TIMEOUTconnect = 200 TIMEOUTidle = 86400 sslVersion = TLSv1.2 Is there a way to force Stunnel to either respect the WinHTTP settings or configure it to route traffic to wproxy.qut.edu.au:3128 before initiating the connect = hostname:port? I did try protocolHost as follows, but I'm probably misunderstanding how it works https://www.stunnel.org/static/stunnel.html#SERVICE-LEVEL-OPTIONS [KG_Self-Checkout] key = client.pem cert = client.pem client = yes accept = 127.0.0.1:5001 connect = wproxy.qut.edu.au:3128 protocolHost = ap01.alma.exlibrisgroup.com:6443 TIMEOUTclose = 0 TIMEOUTconnect = 200 TIMEOUTidle = 86400 sslVersion = TLSv1.2 Any advice or assistance gratefully accepted, and apologies if this is a silly question - I'm just a librarian trying to make this thing work. Thanks, Jai Parker | Information Access Librarian QUT Library | Division of Administrative Services QUT | Kelvin Grove | D Block, Level 1 | Victoria Park Rd Kelvin Grove QLD 4059 P: 07 3138 3381 | E: lib.infoaccess at qut.edu.au<mailto:lib.infoaccess at qut.edu.au> | www.qut.edu.au<http://www.qut.edu.au/> ABN: 83 791 724 622 | CRICOS No. 00213J

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 184, Issue 4
by Brent Kimberley 08 Nov '19

08 Nov '19

From: Mark Brookes <mark(a)loadbalancer.org> To: Francois Robinette <frobinette(a)hotmail.com> >> OpenSSL 1.1.0k x Stunnel interaction... See tag 5.56b1Thanks. Can't find the 5.56b1 tag. Is it on a fork?https://github.com/mtrojnar/stunnel/network/members BTW. I had difficulty linking stunnel-5.56 (static) with OpenSSL 1.1.1d (static) as well. >> The stunnel guys have worked tirelessly to get this resolved. Its an >> interaction of openssl 1.1.0k and Stunnel. I think essentially openssl >> is doing something strange. They came up with a fix and its currently>> in the https://www.stunnel.org/downloads/beta/stunnel-5.56b1.tar.gz >> beta. You should give it a try and see if its resolves your issue. On Thu, 7 Nov 2019 at 19:36, Francois Robinette <frobinette(a)hotmail.com> wrote: > > I've seen other having the same issue without resolution so far... > But we do have the same issue: > > stunnel[7886]: segfault at 21 ip 00007f70aa1efcea sp 00007f6fa7797978 error 6 in libpthread-2.12.so[7f70aa1e5000+17000] >

1 0

Stunnel traffic fails to go via proxy set in winhttp (Windows 10)
by Library Information Access Team 06 Nov '19

06 Nov '19

At QUT Library we use Stunnel to encrypt SIP2 (ie. book borrowing) traffic from the self-checkout machines through to the Alma library services platform (as per https://developers.exlibrisgroup.com/alma/integrations/stunnel/ ) Our self-checkout machines run Windows 10 and are allowed limited internet access to two hosts (cloud.fetechgroup.com and ap01.alma.exlibrisgroup.com) via our institution's Squid proxy and I have our current WinHTTP proxy settings: Proxy Server(s) : wproxy.qut.edu.au:3128 Bypass List : *.qut.edu.au The proxy server settings are set for all protocols (HTTP, HTTPS, secure and FTP) and I've confirmed that web browser and the FE Technologies software is routing via wproxy.qut.edu.au. However Stunnel is still trying to connect to Alma directly. Our stunnel.conf is as follows (just FYI, the FE Tech software points to 127.0.0.1:5001 as our library services platform address): [KG_Self-Checkout] key = client.pem cert = client.pem client = yes accept = 127.0.0.1:5001 connect = ap01.alma.exlibrisgroup.com:6443 TIMEOUTclose = 0 TIMEOUTconnect = 200 TIMEOUTidle = 86400 sslVersion = TLSv1.2 Is there a way to force Stunnel to either respect the WinHTTP settings or configure it to route traffic to wproxy.qut.edu.au:3128 before initiating the connect = hostname:port? I did try protocolHost as follows, but I'm probably misunderstanding how it works https://www.stunnel.org/static/stunnel.html#SERVICE-LEVEL-OPTIONS [KG_Self-Checkout] key = client.pem cert = client.pem client = yes accept = 127.0.0.1:5001 connect = wproxy.qut.edu.au:3128 protocolHost = ap01.alma.exlibrisgroup.com:6443 TIMEOUTclose = 0 TIMEOUTconnect = 200 TIMEOUTidle = 86400 sslVersion = TLSv1.2 Any advice or assistance gratefully accepted, and apologies if this is a silly question - I'm just a librarian trying to make this thing work. Thanks, Jai Parker | Information Access Librarian QUT Library | Division of Administrative Services QUT | Kelvin Grove | D Block, Level 1 | Victoria Park Rd Kelvin Grove QLD 4059 P: 07 3138 3381 | E: lib.infoaccess(a)qut.edu.au<mailto:[email protected]> | www.qut.edu.au<http://www.qut.edu.au/> ABN: 83 791 724 622 | CRICOS No. 00213J

1 0

Re: [stunnel-users] Extensions when negotiating TLS
by Christopher Schultz 05 Nov '19

05 Nov '19

Tom, On 11/4/19 17:59, Tom (AST) Watson wrote: > Trying to make the applications want to talk http/1.1 isn't going to > be easy. Both sides (app#1 and app#2) want to talk http2 (*SIGH*). Understood. > I was just hoping stunnel might work. Presently it looks like it > won't so I am looking at alternatives. Part of the object is to look > at the various transactions over the wire (many!) and they are lots. > I assume that is why http2 is used, and I have no influence over > that decision. From the looks of it, making app#2 unencrypted is the > best path. Boo! > It is written in GO, and has little comments to describe things (such > is life!). I think I'm a bit closer to a solution, but if stunnel > can be made to work (ALPN support) it would be nice. Looks like I'll > have to wait. Why isn't it an option to enable encryption directly on the service? It seems like using stunnel should be your last resort. -chris > -----Original Message----- > From: stunnel-users <stunnel-users-bounces(a)stunnel.org> On Behalf Of Christopher Schultz > > Tom, > > On 11/4/19 17:16, Tom (AST) Watson wrote: >> Yes, I understand about ALPN. Sorry I described in detail. >> Unfortunately application #2 wants encrypted http2 (it is a go >> program). Application #1 wants to talk in http2 (I can't change >> that!) and it doesn't encrypt "naturally" (and I want to see what is >> going on [Wireshark] as well) In looking further I might be able to >> get application #2 to go plaintext (I found a pointer). Yes, it seems >> that stunnel doesn't support ALPN, wishful thinking on my part >> >> Back to the salt mines. (*SIGH*) > > How difficult would it be to enable HTTP/1.1 on that application #1? > I've never seen an h2-only service before. h2 is more effective for web applications that make a lot of tiny requests (like small resources for pages, scripts, etc.). Most API-based services don't really get any benefit from using h2. > > -chris > >> -----Original Message----- From: stunnel-users >> <stunnel-users-bounces(a)stunnel.org> On Behalf Of Christopher Schultz >> Sent: Monday, November 4, 2019 13:59 To: stunnel-users(a)stunnel.org >> Subject: [External] Re: [stunnel-users] Extensions when negotiating >> TLS >> >> Tom, >> >> On 11/4/19 16:05, Tom (AST) Watson wrote: >>> Well, I thought it would be "easy", but maybe not. I have an >>> application (#1) that uses http2, and isn't encrypted. No problem >>> here. Now I have another application (#2) that insists on using >>> https to talk to application #1. So I gleefully setup stunnel to >>> connect the two. Well, application #2 starts talking to stunnel with >>> a "Client Hello" packet, and it includes an extension "Application >>> Layer Protocol Extension" of "h2". >> >> This is called ALPN, and is a requirement for h2s. >> >>> While not versed in the minutia, I take this that the client >>> (application #2) wants to talk "http2" to the server (application >>> #1). >> >> Yep, pretty much. >> >>> OK, that is what I want. The problem is that stunnel doesn't respond >>> with ANY "Application Layer Protocol Extension" indicating acceptance >>> of this request in its "server hello". This means that application >>> #2 fails in its negotiation. No joy! >>> >>> Now I know that application #1 will nicely talk http2, but how do I >>> get stunnel to communicate this to application #2 (as encrypted >>> http2). Am I missing something in my (pretty simple) configuration >>> file? >> >> I can't find any references to stunnel supporting ALPN. You may be >> (temporarily) out of luck, at least with stunnel. >> >> You mentioned that app #2 insists on encryption (great, usually). Is >> there a requirement that it use h2? Or can it be configured to use >> HTTP/1.1? >> >> -chris >> >

2 1

Re: [stunnel-users] Extensions when negotiating TLS
by Christopher Schultz 04 Nov '19

04 Nov '19

Tom, On 11/4/19 17:16, Tom (AST) Watson wrote: > Yes, I understand about ALPN. Sorry I described in detail. > Unfortunately application #2 wants encrypted http2 (it is a go > program). Application #1 wants to talk in http2 (I can't change > that!) and it doesn't encrypt "naturally" (and I want to see what is > going on [Wireshark] as well) In looking further I might be able to > get application #2 to go plaintext (I found a pointer). Yes, it seems > that stunnel doesn't support ALPN, wishful thinking on my part > > Back to the salt mines. (*SIGH*) How difficult would it be to enable HTTP/1.1 on that application #1? I've never seen an h2-only service before. h2 is more effective for web applications that make a lot of tiny requests (like small resources for pages, scripts, etc.). Most API-based services don't really get any benefit from using h2. -chris > -----Original Message----- From: stunnel-users > <stunnel-users-bounces(a)stunnel.org> On Behalf Of Christopher Schultz > Sent: Monday, November 4, 2019 13:59 To: stunnel-users(a)stunnel.org > Subject: [External] Re: [stunnel-users] Extensions when negotiating > TLS > > Tom, > > On 11/4/19 16:05, Tom (AST) Watson wrote: >> Well, I thought it would be "easy", but maybe not. I have an >> application (#1) that uses http2, and isn't encrypted. No problem >> here. Now I have another application (#2) that insists on using >> https to talk to application #1. So I gleefully setup stunnel to >> connect the two. Well, application #2 starts talking to stunnel >> with a "Client Hello" packet, and it includes an extension >> "Application Layer Protocol Extension" of "h2". > > This is called ALPN, and is a requirement for h2s. > >> While not versed in the minutia, I take this that the client >> (application #2) wants to talk "http2" to the server (application >> #1). > > Yep, pretty much. > >> OK, that is what I want. The problem is that stunnel doesn't >> respond with ANY "Application Layer Protocol Extension" indicating >> acceptance of this request in its "server hello". This means that >> application #2 fails in its negotiation. No joy! >> >> Now I know that application #1 will nicely talk http2, but how do I >> get stunnel to communicate this to application #2 (as encrypted >> http2). Am I missing something in my (pretty simple) configuration >> file? > > I can't find any references to stunnel supporting ALPN. You may be > (temporarily) out of luck, at least with stunnel. > > You mentioned that app #2 insists on encryption (great, usually). Is > there a requirement that it use h2? Or can it be configured to use > HTTP/1.1? > > -chris >

1 0

Extensions when negotiating TLS
by Tom (AST) Watson 04 Nov '19

04 Nov '19

Well, I thought it would be "easy", but maybe not. I have an application (#1) that uses http2, and isn't encrypted. No problem here. Now I have another application (#2) that insists on using https to talk to application #1. So I gleefully setup stunnel to connect the two. Well, application #2 starts talking to stunnel with a "Client Hello" packet, and it includes an extension "Application Layer Protocol Extension" of "h2". While not versed in the minutia, I take this that the client (application #2) wants to talk "http2" to the server (application #1). OK, that is what I want. The problem is that stunnel doesn't respond with ANY "Application Layer Protocol Extension" indicating acceptance of this request in its "server hello". This means that application #2 fails in its negotiation. No joy! Now I know that application #1 will nicely talk http2, but how do I get stunnel to communicate this to application #2 (as encrypted http2). Am I missing something in my (pretty simple) configuration file? Thanks. -- Tom Watson (I'm at work now) Thomas.3.watson(a)raytheon.com

2 1

Debian 9 static build
by Chris Maciejewski 01 Nov '19

01 Nov '19

Hello, I am trying to build stunnel 5.55 on Debian 9 x64 statistically against latest OpenSSL build from source. The system already has openssl and libssl ver. 1.1.1b installed via apt-get , but I want to build against OpenSSL 1.1.1d instead. What I do is: 1. Build and install OpenSSL: $ cd /usr/src/openssl-1.1.1d $ ./config -fPIC --prefix=/opt/openssl $ make depend && make && make install 2. Build and install Stunnel $ cd /usr/src/stunnel-5.55 $ ./configure --with-ssl=/opt/openssl --enable-static $ make && make install Both 1 and 2 completes OK with no errors, however when I run: $ /usr/local/bin/stunnel [.] Compiled with OpenSSL 1.1.1d 10 Sep 2019 [.] Running with OpenSSL 1.1.1b 26 Feb 2019 .... and indeed when I do: $ ldd /usr/local/bin/stunnel libssl.so.1.1 => /usr/lib/x86_64-linux-gnu/libssl.so.1.1 (0x00007f1083b4f000) libcrypto.so.1.1 => /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1 (0x00007f1083668000) above shows dynamic .so libs are used, rather than static libs libssl.a and libcrypto.a Any suggestions as to what is wrong with my process above and how to make static build of Stunnel to use non-system OpenSSL very much appreciated. Kind regards, Chris

2 1

Re: [stunnel-users] stunnel-users Digest, Vol 183, Issue 4
by Brent Kimberley 26 Oct '19

26 Oct '19

Chris.Does this help? https://stackoverflow.com/questions/40454338/no-shared-cipher-at-ssl-accept… If you can rule out libraries like OpenSSL, then look at your config + initial setup exchange. Date: Fri, 25 Oct 2019 11:11:54 -0400 From: Christopher Schultz <chris(a)christopherschultz.net> Subject: Re: [stunnel-users] Strange connection failure in one environmentOn 10/25/19 10:09, Christopher Schultz wrote: > All, > > I've been using stunnel in two environments (dev, prod) for a long time > without any problems. Recently, my dev environment started acting funny > and I can't connect to it from outside the box. > > Can someone take a look and let me know if you have any suggestions for > where to look for a problem? > > Both environments have the following things in common: > > 1. Hosted in Amazon EC2, no load-balancer in the way > 2. Configuration requires client-certificate to connect > 3. All certificates are valid, self-signed, and properly-trusted by both > sides > 4. TLS configuration has been locked-down to TLSv1.2, selected cipher > suites, FIPS mode=off > 5. All versions are the same: stunnel 4.56 w/OpenSSL 1.0.2k-fips > > The production (working) environment happens to be i686 and the > development environment happens to be x86-86, but I don't believe that > is relevant. > > When I use e.g. "openssl s_client" to connect to the production > environment and I *do not* provide a client certificate, I am able to > perform the initial TLS handshake, get a cipher suite negotiated, etc. > and then the connection fails because I didn't provide the client > certificate, of course. I *can* see in the handshake the list of allowed > client certificates. > > When I do the same in development, I get a handshake failure. No allowed > client certificates are shown. No nothing. > > If I connect on localhost to the dev server, I get what I'm expecting: > allowed client certificates are listed, connection is closed because I'm > not using the client certificate. Connecting from another host gets my a > handshake failure. > > Again, there are no load-balancers or anything between the outside and > the EC2 instance. I'm connecting as directly as it's possible to > connect. The box definitely allows incoming connections on the port I'm > trying to use; the AWS security group is configured correctly. > > I have tried dropping ALL security configuration on the dev server's > stunnel.conf such as client-cert requirements, TLS protocols, cipher > suites, etc. and I get the same behavior every time. I'm starting to > think that it has nothing to do with my stunnel.conf configuration at > all, but I'm at a loss as to where to look, next. > > Any ideas? Some more information: 0. The error I get on the client is "handshake failure" and the stunnel server drops this log message: SSL_accept: 1408A0C1: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher Note that I have disabled all but TLSv1.2 on the server. Removing this restriction does not change the behavior. 1. I have multiple stunnel configuration files on this server. Actually, I have 4 of them. Connections to ports defined in 2 of these files are not connecting successfully. Connections to ports defined in the OTHER two files *are* connecting successfully. The configurations seem to follow a pattern: those using RSA certificates as the server-certificate are working as expected, while those with EC server-certificate are failing. When I say "working" versus "failing", I mean that this command will give me a cipher suite and master key, but still drop the connection because I'm not providing a client-certificate for these tests: $ openssl s_client -connect host:port 2. I have a Java-based service that *is* able to connect through this stunnel instance just fine. It's running on a recent version of Java 8. My CLI client (not OpenSSL) is also running the same version. My CLI client cannot connect. *weird* In both cases, I am using EC client certificates, but the certificates are different from each other. Both of these certificates are trusted by the server. 3. When using OpenSSL 1.0.2t, I *can* connect, get the list of acceptable client certificates, etc. even without providing a client certificate. When using OpenSSL 1.1.1d, I can *not* connect. So perhaps the inside/outside networking thing I was thinking the problem might be is incorrect. AFAIK, both versions of OpenSSL should be able to use EC certificates and cipher suites. Thanks, -chris

1 0

Strange connection failure in one environment
by Christopher Schultz 25 Oct '19

25 Oct '19

All, I've been using stunnel in two environments (dev, prod) for a long time without any problems. Recently, my dev environment started acting funny and I can't connect to it from outside the box. Can someone take a look and let me know if you have any suggestions for where to look for a problem? Both environments have the following things in common: 1. Hosted in Amazon EC2, no load-balancer in the way 2. Configuration requires client-certificate to connect 3. All certificates are valid, self-signed, and properly-trusted by both sides 4. TLS configuration has been locked-down to TLSv1.2, selected cipher suites, FIPS mode=off 5. All versions are the same: stunnel 4.56 w/OpenSSL 1.0.2k-fips The production (working) environment happens to be i686 and the development environment happens to be x86-86, but I don't believe that is relevant. When I use e.g. "openssl s_client" to connect to the production environment and I *do not* provide a client certificate, I am able to perform the initial TLS handshake, get a cipher suite negotiated, etc. and then the connection fails because I didn't provide the client certificate, of course. I *can* see in the handshake the list of allowed client certificates. When I do the same in development, I get a handshake failure. No allowed client certificates are shown. No nothing. If I connect on localhost to the dev server, I get what I'm expecting: allowed client certificates are listed, connection is closed because I'm not using the client certificate. Connecting from another host gets my a handshake failure. Again, there are no load-balancers or anything between the outside and the EC2 instance. I'm connecting as directly as it's possible to connect. The box definitely allows incoming connections on the port I'm trying to use; the AWS security group is configured correctly. I have tried dropping ALL security configuration on the dev server's stunnel.conf such as client-cert requirements, TLS protocols, cipher suites, etc. and I get the same behavior every time. I'm starting to think that it has nothing to do with my stunnel.conf configuration at all, but I'm at a loss as to where to look, next. Any ideas? -chris

1 1

ssl offloading with stunnel
by simona vittori 23 Oct '19

23 Oct '19

Hello,Is it possible to have the following architecture with stunnel? stunnel client --> balancer --> db server Balancer doesn't have stunnel product installed on it. It receives encrypted packages from stunnel client and redirect clear traffico to DB server. Is it possible to realize this configuration? Thank a lot. Regards Simona

1 0

stunnel : user identification in mutual auth
by Denis Polushin 22 Oct '19

22 Oct '19

Hi All, Haven't found the answer for this issue. The scheme is : TLS-client <==tls==> stunnel-server <==open==> App-server In user session stunnel-server perform authorization for client with its certificate (verify=2) and send request further to App-server. How does App-server can identify user in this session? To grand permissions. Ideally it would be good to know CN or EKU of user certificate. Is it possible? Thanks a lot!! Denis

1 0

segfault with v5.55
by Mark Brookes 30 Sep '19

30 Sep '19

We are currently experiencing a segfault with version 5.55 openssl version 1.1.0k and are trying to narrow down what the issue may be. The first 2 segfaults are about 10 mins apart. The below is from the stunnel log just before and then after the event. Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77582]: TLS state (accept): SSLv3/TLS write finished Sep 23 11:47:31 xxxx stunnel: LOG7[77582]: TLS state (accept): SSLv3/TLS read change cipher spec Sep 23 11:47:31 xxxx stunnel: LOG7[77582]: TLS state (accept): SSLv3/TLS read finished Sep 23 11:47:31 xxxx stunnel: LOG7[77580]: TLS state (accept): SSLv3/TLS write finished Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Deallocating application specific data for session connect address Sep 23 11:47:31 xxxx stunnel: LOG7[77581]: Remove session callback Sep 23 11:52:58 xxxx stunnel: LOG7[ui]: Clients allowed=62937 Sep 23 11:52:58 xxxx stunnel: LOG5[ui]: stunnel 5.55 on x86_64-pc-linux-gnu platform Sep 23 11:52:58 xxxx stunnel: LOG5[ui]: Compiled/running with OpenSSL 1.1.0k 28 May 2019 Sep 23 11:52:58 xxxx stunnel: LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI Sep 23 11:52:58 xxxx stunnel: LOG7[ui]: errno: (*__errno_location ()) The following is from the kernel log. stunnel[31253]: segfault at 0 ip 00007f91214cacea sp 00007f91205ea9f8 error 6 in libpthread-2.12.so[7f91214c0000+17000] The kernel log after the second segfault- stunnel[1868]: segfault at 0 ip 00007f5b35398cea sp 00007f5b344c59f8 error 6 in libpthread-2.12.so[7f5b3538e000+17000] This is all the information we have at the moment. -- Mark Brookes Loadbalancer.org Ltd. www.loadbalancer.org +44 (0)330 380 1064 mark(a)loadbalancer.org

1 0

Re: [stunnel-users] stunnel with OpenSSL engine: reload leaks HSM connections
by Lynch, Andrew 27 Sep '19

27 Sep '19

I’ve been digging around the code and I am no longer sure whether stunnel is at fault or it is actually an issue in OpenSSL! load_key_engine() in ctx.c shoves the key into the SSL context – SSL_CTX_use_PrivateKey(section->ctx, pkey). So the key should be freed when that context is disposed of. The SIGHUP ends up in case SIGNAL_RELOAD_CONFIG of signal_pipe_dispatch(), which calls options_free() [stunnel.c line 830]. Eventually there is an SSL_CTX_free() call, but it looks like this does not actually free the private key. Ephemeral keys are freed and loads of other stuff, but not the private key associated with the certificate. I may try to build a hacked OpenSSL on Monday to see what happens if SSL_CTX_free also frees the private key… Regards, Andrew. From: Brent Kimberley [mailto:[email protected]] Sent: Friday, September 27, 2019 4:29 PM To: stunnel-users(a)stunnel.org; Lynch, Andrew Subject: Re: stunnel-users Digest, Vol 182, Issue 14 >> Over time, after numerous reloads of stunnel (kill -HUP) the HSM reports that its connection table is full. >> Logging from the engine shows that stunnel is never freeing the keys and therefore the engine is not closing the associated sessions with the HSM. Each stunnel reload opens 70 new sessions until eventually the HSM's configured limit is exceeded. Where does the signal dispatcher free keys on SIG_HUP? https://github.com/mtrojnar/stunnel/blob/master/src/stunnel.c Date: Fri, 27 Sep 2019 07:23:29 +0000 From: "Lynch, Andrew" <andrew.lynch(a)atos.net<mailto:[email protected]>> To: Eric Eberhard <flash(a)vicsmba.com<mailto:[email protected]>> Cc: "stunnel-users(a)stunnel.org<mailto:[email protected]>" <stunnel-users(a)stunnel.org<mailto:[email protected]>> Subject: Re: [stunnel-users] stunnel with OpenSSL engine: reload leaks HSM connections Hi Eric, Thank you for your suggestion. It is certainly worth looking into, although I suspect it may be impractical in our environment. Now we have a single stunnel.conf with 70 services which would translate into 70 additional entries in inetd.conf. Each of those entries then needs to have its own reduced stunnel.conf so that it will only load the cert and key for its endpoint. The stunnel HOWTO recommends daemon mode over inetd mode due to the overhead for forking and SSL initialization. We would have additional overhead for engine init and HSM connection. Regards, Andrew. -----Original Message----- From: Eric Eberhard [mailto:[email protected]<mailto:[email protected]>] Sent: Thursday, September 26, 2019 7:20 PM To: Lynch, Andrew; stunnel-users(a)stunnel.org<mailto:[email protected]> Subject: RE: [stunnel-users] stunnel with OpenSSL engine: reload leaks HSM connections? Try running in inetd mode -- even if you don't like this you will learn something. Inetd will close connections as needed. E -----Original Message----- From: stunnel-users [mailto:[email protected]<mailto:[email protected]>] On Behalf Of Lynch, Andrew Sent: Thursday, September 26, 2019 5:56 AM To: stunnel-users(a)stunnel.org<mailto:[email protected]> Subject: [stunnel-users] stunnel with OpenSSL engine: reload leaks HSM connections? Hi, We are using stunnel as a server to terminate incoming TLS connections. The config has around 70 services with certificates whose EC private keys are stored in an HSM and accessed using an OpenSSL engine. Over time, after numerous reloads of stunnel (kill -HUP) the HSM reports that its connection table is full. Logging from the engine shows that stunnel is never freeing the keys and therefore the engine is not closing the associated sessions with the HSM. Each stunnel reload opens 70 new sessions until eventually the HSM's configured limit is exceeded. This behaviour has been observed on Suse Enterprise Linux 12.3 with the system-provided stunnel-5.00-4.3.4, but I can reproduce it with my own build of the current version 5.55. Is this a known issue? It appears that other (ephemeral) keys are being freed, just not those associated with the service certificates. Currently our workaround is to perform a full restart instead of a reload. This closes all HSM sessions when the process terminates, but of course it also kills any open client connections so it can only be done during the scheduled maintenance windows. Regards, Andrew. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org<mailto:[email protected]> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users ------------------------------ Subject: Digest Footer _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org<mailto:[email protected]> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users ------------------------------ End of stunnel-users Digest, Vol 182, Issue 14 **********************************************

2 1

Re: [stunnel-users] stunnel-users Digest, Vol 182, Issue 14
by Eric Eberhard 27 Sep '19

27 Sep '19

I don’t suggest it as a final solution – although for me it works great and we have customers exchanging 2-4 million XML documents per day with no performance issues – BUT no matter what it is a good debugging tool. Inetd gets all the initial connections and closes them when done. It might or might or might not be involved with the HSM at all. You might also look at the process table (some form of ps) and grep for stunnel and relatives and see if they are hanging around. In theory, if a process dies, it “should” close it’s connections. If it is floating in space it will not. Inetd will kill the process – at least on Centos and AIX and SCO – for sure and for certain. E From: stunnel-users [mailto:[email protected]] On Behalf Of Brent Kimberley Sent: Friday, September 27, 2019 7:29 AM To: stunnel-users(a)stunnel.org; andrew.lynch(a)atos.net Subject: Re: [stunnel-users] stunnel-users Digest, Vol 182, Issue 14 >> Over time, after numerous reloads of stunnel (kill -HUP) the HSM reports that its connection table is full. >> Logging from the engine shows that stunnel is never freeing the keys and therefore the engine is not closing the associated sessions with the HSM. Each stunnel reload opens 70 new sessions until eventually the HSM's configured limit is exceeded. Where does the signal dispatcher free keys on SIG_HUP? https://github.com/mtrojnar/stunnel/blob/master/src/stunnel.c Date: Fri, 27 Sep 2019 07:23:29 +0000 From: "Lynch, Andrew" <andrew.lynch(a)atos.net <mailto:[email protected]> > To: Eric Eberhard <flash(a)vicsmba.com <mailto:[email protected]> > Cc: "stunnel-users(a)stunnel.org <mailto:[email protected]> " <stunnel-users(a)stunnel.org <mailto:[email protected]> > Subject: Re: [stunnel-users] stunnel with OpenSSL engine: reload leaks HSM connections Hi Eric, Thank you for your suggestion. It is certainly worth looking into, although I suspect it may be impractical in our environment. Now we have a single stunnel.conf with 70 services which would translate into 70 additional entries in inetd.conf. Each of those entries then needs to have its own reduced stunnel.conf so that it will only load the cert and key for its endpoint. The stunnel HOWTO recommends daemon mode over inetd mode due to the overhead for forking and SSL initialization. We would have additional overhead for engine init and HSM connection. Regards, Andrew. -----Original Message----- From: Eric Eberhard [mailto:[email protected] <mailto:[email protected]> ] Sent: Thursday, September 26, 2019 7:20 PM To: Lynch, Andrew; stunnel-users(a)stunnel.org <mailto:[email protected]> Subject: RE: [stunnel-users] stunnel with OpenSSL engine: reload leaks HSM connections? Try running in inetd mode -- even if you don't like this you will learn something. Inetd will close connections as needed. E -----Original Message----- From: stunnel-users [mailto:[email protected] <mailto:[email protected]> ] On Behalf Of Lynch, Andrew Sent: Thursday, September 26, 2019 5:56 AM To: stunnel-users(a)stunnel.org <mailto:[email protected]> Subject: [stunnel-users] stunnel with OpenSSL engine: reload leaks HSM connections? Hi, We are using stunnel as a server to terminate incoming TLS connections. The config has around 70 services with certificates whose EC private keys are stored in an HSM and accessed using an OpenSSL engine. Over time, after numerous reloads of stunnel (kill -HUP) the HSM reports that its connection table is full. Logging from the engine shows that stunnel is never freeing the keys and therefore the engine is not closing the associated sessions with the HSM. Each stunnel reload opens 70 new sessions until eventually the HSM's configured limit is exceeded. This behaviour has been observed on Suse Enterprise Linux 12.3 with the system-provided stunnel-5.00-4.3.4, but I can reproduce it with my own build of the current version 5.55. Is this a known issue? It appears that other (ephemeral) keys are being freed, just not those associated with the service certificates. Currently our workaround is to perform a full restart instead of a reload. This closes all HSM sessions when the process terminates, but of course it also kills any open client connections so it can only be done during the scheduled maintenance windows. Regards, Andrew. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org <mailto:[email protected]> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users ------------------------------ Subject: Digest Footer _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org <mailto:[email protected]> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users ------------------------------ End of stunnel-users Digest, Vol 182, Issue 14 **********************************************

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 182, Issue 14
by Brent Kimberley 27 Sep '19

27 Sep '19

>> Over time, after numerous reloads of stunnel (kill -HUP) the HSM reports that its connection table is full. >> Logging from the engine shows that stunnel is never freeing the keys and therefore the engine is not closing the associated sessions with the HSM. Each stunnel reload opens 70 new sessions until eventually the HSM's configured limit is exceeded. Where does the signal dispatcher free keys on SIG_HUP?https://github.com/mtrojnar/stunnel/blob/master/src/stunnel.c Date: Fri, 27 Sep 2019 07:23:29 +0000 From: "Lynch, Andrew" <andrew.lynch(a)atos.net> To: Eric Eberhard <flash(a)vicsmba.com> Cc: "stunnel-users(a)stunnel.org" <stunnel-users(a)stunnel.org> Subject: Re: [stunnel-users] stunnel with OpenSSL engine: reload leaks HSM connections Hi Eric, Thank you for your suggestion. It is certainly worth looking into, although I suspect it may be impractical in our environment. Now we have a single stunnel.conf with 70 services which would translate into 70 additional entries in inetd.conf. Each of those entries then needs to have its own reduced stunnel.conf so that it will only load the cert and key for its endpoint. The stunnel HOWTO recommends daemon mode over inetd mode due to the overhead for forking and SSL initialization. We would have additional overhead for engine init and HSM connection. Regards, Andrew. -----Original Message----- From: Eric Eberhard [mailto:[email protected]] Sent: Thursday, September 26, 2019 7:20 PM To: Lynch, Andrew; stunnel-users(a)stunnel.org Subject: RE: [stunnel-users] stunnel with OpenSSL engine: reload leaks HSM connections? Try running in inetd mode -- even if you don't like this you will learn something. Inetd will close connections as needed. E -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of Lynch, Andrew Sent: Thursday, September 26, 2019 5:56 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] stunnel with OpenSSL engine: reload leaks HSM connections? Hi, We are using stunnel as a server to terminate incoming TLS connections. The config has around 70 services with certificates whose EC private keys are stored in an HSM and accessed using an OpenSSL engine. Over time, after numerous reloads of stunnel (kill -HUP) the HSM reports that its connection table is full. Logging from the engine shows that stunnel is never freeing the keys and therefore the engine is not closing the associated sessions with the HSM. Each stunnel reload opens 70 new sessions until eventually the HSM's configured limit is exceeded. This behaviour has been observed on Suse Enterprise Linux 12.3 with the system-provided stunnel-5.00-4.3.4, but I can reproduce it with my own build of the current version 5.55. Is this a known issue? It appears that other (ephemeral) keys are being freed, just not those associated with the service certificates. Currently our workaround is to perform a full restart instead of a reload. This closes all HSM sessions when the process terminates, but of course it also kills any open client connections so it can only be done during the scheduled maintenance windows. Regards, Andrew. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users ------------------------------ Subject: Digest Footer _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users ------------------------------ End of stunnel-users Digest, Vol 182, Issue 14 **********************************************

1 0

Re: [stunnel-users] stunnel with OpenSSL engine: reload leaks HSM connections?
by Eric Eberhard 27 Sep '19

27 Sep '19

Try running in inetd mode -- even if you don't like this you will learn something. Inetd will close connections as needed. E -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of Lynch, Andrew Sent: Thursday, September 26, 2019 5:56 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] stunnel with OpenSSL engine: reload leaks HSM connections? Hi, We are using stunnel as a server to terminate incoming TLS connections. The config has around 70 services with certificates whose EC private keys are stored in an HSM and accessed using an OpenSSL engine. Over time, after numerous reloads of stunnel (kill -HUP) the HSM reports that its connection table is full. Logging from the engine shows that stunnel is never freeing the keys and therefore the engine is not closing the associated sessions with the HSM. Each stunnel reload opens 70 new sessions until eventually the HSM's configured limit is exceeded. This behaviour has been observed on Suse Enterprise Linux 12.3 with the system-provided stunnel-5.00-4.3.4, but I can reproduce it with my own build of the current version 5.55. Is this a known issue? It appears that other (ephemeral) keys are being freed, just not those associated with the service certificates. Currently our workaround is to perform a full restart instead of a reload. This closes all HSM sessions when the process terminates, but of course it also kills any open client connections so it can only be done during the scheduled maintenance windows. Regards, Andrew. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

2 1

stunnel with OpenSSL engine: reload leaks HSM connections?
by Lynch, Andrew 26 Sep '19

26 Sep '19

Hi, We are using stunnel as a server to terminate incoming TLS connections. The config has around 70 services with certificates whose EC private keys are stored in an HSM and accessed using an OpenSSL engine. Over time, after numerous reloads of stunnel (kill -HUP) the HSM reports that its connection table is full. Logging from the engine shows that stunnel is never freeing the keys and therefore the engine is not closing the associated sessions with the HSM. Each stunnel reload opens 70 new sessions until eventually the HSM's configured limit is exceeded. This behaviour has been observed on Suse Enterprise Linux 12.3 with the system-provided stunnel-5.00-4.3.4, but I can reproduce it with my own build of the current version 5.55. Is this a known issue? It appears that other (ephemeral) keys are being freed, just not those associated with the service certificates. Currently our workaround is to perform a full restart instead of a reload. This closes all HSM sessions when the process terminates, but of course it also kills any open client connections so it can only be done during the scheduled maintenance windows. Regards, Andrew.

1 0

Re: [stunnel-users] Problems when using PSK between a version of stunnel usingopenssl 1.0 and a version of stunnel using openssl 1.1.1 in stunnel-users Digest, Vol 182, Issue 7
by Koperberg, J. (Hannah) 25 Sep '19

25 Sep '19

Hi Brent Thank you for your suggestions. I installed stunnel version 5.55 on the client test side (where the openssl version OpenSSL 1.1.1c is). That has solved the problem. Kind regards and thanks again for your help, Hannah Koperberg, de Volksbank N.V., The Netherlands From: Brent Kimberley <brent_kimberley(a)rogers.com> Sent: woensdag 18 september 2019 18:30 To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] stunnel-users Digest, Vol 182, Issue 7 psk_find() and psk_server_callback() are marked NOEXPORT. You can try whitebox - decompile ctx.c:: psk_server_callback() and/or blackbox - breaking the problem into parts to see what works/fails. Decomposing the problem into parts : a) Two differing stunnel versions and a common openssl library. b) One common stunnel version and two differing openssl libraries. On Wednesday, September 18, 2019, 11:28:48 a.m. EDT, Brent Kimberley <brent_kimberley(a)rogers.com<mailto:[email protected]>> wrote: >> 2019.09.16 13:36:28 LOG6[3]: PSK identity not found (session resumption?) Try dumping the symbols for ctx.c::psk_find(), ssl_lib.c::SSL_get_ex_data(), and ctx.c:: psk_server_callback(). ________________________________ Dit e-mailbericht is alleen bestemd voor de geadresseerden. Indien dit bericht niet voor u is bedoeld, wordt u verzocht de afzender hiervan op de hoogte te stellen door het bericht te retourneren en de inhoud niet te gebruiken. This e-mail message is intended to be exclusively for the addressee. If you are not the intended recipient you are kindly requested not to make any use whatsoever of the contents and to notify the sender immediately by returning this e-mail message.

2 1

Re: [stunnel-users] stunnel-users Digest, Vol 182, Issue 11
by Brent Kimberley 24 Sep '19

24 Sep '19

>>We are running stunnel-5.49-1.ppc on AIX 7100-05-03-1846. >>It will stay up awhile and our connection tests work, but it core dumps. Here’s the message in the log file. Thoughts? >>INTERNAL ERROR: Out of memory at s3_both.c, line 626 Hi Gerald. You may have found a memory leak. Try looking at: 1) line 626 of OpenSSL::s3_booth.c https://github.com/openssl/openssl/blob/OpenSSL_1_0_2-stable/ssl/s3_both.c 2) line 296 of stunnel::str.c ; and/or https://github.com/mtrojnar/stunnel/blob/stunnel-5.49/src/str.c 3) dbx, truss, or probevue - in an offline dev environment. http://archive.ibmsystemsmag.com/aix/administrator/performance/debugging-me…

1 0

AIX:stunnel core dumping
by Gerald Shaw 24 Sep '19

24 Sep '19

Hello, We are running stunnel-5.49-1.ppc on AIX 7100-05-03-1846. It will stay up awhile and our connection tests work, but it core dumps. Here’s the message in the log file. Thoughts? INTERNAL ERROR: Out of memory at s3_both.c, line 626 Best, Gerald Shaw

1 0

Cannot create .crt file
by John Khoo 24 Sep '19

24 Sep '19

Hi, I am new to STunnel. I come to know STunnel thru this link: http://www.ibphoenix.com/downloads/Secure_connections_to_Firebird_with_Stun… Based on the instruction, I tried create a certificate using this line below: openssl ca -config "C:\Program Files (x86)\stunnel\config\openssl.conf" -policy policy_anything -notext -in C:\CA\temp\vnc_server\server.req -out C:\CA\temp\vnc_server\server.crt However, no crt file is created and no error is prompted. I hope that someone can help me. Thanks.

1 0

Stunnel and Sophos UTM
by James Brown 20 Sep '19

20 Sep '19

Has anybody been able to use stunnel to update the Sophos UTM’s firewall? I know it has a Restful API , but do not know how to use this with stunnel. https://www.sophos.com/en-us/medialibrary/PDFs/documentation/UTMonAWS/Sopho… <https://www.sophos.com/en-us/medialibrary/PDFs/documentation/UTMonAWS/Sopho…> Any experiences or suggestions? Thanks, James.

2 1

Re: [stunnel-users] Stunnel help and guidance request
by Noonan, M.P. (Mike) 19 Sep '19

19 Sep '19

Hi Gerald, I assume you got stunnel from the oss4aix.org site. We don't use the freeware openssl, but instead the IBM one: [root@duist:/data/O01] lslpp -l | grep openssl openssl.base 1.0.2.1801 COMMITTED Open Secure Socket Layer openssl.license 1.0.2.1801 COMMITTED Open Secure Socket License openssl.man.en_US 1.0.2.1801 COMMITTED Open Secure Socket Layer openssl.base 1.0.2.1801 COMMITTED Open Secure Socket Layer I installed stunnel-5.29 on one of our lpars which I forced with -nodeps: rpm -Uhv --nodeps stunnel-5.29-1.aix5.2.ppc.rpm It picked up the IBM libs, but had the same problem... [root@duist:/data/O01] ldd /usr/bin/stunnel /usr/bin/stunnel needs: /usr/lib/threads/libc.a(shr.o) /usr/lib/libpthreads.a(shr_comm.o) /usr/lib/libpthreads.a(shr_xpg5.o) /usr/lib/libcrypto.a(libcrypto.so.1.0.2) /usr/lib/libssl.a(libssl.so.1.0.2) /unix /usr/lib/libcrypt.a(shr.o) [root@duist:/data/O01] /usr/bin/stunnel Could not load program /usr/bin/stunnel: Symbol resolution failed for stunnel because: Symbol strcmp (number 112) is not exported from dependent module /usr/lib/libcrypto.a(libcrypto.so.1.0.2). Symbol memmove (number 137) is not exported from dependent module /usr/lib/libcrypto.a(libcrypto.so.1.0.2). Symbol strncpy (number 142) is not exported from dependent module /usr/lib/libcrypto.a(libcrypto.so.1.0.2). Symbol strcpy (number 169) is not exported from dependent module /usr/lib/libcrypto.a(libcrypto.so.1.0.2). Symbol bcopy (number 245) is not exported from dependent module /usr/lib/libcrypto.a(libcrypto.so.1.0.2). I then downloaded and installed stunnel-5.49 from oss4aix.org and installed that version which worked fine.. [root@duist:/data/O01] /usr/bin/stunnel [ ] Clients allowed=31999 [.] stunnel 5.49 on powerpc-ibm-aix5.2.0.0 platform [.] Compiled with OpenSSL 1.0.2p 14 Aug 2018 [.] Running with OpenSSL 1.0.2r 26 Feb 2019 [.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_Errno()) [!] Invalid configuration file name "/opt/freeware/etc/stunnel/stunnel.conf" [!] realpath: No such file or directory (2) [ ] Deallocating section defaults I expect that if you upgrade your freeware openssl to at least 1,0,2r and upgrade stunnel to 5.49 your problem should be solved. Met vriendelijke groet, Mike Noonan From: stunnel-users <mailto:[email protected]> On Behalf Of Gerald Shaw Sent: Wednesday, September 18, 2019 11:18 PM To: mailto:[email protected] Subject: [stunnel-users] Stunnel help and guidance request Hello all, I'm new to the mailing list. I'm trying to run stunnel-5.29-1.ppc, and I'm having issues. I'd appreciate your help (or point me to the solution in the archives). OS - AIX 7100-05-03-1846 /home/shawg# rpm -qa|grep -i openssl openssl-1.0.2n-1.ppc /home/shawg# ldd `which stunnel` /usr/bin/stunnel needs: /usr/lib/libc.a(shr.o) /usr/lib/libpthreads.a(shr_comm.o) /usr/lib/libpthreads.a(shr_xpg5.o) /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2) /opt/freeware/lib/libssl.a(libssl.so.1.0.2) /unix /usr/lib/libcrypt.a(shr.o) ** ERROR MESSAGE_- /home/shawg# /usr/bin/stunnel exec(): 0509-036 Cannot load program /usr/bin/stunnel because of the following errors: 0509-130 Symbol resolution failed for stunnel because: 0509-136 Symbol strcmp (number 112) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-136 Symbol memmove (number 137) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-136 Symbol strncpy (number 142) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-136 Symbol strcpy (number 169) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-136 Symbol bcopy (number 245) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-192 Examine .loader section symbols with the 'dump -Tv' command. *** echo $LIBPATH /opt/freeware/lib:/usr/lib ________________________________ Dit e-mailbericht is alleen bestemd voor de geadresseerden. Indien dit bericht niet voor u is bedoeld, wordt u verzocht de afzender hiervan op de hoogte te stellen door het bericht te retourneren en de inhoud niet te gebruiken. This e-mail message is intended to be exclusively for the addressee. If you are not the intended recipient you are kindly requested not to make any use whatsoever of the contents and to notify the sender immediately by returning this e-mail message.

2 1

Stunnel help and guidance request
by Gerald Shaw 18 Sep '19

18 Sep '19

Hello all, I’m new to the mailing list. I’m trying to run stunnel-5.29-1.ppc, and I’m having issues. I’d appreciate your help (or point me to the solution in the archives). OS - AIX 7100-05-03-1846 /home/shawg# rpm -qa|grep -i openssl openssl-1.0.2n-1.ppc /home/shawg# ldd `which stunnel` /usr/bin/stunnel needs: /usr/lib/libc.a(shr.o) /usr/lib/libpthreads.a(shr_comm.o) /usr/lib/libpthreads.a(shr_xpg5.o) /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2) /opt/freeware/lib/libssl.a(libssl.so.1.0.2) /unix /usr/lib/libcrypt.a(shr.o) ** ERROR MESSAGE_- /home/shawg# /usr/bin/stunnel exec(): 0509-036 Cannot load program /usr/bin/stunnel because of the following errors: 0509-130 Symbol resolution failed for stunnel because: 0509-136 Symbol strcmp (number 112) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-136 Symbol memmove (number 137) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-136 Symbol strncpy (number 142) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-136 Symbol strcpy (number 169) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-136 Symbol bcopy (number 245) is not exported from dependent module /opt/freeware/lib/libcrypto.a(libcrypto.so.1.0.2). 0509-192 Examine .loader section symbols with the 'dump -Tv' command. *** echo $LIBPATH /opt/freeware/lib:/usr/lib ** I’d appreciate any help or guidance. Thanks in advance. R, G. Shaw

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 182, Issue 7
by Brent Kimberley 18 Sep '19

18 Sep '19

>> 2019.09.16 13:36:28 LOG6[3]: PSK identity not found (session resumption?)Try dumping the symbols for ctx.c::psk_find(), ssl_lib.c::SSL_get_ex_data(), and ctx.c:: psk_server_callback(). Date: Tue, 17 Sep 2019 18:18:13 +0200 From: Hannah Koperberg <hannah.koperberg(a)gmail.com> Subject: [stunnel-users] Problems when using PSK between a version of stunnel usingopenssl 1.0 and a version of stunnel using openssl 1.1.1 We encounter problems when using PSK between a version of stunnel using openssl 1.0 and a version of stunnel using openssl 1.1.1 The problem being the following: 2019.09.16 13:36:28 LOG6[3]: PSK identity not found (session resumption?) 2019.09.16 13:36:28 LOG7[3]: TLS alert (write): fatal: unknown PSK identity 2019.09.16 13:36:28 LOG3[3]: SSL_accept: s3_srvr.c:2845: error:1408B0DF:SSL routines:ssl3_get_client_key_exchange:psk identity not found No problems are encountered when using certificates or when the same versions of stunnel and openssl are used. In the latter case neither certificates nor PSK give any problems connecting. Kind regards, Hannah Koperberg, de Volksbank in the Netherlands

1 1

openssl inquiry
by Brent Kimberley 16 Sep '19

16 Sep '19

Can someone please walk me through how to replace 1.1.1c with 1.1.1d ? For example: 1. Download from SLP https://github.com/slproweb/opensslhashes/ 2. Extract & overwrite

1 0

TR: using sTunnel with Chrome (Pierre DUPONT)
by Brent Kimberley 06 Sep '19

06 Sep '19

Dump your stunnel.crt file. <stunnel_home>/bin/openssl x509 -in stunnel.crt -noout -text And, compare with * section 4 of https://tools.ietf.org/html/rfc5280 * Peer-reviewed public sites. https://www.ssllabs.com/ssltest/ Dump your stunnel.cnf file. And, compare with stunnel_home>/config/openssl.cnf file https://access.redhat.com/solutions/28965 https://www.openssl.org/docs/manmaster/man5/x509v3_config.html ---------------------------------------------------------------------- From: Pierre DUPONT <pierre.dupont(a)nedap.fr> De : Pierre DUPONT Envoy? : jeudi 5 septembre 2019 16:55 Cc : _sav.bibli <sav.bibli(a)nedap.fr>; Philippe ANQUETIN <philippe.anquetin(a)nedap.fr> Objet : using sTunnel with Chrome Good day to all. So far, I can't succeed to use Chrome with sTunnel. Here is my configuration for sTunnel.... However, I cannot connect on https I tried several things found browsing the list, like building a certificate with openssl req -new -x509 -days 365 -nodes -config stunnel.cnf -out stunnel.crt -keyout stunnel.crt No result so the only solution I see now is to call you for some help... With kind regards, Cordiales salutations de Pierre Dupont Support S.A.V. & D?veloppement Biblioth?ques Courriel S.A.V. : sav.bibli(a)nedap.fr<mailto:[email protected]> 06 13 99 69 38 - 01.61.03.03 18 8/10 Chemin d'Andr?sy 95610 Eragny sur Oise NEDAP LOGO

1 0

TR: using sTunnel with Chrome
by Pierre DUPONT 06 Sep '19

06 Sep '19

De : Pierre DUPONT Envoyé : jeudi 5 septembre 2019 16:55 À : 'stunnel-users(a)stunnel.org' <stunnel-users(a)stunnel.org> Cc : _sav.bibli <sav.bibli(a)nedap.fr>; Philippe ANQUETIN <philippe.anquetin(a)nedap.fr> Objet : using sTunnel with Chrome Good day to all. So far, I can't succeed to use Chrome with sTunnel. I use these versions sTunnel : 5.55 (downloaded today...) Chrome is 76.0.3809 132 [cid:[email protected]] Here is my configuration for sTunnel : ; Sample stunnel configuration file for Win32 by Michal Trojnara 2002-2019 ; Some options used here may be inadequate for your particular configuration ; This sample file does *not* represent stunnel.conf defaults ; Please consult the manual for detailed description of available options ; ************************************************************************** ; * Global options * ; ************************************************************************** ; Debugging stuff (may be useful for troubleshooting) ;debug = info ;output = stunnel.log ; Enable FIPS 140-2 mode if needed for compliance ;fips = yes ; Microsoft CryptoAPI engine allows for authentication with private keys ; stored in the Windows certificate store ; Each section using this feature also needs the "engineId = capi" option ;engine = capi ; You also need to disable TLS 1.2 or later, because the CryptoAPI engine ; currently does not support PSS ;sslVersionMax = TLSv1.1 ; The pkcs11 engine allows for authentication with cryptographic ; keys isolated in a hardware or software token ; MODULE_PATH specifies the path to the pkcs11 module shared library, ; e.g. softhsm2.dll or opensc-pkcs11.so ; Each section using this feature also needs the "engineId = pkcs11" option ;engine = pkcs11 ;engineCtrl = MODULE_PATH:softhsm2.dll ;engineCtrl = PIN:1234 ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Enable support for the insecure SSLv3 protocol ;options = -NO_SSLv3 ; These options provide additional security at some performance degradation ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; ************************************************************************** ; * Include all configuration file fragments from the specified folder * ; ************************************************************************** ;include = conf.d ; ************************************************************************** ; * Service definitions (at least one service has to be defined) * ; ************************************************************************** ; ***************************************** Example TLS client mode services [gmail-pop3] client = yes accept = 127.0.0.1:110 connect = pop.gmail.com:995 verifyChain = yes CAfile = ca-certs.pem checkHost = pop.gmail.com OCSPaia = yes [gmail-imap] client = yes accept = 127.0.0.1:143 connect = imap.gmail.com:993 verifyChain = yes CAfile = ca-certs.pem checkHost = imap.gmail.com OCSPaia = yes [gmail-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.gmail.com:465 verifyChain = yes CAfile = ca-certs.pem checkHost = smtp.gmail.com OCSPaia = yes ; Encrypted HTTP proxy authenticated with a client certificate ; located in the Windows certificate store ;[example-proxy] ;client = yes ;accept = 127.0.0.1:8080 ;connect = example.com:8443 ;engineId = capi ; Encrypted HTTP proxy authenticated with a client certificate ; located in a cryptographic token ;[example-pkcs11] ;client = yes ;accept = 127.0.0.1:8080 ;connect = example.com:8443 ;engineId = pkcs11 ;cert = pkcs11:token=MyToken;object=MyCert ;key = pkcs11:token=MyToken;object=MyKey ; ***************************************** Example TLS server mode services ;[pop3s] ;accept = 995 ;connect = 110 ;cert = stunnel.pem ;[imaps] ;accept = 993 ;connect = 143 ;cert = stunnel.pem ; Either only expose this service to trusted networks, or require ; authentication when relaying emails originated from loopback. ; Otherwise the following configuration creates an open relay. ;[ssmtp] ;accept = 465 ;connect = 25 ;cert = stunnel.pem ; TLS front-end to a web server [https] accept = 443 connect = 81 cert = stunnel.pem ; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SChannel ; Microsoft implementations do not use TLS close-notify alert and thus they ; are vulnerable to truncation attacks TIMEOUTclose = 0 ; Remote cmd.exe protected with PSK-authenticated TLS ; Create "secrets.txt" containing IDENTITY:KEY pairs ;[cmd] ;accept = 1337 ;exec = c:\windows\system32\cmd.exe ;execArgs = cmd.exe ;PSKsecrets = secrets.txt ; vim:ft=dosini The 81 connect port is used by our local webservice : http://localhost:81/nedaprfidwebservice.asmx which runs OK [cid:[email protected]] The problem is when I try to import the certificate. It looks OK giving these informations [cid:[email protected]] [cid:[email protected]] However, I cannot connect on https [cid:[email protected]] I tried several things found browsing the list, like building a certificate with openssl req -new -x509 -days 365 -nodes -config stunnel.cnf -out stunnel.crt -keyout stunnel.crt No result so the only solution I see now is to call you for some help... With kind regards, Cordiales salutations de Pierre Dupont Support S.A.V. & Développement Bibliothèques Courriel S.A.V. : sav.bibli(a)nedap.fr<mailto:[email protected]> Téléphone : 06 13 99 69 38 - 01.61.03.03 18 8/10 Chemin d'Andrésy 95610 Eragny sur Oise [NEDAP LOGO - INLINE - RGB]

1 0

High cpu usage 2016 server
by Cooper, Dave 02 Sep '19

02 Sep '19

Using latest version of stunnel. Running on 3 separate 2016 servers. On each server stunnel is consuming 40% of the cpu even though no end point is even connected. Sent from my iPhone ____________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________ ***MBS DISCLAIMER*** Multi-Bank Securities, Inc. (MBS) cannot be held responsible for errors regarding time and/or price on buy/sell requests via e-mail. Information provided in this email has been prepared from sources to be reliable, but is not guaranteed and is not a complete summary or statement of all data necessary for making an investment decision. This is for informational purposes only and does not constitute a recommendation, please confirm all information before investing. Securities discussed are subject to availability and change in price and yield. Changes to assumptions may have a material impact on returns. Past performance is not indicative of future returns. Additional information is available upon request. This email is intended only for the entity or person to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of this information by entities or persons other than the intended recipient is prohibited. If you receive this message in error, please contact the sender immediately and delete the material from your computer. If you no longer wish to receive e-mails from MBS, please forward this email to compliance(a)mbssecurities.com and place the word REMOVE in the subject line

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 181, Issue 3
by Eric Eberhard 28 Aug '19

28 Aug '19

No. If it ain’t broke, don’t fix it! Old saying but still relevant. The continual updates in all modern software may fix something – and another broken. IMO. I know I am a minority on this this group but an old tried and true setup has great value. Experience, reduces updates and adds to stability. We don’t change our code unless we must. We think it is more stable. Don’t listen to me if you are the type that must have every update ASAP Listen to me if you don’t need the latest and greatest and your app works properly. Study the new version and make a plan to move forward when the time is right. We often move forward to the previous stable release. Often months or even a year later. If the improvements are for things you don’t use, put them off. Look at exactly what the release notes say to help you decide if the update is worth it, you might find it improves only functionality you don’t use. It saves time and money and does not introduce new bugs. We use a very unpopular method – we use inetd. This releases you from all the server management code which is very very very hard to make work on all systems as they work so differently. We are on IBM with AIX (Unix). I doubt a lot of people are testing that configuration. Stunnel is very good at not requiring you to update one step at a time! You can skip safely. Enough blather. I am sure there are a lot of people that disagree with me. And they are likely correct in certain situations. We suggest you look at your situation and and see if you can skip releases … All opinion, not fact. I am old-school so keep that in mind! Good Luck, Eric From: Brent Kimberley [mailto:[email protected]] Sent: Wednesday, August 28, 2019 8:16 AM To: stunnel-users(a)stunnel.org; Eric Eberhard <flash(a)vicsmba.com> Cc: daniel.trickett(a)milliporesigma.com Subject: Re: [stunnel-users] stunnel-users Digest, Vol 181, Issue 3 Have you tried RFC8410? On Thursday, August 22, 2019, 04:00:43 p.m. EDT, Eric Eberhard <flash(a)vicsmba.com <mailto:[email protected]> > wrote: <snip>We use similar logic with one stunnel and have millions of transactions daily... [4+10+1 mil XML+web calls]. <snip>R

1 0