- stunnel-users - stunnel.org

Re: [stunnel-users] Problem with a signed certificate by CA andcurl/wget
by Gabriel Sosa 13 Jan '11

13 Jan '11

perfect! that made the trick!!! thank you for your time Saludos On Thu, Jan 13, 2011 at 3:00 PM, <josealf(a)rocketmail.com> wrote: > Maybe your curl client is trying to negotiate SSLv2... Did you try addding --sslv3 to the command line? Openssl fips disables sslv2.. > > > -----Original Message----- > From: Gabriel Sosa <sosagabriel(a)gmail.com> > Sender: stunnel-users-bounces(a)mirt.net > Date: Thu, 13 Jan 2011 01:39:15 > To: <stunnel-users(a)mirt.net> > Subject: [stunnel-users] Problem with a signed certificate by CA and > curl/wget > > hello, > > I bought an ssl certificate on thawte and installed to stunnel. > > When I go to the site with any browser the ssl is established without > any issue, however when I try to call an url using curl or wget I'm > not able to download the content > > here are the output of curl/wget > > [root@www ~]$ curl https://secure.example.com/test.php > curl: (35) Unknown SSL protocol error in connection to secure.example.com:443 > [root@www1 ~]$ wget https://secure.example.com/test.php > --23:27:15-- https://secure.example.com/test.php > Resolving secure.example.com... xxx.xxx.xxx.xxx > Connecting to secure.example.com|xxx.xxx.xxx.xxx|:443... connected. > Unable to establish SSL connection. > [root@www ~]$ > > > my stunnel config file looks like > > ;setuid=nobody > ;setgid=nobody > fips=no > > pid=/var/run/stunnel.pid > debug=3 > output=/var/log/stunnel.log > cert=/etc/ssl/certs/stunnel.pem > CAfile=/etc/ssl/certs/ssl123.crt > > socket=l:TCP_NODELAY=1 > socket=r:TCP_NODELAY=1 > > > [secure.example.com] > accept=xxx.xxx.xxx.xxx:443 > connect=zzz.zzz.zzz.zzz:8443 > TIMEOUTclose=0 > xforwardedfor=yes > > I'm using the version 4.34 + xforwardedfor patch > > the file ssl123.crt contains the root CA of thawte > > uname -a output > > Linux secure.example.com 2.6.18-164.6.1.el5 #1 SMP Tue Nov 3 16:12:36 > EST 2009 x86_64 x86_64 x86_64 GNU/Linux > > gcc -v output > > Using built-in specs. > Target: x86_64-redhat-linux > Configured with: ../configure --prefix=/usr --mandir=/usr/share/man > --infodir=/usr/share/info --enable-shared --enable-threads=posix > --enable-checking=release --with-system-zlib --enable-__cxa_atexit > --disable-libunwind-exceptions --enable-libgcj-multifile > --enable-languages=c,c++,objc,obj-c++,java,fortran,ada > --enable-java-awt=gtk --disable-dssi --enable-plugin > --with-java-home=/usr/lib/jvm/java-1.4.2-gcj-1.4.2.0/jre > --with-cpu=generic --host=x86_64-redhat-linux > Thread model: posix > gcc version 4.1.2 20080704 (Red Hat 4.1.2-46) > > openssl version > > OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 > > > Does anyone have some clue about what could be causing the problem. > Any help will be really appreciated. > > Thank you > > -- > Gabriel Sosa > Si buscas resultados distintos, no hagas siempre lo mismo. - Einstein > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > -- Gabriel Sosa Si buscas resultados distintos, no hagas siempre lo mismo. - Einstein

1 0

Re: [stunnel-users] Problem with a signed certificate by CA andcurl/wget
by Gabriel Sosa 13 Jan '11

13 Jan '11

Jose, thanks for your reply here is the output of curl --verbose [root@www ~]$ curl --verbose https://secure.example.com/test.php * About to connect() to secure.example.com port 443 * Trying xxx.xxx.xxx.xxx... connected * Connected to secure.example.com (xxx.xxx.xxx.xxx) port 443 * successfully set certificate verify locations: * CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none * SSLv2, Client hello (1): Unknown SSL protocol error in connection to secure.example.com:443 * Closing connection #0 curl: (35) Unknown SSL protocol error in connection to secure.example.com:443 if is there any other info you need please just let me know. Thank you On Thu, Jan 13, 2011 at 8:42 AM, <josealf(a)rocketmail.com> wrote: > Gabriel, > > Can you add the --verbose flag to your curl command and post the result? > > > Jose > -----Original Message----- > From: Gabriel Sosa <sosagabriel(a)gmail.com> > Sender: stunnel-users-bounces(a)mirt.net > Date: Thu, 13 Jan 2011 01:39:15 > To: <stunnel-users(a)mirt.net> > Subject: [stunnel-users] Problem with a signed certificate by CA and > curl/wget > > hello, > > I bought an ssl certificate on thawte and installed to stunnel. > > When I go to the site with any browser the ssl is established without > any issue, however when I try to call an url using curl or wget I'm > not able to download the content > > here are the output of curl/wget > > [root@www ~]$ curl https://secure.example.com/test.php > curl: (35) Unknown SSL protocol error in connection to secure.example.com:443 > [root@www1 ~]$ wget https://secure.example.com/test.php > --23:27:15-- https://secure.example.com/test.php > Resolving secure.example.com... xxx.xxx.xxx.xxx > Connecting to secure.example.com|xxx.xxx.xxx.xxx|:443... connected. > Unable to establish SSL connection. > [root@www ~]$ > > > my stunnel config file looks like > > ;setuid=nobody > ;setgid=nobody > fips=no > > pid=/var/run/stunnel.pid > debug=3 > output=/var/log/stunnel.log > cert=/etc/ssl/certs/stunnel.pem > CAfile=/etc/ssl/certs/ssl123.crt > > socket=l:TCP_NODELAY=1 > socket=r:TCP_NODELAY=1 > > > [secure.example.com] > accept=xxx.xxx.xxx.xxx:443 > connect=zzz.zzz.zzz.zzz:8443 > TIMEOUTclose=0 > xforwardedfor=yes > > I'm using the version 4.34 + xforwardedfor patch > > the file ssl123.crt contains the root CA of thawte > > uname -a output > > Linux secure.example.com 2.6.18-164.6.1.el5 #1 SMP Tue Nov 3 16:12:36 > EST 2009 x86_64 x86_64 x86_64 GNU/Linux > > gcc -v output > > Using built-in specs. > Target: x86_64-redhat-linux > Configured with: ../configure --prefix=/usr --mandir=/usr/share/man > --infodir=/usr/share/info --enable-shared --enable-threads=posix > --enable-checking=release --with-system-zlib --enable-__cxa_atexit > --disable-libunwind-exceptions --enable-libgcj-multifile > --enable-languages=c,c++,objc,obj-c++,java,fortran,ada > --enable-java-awt=gtk --disable-dssi --enable-plugin > --with-java-home=/usr/lib/jvm/java-1.4.2-gcj-1.4.2.0/jre > --with-cpu=generic --host=x86_64-redhat-linux > Thread model: posix > gcc version 4.1.2 20080704 (Red Hat 4.1.2-46) > > openssl version > > OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 > > > Does anyone have some clue about what could be causing the problem. > Any help will be really appreciated. > > Thank you > > -- > Gabriel Sosa > Si buscas resultados distintos, no hagas siempre lo mismo. - Einstein > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > -- Gabriel Sosa Si buscas resultados distintos, no hagas siempre lo mismo. - Einstein

1 0

Problem with a signed certificate by CA and curl/wget
by Gabriel Sosa 13 Jan '11

13 Jan '11

hello, I bought an ssl certificate on thawte and installed to stunnel. When I go to the site with any browser the ssl is established without any issue, however when I try to call an url using curl or wget I'm not able to download the content here are the output of curl/wget [root@www ~]$ curl https://secure.example.com/test.php curl: (35) Unknown SSL protocol error in connection to secure.example.com:443 [root@www1 ~]$ wget https://secure.example.com/test.php --23:27:15-- https://secure.example.com/test.php Resolving secure.example.com... xxx.xxx.xxx.xxx Connecting to secure.example.com|xxx.xxx.xxx.xxx|:443... connected. Unable to establish SSL connection. [root@www ~]$ my stunnel config file looks like ;setuid=nobody ;setgid=nobody fips=no pid=/var/run/stunnel.pid debug=3 output=/var/log/stunnel.log cert=/etc/ssl/certs/stunnel.pem CAfile=/etc/ssl/certs/ssl123.crt socket=l:TCP_NODELAY=1 socket=r:TCP_NODELAY=1 [secure.example.com] accept=xxx.xxx.xxx.xxx:443 connect=zzz.zzz.zzz.zzz:8443 TIMEOUTclose=0 xforwardedfor=yes I'm using the version 4.34 + xforwardedfor patch the file ssl123.crt contains the root CA of thawte uname -a output Linux secure.example.com 2.6.18-164.6.1.el5 #1 SMP Tue Nov 3 16:12:36 EST 2009 x86_64 x86_64 x86_64 GNU/Linux gcc -v output Using built-in specs. Target: x86_64-redhat-linux Configured with: ../configure --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info --enable-shared --enable-threads=posix --enable-checking=release --with-system-zlib --enable-__cxa_atexit --disable-libunwind-exceptions --enable-libgcj-multifile --enable-languages=c,c++,objc,obj-c++,java,fortran,ada --enable-java-awt=gtk --disable-dssi --enable-plugin --with-java-home=/usr/lib/jvm/java-1.4.2-gcj-1.4.2.0/jre --with-cpu=generic --host=x86_64-redhat-linux Thread model: posix gcc version 4.1.2 20080704 (Red Hat 4.1.2-46) openssl version OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 Does anyone have some clue about what could be causing the problem. Any help will be really appreciated. Thank you -- Gabriel Sosa Si buscas resultados distintos, no hagas siempre lo mismo. - Einstein

1 0

Win32 FIPS Question
by pk＠cliffhanger.com 12 Jan '11

12 Jan '11

Hello, Greetings. I am new to STUNNEL and working on a proof of concept to compile the latest FIPS Compliant 1.2.2 OpenSSL with STUNNEL 4.34. in Windows 32 Bit environment. In the install.FIPS file it is mentioned that Win32 is not supported with FIPS. Is it still the case or it is fixed now? Have anybody done this? I greatly appreciate your time and help. Thank you. PK

1 0

Re: [stunnel-users] Question of stunnel/openssl for X86 processor -- Pierre's patch
by Pierre DELAAGE 11 Jan '11

11 Jan '11

Hi Jiehua, Please review the instructions on my webpage : in particular use my compilation scripts, and look inside them to know the syntax. It is quite simple : makece X86 for stunnel. For openssl, run the command "mywcebuild X86". It works. Pierre Le 10/01/2011 17:40, Li, Jiehua a écrit : > Dear Pierre and Dear Stunnel Users, > > We are trying to build stunnel for WinCE on X86 processor. After reviewing messages on the board, I found your article published in late November. I've downloaded packages from your personal website athttp://delaage.pierre.free.fr/ > > These packages include: > 1. Precompiled wcecompat library > 2. Source code foropenssl v100a for WCE <http://delaage.pierre.free.fr/contrib/openssl/wce/openssl100a_WCEpatched3.z…>. > 3. Source code forstunnel v434 for WCE <http://delaage.pierre.free.fr/contrib/stunnel/wce/stunnel434_WCEpatched2X86…>. > > I was hoping to the get the precompiled openssl library files, but it seems there are only library files for ARM processor under the folder of "out32dll_ARMV4" and there's no precompiled version for X86. So I tried to compile the openssl downloaded from your website for the X86 processor after customizing a few parameters (OSVERSION, PLATFORM, WCEROOT, SDKROOT, WCECOMPAT) as you suggested. But the compilation failed, I got error messages as below. I'm also including all options for cl.exe in the email as well. I wonder if you have seen similar issues before. Any suggestion is appreciated. Thanks for the help. > > Regards, > > Jiehua > > cl.exe /Fotmp32dll_x86\cryptlib.obj -Iinc32 -Itmp32dll_x86 /MC /O1 /Oi > /W3 /WX /GF /Gy /nologo -DUNICODE -D_UNICODE -DOPENSSL_SYSNAME_WINCE -DWIN32_LE > AN_AND_MEAN -DL_ENDIAN -DDSO_WIN32 -DNO_CHMOD -DOPENSSL_SMALL_FOOTPRINT -D_WIN32 > _WCE=420 -DUNDER_CE=420 -DWCE_PLATFORM_STANDARDSDK_420 -Dx86 -D_ -IC:\STunnel\wc > ecompat12_patched2X86\patchedX86/include -DOPENSSL_NO_RC5 -DOPENSSL_NO_MD2 -DOPE > NSSL_NO_KRB5 -DOPENSSL_NO_JPAKE -DOPENSSL_NO_STATIC_ENGINE /Zi /Fdtmp32dll_x86/l > ib -D_WINDLL -D_DLL -DOPENSSL_BUILD_SHLIBCRYPTO -c .\crypto\cryptlib.c > Command line warning D4002 : ignoring unknown option '/MC' > cryptlib.c > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winnt.h(301 > 9) : error C2061: syntax error : identifier 'PCONTEXT' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winnt.h(302 > 0) : error C2059: syntax error : '}' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(1 > 481) : error C2061: syntax error : identifier 'LPCONTEXT' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(1 > 481) : error C2059: syntax error : ';' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 222) : error C2146: syntax error : missing ')' before identifier 'lpContext' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 222) : error C2081: 'LPCONTEXT' : name in formal parameter list illegal > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 222) : error C2061: syntax error : identifier 'lpContext' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 222) : error C2059: syntax error : ';' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 223) : error C2059: syntax error : ')' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 230) : error C2143: syntax error : missing ')' before '*' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 230) : error C2143: syntax error : missing '{' before '*' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 231) : error C2059: syntax error : ')' > NMAKE : fatal error U1077: 'cl.exe' : return code '0x2' > Stop. > > ---------------------------------------------------------------------------------------- > Dear Michal, Dear all, > I have continued to work on my WCE version of stunnel 4.34, after having > received some request for help to compile for other TARGET CPU than ARM, > typically WCE/X86. > > That led me to a few more compilation bug fixes and some improvments in > makefiles, proper usage of winsock2 library, automatisation and > management of "make/build" process > for multiple targets WCE (ARM|X86...) and Win32 (with MS VC and > Gnu-mingw32 !). > I added also, as a practical feature, the inclusion of > "version/copyright" properties in the exe files, properties that are > displayable in the Windows Explorer or by right-clicking on the exefile. > This is not only a "beautifying" feature: this allows automatic version > checking by external tools without having to run the stunnel program, > particularly useful when the targetcpu does not match the host cpu... > > I also worked to have "as close as possible" evc.mak, vc.mak, and > mingw.mak files. > A lot of work and test-fail-adapt cycles have been performed to have a > common code working with the various flavors of C-PREPROCESSORS ! > because there are subtle differences between MS EVC, MS VC, Borland BCC > and GNU-GCC preprocessors. > > THE ATTACHMENT has been sent in zip format, because it contains a few > scripts and other files that exceed the 100KB limit of the mailing list. > it contains the files : > version.h : contains the #define version numbers, major and minor > version.rc : version displayable by Windows Explorer property sheet > makew32.bat : an helper for build wih MS VC > > Michal: > patched2X86.txt : a FULL diff -cr between your last 4.34 official > version and my last patched > patched2X86_incr.txt : an INCREMENTAL diff -cr between my previous > patched version sent on 27/09/2010 and the present one. > > > For the impatient, my patched version of stunnel 4.34 is available here : > http://delaage.pierre.free.fr/contrib/stunnel/wce/stunnel434_WCEpatched2X86… > > IT COVERS both WCE and Win32 versions of stunnel. > > NEW FILES have been added to the sources: see attachments: > - version.h is NOW the CENTRAL point to define major and minor versions > of stunnel (NO MORE definition is makefile, which is logical : you > modify the version of the product, without necessarily modifying the > production process). > - version.rc is the resource file required by windows as the repository > of the stunnel.exe properties displayed in Windows Explorer. > Compiled with evc for wce or with VC for win32, this works perfectly. > But compiled and linked with gcc, those properties are unfortunately not > displayed by Windows Explorer, although embedded in the exe file. I have > established that it is a bug in "gnu-link" stage. > - makew32 : the equivalent of makece for Win32, which avoid repetitive > and error prone pollution of env vars when repetitively compiling for > w32. It is very useful in frequent recompilation at dev/test time. > > *** SOME PRACTICAL INFO : > - now to compile, or clean up things, for a particular WCE TARGET CPU : > just type things like : > makece ARMV4, eg for ARMV4 CPU > makece ARMV4 clean > makece X86, eg for ARMV4 CPU > makece X86clean > ===> this create ../bin/ARMV4/stunnel.exe and ../obj/ARMV4/all objs > files, or the like with X86 cpu and so on. > See list of all supported target cpu in evc.mak. ARMV4 and X86 go well; > more cpu may be checked by experts vs compilation flags... > This is very practical to compile for various targets without modifying, > deleting, renaming, anything and with no side effects between targets. > > - For Win32, yes for Windows PC, just type : > makew32 > makew32 clean > ===> this create ../bin/W32/stunnel.exe and ../obj/W32/all objs files. > This tool uses MS-VC 2008 express as compiler/linker. > > - For Win32, but with MINGW32 tools (and GNU-WIN32 coreutils !!!), just > type : > mingw32-make -f mingw.mak > mingw32-make -f mingw.mak clean > ===> this create ../bin/MGW32/stunnel.exe and ../obj/MGW32/objs files. > GOODIE: I have tricked the mingw.mak to work EITHER on a Windows > compilation HOST MACHINE, OR a LINUX/UN*X compilation HOST. > On windows mingw.mak properly checks and warns about potential missing > of gnu-win32 tools. > Note: the make.bat file is just a shortcut for mingw32-make -f mingw.mak. > > *** MODIFICATIONS of FILES : > > So, since my previous version of the patch, here are my adds : > > 1/ evc.mak : > 1.1/linking with a recompiled version of Essemer/wcecompat: > this library has been customized to compile in SEPARATE folders for > MULTIPLE targets. > So path to proper libs have been changed. > My customized version of wcecompat is available here : > http://delaage.pierre.free.fr/contrib/wcecompat/wcecompat12_patched2X86.zip > > IT HAS ALSO been adapted to have separate folders for distinct targets > pre-compiled versions. > Please note that this philosophy is shared with openssl. > > 1.2/ linking with winsock2 library instead of winsock1: at first to be > consistent with the C code, and second because winsock2 is more close to > socket standard than ws1. > > 1.3/ linking with COREDLL.lib and CORELIBC.lib ONLY: whatever /MC or /MT > or other flag you put for CLxxx command, the set of default libs > expected to be linked is WRONG. > This is a bug of CLxxx tools, inconsitent with MS doc. > SO we have to overwrite the default lib list by always the same ones. > You can verify that this is the right way to do it by searching for a > libc.lib in various evc/libs : you will NOT find any although clxxx /? > talks about it. > > 1.3/ change in VERSION management : now there is a version.h and > version.rc souce file for this. > One that wants to change version has just to edit version.h and then > version info will be propagated as usual in resource.h, AND also > in the exe itself to be displayable in Windows Explorer. > Now people will have a simple mean to check the version of stunnel. > > Michal: have you noticed that there was a vestige "version.h" file > mentioned in vc.mak ! > now it makes sense in evc.mak, vc.mak and mingw.mak, for wce or win32 > targets. > > 1.4/ link /machine : IX86 is improper with WCE, it is X86. > > 1.5/ Multiple WCE CPU targets supported by giving targetcpu on the make > command line like this : > makece ARMV4 all > targetcpu is now mandatory. > makece without options, as usual, will show the new syntax (very simple). > > 1.6/ improved clean target with some rmdirs and proper redirection of > error messages. > proper use of make flags -@. > > 1.7/ added explicit "inference rules" that are compatible MS nmake/ > Borland make, > to be sure of the proper options, and to manage multiple subdirs > management matching TARGETCPU. > Now stunnel.exe is build in stunnel/bin/TARGETCPU subdir > objs are build in stunnel/obj/TARGETCPU > > I really think it is practical and good policy : on my host machine I > have been able to test efficiently at the same time > three flavors of stunnel : win32, wce/arm, wce/x86 without > erasing/renaming/recompiling each time and wondering for what platform > was my stunnel.Exe built for. > > 1.8/ HOST flag put in $(DEFINES) for CC and RC to add more info to exe > info property shhet in Windows Explorer "this stunnel is for THIS type > of target" > > > 2/ makece.bat: > protection against pollution of environment when makece is repeatedly > run with the same targetcpu. > + Env is updated only when one is switching targetcpu. > This is not perfect, but a step in the good direction. > To understand what I mean, perform "set" to see all the env vars after > each makece call... > > PRACTICALLY : you can type makece ARMV4 and then makece X86 in the same > command line window, without polluting "too much" the environment, > only when changing target. No need, reasonably, to have multiple command > line windows opened. > > 3/ vc.mak: for win32 > "multiple target" support by putting w32 obj and exe files in obj/w32 > and bin/w32 subdirs, version.rc support, winsock2 lib integration. > > crypt32 was missing .lib SUFFIX ! > > improper use of winsock1 : it is better to take winsock2 lib, and it is > what the code requires (#includes...) ! > > version management through version.h /.rc instead of /DVERSION > > general logic now close to that of WCE evc.mak, as can be (evc and vc > are very close in their syntax, flags...). > HOST flag to add more info to exe info property sheet in Windows > Explorer "this stunnel is for THIS type of target" > > 4/ created a makew32.bat script > as a wrapper to setenv vars for MSVC 2008 Express, and nmake call. > This has to be improved in the future: presently it cannot be called > after a previous compilation for WCE : > pollution of PATH and INCLUDE env vars requires to reopen a shell via > cmd.exe. > One day I will check if there a simple way to clean env vars from some > path (not so simple). > > 5/ adapted mingw.mak to link with WINSOCK 2 (!!) and use of > version.rc/.h + general processing made similar to that of vc.mak. > I tested with mingw for windows and it works. Someone should test with > gcc under linux, this should work... > HOST flag to add more info to exe info property sheet in Windows > Explorer "this stunnel is for THIS type of target" > Some rewriting to have a mingw.mak close to vc.mak, to ease maintenance... > I checked gnu make syntax, and it is close to ms nmake and borland make, > except for ifdef directives and inference rules syntax, unfortunately. > I am somehow skilled in this boring exercise of comparing various make > tools and syntax. > > MINGW.MAK bugs: incorrect reference to "Makefile.w32", incorrect INC > path for openssl/win32 (this is NOT "outinc" but "inc32"! since a long > time). > > NOTE : to compile on windows I commented "-l zdll" lib in the mingw.mak. > Michal, may you restore it if it is useful (I do not see why anyway). > > Added a testenv pseudo-target to check for gnu-win32 proper installation. > Added some tricks to enable proper execution with the same makefile > either on a Windows HOST or a Linux HOST. > When I say host, I mean "production machine" , and NOT TARGET machine > which is always win32 with mingw.mak. > > 6/ make.bat: this script is ONLY meaningful with mingw.mak and MINGW32 > gnu environment. > Due to various improvments I MADE in mingw.mak, mingw.mak is now only > compatible with mingw32-make, > and not just "make.exe", which is Borland make on Windows... > > > TODO : I did not deal with stunnel making for linux, and/or rpm packaging. > But I guess that makefile.in etc...should be updated... > Anyway, on linux, NOT including version.rc is not a problem, as this > file is useless in that target environment. > But I think that having ../obj/UNX and ../bin/UNX folders should be a > good practice... > > 7/ common.h : > Eureka ! I finally understood and cleaned up the mess around the > redefinition of various Socket Error codes. > This comes from the fact that, previously, those codes were defined in > MS winsock1 header files, but disappeared in winsock2 header files (they > are commented) > Apparently, stunnel code was including winsock1 for w32 but winsock2 for > WCE, although winsock2 is in fact available on both platforms. > So I decided to move to winsock2 for WCE, and re-declaring (again) SOME > of those constants. > Some clean up of the makefile has been done also to REALLY link to ws2 > lib instead of ws1 (because there was also a confusion there!). > > 8/ ctx.c : htons is requesting "short". so a cast was required to avoid > warnings from the compiler. > > 9/ resolver.c : here we are: > many routines have been reimplemented when they are in fact available in > winsock2 both for w32 AND WCE. > Michal: I expect that you review this with particular attention. > In fact I have modified the logic of "masking" local_routines when > already defined in winsock2. > the previous code was HIDING winsock2 instead of the local_routines. > It seemed not logical. > It is important to note that the three routines "getaddrinfo, > freeaddrinfo, getnameinfo" are FOR INSTANT used only in resolver.c, > BUT the previous code was preventing them from being used by other modules. > Now, with my code, it is possible. > My code also avoid compilation warnings (because, as getaddrinfo REALLY > exist in win32, such a "#define getaddrinfo localgetaddrinfo" > inevitably raises a warning of the compiler for redef of an existing > symbol; and hence it reveals a problem of conflict..., while my solution > avoids all this pitfalls). > > Removed also the restriction "AND IPV6" on win32 conditional #IF: > winsock2 supports ipv6. > Michal: a review on these conditional #IF should be useful... > > I wanted to add that those routines are also parts of the POSIX standard > API, so they are available almost everywhere... > so I hardly understand their purpose today. > > 10/ version.h : > I have used some preprocessor tricks to have a VERSION string correctly > defined BOTH with MS evc preprocessor, MS vc preprocessor: > AND GNU preprocessor. > those preprocessors have some differences...particularly when called > from a rc compiler through a "pipe" like gnu windres. > In ms VC and EVC the rc preprocessing is NOT the same as that of the > compiler... > Now it works with every build system, and either in .c compilation or > .rc compilation. > > > USEFUL : openssl team is desperately ignoring any WCE patch, so if you > want an openssl 100a source tree compatible with WCE, > just download mine there : > http://delaage.pierre.free.fr/contrib/openssl/wce/openssl100a_WCEpatched3.z… > FYI, my patch to openssl is registered here : > http://rt.openssl.org/index.html?q=2350 (login guest/password guest). > > TODO : gui.c contains code to dynamically load ws2 getaddrinfo > why not rely only on static linking for that, as ws2 is available > everywhere since w95 and wce4.1 ? > we have to harmonize the code there with resolver.c and various makefiles > In resolver.c: code remains to load dynamically ws2 getaddrinfo etc..at > run-time only on win32, and not in CE while it is ALSO available! > I suggest to have "static" linking to ws2.lib both in w32 and wce . but > more code has to be modified to be definitely clean and clear. > When I say "static linking" I mean "Load-Time Dynamic Linking", ie link > with ws2.lib stub at build time, not "link with static lib"... > > I thank you for your good work and attention, > Yours sincerely, > > Pierre Delaage > > > Le 27/09/2010 00:40, Pierre DELAAGE a écrit : > > Dear All, > > Please find enclosed a patch in "diff -cr orig patched" format, > > applying to stunnel4.34 as found hereftp://stunnel.mirt.net/stunnel/. > > This patch mainly addresses compilation and unicode issues for Windows > > CE targets + ONE critical issue preventing stunnel to service anything > > (!). > > > > I use MS EVC 4sp2 compiler with WCE 420 SDK, on a vista host platform. > > Once debugged the code works fine on WM6 HTC smartphones. > > Should work on WM5. > > It needs a windows CE openssl lib (I recompiled MY patched version of > > openssl 1.0.0a successfully: I will have to log a patch to those > > gentlemen, hoping that they are open to integrate it, something not so > > obvious in the past). > > > > I will later post here a link to my patch for openssl 100a pointing to > > the openssl mailing list. THIS OPENSSL PATCH IS ESSENTIAL : with my > > older version of openssl 098pre_j for wce, stunnel does not work > > anymore (it crashes after first cnx). > > > > > > The present stunnel patch addresses the following issues : > > > > ************* > > I] COMPILATION FAILURES > > > > 1/ on common.h "EINVAL redefinition" : > > in fact the compile options WX (see evc.mak) does not tolerate any > > warning : > > The MS evc420 compiler ALWAYS issues a warning on this symbol > > redefinition. > > Michal and I are dealing with it since month... > > But, considering that NEITHER Exxx error codes are used in stunnel, > > I suggest that in fact ALL these redef should be suppressed. > > > > TODO: In the future a proper rewrite of code in log.c, where hardcoded > > values of WSA error codes are used instead of symbolic constant, will > > have to be done. > > > > > > 2/ client.c > > CreateProcess is a UNICODE function: code was ascii only. > > Code has been adapted to work in unicode. > > > > 3/ evc.mak > > path to new openssl lib has been redefined. > > proper location for the libs in openssl tree has been set in the > > make-install block (although this block is presently USELESS and needs > > a complete rewrite). > > > > 4/ gui.c > > All code using hmainmenu is OFF under winCE. > > So some new lines involving it were not compiling. > > > > 5/ options.c > > > > linger_val.l_linger and linger_val.l_onoff require ushort values. > > Strict type checking of the compiler required a proper cast to ushort > > of the r-values. > > > > > > stralloc uses "strdup": > > on Win32 and winCE strdup is _strdup (!). > > > > 6/ prototypes.h : > > _beginthread was defined as returning an int, an a long in sthread.c. > > After some checking in various documentations, long is the correct type, > > in particular because _beginthread can return the special error value > > "-1L". So that unsigned types are illogical. > > This simplifies the code in some locations, by saving some -now > > useless- casts. > > > > 7/ sthread.c > > > > create_client: suppressed some useless cast to (long) for beginthread. > > > > ************* > > II] OPERATIONAL ERRORS (at run-time) > > This is a reminder of previous notification to the mailing list : > > due to beginthread improper code and/or use, > > It is presently IMPOSSIBLE for stunnel 434 to be used in production on > > WCE: > > it is just unable to service any...service. > > Nothing happens if, for example, you use it to connect to an https > > server. No log either ! > > > > I corrected the code with both Michal patch to gui.c and mine to > > sthread.c: > > > > gui.c (Michal patch) : > > _beginthread was called with 0 as stacksize which, cumulated to an > > improper coding of sthread/beginthread, led to FAILURE of service > > thread creation. > > > > sthread.c: > > _beginthread : now supports "0" stacksize value, leading to default > > linker stack size (1MB by default unless specified differently on the > > linker command line, something we do not yet perform but could). > > > > ************* > > III] MINOR IMPROVMENT > > _beginthread: added a log on critical event of "failure" to create a > > service thread. because I think it is a critical event, isn't it? > > > > > > I hope you will find this patch useful. > > Thank you for your excellent work, > > Yours sincerely, > > > > Pierre Delaage > > > > Note : I use stunnel to establish a simple "vpn" between smartphones and > > a corporate linux server mainly for HTTPS/POPS/SMTPS support. > > Stunnel is very relevant in that matter, over solutions based on SSH > > (although we use also ssh), from a communication cost point of view : > > ssh establishes permanent socket between client and server, so that the > > communication is charged by the mobile network provider : and these > > charges are very expensive. > > On the contrary stunnel only establishes ssl sockets on demand so that > > financial charges are limited to strict necessary. > > Please note that stunnel brings "client based certificate > > authentication" to POP/SMTP mobile mail user agents which only > > BASICALLY supports SSL with server authentication, but NO client > > authentication, such as M$ Outlook forMobile (unless you pay for an > > exchange server and exchange client licence). > > Here again stunnel is very relevant. > > > > Note 2 : the strdup and unicode bug fixes should benefit also to the > > win32 (for PC) stunnel version for PC. > > > > > > > > > > > *["stunnel434patch20101117.zip" (application/x-zip-compressed)]* <http://marc.info/?l=stunnel-users&m=129002593426045&q=p3> > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > *[prev in list <http://marc.info/?l=stunnel-users&m=129001288405228&w=2>] [next in list <http://marc.info/?l=stunnel-users&m=129010241218147&w=2>] [prev in thread <http://marc.info/?l=stunnel-users&m=128554087819713&w=2>] [**next in thread]* > > Configure <http://marc.info/?q=configure> | About > <http://marc.info/?q=about> | News <http://marc.info/?q=news> | >

2 1

Re: [stunnel-users] Question of stunnel/openssl for X86 processor -- Pierre's patch
by Pierre DELAAGE 11 Jan '11

11 Jan '11

Hi Jiehua, Please review the instructions on my webpage : in particular use my compilation scripts, and look inside them to know the syntax. It is quite simple : makece X86 for stunnel. For openssl, "mywcebuild X86". It works. Let me know if you have problems. Pierre Le 10/01/2011 17:40, Li, Jiehua a écrit : > Dear Pierre and Dear Stunnel Users, > > We are trying to build stunnel for WinCE on X86 processor. After reviewing messages on the board, I found your article published in late November. I've downloaded packages from your personal website athttp://delaage.pierre.free.fr/ > > These packages include: > 1. Precompiled wcecompat library > 2. Source code foropenssl v100a for WCE <http://delaage.pierre.free.fr/contrib/openssl/wce/openssl100a_WCEpatched3.z…>. > 3. Source code forstunnel v434 for WCE <http://delaage.pierre.free.fr/contrib/stunnel/wce/stunnel434_WCEpatched2X86…>. > > I was hoping to the get the precompiled openssl library files, but it seems there are only library files for ARM processor under the folder of "out32dll_ARMV4" and there's no precompiled version for X86. So I tried to compile the openssl downloaded from your website for the X86 processor after customizing a few parameters (OSVERSION, PLATFORM, WCEROOT, SDKROOT, WCECOMPAT) as you suggested. But the compilation failed, I got error messages as below. I'm also including all options for cl.exe in the email as well. I wonder if you have seen similar issues before. Any suggestion is appreciated. Thanks for the help. > > Regards, > > Jiehua > > cl.exe /Fotmp32dll_x86\cryptlib.obj -Iinc32 -Itmp32dll_x86 /MC /O1 /Oi > /W3 /WX /GF /Gy /nologo -DUNICODE -D_UNICODE -DOPENSSL_SYSNAME_WINCE -DWIN32_LE > AN_AND_MEAN -DL_ENDIAN -DDSO_WIN32 -DNO_CHMOD -DOPENSSL_SMALL_FOOTPRINT -D_WIN32 > _WCE=420 -DUNDER_CE=420 -DWCE_PLATFORM_STANDARDSDK_420 -Dx86 -D_ -IC:\STunnel\wc > ecompat12_patched2X86\patchedX86/include -DOPENSSL_NO_RC5 -DOPENSSL_NO_MD2 -DOPE > NSSL_NO_KRB5 -DOPENSSL_NO_JPAKE -DOPENSSL_NO_STATIC_ENGINE /Zi /Fdtmp32dll_x86/l > ib -D_WINDLL -D_DLL -DOPENSSL_BUILD_SHLIBCRYPTO -c .\crypto\cryptlib.c > Command line warning D4002 : ignoring unknown option '/MC' > cryptlib.c > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winnt.h(301 > 9) : error C2061: syntax error : identifier 'PCONTEXT' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winnt.h(302 > 0) : error C2059: syntax error : '}' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(1 > 481) : error C2061: syntax error : identifier 'LPCONTEXT' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(1 > 481) : error C2059: syntax error : ';' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 222) : error C2146: syntax error : missing ')' before identifier 'lpContext' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 222) : error C2081: 'LPCONTEXT' : name in formal parameter list illegal > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 222) : error C2061: syntax error : identifier 'lpContext' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 222) : error C2059: syntax error : ';' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 223) : error C2059: syntax error : ')' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 230) : error C2143: syntax error : missing ')' before '*' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 230) : error C2143: syntax error : missing '{' before '*' > C:\Program Files\Windows CE Tools\WCE420\STANDARDSDK_420\include\x86\winbase.h(2 > 231) : error C2059: syntax error : ')' > NMAKE : fatal error U1077: 'cl.exe' : return code '0x2' > Stop. > >

1 0

RFC: purge use of keyword 'transparent'
by oscaruser＠programmer.net 08 Jan '11

08 Jan '11

Folks, After searching, installing various Linuces (in the 2.6 family), e.g. CentOS, Ubuntu, and so on, I have not been able to get transparent proxy working at all. As such since it the function does not work, and there is great debate as to whether it ever worked, I would like to propose that this keyword and reference to its function be discarded entirely. This will save many folks a great deal of time and effort attempting to try and get it to work, myself having spent over 80 hours (including my precious holiday time) trying to dig, scratch, research up old posts that say it works or someone has it working under such and such a configuration! The documentation itself has folks claiming that it works and does not, which is really a bad practice. Why did you perpetuate this option in the first place?! I hope you see the importance and reason with my request and act immediately. ... Unless someone really really does have it working. Thank you

3 7

How can I configure Intermediate Certificate
by Carlos García Villate 04 Jan '11

04 Jan '11

Hi. Two months ago, we installed our SSL certificate with stunnel succesfully. That certificate was issued by Verisign. We did not experience any issues. A few weeks ago, we had to renew that certficate and after doing that, we started to get 'Invalid certificate' errors form our web site users. It seems that the new certificate issued by Verisign, has changed its hierarchy, and browsers like FF that do not have one of the necessary intermediate certificate registered fail. This is the new hierarchy: - VeriSign Class 3 Public Primary Certification Authority - G5 - VeriSign Class 3 Secure Server CA - G3 - www.b-kin.com It is the 'VeriSign Class 3 Secure Server CA - G3' certificate the one that most FF browsers do not have registered, and so the browsers reject the request with an 'Invalid certificate' message. To solve this issue, we are trying to incorporate the 'VeriSign Class 3 Secure Server CA - G3' certificate in the .pem file, where our www.b-kin.comcertificate is installed. We have tried to include the Verisign certificate first and then the other one; and the other way round, first our certificate and then the Verisign one, but without success. The Verisign certificate has been directly taken from the Verisign web site. The .pem file has following structure: Bag Attributes heading section ..... -----BEGIN RSA PRIVATE KEY----- ..... -----END RSA PRIVATE KEY----- Bag Attributes heading section -----BEGIN CERTIFICATE----- /*We have alternated to put here the www.b-kin.com or the Verisign certificate*/ ..... -----END CERTIFICATE----- Bag Attributes heading section -----BEGIN CERTIFICATE----- /*We have alternated to put here the www.b-kin.com or the Verisign certificate*/ ..... -----END CERTIFICATE----- We are running stunnel on CentOS with the following configuration: stunnel 4.32 on i686-pc-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 Threading:PTHREAD SSL:ENGINE,FIPS Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = daemon.notice pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = FIPS session = 300 seconds stack = 65536 bytes sslVersion = TLSv1 TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none As we have seen in the documentation, it is possible to include a certificate hierarchy in a .pem file. What we do not know is the order nor the values to set int Bag Attributes heading section, for the Verisign certificate. Best regards, Carlos.

1 0

Is it possible to encrypt the Web server IP , URL , Data???
by cpu.lin 20 Dec '10

20 Dec '10

Dear Michal Trojnara, Some protocols (e.g. ssh,vpn...) must install software in SERVER side. I want to understand the fact below: If only the CLIENT side can install the special software. What is the special software? Is it possible to encrypt the Web server IP ,URL ,Data??? If stunnel can solve this issue. How to configure? Merry X'mas, Best regards, cpu.lin(a)gmail.com > 2010/12/17 Michal Trojnara <Michal.Trojnara(a)mirt.net>: > Dear cpu.lin, > >> No response to the problem: >> > http://stunnel.mirt.net/pipermail/stunnel-users/2010-December/002860.html >> Could you please help me? > > This is how the protocol works: > http://tools.ietf.org/id/draft-luotonen-ssl-tunneling-02.txt > You need a different protocol (e.g. ssh) if you don't like it. > > Mike

1 0

Stunnel 4.05 "SSL write shutdown (output buffer empty)"
by Issam ourrai 17 Dec '10

17 Dec '10

Hi guys, For My apps I'm using a SSL connection using STunnel 4.05 on a windows box. I have the following errors while running a connection : 2010.12.17 14:28:55 LOG7[2764:6312]: Socket closed on read 2010.12.17 14:28:55 LOG7[2764:6312]: SSL write shutdown (output buffer empty) 2010.12.17 14:28:55 LOG7[2764:6312]: SSL alert (write): warning: close notify 2010.12.17 14:28:55 LOG7[2764:6312]: SSL_shutdown retrying 2010.12.17 14:28:55 LOG7[2764:5588]: tradingscreen_connection accepted FD=1728 from 127.0.0.1:2231 2010.12.17 14:28:55 LOG7[2764:5588]: FD 1728 in non-blocking mode 2010.12.17 14:28:55 LOG7[2764:5588]: Creating a new thread 2010.12.17 14:28:55 LOG7[2764:5588]: New thread created 2010.12.17 14:28:55 LOG7[2764:3860]: tradingscreen_connection started 2010.12.17 14:28:55 LOG7[2764:3860]: TCP_NODELAY option set on local socket 2010.12.17 14:28:55 LOG5[2764:3860]: tradingscreen_connection connected from 127.0.0.1:2231 2010.12.17 14:28:55 LOG7[2764:3860]: FD 1708 in non-blocking mode 2010.12.17 14:28:55 LOG7[2764:3860]: tradingscreen_connection connecting XX.XX.XX.XX:9500 2010.12.17 14:28:55 LOG7[2764:3860]: remote connect #1: EWOULDBLOCK: retrying 2010.12.17 14:28:55 LOG7[2764:3860]: waitforsocket: FD=1708, DIR=write 2010.12.17 14:28:55 LOG7[2764:3860]: waitforsocket: ok 2010.12.17 14:28:55 LOG7[2764:3860]: Remote FD=1708 initialized 2010.12.17 14:28:55 LOG7[2764:3860]: TCP_NODELAY option set on remote socket 2010.12.17 14:28:55 LOG7[2764:3860]: SSL state (connect): before/connect initialization 2010.12.17 14:28:55 LOG7[2764:3860]: SSL state (connect): SSLv3 write client hello A 2010.12.17 14:28:55 LOG7[2764:3860]: waitforsocket: FD=1708, DIR=read 2010.12.17 14:28:55 LOG7[2764:3860]: waitforsocket: ok 2010.12.17 14:28:55 LOG7[2764:3860]: SSL state (connect): SSLv3 read server hello A 2010.12.17 14:28:55 LOG7[2764:3860]: waitforsocket: FD=1708, DIR=read 2010.12.17 14:28:56 LOG7[2764:3860]: waitforsocket: ok 2010.12.17 14:28:56 LOG7[2764:3860]: SSL state (connect): SSLv3 read finished A 2010.12.17 14:28:56 LOG7[2764:3860]: SSL state (connect): SSLv3 write change cipher spec A 2010.12.17 14:28:56 LOG7[2764:3860]: SSL state (connect): SSLv3 write finished A 2010.12.17 14:28:56 LOG7[2764:3860]: SSL state (connect): SSLv3 flush data 2010.12.17 14:28:56 LOG7[2764:3860]: 1 items in the session cache 2010.12.17 14:28:56 LOG7[2764:3860]: 2 client connects (SSL_connect()) 2010.12.17 14:28:56 LOG7[2764:3860]: 2 client connects that finished 2010.12.17 14:28:56 LOG7[2764:3860]: 0 client renegotiatations requested 2010.12.17 14:28:56 LOG7[2764:3860]: 0 server connects (SSL_accept()) 2010.12.17 14:28:56 LOG7[2764:3860]: 0 server connects that finished 2010.12.17 14:28:56 LOG7[2764:3860]: 0 server renegotiatiations requested 2010.12.17 14:28:56 LOG7[2764:3860]: 1 session cache hits 2010.12.17 14:28:56 LOG7[2764:3860]: 0 session cache misses 2010.12.17 14:28:56 LOG7[2764:3860]: 0 session cache timeouts 2010.12.17 14:28:56 LOG6[2764:3860]: Negotiated ciphers: DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 2010.12.17 14:28:56 LOG7[2764:6312]: SSL alert (read): warning: close notify 2010.12.17 14:28:56 LOG7[2764:6312]: SSL closed on SSL_read 2010.12.17 14:28:56 LOG7[2764:6312]: Socket write shutdown (*output buffer empty*) 2010.12.17 14:28:56 LOG5[2764:6312]: Connection closed: 31795 bytes sent to SSL, 35089 bytes sent to socket 2010.12.17 14:28:56 LOG7[2764:6312]: tradingscreen_connection finished (1 left) 2010.12.17 14:39:01 LOG7[2764:3860]: Socket closed on read 2010.12.17 14:39:01 LOG7[2764:3860]: SSL write shutdown (*output buffer empty*) 2010.12.17 14:39:01 LOG7[2764:3860]: SSL alert (write): warning: close notify 2010.12.17 14:39:01 LOG7[2764:3860]: SSL_shutdown retrying 2010.12.17 14:39:01 LOG7[2764:5588]: tradingscreen_connection accepted FD=1732 from 127.0.0.1:2362 2010.12.17 14:39:01 LOG7[2764:5588]: FD 1732 in non-blocking mode 2010.12.17 14:39:01 LOG7[2764:5588]: Creating a new thread Did some one ever face this kind of issue, I'm a neube using this connector, thanks for your kind help, -- Cheers Sam

1 0

Re: [stunnel-users] Experimental stunnel-4.35b1
by Michal Trojnara 17 Dec '10

17 Dec '10

Dear cpu.lin, > No response to the problem: > http://stunnel.mirt.net/pipermail/stunnel-users/2010-December/002860.html > Could you please help me? This is how the protocol works: http://tools.ietf.org/id/draft-luotonen-ssl-tunneling-02.txt You need a different protocol (e.g. ssh) if you don't like it. Mike

1 0

Experimental stunnel-4.35b1
by Michal Trojnara 15 Dec '10

15 Dec '10

Dear Users, I have uploaded stunnel-4.35b1 to ftp://stunnel.mirt.net/stunnel/ for your testing. Please give it a shot and submit any problems to stunnel-users mailing list. This is the way you can not only help me improve production 4.35, but also make sure it's going to work on your platform! Please consider version 4.35b1 highly experimental and not ready for production. Specifically it is no supposed to be packaged for any OS distribution (e.g. *BSD ports). Best regards, Michal Trojnara

1 0

endpoints using different versions of stunnel
by nishith n 15 Dec '10

15 Dec '10

Hello all, We have a client who would like to send us data using stunnel 4.33 at their end of the connection. Can we establish connection from our end using stunnel 4.11 version. We are working on a sun machine. I know I can simply download the latest stunnel version but it has to go through an authorization process which probably will take more time than I have and hence this question. What could be the impacts to connectivity or otherwise with such a setup? Thanks for your replies, Nishith

1 0

Examples of stunnel and lighttpd
by fanboy 15 Dec '10

15 Dec '10

Apparently lighttpd ssl support isn't so flash, I'm been attempting (I'm a newb) to use stunnel instead, are there any examples? I have a free startssl cert also (ssl.key / ssl.cert) What information do I need to setup a reliable connection?

1 0

How to encrypt the URL?
by cpu.lin 08 Dec '10

08 Dec '10

Dear friends, After reading mailing lists & Web & FAQ I couldn't find answers to these: stunnel.conf as follows: debug=7 client = yes [proxy] accept=1111 connect=62.215.5.69:8080 (Public SSL Proxy) protocol=connect protocolHost=stunnel.mirt.net:443 CLIENT(Browser+Special software)<->firewall<->(Internet)<->Public SSL Proxy<->WEB SERVER Public SSL Proxy as follows: http://tools.rosinstrument.com/raw_free_db.htm?t=2 Only the CLIENT side have stunnel. After running stunnel 4.34 (Windows binaries). Then. Browser http://localhost:1111/ But Sniffer can monitor the command-(CONNECT stunnel.mirt.net:443). The problem as follows: Only the CLIENT side can install special software. Special software including but not limited to stunnel. If the firewall can block many websites depend on Web IP & URL. How to pass through the firewall base on Public SSL Proxy? How to encrypt the URL-(stunnel.mirt.net:443)? What is the special software? If stunnel can solve this issue. How to configure? Best regards, cpu

1 0

stunnel and IE6 issue
by Bill Tindal 06 Dec '10

06 Dec '10

Hi, I have stunnel running in front of HaProxy and everything is working fine however IE6 users cannot access our HTTPS pages and are instead shown a 'Page cannot be found'. They can access normal pages. Obviously there's something that stunnel doesn't like about IE6 (who doesn't) but I'm at a loss as to what changes to make to the stunnel conf. My conf for stunnel is below: ------------------------------------------------ sslVersion = all options = NO_SSLv2 fips = no setuid = root setgid = stunnel pid = /var/run/stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 output = /var/log/stunnel.log [secure.domain.com] cert = /usr/local/openssl/certs/secure.domain.com.crt key = /usr/local/openssl/certs/secure.domain.com.key accept = X.X.X.X:443 connect = X.X.X.X:81 xforwardedfor = yes TIMEOUTclose = 0

1 0

How to define stunnel.conf so openvpn packet will go thru stunnel to as HTTP?
by UARE1234 29 Nov '10

29 Nov '10

Hi, >From what I read the examples in stunnel site it possible to wrap VPN's using Stunnel tool. Is it possible to do it for openvpn packets? I can configure thru the openvpn configurations that it packets will go thru port 80 and use TCP but the packets are not http pure. I need to wrap this packets using the stunnel tool. The purpose is to use openvpn over http. I will appreceate if someone can give me a solution for combinig Stunnel and openvpn if possible. Thanks -- View this message in context: http://old.nabble.com/How-to-define-stunnel.conf-so-openvpn-packet-will-go-… Sent from the Stunnel - Users mailing list archive at Nabble.com.

1 0

Is it possible to wrap openvpn thru stunnel to HTTP-Like
by UARE1234 28 Nov '10

28 Nov '10

Hi, I understand that it is possible to wrap VPN's using Stunnel tool. How Can I do that for openvpn. The purpose is to use openvpn over http like. OpenVPN can establish an HTTP connection to a proxy server, where it will issue a CONNECT to establish a binary connection to the VPN server on port 443/TCP. This works in 99,9% but not in this case since I am talking about a very restrictive network but yet Skype for example works on it since it works in a way of http like. I will appreceate if someone can give me a solution for combinig Stunnel and openvpn or other tool if possible. Thanks -- View this message in context: http://old.nabble.com/Is-it-possible-to-wrap-openvpn-thru-stunnel-to-HTTP-L… Sent from the Stunnel - Users mailing list archive at Nabble.com.

1 0

Stunnel resource usage
by Avinash Gaonkar 26 Nov '10

26 Nov '10

Hi All, I need to understand how can we calculate the throughput for stunnel based on allocated CPU and memory. For e.g if we allocate 512Mb of RAM and 1 core for the stunnel in Vmware, what would be the throughput in Mbps. Regards, Avinash gaonkar

1 0

Enhance description of transparent mode in FAQ
by Ivan Trancik 25 Nov '10

25 Nov '10

Hello, I would suggest to improve 'transparent = yes | no (Unix only)' section of http://www.stunnel.org/faq/stunnel.html#service_level_options and how this option work on OS X. I think that this part remote mode (I<connect> option) on Linux >=2.6.28 remote mode (I<connect> option) 2.2.x local mode (I<exec> option) is not clear. Remote mode is a "I<connect> option"? What the heck? And local mode is a "I<exec> option"? Does this "I" thingie stand for unnamed pipe or capital "i" or small cap "L"?? I ran to this problem when I tried to set up stunnel on Mac OS X and carelessly used some example config on web. Setting "transparent = yes" in Mac OS X will result in very funny behavior. Consider this conf debug=7 output=stunnel.log verify=0 foreground=yes client=yes pid= [https] accept=localhost:8080 connect=google.com:443 transparent=yes will result in unbelievable error - "local_bind (original port): Address family not supported by protocol family (47)" Using 127.0.0.1 instead of localhost will do better - "Service https bound to 127.0.0.1:8080" - BUT when you try to access 127.0.0.1:8080 nothing reasonable happens and log will show another strange error "connect_blocking: connect <ip_address>: Network is unreachable (51)" The next spectacular thing is that when you use only localhost connect and accept parameter, than transparent=yes works OK. I would suggest rewriting that part to reflect these kind of situations in more clear way - they are very hard to debug, and honestly I couldn't figure it out even though I read FAQ several times. Final question - is it possible on OS X (which doesn't have iptables interface, but has ipfw) to set up transparent proxy tunnel with stunnel? Thanks.

2 1

Problems with cert
by Ross 25 Nov '10

25 Nov '10

Hello, we were using Stunnel 4.25 for a long time without any problems. We used "verify=3". Our client config file: service = stunnel-client cert = client.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 verify = 3 CApath = certificates CAfile = CAcert.pem client = yes [rdp] accept = 3398 connect = XX.XX.XX.XX:3398 But after switching to Stunnel 4.34 (preserving configuration) we started to get errors: 2010.11.25 13:13:30 LOG5[8332:5336]: Service rdp-database accepted connection from 127.0.0.1:30082 2010.11.25 13:13:30 LOG5[8332:5336]: connect_blocking: connected 95.130.236.42:3398 2010.11.25 13:13:30 LOG5[8332:5336]: Service rdp-database connected remote server from XX.XX.XX.XX:30083 2010.11.25 13:13:30 LOG5[8332:5336]: Certificate accepted: depth=1, /C=UA/ST=Lviv/L=Lviv region/O=ROSS/OU=IT/emailAddress=bla(a)bla.com 2010.11.25 13:13:30 LOG4[8332:5336]: CERT: Certificate not found in local repository 2010.11.25 13:13:30 LOG4[8332:5336]: Certificate check failed: depth=0, /C=UA/ST=Lviv/L=Lviv region/O=ROSS/OU=IT/CN=OURSERVER/emailAddress=bala(a)bla.com 2010.11.25 13:13:30 LOG3[8332:5336]: SSL_connect: 14090086: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed 2010.11.25 13:13:30 LOG5[8332:5336]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Main error is: CERT: Certificate not found in local repository Looks like stunnel cannot find the hashed server's certificate in C:\Program Files\stunnel\certificates (CApath = certificates) We tried specifying full paths, but it does not help. Switching to "verify=2" (do not check server's cert) works ok. Also stunnel 4.25 (with verify=3) works ok on this configuration. Could you help? Ross

2 1

Re: [stunnel-users] ssl renegotiation
by Jason Haar 25 Nov '10

25 Nov '10

On 11/25/2010 05:42 AM, Joe Williams wrote: > > Got it, so there's no way to configure stunnel to disable it without building a new openssl from source. I was thinking there might be an SSL option I could pass in. > That kind of feature was only introduced into the newer versions of OpenSSL, so by definition, older versions can't have an option to disable it ;-) FYI I still have to run fully patched Apache with "SSLInsecureRenegotiation on" due to MSIE still not supporting proper optional client cert renegotiation. It's only *2 years* since the vulnerability was discovered... (Chrome, Firefox are fine of course) -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

1 0

ssl renegotiation
by Joe Williams 24 Nov '10

24 Nov '10

List, How does one secure stunnel from man in the middle attacks regarding ssl renegotiation. I have seen http://www.openssl.org/docs/ssl/SSL_CTX_set_options.html#SECURE_RENEGOTIATI… but I couldn't tell if stunnel is affected by it, nor what I could do outside of installing a newer version of openssl to prevent it. Additionally I did a scan on www.ssllabs.com and it stated that insecure renegotiation was supported, which isn't good. I am running 0.9.8k-7ubuntu8.4, the standard version that ships with ubuntu 10.04, and stunnel 4.32. What can I do to configure stunnel to protect myself? My current config is below. Thanks. -Joe ; Certificate/key is needed in server mode and optional in client mode cert = /etc/stunnel/file.crt key = /etc/stunnel/file.key foreground = yes debug = 5 ciphers = DES-CBC3-SHA:AES256-SHA:AES128-SHA:RC4-SHA:RC4-MD5 ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = all options = NO_SSLv2 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 ; PID is created inside chroot jail pid = /stunnel4.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Service-level configuration [https] accept = 443 connect = localhost:80 TIMEOUTclose = 0 Name: Joseph A. Williams Email: joe(a)joetify.com Blog: http://www.joeandmotorboat.com/ Twitter: http://twitter.com/williamsjoe

2 2

SSLPassPhraseDialog
by Avinash Gaonkar 23 Nov '10

23 Nov '10

Hi Team, How can we configure ssl key passphrase in stunnel config file. for. eg SSLPassPhraseDialog exec:/path/to/passphrase-file parameter we have in apache, so no need to key in password every time when we restart service. Regards, Avinash Gaonkar

3 2

SMPP Protocol and STunnel
by Pathak, Apurva (Apu) 23 Nov '10

23 Nov '10

Hello, I would like to find out if I can use STunnel as follows: I have a stand alone C# executable program that uses a third party SDK that implements SMPP protocol and sends SMS text messages with wireless carriers. Recently, one of the wireless carriers wants us to implement SSL Client Authentication and wants SMPP messages that are exchanged with them to be encrypted after the client authentication is done. I want to find out if I can use STunnel running so that STunnel can encrypt and decrypt the messages exchanged between my program and the carrier's SMS server. (1) Is this possible with STunnel? (2) What are the steps involved? I am on the Windows Server 2003 platform. I would really appreciate a reply. Thanks, Apu

3 12

Re: [stunnel-users] Error: faulting application stunnel.exe, version 0.0.0.0, faulting module libeay32.dll, version 1.0.0.1, fault address 0x0007331e.
by Pathak, Apurva (Apu) 21 Nov '10

21 Nov '10

Ok...I may keep it....at the moment things are very stable so I am not touching any thing for the moment. The client mentioned it...and they examined the stunnel.conf of some of their other customers...so...otherwise it made sense to me to keep it. Thanks again for your help! Apurva ====== Hi Apurva, Good news. Just to mention: SslVersion=all OFTEN SOLVES MANY PROBLEMS in various circumstances. So I would keep it... Just search for it in the mailing list and you will see... This is just an advice... Yours sincerely, Pierre -----Original Message----- From: stunnel-users-bounces(a)mirt.net [mailto:[email protected]] On Behalf Of stunnel-users-request(a)mirt.net Sent: Sunday, November 21, 2010 1:27 PM To: stunnel-users(a)mirt.net Subject: stunnel-users Digest, Vol 76, Issue 13 Send stunnel-users mailing list submissions to stunnel-users(a)mirt.net To subscribe or unsubscribe via the World Wide Web, visit http://stunnel.mirt.net/mailman/listinfo/stunnel-users or, via email, send a message with subject or body 'help' to stunnel-users-request(a)mirt.net You can reach the person managing the list at stunnel-users-owner(a)mirt.net When replying, please edit your Subject line so it is more specific than "Re: Contents of stunnel-users digest..."

1 0

public domain [PATCH] to stunnel 4.34 for Windows CE / Windows Mobile, "no service" CRITICAL bug and unicode bugs fixed
by Pierre DELAAGE 17 Nov '10

17 Nov '10

Dear All, Please find enclosed a patch in "diff -cr orig patched" format, applying to stunnel4.34 as found here ftp://stunnel.mirt.net/stunnel/. This patch mainly addresses compilation and unicode issues for Windows CE targets + ONE critical issue preventing stunnel to service anything (!). I use MS EVC 4sp2 compiler with WCE 420 SDK, on a vista host platform. Once debugged the code works fine on WM6 HTC smartphones. Should work on WM5. It needs a windows CE openssl lib (I recompiled MY patched version of openssl 1.0.0a successfully: I will have to log a patch to those gentlemen, hoping that they are open to integrate it, something not so obvious in the past). I will later post here a link to my patch for openssl 100a pointing to the openssl mailing list. THIS OPENSSL PATCH IS ESSENTIAL : with my older version of openssl 098pre_j for wce, stunnel does not work anymore (it crashes after first cnx). The present stunnel patch addresses the following issues : ************* I] COMPILATION FAILURES 1/ on common.h "EINVAL redefinition" : in fact the compile options WX (see evc.mak) does not tolerate any warning : The MS evc420 compiler ALWAYS issues a warning on this symbol redefinition. Michal and I are dealing with it since month... But, considering that NEITHER Exxx error codes are used in stunnel, I suggest that in fact ALL these redef should be suppressed. TODO: In the future a proper rewrite of code in log.c, where hardcoded values of WSA error codes are used instead of symbolic constant, will have to be done. 2/ client.c CreateProcess is a UNICODE function: code was ascii only. Code has been adapted to work in unicode. 3/ evc.mak path to new openssl lib has been redefined. proper location for the libs in openssl tree has been set in the make-install block (although this block is presently USELESS and needs a complete rewrite). 4/ gui.c All code using hmainmenu is OFF under winCE. So some new lines involving it were not compiling. 5/ options.c linger_val.l_linger and linger_val.l_onoff require ushort values. Strict type checking of the compiler required a proper cast to ushort of the r-values. stralloc uses "strdup": on Win32 and winCE strdup is _strdup (!). 6/ prototypes.h : _beginthread was defined as returning an int, an a long in sthread.c. After some checking in various documentations, long is the correct type, in particular because _beginthread can return the special error value "-1L". So that unsigned types are illogical. This simplifies the code in some locations, by saving some -now useless- casts. 7/ sthread.c create_client: suppressed some useless cast to (long) for beginthread. ************* II] OPERATIONAL ERRORS (at run-time) This is a reminder of previous notification to the mailing list : due to beginthread improper code and/or use, It is presently IMPOSSIBLE for stunnel 434 to be used in production on WCE: it is just unable to service any...service. Nothing happens if, for example, you use it to connect to an https server. No log either ! I corrected the code with both Michal patch to gui.c and mine to sthread.c: gui.c (Michal patch) : _beginthread was called with 0 as stacksize which, cumulated to an improper coding of sthread/beginthread, led to FAILURE of service thread creation. sthread.c: _beginthread : now supports "0" stacksize value, leading to default linker stack size (1MB by default unless specified differently on the linker command line, something we do not yet perform but could). ************* III] MINOR IMPROVMENT _beginthread: added a log on critical event of "failure" to create a service thread. because I think it is a critical event, isn't it? I hope you will find this patch useful. Thank you for your excellent work, Yours sincerely, Pierre Delaage Note : I use stunnel to establish a simple "vpn" between smartphones and a corporate linux server mainly for HTTPS/POPS/SMTPS support. Stunnel is very relevant in that matter, over solutions based on SSH (although we use also ssh), from a communication cost point of view : ssh establishes permanent socket between client and server, so that the communication is charged by the mobile network provider : and these charges are very expensive. On the contrary stunnel only establishes ssl sockets on demand so that financial charges are limited to strict necessary. Please note that stunnel brings "client based certificate authentication" to POP/SMTP mobile mail user agents which only BASICALLY supports SSL with server authentication, but NO client authentication, such as M$ Outlook for Mobile (unless you pay for an exchange server and exchange client licence). Here again stunnel is very relevant. Note 2 : the strdup and unicode bug fixes should benefit also to the win32 (for PC) stunnel version for PC.

1 1

CApath hash calculation broken (ver 4.34)?
by Konstantin Suvorov 17 Nov '10

17 Nov '10

Hello, I’m trying to setup client-server SSL connection with “level 3” verification on server side. I use 4.34 precompiled binary package for win32. I put client certificates into CApath folder with hashed filenames (I use openssl x509 -hash to get them). And nothing works: I get “bad certificate”. After sniffing for filenames stunnel server is looking for I found out that they are not matching the hash values I got with openssl tool. I downloaded openssl binaries (ver. 0.9.8o) and put them into the stunnel folder. This fixed the bug with wrong filename request inside stunnel, but it started to crash after connection is initiated. I tried to install stunnel (fresh download of 4.34) on another computer – the same problem: requested hash-filename is not equal to actual one. Does anybody know how to fix this? Regards, Konstantin.

1 0

STunnel / Memory Usage / 4 Second Lag
by Jesse Proudman 16 Nov '10

16 Nov '10

We have an account running on STunnel that has been operating just fine for the last 9 days. This morning, all of a sudden, stunnel memory usage spiked to consume the entire available memory on the machine, and response time went from sub 1 second to 4+ seconds. Nothing has changed in the load balanced service itself, the configuration, or any of the traffic numbers. Restarting stunnel gets us between 5 and 60 seconds of normal response times before spiking in memory and going back to 4 seconds. Has any one seen this before? Thanks - Jesse

1 0

Difficulty to compile with alternate 64 bit openssl libraries
by Philippe A. 12 Nov '10

12 Nov '10

Hello, I am having a problem when I compile stunnel against 64 bit openssl libraries: ./configure --prefix $HOME/tls --with-threads=fork --with-ssl=/opt2/openssl stunnel will end up using default libraries in /lib (which I can't remove from my environment). The workaround we have found is to modify the configure script and to force the LIBS variable to use "lib64" instead of "lib". # Add SSL includes and libraries CFLAGS="$CFLAGS -I$ssldir/include" LIBS="$LIBS -L$ssldir/lib64 -lssl -lcrypto" #- <---- Is this a known problem? Is there another way around this without changing the configure script? Thanks!

2 1

Reg:libwrap is not working with stunnel 4.34
by mohan raj 10 Nov '10

10 Nov '10

Hi, I successfully cross compiled the Stunnel version 4.34 with OpenSSL version 1.0.0a for arm-linux.i want to use this stunnel with my own application which will communicate with outer world through LAN or GPRS.currently i am testing stunnel with telnet application.Its working fine.I am able to telnet to arm board through SSL enabled telnet terminal software.Now i want restrict the access.so i used the /etc/hosts/allow and /etc/hosts.deny files with my chrroot directory as "/".but stunnel is not at all cared about libwrap service.its not checking those files.if i give libwrap=yes in stunnel.conf file its says "specified option name is not valid here".i compiled stunnel with the option --enable-libwrap and gave the libwrap lib also through LDFLAGS.here with i attached my stunnel version information file, stunnel .conf file also.i think its due to configuration???still i don`t know what to do???so please guys help me out. Thanks & Regards S.Thiyagarajan.

3 4

Error Reading Certificate File
by Ken Davidson 04 Nov '10

04 Nov '10

Hi, I am trying to update my companies Certificate in STunnel and I'm getting the following error messages: Certificate: pass-web_new.pem Error reading certificate file: pass-web_new.pem error queue: 140DC009 : error:140DC009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib error queue: 906700D : error:0906700D:PEM routines:PEM_ASN1_read_bio:ASN1 lib error queue: D08303A : error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error error queue: D07803A : error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error SSL_CTX_use_certificate_chain_file: D0680A8: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag We are currently using STunnel without issue; but my certificate is due to expire November 15th. I submitted my request via a CSR file created with OPENSSL. I've attempted to put the data into the file pointed at in the stunnel.conf file but this error continues to haunt me. My previous key was 256, but when making this key I created a 1024 key and used that for the CSR file. I've also added the Intermediate certificate information to the file. Any information on what could be the problem is greatly appreciated. Version: 4.34 Thanks, Ken

1 0

FD_SETSIZE still an option in stunnel 4.34?
by Saikat Chakrabarti 04 Nov '10

04 Nov '10

Hi, I am having some issues with my server where connections are getting dropped once I hit a hard limit of around 350 connections. This may or may not be an issue with my stunnel configuration, but I ran across some old posts saying that stunnel by default has a hard limit of around 500 connections and, to get around this, to set FD_SETSIZE at compile time (I found this on the troubleshooting page - http://www.stunnel.org/faq/troubleshooting.html) However, one of the release notes recently also had a comment saying 'no more FD_SETSIZE limit!' - http://www.mail-archive.com/[email protected]/msg38373.html. So my questions are: 1) Does FD_SETSIZE still exist in Stunnel 4.34 and could it be a reason why I am seeing a limit on the number of people that can make a connection? I already tried running stunnel after setting ulimit -Hn and ulimit -Sn to 4096, and it did not seem to make a difference. 2) More noobish question - how do I set the FD_SETSIZE at compile time? I saw in the troubleshooting that it said to do "-DFD_SETSIZE=4096" at compile time. Is this something I should be adding in one of the Makefiles? Some more info about my setup: - I am using stunnel as a layer in front of Node.js to secure websockets and HTTP connections. - I'm running stunnel 4.34 - I am running stunnel from a startup script in /etc/init.d - it runs as a daemon process - I run stunnel with no params, but with this config file - http://pastebin.com/3Yr80ma1 - uname -a output: Linux gomockingbird.com 2.6.18.8-linode22 #1 SMP Tue Nov 10 16:12:12 UTC 2009 i686 GNU/Linux - gcc -v output: Using built-in specs. Target: i486-linux-gnu Configured with: ../src/configure -v --with-pkgversion='Ubuntu 4.3.3-5ubuntu4' --with-bugurl=file:///usr/share/doc/gcc-4.3/README.Bugs --enable-languages=c,c++,fortran,objc,obj-c++ --prefix=/usr --enable-shared --with-system-zlib --libexecdir=/usr/lib --without-included-gettext --enable-threads=posix --enable-nls --with-gxx-include-dir=/usr/include/c++/4.3 --program-suffix=-4.3 --enable-clocale=gnu --enable-libstdcxx-debug --enable-objc-gc --enable-mpfr --enable-targets=all --with-tune=generic --enable-checking=release --build=i486-linux-gnu --host=i486-linux-gnu --target=i486-linux-gnu Thread model: posix gcc version 4.3.3 (Ubuntu 4.3.3-5ubuntu4) - openssl version output: OpenSSL 0.9.8g 19 Oct 2007 Thanks in advance for any help! -- Saikat

2 3

Many services on the same port (VirtualHost)
by Hugo 01 Nov '10

01 Nov '10

Hello all! Does anyone knows a way to make many services listening on the same port? I've got one stunnel4 server which allows me to crypt two http servers. The first service bind on port 465 and the second on 470. What I will is to let user access on the port 465 using 2 different ServerNames. Thank you in anticipation, and excuse me for my quite bad english =D

4 3

Re: [stunnel-users] stunnel-users Digest, Vol 75, Issue 13
by Hugo 31 Oct '10

31 Oct '10

It's what I wanted to do: redirect the public 443 port on the correct local stunnel "accept:" port or service. I'd set 3 services with 3 different certificates on 3 ports. By eg, my first domain is ssl.example.com and the second admin.example.com. These two records point on the same IP. Stunnel has two services on that, so it binds two ports (!=443) (eg, 7100 and 7200) Is there a way to stunnel (or another program) bind on port 443 and, if user connects on ssl.example.com, forward frames/respond using the service/port 7100, and the same for admin.example.com on 7200? https://ssl.example.com ==> https://ssl.example.com:7100 https://admin.example.com ==>https://admin.example.com:7200 ? Thanks Message: 2 Date: Sat, 30 Oct 2010 11:45:19 -0400 (EDT) From: Jon Daley <stunnel(a)jon.limedaley.com> To: stunnel-users(a)mirt.net Subject: Re: [stunnel-users] Many services on the same port (VirtualHost) Message-ID: <alpine.DEB.2.00.1010301139120.19689(a)orange.limedaley.com> Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed On Sat, 30 Oct 2010, Hugo wrote: > Does anyone knows a way to make many services listening on the same port? > I've got one stunnel4 server which allows me to crypt two http servers. > The first service bind on port 465 and the second on 470. > What I will is to let user access on the port 465 using 2 different > ServerNames. I am not sure what you are trying to do. You want clients to connect via https to ports 465 on two different IPs and then stunnel to forward them to the appropriate http daemon? I am not sure if stunnel works in that method - that is the reverse of what I use stunnel for - I connect via an unencrypted connection, and forward via stunnel to an encrypted daemon. And if you are talking about virtually hosting https connections, that will work, as long as the certificate contains both servernames - you can't use two different certificates, because you don't know which certificate to serve until after the connection is encrypted.

2 2

Re: [stunnel-users] Many services on the same port (VirtualHost)
by Hugo 30 Oct '10

30 Oct '10

Thanks for the answer, but it seems I haven't got access to IPTables (my stunnel is on a remote shell service) and I think using a webserver is not a good solution for that case. So does anyone knows a program able to bind on a single port, and redirect requests on another depending on the domain name? Thanks you in anticipation Hugo On 30/10/2010 17:02, Pierre DELAAGE wrote: > Hello, > The answer is simply NO in stunnel, > but yes in Apache. > If you are joining one "http server", hosting many virtual hosts, > it should be "trivial". > I recommend using IP based hosting. > > I guess you want to act as a transparent gateway/proxy to https servers : > there is another way to proceed if you have a linux PC on your network > that can act as a routing/gateway: > with iptables you can do redirection to stunnel and get what you want. > Sorry but it is a little bit complicated to develop more now. > > Hope this helps, > Pierre Delaage > > > Le 30/10/2010 17:12, Hugo a écrit : >> Hello all! >> >> Does anyone knows a way to make many services listening on the same port? >> I've got one stunnel4 server which allows me to crypt two http servers. >> The first service bind on port 465 and the second on 470. >> What I will is to let user access on the port 465 using 2 different >> ServerNames. >> >> Thank you in anticipation, and excuse me for my quite bad english =D >> >> >> >> _______________________________________________ >> stunnel-users mailing list >> stunnel-users(a)mirt.net >> http://stunnel.mirt.net/mailman/listinfo/stunnel-users >

2 1

Re: [stunnel-users] openssl cross compiling for windows
by Jon Daley 30 Oct '10

30 Oct '10

On Wed, 27 Oct 2010, Jon Daley wrote: > On Wed, 27 Oct 2010, Michal Trojnara wrote: >> Jon Daley wrote: >>>> 3. Cross-compile OpenSSL: >>>> ./Configure --cross-compile-prefix=i586-mingw32msvc- mingw shared >>>> zlib-dynamic >>>> make >>> And you end up with 3 dlls in the openssl directory? >> >> Not really. Just 2 of them. Zlib is produced in step 2. > Hrm. I wasn't talking about the zlib1.dll. I meant: > ssleay32.dll, libssl32.dll and libeay32.dll. Maybe I got mixed up the names, > and am using one that I don't need. I thought I put them in one at a time, > and waited for Windows to ask me for them, but I'll check again. Ah, yes. I am dumb. I can compile and run it without problems with just the two *eay32 dlls. And we've finally figured out the other bug, where it works on my computer, and not on someone else's. It has to do with ipv6 support, and it didn't go away even after I ./config --disable-ipv6, which that flag is (mostly?) ignored in the windows builds, due to the dynamic LoadLibrary calls. On one computer, stunnel connects on the ipv6 port, but then when running "telnet localhost 7000", it connects via the ipv4 port, and so fails. If we force stunnel to use ipv4 by using 127.0.0.1 instead of localhost, everything works fine. My guess is that his computer is partially/incorrectly configured for ipv6, and so that is the reason for the failure. I'm planning on removing the LoadLibrary calls to force ipv6 to be off, though it'd be nice to not do that, since someday, there will be an ipv6-only network that we'll have to deal with presumably. -- Jon Daley http://jon.limedaley.com ~~ For many people, one of the most frustrating aspects of life is not being to understand other people's behavior. We see them as "guilty" instead of "innocent." -- Unknown

2 2

Re: [stunnel-users] openssl cross compiling for windows
by Jon Daley 27 Oct '10

27 Oct '10

On Wed, 27 Oct 2010, Michal Trojnara wrote: > 1. Install mingw32 tools: > apt-get install mingw32 Yes, I did that. > 2. Cross-compile and install zlib > (see the zlib documentation for details) Yes, I was doing that, but then was leaving it out since I don't need it (AFAIK). > 3. Cross-compile OpenSSL: > ./Configure --cross-compile-prefix=i586-mingw32msvc- mingw shared > zlib-dynamic > make And you end up with 3 dlls in the openssl directory? > 4. Cross-compile stunnel: > cd src > make stunnel.exe I can compile stunnel.exe fine, I just can't run it, because I don't have all three of the dlls. -- Jon Daley http://jon.limedaley.com ~~ If you do a job too well, you will get stuck with it. -- Slous

2 1

openssl cross compiling for windows
by Jon Daley 27 Oct '10

27 Oct '10

I am trying to compile openssl and stunnel for Win32, using my Debian host. openssl compilation: ./Configure --cross-compile-prefix=i586-mingw32msvc- mingw shared no-zlib && make The only problem I'm having is that libssl32.dll is not being created. I have the other libssl* files: libssl.a libssl.dll.a libssl.pc So, then I download the precompiled dlls of openssl from here: http://www.slproweb.com/products/Win32OpenSSL.html But, they require an additional vc redistributable, and since it seems like I'm so close, it'd be nice to finish it off the rest of the way. stunnel compiles fine pointing it at the openssl directory, but on run-time, it complains that libssl32.dll can't be found. Thanks. -- Jon Daley http://jon.limedaley.com ~~ There are no traffic jams when you go the extra mile. -- Anonymous

2 1

Stunnel dropping data on binary uploads from most browsers.
by Bill Crowell 16 Oct '10

16 Oct '10

All, I'm hoping that someone can assist with this. I'm using Stunnel on 2 different systems: Mac and FC 13 to front-end my web server for a custom database system. It works flawlessly except for uploading large binary files. The problem comes when trying to upload say a 2.5MB image file. The number of bytes actually transferred to the exec program is usually under 1K or right at about 33K. Using Firefox on Windows works all the time. I can observe the transfer by watching the stunnel.log file. When the data is piped into the openSSL engine, the number of bytes written to socket is being picked up by the exec program and processed so the loss is between the browser and the output side of Stunnel. The message itself is a multi-part message that is not mime-encoded. The part with the image is set in the boundary properly and contains the JPEG binary. (Thanks to HTTPwatch!) My Stunnel Version is: [root@linux log]# stunnel -version stunnel 4.33 on i386-redhat-linux-gnu with OpenSSL 1.0.0a-fips 1 Jun 2010 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = daemon.notice pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!aNULL:!eNULL:!SSLv2 session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none My configuration file on the Linux box is: cert = /etc/stunnel/server.crt key = /etc/stunnel/server.key debug = 7 output = /var/log/stunnel.log ;socket = l:SO_LINGER=1:60 ;socket = r:TCP_NODELAY=1 client = no sslVersion = SSLv3 [https] libwrap = no accept = 443 exec = /usr/qmsys/bin/qm execargs = /usr/qmsys/bin/qm -b7 -quiet -aPAVUK "P.HTTP" options = DONT_INSERT_EMPTY_FRAGMENTS TIMEOUTidle = 30 TIMEOUTbusy = 5 TIMEOUTclose = 0 *** A RANDOM SUCCESSFUL TRANSFER *** 2010.10.15 10:03:12 LOG7[946:3078133552]: Service https accepted FD=0 from 24.171.161.99:1998 2010.10.15 10:03:12 LOG7[946:3078241136]: Service https started 2010.10.15 10:03:12 LOG7[946:3078241136]: FD=0 in non-blocking mode 2010.10.15 10:03:12 LOG5[946:3078241136]: Service https accepted connection from 24.171.161.99:1998 2010.10.15 10:03:12 LOG7[946:3078241136]: SSL state (accept): before accept initialization 2010.10.15 10:03:12 LOG7[946:3078241136]: SSL state (accept): SSLv3 read client hello A 2010.10.15 10:03:12 LOG7[946:3078241136]: SSL state (accept): SSLv3 write server hello A 2010.10.15 10:03:12 LOG7[946:3078241136]: SSL state (accept): SSLv3 write change cipher spec A 2010.10.15 10:03:12 LOG7[946:3078241136]: SSL state (accept): SSLv3 write finished A 2010.10.15 10:03:12 LOG7[946:3078241136]: SSL state (accept): SSLv3 flush data 2010.10.15 10:03:12 LOG7[946:3078241136]: SSL state (accept): SSLv3 read finished A 2010.10.15 10:03:12 LOG7[946:3078241136]: 8 items in the session cache 2010.10.15 10:03:12 LOG7[946:3078241136]: 0 client connects (SSL_connect()) 2010.10.15 10:03:12 LOG7[946:3078241136]: 0 client connects that finished 2010.10.15 10:03:12 LOG7[946:3078241136]: 0 client renegotiations requested 2010.10.15 10:03:12 LOG7[946:3078241136]: 35 server connects (SSL_accept()) 2010.10.15 10:03:12 LOG7[946:3078241136]: 35 server connects that finished 2010.10.15 10:03:12 LOG7[946:3078241136]: 0 server renegotiations requested 2010.10.15 10:03:12 LOG7[946:3078241136]: 27 session cache hits 2010.10.15 10:03:12 LOG7[946:3078241136]: 0 external session cache hits 2010.10.15 10:03:12 LOG7[946:3078241136]: 0 session cache misses 2010.10.15 10:03:12 LOG7[946:3078241136]: 0 session cache timeouts 2010.10.15 10:03:12 LOG6[946:3078241136]: SSL accepted: previous session reused 2010.10.15 10:03:12 LOG6[946:3078241136]: Local mode child started (PID=1179) 2010.10.15 10:03:12 LOG7[946:3078241136]: Remote FD=13 initialized 2010.10.15 10:03:13 LOG7[946:3078241136]: Socket closed on read 2010.10.15 10:03:13 LOG7[946:3078241136]: SSL write shutdown 2010.10.15 10:03:13 LOG7[946:3078241136]: SSL alert (write): warning: close notify 2010.10.15 10:03:13 LOG6[946:3078241136]: SSL_shutdown successfully sent close_notify 2010.10.15 10:03:13 LOG6[946:3078241136]: s_poll_wait timeout: connection close 2010.10.15 10:03:13 LOG5[946:3078241136]: Connection closed: 2895 bytes sent to SSL, 2469539 bytes sent to socket 2010.10.15 10:03:13 LOG7[946:3078241136]: Service https finished (0 left) 2010.10.15 10:03:13 LOG7[946:3078133552]: Cleaning up the signal pipe 2010.10.15 10:03:13 LOG6[946:3078133552]: Child process 1179 finished with code 0 2010.10.15 10:03:13 LOG7[946:3078133552]: Signal pipe is empty *** MOST OF THE TIME - AN UNSUCCESSFUL TRANSFER *** 2010.10.15 10:05:01 LOG7[946:3078133552]: Service https accepted FD=0 from 24.171.161.99:1985 2010.10.15 10:05:01 LOG7[946:3077921648]: Service https started 2010.10.15 10:05:01 LOG7[946:3077921648]: FD=0 in non-blocking mode 2010.10.15 10:05:01 LOG5[946:3077921648]: Service https accepted connection from 24.171.161.99:1985 2010.10.15 10:05:01 LOG7[946:3077921648]: SSL state (accept): before/ accept initialization 2010.10.15 10:05:01 LOG7[946:3077921648]: SSL state (accept): SSLv3 read client hello A 2010.10.15 10:05:01 LOG7[946:3077921648]: SSL state (accept): SSLv3 write server hello A 2010.10.15 10:05:01 LOG7[946:3077921648]: SSL state (accept): SSLv3 write change cipher spec A 2010.10.15 10:05:01 LOG7[946:3077921648]: SSL state (accept): SSLv3 write finished A 2010.10.15 10:05:01 LOG7[946:3077921648]: SSL state (accept): SSLv3 flush data 2010.10.15 10:05:01 LOG7[946:3077921648]: SSL state (accept): SSLv3 read finished A 2010.10.15 10:05:01 LOG7[946:3077921648]: 9 items in the session cache 2010.10.15 10:05:01 LOG7[946:3077921648]: 0 client connects (SSL_connect()) 2010.10.15 10:05:01 LOG7[946:3077921648]: 0 client connects that finished 2010.10.15 10:05:01 LOG7[946:3077921648]: 0 client renegotiations requested 2010.10.15 10:05:01 LOG7[946:3077921648]: 44 server connects (SSL_accept()) 2010.10.15 10:05:01 LOG7[946:3077921648]: 44 server connects that finished 2010.10.15 10:05:01 LOG7[946:3077921648]: 0 server renegotiations requested 2010.10.15 10:05:01 LOG7[946:3077921648]: 35 session cache hits 2010.10.15 10:05:01 LOG7[946:3077921648]: 0 external session cache hits 2010.10.15 10:05:01 LOG7[946:3077921648]: 0 session cache misses 2010.10.15 10:05:01 LOG7[946:3077921648]: 0 session cache timeouts 2010.10.15 10:05:01 LOG6[946:3077921648]: SSL accepted: previous session reused 2010.10.15 10:05:01 LOG6[946:3077921648]: Local mode child started (PID=1213) 2010.10.15 10:05:01 LOG7[946:3077921648]: Remote FD=13 initialized 2010.10.15 10:05:04 LOG7[946:3077921648]: Socket closed on read 2010.10.15 10:05:04 LOG7[946:3077921648]: SSL write shutdown 2010.10.15 10:05:04 LOG7[946:3077921648]: SSL alert (write): warning: close notify 2010.10.15 10:05:04 LOG6[946:3077921648]: SSL_shutdown successfully sent close_notify 2010.10.15 10:05:04 LOG6[946:3077921648]: s_poll_wait timeout: connection close 2010.10.15 10:05:04 LOG5[946:3077921648]: Connection closed: 2895 bytes sent to SSL, 66703 bytes sent to socket 2010.10.15 10:05:04 LOG7[946:3077921648]: Service https finished (0 left) 2010.10.15 10:05:04 LOG7[946:3078133552]: Cleaning up the signal pipe 2010.10.15 10:05:04 LOG6[946:3078133552]: Child process 1213 finished with code 0 2010.10.15 10:05:04 LOG7[946:3078133552]: Signal pipe is empty *** All test cases are the same upload of the same image file. In all tests the number of bytes sent to socket matches what the exec program is receiving in its pipe. My feeling is that there is a connection issue between the browser and Stunnel. The successful upload of the test occurs sometimes with all browsers and appears to always work with Firefox for Windows. It has a 90% failure rate on Safari for Windows, Safari for Mac, Opera for Windows, Opera for Mac, etc. In all cases of testing, the number of bytes "sent to socket" is received by my exec program and consists of a truncated message from the browser. It appears that the data is simply being truncated somewhere in the Stunnel process. Any help is always appreciated! If there are more tests to be run to track down the problem, please advise and I will run them. Regards, Bill Bill Crowell, President Pavuk Technologies, LLC PO Box 33097 Charlotte, NC 28233-3097 Office +1 704.248.0024 Mobile +1 704.607.6077 Skype pavuk.com

2 1

Recompiling Stunnel at version 4.34 appears to fix dropped data problem
by Bill Crowell 15 Oct '10

15 Oct '10

I reported a consistent data loss from most browsers when transferring large files. Compiling version 4.34 on Mac OS X 10.6.4 with the latest Xcode toolkit has resolved the connection problem for all browsers that I have tested except for Safari 5.0 on both Windows and Mac. It has also fixed a connection problem with IE 6 which was not accepting any connection to Stunnel prior to this installation. *** This problem still persists on my linux box running 4.33 installed from FC13. I will attempt a compile of 4.34 and see if this fixes the problem there as well. Fedora does not yet have a package for 4.34. Bill Bill Crowell, President Pavuk Technologies, LLC PO Box 33097 Charlotte, NC 28233-3097 Office +1 704.248.0024 Mobile +1 704.607.6077 Skype pavuk.com

1 0

Re: [stunnel-users] stunnel daemon mode
by Joe Williams 08 Oct '10

08 Oct '10

> In inetd mode, you get a new Stunnel process for every connection. > Initialization must occur in *each* new process - they don't share > any state, including any session ids. > > In daemon mode, there's one stunnel process (threaded) which can > share state between threads, so it is much better. Ah I see, so running a single process (w/ pthreads) under runit I get the same effect as daemon mode. Correct? -Joe Name: Joseph A. Williams Email: joe(a)joetify.com Blog: http://www.joeandmotorboat.com/ Twitter: http://twitter.com/williamsjoe

1 0

stunnel daemon mode
by Joe Williams 07 Oct '10

07 Oct '10

According to http://www.sans.org/reading_room/whitepapers/vpns/stunnel-ssling-internet-s… In addition, Stunnel performance is improved by running it in daemon mode instead of inetd. Running Stunnel in daemon mode provides the following benefits: no SSL initialization necessary with every connection, and SSL session caching. Is this still the case? Running in the foreground you don't get these? Thanks. -Joe Name: Joseph A. Williams Email: joe(a)joetify.com Blog: http://www.joeandmotorboat.com/ Twitter: http://twitter.com/williamsjoe

1 0

fingerprint does not match
by Nelson 02 Oct '10

02 Oct '10

I have a running machine with stunnel installed for HTTPS services. Now, I want to setup another machine using the same configuration and key from my 1ST machine. I have installed stunnel patch with x-forwarded-for. However, everytime I try to start it up, it shows: Starting universal SSL tunnel: stunnelReading configuration from file /usr/local/etc/stunnel/stunnel.conf FIPS_mode_set: 2D06C06E: error:2D06C06E:FIPS routines:FIPS_mode_set:fingerprint does not match failed. I'm using the same key and cert that my 1ST machine is using. Would there be a problem? I've no problem starting stunnel yesterday. I just encountered this error when I change my ip address. I make sure that my config also listen to this ip address. Would anyone know how to fix this problem? Tried to Google but to no avail.

3 2

pop3 stunnel nmh to gmail
by Joseph Brenner 27 Sep '10

27 Sep '10

I'm an nmh user running ubuntu jaunty, and I want to get my local email working over SSL connections to a gmail account (POP3/SMTP). So I'm trying to get some form of mh to talk over SSL using stunnel4. I'm looking for suggestions on what I might be doing wrong, and hints on how to go about isolating the problems. I've succeeded in using slypheed to get mail from gmail, so I know the gmail account is working and is set-up for pop3 and so on. When I run mh's inc command, though, it just reports: "inc: no servers available" I can see that I've got stunnel running by doing a: ps ax | egrep stun | egrep -v egrep 5937 ? SN 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf 5938 ? SN 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf 5939 ? SN 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf 5940 ? SN 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf 5941 ? SN 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf 5942 ? SNs 0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf Google has some instructions up about servers and port numbers (but no examples specific to stunnel): http://mail.google.com/support/bin/answer.py?hl=en&answer=13287 Here's a summary of the kind of configurations I've been trying: /etc/default/stunnel4: ENABLED=1 FILES="/etc/stunnel/*.conf" OPTIONS="" PPP_RESTART=0 /etc/stunnel/stunnel.conf: sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [pop3s] accept = 127.0.0.1:995 connect = pop.gmail.com:110 [smtps] accept = 127.0.0.1:465 connect = smtp.gmail.com:25 /etc/nmh/mts.conf: mts: smtp hostable: /etc/nmh/hosts localname: smtp.gmail.com # localname: gmail.com masquerade: mmdfldir: /var/mail mmdflfil: # pophost: localhost # pophost: pop.gmail.com:995 pophost: pop.gmail.com:110 # pophost: pop.gmail.com # servers: localhost servers: smtp.gmail.com /var/log/stunnel4/stunnel.log 2010.09.21 11:11:41 LOG7[6528:140533218399984]: Snagged 64 random bytes from /dev/urandom 2010.09.21 11:11:41 LOG7[6528:140533218399984]: RAND_status claims sufficient entropy for the PRNG 2010.09.21 11:11:41 LOG7[6528:140533218399984]: PRNG seeded successfully 2010.09.21 11:11:41 LOG7[6528:140533218399984]: SSL context initialized for service pop3s 2010.09.21 11:11:41 LOG7[6528:140533218399984]: SSL context initialized for service imaps 2010.09.21 11:11:41 LOG7[6528:140533218399984]: SSL context initialized for service smtps 2010.09.21 11:11:41 LOG5[6528:140533218399984]: stunnel 4.22 on x86_64-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2010.09.21 11:11:41 LOG5[6528:140533218399984]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2010.09.21 11:11:41 LOG6[6528:140533218399984]: file ulimit = 1024 (can be changed with 'ulimit -n') 2010.09.21 11:11:41 LOG6[6528:140533218399984]: poll() used - no FD_SETSIZE limit for file descriptors 2010.09.21 11:11:41 LOG5[6528:140533218399984]: 500 clients allowed 2010.09.21 11:11:41 LOG7[6528:140533218399984]: FD 10 in non-blocking mode 2010.09.21 11:11:41 LOG7[6528:140533218399984]: FD 11 in non-blocking mode 2010.09.21 11:11:41 LOG7[6528:140533218399984]: FD 12 in non-blocking mode 2010.09.21 11:11:41 LOG7[6528:140533218399984]: SO_REUSEADDR option set on accept socket 2010.09.21 11:11:41 LOG7[6528:140533218399984]: pop3s bound to 127.0.0.1:1109 2010.09.21 11:11:41 LOG7[6528:140533218399984]: FD 13 in non-blocking mode 2010.09.21 11:11:41 LOG7[6528:140533218399984]: SO_REUSEADDR option set on accept socket 2010.09.21 11:11:41 LOG7[6528:140533218399984]: imaps bound to 0.0.0.0:993 2010.09.21 11:11:41 LOG7[6528:140533218399984]: FD 14 in non-blocking mode 2010.09.21 11:11:41 LOG7[6528:140533218399984]: SO_REUSEADDR option set on accept socket 2010.09.21 11:11:41 LOG7[6528:140533218399984]: smtps bound to 127.0.0.1:259 2010.09.21 11:11:41 LOG7[6534:140533218399984]: Created pid file /stunnel4.pid /var/log/mail.log Sep 21 13:40:32 fineline gnu-pop3d[15484]: Incoming connection opened Sep 21 13:40:32 fineline gnu-pop3d[15484]: connect from 127.0.0.1 Sep 21 13:40:32 fineline gnu-pop3d[15484]: User `doomvox(a)gmail.com': nonexistent Sep 21 13:40:32 fineline gnu-pop3d[15484]: Session ended for no user I'm using the "stunnel4" package for ubuntu jaunty: /usr/bin/stunnel4 -version stunnel 4.22 on x86_64-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel4.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none uname -a Linux fineline 2.6.24-16-generic #1 SMP Thu Apr 10 12:47:45 UTC 2008 x86_64 GNU/Linux gcc -v Using built-in specs. Target: x86_64-linux-gnu Configured with: ../src/configure -v --with-pkgversion='Ubuntu 4.3.3-5ubuntu4' --with-bugurl=file:///usr/share/doc/gcc-4.3/README.Bugs --enable-languages=c,c++,fortran,objc,obj-c++ --prefix=/usr --enable-shared --with-system-zlib --libexecdir=/usr/lib --without-included-gettext --enable-threads=posix --enable-nls --with-gxx-include-dir=/usr/include/c++/4.3 --program-suffix=-4.3 --enable-clocale=gnu --enable-libstdcxx-debug --enable-objc-gc --enable-mpfr --with-tune=generic --enable-checking=release --build=x86_64-linux-gnu --host=x86_64-linux-gnu --target=x86_64-linux-gnu Thread model: posix gcc version 4.3.3 (Ubuntu 4.3.3-5ubuntu4) openssl version OpenSSL 0.9.8g 19 Oct 2007

2 1

Critical error on stunnel 434 for WinCE/Windows Mobile: no service at all, because of failure in thread creation
by Pierre DELAAGE 26 Sep '10

26 Sep '10

Hello Michal, Maybe you remember me, I am the man that refreshed stunnel for winCE up to 4.27 version. Thank you for having included my code to your mainstream at that time. As a win32 regular programmer I always check that my code is as close as possible as that of the main win32 stream for PC. I am writing you today to point out a critical bug that prevent stunnel 4.34 from servicing any service at all . I have fixed that bug and will send you a refresh of all the sources (that needed some after some win32 PC version updates) soon. SO DO NOT DO ANYTHING. the bug is in sthread.c: the wince _beginthread port has been modified (by someone else but me) as this : v434: handle=CreateThread(NULL, stack_size, (LPTHREAD_START_ROUTINE)start_address, arglist, STACK_SIZE_PARAM_IS_A_RESERVATION, &thread_id); the "STACK_SIZE_PARAM_IS_A_RESERVATION" flag is the novelty from 4.27. The problem is that beginthread is being called from gui.c with stacksize=0 SO THAT a stack of 0 size "TRIES to be RESERVED" and then CreateThread FAILS to return a valid handle. That is to say that no thread is created, and thus NO TUNNELING SERVICE at all can be delivered. So stunnel cannot work at all. Solution : the proper call is : handle=CreateThread(NULL, stack_size, (LPTHREAD_START_ROUTINE)start_address, arglist, (stack_size > 0) ? STACK_SIZE_PARAM_IS_A_RESERVATION:0, &thread_id); I repeat and insist : please DO NOT DO anything to the code, as I will send soon a refresh with various other updates (because apart from that critical bug, the code needs other refresh to compile properly), and as I am also working on a refresh of openssl up to 1.0.0a (those gentlemen at openssl never included any wce patch to their mainstream, which is really a pity, but another story). See you soon, Thank you again for all the work you do for the community of people, Pierre

2 4

stunnel v4.32 & mac v10.6.3
by Cherry Ngai 25 Sep '10

25 Sep '10

Hello, I am new to stunnel. My stunnel v4.32 is installed to my mac v10.6.3 using MacPort. I am trying to setup active directory, but there is no process start when i run sudo /opt/local/bin/stunnel /opt/local/etc/stunnel/stunnel.conf There is no error msg after i run the command. I believe it could have something to do with my configuration? Having it running in debug mode, I can't find the created output file. Could someone help me? Or tell me where i can find the output file? Thanks! Stunnel seems successfully installed, as it has returned the following with the command "sudo stunnel -version" stunnel 4.32 on i686-apple-darwin10.3.0 with OpenSSL 1.0.0a 1 Jun 2010 Threading:PTHREAD SSL:ENGINE Sockets:SELECT,IPv6 Auth:LIBWRAP Global options debug = daemon.notice pid = /opt/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /opt/local/etc/stunnel/stunnel.pem ciphers = ALL:!aNULL:!eNULL:!SSLv2 session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none Here is my config: cert = /opt/local/etc/stunnel/stunnel.pem key = /opt/local/etc/stunnel/stunnel.pem sslVersion = SSLv3 chroot = /opt/local/var/lib/stunnel/ setuid = nobody setgid = nogroup pid = /stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = stunnel.log client = yes [ActiveDirectory1] accept = 391 connect = SOME_IP:636 Cheers, Cherry

1 0

Target version/timeframe for drawing identity certs from Windows cert store?
by Bucci, David G 22 Sep '10

22 Sep '10

Hi - in an exchange last week, Michal, it sounded like you might be planning on adding the capability/option to the Windows version to select an identity certificate from the Windows certificate store (because it turns out OpenSSL added some supporting infrastructure for doing so, if I understood correctly). For planning purposes, do you have any sense yet of whether that's really going to happen, and in what timeframe or what target version? I think that'd be a change of high interest to a lot of people ... one suggestion, it would help integrators if there was a way to configure a msg into whatever selection dialog that comes up, asking the user to select a certificate from their identity store. Thinking out loud -- probably also, in the case where multiple client tunnels are being set up, a way to make it either a global selection (for all client services), or a service specific selection -- hmm, though global only is probably fine, thinking about, since an integrator could always create a 2nd config, if a 2nd tunnel is needed Thinking further, you would probably want to be careful that it would work early on during login, since I imagine like us, integrators would want to start it from a user's Startup folder, or from a login script. I don't know Windows well enough to know if that constrains you (if the window mgr is up during login script exec, etc.). Thx! ---- David G. Bucci If you can't think of anything kind to say, could you at least have the decency to be vague?

1 0

Server side logging, no connection details logged
by Bucci, David G 22 Sep '10

22 Sep '10

Hi - using Stunnel to enforce client certificate based authentication, and as part of that, we want to log accesses, and the CN used to access, on the server side (kind of an audit log). On the client side, with debug set to 7, we get details about the connection, the SSL steps in the handshake, etc. - but on the server side, even with debug = 7, we're not seeing any info at all about the connections that are occurring. Sooo ... is there a way to enable such logging on the server side of the tunnel? Or possibly turn on independent logging in the OpenSSL libs that are used? I looked, but haven't found anything online about this. Thx! ---- David G. Bucci If you can't say anything nice, at least have the decency to be vague.

1 2

FIPS compliance
by Bucci, David G 21 Sep '10

21 Sep '10

The documentation on fips= seems ambiguous to me ... does leaving it at the default of "yes" /prevent/ FIPS 140-2 compliance mode, or mandate it? Or does it do something else I'm not understanding? Basically, the q. is, what do you have to configure to ensure that you're operating in a FIPS 140-2 compliant manner (at least, as the version of OpenSSL libs bundled understood it)? Do you have to specify ciphers that are validated, etc.? Or just set that config option to "yes" ("no"?)? And how can one tell if the stunnel binary in use was compiled with FIPS support active? (I'm using the Windows 4.33 binary d/l'ed from mirt.net) Tia! ---- David G. Bucci Chuck Norris can kick through all 6 degrees of separation, hitting anyone, anywhere, in the face, at any time. -- ChuckNorrisFacts.com

2 1