- stunnel-users - stunnel.org

SSL_read: 1408F455: error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac problem
by Maddalena.Pulcini＠seleniacomms.com 15 Mar '05

15 Mar '05

Hi, someone could help me? I am using stunnel (4.07) as ssl client to do telnet to my router with ssl server (openssl 0.9.7d). Stunnel is configured in this way: ========================== client = yes debug=7 cert=clcert.pem [telnet] accept = 23 connect = 10.36.3.144:4433 ========================== My router's configuration is: ========================== -Verify 4 -cert cert.pem ========================== The exchange of packets: ========================== client sends=======> Client Hello server sends======> Server Hello,Certificate, Certificate Request,Server Hello Done client sends======> Certificate, Client Key Exchange, Certificate Verify, Change Cipher Spec, Encrypted Handshake Message server sends=====> Change Cipher Spec, Encrypted Handshake Message and then Application Data. After sending a number of Application Data by the server, client sends Encrypted Alert and closes the connection. Having debug on stunnel client I can see: >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> 2005.03.15 11:13:44 LOG5[2040:3964]: stunnel 4.07 on x86-pc-mingw32-gnu WIN32+IPv6 with OpenSSL 0.9.8-dev XX xxx XXXX 2005.03.15 11:13:44 LOG7[2040:2376]: Snagged 64 random bytes from C:/.rnd 2005.03.15 11:13:44 LOG7[2040:2376]: Wrote 1024 new random bytes to C:/.rnd 2005.03.15 11:13:44 LOG7[2040:2376]: RAND_status claims sufficient entropy for the PRNG 2005.03.15 11:13:44 LOG6[2040:2376]: PRNG seeded successfully 2005.03.15 11:13:44 LOG7[2040:2376]: Certificate: clcert.pem 2005.03.15 11:13:44 LOG7[2040:2376]: Key file: clcert.pem 2005.03.15 11:13:44 LOG5[2040:2376]: No limit detected for the number of clients 2005.03.15 11:13:44 LOG7[2040:2376]: FD 188 in non-blocking mode 2005.03.15 11:13:44 LOG7[2040:2376]: SO_REUSEADDR option set on accept socket 2005.03.15 11:13:44 LOG7[2040:2376]: telnet bound to 0.0.0.0:23 2005.03.15 11:13:54 LOG7[2040:2376]: telnet accepted FD=192 from 127.0.0.1:1589 2005.03.15 11:13:54 LOG7[2040:2376]: FD 192 in non-blocking mode 2005.03.15 11:13:54 LOG7[2040:2376]: Creating a new thread 2005.03.15 11:13:54 LOG7[2040:2376]: New thread created 2005.03.15 11:13:54 LOG7[2040:3588]: telnet started 2005.03.15 11:13:54 LOG5[2040:3588]: telnet connected from 127.0.0.1:1589 2005.03.15 11:13:54 LOG7[2040:3588]: FD 224 in non-blocking mode 2005.03.15 11:13:54 LOG7[2040:3588]: telnet connecting 10.36.3.144:4433 2005.03.15 11:13:54 LOG7[2040:3588]: connect_wait: waiting 10 seconds 2005.03.15 11:13:54 LOG7[2040:3588]: connect_wait: connected 2005.03.15 11:13:54 LOG7[2040:3588]: Remote FD=224 initialized 2005.03.15 11:13:54 LOG7[2040:3588]: SSL state (connect): before/connect initialization 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write client hello A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server hello A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server certificate A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server certificate request A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server done A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write client certificate A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write client key exchange A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write certificate verify A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write change cipher spec A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write finished A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 flush data 2005.03.15 11:14:26 LOG7[2040:3588]: SSL state (connect): SSLv3 read finished A 2005.03.15 11:14:26 LOG7[2040:3588]: 1 items in the session cache 2005.03.15 11:14:26 LOG7[2040:3588]: 1 client connects (SSL_connect()) 2005.03.15 11:14:26 LOG7[2040:3588]: 1 client connects that finished 2005.03.15 11:14:26 LOG7[2040:3588]: 0 client renegotiatations requested 2005.03.15 11:14:26 LOG7[2040:3588]: 0 server connects (SSL_accept()) 2005.03.15 11:14:26 LOG7[2040:3588]: 0 server connects that finished 2005.03.15 11:14:26 LOG7[2040:3588]: 0 server renegotiatiations requested 2005.03.15 11:14:26 LOG7[2040:3588]: 0 session cache hits 2005.03.15 11:14:26 LOG7[2040:3588]: 0 session cache misses 2005.03.15 11:14:26 LOG7[2040:3588]: 0 session cache timeouts 2005.03.15 11:14:26 LOG6[2040:3588]: SSL connected: new session negotiated 2005.03.15 11:14:26 LOG6[2040:3588]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.03.15 11:14:41 LOG7[2040:3588]: SSL alert (write): fatal: bad record mac 2005.03.15 11:14:41 LOG3[2040:3588]: SSL_read: 1408F455: error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2005.03.15 11:14:41 LOG5[2040:3588]: Connection reset: 17 bytes sent to SSL, 190 bytes sent to socket 2005.03.15 11:14:41 LOG7[2040:3588]: telnet finished (0 left) >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> This client is now running using an updated library: libeay32.dll obtained compiling openssl-SNAP-20050304 that seemed to be the solution of the problem (after searching on Internet I deduce that). Not having solution to the problem, I know that my conclusion is not right. So if someone knows how to procede, please help me. Thanks&Regards Maddalena Pulcini

1 0

SSL_read: 1408F455: error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac problem
by Maddalena.Pulcini＠seleniacomms.com 15 Mar '05

15 Mar '05

Hi, someone could help me? I am using stunnel (4.07) as ssl client to do telnet to my router with ssl server (openssl 0.9.7d). Stunnel is configured in this way: ========================== client = yes debug=7 cert=clcert.pem [telnet] accept = 23 connect = 10.36.3.144:4433 ========================== My router's configuration is: ========================== -Verify 4 -cert cert.pem ========================== The exchange of packets: ========================== client sends=======> Client Hello server sends======> Server Hello,Certificate, Certificate Request,Server Hello Done client sends======> Certificate, Client Key Exchange, Certificate Verify, Change Cipher Spec, Encrypted Handshake Message server sends=====> Change Cipher Spec, Encrypted Handshake Message and then Application Data. After sending a number of Application Data by the server, client sends Encrypted Alert and closes the connection. Having debug on stunnel client I can see: >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> 2005.03.15 11:13:44 LOG5[2040:3964]: stunnel 4.07 on x86-pc-mingw32-gnu WIN32+IPv6 with OpenSSL 0.9.8-dev XX xxx XXXX 2005.03.15 11:13:44 LOG7[2040:2376]: Snagged 64 random bytes from C:/.rnd 2005.03.15 11:13:44 LOG7[2040:2376]: Wrote 1024 new random bytes to C:/.rnd 2005.03.15 11:13:44 LOG7[2040:2376]: RAND_status claims sufficient entropy for the PRNG 2005.03.15 11:13:44 LOG6[2040:2376]: PRNG seeded successfully 2005.03.15 11:13:44 LOG7[2040:2376]: Certificate: clcert.pem 2005.03.15 11:13:44 LOG7[2040:2376]: Key file: clcert.pem 2005.03.15 11:13:44 LOG5[2040:2376]: No limit detected for the number of clients 2005.03.15 11:13:44 LOG7[2040:2376]: FD 188 in non-blocking mode 2005.03.15 11:13:44 LOG7[2040:2376]: SO_REUSEADDR option set on accept socket 2005.03.15 11:13:44 LOG7[2040:2376]: telnet bound to 0.0.0.0:23 2005.03.15 11:13:54 LOG7[2040:2376]: telnet accepted FD=192 from 127.0.0.1:1589 2005.03.15 11:13:54 LOG7[2040:2376]: FD 192 in non-blocking mode 2005.03.15 11:13:54 LOG7[2040:2376]: Creating a new thread 2005.03.15 11:13:54 LOG7[2040:2376]: New thread created 2005.03.15 11:13:54 LOG7[2040:3588]: telnet started 2005.03.15 11:13:54 LOG5[2040:3588]: telnet connected from 127.0.0.1:1589 2005.03.15 11:13:54 LOG7[2040:3588]: FD 224 in non-blocking mode 2005.03.15 11:13:54 LOG7[2040:3588]: telnet connecting 10.36.3.144:4433 2005.03.15 11:13:54 LOG7[2040:3588]: connect_wait: waiting 10 seconds 2005.03.15 11:13:54 LOG7[2040:3588]: connect_wait: connected 2005.03.15 11:13:54 LOG7[2040:3588]: Remote FD=224 initialized 2005.03.15 11:13:54 LOG7[2040:3588]: SSL state (connect): before/connect initialization 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write client hello A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server hello A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server certificate A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server certificate request A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 read server done A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write client certificate A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write client key exchange A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write certificate verify A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write change cipher spec A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 write finished A 2005.03.15 11:13:55 LOG7[2040:3588]: SSL state (connect): SSLv3 flush data 2005.03.15 11:14:26 LOG7[2040:3588]: SSL state (connect): SSLv3 read finished A 2005.03.15 11:14:26 LOG7[2040:3588]: 1 items in the session cache 2005.03.15 11:14:26 LOG7[2040:3588]: 1 client connects (SSL_connect()) 2005.03.15 11:14:26 LOG7[2040:3588]: 1 client connects that finished 2005.03.15 11:14:26 LOG7[2040:3588]: 0 client renegotiatations requested 2005.03.15 11:14:26 LOG7[2040:3588]: 0 server connects (SSL_accept()) 2005.03.15 11:14:26 LOG7[2040:3588]: 0 server connects that finished 2005.03.15 11:14:26 LOG7[2040:3588]: 0 server renegotiatiations requested 2005.03.15 11:14:26 LOG7[2040:3588]: 0 session cache hits 2005.03.15 11:14:26 LOG7[2040:3588]: 0 session cache misses 2005.03.15 11:14:26 LOG7[2040:3588]: 0 session cache timeouts 2005.03.15 11:14:26 LOG6[2040:3588]: SSL connected: new session negotiated 2005.03.15 11:14:26 LOG6[2040:3588]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2005.03.15 11:14:41 LOG7[2040:3588]: SSL alert (write): fatal: bad record mac 2005.03.15 11:14:41 LOG3[2040:3588]: SSL_read: 1408F455: error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac 2005.03.15 11:14:41 LOG5[2040:3588]: Connection reset: 17 bytes sent to SSL, 190 bytes sent to socket 2005.03.15 11:14:41 LOG7[2040:3588]: telnet finished (0 left) >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> This client is now running using an updated library: libeay32.dll obtained compiling openssl-SNAP-20050304 that seemed to be the solution of the problem (after searching on Internet I deduce that). Not having solution to the problem, I know that my conclusion is not right. So if someone knows how to procede, please help me. Thanks&Regards Maddalena Pulcini

1 0

Problem using Stunnell with Macromedia Communication Server MX
by Miguel Nisembaum 14 Mar '05

14 Mar '05

Hi My name is Miguel from Brazil I need to know if anyone has ever configured Stunnel with Macromedia Flash Communication Server. If anyone has can you tell me something about it I’m new to Stunnel so if anyone can please help me it would be great. Thanks Miguel -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.308 / Virus Database: 266.7.2 - Release Date: 11/3/2005

1 0

Radius over Stunnel??
by Frazer, Andrew non Unisys 08 Mar '05

08 Mar '05

Hello all.. I would like to pass radius over stunnel, but I'm not sure if this will work... I have a lot of 'client's that are using RADIUS for authentication, but i want to pass the data over the internet, and radius is relatively insecure. My client machines also run a web server, which stunnel sits in front of, to provide ssl encrypted web services. My radius servers can easily run stunnel, without any issue. Could someone suggest a configuration for this??

3 2

syslog question
by Brian T 04 Mar '05

04 Mar '05

If debug=4 ( or not 0 ) and output= is commented in an stunnel config, it looks like in server mode, messages goto syslog. But in client mode, nothing goes to syslog. Is this the way it's supposed to be? -Brian

1 0

Re: [stunnel-users] long delay to close the ssl session ?
by ikeda＠areabe 04 Mar '05

04 Mar '05

If TIMEOUTclose value is positive, stunnel does not transmit TCP FIN, even though application sends TCP FIN, until timeout time expires I don't know why stunnel designer chose it, maybe because of the performance, or some others. Some of the browsers do not start to display the page until receiving the entire packet. And one of the trigger for the browser to detect to receive the whole is TCP FIN. From that things, such kind of the problem of yours occurs. regards taka On Fri, 4 Mar 2005 10:39:47 -0800 (PST), gary ng <garyng2000(a)yahoo.com> wrote: > Thanks, that did the trick. Just wonder why the > document said this is needed for MSIE while I was > using firefox. Seems to be more like a Window(I > believe even firefox relis on the underlying socket > library) than simply MSIE. > > --- "ikeda@areabe" <ikeda(a)areabe.com> wrote: >> add >> TIMEOUTclose = 0 >> in stunnel.conf >> >> regards >> taka >> >> > > > > > __________________________________ > Celebrate Yahoo!'s 10th Birthday! > Yahoo! Netrospective: 100 Moments of the Web > http://birthday.yahoo.com/netrospective/ >

1 0

long delay to close the ssl session ?
by gary ng 04 Mar '05

04 Mar '05

Hi, I am using stunnel to wrap SSL around SWAT. Everything works fine except that it takes a very long delay for the browser to see that the page has already been transmitted completely(in other words, the other end has closed). I observed this behaviour with both 3.x and 4.x stunnel. Looking through the log, I see that it takes exactly one minute from the start of the session till the session is closed, seems to be some parameter within stunnel to hold the session. I tried both inetd as well as stand alone stunnel mode and both behave the same as well. Is this an issue with SWAT or stunnel ? If I just use plain SWAT through inetd, I don't see this behaviour. thanks for any help in advance. gary __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

compilation errors
by Greg Matthews 03 Mar '05

03 Mar '05

Anyone here managed to build stunnel for Irix? it seems socklen_t is undefined as a type on this OS (and also older versions of solaris). I have found a possible solution here: http://sprg.ssl.berkeley.edu/~fastops/ITOS/portable/socklen$_t.html but I need to know what type this identifier is supposed to be. any help? GREG -- Greg Matthews iTSS Wallingford 01491 692445

2 4

Naive question: will stunnel connect dynamically?
by Duncan Murdoch 02 Mar '05

02 Mar '05

I currently use openssh to open a tunnel between my laptop and my POP3 server, but the tunnel keeps locking up. (I think it's a server problem, or an intermittent line problem, because it happens with both openssh and Putty.) What I'd like is a program that would open the tunnel only as needed, so I can get the mail, and let the tunnel close. Can stunnel do this? More generally, is there a quick summary somewhere on the relative benefits of stunnel's use of SSL versus an SSH approach? Duncan Murdoch

1 0

Windows XP Pro as a client of Remote Dekstop via stunnel
by Jacek Baszkiewicz 02 Mar '05

02 Mar '05

Hi! I'm currently working (without success) on such problem: I have to connect via Stunnel to Windows Server Remote Desktop from workstation with Windows XP Proffesional. When I refer to the local port handled by stunnel, Windows doesn't let me go go further, because it thinks that I'm trying to use local Remote Dekstop and prints: "You are already connected to this machine" (there can be only one connection through RD) . Is there any workaround for this problem, namely, to use secure connection via Stunnel to Remote Dekstop on XP Pro client? This is my config: client=yes cert = stunnel.pem [ts] accept=localhost:3389 connect=remote_ip:443

5 4