- stunnel-users - stunnel.org

Need help building FIPS capable Stunnel for Windows CE
by Bao, Robert 18 Oct '12

18 Oct '12

I am attempting to build a FIPS-capable Openssl for an XScale processor (ARMV4I) running under Windows CE 5.0 (using openssl-1.0.1c and openssl-fips-2.0.1), that was successful. Then I built the latest Stunnel (just released few days ago) with FIPS option turned on. The build appears to complete successfully. However, at run-time, entering FIPS mode fails and the following messages are produced: error stack: 2D079089 : error:2D079089:FIPS routines:fips_pkey_signature_test:test failure FIPS_mode_set: 2D06B06F: error:2D06B06F:FIPS routines:FIPS_check_incore_fingerprint:fingerprint does not match I have reviewed the build instructions outlined in the OpenSSL FIPS user guide carefully and believe all the build instructions have been adhered to. What needs to be changed for the signature to be properly embedded? Robert Bao Tyco

2 2

Unable to Stop Service - Windows XP SP3 x86
by Thomas Eifert 16 Oct '12

16 Oct '12

I just uninstalled Stunnel version 4.53 and replaced it with 4.54 on my Windows XP SP3 x86 machine. What I generally do is stop the service, uninstall the service, then uninstall Stunnel prior to installing the new version. When I attempted to stop the version 4.53 service via the start menu shortcut, I was unsuccessful; all that happened was that the Stunnel status/log window would launch. This was repeatable. Likewise, when I attempted to stop it from an elevated command prompt using stunnel.exe -stop, the result was the same. I am administrator on this machine. I launched services.msc, and was able to stop it from there without any difficulty. After I installed 4.54, just to see what would happen, I attempted to stop the service again using the same methods. Same result.. I just can't do it in the conventional manner. I checked to ensure that there was only one Stunnel service/process running, and that checks out okay. Not sure if others are seeing this issue, but thought I'd better let someone know about it. Thanks for the new version! Regards, Thomas -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

1 0

X-Forwarded-For stunnel 4.54 patch
by Michael Wittig 16 Oct '12

16 Oct '12

Hi, I created the X-Forwarded-For stunnel 4.54 patch: https://gist.github.com/3899818 Could someone else check it? -- Michael

1 0

Client Authentication and CRL Verification
by Jean-Philippe Constant 16 Oct '12

16 Oct '12

Hi, I am using stunnel in server mode with mutual authentication. The PKI used to authenticate my client is the following : root CA -> Intermediate CA -> Client. My stunnel configuration is : CAfile = RootCA.pem CRLfile = IntermediateCACRL.pem verify = 2 RootCA.pem contains the Root CA certificate IntermediateCACRL.pem contains the CRL file of the Intermediate CA The client authentication with client certificate goes well. The problem occurs when a client certificate is revoked. After the Intermediate CA CRL updates, the client certificate is still accepted whereas it should be refused. With the following configuration the revoked certificate is refused : CAfile = IntermediateCA.pem CRLfile = IntermediateCACRL.pem verify = 2 but I would prefer using the first configuration. Everything happens like if stunnel checks the crl only for the CA certificate and not for the whole certification chain. Thank you for your answers, Jean-Philippe Constant

1 0

SSL proxy in Windows - IP Address Issue
by Brian McGinity 16 Oct '12

16 Oct '12

Thank you so much for stunnel. This program is amazing!!!! In Windows, I'd like to move SSL processing out of Apache and into stunnel. Is there a way for Apache to know the client's ip address? - In Windows, "transparent" mode is unavailable - "xforwardedfor" is for smtp and not https connections - "protocol = proxy" is for Haproxy only? Brian

2 3

Asterisk with stunnel
by manjula hettiarachchi 15 Oct '12

15 Oct '12

Hi List I am new to stunnel, Just tried today to send Asterisk SIP request to stunnel client and forward to stunnel-server --> asterisk on another machine. (server ip=x.x.x.x) (client ip=y.y.y.y) Client config: cert=/etc/stunnel/stunnel.pem client=yes pid=/tmp/stunnel.pid debug=7 output=/etc/stunnel/stunnel.log [sip] accept=16380 connect=x.x.x.x:17380 ================================ Server Config: cert=/etc/stunnel/stunnel.pem #client=no pid=/tmp/stunnel.pid debug=7 output=/etc/stunnel/stunel.log [sip-IN] accept=17380 connect=5060 When tried 'telnet localhost 16380 from client machine i could see packets coming to server. However when Asterisk sends a sip request to port 16380, exten => _X.,1,Dial(SIP/${EXTEN}@y.y.y.y:16380,20,rt) i dont see packets forwaded to the server. Pls advise if anyone has used this scenario Best Regards Manjula

2 1

Re: [stunnel-users] stunnel-users Digest, Vol 99, Issue 2
by Scott McKeown 10 Oct '12

10 Oct '12

Hi Michal, Thats great news and thank you for update. I think the 'renegotiation' option will be a great addition. -- With Kind Regards. Scott McKeown Loadbalancer.org http://www.loadbalancer.org

1 0

stunnel 4.54 released
by Michal Trojnara 09 Oct '12

09 Oct '12

Dear Users, I have released version 4.54 of stunnel. The ChangeLog entry: Version 4.54, 2012.10.09, urgency: MEDIUM: * New Win32 features - FIPS module updated to version 2.0. - OpenSSL DLLs updated to version 1.0.1c. - zlib DLL updated to version 1.2.7. - Engine DLLs added: 4758cca, aep, atalla, capi, chil, cswift, gmp, gost, nuron, padlock, sureware, ubsec. * Other new features - "session" option renamed to more readable "sessionCacheTimeout". The old name remains accepted for backward compatibility. - New service-level "sessionCacheSize" option to control session cache size. - New service-level option "reset" to control whether TCP RST flag is used to indicate errors. The default value is "reset = yes". - New service-level option "renegotiation" to disable SSL renegotiation. This feature is based on a public-domain patch by Janusz Dziemidowicz. - New FreeBSD socket options: IP_FREEBIND, IP_BINDANY, IPV6_BINDANY (thx to Janusz Dziemidowicz). - New parameters to configure TLS v1.1/v1.2 with OpenSSL version 1.0.1 or higher (thx to Henrik Riomar). * Bugfixes - Fixed "Application Failed to Initialize Properly (0xc0150002)" error. - Fixed missing SSL state debug log entries. - Fixed a race condition in libwrap code resulting in random stalls (thx to Andrew Skalski). - Session cache purged at configuration file reload to reduce memory leak. Remaining leak of a few kilobytes per section is yet to be fixed. - Fixed regression bug in "transparent = destination" functionality (thx to Stefan Lauterbach). This bug was introduced in stunnel 4.51. - "transparent = destination" is now a valid endpoint in inetd mode. - "delay = yes" fixed to work even if specified *after* "connect" option. - Multiple "connect" targets fixed to also work with delayed resolver. - The number of resolver retries of EAI_AGAIN error has been limited to 3 in order to prevent infinite loops.. Home page: https://www.stunnel.org/ <http://stunnel.mirt.net/> Download: https://www.stunnel.org/downloads.html <ftp://stunnel.mirt.net/stunnel/> SHA-256 hash for stunnel-4.54.tar.gz: b7e1b9e63569574dbdabee8af90b8ab88db3fe13dcb1268d59a1408c56e6de7b Best regards, Mike

1 0

How to forward client's IP address with stunnel on Windows
by Emmanuel Egensperger 08 Oct '12

08 Oct '12

Dear stunnel's users, I have search on google and try many things on stunnel's configuration to forward ip address, but nothing works ? I have found this option in the FAQ : transparent = source But it seems that it doesn't work on windows ? >Line 22: "transparent = source": Specified option name is not valid here >Server is down Is there any solution to my problem ? Have I done something wrong ? Best regards, Manu Egen

2 1

Timeouts and inetd mode
by Bruce Guenter 28 Sep '12

28 Sep '12

Hi. As far as I can tell, if stunnel is running in "inetd mode", at least TIMEOUTbusy does not work. In particularl, stunnel will never timeout waiting for the SSL handshake to complete. If I'm reading the sources right, this is because the code to set up the SSL session calls SSL_accept before checking for data on stdin, and stdin is never set to non-blocking mode (only newly created sockets and/or pipes are). Would it make sense to set stdin (and stdout) to non-blocking mode when timeouts are enabled? Something in init_local maybe? -- Bruce Guenter <bruce(a)untroubled.org> http://untroubled.org/

1 0