- stunnel-users - stunnel.org

OpenSSL 1.1.1 secure level and also an old problem rearing up
by Peter Pentchev 26 Aug '18

26 Aug '18

Hi, Sorry to be the bearer of a "those OS vendors did something again and now we have to catch up with them... again..." type of news, but, well, the maintainers of the Debian package of OpenSSL upgraded it to a prerelease 1.1.1 version and, in the process, changed the default cipher selection in the openssl.cnf file to 'SECLEVEL=2'. Unfortunately, this means that the server certificate used in the stunnel test suite is not considered strong enough, so the test suite is failing. More details may be found in the description of the Debian bug https://bugs.debian.org/906981 and the error message itself is at https://ci.debian.net/data/autopkgtest/testing/amd64/s/stunnel4/865956/log.… (look for all the lines containing "SSL_CTX_use_certificate:ca md too weak") So my first reaction was to stop running the stunnel test suite and only leave my functional test script; however, I then had another idea and tried to get the stunnel test suite to explicitly specify SECLEVEL=1 using the attached patch. This actually helped a bit - it made most of the tests pass - but then I hit a problem with e.g. 037_failover_prio1: if there is a "ciphers" option in the config file, stunnel eventually dies with an error that I seem to remember having seen before; take a look at this gdb backtrace from stunnel 5.48: (gdb) bt #0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51 #1 0x00007f0a349882f1 in __GI_abort () at abort.c:79 #2 0x000055b1aa3ad645 in fatal_debug (txt=0x55b1aa3c503c "Bad magic", file=0x55b1aa3ca6dd "ssl.c", line=118) at log.c:379 #3 0x000055b1aa3ae066 in get_alloc_list_ptr (ptr=0x7f0a24014520, file=0x55b1aa3ca6dd "ssl.c", line=118) at str.c:429 #4 0x000055b1aa3ae229 in str_detach_debug (ptr=ptr@entry=0x7f0a24014520, file=file@entry=0x55b1aa3ca6dd "ssl.c", line=line@entry=118) at str.c:378 #5 0x000055b1aa3ae884 in str_detach_debug (line=118, file=0x55b1aa3ca6dd "ssl.c", ptr=0x7f0a24014520) at str.c:413 #6 str_free_debug (ptr=0x7f0a24014520, file=0x55b1aa3ca6dd "ssl.c", line=118) at str.c:413 #7 0x00007f0a34f7661a in CRYPTO_free_ex_data () from /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1 #8 0x00007f0a35112a98 in SSL_SESSION_free () from /usr/lib/x86_64-linux-gnu/libssl.so.1.1 #9 0x00007f0a34f7a1bc in OPENSSL_LH_doall_arg () from /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1 #10 0x00007f0a35114177 in SSL_CTX_flush_sessions () from /usr/lib/x86_64-linux-gnu/libssl.so.1.1 #11 0x000055b1aa3c3701 in unbind_ports () at stunnel.c:439 #12 0x000055b1aa3c3799 in main_cleanup () at stunnel.c:224 #13 0x000055b1aa3ad720 in main (argc=<optimized out>, argv=<optimized out>) at ui_unix.c:79 (gdb) (the line numbers may be a bit off from the stock stunnel source, since I also added a setrlimit(RLIMIT_CORE, infinity) patch) So, yeah, what would be the best way forward here? I guess I might create a new certificate specifically for the Debian package's test suite, but I think the double-free problem may also need to be fixed. Let me know if you need any more information about reproducing it or any more data in case it doesn't happen on your end. Thanks for everything you're doing for stunnel, and keep up the great work! G'luck, Peter -- Peter Pentchev roam(a){ringlet.net,debian.org,FreeBSD.org} pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

2 2

Log to syslog without process name, after reloading the configuration (sighup)
by Reschke, Sven (VWIF G-TS/P) 22 Aug '18

22 Aug '18

Hi, I've upgraded my stunnel from version 5.44 to 5.45. After reloading the configuration of stunnel (via pkill -sighup stunnel) several times, I've stumbled about missing syslogs. Only the loading of the configuration file was still visible. Then I've noticed, that greping the syslog for stunnel was my mistake. Stunnel doesn't log its process name after reloading the configuration file the second time (see logs below) Can someone verify, or is it just me, or some configuration I'm missing? BTW: I've reproduced the "problem" also for the version 5.48 as you can see from the logs. With version 5.44 stunnel always logged its process name to syslog. Syslog output for greping after "stunnel": Aug 17 13:41:14 <user> stunnel: LOG5[ui]: stunnel 5.48 on armv7l-unknown-linux-gnueabihf platform Aug 17 13:41:14 <user> stunnel: LOG5[ui]: Compiled/running with OpenSSL 1.0.2p 14 Aug 2018 Aug 17 13:41:14 <user> stunnel: LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Aug 17 13:41:14 <user> stunnel: LOG5[ui]: Reading configuration from file /home/pi/stunnel.conf Aug 17 13:41:14 <user> stunnel: LOG5[ui]: UTF-8 byte order mark not detected Aug 17 13:41:14 <user> stunnel: LOG5[ui]: FIPS mode disabled Aug 17 13:41:14 <user> stunnel: LOG4[ui]: Insecure file permissions on /home/pi/psk.txt Aug 17 13:41:14 <user> stunnel: LOG4[ui]: Insecure file permissions on /home/pi/psk.txt Aug 17 13:41:14 <user> stunnel: LOG5[ui]: Configuration successful ---------------- Reloading the configuration the first time ----------------------- Aug 17 13:41:21 <user> stunnel: LOG5[main]: Reading configuration from file /home/pi/stunnel.conf Aug 17 13:41:21 <user> stunnel: LOG5[main]: UTF-8 byte order mark not detected Aug 17 13:41:21 <user> stunnel: LOG5[main]: FIPS mode disabled Aug 17 13:41:21 <user> stunnel: LOG4[main]: Insecure file permissions on /home/pi/psk.txt Aug 17 13:41:21 <user> stunnel: LOG4[main]: Insecure file permissions on /home/pi/psk.txt Aug 17 13:41:21 <user> stunnel: LOG5[main]: Configuration successful ---------------- Reloading the configuration a second time ------------------------ Aug 17 13:41:26 <user> : LOG5[main]: Reading configuration from file /home/pi/stunnel.conf My configuration file: [PSK client] client = yes accept = <listen address> connect = <remote address> PSKsecrets = /home/pi/psk.txt [PSK server] accept = <listen address> connect = <remote address> PSKsecrets = /home/pi/psk.txt Sven Reschke Embedded System SW Developer G-TS/P Volkswagen Infotainment GmbH Universitätsstr. 140 44799 Bochum Mobile +49 1525-887 2762 sven.reschke(a)volkswagen-infotainment.com<mailto:[email protected]> http://www.volkswagen-infotainment.com<http://www.volkswagen-infotainment.com/> Sitz der Gesellschaft: Wolfsburg Amtsgericht Braunschweig: HRB 204780 Geschäftsführung: Bernhard Krauße (Sprecher), Tobias Nadjib

2 2

OFFICE 365
by Mark Brezinski 15 Aug '18

15 Aug '18

Hello, Anyone have any luck connecting stunnel to office 365 I keep getting a socket 10061 error Mark Brezinski IT / EDI Manager [cid:[email protected]]Healthcare, Inc. Proud Winner of the US National Minority Manufacturer of the Year Award 2012, MBDA, US Dept of Commerce Proud Winner of the Supplier of the Year Award 2012, Chicago Minority Supplier Development Council (Class IV >$50MM) Manufacturer of Medical Devices & Disposable Kits 5535 N. Wolcott Avenue Chicago, IL 60640 Tel : (773) 878-1100 ext.277 Fax: (773) 878-9100 mark.brezinski(a)lslhealthcare.com<mailto:[email protected]> www.LSLHealthcare.com<http://www.lslhealthcare.com/> Notice: If you are not the intended recipient, please note that any dissemination, disclosure, distribution, or copying of this communication is strictly prohibited. Anyone who receives this message in error should notify the sender immediately by telephone or by return e-mail and delete it from their computer. This communication may contain information that is privileged, confidential or exempt from disclosure. P LSL Healthcare, Inc.is dedicated to preserving our environment. Please join us and consider not printing this e-mail unless necessary.

1 0

x64 Installers and Upgrade HowTo
by Cynthia Davis 07 Aug '18

07 Aug '18

Two questions for the mailing list: 1. Are win64 installers available for stunnel? I only see win32 installers on the downloads page. 2. Are there formal (or informal) instructions for upgrading an existing stunnel installation? Thanks in advance, CJD

1 0

zlib1.dll not installed
by Gonzalo Costantini 01 Aug '18

01 Aug '18

Hi, The installer stunnel-5.48-win32-installer.exe do not copy zlib1.dll in any directory; this problem begins with the installer stunnel-5.44-win32-installer. Thaks. -- Luis Gonzalo Costantini Rickel Clave GPG (GPG Key): Fingerprint: 081069E0C552DFBDF53A0D2046ECD11A960D250F Key-ID.: 0x960D250F

1 0

Re: [stunnel-users] Is there a way to specify certificate content in stunnel config
by Eric S Eberhard 24 Jul '18

24 Jul '18

Use stunnel in inetd mode. Execute a script (or better C program). Copy the certificates for making the stunnel connection to a directory that is OK … then delete them immediately after stunnel starts. Hack – but might be OK for what you are doing. I am not sure why anyone would think it more secure to put the keys into the stunnel command than to just use them from a file … but I likely do not know enough about your application to make a judgement. Eric Eric S Eberhard VICS (Vertical Integrated Computer Systems) Voice: 928 567 3529 Cell : 928 301 7537 (not reliable except for text or if not home) 2933 W Middle Verde Rd Camp Verde, AZ 86322 From: stunnel-users [mailto:[email protected]] On Behalf Of Hari Sent: Thursday, July 19, 2018 4:42 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Is there a way to specify certificate content in stunnel config Hi, I have a requirement where in i cannot specify the certificate and/or private key details as "files" to stunnel configuration, owing to the location and/or file system availability for stunnel to access them. Is there a way to specify the actual certificate content in stunnel configuration (similar to other parameters like port numbers etc.,) so that the same can be leveraged. Thanks Hari <http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_cam…> Virus-free. <http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_cam…> www.avg.com

3 2

Grok log parsing
by Manuele Trimarchi 24 Jul '18

24 Jul '18

I would ask if someone use Grok log parsing for stunnel and, if yes, what kind of filter statement are you using? At the moment I've just created 2 parser: STUNNEL_AcceptedConnectionParser %{date("yyyy.MM.dd HH:mm:ss"):date} LOG%{integer:loglevel}\[%{integer:session_id}\]\: Service \[%{word:csb_name}\-%{word:csb_port}\] accepted connection from %{ipv4:caller_ip}\:%{port:caller_port} and STUNNEL_ConnectionClosedParser %{date("yyyy.MM.dd HH:mm:ss"):date} LOG%{integer:loglevel}\[%{integer:session_id}\]\: Connection closed\: %{integer:byte_tx} byte$s$ sent to SSL\, %{integer:byte_rx} byte$s$ sent to socket I'm new with Grok and all the things related to log match-and-parse, so I think that there will be a much better solution than mine, anyway Google this time doesn't help unfortunately. Thank you so much to all those who will help me with this stuff! Manuele

1 1

Cross Compiling Stunnel-5.48 Using BoringSSL
by Jaymin D 24 Jul '18

24 Jul '18

Hi All, I want to cross compile the Stunnel-5.48 for my Android AOSP (arch64) platform using BoringSSL's 'libssl.so' and 'libcrypto.so' libraries. I have successfully cross compiled the BoringSSL in my AOSP and both .so file was generated for arch64 platform. Am using BoringSSL which was delivered with Android AOSP (Android 7). Am cross compiling using "build-android.sh" script. But, while cross compiling the Stunnel-5.48 facing error as below: ------------------------------------------------------------------------------------------------ VERSION=5.48 > DST=stunnel-$VERSION-android > # to build OpenSSL: > # ./Configure threads no-shared no-dso > --cross-compile-prefix=arm-linux-androideabi- > --prefix=/opt/androideabi/sysroot linux-armv4 > # make install > LDFLAGS="$LDFLAGS -L/home/jaymin/Desktop/boringssl_lib -fPIE" > export LDFLAGS > test -f Makefile && make distclean > mkdir -p bin/android > cd bin/android > ../../configure --with-pic --enable-shared --with-sysroot > --host=aarch64-linux-android --with-ssl=/home/jaymin/Desktop/boringssl_lib > configure: **************************************** initialization > checking for a BSD-compatible install... /usr/bin/install -c > checking whether build environment is sane... yes > checking for aarch64-linux-android-strip... no > checking for strip... strip > checking for a thread-safe mkdir -p... /bin/mkdir -p > checking for gawk... gawk > checking whether make sets $(MAKE)... yes > checking whether make supports nested variables... yes > checking build system type... x86_64-pc-linux-gnu > checking host system type... aarch64-unknown-linux-android > checking for aarch64-linux-android-gcc... no > checking for gcc... gcc > checking whether the C compiler works... yes > checking for C compiler default output file name... a.out > checking for suffix of executables... > checking whether we are cross compiling... no > checking for suffix of object files... o > checking whether we are using the GNU C compiler... yes > checking whether gcc accepts -g... yes > checking for gcc option to accept ISO C89... none needed > checking whether gcc understands -c and -o together... yes > checking for style of include used by make... GNU > checking dependency style of gcc... gcc3 > checking whether make sets $(MAKE)... (cached) yes > checking whether make supports nested variables... (cached) yes > configure: **************************************** thread model > checking for a sed that does not truncate output... /bin/sed > checking how to run the C preprocessor... gcc -E > checking for grep that handles long lines and -e... /bin/grep > checking for egrep... /bin/grep -E > checking whether gcc is Clang... no > checking whether pthreads work with -pthread... yes > checking for joinable pthread attribute... PTHREAD_CREATE_JOINABLE > checking whether more special flags are required for pthreads... no > checking for PTHREAD_PRIO_INHERIT... yes > configure: PTHREAD thread model detected > configure: **************************************** compiler/linker flags > checking whether C compiler accepts -Wall... yes > checking whether C compiler accepts -Wextra... yes > checking whether C compiler accepts -Wpedantic... yes > checking whether C compiler accepts -Wformat=2... yes > checking whether C compiler accepts -Wconversion... yes > checking whether C compiler accepts -Wno-long-long... yes > checking whether C compiler accepts -Wno-deprecated-declarations... yes > checking whether C compiler accepts -fPIE... yes > checking whether C compiler accepts -fstack-protector... yes > checking whether the linker accepts -fPIE... yes > checking whether the linker accepts -pie... yes > checking whether the linker accepts -Wl,-z,relro... yes > checking whether the linker accepts -Wl,-z,now... yes > checking whether the linker accepts -Wl,-z,noexecstack... yes > checking whether C compiler accepts -D_FORTIFY_SOURCE=2... yes > configure: **************************************** libtool > checking how to print strings... printf > checking for a sed that does not truncate output... (cached) /bin/sed > checking for fgrep... /bin/grep -F > checking for ld used by gcc... /usr/bin/ld > checking if the linker (/usr/bin/ld) is GNU ld... yes > checking for BSD- or MS-compatible name lister (nm)... no > checking for aarch64-linux-android-dumpbin... no > checking for aarch64-linux-android-link... no > checking for dumpbin... no > checking for link... link -dump > checking the name lister (nm) interface... BSD nm > checking whether ln -s works... yes > checking the maximum length of command line arguments... 1572864 > checking how to convert x86_64-pc-linux-gnu file names to > aarch64-unknown-linux-android format... func_convert_file_noop > checking how to convert x86_64-pc-linux-gnu file names to toolchain > format... func_convert_file_noop > checking for /usr/bin/ld option to reload object files... -r > checking for aarch64-linux-android-objdump... no > checking for objdump... objdump > checking how to recognize dependent libraries... pass_all > checking for aarch64-linux-android-dlltool... no > checking for dlltool... no > checking how to associate runtime and link libraries... printf %s\n > checking for aarch64-linux-android-ar... no > checking for ar... ar > checking for archiver @FILE support... @ > checking for aarch64-linux-android-strip... strip > checking for aarch64-linux-android-ranlib... no > checking for ranlib... ranlib > checking command to parse nm output from gcc object... ok > checking for sysroot... / > checking for a working dd... /bin/dd > checking how to truncate binary pipes... /bin/dd bs=4096 count=1 > checking for aarch64-linux-android-mt... no > checking for mt... mt > checking if mt is a manifest tool... no > checking for ANSI C header files... yes > checking for sys/types.h... yes > checking for sys/stat.h... yes > checking for stdlib.h... yes > checking for string.h... yes > checking for memory.h... yes > checking for strings.h... yes > checking for inttypes.h... yes > checking for stdint.h... yes > checking for unistd.h... yes > checking for dlfcn.h... yes > checking for objdir... .libs > checking if gcc supports -fno-rtti -fno-exceptions... no > checking for gcc option to produce PIC... -fPIC -DPIC > checking if gcc PIC flag -fPIC -DPIC works... yes > checking if gcc static flag -static works... no > checking if gcc supports -c -o file.o... yes > checking if gcc supports -c -o file.o... (cached) yes > checking whether the gcc linker (/usr/bin/ld) supports shared libraries... > yes > checking whether -lc should be explicitly linked in... no > checking dynamic linker characteristics... Android linker > checking how to hardcode library paths into programs... immediate > checking whether stripping libraries is possible... yes > checking if libtool supports shared libraries... yes > checking whether to build shared libraries... yes > checking whether to build static libraries... no > configure: **************************************** types > checking for int8_t... yes > checking for int16_t... yes > checking for int32_t... yes > checking for int64_t... yes > checking for uint8_t... yes > checking for uint16_t... yes > checking for uint32_t... yes > checking for uint64_t... yes > checking for size_t... yes > checking for ssize_t... yes > checking for uid_t in sys/types.h... yes > checking for socklen_t... yes > checking for struct sockaddr_un... yes > checking for struct addrinfo... yes > configure: **************************************** PTY device files > checking for "/dev/ptmx"... yes > checking for "/dev/ptc"... no > configure: **************************************** entropy sources > checking for "/dev/urandom"... yes > configure: **************************************** default group > checking for default group... nogroup > checking for special C compiler options needed for large files... no > checking for _FILE_OFFSET_BITS value needed for large files... no > configure: **************************************** header files > checking for stdint.h... (cached) yes > checking for inttypes.h... (cached) yes > checking malloc.h usability... yes > checking malloc.h presence... yes > checking for malloc.h... yes > checking ucontext.h usability... yes > checking ucontext.h presence... yes > checking for ucontext.h... yes > checking pthread.h usability... yes > checking pthread.h presence... yes > checking for pthread.h... yes > checking poll.h usability... yes > checking poll.h presence... yes > checking for poll.h... yes > checking tcpd.h usability... no > checking tcpd.h presence... no > checking for tcpd.h... no > checking stropts.h usability... yes > checking stropts.h presence... yes > checking for stropts.h... yes > checking grp.h usability... yes > checking grp.h presence... yes > checking for grp.h... yes > checking for unistd.h... (cached) yes > checking util.h usability... no > checking util.h presence... no > checking for util.h... no > checking libutil.h usability... no > checking libutil.h presence... no > checking for libutil.h... no > checking pty.h usability... yes > checking pty.h presence... yes > checking for pty.h... yes > checking limits.h usability... yes > checking limits.h presence... yes > checking for limits.h... yes > checking for sys/types.h... (cached) yes > checking sys/select.h usability... yes > checking sys/select.h presence... yes > checking for sys/select.h... yes > checking sys/poll.h usability... yes > checking sys/poll.h presence... yes > checking for sys/poll.h... yes > checking sys/socket.h usability... yes > checking sys/socket.h presence... yes > checking for sys/socket.h... yes > checking sys/un.h usability... yes > checking sys/un.h presence... yes > checking for sys/un.h... yes > checking sys/ioctl.h usability... yes > checking sys/ioctl.h presence... yes > checking for sys/ioctl.h... yes > checking sys/filio.h usability... no > checking sys/filio.h presence... no > checking for sys/filio.h... no > checking sys/resource.h usability... yes > checking sys/resource.h presence... yes > checking for sys/resource.h... yes > checking sys/uio.h usability... yes > checking sys/uio.h presence... yes > checking for sys/uio.h... yes > checking sys/syscall.h usability... yes > checking sys/syscall.h presence... yes > checking for sys/syscall.h... yes > checking linux/sched.h usability... yes > checking linux/sched.h presence... yes > checking for linux/sched.h... yes > checking for struct msghdr.msg_control... yes > checking for linux/netfilter_ipv4.h... yes > configure: **************************************** libraries > checking for library containing gethostbyname... none required > checking for library containing yp_get_default_domain... -lnsl > checking for library containing socket... none required > checking for library containing openpty... -lutil > checking for library containing dlopen... -ldl > checking for library containing shl_load... no > configure: **************************************** library functions > checking for snprintf... yes > checking for vsnprintf... yes > checking for openpty... yes > checking for _getpty... no > checking for daemon... yes > checking for waitpid... yes > checking for wait4... yes > checking for setsid... yes > checking for setgroups... yes > checking for chroot... yes > checking for realpath... yes > checking for sysconf... yes > checking for getrlimit... yes > checking for pthread_sigmask... yes > checking for localtime_r... yes > checking for getcontext... yes > checking for __makecontext_v2... no > checking for poll... yes > checking for gethostbyname2... yes > checking for endhostent... yes > checking for getnameinfo... yes > checking for getaddrinfo... yes > checking for broken poll() implementation... no > checking for pipe2... yes > checking for accept4... yes > configure: **************************************** optional features > checking whether to enable IPv6 support... yes (default) > checking whether to enable FIPS support... autodetecting > checking whether to enable systemd socket activation support... > autodetecting > checking for library containing sd_listen_fds... no > configure: systemd library not found > checking whether to enable TCP wrappers support... autodetecting > checking for hosts_access in -lwrap... no > configure: libwrap library not found > configure: **************************************** TLS > checking for compiler sysroot... / > checking for TLS directory... /home/jaymin/Desktop/boringssl_lib > checking for FIPS_mode_set... yes > configure: FIPS support enabled > configure: **************************************** write the results > checking that generated files are newer than configure... done > configure: creating ./config.status > config.status: creating Makefile > config.status: creating src/Makefile > config.status: creating doc/Makefile > config.status: creating tools/Makefile > config.status: creating tests/Makefile > config.status: creating src/config.h > config.status: src/config.h is unchanged > config.status: executing depfiles commands > config.status: executing libtool commands > configure: **************************************** success > make clean > Making clean in src > make[1]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/src' > rm -f stunnel > test -z "stunnel3" || rm -f stunnel3 > rm -rf .libs _libs > rm -rf ../obj ../bin > test -z "libstunnel.la" || rm -f libstunnel.la > rm -f ./so_locations > rm -f *.o > rm -f *.lo > make[1]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/src' > Making clean in doc > make[1]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/doc' > test -z "stunnel.8 stunnel.pl.8 stunnel.html stunnel.pl.html" || rm -f > stunnel.8 stunnel.pl.8 stunnel.html stunnel.pl.html > rm -rf .libs _libs > rm -f *.lo > make[1]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/doc' > Making clean in tools > make[1]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/tools' > test -z "stunnel.conf-sample stunnel.init stunnel.service" || rm -f > stunnel.conf-sample stunnel.init stunnel.service > rm -rf .libs _libs > rm -f *.lo > make[1]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/tools' > Making clean in tests > make[1]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/tests' > rm -rf .libs _libs > rm -f *.lo > make[1]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/tests' > make[1]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android' > rm -rf .libs _libs > rm -f *.lo > make[1]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android' > make > Making all in src > make[1]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/src' > make all-am > make[2]: Entering directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/src' > CC env.lo > CCLD libstunnel.la > CC stunnel-tls.o > CC stunnel-str.o > CC stunnel-file.o > CC stunnel-client.o > CC stunnel-log.o > CC stunnel-options.o > CC stunnel-protocol.o > CC stunnel-network.o > CC stunnel-resolver.o > CC stunnel-ssl.o > CC stunnel-ctx.o > CC stunnel-verify.o > CC stunnel-sthreads.o > CC stunnel-fd.o > CC stunnel-dhparam.o > CC stunnel-cron.o > CC stunnel-stunnel.o > CC stunnel-pty.o > CC stunnel-libwrap.o > CC stunnel-ui_unix.o > CCLD stunnel > /usr/bin/ld: skipping incompatible > /home/jaymin/Desktop/boringssl_lib/libssl.so when searching for -lssl > /usr/bin/ld: skipping incompatible > /home/jaymin/Desktop/boringssl_lib/libcrypto.so when searching for -lcrypto > stunnel-str.o: In function `str_leak_debug': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/str.c:459: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/str.c:470: > undefined reference to `CRYPTO_THREAD_unlock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/str.c:501: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/str.c:509: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-client.o: In function `session_cache_retrieve': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:568: > undefined reference to `CRYPTO_THREAD_read_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:581: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-client.o: In function `ssl_start': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:501: > undefined reference to `OpenSSL_version_num' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:519: > undefined reference to `CRYPTO_THREAD_unlock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:511: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:502: > undefined reference to `OpenSSL_version_num' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:503: > undefined reference to `OpenSSL_version_num' > stunnel-client.o: In function `print_cipher': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:595: > undefined reference to `SSL_session_reused' > stunnel-client.o: In function `idx_cache_retrieve': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1446: > undefined reference to `SSL_session_reused' > stunnel-client.o: In function `idx_cache_save': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1432: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1436: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-client.o: In function `idx_cache_retrieve': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1447: > undefined reference to `CRYPTO_THREAD_read_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1453: > undefined reference to `CRYPTO_THREAD_unlock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1469: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-client.o: In function `client_run': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:224: > undefined reference to `CRYPTO_atomic_add' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:323: > undefined reference to `CRYPTO_atomic_add' > stunnel-log.o: In function `log_close': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:109: > undefined reference to `CRYPTO_THREAD_write_lock' > stunnel-log.o: In function `s_log': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:165: > undefined reference to `CRYPTO_THREAD_read_lock' > stunnel-log.o: In function `log_queue': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:194: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:201: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-log.o: In function `s_log': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:170: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-log.o: In function `log_flush': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:205: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:211: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:219: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-log.o: In function `log_close': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:115: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-log.o: In function `log_flush': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:220: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-options.o: In function `engine_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:4219: > undefined reference to `OPENSSL_init_crypto' > stunnel-options.o: In function `service_up_ref': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:614: > undefined reference to `CRYPTO_atomic_add' > stunnel-options.o: In function `parse_global_option': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:681: > undefined reference to `OpenSSL_version_num' > stunnel-options.o: In function `tls_methods_set': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:3514: > undefined reference to `TLS_client_method' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:3515: > undefined reference to `TLS_server_method' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:3506: > undefined reference to `TLS_client_method' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:3507: > undefined reference to `TLS_server_method' > stunnel-options.o: In function `service_up_ref': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:614: > undefined reference to `CRYPTO_atomic_add' > stunnel-options.o: In function `service_free': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:624: > undefined reference to `CRYPTO_atomic_add' > stunnel-ssl.o: In function `ssl_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ssl.c:56: > undefined reference to `OPENSSL_init_ssl' > stunnel-ssl.o: In function `sk_SSL_COMP_pop': > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:846: undefined > reference to `OPENSSL_sk_pop' > stunnel-ssl.o: In function `sk_SSL_COMP_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:846: undefined > reference to `OPENSSL_sk_num' > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:846: undefined > reference to `OPENSSL_sk_num' > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:846: undefined > reference to `OPENSSL_sk_num' > stunnel-ssl.o: In function `sk_SSL_COMP_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:846: undefined > reference to `OPENSSL_sk_value' > stunnel-ssl.o: In function `compression_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ssl.c:217: > undefined reference to `SSL_COMP_get0_name' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ssl.c:221: > undefined reference to `SSL_COMP_get_id' > stunnel-ssl.o: In function `ssl_configure': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ssl.c:127: > undefined reference to `OPENSSL_init_crypto' > stunnel-ssl.o: In function `compression_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ssl.c:201: > undefined reference to `COMP_get_type' > stunnel-ctx.o: In function `info_callback': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:1231: > undefined reference to `SSL_get_state' > stunnel-ctx.o: In function `session_cache_save': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:981: > undefined reference to `SSL_SESSION_up_ref' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:986: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:999: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-ctx.o: In function `sk_X509_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_value' > stunnel-ctx.o: In function `sk_X509_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_num' > stunnel-ctx.o: In function `session_cache_save': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:999: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-ctx.o: In function `context_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:154: > undefined reference to `SSL_CTX_set_options' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:157: > undefined reference to `SSL_CTX_clear_options' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:161: > undefined reference to `SSL_CTX_set_options' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:164: > undefined reference to `SSL_CTX_clear_options' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:170: > undefined reference to `SSL_CTX_get_options' > stunnel-ctx.o: In function `dh_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:328: > undefined reference to `SSL_CTX_get_ciphers' > stunnel-ctx.o: In function `sk_SSL_CIPHER_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:845: undefined > reference to `OPENSSL_sk_num' > stunnel-ctx.o: In function `sk_SSL_CIPHER_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:845: undefined > reference to `OPENSSL_sk_value' > stunnel-ctx.o: In function `dh_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:356: > undefined reference to `CRYPTO_THREAD_read_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:358: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-verify.o: In function `ocsp_request': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/verify.c:539: > undefined reference to `X509_STORE_CTX_get0_chain' > stunnel-verify.o: In function `get_current_issuer': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/verify.c:701: > undefined reference to `X509_STORE_CTX_get0_chain' > stunnel-verify.o: In function `sk_X509_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_num' > stunnel-verify.o: In function `sk_X509_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_value' > stunnel-verify.o: In function `sk_OPENSSL_STRING_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/safestack.h:151: > undefined reference to `OPENSSL_sk_value' > stunnel-verify.o: In function `sk_OPENSSL_STRING_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/safestack.h:151: > undefined reference to `OPENSSL_sk_num' > stunnel-verify.o: In function `cert_check_local': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/verify.c:353: > undefined reference to `X509_STORE_CTX_get1_certs' > stunnel-verify.o: In function `sk_X509_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_num' > stunnel-verify.o: In function `sk_X509_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_value' > stunnel-verify.o: In function `sk_X509_pop_free': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_pop_free' > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined > reference to `OPENSSL_sk_pop_free' > stunnel-verify.o: In function `sk_X509_NAME_num': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:75: undefined > reference to `OPENSSL_sk_num' > stunnel-verify.o: In function `sk_X509_NAME_value': > /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:75: undefined > reference to `OPENSSL_sk_value' > stunnel-sthreads.o: In function `locking_init': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/sthreads.c:358: > undefined reference to `CRYPTO_THREAD_lock_new' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/sthreads.c:358: > undefined reference to `CRYPTO_THREAD_lock_new' > stunnel-dhparam.o: In function `get_dh2048': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/dhparam.c:49: > undefined reference to `DH_set0_pqg' > stunnel-cron.o: In function `cron_dh_param': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/cron.c:193: > undefined reference to `CRYPTO_THREAD_write_lock' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/cron.c:196: > undefined reference to `CRYPTO_THREAD_unlock' > stunnel-stunnel.o: In function `stunnel_info': > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/stunnel.c:887: > undefined reference to `OpenSSL_version' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/stunnel.c:889: > undefined reference to `OpenSSL_version' > /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/stunnel.c:890: > undefined reference to `OpenSSL_version_num' > collect2: error: ld returned 1 exit status > Makefile:538: recipe for target 'stunnel' failed > make[2]: *** [stunnel] Error 1 > make[2]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/src' > Makefile:401: recipe for target 'all' failed > make[1]: *** [all] Error 2 > make[1]: Leaving directory > '/home/jaymin/Downloads/stunnel-5.48/bin/android/src' > Makefile:447: recipe for target 'all-recursive' failed > make: *** [all-recursive] Error 1 ------------------------------------------------------------------------------------------------ As I want to use SSL, did modification as below: --------------------------------------------------------------------------------------------- #!/bin/sh > set -ev > VERSION=5.48 > DST=stunnel-$VERSION-android > # to build OpenSSL: > # ./Configure threads no-shared no-dso > --cross-compile-prefix=arm-linux-androideabi- > --prefix=/opt/androideabi/sysroot linux-armv4 > # make install > LDFLAGS="$LDFLAGS -L/home/jaymin/Desktop/boringssl_lib -fPIE" > export LDFLAGS > test -f Makefile && make distclean > mkdir -p bin/android > cd bin/android > ../../configure --with-pic --enable-shared --with-sysroot > --host=aarch64-linux-android --with-ssl=/home/jaymin/Desktop/boringssl_lib > make clean > make > cd ../.. > mkdir $DST > cp bin/android/src/stunnel $DST > # arm-linux-androideabi-strip $DST/stunnel $DST/openssl > # cp /opt/androideabi/sysroot/bin/openssl $DST > # arm-linux-androideabi-strip $DST/openssl > zip -r $DST.zip $DST > rm -rf $DST > # sha256sum $DST.zip > # mv $DST.zip ../dist/ --------------------------------------------------------------------------------------------- How can I cross compile the Stunnel-5.48 using this BoringSSL? Are my BoringSSL's .so files incompatible? Any suggestions. Regards, Jaymin

1 0

"Reverse" tunneling with stunnel.
by C. Petro 20 Jul '18

20 Jul '18

I have a client who is setting up a logging infrastructure involving a couple of DMZs forwarding logs into central logging points. They have to pass compliance audits (SOX, PCI at least) and have some rather specific desires in regards to how they want the log traffic to move, and which servers *initiate* the connections. Which is to say they want the internal servers to set up tunnels to the DMZ servers and then the forwarders use that tunnel to deliver logs back. Lemme see if I can ascii art this: central1----------------------------------dmz1 \____________________ / _____________________\ _/ / \ central2----------------------------------dmz2 Something like that. Central1=10.10.1.2 Central2=10.9.1.2 DMZ1=172.18.0.5 DMZ2=172.20.0.5 Firewalls are in effect. I have gotten it set up so that I can initiate a connection FROM Central1 to DMZ2. [Tunnel_to_DMZ2] client = yes accept = 3002 connect = 172.20.0.5:5000 And [Tunnel_from_Central1] accept = 5000 connect = 3000 Like I said, I can open a tunnel from Central1 to DMZ2, but can't get traffic to pass backwards--I get a message in the log saying the session is closed. Is it possible to set stunnel up in a "reverse tunnel" mode--one where the connect is initiated from one end, but the other does most of the message passing? What I am missing? Thanks, Petro.

2 2

TLS alert (read): fatal: bad record mac (windows)
by Per Gunnarsson 19 Jul '18

19 Jul '18

I found it after looking once more in the log file. PSK client configured for identity "ï»¿user2" (the identity in the secrets.txt is user2:secretkey, somehow those three weird characters are added on windows) I got around it by copying the secrets.txt file to the server so that the secrets.txt on the server also begins with "ï»¿user2" but I suspect it's a bug. Regards, Per Gunnarsson

1 0

Is there a way to specify certificate content in stunnel config
by Hari 19 Jul '18

19 Jul '18

Hi, I have a requirement where in i cannot specify the certificate and/or private key details as "files" to stunnel configuration, owing to the location and/or file system availability for stunnel to access them. Is there a way to specify the actual certificate content in stunnel configuration (similar to other parameters like port numbers etc.,) so that the same can be leveraged. ThanksHari | | Virus-free. www.avg.com |

1 0

TLS alert (read): fatal: bad record mac (windows)
by Per Gunnarsson 19 Jul '18

19 Jul '18

Hello! I am trying to set up stunnel from a windows box to a VPS. I have working tunnels from a FreeBSD box to the VPS. On the VPS, the config looks like: [socks_server] protocol = socks PSKsecrets = /my/secret/location/secrets.txt accept = xxx.xxx.xxx.xxx:xxxx [ssh] PSKsecrets = /my/secret/location/hecrets.txt accept = xxx.xxx.xxx.xxx:xxxx connect = 127.0.0.1:22 On the windows box, the config looks like this: [socks_client2] debug = 7 client = yes PSKsecrets = c:\my\secret\location\secrets.txt accept = 127.0.0.1:1080 connect = xxx.xxx.xxx.xxx:xxxx The log on Windows looks like this: 2018.07.19 13:13:09 LOG5[main]: stunnel 5.48 on x86-pc-msvc-1500 platform 2018.07.19 13:13:09 LOG5[main]: Compiled/running with OpenSSL 1.0.2o-fips 27 Mar 2018 2018.07.19 13:13:09 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2018.07.19 13:13:09 LOG5[main]: Reading configuration from file stunnel.conf 2018.07.19 13:13:09 LOG5[main]: UTF-8 byte order mark detected 2018.07.19 13:13:09 LOG5[main]: FIPS mode disabled 2018.07.19 13:13:09 LOG5[main]: Configuration successful 2018.07.19 13:13:11 LOG7[0]: Service [socks_client2] started 2018.07.19 13:13:11 LOG7[0]: Setting local socket options (FD=460) 2018.07.19 13:13:11 LOG7[0]: Option TCP_NODELAY set on local socket 2018.07.19 13:13:11 LOG5[0]: Service [socks_client2] accepted connection from 127.0.0.1:56598 2018.07.19 13:13:11 LOG6[0]: s_connect: connecting xxx.xxx.xxx.xxx:xxxx 2018.07.19 13:13:11 LOG7[0]: s_connect: s_poll_wait xxx.xxx.xxx.xxx:xxxx: waiting 10 seconds 2018.07.19 13:13:11 LOG5[0]: s_connect: connected xxx.xxx.xxx.xxx:xxxx 2018.07.19 13:13:11 LOG5[0]: Service [socks_client2] connected remote server from 192.168.1.65:56599 2018.07.19 13:13:11 LOG7[0]: Setting remote socket options (FD=508) 2018.07.19 13:13:11 LOG7[0]: Option TCP_NODELAY set on remote socket 2018.07.19 13:13:11 LOG7[0]: Remote descriptor (FD=508) initialized 2018.07.19 13:13:11 LOG6[0]: SNI: sending servername: xxx.xxx.xxx.xxx 2018.07.19 13:13:11 LOG6[0]: Peer certificate not required 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): before/connect initialization 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv2/v3 write client hello A 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv3 read server hello A 2018.07.19 13:13:11 LOG6[0]: Client certificate not requested 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv3 read server done A 2018.07.19 13:13:11 LOG6[0]: PSK client configured for identity "ï»¿user2" 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv3 write client key exchange A 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv3 write change cipher spec A 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv3 write finished A 2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv3 flush data 2018.07.19 13:13:11 LOG3[0]: SSL_connect: Peer suddenly disconnected 2018.07.19 13:13:11 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.07.19 13:13:11 LOG7[0]: Deallocating application specific data for session connect address 2018.07.19 13:13:11 LOG7[0]: Remote descriptor (FD=508) closed 2018.07.19 13:13:11 LOG7[0]: Local descriptor (FD=460) closed 2018.07.19 13:13:11 LOG7[0]: Service [socks_client2] finished (0 left) 2018.07.19 13:13:34 LOG7[1]: Service [socks_client2] started 2018.07.19 13:13:34 LOG7[1]: Setting local socket options (FD=528) 2018.07.19 13:13:34 LOG7[1]: Option TCP_NODELAY set on local socket 2018.07.19 13:13:34 LOG5[1]: Service [socks_client2] accepted connection from 127.0.0.1:56601 2018.07.19 13:13:34 LOG6[1]: s_connect: connecting xxx.xxx.xxx.xxx:xxxx 2018.07.19 13:13:34 LOG7[1]: s_connect: s_poll_wait xxx.xxx.xxx.xxx:xxxx: waiting 10 seconds 2018.07.19 13:13:34 LOG5[1]: s_connect: connected xxx.xxx.xxx.xxx:xxxx 2018.07.19 13:13:34 LOG5[1]: Service [socks_client2] connected remote server from 192.168.1.65:56602 2018.07.19 13:13:34 LOG7[1]: Setting remote socket options (FD=536) 2018.07.19 13:13:34 LOG7[1]: Option TCP_NODELAY set on remote socket 2018.07.19 13:13:34 LOG7[1]: Remote descriptor (FD=536) initialized 2018.07.19 13:13:34 LOG6[1]: SNI: sending servername: xxx.xxx.xxx.xxx 2018.07.19 13:13:34 LOG6[1]: Peer certificate not required 2018.07.19 13:13:34 LOG7[1]: TLS state (connect): before/connect initialization 2018.07.19 13:13:34 LOG7[1]: TLS state (connect): SSLv2/v3 write client hello A 2018.07.19 13:13:35 LOG7[1]: TLS state (connect): SSLv3 read server hello A 2018.07.19 13:13:35 LOG6[1]: Client certificate not requested 2018.07.19 13:13:35 LOG7[1]: TLS state (connect): SSLv3 read server done A 2018.07.19 13:13:35 LOG6[1]: PSK client configured for identity "ï»¿user2" 2018.07.19 13:13:35 LOG7[1]: TLS state (connect): SSLv3 write client key exchange A 2018.07.19 13:13:35 LOG7[1]: TLS state (connect): SSLv3 write change cipher spec A 2018.07.19 13:13:35 LOG7[1]: TLS state (connect): SSLv3 write finished A 2018.07.19 13:13:35 LOG7[1]: TLS state (connect): SSLv3 flush data 2018.07.19 13:13:35 LOG7[1]: TLS alert (read): fatal: bad record mac 2018.07.19 13:13:35 LOG3[1]: SSL_connect: 140943FC: error:140943FC:SSL routines:ssl3_read_bytes:sslv3 alert bad record mac 2018.07.19 13:13:35 LOG5[1]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.07.19 13:13:35 LOG7[1]: Deallocating application specific data for session connect address 2018.07.19 13:13:35 LOG7[1]: Remote descriptor (FD=536) closed 2018.07.19 13:13:35 LOG7[1]: Local descriptor (FD=528) closed 2018.07.19 13:13:35 LOG7[1]: Service [socks_client2] finished (0 left) 2018.07.19 13:14:06 LOG7[2]: Service [socks_client2] started 2018.07.19 13:14:06 LOG7[2]: Setting local socket options (FD=1880) 2018.07.19 13:14:06 LOG7[2]: Option TCP_NODELAY set on local socket 2018.07.19 13:14:06 LOG5[2]: Service [socks_client2] accepted connection from 127.0.0.1:56604 2018.07.19 13:14:06 LOG6[2]: s_connect: connecting xxx.xxx.xxx.xxx:xxxx 2018.07.19 13:14:06 LOG7[2]: s_connect: s_poll_wait xxx.xxx.xxx.xxx:xxxx: waiting 10 seconds 2018.07.19 13:14:06 LOG5[2]: s_connect: connected xxx.xxx.xxx.xxx:xxxx 2018.07.19 13:14:06 LOG5[2]: Service [socks_client2] connected remote server from 192.168.1.65:56605 2018.07.19 13:14:06 LOG7[2]: Setting remote socket options (FD=2044) 2018.07.19 13:14:06 LOG7[2]: Option TCP_NODELAY set on remote socket 2018.07.19 13:14:06 LOG7[2]: Remote descriptor (FD=2044) initialized 2018.07.19 13:14:06 LOG6[2]: SNI: sending servername: xxx.xxx.xxx.xxx 2018.07.19 13:14:06 LOG6[2]: Peer certificate not required 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): before/connect initialization 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv2/v3 write client hello A 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv3 read server hello A 2018.07.19 13:14:06 LOG6[2]: Client certificate not requested 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv3 read server done A 2018.07.19 13:14:06 LOG6[2]: PSK client configured for identity "ï»¿user2" 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv3 write client key exchange A 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv3 write change cipher spec A 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv3 write finished A 2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv3 flush data 2018.07.19 13:14:06 LOG7[2]: TLS alert (read): fatal: bad record mac 2018.07.19 13:14:06 LOG3[2]: SSL_connect: 140943FC: error:140943FC:SSL routines:ssl3_read_bytes:sslv3 alert bad record mac 2018.07.19 13:14:06 LOG5[2]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.07.19 13:14:06 LOG7[2]: Deallocating application specific data for session connect address 2018.07.19 13:14:06 LOG7[2]: Remote descriptor (FD=2044) closed 2018.07.19 13:14:06 LOG7[2]: Local descriptor (FD=1880) closed 2018.07.19 13:14:06 LOG7[2]: Service [socks_client2] finished (0 left)

1 0

Loss of ability to use Stunnel-Blat, and a solution
by Roger Bohl 10 Jul '18

10 Jul '18

Early in 2018, around the time when I upgraded my system to Windows 10, the Stunnel and Blat files that had worked fine with my Vista PC would not work with the new PC. However, the "bug" turned out to be unrelated to the change in operating systems, but rather an "upgrade" to Gmail: Coincidentally, about that time, Gmail evidently decided to stop accepting e-mails from apps deemed "a less secure app", including Stunnel-Blat, with Blat then displaying messages: *** Warning *** The SMTP server did not accept Auth PLAIN value. *** Warning *** Are your login userid and password correct? *** Warning *** The SMTP server did not accept Auth LOGIN PASSWD value. Only a failure message sent to my "backup e-mail address" led me to explore this as a possible cause for what I had thought was, but turned out not to be, a Stunnel-Blat problem. Gmail has an option to suppress this heightened security feature, and when I activated this option, my Stunnel-Blat tools immediately began to function as intended. While I was at first able to enable Gmail to "Allow access from "less secure accounts," I have been unable to get through Gmail options consistently to turn this on and off and share this info with others. (I would welcome instructions that work consistently.) I would also welcome guidance on how to include Stunnel-Blat as a specific alllowed app, without having to enable Gmail to enable *all* "less secure apps" Roger Bohl

3 3

Re: [stunnel-users] Intermittent error in 042_inetd
by Eric S Eberhard 10 Jul '18

10 Jul '18

The 50% could be because the server side is not fully updated - we have this problem a lot with very large companies that should know better (and in reality should overlap instead of changing over - meaning allow SSLv3 for 3 months or something while also accepting TLSv2. A very good way to test is to get a telnet program. Then "telnent localhost port#" - the port # being the port number stunnel is running on. This will remove all variables except stunnel and allow you to see the output. It could be you are connecting fine and failing some other authentication like a login - which you can see often with telnet. And set your firewall to not allow telnet on port 23. Also, we have found stunnel MUCH more reliable under inetd (if you are on Unix of course) than as a stand-alone server. A little performance loss that is unnoticeable to us - big customers exchange 2-4 million XML documents a day (using stunnel) so inetd is definitely not the most efficient way, but the machines are so darn fast it seems not to matter. The certificates have become more painful but I have never had to use an official signed one. I make my own with openssl. However, there are intermediate ones that are needed from whomever you connect to if they have a signed certificate - say from Verisign - you may need your certificate and Verisigns, etc - in a chain. I use "cacert" to set to a large file of .pem certificates - which I simply download from the Web (available all over, some work, some don't. When you get one that works . then use it. You can modify them by adding anything not found in the file. Supposedly the cacert file I have now is good till 2020 for the big names. You can also use openssl to get the certificate from the server - just ask and you shall receive. It should have the entire chain. I used to have on massive cacert for everyone and it was getting out of hand. As tacky as it is, I just make a cacert.pem file for every connection (e.g. Walmart, Fedex, Target, whatever). This allows working connections to keep working while you fiddle with a tricky one. Eric Eric S Eberhard VICS (Vertical Integrated Computer Systems) Voice: 928 567 3529 Cell : 928 301 7537 (not reliable except for text or if not home) 2933 W Middle Verde Rd Camp Verde, AZ 86322 From: stunnel-users [mailto:[email protected]] On Behalf Of Ian Bamforth Sent: Wednesday, July 04, 2018 9:00 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Intermittent error in 042_inetd Afternoon, Until recently we'd disabled `make test` because of certificate problems - we've re-enabled it (using `make check`) but are getting intermittent failures (around 50% of CI runs). Below is the output from the logs - I can't see what's gone wrong, can anyone shed any light? 2018.07.04 09:59:36 LOG7[ui]: Clients allowed=14648 2018.07.04 09:59:36 LOG7[ui]: errno: (*__errno_location ()) 2018.07.04 09:59:36 LOG7[ui]: Compression disabled 2018.07.04 09:59:36 LOG7[ui]: No PRNG seeding was required 2018.07.04 09:59:36 LOG7[ui]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2018.07.04 09:59:36 LOG7[ui]: TLS options: 0x02004004 (+0x00004000, -0x00000000) 2018.07.04 09:59:36 LOG7[ui]: Private key check succeeded 2018.07.04 09:59:36 LOG7[ui]: ECDH initialization 2018.07.04 09:59:36 LOG7[ui]: ECDH initialized with curve prime256v1 2018.07.04 09:59:36 LOG7[ui]: Binding service [server] 2018.07.04 09:59:36 LOG7[ui]: Listening file descriptor created (FD=6) 2018.07.04 09:59:36 LOG7[ui]: Setting accept socket options (FD=6) 2018.07.04 09:59:36 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2018.07.04 09:59:36 LOG7[main]: Created pid file /opt/stunnel/stunnel-5.48/tests/logs/stunnel.pid 2018.07.04 09:59:36 LOG7[cron]: Cron thread initialized 2018.07.04 09:59:36 LOG7[main]: Found 1 ready file descriptor(s) 2018.07.04 09:59:36 LOG7[main]: FD=4 events=0x2001 revents=0x0 2018.07.04 09:59:36 LOG7[main]: FD=6 events=0x2001 revents=0x1 2018.07.04 09:59:36 LOG7[main]: Service [server] accepted (FD=3) from 127.0.0.1:58890 2018.07.04 09:59:36 LOG7[0]: Service [server] started 2018.07.04 09:59:36 LOG7[0]: Setting local socket options (FD=3) 2018.07.04 09:59:36 LOG7[0]: Option TCP_NODELAY set on local socket 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): before SSL initialization 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): before SSL initialization 2018.07.04 09:59:36 LOG7[0]: SNI: no virtual services defined 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS read client hello 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write server hello 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write certificate 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write key exchange 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write server done 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write server done 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS read client key exchange 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS read change cipher spec 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS read finished 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write change cipher spec 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write finished 2018.07.04 09:59:36 LOG7[0]: New session callback 2018.07.04 09:59:36 LOG7[0]: 1 server accept(s) requested 2018.07.04 09:59:36 LOG7[0]: 1 server accept(s) succeeded 2018.07.04 09:59:36 LOG7[0]: 0 server renegotiation(s) requested 2018.07.04 09:59:36 LOG7[0]: 0 session reuse(s) 2018.07.04 09:59:36 LOG7[0]: 1 internal session cache item(s) 2018.07.04 09:59:36 LOG7[0]: 0 internal session cache fill-up(s) 2018.07.04 09:59:36 LOG7[0]: 0 internal session cache miss(es) 2018.07.04 09:59:36 LOG7[0]: 0 external session cache hit(s) 2018.07.04 09:59:36 LOG7[0]: 0 expired session(s) retrieved 2018.07.04 09:59:36 LOG7[0]: Compression: null, expansion: null 2018.07.04 09:59:36 LOG7[0]: Setting remote socket options (FD=10) 2018.07.04 09:59:36 LOG7[0]: Option TCP_NODELAY set on remote socket 2018.07.04 09:59:36 LOG7[0]: Remote descriptor (FD=10) initialized 2018.07.04 09:59:36 LOG7[0]: TLS alert (read): warning: close notify 2018.07.04 09:59:36 LOG7[0]: Sent socket write shutdown 2018.07.04 09:59:36 LOG7[0]: Remote descriptor (FD=10) closed 2018.07.04 09:59:36 LOG7[0]: Local descriptor (FD=3) closed 2018.07.04 09:59:36 LOG7[0]: Service [server] finished (0 left) 2018.07.04 09:59:36 LOG7[main]: Found 1 ready file descriptor(s) 2018.07.04 09:59:36 LOG7[main]: FD=4 events=0x2001 revents=0x1 2018.07.04 09:59:36 LOG7[main]: FD=6 events=0x2001 revents=0x0 2018.07.04 09:59:36 LOG7[main]: Dispatching a signal from the signal pipe 2018.07.04 09:59:36 LOG7[main]: Processing SIGCHLD 2018.07.04 09:59:36 LOG7[main]: Retrieving pid statuses with waitpid() 2018.07.04 09:59:36 LOG7[ui]: Clients allowed=14648 2018.07.04 09:59:36 LOG7[ui]: errno: (*__errno_location ()) 2018.07.04 09:59:36 LOG7[ui]: Compression disabled 2018.07.04 09:59:36 LOG7[ui]: No PRNG seeding was required 2018.07.04 09:59:36 LOG7[ui]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2018.07.04 09:59:36 LOG7[ui]: TLS options: 0x02000004 (+0x00000000, -0x00000000) 2018.07.04 09:59:36 LOG7[ui]: No certificate or private key specified 2018.07.04 09:59:36 LOG7[0]: Service [inetd client] started 2018.07.04 09:59:36 LOG7[0]: s_connect: s_poll_wait 127.0.0.1:4433: waiting 10 seconds 2018.07.04 09:59:36 LOG7[0]: Setting remote socket options (FD=3) 2018.07.04 09:59:36 LOG7[0]: Option TCP_NODELAY set on remote socket 2018.07.04 09:59:36 LOG7[0]: Remote descriptor (FD=3) initialized 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): before SSL initialization 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write client hello 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write client hello 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read server hello 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read server certificate 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read server key exchange 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read server done 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write client key exchange 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write change cipher spec 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write finished 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write finished 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read change cipher spec 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read finished 2018.07.04 09:59:36 LOG7[0]: New session callback 2018.07.04 09:59:36 LOG7[0]: Peer certificate was cached (1241 bytes) 2018.07.04 09:59:36 LOG7[0]: 1 client connect(s) requested 2018.07.04 09:59:36 LOG7[0]: 1 client connect(s) succeeded 2018.07.04 09:59:36 LOG7[0]: 0 client renegotiation(s) requested 2018.07.04 09:59:36 LOG7[0]: 0 session reuse(s) 2018.07.04 09:59:36 LOG7[0]: Compression: null, expansion: null 2018.07.04 09:59:36 LOG7[0]: Sending close_notify alert 2018.07.04 09:59:36 LOG7[0]: TLS alert (write): warning: close notify 2018.07.04 09:59:36 LOG7[0]: Remote descriptor (FD=3) closed 2018.07.04 09:59:36 LOG7[0]: Service [inetd client] finished (0 left) 2018.07.04 09:59:36 LOG7[0]: Deallocating section defaults 2018.07.04 09:59:36 LOG7[main]: Found 1 ready file descriptor(s) 2018.07.04 09:59:36 LOG7[main]: FD=4 events=0x2001 revents=0x1 2018.07.04 09:59:36 LOG7[main]: FD=6 events=0x2001 revents=0x0 2018.07.04 09:59:36 LOG7[main]: Dispatching a signal from the signal pipe 2018.07.04 09:59:36 LOG7[main]: Processing SIGNAL_TERMINATE 2018.07.04 09:59:36 LOG7[main]: Leak detection table utilization: 86/997, 8.63% 2018.07.04 09:59:36 LOG7[main]: Removed pid file /opt/stunnel/stunnel-5.48/tests/logs/stunnel.pid 2018.07.04 09:59:36 LOG7[main]: Deallocating section defaults Regards, Ian Bamforth Senior Software Engineer Operations & Planning Systems Division T: <tel:00441133443970> +44 (0)113 344 3970 M: <tel:00447852404240> +44 (0)7852 404240 E: <mailto:[email protected]> Ian.Bamforth(a)tracsis.com W: <https://www.tracsis.com> www.tracsis.com <http://www.tracsisops.com> www.tracsisops.com Follow Us <https://www.linkedin.com/company/972873?trk=tyah&trkInfo=idx:1-1-1,tarId:14 20795682492,tas:tracsis> <https://www.twitter.com/tracsis> Tracsis plc Leeds Innovation Centre 103 Clarendon Road Leeds LS2 9DF <https://static.tracsis.com/email/award4.png> Tracsis Operations and Planning Systems Division is a Division of Tracsis plc and comprises Tracsis plc (05019106), Tracsis Rail Consultancy Limited (05047148), Safety Information Systems Limited trading as COMPASS (02588404) and Tracsis Retail and Operations Limited (04225250), all subsidiaries of Tracsis plc with a registered office at Leeds Innovation Centre,103 Clarendon Road, Leeds, LS2 9DF. VAT Registration No: 945 7876 61. This email and its attachments may be confidential and are intended solely for the use of the individual(s) to whom it is addressed. If you are not the intended recipient of this email and its attachments, you must take no action based upon them, nor must you copy or show them to anyone. Please contact the sender if you believe you have received this email in error.

2 1

Re: [stunnel-users] [EXTERNAL] Re: Stunnel connection issue?
by Eric S Eberhard 09 Jul '18

09 Jul '18

Exactly. Eric Eric S Eberhard VICS (Vertical Integrated Computer Systems) Voice: 928 567 3529 Cell : 928 301 7537 (not reliable except for text or if not home) 2933 W Middle Verde Rd Camp Verde, AZ 86322 -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of Peter Pentchev Sent: Thursday, July 05, 2018 5:47 AM To: Spies, Will <Will_Spies(a)comcast.com> Cc: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] [EXTERNAL] Re: Stunnel connection issue? On Thu, Jul 05, 2018 at 11:41:18AM +0000, Spies, Will wrote: > Thanks for the quick response. The client is an Echo Show device and > there is no log. It is an RTSP connection and my backend (behind > Stunnel) is Live555ProxyServer. I read somewhere there is some bug > related to MSIE that closed the connection like this and the fix is to > use TIMEOUTclose=0 which I did but this did not help. This is the > earlier (startup) portion of my log: Hi, Unfortunately, without more information about what the client doesn't like about the established connection, I don't think there is anything more I can help you with :( You *might* try playing with stunnel's cipher settings (OpenSSL options), on the off chance that the client is somewhat confused and offers for negotiation a cipher or something that it later realizes it cannot support... but that would be really weird. G'luck, Peter -- Peter Pentchev roam(a){ringlet.net,debian.org,FreeBSD.org} pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

1 0

Re: [stunnel-users] [EXTERNAL] Re: Stunnel connection issue?
by Eric S Eberhard 09 Jul '18

09 Jul '18

I should also point out that the cipher suite is related to openssl version stunnel is compiled with. Again, we had customers that connected with TLSv1.3 and then could not negotiate a cipher suite ... leading to lost connection. Make sure you update openssl first -- then compile stunnel. Eric Eric S Eberhard VICS (Vertical Integrated Computer Systems) Voice: 928 567 3529 Cell : 928 301 7537 (not reliable except for text or if not home) 2933 W Middle Verde Rd Camp Verde, AZ 86322 -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of Javier Sent: Monday, July 09, 2018 9:55 AM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] [EXTERNAL] Re: Stunnel connection issue? On Mon, 9 Jul 2018 12:26:08 +0000 Daniel Trickett <daniel.trickett(a)emdmillipore.com> wrote: > > Will, > > I was told to ignore the SSLv3 stuff in the log. I have options set to > allow only TLS1.2 and still see SSLv3 references in the log. > > Best regards, > > Dan Hi, in fact, the version can be disclosed from following lines in the log, where is told the cipher used, but not where you usually look: LOG6[1]: TLSv(1-1.1-1.2-1.3-whatever) ciphersuite: (whatever) Regards. _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Stunnel connection issue?
by Spies, Will 09 Jul '18

09 Jul '18

I've been trying to get Stunnel to work for some time now. I have avoided using the mail list - but I see no recourse now. I think I've tried just about every setting I could find. I appear to be getting a connection issue - but as you will see the log just doesn't indicate clearly what is going on. The behavior is my client is failing to get a connection through Stunnel to my backend. The log appears to be closing a socket (but can't tell which one frontend or backend). Nothing wrong happens up until a client connects - 443 binds fine and later a connection to my backend 554 appears to connect find. If someone/anyone can help direct me to how to trouble shoot this better I would greatly appreciate it. As you will see in the log - the client attempts twice to get through. An excerpt of my log and the conf is below. /etc/stunnel.conf: socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 output = /var/log/stunnel.log debug=7 [rtsp] cert = /etc/stunnel/stunnel.pem accept=192.168.112.16:443 connect=192.168.112.16:554 TIMEOUTclose = 0 TIMEOUTbusy = 5 TIMEOUTidle = 30 delay = yes sslVersion = TLSv1.2 /var/log/stunnel.log: 2018.07.05 05:31:01 LOG7[main]: Service [rtsp] accepted (FD=3) from 192.168.112.197:43869 2018.07.05 05:31:01 LOG7[5]: Service [rtsp] started 2018.07.05 05:31:01 LOG7[5]: Setting local socket options (FD=3) 2018.07.05 05:31:01 LOG7[5]: Option TCP_NODELAY set on local socket 2018.07.05 05:31:01 LOG5[5]: Service [rtsp] accepted connection from 192.168.112.197:43869 2018.07.05 05:31:01 LOG6[5]: Peer certificate not required 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): before SSL initialization 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): before SSL initialization 2018.07.05 05:31:01 LOG7[5]: SNI: no virtual services defined 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS read client hello 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS write server hello 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS write certificate 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS write key exchange 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS write server done 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS write server done 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS read client key exchange 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS read change cipher spec 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS read finished 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS write change cipher spec 2018.07.05 05:31:01 LOG7[5]: TLS state (accept): SSLv3/TLS write finished 2018.07.05 05:31:01 LOG7[5]: New session callback 2018.07.05 05:31:01 LOG6[5]: No peer certificate received 2018.07.05 05:31:01 LOG7[5]: 6 server accept(s) requested 2018.07.05 05:31:01 LOG7[5]: 3 server accept(s) succeeded 2018.07.05 05:31:01 LOG7[5]: 0 server renegotiation(s) requested 2018.07.05 05:31:01 LOG7[5]: 0 session reuse(s) 2018.07.05 05:31:01 LOG7[5]: 3 internal session cache item(s) 2018.07.05 05:31:01 LOG7[5]: 0 internal session cache fill-up(s) 2018.07.05 05:31:01 LOG7[5]: 0 internal session cache miss(es) 2018.07.05 05:31:01 LOG7[5]: 0 external session cache hit(s) 2018.07.05 05:31:01 LOG7[5]: 0 expired session(s) retrieved 2018.07.05 05:31:01 LOG6[5]: TLS accepted: new session negotiated 2018.07.05 05:31:01 LOG6[5]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.07.05 05:31:01 LOG7[5]: Compression: null, expansion: null 2018.07.05 05:31:01 LOG6[5]: s_connect: connecting 192.168.112.16:554 2018.07.05 05:31:01 LOG7[5]: s_connect: s_poll_wait 192.168.112.16:554: waiting 10 seconds 2018.07.05 05:31:01 LOG5[5]: s_connect: connected 192.168.112.16:554 2018.07.05 05:31:01 LOG6[5]: persistence: 192.168.112.16:554 cached 2018.07.05 05:31:01 LOG5[5]: Service [rtsp] connected remote server from 192.168.112.16:58594 2018.07.05 05:31:01 LOG7[5]: Setting remote socket options (FD=9) 2018.07.05 05:31:01 LOG7[5]: Option TCP_NODELAY set on remote socket 2018.07.05 05:31:01 LOG7[5]: Remote descriptor (FD=9) initialized 2018.07.05 05:31:02 LOG6[5]: TLS socket closed (SSL_read) 2018.07.05 05:31:02 LOG7[5]: Sent socket write shutdown 2018.07.05 05:31:02 LOG5[5]: Connection closed: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.07.05 05:31:02 LOG7[5]: Remote descriptor (FD=9) closed 2018.07.05 05:31:02 LOG7[5]: Local descriptor (FD=3) closed 2018.07.05 05:31:02 LOG7[5]: Service [rtsp] finished (0 left) 2018.07.05 05:31:02 LOG7[main]: Found 1 ready file descriptor(s) 2018.07.05 05:31:02 LOG7[main]: FD=4 events=0x2001 revents=0x0 2018.07.05 05:31:02 LOG7[main]: FD=7 events=0x2001 revents=0x1 2018.07.05 05:31:02 LOG7[main]: Service [rtsp] accepted (FD=3) from 192.168.112.197:43870 2018.07.05 05:31:02 LOG7[6]: Service [rtsp] started 2018.07.05 05:31:02 LOG7[6]: Setting local socket options (FD=3) 2018.07.05 05:31:02 LOG7[6]: Option TCP_NODELAY set on local socket 2018.07.05 05:31:02 LOG5[6]: Service [rtsp] accepted connection from 192.168.112.197:43870 2018.07.05 05:31:02 LOG6[6]: Peer certificate not required 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): before SSL initialization 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): before SSL initialization 2018.07.05 05:31:02 LOG7[6]: SNI: no virtual services defined 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS read client hello 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS write server hello 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS write certificate 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS write key exchange 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS write server done 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS write server done 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS read client key exchange 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS read change cipher spec 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS read finished 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS write change cipher spec 2018.07.05 05:31:02 LOG7[6]: TLS state (accept): SSLv3/TLS write finished 2018.07.05 05:31:02 LOG7[6]: New session callback 2018.07.05 05:31:02 LOG6[6]: No peer certificate received 2018.07.05 05:31:02 LOG7[6]: 7 server accept(s) requested 2018.07.05 05:31:02 LOG7[6]: 4 server accept(s) succeeded 2018.07.05 05:31:02 LOG7[6]: 0 server renegotiation(s) requested 2018.07.05 05:31:02 LOG7[6]: 0 session reuse(s) 2018.07.05 05:31:02 LOG7[6]: 4 internal session cache item(s) 2018.07.05 05:31:02 LOG7[6]: 0 internal session cache fill-up(s) 2018.07.05 05:31:02 LOG7[6]: 0 internal session cache miss(es) 2018.07.05 05:31:02 LOG7[6]: 0 external session cache hit(s) 2018.07.05 05:31:02 LOG7[6]: 0 expired session(s) retrieved 2018.07.05 05:31:02 LOG6[6]: TLS accepted: new session negotiated 2018.07.05 05:31:02 LOG6[6]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.07.05 05:31:02 LOG7[6]: Compression: null, expansion: null 2018.07.05 05:31:02 LOG6[6]: s_connect: connecting 192.168.112.16:554 2018.07.05 05:31:02 LOG7[6]: s_connect: s_poll_wait 192.168.112.16:554: waiting 10 seconds 2018.07.05 05:31:02 LOG5[6]: s_connect: connected 192.168.112.16:554 2018.07.05 05:31:02 LOG6[6]: persistence: 192.168.112.16:554 cached 2018.07.05 05:31:02 LOG5[6]: Service [rtsp] connected remote server from 192.168.112.16:58596 2018.07.05 05:31:02 LOG7[6]: Setting remote socket options (FD=9) 2018.07.05 05:31:02 LOG7[6]: Option TCP_NODELAY set on remote socket 2018.07.05 05:31:02 LOG7[6]: Remote descriptor (FD=9) initialized 2018.07.05 05:31:02 LOG6[6]: TLS socket closed (SSL_read) 2018.07.05 05:31:02 LOG7[6]: Sent socket write shutdown 2018.07.05 05:31:02 LOG5[6]: Connection closed: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.07.05 05:31:02 LOG7[6]: Remote descriptor (FD=9) closed 2018.07.05 05:31:02 LOG7[6]: Local descriptor (FD=3) closed 2018.07.05 05:31:02 LOG7[6]: Service [rtsp] finished (0 left) 2018.07.05 05:31:05 LOG7[main]: Found 1 ready file descriptor(s) 2018.07.05 05:31:05 LOG7[main]: FD=4 events=0x2001 revents=0x0 2018.07.05 05:31:05 LOG7[main]: FD=7 events=0x2001 revents=0x1

6 12

Fwd: stunnel-users Digest, Vol 168, Issue 2
by Avinash Kumar 05 Jul '18

05 Jul '18

Regards, Avinash Kumar ---------- Forwarded message ---------- From: Avinash Kumar <avinash14331(a)gmail.com> Date: Wed, Jul 4, 2018 at 11:59 AM Subject: Re: [stunnel-users] stunnel-users Digest, Vol 168, Issue 2 To: "Jose Alf." <josealf(a)rocketmail.com> Hi, I commented sslVersion but still getting the same issue. Please find below my configuration details for both client and server: Server conf: Client Conf: Regards, Avinash Kumar On Tue, Jul 3, 2018 at 6:26 PM, Jose Alf. <josealf(a)rocketmail.com> wrote: > Kumar, > > Probably you are trying to connect to a server that dos not allow TLs > v1.0m a protocol that has been deprecated. Please Comment out the > sslVersion line and try again. > > regards, > > Jose > > > > On Tuesday, July 3, 2018, 6:37:53 AM GMT-5, Avinash Kumar < > avinash14331(a)gmail.com> wrote: > > > Hi, > > As requested, Posting my configuration. > [https-App-setup] client = yes accept = 9898 connect = > <<source-ipaddress>>:9898 cert = <<stunnel-installationdirectory>>\config\App\morpheus.pem > key = <<stunnel-installationdirectory>>\config\App\morpheus.key CAfile = > <<stunnel-installationdirectory>>\config\App\root-ca.pem sslVersion = > TLSv1 options = NO_SSLv3 > > > Regards, > Avinash Kumar > > On Tue, Jul 3, 2018 at 3:30 PM, <stunnel-users-request(a)stunnel.org> wrote: > > Send stunnel-users mailing list submissions to > stunnel-users(a)stunnel.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.stunnel.org/cgi- bin/mailman/listinfo/stunnel- users > <https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users> > or, via email, send a message with subject or body 'help' to > stunnel-users-request@stunnel. org > <stunnel-users-request(a)stunnel.org> > > You can reach the person managing the list at > stunnel-users-owner@stunnel. org <stunnel-users-owner(a)stunnel.org> > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. Re: Stunnel Issue (Flo Rance) > > > ------------------------------ ------------------------------ ---------- > > Message: 1 > Date: Tue, 3 Jul 2018 11:18:03 +0200 > From: Flo Rance <trourance(a)gmail.com> > To: Avinash Kumar <avinash14331(a)gmail.com> > Cc: stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] Stunnel Issue > Message-ID: > <CAHogYcUn6BzfBr75X- DuteetppESv2KOjGJmGO7mc=SuHVaE > Xw(a)mail.gmail.com <SuHVaEXw(a)mail.gmail.com>> > Content-Type: text/plain; charset="utf-8" > > Please post your configuration. Without that, it's not obvious. > > Regards, > Flo > > On Tue, Jul 3, 2018 at 10:42 AM, Avinash Kumar <avinash14331(a)gmail.com> > wrote: > > > Attaching the screenshot > > > > Regards, > > Avinash Kumar > > > > On Tue, Jul 3, 2018 at 2:11 PM, Avinash Kumar <avinash14331(a)gmail.com> > > wrote: > > > >> Hi, > >> > >> I am getting below error while connecting through stunnel: > >> > >> > >> > >> Regards, > >> Avinash Kumar > >> > > > > > > ______________________________ _________________ > > stunnel-users mailing list > > stunnel-users(a)stunnel.org > > https://www.stunnel.org/cgi- bin/mailman/listinfo/stunnel- users > <https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users> > > > > >

3 3

Intermittent error in 042_inetd
by Ian Bamforth 04 Jul '18

04 Jul '18

Afternoon, Until recently we'd disabled `make test` because of certificate problems - we've re-enabled it (using `make check`) but are getting intermittent failures (around 50% of CI runs). Below is the output from the logs - I can't see what's gone wrong, can anyone shed any light? 2018.07.04 09:59:36 LOG7[ui]: Clients allowed=14648 2018.07.04 09:59:36 LOG7[ui]: errno: (*__errno_location ()) 2018.07.04 09:59:36 LOG7[ui]: Compression disabled 2018.07.04 09:59:36 LOG7[ui]: No PRNG seeding was required 2018.07.04 09:59:36 LOG7[ui]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2018.07.04 09:59:36 LOG7[ui]: TLS options: 0x02004004 (+0x00004000, -0x00000000) 2018.07.04 09:59:36 LOG7[ui]: Private key check succeeded 2018.07.04 09:59:36 LOG7[ui]: ECDH initialization 2018.07.04 09:59:36 LOG7[ui]: ECDH initialized with curve prime256v1 2018.07.04 09:59:36 LOG7[ui]: Binding service [server] 2018.07.04 09:59:36 LOG7[ui]: Listening file descriptor created (FD=6) 2018.07.04 09:59:36 LOG7[ui]: Setting accept socket options (FD=6) 2018.07.04 09:59:36 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2018.07.04 09:59:36 LOG7[main]: Created pid file /opt/stunnel/stunnel-5.48/tests/logs/stunnel.pid 2018.07.04 09:59:36 LOG7[cron]: Cron thread initialized 2018.07.04 09:59:36 LOG7[main]: Found 1 ready file descriptor(s) 2018.07.04 09:59:36 LOG7[main]: FD=4 events=0x2001 revents=0x0 2018.07.04 09:59:36 LOG7[main]: FD=6 events=0x2001 revents=0x1 2018.07.04 09:59:36 LOG7[main]: Service [server] accepted (FD=3) from 127.0.0.1:58890 2018.07.04 09:59:36 LOG7[0]: Service [server] started 2018.07.04 09:59:36 LOG7[0]: Setting local socket options (FD=3) 2018.07.04 09:59:36 LOG7[0]: Option TCP_NODELAY set on local socket 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): before SSL initialization 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): before SSL initialization 2018.07.04 09:59:36 LOG7[0]: SNI: no virtual services defined 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS read client hello 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write server hello 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write certificate 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write key exchange 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write server done 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write server done 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS read client key exchange 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS read change cipher spec 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS read finished 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write change cipher spec 2018.07.04 09:59:36 LOG7[0]: TLS state (accept): SSLv3/TLS write finished 2018.07.04 09:59:36 LOG7[0]: New session callback 2018.07.04 09:59:36 LOG7[0]: 1 server accept(s) requested 2018.07.04 09:59:36 LOG7[0]: 1 server accept(s) succeeded 2018.07.04 09:59:36 LOG7[0]: 0 server renegotiation(s) requested 2018.07.04 09:59:36 LOG7[0]: 0 session reuse(s) 2018.07.04 09:59:36 LOG7[0]: 1 internal session cache item(s) 2018.07.04 09:59:36 LOG7[0]: 0 internal session cache fill-up(s) 2018.07.04 09:59:36 LOG7[0]: 0 internal session cache miss(es) 2018.07.04 09:59:36 LOG7[0]: 0 external session cache hit(s) 2018.07.04 09:59:36 LOG7[0]: 0 expired session(s) retrieved 2018.07.04 09:59:36 LOG7[0]: Compression: null, expansion: null 2018.07.04 09:59:36 LOG7[0]: Setting remote socket options (FD=10) 2018.07.04 09:59:36 LOG7[0]: Option TCP_NODELAY set on remote socket 2018.07.04 09:59:36 LOG7[0]: Remote descriptor (FD=10) initialized 2018.07.04 09:59:36 LOG7[0]: TLS alert (read): warning: close notify 2018.07.04 09:59:36 LOG7[0]: Sent socket write shutdown 2018.07.04 09:59:36 LOG7[0]: Remote descriptor (FD=10) closed 2018.07.04 09:59:36 LOG7[0]: Local descriptor (FD=3) closed 2018.07.04 09:59:36 LOG7[0]: Service [server] finished (0 left) 2018.07.04 09:59:36 LOG7[main]: Found 1 ready file descriptor(s) 2018.07.04 09:59:36 LOG7[main]: FD=4 events=0x2001 revents=0x1 2018.07.04 09:59:36 LOG7[main]: FD=6 events=0x2001 revents=0x0 2018.07.04 09:59:36 LOG7[main]: Dispatching a signal from the signal pipe 2018.07.04 09:59:36 LOG7[main]: Processing SIGCHLD 2018.07.04 09:59:36 LOG7[main]: Retrieving pid statuses with waitpid() 2018.07.04 09:59:36 LOG7[ui]: Clients allowed=14648 2018.07.04 09:59:36 LOG7[ui]: errno: (*__errno_location ()) 2018.07.04 09:59:36 LOG7[ui]: Compression disabled 2018.07.04 09:59:36 LOG7[ui]: No PRNG seeding was required 2018.07.04 09:59:36 LOG7[ui]: Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK 2018.07.04 09:59:36 LOG7[ui]: TLS options: 0x02000004 (+0x00000000, -0x00000000) 2018.07.04 09:59:36 LOG7[ui]: No certificate or private key specified 2018.07.04 09:59:36 LOG7[0]: Service [inetd client] started 2018.07.04 09:59:36 LOG7[0]: s_connect: s_poll_wait 127.0.0.1:4433: waiting 10 seconds 2018.07.04 09:59:36 LOG7[0]: Setting remote socket options (FD=3) 2018.07.04 09:59:36 LOG7[0]: Option TCP_NODELAY set on remote socket 2018.07.04 09:59:36 LOG7[0]: Remote descriptor (FD=3) initialized 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): before SSL initialization 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write client hello 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write client hello 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read server hello 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read server certificate 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read server key exchange 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read server done 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write client key exchange 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write change cipher spec 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write finished 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS write finished 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read change cipher spec 2018.07.04 09:59:36 LOG7[0]: TLS state (connect): SSLv3/TLS read finished 2018.07.04 09:59:36 LOG7[0]: New session callback 2018.07.04 09:59:36 LOG7[0]: Peer certificate was cached (1241 bytes) 2018.07.04 09:59:36 LOG7[0]: 1 client connect(s) requested 2018.07.04 09:59:36 LOG7[0]: 1 client connect(s) succeeded 2018.07.04 09:59:36 LOG7[0]: 0 client renegotiation(s) requested 2018.07.04 09:59:36 LOG7[0]: 0 session reuse(s) 2018.07.04 09:59:36 LOG7[0]: Compression: null, expansion: null 2018.07.04 09:59:36 LOG7[0]: Sending close_notify alert 2018.07.04 09:59:36 LOG7[0]: TLS alert (write): warning: close notify 2018.07.04 09:59:36 LOG7[0]: Remote descriptor (FD=3) closed 2018.07.04 09:59:36 LOG7[0]: Service [inetd client] finished (0 left) 2018.07.04 09:59:36 LOG7[0]: Deallocating section defaults 2018.07.04 09:59:36 LOG7[main]: Found 1 ready file descriptor(s) 2018.07.04 09:59:36 LOG7[main]: FD=4 events=0x2001 revents=0x1 2018.07.04 09:59:36 LOG7[main]: FD=6 events=0x2001 revents=0x0 2018.07.04 09:59:36 LOG7[main]: Dispatching a signal from the signal pipe 2018.07.04 09:59:36 LOG7[main]: Processing SIGNAL_TERMINATE 2018.07.04 09:59:36 LOG7[main]: Leak detection table utilization: 86/997, 8.63% 2018.07.04 09:59:36 LOG7[main]: Removed pid file /opt/stunnel/stunnel-5.48/tests/logs/stunnel.pid 2018.07.04 09:59:36 LOG7[main]: Deallocating section defaults Regards, Ian Bamforth Senior Software Engineer Operations & Planning Systems Division T: +44 (0)113 344 3970<tel:00441133443970> M: +44 (0)7852 404240<tel:00447852404240> E: Ian.Bamforth(a)tracsis.com<mailto:[email protected]> W: www.tracsis.com<https://www.tracsis.com> www.tracsisops.com<http://www.tracsisops.com> Follow Us [https://static.tracsis.com/email/lin2.png]<https://www.linkedin.com/company/972873?trk=tyah&trkInfo=idx:1-1-1,tarId:14…> [https://static.tracsis.com/email/twi2.png] <https://www.twitter.com/tracsis> Tracsis plc Leeds Innovation Centre 103 Clarendon Road Leeds LS2 9DF [https://static.tracsis.com/email/award4.png] Tracsis Operations and Planning Systems Division is a Division of Tracsis plc and comprises Tracsis plc (05019106), Tracsis Rail Consultancy Limited (05047148), Safety Information Systems Limited trading as COMPASS (02588404) and Tracsis Retail and Operations Limited (04225250), all subsidiaries of Tracsis plc with a registered office at Leeds Innovation Centre,103 Clarendon Road, Leeds, LS2 9DF. VAT Registration No: 945 7876 61. This email and its attachments may be confidential and are intended solely for the use of the individual(s) to whom it is addressed. If you are not the intended recipient of this email and its attachments, you must take no action based upon them, nor must you copy or show them to anyone. Please contact the sender if you believe you have received this email in error.

1 0

stunnel on Windows - using CAPI - tls v1.2?==?utf-8?q? ?
by Brian Ipsen 04 Jul '18

04 Jul '18

Hi Does anyone know whether there is a fix pending for being able to use the Windows built-in certificate store (by CAPI) for client authentication - and using TLS v1.2 ? Currently I need to force the stunnel client to use TLS v1.1, as there seem to be a limitation somewhere if using TLS v1.2... Regards Brian

1 0

tls linger
by Daniel Trickett 03 Jul '18

03 Jul '18

Hi, We are using stunnel to allow us to punchout to suppliers using TLS 1.2 protocol. We are seeing the following with this particular supplier. 2018.07.02 08:49:05 LOG6[4]: TLS connected: previous session reused 2018.07.02 08:49:05 LOG6[4]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-SHA384 (256-bit encryption) 2018.07.02 08:49:05 LOG7[4]: Compression: null, expansion: null 2018.07.02 08:49:15 LOG3[4]: SSL_read: Connection reset by peer (131) 2018.07.02 08:49:15 LOG5[4]: Connection reset: 1720 byte(s) sent to TLS, 0 byte(s) sent to socket 2018.07.02 08:49:15 LOG7[4]: linger (remote): Invalid argument (22) 2018.07.02 08:49:15 LOG7[4]: Remote descriptor (FD=13) closed 2018.07.02 08:49:15 LOG7[4]: Local descriptor (FD=3) closed 2018.07.02 08:49:15 LOG7[4]: Service [dell-https] finished (0 left) We have set socket = l:SO_LINGER=1:60, but still occasionally have an issue. Is there anything else that we may need to set? Since the below is default, would not expect to set it.. socket = a:SO_REUSEADDR=no disable address reuse (enabled by default) Best regards, Dan This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click http://www.emdgroup.com/emd/imprint/mail_disclaimer.html to access the German, French, Spanish and Portuguese versions of this disclaimer.

1 0

Re: [stunnel-users] stunnel-users Digest, Vol 168, Issue 2
by Avinash Kumar 03 Jul '18

03 Jul '18

Hi, As requested, Posting my configuration. [https-App-setup] client = yes accept = 9898 connect = <<source-ipaddress>>:9898 cert = <<stunnel-installationdirectory>>\config\App\morpheus.pem key = <<stunnel-installationdirectory>>\config\App\morpheus.key CAfile = <<stunnel-installationdirectory>>\config\App\root-ca.pem sslVersion = TLSv1 options = NO_SSLv3 Regards, Avinash Kumar On Tue, Jul 3, 2018 at 3:30 PM, <stunnel-users-request(a)stunnel.org> wrote: > Send stunnel-users mailing list submissions to > stunnel-users(a)stunnel.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)stunnel.org > > You can reach the person managing the list at > stunnel-users-owner(a)stunnel.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. Re: Stunnel Issue (Flo Rance) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 3 Jul 2018 11:18:03 +0200 > From: Flo Rance <trourance(a)gmail.com> > To: Avinash Kumar <avinash14331(a)gmail.com> > Cc: stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] Stunnel Issue > Message-ID: > <CAHogYcUn6BzfBr75X-DuteetppESv2KOjGJmGO7mc=SuHVaE > Xw(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > Please post your configuration. Without that, it's not obvious. > > Regards, > Flo > > On Tue, Jul 3, 2018 at 10:42 AM, Avinash Kumar <avinash14331(a)gmail.com> > wrote: > > > Attaching the screenshot > > > > Regards, > > Avinash Kumar > > > > On Tue, Jul 3, 2018 at 2:11 PM, Avinash Kumar <avinash14331(a)gmail.com> > > wrote: > > > >> Hi, > >> > >> I am getting below error while connecting through stunnel: > >> > >> > >> > >> Regards, > >> Avinash Kumar > >> > > > > > > _______________________________________________ > > stunnel-users mailing list > > stunnel-users(a)stunnel.org > > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > > > > >

2 1

Stunnel Issue
by Avinash Kumar 03 Jul '18

03 Jul '18

Hi, I am getting below error while connecting through stunnel: Regards, Avinash Kumar

2 2

stunnel 5.48 released
by Michal Trojnara 02 Jul '18

02 Jul '18

Dear Users, I have released version 5.48 of stunnel. Version 5.48, 2018.07.02, urgency: HIGH * Security bugfixes - Fixed requesting client certificate when specified as a global option. * New features - Certificate subject checks modified to accept certificates if at least one of the specified checks matches. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 1011d5a302ce6a227882d094282993a3187250f42f8a801dcc1620da63b2b8df stunnel-5.48.tar.gz eb160fdf28061eb509e09824ab9cd26f4f0ca9be3b90008bba32274d5136c7eb stunnel-5.48-win32-installer.exe 667ee8c8d5440117285eb5a5ddf0d305a6dd1dbb93dcf5b7bac62f84ddba7466 stunnel-5.48-android.zip Best regards, Mike

1 0

tls question
by Daniel Trickett 02 Jul '18

02 Jul '18

Hi, If I use stunnel 5.44, how do I know that the protocol being used is TLS1.2? Is it the default? Working with supplier sites which still accept 1.0/1.1, but want to make sure that I am using 1.2, as they will be disabling the older protocols. Thanks and Best regards, Dan This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click http://www.emdgroup.com/emd/imprint/mail_disclaimer.html to access the German, French, Spanish and Portuguese versions of this disclaimer.

4 3

Potentially dangerous change of behavior in handling "global option" in stunnel after version 5.45
by Tony Cheneau 29 Jun '18

29 Jun '18

Hello everyone, I was updating my version of stunnel and playing my regression suite and I was surprised to see some tests fail. We usually apply "verify = 2" as global option at the beginning of the configuration file on our stunnel "server" so as to enforce the client certificate verification. So I was a little bit surprise to see I could establish a TLS connection with my test server without providing a client certificate. The "verify = 2" as a "global option" is parsed at some point, because I can trigger an error message if I place a bogus value ("verify = 8"). Yet, it seems to be ignored when accepting connections. If I move the "verify = 2" from the "global option" to a service-level option for a specific service/tunnel, it works as expected (and documented): it rejects my certificate-less client. After a little bit of investigation, I was able to narrow down the change of behavior in version 5.45 (meaning that 5.44 still follow the old behavior). All the newer version follow this new behavior. I haven't seen any public CVS/SVN/git for stunnel, so I was not able to narrow it down further and I could not identify the exact change in the code that modified the behavior. While I understand that this option is documented in the manpage as a service-level option, in practice, "verify" could be used as a global option for years (my oldest documented usage at my company dates back from stunnel 4.54). (I know this option is going to be replaced by verifyChain/requireCert, the observed behavior reported in this email also applies on these options: they can't be applied program wide as a "global option") Am I missing something obvious here ? I haven't seen the change documented in the changelog, so it looks like a regression to me. Thank you in advance (and thank you for the great piece of software, obviously!). Regards, Tony Cheneau

1 0

Re: [stunnel-users] stunnel 5.47 released
by Eric S Eberhard 28 Jun '18

28 Jun '18

Query -- how does this relate to TLSv1.3 and the alpha version (which is not going to work with the final version -- and does not exist I think) -- and what version of openssl do you recommend? Thanks, Eric Eric S Eberhard VICS (Vertical Integrated Computer Systems) Voice: 928 567 3529 Cell : 928 301 7537 (not reliable except for text or if not home) 2933 W Middle Verde Rd Camp Verde, AZ 86322 -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of Michal Trojnara Sent: Friday, June 22, 2018 11:10 PM To: stunnel-users(a)stunnel.org; stunnel-announce(a)stunnel.org; openssl-users(a)openssl.org Subject: [stunnel-users] stunnel 5.47 released Dear Users, I have released version 5.47 of stunnel. Version 5.47, 2018.06.23, urgency: HIGH * New features - Fast add_lock_callback for OpenSSL < 1.1.0. This largely improves performance on heavy load. - Automatic detection of Homebrew OpenSSL. - Clarified port binding error logs. - Various "make test" improvements. * Bugfixes - Fixed a crash on switching to SNI slave sections. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: c4e675db996eb92beef885f72a3ed8af3c7603fea6b99d2873198dd6c0021d0b stunnel-5.47.tar.gz 985e1d65a3f4a7599cc78630960e1b2c97981f91ce6bc41f2eefcd371b4067a3 stunnel-5.47-win32-installer.exe 309cfb79329448f0c134aece0d10d0737e3728b25c288e9a76650837cd6f839c stunnel-5.47-android.zip Best regards, Mike

1 0

question regarding TLS connection.
by Daniel Trickett 26 Jun '18

26 Jun '18

Hi We are using stunnel 5.44. We are having an issue connecting with a customer who is not supporting TLS 1.1, only 1.2 and 1.3. When I look in the log, I see the following. Why do I see the SSLv3 note in the line? The below leads me to believe that we connect to the customer, but they say that we are not. 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 read server certificate A 2018.06.25 11:37:24 LOG6[7]: Client certificate not requested 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 read server done A 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 write client key exchange A 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 write change cipher spec A 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 write finished A 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 flush data 2018.06.25 11:37:24 LOG7[7]: TLS state (connect): SSLv3 read finished A 2018.06.25 11:37:24 LOG7[7]: 1 client connect(s) requested 2018.06.25 11:37:24 LOG7[7]: 1 client connect(s) succeeded 2018.06.25 11:37:24 LOG7[7]: 0 client renegotiation(s) requested 2018.06.25 11:37:24 LOG7[7]: 0 session reuse(s) 2018.06.25 11:37:24 LOG6[7]: TLS connected: new session negotiated Best regards, Dan Daniel Trickett Head of Database Services | MBS Business Technology BX-TCS-O Oracle ERP Business Services of Merck KGaA, Darmstadt, Germany Planned Absence - 7/2/2018 - 7/6/2018 MilliporeSigma A business of Merck KGaA, Darmstadt, Germany EMD Millipore Corporation | 80 Ashby Road | Bedford, MA 01730 | USA office 781-533-3017 |cell 978-761-3506 |email daniel.trickett(a)emdmillipore.com<mailto:[email protected]> This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click http://www.emdgroup.com/emd/imprint/mail_disclaimer.html to access the German, French, Spanish and Portuguese versions of this disclaimer.

2 1

stunnel 5.47 released
by Michal Trojnara 23 Jun '18

23 Jun '18

Dear Users, I have released version 5.47 of stunnel. Version 5.47, 2018.06.23, urgency: HIGH * New features - Fast add_lock_callback for OpenSSL < 1.1.0. This largely improves performance on heavy load. - Automatic detection of Homebrew OpenSSL. - Clarified port binding error logs. - Various "make test" improvements. * Bugfixes - Fixed a crash on switching to SNI slave sections. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: c4e675db996eb92beef885f72a3ed8af3c7603fea6b99d2873198dd6c0021d0b stunnel-5.47.tar.gz 985e1d65a3f4a7599cc78630960e1b2c97981f91ce6bc41f2eefcd371b4067a3 stunnel-5.47-win32-installer.exe 309cfb79329448f0c134aece0d10d0737e3728b25c288e9a76650837cd6f839c stunnel-5.47-android.zip Best regards, Mike

2 1

Stunnel 5.45 and 5.46 crashes upon reconnect HTTPS
by Javier 22 Jun '18

22 Jun '18

Hi, isn't annoying when you are using an old version, 5.44, and all goes fine, you notice you are outdated and then comes the problems after update? :-P The thing is that yesterday I needed the HTTPS server so I run Stunnel 5.44 for my non-SSL app and all was fine. I updated to 5.46 just because I forgot the last time and didn't even run again because I didn't need it. Today I used it and... I had a crash. I tested 5.45 to trace versions back, and it crashes as well. Back to 5.44 and no crash. The crash happens when there is a reload/reconnect/multiconnect (example, 2 connections html+images) by the browser when connects to an HTTPS server. It only happens when using a SNI service. I've been able to trace back the log on those versions and when fails in 5.45 and 5.46 is at the time when it needs to switch to the SNI service. (log from 5.44) SNI: requested servername: xxx SNI: matched pattern: xxx SNI: switched to service [xxx] <<<<----- BEFORE SWITCH, IT CRASHES on 5.45 and 5.46 Imagine you load https://xxx/. The first time is fine, the second, crashes stunnel. Not happening with 5.44. I haven't seen any change to SNI in manual so... :-? These are the configs for the used virtual servers. Nothing has been changed, anyway: [SSL] client = no accept = y.y.y.1:4747 connect = y.y.y.2:443 [SSL-xxx-SNI] client = no sni = SSL:xxx connect = y.y.y.2:443 cert = pem key = pem Don't mind the port numbers. They aren't in conflict. Running on Windows 2000. Regards.

3 4

Reg : Stunnel + RSYNC Usage with TLSv1.2
by Sakthivel Ganesamoorthy 20 Jun '18

20 Jun '18

Hi, I have configured a server and client for Stunnel + Rsync usage over TLSv1.2. It is working fine, but I wanted to verify the "Cipher Key" exchange mechanism between "Server & Client" via "Wireshark". When I captured the logs via "Wireshark", it shows everything as TCP messages and I don't see any "Client Hello message (or) Cipher Key exchange message (or) any of the TLSv1.2" handshake messages. Please let me know whether I'm missing something here. Thanks, Sakthi

1 0

stunnel used as jump host for SFTP
by Schultz, Cecilia 20 Jun '18

20 Jun '18

Hello, I am trying to test stunnel to see if it can provide the functionality we need. We are a Windows shop. What we need is for multiple client machines (I call these C1, C2, C3) to connect to our server (S). Server S will connect to a remote SFTP server (port 22). I call the remote SFTP server "R". C1, C2, C3 and S are all inside our firewall. Currently S can connect and send files to R using SFTP (port 22). The problem is that R does not accept a range of IP addresses, and has a limit on the number of IP addresses they can accept. So, what I need is for C1, C2, C3 to be able to connect to server R using S as a jump host. >From R's perspective, it should be like the connection is coming from S. Question 1: can stunnel be used to accomplish this? Question 2: I have installed stunnel in a test server ("stunnel -install" actually from the bin folder), and configured the conf like this: [sftp] accept=127.0.0.1:22 connect=some.remote.server.com:22 I tried to use Winscp SFTP client to test a connection, but it times out. I then checked S, and I don't see anything listening on port 22. I did "netstat -a" and I don't see anything listening on port 22. Was something wrong in the "stunnel -install" command? Shouldn't it be listening on port 22? Also, I uncommented the entry for log, but I don't see any log file in the stunnel folder/subfolders ; Debugging stuff (may be useful for troubleshooting) debug = info output = stunnel.log Thanks for your help, Cecilia

3 3

Re: [stunnel-users] stunnel used as jump host for SFTP
by Schultz, Cecilia 20 Jun '18

20 Jun '18

Thank you so much for the info! I will try this out. From: stunnel-users <stunnel-users-bounces(a)stunnel.org> On Behalf Of Harris, Douglas (SSC/SPC) Sent: Wednesday, June 20, 2018 5:08 AM To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] stunnel used as jump host for SFTP You can accomplish this in Windows. Just add a port forwarding rule to S: netsh interface portproxy add v4tov4 listenport=22 listenaddress=[IP of S] connectport=22 connectaddress=[IP of R] -Doug

1 0

stunnel PSK support via custome openssl engine
by Tarakeshwar Rao 14 Jun '18

14 Jun '18

Dear Stunnel-users, >From Stunnel man pages, I could see that we could read PSK secret from plain text file with following option: PSKsecrets = psk.txt Could it possible to use custom openssl engine to read PSK file from HSM. I know that this works for reading TLS keys. I am not sure how I could do it for PSK. Thanks for your support, Regards, Tarak

1 0

is it possible to make stunnel works for dbmail timsieved?
by cktmwe＠gmail.com 12 Jun '18

12 Jun '18

hello everyone, I'm currently try to stunnel sieve traffic to local dbmail timsieved, unfortunately I couldn't get it to work, my first question, does stunnel support sieve manage protocol? secondly if it does, how can I config the service? what I've done so far. timsieved started on 127.0.0.1:2000, connect and manage all works, I saw connection in dbmail log, then define sieve service block in stunnel.conf, restart stunnel, but if I connect our.public.ip:4190, timsieved becames no connection at all, dbmail log kept silent. traffic from port 4190 is already accepted in iptables. config that I used. > [sieve] > accept = our.public.ip:4190 > connect = 127.0.0.1:2000 > software version: stunnel-5.43 dbmail-3.2.3 Thanks.

2 1

Slow DNS lookups when DNS does not respond
by Guillermo Rodriguez Garcia 08 Jun '18

08 Jun '18

Hi all, I have stunnel setup on a Linux box and I am experiencing very slow DNS lookup times when DNS does not respond. On this same system, anything that results in a DNS lookup (e.g. ping, ...) takes about 20 seconds before it times out and fails. However with stunnel (and a single service configured) the lookup takes more than 1 minute (approx 80 seconds). Is there any way to configure this? Thank you, Guillermo Rodriguez Garcia guille.rodriguez(a)gmail.com

1 0

Windows 2016 Server: [!] bind: Address already in use (WSAEADDRINUSE) (10048)
by Martin Schweizer 06 Jun '18

06 Jun '18

Hello List My problem: If I run stunnel I regular get the below error: [.] stunnel 5.46 on x86-pc-msvc-1500 platform [.] Compiled/running with OpenSSL 1.0.2o-fips 27 Mar 2018 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] Running on Windows 6.2 [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark detected [.] FIPS mode disabled [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [smtps] [ ] GUI message loop initialized [ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK [ ] TLS options: 0x03000004 (+0x00000000, -0x00000000) [ ] Loading certificate from file: stunnel.pem [ ] Certificate loaded from file: stunnel.pem [ ] Loading private key from file: stunnel.pem [ ] Private key loaded from file: stunnel.pem [ ] Private key check succeeded [:] Service [smtps] needs authentication to prevent MITM attacks [.] Configuration successful [ ] Binding service [smtps] [ ] Listening file descriptor created (FD=676) [ ] Setting accept socket options (FD=676) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket >>> [!] bind: Address already in use (WSAEADDRINUSE) (10048) <<<< [!] Error binding service [smtps] to 192.168.10.62:11465 [!] Could not bind any accepting port [ ] Deallocating section defaults [ ] Unbinding service [smtps] [ ] Service [smtps] closed [ ] Deallocating section [smtps] I had the same problem with the previous versions aswell. To temporary resolv the problem I have to change the listen port to another number. Reread the config file and let the stunnel GUI open. Then all is working until I close the GUI (not each time but most of). My system: - Windows 2016 Server - stunnel-5.46 - stunnel installed as service and GUI My config file (relevant part): taskbar = yes client=yes [smtps] ;delay = yes accept = 192.168.10.62:11466 connect = server.domain.ch:465 cert = stunnel.pem local = 192.168.10.53 (this is dedicated address) I found a similar threat in the archives (but on Linux): https://www.stunnel.org/pipermail/stunnel-users/2018-February/005935.html Here is Microsoft's describtion about WSAEADDRINUSE) (10048): https://msdn.microsoft.com/en-us/library/windows/desktop/ms740668(v=vs.85).… All helps are welcome. Kind regards, -- Martin Schweizer PC-Service M. Schweizer GmbH; Bannholzstrasse 6; Postfach 132; CH-8608 Bubikon; Tel. +41 55 243 30 00; Fax: +41 55 243 33 22

1 0

port-only accept value binds to 127.0.0.1, instead of the wildcard address
by Poor Yorick 30 May '18

30 May '18

The stunnel 6.45 documentation for "accept" states, "If no host specified, defaults to all IPv4 addresses for the local host." In this case, stunnel actually binds to 127.0.0.1. Indeed, inspection of the relevant code paths reveals that addr_list->passive is never set to 1 in this case. To get stunnel to bind to all addresses, 0.0.0.0 must be explicitly specified. Furthermore, inspection of the code path for the "local" option reveals that addr_list->passive is set to 1 in this case, which seems to be backwards: The documentation for getaddrinfo states that AI_PASSIVE is ignored in this case. The logic for these two cases seems to be reversed. -- Yorick

1 0

stunnel 5.46 released
by Michal Trojnara 28 May '18

28 May '18

Dear Users, I have released version 5.46 of stunnel. Version 5.46, 2018.05.28, urgency: MEDIUM * New features - The default cipher list was updated to a safer value: "HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK". * Bugfixes - Default accept address restored to INADDR_ANY. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 76aab48c28743d78e4b2f6b2dfe49994b6ca74126046c179444f699fae7a84c7 stunnel-5.46.tar.gz 721cc4d7c385743df767a32a53c11477def2440ae20ad4538d8e685f7b7d6538 stunnel-5.46-win32-installer.exe d08a3b3598868064db08d6f0e3a97e3c49dedbf6c8d7f348a613b832eca16dd6 stunnel-5.46-android.zip Best regards, Mike

1 0

Stunnel stopps in Windows Failover Cluster
by Tobias Gillstöm 28 May '18

28 May '18

Hi, I'm having problems with Stunnel in a Windows Failover Cluster. When a failover happens and the stunnel service changes node that it's running on, the service changes node just fine but the stunnel service dosen't appear to be doing anything? If anyone has some prior knowledge about Stunnel in a Windows Failover Cluster i would appreciate the help :)

1 0

stunnel and CAPI on Windows
by Brian Ipsen 23 May '18

23 May '18

Hi I am trying to use the Microsoft certificate store/API for client validation of Windows hosts towards an F5. Everything works, when we use file-based certificates - but for security purposes I would prefer to use the windows certificate store, and set the private key on the client as non-exportable... I have enabled the engineId = capi in the global section of stunnel.conf - and for the required client/service I have: [F5CertAdmin] client=yes accept = 127.0.0.1:1679 connect = w.x.y.z:443 delay = yes sni = ssl79admpki.xxxx.com CApath = C:\Program Files (x86)\stunnel\config\certs CAFile = C:\Program Files (x86)\stunnel\config\certs\GlobalSign-Cert-Chain.pem verify = 2 engineId = capi key = BaaSClientCertificateCP cert = BaaSClientCertificateCP I have a certificate in the local computer certificate store with the supplied name - but stunnel is not able to locate it... Is it because it will look under the user account? If yes, will it look under the local machine when running as local system ? The output from stunnel says: [ ] Initializing service [F5CertAdmin] [ ] Ciphers: HIGH:!DH:!aNULL:!SSLv2 [ ] TLS options: 0x03000004 (+0x03000000, -0x00000000) [ ] Client certificate engine (capi) enabled [ ] Loading certificate from engine ID: BaaSClientCertificateCP [!] ENGINE_ctrl_cmd: Peer suddenly disconnected [ ] Initializing private key on engine ID: BaaSClientCertificateCP [!] ENGINE_load_private_key: 26096080: error:26096080:engine routines:ENGINE_load_private_key:failed loading private key [ ] Loading certificate from file: BaaSClientCertificateCP [!] error queue: 140DC002: error:140DC002:SSL routines:SSL_CTX_use_certificate_chain_file:system lib [!] error queue: 20074002: error:20074002:BIO routines:FILE_CTRL:system lib [!] SSL_CTX_use_certificate_chain_file: 2001002: error:02001002:system library:fopen:No such file or directory [!] Service [F5CertAdmin]: Failed to initialize TLS context @am6pr03mb3813.eurprd03.prod.outlook.com>Any advice appreciated... Thanks Brian

1 0

stunnel 5.45 released
by Michal Trojnara 21 May '18

21 May '18

Dear Users, I have released version 5.45 of stunnel. Version 5.45, 2018.05.21, urgency: MEDIUM * New feature sponsored by https://loadbalancer.org/ - Implemented delayed deallocation of service sections after configuration file reload. * Other new features - OpenSSL DLLs updated to version 1.0.2o. - Deprecated the sslVersion option. - The "socket" option is now also available in service sections. - Implemented try-restart in the SysV init script (thx to Peter Pentchev). - TLS 1.3 compliant session handling for OpenSSL 1.1.1. - Default "failover" value changed from "rr" to "prio". - New "make check" tests. * Bugfixes - A service no longer refuses to start if binding fails for some (but not all) addresses:ports. - Fixed compression handling with OpenSSL 1.1.0 and later. - _beginthread() replaced with safer _beginthreadex(). - Fixed exception handling in libwrap. - Fixed exec+connect services. - Fixed automatic resolver delaying. - Fixed a Gentoo cross-compilation bug (thx to Joe Harvell). - A number of "make check" framework fixes. - Fixed false postive memory leak logs. - Build fixes for OpenSSL versions down to 0.9.7. - Fixed (again) round-robin failover in the FORK threading model. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 548244839b8a4bf4dffea46c97893b203d1b9eed118c3dd6a9ac4d8d02592ee3 stunnel-5.45.tar.gz fc13a224c7ec1290035efe8317c53d62a0980a5ab2efe8930b06aae269fbe873 stunnel-5.45-win32-installer.exe 29025eaed007c62856f16c7a8a22f9713eee9762ed95009f6f91f729c35c0bc0 stunnel-5.45-android.zip Best regards, Mike

1 0

configuring Stunnel
by support 20 May '18

20 May '18

The config as described hereby did work properly a few times giving a secured connection. All of a sudden this is no longer working? Any suggestions? Namens IMS evba Paul Waegemans +32475341310 <mailto:[email protected]> support(a)imseuro.be <http://eu.ntrsupport.com/inquiero/web/digisign/digisign.asp?login=I23EBF509 C6B51A9E700D43&lang=nl>

1 0

UTF8 BOM in PSKsecrets file
by Jakob Hirsch 17 May '18

17 May '18

Hi! I just found out (after a while of troubleshooting) that stunnel does not handle UTF-8 BOM in the PSKsecrets file, i.e. the BOM is considered part of the identity (tested with 5.44, 5.45b4 and 5.45b6 on Windows 10 1709). It was a little tricky to figure this out, as the BOM is apparently filtered out in the logs, e.g. the server just says 'No key found for PSK identity "client1"'. Ok, nobody says that this is supported or that you should do it, it just happens automatically when you click "Edit Configuration" in the Windows GUI and click "Save as" (out of convenience, because you will already be in the config directory then), because the sample config has a BOM and Notepad will also insert a BOM in the new file. I don't know how much work it would be to handle the BOM correctly or at least print a warning (didn't look at the code, sorry), a warning in the manual would probably sufficient, as it could be that I'm the first one to stumble over this (at least I didn't find anything about it on the net). Regards (and thanks for this nice piece of software) Jakob

1 0

Windows Server 2012 R2
by Daniel McArdell 17 May '18

17 May '18

Hello, I have joined the mail group in the hope that someone can help with problems I am having running on our Server machine. I downloaded "stunnel-5.45b6-win64-installer" and installed it on our Server. When I run the executable I get: 2018.05.17 12:48:33 LOG5[main]: stunnel 5.45 on x64-pc-msvc-1913 platform 2018.05.17 12:48:33 LOG5[main]: Compiled/running with OpenSSL 1.1.0g 2 Nov 2017 2018.05.17 12:48:33 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI 2018.05.17 12:48:33 LOG5[main]: Reading configuration from file stunnel.conf 2018.05.17 12:48:33 LOG5[main]: UTF-8 byte order mark detected 2018.05.17 12:48:33 LOG5[main]: Configuration successful The shortcut [cid:[email protected]] I was expecting to get a GUI interface but that does not happen. Can someone tell me what is going wrong. I feel as though I have missed something obvious. Daniel McArdell | Senior Analyst Programmer | Products & Technology | BNZ<http://www.bnz.co.nz/> L6 Custom House, 17 Whitmore St, Wellington 6011 DDI +64 4 4746679 (extn 76679) | F +64 4 4746023 | M +64 29 2220451 | E Daniel_McArdell(a)bnz.co.nz<mailto:[email protected]?Subject=> CAUTION - This message may contain privileged and confidential information intended only for the use of the addressee named above. If you are not the intended recipient of this message you are hereby notified that any use, dissemination, distribution or reproduction of this message is prohibited. This email was sent by the Bank of New Zealand. You can contact us on 0800 ASK BNZ (0800 275 269). Any views expressed in this message are those of the individual sender and may not necessarily reflect the views of Bank of New Zealand.

1 0

stunnel with client-auth via proxy-server
by jack.reacher＠gmx.de 16 May '18

16 May '18

2 1

Stunnel running as service on Windows Server 2008 R2 but Stunnel All Users shortcut on the desktop reports that it server is down?
by Alex Birchall 16 May '18

16 May '18

Hello, I have Stunnel running as a service on a Windows Server 2008 R2. But the shortcut on the desktop "Stunnel All Users", when launched, informs me that the server is down due to an "invalid configuration file". In the config file, if Stunnel is being run as a service, should it be "client = no" or "server = yes"? Many thanks. Best regards, Alex

2 2

SMTP Authentication failed
by Ian Coetzee 15 May '18

15 May '18

Hi List, I have just joined the stunnel community. I am in the process of migrating our mailserver's public facing ports to stunnel for PCI compliance reasons. So far i have managed to get working: - imap (143/tcp) with starttls - imaps (993/tcp) - pop3 (110/tcp) with starttls - pop3s (995/tcp) My trouble is with smtp(25/tcp,587/tcp) with starttls. I have now tried a couple different mail clients and everyone of them tells me that the server does not support the authentication protocols. I have installed stunnel 5.44. Tee relevant parts in my config: [mail2-imap] protocol = imap accept = 143 connect = <mail-fqdn>:143 [mail2-imaps] accept = 993 connect = <mail-fqdn>:143 [mail2-pop3] protocol = pop3 accept = 110 connect = <mail-fqdn>:110 [mail2-pop3s] accept = 995 connect = <mail-fqdn>:110 [mail2-smtp] protocol = smtp accept = 25 connect = <mail-fqdn>:25 [mail2-smtps] accept = 465 connect = <mail-fqdn>:465 [mail2-smtps-submission] debug = 7 protocol = smtp accept = 587 connect = <mail-fqdn>:587 In the logfile I have the following entries upon connecting 2018.04.30 09:20:50 LOG7[5]: Service [mail2-smtps-submission] started 2018.04.30 09:20:50 LOG7[5]: Option TCP_NODELAY set on local socket 2018.04.30 09:20:50 LOG5[5]: Service [mail2-smtps-submission] accepted connection from 41.13.8.49:56890 2018.04.30 09:20:50 LOG6[5]: s_connect: connecting 10.10.11.2:587 2018.04.30 09:20:50 LOG7[5]: s_connect: s_poll_wait 10.10.11.2:587: waiting 10 seconds 2018.04.30 09:20:50 LOG5[5]: s_connect: connected 10.10.11.2:587 2018.04.30 09:20:50 LOG5[5]: Service [mail2-smtps-submission] connected remote server from 10.10.11.11:42466 2018.04.30 09:20:50 LOG7[5]: Option TCP_NODELAY set on remote socket 2018.04.30 09:20:50 LOG7[5]: Remote descriptor (FD=23) initialized 2018.04.30 09:20:50 LOG7[5]: RFC 2487 detected 2018.04.30 09:20:50 LOG7[5]: <- 220 <mail-fqdn> ESMTP Postfix 2018.04.30 09:20:50 LOG7[5]: -> 220 <mail-fqdn> stunnel for ESMTP Postfix 2018.04.30 09:20:51 LOG7[5]: <- EHLO [100.125.153.220] 2018.04.30 09:20:51 LOG7[5]: -> 250-<mail-fqdn> 2018.04.30 09:20:51 LOG7[5]: -> 250 STARTTLS 2018.04.30 09:20:51 LOG7[5]: <- STARTTLS 2018.04.30 09:20:51 LOG7[5]: -> 220 Go ahead 2018.04.30 09:20:51 LOG6[5]: Peer certificate not required 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): before/accept initialization 2018.04.30 09:20:51 LOG7[5]: SNI: no virtual services defined 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 read client hello A 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 write server hello A 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 write certificate A 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 write key exchange A 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 write server done A 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 flush data 2018.04.30 09:20:51 LOG7[5]: TLS state (accept): SSLv3 read client certificate A 2018.04.30 09:20:52 LOG7[5]: TLS state (accept): SSLv3 read client key exchange A 2018.04.30 09:20:52 LOG7[5]: TLS state (accept): SSLv3 read certificate verify A 2018.04.30 09:20:52 LOG7[5]: TLS state (accept): SSLv3 read finished A 2018.04.30 09:20:52 LOG7[5]: TLS state (accept): SSLv3 write change cipher spec A 2018.04.30 09:20:52 LOG7[5]: TLS state (accept): SSLv3 write finished A 2018.04.30 09:20:52 LOG7[5]: TLS state (accept): SSLv3 flush data 2018.04.30 09:20:52 LOG7[5]: New session callback 2018.04.30 09:20:52 LOG7[5]: 2 server accept(s) requested 2018.04.30 09:20:52 LOG7[5]: 2 server accept(s) succeeded 2018.04.30 09:20:52 LOG7[5]: 0 server renegotiation(s) requested 2018.04.30 09:20:52 LOG7[5]: 0 session reuse(s) 2018.04.30 09:20:52 LOG7[5]: 2 internal session cache item(s) 2018.04.30 09:20:52 LOG7[5]: 0 internal session cache fill-up(s) 2018.04.30 09:20:52 LOG7[5]: 0 internal session cache miss(es) 2018.04.30 09:20:52 LOG7[5]: 0 external session cache hit(s) 2018.04.30 09:20:52 LOG7[5]: 0 expired session(s) retrieved 2018.04.30 09:20:52 LOG6[5]: TLS accepted: new session negotiated 2018.04.30 09:20:52 LOG6[5]: No peer certificate received 2018.04.30 09:20:52 LOG6[5]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES128-GCM-SHA256 (128-bit encryption) 2018.04.30 09:20:52 LOG7[5]: Compression: null, expansion: null 2018.04.30 09:20:52 LOG6[5]: Read socket closed (read hangup) 2018.04.30 09:20:52 LOG7[5]: Sending close_notify alert 2018.04.30 09:20:52 LOG7[5]: TLS alert (write): warning: close notify 2018.04.30 09:20:52 LOG6[5]: SSL_shutdown successfully sent close_notify alert 2018.04.30 09:20:52 LOG6[5]: TLS fd: Connection reset by peer (104) 2018.04.30 09:20:52 LOG6[5]: TLS socket closed (SSL_read) 2018.04.30 09:20:52 LOG7[5]: Sent socket write shutdown 2018.04.30 09:20:52 LOG5[5]: Connection closed: 156 byte(s) sent to TLS, 30 byte(s) sent to socket 2018.04.30 09:20:52 LOG7[5]: Remote descriptor (FD=23) closed 2018.04.30 09:20:52 LOG7[5]: Local descriptor (FD=22) closed 2018.04.30 09:20:52 LOG7[5]: Service [mail2-smtps-submission] finished (4 left) This is the error I am getting from K9-Mail The google mail app just tells me: Alpine (linux commandline smtp client) Any advise from the gurus? Kind regards Ian

1 1

Error with negotiation OK
by Alix Janeth Jerez 15 May '18

15 May '18

Hi I am using lastest stunnel version. When i try to send an email, i get: "error permanente de SMTP: 503 Bad sequence of commands". This is the trace generated when I try to send an email. 2018.05.14 12:59:08 LOG5[main]: Reading configuration from file stunnel.conf 2018.05.14 12:59:08 LOG5[main]: UTF-8 byte order mark not detected 2018.05.14 12:59:08 LOG5[main]: FIPS mode disabled 2018.05.14 12:59:08 LOG5[main]: Configuration successful 2018.05.14 12:59:08 LOG7[main]: Binding service [pseudo-ssmtp] 2018.05.14 12:59:08 LOG7[main]: Listening file descriptor created (FD=568) 2018.05.14 12:59:08 LOG7[main]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2018.05.14 12:59:08 LOG7[main]: Service [pseudo-ssmtp] (FD=568) bound to 172.31.41.84:116 2018.05.14 12:59:08 LOG7[main]: Signal pipe is empty 2018.05.14 12:59:22 LOG7[main]: Found 1 ready file descriptor(s) 2018.05.14 12:59:22 LOG7[main]: FD=324 ifds=r-x ofds=r-- 2018.05.14 12:59:22 LOG7[main]: Dispatching signals from the signal pipe 2018.05.14 12:59:22 LOG7[main]: Processing SIGNAL_RELOAD_CONFIG 2018.05.14 12:59:22 LOG7[main]: Running on Windows 6.1 2018.05.14 12:59:22 LOG5[main]: Reading configuration from file stunnel.conf 2018.05.14 12:59:22 LOG5[main]: UTF-8 byte order mark not detected 2018.05.14 12:59:22 LOG5[main]: FIPS mode disabled 2018.05.14 12:59:22 LOG7[main]: Compression disabled 2018.05.14 12:59:22 LOG7[main]: Snagged 64 random bytes from C:/.rnd 2018.05.14 12:59:22 LOG7[main]: Wrote 1024 new random bytes to C:/.rnd 2018.05.14 12:59:22 LOG7[main]: PRNG seeded successfully 2018.05.14 12:59:22 LOG6[main]: Initializing service [pseudo-ssmtp] 2018.05.14 12:59:22 LOG7[main]: Ciphers: HIGH:!DH:!aNULL:!SSLv2 2018.05.14 12:59:22 LOG7[main]: TLS options: 0x03000004 (+0x03000000, 0x00000000) 2018.05.14 12:59:22 LOG6[main]: Loading certificate from file: stunnel.pem 2018.05.14 12:59:22 LOG6[main]: Certificate loaded from file: stunnel.pem 2018.05.14 12:59:22 LOG6[main]: Loading private key from file: stunnel.pem 2018.05.14 12:59:22 LOG6[main]: Private key loaded from file: stunnel.pem 2018.05.14 12:59:22 LOG7[main]: Private key check succeeded 2018.05.14 12:59:22 LOG5[main]: Configuration successful 2018.05.14 12:59:22 LOG7[main]: Unbinding service [pseudo-ssmtp] 2018.05.14 12:59:22 LOG7[main]: Service [pseudo-ssmtp] closed (FD=568) 2018.05.14 12:59:22 LOG7[main]: Service [pseudo-ssmtp] closed 2018.05.14 12:59:22 LOG7[main]: Binding service [pseudo-ssmtp] 2018.05.14 12:59:22 LOG7[main]: Listening file descriptor created (FD=568) 2018.05.14 12:59:22 LOG7[main]: Option SO_EXCLUSIVEADDRUSE set on accept socket 2018.05.14 12:59:22 LOG7[main]: Service [pseudo-ssmtp] (FD=568) bound to 172.31.41.84:116 2018.05.14 12:59:22 LOG7[main]: Signal pipe is empty 2018.05.14 12:59:34 LOG7[main]: Found 1 ready file descriptor(s) 2018.05.14 12:59:34 LOG7[main]: FD=324 ifds=r-x ofds=--- 2018.05.14 12:59:34 LOG7[main]: Service [pseudo-ssmtp] accepted (FD=584) from 172.31.41.84:53557 2018.05.14 12:59:34 LOG7[main]: Creating a new thread 2018.05.14 12:59:34 LOG7[main]: New thread created 2018.05.14 12:59:34 LOG7[37]: Service [pseudo-ssmtp] started 2018.05.14 12:59:34 LOG7[37]: Option TCP_NODELAY set on local socket 2018.05.14 12:59:34 LOG5[37]: Service [pseudo-ssmtp] accepted connection from 172.31.41.84:53557 2018.05.14 12:59:34 LOG6[37]: failover: round-robin, starting at entry #1 2018.05.14 12:59:34 LOG6[37]: s_connect: connecting 212.227.15.158:465 2018.05.14 12:59:34 LOG7[37]: s_connect: s_poll_wait 212.227.15.158:465: waiting 10 seconds 2018.05.14 12:59:34 LOG5[37]: s_connect: connected 212.227.15.158:465 2018.05.14 12:59:34 LOG5[37]: Service [pseudo-ssmtp] connected remote server from 172.31.41.84:53558 2018.05.14 12:59:34 LOG7[37]: Option TCP_NODELAY set on remote socket 2018.05.14 12:59:34 LOG7[37]: Remote descriptor (FD=552) initialized 2018.05.14 12:59:34 LOG6[37]: SNI: sending servername: smtp.1and1.es 2018.05.14 12:59:34 LOG6[37]: Peer certificate required 2018.05.14 12:59:34 LOG7[37]: TLS state (connect): before/connect initialization 2018.05.14 12:59:34 LOG7[37]: TLS state (connect): SSLv2/v3 write client hello A 2018.05.14 12:59:34 LOG7[37]: TLS state (connect): SSLv3 read server hello A 2018.05.14 12:59:34 LOG7[37]: Verification started at depth=2: C=US, O="thawte, Inc.", OU=Certification Services Division, OU="(c) 2006 thawte, Inc. - For authorized use only", CN=thawte Primary Root CA 2018.05.14 12:59:34 LOG7[37]: CERT: Pre-verification succeeded 2018.05.14 12:59:34 LOG7[37]: OCSP: Ignoring root certificate 2018.05.14 12:59:34 LOG6[37]: Certificate accepted at depth=2: C=US, O="thawte, Inc.", OU=Certification Services Division, OU="(c) 2006 thawte, Inc. - For authorized use only", CN=thawte Primary Root CA 2018.05.14 12:59:34 LOG7[37]: Verification started at depth=1: C=US, O="thawte, Inc.", CN=thawte SSL CA - G2 2018.05.14 12:59:34 LOG7[37]: CERT: Pre-verification succeeded 2018.05.14 12:59:34 LOG5[37]: OCSP: Connecting the AIA responder "http://t2.symcb.com" 2018.05.14 12:59:34 LOG6[37]: s_connect: connecting 23.5.251.27:80 2018.05.14 12:59:34 LOG7[37]: s_connect: s_poll_wait 23.5.251.27:80: waiting 10 seconds 2018.05.14 12:59:34 LOG5[37]: s_connect: connected 23.5.251.27:80 2018.05.14 12:59:34 LOG7[37]: OCSP: Connected t2.symcb.com:80 2018.05.14 12:59:34 LOG7[37]: OCSP: Response received 2018.05.14 12:59:34 LOG6[37]: OCSP: Status: good 2018.05.14 12:59:34 LOG6[37]: OCSP: This update: May 13 18:15:02 2018 GMT 2018.05.14 12:59:34 LOG6[37]: OCSP: Next update: May 20 18:15:02 2018 GMT 2018.05.14 12:59:34 LOG5[37]: OCSP: Certificate accepted 2018.05.14 12:59:34 LOG6[37]: Certificate accepted at depth=1: C=US, O="thawte, Inc.", CN=thawte SSL CA - G2 2018.05.14 12:59:34 LOG7[37]: Verification started at depth=0: C=DE, ST=Rheinland-Pfalz, L=Montabaur, O=1&1 Internet SE, CN=smtp.1and1.es 2018.05.14 12:59:34 LOG7[37]: CERT: Pre-verification succeeded 2018.05.14 12:59:34 LOG6[37]: CERT: Host name "smtp.1and1.es" matched with "smtp.1and1.es" 2018.05.14 12:59:34 LOG5[37]: OCSP: Connecting the AIA responder "http://tj.symcd.com" 2018.05.14 12:59:34 LOG6[37]: s_connect: connecting 23.5.251.27:80 2018.05.14 12:59:34 LOG7[37]: s_connect: s_poll_wait 23.5.251.27:80: waiting 10 seconds 2018.05.14 12:59:35 LOG5[37]: s_connect: connected 23.5.251.27:80 2018.05.14 12:59:35 LOG7[37]: OCSP: Connected tj.symcd.com:80 2018.05.14 12:59:35 LOG7[37]: OCSP: Response received 2018.05.14 12:59:35 LOG6[37]: OCSP: Status: good 2018.05.14 12:59:35 LOG6[37]: OCSP: This update: May 14 01:38:59 2018 GMT 2018.05.14 12:59:35 LOG6[37]: OCSP: Next update: May 21 01:38:59 2018 GMT 2018.05.14 12:59:35 LOG5[37]: OCSP: Certificate accepted 2018.05.14 12:59:35 LOG5[37]: Certificate accepted at depth=0: C=DE, ST=Rheinland-Pfalz, L=Montabaur, O=1&1 Internet SE, CN=smtp.1and1.es 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 read server certificate A 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 read server key exchange A 2018.05.14 12:59:35 LOG6[37]: Client certificate not requested 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 read server done A 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 write client key exchange A 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 write change cipher spec A 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 write finished A 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 flush data 2018.05.14 12:59:35 LOG7[37]: TLS state (connect): SSLv3 read finished A 2018.05.14 12:59:35 LOG7[37]: 1 client connect(s) requested 2018.05.14 12:59:35 LOG7[37]: 1 client connect(s) succeeded 2018.05.14 12:59:35 LOG7[37]: 0 client renegotiation(s) requested 2018.05.14 12:59:35 LOG7[37]: 0 session reuse(s) 2018.05.14 12:59:35 LOG6[37]: TLS connected: new session negotiated 2018.05.14 12:59:35 LOG7[37]: Peer certificate was cached (5543 bytes) 2018.05.14 12:59:35 LOG6[37]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2018.05.14 12:59:35 LOG7[37]: Compression: null, expansion: null 2018.05.14 12:59:53 LOG3[36]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing 2018.05.14 12:59:53 LOG5[36]: Connection closed: 15 byte(s) sent to TLS, 166 byte(s) sent to socket I can't find the error. Thanks in advance for your help. Best regards, Alix

2 5

stunnel-5.44 fails cross compile due to wrong include path in Gentoo....fix available
by Joe Harvell 14 May '18

14 May '18

The src/Makefile.am hardcodes -I/usr/kerberos/include. When cross compiling it should be including -I$(SYSROOT)//usr/kerberos/include. I patched configure.ac and Makefile.am, taking advantage of the existing --with-sysroot configure option. The Gentoo bug report: https://bugs.gentoo.org/654374 The patch to configure.ac and Makefile.am: https://654374.bugs.gentoo.org/attachment.cgi?id=528968 I was unable to find a bug reporting system for stunnel. So I guess this is it. Please source this fix. --- Joe Harvell

1 1