stunnel4 refuses to connect to TLSv1.0 server
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| stunnel4 (Ubuntu) |
New
|
Undecided
|
Unassigned | ||
Bug Description
Version: 3:5.63-1build1
This is an Ubuntu-specific bug, it works in Debian with the OpenSSL configuration provided (I actually copied the config from a Debian sid box to the Ubuntu jammy box). It also used to work on older Ubuntu releases.
The following fails:
# stunnel4 xconf
2022.09.13 00:47:21 LOG5[ui]: stunnel 5.63 on x86_64-pc-linux-gnu platform
2022.09.13 00:47:21 LOG5[ui]: Compiled/running with OpenSSL 3.0.2 15 Mar 2022
2022.09.13 00:47:21 LOG5[ui]: Threading:PTHREAD Sockets:
2022.09.13 00:47:21 LOG5[ui]: Reading configuration from file /root/xconf
2022.09.13 00:47:21 LOG5[ui]: UTF-8 byte order mark not detected
2022.09.13 00:47:21 LOG5[ui]: FIPS mode disabled
2022.09.13 00:47:21 LOG4[ui]: Service [tlsv1-
2022.09.13 00:47:21 LOG5[ui]: Configuration successful
2022.09.13 00:47:21 LOG5[0]: Service [tlsv1-
2022.09.13 00:47:21 LOG5[0]: s_connect: connected x.x.x.x:xxxxx
2022.09.13 00:47:21 LOG5[0]: Service [tlsv1-
2022.09.13 00:47:21 LOG3[0]: SSL_connect: ../ssl/
2022.09.13 00:47:21 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket
The test configuration is:
# cat xconf
client = yes
foreground = yes
connect = x.x.x.x:xxxxx
service = tlsv1-client-
socket = r:SO_KEEPALIVE=1
socket = r:TCP_KEEPCNT=4
socket = r:TCP_KEEPIDLE=40
socket = r:TCP_KEEPINTVL=5
#sslVersion = all
sslVersion = TLSv1
renegotiation = no
options = -NO_TLSv1
On Debian, it worked with “sslVersion = all” and no “options” line.
Connections with openssl(1) from the same Ubuntu jammy box *do* work, so this is a bug in/with stunnel:
# openssl s_client -CApath /etc/ssl/certs -connect x.x.x.x:xxxxx -quiet
Can't use SSL_get_servername
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R3
verify return:1
depth=0 CN = xxxxx.example.com
verify return:1
<<< first line of response from server >>>
[…]
The OpenSSL configuration I use is (pretty much Debian standard except at the very end)… too long, I’m attaching /etc/ssl/
| Thorsten Glaser (mirabilos) wrote | #1 |
| information type: | Private Security → Public Security |
| Thorsten Glaser (mirabilos) wrote | #2 |
| Thorsten Glaser (mirabilos) wrote | #3 |
| information type: | Public Security → Public |
| Thorsten Glaser (mirabilos) wrote | #4 |
The Debian sid version, which works, is 3:5.63-1.1 so they differ only by a binNMU on the Ubuntu side and the following NMU on the Debian side:
stunnel4 (3:5.63-1.1) unstable; urgency=medium
* Non-maintainer upload
[ Simon Chopin ]
* Fix autopkgtests on new OpenSSL versions (Closes: #1010698)
-- Paul Gevers <email address hidden> Wed, 31 Aug 2022 21:59:52 +0200
I *highly* doubt that this is relevant.