stunnel-users October 2005

32 participants
34 discussions

stunnel 4.x.x and IRIX
by Eric Haddix 31 Jan '06

31 Jan '06

I happened upon a user here that posted a couple of months ago(I think) who used IRIX and had successfully compiled stunnel. Any chance you're still around!?!? I get one of two things. Before I apply the patch, it will crash right after startup. No logs, just dumps core. After the patch, it starts and exits immediately. I can run it with -version, etc. and it seems to work fine. Anyone had this and/or know what can be done? Eric

3 10

Stunnel Session Hangs
by Zachariah K Zachariah 18 Nov '05

18 Nov '05

Hi folks, I use stunnel-4.12 with openssl-0.9.7g to tunnel my CVS-pserver protocols. I have set up the local stunnel client to listen to port 22400 and to forward any connections on it to the cvs server that has the server side stunnel listening on port 22401 forwarding connections to the cvs-pserver on port 2401. Having set up thus, I can do a cvs login just fine. I can watch the negotiation happening using tcpdump. However when I try to check out a module from the repository, I see some files coming through but only to eventually hang. If I <Ctrl C> and try again, more files come in but hangs before the transaction is complete. I have to do this several time in order to download all the files to my local workspace. Upon checking the logs, I find that the hang occurs immediately after the message: 2005.10.28 14:21:53 LOG7[15095:67]: SSL_read returned WANT_READ: retrying 2005.10.28 14:21:53 LOG7[15095:67]: SSL_write returned WANT_WRITE: retrying 2005.10.28 14:21:53 LOG7[15095:67]: SSL_read returned WANT_READ: retrying I have included a snippet of the log file for reference. I have also included my stunnel.conf file. Sorry for the voluminous output. Can some one help me here? Thanks in advance. -ZZ ===============================STUNNEL.LOG================================== The full log file reads: 2005.10.28 14:20:44 LOG6[15095:64]: SSL accepted: previous session reused 2005.10.28 14:20:44 LOG7[15095:64]: FD 1 in non-blocking mode 2005.10.28 14:20:44 LOG7[15095:64]: smd-pserver connecting 127.0.0.1:2401 2005.10.28 14:20:44 LOG7[15095:64]: Remote FD=1 initialized 2005.10.28 14:20:44 LOG7[15095:64]: SSL_read returned WANT_READ: retrying 2005.10.28 14:20:44 LOG7[15095:64]: SSL_write returned WANT_WRITE: retrying 2005.10.28 14:20:44 LOG7[15095:64]: SSL_read returned WANT_READ: retrying 2005.10.28 14:20:50 LOG7[15095:64]: SSL alert (read): warning: close notify 2005.10.28 14:20:50 LOG7[15095:64]: SSL closed on SSL_read 2005.10.28 14:20:50 LOG7[15095:64]: Socket write shutdown 2005.10.28 14:20:50 LOG7[15095:64]: SSL write shutdown 2005.10.28 14:20:50 LOG7[15095:64]: SSL alert (write): warning: close notify 2005.10.28 14:20:50 LOG6[15095:64]: SSL_shutdown successfully sent close_notify 2005.10.28 14:20:50 LOG5[15095:64]: Connection closed: 73224 bytes sent to SSL, 4724 bytes sent to socket 2005.10.28 14:20:50 LOG7[15095:64]: smd-pserver finished (0 left) 2005.10.28 14:20:50 LOG5[15095:64]: stack_info: size=65536, current=5004 (7%), maximum=5004 (7%) 2005.10.28 14:20:50 LOG7[15095:64]: Context 64 closed 2005.10.28 14:20:51 LOG7[15095:1]: Context set: 64 (dropped) -> 1 2005.10.28 14:20:51 LOG7[15095:1]: Current context: 1 2005.10.28 14:20:51 LOG7[15095:1]: Releasing context 64 2005.10.28 14:20:51 LOG7[15095:1]: smd-pserver accepted FD=0 from 171.65.79.143:65521 2005.10.28 14:20:51 LOG7[15095:1]: Creating a new context 2005.10.28 14:20:51 LOG7[15095:1]: Context 65 created 2005.10.28 14:20:51 LOG7[15095:65]: Context swap: 1 -> 65 2005.10.28 14:20:51 LOG7[15095:65]: smd-pserver started 2005.10.28 14:20:51 LOG7[15095:65]: FD 0 in non-blocking mode 2005.10.28 14:20:51 LOG5[15095:65]: smd-pserver connected from 171.65.79.143:65521 2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): before/accept initialization 2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): SSLv3 read client hello A 2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): SSLv3 write server hello A 2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): SSLv3 write change cipher spec A 2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): SSLv3 write finished A 2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): SSLv3 flush data 2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): SSLv3 read finished A 2005.10.28 14:20:51 LOG7[15095:65]: 6 items in the session cache 2005.10.28 14:20:51 LOG7[15095:65]: 0 client connects (SSL_connect()) 2005.10.28 14:20:51 LOG7[15095:65]: 0 client connects that finished 2005.10.28 14:20:51 LOG7[15095:65]: 0 client renegotiatations requested 2005.10.28 14:20:51 LOG7[15095:65]: 64 server connects (SSL_accept()) 2005.10.28 14:20:51 LOG7[15095:65]: 55 server connects that finished 2005.10.28 14:20:51 LOG7[15095:65]: 0 server renegotiatiations requested 2005.10.28 14:20:51 LOG7[15095:65]: 38 session cache hits 2005.10.28 14:20:51 LOG7[15095:65]: 0 session cache misses 2005.10.28 14:20:51 LOG7[15095:65]: 11 session cache timeouts 2005.10.28 14:20:51 LOG6[15095:65]: SSL accepted: previous session reused 2005.10.28 14:20:51 LOG7[15095:65]: FD 1 in non-blocking mode 2005.10.28 14:20:51 LOG7[15095:65]: smd-pserver connecting 127.0.0.1:2401 2005.10.28 14:20:51 LOG7[15095:65]: Remote FD=1 initialized 2005.10.28 14:20:51 LOG7[15095:65]: SSL_read returned WANT_READ: retrying 2005.10.28 14:20:51 LOG7[15095:65]: SSL_write returned WANT_WRITE: retrying 2005.10.28 14:20:51 LOG7[15095:65]: SSL_read returned WANT_READ: retrying 2005.10.28 14:20:57 LOG7[15095:65]: SSL alert (read): warning: close notify 2005.10.28 14:20:57 LOG7[15095:65]: SSL closed on SSL_read 2005.10.28 14:20:57 LOG7[15095:65]: Socket write shutdown 2005.10.28 14:20:57 LOG7[15095:65]: SSL write shutdown 2005.10.28 14:20:57 LOG7[15095:65]: SSL alert (write): warning: close notify 2005.10.28 14:20:57 LOG6[15095:65]: SSL_shutdown successfully sent close_notify 2005.10.28 14:20:57 LOG5[15095:65]: Connection closed: 73224 bytes sent to SSL, 4724 bytes sent to socket 2005.10.28 14:20:57 LOG7[15095:65]: smd-pserver finished (0 left) 2005.10.28 14:20:57 LOG5[15095:65]: stack_info: size=65536, current=5004 (7%), maximum=5004 (7%) 2005.10.28 14:20:57 LOG7[15095:65]: Context 65 closed 2005.10.28 14:20:58 LOG7[15095:1]: Context set: 65 (dropped) -> 1 2005.10.28 14:20:58 LOG7[15095:1]: Current context: 1 2005.10.28 14:20:58 LOG7[15095:1]: Releasing context 65 2005.10.28 14:20:58 LOG7[15095:1]: smd-pserver accepted FD=0 from 171.65.79.143:65523 2005.10.28 14:20:58 LOG7[15095:1]: Creating a new context 2005.10.28 14:20:58 LOG7[15095:1]: Context 66 created 2005.10.28 14:20:58 LOG7[15095:66]: Context swap: 1 -> 66 2005.10.28 14:20:58 LOG7[15095:66]: smd-pserver started 2005.10.28 14:20:58 LOG7[15095:66]: FD 0 in non-blocking mode 2005.10.28 14:20:58 LOG5[15095:66]: smd-pserver connected from 171.65.79.143:65523 2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): before/accept initialization 2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): SSLv3 read client hello A 2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): SSLv3 write server hello A 2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): SSLv3 write change cipher spec A 2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): SSLv3 write finished A 2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): SSLv3 flush data 2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): SSLv3 read finished A 2005.10.28 14:20:58 LOG7[15095:66]: 6 items in the session cache 2005.10.28 14:20:58 LOG7[15095:66]: 0 client connects (SSL_connect()) 2005.10.28 14:20:58 LOG7[15095:66]: 0 client connects that finished 2005.10.28 14:20:58 LOG7[15095:66]: 0 client renegotiatations requested 2005.10.28 14:20:58 LOG7[15095:66]: 65 server connects (SSL_accept()) 2005.10.28 14:20:58 LOG7[15095:66]: 56 server connects that finished 2005.10.28 14:20:58 LOG7[15095:66]: 0 server renegotiatiations requested 2005.10.28 14:20:58 LOG7[15095:66]: 39 session cache hits 2005.10.28 14:20:58 LOG7[15095:66]: 0 session cache misses 2005.10.28 14:20:58 LOG7[15095:66]: 11 session cache timeouts 2005.10.28 14:20:58 LOG6[15095:66]: SSL accepted: previous session reused 2005.10.28 14:20:58 LOG7[15095:66]: FD 1 in non-blocking mode 2005.10.28 14:20:58 LOG7[15095:66]: smd-pserver connecting 127.0.0.1:2401 2005.10.28 14:20:58 LOG7[15095:66]: Remote FD=1 initialized 2005.10.28 14:20:58 LOG7[15095:66]: SSL_read returned WANT_READ: retrying 2005.10.28 14:20:58 LOG7[15095:66]: SSL_write returned WANT_WRITE: retrying 2005.10.28 14:20:58 LOG7[15095:66]: SSL_read returned WANT_READ: retrying 2005.10.28 14:21:50 LOG7[15095:66]: SSL alert (read): warning: close notify 2005.10.28 14:21:50 LOG7[15095:66]: SSL closed on SSL_read 2005.10.28 14:21:50 LOG7[15095:66]: Socket write shutdown 2005.10.28 14:21:50 LOG7[15095:66]: SSL write shutdown 2005.10.28 14:21:50 LOG7[15095:66]: SSL alert (write): warning: close notify 2005.10.28 14:21:50 LOG6[15095:66]: SSL_shutdown successfully sent close_notify 2005.10.28 14:21:50 LOG5[15095:66]: Connection closed: 73224 bytes sent to SSL, 4724 bytes sent to socket 2005.10.28 14:21:50 LOG7[15095:66]: smd-pserver finished (0 left) 2005.10.28 14:21:50 LOG5[15095:66]: stack_info: size=65536, current=5004 (7%), maximum=5004 (7%) 2005.10.28 14:21:50 LOG7[15095:66]: Context 66 closed 2005.10.28 14:21:52 LOG7[15095:1]: Context set: 66 (dropped) -> 1 2005.10.28 14:21:52 LOG7[15095:1]: Current context: 1 2005.10.28 14:21:52 LOG7[15095:1]: Releasing context 66 2005.10.28 14:21:52 LOG7[15095:1]: smd-pserver accepted FD=0 from 171.65.79.143:65525 2005.10.28 14:21:52 LOG7[15095:1]: Creating a new context 2005.10.28 14:21:52 LOG7[15095:1]: Context 67 created 2005.10.28 14:21:52 LOG7[15095:67]: Context swap: 1 -> 67 2005.10.28 14:21:52 LOG7[15095:67]: smd-pserver started 2005.10.28 14:21:52 LOG7[15095:67]: FD 0 in non-blocking mode 2005.10.28 14:21:52 LOG5[15095:67]: smd-pserver connected from 171.65.79.143:65525 2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): before/accept initialization 2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): SSLv3 read client hello A 2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): SSLv3 write server hello A 2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): SSLv3 write change cipher spec A 2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): SSLv3 write finished A 2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): SSLv3 flush data 2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): SSLv3 read finished A 2005.10.28 14:21:52 LOG7[15095:67]: 6 items in the session cache 2005.10.28 14:21:52 LOG7[15095:67]: 0 client connects (SSL_connect()) 2005.10.28 14:21:52 LOG7[15095:67]: 0 client connects that finished 2005.10.28 14:21:52 LOG7[15095:67]: 0 client renegotiatations requested 2005.10.28 14:21:52 LOG7[15095:67]: 66 server connects (SSL_accept()) 2005.10.28 14:21:52 LOG7[15095:67]: 57 server connects that finished 2005.10.28 14:21:52 LOG7[15095:67]: 0 server renegotiatiations requested 2005.10.28 14:21:52 LOG7[15095:67]: 40 session cache hits 2005.10.28 14:21:52 LOG7[15095:67]: 0 session cache misses 2005.10.28 14:21:52 LOG7[15095:67]: 11 session cache timeouts 2005.10.28 14:21:52 LOG6[15095:67]: SSL accepted: previous session reused 2005.10.28 14:21:52 LOG7[15095:67]: FD 1 in non-blocking mode 2005.10.28 14:21:52 LOG7[15095:67]: smd-pserver connecting 127.0.0.1:2401 2005.10.28 14:21:52 LOG7[15095:67]: Remote FD=1 initialized 2005.10.28 14:21:53 LOG7[15095:67]: SSL_read returned WANT_READ: retrying 2005.10.28 14:21:53 LOG7[15095:67]: SSL_write returned WANT_WRITE: retrying 2005.10.28 14:21:53 LOG7[15095:67]: SSL_read returned WANT_READ: retrying ========================================================================== =========================STUNNEL.CONF====================================== ; Sample stunnel configuration file by Michal Trojnara 2002-2005 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ;Delay DNS Lookups delay = yes ; Certificate/key is needed in server mode and optional in client mode cert = /tools/stunnel/4.12/etc/stunnel/stunnel.pem ;key = /tools/stunnel/4.12/etc/stunnel/mail.pem ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /tools/stunnel/4.12/var/stunnel/ setuid = cvsadmin setgid = cvs ; PID is created inside chroot jail pid = /stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath; CApath is located inside chroot jail: ;CApath = /certs ; It's often easier to use CAfile: ;CAfile = /tools/stunnel/4.12/etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath; CRLpath is located inside chroot jail: ;CRLpath = /crls ; Alternatively you can use CRLfile: ;CRLfile = /tools/stunnel/4.12/etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = /tools/stunnel/current/var/stunnel/stunnel.log ; Use it for client mode ;client = yes ; Service-level configuration ;[pop3s] ;accept = 995 ;connect = 110 ;[imaps] ;accept = 993 ;connect = 143 ;[ssmtp] ;accept = 465 ;connect = 25 [pserver] accept = 22401 connect = 2401 TIMEOUTclose = 30 ; vim:ft=dosini

3 3

4.14b1+0.9.7i client loop in s_poll_wait/scan_waiting_queue
by Richard.Hall 30 Oct '05

30 Oct '05

Obviously stunnel problems are like London buses - you wait years for one, then two come along inside a week ;-) Having fixed my server-side problems by installing 4.14b1, I now have a problem on the client side. Apologies for the voluminous diagnostics below, but hopefully they will help make the problem clear. I am running Apache + mod_jk, stunneling to a remote JBoss server. The client is stunnel 4.14 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7i 14 Oct 2005 When things are running normally, everything is sweetness and light. However, if I 'kill -HUP' the Apache server (eg to do a log rotation), the mod_jk connection to stunnel gets closed, and stunnel goes into a loop. If I enable DEBUG_UCONTEXT in network.c, and add a few lines of diagnostics:- $ diff -c network.c.orig network.c.loop *** network.c.orig Thu Oct 20 08:37:47 2005 --- network.c.loop Thu Oct 27 13:07:10 2005 *************** *** 31,37 **** #include "common.h" #include "prototypes.h" ! /* #define DEBUG_UCONTEXT */ #ifndef USE_WIN32 static int signal_pipe[2]={-1, -1}; --- 31,37 ---- #include "common.h" #include "prototypes.h" ! #define DEBUG_UCONTEXT #ifndef USE_WIN32 static int signal_pipe[2]={-1, -1}; *************** *** 156,167 **** for(i=0; i<ctx->fds->nfds; i++) { ctx->fds->ufds[i].revents=ufds[nfds].revents; #ifdef DEBUG_UCONTEXT ! s_log(LOG_DEBUG, "CONTEXT %ld, FD=%d, (%s%s)->(%s%s)", ctx->id, ufds[nfds].fd, ufds[nfds].events & POLLIN ? "IN" : "", ufds[nfds].events & POLLOUT ? "OUT" : "", ufds[nfds].revents & POLLIN ? "IN" : "", ! ufds[nfds].revents & POLLOUT ? "OUT" : ""); #endif if(ufds[nfds].revents & (POLLIN|POLLOUT)) ctx->ready++; --- 156,170 ---- for(i=0; i<ctx->fds->nfds; i++) { ctx->fds->ufds[i].revents=ufds[nfds].revents; #ifdef DEBUG_UCONTEXT ! s_log(LOG_DEBUG, "CONTEXT %ld, FD=%d, (%s%s)->(%s%s%s%s%s)", ctx->id, ufds[nfds].fd, ufds[nfds].events & POLLIN ? "IN" : "", ufds[nfds].events & POLLOUT ? "OUT" : "", ufds[nfds].revents & POLLIN ? "IN" : "", ! ufds[nfds].revents & POLLOUT ? "OUT" : "", ! ufds[nfds].revents & POLLERR ? "ERR" : "", ! ufds[nfds].revents & POLLHUP ? "HUP" : "", ! ufds[nfds].revents & POLLNVAL ? "NVAL" : ""); #endif if(ufds[nfds].revents & (POLLIN|POLLOUT)) ctx->ready++; I get (with fd=9 being the mod_jk socket, fd=10 the SSL one, and TIMEOUTidle set to 35 seconds for demo purposes) ... 2005.10.27 13:13:42 LOG7[1286:0]: Waiting 35 second(s) for 7 file descriptor(s) 2005.10.27 13:13:42 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:13:42 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:13:42 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:13:42 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:13:42 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:13:42 LOG7[1286:0]: CONTEXT 2, FD=9, (INOUT)->(OUT) 2005.10.27 13:13:42 LOG7[1286:0]: CONTEXT 2, FD=10, (IN)->(IN) 2005.10.27 13:13:42 LOG7[1286:2]: SSL_read returned WANT_READ: retrying 2005.10.27 13:13:42 LOG7[1286:0]: Waiting 35 second(s) for 7 file descriptor(s) 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 2, FD=9, (IN)->(IN) 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 2, FD=10, (IN)->() 2005.10.27 13:13:43 LOG7[1286:2]: Socket closed on read ... ie mod_jk has disconnected. Everything carries on for a while ... 2005.10.27 13:13:43 LOG7[1286:2]: SSL write shutdown 2005.10.27 13:13:43 LOG7[1286:0]: Waiting 60 second(s) for 6 file descriptor(s) 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:13:43 LOG7[1286:0]: CONTEXT 2, FD=10, (INOUT)->(OUT) 2005.10.27 13:13:43 LOG7[1286:2]: SSL alert (write): warning: close notify 2005.10.27 13:13:43 LOG7[1286:2]: SSL_shutdown retrying 2005.10.27 13:13:43 LOG7[1286:2]: SSL doesn't need to read or write 2005.10.27 13:13:43 LOG7[1286:0]: Waiting 60 second(s) for 6 file descriptor(s) 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 2, FD=10, (IN)->(IN) 2005.10.27 13:13:45 LOG7[1286:0]: Waiting 35 second(s) for 7 file descriptor(s) 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 2, FD=10, (IN)->() 2005.10.27 13:13:45 LOG7[1286:0]: CONTEXT 2, FD=9, (OUT)->(OUT) [...] 2005.10.27 13:13:46 LOG7[1286:0]: Waiting 60 second(s) for 6 file descriptor(s) 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 2, FD=10, (IN)->(IN) 2005.10.27 13:13:46 LOG7[1286:2]: SSL_read returned WANT_READ: retrying 2005.10.27 13:13:46 LOG7[1286:0]: Waiting 60 second(s) for 6 file descriptor(s) 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 2, FD=10, (IN)->(IN) 2005.10.27 13:13:46 LOG7[1286:0]: Waiting 35 second(s) for 7 file descriptor(s) 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 2, FD=10, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 2, FD=9, (OUT)->(ERRHUP) ... but eventually we start getting ERRHUP (ie POLLERR | POLLHUP), not OUT, on fd 9, and then we end up in a tight loop of 2005.10.27 13:13:46 LOG7[1286:0]: Waiting 35 second(s) for 7 file descriptor(s) 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 2, FD=10, (IN)->() 2005.10.27 13:13:46 LOG7[1286:0]: CONTEXT 2, FD=9, (OUT)->(ERRHUP) ... until eventually we get [...] 2005.10.27 13:14:23 LOG7[1286:0]: Waiting 2 second(s) for 6 file descriptor(s) 2005.10.27 13:14:23 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:14:23 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:14:23 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:14:23 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:14:23 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:14:25 LOG7[1286:0]: CONTEXT 2, FD=9, (OUT)->(ERRHUP) 2005.10.27 13:14:25 LOG7[1286:0]: Waiting 0 second(s) for 6 file descriptor(s) 2005.10.27 13:14:25 LOG7[1286:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:14:25 LOG7[1286:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:14:25 LOG7[1286:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:14:25 LOG7[1286:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:14:25 LOG7[1286:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:14:25 LOG7[1286:0]: CONTEXT 2, FD=9, (OUT)->(ERRHUP) 2005.10.27 13:14:25 LOG6[1286:2]: s_poll_wait timeout: connection reset 2005.10.27 13:14:25 LOG5[1286:2]: Connection reset: 260 bytes sent to SSL, 24734 bytes sent to socket The problem seems to be in network.c:s_poll_wait(), in the code while(!ready_head) /* no context ready */ scan_waiting_queue(); because poll() returns > 0, but scan_waiting_queue() never sets ready_head because no fd has yielded POLLIN or POLLOUT:- if(ufds[nfds].revents & (POLLIN|POLLOUT)) ctx->ready++; The end result is that we chew up CPU until TIMEOUTidle expires (which is rather a long time if left at the default of 12 hours!!) I have fudged a circumvention as follows (because I couldn't follow the logic well enough to do it cleanly, and time is running out on me, I'm afraid.) $ diff -c network.c.loop network.c *** network.c.loop Thu Oct 27 13:07:10 2005 --- network.c Thu Oct 27 13:05:21 2005 *************** *** 166,172 **** ufds[nfds].revents & POLLHUP ? "HUP" : "", ufds[nfds].revents & POLLNVAL ? "NVAL" : ""); #endif ! if(ufds[nfds].revents & (POLLIN|POLLOUT)) ctx->ready++; nfds++; } --- 166,172 ---- ufds[nfds].revents & POLLHUP ? "HUP" : "", ufds[nfds].revents & POLLNVAL ? "NVAL" : ""); #endif ! if(ufds[nfds].revents & (POLLIN|POLLOUT|POLLERR|POLLHUP|POLLNVAL)) ctx->ready++; nfds++; } ... which seems to solve the problem but produces a rather untidy result:- 2005.10.27 13:17:46 LOG7[1759:0]: Waiting 35 second(s) for 7 file descriptor(s) 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 2, FD=10, (IN)->(IN) 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 2, FD=9, (OUT)->(OUT) 2005.10.27 13:17:46 LOG7[1759:0]: Waiting 35 second(s) for 6 file descriptor(s) 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=3, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=5, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=6, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=7, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 1, FD=8, (IN)->() 2005.10.27 13:17:46 LOG7[1759:0]: CONTEXT 2, FD=9, (OUT)->(ERRHUP) 2005.10.27 13:17:46 LOG3[1759:2]: INTERNAL ERROR: s_poll_wait returned 1, but no descriptor is ready 2005.10.27 13:17:46 LOG5[1759:2]: Connection reset: 260 bytes sent to SSL, 41132 bytes sent to socket ... i.e it sorts itself out quickly, but at the cost of logging an INTERNAL ERROR, which doesn't look very good ;-) As far as I could tell (but haven't shown), everything actually got close'd correctly. As I say, I appear to have a circumvention, so I'm not hanging on a proper fix (unless anyone can see any fatal flaw in what I've done?) Regards, Richard

2 1

Question on config for Global Option 'output'
by Tara.L.Weaver＠wellsfargo.com 30 Oct '05

30 Oct '05

Can a file size be determined for 'output' in the config? If so, how can that be done? Or can overwrite be configured for output? STunnel version 4.09 on x86-pc-mingw32-gnu WIN32+IPv6 with OpenSSL 0.9.7e (SQL)Server config: client = no taskbar = yes CAFile = root_ca.cer ciphers = AES128-SHA cert = stunnel.pem output = d:\STunnel\STunnelLog debug=5 [FraudProd] accept = 1364 connect = 1433 Tara L. Weaver Network Analyst 2 Wells Fargo Services Contact Center System Support Office: 612\667-5795 Tara.L.Weaver(a)WellsFargo.com > This message may contain confidential and/or privileged information. > If you are not the addressee or authorized to receive this for the > addressee, you must not use, copy, disclose, or take any action based > on this message or any information herein. If you have received this > message in error, please advise the sender immediately by reply e-mail > and delete this message. Thank you for your cooperation. >

2 1

Boot Password
by Bob 30 Oct '05

30 Oct '05

I need to use signed certificates with stunnel. New to the whole certificate thing. I have the certificate and key and built the .PEM file but when I try to start stunnel in the background it asks me to enter the PEM password. How can I enter the password and have stunnel start during boot? _______________________________________________________________________ Thanks, Bob (bobif(a)yahoo.com) YahooIM: bobif AOLIM: bobifmd ICQ: 111083556

2 1

4.13+0.9.7i server stops writing SSL output
by Richard.Hall 25 Oct '05

25 Oct '05

First-time post (though long-time satisfied occasional user). Searched the archives but if there is anything relevant, I've obviously missed it. I really cannot decide if this is an stunnel problem or an OpenSSL problem. Client is remote and running stunnel 4.12 on i686-pc-linux-gnu UCONTEXT+POLL+IPv4 with OpenSSL 0.9.6i Server is local, I've been through 4.12 + 0.9.6m 4.13 + 0.9.6m and now trying stunnel 4.13 on sparc-sun-solaris2.8 UCONTEXT+POLL+IPv4 with OpenSSL 0.9.7i (I've resisted the urge to try OpenSSL 0.9.8* as people seem to be experiencing 'issues') Small amounts of data are fine. But for larger amounts the connection goes to sleep. The way I read it, the server end stops trying to write to the SSL side. The relevant parts of # truss -w2 -v poll -dl /usr/local/stunnel-4.13/sbin/stunnel look like this: (apologies for doing it like this, but it seemed the easiest way to combine the debug output and truss output) (fd=7 is the SSL side, fd=8 the local side, TIMEOUTidle is set to 35 seconds for demo purposes) /1: 15.5722 read(8, " A B\0\n03\007\t\t\r\n\t".., 8178) = 8178 /1: poll(0x00049DD8, 3, 35000) (sleeping...) /1: fd=3 ev=POLLIN rev=0 /1: fd=6 ev=POLLIN rev=0 /1: fd=7 ev=POLLIN|POLLOUT rev=POLLIN /1: 17.3166 poll(0x00049DD8, 3, 35000) = 1 /1: fd=3 ev=POLLIN rev=0 /1: fd=6 ev=POLLIN rev=0 /1: fd=7 ev=POLLIN|POLLOUT rev=POLLOUT /1: 17.3229 write(7, "1703\0\0188CBEC9 : O\t u".., 16442) = 16442 /1: 17.3234 poll(0x00049DD8, 4, 35000) = 1 /1: fd=3 ev=POLLIN rev=0 /1: fd=6 ev=POLLIN rev=0 /1: fd=8 ev=POLLIN rev=POLLIN /1: fd=7 ev=POLLIN rev=0 So far, so good. /1: 17.3238 read(8, "\t\t\t\r\n\t\t\t\r\n\t\t".., 16384) = 16384 /1: 17.3240 poll(0x00049DD8, 3, 35000) = 1 /1: fd=3 ev=POLLIN rev=0 /1: fd=6 ev=POLLIN rev=0 /1: fd=7 ev=POLLIN|POLLOUT rev=POLLOUT /1: 17.3299 write(7, "1703\0\018ED 1AD91A888 i".., 16442) = 14480 For whatever reason, the write() was only partial. I'm guessing n/w issues, as the client is a loooong way away ;-) /1: 17.3303 write(7, " fE3DDA8FE ! i8DD8\fEBEC".., 1962) Err#11 EAGAIN /1: 17.3308 write(2, 0x00071D60, 74) = 74 /1: 2 0 0 5 . 1 0 . 2 4 1 4 : 5 0 : 3 0 L O G 7 [ 2 0 6 4 7 : 2 /1: ] : S S L _ w r i t e r e t u r n e d W A N T _ W R I T E /1: : r e t r y i n g /1: 17.3312 write(2, "\n", 1) = 1 /1: 17.3315 read(7, 0x000778D8, 5) Err#11 EAGAIN /1: 17.3318 write(2, 0x00071D60, 72) = 72 /1: 2 0 0 5 . 1 0 . 2 4 1 4 : 5 0 : 3 0 L O G 7 [ 2 0 6 4 7 : 2 /1: ] : S S L _ r e a d r e t u r n e d W A N T _ R E A D : /1: r e t r y i n g /1: 17.3321 write(2, "\n", 1) = 1 So we've now done an SSL_write, which yielded SSL_ERROR_WANT_WRITE, _and_ an SSL_read, which yielded SSL_ERROR_WANT_READ, (and which I think removes the SSL_ERROR_WANT_WRITE condition, as we can only have one or the other.) This means that, the next time round the loop (in client.c:transfer()), want_rd is TRUE, want_wr is FALSE, so we don't poll the SSL connection for output, only input: /1: poll(0x00049DD8, 3, 35000) (sleeping...) /1: fd=3 ev=POLLIN rev=0 /1: fd=6 ev=POLLIN rev=0 /1: fd=7 ev=POLLIN rev=POLLOUT But there won't be any input (trust me on that!), so we time out ... /1: 52.3387 poll(0x00049DD8, 3, 35000) = 0 /1: fd=3 ev=POLLIN rev=0 /1: fd=6 ev=POLLIN rev=0 /1: fd=7 ev=POLLIN rev=0 /1: 52.3394 write(2, 0x00071D60, 72) = 72 /1: 2 0 0 5 . 1 0 . 2 4 1 4 : 5 1 : 0 5 L O G 6 [ 2 0 6 4 7 : 2 /1: ] : s _ p o l l _ w a i t t i m e o u t : c o n n e c t i /1: o n r e s e t /1: 52.3399 write(2, "\n", 1) = 1 /1: 52.3403 write(2, 0x00071DD0, 102) = 102 /1: 2 0 0 5 . 1 0 . 2 4 1 4 : 5 1 : 0 5 L O G 5 [ 2 0 6 4 7 : 2 /1: ] : C o n n e c t i o n r e s e t : 5 7 6 1 7 b y t e s /1: s e n t t o S S L , 1 3 1 b y t e s s e n t t o /1: s o c k e t Now I have never before needed (nor wanted!) to delve into the inner workings of either stunnel or OpenSSL, so I may be in completely the wrong ballpark here. But I cannot understand the logic of the following bit of code in transfer() :- if((c->sock_ptr && !want_rd) || /* socket input buffer not empty */ ssl_closing==CL_INIT /* need to send close_notify */ || ((c->ssl_ptr<BUFFSIZE || ssl_closing==CL_RETRY) && want_wr)) /* want to SSL_read or SSL_shutdown but write to the * underlying socket needed for the SSL protocol */ s_poll_add(&c->fds, c->ssl_wfd->fd, 0, 1); In particular, if I change the first line to if(c->sock_ptr || /* socket input buffer not empty */ then everything starts working (correctly as far as I can see). The OpenSSL man pages seem (to me) to say that it is perfectly permissible to call SSL_write when we have SSL_ERROR_WANT_READ. Help? TIA, Richard Hall

4 6

how to sign each pem file with the local CA
by Jonathan Carpenter 22 Oct '05

22 Oct '05

I am trying to setup stunnel to encrypt syslog-ng logs, but all the tutorials that I have found tell me to sign each pem file with the local CA I have tried to find out how in the stunnel archives but have had no luck. Can anyone help me? Thanks

1 0

Stunnel Configure Warning
by G J Piper 21 Oct '05

21 Oct '05

I was upgrading my Stunnel 4.11 to 4.13 when I saw this in the config check and decided to post it to see if I should continue installing... the config told me (obvoiously) to post this message... heh: > checking ucontext.h usability... no > checking ucontext.h presence... yes > configure: WARNING: ucontext.h: present but cannot be compiled > configure: WARNING: ucontext.h: check for missing prerequisite headers? > configure: WARNING: ucontext.h: see the Autoconf documentation > configure: WARNING: ucontext.h: section "Present But Cannot Be Compiled" > configure: WARNING: ucontext.h: proceeding with the preprocessor's result > configure: WARNING: ucontext.h: in the future, the compiler will take precedence > configure: WARNING: ## ---------------------------------- ## > configure: WARNING: ## Report this to the stunnel lists. ## > configure: WARNING: ## ---------------------------------- ## > checking for ucontext.h... yes > checking pthread.h usability... yes > checking pthread.h presence... yes > checking for pthread.h... yes What can be done? ~ Greg

2 1

stunnel 4.13 released
by Michal Trojnara 21 Oct '05

21 Oct '05

Version 4.13, 2005.10.21, urgency: MEDIUM: * DLLs for OpenSSL 0.9.7i included because protection faults were reported in 0.9.8 and 0.9.8a. * New features - Libwrap code is executed as a separate process (no more delays due to a global and potentially long critical section). * Bugfixes - Problem with zombies in UCONTEXT threading fixed. - Workaround for non-standard makecontext() uc_stack.ss_sp parameter semantics on SGI IRIX. - Protection fault in signals handling on IRIX fixed. - Problem finding pthread library on AIX fixed. - size_t printf() fixed in stack_info() (the previous fix didn't work). - socklen_t is used instead of int where required. Homepage: http://stunnel.mirt.net/ sha1sum for stunnel-4.13.tar.gz: 4cb8e162e6cd4b4a966d601d1c890df2c2ee198f Best regards, Mike

1 0

smtp and tls
by Andy Cravens 21 Oct '05

21 Oct '05

Does stunnel support using TLS with SMTP? My SMTP server requires TLS but my client does not support it. Unfortunately, my SMTP server does not support SMTP over SSL so my only choice is to use TLS. I've seen some old threads concerning a patch to stunnel 3.x to do TLS but I read it was not a good solution. Does anybody have any information or opinions on this?

3 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users October 2005