- stunnel-users - stunnel.org

Stunnel static compile error while running Make command
by snainwar＠rediffmail.com 28 Apr '21

28 Apr '21

We are trying to static compile stunnel 5.59 with open ssl 1.1.1 on RHEl 6 and RHEL7 we are getting below error running command Make on the server /stunnel-5.59/src/cron.c:239: undefined reference to `BN_GENCB_new' /stunnel-5.59/src/cron.c:244: undefined reference to `BN_GENCB_set' stunnel-cron.o: In function `cron_dh_param': /stunnel-5.59/src/cron.c:219: undefined reference to `CRYPTO_THREAD_write_lock' /stunnel-5.59/src/cron.c:222: undefined reference to `CRYPTO_THREAD_unlock' /stunnel-5.59/src/cron.c:225: undefined reference to `CRYPTO_THREAD_read_lock' /stunnel-5.59/src/cron.c:229: undefined reference to `CRYPTO_THREAD_unlock' stunnel-cron.o: In function `cron_init': /stunnel-5.59/src/cron.c:78: undefined reference to `CRYPTO_THREAD_write_lock' /stunnel-5.59/src/cron.c:81: undefined reference to `CRYPTO_THREAD_unlock' stunnel-stunnel.o: In function `main_cleanup': /stunnel-5.59/src/stunnel.c:249: undefined reference to `CRYPTO_THREAD_write_lock' /stunnel-5.59/src/stunnel.c:263: undefined reference to `CRYPTO_THREAD_unlock' stunnel-stunnel.o: In function `process_connections': /stunnel-5.59/src/stunnel.c:889: undefined reference to `CRYPTO_THREAD_write_lock' /stunnel-5.59/src/stunnel.c:898: undefined reference to `CRYPTO_THREAD_unlock' stunnel-stunnel.o: In function `stunnel_info': /stunnel-5.59/src/stunnel.c:1034: undefined reference to `OpenSSL_version' /stunnel-5.59/src/stunnel.c:1036: undefined reference to `OpenSSL_version' /stunnel-5.59/src/stunnel.c:1041: undefined reference to `OpenSSL_version_num' collect2: error: ld returned 1 exit status make[2]: *** [stunnel] Error 1 make[2]: Leaving directory `/stunnel-5.59/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/stunnel-5.59/src' make: *** [all-recursive] Error 1 [root@tvdcltmp001 stunnel-5.59]#

1 0

Unable to reload Stunnel in Linux
by gorf＠hyperfunk.club 27 Apr '21

27 Apr '21

Hi, Normally, I would call "kill -HUP" with Stunnel's process ID to make it reload the configuration in Linux. I was very surprised when I tried that and the process stopped. Why would HUP cause it to exit, rather than reload the config? It doesn't do that on every machine. Thanks.

2 4

Questions about two host connection using stunnel
by yfmao＠seas.upenn.edu 24 Apr '21

24 Apr '21

I am using stunnel4 to build a secure connection between two ubuntu hosts. One of the hosts (sender) will send "hello world" to another host (receiver). When I am using tcpdump in receiver to capture the packets sending from sender, I find out that one of the packets contains "hello world" in plaintext. From my understanding, stunnel will encrypt the content of "hello world" if everything is correct, so I shouldn't be able to see "hello world" in plaintext among any incoming packets. Any ideas about what is going wrong here? Here I will put my stunnel.config for your reference: cert = /home/ubuntu/client_server/stunnel.pem key = /home/ubuntu/client_server/stunnel.key debug = 7 output = /home/ubuntu/client_server/stunnel.log socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 options = ALL [services] accept = 6667 connect = some_ip_address:6666 TIMEOUTclose = 0

4 6

Paid work
by David Rose (dsr) 24 Apr '21

24 Apr '21

I need an Stunnel config that will allow my Windows app that only can send SMTP without any authentication or encryption to be able to send email via Gmail or Office 365. Is this something that someone would be able to write for me and if so, what would you charge ? Thanks David --

3 2

Does stunnel support OCSP stapling?
by koalabearguo＠gmail.com 24 Apr '21

24 Apr '21

Will it plan to support in the future? Thanks.

3 2

Re: Fwd: Re: Local socket keeps listening
by Eberhard 16 Apr '21

16 Apr '21

I’ll toss in an unpopular opinion here. I have used stunnel since day one. I had over the years problems with it not answering or the parent process dying altogether and other issues. I finally decided to run it from inetd rather than as a service. It is logical that this is a little slower but with modern machines I don’t notice it. inetd always is running. Always. If it is not you pretty much cannot use the machine. It has been a service program forever and is dead reliable. What you get is total reliability for an unnoticeable loss of speed. I suppose a heavily loaded machine running at capacity might not like this – my answer is throw hardware at it. I need reliable more than anything else. I’d at least try it! E VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) <http://www.vicsmba.com/> http://www.vicsmba.com <https://www.facebook.com/groups/286143052248115> https://www.facebook.com/groups/286143052248115 From: Jorge Redondo Flames <jorge.redondo(a)gmail.com> Sent: Wednesday, April 14, 2021 11:49 AM To: Peter Pentchev <roam(a)ringlet.net> Cc: stunnel-users(a)stunnel.org Subject: [stunnel-users] Re: Fwd: Re: Local socket keeps listening Got it. Thank you very much! On Wed, 14 Apr 2021 at 20:41, Peter Pentchev <roam(a)ringlet.net <mailto:[email protected]> > wrote: On Wed, Apr 14, 2021 at 08:24:51PM +0200, Jorge Redondo Flames wrote: > On Wed, 14 Apr 2021 at 20:19, Jochen Bern <Jochen.Bern(a)binect.de <mailto:[email protected]> > wrote: > > On 14.04.21 19:58, Jorge Redondo Flames wrote: > > > Stunnel could listen on its local port *only* when the peer server is > > > listening on its corresponding server socket. So if there is no serve on > > > the other side, there should not be local listening socket. Does not that > > > make sense? > > > > No. > > > > In the general situation (server *not* being on the same machine as > > stunnel), stunnel CANNOT know whether the server's listening short of > > trying to connect to it - which it will only do on behalf of an incoming > > client request, which would never happen if stunnel weren't listening. > > > > Even if server and stunnel run on the same machine/OS, finding out about > > the server's state would require a bunch of special-purpose code. > > > > Assuming that they *are* on a common Linux (or at least unixoid) system, > > however, it would be rather trivial to write a root cron job that checks > > the output of "ss"/"netstat" for the server's LISTEN and simply > > terminates stunnel if it isn't found. > > > > Or even better, have the server *restarted* automatically whenever it > > croaks ... > > Understood. Although it still seems to me that the code doing more or less > what the cron job would do might worth. So, three points here. 1. There are some services (some servers) that do not react very nicely to somebody connecting to them and disconnecting immediately. Some of them do some work at the moment of the connection (e.g. resolve the client's IP address, check it against firewall rules, or even do some actual, service-specific, work, e.g. allocate buffers, prepare some kind of data...). Some of them are configured in such ways as to avoid portscanners or denial of service attacks or spam or flood or... many other things. In general, unless you *know* that it is safe to connect and immediately disconnect from the remote service, it is very unwise to try to do that. In your particular case, you know that, but in general, it is not a good idea. 2. Even if stunnel would try to connect to the remote service, what happens if the connection fails? OK, you say stunnel should close its local listening socket, but what then - will it never open it again? And if here's the part when you say "it can try to connect to the remote server again and start listening again" - okay, how much time passes between these connection attempts? Even something like a second may be bad if a real client chooses exactly this second to try to connect to stunnel and... stunnel is not listening... even though the remote server has started listening immediately after stunnel's last unsuccessful attempt. So... whatever interval you pick, closing the local listening socket *will* result in real, live clients failing to connect. 3. A more general point: if you really want to check whether a service is operational, only checking whether it will accept a connection is not enough. I've seen *many* failure modes over the years: from an overloaded machine where the OS kernel will accept the connection, but none of the actual server processes will react, through an overloaded service process that accepts the connection but spends too much time processing other requests to pay any attention to it, to a firewall host gone crazy that will pass connection packets, but will then refuse to pass the actual payload (yes, I've seen that happen for at least three different reasons). So an actual service check would be to connect and then send some kind of simple request to the server that you know will not take it too much time and resources to process, but will give you some measure of confidence that the server is actually serving requests and data. But in short, it is impossible for stunnel to know whether a remote server is listening for a connection without trying to connect, it may not be "polite" for it to try to connect too often, and trying to connect not-too-often *will* result in real clients being unable to connect in the intermediate intervals. G'luck, Peter -- Peter Pentchev roam(a)ringlet.net <mailto:[email protected]> roam(a)debian.org <mailto:[email protected]> pp(a)storpool.com <mailto:[email protected]> PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

2 3

Fwd: Re: Local socket keeps listening
by Jorge Redondo Flames 14 Apr '21

14 Apr '21

---------- Forwarded message --------- From: Jorge Redondo Flames <jorge.redondo(a)gmail.com> Date: Wed, 14 Apr 2021 at 19:45 Subject: Re: [stunnel-users] Re: Local socket keeps listening To: Ludolf Holzheid <lholzheid(a)bihl-wiedemann.de> Stunnel could listen on its local port *only* when the peer server is listening on its corresponding server socket. So if there is no serve on the other side, there should not be local listening socket. Does not that make sense? On Wed, 14 Apr 2021 at 19:38, Ludolf Holzheid <lholzheid(a)bihl-wiedemann.de> wrote: > On Wed, 2021-04-14 19:13:03 +0200, Jorge Redondo Flames wrote: > > [..] > > > > Is there a way to configure Stunnel to *close* the local socket (not > > listening anymore) whenever the peer process (i.e. the server) has closed > > its socket? > > Stunnel listens for connection request from the client(s) and connects > to the server on behalf of the client(s). How will a client ever be > able to connect through Stunnel again if Stunnel closes the listening > socket? > > Ludolf > > -- > > Ludolf Holzheid > > Bihl+Wiedemann GmbH > Floßwörthstraße 41 > 68199 Mannheim, Germany > > Tel: +49 621 33996-0 > Fax: +49 621 3392239 > > mailto:[email protected] > https://www.bihl-wiedemann.de > > Sitz der Gesellschaft: Mannheim > Geschäftsführer: Jochen Bihl, Bernhard Wiedemann > Amtsgericht Mannheim, HRB 5796 > > Datenschutzerklärung: https://www.bihl-wiedemann.de/de/meta/datenschutz > _______________________________________________ > stunnel-users mailing list -- stunnel-users(a)stunnel.org > To unsubscribe send an email to stunnel-users-leave(a)stunnel.org >

3 4

Re: Local socket keeps listening
by Ludolf Holzheid 14 Apr '21

14 Apr '21

On Wed, 2021-04-14 19:45:06 +0200, Jorge Redondo Flames wrote: > Stunnel could listen on its local port *only* when the peer server is > listening on its corresponding server socket. So if there is no serve on > the other side, there should not be local listening socket. Does not that > make sense? Stunnel connects to the server only when a client connects to Stunnel. If Stunnel is not listening for clients, it does not try to connect to the server. If it does not try to connect to the server, it does not know if the server is listening. Ludolf > On Wed, 14 Apr 2021 at 19:38, Ludolf Holzheid <lholzheid(a)bihl-wiedemann.de> > wrote: > > > On Wed, 2021-04-14 19:13:03 +0200, Jorge Redondo Flames wrote: > > > [..] > > > > > > Is there a way to configure Stunnel to *close* the local socket (not > > > listening anymore) whenever the peer process (i.e. the server) has closed > > > its socket? > > > > Stunnel listens for connection request from the client(s) and connects > > to the server on behalf of the client(s). How will a client ever be > > able to connect through Stunnel again if Stunnel closes the listening > > socket? > > > > Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:[email protected] https://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796 Datenschutzerklärung: https://www.bihl-wiedemann.de/de/meta/datenschutz

2 1

Local socket keeps listening
by Jorge Redondo Flames 14 Apr '21

14 Apr '21

Hey there, thanks for being there. I have a Client/Server services originally communicating over TCP. The client periodically monitors the socket connection by reading from the socket and, in the case the connection has been lost, the client retries the connection a given amount of times, after which it realizes that the server is definitely down. Now I have implemented secure communication using Stunnel and everything works fine except for the fact that, whenever the server process crashes (which is eventually expected), the client is no longer able to successfully monitor the connection as expected since, no matter what happens to the server process, the local Stunnel daemon keeps listening on its local socket. So, when the client retries connection, it successfully connects to the local socket. Although it soon receives connection reset, this successful connection attempt happening even when the server process is actually down completely breaks the client logic. I could change this logic but I really would like to avoid that path. So here is my question: Is there a way to configure Stunnel to *close* the local socket (not listening anymore) whenever the peer process (i.e. the server) has closed its socket? Thank you very much in advance.

2 1

Connection stops after 20 minutes
by erik.delanghe＠outlook.com 07 Apr '21

07 Apr '21

We use Stunnel between a windows server server and a windows client. Everything is working fine exept, after 20 minutes the connection is broken. (Cannot reach the server)

1 1

stunnel 5.59 released
by Michał Trojnara 05 Apr '21

05 Apr '21

Dear Users, I have released version 5.59 of stunnel. ### Version 5.59, 2021.04.05, urgency: HIGH * Security bugfixes - OpenSSL DLLs updated to version 1.1.1k. * New features - Client-side "protocol = ldap" support (thx to Bart Dopheide and Seth Grover). * Bugfixes - The test suite fixed not to require external connectivity. - Fixed paths in generated manuals (thx to Tatsuki Makino). - Fixed configuration reload when compression is used. - Fixed compilation with early releases of OpenSSL 1.1.1. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 137776df6be8f1701f1cd590b7779932e123479fb91e5192171c16798815ce9f stunnel-5.59.tar.gz c45fa3f70ecf0628d1f5985f2c11fedfc989bbc64db857def82ca7ee602fd8e0 stunnel-5.59-win64-installer.exe b56d91493631ff2b18e3e596fbb491892847f5671335c3f5e2307e174742ae44 stunnel-5.59-android.zip Best regards, Mike

1 0

Vulnerabilities cve-2021-3449 and cve-2021-3450
by erik.soudant＠pinkroccade.nl 31 Mar '21

31 Mar '21

Hi, Is there any chance that there will be a new stunnel version (windows) using openssl 1.1.1 k in order to be protected from at least vulnarability cve-2021-3449. And if so when can that be expected? Issue 3450 only concerns1.1.1 H-J so that is not a risk at this moment because the most recent Stunnel version is compiled against 1.1.1c.

2 1

SSL_get_peer_tmp_key fail
by stunnel＠paapnet.nl 28 Mar '21

28 Mar '21

Hai, I just tried compiling stunnel 5.58 but it bails out: CC stunnel-client.o client.c: In function 'print_tmp_key': client.c:670:10: warning: implicit declaration of function 'SSL_get_peer_tmp_key'; did you mean 'SSL_get_server_tmp_key'? [-Wimplicit-function-declaration] if (!SSL_get_peer_tmp_key(s, &key)) { ^~~~~~~~~~~~~~~~~~~~ SSL_get_server_tmp_key CCLD stunnel stunnel-client.o: In function `print_tmp_key': /try/stunnel-5.58/src/client.c:670: undefined reference to `SSL_get_peer_tmp_key' Running Ubuntu Ubuntu 18.04.5 LTS gcc version 7.5.0 (Ubuntu 7.5.0-3ubuntu1~18.04) OpenSSL 1.1.1 11 Sep 2018 Version 5.49 compiles ok no issues there Am I missing something here ? Changing it into 'SSL_get_server_tmp_key works' or remming it out probably causes issues... bt it compiles well. Would be great if someone can point me in the right direction. Cheers...

1 0

cross compile for armv7 error, show cannot find ssp_nonshared and ssp
by 583301743＠qq.com 27 Mar '21

27 Mar '21

stunnel.c:306:14: warning: unused variable ‘status’ [-Wunused-variable] 306 | int pid, status; | ^~~~~~ stunnel.c:306:9: warning: unused variable ‘pid’ [-Wunused-variable] 306 | int pid, status; | ^~~ CC stunnel-pty.o CC stunnel-libwrap.o CC stunnel-ui_unix.o CCLD stunnel /mnt/armv5-eabi--uclibc--bleeding-edge-2020.08-1/bin/../lib/gcc/arm-buildroot-linux-uclibcgnueabi/10.2.0/../../../../arm-buildroot-linux-uclibcgnueabi/bin/ld: cannot find -lssp_nonshared /mnt/armv5-eabi--uclibc--bleeding-edge-2020.08-1/bin/../lib/gcc/arm-buildroot-linux-uclibcgnueabi/10.2.0/../../../../arm-buildroot-linux-uclibcgnueabi/bin/ld: cannot find -lssp when I comment -fstack-protector running error EchoLife_WAP ~ # stunnel -help /mnt/jffs2/app/bin/stunnel: symbol '__ctype_b_loc': can't resolve symbol /mnt/jffs2/app/bin/stunnel: symbol 'pthread_key_create': can't resolve symbol /mnt/jffs2/app/bin/stunnel: symbol 'pthread_attr_setstacksize': can't resolve symbol /mnt/jffs2/app/bin/stunnel: symbol 'pthread_sigmask': can't resolve symbol /mnt/jffs2/app/bin/stunnel: symbol 'pthread_getspecific': can't resolve symbol /mnt/jffs2/app/bin/stunnel: symbol 'pthread_create': can't resolve symbol /mnt/jffs2/app/bin/stunnel: symbol 'openpty': can't resolve symbol /mnt/jffs2/app/bin/stunnel: symbol 'pthread_detach': can't resolve symbol /mnt/jffs2/app/bin/stunnel: symbol 'pthread_setspecific': can't resolve symbol /mnt/jffs2/app/bin/stunnel: symbol 'pthread_join': can't resolve symbol

2 4

when reload configure，there is a err (win32)
by koalabearguo＠gmail.com 24 Mar '21

24 Mar '21

hi,I am using the latest version(stunnel5.58) on windows10; compiled openssl 1.1.1j with option zlib enabled; the stunnel.conf file: add option "securityLevel = 0" to enable compression add option "compression = zlib" to enable compression when stunnel start,it work well.but when i reload configuration in the menu configuration，it give me this: SSL_COMP_add_compression_method: ssl\ssl_ciph.c:1997: error:140A5135:SSL routines:SSL_COMP_add_compression_method:duplicate compression id Global options: Failed to initialize TLS Then i search the source code,i found when reload config,the SSL_COMP_add_compression_method(0xe0,mesh) function will add compression id again(duplicate) i hope this can be fixed,thanks.

1 0

Windows Mobile Compiling
by ssj92＠att.net 23 Mar '21

23 Mar '21

Hello, I've been trying to compile latest version of stunnel for wce (WM6) and just cannot get it to work. I have 0 programming experience and have been trying to follow old guides. I was hoping if someone can compile or already has compiled a newer stunnel version for WCE (WM6) other than 5.02. Thanks

1 0

FIXED cross-compile stunnel lastest version with tls 1.3 suppport base on uclibc
by 583301743＠qq.com 22 Mar '21

22 Mar '21

Thank you for repy I have fix it using --with-threads=fork like CC=arm-linux-gcc CFLAGS="-fno-stack-protector" ./configure --prefix=/mnt/dists/stunnel --with-ssl=/mnt/dists/openssl-v1.1.1j --host=arm-linux --disable-fips --with-random=/dev/urandom --with-threads=fork --disable-libwrap --disable-systemd --disable-ipv6 (you maybe delete stack-protector in configure for cannot find libssp error) and commit #include <ctype.h> in common.c for fix __ctype_b_loc can't resolve symbol and delete all realize code int pty_allocate(int *ptyfd, int *ttyfd, char *namebuf) in pty.c for fix symbol 'openpty': can't resolve symbol like this int pty_allocate(int *ptyfd, int *ttyfd, char *namebuf) { return -1; } and compile openssl with no-threads options CC=arm-linux-gcc ./Configure --prefix=/mnt/dists/openssl-v1.1.1j linux-armv4 no-threads enable-tls1_3 no-asm no-async now running successfully EchoLife_WAP /tmp # ./stunnel -help Initializing inetd mode configuration stunnel 5.58 on arm-unknown-linux-gnu platform Compiled/running with OpenSSL 1.1.1j 16 Feb 2021 Threading:FORK Sockets:POLL,IPv4 TLS:ENGINE,OCSP,PSK,SNI cross-compile stunnel latest version with tls1.3 support is so diffcult. It spend my 2 days to fix problem. I do not why no any guide for cross compile for armv7 not andriod I use cross compile tools-chain is here https://toolchains.bootlin.com/downloads/releases/toolchains/armv5-eabi/tar…

1 1

Possible memory leak in stunnel4 3:5.44-1ubuntu3?
by hkdb 21 Mar '21

21 Mar '21

Hi all, I am currently implementing stunnels on an Ubuntu 18.04 container running Magento 2 connecting to AWS Elasiticache (Redis) with the following configuration: Master: fips = no setuid = nobody setgid = nogroup pid = /home/agent/pids/redis-master.pid debug = 1 delay = yes [redis-cli] client = yes accept = 127.0.0.1:8000 connect = master.awsurl:6379 and the exact same config for the read replica with different "connect" and "accept" values of course. Everything works great except that the container host becomes unresponsive after a few days. Doing a screenshot of the console shows that the host is out of memory and mentions stunnel4 in the same error message. Upon further digging, I found that running the tunnels progressively eats away at RAM over time. Look at the logs when setting debug to 7 shows the following suspect error message: Possible memory leak at ../crypto/asn1/asn1_lib.c:295: 28363 allocations Does anyone have any thoughts on this? Is it a usage/configurations issue or did I discover a memory leak here? If it is in fact a memory leak, does running a later version fix this? Is there a recommended version that I should try to run that's known to work well with Ubuntu 18.04? Thanks a lot in advance for any help on this issue! Regards, Jeremy 3DF Open Source Initiative *Mail: *hkdb(a)3df.io *Web: *https://osi.3df.io

1 0

when reload configure，there is a err (win32)
by koalabearguo＠gmail.com 17 Mar '21

17 Mar '21

hi,I am using the latest version(stunnel5.58) on windows10; compiled openssl 1.1.1j with option zlib enabled; the stunnel.conf file: add option "securityLevel = 0" to enable compression add option "compression = zlib" to enable compression when stunnel start,it work well.but when i reload configuration in the menu configuration，it give me this: SSL_COMP_add_compression_method: ssl\ssl_ciph.c:1997: error:140A5135:SSL routines:SSL_COMP_add_compression_method:duplicate compression id Global options: Failed to initialize TLS Then i search the source code,i found when reload config,the SSL_COMP_add_compression_method(0xe0,mesh) function will add compression id again(duplicate) i think this can be fixed,thanks.

1 0

TLS alert (read): warning: close notify
by Daniel Trickett 08 Mar '21

08 Mar '21

Hi folks, Receiving the message "TLS alert (read): warning: close notify" when initiating connection to another site. I checked logs and we do not get this on any other site we use stunnel to connect to. Is this a message an acknowledgement that stunnel received a close notify message from the external site? 2021.02.25 11:11:17 LOG6[106453]: TLS connected: new session negotiated 2021.02.25 11:11:17 LOG7[106453]: Deallocating application specific data for session connect address 2021.02.25 11:11:17 LOG6[106453]: Negotiated TLSv1.2 ciphersuite ECDHE-ECDSA-AES256-GCM-SHA384 (256-bit encryption) 2021.02.25 11:11:17 LOG7[106453]: Compression: null, expansion: null 021.02.25 11:11:17 LOG7[106453]: TLS alert (read): warning: close notify 2021.02.25 11:11:17 LOG6[106453]: TLS closed (SSL_read) 2021.02.25 11:11:17 LOG7[106453]: Sent socket write shutdown 2021.02.25 11:11:17 LOG6[106453]: Read socket closed (readsocket) 2021.02.25 11:11:17 LOG7[106453]: Sending close_notify alert 2021.02.25 11:11:17 LOG7[106453]: TLS alert (write): warning: close notify 2021.02.25 11:11:17 LOG6[106453]: SSL_shutdown successfully sent close_notify alert 2021.02.25 11:11:17 LOG5[106453]: Connection closed: 9951 byte(s) sent to TLS, 419 byte(s) sent to socket 2021.02.25 11:11:17 LOG7[106453]: Remote descriptor (FD=16) closed 2021.02.25 11:11:17 LOG7[106453]: Local descriptor (FD=15) closed 2021.02.25 11:11:17 LOG7[106453]: Service [xxxx-https] finished (0 left) Best regards, Dan This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click http://www.merckgroup.com/disclaimer to access the German, French, Spanish and Portuguese versions of this disclaimer.

1 0

Win32 client cron_thread in main_cleanup() lock daemon_thread()
by jony202＠gmail.com 07 Mar '21

07 Mar '21

in main_cleanup() this code blocks because cron_thread has no exit #ifdef USE_WIN32 if(WaitForSingleObject(thread_list[i], INFINITE)==WAIT_FAILED) ioerror("WaitForSingleObject"); if(!CloseHandle(thread_list[i])) ioerror("CloseHandle"); #endif

1 0

Error Stunnel TLS alert (write): fatal: bad record mac
by Alexandre Afonso Vaz 02 Mar '21

02 Mar '21

Hello everyone I apologize in advance because my English is not the best I'm experiencing a problem with stunnel: On the server I'm running a current version [.] stunnel 5.56 on x86_64-pc-linux-gnu platform Compiled / running with OpenSSL 1.1.1d 10 Sep 2019 And on the client an old version [.] stunnel 5.39 on x86_64-pc-linux-gnu platform Compiled with OpenSSL 1.1.0c 10 Nov 2016 The case is that I am having an error in the server log as shown below: SSL_accept: ../ssl/record/ssl3_record.c:677: error: 1408F119: SSL routines: ssl3_get_record: decryption failed or bad record mac I did the test by updating the client to the same version and everything works, the question I have is whether there is really an incompatibility between the versions (be it the stunnel or the openssl). Does anyone know how to confirm me if this is real? Thanks Vaz

1 0

How to insert 2 stunnel.service on redhat 7
by simona vittori 02 Mar '21

02 Mar '21

Hello, I have 2 stunnel instance on a server and I have to insert all 2 in systemd. How to do that? Is it possible to create 2 stunnel.service naming different, for example stunnel.service and stunnel1.service where insert the script to start at boot of the machine? Thanks a lot for you help, Bye Simona

2 2

TLS alert (read): warning: close notify
by Daniel Trickett 01 Mar '21

01 Mar '21

Hi folks, Receiving the message "TLS alert (read): warning: close notify" when initiating connection to another site. I checked logs and we do not get this on any other site we use stunnel to connect to. Is this a message an acknowledgement that stunnel received a close notify message from the external site? 2021.02.25 11:11:17 LOG6[106453]: TLS connected: new session negotiated 2021.02.25 11:11:17 LOG7[106453]: Deallocating application specific data for session connect address 2021.02.25 11:11:17 LOG6[106453]: Negotiated TLSv1.2 ciphersuite ECDHE-ECDSA-AES256-GCM-SHA384 (256-bit encryption) 2021.02.25 11:11:17 LOG7[106453]: Compression: null, expansion: null 021.02.25 11:11:17 LOG7[106453]: TLS alert (read): warning: close notify 2021.02.25 11:11:17 LOG6[106453]: TLS closed (SSL_read) 2021.02.25 11:11:17 LOG7[106453]: Sent socket write shutdown 2021.02.25 11:11:17 LOG6[106453]: Read socket closed (readsocket) 2021.02.25 11:11:17 LOG7[106453]: Sending close_notify alert 2021.02.25 11:11:17 LOG7[106453]: TLS alert (write): warning: close notify 2021.02.25 11:11:17 LOG6[106453]: SSL_shutdown successfully sent close_notify alert 2021.02.25 11:11:17 LOG5[106453]: Connection closed: 9951 byte(s) sent to TLS, 419 byte(s) sent to socket 2021.02.25 11:11:17 LOG7[106453]: Remote descriptor (FD=16) closed 2021.02.25 11:11:17 LOG7[106453]: Local descriptor (FD=15) closed 2021.02.25 11:11:17 LOG7[106453]: Service [xxxx-https] finished (0 left) This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click http://www.merckgroup.com/disclaimer to access the German, French, Spanish and Portuguese versions of this disclaimer.

1 0

New User
by David Rose (dsr) 24 Feb '21

24 Feb '21

Hi I have a Windows app that sends email via SMTP without any authentication (port can be set). I want to use it with Office365 SMTP service which requires TLS. Will stunnel allow me to do this without affecting any other application sending email ? If it does, what terms should I be looking for in the help info ? Many thanks Regards David --

1 0

Windows Server 2012 R2 - localhost:25 stops listening
by Frank Warnke 23 Feb '21

23 Feb '21

Hi, I have noticed that when I install stunnel (stunnel-5.57-win64-installer.exe or today stunnel-5.58-win64-installer.exe) that running "netstat -ano" comes back with; TCP 127.0.0.1:25 0.0.0.0:0 LISTENING 2700 and the application we are using can send email via Gmail SMTP using the default stunnel.config. When I log out the user and go back in, the application can no longer send email via Gmail SMTP and "netstat -ano" no longer sees anything listening on port 25. I have verified that the stunnel service is running and have even stopped and started the stunnel service, but I am not able to get port 25 to be listened to unless I uninstall and install stunnel over again. It seems like something is setup or started during the stunnel install process that stops or gets killed after a user log outs. Any suggestions would be appreciated. Thanks, Frank

2 2

Unable to connect to server using Stunnel with TLS1.2
by jing_pan＠kindermorgan.com 02 Feb '21

02 Feb '21

We failed to using stunnel to connect to remote server which only accept TLS1.2. So we configured the stunnel on our side with below stunnel.conf. We have another program listening to localhost:3500 and process the response from server. I would appreciate any suggestion. 1. Stunnel version: 2021.02.02 10:35:27 LOG5[main]: stunnel 5.58 on x64-pc-mingw32-gnu platform 2021.02.02 10:35:27 LOG5[main]: Compiled/running with OpenSSL 1.1.1h 22 Sep 2020 2021.02.02 10:35:27 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI 2021.02.02 10:35:27 LOG5[main]: Reading configuration from file stunnel.conf 2021.02.02 10:35:27 LOG5[main]: UTF-8 byte order mark not detected 2021.02.02 10:35:27 LOG4[main]: Service [FIXSERVER] needs authentication to prevent MITM attacks 2021.02.02 10:35:27 LOG5[main]: Configuration successful 2. stunnel.conf [FIXSERVER] cert = stunnel.pem client = yes fips = no accept = 127.0.0.1:3000 connect = 63.247.***.***:443 sslVersion = TLSv1.2 3. error returned: An existing connection was forcibly closed by the remote host 4. openssl s_client -connect 63.247.***.***:443 --- No client certificate CA names sent Peer signing digest: SHA256 Peer signature type: RSA Server Temp Key: ECDH, P-256, 256 bits --- SSL handshake has read 2814 bytes and written 419 bytes Verification error: self signed certificate in certificate chain --- New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384 Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE

1 0

Seeing Message in Plain Text in Wireshark
by David Brower 28 Jan '21

28 Jan '21

First time user of Stunnel and I just wanted to check what I'm doing wrong. I have two processes running: a TCP Listener that listens on port 13000 and a TCP client that sends it a message. I'm running Stunnel on Windows 10 with the following config: [myapp] client = yes accept = 13001 connect = 13000 cert = stunnel.pem TIMEOUTclose=0 I updated the TCP client to send the message to port 13001 but when I check Wireshark I can still see the contents of the message in plaintext. Shouldn't I no longer be able to see the unencrypted contents of this message? Here are the relevant logs: 2021.01.27 20:57:26 LOG7[main]: Found 1 ready file descriptor(s) 2021.01.27 20:57:26 LOG7[main]: FD=588 ifds=r-x ofds=r-- 2021.01.27 20:57:26 LOG7[main]: FD=596 ifds=r-x ofds=--- 2021.01.27 20:57:26 LOG7[main]: Service [myapp] accepted (FD=924) from 127.0.0.1:9322 2021.01.27 20:57:26 LOG7[main]: Creating a new thread 2021.01.27 20:57:26 LOG7[main]: New thread created 2021.01.27 20:57:26 LOG7[2]: Service [myapp] started 2021.01.27 20:57:26 LOG7[2]: Setting local socket options (FD=924) 2021.01.27 20:57:26 LOG7[2]: Option TCP_NODELAY set on local socket 2021.01.27 20:57:26 LOG5[2]: Service [myapp] accepted connection from 127.0.0.1:9322 2021.01.27 20:57:26 LOG6[2]: s_connect: connecting 127.0.0.1:13000 2021.01.27 20:57:26 LOG7[2]: s_connect: s_poll_wait 127.0.0.1:13000: waiting 10 seconds 2021.01.27 20:57:26 LOG7[2]: FD=940 ifds=rwx ofds=--- 2021.01.27 20:57:26 LOG5[2]: s_connect: connected 127.0.0.1:13000 2021.01.27 20:57:26 LOG5[2]: Service [myapp] connected remote server from 127.0.0.1:9323 2021.01.27 20:57:26 LOG7[2]: Setting remote socket options (FD=940) 2021.01.27 20:57:26 LOG7[2]: Option TCP_NODELAY set on remote socket 2021.01.27 20:57:26 LOG7[2]: Remote descriptor (FD=940) initialized 2021.01.27 20:57:26 LOG6[2]: SNI: sending servername: localhost 2021.01.27 20:57:26 LOG6[2]: Peer certificate not required 2021.01.27 20:57:26 LOG7[2]: TLS state (connect): before SSL initialization 2021.01.27 20:57:26 LOG7[2]: Initializing application specific data for session authenticated 2021.01.27 20:57:26 LOG7[2]: TLS state (connect): SSLv3/TLS write client hello

3 2

Stunnel intercept and modify payload
by Sealside - 26 Jan '21

26 Jan '21

Hi! I'm wondering if it is possible to modify payload before it is encrypted? I have a stunnel config which intercepts TLS. I have the following config: [server] client = no cert= /etc/stunnel/stunnel.pem accept = 127.0.0.1:11010 connect = 127.0.0.1:12220 [client] client = yes accept = 127.0.0.1:12220 connect = remoteserver_ip:12222 So when posting TLS messages on port 11010 from my TLS-client on the same server, I can connect to port 12220 using tcp-dump and read the payload unencrypted. Is it possible to alter the payload before it is sent? In that case any pointers would be appreciated , I have tried searching but it does not seem to be a common use case. Would be great if I could tunnel it somewhere else and back (external python program). Thanks in advance, S

1 0

Poss Memory Leak
by Danny Clowes 25 Jan '21

25 Jan '21

Hi, Using the latest build of S'tunnel getting this error when do systemctl status stunnel4 can anyone shed some light on this please using Debian 9 as unable to get Debian 10 work with Stunnel. Jan 25 17:30:38 mobile-connection-server stunnel[16656]: LOG4[508179]: Possible memory leak at ../ssl/packet_locl.h:385: 1021646 allocations Jan 25 17:30:38 mobile-connection-server stunnel[16656]: LOG4[508091]: Possible memory leak at ../ssl/packet_locl.h:385: 1021646 allocations Jan 25 17:30:38 mobile-connection-server stunnel[16656]: LOG4[508179]: Possible memory leak at ../crypto/threads_pthread.c:21: 526301 allocations Jan 25 17:30:38 mobile-connection-server stunnel[16656]: LOG4[508091]: Possible memory leak at ../crypto/threads_pthread.c:21: 526301 allocations Jan 25 17:30:38 mobile-connection-server stunnel[16656]: LOG4[508170]: Possible memory leak at ../crypto/stack/stack.c:108: 1026780 allocations Jan 25 17:30:38 mobile-connection-server stunnel[16656]: LOG4[508170]: Possible memory leak at ../ssl/packet_locl.h:385: 1021646 allocations Jan 25 17:30:38 mobile-connection-server stunnel[16656]: LOG4[508170]: Possible memory

1 0

installation v run ad-hoc
by Andrew Zenz 21 Jan '21

21 Jan '21

Hi there, a bit of background to start. We are using SEE4C (from marshallsoft.com) for sending email from our application, and have been for some time. We call various functions from their see32.dll. It has been sitting on the back-burner for some time, but now we must implement TLS/SSL for outgoing mail. MarshallSoft don't do TLS/SSL themselves, instead passing that responsibility on to stunnel by way of an internal function I have been reading MarshallSoft's doco and find that I have to 'install' stunnel and have it running in the background either as a services or starting it when the user logs on (in the Startup group). I also read in their doco regarding mapped drives: MAPPED DRIVES Beginning with Windows 10 update 1803, all executables (such as SEE application programs, SEE32.DLL/SEE64.DLL, and Stunnel) must be loaded from a local drive, not a mapped drive. Unfortunately the requirement to install stunnel and inability to run it from a mapped drive doesn't suit many of our clients installation base. Many of them run our application from a mapped drive. I also don't want the overhead of installing stunnel on each workstation that needs to send email or distribute and maintain configuration files. I have enough work to do. Can stunnel be called (started) on an ad-hoc basis and stopped again, only when email is being sent? I don't mean to whine, what options do I have, do our clients have? Cheers, Andrew

1 0

Why the version of Client Hello is always TLS 1.0 ?
by liuyongjiao＠synqnc.com 13 Jan '21

13 Jan '21

Hi, Why the TLS version is always 1.0 ? Please help to check. Frame 11: 1721 bytes on wire (13768 bits), 1721 bytes captured (13768 bits) Ethernet II, Src: fa:16:3e:53:dc:2f (fa:16:3e:53:dc:2f), Dst: IETF-VRRP-VRID_02 (00:00:5e:00:01:02) Internet Protocol Version 4, Src: 10.160.8.11, Dst: 10.160.130.34 Transmission Control Protocol, Src Port: 50692, Dst Port: 9002, Seq: 1, Ack: 1, Len: 1655 Transport Layer Security TLSv1 Record Layer: Handshake Protocol: Client Hello Content Type: Handshake (22) Version: TLS 1.0 (0x0301) Length: 1650 Handshake Protocol: Client Hello Handshake Type: Client Hello (1) Length: 1646 Version: TLS 1.2 (0x0303) Random: fd7cbf2da8172c362ebd3120b2dcd3886f3015eabfb5f167… Session ID Length: 32 Session ID: 4ea202f00bd35c102c97e8621f68e33dd59ad8ee95a58a2f… Cipher Suites Length: 170 Cipher Suites (85 suites) Compression Methods Length: 1 Compression Methods (1 method) Extensions Length: 1403 Extension: server_name (len=18) Extension: ec_point_formats (len=4) Extension: supported_groups (len=28) Extension: session_ticket (len=1296) Extension: signature_algorithms (len=32) Extension: heartbeat (len=1) Following are the config file: ;************************************************************************** ; * Global options * ; ************************************************************************** ; It is recommended to drop root privileges if stunnel is started by root ;setuid = stunnel4 ;setgid = stunnel4 ; PID file is created inside the chroot jail (if enabled) pid = /home/stunnelnew.pid ; Debugging stuff (may be useful for troubleshooting) ;foreground = yes ;debug = info debug = debug output = /home/log/stunnelnew.log ;options = NO_SSLv2 ;options = NO_SSLv3 ;options = NO_TLSv1 ;options = NO_TLSv1.1 ;sslVersionMax = TLSv1.2 ;sslVersionMin = TLSv1.2 ; ************************************************************************** ; * Service definitions (remove all services for inetd mode) * ; ************************************************************************** [xxxxxxxxxxxx] ;socket = a:SO_REUSEADDR=no retry = yes ;options = NO_SSLv2 ;options = NO_SSLv3 ;options = NO_TLSv1 ;options = NO_TLSv1.1 sslVersion = TLSv1.2 ;socket = l:SO_LINGER=1:13 ;sslVersionMin = TLSv1.2 cert = /home/x/ssltest/x/server.cer key = /home/x/ssltest/x/server_key.pem CAfile = /home/x/ssltest/x/trust.cer client = yes accept = 31115 connect = 10.160.1.11:9113 liuyongjiao(a)synqnc.com

1 0

stunnel to gmail didn't work
by wangweihsiang1109＠gmail.com 09 Jan '21

09 Jan '21

Hello,I have set up a website,and I want to send email by gmail,so I used stunnel,but my gmail didn't send anything. 2021.01.08 15:01:58 LOG5[14]: Service [gmail-smtp] accepted connection from 127.0.0.1:59920 2021.01.08 15:01:58 LOG5[14]: s_connect: connected 2404:6800:4008:c06::6d:587 2021.01.08 15:01:58 LOG5[14]: Service [gmail-smtp] connected remote server from 2001:b011:e:3358:b5b1:fa68:8b3:883c:59921 2021.01.08 15:01:59 LOG5[14]: Connection closed: 22 byte(s) sent to TLS, 154 byte(s) sent to socket conf look like this: [gmail-smtp] client = yes accept = 127.0.0.1:35 connect = smtp.gmail.com:587 verifyChain = yes CAfile = ca-certs.pem checkHost = smtp.gmail.com OCSPaia = yes protocol = smtp protocolUsername = *****(a)gmail.com protocolPassword = *****

1 0

report
by Danny Clowes 03 Jan '21

03 Jan '21

sudo find / -name openssl ive checked some locations but im very lost since learning ssl and stunnel i would be happy if you could forward me to the right location & i'll send information back.. Thank you ------------------- /etc/apparmor.d/abstractions/openssl /usr/include/x86_64-linux-gnu/openssl /usr/include/openssl /usr/bin/openssl /usr/share/lintian/overrides/openssl /usr/share/doc/openssl /usr/share/bash-completion/completions/openssl /root/openssl-master/test/ossl_shim/include/openssl /root/openssl-master/include/openssl /snap/core/10577/etc/apparmor.d/abstractions/openssl /snap/core/10577/usr/bin/openssl /snap/core/10577/usr/lib/python3/dist-packages/cryptography/hazmat/backends/openssl /snap/core/10577/usr/lib/python3/dist-packages/cryptography/hazmat/bindings/openssl /snap/core/10577/usr/share/bash-completion/completions/openssl /snap/core/10577/usr/share/doc/openssl root@debian:/usr/local/include#

1 0

report
by Danny Clowes 28 Dec '20

28 Dec '20

Hi, I'm using 5.7 stunnel for Debian. I have clients connecting to the server we are getting the following error message. I would be grateful if able to help? * Unable to use the beta version as the R-limit don't work and gives me error messages. Dec 28 08:44:33 debian stunnel: LOG4[129248]: Possible memory leak at ../ssl/packet_locl.h:385: 241533 allocations Dec 28 08:44:33 debian stunnel: LOG4[128031]: Possible memory leak at ../crypto/stack/stack.c:108: 243008 allocations Dec 28 08:44:33 debian stunnel: LOG4[129238]: Possible memory leak at ../crypto/stack/stack.c:108: 243008 allocations Dec 28 08:44:33 debian stunnel: LOG4[128031]: Possible memory leak at ../ssl/packet_locl.h:385: 241533 allocations Dec 28 08:44:33 debian stunnel: LOG4[129140]: Possible memory leak at ../crypto/stack/stack.c:108: 243008 allocations Dec 28 08:44:33 debian stunnel: LOG4[129140]: Possible memory leak at ../ssl/packet_locl.h:385: 241533 allocations Dec 28 08:44:33 debian stunnel: LOG4[129238]: Possible memory leak at ../ssl/packet_locl.h:385: 241533 allocations Dec 28 08:44:33 debian stunnel: LOG4[129206]: Possible memory leak at ../crypto/stack/stack.c:108: 243008 allocations Dec 28 08:44:33 debian stunnel: LOG4[129206]: Possible memory leak at ../ssl/packet_locl.h:385: 241533 allocations Dec 28 08:44:33 debian stunnel: LOG4[128166]: Possible memory leak at ../crypto/stack/stack.c:108: 243008 allocations Dec 28 08:44:33 debian stunnel: LOG4[128166]: Possible memory leak at ../ssl/packet_locl.h:385: 241533 allocations Thanks.

1 0

stunnel is stuck for 30 seconds
by dittyadler＠gmail.com 23 Dec '20

23 Dec '20

Hi, I'm running stunnel version 5.58 on Windows, everything works perfectly besides that sometimes stunnel gets stuck for 30 seconds - Nothing special in stunnel log, except for the 30 seconds delay: 2020.12.21 14:48:36 LOG6[8]: TLS connected: previous session reused 2020.12.21 14:48:36 LOG6[8]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) 2020.12.21 14:48:36 LOG6[8]: Peer temporary key: X25519, 253 bits 2020.12.21 14:48:36 LOG7[8]: Compression: null, expansion: null 2020.12.21 14:48:36 LOG6[8]: Session id: 8E62D0D8EB6359FEA7370E64AA7CC58EF9DB68059A5E01417E7038B773CE60D3 2020.12.21 14:48:36 LOG7[8]: TLS state (connect): SSL negotiation finished successfully 2020.12.21 14:48:36 LOG7[8]: TLS state (connect): SSL negotiation finished successfully 2020.12.21 14:48:36 LOG7[8]: Initializing application specific data for session authenticated 2020.12.21 14:48:36 LOG7[8]: New session callback 2020.12.21 14:48:36 LOG7[8]: Deallocating application specific data for session connect address 2020.12.21 14:48:36 LOG6[8]: Session id: AF8ED185555C6734403C71B514A3F6B75F8484A5AC4EAE6058CFF4D35D929B36 2020.12.21 14:48:36 LOG7[8]: TLS state (connect): SSLv3/TLS read server session ticket 30 sec delay 2020.12.21 14:49:06 LOG6[8]: Read socket closed (readsocket) 2020.12.21 14:49:06 LOG7[8]: Sending close_notify alert 2020.12.21 14:49:06 LOG7[8]: TLS alert (write): warning: close notify 2020.12.21 14:49:06 LOG6[8]: SSL_shutdown successfully sent close_notify alert 2020.12.21 14:49:06 LOG3[8]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing 2020.12.21 14:49:06 LOG7[8]: FD=4540 ifds=--x ofds=--- 2020.12.21 14:49:06 LOG7[8]: FD=4792 ifds=r-x ofds=--- 2020.12.21 14:49:06 LOG5[8]: Connection closed: 64 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.12.21 14:49:06 LOG7[8]: Remote descriptor (FD=4792) closed 2020.12.21 14:49:06 LOG7[8]: Local descriptor (FD=4540) closed 2020.12.21 14:49:06 LOG7[8]: Service [SLNP pem file] finished (0 left) log example when stunnel doesn't get stuck: 2020.12.21 14:49:06 LOG6[9]: TLS connected: previous session reused 2020.12.21 14:49:06 LOG6[9]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) 2020.12.21 14:49:06 LOG6[9]: Peer temporary key: X25519, 253 bits 2020.12.21 14:49:06 LOG7[9]: Compression: null, expansion: null 2020.12.21 14:49:06 LOG6[9]: Session id: AF8ED185555C6734403C71B514A3F6B75F8484A5AC4EAE6058CFF4D35D929B36 2020.12.21 14:49:06 LOG7[9]: TLS state (connect): SSL negotiation finished successfully 2020.12.21 14:49:06 LOG7[9]: TLS state (connect): SSL negotiation finished successfully 2020.12.21 14:49:06 LOG7[9]: Initializing application specific data for session authenticated 2020.12.21 14:49:06 LOG7[9]: New session callback 2020.12.21 14:49:06 LOG7[9]: Deallocating application specific data for session connect address 2020.12.21 14:49:06 LOG6[9]: Session id: 44E9010787EFDBC0FCA92724415AD30EF9EDB626D734D894061606C79CD26402 2020.12.21 14:49:06 LOG7[9]: TLS state (connect): SSLv3/TLS read server session ticket 2020.12.21 14:49:06 LOG6[9]: Read socket closed (readsocket) 2020.12.21 14:49:06 LOG7[9]: Sending close_notify alert 2020.12.21 14:49:06 LOG7[9]: TLS alert (write): warning: close notify 2020.12.21 14:49:06 LOG6[9]: SSL_shutdown successfully sent close_notify alert 2020.12.21 14:49:06 LOG3[9]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing 2020.12.21 14:49:06 LOG7[9]: FD=2464 ifds=r-x ofds=--- 2020.12.21 14:49:06 LOG7[9]: FD=2788 ifds=--x ofds=--- 2020.12.21 14:49:06 LOG5[9]: Connection closed: 64 byte(s) sent to TLS, 108 byte(s) sent to socket 2020.12.21 14:49:06 LOG7[9]: Remote descriptor (FD=2464) closed 2020.12.21 14:49:06 LOG7[9]: Local descriptor (FD=2788) closed 2020.12.21 14:49:06 LOG7[9]: Service [SLNP pem file] finished (0 left) My stunnel conf: debug = 7 output = stunnel.log fips = no options = NO_SSLv2 [SLNP pem file] key = SLNP_urmsand01_new.pem cert = SLNP_urmsand01_new.pem client = yes accept = 8003 connect = host:6443 TIMEOUTbusy = 30 TIMEOUTclose = 0 TIMEOUTconnect = 60 TIMEOUTidle = 86400 With the old stunnel(5.14) it doesn’t happen. Thanks, Ditty.

3 3

stunnel is stuck for 30 seconds
by Brent Kimberley 23 Dec '20

23 Dec '20

Chris/Ditty. Have you tried optimizing your config - on both sides? For example, please search for TIMEOUTbusy in https://github.com/mtrojnar/stunnel/tree/stunnel-5.58 &/| https://github.com/mtrojnar/stunnel/tree/stunnel-5.57 On 12/21/20 13:09, dittyadler(a)gmail.com wrote: > Hi, > > I'm running stunnel version 5.58 on Windows, > everything works perfectly besides that sometimes stunnel gets stuck for 30 seconds - > Nothing special in stunnel log, except for the 30 seconds delay: >

1 0

stunnel is stuck for 30 seconds
by dittyadler＠gmail.com 21 Dec '20

21 Dec '20

Hi, I'm running stunnel version 5.58 on Windows, everything works perfectly besides that sometimes stunnel gets stuck for 30 seconds - Nothing special in stunnel log, except for the 30 seconds delay: 2020.12.21 14:48:36 LOG6[8]: TLS connected: previous session reused 2020.12.21 14:48:36 LOG6[8]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) 2020.12.21 14:48:36 LOG6[8]: Peer temporary key: X25519, 253 bits 2020.12.21 14:48:36 LOG7[8]: Compression: null, expansion: null 2020.12.21 14:48:36 LOG6[8]: Session id: 8E62D0D8EB6359FEA7370E64AA7CC58EF9DB68059A5E01417E7038B773CE60D3 2020.12.21 14:48:36 LOG7[8]: TLS state (connect): SSL negotiation finished successfully 2020.12.21 14:48:36 LOG7[8]: TLS state (connect): SSL negotiation finished successfully 2020.12.21 14:48:36 LOG7[8]: Initializing application specific data for session authenticated 2020.12.21 14:48:36 LOG7[8]: New session callback 2020.12.21 14:48:36 LOG7[8]: Deallocating application specific data for session connect address 2020.12.21 14:48:36 LOG6[8]: Session id: AF8ED185555C6734403C71B514A3F6B75F8484A5AC4EAE6058CFF4D35D929B36 2020.12.21 14:48:36 LOG7[8]: TLS state (connect): SSLv3/TLS read server session ticket 30 sec delay 2020.12.21 14:49:06 LOG6[8]: Read socket closed (readsocket) 2020.12.21 14:49:06 LOG7[8]: Sending close_notify alert 2020.12.21 14:49:06 LOG7[8]: TLS alert (write): warning: close notify 2020.12.21 14:49:06 LOG6[8]: SSL_shutdown successfully sent close_notify alert 2020.12.21 14:49:06 LOG3[8]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing 2020.12.21 14:49:06 LOG7[8]: FD=4540 ifds=--x ofds=--- 2020.12.21 14:49:06 LOG7[8]: FD=4792 ifds=r-x ofds=--- 2020.12.21 14:49:06 LOG5[8]: Connection closed: 64 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.12.21 14:49:06 LOG7[8]: Remote descriptor (FD=4792) closed 2020.12.21 14:49:06 LOG7[8]: Local descriptor (FD=4540) closed 2020.12.21 14:49:06 LOG7[8]: Service [SLNP pem file] finished (0 left) log example when stunnel doesn't get stuck: 2020.12.21 14:49:06 LOG6[9]: TLS connected: previous session reused 2020.12.21 14:49:06 LOG6[9]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) 2020.12.21 14:49:06 LOG6[9]: Peer temporary key: X25519, 253 bits 2020.12.21 14:49:06 LOG7[9]: Compression: null, expansion: null 2020.12.21 14:49:06 LOG6[9]: Session id: AF8ED185555C6734403C71B514A3F6B75F8484A5AC4EAE6058CFF4D35D929B36 2020.12.21 14:49:06 LOG7[9]: TLS state (connect): SSL negotiation finished successfully 2020.12.21 14:49:06 LOG7[9]: TLS state (connect): SSL negotiation finished successfully 2020.12.21 14:49:06 LOG7[9]: Initializing application specific data for session authenticated 2020.12.21 14:49:06 LOG7[9]: New session callback 2020.12.21 14:49:06 LOG7[9]: Deallocating application specific data for session connect address 2020.12.21 14:49:06 LOG6[9]: Session id: 44E9010787EFDBC0FCA92724415AD30EF9EDB626D734D894061606C79CD26402 2020.12.21 14:49:06 LOG7[9]: TLS state (connect): SSLv3/TLS read server session ticket 2020.12.21 14:49:06 LOG6[9]: Read socket closed (readsocket) 2020.12.21 14:49:06 LOG7[9]: Sending close_notify alert 2020.12.21 14:49:06 LOG7[9]: TLS alert (write): warning: close notify 2020.12.21 14:49:06 LOG6[9]: SSL_shutdown successfully sent close_notify alert 2020.12.21 14:49:06 LOG3[9]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing 2020.12.21 14:49:06 LOG7[9]: FD=2464 ifds=r-x ofds=--- 2020.12.21 14:49:06 LOG7[9]: FD=2788 ifds=--x ofds=--- 2020.12.21 14:49:06 LOG5[9]: Connection closed: 64 byte(s) sent to TLS, 108 byte(s) sent to socket 2020.12.21 14:49:06 LOG7[9]: Remote descriptor (FD=2464) closed 2020.12.21 14:49:06 LOG7[9]: Local descriptor (FD=2788) closed 2020.12.21 14:49:06 LOG7[9]: Service [SLNP pem file] finished (0 left) My stunnel conf: debug = 7 output = stunnel.log fips = no options = NO_SSLv2 [SLNP pem file] key = SLNP_urmsand01_new.pem cert = SLNP_urmsand01_new.pem client = yes accept = 8003 connect = host:6443 TIMEOUTbusy = 30 TIMEOUTclose = 0 TIMEOUTconnect = 60 TIMEOUTidle = 86400 With the old stunnel(5.14) it doesn’t happen. Thanks, Ditty.

1 0

stunnel is stuck for 30 seconds
by DITTY ADLER 21 Dec '20

21 Dec '20

Hi, I'm running stunnel version 5.58 on Windows, everything works perfectly besides that sometimes stunnel gets stuck for 30 seconds - Nothing special in stunnel log, except for the 30 seconds delay: 2020.12.21 14:48:36 LOG6[8]: TLS connected: previous session reused 2020.12.21 14:48:36 LOG6[8]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) 2020.12.21 14:48:36 LOG6[8]: Peer temporary key: X25519, 253 bits 2020.12.21 14:48:36 LOG7[8]: Compression: null, expansion: null 2020.12.21 14:48:36 LOG6[8]: Session id: 8E62D0D8EB6359FEA7370E64AA7CC58EF9DB68059A5E01417E7038B773CE60D3 2020.12.21 14:48:36 LOG7[8]: TLS state (connect): SSL negotiation finished successfully 2020.12.21 14:48:36 LOG7[8]: TLS state (connect): SSL negotiation finished successfully 2020.12.21 14:48:36 LOG7[8]: Initializing application specific data for session authenticated 2020.12.21 14:48:36 LOG7[8]: New session callback 2020.12.21 14:48:36 LOG7[8]: Deallocating application specific data for session connect address 2020.12.21 14:48:36 LOG6[8]: Session id: AF8ED185555C6734403C71B514A3F6B75F8484A5AC4EAE6058CFF4D35D929B36 2020.12.21 14:48:36 LOG7[8]: TLS state (connect): SSLv3/TLS read server session ticket 30 sec delay 2020.12.21 14:49:06 LOG6[8]: Read socket closed (readsocket) 2020.12.21 14:49:06 LOG7[8]: Sending close_notify alert 2020.12.21 14:49:06 LOG7[8]: TLS alert (write): warning: close notify 2020.12.21 14:49:06 LOG6[8]: SSL_shutdown successfully sent close_notify alert 2020.12.21 14:49:06 LOG3[8]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing 2020.12.21 14:49:06 LOG7[8]: FD=4540 ifds=--x ofds=--- 2020.12.21 14:49:06 LOG7[8]: FD=4792 ifds=r-x ofds=--- 2020.12.21 14:49:06 LOG5[8]: Connection closed: 64 byte(s) sent to TLS, 0 byte(s) sent to socket 2020.12.21 14:49:06 LOG7[8]: Remote descriptor (FD=4792) closed 2020.12.21 14:49:06 LOG7[8]: Local descriptor (FD=4540) closed 2020.12.21 14:49:06 LOG7[8]: Service [SLNP pem file] finished (0 left) log example when stunnel doesn't get stuck: 2020.12.21 14:49:06 LOG6[9]: TLS connected: previous session reused 2020.12.21 14:49:06 LOG6[9]: TLSv1.3 ciphersuite: TLS_AES_256_GCM_SHA384 (256-bit encryption) 2020.12.21 14:49:06 LOG6[9]: Peer temporary key: X25519, 253 bits 2020.12.21 14:49:06 LOG7[9]: Compression: null, expansion: null 2020.12.21 14:49:06 LOG6[9]: Session id: AF8ED185555C6734403C71B514A3F6B75F8484A5AC4EAE6058CFF4D35D929B36 2020.12.21 14:49:06 LOG7[9]: TLS state (connect): SSL negotiation finished successfully 2020.12.21 14:49:06 LOG7[9]: TLS state (connect): SSL negotiation finished successfully 2020.12.21 14:49:06 LOG7[9]: Initializing application specific data for session authenticated 2020.12.21 14:49:06 LOG7[9]: New session callback 2020.12.21 14:49:06 LOG7[9]: Deallocating application specific data for session connect address 2020.12.21 14:49:06 LOG6[9]: Session id: 44E9010787EFDBC0FCA92724415AD30EF9EDB626D734D894061606C79CD26402 2020.12.21 14:49:06 LOG7[9]: TLS state (connect): SSLv3/TLS read server session ticket 2020.12.21 14:49:06 LOG6[9]: Read socket closed (readsocket) 2020.12.21 14:49:06 LOG7[9]: Sending close_notify alert 2020.12.21 14:49:06 LOG7[9]: TLS alert (write): warning: close notify 2020.12.21 14:49:06 LOG6[9]: SSL_shutdown successfully sent close_notify alert 2020.12.21 14:49:06 LOG3[9]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing 2020.12.21 14:49:06 LOG7[9]: FD=2464 ifds=r-x ofds=--- 2020.12.21 14:49:06 LOG7[9]: FD=2788 ifds=--x ofds=--- 2020.12.21 14:49:06 LOG5[9]: Connection closed: 64 byte(s) sent to TLS, 108 byte(s) sent to socket 2020.12.21 14:49:06 LOG7[9]: Remote descriptor (FD=2464) closed 2020.12.21 14:49:06 LOG7[9]: Local descriptor (FD=2788) closed 2020.12.21 14:49:06 LOG7[9]: Service [SLNP pem file] finished (0 left) My stunnel conf: debug = 7 output = stunnel.log fips = no options = NO_SSLv2 [SLNP pem file] key = SLNP_urmsand01_new.pem cert = SLNP_urmsand01_new.pem client = yes accept = 8003 connect = host:6443 TIMEOUTbusy = 30 TIMEOUTclose = 0 TIMEOUTconnect = 60 TIMEOUTidle = 86400 With the old stunnel(5.14) it doesn’t happen. Thanks, Ditty.

1 0

Stunnel 4 failing to connect to gmail
by Asif Iqbal 11 Dec '20

11 Dec '20

I am faling to connect to gmail. Not sure what that bind error means. iqbala@ghar:~$ sudo stunnel4 2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes from /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes to /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims sufficient entropy for the PRNG 2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for service ssmtp 2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE limit for file descriptors 2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on accept socket 2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to 74.125.93.111:587 2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign requested address (99) Here is how my conf file looks like iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$" cert = /etc/stunnel/stunnel.pem foreground = yes sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [ssmtp] accept = smtp.gmail.com:587 connect = 25 Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

5 9

EHLO localhost causing problem in smtp-relay.gmail.com
by sreyas-n＠hcl.com 11 Dec '20

11 Dec '20

We note that always EHLO command sent by sTunnel to SMTP server always been populated as "localhost". Note some well know SMTP server (or) SMTP relay servers such as smtp-relay.gmail.com, etc reject further communication with SMTP clients (as here sTunnel), if they receive initial handshake EHLO request itself as LOCALHOST. Please refer this link on why SMTP servers/ relay servers reject EHLO command with LOCALHOST - https://support.google.com/a/answer/2956491. Note because of this reason, we could use sTunnel as our encryption channel to communicate with SMTP server/relay server. Is there any specific reason behind in hardcoding the EHLO command with LOCALHOST always even in latest version of sTunnel - 5.57 version..? Always what would be in sTunnel functionality, if we change the EHLO command to populate as hostname (or) FQDN instead.

1 0

EHLO localhost
by sreyas-n＠hcl.com 11 Dec '20

11 Dec '20

We note that always EHLO command sent by sTunnel to SMTP server always been populated as "localhost". Note some well know SMTP server (or) SMTP relay servers such as smtp-relay.gmail.com, etc reject further communication with SMTP clients (as here sTunnel), if they receive initial handshake EHLO request itself as LOCALHOST. Please refer this link on why SMTP servers/ relay servers reject EHLO command with LOCALHOST - https://support.google.com/a/answer/2956491. Note because of this reason, we could use sTunnel as our encryption channel to communicate with SMTP server/relay server. Is there any specific reason behind in hardcoding the EHLO command with LOCALHOST always even in latest version of sTunnel - 5.57 version..? Always what would be in sTunnel functionality, if we change the EHLO command to populate as hostname (or) FQDN instead.

1 0

Segmentation fault on the stunnel 5.57 running on RHEL7
by paulrbk＠gmail.com 11 Dec '20

11 Dec '20

Hi All we have a segmentation fault on the stunnel 5.57 running on RHEL7 Dec 10 16:54:32 prod001 kernel: stunnel[1572]: segfault at 278 ip 00007f3fdca229c2 sp 00007f3fd9011a28 error 6 in libssl.so.1.0.2k[7f3fdc9da000+67000] $ uname -a Linux prod001 3.10.0-1160.2.1.el7.x86_64 #1 SMP Mon Sep 21 21:00:09 EDT 2020 x86_64 x86_64 x86_64 GNU/Linux $ rpm -qa|grep openssl openssl-devel-1.0.2k-19.el7.x86_64 xmlsec1-openssl-1.2.20-7.el7_4.x86_64 openssl-1.0.2k-19.el7.x86_64 openssl-libs-1.0.2k-19.el7.x86_64 below is the configuration =================================== pid = /home/admin/run/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 #debug = 2 debug = 7 output = /home/admin/log/stunnel.log ######################################################## ### ### INSTANCE 1: program1 ### ### Tunnel for remote connection (Server_aaS) ### [program1-remote-to-local] cert = /home/admin/config/certs/prod001.crt key = /home/admin/config/certs/prod001.key accept = 192.168.1.33:7011 connect = 192.168.1.33:7001 ### Tunnel for local connection ### [program1-local-to-local] client = yes CAfile = /home/admin/config/certs/prod001.crt accept = 127.0.0.1:7011 connect = 192.168.1.33:7011 ### Tunnel to connect remote Tunnel ### SERVER-02 192.168.1.34:7021 ### [program1-01-to-02] client = yes CAfile = /home/admin/config/certs/prod002.crt accept = 192.168.1.33:7021 connect = 192.168.1.34:7021 ========================================== $ ./stunnel -help Initializing inetd mode configuration stunnel 5.57 on x86_64-pc-linux-gnu platform Compiled/running with OpenSSL 1.0.2k-fips 26 Jan 2017 Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI Global options: chroot = directory to chroot stunnel process compression = compression type EGD = path to Entropy Gathering Daemon socket engine = auto|engine_id engineCtrl = cmd[:arg] engineDefault = TASK_LIST fips = yes|no FIPS 140-2 mode foreground = yes|quiet|no foreground mode (don't fork, log to stderr) log = append|overwrite log file output = file to append log messages pid = pid file RNDbytes = bytes to read from random seed files RNDfile = path to file with random seed data RNDoverwrite = yes|no overwrite seed datafiles with new random data syslog = yes|no send logging messages to syslog Service-level options: accept = [host:]port accept connections on specified host:port CApath = CA certificate directory for 'verify' option CAfile = CA certificate file for 'verify' option cert = certificate chain checkEmail = peer certificate email address checkHost = peer certificate host name pattern checkIP = peer certificate IP address ciphers = permitted ciphers for TLS 1.2 or older client = yes|no client mode (remote service uses TLS) config = command[:parameter] to execute connect = [host:]port to connect CRLpath = CRL directory CRLfile = CRL file curves = ECDH curve names debug = [facility].level (e.g. daemon.info) delay = yes|no delay DNS lookup for 'connect' option engineId = ID of engine to read the key from engineNum = number of engine to read the key from exec = file execute local inetd-type program execArgs = arguments for 'exec' (including $0) failover = rr|prio failover strategy ident = username for IDENT (RFC 1413) checking include = directory with configuration file snippets key = certificate private key local = IP address to be used as source for remote connections logId = connection identifier type OCSP = OCSP responder URL OCSPaia = yes|no check the AIA responders from certificates OCSPflag = OCSP responder flags OCSPnonce = yes|no send and verify the OCSP nonce extension options = TLS option to set/reset protocol = protocol to negotiate before TLS initialization currently supported: cifs, connect, imap, nntp, pgsql, pop3, proxy, smtp, socks protocolAuthentication = authentication type for protocol negotiations protocolDomain = domain for protocol negotiations protocolHost = host:port for protocol negotiations protocolPassword = password for protocol negotiations protocolUsername = username for protocol negotiations PSKidentity = identity for PSK authentication PSKsecrets = secrets for PSK authentication pty = yes|no allocate pseudo terminal for 'exec' option redirect = [host:]port to redirect on authentication failures renegotiation = yes|no support renegotiation requireCert = yes|no require client certificate reset = yes|no send TCP RST on error retry = yes|no retry connect+exec section service = service name setgid = groupname for setgid() setuid = username for setuid() sessionCacheSize = session cache size sessionCacheTimeout = session cache timeout (in seconds) sessiond = [host:]port use sessiond at host:port sni = master_service:host_name for an SNI virtual service socket = a|l|r:option=value[:value] set an option on accept/local/remote socket sslVersion = all|SSLv2|SSLv3|TLSv1|TLSv1.1|TLSv1.2 TLS method stack = thread stack size (in bytes) ticketKeySecret = secret key for encryption/decryption TLSv1.3 tickets ticketMacSecret = key for HMAC operations on TLSv1.3 tickets TIMEOUTbusy = seconds to wait for expected data TIMEOUTclose = seconds to wait for close_notify TIMEOUTconnect = seconds to connect remote host TIMEOUTidle = seconds to keep an idle connection transparent = none|source|destination|both transparent proxy mode verify = level of peer certificate verification verifyChain = yes|no verify certificate chain verifyPeer = yes|no verify peer certificate

1 0

Stunnel and CAPI engine: Issues after OpenSSL upgrade on server side
by Brent Kimberley 10 Dec '20

10 Dec '20

It looks like IBM might have been able to get MS CAPI to work with TLS1.2. That said, I think it would make more sense to switch to CNG API.

2 2

Cannot connect using PKI
by Greg Sanders 09 Dec '20

09 Dec '20

Hello, we have been connecting to a test API site where we specified a PEM cert saved locally, and succeeded. I believe this is the 'certificate pinning' approach. Now we are transitioning to the production API, where the tech documentation says there is no certificate needed, "the certificate is sent during the handshake". So a PKI client connection, I guess. But we can't connect. Any suggestions would be appreciated. Our stunnel config is below. Thanks. STUNNEL CONFIG FILE: debug = 7 output = stunnel.log sslVersion = all options = NO_SSLv2 ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-AES256-GCM [ice_client] client = yes accept = 127.0.0.1:8080 connect = 63.nnn.nnn.207:443 checkHost = *.xxxxx.com CAfile = ca-certs.pem ; CAPath = certs verifyChain = yes -- Greg Sanders Database Architect Yes Energy

1 0

Stunnel and CAPI engine: Issues after OpenSSL upgrade on server side
by Christian Keck 07 Dec '20

07 Dec '20

Hi there, we just upgraded a system that is used as a TLS-proxy for incoming connections using client-ssl-handshake from an old CentOS 6 to a recent Ubuntu LTS. By doing so, the OpenSSL was updated from 1.0.1e to 1.1.1f. Right after installation, the new OpenSSL complained about "too weak ca cypher", so I had to add a line "CipherString = DEFAULT:@SECLEVEL=1" to the openssl.conf to make things work again. After applying the changes, connections via browsers do work again using TLS 1.3. (We will generate a new host-CA some day, but for now we need a running system) Before the upgrade, Stunnel in CAPI-mode worked wih TLS 1.2 encryption. Now after updating the server, it refused to connect at all. Using version 5.56 of Stunnel, I see the following lines in the log: error queue: ssl/statem/statem_lib.c:298: error:141F0006:SSL routines:tls_construct_cert_verify:EVP lib SSL_connect: engines/e_capi.c:814: error:8006F074:lib(128):capi_rsa_priv_enc:function not supported If I nail the protocol setting to TLS1.1 in the apache2-config, the connection is possible again with version 5.56. Any later versions of Stunnel completely refuse to work, I always get lines like: SSL_read: ssl/ssl_rsa.c:36: error:140C618E:SSL routines:SSL_use_certificate:ca md too weak I tried several things I found in the net regarding tweaking openssl.conf and/or stunnel.conf, but I can't get it running with version 5.57 or later. So my questions is: What can I do to get Stunnel working again with at least TLS1.2 (or even better TLS1.3 like I get in most browsers)? Re-generating the host-CA (and thus needing to re-create all client certs) is unfortunately no option for the moment. Many thanks in advance! Cheers, Christian Keck

3 4

Failed to initialize TLS
by Campbell, David 20 Nov '20

20 Nov '20

TLS is not initializing. This is the output. Is there something that I should be including in my conf that would produce this? Or is it just a generic error? [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [ ] No limit detected for the number of clients [ ] stunnel 5.57 on x64-pc-mingw32-gnu platform [ ] Compiled/running with OpenSSL 1.1.1h 22 Sep 2020 [ ] Threading WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] GUI message loop initialized [ ] Initializing inetd mode configuration [ ] Running on Windows 6.2 [ . ] Reading configuration from file stunnel.conf [ . ] UTF-8 byte order mark not detected [ ! ] No compression method is available [ ! ] Global options: Failed to initialize TLS [ ! ] Configuration failed [ ] Deallocating temporary section defaults [ ! ] Server is down ________________________________ CONFIDENTIALITY NOTICE: This email constitutes an electronic communication within the meaning of the Electronic Communications Privacy Act, 18 U.S.C. 2510, and its disclosure is strictly limited to the named recipient(s) intended by the sender of this message. This email, and any attachments, may contain confidential and/or proprietary information of Scientific Research Corporation. If you are not a named recipient, any copying, using, disclosing or distributing to others the information in this email and attachments is STRICTLY PROHIBITED. If you have received this email in error, please notify the sender immediately and permanently delete the email, any attachments, and all copies thereof from any drives or storage media and destroy any printouts or hard copies of the email and attachments. EXPORT COMPLIANCE NOTICE: This email and any attachments may contain technical data subject to U.S export restrictions under the International Traffic in Arms Regulations (ITAR) or the Export Administration Regulations (EAR). Export or transfer of this technical data and/or related information to any foreign person(s) or entity(ies), either within the U.S. or outside of the U.S., may require advance export authorization by the appropriate U.S. Government agency prior to export or transfer. In addition, technical data may not be exported or transferred to certain countries or specified designated nationals identified by U.S. embargo controls without prior export authorization. By accepting this email and any attachments, all recipients confirm that they understand and will comply with all applicable ITAR, EAR and embargo compliance requirements.

1 0

PSK Configuration
by Giulio Regazzo 16 Nov '20

16 Nov '20

Hi, I'm new to stunnel. And I'm trying to configure a server that accepts TCP sockets connections only from clients that have a pre-shared certificate. Looking at the online documentation I found the verifyPeer option, but it is described to be used on client side. Trying to use it on server side I achieved my goal but only if the client has the whole certificate (private + public). My question is: Can I obtain in some way the same result sharing only the public part of the certificate? Currently I'm using a configuration like this one (skipping the accept and connect options): [Server] cert=wholeCert.pem verifyPeer=yes [Client] cert=wholeCert.pem verifyPeer=yes CAFile=wholeCert.pem and I'm looking for something like: [Server] cert=wholeCert.pem verifyPeer=yes [Client] verifyPeer=yes CAFile=publicCert.pem If I try this second option the server refuses the connection in handshake phase saying that the client didn't provide any certificate. Is there a way to achieve this? Thank you.

2 3

hi
by fieldengineer59＠yahoo.com 04 Nov '20

04 Nov '20

hi

1 0

hi
by fieldengineer59＠yahoo.com 04 Nov '20

04 Nov '20

hi

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users