- stunnel-users - stunnel.org

transfer: s_poll_wait: TIMEOUTclose exceeded: closing
by Michael Calder 29 Dec '15

29 Dec '15

Hi, I'm new to stunnel and I'm trying to troubleshoot why it currently isn't working. When I first set it up and tested it everything worked fine. I rebuilt everything to do it all again and now it's not working. I'm pretty sure I set everything up the same way. I'm trying to get it to work with AWS SES. Here is my stunnel config: ; Sample stunnel configuration file for Win32 by Michal Trojnara 2002-2015 ; Some options used here may be inadequate for your particular configuration ; This sample file does *not* represent stunnel.conf defaults ; Please consult the manual for detailed description of available options ; ************************************************************************** ; * Global options * ; ************************************************************************** ; Debugging stuff (may be useful for troubleshooting) debug = debug ;output = stunnel.log ; Enable FIPS 140-2 mode if needed for compliance ;fips = yes ; Microsoft CryptoAPI engine allows for authentication with private keys ; stored in the Windows certificate store ; Each section using this feature also needs the "engineId = capi" option ;engine = capi ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Enable support for the insecure SSLv3 protocol ;options = -NO_SSLv3 ; These options provide additional security at some performance degradation ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; ************************************************************************** ; * Include all configuration file fragments from the specified folder * ; ************************************************************************** ;include = conf.d ; ************************************************************************** ; * Service definitions (at least one service has to be defined) * ; ************************************************************************** ; ***************************************** Example TLS client mode services [gmail-pop3] client = yes accept = 127.0.0.1:110 connect = pop.gmail.com:995 verify = 2 CAfile = ca-certs.pem checkHost = pop.gmail.com OCSPaia = yes [gmail-imap] client = yes accept = 127.0.0.1:143 connect = imap.gmail.com:993 verify = 2 CAfile = ca-certs.pem checkHost = imap.gmail.com OCSPaia = yes [gmail-smtp] client = yes accept = 127.0.0.1:25 connect = smtp.gmail.com:465 verify = 2 CAfile = ca-certs.pem checkHost = smtp.gmail.com OCSPaia = yes ; Encrypted HTTP proxy authenticated with a client certificate ; located in the Windows certificate store ;[example-proxy] ;client = yes ;accept = 127.0.0.1:8080 ;connect = example.com:8443 ;engineId = capi ; ***************************************** Example TLS server mode services ;[pop3s] ;accept = 995 ;connect = 110 ;cert = stunnel.pem ;[imaps] ;accept = 993 ;connect = 143 ;cert = stunnel.pem ;[ssmtp] ;accept = 465 ;connect = 25 ;cert = stunnel.pem ; TLS front-end to a web server ;[https] ;accept = 443 ;connect = 80 ;cert = stunnel.pem ; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SChannel ; Microsoft implementations do not use TLS close-notify alert and thus they ; are vulnerable to truncation attacks ;TIMEOUTclose = 0 ; Remote cmd.exe protected with PSK-authenticated TLS ; Create "secrets.txt" containing IDENTITY:KEY pairs ;[cmd] ;accept = 1337 ;exec = c:\windows\system32\cmd.exe ;execArgs = cmd.exe ;ciphers = PSK ;PSKsecrets = secrets.txt ; vim:ft=dosini [smtp-tls-wrapper] accept = 2525 client = yes connect = email-smtp.us-east-1.amazonaws.com:2465 delay = yes Here is the debug from the log file: 2015.12.29 17:42:38 LOG7[main]: No limit detected for the number of clients 2015.12.29 17:42:38 LOG5[main]: stunnel 5.28 on x86-pc-msvc-1500 platform 2015.12.29 17:42:38 LOG5[main]: Compiled/running with OpenSSL 1.0.2e-fips 3 Dec 2015 2015.12.29 17:42:38 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2015.12.29 17:42:38 LOG7[main]: errno: (*_errno()) 2015.12.29 17:42:38 LOG5[main]: Reading configuration from file stunnel.conf 2015.12.29 17:42:38 LOG5[main]: UTF-8 byte order mark detected 2015.12.29 17:42:38 LOG5[main]: FIPS mode disabled 2015.12.29 17:42:38 LOG7[main]: Compression disabled 2015.12.29 17:42:38 LOG7[main]: Snagged 64 random bytes from C:/.rnd 2015.12.29 17:42:38 LOG7[main]: Wrote 1024 new random bytes to C:/.rnd 2015.12.29 17:42:38 LOG7[main]: PRNG seeded successfully 2015.12.29 17:42:38 LOG6[main]: Initializing service [gmail-pop3] 2015.12.29 17:42:38 LOG7[ui]: GUI message loop initialized 2015.12.29 17:42:38 LOG7[cron]: Cron thread initialized 2015.12.29 17:42:38 LOG7[main]: No certificate or private key specified 2015.12.29 17:42:38 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2015.12.29 17:42:38 LOG6[main]: Initializing service [gmail-imap] 2015.12.29 17:42:38 LOG7[main]: No certificate or private key specified 2015.12.29 17:42:38 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2015.12.29 17:42:38 LOG6[main]: Initializing service [gmail-smtp] 2015.12.29 17:42:38 LOG7[main]: No certificate or private key specified 2015.12.29 17:42:38 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2015.12.29 17:42:38 LOG6[main]: Initializing service [smtp-tls-wrapper] 2015.12.29 17:42:38 LOG7[main]: No certificate or private key specified 2015.12.29 17:42:38 LOG4[main]: Service [smtp-tls-wrapper] needs authentication to prevent MITM attacks 2015.12.29 17:42:38 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2015.12.29 17:42:38 LOG5[main]: Configuration successful 2015.12.29 17:42:38 LOG7[main]: Listening file descriptor created (FD=372) 2015.12.29 17:42:38 LOG7[main]: Service [gmail-pop3] (FD=372) bound to 127.0.0.1:110 2015.12.29 17:42:38 LOG7[main]: Listening file descriptor created (FD=376) 2015.12.29 17:42:38 LOG7[main]: Service [gmail-imap] (FD=376) bound to 127.0.0.1:143 2015.12.29 17:42:38 LOG7[main]: Listening file descriptor created (FD=380) 2015.12.29 17:42:38 LOG7[main]: Service [gmail-smtp] (FD=380) bound to 127.0.0.1:25 2015.12.29 17:42:38 LOG7[main]: Listening file descriptor created (FD=384) 2015.12.29 17:42:38 LOG7[main]: Service [smtp-tls-wrapper] (FD=384) bound to 0.0.0.0:2525 2015.12.29 17:43:25 LOG7[main]: Found 1 ready file descriptor(s) 2015.12.29 17:43:25 LOG7[main]: FD=332 ifds=r-x ofds=--- 2015.12.29 17:43:25 LOG7[main]: FD=372 ifds=r-x ofds=--- 2015.12.29 17:43:25 LOG7[main]: FD=376 ifds=r-x ofds=--- 2015.12.29 17:43:25 LOG7[main]: FD=380 ifds=r-x ofds=--- 2015.12.29 17:43:25 LOG7[main]: Service [smtp-tls-wrapper] accepted (FD=444) from 127.0.0.1:49510 2015.12.29 17:43:25 LOG7[main]: Creating a new thread 2015.12.29 17:43:25 LOG7[main]: New thread created 2015.12.29 17:43:25 LOG7[0]: Service [smtp-tls-wrapper] started 2015.12.29 17:43:25 LOG5[0]: Service [smtp-tls-wrapper] accepted connection from 127.0.0.1:49510 2015.12.29 17:43:25 LOG6[0]: failover: round-robin, starting at entry #0 2015.12.29 17:43:25 LOG6[0]: s_connect: connecting 54.243.71.143:2465 2015.12.29 17:43:25 LOG7[0]: s_connect: s_poll_wait 54.243.71.143:2465: waiting 10 seconds 2015.12.29 17:43:25 LOG5[0]: s_connect: connected 54.243.71.143:2465 2015.12.29 17:43:25 LOG5[0]: Service [smtp-tls-wrapper] connected remote server from 172.31.49.212:49511 2015.12.29 17:43:25 LOG7[0]: Remote descriptor (FD=468) initialized 2015.12.29 17:43:25 LOG6[0]: SNI: sending servername: email-smtp.us-east-1.amazonaws.com 2015.12.29 17:43:25 LOG7[0]: SSL state (connect): before/connect initialization 2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv2/v3 write client hello A 2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 read server hello A 2015.12.29 17:43:25 LOG6[0]: Certificate verification disabled 2015.12.29 17:43:25 LOG6[0]: Certificate verification disabled 2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 read server certificate A 2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 read server key exchange A 2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 read server done A 2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 write client key exchange A 2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 write change cipher spec A 2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 write finished A 2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 flush data 2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 read server session ticket A 2015.12.29 17:43:25 LOG7[0]: SSL state (connect): SSLv3 read finished A 2015.12.29 17:43:25 LOG7[0]: 1 client connect(s) requested 2015.12.29 17:43:25 LOG7[0]: 1 client connect(s) succeeded 2015.12.29 17:43:25 LOG7[0]: 0 client renegotiation(s) requested 2015.12.29 17:43:25 LOG7[0]: 0 session reuse(s) 2015.12.29 17:43:25 LOG6[0]: SSL connected: new session negotiated 2015.12.29 17:43:25 LOG7[0]: Peer certificate was cached (3667 bytes) 2015.12.29 17:43:25 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES128-GCM-SHA256 (128-bit encryption) 2015.12.29 17:43:25 LOG7[0]: Compression: null, expansion: null 2015.12.29 17:43:36 LOG7[0]: SSL alert (read): warning: close notify 2015.12.29 17:43:36 LOG6[0]: SSL closed (SSL_read) 2015.12.29 17:43:36 LOG7[0]: Sent socket write shutdown 2015.12.29 17:43:38 LOG6[cron]: Executing cron jobs 2015.12.29 17:43:38 LOG6[cron]: Cron jobs completed in 0 seconds 2015.12.29 17:43:38 LOG7[cron]: Waiting 86400 seconds 2015.12.29 17:44:36 LOG3[0]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing 2015.12.29 17:44:36 LOG5[0]: Connection closed: 995 byte(s) sent to SSL, 397 byte(s) sent to socket 2015.12.29 17:44:36 LOG7[0]: Remote descriptor (FD=468) closed 2015.12.29 17:44:36 LOG7[0]: Local descriptor (FD=444) closed 2015.12.29 17:44:36 LOG7[0]: Service [smtp-tls-wrapper] finished (0 left) I've searched the web for that TIMEOUTclose message and haven't come up with a solution. I've also attached a packet capture. Any suggestions would be helpful. Thanks! Mike

1 0

stunnel 5.28 released
by Michal Trojnara 14 Dec '15

14 Dec '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear Users, I have released version 5.28 of stunnel. This is a bugfix release. I highly recommend upgrading your stunnel. The ChangeLog entry: Version 5.28, 2015.12.11, urgency: HIGH * New features - Build matrix (.travis.yml) extended with ./configure options. - mingw.mak updated to build tstunnel.exe (thx to Jose Alf.). * Bugfixes - Fixed incomplete initialization. - Fixed UCONTEXT threading on OSX. - Fixed exit codes for information requests (as in "stunnel -version" or "stunnel -help"). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 9a25b87b1ef0c08fa3d796edce07b4408e6a8acece23de2eb7ee9285b78852b5 stunnel-5.28.tar.gz 020b5bd8a97a1da91e9b379c0d2fa8a14606402e2b0c1eb9191fe99c7f4665f9 stunnel-5.28-installer.exe 0af65879343b37bcda89dbbde51f6cfde016a044a533f7bdec229f4e1ec25eb9 stunnel-5.28-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWarN7AAoJEC78f/DUFuAUKhcQAJ62DQW+GMpAmtggO42LhaEj NcAdpgYvCAJnemRnTj+YMHHAGGIn7MY7VQZVzIIHL0y4CS6yy8kg1WVQeDgxS7PM zil/CViLayNQUnEaUSpoD3yFlb5i6wqofPa5/ohObAvUwTejN/XtOlyT6OMTEovF ZWWLsqYnVTCkbrY1Usu9DNRlSWaCgGeqL5ZqhbiJHk7hDHIH5Yy8KXKw3dVuOxBZ 86uYNH0WW3qNHKJrI1z70cA+18c6Kab5/4NnzzmWG+TyYCVVLL8JVkahEHhCX5mc yBYcMyBrSkrUoS++IdEZtOKYjwxfiEFdre0junC1m5DqtbOc+vWcvqZRGUfCszHK bg4LlCoNs6VhaAFzY9dyXKWqFP+HvH1cqcVcagCaofcdAEaFrwP4dqwUUBKCT44z JNhEzyrI6+coGq92SZUeSiko2bj+rQWDf3s5pY+zWQVvUe12rTo427Mhbge3sBhQ QykwMsihtrP9s25YkDQHqlpBV85W3axq/O2veb15QlbETDM6eGfnMCFjqhxpBBMO sSgHOr9E1E4pxN4kcokPhwKizxSe0EHVQYM27qGfNXJkzVAvHE+mz0WR2kMPpjT5 N6th9lOMgrjXGo6aTBQO3DIEkw+BB0C9OVWnNXMWqmUnsKp80QVeZKZXgK5c2t1y Y8e0W7HH2xdaQemUQp+n =GrPO -----END PGP SIGNATURE-----

3 3

Upcoming stunnel 5.28 release
by Michal Trojnara 11 Dec '15

11 Dec '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi Guys, I have found a serious bug in stunnel 5.27. The bug results in incomplete (partial) service initialization. The bugfix 5.28 release is scheduled for tomorrow. Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBCAAGBQJWac5NAAoJEC78f/DUFuAUcRUP/A1dOJW8Sag4YRfxnOZfW6bt SouaKMkFQDkQkLrZzQkUhkOFL35DNmesvA+HgCSp+StO/TagcLA34ZrpR355qcZ7 QjEXYftagy85c7DjDek4CU9vfb9u3J3kTcvhtpy6l5CPYV0TWCjApk438xk+saOn xItijYRVcpHbSUof0/E99Gb9mZ3qiI4AVkdSHT4qw3GV8GCdo9R66cHBNDKsYQy1 XWe7VJCEmXw9n0bmj2Soi1TWlU39Q2GcostWK2GuH9fzFyGqnde7RbMHeJ9KYvY/ oSnMjCRblJtoRn4Ucw/1FuOdEZSalpRuPSarmhKCkgc+tKgkK6mvhSbILUbwOMLL hO2nWbMrOhLOlu4UnM32A1djWQCiVRxTO87IAkd5jTTz8sNLCoJHqzcirug68Kjy ljuNf/A/LhkimkfCvZtY5ErMP6TzJ37iaXhaGRLZLoZtK75yKggXnJcJUAEI8ggI RR/mArBHyHG3IwcfdMt4a+AJvsHOJAApCB+0uCGwJnfnuqHJ41Z6WEHuwpBitN/0 4nTGLoOBOyUX/cnrpsx9FLxRdCKAVbGoebXBM5sA9qhCDskp7MMDUFU1pVER5QbZ VKzCpIdeyGKKvCOA5WiNOt3bBBmOGJKB4CXYyMEyDAbr8SL2FTNo5nJ2iUO/2iaU 6a5MITgIc1C6GacMauvo =rb0T -----END PGP SIGNATURE-----

3 3

Re: [stunnel-users] How do I use the Stunnel download on android?
by Research | FrenchFlorida 09 Dec '15

09 Dec '15

Thanks for the reply. I'm not sure what " statically linked ELF executable for Android/ARM" means yet, but I will look it up. ;) Since I sent the message I did a lot of digging that yielded me very little details. In fact I only came a cross a few mentions that stunnel could be used on android but no examples of how that was implemented. After a vague hint I managed to deduced how the file worked, but it took me a little more independent research to understand how to make it, at least execute. I'm not new to linux but am new to android so not as familiar to how the system works in general. I did see that an android app was on your todo list. In the meanwhile however, may I suggest a little howto for Android that could get a user started in using the app. Stunnel is an amazing application and since I was able to figure it out I made myself a guide on how to set it up (Minus actually creating the configuration) so that I can at least know how to execute stunnel. Since I already did the research I offer you my very unorganized primer on how to set it up below. Perhaps it would be useful for some to have a better version of this doc on the site, and if not, well at least a well determined person can find this topic in the mailing list, because there will be only one other topic with the word "Android" in the title so it can perhaps get a user out of jam more quickly without. Here is my guide: ----------------------------- Chances are that "It is a statically linked ELF executable for Android/ARM." Means that within the stunnel-android.zip resides one file, and that file is the executable file for stunnel. It is in fact the defacto program that under linux you would see in /etc/local/bin/stunnel if that was where you installed it. This means that the requirements to use this file are as such: 1. Your phone probably needs to be rooted 2. You will need access to a terminal on your phone (Terminal Emulator) 3. There is no "APP" to run stunnel it is a command line file There are probably two reasons you would want to use stunnel on your phone. 1. You are an app developer that wants to use stunnel to connect one part of your app to something else, and therefore will incorporate this script within your app. I don't know how to make apps yet so that's probably as useful as I can make the description for you. 2. You are a user that has already used stunnel on your machine and wants to use it on your phone too. [The rest of the guide assumes this is the case.] Assuming the latter, what do you need to do to get it running? 1. Move the stunnel application to your phone. 2. As you would do in linux open the terminal 3. Run stunnel like a command If you get an error message saying it is not executable, or that permission is denied it is because of one of two things. Maybe you need to mark the file as executable Chmod +x ./stunnel Terminal Emulator's chmod does not understand "+x" so you will have to change the permission to Chmod 700 ./stunnel 700 means Read-Write-Execute for the user. If it doesn't work try 770 and 777 However you are likely to still receive that error on some phones. (I'm guessing, just because it happened to my phone I am not assuming it will happen to all phones.) Some phones forbid there to be an executable script within the /sdcard/ directory. Therefore you have to move it somewhere else. I don’t know where the proper place for such a file is, I moved mine to /system/bin/ therefore the script is callable by /system/bin/stunnel Another Caveat!! My phone's /system folder is not writable!! Therefore before you can even move the file you need to make the system folder writable: mount -o rw,remount /system Once moved needs to be made readonly again: mount -o ro,remount /system So In summary, here is a step-by-step of what might work in getting the script to an executable state on Android: 1. Root phone 2. install terminal emulator 3. get stunnel script onto your phone somehow 4. mount -o rw,remount /system 5. cp /sdcard/Download/stunnel /system/bin/stunnel 6. chown 700 /system/bin/stunnel 7. mount -o ro,remount /system 8. /system/bin/stunnel /path/to/conf/file* Now as if you are on linux you should probably** be able to run stunnel. *I haven't tested it out with conf files yet. ** I'm able to run stunnel --version so stunnel in and of itself is "working" ----------------------------- If this guide is any good to you guys, please feel free to use, I would love to contribute in some way. :) Thanks! -Cotex -----Original Message----- From: stunnel-users [mailto:[email protected]] On Behalf Of stunnel-users-request(a)stunnel.org Sent: Tuesday, December 08, 2015 7:00 PM To: stunnel-users(a)stunnel.org Subject: stunnel-users Digest, Vol 137, Issue 10 Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. Re: How do I use the Stunnel download on android? (Michal Trojnara) ---------------------------------------------------------------------- Message: 1 Date: Mon, 7 Dec 2015 16:14:05 +0100 From: Michal Trojnara <Michal.Trojnara(a)mirt.net> To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] How do I use the Stunnel download on android? Message-ID: <5665A23D.8050408(a)mirt.net> Content-Type: text/plain; charset=utf-8 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi cotex, It is a statically linked ELF executable for Android/ARM. It is only useful for people who customize their Android, and not for end-users. A proper Android GUI is on my TODO list: https://www.stunnel.org/sdf_todo.html Best regards, Mike On 04.12.2015 11:02, Research | FrenchFlorida wrote: > In the download section of the site, there is a zip for android. > > Inside this file is a single file, without any extention. > > How do I install this, I have found no documentation anywhere on the > web. > > > > Can anybody guide me, or give me a hint. Is this something I do on the > phone, or that I do from the computer first? > > > > -cotex > > > > _______________________________________________ stunnel-users mailing > list stunnel-users(a)stunnel.org > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBCAAGBQJWZaI9AAoJEC78f/DUFuAUJiAQAKYo2XM39WbeebhZlYa4pER2 hYfCkybWypYlOdiqRo5UGthG4SD/G74MXMJNR5ggKiApW6YBe4/Q983hKMWRSbp6 X803HQPyN8BxwnkZM9tzAcCh57SQXH/Y+VjTD9necLK9bOMMZlZsWg5u3TSp9qP1 jpV7+5NkMlID0KaKzpjaw+ruIY1zwmBUDrs0xT713TEZnVvaqhFDv2vYB8szG0p0 fe5Ppm/ZU/7vWMbFO8eWsWj6TpeoVpq2EI/4iK7VbnCVnSEosJi/C4C5nZ3GrcTv xRk0xDK9I733FfBTmHU5Dkzx6fcDqFekWyea+qYT+JhOmtRqdnyrQM0OCRv3z/b/ fOv36zkuru6DhoO1El2QwQOZlTqFnWYfgvfYDWI1zeIMCSz/qqpn5ojQXk7i87zH cMVG9whVZGWf0DXjwRo9/cHkmjdX46UA5FZwhxADY6Atu9OtdEabTcbNj6BPPh8Q xX7GNEgRFnbZsz50wqZbZJZfE4ticWFkLH37eT7z3WeEU8+HdFk1w24JNGFaZt3H GcJ6TN6/fMTkQP2ch0l0X2vXhWLkBh5puYOVBnsnKKUl8UUzeGa1T3OJAnKJF07Q 0mtP6lyPtuEGy9vUiP+2h0yIICJD1IGhEdkEm3xWJcagp3XJ+0PFN5Mo2juDfg4S FHvDTHxF4/y4PQodabav =+omM -----END PGP SIGNATURE----- ------------------------------ Subject: Digest Footer _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users ------------------------------ End of stunnel-users Digest, Vol 137, Issue 10 **********************************************

1 0

SSL compression in 5.27
by Udo Erdelhoff 08 Dec '15

08 Dec '15

Hi, while testing the upgrade from stunnel 5.26 to stunnel 5.27 on Solaris, one of the tools I use reported that SSL compression was now supported/possible on connections to an stunnel 5.27 instance; this was not the case with 5.26 or earlier. Unfortunately, it is not possible to demonstrate this using openssl as client, I found this using TestSSLServer, which is java-based and available from http://www.bolet.org/TestSSLServer/. With 5.26: | $ java -jar TestSSLServer.jar $server 443 | Supported versions: TLSv1.2 | Deflate compression: no | Supported cipher suites (ORDER IS NOT SIGNIFICANT): | TLSv1.2 | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 | ---------------------- | Server certificate(s): | 4c57045b3f8f9cdd6f487e59a5b008ccb9d38693: CN=***, OU=***, O=***, C=*** | ---------------------- | Minimal encryption strength: strong encryption (96-bit or more) | Achievable encryption strength: strong encryption (96-bit or more) | BEAST status: protected | CRIME status: protected Note: "Deflate compression: no", "CRIME status: protected" With 5.27: | $ java -jar /prod/certmon2/bin/TestSSLServer.jar $server 443 | Supported versions: TLSv1.2 | Deflate compression: YES | Supported cipher suites (ORDER IS NOT SIGNIFICANT): | TLSv1.2 | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 | ---------------------- | Server certificate(s): | 4c57045b3f8f9cdd6f487e59a5b008ccb9d38693: CN=***, OU=***, O=***, C=*** | ---------------------- | Minimal encryption strength: strong encryption (96-bit or more) | Achievable encryption strength: strong encryption (96-bit or more) | BEAST status: protected | CRIME status: vulnerable With 5.27, I get "Deflate compression: YES" and "CRIME status: vulnerable". Server OS: Solaris 10/SPARC or Solaris 11/SPARC (others not tested) OpenSSL: 1.0.1p or 1.0.1q (others not tested) Client: TestSSLServer Both stunnel and OpenSSL are self-compiled using Solaris Studio 12.4. The stunnel.conf in question: sslVersion = TLSv1.2 ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256 cert = test1.crt key = test1.key verify = 2 [test] client = no accept = A.B.C.D:443 connect = 127.0.0.1:8080 The scanner from SSL Labs should be able to check this as well, but I do not have the neccessary modern Python available. I will check if I can reproduce the problem on something a little more mainstream than Solaris 10/11 over the weekend. --

2 1

How do I use the Stunnel download on android?
by Research | FrenchFlorida 07 Dec '15

07 Dec '15

In the download section of the site, there is a zip for android. Inside this file is a single file, without any extention. How do I install this, I have found no documentation anywhere on the web. Can anybody guide me, or give me a hint. Is this something I do on the phone, or that I do from the computer first? -cotex

2 1

stunnel for syslogd of busybox
by Girish Kumar 06 Dec '15

06 Dec '15

Hi All, Stunnel expects TCP-based syslog. Please let me know whether syslogd of busybox supports TCP communication. The busybox version is 1.24.1 If it doesn't support , can it be enhanced to support TCP communication Regards, Girish

1 1

stunnel 5.27 released
by Michal Trojnara 03 Dec '15

03 Dec '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear Users, I have released version 5.27 of stunnel. The ChangeLog entry: Version 5.27, 2015.12.03, urgency: MEDIUM * Security bugfixes - OpenSSL DLLs updated to version 1.0.2e. https://www.openssl.org/news/secadv_20151203.txt * New features - Automated build testing configured with .travis.yml. - Added reading server certificates from hardware engines. For example: cert = id_45 - Only attempt to use potentially harmful compiler or linker options if gcc was detected. - /opt/csw added to the OpenSSL directory lookup list. - mingw.mak updates (thx to Jose Alf.). - TODO list updated. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 7474e986710e88a5cc3330b6b1762f9449f01eccf826fa0f97e56d064c05ead3 stunnel-5.27.tar.gz 04b11dea9a29e7a16d46b2c4e6c66a5ca6f588abb29a827dcca2c6f6456eb4c6 stunnel-5.27-installer.exe 76e4297212eaa99a674191f3e955ec3959abcdd0c081d2df0ce8786a577a6883 stunnel-5.27-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWYG/VAAoJEC78f/DUFuAUKloP/jRcbtEuSpiLbFTg2hQqJcZf T6C6x+pCRDqefPZMQNgN5HIU9TBUAm1dGNH3KxRqrfCTlYKnhqafDoj66fsQe6sm vUDOxxxwCcKBZaiO4II5cLxd05d9GX9FnI86GBfiztSX0nr2wMLu1EdKHdTO2R5s VXsjRl1ey2X0ukhzQ+gsD2bOf2tz0gkCjrcoAZZyGqBE+Zy3hMGSlK8mXeTfU8Of ygUT+nEcUmQb+zbEBrJCp+Q2TP0dMzXSgpKz67toH1wJJ85iTpxqPa6L6LcKwHXd kA2c75Y7HXmc4C+eKpXessifbHTHdJXbsF4ZOc06IxIg2+v47Fqqz13sL2rMKdYQ aldOP7NiOyCxywjQ3bZElvF8f8Q1RJz/+qMKG0QEWwe1cRHmDOweZ2BrqsBsZNbE Pxx2lavAqRruREL9PnL12mH/u9e0SBIaXsgmN1xo9IvaVy98K9+VL23m2GpXeVMp cPGOtfwX2M0NWRIU6keQ8FOqszuP0A7CSFTKwmM2/ZGNjPOk00/NCJk9qchyqZcr 8RDnkMOknvqEp5Uf0PWpBafK0yUps7aPwyTQX9SQ8uvz3ra/30ghkpEyAeIeEP3p Y5DqlSXupIbPAmUw3fNblU7E7SgflPP4LXF8oznLUkWFmPpR/wPUiHC1EnEOGtEQ GHF3H9CS1fr51rPm0UaK =hfT6 -----END PGP SIGNATURE-----

1 0

Client Authentication and CRL Verification
by Mehdi B. 02 Dec '15

02 Dec '15

Hello everybody I am using stunnel in server mode with mutual authentication. Auth is ok, but the crl didn't work, and I need it in production next week.... I do many tries with CRLpath/CRLfile, with my production version (5.08), the last one (5.26) Same result. With a revoked certificate, my client connect on the server. Do you have some idea? Or maybe found my mistake? If you need something else please contact me. Stunnel 1 is the server. Stunnel 1 certificate is revoked ** Configuration ** *** root@auditd:/var/lib/stunnel/2/ca# cat /etc/stunnel/1.conf *** ; * Global options * chroot = /var/lib/stunnel/1/ ; Chroot jail can be escaped if setuid option is not used setuid = stunnel5 setgid = stunnel5 pid = /pid/1.pid ;debug = 0 debug = 7 output = /log/1.log ;foreground = yes options = NO_SSLv2 options = NO_SSLv3 options = DONT_INSERT_EMPTY_FRAGMENTS [1] verify = 2 CAFile = /root/CA/CA.cert cert = /root/CA/1.cert key = /root/CA/1.key client = no accept = 127.0.0.1:59062 connect = 127.0.0.1:22 ciphers = ECDHE-RSA-AES256-GCM-SHA384 sslVersion = TLSv1.2 *** root@auditd:/var/lib/stunnel/2/ca# cat /etc/stunnel/2.conf *** ; * Global options * chroot = /var/lib/stunnel/2/ ; Chroot jail can be escaped if setuid option is not used setuid = stunnel5 setgid = stunnel5 pid = /pid/2.pid ;debug = 0 debug = 7 output = /log/2.log ;foreground = yes options = NO_SSLv2 options = NO_SSLv3 options = DONT_INSERT_EMPTY_FRAGMENTS [2] verify = 2 ;CRLfile = /var/lib/stunnel/2/CA.crl.pem ;CAFile = /var/lib/stunnel/2/CA.pem CRLpath = /crl/ CApath = /ca/ cert = /var/lib/stunnel/2/2.cert key = /var/lib/stunnel/2/2.key client = yes accept = 127.0.0.1:23 connect = 127.0.0.1:59062 ciphers = ECDHE-RSA-AES256-GCM-SHA384 sslVersion = TLSv1.2 ** Logs ** ==> /var/lib/stunnel/1/log/1.log <== 2015.12.02 12:11:46 LOG7[25595]: Clients allowed=500 2015.12.02 12:11:46 LOG5[25595]: stunnel 5.08 on x86_64-unknown-linux-gnu platform 2015.12.02 12:11:46 LOG5[25595]: Compiled/running with OpenSSL 1.0.1e 11 Feb 2013 2015.12.02 12:11:46 LOG5[25595]: Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Auth:LIBWRAP 2015.12.02 12:11:46 LOG7[25595]: errno: (*__errno_location ()) 2015.12.02 12:11:46 LOG5[25595]: Reading configuration from file /etc/stunnel/1.conf 2015.12.02 12:11:46 LOG5[25595]: UTF-8 byte order mark not detected 2015.12.02 12:11:46 LOG5[25595]: FIPS mode disabled 2015.12.02 12:11:46 LOG7[25595]: Compression disabled 2015.12.02 12:11:46 LOG7[25595]: Snagged 64 random bytes from /root/.rnd 2015.12.02 12:11:46 LOG7[25595]: Wrote 1024 new random bytes to /root/.rnd 2015.12.02 12:11:46 LOG7[25595]: PRNG seeded successfully 2015.12.02 12:11:46 LOG6[25595]: Initializing service [1] 2015.12.02 12:11:46 LOG6[25595]: Loading cert from file: /root/CA/1.cert 2015.12.02 12:11:46 LOG6[25595]: Loading key from file: /root/CA/1.key 2015.12.02 12:11:46 LOG7[25595]: Private key check succeeded 2015.12.02 12:11:46 LOG7[25595]: Loaded /root/CA/CA.cert revocation lookup file 2015.12.02 12:11:46 LOG7[25595]: Client CA list: /root/CA/CA.cert 2015.12.02 12:11:46 LOG6[25595]: Client CA: C=FR, ST=Some-State, O=Internet Widgits Pty Ltd 2015.12.02 12:11:46 LOG7[25595]: DH initialization 2015.12.02 12:11:46 LOG7[25595]: Could not load DH parameters from /root/CA/1.cert 2015.12.02 12:11:46 LOG7[25595]: Using hardcoded DH parameters 2015.12.02 12:11:46 LOG7[25595]: DH initialized with 2048-bit key 2015.12.02 12:11:46 LOG7[25595]: ECDH initialization 2015.12.02 12:11:46 LOG7[25595]: ECDH initialized with curve prime256v1 2015.12.02 12:11:46 LOG7[25595]: SSL options: 0x03000804 (+0x03000800, -0x00000000) 2015.12.02 12:11:46 LOG5[25595]: Configuration successful 2015.12.02 12:11:46 LOG7[25595]: Listening file descriptor created (FD=6) 2015.12.02 12:11:46 LOG7[25595]: Service [1] (FD=6) bound to 127.0.0.1:59062 2015.12.02 12:11:46 LOG7[25596]: Created pid file /pid/1.pid ==> /var/lib/stunnel/2/log/2.log <== 2015.12.02 12:11:46 LOG7[25604]: Clients allowed=500 2015.12.02 12:11:46 LOG5[25604]: stunnel 5.08 on x86_64-unknown-linux-gnu platform 2015.12.02 12:11:46 LOG5[25604]: Compiled/running with OpenSSL 1.0.1e 11 Feb 2013 2015.12.02 12:11:46 LOG5[25604]: Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Auth:LIBWRAP 2015.12.02 12:11:46 LOG7[25604]: errno: (*__errno_location ()) 2015.12.02 12:11:46 LOG5[25604]: Reading configuration from file /etc/stunnel/2.conf 2015.12.02 12:11:46 LOG5[25604]: UTF-8 byte order mark not detected 2015.12.02 12:11:46 LOG5[25604]: FIPS mode disabled 2015.12.02 12:11:46 LOG7[25604]: Compression disabled 2015.12.02 12:11:46 LOG7[25604]: Snagged 64 random bytes from /root/.rnd 2015.12.02 12:11:46 LOG7[25604]: Wrote 1024 new random bytes to /root/.rnd 2015.12.02 12:11:46 LOG7[25604]: PRNG seeded successfully 2015.12.02 12:11:46 LOG6[25604]: Initializing service [2] 2015.12.02 12:11:46 LOG6[25604]: Loading cert from file: /var/lib/stunnel/2/2.cert 2015.12.02 12:11:46 LOG6[25604]: Loading key from file: /var/lib/stunnel/2/2.key 2015.12.02 12:11:46 LOG7[25604]: Private key check succeeded 2015.12.02 12:11:46 LOG7[25604]: Verify directory set to /ca/ 2015.12.02 12:11:46 LOG7[25604]: Added /ca/ revocation lookup directory 2015.12.02 12:11:46 LOG7[25604]: Added /crl/ revocation lookup directory 2015.12.02 12:11:46 LOG7[25604]: SSL options: 0x03000804 (+0x03000800, -0x00000000) 2015.12.02 12:11:46 LOG5[25604]: Configuration successful 2015.12.02 12:11:46 LOG7[25604]: Listening file descriptor created (FD=6) 2015.12.02 12:11:46 LOG7[25604]: Service [2] (FD=6) bound to 127.0.0.1:23 2015.12.02 12:11:46 LOG7[25605]: Created pid file /pid/2.pid ** ls ** root@auditd:/var/lib/stunnel/2/ca# ll total 4 lrwxrwxrwx 1 root root 6 Dec 2 12:05 1a870aad.0 -> CA.pem lrwxrwxrwx 1 root root 6 Dec 2 12:05 aeb35906.0 -> CA.pem -rw-r----- 1 stunnel5 root 1919 Dec 1 16:55 CA.pem root@auditd:/var/lib/stunnel/2/ca# ll ../crl/ total 4 lrwxrwxrwx 1 root root 10 Dec 2 12:04 aeb35906.r0 -> CA.crl.pem -rw-r----- 1 stunnel5 root 1129 Dec 2 11:42 CA.crl.pem ** check openssl ** root@auditd:~/stunnel-5.26# openssl verify -crl_check -CAfile /var/lib/stunnel/2/ca/aeb35906.0 -CRLfile /var/lib/stunnel/2/crl/aeb35906.r0 /root/CA/1.cert /root/CA/1.cert: C = FR, ST = FR, O = PLOP, CN = 1 error 23 at 0 depth lookup:certificate revoked ** other :** root@auditd:~/CA# openssl crl -in /opt/syslog-ng/etc/crl/1a870aad.r0 -text Certificate Revocation List (CRL): Version 2 (0x1) Signature Algorithm: sha256WithRSAEncryption Issuer: /C=FR/ST=Some-State/O=Internet Widgits Pty Ltd Last Update: Dec 2 09:04:38 2015 GMT Next Update: Jan 1 09:04:38 2016 GMT CRL extensions: X509v3 CRL Number: 2 Revoked Certificates: Serial Number: 01 Revocation Date: Dec 1 14:46:38 2015 GMT Serial Number: 02 Revocation Date: Dec 2 09:04:29 2015 GMT Serial Number: 03 Revocation Date: Dec 2 07:25:34 2015 GMT Serial Number: 04 Revocation Date: Dec 2 07:27:45 2015 GMT Serial Number: 05 Revocation Date: Dec 2 07:32:21 2015 GMT Serial Number: 06 Revocation Date: Dec 2 08:21:48 2015 GMT Signature Algorithm: sha256WithRSAEncryption 16:24:d4:f8:77:82:7b:ca:70:1a:01:26:5f:83:9f:13:6f:51: 67:85:b0:2c:a7:25:c1:46:66:ca:b8:46:74:85:4a:ca:26:2b: ff:46:e7:91:a3:10:09:ce:6b:84:1d:58:a1:4a:1c:38:ac:1a: 58:fc:50:0a:7a:1e:1c:5c:f9:2b:ef:25:7a:93:27:b3:5e:65: d6:66:89:33:23:52:fd:0d:38:7e:66:d6:74:d7:e4:b2:72:d8: 74:49:73:d3:2a:b5:e0:23:8a:03:b5:c6:ce:2a:f4:03:ef:8c: 50:83:be:9f:68:04:47:79:ff:5d:4b:cb:8a:cd:3c:6a:5f:02: 33:e6:61:86:ff:4c:f3:74:2c:81:70:c1:13:05:43:54:1a:04: a0:7b:df:fe:f8:e5:50:53:ce:2c:04:86:36:ed:0a:98:24:72: 5e:68:1a:23:7f:8e:85:5c:2c:2b:7b:df:23:56:fe:2f:c7:da: ec:ca:8f:48:a0:29:15:72:38:e3:ff:48:1e:89:30:b1:72:1b: 21:3f:0b:e0:ad:eb:89:c3:65:70:cc:29:03:f0:6e:73:be:c8: 24:64:93:b8:7b:af:21:a0:67:24:5a:be:e8:b0:ec:e0:a1:5f: 0c:a9:e5:de:09:39:08:23:60:d9:d9:4e:07:a2:f2:1e:4f:96: 0c:b7:c6:bb:5b:2a:e3:78:92:2e:fa:39:9c:ae:d4:4c:b2:b2: e3:7f:2a:58:14:86:80:97:fd:5e:95:b1:9d:d6:23:3d:cc:ce: 2b:0b:65:b2:43:f5:15:fb:20:2c:72:8f:fd:62:7d:7f:54:80: 54:22:22:42:15:7b:27:18:2f:24:70:81:ca:44:cc:c4:d8:9c: d8:99:69:f2:fd:4a:7f:3e:11:57:91:25:d8:6f:42:ae:b0:d5: bc:fd:cd:0b:9b:a5:c2:f6:d0:ce:8b:e3:66:7b:78:03:90:a6: ca:44:f9:e1:cb:80:70:2e:db:b0:3c:d1:fc:5a:d8:f5:fd:c6: 44:5f:4f:19:f5:da:13:a5:2f:11:f3:db:73:22:a1:98:83:b0: 44:0d:2b:59:2f:3a:54:fb:00:a0:8f:1b:19:2b:c0:3c:9d:fb: f0:80:50:9a:9e:7b:b6:46:84:d3:df:b2:36:6b:d2:97:53:f9: da:1e:8c:7a:e8:40:15:17:3b:17:b7:c6:0d:e0:64:e4:68:96: 11:43:d2:d8:d4:f8:1b:7b:44:15:29:d9:ca:e5:3a:97:b6:b4: c6:b9:2b:c2:8a:6d:47:62:75:33:a1:dd:e9:93:28:eb:82:00: 8d:ef:0d:b6:17:72:a6:59:95:4c:97:fa:47:a8:ff:27:60:dd: c1:6e:6a:62:dc:1b:a8:e7 -----BEGIN X509 CRL----- MIIDGTCCAQECAQEwDQYJKoZIhvcNAQELBQAwRTELMAkGA1UEBhMCRlIxEzARBgNV BAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0 ZBcNMTUxMjAyMDkwNDM4WhcNMTYwMTAxMDkwNDM4WjB4MBICAQEXDTE1MTIwMTE0 NDYzOFowEgIBAhcNMTUxMjAyMDkwNDI5WjASAgEDFw0xNTEyMDIwNzI1MzRaMBIC AQQXDTE1MTIwMjA3Mjc0NVowEgIBBRcNMTUxMjAyMDczMjIxWjASAgEGFw0xNTEy MDIwODIxNDhaoA4wDDAKBgNVHRQEAwIBAjANBgkqhkiG9w0BAQsFAAOCAgEAFiTU +HeCe8pwGgEmX4OfE29RZ4WwLKclwUZmyrhGdIVKyiYr/0bnkaMQCc5rhB1YoUoc OKwaWPxQCnoeHFz5K+8lepMns15l1maJMyNS/Q04fmbWdNfksnLYdElz0yq14COK A7XGzir0A++MUIO+n2gER3n/XUvLis08al8CM+Zhhv9M83QsgXDBEwVDVBoEoHvf /vjlUFPOLASGNu0KmCRyXmgaI3+OhVwsK3vfI1b+L8fa7MqPSKApFXI44/9IHokw sXIbIT8L4K3ricNlcMwpA/Buc77IJGSTuHuvIaBnJFq+6LDs4KFfDKnl3gk5CCNg 2dlOB6LyHk+WDLfGu1sq43iSLvo5nK7UTLKy438qWBSGgJf9XpWxndYjPczOKwtl skP1FfsgLHKP/WJ9f1SAVCIiQhV7JxgvJHCBykTMxNic2Jlp8v1Kfz4RV5El2G9C rrDVvP3NC5ulwvbQzovjZnt4A5CmykT54cuAcC7bsDzR/FrY9f3GRF9PGfXaE6Uv EfPbcyKhmIOwRA0rWS86VPsAoI8bGSvAPJ378IBQmp57tkaE09+yNmvSl1P52h6M euhAFRc7F7fGDeBk5GiWEUPS2NT4G3tEFSnZyuU6l7a0xrkrwoptR2J1M6Hd6ZMo 64IAje8NthdyplmVTJf6R6j/J2DdwW5qYtwbqOc= -----END X509 CRL----- root@auditd:~/CA# openssl x509 -in /opt/syslog-ng/etc/cert.d/1.cert -text Certificate: Data: Version: 3 (0x2) Serial Number: 6 (0x6) Signature Algorithm: sha256WithRSAEncryption Issuer: C=FR, ST=Some-State, O=Internet Widgits Pty Ltd Validity Not Before: Dec 2 07:32:36 2015 GMT Not After : Nov 29 07:32:36 2025 GMT Subject: C=FR, ST=FR, O=PLOP, CN=1 Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (4096 bit) Modulus: 00:ae:2a:9e:a6:6f:54:eb:f7:1f:7f:d6:67:b5:68: 11:9d:a8:79:93:78:e8:b6:48:f6:64:7e:e5:bf:72: 33:61:6f:4a:e9:c0:25:f6:61:47:de:f7:a3:5d:3d: da:fa:2d:97:08:20:5b:b1:a9:10:2b:50:18:ca:40: ea:16:f8:3d:a5:5e:cc:18:d4:80:30:62:cc:4c:b7: 2b:99:9e:6a:3a:09:97:2b:1d:79:36:d2:53:7a:8d: 96:4f:20:c0:f3:ac:e9:01:d1:a0:d7:00:37:83:1f: 64:ee:df:4f:27:61:a2:5f:94:66:be:35:58:9e:52: a0:91:0a:00:57:13:d5:b4:b3:90:10:8c:42:4f:34: 69:3f:9c:1b:7d:9b:ae:eb:79:8d:d9:9d:2c:3c:74: 58:c2:ba:a5:34:e5:15:01:45:d3:47:85:82:eb:34: b2:21:ba:97:2b:4e:90:92:4f:85:19:c7:b0:7f:cd: 8c:49:08:4e:32:d0:9e:34:af:b9:02:aa:40:2e:af: f5:6b:41:92:9f:5a:ab:09:b5:bd:7a:73:fe:4d:f4: 1b:c6:23:22:15:7c:b5:47:e1:88:bd:8a:b7:d7:1b: 5e:4a:53:f9:41:33:e9:30:97:ce:9b:b4:88:77:f6: 35:9c:47:a7:12:5d:98:9e:e4:1c:27:bf:bd:e5:85: b1:c1:1f:dc:17:03:c0:00:9f:0b:d8:40:c3:1c:31: f3:9b:60:17:05:0d:ac:79:9e:53:2b:aa:da:78:e7: f4:a8:3e:f9:14:f1:40:1f:47:df:45:c7:57:14:3d: 26:68:9c:a7:77:da:29:50:85:1c:e3:62:e6:66:f0: 5e:59:6f:35:61:32:e4:a8:7d:a1:30:b5:85:69:0e: e3:fd:8e:67:78:c3:47:58:5d:88:36:65:85:09:52: 46:47:bb:48:03:9c:e5:42:48:66:7d:34:7d:01:9c: 67:ea:82:f0:d5:4e:9b:64:0c:c6:db:1c:0d:2a:de: 67:ba:a5:04:44:4a:fc:12:94:77:b0:30:fc:d0:06: 26:d4:e8:94:ed:a1:78:4d:cd:fa:8b:a4:4e:45:fc: cf:2b:d8:47:11:e0:68:e0:78:36:34:4f:76:5c:76: 4b:69:02:4c:22:47:57:10:92:ce:b9:d8:20:7e:80: 80:a7:ca:55:7c:41:a4:0a:0e:08:e0:86:e2:63:9f: e4:f6:e0:13:fd:67:7a:14:f7:e2:fe:6e:14:2a:ba: 80:e1:29:0d:7c:5a:36:91:60:ae:9b:14:6f:1e:2d: 40:b9:28:03:e5:d6:f8:f4:64:6d:ca:8b:1d:38:48: 30:92:fa:6f:75:c9:7a:62:61:47:0e:32:3e:e5:7e: 0a:3b:d5 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: 33:1A:1E:42:87:07:1F:05:83:C6:14:DE:5D:BC:90:89:8C:10:39:44 X509v3 Authority Key Identifier: keyid:C0:B7:97:89:CD:42:1E:6A:FB:7D:AE:3B:1E:A1:30:7E:94:FA:FB:35 X509v3 CRL Distribution Points: Full Name: URI:https://deb.plop.net/ssl/ Signature Algorithm: sha256WithRSAEncryption ad:d7:d0:1f:d1:f2:10:88:d4:4c:5e:fe:80:88:96:35:55:26: 12:8d:1f:1f:38:d2:36:6e:75:00:37:e8:45:28:eb:c3:b5:e7: 71:90:91:5a:96:2d:b6:3e:5b:c0:45:84:e5:dc:07:65:63:54: b1:06:4b:6a:ee:63:80:54:63:4c:72:1a:2f:eb:00:7c:36:0b: 18:22:3a:d2:90:e6:3f:69:9a:cf:b7:50:72:19:f6:3d:d5:19: fa:2a:46:09:cf:86:f7:12:0e:2c:4a:59:6c:26:45:2b:52:90: 72:55:a9:7d:16:27:db:ba:19:cb:c8:96:4c:e1:42:79:6b:ab: f9:87:97:43:e0:d1:71:2d:ef:fc:c9:f0:02:b1:7d:6c:59:ef: fd:00:76:4b:a7:f9:9c:1a:05:90:5b:df:2e:35:52:c7:79:f9: f3:31:d5:3f:60:2a:93:78:48:19:3b:53:43:ed:ee:f0:39:c8: fa:88:b8:7e:b0:5e:ce:73:c2:b2:c2:da:95:39:d9:1e:b7:02: d7:98:20:31:d2:91:c2:c9:61:45:cd:9b:f1:54:3d:17:df:96: 09:3d:11:96:b4:97:2a:9f:e8:9e:77:d4:1b:67:d9:a1:9d:1e: b8:d9:58:3a:b4:26:24:23:d5:a0:d6:52:78:1d:2f:d9:ce:f4: 41:66:82:7c:56:d9:df:a0:08:cb:b4:ae:2a:79:16:bf:91:09: 46:be:35:17:44:73:7b:48:e0:3e:f4:03:45:a7:36:3e:8e:8e: 58:7c:02:a9:c7:9d:22:98:bc:d3:05:90:81:39:d6:00:09:a4: 33:58:0f:57:b9:a5:e2:d0:3f:e4:ad:4e:47:a4:af:98:b6:d0: 49:f0:f9:d5:9b:b1:18:c6:fb:7d:3d:18:6c:90:62:1f:cb:c9: 97:00:92:57:29:32:1d:be:02:61:af:1f:17:48:eb:6a:b0:a2: f4:96:e1:0f:24:63:11:c7:66:2f:bc:7e:c2:e0:fd:25:3c:ac: 83:5b:05:35:b3:45:64:8e:93:21:3d:ed:1c:95:ae:24:55:98: 07:5f:99:71:28:8e:01:5d:94:16:62:03:a1:63:1f:08:88:6f: 9b:0b:db:43:21:31:4a:08:a2:a2:f6:af:7a:b3:20:94:5f:7d: 2f:53:3a:20:ea:08:5f:db:38:89:24:83:bd:9c:a0:78:ea:68: cd:39:47:b8:b6:f3:f4:bb:14:cc:e8:d0:24:59:7e:fc:0f:05: e9:73:18:5b:5d:31:0b:d2:e0:17:0f:ff:0d:b8:39:54:32:42: a2:07:b3:d3:53:5c:89:f7:b4:c3:44:60:7e:0c:5f:d1:80:e8: d2:6b:89:8d:1f:a9:79:7b -----BEGIN CERTIFICATE----- MIIFnDCCA4SgAwIBAgIBBjANBgkqhkiG9w0BAQsFADBFMQswCQYDVQQGEwJGUjET MBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQ dHkgTHRkMB4XDTE1MTIwMjA3MzIzNloXDTI1MTEyOTA3MzIzNlowNDELMAkGA1UE BhMCRlIxCzAJBgNVBAgMAkZSMQwwCgYDVQQKDANPVkgxCjAIBgNVBAMMATEwggIi MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCuKp6mb1Tr9x9/1me1aBGdqHmT eOi2SPZkfuW/cjNhb0rpwCX2YUfe96NdPdr6LZcIIFuxqRArUBjKQOoW+D2lXswY 1IAwYsxMtyuZnmo6CZcrHXk20lN6jZZPIMDzrOkB0aDXADeDH2Tu308nYaJflGa+ NVieUqCRCgBXE9W0s5AQjEJPNGk/nBt9m67reY3ZnSw8dFjCuqU05RUBRdNHhYLr NLIhupcrTpCST4UZx7B/zYxJCE4y0J40r7kCqkAur/VrQZKfWqsJtb16c/5N9BvG IyIVfLVH4Yi9irfXG15KU/lBM+kwl86btIh39jWcR6cSXZie5Bwnv73lhbHBH9wX A8AAnwvYQMMcMfObYBcFDax5nlMrqtp45/SoPvkU8UAfR99Fx1cUPSZonKd32ilQ hRzjYuZm8F5ZbzVhMuSofaEwtYVpDuP9jmd4w0dYXYg2ZYUJUkZHu0gDnOVCSGZ9 NH0BnGfqgvDVTptkDMbbHA0q3me6pQRESvwSlHewMPzQBibU6JTtoXhNzfqLpE5F /M8r2EcR4GjgeDY0T3ZcdktpAkwiR1cQks652CB+gICnylV8QaQKDgjghuJjn+T2 4BP9Z3oU9+L+bhQquoDhKQ18WjaRYK6bFG8eLUC5KAPl1vj0ZG3Kix04SDCS+m91 yXpiYUcOMj7lfgo71QIDAQABo4GnMIGkMAkGA1UdEwQCMAAwLAYJYIZIAYb4QgEN BB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0GA1UdDgQWBBQzGh5C hwcfBYPGFN5dvJCJjBA5RDAfBgNVHSMEGDAWgBTAt5eJzUIeavt9rjseoTB+lPr7 NTApBgNVHR8EIjAgMB6gHKAahhhodHRwczovL2RlYi5vdmgubmV0L3NzbC8wDQYJ KoZIhvcNAQELBQADggIBAK3X0B/R8hCI1Exe/oCIljVVJhKNHx840jZudQA36EUo 68O153GQkVqWLbY+W8BFhOXcB2VjVLEGS2ruY4BUY0xyGi/rAHw2CxgiOtKQ5j9p ms+3UHIZ9j3VGfoqRgnPhvcSDixKWWwmRStSkHJVqX0WJ9u6GcvIlkzhQnlrq/mH l0Pg0XEt7/zJ8AKxfWxZ7/0Adkun+ZwaBZBb3y41Usd5+fMx1T9gKpN4SBk7U0Pt 7vA5yPqIuH6wXs5zwrLC2pU52R63AteYIDHSkcLJYUXNm/FUPRfflgk9EZa0lyqf 6J531Btn2aGdHrjZWDq0JiQj1aDWUngdL9nO9EFmgnxW2d+gCMu0rip5Fr+RCUa+ NRdEc3tI4D70A0WnNj6Ojlh8AqnHnSKYvNMFkIE51gAJpDNYD1e5peLQP+StTkek r5i20Enw+dWbsRjG+309GGyQYh/LyZcAklcpMh2+AmGvHxdI62qwovSW4Q8kYxHH Zi+8fsLg/SU8rINbBTWzRWSOkyE97RyVriRVmAdfmXEojgFdlBZiA6FjHwiIb5sL 20MhMUoIoqL2r3qzIJRffS9TOiDqCF/bOIkkg72coHjqaM05R7i28/S7FMzo0CRZ fvwPBelzGFtdMQvS4BcP/w24OVQyQqIHs9NTXIn3tMNEYH4MX9GA6NJriY0fqXl7 -----END CERTIFICATE-----

2 7

Upcoming stunnel 5.27 release
by Michal Trojnara 01 Dec '15

01 Dec '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi Guys, stunnel 5.27 will be made available on 3rd December. Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWXHz/AAoJEC78f/DUFuAUcxAQAK5PrsoU4i0n25IYfFnuGWm/ R9Y4BJKO6/4+VHjRN9Yi4gJb0t7QpVxYQH9RuQAYVWp5RYeYqnxyb55m5iZ5IYBl V5ke5+DjTtPpMuTDShLz9BkL01lyrw8c+mwLy1IZM4nUgAQHyWp4lgcKgKukoY6N DYxloE5GmWW3ylGLAJUFlcVZmNayo8pmmVeWLbhsCRt0OyFJbrS8XUcVviZVcxAD q3Lly63NFC0Nsl+5MGmKxO8sRCu3UW0WkT4P5MbJr2f5b9AuTlrBmBNZ/fmyPAV9 5/LvAc5vdh9DwJEgGF3yvFqdFghR8TNuGNqBJaDn5pk+6rmc0qNeQkFFsq0CRX34 jSwNCl0A0SuXp4YGPTOFK9rp8bKjxq5VDUAGa6OyEhd92H2pSLxDA/aJqlY6f1vs MZQb6az60lrUq1JNnoYeUfO9AFMCFpqyFV4kqmfUOlnJox99JbZ5/U38CeaO9n8P tIz7jgijYRDK6itaCuf1QaWJxCU5S7yCUL1dtyi2nTDTvrG8WmTr93SniyGXScix fXIIb4Aa7mg3/p9J9TFONzxw0CySj/32ZBIgiLAWcAaa1Gnuy3+ARSAu1U6t9to8 Unnzppd1B7qn0qk1QANtktz4JAu63FUg7RSPHFt8+nLcABtslkjHdcVvzGl3F02k zjYq9bMufBOqlCDctGQO =rtq3 -----END PGP SIGNATURE-----

2 1

Failover behavior with stunnel
by Thireus 30 Nov '15

30 Nov '15

Hi, I have a couple of questions regarding failover with stunnel: 1. I would like to know if there is a way to use failover with two servers with two different set of TLS cert/key. The following rule doesn't work, because the cert and key parameters are overwritten, but it shows what I would like to achieve: [failover] accept = 127.0.0.1:4441 <http://127.0.0.1:4441/> cert = cert_1.cert key = key_1.pem connect = server-1:1234 cert = cert_2.cert key = key_2.pem connect = server-2:1234 2. On the same topic, I would like to know if there is an option that could open the local port (accept) only when the connection (connect) is established? The problem I'm facing is that I use a PAC profile with failover on several stunnel entries: "return PROXY 127.0.0.1:4441 <http://127.0.0.1:4441/>; PROXY 127.0.0.1:4442 <http://127.0.0.1:4442/>; PROXY 127.0.0.1:4443 <http://127.0.0.1:4443/>;". However, when one of the remote server is down (i.e. server-1), it is not easily detected by web-browsers (Chrome does not seem to detect it well), and so instead of switching to the next PROXY, it simply dies on the first one. If the port 4441 relative to server-1 (which is unavailable) was closed, then the webrowser could easily detect it and switch to the second server with port 4442. 3. Is there another way to tweak stunnel behavior when a remote server is down? I'm thinking about a couple of things, like being able to switch to a different rule set: [failover1] accept = 127.0.0.1:4441 <http://127.0.0.1:4441/> cert = cert_1.cert key = key_1.pem connect = server-1:1234 connect = 127.0.0.1:4442 <http://127.0.0.1:4442/> ; This is failover2 [failover2] accept = 127.0.0.1:4442 <http://127.0.0.1:4442/> cert = cert_2.cert key = key_2.pem connect = server-2:1234 Or maybe there are some options that I'm not aware of to timeout connections more efficiently: so that Chrome (or other clients using HTTP proxies) will immediately know that stunnel cannot connect to the remote server and so that the proxy is down. Thank you for your help. Cheers, Thireus.

2 3

Where is stunnel.exe ?
by Manu Egen 25 Nov '15

25 Nov '15

Hello, Can you tell me from which stunnel version, the "bin" folder and the "config" folder appeared ? The change is between the version 4.53 and 5.26, but which one ? Thanks a lot for the answer Best regards, Manu

1 0

syslog communication using TLS with the help of stunnel
by Girish Kumar 24 Nov '15

24 Nov '15

Dear All, Currently we are using syslog communication without any security. That is using UDP protocol with the server listening on port number 514. This is unsecure. I want to use syslog over TLS that is over TCP . As of now in my project syslogd daemon is used. I am planning to use stunnel to achieve this. I have few questions. Please clarify * To support stunnel, syslogd should be on TCP and not on UDP? * Is stunnel is a daemon ? * My understanding is syslogd forwards messages to the stunnel local portal at port 61514. The local stunnel forwards data via the network to port 60514 to its remote peer. * I assume stunnel-5.26(stunnel-5.26.tar.gz) is the latest version and this can be used on linux Regards, Girish

2 1

A trivial patch for two minor typos in 5.26
by Peter Pentchev 19 Nov '15

19 Nov '15

Hi, Once again, thanks a lot for taking care of stunnel! Attached is a trivial patch for two minor typo fixes. Thanks in advance for looking over it :) G'luck, Peter -- Peter Pentchev roam(a)ringlet.net roam(a)FreeBSD.org pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

1 0

OCSP stapling
by Joó Ádám 17 Nov '15

17 Nov '15

Hi, The website and the documentation does not indicate and a Google search does not give any relevant results, so I would like to ask if Stunnel supports OCSP stapling? Thank you, Ádám

2 1

STunnel 5.22
by Deepak Subbanarasimha 17 Nov '15

17 Nov '15

Is STunnel 5.22 supported on Windows 2003 server? Thanks, DEEPAK SUBBANARASIMHA Kewill DDI: +00 (1) 978 482 2625 Email: deepak.subbanarasimha(a)kewill.com<mailto:[email protected]> www.kewill.com<http://www.kewill.com/> Tel: +00 (1) 978 482 2500 | Fax: +00 (1) 978 482 2501 1 Executive Drive, Chelmsford, MA 01824, USA IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately notify us by telephone at (978) 482-2500 and return the original message to us at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code. Thank You. Copyright (c) 2013 by Kewill Inc IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately return the original message to the sender at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Although Kewill takes reasonable precautions to minimize the risk, Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code.

1 0

Compilation issues - AIX 6.1 XLC and GXLC
by Rob Lockhart 16 Nov '15

16 Nov '15

On AIX 6.1 using IBM's XLC compiler, I do "configure" and that successfully completes. However, when I "make", it fails due to the parameters "-fstack-protector" and "-fPIE"... apparently it couldn't find the files "stack-protector" and "PIE" as "-f" specifies a file. However, gcc and perhaps many other cc variants, "-f" specifies a compile option. I was able to compile with XLC by ripping out the "stack-protector" and "PIE" sections of "configure" and running "make" but it would be best to use the stack protector mechanisms used for AIX's XLC: https://www.ibm.com/developerworks/mydeveloperworks/blogs/b10932b4-0edd-4e6… Has anyone compiled Stunnel 5.26 using IBM's XLC without removing the stack-protector and PIE sections in the configure file? The other option is to use gxlc instead of xlc to map the GNU C compiler options to XLC options. Would that be preferred (less modification of configure file)? I was able to get that working, but still an unusually high number of warnings. http://geco.mines.edu/files/manuals/xlc/mapping.pdf The article above (from IBM) has "-qstackprotect=size=N" - what suggestion parameter to use for "N"? To be nice to everyone's mailbox, I have posted the logs here: Stunnel 5.26 AIX XLC - fails http://pastebin.ca/3250237 Stunnel 5.26 AIX GXLC - passes http://pastebin.ca/3250242 Thanks, -Rob

3 5

Virtual Machine/Server
by Duane Moody - Global Data Specialists 13 Nov '15

13 Nov '15

We are currently using Stunnel on a stand-alone PC to link a 3rd party application that monitors a Graphical User Interface application for alarm notification. Stunnel is used to link this 3rd party alarm notification software to be able to send message to Amazon Web Services for email distribution to the users/operators that need this information. IT would like to investigate having all applications operate from a server possibly running 2012 OS, in a virtual environment. The GUI and 3rd party software will operate in this environment and I wanted to see if Stunnel would have any issues continuing to send messages out to Amazon. Thank you, Duane Moody Global Data Specialists 1815 W. 1st Ave, Suite 110 Mesa, AZ 85202 PH: 480-461-3401, Ext 223 Fax: 480-461-3411 Cell: 602-696-9457 www.gbl-data.com

2 1

stunnel 5.26 released
by Michal Trojnara 06 Nov '15

06 Nov '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear Users, I have released version 5.26 of stunnel. The ChangeLog entry: Version 5.26, 2015.11.06, urgency: MEDIUM * Bugfixes - Compilation fixes for OSX, *BSD and Solaris. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 2c90d469011eed8dc94f003013e3c055de6fdb687ef1e71fa004281d7f7c2726 stunnel-5.26.tar.gz 797e89783bbab29d5eedbd3193da2cb2461bcf47d314a9ee671b228e207e2b15 stunnel-5.26-installer.exe cd62a3ed4818677e7eeab36017accbae697a67cfd85f58eae82d2ad2db781664 stunnel-5.26-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWPJBJAAoJEC78f/DUFuAUSWUQAKglnyE5OkITYqd7deO768mv AC7DvDrP+mwmICbl/ZQhVzuUB4E9WYUnbyrOduIbCoN3FrDr1hROcO6Tuf63DFXa 5Qal5tFFEgVm5LKi7MxPn022d5e8Q04RADtJ7DNzSrJNltyivHG3h6jAVlXcmlui BkFORjWbZAZ2AUvKBbUYYdjfR2rnpqlrUNIcZwMz0hR5e4JT5Yw5WHa3NfAcXknh XZ27+BoKg6jDyEx+mk2aXYFpeCvWPx5vaKmtAqbIkEaNKhmolpYxf02JespwmvpJ Y/rD0kko+r8zSwMQRZ8FSNncVbQ1Zir3rZM6IE78TkNeGnJKiq29H3dzrUuZP4uW Hv5qjAW7IaVMFUMUOsM/eyKTyh7ibgXLIshb7byn9zm5BHmlY4PgVUyeAXVVbYfK qgfMq43VjgXcyvFw4osQx5xYnA0P3edxFyx1v+GMeHssxh2CLv5MwrcmTcnf5SSm t2COdxi+4gA0mJwsSrdw8d7fuTLg/zhzWKSwB9XZqZ+xM+nTNVI3hzoQJ+Fhe/KP kfJ6qPrSHMj2WX740DDY/tGDTdxKnOEgJb0sJepEJyprIm8LFMSrBBt5fAdqgrPy a9znXn7RG+C71oxoaP/Q77fdAUQ9147SfGOO18ooYDzev5w5nHRg0kaPRrMDHxUg CyNsej8I/7CSXCH4PtjL =KQPP -----END PGP SIGNATURE-----

1 0

stunnel 5.25 released
by Michal Trojnara 05 Nov '15

05 Nov '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear Users, I have released version 5.25 of stunnel. The ChangeLog entry: Version 5.25, 2015.11.02, urgency: MEDIUM * New features - SMTP client protocol negotiation support for "protocolUsername", "protocolPassword", and "protocolAuthentication" (thx to Douglas Harris). - New service-level option "config" to specify OpenSSL >=1.0.2 configuration commands (thx to Stephen Wall). - The global option "foreground" now also accepts "quiet" parameter, which does not enable logging to stderr. - Manual page updated. - Obsolete OpenSSL engines removed from the Windows build: 4758cca, aep, atalla, cswift, nuron, sureware. - Improved compatibility with the current OpenSSL 1.1.0-dev tree: gracefully handle symbols renamed from SSLeay* to OpenSSL*. * Bugfixes - Fixed the "s_poll_wait returned 1, but no descriptor is ready" internal error. - Fixed "exec" hangs due to incorrect thread-local storage handling (thx to Philip Craig). - Fixed PRNG initialization (thx to Philip Craig). - Setting socket options no longer performed on PTYs. - Fixed 64-bit Windows build. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 1fb2209f1e006cc01813e1688599c4d0fb0adde4434c31ab95745b1db97484b7 stunnel-5.25.tar.gz 506846a28154e5111c6f374de5861c51221a5c9ddcf012952eaf7b4819176cd9 stunnel-5.25-installer.exe 58e79879a5fa922e2ae28ef0892f447d92d27517dfc0f921095b7180a7fd6905 stunnel-5.25-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWN2IVAAoJEC78f/DUFuAUhBoP/ifLB0Bl8yz13uGyy7mFghTN qwGLfLc5Nmu/flGOnynGWj6gXdRQT7WFaVkPCEoeNpttXEHzt+Q9psNAM4syOhBx KqiGJvq3atGfwGZwrIwUKZIXWT2jZldwL2vIctNe4i2oh6iWROcuTJqVa8eyLobw NJyuWCJqs60UK6IZN0ByrrO5Hc6Z7aTgJRkKmaWYY52ZeFrEUBY56yodfw8wvzAi JL/drDdJCyx4Q7ZQR14ZjhegAIqiEJ7GsbfosxBq3eApJKX/5L7zTP+BHL/jrFCu kiU/BhnjeYIuZ+R2j4tFWVhReMYjYIvjMAvPEo7GG1Z6xuVPpCQ90VW376cPbh8N 918Q/Gh/PF60covJmNYdW8Wn4L84vJrOM5uHkDCH2ZVFWWXUBGHZ0ZxBb1lB+kVC 69AzbK5hwHwEyfs/JjXjaIW3Tih9/Ig9t/+CD/131eWEqjGAxGtCGYgJMi0JgAt0 ei/kXeNuq39DxhTquGD1QOn98rVyrFsvvvV7aaMIECPri2MTHnZyMAF+N7txpcT2 UhD8Dlfnif6nF3JJ08/KWRh7x2tvmsFyZyqNV+uw3q3unUvZD6lcW7DCWAuXK4ap 5+fFJsxdvMUlqKZWrPrA2xrpObKAVdRdlLjDTl/oD3DuT9xfW3UQ6WKB76aLlnkL MdkEcOQuN+oCQNSlAv// =WhEM -----END PGP SIGNATURE-----

5 15

Re: [stunnel-users] One Time Password for https two factor authentication
by hamburg-barmbek＠gmx.de 02 Nov '15

02 Nov '15

2 2

One Time Password for https two factor authentication
by hamburg-barmbek＠gmx.de 30 Oct '15

30 Oct '15

2 1

Re: [stunnel-users] stunnel-users Digest, Vol 135, Issue 19
by Reese Wilson 30 Oct '15

30 Oct '15

Unfortunately that's not an option for our use case On Thu, Oct 29, 2015 at 4:00 AM <stunnel-users-request(a)stunnel.org> wrote: > Send stunnel-users mailing list submissions to > stunnel-users(a)stunnel.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)stunnel.org > > You can reach the person managing the list at > stunnel-users-owner(a)stunnel.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. hex key support for psk (Reese Wilson) > 2. Re: hex key support for psk (Michal Trojnara) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 28 Oct 2015 23:12:01 +0000 > From: Reese Wilson <reesew(a)tzmedical.com> > To: stunnel-users(a)stunnel.org > Subject: [stunnel-users] hex key support for psk > Message-ID: > < > CAJU_q421ksnS8mCtkc6tApdTwUXJrNBZ+69Zt_HxJMpJLGBoiA(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > I ran into an issue with PSK reading the key as ascii instead of hex. I had > a gnutls-serv and gnutls-cli set up with a hex key, and I switched the > server for one wrapped using stunnel, but using the same key in psk.txt was > failing. I eventually got it working by converting the hex characters to > binary and placing that in the contents of the file specified by PSKsecrets > (psk.txt), but this won't work for certain scenarios. For example, what if > the key contains ascii newline characters? >

1 0

hex key support for psk
by Reese Wilson 29 Oct '15

29 Oct '15

I ran into an issue with PSK reading the key as ascii instead of hex. I had a gnutls-serv and gnutls-cli set up with a hex key, and I switched the server for one wrapped using stunnel, but using the same key in psk.txt was failing. I eventually got it working by converting the hex characters to binary and placing that in the contents of the file specified by PSKsecrets (psk.txt), but this won't work for certain scenarios. For example, what if the key contains ascii newline characters?

2 1

stunnel: symbol lookup error: stunnel undefined symbol: X509_check_host
by Ryan McLeod 20 Oct '15

20 Oct '15

Hello. I get the error in the subject on 64bit Ubuntu and Debian system (32bit is fine). I've installed from source: -openssl-1.0.2.d -stunnel-5.24 When first install stunnel, it complained about not being able to find an ssl library during the configure stage and said to reinstall openssl with -fPIC. I did that using the following line: CFLAG=-fPIC ./config shared Once I did that, stunnel installed just fine. But when I run stunnel, I get the error in the subject. I tried reinstalling stunnel with a configure option: --with-ssl=/usr/local/ssl/. But no change. Any suggestions would be great. Thanks. Ryan

2 2

Windows Mobile 6.5
by Jeffrey McCain 19 Oct '15

19 Oct '15

Hello, Does Anyone know if the makece.bat for ARM actually functions anymore? I'd like to build the latest possible version of stunnel for a client that uses Window Mobile 6.5, but not if I have to go back to stunnel version 4.15, which appears to be the last time someone built binaries for it... Thanks! Jeff.

4 7

100 percent CPU usage
by asdf 17 Oct '15

17 Oct '15

Dear subscribers I am new to this so I dont know if this is just wrong configuration (that does not trigger an error message). Searching on the web for the following problem shows someone reporting sth similar on a Linux machine. I am using the newest version of stunnel (5.24) on Windows 7 and there is an stunnel thread starting that takes 100% of one core forever. I have attached a ProcMon trace with activated Registry/Filesystem/Network/Process events. The thread starts at 22:03:55 (which is 30 seconds after stunnel-start and at a time at which I did not use stunnel). The events after that follow that event are my pressing exit. Attachements: stunnel config, procMon-trace Thank you! Ben [myEmailIn] client = yes accept = 127.0.0.1:180 connect = imap.gmx.net:993 verify = 2 CAfile = ca-certs.pem checkHost = mail.gmx.net [myEmailOut] client = yes accept = 127.0.0.1:181 connect = mail.gmx.net:465 verify = 2 CAfile = ca-certs.pem checkHost = mail.gmx.net ; ***************************************** Example TLS server mode services [myServer] accept = 9999 connect = 7777 cert = stunnel.pem

1 0

Question about "forground = yes" and "output = FILE" combined options
by Michael Gebis 16 Oct '15

16 Oct '15

Hello. I have a question about the combination of the "foreground = yes" option combined with the "output = FILE" option. The man page says this: foreground = yes | no (Unix only) foreground mode Stay in foreground (don’t fork) and log to stderr instead of via syslog (unless output is specified). This implies that if you set both "foreground = yes" and "output = FILE", the log messages will not be sent to stderr and will instead be sent to the log file only. We'd like this behavior--it makes it easier for our scripts to distinguish startup errors parsing the config file (which are sent to stderr, since the log file isn't configured yet) vs. normal operation after the config file is parsed and the log file is established. However, it appears that if you specify "foreground = yes" and "output = FILE", log messages will go to *both* stderr and the output file. I guess I'm asking: is the documentation in conflict with the behavior, and if so, which is correct? It's possible I'm just misreading the man page. But in any case, here is a simple patch which changes the behavior to match our reading of the man page. It is against stunnel-5.22 but I believe it should be applicable to later versions as well. Thank you, Michael diff -ru stunnel-5.22.orig/src/log.c stunnel-5.22-foreground-outfile/src/log.c --- stunnel-5.22.orig/src/log.c 2015-06-16 06:16:35.000000000 -0700 +++ stunnel-5.22-foreground-outfile/src/log.c 2015-10-14 11:54:58.998254974 -0700 @@ -243,7 +243,8 @@ level<=opt->log_level #else (level<=opt->log_level && - global_options.option.foreground) + global_options.option.foreground && + !outfile) #endif ) ui_new_log(line);

3 7

Can stunnel do this and if so, how?
by Jason Lacoss-Arnold 15 Oct '15

15 Oct '15

I have a client and a server where the client isn't very good and the server requires a MASSL (Mutual Auth SSL aka client certificate authenticated) connection. I need to get one of two things to work. Either: 1) The client makes a non-SSL connection to stunnel on the local machine which then performs a MASSL connection to the server using a client certificate or 2) The client makes a plain SSL connection to stunnel on the local machine which then performs a MASSL connection to the server using a client certificate. Can stunnel be used in this manner? If so, would someone please give me some hints on configuration? For extra credit, it would be awesome if the client private key were stored in a pkcs11 device (HSM). Thank you, --Jason

1 0

Unable to authenticate with Outlook.com servers (SMTP)
by Aerowinder 15 Oct '15

15 Oct '15

Greetings, Running stunnel 5.25 latest beta (2015-10-15), but also had the same issues on 5.24 final. My config file looks like this: debug = debug output = xxxxx client = yes cert = stunnel.pem [outlook-smtp] accept = 127.0.0.1:25 connect = smtp-mail.outlook.com:587 protocol = smtp ;protocolUsername = xxxx ;protocolPassword = xxxx CAfile = ca-certs.pem checkHost = smtp-mail.outlook.com OCSPaia = yes verify = 2 I am testing functionality to make sure that I am able to send mail with my Outlook.com address. I currently have User/Pass field commented out, but I've tried with them not commented out, and the actual values instead of "xxxx" (the app I'm using has fields for username and password). My log: 2015.10.15 11:01:24 LOG7[cron]: Cron started 2015.10.15 11:01:24 LOG7[main]: No limit detected for the number of clients 2015.10.15 11:01:24 LOG5[main]: stunnel 5.25 on x86-pc-msvc-1500 platform 2015.10.15 11:01:24 LOG5[main]: Compiled/running with OpenSSL 1.0.2d-fips 9 Jul 2015 2015.10.15 11:01:24 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2015.10.15 11:01:24 LOG7[main]: errno: (*_errno()) 2015.10.15 11:01:24 LOG7[ui]: GUI message loop initialized 2015.10.15 11:01:24 LOG5[main]: Reading configuration from file stunnel.conf 2015.10.15 11:01:24 LOG5[main]: UTF-8 byte order mark detected 2015.10.15 11:01:24 LOG5[main]: FIPS mode disabled 2015.10.15 11:01:24 LOG7[main]: Compression disabled 2015.10.15 11:01:24 LOG7[main]: PRNG seeded successfully 2015.10.15 11:01:24 LOG6[main]: Initializing service [outlook-smtp] 2015.10.15 11:01:24 LOG6[main]: Loading certificate from file: stunnel.pem 2015.10.15 11:01:24 LOG6[main]: Loading key from file: stunnel.pem 2015.10.15 11:01:24 LOG7[main]: Private key check succeeded 2015.10.15 11:01:24 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2015.10.15 11:01:24 LOG5[main]: Configuration successful 2015.10.15 11:01:24 LOG7[main]: Listening file descriptor created (FD=652) 2015.10.15 11:01:24 LOG7[main]: Service [outlook-smtp] (FD=652) bound to 127.0.0.1:25 2015.10.15 11:01:31 LOG7[main]: Found 1 ready file descriptor(s) 2015.10.15 11:01:31 LOG7[main]: FD=408 ifds=r-x ofds=--- 2015.10.15 11:01:31 LOG7[main]: Service [outlook-smtp] accepted (FD=692) from 127.0.0.1:58065 2015.10.15 11:01:31 LOG7[main]: Creating a new thread 2015.10.15 11:01:31 LOG7[main]: New thread created 2015.10.15 11:01:31 LOG7[0]: Service [outlook-smtp] started 2015.10.15 11:01:31 LOG5[0]: Service [outlook-smtp] accepted connection from 127.0.0.1:58065 2015.10.15 11:01:31 LOG6[0]: s_connect: connecting 65.55.176.126:587 2015.10.15 11:01:31 LOG7[0]: s_connect: s_poll_wait 65.55.176.126:587: waiting 10 seconds 2015.10.15 11:01:31 LOG5[0]: s_connect: connected 65.55.176.126:587 2015.10.15 11:01:31 LOG5[0]: Service [outlook-smtp] connected remote server from 172.26.1.51:58066 2015.10.15 11:01:31 LOG7[0]: Remote descriptor (FD=704) initialized 2015.10.15 11:01:31 LOG7[0]: <- 220 BLU436-SMTP245.smtp.hotmail.com Microsoft ESMTP MAIL Service, Version: 8.0.9200.16384 ready at Thu, 15 Oct 2015 08:01:34 -0700 2015.10.15 11:01:31 LOG7[0]: -> 220 BLU436-SMTP245.smtp.hotmail.com Microsoft ESMTP MAIL Service, Version: 8.0.9200.16384 ready at Thu, 15 Oct 2015 08:01:34 -0700 2015.10.15 11:01:31 LOG7[0]: -> EHLO localhost 2015.10.15 11:01:31 LOG7[0]: <- 250-BLU436-SMTP245.smtp.hotmail.com Hello [70.90.151.129] 2015.10.15 11:01:31 LOG7[0]: <- 250-TURN 2015.10.15 11:01:31 LOG7[0]: <- 250-SIZE 41943040 2015.10.15 11:01:31 LOG7[0]: <- 250-ETRN 2015.10.15 11:01:31 LOG7[0]: <- 250-PIPELINING 2015.10.15 11:01:31 LOG7[0]: <- 250-DSN 2015.10.15 11:01:31 LOG7[0]: <- 250-ENHANCEDSTATUSCODES 2015.10.15 11:01:31 LOG7[0]: <- 250-8bitmime 2015.10.15 11:01:31 LOG7[0]: <- 250-BINARYMIME 2015.10.15 11:01:31 LOG7[0]: <- 250-CHUNKING 2015.10.15 11:01:31 LOG7[0]: <- 250-VRFY 2015.10.15 11:01:31 LOG7[0]: <- 250-TLS 2015.10.15 11:01:31 LOG7[0]: <- 250-STARTTLS 2015.10.15 11:01:31 LOG7[0]: <- 250 OK 2015.10.15 11:01:31 LOG7[0]: -> STARTTLS 2015.10.15 11:01:31 LOG7[0]: <- 220 2.0.0 SMTP server ready 2015.10.15 11:01:31 LOG6[0]: SNI: sending servername: smtp-mail.outlook.com 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): before/connect initialization 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv2/v3 write client hello A 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 read server hello A 2015.10.15 11:01:31 LOG7[0]: Verification started at depth=2: C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA 2015.10.15 11:01:31 LOG7[0]: CERT: Pre-verification succeeded 2015.10.15 11:01:31 LOG7[0]: OCSP: Ignoring root certificate 2015.10.15 11:01:31 LOG6[0]: Certificate accepted at depth=2: C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA 2015.10.15 11:01:31 LOG7[0]: Verification started at depth=1: C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - G2 2015.10.15 11:01:31 LOG7[0]: CERT: Pre-verification succeeded 2015.10.15 11:01:31 LOG5[0]: OCSP: Connecting the AIA responder "http://ocsp.globalsign.com/rootr1" 2015.10.15 11:01:31 LOG6[0]: s_connect: connecting 108.162.232.204:80 2015.10.15 11:01:31 LOG7[0]: s_connect: s_poll_wait 108.162.232.204:80: waiting 10 seconds 2015.10.15 11:01:31 LOG5[0]: s_connect: connected 108.162.232.204:80 2015.10.15 11:01:31 LOG7[0]: OCSP: Connected ocsp.globalsign.com:80 2015.10.15 11:01:31 LOG7[0]: OCSP: Response received 2015.10.15 11:01:31 LOG6[0]: OCSP: Status: good 2015.10.15 11:01:31 LOG6[0]: OCSP: This update: Oct 15 10:27:35 2015 GMT 2015.10.15 11:01:31 LOG6[0]: OCSP: Next update: Oct 19 10:27:35 2015 GMT 2015.10.15 11:01:31 LOG5[0]: OCSP: Certificate accepted 2015.10.15 11:01:31 LOG6[0]: Certificate accepted at depth=1: C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - G2 2015.10.15 11:01:31 LOG7[0]: Verification started at depth=0: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=*.hotmail.com 2015.10.15 11:01:31 LOG7[0]: CERT: Pre-verification succeeded 2015.10.15 11:01:31 LOG6[0]: CERT: Host name "smtp-mail.outlook.com" matched with "*.outlook.com" 2015.10.15 11:01:31 LOG5[0]: OCSP: Connecting the AIA responder "http://ocsp2.globalsign.com/gsorganizationvalg2" 2015.10.15 11:01:31 LOG6[0]: s_connect: connecting 108.162.232.196:80 2015.10.15 11:01:31 LOG7[0]: s_connect: s_poll_wait 108.162.232.196:80: waiting 10 seconds 2015.10.15 11:01:31 LOG5[0]: s_connect: connected 108.162.232.196:80 2015.10.15 11:01:31 LOG7[0]: OCSP: Connected ocsp2.globalsign.com:80 2015.10.15 11:01:31 LOG7[0]: OCSP: Response received 2015.10.15 11:01:31 LOG6[0]: OCSP: Status: good 2015.10.15 11:01:31 LOG6[0]: OCSP: This update: Oct 15 08:26:15 2015 GMT 2015.10.15 11:01:31 LOG6[0]: OCSP: Next update: Oct 16 08:26:15 2015 GMT 2015.10.15 11:01:31 LOG5[0]: OCSP: Certificate accepted 2015.10.15 11:01:31 LOG5[0]: Certificate accepted at depth=0: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=*.hotmail.com 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 read server certificate A 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 read server key exchange A 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 read server done A 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 write client key exchange A 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 write change cipher spec A 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 write finished A 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 flush data 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 read finished A 2015.10.15 11:01:31 LOG7[0]: 1 client connect(s) requested 2015.10.15 11:01:31 LOG7[0]: 1 client connect(s) succeeded 2015.10.15 11:01:31 LOG7[0]: 0 client renegotiation(s) requested 2015.10.15 11:01:31 LOG7[0]: 0 session reuse(s) 2015.10.15 11:01:31 LOG6[0]: SSL connected: new session negotiated 2015.10.15 11:01:31 LOG7[0]: Peer certificate was cached (3461 bytes) 2015.10.15 11:01:31 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-SHA384 (256-bit encryption) 2015.10.15 11:01:31 LOG7[0]: Compression: null, expansion: null 2015.10.15 11:01:31 LOG6[0]: SSL socket closed (SSL_read) 2015.10.15 11:01:31 LOG7[0]: Sent socket write shutdown 2015.10.15 11:01:31 LOG5[0]: Connection closed: 139 byte(s) sent to SSL, 351 byte(s) sent to socket 2015.10.15 11:01:31 LOG7[0]: Remote descriptor (FD=704) closed 2015.10.15 11:01:31 LOG7[0]: Local descriptor (FD=692) closed 2015.10.15 11:01:31 LOG7[0]: Service [outlook-smtp] finished (0 left) I don't see any errors in the log, but Outlook is reporting an incorrect password on the security section of my Microsoft Account. More specifically, I'm seeing error 5.7.3: Requested action aborted, user not authenticated," I know the password works because I set it up as an account in Outlook 2010 and tested sending the email. It works great. I am using 2FA with an app-specific password. But I have also tried without 2FA. I am 100% certain the account name xxxx(a)outlook.com and the password are correct. As far as the config file goes, I've tried just about everything I could find on Google. Nothing works, always the same error message. I also experienced similar failures with Gmail. Any ideas?

2 1

prng_init failure
by Philip Craig 15 Oct '15

15 Oct '15

prng_init() is failing in 5.24 when cross-compiling with openssl due to a combination of two reasons: 1. The --with-random configure option is not supported when cross compiling. 2. The hardcoded /dev/urandom is no longer used if OPENSSL_NO_EGD is not defined. The following patch reverts the behaviour to how it was in 5.23, but probably the --with-random configure option should be supported too. --- stunnel-5.25.orig/src/ssl.c +++ stunnel-5.25/src/ssl.c @@ -207,7 +207,8 @@ NOEXPORT int prng_init(GLOBAL_OPTIONS *g return 0; /* success */ } s_log(LOG_DEBUG, "RAND_screen failed to sufficiently seed PRNG"); -#elif !defined(OPENSSL_NO_EGD) +#else +#ifndef OPENSSL_NO_EGD if(global->egd_sock) { if((bytes=RAND_egd(global->egd_sock))==-1) { s_log(LOG_WARNING, "EGD Socket %s failed", global->egd_sock); @@ -220,7 +221,7 @@ NOEXPORT int prng_init(GLOBAL_OPTIONS *g so no need to check if seeded sufficiently */ } } -#else +#endif /* try the good-old default /dev/urandom, if available */ totbytes+=add_rand_file(global, "/dev/urandom"); if(RAND_status())

2 1

[PATCH] only use aysnc-signal-safe functions after fork
by Philip Craig 15 Oct '15

15 Oct '15

POSIX requires that multi-threaded processes only use async-signal-safe functions after calling fork(). For more info on the problems this avoids, see the rationale at: http://pubs.opengroup.org/onlinepubs/9699919799/functions/pthread_atfork.ht… The specific problem this patch solves is that, when there are multiple simultaneous requests, stunnel is often hanging on a futex syscall when a child process calls free as a result of tls_alloc(). This problem is experienced when using uClibc. I haven't tested, but I believe the malloc implementation in glibc does not have this problem. --- stunnel-5.24.orig/src/client.c +++ stunnel-5.24/src/client.c @@ -1100,6 +1100,8 @@ NOEXPORT SOCKET connect_local(CLI *c) { NOEXPORT SOCKET connect_local(CLI *c) { /* spawn local process */ char *name, host[40], port[6]; + char *env[10]; + int i, envc; int fd[2], pid; X509 *peer_cert; #ifdef HAVE_PTHREAD_SIGMASK @@ -1115,19 +1117,55 @@ NOEXPORT SOCKET connect_local(CLI *c) { } else if(make_sockets(fd)) longjmp(c->err, 1); + set_nonblock(fd[1], 0); /* switch back to blocking mode */ + + envc = 0; + + if(!getnameinfo(&c->peer_addr.sa, c->peer_addr_len, + host, 40, port, 6, NI_NUMERICHOST|NI_NUMERICSERV)) { + /* just don't set these variables if getnameinfo() fails */ + env[envc++] = str_printf("REMOTE_HOST=%s", host); + env[envc++] = str_printf("REMOTE_PORT=%s", port); + if(c->opt->option.transparent_src) { +#ifndef LIBDIR +#define LIBDIR "." +#endif +#ifdef MACH64 + env[envc++] = str_dup("LD_PRELOAD_32=" LIBDIR "/libstunnel.so"); + env[envc++] = str_dup("LD_PRELOAD_64=" LIBDIR "/" MACH64 "/libstunnel.so"); +#elif __osf /* for Tru64 _RLD_LIST is used instead */ + env[envc++] = str_dup("_RLD_LIST=" LIBDIR "/libstunnel.so:DEFAULT"); +#else + env[envc++] = str_dup("LD_PRELOAD=" LIBDIR "/libstunnel.so"); +#endif + } + } + + if(c->ssl) { + peer_cert=SSL_get_peer_certificate(c->ssl); + if(peer_cert) { + name=X509_NAME2text(X509_get_subject_name(peer_cert)); + env[envc++] = str_printf("SSL_CLIENT_DN=%s", name); + name=X509_NAME2text(X509_get_issuer_name(peer_cert)); + env[envc++] = str_printf("SSL_CLIENT_I_DN=%s", name); + X509_free(peer_cert); + } + } + + env[envc] = NULL; pid=fork(); c->pid=(unsigned long)pid; switch(pid) { case -1: /* error */ + for (i = 0; i < envc; i++) + str_free(env[i]); closesocket(fd[0]); closesocket(fd[1]); ioerror("fork"); longjmp(c->err, 1); case 0: /* child */ - tls_alloc(NULL, c->tls, NULL); /* reuse thread-local storage */ closesocket(fd[0]); - set_nonblock(fd[1], 0); /* switch back to blocking mode */ /* dup2() does not copy FD_CLOEXEC flag */ dup2(fd[1], 0); dup2(fd[1], 1); @@ -1135,36 +1173,6 @@ NOEXPORT SOCKET connect_local(CLI *c) { dup2(fd[1], 2); closesocket(fd[1]); /* not really needed due to FD_CLOEXEC */ - if(!getnameinfo(&c->peer_addr.sa, c->peer_addr_len, - host, 40, port, 6, NI_NUMERICHOST|NI_NUMERICSERV)) { - /* just don't set these variables if getnameinfo() fails */ - putenv(str_printf("REMOTE_HOST=%s", host)); - putenv(str_printf("REMOTE_PORT=%s", port)); - if(c->opt->option.transparent_src) { -#ifndef LIBDIR -#define LIBDIR "." -#endif -#ifdef MACH64 - putenv("LD_PRELOAD_32=" LIBDIR "/libstunnel.so"); - putenv("LD_PRELOAD_64=" LIBDIR "/" MACH64 "/libstunnel.so"); -#elif __osf /* for Tru64 _RLD_LIST is used instead */ - putenv("_RLD_LIST=" LIBDIR "/libstunnel.so:DEFAULT"); -#else - putenv("LD_PRELOAD=" LIBDIR "/libstunnel.so"); -#endif - } - } - - if(c->ssl) { - peer_cert=SSL_get_peer_certificate(c->ssl); - if(peer_cert) { - name=X509_NAME2text(X509_get_subject_name(peer_cert)); - putenv(str_printf("SSL_CLIENT_DN=%s", name)); - name=X509_NAME2text(X509_get_issuer_name(peer_cert)); - putenv(str_printf("SSL_CLIENT_I_DN=%s", name)); - X509_free(peer_cert); - } - } #ifdef HAVE_PTHREAD_SIGMASK sigemptyset(&newmask); sigprocmask(SIG_SETMASK, &newmask, NULL); @@ -1176,11 +1184,13 @@ NOEXPORT SOCKET connect_local(CLI *c) { signal(SIGTERM, SIG_DFL); signal(SIGQUIT, SIG_DFL); signal(SIGINT, SIG_DFL); - execvp(c->opt->exec_name, c->opt->exec_args); + execve(c->opt->exec_name, c->opt->exec_args, env); ioerror(c->opt->exec_name); /* execvp failed */ _exit(1); default: /* parent */ s_log(LOG_INFO, "Local mode child started (PID=%lu)", c->pid); + for (i = 0; i < envc; i++) + str_free(env[i]); closesocket(fd[1]); return fd[0]; }

2 2

Re: [stunnel-users] (no subject)
by Adrián Mihálko 10 Oct '15

10 Oct '15

Some good news, I remove client = yes as you suggested: 2015.10.09 12:39:29 LOG5[main]: Configuration successful 2015.10.09 12:39:29 LOG5[main]: Logging to C:\Users\adrianmihalko\AppData\Local\stunnel.log 2015.10.09 12:39:34 LOG6[57]: SSL socket closed (SSL_read) 2015.10.09 12:39:34 LOG5[57]: Connection closed: 0 byte(s) sent to SSL, 445 byte(s) sent to socket 2015.10.09 12:39:34 LOG5[60]: Service [myservice] accepted connection from 192.168.1.25:49671 2015.10.09 12:39:34 LOG6[60]: SSL accepted: new session negotiated 2015.10.09 12:39:34 LOG6[60]: No peer certificate received 2015.10.09 12:39:34 LOG6[60]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES128-GCM-SHA256 (128-bit encryption) 2015.10.09 12:39:34 LOG6[60]: failover: round-robin, starting at entry #0 2015.10.09 12:39:34 LOG6[60]: s_connect: connecting ::1:41952 2015.10.09 12:39:34 LOG5[60]: s_connect: connected ::1:41952 2015.10.09 12:39:34 LOG6[60]: persistence: ::1:41952 cached 2015.10.09 12:39:34 LOG5[60]: Service [myservice] connected remote server from ::1:50598 2015.10.09 12:39:34 LOG6[60]: SSL socket closed (SSL_read) 2015.10.09 12:39:34 LOG5[60]: Connection closed: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2015.10.09 12:39:34 LOG5[61]: Service [myservice] accepted connection from 192.168.1.25:49672 2015.10.09 12:39:34 LOG6[61]: SSL accepted: new session negotiated 2015.10.09 12:39:34 LOG6[61]: No peer certificate received 2015.10.09 12:39:34 LOG6[61]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES128-GCM-SHA256 (128-bit encryption) 2015.10.09 12:39:34 LOG6[61]: failover: round-robin, starting at entry #1 2015.10.09 12:39:34 LOG6[61]: s_connect: connecting 127.0.0.1:41952 2015.10.09 12:39:34 LOG5[61]: s_connect: connected 127.0.0.1:41952 2015.10.09 12:39:34 LOG6[61]: persistence: 127.0.0.1:41952 cached 2015.10.09 12:39:34 LOG5[61]: Service [myservice] connected remote server from 127.0.0.1:50599 openssl_client log: http://pastebin.com/7bg3sf7J The problem is now that the site loads forever, nothing happens. (this certificate (:1988) is other than the original (:41952). This is not problem? curl test: $ curl https://192.168.1.17:1988/DYMO/DLS/Printing/Check -vk * Trying 192.168.1.17... * Connected to 192.168.1.17 (192.168.1.17) port 1988 (#0) * TLS 1.2 connection using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 * Server certificate: localhost > GET /DYMO/DLS/Printing/Check HTTP/1.1 > Host: 192.168.1.17:1988 > User-Agent: curl/7.43.0 > Accept: */* > waiting forever. 2015-10-09 12:34 GMT+02:00 Adrián Mihálko <adriankoooo(a)gmail.com>: > In the first mail I wrote ports bad, of course in the log I am using the > good ones. > > [myservice] > cert = stunnel.pem > client = yes > accept = 0.0.0.0:1988 > connect = localhost:41952 > > > 2015-10-09 12:32 GMT+02:00 Adrián Mihálko <adriankoooo(a)gmail.com>: > >> Sorry, curl was only for testing. >> >> Adrians-MacBook-Pro:~ adrianmihalko$ openssl s_client -connect >> 192.168.1.17:1988 >> CONNECTED(00000003) >> 1130:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown >> protocol:/BuildRoot/Library/Caches/com.apple.xbs/Sources/OpenSSL098/OpenSSL098-59/src/ssl/s23_clnt.c:618: >> >> 2015.10.09 12:23:21 LOG5[main]: Reading configuration from file >> stunnel.conf >> 2015.10.09 12:23:21 LOG5[main]: UTF-8 byte order mark detected >> 2015.10.09 12:23:21 LOG5[main]: FIPS mode disabled >> 2015.10.09 12:23:21 LOG6[main]: Initializing service [gmail-pop3] >> 2015.10.09 12:23:21 LOG6[main]: Initializing service [gmail-imap] >> 2015.10.09 12:23:21 LOG6[main]: Initializing service [gmail-smtp] >> 2015.10.09 12:23:21 LOG6[main]: Initializing service [myservice] >> 2015.10.09 12:23:21 LOG6[main]: Loading certificate from file: stunnel.pem >> 2015.10.09 12:23:21 LOG6[main]: Loading key from file: stunnel.pem >> 2015.10.09 12:23:21 LOG4[main]: Service [myservice] needs authentication >> to prevent MITM attacks >> 2015.10.09 12:23:21 LOG5[main]: Configuration successful >> 2015.10.09 12:23:21 LOG5[main]: Logging to >> C:\Users\adrianmihalko\AppData\Local\stunnel.log >> 2015.10.09 12:23:42 LOG5[39]: Service [myservice] accepted connection >> from 192.168.1.25:49454 >> 2015.10.09 12:23:42 LOG6[39]: failover: round-robin, starting at entry #0 >> 2015.10.09 12:23:42 LOG6[39]: s_connect: connecting ::1:41952 >> 2015.10.09 12:23:42 LOG5[39]: s_connect: connected ::1:41952 >> 2015.10.09 12:23:42 LOG5[39]: Service [myservice] connected remote server >> from ::1:50564 >> 2015.10.09 12:23:42 LOG6[39]: SNI: sending servername: localhost >> 2015.10.09 12:23:42 LOG6[39]: Certificate verification disabled >> 2015.10.09 12:23:42 LOG6[39]: Certificate verification disabled >> 2015.10.09 12:23:42 LOG6[39]: SSL connected: new session negotiated >> 2015.10.09 12:23:42 LOG6[39]: Negotiated TLSv1 ciphersuite AES128-SHA >> (128-bit encryption) >> 2015.10.09 12:23:42 LOG6[39]: SSL socket closed (SSL_read) >> 2015.10.09 12:23:42 LOG5[39]: Connection closed: 130 byte(s) sent to SSL, >> 505 byte(s) sent to socket >> >> If I am connecting to the :41952: >> >> openssl s_client -connect 192.168.1.17:41952 >> ... >> >> --- >> No client certificate CA names sent >> --- >> SSL handshake has read 1724 bytes and written 712 bytes >> --- >> New, TLSv1/SSLv3, Cipher is AES128-SHA >> Server public key is 4096 bit >> Secure Renegotiation IS supported >> Compression: NONE >> Expansion: NONE >> SSL-Session: >> Protocol : TLSv1 >> Cipher : AES128-SHA >> ... >> >> >> 2015-10-09 10:55 GMT+02:00 test rig <testrig(a)z1p.biz>: >> >>> >>> Ouch #2 missing... >>> >>> Hi Adrian, looks good to me so far - mostly. Try to replace the >>> client=yes with a client=no on the server >>> >>> You are connection to :9999 with curl(?) >>> Try verify it via "openssl s_client -connect yourserverip:1988" command >>> >>> Best Regards >>> Michael >>> >>> --- Ursprüngliche Nachricht --- >>> *Von:* "test rig" <testrig(a)z1p.biz> >>> *Datum:* 09.10.2015 09:48:02 >>> *An:* "stunnel-users(a)stunnel.org." <stunnel-users(a)stunnel.org> >>> *Betreff:* Re: [stunnel-users] (no subject) >>> >>> Hi Adrian, looks good to me so far - mostly. Try to replace the >>> client=yes with a client=no on the server >>> >>> --- Ursprüngliche Nachricht --- >>> *Von:* Adrián Mihálko >>> *Datum:* 09.10.2015 08:15:19 >>> *An:* stunnel-users(a)stunnel.org >>> *Betreff:* [stunnel-users] (no subject) >>> >>> Dear stunnel users, >>> >>> I have a little service which listen only on https://localhost:4952 and >>> checks source hostname. I want to connect on "listen:1988" and redirect >>> requests with stunnel to "localhost:4952" >>> >>> https://192.168.1.10:1988 -> redirect https://localhost:4952 >>> >>> >>> I am trying to configure stunnel like this >>> >>> [myservice] >>> cert = stunnel.pem >>> client = yes >>> accept = 0.0.0.0:1988 >>> connect = localhost:4952 >>> >>> remote machine$ curl https://192.168.1.25:9999/DYMO/DLS/Printing/Check >>> -v >>> * Trying 192.168.1.25... >>> * Connected to 192.168.1.25 (192.168.1.25) port 9999 (#0) >>> * WARNING: using IP address, SNI is being disabled by the OS. >>> * Unknown SSL protocol error in connection to 192.168.1.25:-9847 >>> * Closing connection 0 >>> curl: (35) Unknown SSL protocol error in connection to 192.168.1.25: >>> -9847 >>> >>> stunnel.log: >>> 2015.10.09 09:05:42 LOG5[38]: Service [myservice] accepted connection >>> from 192.168.1.24:60748 >>> 2015.10.09 09:05:42 LOG6[38]: failover: round-robin, starting at entry #1 >>> 2015.10.09 09:05:42 LOG6[38]: s_connect: connecting 127.0.0.1:41952 >>> 2015.10.09 09:05:42 LOG5[38]: s_connect: connected 127.0.0.1:41952 >>> 2015.10.09 09:05:42 LOG5[38]: Service [myservice] connected remote >>> server from 127.0.0.1:50503 >>> 2015.10.09 09:05:42 LOG6[38]: SNI: sending servername: localhost >>> 2015.10.09 09:05:42 LOG6[38]: Certificate verification disabled >>> 2015.10.09 09:05:42 LOG6[38]: Certificate verification disabled >>> 2015.10.09 09:05:42 LOG6[38]: SSL connected: new session negotiated >>> 2015.10.09 09:05:42 LOG6[38]: Negotiated TLSv1 ciphersuite AES128-SHA >>> (128-bit encryption) >>> 2015.10.09 09:05:42 LOG6[38]: SSL socket closed (SSL_read) >>> 2015.10.09 09:05:42 LOG5[38]: Connection closed: 230 byte(s) sent to >>> SSL, 505 byte(s) sent to socket >>> >>> I am tried verify = 1 to 4, either works. :( >>> >>> Best Regards, >>> Adrian >>> >>> >>> >>> ______________________________________________________ >>> powered by Perfect-Privacy.com / Secure-Mail.biz - anonymous and secure >>> internet. >>> >>> >>> >>> ______________________________________________________ >>> powered by Perfect-Privacy.com / Secure-Mail.biz - anonymous and secure >>> internet. >>> >>> _______________________________________________ >>> stunnel-users mailing list >>> stunnel-users(a)stunnel.org >>> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >>> >>> >> >

3 6

(no subject)
by Adrián Mihálko 09 Oct '15

09 Oct '15

Dear stunnel users, I have a little service which listen only on https://localhost:4952 and checks source hostname. I want to connect on "listen:1988" and redirect requests with stunnel to "localhost:4952" https://192.168.1.10:1988 -> redirect https://localhost:4952 I am trying to configure stunnel like this [myservice] cert = stunnel.pem client = yes accept = 0.0.0.0:1988 connect = localhost:4952 remote machine$ curl https://192.168.1.25:9999/DYMO/DLS/Printing/Check -v * Trying 192.168.1.25... * Connected to 192.168.1.25 (192.168.1.25) port 9999 (#0) * WARNING: using IP address, SNI is being disabled by the OS. * Unknown SSL protocol error in connection to 192.168.1.25:-9847 * Closing connection 0 curl: (35) Unknown SSL protocol error in connection to 192.168.1.25:-9847 stunnel.log: 2015.10.09 09:05:42 LOG5[38]: Service [myservice] accepted connection from 192.168.1.24:60748 2015.10.09 09:05:42 LOG6[38]: failover: round-robin, starting at entry #1 2015.10.09 09:05:42 LOG6[38]: s_connect: connecting 127.0.0.1:41952 2015.10.09 09:05:42 LOG5[38]: s_connect: connected 127.0.0.1:41952 2015.10.09 09:05:42 LOG5[38]: Service [myservice] connected remote server from 127.0.0.1:50503 2015.10.09 09:05:42 LOG6[38]: SNI: sending servername: localhost 2015.10.09 09:05:42 LOG6[38]: Certificate verification disabled 2015.10.09 09:05:42 LOG6[38]: Certificate verification disabled 2015.10.09 09:05:42 LOG6[38]: SSL connected: new session negotiated 2015.10.09 09:05:42 LOG6[38]: Negotiated TLSv1 ciphersuite AES128-SHA (128-bit encryption) 2015.10.09 09:05:42 LOG6[38]: SSL socket closed (SSL_read) 2015.10.09 09:05:42 LOG5[38]: Connection closed: 230 byte(s) sent to SSL, 505 byte(s) sent to socket I am tried verify = 1 to 4, either works. :( Best Regards, Adrian

2 3

Stunnel for windows dependencies
by test rig 09 Oct '15

09 Oct '15

2 2

stunnel 5.24 released
by Michal Trojnara 08 Oct '15

08 Oct '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear Users, I have released version 5.24 of stunnel. The ChangeLog entry: Version 5.24, 2015.10.08, urgency: MEDIUM * New features - Custom CRL verification was replaced with the internal OpenSSL functionality. - *BSD support for "transparent = destination" and client-side "protocol = socks". This feature should work at least on FreeBSD, OpenBSD and OS X. - Added a new "protocolDomain" option for the NTLM authentication (thx to Andreas Botsikas). - Improved compatibility of the NTLM phase 1 message (thx to Andreas Botsikas). - "setuid" and "setgid" options are now also available in service sections. They can be used to set owner and group of the Unix socket specified with "accept". - Added support for the new OpenSSL 1.0.2 SSL options. - Added OPENSSL_NO_EGD support (thx to Bernard Spil). - VC autodetection added to makew32.bat (thx to Andreas Botsikas). * Bugfixes - Fixed the RESOLVE [F0] TOR extension support in SOCKS5. - Fixed the error code reported on the failed bind() requests. - Fixed the sequential log id with the FORK threading. - Restored the missing Microsoft.VC90.CRT.manifest file. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: ab2e5a1034d422951ddad21b572eb7fa8efb4c4ce04bc86536c6845f3d02b07e stunnel-5.24.tar.gz f6c38d51c2708f3eddbad651091bf0b59e4149a1d0c1e3b227b033f126c6dbee stunnel-5.24-installer.exe ed2a2c5f280970bd5f5efcecbc1dbbd06f66efb68102af31c27d33e3beb48bb5 stunnel-5.24-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWFoHsAAoJEC78f/DUFuAUQrAP/iUz2fHvvjkIcJvoR2kMeJfZ NFHE/zGIP6qHbf5Fe5SvOA/ygzQcBppa+FJN9S0uL5z0rLkDghqeWoFzPfLIVrfM y2IJ4SZ1HEESyjaZkCxY0C7Ow1kKdlMPLHv81p+Tk/Zm4qKJ/lIkP+q7XMbNmWjW BOYBLeWPtro1OjKm7v07VkzRGJupj1PHjUgPDAQRxdzqsl6fO7xY9n8b9Nh7Cwc2 1mJhsx8J40M7abftYwpG6Mycu2EOo0lIJ9rm6xZahyekzatsaIhlw2o5gx5GWJvN xj9zpkxntTVQysgP4QVdJZ+Kl17ZZmOS4k+3OqXDgdt51Ck2ty46y9NbhkulIUA8 BzH3KXZCaiBFb/sPdBtW8qmvv0azJLR0b1HfKsZQrtIB/SH0slB9rgsLkidjekKG n7FHf5dlncfAbf8KstJRv41PTYcbtQMGI/+sre2YsqG2/MSJgPfCL2Wj0bTOSmOR 7t6jHX6SItnWtAJ4+3yhlh33B4WYOYBbu3FA3Pw7Wgxur9AOV63MH/Mf96KdMFGS dqoLQh+fp/KoSw1A9OUREtQnxHnbF5MMoU4Z1pTO0FxvdCMnYCg4okiwLqbOKcuM J0T543Deq9XU7v9jDkcgUyQzBYU8lG+G9UdSH11B8phuP7pBUQ35cd62Fl9NWv9I zNjRZIOnbBp6F6hqilb4 =F+az -----END PGP SIGNATURE-----

1 0

Log File Not Appending
by K Monz 06 Oct '15

06 Oct '15

Hi, I am a new STUNNEL user, so I apologize if this is a ridiculously simple and insignificant problem. I have STUNNEL running in a Windows 7 (32 bit) environment, and have the following in stunnel.conf: output = C:\STUNNEL\stunnel.log log = append The log file is placed where I've asked, but the contents represent only the most current STUNNEL execution. I am trying to have a running log in this file. STUNNEL is, of course, doing what it is supposed to do, it is only the logging that has me puzzled. Thanks, in advance.

2 1

Error on Windows 2008r2
by Chris 01 Oct '15

01 Oct '15

Just downloaded and installed the latest windows version. When trying to run stunnel I get the following error: The application has failed to start because its side-by-side configuration is incorrect..... When I check the application event view logs I see "Activation context generation failed for "C:\Program Files (x86)\stunnel\bin\stunnel.exe". Dependent Assembly Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8" could not be found. Please use sxstrace.exe for detailed diagnosis." It seems I might be missing a pre-req but I can't not determine what that is. Any ideas? Thanks, Chris

1 0

Support for DTLS
by Kanungo, Rajesh 25 Sep '15

25 Sep '15

Hi, I am looking for support for a DTLS proxy. Does Stunnel support DTLS and, if yes, how do I configure it? Here is the scenario: 1. Remote Server supports DTLS. 2. My client does not support DTLS (yet). Support all our platforms is a pretty arduous task. Possible solutions: 1. Ask customer to use Stunnel, drop DTLS and use plain UDP, and use Stunnel/TCP. Other clients support only DTLS so this does not work. 2. Use VPN. Requires customer configuration. Less painful than 1. 3. Use a UDP-DTLS proxy. Regards Rajesh Kanungo North America Security CTO Department, Itron, Inc. (408) 431-3035 Rajesh.kanungo(a)itron.com

1 0

Missing pid from log file since ~5.19
by Philippe Anctil 17 Sep '15

17 Sep '15

Hi, After upgrading to stunnel 5.19 I noticed the log file no long reports the pid of stunnel processes. Instead I find the constant string [0]. Sep 14 12:15:30 hostname stunnel: LOG6[0]: SSL closed (SSL_read) This information is very useful to isolate individual connections. Do later stunnel versions report the pid correctly? I am using fork mode. My syslog is defined as local6.debug and stunnel.conf contains debug=local6.info. Thank you. -- Philippe Anctil

2 3

How to install CA at client side?
by MingHeng Wang 15 Sep '15

15 Sep '15

Hello Stunnel maintainers, I try to use real certificates of my web server for stunnel. I combine private key, my site's cert, and ca-bundle into a pem file, and it works fine when the client doesn't verify any certificate. Then I specify CAfile which is the ca bundle file from my registrar, at client side and turn on verification and always get errors below, whatever level 2 or 3: Sep 15 14:53:28 y400 stunnel[11666]: LOG5[11]: Service [http-proxy3] connected remote server from 192.168.1.104:45746 Sep 15 14:53:28 y400 stunnel[11666]: LOG4[11]: CERT: Pre-verification error: unable to get issuer certificate Sep 15 14:53:28 y400 stunnel[11666]: LOG4[11]: Rejected by CERT at depth=2: However, level 4 works. I want to prevent man-in-middle-attack, so can level 4 achieve that regarding to my current setup? Both server and client side use stunnel 5.17 which are fairly recent.

2 1

Windows 2012 R2 Error on startup
by Han-Earl Guhm 13 Sep '15

13 Sep '15

I installed the latest version of stunnel and am having problems starting it up. I have attached an error log and my config file. I tested on Windows 7 and it worked with no problems, but I would really like it to work on my Windows 2012 server. Thank you, Han-Earl Guhm Coventry Christian Schools hanguhm(a)educatingforlife.com

2 1

The Error with Engine
by Donne, Ann 08 Sep '15

08 Sep '15

Hi all, Need your help. When I configured the Stunnel without the Engine LunaCA3 (product from SafeNet), everything worked fine. After add the global option with the engine: engine=LunaCA3 engineCtrl=SO_PATH:/usr/local/ssl/lib/engines/liblunaca3.so I got the following error. I also searched previous engine issues and saw someone else with the similar issues. Hope that the issue was resolved. The Stunnel and the open SSL info: stunnel 5.20 on x86_64 Linux. Compiled/running with OpenSSL 1.0.1i-fips. The setting is for server with sslVersion = TLSv1 and ciphers = AES128-SHA. 2015.09.08 11:11:01 LOG7[0]: SSL state (accept): SSLv3 read client certificate A 2015.09.08 11:11:01 LOG7[0]: SSL state (accept): SSLv3 read client key exchange A 2015.09.08 11:11:01 LOG7[0]: SSL state (accept): SSLv3 read certificate verify A 2015.09.08 11:11:01 LOG7[0]: SSL alert (write): fatal: bad record mac 2015.09.08 11:11:01 LOG3[0]: SSL_accept: 1408F119: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2015.09.08 11:11:01 LOG5[0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2015.09.08 11:11:01 LOG7[0]: Deallocating application specific data for addr index 2015.09.08 11:11:01 LOG7[0]: Local socket (FD=3) closed Any help and info are greatly appreciated!! Thanks Ann Donne ---------------------------------------------------------------------- This message, and any attachments, is for the intended recipient(s) only, may contain information that is privileged, confidential and/or proprietary and subject to important terms and conditions available at http://www.bankofamerica.com/emaildisclaimer. If you are not the intended recipient, please delete this message.

1 0

stunnel 5.23 released
by Michal Trojnara 02 Sep '15

02 Sep '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear Users, I have released version 5.23 of stunnel. The ChangeLog entry: Version 5.23, 2015.09.02, urgency: LOW * New features - Client-side support for the SOCKS protocol. See https://www.stunnel.org/socksvpn.html for details. - Reject SOCKS requests to connect loopback addresses. - New service-level option "OCSPnonce". The default value is "OCSPnonce = no". - Win32 directory structure rearranged. The installer script provides automatic migration for common setups. - Added Win32 installer option to install stunnel for the current user only. This feature does not deploy the NT service, but it also does not require aministrative privileges to install and configure stunnel. - stunnel.cnf was renamed to openssl.cnf in order to to prevent users from mixing it up with stunnel.conf. - Win32 desktop is automatically refreshed when the icon is created or removed. - The ca-certs.pem file is now updated on stunnel upgrade. - Inactive ports were removed from the PORTS file. - Added IPv6 support to the transparent proxy code. * Bugfixes - Compilation fix for OpenSSL version older than 1.0.0. - Compilation fix for mingw. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 0fc4a702afd2e857bae8ad1f39c51546eb282c3d0ff4f4d55d62aece7328ddea stunnel-5.23.tar.gz 40739ac4124bbe5192d7f68b020758295586ae65a16c1612829bffd1d3873363 stunnel-5.23-installer.exe 001e7d0a6d53b05b64fe62b0ca0623077d89f090b473e2cabed1eafa49196725 stunnel-5.23-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJV5q76AAoJEC78f/DUFuAUG54P/2ycqSOKbP3CN1MMKJj9NxBM 1uDuv/voF9OT/Y064X2bjy6dApo5HA9a4VHr1EaF+3x+Wofemhc5puLsgbfuFJKl nogN8cNdR2sk+GLooytfKp+jRZ8NAl2Rv5lLi/YE57RsMe91wI5kRxWKpeIDeG4L y7LhsCLmHNYkffsGSeOaXfc3rBBWOY39Lc78t3kezK14jIGZiCH/V32HRHMaWGiw 9oLBIRxGOVAscKcC2+MOGtXelKeJFrnAfW+v6qcZE1/SL4JnGHz8jBxOcvFbfrko 5yJfWYpgQg7NeLNovY+o1EXVxxw4Ty9ppLob9cRTGmx1Fgb6eE1uYVSAbx53lYKF 2z0J2MkKgMj07Mao5j45DiqRqa/kWDzKIN4sTCm5atDKB2ozrcfuDLLEU3W6XKrw 7XHPSs+FdkXQXYsfK7wbftLKfNEu8ojGKyMTMuKQcX/SkxyQuV6rYXA8gBm3HJCY dNp5lU5FdoiMv9S+uQpDL2j9GjOSNAV7qPzyRk8ivl1a1LonkbjQxHApvktSwkHt Gey6xweW5vt7FsKb15mFhx6ctBldM9lR7u4EacXWy+hq5UY6/5Rr/rbyCkCvG/NU Oq5LD2bqX22Xl4XeiVCW2gpLcqPWdbREY3YklGt22ln+PdyA+iGpxbeczUHjV5qX a6P76JpGk/pL5lhWfRV4 =i2gK -----END PGP SIGNATURE-----

1 0

(no subject)
by Eric Poythress 02 Sep '15

02 Sep '15

I am having some issues with getting Stunnel to work for my application. I'm using a logger that is able to email out alarms but it is not encrypted. I have Stunnel on the PC that connects to the logger. Both are able to see each other just fine but I have the following error in the log: Service [SMTP Outgoing] needs authentication to prevent MITM attacks I only want mail to go out and on the logger side of things my only inputs are SMTP Server, Use SMTP Authentication check box, Username, Password and Port. Any help or suggests would be greatly appreciated. Thank you, Eric Poythress Test Manager 1600 West Tacoma Street Broken Arrow, Oklahoma 74012 [Description: Air Hygiene Office - email signature] Direct - (918) 994-4171 Fax - (918) 307-9131 Mobile - (573) 587-0226 Toll Free - (888) 461-8778 virtual tour Air Hygiene: http://host.newspin360.net/airhygiene/ e-mail: epoythress(a)airhygiene.com<mailto:[email protected]> website: www.airhygiene.com<http://www.airhygiene.com/>

2 3

Security suggestions on stunnel with SSL/TLS and SNI configuration
by Secure-Mail User 28 Aug '15

28 Aug '15

2 2

Re: [stunnel-users] stunk closing connections with RST
by Ade Ajibade 26 Aug '15

26 Aug '15

> > Hi All, > > I am having the same problem in my lab. > > I am trying to set up a secure connection between my Bluecoat proxy and stunnel running on windows. I need to encrypt the connection between the 2 devices. > > I am new to stunnel. > > My Bluecoat is configured to do health checks to the stunnel on the specified stunnel port. However every now and again, it reports the server is down. Looking at the capture, I can see the stunnel is sending RESETS back to the proxy. > > The TLS connection to the proxy appears to be working fine. But I need to be able to monitor the servers health. > > How do I do this? > > You have mentioned in your post the stunnel configured of client = yes. > > On what side does this need to be configured and what exactly does this mean? If it is configured as client = no what will be the implication. > > I have been looking at how you solved the F5 issue but how does that apply to what I am doing from my proxy. > > Please any help will be useful. I just subscribed to your site. > > Thank you > > > > Adekunle

1 0

New Windows installer
by Michal Trojnara 19 Aug '15

19 Aug '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have performed a major rewrite of the stunnel installer for Windows. It now allows installing stunnel for all users (as before), and also for the current user (in the user's home directory). It also no longer installs all the files into a single directory. The installer attempts to automatically migrate the previous layout into the new one. https://www.stunnel.org/downloads/beta/stunnel-5.23b4-installer.exe Please give it a try and let me know your comments and any bugs you can find. Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVziEpAAoJEC78f/DUFuAUFFIP/1CN9Bh5PFvpUlmnC67exLA4 CfPLXK4jj3PjFISF3scKAGJJjaCmyWQzF3mmTTn5HXprCfwOtZXf3jJQVI0YFZjE 8OgxpdcWhAyuOr2wQLSs5DX+WBILuxHBpIIJrjYIlrAsKMwmB7ucLHf17K+AkCjb j++ctJdFDQygpX0w9Qp0oyIbiEGlgaFHAn/aeYKdLSzTGaDkTptswMsM+SZzNcHF bK9VxQ15xFE6EwOp45roxc7eMuOd6VGQ9uyj1DcLaHygE0m5ALzXFN2Xsnii9UIq ZbzoOMBYlGYAya8Hbgrrb3D+53CwwQrhjVgE27FbMp3qc4ijboaBlfSzd+Bci3Rg B84EkJjBNC1cOcl5JvB/QAuJgXReBbFecS5+8PYNTzii6HU4bFXKb9JlbxCA7eGm HiCkn+DM4GJ3RXtWYjcyWfhlgCx69SUaEJvtphHl9QLbyGnDsJTE7rLlmpnp4B2N MNvZFhxuZrBsMmDRydQSYKaJ7S5e9H6soi630OfLxHDIbOGD+vDVvO9XrjtdYWBO 6Fm4ed0lDuTcqTzCxy93vbwPkWzvPyOykQPCED/UQ1RgtC8AIi6JVXhCwLs30pwj rSHgBKGxC5E19MXYwrNq3cr0nJdkw4oh8NShaXiplfhdCMdjRZHZz1HpbQzW0WP/ Z5BrUzv9yYpA/aAk4r7V =RSFJ -----END PGP SIGNATURE-----

2 3

net::ERR_TIMED_OUT error when connecting to a websocket via stunnel
by Mike Alhayek 17 Aug '15

17 Aug '15

Hi, I hope someone can help me here as I have been stuck for the past 3 days. I need to allow a client to connect to a websocket running on server 10.0.4.160 on port 8080. I need to setup a secure tunnel to allow the client to connect to the websocket via port 58443. I installed the latest version of stunnel on my windows Server 2008 R2. Then I changed my stunnel.conf file to look like this [websockets] client = yes accept = 58443 connect = 8080 verify = 2 checkIP = 10.0.4.195 CAfile = ca-certs.pem debug = 7 OCSPaia = yes ##The rest have been removed I am expecting to open a connection from the user's console on port 58443 and the stunnel will allow the client to connect to port 8080 This is the code that I use in the client's console "Of course, the console is on a PC that is on my internal network" var conn = new WebSocket('wss://10.0.4.160:58443'); conn.onopen = function(e) { console.log("Connection established!"); }; conn.onmessage = function(e) { console.log(e.data); }; While on the server, I open up a command line and I execute this telnet localhost 8080 to open up a command line where I can see the incoming request. As soon as I fire the code above from a client javascript's console I see this in the server's command line [cid:[email protected]] But few seconds later I get this error in the client's console WebSocket connection to 'wss://10.0.4.160:58443/' failed: Error in connection establishment: net::ERR_TIMED_OUT If I try to send a command using conn.sent('Hello') I get this error VM289:2 Uncaught DOMException: Failed to execute 'send' on 'WebSocket': Still in CONNECTING state. at Error (native) at <anonymous>:2:6 at Object.InjectedScript._evaluateOn (<anonymous>:905:140) at Object.InjectedScript._evaluateAndWrap (<anonymous>:838:34) at Object.InjectedScript.evaluate (<anonymous>:694:21) Additionally, I tried to turn on debugging in strunnel by adding debug = 7 to the config file This is what I got in the stunnel console. I don't understand what is wrong as the logs show that the client is connected but I can't send messages from the client to the server 2015.08.16 16:40:06 LOG7[36]: Service [websockets] started 2015.08.16 16:40:06 LOG5[36]: Service [websockets] accepted connection from 10.0.4.195:21963 2015.08.16 16:40:06 LOG6[36]: s_connect: connecting 127.0.0.1:8080 2015.08.16 16:40:06 LOG7[36]: s_connect: s_poll_wait 127.0.0.1:8080: waiting 10 seconds 2015.08.16 16:40:06 LOG5[36]: s_connect: connected 127.0.0.1:8080 2015.08.16 16:40:06 LOG5[36]: Service [websockets] connected remote server from 127.0.0.1:50891 2015.08.16 16:40:06 LOG7[36]: Remote socket (FD=668) initialized 2015.08.16 16:40:06 LOG6[36]: SNI: sending servername: localhost 2015.08.16 16:40:06 LOG7[36]: SSL state (connect): before/connect initialization 2015.08.16 16:40:06 LOG7[36]: SSL state (connect): SSLv2/v3 write client hello A What am I doing wrong here? How come the connection keeps failing?

1 0

Accept connection from sub-net?
by v v 12 Aug '15

12 Aug '15

Hi, Is it possible to configure stunnel server to accept connection from any IP in some subnet. For example, 111.22.33.xx. The proxy I connect through every time uses the different IP (from some IP pool) to connect to stunnel server. I don't want to add to the config file 255 possible host addresses. I don't see any suitable option in the stunnel documentation. Do I miss something? Any idea it could be done? Thanks, vov

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users