- stunnel-users - stunnel.org

Expired Certificate
by Andrew Smith 09 Jun '14

09 Jun '14

I am pretty new to Stunnel as I have inherited the project at my company. Yesterday the certificate expired on our Windows Server 2008 for Stunnel. What are the steps to renew this certificate? ________________________________ Andrew Smith Support Technical Services Analyst P: 614-875-4910 x109 F: 614-875-4088 E: andrew.smith(a)harriscomputer.com [http://www.harriscomputer.com/images/signatures/HarrisSchools.jpg] [http://www.harriscomputer.com/images/signatures/DivisionofHarris.gif]<http://www.harriscomputer.com/> 6110 Enterprise Parkway Grove City, OH 43123 www.harris-schoolsolutions.com<http://www.harris-schoolsolutions.com> This message is intended exclusively for the individual or entity to which it is addressed. This communication may contain information that is proprietary, privileged or confidential or otherwise legally exempt from disclosure. If you are not the named addressee, you are not authorized to read, print, retain, copy or disseminate this message or any part of it. If you have received this message in error, please notify the sender immediately by e-mail and delete all copies of the message.

2 1

none cipher
by Mark Sullivan 09 Jun '14

09 Jun '14

How can I use the none cipher with SSL? which ciphers allow for the best throughput?

2 1

stunnel 5.02 released
by Michal Trojnara 09 Jun '14

09 Jun '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.02 of stunnel. The ChangeLog entry: Version 5.02, 2014.06.09, urgency: HIGH: * Security bugfixes - OpenSSL DLLs updated to version 1.0.1h. See http://www.openssl.org/news/secadv_20140605.txt * New features - Major rewrite of the protocol.c interface: it is now possible to add protocol negotiations at multiple connection phases, protocols can individually decide whether the remote connection will be established before or after SSL/TLS is negotiated. - Heap memory blocks are wiped before release. This only works for block allocated by stunnel, and not by OpenSSL or other libraries. - The safe_memcmp() function implemented with execution time not dependent on the compared data. - Updated the stunnel.conf and stunnel.init templates. - Added a client-mode example to the manual. * Bugfixes - Fixed "failover = rr" broken since version 5.00. - Fixed "taskbar = no" broken since version 5.00. - Compilation fix for missing SSL_OP_MSIE_SSLV2_RSA_PADDING option. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: c258b71d7f82bba5b0a4ccc69fbda632f1fefe9108589a92aa1016f33985973e stunnel-5.02.tar.gz 2125bf8e9241cb9f7969cb74f8409ce77f2c49e1390d363aa46bc436b9d908aa stunnel-5.02-installer.exe f962a2f4a0e16f07ff10339066ec89d7686734dcabba88654f2e71da4f658529 stunnel-5.02-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlOVrZkACgkQ/NU+nXTHMtHBIQCfefzazgvECg8p4qoHgsMjw/KM gTQAoM0mYm+S7exolJjiBBfSlx2G8Rjn =hyr4 -----END PGP SIGNATURE-----

1 0

OpenSSL dlls update for Windows (security advisory 20140605)
by Javier 07 Jun '14

07 Jun '14

Hi, as a mere user I ask, should we expect a new Stunnel version in a few days even it is not an Stunnel vulnerability or is it enough to just update ssleay and libeay with 1.0.1h by us under Windows? Just in case ssleay and libeay are compiled different than official builds. Regards. http://www.openssl.org/news/secadv_20140605.txt

1 0

behavior change after enabling proxy protocol
by Philippe Anctil 05 Jun '14

05 Jun '14

Hello, We use stunnel to secure a proprietary tcp/ip protocol over the internet. More specifially we have - 1 balancer - 2 stunnel boxes - 1 app server The load balancer 'pings' stunnel boxes regularly to know if one is down. Recently, we have added support for the proxy protocol in our app and turned it on in our stunnel config. It works great except for one small new behavior: upon receiving a load balancer ping, stunnel performs a connection on our app (and sends the proxy header). I ran a tcpdump for a telnet on the stunnel port (8000). With proxy protocol disabled, stunnel does nothing while it waits for the certificate. The connection ended at my request. 17:33:08.537385 IP 127.0.0.1.6015 > 127.0.0.1.8000: S 356922015:356922015(0) win 32792 <mss 16396,sackOK,timestamp 1085620573 0,nop,wscale 7> 17:33:08.537386 IP 127.0.0.1.8000 > 127.0.0.1.6015: S 1525966521:1525966521(0) ack 356922016 win 32768 <mss 16396,sackOK,timestamp 1085620573 1085620573,nop,wscale 7> 17:33:08.537393 IP 127.0.0.1.6015 > 127.0.0.1.8000: . ack 1 win 257 <nop,nop,timestamp 1085620573 1085620573> 17:33:19.750431 IP 127.0.0.1.6015 > 127.0.0.1.8000: F 1:1(0) ack 1 win 257 <nop,nop,timestamp 1085631785 1085620573> 17:33:19.751065 IP 127.0.0.1.8000 > 127.0.0.1.6015: . ack 2 win 256 <nop,nop,timestamp 1085631786 1085631785> 17:33:19.751794 IP 127.0.0.1.8000 > 127.0.0.1.6015: R 1:1(0) ack 2 win 256 <nop,nop,timestamp 1085631787 1085631785> With proxy protocol enabled, stunnel establishes a connection to my app and sends the proxy protocol before even receiving the certificate. 17:34:35.370462 IP 127.0.0.1.6026 > 127.0.0.1.8000: S 2949098861:2949098861(0) win 32792 <mss 16396,sackOK,timestamp 1085707402 0,nop,wscale 7> 17:34:35.370475 IP 127.0.0.1.8000 > 127.0.0.1.6026: S 1044893129:1044893129(0) ack 2949098862 win 32768 <mss 16396,sackOK,timestamp 1085707402 1085707402,nop,wscale 7> 17:34:35.370481 IP 127.0.0.1.6026 > 127.0.0.1.8000: . ack 1 win 257 <nop,nop,timestamp 1085707402 1085707402> 17:34:35.371035 IP 127.0.0.1.37654 > 127.0.0.1.9000: S 801705083:801705083(0) win 32792 <mss 16396,sackOK,timestamp 1085707402 0,nop,wscale 7> 17:34:35.371046 IP 127.0.0.1.9000 > 127.0.0.1.37654: S 4068822820:4068822820(0) ack 801705084 win 32768 <mss 16396,sackOK,timestamp 1085707402 1085707402,nop,wscale 7> 17:34:35.371052 IP 127.0.0.1.37654 > 127.0.0.1.9000: . ack 1 win 257 <nop,nop,timestamp 1085707402 1085707402> 17:34:35.371583 IP 127.0.0.1.37654 > 127.0.0.1.9000: P 1:44(43) ack 1 win 257 <nop,nop,timestamp 1085707403 1085707402> 17:34:35.371595 IP 127.0.0.1.9000 > 127.0.0.1.37654: . ack 44 win 256 <nop,nop,timestamp 1085707403 1085707403> 17:34:50.484991 IP 127.0.0.1.9000 > 127.0.0.1.37654: F 1:1(0) ack 44 win 256 <nop,nop,timestamp 1085722515 1085707403> 17:34:50.485892 IP 127.0.0.1.37654 > 127.0.0.1.9000: . ack 2 win 257 <nop,nop,timestamp 1085722516 1085722515> 17:35:08.824661 IP 127.0.0.1.6026 > 127.0.0.1.8000: F 1:1(0) ack 1 win 257 <nop,nop,timestamp 1085740854 1085707402> 17:35:08.824906 IP 127.0.0.1.8000 > 127.0.0.1.6026: . ack 2 win 256 <nop,nop,timestamp 1085740854 1085740854> 17:35:08.824972 IP 127.0.0.1.37654 > 127.0.0.1.9000: R 44:44(0) ack 2 win 257 <nop,nop,timestamp 1085740854 1085722515> 17:35:08.825013 IP 127.0.0.1.8000 > 127.0.0.1.6026: R 1:1(0) ack 2 win 256 <nop,nop,timestamp 1085740855 1085740854> Note I used 'tcpdump -i lo -nn port 8000 or port 9000' for both traces. I see no good reason to connect to the application before the ssl session is established. Thank you for reading! -- Philippe Anctil

2 2

log format
by Philippe Anctil 04 Jun '14

04 Jun '14

I have noticed stunnel 5.01 log format is different when I run it under my account vs when I run it on the system. I don't remember seeing this with stunnel 4.56 and older. Format under my account: 2014.06.02 11:38:50 LOG6[26855]: SSL accepted: new session negotiated Format on the system: Jun 4 16:27:14 hostname stunnel: LOG6[11100:0]: SSL accepted: new session negotiated When I run under my account I normally save output to a separate file with output=. I guess this is what is having an influence on the log format? Is there any way I can have logging format in my account consistent with what I have in syslog? Thanks. -- Philippe Anctil

1 0

Problem with pidfile
by reg14＠rambler.ru 30 May '14

30 May '14

I run stunnel (version 5.00) as a non-root user which does not have write permissions to /var/run. So I created file /var/run/stunnel.log with right access for that user -rw-r--r--. 1 stunnel stunnel 0 May 28 21:31 stunnel.pid When I start daemon, it writes to logfile the following 2014.05.28 22:18:44 LOG3[8878]: Cannot create pid file /var/run/stunnel.pid 2014.05.28 22:18:44 LOG3[8878]: create: File exists (17) It seems that it tries to create pidfile in /var/run, and ignores that the file is already exists. As a result, pid is not written to stunnel.pid, and daemon crashes. Could this be fixed?

3 7

Possible Mail Relay (port 465/tcp-SSL) after stunnel install
by Sven Schulte 28 May '14

28 May '14

Dear colleagues, after installing stunnel (v 5.01) an PCI Security Scan finished with finding that port 465 allows mail relaying. (CVE-1999-0512, CVE-2002-1278, CVE-2003-0285). Any comments/ideas how to comly? Thanks in advance! Sven

1 0

Strange performance problem, need help troubleshooting
by Paulo Azevedo 24 May '14

24 May '14

I have a strange performance problem with stunnel, could you help me? Here is my setup: PC1 & PC2 -- Switch (GbE) -- Switch (100mbps) -- Router -- modem -- Internet PC1 has stunnel and HFS installed, sharing a folder to the internet.My internet upload speed is 20Mbps. With this setup, I can serve files at 8Mbps over the internet, but if I disable stunnel the speed doubles to 16Mbps. However, with stunnel active, if I try the same with PC2, I get 82Mbps (using the internet IP, it goes all the way to the router), so this does not appear to be a performance problem on the hardware. Can you give me some hints on what is limiting my speed here?

2 1

[patch] Systemd socket activation support in daemon mode
by Mark Theunissen 14 May '14

14 May '14

Hi, This patch allows stunnel to be started in daemon mode by systemd's socket activation. This is superior to inetd mode, for all the reasons specified in the stunnel howto. Since systemd is now the default in most of the major Linux distros, it would be great to have this committed upstream. https://gist.github.com/marktheunissen/7ce9426e66aa8f0ec2e1 Example systemd unit files: ### stunnel.socket [Unit] Description=Stunnel socket After=network.target [Socket] ListenStream=9999 ### stunnel.service [Unit] Description=Stunnel service After=network.target [Service] Type=forking ExecStart=stunnel /etc/stunnel/stunnel.conf Thanks, Mark Theunissen

1 1

Re: [stunnel-users] certificate verify failed
by Aaron Haywood 05 May '14

05 May '14

The following is an excerpt from my log's slightly modified to hide company specific data: 2014.05.01 10:11:05 LOG7[5956]: Starting certificate verification: depth=2, subject=/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority 2014.05.01 10:11:05 LOG6[5956]: Certificate accepted: depth=2, subject=/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority 2014.05.01 10:11:05 LOG7[5956]: Starting certificate verification: depth=1, subject=/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=######## 2014.05.01 10:11:05 LOG6[5956]: Certificate accepted: depth=1, subject=/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=######## 2014.05.01 10:11:05 LOG7[5956]: Starting certificate verification: depth=0, subject=/O=*.somedomain.com/OU=Domain Control Validated/CN=*.somedomain.com 2014.05.01 10:11:05 LOG3[5956]: CERT: X509_STORE_get1_certs: Peer suddenly disconnected 2014.05.01 10:11:05 LOG4[5956]: Certificate check failed: depth=0, subject=/O=*.somedomain.com/OU=Domain Control Validated/CN=*.somedomain.com 2014.05.01 10:11:05 LOG7[5956]: SSL alert (write): fatal: certificate unknown Respectfully, Aaron Haywood | Systems Administrator [cid:[email protected]] O: 858.614.1547 | M: 858.699.8302 | www.sdhealthconnect.org CONNECT WITH US: Facebook<https://www.facebook.com/SDHealthConnect?filter=1> | Twitter<https://twitter.com/SDHealthConnect> | LinkedIn<http://www.linkedin.com/company/san-diego-health-connect?trk=company_logo> | Google+<https://plus.google.com/u/0/b/112077458420951237937/112077458420951237937/p…> | YouTube<http://www.youtube.com/SDHealthConnect>

1 0

Re: [stunnel-users] certificate verify failed
by Aaron Haywood 05 May '14

05 May '14

Roman, I was wondering if you changed your verify from level 3 to level 2, and if this resolved your peer disconnection error with stunnel. We're experiencing a similar problem but was wondering if anyone out there has resolved this issue already; and if so..how? :) Respectfully, Aaron Haywood | Systems Administrator [cid:[email protected]] O: 858.614.1547 | M: 858.699.8302 | www.sdhealthconnect.org CONNECT WITH US: Facebook<https://www.facebook.com/SDHealthConnect?filter=1> | Twitter<https://twitter.com/SDHealthConnect> | LinkedIn<http://www.linkedin.com/company/san-diego-health-connect?trk=company_logo> | Google+<https://plus.google.com/u/0/b/112077458420951237937/112077458420951237937/p…> | YouTube<http://www.youtube.com/SDHealthConnect>

1 0

New stunnel how-to
by Patrick J. 30 Apr '14

30 Apr '14

Hi all, I've spent some time to write a new stunnel how-to. - Install and configure stunnel on a Raspberry Pi - Run stunnel in a chroot jail - Limit allowed ciphers and force Forward Secrecy - Restrict access to the stunnel server (verify = 3) - Disguise SSH as HTTPS traffic http://stunnel.qnea.net/ Regards from Germany, Patrick

1 1

Error 126 compiling on Mac OS X 10.7.5
by James Brown 29 Apr '14

29 Apr '14

I’ve just tried to install version 5.01 and encountered an error. I had no problems installing 5.01b1 previously. I just thought I’d install the release version. System is running Mac OS X 10.7.5. make ends with a warning, and make install fails: ld: warning: directory not found for option '-L/usr//lib64' Making all in doc make[1]: Nothing to be done for `all'. Making all in tools make[1]: Nothing to be done for `all'. make[1]: Nothing to be done for `all-am'. mail:stunnel-5.01 2 jlbrown$ sudo make install Password: Making install in src ../auto/install-sh -c -d '/usr/local/bin' /bin/sh ../libtool --mode=install /usr/bin/install -c stunnel '/usr/local/bin' libtool: install: /usr/bin/install -c stunnel /usr/local/bin/stunnel ../auto/install-sh -c -d '/usr/local/bin' /usr/bin/install -c stunnel3 '/usr/local/bin' ../auto/install-sh -c -d '/usr/local/lib/stunnel' /bin/sh ../libtool --mode=install /usr/bin/install -c libstunnel.la '/usr/local/lib/stunnel' libtool: install: /usr/bin/install -c .libs/libstunnel.dylib /usr/local/lib/stunnel/libstunnel.dylib libtool: install: /usr/bin/install -c .libs/libstunnel.lai /usr/local/lib/stunnel/libstunnel.la /Users/jlbrown/Downloads/stunnel-5.01: /Users/jlbrown/Downloads/stunnel-5.01: is a directory make[2]: *** [install-pkglibLTLIBRARIES] Error 126 make[1]: *** [install-am] Error 2 make: *** [install-recursive] Error 1 I just used ./configure with no arguments. Any suggestions? Thanks, James.

1 0

Verify=2 and Verification Depth...
by Matt Wise 28 Apr '14

28 Apr '14

It was my understanding that when you have an Stunnel Server configured with 'verify=2', that the client that connects must have a certificate signed by the same CA/SubCA combination that the server does. So for example: - My_Root_Ca (private CA) - Some_Random_Cert.pem - Stunnel_Sub_Ca: - Server.pem - Client.pem - Postgres_Sub_Ca: - Server.pem - postgres_user.pem With the above structure in place (and the stunnel server using Stunnel_Sub_Ca/Server.pem) if someone tried to connect in with the Stunnel_Sub_Ca/Client.pem cert, it would work... but if they tried to connect in with Postgres_Sub_Ca/Server.pem, it wouldn't. Unfortunately we're not seeing that behavior... we're seeing a behavior where *every* cert signed by the overall Root CA is validated. We're able to connect in using Some_Random_Cert.pem, Postgres_Sub_Ca/Server.pem and Postgres_Sub_Ca/postgres_user.pem. This feels wrong ... what am I missing? (We're using Stunnel 4.55 btw) Matt Wise Sr. Systems Architect Nextdoor.com

1 1

ephemeral port limit
by Frank Liu 28 Apr '14

28 Apr '14

Hi, I am trying to use stunnel to add ssl support to my app. My app and linux server are tuned to accept 200k+ connections without a problem. When adding stunnel on the same server, the connection stops when it reaches 64k due to stunnel uses ephemeral ports to connect to my app on the localhost. Any suggestions how to get around this limit? One thing I am thinking of is to add 10 virtual interfaces on loopback: lo0:2, lo0:3, etc with ip 127.0.0.2, 127.0.0.3 etc. Can stunnel be configured to cycle through a pool of ip for outbound connection to my app listening on 127.0.0.1? That would give 10x64k of ephemeral ports. I see stunnel has "local" to specify outgoing ip, but I am not sure if it supports a list of ip or use multiple times. If so, will it round robin the list? Thanks Frank

2 2

Syringe
by Michal Trojnara 21 Apr '14

21 Apr '14

Hi Guys, I'm glad to announce syringe, a service for testing client-side heartbleed. It allows to easily examine most of the obscure TLS clients (for example embedded devices). The service is available online at https://www.stunnel.org:4433/ Best regards, Mike

2 2

hardware random
by ios dev 20 Apr '14

20 Apr '14

Hello. I am using GOST engine and set it as default for ALL. At the same time i want to use hardware RNG from other engine. How can i do this? -- BR, Dev.

1 0

Problem with round robin on stunnel 5.0 and 5.1
by WNSDEV 14 Apr '14

14 Apr '14

When I use either of these two versions of stunnel the round-robin for "connect" only sends connections to the first host listed on the configuration file. However the round-robin works in Stunnel 4.56,4.55,4.54 and 4.53. Anyone else have this issue? Thank you, Pete Sangas ./stunnel -version stunnel 5.00 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.1g 7 Apr 2014 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Global options: debug = daemon.notice RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = HIGH:MEDIUM:+3DES:+DH:!aNULL:!SSLv2 (with "fips = no") curve = prime256v1 sessionCacheSize = 1000 sessionCacheTimeout = 300 seconds sslVersion = TLSv1 (with "fips = yes") sslVersion = TLSv1 for client, all for server (with "fips = no") stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none Config file : CApath = /xxx/certs/trusted CAfile = /yyy/cacert.pem ciphers = RC4-SHA debug = daemon.7 pid = /zzz/stunnel.pid options = NO_SSLv2 foreground = yes setgid = gid1 setuid = uid1 delay = no fips=no [stunnel] TIMEOUTidle=86400 verify = 3 cert = /path/servercert.pem accept = 443 failover=rr connect = 10.1.1.50:23 connect = 10.1.1.60:23

2 2

DH not working, although initialized correctly
by Ovidiu Lixandru 14 Apr '14

14 Apr '14

Hello, I'm trying to enable Forward Secrecy. have an stunnel 4.56 instance compiled with authpriv and xforwardedfor patches, configured as follows: sslVersion = all options = NO_SSLv2 ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4 renegotiation = no setuid = nobody setgid = nobody socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 libwrap = no TIMEOUTbusy = 120 xforwardedfor = yes [domain.com] accept = X.X.X.X:443 connect = 127.0.0.1:91 cert = /etc/pki/tls/certs/domain.pem key = /etc/pki/tls/private/domain.key domain.pem contains both the SSL certificate and the DH parameters (generated with "openssl dhparams 2048"). stunnel initializes the DH parameters correctly: 2014.04.14 12:08:18 LOG6[16629:140355580176320]: Initializing service [domain.com] 2014.04.14 12:08:18 LOG7[16629:140355580176320]: Certificate: /etc/pki/tls/certs/domain.pem 2014.04.14 12:08:18 LOG7[16629:140355580176320]: Certificate loaded 2014.04.14 12:08:18 LOG7[16629:140355580176320]: Key file: /etc/pki/tls/private/domain.key 2014.04.14 12:08:18 LOG7[16629:140355580176320]: Private key loaded 2014.04.14 12:08:18 LOG7[16629:140355580176320]: Using DH parameters from /etc/pki/tls/certs/domain.pem 2014.04.14 12:08:18 LOG7[16629:140355580176320]: DH initialized with 2048-bit key 2014.04.14 12:08:18 LOG7[16629:140355580176320]: SSL options set: 0x01000004 When I try to connect using openssl s_client, the connections fails with it unable to negotiate a cipher. On the client side: # openssl s_client -cipher ECDH -tls1 -connect www.domain.com:443 CONNECTED(00000003) 140735113126752:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1256:SSL alert number 40 140735113126752:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:596: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 7 bytes and written 0 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1 Cipher : 0000 Session-ID: Session-ID-ctx: Master-Key: Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1397471905 Timeout : 7200 (sec) Verify return code: 0 (ok) --- On the server side: 2014.04.14 11:57:10 LOG5[9647:140038728394496]: Service [domain.com] accepted connection from X.X.X.X:56678 2014.04.14 11:57:10 LOG7[9647:140038728394496]: SSL state (accept): before/accept initialization 2014.04.14 11:57:10 LOG7[9647:140038728394496]: SNI: no virtual services defined 2014.04.14 11:57:10 LOG7[9647:140038728394496]: SSL alert (write): fatal: handshake failure 2014.04.14 11:57:10 LOG3[9647:140038728394496]: SSL_accept: 1408A0C1: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher 2014.04.14 11:57:10 LOG5[9647:140038728394496]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket The client and the server have the same openssl version (1.0.1e), with the same supported ciphers. I tried different cipher combinations (i.e. "HIGH:!aNULL:!MD5"), but no lock. FWIW, the initial DH cipher list in the stunnel config file works correctly in an SSL nginx instance and openssl s_client negotiates "ECDHE-RSA-AES256-SHA". Any idea what may be wrong with stunnel? Thanks, Ovidiu

1 0

Re: [stunnel-users] Some troubles with PROXY protocol
by Alexey V. Drozdov 13 Apr '14

13 Apr '14

Hi, Mike! In spite of new changes, it's still work incorrect because of init_remote(c) connect to the address from root config section: protocol(c, PROTOCOL_PRE_CONNECT); init_remote(c); <<<<<<<<<< destination address from root section protocol(c, PROTOCOL_PRE_SSL); init_ssl(c); <<<<<<<<<<< switch to target SNI config section only there protocol(c, PROTOCOL_POST_SSL); <<<<<<<<<<< send PROXY protocol to incorrect address Context switch to target section parameters after init_ssl(c) only. /Alexey V. Drozdov e-mail: anyquist(a)yandex.ru

2 2

Connection closed with a turn server backend
by pablo platt 12 Apr '14

12 Apr '14

Hi, I'm trying to tunnel TLS connection to a turn server https://code.google.com/p/rfc5766-turn-server/ The connection is closed with; SSL socket closed on SSL_read I'm using the ubuntu 12.04 package http://packages.ubuntu.com/precise/stunnel4 Am I missing a configuration option in my stunnel config? Please see my config and log bellow. ----------------------------------------------- chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid debug = 7 output = /stunnel.log [ssl] accept = 443 connect = 3478 cert = /etc/stunnel/cert.pem key = /etc/stunnel/key.pem ---------------------------------------------------- 2014.04.12 13:40:15 LOG7[14983:140499885700864]: No limit detected for the number of clients 2014.04.12 13:40:15 LOG7[14983:140499885700864]: signal_pipe: FD=3 allocated (non-blocking mode) 2014.04.12 13:40:15 LOG7[14983:140499885700864]: signal_pipe: FD=4 allocated (non-blocking mode) 2014.04.12 13:40:15 LOG5[14983:140499885700864]: stunnel 4.42 on x86_64-pc-linux-gnu platform 2014.04.12 13:40:15 LOG5[14983:140499885700864]: Compiled/running with OpenSSL 1.0.1 14 Mar 2012 2014.04.12 13:40:15 LOG5[14983:140499885700864]: Threading:PTHREAD SSL:ENGINE Auth:LIBWRAP Sockets:POLL,IPv6 2014.04.12 13:40:15 LOG5[14983:140499885700864]: Reading configuration from file /etc/stunnel/stunnel.conf 2014.04.12 13:40:15 LOG7[14983:140499885700864]: PRNG seeded successfully 2014.04.12 13:40:15 LOG6[14983:140499885700864]: Initializing SSL context for service ssl 2014.04.12 13:40:15 LOG4[14983:140499885700864]: Insecure file permissions on /etc/stunnel/key.pem 2014.04.12 13:40:15 LOG7[14983:140499885700864]: Certificate: /etc/stunnel/cert.pem 2014.04.12 13:40:15 LOG7[14983:140499885700864]: Certificate loaded 2014.04.12 13:40:15 LOG7[14983:140499885700864]: Key file: /etc/stunnel/key.pem 2014.04.12 13:40:15 LOG7[14983:140499885700864]: Private key loaded 2014.04.12 13:40:15 LOG7[14983:140499885700864]: Could not load DH parameters from /etc/stunnel/cert.pem 2014.04.12 13:40:15 LOG7[14983:140499885700864]: Using hardcoded DH parameters 2014.04.12 13:40:15 LOG7[14983:140499885700864]: DH initialized with 2048-bit key 2014.04.12 13:40:15 LOG7[14983:140499885700864]: ECDH initialized with curve prime256v1 2014.04.12 13:40:15 LOG7[14983:140499885700864]: SSL options set: 0x00000004 2014.04.12 13:40:15 LOG6[14983:140499885700864]: SSL context initialized 2014.04.12 13:40:15 LOG5[14983:140499885700864]: Configuration successful 2014.04.12 13:40:15 LOG7[14983:140499885700864]: libwrap_init: FD=5 allocated (blocking mode) 2014.04.12 13:40:15 LOG7[14983:140499885700864]: libwrap_init: FD=6 allocated (blocking mode) 2014.04.12 13:40:15 LOG7[14983:140499885700864]: libwrap_init: FD=6 allocated (blocking mode) 2014.04.12 13:40:15 LOG7[14983:140499885700864]: libwrap_init: FD=7 allocated (blocking mode) 2014.04.12 13:40:15 LOG7[14983:140499885700864]: libwrap_init: FD=7 allocated (blocking mode) 2014.04.12 13:40:15 LOG7[14983:140499885700864]: libwrap_init: FD=8 allocated (blocking mode) 2014.04.12 13:40:15 LOG7[14983:140499885700864]: libwrap_init: FD=8 allocated (blocking mode) 2014.04.12 13:40:15 LOG7[14983:140499885700864]: libwrap_init: FD=9 allocated (blocking mode) 2014.04.12 13:40:15 LOG7[14983:140499885700864]: libwrap_init: FD=9 allocated (blocking mode) 2014.04.12 13:40:15 LOG7[14983:140499885700864]: libwrap_init: FD=10 allocated (blocking mode) 2014.04.12 13:40:15 LOG7[14983:140499885700864]: accept socket: FD=11 allocated (non-blocking mode) 2014.04.12 13:40:15 LOG7[14983:140499885700864]: Option SO_REUSEADDR set on accept socket 2014.04.12 13:40:15 LOG7[14983:140499885700864]: Service ssl bound to 0.0.0.0:443 2014.04.12 13:40:15 LOG7[14983:140499885700864]: Service ssl opened FD=11 2014.04.12 13:40:15 LOG7[14989:140499885700864]: Created pid file /stunnel4.pid 2014.04.12 13:40:17 LOG7[14989:140499885700864]: local socket: FD=0 allocated (non-blocking mode) 2014.04.12 13:40:17 LOG7[14989:140499885700864]: Service ssl accepted FD=0 from 192.168.56.1:54561 2014.04.12 13:40:17 LOG7[14989:140499885700864]: local socket: FD=1 allocated (non-blocking mode) 2014.04.12 13:40:17 LOG7[14989:140499885700864]: Service ssl accepted FD=1 from 192.168.56.1:54562 2014.04.12 13:40:17 LOG7[14989:140499885692672]: Service ssl started 2014.04.12 13:40:17 LOG7[14989:140499885692672]: Option TCP_NODELAY set on local socket 2014.04.12 13:40:17 LOG7[14989:140499885692672]: Waiting for a libwrap process 2014.04.12 13:40:17 LOG7[14989:140499885692672]: Acquired libwrap process #0 2014.04.12 13:40:17 LOG7[14989:140499885790976]: Service ssl started 2014.04.12 13:40:17 LOG7[14989:140499885790976]: Option TCP_NODELAY set on local socket 2014.04.12 13:40:17 LOG7[14989:140499885790976]: Waiting for a libwrap process 2014.04.12 13:40:17 LOG7[14989:140499885790976]: Acquired libwrap process #1 2014.04.12 13:40:17 LOG7[14989:140499885692672]: Releasing libwrap process #0 2014.04.12 13:40:17 LOG7[14989:140499885692672]: Released libwrap process #0 2014.04.12 13:40:17 LOG7[14989:140499885692672]: Service ssl permitted by libwrap from 192.168.56.1:54562 2014.04.12 13:40:17 LOG5[14989:140499885692672]: Service ssl accepted connection from 192.168.56.1:54562 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL state (accept): before/accept initialization 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL state (accept): SSLv3 read client hello A 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL state (accept): SSLv3 write server hello A 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL state (accept): SSLv3 write certificate A 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL state (accept): SSLv3 write key exchange A 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL state (accept): SSLv3 write server done A 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL state (accept): SSLv3 flush data 2014.04.12 13:40:17 LOG7[14989:140499885790976]: Releasing libwrap process #1 2014.04.12 13:40:17 LOG7[14989:140499885790976]: Released libwrap process #1 2014.04.12 13:40:17 LOG7[14989:140499885790976]: Service ssl permitted by libwrap from 192.168.56.1:54561 2014.04.12 13:40:17 LOG5[14989:140499885790976]: Service ssl accepted connection from 192.168.56.1:54561 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL state (accept): before/accept initialization 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL state (accept): SSLv3 read client hello A 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL state (accept): SSLv3 write server hello A 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL state (accept): SSLv3 write certificate A 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL state (accept): SSLv3 write key exchange A 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL state (accept): SSLv3 write server done A 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL state (accept): SSLv3 flush data 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL state (accept): SSLv3 read client key exchange A 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL state (accept): SSLv3 read finished A 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL state (accept): SSLv3 write session ticket A 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL state (accept): SSLv3 write change cipher spec A 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL state (accept): SSLv3 write finished A 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL state (accept): SSLv3 flush data 2014.04.12 13:40:17 LOG7[14989:140499885692672]: 0 items in the session cache 2014.04.12 13:40:17 LOG7[14989:140499885692672]: 0 client connects (SSL_connect()) 2014.04.12 13:40:17 LOG7[14989:140499885692672]: 0 client connects that finished 2014.04.12 13:40:17 LOG7[14989:140499885692672]: 0 client renegotiations requested 2014.04.12 13:40:17 LOG7[14989:140499885692672]: 2 server connects (SSL_accept()) 2014.04.12 13:40:17 LOG7[14989:140499885692672]: 1 server connects that finished 2014.04.12 13:40:17 LOG7[14989:140499885692672]: 0 server renegotiations requested 2014.04.12 13:40:17 LOG7[14989:140499885692672]: 0 session cache hits 2014.04.12 13:40:17 LOG7[14989:140499885692672]: 0 external session cache hits 2014.04.12 13:40:17 LOG7[14989:140499885692672]: 0 session cache misses 2014.04.12 13:40:17 LOG7[14989:140499885692672]: 0 session cache timeouts 2014.04.12 13:40:17 LOG6[14989:140499885692672]: SSL accepted: new session negotiated 2014.04.12 13:40:17 LOG6[14989:140499885692672]: Negotiated ciphers: ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(128) Mac=AEAD 2014.04.12 13:40:17 LOG7[14989:140499885692672]: remote socket: FD=2 allocated (non-blocking mode) 2014.04.12 13:40:17 LOG6[14989:140499885692672]: connect_blocking: connecting 192.169.56.300:3478 2014.04.12 13:40:17 LOG7[14989:140499885692672]: connect_blocking: s_poll_wait 192.169.56.300:3478: waiting 10 seconds 2014.04.12 13:40:17 LOG5[14989:140499885692672]: connect_blocking: connected 192.169.56.300:3478 2014.04.12 13:40:17 LOG5[14989:140499885692672]: Service ssl connected remote server from 192.169.56.300:59744 2014.04.12 13:40:17 LOG7[14989:140499885692672]: Remote FD=2 initialized 2014.04.12 13:40:17 LOG7[14989:140499885692672]: Option TCP_NODELAY set on remote socket 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL state (accept): SSLv3 read client key exchange A 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL state (accept): SSLv3 read finished A 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL state (accept): SSLv3 write session ticket A 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL state (accept): SSLv3 write change cipher spec A 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL state (accept): SSLv3 write finished A 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL state (accept): SSLv3 flush data 2014.04.12 13:40:17 LOG7[14989:140499885790976]: 0 items in the session cache 2014.04.12 13:40:17 LOG7[14989:140499885790976]: 0 client connects (SSL_connect()) 2014.04.12 13:40:17 LOG7[14989:140499885790976]: 0 client connects that finished 2014.04.12 13:40:17 LOG7[14989:140499885790976]: 0 client renegotiations requested 2014.04.12 13:40:17 LOG7[14989:140499885790976]: 2 server connects (SSL_accept()) 2014.04.12 13:40:17 LOG7[14989:140499885790976]: 2 server connects that finished 2014.04.12 13:40:17 LOG7[14989:140499885790976]: 0 server renegotiations requested 2014.04.12 13:40:17 LOG7[14989:140499885790976]: 0 session cache hits 2014.04.12 13:40:17 LOG7[14989:140499885790976]: 0 external session cache hits 2014.04.12 13:40:17 LOG7[14989:140499885790976]: 0 session cache misses 2014.04.12 13:40:17 LOG7[14989:140499885790976]: 0 session cache timeouts 2014.04.12 13:40:17 LOG6[14989:140499885790976]: SSL accepted: new session negotiated 2014.04.12 13:40:17 LOG6[14989:140499885790976]: Negotiated ciphers: ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(128) Mac=AEAD 2014.04.12 13:40:17 LOG7[14989:140499885692672]: SSL socket closed on SSL_read 2014.04.12 13:40:17 LOG7[14989:140499885692672]: Sending socket write shutdown 2014.04.12 13:40:17 LOG5[14989:140499885692672]: Connection closed: 0 bytes sent to SSL, 0 bytes sent to socket 2014.04.12 13:40:17 LOG7[14989:140499885692672]: Service ssl finished (1 left) 2014.04.12 13:40:17 LOG7[14989:140499885692672]: str_stats: 0 block(s), 0 byte(s) 2014.04.12 13:40:17 LOG7[14989:140499885790976]: remote socket: FD=1 allocated (non-blocking mode) 2014.04.12 13:40:17 LOG6[14989:140499885790976]: connect_blocking: connecting 192.169.56.300:3478 2014.04.12 13:40:17 LOG7[14989:140499885790976]: connect_blocking: s_poll_wait 192.169.56.300:3478: waiting 10 seconds 2014.04.12 13:40:17 LOG5[14989:140499885790976]: connect_blocking: connected 192.169.56.300:3478 2014.04.12 13:40:17 LOG5[14989:140499885790976]: Service ssl connected remote server from 192.169.56.300:59745 2014.04.12 13:40:17 LOG7[14989:140499885790976]: Remote FD=1 initialized 2014.04.12 13:40:17 LOG7[14989:140499885790976]: Option TCP_NODELAY set on remote socket 2014.04.12 13:40:17 LOG7[14989:140499885790976]: SSL socket closed on SSL_read 2014.04.12 13:40:17 LOG7[14989:140499885790976]: Sending socket write shutdown 2014.04.12 13:40:17 LOG5[14989:140499885790976]: Connection closed: 0 bytes sent to SSL, 0 bytes sent to socket 2014.04.12 13:40:17 LOG7[14989:140499885790976]: Service ssl finished (0 left) 2014.04.12 13:40:17 LOG7[14989:140499885790976]: str_stats: 0 block(s), 0 byte(s)

1 0

Bleedingheart Bug in OpenSSL
by Burak Say 11 Apr '14

11 Apr '14

Hello, When do you think you can release a patch to use OpenSSL 1.0.1g instead of 1.0.1f? Thanks, Burak Say

4 5

Re: [stunnel-users] Some troubles with PROXY protocol
by Alexey V. Drozdov 10 Apr '14

10 Apr '14

Hi, Mike! I have analyze your fix and found mistake :( We will switch to target SNI section after init_ssl(c) only, thereby init_remote(c) will be connect to wrong destination. if(!c->opt->option.client && c->opt->protocol<0 #ifndef OPENSSL_NO_TLSEXT && !c->opt->servername_list_head #endif ) { /* server mode and no protocol negotiation needed */ init_ssl(c); init_remote(c); } else { /* client mode or protocol negotiation enabled */ protocol(c, PROTOCOL_PRE_CONNECT); init_remote(c); <<<<<<<<<< Incorrect destination protocol(c, PROTOCOL_PRE_SSL); init_ssl(c); <<<<<<<<<<< switch to target SNI config section only there protocol(c, PROTOCOL_POST_SSL); } /Alexey V. Drozdov e-mail: anyquist(a)yandex.ru

2 1

stunnel 5.01 released
by Michal Trojnara 08 Apr '14

08 Apr '14

Dear Users, I have released version 5.01 of stunnel. The ChangeLog entry: Version 5.01, 2014.04.08, urgency: HIGH: * Security bugfixes - OpenSSL DLLs updated to version 1.0.1g. This version mitigates TLS heartbeat read overrun (CVE-2014-0160). * New features - X.509 extensions added to the created self-signed stunnel.pem. - "FIPS = no" also allowed in non-FIPS builds of stunnel. - Search all certificates with the same subject name for a matching public key rather than only the first one (thx to Leon Winter). - Create logs in the local application data folder if stunnel folder is not writable on Win32. * Bugfixes - close_notify not sent when SSL still has some data buffered. - Protocol negotiation with server-side SNI fixed. - A Mac OS X missing symbols fixed. - Win32 configuration file reload crash fixed. - Added s_pool_free() on exec+connect service retires. - Line-buffering enforced on stderr output. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hash for stunnel-5.01.tar.gz: 2565bf58ffe8a612304c64df621105b2e42d6e389e815ed4205dbeec4f3f886b Best regards, Mike

1 0

Re: [stunnel-users] public domain [Patch] Support multiple X509 client certificates with same CN
by Leon Winter 01 Apr '14

01 Apr '14

Hi Michal, > >What license do you need the patch to be? > > Preferably public domain, but any GPL-compatbile and non-copyleft license > should be fine. I hereby release my patches to stunnel for support of muliple client certificates with the same CN into the public domain. Best regards, Leon Winter

2 2

Some troubles with PROXY protocol
by Alexey V. Drozdov 31 Mar '14

31 Mar '14

Hi, I try to use PROXY protocol ability for my virtual server, but this options work for root section only. E.g. it not work for this simple case: [virtual_server] accept = 443 connect = localhost:1081 cert = /etc/stunnel/serverCA.crt key = /etc/stunnel/serverCA.key verify = 2 CAfile = /etc/stunnel/serverCA.crt [server_ru] sni = virtual_server:server.ru cert = /etc/stunnel/server.cer key = /etc/stunnel/server.pem connect = localhost:7000 protocol = proxy <-- option don not work there This problem exist due some code bug: NOEXPORT void client_try(CLI *c) { init_local(c); if(!c->opt->option.client && c->opt->protocol<0) // <-- condition is true in spite of setup protorol=proxy { init_ssl(c); // we'll switch to target section (c->opt) there only! init_remote(c); } else { protocol(c, PROTOCOL_PRE_CONNECT); init_remote(c); protocol(c, PROTOCOL_PRE_SSL); init_ssl(c); protocol(c, PROTOCOL_POST_SSL); } ... Simple adhoc solution work for me: if(!c->opt->option.client && c->opt->protocol<0) // <-- condition is true in spite of setup protorol=proxy { init_ssl(c); init_remote(c); // force initiate PROXY protocol protocol(c, PROTOCOL_PRE_SSL); } It's crutch and not general solution certain. But some code refactoring needs for more correct fix. I think that this bug will be fixed in future versions. Thanks for stunnel! :) /Alexey V. Drozdov e-mail: anyquist(a)yandex.ru

2 1

Build failure of stunned 5.00 under OS X.
by Marius Schamschula 28 Mar '14

28 Mar '14

Hi there, After having built many prior releases of stunned for OS X, I ran into the following issue with version 5.0: /bin/sh ../libtool --tag=CC --mode=link gcc -pthread -fstack-protector -fPIE -g -O2 -Wall -Wextra -Wno-long-long -pedantic -L/usr/local/ssl/lib64 -L/usr/local/ssl/lib -lssl -lcrypto -o stunnel stunnel-str.o stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-fd.o stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o stunnel-ui_unix.o -lz -lpthread -lwrap libtool: link: gcc -pthread -fstack-protector -fPIE -g -O2 -Wall -Wextra -Wno-long-long -pedantic -o stunnel stunnel-str.o stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-fd.o stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o stunnel-ui_unix.o -L/usr/local/ssl/lib64 -L/usr/local/ssl/lib -lssl -lcrypto -lz -lpthread -lwrap -pthread ld: warning: directory not found for option '-L/usr/local/ssl/lib64' Undefined symbols for architecture x86_64: "_load_icon_default", referenced from: _parse_global_option in stunnel-options.o "_load_icon_file", referenced from: _parse_global_option in stunnel-options.o ld: symbol(s) not found for architecture x86_64 collect2: ld returned 1 exit status he ewxat same issue under 10.8 and 10.9. Makefile:471: recipe for target 'stunnel' failed make[2]: *** [stunnel] Error 1 make[2]: Leaving directory '/private/tmp/stunnel-5.00/src' Makefile:339: recipe for target 'all' failed make[1]: *** [all] Error 2 make[1]: Leaving directory '/private/tmp/stunnel-5.00/src' Makefile:365: recipe for target 'all-recursive' failed make: *** [all-recursive] Error 1 This is the OS X 10.7 build, but I had the same issue under 10.8 and 10.9. Marius -- Marius Schamschula

1 0

Access to Packet Content
by Michael Carlino (RIT Student) 26 Mar '14

26 Mar '14

Hello stunnel users, I am working with what seems to be the standard stunnel HTTPS configuration. I have two instances of stunnel, one as a client and one as a server. The client accepts connections from a browser. The server sits in front of tomcat. If works like a charm (of course!). What I need to do seems simple, and I will try to keep my description of it generic. In the client stunnel I need to make a small change to the HTTP packet. I need to add some data to it. At the server side I need to access that added data. The server stunnel may close the SSL session based on that data. So, my question is: can I obtain access to the packet before it's encrypted and sent out over SSL? Can I get access to the decrypted packet before it's sent on to tomcat? I know that as a proxy stunnel has to be and tries to be general in nature. I am not concerned (right now) with developing a feature that will become available to others later. I don't mind if my changes make my development version of stunnel single-purpose. My work is academic and proof-of-concept in it's nature. I have collected references and a text book (Network Security with OpenSSL by Viega et al). I will continue to walk through and explore the code. Are there any programmer resources I can obtain? I see the occasional URL in the stunnel source code. I will have to check these URLs. --- I just now pursued http://haproxy.1wt.eu/download/1.5/doc/proxy-protocol.txt, and I see that there is a patch that allows stunnel to do an initial modification to the HTTP request to insert a X-Forwarded-For header. This sounds like what I need to do! I am going to look for that patch. I hope the source code for the patch is available. Please, if anyone has any advice, war stories, criticism, whatever... I would very much appreciate it. Regards.

4 8

Tool Information
by "Cortenai Swoboda Reinbrecht" 14 Mar '14

14 Mar '14

1 0

stunnel.cnf should set keyUsage = keyCertSign
by Athir Nuaimi 11 Mar '14

11 Mar '14

I'm trying to write a go program to connect to an stunnel server and verify the certificate but it fails because the go language requires that self-signed certs have keyCertSign set in the keyUsages. the default stunnel.cnf does not set this. According to the following message thread this is required by RFC 5280. https://groups.google.com/forum/#!msg/golang-nuts/LfLHjVkeSj8/YyP-LSPEytEJ The solution to this is to add 'keyUsage = keyCertSign' to the stunnel.cnf.

3 3

Please allow fips=no even if !USE_FIPS
by Andy Lutomirski 10 Mar '14

10 Mar '14

It's currently impossible to make a stunnel config file that works with reasonable settings on both a USE_FIPS build (e.g. Fedora) and a !USE_FIPS build (e.g. Ubuntu). This is because, if USE_FIPS, fips defaults to "yes" (which is, for most purposes, a serious problem) and, if !USE_FIPS, the setting 'fips=no' prevents stunnel from starting. I've observed this on stunnel 4.53, and it looks like the same issue exists in the source in stunnel 4.56 and 5.00. (Note that, if targetting stunnel 5.00, this is less of an issue, since the default value of 'fips' changed. Nonetheless, it would be nice to accept 'fips=no' to avoid surprises.) Thanks, Andy

1 0

Stunnel Install error on Solaris10 X86
by Ashok Kumar G 10 Mar '14

10 Mar '14

Hi, I am trying to install stunnel-4.56 on my Solaris10 server. configure step completed successfully. But make and make install commands failed miserably. # gzip -dc stunnel-3.8.tar.gz | tar -xvf - # cd stunnel-3.8 # ./configure bash-3.00# make bash: make: command not found bash-3.00# export PATH=/usr/ccs/bin bash-3.00# make bash: line 8: sed: command not found *** Error code 127 The following command caused the error: fail= failcom='exit 1'; \ for f in x $MAKEFLAGS; do \ case $f in \ *=* | --[!k]*);; \ *k*) failcom='fail=yes';; \ esac; \ done; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='src doc tools'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (CDPATH="${ZSH_VERSION+.}:" && cd $subdir && make $local_target) \ || eval $failcom; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' bash-3.00# make install bash: line 8: sed: command not found *** Error code 127 The following command caused the error: fail= failcom='exit 1'; \ for f in x $MAKEFLAGS; do \ case $f in \ *=* | --[!k]*);; \ *k*) failcom='fail=yes';; \ esac; \ done; \ dot_seen=no; \ target=`echo install-recursive | sed s/-recursive//`; \ list='src doc tools'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (CDPATH="${ZSH_VERSION+.}:" && cd $subdir && make $local_target) \ || eval $failcom; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `install-recursive' bash-3.00# bash-3.00# bash-3.00# echo $PATH /usr/ccs/bin ========================================================= * 2nd Try:* ========================================================= bash-3.00# echo $PATH /usr/sbin:/usr/bin bash-3.00# PATH=$PATH:/usr/sbin:/usr/sfw/bin:/usr/ccs/bin bash-3.00# LD_LIBARAY_PATH=/lib:/usr/lib:/usr/local/lib bash-3.00# cd /opt/softwares/stunnel-4.56 bash-3.00# make Making all in src make all-am Making all in doc Making all in tools bash-3.00# make install Making install in src test -z "/usr/local/bin" || ../auto/install-sh -c -d "/usr/local/bin" /bin/bash ../libtool --mode=install ../auto/install-sh -c stunnel '/usr/local/bin' libtool: install: ../auto/install-sh -c stunnel /usr/local/bin/stunnel test -z "/usr/local/bin" || ../auto/install-sh -c -d "/usr/local/bin" ../auto/install-sh -c stunnel3 '/usr/local/bin' test -z "/usr/local/lib/stunnel" || ../auto/install-sh -c -d "/usr/local/lib/stunnel" /bin/bash ../libtool --mode=install ../auto/install-sh -c libstunnel.la'/usr/local/lib/stunnel' libtool: install: ../auto/install-sh -c .libs/libstunnel.so /usr/local/lib/stunnel/libstunnel.so libtool: install: chmod +x /usr/local/lib/stunnel/libstunnel.so libtool: install: ../auto/install-sh -c .libs/libstunnel.lai /usr/local/lib/stunnel/libstunnel.la ---------------------------------------------------------------------- Libraries have been installed in: /usr/local/lib/stunnel If you ever happen to want to link against installed libraries in a given directory, LIBDIR, you must either use libtool, and specify the full pathname of the library, or use the `-LLIBDIR' flag during linking and do at least one of the following: - add LIBDIR to the `LD_LIBRARY_PATH' environment variable during execution - use the `-RLIBDIR' linker flag See any operating system documentation about shared libraries for more information, such as the ld(1) and ld.so(8) manual pages. ---------------------------------------------------------------------- Making install in doc test -z "/usr/local/share/doc/stunnel" || ../auto/install-sh -c -d "/usr/local/share/doc/stunnel" ../auto/install-sh -c -m 644 stunnel.html stunnel.pl.html stunnel.fr.html '/usr/local/share/doc/stunnel' test -z "/usr/local/share/man/man8" || ../auto/install-sh -c -d "/usr/local/share/man/man8" ../auto/install-sh -c -m 644 stunnel.8 stunnel.pl.8 stunnel.fr.8 '/usr/local/share/man/man8' Making install in tools test -z "/usr/local/etc/stunnel" || ../auto/install-sh -c -d "/usr/local/etc/stunnel" ../auto/install-sh -c -m 644 stunnel.conf-sample '/usr/local/etc/stunnel' if test ! -r /usr/local/etc/stunnel/stunnel.pem; then \ if test -r "/dev/urandom"; then \ dd if="/dev/urandom" of=stunnel.rnd bs=256 count=1; \ RND="-rand stunnel.rnd"; \ else \ RND=""; \ fi; \ /usr//bin/openssl req -new -x509 -days 365 $RND \ -config ./stunnel.cnf \ -out stunnel.pem -keyout stunnel.pem; \ /usr//bin/openssl gendh $RND 1024 >> stunnel.pem; \ /usr//bin/openssl x509 -subject -dates -fingerprint -noout -in stunnel.pem; \ ../auto/install-sh -c -m 600 stunnel.pem /usr/local/etc/stunnel/stunnel.pem; \ rm stunnel.pem; \ fi 1+0 records in 1+0 records out bash: line 7: /usr//bin/openssl: No such file or directory *** Error code 1 make: Fatal error: Command failed for target `install-data-local' Current working directory /opt/softwares/stunnel-4.56/tools *** Error code 1 The following command caused the error: make install-exec-am install-data-am make: Fatal error: Command failed for target `install-am' Current working directory /opt/softwares/stunnel-4.56/tools *** Error code 1 The following command caused the error: fail= failcom='exit 1'; \ for f in x $MAKEFLAGS; do \ case $f in \ *=* | --[!k]*);; \ *k*) failcom='fail=yes';; \ esac; \ done; \ dot_seen=no; \ target=`echo install-recursive | sed s/-recursive//`; \ list='src doc tools'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (CDPATH="${ZSH_VERSION+.}:" && cd $subdir && make $local_target) \ || eval $failcom; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `install-recursive' bash-3.00# Can someone please help to resolve the above error. Thanks, Ashok Kumar G

2 3

Re: [stunnel-users] [Patch] Support multiple X509 client certificates with same CN
by Leon Winter 10 Mar '14

10 Mar '14

On Mon, Mar 10, 2014 at 06:34:14AM -0400, Brian Wilkins wrote: > You will have to attach appropriate software license as well. Michal may > ask for it I hereby declare my two previously sent patches to be licensed under GPL as according to the license of the stunnel project. Regards, Leon Winter

1 0

[Patch] Support multiple X509 client certificates with same CN
by Leon Winter 10 Mar '14

10 Mar '14

Hi, currently stunnel uses the X509_STORE_get_by_subject () API call to OpenSSL to retrieve the x509 client certificate in the cert_check () method (located in verify.c) to gather the client certificate from the whitelist by the common name (CN) the client presented during the TLS handshake. It then proceeds to compare both certificates bit by bit. This all works rather fine until the very moment you have more than one client certificate with the same CN. The OpenSSL API call will then return any of the certificates with the provided CN (according to internal logic). Other implementations using OpenSSL were aware of this issue and introduced logic to further iterate over the remaining certificates, retrieving any further with the same CN. See for example function X509_STORE_CTX_get1_issuer () and its comment: http://www.opensource.apple.com/source/OpenSSL/OpenSSL-12/openssl/crypto/x5… I patched stunnel 4.53 and adapted the patch to upstream version 5.00 to behave in similar fashion and can report that with these changes stunnel then also supports multiple client certificates sharing the same CN. Feel free to adapt indention as my patches aim for minimal changed lines. Best regards, Leon Winter

1 0

stunnel 5.00 released
by Michal Trojnara 10 Mar '14

10 Mar '14

Dear Users, I have released version 5.00 of stunnel. The ChangeLog entry: stunnel 5.00 disables some features previously enabled by default. Users should review whether the new defaults are appropriate for their particular deployments. Packages maintainers may consider prepending the old defaults for "fips" (if supported by their OpenSSL library), "pid" and "libwrap" to stunnel.conf during automated updates. Version 5.00, 2014.03.06, urgency: HIGH: * Security bugfixes - Added PRNG state update in fork threading (CVE-2014-0016). * New global configuration file defaults - Default "fips" option value is now "no", as FIPS mode is only helpful for compliance, and never for actual security. - Default "pid" is now "", i.e. not to create a pid file at startup. * New service-level configuration file defaults - Default "ciphers" updated to "HIGH:MEDIUM:+3DES:+DH:!aNULL:!SSLv2" due to AlFBPPS attack and bad performance of DH ciphersuites. - Default "libwrap" setting is now "no" to improve performance. * New features - OpenSSL DLLs updated to version 1.0.1f. - zlib DLL updated to version 1.2.8. - autoconf scripts upgraded to version 2.69. - TLS 1.1 and TLS 1.2 are now allowed in the FIPS mode. - New service-level option "redirect" to redirect SSL client connections on authentication failures instead of rejecting them. - New global "engineDefault" configuration file option to control which OpenSSL tasks are delegated to the current engine. Available tasks: ALL, RSA, DSA, ECDH, ECDSA, DH, RAND, CIPHERS, DIGESTS, PKEY, PKEY_CRYPTO, PKEY_ASN1. - New service-level configuration file option "engineId" to select the engine by identifier, e.g. "engineId = capi". - New global configuration file option "log" to control whether to append (the default), or to overwrite log file while (re)opening. - Different taskbar icon colors to indicate the service state. - New global configuration file options "iconIdle", "iconActive", and "iconError" to select status icon on GUI taskbar. - Removed the limit of 63 stunnel.conf sections on Win32 platform. - Installation of a sample certificate was moved to a separate "cert" target in order to allow unattended (e.g. scripted) installations. - Reduced length of the logged thread identifier. It is still based on the OS thread ID, and thus not unique over long periods of time. - Improved readability of error messages printed when stunnel refuses to start due to a critical error. * Bugfixes - LD_PRELOAD Solaris compatibility bug fixed (thx to Norm Jacobs). - CRYPTO_NUM_LOCKS replaced with CRYPTO_num_locks() to improve binary compatibility with diverse builds of OpenSSL (thx to Norm Jacobs). - Corrected round-robin failover behavior under heavy load. - Numerous fixes in the engine support code. - On Win32 platform .rnd file moved from c:\ to the stunnel folder. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hash for stunnel-5.00.tar.gz: 88986d52a7ef1aff0cc26fc0a9830361c991baba7ee591d5cf1cc8baef75bc13 Best regards, Mike

3 5

Weird problem starting stunnel
by Matthew Lunnon 05 Mar '14

05 Mar '14

Hello, Can anyone enlighten me on the following: I have installed stunnel up on my Mac (OS X Lion) and it all runs just fine. When I put this on another machine (OS X Mountain Lion) stunnel refuses to start. I include the output and the stunnel.conf file below. We have some experience of stunnel as we have been using it in both client and server mode on Windows and RedHat for years but none of my colleagues can give me much help here. It looks to me like although stunnel is reporting that it is starting with the correct stunnel.conf file it is actually using something else as: 1) no stunnel.log file is created 2) after successfully seeding the PRNG it seems to be Initializing inetd mode and starting as a service when this should be starting in client mode. (The only way I can get it to do something similar on the machine that works is to remove all the service definitions and put in a line service = SERVICE when it blows up but with a slightly different error about needing an end/connection point (not sure the exact error) and then it fails. Even so in this case it will still create an output log in the correct place) My thoughts are that it might be something to do with the installation process of stunnel that hasn't been followed properly or some kind of permissions issue. Apologies if I am being dim but I am at a bit of a loss to explain what is going on here. I do not have direct access to the second machine and am trying to support it over the phone. Thanks for any help. Matthew ========================================================================== = Here is the output: ========================================================================== Last login: Fri Jan 31 10:44:30 on ttys000 Administrator:~ admin$ cd stunnel Administrator:stunnel admin$ stunnel /Users/admin/stunnel/stunnel.conf Clients allowed=125 stunnel 4.56 on x86_64-apple-darwin11.4.2 platform Compiled with OpenSSL 0.9.8r 8 Feb 2011 Running with OpenSSL 0.9.8y 5 Feb 2013 Update OpenSSL shared libraries or rebuild stunnel Threading:PTHREAD Sockets:SELECT,IPv6 SSL:ENGINE,OCSP Auth:LIBWRAP Reading configuration from file /Users/admin/stunnel/stunnel.conf Compression not enabled Snagged 64 random bytes from /Users/admin/.rnd Wrote 1024 new random bytes to /Users/admin/.rnd PRNG seeded successfully Initializing inetd mode configuration Service [stunnel]: SSL server needs a certificate str_stats: 2 block(s), 45 data byte(s), 116 control byte(s) Administrator:stunnel admin$ ========================================================================== = And here is the stunnel.conf file: ========================================================================== ; Sample stunnel configuration file for Win32 by Michal Trojnara 2002-2012 ; Some options used here may be inadequate for your particular configuration ; This sample file does *not* represent stunnel.conf defaults ; Please consult the manual for detailed description of available options ; ************************************************************************** ; * Global options * ; ************************************************************************** ; Debugging stuff (may useful for troubleshooting) debug = 7 ;output = stunnel.log ; Disable FIPS mode to allow non-approved protocols and algorithms ;fips = no client=yes sslVersion=SSLv3 output=/Users/admin/stunnel/stunnel.log pid=/Users/admin/stunnel/stunnel.pid ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Certificate/key is needed in server mode and optional in client mode ;cert = rwa2012.clientkeycert.pem ;key = stunnel.pem ; Authentication stuff needs to be configured to prevent MITM attacks ; It is not enabled by default! verify = 2 ;verify = 0 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile CAfile = /Users/admin/stunnel/ca.crt ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively CRLfile can be used ;CRLfile = crls.pem ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; These options provide additional security at some performance degradation ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; ************************************************************************** ; * Service definitions (at least one service has to be defined) * ; ************************************************************************** [Gounder] cert = /Users/admin/stunnel/gounder20141401011000.pem accept=8128 connect=311.219.292.173:9876 [Gounder IJ] cert = /Users/admin/stunnel/gounder20141401011000.pem accept=9128 connect=311.219.292.173:9875 -- Matthew Lunnon Technical Consultant RWA Ltd. mlunnon(a)rwa-net.co.uk Tel: +44 (0)29 2081 5056 www.rwa-net.co.uk

2 1

Stunnel use with Juniper VPN
by Nancy Shortall 19 Feb '14

19 Feb '14

Looking for help in planning a point to point VPN between a fixed site and a mobile site. The fixed site currently uses Stunnel and the mobile site must use a Juniper VPN SSG 140 hardware VPN device. Would this configuration be possible?

1 0

Re: [stunnel-users] Compatible with windows 8.1?
by peter 08 Feb '14

08 Feb '14

Is the stunnel compatible with windows 8.1? I am having problems after updating to 8.1 Peter

1 0

DNS SSL tunnel
by Quinn Wood 07 Feb '14

07 Feb '14

Woops, starting with the forwarded ports... 192.168.1.100 UDP/5353 -> VM UDP/53 192.168.1.100 TCP/5353 -> VM TCP/53 192.168.1.100 TCP/5667 -> VM TCP/5667 [...] I am able to get DNS replies using both of dig @192.168.1.100 -p 5353 google.com A dig @192.168.1.100 -p 5353 google.com A +tcp But dig times out when I try to use dig @192.168.1.100 -p 53 google.com A The stunnel server log is here: http://sprunge.us/deLY The stunnel client log is here: http://sprunge.us/ScAC Why this is happening? I notice the three connection attempts which seems like it's relevant to the connection resets.

1 0

DNS SSL tunnel
by Quinn Wood 07 Feb '14

07 Feb '14

I am attempting to tunnel DNS traffic over stunnel using socat. I am following a guide[1] by the German Privacy Foundation. The client is my physical machine and the server is a VirtualBox virtual machine with three ports forwarded: 192.168.1.100 53/UDP My configs for stunnel are an exact match to the ones on the guide, and I am able to get a DNS reply using dig @IP [1] https://www.privacyfoundation.de/wiki/SSL-DNS

1 0

Problem in stunnel log
by sawbona＠xsmail.com 06 Feb '14

06 Feb '14

Good morning: This connection was working perfectly well up until yesterday. Now it fails and I get this text in the log: (date/time snipped for brevity's sake) --- LOG5[648:980]: FIPS mode is enabled LOG5[648:980]: Configuration successful LOG5[648:2448]: Service [gmx-POP3-SSL] accepted connection from 127.0.0.1:1212 LOG5[648:2448]: connect_blocking: connected xxx.xxx.xxx.xxx:995 LOG5[648:2448]: Service [gmx-POP3-SSL] connected remote server from 192.168.1.136:1213 LOG4[648:2448]: CERT: Verification error: self signed certificate in certificate chain LOG4[648:2448]: Certificate check failed: depth=2, /C=DE/O=Deutsche Telekom AG/OU=T-TeleSec Trust Center/CN=Deutsche Telekom Root CA 2 LOG3[648:2448]: SSL_connect: 14090086: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed LOG5[648:2448]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket --- What has happened? I have not changed anything ... This is the stunnel.conf bit: --- [gmx-POP3-SSL] client = yes accept = 20995 connect = pop.gmx.net:995 CAfile = peer-gmx-POP3-SSL.pem verify = 3 [gmx-smtp-SSL] client = yes accept = 20465 connect = mail.gmx.net:465 [gmx-IMAP-SSL] client = yes accept = 20993 connect = imap.gmx.net:993 --- Is it 'me' or is it 'them'? Thanks in advance for any input. Best regards.

1 0

Stunnel - how to make Google App Engine HTTP into HTTPS ?
by Shamun Toha Md 06 Feb '14

06 Feb '14

I have Google App Engine running in HTTP (port tcp 80), which is a daemon based service it execute back-end some python instances. Now all that works over HTTP , TCP 80, and Google App Engine itself do not have any kind of HTTPS setup, it has to be organized externally. Therefore, the biggest problem is now that how can i use stunnel to resolve this problem please? I have already tried following setup and it does not work at all. 1) if the user visit https://www.mysite.com then he hit stunnel accept=443 after that he is connected with connect=80 but user browser change into http:// instead of remaining in https:// . Which make the whole thing not working $ uname -a Linux server2 2.6.32-358.23.2.el6.x86_64 #1 SMP Wed Oct 16 18:37:12 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux $ cat /etc/stunnel/stunnel.conf pid = /stunnel.pid cert=/etc/stunnel/abyhu.crt CAfile=/etc/stunnel/abyhu.ca key=/etc/stunnel/abyhu.key sslVersion = all ;socket = l:TCP_NODELAY=1 ;socket = r:TCP_NODELAY=1 client=no debug = 7 output = /var/log/stunnel.log [SSL] accept=443 connect=80 TIMEOUTclose = 0 My goal is: when user visit https://www.mysite.com it remain as https not become http:// then it is not solving the problem cause Google app engine do not have HTTPS Thank you. Best regards

3 4

Re: [stunnel-users] cross compiling stunnel-4.21 for ARM
by josealf＠rocketmail.com 03 Feb '14

03 Feb '14

Krinali, Looks like firefox can't connect to port 443 on your target IP. Are you sure there is no firewall enabled on your board? Regards, Jose -----Original Message----- From: Krinali Shah - PES <krinali.shah(a)einfochips.com> Date: Mon, 3 Feb 2014 16:47:39 To: <josealf(a)rocketmail.com> Subject: Re: [stunnel-users] cross compiling stunnel-4.21 for ARM Hi Jose, Thank you so much for your suggestion. Firefox is giving an error like "Problem Loading Page". (Plase find attached snapshot for your reference). Note - I have made sure that there are no proxy settings on firefox. Thanks, Krinali Shah ----- Original Message ----- From: josealf(a)rocketmail.com To: "Krinali Shah - PES" <krinali.shah(a)einfochips.com>, "stunnel-users" <stunnel-users-bounces(a)stunnel.org>, stunnel-users(a)stunnel.org Sent: Monday, February 3, 2014 4:21:49 PM Subject: Re: [stunnel-users] cross compiling stunnel-4.21 for ARM Krimnali, 1. Exactly which error is giving Firefox? It will give you an error if the certificate subject does not match the URL (in this case the IP). And of course, it will also complain if the certificate is self signed and/or the signing CA is unknown. 2. Why are you using such an updated stunnel version? 3. You can use openssl s_client command to troubleshoot. Google for it. Regards, Jose -----Original Message----- From: Krinali Shah - PES <krinali.shah(a)einfochips.com> Sender: "stunnel-users" <stunnel-users-bounces(a)stunnel.org> Date: Mon, 3 Feb 2014 15:34:28 To: <stunnel-users(a)stunnel.org> Subject: [stunnel-users] cross compiling stunnel-4.21 for ARM _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users --------------------------------------------------------------------------------------------- Notice: This message has been scanned by Trend Micro Mail Security scanner and is believed to be clean --------------------------------------------------------------------------------------------- ************************************************************************************************************************************************************* eInfochips Business Disclaimer : This e-mail message and all attachments transmitted with it are intended solely for the use of the addressee and may contain legally privileged and confidential information. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution, copying, or other use of this message or its attachments is strictly prohibited. If you have received this message in error, please notify the sender immediately by replying to this message and please delete it from your computer. Any views expressed in this message are those of the individual sender unless otherwise stated. Company has taken enough precautions to prevent the spread of viruses. However the company accepts no liability for any damage caused by any virus transmitted by this email. ************************************************************************************************************************************************************* --------------------------------------------------------------------------------------------- Notice: This message has been scanned by Trend Micro Mail Security scanner and is believed to be clean ---------------------------------------------------------------------------------------------

1 0

cross compiling stunnel-4.21 for ARM
by Krinali Shah - PES 03 Feb '14

03 Feb '14

----- Forwarded Message ----- From: "Krinali Shah - PES" <krinali.shah(a)einfochips.com> To: stunnel-users(a)stunnel.org Sent: Monday, February 3, 2014 3:04:44 PM Subject: cross compiling stunnel-4.21 for ARM Hi All, I have thttpd server cross-compiled for my ARM based embedded board. Now I want to add the support for https services on my board, so I think of using stunnel with openssl. I have already download source code of openssl and cross compiled it, for linux-arm. I have downloaded stunnel-4.21 and followed the steps as mentioned below. 1. create stunnel.pem file inside /etc/ssl/certs/stunnel.pem 2. create stunnel.conf file inside /etc/stunnel/stunnel.conf with following parameters. cert = /etc/ssl/certs/stunnel.pem key = /etc/ssl/certs/stunnel.pem chroot = /var/run/stunnel setuid = stunnel4 setgid = stunnel4 debug = 7 pid = /stunnel.pid setuid = stunnel setgid = stunnel socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 compression = rle output = /var/log/stunnel4/stunnel.log client = no [https] accept = 10.103.2.104:443 connect = 127.0.0.1:8080 TIMEOUTclose = 0 2. ./configure --prefix=/home/stunnel --host=arm-linux --enable-shared --with-ssl=/home 3. changed CC, RANLIB and STRIP environment variables for cross compilation in Makefile. 4. make 5. sudo make install The cross-compiled binary stunnel is installed. When I run the binary on board, it does not show any error. Following debug messages are seen on screen. 1969.12.31 21:19:54 LOG6[1154:1073842296]: Compression enabled using rle method 1969.12.31 21:19:54 LOG7[1154:1073842296]: RAND_status claims sufficient entropG 1969.12.31 21:19:54 LOG7[1154:1073842296]: PRNG seeded successfully 1969.12.31 21:19:54 LOG7[1154:1073842296]: Certificate: /etc/ssl/certs/stunnel.m 1969.12.31 21:19:54 LOG7[1154:1073842296]: Certificate loaded 1969.12.31 21:19:54 LOG7[1154:1073842296]: Key file: /etc/ssl/certs/stunnel.pem 1969.12.31 21:19:54 LOG7[1154:1073842296]: Private key loaded 1969.12.31 21:19:54 LOG7[1154:1073842296]: SSL context initialized for service s But, If I try to request https service from web browser (Firefox) ie, https://server_ip it gives me error. Meaning https server is not started correctly, still something is missing. Please guide me if you have any clues. Any help would be highly appreciated. Thanks, Krinali Shah ************************************************************************************************************************************************************* eInfochips Business Disclaimer : This e-mail message and all attachments transmitted with it are intended solely for the use of the addressee and may contain legally privileged and confidential information. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution, copying, or other use of this message or its attachments is strictly prohibited. If you have received this message in error, please notify the sender immediately by replying to this message and please delete it from your computer. Any views expressed in this message are those of the individual sender unless otherwise stated. Company has taken enough precautions to prevent the spread of viruses. However the company accepts no liability for any damage caused by any virus transmitted by this email. ************************************************************************************************************************************************************* --------------------------------------------------------------------------------------------- Notice: This message has been scanned by Trend Micro Mail Security scanner and is believed to be clean ---------------------------------------------------------------------------------------------

2 1

Connect to Outlook.com SMTP with stunnel
by Tenhult Server 30 Jan '14

30 Jan '14

Hi, i'm trying to send mail with the help of stunnel but i get STARTTLS expected, what is wrong with my setup? File: stunnel.conf [outlook-smtp] protocol = smtp accept = 127.0.0.1:25 connect = smtp-mail.outlook.com:587 Log 2014.01.26 13:59:03 LOG5[1536]: stunnel 5.00 on x86-pc-msvc-1500 platform 2014.01.26 13:59:03 LOG5[1536]: Compiled/running with OpenSSL 1.0.1e-fips 11 Feb 2013 ... ... 2014.01.26 13:59:16 LOG6[2428]: Server-mode smtp protocol negotiations started 2014.01.26 13:59:16 LOG7[2428]: RFC 2487 detected 2014.01.26 13:59:16 LOG7[2428]: <- 220 BLU0-SMTP180.phx.gbl Microsoft ESMTP MAIL Service, Version: 6.0.3790.4675 ready at Sun, 26 Jan 2014 04:59:07 -0800 2014.01.26 13:59:16 LOG7[2428]: -> 220 BLU0-SMTP180.phx.gbl Microsoft ESMTP MAIL Service, Version: 6.0.3790.4675 ready at Sun, 26 Jan 2014 04:59:07 -0800 + stunnel 2014.01.26 13:59:16 LOG7[2428]: <- EHLO Fredrik-Laptop 2014.01.26 13:59:16 LOG7[2428]: -> 250-EHLO Fredrik-Laptop Welcome 2014.01.26 13:59:16 LOG7[2428]: -> 250 STARTTLS 2014.01.26 13:59:16 LOG7[2428]: <- MAIL FROM: <mymail(a)live.com> 2014.01.26 13:59:16 LOG3[2428]: STARTTLS expected 2014.01.26 13:59:16 LOG5[2428]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2014.01.26 13:59:16 LOG7[2428]: Remote socket (FD=520) closed 2014.01.26 13:59:16 LOG7[2428]: Local socket (FD=540) closed 2014.01.26 13:59:16 LOG7[2428]: Service [outlook-smtp] finished (0 left) Fredrik

2 1

Specifying a username and password
by Allen Crist 30 Jan '14

30 Jan '14

I have a scanner that only has an smtp address and port #. There is no option to specify a username and password. Is there a way to configure STunnel to assist with this? Regards, Allen -- Allen Crist, Owner A+ | Network+ | Security+ | MCITP/MCSA: Windows Server 2008 *CCW Technology Computer Repair*Serving Home & Small Business Customers since 2008 (801)410-0203 http://www.ccwtech.com http://www.facebook.com/CCWTechnology

1 0

Filename is not cached for later editing
by Javier 24 Jan '14

24 Jan '14

Hi, Scenario in Windows. I found today that, when you specify a configuration file different from the standard file name, you can't edit it through "Configuration>Edit stunnel.conf". Stunnel tries to edit stunnel.conf, and, if not found, creates a new one through notepad. This doesn't affect to the reload function, where the configuration file specified is used for reload. Also, this is not important, because in most cases is used the default file name, but maybe could be implemented the ability to change those menu options to display the current configuration file name used instead the standard. Let's say we use a configuration file named xxx.conf. The menu may change to "Edit xxx.conf" and "Reload xxx.conf" instead "Edit stunnel.conf" and "Reload stunnel.conf". This may be interesting for when we have several services installed and identify them better. Regards.

4 9

Additional certificate (like openssl s_server -dkey/-dcert)
by Lapo Luchini 24 Jan '14

24 Jan '14

Is it possible to configure STunnel to support "additional" certificate like OpenSSL s_Server's -dkey/-dcert parameters, in order to support ECDSA in addition to RSA on the same connection? -- Lapo Luchini - http://lapo.it/ “Two can keep a secret if one is dead.” (anonymous)

2 1

SSL communication is unestablishable by stunnel.
by take＠kasaneiro.jp 24 Jan '14

24 Jan '14

stunnel is used in order to use SMTPs/POPs, when using the e-mail software Mew. However, the following logs come out, emacs solidifies and communication is impossible. How is it repaired if it carries out? Please let me know if you please. Computer environment Apple MacBook Pro (Mid 2012), Mac OS X 10.9.2 GNU (Cocoa)Emacs 24.3.50.1 (x86_64-apple-darwin13.0.0, NS apple-appkit- 1265.00) Mew 6.5 Stunnel 4.56 --- <SSL/TLS: > 2014.01.23 23:30:26 LOG7[15311:140735163843344]: Clients allowed=125 2014.01.23 23:30:26 LOG5[15311:140735163843344]: stunnel 4.56 on x86_64- apple-darwin13.0.0 platform 2014.01.23 23:30:26 LOG5[15311:140735163843344]: Compiled/running with OpenSSL 0.9.8y 5 Feb 2013 2014.01.23 23:30:26 LOG5[15311:140735163843344]: Threading:PTHREAD Sockets:SELECT,IPv6 SSL:ENGINE,OCSP 2014.01.23 23:30:26 LOG5[15311:140735163843344]: Reading configuration from file /var/folders/tc/0dm70kl977x3_rcfkldrzz3h0000gn/T/take15307AeS/ mew1530708i 2014.01.23 23:30:26 LOG7[15311:140735163843344]: Compression not enabled 2014.01.23 23:30:26 LOG7[15311:140735163843344]: PRNG seeded successfully 2014.01.23 23:30:26 LOG6[15311:140735163843344]: Initializing service [ 8840] 2014.01.23 23:30:26 LOG7[15311:140735163843344]: Verify directory set to /Users/take/.certs 2014.01.23 23:30:26 LOG7[15311:140735163843344]: Added /Users/take/. certs revocation lookup directory 2014.01.23 23:30:26 LOG7[15311:140735163843344]: SSL options set: 0x00000004 2014. <SSL/TLS: > 01.23 23:30:26 LOG5[15311:140735163843344]: Configuration successful 2014.01.23 23:30:26 LOG7[15311:140735163843344]: Service [8840] (FD=7) bound to 127.0.0.1:8840 2014.01.23 23:30:26 LOG7[15311:140735163843344]: No pid file being created <SSL/TLS: > 2014.01.23 23:30:26 LOG7[15311:140735163843344]: Service [8840] accepted (FD=3) from 127.0.0.1:56364 2014.01.23 23:30:26 LOG7[15311:4558856192]: Service [8840] started 2014.01.23 23:30:26 LOG5[15311:4558856192]: Service [8840] accepted connection from 127.0.0.1:56364 2014.01.23 23:30:26 LOG6[15311:4558856192]: connect_blocking: connecting 127.0.0.1:99 2014.01.23 23:30:26 LOG7[15311:4558856192]: connect_blocking: s_poll_ wait 127.0.0.1:995: waiting 10 seconds 2014.01.23 23:30:26 LOG3[15311:4558856192]: connect_blocking: connect 127.0.0.1:995: Connection refused (61) 2014.01.23 23:30:26 LOG5[15311:4558856192]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2014.01.23 23:30:26 LOG7[15311:4558856192]: Local socket (FD=3) closed 2014.01.23 23:30:26 LOG7[15311:4558856192]: Service [8840] finished (0 left)

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users