- stunnel-users - stunnel.org

patch for using stunnel as client with pkcs11-engine and opensc smartcard
by Märt Laak 29 Jan '12

29 Jan '12

Dear stunnel managers, I would like to inform you that there exist some incompatibility with stunnel and openssl pkcs11-engine with external PIN entry device (like RSA smartcard using opensc) in Linux. We use this config to load openssl engine stunnel.conf: --- engine=dynamic engineCtrl=SO_PATH:/usr/lib/engines/engine_pkcs11.so engineCtrl=ID:pkcs11 engineCtrl=LIST_ADD:1 engineCtrl=LOAD engineCtrl=MODULE_PATH:/usr/lib/opensc-pkcs11.so engineCtrl=INIT --- Problem is, with this setup stunnel does not allow user to enter PIN for the secret key. Instead it tries to get secret key without PIN, 3 times (and then therefore usually blocks card PIN) and retires: ---- Initializing engine 1 Engine 1 initialized PRNG seeded successfully Certificate: mart.pem Certificate loaded Key file: id_01 error queue: 26096080 : error:26096080:engine routines:ENGINE_load_private_key:failed loading private key error queue: 800050A0 : error:800050A0:PKCS11 library:PKCS11_login:PIN incorrect Wrong PIN: retrying error queue: 26096080 : error:26096080:engine routines:ENGINE_load_private_key:failed loading private key error queue: 800050A0 : error:800050A0:PKCS11 library:PKCS11_login:PIN incorrect Wrong PIN: retrying error queue: 26096080 : error:26096080:engine routines:ENGINE_load_private_key:failed loading private key ENGINE_load_private_key: 800050A0: error:800050A0:PKCS11 library:PKCS11_login:PIN incorrect ---- I discovered workaround that is valid form version 4.26 till current 4.34, as follows, NULL-ing the ui_data.method property in ctx.c: --- diff -cr stunnel-4.34/src/ctx.c stunnel-4.34-patched/src/ctx.c *** stunnel-4.34/src/ctx.c 2010-09-14 18:08:43.000000000 +0300 --- stunnel-4.34-patched/src/ctx.c 2010-09-28 21:56:36.219081931 +0300 *************** *** 304,309 **** --- 304,310 ---- UI_method_set_reader(ui_method, pin_cb); #else /* USE_WIN32 */ ui_method=UI_OpenSSL(); + ui_data.section = NULL; #endif /* USE_WIN32 */ if(section->engine) for(i=1; i<=3; i++) { --- After that patch private key loads correctly: --- Initializing engine 1 Engine 1 initialized PRNG seeded successfully Certificate: mart.pem Certificate loaded Key file: id_01 private key loaded --- It would be nice if: * somebody investigates more precisely why the OpenSSL PIN entry is not showing with unpached stunnel * include my or better patch for this situation Thank you very much for excellent piece of software! With best regards, Märt Laak

2 2

STunnel on Windows (2008R2 Server)
by Skinner, Robert 28 Jan '12

28 Jan '12

I am attempting to use stunnel to encrypt traffic between our backup client (Window2008R2) and our NetApp filer, but I'm not having any luck We would like to use the stunnel to redirect the port 80 calls to the filer (ubfs2.buffalo.edu) to port 443. Be design, the backup client (IBM Tivoli/TSM V6.2.4) makes a call to the Netapp over http.admin interface to tell it to create a snapshot. The filer listens on https.admin (not http.admin), and we don't want to turn on http.admin for security reasons. I've included the stunnel.config file, hosts file, and the output below. If anyone could give us a hand here it would be much appreciated. We tested this config on a Mac laptop and it works just fine, so I would assume that it has something to do with Windows2008R2 Stunnel.config debug = 7 client = yes [snapdiff] accept = localhost:80 connect = 128.205.5.55:443 sslVersion = all hosts 127.0.0.1 localhost ubfs2.buffalo.edu output 7[1596:4336]: No limit detected for the number of clients 2012.01.27 15:16:30 LOG5[1596:4336]: stunnel 4.52 on x86-pc-mingw32-gnu platform 2012.01.27 15:16:30 LOG5[1596:4336]: Compiled/running with OpenSSL 0.9.8s-fips 4 Jan 2012 2012.01.27 15:16:30 LOG5[1596:4336]: Threading:WIN32 SSL:ENGINE,FIPS Auth:none Sockets:SELECT,IPv6 2012.01.27 15:16:30 LOG5[1596:4336]: Reading configuration from file stunnel.conf 2012.01.27 15:16:30 LOG5[1596:4336]: FIPS mode is enabled 2012.01.27 15:16:30 LOG7[1596:4336]: Compression not enabled 2012.01.27 15:16:30 LOG7[1596:4336]: Snagged 64 random bytes from C:/.rnd 2012.01.27 15:16:30 LOG7[1596:4336]: Wrote 1024 new random bytes to C:/.rnd 2012.01.27 15:16:30 LOG7[1596:4336]: PRNG seeded successfully 2012.01.27 15:16:31 LOG6[1596:4336]: Initializing SSL context for service snapdiff 2012.01.27 15:16:31 LOG7[1596:4336]: SSL options set: 0x00000004 2012.01.27 15:16:31 LOG6[1596:4336]: SSL context initialized 2012.01.27 15:16:31 LOG5[1596:4336]: Configuration successful 2012.01.27 15:16:31 LOG7[1596:4336]: Service snapdiff bound FD=396 to 127.0.0.1:80 2012.01.27 15:16:40 LOG7[1596:4336]: Service snapdiff accepted FD=452 from 127.0.0.1:51366 2012.01.27 15:16:40 LOG7[1596:4336]: Creating a new thread 2012.01.27 15:16:40 LOG7[1596:4336]: New thread created 2012.01.27 15:16:40 LOG7[1596:4336]: Service snapdiff accepted FD=460 from 127.0.0.1:51367 2012.01.27 15:16:40 LOG7[1596:4336]: Creating a new thread 2012.01.27 15:16:40 LOG7[1596:4336]: New thread created 2012.01.27 15:16:40 LOG7[1596:5080]: Service snapdiff started 2012.01.27 15:16:40 LOG5[1596:5080]: Service snapdiff accepted connection from 127.0.0.1:51366 2012.01.27 15:16:40 LOG6[1596:5080]: connect_blocking: connecting 128.205.5.55:443 2012.01.27 15:16:40 LOG7[1596:5080]: connect_blocking: s_poll_wait 128.205.5.55:443: waiting 10 seconds 2012.01.27 15:16:40 LOG7[1596:4720]: Service snapdiff started 2012.01.27 15:16:40 LOG5[1596:4720]: Service snapdiff accepted connection from 127.0.0.1:51367 2012.01.27 15:16:40 LOG6[1596:4720]: connect_blocking: connecting 128.205.5.55:443 2012.01.27 15:16:40 LOG7[1596:4720]: connect_blocking: s_poll_wait 128.205.5.55:443: waiting 10 seconds 2012.01.27 15:16:40 LOG5[1596:4720]: connect_blocking: connected 128.205.5.55:443 2012.01.27 15:16:40 LOG5[1596:4720]: Service snapdiff connected remote server from 128.205.4.234:51369 2012.01.27 15:16:40 LOG7[1596:4720]: Remote FD=508 initialized 2012.01.27 15:16:40 LOG3[1596:4720]: SSL_connect: 14077410: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure 2012.01.27 15:16:40 LOG5[1596:4720]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2012.01.27 15:16:40 LOG7[1596:4720]: Service snapdiff finished (1 left) 2012.01.27 15:16:43 LOG5[1596:5080]: connect_blocking: connected 128.205.5.55:443 2012.01.27 15:16:43 LOG5[1596:5080]: Service snapdiff connected remote server from 128.205.4.234:51368 2012.01.27 15:16:43 LOG7[1596:5080]: Remote FD=480 initialized 2012.01.27 15:16:43 LOG3[1596:5080]: SSL_connect: 14077410: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure 2012.01.27 15:16:43 LOG5[1596:5080]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2012.01.27 15:16:43 LOG7[1596:5080]: Service snapdiff finished (0 left)

2 1

stunnel+memoq error | urgent feedback needed
by Bob Makovei 27 Jan '12

27 Jan '12

Hello there! I am a new stunnel user, working as a translator. Please, find attached a log report about a connection error. I've tried everything I could to make stunnel work for memoq. What's wrong? I would much appreciate your quck input... Kind regards, Bob Bob Makovei Economist, Certified Translator, Investment Consultant | <http://www.makovei.me/> www.makovei.me | <mailto:[email protected]> bob(a)makovei.me Exim Pro Ltd., 25 Draga Street, Bekes H-5630, Hungary | +36.70.324.7424 (t) | +36.70.908.7704 (f) US: +1.512.682.0817 (vm) | +1.781.723.5861 (f) | UK: +44.871.526.2661 (f) | mr19740809 (skype)

1 0

stunnel and socat
by John A. Wallace 26 Jan '12

26 Jan '12

Hello. I use socat to connect stunnel to a socks proxy on my client workstation running windows. the socks proxy then connects to a news server on the internet. The initial connection works just fine and it appears to stay connected while I am transferring data and for a while afterwards; but after a period of idle connection say five or ten minutes, I get a message from my network adaptor popup saying that the connection stunnel had to my localhost has failed. Any ideas on how I can make the connection between stunnel and localhost persist longer during periods of inactivity? I would like it to stay connected until I purposely stop it. Below is the relevant section of "stunnel.conf". [newsreader_to_newsserver] accept = 127.0.0.1:120 connect = 127.0.0.1:5630 CAfile = peer-news_certificate.pem verify = 3

1 0

stunnel+memoq error
by Bob Makovei 26 Jan '12

26 Jan '12

Hello there! I am a new stunnel user, working as a translator. Please, find attached a log report about a connection error. I've tried everything I could to make stunnel work for memoq. What's wrong? Kind regards, Bob Bob Makovei Economist, Certified Translator, Investment Consultant | <http://www.makovei.me/> www.makovei.me | <mailto:[email protected]> bob(a)makovei.me Exim Pro Ltd., 25 Draga Street, Bekes H-5630, Hungary | +36.70.324.7424 (t) | +36.70.908.7704 (f) US: +1.512.682.0817 (vm) | +1.781.723.5861 (f) | UK: +44.871.526.2661 (f) | mr19740809 (skype)

1 0

Strange Log
by Hamid.Shahid＠sungard.com 26 Jan '12

26 Jan '12

Hi Jose, I am getting the following log, when I am trying connect my program with Stunnel, which is connected to a remote server using SSL. Can you please have a look and help me understand what is happening and what can be the reason? Many thanks! 2012.01.25 18:50:12 LOG5[8384:2416]: Reading configuration from file stunnel.conf 2012.01.25 18:50:12 LOG7[8384:2416]: Snagged 64 random bytes from C:/.rnd 2012.01.25 18:50:12 LOG7[8384:2416]: Wrote 1024 new random bytes to C:/.rnd 2012.01.25 18:50:12 LOG7[8384:2416]: PRNG seeded successfully 2012.01.25 18:50:12 LOG6[8384:2416]: Initializing SSL context for service SSLHOST 2012.01.25 18:50:12 LOG7[8384:2416]: Certificate: ABC_Cert.pem 2012.01.25 18:50:12 LOG7[8384:2416]: Certificate loaded 2012.01.25 18:50:12 LOG7[8384:2416]: Key file: ABC_Cert_key.pem 2012.01.25 18:50:30 LOG7[8384:2416]: Private key loaded 2012.01.25 18:50:30 LOG7[8384:2416]: SSL options set: 0x00180004 2012.01.25 18:50:30 LOG6[8384:2416]: SSL context initialized 2012.01.25 18:50:30 LOG5[8384:2416]: Configuration successful 2012.01.25 18:50:30 LOG7[8384:2416]: accept socket: FD=652 allocated (non-blocking mode) 2012.01.25 18:50:30 LOG7[8384:2416]: Option SO_REUSEADDR set on accept socket 2012.01.25 18:50:30 LOG7[8384:2416]: Service SSLHOST bound to 127.0.0.1:2525 2012.01.25 18:50:30 LOG7[8384:2416]: Service SSLHOST opened FD=652 2012.01.25 18:50:46 LOG7[8384:2416]: local socket: FD=752 allocated (non-blocking mode) 2012.01.25 18:50:46 LOG7[8384:2416]: Service SSLHOST accepted FD=752 from 127.0.0.1:52075 2012.01.25 18:50:46 LOG7[8384:2416]: Creating a new thread 2012.01.25 18:50:46 LOG7[8384:2416]: New thread created 2012.01.25 18:50:46 LOG7[8384:12664]: Service SSLHOST started 2012.01.25 18:50:46 LOG7[8384:12664]: Option TCP_NODELAY set on local socket 2012.01.25 18:50:46 LOG5[8384:12664]: Service SSLHOST accepted connection from 127.0.0.1:52075 2012.01.25 18:50:46 LOG7[8384:12664]: remote socket: FD=768 allocated (non-blocking mode) 2012.01.25 18:50:46 LOG6[8384:12664]: connect_blocking: connecting <server_ip : port> 2012.01.25 18:50:46 LOG7[8384:12664]: connect_blocking: s_poll_wait <server_ip : port>: waiting 10 seconds 2012.01.25 18:50:46 LOG5[8384:12664]: connect_blocking: connected <server_ip : port> 2012.01.25 18:50:46 LOG5[8384:12664]: Service SSLHOST connected remote server from <server_ip : port> 2012.01.25 18:50:46 LOG7[8384:12664]: Remote FD=768 initialized 2012.01.25 18:50:46 LOG7[8384:12664]: Option TCP_NODELAY set on remote socket 2012.01.25 18:50:46 LOG7[8384:12664]: SNI: host name: <ip> 2012.01.25 18:50:46 LOG7[8384:12664]: Peer certificate was cached (1976 bytes) 2012.01.25 18:50:46 LOG6[8384:12664]: SSL connected: new session negotiated 2012.01.25 18:50:46 LOG6[8384:12664]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2012.01.25 18:50:46 LOG7[8384:12664]: SSL closed on SSL_read 2012.01.25 18:50:46 LOG7[8384:12664]: Sending socket write shutdown 2012.01.25 18:50:46 LOG7[8384:12664]: Socket closed on read 2012.01.25 18:50:46 LOG7[8384:12664]: Sending SSL write shutdown 2012.01.25 18:50:46 LOG6[8384:12664]: SSL_shutdown successfully sent close_notify 2012.01.25 18:50:46 LOG5[8384:12664]: Connection closed: 133 bytes sent to SSL, 8 bytes sent to socket 2012.01.25 18:50:46 LOG7[8384:12664]: Service SSLHOST finished (0 left) Kind Regards, Hamid Shahid

2 1

Stunnel without certificate
by VANDOOREN, Pascal 25 Jan '12

25 Jan '12

Hello, I have a question, is it possible to use Stunnel without a certification but with a passphrase ? because a use a generated certificate that expired after one year and it's not possible to generate a certificate more than one year .... Kind regards Pascal -- This e-mail is confidential. If you are not the addressee or an authorized recipient of this message, any distribution, copying, publication or use of this information for any purpose is prohibited. Please notify the sender immediately by e-mail and then delete this message. Ce message est confidentiel. Si vous n'etes pas le destinataire designe de ce message ou une personne autorisee a l'utiliser, toute distribution, copie, publication ou usage a quelques fins que ce soit des informations contenues dans ce message sont interdits. Merci d'informer immediatement l'expediteur par messagerie electronique et d'ensuite detruire ce message. --

1 0

certificate authentications
by John A. Wallace 21 Jan '12

21 Jan '12

I have two questions, which I think may be related, regarding how to use the information from stunnel log. I use stunnel to connect to an SMTP server on the internet from my home network, and in particular from my Windows laptop. My stunnel version is this: stunnel 4.50 on x86-pc-mingw32-gnu platform Compiled/running with OpenSSL 0.9.8r-fips 8 Feb 2011 It works well for my purposes, and I can see, by using a program for monitoring process and network connections, that the connections are now secured as expected. However, I believe it can be made more secure if I can utilize the certificate that is offered by the server, but I am not sure how to make that happen. In my stunnel log for the connection, I get this message: Client-mode smtp protocol negotiations started Client-mode smtp protocol negotiations succeeded No peer certificate received SSL connected: new session negotiated Negotiated ciphers: ADH-AES256-SHA SSLv3 Kx=DH Au=None Enc=AES(256) Mac=SHA1 My first question is, how should I go about getting that "No peer certificate received" issue corrected and how do I install it? Secondly, when I issue this command at the cmd shell prompt: openssl s_client -starttls smtp -connect host.server:port The output is lengthy and it includes, among other things, clearly what is identified as a certificate. I have been told that this is a good certificate, and one that I should utilize for an authenticated connection. So, my question is, is this the same certificate that I saw referenced in the log as the "peer certificate", and how do I go about putting this certificate where it belongs in my directory? I know how to copy it and save it as a file, but where do I put it and should it have a special name? If someone wants to direct me to the correct instruction for doing this, that would be fine too. I am just looking for some pointers for assistance. Thanks.

3 5

Re: [stunnel-users] ver 4.5 VS 4.2: running single process now, how to close when all client apps closed?
by Jose Alf. 21 Jan '12

21 Jan '12

All right. I just recompiled against the latest OpenSSL 0.9.8t. Still not enought to tempt you? :) Regards, Jose ________________________________ From: Larisa <larisaka(a)yahoo.com> To: Jose Alf. <josealf(a)rocketmail.com> Sent: Friday, January 20, 2012 5:20 PM Subject: Re: [stunnel-users] ver 4.5 VS 4.2: running single process now, how to close when all client apps closed? Jose, I am thinking to stay with the old version for a little bit longer, though hoping to get newer one 4.5_ soon. Thank you for the offer. Larisa --- On Thu, 1/19/12, Jose Alf. <josealf(a)rocketmail.com> wrote: >From: Jose Alf. <josealf(a)rocketmail.com> >Subject: Re: [stunnel-users] ver 4.5 VS 4.2: running single process now, how to close when all client apps closed? >To: "Stunnel Users Mailing List" <stunnel-users(a)mirt.net>, "larisa_y" <larisaka(a)yahoo.com> >Date: Thursday, January 19, 2012, 8:01 AM > > >Larisa, >I compiled stunnel-4.39 against OpenSSL 0.9.8s. Let me know if you are interested in the binaries. > >Regards >Jose > >________________________________ >From: Michal Trojnara <Michal.Trojnara(a)mirt.net> >To: Stunnel Users Mailing List <stunnel-users(a)mirt.net> >Sent: Tuesday, January 17, 2012 5:08 PM >Subject: Re: [stunnel-users] ver 4.5 VS 4.2: running single process now, how to close when all client apps closed? >larisa_y wrote:> Could you tell me starting which version the new behaviour was implemented?> (single process architecture) I tried the changelog but could not really> identify the item.The implementation of this change started with stunnel 4.40 with new "stunnel -exit" option. The last version fully supporting multiple processes is 4.39.Please be aware of security risks related to using obsolete versions of OpenSSL. Some Win32 GUI features are also unstable until version 4.50.Mike_______________________________________________stunnel-users mailing [email protected]://stunnel.mirt.net/mailman/listinfo/stunnel-users

1 0

Re: [stunnel-users] STARTTLS
by James Devine 20 Jan '12

20 Jan '12

http and smtp are two different birds, https runs on a different port, whereas an smtp connection running on port 25 can be upgraded to secure with starttls On Fri, Jan 20, 2012 at 12:29 AM, Michal Trojnara <Michal.Trojnara(a)mirt.net>wrote: > James Devine <fxmulder(a)gmail.com> wrote: > > >I've setup stunnel to tunnel port 25 to a few backend smtp servers, it > >appears that it only works with starttls, is there a way to make it > >work if > >no starttls is issued also? > >_______________________________________________ > >stunnel-users mailing list > >stunnel-users(a)stunnel.org > >http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > Do you also have problems with https on port 80? > > Mike >

1 0

STARTTLS
by James Devine 19 Jan '12

19 Jan '12

I've setup stunnel to tunnel port 25 to a few backend smtp servers, it appears that it only works with starttls, is there a way to make it work if no starttls is issued also?

1 0

ver 4.5 VS 4.2: running single process now, how to close when all client apps closed?
by larisa_y 19 Jan '12

19 Jan '12

I have several client applications running on win machine, connecting to the same server, or sometimes to different servers. ver. 4.2 allowed me to do the following: modify .conf file to [my_section] accept=5566 connect 123.22.33.44:5005; then run stunnel.exe; modify .conf file to [my_section] accept=5567 connect 456.22.33.44:5006; then run stunnel.exe. That would start 2 stunnel.exe processes, each one handling its own connection; which were easy to close when each respective client app closed - each one would close the one it started. Now with 4.5 version: the single stunnel.exe process runs and is able to handle all communications perfectly, provided I prepare .conf file for all possible connections in advance, before starting stunnel. The problem I cannot solve easily is how not to leave stunnel running after client logged out of all the applications. Without building something to keep track of "stunnels users" count, how could I do it? Is there some way to switch to multiple instances mode? Please advise. Larisa -- View this message in context: http://old.nabble.com/ver-4.5-VS-4.2%3A-running-single-process-now%2C-how-t… Sent from the Stunnel - Users mailing list archive at Nabble.com.

3 7

Windows Live Mail issue ?
by Victor 19 Jan '12

19 Jan '12

I'm new with stunnel and I'm experiencing a issue. Windows Live Mail is closing the connection with the SSL tunnel without send the close down packet, resulting in connection reset by peer. Follow the output debug of stunnel: 2012.01.18 17:13:25 LOG7[16954:34377572800]: Socket closed on read 2012.01.18 17:13:25 LOG7[16954:34377572800]: Sending SSL write shutdown 2012.01.18 17:13:25 LOG7[16954:34377572800]: SSL alert (write): warning: close notify 2012.01.18 17:13:25 LOG6[16954:34377572800]: SSL_shutdown successfully sent close_notify 2012.01.18 17:13:25 LOG3[16954:34377572800]: SSL_read: Connection reset by peer (54) 2012.01.18 17:13:25 LOG5[16954:34377572800]: Connection reset: 293 bytes sent to SSL, 1293 bytes sent to socket 2012.01.18 17:13:25 LOG7[16954:34377572800]: Service stunnel finished (0 left) 2012.01.18 17:13:25 LOG7[16954:34377572800]: str_stats: 28 block(s), 988 byte(s) The e-mail message is sent successfully but Im very intrigued with the line "Connection reset: 293 bytes sent to SSL, 1293 bytes sent to socket", that make me think that some data was lost in the middle of the connection. I need to fix something or this is a normal behavior ? qmail 1.03 with SPAMCONTROL stunnel 4.43 running on FreeBSD 8.0-RELEASE Config file: ; SMTP SSL (SMTP-AUTH) debug = 7 foreground = yes syslog = no cert = /usr/local/etc/stunnel/stunnel.pem exec = /var/qmail/bin/qmail-smtpd execargs = qmail-smtpd /mailhome/bin/vchkpw /bin/true Thanks in advance !

2 1

client side SNI
by yyy 14 Jan '12

14 Jan '12

It looks like server name for client side SNI is defined as name to connect to in connect option. According to RFC, this name must be FQDN. It is the only place where it is defined and server name for SNI cannot be defined outside connect option. Is that right? Server side SNI has some good examples. Searching for "client side SNI" did not yield anything useful. I am trying to run multiple independent services over the same port there is no DNS infrastructure in place, so those server names would be random strings not refering to anything. Both ends would be stunnel. If it is as it seems, it will not work, because defined server name (at client) must be working DNS name (FQDN).

2 7

Verify = 3 and Giganews
by Thomas Eifert 13 Jan '12

13 Jan '12

Hello, I've tried to use verify = 3 with Giganews on several occasions now, but it always fails. It works fine with other servers, however. Here is the debug output for the Giganews scenario: 2012.01.12 14:05:01 LOG4[292:3840]: CERT: Verification error: unable to get local issuer certificate 2012.01.12 14:05:01 LOG4[292:3840]: Certificate check failed: depth=1, /C=US/O=GeoTrust Inc./OU=Domain Validated SSL/CN=GeoTrust DV SSL CA 2012.01.12 14:05:01 LOG3[292:3840]: SSL_connect: 14090086: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed And the following is from my stunnel.conf: ~~~~~~~~~~~~~~~~~~~~~~~~~~~ debug = 6 delay = yes [nntps.3] client = yes sslVersion = TLSv1 ciphers = AES256-SHA cafile = peer-nntps.3.pem verify = 3 accept = 127.0.0.1:119 connect = news.giganews.com:443 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ As I have with other connections, I am saving peer-nntps3.pem from the log window menu. Can anyone tell me why this is failing on this server only? Regards; Thomas

2 2

stunnel 4.52 released
by Michal Trojnara 12 Jan '12

12 Jan '12

Dear Users, I have released version 4.52 of stunnel. This is a bugfix release. Upgrade is highly recommended. The ChangeLog entry: Version 4.52, 2012.01.12, urgency: MEDIUM: * Bugfixes - Fixed write closure notification for non-socket file descriptors. - Removed a line logged to stderr in inetd mode. - Fixed "Socket operation on non-socket" error in inetd mode on Mac OS X platform. - Removed direct access to the fields of the X509_STORE_CTX data structure. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.52.tar.gz: 7c78c178074e9b96331518a9c309d2e95ca9ad6e0338a96d5ab8ad47fde4347c Best regards, Mike

1 0

fips=no and slow performance problem
by Owen Ching 12 Jan '12

12 Jan '12

I have a production system that uses stunnel and it's been working pretty well. Mike, thanks for all your hard work. But there has been a weird issue that I ran into a while ago and now it's happening again. we're using a rackspace cloud machine to run stunnel and haproxy. we're using the x-forwarded-for stunnel patch for now with plans to upgrade to send-proxy method once haproxy 1.5 is considered the stable branch. So I built one machine and ran into the "FIPS_mode_set: 2D06C06E: error:2D06C06E:FIPS routines:FIPS_mode_set:fingerprint does not match" error message. So I changed the config to fips=no and stunnel started up but the https seems really slow (multiple browsers). We run with significant https volume. So the fips=no option didn't work for us. I kept trying different things but nothing worked. I decided to start clean and built a new machine. This time stunnel didn't throw the FIPS error and everything performed great. So used the new machine instead. Now after some time (over a year), we had some performance problems. we rebooted the machine and now we have the FIPS error again. I've tried multiple versions of stunnel (whatever I could find working patches for) and also tried a clean 4.51 with no patches. all of them throw the FIPS error now on this machine. I'm in the process of building a new machine to see if it magically works again. Any help or insight would be greatly appreciated. Thanks, Owen

2 2

I am having problems with the 4.5x-series also: Pan connects, nothing else happens.
by SciFi 12 Jan '12

12 Jan '12

Hi, I am also having no luck using the stunnel-4.5* series. The last/latest working for me is 4.49. $ uname -a Darwin SciFi.homeip.net 10.8.0 Darwin Kernel Version 10.8.0: Tue Jun 7 16:33:36 PDT 2011; root:xnu-1504.15.3~1/RELEASE_I386 i386 i386 iMac6,1 Darwin (altho this is a C2D machine, running most tasks in 64-bit mode, Apple has left the EFI/BIOS/kernels at 32-bit… yes I can boot+run 10.7/Lion, but that is a total separate topic altogether [don't get me started]…) I mainly use stunnel with Pan, to connect to Giganews, Astraweb, and Gmane (which is what I'm using now to post this message). I use the simple 127.0.0.1:port mechanism. (I've been working with one of Pan's new developers, to try their new GnuTLS support; but until that works, stunnel is my known supposedly-functioning fallback.) I've tested every 4.5x release, including today's 4.52b1 & b2 -- all act the same, in that Pan tries to connect to stunnel, and that's all I see, nothing further happens. Also, the 4.5-series produces much-less log-listing, as you'll see in my attachments below. I am fine while relegated to using stunnel-4.49, but we have a further issue, in that the "verify=<number>" option seems to reject the certs & what-not coming from these servers, for any <number> higher than 0 (yes I saw the maillist discussion about what 4 means there, and tried it also). I've been mildly joking with the Pan developer on how to be sure we are /really/ in secure mode. ;) Now, the details. I manually start stunnel on a login-root terminal window, this way: # stunnel /usr/local/etc/stunnel/stunnel.conf -sockets With these sample log-lists (below), I'm trying to get one single short post in a newsgroup. I made sure Pan did not save this post in its cache, such that it does try to fetch the post from the NNTP server. (Currently, Pan is set to use Astraweb as my primary feed.) Here's what 4.49 will show on the terminal (this works: I can see the modem blinking, and can see/read the post): ---start--- 2012.01.11 10:24:51 LOG7[3782:2697274688]: Clients allowed=500 2012.01.11 10:24:51 LOG7[3782:2697274688]: signal_pipe: FD=3 allocated (non-blocking mode) 2012.01.11 10:24:51 LOG7[3782:2697274688]: signal_pipe: FD=4 allocated (non-blocking mode) 2012.01.11 10:24:51 LOG5[3782:2697274688]: stunnel 4.49 on i386-apple-darwin10.8.0 platform 2012.01.11 10:24:51 LOG5[3782:2697274688]: Compiled/running with OpenSSL 1.1.0-dev xx XXX xxxx 2012.01.11 10:24:51 LOG5[3782:2697274688]: Threading:PTHREAD SSL:ENGINE Auth:LIBWRAP Sockets:SELECT,IPv6 2012.01.11 10:24:51 LOG5[3782:2697274688]: Reading configuration from file /usr/local/etc/stunnel/stunnel.conf 2012.01.11 10:24:51 LOG6[3782:2697274688]: Compression enabled using zlib method 2012.01.11 10:24:51 LOG7[3782:2697274688]: PRNG seeded successfully 2012.01.11 10:24:52 LOG6[3782:2697274688]: Initializing SSL context for service nntp_gn 2012.01.11 10:24:52 LOG7[3782:2697274688]: Verify directory set to /certs 2012.01.11 10:24:52 LOG7[3782:2697274688]: Added /certs revocation lookup directory 2012.01.11 10:24:52 LOG7[3782:2697274688]: Added /crls revocation lookup directory 2012.01.11 10:24:52 LOG7[3782:2697274688]: SSL options set: 0x00000004 2012.01.11 10:24:52 LOG6[3782:2697274688]: SSL context initialized 2012.01.11 10:24:52 LOG6[3782:2697274688]: Initializing SSL context for service nntp_aw 2012.01.11 10:24:52 LOG7[3782:2697274688]: Verify directory set to /certs 2012.01.11 10:24:52 LOG7[3782:2697274688]: Added /certs revocation lookup directory 2012.01.11 10:24:52 LOG7[3782:2697274688]: Added /crls revocation lookup directory 2012.01.11 10:24:52 LOG7[3782:2697274688]: SSL options set: 0x00000004 2012.01.11 10:24:52 LOG6[3782:2697274688]: SSL context initialized 2012.01.11 10:24:52 LOG6[3782:2697274688]: Initializing SSL context for service nntp_gm 2012.01.11 10:24:52 LOG7[3782:2697274688]: Verify directory set to /certs 2012.01.11 10:24:52 LOG7[3782:2697274688]: Added /certs revocation lookup directory 2012.01.11 10:24:52 LOG7[3782:2697274688]: Added /crls revocation lookup directory 2012.01.11 10:24:52 LOG7[3782:2697274688]: SSL options set: 0x00000004 2012.01.11 10:24:52 LOG6[3782:2697274688]: SSL context initialized 2012.01.11 10:24:52 LOG5[3782:2697274688]: Configuration successful 2012.01.11 10:24:52 LOG7[3782:2697274688]: libwrap_init: FD=5 allocated (blocking mode) 2012.01.11 10:24:52 LOG7[3782:2697274688]: libwrap_init: FD=6 allocated (blocking mode) 2012.01.11 10:24:52 LOG7[3782:2697274688]: libwrap_init: FD=6 allocated (blocking mode) 2012.01.11 10:24:52 LOG7[3782:2697274688]: libwrap_init: FD=8 allocated (blocking mode) 2012.01.11 10:24:52 LOG7[3782:2697274688]: libwrap_init: FD=8 allocated (blocking mode) 2012.01.11 10:24:52 LOG7[3782:2697274688]: libwrap_init: FD=9 allocated (blocking mode) 2012.01.11 10:24:52 LOG7[3782:2697274688]: libwrap_init: FD=9 allocated (blocking mode) 2012.01.11 10:24:52 LOG7[3782:2697274688]: libwrap_init: FD=10 allocated (blocking mode) 2012.01.11 10:24:52 LOG7[3782:2697274688]: libwrap_init: FD=10 allocated (blocking mode) 2012.01.11 10:24:52 LOG7[3782:2697274688]: libwrap_init: FD=11 allocated (blocking mode) 2012.01.11 10:24:52 LOG7[3782:2697274688]: accept socket: FD=11 allocated (non-blocking mode) 2012.01.11 10:24:52 LOG7[3782:2697274688]: Option SO_REUSEADDR set on accept socket 2012.01.11 10:24:52 LOG7[3782:2697274688]: Service nntp_gn bound to 0.0.0.0:12000 2012.01.11 10:24:52 LOG7[3782:2697274688]: Service nntp_gn opened FD=11 2012.01.11 10:24:52 LOG7[3782:2697274688]: accept socket: FD=12 allocated (non-blocking mode) 2012.01.11 10:24:52 LOG7[3782:2697274688]: Option SO_REUSEADDR set on accept socket 2012.01.11 10:24:52 LOG7[3782:2697274688]: Service nntp_aw bound to 0.0.0.0:12001 2012.01.11 10:24:52 LOG7[3782:2697274688]: Service nntp_aw opened FD=12 2012.01.11 10:24:52 LOG7[3782:2697274688]: accept socket: FD=13 allocated (non-blocking mode) 2012.01.11 10:24:52 LOG7[3782:2697274688]: Option SO_REUSEADDR set on accept socket 2012.01.11 10:24:52 LOG7[3782:2697274688]: Service nntp_gm bound to 0.0.0.0:12002 2012.01.11 10:24:52 LOG7[3782:2697274688]: Service nntp_gm opened FD=13 2012.01.11 10:24:52 LOG7[3782:2697274688]: Created pid file /stunnel.pid 2012.01.11 10:25:53 LOG7[3782:2697274688]: local socket: FD=14 allocated (non-blocking mode) 2012.01.11 10:25:53 LOG7[3782:2697274688]: Service nntp_aw accepted FD=14 from 127.0.0.1:52241 2012.01.11 10:25:53 LOG7[3782:2952859648]: Service nntp_aw started 2012.01.11 10:25:53 LOG7[3782:2952859648]: Option TCP_NODELAY set on local socket 2012.01.11 10:25:53 LOG7[3782:2952859648]: Waiting for a libwrap process 2012.01.11 10:25:53 LOG7[3782:2952859648]: Acquired libwrap process #0 2012.01.11 10:25:53 LOG7[3782:2952859648]: Releasing libwrap process #0 2012.01.11 10:25:53 LOG7[3782:2952859648]: Released libwrap process #0 2012.01.11 10:25:53 LOG7[3782:2952859648]: Service nntp_aw permitted by libwrap from 127.0.0.1:52241 2012.01.11 10:25:53 LOG5[3782:2952859648]: Service nntp_aw accepted connection from 127.0.0.1:52241 2012.01.11 10:25:53 LOG7[3782:2952859648]: remote socket: FD=15 allocated (non-blocking mode) 2012.01.11 10:25:53 LOG6[3782:2952859648]: connect_blocking: connecting 216.151.153.83:563 2012.01.11 10:25:53 LOG7[3782:2952859648]: connect_blocking: s_poll_wait 216.151.153.83:563: waiting 10 seconds 2012.01.11 10:25:54 LOG5[3782:2952859648]: connect_blocking: connected 216.151.153.83:563 2012.01.11 10:25:54 LOG5[3782:2952859648]: Service nntp_aw connected remote server from 192.168.1.65:52242 2012.01.11 10:25:54 LOG7[3782:2952859648]: Remote FD=15 initialized 2012.01.11 10:25:54 LOG7[3782:2952859648]: Option TCP_NODELAY set on remote socket 2012.01.11 10:25:54 LOG7[3782:2952859648]: SNI: host name: ssl.astraweb.com 2012.01.11 10:25:54 LOG7[3782:2952859648]: Starting certificate verification: depth=3, /L=ValiCert Validation Network/O=ValiCert, Inc./OU=ValiCert Class 2 Policy Validation Authority/CN=http://www.valicert.com//[email protected] 2012.01.11 10:25:54 LOG6[3782:2952859648]: CERT: Verification not enabled 2012.01.11 10:25:54 LOG5[3782:2952859648]: Certificate accepted: depth=3, /L=ValiCert Validation Network/O=ValiCert, Inc./OU=ValiCert Class 2 Policy Validation Authority/CN=http://www.valicert.com//[email protected] 2012.01.11 10:25:54 LOG7[3782:2952859648]: Starting certificate verification: depth=2, /C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority 2012.01.11 10:25:54 LOG6[3782:2952859648]: CERT: Verification not enabled 2012.01.11 10:25:54 LOG5[3782:2952859648]: Certificate accepted: depth=2, /C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority 2012.01.11 10:25:54 LOG7[3782:2952859648]: Starting certificate verification: depth=1, /C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=07969287 2012.01.11 10:25:54 LOG6[3782:2952859648]: CERT: Verification not enabled 2012.01.11 10:25:54 LOG5[3782:2952859648]: Certificate accepted: depth=1, /C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=07969287 2012.01.11 10:25:54 LOG7[3782:2952859648]: Starting certificate verification: depth=0, /O=*.astraweb.com/OU=Domain Control Validated/CN=*.astraweb.com 2012.01.11 10:25:54 LOG6[3782:2952859648]: CERT: Verification not enabled 2012.01.11 10:25:54 LOG5[3782:2952859648]: Certificate accepted: depth=0, /O=*.astraweb.com/OU=Domain Control Validated/CN=*.astraweb.com 2012.01.11 10:25:54 LOG6[3782:2952859648]: SSL connected: new session negotiated 2012.01.11 10:25:54 LOG6[3782:2952859648]: Negotiated ciphers: RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 2012.01.11 10:26:06 LOG7[3782:2952859648]: Socket closed on read 2012.01.11 10:26:06 LOG7[3782:2952859648]: Sending SSL write shutdown 2012.01.11 10:26:06 LOG6[3782:2952859648]: SSL_shutdown successfully sent close_notify 2012.01.11 10:26:06 LOG3[3782:2952859648]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing 2012.01.11 10:26:06 LOG5[3782:2952859648]: Connection closed: 147 bytes sent to SSL, 1446 bytes sent to socket 2012.01.11 10:26:06 LOG7[3782:2952859648]: Service nntp_aw finished (0 left) 2012.01.11 10:26:06 LOG7[3782:2952859648]: str_stats: 0 block(s), 0 data byte(s), 0 control byte(s) ^C2012.01.11 10:26:11 LOG7[3782:2697274688]: Dispatching signals from the signal pipe 2012.01.11 10:26:11 LOG3[3782:2697274688]: Received signal 2; terminating 2012.01.11 10:26:11 LOG7[3782:2697274688]: Service nntp_gn closed FD=11 2012.01.11 10:26:11 LOG7[3782:2697274688]: Service nntp_aw closed FD=12 2012.01.11 10:26:11 LOG7[3782:2697274688]: Service nntp_gm closed FD=13 2012.01.11 10:26:11 LOG7[3782:2697274688]: str_stats: 76 block(s), 4835 data byte(s), 2584 control byte(s) 2012.01.11 10:26:11 LOG7[3782:2697274688]: removing pid file /stunnel.pid # _ ---end--- Here's what 4.52b2 shows, much like other 4.5x versions (note it shows much-less than 4.49) -- Pan tried to connect starting at 10:21:27, timing-out twice at least, before I made it go off-line etc.: ---start--- 2012.01.11 10:20:22 LOG7[3549:3146608]: Clients allowed=500 2012.01.11 10:20:22 LOG5[3549:3146608]: stunnel 4.52 on x86_64-apple-darwin10.8.0 platform 2012.01.11 10:20:22 LOG5[3549:3146608]: Compiled/running with OpenSSL 1.1.0-dev xx XXX xxxx 2012.01.11 10:20:22 LOG5[3549:3146608]: Threading:PTHREAD SSL:ENGINE Auth:LIBWRAP Sockets:SELECT,IPv6 2012.01.11 10:20:22 LOG5[3549:3146608]: Reading configuration from file /usr/local/etc/stunnel/stunnel.conf 2012.01.11 10:20:22 LOG6[3549:3146608]: Compression enabled: 2 algorithm(s) 2012.01.11 10:20:22 LOG7[3549:3146608]: PRNG seeded successfully 2012.01.11 10:20:23 LOG6[3549:3146608]: Initializing SSL context for service nntp_gn 2012.01.11 10:20:23 LOG7[3549:3146608]: Verify directory set to /certs 2012.01.11 10:20:23 LOG7[3549:3146608]: Added /certs revocation lookup directory 2012.01.11 10:20:23 LOG7[3549:3146608]: Added /crls revocation lookup directory 2012.01.11 10:20:23 LOG7[3549:3146608]: SSL options set: 0x00000004 2012.01.11 10:20:23 LOG6[3549:3146608]: SSL context initialized 2012.01.11 10:20:23 LOG6[3549:3146608]: Initializing SSL context for service nntp_aw 2012.01.11 10:20:23 LOG7[3549:3146608]: Verify directory set to /certs 2012.01.11 10:20:23 LOG7[3549:3146608]: Added /certs revocation lookup directory 2012.01.11 10:20:23 LOG7[3549:3146608]: Added /crls revocation lookup directory 2012.01.11 10:20:23 LOG7[3549:3146608]: SSL options set: 0x00000004 2012.01.11 10:20:23 LOG6[3549:3146608]: SSL context initialized 2012.01.11 10:20:23 LOG6[3549:3146608]: Initializing SSL context for service nntp_gm 2012.01.11 10:20:23 LOG7[3549:3146608]: Verify directory set to /certs 2012.01.11 10:20:23 LOG7[3549:3146608]: Added /certs revocation lookup directory 2012.01.11 10:20:23 LOG7[3549:3146608]: Added /crls revocation lookup directory 2012.01.11 10:20:23 LOG7[3549:3146608]: SSL options set: 0x00000004 2012.01.11 10:20:23 LOG6[3549:3146608]: SSL context initialized 2012.01.11 10:20:23 LOG5[3549:3146608]: Configuration successful 2012.01.11 10:20:23 LOG7[3549:3146608]: Service nntp_gn bound FD=13 to 0.0.0.0:12000 2012.01.11 10:20:23 LOG7[3549:3146608]: Service nntp_aw bound FD=14 to 0.0.0.0:12001 2012.01.11 10:20:23 LOG7[3549:3146608]: Service nntp_gm bound FD=15 to 0.0.0.0:12002 2012.01.11 10:20:23 LOG7[3549:3146608]: Created pid file /stunnel.pid 2012.01.11 10:21:27 LOG7[3549:3146608]: Service nntp_aw accepted FD=16 from 127.0.0.1:52237 2012.01.11 10:22:01 LOG7[3549:3146608]: Service nntp_aw accepted FD=17 from 127.0.0.1:52238 ^C2012.01.11 10:22:32 LOG7[3549:3146608]: Dispatching signals from the signal pipe 2012.01.11 10:22:32 LOG3[3549:3146608]: Received signal 2; terminating 2012.01.11 10:22:32 LOG7[3549:3146608]: Service nntp_gn closed FD=13 2012.01.11 10:22:32 LOG7[3549:3146608]: Service nntp_aw closed FD=14 2012.01.11 10:22:32 LOG7[3549:3146608]: Service nntp_gm closed FD=15 2012.01.11 10:22:32 LOG7[3549:3146608]: str_stats: 55 block(s), 4163 data byte(s), 1870 control byte(s) 2012.01.11 10:22:32 LOG7[3549:3146608]: removing pid file /stunnel.pid # _ ---end--- Here's my stunnel.conf with superfluous comments removed: ---/usr/local/etc/stunnel/stunnel.conf--- foreground = yes key = /usr/local/etc/stunnel/stunnel.pem sslVersion = all ciphers = ALL chroot = /usr/local/var/lib/stunnel/ setuid = nobody setgid = nogroup pid = /stunnel.pid compression = zlib verify = 0 CApath = /certs CRLpath = /crls debug = 7 client = yes TIMEOUTclose = 0 ; service-level configuration [nntp_gn] accept = 12000 connect = news.giganews.com:563 [nntp_aw] accept = 12001 connect = ssl.astraweb.com:563 [nntp_gm] accept = 12002 connect = 80.91.229.10:563 ; vim:ft=dosini ---end--- To generate the aforementioned stunnel.pem, I followed the steps shown here: <https://baltazaar.wordpress.com/2008/03/03/configuring-pan-newsreader-with-…> Here is my build-log for 4.52b2, similar to my other builds: ---start--- $ cat ./dothis.sh # ./configure \ --enable-dependency-tracking \ --enable-static \ --enable-shared \ --enable-ipv6 \ --with-ssl=/usr/local/ssl \ # $ ./dothis.sh configure: **************************************** initialization checking for a BSD-compatible install... /usr/local/bin/install -c checking whether build environment is sane... yes checking for a thread-safe mkdir -p... /usr/local/bin/mkdir -p checking for gawk... gawk checking whether make sets $(MAKE)... yes checking build system type... x86_64-apple-darwin10.8.0 checking host system type... x86_64-apple-darwin10.8.0 checking for gcc... gcc-4.2 checking whether the C compiler works... yes checking for C compiler default output file name... a.out checking for suffix of executables... checking whether we are cross compiling... no checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc-4.2 accepts -g... yes checking for gcc-4.2 option to accept ISO C89... none needed checking for style of include used by make... GNU checking dependency style of gcc-4.2... gcc3 checking whether gcc-4.2 and cc understand -c and -o together... yes checking whether make sets $(MAKE)... (cached) yes configure: **************************************** compiler/linker flags checking whether gcc-4.2 accepts -pthread... yes checking whether gcc-4.2 accepts -fstack-protector... yes checking whether gcc-4.2 accepts -Wall... yes checking whether gcc-4.2 accepts -Wextra... yes checking whether gcc-4.2 accepts -Wno-long-long... yes checking whether gcc-4.2 accepts -pedantic... yes configure: **************************************** libtool checking for a sed that does not truncate output... /usr/local/bin/sed checking for grep that handles long lines and -e... /usr/local/bin/grep checking for egrep... /usr/local/bin/grep -E checking for fgrep... /usr/local/bin/grep -F checking for ld used by gcc-4.2... /usr/libexec/gcc/i686-apple-darwin10/4.2.1/ld checking if the linker (/usr/libexec/gcc/i686-apple-darwin10/4.2.1/ld) is GNU ld... no checking for BSD- or MS-compatible name lister (nm)... /usr/bin/nm checking the name lister (/usr/bin/nm) interface... BSD nm checking whether ln -s works... yes checking the maximum length of command line arguments... 196608 checking whether the shell understands some XSI constructs... yes checking whether the shell understands "+="... yes checking for /usr/libexec/gcc/i686-apple-darwin10/4.2.1/ld option to reload object files... -r checking for objdump... no checking how to recognize dependent libraries... pass_all checking for ar... ar checking for strip... strip checking for ranlib... ranlib checking command to parse /usr/bin/nm output from gcc-4.2 object... ok checking for dsymutil... dsymutil checking for nmedit... nmedit checking for lipo... lipo checking for otool... otool checking for otool64... no checking for -single_module linker flag... yes checking for -exported_symbols_list linker flag... yes checking how to run the C preprocessor... cpp-4.2 checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking for dlfcn.h... yes checking for objdir... .libs checking if gcc-4.2 supports -fno-rtti -fno-exceptions... no checking for gcc-4.2 option to produce PIC... -fno-common -DPIC checking if gcc-4.2 PIC flag -fno-common -DPIC works... yes checking if gcc-4.2 static flag -static works... no checking if gcc-4.2 supports -c -o file.o... yes checking if gcc-4.2 supports -c -o file.o... (cached) yes checking whether the gcc-4.2 linker (/usr/libexec/gcc/i686-apple-darwin10/4.2.1/ld) supports shared libraries... yes checking dynamic linker characteristics... darwin10.8.0 dyld checking how to hardcode library paths into programs... immediate checking whether stripping libraries is possible... yes checking if libtool supports shared libraries... yes checking whether to build shared libraries... yes checking whether to build static libraries... yes configure: **************************************** types checking size of unsigned char... 1 checking size of unsigned short... 2 checking size of unsigned int... 4 checking size of unsigned long... 4 checking for socklen_t... yes checking for struct sockaddr_un... yes checking for struct addrinfo... yes configure: **************************************** PTY device files checking for "/dev/ptmx"... yes checking for "/dev/ptc"... no configure: **************************************** entropy sources checking for "/dev/urandom"... yes configure: **************************************** default group checking for default group... nogroup configure: **************************************** header files checking ucontext.h usability... no checking ucontext.h presence... no checking for ucontext.h... no checking pthread.h usability... yes checking pthread.h presence... yes checking for pthread.h... yes checking poll.h usability... yes checking poll.h presence... yes checking for poll.h... yes checking tcpd.h usability... yes checking tcpd.h presence... yes checking for tcpd.h... yes checking stropts.h usability... no checking stropts.h presence... no checking for stropts.h... no checking grp.h usability... yes checking grp.h presence... yes checking for grp.h... yes checking for unistd.h... (cached) yes checking util.h usability... yes checking util.h presence... yes checking for util.h... yes checking libutil.h usability... no checking libutil.h presence... no checking for libutil.h... no checking pty.h usability... no checking pty.h presence... no checking for pty.h... no checking sys/select.h usability... yes checking sys/select.h presence... yes checking for sys/select.h... yes checking sys/poll.h usability... yes checking sys/poll.h presence... yes checking for sys/poll.h... yes checking sys/socket.h usability... yes checking sys/socket.h presence... yes checking for sys/socket.h... yes checking sys/un.h usability... yes checking sys/un.h presence... yes checking for sys/un.h... yes checking sys/ioctl.h usability... yes checking sys/ioctl.h presence... yes checking for sys/ioctl.h... yes checking sys/filio.h usability... yes checking sys/filio.h presence... yes checking for sys/filio.h... yes checking sys/resource.h usability... yes checking sys/resource.h presence... yes checking for sys/resource.h... yes checking for struct msghdr.msg_control... yes checking for linux/netfilter_ipv4.h... no configure: **************************************** libraries checking for library containing gethostbyname... none required checking for library containing yp_get_default_domain... none required checking for library containing socket... none required checking for library containing openpty... none required checking for library containing dlopen... none required checking for library containing shl_load... no checking for library containing inflateEnd... -lz configure: **************************************** thread model checking for pthread_create in -lc_r... no checking for pthread_create in -lc... yes checking for pthread_create in -lpthread... yes configure: PTHREAD thread model detected configure: **************************************** library functions checking for snprintf... yes checking for vsnprintf... yes checking for openpty... yes checking for _getpty... no checking for daemon... yes checking for waitpid... yes checking for wait4... yes checking for setsid... yes checking for setgroups... yes checking for chroot... yes checking for sysconf... yes checking for getrlimit... yes checking for pthread_sigmask... yes checking for localtime_r... yes checking for getcontext... yes checking for __makecontext_v2... no checking for poll... yes checking for gethostbyname2... yes checking for endhostent... yes checking for getnameinfo... yes checking for getaddrinfo... yes checking for broken poll() implementation... yes (poll() disabled) checking for pipe2... no checking for accept4... no configure: **************************************** optional features checking whether to enable IPv6 support... yes checking whether to disable TCP wrappers library support... autodetecting checking for hosts_access in -lwrap... yes checking whether to enable FIPS mode support... autodetecting configure: **************************************** SSL checking for SSL directory... /usr/local/ssl checking /usr/local/ssl/include/openssl/engine.h usability... yes checking /usr/local/ssl/include/openssl/engine.h presence... yes checking for /usr/local/ssl/include/openssl/engine.h... yes checking /usr/local/ssl/include/openssl/ocsp.h usability... yes checking /usr/local/ssl/include/openssl/ocsp.h presence... yes checking for /usr/local/ssl/include/openssl/ocsp.h... yes checking for FIPS_mode_set... no configure: **************************************** write the results configure: creating ./config.status config.status: creating Makefile config.status: creating src/Makefile config.status: creating src/stunnel3 config.status: creating doc/Makefile config.status: creating tools/Makefile config.status: creating tools/stunnel.conf-sample config.status: creating tools/stunnel.init config.status: creating tools/stunnel.service config.status: creating src/config.h config.status: executing depfiles commands config.status: executing libtool commands configure: **************************************** success $ make -w make: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52' Making all in src make[1]: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52/src' make all-am make[2]: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52/src' /bin/sh ../libtool --tag=CC --mode=compile gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT env.lo -MD -MP -MF .deps/env.Tpo -c -o env.lo env.c libtool: compile: gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT env.lo -MD -MP -MF .deps/env.Tpo -c env.c -fno-common -DPIC -o .libs/env.o libtool: compile: gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT env.lo -MD -MP -MF .deps/env.Tpo -c env.c -o env.o >/dev/null 2>&1 mv -f .deps/env.Tpo .deps/env.Plo /bin/sh ../libtool --tag=CC --mode=link gcc-4.2 -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -avoid-version -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -o libstunnel.la -rpath /usr/local/lib/stunnel env.lo -lz -L/usr/local/ssl/lib -L/usr/local/lib/libquicktime -L/usr/local/lib -L/usr/X11/lib -L/usr/lib -lpthread -lwrap libtool: link: gcc-4.2 -dynamiclib -Wl,-undefined -Wl,dynamic_lookup -o .libs/libstunnel.dylib .libs/env.o -lz -L/usr/local/ssl/lib -L/usr/local/lib/libquicktime -L/usr/local/lib -L/usr/X11/lib -L/usr/lib /usr/local/lib/libpthread.dylib -lwrap -mtune=core2 -march=core2 -arch i386 -mtune=core2 -march=core2 -arch i386 -install_name /usr/local/lib/stunnel/libstunnel.dylib -Wl,-single_module libtool: link: dsymutil .libs/libstunnel.dylib || : warning: no debug symbols in executable (-arch i386) libtool: link: ar cru .libs/libstunnel.a env.o libtool: link: ranlib .libs/libstunnel.a libtool: link: ( cd ".libs" && rm -f "libstunnel.la" && ln -s "../libstunnel.la" "libstunnel.la" ) gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-str.o -MD -MP -MF .deps/stunnel-str.Tpo -c -o stunnel-str.o `test -f 'str.c' || echo './'`str.c mv -f .deps/stunnel-str.Tpo .deps/stunnel-str.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-file.o -MD -MP -MF .deps/stunnel-file.Tpo -c -o stunnel-file.o `test -f 'file.c' || echo './'`file.c mv -f .deps/stunnel-file.Tpo .deps/stunnel-file.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-client.o -MD -MP -MF .deps/stunnel-client.Tpo -c -o stunnel-client.o `test -f 'client.c' || echo './'`client.c mv -f .deps/stunnel-client.Tpo .deps/stunnel-client.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-log.o -MD -MP -MF .deps/stunnel-log.Tpo -c -o stunnel-log.o `test -f 'log.c' || echo './'`log.c mv -f .deps/stunnel-log.Tpo .deps/stunnel-log.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-options.o -MD -MP -MF .deps/stunnel-options.Tpo -c -o stunnel-options.o `test -f 'options.c' || echo './'`options.c mv -f .deps/stunnel-options.Tpo .deps/stunnel-options.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-protocol.o -MD -MP -MF .deps/stunnel-protocol.Tpo -c -o stunnel-protocol.o `test -f 'protocol.c' || echo './'`protocol.c mv -f .deps/stunnel-protocol.Tpo .deps/stunnel-protocol.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-network.o -MD -MP -MF .deps/stunnel-network.Tpo -c -o stunnel-network.o `test -f 'network.c' || echo './'`network.c mv -f .deps/stunnel-network.Tpo .deps/stunnel-network.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-resolver.o -MD -MP -MF .deps/stunnel-resolver.Tpo -c -o stunnel-resolver.o `test -f 'resolver.c' || echo './'`resolver.c mv -f .deps/stunnel-resolver.Tpo .deps/stunnel-resolver.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-ssl.o -MD -MP -MF .deps/stunnel-ssl.Tpo -c -o stunnel-ssl.o `test -f 'ssl.c' || echo './'`ssl.c mv -f .deps/stunnel-ssl.Tpo .deps/stunnel-ssl.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-ctx.o -MD -MP -MF .deps/stunnel-ctx.Tpo -c -o stunnel-ctx.o `test -f 'ctx.c' || echo './'`ctx.c mv -f .deps/stunnel-ctx.Tpo .deps/stunnel-ctx.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-verify.o -MD -MP -MF .deps/stunnel-verify.Tpo -c -o stunnel-verify.o `test -f 'verify.c' || echo './'`verify.c mv -f .deps/stunnel-verify.Tpo .deps/stunnel-verify.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-sthreads.o -MD -MP -MF .deps/stunnel-sthreads.Tpo -c -o stunnel-sthreads.o `test -f 'sthreads.c' || echo './'`sthreads.c mv -f .deps/stunnel-sthreads.Tpo .deps/stunnel-sthreads.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-stunnel.o -MD -MP -MF .deps/stunnel-stunnel.Tpo -c -o stunnel-stunnel.o `test -f 'stunnel.c' || echo './'`stunnel.c stunnel.c: In function ‘daemonize’: stunnel.c:459: warning: ‘daemon’ is deprecated (declared at /usr/include/stdlib.h:289) mv -f .deps/stunnel-stunnel.Tpo .deps/stunnel-stunnel.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-pty.o -MD -MP -MF .deps/stunnel-pty.Tpo -c -o stunnel-pty.o `test -f 'pty.c' || echo './'`pty.c mv -f .deps/stunnel-pty.Tpo .deps/stunnel-pty.Po gcc-4.2 -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -I/usr/local/ssl/include -I/usr/X11/include -I/usr/local/include -I/WhichXcode/Headers/FlatCarbon -I/usr/include -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-libwrap.o -MD -MP -MF .deps/stunnel-libwrap.Tpo -c -o stunnel-libwrap.o `test -f 'libwrap.c' || echo './'`libwrap.c mv -f .deps/stunnel-libwrap.Tpo .deps/stunnel-libwrap.Po /bin/sh ../libtool --tag=CC --mode=link gcc-4.2 -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -L/usr/local/ssl/lib64 -L/usr/local/ssl/lib -lssl -lcrypto -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -o stunnel stunnel-str.o stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o -lz -L/usr/local/ssl/lib -L/usr/local/lib/libquicktime -L/usr/local/lib -L/usr/X11/lib -L/usr/lib -lpthread -lwrap libtool: link: gcc-4.2 -pthread -fstack-protector -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -Wall -Wextra -Wno-long-long -pedantic -Os -mtune=core2 -march=core2 -force_cpusubtype_ALL -arch i386 -o stunnel stunnel-str.o stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o -L/usr/local/ssl/lib64 -L/usr/local/ssl/lib -lssl -lcrypto -lz -L/usr/local/lib/libquicktime -L/usr/local/lib -L/usr/X11/lib -L/usr/lib /usr/local/lib/libpthread.dylib -lwrap -pthread ld: warning: directory not found for option '-L/usr/local/ssl/lib64' make[2]: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52/src' make[1]: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52/src' Making all in doc make[1]: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52/doc' make[1]: Nothing to be done for `all'. make[1]: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52/doc' Making all in tools make[1]: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52/tools' make[1]: Nothing to be done for `all'. make[1]: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52/tools' make[1]: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52' make[1]: Nothing to be done for `all-am'. make[1]: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52' make: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52' $ sudo make -w install Password: make: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52' Making install in src make[1]: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52/src' make[2]: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52/src' test -z "/usr/local/bin" || /usr/local/bin/mkdir -p "/usr/local/bin" /bin/sh ../libtool --mode=install /usr/local/bin/install -c stunnel '/usr/local/bin' libtool: install: /usr/local/bin/install -c stunnel /usr/local/bin/stunnel test -z "/usr/local/bin" || /usr/local/bin/mkdir -p "/usr/local/bin" /usr/local/bin/install -c stunnel3 '/usr/local/bin' test -z "/usr/local/lib/stunnel" || /usr/local/bin/mkdir -p "/usr/local/lib/stunnel" /bin/sh ../libtool --mode=install /usr/local/bin/install -c libstunnel.la '/usr/local/lib/stunnel' libtool: install: /usr/local/bin/install -c .libs/libstunnel.dylib /usr/local/lib/stunnel/libstunnel.dylib libtool: install: /usr/local/bin/install -c .libs/libstunnel.lai /usr/local/lib/stunnel/libstunnel.la libtool: install: /usr/local/bin/install -c .libs/libstunnel.a /usr/local/lib/stunnel/libstunnel.a libtool: install: chmod 644 /usr/local/lib/stunnel/libstunnel.a libtool: install: ranlib /usr/local/lib/stunnel/libstunnel.a ---------------------------------------------------------------------- Libraries have been installed in: /usr/local/lib/stunnel If you ever happen to want to link against installed libraries in a given directory, LIBDIR, you must either use libtool, and specify the full pathname of the library, or use the `-LLIBDIR' flag during linking and do at least one of the following: - add LIBDIR to the `DYLD_LIBRARY_PATH' environment variable during execution See any operating system documentation about shared libraries for more information, such as the ld(1) and ld.so(8) manual pages. ---------------------------------------------------------------------- make[2]: Nothing to be done for `install-data-am'. make[2]: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52/src' make[1]: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52/src' Making install in doc make[1]: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52/doc' make[2]: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52/doc' make[2]: Nothing to be done for `install-exec-am'. test -z "/usr/local/share/doc/stunnel" || /usr/local/bin/mkdir -p "/usr/local/share/doc/stunnel" /usr/local/bin/install -c -m 644 stunnel.html stunnel.pl.html stunnel.fr.html '/usr/local/share/doc/stunnel' test -z "/usr/local/share/man/man8" || /usr/local/bin/mkdir -p "/usr/local/share/man/man8" /usr/local/bin/install -c -m 644 stunnel.8 stunnel.pl.8 stunnel.fr.8 '/usr/local/share/man/man8' make[2]: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52/doc' make[1]: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52/doc' Making install in tools make[1]: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52/tools' make[2]: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52/tools' make[2]: Nothing to be done for `install-exec-am'. test -z "/usr/local/etc/stunnel" || /usr/local/bin/mkdir -p "/usr/local/etc/stunnel" /usr/local/bin/install -c -m 644 stunnel.conf-sample '/usr/local/etc/stunnel' if test ! -r /usr/local/etc/stunnel/stunnel.pem; then \ if test -r "/dev/urandom"; then \ dd if="/dev/urandom" of=stunnel.rnd bs=256 count=1; \ RND="-rand stunnel.rnd"; \ else \ RND=""; \ fi; \ /usr/local/ssl/bin/openssl req -new -x509 -days 365 $RND \ -config ./stunnel.cnf \ -out stunnel.pem -keyout stunnel.pem; \ /usr/local/ssl/bin/openssl gendh $RND 1024 >> stunnel.pem; \ /usr/local/ssl/bin/openssl x509 -subject -dates -fingerprint -noout -in stunnel.pem; \ /usr/local/bin/install -c -m 600 stunnel.pem /usr/local/etc/stunnel/stunnel.pem; \ rm stunnel.pem; \ fi /usr/local/bin/install -c -d -m 1770 /usr/local/var/lib/stunnel chgrp nogroup /usr/local/var/lib/stunnel if uname | grep SunOS; then \ /usr/local/bin/install -c -d -m 755 /usr/local/var/lib/stunnel/dev; \ mknod /usr/local/var/lib/stunnel/dev/zero c 13 12; \ chmod 666 /usr/local/var/lib/stunnel/dev/zero; \ fi test -z "/usr/local/share/doc/stunnel/examples" || /usr/local/bin/mkdir -p "/usr/local/share/doc/stunnel/examples" /usr/local/bin/install -c -m 644 ca.html ca.pl importCA.html importCA.sh script.sh stunnel.spec stunnel.init stunnel.service '/usr/local/share/doc/stunnel/examples' make[2]: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52/tools' make[1]: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52/tools' make[1]: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52' make[2]: Entering directory `/Volumes/RamDisk/Safari/stunnel-4.52' make[2]: Nothing to be done for `install-exec-am'. test -z "/usr/local/share/doc/stunnel" || /usr/local/bin/mkdir -p "/usr/local/share/doc/stunnel" /usr/local/bin/install -c -m 644 INSTALL README TODO COPYING AUTHORS ChangeLog PORTS BUGS COPYRIGHT.GPL CREDITS INSTALL.W32 INSTALL.WCE INSTALL.FIPS '/usr/local/share/doc/stunnel' make[2]: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52' make[1]: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52' make: Leaving directory `/Volumes/RamDisk/Safari/stunnel-4.52' $ _ ---end--- If it matters, I have a local checkout of the openssl-cvs repo here, and use it instead-of Apple's. [BTW I have a personal project to "jump off this fruity ship" ASAP. I've written about this in earlier posts (several months ago) to the Pan maillist, if anyone is interested.] Thanks for any help at all. --

2 3

Re: [stunnel-users] Stunnel 4.33 last one to work with VM & IMAP
by Michal Trojnara 11 Jan '12

11 Jan '12

Mark Wogahn wrote: > No joy here. The thing that bugs me the most about this problem is > why do stunnel versions after 4.33 work on linux and bsd but not Mac > OS? It looks like Apple has put some serious effort to make its TCP/IP stack incompatible with other operating systems. Here is the the version I successfully tested against Mac OS X 10.5.8 (PowerPC): ftp://ftp.stunnel.org/stunnel/beta/stunnel-4.52b2.tar.gz Mike

1 0

Stunnel 4.33 last one to work with VM & IMAP
by Drew McDermott 11 Jan '12

11 Jan '12

I am running VM 8.1, the Emacs mail reader, connecting via imap to gmail. It can be made to work with stunnel 4.33 providing the encryption, but any version after that causes VM to choke when fetching messages, generating the following error message: vm-imap-protocol-error: IMAP protocol error: "unexpected char (10)" Not being an expert in any of the programs that are chained together to make my e-mail setup work, I was able to trace this no deeper than the point where VM reads the buffer Emacs uses for interprocess communication. Sure enough, there is a linefeed in a place where it isn't expected, but it also happens to be the first character in the sequence: " Process IMAP over SSL finished " which may be there because of problems deeper than the representation of "newline." At the end of this message I give my attempt to represent the complete contents of the buffer with name "trace of IMAP over SSL session to imap.gmail.com." The ^M's were inserted by hand because cutting and pasting didn't seem to reproduce them. I realize that I am providing quite a bit of information from VM, and none from stunnel, which is frustrating in an stunnel forum, but I am a complete newbie regarding stunnel. I would be glad to run further experiments with guidance on how to get stunnel itself to generate more useful information. The only reason I suspect it is that installing version 4.33 fixes the problem; but I realize it may be that VM or some other component is violating the rules somehow. When I say "any version after" 4.33, I mean that I have tried 4.35, the version installed by MacPorts; and 4.49, the latest stable version, recompiled by hand. They behave identically. -- Drew McDermott Professor of Computer Science Yale Computer Science Department The interprocess-communication buffer (everything between the dashes, including the newline after "finished," but not including the newline before "starting"): --------------- starting IMAP over SSL session Tue Nov 29 14:20:01 2011 connecting to imap.gmail.com:993 connected * OK Gimap ready for requests from 128.36.148.241 s17if7011003qao.19 VM CAPABILITY Process IMAP over SSL finished ---------------

2 3

Problem with startup of stunnel
by Villiboy＠web.de 10 Jan '12

10 Jan '12

2 1

stunnel 4.51 released
by Michal Trojnara 09 Jan '12

09 Jan '12

Dear Users, I have released version 4.51 of stunnel. The ChangeLog entry: Version 4.51, 2012.01.09, urgency: MEDIUM: * New features - Updated Win32 binary distribution OpenSSL DLLs to version 0.9.8s-fips. - Updated Android binary OpenSSL to version 1.0.0f. - Zlib support added to Win32 and Android binary builds. - New "compression = deflate" global option to enable RFC 2246 compresion. For compatibility with previous versions "compression = zlib" and "compression = rle" also enable the deflate (RFC 2246) compression. - Separate default ciphers and sslVersion for "fips = yes" and "fips = no". - UAC support for editing configuration file with Windows GUI. * Bugfixes - Fixed exec+connect sections. - Added a workaround for broken Android getaddrinfo(): http://stackoverflow.com/questions/7818246/segmentation-fault-in-getaddrinfo Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.51.tar.gz: dc52b22de48a2d71ab6170adb628dbe05dd406d6c9103fc43fbdbda776c3e90b Best regards, Mike

1 0

Basic initialization failed at gui.cpp, line 842
by K Rasmussen 09 Jan '12

09 Jan '12

Hi I have downloaded and installed: stunnel-4.50-installer.exe stunnel crash with message: Basic initialization failed at gui.cpp, line 842 Adding debug flag in .conf file does not generate any log file. Any suggestions on how to proceed is welcome. Best Regards K Rasmussn

2 1

Stunnel is not working on one computer
by Reuven Sabi 01 Jan '12

01 Jan '12

Hello to all! I have a problem i have installed on my laptop in order to work with one service , i have to say it works like a charm , but it doesn't work on my PC both computers have Windows 7 No firewall in windows No firewall in router I can not understand what is missing , why is it working on what computer and on other is not This is my sunnel.conf client= yes debug= 7 output= stunnel.log [Rates] accept = 127.0.0.1:11009 connect = XXXXXXXXX.com:14009 [Deals] accept = 127.0.0.1:12009 connect = XXXXXXXXX.com:15009 Thanks in advance i appreciate any help.

3 3

Missing bytes?
by Arthur Murray 01 Jan '12

01 Jan '12

Hello, When I telnet to my pop3 server and "QUIT" this is what I see: Escape character is '^]'. +OK InterMail POP3 server ready. QUIT +OK ? InterMail POP3 server signing off. Connection closed by foreign host. When I setup an stunnel 4.5 to the same pop3 server: [pop3s] accept = 995 connect = server:110 and connect with "openssl s_client -connect localhost:995" this is what I see: +OK InterMail POP3 server ready. QUIT DONE And the stunnel log reports: Connection closed: 34 bytes sent to SSL, 0 bytes sent to socket What happened to the last line "+OK ? InterMail POP3 server signing off." and why aren't the counters counting the 5 bytes I sent ("QUIT\n") and the last line of 41 sent over the SSL? Example 2 through stunnel: +OK InterMail POP3 server ready. USER -ERR a user name MUST be entered QUIT DONE Connection closed: 68 bytes sent to SSL, 5 bytes sent to socket (still missing the last bytes)

2 4

Segfault with stunnel
by yassine ayachi 23 Dec '11

23 Dec '11

Hi all, I'am trying to encrypt a connection between two hosts using stunnel. ----- here is my config file ---- cert = /usr/local/etc/stunnel/stunnel.pem chroot = /usr/local/var/lib/stunnel/ setuid = nobody setgid = nogroup pid = /stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = debug output = stunnel.log --- [rdps] accept = 1957 connect = remote_machine:3389 Avery think was working fine until I tried to telnet to the port 1957 on the machine running stunnel, the process stunnel was killed alone leaving this in /var/log/messages : Dec 20 16:58:01 alpha kernel: [4930384.164316] stunnel[14540]: segfault at 8 ip b7629b61 sp b758d16c error 6 in libc-2.7.so[b75bd000+138000] Does anybody have an idea about this problem, thanks in advance, Yassine

3 6

Re: [stunnel-users] Configuring VeriSign certificate with STunnel
by Zubair Ali Mansoor 22 Dec '11

22 Dec '11

Hi Guys, Thanks for your replies. I tried following commands on verisign c certificate, for both of these do not work. There is error 'unable to load certificate'. openssl x509 -inform DER -in stunnel.pem -noout -text or openssl x509 -inform PEM -in stunnel.pem -noout -text however if I run same command (openssl x509 -inform PEM -in stunnel.pem -noout -text) on VeriSign root & Intermediate certificate it works. It shows format should be 'pem'. But somehow certificate is not valid. I am using following commands to create csr and private key. Are these correct ? openssl genrsa -des3 -out server.key 2048 openssl req -new -key server.key -out server.csr Thanks, Zubair -----Original Message----- From: stunnel-users-bounces(a)stunnel.org [mailto:[email protected]] On Behalf Of stunnel-users-request(a)stunnel.org Sent: Wednesday, December 21, 2011 9:27 PM To: stunnel-users(a)stunnel.org Subject: stunnel-users Digest, Vol 89, Issue 21 Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit http://stunnel.mirt.net/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. Re: Configuring VeriSign certificate with STunnel (Michal Trojnara) 2. stunnel segfault, please advise (Mehdi Bennani) 3. Re: Configuring VeriSign certificate with STunnel (Ludovic LEVET) 4. Segfault with stunnel (yassine ayachi) 5. Re: Segfault with stunnel (Scott Damron) 6. unsubscribe (Brian McGinity) 7. Re: Missing bytes? (Arthur Murray) 8. Re: Segfault with stunnel (yassine ayachi) ---------------------------------------------------------------------- Message: 1 Date: Wed, 21 Dec 2011 13:30:45 +0100 From: Michal Trojnara <Michal.Trojnara(a)mirt.net> To: <stunnel-users(a)stunnel.org> Subject: Re: [stunnel-users] Configuring VeriSign certificate with STunnel Message-ID: <f039775ca5efe5be73a2858b88f0ebc2(a)mirt.net> Content-Type: text/plain; charset=UTF-8; format=flowed Zubair Ali Mansoor wrote: > 2011.12.21 13:31:30 LOG3[5144:2256]: > SSL_CTX_use_certificate_chain_file: > D0680A8: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong > tag I don't think this problem is specific to stunnel: https://encrypted.google.com/search?q=%22ASN1_CHECK_TLEN%3Awrong+tag%22+veri sign Mike ------------------------------ Message: 2 Date: Wed, 21 Dec 2011 07:34:19 -0500 From: Mehdi Bennani <mehdibennani(a)hotmail.com> To: <stunnel-users(a)stunnel.org> Subject: [stunnel-users] stunnel segfault, please advise Message-ID: <SNT134-W33BCBEA69CFD9694C37B7EC3A50(a)phx.gbl> Content-Type: text/plain; charset="iso-8859-1" Hi you guys, I proposed stunnel as a potential solution to our product about 4-5 months ago and I am in the process of testing a prototype I have built around that proposition. I am using stunnel v. 4.41. I am relatively new to stunnel myself. The env. is as follows: We are trying to secure an rdp connection from a java applet running in a web browser into a windows 2008 server machine behind our firewall. Presently, the java applet opens up an RDP connection into a machine (I will call it the SSL machine) where Stunnel is presently installed. Stunnel then forwards properly the incoming traffic (from portA) into its final destination (i.e: the windows Server 2008 machine) on port B. Further, I have configured Stunnel to use an SSL certificate. (Although, I have not been able to test that yet to make sure it works) Anyhow, it is all working as expected and I am pretty happy about the proof of concept. However, while testing it a bit, I noticed that it was relatively easy to bring stunnel down. The way I went about it, was to simply run a "telnet IP_of_MySSLMachine portA" from any DOS command window from any machine with internet access. From the Stunnel logs, I can tell that I get a response from Stunnel and on the DOS window side, I have a cursor waiting for input.... Writing any gibberish into that DOS windows and waiting a little bit makes stunnel stop and die in the SSL machine. I found nothing in the stunnel log, but grepping in the /var/log/, I found the segfault sslmahine:/var/log/# grep stunnel messages kernel: [1996904.624042] stunnel [19696]: segfault at 8 ip b768d361 sp b7601210 error 4 in libc-2.7.so[b7621000+138000] After another telnet execution, few days later: sslmahine:/var/log/# grep stunnel messages kernel: [4930384.164316] stunnel [14540]: segfault at 8 ip b7629b61 error 6 in libc-2.7.so[b75bd000+138000] Basically, if I don't issue that telnet command, stunnel works properly. As soon as I issue that command and start typing few things in that DOS console, stunnel dies. I have to manually restart it. Question: I was wondering if you guys could shed some light into this behavior. Is it a known behavior/bug? Is there a way to solve it by maybe upgrading into a later version of stunnel? Also, I was thinking to block telnet altogether at the firewall level, but then I am not sure what other protocols could people use to hack into the system...so should I block all of them? And, finally is there a more secure way to setup stunnel? Thank you in advance Mehdi/

2 1

building browser like client application based on OpenSSL
by Zubair Ali Mansoor 22 Dec '11

22 Dec '11

Hi, Can I develop an application based on OpenSSL such that it can communicate with all trusted sites ? Like browser can communicates? Actually I have desktop application that uses SSL. Now this application may communicate with any trusted server application. How can I achieve this ? Thanks, Zubair -----Original Message----- From: stunnel-users-bounces(a)stunnel.org [mailto:[email protected]] On Behalf Of stunnel-users-request(a)stunnel.org Sent: Wednesday, December 21, 2011 9:27 PM To: stunnel-users(a)stunnel.org Subject: stunnel-users Digest, Vol 89, Issue 21 Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit http://stunnel.mirt.net/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. Re: Configuring VeriSign certificate with STunnel (Michal Trojnara) 2. stunnel segfault, please advise (Mehdi Bennani) 3. Re: Configuring VeriSign certificate with STunnel (Ludovic LEVET) 4. Segfault with stunnel (yassine ayachi) 5. Re: Segfault with stunnel (Scott Damron) 6. unsubscribe (Brian McGinity) 7. Re: Missing bytes? (Arthur Murray) 8. Re: Segfault with stunnel (yassine ayachi) ---------------------------------------------------------------------- Message: 1 Date: Wed, 21 Dec 2011 13:30:45 +0100 From: Michal Trojnara <Michal.Trojnara(a)mirt.net> To: <stunnel-users(a)stunnel.org> Subject: Re: [stunnel-users] Configuring VeriSign certificate with STunnel Message-ID: <f039775ca5efe5be73a2858b88f0ebc2(a)mirt.net> Content-Type: text/plain; charset=UTF-8; format=flowed Zubair Ali Mansoor wrote: > 2011.12.21 13:31:30 LOG3[5144:2256]: > SSL_CTX_use_certificate_chain_file: > D0680A8: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong > tag I don't think this problem is specific to stunnel: https://encrypted.google.com/search?q=%22ASN1_CHECK_TLEN%3Awrong+tag%22+veri sign Mike ------------------------------ Message: 2 Date: Wed, 21 Dec 2011 07:34:19 -0500 From: Mehdi Bennani <mehdibennani(a)hotmail.com> To: <stunnel-users(a)stunnel.org> Subject: [stunnel-users] stunnel segfault, please advise Message-ID: <SNT134-W33BCBEA69CFD9694C37B7EC3A50(a)phx.gbl> Content-Type: text/plain; charset="iso-8859-1" Hi you guys, I proposed stunnel as a potential solution to our product about 4-5 months ago and I am in the process of testing a prototype I have built around that proposition. I am using stunnel v. 4.41. I am relatively new to stunnel myself. The env. is as follows: We are trying to secure an rdp connection from a java applet running in a web browser into a windows 2008 server machine behind our firewall. Presently, the java applet opens up an RDP connection into a machine (I will call it the SSL machine) where Stunnel is presently installed. Stunnel then forwards properly the incoming traffic (from portA) into its final destination (i.e: the windows Server 2008 machine) on port B. Further, I have configured Stunnel to use an SSL certificate. (Although, I have not been able to test that yet to make sure it works) Anyhow, it is all working as expected and I am pretty happy about the proof of concept. However, while testing it a bit, I noticed that it was relatively easy to bring stunnel down. The way I went about it, was to simply run a "telnet IP_of_MySSLMachine portA" from any DOS command window from any machine with internet access. From the Stunnel logs, I can tell that I get a response from Stunnel and on the DOS window side, I have a cursor waiting for input.... Writing any gibberish into that DOS windows and waiting a little bit makes stunnel stop and die in the SSL machine. I found nothing in the stunnel log, but grepping in the /var/log/, I found the segfault sslmahine:/var/log/# grep stunnel messages kernel: [1996904.624042] stunnel [19696]: segfault at 8 ip b768d361 sp b7601210 error 4 in libc-2.7.so[b7621000+138000] After another telnet execution, few days later: sslmahine:/var/log/# grep stunnel messages kernel: [4930384.164316] stunnel [14540]: segfault at 8 ip b7629b61 error 6 in libc-2.7.so[b75bd000+138000] Basically, if I don't issue that telnet command, stunnel works properly. As soon as I issue that command and start typing few things in that DOS console, stunnel dies. I have to manually restart it. Question: I was wondering if you guys could shed some light into this behavior. Is it a known behavior/bug? Is there a way to solve it by maybe upgrading into a later version of stunnel? Also, I was thinking to block telnet altogether at the firewall level, but then I am not sure what other protocols could people use to hack into the system...so should I block all of them? And, finally is there a more secure way to setup stunnel? Thank you in advance Mehdi/

2 2

unsubscribe
by Brian McGinity 21 Dec '11

21 Dec '11

Unsubscribe

1 0

Re: [stunnel-users] Configuring VeriSign certificate with STunnel
by Zubair Ali Mansoor 21 Dec '11

21 Dec '11

Hi, Thanks for your response. Here is log file. 2011.12.21 13:31:30 LOG7[5144:2256]: Snagged 64 random bytes from C:/.rnd 2011.12.21 13:31:30 LOG7[5144:2256]: Wrote 1024 new random bytes to C:/.rnd 2011.12.21 13:31:30 LOG7[5144:2256]: RAND_status claims sufficient entropy for the PRNG 2011.12.21 13:31:30 LOG7[5144:2256]: PRNG seeded successfully 2011.12.21 13:31:30 LOG7[5144:2256]: Certificate: zos.pem 2011.12.21 13:31:30 LOG3[5144:2256]: Error reading certificate file: zos.pem 2011.12.21 13:31:30 LOG3[5144:2256]: error stack: 140DC009 : error:140DC009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib 2011.12.21 13:31:30 LOG3[5144:2256]: error stack: 906700D : error:0906700D:PEM routines:PEM_ASN1_read_bio:ASN1 lib 2011.12.21 13:31:30 LOG3[5144:2256]: error stack: D08303A : error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error 2011.12.21 13:31:30 LOG3[5144:2256]: error stack: D07803A : error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error 2011.12.21 13:31:30 LOG3[5144:2256]: SSL_CTX_use_certificate_chain_file: D0680A8: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag 2011.12.21 13:31:30 LOG3[5144:2256]: Server is down Please let me know if you need further information. Thanks, Zubair -----Original Message----- From: stunnel-users-bounces(a)stunnel.org [mailto:[email protected]] On Behalf Of stunnel-users-request(a)stunnel.org Sent: Wednesday, December 21, 2011 12:56 PM To: stunnel-users(a)stunnel.org Subject: stunnel-users Digest, Vol 89, Issue 18 Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit http://stunnel.mirt.net/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. Unable to make Stunnel on Solaris 10 (ted.pritchard(a)steria.co.uk) 2. Incompatibility between openssl 1.0.0 and 0.9.8 which cause stunnel windows version malfunction. (ayanamist) 3. Configuring VeriSign certificate with STunnel (Zubair Ali Mansoor) 4. Re: Incompatibility between openssl 1.0.0 and 0.9.8 which cause stunnel windows version malfunction. (Ludovic LEVET) 5. Re: Configuring VeriSign certificate with STunnel (Ludovic LEVET) ---------------------------------------------------------------------- Message: 1 Date: Tue, 20 Dec 2011 16:04:08 +0000 From: ted.pritchard(a)steria.co.uk To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Unable to make Stunnel on Solaris 10 Message-ID: <OFBAF4145D.79BD6AD7-ON8025796C.0056E111-8025796C.005844D7(a)xansa.com> Content-Type: text/plain; charset="us-ascii" Hi, I'm trying to compile and install Stunnel 4.47 on a Solaris 10 container. My GCC version is 3.4.3. The problem is that I get the following error during make make gcc:unrecognized option: '-pthread' Should I be able to compile Stunnel using this configuration or is there some option I can use to make it work? For interest, In the past using Stunnel 3.34 I've not had this problem so something in the build process must have changed. Many Thanks Ted This email originates from Steria*. It, and any attachments, may contain confidential information and may be subject to copyright or other intellectual property rights. It is only for the use of the addressee(s). You may not copy, forward, disclose, save or otherwise use it in any way if you are not the addressee(s) or responsible for delivery. If you receive this email by mistake, please advise the sender and cancel it immediately. Steria may monitor the content of emails within its network to ensure compliance with its policies and procedures. Any email is susceptible to alteration and its integrity cannot be assured. Steria shall not be liable if the message is altered, modified, falsified, or edited. _____________________________________________________ * Steria Limited, number 4077975; Steria Recruitment Limited, number 1437998. Registered in England and Wales; registered office Three Cherry Trees Lane, Hemel Hempstead, Hertfordshire HP2 7AH

3 2

stunnel segfault, please advise
by Mehdi Bennani 21 Dec '11

21 Dec '11

Hi you guys, I proposed stunnel as a potential solution to our product about 4-5 months ago and I am in the process of testing a prototype I have built around that proposition. I am using stunnel v. 4.41. I am relatively new to stunnel myself. The env. is as follows: We are trying to secure an rdp connection from a java applet running in a web browser into a windows 2008 server machine behind our firewall. Presently, the java applet opens up an RDP connection into a machine (I will call it the SSL machine) where Stunnel is presently installed. Stunnel then forwards properly the incoming traffic (from portA) into its final destination (i.e: the windows Server 2008 machine) on port B. Further, I have configured Stunnel to use an SSL certificate. (Although, I have not been able to test that yet to make sure it works) Anyhow, it is all working as expected and I am pretty happy about the proof of concept. However, while testing it a bit, I noticed that it was relatively easy to bring stunnel down. The way I went about it, was to simply run a "telnet IP_of_MySSLMachine portA" from any DOS command window from any machine with internet access. From the Stunnel logs, I can tell that I get a response from Stunnel and on the DOS window side, I have a cursor waiting for input.... Writing any gibberish into that DOS windows and waiting a little bit makes stunnel stop and die in the SSL machine. I found nothing in the stunnel log, but grepping in the /var/log/, I found the segfault sslmahine:/var/log/# grep stunnel messages kernel: [1996904.624042] stunnel [19696]: segfault at 8 ip b768d361 sp b7601210 error 4 in libc-2.7.so[b7621000+138000] After another telnet execution, few days later: sslmahine:/var/log/# grep stunnel messages kernel: [4930384.164316] stunnel [14540]: segfault at 8 ip b7629b61 error 6 in libc-2.7.so[b75bd000+138000] Basically, if I don't issue that telnet command, stunnel works properly. As soon as I issue that command and start typing few things in that DOS console, stunnel dies. I have to manually restart it. Question: I was wondering if you guys could shed some light into this behavior. Is it a known behavior/bug? Is there a way to solve it by maybe upgrading into a later version of stunnel? Also, I was thinking to block telnet altogether at the firewall level, but then I am not sure what other protocols could people use to hack into the system...so should I block all of them? And, finally is there a more secure way to setup stunnel? Thank you in advance Mehdi/

1 0

Incompatibility between openssl 1.0.0 and 0.9.8 which cause stunnel windows version malfunction.
by ayanamist 21 Dec '11

21 Dec '11

I generated a pair of key and certificates with openssl 1.0.0d, and use them in stunnel 4.36. Today i upgrade it to stunnel 4.50 and it doesnot work. All configurations remain unmodified. Then i tested many versions and found, stunnel with openssl 1.00 works fine while with openssl 0.98 does not work. I use stunnel with linux server and windows client, stunnel 4.50 windows version is using openssl 0.98, so cause this problem. 4.47 is using 1.00e which i think is newer than 0.98 bundled with 4.50. So why stunnel keep changing openssl version?

3 4

Re: [stunnel-users] Configuring VeriSign certificate with STunnel
by Zubair Ali Mansoor 21 Dec '11

21 Dec '11

Hi, Here are steps how I created certificate request and private key. Generate private key openssl genrsa -des3 -out server.key 2048 Generate certificate request openssl req -new -key server.key -out server.csr I submitted server.csr contents to VeriSign to get test certificate and they provided me three certificates. VeriSign signed certificated Root certificate Intermediate certificate I copied VeriSign signed certificate in stunnel.pem and other two certificates in ca.pem file. As per my observation STunnel is unable to load stunnel.pem file. If you need VeriSign test certificate I can provide you that as well. Please let me know if you need further information. Thanks, Zubair -----Original Message----- From: stunnel-users-bounces(a)stunnel.org [mailto:[email protected]] On Behalf Of stunnel-users-request(a)stunnel.org Sent: Wednesday, December 21, 2011 12:56 PM To: stunnel-users(a)stunnel.org Subject: stunnel-users Digest, Vol 89, Issue 18 Send stunnel-users mailing list submissions to stunnel-users(a)stunnel.org To subscribe or unsubscribe via the World Wide Web, visit http://stunnel.mirt.net/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)stunnel.org You can reach the person managing the list at stunnel-users-owner(a)stunnel.org When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..." Today's Topics: 1. Unable to make Stunnel on Solaris 10 (ted.pritchard(a)steria.co.uk) 2. Incompatibility between openssl 1.0.0 and 0.9.8 which cause stunnel windows version malfunction. (ayanamist) 3. Configuring VeriSign certificate with STunnel (Zubair Ali Mansoor) 4. Re: Incompatibility between openssl 1.0.0 and 0.9.8 which cause stunnel windows version malfunction. (Ludovic LEVET) 5. Re: Configuring VeriSign certificate with STunnel (Ludovic LEVET) ---------------------------------------------------------------------- Message: 1 Date: Tue, 20 Dec 2011 16:04:08 +0000 From: ted.pritchard(a)steria.co.uk To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Unable to make Stunnel on Solaris 10 Message-ID: <OFBAF4145D.79BD6AD7-ON8025796C.0056E111-8025796C.005844D7(a)xansa.com> Content-Type: text/plain; charset="us-ascii" Hi, I'm trying to compile and install Stunnel 4.47 on a Solaris 10 container. My GCC version is 3.4.3. The problem is that I get the following error during make make gcc:unrecognized option: '-pthread' Should I be able to compile Stunnel using this configuration or is there some option I can use to make it work? For interest, In the past using Stunnel 3.34 I've not had this problem so something in the build process must have changed. Many Thanks Ted This email originates from Steria*. It, and any attachments, may contain confidential information and may be subject to copyright or other intellectual property rights. It is only for the use of the addressee(s). You may not copy, forward, disclose, save or otherwise use it in any way if you are not the addressee(s) or responsible for delivery. If you receive this email by mistake, please advise the sender and cancel it immediately. Steria may monitor the content of emails within its network to ensure compliance with its policies and procedures. Any email is susceptible to alteration and its integrity cannot be assured. Steria shall not be liable if the message is altered, modified, falsified, or edited. _____________________________________________________ * Steria Limited, number 4077975; Steria Recruitment Limited, number 1437998. Registered in England and Wales; registered office Three Cherry Trees Lane, Hemel Hempstead, Hertfordshire HP2 7AH

1 0

Configuring VeriSign certificate with STunnel
by Zubair Ali Mansoor 21 Dec '11

21 Dec '11

Hi, I got VeriSign Test SSL certificate. I have been trying to configure it with STunnel. But there are errors in STunnel. I have placed private key and CA signed certificate in a separate file named 'stunnel.pem'. Root and Intermediate certificates have been placed in following order in a file named 'ca.pem' stunnel.pem -----BEGIN RSA PRIVATE KEY----- encrypted key -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- VeriSign signed certificate -----END CERTIFICATE----- ca.pem -----BEGIN CERTIFICATE----- VeriSign Intermediate CA Certificate -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- VeriSign Root CA Certificate -----END CERTIFICATE----- Here is stunnel.conf file. ;key = server.key cert = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff verify = 2 ; Don't forget to c_rehash CApath ;CApath = certs ; It's often easier to use CAfile CAfile = ca.pem ;CAfile=zosIntermediate.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting ;debug = 7 output = stunnel.log ; Use it for client mode client = no I have also tried to change order of certificates but nothing is working. Anyone have idea how it can work. Your cooperation will be highly appreciated. Thanks, Zubair

2 1

Unable to make Stunnel on Solaris 10
by ted.pritchard＠steria.co.uk 20 Dec '11

20 Dec '11

Hi, I'm trying to compile and install Stunnel 4.47 on a Solaris 10 container. My GCC version is 3.4.3. The problem is that I get the following error during make make gcc:unrecognized option: '-pthread' Should I be able to compile Stunnel using this configuration or is there some option I can use to make it work? For interest, In the past using Stunnel 3.34 I've not had this problem so something in the build process must have changed. Many Thanks Ted This email originates from Steria*. It, and any attachments, may contain confidential information and may be subject to copyright or other intellectual property rights. It is only for the use of the addressee(s). You may not copy, forward, disclose, save or otherwise use it in any way if you are not the addressee(s) or responsible for delivery. If you receive this email by mistake, please advise the sender and cancel it immediately. Steria may monitor the content of emails within its network to ensure compliance with its policies and procedures. Any email is susceptible to alteration and its integrity cannot be assured. Steria shall not be liable if the message is altered, modified, falsified, or edited. _____________________________________________________ * Steria Limited, number 4077975; Steria Recruitment Limited, number 1437998. Registered in England and Wales; registered office Three Cherry Trees Lane, Hemel Hempstead, Hertfordshire HP2 7AH

1 0

unsubscribe
by Brian McGinity 16 Dec '11

16 Dec '11

Unsubscribe

1 0

Re: [stunnel-users] Problem with sslv2 clients
by Ludovic LEVET 16 Dec '11

16 Dec '11

Hi, Normal, SSLv2 is disable by default since version 4.40. (http://www.stunnel.org/?page=sdf_ChangeLog) To re-enable it add in your config file : ciphers = ALL:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH (or other) and sslVersion = all Ludovic. > > > > Le 09/12/2011 15:37, Markus Borst a écrit : >> Hi, >> >> we have a strange problem with newer stunnel versions (4.50 on >> windows), compared to older ones (known to work is version 4.35). The >> problem seems to be, that if a client sends a SSLv2 Helo message, the >> stunnel server simply resets the TCP connection, without trying to >> negotioate anything. >> >> Setup: Stunnel is used top provide ssl/tls for imap, Hobbit is used >> to monitor service availability. The Hobbit module to monitor imaps >> seems to try SSLv2 first, but also supports newer versions (SSLv3 and >> TLSv1). The ssl connection never gets established, stunnel sends a >> tcp RST, hobbit never retries. We can force some hobbit modules to >> use TLSv1 exclusively, but not all of them. We fear that some older >> mailclients will also have problems initiating a connection, so we >> keep stunnel 4.35 running for now. >> >> stunnel.conf: >> >> fips = no >> debug = 7 >> output = stunnel.log >> >> [imaps] >> accept = 130.83.174.1:993 >> connect = 127.0.0.1:143 >> cert = imap.xxx.company.yy.pem >> >> >> stunnel.log: >> >> 2011.12.09 14:55:12 LOG5[6820:2144]: Service imaps accepted >> connection from xxx.yyy.zzz.105:45294 >> 2011.12.09 14:55:12 LOG3[6820:2144]: SSL_accept: 1408F10B: >> error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number >> 2011.12.09 14:55:12 LOG5[6820:2144]: Connection reset: 0 bytes sent >> to SSL, 0 bytes sent to socket >> 2011.12.09 14:55:12 LOG7[6820:2144]: Service imaps finished (0 left) >> 2011.12.09 14:55:12 LOG7[6820:2144]: str_stats: 0 block(s), 0 data >> byte(s), 0 control byte(s) >> >> >> >> Wireshark Packet Trace (see attached image). >> >> >> What's wrong here? Shouldn't client and server negotiate the methods >> used? The client seems to offer TLS ("Version: TLS 1.0 ..."), but >> instead of negotiating, the server simply closes the connection. >> >> >> Greetings >> Markus Borst >> >

4 6

Multiple Domains for https
by Brian McGinity 15 Dec '11

15 Dec '11

Will Stunnel work with multiple domains? For example if abc.com and xyz.com both resolve to the same ip address where the web server is running locally on port 4080. Going when to https://abc.com or https://xyz.com stunnel will encrypt the traffic and forward to the local 4080 port in the clear. What if 10 or 20 domains needed to be served by the same web server?

2 3

Reload/change CRL?
by John Abloyer 15 Dec '11

15 Dec '11

Hi, Is there a way to reload CRL, or actually change to a newer, *without* restarting stunnel?

2 1

Is Stunnel Right Tool for....?
by Brian McGinity 14 Dec '11

14 Dec '11

Is Stunnel the right tool for this situation? I am using an Intel disk monitoring tool which has the ability to send out email alerts. In the Email Setup it asks for Host, From and To, there is not a username or pw. Could Stunnel be configured to add the username and pw and send the message to gmail's smtp?

2 1

stunnel-4.50 on Nexus S android
by Jason Haar 14 Dec '11

14 Dec '11

Hi there I'm trying out the stunnel android binary from 4.50 on a rooted 2.3.6 Android, mapping localhost port 80 to a remote client-cert protected ActiveSync server. It crashes after a client makes a connection. Here's the "debug = 7" logs 2011.12.14 07:44:55 LOG7[8738:2949960768]: Private key loaded 2011.12.14 07:44:55 LOG7[8738:2949960768]: SSL options set: 0x00000004 2011.12.14 07:44:55 LOG6[8738:2949960768]: SSL context initialized 2011.12.14 07:44:55 LOG5[8738:2949960768]: Configuration successful 2011.12.14 07:44:55 LOG7[8738:2949960768]: Option SO_REUSEADDR set on accept socket 2011.12.14 07:44:55 LOG7[8738:2949960768]: Service ActiveSync bound to 0.0.0.0:80 2011.12.14 07:44:55 LOG7[8738:2949960768]: Service ActiveSync opened FD=5 2011.12.14 07:44:55 LOG7[8738:2949960768]: Created pid file /data/local/etc/stunnel/pid 2011.12.14 07:44:59 LOG7[8738:2949960768]: Service ActiveSync accepted FD=6 from 127.0.0.1:58088 2011.12.14 07:44:59 LOG7[8738:1525312]: Service ActiveSync started 2011.12.14 07:44:59 LOG7[8738:1525312]: Option TCP_NODELAY set on local socket ...[I do "telnet 127.0.0.1 80" ] 2011.12.14 07:44:59 LOG5[8738:1525312]: Service ActiveSync accepted connection from 127.0.0.1:58088 Segmentation fault Any ideas how to debug this? I basically grabbed a working config off my Linux laptop and moved it over (different paths of course), so I assume the binary is missing something? -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +1 408 481 8171 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

2 1

unsubscribe
by Brian McGinity 14 Dec '11

14 Dec '11

Unsubscribe

1 0

SSL alert (write): fatal: protocol version
by René Legault 14 Dec '11

14 Dec '11

Hi, I have an issue when using Stunnel. Can somebody help me? I have a module on my network that sends non-SSL e-mail but my ISP (Sympatico.ca) is accepting only SSL communication. This is my stunnel.conf file: cert = stunnel.pem protocol = smtp ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Some debugging stuff useful for troubleshooting debug = 7 output = stunnel.log ; Use it for client mode client = yes ; Service-level configuration [smtp] accept=192.168.1.17:25 connect = smtphm.sympatico.ca:25 And this is my log: 2011.12.13 19:55:06 LOG7[2468:1644]: Service smtp accepted FD=316 from 192.168.1.200:12149 2011.12.13 19:55:06 LOG7[2468:1644]: Creating a new thread 2011.12.13 19:55:06 LOG7[2468:1644]: New thread created 2011.12.13 19:55:06 LOG7[2468:2684]: Service smtp started 2011.12.13 19:55:06 LOG5[2468:2684]: Service smtp accepted connection from 192.168.1.200:12149 2011.12.13 19:55:06 LOG6[2468:2684]: connect_blocking: connecting 65.55.172.251:25 2011.12.13 19:55:06 LOG7[2468:2684]: connect_blocking: s_poll_wait 65.55.172.251:25: waiting 10 seconds 2011.12.13 19:55:06 LOG5[2468:2684]: connect_blocking: connected 65.55.172.251:25 2011.12.13 19:55:06 LOG5[2468:2684]: Service smtp connected remote server from 192.168.1.17:3013 2011.12.13 19:55:06 LOG7[2468:2684]: Remote FD=392 initialized 2011.12.13 19:55:06 LOG6[2468:2684]: Client-mode smtp protocol negotiations started 2011.12.13 19:55:06 LOG7[2468:2684]: <- 220 BLU0-SMTP6.phx.gbl Microsoft ESMTP MAIL Service, Version: 6.0.3790.4675 ready at Tue, 13 Dec 2011 16:55:06 -0800 2011.12.13 19:55:06 LOG7[2468:2684]: -> 220 BLU0-SMTP6.phx.gbl Microsoft ESMTP MAIL Service, Version: 6.0.3790.4675 ready at Tue, 13 Dec 2011 16:55:06 -0800 2011.12.13 19:55:06 LOG7[2468:2684]: -> EHLO localhost 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-BLU0-SMTP6.phx.gbl Hello [65.94.163.170] 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-TURN 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-SIZE 41943040 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-ETRN 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-PIPELINING 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-DSN 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-ENHANCEDSTATUSCODES 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-8bitmime 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-BINARYMIME 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-CHUNKING 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-VRFY 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-TLS 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250-STARTTLS 2011.12.13 19:55:06 LOG7[2468:2684]: <- 250 OK 2011.12.13 19:55:06 LOG7[2468:2684]: -> STARTTLS 2011.12.13 19:55:06 LOG7[2468:2684]: <- 220 2.0.0 SMTP server ready 2011.12.13 19:55:06 LOG6[2468:2684]: Client-mode smtp protocol negotiations succeeded 2011.12.13 19:55:06 LOG7[2468:2684]: SSL state (connect): before/connect initialization 2011.12.13 19:55:06 LOG7[2468:2684]: SSL state (connect): SSLv3 write client hello A 2011.12.13 19:55:06 LOG7[2468:2684]: SSL state (connect): SSLv3 read server hello A 2011.12.13 19:55:06 LOG7[2468:2684]: SSL state (connect): SSLv3 read server certificate A 2011.12.13 19:55:06 LOG7[2468:2684]: SSL state (connect): SSLv3 read server done A 2011.12.13 19:55:06 LOG7[2468:2684]: SSL state (connect): SSLv3 write client key exchange A 2011.12.13 19:55:06 LOG7[2468:2684]: SSL state (connect): SSLv3 write change cipher spec A 2011.12.13 19:55:06 LOG7[2468:2684]: SSL state (connect): SSLv3 write finished A 2011.12.13 19:55:06 LOG7[2468:2684]: SSL state (connect): SSLv3 flush data 2011.12.13 19:55:07 LOG7[2468:2684]: SSL state (connect): SSLv3 read finished A 2011.12.13 19:55:07 LOG7[2468:2684]: 1 items in the session cache 2011.12.13 19:55:07 LOG7[2468:2684]: 86477 client connects (SSL_connect()) 2011.12.13 19:55:07 LOG7[2468:2684]: 86477 client connects that finished 2011.12.13 19:55:07 LOG7[2468:2684]: 0 client renegotiations requested 2011.12.13 19:55:07 LOG7[2468:2684]: 0 server connects (SSL_accept()) 2011.12.13 19:55:07 LOG7[2468:2684]: 0 server connects that finished 2011.12.13 19:55:07 LOG7[2468:2684]: 0 server renegotiations requested 2011.12.13 19:55:07 LOG7[2468:2684]: 0 session cache hits 2011.12.13 19:55:07 LOG7[2468:2684]: 0 external session cache hits 2011.12.13 19:55:07 LOG7[2468:2684]: 0 session cache misses 2011.12.13 19:55:07 LOG7[2468:2684]: 0 session cache timeouts 2011.12.13 19:55:07 LOG6[2468:2684]: SSL connected: new session negotiated 2011.12.13 19:55:07 LOG6[2468:2684]: Negotiated ciphers: DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 2011.12.13 19:55:07 LOG6[2468:2684]: Compression: null, expansion: null 2011.12.13 19:55:07 LOG7[2468:2684]: SSL alert (write): fatal: protocol version 2011.12.13 19:55:07 LOG3[2468:2684]: SSL_read: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2011.12.13 19:55:07 LOG5[2468:2684]: Connection reset: 19 bytes sent to SSL, 219 bytes sent to socket 2011.12.13 19:55:07 LOG7[2468:2684]: Service smtp finished (0 left) 2011.12.13 19:55:07 LOG7[2468:2684]: str_stats: 16 block(s), 353 data byte(s), 544 control byte(s) What am I doing wrong? Thanks Rene

1 0

Problems with Stunnel 4.5*
by Sebastian Rose-Indorf 12 Dec '11

12 Dec '11

Hello Mike, many thanks for your work. However, I have problems with the current Stunnel versions. (I work with Windows 64bit.) Stunnel 4.47 works without problems. Stunnel 4.51b1 however - starts only if "fips = no" is set; - not accepts my certificate and my private key (SHA384 or RMD160, AES128 or IDEA) any more: error queue: 140B0009: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib error queue: 907B00D: error:0907B00D:PEM routines:PEM_READ_BIO_PRIVATEKEY:ASN1 lib error queue: 2306A075: error:2306A075:PKCS12 routines:PKCS12_item_decrypt_d2i:pkcs12 pbe crypt error error queue: 23077073: error:23077073:PKCS12 routines:PKCS12_pbe_crypt:pkcs12 algor cipherinit error SSL_CTX_use_PrivateKey_file: 6074079: error:06074079:digital envelope routines:EVP_PBE_CipherInit:unknown pbe algorithm Yours sincerely Sebastian

3 10

stunnel 4.50 released
by Michal Trojnara 12 Dec '11

12 Dec '11

Dear Users, I have released version 4.50 of stunnel. The ChangeLog entry: Version 4.50, 2011.12.03, urgency: MEDIUM: * New features - Added Android port. - Updated INSTALL.FIPS. * Bugfixes - Fixed internal memory allocation problem in inetd mode. - Fixed FIPS mode on Microsoft Vista, Server 2008, and Windows 7. This fix required to compile OpenSSL FIPS-compliant DLLs with MSVC 9.0, instead of MSVC 10.0. msvcr100.dll was replaced with msvcr90.dll. GPL compatibility issues are explained in the GPL FAQ: http://www.gnu.org/licenses/gpl-faq.html#WindowsRuntimeAndGPL - POP3 server-side protocol negotiation updated to report STLS capability (thx to Anthony Morgan). Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.50.tar.gz: 933467009529bae4f338bb20e758e0ea20b0759130e7695ea2193c4f270e5eaf Best regards, Mike

4 18

Problem with sslv2 clients
by Markus Borst 09 Dec '11

09 Dec '11

Hi, we have a strange problem with newer stunnel versions (4.50 on windows), compared to older ones (known to work is version 4.35). The problem seems to be, that if a client sends a SSLv2 Helo message, the stunnel server simply resets the TCP connection, without trying to negotioate anything. Setup: Stunnel is used top provide ssl/tls for imap, Hobbit is used to monitor service availability. The Hobbit module to monitor imaps seems to try SSLv2 first, but also supports newer versions (SSLv3 and TLSv1). The ssl connection never gets established, stunnel sends a tcp RST, hobbit never retries. We can force some hobbit modules to use TLSv1 exclusively, but not all of them. We fear that some older mailclients will also have problems initiating a connection, so we keep stunnel 4.35 running for now. stunnel.conf: fips = no debug = 7 output = stunnel.log [imaps] accept = 130.83.174.1:993 connect = 127.0.0.1:143 cert = imap.xxx.company.yy.pem stunnel.log: 2011.12.09 14:55:12 LOG5[6820:2144]: Service imaps accepted connection from xxx.yyy.zzz.105:45294 2011.12.09 14:55:12 LOG3[6820:2144]: SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number 2011.12.09 14:55:12 LOG5[6820:2144]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2011.12.09 14:55:12 LOG7[6820:2144]: Service imaps finished (0 left) 2011.12.09 14:55:12 LOG7[6820:2144]: str_stats: 0 block(s), 0 data byte(s), 0 control byte(s) Wireshark Packet Trace (see attached image). What's wrong here? Shouldn't client and server negotiate the methods used? The client seems to offer TLS ("Version: TLS 1.0 ..."), but instead of negotiating, the server simply closes the connection. Greetings Markus Borst

1 0

NFS over sTunnel
by Elodie BOSSIER 08 Dec '11

08 Dec '11

Greetings again, I have a problem to mount a NFS share via my sTunnel. If i don't use the stunnel it's work : #mount -t nfs 188.165.214.229:/home /mnt/nfs/ #df -h [...] 188.165.214.229:/home 7.2T 12G 6.9T 1% /mnt/nfs #umount /mnt/nfs but if i use the stunnel client it's don't work : #mount -t nfs 127.0.0.1:/home /mnt/nfs/ (.......sleep....... and i need to ctrl+C to stop my command) The log into the serveur is : 2011.12.08 00:55:54 LOG7[12438:140256813074176]: nfs accepted FD=18 from 178.33.214.192:8671 2011.12.08 00:55:54 LOG7[12438:140256812631808]: nfs started 2011.12.08 00:55:54 LOG7[12438:140256812631808]: FD 18 in non-blocking mode 2011.12.08 00:55:54 LOG7[12438:140256812631808]: TCP_NODELAY option set on local socket 2011.12.08 00:55:54 LOG7[12438:140256812631808]: Waiting for a libwrap process 2011.12.08 00:55:54 LOG7[12438:140256812631808]: Acquired libwrap process #0 2011.12.08 00:55:54 LOG7[12438:140256812631808]: Releasing libwrap process #0 2011.12.08 00:55:54 LOG7[12438:140256812631808]: Released libwrap process #0 2011.12.08 00:55:54 LOG7[12438:140256812631808]: nfs permitted by libwrap from 178.33.214.192:8671 2011.12.08 00:55:54 LOG5[12438:140256812631808]: nfs accepted connection from 178.33.214.192:8671 2011.12.08 00:55:54 LOG7[12438:140256812631808]: SSL state (accept): before/accept initialization 2011.12.08 00:55:54 LOG7[12438:140256812631808]: SSL state (accept): SSLv3 read client hello A 2011.12.08 00:55:54 LOG7[12438:140256812631808]: SSL state (accept): SSLv3 write server hello A 2011.12.08 00:55:54 LOG7[12438:140256812631808]: SSL state (accept): SSLv3 write change cipher spec A 2011.12.08 00:55:54 LOG7[12438:140256812631808]: SSL state (accept): SSLv3 write finished A 2011.12.08 00:55:54 LOG7[12438:140256812631808]: SSL state (accept): SSLv3 flush data 2011.12.08 00:55:54 LOG7[12438:140256812631808]: SSL state (accept): SSLv3 read finished A 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 1 items in the session cache 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 0 client connects (SSL_connect()) 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 0 client connects that finished 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 0 client renegotiations requested 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 12 server connects (SSL_accept()) 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 12 server connects that finished 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 0 server renegotiations requested 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 9 session cache hits 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 0 external session cache hits 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 0 session cache misses 2011.12.08 00:55:54 LOG7[12438:140256812631808]: 1 session cache timeouts 2011.12.08 00:55:54 LOG6[12438:140256812631808]: SSL accepted: previous session reused 2011.12.08 00:55:54 LOG7[12438:140256812631808]: FD 19 in non-blocking mode 2011.12.08 00:55:54 LOG6[12438:140256812631808]: connect_blocking: connecting 127.0.0.1:2049 2011.12.08 00:55:54 LOG7[12438:140256812631808]: connect_blocking: s_poll_wait 127.0.0.1:2049: waiting 10 seconds 2011.12.08 00:55:54 LOG5[12438:140256812631808]: connect_blocking: connected 127.0.0.1:2049 2011.12.08 00:55:54 LOG5[12438:140256812631808]: nfs connected remote server from 127.0.0.1:51193 2011.12.08 00:55:54 LOG7[12438:140256812631808]: Remote FD=19 initialized 2011.12.08 00:55:54 LOG7[12438:140256812631808]: TCP_NODELAY option set on remote socket ( my ctrl+C is here ) 2011.12.08 00:56:58 LOG7[12438:140256812631808]: SSL alert (read): warning: close notify 2011.12.08 00:56:58 LOG7[12438:140256812631808]: SSL closed on SSL_read 2011.12.08 00:56:58 LOG7[12438:140256812631808]: Socket write shutdown 2011.12.08 00:56:58 LOG7[12438:140256812631808]: Socket closed on read 2011.12.08 00:56:58 LOG7[12438:140256812631808]: SSL write shutdown 2011.12.08 00:56:58 LOG7[12438:140256812631808]: SSL alert (write): warning: close notify 2011.12.08 00:56:58 LOG6[12438:140256812631808]: SSL_shutdown successfully sent close_notify 2011.12.08 00:56:58 LOG5[12438:140256812631808]: Connection closed: 76 bytes sent to SSL, 164 bytes sent to socket 2011.12.08 00:56:58 LOG7[12438:140256812631808]: nfs finished (0 left) (End of the log server) My config client : [rquotad] accept = 1040 connect = 188.165.214.229:1041 [mountd] accept = 1048 connect = 188.165.214.229:1049 [nfs] accept = 2049 connect = 188.165.214.229:2050 [status] accept = 1039 connect = 188.165.214.229:1038 [portmapper] accept = 111 connect = 188.165.214.229:112 [nlockmgr] accept = 1047 connect = 188.165.214.229:1046 My config server : [rquotad] accept = 1041 connect = 1040 [mountd] accept = 1049 connect = 1048 [nfs] accept = 2050 connect = 2049 [status] accept = 1038 connect = 1039 [portmapper] accept = 112 connect = 111 [nlockmgr] accept = 1046 connect = 1047 Do you have an idea please ?

1 1

stunnel in client and server mode in same time
by Elodie BOSSIER 07 Dec '11

07 Dec '11

Greetings, I would like use stunnel in client & server mode but i don't find the way to do it, it's don't work My stunnel is a client of a remote MySQL server and a server of a NFS in local Do you have an idea please ?

4 3

FIPS_mode_set error
by Stefano Lodi 02 Dec '11

02 Dec '11

The problem referred to by Koenraad affects Windows 7 32 bit as well. Anyway fips=no fixes it.

2 1

FIPS on Win7
by james.poole＠rsa.com 01 Dec '11

01 Dec '11

It looks like there is a known issue with FIPS running on Windows 7 from the mail archives. Is there something I could do to help get this fixed? I was planning on using stunnel to allow a FIPS compliant transmission of data over the wire. Win7 - 32bit Output - From the console window: stunnel 4.49 on x86-pc-mingw32-gnu platform Compiled/running with OpenSSL 0.9.8r-fips 8 Feb 2011 Threading:WIN32 SSL:ENGINE,FIPS Auth:none Sockets:SELECT,IPv6 Reading configuration from file stunnel.conf FIPS_mode_set: 2D06906E: error:2D06906E:FIPS routines:FIPS_CHECK_INCORE_FINGERPRINT:fingerprint does not match Old Thread: http://www.stunnel.org/pipermail/stunnel-users/2011-November/003374.html Thanks for any help, James

2 1