- stunnel-users - stunnel.org

connect ip = accept ip on multihomed server ?
by Dennis Spreen 09 May '05

09 May '05

hi all, with a configuration (stunnel4.10) like this [conc1] accept = 100 connect = 99 stunnel accepts all requests on all ips on port 100 but connects with the localhost to port 99. is it possible to configure stunnel that if it accepts a connection on 1.2.3.4:100 it connects to 1.2.3.4:99 ? I know it is possible to use accept = 1.2.3.4:100 connect = 1.2.3.4:99 .... accept = 1.2.3.250:100 connect = 1.2.3.250:99 but i'm on a c-class and that would require about 250 entries in the config file. Is there a better way to do this? regards dennis

1 0

Problems in Stunnel4.10
by vasudha.upadhyaya＠convergys.com 06 May '05

06 May '05

Hi, We have been using stunnel 4.05 and recently downloded the stunnel 4.10 and deployed in our environmrnt. All the traffice is going via the Load Balancer Cisco CSS with SSL Module to the unix server(with stunnel4.10 on them). We also 4.10 deployed on the Windows2000 as a client. The CSS sends keep Alives to check the health of the servers(whether they are up or not).And I guess due to this the stunnel on unix servers crashes immediately and there is a access violation error. Attached is the truss output for one of the unix servers.Stunnel4.10 was compiled using OpenSSL0.97d and OpenSSL0.97g, and still we get the same problem.Attached is the stunnel.conf also.[attachment "stunnel.conf" deleted by Vasudha Upadhyaya/CCMG/CVG] (See attached file: truss.out) (See attached file: stunnel.conf) Thanks, Vasudha. -------------------------------------------- Vasudha Upadhyaya Convergys Speech Solutions Ph:703-885-5837 vasudha.upadhyaya(a)convergys.com -- "NOTICE: The information contained in this electronic mail transmission is intended by Convergys Corporation for the use of the named individual or entity to which it is directed and may contain information that is privileged or otherwise confidential. If you have received this electronic mail transmission in error, please delete it from your system without copying or forwarding it, and notify the sender of the error by reply email or by telephone (collect), so that the sender's address records can be corrected."

1 0

qmail+tcpserver+stunnel-4.x
by Scott Geiger 06 May '05

06 May '05

Does anyone have a good link to setting up qmail to use stunnel for pop3s? I have found a few, but so far nothing seems to work from me. When I test with telnet it closes the connection immediately and tcpserver exits with status 11. tcpserver: status: 0/20 tcpserver: status: 1/20 tcpserver: pid 32660 from 128.226.61.66 tcpserver: ok 32660 242.70-84-9.reverse.theplanet.com:70.84.9.242:995 :128.226.61.66::26733 2005.05.06 15:37:18 LOG5[32660:1]: stunnel 4.10 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7g 11 Apr 2005 2005.05.06 15:37:18 LOG7[32660:1]: Snagged 64 random bytes from /root/.rnd 2005.05.06 15:37:18 LOG7[32660:1]: Wrote 1024 new random bytes to /root/.rnd 2005.05.06 15:37:18 LOG7[32660:1]: RAND_status claims sufficient entropy for the PRNG 2005.05.06 15:37:18 LOG6[32660:1]: PRNG seeded successfully 2005.05.06 15:37:18 LOG7[32660:1]: Configuration SSL options: 0x01000000 2005.05.06 15:37:18 LOG7[32660:1]: SSL options set: 0x01000000 2005.05.06 15:37:18 LOG7[32660:1]: Certificate: /etc/stunnel/stunnel.pem 2005.05.06 15:37:18 LOG7[32660:1]: Key file: /etc/stunnel/stunnel.pem 2005.05.06 15:37:18 LOG7[32660:1]: stunnel started 2005.05.06 15:37:18 LOG7[32660:1]: FD 0 in non-blocking mode 2005.05.06 15:37:18 LOG7[32660:1]: FD 1 in non-blocking mode 2005.05.06 15:37:18 LOG6[32660:1]: Local mode child started (PID=32661) 2005.05.06 15:37:18 LOG5[32660:1]: stunnel connected from 127.0.0.1:41860 2005.05.06 15:37:18 LOG7[32660:1]: FD 3 in non-blocking mode 2005.05.06 15:37:18 LOG7[32660:1]: stunnel connecting 127.0.0.1:110 2005.05.06 15:37:18 LOG7[32660:1]: connect_wait: waiting 10 seconds 2005.05.06 15:37:18 LOG7[32660:0]: Waiting 10 second(s) for 1 file descriptor(s) tcpserver: end 32660 status 11 tcpserver: status: 0/20 If is use openssl's s_client (openssl s_client -connect mail.bcmediagroup.com:995 -state) I get: CONNECTED(00000003) SSL_connect:before/connect initialization SSL_connect:SSLv2/v3 write client hello A SSL_connect:error in SSLv2/v3 read server hello A write:errno=104 Scott Geiger

1 0

Newbie windows user needs help patching/compiling with mingw
by Geoff Elmer 04 May '05

04 May '05

Can anyone point me to some documentation on how to use mingw to patch and make stunnel? Specifically, I want to apply connect-proxy_dunbar.patch to v4.05 source and compile it. As I am not really a coder (yet) and am not yet very *nix knowledgeable, any help would be much appreciated. Situation is: I am trying to traverse a MS ISA server (running as a proxy) and the v4.10 stunnel doesn't allow me to specify a proxy to route thru. Thanks in advance, Geoff __________________________________ Do you Yahoo!? Yahoo! Mail - Find what you need with new enhanced search. http://info.mail.yahoo.com/mail_250

1 0

[Newbie] Set up question
by Geoff Sheridan 02 May '05

02 May '05

I have compiled and installed stunnel 4.10 under Mac OS X 10.3. I want to set up stunnel to connect a non-ssl newsreader client to an ssl nntp server. The newsreader client is Unison and the server is Easynews SSL server. I don't really know how to do this. I wonder if anyone can point me in the right direction. Thanks Geoff ___________ PS I did various searches of the list archive and read TFM, but still need guidance! I am asked to include some details: $ /usr/local/sbin/stunnel -version stunnel 4.10 on powerpc-apple-darwin7.7.0 PTHREAD+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7b 10 Apr 2003 Global options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /usr/local/etc/stunnel/stunnel.pem pid = /usr/local/var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds $ uname -a Darwin My-Computer.local 7.7.0 Darwin Kernel Version 7.7.0: Sun Nov 7 16:06:51 PST 2004; root:xnu/xnu-517.9.5.obj~1/RELEASE_PPC Power Macintosh powerpc $ gcc -v Reading specs from /usr/libexec/gcc/darwin/ppc/3.3/specs Thread model: posix gcc version 3.3 20030304 (Apple Computer, Inc. build 1640)

2 1

[Newbie] Set up question
by retrocool 30 Apr '05

30 Apr '05

I have compiled and installed stunnel 4.10 under Mac OS X 10.3. I want to set up stunnel to connect a non-ssl newsreader client to an ssl nntp server. The newsreader client is Unison and the server is Easynews SSL server. I don't really know how to do this. I wonder if anyone can point me in the right direction. Thanks Geoff ___________ PS I did various searches of the list archive and read TFM, but still need guidance! I am asked to include some details: $ /usr/local/sbin/stunnel -version stunnel 4.10 on powerpc-apple-darwin7.7.0 PTHREAD+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7b 10 Apr 2003 Global options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /usr/local/etc/stunnel/stunnel.pem pid = /usr/local/var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds $ uname -a Darwin My-Computer.local 7.7.0 Darwin Kernel Version 7.7.0: Sun Nov 7 16:06:51 PST 2004; root:xnu/xnu-517.9.5.obj~1/RELEASE_PPC Power Macintosh powerpc $ gcc -v Reading specs from /usr/libexec/gcc/darwin/ppc/3.3/specs Thread model: posix gcc version 3.3 20030304 (Apple Computer, Inc. build 1640)

1 0

ldaps error "unknown protocol"
by Mike Partyka 29 Apr '05

29 Apr '05

Hello, Description of problem is as follows: I have a email server package called Scalix, which when installed came with openldap. On the same server i am also running Stunnel, which is already successfully ssl wrapping imap,pop, and smtp protocols. The ldap directory is very handy for an address book internally but we also have people that will be outside the corporate lan and to provide the directory securely would be desirable so i added the lines in the stunnel.conf to wrap ldap as well. I can see the stunnel daemon listening on port 636. But when i try to connect from any ssl aware mail client, such as evolution, or entourage, i get an error indicating failure to authenticate, which i know is not really the problem because the ldap directory is anonymous read access enabled. Debug logging gives more information about what is occurring, here is the conversion when attempting to connect: 2005.04.28 12:15:05 LOG5[27926:1076812720]: ldaps connected from 71.4.124.200:43012 2005.04.28 12:15:05 LOG7[27926:1076812720]: SSL state (accept): before/accept initialization 2005.04.28 12:15:05 LOG7[27926:1076812720]: waitforsocket: FD=14, DIR=read 2005.04.28 12:15:05 LOG7[27926:1076812720]: waitforsocket: ok 2005.04.28 12:15:05 LOG3[27926:1076812720]: SSL_accept: 140760FC: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol 2005.04.28 12:15:05 LOG7[27926:1076812720]: ldaps finished (6 left) Searching the archive is saw someone suggesting that either the ldap server or ldap client was not compiled with ssl support. I know the email clients i am trying to connect with are ssl compatible and maybe someone can set me straight here but i didn't think that the ldap server had to be ssl aware and that was the advantage of stunnel is that it can wrap services that are do not have ssl support? At any rate i believe the ldap server does have ssl support becuase i can see the binary omslapd (provided by Scalix, preceding "om" is there because Scalix is based on HP's Open Mail) links to the ssl library using the ldd command, here is the output, note the bolded line: msp1intmx01:~ # ldd /opt/scalix/bin/omslapd linux- gate.so.1 => (0xffffe000) libom_er.so => /opt/scalix/lib/libom_er.so (0x40018000) libom_ext.so => /opt/scalix/lib/libom_ext.so (0x40023000) libom_ldapth.so => /opt/scalix/lib/libom_ldapth.so (0x4002d000) libom_mdc.so => /opt/scalix/lib/libom_mdc.so (0x4004f000) libom_omldap.so => /opt/scalix/lib/libom_omldap.so (0x4005c000) libom_os.so => /opt/scalix/lib/libom_os.so (0x40079000) libom_sdl.so => /opt/scalix/lib/libom_sdl.so (0x40087000) libom_str.so => /opt/scalix/lib/libom_str.so (0x4008e000) libpthread.so.0 => /lib/tls/libpthread.so.0 (0x400a9000) libc.so.6 => /lib/tls/libc.so.6 (0x400b9000) libom_cvc.so => /opt/scalix/lib/libom_cvc.so (0x401ce000) libom_go.so => /opt/scalix/lib/libom_go.so (0x401e2000) libom_t61.so => /opt/scalix/lib/libom_t61.so (0x401e6000) libom_tfl.so => /opt/scalix/lib/libom_tfl.so (0x401eb000) libom_gcl.so => /opt/scalix/lib/libom_gcl.so (0x401f1000) libom_ccs.so => /opt/scalix/lib/libom_ccs.so (0x401f5000) libdl.so.2 => /lib/libdl.so.2 (0x40203000) libom_cl.so => /opt/scalix/lib/libom_cl.so (0x40206000) libom_cust.so => /opt/scalix/lib/libom_cust.so (0x40215000) libom_da.so => /opt/scalix/lib/libom_da.so (0x4021c000) libom_dit.so => /opt/scalix/lib/libom_dit.so (0x40244000) libom_dr.so => /opt/scalix/lib/libom_dr.so (0x4024a000) libom_hash.so => /opt/scalix/lib/libom_hash.so (0x4027b000) libom_lng.so => /opt/scalix/lib/libom_lng.so (0x4027e000) libom_mes.so => /opt/scalix/lib/libom_mes.so (0x40282000) libom_mim.so => /opt/scalix/lib/libom_mim.so (0x4028a000) libom_ml.so => /opt/scalix/lib/libom_ml.so (0x4029d000) libom_pam.so => /opt/scalix/lib/libom_pam.so (0x402a6000) libom_pwdl.so => /opt/scalix/lib/libom_pwdl.so (0x402b4000) libom_ul.so => /opt/scalix/lib/libom_ul.so (0x402b9000) libom_uni.so => /opt/scalix/lib/libom_uni.so (0x402cc000) libom_im.so => /opt/scalix/lib/libom_im.so (0x402e3000) libom_sfl.so => /opt/scalix/lib/libom_sfl.so (0x402ee000) libcrypt.so.1 => /lib/libcrypt.so.1 (0x4030c000) libom_sml.so => /opt/scalix/lib/libom_sml.so (0x4033d000) libom_tfo.so => /opt/scalix/lib/libom_tfo.so (0x40340000) libom_enc.so => /opt/scalix/lib/libom_enc.so (0x40343000) libom_lkf.so => /opt/scalix/lib/libom_lkf.so (0x40347000) libom_nm.so => /opt/scalix/lib/libom_nm.so (0x4034b000) /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000) libom_uscv.so => /opt/scalix/lib/libom_uscv.so (0x40352000) libom_fstr.so => /opt/scalix/lib/libom_fstr.so (0x4035a000) libom_gen.so => /opt/scalix/lib/libom_gen.so (0x4035c000) libom_xdse.so => /opt/scalix/lib/libom_xdse.so (0x40362000) libom_acl.so => /opt/scalix/lib/libom_acl.so (0x40365000) libom_cdl.so => /opt/scalix/lib/libom_cdl.so (0x4036c000) libom_drsc.so => /opt/scalix/lib/libom_drsc.so (0x40374000) libom_inet.so => /opt/scalix/lib/libom_inet.so (0x40379000) libom_vi.so => /opt/scalix/lib/libom_vi.so (0x40388000) libom_akt.so => /opt/scalix/lib/libom_akt.so (0x40399000) libom_q.so => /opt/scalix/lib/libom_q.so (0x403a1000) libom_date.so => /opt/scalix/lib/libom_date.so (0x403a6000) libom_ssn.so => /opt/scalix/lib/libom_ssn.so (0x403a8000) libom_orname.so => /opt/scalix/lib/libom_orname.so (0x403ac000) libom_culb.so => /opt/scalix/lib/libom_culb.so (0x403af000) libom_dstring.so => /opt/scalix/lib/libom_dstring.so (0x403b3000) libssl.so.0.9.7 => /usr/lib/libssl.so.0.9.7 (0x403b6000) libom_ufcv.so => /opt/scalix/lib/libom_ufcv.so (0x403e7000) libom_vista.so => /opt/scalix/lib/libom_vista.so (0x4040d000) libom_rda.so => /opt/scalix/lib/libom_rda.so (0x40439000) libom_rdudp.so => /opt/scalix/lib/libom_rdudp.so (0x4043e000) libom_rsl.so => /opt/scalix/lib/libom_rsl.so (0x40444000) libom_mp.so => /opt/scalix/lib/libom_mp.so (0x40456000) libom_mpl.so => /opt/scalix/lib/libom_mpl.so (0x4045e000) libom_msg.so => /opt/scalix/lib/libom_msg.so (0x40466000) libom_qml.so => /opt/scalix/lib/libom_qml.so (0x4046c000) libom_tf.so => /opt/scalix/lib/libom_tf.so (0x40471000) libcrypto.so.0.9.7 => /usr/lib/libcrypto.so.0.9.7 (0x4047b000) libom_fmem.so => /opt/scalix/lib/libom_fmem.so (0x4056b000) libom_acf.so => /opt/scalix/lib/libom_acf.so (0x40570000) libom_cvr.so => /opt/scalix/lib/libom_cvr.so (0x40575000) libom_ct.so => /opt/scalix/lib/libom_ct.so (0x40589000) libom_bb.so => /opt/scalix/lib/libom_bb.so (0x405cc000) libom_rtfl.so => /opt/scalix/lib/libom_rtfl.so (0x405e1000) libom_isl.so => /opt/scalix/lib/libom_isl.so (0x405f2000) libom_nf.so => /opt/scalix/lib/libom_nf.so (0x405fc000) libom_nfda.so => /opt/scalix/lib/libom_nfda.so (0x40602000) libom_nsl.so => /opt/scalix/lib/libom_nsl.so (0x40607000) libom_exual.so => /opt/scalix/lib/libom_exual.so (0x4060d000) Stunnel version information is as follows: stunnel 4.05 on i686-suse-linux-gnu PTHREAD with OpenSSL 0.9.7d 17 Mar 2004 Global options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /etc/stunnel/stunnel.pem pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTidle = 43200 seconds Stunnel is running in stand-alone mode and is being started without any parameters that i am aware of, i just used the init script supplied SuSE for their Enterprise 9 server product. Output of "stunnel -f -D 7 is: msp1intmx01:~ # stunnel -f -D 7 2005.04.29 08:27:24 LOG3[3326:1076392064]: -f: No such file or directory (2) Output of "stunnel -V is: msp1intmx01:~ # stunnel -V 2005.04.29 08:30:49 LOG3[3368:1076392064]: -V: No such file or directory (2) Output of "uname -a" msp1intmx01:~ # uname -a Linux msp1intmx01 2.6.5-7.151-smp #1 SMP Fri Mar 18 11:31:21 UTC 2005 i686 i686 i386 GNU/Linux Libc version is 2.3.3 Output of "gcc -v" msp1intmx01:~ # gcc -v Reading specs from /usr/lib/gcc-lib/i586-suse-linux/3.3.3/specs Configured with: ../configure --enable-threads=posix -- prefix=/usr --with-local-prefix=/usr/local -- infodir=/usr/share/info --mandir=/usr/share/man --enable- languages=c,c++,f77,objc,java,ada --disable-checking -- libdir=/usr/lib --enable-libgcj --with-gxx-include- dir=/usr/include/g++ --with-slibdir=/lib --with-system-zlib -- enable-shared --enable-__cxa_atexit i586-suse-linux Thread model: posix gcc version 3.3.3 (SuSE Linux) Openssl version is: msp1intmx01:~ # openssl version OpenSSL 0.9.7d 17 Mar 2004 Regards, -- Michael W. Partyka Jumpnode Systems, LLC Systems Administrator 612.605.5056 Desk 651.208.5734 Cell

1 0

stunnel with pop-3 over SSL, port 995?
by conover＠rahul.net 27 Apr '05

27 Apr '05

Can stunnel be used to connect to a pop-3 over SSL server on port 995? Thanks, John -- John Conover, conover(a)rahul.net, http://www.johncon.com/

1 0

SIGSEGV in init_ssl stunnel 4.10 on solaris 8
by Toni Schmidbauer 27 Apr '05

27 Apr '05

hi, we've got the following problem: - compiled stunnel 4.10 with openssl-0.9.7g - stunnel receives a SIGSEGV when connecting i am really not a C or gdb guru, but running stunnel 4.10 under gdb shows this: # gdb src/stunnel GNU gdb 6.0 Copyright 2003 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "sparc-sun-solaris2.8"... (gdb) set args /usr/local/stunnel-4.10/etc/stunnel/stunnel.conf (gdb) run Starting program: /usr/local/src/stunnel-4.10/src/stunnel /usr/local/stunnel-4.10/etc/stunnel/stunnel.conf [New LWP 1] [New LWP 2] [New LWP 3] [New LWP 4] Program received signal SIGSEGV, Segmentation fault. 0x0002a32c in init_ssl (c=0x11e008) at client.c:298 298 s_poll_add(&c->fds, c->ssl_rfd->fd, (gdb) bt #0 0x0002a32c in init_ssl (c=0x11e008) at client.c:298 #1 0x00029f30 in do_client (c=0x11e008) at client.c:147 #2 0x00029dd8 in client (arg=0x126270) at client.c:120 (gdb) p c->ssl_rfd $1 = (FD *) 0x1 (gdb) so it seems c->ssl_rfd points to nowhere. further investigation reveals that c->ssl_rfd gets overwritten after the call to SSL_accept. stunnel 4.09 works. is this a problem with UCONTEXT? ************************************************************************ information as request on the support page: openssl version: OpenSSL 0.9.7g 11 Apr 2005 uname -a: SunOS coti 5.8 Generic_117350-05 sun4u sparc SUNW,UltraAX-i2 gcc -v: Reading specs from /usr/local/lib/gcc-lib/sparc-sun-solaris2.8/3.3.2/specs Configured with: ../configure --with-as=/usr/ccs/bin/as --with-ld=/usr/ccs/bin/ld --disable-nls --disable-libgcj --enable-languages=c,c++ Thread model: posix gcc version 3.3.2 stunnel log with debug=7: 2005.04.27 08:41:33 LOG5[24386:1]: stunnel 4.10 on sparc-sun-solaris2.8 UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7g 11 Apr 2005 2005.04.27 08:41:33 LOG7[24386:1]: RAND_status claims sufficient entropy for the PRNG 2005.04.27 08:41:33 LOG6[24386:1]: PRNG seeded successfully 2005.04.27 08:41:33 LOG7[24386:1]: Configuration SSL options: 0x00000FFF 2005.04.27 08:41:33 LOG7[24386:1]: SSL options set: 0x00000FFF 2005.04.27 08:41:33 LOG7[24386:1]: Certificate: /usr/local/stunnel-4.10/etc/stunnel/stunnel.pem 2005.04.27 08:41:33 LOG7[24386:1]: Key file: /usr/local/stunnel-4.10/etc/stunnel/stunnel.pem 2005.04.27 08:41:33 LOG6[24386:1]: file ulimit = 256 (can be changed with 'ulimit -n') 2005.04.27 08:41:33 LOG6[24386:1]: poll() used - no FD_SETSIZE limit for file descriptors 2005.04.27 08:41:33 LOG5[24386:1]: 125 clients allowed 2005.04.27 08:41:33 LOG7[24386:1]: FD 5 in non-blocking mode 2005.04.27 08:41:33 LOG7[24386:1]: FD 6 in non-blocking mode 2005.04.27 08:41:33 LOG7[24386:1]: FD 7 in non-blocking mode 2005.04.27 08:41:33 LOG7[24386:1]: SO_REUSEADDR option set on accept socket 2005.04.27 08:41:33 LOG7[24386:1]: https bound to 0.0.0.0:443 2005.04.27 08:41:33 LOG7[24386:1]: Created pid file /usr/local/stunnel-4.10/var/stunnel/stunnel.pid 2005.04.27 08:41:33 LOG7[24386:0]: Waiting -1 second(s) for 2 file descriptor(s) 2005.04.27 08:41:35 LOG7[24386:0]: CONTEXT 1, FD=5, (IN)->() 2005.04.27 08:41:35 LOG7[24386:0]: CONTEXT 1, FD=7, (IN)->(IN) 2005.04.27 08:41:35 LOG7[24386:1]: https accepted FD=9 from 162.25.222.252:35728 2005.04.27 08:41:35 LOG7[24386:1]: Creating a new context 2005.04.27 08:41:35 LOG7[24386:1]: Context 2 created 2005.04.27 08:41:35 LOG7[24386:2]: https started 2005.04.27 08:41:35 LOG7[24386:2]: FD 9 in non-blocking mode 2005.04.27 08:41:35 LOG5[24386:2]: https connected from 162.25.222.252:35728 2005.04.27 08:43:08 LOG7[24386:2]: SSL state (accept): before/accept initialization 2005.04.27 08:43:08 LOG7[24386:2]: SSL state (accept): SSLv3 read client hello A 2005.04.27 08:43:08 LOG7[24386:2]: SSL state (accept): SSLv3 write server hello A 2005.04.27 08:43:08 LOG7[24386:2]: SSL state (accept): SSLv3 write certificate A 2005.04.27 08:43:08 LOG7[24386:2]: SSL state (accept): SSLv3 write server done A 2005.04.27 08:43:08 LOG7[24386:2]: SSL state (accept): SSLv3 flush data ************************************************************************ thanks for your time and help regards toni -- Wer es einmal so weit gebracht hat, dass er nicht | toni at stderror dot at mehr irrt, der hat auch zu arbeiten aufgehoert | Toni Schmidbauer -- Max Planck |

1 1

stunnel crash when multiple connections
by Debin Chen 27 Apr '05

27 Apr '05

Hi, I will appreciate greatly if you can diagnose the following crash problem: I am using stunnel 4.05, working with webserver thttpd to provide a https solution, in linux environment. First I wrote down some noticeable behavior of stunnel. 1) stunnel each time spawns a thread to handle the https connection then destroy the thread. If I browse a lot of pages, then internally a lot of thread ( or process) got created and destroyed. 2) Sometimes after a https request is completed, the thread is still there. Only following request will trigger the thread got destroyed. Normally if there is no activity, just 2 threads left. The problem: During some stress testing, such as multiple ( in my case, actually just 2 or 3) web browser simultaneously issues request to the web server in https, I found out in certain moment stunnel spawns more than 5 or 6 threads to handle the connections, sometimes it crashed without giving out any serious debug error messages. When it crashed, system resource of CPU and memory is still sufficient. Note than I already set timeoutclose=0, that should be done. Best Regards Debin Chen ======================================== Advanced Storage Division Promise Technology, Inc. 580 Cottonwood Drive, Milpitas, CA 95035 Tel: 408-228-1529 CONFIDENTIALITY NOTICE: The information contained in or attached to this email message is either proprietary and/or confidential information, or information intended solely for the use of the individual or entity named above. If the reader of this message is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately notify us by email and delete the original message from your computer/server with confirmation to us that you have done so. Thank you.

1 0

connect directly to unix domain socket?
by Marty Lamb 25 Apr '05

25 Apr '05

Hello, Sorry for the newb question, but I've done quite a bit of searching and haven't found a definitive answer either way - and I doubt I'm the first to ask about this. Is there any way to connect an incoming connection directly to a unix domain socket? Some sort of service level option like: connect = /path/to/socket would be ideal, and hopefully I'm just missing something in the docs. If this is not available, I can just exec socat - but that seems like an unnecessary step. Thanks much, Marty

1 0

Newbie question
by Rick Kubowic 25 Apr '05

25 Apr '05

I'm trying to implement a secure TCP tunnel from one PC to another. I've been looking for quite some time and can't seem to find the problem. I've been following the following example of how to start a server service: stunnel -p /path/to/stunnel.pem -d pop3s -r bar:pop3 I've created a generic certificate, but I get the error: Failed to open configuration file -p What am I doing wrong?? Rick Kubowicz ITG Canada Corp. 416-874-0834

2 1

Mailing list web interface
by Michal Trojnara 24 Apr '05

24 Apr '05

Dear Users, I'm glad to announce that mirt.net server is now fully moved to the new location. I hope you'll enjoy the speed. 8-) The mailing list management web interface is operational, again. Best regards, Mike

1 0

Stunnel 4.10 released
by Michal Trojnara 23 Apr '05

23 Apr '05

Here is the ChangeLog entry: Version 4.10, 2005.04.23, urgency: LOW/EXPERIMENTAL: * DLLs for OpenSSL 0.9.7g. * Bugfixes - Missing locking on Win32 platform was added (thx to Yi Lin <yi.lin(a)convergys.com>) - Some problems with closing SSL fixed. * New features - New UCONTEXT user-level non-preemptive threads model is used on systems that support SYSV-compatible ucontext.h. - Improved stunnel3 script with getopt-compatible syntax. * Release notes - This version should be thoroughly tested before using it in the mission-critical environment. Homepage: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ Best regards, Mike

1 0

Patch: Windows version of stunnel 4.09 is not thread-safe
by yi.lin＠convergys.com 23 Apr '05

23 Apr '05

We have been using stunnel on Windows as a SSL proxy to connect to HTTPS server but stunnel kept crashing randomly under load. After some investigation, we found the following: according to OpenSSL document (http://www.openssl.org/docs/crypto/threads.html) "OpenSSL can safely be used in multi-threaded applications provided that at least two callback functions are set. locking_function(int mode, int n, const char *file, int line) is needed to perform locking on shared data structures. (Note that OpenSSL uses a number of global data structures that will be implicitly shared whenever multiple threads use OpenSSL.) Multi-threaded applications will crash at random if it is not set. " The original stunnel package only implements a POSIX Pthread version of locking callback functions, but doesn't provide any implementation for Windows. This has caused random crashes during our testing because the way we use stunnel requires frequent creation/destruction of threads and stunnel is not thread-safe without the locking callbacks. The attached fix attempts to address the problem by implementing the Windows version of locking callbacks using Windows native CRITICAL_SECTION object. =============================================================================================================================== *** sthreads.c Fri Dec 31 02:55:40 2004 --- sthreads_w32.c Thu Apr 14 08:29:07 2005 *************** *** 121,126 **** --- 121,127 ---- #ifdef USE_WIN32 CRITICAL_SECTION stunnel_cs[CRIT_SECTIONS]; + static CRITICAL_SECTION lock_cs[CRYPTO_NUM_LOCKS]; void enter_critical_section(SECTION_CODE i) { EnterCriticalSection(stunnel_cs+i); *************** *** 130,141 **** --- 131,161 ---- LeaveCriticalSection(stunnel_cs+i); } + static void locking_callback(int mode, int type, + #ifdef HAVE_OPENSSL + const /* Callback definition has been changed in openssl 0.9.3 */ + #endif + char *file, int line) { + if(mode&CRYPTO_LOCK) + EnterCriticalSection(lock_cs+type); + else + LeaveCriticalSection(lock_cs+type); + } + + void sthreads_init(void) { int i; /* Initialize stunnel critical sections */ for(i=0; i<CRIT_SECTIONS; i++) InitializeCriticalSection(stunnel_cs+i); + + /* Initialize OpenSSL locking callback */ + for(i=0; i<CRYPTO_NUM_LOCKS; i++) + InitializeCriticalSection(lock_cs+i); + CRYPTO_set_locking_callback(locking_callback); + + } unsigned long stunnel_process_id(void) { (See attached file: sthread_diff) Yi Lin Convergys Corporation yi.lin(a)convergys.com (703)885-5767 -- "NOTICE: The information contained in this electronic mail transmission is intended by Convergys Corporation for the use of the named individual or entity to which it is directed and may contain information that is privileged or otherwise confidential. If you have received this electronic mail transmission in error, please delete it from your system without copying or forwarding it, and notify the sender of the error by reply email or by telephone (collect), so that the sender's address records can be corrected."

2 1

connection refsed (111)
by RAJADURAI D 20 Apr '05

20 Apr '05

hi I am trying to connect using mysql, there are no fw between the 2 boxes. I tested with stunnel latest version 4.08 in red hat 9,it shows the last message as connection refused (111) after the cipher negotiation Any ideas on how to solve this error plz help me, to short out this problem ? i am using ==> Stunnel 4.08 redhat 9 Kernel 2.4.20-8 mysql Ver 11.18 Distrib 3.23.54,for redhat-linux-gnu(i386) I am using stunnel.pem generated while installing stunnel 4.08 SERVER SIDE [root@scorpion src]# ./stunnel 2005.03.30 12:23:19 : stunnel with OpenSSL 0.9.7a Feb 19 2003 2005.03.30 12:23:19 : Certificate: /usr/local/etc/stunnel/stunnel.pem 2005.03.30 12:23:19 : Key file: /usr/local/etc/stunnel/stunnel.pem 2005.03.30 12:23:19 : 500 clients allowed 2005.03.30 12:23:19 : SO_REUSEADDR option set on accept socket 2005.03.30 12:23:19 : mysqls bound to 0.0.0.0:3307 2005.03.30 12:23:19 : Created pid file /stunnel.pid 2005.03.30 12:27:01 : mysqls accepted FD=7 from 192.168.2.175:33091 2005.03.30 12:27:01 : mysqls started 2005.03.30 12:27:01 : mysqls connected from 192.168.2.175:33091 2005.03.30 12:27:01 : SSL state (accept): before/accept initialization 2005.03.30 12:27:01 : SSL state (accept): SSLv3 read client hello A 2005.03.30 12:27:01 : SSL state (accept): SSLv3 write server hello A 2005.03.30 12:27:01 : SSL state (accept): SSLv3 write certificate A 2005.03.30 12:27:01 : SSL state (accept): SSLv3 write server done A 2005.03.30 12:27:01 : SSL state (accept): SSLv3 flush data 2005.03.30 12:27:01 : SSL state (accept): SSLv3 read client key exchange A 2005.03.30 12:27:01 : SSL state (accept): SSLv3 read finished A 2005.03.30 12:27:01 : SSL state (accept): SSLv3 write change cipher spec A 2005.03.30 12:27:01 : SSL state (accept): SSLv3 write finished A 2005.03.30 12:27:01 : SSL state (accept): SSLv3 flush data 2005.03.30 12:27:01 : 1 items in the session cache 2005.03.30 12:27:01 : 0 client connects (SSL_connect()) 2005.03.30 12:27:01 : 0 client connects that finished 2005.03.30 12:27:01 : 0 client renegotiatations requested 2005.03.30 12:27:01 : 1 server connects (SSL_accept()) 2005.03.30 12:27:01 : 1 server connects that finished 2005.03.30 12:27:01 : 0 server renegotiatiations requested 2005.03.30 12:27:01 : 0 session cache hits 2005.03.30 12:27:01 : 0 session cache misses 2005.03.30 12:27:01 : 0 session cache timeouts 2005.03.30 12:27:01 : SSL accepted: new session negotiated 2005.03.30 12:27:01 : Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.03.30 12:27:01 : mysqls connecting 127.0.0.1:3306 2005.03.30 12:27:01 : connect_wait: waiting 10 seconds 2005.03.30 12:27:01 : connect_wait: getsockopt: Connection refused (111) 2005.03.30 12:27:01 : Failed to initialize remote connection 2005.03.30 12:27:01 : mysqls finished (0 left) ====================================================== CLIENT SIDE [root@redhat src]# ./stunnel 2005.03.30 23:24:42 LOG5[7383:1075999904]: stunnel 4.08 on i686-pc-linux-gnu PTH READ+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7a Feb 19 2003 2005.03.30 23:24:42 LOG7[7383:1075999904]: RAND_status claims sufficient entropy for the PRNG 2005.03.30 23:24:42 LOG6[7383:1075999904]: PRNG seeded successfully 2005.03.30 23:24:42 LOG7[7383:1075999904]: Certificate: /usr/local/etc/stunnel/s tunnel.pem 2005.03.30 23:24:42 LOG7[7383:1075999904]: Key file: /usr/local/etc/stunnel/stun nel.pem 2005.03.30 23:24:42 LOG6[7383:1075999904]: file ulimit = 1024 (can be changed wi th 'ulimit -n') 2005.03.30 23:24:42 LOG6[7383:1075999904]: poll() used - no FD_SETSIZE limit for file descriptors 2005.03.30 23:24:42 LOG5[7383:1075999904]: 500 clients allowed 2005.03.30 23:24:42 LOG7[7383:1075999904]: FD 4 in non-blocking mode 2005.03.30 23:24:42 LOG7[7383:1075999904]: FD 5 in non-blocking mode 2005.03.30 23:24:42 LOG7[7383:1075999904]: FD 6 in non-blocking mode 2005.03.30 23:24:42 LOG7[7383:1075999904]: SO_REUSEADDR option set on accept soc ket 2005.03.30 23:24:42 LOG7[7383:1075999904]: mysqls bound to 0.0.0.0:3306 2005.03.30 23:24:42 LOG7[7383:1075999904]: Created pid file /stunnel.pid 2005.03.30 23:32:19 LOG7[7383:1075999904]: mysqls accepted FD=7 from 127.0.0.1:3 3090 2005.03.30 23:32:19 LOG7[7383:1075999904]: FD 7 in non-blocking mode 2005.03.30 23:32:19 LOG7[7383:1076067520]: mysqls started 2005.03.30 23:32:20 LOG5[7383:1076067520]: mysqls connected from 127.0.0.1:33090 2005.03.30 23:32:20 LOG7[7383:1076067520]: FD 8 in non-blocking mode 2005.03.30 23:32:20 LOG7[7383:1076067520]: mysqls connecting 192.168.2.210:3307 2005.03.30 23:32:20 LOG7[7383:1076067520]: connect_wait: waiting 10 seconds 2005.03.30 23:32:20 LOG7[7383:1076067520]: connect_wait: connected 2005.03.30 23:32:20 LOG7[7383:1076067520]: Remote FD=8 initialized 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): before/connect initialization 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): SSLv3 write client hello A 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): SSLv3 read server hello A 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): SSLv3 read server certificate A 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): SSLv3 read server done A 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): SSLv3 write client key exchange A 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): SSLv3 write change cipher spec A 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): SSLv3 write finished A 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): SSLv3 flush data 2005.03.30 23:32:20 LOG7[7383:1076067520]: SSL state (connect): SSLv3 read finished A 2005.03.30 23:32:20 LOG7[7383:1076067520]: 1 items in the session cache 2005.03.30 23:32:20 LOG7[7383:1076067520]: 1 client connects (SSL_connect()) 2005.03.30 23:32:20 LOG7[7383:1076067520]: 1 client connects that finished 2005.03.30 23:32:20 LOG7[7383:1076067520]: 0 client renegotiatations requeste d 2005.03.30 23:32:20 LOG7[7383:1076067520]: 0 server connects (SSL_accept()) 2005.03.30 23:32:20 LOG7[7383:1076067520]: 0 server connects that finished 2005.03.30 23:32:20 LOG7[7383:1076067520]: 0 server renegotiatiations request ed 2005.03.30 23:32:20 LOG7[7383:1076067520]: 0 session cache hits 2005.03.30 23:32:20 LOG7[7383:1076067520]: 0 session cache misses 2005.03.30 23:32:20 LOG7[7383:1076067520]: 0 session cache timeouts 2005.03.30 23:32:20 LOG6[7383:1076067520]: SSL connected: new session negotiated 2005.03.30 23:32:20 LOG6[7383:1076067520]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.03.30 23:32:20 LOG3[7383:1076067520]: SSL_read: Connection reset by peer (1 04) 2005.03.30 23:32:20 LOG5[7383:1076067520]: Connection reset: 0 bytes sent to SSL , 0 bytes sent to socket 2005.03.30 23:32:20 LOG7[7383:1076067520]: mysqls finished (0 left) RUNNING mysqL IN AN SEPARATE TERMINAL [root@redhat bharathi]# mysql -h 127.0.0.1 -u anirudh -p Enter password: ERROR 2013: Lost connection to MySQL server during query

2 2

Disabling IPv6
by Punitha 20 Apr '05

20 Apr '05

Hello Everyone !! I need to build Stunnel-4.09 in HP-UX11.11 without the support of IPv6. I did not use --enable-ipv6 option. In the configure log I could see the reference of getaddrinfo and getnameinfo functions. Is that refers any of the system file or the function defined in the souce code? I used `nm stunnel | grep getaddrinfo` and it shows the following. $ nm stunnel | grep getaddrinfo getaddrinfo | |undef |code | getaddrinfo | 118768|uext |stub | $ I need to confirm the source(from where they are taken) of getaddrinfo and getnameinfo functions. Is that related with the support of ipv6 in any way? Any of you please make me clear. Thanx in ADVANCE. Regards, Punitha.

2 1

Disabling IPv6
by Punitha 20 Apr '05

20 Apr '05

Hello Everyone !! I need to build Stunnel-4.09 in HP-UX11.11 without the support of IPv6. I did not use --enable-ipv6 option. In the configure log I could see the reference of getaddrinfo and getnameinfo functions. Is that refers any of the system file or the function defined in the souce code? I used `nm stunnel | grep getaddrinfo` and it shows the following. $ nm stunnel | grep getaddrinfo getaddrinfo | |undef |code | getaddrinfo | 118768|uext |stub | $ I need to confirm the source(from where they are taken) of getaddrinfo and getnameinfo functions. Is that related with the support of ipv6 in any way? Any of you please make me clear. Thanx in ADVANCE. Regards, Punitha.

1 0

Reporting problems
by Michal Trojnara 19 Apr '05

19 Apr '05

Dear Users, Please stop reporting problems with obsolete versions of stunnel. You should always upgrade to the latest stunnel and OpenSSL first, than repeat your tests and report a problem. Best regards, Mike

2 1

Stunnel - Transfer loop executes not transferring any data.
by Michel Esber 19 Apr '05

19 Apr '05

Hello All, I am running a proprietary daemon on port 443 that accepts incoming connections. We are experiencing problems when activating stunnel on our production box. Everytime that we run our daemon with stunnel, our CPU and memory/swap area consumption is extremely intensive. Each stunnel process consumes approximately 37Mb of RSS memory. I have browsed through my logs and here is what I found: 2005.04.18 14:35:00 LOG3[15242:1245336]: transfer() loop executes not transferring any data 2005.04.18 14:35:06 LOG3[15242:1245336]: please report the problem to Michal.Trojnara(a)mirt.net 2005.04.18 14:35:06 LOG3[15242:1245336]: socket open rd=yes wr=yes, ssl open rd=yes wr=yes 2005.04.18 14:35:06 LOG3[15242:1245336]: socket ready rd=no wr=no, ssl ready rd=no wr=no 2005.04.18 14:35:06 LOG3[15242:1245336]: check_SSL_pending=0, ssl_closing=0 2005.04.18 14:35:06 LOG5[15242:1245336]: Connection reset: 258 bytes sent to SSL, 153319 bytes sent to socket Some details: a) My configuration file: [https] accept = 443 exec = /path/to/daemon execargs = daemon -ssl stunnel 4.07 on i686-pc-linux-gnu PTHREAD+POLL+IPv4+LIBWRAP with OpenSSL 0.9.6b [engine] 9 Jul 2001 Global options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:RC4+RSA:+SSLv2:@STRENGTH debug = 5 key = /usr/local/etc/stunnel/stunnel.pem pid = /usr/local/var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds b) glibc-2.2.4-31.7 glibc-devel-2.2.4-32.8 libcap-1.10-6 glibc-common-2.2.4-31.7 c) uname -a Linux myserver 2.4.9-e.57enterprise #1 SMP Thu Dec 2 20:45:51 EST 2004 i686 unknown d) gcc -v gcc version 2.96 20000731 (Red Hat Linux 7.2 2.96-118.7.2) e) openssl version OpenSSL 0.9.6b [engine] 9 Jul 2001 Can anyone shred some light? I believe I should upgrade some of my core components (gcc / openssl). I just need to make sure this is the right direction. Thanks in advance, X------------------- Michel Esber MCSE, MCSA, MCDBA Automatos - www.automatos.com US: 1 (866) 2293584

2 1

stunnel generating defuncts
by Serxio Barral 19 Apr '05

19 Apr '05

Hi there! I'm using stunnel as client with SuSE SLES 8. Usually after several days working OK (up to two weeks) it begins to generate defunct processes for every transfer. At first, stunnel version was 3.14 (the one that comes out of the box with SLES 8), but now I have downloaded an compiled 3.26 and it just happens the same. killing stunnel won't help, since relaunching it again turns on generating defuncts. Situation does not come back to normal until rebooting the server. Any hint on this issue? Thanks in advance, Serxio Barral.

1 0

stunnel generating defuncts
by SERXIO BARRAL PAN/ Generali-España 19 Apr '05

19 Apr '05

Hi there! I'm using stunnel as client with SuSE SLES 8. Usually after several days working OK (up to two weeks) it begins to generate defunct processes for every transfer. At first, stunnel version was 3.14 (the one that comes out of the box with SLES 8), but now I have downloaded an compiled 3.26 and it just happens the same. killing stunnel won't help, since relaunching it again turns on generating defuncts. Situation does not come back to normal until rebooting the server. Any hint on this issue? Thanks in advance, Serxio Barral.

1 0

Please Help! I keep getting the same error.
by Theodore W. Hildebrandt 11 Apr '05

11 Apr '05

Refer to my submission of 03/24/05: "error:1408F10B:SSL . . . " I had hoped that someone would tell me how to get around this error, but no message has appeared in the stunnel Archive. I have now ftp'd version 4.09 and tried it, with the same results. I wait and wait for a connection, and finally interrupt the process, since it's not going anywhere. And then I get the "error:1408F10B. . ." message in the stunnel log. Since I seem to be able to send e-mail from my old Pentium II computer (Windows 98SE) I'm, using it so send this message. [Note that I can still receive e-mail on the new Dell Pentium IV machine (Windows XP Home). I just can't send anything.] Doesn't anyone have answers? Ted Hildebrandt

1 0

Unexpected closed connections
by Rory Campbell-Lange 11 Apr '05

11 Apr '05

Hi Everyone We have been very happily using stunnel for about 5 months connecting a site office back to a main office, tunnelling imap connections. We are suddenly seeing lots of disconnection messages and people at a. can no longer see their mail on d. The server suffers a "socket write shutdown" condition and shuts down the associated process. We have restarted the routers and firewalls and all seems to be working fine, other than stunnel. I'd be grateful for any insight or further help. Many thanks Rory Present arrangement: a. site client | b. site server port forwarded to c. | | internet | | c. main office server port forwarded to d. | d. imap server Server b forwards imap connections securely to the main office server, which then passes on on the imap connections to the imap server. Server b connects through the following inetd line: imaph stream tcp nowait nobody /usr/sbin/stunnel /usr/sbin/stunnel -c -r server_c_address:imap We are running version 3.26 on debian: stunnel 3.26 on i386-pc-linux-gnu PTHREAD+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 Server shows following disconnect messages: 2005.04.11 13:21:46 LOG7[13320:163848]: SSL alert (read): warning: close notify 2005.04.11 13:21:46 LOG7[13320:163848]: SSL closed on SSL_read 2005.04.11 13:21:46 LOG7[13320:163848]: SSL alert (write): warning: close notify 2005.04.11 13:21:46 LOG7[13320:163848]: SSL write shutdown (output buffer empty) 2005.04.11 13:21:46 LOG7[13320:163848]: Socket write shutdown (output buffer empty) 2005.04.11 13:21:46 LOG5[13320:163848]: Connection closed: 92 bytes sent to SSL, 0 bytes sent to socket 2005.04.11 13:21:46 LOG7[13320:163848]: 10.0.0.24.imap finished (6 left) Client logs: Apr 11 15:50:26 hald stunnel[4672]: server_b.imaps connected from 10.0.1.54:49301 Apr 11 15:55:05 hald stunnel[4672]: SSL_connect: Peer suddenly disconnected ... Apr 11 15:49:55 hald stunnel[4655]: 195.172.252.146.imaps connected from 10.0.1.52:49819 Apr 11 15:54:08 hald stunnel[4655]: SSL_connect: Peer suddenly disconnected -- Rory Campbell-Lange <rory(a)campbell-lange.net> <www.campbell-lange.net>

1 0

Re: [stunnel-users] Pass IP Attn: Alexander Lazic
by Tim Brown 10 Apr '05

10 Apr '05

Nope...I see Cygwin is a Linux-like environment for Windows. Can you send me the stunnel.exe that already has this patch compiled? This works for windows? thanks. ----- Original Message ----- From: "Alexander Lazic" <al-stunnel(a)none.at> To: "Tim Brown" <tbrown2376(a)adelphia.net> Sent: Sunday, April 10, 2005 12:06 PM Subject: Re: [stunnel-users] Pass IP Attn: Alexander Lazic > On Son 10.04.2005 10:24, Tim Brown wrote: >>Al....not following how to do this from Windows..cmd prompt? > > Don't you use cygwin? > > al ;-) > >>From: "Alexander Lazic" <al-stunnel(a)none.at> >>To: "Tim Brown" <tbrown2376(a)adelphia.net> >>Cc: <stunnel-users(a)mirt.net> >>Sent: Sunday, April 10, 2005 4:28 AM >>Subject: Re: [stunnel-users] Pass IP Attn: Alexander Lazic >> >> >>>On Son 10.04.2005 00:33, Tim Brown wrote: >>>>Al...how do I install this patch? ...I running stunnel 4.07 >>> >>>Have you ever used the program 'patch'? >>> >>>>Thanks for your help. >>> >>>get stunnel-4.07.tar.gz >>>extract stunnel-4.07.tar.gz >>>get the patch >>>call patch -p0 < the_patch_file >>> >>>al ;-) >>> >>>>From: "Alexander Lazic" <al-stunnel(a)none.at> >>>>To: <tbrown2376(a)adelphia.net> >>>>Cc: <stunnel-users(a)mirt.net> >>>>Sent: Saturday, April 09, 2005 3:54 AM >>>>Subject: Re: [stunnel-users] Pass IP Attn: Alexander Lazic >>>> >>>> >>>>>Hi, >>>>> >>>>>On Fre 08.04.2005 12:48, tbrown2376(a)adelphia.net wrote: >>>>>>Attn: Alexander Lazic >>>>>> >>>>>>Can you please send me the patch for: >>>>>>patch for HTTP => X-Forwarded-For Header >>>>>> >>>>>>to: tbrown2376(a)adelphia.net >>>>> >>>>>You can get it from: >>>>> >>>>>http://stunnel.mirt.net/pipermail/stunnel-users/2005-February/000331.html >>>>> >>>>>or you can wait for monday, then i can send you the patch. >>>>> >>>>>al ;-) >>>>> >>>>_______________________________________________ >>>>stunnel-users mailing list >>>>stunnel-users(a)mirt.net >>>>http://stunnel.mirt.net/mailman/listinfo/stunnel-users >> >>_______________________________________________ >>stunnel-users mailing list >>stunnel-users(a)mirt.net >>http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 1

stunnel 4.09 error message-- s_poll_wait:invalid argurment <WSAEINVAL> <10022>
by Ed Huckins 10 Apr '05

10 Apr '05

Occurs when I upgraded from stunnel 4.08 to 4.09. Using OpenSSL 0.9.7f . Stunnel.conf looks like # We're running as a client to SSLify the POP & IMAP connections client=yes # POP3 service, listens on localhost:11110 [dslx-pop3s] accept=localhost:11110 connect=mail.dslextreme.com:995 What do I need to add when going from 4.08 to 4.09? Everything seems to work; just a reset of the connection occurs instead of a close. --- avast! Antivirus: Outbound message clean. Virus Database (VPS): 0514-3, 04/10/2005 Tested on: 4/10/2005 10:40:50 AM

1 0

Pass IP Attn: Alexander Lazic
by tbrown2376＠adelphia.net 10 Apr '05

10 Apr '05

Attn: Alexander Lazic Can you please send me the patch for: patch for HTTP => X-Forwarded-For Header to: tbrown2376(a)adelphia.net Thanks. On Die 29.03.2005 11:00, Tim Brown wrote: >I am running Stunnel version 4.07 on a Windows 2000 server. Is there >any way to pass the originating IP through Stunnel to my server >application? As it is now Stunnel is passing the server IP for all >requests. I have send a patch for HTTP => X-Forwarded-For Header to the list. al ;-)

3 4

Pass IP Attn: Alexander Lazic
by Tim Brown 09 Apr '05

09 Apr '05

Alexander Lazic Can you please send me the patch for: patch for HTTP => X-Forwarded-For Header to: tbrown2376(a)adelphia.net Thanks. On Die 29.03.2005 11:00, Tim Brown wrote: >I am running Stunnel version 4.07 on a Windows 2000 server. Is there >any way to pass the originating IP through Stunnel to my server >application? As it is now Stunnel is passing the server IP for all >requests. I have send a patch for HTTP => X-Forwarded-For Header to the list. al ;-) Tim Brown VP Network Services Florida Telco Credit Union Ph: 904.723.6315 Toll Free: 800.342.2352 ext. 6315 Fax: 904.722.6615 <mailto:[email protected]> tbrown(a)floridatelco.org Confidentiality Notice: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review or distribution by others is strictly prohibited. If you are not the intended recipient, be advised that any unauthorized disclosure, copying, distribution, or the taking of any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error, please immediately delete this message and attachments (including all copies) and notify the sender by return e-mail or by phone at 904.723.6300.

3 3

stunnel and NNTP on windows - best practices
by Sir Thanksalot 08 Apr '05

08 Apr '05

Hi all, I am trying to use stunnel for SSL access to a NNTP newserver and found quite a few pages that list ways of doing that. I personally am using xnews as my newsreader, and I have seen variations of the same instructions with different software (Agent, Free Agent for newsreaders, Pegasus Mail as your mail application etc.). For completeness sake, here are some of the ones that I've found - http://www.cotse.net/users/putty/ssl (for Xnews and stunnel 4.x) http://www.geocities.com/d4vidb/x_setup13.html (for Xnews and stunnel 3.x - doesn't use the stunnel.conf file necessary in stunnel 4.x) http://www.noderunner.net/~llin/old/nntp-ssl.html (for a newsreader and stunnel 3.x. It also has links to a stunnel.conf file for stunnel 4.x users) In all these instructions (whether using the stunnel 3.x commandline options or using the stunnel.conf file for stunnel 4.x), I haven't seen any instructions about creating any certificates or public/private keys or a passphrase. Also there doesn't seem to be any writeup on what algorithm actually ends up getting used or even a way to pick which algorithm to use. What's the best practise for users? Should they do anything extra? Set up key pairs? Choose a default algorithm? Thanks. -- _______________________________________________ NEW! Lycos Dating Search. The only place to search multiple dating sites at once. http://datingsearch.lycos.com

1 0

TIMEOUTclose
by Joe Abbey 08 Apr '05

08 Apr '05

Background: I have been having issues getting Entourage to connect with my mail server over POP3S. Entourage will connect, communicate, and then hangs for 60 seconds. According to tcpdumps, Entourage appears to hang until a timeout. Connecting directly to the pop3 daemon, bypassing stunnel, there is no lag. Therefore something appears to be wrond with the stunnel/Entourage interaction. To get Entourage to work with POP3S and have virtually no lag, I've set in my stunnel.conf TIMEOUTclose = 2 for [pop3s]. Question: Is there any reason not to set TIMEOUTclose = 0? Thanks! Joe

1 0

Pass IP Attn: Alexander Lazic
by tbrown2376＠adelphia.net 08 Apr '05

08 Apr '05

ATTN: Alexander Lazic Can you please send me the patch for: patch for HTTP => X-Forwarded-For Header to: tbrown2376(a)adelphia.net Thanks. On Die 29.03.2005 11:00, Tim Brown wrote: >I am running Stunnel version 4.07 on a Windows 2000 server. Is there >any way to pass the originating IP through Stunnel to my server >application? As it is now Stunnel is passing the server IP for all >requests. I have send a patch for HTTP => X-Forwarded-For Header to the list. al ;-)

1 0

Compilation error on windows, cannot find "-lssl"
by Billinger Olle 07 Apr '05

07 Apr '05

Hi I'm trying to compile stunnel 4.08 on windows using mingw, with openssl-0.9.7f. I have edited the Makefile.w32 and it compiles ok until it cannot find the "-lssl". Any suggestions are welcome. //Olle ************************************** $ make -f Makefile.w32 stunnel.exe gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o stunnel.o stunnel.c gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o ssl.o ssl.c gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o client.o client.c gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o protocol.o protocol.c gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o sthreads.o sthreads.c gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o log.o log.c gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o options.o options.c gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o network.o network.c gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o resolver.o resolver.c gcc -g -O2 -Wall -DUSE_WIN32 -DHAVE_OPENSSL -I/c/openssl/include -c -o gui.o gui.c gcc -s -o stunnel.exe stunnel.o ssl.o client.o protocol.o sthreads.o log.o options.o network.o resolver.o gui.o resources.o -L/c/openssl/bin -lwsock32 -lgdi32 -lssl -mwindows c:\mingw\bin\..\lib\gcc-lib\mingw32\3.2.3\..\..\..\..\mingw32\bin\ld.exe: cannot find -lssl make: *** [stunnel.exe] Error 1 My Makefile.w32 ******************* SSLDIR=/c/openssl DEFINES=-DUSE_WIN32 -DHAVE_OPENSSL CFLAGS=-g -O2 -Wall $(DEFINES) -I$(SSLDIR)/include LDFLAGS=-s # LIBS=-L$(SSLDIR)/out -lssl -lcrypto -lwsock32 -lgdi32 LIBS=-L$(SSLDIR)/bin -lwsock32 -lgdi32 -lssl OBJS=stunnel.o ssl.o client.o protocol.o sthreads.o log.o options.o network.o resolver.o gui.o resources.o stunnel.exe: $(OBJS) $(CC) $(LDFLAGS) -o stunnel.exe $(OBJS) $(LIBS) -mwindows clean: rm *.o rm stunnel.exe #resources.o: resources.rc resources.h # windres resource.rc resources.o $(OBJS): *.h Makefile.w32 *********************

1 0

Stunnel.conf reload
by CIM Massy 05 Apr '05

05 Apr '05

Hi, is there a way, under win32, to have stunnel reload its .conf file and certificates without restarting the service ? (A kind of SIGHUP) Thanks, Phil

1 0

Stunnel and CRLs
by CIM Massy 05 Apr '05

05 Apr '05

Hi, is there a way to automagically mutually verify certificates (verify=3) and to check the certificates against a .crl file hosted on a web server ? I want my "VNC over Stunnel" host check if the incoming connexions are authorized or if the certificates have expired / been revoked. Thanks, Phil

1 0

stunnel 4.09 problem: Connection rejected: too many clients
by Steven Van Acker 04 Apr '05

04 Apr '05

Hi, after upgrading to stunnel 4.09, we are having 2 problems with it that did not exist in a previous version (our case: stunnel 4.05 without pthreads) ---[ My testsetup is as follows: * stunnel listening on port 4321, connects to localhost port 13 (daytime) * daytime is enabled in inetd * stunnel was compiled without pthreads * ulimit -u = 8192 ---[ problem 1 At first, it works fine. For every incoming connection, the process forks and data is transferred. However, when the connection is closed, the forked process remains hanging for a while (about 1 minute) and then exits. This in itself is not a real problem, except that it generates a lot of processes. (and maybe causes problem 2 ?) ---[ data and logs concerning problem 1 (process hangs for 1 minute): I run the following command: openssl s_client -connect 192.168.2.119:4321 the output follows immediately The logfile (debug = debug) looks like this: 2005.03.31 14:05:05 LOG7[4552:0]: daytime accepted FD=8 from 192.168.2.103:47200 2005.03.31 14:05:05 LOG7[4552:0]: FD 8 in non-blocking mode 2005.03.31 14:05:05 LOG7[4553:0]: daytime started 2005.03.31 14:05:05 LOG5[4553:0]: daytime connected from 192.168.2.103:47200 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): before/accept initialization 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 read client hello A 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 write server hello A 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 write certificate A 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 write server done A 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 flush data 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 read client key exchange A 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 read finished A 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 write change cipher spec A 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 write finished A 2005.03.31 14:05:05 LOG7[4553:0]: SSL state (accept): SSLv3 flush data 2005.03.31 14:05:05 LOG7[4553:0]: 1 items in the session cache 2005.03.31 14:05:05 LOG7[4553:0]: 0 client connects (SSL_connect()) 2005.03.31 14:05:05 LOG7[4553:0]: 0 client connects that finished 2005.03.31 14:05:05 LOG7[4553:0]: 0 client renegotiatations requested 2005.03.31 14:05:05 LOG7[4553:0]: 1 server connects (SSL_accept()) 2005.03.31 14:05:05 LOG7[4553:0]: 1 server connects that finished 2005.03.31 14:05:05 LOG7[4553:0]: 0 server renegotiatiations requested 2005.03.31 14:05:05 LOG7[4553:0]: 0 session cache hits 2005.03.31 14:05:05 LOG7[4553:0]: 0 session cache misses 2005.03.31 14:05:05 LOG7[4553:0]: 0 session cache timeouts 2005.03.31 14:05:05 LOG6[4553:0]: SSL accepted: new session negotiated 2005.03.31 14:05:05 LOG6[4553:0]: Negotiated ciphers: RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 2005.03.31 14:05:05 LOG7[4553:0]: FD 7 in non-blocking mode 2005.03.31 14:05:05 LOG7[4553:0]: daytime connecting 127.0.0.1:13 2005.03.31 14:05:05 LOG7[4553:0]: connect_wait: waiting 10 seconds 2005.03.31 14:05:05 LOG7[4553:0]: connect_wait: connected 2005.03.31 14:05:05 LOG7[4553:0]: Remote FD=7 initialized 2005.03.31 14:05:05 LOG7[4553:0]: Socket closed on read 2005.03.31 14:05:05 LOG7[4553:0]: SSL write shutdown 2005.03.31 14:05:05 LOG7[4553:0]: SSL alert (write): warning: close notify 2005.03.31 14:05:05 LOG7[4553:0]: SSL_shutdown retrying 2005.03.31 14:05:06 LOG7[4553:0]: SSL alert (read): warning: close notify 2005.03.31 14:05:06 LOG7[4553:0]: SSL closed on SSL_read 2005.03.31 14:05:06 LOG7[4553:0]: Socket write shutdown When I check netstat, the connection from the client to stunnel is in the CLOSE_WAIT state and the connection from stunnel to the daytime server is in TIME_WAIT state then 1 minute later, this follows: 2005.03.31 14:06:06 LOG6[4553:0]: s_poll_wait timeout: connection close 2005.03.31 14:06:06 LOG5[4553:0]: Connection closed: 26 bytes sent to SSL, 0 bytes sent to socket 2005.03.31 14:06:06 LOG7[4553:0]: removing pid file /stunnel.pid 2005.03.31 14:06:06 LOG7[4552:0]: Steven: going into client_status with num_clients = 1 2005.03.31 14:06:06 LOG7[4552:0]: Process 4553 finished with code 0 (0 left) Now, netstat no longer shows the connections in any state. ---[ problem 2 Another problem that was found is that after bombarding stunnel with lots of connections, it stops accepting new connections. This would be normal if all connections remained open, but they are all closed. This is the error: Mar 31 13:53:40 hostname stunnel[13044]: Connection rejected: too many clients (>=4000) netstat only shows +- 500 connections, of which none are aimed at the stunnel process in question (port 4321 in my test setup) there is only 1 stunnel process active aswell. I dug into the problem a bit and it probably has to do with num_clients not being decreased after a process is closed (although I can not find any specifics :/) greets, -- Steven

3 4

Terminal services and stunnel 4.09
by Mattias Olsson 01 Apr '05

01 Apr '05

Hi! Im tying to access an internal Win2003 terminal server from my Linux box (internet). As i understand it stunnel should do the work. I have read some documents but im not sure... This is my setup. Linuxbox ----> Linuxbox ssh server | Firewall | Terminal server i wish to access. Can this be done or do i have to open a port in the fw to access the TS directly? Should stunnel.conf look like this on my linuxbox (client) cert = /usr/local/etc/stunnel/mail.pem client = yes On the TS? [TS] accept = 3000 connect = 3389 Should it have cert = ? Or could i on my linux ssh server have a config looking like this: [TS-remote] accept = 3000 connect = <internal-ip>:3389 Should it have cert = ? A novice man sends his best regards and thanks! /Kaz -- Mvh / Regards Mattias Olsson - aka - KaZaMaNIaC

1 0

Does stunnel work on Windows 2000 & SIMP(Secure Instant Messaging) ??
by DK 01 Apr '05

01 Apr '05

Hi Group, I have a windows 2000 box & want to communicate securely with someone else via SIMP(Secure Instant Messaging Protocol - http://www.winfosec.com/simp.php) I know that SIMP Instant Messaging is a "Direct Connection" & does NOT go through an intermediary server & that its encrypted, but being the security nut I am, I want to know if "stunnel" handles the SIMP protocols ? ... as I can't find anywhere what the SIMP protocols are ... because as I have read in the stunnel FAQ, stunnel does not handle UDP. Regards, David __________________________________ Do you Yahoo!? Yahoo! Personals - Better first dates. More second dates. http://personals.yahoo.com

1 0

Pass IP
by Tim Brown 31 Mar '05

31 Mar '05

I am running Stunnel version 4.07 on a Windows 2000 server. Is there any way to pass the originating IP through Stunnel to my server application? As it is now Stunnel is passing the server IP for all requests. Thanks. Confidentiality Notice: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review or distribution by others is strictly prohibited. If you are not the intended recipient, be advised that any unauthorized disclosure, copying, distribution, or the taking of any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error, please immediately delete this message and attachments (including all copies) and notify the sender by return e-mail or by phone at 904.723.6300.

2 1

help
by Maddalena.Pulcini＠seleniacomms.com 31 Mar '05

31 Mar '05

Hi Mike, Thank you for your precious help. I am using stunnel as SSL client. The SSL server runs in a router. As you suggested me, I have done these changes: at first I have modified the stunnel.conf with options = SSL_OP_TLS_BLOCK_PADDING_BUG stunnel.conf ============================== client = yes debug=7 options = SSL_OP_TLS_BLOCK_PADDING_BUG [telnet] accept = 23 connect = 10.36.3.144:4433 ============================= but I have got this error ======================================= file stunnel.conf line 5: Illegal SSL option 2005.03.31 13:26:48 LOG3[3396:3716]: Server is down ======================================= After I have changed the stunnel.conf in this way: stunnel.conf ============================== client = yes debug=7 ciphers = RC4-MD5 [telnet] accept = 23 connect = 10.36.3.144:4433 ============================== The problem I had is now solved. But my question is: how can I know more about this protocol incompatibility? Is there an accurate documentation about that and also about stunnel configuration? Sorry but sometimes it's difficult for me to find (in the FAQ or other sessions) the informations that I need. Thanks&Regards Maddalena

2 1

Terminal services and stunnel 4.09
by Mattias Olsson 31 Mar '05

31 Mar '05

Hi! Im tying to access an internal Win2003 terminal server from my Linux box (internet). As i understand it stunnel should do the work. I have read some documents but im not sure... This is my setup. Linuxbox ----> Linuxbox ssh server | Firewall | Terminal server i wish to access. Can this be done or do i have to open a port in the fw to access the TS directly? Should stunnel.conf look like this on my linuxbox (client) cert = /usr/local/etc/stunnel/mail.pem client = yes On the TS? [TS] accept = 3000 connect = 3389 Should it have cert = ? Or could i on my linux ssh server have a config looking like this: [TS-remote] accept = 3000 connect = <internal-ip>:3389 Should it have cert = ? A novice man sends his best regards and thanks! /Kaz

1 0

Re: [stunnel-users] Libssl32.dll and Libeay32.dll Patents
by Brian Hatch 30 Mar '05

30 Mar '05

> I live in Maryland, United States. Can somebody please tell me if there > is a patent or some kind of legal restriction on the Libssl32.dll and > Libeay32.dll files available in the > http://www.stunnel.org/download/stunnel/win32/ directory? I would > really like to avoid compiling OpenSSL manually...gave it a shot this > evening and it bombed. I need to use Stunnel for strictly internal > purposes and not for any profit. The IDEA algorithm is patented, but I don't think Mike included that in his builds. You can configure Stunnel to only use specific ciphers, in which case you wouldn't be using it regardless. Does that make it legal? Consult a lawyer. Software patents suck. I'd download the openssl.exe and the libs and run 'openssl.exe ciphers -v' and see exactly which ciphers it includes and avoid any from which your legal team suggess you run away. -- Brian Hatch If we aren't supposed Systems and to eat animals, why Security Engineer are they made of meat? http://www.ifokr.org/bri/ Every message PGP signed

1 0

Stunnel 4.09 released
by Michal Trojnara 26 Mar '05

26 Mar '05

New stunnel 4.09 can be found on my FTP site: ftp://stunnel.mirt.net/stunnel/ Here is the ChangeLog entry: * DLLs for OpenSSL 0.9.7f. * Bugfixes - Compilation problem with undeclarated socklen_t fixed. - TIMEOUTclose is not used when there is any data in the buffers. - Stunnel no longer relies on close_notify with SSL 2.0 connections, since SSL 2.0 protocol does not have any alerts defined. - Closing SSL socket when there is some data in SSL output buffer is detected and reported as an error. - Install/chmod race condition when installing default certificate fixed. - Stunnel no longer installs signal_handler on ignored signals. Best regards, Mike

1 0

help
by Maddalena.Pulcini＠seleniacomms.com 25 Mar '05

25 Mar '05

Hi, I downloaded libeay32.dll and linssl32.dll. I started stunnel (4.07) and I did telnet to my router; after handshake I had the same problem. Client Debug ================ 2005.03.24 15:03:28 LOG5[3392:3104]: stunnel 4.07 on x86-pc-mingw32-gnu WIN32+IPv6 with OpenSSL 0.9.7f 22 Mar 2005 2005.03.24 15:03:28 LOG7[3392:2524]: Snagged 64 random bytes from C:/.rnd 2005.03.24 15:03:28 LOG7[3392:2524]: Wrote 1024 new random bytes to C:/.rnd 2005.03.24 15:03:28 LOG7[3392:2524]: RAND_status claims sufficient entropy for the PRNG 2005.03.24 15:03:28 LOG6[3392:2524]: PRNG seeded successfully 2005.03.24 15:03:28 LOG7[3392:2524]: Certificate: clcert.pem 2005.03.24 15:03:28 LOG7[3392:2524]: Key file: clcert.pem 2005.03.24 15:03:28 LOG5[3392:2524]: No limit detected for the number of clients 2005.03.24 15:03:28 LOG7[3392:2524]: FD 144 in non-blocking mode 2005.03.24 15:03:28 LOG7[3392:2524]: SO_REUSEADDR option set on accept socket 2005.03.24 15:03:28 LOG7[3392:2524]: telnet bound to 0.0.0.0:23 2005.03.24 15:03:39 LOG7[3392:2524]: telnet accepted FD=148 from 127.0.0.1:2133 2005.03.24 15:03:39 LOG7[3392:2524]: FD 148 in non-blocking mode 2005.03.24 15:03:39 LOG7[3392:2524]: Creating a new thread 2005.03.24 15:03:39 LOG7[3392:2524]: New thread created 2005.03.24 15:03:39 LOG7[3392:2556]: telnet started 2005.03.24 15:03:39 LOG5[3392:2556]: telnet connected from 127.0.0.1:2133 2005.03.24 15:03:39 LOG7[3392:2556]: FD 224 in non-blocking mode 2005.03.24 15:03:39 LOG7[3392:2556]: telnet connecting 10.36.3.144:4433 2005.03.24 15:03:39 LOG7[3392:2556]: connect_wait: waiting 10 seconds 2005.03.24 15:03:39 LOG7[3392:2556]: connect_wait: connected 2005.03.24 15:03:39 LOG7[3392:2556]: Remote FD=224 initialized 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): before/connect initialization 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 write client hello A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 read server hello A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 read server certificate A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 read server certificate request A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 read server done A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 write client certificate A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 write client key exchange A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 write certificate verify A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 write change cipher spec A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 write finished A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 flush data 2005.03.24 15:04:11 LOG7[3392:2556]: SSL state (connect): SSLv3 read finished A 2005.03.24 15:04:11 LOG7[3392:2556]: 1 items in the session cache 2005.03.24 15:04:11 LOG7[3392:2556]: 1 client connects (SSL_connect()) 2005.03.24 15:04:11 LOG7[3392:2556]: 1 client connects that finished 2005.03.24 15:04:11 LOG7[3392:2556]: 0 client renegotiatations requested 2005.03.24 15:04:11 LOG7[3392:2556]: 0 server connects (SSL_accept()) 2005.03.24 15:04:11 LOG7[3392:2556]: 0 server connects that finished 2005.03.24 15:04:11 LOG7[3392:2556]: 0 server renegotiatiations requested 2005.03.24 15:04:11 LOG7[3392:2556]: 0 session cache hits 2005.03.24 15:04:11 LOG7[3392:2556]: 0 session cache misses 2005.03.24 15:04:11 LOG7[3392:2556]: 0 session cache timeouts 2005.03.24 15:04:11 LOG6[3392:2556]: SSL connected: new session negotiated 2005.03.24 15:04:11 LOG6[3392:2556]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.03.24 15:04:27 LOG7[3392:2556]: SSL alert (write): fatal: bad record mac 2005.03.24 15:04:27 LOG3[3392:2556]: SSL_read: 1408F455: error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2005.03.24 15:04:27 LOG5[3392:2556]: Connection reset: 17 bytes sent to SSL, 191 bytes sent to socket 2005.03.24 15:04:27 LOG7[3392:2556]: telnet finished (0 left) =============================================================================== How can I procede? Thanks&Regards Maddalena

2 1

error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number
by Theodore W. Hildebrandt 24 Mar '05

24 Mar '05

I was running stunnel-4.08 under Windows XP-Home, using MS IEX as browser and Netscape 4.6 for e-mail. My ISP is AT&T Worldnet and I am accessing it via DSL and home wireless NW. Here is stunnel.conf: client = yes [pop3] accept = 110 connect = ipostoffice.att.net:995 [smtp] accept = 25 connect = imailhost.att.net:465 As instructed by AT&T, the e-mail servers have been specified as "localhost", both POP-3 and SMTP. The problem is that while I can download messages, I am unable to send e-mail because the "peer disconnects", and the log file carries the following messages: 2005.03.24 10:18:00 LOG5[2960:232]: smtp connected from 127.0.0.1:2194 2005.03.24 10:18:00 LOG5[2960:2428]: smtp connected from 127.0.0.1:2197 2005.03.24 10:18:01 LOG3[2960:232]: SSL_connect: Peer suddenly disconnected 2005.03.24 10:18:01 LOG3[2960:2428]: SSL_connect: Peer suddenly disconnected 2005.03.24 10:18:09 LOG3[2960:2084]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2005.03.24 10:18:09 LOG3[2960:3384]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number I have been able to run "openssl version" with the result: "OpenSSL 0.9.7e 25 Oct 2004" but I am unable to obtain the other outputs specified under the instructions for the "Stunnel-Users Mailing List". I have tried replacing libssl32.dll and libay32.dll with versions more recently downloaded (but with the same origination dates) and no improvement. So I am sending this message from another system running Win98 and stunnel-4.05, also using Netscape 4.6, which seems to work o.k. Please tell me how to get the right version number to work with stunnel-4.08, and WinXP. Additionally, it would be nice to know how to obtain the outputs suggested in the instructions for Stunnel-Users Mailing List.

1 0

help
by Maddalena.Pulcini＠seleniacomms.com 24 Mar '05

24 Mar '05

Hi, I downloaded libeay32.dll and linssl32.dll (ftp://stunnel.mirt.net/openssl/binary-0.9.7f-zlib/) . I started stunnel (4.07) and I did telnet to my router; after handshake I had the same problem. Client Debug ================ 2005.03.24 15:03:28 LOG5[3392:3104]: stunnel 4.07 on x86-pc-mingw32-gnu WIN32+IPv6 with OpenSSL 0.9.7f 22 Mar 2005 2005.03.24 15:03:28 LOG7[3392:2524]: Snagged 64 random bytes from C:/.rnd 2005.03.24 15:03:28 LOG7[3392:2524]: Wrote 1024 new random bytes to C:/.rnd 2005.03.24 15:03:28 LOG7[3392:2524]: RAND_status claims sufficient entropy for the PRNG 2005.03.24 15:03:28 LOG6[3392:2524]: PRNG seeded successfully 2005.03.24 15:03:28 LOG7[3392:2524]: Certificate: clcert.pem 2005.03.24 15:03:28 LOG7[3392:2524]: Key file: clcert.pem 2005.03.24 15:03:28 LOG5[3392:2524]: No limit detected for the number of clients 2005.03.24 15:03:28 LOG7[3392:2524]: FD 144 in non-blocking mode 2005.03.24 15:03:28 LOG7[3392:2524]: SO_REUSEADDR option set on accept socket 2005.03.24 15:03:28 LOG7[3392:2524]: telnet bound to 0.0.0.0:23 2005.03.24 15:03:39 LOG7[3392:2524]: telnet accepted FD=148 from 127.0.0.1:2133 2005.03.24 15:03:39 LOG7[3392:2524]: FD 148 in non-blocking mode 2005.03.24 15:03:39 LOG7[3392:2524]: Creating a new thread 2005.03.24 15:03:39 LOG7[3392:2524]: New thread created 2005.03.24 15:03:39 LOG7[3392:2556]: telnet started 2005.03.24 15:03:39 LOG5[3392:2556]: telnet connected from 127.0.0.1:2133 2005.03.24 15:03:39 LOG7[3392:2556]: FD 224 in non-blocking mode 2005.03.24 15:03:39 LOG7[3392:2556]: telnet connecting 10.36.3.144:4433 2005.03.24 15:03:39 LOG7[3392:2556]: connect_wait: waiting 10 seconds 2005.03.24 15:03:39 LOG7[3392:2556]: connect_wait: connected 2005.03.24 15:03:39 LOG7[3392:2556]: Remote FD=224 initialized 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): before/connect initialization 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 write client hello A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 read server hello A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 read server certificate A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 read server certificate request A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 read server done A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 write client certificate A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 write client key exchange A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 write certificate verify A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 write change cipher spec A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 write finished A 2005.03.24 15:03:39 LOG7[3392:2556]: SSL state (connect): SSLv3 flush data 2005.03.24 15:04:11 LOG7[3392:2556]: SSL state (connect): SSLv3 read finished A 2005.03.24 15:04:11 LOG7[3392:2556]: 1 items in the session cache 2005.03.24 15:04:11 LOG7[3392:2556]: 1 client connects (SSL_connect()) 2005.03.24 15:04:11 LOG7[3392:2556]: 1 client connects that finished 2005.03.24 15:04:11 LOG7[3392:2556]: 0 client renegotiatations requested 2005.03.24 15:04:11 LOG7[3392:2556]: 0 server connects (SSL_accept()) 2005.03.24 15:04:11 LOG7[3392:2556]: 0 server connects that finished 2005.03.24 15:04:11 LOG7[3392:2556]: 0 server renegotiatiations requested 2005.03.24 15:04:11 LOG7[3392:2556]: 0 session cache hits 2005.03.24 15:04:11 LOG7[3392:2556]: 0 session cache misses 2005.03.24 15:04:11 LOG7[3392:2556]: 0 session cache timeouts 2005.03.24 15:04:11 LOG6[3392:2556]: SSL connected: new session negotiated 2005.03.24 15:04:11 LOG6[3392:2556]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.03.24 15:04:27 LOG7[3392:2556]: SSL alert (write): fatal: bad record mac 2005.03.24 15:04:27 LOG3[3392:2556]: SSL_read: 1408F455: error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2005.03.24 15:04:27 LOG5[3392:2556]: Connection reset: 17 bytes sent to SSL, 191 bytes sent to socket 2005.03.24 15:04:27 LOG7[3392:2556]: telnet finished (0 left) =============================================================================== How can I procede? Thanks&Regards Maddalena

2 1

Proxy support with stunnel
by Andrei Emeltchenko 24 Mar '05

24 Mar '05

Hi! I am new to stunnel and just wanted to check is there possibility to use proxy? Assume I want to connect to secure news with NNTPS. I need something like ProxyCommand in ssh. Regards, Andrei

1 0

help
by Maddalena.Pulcini＠seleniacomms.com 24 Mar '05

24 Mar '05

Hi, someone could help me? I am using stunnel (4.07) as ssl client to do telnet to my router with ssl server (openssl 0.9.7d). After protocol handshake I get this error: SSL_read: 1408F455: error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac problem Stunnel is configured in this way: ========================== client = yes debug=7 cert=clcert.pem [telnet] accept = 23 connect = 10.36.3.144:4433 ========================== My router's configuration is: ========================== -Verify 4 -cert cert.pem ========================== The exchange of packets: ========================== client sends=======> Client Hello server sends======> Server Hello,Certificate, Certificate Request,Server Hello Done client sends======> Certificate, Client Key Exchange, Certificate Verify, Change Cipher Spec, Encrypted Handshake Message server sends=====> Change Cipher Spec, Encrypted Handshake Message and then Application Data. After sending a number of Application Data by the server, client sends Encrypted Alert and closes the connection. Having debug on stunnel client I can see: >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> 2005.03.15 11:13:44 LOG5[2040:3964]: stunnel 4.07 on x86-pc-mingw32-gnu WIN32+IPv6 with OpenSSL 0.9.8-dev XX xxx XXXX 2005.03.15 11:13:44 LOG7[2040:2376]: Snagged 64 random bytes from C:/.rnd 2005.03.15 11:13:44 LOG7[2040:2376]: Wrote 1024 new random bytes to C:/.rnd 2005.03.15 11:13:44 LOG7[2040:2376]: RAND_status claims sufficient entropy for the PRNG 2005.03.15 11:13:44 LOG6[2040:2376]: PRNG seeded successfully 2005.03.15 11:13:44 LOG7[2040:2376]: Certificate: clcert.pem 2005.03.15 11:13:44 LOG7[2040:2376]: Key file: clcert.pem 2005.03.15 11:13:44 LOG5[2040:2376]: No limit detected for the number of clients 2005.03.15 11:13:44 LOG7[2040:2376]: FD 188 in non-blocking mode 2005.03.15 11:13:44 LOG7[2040:2376]: SO_REUSEADDR option set on accept socket 2005.03.15 11:13:44 LOG7[2040:2376]: telnet bound to 0.0.0.0:23 2005.03.15 11:13:54 LOG7[2040:2376]: telnet accepted FD=192 from 127.0.0.1:1589 2005.03.15 11:13:54 LOG7[2040:2376]: FD 192 in non-blocking mode 2005.03.15 11:13:54 LOG7[2040:2376]: Creating a new thread 2005.03.15 11:13:54 LOG7[2040:2376]: New thread created 2005.03.15 11:13:54 LOG7[2040:3588]: telnet started 2005.03.15 11:13:54 LOG5[2040:3588]: telnet connected from 127.0.0.1:1589 2005.03.15 11:13:54 LOG7[2040:3588]: FD 224 in non-blocking mode 2005.03.15 11:13:54 LOG7[2040:3588]: telnet connecting 10.36.3.144:4433 2005.03.15 11:13:54 LOG7[2040:3588]: connect_wait: waiting 10 seconds 2005.03.15 11:13:54 LOG7[2040:3588]: connect_wait: connected 2005.03.15 11:13:54 LOG7[2040:3588]: Remote FD=224 initialized 2005.03.15 11:13:54 LOG7[2040:3588]: SSL state (connect): before/connect initialization 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write client hello A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server hello A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server certificate A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server certificate request A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server done A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write client certificate A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write client key exchange A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write certificate verify A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write change cipher spec A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write finished A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 flush data 2005.03.15 11:14:26 LOG7[2040:3588]: SSL state (connect): SSLv3 read finished A 2005.03.15 11:14:26 LOG7[2040:3588]: 1 items in the session cache 2005.03.15 11:14:26 LOG7[2040:3588]: 1 client connects (SSL_connect()) 2005.03.15 11:14:26 LOG7[2040:3588]: 1 client connects that finished 2005.03.15 11:14:26 LOG7[2040:3588]: 0 client renegotiatations requested 2005.03.15 11:14:26 LOG7[2040:3588]: 0 server connects (SSL_accept()) 2005.03.15 11:14:26 LOG7[2040:3588]: 0 server connects that finished 2005.03.15 11:14:26 LOG7[2040:3588]: 0 server renegotiatiations requested 2005.03.15 11:14:26 LOG7[2040:3588]: 0 session cache hits 2005.03.15 11:14:26 LOG7[2040:3588]: 0 session cache misses 2005.03.15 11:14:26 LOG7[2040:3588]: 0 session cache timeouts 2005.03.15 11:14:26 LOG6[2040:3588]: SSL connected: new session negotiated 2005.03.15 11:14:26 LOG6[2040:3588]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.03.15 11:14:41 LOG7[2040:3588]: SSL alert (write): fatal: bad record mac 2005.03.15 11:14:41 LOG3[2040:3588]: SSL_read: 1408F455: error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2005.03.15 11:14:41 LOG5[2040:3588]: Connection reset: 17 bytes sent to SSL, 190 bytes sent to socket 2005.03.15 11:14:41 LOG7[2040:3588]: telnet finished (0 left) >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> This client is now running using an updated library: libeay32.dll obtained compiling openssl-SNAP-20050304 that seemed to be the solution of the problem (after searching on Internet I deduce that). Not having solution to the problem, I know that my conclusion is not right. This morning I tryed with new library available in your home page (New compiled Windows DLL libraries for 0.9.7d) but I get the same error. So if someone knows how to procede, please help me. Thanks&Regards Maddalena Pulcini

3 2

Problems using STunnel with a non-default port - Please Help
by Chetan Rao 22 Mar '05

22 Mar '05

I have a personal webserver running on Win2K Pro SP4 that listens on port 17875. This server is accessible through my NAT and software firewall (ZoneAlarm Pro). I then installed STunnel with the following conf: [https] accept=4430 connect=17875 TIMEOUTclose=0 Now, when I access https://<server>:4430, I get a HTTP 400 (Bad Request) error message, with both Internet Explorer 6 and FireFox 1.01. However, if I change the accept port from 4430 to 443 (and make the appropriate changes on the NAT for port forwarding), and use https://<server>, it works. I don't want to use the standard port. What am I doing wrong? Here's the log that STunnel generated: 2005.03.16 08:33:26 LOG5[1044:288]: stunnel 4.08 on x86-pc-mingw32-gnu WIN32+IPv4 with OpenSSL 0.9.7e 25 Oct 2004 2005.03.16 08:33:26 LOG7[1044:1096]: RAND_status claims sufficient entropy for the PRNG 2005.03.16 08:33:26 LOG6[1044:1096]: PRNG seeded successfully 2005.03.16 08:33:26 LOG7[1044:1096]: Certificate: stunnel.pem 2005.03.16 08:33:26 LOG7[1044:1096]: Key file: stunnel.pem 2005.03.16 08:33:26 LOG5[1044:1096]: No limit detected for the number of clients 2005.03.16 08:33:26 LOG7[1044:1096]: FD 168 in non-blocking mode 2005.03.16 08:33:26 LOG7[1044:1096]: SO_REUSEADDR option set on accept socket 2005.03.16 08:33:26 LOG7[1044:1096]: https bound to 0.0.0.0:4430 2005.03.16 08:34:08 LOG7[1044:1096]: https accepted FD=180 from 192.168.0.2:4864 2005.03.16 08:34:08 LOG7[1044:1096]: FD 180 in non-blocking mode 2005.03.16 08:34:08 LOG7[1044:1096]: Creating a new thread 2005.03.16 08:34:08 LOG7[1044:1096]: New thread created 2005.03.16 08:34:08 LOG7[1044:896]: https started 2005.03.16 08:34:08 LOG5[1044:896]: https connected from 192.168.0.2:4864 2005.03.16 08:34:08 LOG7[1044:896]: SSL state (accept): before/accept initialization 2005.03.16 08:34:08 LOG7[1044:896]: SSL state (accept): SSLv3 read client hello A 2005.03.16 08:34:08 LOG7[1044:896]: SSL state (accept): SSLv3 write server hello A 2005.03.16 08:34:08 LOG7[1044:896]: SSL state (accept): SSLv3 write certificate A 2005.03.16 08:34:08 LOG7[1044:896]: SSL state (accept): SSLv3 write server done A 2005.03.16 08:34:08 LOG7[1044:896]: SSL state (accept): SSLv3 flush data 2005.03.16 08:34:08 LOG7[1044:896]: SSL state (accept): SSLv3 read client key exchange A 2005.03.16 08:34:08 LOG7[1044:896]: SSL state (accept): SSLv3 read finished A 2005.03.16 08:34:08 LOG7[1044:896]: SSL state (accept): SSLv3 write change cipher spec A 2005.03.16 08:34:08 LOG7[1044:896]: SSL state (accept): SSLv3 write finished A 2005.03.16 08:34:08 LOG7[1044:896]: SSL state (accept): SSLv3 flush data 2005.03.16 08:34:08 LOG7[1044:896]: 1 items in the session cache 2005.03.16 08:34:08 LOG7[1044:896]: 0 client connects (SSL_connect()) 2005.03.16 08:34:08 LOG7[1044:896]: 0 client connects that finished 2005.03.16 08:34:08 LOG7[1044:896]: 0 client renegotiatations requested 2005.03.16 08:34:08 LOG7[1044:896]: 1 server connects (SSL_accept()) 2005.03.16 08:34:08 LOG7[1044:896]: 1 server connects that finished 2005.03.16 08:34:08 LOG7[1044:896]: 0 server renegotiatiations requested 2005.03.16 08:34:08 LOG7[1044:896]: 0 session cache hits 2005.03.16 08:34:08 LOG7[1044:896]: 1 session cache misses 2005.03.16 08:34:08 LOG7[1044:896]: 0 session cache timeouts 2005.03.16 08:34:08 LOG6[1044:896]: SSL accepted: new session negotiated 2005.03.16 08:34:08 LOG6[1044:896]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2005.03.16 08:34:08 LOG7[1044:896]: FD 200 in non-blocking mode 2005.03.16 08:34:08 LOG7[1044:896]: https connecting 127.0.0.1:17875 2005.03.16 08:34:08 LOG7[1044:896]: connect_wait: waiting 10 seconds 2005.03.16 08:34:08 LOG7[1044:896]: connect_wait: connected 2005.03.16 08:34:08 LOG7[1044:896]: Remote FD=200 initialized 2005.03.16 08:34:08 LOG7[1044:896]: Socket closed on read 2005.03.16 08:34:08 LOG7[1044:896]: SSL write shutdown 2005.03.16 08:34:08 LOG7[1044:896]: SSL alert (write): warning: close notify 2005.03.16 08:34:08 LOG7[1044:896]: SSL_shutdown retrying 2005.03.16 08:34:08 LOG7[1044:896]: s_poll_wait timeout waiting for SSL close_notify 2005.03.16 08:34:08 LOG5[1044:896]: Connection closed: 208 bytes sent to SSL, 389 bytes sent to socket 2005.03.16 08:34:08 LOG7[1044:896]: https finished (0 left) Any help much appreciated. Thanks.

2 6

Certificate chain not used for server?
by Ed Kapitein 21 Mar '05

21 Mar '05

Hi all, I have a working setup of stunnel listening on port 443 and connect to the server on the same host on port 80. It is done via xinetd. Alltough everything is working just fine, clients on webbrowsers get the "you have choosen not to trust this CA" error when connecting to this server. In apache the certificate chain (bundle.ca) is used and clients connecting to the apache server wont get this error. Is there a way to make stunnel behave like apache, so the clients don't have to manually install the CA certificates? (the certificate is a vallid certificate obtained from globaslsign.be) i do have the CAfile in my options file, but this does not help. All help is greatly appreciated! Kind regards, @

1 0

Cert errors ....... need help!
by Richard Houston 17 Mar '05

17 Mar '05

Hi all, I have take over a stunnel install and all the clients certs have expired. I have been trying for the past 2 days to get the new step up to work but no such luck. Here is the error I get on the sever side, Linux Fedora Core 3, Stunnel 4.05: 2005.03.17 11:36:15 LOG7[12746:3086949296]: school4 started 2005.03.17 11:36:15 LOG5[12746:3086949296]: school4 connected from XXX.XXX.XXX.XX:1414 2005.03.17 11:36:15 LOG7[12746:3086949296]: SSL state (accept): before/accept initialization 2005.03.17 11:36:15 LOG7[12746:3086949296]: waitforsocket: FD=7, DIR=read 2005.03.17 11:36:15 LOG7[12746:3086949296]: waitforsocket: ok 2005.03.17 11:36:15 LOG7[12746:3086949296]: SSL state (accept): SSLv3 read client hello A 2005.03.17 11:36:15 LOG7[12746:3086949296]: SSL state (accept): SSLv3 write server hello A 2005.03.17 11:36:15 LOG7[12746:3086949296]: SSL state (accept): SSLv3 write certificate A 2005.03.17 11:36:15 LOG7[12746:3086949296]: SSL state (accept): SSLv3 write certificate request A 2005.03.17 11:36:15 LOG7[12746:3086949296]: SSL state (accept): SSLv3 flush data 2005.03.17 11:36:15 LOG7[12746:3086949296]: waitforsocket: FD=7, DIR=read 2005.03.17 11:36:18 LOG7[12746:3086949296]: waitforsocket: ok 2005.03.17 11:36:18 LOG7[12746:3086949296]: SSL alert (read): fatal: certificate unknown 2005.03.17 11:36:18 LOG3[12746:3086949296]: SSL_accept: 14094416: error:14094416:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate unknown 2005.03.17 11:36:18 LOG7[12746:3086949296]: school4 finished (0 left) And here is the output on the client side: 005.03.17 11:21:02 LOG5[952:1264]: stunnel 4.04 on x86-pc-mingw32-gnu WIN32 with OpenSSL 0.9.7 31 Dec2002 2005.03.17 11:21:03 LOG5[952:896]: Peer certificate location (null) 2005.03.17 11:21:03 LOG5[952:896]: WIN32 platform: 30000 clients allowed 2005.03.17 11:21:03 LOG5[952:1152]: schools connected from 127.0.0.1:1413 2005.03.17 11:21:07 LOG5[952:1152]: VERIFY OK: depth=1, /C=CA/ST=XXX/L=XXX/O=XXX/OU=XXX CACERT/CN=sd.traf.mb.ca/emailAddress=sysadmin@XXXX 2005.03.17 11:21:07 LOG4[952:1152]: VERIFY ERROR ONLY MY: no cert for /C=CA/ST=XXX/O=XXXX/OU=STUNNEL SERVER CERT/CN=XXXXX/emailAddress=sysadmin@XXXX 2005.03.17 11:21:07 LOG3[952:1152]: SSL_connect: 14090086: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed I have created the certs on both server and client according to the documents at http://www.stunnel.org/faq/openssl_stunnel_ServerClientAuth.txt. I have the cacert.pem file on the cleint side, I have c_hashed the cert file on the server side. Do I need to out the c_hash of the server side cert on the client as well? Is there something I have missed? Any ideas as to what I can check to see where the issue is? I am desperate, any help would be greatly appreciated. Regards, +------------------------------------------+ | Richard Houston .^. | | R.L.H. Consulting /V\ | | E-Mail <rhouston(a)rlhc.net> /( )\ | | WWW <www.rlhc.net> ^^-^^ | +------------------------------------------+

3 8

Cert errors ....... need help!
by Richard Houston 17 Mar '05

17 Mar '05

Hi all, I have take over a stunnel install and all the clients certs have expired. I have been trying for the past 2 days to get the new step up to work but no such luck. Here is the error I get on the sever side, Linux Fedora Core 3, Stunnel 4.05: 2005.03.17 11:36:15 LOG7[12746:3086949296]: school4 started 2005.03.17 11:36:15 LOG5[12746:3086949296]: school4 connected from XXX.XXX.XXX.XX:1414 2005.03.17 11:36:15 LOG7[12746:3086949296]: SSL state (accept): before/accept initialization 2005.03.17 11:36:15 LOG7[12746:3086949296]: waitforsocket: FD=7, DIR=read 2005.03.17 11:36:15 LOG7[12746:3086949296]: waitforsocket: ok 2005.03.17 11:36:15 LOG7[12746:3086949296]: SSL state (accept): SSLv3 read client hello A 2005.03.17 11:36:15 LOG7[12746:3086949296]: SSL state (accept): SSLv3 write server hello A 2005.03.17 11:36:15 LOG7[12746:3086949296]: SSL state (accept): SSLv3 write certificate A 2005.03.17 11:36:15 LOG7[12746:3086949296]: SSL state (accept): SSLv3 write certificate request A 2005.03.17 11:36:15 LOG7[12746:3086949296]: SSL state (accept): SSLv3 flush data 2005.03.17 11:36:15 LOG7[12746:3086949296]: waitforsocket: FD=7, DIR=read 2005.03.17 11:36:18 LOG7[12746:3086949296]: waitforsocket: ok 2005.03.17 11:36:18 LOG7[12746:3086949296]: SSL alert (read): fatal: certificate unknown 2005.03.17 11:36:18 LOG3[12746:3086949296]: SSL_accept: 14094416: error:14094416:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate unknown 2005.03.17 11:36:18 LOG7[12746:3086949296]: school4 finished (0 left) And here is the output on the client side: 005.03.17 11:21:02 LOG5[952:1264]: stunnel 4.04 on x86-pc-mingw32-gnu WIN32 with OpenSSL 0.9.7 31 Dec2002 2005.03.17 11:21:03 LOG5[952:896]: Peer certificate location (null) 2005.03.17 11:21:03 LOG5[952:896]: WIN32 platform: 30000 clients allowed 2005.03.17 11:21:03 LOG5[952:1152]: schools connected from 127.0.0.1:1413 2005.03.17 11:21:07 LOG5[952:1152]: VERIFY OK: depth=1, /C=CA/ST=XXX/L=XXX/O=XXX/OU=XXX CACERT/CN=sd.traf.mb.ca/emailAddress=sysadmin@XXXX 2005.03.17 11:21:07 LOG4[952:1152]: VERIFY ERROR ONLY MY: no cert for /C=CA/ST=XXX/O=XXXX/OU=STUNNEL SERVER CERT/CN=XXXXX/emailAddress=sysadmin@XXXX 2005.03.17 11:21:07 LOG3[952:1152]: SSL_connect: 14090086: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed I have created the certs on both server and client according to the documents at http://www.stunnel.org/faq/openssl_stunnel_ServerClientAuth.txt. I have the cacert.pem file on the cleint side, I have c_hashed the cert file on the server side. Do I need to out the c_hash of the server side cert on the client as well? Is there something I have missed? Any ideas as to what I can check to see where the issue is? I am desperate, any help would be greatly appreciated. Regards, +------------------------------------------+ | Richard Houston .^. | | R.L.H. Consulting /V\ | | E-Mail <rhouston(a)rlhc.net> /( )\ | | WWW <www.rlhc.net> ^^-^^ | +------------------------------------------+

1 0

Creating a man in middle attack for legit purposes.
by Todd Troutman 16 Mar '05

16 Mar '05

So I don't normally start off on a list by immediately asking a question but I've got a weird one here that's a critical thing tonight, plus, this might just be entertaining! Problem : MacOS Panther has horrible performance problems with large https web apps. So I setup Stunnel to take port 80 and run it through the web app on 443. Provides http from an https server. On a MacOS client machine I set /etc/hosts to say that system.netsuite.com, the web app, is 192.168.0.4, a handy FreeBSD 5.3 box running stunnel 4.05 It works. Sort of. Problems - the web app keeps rewriting the url from http to https, anytime I click on anything, hmmm.. so I can't make stunnel answer on 443 because then I'm back to square one. Also, I can't login, the web app is giving me a login page as http, but I get a session timeout,please login again, just repeats, unsure if something in the stunnel config should be done to fix that. Other than that, this is working. Config is currently this. client=yes accept=80 connect=system.netsuite.com:443 Anyway, so is this maybe one of the stranger uses of stunnel, possibly a wrong headed and broken way of using it, but oh well. There goes my plea for some ideas on this one, Thanks, Todd

1 0

SSL_read: 1408F455: error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac problem
by Maddalena.Pulcini＠seleniacomms.com 15 Mar '05

15 Mar '05

Hi, someone could help me? I am using stunnel (4.07) as ssl client to do telnet to my router with ssl server (openssl 0.9.7d). Stunnel is configured in this way: ========================== client = yes debug=7 cert=clcert.pem [telnet] accept = 23 connect = 10.36.3.144:4433 ========================== My router's configuration is: ========================== -Verify 4 -cert cert.pem ========================== The exchange of packets: ========================== client sends=======> Client Hello server sends======> Server Hello,Certificate, Certificate Request,Server Hello Done client sends======> Certificate, Client Key Exchange, Certificate Verify, Change Cipher Spec, Encrypted Handshake Message server sends=====> Change Cipher Spec, Encrypted Handshake Message and then Application Data. After sending a number of Application Data by the server, client sends Encrypted Alert and closes the connection. Having debug on stunnel client I can see: >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> 2005.03.15 11:13:44 LOG5[2040:3964]: stunnel 4.07 on x86-pc-mingw32-gnu WIN32+IPv6 with OpenSSL 0.9.8-dev XX xxx XXXX 2005.03.15 11:13:44 LOG7[2040:2376]: Snagged 64 random bytes from C:/.rnd 2005.03.15 11:13:44 LOG7[2040:2376]: Wrote 1024 new random bytes to C:/.rnd 2005.03.15 11:13:44 LOG7[2040:2376]: RAND_status claims sufficient entropy for the PRNG 2005.03.15 11:13:44 LOG6[2040:2376]: PRNG seeded successfully 2005.03.15 11:13:44 LOG7[2040:2376]: Certificate: clcert.pem 2005.03.15 11:13:44 LOG7[2040:2376]: Key file: clcert.pem 2005.03.15 11:13:44 LOG5[2040:2376]: No limit detected for the number of clients 2005.03.15 11:13:44 LOG7[2040:2376]: FD 188 in non-blocking mode 2005.03.15 11:13:44 LOG7[2040:2376]: SO_REUSEADDR option set on accept socket 2005.03.15 11:13:44 LOG7[2040:2376]: telnet bound to 0.0.0.0:23 2005.03.15 11:13:54 LOG7[2040:2376]: telnet accepted FD=192 from 127.0.0.1:1589 2005.03.15 11:13:54 LOG7[2040:2376]: FD 192 in non-blocking mode 2005.03.15 11:13:54 LOG7[2040:2376]: Creating a new thread 2005.03.15 11:13:54 LOG7[2040:2376]: New thread created 2005.03.15 11:13:54 LOG7[2040:3588]: telnet started 2005.03.15 11:13:54 LOG5[2040:3588]: telnet connected from 127.0.0.1:1589 2005.03.15 11:13:54 LOG7[2040:3588]: FD 224 in non-blocking mode 2005.03.15 11:13:54 LOG7[2040:3588]: telnet connecting 10.36.3.144:4433 2005.03.15 11:13:54 LOG7[2040:3588]: connect_wait: waiting 10 seconds 2005.03.15 11:13:54 LOG7[2040:3588]: connect_wait: connected 2005.03.15 11:13:54 LOG7[2040:3588]: Remote FD=224 initialized 2005.03.15 11:13:54 LOG7[2040:3588]: SSL state (connect): before/connect initialization 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write client hello A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server hello A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server certificate A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server certificate request A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server done A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write client certificate A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write client key exchange A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write certificate verify A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write change cipher spec A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write finished A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 flush data 2005.03.15 11:14:26 LOG7[2040:3588]: SSL state (connect): SSLv3 read finished A 2005.03.15 11:14:26 LOG7[2040:3588]: 1 items in the session cache 2005.03.15 11:14:26 LOG7[2040:3588]: 1 client connects (SSL_connect()) 2005.03.15 11:14:26 LOG7[2040:3588]: 1 client connects that finished 2005.03.15 11:14:26 LOG7[2040:3588]: 0 client renegotiatations requested 2005.03.15 11:14:26 LOG7[2040:3588]: 0 server connects (SSL_accept()) 2005.03.15 11:14:26 LOG7[2040:3588]: 0 server connects that finished 2005.03.15 11:14:26 LOG7[2040:3588]: 0 server renegotiatiations requested 2005.03.15 11:14:26 LOG7[2040:3588]: 0 session cache hits 2005.03.15 11:14:26 LOG7[2040:3588]: 0 session cache misses 2005.03.15 11:14:26 LOG7[2040:3588]: 0 session cache timeouts 2005.03.15 11:14:26 LOG6[2040:3588]: SSL connected: new session negotiated 2005.03.15 11:14:26 LOG6[2040:3588]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.03.15 11:14:41 LOG7[2040:3588]: SSL alert (write): fatal: bad record mac 2005.03.15 11:14:41 LOG3[2040:3588]: SSL_read: 1408F455: error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2005.03.15 11:14:41 LOG5[2040:3588]: Connection reset: 17 bytes sent to SSL, 190 bytes sent to socket 2005.03.15 11:14:41 LOG7[2040:3588]: telnet finished (0 left) >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> This client is now running using an updated library: libeay32.dll obtained compiling openssl-SNAP-20050304 that seemed to be the solution of the problem (after searching on Internet I deduce that). Not having solution to the problem, I know that my conclusion is not right. So if someone knows how to procede, please help me. Thanks&Regards Maddalena Pulcini

1 0

SSL_read: 1408F455: error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac problem
by Maddalena.Pulcini＠seleniacomms.com 15 Mar '05

15 Mar '05

Hi, someone could help me? I am using stunnel (4.07) as ssl client to do telnet to my router with ssl server (openssl 0.9.7d). Stunnel is configured in this way: ========================== client = yes debug=7 cert=clcert.pem [telnet] accept = 23 connect = 10.36.3.144:4433 ========================== My router's configuration is: ========================== -Verify 4 -cert cert.pem ========================== The exchange of packets: ========================== client sends=======> Client Hello server sends======> Server Hello,Certificate, Certificate Request,Server Hello Done client sends======> Certificate, Client Key Exchange, Certificate Verify, Change Cipher Spec, Encrypted Handshake Message server sends=====> Change Cipher Spec, Encrypted Handshake Message and then Application Data. After sending a number of Application Data by the server, client sends Encrypted Alert and closes the connection. Having debug on stunnel client I can see: >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> 2005.03.15 11:13:44 LOG5[2040:3964]: stunnel 4.07 on x86-pc-mingw32-gnu WIN32+IPv6 with OpenSSL 0.9.8-dev XX xxx XXXX 2005.03.15 11:13:44 LOG7[2040:2376]: Snagged 64 random bytes from C:/.rnd 2005.03.15 11:13:44 LOG7[2040:2376]: Wrote 1024 new random bytes to C:/.rnd 2005.03.15 11:13:44 LOG7[2040:2376]: RAND_status claims sufficient entropy for the PRNG 2005.03.15 11:13:44 LOG6[2040:2376]: PRNG seeded successfully 2005.03.15 11:13:44 LOG7[2040:2376]: Certificate: clcert.pem 2005.03.15 11:13:44 LOG7[2040:2376]: Key file: clcert.pem 2005.03.15 11:13:44 LOG5[2040:2376]: No limit detected for the number of clients 2005.03.15 11:13:44 LOG7[2040:2376]: FD 188 in non-blocking mode 2005.03.15 11:13:44 LOG7[2040:2376]: SO_REUSEADDR option set on accept socket 2005.03.15 11:13:44 LOG7[2040:2376]: telnet bound to 0.0.0.0:23 2005.03.15 11:13:54 LOG7[2040:2376]: telnet accepted FD=192 from 127.0.0.1:1589 2005.03.15 11:13:54 LOG7[2040:2376]: FD 192 in non-blocking mode 2005.03.15 11:13:54 LOG7[2040:2376]: Creating a new thread 2005.03.15 11:13:54 LOG7[2040:2376]: New thread created 2005.03.15 11:13:54 LOG7[2040:3588]: telnet started 2005.03.15 11:13:54 LOG5[2040:3588]: telnet connected from 127.0.0.1:1589 2005.03.15 11:13:54 LOG7[2040:3588]: FD 224 in non-blocking mode 2005.03.15 11:13:54 LOG7[2040:3588]: telnet connecting 10.36.3.144:4433 2005.03.15 11:13:54 LOG7[2040:3588]: connect_wait: waiting 10 seconds 2005.03.15 11:13:54 LOG7[2040:3588]: connect_wait: connected 2005.03.15 11:13:54 LOG7[2040:3588]: Remote FD=224 initialized 2005.03.15 11:13:54 LOG7[2040:3588]: SSL state (connect): before/connect initialization 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write client hello A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server hello A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server certificate A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server certificate request A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server done A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write client certificate A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write client key exchange A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write certificate verify A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write change cipher spec A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write finished A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 flush data 2005.03.15 11:14:26 LOG7[2040:3588]: SSL state (connect): SSLv3 read finished A 2005.03.15 11:14:26 LOG7[2040:3588]: 1 items in the session cache 2005.03.15 11:14:26 LOG7[2040:3588]: 1 client connects (SSL_connect()) 2005.03.15 11:14:26 LOG7[2040:3588]: 1 client connects that finished 2005.03.15 11:14:26 LOG7[2040:3588]: 0 client renegotiatations requested 2005.03.15 11:14:26 LOG7[2040:3588]: 0 server connects (SSL_accept()) 2005.03.15 11:14:26 LOG7[2040:3588]: 0 server connects that finished 2005.03.15 11:14:26 LOG7[2040:3588]: 0 server renegotiatiations requested 2005.03.15 11:14:26 LOG7[2040:3588]: 0 session cache hits 2005.03.15 11:14:26 LOG7[2040:3588]: 0 session cache misses 2005.03.15 11:14:26 LOG7[2040:3588]: 0 session cache timeouts 2005.03.15 11:14:26 LOG6[2040:3588]: SSL connected: new session negotiated 2005.03.15 11:14:26 LOG6[2040:3588]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.03.15 11:14:41 LOG7[2040:3588]: SSL alert (write): fatal: bad record mac 2005.03.15 11:14:41 LOG3[2040:3588]: SSL_read: 1408F455: error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2005.03.15 11:14:41 LOG5[2040:3588]: Connection reset: 17 bytes sent to SSL, 190 bytes sent to socket 2005.03.15 11:14:41 LOG7[2040:3588]: telnet finished (0 left) >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> This client is now running using an updated library: libeay32.dll obtained compiling openssl-SNAP-20050304 that seemed to be the solution of the problem (after searching on Internet I deduce that). Not having solution to the problem, I know that my conclusion is not right. So if someone knows how to procede, please help me. Thanks&Regards Maddalena Pulcini

1 0

Problem using Stunnell with Macromedia Communication Server MX
by Miguel Nisembaum 14 Mar '05

14 Mar '05

Hi My name is Miguel from Brazil I need to know if anyone has ever configured Stunnel with Macromedia Flash Communication Server. If anyone has can you tell me something about it I’m new to Stunnel so if anyone can please help me it would be great. Thanks Miguel -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.308 / Virus Database: 266.7.2 - Release Date: 11/3/2005

1 0

Radius over Stunnel??
by Frazer, Andrew non Unisys 08 Mar '05

08 Mar '05

Hello all.. I would like to pass radius over stunnel, but I'm not sure if this will work... I have a lot of 'client's that are using RADIUS for authentication, but i want to pass the data over the internet, and radius is relatively insecure. My client machines also run a web server, which stunnel sits in front of, to provide ssl encrypted web services. My radius servers can easily run stunnel, without any issue. Could someone suggest a configuration for this??

3 2

syslog question
by Brian T 04 Mar '05

04 Mar '05

If debug=4 ( or not 0 ) and output= is commented in an stunnel config, it looks like in server mode, messages goto syslog. But in client mode, nothing goes to syslog. Is this the way it's supposed to be? -Brian

1 0

Re: [stunnel-users] long delay to close the ssl session ?
by ikeda＠areabe 04 Mar '05

04 Mar '05

If TIMEOUTclose value is positive, stunnel does not transmit TCP FIN, even though application sends TCP FIN, until timeout time expires I don't know why stunnel designer chose it, maybe because of the performance, or some others. Some of the browsers do not start to display the page until receiving the entire packet. And one of the trigger for the browser to detect to receive the whole is TCP FIN. From that things, such kind of the problem of yours occurs. regards taka On Fri, 4 Mar 2005 10:39:47 -0800 (PST), gary ng <garyng2000(a)yahoo.com> wrote: > Thanks, that did the trick. Just wonder why the > document said this is needed for MSIE while I was > using firefox. Seems to be more like a Window(I > believe even firefox relis on the underlying socket > library) than simply MSIE. > > --- "ikeda@areabe" <ikeda(a)areabe.com> wrote: >> add >> TIMEOUTclose = 0 >> in stunnel.conf >> >> regards >> taka >> >> > > > > > __________________________________ > Celebrate Yahoo!'s 10th Birthday! > Yahoo! Netrospective: 100 Moments of the Web > http://birthday.yahoo.com/netrospective/ >

1 0

long delay to close the ssl session ?
by gary ng 04 Mar '05

04 Mar '05

Hi, I am using stunnel to wrap SSL around SWAT. Everything works fine except that it takes a very long delay for the browser to see that the page has already been transmitted completely(in other words, the other end has closed). I observed this behaviour with both 3.x and 4.x stunnel. Looking through the log, I see that it takes exactly one minute from the start of the session till the session is closed, seems to be some parameter within stunnel to hold the session. I tried both inetd as well as stand alone stunnel mode and both behave the same as well. Is this an issue with SWAT or stunnel ? If I just use plain SWAT through inetd, I don't see this behaviour. thanks for any help in advance. gary __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

compilation errors
by Greg Matthews 03 Mar '05

03 Mar '05

Anyone here managed to build stunnel for Irix? it seems socklen_t is undefined as a type on this OS (and also older versions of solaris). I have found a possible solution here: http://sprg.ssl.berkeley.edu/~fastops/ITOS/portable/socklen$_t.html but I need to know what type this identifier is supposed to be. any help? GREG -- Greg Matthews iTSS Wallingford 01491 692445

2 4

Naive question: will stunnel connect dynamically?
by Duncan Murdoch 02 Mar '05

02 Mar '05

I currently use openssh to open a tunnel between my laptop and my POP3 server, but the tunnel keeps locking up. (I think it's a server problem, or an intermittent line problem, because it happens with both openssh and Putty.) What I'd like is a program that would open the tunnel only as needed, so I can get the mail, and let the tunnel close. Can stunnel do this? More generally, is there a quick summary somewhere on the relative benefits of stunnel's use of SSL versus an SSH approach? Duncan Murdoch

1 0

Windows XP Pro as a client of Remote Dekstop via stunnel
by Jacek Baszkiewicz 02 Mar '05

02 Mar '05

Hi! I'm currently working (without success) on such problem: I have to connect via Stunnel to Windows Server Remote Desktop from workstation with Windows XP Proffesional. When I refer to the local port handled by stunnel, Windows doesn't let me go go further, because it thinks that I'm trying to use local Remote Dekstop and prints: "You are already connected to this machine" (there can be only one connection through RD) . Is there any workaround for this problem, namely, to use secure connection via Stunnel to Remote Dekstop on XP Pro client? This is my config: client=yes cert = stunnel.pem [ts] accept=localhost:3389 connect=remote_ip:443

5 4

PEM routines:PEM_read_bio Problem
by Metal Gear 02 Mar '05

02 Mar '05

Hi all, i was configuring my syslog-ng server with stunnel and it worked fine for somedays but after that i upgraded to new SSL libraries (OpenSSL 0.9.7e) from (OpenSSL 0x0090701f) then i m getting this "stunnel[2480]: SSL_CTX_use_RSAPrivateKey_file: 906D06C: error:0906D06C:PEM routines:PEM_read_bio" error (i have given the link of stunnel binary in rc.local, to start at boot time, at i get this error in logs) i m using stunnel (stunnel 4.07). Can anyone has any idea about it. Thanks

1 0

verify = 3 error with certificate client
by Humberto Morell 01 Mar '05

01 Mar '05

Hello List I have stunnel 4.7 In the messages of the list I have not seen solution to my problem. This is VERIFY ERROR ONLY MY: no cert stunnel.log in Server ################## 2005.02.25 07:55:07 LOG5[2501:1076546480]: VERIFY OK: depth=1, /C=CU/ST=Ciudad Habana/L=Centro Habana/O=Segurmatica/OU=Agencia de Certificacion/CN=Segurmatica/emailAddress=ca(a)segurmatica.cu 2005.02.25 07:55:07 LOG4[2501:1076546480]: VERIFY ERROR ONLY MY: no cert for /C=CU/ST=Ciudad Habana/L=Centro Habana/O=Ministerio Informatica y Comunicaciones/OU=Segurmatica/CN=Humberto Morell/emailAddress=morell(a)seg.inf.cu 2005.02.25 07:55:07 LOG7[2501:1076546480]: SSL alert (write): fatal: certificate unknown ############# stunnel.conf in Server ############## #chroot = /var/lib/stunnel/ verify = 3 CApath = /etc/stunnel/certdb # or simply use CAfile instead: #CAfile = /etc/stunnel/certs.pem CAfile = /etc/stunnel/acsegurmatica.crt #cert = /etc/stunnel/stunnel.pem cert = /etc/stunnel/certstunnel.pem ################# File in /etc/stunnel ############### certdb morell.pem stunnel.prueba.pem certstunnel.pem stunnel.conf acsegurmatica.crt morell.crt stunnel.log certclient morell.key stunnel.pem ############### Link in /etc/stunnel/certdb ############### drwxr-xr-x 2 root root 176 Feb 25 11:06 . drwx------ 4 root root 472 Feb 25 10:52 .. lrwxrwxrwx 1 root root 24 Feb 25 11:00 2307a3fe.0 -> /etc/stunnel/stunnel.pem lrwxrwxrwx 1 root root 30 Feb 25 11:01 3f5b7ca8.0 -> /etc/stunnel/acsegurmatica.crt lrwxrwxrwx 1 root root 23 Feb 25 11:03 3fb3183e.0 -> /etc/stunnel/morell.pem lrwxrwxrwx 1 root root 28 Feb 25 11:06 d14abd18.0 -> /etc/stunnel/certstunnel.pem ################# client in Windows stunnel.conf ############## client = yes cert = d:\morell.pem debug = 7 output = d:\stunnel.log [lsd] accept = 9595 connect = 10.10.1.83:9500 [ssh] accept = 2222 connect = 10.10.1.83:9522 ##################### Note: I don't use chroot I have try, but idem error with. File morell.pem only client certificate and other time file morell.pem Key private crl Certificate With verify = 2 all is ok Please help Best regards Morell

3 3

stunnel woes under HPUX 10.20
by foner-stunnel＠media.mit.edu 28 Feb '05

28 Feb '05

[Please keep me CC'ed on replies! I'm not on any stunnel lists.] Stunnel 4.07 and 4.08 don't build under HPUX 10.20. 4.06 appears to build, but doesn't appear to work---with a config file like this, running on the local host: pid = /usr/local/var/stunnel/stunnel.pid client = yes foreground = yes # debug = debug [pop3s] accept = 110 connect = our-pop-host:995 ...and an attempt like this, using (for instance) Emacs 21.4a's movemail: movemail po:foner:localhost NEWMAIL [the-password] ...I get an infinite hang. Enabling debugging causes stunnel to spit out an infinite stream of a single line at maximum rate, and seems unaffected by whether I'm trying to connect to it or not: # stunnel test-stunnel.conf 1900.01.00 00:00:00 LOG5[9738:0]: stunnel 4.06 on hppa1.1-hp-hpux10.20 FORK+POLL with OpenSSL 0.9.7e 25 Oct 2004 1900.01.00 00:00:00 LOG7[9738:0]: Snagged 64 random bytes from /users/foner/.rnd 1900.01.00 00:00:00 LOG7[9738:0]: Wrote 1024 new random bytes to /users/foner/.rnd 1900.01.00 00:00:00 LOG7[9738:0]: RAND_status claims sufficient entropy for the PRNG 1900.01.00 00:00:00 LOG6[9738:0]: PRNG seeded successfully 1900.01.00 00:00:00 LOG6[9738:0]: file ulimit = 60 (can be changed with 'ulimit -n') 1900.01.00 00:00:00 LOG6[9738:0]: poll() used - no FD_SETSIZE limit for file descriptors 1900.01.00 00:00:00 LOG5[9738:0]: 27 clients allowed 1900.01.00 00:00:00 LOG7[9738:0]: FD 3 in non-blocking mode 1900.01.00 00:00:00 LOG7[9738:0]: FD 4 in non-blocking mode 1900.01.00 00:00:00 LOG7[9738:0]: FD 5 in non-blocking mode 1900.01.00 00:00:00 LOG7[9738:0]: SO_REUSEADDR option set on accept socket 1900.01.00 00:00:00 LOG7[9738:0]: pop3s bound to 0.0.0.0:110 1900.01.00 00:00:00 LOG7[9738:0]: Created pid file /usr/local/var/stunnel/stunnel.pid 1900.01.00 00:00:00 LOG6[9738:0]: daemon_loop: s_poll_wait: Invalid argument (22) 1900.01.00 00:00:00 LOG6[9738:0]: daemon_loop: s_poll_wait: Invalid argument (22) 1900.01.00 00:00:00 LOG6[9738:0]: daemon_loop: s_poll_wait: Invalid argument (22) 1900.01.00 00:00:00 LOG6[9738:0]: daemon_loop: s_poll_wait: Invalid argument (22) [ . . . and forever more . . . ] I can't imagine that this is supposed to be how debug works, since it's totally useless for debugging if it spits out the same line as fast as it can. I'm running the stunnel as root, and netstat seems to show that it's bound to port 110, but doesn't seem to indicate any outbound connection from stunnel to our pop host after I invoke movemail. I have no idea if versions before 4.06 work; I haven't tried. Sure, this is an old OS, but zillions of other things, including the entire GNU toolchain, seem to work on it, so stunnel should, too. Builds for all three versions I've tried may be found in at the following URLs. Note that 4.07 and 4.08 fail on different files, but in essentially the same way. http://foner.www.media.mit.edu/people/foner/Sys/stunnel-4.06.build http://foner.www.media.mit.edu/people/foner/Sys/stunnel-4.07.build http://foner.www.media.mit.edu/people/foner/Sys/stunnel-4.08.build I've done some websearching, and I've searched the stunnel archives at mirt.net, but haven't found anything relevant. Any clues? Thanks...

5 9

stunnel logging problem
by Brian T 28 Feb '05

28 Feb '05

Hi, I work for a company which has a custom embedded Linux platform, and have been working with stunnel for some time but have never seen this problem. I have seen it with stunnel 4.04 and 4.07, which is compiled on a Redhat 7.2ish platform, but newer SSL libraries. (below my sig is the stunnel info). Basically I use a config file, but when debug= and output= is commented out, stunnel seems to cause a problem which resets the embedded unit. If I uncomment them both and use output=/var/log/stunnel.log ( or /dev/null ) everything works fine. Not sure where to look for the problem that is causing this since I can't even get a core dump. I looged in s_log() but nothing stuck out as being wrong. Thanks for any help you can lend, -Brian [root@JBMgateway-v63 /]# stunnel -version stunnel 4.07 on i486-pc-linux-gnu PTHREAD+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7d 17 Mar 2004 Global options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /etc/stunnel/stunnel.pem pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds [root@JBMgateway-v63 /]# uname -a Linux JBMgateway-v63 2.4.20 #1729 Wed Jan 26 17:38:15 CST 2005 i486 unknown [root@JBMgateway-v63 /]# ls -al /lib/libssl.so.* -rwxr-xr-x 1 root root 210452 Jan 26 18:47 /lib/libssl.so.0.9.7 lrwxrwxrwx 1 root root 20 Jan 26 18:47 /lib/libssl.so.2 -> /lib/libssl.so.0.9.7 [root@JBMgateway-v63 /]# cat /etc/stunnel/stunnel.conf # Some debugging stuff debug = 6 output = /var/log/stunnel.log #output = /dev/null foreground = yes # Use it for client mode client = yes [SampleGroup] accept = 443 connect = x.x.x.x:6660

1 0

PEM routines:PEM_read_bio Problem
by Metal Gear 28 Feb '05

28 Feb '05

Hi all, i was configuring my syslog-ng server with stunnel and it worked fine for somedays but after that i upgraded to new SSL libraries (OpenSSL 0.9.7e) from (OpenSSL 0x0090701f) then i m getting this "stunnel[2480]: SSL_CTX_use_RSAPrivateKey_file: 906D06C: error:0906D06C:PEM routines:PEM_read_bio" error (i have given the link of stunnel binary in rc.local, to start at boot time, at i get this error in logs) i m using stunnel (stunnel 4.07). Can anyone has any idea about it. Thanks (sorry for sending same message twice)

1 0

PEM routines:PEM_read_bio Problem
by Metal Gear 28 Feb '05

28 Feb '05

Hi all, i was configuring my syslog-ng server with stunnel and it worked fine for somedays but after that i upgraded to new SSL libraries (OpenSSL 0.9.7e) from (OpenSSL 0x0090701f) then i m getting this "stunnel[2480]: SSL_CTX_use_RSAPrivateKey_file: 906D06C: error:0906D06C:PEM routines:PEM_read_bio" error (i have given the link of stunnel binary in rc.local, to start at boot time, at i get this error in logs) i m using stunnel (stunnel 4.07). Can anyone has any idea about it. Thanks

1 0

Stunnel 4.08 released
by Michal Trojnara 27 Feb '05

27 Feb '05

Here is the ChangeLog entry for the new stunnel 4.08: Version 4.08, 2005.02.27, urgency: LOW: * New features - New -quiet option was added to install NT service without a message box. * Bugfixes - Using $(DESTDIR) in tools/Makefile.am. - Define NI_NUMERICHOST and NI_NUMERICSERV when needed. - Length of configuration file line increased from 256B to 16KB. - Stunnel sends close_notify when a close_notify is received from SSL peer and all remaining data is sent to SSL peer. - Some fixes for bugs detected by the watchdog. * Release notes - There were many changes in the transfer() function (the main loop). This version should be thoroughly tested before using it in the mission-critical environment. Home page & downloads: http://stunnel.mirt.net/ Best regards, Mike

1 0

Help Needed
by Alexander Lazic 25 Feb '05

25 Feb '05

Hi, i have try to add the X-Forwarded-For Header, based on http://www.stunnel.org/patches/desc/xforwardedfor_jrd.html, into stunnel 4.07, but i don't come to a solution :-( I have try to add i into 'client.c => transfer()'. Please can anybody review the attached Patch and point me to the right way ;-) I'am not shure that i add the 'insert' into the right place :-( Thanx for help ;-)) al ;-)

1 1

verify =3 error with certificate client
by Humberto Morell 25 Feb '05

25 Feb '05

Hello List I have stunnel 4.7 In the messages of the list I have not seen solution to my problem. This is VERIFY ERROR ONLY MY: no cert stunnel.log in Server ################## 2005.02.25 07:55:07 LOG5[2501:1076546480]: VERIFY OK: depth=1, /C=CU/ST=Ciudad Habana/L=Centro Habana/O=Segurmatica/OU=Agencia de Certificacion/CN=Segurmatica/emailAddress=ca(a)segurmatica.cu 2005.02.25 07:55:07 LOG4[2501:1076546480]: VERIFY ERROR ONLY MY: no cert for /C=CU/ST=Ciudad Habana/L=Centro Habana/O=Ministerio Informatica y Comunicaciones/OU=Segurmatica/CN=Humberto Morell/emailAddress=morell(a)seg.inf.cu 2005.02.25 07:55:07 LOG7[2501:1076546480]: SSL alert (write): fatal: certificate unknown ############# stunnel.conf in Server ############## #chroot = /var/lib/stunnel/ verify = 3 CApath = /etc/stunnel/certdb # or simply use CAfile instead: #CAfile = /etc/stunnel/certs.pem CAfile = /etc/stunnel/acsegurmatica.crt #cert = /etc/stunnel/stunnel.pem cert = /etc/stunnel/certstunnel.pem ################# File in /etc/stunnel ############### certdb morell.pem stunnel.prueba.pem certstunnel.pem stunnel.conf acsegurmatica.crt morell.crt stunnel.log certclient morell.key stunnel.pem ############### Link in /etc/stunnel/certdb ############### drwxr-xr-x 2 root root 176 Feb 25 11:06 . drwx------ 4 root root 472 Feb 25 10:52 .. lrwxrwxrwx 1 root root 24 Feb 25 11:00 2307a3fe.0 -> /etc/stunnel/stunnel.pem lrwxrwxrwx 1 root root 30 Feb 25 11:01 3f5b7ca8.0 -> /etc/stunnel/acsegurmatica.crt lrwxrwxrwx 1 root root 23 Feb 25 11:03 3fb3183e.0 -> /etc/stunnel/morell.pem lrwxrwxrwx 1 root root 28 Feb 25 11:06 d14abd18.0 -> /etc/stunnel/certstunnel.pem ################# client in Windows stunnel.conf ############## client = yes cert = d:\morell.pem debug = 7 output = d:\stunnel.log [lsd] accept = 9595 connect = 10.10.1.83:9500 [ssh] accept = 2222 connect = 10.10.1.83:9522 ##################### Note: I don't use chroot I have try, but idem error with. File morell.pem only client certificate and other time file morell.pem Key private crl Certificate With verify = 2 all is ok Please help Best regards Morell

1 0

openssl - generating stunnel.pem - stunnel.cnf
by k-i-r＠web.de 24 Feb '05

24 Feb '05

Using Stunnel under Windows I want to create a certificate (stunnel.pem) with Openssl. According to FAQ the syntax for creating a certificate with Openssl is openssl req -new -x509 -days 365 -nodes -config stunnel.cnf -out stunnel.pem -keyout stunnel.pem I use openssl for windows (as part of apache-windows-http-server) . Where do I get the file stunnel.cnf ? Or is this file not necessary for creating a certificate ? Thanks for help, k.

3 2

Stunnel and configuration
by Bohdan Linda 22 Feb '05

22 Feb '05

Hi all, I have configured stunnel to do the client authetication, but I have some question. I have used following config: cert = /etc/certificates/server.pem - file with signed server cert and key (passwordless) chroot = /var/run/stunnel/ CAfile = /etc/certificates/certs -file where first item is my CA certificate followed by list of all client certificates sgined by my CA. setuid = nobody setgid = nogroup pid = /stunnel.pid verify = 3 This setup is working, but this seems to me very "unlogical". If I create for me "more logic" setup: cert = /etc/certificates/server.pem chroot = /var/run/stunnel/ CAfile = /etc/certificates/CA/cacert.pem - only certificate of my CA CRLfile = /etc/certificates/crls - only certificates signed by my CA I get the following error: 2005.02.22 15:15:10 LOG5[22418:81926]: VERIFY OK: depth=1, /C= ..... 2005.02.22 15:15:10 LOG4[22418:81926]: VERIFY ERROR ONLY MY: no cert for /C= The question is ... why? Why CAfile has to contain all client certificates, when clients certs are not CA? Why I cannot have separate file for CA and separate file for certificates that I want accept? If I do the similar setup in mod_ssl, the configuration works as expected. Anyway, I'am newbie to deploy stunnel, thus I would like to ask you for giving me you opinion of this configuration, caveats and possible enhancements. Thanks for any comments, Bohdan Linda

3 4

SSL_read (ERROR_SYSCALL)
by Passreality 16 Feb '05

16 Feb '05

Hi Im trying to connect using mysql, there are no fw between the 2 boxes. I tested with stunnel 3.x and 4.x but when i use the 4.0.23 mysldb it just wount work. When i use the older db it works. Any ideas on how to solve this error ? /Christian Stunnel 4.07 Kernel 2.4.18 gcc version 3.3.5 (Debian 1:3.3.5-8) mysql Ver 12.22 Distrib 4.0.23 Dist Debian Testing Im using stunnel.pem (default one) Client Log 2005.02.16 15:04:19 LOG7[2147:16384]: mysql accepted FD=10 from 217.212.4.33:40797 2005.02.16 15:04:19 LOG7[2147:16384]: FD 10 in non-blocking mode 2005.02.16 15:04:19 LOG7[2322:49154]: mysql started 2005.02.16 15:04:19 LOG7[2322:49154]: TCP_NODELAY option set on local socket 2005.02.16 15:04:19 LOG5[2322:49154]: mysql connected from 217.212.4.33:40797 2005.02.16 15:04:19 LOG7[2322:49154]: FD 13 in non-blocking mode 2005.02.16 15:04:19 LOG7[2322:49154]: mysql connecting 217.212.4.198:3307 2005.02.16 15:04:19 LOG7[2322:49154]: connect_wait: waiting 10 seconds 2005.02.16 15:04:19 LOG7[2322:49154]: connect_wait: connected 2005.02.16 15:04:19 LOG7[2322:49154]: Remote FD=13 initialized 2005.02.16 15:04:19 LOG7[2322:49154]: TCP_NODELAY option set on remote socket 2005.02.16 15:04:19 LOG7[2322:49154]: SSL state (connect): before/connect initialization 2005.02.16 15:04:19 LOG7[2322:49154]: SSL state (connect): SSLv3 write client hello A 2005.02.16 15:04:19 LOG7[2322:49154]: SSL state (connect): SSLv3 read server hello A 2005.02.16 15:04:19 LOG7[2322:49154]: SSL state (connect): SSLv3 read server certificate A 2005.02.16 15:04:19 LOG7[2322:49154]: SSL state (connect): SSLv3 read server done A 2005.02.16 15:04:19 LOG7[2322:49154]: SSL state (connect): SSLv3 write client key exchange A 2005.02.16 15:04:19 LOG7[2322:49154]: SSL state (connect): SSLv3 write change cipher spec A 2005.02.16 15:04:19 LOG7[2322:49154]: SSL state (connect): SSLv3 write finished A 2005.02.16 15:04:19 LOG7[2322:49154]: SSL state (connect): SSLv3 flush data 2005.02.16 15:04:19 LOG7[2322:49154]: SSL state (connect): SSLv3 read finished A 2005.02.16 15:04:19 LOG7[2322:49154]: 2 items in the session cache 2005.02.16 15:04:19 LOG7[2322:49154]: 3 client connects (SSL_connect()) 2005.02.16 15:04:19 LOG7[2322:49154]: 3 client connects that finished 2005.02.16 15:04:19 LOG7[2322:49154]: 0 client renegotiatations requested 2005.02.16 15:04:19 LOG7[2322:49154]: 0 server connects (SSL_accept()) 2005.02.16 15:04:19 LOG7[2322:49154]: 0 server connects that finished 2005.02.16 15:04:19 LOG7[2322:49154]: 0 server renegotiatiations requested 2005.02.16 15:04:19 LOG7[2322:49154]: 1 session cache hits 2005.02.16 15:04:19 LOG7[2322:49154]: 0 session cache misses 2005.02.16 15:04:19 LOG7[2322:49154]: 0 session cache timeouts 2005.02.16 15:04:19 LOG6[2322:49154]: SSL connected: new session negotiated 2005.02.16 15:04:19 LOG6[2322:49154]: Negotiated ciphers: DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 2005.02.16 15:04:19 LOG3[2322:49154]: SSL_read (ERROR_SYSCALL): Connection reset by peer (104) 2005.02.16 15:04:19 LOG5[2322:49154]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2005.02.16 15:04:19 LOG7[2322:49154]: mysql finished (0 left) Server Log 2005.02.16 15:04:51 LOG7[29786:16384]: mysql accepted FD=10 from 217.212.4.33:40798 2005.02.16 15:04:51 LOG7[29786:16384]: FD 10 in non-blocking mode 2005.02.16 15:04:51 LOG7[29814:49154]: mysql started 2005.02.16 15:04:51 LOG7[29814:49154]: TCP_NODELAY option set on local socket 2005.02.16 15:04:51 LOG5[29814:49154]: mysql connected from 217.212.4.33:40798 2005.02.16 15:04:51 LOG7[29814:49154]: SSL state (accept): before/accept initialization 2005.02.16 15:04:51 LOG7[29814:49154]: SSL state (accept): SSLv3 read client hello A 2005.02.16 15:04:51 LOG7[29814:49154]: SSL state (accept): SSLv3 write server hello A 2005.02.16 15:04:51 LOG7[29814:49154]: SSL state (accept): SSLv3 write certificate A 2005.02.16 15:04:51 LOG7[29814:49154]: SSL state (accept): SSLv3 write server done A 2005.02.16 15:04:51 LOG7[29814:49154]: SSL state (accept): SSLv3 flush data 2005.02.16 15:04:51 LOG7[29814:49154]: SSL state (accept): SSLv3 read client key exchange A 2005.02.16 15:04:51 LOG7[29814:49154]: SSL state (accept): SSLv3 read finished A 2005.02.16 15:04:51 LOG7[29814:49154]: SSL state (accept): SSLv3 write change cipher spec A 2005.02.16 15:04:51 LOG7[29814:49154]: SSL state (accept): SSLv3 write finished A 2005.02.16 15:04:51 LOG7[29814:49154]: SSL state (accept): SSLv3 flush data 2005.02.16 15:04:51 LOG7[29814:49154]: 1 items in the session cache 2005.02.16 15:04:51 LOG7[29814:49154]: 0 client connects (SSL_connect()) 2005.02.16 15:04:51 LOG7[29814:49154]: 0 client connects that finished 2005.02.16 15:04:51 LOG7[29814:49154]: 0 client renegotiatations requested 2005.02.16 15:04:51 LOG7[29814:49154]: 3 server connects (SSL_accept()) 2005.02.16 15:04:51 LOG7[29814:49154]: 3 server connects that finished 2005.02.16 15:04:51 LOG7[29814:49154]: 0 server renegotiatiations requested 2005.02.16 15:04:51 LOG7[29814:49154]: 1 session cache hits 2005.02.16 15:04:51 LOG7[29814:49154]: 0 session cache misses 2005.02.16 15:04:51 LOG7[29814:49154]: 1 session cache timeouts 2005.02.16 15:04:51 LOG6[29814:49154]: SSL accepted: new session negotiated 2005.02.16 15:04:51 LOG6[29814:49154]: Negotiated ciphers: DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 2005.02.16 15:04:51 LOG7[29814:49154]: FD 13 in non-blocking mode 2005.02.16 15:04:51 LOG7[29814:49154]: mysql connecting 127.0.0.1:3306 2005.02.16 15:04:51 LOG7[29814:49154]: connect_wait: waiting 10 seconds 2005.02.16 15:04:51 LOG3[29814:49154]: connect_wait: getsockopt: Connection refused (111) 2005.02.16 15:04:51 LOG3[29814:49154]: Failed to initialize remote connection 2005.02.16 15:04:51 LOG7[29814:49154]: mysql finished (0 left) __________________________________ Do you Yahoo!? The all-new My Yahoo! - What will yours do? http://my.yahoo.com

1 0

Stunnel on Open-WRT..
by Andrew Frazer 16 Feb '05

16 Feb '05

I have got Stunnel running under Open-wrt, on a Linksys WRT54GS. However I don't seem to be able to get it to run the transparent mode.. (a) is it possible? (b) If the answer is no, would be possible to modifty either open-wrt or stunnel to make it work? Regards A.

1 0

Re: [stunnel-users] read sock return size 0 situation( it cause http web server to wait timeout for long time)
by Michal Trojnara 15 Feb '05

15 Feb '05

On 2005-01-18, at 02:43, Stanley wrote: > 1.In our case, the web server sent TCP fin,ack to stunnel > but the stunnel just sent TCP ack, so it is TCP half close. > 2.The stunnel use read() function that try to read more data from > sock_fd > but return 0(EOF) because TCP half close. > 3.At this moment, the stunnel call SSL_shutdown() function > that sent close_notify alert but a broswer(IE6 or firefox1.0) return > no message. > > I just modify stunnel 4.07 client.c to set sock_wr=0 > that will close TCP connection from stunnel to web server when read() > EOF. I'm NOT going to break SSL protocol in stunnel to support broken SSL clients. Use: TIMEOUTclose = 0 configuration option instead. Best regards, Mike

1 0

multiple stunnel client
by Manila, Dinesh - Contractor 15 Feb '05

15 Feb '05

Hi, I am working in a project, whereas the EMS application need to be secured while communicating with NE. To make it secure, we have decided to go with stunnel and openSSL. I have following questions while using stunnel in my application: 1. I read that stunnel limits the number of clients to be connected to 125. Can I increase this number. If so, by increasing this number, what is the implication in performance of stuunel. 2. Since my EMS is capable of managing more than 1000 NEs, I would want to have multiple stunnel client running on the same workstation. Is this possible to have multiple stuunel process running on the same server. if so, how should my stunnle.conf file look like. I appreciate greatly, If I could get the answers for the above queries. Thanks and Regards, Dinesh Wipro Technologies. Bangalore.

2 1

Multiple listeners with just one instance of Stunnel?
by Michael Zarlenga 15 Feb '05

15 Feb '05

It doesn't seem possible to start 1 instance of Stunnel for multiple accept ports. Judging by the format of the Stunnel configuration file, it seems that I need to 1 instance of Stunnel for each port that accepts connections from the outside world. Is this true?

3 6

HELP!!! Problem uploading files
by Bhavesh Patel 14 Feb '05

14 Feb '05

Hi all, I'm using stunnel verstion 4.05 and openssl 0.9.7d. When trying to upload a large file say 1Meg I always get the following: 2005.01.27 14:30:40 LOG7[72667165:0]: stunnel accepted FD=0 from 136.157.232.120:3372 2005.01.27 14:30:40 LOG7[72667165:0]: FD 0 in non-blocking mode 2005.01.27 14:30:40 LOG7[79306780:0]: stunnel started 2005.01.27 14:30:40 LOG5[79306780:0]: stunnel connected from 136.157.232.120:3372 2005.01.27 14:30:40 LOG7[79306780:0]: SSL state (accept): before/accept initialization 2005.01.27 14:30:40 LOG7[79306780:0]: SSL state (accept): SSLv2 read client hello A 2005.01.27 14:30:40 LOG7[79306780:0]: SSL state (accept): SSLv2 write server hello A 2005.01.27 14:30:40 LOG7[79306780:0]: waitforsocket: FD=0, DIR=read 2005.01.27 14:30:40 LOG7[79306780:0]: waitforsocket: ok 2005.01.27 14:30:40 LOG7[79306780:0]: SSL state (accept): SSLv2 read client master key A 2005.01.27 14:30:40 LOG7[79306780:0]: SSL state (accept): SSLv2 server start encryption 2005.01.27 14:30:40 LOG7[79306780:0]: SSL state (accept): SSLv2 write server verify A 2005.01.27 14:30:40 LOG7[79306780:0]: waitforsocket: FD=0, DIR=read 2005.01.27 14:30:40 LOG7[79306780:0]: waitforsocket: ok 2005.01.27 14:30:40 LOG7[79306780:0]: SSL state (accept): SSLv2 read client finished A 2005.01.27 14:30:40 LOG7[79306780:0]: SSL state (accept): SSLv2 write request certificate A 2005.01.27 14:30:40 LOG7[79306780:0]: SSL state (accept): SSLv2 write server finished A 2005.01.27 14:30:40 LOG7[79306780:0]: 1 items in the session cache 2005.01.27 14:30:40 LOG7[79306780:0]: 0 client connects (SSL_connect()) 2005.01.27 14:30:40 LOG7[79306780:0]: 0 client connects that finished 2005.01.27 14:30:40 LOG7[79306780:0]: 0 client renegotiatations requested 2005.01.27 14:30:40 LOG7[79306780:0]: 1 server connects (SSL_accept()) 2005.01.27 14:30:40 LOG7[79306780:0]: 1 server connects that finished 2005.01.27 14:30:40 LOG7[79306780:0]: 0 server renegotiatiations requested 2005.01.27 14:30:40 LOG7[79306780:0]: 0 session cache hits 2005.01.27 14:30:40 LOG7[79306780:0]: 1 session cache misses 2005.01.27 14:30:40 LOG7[79306780:0]: 0 session cache timeouts 2005.01.27 14:30:40 LOG6[79306780:0]: Negotiated ciphers: DES-CBC3-MD5 SSLv2 Kx=RSA Au=RSA Enc=3DES(168 ) Mac=MD5 2005.01.27 14:30:40 LOG7[79306780:0]: FD 1 in non-blocking mode 2005.01.27 14:30:40 LOG7[79306780:0]: stunnel connecting 127.0.0.1:80 2005.01.27 14:30:40 LOG7[79306780:0]: remote connect #1: EINPROGRESS: retrying 2005.01.27 14:30:40 LOG7[79306780:0]: waitforsocket: FD=1, DIR=write 2005.01.27 14:30:40 LOG7[79306780:0]: waitforsocket: ok 2005.01.27 14:30:40 LOG7[79306780:0]: Remote FD=1 initialized 2005.01.27 14:30:40 LOG7[79306780:0]: SSL_read returned WANT_: retrying 2005.01.27 14:30:40 LOG7[79306780:0]: SSL closed on SSL_write 2005.01.27 14:30:40 LOG5[79306780:0]: Connection closed: 0 bytes sent to SSL, 668 bytes sent to socket 2005.01.27 14:30:40 LOG7[79306780:0]: removing pid file /usr/local/var/run/stunnel.pid 2005.01.27 14:30:40 LOG7[72667165:0]: Process 79306780 finished with code 0 (0 left) Specifically: I get SSL_read returned WANT_: retrying I am using sslv2 because sslV3 does not work with windows explorer. Any help would be appreciated. __________________________________ Do you Yahoo!? Read only the mail you want - Yahoo! Mail SpamGuard. http://promotions.yahoo.com/new_mail

2 1

using no certificate
by Zohar 14 Feb '05

14 Feb '05

Hi, I'm very new to all this issue of SSL, so I apologize if this question sounds stupid. I currently have a server that listens to connections on a TCP port. Clients that connect to it may do so using SSL v3 (mobile clients, which use their own SSL packages, so I have very little control over it). I want to add stunnel to my server's setting, to enable SSL communication. I have no need for the client to authenticate the server, I am only interested in the data being encrypted. I tried setting this up, but the client complains that my server certificate cannot be authenticated (I produced it using http://www.stunnel.org/pem/) Any pointers on how to set such a thing up (even for the time being, while I develop), without having to pay lots of money to a CA ?

3 2

Multiple Instances of stunnel
by dps_maillists＠mac.com 11 Feb '05

11 Feb '05

Hi everyone; Is it possible to run multiple instances of stunnel (v 4.07) in client mode on a single machine? We sould like to use stunnel to secure connections from a small number of client applications (1 to 10) connecting to a larger number of server applications (200 per client app). Ideally, we would like to use one instance of stunnel per client. Many thanks in advance. Doug

2 1

connect_wait: s_poll_wait timeout
by Alexander Lazic 07 Feb '05

07 Feb '05

Hi, we run stunnel on an solaris 9 with unlimited FD. Today we get the follwing error: connect_wait: s_poll_wait timeout With 'top' we see ~190-~220 threads and the client can't connect to our site. our config is: --- cert = /usr/local/apache/our.pem setuid = stunnel setgid = apache options = ALL pid = /usr/local/apache/logs/stunnel_netbanking.pid ciphers = ALL:!EXP1024-DHE-DSS-RC4-SHA:!EXP1024-RC4-SHA:!EXP1024-DHE-DSS-DES-CBC-SHA:!EXP1024-DES-CBC-SHA:!EXP1024-RC2-CBC-MD5:!EXP1024-RC4-MD5:!ADH:!EXP56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL:@STRENGTH debug = 6 output = /usr/local/apache/logs/stunnel_netbanking.log [https] accept = 10.3.169.208:443 connect = 10.3.169.208:10800 TIMEOUTclose = 0 xforwardedfor = yes --- stunnel 4.07 on sparc-sun-solaris2.9 PTHREAD+POLL+IPv4 with OpenSSL 0.9.7d 17 Mar 2004 PRNG seeded successfully file ulimit = 2147483647 (can be changed with 'ulimit -n') poll() used - no FD_SETSIZE limit for file descriptors 8388607 clients allowed --- Please can you help us to solve the problem. thx al ;-)

2 1

Problem downloading large files with sslv2
by Bhavesh Patel 04 Feb '05

04 Feb '05

Hi, I'm trying to download files from Internet Explorer using sslv2 and I keep getting the following message: 2005.02.04 16:45:04 LOG7[8237077:0]: FD 1 in non-blocking mode 2005.02.04 16:45:04 LOG7[8237077:0]: stunnel connecting 127.0.0.1:80 2005.02.04 16:45:04 LOG7[8237077:0]: remote connect #1: EINPROGRESS: retrying 2005.02.04 16:45:04 LOG7[8237077:0]: waitforsocket: FD=1, DIR=write 2005.02.04 16:45:04 LOG7[8237077:0]: waitforsocket: ok 2005.02.04 16:45:04 LOG7[8237077:0]: Remote FD=1 initialized 2005.02.04 16:45:04 LOG7[8237077:0]: SSL_read returned WANT_: retrying 2005.02.04 16:45:04 LOG7[8237077:0]: SSL closed on SSL_write 2005.02.04 16:45:04 LOG5[8237077:0]: Connection closed: 0 bytes sent to SSL, 669 bytes 2005.02.04 16:45:04 LOG7[8237077:0]: removing pid file /usr/local/var/run/stunnel.pid 2005.02.04 16:45:04 LOG7[2375710:0]: Process 8237077 finished with code 0 (0 left) Also does anyone know if that 10 TIMEOUTconnect for IE really works? Thanks, Bhavesh

1 0

concurrency request
by kevin 01 Feb '05

01 Feb '05

hi, I've recently set up stunnel for SSL connect. When I test its performance with siege with 700 concurrency request, I got this log: "Error: socket: connection timed out.: Operation now in progress" So, may I ask what is the upper limit of concurrency in stunnel, if the performance of the machine is good enough. and how can I increase the concurrency upper limit. thanks

2 1

Q: rereading configuration file?
by Heiko Nardmann 01 Feb '05

01 Feb '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi! Does stunnel offer a way to signal a need for rereading the configuration file, i.e. some kind of SIGHUP ? I would like to add services while running stunnel without stopping the program ... it should compare currently available services with the new list of services, stop the ones not available any more and start those which are new in the new/changed configuration ... - -- Heiko Nardmann (Dipl.-Ing. Technische Informatik) secunet Security Networks AG - Sicherheit in Netzwerken (www.secunet.de) Weidenauer Str. 223-225, D-57076 Siegen Tel. : +49 271 48950-13, Fax : +49 271 48950-50 Besuchen Sie uns vom 10. - 16. März auf der CeBIT 2005 in Halle 7, Stand D38. Informationen zu unseren CeBIT-Themen finden Sie unter www.secunet.com <outbind://44/www.secunet.com> - wir freuen uns auf das Gespräch mit Ihnen. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.6 (GNU/Linux) iD8DBQFB/4Dzpm53PRScYygRAtg4AJ9Ku/8xfufFdrLq7cz2+1GDjrcvyQCffVLw v/2D0Fd8UtTHpssq7cgc71Y= =uG2t -----END PGP SIGNATURE-----

3 2

Q: error message during startup?
by Heiko Nardmann 01 Feb '05

01 Feb '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi! I just got the following stunnel error message in my syslog: File descriptor out of range (1024>=1024) The reason is that I have tried to let stunnel create 2000 services. But where do I change the maximum for this range? (Linux) Kernel? Or stunnel? Thanks in advance! PS: I already changed ulimit to 4000. - -- Heiko Nardmann (Dipl.-Ing. Technische Informatik) secunet Security Networks AG - Sicherheit in Netzwerken (www.secunet.de) Weidenauer Str. 223-225, D-57076 Siegen Tel. : +49 271 48950-13, Fax : +49 271 48950-50 Besuchen Sie uns vom 10. - 16. März auf der CeBIT 2005 in Halle 7, Stand D38. Informationen zu unseren CeBIT-Themen finden Sie unter www.secunet.com <outbind://44/www.secunet.com> - wir freuen uns auf das Gespräch mit Ihnen. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.6 (GNU/Linux) iD8DBQFB/4TWpm53PRScYygRAv2JAKCHTe6zNvhmWAkypK5xymm+LWstEACgt1vJ vSNr7eeFXUpRFCu2SiY/4ls= =huyB -----END PGP SIGNATURE-----

2 1

Q: need of restart after CRL/CA directory contents change?
by Heiko Nardmann 31 Jan '05

31 Jan '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi! Since I want to write CRL files from all relevant CAs based on a regular (daily) basis I wonder whether it is necessary to restart stunnel if the contents of the CRL or CA directory changes. The regular part is going to be handled by a cronjob which does an LDAP search which results in the CA certificate and crl files. How does stunnel work in this situation? Do I need a restart after a cron run or not? Thanks in advance! - -- Heiko Nardmann (Dipl.-Ing. Technische Informatik) secunet Security Networks AG - Sicherheit in Netzwerken (www.secunet.de) Weidenauer Str. 223-225, D-57076 Siegen Tel. : +49 271 48950-13, Fax : +49 271 48950-50 Besuchen Sie uns vom 10. - 16. März auf der CeBIT 2005 in Halle 7, Stand D38. Informationen zu unseren CeBIT-Themen finden Sie unter www.secunet.com <outbind://44/www.secunet.com> - wir freuen uns auf das Gespräch mit Ihnen. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.6 (GNU/Linux) iD8DBQFB/j+kpm53PRScYygRArxfAJ4mXXvjL+qEh6lBJlhpJJfC/jSoEQCgx4ie Xjv5/K3xcL6qPxp5ZH3SzOk= =4/pC -----END PGP SIGNATURE-----

2 1

Re: [stunnel-users] Stunnel 4.05/4.07 Crash
by PinLee_Su＠azuretech.com.sg 31 Jan '05

31 Jan '05

Hi Michal, The initial lines look like this:- 2005.01.25 15:21:23 LOG5[1160:2612]: stunnel 4.07 on x86-pc-mingw32-gnu WIN32+IPv4 with OpenSSL 0.9.7e 25 Oct 2004 2005.01.25 15:21:24 LOG5[1160:1828]: No limit detected for the number of clients 2005.01.25 15:21:24 LOG5[1160:1476]: HTTP connected from 10.3.5.137:2013 2005.01.25 15:21:25 LOG3[1160:1476]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2005.01.25 15:21:25 LOG5[1160:1476]: Connection reset: 206 bytes sent to SSL, 250 bytes sent to socket 2005.01.25 15:21:25 LOG5[1160:2380]: HTTP connected from 10.3.5.137:2024 2005.01.25 15:21:25 LOG3[1160:2380]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2005.01.25 15:21:25 LOG5[1160:2380]: Connection reset: 206 bytes sent to SSL, 226 bytes sent to socket 2005.01.25 15:21:25 LOG5[1160:1992]: HTTP connected from 10.3.5.137:2056 2005.01.25 15:21:27 LOG5[1160:2220]: HTTP connected from 10.3.5.137:2084 2005.01.25 15:21:31 LOG5[1160:2220]: Connection closed: 4969 bytes sent to SSL, 41208 bytes sent to socket 2005.01.25 15:21:31 LOG5[1160:1028]: HTTP connected from 10.3.5.137:2104 2005.01.25 15:21:40 LOG5[1160:1028]: Connection closed: 2528 bytes sent to SSL, 31275 bytes sent to socket 2005.01.25 15:21:40 LOG5[1160:512]: HTTP connected from 10.3.5.137:2122 2005.01.25 15:21:43 LOG5[1160:1992]: Connection closed: 12539 bytes sent to SSL, 56951 bytes sent to socket 2005.01.25 15:21:45 LOG5[1160:512]: Connection closed: 1689 bytes sent to SSL, 21416 bytes sent to socket 2005.01.25 15:21:46 LOG5[1160:2044]: HTTP connected from 10.3.5.137:2154 2005.01.25 15:21:47 LOG5[1160:2148]: HTTP connected from 10.3.5.137:2160 I have 11 config files as each one has its own client certificate. each one contains the follow:- CAfile=c:\STunnel\config\root.pem cert=c:\STunnel\config\myCert_A.pem client=Yes debug=7 output=c:\STunnel\logs\myCert_A.log [HTTP] accept=3885 connect=10.70.1.81:443 thanks and rgds,spl "Azure Technologies is the IT solutions provider of Hutchison Whampoa Limited and a member of Hutchison Global Communications Holdings Limited." The message is for information purposes only and is not intended to create legally binding relations. The shareholders, directors and management of Azure Technologies and any of its group companies accept no responsibility and accordingly shall have no liability to any party whatsoever with respect to the contents of this message. This message (including any attachments) is intended only for the use of the addressee(s) named above. It may contain information that is PRIVILEGED and CONFIDENTIAL and should not be read, copied or otherwise used by any other person. If you are not the intended recipient, please erase all copies of the message (including attachments) and notify us immediately. PinLee_Su@azuretech .com.sg To: stunnel-users(a)mirt.net Sent by: cc: stunnel-users-bounc Subject: [stunnel-users] Stunnel 4.05/4.07 Crash es(a)mirt.net 01/28/2005 06:28 PM Hi, I've initiated 11 stunnel processes in the same server. Each of the stunnel process has its own client certificate to communicate to application server. However after sometime of execution, the stunnel processes are crached (dying off) one by one. below is the last portion of my log (with debug level 7). I don't see any critical error in the log. Would appreciate if someone could highlight to me what cause the problem or anyone has similar experience. 2005.01.25 16:02:41 LOG7[2244:1424]: 0 server connects that finished 2005.01.25 16:02:41 LOG7[2244:1424]: 0 server renegotiatiations requested 2005.01.25 16:02:41 LOG7[2244:1424]: 486 session cache hits 2005.01.25 16:02:41 LOG7[2244:1424]: 0 session cache misses 2005.01.25 16:02:41 LOG7[2244:1424]: 0 session cache timeouts 2005.01.25 16:02:41 LOG7[2244:1424]: SSL_read returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1804]: SSL socket closed on SSL_read 2005.01.25 16:02:41 LOG5[2244:1804]: Connection closed: 716 bytes sent to SSL, 359 bytes sent to socket 2005.01.25 16:02:41 LOG7[2244:1804]: HTTP finished (7 left) 2005.01.25 16:02:41 LOG7[2244:1424]: SSL socket closed on SSL_read 2005.01.25 16:02:41 LOG5[2244:1424]: Connection closed: 716 bytes sent to SSL, 304 bytes sent to socket 2005.01.25 16:02:41 LOG7[2244:1424]: HTTP finished (6 left) 2005.01.25 16:02:41 LOG7[2244:2240]: HTTP accepted FD=516 from 10.3.5.137:1405 2005.01.25 16:02:41 LOG7[2244:2240]: FD 516 in non-blocking mode 2005.01.25 16:02:41 LOG7[2244:2240]: Creating a new thread 2005.01.25 16:02:41 LOG7[2244:2240]: New thread created 2005.01.25 16:02:41 LOG7[2244:1252]: HTTP started 2005.01.25 16:02:41 LOG5[2244:1252]: HTTP connected from 10.3.5.137:1405 2005.01.25 16:02:41 LOG7[2244:1252]: FD 704 in non-blocking mode 2005.01.25 16:02:41 LOG7[2244:1252]: HTTP connecting 10.1.11.56:443 2005.01.25 16:02:41 LOG7[2244:1252]: connect_wait: waiting 10 seconds 2005.01.25 16:02:41 LOG7[2244:1252]: connect_wait: connected 2005.01.25 16:02:41 LOG7[2244:1252]: Remote FD=704 initialized 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): before/connect initialization 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write client hello A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 read server hello A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 read finished A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write change cipher spec A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write finished A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 flush data 2005.01.25 16:02:41 LOG7[2244:1252]: 241 items in the session cache 2005.01.25 16:02:41 LOG7[2244:1252]: 979 client connects (SSL_connect()) 2005.01.25 16:02:41 LOG7[2244:1252]: 979 client connects that finished 2005.01.25 16:02:41 LOG7[2244:1252]: 489 client renegotiatations requested 2005.01.25 16:02:41 LOG7[2244:1252]: 0 server connects (SSL_accept()) 2005.01.25 16:02:41 LOG7[2244:1252]: 0 server connects that finished 2005.01.25 16:02:41 LOG7[2244:1252]: 0 server renegotiatiations requested 2005.01.25 16:02:41 LOG7[2244:1252]: 487 session cache hits 2005.01.25 16:02:41 LOG7[2244:1252]: 0 session cache misses 2005.01.25 16:02:41 LOG7[2244:1252]: 0 session cache timeouts 2005.01.25 16:02:41 LOG6[2244:1252]: SSL connected: previous session reused 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSL renegotiate ciphers 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write client hello A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_read returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_write returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_read returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_write returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_read returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 read server hello A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 read server certificate A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 read server certificate request A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 read server done A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write client certificate A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write client key exchange A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write certificate verify A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write change cipher spec A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write finished A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 flush data 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_write returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_read returned WANT_: retrying 2005.01.25 16:02:42 LOG7[2244:1252]: SSL state (connect): SSLv3 read finished A 2005.01.25 16:02:42 LOG7[2244:1252]: 242 items in the session cache 2005.01.25 16:02:42 LOG7[2244:1252]: 980 client connects (SSL_connect()) 2005.01.25 16:02:42 LOG7[2244:1252]: 980 client connects that finished 2005.01.25 16:02:42 LOG7[2244:1252]: 490 client renegotiatations requested 2005.01.25 16:02:42 LOG7[2244:1252]: 0 server connects (SSL_accept()) 2005.01.25 16:02:42 LOG7[2244:1252]: 0 server connects that finished 2005.01.25 16:02:42 LOG7[2244:1252]: 0 server renegotiatiations requested 2005.01.25 16:02:42 LOG7[2244:1252]: 487 session cache hits 2005.01.25 16:02:42 LOG7[2244:1252]: 0 session cache misses 2005.01.25 16:02:42 LOG7[2244:1252]: 0 session cache timeouts 2005.01.25 16:02:42 LOG7[2244:1252]: SSL_read returned WANT_: retrying 2005.01.25 16:02:43 LOG7[2244:2428]: s_poll_wait timeout waiting for SSL close_notify 2005.01.25 16:02:43 LOG7[2244:2284]: s_poll_wait timeout waiting for SSL close_notify 2005.01.25 16:02:43 LOG5[2244:2428]: Connection closed: 606 bytes sent to SSL, 242 bytes sent to socket 2005.01.25 16:02:43 LOG5[2244:2284]: Connection closed: 7758 bytes sent to SSL, 23278 bytes sent to socket 2005.01.25 16:02:43 LOG7[2244:2428]: HTTP finished (6 left) 2005.01.25 16:02:43 LOG7[2244:2284]: HTTP finished (5 left) 2005.01.25 16:02:45 LOG7[2244:1188]: s_poll_wait timeout waiting for SSL close_notify 2005.01.25 16:02:45 LOG5[2244:1188]: Connection closed: 1485 bytes sent to SSL, 7307 bytes sent to socket 2005.01.25 16:02:47 LOG7[2244:2228]: s_poll_wait timeout waiting for SSL close_notify 2005.01.25 16:02:47 LOG5[2244:2228]: Connection closed: 667 bytes sent to SSL, 552 bytes sent to socket 2005.01.25 16:02:49 LOG7[2244:1644]: s_poll_wait timeout waiting for SSL close_notify 2005.01.25 16:02:49 LOG5[2244:1644]: Connection closed: 667 bytes sent to SSL, 552 bytes sent to socket 2005.01.25 16:02:50 LOG7[2244:2268]: s_poll_wait timeout waiting for SSL close_notify 2005.01.25 16:02:50 LOG5[2244:2268]: Connection closed: 418 bytes sent to SSL, 1375 bytes sent to socket 2005.01.25 16:11:14 LOG7[2244:2240]: HTTP accepted FD=796 from 10.3.5.137:3973 2005.01.25 16:11:14 LOG7[2244:2240]: FD 796 in non-blocking mode 2005.01.25 16:11:14 LOG7[2244:2240]: Creating a new thread 2005.01.25 16:11:14 LOG7[2244:2240]: New thread created 2005.01.25 16:11:14 LOG7[2244:992]: HTTP started 2005.01.25 16:11:14 LOG5[2244:992]: HTTP connected from 10.3.5.137:3973 2005.01.25 16:11:14 LOG7[2244:992]: FD 632 in non-blocking mode 2005.01.25 16:11:14 LOG7[2244:992]: HTTP connecting 10.1.11.56:443 2005.01.25 16:11:14 LOG7[2244:992]: connect_wait: waiting 10 seconds 2005.01.25 16:11:14 LOG7[2244:992]: connect_wait: connected 2005.01.25 16:11:14 LOG7[2244:992]: Remote FD=632 initialized 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): before/connect initialization 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): SSLv3 write client hello A 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): SSLv3 read server hello A 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): SSLv3 read finished A 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): SSLv3 write change cipher spec A 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): SSLv3 write finished A 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): SSLv3 flush data 2005.01.25 16:11:14 LOG7[2244:992]: 242 items in the session cache 2005.01.25 16:11:14 LOG7[2244:992]: 981 client connects (SSL_connect()) 2005.01.25 16:11:14 LOG7[2244:992]: 981 client connects that finished 2005.01.25 16:11:14 LOG7[2244:992]: 490 client renegotiatations requested 2005.01.25 16:11:14 LOG7[2244:992]: 0 server connects (SSL_accept()) 2005.01.25 16:11:14 LOG7[2244:992]: 0 server connects that finished 2005.01.25 16:11:14 LOG7[2244:992]: 0 server renegotiatiations requested 2005.01.25 16:11:14 LOG7[2244:992]: 488 session cache hits 2005.01.25 16:11:14 LOG7[2244:992]: 0 session cache misses 2005.01.25 16:11:14 LOG7[2244:992]: 0 session cache timeouts 2005.01.25 16:11:14 LOG6[2244:992]: SSL connected: previous session reused 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSL renegotiate ciphers 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 write client hello A 2005.01.25 16:11:15 LOG7[2244:992]: SSL_read returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:992]: SSL_write returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:992]: SSL_read returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:992]: SSL_write returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:992]: SSL_read returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 read server hello A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 read server certificate A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 read server certificate request A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 read server done A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 write client certificate A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 write client key exchange A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 write certificate verify A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 write change cipher spec A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 write finished A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 flush data 2005.01.25 16:11:15 LOG7[2244:992]: SSL_write returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:992]: SSL_read returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:2268]: HTTP finished (5 left) thanks and rgds,spl _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

Stunnel 4.05/4.07 Crash
by PinLee_Su＠azuretech.com.sg 28 Jan '05

28 Jan '05

Hi, I've initiated 11 stunnel processes in the same server. Each of the stunnel process has its own client certificate to communicate to application server. However after sometime of execution, the stunnel processes are crached (dying off) one by one. below is the last portion of my log (with debug level 7). I don't see any critical error in the log. Would appreciate if someone could highlight to me what cause the problem or anyone has similar experience. 2005.01.25 16:02:41 LOG7[2244:1424]: 0 server connects that finished 2005.01.25 16:02:41 LOG7[2244:1424]: 0 server renegotiatiations requested 2005.01.25 16:02:41 LOG7[2244:1424]: 486 session cache hits 2005.01.25 16:02:41 LOG7[2244:1424]: 0 session cache misses 2005.01.25 16:02:41 LOG7[2244:1424]: 0 session cache timeouts 2005.01.25 16:02:41 LOG7[2244:1424]: SSL_read returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1804]: SSL socket closed on SSL_read 2005.01.25 16:02:41 LOG5[2244:1804]: Connection closed: 716 bytes sent to SSL, 359 bytes sent to socket 2005.01.25 16:02:41 LOG7[2244:1804]: HTTP finished (7 left) 2005.01.25 16:02:41 LOG7[2244:1424]: SSL socket closed on SSL_read 2005.01.25 16:02:41 LOG5[2244:1424]: Connection closed: 716 bytes sent to SSL, 304 bytes sent to socket 2005.01.25 16:02:41 LOG7[2244:1424]: HTTP finished (6 left) 2005.01.25 16:02:41 LOG7[2244:2240]: HTTP accepted FD=516 from 10.3.5.137:1405 2005.01.25 16:02:41 LOG7[2244:2240]: FD 516 in non-blocking mode 2005.01.25 16:02:41 LOG7[2244:2240]: Creating a new thread 2005.01.25 16:02:41 LOG7[2244:2240]: New thread created 2005.01.25 16:02:41 LOG7[2244:1252]: HTTP started 2005.01.25 16:02:41 LOG5[2244:1252]: HTTP connected from 10.3.5.137:1405 2005.01.25 16:02:41 LOG7[2244:1252]: FD 704 in non-blocking mode 2005.01.25 16:02:41 LOG7[2244:1252]: HTTP connecting 10.1.11.56:443 2005.01.25 16:02:41 LOG7[2244:1252]: connect_wait: waiting 10 seconds 2005.01.25 16:02:41 LOG7[2244:1252]: connect_wait: connected 2005.01.25 16:02:41 LOG7[2244:1252]: Remote FD=704 initialized 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): before/connect initialization 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write client hello A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 read server hello A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 read finished A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write change cipher spec A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write finished A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 flush data 2005.01.25 16:02:41 LOG7[2244:1252]: 241 items in the session cache 2005.01.25 16:02:41 LOG7[2244:1252]: 979 client connects (SSL_connect()) 2005.01.25 16:02:41 LOG7[2244:1252]: 979 client connects that finished 2005.01.25 16:02:41 LOG7[2244:1252]: 489 client renegotiatations requested 2005.01.25 16:02:41 LOG7[2244:1252]: 0 server connects (SSL_accept()) 2005.01.25 16:02:41 LOG7[2244:1252]: 0 server connects that finished 2005.01.25 16:02:41 LOG7[2244:1252]: 0 server renegotiatiations requested 2005.01.25 16:02:41 LOG7[2244:1252]: 487 session cache hits 2005.01.25 16:02:41 LOG7[2244:1252]: 0 session cache misses 2005.01.25 16:02:41 LOG7[2244:1252]: 0 session cache timeouts 2005.01.25 16:02:41 LOG6[2244:1252]: SSL connected: previous session reused 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSL renegotiate ciphers 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write client hello A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_read returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_write returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_read returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_write returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_read returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 read server hello A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 read server certificate A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 read server certificate request A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 read server done A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write client certificate A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write client key exchange A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write certificate verify A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write change cipher spec A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write finished A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 flush data 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_write returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_read returned WANT_: retrying 2005.01.25 16:02:42 LOG7[2244:1252]: SSL state (connect): SSLv3 read finished A 2005.01.25 16:02:42 LOG7[2244:1252]: 242 items in the session cache 2005.01.25 16:02:42 LOG7[2244:1252]: 980 client connects (SSL_connect()) 2005.01.25 16:02:42 LOG7[2244:1252]: 980 client connects that finished 2005.01.25 16:02:42 LOG7[2244:1252]: 490 client renegotiatations requested 2005.01.25 16:02:42 LOG7[2244:1252]: 0 server connects (SSL_accept()) 2005.01.25 16:02:42 LOG7[2244:1252]: 0 server connects that finished 2005.01.25 16:02:42 LOG7[2244:1252]: 0 server renegotiatiations requested 2005.01.25 16:02:42 LOG7[2244:1252]: 487 session cache hits 2005.01.25 16:02:42 LOG7[2244:1252]: 0 session cache misses 2005.01.25 16:02:42 LOG7[2244:1252]: 0 session cache timeouts 2005.01.25 16:02:42 LOG7[2244:1252]: SSL_read returned WANT_: retrying 2005.01.25 16:02:43 LOG7[2244:2428]: s_poll_wait timeout waiting for SSL close_notify 2005.01.25 16:02:43 LOG7[2244:2284]: s_poll_wait timeout waiting for SSL close_notify 2005.01.25 16:02:43 LOG5[2244:2428]: Connection closed: 606 bytes sent to SSL, 242 bytes sent to socket 2005.01.25 16:02:43 LOG5[2244:2284]: Connection closed: 7758 bytes sent to SSL, 23278 bytes sent to socket 2005.01.25 16:02:43 LOG7[2244:2428]: HTTP finished (6 left) 2005.01.25 16:02:43 LOG7[2244:2284]: HTTP finished (5 left) 2005.01.25 16:02:45 LOG7[2244:1188]: s_poll_wait timeout waiting for SSL close_notify 2005.01.25 16:02:45 LOG5[2244:1188]: Connection closed: 1485 bytes sent to SSL, 7307 bytes sent to socket 2005.01.25 16:02:47 LOG7[2244:2228]: s_poll_wait timeout waiting for SSL close_notify 2005.01.25 16:02:47 LOG5[2244:2228]: Connection closed: 667 bytes sent to SSL, 552 bytes sent to socket 2005.01.25 16:02:49 LOG7[2244:1644]: s_poll_wait timeout waiting for SSL close_notify 2005.01.25 16:02:49 LOG5[2244:1644]: Connection closed: 667 bytes sent to SSL, 552 bytes sent to socket 2005.01.25 16:02:50 LOG7[2244:2268]: s_poll_wait timeout waiting for SSL close_notify 2005.01.25 16:02:50 LOG5[2244:2268]: Connection closed: 418 bytes sent to SSL, 1375 bytes sent to socket 2005.01.25 16:11:14 LOG7[2244:2240]: HTTP accepted FD=796 from 10.3.5.137:3973 2005.01.25 16:11:14 LOG7[2244:2240]: FD 796 in non-blocking mode 2005.01.25 16:11:14 LOG7[2244:2240]: Creating a new thread 2005.01.25 16:11:14 LOG7[2244:2240]: New thread created 2005.01.25 16:11:14 LOG7[2244:992]: HTTP started 2005.01.25 16:11:14 LOG5[2244:992]: HTTP connected from 10.3.5.137:3973 2005.01.25 16:11:14 LOG7[2244:992]: FD 632 in non-blocking mode 2005.01.25 16:11:14 LOG7[2244:992]: HTTP connecting 10.1.11.56:443 2005.01.25 16:11:14 LOG7[2244:992]: connect_wait: waiting 10 seconds 2005.01.25 16:11:14 LOG7[2244:992]: connect_wait: connected 2005.01.25 16:11:14 LOG7[2244:992]: Remote FD=632 initialized 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): before/connect initialization 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): SSLv3 write client hello A 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): SSLv3 read server hello A 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): SSLv3 read finished A 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): SSLv3 write change cipher spec A 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): SSLv3 write finished A 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): SSLv3 flush data 2005.01.25 16:11:14 LOG7[2244:992]: 242 items in the session cache 2005.01.25 16:11:14 LOG7[2244:992]: 981 client connects (SSL_connect()) 2005.01.25 16:11:14 LOG7[2244:992]: 981 client connects that finished 2005.01.25 16:11:14 LOG7[2244:992]: 490 client renegotiatations requested 2005.01.25 16:11:14 LOG7[2244:992]: 0 server connects (SSL_accept()) 2005.01.25 16:11:14 LOG7[2244:992]: 0 server connects that finished 2005.01.25 16:11:14 LOG7[2244:992]: 0 server renegotiatiations requested 2005.01.25 16:11:14 LOG7[2244:992]: 488 session cache hits 2005.01.25 16:11:14 LOG7[2244:992]: 0 session cache misses 2005.01.25 16:11:14 LOG7[2244:992]: 0 session cache timeouts 2005.01.25 16:11:14 LOG6[2244:992]: SSL connected: previous session reused 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSL renegotiate ciphers 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 write client hello A 2005.01.25 16:11:15 LOG7[2244:992]: SSL_read returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:992]: SSL_write returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:992]: SSL_read returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:992]: SSL_write returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:992]: SSL_read returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 read server hello A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 read server certificate A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 read server certificate request A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 read server done A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 write client certificate A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 write client key exchange A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 write certificate verify A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 write change cipher spec A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 write finished A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 flush data 2005.01.25 16:11:15 LOG7[2244:992]: SSL_write returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:992]: SSL_read returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:2268]: HTTP finished (5 left) thanks and rgds,spl

2 1

Stunnel 4.05/4.07 Crash
by PinLee_Su＠azuretech.com.sg 28 Jan '05

28 Jan '05

Hi, I've initiated 11 stunnel processes in the same server. Each of the stunnel process has its own client certificate to communicate to application server. However after sometime of execution, the stunnel processes are crached (dying off) one by one. below is the last portion of my log (with debug level 7). I don't see any critical error in the log. Would appreciate if someone could highlight to me what cause the problem or anyone has similar experience. 2005.01.25 16:02:41 LOG7[2244:1424]: 0 server connects that finished 2005.01.25 16:02:41 LOG7[2244:1424]: 0 server renegotiatiations requested 2005.01.25 16:02:41 LOG7[2244:1424]: 486 session cache hits 2005.01.25 16:02:41 LOG7[2244:1424]: 0 session cache misses 2005.01.25 16:02:41 LOG7[2244:1424]: 0 session cache timeouts 2005.01.25 16:02:41 LOG7[2244:1424]: SSL_read returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1804]: SSL socket closed on SSL_read 2005.01.25 16:02:41 LOG5[2244:1804]: Connection closed: 716 bytes sent to SSL, 359 bytes sent to socket 2005.01.25 16:02:41 LOG7[2244:1804]: HTTP finished (7 left) 2005.01.25 16:02:41 LOG7[2244:1424]: SSL socket closed on SSL_read 2005.01.25 16:02:41 LOG5[2244:1424]: Connection closed: 716 bytes sent to SSL, 304 bytes sent to socket 2005.01.25 16:02:41 LOG7[2244:1424]: HTTP finished (6 left) 2005.01.25 16:02:41 LOG7[2244:2240]: HTTP accepted FD=516 from 10.3.5.137:1405 2005.01.25 16:02:41 LOG7[2244:2240]: FD 516 in non-blocking mode 2005.01.25 16:02:41 LOG7[2244:2240]: Creating a new thread 2005.01.25 16:02:41 LOG7[2244:2240]: New thread created 2005.01.25 16:02:41 LOG7[2244:1252]: HTTP started 2005.01.25 16:02:41 LOG5[2244:1252]: HTTP connected from 10.3.5.137:1405 2005.01.25 16:02:41 LOG7[2244:1252]: FD 704 in non-blocking mode 2005.01.25 16:02:41 LOG7[2244:1252]: HTTP connecting 10.1.11.56:443 2005.01.25 16:02:41 LOG7[2244:1252]: connect_wait: waiting 10 seconds 2005.01.25 16:02:41 LOG7[2244:1252]: connect_wait: connected 2005.01.25 16:02:41 LOG7[2244:1252]: Remote FD=704 initialized 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): before/connect initialization 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write client hello A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 read server hello A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 read finished A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write change cipher spec A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write finished A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 flush data 2005.01.25 16:02:41 LOG7[2244:1252]: 241 items in the session cache 2005.01.25 16:02:41 LOG7[2244:1252]: 979 client connects (SSL_connect()) 2005.01.25 16:02:41 LOG7[2244:1252]: 979 client connects that finished 2005.01.25 16:02:41 LOG7[2244:1252]: 489 client renegotiatations requested 2005.01.25 16:02:41 LOG7[2244:1252]: 0 server connects (SSL_accept()) 2005.01.25 16:02:41 LOG7[2244:1252]: 0 server connects that finished 2005.01.25 16:02:41 LOG7[2244:1252]: 0 server renegotiatiations requested 2005.01.25 16:02:41 LOG7[2244:1252]: 487 session cache hits 2005.01.25 16:02:41 LOG7[2244:1252]: 0 session cache misses 2005.01.25 16:02:41 LOG7[2244:1252]: 0 session cache timeouts 2005.01.25 16:02:41 LOG6[2244:1252]: SSL connected: previous session reused 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSL renegotiate ciphers 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write client hello A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_read returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_write returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_read returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_write returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_read returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 read server hello A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 read server certificate A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 read server certificate request A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 read server done A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write client certificate A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write client key exchange A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write certificate verify A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write change cipher spec A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 write finished A 2005.01.25 16:02:41 LOG7[2244:1252]: SSL state (connect): SSLv3 flush data 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_write returned WANT_: retrying 2005.01.25 16:02:41 LOG7[2244:1252]: SSL_read returned WANT_: retrying 2005.01.25 16:02:42 LOG7[2244:1252]: SSL state (connect): SSLv3 read finished A 2005.01.25 16:02:42 LOG7[2244:1252]: 242 items in the session cache 2005.01.25 16:02:42 LOG7[2244:1252]: 980 client connects (SSL_connect()) 2005.01.25 16:02:42 LOG7[2244:1252]: 980 client connects that finished 2005.01.25 16:02:42 LOG7[2244:1252]: 490 client renegotiatations requested 2005.01.25 16:02:42 LOG7[2244:1252]: 0 server connects (SSL_accept()) 2005.01.25 16:02:42 LOG7[2244:1252]: 0 server connects that finished 2005.01.25 16:02:42 LOG7[2244:1252]: 0 server renegotiatiations requested 2005.01.25 16:02:42 LOG7[2244:1252]: 487 session cache hits 2005.01.25 16:02:42 LOG7[2244:1252]: 0 session cache misses 2005.01.25 16:02:42 LOG7[2244:1252]: 0 session cache timeouts 2005.01.25 16:02:42 LOG7[2244:1252]: SSL_read returned WANT_: retrying 2005.01.25 16:02:43 LOG7[2244:2428]: s_poll_wait timeout waiting for SSL close_notify 2005.01.25 16:02:43 LOG7[2244:2284]: s_poll_wait timeout waiting for SSL close_notify 2005.01.25 16:02:43 LOG5[2244:2428]: Connection closed: 606 bytes sent to SSL, 242 bytes sent to socket 2005.01.25 16:02:43 LOG5[2244:2284]: Connection closed: 7758 bytes sent to SSL, 23278 bytes sent to socket 2005.01.25 16:02:43 LOG7[2244:2428]: HTTP finished (6 left) 2005.01.25 16:02:43 LOG7[2244:2284]: HTTP finished (5 left) 2005.01.25 16:02:45 LOG7[2244:1188]: s_poll_wait timeout waiting for SSL close_notify 2005.01.25 16:02:45 LOG5[2244:1188]: Connection closed: 1485 bytes sent to SSL, 7307 bytes sent to socket 2005.01.25 16:02:47 LOG7[2244:2228]: s_poll_wait timeout waiting for SSL close_notify 2005.01.25 16:02:47 LOG5[2244:2228]: Connection closed: 667 bytes sent to SSL, 552 bytes sent to socket 2005.01.25 16:02:49 LOG7[2244:1644]: s_poll_wait timeout waiting for SSL close_notify 2005.01.25 16:02:49 LOG5[2244:1644]: Connection closed: 667 bytes sent to SSL, 552 bytes sent to socket 2005.01.25 16:02:50 LOG7[2244:2268]: s_poll_wait timeout waiting for SSL close_notify 2005.01.25 16:02:50 LOG5[2244:2268]: Connection closed: 418 bytes sent to SSL, 1375 bytes sent to socket 2005.01.25 16:11:14 LOG7[2244:2240]: HTTP accepted FD=796 from 10.3.5.137:3973 2005.01.25 16:11:14 LOG7[2244:2240]: FD 796 in non-blocking mode 2005.01.25 16:11:14 LOG7[2244:2240]: Creating a new thread 2005.01.25 16:11:14 LOG7[2244:2240]: New thread created 2005.01.25 16:11:14 LOG7[2244:992]: HTTP started 2005.01.25 16:11:14 LOG5[2244:992]: HTTP connected from 10.3.5.137:3973 2005.01.25 16:11:14 LOG7[2244:992]: FD 632 in non-blocking mode 2005.01.25 16:11:14 LOG7[2244:992]: HTTP connecting 10.1.11.56:443 2005.01.25 16:11:14 LOG7[2244:992]: connect_wait: waiting 10 seconds 2005.01.25 16:11:14 LOG7[2244:992]: connect_wait: connected 2005.01.25 16:11:14 LOG7[2244:992]: Remote FD=632 initialized 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): before/connect initialization 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): SSLv3 write client hello A 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): SSLv3 read server hello A 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): SSLv3 read finished A 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): SSLv3 write change cipher spec A 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): SSLv3 write finished A 2005.01.25 16:11:14 LOG7[2244:992]: SSL state (connect): SSLv3 flush data 2005.01.25 16:11:14 LOG7[2244:992]: 242 items in the session cache 2005.01.25 16:11:14 LOG7[2244:992]: 981 client connects (SSL_connect()) 2005.01.25 16:11:14 LOG7[2244:992]: 981 client connects that finished 2005.01.25 16:11:14 LOG7[2244:992]: 490 client renegotiatations requested 2005.01.25 16:11:14 LOG7[2244:992]: 0 server connects (SSL_accept()) 2005.01.25 16:11:14 LOG7[2244:992]: 0 server connects that finished 2005.01.25 16:11:14 LOG7[2244:992]: 0 server renegotiatiations requested 2005.01.25 16:11:14 LOG7[2244:992]: 488 session cache hits 2005.01.25 16:11:14 LOG7[2244:992]: 0 session cache misses 2005.01.25 16:11:14 LOG7[2244:992]: 0 session cache timeouts 2005.01.25 16:11:14 LOG6[2244:992]: SSL connected: previous session reused 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSL renegotiate ciphers 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 write client hello A 2005.01.25 16:11:15 LOG7[2244:992]: SSL_read returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:992]: SSL_write returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:992]: SSL_read returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:992]: SSL_write returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:992]: SSL_read returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 read server hello A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 read server certificate A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 read server certificate request A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 read server done A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 write client certificate A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 write client key exchange A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 write certificate verify A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 write change cipher spec A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 write finished A 2005.01.25 16:11:15 LOG7[2244:992]: SSL state (connect): SSLv3 flush data 2005.01.25 16:11:15 LOG7[2244:992]: SSL_write returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:992]: SSL_read returned WANT_: retrying 2005.01.25 16:11:15 LOG7[2244:2268]: HTTP finished (5 left) thanks and rgds,spl

1 0

Re: [stunnel-announce] cannot create pid
by higuita 27 Jan '05

27 Jan '05

Hi On Tue, 25 Jan 2005 14:15:45 -0500 "Humberto Morell" <morell(a)seg.inf.cu> wrote: > Hello list please use the stunnel-users instead of stunnel-anounce 8) > Cannot create pid file /var/run/stunnel.pid (...) > prueba:/usr/local/etc/stunnel # ls -l /var/run (...) > chroot = /var/lib/stunnel/ (...) > pid = /var/run/stunnel.pid so you cant create the pid, and you think that /var/run is correct, but you are forgeting that you enabled the chroot, so you have to check the /var/run inside the chroot, not your main /var/run directory (that the chroot stunnel cant access) check the /var/lib/stunnel/var/run and you will find that you dont have that directory or it have the wrong permissions good luck higuita -- Daniel Mota Leite Gestor de Sistemas/System Manager Centro de Computação Gráfica Tel: +351 253 439 300 Rua Teixeira de Pascoais, 596 Fax: +351 253 439 348 4800-073 Guimarães Portugal CCG and University of Minho are Members of the INI-GraphicsNet

1 0

Hi
by UHRA 27 Jan '05

27 Jan '05

Hi, I have problem with stunnel. I like to create stunnel on my server. I want to create SSL connection on IRCD server. I am using UnrealIRCD. I have installed Stunnel 4.07 and OpenSSL 0.9.7e. I have created certificates. I use this command stunnel -c -d 6668 -r irc.myserver.sk:6697 and then when I run ircd then display me thist error: [Mon Jan 24 18:27:49 2005] - Error binding stream socket to IP 0.0.0.0 port 6668 - irc.myserver.sk[]:Address already in use Can you help me ? thanks

3 2

Profiling STunnel
by Mark Swann 26 Jan '05

26 Jan '05

All, I need to do some performance profiling on STunnel. I assume gcov and gprof are the correct tools for this. Does anyone have any experience profiling STunnel? Any advice on how to do it properly would be appreciated. Thanks Mark Swann

1 0

Cannot find License.CM file
by Ranjit Mallick 26 Jan '05

26 Jan '05

Hi , I am new to stunnel , one of the previous develoeper has developed a application using Stunnel, essentially this app will work as a proxy to outside world and tunnel back to the remote server. On the server side the Stunnel has License.cm file and when ever I bring stunnel in CMD mode, it shows a message cannot find the License.cm file(even though it is there), Obviously the License file has expired or corrupted. How do I tell this tunnel.exe not to look for that file or how can I generate a license file(.cm)? Pls note that the tunnel has all the required files in it's directory tunnel.pem,tunnel.conf,ssleay32.dll,libeay32.dll,ssleay32.exp), pls help this is a show stopper and is effecting the client.Any leads or direction will be much appreciated. Thank you Ranjit __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

win32 stunnel - quiet service install
by joe smith 22 Jan '05

22 Jan '05

I would like to request the following feature be included in subsequent releases of stunnel. Cheers, Jeff Greetings, It would be great if while installing as a service on win32, there was an option to install quietly - i.e. only pop up a dialog box to the user if there's a problem. Any chance of somebody nice compiling me a binary that does this? :) M. -- Michael Brown {0x527670C0} | `One of the main causes of the fall of Systems Administrator | the Roman Empire was that, lacking zero, +1 519 888 7111 x2339 | they had no way to indicate successful michaelb at opentext.com | termination of their C programs.' - Firth --------------------------------- Do you Yahoo!? Yahoo! Search presents - Jib Jab's 'Second Term'

2 1

stunnel and verify
by Brian Hirt 21 Jan '05

21 Jan '05

Hi, I've recently set up stunnel for a remote vnc connection, and it's working great. However, I would like to restrict access based on cert (only allow access a single public key), because nobody else should be accessing it besides my one machine. It seems what i want is to set verify = 3, but I'm using self-signed certs on my client, so verify = 3 fails. Is there some way to verify the client public key without doing the self signed test too? I'm sorry if this is a faq -- i searched the lists and read the faq and couldn't find anything. Thanks! (I'm running stunnel 4.04 on fedora1, and stunnel 4.04 on mac 10.3.7, installed via fink) my stunnel.conf is pretty simple. client conf is (sans connection info) client = yes cert = /sw/etc/stunnel/stunnel.pem chroot = /var/run/stunnel/ pid = /stunnel.pid setuid = stunnel setgid = stunnel server conf is: client = no cert = /etc/stunnel/stunnel.pem CApath = /etc/stunnel/clientdb chroot = /var/run/stunnel/ verify=3 pid = /stunnel.pid setuid = stunnel setgid = stunnel -------------------------------------------- MobyGames http://www.mobygames.com The world's largest and most comprehensive gaming database project

1 0

Re: [stunnel-users] Activating Stunnel After Exiting (Newbie)
by Andre Tertling 20 Jan '05

20 Jan '05

[...] >Pack 2.) After close Agent, I right-click the Stunnel icon on the task >bar and choose Exit. If I try to activate Stunnel later, by >double-clicking its desktop icon, I am presented with an error window >headed "stunnel 4.07 on Win32" with the following message: "Failed to >create a new service". Looking at Properties on the desktop, I see that >the Target is "C:\stunnel\stunnel-4.07.exe -install". This looks wrong, >as it appears to be the option for initial installation of the program. I >assume I need to change this, or discover another method of re- [...] You already found the culprit. The command line option "-install" attempts to install the stunnel service. As it is already present in the services list, this has to fail. You can easily start and stop stunnel using the net command from a command line window: net start stunnel to start stunnel, or: net stop stunnel to shut it down again. You could make up a batch file to launch stunnel automatically for the time agent is running: --file runagent.cmd begin-- @echo off net stunnel start C:\Program Files\Agent!\Agent32.exe net stunnel stop --file runagent.cmd end-- Just edit the path for agent32.exe to match the path where you have Forté Agent installed, and you're done. P.S. I know net stunnel start can complain about that the service is already running, but that's just cosmetical and I was too lazy to implement logic to check if the service is already running ;) Best regards, Andre

1 1

Activating Stunnel After Exiting (Newbie)
by mhrtmhd94＠att.net 20 Jan '05

20 Jan '05

Hi. I just installed Stunnel, in order to be able to continue Agent as my mews reader. This works well. Based on the cautions on the website, I have decided to keep Stunnel active only when I am using Agent. Stunnel opens when I boot Windows - (XP Home Edition with Service Pack 2.) After close Agent, I right-click the Stunnel icon on the task bar and choose Exit. If I try to activate Stunnel later, by double-clicking its desktop icon, I am presented with an error window headed "stunnel 4.07 on Win32" with the following message: "Failed to create a new service". Looking at Properties on the desktop, I see that the Target is "C:\stunnel\stunnel-4.07.exe -install". This looks wrong, as it appears to be the option for initial installation of the program. I assume I need to change this, or discover another method of re-opening stunnel. As it stands now, I have to reboot to accomplish this. Any assistance will be appreciated. Thanks.

1 0

[email protected]
by eric wyzerski 17 Jan '05

17 Jan '05

Hi, Im trying to bind my 465 port tu my 25 port to have a ssl-smtp with the following command: stunnel -p /etc/stunnel.pem2 -d 465 -r localhost:25 However when I try to connect to port 465, I get the following error, stunnel[3443]: SSL_accept: Peer suddenly disconnected Any idea? Thank you Eric _________________________________________________________________ Take advantage of powerful junk e-mail filters built on patented Microsoft® SmartScreen Technology. http://join.msn.com/?pgmarket=en-ca&page=byoa/prem&xAPID=1994&DI=1034&SU=ht… Start enjoying all the benefits of MSN® Premium right now and get the first two months FREE*.

2 1

Problem with zlib compression
by Allan Guild 13 Jan '05

13 Jan '05

I'm having problems with zlib compression - stunnel 4.07 on my client machne crashes whenever I try and start a session. With compression set to rle or not defined, there is no problem. I am securing a MySQL connection between a Windows client and Mandrake Linux 10.1 server. Client Configuration: Stunnel 4.07 and openssl 0.9.7e-zlib binaries downloaded from Stunnel website stunnel.conf ------------ cert=./Allan_Guild_Work.pem key=./Allan_Guild_Work_key.pem client=yes compression=zlib [Primary Club] accept=3306 connect=195.137.78.107:3307 TIMEOUTbusy=5 ------------- Server Configuration: Stunnel 4.07 and openssl 0.9.7e (compiled with zlib support) rebuilt from Mandrake Cooker SRPMS stunnel.conf ------------ CApath=/etc/ssl/stunnel/certs/ cert=/etc/ssl/stunnel/CAcert.pem key=/etc/ssl/stunnel/CAkey.pem client=no foreground=yes pid=/var/run/stunnel.pid verify=0 compression=zlib [Primary Club] accept=3307 connect=3306 ------------ When I try and connect, I get the following output from the client (which then crashes): ------------- 2005.01.11 19:04:14 LOG5[308:2172]: stunnel 4.07 on x86-pc-mingw32-gnu WIN32+IPv4 with OpenSSL 0.9.7e 25 Oct 2004 2005.01.11 19:04:14 LOG5[308:1688]: No limit detected for the number of clients 2005.01.11 19:04:16 LOG5[308:804]: Primary Club connected from 127.0.0.1:4769 ------------- and the following from the server: ------------- 2005.01.11 19:21:30 LOG5[25439:1076523680]: stunnel 4.07 on i586-mandrake-linux-gnu PTHREAD+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004 2005.01.11 19:21:30 LOG5[25439:1076523680]: 500 clients allowed 2005.01.11 19:21:53 LOG5[25439:1073900464]: Primary Club connected from 212.135.219.66:3974 2005.01.11 19:21:53 LOG5[25439:1073900464]: VERIFY IGNORE: depth=0, /C=UK/ST=Some-State/L=London/O=Primary Club/CN=Allan Guild/emailAddress=allan.guild(a)bitsnpieces.org.uk 2005.01.11 19:21:53 LOG5[25439:1073900464]: VERIFY IGNORE: depth=0, /C=UK/ST=Some-State/L=London/O=Primary Club/CN=Allan Guild/emailAddress=allan.guild(a)bitsnpieces.org.uk 2005.01.11 19:21:57 LOG3[25439:1073900464]: SSL_read (ERROR_SYSCALL): Connection reset by peer (104) 2005.01.11 19:21:57 LOG5[25439:1073900464]: Connection reset: 3843 bytes sent to SSL, 55 bytes sent to socket ------------- Any advice would be greatly appreciated (Do I need a zlib dll?), Allan

2 2