- stunnel-users - stunnel.org

100 percent CPU usage
by asdf 17 Oct '15

17 Oct '15

Dear subscribers I am new to this so I dont know if this is just wrong configuration (that does not trigger an error message). Searching on the web for the following problem shows someone reporting sth similar on a Linux machine. I am using the newest version of stunnel (5.24) on Windows 7 and there is an stunnel thread starting that takes 100% of one core forever. I have attached a ProcMon trace with activated Registry/Filesystem/Network/Process events. The thread starts at 22:03:55 (which is 30 seconds after stunnel-start and at a time at which I did not use stunnel). The events after that follow that event are my pressing exit. Attachements: stunnel config, procMon-trace Thank you! Ben [myEmailIn] client = yes accept = 127.0.0.1:180 connect = imap.gmx.net:993 verify = 2 CAfile = ca-certs.pem checkHost = mail.gmx.net [myEmailOut] client = yes accept = 127.0.0.1:181 connect = mail.gmx.net:465 verify = 2 CAfile = ca-certs.pem checkHost = mail.gmx.net ; ***************************************** Example TLS server mode services [myServer] accept = 9999 connect = 7777 cert = stunnel.pem

1 0

Question about "forground = yes" and "output = FILE" combined options
by Michael Gebis 16 Oct '15

16 Oct '15

Hello. I have a question about the combination of the "foreground = yes" option combined with the "output = FILE" option. The man page says this: foreground = yes | no (Unix only) foreground mode Stay in foreground (don’t fork) and log to stderr instead of via syslog (unless output is specified). This implies that if you set both "foreground = yes" and "output = FILE", the log messages will not be sent to stderr and will instead be sent to the log file only. We'd like this behavior--it makes it easier for our scripts to distinguish startup errors parsing the config file (which are sent to stderr, since the log file isn't configured yet) vs. normal operation after the config file is parsed and the log file is established. However, it appears that if you specify "foreground = yes" and "output = FILE", log messages will go to *both* stderr and the output file. I guess I'm asking: is the documentation in conflict with the behavior, and if so, which is correct? It's possible I'm just misreading the man page. But in any case, here is a simple patch which changes the behavior to match our reading of the man page. It is against stunnel-5.22 but I believe it should be applicable to later versions as well. Thank you, Michael diff -ru stunnel-5.22.orig/src/log.c stunnel-5.22-foreground-outfile/src/log.c --- stunnel-5.22.orig/src/log.c 2015-06-16 06:16:35.000000000 -0700 +++ stunnel-5.22-foreground-outfile/src/log.c 2015-10-14 11:54:58.998254974 -0700 @@ -243,7 +243,8 @@ level<=opt->log_level #else (level<=opt->log_level && - global_options.option.foreground) + global_options.option.foreground && + !outfile) #endif ) ui_new_log(line);

3 7

Can stunnel do this and if so, how?
by Jason Lacoss-Arnold 15 Oct '15

15 Oct '15

I have a client and a server where the client isn't very good and the server requires a MASSL (Mutual Auth SSL aka client certificate authenticated) connection. I need to get one of two things to work. Either: 1) The client makes a non-SSL connection to stunnel on the local machine which then performs a MASSL connection to the server using a client certificate or 2) The client makes a plain SSL connection to stunnel on the local machine which then performs a MASSL connection to the server using a client certificate. Can stunnel be used in this manner? If so, would someone please give me some hints on configuration? For extra credit, it would be awesome if the client private key were stored in a pkcs11 device (HSM). Thank you, --Jason

1 0

Unable to authenticate with Outlook.com servers (SMTP)
by Aerowinder 15 Oct '15

15 Oct '15

Greetings, Running stunnel 5.25 latest beta (2015-10-15), but also had the same issues on 5.24 final. My config file looks like this: debug = debug output = xxxxx client = yes cert = stunnel.pem [outlook-smtp] accept = 127.0.0.1:25 connect = smtp-mail.outlook.com:587 protocol = smtp ;protocolUsername = xxxx ;protocolPassword = xxxx CAfile = ca-certs.pem checkHost = smtp-mail.outlook.com OCSPaia = yes verify = 2 I am testing functionality to make sure that I am able to send mail with my Outlook.com address. I currently have User/Pass field commented out, but I've tried with them not commented out, and the actual values instead of "xxxx" (the app I'm using has fields for username and password). My log: 2015.10.15 11:01:24 LOG7[cron]: Cron started 2015.10.15 11:01:24 LOG7[main]: No limit detected for the number of clients 2015.10.15 11:01:24 LOG5[main]: stunnel 5.25 on x86-pc-msvc-1500 platform 2015.10.15 11:01:24 LOG5[main]: Compiled/running with OpenSSL 1.0.2d-fips 9 Jul 2015 2015.10.15 11:01:24 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2015.10.15 11:01:24 LOG7[main]: errno: (*_errno()) 2015.10.15 11:01:24 LOG7[ui]: GUI message loop initialized 2015.10.15 11:01:24 LOG5[main]: Reading configuration from file stunnel.conf 2015.10.15 11:01:24 LOG5[main]: UTF-8 byte order mark detected 2015.10.15 11:01:24 LOG5[main]: FIPS mode disabled 2015.10.15 11:01:24 LOG7[main]: Compression disabled 2015.10.15 11:01:24 LOG7[main]: PRNG seeded successfully 2015.10.15 11:01:24 LOG6[main]: Initializing service [outlook-smtp] 2015.10.15 11:01:24 LOG6[main]: Loading certificate from file: stunnel.pem 2015.10.15 11:01:24 LOG6[main]: Loading key from file: stunnel.pem 2015.10.15 11:01:24 LOG7[main]: Private key check succeeded 2015.10.15 11:01:24 LOG7[main]: SSL options: 0x03000004 (+0x03000000, -0x00000000) 2015.10.15 11:01:24 LOG5[main]: Configuration successful 2015.10.15 11:01:24 LOG7[main]: Listening file descriptor created (FD=652) 2015.10.15 11:01:24 LOG7[main]: Service [outlook-smtp] (FD=652) bound to 127.0.0.1:25 2015.10.15 11:01:31 LOG7[main]: Found 1 ready file descriptor(s) 2015.10.15 11:01:31 LOG7[main]: FD=408 ifds=r-x ofds=--- 2015.10.15 11:01:31 LOG7[main]: Service [outlook-smtp] accepted (FD=692) from 127.0.0.1:58065 2015.10.15 11:01:31 LOG7[main]: Creating a new thread 2015.10.15 11:01:31 LOG7[main]: New thread created 2015.10.15 11:01:31 LOG7[0]: Service [outlook-smtp] started 2015.10.15 11:01:31 LOG5[0]: Service [outlook-smtp] accepted connection from 127.0.0.1:58065 2015.10.15 11:01:31 LOG6[0]: s_connect: connecting 65.55.176.126:587 2015.10.15 11:01:31 LOG7[0]: s_connect: s_poll_wait 65.55.176.126:587: waiting 10 seconds 2015.10.15 11:01:31 LOG5[0]: s_connect: connected 65.55.176.126:587 2015.10.15 11:01:31 LOG5[0]: Service [outlook-smtp] connected remote server from 172.26.1.51:58066 2015.10.15 11:01:31 LOG7[0]: Remote descriptor (FD=704) initialized 2015.10.15 11:01:31 LOG7[0]: <- 220 BLU436-SMTP245.smtp.hotmail.com Microsoft ESMTP MAIL Service, Version: 8.0.9200.16384 ready at Thu, 15 Oct 2015 08:01:34 -0700 2015.10.15 11:01:31 LOG7[0]: -> 220 BLU436-SMTP245.smtp.hotmail.com Microsoft ESMTP MAIL Service, Version: 8.0.9200.16384 ready at Thu, 15 Oct 2015 08:01:34 -0700 2015.10.15 11:01:31 LOG7[0]: -> EHLO localhost 2015.10.15 11:01:31 LOG7[0]: <- 250-BLU436-SMTP245.smtp.hotmail.com Hello [70.90.151.129] 2015.10.15 11:01:31 LOG7[0]: <- 250-TURN 2015.10.15 11:01:31 LOG7[0]: <- 250-SIZE 41943040 2015.10.15 11:01:31 LOG7[0]: <- 250-ETRN 2015.10.15 11:01:31 LOG7[0]: <- 250-PIPELINING 2015.10.15 11:01:31 LOG7[0]: <- 250-DSN 2015.10.15 11:01:31 LOG7[0]: <- 250-ENHANCEDSTATUSCODES 2015.10.15 11:01:31 LOG7[0]: <- 250-8bitmime 2015.10.15 11:01:31 LOG7[0]: <- 250-BINARYMIME 2015.10.15 11:01:31 LOG7[0]: <- 250-CHUNKING 2015.10.15 11:01:31 LOG7[0]: <- 250-VRFY 2015.10.15 11:01:31 LOG7[0]: <- 250-TLS 2015.10.15 11:01:31 LOG7[0]: <- 250-STARTTLS 2015.10.15 11:01:31 LOG7[0]: <- 250 OK 2015.10.15 11:01:31 LOG7[0]: -> STARTTLS 2015.10.15 11:01:31 LOG7[0]: <- 220 2.0.0 SMTP server ready 2015.10.15 11:01:31 LOG6[0]: SNI: sending servername: smtp-mail.outlook.com 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): before/connect initialization 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv2/v3 write client hello A 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 read server hello A 2015.10.15 11:01:31 LOG7[0]: Verification started at depth=2: C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA 2015.10.15 11:01:31 LOG7[0]: CERT: Pre-verification succeeded 2015.10.15 11:01:31 LOG7[0]: OCSP: Ignoring root certificate 2015.10.15 11:01:31 LOG6[0]: Certificate accepted at depth=2: C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign Root CA 2015.10.15 11:01:31 LOG7[0]: Verification started at depth=1: C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - G2 2015.10.15 11:01:31 LOG7[0]: CERT: Pre-verification succeeded 2015.10.15 11:01:31 LOG5[0]: OCSP: Connecting the AIA responder "http://ocsp.globalsign.com/rootr1" 2015.10.15 11:01:31 LOG6[0]: s_connect: connecting 108.162.232.204:80 2015.10.15 11:01:31 LOG7[0]: s_connect: s_poll_wait 108.162.232.204:80: waiting 10 seconds 2015.10.15 11:01:31 LOG5[0]: s_connect: connected 108.162.232.204:80 2015.10.15 11:01:31 LOG7[0]: OCSP: Connected ocsp.globalsign.com:80 2015.10.15 11:01:31 LOG7[0]: OCSP: Response received 2015.10.15 11:01:31 LOG6[0]: OCSP: Status: good 2015.10.15 11:01:31 LOG6[0]: OCSP: This update: Oct 15 10:27:35 2015 GMT 2015.10.15 11:01:31 LOG6[0]: OCSP: Next update: Oct 19 10:27:35 2015 GMT 2015.10.15 11:01:31 LOG5[0]: OCSP: Certificate accepted 2015.10.15 11:01:31 LOG6[0]: Certificate accepted at depth=1: C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - G2 2015.10.15 11:01:31 LOG7[0]: Verification started at depth=0: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=*.hotmail.com 2015.10.15 11:01:31 LOG7[0]: CERT: Pre-verification succeeded 2015.10.15 11:01:31 LOG6[0]: CERT: Host name "smtp-mail.outlook.com" matched with "*.outlook.com" 2015.10.15 11:01:31 LOG5[0]: OCSP: Connecting the AIA responder "http://ocsp2.globalsign.com/gsorganizationvalg2" 2015.10.15 11:01:31 LOG6[0]: s_connect: connecting 108.162.232.196:80 2015.10.15 11:01:31 LOG7[0]: s_connect: s_poll_wait 108.162.232.196:80: waiting 10 seconds 2015.10.15 11:01:31 LOG5[0]: s_connect: connected 108.162.232.196:80 2015.10.15 11:01:31 LOG7[0]: OCSP: Connected ocsp2.globalsign.com:80 2015.10.15 11:01:31 LOG7[0]: OCSP: Response received 2015.10.15 11:01:31 LOG6[0]: OCSP: Status: good 2015.10.15 11:01:31 LOG6[0]: OCSP: This update: Oct 15 08:26:15 2015 GMT 2015.10.15 11:01:31 LOG6[0]: OCSP: Next update: Oct 16 08:26:15 2015 GMT 2015.10.15 11:01:31 LOG5[0]: OCSP: Certificate accepted 2015.10.15 11:01:31 LOG5[0]: Certificate accepted at depth=0: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=*.hotmail.com 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 read server certificate A 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 read server key exchange A 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 read server done A 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 write client key exchange A 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 write change cipher spec A 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 write finished A 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 flush data 2015.10.15 11:01:31 LOG7[0]: SSL state (connect): SSLv3 read finished A 2015.10.15 11:01:31 LOG7[0]: 1 client connect(s) requested 2015.10.15 11:01:31 LOG7[0]: 1 client connect(s) succeeded 2015.10.15 11:01:31 LOG7[0]: 0 client renegotiation(s) requested 2015.10.15 11:01:31 LOG7[0]: 0 session reuse(s) 2015.10.15 11:01:31 LOG6[0]: SSL connected: new session negotiated 2015.10.15 11:01:31 LOG7[0]: Peer certificate was cached (3461 bytes) 2015.10.15 11:01:31 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-SHA384 (256-bit encryption) 2015.10.15 11:01:31 LOG7[0]: Compression: null, expansion: null 2015.10.15 11:01:31 LOG6[0]: SSL socket closed (SSL_read) 2015.10.15 11:01:31 LOG7[0]: Sent socket write shutdown 2015.10.15 11:01:31 LOG5[0]: Connection closed: 139 byte(s) sent to SSL, 351 byte(s) sent to socket 2015.10.15 11:01:31 LOG7[0]: Remote descriptor (FD=704) closed 2015.10.15 11:01:31 LOG7[0]: Local descriptor (FD=692) closed 2015.10.15 11:01:31 LOG7[0]: Service [outlook-smtp] finished (0 left) I don't see any errors in the log, but Outlook is reporting an incorrect password on the security section of my Microsoft Account. More specifically, I'm seeing error 5.7.3: Requested action aborted, user not authenticated," I know the password works because I set it up as an account in Outlook 2010 and tested sending the email. It works great. I am using 2FA with an app-specific password. But I have also tried without 2FA. I am 100% certain the account name xxxx(a)outlook.com and the password are correct. As far as the config file goes, I've tried just about everything I could find on Google. Nothing works, always the same error message. I also experienced similar failures with Gmail. Any ideas?

2 1

prng_init failure
by Philip Craig 15 Oct '15

15 Oct '15

prng_init() is failing in 5.24 when cross-compiling with openssl due to a combination of two reasons: 1. The --with-random configure option is not supported when cross compiling. 2. The hardcoded /dev/urandom is no longer used if OPENSSL_NO_EGD is not defined. The following patch reverts the behaviour to how it was in 5.23, but probably the --with-random configure option should be supported too. --- stunnel-5.25.orig/src/ssl.c +++ stunnel-5.25/src/ssl.c @@ -207,7 +207,8 @@ NOEXPORT int prng_init(GLOBAL_OPTIONS *g return 0; /* success */ } s_log(LOG_DEBUG, "RAND_screen failed to sufficiently seed PRNG"); -#elif !defined(OPENSSL_NO_EGD) +#else +#ifndef OPENSSL_NO_EGD if(global->egd_sock) { if((bytes=RAND_egd(global->egd_sock))==-1) { s_log(LOG_WARNING, "EGD Socket %s failed", global->egd_sock); @@ -220,7 +221,7 @@ NOEXPORT int prng_init(GLOBAL_OPTIONS *g so no need to check if seeded sufficiently */ } } -#else +#endif /* try the good-old default /dev/urandom, if available */ totbytes+=add_rand_file(global, "/dev/urandom"); if(RAND_status())

2 1

[PATCH] only use aysnc-signal-safe functions after fork
by Philip Craig 15 Oct '15

15 Oct '15

POSIX requires that multi-threaded processes only use async-signal-safe functions after calling fork(). For more info on the problems this avoids, see the rationale at: http://pubs.opengroup.org/onlinepubs/9699919799/functions/pthread_atfork.ht… The specific problem this patch solves is that, when there are multiple simultaneous requests, stunnel is often hanging on a futex syscall when a child process calls free as a result of tls_alloc(). This problem is experienced when using uClibc. I haven't tested, but I believe the malloc implementation in glibc does not have this problem. --- stunnel-5.24.orig/src/client.c +++ stunnel-5.24/src/client.c @@ -1100,6 +1100,8 @@ NOEXPORT SOCKET connect_local(CLI *c) { NOEXPORT SOCKET connect_local(CLI *c) { /* spawn local process */ char *name, host[40], port[6]; + char *env[10]; + int i, envc; int fd[2], pid; X509 *peer_cert; #ifdef HAVE_PTHREAD_SIGMASK @@ -1115,19 +1117,55 @@ NOEXPORT SOCKET connect_local(CLI *c) { } else if(make_sockets(fd)) longjmp(c->err, 1); + set_nonblock(fd[1], 0); /* switch back to blocking mode */ + + envc = 0; + + if(!getnameinfo(&c->peer_addr.sa, c->peer_addr_len, + host, 40, port, 6, NI_NUMERICHOST|NI_NUMERICSERV)) { + /* just don't set these variables if getnameinfo() fails */ + env[envc++] = str_printf("REMOTE_HOST=%s", host); + env[envc++] = str_printf("REMOTE_PORT=%s", port); + if(c->opt->option.transparent_src) { +#ifndef LIBDIR +#define LIBDIR "." +#endif +#ifdef MACH64 + env[envc++] = str_dup("LD_PRELOAD_32=" LIBDIR "/libstunnel.so"); + env[envc++] = str_dup("LD_PRELOAD_64=" LIBDIR "/" MACH64 "/libstunnel.so"); +#elif __osf /* for Tru64 _RLD_LIST is used instead */ + env[envc++] = str_dup("_RLD_LIST=" LIBDIR "/libstunnel.so:DEFAULT"); +#else + env[envc++] = str_dup("LD_PRELOAD=" LIBDIR "/libstunnel.so"); +#endif + } + } + + if(c->ssl) { + peer_cert=SSL_get_peer_certificate(c->ssl); + if(peer_cert) { + name=X509_NAME2text(X509_get_subject_name(peer_cert)); + env[envc++] = str_printf("SSL_CLIENT_DN=%s", name); + name=X509_NAME2text(X509_get_issuer_name(peer_cert)); + env[envc++] = str_printf("SSL_CLIENT_I_DN=%s", name); + X509_free(peer_cert); + } + } + + env[envc] = NULL; pid=fork(); c->pid=(unsigned long)pid; switch(pid) { case -1: /* error */ + for (i = 0; i < envc; i++) + str_free(env[i]); closesocket(fd[0]); closesocket(fd[1]); ioerror("fork"); longjmp(c->err, 1); case 0: /* child */ - tls_alloc(NULL, c->tls, NULL); /* reuse thread-local storage */ closesocket(fd[0]); - set_nonblock(fd[1], 0); /* switch back to blocking mode */ /* dup2() does not copy FD_CLOEXEC flag */ dup2(fd[1], 0); dup2(fd[1], 1); @@ -1135,36 +1173,6 @@ NOEXPORT SOCKET connect_local(CLI *c) { dup2(fd[1], 2); closesocket(fd[1]); /* not really needed due to FD_CLOEXEC */ - if(!getnameinfo(&c->peer_addr.sa, c->peer_addr_len, - host, 40, port, 6, NI_NUMERICHOST|NI_NUMERICSERV)) { - /* just don't set these variables if getnameinfo() fails */ - putenv(str_printf("REMOTE_HOST=%s", host)); - putenv(str_printf("REMOTE_PORT=%s", port)); - if(c->opt->option.transparent_src) { -#ifndef LIBDIR -#define LIBDIR "." -#endif -#ifdef MACH64 - putenv("LD_PRELOAD_32=" LIBDIR "/libstunnel.so"); - putenv("LD_PRELOAD_64=" LIBDIR "/" MACH64 "/libstunnel.so"); -#elif __osf /* for Tru64 _RLD_LIST is used instead */ - putenv("_RLD_LIST=" LIBDIR "/libstunnel.so:DEFAULT"); -#else - putenv("LD_PRELOAD=" LIBDIR "/libstunnel.so"); -#endif - } - } - - if(c->ssl) { - peer_cert=SSL_get_peer_certificate(c->ssl); - if(peer_cert) { - name=X509_NAME2text(X509_get_subject_name(peer_cert)); - putenv(str_printf("SSL_CLIENT_DN=%s", name)); - name=X509_NAME2text(X509_get_issuer_name(peer_cert)); - putenv(str_printf("SSL_CLIENT_I_DN=%s", name)); - X509_free(peer_cert); - } - } #ifdef HAVE_PTHREAD_SIGMASK sigemptyset(&newmask); sigprocmask(SIG_SETMASK, &newmask, NULL); @@ -1176,11 +1184,13 @@ NOEXPORT SOCKET connect_local(CLI *c) { signal(SIGTERM, SIG_DFL); signal(SIGQUIT, SIG_DFL); signal(SIGINT, SIG_DFL); - execvp(c->opt->exec_name, c->opt->exec_args); + execve(c->opt->exec_name, c->opt->exec_args, env); ioerror(c->opt->exec_name); /* execvp failed */ _exit(1); default: /* parent */ s_log(LOG_INFO, "Local mode child started (PID=%lu)", c->pid); + for (i = 0; i < envc; i++) + str_free(env[i]); closesocket(fd[1]); return fd[0]; }

2 2

Re: [stunnel-users] (no subject)
by Adrián Mihálko 10 Oct '15

10 Oct '15

Some good news, I remove client = yes as you suggested: 2015.10.09 12:39:29 LOG5[main]: Configuration successful 2015.10.09 12:39:29 LOG5[main]: Logging to C:\Users\adrianmihalko\AppData\Local\stunnel.log 2015.10.09 12:39:34 LOG6[57]: SSL socket closed (SSL_read) 2015.10.09 12:39:34 LOG5[57]: Connection closed: 0 byte(s) sent to SSL, 445 byte(s) sent to socket 2015.10.09 12:39:34 LOG5[60]: Service [myservice] accepted connection from 192.168.1.25:49671 2015.10.09 12:39:34 LOG6[60]: SSL accepted: new session negotiated 2015.10.09 12:39:34 LOG6[60]: No peer certificate received 2015.10.09 12:39:34 LOG6[60]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES128-GCM-SHA256 (128-bit encryption) 2015.10.09 12:39:34 LOG6[60]: failover: round-robin, starting at entry #0 2015.10.09 12:39:34 LOG6[60]: s_connect: connecting ::1:41952 2015.10.09 12:39:34 LOG5[60]: s_connect: connected ::1:41952 2015.10.09 12:39:34 LOG6[60]: persistence: ::1:41952 cached 2015.10.09 12:39:34 LOG5[60]: Service [myservice] connected remote server from ::1:50598 2015.10.09 12:39:34 LOG6[60]: SSL socket closed (SSL_read) 2015.10.09 12:39:34 LOG5[60]: Connection closed: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2015.10.09 12:39:34 LOG5[61]: Service [myservice] accepted connection from 192.168.1.25:49672 2015.10.09 12:39:34 LOG6[61]: SSL accepted: new session negotiated 2015.10.09 12:39:34 LOG6[61]: No peer certificate received 2015.10.09 12:39:34 LOG6[61]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES128-GCM-SHA256 (128-bit encryption) 2015.10.09 12:39:34 LOG6[61]: failover: round-robin, starting at entry #1 2015.10.09 12:39:34 LOG6[61]: s_connect: connecting 127.0.0.1:41952 2015.10.09 12:39:34 LOG5[61]: s_connect: connected 127.0.0.1:41952 2015.10.09 12:39:34 LOG6[61]: persistence: 127.0.0.1:41952 cached 2015.10.09 12:39:34 LOG5[61]: Service [myservice] connected remote server from 127.0.0.1:50599 openssl_client log: http://pastebin.com/7bg3sf7J The problem is now that the site loads forever, nothing happens. (this certificate (:1988) is other than the original (:41952). This is not problem? curl test: $ curl https://192.168.1.17:1988/DYMO/DLS/Printing/Check -vk * Trying 192.168.1.17... * Connected to 192.168.1.17 (192.168.1.17) port 1988 (#0) * TLS 1.2 connection using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 * Server certificate: localhost > GET /DYMO/DLS/Printing/Check HTTP/1.1 > Host: 192.168.1.17:1988 > User-Agent: curl/7.43.0 > Accept: */* > waiting forever. 2015-10-09 12:34 GMT+02:00 Adrián Mihálko <adriankoooo(a)gmail.com>: > In the first mail I wrote ports bad, of course in the log I am using the > good ones. > > [myservice] > cert = stunnel.pem > client = yes > accept = 0.0.0.0:1988 > connect = localhost:41952 > > > 2015-10-09 12:32 GMT+02:00 Adrián Mihálko <adriankoooo(a)gmail.com>: > >> Sorry, curl was only for testing. >> >> Adrians-MacBook-Pro:~ adrianmihalko$ openssl s_client -connect >> 192.168.1.17:1988 >> CONNECTED(00000003) >> 1130:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown >> protocol:/BuildRoot/Library/Caches/com.apple.xbs/Sources/OpenSSL098/OpenSSL098-59/src/ssl/s23_clnt.c:618: >> >> 2015.10.09 12:23:21 LOG5[main]: Reading configuration from file >> stunnel.conf >> 2015.10.09 12:23:21 LOG5[main]: UTF-8 byte order mark detected >> 2015.10.09 12:23:21 LOG5[main]: FIPS mode disabled >> 2015.10.09 12:23:21 LOG6[main]: Initializing service [gmail-pop3] >> 2015.10.09 12:23:21 LOG6[main]: Initializing service [gmail-imap] >> 2015.10.09 12:23:21 LOG6[main]: Initializing service [gmail-smtp] >> 2015.10.09 12:23:21 LOG6[main]: Initializing service [myservice] >> 2015.10.09 12:23:21 LOG6[main]: Loading certificate from file: stunnel.pem >> 2015.10.09 12:23:21 LOG6[main]: Loading key from file: stunnel.pem >> 2015.10.09 12:23:21 LOG4[main]: Service [myservice] needs authentication >> to prevent MITM attacks >> 2015.10.09 12:23:21 LOG5[main]: Configuration successful >> 2015.10.09 12:23:21 LOG5[main]: Logging to >> C:\Users\adrianmihalko\AppData\Local\stunnel.log >> 2015.10.09 12:23:42 LOG5[39]: Service [myservice] accepted connection >> from 192.168.1.25:49454 >> 2015.10.09 12:23:42 LOG6[39]: failover: round-robin, starting at entry #0 >> 2015.10.09 12:23:42 LOG6[39]: s_connect: connecting ::1:41952 >> 2015.10.09 12:23:42 LOG5[39]: s_connect: connected ::1:41952 >> 2015.10.09 12:23:42 LOG5[39]: Service [myservice] connected remote server >> from ::1:50564 >> 2015.10.09 12:23:42 LOG6[39]: SNI: sending servername: localhost >> 2015.10.09 12:23:42 LOG6[39]: Certificate verification disabled >> 2015.10.09 12:23:42 LOG6[39]: Certificate verification disabled >> 2015.10.09 12:23:42 LOG6[39]: SSL connected: new session negotiated >> 2015.10.09 12:23:42 LOG6[39]: Negotiated TLSv1 ciphersuite AES128-SHA >> (128-bit encryption) >> 2015.10.09 12:23:42 LOG6[39]: SSL socket closed (SSL_read) >> 2015.10.09 12:23:42 LOG5[39]: Connection closed: 130 byte(s) sent to SSL, >> 505 byte(s) sent to socket >> >> If I am connecting to the :41952: >> >> openssl s_client -connect 192.168.1.17:41952 >> ... >> >> --- >> No client certificate CA names sent >> --- >> SSL handshake has read 1724 bytes and written 712 bytes >> --- >> New, TLSv1/SSLv3, Cipher is AES128-SHA >> Server public key is 4096 bit >> Secure Renegotiation IS supported >> Compression: NONE >> Expansion: NONE >> SSL-Session: >> Protocol : TLSv1 >> Cipher : AES128-SHA >> ... >> >> >> 2015-10-09 10:55 GMT+02:00 test rig <testrig(a)z1p.biz>: >> >>> >>> Ouch #2 missing... >>> >>> Hi Adrian, looks good to me so far - mostly. Try to replace the >>> client=yes with a client=no on the server >>> >>> You are connection to :9999 with curl(?) >>> Try verify it via "openssl s_client -connect yourserverip:1988" command >>> >>> Best Regards >>> Michael >>> >>> --- Ursprüngliche Nachricht --- >>> *Von:* "test rig" <testrig(a)z1p.biz> >>> *Datum:* 09.10.2015 09:48:02 >>> *An:* "stunnel-users(a)stunnel.org." <stunnel-users(a)stunnel.org> >>> *Betreff:* Re: [stunnel-users] (no subject) >>> >>> Hi Adrian, looks good to me so far - mostly. Try to replace the >>> client=yes with a client=no on the server >>> >>> --- Ursprüngliche Nachricht --- >>> *Von:* Adrián Mihálko >>> *Datum:* 09.10.2015 08:15:19 >>> *An:* stunnel-users(a)stunnel.org >>> *Betreff:* [stunnel-users] (no subject) >>> >>> Dear stunnel users, >>> >>> I have a little service which listen only on https://localhost:4952 and >>> checks source hostname. I want to connect on "listen:1988" and redirect >>> requests with stunnel to "localhost:4952" >>> >>> https://192.168.1.10:1988 -> redirect https://localhost:4952 >>> >>> >>> I am trying to configure stunnel like this >>> >>> [myservice] >>> cert = stunnel.pem >>> client = yes >>> accept = 0.0.0.0:1988 >>> connect = localhost:4952 >>> >>> remote machine$ curl https://192.168.1.25:9999/DYMO/DLS/Printing/Check >>> -v >>> * Trying 192.168.1.25... >>> * Connected to 192.168.1.25 (192.168.1.25) port 9999 (#0) >>> * WARNING: using IP address, SNI is being disabled by the OS. >>> * Unknown SSL protocol error in connection to 192.168.1.25:-9847 >>> * Closing connection 0 >>> curl: (35) Unknown SSL protocol error in connection to 192.168.1.25: >>> -9847 >>> >>> stunnel.log: >>> 2015.10.09 09:05:42 LOG5[38]: Service [myservice] accepted connection >>> from 192.168.1.24:60748 >>> 2015.10.09 09:05:42 LOG6[38]: failover: round-robin, starting at entry #1 >>> 2015.10.09 09:05:42 LOG6[38]: s_connect: connecting 127.0.0.1:41952 >>> 2015.10.09 09:05:42 LOG5[38]: s_connect: connected 127.0.0.1:41952 >>> 2015.10.09 09:05:42 LOG5[38]: Service [myservice] connected remote >>> server from 127.0.0.1:50503 >>> 2015.10.09 09:05:42 LOG6[38]: SNI: sending servername: localhost >>> 2015.10.09 09:05:42 LOG6[38]: Certificate verification disabled >>> 2015.10.09 09:05:42 LOG6[38]: Certificate verification disabled >>> 2015.10.09 09:05:42 LOG6[38]: SSL connected: new session negotiated >>> 2015.10.09 09:05:42 LOG6[38]: Negotiated TLSv1 ciphersuite AES128-SHA >>> (128-bit encryption) >>> 2015.10.09 09:05:42 LOG6[38]: SSL socket closed (SSL_read) >>> 2015.10.09 09:05:42 LOG5[38]: Connection closed: 230 byte(s) sent to >>> SSL, 505 byte(s) sent to socket >>> >>> I am tried verify = 1 to 4, either works. :( >>> >>> Best Regards, >>> Adrian >>> >>> >>> >>> ______________________________________________________ >>> powered by Perfect-Privacy.com / Secure-Mail.biz - anonymous and secure >>> internet. >>> >>> >>> >>> ______________________________________________________ >>> powered by Perfect-Privacy.com / Secure-Mail.biz - anonymous and secure >>> internet. >>> >>> _______________________________________________ >>> stunnel-users mailing list >>> stunnel-users(a)stunnel.org >>> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >>> >>> >> >

3 6

(no subject)
by Adrián Mihálko 09 Oct '15

09 Oct '15

Dear stunnel users, I have a little service which listen only on https://localhost:4952 and checks source hostname. I want to connect on "listen:1988" and redirect requests with stunnel to "localhost:4952" https://192.168.1.10:1988 -> redirect https://localhost:4952 I am trying to configure stunnel like this [myservice] cert = stunnel.pem client = yes accept = 0.0.0.0:1988 connect = localhost:4952 remote machine$ curl https://192.168.1.25:9999/DYMO/DLS/Printing/Check -v * Trying 192.168.1.25... * Connected to 192.168.1.25 (192.168.1.25) port 9999 (#0) * WARNING: using IP address, SNI is being disabled by the OS. * Unknown SSL protocol error in connection to 192.168.1.25:-9847 * Closing connection 0 curl: (35) Unknown SSL protocol error in connection to 192.168.1.25:-9847 stunnel.log: 2015.10.09 09:05:42 LOG5[38]: Service [myservice] accepted connection from 192.168.1.24:60748 2015.10.09 09:05:42 LOG6[38]: failover: round-robin, starting at entry #1 2015.10.09 09:05:42 LOG6[38]: s_connect: connecting 127.0.0.1:41952 2015.10.09 09:05:42 LOG5[38]: s_connect: connected 127.0.0.1:41952 2015.10.09 09:05:42 LOG5[38]: Service [myservice] connected remote server from 127.0.0.1:50503 2015.10.09 09:05:42 LOG6[38]: SNI: sending servername: localhost 2015.10.09 09:05:42 LOG6[38]: Certificate verification disabled 2015.10.09 09:05:42 LOG6[38]: Certificate verification disabled 2015.10.09 09:05:42 LOG6[38]: SSL connected: new session negotiated 2015.10.09 09:05:42 LOG6[38]: Negotiated TLSv1 ciphersuite AES128-SHA (128-bit encryption) 2015.10.09 09:05:42 LOG6[38]: SSL socket closed (SSL_read) 2015.10.09 09:05:42 LOG5[38]: Connection closed: 230 byte(s) sent to SSL, 505 byte(s) sent to socket I am tried verify = 1 to 4, either works. :( Best Regards, Adrian

2 3

Stunnel for windows dependencies
by test rig 09 Oct '15

09 Oct '15

2 2

stunnel 5.24 released
by Michal Trojnara 08 Oct '15

08 Oct '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear Users, I have released version 5.24 of stunnel. The ChangeLog entry: Version 5.24, 2015.10.08, urgency: MEDIUM * New features - Custom CRL verification was replaced with the internal OpenSSL functionality. - *BSD support for "transparent = destination" and client-side "protocol = socks". This feature should work at least on FreeBSD, OpenBSD and OS X. - Added a new "protocolDomain" option for the NTLM authentication (thx to Andreas Botsikas). - Improved compatibility of the NTLM phase 1 message (thx to Andreas Botsikas). - "setuid" and "setgid" options are now also available in service sections. They can be used to set owner and group of the Unix socket specified with "accept". - Added support for the new OpenSSL 1.0.2 SSL options. - Added OPENSSL_NO_EGD support (thx to Bernard Spil). - VC autodetection added to makew32.bat (thx to Andreas Botsikas). * Bugfixes - Fixed the RESOLVE [F0] TOR extension support in SOCKS5. - Fixed the error code reported on the failed bind() requests. - Fixed the sequential log id with the FORK threading. - Restored the missing Microsoft.VC90.CRT.manifest file. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: ab2e5a1034d422951ddad21b572eb7fa8efb4c4ce04bc86536c6845f3d02b07e stunnel-5.24.tar.gz f6c38d51c2708f3eddbad651091bf0b59e4149a1d0c1e3b227b033f126c6dbee stunnel-5.24-installer.exe ed2a2c5f280970bd5f5efcecbc1dbbd06f66efb68102af31c27d33e3beb48bb5 stunnel-5.24-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWFoHsAAoJEC78f/DUFuAUQrAP/iUz2fHvvjkIcJvoR2kMeJfZ NFHE/zGIP6qHbf5Fe5SvOA/ygzQcBppa+FJN9S0uL5z0rLkDghqeWoFzPfLIVrfM y2IJ4SZ1HEESyjaZkCxY0C7Ow1kKdlMPLHv81p+Tk/Zm4qKJ/lIkP+q7XMbNmWjW BOYBLeWPtro1OjKm7v07VkzRGJupj1PHjUgPDAQRxdzqsl6fO7xY9n8b9Nh7Cwc2 1mJhsx8J40M7abftYwpG6Mycu2EOo0lIJ9rm6xZahyekzatsaIhlw2o5gx5GWJvN xj9zpkxntTVQysgP4QVdJZ+Kl17ZZmOS4k+3OqXDgdt51Ck2ty46y9NbhkulIUA8 BzH3KXZCaiBFb/sPdBtW8qmvv0azJLR0b1HfKsZQrtIB/SH0slB9rgsLkidjekKG n7FHf5dlncfAbf8KstJRv41PTYcbtQMGI/+sre2YsqG2/MSJgPfCL2Wj0bTOSmOR 7t6jHX6SItnWtAJ4+3yhlh33B4WYOYBbu3FA3Pw7Wgxur9AOV63MH/Mf96KdMFGS dqoLQh+fp/KoSw1A9OUREtQnxHnbF5MMoU4Z1pTO0FxvdCMnYCg4okiwLqbOKcuM J0T543Deq9XU7v9jDkcgUyQzBYU8lG+G9UdSH11B8phuP7pBUQ35cd62Fl9NWv9I zNjRZIOnbBp6F6hqilb4 =F+az -----END PGP SIGNATURE-----

1 0