- stunnel-users - stunnel.org

Client Authentication and CRL Verification
by Jean-Philippe Constant 16 Oct '12

16 Oct '12

Hi, I am using stunnel in server mode with mutual authentication. The PKI used to authenticate my client is the following : root CA -> Intermediate CA -> Client. My stunnel configuration is : CAfile = RootCA.pem CRLfile = IntermediateCACRL.pem verify = 2 RootCA.pem contains the Root CA certificate IntermediateCACRL.pem contains the CRL file of the Intermediate CA The client authentication with client certificate goes well. The problem occurs when a client certificate is revoked. After the Intermediate CA CRL updates, the client certificate is still accepted whereas it should be refused. With the following configuration the revoked certificate is refused : CAfile = IntermediateCA.pem CRLfile = IntermediateCACRL.pem verify = 2 but I would prefer using the first configuration. Everything happens like if stunnel checks the crl only for the CA certificate and not for the whole certification chain. Thank you for your answers, Jean-Philippe Constant

1 0

SSL proxy in Windows - IP Address Issue
by Brian McGinity 16 Oct '12

16 Oct '12

Thank you so much for stunnel. This program is amazing!!!! In Windows, I'd like to move SSL processing out of Apache and into stunnel. Is there a way for Apache to know the client's ip address? - In Windows, "transparent" mode is unavailable - "xforwardedfor" is for smtp and not https connections - "protocol = proxy" is for Haproxy only? Brian

2 3

Asterisk with stunnel
by manjula hettiarachchi 15 Oct '12

15 Oct '12

Hi List I am new to stunnel, Just tried today to send Asterisk SIP request to stunnel client and forward to stunnel-server --> asterisk on another machine. (server ip=x.x.x.x) (client ip=y.y.y.y) Client config: cert=/etc/stunnel/stunnel.pem client=yes pid=/tmp/stunnel.pid debug=7 output=/etc/stunnel/stunnel.log [sip] accept=16380 connect=x.x.x.x:17380 ================================ Server Config: cert=/etc/stunnel/stunnel.pem #client=no pid=/tmp/stunnel.pid debug=7 output=/etc/stunnel/stunel.log [sip-IN] accept=17380 connect=5060 When tried 'telnet localhost 16380 from client machine i could see packets coming to server. However when Asterisk sends a sip request to port 16380, exten => _X.,1,Dial(SIP/${EXTEN}@y.y.y.y:16380,20,rt) i dont see packets forwaded to the server. Pls advise if anyone has used this scenario Best Regards Manjula

2 1

Re: [stunnel-users] stunnel-users Digest, Vol 99, Issue 2
by Scott McKeown 10 Oct '12

10 Oct '12

Hi Michal, Thats great news and thank you for update. I think the 'renegotiation' option will be a great addition. -- With Kind Regards. Scott McKeown Loadbalancer.org http://www.loadbalancer.org

1 0

stunnel 4.54 released
by Michal Trojnara 09 Oct '12

09 Oct '12

Dear Users, I have released version 4.54 of stunnel. The ChangeLog entry: Version 4.54, 2012.10.09, urgency: MEDIUM: * New Win32 features - FIPS module updated to version 2.0. - OpenSSL DLLs updated to version 1.0.1c. - zlib DLL updated to version 1.2.7. - Engine DLLs added: 4758cca, aep, atalla, capi, chil, cswift, gmp, gost, nuron, padlock, sureware, ubsec. * Other new features - "session" option renamed to more readable "sessionCacheTimeout". The old name remains accepted for backward compatibility. - New service-level "sessionCacheSize" option to control session cache size. - New service-level option "reset" to control whether TCP RST flag is used to indicate errors. The default value is "reset = yes". - New service-level option "renegotiation" to disable SSL renegotiation. This feature is based on a public-domain patch by Janusz Dziemidowicz. - New FreeBSD socket options: IP_FREEBIND, IP_BINDANY, IPV6_BINDANY (thx to Janusz Dziemidowicz). - New parameters to configure TLS v1.1/v1.2 with OpenSSL version 1.0.1 or higher (thx to Henrik Riomar). * Bugfixes - Fixed "Application Failed to Initialize Properly (0xc0150002)" error. - Fixed missing SSL state debug log entries. - Fixed a race condition in libwrap code resulting in random stalls (thx to Andrew Skalski). - Session cache purged at configuration file reload to reduce memory leak. Remaining leak of a few kilobytes per section is yet to be fixed. - Fixed regression bug in "transparent = destination" functionality (thx to Stefan Lauterbach). This bug was introduced in stunnel 4.51. - "transparent = destination" is now a valid endpoint in inetd mode. - "delay = yes" fixed to work even if specified *after* "connect" option. - Multiple "connect" targets fixed to also work with delayed resolver. - The number of resolver retries of EAI_AGAIN error has been limited to 3 in order to prevent infinite loops.. Home page: https://www.stunnel.org/ <http://stunnel.mirt.net/> Download: https://www.stunnel.org/downloads.html <ftp://stunnel.mirt.net/stunnel/> SHA-256 hash for stunnel-4.54.tar.gz: b7e1b9e63569574dbdabee8af90b8ab88db3fe13dcb1268d59a1408c56e6de7b Best regards, Mike

1 0

How to forward client's IP address with stunnel on Windows
by Emmanuel Egensperger 08 Oct '12

08 Oct '12

Dear stunnel's users, I have search on google and try many things on stunnel's configuration to forward ip address, but nothing works ? I have found this option in the FAQ : transparent = source But it seems that it doesn't work on windows ? >Line 22: "transparent = source": Specified option name is not valid here >Server is down Is there any solution to my problem ? Have I done something wrong ? Best regards, Manu Egen

2 1

Timeouts and inetd mode
by Bruce Guenter 28 Sep '12

28 Sep '12

Hi. As far as I can tell, if stunnel is running in "inetd mode", at least TIMEOUTbusy does not work. In particularl, stunnel will never timeout waiting for the SSL handshake to complete. If I'm reading the sources right, this is because the code to set up the SSL session calls SSL_accept before checking for data on stdin, and stdin is never set to non-blocking mode (only newly created sockets and/or pipes are). Would it make sense to set stdin (and stdout) to non-blocking mode when timeouts are enabled? Something in init_local maybe? -- Bruce Guenter <bruce(a)untroubled.org> http://untroubled.org/

1 0

SNI with wildcard certificates
by Gustavo Machado 27 Sep '12

27 Sep '12

Hi, I would like to use SNI in combination with wildcard certificates. I currently have the following configuration: [https] accept = 443 connect = 80 TIMEOUTclose = 0 cert = C:\default.pem key = C:\default.key ;SNI Config ;========== [https_a] sni = https:one.org connect = 80 cert = C:\a.pem key = C:\a.key [https_a_wc] sni = https:*.one.org connect = 80 cert = C:\b.pem key = C:\b.key If I go to https://one.org then I can see a.pem in the browser. If I go to https://mysubdomain.one.org I see default.pem. What am I missing?? Thanks! Gustavo

2 1

Chain pem files
by Gustavo Machado 27 Sep '12

27 Sep '12

Hi guys, Sorry for the newbie question, but I have the following configuration for an HTTPS endpoint: [https_one] sni = https:one.org connect = 44300 cert = D:\node\https\default.crt key = D:\node\https\default.key It works wonders, however I need to provide to this configuration two more .pem files for "chain". How would go about doing that? Thanks, Gustavo

1 1

Stunnel build with openssl 1.0+
by Gustavo Machado 27 Sep '12

27 Sep '12

Hi guys, I would like to use SNI and looks like I need a build with openssl 1.0+ Can you guys point me to a download link to the installer for that build? Thanks, Gustavo

2 2

(no subject)
by larisaka＠yahoo.com 25 Sep '12

25 Sep '12

http://www.steam-n-gleam.com/wp-content/plugins/bookingbug/google.html?fs=z…

1 0

Stunnel blocks booting process when no network connectivity
by Muschi Stevenson 25 Sep '12

25 Sep '12

My stunnel implementation works fine when the network is plugged in but it does not start at all, which stops the whole boot process, when there is no network connected on the machine (as a client). As extra information: - I'm using "delay=yes" - I'm using an fqdn (e.g: stunnel.mydomain.com) for the connections - Using stunnel 4.53 - Using ubuntu 12.04 but this also happened with centos5 previously however after some time it did boot on centos which doesn't happen in ubuntu How can this be avoided or a timeout specified? Doing an strace as suggested by symcbean shows the following (including the last part where it hangs): [...] --- SIGCHLD (Child exited) @ 0 (0) --- rt_sigreturn(0x11) = 0 close(3) = 0 wait4(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 6039 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7ff9ce0c79d0) = 6046 wait4(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 6046 --- SIGCHLD (Child exited) @ 0 (0) --- rt_sigreturn(0x11) = 6046 write(1, "[Started: /etc/stunnel/stunnel.c"..., 37) = 37 write(1, "stunnel.\n", 9) = 9 exit_group(0) = ? [...] stunnel hangs in this line: wait4(-1, and when i plug in the network cable it continues to show [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 6046 Any help would be appreciated as this is critically blocking our deployment http://serverfault.com/questions/429072/stunnel-delaying-boot

2 6

[patch] options-related-to-TLS-v1.1-v1.2
by Henrik Riomar 21 Sep '12

21 Sep '12

Hi, When building stunnel against OpenSSL 1.0.1 support for TLS v1.1/v1.2 gets included. This patch adds options to configure these protocols in stunnel.conf. The patch is against 4.53 and under public domain. Best Regards, Henrik

2 3

"Broken pipe" issue
by Kai M. Becker 20 Sep '12

20 Sep '12

Hi :) although several postings state that this issue has been fixed, I'm still getting this error message: Error detected on SSL (read) file descriptor: Broken pipe (32) OS: OpenSuSE 11.4 stunnel: 4.53 The original problem for taking a closer look though, are hanging incoming connections. I.e. a https request is not forwarded to the backend application, but hangs somewhere in limbo. My current workaround are TIMEOUT* settings to kill these connections. Does anyone have some suggestions how to solve these issues? Kai -- == Kai M. Becker == kmb(a)kai-m-becker.de == Bremen, Germany == "Any technology distinguishable from magic is insufficiently advanced"

2 2

SSL renegotiation patch
by Janusz Dziemidowicz 19 Sep '12

19 Sep '12

Hi, since I couldn't find a better place I'm sending a simple patch that allows to disable SSL renegotiation here. Possible reasons for this: - famous renegotiation SSL flaw, patched in OpenSSL a long time ago, but not everyone can or want to upgrade OpenSSL - renegotiation makes some DoS attacks much easier (see http://www.thc.org/thc-ssl-dos/) regardless of it being a secure one or not - it is really not needed in many cases The approach is based on what is being done in Apache. The default is to allow renegotation, so there should be no surprises for anyone after upgrade. Patch applies on latest (4.54b4) stunnel beta. Feel free to comment:) -- Janusz Dziemidowicz

3 13

Re: [stunnel-users] Binding to non-local sockets
by Janusz Dziemidowicz 19 Sep '12

19 Sep '12

2012/9/12 Willy Tarreau <w(a)1wt.eu>: > Janusz, > > I just saw your mail on stunnel-users. You don't need to use IP_FREEBIND > to bind to a non-existent address under Linux. You can simply enable > sys.net.ipv4.ip_nonlocal_bind to do this. This is how most users deal > with VRRP setups. It does not allow the backup server to receive the > traffic aimed at the missing address, but it allows the process to bind > even when the address is missing so that it becomes operational upon a > switchover. I am aware of this sysctl. However, this will allows any process on the system to bind to any address. In my case I prefer to enable this on per process basis to avoid any possible configuration errors in any other service running on my machines. Since stunnel already had low level socket options exposed I've simply added IP_FREEBIND to the list;) -- Janusz Dziemidowicz

1 0

Re: [stunnel-users] Trouble with smtp client connection and TLS inWindows
by David Schomaker 13 Sep '12

13 Sep '12

Adding "protocol = smtp" was the solution to my problem. Thank you Leonardo! Regards, David Schomaker ----- Original Message ----- From: "Leandro Avila" <leandro.avila(a)ymail.com> To: "David Schomaker" <david(a)schomaker.net>, "stunnel" <stunnel-users(a)stunnel.org> Date: Thu, 13 Sep 2012 09:26:00 -0700 Subject: Re: [stunnel-users] Trouble with smtp client connection and TLS inWindows David, Perhaps the issue is on the server side. A quick look to the SMTP server on smtp.smarshmail.com will show 220 smtp.smarshmail.com ESMTP Service is ready on Server 1 (EQ). EHLO 250-smtp.smarshmail.com Hello [123.456.790.101] 250-SIZE 36700160 250-PIPELINING 250-DSN 250-ENHANCEDSTATUSCODES 250-STARTTLS 250-AUTH GSSAPI NTLM 250-8BITMIME 250-BINARYMIME 250 CHUNKING QUIT 221 2.0.0 Service closing transmission channel I would try adding the following option to your stunnel configuration protocol = smtp I'm not certain but looks like you need to issue the STARTTLS to negociate the secure connection with this server. Check the stunnel manual for further explanation on the option http://www.stunnel.org/static/stunnel.html Hope this helps ----------------- Leandro Avila ----- Original Message ----- From: David Schomaker <david(a)schomaker.net> To: stunnel <stunnel-users(a)stunnel.org> Cc: Sent: Monday, September 10, 2012 10:32 PM Subject: [stunnel-users] Trouble with smtp client connection and TLS in Windows I need to configure stunnel to connect to smtp via TLS and am not able to get it to work either running 4.53 or 4.54beta. Perhaps I have the conf file created incorrectly. The stunnel.conf is as follows: +++++++++++++++++++++++++++++++++++++++ ; Debugging stuff (may useful for troubleshooting) debug = 7 output = c:\temp\stunnel.log ; Disable FIPS mode to allow non-approved protocols and algorithms ;fips = no ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 [SMARSH-pop3] client = yes accept = 127.0.0.1:110 connect = pop.smarshmail.com:995 [SMARSH-smtp] client = yes SSLversion=TLSv1 accept = 127.0.0.1:25 connect = smtp.smarshmail.com:587 +++++++++++++++++++++++++ Pop works great. The log on an smtp session is as follows: +++++++++++++++++++++++++ 2012.09.10 12:48:31 LOG7[1984:300]: Service [SMARSH-smtp] accepted (FD=508) from 127.0.0.1:49517 2012.09.10 12:48:31 LOG7[1984:300]: Creating a new thread 2012.09.10 12:48:31 LOG7[1984:300]: New thread created 2012.09.10 12:48:31 LOG7[1984:2796]: Service [SMARSH-smtp] started 2012.09.10 12:48:31 LOG5[1984:2796]: Service [SMARSH-smtp] accepted connection from 127.0.0.1:49517 2012.09.10 12:48:31 LOG6[1984:2796]: connect_blocking: connecting 199.47.168.58:587 2012.09.10 12:48:31 LOG7[1984:2796]: connect_blocking: s_poll_wait 199.47.168.58:587: waiting 10 seconds 2012.09.10 12:48:31 LOG5[1984:2796]: connect_blocking: connected 199.47.168.58:587 2012.09.10 12:48:31 LOG5[1984:2796]: Service [SMARSH-smtp] connected remote server from 192.168.108.158:49518 2012.09.10 12:48:31 LOG7[1984:2796]: Remote socket (FD=528) initialized 2012.09.10 12:48:31 LOG7[1984:2796]: SNI: host name: smtp.smarshmail.com 2012.09.10 12:48:31 LOG7[1984:2796]: SSL state (connect): before/connect initialization 2012.09.10 12:48:31 LOG7[1984:2796]: SSL state (connect): SSLv3 write client hello A 2012.09.10 12:48:31 LOG7[1984:2796]: SSL alert (write): fatal: protocol version 2012.09.10 12:48:31 LOG3[1984:2796]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2012.09.10 12:48:31 LOG5[1984:2796]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2012.09.10 12:48:31 LOG7[1984:2796]: Remote socket (FD=528) closed 2012.09.10 12:48:31 LOG7[1984:2796]: Local socket (FD=508) closed 2012.09.10 12:48:31 LOG7[1984:2796]: Service [SMARSH-smtp] finished (0 left) 2012.09.10 12:48:40 LOG7[1984:300]: Dispatching signals from the signal pipe 2012.09.10 12:48:43 LOG7[1984:300]: Processing SIGNAL_TERMINATE 2012.09.10 12:48:43 LOG5[1984:300]: Terminated ++++++++++++++++++++++++++ Is sTunnel using SSLv3 rather than TLSv1? If so how do I force TLS? Thanks... _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users _______________________________________________ stunnel-users mailing list stunnel-users(a)stunnel.org https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

1 0

Trouble with smtp client connection and TLS in Windows
by David Schomaker 13 Sep '12

13 Sep '12

I need to configure stunnel to connect to smtp via TLS and am not able to get it to work either running 4.53 or 4.54beta. Perhaps I have the conf file created incorrectly. The stunnel.conf is as follows: +++++++++++++++++++++++++++++++++++++++ ; Debugging stuff (may useful for troubleshooting) debug = 7 output = c:\temp\stunnel.log ; Disable FIPS mode to allow non-approved protocols and algorithms ;fips = no ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 [SMARSH-pop3] client = yes accept = 127.0.0.1:110 connect = pop.smarshmail.com:995 [SMARSH-smtp] client = yes SSLversion=TLSv1 accept = 127.0.0.1:25 connect = smtp.smarshmail.com:587 +++++++++++++++++++++++++ Pop works great. The log on an smtp session is as follows: +++++++++++++++++++++++++ 2012.09.10 12:48:31 LOG7[1984:300]: Service [SMARSH-smtp] accepted (FD=508) from 127.0.0.1:49517 2012.09.10 12:48:31 LOG7[1984:300]: Creating a new thread 2012.09.10 12:48:31 LOG7[1984:300]: New thread created 2012.09.10 12:48:31 LOG7[1984:2796]: Service [SMARSH-smtp] started 2012.09.10 12:48:31 LOG5[1984:2796]: Service [SMARSH-smtp] accepted connection from 127.0.0.1:49517 2012.09.10 12:48:31 LOG6[1984:2796]: connect_blocking: connecting 199.47.168.58:587 2012.09.10 12:48:31 LOG7[1984:2796]: connect_blocking: s_poll_wait 199.47.168.58:587: waiting 10 seconds 2012.09.10 12:48:31 LOG5[1984:2796]: connect_blocking: connected 199.47.168.58:587 2012.09.10 12:48:31 LOG5[1984:2796]: Service [SMARSH-smtp] connected remote server from 192.168.108.158:49518 2012.09.10 12:48:31 LOG7[1984:2796]: Remote socket (FD=528) initialized 2012.09.10 12:48:31 LOG7[1984:2796]: SNI: host name: smtp.smarshmail.com 2012.09.10 12:48:31 LOG7[1984:2796]: SSL state (connect): before/connect initialization 2012.09.10 12:48:31 LOG7[1984:2796]: SSL state (connect): SSLv3 write client hello A 2012.09.10 12:48:31 LOG7[1984:2796]: SSL alert (write): fatal: protocol version 2012.09.10 12:48:31 LOG3[1984:2796]: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2012.09.10 12:48:31 LOG5[1984:2796]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2012.09.10 12:48:31 LOG7[1984:2796]: Remote socket (FD=528) closed 2012.09.10 12:48:31 LOG7[1984:2796]: Local socket (FD=508) closed 2012.09.10 12:48:31 LOG7[1984:2796]: Service [SMARSH-smtp] finished (0 left) 2012.09.10 12:48:40 LOG7[1984:300]: Dispatching signals from the signal pipe 2012.09.10 12:48:43 LOG7[1984:300]: Processing SIGNAL_TERMINATE 2012.09.10 12:48:43 LOG5[1984:300]: Terminated ++++++++++++++++++++++++++ Is sTunnel using SSLv3 rather than TLSv1? If so how do I force TLS? Thanks...

2 1

Stunnel message
by Philip Wong 13 Sep '12

13 Sep '12

Hi all, I'm still learning stunnel for my company support. l feel difficult to understand what's the meaning of some stunnel log message. Is there any doc listed the log messages with some explanation? Thanks, Philip

1 0

stunnel conf alternatives
by John A. Wallace 11 Sep '12

11 Sep '12

I have stunnel 4.53 on x86-pc-mingw32-gnu platform on Win7 OS. I use it minimally at this point but I would like to see whether I can expand my use of it if possible. When I installed it, I simply saved all the program's files into one folder without actually using the Windows installer program, and then I made some entries in the "stunnel.conf" to make it serve my purpose. Right now to start the program I can go to a Windows command prompt in the stunnel folder and type "stunnel stunnel.conf". Then a little icon appears in the notification area of Windows Taskbar. What would happen, I mean how would it differ, if I just typed "stunnel" instead of having to specify the "stunnel.conf" file too? And how would I be able to make use of it in that case? Thanks.

2 1

Binding to non-local sockets
by Janusz Dziemidowicz 09 Sep '12

09 Sep '12

Hi, attached is very simple patch that allows to set IP_FREEBIND under Linux (IP_BINDANY/IPV6_BINDANY under FreeBSD) on an accept socket. I've stumbled upon this need due to the following situation (which I believe might be quite common): - I've already had stunnel instance happily serving one website on port 443, single domain - a need occurred to set up another domain - SNI cannot be used, because Windows XP doesn't support it (and it is still a very large user base) - no problem, I thought, I have a few public IPs available, just set stunnel up on another IP - and here comes the problem, I have two frontend servers with VRRP configured to migrate public IP between them, only one server has the public IP at a time - under normal circumstances it is impossible to bind to an address that does not exist on the server (in case of one domain I've simply bound stunnel to 0.0.0.0) - starting stunnel manually when the address migrates is not an option (VRRP daemon probably can start it, but I was not happy with that solution, I want all services working constantly on both servers so there are no surprises in case of a failover) - setting IP_FREEBIND on accept socket solves the problem, stunnel is working on both machines and I can migrate the public IPs however I want As stunnel already exposes low level socket options, adding support for IP_FREEBIND is very simple. I've also added similar FreeBSD options (tested on FreeBSD 9.0). Oh, and the patch is public domain;) -- Janusz Dziemidowicz

1 0

SSL3_GET_RECORD:wrong version number
by Bob Tentinger 06 Sep '12

06 Sep '12

I have a POS application (SWIFTLINK) that uses Stunnel to send email on Windows XP. This is the error**************** SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number ***************** I have searched the Internet and none of the resolutions help.

2 1

Race condition in libwrap_auth can hang threads waiting on libwrap process
by Andrew Skalski 05 Sep '12

05 Sep '12

I ran into an issue with stunnel (verified with the latest version) where under certain conditions, client connections will hang in the "Waiting for a libwrap process" state. The problem is a race condition in src/libwrap.c: 170 --num_busy; /* the child process has been released */ 171 if(num_busy==num_processes-1) { /* need to wake up a thread */ 172 retval=pthread_cond_signal(&cond); /* signal waiting threads */ 173 if(retval) { 174 errno=retval; 175 ioerror("pthread_cond_signal"); 176 longjmp(c->err, 1); 177 } 178 } Removing the statement "if (num_busy==num_processes-1)" is one way to fix the problem. The conditions under which the race condition occur are: - All libwrap processes are busy, and multiple threads are waiting [num_busy == num_processes] - One thread releases its libwrap process (this signals one of the waiting threads) - Another thread releases its libwrap process before the signaled thread has a chance to acquire and increment num_busy. Once that happens, all queued threads are stuck waiting on the condition variable, until stunnel is hit with enough concurrent connections to max out num_busy again. (Depending on traffic patterns, this may not happen for a long time.) Andy Skalski

2 1

transpartent=destination setting fails with runtime error
by Stefan Lauterbach 03 Sep '12

03 Sep '12

*In the latest versions of stunnel including stunnel-4.54b8, activating the option for transparent destination with transparent=destination fails. The following error is found in the log with this configuration (tested on CentOS 6.2 and 6.3): INTERNAL ERROR: No target for remote socket This bug seems to be introduced with version 4.51 by rewriting the code and introducing additional sanity checks for the configuration. The following patch seems to resolve the problem: --- src/client.c.~1~ 2012-03-05 12:11:06.000000000 +0100 +++ src/client.c 2012-08-27 00:29:36.000000000 +0200 @@ -303,7 +303,7 @@ c->bind_addr=NULL; /* don't bind */ /* setup c->remote_fd, now */ - if(c->opt->option.remote) { /* try remote first for exec+connect targets */ + if(c->opt->option.remote || c->opt->option.transparent_dst) { /* try remote first for exec+connect targets */ c->remote_fd.fd=connect_remote(c); } else if(c->opt->option.program) { /* exec+connect uses local fd */ c->remote_fd.fd=connect_local(c); *

1 0

MySQL replication + SSL/stunnel
by Gareth Evans 27 Aug '12

27 Aug '12

Hello, I'm failing miserably to implement replication over any kind of SSL (that is, MySQL's native (alleged) SSL support) or stunnel. I'd be grateful for any tips or advice. I have tried using OpenSSL and MySQL in various flavours: CentOS 6.2, OpenSSL v1.0.0, MySQL v5.1.63 Ubuntu 12.04, OpenSSL v1.0.1, MySQL v 5.5.24 and stunnel4 on both - certs created with OpenSSL in each case. I get an eror 1045 access denied from the MySQL native SSL approach, and mysql -u ejbkslave -pejbkslavepw -h127.0.0.1 -P3307 ERROR 2013 (HY000): Lost connection to MySQL server at 'reading initial communication packet', system error: 104 from stunnel (connecting two Ubuntu 12.04 VM's on my PC, with the latest updates) - if you know what causes this error and/or could point me towards some good documentation, I'd be grateful. I've copied and amended stunnel.conf-sample and just added debug and accept/connect info in each case. I've seen various reports around the web that OpenSSL+MySQL don't work together at the moment, but it seems some people can repicate the problem while others can't - I've tried the previous version of OpenSSL (1.0.0e on Ubuntu) still without success. Most frustrating!! Thanks Gareth

2 1

Stunnel performance about multiple session
by Yuqiong Sun 27 Aug '12

27 Aug '12

Hi, I am using stunnel as an encrypted channel between one server and multiple clients. Each client will transfer a very small piece of data every 20 seconds. Therefore I want to compare the tradeoff between maintaining multiple sessions with tearing down and re-establish connection every time. I read the performance table in stunnel doc and got a brief idea, but I hope to evaluate the performance for my specific hardware and software setup to make a better decision. I guess my question is how to measure the Max. concurrent sessions? Should I start multiple stunnel instances on client side? Also, how can I tear down a connection automatically after each time data transfer? Thanks Yuqiong

2 1

Behavior
by Javier 17 Aug '12

17 Aug '12

Hi, I want to report 2 different behaviors, one, related to logs and, the other, to close delay. - About the logs, there is a funny thing. If you reload stunnel.conf the log style and amount of information differs from the starting one. I'm under Windows 2000 and these are the general options in stunnel.conf: debug = debug delay = yes output = stunnel.log fips = no The differences can be seen in the attached text file. First part is how is being seen if you don't reload the conf file. The second, after you reload. I, by myself, prefer the second log style. - About the close delay, I don't know when it started to happen (maybe in the version you removed the multiple instance of stunnel or maybe later), but what happens is that stunnel delays about 1-2 seconds to close. It didn't happen before. It was immediately. And has nothing to do with how many services you have, it delays with one service or ten services or… whatever. My system specs, the same as above. But it happens in Windows XP as well, and with the latest 4.54 beta too (the one that has removed the annoying app error (thank you so much for this :-) )). Have a look to them ;-) and confirm if possible :-) Thanks.

1 0

Stunnel high memory usage?
by Matt Wise 16 Aug '12

16 Aug '12

We use Stunnel 4.5.2 in our environment of Ubuntu 10.04/12.04 systems in various clouds. We're leveraging PGPool for SSL encryption of a lot of different types of traffic ... Zookeeper, Postgresql, and AMQP traffic are some examples for us. Mostly everything works great .. its fast, and very reliable. I've just noticed though that on a particular group of machines we are seeing really high memory usage on the Stunnel process that seems to grow and grow over time. I found this Stunnel process using over 350MB of ram yesterday ... and on an m1.small in Amazon, thats a big chunk! Here's our client config file: > cert = /etc/stunnel/localhost-pgpool.pem > key = /etc/stunnel/localhost-pgpool.key > CAfile = /etc/stunnel/localhost-pgpool_ca.pem > verify = 2 > delay = no > sslVersion = TLSv1 > client = yes > setuid = stunnel4 > setgid = stunnel4 > pid = /var/lib/stunnel4/localhost-pgpool.stunnel4.pid > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > TIMEOUTconnect = 2 > session = 86400 > debug = 4 > [localhost-pgpool] > accept = 127.0.0.1:5001 > failover = rr > connect = prod-pgpool1-uswest1:6433 > connect = prod-pgpool2-uswest1:6433 My first thought was that perhaps the Session cache was too large... so I dropped it to '3600'. Now instead of 360MB, I'm seeing Stunnel sit at around 170MB. Is the session ID cache just caching thousands and thousands of new session IDs without properly re-using them? It seems like the session ID cache should never have more than: Currently_Used_Session_IDs + Session_IDs_unused_but_last_used_within_the_last_hour Any thoughts on what might be going on? --Matt

1 0

Application Failed to Initialize Properly (0xc0150002)
by Thomas Eifert 09 Aug '12

09 Aug '12

New problem here. Stunnel version 4.53. I just did a fresh install of Windows XP Pro x86 SP3, and did all the Windows updates as well. Whenever I try to launch Stunnel or install the service, I get the error: "Application Failed to Initialize Properly (0xc0150002)" I've never seen this before. I thought it might have something to do with not having the Visual C++ Redistributables, so I installed those too, with the same result. Has anyone else seen this issue? Regards, Thomas -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

3 4

Stunnel waits for a long time if client does not negotiate SSL
by Denis Solovyov 09 Aug '12

09 Aug '12

Hello, I use stunnel 4.53 to provide pop3s for existing pop3 service. I start stunnel from xinetd, and then exec pop3 utility from stunnel. If a legal pop3s client connects to a server, everything's fine. But if I try to do "telnet host 995" with a simple telnet client and then just do nothing (or even close telnet client without quitting) stunnel process keeps waiting for a very long time (actually maybe forever, I just kill it). The last line in log in such case "Service [stunnel] accepted connection from xx.xx.xx.xx:xxxx". No stunnel TIMEOUT* options have effect in this situation. What can I do to avoid such "waiting"? Maybe stunnel should have something like "SSL negotiation timeout"? Or is there a way to emulate it? (Analyzing `ps` or `netstat` is a bad idea of course.) With the best regards, Denis Solovyov

2 3

Re: [stunnel-users] Application Failed to Initialize Properly (0xc0150002)
by Generic Poster 08 Aug '12

08 Aug '12

Hi Thomas, I have the exact same error when trying to run stunnel on a virtual XP machine under windows 7. I asked here and the only reply I got was that it sounded like a configuration problem. I have tried everything I can think of, but to no avail. I just gave up trying in the end. Wednesday, August 8, 2012, 2:20:43 AM, you wrote: > New problem here. Stunnel version 4.53. > I just did a fresh install of Windows XP Pro x86 SP3, and did all the > Windows updates as well. > Whenever I try to launch Stunnel or install the service, I get the error: > "Application Failed to Initialize Properly (0xc0150002)" > I've never seen this before. I thought it might have something to do > with not having the Visual C++ Redistributables, so I installed those too, > with the same result. > Has anyone else seen this issue? > Regards, > Thomas -- Best regards, GP

2 1

Getting Stunnel to Work Under Windows 7 64-bit
by Hacker, Dietmar 06 Aug '12

06 Aug '12

Some thoughts about a thread from may: Stunnel works ok under Windows7 64bit. But: There are some windows7-specific security restraints one should be aware of: Windows7 does not allow programs to have write-access to c:\program files and c:\program files (x86) (win7 64bit). You can find the logfile in hidden directory c:\users\Youruser\appdata\local\virtualstore\program files\stunnel\stunnel.log ( Youruser is the windows user which started stunnel ) If you want a common logfile for all users, either you install stunnel in another writeable directory (security risk ?) or if installing in program files change your stunnel.conf file to have the log file in a writeable directory e.g. c:\temp or the standard common data directory c:\programData (also a hidden directory ) I use stunnel as a service and defined "output = c:\programData\stunnel\stunnel.log" stunnel writes there and only users with admin access could change the logfile. Dietmar Hacker

1 0

Build stunnel 4.53 binaries for windows error
by Anton Tkachev 01 Aug '12

01 Aug '12

Hey Guys, I'm trying to build stunnel 4.53 binaries for windows on Debian Squeeze x86 using instructions in INSTALL.W32 file. I use the latest openssl-1.0.1c (libssl-dev debian package installed also). At the last step 'make stunnel.exe' returns following error: # make stunnel.exe i586-mingw32msvc-gcc -c -I/usr/src/openssl-0.9.8s-fips/inc32 -mthreads -fstack-protector -O2 -Wall -Wextra -Wno-long-long -pedantic -o str.obj str.c In file included from str.c:38: common.h:392:33: error: openssl/opensslconf.h: No such file or directory common.h:405:27: error: openssl/lhash.h: No such file or directory common.h:406:25: error: openssl/ssl.h: No such file or directory common.h:407:25: error: openssl/err.h: No such file or directory common.h:408:66: error: openssl/crypto.h: No such file or directory common.h:409:26: error: openssl/rand.h: No such file or directory common.h:411:25: error: openssl/md4.h: No such file or directory common.h:413:25: error: openssl/des.h: No such file or directory common.h:417:28: error: openssl/engine.h: No such file or directory In file included from str.c:38: common.h:449: warning: return type defaults to ‘int’ common.h: In function ‘STACK_OF’: common.h:449: error: expected declaration specifiers before ‘*’ token In file included from str.c:39: prototypes.h:50: error: storage class specified for parameter ‘LOG_MODE’ prototypes.h:61: error: storage class specified for parameter ‘SOCKADDR_UNION’ prototypes.h:64: error: expected specifier-qualifier-list before ‘SOCKADDR_UNION’ prototypes.h:67: warning: struct has no members prototypes.h:67: error: storage class specified for parameter ‘SOCKADDR_LIST’ prototypes.h:72: error: storage class specified for parameter ‘COMP_TYPE’ prototypes.h:78: error: expected specifier-qualifier-list before ‘COMP_TYPE’ prototypes.h:114: warning: struct has no members prototypes.h:114: error: storage class specified for parameter ‘GLOBAL_OPTIONS’ prototypes.h:116: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘global_options’ prototypes.h:124: error: expected specifier-qualifier-list before ‘SSL_CTX’ prototypes.h:222: error: storage class specified for parameter ‘SERVICE_OPTIONS’ prototypes.h:224: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘service_options’ prototypes.h:236: error: storage class specified for parameter ‘VAL_TYPE’ prototypes.h:244: error: storage class specified for parameter ‘OPT_UNION’ prototypes.h:250: error: expected specifier-qualifier-list before ‘VAL_TYPE’ prototypes.h:252: error: storage class specified for parameter ‘SOCK_OPT’ prototypes.h:256: error: storage class specified for parameter ‘CONF_TYPE’ prototypes.h:269: error: storage class specified for parameter ‘s_poll_set’ prototypes.h:278: error: storage class specified for parameter ‘DISK_FILE’ prototypes.h:285: error: storage class specified for parameter ‘FD’ prototypes.h:290: error: storage class specified for parameter ‘max_clients’ prototypes.h:291: error: storage class specified for parameter ‘num_clients’ prototypes.h:327: warning: parameter names (without types) in function declaration prototypes.h:347: error: storage class specified for parameter ‘cli_index’ prototypes.h:347: error: storage class specified for parameter ‘opt_index’ prototypes.h:350: error: expected ‘)’ before ‘*’ token prototypes.h:355: error: expected declaration specifiers or ‘...’ before ‘CONF_TYPE’ prototypes.h:361: error: expected specifier-qualifier-list before ‘SERVICE_OPTIONS’ prototypes.h:363: warning: struct has no members prototypes.h:363: error: storage class specified for parameter ‘UI_DATA’ prototypes.h:365: error: expected ‘)’ before ‘*’ token prototypes.h:370: error: expected ‘)’ before ‘*’ token prototypes.h:374: error: expected declaration specifiers before ‘s_poll_set’ prototypes.h:375: error: expected ‘)’ before ‘*’ token prototypes.h:376: error: expected ‘)’ before ‘*’ token prototypes.h:377: error: expected ‘)’ before ‘*’ token prototypes.h:378: error: expected ‘)’ before ‘*’ token prototypes.h:379: error: expected ‘)’ before ‘*’ token prototypes.h:380: error: expected ‘)’ before ‘*’ token prototypes.h:381: error: expected ‘)’ before ‘*’ token prototypes.h:401: error: expected specifier-qualifier-list before ‘SSL’ prototypes.h:422: error: storage class specified for parameter ‘CLI’ prototypes.h:424: error: expected declaration specifiers before ‘CLI’ prototypes.h:426: error: expected ‘)’ before ‘*’ token prototypes.h:430: error: expected ‘)’ before ‘*’ token prototypes.h:431: error: expected ‘)’ before ‘*’ token prototypes.h:432: error: expected ‘)’ before ‘*’ token prototypes.h:433: error: expected ‘)’ before ‘*’ token prototypes.h:434: error: expected ‘)’ before ‘*’ token prototypes.h:436: error: expected ‘)’ before ‘*’ token prototypes.h:450: error: storage class specified for parameter ‘PROTOCOL_TYPE’ prototypes.h:453: error: expected ‘)’ before ‘*’ token prototypes.h:457: error: expected ‘)’ before ‘*’ token prototypes.h:458: error: expected ‘)’ before ‘*’ token prototypes.h:459: error: expected ‘)’ before ‘*’ token prototypes.h:460: error: expected ‘)’ before ‘*’ token prototypes.h:461: error: expected ‘)’ before ‘*’ token prototypes.h:462: warning: type defaults to ‘int’ in declaration of ‘SOCKADDR_UNION’ prototypes.h:462: error: expected ‘;’, ‘,’ or ‘)’ before ‘*’ token prototypes.h:493: error: storage class specified for parameter ‘SECTION_CODE’ prototypes.h:495: warning: parameter names (without types) in function declaration prototypes.h:496: warning: parameter names (without types) in function declaration prototypes.h:500: error: expected declaration specifiers or ‘...’ before ‘CLI’ prototypes.h:526: error: storage class specified for parameter ‘hwnd’ prototypes.h:530: error: expected ‘)’ before ‘*’ token prototypes.h:535: error: storage class specified for parameter ‘GETADDRINFO’ prototypes.h:536: error: storage class specified for parameter ‘FREEADDRINFO’ prototypes.h:538: error: storage class specified for parameter ‘GETNAMEINFO’ prototypes.h:539: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘s_getaddrinfo’ prototypes.h:540: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘s_freeaddrinfo’ prototypes.h:541: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘s_getnameinfo’ prototypes.h:550: error: expected declaration specifiers before ‘DISK_FILE’ prototypes.h:551: error: expected ‘)’ before ‘*’ token prototypes.h:552: error: expected ‘)’ before ‘*’ token prototypes.h:553: error: expected ‘)’ before ‘*’ token prototypes.h:563: error: expected ‘)’ before ‘*’ token str.c:49: error: storage class specified for parameter ‘canary’ str.c:50: error: storage class specified for parameter ‘canary_initialized’ str.c:50: error: parameter ‘canary_initialized’ is initialized str.c:52: error: storage class specified for parameter ‘ALLOC_LIST’ str.c:55: error: expected specifier-qualifier-list before ‘ALLOC_LIST’ str.c:57: warning: struct has no members str.c:57: error: storage class specified for parameter ‘ALLOC_TLS’ str.c:60: error: expected specifier-qualifier-list before ‘ALLOC_LIST’ str.c:67: warning: struct has no members str.c:59: warning: empty declaration str.c:73: error: expected ‘)’ before ‘*’ token str.c:74: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘*’ token str.c:75: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘*’ token str.c:77: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:85: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:95: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:175: error: storage class specified for parameter ‘tls_index’ str.c:177: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:181: error: expected ‘)’ before ‘*’ token str.c:185: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘*’ token str.c:191: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:198: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:210: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:228: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:262: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:291: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:315: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:326: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘*’ token common.h:449: warning: type of ‘SSL_COMP’ defaults to ‘int’ str.c:175: error: declaration for parameter ‘tls_index’ but no such parameter str.c:57: error: declaration for parameter ‘ALLOC_TLS’ but no such parameter str.c:52: error: declaration for parameter ‘ALLOC_LIST’ but no such parameter str.c:50: error: declaration for parameter ‘canary_initialized’ but no such parameter str.c:49: error: declaration for parameter ‘canary’ but no such parameter prototypes.h:581: error: declaration for parameter ‘str_printf’ but no such parameter prototypes.h:580: error: declaration for parameter ‘str_vprintf’ but no such parameter prototypes.h:579: error: declaration for parameter ‘str_dup’ but no such parameter prototypes.h:577: error: declaration for parameter ‘str_free_debug’ but no such parameter prototypes.h:575: error: declaration for parameter ‘str_detach_debug’ but no such parameter prototypes.h:573: error: declaration for parameter ‘str_realloc_debug’ but no such parameter prototypes.h:571: error: declaration for parameter ‘str_alloc_debug’ but no such parameter prototypes.h:570: error: declaration for parameter ‘str_stats’ but no such parameter prototypes.h:569: error: declaration for parameter ‘str_cleanup’ but no such parameter prototypes.h:568: error: declaration for parameter ‘str_canary_init’ but no such parameter prototypes.h:567: error: declaration for parameter ‘str_init’ but no such parameter prototypes.h:562: error: declaration for parameter ‘libwrap_init’ but no such parameter prototypes.h:557: error: declaration for parameter ‘tstr2str’ but no such parameter prototypes.h:556: error: declaration for parameter ‘str2tstr’ but no such parameter prototypes.h:537: error: declaration for parameter ‘GETNAMEINFO’ but no such parameter prototypes.h:536: error: declaration for parameter ‘FREEADDRINFO’ but no such parameter prototypes.h:534: error: declaration for parameter ‘GETADDRINFO’ but no such parameter prototypes.h:528: error: declaration for parameter ‘passwd_cb’ but no such parameter prototypes.h:526: error: declaration for parameter ‘hwnd’ but no such parameter prototypes.h:500: error: declaration for parameter ‘create_client’ but no such parameter prototypes.h:499: error: declaration for parameter ‘stunnel_thread_id’ but no such parameter prototypes.h:498: error: declaration for parameter ‘stunnel_process_id’ but no such parameter prototypes.h:497: error: declaration for parameter ‘sthreads_init’ but no such parameter prototypes.h:496: error: declaration for parameter ‘leave_critical_section’ but no such parameter prototypes.h:495: error: declaration for parameter ‘enter_critical_section’ but no such parameter prototypes.h:493: error: declaration for parameter ‘SECTION_CODE’ but no such parameter prototypes.h:479: error: declaration for parameter ‘local_getnameinfo’ but no such parameter prototypes.h:463: error: declaration for parameter ‘s_gai_strerror’ but no such parameter prototypes.h:452: error: declaration for parameter ‘find_protocol_id’ but no such parameter prototypes.h:450: error: declaration for parameter ‘PROTOCOL_TYPE’ but no such parameter prototypes.h:425: error: declaration for parameter ‘client_thread’ but no such parameter prototypes.h:422: error: declaration for parameter ‘CLI’ but no such parameter prototypes.h:395: error: declaration for parameter ‘make_sockets’ but no such parameter prototypes.h:394: error: declaration for parameter ‘get_socket_error’ but no such parameter prototypes.h:393: error: declaration for parameter ‘set_socket_options’ but no such parameter prototypes.h:366: error: declaration for parameter ‘sslerror’ but no such parameter prototypes.h:363: error: declaration for parameter ‘UI_DATA’ but no such parameter prototypes.h:356: error: declaration for parameter ‘apply_conf’ but no such parameter prototypes.h:355: error: declaration for parameter ‘parse_conf’ but no such parameter prototypes.h:354: error: declaration for parameter ‘parse_commandline’ but no such parameter prototypes.h:349: error: declaration for parameter ‘ssl_init’ but no such parameter prototypes.h:347: error: declaration for parameter ‘opt_index’ but no such parameter prototypes.h:347: error: declaration for parameter ‘cli_index’ but no such parameter prototypes.h:343: error: declaration for parameter ‘pty_allocate’ but no such parameter prototypes.h:339: error: declaration for parameter ‘s_strerror’ but no such parameter prototypes.h:338: error: declaration for parameter ‘log_error’ but no such parameter prototypes.h:337: error: declaration for parameter ‘sockerror’ but no such parameter prototypes.h:336: error: declaration for parameter ‘ioerror’ but no such parameter prototypes.h:334: error: declaration for parameter ‘fatal_debug’ but no such parameter prototypes.h:328: error: declaration for parameter ‘s_log’ but no such parameter prototypes.h:327: error: declaration for parameter ‘log_flush’ but no such parameter prototypes.h:326: error: declaration for parameter ‘log_close’ but no such parameter prototypes.h:325: error: declaration for parameter ‘log_open’ but no such parameter prototypes.h:317: error: declaration for parameter ‘set_nonblock’ but no such parameter prototypes.h:316: error: declaration for parameter ‘s_accept’ but no such parameter prototypes.h:315: error: declaration for parameter ‘s_socketpair’ but no such parameter prototypes.h:314: error: declaration for parameter ‘s_pipe’ but no such parameter prototypes.h:313: error: declaration for parameter ‘s_socket’ but no such parameter prototypes.h:311: error: declaration for parameter ‘get_limits’ but no such parameter prototypes.h:306: error: declaration for parameter ‘stunnel_info’ but no such parameter prototypes.h:302: error: declaration for parameter ‘signal_post’ but no such parameter prototypes.h:298: error: declaration for parameter ‘bind_ports’ but no such parameter prototypes.h:297: error: declaration for parameter ‘unbind_ports’ but no such parameter prototypes.h:296: error: declaration for parameter ‘daemon_loop’ but no such parameter prototypes.h:295: error: declaration for parameter ‘main_configure’ but no such parameter prototypes.h:294: error: declaration for parameter ‘main_initialize’ but no such parameter prototypes.h:291: error: declaration for parameter ‘num_clients’ but no such parameter prototypes.h:290: error: declaration for parameter ‘max_clients’ but no such parameter prototypes.h:285: error: declaration for parameter ‘FD’ but no such parameter prototypes.h:278: error: declaration for parameter ‘DISK_FILE’ but no such parameter prototypes.h:269: error: declaration for parameter ‘s_poll_set’ but no such parameter prototypes.h:256: error: declaration for parameter ‘CONF_TYPE’ but no such parameter prototypes.h:252: error: declaration for parameter ‘SOCK_OPT’ but no such parameter prototypes.h:244: error: declaration for parameter ‘OPT_UNION’ but no such parameter prototypes.h:236: error: declaration for parameter ‘VAL_TYPE’ but no such parameter prototypes.h:222: error: declaration for parameter ‘SERVICE_OPTIONS’ but no such parameter prototypes.h:114: error: declaration for parameter ‘GLOBAL_OPTIONS’ but no such parameter prototypes.h:72: error: declaration for parameter ‘COMP_TYPE’ but no such parameter prototypes.h:67: error: declaration for parameter ‘SOCKADDR_LIST’ but no such parameter prototypes.h:61: error: declaration for parameter ‘SOCKADDR_UNION’ but no such parameter prototypes.h:50: error: declaration for parameter ‘LOG_MODE’ but no such parameter str.c:342: error: expected ‘{’ at end of input common.h:449: warning: unused parameter ‘SSL_COMP’ str.c:175: warning: unused parameter ‘tls_index’ str.c:57: warning: unused parameter ‘ALLOC_TLS’ str.c:52: warning: unused parameter ‘ALLOC_LIST’ str.c:50: warning: unused parameter ‘canary_initialized’ str.c:49: warning: unused parameter ‘canary’ prototypes.h:581: warning: unused parameter ‘str_printf’ prototypes.h:580: warning: unused parameter ‘str_vprintf’ prototypes.h:579: warning: unused parameter ‘str_dup’ prototypes.h:577: warning: unused parameter ‘str_free_debug’ prototypes.h:575: warning: unused parameter ‘str_detach_debug’ prototypes.h:573: warning: unused parameter ‘str_realloc_debug’ prototypes.h:571: warning: unused parameter ‘str_alloc_debug’ prototypes.h:570: warning: unused parameter ‘str_stats’ prototypes.h:569: warning: unused parameter ‘str_cleanup’ prototypes.h:568: warning: unused parameter ‘str_canary_init’ prototypes.h:567: warning: unused parameter ‘str_init’ prototypes.h:562: warning: unused parameter ‘libwrap_init’ prototypes.h:557: warning: unused parameter ‘tstr2str’ prototypes.h:556: warning: unused parameter ‘str2tstr’ prototypes.h:537: warning: unused parameter ‘GETNAMEINFO’ prototypes.h:536: warning: unused parameter ‘FREEADDRINFO’ prototypes.h:534: warning: unused parameter ‘GETADDRINFO’ prototypes.h:528: warning: unused parameter ‘passwd_cb’ prototypes.h:526: warning: unused parameter ‘hwnd’ prototypes.h:500: warning: unused parameter ‘create_client’ prototypes.h:499: warning: unused parameter ‘stunnel_thread_id’ prototypes.h:498: warning: unused parameter ‘stunnel_process_id’ prototypes.h:497: warning: unused parameter ‘sthreads_init’ prototypes.h:496: warning: unused parameter ‘leave_critical_section’ prototypes.h:495: warning: unused parameter ‘enter_critical_section’ prototypes.h:493: warning: unused parameter ‘SECTION_CODE’ prototypes.h:479: warning: unused parameter ‘local_getnameinfo’ prototypes.h:463: warning: unused parameter ‘s_gai_strerror’ prototypes.h:452: warning: unused parameter ‘find_protocol_id’ prototypes.h:450: warning: unused parameter ‘PROTOCOL_TYPE’ prototypes.h:425: warning: unused parameter ‘client_thread’ prototypes.h:422: warning: unused parameter ‘CLI’ prototypes.h:395: warning: unused parameter ‘make_sockets’ prototypes.h:394: warning: unused parameter ‘get_socket_error’ prototypes.h:393: warning: unused parameter ‘set_socket_options’ prototypes.h:366: warning: unused parameter ‘sslerror’ prototypes.h:363: warning: unused parameter ‘UI_DATA’ prototypes.h:356: warning: unused parameter ‘apply_conf’ prototypes.h:355: warning: unused parameter ‘parse_conf’ prototypes.h:354: warning: unused parameter ‘parse_commandline’ prototypes.h:349: warning: unused parameter ‘ssl_init’ prototypes.h:347: warning: unused parameter ‘opt_index’ prototypes.h:347: warning: unused parameter ‘cli_index’ prototypes.h:343: warning: unused parameter ‘pty_allocate’ prototypes.h:339: warning: unused parameter ‘s_strerror’ prototypes.h:338: warning: unused parameter ‘log_error’ prototypes.h:337: warning: unused parameter ‘sockerror’ prototypes.h:336: warning: unused parameter ‘ioerror’ prototypes.h:334: warning: unused parameter ‘fatal_debug’ prototypes.h:328: warning: unused parameter ‘s_log’ prototypes.h:327: warning: unused parameter ‘log_flush’ prototypes.h:326: warning: unused parameter ‘log_close’ prototypes.h:325: warning: unused parameter ‘log_open’ prototypes.h:317: warning: unused parameter ‘set_nonblock’ prototypes.h:316: warning: unused parameter ‘s_accept’ prototypes.h:315: warning: unused parameter ‘s_socketpair’ prototypes.h:314: warning: unused parameter ‘s_pipe’ prototypes.h:313: warning: unused parameter ‘s_socket’ prototypes.h:311: warning: unused parameter ‘get_limits’ prototypes.h:306: warning: unused parameter ‘stunnel_info’ prototypes.h:302: warning: unused parameter ‘signal_post’ prototypes.h:298: warning: unused parameter ‘bind_ports’ prototypes.h:297: warning: unused parameter ‘unbind_ports’ prototypes.h:296: warning: unused parameter ‘daemon_loop’ prototypes.h:295: warning: unused parameter ‘main_configure’ prototypes.h:294: warning: unused parameter ‘main_initialize’ prototypes.h:291: warning: unused parameter ‘num_clients’ prototypes.h:290: warning: unused parameter ‘max_clients’ prototypes.h:285: warning: unused parameter ‘FD’ prototypes.h:278: warning: unused parameter ‘DISK_FILE’ prototypes.h:269: warning: unused parameter ‘s_poll_set’ prototypes.h:256: warning: unused parameter ‘CONF_TYPE’ prototypes.h:252: warning: unused parameter ‘SOCK_OPT’ prototypes.h:244: warning: unused parameter ‘OPT_UNION’ prototypes.h:236: warning: unused parameter ‘VAL_TYPE’ prototypes.h:222: warning: unused parameter ‘SERVICE_OPTIONS’ prototypes.h:114: warning: unused parameter ‘GLOBAL_OPTIONS’ prototypes.h:72: warning: unused parameter ‘COMP_TYPE’ prototypes.h:67: warning: unused parameter ‘SOCKADDR_LIST’ prototypes.h:61: warning: unused parameter ‘SOCKADDR_UNION’ prototypes.h:50: warning: unused parameter ‘LOG_MODE’ make: *** [str.obj] Error 1 It seems it has hardcoded path to openssl (/usr/src/openssl-0.9.8s-fips). I tried to change this path to the right one in Makefile*, but with no luck - I get the same error. I also tried to build stunnel with openssl-0.9.8s, but openssl configure command from the instruction doesn't work: root@debian:/usr/src/openssl-0.9.8s-i586# ./Configure --cross-compile-prefix=i586-mingw32msvc- mingw shared zlib-dynamic Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [experimental-<cipher> ...] [-Dxxx] [-lxxx] [-Lxxx] [-fxxx] [-Kxxx] [no-hw-xxx|no-hw] [[no-]threads] [[no-]shared] [[no-]zlib|zlib-dynamic] [enable-montasm] [no-asm] [no-dso] [no-krb5] [386] [--prefix=DIR] [--openssldir=OPENSSLDIR] [--with-xxx[=vvv]] [--test-sanity] os/compiler[:flags] Regards, Anton.

3 11

"application failed to initialize properly"
by Generic Poster 31 Jul '12

31 Jul '12

Hello Stunnel-users, Whenever I run Stunnel from a Windows 7 Virtual XP machine I receive the following error message: --------------------------- stunnel.exe - Application Error --------------------------- The application failed to initialize properly (0xc0150002). Click on OK to terminate the application. --------------------------- Any ideas as to what causes it or how I can get around the problem? The result is the same regardless of version. -- Best regards, Generic

2 1

Newbie: Success, now failure???
by Roger Bohl (Sr.) 25 Jul '12

25 Jul '12

For several days, I've been using Stunnel (with Blat) successfully (possibly with no intervening re-boots). A day or so ago, the system was re booted Today, however, Stunnel failed. I got the following Stunnel reply message: No limit detected for the number of clients stunnel 4.53 on x86-pc-mingw32-gnu platform Compiled/running with OpenSSL 0.9.8s-fips 4 Jan 2012 Threading:WIN32 SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:SELECT+IPv6 Reading configuration from file stunnel.conf FIPS mode is enabled Compression not enabled Snagged 64 random bytes from .rnd Wrote 1024 new random bytes to .rnd PRNG seeded successfully Initializing inetd mode configuration Certificate: client.pem Certificate loaded Key file: client.pem Private key loaded SSL options set: 0x00000004 Accept option is not allowed in inetd mode Remove accept option or define a [section] Server is down The stunnel.conf file in the Stunnel directory is: CAfile = cert.pem cert = client.pem client = yes RNDfile = .rnd [gmail smtp] ; (I may have had this in or out before. In "cleaning up" various files, I may have thought this to be a comment, and removed it.) accept = 25 connect = smtp.gmail.com:465 The program fails both with and without the [gmail smtp] line included. Except, possibly, for removing ;[comment] lines, no other changes occurred. Can somebody give me a clue as to the cause, and suggest the fix. I'm running Windows Vista. (I found the 17+ page instruction file, by Michal Trojnara, but didn't see a solution, there.) Thanks. Roger Bohl rhbohl(a)gmail.com 707-939-8459 PDT

1 0

please unsubscribe my email - thx
by Rüdiger Konte 24 Jul '12

24 Jul '12

1 0

stunnel and http
by John 23 Jul '12

23 Jul '12

I am running the latest stunnel for Windows on 64-bit Win7 as an application, not as a service. I simply unzipped everything to one folder, configured the "stunnel.conf" file; and when I need to run the program, I can open a command prompt in its folder and type "stunnel stunnel.conf". It then reads my stunnel.conf file and works its magic. This works fine for capturing the data from those programs which I can configure to use localhost and a specific port because I can configure stunnel.conf with accept = ip.address:port Now I have a program that I want to use to download some text files from the internet using http or https. However, this program cannot be manually configured to make a connection with a certain IP and port. Instead, I have to give it an alias-like name, which it then maps to one of several different domain names, makes a DNS query for the IP and transmits to that address the instructions for downloading some text files. So, is it possible to have stunnel "capture" any and all http transports (port 80) or https transports (port 443) from a specific program, regardless of which IP that connection was destined for, so that I can then direct this data traffic from stunnel to socat or from stunnel to an http proxy which I can manually direct to a specific connection? Is this a kind of thing for which stunnel can be used? If so, where can I find the instructions for setting it up? Thanks.

2 2

Reboot Requires Manual: "service stunnel restart"
by John Vasko 21 Jul '12

21 Jul '12

On FreeBSD 9.0 stunnel 4.43 works fine after running "service stunnel restart", but stunnel fails loading on boot. My desired config includes: /usr/local/etc/stunnel/stunnel.conf -------------------------------------------- [attsmtp] client = yes verify = 0 accept = 2525 connect = smtp.att.yahoo.com:465 delay = yes Please advise. See below for messages after bootup: /var/run/stunnel/stunnel.log ------------------------------------ 2012.07.21 02:52:06 LOG7[1378:675300096]: No limit detected for the number of clients 2012.07.21 02:52:06 LOG7[1378:675300096]: signal_pipe: FD=3 allocated (non-blocking mode) 2012.07.21 02:52:06 LOG7[1378:675300096]: signal_pipe: FD=4 allocated (non-blocking mode) 2012.07.21 02:52:06 LOG5[1378:675300096]: stunnel 4.43 on i386-portbld-freebsd9.0 platform 2012.07.21 02:52:06 LOG5[1378:675300096]: Compiled/running with OpenSSL 1.0.0e 6 Sep 2011 2012.07.21 02:52:06 LOG5[1378:675300096]: Threading:PTHREAD SSL:ENGINE Auth:LIBWRAP Sockets:POLL,IPv6 2012.07.21 02:52:06 LOG5[1378:675300096]: Reading configuration from file /usr/local/etc/stunnel/stunnel.conf 2012.07.21 02:52:06 LOG7[1378:675300096]: Snagged 64 random bytes from //.rnd 2012.07.21 02:52:06 LOG7[1378:675300096]: Wrote 1024 new random bytes to //.rnd 2012.07.21 02:52:06 LOG7[1378:675300096]: PRNG seeded successfully 2012.07.21 02:52:08 LOG6[1378:675300096]: Initializing SSL context for service attsmtp 2012.07.21 02:52:08 LOG7[1378:675300096]: SSL options set: 0x00000004 2012.07.21 02:52:08 LOG6[1378:675300096]: SSL context initialized 2012.07.21 02:52:08 LOG5[1378:675300096]: Configuration successful 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=5 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=6 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=6 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=7 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=7 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=8 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=8 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=9 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=9 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=10 allocated (blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: accept socket: FD=11 allocated (non-blocking mode) 2012.07.21 02:52:08 LOG7[1378:675300096]: Option SO_REUSEADDR set on accept socket 2012.07.21 02:52:08 LOG7[1378:675300096]: Service attsmtp bound to 0.0.0.0:2525 2012.07.21 02:52:08 LOG7[1378:675300096]: Service attsmtp opened FD=11 2012.07.21 02:52:08 LOG7[1378:675300096]: Created pid file /stunnel.pid 2012.07.21 02:52:15 LOG7[1378:675300096]: Dispatching signals from the signal pipe 2012.07.21 02:52:15 LOG3[1378:675300096]: Received signal 2; terminating 2012.07.21 02:52:15 LOG7[1378:675300096]: str_stats: 43 block(s), 3554 byte(s) 2012.07.21 02:52:15 LOG7[1378:675300096]: removing pid file /stunnel.pid

1 1

Re: [stunnel-users] Reverse tunnel with middle server
by Javier 19 Jul '12

19 Jul '12

[To the mailing list: Sorry for these non-english messages, I started, previously, a private communication to avoid it] On Thu, 19 Jul 2012 20:26:45 +0200 "Jorge A." <curruscataphractus(a)gmail.com> wrote: > Hola Javier, > > Igual no me he explicado bien. Lo que quiero es conectar dos > máquinas, una dentro de una NAT detrás de un router que no tiene > redirigidos los puertos a la máquina claro, pero que sí tiene > Internet y acceso a la máquina servidor. Esto me sigue sin quedar claro. Ya perdonarás. Una (Objetivo) está conectada a un router, que sirve internet a una red local, pero que no tiene redirigidos los puertos a la máquina que tiene el servidor http. Esta no tiene acceso a internet porque no se le ha configurado una puerta de enlace y además no la pueden alcanzar porque no hay puertos redirigidos hacia ella. Hasta ahí, todo bien ;) Lo que quería saber es si la máquina que hace de Servidor hacia internet está en la misma subred local o no que la máquina objetivo. El que la máquina objetivo vea al servidor no implica necesariamente que el servidor vea al objetivo. Además, si está conectada al mismo router, porque decías que era accesible desde internet. Lo que entiendo es que quieres redirigir el tráfico proveniente al servidor desde el exterior al objetivo http. Si el servidor, ve a la máquina http, bastaría con decir en la configuración de stunnel que conecte con el servidor http de esa maquina indicándole la ip:puerto. Por eso te dije que no tenía mayor complicación. En esa configuración no hace falta que la máquina objetivo tenga un servidor stunnel y viceversa para comunicarse entre ellos. La comunicación entre el servidor y la máquina objetivo puede ser abierta sin problemas. Lo importante ya existe, que el servidor haga de puente ssl entre internet y el objetivo http. > Durante el día de hoy lo he conseguido hacer más o menos usando > pppd y stunnel entre 2 linux pero no sé si sería posible hacerlo > sólo con stunnel (y *ifconfig*, *ip*, *route* o similares). Sobre > todo porque la máquina cliente objetivo está bastante limitada y no > puedo instalar de manera fácil pppd (tiene un kernel custom, hay > que compilar el módulo pppd del kernel, el demonio, etc). > > Lo que estoy mirando ahora es el comando *ip tunnel* para per si > puedo hacer algo parecido con pppd pero no sé si me estoy dando > golpes contra la pared. > > Muchas gracias de antemano por tu ayuda. De nada, aunque con Linux he topado. Conozco muy por encima los comandos. Pero, olvidándonos de las herramientas a utilizar, sabiendo exactamente el entorno en el que están esas máquinas, todo es coser y cantar, a no ser que sea un imposible ;) De ahí la importancia de saber si están en la misma red local o no, etc. Saludos.

1 1

Reverse tunnel with middle server
by Jorge A. 18 Jul '12

18 Jul '12

Hi everyone, I've search into archives trying to found a solution for my problem without success. The problem is simple: make a machine available on HTTP port when it's behind a e.g. common DSL. I have a middle server for which I have full access to install any program, linux. What I was trying to do is the following: Three machines: Middle server (Server), Target (linux machine behind DSL) and Client. Same stunnel version on both Server and Target. Latests. Server is available on the Internet, running stunnel Target is behind a nat router, e.g. inside a common DSL. I assume this must run stunnel as well. Client connects to Server and Server forwards traffic to Target seamlessly. As far as I know, running stunnel on client mode from e.g. Target and trying to connect to whichever service on Server does not work on reverse: you cannot connect backwards to target. Am I correct? If not, how do I configure both ends and how do I know port to use to connect to Target (log file?) ? What I've tested: 1. Run stunnel on Server on server mode accepting ('accept') connections on a fixed port, e.g. 5000. Here, as far as I know, you must define the 'connect' directive to forward traffic to either local or remote host. The problem is, from Server, you don't know Target ip nor it's accessible 2. Run stunnel on Server and, on Target launch stunnel on client mode to try Thanks in advance and congratulations as it's a great piece of software. Best regards, Jorge

1 0

Stunnel on WIndows Server 2008 R2 SP1 x 64 fails - Microsoft.VC90.CRT.MANIFEST
by Rüdiger Konte 15 Jul '12

15 Jul '12

Hi Stunnel users, I am trying to run stunnel "4.53 installer.exe" on a MS Windows Server 2008 R2 SP1 64 Bit (under VMWARE Workstation 6.5 as a virtual system; Physical Host OS is WIN7 Ultimate 32 BIT) The installation of stunnel was done as an "Administrator" and it ran through without issues. But I cannot se any service running. And when I try to launch the stunnel shortcut on the desktop, i got a error message like: "The application was unable to start correctly (0xc0150002). Click OK to close the application." I assume it has something to do with the Microsoft.VC90.CRT.MANIFEST file. But i am not an expert. This is shown in the Event log: ########################## Protokollname: Application Quelle: SideBySide Datum: 15.07.2012 12:17:01 Ereignis-ID: 35 Aufgabenkategorie:Keine Ebene: Fehler Schlüsselwörter:Klassisch Benutzer: Nicht zutreffend Computer: WIN-C1K2E115MV1 Beschreibung: Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files (x86)\stunnel\LIBEAY32.dll". Fehler in Manifest- oder Richtliniendatei "C:\Program Files (x86)\stunnel\Microsoft.VC90.CRT.MANIFEST" in Zeile 4. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8". Definition: Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Ereignis-XML: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="SideBySide" /> <EventID Qualifiers="49409">35</EventID> <Level>2</Level> <Task>0</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2012-07-15T10:17:01.000000000Z" /> <EventRecordID>197</EventRecordID> <Channel>Application</Channel> <Computer>WIN-C1K2E115MV1</Computer> <Security /> </System> <EventData> <Data>Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"</Data> <Data>Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161"</Data> <Data>C:\Program Files (x86)\stunnel\LIBEAY32.dll</Data> <Data>C:\Program Files (x86)\stunnel\Microsoft.VC90.CRT.MANIFEST</Data> <Data>4</Data> ########################## I ran the MS tool sxstrace.exe to get more details: See the outcome below: ######################################### INFORMATION: Die Manifestsdefinitionsidentität ist "Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161"". FEHLER: Die im Manifest gefundene Komponentenidentität stimmt nicht mit der Identität der angeforderten Komponente überein. Verweis: Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8". Definition: Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161". FEHLER: Bei der Generierung des Aktivierungskontextes ist ein Fehler aufgetreten. Beendet die Generierung des Aktivierungskontextes. ######################################### Is anything missing? .NET or another library ? Note: I installed on the same server in a different snapshot stunnel version 4.4 and it seems to work, at least no error message. But i want to use the latest version. Any help would be nice. Best Rudi

1 0

Conf question: HTTP to HTTPS with SNI
by John Moser 03 Jul '12

03 Jul '12

I have a particular task I need to accomplish in which an HTTP-only caching proxy server is to accept SSL. The architecture in mind is as follows: - Receive request { HTTP request: - Received by caching proxy at localhost:80 HTTPS request: - Received by Pound - Decoded to HTTP - X-FROM-SSL header added - Forwarded to localhost:80 (caching proxy) } Proxy receives HTTP request - Perform caching - If X-FROM-SSL, forward to localhost:8088 - Else forward to HTTP server It is at this point that two design options come into play, both using stunnel. Either use SNI or use stunnel and HTTP. Via SNI, this would appear as follows: Stunnel receives HTTP request - Forward to https://http-server:443/ with SNI This of course requires that stunnel can read the 'Host' header out of an HTTP request and use that for SNI automatically (there's some 300 virtual hosts on that server). If not, this is infeasible. Which is my question, of course: can this be done? If this isn't an option, then the next logical way to handle this problem is: Stunnel receives HTTP request: - SSL encrypt - Forward to http-server:8443 http-server receives HTTP over stunnel - stunnel receives on http-server:8443 - Decrypt and forward to http://localhost:80/ In this way the entire connection would be encrypted, and the HTTP server would see the Host: header and use that to figure out the virtual host etc. Is that the better/only way?

1 0

more than 1000 concurrent connections?
by Trenton Ashburn 03 Jul '12

03 Jul '12

Hi There - I'd like to use stunnel as the SSL termination point for a bunch of persistent TCP connections. I'm running it on an EC2 instance and it's only allowing me about 1000 concurrent connections. It doesn't matter if the connections come from one client IP or two. How can I raise this limit? I've already raised the OS tcp connection limit with ulimit and it doesn't improve things. Thanks, T

4 5

Re: [stunnel-users] Interoperability problems with .net client software
by josealf＠rocketmail.com 30 Jun '12

30 Jun '12

Not as far as I know. You need to check with the client application developers. Maybe they can use a debugger to trace the program flow and see where and why it fails (assuming they understand the protocols and the tools). The application must be coded to present the certificate, and my guess (just a guess), is that it isn't or is blocking before getting to that point. -----Original Message----- From: ProPharma Systems AG - Gregor Bürgisser <g.buergisser(a)propharma.ch> Date: Fri, 29 Jun 2012 06:59:14 To: <josealf(a)rocketmail.com> Subject: Re: [stunnel-users] Interoperability problems with .net client software Yes I did. Also the CA used to sign the server cert. All to no avail. Do you know if there are any (known) interoperability issues between stunnel and .net applications? On 06/28/2012 02:05 PM, josealf(a)rocketmail.com wrote: > Looks like your client is not presenting the certificate to the stunnel server. Maybe because it does not trust the server certificate? Did you import your stunnel server cert into windows certificate store? > > > -----Original Message----- > From: ProPharma Systems AG - Gregor Bürgisser > <g.buergisser(a)propharma.ch> > Sender: stunnel-users-bounces(a)stunnel.org > Date: Thu, 28 Jun 2012 12:48:53 > To:<stunnel-users(a)stunnel.org> > Subject: [stunnel-users] Interoperability problems with .net client software > > Hi all, > > I'm using stunnel 4.53 under Linux to secure a service. There are two > different clients connecting to this service: My own client, also Linux > based and using libcurl and another (third party!) client being > developed using Microsoft .net stuff. > > Of course with my own client all works well. But we are not able to get > the Microsoft client running. stunnel keeps on telling: > > SSL_accept: 140890C7: error:140890C7:SSL > routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate > > We have tried diffierent things... I will outline them here if you think > it is helpful (in short: tried using certificates generated on the > Microsoft side, then tried using certificates created on the Linux side). > If "verify" ist set to 0 or 1 it works (of course) but with a higher > value the above message is logged. > > Are there any known pitfalls, problems or whatsoever when using stunnel > with a .net client? > Any advice would be appreciated! > > Regards, > Gregor > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > http://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

clean installation on Windows
by John 29 Jun '12

29 Jun '12

Hello. I would like to install stunnel on 64-bit Win7, and I would like to know whether it is possible to do so by just unzipping the downloaded files into one folder and then clicking on the main executable, that is, to avoid making registry entries, etc. I would like to have a minimal impact to whatever extent is possible. Can it be done in this way, or does it need the whole shebang installer procedure to be run?

4 5

Stunnel, Pan and the SSL23_GET_SERVER_HELLO:unknown protocol
by mike 28 Jun '12

28 Jun '12

Hello All, Running Debian 6.0, stunnel4 and Pan 0.133 I have set up Pan and installed stunnel so that I can use ssl with nntp. Installing Pan and stunnel was easy. I've edited Pan to use localhost:119 and edited my config file in stunnel to point to my nntp server. I have allowed nntp in my hosts.allow for ALL:ALL. The problem I am running into is that Pan does not connect. I get the following error: Error reading from localhost. Connection reset by peer Checking with the following openssl command produced this error: root@triglav:/etc/stunnel# openssl s_client -ssl3 -connect localhost:119 CONNECTED(00000003) write:errno=104 Looking at the logs for stunnel I see many repetitions of this message: 2012.06.25 14:18:26 LOG7[16355:3074153328]: nntp started 2012.06.25 14:18:26 LOG7[16355:3074153328]: FD 13 in non-blocking mode 2012.06.25 14:18:26 LOG7[16355:3074153328]: TCP_NODELAY option set on local socket 2012.06.25 14:18:26 LOG7[16355:3074153328]: Waiting for a libwrap process 2012.06.25 14:18:26 LOG7[16355:3074153328]: Acquired libwrap process #0 2012.06.25 14:18:26 LOG7[16355:3074153328]: Releasing libwrap process #0 2012.06.25 14:18:26 LOG7[16355:3074153328]: Released libwrap process #0 2012.06.25 14:18:26 LOG7[16355:3074153328]: nntp permitted by libwrap from 127.0.0.1:59451 2012.06.25 14:18:26 LOG5[16355:3074153328]: nntp accepted connection from 127.0.0.1:59451 2012.06.25 14:18:26 LOG7[16355:3074153328]: FD 14 in non-blocking mode 2012.06.25 14:18:26 LOG6[16355:3074153328]: connect_blocking: connecting 209.197.15.238:119 2012.06.25 14:18:26 LOG7[16355:3074153328]: connect_blocking: s_poll_wait 209.197.15.238:119: waiting 10 seconds 2012.06.25 14:18:26 LOG5[16355:3074153328]: connect_blocking: connected 209.197.15.238:119 2012.06.25 14:18:26 LOG5[16355:3074153328]: nntp connected remote server from 192.168.2.56:51455 2012.06.25 14:18:26 LOG7[16355:3074153328]: Remote FD=14 initialized 2012.06.25 14:18:26 LOG7[16355:3074153328]: TCP_NODELAY option set on remote socket 2012.06.25 14:18:26 LOG7[16355:3074153328]: SSL state (connect): before/connect initialization 2012.06.25 14:18:26 LOG7[16355:3074153328]: SSL state (connect): SSLv2/v3 write client hello A 2012.06.25 14:18:26 LOG3[16355:3074153328]: SSL_connect: 140770FC: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol 2012.06.25 14:18:26 LOG5[16355:3074153328]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2012.06.25 14:18:26 LOG7[16355:3074153328]: nntp finished (0 left) Anyone know what is missing? It almost looks like it cant talk in either SSLv2 or v3 which makes no sense. Here is my stunnel config: ; Sample stunnel configuration file by Michal Trojnara 2002-2009 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of the chroot jail) ; Certificate/key is needed in server mode and optional in client mode ;cert = /etc/ssl/certs/stunnel.pem ;key = /etc/ssl/certs/stunnel.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = all ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 ; PID is created inside the chroot jail pid = /stunnel4.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = zlib ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = /var/log/stunnel4/stunnel.log foreground = no ; Use it for client mode client = yes ; Service-level configuration [nntp] accept = localhost:119 connect = news.aliant.net:119 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini

2 4

Interoperability problems with .net client software
by ProPharma Systems AG - Gregor Bürgisser 28 Jun '12

28 Jun '12

Hi all, I'm using stunnel 4.53 under Linux to secure a service. There are two different clients connecting to this service: My own client, also Linux based and using libcurl and another (third party!) client being developed using Microsoft .net stuff. Of course with my own client all works well. But we are not able to get the Microsoft client running. stunnel keeps on telling: SSL_accept: 140890C7: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate We have tried diffierent things... I will outline them here if you think it is helpful (in short: tried using certificates generated on the Microsoft side, then tried using certificates created on the Linux side). If "verify" ist set to 0 or 1 it works (of course) but with a higher value the above message is logged. Are there any known pitfalls, problems or whatsoever when using stunnel with a .net client? Any advice would be appreciated! Regards, Gregor

2 1

Accept on same port to ethernet aliases
by John Morrison 27 Jun '12

27 Jun '12

Hi, Is it possible to configure stunnel to use the same port on different IP addresses that are Ethernet aliases? I have successfully set up a configuration file accepting SSL connections. Firstly I did this on all IP addresses by using the following configuration lines: accept = 443 connect = 80 This worked correctly. I then attempted to setup a second configuration file on an aliased Ethernet address. The configuration file settings are: test1.conf accept = 10.168.1.132:443 connect = 10.168.1.132:80 test2.conf accept = 10.168.1.133:443 connect = 10.168.1.133:80 Stunnel is able to start the first configuration file, but not the second. The error message I can see when I run the second configuration file in the foreground is: accept socket: FD=11 allocated (non-blocking mode) Option SO_REUSEADDR set on accept socket Error binding https to 10.168.1.133:443 bind: Address already in use (98) and if I telnet to 10.168.1.133 on port 443 the connection is accepted. I have attempted to use the binding socket options in the configuration files as described in the manual: socket = a:SO_BINDTODEVICE=eth0:0 and socket = a:SO_BINDTODEVICE=eth0:1 However in this case stunnel will not start either configuration file. The error message I receive is: Option SO_REUSEADDR set on accept socket SO_BINDTODEVICE: No such device (19) Is there a different way to configure stunnel to allow this to work? My ipconfig settings are below. I am running the ubuntu 10.04 version of stunnel. The version output is: stunnel 4.35 on x86_64-pc-linux-gnu with OpenSSL 1.0.0e 6 Sep 2011 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Thanks, John eth0:0 Link encap:Ethernet HWaddr 3c:4a:92:6d:0b:08 inet addr:10.168.1.132 Bcast:10.168.1.132 Mask:255.255.255.255 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 Interrupt:16 Memory:f4000000-f4012800 eth0:1 Link encap:Ethernet HWaddr 3c:4a:92:6d:0b:08 inet addr:10.168.1.133 Bcast:10.168.1.133 Mask:255.255.255.255 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 Interrupt:16 Memory:f4000000-f4012800

2 2

Confused about stunnel + haproxy
by Robin Lee Powell 27 Jun '12

27 Jun '12

I've set up stunnel + haproxy using the "protocol = proxy" method, but stunnel doesn't seem to pass to haproxy any information about the source IP of the original connection, which I thought was the point of using this method? Can someone tell me what I'm missng? I just want to have haproxy with SSL support without losing the client IP information completely. -Robin -- http://singinst.org/ : Our last, best hope for a fantastic future. .i ko na cpedu lo nu stidi vau loi jbopre .i danfu lu na go'i li'u .e lu go'i li'u .i ji'a go'i lu na'e go'i li'u .e lu go'i na'i li'u .e lu no'e go'i li'u .e lu to'e go'i li'u .e lu lo mamta be do cu sofybakni li'u

1 1

socket status
by Dee Ayy 20 Jun '12

20 Jun '12

My socket in Eiffel will report that it is connected, but when it tries to write to the socket, it will fail and report Connection reset by peer I/O error The syslog shows 1) ... accepted connection from 127.0.0.1:.. 2) connect_blocking: getsockopt A_REMOTE_IP:A_REMOTE_PORT: Connection refused (111) 3) Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket I believe that my socket is connecting locally fine 127.0.0.1:.. in step 1, and then the remote connection via stunnel is failing in step 2, but I have tried to write to the socket in between steps 1 and 2. Is this proper behavior? How can I know the status of the remote connection? Wait a while and then test? Is the socket state really just the state of the local stunnel connection? Should stunnel report a different state (as seen by my socket) until it determines the remote socket state?

1 0