- stunnel-users - stunnel.org

Stunnel server as transparent proxy
by Derek Cole 28 Oct '14

28 Oct '14

Hello, Is it possible to use stunnel server as a transparent proxy? I was digging through the manpage and I see the transparent= option. What I would like to do is have an stunnel client connect to the stunnel server, and once traffic is at the server, go to the original destination that the traffic going to the stunnel client was destined for. I.E. Can I have firefox proxy to my stunnel client, which connects to my stunnel server, and then that traffic goes to whatever website the end user was trying to hit in firefox? My Stunnel server is on a CentOS box: [root@CentOSTunTest ~]# uname -a Linux CentOSTunTest 2.6.32-431.el6.x86_64 #1 SMP Fri Nov 22 03:15:09 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux And my stunnel.conf foreground = yes > debug = 7 > options = NO_SSLv2 > fips = no > output=/usr/local/etc/stunnel/stunnel.log > > > [https] > cert=/usr/local/etc/stunnel/stunnel.pem > accept = 443 > connect = 80 > > [Internet] > cert=/usr/local/etc/stunnel/stunnel.pem > sni = https:Internet > transparent=destination > So basically in the transparent option is Internet is what I am wondering if it works the way I expect. I see this in the log file: 2014.10.23 09:57:05 LOG3[11414]: setsockopt SO_ORIGINAL_DST: Protocol not available (92) 2014.10.23 09:57:05 LOG5[11414]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket I see this in the stunnel manpage: For a connect target installed on the same host: /sbin/iptables -t nat -I OUTPUT -p tcp --dport <redirected_port> \ -m ! --uid-owner <stunnel_user_id> \ -j DNAT --to-destination <local_ip>:<stunnel_port> For a connect target installed on a remote host: /sbin/iptables -I INPUT -i eth0 -p tcp --dport <stunnel_port> -j ACCEPT /sbin/iptables -t nat -I PREROUTING -p tcp --dport <redirected_port> \ -i eth0 -j DNAT --to-destination <local_ip>:<stunnel_port> What does it mean "for a connect target installed on the same host" I thought transparent meant I was not using a connect target except the original destination. Does this mean I should implement the IPTables for a remote host, since I want my client to just reach the internet? Thanks for the help in advance!

2 4

VS 2010 compilation issue due to shfolder.h
by nnposter＠users.sourceforge.net 28 Oct '14

28 Oct '14

I am running into a compilation problem on MS C/C++ 16 (aka VS 2010). Specifically, I am getting the following error due to an include that has been added in 5.01: C:\Program Files (x86)\Microsoft SDKs\Windows\v7.0A\include\shfolder.h(14) : fatal error C1189: #error : shfolder.h/shfolder.lib provide platform independence with versions prior to Windows 2000. Use shlobj.h/shell32.lib if targetting Windows 2000 or higher. The following primitive patch seems to address the issue: --- common.h.orig 2014-10-02 04:12:48.000000000 -0600 +++ common.h 2014-10-27 16:02:22.536329500 -0600 @@ -228,7 +228,13 @@ #include <windows.h> #include <process.h> /* _beginthread */ + +#if defined _MSC_VER && _MSC_VER >= 1600 +#include <shlobj.h> /* SHGetFolderPath */ +#else #include <shfolder.h> /* SHGetFolderPath */ +#endif + #include <tchar.h> #include "resources.h" Cheers, nnposter

2 1

stunnel-5.06 fails to build against systemd 215
by Anthony G. Basile 24 Oct '14

24 Oct '14

Hi everyone, We hit a bug in stunnel-5.05 and it continues in 5.06. The problem comes from systemd which moved sd_listen_fds() form libsystemd-daemon.so to libsystemd.so. However, stunnel's configure.ac still has AC_SEARCH_LIBS([sd_listen_fds], [systemd-daemon]) For backwards compatibility, this should probably be AC_SEARCH_LIBS([sd_listen_fds], [systemd], [], [ AC_SEARCH_LIBS([sd_listen_fds], [systemd-daemon]) ]) or similar. Please refer to our downstream bug: https://bugs.gentoo.org/show_bug.cgi?id=525234' Thanks. -- Anthony G. Basile, Ph. D. Chair of Information Technology D'Youville College Buffalo, NY 14201 (716) 829-8197

2 5

stunnel service leaves stale connections to rsync on the server side
by Polyack, Steve 22 Oct '14

22 Oct '14

Hi, We've been running a rsync service over stunnel for some time now. After upgrading our environment, which involved moving from an old version of Linux to FreeBSD 9.3, and from stunnel-4.29 to stunnel-5.06, we've had a problem pop up. Ever since switching over, we see that rsync daemon processes slowly build up over time on our server, each consuming 100% CPU. The vast majority of our clients are working just fine, and the problematic rsync processes just seem to have been dead/aborted connections from the clients (which are using wireless aircard, so connectivity can be shotty). A quick 'truss' on the process shows they are doing nothing but sitting there and read()'ing in a loop indefinitely: # truss -p 14689 | head read(6,0x7fffffff8240,1) = 0 (0x0) read(6,0x7fffffff8240,1) = 0 (0x0) read(6,0x7fffffff8240,1) = 0 (0x0) read(6,0x7fffffff8240,1) = 0 (0x0) read(6,0x7fffffff8240,1) = 0 (0x0) read(6,0x7fffffff8240,1) = 0 (0x0) Furthermore, the connection appears to be closed: # sockstat -4 | grep 14689 root rsync 14689 3 tcp4 127.0.0.1:873 127.0.0.1:27724 netstat -an | grep 27724 netstat: kvm not available: /dev/mem: No such file or directory tcp4 0 0 127.0.0.1.873 127.0.0.1.27724 CLOSED Looking through the stunnel logs, it looks like no data was ever really passed (perhaps the client gave up?): 2014.10.22 10:45:52 LOG7[34384941056]: Service [rsync] started 2014.10.22 10:45:52 LOG5[34384941056]: Service [rsync] accepted connection from 1.1.1.1:63095 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): before/accept initialization 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 read client hello A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 write server hello A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 write certificate A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 write server done A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 flush data 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 read client key exchange A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 read finished A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 write change cipher spec A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 write finished A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 flush data 2014.10.22 10:45:52 LOG7[34384941056]: 41 items in the session cache 2014.10.22 10:45:52 LOG7[34384941056]: 0 client connects (SSL_connect()) 2014.10.22 10:45:52 LOG7[34384941056]: 0 client connects that finished 2014.10.22 10:45:52 LOG7[34384941056]: 0 client renegotiations requested 2014.10.22 10:45:52 LOG7[34384941056]: 110 server connects (SSL_accept()) 2014.10.22 10:45:52 LOG7[34384941056]: 107 server connects that finished 2014.10.22 10:45:52 LOG7[34384941056]: 0 server renegotiations requested 2014.10.22 10:45:52 LOG7[34384941056]: 66 session cache hits 2014.10.22 10:45:52 LOG7[34384941056]: 0 external session cache hits 2014.10.22 10:45:52 LOG7[34384941056]: 32 session cache misses 2014.10.22 10:45:52 LOG7[34384941056]: 0 session cache timeouts 2014.10.22 10:45:52 LOG6[34384941056]: No peer certificate received 2014.10.22 10:45:52 LOG6[34384941056]: SSL accepted: new session negotiated 2014.10.22 10:45:52 LOG6[34384941056]: Negotiated SSLv3 ciphersuite AES256-SHA (256-bit encryption) 2014.10.22 10:45:52 LOG6[34384941056]: Compression: null, expansion: null 2014.10.22 10:45:52 LOG6[34384941056]: s_connect: connecting 127.0.0.1:873 2014.10.22 10:45:52 LOG5[34384941056]: s_connect: connected 127.0.0.1:873 2014.10.22 10:45:52 LOG5[34384941056]: Service [rsync] connected remote server from 127.0.0.1:27724 2014.10.22 10:45:52 LOG7[34384941056]: Remote socket (FD=11) initialized 2014.10.22 11:01:12 LOG3[34384941056]: SSL_read: Connection reset by peer (54) 2014.10.22 11:01:12 LOG5[34384941056]: Connection reset: 56 byte(s) sent to SSL, 56 byte(s) sent to socket 2014.10.22 11:01:12 LOG7[34384941056]: Remote socket (FD=11) closed 2014.10.22 11:01:12 LOG7[34384941056]: Local socket (FD=10) closed 2014.10.22 11:01:12 LOG7[34384941056]: Service [rsync] finished (4 left) The clients are generally field units running stunnel versions in the 4.x range. Unfortunately, updating them is not an easy task and is not really under my control. Either way, this seems like a server side issue, and possibly an issue with rsync (we're running 3.1.0). Has anyone run into anything like this before? Does anyone have any suggestions for additional debugging we can do to try to pinpoint the problem? We are going to try rolling back to stunnel-4.29 to see if the problem still occurs there on the new system. Thanks, Steve

1 1

SSLv3 connections vulnerable in my environment?
by Fritz Gschwendner 21 Oct '14

21 Oct '14

Hello, I have a pretty standard stunnel server configuration with verify = 2 and clients, that don't speak TLS and can't easily be upgraded to support TLS. So disabling SSLv3 leads to handshake errors, I need to leave it enabled for now. The SSL connection is always renegotiated, a proprietary protocol is used inside SSL, and clients can be considered safe. Can the poodle security flaw realistically be used by a man in the middle to decrypt packets send over such an SSLv3 connection? If so, is there any other way to protect against the attack? Thank you.

1 0

Trouble after disabling SSLv3 (another one)
by Koenraad Lelong 21 Oct '14

21 Oct '14

Hi, Last week I disabled SSLv3 on my stunnel-server. I thought I tested it, but this morning I had to use it and I couldn't get access. Now at the office I tried again, with the same result. After enabling SSLv3 again I could get access. So my configuration seems wrong. My server runs Ubuntu 12.04 LTS, stunnel is 4.42-1ubuntu (stock ubuntu). This is my stunnel.conf (tunnels removed/edited) : client = no setuid = stunnel4 setgid = stunnel4 pid = /var/run/stunnel4/stunnel4.pid debug = debug output = /var/log/stunnel4/stunnel.log options = NO_SSLv2 options = NO_SSLv3 socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 3 CApath = /etc/stunnel-certs CAfile = /etc/stunnel/cacert.pem cert = /etc/stunnel/lace3.keycrt [tunnel vnc] accept = 12345 connect = remotehost:5901 The log on the server : 2014.10.21 08:32:15 LOG7[28587:140281088546560]: Service tunnel vnc accepted FD=0 from 192.168.1.14:55708 2014.10.21 08:32:15 LOG7[28587:140281088538368]: Service tunnel vnc started 2014.10.21 08:32:15 LOG7[28587:140281088538368]: Option TCP_NODELAY set on local socket 2014.10.21 08:32:15 LOG7[28587:140281088538368]: Waiting for a libwrap process 2014.10.21 08:32:15 LOG7[28587:140281088538368]: Acquired libwrap process #0 2014.10.21 08:32:15 LOG7[28587:140281088538368]: Releasing libwrap process #0 2014.10.21 08:32:15 LOG7[28587:140281088538368]: Released libwrap process #0 2014.10.21 08:32:15 LOG7[28587:140281088538368]: Service tunnel vnc permitted by libwrap from 192.168.1.14:55708 2014.10.21 08:32:15 LOG5[28587:140281088538368]: Service tunnel vnc accepted connection from 192.168.1.14:55708 2014.10.21 08:32:15 LOG7[28587:140281088538368]: SSL state (accept): before/accept initialization 2014.10.21 08:32:15 LOG7[28587:140281088538368]: SSL alert (write): fatal: handshake failure 2014.10.21 08:32:15 LOG3[28587:140281088538368]: SSL_accept: 1408A10B: error:1408A10B:SSL routines:SSL3_GET_CLIENT_HELLO:wrong version number 2014.10.21 08:32:15 LOG5[28587:140281088538368]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2014.10.21 08:32:15 LOG7[28587:140281088538368]: Service tunnel vnc finished (0 left) 2014.10.21 08:32:15 LOG7[28587:140281088538368]: str_stats: 0 block(s), 0 byte(s) The log on the client (opensuse 13.1) : 2014.10.21 08:47:47 LOG7[978:140089725433664]: local socket: FD=0 allocated (non-blocking mode) 2014.10.21 08:47:47 LOG7[978:140089725433664]: Service tunnel vnc accepted FD=0 from 127.0.0.1:39609 2014.10.21 08:47:47 LOG7[978:140089725630208]: Service tunnel vnc started 2014.10.21 08:47:47 LOG7[978:140089725630208]: Option TCP_NODELAY set on local socket 2014.10.21 08:47:47 LOG7[978:140089725630208]: Waiting for a libwrap process 2014.10.21 08:47:47 LOG7[978:140089725630208]: Acquired libwrap process #0 2014.10.21 08:47:47 LOG7[978:140089725630208]: Releasing libwrap process #0 2014.10.21 08:47:47 LOG7[978:140089725630208]: Released libwrap process #0 2014.10.21 08:47:47 LOG7[978:140089725630208]: Service tunnel vnc permitted by libwrap from 127.0.0.1:39609 2014.10.21 08:47:47 LOG5[978:140089725630208]: Service tunnel vnc accepted connection from 127.0.0.1:39609 2014.10.21 08:47:47 LOG7[978:140089725630208]: remote socket: FD=1 allocated (non-blocking mode) 2014.10.21 08:47:47 LOG6[978:140089725630208]: connect_blocking: connecting 192.168.0.30:12345 2014.10.21 08:47:47 LOG7[978:140089725630208]: connect_blocking: s_poll_wait 192.168.0.30:13001: waiting 10 seconds 2014.10.21 08:47:47 LOG5[978:140089725630208]: connect_blocking: connected 192.168.0.30:12345 2014.10.21 08:47:47 LOG5[978:140089725630208]: Service tunnel vnc connected remote server from 192.168.1.14:55770 2014.10.21 08:47:47 LOG7[978:140089725630208]: Remote FD=1 initialized 2014.10.21 08:47:47 LOG7[978:140089725630208]: Option TCP_NODELAY set on remote socket 2014.10.21 08:47:47 LOG7[978:140089725630208]: SSL state (connect): before/connect initialization 2014.10.21 08:47:47 LOG7[978:140089725630208]: SSL state (connect): SSLv3 write client hello A 2014.10.21 08:47:47 LOG7[978:140089725630208]: SSL alert (read): fatal: handshake failure 2014.10.21 08:47:47 LOG3[978:140089725630208]: SSL_connect: 14094410: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure 2014.10.21 08:47:47 LOG5[978:140089725630208]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2014.10.21 08:47:47 LOG7[978:140089725630208]: Service tunnel vnc finished (0 left) 2014.10.21 08:47:47 LOG7[978:140089725630208]: str_stats: 0 blocks, 0 bytes Am I missing something ? I would like to stay with Ubuntu's standard packages. Thanks for any advice. Koenraad Lelong.

2 4

STOP REMOVING OLD RELEASE TARBALLS FOR GODS SAKE
by John Spencer 21 Oct '14

21 Oct '14

hello, 5 days ago i noticed that my stunnel source package was *again* broken because some clown removed the previous version's download from the download server, so i bite the bullet and upgraded to latest (5.05). today, doing a testbuild i got a again a 404 and was forced again to update to latest stunnel download. this is fucking frustrating. i really have better things to do than to update my package recipes whenever a new stunnel release comes out (and that's not just me). SO COULD YOU PLEASE FINALLY LEAVE YOUR PAST RELEASES ON THE DOWNLOAD MIRROR LIKE ANYONE ELSE DOES ? THANKS. and no, even if a security flaw in non-latest was discovered that's still no reason to silently delete the old tarballs. thanks, --JS P.S. the latest stunnel still does not link against libreSSL instead of openssl, due to bogus usage of RAND_egd() as mentioned a quarter year ago in my blog: http://devsonacid.wordpress.com/2014/07/12/how-compatible-is-libressl/

4 3

Trouble after disabling SSLv3
by Dion Kant 19 Oct '14

19 Oct '14

Dear list, I have stunnel running in a configuration where we use it to connect to a webserver over https while adding client certificates to the requests. This worked fine until recently on the (Apache) webserver SSLv3 was disabled. I installed the latest version of stunnel today (stunnel-5.07b2 <https://www.stunnel.org/downloads/beta/stunnel-5.07b2.tar.gz>) but that did not fix the problem. Now STunnel tries to negotiate a https connection using the TLSv1.2 and I found that because of this Apache does not like the content of the Host variable in the HTTP header which is different from what Apache is expectingto be. With SSLv3 this was not an issue. As a result I get a "HTTP/1.1 400 Bad Request" from the webserver. In my configuration I cannot (easily) apply some form of split DNS to get the hostname correct in the http header already from the client connecting to the stunnel service. I tested using curl sending a request through stunnel to the web server and verified that when I modified the Host field in the request header it does work. To my opinion it is stunnel setting up the HTTPS connection to the webserver and stunnel should take care of setting the correct Host field in the request header. Is there a way to let stunnel take care of setting the correct info in the HTTP header? Best regards, Dion Kant

1 0

Re: [stunnel-users] stunnel 5.06 released
by Dominyk Tiller 16 Oct '14

16 Oct '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi Mike, Latest build seems to be broken for me on OS X 10.10. If it matters here, since the error is SSL related, I'm building against OpenSSL 1.0.1j which is configured without ssl2 ciphers but with ssl3 ciphers enabled. This is the error: libtool: link: clang -pthread -fstack-protector -fPIE -g -O2 -Wall - -Wextra -Wno-long-long -pedantic -o stunnel stunnel-str.o stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-fd.o stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o stunnel-ui_unix.o - -L/usr/local/opt/openssl/lib64 -L/usr/local/opt/openssl/lib -lssl - -lcrypto -lz -lpthread -pthread Undefined symbols for architecture x86_64: "_SSLv2_client_method", referenced from: _parse_service_option in stunnel-options.o "_SSLv2_server_method", referenced from: _parse_service_option in stunnel-options.o ld: symbol(s) not found for architecture x86_64 clang: error: linker command failed with exit code 1 (use -v to see invocation) make[1]: *** [stunnel] Error 1 make[1]: *** Waiting for unfinished jobs.... libtool: link: ( cd ".libs" && rm -f "libstunnel.la" && ln -s "../libstunnel.la" "libstunnel.la" ) make: *** [install-recursive] Error 1 Hope that's useful. Let me know if you need more. Dom -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJUP8tNAAoJEIclJNuddDJsePEP/0tEy5rKsOzpORpawOFDpZAD KaemUgVKbaWpphkldp9tPFsaCRhQrqQPNIjfaUGb/mSAe3mAoV69P1rXYlMQiGne oaCa/p35y1SYYq0RHzflPhlDb/avfz8F5cQsXb1vA3bec8vVyTEjsIjj/pSH+him EysnGZNG61xcD55IOWT4LbcfiBO+L0iwQn4w/fQXqATmMHeYKde95d1t3DCx7Rvw t80hOw7c6xZzkYOPoXZpWPBhBESzifkE3JiapNAtRjyj9EZK+1gukjOa5EB7vrz8 pdpI65lwIAk9Grv8IT2jHIJcj03H7zPzhXoeLJl/OWKTqHVc8X7naT1Tg5kwKWdG CG0keA9hyXHhhSn763OPkKeMG7Ab31IRAlIT3ajEa2o+57KFBb5KVgHn/RWsr+0g Yzv5FjM5ZJjH02Qj/9QqjlhzzdUQDNPGpNk72UKqXbnz3xv8JoQX16PMeUYrgH6h ZjXrtcBh6CXQghyDY1D9m2xFKIVAIcfcAm6XgV6yUawfL76LL/WbreEbCmBlkRHI p17BT7TUE4pfeSpxdfMmIPgMlaAragfT+NYw4/l7XgEqi3sjaf3IpupJ4hjqbl/F dt6W/VCILDW3lnSnbWwWy/7rantCQZldbg4xWsxDMMx1oinwOgk+l92I+9Qas+8z MnuTZ052UiJ9Agn+ZxQs =i1GY -----END PGP SIGNATURE-----

1 0

Window not updating (win32 5.05)
by Javier 16 Oct '14

16 Oct '14

Hi, just reporting that with the latest version the window doesn't get updated when there is activity. It is static. You have to minimize to tray and restore again to view the activity, what, almost, is actually as fast as have a look to the log :/ Can anyone confirm? Regards. P.S.: happening on 2k and XP. Haven't tested any NT6 version.

2 3

error compiling stunnel 5.06
by Laura Fried 16 Oct '14

16 Oct '14

/tmp/stunnel-5.06/src/options.c:2123: undefined reference to `SSLv2_client_method' /tmp/stunnel-5.06/src/options.c:2127: undefined reference to `SSLv2_server_method' collect2: ld returned 1 exit status make[2]: *** [stunnel] Error 1 make[2]: Leaving directory `/tmp/stunnel-5.06/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/tmp/stunnel-5.06/src' make: *** [all-recursive] Error 1 Please advise. -- Laura J. Fried Internal Revenue Service Online Fraud Detection and Prevention 202-556-2612 (Voice) 202-552-1226 (Fax) ofdp-laura (Skype)

2 2

stunnel 5.06 released
by Michal Trojnara 15 Oct '14

15 Oct '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.06 of stunnel. This is a security bugfix release. Update is recommended. The ChangeLog entry: Version 5.06, 2014.10.15, urgency: HIGH: * Security bugfixes - OpenSSL DLLs updated to version 1.0.1j. https://www.openssl.org/news/secadv_20141015.txt - The insecure SSLv2 protocol is now disabled by default. It can be enabled with "options = -NO_SSLv2". - The insecure SSLv3 protocol is now disabled by default. It can be enabled with "options = -NO_SSLv3". - Default sslVersion changed to "all" (also in FIPS mode) to autonegotiate the highest supported TLS version. * New features - Added missing SSL options to match OpenSSL 1.0.1j. - New "-options" commandline option to display the list of supported SSL options. * Bugfixes - Fixed FORK threading build regression bug. - Fixed missing periodic Win32 GUI log updates. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 098c2b6db0793ea4fa5b6767ce6ef1853e9f6cc2f32133024be55f6a460b1a40 stunnel-5.06.tar.gz 55afb3013406da1afcc1ab7ccc25bb1c66605ca3e004636a6b49cac555cb4d09 stunnel-5.06-installer.exe a1741eb8bb050d3d29515ddef46a0a6828372a991f2658995dee1e06af8c05c8 stunnel-5.06-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlQ+4v4ACgkQ/NU+nXTHMtFwNwCgvZyndOwkAQqmsWnuL7DcRAPq lSIAnig726aVMrFzFAoQzKXxxmWo/Qo9 =ok3p -----END PGP SIGNATURE-----

1 0

Nasty SSL 3.0 vulnerability to be revealed soon
by 541401＠gmail.com 14 Oct '14

14 Oct '14

Nasty SSL 3.0 vulnerability to be revealed soon http://www.theregister.co.uk/2014/10/14/nasty_ssl_30_vulnerability_to_drop_…

1 0

Mongo Replication using Stunnel
by Danny Hernandez 12 Oct '14

12 Oct '14

Hello, I am trying to create an ssl connection between two mongodb instances both using the mongodb community version. Both instances need to communicate with one another as they need to be able to ping each other. I am getting this error when attempting to connect to Instance A from Instance B and vice versa: connect_blocking: connect <ip address>:27027: Connection refused (111) I have two conf files on each server (one for client and one for server). I am using the latest version of stunnel and the latest version of mongodb. Here are my conf files: *SERVER A* cert=/etc/stunnel/stunnel.pem key = /etc/stunnel/stunnel.pem verify = 2 CAfile = /etc/stunnel/stunnel.pem pid = /client.pid output = /var/log/stunnel4/stunnel.log debug = 7 sslVersion = all [mongo-replication] accept = 27037 connect = 127.0.0.1:27017 retry = yes* * *Server B *cert=/etc/stunnel/stunnel.pem key = /etc/stunnel/stunnel.pem verify = 2 CAfile = /etc/stunnel/stunnel.pem pid = /client.pid output = /var/log/stunnel4/stunnel.log debug = 7 sslVersion = all [mongo-replication] accept = 27027 connect = 127.0.0.1:27027 retry = yes *Client A *cert=/etc/stunnel/client.pem pid = /client.pid output = /var/log/stunnel4/client.log debug = 7 client = yes [mongo-replication] accept = 27037 connect = dbtest2:27027 retry = yes *Client B *cert=/etc/stunnel/client.pem pid = /client.pid output = /var/log/stunnel4/client.log debug = 7 client = yes [mongo-replication] accept = 27037 connect = dbtest1:27037 retry = yes Could someone please assist with troubleshooting the error? Thank you! -- Thank you, Danny Hernandez

1 0

num_clients Undeclared
by Abdelkader Chelouah 12 Oct '14

12 Oct '14

Hello, Build of stunnel 5.04 and 5.05 failed on RHEL 6.2 (prior to 5.04, the build succeded) ... gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/logiciels/postgresql/9.3/lib/openssl/include -DLIBDIR='"/logiciels/postgresql/9.3/lib/stunnel/lib/stunnel"' -DCONFDIR='"/logiciels/postgresql/9.3/lib/stunnel/etc/stunnel"' -I/logiciels/postgresql/9.3/include -I/logiciels/postgresql/9.3/lib/openssl/include -I/logiciels/postgresql/9.3/lib/krb5/include -I/logiciels/postgresql/9.3/lib/cyrus-sasl/include -pthread -fstack-protector -fPIE -O3 -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -march=nocona -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-stunnel.o -MD -MP -MF .deps/stunnel-stunnel.Tpo -c -o stunnel-stunnel.o `test -f 'stunnel.c' || echo './'`stunnel.c stunnel.c: In function ‘main_configure’: stunnel.c:150: error: ‘num_clients’ undeclared (first use in this function) stunnel.c:150: error: (Each undeclared identifier is reported only once stunnel.c:150: error: for each function it appears in.) stunnel.c: At top level: stunnel.c:533: warning: expected [error|warning|ignored] after ‘#pragma GCC diagnostic’ stunnel.c:534: warning: unknown option after ‘#pragma GCC diagnostic’ kind stunnel.c: In function ‘signal_post’: stunnel.c:538: warning: ignoring return value of ‘write’, declared with attribute warn_unused_result stunnel.c: At top level: stunnel.c:541: warning: expected [error|warning|ignored] after ‘#pragma GCC diagnostic’ make[2]: *** [stunnel-stunnel.o] Error 1 make[2]: Leaving directory `/ESA/build/stunnel-5.05/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/ESA/build/stunnel-5.05/src' make: *** [all-recursive] Error 1 It seems that the 'num_clients' variable is undeclared in the main_configure function. Thank you

2 3

Problems with stunnel 5.04 for Windows
by Mark Hannig 11 Oct '14

11 Oct '14

Hi! New to this list and this product. I posted this on the Amazon forums, but I need to fix this fast, so I thought I would post it here as well. I am running stunnel 5.04 for Windows on a Windows 2012 R2 instance. I have it working with SES, but after a while it just keeps timing out. I have to manually reload the configuration file to get it to start working again. What am I doing wrong? Here is a part of the log: 2014.10.09 07:43:57 LOG5964 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> accepted connection from 127.0.0.1:62779 2014.10.09 07:44:07 LOG3964 <https://forums.aws.amazon.com/>: s_connect: s_poll_wait 54.68.86.38:465: TIMEOUTconnect exceeded 2014.10.09 07:44:17 LOG3964 <https://forums.aws.amazon.com/>: s_connect: s_poll_wait 54.68.197.46:465: TIMEOUTconnect exceeded 2014.10.09 07:44:27 LOG3964 <https://forums.aws.amazon.com/>: s_connect: s_poll_wait 54.213.178.250:465: TIMEOUTconnect exceeded 2014.10.09 07:44:27 LOG5964 <https://forums.aws.amazon.com/>: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2014.10.09 11:30:18 LOG53224 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> accepted connection from 127.0.0.1:63014 2014.10.09 11:30:28 LOG33224 <https://forums.aws.amazon.com/>: s_connect: s_poll_wait 54.68.197.46:465: TIMEOUTconnect exceeded 2014.10.09 11:30:38 LOG33224 <https://forums.aws.amazon.com/>: s_connect: s_poll_wait 54.213.178.250:465: TIMEOUTconnect exceeded 2014.10.09 11:30:48 LOG33224 <https://forums.aws.amazon.com/>: s_connect: s_poll_wait 54.68.86.38:465: TIMEOUTconnect exceeded 2014.10.09 11:30:48 LOG53224 <https://forums.aws.amazon.com/>: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2014.10.09 11:31:34 LOG51000 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> accepted connection from 127.0.0.1:63019 2014.10.09 11:31:44 LOG31000 <https://forums.aws.amazon.com/>: s_connect: s_poll_wait 54.213.178.250:465: TIMEOUTconnect exceeded 2014.10.09 11:31:54 LOG31000 <https://forums.aws.amazon.com/>: s_connect: s_poll_wait 54.68.86.38:465: TIMEOUTconnect exceeded 2014.10.09 11:32:01 LOG5388 <https://forums.aws.amazon.com/>: Reading configuration from file stunnel.conf 2014.10.09 11:32:01 LOG5388 <https://forums.aws.amazon.com/>: FIPS mode disabled 2014.10.09 11:32:01 LOG5388 <https://forums.aws.amazon.com/>: Configuration successful 2014.10.09 11:32:04 LOG31000 <https://forums.aws.amazon.com/>: s_connect: s_poll_wait 54.68.197.46:465: TIMEOUTconnect exceeded 2014.10.09 11:32:04 LOG51000 <https://forums.aws.amazon.com/>: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2014.10.09 11:32:14 LOG5964 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> accepted connection from 127.0.0.1:63024 2014.10.09 11:32:14 LOG5964 <https://forums.aws.amazon.com/>: s_connect: connected 54.68.159.203:465 2014.10.09 11:32:14 LOG5964 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> connected remote server from 172.31.3.85:63025 2014.10.09 11:32:14 LOG5964 <https://forums.aws.amazon.com/>: Connection closed: 494 byte(s) sent to SSL, 360 byte(s) sent to socket 2014.10.09 11:32:18 LOG5892 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> accepted connection from 127.0.0.1:63026 2014.10.09 11:32:18 LOG5892 <https://forums.aws.amazon.com/>: s_connect: connected 54.213.190.197:465 2014.10.09 11:32:18 LOG5892 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> connected remote server from 172.31.3.85:63027 2014.10.09 11:32:18 LOG5892 <https://forums.aws.amazon.com/>: Connection closed: 1592 byte(s) sent to SSL, 360 byte(s) sent to socket 2014.10.09 12:41:29 LOG53700 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> accepted connection from 127.0.0.1:63100 2014.10.09 12:41:29 LOG53700 <https://forums.aws.amazon.com/>: s_connect: connected 54.244.8.28:465 2014.10.09 12:41:29 LOG53700 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> connected remote server from 172.31.3.85:63101 2014.10.09 12:41:29 LOG53700 <https://forums.aws.amazon.com/>: Connection closed: 1609 byte(s) sent to SSL, 360 byte(s) sent to socket 2014.10.09 12:46:13 LOG53428 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> accepted connection from 127.0.0.1:63107 2014.10.09 12:46:13 LOG53428 <https://forums.aws.amazon.com/>: s_connect: connected 54.68.159.203:465 2014.10.09 12:46:13 LOG53428 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> connected remote server from 172.31.3.85:63108 2014.10.09 12:46:14 LOG53428 <https://forums.aws.amazon.com/>: Connection closed: 1609 byte(s) sent to SSL, 360 byte(s) sent to socket 2014.10.09 16:32:21 LOG51876 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> accepted connection from 127.0.0.1:63335 2014.10.09 16:32:21 LOG51876 <https://forums.aws.amazon.com/>: s_connect: connected 54.213.190.197:465 2014.10.09 16:32:21 LOG51876 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> connected remote server from 172.31.3.85:63336 2014.10.09 16:32:21 LOG51876 <https://forums.aws.amazon.com/>: Connection closed: 1611 byte(s) sent to SSL, 360 byte(s) sent to socket 2014.10.10 01:52:46 LOG5440 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> accepted connection from 127.0.0.1:64017 2014.10.10 01:52:46 LOG5440 <https://forums.aws.amazon.com/>: s_connect: connected 54.244.8.28:465 2014.10.10 01:52:46 LOG5440 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> connected remote server from 172.31.3.85:64018 2014.10.10 01:52:47 LOG5440 <https://forums.aws.amazon.com/>: Connection closed: 5129 byte(s) sent to SSL, 360 byte(s) sent to socket 2014.10.10 08:32:20 LOG53548 <https://forums.aws.amazon.com/>: Service smtp-tls-wrapper <https://forums.aws.amazon.com/> accepted connection from 127.0.0.1:64423 2014.10.10 08:32:30 LOG33548 <https://forums.aws.amazon.com/>: s_connect: s_poll_wait 54.68.159.203:465: TIMEOUTconnect exceeded 2014.10.10 08:32:40 LOG33548 <https://forums.aws.amazon.com/>: s_connect: s_poll_wait 54.213.190.197:465: TIMEOUTconnect exceeded 2014.10.10 08:32:50 LOG33548 <https://forums.aws.amazon.com/>: s_connect: s_poll_wait 54.244.8.28:465: TIMEOUTconnect exceeded 2014.10.10 08:32:50 LOG53548 <https://forums.aws.amazon.com/>: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket You can see that it stops, then I reload the configuration and it works again, and then eventually stops. Here is my configuration file: engine = capi cert = stunnel.pem options = NO_SSLv2 ssmtp <https://forums.aws.amazon.com/> accept = 465 connect = 25 smtp-tls-wrapper <https://forums.aws.amazon.com/> accept = 2525 client = yes connect = email-smtp.us-west-2.amazonaws.com:465 Thank you. -- Mark F. Hannig

2 1

stunnel 5.05 released
by Michal Trojnara 10 Oct '14

10 Oct '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.05 of stunnel. The ChangeLog entry: Version 5.05, 2014.10.10, urgency: MEDIUM: * New features - Asynchronous communication with the GUI thread for faster logging on Win32. - systemd socket activation (thx to Mark Theunissen). - The parameter of "options" can now be prefixed with "-" to clear an SSL option, for example: "options = -LEGACY_SERVER_CONNECT". - Improved "transparent = destination" manual page (thx to Vadim Penzin). * Bugfixes - Fixed POLLIN|POLLHUP condition handling error resulting in prematurely closed (truncated) connection. - Fixed a null pointer dereference regression bug in the "transparent = destination" functionality (thx to Vadim Penzin). This bug was introduced in stunnel 5.00. - Fixed startup thread synchronization with Win32 GUI. - Fixed erroneously closed stdin/stdout/stderr if specified as the -fd commandline option parameter. - A number of minor Win32 GUI bugfixes and improvements. - Merged most of the Windows CE patches (thx to Pierre Delaage). - Fixed incorrect CreateService() error message on Win32. - Implemented a workaround for defective Cygwin file descriptor passing breaking the libwrap support: http://wiki.osdev.org/Cygwin_Issues#Passing_file_descriptors Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: c7e1653345150db7e48d00e1129cf571c7c85de8e7e1aa70b21cf1d76b1e31ef stunnel-5.05.tar.gz 19f8b78aecc26c291d90e4fa72807bdb75063a7641fd64f224222b526cfa83aa stunnel-5.05-installer.exe 65129c4c1a73dc04a0f66571a9bda2860d70376cdcc2c1d83fd575dcb0adc7a5 stunnel-5.05-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlQ3ofIACgkQ/NU+nXTHMtHnmQCg8sncLzw4bfiuw3ziL7HGFEdJ luwAoKTF4C3jbUihpz8ODEPvtGbK24Cs =Z+GJ -----END PGP SIGNATURE-----

1 0

CERT: Verification error: unable to get local issuer certificate
by Vivek Gupta 07 Oct '14

07 Oct '14

Hi I am getting error - Below is the log: ******************************** Service [LMAX-fix-tunnel-DEMO-MktData] connected remote server from 192.168.1.5:49819 Remote socket (FD=276) initialized SNI: sending servername: fix-md-ate.lmaxtrader.com SSL state (connect): before/connect initialization SSL state (connect): SSLv3 write client hello A SSL state (connect): SSLv3 read server hello A Verification started at depth=1: C=US, O=DigiCert Inc, CN=DigiCert Secure Server CA CERT: Verification error: unable to get local issuer certificate Rejected by CERT at depth=1: C=US, O=DigiCert Inc, CN=DigiCert Secure Server CA SSL alert (write): fatal: unknown CA SSL_connect: 14090086: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket Remote socket (FD=276) closed Local socket (FD=524) closed Service [LMAX-fix-tunnel-DEMO-MktData] finished (0 left) *************************************************** and below is the conf file: ************ ; Certificate/key is needed in server mode and optional in client mode ;cert = stunnel.pem ;key = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 3 CApath = C:\Program Files (x86)\stunnel\ CAfile = C:\Program Files (x86)\stunnel\peer-LMAX-fix-tunnel-DEMO-MktData.pem ;CRLpath = crls ;CRLfile = crls.pem options = NO_SSLv2 ************************************ Please suggest how to solve verification error. Thanks &Regards Vivek Gupta 9971514343

1 0

STunnel Connection closed: 150 byte(s) sent to SSL, 0 byte(s) sent to socket
by Vivek Gupta 07 Oct '14

07 Oct '14

Hi I am using sTunnel for communication betweem my TCP client and a remote SERVER but I am getting error as always- Signal pipe is empty Service [LMAX-fix-tunnel-DEMO-MktData] accepted (FD=348) from 127.0.0.1:55919 2014.10.06 :34:56 LOG7[4220]: Creating a new thread New thread created Service [LMAX-fix-tunnel-DEMO-MktData] started Service [LMAX-fix-tunnel-DEMO-MktData] accepted connection from 127.0.0.1:55919 s_connect: connecting 91.215.165.69:443 s_connect: s_poll_wait 91.215.165.69:443: waiting 10 seconds s_connect: connected 91.215.165.69:443 Service [LMAX-fix-tunnel-DEMO-MktData] connected remote server from 192.168.1.5:55920 Remote socket (FD=352) initialized SNI: sending servername: fix-md-ate.lmaxtrader.com SSL state (connect): before/connect initialization SSL state (connect): SSLv3 write client hello A SSL state (connect): SSLv3 read server hello A SSL state (connect): SSLv3 read server certificate A SSL state (connect): SSLv3 read server done A SSL state (connect): SSLv3 write client key exchange A SSL state (connect): SSLv3 write change cipher spec A SSL state (connect): SSLv3 write finished A SSL state (connect): SSLv3 flush data SSL state (connect): SSLv3 read finished A 1 items in the session cache 1 client connects (SSL_connect()) 1 client connects that finished 0 client renegotiations requested 0 server connects (SSL_accept()) 0 server connects that finished 0 server renegotiations requested 0 session cache hits 0 external session cache hits 0 session cache misses 0 session cache timeouts Peer certificate was cached (3944 bytes) SSL connected: new session negotiated Negotiated TLSv1/SSLv3 ciphersuite: AES128-SHA (128-bit encryption) Compression: null, expansion: null SSL_read returned WANT_READ: retrying SSL socket closed (SSL_read) Sent socket write shutdown Connection closed: 150 byte(s) sent to SSL, 0 byte(s) sent to socket Remote socket (FD=352) closed Local socket (FD=348) closed Service [LMAX-fix-tunnel-DEMO-MktData] finished (0 left) Please suggest.

3 4

trojan in stunnel-5.04-installer.exe ?
by oVPN.to Support 03 Oct '14

03 Oct '14

Hi stunnel folks, a client informed us about trojan warning in stunnel-5.04-installer.exe can anybody explain this "behavioural information"? DNS requests VBOXSVR.ovh.net https://www.virustotal.com/en/file/045145b4e6ef66d29774b558837bd693a0dbab9f… additonal: https://anubis.iseclab.org/?action=result&task_id=1beba124664d67ea4914aa2b2… stunnel-5.05b4-installer.exe does not have it, but flagged as trojan by 2 AVs too https://www.virustotal.com/en/file/ac4f98c13a0a9f62cc118faa91483a1a5c0a7128… stunnel-5.03-installer.exe https://www.virustotal.com/en/file/803bc85fbc80f22d71b13d4180e2d51c02586b2c… Thanks

1 0

Support on windows 2012 SR (32/64b)
by Soudant, Erik 03 Oct '14

03 Oct '14

Hi All, I would like to know if Stunnel supports Windows 2012 SR (32/64). I cannot find any information about this in the archives/Documentation. Thanx in advance. Regards Erik Soudant Application Designer [cid:[email protected]] E Erik.soudant(a)pinkroccade.nl<mailto:[email protected]> l M 06 46091160 l T +31 (0)88 110 1500 | W www.pinkroccadelocalgovernment.nl<http://www.pinkroccadelocalgovernment.nl/> [cid:[email protected]]<http://www.linkedin.com/groups?mostPopular=&gid=1811286&trk=myg_ugrp_ovr>[cid:[email protected]]<http://www.twitter.com/pinkroccadelg> Disclaimer | De informatie verzonden met dit e-mail bericht is confidentieel en uitsluitend bestemd voor de geadresseerde. Gebruik van deze informatie door anderen dan de geadresseerde en gebruik door hen die niet gerechtigd zijn van de informatie kennis te nemen, is verboden. Indien u niet de geadresseerde bent of niet gerechtigd bent tot kennisneming, (a) is openbaarmaking, vermenigvuldiging, verspreiding en/of verstrekking van deze informatie aan derden, niet toegestaan, en (b) wordt u verzocht de afzender daarvan onmiddellijk op de hoogte te brengen en het bericht te vernietigen. PinkRoccade Local Government B.V. staat niet in voor de juiste en volledige overbrenging van de inhoud van een verzonden e-mail, noch voor tijdige ontvangst daarvan. [cid:[email protected]]Denk alstublieft aan het milieu voordat u deze e-mail print.

1 0

Configuring the STunnel for a TCP Client
by Vivek Gupta 01 Oct '14

01 Oct '14

Hi I have installed STunnel version 5.xx and using a TCP client to connect with it but no success. My details are as follows: 1. Configuration of STunnel.conf verify = 3 CAfile = peer-LMAX-fix-tunnel-DEMO-MktData.pem [LMAX-fix-tunnel-DEMO-MktData] client = yes accept = 127.0.0.1:40003 connect = fix-md-ate.lmaxtrader.com:443 cert = stunnel.pem key = stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 Certificate file stunnel.pem was generated by software itself. 2. I have written a TCP client as follows:Only part of code is given below *********************************************** // Resolve the server address and port iResult = getaddrinfo("127.0.0.1", 40003, NULL, &servinfo); // Attempt to connect to an address until one succeeds for(ptr=servinfo; ptr != NULL ;ptr=ptr->ai_next) { // Create a SOCKET for connecting to server ConnectSocket = socket(ptr->ai_family,ptr->ai_socktype,ptr-ai_protocol); // Connect to server. iResult = connect( ConnectSocket, ptr->ai_addr, (int)ptr->ai_addrlen); break; } // Send an initial buffer iResult = send( ConnectSocket, sendbuf, (int)strlen(sendbuf), 0 ); printf("Bytes Sent: %ld\n", iResult); // Receive until the peer closes the connection do { iResult = recv(ConnectSocket, recvbuf, recvbuflen, 0); if ( iResult > 0 ) printf("Bytes received: %d\n", iResult); else if ( iResult == 0 ) printf("Connection closed\n"); else printf("recv failed with error: %d\n", WSAGetLastError()); } while( iResult > 0 ); ******************************************************** Here I would like to tell you that I have used 127.0.0.1 and 40003 in getaddrinfo and same has been configured in conf file. Whenever I try to connect I am receiving iResult =0 from recv(). Could anybody please let me know is there anything wrong with my configuration and how to get resolve the current issue?

1 0

No Taskbar Icon
by Carter Browne 26 Sep '14

26 Sep '14

I have updated stunnel to version 5.04 on Windows 7 32 & 64 bit, Windows Server 2008R2, Windows Server 2012 and Windows Server 2012R2 and in no case does the icon appear. I explicitly set taskbar = yes in the configuration file. -- Carter Browne cbrowne(a)cbcs-usa.com

5 13

"Socket operation on non-socket" when trying to pass the configuration file as a file descriptor on OSX
by Guylhem 24 Sep '14

24 Sep '14

Hello I'm trying to pass the configuration file with option fd. However, I get the following errors when I do : echo my configuration | stunnel -fd 0 This is not related to echo since I get the same errors with: cat conf | stunnel -fd 0 stunnel is just filling my logs with : 2014-07-13 6:48:46.675 PM stunnel[1959]: LOG3[140735238959888]: local socket: Socket operation on non-socket (38) 2014-07-13 6:48:46.676 PM stunnel[1959]: LOG3[140735238959888]: local socket: Socket operation on non-socket (38) (...) stunnel ./conf works fine I found a reference to a bug that caused this same error message on OSX when run in inetd mode, but nothing else. Any help is appreciated I'm using stunnel 5.02 on x86_64-apple-darwin13.2.0 platform with the following in -sockets: Socket option defaults: Option Name | Accept | Local | Remote |OS default ----------------+----------+----------+----------+---------- SO_DEBUG | -- | -- | -- | no SO_DONTROUTE | -- | -- | -- | no SO_KEEPALIVE | -- | -- | -- | no SO_LINGER | -- | -- | -- | 0:0 SO_OOBINLINE | -- | -- | -- | no SO_RCVBUF | -- | -- | -- | 131072 SO_SNDBUF | -- | -- | -- | 131072 SO_RCVLOWAT | -- | -- | -- | 1 SO_SNDLOWAT | -- | -- | -- | 2048 SO_RCVTIMEO | -- | -- | -- | 0:0 SO_SNDTIMEO | -- | -- | -- | 0:0 SO_REUSEADDR | yes| -- | -- | no TCP_KEEPCNT | -- | -- | -- |write-only TCP_KEEPINTVL | -- | -- | -- |write-only IP_TOS | -- | -- | -- | 0 IP_TTL | -- | -- | -- | 64 TCP_NODELAY | -- | yes| yes| no My configuration is quite simple : I just echo CAfile=/path/to/file.pem verify = 3 fips = no options = NO_SSLv2 debug = 7 [test] client = yes accept = 127.0.0.1:4443 connect = remoteip:443

2 1

Stunnel as windows service doesn't start on restart.
by John Smith 24 Sep '14

24 Sep '14

Running stunnel 5.03 on Windows 2008 R2. Everything is installed and working fine. I can even start/stop the service no problem... (Pretty sure the service is set to start Automatically) When I reboot my server stunnel service shows as started but nothing gets logged and none of my connections work. Once I restart the service through service manager, everything works. So on startup it doesn't seem to run... This only happens if i reboot the machine. I also asked the same question here: http://serverfault.com/questions/627932/stunnel-as-windows-service-doesnt-s… Output of my logs proving it works. 2014.09.11 15:57:48 LOG5[1612]: stunnel 5.03 on x86-pc-msvc-1500 platform 2014.09.11 15:57:48 LOG5[1612]: Compiled/running with OpenSSL 1.0.1i-fips 6 Aug 2014 2014.09.11 15:57:48 LOG5[1612]: Threading:WIN32 Sockets:SELECT,IPv6 SSL:ENGINE,OCSP,FIPS 2014.09.11 15:57:48 LOG5[1612]: Reading configuration from file stunnel.conf 2014.09.11 15:57:48 LOG5[1612]: FIPS mode disabled 2014.09.11 15:57:49 LOG5[1612]: Configuration successful

8 27

Possible problem found in init script with 'dirty' config file
by F. J. Blanco 23 Sep '14

23 Sep '14

Hi there. Perhaps this is a foolishness, but it happens to me, triggering a great headache. I'm Debian (Wheezy) user, using stunnel 4.53-1.1. I copied the stunnel configuration from another machine for a simple LAN SMTP relay. When I tried to reload the script, I got this: # /etc/init.d/stunnel4 start > Reloading configuration SSL tunnels: /etc/init.d/stunnel4: 34: test: /var/lib/stunnel4/: unexpected operator A few hours laters, I discovered the problem was in config file, in the chroot parameter: chroot = /var/lib/stunnel4 Specifically, with a hide space at the end of the line: chroot = /var/lib/stunnel4[ ] In the init script, in the function get_pids(), this mistake caused that this checkout fails: --- if test -f $CHROOT/$PIDFILE; then cat $CHROOT/$PIDFILE fi --- 'cat /var/lib/stunnel4///stunnel.pid' is not the same as 'cat /var/lib/stunnel4/[ ]//stunnel.pid' Perhaps a suggestion, a little change here: CHROOT=`grep "^chroot" $file|sed "s;.*= *;;"` Adding a space filter: CHROOT=`grep "^chroot" $file|sed "s;.*= *;;" | tr -d " "` Regards.

4 10

Re: [stunnel-users] Stunnel as windows service doesn't start on restart.
by josealf＠rocketmail.com 22 Sep '14

22 Sep '14

John. Looks fine to me. Same configuration works in my Windows 7 64 bits. I have no access to Windows Server 2008 R2, but I would expect it to work the same. What are you securing with stunnel?... Perhaps the service you are securing is starting after stunnel? -----Original Message----- From: John Smith <java.dev.mtl(a)gmail.com> Date: Mon, 22 Sep 2014 11:09:21 To: Jose Diaz<josealf(a)rocketmail.com> Subject: Re: [stunnel-users] Stunnel as windows service doesn't start on restart. SERVICE_NAME: stunnel TYPE : 110 WIN32_OWN_PROCESS (interactive) START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : "C:\Program Files (x86)\stunnel\stunnel.exe" -service -install LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Stunnel SSL wrapper DEPENDENCIES : TCPIP SERVICE_START_NAME : LocalSystem On 22 September 2014 11:02, John Smith <java.dev.mtl(a)gmail.com> wrote: > After reboot? > > On 22 September 2014 10:11, <josealf(a)rocketmail.com> wrote: > >> >> Interesting. Please execute >> >> sc qc stunnel >> >> And post the output. >> >> >> >> -----Original Message----- >> From: John Smith <java.dev.mtl(a)gmail.com> >> Sender: "stunnel-users" <stunnel-users-bounces(a)stunnel.org> >> Date: Mon, 22 Sep 2014 09:54:10 >> To: Michal Trojnara<Michal.Trojnara(a)mirt.net> >> Cc: <stunnel-users(a)stunnel.org> >> Subject: Re: [stunnel-users] Stunnel as windows service doesn't start on >> restart. >> >> _______________________________________________ >> stunnel-users mailing list >> stunnel-users(a)stunnel.org >> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >> >> >> >> >

2 3

stunnel beta (5.04b1) is available for testing
by Michal Trojnara 22 Sep '14

22 Sep '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Guys, Please feel free to try the beta version I just made available for download: https://www.stunnel.org/downloads/beta/stunnel-5.04b1.tar.gz https://www.stunnel.org/downloads/beta/stunnel-5.04b1-installer.exe The list of changes includes most of the issues recently discussed on the stunnel-users mailing list and more. * New features - Support for local mode ("exec" option) on Win32. - A more explicit service description provided for the Windows SCM (thx to Pierre Delaage). - TCP/IP dependency added for NT service in order to (hopefully) prevent initialization failure at boot time. - FIPS canister updated to version 2.0.8 in the Win32 binary build. * Bugfixes - load_icon_default() modified to return copies of default icons instead of the original resources to prevent the resources from being destroyed. - Reportedly more compatible values used for the dwDesiredAccess parameter of the CreateFile() function (thx to Pierre Delaage). - Partially merged UNICODE compilation fixes (thx to Pierre Delaage). - Partially merged Windows CE patches (thx to Pierre Delaage). - Fixed typos in stunnel.init.in and vc.mak. - Fixed incorrect memory allocation statistics update in str_realloc(). - Missing REMOTE_PORT environmental variable is provided to processes spawned with "exec" on Unix platforms. - Taskbar icon is no longer disabled for NT service. Some basic examples for local mode ("exec" option) on Windows: ; Service based on a command-line tool [netstat] accept = 8015 exec = c:\windows\system32\netstat.exe execargs = netstat -a ; Remote cmd.exe protected with SSL ; Certificate-based authentication needs to be configured here! [cmd] accept = 1337 exec = c:\windows\system32\cmd.exe Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlQYYkoACgkQ/NU+nXTHMtGmfwCfSdHFmK8q5IRcS/CoFmYMZ40G zUEAoNUrIp0KAJ4+0LPwx+/1lJG6q2q/ =aSXM -----END PGP SIGNATURE-----

3 11

Support for PSK
by Thomas Conté 21 Sep '14

21 Sep '14

Hello everyone, In the context of an embedded project, I have developed a lightweight, PolarSSL-based TLS-PSK client running on an Arduino board. Now I am looking for a generic server-side solution to connect the TLK-PSK client to a few Web services living in various app servers (Node.JS, IIS, and others). Since PSK support is not widespread, I am thinking about using stunnel as a generic front-end to these services. I have done a quick-and-dirty POC of adding PSK support to stunnel and it looks like this could be done with minor modifications, e.g. adding a call to SSL_CTX_set_psk_server_callback and the corresponding callback to ctx.c. Right now the psk_key and psk_identity values are hard-coded, so of course those need to be added to the configuration file. Is the community interested in further work in that area? Or is PSK support already in the stunnel roadmap? Cheers, -- Thomas Conté.

2 1

stunnel 5.04 released
by Michal Trojnara 21 Sep '14

21 Sep '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.04 of stunnel. The ChangeLog entry: Version 5.04, 2014.09.21, urgency: LOW: * New features - Support for local mode ("exec" option) on Win32. - Support for UTF-8 config file and log file. - Win32 UTF-16 build (thx to Pierre Delaage for support). - Support for Unicode file names on Win32. - A more explicit service description provided for the Windows SCM (thx to Pierre Delaage). - TCP/IP dependency added for NT service in order to prevent initialization failure at boot time. - FIPS canister updated to version 2.0.8 in the Win32 binary build. * Bugfixes - load_icon_default() modified to return copies of default icons instead of the original resources to prevent the resources from being destroyed. - Partially merged Windows CE patches (thx to Pierre Delaage). - Fixed typos in stunnel.init.in and vc.mak. - Fixed incorrect memory allocation statistics update in str_realloc(). - Missing REMOTE_PORT environmental variable is provided to processes spawned with "exec" on Unix platforms. - Taskbar icon is no longer disabled for NT service. - Fixed taskbar icon initialization when commandline options are specified. - Reportedly more compatible values used for the dwDesiredAccess parameter of the CreateFile() function (thx to Pierre Delaage). - A number of minor Win32 GUI bugfixes and improvements. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: ee9702e073cb8d5940a1310ae171a38d3264f1ce3b087160728bbbcf5710cec1 stunnel-5.04.tar.gz 045145b4e6ef66d29774b558837bd693a0dbab9f7295586da9e5f0de4c5a7481 stunnel-5.04-installer.exe d1bc5c00278f31c64ad4a601d9e398b21284777f9079e91b8cbaef1e8e91f538 stunnel-5.04-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlQfAqsACgkQ/NU+nXTHMtH1cACeLEi7tFSEoxYJCfZROeaTLD4J +8sAoKK+l/6Bjl2sLwPRTcmw/Vj4+PYy =F0H9 -----END PGP SIGNATURE-----

1 0

GnuTLS port
by Max 21 Sep '14

21 Sep '14

Pardon if that was asked before, but are there port of stunnel to GnuTLS available somewhere? With recent fallout from heartbleed I'm looking into getting rid of openssl (besides I've never liked the license anyway :) and stunnel is one of the very few programs which got dependency on it. cheers, Max.

2 1

stunnel beta (5.04b2) is available for testing
by Michal Trojnara 19 Sep '14

19 Sep '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Guys, Please feel free to try the second beta version: https://www.stunnel.org/downloads/beta/stunnel-5.04b2.tar.gz https://www.stunnel.org/downloads/beta/stunnel-5.04b2-installer.exe I have finished implementing Win32 UNICODE support. The following planned features depend on UNICODE support: - Non-ASCII path names (this is already partially implemented) - UTF8 stunnel.conf - Windows CE GUI stunnel 5.04b2 also fixes missing taskbar icon when stunnel is executed with commandline switches (for example "stunnel -help"). Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlQcnAcACgkQ/NU+nXTHMtHOnQCeJFPogmAyhDFQ+CoLT17nhd1I CSIAni1tOnInyScnXwB/d876RF0o9YYt =PJ+o -----END PGP SIGNATURE-----

1 0

400 - Bad Request
by j nasty 17 Sep '14

17 Sep '14

I'm trying to access a web service endpoint using sTunnel to handle all the SSL traffic. For my other connection setups this works perfectly fine. But for this one particular client I'm getting a 400 - Bad Request Error. Client Configuration looks like this: [Connection1] client = yes accept = 127.0.0.1:9006 connect = server.com:443 Response I get back is: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>400 Bad Request</title> </head><body> <h1>Bad Request</h1> <p>Your browser sent a request that this server could not understand.<br /> Reason: You're speaking plain HTTP to an SSL-enabled server port.<br /> Instead use the HTTPS scheme to access this URL, please.<br /> <blockquote>Hint: <a href="https://server.com/"><b>https://server.com/</b></a></blockquote></p> </body></html> Is there a setting configuration I can use so that sTunnel redirects to https://server.com instead of server.com:443? Thanks in advance, Jake

2 1

Re: [stunnel-users] Stunnel Windows Server 2008 R2
by Pierre DELAAGE 01 Sep '14

01 Sep '14

Ok, thank you very much. I am pushing our mails to the forum, just in case it may help someone. Yours sincerely Pierre Le 01/09/2014 00:53, 541401(a)gmail.com a écrit : > Sorry for my lack of clarity. > > Your patched 5.02 works as a service. The official 5.03 does not work > as a service. > > > On 31.Aug.14 15:13, Pierre DELAAGE wrote: >> Hello, >> Thanks for the feedback. >> >> So...are you saying that it is now working with MY patched 502 and >> NOT with the official 503 (except for the "not configured msg") ? >> >> Or, finally, are you saying that they work the same, my patched 502 >> and the official 503 ? >> >> Yours sincerely >> Pierre >> >> >> >> Le 31/08/2014 22:46, 541401(a)gmail.com a écrit : >>> Hello Pierre, >>> >>> Today I downloaded the file you sent. I installed 5.03 on the server >>> (replacing 4.35), copied your 5.02 executable over the 5.03 exe. >>> >>> I then copied the 4.35 conf file into the 5.03 directory and finally >>> I installed and started the service. The service installed and ran, >>> but there was a message on the notification window saying it was not >>> configured. >>> >>> HOWEVER, I believe that message was wrong because the service works >>> just fine. I was able to send email from the Event log, through the >>> Windows virtual SMTP server and finally on through a gmail account! >>> >>> I did have to uncheck the service option "allow to interact with >>> desktop" because Server 2008 R2 will not allow a service to interact >>> with the desktop. >>> >>> Thank you very much, I am sorry it took a couple of days to do this >>> and report back to you! >>> >>> >>> On 29.Aug.14 07:38, Pierre DELAAGE wrote: >>>> Hello, >>>> have you tried the patched 502 version I sent you last week ? >>>> Regards >>>> Pierre >>>> >>>> Le 28 août 2014 à 21:20, "541401(a)gmail.com" <541401(a)gmail.com> a >>>> écrit : >>>> >>>>> Hopefully you were smarter than I and didn't piss away several >>>>> hours trying to solve the issue before turning to this forum? I >>>>> felt kind of foolish for wasting so much time trying to fix it on >>>>> my own. >>>>> >>>>> On 28.Aug.14 10:50, WNSDEV wrote: >>>>>> Hi, >>>>>> >>>>>> I ran into the same problem with Stunnel 5.03 on Windows 7 and >>>>>> downgrading >>>>>> to V 4.35 fixed it. Is there a new version to address this issue >>>>>> going to >>>>>> be available at some point? >>>>>> >>>>>> Thanks, >>>>>> Pete >>>>>> >>>>>> -----Original Message----- >>>>>> From: 541401(a)gmail.com [mailto:[email protected]] >>>>>> Sent: Thursday, August 21, 2014 4:43 PM >>>>>> To: stunnel-users(a)stunnel.org >>>>>> Subject: [stunnel-users] Stunnel Windows Server 2008 R2 >>>>>> >>>>>> I have installed stunnel 5.03 on Windows Server 2008 R2 X64. >>>>>> When I run it >>>>>> as an application it works perfectly. When I install and run the >>>>>> service, >>>>>> it starts but the start notice window, title bar, says Stunnel >>>>>> 5.03 win32 (not configured). It appears that the stunnel service >>>>>> is not >>>>>> reading the stunnel.conf. >>>>>> >>>>>> If anyone has any suggestions how I can successfully run stunnel >>>>>> as a >>>>>> service, I would be very appreciative. >>>>>> >>>>>> Thank you! >>>>>> _______________________________________________ >>>>>> stunnel-users mailing list >>>>>> stunnel-users(a)stunnel.org >>>>>> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >>>>>> >>>>>> _______________________________________________ >>>>>> stunnel-users mailing list >>>>>> stunnel-users(a)stunnel.org >>>>>> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >>>>>> >>>>> >>>>> _______________________________________________ >>>>> stunnel-users mailing list >>>>> stunnel-users(a)stunnel.org >>>>> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >>>> >>> >>> >> >> > >

1 0

Stunnel Windows Server 2008 R2
by 541401＠gmail.com 29 Aug '14

29 Aug '14

I have installed stunnel 5.03 on Windows Server 2008 R2 X64. When I run it as an application it works perfectly. When I install and run the service, it starts but the start notice window, title bar, says Stunnel 5.03 win32 (not configured). It appears that the stunnel service is not reading the stunnel.conf. If anyone has any suggestions how I can successfully run stunnel as a service, I would be very appreciative. Thank you!

5 12

SSL Server Allows Anonymous Authentication Vulnerability
by Michael Curran 25 Aug '14

25 Aug '14

I am looking at this vulnerability reported from McAfee -- but we use stunnel to secure our communications and not the application directly. Are these settings that I can make within the stunnel config -- or something comparable? SSLProtocol -ALL +SSLv3 +TLSv1 SSLCipherSuite ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM

2 2

Odd complication between VM clients, same host
by afpteam＠sbcglobal.net 24 Aug '14

24 Aug '14

Hi, Much appreciation to Stunnel and OpenSSL for a long, successful provision. I can't be sure yet if the concern below is Stunnel or OpenSSL related. I've surfed Google and found nothing similar. Stunnel package with integral OpenSSL is current release. I recently had to secure and connect two public facing client machines on the same Citrix Xen 6.2 release, running Server 2003 x 64 bit. I typically use Stunnel with self generated Pem, for securing short term TightVNC sessions. The config is always fairly generic, loopback allowed, securing across 127.0.0.1 Typically I don't make name references in the .conf profile, just accept / connect on related ports. This is the first time I recall ever pointing two VM's at each other. I have tried both service and gui on both Stunnel and VNC. Tried both application listing and discrete port listing in the server's windows firewall. I have tried updating security to the Admin account as owner or Administrators, in general. I have tried launching either or both as Administrator. When VNC client viewer calls to Server, Stunnel sees the connect, succeeds the Pem and stops. If I restart the stunnel service at the server, the viewer auth dialog suddenly succeeds. I question if this remains secured but clearly isn't practical for application. Both VM's are connected to me via RDP at the time, if this might relate to an Auth violation. I tried multiple VMs to eliminate anything related to a bungled VM config. I'm guessing there is some kind of circular routing restriction possibly. Citrix does use an X-window console to each VM on the control path, but in other instances there's never been any conflict. Not sure how to determine if the issue is config, Stunnel or OpenSSL or how to resolve it. Any suggestions would be appreciated. Regards and thank you again, Mike

1 0

Server side SNI and Windows problem
by Slava 17 Aug '14

17 Aug '14

I'm trying use SNI on Windows (server 2003 R2 or XP) stunnel 5.01 on x86-pc-msvc-1500 platform Compiled/running with OpenSSL 1.0.1g-fips 7 Apr 2014 stunnel.config ... [main] accept = 60000 connect = 10.0.21.1:80 [ssh] connect = 10.0.21.1:22 sni=main:ssh Client has line sni=ssh, but server not see this and attempt connect to :80. I'm try connect from linux and windows, same result For server on linux all work fine. ?

3 4

verify=4
by oweijr oweirj 12 Aug '14

12 Aug '14

Hello, In the stunnel documentation, I see the following: level 4 Ignore CA chain and only verify peer certificate. My interpretation of level 4 was that only the server certificate had to be installed on the client in order for the cert verification to pass. No issuer/CA certificates were needed. However, when I do this, the connection fails. I see this following in the logs with verify=4: 2014.08.12 21:17:57 LOG7[26768]: Starting certificate verification: depth=0, subject=/C=US/CN=a.b.com 2014.08.12 21:17:57 LOG4[26768]: CERT: Verification error: unable to get local issuer certificate 2014.08.12 21:17:57 LOG4[26768]: Certificate check failed: depth=0, subject=/C=US/CN=a.b.com 2014.08.12 21:17:57 LOG7[26768]: SSL alert (write): fatal: unknown CA 2014.08.12 21:17:57 LOG3[26768]: SSL_connect: 14090086: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed My config file contains the following: verify = 4 CAfile = /opt/stunnel/certs/clients.pem chroot = /opt/stunnel setuid = stunnel setgid = stunnel pid = /run/stunnel.pid debug = 7 output = stunnel.log options = NO_SSLv2 cert = /opt/stunnel/certs/server.pem key = /opt/stunnel/certs/server.pem If I append the issuer certificate to the CAfile, after the peer certificate, then the connection is successful with verify=4. Is this expected behavior? Is there a verify level that works as I described above: only the peer certificate needs to be present, no CA/issuer certificates at all? Thank you for your help.

1 0

unable to send SMTP over SSL
by Paul Hargrove 08 Aug '14

08 Aug '14

Hi, I'm a new user using stunnel-5.03 on Windows SBS 2003. I can't send email from Exchange but can from Outlook with same credentials on same network. Email gets stuck in the exchange smtp queue. Simple config: ; * Global options debug = 7 output = stunnel.log engine = capi options = NO_SSLv2 ; * Service definition [SMTP] client = yes accept = 8465 connect = smtp.virginmedia.com:465 protocol = smtp Logs look good but nothing seems to go: 2014.08.08 22:15:07 LOG7[7284]: Dispatching signals from the signal pipe 2014.08.08 22:15:07 LOG7[7284]: Processing SIGNAL_RELOAD_CONFIG 2014.08.08 22:15:07 LOG5[7284]: Reading configuration from file stunnel.conf 2014.08.08 22:15:07 LOG7[7284]: Enabling support for engine 'capi' 2014.08.08 22:15:07 LOG7[7284]: Initializing engine #1 (capi) 2014.08.08 22:15:07 LOG6[7284]: Engine #1 (capi) initialized 2014.08.08 22:15:07 LOG5[7284]: FIPS mode disabled 2014.08.08 22:15:07 LOG7[7284]: Compression disabled 2014.08.08 22:15:07 LOG7[7284]: Snagged 64 random bytes from C:/.rnd 2014.08.08 22:15:07 LOG7[7284]: Wrote 1024 new random bytes to C:/.rnd 2014.08.08 22:15:07 LOG7[7284]: PRNG seeded successfully 2014.08.08 22:15:07 LOG6[7284]: Initializing service [SMTP] 2014.08.08 22:15:08 LOG7[7284]: No private key specified 2014.08.08 22:15:08 LOG7[7284]: SSL options set: 0x01000004 2014.08.08 22:15:08 LOG5[7284]: Configuration successful 2014.08.08 22:15:08 LOG7[7284]: Closing service [SMTP] 2014.08.08 22:15:08 LOG7[7284]: Service [SMTP] closed (FD=292) 2014.08.08 22:15:08 LOG7[7284]: Sessions cached before flush: 7 2014.08.08 22:15:08 LOG7[7284]: Sessions cached after flush: 0 2014.08.08 22:15:08 LOG7[7284]: Service [SMTP] closed 2014.08.08 22:15:08 LOG7[7284]: Service [SMTP] (FD=292) bound to 0.0.0.0:8465 2014.08.08 22:15:08 LOG7[7284]: Signal pipe is empty 2014.08.08 22:16:03 LOG7[7284]: Service [SMTP] accepted (FD=392) from 127.0.0.1:26642 2014.08.08 22:16:03 LOG7[7284]: Creating a new thread 2014.08.08 22:16:03 LOG7[7284]: New thread created 2014.08.08 22:16:03 LOG7[7184]: Service [SMTP] started 2014.08.08 22:16:03 LOG5[7184]: Service [SMTP] accepted connection from 127.0.0.1:26642 2014.08.08 22:16:03 LOG6[7184]: s_connect: connecting 62.254.26.219:465 2014.08.08 22:16:03 LOG7[7184]: s_connect: s_poll_wait 62.254.26.219:465: waiting 10 seconds 2014.08.08 22:16:03 LOG5[7184]: s_connect: connected 62.254.26.219:465 2014.08.08 22:16:03 LOG5[7184]: Service [SMTP] connected remote server from 10.0.0.2:26643 2014.08.08 22:16:03 LOG7[7184]: Remote socket (FD=688) initialized 2014.08.08 22:16:14 LOG3[7184]: fd_getline: Unexpected socket close 2014.08.08 22:16:14 LOG5[7184]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2014.08.08 22:16:14 LOG7[7184]: Remote socket (FD=688) closed 2014.08.08 22:16:14 LOG7[7184]: Local socket (FD=392) closed 2014.08.08 22:16:14 LOG7[7184]: Service [SMTP] finished (0 left) 2014.08.08 22:16:14 LOG7[7184]: str_stats: 3 block(s), 4294966138 data byte(s), 150 control byte(s) 2014.08.08 22:16:14 LOG7[7184]: str_stats: 20 byte(s) at ..\src\network.c:413 2014.08.08 22:16:14 LOG7[7184]: str_stats: 20 byte(s) at ..\src\network.c:412 2014.08.08 22:16:14 LOG7[7184]: str_stats: 20 byte(s) at ..\src\network.c:411 If I rem out the protocol = smtp then the mails go from the queue and the logs seem to indicate a success: 2014.08.08 22:02:14 LOG7[7284]: Service [SMTP] accepted (FD=688) from 127.0.0.1:54520 2014.08.08 22:02:14 LOG7[7284]: Creating a new thread 2014.08.08 22:02:14 LOG7[7284]: New thread created 2014.08.08 22:02:14 LOG7[10072]: Service [SMTP] started 2014.08.08 22:02:14 LOG5[10072]: Service [SMTP] accepted connection from 127.0.0.1:54520 2014.08.08 22:02:14 LOG6[10072]: s_connect: connecting 62.254.26.219:465 2014.08.08 22:02:14 LOG7[10072]: s_connect: s_poll_wait 62.254.26.219:465: waiting 10 seconds 2014.08.08 22:02:14 LOG5[10072]: s_connect: connected 62.254.26.219:465 2014.08.08 22:02:14 LOG5[10072]: Service [SMTP] connected remote server from 10.0.0.2:54521 2014.08.08 22:02:14 LOG7[10072]: Remote socket (FD=456) initialized 2014.08.08 22:02:14 LOG6[10072]: SNI: sending servername: smtp.virginmedia.com 2014.08.08 22:02:14 LOG7[10072]: SSL state (connect): before/connect initialization 2014.08.08 22:02:14 LOG7[10072]: SSL state (connect): SSLv3 write client hello A 2014.08.08 22:02:14 LOG7[10072]: SSL state (connect): SSLv3 read server hello A 2014.08.08 22:02:14 LOG7[10072]: SSL state (connect): SSLv3 read finished A 2014.08.08 22:02:14 LOG7[10072]: SSL state (connect): SSLv3 write change cipher spec A 2014.08.08 22:02:14 LOG7[10072]: SSL state (connect): SSLv3 write finished A 2014.08.08 22:02:14 LOG7[10072]: SSL state (connect): SSLv3 flush data 2014.08.08 22:02:14 LOG7[10072]: 6 items in the session cache 2014.08.08 22:02:14 LOG7[10072]: 13 client connects (SSL_connect()) 2014.08.08 22:02:14 LOG7[10072]: 13 client connects that finished 2014.08.08 22:02:14 LOG7[10072]: 0 client renegotiations requested 2014.08.08 22:02:14 LOG7[10072]: 0 server connects (SSL_accept()) 2014.08.08 22:02:14 LOG7[10072]: 0 server connects that finished 2014.08.08 22:02:14 LOG7[10072]: 0 server renegotiations requested 2014.08.08 22:02:14 LOG7[10072]: 7 session cache hits 2014.08.08 22:02:14 LOG7[10072]: 0 external session cache hits 2014.08.08 22:02:14 LOG7[10072]: 0 session cache misses 2014.08.08 22:02:14 LOG7[10072]: 0 session cache timeouts 2014.08.08 22:02:14 LOG6[10072]: SSL connected: previous session reused 2014.08.08 22:02:16 LOG6[10072]: Read socket closed (readsocket) 2014.08.08 22:02:16 LOG7[10072]: Sending close_notify alert 2014.08.08 22:02:16 LOG7[10072]: SSL alert (write): warning: close notify 2014.08.08 22:02:16 LOG6[10072]: SSL_shutdown successfully sent close_notify alert 2014.08.08 22:02:16 LOG6[10072]: SSL socket closed (SSL_read) 2014.08.08 22:02:16 LOG7[10072]: Sent socket write shutdown 2014.08.08 22:02:16 LOG5[10072]: Connection closed: 80 byte(s) sent to SSL, 298 byte(s) sent to socket 2014.08.08 22:02:16 LOG7[10072]: Remote socket (FD=456) closed 2014.08.08 22:02:16 LOG7[10072]: Local socket (FD=688) closed 2014.08.08 22:02:16 LOG7[10072]: Service [SMTP] finished (0 left) 2014.08.08 22:02:16 LOG7[10072]: str_stats: 3 block(s), 4294963672 data byte(s), 150 control byte(s) 2014.08.08 22:02:16 LOG7[10072]: str_stats: 20 byte(s) at ..\src\network.c:413 2014.08.08 22:02:16 LOG7[10072]: str_stats: 20 byte(s) at ..\src\network.c:412 2014.08.08 22:02:16 LOG7[10072]: str_stats: 20 byte(s) at ..\src\network.c:411 but all Mails bounce with: There was a SMTP communication problem with the recipient's email server. Please contact your system administrator. <server.domain.local #5.5.0 smtp;530 Authentication Required (VM401)> Any ideas?

1 0

Re: [stunnel-users] stunnel 5.03 released
by Michal Trojnara 08 Aug '14

08 Aug '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Peter Pentchev wrote: > Um, there's just one little problem with this; what do you think > about the attached public-domain patch that removes what looks very > much like a stray quote character? Argh! Thank you. Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlPlP0MACgkQ/NU+nXTHMtG61QCgrh8w889DGai/Xbc7y42vTkQ/ /BQAnRsl60djjKX2O3PJWzRrVkLXDnEt =yKfI -----END PGP SIGNATURE-----

1 0

Re: [stunnel-users] stunnel 5.03 released
by Peter Pentchev 08 Aug '14

08 Aug '14

On Thu, Aug 07, 2014 at 10:15:47PM +0200, Michal Trojnara wrote: > Dear Users, > > I have released version 5.03 of stunnel. Hi, (-announce and openssl-users dropped from CC) Thanks a lot - and thanks for saving downstream distro maintainers the trouble of releasing an intermediate package update for the init script fix ;) > > The ChangeLog entry: [snip] > * Bugfixes [snip] > - Fixed whitespace handling in the stunnel.init script. Um, there's just one little problem with this; what do you think about the attached public-domain patch that removes what looks very much like a stray quote character? Once again, thanks for writing and maintaining stunnel! G'luck, Peter PS. I tried to send this from my <roam(a)ringlet.net> address, but mx1.mirt.net bounced my message due to a junkemailfilter.com blacklist problem that I've taken up with the folks over there (at junkemailfilter.com, not mirt.net, obviously ;) -- Peter Pentchev roam(a)ringlet.net roam(a)FreeBSD.org p.penchev(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

1 0

Windows Certificate Store
by j nasty 07 Aug '14

07 Aug '14

I haven't been able to get a definitive answer and can't find the information I need through traditional searching around. Anyways, is it possible to have sTunnel access the Windows certificate store to get the certificate that will be used for client authentication? If so, how can this be configured in sTunnel's configuration file? Or can you at least point me in the direction I can find the information I'm looking for? Many thanks in advance everyone!

2 1

stunnel 5.03 released
by Michal Trojnara 07 Aug '14

07 Aug '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.03 of stunnel. The ChangeLog entry: Version 5.03, 2014.08.07, urgency: HIGH: * Security bugfixes - OpenSSL DLLs updated to version 1.0.1i. See https://www.openssl.org/news/secadv_20140806.txt * New features - FIPS autoconfiguration cleanup. - FIPS canister updated to version 2.0.6. - Improved SNI diagnostic logging. * Bugfixes - Compilation fixes for old versions of OpenSSL. - Fixed whitespace handling in the stunnel.init script. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 5e8196f913bf7460082c1c7e5d436fbfba7f65d56c60065e6ccf0df9057294ef stunnel-5.03-android.zip 803bc85fbc80f22d71b13d4180e2d51c02586b2cc611169961a2745e47e31c4f stunnel-5.03-installer.exe 9a1e369466fa756e6f48b11480a3338c1fa4717e6472871bf4a3a96c483edd03 stunnel-5.03.tar.gz Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlPj3nMACgkQ/NU+nXTHMtGM3ACfdFm7k754Pzo1rhDkVb6rT5nO EEUAoJoSXbRPHu3jphxXYVA5SeJ05BXj =tFws -----END PGP SIGNATURE-----

1 0

Re: [stunnel-users] cert verification problem
by n n 07 Aug '14

07 Aug '14

Hi! I want to authenticate server, using valid cert from StartSSL, and I receive error: ## sie 07 16:24:17 yabba stunnel[4247]: LOG4[5495]: CERT: Verification error: unable to get local issuer certificate sie 07 16:24:17 yabba stunnel[4247]: LOG4[5495]: Certificate check failed: depth=1, subject=/C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Class 1 Primary Intermediate Server CA sie 07 16:24:17 yabba stunnel[4247]: LOG3[5495]: SSL_connect: 14090086: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed sie 07 16:24:17 yabba stunnel[4247]: LOG5[5495]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket ## I don't know what's wrong. There is server's config: ## chroot = /var/run/stunnel/ pid=/stunnel.pid setuid = nobody setgid = nobody [squid] accept = 80 connect = 127.0.0.1:3128 verify=0 ## Client's config: ## client = yes [proxy] accept = 127.0.0.1:8005 connect = server:80 ##

1 0

Possible false positive trojan detection on stunnel-5.02-installer.exe
by Drew Mayo 06 Aug '14

06 Aug '14

Hi all, This is just an FYI. I'm a recent user of stunnel, and one of my team has just alerted me that f-prot (and unfortunately hence google drive) detects the current windows installer for stunnel 5.02 as a trojan. virustotal (which confirms it matches the sha256) tells me that the file is detected as: W32/Trojan.TDWH-2255 W32/Trojan3.JUA I've raised a misclassification request with f-prot, but of course that will probably take some time to get resolved. Of course, it is remotely possible it's not false, but i'm betting the other way. -d

2 2

More peer cert info export, new verify option
by Michal Vaško 05 Aug '14

05 Aug '14

Hello, for our current use-case we needed to add functionality to stunnel and therefore have made few patches. We distribute these patches with our software and were wondering what do you think about including them directly in stunnel. Firstly, we need peer certificate fingerprints in MD5, SHA1, SHA224, SHA256, SHA384 and SHA512. Patched stunnel exports all these in separate variables "SSL_CLIENT_*". Secondly, we could need subjectAltName values. Patched stunnel exports these in "SSL_CLIENT_SAN", but only rfc822Name, iPAddress and dNSName as we need only these. It could easily be expanded to all the values. Lastly, we required verification as if we first used verify = 2 and after failing trying verify = 4 (verify = 3 is technically verify = 2 AND verify = 4, if I am not wrong, and we need verify = 2 OR verify = 4). For this purpose my patch adds new verify = 5 option. I want to say that we did not just make all these requirements up, but we want to conform to RFCs describing NETCONF over TLS and its configuration. All the patches are included so you can go through them. Thank you. Kind regards, Michal Vasko

1 0

Re: [stunnel-users] FIPS compliant Stunnel build
by Michael Curran 24 Jul '14

24 Jul '14

I have already requested the CD of software from OpenSSL -- that section does not really assist with the build functions. The FIPSDIR= option still did not allow Stunnel to autodiscover FIPS.h -- this is my openssl1.0.1h configure command openssl-fips-2.0.7 ./config ; make ; make install openssl-1.0.1h./config fips --openssldir=/usr/local/openssl-100 --with-fipslibdir=/usr/local/ssl/fips-2.0/lib --with-fipsdir=/usr/local/ssl/fips-2.0/ ; make depend ; make ; make test ; make install Stunnel5.02 I am not installling the newer copy of openssl to the rest of the system, just as libraries accessible to Stunnel for building with a version that is different than the OS installed openssl so as not to risk breaking ssh or OS Upgrade capabilities ./configure --with-ssl=/usr/local/openssl-100 --disable-libwrap ; make ; make install During the Make phase it just says it cannot find fips.h but it says fips enabled -- but when I tell it to use FIPS I get checking whether to enable FIPS mode support... yesconfigure: **************************************** SSLchecking for SSL directory... /usr/local/openssl-100checking /usr/local/openssl-100/include/openssl/engine.h usability... yeschecking /usr/local/openssl-100/include/openssl/engine.h presence... yeschecking for /usr/local/openssl-100/include/openssl/engine.h... yeschecking /usr/local/openssl-100/include/openssl/ocsp.h usability... yeschecking /usr/local/openssl-100/include/openssl/ocsp.h presence... yeschecking for /usr/local/openssl-100/include/openssl/ocsp.h... yeschecking /usr/local/openssl-100/include/openssl/fips.h usability... nochecking /usr/local/openssl-100/include/openssl/fips.h presence... nochecking for /usr/local/openssl-100/include/openssl/fips.h... noconfigure: WARNING: OpenSSL fips header not foundconfigure: **************************************** write the resultsconfigure: creating ./config.status Restarting Stunnel with fips=yes gives me this [!] FIPS_mode_set: F06D065: error:0F06D065:common libcrypto routines:FIPS_mode_set:fips mode not supported[!] Line 35: "[webapp]": Failed to initialize SSL The TODO file in Stunnel5.02 tarball has this * Support static FIPS-enabled build. Does this mean that it can only currently support a system that is fully fips enabled and not my static libraries that I use for building Stunnel? Thats what I get out of this. And upon further reading of the INSTALL.FIPS file I confirm this Unix HOWTO:* Only dynamic linking of the FIPS-enabled OpenSSL is currently supported, i.e. FIPS-enabled OpenSSL has to be configured with "shared" parameter. I cannot install it with dynamic libraries as I am required to build via the actual instructions for FIPS 140-2 compliance which implicitly states I cannot call out shared as part of the config options. Mike Curran From: mike_curran(a)hotmail.com To: nobody(a)dizum.com Subject: RE: FIPS compliant Stunnel build Date: Wed, 23 Jul 2014 17:34:08 -0500 I have already requested the CD of software from OpenSSL -- that section does not really assist with the build functions. The FIPSDIR= option still did not allow Stunnel to autodiscover FIPS.h -- this is my openssl1.0.1h configure command openssl-fips-2.0.7 ./config ; make ; make install openssl-1.0.1h./config fips --openssldir=/usr/local/openssl-100 --with-fipslibdir=/usr/local/ssl/fips-2.0/lib --with-fipsdir=/usr/local/ssl/fips-2.0/ ; make depend ; make ; make test ; make install Stunnel5.02 I am not installling the newer copy of openssl to the rest of the system, just as libraries accessible to Stunnel for building with a version that is different than the OS installed openssl so as not to risk breaking ssh or OS Upgrade capabilities ./configure --with-ssl=/usr/local/openssl-100 --disable-libwrap ; make ; make install During the Make phase it just says it cannot find fips.h but it says fips enabled -- but when I tell it to use FIPS I get checking whether to enable FIPS mode support... yesconfigure: **************************************** SSLchecking for SSL directory... /usr/local/openssl-100checking /usr/local/openssl-100/include/openssl/engine.h usability... yeschecking /usr/local/openssl-100/include/openssl/engine.h presence... yeschecking for /usr/local/openssl-100/include/openssl/engine.h... yeschecking /usr/local/openssl-100/include/openssl/ocsp.h usability... yeschecking /usr/local/openssl-100/include/openssl/ocsp.h presence... yeschecking for /usr/local/openssl-100/include/openssl/ocsp.h... yeschecking /usr/local/openssl-100/include/openssl/fips.h usability... nochecking /usr/local/openssl-100/include/openssl/fips.h presence... nochecking for /usr/local/openssl-100/include/openssl/fips.h... noconfigure: WARNING: OpenSSL fips header not foundconfigure: **************************************** write the resultsconfigure: creating ./config.status Restarting Stunnel with fips=yes gives me this [!] FIPS_mode_set: F06D065: error:0F06D065:common libcrypto routines:FIPS_mode_set:fips mode not supported[!] Line 35: "[webapp]": Failed to initialize SSL The TODO file in Stunnel5.02 tarball has this * Support static FIPS-enabled build. Does this mean that it can only currently support a system that is fully fips enabled and not my static libraries that I use for building Stunnel? Thats what I get out of this. Mike Curran > From: nobody(a)dizum.com > To: mike_curran(a)hotmail.com > Subject: Re: FIPS compliant Stunnel build > Date: Thu, 24 Jul 2014 00:00:37 +0200 > > it IS possible... > > use FIPSDIR environment variable -- > NOT any change to FIPS Object Module ./config command > > BUT most important see: > > 6.6 The "Secure Installation" Issue > > of > > User Guide for the OpenSSL FIPS Object Module v2.0 > (including v2.0.1, v2.0.2, v2.0.3, v2.0.4, v2.0.5, v2.0.6, v2.0.7) >

2 1

OpenVPN over stunnel
by Derek Cole 24 Jul '14

24 Jul '14

Hello, I am doing something similar to what is happening in this scenario: http://kyl191.net/2012/12/tunneling-openvpn-through-stunnel/ That is, I have set my openvpn client configuration to be "remote localhost port" where port is the port my stunnel client is listening on the same box as my openvpn client. This seems to work - I get connected to OpenVPN server fine, however, I don't seem to be able to ping the openvpn server by either of it's public or private ip addresses. In fact, it seems like when I do a tcpdump on the stunnel server, I don't see any incoming traffic on port 443. How is it possible that I am getting the VPN connection, but then the rest of the traffic just sort of stops going through stunnel? My stunnel client service looks like the following: [openvpn] accept = 127.0.0.1:5150 connect = stunnelserver:443 and my stunnel server looks like: [ovpnout] cert = mycert.pem accept = 443 connect = openvpn server Any ideas?

2 3

FIPS compliant Stunnel build
by Michael Curran 23 Jul '14

23 Jul '14

Hello -- Is Stunnel (any version) compatible with Fips-2.0 for compliance? I have found one individuals instructions for compiling fips-2.0.5 , but he calls out a prefix= in his configure for FIPS which breaks 140-2 compliance rules and makes the build no longer viable >From the Fips-2.0 userguide "Note that as a condition of the FIPS 140-2 validation no other user specified configuration optionsmay be specified. This restriction means that an optional install prefix cannot be specified –however, there is no restriction on subsequent manual relocation of the generated files to thedesired final location." I know that Stunnel compiles just fine with OpenSSL1.0.1 versions, but there appears to have been a difference in the method of validation and installation of FIPS modules into a seperate modular directory, and is not located in the openssl/include files after build now The stunnel configure script only looks for fips-1.0 as well , so my base assumption is might not be capable of handling FIPS-2.0 at this time.

1 0