- stunnel-users - stunnel.org

stunnel 4.50 released
by Michal Trojnara 12 Dec '11

12 Dec '11

Dear Users, I have released version 4.50 of stunnel. The ChangeLog entry: Version 4.50, 2011.12.03, urgency: MEDIUM: * New features - Added Android port. - Updated INSTALL.FIPS. * Bugfixes - Fixed internal memory allocation problem in inetd mode. - Fixed FIPS mode on Microsoft Vista, Server 2008, and Windows 7. This fix required to compile OpenSSL FIPS-compliant DLLs with MSVC 9.0, instead of MSVC 10.0. msvcr100.dll was replaced with msvcr90.dll. GPL compatibility issues are explained in the GPL FAQ: http://www.gnu.org/licenses/gpl-faq.html#WindowsRuntimeAndGPL - POP3 server-side protocol negotiation updated to report STLS capability (thx to Anthony Morgan). Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.50.tar.gz: 933467009529bae4f338bb20e758e0ea20b0759130e7695ea2193c4f270e5eaf Best regards, Mike

4 18

Problem with sslv2 clients
by Markus Borst 09 Dec '11

09 Dec '11

Hi, we have a strange problem with newer stunnel versions (4.50 on windows), compared to older ones (known to work is version 4.35). The problem seems to be, that if a client sends a SSLv2 Helo message, the stunnel server simply resets the TCP connection, without trying to negotioate anything. Setup: Stunnel is used top provide ssl/tls for imap, Hobbit is used to monitor service availability. The Hobbit module to monitor imaps seems to try SSLv2 first, but also supports newer versions (SSLv3 and TLSv1). The ssl connection never gets established, stunnel sends a tcp RST, hobbit never retries. We can force some hobbit modules to use TLSv1 exclusively, but not all of them. We fear that some older mailclients will also have problems initiating a connection, so we keep stunnel 4.35 running for now. stunnel.conf: fips = no debug = 7 output = stunnel.log [imaps] accept = 130.83.174.1:993 connect = 127.0.0.1:143 cert = imap.xxx.company.yy.pem stunnel.log: 2011.12.09 14:55:12 LOG5[6820:2144]: Service imaps accepted connection from xxx.yyy.zzz.105:45294 2011.12.09 14:55:12 LOG3[6820:2144]: SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2011.12.09 14:55:12 LOG5[6820:2144]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2011.12.09 14:55:12 LOG7[6820:2144]: Service imaps finished (0 left) 2011.12.09 14:55:12 LOG7[6820:2144]: str_stats: 0 block(s), 0 data byte(s), 0 control byte(s) Wireshark Packet Trace (see attached image). What's wrong here? Shouldn't client and server negotiate the methods used? The client seems to offer TLS ("Version: TLS 1.0 ..."), but instead of negotiating, the server simply closes the connection. Greetings Markus Borst

1 0

NFS over sTunnel
by Elodie BOSSIER 08 Dec '11

08 Dec '11

Greetings again, I have a problem to mount a NFS share via my sTunnel. If i don't use the stunnel it's work : #mount -t nfs 188.165.214.229:/home /mnt/nfs/ #df -h [...] 188.165.214.229:/home 7.2T 12G 6.9T 1% /mnt/nfs #umount /mnt/nfs but if i use the stunnel client it's don't work : #mount -t nfs 127.0.0.1:/home /mnt/nfs/ (.......sleep....... and i need to ctrl+C to stop my command) The log into the serveur is : 2011.12.08 00:55:54 LOG7[12438:140256813074176]: nfs accepted FD=18 from 178.33.214.192:8671 2011.12.08 00:55:54 LOG7[12438:140256812631808]: nfs started 2011.12.08 00:55:54 LOG7[12438:140256812631808]: FD 18 in non-blocking mode 2011.12.08 00:55:54 LOG7[12438:140256812631808]: TCP_NODELAY option set on local socket 2011.12.08 00:55:54 LOG7[12438:140256812631808]: Waiting for a libwrap process 2011.12.08 00:55:54 LOG7[12438:140256812631808]: Acquired libwrap process #0 2011.12.08 00:55:54 LOG7[12438:140256812631808]: Releasing libwrap process #0 2011.12.08 00:55:54 LOG7[12438:140256812631808]: Released libwrap process #0 2011.12.08 00:55:54 LOG7[12438:140256812631808]: nfs permitted by libwrap from 178.33.214.192:8671 2011.12.08 00:55:54 LOG5[12438:140256812631808]: nfs accepted connection from 178.33.214.192:8671 2011.12.08 00:55:54 LOG7[12438:140256812631808]: SSL state (accept): before/accept initialization 2011.12.08 00:55:54 LOG7[12438:140256812631808]: SSL state (accept): SSLv3 read client hello A 2011.12.08 00:55:54 LOG7[12438:140256812631808]: SSL state (accept): SSLv3 write server hello A 2011.12.08 00:55:54 LOG7[12438:140256812631808]: SSL state (accept): SSLv3 write change cipher spec A 2011.12.08 00:55:54 LOG7[12438:140256812631808]: SSL state (accept): SSLv3 write finished A 2011.12.08 00:55:54 LOG7[12438:140256812631808]: SSL state (accept): SSLv3 flush data 2011.12.08 00:55:54 LOG7[12438:140256812631808]: SSL state (accept): SSLv3 read finished A 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 1 items in the session cache 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 0 client connects (SSL_connect()) 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 0 client connects that finished 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 0 client renegotiations requested 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 12 server connects (SSL_accept()) 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 12 server connects that finished 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 0 server renegotiations requested 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 9 session cache hits 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 0 external session cache hits 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 0 session cache misses 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 1 session cache timeouts 2011.12.08 00:55:54 LOG6[12438:140256812631808]: SSL accepted: previous session reused 2011.12.08 00:55:54 LOG7[12438:140256812631808]: FD 19 in non-blocking mode 2011.12.08 00:55:54 LOG6[12438:140256812631808]: connect_blocking: connecting 127.0.0.1:2049 2011.12.08 00:55:54 LOG7[12438:140256812631808]: connect_blocking: s_poll_wait 127.0.0.1:2049: waiting 10 seconds 2011.12.08 00:55:54 LOG5[12438:140256812631808]: connect_blocking: connected 127.0.0.1:2049 2011.12.08 00:55:54 LOG5[12438:140256812631808]: nfs connected remote server from 127.0.0.1:51193 2011.12.08 00:55:54 LOG7[12438:140256812631808]: Remote FD=19 initialized 2011.12.08 00:55:54 LOG7[12438:140256812631808]: TCP_NODELAY option set on remote socket ( my ctrl+C is here ) 2011.12.08 00:56:58 LOG7[12438:140256812631808]: SSL alert (read): warning: close notify 2011.12.08 00:56:58 LOG7[12438:140256812631808]: SSL closed on SSL_read 2011.12.08 00:56:58 LOG7[12438:140256812631808]: Socket write shutdown 2011.12.08 00:56:58 LOG7[12438:140256812631808]: Socket closed on read 2011.12.08 00:56:58 LOG7[12438:140256812631808]: SSL write shutdown 2011.12.08 00:56:58 LOG7[12438:140256812631808]: SSL alert (write): warning: close notify 2011.12.08 00:56:58 LOG6[12438:140256812631808]: SSL_shutdown successfully sent close_notify 2011.12.08 00:56:58 LOG5[12438:140256812631808]: Connection closed: 76 bytes sent to SSL, 164 bytes sent to socket 2011.12.08 00:56:58 LOG7[12438:140256812631808]: nfs finished (0 left) (End of the log server) My config client : [rquotad] accept = 1040 connect = 188.165.214.229:1041 [mountd] accept = 1048 connect = 188.165.214.229:1049 [nfs] accept = 2049 connect = 188.165.214.229:2050 [status] accept = 1039 connect = 188.165.214.229:1038 [portmapper] accept = 111 connect = 188.165.214.229:112 [nlockmgr] accept = 1047 connect = 188.165.214.229:1046 My config server : [rquotad] accept = 1041 connect = 1040 [mountd] accept = 1049 connect = 1048 [nfs] accept = 2050 connect = 2049 [status] accept = 1038 connect = 1039 [portmapper] accept = 112 connect = 111 [nlockmgr] accept = 1046 connect = 1047 Do you have an idea please ?

1 1

stunnel in client and server mode in same time
by Elodie BOSSIER 07 Dec '11

07 Dec '11

Greetings, I would like use stunnel in client & server mode but i don't find the way to do it, it's don't work My stunnel is a client of a remote MySQL server and a server of a NFS in local Do you have an idea please ?

4 3

FIPS_mode_set error
by Stefano Lodi 02 Dec '11

02 Dec '11

The problem referred to by Koenraad affects Windows 7 32 bit as well. Anyway fips=no fixes it.

2 1

FIPS on Win7
by james.poole＠rsa.com 01 Dec '11

01 Dec '11

It looks like there is a known issue with FIPS running on Windows 7 from the mail archives. Is there something I could do to help get this fixed? I was planning on using stunnel to allow a FIPS compliant transmission of data over the wire. Win7 - 32bit Output - From the console window: stunnel 4.49 on x86-pc-mingw32-gnu platform Compiled/running with OpenSSL 0.9.8r-fips 8 Feb 2011 Threading:WIN32 SSL:ENGINE,FIPS Auth:none Sockets:SELECT,IPv6 Reading configuration from file stunnel.conf FIPS_mode_set: 2D06906E: error:2D06906E:FIPS routines:FIPS_CHECK_INCORE_FINGERPRINT:fingerprint does not match Old Thread: http://www.stunnel.org/pipermail/stunnel-users/2011-November/003374.html Thanks for any help, James

2 1

Key and Certificate file issue!
by Hamid.Shahid＠sungard.com 30 Nov '11

30 Nov '11

Hi, I am trying to establish a SSL connection with a remote server on a random port 10170. I have got a public key from the server side. And I have sent my public key to the server. And I am trying to use my certificate file and the public key of the server like this. cert = sunPrimary.pem key = sunStunnel.pem But the problem is both the public key from server and my own certificate file starts with "-----BEGIN CERTIFICATE-----" by default. So now, if I don't change the "-----BEGIN CERTIFICATE-----" header of the my certificate to "-----BEGIN PRIVATE KEY-----" I get errors and if I change it to private key and make the public key of the server as certificate then I still get errors. Please let me know, how can I use the key and certificate together. Thanks. Kind Regards, Hamid Shahid

2 3

Pop3, CAPA before STLS (allow stunnel to work with android devices using proto pop3 option).
by Anthony Morgan 30 Nov '11

30 Nov '11

Hi, I'm running a pop3 server on a non-standard port and having stunnel listen on both 110 and 995 like so: [pop3_ssl] accept = 995 connect = ... [pop3_tls] accept = 110 connect = ... protocol = pop3 When connecting from an android device (2.3 on Nexus S at least), it confirms the server supports STLS using CAPA (and seemingly will not configure otherwise), so I modified protocol.c to announce support: < fdputline(c, c->local_wfd.fd, "+OK Stunnel capability list follows"); < fdputline(c, c->local_wfd.fd, "STLS"); < fdputline(c, c->local_wfd.fd, "."); --- > fdputline(c, c->local_wfd.fd, "-ERR Stunnel does not support capabilities"); It seems to me that there is no harm in this, because the RFC states that the client MUST recheck the servers capabilities with another CAPA command after starting TLS. It may be better to check the servers actual capabilities, add STLS to them and return that, but this does work. Any thoughts or comments? Tony Morgan --- Sent from Post.fm

1 0

FIPS_mode_set error
by Koenraad Lelong 29 Nov '11

29 Nov '11

Hi, I have an application which uses stunnel. Using stunnel 4.25 everything works fine. If I replace this with stunnel 4.49, I get an error, see the log : No limit detected for the number of clients make_sockets: s_socket#1: FD=228 allocated (blocking mode) make_sockets: s_socket#2: FD=232 allocated (blocking mode) make_sockets: s_accept: FD=236 allocated (non-blocking mode) stunnel 4.49 on x86-pc-mingw32-gnu platform Compiled/running with OpenSSL 0.9.8r-fips 8 Feb 2011 Threading:WIN32 SSL:ENGINE,FIPS Auth:none Sockets:SELECT,IPv6 Reading configuration from file stunnel.conf FIPS_mode_set: 2D06906E: error:2D06906E:FIPS routines:FIPS_CHECK_INCORE_FINGERPRINT:fingerprint does not match Server is down My stunnel.conf : cert = my.keycrt socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 3 CApath = certs CAfile = cacert.pem debug = 7 ; output = c:\Program Files\stunnel\stunnel.log client = yes [Server] accept = 6051 connect = server.example.com:8051 What am I doing wrong ? I'm trying this on Win7-64bit. On WinXP-32bit it works fine. Thanks for any clarification, Regards, Koenraad Lelong.

2 2

stunnel 4.49 released
by Michal Trojnara 28 Nov '11

28 Nov '11

Dear Users, I have released version 4.49 of stunnel. The ChangeLog entry: Version 4.49, 2011.11.28, urgency: MEDIUM: * Bugfixes - Missing Microsoft Visual C++ Redistributable (msvcr100.dll) required by FIPS-compliant OpenSSL library was added to the Windows installer. - A bug was fixed causing crashes on MacOS X and some other platforms. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.49.tar.gz: dcb0e1f21e9fcf56f4d67bc7a5a4ef8720845b61063a749953417db2616cb20d Best regards, Mike

1 0