[SOLVED] Stunnel uses old openssl library

hua · 02-05-2015, 04:18 AM

Hello

I have just updated my openssl package on Slackware14.1. I use stunnel on this box for sendmail, httpd and imap. When I started the stunnel I have noticed that the Log message is showing an older Openssl library is used:

Quote:

Compiled/running with OpenSSL 1.0.1c 10 May 2012

Does it mean that although I updated the openssl for openssl-1.0.1k, as far as I use stunnel I use an outdated version of SSL library?

Thanks

veerain · 02-05-2015, 04:43 AM

If stunnel is executable command, then you can run 'ldd stunnel' in shell to see which openssl it uses.

TB0ne · 02-05-2015, 10:26 AM

Quote:

Originally Posted by hua

Hello
I have just updated my openssl package on Slackware14.1. I use stunnel on this box for sendmail, httpd and imap. When I started the stunnel I have noticed that the Log message is showing an older Openssl library is used:

Does it mean that although I updated the openssl for openssl-1.0.1k, as far as I use stunnel I use an outdated version of SSL library?

Correct...that is the version of openssl that was compiled in to the stunnel program you're using. The easiest way to do this is to just re-compile your stunnel program from source, which will pick up the newly-installed library.

bassmadrigal · 02-05-2015, 11:46 AM

You can check and see if there is a way to dynamically link openssl to stunnel instead of the static link that was done when you recompile. Possibly as a --enable-shared option in the ./configure options.

turtleli · 02-05-2015, 11:47 AM

No. You are using version 1.01k. From the build script used to build OpenSSL:

Code:

# OpenSSL has a (nasty?) habit of bumping the internal version number with
# every release.  This wouldn't be so bad, but some applications are so
# paranoid that they won't run against a different OpenSSL version than
# what they were compiled against, whether or not the ABI has changed.
#
# So, we will use the OPENSSL_VERSION_NUMBER from openssl-1.0.1c unless ABI
# breakage forces it to change.  Yes, we're finally using this old trick.  :)
sed -i "s/#define OPENSSL_VERSION_NUMBER.*/\/* Use 0x1000103fL (1.0.1c) below to avoid pointlessly breaking the ABI *\/\n#define OPENSSL_VERSION_NUMBER 0x1000103fL/g" crypto/opensslv.h || exit 1

hua · 02-24-2015, 08:48 AM

Thanks turtleli.