- stunnel-users - stunnel.org

Stunnel aborted the workflow silently in half way
by ygaochn＠amazon.com 25 Mar '22

25 Mar '22

Hey stunnel-users, We are using stunnel as the encryption transit between our NFS client and server. Recently we detected that the stunnel aborted the workflow silently in half way for unknown reason. We'd like to understand what could be the potential reason that cause the issue. Stunnel version: 4.56/5.56, below logs are for 4.56, 5.56 is from customer report without detail log Occurance #1: 2022.03.17 02:19:58 LOG7[1105:139990955783936]: connect_blocking: s_poll_wait IP:PORT: waiting 10 seconds # -> There should be a `TIMEOUTconnect exceeded` failure if the connection failed, but there is no info about how is the waiting going on, there is no log further 2022.03.17 02:56:09 LOG7[1105:139990955789440]: Dispatching signals from the signal pipe Occurance #2: 2022.03.23 16:10:49 LOG6[19003:140551554406144]: CERT: Host name "**" matched with "**" # Aborted again, this is the handshake phase 2022.03.23 16:56:09 LOG7[19003:140551554411648]: Dispatching signals from the signal pipe From the PCAP of the #2 occurance, there is no client side cert and key send to server side, so we can rule out the network issue. 8510 2022-03-23 16:09:47.660910 A B TLSv1.2 5507 Server Hello, Certificate[Packet size limited during capture] 8511 2022-03-23 16:09:47.660919 B A TCP 68 38390 → 2049 [ACK] Seq=340 Ack=5440 Win=57472 Len=0 TSval=698509941 TSecr=1821371384 ... No other client side packet send to server side afterwards, server side are waiting Does anyone encounter this before? I searched the archive but there is no similar issue. What could cause stunnel swallow all the subsequent workflow? Thanks.

1 0

Fix the expansion of @sysconfdir@ in the sample config file
by Peter Pentchev 19 Mar '22

19 Mar '22

Hi, Thanks a lot for writing and maintaining stunnel over the years! What do you think about the attached trivial patch that makes sure @sysconfdir@ is expanded correctly in the sample config file? If something should go wrong with the attachment, it is also available at: https://salsa.debian.org/debian/stunnel/-/blob/master/debian/patches/05-sam… Thanks in advance, and keep up the great work! G'luck, Peter -- Peter Pentchev roam(a)ringlet.net roam(a)debian.org pp(a)storpool.com PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint 2EE7 A7A5 17FC 124C F115 C354 651E EFB0 2527 DF13

1 0

the stunnel stops showing the ssl after a few hours of operation
by Daniel Cordero Gonzalez 19 Mar '22

19 Mar '22

I send an image of the error presented by the stunnel

1 0

the stunnel stops showing the ssl after a few hours of operation
by daniel＠hostingtico.com 19 Mar '22

19 Mar '22

hello, thank you very much for the opportunity to humbly ask for help, I had a server with centos 6 for approximately 3 years and the stunnel never gave me any problem, I recently changed my server with centos 7 but now after a few hours of being active it stops showing the ssl in the ports that I have configured to show shoutcast when viewing the stunnel status: service stunnel status after a few hours it shows most of the result in red and there it does not show the shoutcast in ssl, after giving restart: service stunnel restart everything returns to normal but before 6 hours the problem returns, Could someone give me a light to solve this problem, I'm running the latest version of stunnel my stunnel.conf: client=no [Orto] accept=7000 connect=208.77.20.179:8006 cert = /etc/stunnel/stunnel.pem sslVersion = TLSv1.2 [radio] accept=7002 connect=208.77.20.179:9942 cert = /etc/stunnel/stunnel.pem sslVersion = TLSv1.2 [Metro] accept=7004 connect=208.77.20.179:8014 cert = /etc/stunnel/stunnel.pem sslVersion = TLSv1.2 [arrge] accept=7006 connect=208.77.20.179:8016 cert = /etc/stunnel/stunnel.pem sslVersion = TLSv1.2 [radio2] accept=7008 connect=208.77.20.179:9932 cert = /etc/stunnel/stunnel.pem sslVersion = TLSv1.2 [Radiored] accept=7010 connect=208.77.20.179:8023 cert = /etc/stunnel/stunnel.pem sslVersion = TLSv1.2

1 0

stunnel error message
by Stephen McQuaid 18 Mar '22

18 Mar '22

Hello, I am getting the following error message in stunnel 2022.03.18 14:27:01 LOG3[0]: SSL_read (s_ssl_read_eof): Operation would block (WSAEWOULDBLOCK) (10035) 2022.03.18 14:27:01 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket But when I send a second email immediately after the first one, it goes through ok, does anyone know how to resolve this please?? Regards, Stephen McQuaid Local I.T. Office, Dublin, Ireland Henkel dx - creating the next [Ein Bild, das Schild, Ende, sitzend, Front enth?lt. Automatisch generierte Beschreibung] Office : +353-1-4046338 Mobile: +353-87-2470012 stephen.mcquaid(a)henkel.com<mailto:[email protected]> www.henkeldx.com<http://www.henkeldx.com/> Have a question visit Digital Business Norden<https://henkelgroup.sharepoint.com/teams/IBSNITInfoPortal/SitePages/IBS-Nor…>

1 0

stunnel 5.63 released
by Michał Trojnara 15 Mar '22

15 Mar '22

Dear Users, I have released version 5.63 of stunnel. ### Version 5.63, 2022.03.15, urgency: HIGH * Security bugfixes - OpenSSL DLLs updated to version 3.0.2. * New features - Updated stunnel.spec to support bash completion. * Bugfixes - Fixed a PRNG initialization crash (thx to Gleydson Soares). Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: c74c4e15144a3ae34b8b890bb31c909207301490bd1e51bfaaa5ffeb0a994617 stunnel-5.63.tar.gz 723f54c28073f17b1ac095a2ab9922735c69f73fba6144a5c68cc160dc673b10 stunnel-5.63-win64-installer.exe c77850c39dfb42f95d26d4f5830a261a95c3785d8c39bdd9f28764ba43ee1d7d stunnel-5.63-android.zip Best regards, Mike

1 0

src/ssl.c:319 - RAND_get_rand_method() may return NULL
by Gleydson Soares 03 Mar '22

03 Mar '22

Hello, The following patch avoids crashess. In src/ssl.c:prng_init(), the RAND_get_rand_method() may return NULL so strict the check to skip PRNG initialization. Diff inline below, against 5.62 gsoares --- ssl.c.orig Thu Mar 3 16:10:39 2022 +++ ssl.c Thu Mar 3 16:13:17 2022 @@ -354,7 +354,7 @@ NOEXPORT int prng_init(GLOBAL_OPTIONS *global) { const RAND_METHOD *meth=RAND_get_rand_method(); /* skip PRNG initialization when no seeding methods are available */ - if(meth->status==NULL || meth->add==NULL) { + if(meth==NULL || meth->status==NULL || meth->add==NULL) { s_log(LOG_DEBUG, "No PRNG seeding methods"); return 0; /* success */ }

1 0

Error -63 when connecting to Office 365 to retrieve emails
by sedick＠logicore.co.za 01 Mar '22

01 Mar '22

Hi All, A problem started recently with error -63 when connecting to office 365 server to retrieve emails. The code I am using are as follows: * variables ChannelNo = 0 Pop3Server = 'outlook.office365.com' Pop3User = UserName Pop3Pass = Password Pop3Port = '995' ProxYServer = '127.0.0.1' ProxyPort = '110' ProxyDir = 'C:\see4OI\SSL\' ProxyExe = 'stunnel.exe' ProxyCert = 'stunnel.pem' * retreives mail in MIME format Gosub GET_EMAILS return Mail_Rec * ----------------------------------------------------------------------------------------- GET_EMAILS: * close previous session If it wasnt closed properly Code = seeClose(ChannelNo) Code = seeRelease() * attach key code Code = seeAttach(1, KeyCode) if Code < 0 then RetFlag = 1 return end * start stunnel Code = seeSetProxySSL(0, 1, ProxyDir, ProxyCert, ProxyExe) If Code < 0 Then RETURN end * connect to email server Code = seePop3ConnectSSL(ChannelNo, ProxyPort, Pop3Port, Pop3Server, Pop3User, Pop3Pass, ProxyServer) If Code < 0 Then RETURN End Help urgently required please. Stunnel version 5.42 with a special exception for OpenSSL Kind Regards, Sedick

1 0

SmtpConnectSSL question
by sportman7＠netzero.com 28 Feb '22

28 Feb '22

When I use SmtpConectSSL I establish the SSL connection but Stunnel opens a Stunnel window. I would like the connection to run without this window. Anyone know how I can stop the window from opening? Is there a setting in .conf or a parameter for SmtpConnectSSL I need?

1 0

Re: tunnel for IMAP/SMTP
by Eberhard 14 Feb '22

14 Feb '22

Just saying -- if something is deprecated it does not mean you MUST stop using it. Use an older version of the software. You can of course have both -- put the older version in one place and the newer one in another. Configure your system to use whichever version you need. The habit of always updating "just because" is sometimes not good for you 😊 E VICS, LLC Eric S Eberhard 2933 W Middle Verde Rd Camp Verde, AZ 86322 928-567-3727 (land line) 928-301-7537 (cell phone) http://www.vicsmba.com https://www.facebook.com/groups/286143052248115 -----Original Message----- From: Germano Massullo <germano.massullo(a)gmail.com> On Behalf Of Caterpillar Sent: Saturday, February 12, 2022 7:18 AM To: Josealf.rm <josealf(a)rocketmail.com> Cc: stunnel-users(a)stunnel.org Subject: [stunnel-users] Re: tunnel for IMAP/SMTP Il 10/02/22 01:56, Josealf.rm ha scritto: > OK, I see you’re using stunnel only on your client and it looks you’re > connecting using TLS 1.0 which is deprecated. > > My proposed solution runs stunnel on your server and aims to implement > a front end proxy to the imap/smtp product. This can give you the > support for new TLS versions and no need to run stunnel on your clients. No, I don't have access to the mail server machine. I just installed stunnel on a localhost VM, then lowered the VM minimum accepted TLS to 1.0, and then run Thunderbird from host machine. The latter will connect to the stunnel running in the VM _______________________________________________ stunnel-users mailing list -- stunnel-users(a)stunnel.org To unsubscribe send an email to stunnel-users-leave(a)stunnel.org

1 0