- stunnel-users - stunnel.org

Timeout when connecting to
by Khan, Mohammed 10 May '16

10 May '16

Hi, I have installed v5.32 Stunnel on my Windows server which is hosted on AWS. I am trying to connect from here using a Emailer app which uses POP3 to try to connect to this server Outlook.Office365.com on port 995, but I keep on getting this error logged in Stunnel logs: [cid:[email protected]] Does anyone have any ideas as to why this connection is timing out please? Any help would be much appreciated thanks in advance! Rgds Mo Khan / Software Engineer / FootFall Tel: +44 121 712 1428 / Mobile: +44 776 692 7120 Yorke House, Arleston Way / Solihull, B90 4LH / United Kingdom mohammedkhan(a)tycoint.com<mailto:%[email protected]> / www.footfall.com<http://www.footfall.com/> [Description: Fieldworks Marketing]<https://urldefense.proofpoint.com/v2/url?u=http-3A__tycoretailsolutions.com…> [Description: Fieldworks Marketing]<http://www.footfall.com/> [Description: http://www.footfall.com/wp-content/uploads/2015/09/LinkedIn.png]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.linkedin.com_compa…> [Description: http://www.footfall.com/wp-content/uploads/2015/09/Twitter.png] <https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_footfallin…> [Description: http://www.footfall.com/wp-content/uploads/2015/09/YouTube.png] <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.youtube.com_channe…> [Description: http://www.footfall.com/wp-content/uploads/2015/09/Facebook.png] <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.facebook.com_footf…> [Description: http://www.footfall.com/wp-content/uploads/2015/09/Google-.png] <https://urldefense.proofpoint.com/v2/url?u=https-3A__plus.google.com_-2BFoo…> ________________________________ This e-mail contains privileged and confidential information intended for the use of the addressees named above. If you are not the intended recipient of this e-mail, you are hereby notified that you must not disseminate, copy or take any action in respect of any information contained in it. If you have received this e-mail in error, please notify the sender immediately by e-mail and immediately destroy this e-mail and its attachments.

1 0

Temporary DH params in stunnel
by Guillermo Rodriguez Garcia 10 May '16

10 May '16

Hi all, The stunnel docs say that starting with stunnel 5.18, DH params are auto-generated every 24 hours and that this "may take several minutes". I see that for this purpose, stunnel uses OpenSSL's DH_generate_parameters[_ex] function. According to the OpenSSL API docs [1], these functions "may run for several hours before finding a suitable prime." [1]: https://www.openssl.org/docs/manmaster/crypto/DH_generate_parameters.html Wouldn't it make sense to use "DSA-like" DH params for this purpose? These are much faster to generate and apparently equally safe. DSA-like DH params are generated using DSA_generate_parameters[ex]. It is the equivalent of passing the -dsaparam option to the openssl dhparam command. Some useful info: - http://security.stackexchange.com/a/95184/109144 - http://dovecot.org/pipermail/dovecot/2015-November/102447.html Best regards, Guillermo Rodriguez Garcia guille.rodriguez(a)gmail.com

1 0

'Integer constant too large' warnings in str.c
by Guillermo Rodriguez Garcia 10 May '16

10 May '16

Hello, Current stunnel (5.32) gives a bunch of warnings in str.c when the CANARY_XXX and MAGIC_XXX constants are used, for example: str.c:101: warning: integer constant is too large for 'long' type Shouldn't these constants be declared with the 'LL' suffix instead of 'L' ? #define CANARY_INITIALIZED 0x0000c0ded0000000LL #define CANARY_UNINTIALIZED 0x0000abadbabe0000LL #define MAGIC_ALLOCATED 0x0000a110c8ed0000LL #define MAGIC_DEALLOCATED 0x0000defec8ed0000LL Best regards, Guillermo Rodriguez Garcia guille.rodriguez(a)gmail.com

2 1

SNI support in OpenSSL
by Guillermo Rodriguez Garcia 08 May '16

08 May '16

Hello all, The stunnel documentation says that SNI requires stunnel to be linked with OpenSSL >= 1.0.0. However, SNI is supported in OpenSSL since 0.9.8f (and actually enabled by default since 0.9.8k). For 0.9.8f and later, OPENSSL_NO_TLSEXT will be defined if TLS extension support (including SNI support) is not compiled into OpenSSL. Taking the above into account, the OpenSSL version check in stunnel (src/common.h) could be relaxed a bit. Instead of: #if OPENSSL_VERSION_NUMBER<0x10000000L #define OPENSSL_NO_TLSEXT #define OPENSSL_NO_PSK #endif /* OpenSSL older than 1.0.0 */ this could be: #if OPENSSL_VERSION_NUMBER<0x00908060L #define OPENSSL_NO_TLSEXT #endif /* OpenSSL older than 0.9.8f */ #if OPENSSL_VERSION_NUMBER<0x10000000L #define OPENSSL_NO_PSK #endif /* OpenSSL older than 1.0.0 */ This would enable SNI on systems using 0.9.8 (Mac OS X for example). Best regards, Guillermo Rodriguez Garcia guille.rodriguez(a)gmail.com

1 0

SSLv3 not working with version 5.06
by Francois Pires 06 May '16

06 May '16

Hi all, We need use of sslv3 but with debian Jessie package version 5.06 this is not working. I have add options -NO_SSLv3 still same. Can you check if my configuration is good and if you have any idea to have sslv3 working with this verison. # stunnel.conf syslog = no cert = /etc/ssl/certs/test.crt.pem key = /etc/ssl/private/test.key.pem CAfile = /etc/ssl/certs/test.ca-bundle # Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = all options = -NO_SSLv3 ciphers = AES256-SHA #ciphers = ECDH@STRENGTH:DH@STRENGTH:HIGH:!RC4:!MD5:!DES:!aNULL:!eNULL # Some debugging stuff useful for troubleshooting debug = 7 output = /stunnel.log # Debian and Ubuntu chroot config chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid # Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 socket = l:SO_KEEPALIVE=1 socket = r:SO_KEEPALIVE=1 [test] accept = 11443 connect = 127.0.0.1:11444 # stunnel log with openssl test SSL_accept: 14076102: error:14076102:SSL routines:SSL23_GET_CLIENT_HELLO:unsupported protocol openssl s_client -connect 127.0.0.1:11443 -ssl3 CONNECTED(00000003) write:errno=104 --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 0 bytes and written 0 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE SSL-Session: Protocol : SSLv3 Cipher : 0000 Session-ID: Session-ID-ctx: Master-Key: Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1462525363 Timeout : 7200 (sec) Verify return code: 0 (ok) -- Cordialement, François PIRES SysAdmin

2 1

how to pass servername openssl parameter
by Dod 04 May '16

04 May '16

Hello, Little question I use openssl s_client mode to call an https with private PKI so private CAFile CERT and also Key, but I also need to use the parameter "servername" but stunnel seems not support it or may be it has an other syntax ? regards.

1 0

Connect to web app with weak crypto
by Pete McEvoy 29 Apr '16

29 Apr '16

Hi. I have a java web app that uses weak crypto. I would like to be able to access it with a modern browser. Currently the only method that seems to work is links on freebsd 9.3, all other browsers give errors such as: Error performing TLS handshake: The Diffie-Hellman prime sent by the server is not acceptable (not long enough). Obviously it would be better if this was fixed but it is not something I have control of. Would it be possible for me to use stunnel to encapsulate the weak connection within a stronger one so the browser does not complain? I have tried this: ; TLS front-end to a web server [https] client = yes accept = 443 connect = 192.168.1.5:443 cert = /usr/local/etc/stunnel/stunnel.pem Which asks me to make an exception for the self signed cert but then proceeds to fail in same way as before. Cheers -- Pete

1 0

Memory Leak in stunnel 5.31
by Fritz Gschwendner 20 Apr '16

20 Apr '16

Thank you. I tried the new version. Between 10:15 and 10:50 stunnel private bytes grew by ~ 85 MB. Log entries regarding "possible memory leak" look like this at the beginning: 2016.04.20 10:17:01 LOG4[937]: Possible memory leak at .\crypto\asn1\tasn_new.c:179: 71652 allocations 2016.04.20 10:17:01 LOG4[937]: Possible memory leak at .\crypto\asn1\asn1_lib.c:412: 70978 allocations 2016.04.20 10:17:01 LOG4[937]: Possible memory leak at .\crypto\asn1\a_object.c:346: 55283 allocations 2016.04.20 10:17:01 LOG4[937]: Possible memory leak at .\crypto\asn1\a_object.c:315: 55283 allocations 2016.04.20 10:17:01 LOG4[937]: Possible memory leak at .\crypto\asn1\asn1_lib.c:376: 56826 allocations 2016.04.20 10:17:01 LOG4[937]: Possible memory leak at .\crypto\stack\stack.c:162: 13761 allocations 2016.04.20 10:17:01 LOG4[937]: Possible memory leak at .\crypto\stack\stack.c:187: 11448 allocations 2016.04.20 10:17:01 LOG4[937]: Possible memory leak at .\crypto\buffer\buffer.c:118: 11172 allocations 2016.04.20 10:17:01 LOG4[937]: Possible memory leak at .\crypto\asn1\tasn_new.c:342: 10501 allocations ..and later like this: 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\tasn_new.c:179: 182132 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\asn1_lib.c:412: 181243 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\a_object.c:346: 138968 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\a_object.c:315: 138968 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\asn1_lib.c:376: 144407 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\stack\stack.c:162: 35294 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\stack\stack.c:187: 29760 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\buffer\buffer.c:118: 28186 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\tasn_new.c:342: 27649 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\bn\bn_lib.c:303: 27405 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\buffer\buffer.c:74: 18971 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\x_name.c:136: 18967 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\x_name.c:383: 18967 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\a_int.c:208: 18406 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\asn1\a_bitstr.c:158: 18433 allocations 2016.04.20 10:51:04 LOG4[2658]: Possible memory leak at .\crypto\bn\bn_lib.c:272: 13616 allocations If there is anything else I can do, please let me know. -----Ursprüngliche Nachricht----- Von: stunnel-users [mailto:[email protected]] Im Auftrag von Michal Trojnara Gesendet: Dienstag, 19. April 2016 23:31 An: stunnel-users(a)stunnel.org Betreff: Re: [stunnel-users] Memory Leak in stunnel 5.31 On 31.03.2016 22:28, Fritz Gschwendner wrote: > we have a memory leak with stunnel 5.31 in server mode on Windows > Server 2012. Page File Bytes of the stunnel process keep growing. [cut] > I suspect it has something to do with clients not closing the > connection correctly. We have a lot of connections ending like > this: [cut] > Is my suspicion plausible? Can you recommend a change in the > configuration to avoid this issue? Anything else I can do to debug? Your suspicion looks plausible. I have added a heuristic algorithm that identifies excessive memory allocations. Please try stunnel-5.32b2: https://www.stunnel.org/downloads.html The logged warnings should allow identification of the leak source. Best regards, Mike _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Stunnel and Eudora error
by EPPack 14 Apr '16

14 Apr '16

I installed stunnel on one of my laptops a few days ago, and it installed uneventfully. I set up one of my gmail accounts in Eudora per directions I got from another Eudora user, and the account works perfectly in Eudora. However, on this machine, I got an unexpected prompt that showed up in a cmd window during the install, which did NOT show up on the other machine: WARNING: can't open config file: /devel/win32/openssl/openssl.cnf Generating a 2048 bit RSA private key ...+++ ..................+++ Writing new private key to 'C:\Program Files (x86)\stunnel\config\stunnel.pem' ---- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank for some fields there will be a default value, If you enter '.', the field will be left blank. ---- Country Name (2 letter code) [PL]: When I try for an inbound in Eudora, I get the "Error reading from network. Cause: connection aborted due to timeout or other failure (10053). Problem of course is that I'm also unsure if it installed fully/correctly. On the other machine, it installed itself uneventfully as a service, and after I started it (it came in as manual, unstarted), it was fine. This time, tho, it didn't show up in the list of services at all, even tho there was a prompt to start it, which I allowed it to do. That said, I did see it in the start menu, and was able to start it. I also rebooted, and it started up OK. However, after configuring one of my accounts the same way as on the other machine, it's not working, getting the timeout error above. Changed it back to the normal settings for GMail in Eudora, it worked fine, so it wasn't any other cause. I tried adding options = DONT_INSERT_EMPTY_FRAGMENTS to the conf, hopefully in the right place :) and also bumped the Eudora Advanced Network params as also suggested.Nada. The only difference between the two machines, both Windows 7 Pro, is that this one is a 64bit, the other not, which may well be the difference. As I'm new to stunnel, I looked for the manual, but got a 403 on the page. Thoughts? elaine ----- Elaine Pack, Web Analyst, Ivy, VA 99 programming bugs in the code 99 programming bugs Fix one bug, compile it again Now there's 100 bugs in the code! (Repeat until bugs=0)

1 0

developpement hints request
by brahim mohamed 06 Apr '16

06 Apr '16

Hello, My name is Mohamed Aymen, i'm an electronic payment engineer . I recently descovered Stunnel and i'm trying to make some developement and modifications and i need your help with points bellow: 1-steps for compilation on IBM AIX-7 plateform 2-possibility of adding a new source code file(.c) and compiling it with native stunnel files ===some clarifications about source code : 3-i would appreciate if you can indicate me : where exactly in source code i can find the code responsible for accepting buffer from client and the code responsible for accepting buffer (response) from server, also the code responsible for sending data to server and the code responsible for sending server's answer to client (all those on socket mode,on ssl mode and on tls mode) warm regards

1 0

blockscript
by Petr Hojzak 05 Apr '16

05 Apr '16

Hello. Is it possible to setup stunel in a way so it is not detected by services like blocksript? Petr Hojzak https://forpsi-vzr-s126463.mojeid.cz/

2 3

Memory Leak in stunnel 5.31
by Fritz Gschwendner 31 Mar '16

31 Mar '16

Hello, we have a memory leak with stunnel 5.31 in server mode on Windows Server 2012. Page File Bytes of the stunnel process keep growing. The more traffic the faster it's growing, until memory is exhausted and client connects start to fail with: 2016.03.31 15:50:30 LOG3[main]: _beginthread: Exec format error (8) 2016.03.31 15:50:30 LOG3[main]: Connection rejected: create_client failed I suspect it has something to do with clients not closing the connection correctly. We have a lot of connections ending like this: 2016.03.31 09:21:48 LOG3[5156]: SSL_shutdown: Connection reset by peer (WSAECONNRESET) (10054) 2016.03.31 09:21:48 LOG5[5156]: Connection reset: 239 byte(s) sent to SSL, 722 byte(s) sent to socket Is my suspicion plausible? Can you recommend a change in the configuration to avoid this issue? Anything else I can do to debug? The config looks something like this: cert = C:\crt.pem key = C:\key.key ciphers = ALL:!DH:!aNULL:!eNULL:!LOW:!EXP socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 2 CAfile = C:\All-In-One.pem [test] accept = 23456 connect = 10.10.10.10

1 0

Incoming port ignored
by Ivan De Masi 31 Mar '16

31 Mar '16

Hello, I have a strange problem with my stunnel since a view days: I installed stunnel, because my AV-Scanner (Avira) is not able to scan e-mail traffic of encrypted connections to my mailprovider. So I configured both mail-clients (Thunderbird & Outlook) and AV-Scanner to listen on localhost and stunnel to connect to my mailprovider. This was working fine for a view days, but stoped some days ago and I'm not shure why. Maybe when I installed stunnel as a daemon I run into trouble (will bw another subject). The encrypted connection to my mailprovider is working and e-mails are recived and sent, but the AV-scanner doesn't "see" them anymore. I examined the log and what makes me wonder is, that the when fetching the e-mails, the configured ports (110/143/25) seem to be ignored: "Service [df-pop3s] accepted connection from 127.0.0.1:1878" or "Service [df-pop3s] accepted (FD=472) from 127.0.0.1:1882" The mails on my host are always bypassed on another port (the longer I run stunnel they change/increase) - see the log file. I have installed latest stunnel version (5.31) on Windows 7 (x86). Any ideas? Kind regards, Ivan Main-config: [df-pop3s] client = yes accept = 127.0.0.1:110 connect = sslin.df.eu:995 verify = 3 CAfile = peer-df-pop3s.pem checkHost = sslin.df.eu OCSPaia = yes [df-imaps] client = yes accept = 127.0.0.1:143 connect = sslin.df.eu:993 verify = 3 CAfile = peer-df-imaps.pem checkHost = sslin.df.eu OCSPaia = yes [df-smtps] client = yes accept = 127.0.0.1:25 connect = sslout.df.eu:465 verify = 3 CAfile = peer-df-smtps.pem checkHost = sslout.df.eu OCSPaia = yes Log: 2016.03.30 09:22:21 LOG7[main]: No limit detected for the number of clients 2016.03.30 09:22:21 LOG7[cron]: Cron thread initialized 2016.03.30 09:22:21 LOG5[main]: stunnel 5.31 on x86-pc-msvc-1500 platform 2016.03.30 09:22:21 LOG5[main]: Compiled/running with OpenSSL 1.0.2g-fips 1 Mar 2016 2016.03.30 09:22:21 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2016.03.30 09:22:21 LOG7[main]: errno: (*_errno()) 2016.03.30 09:22:21 LOG7[ui]: GUI message loop initialized 2016.03.30 09:22:21 LOG5[main]: Reading configuration from file stunnel.conf 2016.03.30 09:22:21 LOG5[main]: UTF-8 byte order mark detected 2016.03.30 09:22:21 LOG5[main]: FIPS mode enabled 2016.03.30 09:22:21 LOG7[main]: Compression disabled 2016.03.30 09:22:21 LOG7[main]: Snagged 64 random bytes from C:/.rnd 2016.03.30 09:22:21 LOG7[main]: Wrote 0 new random bytes to C:/.rnd 2016.03.30 09:22:21 LOG7[main]: PRNG seeded successfully 2016.03.30 09:22:21 LOG6[main]: Initializing service [df-pop3s] 2016.03.30 09:22:23 LOG7[main]: No certificate or private key specified 2016.03.30 09:22:23 LOG7[main]: SSL options: 0x03000004 (+0x03000000l, -0x00000000) 2016.03.30 09:22:23 LOG6[main]: Initializing service [df-imaps] 2016.03.30 09:22:23 LOG7[main]: No certificate or private key specified 2016.03.30 09:22:23 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2016.03.30 09:22:23 LOG6[main]: Initializing service [df-smtps] 2016.03.30 09:22:23 LOG7[main]: No certificate or private key specified 2016.03.30 09:22:23 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2016.03.30 09:22:23 LOG5[main]: Configuration successful 2016.03.30 09:22:23 LOG7[main]: Listening file descriptor created (FD=428) 2016.03.30 09:22:23 LOG7[main]: Service [df-pop3s] (FD=428) bound to 127.0.0.1:110 2016.03.30 09:22:23 LOG7[main]: Listening file descriptor created (FD=432) 2016.03.30 09:22:23 LOG7[main]: Service [df-imaps] (FD=432) bound to 127.0.0.1:143 2016.03.30 09:22:23 LOG7[main]: Listening file descriptor created (FD=436) 2016.03.30 09:22:23 LOG7[main]: Service [df-smtps] (FD=436) bound to 127.0.0.1:25 2016.03.30 09:22:42 LOG7[main]: Found 1 ready file descriptor(s) 2016.03.30 09:22:42 LOG7[main]: FD=352 ifds=r-x ofds=--- 2016.03.30 09:22:42 LOG7[main]: FD=428 ifds=r-x ofds=r-- 2016.03.30 09:22:42 LOG7[main]: FD=432 ifds=r-x ofds=--- 2016.03.30 09:22:42 LOG7[main]: Service [df-pop3s] accepted (FD=460) from 127.0.0.1:1878 2016.03.30 09:22:42 LOG7[main]: Creating a new thread 2016.03.30 09:22:42 LOG7[main]: New thread created 2016.03.30 09:22:42 LOG7[0]: Service [df-pop3s] started 2016.03.30 09:22:42 LOG5[0]: Service [df-pop3s] accepted connection from 127.0.0.1:1878 2016.03.30 09:22:42 LOG6[0]: s_connect: connecting 134.119.18.26:995 2016.03.30 09:22:42 LOG7[0]: s_connect: s_poll_wait 134.119.18.26:995: waiting 10 seconds 2016.03.30 09:22:42 LOG5[0]: s_connect: connected 134.119.18.26:995 2016.03.30 09:22:42 LOG5[0]: Service [df-pop3s] connected remote server from 192.168.1.2:1879 2016.03.30 09:22:42 LOG7[0]: Remote descriptor (FD=484) initialized 2016.03.30 09:22:42 LOG6[0]: SNI: sending servername: sslin.df.eu 2016.03.30 09:22:42 LOG7[0]: SSL state (connect): before/connect initialization 2016.03.30 09:22:42 LOG7[0]: SSL state (connect): SSLv2/v3 write client hello A 2016.03.30 09:22:42 LOG7[0]: SSL state (connect): SSLv3 read server hello A 2016.03.30 09:22:42 LOG7[0]: Verification started at depth=2: C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA 2016.03.30 09:22:42 LOG7[0]: CERT: Pre-verification succeeded 2016.03.30 09:22:42 LOG7[0]: OCSP: Ignoring root certificate 2016.03.30 09:22:42 LOG6[0]: Certificate accepted at depth=2: C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA 2016.03.30 09:22:42 LOG7[0]: Verification started at depth=1: C=BE, O=GlobalSign nv-sa, CN=AlphaSSL CA - SHA256 - G2 2016.03.30 09:22:42 LOG7[0]: CERT: Pre-verification succeeded 2016.03.30 09:22:42 LOG5[0]: OCSP: Connecting the AIA responder "http://ocsp.globalsign.com/rootr1" 2016.03.30 09:22:46 LOG6[0]: s_connect: connecting 104.16.25.216:80 2016.03.30 09:22:46 LOG7[0]: s_connect: s_poll_wait 104.16.25.216:80: waiting 10 seconds 2016.03.30 09:22:46 LOG5[0]: s_connect: connected 104.16.25.216:80 2016.03.30 09:22:46 LOG7[0]: OCSP: Connected ocsp.globalsign.com:80 2016.03.30 09:22:46 LOG7[0]: OCSP: Response received 2016.03.30 09:22:46 LOG6[0]: OCSP: Status: good 2016.03.30 09:22:46 LOG6[0]: OCSP: This update: Mar 30 05:42:27 2016 GMT 2016.03.30 09:22:46 LOG6[0]: OCSP: Next update: Apr 3 05:42:27 2016 GMT 2016.03.30 09:22:46 LOG5[0]: OCSP: Certificate accepted 2016.03.30 09:22:46 LOG6[0]: Certificate accepted at depth=1: C=BE, O=GlobalSign nv-sa, CN=AlphaSSL CA - SHA256 - G2 2016.03.30 09:22:46 LOG7[0]: Verification started at depth=0: C=DE, OU=Domain Control Validated, CN=sslin.df.eu 2016.03.30 09:22:46 LOG7[0]: CERT: Pre-verification succeeded 2016.03.30 09:22:46 LOG6[0]: CERT: Host name "sslin.df.eu" matched with "sslin.df.eu" 2016.03.30 09:22:46 LOG6[0]: CERT: Locally installed certificate matched 2016.03.30 09:22:46 LOG5[0]: OCSP: Connecting the AIA responder "http://ocsp2.globalsign.com/gsalphasha2g2" 2016.03.30 09:22:46 LOG6[0]: s_connect: connecting 104.16.25.216:80 2016.03.30 09:22:46 LOG7[0]: s_connect: s_poll_wait 104.16.25.216:80: waiting 10 seconds 2016.03.30 09:22:46 LOG5[0]: s_connect: connected 104.16.25.216:80 2016.03.30 09:22:46 LOG7[0]: OCSP: Connected ocsp2.globalsign.com:80 2016.03.30 09:22:46 LOG7[0]: OCSP: Response received 2016.03.30 09:22:46 LOG6[0]: OCSP: Status: good 2016.03.30 09:22:46 LOG6[0]: OCSP: This update: Mar 27 21:09:59 2016 GMT 2016.03.30 09:22:46 LOG6[0]: OCSP: Next update: Mar 31 21:09:59 2016 GMT 2016.03.30 09:22:46 LOG5[0]: OCSP: Certificate accepted 2016.03.30 09:22:46 LOG5[0]: Certificate accepted at depth=0: C=DE, OU=Domain Control Validated, CN=sslin.df.eu 2016.03.30 09:22:46 LOG7[0]: SSL state (connect): SSLv3 read server certificate A 2016.03.30 09:22:46 LOG7[0]: SSL state (connect): SSLv3 read server key exchange A 2016.03.30 09:22:46 LOG6[0]: Client certificate not requested 2016.03.30 09:22:46 LOG7[0]: SSL state (connect): SSLv3 read server done A 2016.03.30 09:22:46 LOG7[0]: SSL state (connect): SSLv3 write client key exchange A 2016.03.30 09:22:46 LOG7[0]: SSL state (connect): SSLv3 write change cipher spec A 2016.03.30 09:22:46 LOG7[0]: SSL state (connect): SSLv3 write finished A 2016.03.30 09:22:46 LOG7[0]: SSL state (connect): SSLv3 flush data 2016.03.30 09:22:46 LOG7[0]: SSL state (connect): SSLv3 read server session ticket A 2016.03.30 09:22:46 LOG7[0]: SSL state (connect): SSLv3 read finished A 2016.03.30 09:22:46 LOG7[0]: 1 client connect(s) requested 2016.03.30 09:22:46 LOG7[0]: 1 client connect(s) succeeded 2016.03.30 09:22:46 LOG7[0]: 0 client renegotiation(s) requested 2016.03.30 09:22:46 LOG7[0]: 0 session reuse(s) 2016.03.30 09:22:46 LOG6[0]: SSL connected: new session negotiated 2016.03.30 09:22:46 LOG7[0]: Peer certificate was cached (4539 bytes) 2016.03.30 09:22:46 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES128-GCM-SHA256 (128-bit encryption) 2016.03.30 09:22:46 LOG7[0]: Compression: null, expansion: null 2016.03.30 09:23:01 LOG7[0]: SSL alert (read): warning: close notify 2016.03.30 09:23:01 LOG6[0]: SSL closed (SSL_read) 2016.03.30 09:23:01 LOG7[0]: Sent socket write shutdown 2016.03.30 09:23:01 LOG6[0]: Read socket closed (readsocket) 2016.03.30 09:23:01 LOG7[0]: Sending close_notify alert 2016.03.30 09:23:01 LOG7[0]: SSL alert (write): warning: close notify 2016.03.30 09:23:01 LOG6[0]: SSL_shutdown successfully sent close_notify alert 2016.03.30 09:23:01 LOG5[0]: Connection closed: 304 byte(s) sent to SSL, 545297 byte(s) sent to socket 2016.03.30 09:23:01 LOG7[0]: Remote descriptor (FD=484) closed 2016.03.30 09:23:01 LOG7[0]: Local descriptor (FD=460) closed 2016.03.30 09:23:01 LOG7[0]: Service [df-pop3s] finished (0 left) 2016.03.30 09:23:02 LOG7[main]: Found 1 ready file descriptor(s) 2016.03.30 09:23:02 LOG7[main]: FD=352 ifds=r-x ofds=--- 2016.03.30 09:23:02 LOG7[main]: FD=428 ifds=r-x ofds=r-- 2016.03.30 09:23:02 LOG7[main]: FD=432 ifds=r-x ofds=--- 2016.03.30 09:23:02 LOG7[main]: Service [df-pop3s] accepted (FD=472) from 127.0.0.1:1882 2016.03.30 09:23:02 LOG7[main]: Creating a new thread 2016.03.30 09:23:02 LOG7[main]: New thread created 2016.03.30 09:23:02 LOG7[1]: Service [df-pop3s] started 2016.03.30 09:23:02 LOG5[1]: Service [df-pop3s] accepted connection from 127.0.0.1:1882 2016.03.30 09:23:02 LOG6[1]: s_connect: connecting 134.119.18.26:995 2016.03.30 09:23:02 LOG7[1]: s_connect: s_poll_wait 134.119.18.26:995: waiting 10 seconds 2016.03.30 09:23:02 LOG5[1]: s_connect: connected 134.119.18.26:995 2016.03.30 09:23:02 LOG5[1]: Service [df-pop3s] connected remote server from 192.168.1.2:1883 2016.03.30 09:23:02 LOG7[1]: Remote descriptor (FD=468) initialized 2016.03.30 09:23:02 LOG6[1]: SNI: sending servername: sslin.df.eu 2016.03.30 09:23:02 LOG7[1]: SSL state (connect): before/connect initialization 2016.03.30 09:23:02 LOG7[1]: SSL state (connect): SSLv3 write client hello A 2016.03.30 09:23:02 LOG7[1]: SSL state (connect): SSLv3 read server hello A 2016.03.30 09:23:02 LOG7[1]: SSL state (connect): SSLv3 read finished A 2016.03.30 09:23:02 LOG7[1]: SSL state (connect): SSLv3 write change cipher spec A 2016.03.30 09:23:02 LOG7[1]: SSL state (connect): SSLv3 write finished A 2016.03.30 09:23:02 LOG7[1]: SSL state (connect): SSLv3 flush data 2016.03.30 09:23:02 LOG7[1]: 2 client connect(s) requested 2016.03.30 09:23:02 LOG7[1]: 2 client connect(s) succeeded 2016.03.30 09:23:02 LOG7[1]: 0 client renegotiation(s) requested 2016.03.30 09:23:02 LOG7[1]: 1 session reuse(s) 2016.03.30 09:23:02 LOG6[1]: SSL connected: previous session reused 2016.03.30 09:23:08 LOG7[1]: SSL alert (read): warning: close notify 2016.03.30 09:23:08 LOG6[1]: SSL closed (SSL_read) 2016.03.30 09:23:08 LOG7[1]: Sent socket write shutdown 2016.03.30 09:23:08 LOG6[1]: Read socket closed (readsocket) 2016.03.30 09:23:08 LOG7[1]: Sending close_notify alert 2016.03.30 09:23:08 LOG7[1]: SSL alert (write): warning: close notify 2016.03.30 09:23:08 LOG6[1]: SSL_shutdown successfully sent close_notify alert 2016.03.30 09:23:08 LOG5[1]: Connection closed: 149 byte(s) sent to SSL, 336471 byte(s) sent to socket 2016.03.30 09:23:08 LOG7[1]: Remote descriptor (FD=468) closed 2016.03.30 09:23:08 LOG7[1]: Local descriptor (FD=472) closed 2016.03.30 09:23:08 LOG7[1]: Service [df-pop3s] finished (0 left) 2016.03.30 09:23:21 LOG6[cron]: Executing cron jobs 2016.03.30 09:23:21 LOG6[cron]: Cron jobs completed in 0 seconds 2016.03.30 09:23:21 LOG7[cron]: Waiting 86400 seconds

4 10

Re: [stunnel-users] Connecting stunnels
by Ludolf Holzheid 31 Mar '16

31 Mar '16

On Thu, 2016-03-31 09:39:49 -0400, Carter Browne wrote: > A single instance of stunnel can be a server or a client depending on > the settings. For this configuration, you would want host3 to be a > server not a client. > Thus, you need the intermediate port on server2 to server as both a > client and a server: > > In your configuration files you would need: > > Host1: > [secure_telnet] > accept = local:23 > connect = host2:host2port1 > client = yes > > Host2: > [incoming_telnet_relay] > accept = host2:host2port1 > connect = local:host2port2 > client = no > > [outgoing_telnet_relay] > accept =local:host2port2 > connect = host3:host3port1 > client = yes > > Host3: > [incoming_telnet] > accept = host3:host3port1 > connect = local:23 Carter, What's the advantage of this setup over a direct connection from Host1 to Host3? Host1: [secure_telnet] accept = local:23 connect = host3:host3port1 client = yes Host3: [incoming_telnet] accept = host3:host3port1 connect = local:23 client = no If e.g. Host3 isn't directly reachable from Host1, a simple port forwarding (without decryption and re-encryption) on Host2 would suffice. Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:[email protected] http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

2 3

Connecting stunnels
by Juhasz Gabor 31 Mar '16

31 Mar '16

Hi, I am newbie in stunnel world so sorry for my question if it was already answered earlier. I have the following task to solve somehow : We have 1 server with 2 stunnel connections (any kind). We have e.g. http communicatoin via tunnels. Is there any support in stunnel to connect them somehow. Probably we do not need bidirectional communication. [client1]----- stunnel 1---> [server]------stunnel2 ----->[client2] So [client1] --> [client2] If there is no support in stunnel do you have any idea how to do it? Kind regards, Gabor

2 9

Please help
by Steve Wollan 30 Mar '16

30 Mar '16

Installed stunnel-5.31 (stunnel-5.31-installer) so that I can get MT4, a Forex trade platform, to send me mails to my Gmail account. I was told this was necessary because MT4 doesn't support SSL Authentication. I attempted to start and received this; [image: Inline image 1] It looks like a config file issue but also would not bind? Is this one issue? I was told all I needed to do with the config file is this; [image: Inline image 2] Can you please simply help me with the config file? I'm lost and need help. Thanks to all in advance for your help.

3 2

Using stunnel for TLS with Geotrust cert?
by Jon Bogaty 28 Mar '16

28 Mar '16

Hey stunnel-users, I'm having an issue both on stunnel4 and on 5 which I think is more related to a lack of understanding of the difference between how stunnel uses intermediate chain certs and root CA certs. I have from Geotrust, who signs my SSL certs, an intermediate.crt which by the stunnel docs should be catted into one stunnel.pem with the cert for my domain and the private key. The issue is when I setup everything on the server and try to connect with a client I either get for "verify 2" warnings about MiTM authentication problems, or for "verify 3" or "verify 4", which should disable CA checking altogether to my understanding, "Please specify CApath". I feel like I'm missing something critical in terms of pieces. The goal is to use stunnel as a proxy for mysql and the conf is pretty barebones: sslVersion = TLSv1 setuid = stunnel4 setgid = stunnel4 pid = /var/lib/stunnel4/stunnel4.pid debug = 7 foreground = yes socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 cert = /etc/stunnel/stunnel.pem verify = 3 [mysqls] accept = 3307 connect = localhost:3306 It runs just fine using supervisor. Any thoughts and how I could make the handshake work between server and client using geotrust's intermediate crt as the CA cert, or something similar? It contains certs down to the root level. Thanks! Jon

1 0

Install directory with /S /D=[path]
by Yoshitake, Aaron 23 Mar '16

23 Mar '16

Hi all, I'm making an installer that installs stunnel as a dependency, and I'd like to customize its install directory while running it in silent mode. Per the NSIS docs, my command has the /S switch for silent mode, but when I try /D=[path], the installer ignores it and installs to Program Files (x86)/stunnel anyway. Is there a workaround for this? Thanks, Aaron

2 2

Latest x-forwarded-for patch for Stunnel 5.31
by Nelson 20 Mar '16

20 Mar '16

Hi, Has anyone knows a compatible patch for the latest version 5.31? Can anyone provide the link? The patch that I have only works on 5.02 but not on 5.31

1 0

Minor bug in resolver.c
by Jose Alf. 16 Mar '16

16 Mar '16

Hello Michal, I found a small bug on resolver.c. In function addrlist_resolve, in source line 318 for version 5.31, there is the instruction: num+=name2addrlist(addr_list, host->name) I think It should be: num = name2addrlist(addr_list, host->name) I found this because I created a service with three connect lines, like this: [ldaps] client=yes accept=127.0.0.1:7000 connect=10.1.1.1:636 connect=10.2.2.2:636 connect=10.3.2.3:636 And I found this line in the log: 2016.03.15 22:23:34 LOG6[0]: failover: round-robin, starting at entry #6 #6? It should be <= #2 ! I checked the source code, added some s_log instructions and found that the problem. For 3 addresses num variable was set to 6 (1 + 2 + 3) and that was returned by addrlist_resolve. Hope this helps. And thanks again for your hard work on stunnel. Best Regards Jose A. Diaz

1 0

Possible signal handling bug in fork mode
by Philippe Anctil 15 Mar '16

15 Mar '16

Hi, In fork mode, sending a sigterm signal to a child is caught by the parent. I suspect it has something to do with signal_pipe being shared by the child and parent after the fork. Here I sent a signal to the parent while a child process was also running. The parent shut down as expected. After sending sigterm, the child remains. Processes before sigterm: UID PID PPID C STIME TTY STAT TIME CMD user 1423 1 0 10:32 ? Ss 0:00 /usr/local/stunnel/bin/stunnel.bin /usr/local/stunnel/etc/server.conf user 1921 1423 0 10:37 ? S 0:00 \_ /usr/local/stunnel/bin/stunnel.bin /usr/local/stunnel/etc/server.conf selected pid 1423 Processes after: UID PID PPID C STIME TTY STAT TIME CMD user 1921 1 0 10:37 ? S 0:00 /usr/local/stunnel/bin/stunnel.bin /usr/local/stunnel/etc/server.conf Here I sent the signal to the child. The parent shut down and the child completed normally. Processes before: UID PID PPID C STIME TTY STAT TIME CMD user 1276 1 0 10:31 ? Ss 0:00 /usr/local/stunnel/bin/stunnel.bin /usr/local/stunnel/etc/server.conf user 1309 1276 0 10:31 ? S 0:00 \_ /usr/local/stunnel/bin/stunnel.bin /usr/local/stunnel/etc/server.conf selected pid 1309 Processes after: UID PID PPID C STIME TTY STAT TIME CMD user 1309 1 0 10:31 ? S 0:00 /usr/local/stunnel/bin/stunnel.bin /usr/local/stunnel/etc/server.conf I know I should be trying threads. I will eventually. I can only switch once I validate it can sustain our level of traffic. Fork has done that flawlessly for many years now. Best regards, -- Philippe Anctil

2 5

windows certificate store
by Jim Howland 11 Mar '16

11 Mar '16

Hi I am running a windows instance of stunnel as a client and A Linux version as the server When I set this on the Windows side : engine = capi and this in my section: engineId = capi I get an error message that CApath or CAFile still needs to be set. My understanding is that these setting should make stunnel use the Windows certificate store to find a root and intermediate certificate to authenticate my (Symantec generated) certificate and should not require a CAfile. Here is my windows config : ; ************************************************************************** ; * Global options * ; ************************************************************************** ; Debugging stuff (may be useful for troubleshooting) debug = debug ;output = stunnel.log ; Enable FIPS 140-2 mode if needed for compliance ;fips = yes ; Microsoft CryptoAPI engine allows for authentication with private keys ; stored in the Windows certificate store ; Each section using this feature also needs the "engineId = capi" option engine = capi [FIX] client = yes accept = 9021 connect = fixuat.au.abnamroclearing.com:9443<http://fixuat.au.abnamroclearing.com:9443> cert = C:\certs\jim.howland.cer key = C:\certs\jim.howland.key verify = 3 ; CAfile = C:\certs\veriSign_root_certificates\symantec-class3-G5.cer engineId = capi and here is the error [ ] Cron thread initialized [ ] No limit detected for the number of clients [.] stunnel 5.31 on x86-pc-msvc-1500 platform [.] Compiled/running with OpenSSL 1.0.2g-fips 1 Mar 2016 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] GUI message loop initialized [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark detected [ ] Enabling support for engine "capi" [ ] Initializing engine #1 (capi) [ ] Engine #1 (capi) initialized [.] FIPS mode disabled [ ] Compression disabled [ ] Snagged 64 random bytes from C:/.rnd [ ] Wrote 0 new random bytes to C:/.rnd [ ] PRNG seeded successfully [ ] Initializing service [FIX] [!] Service [FIX]: Either "CAfile" or "CApath" has to be configured [!] Server is down Any ideas? Kind Regards, Jim Howland | Linux Engineer ABN AMRO | ABN AMRO Clearing Sydney Pty Ltd Level 8, 50 Bridge Street | Sydney NSW 2000 | Australia Tel: +61 (0)2 9151 3124 | Mobile: +61 (0)417 885818 | Internet abnamroclearing.com ******** This message (including any attachments ) is confidential and is intended solely for the use of the individual or entity to whom it is addressed. If you have received this message by mistake please notify the sender by return email and delete this message from your system. Any unauthorised use or dissemination of this message in whole or in part is strictly prohibited. ********

1 0

Error 1408F10B talking to Active Directory on port 636
by Matthew Slowe 07 Mar '16

07 Mar '16

Hi all! We’ve been using stunnel as part of a vendor supplied product for some time to connect a large application running in an application server on Windows to Active Directory for authentication via LDAPS (for some reason, it only natively supports LDAP!). Anyway, it’s been working fine until a couple of weeks ago when we started getting intermittent failures against all of our configured Domain Controllers (the upstream LDAPS servers). With no change in STunnel or DC config, some connections would abort with the following log: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number … while others worked fine. The error is not limited to any one of the upstream DCs nor does it occur for every request. We’ve updated STunnel to the latest version (5.31) and the problem remains running on Windows 2008 R2 SP1. Below are two transactions from the same instance of STunnel connecting to the same DC one which works and one which doesn’t (IP addresses obfuscated). Config in use: {{{ client = yes debug = 7 output = e:\prog\stunnel\stunnel.log options = NO_SSLv2 [ldaps] accept = localhost:389 connect = domain.local:636 }}} Any thoughts gratefully received! Thanks, Matthew Fails ==== 2016.03.04 15:20:25 LOG7[14]: Service [ldaps] started 2016.03.04 15:20:25 LOG5[14]: Service [ldaps] accepted connection from 127.0.0.1:63130 2016.03.04 15:20:25 LOG6[14]: failover: round-robin, starting at entry #2 2016.03.04 15:20:25 LOG6[14]: s_connect: connecting 10.10.1.254:636 2016.03.04 15:20:25 LOG7[14]: s_connect: s_poll_wait 10.10.1.254:636: waiting 10 seconds 2016.03.04 15:20:25 LOG5[14]: s_connect: connected 10.10.1.254:636 2016.03.04 15:20:25 LOG5[14]: Service [ldaps] connected remote server from 10.10.1.225:63131 2016.03.04 15:20:25 LOG7[14]: Remote socket (FD=448) initialized 2016.03.04 15:20:25 LOG6[14]: SNI: sending servername: ad.kent.ac.uk 2016.03.04 15:20:25 LOG7[14]: SSL state (connect): before/connect initialization 2016.03.04 15:20:25 LOG7[14]: SSL state (connect): SSLv3 write client hello A 2016.03.04 15:20:25 LOG7[14]: SSL alert (write): fatal: protocol version 2016.03.04 15:20:25 LOG3[14]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2016.03.04 15:20:25 LOG5[14]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.03.04 15:20:25 LOG7[14]: Remote socket (FD=448) closed 2016.03.04 15:20:25 LOG7[14]: Local socket (FD=492) closed 2016.03.04 15:20:25 LOG7[14]: Service [ldaps] finished (0 left) Works ====== 2016.03.02 18:18:01 LOG7[204]: Service [ldaps] started 2016.03.02 18:18:01 LOG5[204]: Service [ldaps] accepted connection from 127.0.0.1:52873 2016.03.02 18:18:01 LOG6[204]: failover: round-robin, starting at entry #0 2016.03.02 18:18:01 LOG6[204]: s_connect: connecting 10.10.1.254:636 2016.03.02 18:18:01 LOG7[204]: s_connect: s_poll_wait 10.10.1.254:636: waiting 10 seconds 2016.03.02 18:18:01 LOG5[204]: s_connect: connected 10.10.1.254:636 2016.03.02 18:18:01 LOG5[204]: Service [ldaps] connected remote server from 10.10.1.223:52874 2016.03.02 18:18:01 LOG7[204]: Remote socket (FD=492) initialized 2016.03.02 18:18:01 LOG6[204]: SNI: sending servername: ad.kent.ac.uk 2016.03.02 18:18:01 LOG7[204]: SSL state (connect): before/connect initialization 2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 write client hello A 2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 read server hello A 2016.03.02 18:18:01 LOG6[204]: Certificate verification disabled 2016.03.02 18:18:01 LOG6[204]: Certificate verification disabled 2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 read server certificate A 2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 read server key exchange A 2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 read server certificate request A 2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 read server done A 2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 write client certificate A 2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 write client key exchange A 2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 write change cipher spec A 2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 write finished A 2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 flush data 2016.03.02 18:18:01 LOG7[204]: SSL state (connect): SSLv3 read finished A 2016.03.02 18:18:01 LOG7[204]: 205 client connect(s) requested 2016.03.02 18:18:01 LOG7[204]: 205 client connect(s) succeeded 2016.03.02 18:18:01 LOG7[204]: 0 client renegotiation(s) requested 2016.03.02 18:18:01 LOG7[204]: 0 session reuse(s) 2016.03.02 18:18:01 LOG6[204]: SSL connected: new session negotiated 2016.03.02 18:18:01 LOG7[204]: Deallocating application specific data for addr index 2016.03.02 18:18:01 LOG6[204]: Negotiated TLSv1 ciphersuite ECDHE-RSA-AES256-SHA (256-bit encryption) 2016.03.02 18:18:01 LOG7[204]: Compression: null, expansion: null 2016.03.02 18:18:01 LOG6[204]: Read socket closed (readsocket) 2016.03.02 18:18:01 LOG7[204]: Sending close_notify alert 2016.03.02 18:18:01 LOG7[204]: SSL alert (write): warning: close notify 2016.03.02 18:18:01 LOG6[204]: SSL_shutdown successfully sent close_notify alert 2016.03.02 18:18:01 LOG3[204]: SSL_read: Connection reset by peer (WSAECONNRESET) (10054) 2016.03.02 18:18:01 LOG5[204]: Connection reset: 276 byte(s) sent to SSL, 44 byte(s) sent to socket 2016.03.02 18:18:01 LOG7[204]: Remote socket (FD=492) closed 2016.03.02 18:18:01 LOG7[204]: Local socket (FD=456) closed 2016.03.02 18:18:01 LOG7[204]: Service [ldaps] finished (0 left) -- Matthew Slowe | Server Infrastructure Officer IT Infrastructure, Information Services, University of Kent Room S21, Cornwallis South Canterbury, Kent, CT2 7NZ, UK Tel: +44 (0)1227 824265 www.kent.ac.uk/is | @UnikentUnseenIT | @UKCLibraryIt PGP: https://keybase.io/fooflington

1 0

CRL checking
by Fritz Gschwendner 03 Mar '16

03 Mar '16

Hello, I noticed a change in functionality of CRL checking in server mode somewhere between stunnel version 5.2.00 and 5.31.00. We have multiple services listening for incoming connections and a global option CRLfile = crls.pem, with crls.pem containing a few CRLs but not one for every possible client certificate, and client certificates not all having a CRL distribution point configured. This worked with the old version in the sense that all clients could connect. I don't know If CRL checking really worked, they are all empty and I can't test. With the new version client certificates with no CRL and no CRL distribution point configured got rejected with errors "CERT: Pre-verification error: unable to get certificate CRL" and "SSL_accept: 14089086: error:14089086:SSL routines:ssl3_get_client_certificate:certificate verify failed" If I remove the global entry for CRLfile with the new version, all clients can connect again. I guess I could enter the CRLfile option on service level, but it could be that some client certificates connecting to a specific service have a CRL and some don't. My questions: Is this intended behaviour? I find it logical to check the CRL of a client certificate, if there is one in the CRLfile, if there isn't, to not check. Does a CRL distribution point configured in a client certificate play any role?

2 1

Problem with Stunnel 5.31 and Openssl 1.0.2g
by Carter Browne 02 Mar '16

02 Mar '16

I have a confusing problem I cannot figure out: I have two systems: one Redhat 5.10 x86, the other CentOs 5.10 x86 I compiled openssl version 1.0.2g on both systems I compiled stunnel 5.31 on both systems In both cases, this was updating older working verions of openssl and stunnel. On the Redhat system I used gcc44 On the CentOS system i used gcc4.1 The CentOS system works as before. On the Redhat system all self signed certificates are rejected. As I only use self-signed certificates to identify a set of known hosts, this is a problem for me. I tried various verify optios (2 3 4) both nothing changed. Any idea on how to fix this problem. What information can I provide you with to help? Thanks, Carter Carter Browne cbrowne(a)cbcs-usa.com

2 1

Slow sending email through stunnel to Office365
by ajreynolds＠san.rr.com 01 Mar '16

01 Mar '16

After a bit of experimentation, I've succeeded in getting stunnel 5.31 running on my Windows 2008 r2 server and sending email through SMTP through Office365. My problem now is that it's quite slow. I can see a point in the log file where it stops for 5 seconds or more for each email message. Are there any parameter for stunnel that might help, or do I have to just accept that Office365 is slow? Here is my stunnel.conf file: debug = 7 output = stunnel.log [ms-smtp] protocol = smtp client = yes accept = 587 connect = smtp.office365.com:587 And here is the log file for an email transmission. Notice the 5 second pause at 12:31:04. Is there a way to eliminate this pause? 2016.03.01 12:30:21 LOG7[cron]: Cron thread initialized 2016.03.01 12:30:21 LOG7[main]: No limit detected for the number of clients 2016.03.01 12:30:21 LOG5[main]: stunnel 5.31 on x86-pc-msvc-1500 platform 2016.03.01 12:30:21 LOG5[main]: Compiled/running with OpenSSL 1.0.2g-fips 1 Mar 2016 2016.03.01 12:30:21 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2016.03.01 12:30:21 LOG7[main]: errno: (*_errno()) 2016.03.01 12:30:21 LOG7[service]: GUI message loop initialized 2016.03.01 12:30:21 LOG5[main]: Reading configuration from file stunnel.conf 2016.03.01 12:30:21 LOG5[main]: UTF-8 byte order mark detected 2016.03.01 12:30:21 LOG5[main]: FIPS mode disabled 2016.03.01 12:30:21 LOG7[main]: Compression disabled 2016.03.01 12:30:21 LOG7[main]: Snagged 64 random bytes from C:/.rnd 2016.03.01 12:30:21 LOG7[main]: Wrote 1024 new random bytes to C:/.rnd 2016.03.01 12:30:21 LOG7[main]: PRNG seeded successfully 2016.03.01 12:30:21 LOG6[main]: Initializing service [ms-smtp] 2016.03.01 12:30:21 LOG7[main]: No certificate or private key specified 2016.03.01 12:30:21 LOG4[main]: Service [ms-smtp] needs authentication to prevent MITM attacks 2016.03.01 12:30:21 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2016.03.01 12:30:21 LOG5[main]: Configuration successful 2016.03.01 12:30:21 LOG7[main]: Listening file descriptor created (FD=424) 2016.03.01 12:30:21 LOG7[main]: Service [ms-smtp] (FD=424) bound to 0.0.0.0:587 2016.03.01 12:30:58 LOG7[main]: Found 1 ready file descriptor(s) 2016.03.01 12:30:58 LOG7[main]: FD=388 ifds=r-x ofds=--- 2016.03.01 12:30:58 LOG7[main]: Service [ms-smtp] accepted (FD=440) from 192.168.8.58:55266 2016.03.01 12:30:58 LOG7[main]: Creating a new thread 2016.03.01 12:30:58 LOG7[main]: New thread created 2016.03.01 12:30:58 LOG7[0]: Service [ms-smtp] started 2016.03.01 12:30:58 LOG5[0]: Service [ms-smtp] accepted connection from 192.168.8.58:55266 2016.03.01 12:30:58 LOG6[0]: failover: round-robin, starting at entry #3 2016.03.01 12:30:58 LOG6[0]: s_connect: connecting 132.245.34.194:587 2016.03.01 12:30:58 LOG7[0]: s_connect: s_poll_wait 132.245.34.194:587: waiting 10 seconds 2016.03.01 12:30:58 LOG5[0]: s_connect: connected 132.245.34.194:587 2016.03.01 12:30:58 LOG5[0]: Service [ms-smtp] connected remote server from 192.168.8.14:55477 2016.03.01 12:30:58 LOG7[0]: Remote descriptor (FD=460) initialized 2016.03.01 12:30:59 LOG7[0]: <- 220 CY1PR21CA0008.outlook.office365.com Microsoft ESMTP MAIL Service ready at Tue, 1 Mar 2016 20:30:58 +0000 2016.03.01 12:30:59 LOG7[0]: -> 220 CY1PR21CA0008.outlook.office365.com Microsoft ESMTP MAIL Service ready at Tue, 1 Mar 2016 20:30:58 +0000 2016.03.01 12:30:59 LOG7[0]: -> EHLO localhost 2016.03.01 12:30:59 LOG7[0]: <- 250-CY1PR21CA0008.outlook.office365.com Hello [#.#.#.#] 2016.03.01 12:30:59 LOG7[0]: <- 250-SIZE 157286400 2016.03.01 12:30:59 LOG7[0]: <- 250-PIPELINING 2016.03.01 12:30:59 LOG7[0]: <- 250-DSN 2016.03.01 12:30:59 LOG7[0]: <- 250-ENHANCEDSTATUSCODES 2016.03.01 12:30:59 LOG7[0]: <- 250-STARTTLS 2016.03.01 12:30:59 LOG7[0]: <- 250-8BITMIME 2016.03.01 12:30:59 LOG7[0]: <- 250-BINARYMIME 2016.03.01 12:30:59 LOG7[0]: <- 250 CHUNKING 2016.03.01 12:30:59 LOG7[0]: -> STARTTLS 2016.03.01 12:30:59 LOG7[0]: <- 220 2.0.0 SMTP server ready 2016.03.01 12:30:59 LOG6[0]: SNI: sending servername: smtp.office365.com 2016.03.01 12:30:59 LOG7[0]: SSL state (connect): before/connect initialization 2016.03.01 12:30:59 LOG7[0]: SSL state (connect): SSLv2/v3 write client hello A 2016.03.01 12:30:59 LOG7[0]: SSL state (connect): SSLv3 read server hello A 2016.03.01 12:30:59 LOG6[0]: Certificate verification disabled 2016.03.01 12:30:59 LOG6[0]: Certificate verification disabled 2016.03.01 12:30:59 LOG7[0]: SSL state (connect): SSLv3 read server certificate A 2016.03.01 12:30:59 LOG7[0]: SSL state (connect): SSLv3 read server key exchange A 2016.03.01 12:30:59 LOG6[0]: Empty client CA list 2016.03.01 12:30:59 LOG7[0]: SSL state (connect): SSLv3 read server certificate request A 2016.03.01 12:30:59 LOG7[0]: SSL state (connect): SSLv3 read server done A 2016.03.01 12:30:59 LOG7[0]: SSL state (connect): SSLv3 write client certificate A 2016.03.01 12:30:59 LOG7[0]: SSL state (connect): SSLv3 write client key exchange A 2016.03.01 12:30:59 LOG7[0]: SSL state (connect): SSLv3 write change cipher spec A 2016.03.01 12:30:59 LOG7[0]: SSL state (connect): SSLv3 write finished A 2016.03.01 12:30:59 LOG7[0]: SSL state (connect): SSLv3 flush data 2016.03.01 12:30:59 LOG7[0]: SSL state (connect): SSLv3 read finished A 2016.03.01 12:30:59 LOG7[0]: 1 client connect(s) requested 2016.03.01 12:30:59 LOG7[0]: 1 client connect(s) succeeded 2016.03.01 12:30:59 LOG7[0]: 0 client renegotiation(s) requested 2016.03.01 12:30:59 LOG7[0]: 0 session reuse(s) 2016.03.01 12:30:59 LOG6[0]: SSL connected: new session negotiated 2016.03.01 12:30:59 LOG7[0]: Peer certificate was cached (4882 bytes) 2016.03.01 12:30:59 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-SHA384 (256-bit encryption) 2016.03.01 12:30:59 LOG7[0]: Compression: null, expansion: null 2016.03.01 12:31:04 LOG6[0]: Read socket closed (readsocket) 2016.03.01 12:31:04 LOG7[0]: Sending close_notify alert 2016.03.01 12:31:04 LOG7[0]: SSL alert (write): warning: close notify 2016.03.01 12:31:04 LOG6[0]: SSL_shutdown successfully sent close_notify alert 2016.03.01 12:31:04 LOG6[0]: SSL socket closed (SSL_read) 2016.03.01 12:31:04 LOG7[0]: Sent socket write shutdown 2016.03.01 12:31:04 LOG5[0]: Connection closed: 413 byte(s) sent to SSL, 635 byte(s) sent to socket 2016.03.01 12:31:04 LOG7[0]: Remote descriptor (FD=460) closed 2016.03.01 12:31:04 LOG7[0]: Local descriptor (FD=440) closed 2016.03.01 12:31:04 LOG7[0]: Service [ms-smtp] finished (0 left) Thanks very much, Andy

1 0

stunnel 5.31 released
by Michal Trojnara 01 Mar '16

01 Mar '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear Users, I have released version 5.31 of stunnel. The ChangeLog entry: Version 5.31, 2016.03.01, urgency: HIGH * Security bugfixes - OpenSSL DLLs updated to version 1.0.2g. https://www.openssl.org/news/secadv_20160301.txt * New features - Added logging the list of client CAs requested by the server. - Improved compatibility with the current OpenSSL 1.1.0-dev tree. * Bugfixes - Only reset the watchdog if some data was actually transferred. - A workaround implemented for the unexpected exceptfds set by select() on WinCE 6.0 (thx to Richard Kraemer). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: a746b71ab3dc6c23eacb0daf7342467870e43ac933430905eb1b1d050bbae0b7 stunnel-5.31.tar.gz c662fc1254f22ce5ac3f6e09bf643b3a0a99a884b6414f55cc8ab22d7c680fd5 stunnel-5.31-installer.exe f14d7c9cf23a25bdcef8480f9d35c66233bb9e64f82098f1867edf4b038b41c4 stunnel-5.31-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJW1cIFAAoJEC78f/DUFuAU998P/1LpUY+B/Q4E7XWCctK1XspG zcFi8U5UhaMek9eTPlY0mJWUGihX4qQOeQi+9MV9LqvzLLfWbgMzWSv/rAiWxCzx NbHw7yASK5+xfnGBGoSenvdbvmL6s4RPxM0Qf3lrVj9kpha75JS9aHPnDhq90aLG YXle0uTj/dvDC3aG2UY0TYFQMvvubrx87JyoiTbf9i2f6q85iM76DaeP15mMZSXZ eq+9bP37OVG6RDFrlFSoSSHxOWHA5ebftwvf4MjedrziXld6pzYSzwIJ7eJhZO7Y ob+hRO3D86chiGfynYj1WWws51Q+TE4hg2NQ7vWPEi7HuN+/62CMZg3q1h/LAIT+ 2qzjVFIoVwwl8B3RZ94aJ8AzsFnhWOp5AZJ7nOBFbF69cRAuIT6DQL+GwcJoB+RJ +sxlJAyhu+3/RuAPbZYXzSzr7Lsp4/fhWIxVRW5rBqHSJCBZU+QqSOTu9GP06F9i 7FaUq9p7RxajVjtqn+QmzDpVTgBymkYvc3F1+ATSUZZNLU8KPWG+aYTtSYKKEDQS VBtQJ3BRR0Ne/TqBXStdK3PdG8t8r7hoYhPSAE1IX59F0/4MaKHcAoyDEAH5aKQx rK1Iowb5DUNF/Rcota3CXzLFBfp/ePmZFbjpQd9YcGtMXnMGFk9/Lnc+8If+vHGk p66Kx7ZYLNzkIPf0y8wn =WkNw -----END PGP SIGNATURE-----

1 0

How to build Stunnel on x64 Windows by VC with right alignment memory allocation functions
by zuz666＠gmail.com 28 Feb '16

28 Feb '16

Hello! I need to compile stunnel using VC for Windows x64 platform. I know that I can use MinGW/gcc and it will work, but VC used to build all other libraries and I want to simplify assembly process. I am try build stunnel by VC for Windows x64 platform and it builds fine but after start, stunnel crashed in VC runtime after calling setjmp function in client.c : /* try to process the request */ err=setjmp(c->err); I did some researches of the reason of a problem and found the following comment in prototypes.h: jmp_buf err; /* exception handler needs to be 16-byte aligned on Itanium */ The memory for CLI struct allocated by str_alloc_detached function (jmp_buf uded in definition CLI struct), but jmp_buf for AMD64/x64 must be 16-byte aligned to save state of SSE registers. Function calloc used for memory allocation in str_alloc_detached function and sometimes it return pointers not aligned to 16-byte boundary what causes a problem. I create dummy patch to workaround the problem but am think the best solution in that case is to use malloc instead calloc function (as described in some articles it’s always 16-byte aligned on AMD64 VC builds). Can you suggest some solutions to this problem? prototypes.h @@ -404,6 +404,10 @@ typedef struct { uint64_t sock_bytes, ssl_bytes; /* bytes written to socket and SSL */ s_poll_set *fds; /* file descriptors */ uintptr_t redirect; /* redirect to another destination after failed auth */ + /* New member added by Zuz to work around setjmp alignment issues */ +#if defined(_MSC_VER) && defined(_WIN64) + void *cli_struct_free_ptr; /* Ptr to unaligned address for this struct */ +#endif } CLI; client.c @@ -76,8 +76,14 @@ NOEXPORT void reset(SOCKET, char *); CLI *alloc_client_session(SERVICE_OPTIONS *opt, SOCKET rfd, SOCKET wfd) { static unsigned long long seq=0; CLI *c; - +#if defined(_MSC_VER) && defined(_WIN64) + #define CLI_STRUCT_ALIGNMENT 15 + void *cli_ptr_unaligned = str_alloc_detached(sizeof(CLI) + CLI_STRUCT_ALIGNMENT); + c = (CLI *)(((uintptr_t)cli_ptr_unaligned+CLI_STRUCT_ALIGNMENT) & ~ (uintptr_t)0x0F); + c->cli_struct_free_ptr = cli_ptr_unaligned; +#else c=str_alloc_detached(sizeof(CLI)); +#endif c->opt=opt; c->local_rfd.fd=rfd; c->local_wfd.fd=wfd; @@ -117,7 +123,13 @@ void client_main(CLI *c) { * -> spawn a local program instead of stdio */ for(;;) { SERVICE_OPTIONS *opt=c->opt; +#if defined(_MSC_VER) && defined(_WIN64) + void *cli_ptr_unaligned = c->cli_struct_free_ptr; +#endif memset(c, 0, sizeof(CLI)); /* connect_local needs clean c */ +#if defined(_MSC_VER) && defined(_WIN64) + c->cli_struct_free_ptr = cli_ptr_unaligned; +#endif c->opt=opt; if(!setjmp(c->err)) c->local_rfd.fd=c->local_wfd.fd=connect_local(c); @@ -136,7 +148,11 @@ void client_main(CLI *c) { } } else client_run(c); - str_free(c); +#if defined(_MSC_VER) && defined(_WIN64) + str_free(c->cli_struct_free_ptr); +#else + str_free(c); +#endif } #ifdef __GNUC__ -- Yuris W. Auzins

1 0

Forthcoming stunnel release
by Michal Trojnara 27 Feb '16

27 Feb '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear Users, A quick heads-up before the stunnel 5.31 release scheduled for 01 March 2016. The intended change log entry is: Version 5.31, 2016.03.01, urgency: HIGH * Security bugfixes - OpenSSL DLLs updated to version 1.0.2g. https://www.openssl.org/news/secadv_20160301.txt * New features - Added logging the list of client CAs requested by the server. - Improved compatibility with the current OpenSSL 1.1.0-dev tree. * Bugfixes - Only reset the watchdog if some data was actually transferred. - A workaround implemented for the unexpected exceptfds set by select() on WinCE 6.0 (thx to Richard Kraemer). Feel free download the latest beta from https://www.stunnel.org/downloads.html and report any issues. Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJW0IYYAAoJEC78f/DUFuAUCw4P/20m8FSJcnyls4TIDbn4pbmi ZGTneC1qBt4y/lAbQpQHaUQDmwhmSZ10h1jwIf7IRNWGGiy4oPuFofY8Ee64uwvs +PKI9ZTsXlL9K7gkfusfhGrw2xnmx2j9fiw/bcby+qxTh6qkR7xGAR7kdFGba6iI KLPi/AfsP/lR8BDxKIwIzcE+REOAk4Fzn9cU2HqOlwZOVuBm9k0udsuqtbl4aUO1 35fhYpNaCzMEsYFxQrF7rgUfQzD5m/8LAMk3mvBa8ByGCbSLBenETSOb++xaND92 wjL0Nv4+HDlP/XY0HfLMqhexoG5XCL1fu3cAuTPVf7PT34EGWLtickExY1w1TVKY DsND1YpCffN20ZjYksKj6IBb/dG/72Yz1MzNgbvd/x4l4PJv1O5BJQWQQ4y58+Gg b8sL4LBXXINgQdNptGSJfoQFRA1NtaNKTyOzEbeN+rcSnCcWZXnRVh5nR7rd8C14 A5EofhK0op18uyMuwTbTp1VlEvMNSW5ZGsxa0itaXHaCcF0uF/bbn/JiKYQh/TUo kOxvVu8KOmwoixw5jgGvnBnKfQSA/G7S/fcJ2WlQzBIQJFHyU159bIeTTORWCrIR /yYe/PJYgufCXmKQW7SkNOtcQggRi4IuM87+nxoFLE6u/7GxmFgN2y2kWsmc71Ev sQqDi9BBv7Kag3a7ozif =z3hT -----END PGP SIGNATURE-----

2 1

Version 4.29: First connection fails with "Unexpected socket close (read_blocking)"
by Matthew 26 Feb '16

26 Feb '16

Hi, I am experiencing an issue with version 4.29, which is the version available on yum for centos6. I am getting the following error: "Unexpected socket close (read_blocking)". This error only occurs once per stunnel instance upon the first connection only. More recent versions of stunnel do not have this problem, but I am hoping to work around this issue on the default version for this OS. My hosts.allow and hosts.deny files are both empty. I have tried adding my services to hosts.allow, but it did not have any noticeble effect. This is the version that I am using (installed with "yum install stunnel"): $ stunnel -version stunnel 4.29 on x86_64-redhat-linux-gnu with OpenSSL 1.0.1e-fips 11 Feb 2013 Threading:PTHREAD SSL:ENGINE,FIPS Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = FIPS key = /etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = TLSv1 TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none This is what my demonstration setup looks like: nc_client --TCP--> stunnel_client (2000) --SSL--> stunnel_server (2100) --TCP--> nc_server (2200) Steps to reproduce: (1) Start the netcat TCP server. $ nc -l 2200 (2) Leave the server open and open a new terminal for the rest of the commands. (3) Create “client_config.txt” with the following contents: pid = /tmp/client_stunnel.pid debug = 7 output = /tmp/client_stunnel.log client = yes ciphers = ALL fips = no foreground = no [CLIENT_PROXY_0] accept = 0.0.0.0:2000 connect = 127.0.0.1:2100 (4) Create “server_config.txt” with the following contents: pid = /tmp/server_stunnel.pid debug = 7 output = /tmp/server_stunnel.log client = no ciphers = ALL fips = no cert = /tmp/server_stunnel.pem foreground = no [SVR_PROXY_0] accept = 0.0.0.0:2100 connect = 127.0.0.1:2200 (4) Start the stunnel client: $ cat client_config.txt | stunnel -fd 0 (5) Start the stunnel server: $ cat server_config.txt | stunnel -fd 0 (6) Send three sequential messages through stunnel to the netcat server: $ echo "Test 1" | nc 127.0.0.1 2000 $ echo "Test 2" | nc 127.0.0.1 2000 $ echo "Test 3" | nc 127.0.0.1 2000 (7) You should see only “Test 3” appear at the netcat server. “Test 1” will have failed to pass from the stunnel client to the stunnel server and the log will report an "Unexpected socket close (read_blocking)” error. “Test 2” is not the first connection for the stunnel client, so it will pass through to the stunnel server successfully. But because it is the first connection for the stunnel server, it will fail there with the same error. “Test 3” is not the first connection for either the stunnel client or stunnel server, so it will make it through successfully to the netcat server. All subsequent connections will work. Basically my question is: Is there any way to make this setup work on the first connection with version 4.29, or is a new version necessary? Thanks, Matthew

1 0

How to use stunnel as a HTTPS to HTTPS reverse proxy
by Claudio Beretta 26 Feb '16

26 Feb '16

I'd like Stunnel to act as a reverse proxy that accepts TLS 1.0 and TLS 1.2 for https://example.com and then forwards the traffic to https://example.net, another web server that only accepts TLS 1.2 browser --TLS 1.0 or 1.2--> Stunnel --TLS 1.2--> Web App The browser should have no idea that example.net even exists (only example.com certificate will be presented to the browser). Is this something Stunnel can do? This is what I got so far: cert = example.com.pem ;stunnel.pem [proxy1] client = yes accept = 10.100.4.179:443 connect = localhost:54323 CAfile = sca.server1.crt.pem ;verify = 2 [proxy2] client = no accept = localhost:54323 connect = example.net:443 ;CAfile = SymantecClass3EVSSLCA-G3.pem example.com.pem contains the public and decrypted private key for example.com sca.server1.crt.pem contains the intermediate and root certificates of the CA that issues the example.com.pem certificate It partially works: the browser shows example.com in the address bad and the content of example.net, but the certificate that is returned is from example.net What am I doing wrong? Or do you have other recommendations to get something like this working on Windows Server 2008 R2? (IIS + Application Request Routing + URL Rewrite won't work: TLS1.2 is not properly supported) Thank you Claudio

3 4

Usint Stunnel in combination with tinyproxy and PSK
by Christoph Malin 26 Feb '16

26 Feb '16

Hello, I have tinyproxy running on my server. Now I would like to add stunnel with a pres shared key (username, password combination). Is it possible to use this combination as a Proxy on my normal web browser e.g. firefox? So that stunnel ist only used on server side? greetings Christoph

1 0

User-agent string
by Josh Rabinowitz 22 Feb '16

22 Feb '16

Is there a way to force stunnel to use a specific user-agent string? I have mulled through documentation, this list, and other places with no results. The reason I ask, is the proxy I am going through is super strict, well not really. It will accept 'lynx' as a user-agent (among others), but it needs something. I cannot figure out how to tell stunnel to use something like this. 5.30 on both ends, here is debug 7 from the client (IPs changed for privacy) after a config reload and ssh attempt: 2016.02.22 09:22:08 LOG5[main]: Reading configuration from file stunnel.conf 2016.02.22 09:22:08 LOG5[main]: UTF-8 byte order mark not detected 2016.02.22 09:22:08 LOG5[main]: FIPS mode disabled 2016.02.22 09:22:08 LOG5[main]: Configuration successful 2016.02.22 09:22:15 LOG7[4]: Service [ssh] started 2016.02.22 09:22:15 LOG5[4]: Service [ssh] accepted connection from 127.0.0.1:56690 2016.02.22 09:22:15 LOG6[4]: failover: round-robin, starting at entry #1 2016.02.22 09:22:15 LOG6[4]: s_connect: connecting [webproxyIP]:8080 2016.02.22 09:22:15 LOG7[4]: s_connect: s_poll_wait [webproxyIP]:8080: waiting 10 seconds 2016.02.22 09:22:15 LOG5[4]: s_connect: connected [webproxyIP]:8080 2016.02.22 09:22:15 LOG5[4]: Service [ssh] connected remote server from [clientIP]:56691 2016.02.22 09:22:15 LOG7[4]: Remote descriptor (FD=844) initialized 2016.02.22 09:22:15 LOG7[4]: -> CONNECT [remoteIP]:443 HTTP/1.1 2016.02.22 09:22:15 LOG7[4]: -> Host: [remoteIP]:443 2016.02.22 09:22:15 LOG7[4]: -> 2016.02.22 09:22:15 LOG7[4]: <- HTTP/1.1 403 Forbidden 2016.02.22 09:22:15 LOG3[4]: CONNECT request rejected 2016.02.22 09:22:15 LOG7[4]: <- Cache-Control: no-cache 2016.02.22 09:22:15 LOG7[4]: <- Pragma: no-cache 2016.02.22 09:22:15 LOG7[4]: <- Content-Type: text/html; charset=utf-8 2016.02.22 09:22:15 LOG7[4]: <- Proxy-Connection: close 2016.02.22 09:22:15 LOG7[4]: <- Connection: close 2016.02.22 09:22:15 LOG7[4]: <- Content-Length: 3164 2016.02.22 09:22:15 LOG7[4]: <- 2016.02.22 09:22:15 LOG5[4]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.02.22 09:22:15 LOG7[4]: Remote descriptor (FD=844) closed 2016.02.22 09:22:15 LOG7[4]: Local descriptor (FD=1116) closed 2016.02.22 09:22:15 LOG7[4]: Service [ssh] finished (0 left) client config: cert = stunnel.pem client = yes [ssh] accept = 127.0.0.1:2222 protocol= connect connect = [webproxyIP]:8080 protocolHost = [remoteIP]:443 PSKsecrets = psk1.txt debug = 7 Confirmed working from other hosts outside of this network. Thanks

1 0

Re: [stunnel-users] Using CAPI Engine for client authentication
by Michal Trojnara 22 Feb '16

22 Feb '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 21.02.2016 10:23, Shay Cohen wrote: > LOG6[10]: No client CA list It looks like your server does not request a client certificate. You may try connecting your service with MSIE, which natively uses client certificates from the Windows Certificate Store. If the server is configured correctly, MSIE should be able to establish TLS even if the service does not speak HTTPS. Just use https://1.2.3.4:9000/ Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWyslNAAoJEC78f/DUFuAUKowQALxsJAxHJsiglCmxlu7HevvI I7NE77SwJOh3rCQ7KrZ+HMlq36PpxzeiRmjkwstp2dMJ5KKu8+rzbGqvxcFQjKQG w3P7GE2sn3Kw1aakOj2sJBuzYTCM3mRpl4ARD10yiZv42leggWfhLHh3bU4eFmEn Mr7k2GM51uhjooDpYTY604wloxISC0m4FWcPl3elp0mDpDgYA1TehbsIsd0KxH13 poiCZGB44AuzX1As350fb3D31GLqQmZ9bCrgGY1OGepX14VeH304fFctCSqlrAa9 XGup/cmJy6URWZ26GUP7l3zOJtH5LRXEafbGPRfRKK2ZaDSt+NGCWypKA1pJ3XGK W1u6H8ggf6gER3z9Yvqemi8ukQ4C7zIt4vu10HYZ2hehxv7HpHL5Lkrj5lT+zGQQ nkOy4kckrAlk1RXTh2HO3DXlq5IHjh/8UrP/OhaRv7tb6tRVJ4I5L9Xl3kes9lJj BdgW5fS3E0F6iyJoWanviIUSjAAKT8mOhoxQhu3KvVL6Krm0J59hWTSCfdGjVwPY lMEIy2xLxUyEgDjO1r1XdPWsns5uq1wVz8BnQ6F6dgXrpOZwjUJ0DW4NZyK0m4pv +X9paNAOQaXOsSfMF8dHChL+UFuEIlCO0ILoISh3N+hJCyUJkPw8LK9Lr0cYRhif V8eUxUXA52BUqvGdzUHa =PZNb -----END PGP SIGNATURE-----

1 0

Using CAPI Engine for client authentication
by Shay Cohen 18 Feb '16

18 Feb '16

Hi, I am trying to configure one of my clients to use 'engine = capi', but cannot find a way to define which Key to actually use. debug = 7 does not show engine internal actions and engineCtrl = CAPI_CMD_DEBUG_LEVEL:2 gives an error, as well as engineCtrl = DEBUG_LEVEL:2 I'de appreciate any help with configuring this. Thanks in advance, Shay

2 2

Fw: new message
by mysql.jorge＠decimal.pt 09 Feb '16

09 Feb '16

Hey! Open message <http://sudarena.intelmedia.ro/back.php?5n11v> mysql.jorge(a)decimal.pt

1 0

User-defined headers to CONNECT
by Jason Whitener 05 Feb '16

05 Feb '16

"Add user-defined headers to CONNECT proxy requests. This can be used to impersonate other software (e.g. web browsers)." My search skills are lacking today apparently. I can't find any documentation or examples about sending custom headers back to the server. Can someone please provide an example or a link to an example? I need to send "WL-Proxy-SSL:true" back to a Web Logic server in the header with each request. Nothing too tricky I assume. Jason

1 0

Log to file WSS Websocket packet traffic
by Francesco Alfano 05 Feb '16

05 Feb '16

How can I log to file all packet traffic coming from a wss web socket on port 1234 using stunnel, openssl and tcpdump ? I have already seen https://gist.github.com/jeremiahsnapp/6426298#file-stunnel-mitm-proxy-conf , but I would like to know how to configure it

1 0

Microsoft Exchange 2010 - SMTP issue
by mahdi＠kadtekautomation.com 04 Feb '16

04 Feb '16

Hey all, Has anybody here been successful connecting to Microsoft Exchange 2010 servers usnig STunnel? Here is what I have in my stunnel.conf: ******************** cert = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 client = yes [ssmtp] accept = 127.0.0.1:587 connect = smtp.ex3.secureserver.net:587 ******************* And this is what I see in the log: ******************* 2016.02.03 18:55:14 LOG5[63]: Service [ssmtp] accepted connection from 127.0.0.1:57314 2016.02.03 18:55:14 LOG5[63]: s_connect: connected 184.168.131.205:587 2016.02.03 18:55:14 LOG5[63]: Service [ssmtp] connected remote server from 10.10.10.10:57315 2016.02.03 18:55:14 LOG3[63]: SSL_connect: 140770FC: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol 2016.02.03 18:55:14 LOG5[63]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket ******************* I am quite sure that my server address and port is correct, and obviously the other application is pushing data to stunnel. Seems like what's coming back from server is puzzling. Any help regarding this? Thanks, Mahdi.

1 0

stunnel 5.30 released
by Michal Trojnara 28 Jan '16

28 Jan '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear Users, I have released version 5.30 of stunnel. The ChangeLog entry: Version 5.30, 2016.01.28, urgency: HIGH * Security bugfixes - OpenSSL DLLs updated to version 1.0.2f. https://www.openssl.org/news/secadv_20160128.txt * New features - Improved compatibility with the current OpenSSL 1.1.0-dev tree. - Added OpenSSL autodetection for the recent versions of Xcode. * Bugfixes - Fixed references to /etc removed from stunnel.init.in. - Stopped even trying -fstack-protector on unsupported platforms (thx to Rob Lockhart). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 7d6eb389f6a1954b3bcf6c71d4ae3c5f9dde1990dd0b9e0cb1c7caf138d60570 stunnel-5.30.tar.gz cf13a881d2f19b8db5e70fafac6e5dad31f041ee6b9c0316dbd8f9f425c16418 stunnel-5.30-installer.exe 102c54d0f58937fc3c3de2a6fb6295622222e48eae200123d6357889defa45c1 stunnel-5.30-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWqkhcAAoJEC78f/DUFuAUbZoP/iH+4dndQdh5SSpSH8NR2dUf Nx10nPHP9WXZIVF9C0pISDGpRcpRi6k+4p3NU8SblGsTRm78zCpWYmeEso46Q9ve IHCrUrmQntygZ5xL5Igij9rvN8s6VeucxiMX1pZBJWAvtV5Mj2XDWFEgGiUc+sPC leCJIhj+2G6hNZJzl5whptW48+smqQvh8LC5jEtFaAUp5C0ptjrmz/vebEDlVKOs qZOZMwLmNojP3WGWWrt5fkBCLZXKvkDipgI4ln3aro/fCYQZ5fikGYbW7dTOvNCT lFmCS2vXg1hqFNM3qBWp8HKqiyYR9nVYNesW5vQW/INp6wRSqul9QSJQwsVge37N wbl19KLZL0bqXYV5a5OTovi5X1X+wRbKkcGE8yozptifV4n1AgZL4rbLkKqFu/BF zHHUmOi1m5SkRAoN8pmaTmNFe/Zp72o6unN1kfrXyvJj6NCiDKXMqTmYw4bfoSBM UUg6uKtc7k7XGPvgca/HrdEu8DJPQIWcRqNVqQ5AxVnub9gBFsJC15XdgutHJK97 XuLhZhHBdm10Frf2u/nk2Q2GpPdHAPK67QgERzO2Nr35KGOxwMXahyxKK0jI5ue5 bekTLYjZYUKS94Lt/uUgxaVmwG0x1qjurfhdXoUemuYKUAzv2tZlNF1NiGme3feP WqLyTnuGhYIxEbltnFif =gYXk -----END PGP SIGNATURE-----

1 0

Re: [stunnel-users] Access an arbitrary https website on http://localhost:3000 via stunnel.
by Hongyi Zhao 15 Jan '16

15 Jan '16

2016-01-14 16:51 GMT+08:00 Michal Trojnara <Michal.Trojnara(a)stunnel.org>: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA256 > > Hi Hongyi, > > My hint: > > $ curl -s http://localhost:3000/ > Cannot GET / > > $ curl -s -H 'Host: coolaj86.com' http://localhost:3000/ Thanks a lot, I still have some issues: 1- Why must we use the ''-H 'Host: coolaj86.com' '' in this command for getting the correct result? 2- If I want to use internet explorer, such as firefox/chrome to open the corresponding url, i.e., http://localhost:3000/, how should I do? 3- There are 3 certificates given by the owner of the website https://coolaj86.com/. They are all stored here: https://gist.github.com/coolaj86/327cee3eee6fc119b389/ Just as you can see, the 3 certificates are named as follows: cert.pem chain.pem root.pem What's the relationship between the above 3 certificates? And the first certificate, i.e., the cert.pem, is the one used for the website https://coolaj86.com/. So, I just want to know why we must the root.pem in the stunnel's conf file? Regards > <!DOCTYPE html> > <html lang="en"> > <head> > <meta charset="utf-8"> > <title>AJ ONeal</title> > ... > > Best regards, > Mike > > On 14.01.2016 05:51, Hongyi Zhao wrote: >> Hi all, >> >> Based on the descriptions on the following webpage: >> >> http://plug.org/pipermail/plug/2015-August/033939.html >> >> I do the following testing: >> >> 1- Complile and install the lastest stunnel, i.e., the >> stunnel-5.29. >> >> 2- Obtaining the root cert >> >> wget -q >> https://gist.githubusercontent.com/coolaj86/327cee3eee6fc119b389/raw/r > oot.pem >> >> > - -O /tmp/root.pem >> >> 3- Prepare the following config file for stunnel: >> >> pid = /tmp/stunnel-tlsvpn.pid >> >> client = yes verify = 1 foreground = yes >> >> [tlsvpn] accept = localhost:3000 sni = coolaj86.com connect = >> coolaj86.com:443 CAfile = /tmp/root.pem >> >> 4- Starting the stunnel: >> >> $ stunnel ./stunnel-tlsvpn.conf >> >> 5- Testing: >> >> At this moment, I use the firefox to open the following url: >> >> http://localhost:3000 >> >> But the firefox will only give the following line in its windows: >> >> Cannot GET / >> >> Any hints on this issue? >> >> Regards >> > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v2 > > iQIcBAEBCAAGBQJWl2GYAAoJEC78f/DUFuAUwlAP/3w4sq5u4Wp1SV9mbB4Sr7D4 > nP++WO10HLpSFQRnO85BaX2XHwU5aC+AxDI9wztvkEXLE9gup3KfT9Dvk9cfrHHv > Vb+EmOnspKslsOI1X/pHbSxB7tuc816aqqW9Q2Vmwh9RoVnt0djFIIB/GpKQa/0m > YhJrfcpT+WmZ3xrKQUcsahVFTzgxWxZCbDO26c/B3n/ORSmCvs4lRuYXtAuqfGlX > q0+qHt4+gi69lc6PMLeGWEonFhgHCl3Mc2Oa5Y3atb52uWG3KS2b4KF+ZQWfhPFK > qMggrXNnGgtxrb52rTw8C0/e14v3ZmENB2NX3qZGOvgiS4YujbjE2yGOgjeJzaxo > x/UEOFY2X879TECrThEWS87e6BiMog5iKYw8VneJ6rAYn40vGPEji5Lg8kTUU3kC > Du5u2zyIdPmqHhTKqpSoIgFKt1w80VpM7wZ/Z8H12yJJh1MHvh7EFUZTZ987nMpt > UNf8wCTTDxMEnQI/kMODLBLO9ntGnCHF0PXQ3s24zQ10/BftLyNbTMMTs14bktQG > hyWV/aGqF7+dtgcTgirLn1cypxKW5wrF8JOt5I/B1c3/fafHny/I4NyuF5MQuEB9 > GDDjYwbcQrU4shSA4Hoe5mWQDpdBJUBb5+8wHkgZg2neU8wcfyzEPucS960eG46Q > zSbvpAgUjmvP91qZhWyI > =oyVS > -----END PGP SIGNATURE----- -- Hongyi Zhao <hongyi.zhao(a)gmail.com> Xinjiang Technical Institute of Physics and Chemistry Chinese Academy of Sciences GnuPG DSA: 0xD108493

3 6

Access an arbitrary https website on http://localhost:3000 via stunnel.
by Hongyi Zhao 14 Jan '16

14 Jan '16

Hi all, Based on the descriptions on the following webpage: http://plug.org/pipermail/plug/2015-August/033939.html I do the following testing: 1- Complile and install the lastest stunnel, i.e., the stunnel-5.29. 2- Obtaining the root cert wget -q https://gist.githubusercontent.com/coolaj86/327cee3eee6fc119b389/raw/root.p… -O /tmp/root.pem 3- Prepare the following config file for stunnel: pid = /tmp/stunnel-tlsvpn.pid client = yes verify = 1 foreground = yes [tlsvpn] accept = localhost:3000 sni = coolaj86.com connect = coolaj86.com:443 CAfile = /tmp/root.pem 4- Starting the stunnel: $ stunnel ./stunnel-tlsvpn.conf 5- Testing: At this moment, I use the firefox to open the following url: http://localhost:3000 But the firefox will only give the following line in its windows: Cannot GET / Any hints on this issue? Regards -- Hongyi Zhao <hongyi.zhao(a)gmail.com> Xinjiang Technical Institute of Physics and Chemistry Chinese Academy of Sciences GnuPG DSA: 0xD108493

2 1

Re: [stunnel-users] Fwd: Stunnel log file format
by Ludolf Holzheid 12 Jan '16

12 Jan '16

On Tue, 2016-01-12 11:23:43 -0430, Jesús Alfredo Cambera wrote: > Hello Ludof, > > Thanks for answering so fast. I think this information would be really > useful for other users. I'd would be great if it could be included the the > manual page (https://www.stunnel.org/static/stunnel.html). > > I had just completed the logstash filters but still I have one last > question: What do the log levels correspond to: error, warning, info? Hi Alfredo, always answer to the list, so others may read along and/or chime in. >From the stunnel man page: >> >> Level is a one of the syslog level names or numbers emerg (0), alert (1), crit (2), >> err (3), warning (4), notice (5), info (6), or debug (7). All logs for the specified >> level and all levels numerically less than it will be shown. Use debug = debug or >> debug = 7 for greatest debugging output. The default is notice (5). This seems to perfectly match the 'conventional meaning of the log level' used for most POSIX system log daemons (e.g. the linux syslogd). I don't know how significant the level /names/ actually are - Maybe all you can read from this is that level 0 gives the fewest and level 7 gives the most messages. Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:[email protected] http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

2 1

Fwd: Stunnel log file format
by Jesús Alfredo Cambera 12 Jan '16

12 Jan '16

Hi everybody, I'm pretty new on stunnel and I'm still learning a lot through the documentation. One of the tasks that i need to accomplish is to consolidate all the log information using logstash and ELK. So far I had managed to figure out most of the log file format. Here is an example of my log file 2013.01.11 11:26:35 LOG5[13520:140223486400256]: stunnel3 accepted connection from 127.0.0.1:45939 2013.01.11 11:26:35 LOG6[13520:140223486400256]: connect_blocking: connecting 123.4.5.6:9130 2013.01.11 11:26:35 LOG5[13520:140223486498560]: connect_blocking: connected 7.8.9.10:9130 The first two fields are date and hour but I don't understand what do the next field means (LOG5, LOG6). Next is the pid, but I don't know anything about the next field. The last one is the error explanation. Is there documentation about log file format? I'd really appreciate your help. Greetings from Venezuela, Alfredo

2 1

Re: [stunnel-users] Help: sTunnel http to Apache https?
by Hathor27 11 Jan '16

11 Jan '16

Please everybody out there, can anybody tell me, if I can wrap a http-proxy request into http over ssl (https, with sTunnel) and receive it by an Apache https server (without sTunnel server)? Best regards Hathor27

1 0

stunnel 5.29 released
by Michal Trojnara 08 Jan '16

08 Jan '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear Users, I have released version 5.29 of stunnel. The ChangeLog entry: Version 5.29, 2016.01.08, urgency: LOW * New features - New WIN32 icons. - Performance improvement: rwlocks used for locking with pthreads. * Bugfixes - Compilation fix for *BSD. - Fixed configuration file reload for relative stunnel.conf path on Unix. - Fixed ignoring CRLfile unless CAfile was also specified (thx to Strukov Petr). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 43909625403ea634fa7cb8399d58faf8e7f11c1b7b29097491469951f56df551 stunnel-5.29.tar.gz c92ccc98cc9eb0c5d95d9550af39ab502e7ea45ed4d9ccc821aa261856f958b1 stunnel-5.29-installer.exe f9db8676e8e2ec6db355bae41eb625eb8ebd45a836ad8cbf06ce60a3c305fde2 stunnel-5.29-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWj/AqAAoJEC78f/DUFuAUZagQAMbBLW8VSgB8x8WGK1ZueSun HJAqXQgCYFY3+Vdz/41gdGy4T8kMB0MHarCwUbI4Wuk/JEvJLIs7OtFzycm1pTBU vXOgk962OkKs/RGD6tygnzIMmYU+BjxPLcfuj0JZR8Z3/Skt2ssFh4RrgCwoFM7/ VxseTRf487dBTU8n2EduWS1naNSIZCN6MlM0Ql1NNenZIGUSYlOfpxXSYo2ZTbe9 At+oVJ5J23eZrv5Vd48cZY7ArfXqCFDkUsCVyBOjUoSSJQ3qZ7srr7tWj4AVY6Pp Nk4Q1w1o7vWpEMDovjEmiLJMUGY2AUiQMpKoZDyfTnDRdtEfEDb7+P9sa++sruSY uauMZ4IL2zjUhWh2RJVnYHgCYCvjAWVw3GeUoM092svR0NXqf0fnBqAGgXNA/uHg zXy2Ljp8yLSK73oR3z7BaSmM3+q1NS2fZBEfWOVpZoOdG+hoyCZvsvuvDpNXh+y8 7WBPiGMl+Umti8HxKDsF/HEiLoSRrBZFZ1t2jwmLM+kZAsA06j3s5ExttK+FNsSC s/yoISPBGIRJyM/xOwYugyO2mDI8xLm3w7YbJADlJ0R2UiaRFVRqJErITv1/i18c Xek1mhk6HgyhQSCns4gxjM/Xc3VuOGJCP6umwUuiXQvyHvP+oypAyYlgshxNmKD1 Ccn+1DCtt3jw83qNLrZE =yIQ7 -----END PGP SIGNATURE-----

1 0

Re: [stunnel-users] Help: sTunnel http to Apache https?
by Hathor27 05 Jan '16

05 Jan '16

Thank you for your fast response, Jhon. My target https-server is a Synology DS211+ with Apache 2.2(Unix). Its VirtualHost config looks like: <VirtualHost *:443> ServerName myhost.mydomain.com ServerAlias internal.name.local DocumentRoot /somepath/not/used/at/all/ SSLEngine On SSLProtocol all -SSLv2 -SSLv3 # TLSv1 or higher SSLProxyEngine On ProxyRequests On ProxyBadHeader Ignore ProxyVia Full AllowCONNECT myInternalPort <Proxy *> Order deny,allow Deny from all </Proxy> <ProxyMatch (internal\.name\.local)> Order allow,deny Allow from all </ProxyMatch> LogLevel debug ErrorLog /logpath/sshserver-proxy_error_log CustomLog /logpath/sshserver-proxy_request_log combined </VirtualHost> The sTunnel client config on Win7 is: debug = 7 log = overwrite output = C:\userpath\stunnel\stunnel.log socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 client = yes [http-2-ssl] accept = 127.0.0.1:80 connect = proxy.gateway:gwPort protocol = connect protocolHost = myhost.mydomain.com:443 retry = yes config = Protocol:ALL config = Protocol:-SSLv3 Finally still remains my initial question: Can I wrap my http-proxy request into http over ssl (https) and receive it on an Apache https server? If 'yes', how? Best regards Hathor27 Btw: Hopefully better posted

1 0

Upcoming stunnel 5.29 release
by Michal Trojnara 05 Jan '16

05 Jan '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi Guys, This Friday I intend to release stunnel 5.29. The planned list of changes: * New features - New WIN32 icons. - Performance improvement: rwlocks used for locking with pthreads. * Bugfixes - Compilation fix for *BSD. - Fixed configuration file reload for relative stunnel.conf path on Unix. - Fixed ignoring CRLfile unless CAfile was also specified (thx to Strukov Petr). Feel free to try stunnel 5.29b3, so I can fix any discovered issues before the final release: https://www.stunnel.org/downloads.html Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBCAAGBQJWit/iAAoJEC78f/DUFuAUtv8P/izyH0DIhUsDCWbYlyWRJDjr 2lwE1sYwmmMqtArM31N25QtRidEbZgTbuWQXaXY7/HALTnnI1VbDrbtAntVkovQr FDXGlVvkife2IuSDS92b8ezEuq5swCQoT6KoHJDj9yLBSTQdZNxGHv9GfbS90mmv fX3zcWmh+SklYnVgGrnc3GfgecaUS261KArdW1BTfA5ucydzse9z9X+2/iA7zl7i wwvSHkfH3+Q3VsmJaSmoHTiMqzRzvH0NpKnbm0J5OfOql/fT9Mfn57U5ZGnC5iWP bLlPmmP+fC7WLX8Cwl2DWESJ8kxPn2xEJbDGeCn9uzI0feKXMLwF/yrJopYVetIx fJDgts4iR8eFRcFcSIpBrnWxNoTi4RhCzuIj8U/zYOBsHJPs6gPcuDG9fYtPXhF8 D93e8HeOW7naNyi+mTDjBo8qdiGGh+/ITp1PkNonVgFCWkxLIpfS2k6iQ/DqNTXd szMU+uLeub5vt3ifRnSieTpIDTAsSbp0jarlXFRQNrUB0Cl8sgv/Ssl+ZYnDRyIa 2aTrK00eSc1nk+kZGJg5kTJM/t6PzfxtDUhVo5Pr6u9gwa94c34AHQ04W5dA7rTV 4pD4DxpFEk+2Syndjt6lncT/O2at3aYUkhyTZ/tN8/P22v1OWp+ci1WIpNXp/zVX z12IUAFfyQPIuvdwLzZr =CEXd -----END PGP SIGNATURE-----

2 4

Help: sTunnel http to Apache https?
by Hathor27 02 Jan '16

02 Jan '16

Dear List Members, I searched, tried and recovered for several days and found no solution that works. My topic is to establish an ssh remote session through a http-proxy (http connect). In case of port restrictions I can only use pure https (443). So I try to wrap my http-proxy request into http over ssl (https) and receive it on an Apache https server. I can establish a connection between sTunnel Client (Win7 Prof) and sTunnel Server (Synology, Linux), both on 443 - that works fine. But if I try to connect from sTunnel Client (443) to Apache Server https, they seem to speek not the same protocol. .are there any examples for that? - or are sTunnel and Apache two different things of SSL? I would be very glad to get some help here :) Best Regards Hathor27

1 0

Do Not Make Stunnel on El Capitan
by WATANABE Takeo 02 Jan '16

02 Jan '16

Dear all. Hi. My name is WATANABE, Takeo in Japan. There is a thing that is very troubled, it will post to this ML. It is in OS X El Capitan(10.11.x), it is stunnel of make it is that does not pass. The rootkill mechanism I think is causing, but tried again to disable this, even doing several times, not as make is. Even latest Stunnel, make will fail. Where everyone is, what you can well Build. If you have person there know what measures and successes such as a, please tell me. Warm Regards. Sincerely yours.

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users