stunnel-users

1 participants
3311 discussions

stunnel 5.01 released
by Michal Trojnara 08 Apr '14

08 Apr '14

Dear Users, I have released version 5.01 of stunnel. The ChangeLog entry: Version 5.01, 2014.04.08, urgency: HIGH: * Security bugfixes - OpenSSL DLLs updated to version 1.0.1g. This version mitigates TLS heartbeat read overrun (CVE-2014-0160). * New features - X.509 extensions added to the created self-signed stunnel.pem. - "FIPS = no" also allowed in non-FIPS builds of stunnel. - Search all certificates with the same subject name for a matching public key rather than only the first one (thx to Leon Winter). - Create logs in the local application data folder if stunnel folder is not writable on Win32. * Bugfixes - close_notify not sent when SSL still has some data buffered. - Protocol negotiation with server-side SNI fixed. - A Mac OS X missing symbols fixed. - Win32 configuration file reload crash fixed. - Added s_pool_free() on exec+connect service retires. - Line-buffering enforced on stderr output. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hash for stunnel-5.01.tar.gz: 2565bf58ffe8a612304c64df621105b2e42d6e389e815ed4205dbeec4f3f886b Best regards, Mike

1 0

Re: [stunnel-users] public domain [Patch] Support multiple X509 client certificates with same CN
by Leon Winter 01 Apr '14

01 Apr '14

Hi Michal, > >What license do you need the patch to be? > > Preferably public domain, but any GPL-compatbile and non-copyleft license > should be fine. I hereby release my patches to stunnel for support of muliple client certificates with the same CN into the public domain. Best regards, Leon Winter

2 2

Some troubles with PROXY protocol
by Alexey V. Drozdov 31 Mar '14

31 Mar '14

Hi, I try to use PROXY protocol ability for my virtual server, but this options work for root section only. E.g. it not work for this simple case: [virtual_server] accept = 443 connect = localhost:1081 cert = /etc/stunnel/serverCA.crt key = /etc/stunnel/serverCA.key verify = 2 CAfile = /etc/stunnel/serverCA.crt [server_ru] sni = virtual_server:server.ru cert = /etc/stunnel/server.cer key = /etc/stunnel/server.pem connect = localhost:7000 protocol = proxy <-- option don not work there This problem exist due some code bug: NOEXPORT void client_try(CLI *c) { init_local(c); if(!c->opt->option.client && c->opt->protocol<0) // <-- condition is true in spite of setup protorol=proxy { init_ssl(c); // we'll switch to target section (c->opt) there only! init_remote(c); } else { protocol(c, PROTOCOL_PRE_CONNECT); init_remote(c); protocol(c, PROTOCOL_PRE_SSL); init_ssl(c); protocol(c, PROTOCOL_POST_SSL); } ... Simple adhoc solution work for me: if(!c->opt->option.client && c->opt->protocol<0) // <-- condition is true in spite of setup protorol=proxy { init_ssl(c); init_remote(c); // force initiate PROXY protocol protocol(c, PROTOCOL_PRE_SSL); } It's crutch and not general solution certain. But some code refactoring needs for more correct fix. I think that this bug will be fixed in future versions. Thanks for stunnel! :) /Alexey V. Drozdov e-mail: anyquist(a)yandex.ru

2 1

Build failure of stunned 5.00 under OS X.
by Marius Schamschula 28 Mar '14

28 Mar '14

Hi there, After having built many prior releases of stunned for OS X, I ran into the following issue with version 5.0: /bin/sh ../libtool --tag=CC --mode=link gcc -pthread -fstack-protector -fPIE -g -O2 -Wall -Wextra -Wno-long-long -pedantic -L/usr/local/ssl/lib64 -L/usr/local/ssl/lib -lssl -lcrypto -o stunnel stunnel-str.o stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-fd.o stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o stunnel-ui_unix.o -lz -lpthread -lwrap libtool: link: gcc -pthread -fstack-protector -fPIE -g -O2 -Wall -Wextra -Wno-long-long -pedantic -o stunnel stunnel-str.o stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-fd.o stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o stunnel-ui_unix.o -L/usr/local/ssl/lib64 -L/usr/local/ssl/lib -lssl -lcrypto -lz -lpthread -lwrap -pthread ld: warning: directory not found for option '-L/usr/local/ssl/lib64' Undefined symbols for architecture x86_64: "_load_icon_default", referenced from: _parse_global_option in stunnel-options.o "_load_icon_file", referenced from: _parse_global_option in stunnel-options.o ld: symbol(s) not found for architecture x86_64 collect2: ld returned 1 exit status he ewxat same issue under 10.8 and 10.9. Makefile:471: recipe for target 'stunnel' failed make[2]: *** [stunnel] Error 1 make[2]: Leaving directory '/private/tmp/stunnel-5.00/src' Makefile:339: recipe for target 'all' failed make[1]: *** [all] Error 2 make[1]: Leaving directory '/private/tmp/stunnel-5.00/src' Makefile:365: recipe for target 'all-recursive' failed make: *** [all-recursive] Error 1 This is the OS X 10.7 build, but I had the same issue under 10.8 and 10.9. Marius -- Marius Schamschula

1 0

Access to Packet Content
by Michael Carlino (RIT Student) 26 Mar '14

26 Mar '14

Hello stunnel users, I am working with what seems to be the standard stunnel HTTPS configuration. I have two instances of stunnel, one as a client and one as a server. The client accepts connections from a browser. The server sits in front of tomcat. If works like a charm (of course!). What I need to do seems simple, and I will try to keep my description of it generic. In the client stunnel I need to make a small change to the HTTP packet. I need to add some data to it. At the server side I need to access that added data. The server stunnel may close the SSL session based on that data. So, my question is: can I obtain access to the packet before it's encrypted and sent out over SSL? Can I get access to the decrypted packet before it's sent on to tomcat? I know that as a proxy stunnel has to be and tries to be general in nature. I am not concerned (right now) with developing a feature that will become available to others later. I don't mind if my changes make my development version of stunnel single-purpose. My work is academic and proof-of-concept in it's nature. I have collected references and a text book (Network Security with OpenSSL by Viega et al). I will continue to walk through and explore the code. Are there any programmer resources I can obtain? I see the occasional URL in the stunnel source code. I will have to check these URLs. --- I just now pursued http://haproxy.1wt.eu/download/1.5/doc/proxy-protocol.txt, and I see that there is a patch that allows stunnel to do an initial modification to the HTTP request to insert a X-Forwarded-For header. This sounds like what I need to do! I am going to look for that patch. I hope the source code for the patch is available. Please, if anyone has any advice, war stories, criticism, whatever... I would very much appreciate it. Regards.

4 8

Tool Information
by "Cortenai Swoboda Reinbrecht" 14 Mar '14

14 Mar '14

1 0

stunnel.cnf should set keyUsage = keyCertSign
by Athir Nuaimi 11 Mar '14

11 Mar '14

I'm trying to write a go program to connect to an stunnel server and verify the certificate but it fails because the go language requires that self-signed certs have keyCertSign set in the keyUsages. the default stunnel.cnf does not set this. According to the following message thread this is required by RFC 5280. https://groups.google.com/forum/#!msg/golang-nuts/LfLHjVkeSj8/YyP-LSPEytEJ The solution to this is to add 'keyUsage = keyCertSign' to the stunnel.cnf.

3 3

Please allow fips=no even if !USE_FIPS
by Andy Lutomirski 10 Mar '14

10 Mar '14

It's currently impossible to make a stunnel config file that works with reasonable settings on both a USE_FIPS build (e.g. Fedora) and a !USE_FIPS build (e.g. Ubuntu). This is because, if USE_FIPS, fips defaults to "yes" (which is, for most purposes, a serious problem) and, if !USE_FIPS, the setting 'fips=no' prevents stunnel from starting. I've observed this on stunnel 4.53, and it looks like the same issue exists in the source in stunnel 4.56 and 5.00. (Note that, if targetting stunnel 5.00, this is less of an issue, since the default value of 'fips' changed. Nonetheless, it would be nice to accept 'fips=no' to avoid surprises.) Thanks, Andy

1 0

Stunnel Install error on Solaris10 X86
by Ashok Kumar G 10 Mar '14

10 Mar '14

Hi, I am trying to install stunnel-4.56 on my Solaris10 server. configure step completed successfully. But make and make install commands failed miserably. # gzip -dc stunnel-3.8.tar.gz | tar -xvf - # cd stunnel-3.8 # ./configure bash-3.00# make bash: make: command not found bash-3.00# export PATH=/usr/ccs/bin bash-3.00# make bash: line 8: sed: command not found *** Error code 127 The following command caused the error: fail= failcom='exit 1'; \ for f in x $MAKEFLAGS; do \ case $f in \ *=* | --[!k]*);; \ *k*) failcom='fail=yes';; \ esac; \ done; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='src doc tools'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (CDPATH="${ZSH_VERSION+.}:" && cd $subdir && make $local_target) \ || eval $failcom; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' bash-3.00# make install bash: line 8: sed: command not found *** Error code 127 The following command caused the error: fail= failcom='exit 1'; \ for f in x $MAKEFLAGS; do \ case $f in \ *=* | --[!k]*);; \ *k*) failcom='fail=yes';; \ esac; \ done; \ dot_seen=no; \ target=`echo install-recursive | sed s/-recursive//`; \ list='src doc tools'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (CDPATH="${ZSH_VERSION+.}:" && cd $subdir && make $local_target) \ || eval $failcom; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `install-recursive' bash-3.00# bash-3.00# bash-3.00# echo $PATH /usr/ccs/bin ========================================================= * 2nd Try:* ========================================================= bash-3.00# echo $PATH /usr/sbin:/usr/bin bash-3.00# PATH=$PATH:/usr/sbin:/usr/sfw/bin:/usr/ccs/bin bash-3.00# LD_LIBARAY_PATH=/lib:/usr/lib:/usr/local/lib bash-3.00# cd /opt/softwares/stunnel-4.56 bash-3.00# make Making all in src make all-am Making all in doc Making all in tools bash-3.00# make install Making install in src test -z "/usr/local/bin" || ../auto/install-sh -c -d "/usr/local/bin" /bin/bash ../libtool --mode=install ../auto/install-sh -c stunnel '/usr/local/bin' libtool: install: ../auto/install-sh -c stunnel /usr/local/bin/stunnel test -z "/usr/local/bin" || ../auto/install-sh -c -d "/usr/local/bin" ../auto/install-sh -c stunnel3 '/usr/local/bin' test -z "/usr/local/lib/stunnel" || ../auto/install-sh -c -d "/usr/local/lib/stunnel" /bin/bash ../libtool --mode=install ../auto/install-sh -c libstunnel.la'/usr/local/lib/stunnel' libtool: install: ../auto/install-sh -c .libs/libstunnel.so /usr/local/lib/stunnel/libstunnel.so libtool: install: chmod +x /usr/local/lib/stunnel/libstunnel.so libtool: install: ../auto/install-sh -c .libs/libstunnel.lai /usr/local/lib/stunnel/libstunnel.la ---------------------------------------------------------------------- Libraries have been installed in: /usr/local/lib/stunnel If you ever happen to want to link against installed libraries in a given directory, LIBDIR, you must either use libtool, and specify the full pathname of the library, or use the `-LLIBDIR' flag during linking and do at least one of the following: - add LIBDIR to the `LD_LIBRARY_PATH' environment variable during execution - use the `-RLIBDIR' linker flag See any operating system documentation about shared libraries for more information, such as the ld(1) and ld.so(8) manual pages. ---------------------------------------------------------------------- Making install in doc test -z "/usr/local/share/doc/stunnel" || ../auto/install-sh -c -d "/usr/local/share/doc/stunnel" ../auto/install-sh -c -m 644 stunnel.html stunnel.pl.html stunnel.fr.html '/usr/local/share/doc/stunnel' test -z "/usr/local/share/man/man8" || ../auto/install-sh -c -d "/usr/local/share/man/man8" ../auto/install-sh -c -m 644 stunnel.8 stunnel.pl.8 stunnel.fr.8 '/usr/local/share/man/man8' Making install in tools test -z "/usr/local/etc/stunnel" || ../auto/install-sh -c -d "/usr/local/etc/stunnel" ../auto/install-sh -c -m 644 stunnel.conf-sample '/usr/local/etc/stunnel' if test ! -r /usr/local/etc/stunnel/stunnel.pem; then \ if test -r "/dev/urandom"; then \ dd if="/dev/urandom" of=stunnel.rnd bs=256 count=1; \ RND="-rand stunnel.rnd"; \ else \ RND=""; \ fi; \ /usr//bin/openssl req -new -x509 -days 365 $RND \ -config ./stunnel.cnf \ -out stunnel.pem -keyout stunnel.pem; \ /usr//bin/openssl gendh $RND 1024 >> stunnel.pem; \ /usr//bin/openssl x509 -subject -dates -fingerprint -noout -in stunnel.pem; \ ../auto/install-sh -c -m 600 stunnel.pem /usr/local/etc/stunnel/stunnel.pem; \ rm stunnel.pem; \ fi 1+0 records in 1+0 records out bash: line 7: /usr//bin/openssl: No such file or directory *** Error code 1 make: Fatal error: Command failed for target `install-data-local' Current working directory /opt/softwares/stunnel-4.56/tools *** Error code 1 The following command caused the error: make install-exec-am install-data-am make: Fatal error: Command failed for target `install-am' Current working directory /opt/softwares/stunnel-4.56/tools *** Error code 1 The following command caused the error: fail= failcom='exit 1'; \ for f in x $MAKEFLAGS; do \ case $f in \ *=* | --[!k]*);; \ *k*) failcom='fail=yes';; \ esac; \ done; \ dot_seen=no; \ target=`echo install-recursive | sed s/-recursive//`; \ list='src doc tools'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (CDPATH="${ZSH_VERSION+.}:" && cd $subdir && make $local_target) \ || eval $failcom; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `install-recursive' bash-3.00# Can someone please help to resolve the above error. Thanks, Ashok Kumar G

2 3

Re: [stunnel-users] [Patch] Support multiple X509 client certificates with same CN
by Leon Winter 10 Mar '14

10 Mar '14

On Mon, Mar 10, 2014 at 06:34:14AM -0400, Brian Wilkins wrote: > You will have to attach appropriate software license as well. Michal may > ask for it I hereby declare my two previously sent patches to be licensed under GPL as according to the license of the stunnel project. Regards, Leon Winter

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users