#692796 stunnel.conf: options = SSL_OP_CIPHER_SERVER_PREFERENCE: Illegal SSL option

Package:
stunnel4
Source:
stunnel4
Description:
Universal SSL tunnnel for network daemons - compatibility package
Submitter:
Andrew Buckeridge
Date:
2014-10-28 21:03:09 UTC
Severity:
normal
#692796#5
Date:
2012-11-09 02:08:03 UTC
From:
To:
I have not tagged severity. Is it a real security issue?

In my stunnel.conf I tried:--

options = SSL_OP_CIPHER_SERVER_PREFERENCE

It gave "Illegal SSL option" and did not start.

Trying to set SSL_CTX_set_options(3ssl) SSL_OP_CIPHER_SERVER_PREFERENCE.

<https://community.qualys.com/blogs/securitylabs/2011/10/17/mitigating-the-beast-attack-on-tls>

In my stunnel.conf I also have:--

options = NO_SSLv2
options = NO_SESSION_RESUMPTION_ON_RENEGOTIATION
options = SINGLE_DH_USE

ciphers = RC4-SHA:HIGH:!ADH

They are aware of this upstream.
<https://www.stunnel.org/pipermail/stunnel-users/2012-May/003744.html>
May also be fixed.
<https://www.stunnel.org/pipermail/stunnel-users/2012-May/003745.html>
#692796#10
Date:
2013-04-23 12:13:01 UTC
From:
To:
Hi,

The correct syntax is:
    options = CIPHER_SERVER_PREFERENCE
and not:
    options = SSL_OP_CIPHER_SERVER_PREFERENCE

You should not include "SSL_OP_" at the beginning of every SSL option.

CIPHER_SERVER_PREFERENCE is supported since stunnel 4.28.

Mike
#692796#15
Date:
2014-10-28 20:58:09 UTC
From:
To:
Hi,

This bug report is clearly invalid.  Please close it.

Mike