March 2013 - stunnel-users

stunnel 4.56 released
by Michal Trojnara 23 Mar '13

23 Mar '13

Dear Users, I have released version 4.56 of stunnel. The ChangeLog entry: Version 4.56, 2013.03.22, urgency: HIGH: * New features - Win32 installer automatically configures firewall exceptions. - Win32 installer configures administrative shortcuts to invoke UAC. - Improved Win32 GUI shutdown time. * Bugfixes - Fixed a regression bug introduced in version 4.55 causing random crashes on several platforms, including Windows 7. - Fixed startup crashes on some Win32 systems. - Fixed incorrect "stunnel -exit" process synchronisation. - Fixed FIPS detection with new versions of the OpenSSL library. - Failure to open the log file at startup is no longer ignored. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hash for stunnel-4.56.tar.gz: 9cae2cfbe26d87443398ce50d7d5db54e5ea363889d5d2ec8d2778a01c871293 Best regards, Mike

2 2

4.56 FIPS startup issue
by Ian Donaldson 22 Mar '13

22 Mar '13

Hi, I've been using stunnel for years and tried to upgrade to 4.56 today and it fails to start with this error: Clients allowed=125 stunnel 4.56 on i386-pc-solaris2.9 platform Compiled/running with OpenSSL 1.0.1e 11 Feb 2013 Threading:PTHREAD Sockets:POLL,IPv6 SSL:ENGINE,OCSP,FIPS Reading configuration from file /opt/local/etc/stunnel.conf FIPS_mode_set: F06D065: error:0F06D065:common libcrypto routines:FIPS_mode_set:fips mode not supported Line 36: "[pop3s]": Failed to initialize SSL str_stats: 5 block(s), 118 data byte(s), 210 control byte(s) I note some mention of FIPS in today's release. 4.55 started ok though with the same version of openssl (and crashed a few hours later), so we're back to 4.54 again. Ian D

1 1

stunnel craches in windows 7 x64
by Mosy Mosy 14 Mar '13

14 Mar '13

I have been facing with a strange bug in stunnel 4.55 (and also in tstunnel) in Windows 7 x64 and also in Windows Server 2003 R2 x86. I redirect TCP connections from a win7 client to a win2k3 server. Stunnel works fine when accepting connections and transferring data. But suddenly crashes when the client program (in the client side) closes the connection (maybe the several connections simultaneously). It happens on the server side too. Because of this problem I have to load a little program to relaunch stunnel whenever it is crashed. What I mean by 'crash' is that the windows shows the "stunnel stops working" and giving the choices to restart,stop, or debug the program. If you need more details I will be pleased to help you in this case. Thank you :) PS: I just have downloaded "stunnel-4.56b1" and I'm using it right now. I see no sign of crashing and instability until this moment :) it seems the bug is eliminated :)

1 0

4.55 is unstable
by Death Master 14 Mar '13

14 Mar '13

Windows build of 4.55, 2013.03.03 crashes every 20-60sec under load. OS:Win7 x64 (with all updates) This bug affects both stunnel and tstunnel. Please fix it soon ;)

5 6

stunnel: SSL routinesdecryption failed or bad record mac
by Kishore Paul 13 Mar '13

13 Mar '13

Hello Everyone, I updated to the latest version of stunnel and openssl and am still getting a lot of decryption fails. stunnel: SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac and a few times it just segfaults: [937987.314573] stunnel: segfault at 7f6164025000 ip 00007f616d8b5adc sp 00007f616e6a9af0 error 4 in libcrypto.so.1.0.0[7f616d84a000+19f000] stunnel 4.54 on x86_64-unknown-linux-gnu platform Compiled with OpenSSL 1.0.1e 11 Feb 2013 Running with OpenSSL 1.0.1 14 Mar 2012 Is there any way to avoid these errors? I limited my cipher set to just RC4-SHA after seeing that there is an issue even in openssl 1.01e-1 for e_aes_cbc_hmac_sha1.c http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=678353 Appreciate your help. Thanks, Kishore

1 0

Need help to configure STUNNEL using proxy socks v5 to send file to a server
by laurent.uk＠bnpparibas.com 11 Mar '13

11 Mar '13

Hi everyone, I need to connect to proxy socks V5 in order to send file in my server. I configure my stunnel like this : sslVersion = SSLv3 client=yes cert = /opt/freeware/etc/stunnel/ca_nopass.pem pid = /var/adm/stunnel_test.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /logs/stunnel/stunnel.log ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail CApath = /opt/freeware/etc/stunnel/CA_files/ protocol = connect protocolAuthentication = basic protocolHost = ***:8080 [pesit] accept = 12099 connect = ***:433 But it doesn't works! The log from my stunnel client : 2013.03.11 18:57:30 LOG5[26673178:260]: Service pesit accepted connection from ***:48549 2013.03.11 18:57:30 LOG7[26673178:260]: remote socket: FD=1 allocated (non-blocking mode) 2013.03.11 18:57:30 LOG6[26673178:260]: connect_blocking: connecting ::1:10443 2013.03.11 18:57:30 LOG3[26673178:260]: connect_blocking: connect ::1:10443: Connection refused (79) 2013.03.11 18:57:30 LOG7[26673178:260]: remote socket: FD=1 allocated (non-blocking mode) 2013.03.11 18:57:30 LOG6[26673178:260]: connect_blocking: connecting ****:10443 2013.03.11 18:57:30 LOG5[26673178:260]: connect_blocking: connected ****:10443 2013.03.11 18:57:30 LOG5[26673178:260]: Service pesit connected remote server from ****:48551 2013.03.11 18:57:30 LOG7[26673178:260]: Remote FD=1 initialized 2013.03.11 18:57:30 LOG7[26673178:260]: Option TCP_NODELAY set on remote socket 2013.03.11 18:57:30 LOG6[26673178:260]: Client-mode connect protocol negotiations started 2013.03.11 18:57:30 LOG7[26673178:260]: -> CONNECT ****:1080 HTTP/1.1 2013.03.11 18:57:30 LOG7[26673178:260]: -> Host: ****:1080 2013.03.11 18:57:30 LOG7[26673178:260]: -> 2013.03.11 18:57:30 LOG3[26673178:260]: fdgetline: readsocket: Connection reset by peer (73) 2013.03.11 18:57:30 LOG5[26673178:260]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2013.03.11 18:57:30 LOG7[26673178:260]: Service pesit finished (0 left) 2013.03.11 18:57:30 LOG7[26673178:260]: str_stats: 0 block(s), 0 data byte(s), 0 control byte(s) 2013.03.11 18:57:32 LOG7[26673178:1]: local socket: FD=0 allocated (non-blocking mode) In my stunnel server, i have the following message : "SSL_accept: 1407609B: error:1407609B:SSL routines:SSL23_GET_CLIENT_HELLO:https proxy request" 2013.03.11 18:57:30 LOG7[27525210:1]: Service pesitip accepted FD=0 from ****:48551 2013.03.11 18:57:30 LOG7[27525210:265]: Service pesitip started 2013.03.11 18:57:30 LOG7[27525210:265]: Option TCP_NODELAY set on local socket 2013.03.11 18:57:30 LOG5[27525210:265]: Service pesitip accepted connection from 159.50.49.69:48551 2013.03.11 18:57:30 LOG3[27525210:265]: SSL_accept: 1407609B: error:1407609B:SSL routines:SSL23_GET_CLIENT_HELLO:https proxy request 2013.03.11 18:57:30 LOG5[27525210:265]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2013.03.11 18:57:30 LOG7[27525210:265]: Service pesitip finished (0 left) 2013.03.11 18:57:30 LOG7[27525210:265]: str_stats: 0 block(s), 0 data byte(s), 0 control byte(s) 2013.03.11 18:57:32 LOG7[27525210:1]: local socket: FD=0 allocated (non-blocking mode) Can you help me to configure my stunnel please? Thanks. Regards, Laurent UK This message and any attachments (the "message") is intended solely for the intended addressees and is confidential. If you receive this message in error,or are not the intended recipient(s), please delete it and any copies from your systems and immediately notify the sender. Any unauthorized view, use that does not comply with its purpose, dissemination or disclosure, either whole or partial, is prohibited. Since the internet cannot guarantee the integrity of this message which may not be reliable, BNP PARIBAS (and its subsidiaries) shall not be liable for the message if modified, changed or falsified. Do not print this message unless it is necessary,consider the environment. ---------------------------------------------------------------------------------------------------------------------------------- Ce message et toutes les pieces jointes (ci-apres le "message") sont etablis a l'intention exclusive de ses destinataires et sont confidentiels. Si vous recevez ce message par erreur ou s'il ne vous est pas destine, merci de le detruire ainsi que toute copie de votre systeme et d'en avertir immediatement l'expediteur. Toute lecture non autorisee, toute utilisation de ce message qui n'est pas conforme a sa destination, toute diffusion ou toute publication, totale ou partielle, est interdite. L'Internet ne permettant pas d'assurer l'integrite de ce message electronique susceptible d'alteration, BNP Paribas (et ses filiales) decline(nt) toute responsabilite au titre de ce message dans l'hypothese ou il aurait ete modifie, deforme ou falsifie. N'imprimez ce message que si necessaire, pensez a l'environnement.

1 0

Mutual Authentication
by Sameer Rahmani 11 Mar '13

11 Mar '13

Hi guys, I want to have secure tunnel to my server and also i want only specified clients can connect via the tunnel to the server. I was reading about mutual authentication but i can't run stunnel using verify=2 or 3 or 4. I confused. Can you please explain for me what should i do to use 2way ssl connection? how does stunnel use this?

2 1

It doesn't work.
by Raemsh Pungavanam 11 Mar '13

11 Mar '13

Hi , i have following issue with latest version of stunnel and openssl. version ====== stunnel - 4.55 openssl - 1.0.1e stunnel.conf ========== # Sample stunnel configuration file # Copyright by Michal Trojnara 2002 # Comment it out on Win32 #cert = /etc/tr69/stunnel.pem key = /etc/tr69/stunnel.pem # chroot = /usr/local/var/run/stunnel/ # PID is created inside chroot jail pid = /var/run/ssl.pid setuid = root setgid = root # Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = TLSv1.2 # Workaround for Eudora bug #options = DONT_INSERT_EMPTY_FRAGMENTS # Authentication stuff verify = 1 # don't forget about c_rehash CApath # it is located inside chroot jail: #CApath = /certs # or simply use CAfile instead: #CAfile = /usr/local/etc/stunnel/certs.pem #CAfile = /etc/tr69/ca.crt # CRL path or file (inside chroot jail): #CRLpath = /crls # or simply use CAfile instead: #CRLfile = /usr/local/etc/stunnel/crls.pem # Some debugging stuff debug = 7 output = /var/log/ssl.log foreground = yes # Use it for client mode client = yes # Service-level configuration [https] CAfile = /flash/Cert.pem accept = 127.0.0.1:8001 connect = acs.qacafe.com:80 #accept = 8080 cat /var/log/ssl.log ============== 2013.03.11 18:29:04 LOG5[5849:0]: stunnel 4.55 on mips-openwrt-linux-uclibc platform 2013.03.11 18:29:04 LOG5[5849:0]: Compiled/running with OpenSSL 1.0.1e 11 Feb 2013 2013.03.11 18:29:04 LOG5[5849:0]: Threading:FORK SSL:+ENGINE+OCSP Auth:none Sockets:POLL+IPv6 2013.03.11 18:29:04 LOG5[5849:0]: Reading configuration from file /etc/tr69/stunnel.conf 2013.03.11 18:29:04 LOG7[5849:0]: Compression not enabled 2013.03.11 18:29:04 LOG7[5849:0]: PRNG seeded successfully 2013.03.11 18:29:04 LOG6[5849:0]: Initializing service [https] 2013.03.11 18:29:04 LOG4[5849:0]: Insecure file permissions on /etc/tr69/stunnel.pem 2013.03.11 18:29:04 LOG7[5849:0]: Loaded verify certificates from /flash/Cert.pem 2013.03.11 18:29:04 LOG7[5849:0]: Loaded /flash/Cert.pem revocation lookup file 2013.03.11 18:29:04 LOG7[5849:0]: SSL options set: 0x00000004 2013.03.11 18:29:04 LOG5[5849:0]: Configuration successful 2013.03.11 18:29:04 LOG7[5849:0]: Service [https] (FD=17) bound to 127.0.0.1:8001 2013.03.11 18:29:04 LOG7[5849:0]: Created pid file /var/run/ssl.pid 2013.03.11 18:29:21 LOG7[5849:0]: Service [https] accepted (FD=4) from 127.0.0.1:36039 2013.03.11 18:29:21 LOG7[5920:0]: Service [https] started 2013.03.11 18:29:21 LOG5[5920:0]: Service [https] accepted connection from 127.0.0.1:36039 2013.03.11 18:29:22 LOG6[5920:0]: connect_blocking: connecting 6.0.0.1:80 2013.03.11 18:29:22 LOG7[5920:0]: connect_blocking: s_poll_wait 6.0.0.1:80: waiting 10 seconds 2013.03.11 18:29:22 LOG5[5920:0]: connect_blocking: connected 6.0.0.1:80 2013.03.11 18:29:22 LOG5[5920:0]: Service [https] connected remote server from 61.200.100.100:35694 2013.03.11 18:29:22 LOG7[5920:0]: Remote socket (FD=17) initialized 2013.03.11 18:29:22 LOG7[5920:0]: SNI: sending servername: acs.qacafe.com 2013.03.11 18:29:22 LOG7[5920:0]: SSL state (connect): before/connect initialization 2013.03.11 18:29:22 LOG7[5920:0]: SSL state (connect): SSLv3 write client hello A 2013.03.11 18:30:15 LOG7[5849:0]: Service [https] accepted (FD=4) from 127.0.0.1:36042 2013.03.11 18:30:15 LOG7[5973:0]: Service [https] started 2013.03.11 18:30:15 LOG5[5973:0]: Service [https] accepted connection from 127.0.0.1:36042 2013.03.11 18:30:15 LOG6[5973:0]: connect_blocking: connecting 6.0.0.1:80 2013.03.11 18:30:15 LOG7[5973:0]: connect_blocking: s_poll_wait 6.0.0.1:80: waiting 10 seconds 2013.03.11 18:30:15 LOG5[5973:0]: connect_blocking: connected 6.0.0.1:80 2013.03.11 18:30:15 LOG5[5973:0]: Service [https] connected remote server from 61.200.100.100:35697 2013.03.11 18:30:15 LOG7[5973:0]: Remote socket (FD=17) initialized 2013.03.11 18:30:15 LOG7[5973:0]: SNI: sending servername: acs.qacafe.com 2013.03.11 18:30:15 LOG7[5973:0]: SSL state (connect): before/connect initialization 2013.03.11 18:30:15 LOG7[5973:0]: SSL state (connect): SSLv3 write client hello A 2013.03.11 18:31:40 LOG7[5849:0]: Service [https] accepted (FD=4) from 127.0.0.1:49029 2013.03.11 18:31:40 LOG7[6023:0]: Service [https] started 2013.03.11 18:31:40 LOG5[6023:0]: Service [https] accepted connection from 127.0.0.1:49029 2013.03.11 18:31:40 LOG6[6023:0]: connect_blocking: connecting 6.0.0.1:80 2013.03.11 18:31:40 LOG7[6023:0]: connect_blocking: s_poll_wait 6.0.0.1:80: waiting 10 seconds 2013.03.11 18:31:40 LOG5[6023:0]: connect_blocking: connected 6.0.0.1:80 2013.03.11 18:31:40 LOG5[6023:0]: Service [https] connected remote server from 61.200.100.100:40051 2013.03.11 18:31:40 LOG7[6023:0]: Remote socket (FD=17) initialized 2013.03.11 18:31:40 LOG7[6023:0]: SNI: sending servername: acs.qacafe.com 2013.03.11 18:31:40 LOG7[6023:0]: SSL state (connect): before/connect initialization 2013.03.11 18:31:40 LOG7[6023:0]: SSL state (connect): SSLv3 write client hello A 2013.03.11 18:33:45 LOG7[5849:0]: Service [https] accepted (FD=4) from 127.0.0.1:49032 2013.03.11 18:33:45 LOG7[6074:0]: Service [https] started 2013.03.11 18:33:45 LOG5[6074:0]: Service [https] accepted connection from 127.0.0.1:49032 2013.03.11 18:33:45 LOG6[6074:0]: connect_blocking: connecting 6.0.0.1:80 2013.03.11 18:33:45 LOG7[6074:0]: connect_blocking: s_poll_wait 6.0.0.1:80: waiting 10 seconds 2013.03.11 18:33:45 LOG5[6074:0]: connect_blocking: connected 6.0.0.1:80 2013.03.11 18:33:45 LOG5[6074:0]: Service [https] connected remote server from 61.200.100.100:40054 2013.03.11 18:33:45 LOG7[6074:0]: Remote socket (FD=17) initialized 2013.03.11 18:33:45 LOG7[6074:0]: SNI: sending servername: acs.qacafe.com 2013.03.11 18:33:45 LOG7[6074:0]: SSL state (connect): before/connect initialization 2013.03.11 18:33:45 LOG7[6074:0]: SSL state (connect): SSLv3 write client hello A 2013.03.11 18:34:22 LOG6[5920:0]: init_ssl: s_poll_wait: TIMEOUTbusy exceeded: sending reset 2013.03.11 18:34:22 LOG5[5920:0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2013.03.11 18:34:22 LOG7[5920:0]: Remote socket (FD=17) closed 2013.03.11 18:34:22 LOG7[5920:0]: Local socket (FD=4) closed 2013.03.11 18:34:22 LOG7[5920:0]: Service [https] finished 2013.03.11 18:34:22 LOG7[5920:0]: str_stats: 19 block(s), 877 data byte(s), 798 control byte(s) 2013.03.11 18:34:22 LOG7[5849:0]: Dispatching signals from the signal pipe 2013.03.11 18:34:22 LOG7[5849:0]: Processing SIGCHLD 2013.03.11 18:34:22 LOG7[5849:0]: Process 5920 finished with code 0 2013.03.11 18:34:22 LOG7[5849:0]: Signal pipe is empty 2013.03.11 18:35:15 LOG6[5973:0]: init_ssl: s_poll_wait: TIMEOUTbusy exceeded: sending reset 2013.03.11 18:35:15 LOG5[5973:0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2013.03.11 18:35:15 LOG7[5973:0]: Remote socket (FD=17) closed 2013.03.11 18:35:15 LOG7[5973:0]: Local socket (FD=4) closed 2013.03.11 18:35:15 LOG7[5973:0]: Service [https] finished 2013.03.11 18:35:15 LOG7[5973:0]: str_stats: 19 block(s), 877 data byte(s), 798 control byte(s) 2013.03.11 18:35:15 LOG7[5849:0]: Dispatching signals from the signal pipe 2013.03.11 18:35:15 LOG7[5849:0]: Processing SIGCHLD 2013.03.11 18:35:15 LOG7[5849:0]: Process 5973 finished with code 0 2013.03.11 18:35:15 LOG7[5849:0]: Signal pipe is empty 2013.03.11 18:36:40 LOG6[6023:0]: init_ssl: s_poll_wait: TIMEOUTbusy exceeded: sending reset 2013.03.11 18:36:40 LOG5[6023:0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2013.03.11 18:36:40 LOG7[6023:0]: Remote socket (FD=17) closed 2013.03.11 18:36:40 LOG7[6023:0]: Local socket (FD=4) closed 2013.03.11 18:36:40 LOG7[6023:0]: Service [https] finished 2013.03.11 18:36:40 LOG7[6023:0]: str_stats: 19 block(s), 877 data byte(s), 798 control byte(s) 2013.03.11 18:36:40 LOG7[5849:0]: Dispatching signals from the signal pipe 2013.03.11 18:36:40 LOG7[5849:0]: Processing SIGCHLD 2013.03.11 18:36:40 LOG7[5849:0]: Process 6023 finished with code 0 2013.03.11 18:36:40 LOG7[5849:0]: Signal pipe is empty 2013.03.11 18:38:45 LOG6[6074:0]: init_ssl: s_poll_wait: TIMEOUTbusy exceeded: sending reset 2013.03.11 18:38:45 LOG5[6074:0]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2013.03.11 18:38:45 LOG7[6074:0]: Remote socket (FD=17) closed 2013.03.11 18:38:45 LOG7[6074:0]: Local socket (FD=4) closed 2013.03.11 18:38:45 LOG7[6074:0]: Service [https] finished 2013.03.11 18:38:45 LOG7[6074:0]: str_stats: 19 block(s), 877 data byte(s), 798 control byte(s) 2013.03.11 18:38:45 LOG7[5849:0]: Dispatching signals from the signal pipe 2013.03.11 18:38:45 LOG7[5849:0]: Processing SIGCHLD 2013.03.11 18:38:45 LOG7[5849:0]: Process 6074 finished with code 0 2013.03.11 18:38:45 LOG7[5849:0]: Signal pipe is empty Normally under which circumstances this can happen. please help me totally clue less ... Rgds, Ramesh P

1 0

Stunnel SMP enabled?
by Michael Curran 06 Mar '13

06 Mar '13

I am running an Ubuntu system with Stunnel for 443 connections to an application on the back end. Essentially acting as a load balancer. When I look at the processor stats per processor (this is a 6-cpu system) I see cpu0 with almost 4% usage , compared to the other 5 processors hiting maybe .5% usage across the board. Is stunnel SMP enabled and passes processing amongst all 6 Procs? Or does it bind to one Proc and as long as its active it does all its work on just one PROC. We are having a lot of dropped connections when the overall system CPU hits about 23-25% .. which seems to me that it could be pushing just one CPU hard and the other 5 become basically idle. I am setting up to capture some SAR data to help confirm this effort, but it would if I knew that stunnel was setup for SMP processing.

1 0

Re: [stunnel-users] Stunnel as an "HTTPS to HTTPS" proxy
by Javier 05 Mar '13

05 Mar '13

On Tue, 05 Mar 2013 09:04:41 +0200 "jmwb(a)webmail.co.za" <jmwb(a)webmail.co.za> wrote: > Thank you for your response Javier. > > I now understand how to phrase what I am looking for. What I am looking for is > effectively an SSL Man-in-The-Middle (but please be assured that I am not > looking to build malware). However, I am still not certain from your response > that Stunnel can do this. Can the client-side handle SSL or does it only > support clear-text on the client side? > > jmwb Hi, in the example I gave to you is like this. Hope this can help you to understand how stunnel works in such scenario. 1. Web browser without SSL support. 2. It sends clear text to the IP:port where stunnel client is listening. 3. Stunnel in the client machine send ciphered text to the machine with Stunnel acting as server. 4. Stunnel in the server machine sends clear text to the web server. 5. The web server hasn't SSL support. 6. The communication is reversed to reply to the client side. With a diagram. Browser <> clear text <> stunnel<> ciphered <> stunnel <> clear text <> web server Of course, it is possible to make a MiTM attack between browser and stunnel and stunnel and web server at both sides, but not in between. To accomplish such attack you'll first need to access one of the machines and find such scenario. If both sides support SSL you don't need stunnel (unless one of the sides doesn't support SSL) and, therefore, all communications are ciphered P2P. No clear text. Except keyboard/mouse loggers in the client side. As said, is a secure tunnel, an SSL proxy. As you wish. Regards.

1 0