- stunnel-users - stunnel.org

Possible memory leak in stunnel4 3:5.44-1ubuntu3?
by hkdb 20 Mar '21

20 Mar '21

Hi all, I am currently implementing stunnels on an Ubuntu 18.04 container running Magento 2 connecting to AWS Elasiticache (Redis) with the following configuration: Master: fips = no setuid = nobody setgid = nogroup pid = /home/agent/pids/redis-master.pid debug = 1 delay = yes [redis-cli] client = yes accept = 127.0.0.1:8000 connect = master.awsurl:6379 and the exact same config for the read replica with different "connect" and "accept" values of course. Everything works great except that the container host becomes unresponsive after a few days. Doing a screenshot of the console shows that the host is out of memory and mentions stunnel4 in the same error message. Upon further digging, I found that running the tunnels progressively eats away at RAM over time. Look at the logs when setting debug to 7 shows the following suspect error message: Possible memory leak at ../crypto/asn1/asn1_lib.c:295: 28363 allocations Does anyone have any thoughts on this? Is it a usage/configurations issue or did I discover a memory leak here? If it is in fact a memory leak, does running a later version fix this? Is there a recommended version that I should try to run that's known to work well with Ubuntu 18.04? Thanks a lot in advance for any help on this issue! Regards, Jeremy 3DF Open Source Initiative *Mail: *hkdb(a)3df.io *Web: *https://osi.3df.io

1 0

when reload configure，there is a err (win32)
by koalabearguo＠gmail.com 16 Mar '21

16 Mar '21

hi,I am using the latest version(stunnel5.58) on windows10; compiled openssl 1.1.1j with option zlib enabled; the stunnel.conf file: add option "securityLevel = 0" to enable compression add option "compression = zlib" to enable compression when stunnel start,it work well.but when i reload configuration in the menu configuration，it give me this: SSL_COMP_add_compression_method: ssl\ssl_ciph.c:1997: error:140A5135:SSL routines:SSL_COMP_add_compression_method:duplicate compression id Global options: Failed to initialize TLS Then i search the source code,i found when reload config,the SSL_COMP_add_compression_method(0xe0,mesh) function will add compression id again(duplicate) i think this can be fixed,thanks.

1 0

TLS alert (read): warning: close notify
by Daniel Trickett 08 Mar '21

08 Mar '21

Hi folks, Receiving the message "TLS alert (read): warning: close notify" when initiating connection to another site. I checked logs and we do not get this on any other site we use stunnel to connect to. Is this a message an acknowledgement that stunnel received a close notify message from the external site? 2021.02.25 11:11:17 LOG6[106453]: TLS connected: new session negotiated 2021.02.25 11:11:17 LOG7[106453]: Deallocating application specific data for session connect address 2021.02.25 11:11:17 LOG6[106453]: Negotiated TLSv1.2 ciphersuite ECDHE-ECDSA-AES256-GCM-SHA384 (256-bit encryption) 2021.02.25 11:11:17 LOG7[106453]: Compression: null, expansion: null 021.02.25 11:11:17 LOG7[106453]: TLS alert (read): warning: close notify 2021.02.25 11:11:17 LOG6[106453]: TLS closed (SSL_read) 2021.02.25 11:11:17 LOG7[106453]: Sent socket write shutdown 2021.02.25 11:11:17 LOG6[106453]: Read socket closed (readsocket) 2021.02.25 11:11:17 LOG7[106453]: Sending close_notify alert 2021.02.25 11:11:17 LOG7[106453]: TLS alert (write): warning: close notify 2021.02.25 11:11:17 LOG6[106453]: SSL_shutdown successfully sent close_notify alert 2021.02.25 11:11:17 LOG5[106453]: Connection closed: 9951 byte(s) sent to TLS, 419 byte(s) sent to socket 2021.02.25 11:11:17 LOG7[106453]: Remote descriptor (FD=16) closed 2021.02.25 11:11:17 LOG7[106453]: Local descriptor (FD=15) closed 2021.02.25 11:11:17 LOG7[106453]: Service [xxxx-https] finished (0 left) Best regards, Dan This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click http://www.merckgroup.com/disclaimer to access the German, French, Spanish and Portuguese versions of this disclaimer.

1 0

Win32 client cron_thread in main_cleanup() lock daemon_thread()
by jony202＠gmail.com 07 Mar '21

07 Mar '21

in main_cleanup() this code blocks because cron_thread has no exit #ifdef USE_WIN32 if(WaitForSingleObject(thread_list[i], INFINITE)==WAIT_FAILED) ioerror("WaitForSingleObject"); if(!CloseHandle(thread_list[i])) ioerror("CloseHandle"); #endif

1 0

Error Stunnel TLS alert (write): fatal: bad record mac
by Alexandre Afonso Vaz 02 Mar '21

02 Mar '21

Hello everyone I apologize in advance because my English is not the best I'm experiencing a problem with stunnel: On the server I'm running a current version [.] stunnel 5.56 on x86_64-pc-linux-gnu platform Compiled / running with OpenSSL 1.1.1d 10 Sep 2019 And on the client an old version [.] stunnel 5.39 on x86_64-pc-linux-gnu platform Compiled with OpenSSL 1.1.0c 10 Nov 2016 The case is that I am having an error in the server log as shown below: SSL_accept: ../ssl/record/ssl3_record.c:677: error: 1408F119: SSL routines: ssl3_get_record: decryption failed or bad record mac I did the test by updating the client to the same version and everything works, the question I have is whether there is really an incompatibility between the versions (be it the stunnel or the openssl). Does anyone know how to confirm me if this is real? Thanks Vaz

1 0

How to insert 2 stunnel.service on redhat 7
by simona vittori 02 Mar '21

02 Mar '21

Hello, I have 2 stunnel instance on a server and I have to insert all 2 in systemd. How to do that? Is it possible to create 2 stunnel.service naming different, for example stunnel.service and stunnel1.service where insert the script to start at boot of the machine? Thanks a lot for you help, Bye Simona

2 2

TLS alert (read): warning: close notify
by Daniel Trickett 01 Mar '21

01 Mar '21

Hi folks, Receiving the message "TLS alert (read): warning: close notify" when initiating connection to another site. I checked logs and we do not get this on any other site we use stunnel to connect to. Is this a message an acknowledgement that stunnel received a close notify message from the external site? 2021.02.25 11:11:17 LOG6[106453]: TLS connected: new session negotiated 2021.02.25 11:11:17 LOG7[106453]: Deallocating application specific data for session connect address 2021.02.25 11:11:17 LOG6[106453]: Negotiated TLSv1.2 ciphersuite ECDHE-ECDSA-AES256-GCM-SHA384 (256-bit encryption) 2021.02.25 11:11:17 LOG7[106453]: Compression: null, expansion: null 021.02.25 11:11:17 LOG7[106453]: TLS alert (read): warning: close notify 2021.02.25 11:11:17 LOG6[106453]: TLS closed (SSL_read) 2021.02.25 11:11:17 LOG7[106453]: Sent socket write shutdown 2021.02.25 11:11:17 LOG6[106453]: Read socket closed (readsocket) 2021.02.25 11:11:17 LOG7[106453]: Sending close_notify alert 2021.02.25 11:11:17 LOG7[106453]: TLS alert (write): warning: close notify 2021.02.25 11:11:17 LOG6[106453]: SSL_shutdown successfully sent close_notify alert 2021.02.25 11:11:17 LOG5[106453]: Connection closed: 9951 byte(s) sent to TLS, 419 byte(s) sent to socket 2021.02.25 11:11:17 LOG7[106453]: Remote descriptor (FD=16) closed 2021.02.25 11:11:17 LOG7[106453]: Local descriptor (FD=15) closed 2021.02.25 11:11:17 LOG7[106453]: Service [xxxx-https] finished (0 left) This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click http://www.merckgroup.com/disclaimer to access the German, French, Spanish and Portuguese versions of this disclaimer.

1 0

New User
by David Rose (dsr) 24 Feb '21

24 Feb '21

Hi I have a Windows app that sends email via SMTP without any authentication (port can be set). I want to use it with Office365 SMTP service which requires TLS. Will stunnel allow me to do this without affecting any other application sending email ? If it does, what terms should I be looking for in the help info ? Many thanks Regards David --

1 0

Windows Server 2012 R2 - localhost:25 stops listening
by Frank Warnke 22 Feb '21

22 Feb '21

Hi, I have noticed that when I install stunnel (stunnel-5.57-win64-installer.exe or today stunnel-5.58-win64-installer.exe) that running "netstat -ano" comes back with; TCP 127.0.0.1:25 0.0.0.0:0 LISTENING 2700 and the application we are using can send email via Gmail SMTP using the default stunnel.config. When I log out the user and go back in, the application can no longer send email via Gmail SMTP and "netstat -ano" no longer sees anything listening on port 25. I have verified that the stunnel service is running and have even stopped and started the stunnel service, but I am not able to get port 25 to be listened to unless I uninstall and install stunnel over again. It seems like something is setup or started during the stunnel install process that stops or gets killed after a user log outs. Any suggestions would be appreciated. Thanks, Frank

2 2

Unable to connect to server using Stunnel with TLS1.2
by jing_pan＠kindermorgan.com 02 Feb '21

02 Feb '21

We failed to using stunnel to connect to remote server which only accept TLS1.2. So we configured the stunnel on our side with below stunnel.conf. We have another program listening to localhost:3500 and process the response from server. I would appreciate any suggestion. 1. Stunnel version: 2021.02.02 10:35:27 LOG5[main]: stunnel 5.58 on x64-pc-mingw32-gnu platform 2021.02.02 10:35:27 LOG5[main]: Compiled/running with OpenSSL 1.1.1h 22 Sep 2020 2021.02.02 10:35:27 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6 TLS:ENGINE,OCSP,PSK,SNI 2021.02.02 10:35:27 LOG5[main]: Reading configuration from file stunnel.conf 2021.02.02 10:35:27 LOG5[main]: UTF-8 byte order mark not detected 2021.02.02 10:35:27 LOG4[main]: Service [FIXSERVER] needs authentication to prevent MITM attacks 2021.02.02 10:35:27 LOG5[main]: Configuration successful 2. stunnel.conf [FIXSERVER] cert = stunnel.pem client = yes fips = no accept = 127.0.0.1:3000 connect = 63.247.***.***:443 sslVersion = TLSv1.2 3. error returned: An existing connection was forcibly closed by the remote host 4. openssl s_client -connect 63.247.***.***:443 --- No client certificate CA names sent Peer signing digest: SHA256 Peer signature type: RSA Server Temp Key: ECDH, P-256, 256 bits --- SSL handshake has read 2814 bytes and written 419 bytes Verification error: self signed certificate in certificate chain --- New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384 Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE

1 0