- stunnel-users - stunnel.org

Stunnel - supports static OpenSSL engines?
by pepak＠seznam.cz 10 Dec '19

10 Dec '19

Hi! Does Stunnel support static-linked engines for OpenSSL? From my experiments, my guess would be that it doesn't, but I may be overlooking something and would welcome a confirmation. Why I need it: During development of an urelated app, after many many failed attempts, I finally managed to get OpenSSL 1.1.x working with a CAPI engine - but the only functional setup involved CAPI built directly into libcrypto. Every other setup, in both Visual Studio and MinGW, led to some problem or another. I would love to extend this success to my Stunnel setup, where I am now forced to stick with version 5.49 because the newer versions use OpenSSL 1.1.x which simply doesn't seem to be able to function correctly with the dynamic CAPI engine. What I need from Stunnel, basically, is for it to try to use ENGINE_by_id('capi') first and only when that fails, attempt to load a dynamic engine using ENGINE_by_id('dynamic') and the necessary ENGINE_ctrl_cmd_string commands. I can build a functional static-built OpenSSL libraries myself. If Stunnel wanted to incorporate that, I am all for it, provided that there is some way of specifying whether a static engine or a dynamic engine is preferred. My Configure command is: perl Configure shared enable-static-engine enable-zlib --with-zlib-include=C:\Zlib --with-zlib-lib=C:\Zlib\zlib.lib VC-WIN64A Pepak

1 0

Re: [stunnel-users] stunnel 5.55 - - - SSL_connect: Peer suddenly disconnected
by Flo Rance 06 Dec '19

06 Dec '19

The full logs of both sides would still be useful. Regards, Flo On Fri, 6 Dec 2019 at 09:48, simona vittori <svittori(a)gmail.com> wrote: > Hi, > port 41521 is the port of stunnel server istance that then redirect > connection in clear on port 1521 of the listener. > > That's all > > Thanks > > Simona > > Il giorno ven 6 dic 2019 alle ore 09:37 Flo Rance <trourance(a)gmail.com> > ha scritto: > >> Hi, >> >> The full logs of the client would be useful. >> >> What are you trying to connect to (on port 41521) ? >> >> Regards, >> Flo >> >> On Thu, 5 Dec 2019 at 12:44, simona vittori <svittori(a)gmail.com> wrote: >> >>> Hello, >>> >>> I have stunnel v 5.55 on linux machine client e linux machine db server, >>> Red Hat Enterprise Linux Server release 6.6. I have noticed that there are >>> many many diconnections by side client (at the bottom of the page). Why >>> there is this behavior? >>> >>> This is the configuration file of client machine: >>> >>> cert = /opt/stunnel-5.55/etc/stunnel/stunnel.pem >>> verify = 3 >>> setuid = stunnel >>> >>> CAfile = /opt/stunnel-5.55/var/certs.pem >>> >>> pid = /opt/stunnel-5.55/var/lib/stunnel/stunnel_client.pid >>> >>> socket = l:TCP_NODELAY=1 >>> socket = r:TCP_NODELAY=1 >>> >>> sslVersion = TLSv1 >>> >>> TIMEOUTconnect = 30 >>> failover = rr >>> >>> ciphers = ECDH@STRENGTH:DH@STRENGTH:HIGH:!RC4:!MD5:!DES:!aNULL:!eNULL >>> >>> debug = 7 >>> output = /opt/stunnel-5.55/var/stunnel.log >>> >>> client = yes >>> >>> [connessione_a_EMPRMDB1-DB2] >>> accept=127.0.0.1:10001 >>> connect=10.56.213.70:41521 >>> connect=10.56.213.72:41521 >>> >>> >>> ####################################################################################### >>> >>> Dec 5 12:31:42 EMWBPAPP2b stunnel: []:LOG3[15001]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:31:52 EMWBPAPP2b stunnel: []:LOG3[15007]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:32:13 EMWBPAPP2b stunnel: []:LOG3[15013]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:32:13 EMWBPAPP2b stunnel: []:LOG3[15014]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:32:22 EMWBPAPP2b stunnel: []:LOG3[15019]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:32:23 EMWBPAPP2b stunnel: []:LOG3[15021]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:32:23 EMWBPAPP2b stunnel: []:LOG3[15023]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:32:24 EMWBPAPP2b stunnel: []:LOG3[15024]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:32:44 EMWBPAPP2b stunnel: []:LOG3[15033]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:32:45 EMWBPAPP2b stunnel: []:LOG3[15035]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:32:55 EMWBPAPP2b stunnel: []:LOG3[15041]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:34:04 EMWBPAPP2b stunnel: []:LOG3[15062]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:34:05 EMWBPAPP2b stunnel: []:LOG3[15063]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:34:06 EMWBPAPP2b stunnel: []:LOG3[15065]: SSL_connect: Peer >>> suddenly disconnected >>> Dec 5 12:34:18 EMWBPAPP2b stunnel: []:LOG3[15069]: SSL_connect: Peer >>> suddenly disconnected >>> >>> #####################################################################à >>> >>> Thank for your help >>> >>> Simona >>> _______________________________________________ >>> stunnel-users mailing list >>> stunnel-users(a)stunnel.org >>> https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users >>> >>

1 0

stunnel 5.55 - - - SSL_connect: Peer suddenly disconnected
by simona vittori 06 Dec '19

06 Dec '19

Hello, I have stunnel v 5.55 on linux machine client e linux machine db server, Red Hat Enterprise Linux Server release 6.6. I have noticed that there are many many diconnections by side client (at the bottom of the page). Why there is this behavior? This is the configuration file of client machine: cert = /opt/stunnel-5.55/etc/stunnel/stunnel.pem verify = 3 setuid = stunnel CAfile = /opt/stunnel-5.55/var/certs.pem pid = /opt/stunnel-5.55/var/lib/stunnel/stunnel_client.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 sslVersion = TLSv1 TIMEOUTconnect = 30 failover = rr ciphers = ECDH@STRENGTH:DH@STRENGTH:HIGH:!RC4:!MD5:!DES:!aNULL:!eNULL debug = 7 output = /opt/stunnel-5.55/var/stunnel.log client = yes [connessione_a_EMPRMDB1-DB2] accept=127.0.0.1:10001 connect=10.56.213.70:41521 connect=10.56.213.72:41521 ####################################################################################### Dec 5 12:31:42 EMWBPAPP2b stunnel: []:LOG3[15001]: SSL_connect: Peer suddenly disconnected Dec 5 12:31:52 EMWBPAPP2b stunnel: []:LOG3[15007]: SSL_connect: Peer suddenly disconnected Dec 5 12:32:13 EMWBPAPP2b stunnel: []:LOG3[15013]: SSL_connect: Peer suddenly disconnected Dec 5 12:32:13 EMWBPAPP2b stunnel: []:LOG3[15014]: SSL_connect: Peer suddenly disconnected Dec 5 12:32:22 EMWBPAPP2b stunnel: []:LOG3[15019]: SSL_connect: Peer suddenly disconnected Dec 5 12:32:23 EMWBPAPP2b stunnel: []:LOG3[15021]: SSL_connect: Peer suddenly disconnected Dec 5 12:32:23 EMWBPAPP2b stunnel: []:LOG3[15023]: SSL_connect: Peer suddenly disconnected Dec 5 12:32:24 EMWBPAPP2b stunnel: []:LOG3[15024]: SSL_connect: Peer suddenly disconnected Dec 5 12:32:44 EMWBPAPP2b stunnel: []:LOG3[15033]: SSL_connect: Peer suddenly disconnected Dec 5 12:32:45 EMWBPAPP2b stunnel: []:LOG3[15035]: SSL_connect: Peer suddenly disconnected Dec 5 12:32:55 EMWBPAPP2b stunnel: []:LOG3[15041]: SSL_connect: Peer suddenly disconnected Dec 5 12:34:04 EMWBPAPP2b stunnel: []:LOG3[15062]: SSL_connect: Peer suddenly disconnected Dec 5 12:34:05 EMWBPAPP2b stunnel: []:LOG3[15063]: SSL_connect: Peer suddenly disconnected Dec 5 12:34:06 EMWBPAPP2b stunnel: []:LOG3[15065]: SSL_connect: Peer suddenly disconnected Dec 5 12:34:18 EMWBPAPP2b stunnel: []:LOG3[15069]: SSL_connect: Peer suddenly disconnected #####################################################################à Thank for your help Simona

2 1

Re: [stunnel-users] Help please.
by Christopher Schultz 03 Dec '19

03 Dec '19

Ajiq, On 12/3/19 09:13, Ajjq . wrote: > Hi Christopher: > > You are right. I needed > C:> TELNET LOCALHOST 80 and expect to be connected to sub.dominio.com:443 > > I modified stunnel.conf with client=yes. I am including stunnel.con and > log. > > I created the service Stunnel service, but when I start it, I get this > error message. > > [Stunnel server is down due to an error. You need to exit and correct the problem. Click OK to see the error log window.] The screenshot shows an error "bind: Address already in use". Do you have stunnel running twice at once? Please stop stunnel, delete your log file, then start it again. Post the resulting log file to the mailing list. -chris > > > stunnel.conf > > debug = 7 > output = stunnel3.log > > ; TLS front-end to a web server > [https] > client=yes > accept = 127.0.0.1:80 > connect = subd.dominio.com:443 > cert = stunnel.pem > TIMEOUTclose = 0 Is TIMEOPUTclose=0 actually on one line? That might be a syntax error. -chris

2 1

Help please.
by Ajjq . 02 Dec '19

02 Dec '19

Hi I need to enable a tunnel_out for UTL_HTTP from http:// to https:// I installed stunnel 5.34 win32 in a windows 2008 server. I am including my stunnel.conf y log file (debug=7) As you can see in the log file, I get this error: 2019.12.01 14:08:12 LOG3[7]: SSL_accept: 1407609C: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request Could you help me please? MY stunnel.conf--- debug = 7 output = stunnel.log [https] accept = 127.0.0.1:80 connect = sub.dominio.com:443 cert = stunnel.pem TIMEOUTclose = 0 This version has openssl[cid:b6de9085-07c4-43d0-b772-bb9beb37c2ac] MY LOG--- 2019.12.01 14:00:37 LOG7[cron]: Cron thread initialized 2019.12.01 14:00:37 LOG7[main]: No limit detected for the number of clients 2019.12.01 14:00:37 LOG5[main]: stunnel 5.34 on x86-pc-msvc-1500 platform 2019.12.01 14:00:37 LOG5[main]: Compiled/running with OpenSSL 1.0.2h-fips 3 May 2016 2019.12.01 14:00:37 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2019.12.01 14:00:37 LOG7[main]: errno: (*_errno()) 2019.12.01 14:00:37 LOG7[ui]: GUI message loop initialized 2019.12.01 14:00:37 LOG5[main]: Reading configuration from file stunnel.conf 2019.12.01 14:00:37 LOG5[main]: UTF-8 byte order mark detected 2019.12.01 14:00:37 LOG5[main]: FIPS mode disabled 2019.12.01 14:00:37 LOG7[main]: Compression disabled 2019.12.01 14:00:37 LOG7[main]: Snagged 64 random bytes from C:/.rnd 2019.12.01 14:00:37 LOG7[main]: Wrote 1024 new random bytes to C:/.rnd 2019.12.01 14:00:37 LOG7[main]: PRNG seeded successfully 2019.12.01 14:00:37 LOG6[main]: Initializing service [https] 2019.12.01 14:00:38 LOG6[main]: Loading certificate from file: stunnel.pem 2019.12.01 14:00:38 LOG6[main]: Certificate loaded from file: stunnel.pem 2019.12.01 14:00:38 LOG6[main]: Loading private key from file: stunnel.pem 2019.12.01 14:00:38 LOG6[main]: Private key loaded from file: stunnel.pem 2019.12.01 14:00:38 LOG7[main]: Private key check succeeded 2019.12.01 14:00:38 LOG7[main]: DH initialization 2019.12.01 14:00:38 LOG7[main]: Could not load DH parameters from stunnel.pem 2019.12.01 14:00:38 LOG6[main]: Using dynamic DH parameters 2019.12.01 14:00:38 LOG7[main]: ECDH initialization 2019.12.01 14:00:38 LOG7[main]: ECDH initialized with curve prime256v1 2019.12.01 14:00:38 LOG7[main]: SSL options: 0x03004004 (+0x03004000, -0x00000000) 2019.12.01 14:00:38 LOG5[main]: Configuration successful 2019.12.01 14:00:38 LOG7[main]: Listening file descriptor created (FD=352) 2019.12.01 14:00:38 LOG7[main]: Service [https] (FD=352) bound to 127.0.0.1:80 2019.12.01 14:00:59 LOG7[main]: Found 1 ready file descriptor(s) 2019.12.01 14:00:59 LOG7[main]: FD=260 ifds=r-x ofds=r-- 2019.12.01 14:00:59 LOG7[main]: Dispatching signals from the signal pipe 2019.12.01 14:00:59 LOG7[main]: Processing SIGNAL_RELOAD_CONFIG 2019.12.01 14:00:59 LOG5[main]: Reading configuration from file stunnel.conf 2019.12.01 14:00:59 LOG5[main]: UTF-8 byte order mark detected 2019.12.01 14:00:59 LOG5[main]: FIPS mode disabled 2019.12.01 14:00:59 LOG7[main]: Compression disabled 2019.12.01 14:00:59 LOG7[main]: Snagged 64 random bytes from C:/.rnd 2019.12.01 14:00:59 LOG7[main]: Wrote 1024 new random bytes to C:/.rnd 2019.12.01 14:00:59 LOG7[main]: PRNG seeded successfully 2019.12.01 14:00:59 LOG6[main]: Initializing service [https] 2019.12.01 14:00:59 LOG6[main]: Loading certificate from file: stunnel.pem 2019.12.01 14:00:59 LOG6[main]: Certificate loaded from file: stunnel.pem 2019.12.01 14:00:59 LOG6[main]: Loading private key from file: stunnel.pem 2019.12.01 14:00:59 LOG6[main]: Private key loaded from file: stunnel.pem 2019.12.01 14:00:59 LOG7[main]: Private key check succeeded 2019.12.01 14:00:59 LOG7[main]: DH initialization 2019.12.01 14:00:59 LOG7[main]: Could not load DH parameters from stunnel.pem 2019.12.01 14:00:59 LOG6[main]: Using dynamic DH parameters 2019.12.01 14:00:59 LOG7[main]: ECDH initialization 2019.12.01 14:00:59 LOG7[main]: ECDH initialized with curve prime256v1 2019.12.01 14:00:59 LOG7[main]: SSL options: 0x03004004 (+0x03004000, -0x00000000) 2019.12.01 14:00:59 LOG5[main]: Configuration successful 2019.12.01 14:00:59 LOG7[main]: Closing service [https] 2019.12.01 14:00:59 LOG7[main]: Service [https] closed (FD=352) 2019.12.01 14:00:59 LOG7[main]: Service [https] closed 2019.12.01 14:00:59 LOG7[main]: Listening file descriptor created (FD=352) 2019.12.01 14:00:59 LOG7[main]: Service [https] (FD=352) bound to 127.0.0.1:80 2019.12.01 14:00:59 LOG7[main]: Signal pipe is empty 2019.12.01 14:01:37 LOG6[cron]: Executing cron jobs 2019.12.01 14:01:37 LOG5[cron]: Updating DH parameters 2019.12.01 14:01:37 LOG7[main]: Found 1 ready file descriptor(s) 2019.12.01 14:01:37 LOG7[main]: FD=260 ifds=r-x ofds=--- 2019.12.01 14:01:37 LOG7[main]: Service [https] accepted (FD=420) from 127.0.0.1:56581 2019.12.01 14:01:37 LOG7[main]: Creating a new thread 2019.12.01 14:01:37 LOG7[main]: New thread created 2019.12.01 14:01:37 LOG7[0]: Service [https] started 2019.12.01 14:01:37 LOG5[0]: Service [https] accepted connection from 127.0.0.1:56581 2019.12.01 14:01:37 LOG7[0]: SSL state (accept): before/accept initialization 2019.12.01 14:01:37 LOG7[main]: Found 1 ready file descriptor(s) 2019.12.01 14:01:37 LOG7[main]: FD=260 ifds=r-x ofds=--- 2019.12.01 14:01:37 LOG7[main]: Service [https] accepted (FD=440) from 127.0.0.1:56582 2019.12.01 14:01:37 LOG7[main]: Creating a new thread 2019.12.01 14:01:37 LOG7[main]: New thread created 2019.12.01 14:01:37 LOG7[1]: Service [https] started 2019.12.01 14:01:37 LOG5[1]: Service [https] accepted connection from 127.0.0.1:56582 2019.12.01 14:01:37 LOG7[1]: SSL state (accept): before/accept initialization 2019.12.01 14:01:37 LOG3[0]: SSL_accept: 1407609C: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request 2019.12.01 14:01:37 LOG5[0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2019.12.01 14:01:37 LOG7[0]: Local descriptor (FD=420) closed 2019.12.01 14:01:37 LOG7[0]: Service [https] finished (1 left) 2019.12.01 14:01:37 LOG3[1]: SSL_accept: 1407609C: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request 2019.12.01 14:01:37 LOG5[1]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2019.12.01 14:01:37 LOG7[1]: Local descriptor (FD=440) closed 2019.12.01 14:01:37 LOG7[1]: Service [https] finished (0 left) 2019.12.01 14:01:37 LOG7[main]: Found 1 ready file descriptor(s) 2019.12.01 14:01:37 LOG7[main]: FD=260 ifds=r-x ofds=--- 2019.12.01 14:01:37 LOG7[main]: Service [https] accepted (FD=448) from 127.0.0.1:56583 2019.12.01 14:01:37 LOG7[main]: Creating a new thread 2019.12.01 14:01:37 LOG7[main]: New thread created 2019.12.01 14:01:37 LOG7[2]: Service [https] started 2019.12.01 14:01:37 LOG5[2]: Service [https] accepted connection from 127.0.0.1:56583 2019.12.01 14:01:37 LOG7[2]: SSL state (accept): before/accept initialization 2019.12.01 14:01:37 LOG3[2]: SSL_accept: 1407609C: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request 2019.12.01 14:01:37 LOG5[2]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2019.12.01 14:01:37 LOG7[2]: Local descriptor (FD=448) closed 2019.12.01 14:01:37 LOG7[2]: Service [https] finished (0 left) 2019.12.01 14:01:37 LOG7[main]: Found 1 ready file descriptor(s) 2019.12.01 14:01:37 LOG7[main]: FD=260 ifds=r-x ofds=--- 2019.12.01 14:01:37 LOG7[main]: Service [https] accepted (FD=452) from 127.0.0.1:56584 2019.12.01 14:01:37 LOG7[main]: Creating a new thread 2019.12.01 14:01:37 LOG7[main]: New thread created 2019.12.01 14:01:37 LOG7[3]: Service [https] started 2019.12.01 14:01:37 LOG5[3]: Service [https] accepted connection from 127.0.0.1:56584 2019.12.01 14:01:37 LOG7[3]: SSL state (accept): before/accept initialization 2019.12.01 14:01:37 LOG3[3]: SSL_accept: 1407609C: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request 2019.12.01 14:01:37 LOG5[3]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2019.12.01 14:01:37 LOG7[3]: Local descriptor (FD=452) closed 2019.12.01 14:01:37 LOG7[3]: Service [https] finished (0 left) Thanks in advance.

2 1

SMTP out via Comcast stopped working
by Carlos Rodriguez 30 Nov '19

30 Nov '19

All: I have had this setup working fine since Comcast blocked port 25 and recently stopped working. This is a MS Small Business Server 2003 with Exchange, I know, old and obsolete but I would like to keep it working until I migrate to Linux. Anyway, right now I also have my desktop, Win10, using the same SMTP settings for the Acronis backup event results and it can send me emails just fine, just tested this. So it is not my firewall or Comcast. I'm missing something in the settings of stunnel. Below are my settings and log file. Any suggestions will be appreciated. Carlos taskbar = yes [SSLsmtp] client = yes accept = localhost:555 connect = smtp.comcast.net:587 protocol = smtp CAfile = ca-certs.pem protocolUsername = verifiedusername protocolPassword = verifiedpassword debug = 7 ================================================ 2019.11.29 16:31:24 LOG5[main]: stunnel 5.49 on x86-pc-msvc-1500 platform 2019.11.29 16:31:24 LOG5[main]: Compiled/running with OpenSSL 1.0.2p-fips 14 Aug 2018 2019.11.29 16:31:24 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI 2019.11.29 16:31:24 LOG5[main]: Reading configuration from file stunnel.conf 2019.11.29 16:31:24 LOG5[main]: UTF-8 byte order mark detected 2019.11.29 16:31:24 LOG5[main]: FIPS mode disabled 2019.11.29 16:31:26 LOG4[main]: Service [SSLsmtp] needs authentication to prevent MITM attacks 2019.11.29 16:31:26 LOG5[main]: Configuration successful 2019.11.29 16:34:12 LOG7[0]: Service [SSLsmtp] started 2019.11.29 16:34:12 LOG7[0]: Setting local socket options (FD=264) 2019.11.29 16:34:12 LOG7[0]: Option TCP_NODELAY set on local socket 2019.11.29 16:34:12 LOG5[0]: Service [SSLsmtp] accepted connection from 127.0.0.1:1268 2019.11.29 16:34:12 LOG6[0]: s_connect: connecting 96.114.157.81:587 2019.11.29 16:34:12 LOG7[0]: s_connect: s_poll_wait 96.114.157.81:587: waiting 10 seconds 2019.11.29 16:34:12 LOG5[0]: s_connect: connected 96.114.157.81:587 2019.11.29 16:34:12 LOG5[0]: Service [SSLsmtp] connected remote server from 10.10.10.99:1269 2019.11.29 16:34:12 LOG7[0]: Setting remote socket options (FD=288) 2019.11.29 16:34:12 LOG7[0]: Option TCP_NODELAY set on remote socket 2019.11.29 16:34:12 LOG7[0]: Remote descriptor (FD=288) initialized 2019.11.29 16:34:12 LOG7[0]: <- 220 resomta-po-02v.sys.comcast.net resomta-po-02v.sys.comcast.net ESMTP server ready 2019.11.29 16:34:12 LOG7[0]: -> 220 resomta-po-02v.sys.comcast.net resomta-po-02v.sys.comcast.net ESMTP server ready 2019.11.29 16:34:12 LOG7[0]: -> EHLO localhost 2019.11.29 16:34:12 LOG7[0]: <- 250-resomta-po-02v.sys.comcast.net hello [71.206.38.109], pleased to meet you 2019.11.29 16:34:12 LOG7[0]: <- 250-HELP 2019.11.29 16:34:12 LOG7[0]: <- 250-SIZE 36700160 2019.11.29 16:34:12 LOG7[0]: <- 250-ENHANCEDSTATUSCODES 2019.11.29 16:34:12 LOG7[0]: <- 250-8BITMIME 2019.11.29 16:34:12 LOG7[0]: <- 250-STARTTLS 2019.11.29 16:34:12 LOG7[0]: <- 250 OK 2019.11.29 16:34:12 LOG7[0]: -> STARTTLS 2019.11.29 16:34:12 LOG7[0]: <- 220 2.0.0 Ready to start TLS 2019.11.29 16:34:12 LOG6[0]: SNI: sending servername: smtp.comcast.net 2019.11.29 16:34:12 LOG6[0]: Peer certificate not required 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): before/connect initialization 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv2/v3 write client hello A 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 read server hello A 2019.11.29 16:34:12 LOG6[0]: Certificate verification disabled 2019.11.29 16:34:12 LOG6[0]: Certificate verification disabled 2019.11.29 16:34:12 LOG6[0]: Certificate verification disabled 2019.11.29 16:34:12 LOG6[0]: Certificate verification disabled 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 read server certificate A 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 read server key exchange A 2019.11.29 16:34:12 LOG6[0]: Client certificate not requested 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 read server done A 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 write client key exchange A 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 write change cipher spec A 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 write finished A 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 flush data 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 read server session ticket A 2019.11.29 16:34:12 LOG7[0]: TLS state (connect): SSLv3 read finished A 2019.11.29 16:34:12 LOG7[0]: New session callback 2019.11.29 16:34:12 LOG7[0]: Peer certificate was cached (6814 bytes) 2019.11.29 16:34:12 LOG6[0]: Session id: 11C16B28FFB4A3A4EDC164CA65C3F20A896BF61C4D3B09F571E4285CFD0C82B3 2019.11.29 16:34:12 LOG7[0]: 1 client connect(s) requested 2019.11.29 16:34:12 LOG7[0]: 1 client connect(s) succeeded 2019.11.29 16:34:12 LOG7[0]: 0 client renegotiation(s) requested 2019.11.29 16:34:12 LOG7[0]: 0 session reuse(s) 2019.11.29 16:34:12 LOG6[0]: TLS connected: new session negotiated 2019.11.29 16:34:12 LOG6[0]: TLSv1.2 ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption) 2019.11.29 16:34:12 LOG7[0]: Compression: null, expansion: null 2019.11.29 16:34:12 LOG7[0]: -> AUTH PLAIN AGNhcmxvc3JyQGNvbWNhc3QubmV0AFNveTFjYXJpZHVybw== 2019.11.29 16:34:12 LOG7[0]: <- 500 command unrecognized 2019.11.29 16:34:12 LOG3[0]: PLAIN Authentication Failed 2019.11.29 16:34:12 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket 2019.11.29 16:34:12 LOG7[0]: Remote descriptor (FD=288) closed 2019.11.29 16:34:12 LOG7[0]: Local descriptor (FD=264) closed 2019.11.29 16:34:12 LOG7[0]: Service [SSLsmtp] finished (0 left)

2 1

undefined reference to `CRYPTO_set_id_callback'
by Somchai Smythe 29 Nov '19

29 Nov '19

How do I fix this? gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/include -DLIBDIR='"/usr/lib/stunnel"' -DCONFDIR='"/etc/stunnel"' -O3 -m64 -march=x86-64 -mtune=generic -pipe -std=gnu17 -pthread -Wall -Wextra -Wpedantic -Wformat=2 -Wconversion -Wno-long-long -Wno-deprecated-declarations -fPIE -fstack-protector -D_FORTIFY_SOURCE=2 -MT stunnel-sthreads.o -MD -MP -MF .deps/stunnel-sthreads.Tpo -c -o stunnel-sthreads.o `test -f 'sthreads.c' || echo './'`sthreads.c sthreads.c: In function 'thread_id_init': sthreads.c:116:5: warning: implicit declaration of function 'CRYPTO_set_id_callback'; did you mean 'CRYPTO_set_locking_callback'? [-Wimplicit-function-declaration] 116 | CRYPTO_set_id_callback(stunnel_thread_id); | ^~~~~~~~~~~~~~~~~~~~~~ | CRYPTO_set_locking_callback ... libtool: link: ( cd ".libs" && rm -f "libstunnel.la" && ln -s "../libstunnel.la" "libstunnel.la" ) /usr/lib/gcc/x86_64-pc-linux-gnu/9.2.0/../../../../x86_64-pc-linux-gnu/bin/ld: stunnel-sthreads.o: in function `sthreads_init': sthreads.c:(.text+0xb0): undefined reference to `CRYPTO_set_id_callback' /usr/lib/gcc/x86_64-pc-linux-gnu/9.2.0/../../../../x86_64-pc-linux-gnu/bin/ld: stunnel-sthreads.o: in function `thread_id_init': sthreads.c:(.text+0x3a): undefined reference to `CRYPTO_set_id_callback' collect2: error: ld returned 1 exit status make[2]: *** [Makefile:550: stunnel] Error 1 I'm using openssl-1.1.1d if it matters.

2 4

"Address already in use" error
by Phil Smith III 25 Nov '19

25 Nov '19

Rebooted (Windows 7, fully patched) today and stunnel wouldn't start, said "Address already in use". Hmm.nothing much has changed. Rebooted again, same. Tinkered a bit, didn't see anything that looked meaningful. Went to look at deleted digests of this list, saw new version out, installed that, now it's happy. So.a mystery, at least to me; posting in case it helps someone else! .phsiii

1 0

segfault with v5.55
by Francois Robinette 22 Nov '19

22 Nov '19

I've seen other having the same issue without resolution so far... But we do have the same issue: stunnel[7886]: segfault at 21 ip 00007f70aa1efcea sp 00007f6fa7797978 error 6 in libpthread-2.12.so[7f70aa1e5000+17000]

2 4

Windows 10 stunnel does not accept options
by Clodoaldo Neto 22 Nov '19

22 Nov '19

Any option I try in stunnel 5.55 results the same. Say: PS C:\Program Files (x86)\stunnel\bin> .\stunnel \path\to\config\file [ ] Running on Windows 6.2 [ ] No limit detected for the number of clients [.] stunnel 5.55 on x64-pc-mingw32-gnu platform [.] Compiled/running with OpenSSL 1.1.1c 28 May 2019 [.] Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI [ ] errno: (*_errno()) [ ] GUI message loop initialized [ ] Running on Windows 6.2 [.] Reading configuration from file stunnel.conf [.] UTF-8 byte order mark detected [ ] Compression disabled [ ] No PRNG seeding was required [ ] Initializing service [ssh] [ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK [ ] TLSv1.3 ciphersuites: TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256 [ ] TLS options: 0x02100004 (+0x00000000, -0x00000000) [ ] No certificate or private key specified [:] Service [ssh] needs authentication to prevent MITM attacks [ ] Initializing service [gmail-imap] [!] Service [gmail-imap]: TLS server needs a certificate [ ] Deallocating section defaults [!] Server is down Same with PS C:\Program Files (x86)\stunnel\bin> .\stunnel nonexistent or PS C:\Program Files (x86)\stunnel\bin> .\stunnel -help Regards, Clodoaldo

1 0