- stunnel-users - stunnel.org

Re: [stunnel-users] Configuring Stunnel to work between client and server - possible certificate issue
by Ludolf Holzheid 17 May '16

17 May '16

On Tue, 2016-05-17 13:08:33 +0000, David Faizulaev wrote: > Latest update: > After further investigation, it became evident that Stunnel should run as client. > Therefore, I've converted my existing certs file (from my application) into a PEM file. > The file includes -----BEGIN CERTIFICATE----- & -----END CERTIFICATE-----. > > But I still get an error: > > 2016.05.17 15:57:24 LOG4[281]: CERT: Pre-verification error: self signed certificate in certificate chain > 2016.05.17 15:57:24 LOG4[281]: Rejected by CERT at depth=1: CN=NextnineCA > 2016.05.17 15:57:24 LOG3[281]: SSL_connect: 14090086: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed > > Here is the current configuration: > > [custom] > client = yes > accept = 127.0.0.1:8449 > connect = 192.168.220.62:443 > verify = 2 > CAfile = myapp.pem David, CAfile should point to a list of trusted certificates. The file(s) for your pair of certificate and key should be specified with cert=... (and key=..., if certificate and key are stored to separate files). Are the log messages generated at stunnel startup or at connection establishment? Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:lholzheid@bihl-wiedemann.de http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

1 0

Re: [stunnel-users] Configuring Stunnel to work between client and server - possible certificate issue
by Ludolf Holzheid 17 May '16

17 May '16

On Tue, 2016-05-17 11:13:26 +0000, David Faizulaev wrote: > I see, I have a keystore file for the server, can it be set as KEY ? can I convert keystore to PEM? I don't know. Some key/certificate repositories don't allow to export private keys. Maybe there is a PKCS11 plug-in for OpenSSL to access the keystore. If this is the case, you don't have to export your private key. But again, I don't know. > Additionally, I've thought about configuring Stunnel in client mode. > Here is the configuration: > [..] Running stunnel in client or server mode makes no difference w.r.t. certificate and key files. As long as stunnel is not able to access your private key, the client mode won't work either. HTH, Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:lholzheid@bihl-wiedemann.de http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

1 0

Re: [stunnel-users] Configuring Stunnel to work between client and server - possible certificate issue
by Ludolf Holzheid 17 May '16

17 May '16

On Tue, 2016-05-17 08:29:17 +0000, David Faizulaev wrote: > Hello Ludolf, > > I've printed the content of certificate file and the lines: "-----BEGIN CERTIFICATE-----" "-----END CERTIFICATE-----" exist. > In addition, I've compared the default certificate provided by Stunnel with the one I wish to use, they're structure is identical. Hello David, Please reply to the list, so others are able to comment too. I don't know the 'default certificate provided by Stunnel'. I expect it to be depending on the distribution. However, if there are "BEGIN/END CERTIFICATE" lines in your file, but no "BEGIN/END RSA PRIVATE KEY", then the file is in PEM format, but the key is missing. Maybe you have separate files for private key and certificate. If this is the case, you may either concatenate key and certificate to a single file or specify both files in the stunnel configuration: >> key = my-private-key.pem >> cert = my-certificate.pem Ludolf -- Ludolf Holzheid Bihl+Wiedemann GmbH Floßwörthstraße 41 68199 Mannheim, Germany Tel: +49 621 33996-0 Fax: +49 621 3392239 mailto:lholzheid@bihl-wiedemann.de http://www.bihl-wiedemann.de Sitz der Gesellschaft: Mannheim Geschäftsführer: Jochen Bihl, Bernhard Wiedemann Amtsgericht Mannheim, HRB 5796

1 0

Configuring Stunnel to work between client and server - possible certificate issue
by David Faizulaev 17 May '16

17 May '16

Hello, I've found Stunnel as a potential answer to securely moving traffic between two machines. But I'm having some difficulties configuring the software. I've installed it on to the client machine and configured the client to connect to 127.0.0.1:8449 while the Server to which the client needs to connect is 192.168.220.72:8447 In the stunnel.conf I've set the following: [custom] accept = 127.0.0.1:8449 connect = 192.168.220.72:8447 cert = 220.72.cer TIMEOUTclose = 0 Upon initializing Stunnel I get the following error: 2016.05.16 19:14:04 LOG3[main]: error queue: 140B0009: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib 2016.05.16 19:14:04 LOG3[main]: SSL_CTX_use_PrivateKey_file: 906D06C: error:0906D06C:PEM routines:PEM_read_bio:no start line 2016.05.16 19:14:04 LOG3[main]: Service [custom]: Failed to initialize SSL context 2016.05.16 19:14:04 LOG3[main]: Failed to reload the configuration file What can be the cause? Thanks in advance. Best Regards, David. [logo_tagline_Sig] David Faizulaev | PL/SQL Developer | T +972 (3) 767 3026<tel:%2B97237673012> | M +972 (54) 7314<tel:%2B972528466746>687 Centralized OT Security Management for Distributed SCADA/ICS Networks P Please consider the environment before printing this e-mail

2 1

TIMEOUTBusy exceeded
by James Brown 17 May '16

17 May '16

Running OpenSSL 1.0.2h, and stunnel 5.32 I often get: ssl_start: s_poll_wait: TIMEOUTbusy exceeded: sending reset 2016.05.17 16:51:46 LOG5[21]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.05.17 16:51:46 LOG7[21]: Local descriptor (FD=15) closed 2016.05.17 16:51:46 LOG7[21]: Service [ssmtp2] finished (3 left) 2016.05.17 16:51:46 LOG6[22]: ssl_start: s_poll_wait: TIMEOUTbusy exceeded: sending reset 2016.05.17 16:51:46 LOG5[22]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2016.05.17 16:51:46 LOG7[22]: Local descriptor (FD=16) closed 2016.05.17 16:51:46 LOG7[22]: Service [ssmtp2] finished (2 left) when a user is sending an email. The email actually makes it to our mail server and gets sent, but the sender’s mail app says that it could not be sent. Upgraded to 5.33b2, no change. It is not all the time - I suspect it is with emails with large attachments. Any suggestions? Mac OS X 10.7.5. Thanks, James.

1 0

stunnel v5.32 (and older) strange session cache behavior on memory (de)allocation
by Adrian Irimescu 16 May '16

16 May '16

I am using stunnel v5.32 compiled on a RHEL 6.7 with openssl-1.0.1e-42.el6.x86_64. The stunnel.conf cache settings are (for testing cache behaviour): *sessionCacheSize = 3sessionCacheTimeout = 60* What I expect is that after sessioncache size is reached, the memory (RSS) allocated to stunnel process does not grow with new sessions which are not in cache. Instead of this the stunnel allocates about 28K for any new session which does not have a stored session in cache and does not free this anymore. For new connections, but with session stored in cache, the memory does not grow. This lead me to a problem in memory deallocation for expired session in internal session cache.( I know that openssl frees expired session cache entries at every 255 sessions). See example below: --> stunnel start (see RSS) USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND stunnel 20655 0.0 0.0 117760 1440 ? Ss 15:49 0:00 /usr/local/bin/stunnel5 --> after 3 sessions with no cache hits stunnel 20655 0.0 0.0 117828 2976 ? Ss 15:49 0:00 /usr/local/bin/stunnel5 - stunnel log 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: New session callback 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 4 server accept(s) requested 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 4 server accept(s) succeeded 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 0 server renegotiation(s) requested 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 0 session reuse(s) 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 3 internal session cache item(s) 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 0 internal session cache fill-up(s) 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 0 internal session cache miss(es) 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 0 external session cache hit(s) 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 0 expired session(s) retrieved 2016.05.11 15:50:57 LOG6[kngHAM6DLUpVRXEqHcUMIt]: SSL accepted: new session negotiated 2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: Remove session callback ----------------------------------------------------- --> after another 1 request with cache hit: as you can see no RSS memory was added stunnel 20655 0.0 0.0 117828 2976 ? Ss 15:49 0:00 /usr/local/bin/stunnel5 - stunnel log 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: SSL state (accept): SSLv3 read finished A 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 5 server accept(s) requested 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 5 server accept(s) succeeded 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 0 server renegotiation(s) requested 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 1 session reuse(s) 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 3 internal session cache item(s) 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 1 internal session cache fill-up(s) 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 0 internal session cache miss(es) 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 0 external session cache hit(s) 2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 0 expired session(s) retrieved 2016.05.11 15:51:57 LOG6[Slq6WdqS97Ox4G8eOKfGg0]: SSL accepted: previous session reused ---------------------------------------------------- --> after another 1 request with no cache hit (now we have the first cache fill-up) stunnel 20655 0.0 0.0 117828 3000 ? Ss 15:49 0:00 /usr/local/bin/stunnel5 - stunnel log 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: New session callback 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 6 server accept(s) requested 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 6 server accept(s) succeeded 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 0 server renegotiation(s) requested 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 1 session reuse(s) 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 3 internal session cache item(s) 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 1 internal session cache fill-up(s) 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 0 internal session cache miss(es) 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 0 external session cache hit(s) 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 0 expired session(s) retrieved 2016.05.11 15:53:31 LOG6[P8n33mFxzHVAZEeRwnFccK]: SSL accepted: new session negotiated 2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: Remove session callback ---------------------------------------------------- --> after another 300 new session with no cache hits and after waiting 1 minute for entries in session cache to expire (as said in documentation openssl must free expired entries every 255 sessions) stunnel 20655 0.0 0.2 117828 11632 ? Ss 15:49 0:03 /usr/local/bin/stunnel5 - stunnel log 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: New session callback 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 306 server accept(s) requested 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 306 server accept(s) succeeded 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 0 server renegotiation(s) requested 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 1 session reuse(s) 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 3 internal session cache item(s) 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 301 internal session cache fill-up(s) 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 0 internal session cache miss(es) 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 0 external session cache hit(s) 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 0 expired session(s) retrieved 2016.05.11 16:13:26 LOG6[vWvoFT1DXuJ9x0eEfFnQBf]: SSL accepted: new session negotiated 2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: Remove session callback ---------------------------------------------------- What I can see is tat memory grows with ~28K for every new session after session cache was filled and never deallocates this memory. In my production env. this really creates problems because after 2 weeks stunnel fils all 32GB of server RAM. *Anyone has encountered a similar problem? * Of course the stunnel service restart clears the memory but I loose all cache entries and is not acceptable. After some code analysis between different versions of stunnel I can see that between v5.26 ans v5.27 the ctx callbacks functions was changed. In my tests with versions prior to 5.27 I can see that this memory problems does not appear. See logs below: ---- stunnel v5.26 -------- 2016.05.12 13:08:14 LOG5[ui]: stunnel 5.26 on x86_64-unknown-linux-gnu platform 2016.05.12 13:08:14 LOG5[ui]: Compiled/running with OpenSSL 1.0.1e-fips 11 Feb 2013 stunnel 27402 0.0 0.0 117604 1316 ? Ss 13:08 0:00 /usr/local/bin/stunnel5 stunnel 27402 0.0 0.0 117672 2756 ? Ss 13:08 0:00 /usr/local/bin/stunnel5 stunnel 27402 0.0 0.0 117672 2804 ? Ss 13:08 0:00 /usr/local/bin/stunnel5 stunnel 27402 0.0 0.0 117672 2828 ? Ss 13:08 0:00 /usr/local/bin/stunnel5 stunnel 27402 0.0 0.0 117672 2868 ? Ss 13:08 0:00 /usr/local/bin/stunnel5 cache fill-up 2016.05.12 13:11:01 LOG7[FdNYw7uGlV9xNElZSPBfyh]: 0 session reuse(s) 2016.05.12 13:11:01 LOG7[FdNYw7uGlV9xNElZSPBfyh]: 3 internal session cache item(s) 2016.05.12 13:11:01 LOG7[FdNYw7uGlV9xNElZSPBfyh]: 1 internal session cache fill-up(s) stunnel 27402 0.0 0.0 117672 2868 ? Ss 13:08 0:00 /usr/local/bin/stunnel5 stunnel 27402 0.0 0.0 117672 2868 ? Ss 13:08 0:00 /usr/local/bin/stunnel5 after 100 fill-ups 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: SSL state (accept): SSLv3 flush data 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 107 server accept(s) requested 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 107 server accept(s) succeeded 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 0 server renegotiation(s) requested 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 1 session reuse(s) 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 3 internal session cache item(s) 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 102 internal session cache fill-up(s) 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 0 internal session cache miss(es) 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 0 external session cache hit(s) 2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 0 expired session(s) retrieved 2016.05.12 13:13:55 LOG6[TWO1OFFPYvsW4qdjyJ0IZK]: SSL accepted: new session negotiated stunnel 27402 0.1 0.0 117672 2872 ? Ss 13:08 0:00 /usr/local/bin/stunnel5 after another 100 fill-ups 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: SSL state (accept): SSLv3 flush data 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 207 server accept(s) requested 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 207 server accept(s) succeeded 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 0 server renegotiation(s) requested 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 1 session reuse(s) 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 3 internal session cache item(s) 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 202 internal session cache fill-up(s) 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 0 internal session cache miss(es) 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 0 external session cache hit(s) 2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 0 expired session(s) retrieved 2016.05.12 13:19:03 LOG6[InwkBBOxJrfptxYx6wXTxU]: SSL accepted: new session negotiated stunnel 27402 0.0 0.0 117672 2872 ? Ss 13:08 0:01 /usr/local/bin/stunnel5 Code: --->>> callbacks in v5.26 L605 *NOEXPORT int sess_new_cb(SSL *ssl, SSL_SESSION *sess) { unsigned char *val, *val_tmp; ssize_t val_len; const unsigned char *session_id; unsigned int session_id_length; val_len=i2d_SSL_SESSION(sess, NULL); val_tmp=val=str_alloc((size_t)val_len); i2d_SSL_SESSION(sess, &val_tmp);#if OPENSSL_VERSION_NUMBER>=0x0090800fL session_id=SSL_SESSION_get_id(sess, &session_id_length);#else session_id=(const unsigned char *)sess->session_id; session_id_length=sess->session_id_length;#endif cache_transfer(SSL_get_SSL_CTX(ssl), CACHE_CMD_NEW, SSL_SESSION_get_timeout(sess), session_id, session_id_length, val, (size_t)val_len, NULL, NULL); str_free(val); return 1; /* leave the session in local cache for reuse */}NOEXPORT SSL_SESSION *sess_get_cb(SSL *ssl, unsigned char *key, int key_len, int *do_copy) { unsigned char *val, *val_tmp=NULL; ssize_t val_len=0; SSL_SESSION *sess; *do_copy = 0; /* allow the session to be freed autmatically */ cache_transfer(SSL_get_SSL_CTX(ssl), CACHE_CMD_GET, 0, key, (size_t)key_len, NULL, 0, &val, (size_t *)&val_len); if(!val) return NULL; val_tmp=val; sess=d2i_SSL_SESSION(NULL,#if OPENSSL_VERSION_NUMBER>=0x0090800fL (const unsigned char **)#endif /* OpenSSL version >= 0.8.0 */ &val_tmp, val_len); str_free(val);* --->>> callbacks in v5.32 /**************************************** session callbacks */ *NOEXPORT int sess_new_cb(SSL *ssl, SSL_SESSION *sess) { CLI *c; s_log(LOG_DEBUG, "New session callback"); c=SSL_get_ex_data(ssl, index_cli); if(c->opt->option.sessiond) cache_new(ssl, sess); return 1; /* leave the session in local cache for reuse */}NOEXPORT SSL_SESSION *sess_get_cb(SSL *ssl,#if OPENSSL_VERSION_NUMBER>=0x10100000L const#endif unsigned char *key, int key_len, int *do_copy) { CLI *c; s_log(LOG_DEBUG, "Get session callback"); *do_copy=0; /* allow the session to be freed automatically */ c=SSL_get_ex_data(ssl, index_cli); if(c->opt->option.sessiond) return cache_get(ssl, key, key_len); return NULL; /* no session to resume */}NOEXPORT void sess_remove_cb(SSL_CTX *ctx, SSL_SESSION *sess) { SERVICE_OPTIONS *opt; s_log(LOG_DEBUG, "Remove session callback"); opt=SSL_CTX_get_ex_data(ctx, index_opt); if(opt->option.sessiond) cache_remove(ctx, sess);}* In production env. I have downgraded today at stunnel v5.26 and memory seems to be OK (untill now). Regards, Adrian Irimescu

1 0

Re: [stunnel-users] stunnel and MSIE
by Brugman, Matt 13 May '16

13 May '16

This is a perfect example of "do not post until you've tried the latest version"... I apologize again, I missed the update. Stunnel is working correctly on my WCE device with all browsers now. Thanks again for the help and the awesome product! Matt -----Original Message----- From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Michal Trojnara Sent: Thursday, May 12, 2016 15:16 To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] stunnel and MSIE On 12.05.2016 15:57, Brugman, Matt wrote: > I’ve compiled stunnel for Windows CE 5.0 and 6.0, and am running it on > an ARM device. Which version of stunnel have you compiled? Make sure to use stunnel 5.32, as it contains an important WCE fix. Best regards, Mike

1 0

Re: [stunnel-users] stunnel and MSIE
by Brugman, Matt 12 May '16

12 May '16

I am running 5.31. I apologize; I missed the release of 5.32. I'll build and let you know what I find. Thanks very much! Matt -----Original Message----- From: stunnel-users [mailto:stunnel-users-bounces@stunnel.org] On Behalf Of Michal Trojnara Sent: Thursday, May 12, 2016 15:16 To: stunnel-users(a)stunnel.org Subject: Re: [stunnel-users] stunnel and MSIE On 12.05.2016 15:57, Brugman, Matt wrote: > I’ve compiled stunnel for Windows CE 5.0 and 6.0, and am running it on > an ARM device. Which version of stunnel have you compiled? Make sure to use stunnel 5.32, as it contains an important WCE fix. Best regards, Mike

1 0

stunnel and MSIE
by Brugman, Matt 12 May '16

12 May '16

I've compiled stunnel for Windows CE 5.0 and 6.0, and am running it on an ARM device. It is being used in client mode to secure communications to various external servers with not problems. It is also being used to secure Windows CE's webserver. All of the client mode connections are working flawlessly (thanks for the awesome work, by the way!). The webserver is working properly for all browsers except MSIE 11. Everything I've seen tells me that the problem is not really with stunnel or openssl, but with Internet Explorer. I've spent some time searching the mailing list archives and on Google, but haven't really found a solution to this, besides the obvious "well, don't use IE." I'd love to go with the answer, but some of our users are locked into IE, and let's must make it a given that the choice of browser can't be changed. The browser connects, negotiates a connection, and then exchanges keys and certificates. Using the debug console in IE I see that it sends the initial "GET /". Then the browser sees the response header, but no "body" data. Again, I realize this isn't a specific stunnel issue, but I'm hoping someone on the list has seen a similar issue and found a resolution. I've stripped stunnel.conf down to the very basics (some paths removed for clarity): ; Stunnel config for device debug = 7 output = <path removed>stunnel.log options = -NO_SSLv3 log = overwrite ;********* SERVICES *********** [https-server] client = no accept = 443 connect = 127.0.0.1:9975 cert = <path removed>stunnel.pem delay = yes TIMEOUTbusy = 5 TIMEOUTclose = 0 TIMEOUTidle = 30 Stunnel log output. I do see the "Peer suddenly disconnected" messages, but again; I'm not sure why. The last two lines of the log are the "transfer() loop executes not transferring any data": 3916.06.12 08:21:19 LOG7[ui]: Service [https-server] accepted (FD=9) from 192.168.55.77:12377 3916.06.12 08:21:19 LOG7[ui]: Creating a new thread 3916.06.12 08:21:19 LOG7[ui]: New thread created 3916.06.12 08:21:19 LOG7[0]: Service [https-server] started 3916.06.12 08:21:19 LOG5[0]: Service [https-server] accepted connection from 192.168.55.77:12377 3916.06.12 08:21:19 LOG7[0]: SSL state (accept): before/accept initialization 3916.06.12 08:21:19 LOG7[0]: SNI: no virtual services defined 3916.06.12 08:21:19 LOG7[0]: SSL state (accept): SSLv3 read client hello A 3916.06.12 08:21:19 LOG7[0]: SSL state (accept): SSLv3 write server hello A 3916.06.12 08:21:19 LOG7[0]: SSL state (accept): SSLv3 write certificate A 3916.06.12 08:21:19 LOG7[0]: SSL state (accept): SSLv3 write key exchange A 3916.06.12 08:21:19 LOG7[0]: SSL state (accept): SSLv3 write server done A 3916.06.12 08:21:19 LOG7[0]: SSL state (accept): SSLv3 flush data 3916.06.12 08:21:19 LOG7[0]: SSL state (accept): SSLv3 read client certificate A 3916.06.12 08:21:20 LOG7[0]: SSL state (accept): SSLv3 read client key exchange A 3916.06.12 08:21:20 LOG7[0]: SSL state (accept): SSLv3 read certificate verify A 3916.06.12 08:21:20 LOG7[0]: SSL state (accept): SSLv3 read finished A 3916.06.12 08:21:20 LOG7[0]: SSL state (accept): SSLv3 write change cipher spec A 3916.06.12 08:21:20 LOG7[0]: SSL state (accept): SSLv3 write finished A 3916.06.12 08:21:20 LOG7[0]: SSL state (accept): SSLv3 flush data 3916.06.12 08:21:20 LOG7[0]: New session callback 3916.06.12 08:21:20 LOG7[0]: 1 server accept(s) requested 3916.06.12 08:21:20 LOG7[0]: 1 server accept(s) succeeded 3916.06.12 08:21:20 LOG7[0]: 0 server renegotiation(s) requested 3916.06.12 08:21:20 LOG7[0]: 0 session reuse(s) 3916.06.12 08:21:20 LOG7[0]: 0 internal session cache item(s) 3916.06.12 08:21:20 LOG7[0]: 0 internal session cache fill-up(s) 3916.06.12 08:21:20 LOG7[0]: 0 internal session cache miss(es) 3916.06.12 08:21:20 LOG7[0]: 0 external session cache hit(s) 3916.06.12 08:21:20 LOG7[0]: 0 expired session(s) retrieved 3916.06.12 08:21:20 LOG6[0]: SSL accepted: new session negotiated 3916.06.12 08:21:20 LOG6[0]: No peer certificate received 3916.06.12 08:21:20 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-SHA384 (256-bit encryption) 3916.06.12 08:21:20 LOG7[0]: Compression: null, expansion: null 3916.06.12 08:21:20 LOG6[0]: s_connect: connecting 127.0.0.1:9775 3916.06.12 08:21:20 LOG6[0]: s_connect: connected 127.0.0.1:9775 3916.06.12 08:21:20 LOG6[0]: persistence: 127.0.0.1:9775 cached 3916.06.12 08:21:20 LOG5[0]: Service [https-server] connected remote server from 127.0.0.1:49277 3916.06.12 08:21:20 LOG7[0]: Remote descriptor (FD=11) initialized 3916.06.12 08:21:20 LOG6[0]: SSL socket closed (SSL_read) 3916.06.12 08:21:20 LOG7[0]: Sent socket write shutdown 3916.06.12 08:21:20 LOG5[0]: Connection closed: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 3916.06.12 08:21:20 LOG7[0]: Remote descriptor (FD=11) closed 3916.06.12 08:21:20 LOG7[0]: Local descriptor (FD=9) closed 3916.06.12 08:21:20 LOG7[0]: Service [https-server] finished (0 left) 3916.06.12 08:21:22 LOG7[ui]: Found 1 ready file descriptor(s) 3916.06.12 08:21:22 LOG7[ui]: FD=5 ifds=r-x ofds=--- 3916.06.12 08:21:22 LOG7[ui]: Service [https-server] accepted (FD=13) from 192.168.55.77:30351 3916.06.12 08:21:22 LOG7[ui]: Creating a new thread 3916.06.12 08:21:22 LOG7[ui]: New thread created 3916.06.12 08:21:22 LOG7[1]: Service [https-server] started 3916.06.12 08:21:22 LOG5[1]: Service [https-server] accepted connection from 192.168.55.77:30351 3916.06.12 08:21:22 LOG7[1]: SSL state (accept): before/accept initialization 3916.06.12 08:21:22 LOG7[1]: SNI: no virtual services defined 3916.06.12 08:21:22 LOG7[1]: SSL state (accept): SSLv3 read client hello A 3916.06.12 08:21:22 LOG7[1]: SSL state (accept): SSLv3 write server hello A 3916.06.12 08:21:22 LOG7[1]: SSL state (accept): SSLv3 write change cipher spec A 3916.06.12 08:21:22 LOG7[1]: SSL state (accept): SSLv3 write finished A 3916.06.12 08:21:22 LOG7[1]: SSL state (accept): SSLv3 flush data 3916.06.12 08:21:22 LOG7[1]: SSL state (accept): SSLv3 read finished A 3916.06.12 08:21:22 LOG7[1]: 2 server accept(s) requested 3916.06.12 08:21:22 LOG7[1]: 2 server accept(s) succeeded 3916.06.12 08:21:22 LOG7[1]: 0 server renegotiation(s) requested 3916.06.12 08:21:22 LOG7[1]: 1 session reuse(s) 3916.06.12 08:21:22 LOG7[1]: 1 internal session cache item(s) 3916.06.12 08:21:22 LOG7[1]: 0 internal session cache fill-up(s) 3916.06.12 08:21:22 LOG7[1]: 0 internal session cache miss(es) 3916.06.12 08:21:22 LOG7[1]: 0 external session cache hit(s) 3916.06.12 08:21:22 LOG7[1]: 0 expired session(s) retrieved 3916.06.12 08:21:22 LOG6[1]: SSL accepted: previous session reused 3916.06.12 08:21:22 LOG6[1]: s_connect: connecting 127.0.0.1:9775 3916.06.12 08:21:22 LOG6[1]: s_connect: connected 127.0.0.1:9775 3916.06.12 08:21:22 LOG6[1]: persistence: 127.0.0.1:9775 cached 3916.06.12 08:21:22 LOG5[1]: Service [https-server] connected remote server from 127.0.0.1:49278 3916.06.12 08:21:22 LOG7[1]: Remote descriptor (FD=15) initialized 3916.06.12 08:21:22 LOG6[1]: SSL socket closed (SSL_read) 3916.06.12 08:21:22 LOG7[1]: Sent socket write shutdown 3916.06.12 08:21:22 LOG5[1]: Connection closed: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 3916.06.12 08:21:22 LOG7[1]: Remote descriptor (FD=15) closed 3916.06.12 08:21:22 LOG7[1]: Local descriptor (FD=13) closed 3916.06.12 08:21:22 LOG7[1]: Service [https-server] finished (0 left) 3916.06.12 08:21:22 LOG7[ui]: Found 1 ready file descriptor(s) 3916.06.12 08:21:22 LOG7[ui]: FD=5 ifds=r-x ofds=--- 3916.06.12 08:21:22 LOG7[ui]: Service [https-server] accepted (FD=17) from 192.168.55.77:30352 3916.06.12 08:21:22 LOG7[ui]: Creating a new thread 3916.06.12 08:21:22 LOG7[ui]: New thread created 3916.06.12 08:21:22 LOG7[2]: Service [https-server] started 3916.06.12 08:21:22 LOG5[2]: Service [https-server] accepted connection from 192.168.55.77:30352 3916.06.12 08:21:22 LOG7[2]: SSL state (accept): before/accept initialization 3916.06.12 08:21:22 LOG7[2]: SNI: no virtual services defined 3916.06.12 08:21:22 LOG7[2]: SSL state (accept): SSLv3 read client hello A 3916.06.12 08:21:22 LOG7[2]: SSL state (accept): SSLv3 write server hello A 3916.06.12 08:21:22 LOG7[2]: SSL state (accept): SSLv3 write change cipher spec A 3916.06.12 08:21:22 LOG7[2]: SSL state (accept): SSLv3 write finished A 3916.06.12 08:21:22 LOG7[2]: SSL state (accept): SSLv3 flush data 3916.06.12 08:21:22 LOG7[2]: SSL state (accept): SSLv3 read finished A 3916.06.12 08:21:22 LOG7[2]: 3 server accept(s) requested 3916.06.12 08:21:22 LOG7[2]: 3 server accept(s) succeeded 3916.06.12 08:21:22 LOG7[2]: 0 server renegotiation(s) requested 3916.06.12 08:21:22 LOG7[2]: 2 session reuse(s) 3916.06.12 08:21:22 LOG7[2]: 1 internal session cache item(s) 3916.06.12 08:21:22 LOG7[2]: 0 internal session cache fill-up(s) 3916.06.12 08:21:22 LOG7[2]: 0 internal session cache miss(es) 3916.06.12 08:21:22 LOG7[2]: 0 external session cache hit(s) 3916.06.12 08:21:22 LOG7[2]: 0 expired session(s) retrieved 3916.06.12 08:21:22 LOG6[2]: SSL accepted: previous session reused 3916.06.12 08:21:22 LOG6[2]: s_connect: connecting 127.0.0.1:9775 3916.06.12 08:21:22 LOG6[2]: s_connect: connected 127.0.0.1:9775 3916.06.12 08:21:22 LOG6[2]: persistence: 127.0.0.1:9775 cached 3916.06.12 08:21:22 LOG5[2]: Service [https-server] connected remote server from 127.0.0.1:49279 3916.06.12 08:21:22 LOG7[2]: Remote descriptor (FD=19) initialized 3916.06.12 08:21:22 LOG3[2]: SSL socket closed (SSL_read) with 10137 unsent byte(s) 3916.06.12 08:21:22 LOG5[2]: Connection reset: 239 byte(s) sent to SSL, 553 byte(s) sent to socket 3916.06.12 08:21:22 LOG7[2]: Remote descriptor (FD=19) closed 3916.06.12 08:21:22 LOG7[2]: Local descriptor (FD=17) closed 3916.06.12 08:21:22 LOG7[2]: Service [https-server] finished (0 left) 3916.06.12 08:21:23 LOG7[ui]: Found 1 ready file descriptor(s) 3916.06.12 08:21:23 LOG7[ui]: FD=5 ifds=r-x ofds=--- 3916.06.12 08:21:23 LOG7[ui]: Service [https-server] accepted (FD=21) from 192.168.55.77:30353 3916.06.12 08:21:23 LOG7[ui]: Creating a new thread 3916.06.12 08:21:23 LOG7[ui]: New thread created 3916.06.12 08:21:23 LOG7[3]: Service [https-server] started 3916.06.12 08:21:23 LOG5[3]: Service [https-server] accepted connection from 192.168.55.77:30353 3916.06.12 08:21:23 LOG7[3]: SSL state (accept): before/accept initialization 3916.06.12 08:21:23 LOG7[3]: SNI: no virtual services defined 3916.06.12 08:21:23 LOG7[3]: SSL state (accept): SSLv3 read client hello A 3916.06.12 08:21:23 LOG7[3]: SSL state (accept): SSLv3 write server hello A 3916.06.12 08:21:23 LOG7[3]: SSL state (accept): SSLv3 write change cipher spec A 3916.06.12 08:21:23 LOG7[3]: SSL state (accept): SSLv3 write finished A 3916.06.12 08:21:23 LOG7[3]: SSL state (accept): SSLv3 flush data 3916.06.12 08:21:23 LOG7[3]: SSL state (accept): SSLv3 read finished A 3916.06.12 08:21:23 LOG7[3]: 4 server accept(s) requested 3916.06.12 08:21:23 LOG7[3]: 4 server accept(s) succeeded 3916.06.12 08:21:23 LOG7[3]: 0 server renegotiation(s) requested 3916.06.12 08:21:23 LOG7[3]: 3 session reuse(s) 3916.06.12 08:21:23 LOG7[3]: 1 internal session cache item(s) 3916.06.12 08:21:23 LOG7[3]: 0 internal session cache fill-up(s) 3916.06.12 08:21:23 LOG7[3]: 0 internal session cache miss(es) 3916.06.12 08:21:23 LOG7[3]: 0 external session cache hit(s) 3916.06.12 08:21:23 LOG7[3]: 0 expired session(s) retrieved 3916.06.12 08:21:23 LOG6[3]: SSL accepted: previous session reused 3916.06.12 08:21:23 LOG6[3]: s_connect: connecting 127.0.0.1:9775 3916.06.12 08:21:23 LOG6[3]: s_connect: connected 127.0.0.1:9775 3916.06.12 08:21:23 LOG6[3]: persistence: 127.0.0.1:9775 cached 3916.06.12 08:21:23 LOG5[3]: Service [https-server] connected remote server from 127.0.0.1:49280 3916.06.12 08:21:23 LOG7[3]: Remote descriptor (FD=23) initialized 3916.06.12 08:21:23 LOG6[3]: Read socket closed (readsocket) 3916.06.12 08:21:23 LOG7[3]: Sending close_notify alert 3916.06.12 08:21:23 LOG7[3]: SSL alert (write): warning: close notify 3916.06.12 08:21:23 LOG6[3]: SSL_shutdown successfully sent close_notify alert 3916.06.12 08:21:23 LOG3[3]: transfer() loop executes not transferring any data 3916.06.12 08:21:23 LOG3[3]: please report the problem to Michal.Trojnara(a)mirt.net

1 0

Multiple accept parameter, or Ipv4 and v6 in one statement.
by Brandon Jackson 12 May '16

12 May '16

Hi, I'm looking to expand my usage of stunnel. One thing i'm wondering, is there a way to use multiple accepts for the same service. Like: [httpsmain] accept = 443 accept = :::443 connect = 10.0.1.1:9443 or even something like. [httpsmain] accept = 443,:::443 connect = 10.0.1.1:8443 The reason is I'm about to setup some service with sni with a few domains and certs, but if I have to have them on v4 and v6 it looks like i'll have to double everything up. Is there a better way? ---------------------------------- Brandon Jackson bojack1437(a)gmail.com <https://mail.google.com/mail/?view=cm&fs=1&tf=1&to=bojack1437@gmail.com>

1 0