- stunnel-users - stunnel.org

RE: [stunnel-users] Windows config with both SSL listen andnon-SSLlisten
by Paul Hethmon 07 Dec '05

07 Dec '05

Michal, Ok, the next obvious questions then: 1. When is 4.15 expected? 2. If not in the next 7 days, what can I do to help? I've done C/C++ and sockets for the last 10 years. I've looked at the code briefly so far, but have not set up a build environment yet. I need it in the next week so if there is any coding I can do which would help you, let me know your thoughts and where to put stuff. Also, just a public thanks for putting the package together. I started coding my own a couple of days ago and then thought there must have been someone else who just needed an SSL tunnel (and not a full blown SSH setup). Thanks, Paul -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Michal Trojnara Sent: Wednesday, December 07, 2005 9:03 AM To: stunnel-users(a)mirt.net Subject: RE: [stunnel-users] Windows config with both SSL listen andnon-SSLlisten Paul, This feature is going to be supported in the next release (4.15). Your config will look like this: [inbound] client = no accept = 5102 connect = 5010 [outbound] client = yes accept = 5101 connect = x.x.x.x:5102 Best regards, Mike ________________________________ From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Paul Hethmon Sent: Wednesday, December 07, 2005 2:50 PM To: stunnel-users(a)mirt.net Subject: [stunnel-users] Windows config with both SSL listen and non-SSLlisten I'm trying to set up using the Windows service the ability to listen in SSL mode on one port (5102) and forward to non-SSL port (5010) and then also listen on one port (5101) in non-SSL mode and forward to a remote port (5102) in SSL mode. What I have currently in the config is: [inbound] accept = 5102 connect = 5010 [outbound] accept = 5101 connect = x.x.x.x:5102 The first STunnel example on the website talks about doing this, sort of, but I don't see any options to specify on a service configuration level whether the listen port is in SSL or non-SSL mode. The use of a service name like [pop3] vs [pop3s] seems to imply a difference, but I've got a custom application I'm trying to tunnel two way, not a standard IETF service. A perusal of the last year's mailing list archives didn't yield anything. I guess the next step is to look at the source and see if it's supported unless someone here can tell me one way or the other. If it's not supported, I guess I'll add it in. thanks, Paul Paul Hethmon Senior Engineer ClareityT Security SAFEMLST Security Education, Consulting and Solutions http://www.SAFEMLS.com <http://www.safemls.com/> paul.hethmon(a)callclareity.com work: 865.671.6630 cell: 865.250.3517 _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 1

Windows config with both SSL listen and non-SSL listen
by Paul Hethmon 07 Dec '05

07 Dec '05

I'm trying to set up using the Windows service the ability to listen in SSL mode on one port (5102) and forward to non-SSL port (5010) and then also listen on one port (5101) in non-SSL mode and forward to a remote port (5102) in SSL mode. What I have currently in the config is: [inbound] accept = 5102 connect = 5010 [outbound] accept = 5101 connect = x.x.x.x:5102 The first STunnel example on the website talks about doing this, sort of, but I don't see any options to specify on a service configuration level whether the listen port is in SSL or non-SSL mode. The use of a service name like [pop3] vs [pop3s] seems to imply a difference, but I've got a custom application I'm trying to tunnel two way, not a standard IETF service. A perusal of the last year's mailing list archives didn't yield anything. I guess the next step is to look at the source and see if it's supported unless someone here can tell me one way or the other. If it's not supported, I guess I'll add it in. thanks, Paul Paul Hethmon Senior Engineer Clareity(tm) Security SAFEMLS(tm) Security Education, Consulting and Solutions http://www.SAFEMLS.com <http://www.safemls.com/> paul.hethmon(a)callclareity.com work: 865.671.6630 cell: 865.250.3517

2 1

stunnel install failure
by James.Bartkowicz＠bedbath.com 05 Dec '05

05 Dec '05

Pretty new to stunnel and not very familiar with compiling programs at all: 1. Description: Installation of stunnel 4.14 failing on a Solaris 9 box. #>make Making all in src /bin/bash ../libtool --tag=CC --mode=link gcc -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/local/ssl/include -o libstunnel.la -rpath /usr/local/lib -avoid-version env.lo -lz -ldl -lsocket -lnsl -L/usr/local/ssl/lib -lssl -lcrypto -lwrap gcc -shared -Wl,-h -Wl,libstunnel.so -o .libs/libstunnel.so .libs/env.o -lz -ldl -lsocket -lnsl -L/usr/local/ssl/lib -lssl -lcrypto -lwrap -lc ld: fatal: library -lwrap: not found ld: fatal: File processing errors. No output written to .libs/libstunnel.so collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `libstunnel.la' Current working directory /local1/home/stunnel/stunnel-4.14/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' ******************************************* James Bartkowicz Bed Bath & Beyond Server Administration Team - UNIX 908-688-0888 ext.4441 ******************************************* ------------------------------------------------------ CONFIDENTIALITY NOTICE: This e-mail, and any attachments thereto, is intended only for use by the addressee(s) named herein and may contain confidential information. If you are not the intended recipient of this e-mail, you are hereby notified that any dissemination, distribution or copying of this e-mail, and any attachments thereto, is strictly prohibited. If you have received this e-mail in error, please permanently delete the original and any copy of any e-mail and any printout thereof. Thank you for your compliance.

2 1

Server connecting back to client?
by Joshua Kugler 02 Dec '05

02 Dec '05

I've looked through the man pages, FAQ's, examples, and found one post (without a reply: http://stunnel.mirt.net/pipermail/stunnel-users/2005-May/000487.html) about this, but still don't have my question answered. I have a machine outside the firewall (let's call it outThere) that needs to connect back to a machine inside the firewall (let's call in inHere) for backup procedures. Now, because of the firewall, outThere cannot connect to inHere, but inHere can connect to anything on outThere that it wants. Can I initiate an stunnel connection from inHere to outThere, and then have stunnel on outThere listen on a localhost port, which, when connected to, would actually forward the connection (over SSL) back to a configured port on inHere? Is this at all doable? j----- k----- -- Joshua Kugler CDE System Administrator http://distance.uaf.edu/

2 1

Stunnel sending ICMP packet at startup
by Paul Jones 30 Nov '05

30 Nov '05

Hi there, I have set up Stunnel on both the server and the client. There is a firewall on the server side that only allows TCP connections through. When Stunnel is started up on the client side, the firewall is actually receiving an ICMP packet, not a TCP. Is this how Stunnel should be working? I assume it's doing a ping or something at startup. Thanks in advance. Paul _________________________________________________________________ SEEK: Over 80,000 jobs across all industries at Australia's #1 job site. http://ninemsn.seek.com.au?hotmail

2 1

4th Dimension and Stunnel
by Mark 28 Nov '05

28 Nov '05

Does anyone have a sample config file to allow 4th Dimension client and server to use stunnel?

1 0

How to protect private key in Windows XP Home
by Andrus 28 Nov '05

28 Nov '05

My stunnel client must start without user intervention. So I installed stunnel in client mode in a Windows XP Home computer as XP service. In XP Proffesional I can specify that only Administrators group has access to stunnel directory. XP Home does not have security tab in folder properties. Any person working in XP Home compter can copy stunnel private key How to protect private key from copying ? Andrus. My stunnel.conf file: Cafile=server.crt cert=privkey.pem client = yes service=RDPClient verify = 2 [terminal server] accept = 83389 connect = 1.2.3.4:83389

1 0

socklen_t undeclared
by tc 24 Nov '05

24 Nov '05

Hi, I'm getting socklet_t undeclared in client.c making stunnel4.14 in an embedded linux 2.038 system. What can I do? Thanks TC __________________________________ Meet your soulmate! Yahoo! Asia presents Meetic - where millions of singles gather http://asia.yahoo.com/meetic

2 1

Newbie Question
by Mark 23 Nov '05

23 Nov '05

I am completely new to SSL and stunnel. I need to test the differences between 4th Dimension's SSL and doing the same thing without the 4D implementation of SSL using stunnel. Can anyone please tell me where to get started? Mark Zinke

2 1

Call for Beta Testers: Tool similar to Stunnel.
by Wilfred Nilsen 22 Nov '05

22 Nov '05

We have designed a tool that is similar to Stunnel and we would like to know if anyone would be interested in testing the tool. A short introduction: The Barracuda HTTPS tunnel allows you to encrypt arbitrary TCP connections inside SSL. The HTTPS tunnel allows you to secure non-SSL aware services such as TELNET, FTP, VNC, etc., by having the HTTPS tunnel provide the encryption. The HTTPS tunnel can also be used, for example, to tunnel traffic out from behind a restrictive firewall/proxy that only allows outgoing HTTPS web connections. The client is a Java program that can either be downloaded and started from the command prompt or started using Java Web Start. The server is BarracudaDrive. http://barracudaserver.com/examples/BarracudaDrive/ We will make the beta program (the server and client) available if anyone is interested in testing the tool and give us feedback. We are specifically interested in beta testers that are behind a restrictive company proxy. Thanks, Wilfred

7 10

Re: [stunnel-users] Problem with Stunnel Working fine on the firstconnection and not on subsequent connections
by Kevin A. McGrail 19 Nov '05

19 Nov '05

> I'd try to disable chroot and run stunnel under strace with "foreground = yes" option. Mike, When running in foreground, with or without chroot, things work as expected. Without foreground, it did not work. Two key differences on the logs for each: Output of "Cleaning up the signal pipe" prior to checking the libwrap permissions a finish line of "ssmtp finished (0 left)" instead of "ssmtp finished (-1 left)" (Yes, this is a dual processor box.) It looks like the key problem lies in the regerenation of the standalone mode. Is there a way with v4 to just use inetd to answer on port 465, negotiate and connect on port 25 on another host because perhaps that will avoid the issue. Regards, KAM 2005.11.19 13:07:51 LOG7[3893:1024]: Key file: /usr/local/ssl/certs/stunnel.pem 2005.11.19 13:07:51 LOG6[3893:1024]: file ulimit = 1024 (can be changed with 'ulimit -n') 2005.11.19 13:07:51 LOG6[3893:1024]: poll() used - no FD_SETSIZE limit for file descriptors 2005.11.19 13:07:51 LOG5[3893:1024]: 500 clients allowed 2005.11.19 13:07:51 LOG7[3893:1024]: FD 4 in non-blocking mode 2005.11.19 13:07:51 LOG7[3893:1024]: FD 5 in non-blocking mode 2005.11.19 13:07:51 LOG7[3893:1024]: FD 6 in non-blocking mode 2005.11.19 13:07:51 LOG7[3893:1024]: SO_REUSEADDR option set on accept socket 2005.11.19 13:07:51 LOG7[3893:1024]: ssmtp bound to 0.0.0.0:465 2005.11.19 13:07:51 LOG7[3893:1024]: Created pid file /stunnel.pid [ed: 1st email] 2005.11.19 13:08:32 LOG7[3893:1024]: ssmtp accepted FD=7 from 66.149.103.32:3130 2005.11.19 13:08:32 LOG7[3898:1026]: ssmtp started 2005.11.19 13:08:32 LOG7[3898:1026]: FD 7 in non-blocking mode 2005.11.19 13:08:32 LOG7[3898:1026]: TCP_NODELAY option set on local socket 2005.11.19 13:08:32 LOG7[3898:1026]: FD 10 in non-blocking mode 2005.11.19 13:08:32 LOG7[3898:1026]: FD 11 in non-blocking mode 2005.11.19 13:08:32 LOG7[3893:1024]: Cleaning up the signal pipe 2005.11.19 13:08:32 LOG7[3898:1026]: Connection from 66.149.103.32:3130 permitted by libwrap 2005.11.19 13:08:32 LOG5[3898:1026]: ssmtp connected from 66.149.103.32:3130 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): before/accept initialization 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 read client hello A 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 write server hello A 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 write certificate A 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 write server done A 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 flush data 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 read client key exchange A 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 read finished A 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 write change cipher spec A 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 write finished A 2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 flush data 2005.11.19 13:08:32 LOG7[3898:1026]: 1 items in the session cache 2005.11.19 13:08:32 LOG7[3898:1026]: 0 client connects (SSL_connect()) 2005.11.19 13:08:32 LOG7[3898:1026]: 0 client connects that finished 2005.11.19 13:08:32 LOG7[3898:1026]: 0 client renegotiatations requested 2005.11.19 13:08:32 LOG7[3898:1026]: 1 server connects (SSL_accept()) 2005.11.19 13:08:32 LOG7[3898:1026]: 1 server connects that finished 2005.11.19 13:08:32 LOG7[3898:1026]: 0 server renegotiatiations requested 2005.11.19 13:08:32 LOG7[3898:1026]: 0 session cache hits 2005.11.19 13:08:32 LOG7[3898:1026]: 1 session cache misses 2005.11.19 13:08:32 LOG7[3898:1026]: 0 session cache timeouts 2005.11.19 13:08:32 LOG6[3898:1026]: SSL accepted: new session negotiated 2005.11.19 13:08:32 LOG6[3898:1026]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2005.11.19 13:08:32 LOG7[3898:1026]: FD 10 in non-blocking mode 2005.11.19 13:08:32 LOG7[3898:1026]: ssmtp connecting 10.10.10.30:25 2005.11.19 13:08:32 LOG7[3898:1026]: connect_wait: waiting 10 seconds 2005.11.19 13:08:32 LOG7[3898:1026]: connect_wait: connected 2005.11.19 13:08:32 LOG7[3898:1026]: Remote FD=10 initialized 2005.11.19 13:08:32 LOG7[3898:1026]: TCP_NODELAY option set on remote socket 2005.11.19 13:08:33 LOG7[3898:1026]: Socket closed on read 2005.11.19 13:08:33 LOG7[3898:1026]: SSL write shutdown 2005.11.19 13:08:33 LOG7[3898:1026]: SSL alert (write): warning: close notify 2005.11.19 13:08:33 LOG7[3898:1026]: SSL_shutdown retrying 2005.11.19 13:08:33 LOG7[3898:1026]: SSL doesn't need to read or write 2005.11.19 13:08:33 LOG7[3898:1026]: SSL socket closed on SSL_read 2005.11.19 13:08:33 LOG7[3898:1026]: Socket write shutdown 2005.11.19 13:08:33 LOG5[3898:1026]: Connection closed: 834 bytes sent to SSL, 1358 bytes sent to socket 2005.11.19 13:08:33 LOG7[3898:1026]: ssmtp finished (0 left) [ed: 2nd email] 2005.11.19 13:08:40 LOG7[3893:1024]: ssmtp accepted FD=7 from 66.149.103.32:3137 2005.11.19 13:08:40 LOG7[3900:2050]: ssmtp started 2005.11.19 13:08:40 LOG7[3900:2050]: FD 7 in non-blocking mode 2005.11.19 13:08:40 LOG7[3900:2050]: TCP_NODELAY option set on local socket 2005.11.19 13:08:40 LOG7[3900:2050]: FD 10 in non-blocking mode 2005.11.19 13:08:40 LOG7[3900:2050]: FD 11 in non-blocking mode 2005.11.19 13:08:40 LOG7[3893:1024]: Cleaning up the signal pipe 2005.11.19 13:08:40 LOG7[3900:2050]: Connection from 66.149.103.32:3137 permitted by libwrap 2005.11.19 13:08:40 LOG5[3900:2050]: ssmtp connected from 66.149.103.32:3137 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): before/accept initialization 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 read client hello A 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 write server hello A 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 write certificate A 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 write server done A 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 flush data 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 read client key exchange A 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 read finished A 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 write change cipher spec A 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 write finished A 2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 flush data 2005.11.19 13:08:40 LOG7[3900:2050]: 2 items in the session cache 2005.11.19 13:08:40 LOG7[3900:2050]: 0 client connects (SSL_connect()) 2005.11.19 13:08:40 LOG7[3900:2050]: 0 client connects that finished 2005.11.19 13:08:40 LOG7[3900:2050]: 0 client renegotiatations requested 2005.11.19 13:08:40 LOG7[3900:2050]: 2 server connects (SSL_accept()) 2005.11.19 13:08:40 LOG7[3900:2050]: 2 server connects that finished 2005.11.19 13:08:40 LOG7[3900:2050]: 0 server renegotiatiations requested 2005.11.19 13:08:40 LOG7[3900:2050]: 0 session cache hits 2005.11.19 13:08:40 LOG7[3900:2050]: 2 session cache misses 2005.11.19 13:08:40 LOG7[3900:2050]: 0 session cache timeouts 2005.11.19 13:08:40 LOG6[3900:2050]: SSL accepted: new session negotiated 2005.11.19 13:08:40 LOG6[3900:2050]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2005.11.19 13:08:40 LOG7[3900:2050]: FD 10 in non-blocking mode 2005.11.19 13:08:40 LOG7[3900:2050]: ssmtp connecting 10.10.10.30:25 2005.11.19 13:08:40 LOG7[3900:2050]: connect_wait: waiting 10 seconds 2005.11.19 13:08:40 LOG7[3900:2050]: connect_wait: connected 2005.11.19 13:08:40 LOG7[3900:2050]: Remote FD=10 initialized 2005.11.19 13:08:40 LOG7[3900:2050]: TCP_NODELAY option set on remote socket 2005.11.19 13:08:42 LOG7[3900:2050]: Socket closed on read 2005.11.19 13:08:42 LOG7[3900:2050]: SSL write shutdown 2005.11.19 13:08:42 LOG7[3900:2050]: SSL alert (write): warning: close notify 2005.11.19 13:08:42 LOG7[3900:2050]: SSL_shutdown retrying 2005.11.19 13:08:42 LOG7[3900:2050]: SSL doesn't need to read or write 2005.11.19 13:08:42 LOG7[3900:2050]: SSL socket closed on SSL_read 2005.11.19 13:08:42 LOG7[3900:2050]: Socket write shutdown 2005.11.19 13:08:42 LOG5[3900:2050]: Connection closed: 834 bytes sent to SSL, 1358 bytes sent to socket 2005.11.19 13:08:42 LOG7[3900:2050]: ssmtp finished (0 left) Without foreground, things do not continue past the first connection: 2005.11.19 13:10:32 LOG7[3910:1024]: ssmtp accepted FD=7 from 66.149.103.32:3268 2005.11.19 13:10:32 LOG7[3916:1026]: ssmtp started 2005.11.19 13:10:32 LOG7[3916:1026]: FD 7 in non-blocking mode 2005.11.19 13:10:32 LOG7[3916:1026]: TCP_NODELAY option set on local socket 2005.11.19 13:10:32 LOG7[3916:1026]: FD 10 in non-blocking mode 2005.11.19 13:10:32 LOG7[3916:1026]: FD 11 in non-blocking mode 2005.11.19 13:10:32 LOG7[3916:1026]: Connection from 66.149.103.32:3268 permitted by libwrap 2005.11.19 13:10:32 LOG5[3916:1026]: ssmtp connected from 66.149.103.32:3268 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): before/accept initialization 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 read client hello A 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 write server hello A 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 write certificate A 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 write server done A 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 flush data 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 read client key exchange A 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 read finished A 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 write change cipher spec A 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 write finished A 2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 flush data 2005.11.19 13:10:32 LOG7[3916:1026]: 1 items in the session cache 2005.11.19 13:10:32 LOG7[3916:1026]: 0 client connects (SSL_connect()) 2005.11.19 13:10:32 LOG7[3916:1026]: 0 client connects that finished 2005.11.19 13:10:32 LOG7[3916:1026]: 0 client renegotiatations requested 2005.11.19 13:10:32 LOG7[3916:1026]: 1 server connects (SSL_accept()) 2005.11.19 13:10:32 LOG7[3916:1026]: 1 server connects that finished 2005.11.19 13:10:32 LOG7[3916:1026]: 0 server renegotiatiations requested 2005.11.19 13:10:32 LOG7[3916:1026]: 0 session cache hits 2005.11.19 13:10:32 LOG7[3916:1026]: 1 session cache misses 2005.11.19 13:10:32 LOG7[3916:1026]: 0 session cache timeouts 2005.11.19 13:10:32 LOG6[3916:1026]: SSL accepted: new session negotiated 2005.11.19 13:10:32 LOG6[3916:1026]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2005.11.19 13:10:32 LOG7[3916:1026]: FD 10 in non-blocking mode 2005.11.19 13:10:32 LOG7[3916:1026]: ssmtp connecting 10.10.10.30:25 2005.11.19 13:10:32 LOG7[3916:1026]: connect_wait: waiting 10 seconds 2005.11.19 13:10:32 LOG7[3916:1026]: connect_wait: connected 2005.11.19 13:10:32 LOG7[3916:1026]: Remote FD=10 initialized 2005.11.19 13:10:32 LOG7[3916:1026]: TCP_NODELAY option set on remote socket 2005.11.19 13:10:33 LOG7[3916:1026]: Socket closed on read 2005.11.19 13:10:33 LOG7[3916:1026]: SSL write shutdown 2005.11.19 13:10:33 LOG7[3916:1026]: SSL alert (write): warning: close notify 2005.11.19 13:10:33 LOG7[3916:1026]: SSL_shutdown retrying 2005.11.19 13:10:33 LOG7[3916:1026]: SSL doesn't need to read or write 2005.11.19 13:10:34 LOG7[3916:1026]: SSL socket closed on SSL_read 2005.11.19 13:10:34 LOG7[3916:1026]: Socket write shutdown 2005.11.19 13:10:34 LOG5[3916:1026]: Connection closed: 834 bytes sent to SSL, 1353 bytes sent to socket 2005.11.19 13:10:34 LOG7[3916:1026]: ssmtp finished (-1 left)

1 0

Problem with Stunnel Working fine on the first connection and not on subsequent connections
by Kevin A. McGrail 19 Nov '05

19 Nov '05

Have worked on this all day without any glimmer of hope and would appreciate help and feedback! Regards, KAM # Description of your problem. What programs are on which machines, and how are they attempting to communicate. What connections are you attempting to secure in SSL. I am having problems with the regeneration of stunnel on an old but fairly reliable machine. I am switching from v3 to v4 and it works absolutely perfectly ONCE. The second time it just hangs. # What version of Stunnel you're using - remember, Stunnel 4.x doesn't take Stunnel 3.x command line options! 4.x # The list of parameters you are using for stunnel, and if you are running it standalone or from inetd/xinetd. I am running it in standalone. My conf file is: cert = /usr/local/ssl/certs/stunnel.pem key = /usr/local/ssl/certs/stunnel.pem chroot = /usr/local/var/stunnel/ setuid = nobody setgid = nobody pid = /stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = stunnel.log [ssmtp] accept = 465 connect = 10.10.10.30:25 # Output of "stunnel -f -D 7 <your-parameters>". Not sure this works on v4.X but here are the logs from the connection: 2005.11.18 19:17:56 LOG7[13166:1024]: ssmtp accepted FD=7 from 66.149.103.32:3542 2005.11.18 19:17:56 LOG7[13171:1026]: ssmtp started 2005.11.18 19:17:56 LOG7[13171:1026]: FD 7 in non-blocking mode 2005.11.18 19:17:56 LOG7[13171:1026]: TCP_NODELAY option set on local socket 2005.11.18 19:17:56 LOG7[13171:1026]: FD 10 in non-blocking mode 2005.11.18 19:17:56 LOG7[13171:1026]: FD 11 in non-blocking mode 2005.11.18 19:17:56 LOG7[13171:1026]: Connection from 66.149.103.32:3542 permitted by libwrap 2005.11.18 19:17:56 LOG5[13171:1026]: ssmtp connected from 66.149.103.32:3542 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): before/accept initialization 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 read client hello A 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 write server hello A 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 write certificate A 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 write server done A 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 flush data 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 read client key exchange A 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 read finished A 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 write change cipher spec A 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 write finished A 2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 flush data 2005.11.18 19:17:56 LOG7[13171:1026]: 1 items in the session cache 2005.11.18 19:17:56 LOG7[13171:1026]: 0 client connects (SSL_connect()) 2005.11.18 19:17:56 LOG7[13171:1026]: 0 client connects that finished 2005.11.18 19:17:56 LOG7[13171:1026]: 0 client renegotiatations requested 2005.11.18 19:17:56 LOG7[13171:1026]: 1 server connects (SSL_accept()) 2005.11.18 19:17:56 LOG7[13171:1026]: 1 server connects that finished 2005.11.18 19:17:56 LOG7[13171:1026]: 0 server renegotiatiations requested 2005.11.18 19:17:56 LOG7[13171:1026]: 0 session cache hits 2005.11.18 19:17:56 LOG7[13171:1026]: 1 session cache misses 2005.11.18 19:17:56 LOG7[13171:1026]: 0 session cache timeouts 2005.11.18 19:17:56 LOG6[13171:1026]: SSL accepted: new session negotiated 2005.11.18 19:17:56 LOG6[13171:1026]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2005.11.18 19:17:56 LOG7[13171:1026]: FD 10 in non-blocking mode 2005.11.18 19:17:56 LOG7[13171:1026]: ssmtp connecting 10.10.10.30:25 2005.11.18 19:17:56 LOG7[13171:1026]: connect_wait: waiting 10 seconds 2005.11.18 19:17:56 LOG7[13171:1026]: connect_wait: connected 2005.11.18 19:17:56 LOG7[13171:1026]: Remote FD=10 initialized 2005.11.18 19:17:56 LOG7[13171:1026]: TCP_NODELAY option set on remote socket 2005.11.18 19:17:58 LOG7[13171:1026]: Socket closed on read 2005.11.18 19:17:58 LOG7[13171:1026]: SSL write shutdown 2005.11.18 19:17:58 LOG7[13171:1026]: SSL alert (write): warning: close notify 2005.11.18 19:17:58 LOG7[13171:1026]: SSL_shutdown retrying 2005.11.18 19:17:58 LOG7[13171:1026]: SSL doesn't need to read or write 2005.11.18 19:17:58 LOG7[13171:1026]: SSL socket closed on SSL_read 2005.11.18 19:17:58 LOG7[13171:1026]: Socket write shutdown 2005.11.18 19:17:58 LOG5[13171:1026]: Connection closed: 827 bytes sent to SSL, 1362 bytes sent to socket 2005.11.18 19:17:58 LOG7[13171:1026]: ssmtp finished (-1 left) There is nothing more after this point # Output of "stunnel -V". I think you want -version: /usr/local/sbin/stunnel -version stunnel 4.14 on i686-pc-linux-gnu PTHREAD+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 Global options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /usr/local/etc/stunnel/stunnel.pem pid = /usr/local/var/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds # Output of "uname -a". Linux <removed> 2.2.26 #8 Fri Jul 16 00:42:34 EDT 2004 i686 unknown # Your libc version if you use Linux. 2.2.5 # Output of "gcc -v". Reading specs from /usr/lib/gcc-lib/i386-redhat-linux/egcs-2.91.66/specs gcc version egcs-2.91.66 19990314/Linux (egcs-1.1.2 release) # Output of "openssl version" or "ssleay version" depending on your library. Subscribe to stunnel-users. OpenSSL 0.9.7e 25 Oct 2004

2 1

Stunnel Session Hangs
by Zachariah K Zachariah 17 Nov '05

17 Nov '05

Hi folks, I use stunnel-4.12 with openssl-0.9.7g to tunnel my CVS-pserver protocols. I have set up the local stunnel client to listen to port 22400 and to forward any connections on it to the cvs server that has the server side stunnel listening on port 22401 forwarding connections to the cvs-pserver on port 2401. Having set up thus, I can do a cvs login just fine. I can watch the negotiation happening using tcpdump. However when I try to check out a module from the repository, I see some files coming through but only to eventually hang. If I <Ctrl C> and try again, more files come in but hangs before the transaction is complete. I have to do this several time in order to download all the files to my local workspace. Upon checking the logs, I find that the hang occurs immediately after the message: 2005.10.28 14:21:53 LOG7[15095:67]: SSL_read returned WANT_READ: retrying 2005.10.28 14:21:53 LOG7[15095:67]: SSL_write returned WANT_WRITE: retrying 2005.10.28 14:21:53 LOG7[15095:67]: SSL_read returned WANT_READ: retrying I have included a snippet of the log file for reference. I have also included my stunnel.conf file. Sorry for the voluminous output. Can some one help me here? Thanks in advance. -ZZ ===============================STUNNEL.LOG================================== The full log file reads: 2005.10.28 14:20:44 LOG6[15095:64]: SSL accepted: previous session reused 2005.10.28 14:20:44 LOG7[15095:64]: FD 1 in non-blocking mode 2005.10.28 14:20:44 LOG7[15095:64]: smd-pserver connecting 127.0.0.1:2401 2005.10.28 14:20:44 LOG7[15095:64]: Remote FD=1 initialized 2005.10.28 14:20:44 LOG7[15095:64]: SSL_read returned WANT_READ: retrying 2005.10.28 14:20:44 LOG7[15095:64]: SSL_write returned WANT_WRITE: retrying 2005.10.28 14:20:44 LOG7[15095:64]: SSL_read returned WANT_READ: retrying 2005.10.28 14:20:50 LOG7[15095:64]: SSL alert (read): warning: close notify 2005.10.28 14:20:50 LOG7[15095:64]: SSL closed on SSL_read 2005.10.28 14:20:50 LOG7[15095:64]: Socket write shutdown 2005.10.28 14:20:50 LOG7[15095:64]: SSL write shutdown 2005.10.28 14:20:50 LOG7[15095:64]: SSL alert (write): warning: close notify 2005.10.28 14:20:50 LOG6[15095:64]: SSL_shutdown successfully sent close_notify 2005.10.28 14:20:50 LOG5[15095:64]: Connection closed: 73224 bytes sent to SSL, 4724 bytes sent to socket 2005.10.28 14:20:50 LOG7[15095:64]: smd-pserver finished (0 left) 2005.10.28 14:20:50 LOG5[15095:64]: stack_info: size=65536, current=5004 (7%), maximum=5004 (7%) 2005.10.28 14:20:50 LOG7[15095:64]: Context 64 closed 2005.10.28 14:20:51 LOG7[15095:1]: Context set: 64 (dropped) -> 1 2005.10.28 14:20:51 LOG7[15095:1]: Current context: 1 2005.10.28 14:20:51 LOG7[15095:1]: Releasing context 64 2005.10.28 14:20:51 LOG7[15095:1]: smd-pserver accepted FD=0 from 171.65.79.143:65521 2005.10.28 14:20:51 LOG7[15095:1]: Creating a new context 2005.10.28 14:20:51 LOG7[15095:1]: Context 65 created 2005.10.28 14:20:51 LOG7[15095:65]: Context swap: 1 -> 65 2005.10.28 14:20:51 LOG7[15095:65]: smd-pserver started 2005.10.28 14:20:51 LOG7[15095:65]: FD 0 in non-blocking mode 2005.10.28 14:20:51 LOG5[15095:65]: smd-pserver connected from 171.65.79.143:65521 2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): before/accept initialization 2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): SSLv3 read client hello A 2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): SSLv3 write server hello A 2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): SSLv3 write change cipher spec A 2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): SSLv3 write finished A 2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): SSLv3 flush data 2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): SSLv3 read finished A 2005.10.28 14:20:51 LOG7[15095:65]: 6 items in the session cache 2005.10.28 14:20:51 LOG7[15095:65]: 0 client connects (SSL_connect()) 2005.10.28 14:20:51 LOG7[15095:65]: 0 client connects that finished 2005.10.28 14:20:51 LOG7[15095:65]: 0 client renegotiatations requested 2005.10.28 14:20:51 LOG7[15095:65]: 64 server connects (SSL_accept()) 2005.10.28 14:20:51 LOG7[15095:65]: 55 server connects that finished 2005.10.28 14:20:51 LOG7[15095:65]: 0 server renegotiatiations requested 2005.10.28 14:20:51 LOG7[15095:65]: 38 session cache hits 2005.10.28 14:20:51 LOG7[15095:65]: 0 session cache misses 2005.10.28 14:20:51 LOG7[15095:65]: 11 session cache timeouts 2005.10.28 14:20:51 LOG6[15095:65]: SSL accepted: previous session reused 2005.10.28 14:20:51 LOG7[15095:65]: FD 1 in non-blocking mode 2005.10.28 14:20:51 LOG7[15095:65]: smd-pserver connecting 127.0.0.1:2401 2005.10.28 14:20:51 LOG7[15095:65]: Remote FD=1 initialized 2005.10.28 14:20:51 LOG7[15095:65]: SSL_read returned WANT_READ: retrying 2005.10.28 14:20:51 LOG7[15095:65]: SSL_write returned WANT_WRITE: retrying 2005.10.28 14:20:51 LOG7[15095:65]: SSL_read returned WANT_READ: retrying 2005.10.28 14:20:57 LOG7[15095:65]: SSL alert (read): warning: close notify 2005.10.28 14:20:57 LOG7[15095:65]: SSL closed on SSL_read 2005.10.28 14:20:57 LOG7[15095:65]: Socket write shutdown 2005.10.28 14:20:57 LOG7[15095:65]: SSL write shutdown 2005.10.28 14:20:57 LOG7[15095:65]: SSL alert (write): warning: close notify 2005.10.28 14:20:57 LOG6[15095:65]: SSL_shutdown successfully sent close_notify 2005.10.28 14:20:57 LOG5[15095:65]: Connection closed: 73224 bytes sent to SSL, 4724 bytes sent to socket 2005.10.28 14:20:57 LOG7[15095:65]: smd-pserver finished (0 left) 2005.10.28 14:20:57 LOG5[15095:65]: stack_info: size=65536, current=5004 (7%), maximum=5004 (7%) 2005.10.28 14:20:57 LOG7[15095:65]: Context 65 closed 2005.10.28 14:20:58 LOG7[15095:1]: Context set: 65 (dropped) -> 1 2005.10.28 14:20:58 LOG7[15095:1]: Current context: 1 2005.10.28 14:20:58 LOG7[15095:1]: Releasing context 65 2005.10.28 14:20:58 LOG7[15095:1]: smd-pserver accepted FD=0 from 171.65.79.143:65523 2005.10.28 14:20:58 LOG7[15095:1]: Creating a new context 2005.10.28 14:20:58 LOG7[15095:1]: Context 66 created 2005.10.28 14:20:58 LOG7[15095:66]: Context swap: 1 -> 66 2005.10.28 14:20:58 LOG7[15095:66]: smd-pserver started 2005.10.28 14:20:58 LOG7[15095:66]: FD 0 in non-blocking mode 2005.10.28 14:20:58 LOG5[15095:66]: smd-pserver connected from 171.65.79.143:65523 2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): before/accept initialization 2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): SSLv3 read client hello A 2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): SSLv3 write server hello A 2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): SSLv3 write change cipher spec A 2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): SSLv3 write finished A 2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): SSLv3 flush data 2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): SSLv3 read finished A 2005.10.28 14:20:58 LOG7[15095:66]: 6 items in the session cache 2005.10.28 14:20:58 LOG7[15095:66]: 0 client connects (SSL_connect()) 2005.10.28 14:20:58 LOG7[15095:66]: 0 client connects that finished 2005.10.28 14:20:58 LOG7[15095:66]: 0 client renegotiatations requested 2005.10.28 14:20:58 LOG7[15095:66]: 65 server connects (SSL_accept()) 2005.10.28 14:20:58 LOG7[15095:66]: 56 server connects that finished 2005.10.28 14:20:58 LOG7[15095:66]: 0 server renegotiatiations requested 2005.10.28 14:20:58 LOG7[15095:66]: 39 session cache hits 2005.10.28 14:20:58 LOG7[15095:66]: 0 session cache misses 2005.10.28 14:20:58 LOG7[15095:66]: 11 session cache timeouts 2005.10.28 14:20:58 LOG6[15095:66]: SSL accepted: previous session reused 2005.10.28 14:20:58 LOG7[15095:66]: FD 1 in non-blocking mode 2005.10.28 14:20:58 LOG7[15095:66]: smd-pserver connecting 127.0.0.1:2401 2005.10.28 14:20:58 LOG7[15095:66]: Remote FD=1 initialized 2005.10.28 14:20:58 LOG7[15095:66]: SSL_read returned WANT_READ: retrying 2005.10.28 14:20:58 LOG7[15095:66]: SSL_write returned WANT_WRITE: retrying 2005.10.28 14:20:58 LOG7[15095:66]: SSL_read returned WANT_READ: retrying 2005.10.28 14:21:50 LOG7[15095:66]: SSL alert (read): warning: close notify 2005.10.28 14:21:50 LOG7[15095:66]: SSL closed on SSL_read 2005.10.28 14:21:50 LOG7[15095:66]: Socket write shutdown 2005.10.28 14:21:50 LOG7[15095:66]: SSL write shutdown 2005.10.28 14:21:50 LOG7[15095:66]: SSL alert (write): warning: close notify 2005.10.28 14:21:50 LOG6[15095:66]: SSL_shutdown successfully sent close_notify 2005.10.28 14:21:50 LOG5[15095:66]: Connection closed: 73224 bytes sent to SSL, 4724 bytes sent to socket 2005.10.28 14:21:50 LOG7[15095:66]: smd-pserver finished (0 left) 2005.10.28 14:21:50 LOG5[15095:66]: stack_info: size=65536, current=5004 (7%), maximum=5004 (7%) 2005.10.28 14:21:50 LOG7[15095:66]: Context 66 closed 2005.10.28 14:21:52 LOG7[15095:1]: Context set: 66 (dropped) -> 1 2005.10.28 14:21:52 LOG7[15095:1]: Current context: 1 2005.10.28 14:21:52 LOG7[15095:1]: Releasing context 66 2005.10.28 14:21:52 LOG7[15095:1]: smd-pserver accepted FD=0 from 171.65.79.143:65525 2005.10.28 14:21:52 LOG7[15095:1]: Creating a new context 2005.10.28 14:21:52 LOG7[15095:1]: Context 67 created 2005.10.28 14:21:52 LOG7[15095:67]: Context swap: 1 -> 67 2005.10.28 14:21:52 LOG7[15095:67]: smd-pserver started 2005.10.28 14:21:52 LOG7[15095:67]: FD 0 in non-blocking mode 2005.10.28 14:21:52 LOG5[15095:67]: smd-pserver connected from 171.65.79.143:65525 2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): before/accept initialization 2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): SSLv3 read client hello A 2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): SSLv3 write server hello A 2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): SSLv3 write change cipher spec A 2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): SSLv3 write finished A 2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): SSLv3 flush data 2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): SSLv3 read finished A 2005.10.28 14:21:52 LOG7[15095:67]: 6 items in the session cache 2005.10.28 14:21:52 LOG7[15095:67]: 0 client connects (SSL_connect()) 2005.10.28 14:21:52 LOG7[15095:67]: 0 client connects that finished 2005.10.28 14:21:52 LOG7[15095:67]: 0 client renegotiatations requested 2005.10.28 14:21:52 LOG7[15095:67]: 66 server connects (SSL_accept()) 2005.10.28 14:21:52 LOG7[15095:67]: 57 server connects that finished 2005.10.28 14:21:52 LOG7[15095:67]: 0 server renegotiatiations requested 2005.10.28 14:21:52 LOG7[15095:67]: 40 session cache hits 2005.10.28 14:21:52 LOG7[15095:67]: 0 session cache misses 2005.10.28 14:21:52 LOG7[15095:67]: 11 session cache timeouts 2005.10.28 14:21:52 LOG6[15095:67]: SSL accepted: previous session reused 2005.10.28 14:21:52 LOG7[15095:67]: FD 1 in non-blocking mode 2005.10.28 14:21:52 LOG7[15095:67]: smd-pserver connecting 127.0.0.1:2401 2005.10.28 14:21:52 LOG7[15095:67]: Remote FD=1 initialized 2005.10.28 14:21:53 LOG7[15095:67]: SSL_read returned WANT_READ: retrying 2005.10.28 14:21:53 LOG7[15095:67]: SSL_write returned WANT_WRITE: retrying 2005.10.28 14:21:53 LOG7[15095:67]: SSL_read returned WANT_READ: retrying ========================================================================== =========================STUNNEL.CONF====================================== ; Sample stunnel configuration file by Michal Trojnara 2002-2005 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ;Delay DNS Lookups delay = yes ; Certificate/key is needed in server mode and optional in client mode cert = /tools/stunnel/4.12/etc/stunnel/stunnel.pem ;key = /tools/stunnel/4.12/etc/stunnel/mail.pem ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /tools/stunnel/4.12/var/stunnel/ setuid = cvsadmin setgid = cvs ; PID is created inside chroot jail pid = /stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath; CApath is located inside chroot jail: ;CApath = /certs ; It's often easier to use CAfile: ;CAfile = /tools/stunnel/4.12/etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath; CRLpath is located inside chroot jail: ;CRLpath = /crls ; Alternatively you can use CRLfile: ;CRLfile = /tools/stunnel/4.12/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = /tools/stunnel/current/var/stunnel/stunnel.log ; Use it for client mode ;client = yes ; Service-level configuration ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 [pserver] accept = 22401 connect = 2401 TIMEOUTclose = 30 ; vim:ft=dosini

3 3

Strict.pm
by Jorge Abrines 17 Nov '05

17 Nov '05

Hi all, Once installed stunnel4 debian package, when I execute stunnel stunnel-mysql-client.conf (given sample) get following errors: Can't locate strict.pm in @INC (@INC contains: /etc/perl /usr/local/lib/perl/5.8.7 /usr/local/share/perl/5.8.7 /usr/lib/perl5 /usr/share/perl5 /usr/lib/perl/5.8 /usr/share/perl/5.8 /usr/local/lib/site_perl .) at /usr/share/perl/5.8/AutoLoader.pm line 3. BEGIN failed--compilation aborted at /usr/share/perl/5.8/AutoLoader.pm line 3. Compilation failed in require at /usr/lib/perl/5.8/POSIX.pm line 7. BEGIN failed--compilation aborted at /usr/lib/perl/5.8/POSIX.pm line 7. Compilation failed in require at /usr/sbin/stunnel line 26. BEGIN failed--compilation aborted at /usr/sbin/stunnel line 26. Any ideas? Thanks in advance. Regards, Jorge.

2 2

Filesystem Hierarchy Standard 2.3
by Michal Trojnara 17 Nov '05

17 Nov '05

Dear Users, I tried to make stunnel more compatible with Filesystem Hierarchy Standard 2.3. Here is the current status: - configuration and certificates are in $prefix/etc/stunnel/ - binaries are in $prefix/sbin/ - default pid file is $prefix/var/run/stunnel.pid - manual is $prefix/man/man8/stunnel.8 - other docs are in $prefix/share/doc/stunnel/ - libstunnel is in $prefix/lib - chroot directory is setup in $prefix/var/lib/stunnel/ this directory is chmoded 1770 and group nogroup Your critical comments are welcome. Best regards, Mike

1 0

Visual studio compilation errors
by Jorge Abrines 17 Nov '05

17 Nov '05

Hi, After browsing all previous list messages I havent found information about an error I get compiling stunnel with visual studio. The errors appear in linking step with undefined symbol message: "undefined symbol: LNK2019 undefined symbol _exit_stunnel referenced in function _main_initialize". I also attach the Makefile.w32 changed to work with visual studio. Thanks in advance. Regards, Jorge. Makefile.w32 follows: # Simple Makefile.w32 for stunnel.exe by Michal Trojnara 1998-2000 # # Modified by Brian Hatch (bri(a)stunnel.org) # This makefile is only tested on the mingw compiler. Mingw # can successfully compile both openssl and stunnel. If you want # to use another compiler, give it a shot, and tell us how it went. # Modify this to point to your actual openssl compile directory # (You did already compile openssl, didn't you???) SSLDIR=..\..\openssl-0.9.7g DEFINES=-DUSE_WIN32 -DHAVE_OPENSSL # You may want to add some of the following flags # to the DEFINES definition above. # Location of default certificate file for -v option # -DCERT_FILE=\"/stunnel/certs/certs.pem\" # Location of default certificate directory for -v option # -DCERT_DIR=\"/stunnel/certs\" # Default directory for stunnel.pem file # -DPEM_DIR=\"/stunnel/private\" # Use the default certificate sources from your ssl library? (0==no, 1==yes) # -DSSLLIB_CS=0 CC=cl CFLAGS= $(DEFINES) /I"$(SSLDIR)inc32" LDFLAGS=/LIBPATH:"$(SSLDIR)\out" /LIBPATH:"$(SSLDIR)\out32dll" # LIBS=-L$(SSLDIR)/out -lssl -lcrypto -lwsock32 -lgdi32 # LIBS=-L$(SSLDIR)/out -leay32 -lssl32 -lwsock32 -lgdi32 LIBS="$(SSLDIR)\out32dll\libeay32.lib" "$(SSLDIR)\out32dll\ssleay32.lib" " wsock32.lib" "gdi32.lib" OBJS=stunnel.obj ssl.obj protocol.obj sthreads.obj log.obj stunnel.exe: $(OBJS) $(CC) $(LDFLAGS) -o stunnel.exe $(OBJS) $(LIBS) .c.obj: # {.}.c{_obj\}.obj:: $(CC) /c $(CFLAGS) $(INCPATH) @<< $< << clean: del *.o del stunnel.exe

2 2

CONNECT protocol negotiations
by Michal Trojnara 16 Nov '05

16 Nov '05

Dear Users, I think some of you could be interested in testing this new feature: ftp://stunnel.mirt.net/stunnel/stunnel-4.15b2.tar.gz ftp://stunnel.mirt.net/stunnel/stunnel-4.15b2-installer.exe Sample configuration: debug=7 client = yes [my_proxy] accept=1111 connect=proxy.example.com:8080 protocol=connect protocolHost=stunnel.mirt.net:443 protocolCredentials=username:password Best regards, Mike

1 0

Vasudha Upadhyaya is out of the office.
by vasudha.upadhyaya＠convergys.com 16 Nov '05

16 Nov '05

I will be out of the office starting 11/16/2005 and will not return until 12/05/2005. I will respond to your message when I return. -- "NOTICE: The information contained in this electronic mail transmission is intended by Convergys Corporation for the use of the named individual or entity to which it is directed and may contain information that is privileged or otherwise confidential. If you have received this electronic mail transmission in error, please delete it from your system without copying or forwarding it, and notify the sender of the error by reply email or by telephone (collect), so that the sender's address records can be corrected."

1 0

more stunnel problems
by Louis Young 10 Nov '05

10 Nov '05

Hi guys Ok, as I've said in a previous mail, I'm now merely trying to get the linux client to work. In the config file: [ssmtp] accept = 465 connect = 25 But now: louislaptop:/usr/local/etc/stunnel # telnet localhost 25 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. 220 louislaptop.kpho.local ESMTP Postfix Works fine. I get the SMTP prompt. And now: louislaptop:/usr/local/etc/stunnel # telnet localhost 465 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. No SMTP prompt. In the log files: 2005.11.09 16:32:47 LOG5[32348:1]: stunnel 4.14 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7g 11 Apr 2005 2005.11.09 16:32:47 LOG7[32348:1]: Snagged 64 random bytes from /root/.rnd 2005.11.09 16:32:47 LOG7[32348:1]: Wrote 1024 new random bytes to /root/.rnd 2005.11.09 16:32:47 LOG7[32348:1]: RAND_status claims sufficient entropy for the PRNG 2005.11.09 16:32:47 LOG6[32348:1]: PRNG seeded successfully 2005.11.09 16:32:47 LOG7[32348:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2005.11.09 16:32:47 LOG7[32348:1]: Key file: /usr/local/etc/stunnel/stunnel.pem 2005.11.09 16:32:47 LOG6[32348:1]: file ulimit = 1024 (can be changed with 'ulimit -n') 2005.11.09 16:32:47 LOG6[32348:1]: poll() used - no FD_SETSIZE limit for file descriptors 2005.11.09 16:32:47 LOG5[32348:1]: 500 clients allowed 2005.11.09 16:32:47 LOG7[32348:1]: FD 4 in non-blocking mode 2005.11.09 16:32:47 LOG7[32348:1]: FD 5 in non-blocking mode 2005.11.09 16:32:47 LOG7[32348:1]: FD 6 in non-blocking mode 2005.11.09 16:32:47 LOG7[32348:1]: SO_REUSEADDR option set on accept socket 2005.11.09 16:32:47 LOG7[32348:1]: ssmtp bound to 0.0.0.0:7777 2005.11.09 16:32:47 LOG7[32349:1]: Created pid file /stunnel.pid 2005.11.09 16:32:47 LOG7[32349:0]: Waiting -1 second(s) for 2 file descriptor(s) 2005.11.09 16:32:53 LOG7[32349:0]: CONTEXT 1, FD=4, (IN)->() 2005.11.09 16:32:53 LOG7[32349:0]: CONTEXT 1, FD=6, (IN)->(IN) 2005.11.09 16:32:53 LOG7[32349:1]: ssmtp accepted FD=7 from 127.0.0.1:15767 2005.11.09 16:32:53 LOG7[32349:1]: Creating a new context 2005.11.09 16:32:53 LOG7[32349:1]: Context 2 created 2005.11.09 16:32:53 LOG7[32349:2]: Context swap: 1 -> 2 2005.11.09 16:32:53 LOG7[32349:2]: ssmtp started 2005.11.09 16:32:53 LOG7[32349:2]: FD 7 in non-blocking mode 2005.11.09 16:32:53 LOG7[32349:2]: TCP_NODELAY option set on local socket 2005.11.09 16:32:53 LOG5[32349:2]: ssmtp connected from 127.0.0.1:15767 2005.11.09 16:32:53 LOG7[32349:2]: SSL state (accept): before/accept initialization 2005.11.09 16:32:53 LOG7[32349:0]: Waiting 300 second(s) for 3 file descriptor(s) 2005.11.09 16:37:53 LOG7[32349:0]: CONTEXT 1, FD=4, (IN)->() 2005.11.09 16:37:53 LOG7[32349:0]: CONTEXT 1, FD=6, (IN)->() 2005.11.09 16:37:53 LOG7[32349:0]: CONTEXT 2, FD=7, (IN)->() 2005.11.09 16:37:53 LOG6[32349:2]: init_ssl: s_poll_wait timeout 2005.11.09 16:37:53 LOG7[32349:2]: ssmtp finished (0 left) 2005.11.09 16:37:53 LOG3[32349:2]: STACK_RESERVE is too high 2005.11.09 16:37:53 LOG7[32349:2]: Context 2 closed 2005.11.09 16:37:53 LOG7[32349:0]: Waiting -1 second(s) for 2 file descriptor(s) 2005.11.09 16:58:51 LOG5[32349:0]: Received signal 15; terminating 2005.11.09 16:58:51 LOG7[32349:0]: removing pid file /stunnel.pid Any ideas? -- Regards Louis Young Systems Administrator Kwikpay SA (Pty) Ltd

2 3

Re: [stunnel-users] Solaris: new_context, makecontext
by Hans Werner Strube 09 Nov '05

09 Nov '05

Hans Werner Strube wrote: > 1. Line 92 of sthreads.c, > (char *)ctx->ctx.uc_stack.ss_sp+=STACK_SIZE-8; > causes a compiler warning: "a cast does not yield an lvalue." > > 2. The Solaris <9 SPARC peculiarity concerning the third argument of > makecontext might be taken into account. > > Both would be fixed by the following changes. > ***Caveat: I do not know how the third argument of makecontext behaves > in Solaris x86 for versions <9 vs. >=9. Have no machine to test this. Sorry, my patch contained a bad error: ctx->stack+=STACK_SIZE-8 is, of course, nonsense, since ctx->stack must not be changed. My patch to version 4.15b1 should read instead: *** sthreads.c.15b1 Wed Nov 9 12:18:18 2005 --- sthreads.c Wed Nov 9 17:07:57 2005 *************** *** 78,85 **** return NULL; } ctx->ctx.uc_link=NULL; /* it should never happen */ ! ctx->ctx.uc_stack.ss_sp=ctx->stack; ! #if defined(__sgi) || (defined(CPU_SPARC) && ( \ defined(OS_SOLARIS2_0) || \ defined(OS_SOLARIS2_1) || \ defined(OS_SOLARIS2_2) || \ --- 78,84 ---- return NULL; } ctx->ctx.uc_link=NULL; /* it should never happen */ ! #if defined(CPU_SPARC) && ( \ defined(OS_SOLARIS2_0) || \ defined(OS_SOLARIS2_1) || \ defined(OS_SOLARIS2_2) || \ *************** *** 88,96 **** defined(OS_SOLARIS2_5) || \ defined(OS_SOLARIS2_6) || \ defined(OS_SOLARIS2_7) || \ ! defined(OS_SOLARIS2_8))) ! (char *)ctx->ctx.uc_stack.ss_sp+=STACK_SIZE-8; #endif ctx->ctx.uc_stack.ss_size=STACK_SIZE; ctx->ctx.uc_stack.ss_flags=0; --- 87,102 ---- defined(OS_SOLARIS2_5) || \ defined(OS_SOLARIS2_6) || \ defined(OS_SOLARIS2_7) || \ ! defined(OS_SOLARIS2_8)) ! #define MCTXA 2 ! #else ! #define MCTXA 1 #endif + #if defined(__sgi) || (MCTXA == 2) + ctx->ctx.uc_stack.ss_sp=ctx->stack+STACK_SIZE-8; + #else + ctx->ctx.uc_stack.ss_sp=ctx->stack; + #endif ctx->ctx.uc_stack.ss_size=STACK_SIZE; ctx->ctx.uc_stack.ss_flags=0; *************** *** 121,127 **** if(!ctx) return -1; s_log(LOG_DEBUG, "Context %ld created", ctx->id); ! makecontext(&ctx->ctx, (void(*)(void))cli, 1, arg); return 0; } --- 127,133 ---- if(!ctx) return -1; s_log(LOG_DEBUG, "Context %ld created", ctx->id); ! makecontext(&ctx->ctx, (void(*)(void))cli, MCTXA, arg); return 0; }

1 0

Trouble between linux client and windows server
by Louis Young 09 Nov '05

09 Nov '05

Hi guys I'm trying to use stunnel between a windows server and a linux client. On the windows server: [VNC] accept = 5901 connect = 5900 and on the linux client: ; VNC server on 192.168.100.57 accept = 5901 connect = 192.168.100.65:5901 But, alas: Trying 127.0.0.1... telnet: connect to address 127.0.0.1: Connection refused Trying ::1... telnet: connect to address ::1: Connection refused It's almost as if stunnel isn't listening on that port on the linux client. Any ideas? -- Regards Louis Young Systems Administrator Kwikpay SA (Pty) Ltd

1 1

Re: [stunnel-users] Solaris: new_context, makecontext
by Hans Werner Strube 09 Nov '05

09 Nov '05

Michal Trojnara wrote: > Please try: ftp://stunnel.mirt.net/stunnel/stunnel-4.15b1.tar.gz The changes to common.h and sthreads.c with respect to new_context and makecontext are reasonable. However, there are two problems: 1. Line 92 of sthreads.c, (char *)ctx->ctx.uc_stack.ss_sp+=STACK_SIZE-8; causes a compiler warning: "a cast does not yield an lvalue." 2. The Solaris <9 SPARC peculiarity concerning the third argument of makecontext might be taken into account. Both would be fixed by the following changes. ***Caveat: I do not know how the third argument of makecontext behaves in Solaris x86 for versions <9 vs. >=9. Have no machine to test this. *** sthreads.c.15b1 Wed Nov 9 12:18:18 2005 --- sthreads.c Wed Nov 9 14:56:18 2005 *************** *** 78,85 **** return NULL; } ctx->ctx.uc_link=NULL; /* it should never happen */ ! ctx->ctx.uc_stack.ss_sp=ctx->stack; ! #if defined(__sgi) || (defined(CPU_SPARC) && ( \ defined(OS_SOLARIS2_0) || \ defined(OS_SOLARIS2_1) || \ defined(OS_SOLARIS2_2) || \ --- 78,84 ---- return NULL; } ctx->ctx.uc_link=NULL; /* it should never happen */ ! #if defined(CPU_SPARC) && ( \ defined(OS_SOLARIS2_0) || \ defined(OS_SOLARIS2_1) || \ defined(OS_SOLARIS2_2) || \ *************** *** 88,96 **** defined(OS_SOLARIS2_5) || \ defined(OS_SOLARIS2_6) || \ defined(OS_SOLARIS2_7) || \ ! defined(OS_SOLARIS2_8))) ! (char *)ctx->ctx.uc_stack.ss_sp+=STACK_SIZE-8; #endif ctx->ctx.uc_stack.ss_size=STACK_SIZE; ctx->ctx.uc_stack.ss_flags=0; --- 87,101 ---- defined(OS_SOLARIS2_5) || \ defined(OS_SOLARIS2_6) || \ defined(OS_SOLARIS2_7) || \ ! defined(OS_SOLARIS2_8)) ! #define MCtxA 2 ! #else ! #define MCtxA 1 #endif + #if defined(__sgi) || (MCtxA == 2) + ctx->stack+=STACK_SIZE-8; + #endif + ctx->ctx.uc_stack.ss_sp=ctx->stack; ctx->ctx.uc_stack.ss_size=STACK_SIZE; ctx->ctx.uc_stack.ss_flags=0; *************** *** 121,127 **** if(!ctx) return -1; s_log(LOG_DEBUG, "Context %ld created", ctx->id); ! makecontext(&ctx->ctx, (void(*)(void))cli, 1, arg); return 0; } --- 126,132 ---- if(!ctx) return -1; s_log(LOG_DEBUG, "Context %ld created", ctx->id); ! makecontext(&ctx->ctx, (void(*)(void))cli, MCtxA, arg); return 0; }

1 0

Re: [stunnel-users] Solaris: new_context, makecontext
by Hans Werner Strube 09 Nov '05

09 Nov '05

Alexander Lazic wrote: > The semantics of the uc_stack member of the ucontext_t structure have > changed as they apply to inputs to makecontext(). Prior to Solaris 10, > the ss_sp member of the uc_stack structure represented the high memory > address of the area reserved for the stack. The ss_sp member now > represents the base (low memory address), in keeping with other uses of > ss_sp. > > This change in the meaning of ss_sp is now the default behavior. The > -D__MAKECONTEXT_V2_SOURCE compilation flag used in Solaris 9 update > releases to access this behavior is obsolete. Solaris 9_x86 does not use __MAKECONTEXT_V2_SOURCE, see /usr/include/ucontext.h: *** Solaris 9: #if defined(__MAKECONTEXT_V2_SOURCE) && defined(__sparc) #ifdef __PRAGMA_REDEFINE_EXTNAME #pragma redefine_extname makecontext __makecontext_v2 #else #define makecontext __makecontext_v2 #endif #endif *** Solaris 10: #ifdef __sparc #ifdef __PRAGMA_REDEFINE_EXTNAME #pragma redefine_extname makecontext __makecontext_v2 #else #define makecontext __makecontext_v2 #endif In libc.so.1, __makecontext_v2 is the "new" function and makecontext the "old" one (binary compatible to Solaris 8 and earlier). For Solaris x86, there is only one function makecontext in all versions. Thus the behavior might not have been changed. A small test program in Solaris 9_x86 (have no earlier versions) indicated the "new" behavior.

2 1

IPTables/Stunnel Help needed
by Alaric Dailey 08 Nov '05

08 Nov '05

Ok, I have a fairly complex firewall setup on my Linux box with 7 host IPs, 2 Internet connections, and a DMZ. I need to direct 1 IP to stunnel on the firewall to be forwarded to the mail server in the DMZ on ports 8383, 993, 995 etc.. but leave ports 25, and 3389 forwarded via iptables, can anyone lend a hand?

1 0

Re: [stunnel-users] Solaris: new_context, makecontext
by Hans Werner Strube 08 Nov '05

08 Nov '05

Michal Trojnara wrote: > I had no Solaris 10 to test it... So what's the correct way to detect > Solaris 10? This must probably be done by a modified configure and a new #if or #ifdef. uname -r gives 5.10 for Solaris 10. > Solaris 9 behaves correctly if __MAKECONTEXT_V2_SOURCE is defined (it > is defined in common.h). I've tested this case. Yes, of course. I have not stated anything different. > The manual claims: > The value of > argc must match the number of integer arguments passed to > func, otherwise the behavior is undefined. > (SunOS mion 5.9 Generic_112233-12 sun4u sparc SUNW,Ultra-250) > > I only pass single argument... Yes, but up to Solaris 8 it claimed: The integer value of argc must be one-greater-than the number of arguments that follow argc; otherwise, the behavior is undefined. For 5 arguments, the value of argc must be 6. AfaIk this would also hold for Solaris 9 without __MAKECONTEXT_V2_SOURCE, but this is deprecated. Btw, Solaris 9 and 10 can still handle binaries compiled under earlier versions.

1 0

Re: stunnel 4.14 and openssl 0.9.8a
by MeeAGhost 08 Nov '05

08 Nov '05

I am using stunnel to tunnel my VNC connection. As recent as version 4.12 I have been able to use the libeay32.dll and libssl32.dll files I created with openssl 0.9.X.X using Msys and Mingw with the steps below: 1. I comment out line 910 in the openssl Configure script 2. Create .def for dll's: perl util/mkdef.pl 32 libeay > ms/libeay32.def perl util/mkdef.pl 32 ssleay > ms/ssleay32.def 3. Execute the openssl configure script ./Configure mingw 4. Execute the make for openssl make 5. After the make completes I create the dlls dllwrap --dllname libeay32.dll --output-lib libeay32.a --def ms/libeay32.def libcrypto.a -lwsock32 -lgdi32 dllwrap --dllname libssl32.dll --output-lib libssl32.a --def ms/ssleay32.def libssl.a libeay32.a When I place the resulting dlls on the remote machine with version 4.14installed and establish a VNC connection to machine stunnel crashes and generates a Dr. Watson error. If I revert back to version 4.12 the dlls I created using the steps above --- everything works. If I install the 0.9.7idlls (which come as a part of the 4.14 Win Install package) everything works. I am trying to keep server and clients on the same version of openssl which is why I have been compling new dlls whenever I have upgraded the servers. Is there something unique being done in version 4.14 that prevents dlls created with 0.9.8a from being used? -- Chris

2 3

Solaris: new_context, makecontext
by Hans Werner Strube 08 Nov '05

08 Nov '05

Concerns all versions of sthreads.c using ucontext: As far as I know from the Solaris documentation and some experiments, the context treatment in new_context() is not universally correct. #if defined(__sgi) || (defined(__sparc) && !defined(HAVE___MAKECONTEXT_V2)) ctx->ctx.uc_stack.ss_sp=ctx->stack+STACK_SIZE-8; #else /* not an IRIX or old and buggy Solaris on Sparc */ ctx->ctx.uc_stack.ss_sp=ctx->stack; #endif The first case is wrong for Solaris 10, since HAVE___MAKECONTEXT_V2 is not defined there but the behavior is _always_ as with HAVE___MAKECONTEXT_V2 in Solaris 9 SPARC. (Solaris 9 SPARC behaves like Solaris 7 and 8 SPARC ["old and buggy"] if HAVE___MAKECONTEXT_V2 is not set, and like Solaris 10 if it is set.) In the "old and buggy" case, the third argument of makecontext() should be 2 instead of 1 (although the latter _may_ work). I do not know how this is in Solaris x86. At least, HAVE___MAKECONTEXT_V2 has no meaning there.

3 3

stunnel 4.14 released
by Michal Trojnara 03 Nov '05

03 Nov '05

The ChangeLog entry for stunnel 4.14: Version 4.14, 2005.11.02, urgency: HIGH: * Bugfixes - transfer() fixed to avoid random stalls introduced in version 4.12. - poll() error handing bug fixed. - Checking for dynamic loader libraries added again. - Default pidfile changed from $localstatedir/run/stunnel.pid to $localstatedir/stunnel/stunnel.pid. - Basic SSL library initalization moved to the beginning of execution. * Release notes - This is an important bugfix release. Upgrade is recommended. sha1sum for stunnel-4.14.tar.gz: b2edb3a2473367f2a9f04a877adcb332483a5267 Home page and download: http://stunnel.mirt.net/ Best regards, Mike

2 2

I: error=certificate signature failure
by Pulcini Maddalena 03 Nov '05

03 Nov '05

________________________________ Da: Pulcini Maddalena Inviato: gio 03/11/2005 8.58 A: stunnel Oggetto: I: error=certificate signature failure ________________________________ Da: Pulcini Maddalena Inviato: mer 02/11/2005 17.14 A: stunnel Oggetto: error=certificate signature failure Hi All, someone could help me to understand what happens and what my client needs to verify the peer? Thanks&Regards I configure stunnel in this way: stunnel.conf ================================ client = yes debug=7 cert = client69f.pem key = chiave69.pem cafile=cacert.pem verify = 1 capath= . [telnet] accept = 23 connect = 10.36.3.191:4433 ============================ I put all the files configured above in the same directory where stunnel-4.07.exe runs; I have a machine in which ssl server runs with a certificate signed by the same CA (cacert.pem). The log file is : ====================================== 2005.11.02 16:33:47 LOG5[1456:1084]: stunnel 4.07 on x86-pc-mingw32-gnu WIN32+IPv4 with OpenSSL 0.9.7f 22 Mar 2005 2005.11.02 16:33:47 LOG7[1456:1504]: Snagged 64 random bytes from C:/.rnd 2005.11.02 16:33:47 LOG7[1456:1504]: Wrote 1024 new random bytes to C:/.rnd 2005.11.02 16:33:47 LOG7[1456:1504]: RAND_status claims sufficient entropy for the PRNG 2005.11.02 16:33:47 LOG6[1456:1504]: PRNG seeded successfully 2005.11.02 16:33:47 LOG7[1456:1504]: Certificate: client69f.pem 2005.11.02 16:33:47 LOG7[1456:1504]: Key file: chiave69.pem 2005.11.02 16:33:47 LOG7[1456:1504]: Loaded verify certificates from cacert.pem 2005.11.02 16:33:47 LOG7[1456:1504]: Verify directory set to . 2005.11.02 16:33:47 LOG5[1456:1504]: No limit detected for the number of clients 2005.11.02 16:33:47 LOG7[1456:1504]: FD 156 in non-blocking mode 2005.11.02 16:33:47 LOG7[1456:1504]: SO_REUSEADDR option set on accept socket 2005.11.02 16:33:47 LOG7[1456:1504]: telnet bound to 0.0.0.0:23 2005.11.02 16:34:14 LOG7[1456:1504]: telnet accepted FD=168 from 127.0.0.1:2501 2005.11.02 16:34:14 LOG7[1456:1504]: FD 168 in non-blocking mode 2005.11.02 16:34:14 LOG7[1456:1504]: Creating a new thread 2005.11.02 16:34:14 LOG7[1456:1504]: New thread created 2005.11.02 16:34:14 LOG7[1456:1320]: telnet started 2005.11.02 16:34:14 LOG5[1456:1320]: telnet connected from 127.0.0.1:2501 2005.11.02 16:34:14 LOG7[1456:1320]: FD 192 in non-blocking mode 2005.11.02 16:34:14 LOG7[1456:1320]: telnet connecting 10.36.3.191:4433 2005.11.02 16:34:14 LOG7[1456:1320]: connect_wait: waiting 10 seconds 2005.11.02 16:34:14 LOG7[1456:1320]: connect_wait: connected 2005.11.02 16:34:14 LOG7[1456:1320]: Remote FD=192 initialized 2005.11.02 16:34:14 LOG7[1456:1320]: SSL state (connect): before/connect initialization 2005.11.02 16:34:14 LOG7[1456:1320]: SSL state (connect): SSLv3 write client hello A 2005.11.02 16:34:14 LOG7[1456:1320]: SSL state (connect): SSLv3 read server hello A 2005.11.02 16:34:14 LOG4[1456:1320]: VERIFY ERROR: depth=1, error=certificate signature failure: /C=Siena/O=amtec/OU=elsag/CN=CERTIFICATION AUTHORITY 2.0/description=CA CERTIFICATE/L=Abbadia San Salvatore 2005.11.02 16:34:14 LOG7[1456:1320]: SSL alert (write): fatal: handshake failure 2005.11.02 16:34:14 LOG3[1456:1320]: error stack: 14090086 : error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed 2005.11.02 16:34:14 LOG3[1456:1320]: error stack: D089006 : error:0D089006:asn1 encoding routines:ASN1_verify:EVP lib 2005.11.02 16:34:14 LOG3[1456:1320]: SSL_connect: 4077068: error:04077068:rsa routines:RSA_verify:bad signature 2005.11.02 16:34:14 LOG7[1456:1320]: telnet finished (0 left)

1 0

4.14b1+0.9.7i client loop in s_poll_wait/scan_waiting_queue
by Richard.Hall 30 Oct '05

30 Oct '05

Obviously stunnel problems are like London buses - you wait years for one, then two come along inside a week ;-) Having fixed my server-side problems by installing 4.14b1, I now have a problem on the client side. Apologies for the voluminous diagnostics below, but hopefully they will help make the problem clear. I am running Apache + mod_jk, stunneling to a remote JBoss server. The client is stunnel 4.14 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7i 14 Oct 2005 When things are running normally, everything is sweetness and light. However, if I 'kill -HUP' the Apache server (eg to do a log rotation), the mod_jk connection to stunnel gets closed, and stunnel goes into a loop. If I enable DEBUG_UCONTEXT in network.c, and add a few lines of diagnostics:- $ diff -c network.c.orig network.c.loop *** network.c.orig Thu Oct 20 08:37:47 2005 --- network.c.loop Thu Oct 27 13:07:10 2005 *************** *** 31,37 **** #include "common.h" #include "prototypes.h" ! /* #define DEBUG_UCONTEXT */ #ifndef USE_WIN32 static int signal_pipe[2]={-1, -1}; --- 31,37 ---- #include "common.h" #include "prototypes.h" ! #define DEBUG_UCONTEXT #ifndef USE_WIN32 static int signal_pipe[2]={-1, -1}; *************** *** 156,167 **** for(i=0; i<ctx->fds->nfds; i++) { ctx->fds->ufds[i].revents=ufds[nfds].revents; #ifdef DEBUG_UCONTEXT ! s_log(LOG_DEBUG, "CONTEXT %ld, FD=%d, (%s%s)->(%s%s)", ctx->id, ufds[nfds].fd, ufds[nfds].events & POLLIN ? "IN" : "", ufds[nfds].events & POLLOUT ? "OUT" : "", ufds[nfds].revents & POLLIN ? "IN" : "", ! ufds[nfds].revents & POLLOUT ? "OUT" : ""); #endif if(ufds[nfds].revents & (POLLIN|POLLOUT)) ctx->ready++; --- 156,170 ---- for(i=0; i<ctx->fds->nfds; i++) { ctx->fds->ufds[i].revents=ufds[nfds].revents; #ifdef DEBUG_UCONTEXT ! s_log(LOG_DEBUG, "CONTEXT %ld, FD=%d, (%s%s)->(%s%s%s%s%s)", ctx->id, ufds[nfds].fd, ufds[nfds].events & POLLIN ? "IN" : "", ufds[nfds].events & POLLOUT ? "OUT" : "", ufds[nfds].revents & POLLIN ? "IN" : "", ! ufds[nfds].revents & POLLOUT ? "OUT" : "", ! ufds[nfds].revents & POLLERR ? "ERR" : "", ! ufds[nfds].revents & POLLHUP ? "HUP" : "", ! ufds[nfds].revents & POLLNVAL ? "NVAL" : ""); #endif if(ufds[nfds].revents & (POLLIN|POLLOUT)) ctx->ready++; I get (with fd=9 being the mod_jk socket, fd=10 the SSL one, and TIMEOUTidle set to 35 seconds for demo purposes) ... 2005.10.27 13:13:42 LOG7[1286:0]: Waiting 35 second(s) for 7 file descriptor(s) 2005.10.27 13:13:42 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:13:42 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:13:42 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:13:42 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:13:42 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:13:42 LOG7[1286:0]: CONTEXT 2, FD=9, (INOUT)->(OUT) 2005.10.27 13:13:42 LOG7[1286:0]: CONTEXT 2, FD=10, (IN)->(IN) 2005.10.27 13:13:42 LOG7[1286:2]: SSL_read returned WANT_READ: retrying 2005.10.27 13:13:42 LOG7[1286:0]: Waiting 35 second(s) for 7 file descriptor(s) 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 2, FD=9, (IN)->(IN) 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 2, FD=10, (IN)->() 2005.10.27 13:13:43 LOG7[1286:2]: Socket closed on read ... ie mod_jk has disconnected. Everything carries on for a while ... 2005.10.27 13:13:43 LOG7[1286:2]: SSL write shutdown 2005.10.27 13:13:43 LOG7[1286:0]: Waiting 60 second(s) for 6 file descriptor(s) 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 2, FD=10, (INOUT)->(OUT) 2005.10.27 13:13:43 LOG7[1286:2]: SSL alert (write): warning: close notify 2005.10.27 13:13:43 LOG7[1286:2]: SSL_shutdown retrying 2005.10.27 13:13:43 LOG7[1286:2]: SSL doesn't need to read or write 2005.10.27 13:13:43 LOG7[1286:0]: Waiting 60 second(s) for 6 file descriptor(s) 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 2, FD=10, (IN)->(IN) 2005.10.27 13:13:45 LOG7[1286:0]: Waiting 35 second(s) for 7 file descriptor(s) 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 2, FD=10, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 2, FD=9, (OUT)->(OUT) [...] 2005.10.27 13:13:46 LOG7[1286:0]: Waiting 60 second(s) for 6 file descriptor(s) 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 2, FD=10, (IN)->(IN) 2005.10.27 13:13:46 LOG7[1286:2]: SSL_read returned WANT_READ: retrying 2005.10.27 13:13:46 LOG7[1286:0]: Waiting 60 second(s) for 6 file descriptor(s) 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 2, FD=10, (IN)->(IN) 2005.10.27 13:13:46 LOG7[1286:0]: Waiting 35 second(s) for 7 file descriptor(s) 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 2, FD=10, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 2, FD=9, (OUT)->(ERRHUP) ... but eventually we start getting ERRHUP (ie POLLERR | POLLHUP), not OUT, on fd 9, and then we end up in a tight loop of 2005.10.27 13:13:46 LOG7[1286:0]: Waiting 35 second(s) for 7 file descriptor(s) 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 2, FD=10, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 2, FD=9, (OUT)->(ERRHUP) ... until eventually we get [...] 2005.10.27 13:14:23 LOG7[1286:0]: Waiting 2 second(s) for 6 file descriptor(s) 2005.10.27 13:14:23 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:14:23 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:14:23 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:14:23 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:14:23 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:14:25 LOG7[1286:0]: CONTEXT 2, FD=9, (OUT)->(ERRHUP) 2005.10.27 13:14:25 LOG7[1286:0]: Waiting 0 second(s) for 6 file descriptor(s) 2005.10.27 13:14:25 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:14:25 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:14:25 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:14:25 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:14:25 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:14:25 LOG7[1286:0]: CONTEXT 2, FD=9, (OUT)->(ERRHUP) 2005.10.27 13:14:25 LOG6[1286:2]: s_poll_wait timeout: connection reset 2005.10.27 13:14:25 LOG5[1286:2]: Connection reset: 260 bytes sent to SSL, 24734 bytes sent to socket The problem seems to be in network.c:s_poll_wait(), in the code while(!ready_head) /* no context ready */ scan_waiting_queue(); because poll() returns > 0, but scan_waiting_queue() never sets ready_head because no fd has yielded POLLIN or POLLOUT:- if(ufds[nfds].revents & (POLLIN|POLLOUT)) ctx->ready++; The end result is that we chew up CPU until TIMEOUTidle expires (which is rather a long time if left at the default of 12 hours!!) I have fudged a circumvention as follows (because I couldn't follow the logic well enough to do it cleanly, and time is running out on me, I'm afraid.) $ diff -c network.c.loop network.c *** network.c.loop Thu Oct 27 13:07:10 2005 --- network.c Thu Oct 27 13:05:21 2005 *************** *** 166,172 **** ufds[nfds].revents & POLLHUP ? "HUP" : "", ufds[nfds].revents & POLLNVAL ? "NVAL" : ""); #endif ! if(ufds[nfds].revents & (POLLIN|POLLOUT)) ctx->ready++; nfds++; } --- 166,172 ---- ufds[nfds].revents & POLLHUP ? "HUP" : "", ufds[nfds].revents & POLLNVAL ? "NVAL" : ""); #endif ! if(ufds[nfds].revents & (POLLIN|POLLOUT|POLLERR|POLLHUP|POLLNVAL)) ctx->ready++; nfds++; } ... which seems to solve the problem but produces a rather untidy result:- 2005.10.27 13:17:46 LOG7[1759:0]: Waiting 35 second(s) for 7 file descriptor(s) 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 2, FD=10, (IN)->(IN) 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 2, FD=9, (OUT)->(OUT) 2005.10.27 13:17:46 LOG7[1759:0]: Waiting 35 second(s) for 6 file descriptor(s) 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 2, FD=9, (OUT)->(ERRHUP) 2005.10.27 13:17:46 LOG3[1759:2]: INTERNAL ERROR: s_poll_wait returned 1, but no descriptor is ready 2005.10.27 13:17:46 LOG5[1759:2]: Connection reset: 260 bytes sent to SSL, 41132 bytes sent to socket ... i.e it sorts itself out quickly, but at the cost of logging an INTERNAL ERROR, which doesn't look very good ;-) As far as I could tell (but haven't shown), everything actually got close'd correctly. As I say, I appear to have a circumvention, so I'm not hanging on a proper fix (unless anyone can see any fatal flaw in what I've done?) Regards, Richard

2 1

Question on config for Global Option 'output'
by Tara.L.Weaver＠wellsfargo.com 30 Oct '05

30 Oct '05

Can a file size be determined for 'output' in the config? If so, how can that be done? Or can overwrite be configured for output? STunnel version 4.09 on x86-pc-mingw32-gnu WIN32+IPv6 with OpenSSL 0.9.7e (SQL)Server config: client = no taskbar = yes CAFile = root_ca.cer ciphers = AES128-SHA cert = stunnel.pem output = d:\STunnel\STunnelLog debug=5 [FraudProd] accept = 1364 connect = 1433 Tara L. Weaver Network Analyst 2 Wells Fargo Services Contact Center System Support Office: 612\667-5795 Tara.L.Weaver(a)WellsFargo.com > This message may contain confidential and/or privileged information. > If you are not the addressee or authorized to receive this for the > addressee, you must not use, copy, disclose, or take any action based > on this message or any information herein. If you have received this > message in error, please advise the sender immediately by reply e-mail > and delete this message. Thank you for your cooperation. >

2 1

Boot Password
by Bob 30 Oct '05

30 Oct '05

I need to use signed certificates with stunnel. New to the whole certificate thing. I have the certificate and key and built the .PEM file but when I try to start stunnel in the background it asks me to enter the PEM password. How can I enter the password and have stunnel start during boot? _______________________________________________________________________ Thanks, Bob (bobif(a)yahoo.com) YahooIM: bobif AOLIM: bobifmd ICQ: 111083556

2 1

4.13+0.9.7i server stops writing SSL output
by Richard.Hall 25 Oct '05

25 Oct '05

First-time post (though long-time satisfied occasional user). Searched the archives but if there is anything relevant, I've obviously missed it. I really cannot decide if this is an stunnel problem or an OpenSSL problem. Client is remote and running stunnel 4.12 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4 with OpenSSL 0.9.6i Server is local, I've been through 4.12 + 0.9.6m 4.13 + 0.9.6m and now trying stunnel 4.13 on sparc-sun-solaris2.8 UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7i (I've resisted the urge to try OpenSSL 0.9.8* as people seem to be experiencing 'issues') Small amounts of data are fine. But for larger amounts the connection goes to sleep. The way I read it, the server end stops trying to write to the SSL side. The relevant parts of # truss -w2 -v poll -dl /usr/local/stunnel-4.13/sbin/stunnel look like this: (apologies for doing it like this, but it seemed the easiest way to combine the debug output and truss output) (fd=7 is the SSL side, fd=8 the local side, TIMEOUTidle is set to 35 seconds for demo purposes) /1: 15.5722 read(8, " A B\0\n03\007\t\t\r\n\t".., 8178) = 8178 /1: poll(0x00049DD8, 3, 35000) (sleeping...) /1: fd=3 ev=POLLIN rev=0 /1: fd=6 ev=POLLIN rev=0 /1: fd=7 ev=POLLIN|POLLOUT rev=POLLIN /1: 17.3166 poll(0x00049DD8, 3, 35000) = 1 /1: fd=3 ev=POLLIN rev=0 /1: fd=6 ev=POLLIN rev=0 /1: fd=7 ev=POLLIN|POLLOUT rev=POLLOUT /1: 17.3229 write(7, "1703\0\0188CBEC9 : O\t u".., 16442) = 16442 /1: 17.3234 poll(0x00049DD8, 4, 35000) = 1 /1: fd=3 ev=POLLIN rev=0 /1: fd=6 ev=POLLIN rev=0 /1: fd=8 ev=POLLIN rev=POLLIN /1: fd=7 ev=POLLIN rev=0 So far, so good. /1: 17.3238 read(8, "\t\t\t\r\n\t\t\t\r\n\t\t".., 16384) = 16384 /1: 17.3240 poll(0x00049DD8, 3, 35000) = 1 /1: fd=3 ev=POLLIN rev=0 /1: fd=6 ev=POLLIN rev=0 /1: fd=7 ev=POLLIN|POLLOUT rev=POLLOUT /1: 17.3299 write(7, "1703\0\018ED 1AD91A888 i".., 16442) = 14480 For whatever reason, the write() was only partial. I'm guessing n/w issues, as the client is a loooong way away ;-) /1: 17.3303 write(7, " fE3DDA8FE ! i8DD8\fEBEC".., 1962) Err#11 EAGAIN /1: 17.3308 write(2, 0x00071D60, 74) = 74 /1: 2 0 0 5 . 1 0 . 2 4 1 4 : 5 0 : 3 0 L O G 7 [ 2 0 6 4 7 : 2 /1: ] : S S L _ w r i t e r e t u r n e d W A N T _ W R I T E /1: : r e t r y i n g /1: 17.3312 write(2, "\n", 1) = 1 /1: 17.3315 read(7, 0x000778D8, 5) Err#11 EAGAIN /1: 17.3318 write(2, 0x00071D60, 72) = 72 /1: 2 0 0 5 . 1 0 . 2 4 1 4 : 5 0 : 3 0 L O G 7 [ 2 0 6 4 7 : 2 /1: ] : S S L _ r e a d r e t u r n e d W A N T _ R E A D : /1: r e t r y i n g /1: 17.3321 write(2, "\n", 1) = 1 So we've now done an SSL_write, which yielded SSL_ERROR_WANT_WRITE, _and_ an SSL_read, which yielded SSL_ERROR_WANT_READ, (and which I think removes the SSL_ERROR_WANT_WRITE condition, as we can only have one or the other.) This means that, the next time round the loop (in client.c:transfer()), want_rd is TRUE, want_wr is FALSE, so we don't poll the SSL connection for output, only input: /1: poll(0x00049DD8, 3, 35000) (sleeping...) /1: fd=3 ev=POLLIN rev=0 /1: fd=6 ev=POLLIN rev=0 /1: fd=7 ev=POLLIN rev=POLLOUT But there won't be any input (trust me on that!), so we time out ... /1: 52.3387 poll(0x00049DD8, 3, 35000) = 0 /1: fd=3 ev=POLLIN rev=0 /1: fd=6 ev=POLLIN rev=0 /1: fd=7 ev=POLLIN rev=0 /1: 52.3394 write(2, 0x00071D60, 72) = 72 /1: 2 0 0 5 . 1 0 . 2 4 1 4 : 5 1 : 0 5 L O G 6 [ 2 0 6 4 7 : 2 /1: ] : s _ p o l l _ w a i t t i m e o u t : c o n n e c t i /1: o n r e s e t /1: 52.3399 write(2, "\n", 1) = 1 /1: 52.3403 write(2, 0x00071DD0, 102) = 102 /1: 2 0 0 5 . 1 0 . 2 4 1 4 : 5 1 : 0 5 L O G 5 [ 2 0 6 4 7 : 2 /1: ] : C o n n e c t i o n r e s e t : 5 7 6 1 7 b y t e s /1: s e n t t o S S L , 1 3 1 b y t e s s e n t t o /1: s o c k e t Now I have never before needed (nor wanted!) to delve into the inner workings of either stunnel or OpenSSL, so I may be in completely the wrong ballpark here. But I cannot understand the logic of the following bit of code in transfer() :- if((c->sock_ptr && !want_rd) || /* socket input buffer not empty */ ssl_closing==CL_INIT /* need to send close_notify */ || ((c->ssl_ptr<BUFFSIZE || ssl_closing==CL_RETRY) && want_wr)) /* want to SSL_read or SSL_shutdown but write to the * underlying socket needed for the SSL protocol */ s_poll_add(&c->fds, c->ssl_wfd->fd, 0, 1); In particular, if I change the first line to if(c->sock_ptr || /* socket input buffer not empty */ then everything starts working (correctly as far as I can see). The OpenSSL man pages seem (to me) to say that it is perfectly permissible to call SSL_write when we have SSL_ERROR_WANT_READ. Help? TIA, Richard Hall

4 6

how to sign each pem file with the local CA
by Jonathan Carpenter 21 Oct '05

21 Oct '05

I am trying to setup stunnel to encrypt syslog-ng logs, but all the tutorials that I have found tell me to sign each pem file with the local CA I have tried to find out how in the stunnel archives but have had no luck. Can anyone help me? Thanks

1 0

Stunnel Configure Warning
by G J Piper 21 Oct '05

21 Oct '05

I was upgrading my Stunnel 4.11 to 4.13 when I saw this in the config check and decided to post it to see if I should continue installing... the config told me (obvoiously) to post this message... heh: > checking ucontext.h usability... no > checking ucontext.h presence... yes > configure: WARNING: ucontext.h: present but cannot be compiled > configure: WARNING: ucontext.h: check for missing prerequisite headers? > configure: WARNING: ucontext.h: see the Autoconf documentation > configure: WARNING: ucontext.h: section "Present But Cannot Be Compiled" > configure: WARNING: ucontext.h: proceeding with the preprocessor's result > configure: WARNING: ucontext.h: in the future, the compiler will take precedence > configure: WARNING: ## ---------------------------------- ## > configure: WARNING: ## Report this to the stunnel lists. ## > configure: WARNING: ## ---------------------------------- ## > checking for ucontext.h... yes > checking pthread.h usability... yes > checking pthread.h presence... yes > checking for pthread.h... yes What can be done? ~ Greg

2 1

stunnel 4.13 released
by Michal Trojnara 21 Oct '05

21 Oct '05

Version 4.13, 2005.10.21, urgency: MEDIUM: * DLLs for OpenSSL 0.9.7i included because protection faults were reported in 0.9.8 and 0.9.8a. * New features - Libwrap code is executed as a separate process (no more delays due to a global and potentially long critical section). * Bugfixes - Problem with zombies in UCONTEXT threading fixed. - Workaround for non-standard makecontext() uc_stack.ss_sp parameter semantics on SGI IRIX. - Protection fault in signals handling on IRIX fixed. - Problem finding pthread library on AIX fixed. - size_t printf() fixed in stack_info() (the previous fix didn't work). - socklen_t is used instead of int where required. Homepage: http://stunnel.mirt.net/ sha1sum for stunnel-4.13.tar.gz: 4cb8e162e6cd4b4a966d601d1c890df2c2ee198f Best regards, Mike

1 0

smtp and tls
by Andy Cravens 21 Oct '05

21 Oct '05

Does stunnel support using TLS with SMTP? My SMTP server requires TLS but my client does not support it. Unfortunately, my SMTP server does not support SMTP over SSL so my only choice is to use TLS. I've seen some old threads concerning a patch to stunnel 3.x to do TLS but I read it was not a good solution. Does anybody have any information or opinions on this?

3 3

SSL alert (write): fatal: bad record mac
by Huy Vu 21 Oct '05

21 Oct '05

Hi all, I was tried stunnel 4.0.9 compiled with Openssl 0.9.7g on Redhat ES 3.0 and got the telnets sessions disconnected with error messages in stunnel.log as below: SSL alert (write): fatal: bad record mac SSL_read: 1408F455: error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac The same problem with stunnel 4.0.12 compiled with Openssl 0.9.8a Tried to disable the option socket = a:SO_REUSEADDR=0 in stunne server configuration file but still not help. Thanks in advance for any help: Full stunnel.log: -------------------- 2005.10.21 04:07:33 LOG5[19485:1]: stunnel 4.12 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 2005.10.21 04:07:33 LOG7[19485:1]: Snagged 64 random bytes from /dev/urandom 2005.10.21 04:07:33 LOG7[19485:1]: RAND_status claims sufficient entropy for the PRNG 2005.10.21 04:07:33 LOG6[19485:1]: PRNG seeded successfully 2005.10.21 04:07:33 LOG7[19485:1]: Certificate: /usr/local/stunnel/etc/stunnel/stunnel.pem 2005.10.21 04:07:33 LOG7[19485:1]: Key file: /usr/local/stunnel/etc/stunnel/stunnel.pem 2005.10.21 04:07:33 LOG6[19485:1]: file ulimit = 1024 (can be changed with 'ulimit -n') 2005.10.21 04:07:33 LOG6[19485:1]: poll() used - no FD_SETSIZE limit for file descriptors 2005.10.21 04:07:33 LOG5[19485:1]: 500 clients allowed 2005.10.21 04:07:33 LOG7[19485:1]: FD 4 in non-blocking mode 2005.10.21 04:07:33 LOG7[19485:1]: FD 5 in non-blocking mode 2005.10.21 04:07:33 LOG7[19485:1]: FD 6 in non-blocking mode 2005.10.21 04:07:33 LOG7[19485:1]: SO_REUSEADDR option set on accept socket 2005.10.21 04:07:33 LOG7[19485:1]: telnets bound to 192.168.34.35:992 2005.10.21 04:07:33 LOG7[19486:1]: Created pid file /stunnel.pid 2005.10.21 04:07:33 LOG5[19487:1]: stunnel 4.12 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.8a 11 Oct 2005 2005.10.21 04:07:33 LOG7[19487:1]: Snagged 64 random bytes from /dev/urandom 2005.10.21 04:07:33 LOG7[19487:1]: RAND_status claims sufficient entropy for the PRNG 2005.10.21 04:07:33 LOG6[19487:1]: PRNG seeded successfully 2005.10.21 04:07:33 LOG6[19487:1]: file ulimit = 1024 (can be changed with 'ulimit -n') 2005.10.21 04:07:33 LOG6[19487:1]: poll() used - no FD_SETSIZE limit for file descriptors 2005.10.21 04:07:33 LOG5[19487:1]: 500 clients allowed 2005.10.21 04:07:33 LOG7[19487:1]: FD 4 in non-blocking mode 2005.10.21 04:07:33 LOG7[19487:1]: FD 5 in non-blocking mode 2005.10.21 04:07:33 LOG7[19487:1]: FD 6 in non-blocking mode 2005.10.21 04:07:33 LOG7[19487:1]: SO_REUSEADDR option set on accept socket 2005.10.21 04:07:33 LOG7[19487:1]: soap bound to 127.0.0.1:44300 2005.10.21 04:07:33 LOG7[19488:1]: Created pid file /stunnel.pid 2005.10.21 04:09:30 LOG7[19486:1]: telnets accepted FD=7 from 65.94.188.47:60677 2005.10.21 04:09:30 LOG7[19486:1]: Creating a new context 2005.10.21 04:09:30 LOG7[19486:1]: Context 2 created 2005.10.21 04:09:30 LOG7[19486:2]: Context swap: 1 -> 2 2005.10.21 04:09:30 LOG7[19486:2]: telnets started 2005.10.21 04:09:30 LOG7[19486:2]: FD 7 in non-blocking mode 2005.10.21 04:09:30 LOG7[19486:2]: TCP_NODELAY option set on local socket 2005.10.21 04:09:30 LOG5[19486:2]: telnets connected from 65.94.188.47:60677 2005.10.21 04:09:30 LOG7[19486:2]: SSL state (accept): before/accept initialization 2005.10.21 04:09:30 LOG7[19486:2]: SSL state (accept): SSLv3 read client hello A 2005.10.21 04:09:30 LOG7[19486:2]: SSL state (accept): SSLv3 write server hello A 2005.10.21 04:09:30 LOG7[19486:2]: SSL state (accept): SSLv3 write certificate A 2005.10.21 04:09:30 LOG7[19486:2]: SSL state (accept): SSLv3 write server done A 2005.10.21 04:09:30 LOG7[19486:2]: SSL state (accept): SSLv3 flush data 2005.10.21 04:09:30 LOG7[19486:2]: SSL state (accept): SSLv3 read client key exchange A 2005.10.21 04:09:30 LOG7[19486:2]: SSL state (accept): SSLv3 read finished A 2005.10.21 04:09:30 LOG7[19486:2]: SSL state (accept): SSLv3 write change cipher spec A 2005.10.21 04:09:30 LOG7[19486:2]: SSL state (accept): SSLv3 write finished A 2005.10.21 04:09:30 LOG7[19486:2]: SSL state (accept): SSLv3 flush data 2005.10.21 04:09:30 LOG7[19486:2]: 1 items in the session cache 2005.10.21 04:09:30 LOG7[19486:2]: 0 client connects (SSL_connect()) 2005.10.21 04:09:30 LOG7[19486:2]: 0 client connects that finished 2005.10.21 04:09:30 LOG7[19486:2]: 0 client renegotiatations requested 2005.10.21 04:09:30 LOG7[19486:2]: 1 server connects (SSL_accept()) 2005.10.21 04:09:30 LOG7[19486:2]: 1 server connects that finished 2005.10.21 04:09:30 LOG7[19486:2]: 0 server renegotiatiations requested 2005.10.21 04:09:30 LOG7[19486:2]: 0 session cache hits 2005.10.21 04:09:30 LOG7[19486:2]: 0 session cache misses 2005.10.21 04:09:30 LOG7[19486:2]: 0 session cache timeouts 2005.10.21 04:09:30 LOG6[19486:2]: SSL accepted: new session negotiated 2005.10.21 04:09:30 LOG6[19486:2]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2005.10.21 04:09:30 LOG7[19486:2]: FD 8 in non-blocking mode 2005.10.21 04:09:30 LOG7[19486:2]: telnets connecting 127.0.0.1:23 2005.10.21 04:09:30 LOG7[19486:2]: connect_wait: waiting 10 seconds 2005.10.21 04:09:30 LOG7[19486:2]: connect_wait: connected 2005.10.21 04:09:30 LOG7[19486:2]: Remote FD=8 initialized 2005.10.21 04:09:30 LOG7[19486:2]: TCP_NODELAY option set on remote socket 2005.10.21 04:09:31 LOG7[19488:1]: soap accepted FD=7 from 127.0.0.1:37120 2005.10.21 04:09:31 LOG7[19488:1]: Creating a new context 2005.10.21 04:09:31 LOG7[19488:1]: Context 2 created 2005.10.21 04:09:31 LOG7[19488:2]: Context swap: 1 -> 2 2005.10.21 04:09:31 LOG7[19488:2]: soap started 2005.10.21 04:09:31 LOG7[19488:2]: FD 7 in non-blocking mode 2005.10.21 04:09:31 LOG7[19488:2]: TCP_NODELAY option set on local socket 2005.10.21 04:09:31 LOG5[19488:2]: soap connected from 127.0.0.1:37120 2005.10.21 04:09:31 LOG7[19488:2]: FD 8 in non-blocking mode 2005.10.21 04:09:31 LOG7[19488:2]: soap connecting 199.84.230.35:443 2005.10.21 04:09:31 LOG7[19488:2]: connect_wait: waiting 10 seconds 2005.10.21 04:09:31 LOG7[19488:2]: connect_wait: connected 2005.10.21 04:09:31 LOG7[19488:2]: Remote FD=8 initialized 2005.10.21 04:09:31 LOG7[19488:2]: TCP_NODELAY option set on remote socket 2005.10.21 04:09:31 LOG7[19488:2]: SSL state (connect): before/connect initialization 2005.10.21 04:09:31 LOG7[19488:2]: SSL state (connect): SSLv3 write client hello A 2005.10.21 04:09:31 LOG7[19488:2]: SSL state (connect): SSLv3 read server hello A 2005.10.21 04:09:31 LOG7[19488:2]: SSL state (connect): SSLv3 read server certificate A 2005.10.21 04:09:31 LOG7[19488:2]: SSL state (connect): SSLv3 read server key exchange A 2005.10.21 04:09:31 LOG7[19488:2]: SSL state (connect): SSLv3 read server done A 2005.10.21 04:09:31 LOG7[19488:2]: SSL state (connect): SSLv3 write client key exchange A 2005.10.21 04:09:31 LOG7[19488:2]: SSL state (connect): SSLv3 write change cipher spec A 2005.10.21 04:09:31 LOG7[19488:2]: SSL state (connect): SSLv3 write finished A 2005.10.21 04:09:31 LOG7[19488:2]: SSL state (connect): SSLv3 flush data 2005.10.21 04:09:31 LOG7[19488:2]: SSL state (connect): SSLv3 read finished A 2005.10.21 04:09:31 LOG7[19488:2]: 1 items in the session cache 2005.10.21 04:09:31 LOG7[19488:2]: 1 client connects (SSL_connect()) 2005.10.21 04:09:31 LOG7[19488:2]: 1 client connects that finished 2005.10.21 04:09:31 LOG7[19488:2]: 0 client renegotiatations requested 2005.10.21 04:09:31 LOG7[19488:2]: 0 server connects (SSL_accept()) 2005.10.21 04:09:31 LOG7[19488:2]: 0 server connects that finished 2005.10.21 04:09:31 LOG7[19488:2]: 0 server renegotiatiations requested 2005.10.21 04:09:31 LOG7[19488:2]: 0 session cache hits 2005.10.21 04:09:31 LOG7[19488:2]: 0 session cache misses 2005.10.21 04:09:31 LOG7[19488:2]: 0 session cache timeouts 2005.10.21 04:09:31 LOG6[19488:2]: SSL connected: new session negotiated 2005.10.21 04:09:31 LOG6[19488:2]: Negotiated ciphers: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 2005.10.21 04:09:31 LOG7[19488:2]: SSL_read returned WANT_READ: retrying 2005.10.21 04:09:31 LOG7[19488:2]: SSL_read returned WANT_READ: retrying 2005.10.21 04:09:31 LOG7[19488:2]: SSL alert (read): warning: close notify 2005.10.21 04:09:31 LOG7[19488:2]: SSL closed on SSL_read 2005.10.21 04:09:31 LOG7[19488:2]: Socket write shutdown 2005.10.21 04:09:31 LOG7[19488:2]: SSL write shutdown 2005.10.21 04:09:31 LOG7[19488:2]: SSL alert (write): warning: close notify 2005.10.21 04:09:31 LOG6[19488:2]: SSL_shutdown successfully sent close_notify 2005.10.21 04:09:31 LOG7[19488:2]: Socket closed on read 2005.10.21 04:09:31 LOG5[19488:2]: Connection closed: 818 bytes sent to SSL, 4558 bytes sent to socket 2005.10.21 04:09:31 LOG7[19488:2]: soap finished (0 left) 2005.10.21 04:09:31 LOG5[19488:2]: stack_info: size=65536, current=9560 (14%), maximum=9560 (14%) 2005.10.21 04:09:31 LOG7[19488:2]: Context 2 closed 2005.10.21 04:09:45 LOG7[19486:2]: SSL alert (write): fatal: bad record mac 2005.10.21 04:09:45 LOG3[19486:2]: SSL_read: 1408F455: error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2005.10.21 04:09:45 LOG5[19486:2]: Connection reset: 4313 bytes sent to SSL, 232 bytes sent to socket 2005.10.21 04:09:45 LOG7[19486:2]: telnets finished (0 left) 2005.10.21 04:09:45 LOG5[19486:2]: stack_info: size=65536, current=9560 (14%), maximum=9560 (14%) 2005.10.21 04:09:45 LOG7[19486:2]: Context 2 closed _________________________________________________________________ Take advantage of powerful junk e-mail filters built on patented Microsoft® SmartScreen Technology. http://join.msn.com/?pgmarket=en-ca&page=byoa/prem&xAPID=1994&DI=1034&SU=ht… Start enjoying all the benefits of MSN® Premium right now and get the first two months FREE*.

1 0

ECC-enabled version of Stunnel
by Dennis Laupichler 19 Oct '05

19 Oct '05

Hello, I want to use a ECC-certificate for stunnel.pem, but it doesn't work. Can anybody help me, what I have to do, to use Elliptique Curve cryptography certificates in Stunnel? Is it still possible or not? The ECC-Ciphers "ECDH-ECDSA-AES256-SHA" from openssl 0.9.8 works, but when I loaded the certificate into stunnel, there was follow messages in the log-file: stunnel.log in Server ################## error stack: 140B3009 : error:140B3009:SSL routines:SSL_CTX_use_RSAPrivateKey_file:PEM lib SSL_CTX_use_RSAPrivateKey_file: 607907F: error:0607907F:digital envelope routines:EVP_PKEY_get1_RSA:expecting an rsa key Server is down ################## Thanks, Dennis

2 1

Lost Connection to MySQL
by Dave.Wismer＠faa.gov 18 Oct '05

18 Oct '05

1 0

stunnel silently dies
by Uffe Vedenbrant 18 Oct '05

18 Oct '05

Hi! After using stunnel on several freebsd boxes i decided to try it out on my mailserver.. Unfortunately it silently died after first connection.. ( and with exitcode=0 ) debug = 7 Nothing more in the log than startup + a line about a incomming connection on port 9143.. ( where i put my incomming imap ) Nothing in any log on the box.. Ok.. It might be my openssl freebsd version or stunnel version so i started to upgrade everything.. Freebsd 4.4 -> 4.11 stunnel 4.05 -> 4.11 etc.. Well did it work.. Nop..;-) Finally i found out after tryin ktrace that the problem was that the tcpwrapper code killed me.. That's ok but there where no logging at all that the tcpwrapper silently decided that i was comming from a blocked host.. It's up now without tcpwrapper enabled and works perfect..;-) Is there any possibility to have stunnel to say something about tcpwrapper problems..;-) And not just die..;-) Regards /Uffe

4 9

client and server together?
by Sholund, Mark D, GVSOL 18 Oct '05

18 Oct '05

I have a situation in which I have a client system, a middle-tier application server, and a backend database. The middle-tier takes info from the client and sends requests to the database, in other words the middle-tier has to act as both a client and a server in different parts of a transaction. Is it necessary that I run two instances of stunnel, one with an stunnel-client.conf wherein client=yes and another instance with stunnel-server.conf wherein client=no or is it possible to configure a single stunnel to do this? I would guess it would be kind of like having "client=yes|no" at the service level; this is not an option as far as I can see from the man page for 4.12 but I figured I could at least ask.

3 2

Windows XP, 2000 Crash on VNC over stunnel
by prez2＠o2.pl 15 Oct '05

15 Oct '05

Hello I've got problem with vnc over stunnel, stunnel on client computer crashes all the time. I did all configuration according to information at http://www.securityfocus.com/infocus/1677. Stunnel v 4.12, VNC version 4.1.1, all firewalls off, all computers in the same LAN. Tried on Windows XP SP2 and Windows 2000, on both of them there was a crash. All necessery (at least I think so) information are here: http://users.vlo.ids.gda.pl/~piotr/client.txt http://users.vlo.ids.gda.pl/~piotr/server.txt http://users.vlo.ids.gda.pl/~piotr/windows.txt Thank you in advance

3 2

Re: [stunnel-users] Windows XP, 2000 Crash on VNC over stunnel
by prez2＠o2.pl 14 Oct '05

14 Oct '05

> > I've got problem with vnc over stunnel, stunnel on client computer > > crashes all the time. > Did you try to upgrade DLLs to the latest version: > ftp://stunnel.mirt.net/stunnel/openssl/binary-0.9.8a-zdll/ I did upgrade librabries on both server and client, unfortunately it didn't help - theres is still a crash. Should I generate certifcates again? Meantime, I did configure it on my Ubuntu 10 X box, and manage to connect with server, so I guess server configuration is ok. Thanks for help. Best regards.

2 1

ECC-enabled version of Stunnel
by Dennis Laupichler 13 Oct '05

13 Oct '05

Dear Sirs, I want to use a ECC-certificate for stunnel.pem, but it doesn't work. Can you tell me, what I have to do, to use Elliptique Curve cryptography certificates in Stunnel? Is it still possible or not? The ECC-Ciphers "ECDH-ECDSA-AES256-SHA" from openssl 0.9.8 works, but when I loaded the certificate into stunnel, there was follow messages in the log-file: stunnel.log in Server ################## error stack: 140B3009 : error:140B3009:SSL routines:SSL_CTX_use_RSAPrivateKey_file:PEM lib SSL_CTX_use_RSAPrivateKey_file: 607907F: error:0607907F:digital envelope routines:EVP_PKEY_get1_RSA:expecting an rsa key Server is down ################## Best regards, Dennis

1 0

IMAP TLS support in stunnel 4?
by George Hartzell 12 Oct '05

12 Oct '05

Hi All, I'd like to put stunnel in front of dbmail-imap and dbmail-pop, since they don't offer any encryption. I understand I can just do straight ssl connections, but would like [prefer] to support TLS. I've found patches to the stunnel 3 series that implement TLS for IMAP, but haven't found any for version 4. Has someone implemented it for 4? Is there a technical or political reason/problem, or just not enough round-tuits? Thanks, g.

3 3

404 File Not Found when accessing webservice using STunnel (works fine without STunnel)
by Sundell Staffan 10 Oct '05

10 Oct '05

"stunnel 4.08 on x86-pc-mingw32-gnu WIN32+IPv6 with OpenSSL 0.9.7e 25 Oct 2004" Hi, this is my first try with both SSL & STunnel, so please excuse me for any missunderstandings a.s.o. I have problems running a STunnel in client-mode agains a SSL webservice. Our application does not support clientside-certificates, so i want to use STunnel to handle the SSL connection. For now, our webservice-provider has disabled the need for client-certificates (to help us narrow our problem down) But it still dont work. As a first step, i access whe webservice default-page through IE-Explorer. https://<ip>:3001/<path> and i am presented with the default-webpage. As i second step, i start stunnel with following .conf verify = 2 CApath = <path where i have saved all certificates as .pem:s with <hash>.0 filenames, from the direct-access example with explorer above> debug = 7 client = yes [https] accept = 127.0.0.1:3000 connect = <ip>:3001 TIMEOUTclose = 0 and try to access http://127.0.0.1:3000/<path> but i get: HTTP 404 File Not found. I have tried the same approach against a microsoft webservice at: https://test.uddi.microsoft.com/extension.asmx Without any problems. 1. I see no errors in the log, as i understand it (se below) can any one else with a more skilled eye see any problem ? 2. Our webservice-provider has an invalid hostname in its certificate (no public hostname, just IP during testing, but server certificate state www.fora.se) might that cause a problem ? (i have tried localy with invalid hostname in certificate without any problem though) 3. Is it possible to enable/disable verification of hostname in STunnel ? (as i understand it, the "verify" option in the STunnel.conf concerns the whole certificate-validation-process, and not just the hostname validation ?) 4. Could the problem be a config-issue on the webservice-provider end ? Im not sure, as it works with IE-Explorer, but not through STunnel ? 5. Any clue on where to look would be greatly apriciated, i have been working with this for a week, and i have been able to use STunnel both as server & client, with & without client-certs against everything i have tested localy and public (tried between diffrent home-made applications, on a local webserver, against verisign website a.s.o.) and everything works fine, except where i need it to work (against our webservice-provider). Regards /Staffan Sundell STunnel log against our webservice-provider (when it doesnt work): 2005.10.10 16:50:23 LOG5[2760:2800]: stunnel 4.08 on x86-pc-mingw32-gnu WIN32+IPv6 with OpenSSL 0.9.7e 25 Oct 2004 2005.10.10 16:50:23 LOG7[2760:2332]: RAND_status claims sufficient entropy for the PRNG 2005.10.10 16:50:23 LOG6[2760:2332]: PRNG seeded successfully 2005.10.10 16:50:23 LOG7[2760:2332]: Verify directory set to w:\ws\certs 2005.10.10 16:50:23 LOG5[2760:2332]: No limit detected for the number of clients 2005.10.10 16:50:23 LOG7[2760:2332]: FD 1916 in non-blocking mode 2005.10.10 16:50:23 LOG7[2760:2332]: SO_REUSEADDR option set on accept socket 2005.10.10 16:50:23 LOG7[2760:2332]: https bound to 127.0.0.1:3000 2005.10.10 16:50:28 LOG7[2760:2332]: https accepted FD=1904 from 127.0.0.1:2975 2005.10.10 16:50:28 LOG7[2760:2332]: FD 1904 in non-blocking mode 2005.10.10 16:50:28 LOG7[2760:2332]: Creating a new thread 2005.10.10 16:50:28 LOG7[2760:2332]: New thread created 2005.10.10 16:50:28 LOG7[2760:3748]: https started 2005.10.10 16:50:28 LOG5[2760:3748]: https connected from 127.0.0.1:2975 2005.10.10 16:50:28 LOG7[2760:3748]: FD 1876 in non-blocking mode 2005.10.10 16:50:28 LOG7[2760:3748]: https connecting <webserviceprovider ip>:3001 2005.10.10 16:50:28 LOG7[2760:3748]: connect_wait: waiting 10 seconds 2005.10.10 16:50:28 LOG7[2760:3748]: connect_wait: connected 2005.10.10 16:50:28 LOG7[2760:3748]: Remote FD=1876 initialized 2005.10.10 16:50:28 LOG7[2760:3748]: SSL state (connect): before/connect initialization 2005.10.10 16:50:28 LOG7[2760:3748]: SSL state (connect): SSLv3 write client hello A 2005.10.10 16:50:28 LOG7[2760:3748]: SSL state (connect): SSLv3 read server hello A 2005.10.10 16:50:28 LOG5[2760:3748]: VERIFY OK: depth=2, /C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification Authority 2005.10.10 16:50:28 LOG5[2760:3748]: VERIFY OK: depth=1, /O=VeriSign Trust Network/OU=VeriSign, Inc./OU=VeriSign International Server CA - Class 3/OU=www.verisign.com/CPS Incorp.by Ref. LIABILITY LTD.(c)97 VeriSign 2005.10.10 16:50:28 LOG5[2760:3748]: VERIFY OK: depth=0, /C=SE/L=STOCKHOLM/O=Fora AB/OU=Member, VeriSign Trust Network/OU=Terms of use at www.verisign.se/rpa <http://www.verisign.se/rpa> (c)05/OU=Authenticated by VeriSign/OU=Member, VeriSign Trust Network/CN=www.fora.se 2005.10.10 16:50:28 LOG7[2760:3748]: SSL state (connect): SSLv3 read server certificate A 2005.10.10 16:50:28 LOG7[2760:3748]: SSL state (connect): SSLv3 read server done A 2005.10.10 16:50:28 LOG7[2760:3748]: SSL state (connect): SSLv3 write client key exchange A 2005.10.10 16:50:28 LOG7[2760:3748]: SSL state (connect): SSLv3 write change cipher spec A 2005.10.10 16:50:28 LOG7[2760:3748]: SSL state (connect): SSLv3 write finished A 2005.10.10 16:50:28 LOG7[2760:3748]: SSL state (connect): SSLv3 flush data 2005.10.10 16:50:28 LOG7[2760:3748]: SSL state (connect): SSLv3 read finished A 2005.10.10 16:50:28 LOG7[2760:3748]: 1 items in the session cache 2005.10.10 16:50:28 LOG7[2760:3748]: 1 client connects (SSL_connect()) 2005.10.10 16:50:28 LOG7[2760:3748]: 1 client connects that finished 2005.10.10 16:50:28 LOG7[2760:3748]: 0 client renegotiatations requested 2005.10.10 16:50:28 LOG7[2760:3748]: 0 server connects (SSL_accept()) 2005.10.10 16:50:28 LOG7[2760:3748]: 0 server connects that finished 2005.10.10 16:50:28 LOG7[2760:3748]: 0 server renegotiatiations requested 2005.10.10 16:50:28 LOG7[2760:3748]: 0 session cache hits 2005.10.10 16:50:28 LOG7[2760:3748]: 0 session cache misses 2005.10.10 16:50:28 LOG7[2760:3748]: 0 session cache timeouts 2005.10.10 16:50:28 LOG6[2760:3748]: SSL connected: new session negotiated 2005.10.10 16:50:28 LOG6[2760:3748]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.10.10 16:50:45 LOG7[2760:3748]: SSL socket closed on SSL_read 2005.10.10 16:50:45 LOG7[2760:3748]: Socket write shutdown 2005.10.10 16:50:45 LOG5[2760:3748]: Connection closed: 407 bytes sent to SSL, 507 bytes sent to socket 2005.10.10 16:50:45 LOG7[2760:3748]: https finished (0 left) STunnel log against microsoft (where it works) 2005.10.10 16:50:22 LOG5[2940:2556]: stunnel 4.08 on x86-pc-mingw32-gnu WIN32+IPv6 with OpenSSL 0.9.7e 25 Oct 2004 2005.10.10 16:50:22 LOG7[2940:1112]: RAND_status claims sufficient entropy for the PRNG 2005.10.10 16:50:22 LOG6[2940:1112]: PRNG seeded successfully 2005.10.10 16:50:22 LOG7[2940:1112]: Verify directory set to c:\ws\certs 2005.10.10 16:50:22 LOG5[2940:1112]: No limit detected for the number of clients 2005.10.10 16:50:22 LOG7[2940:1112]: FD 136 in non-blocking mode 2005.10.10 16:50:22 LOG7[2940:1112]: SO_REUSEADDR option set on accept socket 2005.10.10 16:50:22 LOG7[2940:1112]: https bound to 127.0.0.1:80 2005.10.10 16:50:32 LOG7[2940:1112]: https accepted FD=148 from 127.0.0.1:2977 2005.10.10 16:50:32 LOG7[2940:1112]: FD 148 in non-blocking mode 2005.10.10 16:50:32 LOG7[2940:1112]: Creating a new thread 2005.10.10 16:50:32 LOG7[2940:1112]: New thread created 2005.10.10 16:50:32 LOG7[2940:3904]: https started 2005.10.10 16:50:32 LOG5[2940:3904]: https connected from 127.0.0.1:2977 2005.10.10 16:50:32 LOG7[2940:3904]: FD 176 in non-blocking mode 2005.10.10 16:50:32 LOG7[2940:3904]: https connecting 207.46.197.39:443 2005.10.10 16:50:32 LOG7[2940:3904]: connect_wait: waiting 10 seconds 2005.10.10 16:50:33 LOG7[2940:3904]: connect_wait: connected 2005.10.10 16:50:33 LOG7[2940:3904]: Remote FD=176 initialized 2005.10.10 16:50:33 LOG7[2940:3904]: SSL state (connect): before/connect initialization 2005.10.10 16:50:33 LOG7[2940:3904]: SSL state (connect): SSLv3 write client hello A 2005.10.10 16:50:33 LOG7[2940:3904]: SSL state (connect): SSLv3 read server hello A 2005.10.10 16:50:33 LOG5[2940:3904]: VERIFY OK: depth=3, /C=US/O=GTE Corporation/OU=GTE CyberTrust Solutions, Inc./CN=GTE CyberTrust Global Root 2005.10.10 16:50:33 LOG5[2940:3904]: VERIFY OK: depth=2, /CN=Microsoft Internet Authority 2005.10.10 16:50:33 LOG5[2940:3904]: VERIFY OK: depth=1, /DC=com/DC=microsoft/DC=corp/DC=redmond/CN=Microsoft Secure Server Authority 2005.10.10 16:50:33 LOG5[2940:3904]: VERIFY OK: depth=0, /C=US/ST=Washington/L=Redmond/O=Microsoft/OU=UDDI Test production site/CN=test.uddi.microsoft.com 2005.10.10 16:50:33 LOG7[2940:3904]: SSL state (connect): SSLv3 read server certificate A 2005.10.10 16:50:33 LOG7[2940:3904]: SSL state (connect): SSLv3 read server done A 2005.10.10 16:50:33 LOG7[2940:3904]: SSL state (connect): SSLv3 write client key exchange A 2005.10.10 16:50:33 LOG7[2940:3904]: SSL state (connect): SSLv3 write change cipher spec A 2005.10.10 16:50:33 LOG7[2940:3904]: SSL state (connect): SSLv3 write finished A 2005.10.10 16:50:33 LOG7[2940:3904]: SSL state (connect): SSLv3 flush data 2005.10.10 16:50:33 LOG7[2940:3904]: SSL state (connect): SSLv3 read finished A 2005.10.10 16:50:33 LOG7[2940:3904]: 1 items in the session cache 2005.10.10 16:50:33 LOG7[2940:3904]: 1 client connects (SSL_connect()) 2005.10.10 16:50:33 LOG7[2940:3904]: 1 client connects that finished 2005.10.10 16:50:33 LOG7[2940:3904]: 0 client renegotiatations requested 2005.10.10 16:50:33 LOG7[2940:3904]: 0 server connects (SSL_accept()) 2005.10.10 16:50:33 LOG7[2940:3904]: 0 server connects that finished 2005.10.10 16:50:33 LOG7[2940:3904]: 0 server renegotiatiations requested 2005.10.10 16:50:33 LOG7[2940:3904]: 0 session cache hits 2005.10.10 16:50:33 LOG7[2940:3904]: 0 session cache misses 2005.10.10 16:50:33 LOG7[2940:3904]: 0 session cache timeouts 2005.10.10 16:50:33 LOG6[2940:3904]: SSL connected: new session negotiated 2005.10.10 16:50:33 LOG6[2940:3904]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2005.10.10 16:51:38 LOG3[2940:3904]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2005.10.10 16:51:38 LOG5[2940:3904]: Connection reset: 203 bytes sent to SSL, 3214 bytes sent to socket 2005.10.10 16:51:38 LOG7[2940:3904]: https finished (0 left)

1 0

Usage scenarios of stgunnel
by Jagannadha Bhattu Gosukonda 09 Oct '05

09 Oct '05

Hi, Can you kindly let me know the usage scenarios of stunnel in the sense that will it be used mainly at the client side / server side? which is the most common scenario? Thanks JB

1 0

STUNNEL and Windows 98 Second Edition
by David T. Ashley 08 Oct '05

08 Oct '05

I've installed STUNNEL on a Win 98 SE machine. Connections die after a few or a few hundred bytes. Any ideas? Thanks, Dave. ----------------------------------- David T. Ashley (dta(a)e3ft.com) Thousand Feet Consulting, LLC

2 1

UID/GID/Permissions Issue
by David T. Ashley 08 Oct '05

08 Oct '05

I've installed STUNNEL, works great, etc. etc. etc. Just one thing is a mystery .... The daemon definitely runs with UID "stunnel" (as I set it up), but still somehow it is able to grab its own keys and cert, as well as the client cert, which I set with root-only access. How is that possible? Does it buffer these things during startup (as root) before it sets UID/GID to stunnel, or am I missing something? Thanks. ----------------------------------- David T. Ashley (dta(a)e3ft.com) Thousand Feet Consulting, LLC

1 0

stunnel-4.12 Solaris 9 libwrap compile problem
by John Christian 07 Oct '05

07 Oct '05

Hi gurus... I'm setting up a centralized log server for all of my Solaris 9 hosts. Kim's article at http://www.sun.com/bigadmin/features/articles/syslog_ng.html is providing much of the guidence. I plan to use syslog-ng, but would like to have stunnel in place first. http://www.sunfreeware.com does not have a pre-rolled stunnel for Solaris 9. I'm receiving the error below when trying to compile stunnel-4.12 on Solaris 9. Can you offer any tips on overcoming the stunnelcompile error below? ERROR: [snip] gcc -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/local/ssl/include -o stunnel client.o log.o options.o protocol.o network.o resolver.o ssl.o sthreads.o stunnel.o pty.o -lz -lsocket -lnsl -L/usr/local/ssl/lib -lssl -lcrypto -lwrap Undefined first referenced symbol in file allow_severity /usr/sfw/lib/libwrap.so deny_severity /usr/sfw/lib/libwrap.so ld: fatal: Symbol referencing errors. No output written to stunnel collect2: ld returned 1 exit status make[1]: *** [stunnel] Error 1 make[1]: Leaving directory `/var/spool/src/stunnel-4.12/src' make: *** [all-recursive] Error 1 I'm using GNU's make 3.80 and gcc 3.4.2. My environment variable LD_LIBRARY_PATH is: LD_LIBRARY_PATH=/usr/openwin/lib:/usr/dt/lib:/usr/local/lib:/usr/local/ssl/lib:/usr/sfw/lib Thanks for taking the time to share any direct solutions or hints that will help me find a solution. -John __________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com

1 0

Help With Verify = 3
by David T. Ashley 07 Oct '05

07 Oct '05

Hi, I installed Stunnel 4.12 on a Linux box, and am attempting to use it to secure SMTP e-mail injection from Windows machines. I have everything working, and I have a Windows Stunnel client which will inject mail into a Linux Stunnel server over TCP Port 465. However, I've been unable to find the right combination of verification settings to cause the server to refuse connections from clients without the right certificates. Right now, I'm able to inject mail if the client has ANY certificate. Is there any tutorial on how to generate the keys, .PEM files, and the Stunnel settings to have the behavior where only MY clients can inject mail? Thanks and best regards, Dave Ashley.

2 2

stunnel and logrotate
by Bohdan Linda 06 Oct '05

06 Oct '05

Hello, I have noticed that by sending -HUP signal to stunnel causes daemon to exit. The problem is when stunnel is logging to a file and the file was recreated (i.e. by logrotate). I have blindly configured logrotate to send -HUP to the stunnel after the logs are rotated and awaited 'common-habbit' functionality: re-read configuration and refresh file handles. But I was supprised: xxxx@yyyyy:/var/log# more stunnel.log.1 2005.09.27 14:07:51 LOG5[23244:3084273344]: stunnel 4.07 on xxxxxxxxxxxxxxx 2005.09.27 14:07:51 LOG5[23244:3084273344]: 500 clients allowed 2005.10.02 04:40:03 LOG3[23245:3084273344]: Received signal 1; terminating Apparently messages are going to the 'old' filehandle and stunnel exits. Is there any workaround to this except: 1) hard restarting stunnel 2) putting stunnel in inetd Thank you, Bohdan

2 1

Stunnel 4.12 won't work with Openssl 0.98
by Luca G. 05 Oct '05

05 Oct '05

Hi I upgraded yesterday from stunnel 4.11 to 4.12, and i had a few problems... Basically I have been unable to use latest libeay32.dll and libssl32.dll versions (the one that comes with stunnel's installation file). I use stunnel to tunnel a thightvnc connection from my windows xp sp2 workstation to a couple of windows 2000 server machine on the opposite side of the building. At the moment i'm keeping 0.98 files on the server machines, 0.97f on my client and it works These are my stunnel.conf files -----------------------------------client CAfile = CAcert.pem CApath = certificates cert = client.pem client = yes verify = 3 debug = 7 output = stunnel.log [vnc] accept = 127.0.0.1:5900 connect = 192.168.1.252:443 [vnc2] accept = 127.0.0.1:5899 connect = 192.168.1.254:443 ---------------------------------------- -------------------------------server CAfile = CAcert.pem CApath = certificates cert = server.pem client = no verify = 3 debug = 7 output = stunnel.log [vnc] accept = 443 connect = 127.0.0.1:5900 -------------------------------------- And this is what i found in my log files after every connection attempt -----------------------------------client 2005.10.05 09:50:21 LOG5[3880:3960]: stunnel 4.12 on x86-pc-mingw32-gnu WIN32+SELECT+IPv6 with OpenSSL 0.9.8 05 Jul 2005 2005.10.05 09:50:21 LOG7[3880:3964]: RAND_status claims sufficient entropy for the PRNG 2005.10.05 09:50:21 LOG6[3880:3964]: PRNG seeded successfully 2005.10.05 09:50:21 LOG7[3880:3964]: Certificate: client.pem 2005.10.05 09:50:21 LOG7[3880:3964]: Key file: client.pem 2005.10.05 09:50:21 LOG7[3880:3964]: Loaded verify certificates from CAcert.pem 2005.10.05 09:50:21 LOG7[3880:3964]: Verify directory set to certificates 2005.10.05 09:50:21 LOG5[3880:3964]: Peer certificate location certificates 2005.10.05 09:50:21 LOG5[3880:3964]: No limit detected for the number of clients 2005.10.05 09:50:21 LOG7[3880:3964]: FD 164 in non-blocking mode 2005.10.05 09:50:21 LOG7[3880:3964]: SO_REUSEADDR option set on accept socket 2005.10.05 09:50:21 LOG7[3880:3964]: vnc bound to 127.0.0.1:5900 2005.10.05 09:50:21 LOG7[3880:3964]: FD 168 in non-blocking mode 2005.10.05 09:50:21 LOG7[3880:3964]: SO_REUSEADDR option set on accept socket 2005.10.05 09:50:21 LOG7[3880:3964]: vnc2 bound to 127.0.0.1:5899 2005.10.05 09:50:30 LOG7[3880:3964]: vnc accepted FD=176 from 127.0.0.1:1351 2005.10.05 09:50:30 LOG7[3880:3964]: Creating a new thread 2005.10.05 09:50:30 LOG7[3880:3964]: New thread created 2005.10.05 09:50:30 LOG7[3880:388]: vnc started 2005.10.05 09:50:30 LOG7[3880:388]: FD 176 in non-blocking mode 2005.10.05 09:50:30 LOG5[3880:388]: vnc connected from 127.0.0.1:1351 2005.10.05 09:50:30 LOG7[3880:388]: FD 200 in non-blocking mode 2005.10.05 09:50:30 LOG7[3880:388]: vnc connecting 192.168.1.252:443 2005.10.05 09:50:30 LOG7[3880:388]: connect_wait: waiting 10 seconds 2005.10.05 09:50:30 LOG7[3880:388]: connect_wait: connected 2005.10.05 09:50:30 LOG7[3880:388]: Remote FD=200 initialized 2005.10.05 09:50:30 LOG7[3880:388]: SSL state (connect): before/connect initialization 2005.10.05 09:50:30 LOG7[3880:388]: SSL state (connect): SSLv3 write client hello A 2005.10.05 09:50:30 LOG7[3880:388]: SSL state (connect): SSLv3 read server hello A 2005.10.05 09:50:30 LOG5[3880:388]: VERIFY OK: depth=1, /C=IT/ST=Trentino/L=Trento/O=ATAS onlus/OU=Atas Trento/CN=VNC/emailAddress=tecnico(a)atas.tn.it 2005.10.05 09:50:30 LOG5[3880:388]: VERIFY OK: depth=0, /C=IT/ST=Trentino/L=Trento/O=ATAS onlus/OU=Atas Trento/CN=VNC_server/emailAddress=tecnico(a)atas.tn.it 2005.10.05 09:50:30 LOG7[3880:388]: SSL state (connect): SSLv3 read server certificate A 2005.10.05 09:50:30 LOG7[3880:388]: SSL state (connect): SSLv3 read server certificate request A 2005.10.05 09:50:30 LOG7[3880:388]: SSL state (connect): SSLv3 read server done A 2005.10.05 09:50:30 LOG7[3880:388]: SSL state (connect): SSLv3 write client certificate A 2005.10.05 09:50:30 LOG7[3880:388]: SSL state (connect): SSLv3 write client key exchange A 2005.10.05 09:50:30 LOG7[3880:388]: SSL state (connect): SSLv3 write certificate verify A ----------------------------------- -----------------------------------server 2005.10.04 10:49:50 LOG5[2480:2760]: stunnel 4.12 on x86-pc-mingw32-gnu WIN32+SELECT+IPv4 with OpenSSL 0.9.8 05 Jul 2005 2005.10.04 10:49:51 LOG7[2480:2824]: RAND_status claims sufficient entropy for the PRNG 2005.10.04 10:49:51 LOG6[2480:2824]: PRNG seeded successfully 2005.10.04 10:49:51 LOG7[2480:2824]: Certificate: server.pem 2005.10.04 10:49:51 LOG7[2480:2824]: Key file: server.pem 2005.10.04 10:49:51 LOG7[2480:2824]: Loaded verify certificates from CAcert.pem 2005.10.04 10:49:51 LOG7[2480:2824]: Verify directory set to certificates 2005.10.04 10:49:51 LOG5[2480:2824]: Peer certificate location certificates 2005.10.04 10:49:51 LOG5[2480:2824]: No limit detected for the number of clients 2005.10.04 10:49:51 LOG7[2480:2824]: FD 864 in non-blocking mode 2005.10.04 10:49:51 LOG7[2480:2824]: SO_REUSEADDR option set on accept socket 2005.10.04 10:49:51 LOG7[2480:2824]: vnc bound to 0.0.0.0:443 2005.10.04 10:51:00 LOG7[2480:2824]: vnc accepted FD=852 from 192.168.1.250:13545 2005.10.04 10:51:00 LOG7[2480:2824]: Creating a new thread 2005.10.04 10:51:00 LOG7[2480:2824]: New thread created 2005.10.04 10:51:00 LOG7[2480:2740]: vnc started 2005.10.04 10:51:00 LOG7[2480:2740]: FD 852 in non-blocking mode 2005.10.04 10:51:00 LOG5[2480:2740]: vnc connected from 192.168.1.250:13545 2005.10.04 10:51:00 LOG7[2480:2740]: SSL state (accept): before/accept initialization 2005.10.04 10:51:00 LOG7[2480:2740]: SSL state (accept): SSLv3 read client hello A 2005.10.04 10:51:00 LOG7[2480:2740]: SSL state (accept): SSLv3 write server hello A 2005.10.04 10:51:00 LOG7[2480:2740]: SSL state (accept): SSLv3 write certificate A 2005.10.04 10:51:00 LOG7[2480:2740]: SSL state (accept): SSLv3 write certificate request A 2005.10.04 10:51:00 LOG7[2480:2740]: SSL state (accept): SSLv3 flush data 2005.10.04 10:51:00 LOG3[2480:2740]: SSL_accept: Peer suddenly disconnected 2005.10.04 10:51:00 LOG7[2480:2740]: vnc finished (0 left) ----------------------------------- Am i doing soething wrong? Thanks in advance Luca

1 0

4.12 Broken?
by G J Piper 04 Oct '05

04 Oct '05

The new Stunnel Version 4.12 doesn't work well with POPs mail retrieval on my system. Reverting back to 4.11 fixes it perfectly. With 4.12, various emails wouldn't come through, got random timeouts, LONG email retrieval times mainly. Sometimes an email would be impossible to retrieve from the spool file. Running Stunnel with default parameters. Standalone I believe POPs runs off xinetd. % uname -a FreeBSD pipercomputerservices.net 4.4-RELEASE FreeBSD 4.4-RELEASE #0: Wed Aug 28 19:41:18 GMT 2002 root@osbuilder:/usr/src/sys/compile/SERVER i386 % gcc -v Using builtin specs. gcc version 2.95.3 20010315 (release) [FreeBSD] % openssl version OpenSSL 0.9.6e 30 Jul 2002 % stunnel -version stunnel 4.11 on i386-unknown-freebsd4.4 PTHREAD+POLL+IPv4+LIBWRAP with OpenSSL 0.9.6e 30 Jul 2002 Global options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /usr/local/etc/stunnel/stunnel.pem pid = /usr/local/var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds

2 2

Help: Remote desktop connection crashes Stunnel
by Jonathan Bell 04 Oct '05

04 Oct '05

In an attempt to get remote desktop set up over SSL tunneling with compression, I have installed stunnel on my Windows XP Professional SP2 machine and created a "portable" stunnel/config/dll zip that just contains the essentials to create a pre-configured tunnel. Here are the two config files: Server -------------------------------- ; Sample stunnel configuration file by Michal Trojnara 2002-2005 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = stunnel.pem key = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 compression = zlib ; Some debugging stuff useful for troubleshooting debug = 6 output = G:\Stunnel Logs\stunnel.log taskbar = no ; Use it for client mode client = no ; Service-level configuration [remote-desktop] accept = 9833 connect = 127.0.0.1:3389 --------------------------------- Client --------------------------------- ; Sample stunnel configuration file by Michal Trojnara 2002-2005 ; Some options used here may not be adequate for your particular configuration ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 compression = zlib ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log taskbar = yes ; Use it for client mode client = yes ; Service-level configuration [remote-desktop] accept = 127.0.0.1:6389 connect = my.host.name:9833 ---------------------------------- The procedure I used was as follows - start Stunnel on the host, run upstairs with the zipped "portable" stunnel on a USB drive, run stunnel on the other PC, also running XP Pro SP2. Start->run->mstsc, enter 127.0.0.1:6389 and all that happens is that stunnel instantly crashes then Remote Desktop times out. What am I doing wrong?

2 1

Dual Instance of Stunnel Service on W2K
by Mundy Jennifer 04 Oct '05

04 Oct '05

Am new to stunnel and in need of some help. I have W2K box that has Stunnel installed as a service. Upon startup, it starts the service and uses the default stunnel.conf file. I would like to install a second Stunnel service and call a custom .conf service. Is this possible? I've read thru the documentation but haven't come across anything about a second service. We're running v4.05. I know I can get a second instance running via cmd line/batch file, but need the second instance to startup automatically so it can be monitored as well as other things. Thank you in advance. Jennifer The information contained in this e-mail may be confidential and is intended solely for the use of the named addressee. Access, copying or re-use of the e-mail or any information contained therein by any other person is not authorized. If you are not the intended recipient please notify us immediately by returning the e-mail to the originator.(17b)

1 0

SSL_GET_NEW_SESSION:ssl session id callback failed
by DoJo 04 Oct '05

04 Oct '05

Hi There, We have run into "SSL_GET_NEW_SESSION:ssl session id callback failed" error. Can anyone describe what it means? I didn't find any information about it. We'd like to use stunnel to secure Oracle SQL*Net communication. HP-UX server communicates with Win32 clients. We use stunnel standalone not from inetd. Any help would be appreciated. Thanks DoJo Here is a cut from the log file (level 7): 2005.09.29 11:49:53 LOG5[10388:1]: stunnel 4.09 on hppa2.0w-hp-hpux11.11 PTHREAD+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 2005.09.29 11:49:53 LOG7[10388:1]: Snagged 0 random bytes from EGD Socket /var/run/egd-pool 2005.09.29 11:49:53 LOG6[10388:1]: PRNG seeded successfully 2005.09.29 11:49:53 LOG7[10388:1]: Certificate: /opt/iexpress/stunnel/etc/stunnel/..._cert.cer 2005.09.29 11:49:53 LOG7[10388:1]: Key file: /opt/iexpress/stunnel/etc/stunnel/..._privkey.pem 2005.09.29 11:49:53 LOG6[10388:1]: file ulimit = 60 (can be changed with 'ulimit -n') 2005.09.29 11:49:53 LOG6[10388:1]: poll() used - no FD_SETSIZE limit for file descriptors 2005.09.29 11:49:53 LOG5[10388:1]: 27 clients allowed 2005.09.29 11:49:53 LOG7[10388:1]: FD 4 in non-blocking mode 2005.09.29 11:49:53 LOG7[10388:1]: FD 5 in non-blocking mode 2005.09.29 11:49:53 LOG7[10388:1]: FD 6 in non-blocking mode 2005.09.29 11:49:53 LOG7[10388:1]: SO_REUSEADDR option set on accept socket 2005.09.29 11:49:53 LOG7[10388:1]: myapp bound to 0.0.0.0:2000 2005.09.29 11:49:53 LOG7[10389:1]: Created pid file /stunnel.pid 2005.09.30 12:01:47 LOG7[10389:1]: myapp accepted FD=1 from 10.3.125.165:3570 2005.09.30 12:01:47 LOG7[10389:1]: FD 1 in non-blocking mode 2005.09.30 12:01:47 LOG7[10389:2]: myapp started 2005.09.30 12:01:47 LOG5[10389:2]: myapp connected from 10.3.125.165:3570 2005.09.30 12:01:47 LOG7[10389:2]: SSL state (accept): before/accept initialization 2005.09.30 12:01:47 LOG3[10389:2]: SSL_accept: 140B544E: error:140B544E:SSL routines:SSL_GET_NEW_SESSION:ssl session id callback failed 2005.09.30 12:01:47 LOG7[10389:2]: myapp finished (0 left) Our config file: cert = /opt/iexpress/stunnel/etc/stunnel/..._cert.cer # contains the server's signed (by a CA) cert. key = /opt/iexpress/stunnel/etc/stunnel/..._privkey.pem # contains the server's private key service = myapp-ssl chroot = /var/run/stunnel pid = /stunnel.pid setuid = oracle setgid = oracle debug = 7 output = stunnel.log client = no [myapp] accept=2000 connect=1521

1 1

stunnel4 user + permissions
by nick.hoffman＠altcall.com 04 Oct '05

04 Oct '05

Hey guys, I've been using stunnel for a while and it's great. I've noticed something that doesn't make much sense to me though, so I was wondering if you might be able to shed some light. Stunnel runs as user:group stunnel4:stunnel4. The server reads client certs (for verify = 3) from /etc/stunnel/certs/ which is chown'd root:ssl-certs and chmod'd 750. The client PEMs in that directory have the same ownership and permissions. User stunnel4 is in the ssl-certs group. When a client connects, the server is unable to read from /etc/stunnel/certs/. If I change the ownership of the directory to root:stunnel4 though, everything works. Any idea why this occurs? Cheers, Nick

2 1

Win2k, stunnel & Magic Mail Monitor questions
by Dana Rasmussen 04 Oct '05

04 Oct '05

Hello, I am running Windows 2000. I have recently learned of the stunnel tool. I am using it with Magic Mail Monitor, (MMM). MMM is a POP3 new mail notifier program. MMM allows me to configure a POP3 server by user name, host, password and POP3 port. MMM allows me to have multiple POP3 servers configured. Unfortunately, MMM does not use SSL. I have been able to get MMM to work with stunnel with the following stunnel.conf file: client = yes [MyPOP3SSL] accept=995 connect=mypop3server.com:995 The associated MMM configuration is: user: myuser host: 127.0.0.1 password:mypassword port:995 I would like to be able to add a second POP3 server to MMM, i.e. Gmail. If I add the following to the bottom of the existing stunnel.conf file Gmail POP3SSL access fails. If I add the following to the top of the existing stunnel.conf file the MyPOP3SSL fails but Gmail works. [GmailPOP3SSL] accept=995 connect=pop.gmail.com:995 The additional MMM configuration is: user:mygmail host: 127.0.0.1 password:mygmailpassword port:995 Is there a way to map the MMM configurations to the matching entries in the stunnel.conf file? Thank you, Dana

2 1

Peer suddenly disconnected
by Mark Tabash 03 Oct '05

03 Oct '05

Hello, I'm having problems using stunnel. I would be glad to provide further information upon request. The funny thing is that it was working before I shipped the client pc to the remote location. Nothing has changed since. Here's what I get in the logs: CLIENT: ssmtp accepted FD=8 from 127.0.0.1:32844 FD 8 in non-blocking mode ssmtp started ssmtp connected from 127.0.0.1:32844 FD 9 in non-blocking mode ssmtp connecting 62.21.201.224:465 remote connect #1: EINPROGRESS: retrying waitforsocket: FD=9, DIR=write waitforsocket: ok Remote FD=9 initialized SSL state (connect): before/connect initialization SSL state (connect): SSLv3 write client hello A waitforsocket: FD=9, DIR=read waitforsocket: ok SSL state (connect): SSLv3 read server hello A SSL state (connect): SSLv3 read server certificate A SSL state (connect): SSLv3 read server certificate request A SSL state (connect): SSLv3 read server done A SSL state (connect): SSLv3 write client certificate A SSL state (connect): SSLv3 write client key exchange A SSL state (connect): SSLv3 write certificate verify A SSL state (connect): SSLv3 write change cipher spec A SSL state (connect): SSLv3 write finished A SSL state (connect): SSLv3 flush data waitforsocket: FD=9, DIR=read waitforsocket: ok SSL_connect: Peer suddenly disconnected ssmtp finished (0 left) SERVER: ssmtp accepted FD=8 from 77.34.26.143:32845 FD 8 in non-blocking mode ssmtp started ssmtp connected from 77.34.26.143:32845 SSL state (accept): before/accept initialization SSL state (accept): SSLv3 read client hello A SSL state (accept): SSLv3 write server hello A SSL state (accept): SSLv3 write certificate A SSL state (accept): SSLv3 write certificate request A SSL state (accept): SSLv3 flush data SSL_accept: Peer suddenly disconnected ssmtp finished (0 left) ============================================ CLIENT INFO: stunnel 4.05 on i386-pc-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 Global options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /etc/stunnel/stunnel.pem pid = /var/run/stunnel4/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTidle = 43200 seconds ------------------ SERVER INFO: stunnel 4.09 on x86_64-pc-linux-gnu PTHREAD+POLL+IPv6+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 Global options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /etc/stunnel/stunnel.pem pid = /var/lib/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds

2 2

Stunnel 4.12 released
by Michal Trojnara 30 Sep '05

30 Sep '05

Here is the ChangeLog entry: Version 4.12, 2005.09.29, urgency: MEDIUM: * New features - Win32 installer added. - New Win32 commandline options: -start and -stop. - Log level and thread number are reported to syslog. - DLLs for OpenSSL 0.9.8. - stunnel.spec updated by neeo <neeo(a)irc.pl>. * Bugfixes - Use of broken poll() is disabled on Mac OS X. - Yet another transfer() infinite loop condition fixed. - Workaround for a serious M$ bug (KB177346). - IPv6 DLLs allocation problem resulting in GPF on W2K fixed. - zlib added to shared libraries (OpenSSL may need it). - size_t printf() fixed in stack_info(). * Release notes - This is a bugfix release. Upgrade is recommended. Homepage: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ sha1sum: 3a0f1b9955f64dcab376b4145663f1eadc5dfba5 stunnel-4.12.tar.gz Best regards, Mike

2 2

Stunnel Win32 binary
by Michal Trojnara 30 Sep '05

30 Sep '05

Dear Users, Some people were asking me for a standalone stunnel.exe file. It's located in stunnel-4.12/src directory of stunnel-4.12.tar.gz archive. Winzip can handle .tar.gz format, so you'll be able to unpack it. http://www.winzip.com/wzdifs.htm BTW: I recommend to try the installer, anyway. It's designed to make the upgrade much easier. You can simply enter the path where your current stunnel.exe and stunnel.conf are located during the install. stunnel.conf and stunnel.pem files won't be replaced and your Windows will remember the path so you won't have to enter it on next upgrade. Also the latest OpenSSL DLLs are installed in stunnel directory each time. Notes: 1. Uninstall removes stunnel.conf, so don't uninstall if you're only going to upgrade stunnel. 2. Remember to stop stunnel before you uninstall/upgrade it. Best regards, Mike

2 2

No encryption?
by Revelancefound＠aol.com 27 Sep '05

27 Sep '05

Dear patient users, It seems that stunnel does not encrypt outward traffic from my pc. I was able to get stunnel to work in the first place by having different proxies for each protocol. However, to test if my 8196 bit + x509 certificate keys actually encrypted my traffic I decided to do a test. I had sniffed my own computer using Cain and Able while logging in to my home router. To my disappointment, the sniffer picked up my username and password in plain text through HTTP protocol several times. Either that or Able can crack 256bit level encryption (256 x 32 = 8196) rather quickly. My stunnel.conf file: ; Sample stunnel configuration file by Michal Trojnara 2002-2005 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode cert = C:\Program Files\stunnel\stunnel.pem key = C:\Program Files\stunnel\stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath; CApath is located inside chroot jail: ;CApath = certs ; It's often easier to use CAfile: ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath; CRLpath is located inside chroot jail: ;CRLpath = crls ; Alternatively you can use CRLfile: ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 ;dutput = C:\Program Files\stunnel\stunnel.log ; Use it for client mode client = yes ; Service-level configuration client = yes verify = 0 ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 [ssmtp] accept = 127.0.0.1:465 connect = httpsupportingproxy4:3124 TIMEOUTclose = 0 [http] accept = 127.0.0.1:444 connect = httpsupportingproxy3:6588 TIMEOUTclose = 0 [https] accept = 127.0.0.1:443 connect = httpsupportingproxy2:6588 TIMEOUTclose = 0 [ftps] accept = 127.0.0.1:21 connect = httpsupportingproxy1:6588 TIMEOUTclose = 0 ; vim:ft=dosini And my bat file used to generate keys: openssl req -new -x509 -days 365 -nodes -config C:\OpenSSL\bin\openssl.cnf -out stunnel.pem -keyout stunnel.pem ;requirements: ;OpensSSL.exe in C:\windows directory ;Installation of Win32OpenSSL-v0.9.8.mis to C:\ ;Edit C:\OpenSSL\bin\openssl.cnf strings ;[ req ] ;default_bits = 8196 ;default_keyfile = stunnel.pem ;distinguished_name = req_distinguished_name ;attributes = req_attributes ;x509_extensions = v3_ca # The extentions to add to the self signed cert Cain Log: ================================================================== = Cain's MAC Scanner/Promiscuous-mode Detector = ================================================================== IP Address: (Router) MAC Address: (RouterMAC) OUI Fingerprint: Cisco-Linksys, LLC Hostname: ARP Test (Broadcast 31-bit): * ARP Test (Broadcast 16-bit): * ARP Test (Broadcast 8-bit): * ARP Test (Group bit): * ARP Test (Multicast group 0): * ARP Test (Multicast group 1): * ARP Test (Multicast group 3): * Am I doing something wrong here?

3 2

question about usage of configfile
by Revelancefound＠aol.com 26 Sep '05

26 Sep '05

To put it blatantly, I am trying to make stunnel 4.12 create a 2 way encrypted channel from my home computer as a client to an SSL supporting proxy (HTTP). Also, I am using localhost (127.0.0.1) as a connect address for proxy settings in such programs as Internet Explorer or a download manager. A sample of my stunnel.conf is bellow: client = yes verify = 0 [https] accept = 127.0.0.1:8080 connect = ssl.supporting.httpproxy.with.openport:80 TIMEOUTclose = 0 ; vim:ft=dosini My computer currently has the following installed: stunnel-4.12 Opensslv0.9.8 (Win32OpenSSL-v0.9.8.exe) ActivePerl-5.8.7.813-MSWin32-x86-148120.msi Windows XP Home Edition (SP2) Whenever I try to connect to 127.0.0.1:8080 the stunnel log reports 2005.09.23 20:57:33 LOG5[6012:5668]: stunnel 4.12 on x86-pc-mingw32-gnu WIN32+IPv6 with OpenSSL 0.9.8 05 Jul 2005 2005.09.23 20:57:33 LOG5[6012:4600]: No limit detected for the number of clients 2005.09.23 20:57:38 LOG5[6012:1560]: https connected from 127.0.0.1:3226 2005.09.23 20:59:10 LOG5[6012:5396]: https connected from 127.0.0.1:3232 2005.09.23 21:04:10 LOG5[6012:4576]: https connected from 127.0.0.1:3249 2005.09.23 21:09:10 LOG5[6012:4652]: https connected from 127.0.0.1:3268 2005.09.23 21:14:10 LOG5[6012:5396]: https connected from 127.0.0.1:3283 2005.09.23 21:19:12 LOG5[6012:1556]: https connected from 127.0.0.1:3296 2005.09.23 21:24:13 LOG5[6012:4072]: https connected from 127.0.0.1:3309 2005.09.23 21:29:23 LOG3[6012:3408]: Failed to initialize remote connection 2005.09.23 21:29:23 LOG5[6012:6140]: https connected from 127.0.0.1:3332 And so on into infinity Am I trying to do the impossible, or are all those 8196 bit RSA keys (certified through x508) that I generated going to waste?

2 1

stunnel for dovecot
by dhaval thakar 26 Sep '05

26 Sep '05

dear friends, i m preparing for RHCE Exam, as dovecot can not be configured in host.deny (TCP wrappers), we can create tunnel using stunnel & can use for the security perpose. kindly help me blocking pop3 access using host.deny file (using dovecot for the pop3) thanks in advance

2 1

minor annoyance
by Alaric Dailey 26 Sep '05

26 Sep '05

I have been using stunnel for a while with great success, only one minor issue, I am using stunnel for my http server and it ALWAYS logs traffic as coming from the stunnel IP rather than the IP address it is really coming from, is there a way around this?

3 5

RE: [stunnel-users] newbie stunnel question
by Revelancefound＠aol.com 25 Sep '05

25 Sep '05

no data is being transfered, thats the problem 2005.09.24 09:41:19 LOG5[1672:3268]: stunnel 4.11 on x86-pc-mingw32-gnu WIN32+IPv6 with OpenSSL 0.9.7f 22 Mar 2005 2005.09.24 09:41:20 LOG5[1672:2716]: No limit detected for the number of clients 2005.09.24 09:41:33 LOG5[1672:3576]: http connected from 127.0.0.1:1876 2005.09.24 09:42:18 LOG5[1672:1176]: http connected from 127.0.0.1:1881 2005.09.24 09:42:35 LOG5[1672:1408]: http connected from 127.0.0.1:1884 2005.09.24 09:42:44 LOG5[1672:1028]: http connected from 127.0.0.1:1887 And so on until Failed to initialize remote connection My config file: client = yes cert=c:\stunnel\stunnel.pem [http] accept = 127.0.0.1:80 connect = httpsupportingsslserver:80 [https] accept = 127.0.0.1:443 connect = httpsupportingsslserver:80 [ftp] accept = 127.0.0.1:22 connect = httpsupportingsslserver:80 Am I missing something here?

2 1

newbie stunnel question
by Revelancefound＠aol.com 24 Sep '05

24 Sep '05

Hello, im new to stunnel 4.11 and I am currently having trouble creating ssl conncetions. My operating sysytem in Windows XP Home (SP2), I am running Stunnel not as a service and I do not have CERT nor chroot. I am trying to create a SSL tunnel from my pc (stunnel in client mode) to a SSL supporting proxy that does not spill my ip. Because I am using windows I have to edit the stunnel.conf file, its contense is displayed here: client = yes cert=c:\stunnel\stunnel.pem [http] accept = 127.0.0.1:3900 connect = 200.114.206.192:8080 [https] accept = 127.0.0.1:3900 connect = 200.114.206.192:8080 [ftp] accept = 127.0.0.1:3900 connect = 200.114.206.192:8080 After these values are estabolished an netstat -an shows Proto Local Address Foreign Address State TCP 127.0.0.1:3900 0.0.0.0:0 LISTENING Can someone please help me? Attachment:

3 3

stunnel >= 4.0.7 crashes on IPv6 enabled Windows 2000
by Peter Bieringer 24 Sep '05

24 Sep '05

Hi, 4.0.6 claim about "The procedure entry point freeaddrinfo could not be located in the dynamic link library WS2_32.DLL" 4.0.7 and above crashes "...has generated errors". Windows 2000 is IPv6 enabled by <http://msdn.microsoft.com/downloads/sdks/platform/tpipv6.asp> with information from: <http://msdn.microsoft.com/downloads/sdks/platform/tpipv6/faq.asp> Is it planned to fix this issue? BTW: IPv6 enabled 4.0.11 works fine on Linux ! Peter -- Dr. Peter Bieringer http://www.bieringer.de/pb/ GPG/PGP Key 0x958F422D mailto: pb at bieringer dot de Deep Space 6 Co-Founder and Core Member http://www.deepspace6.net/

2 3

Re: stunnel-users Digest, Vol 14, Issue 7
by mxrtmxd72＠att.net 22 Sep '05

22 Sep '05

Thanks Michael. -------------- Original message ---------------------- From: stunnel-users-request(a)mirt.net > Send stunnel-users mailing list submissions to > stunnel-users(a)mirt.net > > To subscribe or unsubscribe via the World Wide Web, visit > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)mirt.net > > You can reach the person managing the list at > stunnel-users-owner(a)mirt.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. Help Installing Stunnel After Reformat Drive (mxrtmxd72(a)att.net) > 2. Re: Help Installing Stunnel After Reformat Drive (Michal Trojnara) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 21 Sep 2005 20:21:03 +0000 > From: mxrtmxd72(a)att.net > Subject: [stunnel-users] Help Installing Stunnel After Reformat Drive > To: stunnel-users(a)mirt.net (stunnel-users) > Message-ID: > > <092120052021.21511.4331C0AE000BE230000054072160376316CDC90B98039B9D9803(a)att.net > > > > > I have been using Stunnel with Agent versioin 3. My system recently crashed and > I had to re-format the hard drive, reinstall Windows XP, and reinstall my apps. > I have followed the directions at wurd.com/cl_ssl_stunnel.php#Windows. > Fortunately, I had backups of the required files. > > I placed libeay32.dll, libssl32.dll, stunnel-4.10.exe, and stunnel.conf in > C:\Stunnel. > > I placed a shortcut on the desktop which points to C:\Batch\runagent.bat. > > C:\Batch\runagent.bat consists of the following line: > c:\batch\runagent.cmd > > c:\batch\runagent.cmd consists of the following lines: > net start stunnel > "C:\Program Files\Agent\agent.exe" > net stop stunnel > > There is also a desktop shortcut which points to C:\Stunnel\stunnel-4.10.exe. > > When I place a pause command following the net start stunnel line in > runagent.cmd a message appears: The service name is invalid. > > The WURD document seems to imply that it is not necessary to run stunnel-410.exe > -install unless you want Stunnel to run all the time. Am I missing something? > I don't remember exactly how I made this work when I first installed it before > my system crashed. > > Any assistance would be gratefully appreciated. Thanks. > > Mort Middleman > > > > > > > Print. > Move to folder: > > > > ------------------------------ > > Message: 2 > Date: Thu, 22 Sep 2005 10:05:51 +0200 > From: "Michal Trojnara" <Michal.Trojnara(a)mobi-com.net> > Subject: Re: [stunnel-users] Help Installing Stunnel After Reformat > Drive > To: "stunnel-users" <stunnel-users(a)mirt.net> > Message-ID: <001401c5bf4c$823b6f00$df66a8c0@DT1518000186> > Content-Type: text/plain; format=flowed; charset="iso-8859-2"; > reply-type=original > > Mort Middleman <mxrtmxd72(a)att.net> wrote: > > net start stunnel > [cut] > > The WURD document seems to imply that it is not necessary to run > > stunnel-410.exe > > -install unless you want Stunnel to run all the time. Am I missing > > something? > > Yes. You need to install a service in order to start it. 8-) > You can change Startup Type in your Control Panel/Services so stunnel > service is not started automatically. > > BTW: Stunnel 4.12 is going to be released with a Windows installer, so users > won't have to maually copy the dlls. 8-) > You could try a prerelease here: > ftp://ftp.mirt.net/stunnel/stunnel-4.12rc1-installer.exe > > Best regards, > Mike > > > > ------------------------------ > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > End of stunnel-users Digest, Vol 14, Issue 7 > ********************************************

1 0

Help Installing Stunnel After Reformat Drive
by mxrtmxd72＠att.net 22 Sep '05

22 Sep '05

I have been using Stunnel with Agent versioin 3. My system recently crashed and I had to re-format the hard drive, reinstall Windows XP, and reinstall my apps. I have followed the directions at wurd.com/cl_ssl_stunnel.php#Windows. Fortunately, I had backups of the required files. I placed libeay32.dll, libssl32.dll, stunnel-4.10.exe, and stunnel.conf in C:\Stunnel. I placed a shortcut on the desktop which points to C:\Batch\runagent.bat. C:\Batch\runagent.bat consists of the following line: c:\batch\runagent.cmd c:\batch\runagent.cmd consists of the following lines: net start stunnel "C:\Program Files\Agent\agent.exe" net stop stunnel There is also a desktop shortcut which points to C:\Stunnel\stunnel-4.10.exe. When I place a pause command following the net start stunnel line in runagent.cmd a message appears: The service name is invalid. The WURD document seems to imply that it is not necessary to run stunnel-410.exe -install unless you want Stunnel to run all the time. Am I missing something? I don't remember exactly how I made this work when I first installed it before my system crashed. Any assistance would be gratefully appreciated. Thanks. Mort Middleman Print. Move to folder:

2 1

RE: [stunnel-users] Access to a daemon that has SSL abilities
by Amiram Oren 15 Sep '05

15 Sep '05

10x for the quick reply Alaric! Just want to see if I fully understand your note.. You set the stunnel daemon (/application) on a certain client machine. (let's say you have an IMAP client on it) Then, you configure your Argosoft server, which is set on another machine, to listen to SSL communication (i.e. IMAPS). Is this correct? Cheers, Oren. -----Original Message----- From: Alaric Dailey [mailto:[email protected]] Sent: Wednesday, September 14, 2005 7:44 PM To: Amiram Oren; stunnel-users(a)mirt.net Subject: Re: [stunnel-users] Access to a daemon that has SSL abilities Amiram Oren wrote: > Hi. > > Can I use stunnel only on a client side, in case on the other side, > the server already supports SSL? > > Will this work for SPOP3 and SMTP\S? > > 10X! > > Oren Amiram > >ilman/listinfo/stunnel-users > > I use it on my Argosoft email server to support IMAP, pop3 and HTTP with SSL onWindows 2003 yet :) - ______________________________________________________________________ This email message has been scanned by PineApp Mail-Secure and has been found clean.

2 1

Failed to initialize remote connection
by stunnel-users＠tinfoil.cotse.net 15 Sep '05

15 Sep '05

Hello I am running the Win32 binaries, v4.11, and up to now, they were working fine, as had all the 4.x versions before. But now my http connection will not work; it says "Failed to initialize remote connection". 2005.09.14 22:50:04 LOG3[2500:1492]: Failed to initialize remote connection 2005.09.14 22:50:06 LOG3[2500:1608]: Failed to initialize remote connection Please can anyone advice me what is wrong and how to put this right? Thanks.

1 0

Re: stunnel-4.11 stable?
by Serge Marigold 14 Sep '05

14 Sep '05

FYI, I'm trying to make a case so that my employer will feel some degree of comfort if we deploy it. Is there any other commercial entity that uses this version (4.11) of stunnel. Thanks

1 0

stunnel-4.11 patch for multiple certificates
by Nick Tolomiczenko 14 Sep '05

14 Sep '05

Hi stunnel users, I placed a patch to stunnel-4.11 that will enable it to handle multiple certificates. It is currently awaiting moderator approval. For those who can't wait, please contact myself, Nick Tolomiczenko, or Shem Ali below. Here's the description of what it does: This patch addresses the need for service-level ssl contexts. In particular, the following options which were only available as global options may now be used at the service level: cert, key, CApath, CAfile, ciphers, CRLpath, CRLfile, options, client and verify. If any of these options are used in a service section, stunnel will override its global setting -- if it exists -- and initialize a separate ssl context for the service. On the other hand, for those services that do not specify any of these options, stunnel will fall back on what was specified in the global section of the configuration file and intialize a "common" ssl context for those services. Note: If all services each specified at least one the the above ssl options, then the no "common" ssl context will be initialized since each service will have its own. In this case, it's still a good idea to put common default ssl options in the global section as each service will inherit these settings even if the service initializes its own ssl context. Brought to you by: Nick Tolomiczenko: nick(a)renderquest.com or nick(a)neikos.com Shem Ali: shem(a)renderquest.com

1 0

stunnel-4.11 patch for multiple certificates
by Nick Tolomiczenko 14 Sep '05

14 Sep '05

This patch addresses the need for service-level ssl contexts. In particular, the following options which were only available as global options may now be used at the service level: cert, key, CApath, CAfile, ciphers, CRLpath, CRLfile, options, client and verify. If any of these options are used in a service section, stunnel will override its global setting -- if it exists -- and initialize a separate ssl context for the service. On the other hand, for those services that do not specify any of these options, stunnel will fall back on what was specified in the global section of the configuration file and intialize a "common" ssl context for those services. Note: If all services each specified at least one the the above ssl options, then the no "common" ssl context will be initialized since each service will have its own. In this case, it's still a good idea to put common default ssl options in the global section as each service will inherit these settings even if the service initializes its own ssl context. Brought to you by: Nick Tolomiczenko: nick(a)renderquest.com or nick(a)neikos.com Shem Ali: shem(a)renderquest.com

1 0

Access to a daemon that has SSL abilities
by Amiram Oren 14 Sep '05

14 Sep '05

Hi. Can I use stunnel only on a client side, in case on the other side, the server already supports SSL? Will this work for SPOP3 and SMTP\S? 10X! Oren Amiram

2 1

stunnel-4.11 stable?
by Serge Marigold 13 Sep '05

13 Sep '05

Hi, Is anyone using stunnel-4.11 in a heavily trafficed production environment?

1 0

4.10 stable?
by conover＠rahul.net 09 Sep '05

09 Sep '05

Stunnel 4.10 has gzip compression, right? Is it stable? Thanks, John -- John Conover, conover(a)rahul.net, http://www.johncon.com/

1 0

[BUG] Stunnel 4.10 + xinetd : Connection reset by peer
by Eric Piel 02 Sep '05

02 Sep '05

Hello, I've upgraded to stunnel 4.10 yesterday and since this time I can't managed to get stunnel working with xinetd. I try to access a CVS server with ssl encryption. If stunnel is started as stand-alone, it works as before, but when it's started by xinetd all I get is: cvs [update aborted]: reading from server: Connection reset by peer I've attached the connection logs with 4.09 and 4.10 as well as my configuration file (which used to work for more than a year). My xinetd is version 2.3.13 (and I haven't changed it for several months). Please, let me know if I'm overlooking at something or if I can try anything to debug more in depth... Thanks in advance, Eric PS: actually the CVS is accesible from outside, so you might want to try yourself! # Sample stunnel configuration file # Copyright by Michal Trojnara 2002 setuid = root setgid = root # Authentication stuff verify = 2 CAfile = /etc/ssl/stunnel/lifl-cvs.pem # Use it for client mode client = yes #debug = 7 #output = /home/eric/busy/stunnel.log connect = cvs.lifl.fr:2405

4 5

Re: Flyspray task #7 - CRLfile is never refreshed
by Kartik Subbarao 27 Aug '05

27 Aug '05

I wanted to follow up on this. Flyspray did not let me add a comment since the bug is closed, so I'm posting to the mailing list. 1. I tried using CRLpath (and setting up the symbolic link properly to the hashed value), but that had the same behavior as CRLfile. It only reads the actual CRL once. If I update the file on disk, it never re-reads the file. So I don't see how this is a workaround. Am I missing something? 2. As I mentioned in my initial report, it is a significant disruption for existing stunnel processes to be killed. If it were possible just to kill the main daemon without also killing the child processes (i.e. like sshd), that could be a workaround. But currently, killing the main stunnel process also kills all child stunnel processes. I guess I don't understand what else one could do in this situation, apart from having the application properly reread the CRL on a regular basis. (OCSP is not yet available). When you say that "that's how openssl works", are you saying that the API does not allow you to reread/reload the CRL file? That seems rather odd. It seems like there should be some kind of way to refresh the OpenSSL data structures that store the CRL. Any thoughts/suggestions would be appreciated. Thanks, -Kartik Michal.Trojnara(a)mirt.net wrote: > Notice from stunnel > > Michal Trojnara (mtrojnar) has closed the following task. You are > receiving this because you are on the notification list. > > Task #7: CRLfile is never refreshed > The reason for closing is: Not a bug > That's how OpenSSL work. There are two workarounds: > 1. Use CRLpath instead of CRLfile (I recommend it). > 2. Restart stunnel after the CRL file modification. > > You can get more information about this task at the following URL: > http://stunnel.mirt.net/flyspray/index.php?do=details&id=7 > >

1 0

[stunnel patch] updated transparent proxy on linux 2.6 using cttproxy patch
by MAtteo HCE Valsasna 26 Aug '05

26 Aug '05

hello folks, here comes an improved version of the transparent proxy patch, basically solving the previous TODO issues. please try it if you are interested in transparent stunnel. any feedback il welcome. the code is heavly based on the examples distributed along with the cttproxy patch, many thanks to Balzs Scheidler for its great work and to Lennert Buytenhek for the skaidrus example program. this code is (re)distributed under the GPL version 2 MAtteo ---README--- cttproxy patch to stunnel MAtteo HCE Valsasna (matteo dot valsasna at uninsubria dot it) based on example code in cttproxy patch ports stunnel transparent proxy to cttproxy kernel patch allow stunnel server to connect to the application server faking the stunnel client's IP source address. the server sees connections coming from the stunnel client's IP address instead of that of the stunnel server, and thus can apply admission control, bandwidth control, logging policies as if the client connected directly. should work 2.4 and 2.6 kernels and 2.0.x cttproxy patch tested with kernel 2.6.12.5 and cttproxy-2.6.12-2.0.2 patch setup: * application server(s): here run the application(s) you want to access trough stunnel must route all traffic, or at least all traffic for transproxyed connections, trough the stunnel server * stunnel server: must not be the same host as the application server grab recent kernel source patch your kernel source with the appropriate cttproxy patch (from http://www.balabit.com/products/oss/tproxy/) configure kernel with: CONFIG_IP_NF_TPROXY=m CONFIG_IP_NF_MATCH_TPROXY=m CONFIG_IP_NF_TARGET_TPROXY=m make and install kernel reboot and choose patched kernel load tproxy kernel modules # modprobe iptable_tproxy # modprobe ipt_tproxy enable ip forwarding (this must act as a router) # echo 1 > /proc/sys/net/ipv4/ip_forward grab stunnel source and extract it $ tar xzf stunnel-4.11.tar.gz patch it $ patch -p0 < cttproxy.patch configure selecting tproxy support $ ./configure --enable-tproxy make and install $ make # make install run stunnel in server mode with transparent = yes remote = <application server>:<port> in conf file * stunnel client run plain stunnel, client = yes remote = stunnel server * application client may or may not be the same host as the stunnel client connect to stunnel client to talk securely to application server ---PATCH---diff -crb /tmp/stunnel-4.11/configure stunnel-4.11/configure *** /tmp/stunnel-4.11/configure 2005-07-09 23:00:44.000000000 +0200 --- stunnel-4.11/configure 2005-08-25 16:59:57.000000000 +0200 *************** *** 463,469 **** # include <unistd.h> #endif" ! ac_subst_vars='SHELL PATH_SEPARATOR PACKAGE_NAME PACKAGE_TARNAME PACKAGE_VERSION PACKAGE_STRING PACKAGE_BUGREPORT exec_prefix prefix program_transform_name bindir sbindir libexecdir datadir sysconfdir sharedstatedir localstatedir libdir includedir oldincludedir infodir mandir build_alias host_alias target_alias DEFS ECHO_C ECHO_N ECHO_T LIBS INSTALL_PROGRAM INSTALL_SCRIPT INSTALL_DATA CYGPATH_W PACKAGE VERSION ACLOCAL AUTOCONF AUTOMAKE AUTOHEADER MAKEINFO install_sh STRIP ac_ct_STRIP INSTALL_STRIP_PROGRAM mkdir_p AWK SET_MAKE am__leading_dot AMTAR am__tar am__untar build build_cpu build_vendor build_os host host_cpu host_vendor host_os CC CFLAGS LDFLAGS CPPFLAGS ac_ct_CC EXEEXT OBJEXT DEPDIR am__include am__quote AMDEP_TRUE AMDEP_FALSE AMDEPBACKSLASH CCDEPMODE am__fastdepCC_TRUE am__fastdepCC_FALSE EGREP LN_S ECHO AR ac_ct_AR RANLIB ac_ct_RANLIB CPP CXX CXXFLAGS ac_ct_CXX CXXDEPMODE am__fastdepCXX_TRUE am__fastdepCXX_FALSE CXXCPP F77 FFLAGS ac_ct_F77 LIBTOOL ssldir RANDOM_FILE USE_DH USE_IPv6 LIBOBJS LTLIBOBJS' ac_subst_files='' # Initialize some variables set by options. --- 463,469 ---- # include <unistd.h> #endif" ! ac_subst_vars='SHELL PATH_SEPARATOR PACKAGE_NAME PACKAGE_TARNAME PACKAGE_VERSION PACKAGE_STRING PACKAGE_BUGREPORT exec_prefix prefix program_transform_name bindir sbindir libexecdir datadir sysconfdir sharedstatedir localstatedir libdir includedir oldincludedir infodir mandir build_alias host_alias target_alias DEFS ECHO_C ECHO_N ECHO_T LIBS INSTALL_PROGRAM INSTALL_SCRIPT INSTALL_DATA CYGPATH_W PACKAGE VERSION ACLOCAL AUTOCONF AUTOMAKE AUTOHEADER MAKEINFO install_sh STRIP ac_ct_STRIP INSTALL_STRIP_PROGRAM mkdir_p AWK SET_MAKE am__leading_dot AMTAR am__tar am__untar build build_cpu build_vendor build_os host host_cpu host_vendor host_os CC CFLAGS LDFLAGS CPPFLAGS ac_ct_CC EXEEXT OBJEXT DEPDIR am__include am__quote AMDEP_TRUE AMDEP_FALSE AMDEPBACKSLASH CCDEPMODE am__fastdepCC_TRUE am__fastdepCC_FALSE CPP LN_S RANLIB ac_ct_RANLIB EGREP ECHO AR ac_ct_AR CXX CXXFLAGS ac_ct_CXX CXXDEPMODE am__fastdepCXX_TRUE am__fastdepCXX_FALSE CXXCPP F77 FFLAGS ac_ct_F77 LIBTOOL ssldir RANDOM_FILE USE_DH USE_IPv6 USE_TPROXY LIBOBJS LTLIBOBJS' ac_subst_files='' # Initialize some variables set by options. *************** *** 1037,1042 **** --- 1037,1043 ---- --disable-rsa Disable RSA support --enable-dh Enable DH support --enable-ipv6 Enable IPv6 support + --enable-tproxy Enable linux 2.6 tproxy patch support --disable-libwrap Disable TCP wrappers library support Optional Packages: *************** *** 23166,23171 **** --- 23344,23367 ---- fi; + # use linux 2.[46] tproxy patch + echo "$as_me:$LINENO: checking whether to enable transparent proxyng using linux 2.46 tproxy patch" >&5 + echo $ECHO_N "checking whether to enable transparent proxyng using linux 2.46 tproxy patch... $ECHO_C" >&6 + # Check whether --enable-tproxy or --disable-tproxy was given. + if test "${enable_tproxy+set}" = set; then + enableval="$enable_tproxy" + echo "$as_me:$LINENO: result: yes" >&5 + echo "${ECHO_T}yes" >&6; cat >>confdefs.h <<\_ACEOF + #define USE_TPROXY 1 + _ACEOF + + else + echo "$as_me:$LINENO: result: no" >&5 + echo "${ECHO_T}no" >&6 + + fi; + + # Disable use of libwrap (TCP wrappers) # it should be the last check! echo "$as_me:$LINENO: checking whether to disable TCP wrappers library support" >&5 *************** *** 23987,23992 **** --- 24184,24190 ---- s,@RANDOM_FILE@,$RANDOM_FILE,;t t s,@USE_DH@,$USE_DH,;t t s,@USE_IPv6@,$USE_IPv6,;t t + s,@USE_TPROXY@,$USE_TPROXY,;t t s,@LIBOBJS@,$LIBOBJS,;t t s,@LTLIBOBJS@,$LTLIBOBJS,;t t CEOF diff -crb /tmp/stunnel-4.11/configure.ac stunnel-4.11/configure.ac *** /tmp/stunnel-4.11/configure.ac 2005-07-09 22:58:05.000000000 +0200 --- stunnel-4.11/configure.ac 2005-08-25 16:56:33.000000000 +0200 *************** *** 14,21 **** --- 14,24 ---- if test "$GCC" = "yes" then CFLAGS="$CFLAGS -Wall -Wshadow -Wcast-align -Wpointer-arith" fi + AC_PROG_CPP AC_PROG_INSTALL + AC_PROG_LN_S AC_PROG_MAKE_SET + AC_PROG_RANLIB # Checks for typedefs, structures, and compiler characteristics # AC_C_CONST *************** *** 254,259 **** --- 257,271 ---- ) AC_SUBST(USE_IPv6) + # use linux 2.[46] tproxy patch + AC_MSG_CHECKING([whether to enable transparent proxyng using linux 2.[46] tproxy patch]) + AC_ARG_ENABLE(tproxy, + [ --enable-tproxy Enable linux 2.6 tproxy patch support], + [AC_MSG_RESULT([yes]); AC_DEFINE(USE_TPROXY)], + [AC_MSG_RESULT([no])] + ) + AC_SUBST(USE_TPROXY) + # Disable use of libwrap (TCP wrappers) # it should be the last check! AC_MSG_CHECKING([whether to disable TCP wrappers library support]) diff -crb /tmp/stunnel-4.11/src/client.c stunnel-4.11/src/client.c *** /tmp/stunnel-4.11/src/client.c 2005-07-02 08:55:58.000000000 +0200 --- stunnel-4.11/src/client.c 2005-08-26 16:01:34.000000000 +0200 *************** *** 44,49 **** --- 44,65 ---- #define SHUT_RDWR 2 #endif + #ifdef USE_TPROXY + #define LINUX_NETFILTER + #define LINUX_TPROXY + #define TPROXY_MAJOR_VERSION(x) ((x >> 24) & 0xff) + #define TPROXY_MINOR_VERSION(x) ((x >> 16) & 0xff) + #define TPROXY_PATCH_VERSION(x) (x & 0xffff) + #endif + + /* transparent proxy */ + #ifdef LINUX_NETFILTER + #include <linux/netfilter_ipv4.h> + #endif + #ifdef LINUX_TPROXY + #include <linux/netfilter_ipv4/ip_tproxy.h> + #endif + /* TCP wrapper */ #ifdef USE_LIBWRAP #include <tcpd.h> *************** *** 77,82 **** --- 93,103 ---- static int connect_wait(CLI *, int, int); static void reset(int, char *); + #ifdef USE_TPROXY + static int determine_source_address(struct sockaddr_in *destination, + struct sockaddr_in *source); + #endif + int max_clients; #ifndef USE_WIN32 int max_fds; *************** *** 921,926 **** --- 942,954 ---- int s; /* destination socket */ u16 i; + // struct in_addr *local=NULL; + #ifdef USE_TPROXY + int f; + struct in_tproxy itp; + struct sockaddr_in tproxy_sin; + #endif + /* setup address_list */ if(c->opt->option.delayed_lookup) { resolved_list.num=0; *************** *** 945,959 **** if(alloc_fd(s)) return -1; ! if(c->bind_addr.num) { /* explicit local bind or transparent proxy */ memcpy(&bind_addr, &c->bind_addr.addr[0], sizeof(SOCKADDR_UNION)); if(bind(s, &bind_addr.sa, addr_len(bind_addr))<0) { sockerror("bind transparent"); closesocket(s); return -1; } } /* try to connect for the 1st time */ s_ntop(c->connecting_address, &addr); s_log(LOG_DEBUG, "%s connecting %s", --- 973,1066 ---- if(alloc_fd(s)) return -1; ! if(c->bind_addr.num ! #ifdef USE_TPROXY ! /* if we're using the tproxy patch, transparent proxy is ! handled below */ ! && !c->opt->option.transparent ! #endif ! ) { ! /* explicit local bind, not tproxy transparent mode */ ! memcpy(&bind_addr, &c->bind_addr.addr[0], sizeof(SOCKADDR_UNION)); if(bind(s, &bind_addr.sa, addr_len(bind_addr))<0) { sockerror("bind transparent"); closesocket(s); return -1; } + sockerror("local bind succeeded"); } + #ifdef USE_TPROXY + if (c->opt->option.transparent){ + /* transparent proxy support on 2.[46] linux kernels */ + /* added by MAtteo HCE Valsasna (matteo.valsasna(a)uninsubria.it) 20050826 */ + /* requires tproxy kernel patch (http://www.balabit.com/products/oss/tproxy */ + /* based on examples in cttproxy patch */ + /* this patch is released under the GNU General Public Licence, Version 2 */ + + memcpy(&bind_addr, &c->bind_addr.addr[0], sizeof(SOCKADDR_UNION)); + + /* check tproxy version */ + itp.op = TPROXY_VERSION; + itp.v.version = 0x00000000; + + getsockopt(s, SOL_IP, IP_TPROXY, &itp, &f); + s_log(LOG_NOTICE, "TPROXY_VERSION: %d.%d.%d", + TPROXY_MAJOR_VERSION(itp.v.version), + TPROXY_MINOR_VERSION(itp.v.version), + TPROXY_PATCH_VERSION(itp.v.version)); + + /* conservative: accepting only tproxy version 2.0.x */ + if (TPROXY_MAJOR_VERSION(itp.v.version) != 2 || + TPROXY_MINOR_VERSION(itp.v.version) != 0) + { + s_log(LOG_ERR, "unsupported tproxy version: %x (2.0.x required)", itp.v.version); + return -1; + } + + tproxy_sin.sin_family = AF_INET; + if (determine_source_address(&addr.in, &tproxy_sin) < 0){ + sockerror("determine_source_address"); + return -1; + } + + /* do not request a specific source port */ + tproxy_sin.sin_port = htons(0); + + /* bind to local source address */ + /* needed for tproxy magic */ + if (bind(s, (struct sockaddr *) &tproxy_sin, sizeof(tproxy_sin)) == -1) + { + sockerror("bind"); + return -1; + } + s_log(LOG_NOTICE, "bound to local: %s", inet_ntoa(tproxy_sin.sin_addr)); + + /* assign foreign address */ + itp.op = TPROXY_ASSIGN; + itp.v.addr.faddr = bind_addr.in.sin_addr; + itp.v.addr.fport = 0; + + if (setsockopt(s, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1) + { + s_log(LOG_NOTICE, "error assigning foreign address: %s", inet_ntoa(bind_addr.in.sin_addr)); + sockerror("setsockopt(SOL_IP, IP_TPROXY, TPROXY_ASSIGN)"); + return -1; + } + s_log(LOG_NOTICE, "assigned foreign address: %s", inet_ntoa(bind_addr.in.sin_addr)); + + /* set connect flag on socket */ + itp.op = TPROXY_FLAGS; + itp.v.flags = ITP_CONNECT|ITP_ONCE; + if (setsockopt(s, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1) + { + sockerror("setsockopt(SOL_IP, IP_TPROXY, TPROXY_FLAGS)"); + return -1; + } + } + #endif + /* try to connect for the 1st time */ s_ntop(c->connecting_address, &addr); s_log(LOG_DEBUG, "%s connecting %s", *************** *** 1020,1023 **** --- 1127,1175 ---- log_error(LOG_DEBUG, get_last_socket_error(), txt); } + + #ifdef USE_TPROXY + + /* from skaidrus */ + static int determine_source_address(struct sockaddr_in *destination, + struct sockaddr_in *source) + { + struct sockaddr_in addr; + socklen_t addrlen; + char textaddr[32]; + int sock; + + sock = socket(AF_INET, SOCK_DGRAM, 0); + if (sock < 0) { + syslog(LOG_CRIT, "determine_source_address: error " + "%d while creating socket", errno); + abort(); + } + + addr = *destination; + addr.sin_port = htons(80); + if (connect(sock, (struct sockaddr *)&addr, sizeof(addr)) < 0) { + syslog(LOG_ALERT, "determine_source_address: error %d " + "while looking up route for %d", errno, + inet_aton(textaddr, &(addr.sin_addr))); + close(sock); + return -1; + } + + addrlen = sizeof(*source); + if (getsockname(sock, (struct sockaddr *)source, &addrlen) < 0) { + syslog(LOG_CRIT, "determine_source_address: error %d " + "while retrieving source address", errno); + abort(); + } + source->sin_port = 0; + + close(sock); + + return 0; + } + + #endif + + /* End of client.c */

1 0

RE: stunnel and OpenSSL v0.9.8 - tunneling the UDP. Possible?
by rz1a＠mail.ru 22 Aug '05

22 Aug '05

Hello Michal, Just one thought: - if the stunnel on LAN1 joins a group to receive a multicasted stream does it really depend on DTLS's [in]ability to handle the multicasting? I see it this way - on LAN1 a machine running the (first instance of) stunnel joins a group, i.e. stunnel is told to open a socket with all the relevant socket options. Then, another machine on LAN2 (behind NAT + firewall + internet + firewall + NAT) connects to the first stunnel and tells it's own instance of stunnel to open a socket with all the relevant socket options to emit the (apparently) multicasted stream. Please comment. -- Best regards, Tony

2 2

[stunnel patch] transparent proxy on linux 2.6 using cttproxy patch
by MAtteo HCE Valsasna 22 Aug '05

22 Aug '05

hi folks: as suggested in http://www.stunnel.org/faq/transparent.html#ToC3, I modified the stunnel code to use the transparent proxy funcionality on 2.6 (and possibly 2.4) linux kernels with the cttproxy patch (http://www.balabit.com/products/oss/tproxy/, I used )cttproxy-2.6.12-2.0.2. on a clean 2.6.12.5 kernel) the patch is higly incomplete, but it works (see TODO). please try it if you are interested in transparent stunnel. any feedback il welcome. MAtteo the code is heavly based on the examples distributed along with the cttproxy patch, many thanks to Balázs Scheidler for its great work and for making it GPL. with this patch, I was able to run a stunnel in server mode with the transparent option, and the application server I connected to saw the IP address of the stunnel client. of course, this code il also redistributed under the GPL. conditions for running stunnel in transparent mode: if you want to try this patch, you MUST modify the hardcoded IP address in client.c to the IP address of the stunnel server (look for DOIT! in the source code). any improvements wellcome. the stunnel server must run a linux kernel patched with the cttproxy patch the stunnel server and the application server cannot be the same host the application server must believe that it has to route all packets of transparently tunneled connections via the stunnel server. thus the two server should be on the same subnet. I was also able to use linux policy routing to avoid modifying the general routing on the application server: transparently tunneled connections are directed to a different IP on the application server, where a policy rule applies a specific routing table to packets with that source address (see at the end of this message). TODO: stunnel must explicitly bind to an *existing* local address (not loopback) before calling setsockopt(SOL_IP, IP_TPROXY, TPROXY_ASSIGN)"). now the address is hardcoded in the patch, it should automatically find a local address to bind to (or get it from the config file) now the code will only run with tproxy patch version 2.0.2 it should be less strict about tproxy version (make it a configurable option in stunnel?). which tproxy version will it run with? auto detect or configure kernel version (2.2 vs 2.4 or 2.6 with cttproxy), or better add it in .configure ----begin patch----- *** /tmp/stunnel-4.11/src/client.c 2005-07-02 08:55:58.000000000 +0200 --- stunnel-4.11/src/client.c 2005-08-22 12:19:57.000000000 +0200 *************** *** 44,49 **** --- 44,60 ---- #define SHUT_RDWR 2 #endif + #define LINUX_NETFILTER + #define LINUX_TPROXY + + /* transparent proxy */ + #ifdef LINUX_NETFILTER + #include <linux/netfilter_ipv4.h> + #endif + #ifdef LINUX_TPROXY + #include <linux/netfilter_ipv4/ip_tproxy.h> + #endif + /* TCP wrapper */ #ifdef USE_LIBWRAP #include <tcpd.h> *************** *** 921,926 **** --- 932,944 ---- int s; /* destination socket */ u16 i; + // struct in_addr *local=NULL; + #ifdef LINUX_TPROXY + int f; + struct in_tproxy itp; + struct sockaddr_in tproxy_sin; + #endif + /* setup address_list */ if(c->opt->option.delayed_lookup) { resolved_list.num=0; *************** *** 945,960 **** if(alloc_fd(s)) return -1; ! if(c->bind_addr.num) { /* explicit local bind or transparent proxy */ ! memcpy(&bind_addr, &c->bind_addr.addr[0], sizeof(SOCKADDR_UNION)); ! if(bind(s, &bind_addr.sa, addr_len(bind_addr))<0) { ! sockerror("bind transparent"); ! closesocket(s); ! return -1; ! } ! } ! ! /* try to connect for the 1st time */ s_ntop(c->connecting_address, &addr); s_log(LOG_DEBUG, "%s connecting %s", c->opt->servname, c->connecting_address); --- 963,1053 ---- if(alloc_fd(s)) return -1; ! if(c->bind_addr.num && !c->opt->option.transparent) { ! /* explicit local bind, not transparent mode */ ! ! memcpy(&bind_addr, &c->bind_addr.addr[0], sizeof(SOCKADDR_UNION)); ! if(bind(s, &bind_addr.sa, addr_len(bind_addr))<0) { ! sockerror("bind transparent"); ! closesocket(s); ! return -1; ! } ! sockerror("local bind succeeded"); ! } ! ! if (c->opt->option.transparent){ ! ! /* transparent proxy support on 2.[46] linux kernels */ ! /* added by MAtteo HCE Valsasna (matteo.valsasna(a)uninsubria.it) 20050822 */ ! /* requires tproxy kernel patch (http://www.balabit.com/products/oss/tproxy */ ! /* based on examples in cttproxy patch */ ! ! /* FIXME: should detect 2.2 kernel or 2.[46] + cttproxy patch and use appropriate code */ ! ! memcpy(&bind_addr, &c->bind_addr.addr[0], sizeof(SOCKADDR_UNION)); ! ! /* check tproxy version */ ! itp.op = TPROXY_VERSION; ! itp.v.version = 0x00000000; ! ! getsockopt(s, SOL_IP, IP_TPROXY, &itp, &f); ! s_log(LOG_NOTICE, "pre getsockopt(s, SOL_IP, IP_TPROXY): %x", itp.v.version); ! ! /* FIXME: should accept a range of tproxy versions - which? */ ! ! if (itp.v.version != 0x02000002) { ! itp.v.version = 0x02000002; ! if (setsockopt(s, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1) ! { ! sockerror("setsockopt(SOL_IP, IP_TPROXY, TPROXY_VERSION)"); ! getsockopt(s, SOL_IP, IP_TPROXY, &itp, &f); ! s_log(LOG_NOTICE, "err getsockopt(s, SOL_IP, IP_TPROXY): %x", itp.v.version); ! return -1; ! } ! } ! else{ ! s_log(LOG_NOTICE, "getsockopt(SOL_IP, IP_TPROXY, TPROXY_VERSION) returned right version"); ! } ! ! /* bind to local address */ ! /* FIXME: must become dynamic */ ! tproxy_sin.sin_family = AF_INET; ! /* DOIT! add a local IP address here */ ! inet_aton("192.168.179.71", &tproxy_sin.sin_addr); ! /* do not request a specific source port */ ! tproxy_sin.sin_port = htons(0); ! ! if (bind(s, (struct sockaddr *) &tproxy_sin, sizeof(tproxy_sin)) == -1) ! { ! sockerror("bind"); ! return -1; ! } ! s_log(LOG_NOTICE, "bound to local: %s", inet_ntoa(tproxy_sin.sin_addr)); ! ! /* assign foreign address */ ! itp.op = TPROXY_ASSIGN; ! itp.v.addr.faddr = bind_addr.in.sin_addr; ! itp.v.addr.fport = 0; ! ! if (setsockopt(s, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1) ! { ! s_log(LOG_NOTICE, "error assigning foreign address: %s", inet_ntoa(bind_addr.in.sin_addr)); ! sockerror("setsockopt(SOL_IP, IP_TPROXY, TPROXY_ASSIGN)"); ! return -1; ! } ! s_log(LOG_NOTICE, "assigned foreign address: %s", inet_ntoa(bind_addr.in.sin_addr)); ! ! /* set connect flag on socket */ ! itp.op = TPROXY_FLAGS; ! itp.v.flags = ITP_CONNECT|ITP_ONCE; ! if (setsockopt(s, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1) ! { ! sockerror("setsockopt(SOL_IP, IP_TPROXY, TPROXY_FLAGS)"); ! return -1; ! } ! } ! ! /* try to connect for the 1st time */ s_ntop(c->connecting_address, &addr); s_log(LOG_DEBUG, "%s connecting %s", c->opt->servname, c->connecting_address); ----end patch----- EXTRAS source routing on the application server intended usage: the application server is a squid proxy with pubblic adresses. its default gw is an HW-based router (not the transparent stunnel server). we want normal traffic (i.e. not handled by transparent stunnel) to continue to use normal routing. only traffic handled by stunnel should be routed back to the stunnel server. a new IP address (10.0.0.1) is added on the application server specifically for this purpose. stunnel server will forward connections to this address, normal clients will use another address. then, only traffic originating from this address needs to be routed back to the stunnel server. the stunnel server has IP 10.0.0.254 (but it can have more, of course) in /etc/iproute2/rt_tables add a line defining a new routing table: 10 inr.tproxy # add a rule to the new routing table ip r a table inr.tproxy default via 10.0.0.254 # create ip policy routing rule: packets with source address = # 10.0.0.1 should be routed according to the inr.tproxy table ip rule add type unicast from 10.0.0.1 table inr.tproxy priority 220 # apply policy routing changes ip route flush cache

1 0

RE: stunnel and OpenSSL v0.9.8 - tunneling the UDP. Possible?
by rz1a＠mail.ru 20 Aug '05

20 Aug '05

Hello Michal, OK. Securing a plain UDP will suffice at first! Are there any plans to use DTLS? Thank you in advance. -- Best regards, Tony

1 0

stunnel and OpenSSL v0.9.8 - tunneling the UDP. Possible?
by rz1a＠mail.ru 19 Aug '05

19 Aug '05

Hello stunnel-users, OpenSSL from v0.9.8 onwards (I'm told) supports a thing called DTLS. On the OpenSSL's list I was told that it's the tool one needs to use for UDP tunneling. Are there any plans to use this OpenSSL's functionality in the stunnel? I need to securely tunnel the UDP traffic, namely multicasted datagramms. -- Best regards, Tony.

2 1

stunnel on windows
by Paul Cottingham 19 Aug '05

19 Aug '05

Folks, I'm in need of some help in setting up stunnel on windows, I get either Error reading certificate file: {path}/stunnel.pem {path}/stunnel.pem: No such process (3) So I am assuming the second error {path}/stunnel.pem: No such process (3) the path statement is correct and therefore something else is not correct but I have no idea where and what Regards Paul

1 0

Stunnel HTTPS Client Issue
by Salar Madadi 19 Aug '05

19 Aug '05

Hello, We are having a problem with our application using STUNNEL and are stuck. I have detailed the issue below with more detailed info about our setup. I am not very familiar with the SSL protocol so I am having trouble identifying the differences between the log samples I posted to determine what the issue may be. Any help would be greatly appreciated. Thanks, Salar Madadi - Latest Developments Inc. Problem Description ************************************ We are using Stunnel to provide an HTTPS client for use with the UPS ShipXML service. Our application is an xBase++ 1.82 service using the XB2.NET library, running on a windows 2003 server. The application opens a connection to stunnel, which then connects to the UPS https server to send and retrieve an xml response with shipping data. UPS made a change to their service last week related to load balancing and our application has not worked since then. When we send an XML document to UPS we receive the exact same XML document back as if it has been bounced instead of the proper response. Our setup was working until they made the change and they have no idea what is going on. Stunnel Version ***************************************** The problem initially happened with stunnel v. 4.05 and openSSL v. 0.9.7c. I have also tried it with stunnel v. 4.11 and openSSL v. 0.9.7f and the same result occurs. Stunnel.conf settings *********************************** #Stunnel server configuration file key=stunnel.pem #up this number to 7 to get full log details #leave it at 3 to just get critical error messages debug=7 output=test.log client=yes verify=0 [psuedo-https] accept = 8080 connect = www.ups.com:443 TIMEOUTclose = 0 Stunnel log samples ************************************** Here are some log samples. The first is a log sample of when it was working. The second is one when it stopped working and the third is from when it was still not working using the latest version of stunnel/openssl. LOG 1 - Working 2005.05.24 23:37:39 LOG7[184:2796]: psuedo-https accepted FD=216 from 127.0.0.1:3349 2005.05.24 23:37:39 LOG7[184:2796]: FD 216 in non-blocking mode 2005.05.24 23:37:39 LOG7[184:2796]: Creating a new thread 2005.05.24 23:37:39 LOG7[184:2796]: New thread created 2005.05.24 23:37:39 LOG7[184:1840]: psuedo-https started 2005.05.24 23:37:39 LOG5[184:1840]: psuedo-https connected from 127.0.0.1:3349 2005.05.24 23:37:39 LOG7[184:1840]: FD 208 in non-blocking mode 2005.05.24 23:37:39 LOG7[184:1840]: psuedo-https connecting 153.2.228.50:443 2005.05.24 23:37:39 LOG7[184:1840]: remote connect #1: EWOULDBLOCK: retrying 2005.05.24 23:37:39 LOG7[184:1840]: waitforsocket: FD=208, DIR=write 2005.05.24 23:37:39 LOG7[184:1840]: waitforsocket: ok 2005.05.24 23:37:39 LOG7[184:1840]: Remote FD=208 initialized 2005.05.24 23:37:39 LOG7[184:1840]: SSL state (connect): before/connect initialization 2005.05.24 23:37:39 LOG7[184:1840]: SSL state (connect): SSLv3 write client hello A 2005.05.24 23:37:39 LOG7[184:1840]: waitforsocket: FD=208, DIR=read 2005.05.24 23:37:39 LOG7[184:1840]: waitforsocket: ok 2005.05.24 23:37:39 LOG7[184:1840]: SSL state (connect): SSLv3 read server hello A 2005.05.24 23:37:39 LOG5[184:1840]: VERIFY IGNORE: depth=1, /C=US/O=RSA Data Security, Inc./OU=Secure Server Certification Authority 2005.05.24 23:37:39 LOG5[184:1840]: VERIFY IGNORE: depth=1, /C=US/O=RSA Data Security, Inc./OU=Secure Server Certification Authority 2005.05.24 23:37:39 LOG5[184:1840]: VERIFY IGNORE: depth=0, /C=US/ST=New Jersey/L=Mahwah/O=United Parcel Service/OU=Internet Systems/CN=www.ups.com 2005.05.24 23:37:39 LOG7[184:1840]: SSL state (connect): SSLv3 read server certificate A 2005.05.24 23:37:39 LOG7[184:1840]: SSL state (connect): SSLv3 read server done A 2005.05.24 23:37:39 LOG7[184:1840]: SSL state (connect): SSLv3 write client key exchange A 2005.05.24 23:37:39 LOG7[184:1840]: SSL state (connect): SSLv3 write change cipher spec A 2005.05.24 23:37:39 LOG7[184:1840]: SSL state (connect): SSLv3 write finished A 2005.05.24 23:37:39 LOG7[184:1840]: SSL state (connect): SSLv3 flush data 2005.05.24 23:37:39 LOG7[184:1840]: waitforsocket: FD=208, DIR=read 2005.05.24 23:37:39 LOG7[184:1840]: waitforsocket: ok 2005.05.24 23:37:39 LOG7[184:1840]: SSL state (connect): SSLv3 read finished A 2005.05.24 23:37:39 LOG7[184:1840]: 3 items in the session cache 2005.05.24 23:37:39 LOG7[184:1840]: 3 client connects (SSL_connect()) 2005.05.24 23:37:39 LOG7[184:1840]: 3 client connects that finished 2005.05.24 23:37:39 LOG7[184:1840]: 0 client renegotiatations requested 2005.05.24 23:37:39 LOG7[184:1840]: 0 server connects (SSL_accept()) 2005.05.24 23:37:39 LOG7[184:1840]: 0 server connects that finished 2005.05.24 23:37:39 LOG7[184:1840]: 0 server renegotiatiations requested 2005.05.24 23:37:39 LOG7[184:1840]: 0 session cache hits 2005.05.24 23:37:39 LOG7[184:1840]: 0 session cache misses 2005.05.24 23:37:39 LOG7[184:1840]: 0 session cache timeouts 2005.05.24 23:37:39 LOG6[184:1840]: Negotiated ciphers: RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 2005.05.24 23:37:40 LOG7[184:1840]: SSL alert (read): warning: close notify 2005.05.24 23:37:40 LOG7[184:1840]: SSL closed on SSL_read 2005.05.24 23:37:40 LOG7[184:1840]: SSL write shutdown (output buffer empty) 2005.05.24 23:37:40 LOG7[184:1840]: Socket write shutdown (output buffer empty) 2005.05.24 23:37:40 LOG7[184:1840]: SSL alert (write): warning: close notify 2005.05.24 23:37:40 LOG6[184:1840]: SSL_shutdown successfully sent close_notify 2005.05.24 23:37:40 LOG7[184:1840]: Socket closed on read 2005.05.24 23:37:40 LOG5[184:1840]: Connection closed: 726 bytes sent to SSL, 648 bytes sent to socket 2005.05.24 23:37:40 LOG7[184:1840]: psuedo-https finished (0 left) LOG 2 - NOT WORKING 2005.08.15 15:46:07 LOG7[2636:3432]: psuedo-https accepted FD=180 from 127.0.0.1:3141 2005.08.15 15:46:07 LOG7[2636:3432]: FD 180 in non-blocking mode 2005.08.15 15:46:07 LOG7[2636:3432]: Creating a new thread 2005.08.15 15:46:07 LOG7[2636:3432]: New thread created 2005.08.15 15:46:07 LOG7[2636:1316]: psuedo-https started 2005.08.15 15:46:07 LOG5[2636:1316]: psuedo-https connected from 127.0.0.1:3141 2005.08.15 15:46:07 LOG7[2636:1316]: FD 172 in non-blocking mode 2005.08.15 15:46:07 LOG7[2636:1316]: psuedo-https connecting 65.171.127.243:443 2005.08.15 15:46:07 LOG7[2636:1316]: remote connect #1: EWOULDBLOCK: retrying 2005.08.15 15:46:07 LOG7[2636:1316]: waitforsocket: FD=172, DIR=write 2005.08.15 15:46:07 LOG7[2636:1316]: waitforsocket: ok 2005.08.15 15:46:07 LOG7[2636:1316]: remote connect #2: EINVAL: ok 2005.08.15 15:46:07 LOG7[2636:1316]: Remote FD=172 initialized 2005.08.15 15:46:07 LOG7[2636:1316]: SSL state (connect): before/connect initialization 2005.08.15 15:46:07 LOG7[2636:1316]: SSL state (connect): SSLv3 write client hello A 2005.08.15 15:46:07 LOG7[2636:1316]: waitforsocket: FD=172, DIR=read 2005.08.15 15:46:12 LOG7[2636:1316]: waitforsocket: ok 2005.08.15 15:46:12 LOG7[2636:1316]: SSL state (connect): SSLv3 read server hello A 2005.08.15 15:46:12 LOG7[2636:1316]: SSL state (connect): SSLv3 read finished A 2005.08.15 15:46:12 LOG7[2636:1316]: SSL state (connect): SSLv3 write change cipher spec A 2005.08.15 15:46:12 LOG7[2636:1316]: SSL state (connect): SSLv3 write finished A 2005.08.15 15:46:12 LOG7[2636:1316]: SSL state (connect): SSLv3 flush data 2005.08.15 15:46:12 LOG7[2636:1316]: 17 items in the session cache 2005.08.15 15:46:12 LOG7[2636:1316]: 230 client connects (SSL_connect()) 2005.08.15 15:46:12 LOG7[2636:1316]: 230 client connects that finished 2005.08.15 15:46:12 LOG7[2636:1316]: 0 client renegotiatations requested 2005.08.15 15:46:12 LOG7[2636:1316]: 0 server connects (SSL_accept()) 2005.08.15 15:46:12 LOG7[2636:1316]: 0 server connects that finished 2005.08.15 15:46:12 LOG7[2636:1316]: 0 server renegotiatiations requested 2005.08.15 15:46:12 LOG7[2636:1316]: 213 session cache hits 2005.08.15 15:46:12 LOG7[2636:1316]: 0 session cache misses 2005.08.15 15:46:12 LOG7[2636:1316]: 0 session cache timeouts 2005.08.15 15:46:12 LOG6[2636:1316]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.08.15 15:46:14 LOG7[2636:1316]: SSL_read returned WANT_: retrying 2005.08.15 15:46:14 LOG7[2636:1316]: SSL_read returned WANT_: retrying 2005.08.15 15:46:14 LOG7[2636:1316]: SSL alert (read): warning: close notify 2005.08.15 15:46:14 LOG7[2636:1316]: SSL closed on SSL_read 2005.08.15 15:46:14 LOG7[2636:1316]: SSL write shutdown (output buffer empty) 2005.08.15 15:46:14 LOG7[2636:1316]: Socket write shutdown (output buffer empty) 2005.08.15 15:46:14 LOG7[2636:1316]: SSL alert (write): warning: close notify 2005.08.15 15:46:14 LOG6[2636:1316]: SSL_shutdown successfully sent close_notify 2005.08.15 15:46:14 LOG5[2636:1316]: Connection closed: 738 bytes sent to SSL, 5754 bytes sent to socket 2005.08.15 15:46:14 LOG7[2636:1316]: psuedo-https finished (0 left) LOG 3 - NOT WORKING WITH LATEST VERSION OF STUNNEL/OPENSSL 2005.08.18 20:45:13 LOG7[2212:3324]: psuedo-https accepted FD=164 from 127.0.0.1:1076 2005.08.18 20:45:13 LOG7[2212:3324]: Creating a new thread 2005.08.18 20:45:13 LOG7[2212:3324]: New thread created 2005.08.18 20:45:13 LOG7[2212:3388]: psuedo-https started 2005.08.18 20:45:13 LOG7[2212:3388]: FD 164 in non-blocking mode 2005.08.18 20:45:13 LOG5[2212:3388]: psuedo-https connected from 127.0.0.1:1076 2005.08.18 20:45:13 LOG7[2212:3388]: FD 188 in non-blocking mode 2005.08.18 20:45:13 LOG7[2212:3388]: psuedo-https connecting 153.2.228.50:443 2005.08.18 20:45:13 LOG7[2212:3388]: connect_wait: waiting 10 seconds 2005.08.18 20:45:13 LOG7[2212:3388]: connect_wait: connected 2005.08.18 20:45:13 LOG7[2212:3388]: Remote FD=188 initialized 2005.08.18 20:45:16 LOG5[2212:3388]: VERIFY IGNORE: depth=1, /C=US/O=RSA Data Security, Inc./OU=Secure Server Certification Authority 2005.08.18 20:45:16 LOG5[2212:3388]: VERIFY IGNORE: depth=1, /C=US/O=RSA Data Security, Inc./OU=Secure Server Certification Authority 2005.08.18 20:45:16 LOG5[2212:3388]: VERIFY IGNORE: depth=0, /C=US/ST=New Jersey/L=Mahwah/O=United Parcel Service/OU=Internet System/OU=Terms of use at www.verisign.com/rpa (c)05/CN=www.ups.com 2005.08.18 20:45:17 LOG6[2212:3388]: SSL connected: new session negotiated 2005.08.18 20:45:17 LOG6[2212:3388]: Negotiated ciphers: RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 2005.08.18 20:45:20 LOG7[2212:3388]: SSL_read returned WANT_READ: retrying 2005.08.18 20:45:20 LOG7[2212:3388]: SSL_read returned WANT_READ: retrying 2005.08.18 20:45:20 LOG7[2212:3388]: SSL closed on SSL_read 2005.08.18 20:45:20 LOG7[2212:3388]: Socket write shutdown 2005.08.18 20:45:20 LOG7[2212:3388]: SSL write shutdown 2005.08.18 20:45:20 LOG6[2212:3388]: SSL_shutdown successfully sent close_notify 2005.08.18 20:45:20 LOG5[2212:3388]: Connection closed: 738 bytes sent to SSL, 8248 bytes sent to socket 2005.08.18 20:45:20 LOG7[2212:3388]: psuedo-https finished (0 left) Output of stunnel.exe -version ************************************* stunnel 4.11 on x86-pc-mingw32-gnu WIN32+IPv6 with OpenSSL 0.9.7f 22 Mar 2005 Global options cert = stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = stunnel.pem RNDbytes = 64 RNDoverwrite = yes service = stunnel session = 300 seconds taskbar = yes verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds 2005.08.18 21:06:04 LOG3[2508:3100]: Server is down

2 1

Win32 Local Privilege Escalation when Stunnel installed as a System service
by Ian 18 Aug '05

18 Aug '05

Hi, There is a trivial to exploit Local Privilege Escalation when stunnel is installed as a system service on windows. Who should I inform of this so a fix can be made? Thanks Ian --

5 4

stunnel Bug Tracking System
by Michal Trojnara 10 Aug '05

10 Aug '05

Dear Users, I've installed a Bug Tracking System for stunnel. You can enter bugs and feature requests here: http://stunnel.mirt.net/flyspray/ Best regards, Mike

1 0

stunnel for postgresql in windows
by babu 10 Aug '05

10 Aug '05

Hi all, I have seen stunnel example for mysql. how to use stunnel for postgresql in windows.. Thanks babu --------------------------------- To help you stay safe and secure online, we've developed the all new Yahoo! Security Centre.

2 2

nonblocking: Operation not supported by this device (19)
by Tuc＠T-B-O-H 09 Aug '05

09 Aug '05

Hi, This morning I stopped using the splash screen on boot on my FreeBSD 4.11 system, using stunnel 4.11 and now when I use stunnel I get: "stunnel[PID]: nonblocking: Operation not supported by device (19)" Why would changing if I use a splash screen or not make this difference?! Thanks, Tuc

1 0

Any examples of Stunnel usage in "enterprise environments"?
by Claus Lund 06 Aug '05

06 Aug '05

Hi everybody, I was just wondering if there are any public examples of widespread Stunnel usage in an enterprise environments? I'm a UNIX admin where I work and we are currently working on trying to find a solution for encrypting all network traffic to and from the UNIX machines (all the clients are using Windows boxes). We are running a variety of services on the boxes including Samba, homegrown services for our 3-tier app, Oracle, DB2 etc... I already have proof of concept setups for every network service that we offer but I think some "real-world examples" would go a long to convince my boss (and the Windows admins) that Stunnel is a viable option for us. Thank you in advance, Claus

2 1

Re: [stunnel-users] Stunnel dumping core
by Andrew Gay 05 Aug '05

05 Aug '05

> Envelope-to: gay@localhost > Delivery-date: Thu, 04 Aug 2005 16:49:55 +0100 Michael Tronjara wrote: > Politeness is required on this list. *plonk* > > Mike Michael, might I suggest your understanding of that word differs from the majority of us on this list. Many times people have written in pointing out problems with stunnel crashing, dumping core, locking up, yet all you can offer is 'never report problems with older versions', 'you have no right to complain', etc etc, and now you have the arrogance to tell us all we have no clue how to report bugs. I get the feeling you are upset because so many of us discover problems with this software. Andrew

4 6

RE: [stunnel-users] Stunnel dumping core
by Stephen Tanner 04 Aug '05

04 Aug '05

I was trying to see if it was a common issue when stunnel is unable to connect. I didn't ask for snide remarks. -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of Michal Trojnara Sent: Thursday, August 04, 2005 3:48 AM To: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] Stunnel dumping core "Stephen Tanner" <stanner(a)leeclerk.org> wrote: > Sometimes shutting it down while > it is doing this, it will dump core. Here is an axample of a good core dump error report. http://stunnel.mirt.net/pipermail/stunnel-users/2004-August/000009.html http://stunnel.mirt.net/pipermail/stunnel-users/2004-August/000015.html The report should include at least: - stunnel version line (for example "stunnel 4.05 on powerpc-ibm-aix5.2.0.0 FORK with OpenSSL 0.9.7d 17 Mar 2004"). - stack backtrace. It's a good idea to read: http://www.chiark.greenend.org.uk/~sgtatham/bugs.html Best regards, Mike _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 1

Stunnel dumping core
by Stephen Tanner 04 Aug '05

04 Aug '05

I've been running stunnel to tunnel syslog-ng messages to a loghost. On some occasions, be it a network maintenance issue or fluke, if a server loses connection to the loghost, stunnel starts spewing broken pipe messages to syslog. Sometimes shutting it down while it is doing this, it will dump core. Anyone have an idea on what might be causing this? =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Stephen Tanner HP-UX Systems Administrator Network Support Services Lee County Clerk of Courts =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

2 1

Error resolving '...' (Windows)
by Oliver Ackermann (infowing AG) 03 Aug '05

03 Aug '05

On a Windows 2000 machine I always get the following error when I try to start stunnel (4.11): Error resolving 'x.y.z.23': Neither nodename nor servname known (EAI_NONAME) The client should connect to a server using SSL. x.y.z.23 is a static IP address of the client. The client has multiple IP addresses and stunnel should use this one to connect to the server. Contents of stunnel.conf: client=yes [service] local=x.y.z.23 accept=12345 connect=server:12345 Why does stunnel try to "resolve" this IP? Is the configuration correct? Thanks for your help! Oliver

2 1

ftp support for stunnel-4.11 (still has errors, do not know why)
by ZHUANG YUYAO 03 Aug '05

03 Aug '05

hi, here is the initial patch (pre-pre-pre-alpha! just a demo/test) for adding ftp support to stunnel-4.11. Known bugs: 1) only tested under linux. debian 3.1 (testing), gcc version 3.3.5 (Debian 1:3.3.5-13) 2) ftp_alloc_port() in ftp.c is not yet finished. just a demo; 3) only works when configured with --with-threads=ucontext. does not work with --with-threads=pthread! 4) libwrap support is not tested. 5) only tested with flashfxp (3.0.2 build(1043) implicit SSL); 6) still contains memory leaks. 7) can only successfully transfer(RETR) small files whose size is less than about 90K bytes. stunnel hangs while transferring a larger file, looks like poll() in scan_waiting_queue() (network.c line 164) can not receive a POLLOUT event from ssl_wfd->fd after successfully transfered 90K bytes. the log file is also included in this mail. bug #7 really frustrats me. still do not know why. could anyone please give me some hints? Zhuang Yuyao.

1 1

some thoughts of add ftp server proxy support to stunnel4. comments required
by ZHUANG YUYAO 30 Jul '05

30 Jul '05

Hi, I am thinking about adding ftp protocol support to stunnel4. first, some restrictions to simplify the implimentation: 1) only support for stunnel running in server mode, users can use ftp clients which support ssl connection (ie. FlashFXP) to connect to the real ftp server through stunnel daemon; 2) only support standalone service mode of stunnel. (inted support may be added later, I've just read the source code related to standalone service, and have not got any clue about how to support inetd.) 3) only support FTP implicit SSL and PASSIVE mode; the code may look like this: (the real ftp server is at 192.168.10.254, listening on port 21.) 1) start a stunnel daemon nonmally with accept = 990, remote = 192.168.10.254:21, protocol = ftp; 2) when a connection come in, parse the ftp server response, search for "227 Entering Passive Mode (192,168,10,254,133,22)", then got the data connection IP: 192.168.10.254 PORT: 34070; 3) plus 1 to the data connction port 34070, then we got 34071 which will be used as stunnel accept port; 4) create a LOCAL_OPTIONS structure instance opt (prototypes.h) dynamically, set opt->accept=1, opt->local_addr same to the parent stunnel, change its port to 34071, opt->remote_addr = real data connection (IP: 192.168.10.254 PORT: 34070); opt->fd = socket(), bind(); 5) set local_option->next = opt; 6) s_poll_add (&fds, opt->fd, 1, 0); (stunnel.c) (the local variable fds needs to be changed to a global variable, by the way, I think it is also required if stunnel want real SIGHUP configuration-on-the-fly support) 7) changed server response to "227 Entering Passive Mode (STUNNEL_LOCAL_HOST,133,23)", then send back to client. 8) the client will then connect to STUNNEL_LOCAL_HOST port = 34071, negotiate SSL session and send/receive data; 9) after ftp session finished (How to know a ftp session is finished?), free the dynamic LOCAL_OPTIONS opt, remove opt->fd from fds, close the data sessoin. There are only two source file (stunnel.c, protocol.c) need to be modified to implement these functions. Any suggestions will be appreciated. Thank you. Zhuang Yuyao 2005/7/28

3 3