- stunnel-users - stunnel.org

Re: [stunnel-users] Certificate
by Vitic Zikica (EXT) 12 Nov '14

12 Nov '14

HI, We are using stunnel to connect to some servers. The client informed us that we have to use new 2048 bit certificate ( XXXXX.crt ) Is it supported by stunnel ? how can I install it ? Thank you . Zikica VITIC BFI-DSI-FIS-ETRADING-ARCHITECTURE 47, quai d'Austerlitz 75648 Paris Cedex 13 Phone: +(33) 1 58 55 31 84 E-mail: flux(a)natixis.com<mailto:flux@natixis.com> L'integrite de ce message n'etant pas assuree sur internet, Natixis ne peut etre tenu responsable de son contenu. Toute utilisation ou diffusion non autorisee est interdite. Si vous n'etes pas destinataire de ce message, merci de le detruire et d'avertir l'expediteur. Ensemble, faisons un geste pour l'environnement : n'imprimons nos mails que si necessaire. The integrity of this message cannot be guaranteed on the Internet. Natixis can not therefore be considered responsible for the contents. Any unauthorized use or dissemination is prohibited. If you are not the intended recipient of this message, then please delete it and notify the sender. Let us mind the environment : let's print our mails only when necessary

1 0

Output to neither stdout nor stderr it seems
by Casper Thomsen 10 Nov '14

10 Nov '14

Hi stunnel-users I run stunnel4 in docker with the following config file: --- /etc/stunnel/stunnel.conf -------------- sslVersion = SSLv3 pid = /var/lib/stunnel4/stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 2 CApath = /etc/ssl/certs debug = notice output = /var/log/stunnel.log client = yes foreground = yes [foo] accept = 1234 connect = 127.0.0.1:2345 TIMEOUTclose = 3 --------------------------------------------------------- When I run stunnel and pipe stdout and stderr to /dev/null, I still get output: root@849b7eb3bbd0:/# /usr/bin/stunnel4 /etc/stunnel/stunnel.conf 2>/dev/null >/dev/null stunnel: LOG5[258:140421949949696]: stunnel 4.53 on x86_64-pc-linux-gnu platform stunnel: LOG5[258:140421949949696]: Compiled/running with OpenSSL 1.0.1e 11 Feb 2013 stunnel: LOG5[258:140421949949696]: Threading:PTHREAD SSL:+ENGINE+OCSP Auth:LIBWRAP Sockets:POLL+IPv6 stunnel: LOG5[258:140421949949696]: Reading configuration from file /etc/stunnel/stunnel.conf stunnel: LOG5[258:140421949949696]: Configuration successful ^Cstunnel: LOG3[258:140421949949696]: Received signal 2; terminating Complete shell output is attached. Any hints on what's happening? Kindly, -- Casper Thomsen

3 4

Truncated responses with stunnel >= 5.05
by Tuomas Silen 07 Nov '14

07 Nov '14

Hi there, After upgrading to stunnel 5.07 I've seen a lot of truncated http responses. I've tested different versions and 5.04 is the last one to work fine. There seems to be fixes to a similar issue in 5.05, but at least for me the result seems to be the opposite. I'm on Ubuntu 12.04. Looking at the logs, the log entries are identical except for one part, the amount of data sent to SSL: stunnel >= 5.05, not working: LOG3[31153]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing LOG5[31153]: Connection closed: 67584 byte(s) sent to SSL, 184 byte(s) sent to socket stunnel 5.04, works: LOG3[6248]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing LOG5[6248]: Connection closed: 113051 byte(s) sent to SSL, 184 byte(s) sent to socket It's worth noting that in both cases the closing happens after TIMEOUTclose has exceeded (probably because of a missing close notify?). In any case, apparently less data is sent to SSL and that's how it seems like; the end of the http responses get truncated. If everything's very fast (e.g. localhost connections only) the problem seems not to happen, not very often at least. With connections between two servers I've been able to reproduce it pretty much every time in my setup (stunnel -> haproxy -> apache -> unicorn). Undefining the POLLRDHUP or reverting the changes in 5.05 to src/client.c seem to fix the problem for me. Any ideas what would be a proper fix? Thanks! Best regards, Tuomas Silen

3 5

[BUG] SSL directory scan breaks cross-compilation
by John Spencer 05 Nov '14

05 Nov '14

it seems between 5.02 and 5.06 a "SSL directory scan" was introduced. for main_dir in /usr/local /usr/lib /usr/pkg /opt/local /opt /usr; do for sub_dir in /ssl /openssl /; do check_ssl_dir "$main_dir$sub_dir" && break 2 this ofc breaks cross-compilation. the concept of searching for a library directory is completely broken. if just adding -lssl -lcrypto to LDFLAGS doesnt find the openssl libraries at link time, the user's compiler toolchain is wrongly set up, and its not the job of a package to work around that by searching through a number of directories. it's the user's job to fix his toolchain by supplying the right -L paths in case he's got his library installed in a non-standard location. also, there's pkg-config (which supports crosscompilation via a PKG_CONFIG_SYSROOT_DIR env var) in case a library needs elaborate CFLAGS. --JS

2 6

slight fix for tools/stunnel.conf-sample.in
by Gleydson Soares 03 Nov '14

03 Nov '14

----- Forwarded message from Gleydson Soares <gsoares(a)gmail.com> ----- Date: Mon, 3 Nov 2014 17:00:38 -0300 From: Gleydson Soares <gsoares(a)gmail.com> To: stunnel-users(a)stunnel.org Cc: Marzena.Trojnara(a)mirt.net Subject: slight fix for tools/stunnel.conf-sample.in User-Agent: Mutt/1.5.23 (2014-03-12) Hi, I noticed unexpected characters in stunnel.conf-sample.in, stunnel 5.07. following diff fix that. --, Gleydson. ----- End forwarded message -----

1 0

stunnel 5.07 released
by Michal Trojnara 01 Nov '14

01 Nov '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.07 of stunnel. The ChangeLog entry: Version 5.07, 2014.11.01, urgency: MEDIUM: * New features - Several SMTP server protocol negotiation improvements. - Added UTF-8 byte order marks to stunnel.conf templates. - DH parameters are no longer generated by "make cert". The hardcoded DH parameters are sufficiently secure, and modern TLS implementations will use ECDH anyway. - Updated manual for the "options" configuration file option. - Added support for systemd 209 or later. - New --disable-systemd ./configure option. - setuid/setgid commented out in stunnel.conf-sample. * Bugfixes - Added support for UTF-8 byte order mark in stunnel.conf. - Compilation fix for OpenSSL with disabled SSLv2 or SSLv3. - Non-blocking mode set on inetd and systemd descriptors. - shfolder.h replaced with shlobj.h for compatibility with modern Microsoft compilers. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 505c6c63c4a20fc0cce8c35ef1ab7626c7b01071e3fca4ac6ea417afe8065309 stunnel-5.07.tar.gz 0e8d41a8102437d2c04a347bfe38ad80408fd2eb1451c559dcc7932ff2d09bd9 stunnel-5.07-installer.exe d3ced258ad35bea656ec178644d83e7d0b9fe8a2e4b2d6511e5c898ac9e6c7fc stunnel-5.07-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlRU61wACgkQ/NU+nXTHMtEwLwCdEprl4s5aleq7+MzK9JmYcnQ+ q+gAniP9aOtMuQtML9zcRPK0LY6Yb/3H =IVK/ -----END PGP SIGNATURE-----

1 0

Help needed to load hierarchical chain of certificates
by Rejuan Masud Masud 31 Oct '14

31 Oct '14

Help needed to load hierarchical chain of certificates(Root, CA) when stunnel running in server mode. We are trying to load. but only server signed certificate is loading which is assigned in cert as below, CAfile=/u01/stunnel/AMEX_all/CA.PEM cert=/u01/stunnel/AMEX_all/cert.pem HOW TO LOAD HIERARCHICAL CHAIN OF CERTIFICATES?

2 1

special characters in output path -> error
by "Dirk Löning [CSB-Bruns&Börjes GmbH ]" 31 Oct '14

31 Oct '14

It's seems to be a problem in the new stunnel version 5.06 When I use the USERPROFILE directory, which contains special characters like "ö", i get an error: *[!] Cannot open log file: C:\Users\Bl?d\CSB\SSL\SmtpLog(0).txt* Is this a bug or must i change something ? The configuration file " SmtpConfig(0).txt" : ; Configuration file output = C:\Users\Blöd\CSB\SSL\SmtpLog(0).txt taskbar = yes cert = C:\Users\Blöd\CSB\SSL\stunnel.pem client = yes [ssmtp] accept = 8801 connect = smtp.1und1.de:465 The log says: [ ] No limit detected for the number of clients [.] stunnel 5.06 on x86-pc-msvc-1500 platform [.] Compiled/running with OpenSSL 1.0.1j-fips 15 Oct 2014 [.] Threading:WIN32 Sockets:SELECT,IPv6 SSL:ENGINE,OCSP,FIPS [ ] errno: (*_errno()) [.] Reading configuration from file C:\Users\Blöd\CSB\SSL\SmtpConfig(0).txt [.] FIPS mode disabled [ ] Compression disabled [ ] GUI message loop initialized [ ] Snagged 64 random bytes from C:/.rnd [ ] Wrote 0 new random bytes to C:/.rnd [ ] PRNG seeded successfully [ ] Initializing service [ssmtp] [ ] Loading cert from file: C:\Users\Bl?d\CSB\SSL\stunnel.pem [ ] Loading key from file: C:\Users\Bl?d\CSB\SSL\stunnel.pem [ ] Private key check succeeded [ ] SSL options: 0x03000004 (+0x03000000, -0x00000000) [.] Configuration successful [ ] Listening file descriptor created (FD=456) [ ] Service [ssmtp] (FD=456) bound to 0.0.0.0:8801 *[!] Cannot open log file: C:\Users\Bl?d\CSB\SSL\SmtpLog(0).txt* [ ] Closing service [ssmtp] [ ] Service [ssmtp] closed (FD=456) [ ] Service [ssmtp] closed [!] Server is down greetings dirk

1 0

Re: [stunnel-users] Exchange Online - SSLv3 and Sophos UTM 120 firewall update
by Michal Trojnara 31 Oct '14

31 Oct '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Stephen Hogan wrote: > 2014.10.28 14:35:55 LOG7[4156]: SSL state (connect): SSLv3 write > client hello A [cut] > I have a basic (shaky) understanding that the "handshake" for TLS > does downgrade to SSLv3 if newer versions of TLS fail, but I am > wondering if I apply the update recommended on the firewall, will > this cut the communication for the SMTP relay, the way I am using > it? The debug messages produced by stunnel can sometimes be confusing. They are intended to be helpful to developers, and not end-users. OpenSSL implements the SSL/TLS/DTLS protocols with three separate finite state machines: SSLv2, SSLv3, and DTLS1. http://en.wikipedia.org/wiki/Automata-based_programming All TLS protocols use the SSLv3 state machine, thus the state name does not reflect the actual protocol being negotiated. See the source for details: https://github.com/openssl/openssl/blob/master/ssl/ssl_stat.c Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlRREk8ACgkQ/NU+nXTHMtGLPwCgiA1tfq7LhNC600d5eVbWugLk coUAn1mGA4mWBAchUu5+d6nYfxe0isgr =p4hH -----END PGP SIGNATURE-----

2 1

Configuring Stunnel 4.1 to use TLS
by Deepak Subbanarasimha 30 Oct '14

30 Oct '14

Hello, I had some questions on Stunnel version for Windows. 1. Does Stunnel 4.1 support TLS? 2. If yes, what version of TLS does it support(TLS1.0, TLS1,1 or TLS 1.2 ) 3. How can I tell if an Stunnel instance is using SSL or TLS 4. Does anyone have instructions to configure Stunnel 4.1 to use TLS 5. Can you share an example of stunnel.conf with TLS turned on Thanks, DEEPAK SUBBANARASIMHA Kewill DDI: +00 (1) 978 482 2625 Email: deepak.subbanarasimha(a)kewill.com<mailto:deepak.subbanarasimha@kewill.com> www.kewill.com<http://www.kewill.com/> Tel: +00 (1) 978 482 2500 | Fax: +00 (1) 978 482 2501 1 Executive Drive, Chelmsford, MA 01824, USA IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately notify us by telephone at (978) 482-2500 and return the original message to us at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code. Thank You. Copyright (c) 2013 by Kewill Inc IMPORTANT NOTICE: This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately return the original message to the sender at the listed email address. In accordance with Kewill policy, emails sent and received may be monitored. Although Kewill takes reasonable precautions to minimize the risk, Kewill accepts no responsibility for any loss or damage should this email contain any virus, or similar destructive or mischievous code.

1 0

Stunnel server as transparent proxy
by Derek Cole 28 Oct '14

28 Oct '14

Hello, Is it possible to use stunnel server as a transparent proxy? I was digging through the manpage and I see the transparent= option. What I would like to do is have an stunnel client connect to the stunnel server, and once traffic is at the server, go to the original destination that the traffic going to the stunnel client was destined for. I.E. Can I have firefox proxy to my stunnel client, which connects to my stunnel server, and then that traffic goes to whatever website the end user was trying to hit in firefox? My Stunnel server is on a CentOS box: [root@CentOSTunTest ~]# uname -a Linux CentOSTunTest 2.6.32-431.el6.x86_64 #1 SMP Fri Nov 22 03:15:09 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux And my stunnel.conf foreground = yes > debug = 7 > options = NO_SSLv2 > fips = no > output=/usr/local/etc/stunnel/stunnel.log > > > [https] > cert=/usr/local/etc/stunnel/stunnel.pem > accept = 443 > connect = 80 > > [Internet] > cert=/usr/local/etc/stunnel/stunnel.pem > sni = https:Internet > transparent=destination > So basically in the transparent option is Internet is what I am wondering if it works the way I expect. I see this in the log file: 2014.10.23 09:57:05 LOG3[11414]: setsockopt SO_ORIGINAL_DST: Protocol not available (92) 2014.10.23 09:57:05 LOG5[11414]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket I see this in the stunnel manpage: For a connect target installed on the same host: /sbin/iptables -t nat -I OUTPUT -p tcp --dport <redirected_port> \ -m ! --uid-owner <stunnel_user_id> \ -j DNAT --to-destination <local_ip>:<stunnel_port> For a connect target installed on a remote host: /sbin/iptables -I INPUT -i eth0 -p tcp --dport <stunnel_port> -j ACCEPT /sbin/iptables -t nat -I PREROUTING -p tcp --dport <redirected_port> \ -i eth0 -j DNAT --to-destination <local_ip>:<stunnel_port> What does it mean "for a connect target installed on the same host" I thought transparent meant I was not using a connect target except the original destination. Does this mean I should implement the IPTables for a remote host, since I want my client to just reach the internet? Thanks for the help in advance!

2 4

VS 2010 compilation issue due to shfolder.h
by nnposter＠users.sourceforge.net 28 Oct '14

28 Oct '14

I am running into a compilation problem on MS C/C++ 16 (aka VS 2010). Specifically, I am getting the following error due to an include that has been added in 5.01: C:\Program Files (x86)\Microsoft SDKs\Windows\v7.0A\include\shfolder.h(14) : fatal error C1189: #error : shfolder.h/shfolder.lib provide platform independence with versions prior to Windows 2000. Use shlobj.h/shell32.lib if targetting Windows 2000 or higher. The following primitive patch seems to address the issue: --- common.h.orig 2014-10-02 04:12:48.000000000 -0600 +++ common.h 2014-10-27 16:02:22.536329500 -0600 @@ -228,7 +228,13 @@ #include <windows.h> #include <process.h> /* _beginthread */ + +#if defined _MSC_VER && _MSC_VER >= 1600 +#include <shlobj.h> /* SHGetFolderPath */ +#else #include <shfolder.h> /* SHGetFolderPath */ +#endif + #include <tchar.h> #include "resources.h" Cheers, nnposter

2 1

stunnel-5.06 fails to build against systemd 215
by Anthony G. Basile 24 Oct '14

24 Oct '14

Hi everyone, We hit a bug in stunnel-5.05 and it continues in 5.06. The problem comes from systemd which moved sd_listen_fds() form libsystemd-daemon.so to libsystemd.so. However, stunnel's configure.ac still has AC_SEARCH_LIBS([sd_listen_fds], [systemd-daemon]) For backwards compatibility, this should probably be AC_SEARCH_LIBS([sd_listen_fds], [systemd], [], [ AC_SEARCH_LIBS([sd_listen_fds], [systemd-daemon]) ]) or similar. Please refer to our downstream bug: https://bugs.gentoo.org/show_bug.cgi?id=525234' Thanks. -- Anthony G. Basile, Ph. D. Chair of Information Technology D'Youville College Buffalo, NY 14201 (716) 829-8197

2 5

stunnel service leaves stale connections to rsync on the server side
by Polyack, Steve 22 Oct '14

22 Oct '14

Hi, We've been running a rsync service over stunnel for some time now. After upgrading our environment, which involved moving from an old version of Linux to FreeBSD 9.3, and from stunnel-4.29 to stunnel-5.06, we've had a problem pop up. Ever since switching over, we see that rsync daemon processes slowly build up over time on our server, each consuming 100% CPU. The vast majority of our clients are working just fine, and the problematic rsync processes just seem to have been dead/aborted connections from the clients (which are using wireless aircard, so connectivity can be shotty). A quick 'truss' on the process shows they are doing nothing but sitting there and read()'ing in a loop indefinitely: # truss -p 14689 | head read(6,0x7fffffff8240,1) = 0 (0x0) read(6,0x7fffffff8240,1) = 0 (0x0) read(6,0x7fffffff8240,1) = 0 (0x0) read(6,0x7fffffff8240,1) = 0 (0x0) read(6,0x7fffffff8240,1) = 0 (0x0) read(6,0x7fffffff8240,1) = 0 (0x0) Furthermore, the connection appears to be closed: # sockstat -4 | grep 14689 root rsync 14689 3 tcp4 127.0.0.1:873 127.0.0.1:27724 netstat -an | grep 27724 netstat: kvm not available: /dev/mem: No such file or directory tcp4 0 0 127.0.0.1.873 127.0.0.1.27724 CLOSED Looking through the stunnel logs, it looks like no data was ever really passed (perhaps the client gave up?): 2014.10.22 10:45:52 LOG7[34384941056]: Service [rsync] started 2014.10.22 10:45:52 LOG5[34384941056]: Service [rsync] accepted connection from 1.1.1.1:63095 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): before/accept initialization 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 read client hello A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 write server hello A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 write certificate A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 write server done A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 flush data 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 read client key exchange A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 read finished A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 write change cipher spec A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 write finished A 2014.10.22 10:45:52 LOG7[34384941056]: SSL state (accept): SSLv3 flush data 2014.10.22 10:45:52 LOG7[34384941056]: 41 items in the session cache 2014.10.22 10:45:52 LOG7[34384941056]: 0 client connects (SSL_connect()) 2014.10.22 10:45:52 LOG7[34384941056]: 0 client connects that finished 2014.10.22 10:45:52 LOG7[34384941056]: 0 client renegotiations requested 2014.10.22 10:45:52 LOG7[34384941056]: 110 server connects (SSL_accept()) 2014.10.22 10:45:52 LOG7[34384941056]: 107 server connects that finished 2014.10.22 10:45:52 LOG7[34384941056]: 0 server renegotiations requested 2014.10.22 10:45:52 LOG7[34384941056]: 66 session cache hits 2014.10.22 10:45:52 LOG7[34384941056]: 0 external session cache hits 2014.10.22 10:45:52 LOG7[34384941056]: 32 session cache misses 2014.10.22 10:45:52 LOG7[34384941056]: 0 session cache timeouts 2014.10.22 10:45:52 LOG6[34384941056]: No peer certificate received 2014.10.22 10:45:52 LOG6[34384941056]: SSL accepted: new session negotiated 2014.10.22 10:45:52 LOG6[34384941056]: Negotiated SSLv3 ciphersuite AES256-SHA (256-bit encryption) 2014.10.22 10:45:52 LOG6[34384941056]: Compression: null, expansion: null 2014.10.22 10:45:52 LOG6[34384941056]: s_connect: connecting 127.0.0.1:873 2014.10.22 10:45:52 LOG5[34384941056]: s_connect: connected 127.0.0.1:873 2014.10.22 10:45:52 LOG5[34384941056]: Service [rsync] connected remote server from 127.0.0.1:27724 2014.10.22 10:45:52 LOG7[34384941056]: Remote socket (FD=11) initialized 2014.10.22 11:01:12 LOG3[34384941056]: SSL_read: Connection reset by peer (54) 2014.10.22 11:01:12 LOG5[34384941056]: Connection reset: 56 byte(s) sent to SSL, 56 byte(s) sent to socket 2014.10.22 11:01:12 LOG7[34384941056]: Remote socket (FD=11) closed 2014.10.22 11:01:12 LOG7[34384941056]: Local socket (FD=10) closed 2014.10.22 11:01:12 LOG7[34384941056]: Service [rsync] finished (4 left) The clients are generally field units running stunnel versions in the 4.x range. Unfortunately, updating them is not an easy task and is not really under my control. Either way, this seems like a server side issue, and possibly an issue with rsync (we're running 3.1.0). Has anyone run into anything like this before? Does anyone have any suggestions for additional debugging we can do to try to pinpoint the problem? We are going to try rolling back to stunnel-4.29 to see if the problem still occurs there on the new system. Thanks, Steve

1 1

SSLv3 connections vulnerable in my environment?
by Fritz Gschwendner 21 Oct '14

21 Oct '14

Hello, I have a pretty standard stunnel server configuration with verify = 2 and clients, that don't speak TLS and can't easily be upgraded to support TLS. So disabling SSLv3 leads to handshake errors, I need to leave it enabled for now. The SSL connection is always renegotiated, a proprietary protocol is used inside SSL, and clients can be considered safe. Can the poodle security flaw realistically be used by a man in the middle to decrypt packets send over such an SSLv3 connection? If so, is there any other way to protect against the attack? Thank you.

1 0

Trouble after disabling SSLv3 (another one)
by Koenraad Lelong 21 Oct '14

21 Oct '14

Hi, Last week I disabled SSLv3 on my stunnel-server. I thought I tested it, but this morning I had to use it and I couldn't get access. Now at the office I tried again, with the same result. After enabling SSLv3 again I could get access. So my configuration seems wrong. My server runs Ubuntu 12.04 LTS, stunnel is 4.42-1ubuntu (stock ubuntu). This is my stunnel.conf (tunnels removed/edited) : client = no setuid = stunnel4 setgid = stunnel4 pid = /var/run/stunnel4/stunnel4.pid debug = debug output = /var/log/stunnel4/stunnel.log options = NO_SSLv2 options = NO_SSLv3 socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 3 CApath = /etc/stunnel-certs CAfile = /etc/stunnel/cacert.pem cert = /etc/stunnel/lace3.keycrt [tunnel vnc] accept = 12345 connect = remotehost:5901 The log on the server : 2014.10.21 08:32:15 LOG7[28587:140281088546560]: Service tunnel vnc accepted FD=0 from 192.168.1.14:55708 2014.10.21 08:32:15 LOG7[28587:140281088538368]: Service tunnel vnc started 2014.10.21 08:32:15 LOG7[28587:140281088538368]: Option TCP_NODELAY set on local socket 2014.10.21 08:32:15 LOG7[28587:140281088538368]: Waiting for a libwrap process 2014.10.21 08:32:15 LOG7[28587:140281088538368]: Acquired libwrap process #0 2014.10.21 08:32:15 LOG7[28587:140281088538368]: Releasing libwrap process #0 2014.10.21 08:32:15 LOG7[28587:140281088538368]: Released libwrap process #0 2014.10.21 08:32:15 LOG7[28587:140281088538368]: Service tunnel vnc permitted by libwrap from 192.168.1.14:55708 2014.10.21 08:32:15 LOG5[28587:140281088538368]: Service tunnel vnc accepted connection from 192.168.1.14:55708 2014.10.21 08:32:15 LOG7[28587:140281088538368]: SSL state (accept): before/accept initialization 2014.10.21 08:32:15 LOG7[28587:140281088538368]: SSL alert (write): fatal: handshake failure 2014.10.21 08:32:15 LOG3[28587:140281088538368]: SSL_accept: 1408A10B: error:1408A10B:SSL routines:SSL3_GET_CLIENT_HELLO:wrong version number 2014.10.21 08:32:15 LOG5[28587:140281088538368]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2014.10.21 08:32:15 LOG7[28587:140281088538368]: Service tunnel vnc finished (0 left) 2014.10.21 08:32:15 LOG7[28587:140281088538368]: str_stats: 0 block(s), 0 byte(s) The log on the client (opensuse 13.1) : 2014.10.21 08:47:47 LOG7[978:140089725433664]: local socket: FD=0 allocated (non-blocking mode) 2014.10.21 08:47:47 LOG7[978:140089725433664]: Service tunnel vnc accepted FD=0 from 127.0.0.1:39609 2014.10.21 08:47:47 LOG7[978:140089725630208]: Service tunnel vnc started 2014.10.21 08:47:47 LOG7[978:140089725630208]: Option TCP_NODELAY set on local socket 2014.10.21 08:47:47 LOG7[978:140089725630208]: Waiting for a libwrap process 2014.10.21 08:47:47 LOG7[978:140089725630208]: Acquired libwrap process #0 2014.10.21 08:47:47 LOG7[978:140089725630208]: Releasing libwrap process #0 2014.10.21 08:47:47 LOG7[978:140089725630208]: Released libwrap process #0 2014.10.21 08:47:47 LOG7[978:140089725630208]: Service tunnel vnc permitted by libwrap from 127.0.0.1:39609 2014.10.21 08:47:47 LOG5[978:140089725630208]: Service tunnel vnc accepted connection from 127.0.0.1:39609 2014.10.21 08:47:47 LOG7[978:140089725630208]: remote socket: FD=1 allocated (non-blocking mode) 2014.10.21 08:47:47 LOG6[978:140089725630208]: connect_blocking: connecting 192.168.0.30:12345 2014.10.21 08:47:47 LOG7[978:140089725630208]: connect_blocking: s_poll_wait 192.168.0.30:13001: waiting 10 seconds 2014.10.21 08:47:47 LOG5[978:140089725630208]: connect_blocking: connected 192.168.0.30:12345 2014.10.21 08:47:47 LOG5[978:140089725630208]: Service tunnel vnc connected remote server from 192.168.1.14:55770 2014.10.21 08:47:47 LOG7[978:140089725630208]: Remote FD=1 initialized 2014.10.21 08:47:47 LOG7[978:140089725630208]: Option TCP_NODELAY set on remote socket 2014.10.21 08:47:47 LOG7[978:140089725630208]: SSL state (connect): before/connect initialization 2014.10.21 08:47:47 LOG7[978:140089725630208]: SSL state (connect): SSLv3 write client hello A 2014.10.21 08:47:47 LOG7[978:140089725630208]: SSL alert (read): fatal: handshake failure 2014.10.21 08:47:47 LOG3[978:140089725630208]: SSL_connect: 14094410: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure 2014.10.21 08:47:47 LOG5[978:140089725630208]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2014.10.21 08:47:47 LOG7[978:140089725630208]: Service tunnel vnc finished (0 left) 2014.10.21 08:47:47 LOG7[978:140089725630208]: str_stats: 0 blocks, 0 bytes Am I missing something ? I would like to stay with Ubuntu's standard packages. Thanks for any advice. Koenraad Lelong.

2 4

STOP REMOVING OLD RELEASE TARBALLS FOR GODS SAKE
by John Spencer 21 Oct '14

21 Oct '14

hello, 5 days ago i noticed that my stunnel source package was *again* broken because some clown removed the previous version's download from the download server, so i bite the bullet and upgraded to latest (5.05). today, doing a testbuild i got a again a 404 and was forced again to update to latest stunnel download. this is fucking frustrating. i really have better things to do than to update my package recipes whenever a new stunnel release comes out (and that's not just me). SO COULD YOU PLEASE FINALLY LEAVE YOUR PAST RELEASES ON THE DOWNLOAD MIRROR LIKE ANYONE ELSE DOES ? THANKS. and no, even if a security flaw in non-latest was discovered that's still no reason to silently delete the old tarballs. thanks, --JS P.S. the latest stunnel still does not link against libreSSL instead of openssl, due to bogus usage of RAND_egd() as mentioned a quarter year ago in my blog: http://devsonacid.wordpress.com/2014/07/12/how-compatible-is-libressl/

4 3

Trouble after disabling SSLv3
by Dion Kant 19 Oct '14

19 Oct '14

Dear list, I have stunnel running in a configuration where we use it to connect to a webserver over https while adding client certificates to the requests. This worked fine until recently on the (Apache) webserver SSLv3 was disabled. I installed the latest version of stunnel today (stunnel-5.07b2 <https://www.stunnel.org/downloads/beta/stunnel-5.07b2.tar.gz>) but that did not fix the problem. Now STunnel tries to negotiate a https connection using the TLSv1.2 and I found that because of this Apache does not like the content of the Host variable in the HTTP header which is different from what Apache is expectingto be. With SSLv3 this was not an issue. As a result I get a "HTTP/1.1 400 Bad Request" from the webserver. In my configuration I cannot (easily) apply some form of split DNS to get the hostname correct in the http header already from the client connecting to the stunnel service. I tested using curl sending a request through stunnel to the web server and verified that when I modified the Host field in the request header it does work. To my opinion it is stunnel setting up the HTTPS connection to the webserver and stunnel should take care of setting the correct Host field in the request header. Is there a way to let stunnel take care of setting the correct info in the HTTP header? Best regards, Dion Kant

1 0

Re: [stunnel-users] stunnel 5.06 released
by Dominyk Tiller 16 Oct '14

16 Oct '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi Mike, Latest build seems to be broken for me on OS X 10.10. If it matters here, since the error is SSL related, I'm building against OpenSSL 1.0.1j which is configured without ssl2 ciphers but with ssl3 ciphers enabled. This is the error: libtool: link: clang -pthread -fstack-protector -fPIE -g -O2 -Wall - -Wextra -Wno-long-long -pedantic -o stunnel stunnel-str.o stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-fd.o stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o stunnel-ui_unix.o - -L/usr/local/opt/openssl/lib64 -L/usr/local/opt/openssl/lib -lssl - -lcrypto -lz -lpthread -pthread Undefined symbols for architecture x86_64: "_SSLv2_client_method", referenced from: _parse_service_option in stunnel-options.o "_SSLv2_server_method", referenced from: _parse_service_option in stunnel-options.o ld: symbol(s) not found for architecture x86_64 clang: error: linker command failed with exit code 1 (use -v to see invocation) make[1]: *** [stunnel] Error 1 make[1]: *** Waiting for unfinished jobs.... libtool: link: ( cd ".libs" && rm -f "libstunnel.la" && ln -s "../libstunnel.la" "libstunnel.la" ) make: *** [install-recursive] Error 1 Hope that's useful. Let me know if you need more. Dom -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJUP8tNAAoJEIclJNuddDJsePEP/0tEy5rKsOzpORpawOFDpZAD KaemUgVKbaWpphkldp9tPFsaCRhQrqQPNIjfaUGb/mSAe3mAoV69P1rXYlMQiGne oaCa/p35y1SYYq0RHzflPhlDb/avfz8F5cQsXb1vA3bec8vVyTEjsIjj/pSH+him EysnGZNG61xcD55IOWT4LbcfiBO+L0iwQn4w/fQXqATmMHeYKde95d1t3DCx7Rvw t80hOw7c6xZzkYOPoXZpWPBhBESzifkE3JiapNAtRjyj9EZK+1gukjOa5EB7vrz8 pdpI65lwIAk9Grv8IT2jHIJcj03H7zPzhXoeLJl/OWKTqHVc8X7naT1Tg5kwKWdG CG0keA9hyXHhhSn763OPkKeMG7Ab31IRAlIT3ajEa2o+57KFBb5KVgHn/RWsr+0g Yzv5FjM5ZJjH02Qj/9QqjlhzzdUQDNPGpNk72UKqXbnz3xv8JoQX16PMeUYrgH6h ZjXrtcBh6CXQghyDY1D9m2xFKIVAIcfcAm6XgV6yUawfL76LL/WbreEbCmBlkRHI p17BT7TUE4pfeSpxdfMmIPgMlaAragfT+NYw4/l7XgEqi3sjaf3IpupJ4hjqbl/F dt6W/VCILDW3lnSnbWwWy/7rantCQZldbg4xWsxDMMx1oinwOgk+l92I+9Qas+8z MnuTZ052UiJ9Agn+ZxQs =i1GY -----END PGP SIGNATURE-----

1 0

Window not updating (win32 5.05)
by Javier 16 Oct '14

16 Oct '14

Hi, just reporting that with the latest version the window doesn't get updated when there is activity. It is static. You have to minimize to tray and restore again to view the activity, what, almost, is actually as fast as have a look to the log :/ Can anyone confirm? Regards. P.S.: happening on 2k and XP. Haven't tested any NT6 version.

2 3

error compiling stunnel 5.06
by Laura Fried 15 Oct '14

15 Oct '14

/tmp/stunnel-5.06/src/options.c:2123: undefined reference to `SSLv2_client_method' /tmp/stunnel-5.06/src/options.c:2127: undefined reference to `SSLv2_server_method' collect2: ld returned 1 exit status make[2]: *** [stunnel] Error 1 make[2]: Leaving directory `/tmp/stunnel-5.06/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/tmp/stunnel-5.06/src' make: *** [all-recursive] Error 1 Please advise. -- Laura J. Fried Internal Revenue Service Online Fraud Detection and Prevention 202-556-2612 (Voice) 202-552-1226 (Fax) ofdp-laura (Skype)

2 2

stunnel 5.06 released
by Michal Trojnara 15 Oct '14

15 Oct '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Users, I have released version 5.06 of stunnel. This is a security bugfix release. Update is recommended. The ChangeLog entry: Version 5.06, 2014.10.15, urgency: HIGH: * Security bugfixes - OpenSSL DLLs updated to version 1.0.1j. https://www.openssl.org/news/secadv_20141015.txt - The insecure SSLv2 protocol is now disabled by default. It can be enabled with "options = -NO_SSLv2". - The insecure SSLv3 protocol is now disabled by default. It can be enabled with "options = -NO_SSLv3". - Default sslVersion changed to "all" (also in FIPS mode) to autonegotiate the highest supported TLS version. * New features - Added missing SSL options to match OpenSSL 1.0.1j. - New "-options" commandline option to display the list of supported SSL options. * Bugfixes - Fixed FORK threading build regression bug. - Fixed missing periodic Win32 GUI log updates. Home page: https://www.stunnel.org/ Download: https://www.stunnel.org/downloads.html SHA-256 hashes: 098c2b6db0793ea4fa5b6767ce6ef1853e9f6cc2f32133024be55f6a460b1a40 stunnel-5.06.tar.gz 55afb3013406da1afcc1ab7ccc25bb1c66605ca3e004636a6b49cac555cb4d09 stunnel-5.06-installer.exe a1741eb8bb050d3d29515ddef46a0a6828372a991f2658995dee1e06af8c05c8 stunnel-5.06-android.zip Best regards, Mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlQ+4v4ACgkQ/NU+nXTHMtFwNwCgvZyndOwkAQqmsWnuL7DcRAPq lSIAnig726aVMrFzFAoQzKXxxmWo/Qo9 =ok3p -----END PGP SIGNATURE-----

1 0

Nasty SSL 3.0 vulnerability to be revealed soon
by 541401＠gmail.com 14 Oct '14

14 Oct '14

Nasty SSL 3.0 vulnerability to be revealed soon http://www.theregister.co.uk/2014/10/14/nasty_ssl_30_vulnerability_to_drop_…

1 0

Mongo Replication using Stunnel
by Danny Hernandez 12 Oct '14

12 Oct '14

Hello, I am trying to create an ssl connection between two mongodb instances both using the mongodb community version. Both instances need to communicate with one another as they need to be able to ping each other. I am getting this error when attempting to connect to Instance A from Instance B and vice versa: connect_blocking: connect <ip address>:27027: Connection refused (111) I have two conf files on each server (one for client and one for server). I am using the latest version of stunnel and the latest version of mongodb. Here are my conf files: *SERVER A* cert=/etc/stunnel/stunnel.pem key = /etc/stunnel/stunnel.pem verify = 2 CAfile = /etc/stunnel/stunnel.pem pid = /client.pid output = /var/log/stunnel4/stunnel.log debug = 7 sslVersion = all [mongo-replication] accept = 27037 connect = 127.0.0.1:27017 retry = yes* * *Server B *cert=/etc/stunnel/stunnel.pem key = /etc/stunnel/stunnel.pem verify = 2 CAfile = /etc/stunnel/stunnel.pem pid = /client.pid output = /var/log/stunnel4/stunnel.log debug = 7 sslVersion = all [mongo-replication] accept = 27027 connect = 127.0.0.1:27027 retry = yes *Client A *cert=/etc/stunnel/client.pem pid = /client.pid output = /var/log/stunnel4/client.log debug = 7 client = yes [mongo-replication] accept = 27037 connect = dbtest2:27027 retry = yes *Client B *cert=/etc/stunnel/client.pem pid = /client.pid output = /var/log/stunnel4/client.log debug = 7 client = yes [mongo-replication] accept = 27037 connect = dbtest1:27037 retry = yes Could someone please assist with troubleshooting the error? Thank you! -- Thank you, Danny Hernandez

1 0

num_clients Undeclared
by Abdelkader Chelouah 12 Oct '14

12 Oct '14

Hello, Build of stunnel 5.04 and 5.05 failed on RHEL 6.2 (prior to 5.04, the build succeded) ... gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/logiciels/postgresql/9.3/lib/openssl/include -DLIBDIR='"/logiciels/postgresql/9.3/lib/stunnel/lib/stunnel"' -DCONFDIR='"/logiciels/postgresql/9.3/lib/stunnel/etc/stunnel"' -I/logiciels/postgresql/9.3/include -I/logiciels/postgresql/9.3/lib/openssl/include -I/logiciels/postgresql/9.3/lib/krb5/include -I/logiciels/postgresql/9.3/lib/cyrus-sasl/include -pthread -fstack-protector -fPIE -O3 -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -march=nocona -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-stunnel.o -MD -MP -MF .deps/stunnel-stunnel.Tpo -c -o stunnel-stunnel.o `test -f 'stunnel.c' || echo './'`stunnel.c stunnel.c: In function ‘main_configure’: stunnel.c:150: error: ‘num_clients’ undeclared (first use in this function) stunnel.c:150: error: (Each undeclared identifier is reported only once stunnel.c:150: error: for each function it appears in.) stunnel.c: At top level: stunnel.c:533: warning: expected [error|warning|ignored] after ‘#pragma GCC diagnostic’ stunnel.c:534: warning: unknown option after ‘#pragma GCC diagnostic’ kind stunnel.c: In function ‘signal_post’: stunnel.c:538: warning: ignoring return value of ‘write’, declared with attribute warn_unused_result stunnel.c: At top level: stunnel.c:541: warning: expected [error|warning|ignored] after ‘#pragma GCC diagnostic’ make[2]: *** [stunnel-stunnel.o] Error 1 make[2]: Leaving directory `/ESA/build/stunnel-5.05/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/ESA/build/stunnel-5.05/src' make: *** [all-recursive] Error 1 It seems that the 'num_clients' variable is undeclared in the main_configure function. Thank you

2 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users