- stunnel-users - stunnel.org

-reopen for Ubuntu?
by mguyre＠comcast.net 24 Aug '16

24 Aug '16

Are there any plans to add the -reopen functionality to other operating systems? Thanks Mike

1 0

[Stunnel] [Android x86] Compilation
by John Fisherman 22 Aug '16

22 Aug '16

Dear all, I am currently trying to make stunnel work for an Android x86 architecture. The android binary found on the stunnel official website is not supported on x86 architecture, so I'd like to cross-compile it myself using the 'configure' options. I did not find much informations about this around the web, could you give me some advices or at least tell me if it is possible to make Stunnel work on an Android x86 device ? Thanks in advance, Regards, - John

1 0

Stunnel exits with timeout
by SP 19 Aug '16

19 Aug '16

Summary of problem (configuration and log details below): I am attempting to configure Stunnel to run a pop3s service on our server so that users can retrieve email securely. Stunnel is started as a systemctl service. If I include both the following in the stunnel.conf: accept = mail.myserver.net:995 connect = localhost:110 then systemctl will exit immediately with: Service [pop3s]: Each service must define two endpoints stunnel.service: Control process exited, code=exited status=1 Failed to start SSL tunnel for network daemons. If I comment the connect to 110 then it will start and hang then eventually timeout: stunnel.service: Failed with result 'timeout'. Below is my stunnel.conf and log excerpt from the start with the connect to 110 commented out. I would greatly appreciate any advice. ---stunnel.conf setuid = nobody setgid = nobody pid = /usr/local/var/lib/stunnel/var/run/stunnel.pid foreground = yes ;debug = info debug = 7 sslVersion = TLSv1.2 output = /usr/local/var/lib/stunnel/var/log/stunnel.log ;ciphers = HIGH:MEDIUM:+DH:!SSLv2:!aNULL:+SHA256:+SHA1:+MD5 ciphers = HIGH:+3DES:+DH:!aNULL:!SSLv2 transparent = yes delay = no fips = no compression = deflate client = no [pop3s] accept = mail.myserver.net:995 ;connect = localhost:110 cert = /etc/stunnel/stunnel.pem key = /etc/stunnel/stunnel.pem exec = /usr/local/sbin/gnu-pop3d execargs = --debug=000 --mdn --timeout=60 --ipv6 ----log excerpt ----- 2016.08.17 15:08:55 LOG7[ui]: Clients allowed=500 2016.08.17 15:08:55 LOG5[ui]: stunnel 5.35 on x86_64-unknown-linux-gnu platform 2016.08.17 15:08:55 LOG5[ui]: Compiled/running with OpenSSL 1.0.2h 3 May 2016 2016.08.17 15:08:55 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2016.08.17 15:08:55 LOG7[ui]: errno: (*__errno_location ()) 2016.08.17 15:08:55 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf 2016.08.17 15:08:55 LOG5[ui]: UTF-8 byte order mark not detected 2016.08.17 15:08:55 LOG7[cron]: Cron thread initialized 2016.08.17 15:08:55 LOG5[ui]: FIPS mode disabled 2016.08.17 15:08:55 LOG6[ui]: Compression enabled: 1 method(s) 2016.08.17 15:08:55 LOG7[ui]: Snagged 64 random bytes from /dev/urandom 2016.08.17 15:08:55 LOG7[ui]: PRNG seeded successfully 2016.08.17 15:08:55 LOG6[ui]: Initializing service [pop3s] 2016.08.17 15:08:55 LOG6[ui]: Loading certificate from file: /etc/stunnel/stunnel.pem 2016.08.17 15:08:55 LOG6[ui]: Certificate loaded from file: /etc/stunnel/stunnel.pem 2016.08.17 15:08:55 LOG6[ui]: Loading private key from file: /etc/stunnel/stunnel.pem 2016.08.17 15:08:55 LOG6[ui]: Private key loaded from file: /etc/stunnel/stunnel.pem 2016.08.17 15:08:55 LOG7[ui]: Private key check succeeded 2016.08.17 15:08:55 LOG7[ui]: DH initialization 2016.08.17 15:08:55 LOG7[ui]: Could not load DH parameters from /etc/stunnel/stunnel.pem 2016.08.17 15:08:55 LOG6[ui]: Using dynamic DH parameters 2016.08.17 15:08:55 LOG7[ui]: ECDH initialization 2016.08.17 15:08:55 LOG7[ui]: ECDH initialized with curve prime256v1 2016.08.17 15:08:55 LOG7[ui]: SSL options: 0x03004004 (+0x03004000, -0x00000000) 2016.08.17 15:08:55 LOG5[ui]: Configuration successful 2016.08.17 15:08:55 LOG7[ui]: Listening file descriptor created (FD=7) 2016.08.17 15:08:55 LOG7[ui]: Option SO_REUSEADDR set on accept socket 2016.08.17 15:08:55 LOG7[ui]: Service [pop3s] (FD=7) bound to 60.62.114.105:995 2016.08.17 15:08:55 LOG6[cron]: Executing cron jobs 2016.08.17 15:08:55 LOG7[ui]: Created pid file /usr/local/var/lib/stunnel/var/run/stunnel.pid 2016.08.17 15:08:55 LOG5[cron]: Updating DH parameters 2016.08.17 15:10:01 LOG5[cron]: DH parameters updated 2016.08.17 15:10:01 LOG6[cron]: Cron jobs completed in 66 seconds 2016.08.17 15:10:01 LOG7[cron]: Waiting 86334 seconds 2016.08.17 15:10:25 LOG7[ui]: Found 1 ready file descriptor(s) 2016.08.17 15:10:25 LOG7[ui]: FD=4 events=0x2001 revents=0x1 2016.08.17 15:10:25 LOG7[ui]: FD=7 events=0x2001 revents=0x0 2016.08.17 15:10:25 LOG7[ui]: Dispatching signals from the signal pipe 2016.08.17 15:10:25 LOG7[ui]: Processing SIGNAL_TERMINATE 2016.08.17 15:10:25 LOG5[ui]: Terminated 2016.08.17 15:10:25 LOG7[ui]: Closing service [pop3s] 2016.08.17 15:10:25 LOG7[ui]: Service [pop3s] closed (FD=7) 2016.08.17 15:10:25 LOG7[ui]: Service [pop3s] closed 2016.08.17 15:10:25 LOG7[ui]: removing pid file /usr/local/var/lib/stunnel/var/run/stunnel.pid

2 6

Logging Issues Causing Crash?
by Randall LeJeune 08 Aug '16

08 Aug '16

Hello all, Has anyone experienced a full log file causing stunnel issues in the past? We tried upgrading from 4.56 to 5.17 and the upgrade seemed to go fine at first, but a day or so later we began to have some disconnects. Later we downgraded to 5.01 which worked OK at first, but then we ran into the same kinds of problems again after a few days. We eventually put the stunnel.log file on a separate filesystem, but I am curious, has anyone else experienced any issues like this? Thanks, Randy

3 2

Config was working. Now it isn't after reboot
by Lee Savidge 02 Aug '16

02 Aug '16

I just reinstalled stunnel the latest version. When running I went through the creation of the pem file. I put in UK for the country code and the company name and put a . for everything else. It finished, I start the GUI and it works. I edited the config file to comment out the gmail IMAP section and reload it and it was fine. I rebooted, now it tells me tehre is an error in the config file. Why? I keep getting this problem. Rebooting seems to break the config somehow. Log shows this when stunnel starts: [ ] Cron thread initialized [ ] Running on Windows 6.1 [ ] No limit detected for the number of clients [.] stunnel 5.35 on x86-pc-msvc-1500 platform [.] Compiled/running with OpenSSL 1.0.2h-fips 3 May 2016 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] GUI message loop initialized [ ] Running on Windows 6.1 [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark detected [.] FIPS mode disabled [ ] Compression disabled [ ] Snagged 64 random bytes from C:/.rnd [ ] Wrote 1024 new random bytes to C:/.rnd [ ] PRNG seeded successfully [ ] Initializing service [gmail-pop3] [ ] No certificate or private key specified [ ] SSL options: 0x03000004 (+0x03000000, -0x00000000) [ ] Initializing service [gmail-smtp] [ ] No certificate or private key specified [ ] SSL options: 0x03000004 (+0x03000000, -0x00000000) [.] Configuration successful [ ] Listening file descriptor created (FD=388) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [ ] Service [gmail-pop3] (FD=388) bound to 127.0.0.1:110 [ ] Listening file descriptor created (FD=392) [ ] Option SO_EXCLUSIVEADDRUSE set on accept socket [!] bind: Permission denied (WSAEACCES) (10013) [!] Error binding service [gmail-smtp] to 127.0.0.1:25 [ ] Closing service [gmail-pop3] [ ] Service [gmail-pop3] closed (FD=388) [ ] Service [gmail-pop3] closed [ ] Closing service [gmail-smtp] [ ] Service [gmail-smtp] closed [!] Server is down [ ] Executing cron jobs [ ] Cron jobs completed in 0 seconds [ ] Waiting 86400 seconds The config file contains this: debug = debug output = stunnel.log [gmail-pop3] client = yes accept = 127.0.0.1:110 connect = pop.gmail.com:995 verifyChain = yes CAfile = ca-certs.pem checkHost = pop.gmail.com OCSPaia = yes [gmail-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.gmail.com:465 verifyChain = yes CAfile = ca-certs.pem checkHost = smtp.gmail.com OCSPaia = yes I have pasted in only the stuff that isn't commented out. Why does this not work after a reboot? It makes no sense. -- =-----------------= Lee Savidge =-----------------= --

2 2

Installation problem on Windows 2003
by Tom Eberhard 01 Aug '16

01 Aug '16

Hello stunnel-users: I'm trying to install stunnel 5.35 on a Windows 2003 box, 32-bit. The installer runs to completion, but we get an error from SimpleFC: SimpleFC::AddApplication failed to add stunnel What is causing this error to come up, and what do I have to do to fix it? Googling just showed that SimpleFC is a plugin to interact with the Windows Firewall. Thanks, Tom This e-mail is intended solely for the person or entity to which it is addressed and may contain confidential and/or privileged information. Any review, dissemination, copying, printing or other use of this e-mail by persons or entities other than the addressee is prohibited. If you have received this e-mail in error, please contact the sender immediately and delete the material from any computer.

1 0

Client-side SNI
by Vincent Deschenes 01 Aug '16

01 Aug '16

Hi, Anyone know if there is anything special to do to get ServerName sent when using stunnel in client mode to be able to connect to SNI enabled server? Using latest version of stunnel and openssl. Will stunnel use the name specified in the "connect=" config ? Thanks, Regards, Vincent Deschenes Ing. PMP Director of Operations Stelvio Inc. (+1) 514-281-8570

1 2

stunnel only sends some emails, not all, and only on second attempt
by Martin Jaquess 28 Jul '16

28 Jul '16

Hi I'm using the latest Stunnel (5.35), running under Windows Server 2000, to download emails from Outlook(Office365)/Outlook 2016 to another email client called OfficeTalk which only supports unencrypted POP3, so it can't access Outlook directly. First problem is that although most emails are downloaded without problem, some stubbornly and consistently refuse to be downloaded. This omission doesn't seem related to attachments, encoding, size, date, or anything else that I can see. Has anyone else experienced this or have any idea why it might be happening?? Second problem is that the first download doesn't produce anything, but if I run the request again, it works - the only difference in the log files is the IP addresses I'd greatly appreciate any advice on this - I've checked the threads but can't find anything similar. Many thanks in advance Martin Config file for all attempts is:debug=7 output = c:\program files\stunnel\stunnel.log [outlook-pop3] client = yes accept = 127.0.0.1:110 connect = outlook.office365.com:995 Logfile for successful download of one email is:12:49:50 LOG7[cron]: Cronthread initialized12:49:50 LOG7[main]: Runningon Windows 5.012:49:50 LOG7[main]: No limitdetected for the number of clients12:49:50 LOG5[main]: stunnel5.35 on x86-pc-msvc-1500 platform12:49:50 LOG5[main]:Compiled/running with OpenSSL 1.0.2h-fips 3 May 201612:49:50 LOG5[main]:Threading:WIN32 Sockets:SELECT,IPv4 TLS:ENGINE,FIPS,OCSP,PSK,SNI12:49:50 LOG7[main]: errno:(*_errno())12:49:50 LOG7[ui]: GUImessage loop initialized12:49:50 LOG7[main]: Runningon Windows 5.012:49:50 LOG5[main]: Reading configurationfrom file stunnel.conf12:49:50 LOG5[main]: UTF-8byte order mark detected12:49:50 LOG5[main]: FIPSmode disabled12:49:50 LOG7[main]:Compression disabled12:49:50 LOG7[main]: Snagged64 random bytes from C:/.rnd12:49:50 LOG7[main]: Wrote1024 new random bytes to C:/.rnd12:49:50 LOG7[main]: PRNGseeded successfully12:49:50 LOG6[main]:Initializing service [outlook-pop3]12:49:50 LOG7[main]: Nocertificate or private key specified12:49:50 LOG4[main]: Service[outlook-pop3] needs authentication to prevent MITM attacks12:49:50 LOG7[main]: SSLoptions: 0x03000004 (+0x03000000, -0x00000000)12:49:50 LOG5[main]:Configuration successful12:49:50 LOG7[main]:Listening file descriptor created (FD=344)12:49:50 LOG7[main]: Service[outlook-pop3] (FD=344) bound to 127.0.0.1:11012:49:53 LOG7[main]: Found 1ready file descriptor(s)12:49:53 LOG7[main]: FD=204ifds=r-x ofds=---12:49:53 LOG7[main]: Service[outlook-pop3] accepted (FD=356) from 127.0.0.1:380112:49:53 LOG7[main]: Creatinga new thread12:49:53 LOG7[main]: Newthread created12:49:53 LOG7[0]: Service[outlook-pop3] started12:49:53 LOG7[0]: OptionTCP_NODELAY set on local socket12:49:53 LOG5[0]: Service[outlook-pop3] accepted connection from 127.0.0.1:380112:49:53 LOG6[0]: failover:round-robin, starting at entry #112:49:53 LOG6[0]: s_connect:connecting 132.245.224.162:99512:49:53 LOG7[0]: s_connect:s_poll_wait 132.245.224.162:995: waiting 10 seconds12:49:53 LOG5[0]: s_connect:connected 132.245.224.162:99512:49:53 LOG5[0]: Service[outlook-pop3] connected remote server from 192.168.15.102:380212:49:53 LOG7[0]: OptionTCP_NODELAY set on remote socket12:49:53 LOG7[0]: Remotedescriptor (FD=380) initialized12:49:53 LOG6[0]: SNI:sending servername: outlook.office365.com12:49:53 LOG6[0]: Peercertificate not required12:49:53 LOG7[0]: SSL state(connect): before/connect initialization12:49:53 LOG7[0]: SSL state(connect): SSLv2/v3 write client hello A12:49:53 LOG7[0]: SSL state(connect): SSLv3 read server hello A12:49:53 LOG6[0]: Certificateverification disabled12:49:53 LOG6[0]: Certificateverification disabled12:49:53 LOG7[0]: SSL state(connect): SSLv3 read server certificate A12:49:53 LOG7[0]: SSL state(connect): SSLv3 read server key exchange A12:49:53 LOG6[0]: Clientcertificate not requested12:49:53 LOG7[0]: SSL state(connect): SSLv3 read server done A12:49:53 LOG7[0]: SSL state(connect): SSLv3 write client key exchange A12:49:53 LOG7[0]: SSL state(connect): SSLv3 write change cipher spec A12:49:53 LOG7[0]: SSL state(connect): SSLv3 write finished A12:49:53 LOG7[0]: SSL state(connect): SSLv3 flush data12:49:53 LOG7[0]: SSL state(connect): SSLv3 read finished A12:49:53 LOG7[0]: 1 client connect(s) requested12:49:53 LOG7[0]: 1 client connect(s) succeeded12:49:53 LOG7[0]: 0 client renegotiation(s) requested12:49:53 LOG7[0]: 0 session reuse(s)12:49:53 LOG6[0]: SSLconnected: new session negotiated12:49:53 LOG7[0]: Peercertificate was cached (4882 bytes)12:49:53 LOG6[0]: NegotiatedTLSv1.2 ciphersuite ECDHE-RSA-AES256-SHA384 (256-bit encryption)12:49:53 LOG7[0]:Compression: null, expansion: null12:49:54 LOG6[0]: Read socketclosed (readsocket)12:49:54 LOG7[0]: Sendingclose_notify alert12:49:54 LOG7[0]: SSL alert(write): warning: close notify12:49:54 LOG6[0]:SSL_shutdown successfully sent close_notify alert12:49:54 LOG7[main]: Found 1ready file descriptor(s)12:49:54 LOG7[main]: FD=204ifds=r-x ofds=---12:49:54 LOG7[main]: Service[outlook-pop3] accepted (FD=404) from 127.0.0.1:380312:49:54 LOG7[main]: Creatinga new thread12:49:54 LOG7[main]: Newthread created12:49:54 LOG7[1]: Service[outlook-pop3] started12:49:54 LOG7[1]: OptionTCP_NODELAY set on local socket12:49:54 LOG5[1]: Service[outlook-pop3] accepted connection from 127.0.0.1:380312:49:54 LOG6[1]: failover:round-robin, starting at entry #212:49:54 LOG6[1]: s_connect:connecting 132.245.212.98:99512:49:54 LOG7[1]: s_connect:s_poll_wait 132.245.212.98:995: waiting 10 seconds12:49:54 LOG6[0]: SSL socketclosed (SSL_read)12:49:54 LOG7[0]: Sent socketwrite shutdown12:49:54 LOG5[0]: Connectionclosed: 67 byte(s) sent to SSL, 11900 byte(s) sent to socket12:49:54 LOG7[0]: Remotedescriptor (FD=380) closed12:49:54 LOG7[0]: Local descriptor(FD=356) closed12:49:54 LOG7[0]: Service[outlook-pop3] finished (1 left)12:49:54 LOG5[1]: s_connect:connected 132.245.212.98:99512:49:54 LOG5[1]: Service[outlook-pop3] connected remote server from 192.168.15.102:380412:49:54 LOG7[1]: OptionTCP_NODELAY set on remote socket12:49:54 LOG7[1]: Remotedescriptor (FD=428) initialized12:49:54 LOG6[1]: SNI:sending servername: outlook.office365.com12:49:54 LOG6[1]: Peercertificate not required12:49:54 LOG7[1]: SSL state(connect): before/connect initialization12:49:54 LOG7[1]: SSL state(connect): SSLv3 write client hello A12:49:54 LOG7[1]: SSL state(connect): SSLv3 read server hello A12:49:54 LOG6[1]: Certificateverification disabled12:49:54 LOG6[1]: Certificateverification disabled12:49:54 LOG7[1]: SSL state(connect): SSLv3 read server certificate A12:49:54 LOG7[1]: SSL state(connect): SSLv3 read server key exchange A12:49:54 LOG6[1]: Clientcertificate not requested12:49:54 LOG7[1]: SSL state(connect): SSLv3 read server done A12:49:54 LOG7[1]: SSL state(connect): SSLv3 write client key exchange A12:49:54 LOG7[1]: SSL state(connect): SSLv3 write change cipher spec A12:49:54 LOG7[1]: SSL state(connect): SSLv3 write finished A12:49:54 LOG7[1]: SSL state(connect): SSLv3 flush data12:49:54 LOG7[1]: SSL state(connect): SSLv3 read finished A12:49:54 LOG7[1]: 2 client connect(s) requested12:49:54 LOG7[1]: 2 client connect(s) succeeded12:49:54 LOG7[1]: 0 client renegotiation(s) requested12:49:54 LOG7[1]: 0 session reuse(s)12:49:54 LOG6[1]: SSLconnected: new session negotiated12:49:54 LOG7[1]:Deallocating application specific data for addr index12:49:54 LOG6[1]: NegotiatedTLSv1.2 ciphersuite ECDHE-RSA-AES256-SHA384 (256-bit encryption)12:49:54 LOG7[1]:Compression: null, expansion: null12:49:56 LOG6[1]: Read socketclosed (readsocket)12:49:56 LOG7[1]: Sendingclose_notify alert12:49:56 LOG7[1]: SSL alert(write): warning: close notify12:49:56 LOG6[1]:SSL_shutdown successfully sent close_notify alert12:49:56 LOG6[1]: SSL socketclosed (SSL_read)12:49:56 LOG7[1]: Sent socketwrite shutdown12:49:56 LOG5[1]: Connectionclosed: 67 byte(s) sent to SSL, 11884 byte(s) sent to socket12:49:56 LOG7[1]: Remotedescriptor (FD=428) closed12:49:56 LOG7[1]: Localdescriptor (FD=404) closed12:49:56 LOG7[1]: Service[outlook-pop3] finished (0 left)

1 0

HTTPS proxy tunnel. ssl handshake failure
by Kirill Franko 22 Jul '16

22 Jul '16

1 1

AiX 7.1 TL3 SP6 - Stunnel Memory Usages grows after 24 hours
by Benjamin, Earl 19 Jul '16

19 Jul '16

Hello Everyone, I am running Stunnel-5.29 in AiX 7.1 TL3 SP6. I have added the DH param to the bottom of my CERT file. After approximately 24 hours or so the Stunnel CPU usage jumps to about 50% and after a few days to about 90%. Is there a configuration setting I've missed or compile option I need to consider? Thanks for your assistance in advance. Below is a cleaned up version of my config file. -Earl ------------------------------------------------- ; Verify peer certificate verify = 2 ; Certificate/key is needed in server mode and in client mode cert = /Server-certificate-all.pem key = /Server-certificate-all.pem CAfile = /all_root_ca.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = TLSv1 ; PID path pid = /etc/oraserver_stunnel.pid ; Turn off Nagle algorithm socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Debug level debug = 2 ; Use it for client mode client = no ; Ciphers ciphers = DHE-RSA-AES256-SHA ; Service-level configuration [ oraserver_DB ] accept = 15210 connect = server:1622 [ oraserver_ASM ] accept = 15211 connect = server:1621 This message and any attachments are solely for the use of intended recipients. The information contained herein may include trade secrets, protected health or personal information, privileged or otherwise confidential information. Unauthorized review, forwarding, printing, copying, distributing, or using such information is strictly prohibited and may be unlawful. If you are not an intended recipient, you are hereby notified that you received this email in error, and that any review, dissemination, distribution or copying of this email and any attachment is strictly prohibited. If you have received this email in error, please contact the sender and delete the message and any attachment from your system. Thank you for your cooperation

1 0

Man in the middle attack possibility
by Abhinav Srivastava 19 Jul '16

19 Jul '16

Hi, I'm trying to use stunnel to provide encryption for my application to server communication. Server is already ssl aware. I configured my app to talk to localhost:xyz, and configured stunnel in client mode to relay traffic from localhost:<xyz> to actual service. The stunnel to service ssl protocol would use the server certificate, as server is already ssl aware. For any reason if stunnel is not running it would become possible for a non-elevated attacker/malware to spin up a tcp server listening to xyz, essentially taking advantage of my re-configuration of app to talk to localhost:xyz, and spoof the actual server. Even if my app to server protocol had some anti-spoofing mechanism say e.g., reverse CHAP, the malware can easily relay the challenge and response by using the actual service. In my case the actual app is iscsi initiator software that is not in my control and cant be modified, while the server is an iscsi tcp server which I am free to modify. Are there any guidance/best practices around preventing this attack with stunnel? Thanks Abhinav

1 0

Client certificates now required by default?
by Wiest, Damian 07 Jul '16

07 Jul '16

After building stunnel 5.34 from source I noticed that my old config (5.22) was not working. [dwiest@716161-compute2 ~]$ sudo ./stunnel /etc/stunnel/stunnel.conf 2016.07.07 14:07:41 LOG5[ui]: stunnel 5.34 on x86_64-unknown-linux-gnu platform 2016.07.07 14:07:41 LOG5[ui]: Compiled/running with OpenSSL 1.0.1e-fips 11 Feb 2013 2016.07.07 14:07:41 LOG5[ui]: Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Auth:LIBWRAP 2016.07.07 14:07:41 LOG5[ui]: Reading configuration from file /etc/stunnel/stunnel.conf 2016.07.07 14:07:41 LOG5[ui]: UTF-8 byte order mark not detected 2016.07.07 14:07:41 LOG5[ui]: FIPS mode disabled 2016.07.07 14:07:41 LOG5[ui]: Configuration successful 2016.07.07 14:07:41 LOG5[cron]: Updating DH parameters 2016.07.07 14:07:42 LOG5[0]: Service [rabbitmq] accepted connection from 192.168.237.81:49535 2016.07.07 14:07:42 LOG3[0]: SSL_accept: Peer suddenly disconnected 2016.07.07 14:07:42 LOG5[0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.07.07 14:07:42 LOG5[1]: Service [rabbitmq] accepted connection from 192.168.237.81:49536 2016.07.07 14:07:42 LOG3[1]: SSL_accept: 140890C7: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate But I haven't enabled client certificate verification! [dwiest@716161-compute2 ~]$ sudo grep verify /etc/stunnel/stunnel.conf ; verify = 2 I have to explicitly set verify to 0 or 1 in order to connect without a client cert. Is this intentional? The documentation suggests that by default no verification should be taking place. -Damian -- Confidentiality Notice: This e-mail transmission may contain confidential or legally privileged information that is intended only for the individual or entity named in the e-mail address. If you have received this communication in error, please notify me by return e-mail, and destroy this communication and all copies thereof, including any attachments. Apervita ® is a registered trademark of Apervita Inc.

1 0

stunnel and hosts.allow
by Yousef Alhashemi 05 Jul '16

05 Jul '16

Hi, This may be a little bit off-topic, but does anyone here use stunnel with pan? My connections to stunnel (in pan) are always refused by libwrap. I was looking for the right rule to add to /etc/hosts.allow but nothing seems to work aside from "ALL : ALL" (which is obviously not good) and "nntps: KNOWN". Is the latter reasonable? The hosts_access(5) manpage is confusing to say the least. It mentions that daemon (the first token on any line) is the name of the daemon running the process, which would be "stunnel" in my case, but using "stunnel : LOCAL" or even "stunnel : ALL" doesn't work. The rule that seems to work, as mentioned, is "nntps : KNOWN" ("nntps" being the group name in stunnel.conf). What's even more confusing to me is that "nntps : LOCAL" does not work either. Nor does "nntps : localhost 127.0.0.1", "nntps : localhost", "nntps : 127.0.0.1", or "nntps : 192.168.1.". Pan is running on the same machine as stunnel so all connections must be coming from localhost. Why do these rules not trigger? Either way, I'd like to know the "least permissive" hosts.allow rule that would allow me to connect to my news provider from pan, and/or whether "nntps : KNOWN" is a safe option. Thanks, Yousef

3 6

Another OpenSSL 1.1.x patch - no ssl23.h any more
by Peter Pentchev 27 Jun '16

27 Jun '16

Hi, What do you think about the attached patch that fixes yet another OpenSSL 1.1.x compilation problem: the OpenSSL developers dropped the ssl23.h file altogether? Thanks for your work on stunnel! G'luck, Peter -- Peter Pentchev roam(a)ringlet.net roam(a)FreeBSD.org pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

1 0

Failed to redirect http to https
by Doris Hongmei 27 Jun '16

27 Jun '16

Hi Support, I setup stunnel to a web server with apache Configuration like below, --- /usr/local/etc/stunnel/stunnel.conf ---------- ; It is recommended to drop root privileges if stunnel is started by root setuid = nobody setgid = nobody ; TLS front-end to a web server [https] accept = 443 connect = 127.0.0.1:80 cert = /usr/local/etc/stunnel/stunnel.pem --- end of /usr/local/etc/stunnel/stunnel.conf ---------- After stunnel started, https://xxx/ is working, http://xxx/ is also still working , which doesn't redirect to https://xxx automatically. As my understanding, all the connections from http should redirect to https through stunnel, right? What steps did I miss? I need your help. Thanks. [Ericsson]<http://www.ericsson.com/> DORIS HONGMEI Software Configuration Mgmt Engineer BUSS SA OSS&BSS BL CPM DU SEP GZ RelGrp Ericsson 5&6F, No 44-46 Jianzhong Road 510630,Guangzhou,Tian He Software Park, China Mobile +8613922114721 Office +862085117729 doris.hongmei(a)ericsson.com www.ericsson.com [http://www.ericsson.com/current_campaign]<http://www.ericsson.com/current_campaign> Legal entity: Ericsson, registered office in CGC . This Communication is Confidential. We only send and receive email on the basis of the terms set out at www.ericsson.com/email_disclaimer<http://www.ericsson.com/email_disclaimer>

2 2

Re: [stunnel-users] FW: Stunnel with IIS8 on server 2012 64 bit
by J. Michael Drew 24 Jun '16

24 Jun '16

Jose, I have discovered what I did wrong. I did the original stunnel installs from the command line and then installed the stunnel service from the command line as well. When I installed the stunnel service it would break the website. So I removed the service (I thought) then I copied a shortcut to stunnel.exe to the Win start up> program folder. Both sites started working on the servers as long as I was logged in through an RDP session. I uninstalled everything and reinstalled. Stunnel 5.32 installs a Windows GUI on Server 2012 as well so I went back and used the Windows server 2012 desktop applications to install the windows service and to stop the GUI application. Everything is now working as expected. It appears that I was running two instances of stunnel at the same time and I didn’t completely remove the original stunnel service. Thanks for all of your help, Cheers, Michael From: Josealf.rm [mailto:[email protected]] Sent: Thursday, June 23, 2016 2:37 PM To: J. Michael Drew Subject: Re: [stunnel-users] FW: Stunnel with IIS8 on server 2012 64 bit Hi Michael, Did my last suggestions help with your issue? Regards El 20 jun 2016, a las 18:00, J. Michael Drew <jmichaeldrew(a)hotmail.com> escribió: .Jose, I appreciate your patience. Internet - Clients : 443 -> : https://website.company.com/website/ ________Firewall___________ Web\Presentation Layer 2 Win 2012 Webservers (443) not currently connected to the production LB, application needs to work before connecting to LB. This configuration is first time on 64 bit OS… Win 2012. IIS 8 running Jakarta ISAPI Filter\Stunnel to redirect 9001 to 9009: _________Firewall\App Layer________ Port 9009 Connects to App server running Apache Application is working as expected as long as I am logged in to the IIS 8 server. I can telnet to the APP layer over 9009 and I can reach these websites externally as expected. Firewalls are good. Please let me know any other information you need. Thank you again, Michael From: Jose Alf. [mailto:[email protected]] Sent: Monday, June 20, 2016 4:32 PM To: J. Michael Drew Subject: Re: [stunnel-users] FW: Stunnel with IIS8 on server 2012 64 bit Michael, Please take this in constructive way. I am trying to help, but it looks like you need to do some reading and homework. Please check http://catb.org/~esr/faqs/smart-questions.html <http://catb.org/%7Eesr/faqs/smart-questions.html> I suggest you draw a picture of your environment and explain well what you're trying to achieve. Show your client, your backend server, your stunnel server, include the IPs and ports they're listening to and everything should be easier. Don't forget any firewalls thay may be in the way. Regards, Jose. _____ From: J. Michael Drew <jmichaeldrew(a)hotmail.com> To: 'Jose Alf.' <josealf(a)rocketmail.com> Sent: Monday, June 20, 2016 1:00 PM Subject: RE: [stunnel-users] FW: Stunnel with IIS8 on server 2012 64 bit Hi Jose, I made the changes you suggested, but I am still getting the same behavior. My external address is: https://website.company.com/website I am not adding any ports to the address. Thanks so much for your help! Michael From: Jose Alf. [mailto:[email protected]] Sent: Monday, June 20, 2016 12:10 PM To: J. Michael Drew; stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] FW: Stunnel with IIS8 on server 2012 64 bit Michael, I guess what you want to do is to be able to connect to your internal Webserver via your Win2012 stunnel proxy using a URL like: https://yourwin2012dnsname:9001/ <https://yourwin2012dnsname:9009/> if that is correct, I suggest to adjust your configuration as follows: 1. Your stunnel mode must be server, not client. So adjust your service stanza as follows: [CLI9F529A0A] accept=9001 connect=10.xxx.xxx.xxx:9009 client=no 2. In your current configuration stunnel is listening only in the localhost ipv4 address (127.0.0.1). Therefore, you can only connect when you are logged on the server, you can't connect from a remote client. Hope this helps you clarify what's going on. Regards, Jose From: J. Michael Drew [mailto:[email protected]] Sent: Monday, June 20, 2016 9:54 AM To: 'Josealf.rm' Subject: RE: [stunnel-users] Stunnel with IIS8 on server 2012 64 bit Jose, Once logged in to the server I can open a browser on the server and connect through https://localhost/website and I can log in to the site externally as expected. Here are the log files from IIS and stunnel where stunnel is running as a service on the Windows 2012 server: When I am not logged in to the server it fails: #Software: Microsoft Internet Information Services 8.5 #Version: 1.0 #Date: 2016-06-20 00:30:21 #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken 2016-06-20 00:30:21 159.xxx.xxx.xxx HEAD / - 443 - 190.xxx.xxx.xxx - - 200 0 0 1218 #Software: Microsoft Internet Information Services 8.5 #Version: 1.0 #Date: 2016-06-20 05:41:01 #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken 2016-06-20 05:41:01 10.xxx.xxx.xxx OPTIONS /C$/windows/system32/NTDLL.DLL - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 200 0 0 500 2016-06-20 05:41:01 10.xxx.xxx.xxx PROPFIND /C$/windows/system32/NTDLL.DLL - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 46 2016-06-20 05:41:01 10.xxx.xxx.xxx PROPFIND /C$/windows/system32 - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 218 2016-06-20 05:41:16 10.xxx.xxx.xxx PROPFIND /patch-{682810b5-36dc-4e5d-81dd-6c02cd8f445b}-patchtoolsd.exe - 80 - 159.82.156.241 Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 64 62 2016-06-20 05:41:27 10.xxx.xxx.xxx PROPFIND /N$cl64.exe - 80 - 159.xxx.xxx.xxx 1 Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 62 2016-06-20 05:41:27 10.xxx.xxx.xxx PROPFIND /C$rome.dll - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 296 Stunell.conf: cert = extwebsvr_ver.pem ; Some performance tuning socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Peer Authentication verify = 2 CAfile = extwebsvr_root.pem ; Debug mode - useful for troubleshooting debug = 7 output = stunnel.log ; Client mode client = yes ; Setup tunnels to each EMS node [CLIxxxxxxxx)] accept=127.0.0.1:9001 connect=10.xxx.xxx.xxx:9009 Stunnel.log: 2016.06.20 09:17:39 LOG7[main]: No limit detected for the number of clients 2016.06.20 09:17:39 LOG5[main]: stunnel 5.27 on x86-pc-msvc-1500 platform 2016.06.20 09:17:39 LOG5[main]: Compiled/running with OpenSSL 1.0.2e-fips 3 Dec 2015 2016.06.20 09:17:39 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2016.06.20 09:17:39 LOG7[main]: errno: (*_errno()) 2016.06.20 09:17:39 LOG5[main]: Reading configuration from file stunnel.conf 2016.06.20 09:17:39 LOG7[ui]: GUI message loop initialized 2016.06.20 09:17:39 LOG7[cron]: Cron thread initialized 2016.06.20 09:17:39 LOG5[main]: UTF-8 byte order mark detected 2016.06.20 09:17:39 LOG6[main]: Initializing service [CLI9F529A0A] 2016.06.20 09:17:39 LOG6[main]: Loading certificate from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Certificate loaded from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Loading private key from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Private key loaded from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG7[main]: Private key check succeeded 2016.06.20 09:17:39 LOG4[main]: Service [CLIxxxxxxxx] uses "verify = 2" without subject checks 2016.06.20 09:17:39 LOG4[main]: Use "checkHost" or "checkIP" to restrict trusted certificates 2016.06.20 09:17:39 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2016.06.20 09:17:39 LOG5[main]: Configuration successful Thanks for your help, Michael From: Josealf.rm [mailto:[email protected]] Sent: Monday, June 20, 2016 8:01 AM To: J. Michael Drew Cc: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Stunnel with IIS8 on server 2012 64 bit Michael, Is your stunnel running as a service? Please post sanitized logs and configuration for a better diagnostic ... Regards Jose El 20 jun 2016, a las 6:39, J. Michael Drew <jmichaeldrew(a)hotmail.com> escribió: Hi, I have a website on IIS8 and am using stunnel to forward requests over 9009 inside to my application server. When I log in to the IIS server and stay logged in everything works as expected. When I log off the IIS 8 web server my site is unreachable with a “service is unavailable”. Can someone help me? Sincere thanks, Michael _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

2 1

Re: [stunnel-users] FW: Stunnel with IIS8 on server 2012 64 bit
by J. Michael Drew 22 Jun '16

22 Jun '16

.Jose, I appreciate your patience. Internet - Clients : 443 -> : https://website.company.com/website/ ________Firewall___________ Web\Presentation Layer 2 Win 2012 Webservers (443) not currently connected to the production LB, application needs to work before connecting to LB. This configuration is first time on 64 bit OS… Win 2012. IIS 8 running Jakarta ISAPI Filter\Stunnel to redirect 9001 to 9009: _________Firewall\App Layer________ Port 9009 Connects to App server running Apache Application is working as expected as long as I am logged in to the IIS 8 server. I can telnet to the APP layer over 9009 and I can reach these websites externally as expected. Firewalls are good. Please let me know any other information you need. Thank you again, Michael From: Jose Alf. [mailto:[email protected]] Sent: Monday, June 20, 2016 4:32 PM To: J. Michael Drew Subject: Re: [stunnel-users] FW: Stunnel with IIS8 on server 2012 64 bit Michael, Please take this in constructive way. I am trying to help, but it looks like you need to do some reading and homework. Please check http://catb.org/~esr/faqs/smart-questions.html <http://catb.org/%7Eesr/faqs/smart-questions.html> I suggest you draw a picture of your environment and explain well what you're trying to achieve. Show your client, your backend server, your stunnel server, include the IPs and ports they're listening to and everything should be easier. Don't forget any firewalls thay may be in the way. Regards, Jose. _____ From: J. Michael Drew <jmichaeldrew(a)hotmail.com> To: 'Jose Alf.' <josealf(a)rocketmail.com> Sent: Monday, June 20, 2016 1:00 PM Subject: RE: [stunnel-users] FW: Stunnel with IIS8 on server 2012 64 bit Hi Jose, I made the changes you suggested, but I am still getting the same behavior. My external address is: https://website.company.com/website I am not adding any ports to the address. Thanks so much for your help! Michael From: Jose Alf. [mailto:[email protected]] Sent: Monday, June 20, 2016 12:10 PM To: J. Michael Drew; stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] FW: Stunnel with IIS8 on server 2012 64 bit Michael, I guess what you want to do is to be able to connect to your internal Webserver via your Win2012 stunnel proxy using a URL like: https://yourwin2012dnsname:9001/ <https://yourwin2012dnsname:9009/> if that is correct, I suggest to adjust your configuration as follows: 1. Your stunnel mode must be server, not client. So adjust your service stanza as follows: [CLI9F529A0A] accept=9001 connect=10.xxx.xxx.xxx:9009 client=no 2. In your current configuration stunnel is listening only in the localhost ipv4 address (127.0.0.1). Therefore, you can only connect when you are logged on the server, you can't connect from a remote client. Hope this helps you clarify what's going on. Regards, Jose From: J. Michael Drew [mailto:[email protected]] Sent: Monday, June 20, 2016 9:54 AM To: 'Josealf.rm' Subject: RE: [stunnel-users] Stunnel with IIS8 on server 2012 64 bit Jose, Once logged in to the server I can open a browser on the server and connect through https://localhost/website and I can log in to the site externally as expected. Here are the log files from IIS and stunnel where stunnel is running as a service on the Windows 2012 server: When I am not logged in to the server it fails: #Software: Microsoft Internet Information Services 8.5 #Version: 1.0 #Date: 2016-06-20 00:30:21 #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken 2016-06-20 00:30:21 159.xxx.xxx.xxx HEAD / - 443 - 190.xxx.xxx.xxx - - 200 0 0 1218 #Software: Microsoft Internet Information Services 8.5 #Version: 1.0 #Date: 2016-06-20 05:41:01 #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken 2016-06-20 05:41:01 10.xxx.xxx.xxx OPTIONS /C$/windows/system32/NTDLL.DLL - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 200 0 0 500 2016-06-20 05:41:01 10.xxx.xxx.xxx PROPFIND /C$/windows/system32/NTDLL.DLL - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 46 2016-06-20 05:41:01 10.xxx.xxx.xxx PROPFIND /C$/windows/system32 - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 218 2016-06-20 05:41:16 10.xxx.xxx.xxx PROPFIND /patch-{682810b5-36dc-4e5d-81dd-6c02cd8f445b}-patchtoolsd.exe - 80 - 159.82.156.241 Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 64 62 2016-06-20 05:41:27 10.xxx.xxx.xxx PROPFIND /N$cl64.exe - 80 - 159.xxx.xxx.xxx 1 Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 62 2016-06-20 05:41:27 10.xxx.xxx.xxx PROPFIND /C$rome.dll - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 296 Stunell.conf: cert = extwebsvr_ver.pem ; Some performance tuning socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Peer Authentication verify = 2 CAfile = extwebsvr_root.pem ; Debug mode - useful for troubleshooting debug = 7 output = stunnel.log ; Client mode client = yes ; Setup tunnels to each EMS node [CLIxxxxxxxx)] accept=127.0.0.1:9001 connect=10.xxx.xxx.xxx:9009 Stunnel.log: 2016.06.20 09:17:39 LOG7[main]: No limit detected for the number of clients 2016.06.20 09:17:39 LOG5[main]: stunnel 5.27 on x86-pc-msvc-1500 platform 2016.06.20 09:17:39 LOG5[main]: Compiled/running with OpenSSL 1.0.2e-fips 3 Dec 2015 2016.06.20 09:17:39 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2016.06.20 09:17:39 LOG7[main]: errno: (*_errno()) 2016.06.20 09:17:39 LOG5[main]: Reading configuration from file stunnel.conf 2016.06.20 09:17:39 LOG7[ui]: GUI message loop initialized 2016.06.20 09:17:39 LOG7[cron]: Cron thread initialized 2016.06.20 09:17:39 LOG5[main]: UTF-8 byte order mark detected 2016.06.20 09:17:39 LOG6[main]: Initializing service [CLI9F529A0A] 2016.06.20 09:17:39 LOG6[main]: Loading certificate from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Certificate loaded from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Loading private key from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Private key loaded from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG7[main]: Private key check succeeded 2016.06.20 09:17:39 LOG4[main]: Service [CLIxxxxxxxx] uses "verify = 2" without subject checks 2016.06.20 09:17:39 LOG4[main]: Use "checkHost" or "checkIP" to restrict trusted certificates 2016.06.20 09:17:39 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2016.06.20 09:17:39 LOG5[main]: Configuration successful Thanks for your help, Michael From: Josealf.rm [mailto:[email protected]] Sent: Monday, June 20, 2016 8:01 AM To: J. Michael Drew Cc: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Stunnel with IIS8 on server 2012 64 bit Michael, Is your stunnel running as a service? Please post sanitized logs and configuration for a better diagnostic ... Regards Jose El 20 jun 2016, a las 6:39, J. Michael Drew <jmichaeldrew(a)hotmail.com> escribió: Hi, I have a website on IIS8 and am using stunnel to forward requests over 9009 inside to my application server. When I log in to the IIS server and stay logged in everything works as expected. When I log off the IIS 8 web server my site is unreachable with a “service is unavailable”. Can someone help me? Sincere thanks, Michael _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

2 1

MAC OS 32 bits
by Francisco Pereira 21 Jun '16

21 Jun '16

Is stunnel compatible with Mac Os 32-bit?Which installer should I consider for that?

1 0

FW: FW: Stunnel with IIS8 on server 2012 64 bit
by J. Michael Drew 20 Jun '16

20 Jun '16

From: J. Michael Drew [mailto:[email protected]] Sent: Monday, June 20, 2016 2:01 PM To: 'Jose Alf.' Subject: RE: [stunnel-users] FW: Stunnel with IIS8 on server 2012 64 bit Hi Jose, I made the changes you suggested, but I am still getting the same behavior. My external address is: https://website.company.com/website I am not adding any ports to the address. Thanks so much for your help! Michael From: Jose Alf. [mailto:[email protected]] Sent: Monday, June 20, 2016 12:10 PM To: J. Michael Drew; stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] FW: Stunnel with IIS8 on server 2012 64 bit Michael, I guess what you want to do is to be able to connect to your internal Webserver via your Win2012 stunnel proxy using a URL like: https://yourwin2012dnsname:9001/ <https://yourwin2012dnsname:9009/> if that is correct, I suggest to adjust your configuration as follows: 1. Your stunnel mode must be server, not client. So adjust your service stanza as follows: [CLI9F529A0A] accept=9001 connect=10.xxx.xxx.xxx:9009 client=no 2. In your current configuration stunnel is listening only in the localhost ipv4 address (127.0.0.1). Therefore, you can only connect when you are logged on the server, you can't connect from a remote client. Hope this helps you clarify what's going on. Regards, Jose From: J. Michael Drew [mailto:[email protected]] Sent: Monday, June 20, 2016 9:54 AM To: 'Josealf.rm' Subject: RE: [stunnel-users] Stunnel with IIS8 on server 2012 64 bit Jose, Once logged in to the server I can open a browser on the server and connect through https://localhost/website and I can log in to the site externally as expected. Here are the log files from IIS and stunnel where stunnel is running as a service on the Windows 2012 server: When I am not logged in to the server it fails: #Software: Microsoft Internet Information Services 8.5 #Version: 1.0 #Date: 2016-06-20 00:30:21 #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken 2016-06-20 00:30:21 159.xxx.xxx.xxx HEAD / - 443 - 190.xxx.xxx.xxx - - 200 0 0 1218 #Software: Microsoft Internet Information Services 8.5 #Version: 1.0 #Date: 2016-06-20 05:41:01 #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken 2016-06-20 05:41:01 10.xxx.xxx.xxx OPTIONS /C$/windows/system32/NTDLL.DLL - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 200 0 0 500 2016-06-20 05:41:01 10.xxx.xxx.xxx PROPFIND /C$/windows/system32/NTDLL.DLL - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 46 2016-06-20 05:41:01 10.xxx.xxx.xxx PROPFIND /C$/windows/system32 - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 218 2016-06-20 05:41:16 10.xxx.xxx.xxx PROPFIND /patch-{682810b5-36dc-4e5d-81dd-6c02cd8f445b}-patchtoolsd.exe - 80 - 159.82.156.241 Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 64 62 2016-06-20 05:41:27 10.xxx.xxx.xxx PROPFIND /N$cl64.exe - 80 - 159.xxx.xxx.xxx 1 Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 62 2016-06-20 05:41:27 10.xxx.xxx.xxx PROPFIND /C$rome.dll - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 296 Stunell.conf: cert = extwebsvr_ver.pem ; Some performance tuning socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Peer Authentication verify = 2 CAfile = extwebsvr_root.pem ; Debug mode - useful for troubleshooting debug = 7 output = stunnel.log ; Client mode client = yes ; Setup tunnels to each EMS node [CLIxxxxxxxx)] accept=127.0.0.1:9001 connect=10.xxx.xxx.xxx:9009 Stunnel.log: 2016.06.20 09:17:39 LOG7[main]: No limit detected for the number of clients 2016.06.20 09:17:39 LOG5[main]: stunnel 5.27 on x86-pc-msvc-1500 platform 2016.06.20 09:17:39 LOG5[main]: Compiled/running with OpenSSL 1.0.2e-fips 3 Dec 2015 2016.06.20 09:17:39 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2016.06.20 09:17:39 LOG7[main]: errno: (*_errno()) 2016.06.20 09:17:39 LOG5[main]: Reading configuration from file stunnel.conf 2016.06.20 09:17:39 LOG7[ui]: GUI message loop initialized 2016.06.20 09:17:39 LOG7[cron]: Cron thread initialized 2016.06.20 09:17:39 LOG5[main]: UTF-8 byte order mark detected 2016.06.20 09:17:39 LOG6[main]: Initializing service [CLI9F529A0A] 2016.06.20 09:17:39 LOG6[main]: Loading certificate from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Certificate loaded from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Loading private key from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Private key loaded from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG7[main]: Private key check succeeded 2016.06.20 09:17:39 LOG4[main]: Service [CLIxxxxxxxx] uses "verify = 2" without subject checks 2016.06.20 09:17:39 LOG4[main]: Use "checkHost" or "checkIP" to restrict trusted certificates 2016.06.20 09:17:39 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2016.06.20 09:17:39 LOG5[main]: Configuration successful Thanks for your help, Michael From: Josealf.rm [mailto:[email protected]] Sent: Monday, June 20, 2016 8:01 AM To: J. Michael Drew Cc: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Stunnel with IIS8 on server 2012 64 bit Michael, Is your stunnel running as a service? Please post sanitized logs and configuration for a better diagnostic ... Regards Jose El 20 jun 2016, a las 6:39, J. Michael Drew <jmichaeldrew(a)hotmail.com> escribió: Hi, I have a website on IIS8 and am using stunnel to forward requests over 9009 inside to my application server. When I log in to the IIS server and stay logged in everything works as expected. When I log off the IIS 8 web server my site is unreachable with a “service is unavailable”. Can someone help me? Sincere thanks, Michael _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Stunnel connection host address not appearing in sent message.
by Donald F. Coffin 20 Jun '16

20 Jun '16

I am using stunnel to enable SoapUI Mock Servers to support SSL connections. I am attempting to send the following SSL message: https://services.greenbuttondata.org/oauth/token?grant_type=client_credentia ls <https://services.greenbuttondata.org/oauth/token?grant_type=client_credenti als&scope=FB=39_40> &scope=FB=39_40 Using Wireshark, it appears the message being sent is POST /oauth/token?grant_type=client_credentials&scope=FB=39_40 which is receiving the following response: Error 404 (Not Found) The contents of the stunnel.conf file is: ; ***************************************************************** : * Service definitions (at least one service has to be defined) * ; ***************************************************************** ; ***************************************************************** ; * Resource Server * ; ***************************************************************** [resourceServer] accept=localhost:8080 connect=services.greenbuttondata.org:443 ciphers=AES128-SHA client=yes cert=/etc/stunnel/stunnel.pem verify=0 ; ***************************************************************** ; * Authorization Server * ; ***************************************************************** [authorizationServer] accept=localhost:8082 connect=services.greenbuttondata.org:443 ciphers=AES128-SHA client=yes cert=/etc/stunnel/stunnel.pem verify=0 [tpserver] accept=localhost:8444 connect=localhost:8081 cert=/etc/stunnel/stunnel.pem ciphers=AES128-SHA client=no verify=0 The HTTP log from SoapUI shows the following: "POST /oauth/token?grant_type=client_credentials&scope=FB=36_40 HTTP/1.1" "Accept-Encoding: gzip.deflate" "Content-Type: application/json" "Authorization: Basic UkVHSV... " (not shown for security) "Content-Length: 0" "Host: localhost:8082" "Connection: Keep-Alive" "User-Agent: Apache-HttpClient/4.1.1 (java 1.5)" "HTTP/1.1 404 Not Found" "Content-Type: text/html: charset=UTF-8" "Server: ghs" "Content-Length: 1623" "X-XSS-Protection: 1; mode=block" "X-Frame-Options: SAMEORIGIN" Through experimentation, the request only fails when using the stunnel proxy server, but works when sent directly to the targeted endpoint. Any assistance would be greatly appreciated. Best regards, Don Donald F. Coffin Technical Manager Green Button Alliance 2335 Dunwoody Crossing Suite E Dunwoody, GA 30338-8221 http://www.greenbuttonalliance.org <http://www.greenbuttonalliance.org/> (949) 636-8571 Mobile

1 0

FW: Stunnel with IIS8 on server 2012 64 bit
by J. Michael Drew 20 Jun '16

20 Jun '16

From: J. Michael Drew [mailto:[email protected]] Sent: Monday, June 20, 2016 9:54 AM To: 'Josealf.rm' Subject: RE: [stunnel-users] Stunnel with IIS8 on server 2012 64 bit Jose, Once logged in to the server I can open a browser on the server and connect through https://localhost/website and I can log in to the site externally as expected. Here are the log files from IIS and stunnel where stunnel is running as a service on the Windows 2012 server: When I am not logged in to the server it fails: #Software: Microsoft Internet Information Services 8.5 #Version: 1.0 #Date: 2016-06-20 00:30:21 #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken 2016-06-20 00:30:21 159.xxx.xxx.xxx HEAD / - 443 - 190.xxx.xxx.xxx - - 200 0 0 1218 #Software: Microsoft Internet Information Services 8.5 #Version: 1.0 #Date: 2016-06-20 05:41:01 #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken 2016-06-20 05:41:01 10.xxx.xxx.xxx OPTIONS /C$/windows/system32/NTDLL.DLL - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 200 0 0 500 2016-06-20 05:41:01 10.xxx.xxx.xxx PROPFIND /C$/windows/system32/NTDLL.DLL - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 46 2016-06-20 05:41:01 10.xxx.xxx.xxx PROPFIND /C$/windows/system32 - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 218 2016-06-20 05:41:16 10.xxx.xxx.xxx PROPFIND /patch-{682810b5-36dc-4e5d-81dd-6c02cd8f445b}-patchtoolsd.exe - 80 - 159.82.156.241 Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 64 62 2016-06-20 05:41:27 10.xxx.xxx.xxx PROPFIND /N$cl64.exe - 80 - 159.xxx.xxx.xxx 1 Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 62 2016-06-20 05:41:27 10.xxx.xxx.xxx PROPFIND /C$rome.dll - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 296 Stunell.conf: cert = extwebsvr_ver.pem ; Some performance tuning socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Peer Authentication verify = 2 CAfile = extwebsvr_root.pem ; Debug mode - useful for troubleshooting debug = 7 output = stunnel.log ; Client mode client = yes ; Setup tunnels to each EMS node [CLIxxxxxxxx)] accept=127.0.0.1:9001 connect=10.xxx.xxx.xxx:9009 Stunnel.log: 2016.06.20 09:17:39 LOG7[main]: No limit detected for the number of clients 2016.06.20 09:17:39 LOG5[main]: stunnel 5.27 on x86-pc-msvc-1500 platform 2016.06.20 09:17:39 LOG5[main]: Compiled/running with OpenSSL 1.0.2e-fips 3 Dec 2015 2016.06.20 09:17:39 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2016.06.20 09:17:39 LOG7[main]: errno: (*_errno()) 2016.06.20 09:17:39 LOG5[main]: Reading configuration from file stunnel.conf 2016.06.20 09:17:39 LOG7[ui]: GUI message loop initialized 2016.06.20 09:17:39 LOG7[cron]: Cron thread initialized 2016.06.20 09:17:39 LOG5[main]: UTF-8 byte order mark detected 2016.06.20 09:17:39 LOG6[main]: Initializing service [CLI9F529A0A] 2016.06.20 09:17:39 LOG6[main]: Loading certificate from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Certificate loaded from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Loading private key from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Private key loaded from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG7[main]: Private key check succeeded 2016.06.20 09:17:39 LOG4[main]: Service [CLIxxxxxxxx] uses "verify = 2" without subject checks 2016.06.20 09:17:39 LOG4[main]: Use "checkHost" or "checkIP" to restrict trusted certificates 2016.06.20 09:17:39 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2016.06.20 09:17:39 LOG5[main]: Configuration successful Thanks for your help, Michael From: Josealf.rm [mailto:[email protected]] Sent: Monday, June 20, 2016 8:01 AM To: J. Michael Drew Cc: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Stunnel with IIS8 on server 2012 64 bit Michael, Is your stunnel running as a service? Please post sanitized logs and configuration for a better diagnostic ... Regards Jose El 20 jun 2016, a las 6:39, J. Michael Drew <jmichaeldrew(a)hotmail.com> escribió: Hi, I have a website on IIS8 and am using stunnel to forward requests over 9009 inside to my application server. When I log in to the IIS server and stay logged in everything works as expected. When I log off the IIS 8 web server my site is unreachable with a “service is unavailable”. Can someone help me? Sincere thanks, Michael _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

2 1

FW: Stunnel with IIS8 on server 2012 64 bit
by J. Michael Drew 20 Jun '16

20 Jun '16

From: J. Michael Drew [mailto:[email protected]] Sent: Monday, June 20, 2016 9:54 AM To: 'Josealf.rm' Subject: RE: [stunnel-users] Stunnel with IIS8 on server 2012 64 bit Jose, Once logged in to the server I can open a browser on the server and connect through https://localhost/website and I can log in to the site externally as expected. Here are the log files from IIS and stunnel where stunnel is running as a service on the Windows 2012 server: When I am not logged in to the server it fails: #Software: Microsoft Internet Information Services 8.5 #Version: 1.0 #Date: 2016-06-20 00:30:21 #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken 2016-06-20 00:30:21 159.xxx.xxx.xxx HEAD / - 443 - 190.xxx.xxx.xxx - - 200 0 0 1218 #Software: Microsoft Internet Information Services 8.5 #Version: 1.0 #Date: 2016-06-20 05:41:01 #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken 2016-06-20 05:41:01 10.xxx.xxx.xxx OPTIONS /C$/windows/system32/NTDLL.DLL - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 200 0 0 500 2016-06-20 05:41:01 10.xxx.xxx.xxx PROPFIND /C$/windows/system32/NTDLL.DLL - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 46 2016-06-20 05:41:01 10.xxx.xxx.xxx PROPFIND /C$/windows/system32 - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 218 2016-06-20 05:41:16 10.xxx.xxx.xxx PROPFIND /patch-{682810b5-36dc-4e5d-81dd-6c02cd8f445b}-patchtoolsd.exe - 80 - 159.82.156.241 Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 64 62 2016-06-20 05:41:27 10.xxx.xxx.xxx PROPFIND /N$cl64.exe - 80 - 159.xxx.xxx.xxx 1 Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 62 2016-06-20 05:41:27 10.xxx.xxx.xxx PROPFIND /C$rome.dll - 80 - 159.xxx.xxx.xxx Microsoft-WebDAV-MiniRedir/6.1.7601 - 404 0 2 296 Stunell.conf: cert = extwebsvr_ver.pem ; Some performance tuning socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Peer Authentication verify = 2 CAfile = extwebsvr_root.pem ; Debug mode - useful for troubleshooting debug = 7 output = stunnel.log ; Client mode client = yes ; Setup tunnels to each EMS node [CLIxxxxxxxx)] accept=127.0.0.1:9001 connect=10.xxx.xxx.xxx:9009 Stunnel.log: 2016.06.20 09:17:39 LOG7[main]: No limit detected for the number of clients 2016.06.20 09:17:39 LOG5[main]: stunnel 5.27 on x86-pc-msvc-1500 platform 2016.06.20 09:17:39 LOG5[main]: Compiled/running with OpenSSL 1.0.2e-fips 3 Dec 2015 2016.06.20 09:17:39 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2016.06.20 09:17:39 LOG7[main]: errno: (*_errno()) 2016.06.20 09:17:39 LOG5[main]: Reading configuration from file stunnel.conf 2016.06.20 09:17:39 LOG7[ui]: GUI message loop initialized 2016.06.20 09:17:39 LOG7[cron]: Cron thread initialized 2016.06.20 09:17:39 LOG5[main]: UTF-8 byte order mark detected 2016.06.20 09:17:39 LOG6[main]: Initializing service [CLI9F529A0A] 2016.06.20 09:17:39 LOG6[main]: Loading certificate from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Certificate loaded from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Loading private key from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG6[main]: Private key loaded from file: extwebsvr_ver.pem 2016.06.20 09:17:39 LOG7[main]: Private key check succeeded 2016.06.20 09:17:39 LOG4[main]: Service [CLIxxxxxxxx] uses "verify = 2" without subject checks 2016.06.20 09:17:39 LOG4[main]: Use "checkHost" or "checkIP" to restrict trusted certificates 2016.06.20 09:17:39 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2016.06.20 09:17:39 LOG5[main]: Configuration successful Thanks for your help, Michael From: Josealf.rm [mailto:[email protected]] Sent: Monday, June 20, 2016 8:01 AM To: J. Michael Drew Cc: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] Stunnel with IIS8 on server 2012 64 bit Michael, Is your stunnel running as a service? Please post sanitized logs and configuration for a better diagnostic ... Regards Jose El 20 jun 2016, a las 6:39, J. Michael Drew <jmichaeldrew(a)hotmail.com> escribió: Hi, I have a website on IIS8 and am using stunnel to forward requests over 9009 inside to my application server. When I log in to the IIS server and stay logged in everything works as expected. When I log off the IIS 8 web server my site is unreachable with a “service is unavailable”. Can someone help me? Sincere thanks, Michael _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Stunnel with IIS8 on server 2012 64 bit
by J. Michael Drew 20 Jun '16

20 Jun '16

Hi, I have a website on IIS8 and am using stunnel to forward requests over 9009 inside to my application server. When I log in to the IIS server and stay logged in everything works as expected. When I log off the IIS 8 web server my site is unreachable with a "service is unavailable". Can someone help me? Sincere thanks, Michael

2 1

Compiling for Windows CE
by Bart de Waal 15 Jun '16

15 Jun '16

Hello, Are there more up to date instructions for compiling on Windows CE? I found the version here that works but is old and missing one of the features I need to connect to the server: http://www.usenix.org.uk/mirrors/stunnel/wce/ The instructions for building say you need evt2002web_min.exe, which as far as I can tell is no longer available. I can't get the newer version (evc4.exe) to work on a modern windows system (or under linux using wine) either. I think the CE version is still being used, as I saw references to it in the latest changelog. If someone has a more modern guide to building it I would appreciate it. Thanks, Bart de Waal

1 0

SSL Error
by Randall LeJeune 14 Jun '16

14 Jun '16

Hello. I am getting the following error when I try to run stunnel: [root@doadmzqas stunnel]# stunnel [ ] Clients allowed=31999 [.] stunnel 5.17 on powerpc-ibm-aix5.2.0.0 platform [.] Compiled/running with OpenSSL 1.0.1s 1 Mar 2016 [.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_Errno()) [.] Reading configuration from file /opt/freeware/etc/stunnel/stunnel.conf [.] UTF-8 byte order mark not detected [.] FIPS mode disabled [ ] Compression disabled [ ] Snagged 64 random bytes from /home/root/.rnd [ ] Wrote 1024 new random bytes to /home/root/.rnd [ ] PRNG seeded successfully [ ] Initializing service [sapdp3202] [ ] Loading certificate from file: /opt/freeware/etc/stunnel/stunnel.pem [!] error queue: 140DC002: error:140DC002:SSL routines:SSL_CTX_use_certificate_chain_file:system lib [!] error queue: 20074002: error:20074002:BIO routines:FILE_CTRL:system lib [!] SSL_CTX_use_certificate_chain_file: 2001002: error:02001002:system library:fopen:No such file or directory [!] Service [sapdp3202]: Failed to initialize SSL context The version is 5.17 as you can see above. My config file looks like this: ; Log file (enable for troubleshooting) output = /var/log/stunnel.log ; SSL Certificate and key files cert = /opt/freeware/etc/stunnel/stunnel.pem key = /opt/freeware/etc/stunnel/stunnel.key ; Restrict to FIPS compliant ciphers only ciphers = FIPS ; Force the SSL version to TLSv1 only sslVersion = TLSv1 ; The cipher list and SSL version restrictions above should make us ; _de_facto_ FIPS compliant; our OpenSSL library is *not* FIPS ; compliant, so this cannot be set to 'yes' fips = no [sapdp3202] client = yes accept = 127.0.0.1:3202 connect = doaprdssl.dot.com.gov:4709 The OS is AIX version 7. Does anybody have any idea what this means? Thanks in advance.

1 0

HTTP Strict Transport Security (HSTS) header
by Andrey 06 Jun '16

06 Jun '16

Hi! How I can enable HTTP Strict Transport Security (HSTS) header on stunnel ? Thank you Best regards, Andrey

2 1

openssl warning
by Vpn Bekhar 06 Jun '16

06 Jun '16

Hi, When I install stunnel on my windows server i see this error: stunnel warning can't open config file: /devel/win32/openssl/openssl.cnf please help me thank you so much best regards,

1 0

Broadband and stunnel weird behavior
by Javier 04 Jun '16

04 Jun '16

Hi, I was in doubt if post this or not because I couldn't replicate with enough similarities. But as it may be worth, if it is an actual bug, or help others... why not? Here I have to say that it is more noticeable under Windows 2000. That doesn’t mean doesn’t happen on higher OSs, but, from XP, it isn’t as noticeable. So, please, don’t stop reading here. But, hey, I know it is obsolete, and I know this is long and I’ll understand if you don’t want to read this. I tend to make a lot of “speed tests” because ISPs in my country… well, if you have luck, great, if not, brace yourself with the fights. Maybe as other countries :/ About February my download broadband was enhanced from 30Mb to 50Mb. This is important because is when it started all. With only 30Mb I didn’t notice any problem. “Speed tests“ were fine with “only” 30Mb and all matched the contracted speed and even a bit more. But when I had 50Mb I started to see some annoyances that sometimes was over 50Mb and others... if I had the luck to have 30Mb, it was a miracle. It wasn’t the test used. It was any test, with any technology (flash, html5, java, etc). The difference was just a couple of Mb. But all reflected the problems. They were so random, but something in common is that the tests didn’t show the correct speed at the end of my PC usage day. So I thought, something in memory, maybe, was causing it. But, also, it didn’t happen all days. At the end of the day, sometimes, I topped the 50Mb. And here starts the discarding process. I have a humble Pentium 4 and, even it is not powerful, one of the things I do (that I won’t explain why) is to throttle it (decrease speed). It is one of the first things I discarded, because as higher the broadband, the CPU load at full speed is higher as well. I only noticed a little improvement. This wasn’t the problem. Even I uninstalled the filter driver. So, if the CPU wasn’t the problem, programs should be. And I started with everything. And I left Stunnel as one of the latest. And there was the problem. When Stunnel is open, the speed cuts at about 30Mb. Yeah, I couldn’t believe myself either. After several tests, I discovered that Stunnel isn’t either the problem itself. The problem comes from the amount of services in .conf file. The more you have, the more speed problems you’ll have. I discovered this with the second instance of Stunnel I use for servers, which only has 7 services (3 SNI). I mainly use Stunnel as client for non-SSL aware programs and I have set 16 services. The options of .conf file, or services options, seems to don’t have much effect on speed tests. At the end, one way or another, the result is that if I open Stunnel, I can’t top full speed. I close it and voilà!, even during the same speed test. What is causing it? Probably just Windows 2000, or maybe not. Windows 2000 doesn’t have a connection limit as XP, one of the things I thought about. Anyway, I just wanted to shared this with you, just in case helps or anything. Regards. System specifications: Windows 2000 SP4 // XP SP2 (testing purposes) P4 2.8Ghz RAM 2GB RTL8139 Fast Ethernet Full Duplex

1 0

Re: [stunnel-users] Public domain [PATCH] support environment variables in config file
by Dmitry Bakshaev 31 May '16

31 May '16

2016-05-31 12:02 GMT+04:00 Pierre Delaage <delaage.pierre(a)free.fr>: > Hi Michal, > Did not have a look at the code yet, but should it be possible to replace > envvars usage by some keys in the registry on windows platform and/or > %userprofile%/config-file ? > why not just start stunnel with config parameter on command line? stunnel %USERPROFILE%/stunnel-config-file (windows) stunnel ${HOME}/stunnel-config-file (*nix)

2 1

Re: [stunnel-users] IPv4 and IPv6
by Konstantin Belousov 31 May '16

31 May '16

On Tue, May 31, 2016 at 08:04:24AM +0200, Micha?? Trojnara wrote: > On 31.05.2016 00:42, Konstantin Belousov wrote: > > I have a following configuration for the outgoing connection > > [XXX-1] > > client = yes > > accept = 127.0.0.1:1564 > > connect = some-server:9999 > > local = some-other-address > [cut] > > The socket was created with INET6 address family, but bind was done for > > INET AF. > > This is pretty much expected if "some-server:9999" is an IPv6 address > and "some-other-address" is an IPv4 address. The "local" option indeed > cannot handle a mix of IPv4 and IPv6 "connect" addresses. Usually some-server is the list of addresses, one of them is IPv4, and another is IPv6. This is the only reasonable way to name dual-stack host. > > What do you think might be a proper solution? I would expect that the code which binds the socket for connect(2), matched the address types before binding. A good implementation needs to iterate over the results of getaddrinfo(3) for remote host to try to connect to each returned address. In the same manner, when one outgoing address is attempted to connect to, the getaddrinfo(3) list for the local address would be iterated over, and first matched compatible address selected for binding. It seems that it is enough to match addrinfo pairs by ai_family/ai_socktype/ai_protocol, but you might also need to e.g. pay some attention to filter out IPv4 mapped to IPv6 entries. I am not sure how much additional plumbing is required to have local getaddrinfo(3) result in the local_bind().

1 0

IPv4 and IPv6
by Konstantin Belousov 30 May '16

30 May '16

Hi. I have a following configuration for the outgoing connection [XXX-1] client = yes accept = 127.0.0.1:1564 connect = some-server:9999 local = some-other-address Sometimes, or rather, quite regular, the connection to localhost port 1564 results in immediate connection close and logging the following: May 30 23:06:58 tom stunnel: LOG5[4]: Service [XXX-1] accepted connection from 127.0.0.1:12848 May 30 23:06:58 tom stunnel: LOG3[4]: local_bind (ephemeral port): Invalid argument (22) I traced the syscalls and see the following: 28196 stunnel CALL socket(PF_INET6,SOCK_STREAM,IPPROTO_IP) 28196 stunnel RET socket 10/0xa 28196 stunnel CALL fcntl(0xa,F_GETFL,0) 28196 stunnel RET fcntl 2 28196 stunnel CALL fcntl(0xa,F_SETFL,0x6<O_RDWR|O_NONBLOCK>) 28196 stunnel RET fcntl 0 28196 stunnel CALL fcntl(0xa,F_SETFD,FD_CLOEXEC) 28196 stunnel RET fcntl 0 28196 stunnel CALL bind(0xa,0x802808a6c,0x10) 28196 stunnel STRU struct sockaddr { AF_INET, 176.36.249.139:0 } 28196 stunnel RET bind -1 errno 22 Invalid argument The socket was created with INET6 address family, but bind was done for INET AF. Indeed, both some-server and some-other-address have both A and AAAA records, corresponding addresses are configured and functional. OS is FreeBSD, I was ensured that this combination (INET6 socket and INET bind) is not correct. It probably works sometime when first resolved addresses for names happen to come from the same address family, but when resolvers return different order, the situation above occurs. Disabling ipv6 support makes the connection work reliably, which confirms my observations. I am using stunnel 5.31. Would be nice to have this fixed. Thanks.

1 0

Public domain [PATCH] support environment variables in config file
by Dmitry Bakshaev 28 May '16

28 May '16

the problem frequently occurs on the client side: admin need to configure stunnel for multiple users. every user has own key, certificate, own permissions on file system (for log-files, etc) this patch allow to write flexible config. some examples: cert = %USERPROFILE%\.config\my.pem (windows) cert = ${HOME}/.config/my.pem (other) output = %APPDATA%\stunnel.log (windows) output = ${HOME}/stunnel.log (other) CAfile = %ALLUSERSPROFILE%\ourCAbundle.crt (windows) CAfile = /etc/ssl/certs/ourCAbundle.crt (other, not using variables) "secure" :) random port example: ... [srv1] accept = 127.0.0.1:%SRV1_PORT% (windows) accept = 127.0.0.1:${SRV1_PORT} (other) ... start stunnel (batch-file or shell-script): set SRV1_PORT=%RANDOM% (windows) limitations: 1. don't support unicode on windows (localized usernames, files, etc) 2. only ${NAME} syntax supported on *nix (not $NAME).

2 1

Potential performance degradation moving from Stunnel 5.06 to 5.32
by Mark Brookes 24 May '16

24 May '16

There might be a throughput degradation in the more recent versions of stunnel. I have recently been testing the 5.32 version of stunnel and have noticed that the tps drop quite significantly when moving from 5.06 to 5.32. Im willing to admit it could be something to do with my config or testing. But if anyone could offer some suggestions it would be much appreciated. The config is setup as follows - Stunnel VIP -> Haproxy. (I have configured haproxy to return a simple page). I am using a self signed 1024 bit certificate and the cipher I am using is ECDHE-RSA-AES256-GCM-SHA384 (I also tested with aNull:eNULL:MD5:LOW:HIGH and noticed a similar drop in performance) My Stunnel config is - setuid = stunnel pid = /var/run/stunnel/stunnel.pid debug = local1.0 socket = a:IP_FREEBIND=yes socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [VIP_Name-1] cert = /root/server1024.pem ciphers = ECDHE-RSA-AES256-GCM-SHA384 accept = 192.168.80.131:443 connect = 127.0.0.1:80 connect = 127.0.0.2:80 delay = no options = CIPHER_SERVER_PREFERENCE options = DONT_INSERT_EMPTY_FRAGMENTS renegotiation = no TIMEOUTclose = 0 My HAProxy config is - global daemon stats socket /var/run/haproxy.stat mode 600 level admin pidfile /var/run/haproxy.pid maxconn 100000 tune.maxrewrite 1024 nbproc 3 defaults #mode http #balance roundrobin timeout connect 4000 timeout client 42000 timeout server 43000 peers loadbalancer_replication peer lbmaster localhost:7778 peer lbslave localhost:7778 listen VIP_Name bind 127.0.0.1:80 transparent #bind 192.168.80.121:80 transparent monitor-uri / mode http errorfile 200 /etc/haproxy/200.http listen VIP_Name_2 monitor-uri / mode http bind 127.0.0.2:80 transparent errorfile 200 /etc/haproxy/200.http All the versions of stunnel mentioned here have been built against Openssl1.0.1s I am using siege to generate the load and issuing the following command - siege https://192.168.80.131 -t1M -c 15 -b The test is stop stunnel service, replace stunnel binary with different version, restart service, run test. The results im seeing are as follows (All results are quoted in transactions per second as reported by siege). v5.06 - 2233 v5.07 - 2229 v5.25 - 2171 v5.30 - 2092 v5.32 - 302 In my results you can see roughly a 200 tps drop from version 5.06 to v5.30 then when we get to v5.32 it drops further. To reiterate the only thing I am changing in my configuration is the stunnel binary. Everything else is remaining the same. Does anyone have any ideas what could be happening? Thankyou Mark

1 0

stunnel on AIX 7
by Randall LeJeune 19 May '16

19 May '16

Does anyone here have any experience in installing and/or running stunnel on AIX? I have version 4.56 installed on my AIX v.7 box, but I checked when this was released and it was over three years ago. I found a version 5.17-2 binary available on Perzl.org but nothing more recent (this version is slightly over a year old). I did try a compile of the newest version but got some errors when I tried to run make (1254-004 error on collect2). Does anyone have any ideas on what would be the best way to proceed here? Thanks in advance.

2 1

PKCS12 support patch
by Dmitry Bakshaev 19 May '16

19 May '16

googling internet about using certificate and keys from PKCS12 file lead to convert it to PEM. it requires some additional utilities (openssl not default windows application) and manual steps to convert. this patch allow using PKCS12 directly from stunnel. example configuration: cert = /home/dab/.certs/my.p12 PKCS12-files detected by file extension (.p12 or .pfx, no case sensetive) and load specially. password prompted if needed, empty password also supported. code based on examples from: https://groups.google.com/forum/#!topic/mailing.openssl.users/iuBmSqwsIG4 http://openssl-users.openssl.narkive.com/J0bR3cMA/ssl-ctx-use-privatekey-fi… patch tested on stunnel working on linux (gentoo: from our overlay http://bbgentoo.ilb.ru/repos/bbgentoo/bbgentoo_overlay/branches/drafts/net-… ) and windows.

1 1

Re: [stunnel-users] Configuring Stunnel to work between client and server - possible certificate issue
by Ludolf Holzheid 18 May '16

18 May '16

On Wed, 2016-05-18 07:24:52 +0000, David Faizulaev wrote: > Do you concatenate the self-signed certificate to the current CA? This self-signed certificate /is/ the current CA certificate, as it is the root of the peer's certificate chain and you trust it. Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:[email protected] http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

1 0

SSL Labs: Session resumption IDs assigned but not accepted
by Brandon Jackson 17 May '16

17 May '16

Trying to find out why SSL Labs is giving this message Session resumption (caching): No (IDs assigned but not accepted) I have this in the config. sessionCacheSize = 1000 sessionCacheTimeout = 86400 ---------------------------------- Brandon Jackson bojack1437(a)gmail.com

1 0

Re: [stunnel-users] Configuring Stunnel to work between client and server - possible certificate issue
by Ludolf Holzheid 17 May '16

17 May '16

On Tue, 2016-05-17 13:50:04 +0000, David Faizulaev wrote: > Hello, > > I've tried changing the value of 'verify' to 0 & 1, in both cases I get the following: > > 2016.05.17 16:40:25 LOG3[285]: SSL_connect: 14090086: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed > 2016.05.17 16:40:25 LOG5[285]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket > 2016.05.17 16:40:25 LOG4[285]: Possible memory leak at .\crypto\asn1\tasn_new.c:179: 11859 allocations > 2016.05.17 16:40:25 LOG4[285]: Possible memory leak at .\crypto\asn1\asn1_lib.c:408: 11241 allocations Strange. I never used verify = 0, but I had the understanding, stunnel should accept a connection even if the peer's certificate can't be verified. Anyhow, what happens if you add the self-signed certificate presented by the peer to the CA file? Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:[email protected] http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

1 0

Re: [stunnel-users] Configuring Stunnel to work between client and server - possible certificate issue
by Ludolf Holzheid 17 May '16

17 May '16

On Tue, 2016-05-17 13:33:31 +0000, David Faizulaev wrote: > Between each certificate block I have the following block: > > Bag Attributes > friendlyName: trustcenterclass2caii > 2.16.840.1.113894.746875.1.1: <Unsupported tag 6> > subject=/C=DE/O=TC TrustCenter GmbH/OU=TC TrustCenter Class 2 CA/CN=TC TrustCenter Class 2 CA II > issuer=/C=DE/O=TC TrustCenter GmbH/OU=TC TrustCenter Class 2 CA/CN=TC TrustCenter Class 2 CA II > > possible cause? No, this should be ignored as a comment. But you instructed stunnel to check the peer's certificate against the trusted ones (verify = 2), and the certificate chain the peer presents ends with a certificate not found in the CA file. Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:[email protected] http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

1 0

Re: [stunnel-users] Configuring Stunnel to work between client and server - possible certificate issue
by Ludolf Holzheid 17 May '16

17 May '16

On Tue, 2016-05-17 13:24:38 +0000, David Faizulaev wrote: > Logs messages are generated upon connection attempt. Then the server presents a certificate that can't be validated against the trusted certificates stored to the file you specified with CAfile=... Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:[email protected] http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

1 0

Re: [stunnel-users] Configuring Stunnel to work between client and server - possible certificate issue
by Ludolf Holzheid 17 May '16

17 May '16

On Tue, 2016-05-17 13:08:33 +0000, David Faizulaev wrote: > Latest update: > After further investigation, it became evident that Stunnel should run as client. > Therefore, I've converted my existing certs file (from my application) into a PEM file. > The file includes -----BEGIN CERTIFICATE----- & -----END CERTIFICATE-----. > > But I still get an error: > > 2016.05.17 15:57:24 LOG4[281]: CERT: Pre-verification error: self signed certificate in certificate chain > 2016.05.17 15:57:24 LOG4[281]: Rejected by CERT at depth=1: CN=NextnineCA > 2016.05.17 15:57:24 LOG3[281]: SSL_connect: 14090086: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed > > Here is the current configuration: > > [custom] > client = yes > accept = 127.0.0.1:8449 > connect = 192.168.220.62:443 > verify = 2 > CAfile = myapp.pem David, CAfile should point to a list of trusted certificates. The file(s) for your pair of certificate and key should be specified with cert=... (and key=..., if certificate and key are stored to separate files). Are the log messages generated at stunnel startup or at connection establishment? Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:[email protected] http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

1 0

Re: [stunnel-users] Configuring Stunnel to work between client and server - possible certificate issue
by Ludolf Holzheid 17 May '16

17 May '16

On Tue, 2016-05-17 11:13:26 +0000, David Faizulaev wrote: > I see, I have a keystore file for the server, can it be set as KEY ? can I convert keystore to PEM? I don't know. Some key/certificate repositories don't allow to export private keys. Maybe there is a PKCS11 plug-in for OpenSSL to access the keystore. If this is the case, you don't have to export your private key. But again, I don't know. > Additionally, I've thought about configuring Stunnel in client mode. > Here is the configuration: > [..] Running stunnel in client or server mode makes no difference w.r.t. certificate and key files. As long as stunnel is not able to access your private key, the client mode won't work either. HTH, Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:[email protected] http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

1 0

Re: [stunnel-users] Configuring Stunnel to work between client and server - possible certificate issue
by Ludolf Holzheid 17 May '16

17 May '16

On Tue, 2016-05-17 08:29:17 +0000, David Faizulaev wrote: > Hello Ludolf, > > I've printed the content of certificate file and the lines: "-----BEGIN CERTIFICATE-----" "-----END CERTIFICATE-----" exist. > In addition, I've compared the default certificate provided by Stunnel with the one I wish to use, they're structure is identical. Hello David, Please reply to the list, so others are able to comment too. I don't know the 'default certificate provided by Stunnel'. I expect it to be depending on the distribution. However, if there are "BEGIN/END CERTIFICATE" lines in your file, but no "BEGIN/END RSA PRIVATE KEY", then the file is in PEM format, but the key is missing. Maybe you have separate files for private key and certificate. If this is the case, you may either concatenate key and certificate to a single file or specify both files in the stunnel configuration: >> key = my-private-key.pem >> cert = my-certificate.pem Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:[email protected] http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

1 0

Configuring Stunnel to work between client and server - possible certificate issue
by David Faizulaev 17 May '16

17 May '16

Hello, I've found Stunnel as a potential answer to securely moving traffic between two machines. But I'm having some difficulties configuring the software. I've installed it on to the client machine and configured the client to connect to 127.0.0.1:8449 while the Server to which the client needs to connect is 192.168.220.72:8447 In the stunnel.conf I've set the following: [custom] accept = 127.0.0.1:8449 connect = 192.168.220.72:8447 cert = 220.72.cer TIMEOUTclose = 0 Upon initializing Stunnel I get the following error: 2016.05.16 19:14:04 LOG3[main]: error queue: 140B0009: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib 2016.05.16 19:14:04 LOG3[main]: SSL_CTX_use_PrivateKey_file: 906D06C: error:0906D06C:PEM routines:PEM_read_bio:no start line 2016.05.16 19:14:04 LOG3[main]: Service [custom]: Failed to initialize SSL context 2016.05.16 19:14:04 LOG3[main]: Failed to reload the configuration file What can be the cause? Thanks in advance. Best Regards, David. [logo_tagline_Sig] David Faizulaev | PL/SQL Developer | T +972 (3) 767 3026<tel:%2B97237673012> | M +972 (54) 7314<tel:%2B972528466746>687 Centralized OT Security Management for Distributed SCADA/ICS Networks P Please consider the environment before printing this e-mail

2 1

TIMEOUTBusy exceeded
by James Brown 17 May '16

17 May '16

Running OpenSSL 1.0.2h, and stunnel 5.32 I often get: ssl_start: s_poll_wait: TIMEOUTbusy exceeded: sending reset 2016.05.17 16:51:46 LOG5[21]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.05.17 16:51:46 LOG7[21]: Local descriptor (FD=15) closed 2016.05.17 16:51:46 LOG7[21]: Service [ssmtp2] finished (3 left) 2016.05.17 16:51:46 LOG6[22]: ssl_start: s_poll_wait: TIMEOUTbusy exceeded: sending reset 2016.05.17 16:51:46 LOG5[22]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.05.17 16:51:46 LOG7[22]: Local descriptor (FD=16) closed 2016.05.17 16:51:46 LOG7[22]: Service [ssmtp2] finished (2 left) when a user is sending an email. The email actually makes it to our mail server and gets sent, but the sender’s mail app says that it could not be sent. Upgraded to 5.33b2, no change. It is not all the time - I suspect it is with emails with large attachments. Any suggestions? Mac OS X 10.7.5. Thanks, James.

1 0

stunnel v5.32 (and older) strange session cache behavior on memory (de)allocation
by Adrian Irimescu 16 May '16

16 May '16

I am using stunnel v5.32 compiled on a RHEL 6.7 with openssl-1.0.1e-42.el6.x86_64. The stunnel.conf cache settings are (for testing cache behaviour): *sessionCacheSize = 3sessionCacheTimeout = 60* What I expect is that after sessioncache size is reached, the memory (RSS) allocated to stunnel process does not grow with new sessions which are not in cache. Instead of this the stunnel allocates about 28K for any new session which does not have a stored session in cache and does not free this anymore. For new connections, but with session stored in cache, the memory does not grow. This lead me to a problem in memory deallocation for expired session in internal session cache.( I know that openssl frees expired session cache entries at every 255 sessions). See example below: --> stunnel start (see RSS) USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND stunnel 20655 0.0 0.0 117760 1440 ? Ss 15:49 0:00 /usr/local/bin/stunnel5 --> after 3 sessions with no cache hits stunnel 20655 0.0 0.0 117828 2976 ? Ss 15:49 0:00 /usr/local/bin/stunnel5 - stunnel log 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: New session callback 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 4 server accept(s) requested 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 4 server accept(s) succeeded 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 0 server renegotiation(s) requested 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 0 session reuse(s) 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 3 internal session cache item(s) 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 0 internal session cache fill-up(s) 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 0 internal session cache miss(es) 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 0 external session cache hit(s) 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 0 expired session(s) retrieved 2016.05.11 15:50:57 LOG6[kngHAM6DLUpVRXEqHcUMIt]: SSL accepted: new session negotiated 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: Remove session callback ----------------------------------------------------- --> after another 1 request with cache hit: as you can see no RSS memory was added stunnel 20655 0.0 0.0 117828 2976 ? Ss 15:49 0:00 /usr/local/bin/stunnel5 - stunnel log 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: SSL state (accept): SSLv3 read finished A 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 5 server accept(s) requested 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 5 server accept(s) succeeded 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 0 server renegotiation(s) requested 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 1 session reuse(s) 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 3 internal session cache item(s) 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 1 internal session cache fill-up(s) 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 0 internal session cache miss(es) 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 0 external session cache hit(s) 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 0 expired session(s) retrieved 2016.05.11 15:51:57 LOG6[Slq6WdqS97Ox4G8eOKfGg0]: SSL accepted: previous session reused ---------------------------------------------------- --> after another 1 request with no cache hit (now we have the first cache fill-up) stunnel 20655 0.0 0.0 117828 3000 ? Ss 15:49 0:00 /usr/local/bin/stunnel5 - stunnel log 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: New session callback 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 6 server accept(s) requested 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 6 server accept(s) succeeded 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 0 server renegotiation(s) requested 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 1 session reuse(s) 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 3 internal session cache item(s) 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 1 internal session cache fill-up(s) 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 0 internal session cache miss(es) 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 0 external session cache hit(s) 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 0 expired session(s) retrieved 2016.05.11 15:53:31 LOG6[P8n33mFxzHVAZEeRwnFccK]: SSL accepted: new session negotiated 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: Remove session callback ---------------------------------------------------- --> after another 300 new session with no cache hits and after waiting 1 minute for entries in session cache to expire (as said in documentation openssl must free expired entries every 255 sessions) stunnel 20655 0.0 0.2 117828 11632 ? Ss 15:49 0:03 /usr/local/bin/stunnel5 - stunnel log 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: New session callback 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 306 server accept(s) requested 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 306 server accept(s) succeeded 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 0 server renegotiation(s) requested 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 1 session reuse(s) 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 3 internal session cache item(s) 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 301 internal session cache fill-up(s) 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 0 internal session cache miss(es) 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 0 external session cache hit(s) 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 0 expired session(s) retrieved 2016.05.11 16:13:26 LOG6[vWvoFT1DXuJ9x0eEfFnQBf]: SSL accepted: new session negotiated 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: Remove session callback ---------------------------------------------------- What I can see is tat memory grows with ~28K for every new session after session cache was filled and never deallocates this memory. In my production env. this really creates problems because after 2 weeks stunnel fils all 32GB of server RAM. *Anyone has encountered a similar problem? * Of course the stunnel service restart clears the memory but I loose all cache entries and is not acceptable. After some code analysis between different versions of stunnel I can see that between v5.26 ans v5.27 the ctx callbacks functions was changed. In my tests with versions prior to 5.27 I can see that this memory problems does not appear. See logs below: ---- stunnel v5.26 -------- 2016.05.12 13:08:14 LOG5[ui]: stunnel 5.26 on x86_64-unknown-linux-gnu platform 2016.05.12 13:08:14 LOG5[ui]: Compiled/running with OpenSSL 1.0.1e-fips 11 Feb 2013 stunnel 27402 0.0 0.0 117604 1316 ? Ss 13:08 0:00 /usr/local/bin/stunnel5 stunnel 27402 0.0 0.0 117672 2756 ? Ss 13:08 0:00 /usr/local/bin/stunnel5 stunnel 27402 0.0 0.0 117672 2804 ? Ss 13:08 0:00 /usr/local/bin/stunnel5 stunnel 27402 0.0 0.0 117672 2828 ? Ss 13:08 0:00 /usr/local/bin/stunnel5 stunnel 27402 0.0 0.0 117672 2868 ? Ss 13:08 0:00 /usr/local/bin/stunnel5 cache fill-up 2016.05.12 13:11:01 LOG7[FdNYw7uGlV9xNElZSPBfyh]: 0 session reuse(s) 2016.05.12 13:11:01 LOG7[FdNYw7uGlV9xNElZSPBfyh]: 3 internal session cache item(s) 2016.05.12 13:11:01 LOG7[FdNYw7uGlV9xNElZSPBfyh]: 1 internal session cache fill-up(s) stunnel 27402 0.0 0.0 117672 2868 ? Ss 13:08 0:00 /usr/local/bin/stunnel5 stunnel 27402 0.0 0.0 117672 2868 ? Ss 13:08 0:00 /usr/local/bin/stunnel5 after 100 fill-ups 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: SSL state (accept): SSLv3 flush data 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 107 server accept(s) requested 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 107 server accept(s) succeeded 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 0 server renegotiation(s) requested 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 1 session reuse(s) 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 3 internal session cache item(s) 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 102 internal session cache fill-up(s) 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 0 internal session cache miss(es) 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 0 external session cache hit(s) 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 0 expired session(s) retrieved 2016.05.12 13:13:55 LOG6[TWO1OFFPYvsW4qdjyJ0IZK]: SSL accepted: new session negotiated stunnel 27402 0.1 0.0 117672 2872 ? Ss 13:08 0:00 /usr/local/bin/stunnel5 after another 100 fill-ups 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: SSL state (accept): SSLv3 flush data 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 207 server accept(s) requested 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 207 server accept(s) succeeded 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 0 server renegotiation(s) requested 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 1 session reuse(s) 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 3 internal session cache item(s) 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 202 internal session cache fill-up(s) 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 0 internal session cache miss(es) 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 0 external session cache hit(s) 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 0 expired session(s) retrieved 2016.05.12 13:19:03 LOG6[InwkBBOxJrfptxYx6wXTxU]: SSL accepted: new session negotiated stunnel 27402 0.0 0.0 117672 2872 ? Ss 13:08 0:01 /usr/local/bin/stunnel5 Code: --->>> callbacks in v5.26 L605 *NOEXPORT int sess_new_cb(SSL *ssl, SSL_SESSION *sess) { unsigned char *val, *val_tmp; ssize_t val_len; const unsigned char *session_id; unsigned int session_id_length; val_len=i2d_SSL_SESSION(sess, NULL); val_tmp=val=str_alloc((size_t)val_len); i2d_SSL_SESSION(sess, &val_tmp);#if OPENSSL_VERSION_NUMBER>=0x0090800fL session_id=SSL_SESSION_get_id(sess, &session_id_length);#else session_id=(const unsigned char *)sess->session_id; session_id_length=sess->session_id_length;#endif cache_transfer(SSL_get_SSL_CTX(ssl), CACHE_CMD_NEW, SSL_SESSION_get_timeout(sess), session_id, session_id_length, val, (size_t)val_len, NULL, NULL); str_free(val); return 1; /* leave the session in local cache for reuse */}NOEXPORT SSL_SESSION *sess_get_cb(SSL *ssl, unsigned char *key, int key_len, int *do_copy) { unsigned char *val, *val_tmp=NULL; ssize_t val_len=0; SSL_SESSION *sess; *do_copy = 0; /* allow the session to be freed autmatically */ cache_transfer(SSL_get_SSL_CTX(ssl), CACHE_CMD_GET, 0, key, (size_t)key_len, NULL, 0, &val, (size_t *)&val_len); if(!val) return NULL; val_tmp=val; sess=d2i_SSL_SESSION(NULL,#if OPENSSL_VERSION_NUMBER>=0x0090800fL (const unsigned char **)#endif /* OpenSSL version >= 0.8.0 */ &val_tmp, val_len); str_free(val);* --->>> callbacks in v5.32 /**************************************** session callbacks */ *NOEXPORT int sess_new_cb(SSL *ssl, SSL_SESSION *sess) { CLI *c; s_log(LOG_DEBUG, "New session callback"); c=SSL_get_ex_data(ssl, index_cli); if(c->opt->option.sessiond) cache_new(ssl, sess); return 1; /* leave the session in local cache for reuse */}NOEXPORT SSL_SESSION *sess_get_cb(SSL *ssl,#if OPENSSL_VERSION_NUMBER>=0x10100000L const#endif unsigned char *key, int key_len, int *do_copy) { CLI *c; s_log(LOG_DEBUG, "Get session callback"); *do_copy=0; /* allow the session to be freed automatically */ c=SSL_get_ex_data(ssl, index_cli); if(c->opt->option.sessiond) return cache_get(ssl, key, key_len); return NULL; /* no session to resume */}NOEXPORT void sess_remove_cb(SSL_CTX *ctx, SSL_SESSION *sess) { SERVICE_OPTIONS *opt; s_log(LOG_DEBUG, "Remove session callback"); opt=SSL_CTX_get_ex_data(ctx, index_opt); if(opt->option.sessiond) cache_remove(ctx, sess);}* In production env. I have downgraded today at stunnel v5.26 and memory seems to be OK (untill now). Regards, Adrian Irimescu

1 0

Re: [stunnel-users] stunnel and MSIE
by Brugman, Matt 13 May '16

13 May '16

This is a perfect example of "do not post until you've tried the latest version"... I apologize again, I missed the update. Stunnel is working correctly on my WCE device with all browsers now. Thanks again for the help and the awesome product! Matt -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of Michal Trojnara Sent: Thursday, May 12, 2016 15:16 To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] stunnel and MSIE On 12.05.2016 15:57, Brugman, Matt wrote: > I’ve compiled stunnel for Windows CE 5.0 and 6.0, and am running it on > an ARM device. Which version of stunnel have you compiled? Make sure to use stunnel 5.32, as it contains an important WCE fix. Best regards, Mike

1 0

Re: [stunnel-users] stunnel and MSIE
by Brugman, Matt 12 May '16

12 May '16

I am running 5.31. I apologize; I missed the release of 5.32. I'll build and let you know what I find. Thanks very much! Matt -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of Michal Trojnara Sent: Thursday, May 12, 2016 15:16 To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] stunnel and MSIE On 12.05.2016 15:57, Brugman, Matt wrote: > I’ve compiled stunnel for Windows CE 5.0 and 6.0, and am running it on > an ARM device. Which version of stunnel have you compiled? Make sure to use stunnel 5.32, as it contains an important WCE fix. Best regards, Mike

1 0

stunnel and MSIE
by Brugman, Matt 12 May '16

12 May '16

I've compiled stunnel for Windows CE 5.0 and 6.0, and am running it on an ARM device. It is being used in client mode to secure communications to various external servers with not problems. It is also being used to secure Windows CE's webserver. All of the client mode connections are working flawlessly (thanks for the awesome work, by the way!). The webserver is working properly for all browsers except MSIE 11. Everything I've seen tells me that the problem is not really with stunnel or openssl, but with Internet Explorer. I've spent some time searching the mailing list archives and on Google, but haven't really found a solution to this, besides the obvious "well, don't use IE." I'd love to go with the answer, but some of our users are locked into IE, and let's must make it a given that the choice of browser can't be changed. The browser connects, negotiates a connection, and then exchanges keys and certificates. Using the debug console in IE I see that it sends the initial "GET /". Then the browser sees the response header, but no "body" data. Again, I realize this isn't a specific stunnel issue, but I'm hoping someone on the list has seen a similar issue and found a resolution. I've stripped stunnel.conf down to the very basics (some paths removed for clarity): ; Stunnel config for device debug = 7 output = <path removed>stunnel.log options = -NO_SSLv3 log = overwrite ;********* SERVICES *********** [https-server] client = no accept = 443 connect = 127.0.0.1:9975 cert = <path removed>stunnel.pem delay = yes TIMEOUTbusy = 5 TIMEOUTclose = 0 TIMEOUTidle = 30 Stunnel log output. I do see the "Peer suddenly disconnected" messages, but again; I'm not sure why. The last two lines of the log are the "transfer() loop executes not transferring any data": 3916.06.12 08:21:19 LOG7[ui]: Service [https-server] accepted (FD=9) from 192.168.55.77:12377 3916.06.12 08:21:19 LOG7[ui]: Creating a new thread 3916.06.12 08:21:19 LOG7[ui]: New thread created 3916.06.12 08:21:19 LOG7[0]: Service [https-server] started 3916.06.12 08:21:19 LOG5[0]: Service [https-server] accepted connection from 192.168.55.77:12377 3916.06.12 08:21:19 LOG7[0]: SSL state (accept): before/accept initialization 3916.06.12 08:21:19 LOG7[0]: SNI: no virtual services defined 3916.06.12 08:21:19 LOG7[0]: SSL state (accept): SSLv3 read client hello A 3916.06.12 08:21:19 LOG7[0]: SSL state (accept): SSLv3 write server hello A 3916.06.12 08:21:19 LOG7[0]: SSL state (accept): SSLv3 write certificate A 3916.06.12 08:21:19 LOG7[0]: SSL state (accept): SSLv3 write key exchange A 3916.06.12 08:21:19 LOG7[0]: SSL state (accept): SSLv3 write server done A 3916.06.12 08:21:19 LOG7[0]: SSL state (accept): SSLv3 flush data 3916.06.12 08:21:19 LOG7[0]: SSL state (accept): SSLv3 read client certificate A 3916.06.12 08:21:20 LOG7[0]: SSL state (accept): SSLv3 read client key exchange A 3916.06.12 08:21:20 LOG7[0]: SSL state (accept): SSLv3 read certificate verify A 3916.06.12 08:21:20 LOG7[0]: SSL state (accept): SSLv3 read finished A 3916.06.12 08:21:20 LOG7[0]: SSL state (accept): SSLv3 write change cipher spec A 3916.06.12 08:21:20 LOG7[0]: SSL state (accept): SSLv3 write finished A 3916.06.12 08:21:20 LOG7[0]: SSL state (accept): SSLv3 flush data 3916.06.12 08:21:20 LOG7[0]: New session callback 3916.06.12 08:21:20 LOG7[0]: 1 server accept(s) requested 3916.06.12 08:21:20 LOG7[0]: 1 server accept(s) succeeded 3916.06.12 08:21:20 LOG7[0]: 0 server renegotiation(s) requested 3916.06.12 08:21:20 LOG7[0]: 0 session reuse(s) 3916.06.12 08:21:20 LOG7[0]: 0 internal session cache item(s) 3916.06.12 08:21:20 LOG7[0]: 0 internal session cache fill-up(s) 3916.06.12 08:21:20 LOG7[0]: 0 internal session cache miss(es) 3916.06.12 08:21:20 LOG7[0]: 0 external session cache hit(s) 3916.06.12 08:21:20 LOG7[0]: 0 expired session(s) retrieved 3916.06.12 08:21:20 LOG6[0]: SSL accepted: new session negotiated 3916.06.12 08:21:20 LOG6[0]: No peer certificate received 3916.06.12 08:21:20 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-SHA384 (256-bit encryption) 3916.06.12 08:21:20 LOG7[0]: Compression: null, expansion: null 3916.06.12 08:21:20 LOG6[0]: s_connect: connecting 127.0.0.1:9775 3916.06.12 08:21:20 LOG6[0]: s_connect: connected 127.0.0.1:9775 3916.06.12 08:21:20 LOG6[0]: persistence: 127.0.0.1:9775 cached 3916.06.12 08:21:20 LOG5[0]: Service [https-server] connected remote server from 127.0.0.1:49277 3916.06.12 08:21:20 LOG7[0]: Remote descriptor (FD=11) initialized 3916.06.12 08:21:20 LOG6[0]: SSL socket closed (SSL_read) 3916.06.12 08:21:20 LOG7[0]: Sent socket write shutdown 3916.06.12 08:21:20 LOG5[0]: Connection closed: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 3916.06.12 08:21:20 LOG7[0]: Remote descriptor (FD=11) closed 3916.06.12 08:21:20 LOG7[0]: Local descriptor (FD=9) closed 3916.06.12 08:21:20 LOG7[0]: Service [https-server] finished (0 left) 3916.06.12 08:21:22 LOG7[ui]: Found 1 ready file descriptor(s) 3916.06.12 08:21:22 LOG7[ui]: FD=5 ifds=r-x ofds=--- 3916.06.12 08:21:22 LOG7[ui]: Service [https-server] accepted (FD=13) from 192.168.55.77:30351 3916.06.12 08:21:22 LOG7[ui]: Creating a new thread 3916.06.12 08:21:22 LOG7[ui]: New thread created 3916.06.12 08:21:22 LOG7[1]: Service [https-server] started 3916.06.12 08:21:22 LOG5[1]: Service [https-server] accepted connection from 192.168.55.77:30351 3916.06.12 08:21:22 LOG7[1]: SSL state (accept): before/accept initialization 3916.06.12 08:21:22 LOG7[1]: SNI: no virtual services defined 3916.06.12 08:21:22 LOG7[1]: SSL state (accept): SSLv3 read client hello A 3916.06.12 08:21:22 LOG7[1]: SSL state (accept): SSLv3 write server hello A 3916.06.12 08:21:22 LOG7[1]: SSL state (accept): SSLv3 write change cipher spec A 3916.06.12 08:21:22 LOG7[1]: SSL state (accept): SSLv3 write finished A 3916.06.12 08:21:22 LOG7[1]: SSL state (accept): SSLv3 flush data 3916.06.12 08:21:22 LOG7[1]: SSL state (accept): SSLv3 read finished A 3916.06.12 08:21:22 LOG7[1]: 2 server accept(s) requested 3916.06.12 08:21:22 LOG7[1]: 2 server accept(s) succeeded 3916.06.12 08:21:22 LOG7[1]: 0 server renegotiation(s) requested 3916.06.12 08:21:22 LOG7[1]: 1 session reuse(s) 3916.06.12 08:21:22 LOG7[1]: 1 internal session cache item(s) 3916.06.12 08:21:22 LOG7[1]: 0 internal session cache fill-up(s) 3916.06.12 08:21:22 LOG7[1]: 0 internal session cache miss(es) 3916.06.12 08:21:22 LOG7[1]: 0 external session cache hit(s) 3916.06.12 08:21:22 LOG7[1]: 0 expired session(s) retrieved 3916.06.12 08:21:22 LOG6[1]: SSL accepted: previous session reused 3916.06.12 08:21:22 LOG6[1]: s_connect: connecting 127.0.0.1:9775 3916.06.12 08:21:22 LOG6[1]: s_connect: connected 127.0.0.1:9775 3916.06.12 08:21:22 LOG6[1]: persistence: 127.0.0.1:9775 cached 3916.06.12 08:21:22 LOG5[1]: Service [https-server] connected remote server from 127.0.0.1:49278 3916.06.12 08:21:22 LOG7[1]: Remote descriptor (FD=15) initialized 3916.06.12 08:21:22 LOG6[1]: SSL socket closed (SSL_read) 3916.06.12 08:21:22 LOG7[1]: Sent socket write shutdown 3916.06.12 08:21:22 LOG5[1]: Connection closed: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 3916.06.12 08:21:22 LOG7[1]: Remote descriptor (FD=15) closed 3916.06.12 08:21:22 LOG7[1]: Local descriptor (FD=13) closed 3916.06.12 08:21:22 LOG7[1]: Service [https-server] finished (0 left) 3916.06.12 08:21:22 LOG7[ui]: Found 1 ready file descriptor(s) 3916.06.12 08:21:22 LOG7[ui]: FD=5 ifds=r-x ofds=--- 3916.06.12 08:21:22 LOG7[ui]: Service [https-server] accepted (FD=17) from 192.168.55.77:30352 3916.06.12 08:21:22 LOG7[ui]: Creating a new thread 3916.06.12 08:21:22 LOG7[ui]: New thread created 3916.06.12 08:21:22 LOG7[2]: Service [https-server] started 3916.06.12 08:21:22 LOG5[2]: Service [https-server] accepted connection from 192.168.55.77:30352 3916.06.12 08:21:22 LOG7[2]: SSL state (accept): before/accept initialization 3916.06.12 08:21:22 LOG7[2]: SNI: no virtual services defined 3916.06.12 08:21:22 LOG7[2]: SSL state (accept): SSLv3 read client hello A 3916.06.12 08:21:22 LOG7[2]: SSL state (accept): SSLv3 write server hello A 3916.06.12 08:21:22 LOG7[2]: SSL state (accept): SSLv3 write change cipher spec A 3916.06.12 08:21:22 LOG7[2]: SSL state (accept): SSLv3 write finished A 3916.06.12 08:21:22 LOG7[2]: SSL state (accept): SSLv3 flush data 3916.06.12 08:21:22 LOG7[2]: SSL state (accept): SSLv3 read finished A 3916.06.12 08:21:22 LOG7[2]: 3 server accept(s) requested 3916.06.12 08:21:22 LOG7[2]: 3 server accept(s) succeeded 3916.06.12 08:21:22 LOG7[2]: 0 server renegotiation(s) requested 3916.06.12 08:21:22 LOG7[2]: 2 session reuse(s) 3916.06.12 08:21:22 LOG7[2]: 1 internal session cache item(s) 3916.06.12 08:21:22 LOG7[2]: 0 internal session cache fill-up(s) 3916.06.12 08:21:22 LOG7[2]: 0 internal session cache miss(es) 3916.06.12 08:21:22 LOG7[2]: 0 external session cache hit(s) 3916.06.12 08:21:22 LOG7[2]: 0 expired session(s) retrieved 3916.06.12 08:21:22 LOG6[2]: SSL accepted: previous session reused 3916.06.12 08:21:22 LOG6[2]: s_connect: connecting 127.0.0.1:9775 3916.06.12 08:21:22 LOG6[2]: s_connect: connected 127.0.0.1:9775 3916.06.12 08:21:22 LOG6[2]: persistence: 127.0.0.1:9775 cached 3916.06.12 08:21:22 LOG5[2]: Service [https-server] connected remote server from 127.0.0.1:49279 3916.06.12 08:21:22 LOG7[2]: Remote descriptor (FD=19) initialized 3916.06.12 08:21:22 LOG3[2]: SSL socket closed (SSL_read) with 10137 unsent byte(s) 3916.06.12 08:21:22 LOG5[2]: Connection reset: 239 byte(s) sent to SSL, 553 byte(s) sent to socket 3916.06.12 08:21:22 LOG7[2]: Remote descriptor (FD=19) closed 3916.06.12 08:21:22 LOG7[2]: Local descriptor (FD=17) closed 3916.06.12 08:21:22 LOG7[2]: Service [https-server] finished (0 left) 3916.06.12 08:21:23 LOG7[ui]: Found 1 ready file descriptor(s) 3916.06.12 08:21:23 LOG7[ui]: FD=5 ifds=r-x ofds=--- 3916.06.12 08:21:23 LOG7[ui]: Service [https-server] accepted (FD=21) from 192.168.55.77:30353 3916.06.12 08:21:23 LOG7[ui]: Creating a new thread 3916.06.12 08:21:23 LOG7[ui]: New thread created 3916.06.12 08:21:23 LOG7[3]: Service [https-server] started 3916.06.12 08:21:23 LOG5[3]: Service [https-server] accepted connection from 192.168.55.77:30353 3916.06.12 08:21:23 LOG7[3]: SSL state (accept): before/accept initialization 3916.06.12 08:21:23 LOG7[3]: SNI: no virtual services defined 3916.06.12 08:21:23 LOG7[3]: SSL state (accept): SSLv3 read client hello A 3916.06.12 08:21:23 LOG7[3]: SSL state (accept): SSLv3 write server hello A 3916.06.12 08:21:23 LOG7[3]: SSL state (accept): SSLv3 write change cipher spec A 3916.06.12 08:21:23 LOG7[3]: SSL state (accept): SSLv3 write finished A 3916.06.12 08:21:23 LOG7[3]: SSL state (accept): SSLv3 flush data 3916.06.12 08:21:23 LOG7[3]: SSL state (accept): SSLv3 read finished A 3916.06.12 08:21:23 LOG7[3]: 4 server accept(s) requested 3916.06.12 08:21:23 LOG7[3]: 4 server accept(s) succeeded 3916.06.12 08:21:23 LOG7[3]: 0 server renegotiation(s) requested 3916.06.12 08:21:23 LOG7[3]: 3 session reuse(s) 3916.06.12 08:21:23 LOG7[3]: 1 internal session cache item(s) 3916.06.12 08:21:23 LOG7[3]: 0 internal session cache fill-up(s) 3916.06.12 08:21:23 LOG7[3]: 0 internal session cache miss(es) 3916.06.12 08:21:23 LOG7[3]: 0 external session cache hit(s) 3916.06.12 08:21:23 LOG7[3]: 0 expired session(s) retrieved 3916.06.12 08:21:23 LOG6[3]: SSL accepted: previous session reused 3916.06.12 08:21:23 LOG6[3]: s_connect: connecting 127.0.0.1:9775 3916.06.12 08:21:23 LOG6[3]: s_connect: connected 127.0.0.1:9775 3916.06.12 08:21:23 LOG6[3]: persistence: 127.0.0.1:9775 cached 3916.06.12 08:21:23 LOG5[3]: Service [https-server] connected remote server from 127.0.0.1:49280 3916.06.12 08:21:23 LOG7[3]: Remote descriptor (FD=23) initialized 3916.06.12 08:21:23 LOG6[3]: Read socket closed (readsocket) 3916.06.12 08:21:23 LOG7[3]: Sending close_notify alert 3916.06.12 08:21:23 LOG7[3]: SSL alert (write): warning: close notify 3916.06.12 08:21:23 LOG6[3]: SSL_shutdown successfully sent close_notify alert 3916.06.12 08:21:23 LOG3[3]: transfer() loop executes not transferring any data 3916.06.12 08:21:23 LOG3[3]: please report the problem to Michal.Trojnara(a)mirt.net

1 0

Multiple accept parameter, or Ipv4 and v6 in one statement.
by Brandon Jackson 12 May '16

12 May '16

Hi, I'm looking to expand my usage of stunnel. One thing i'm wondering, is there a way to use multiple accepts for the same service. Like: [httpsmain] accept = 443 accept = :::443 connect = 10.0.1.1:9443 or even something like. [httpsmain] accept = 443,:::443 connect = 10.0.1.1:8443 The reason is I'm about to setup some service with sni with a few domains and certs, but if I have to have them on v4 and v6 it looks like i'll have to double everything up. Is there a better way? ---------------------------------- Brandon Jackson bojack1437(a)gmail.com <https://mail.google.com/mail/?view=cm&fs=1&tf=1&[email protected]>

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users