I happened upon a user here that posted a couple of months ago(I think)
who used IRIX and had successfully compiled stunnel. Any chance you're
still around!?!?
I get one of two things. Before I apply the patch, it will crash right
after startup. No logs, just dumps core. After the patch, it starts and
exits immediately. I can run it with -version, etc. and it seems to work
fine.
Anyone had this and/or know what can be done?
Eric
3
10
Hi there,
I have set up Stunnel on both the server and the client. There is a
firewall on the server side that only allows TCP connections through.
When Stunnel is started up on the client side, the firewall is actually
receiving an ICMP packet, not a TCP. Is this how Stunnel should be working?
I assume it's doing a ping or something at startup.
Thanks in advance.
Paul
_________________________________________________________________
SEEK: Over 80,000 jobs across all industries at Australia's #1 job site.
http://ninemsn.seek.com.au?hotmail
2
1
Does anyone have a sample config file to allow 4th Dimension client
and server to use stunnel?
1
0
My stunnel client must start without user intervention.
So I installed stunnel in client mode in a Windows XP Home computer as XP
service.
In XP Proffesional I can specify that only Administrators group has access
to stunnel directory.
XP Home does not have security tab in folder properties.
Any person working in XP Home compter can copy stunnel private key
How to protect private key from copying ?
Andrus.
My stunnel.conf file:
Cafile=server.crt
cert=privkey.pem
client = yes
service=RDPClient
verify = 2
[terminal server]
accept = 83389
connect = 1.2.3.4:83389
1
0
Hi,
I'm getting socklet_t undeclared in client.c making
stunnel4.14 in
an embedded linux 2.038 system.
What can I do?
Thanks
TC
__________________________________
Meet your soulmate!
Yahoo! Asia presents Meetic - where millions of singles gather
http://asia.yahoo.com/meetic
2
1
I am completely new to SSL and stunnel. I need to test the
differences between 4th Dimension's SSL and doing the same thing
without the 4D implementation of SSL using stunnel. Can anyone
please tell me where to get started?
Mark Zinke
2
1
We have designed a tool that is similar to Stunnel and we would like to know
if anyone would be interested in testing the tool.
A short introduction:
The Barracuda HTTPS tunnel allows you to encrypt arbitrary TCP connections
inside SSL. The HTTPS tunnel allows you to secure non-SSL aware services
such as TELNET, FTP, VNC, etc., by having the HTTPS tunnel provide the
encryption. The HTTPS tunnel can also be used, for example, to tunnel
traffic out from behind a restrictive firewall/proxy that only allows
outgoing HTTPS web connections.
The client is a Java program that can either be downloaded and started from
the command prompt or started using Java Web Start.
The server is BarracudaDrive.
http://barracudaserver.com/examples/BarracudaDrive/
We will make the beta program (the server and client) available if anyone is
interested in testing the tool and give us feedback. We are specifically
interested in beta testers that are behind a restrictive company proxy.
Thanks,
Wilfred
7
10
Re: [stunnel-users] Problem with Stunnel Working fine on the firstconnection and not on subsequent connections
by Kevin A. McGrail 19 Nov '05
by Kevin A. McGrail 19 Nov '05
19 Nov '05
> I'd try to disable chroot and run stunnel under strace with "foreground =
yes" option.
Mike,
When running in foreground, with or without chroot, things work as expected.
Without foreground, it did not work.
Two key differences on the logs for each:
Output of "Cleaning up the signal pipe" prior to checking the libwrap
permissions
a finish line of "ssmtp finished (0 left)" instead of "ssmtp finished (-1
left)"
(Yes, this is a dual processor box.)
It looks like the key problem lies in the regerenation of the standalone
mode. Is there a way with v4 to just use inetd to answer on port 465,
negotiate and connect on port 25 on another host because perhaps that will
avoid the issue.
Regards,
KAM
2005.11.19 13:07:51 LOG7[3893:1024]: Key file:
/usr/local/ssl/certs/stunnel.pem
2005.11.19 13:07:51 LOG6[3893:1024]: file ulimit = 1024 (can be changed with
'ulimit -n')
2005.11.19 13:07:51 LOG6[3893:1024]: poll() used - no FD_SETSIZE limit for
file descriptors
2005.11.19 13:07:51 LOG5[3893:1024]: 500 clients allowed
2005.11.19 13:07:51 LOG7[3893:1024]: FD 4 in non-blocking mode
2005.11.19 13:07:51 LOG7[3893:1024]: FD 5 in non-blocking mode
2005.11.19 13:07:51 LOG7[3893:1024]: FD 6 in non-blocking mode
2005.11.19 13:07:51 LOG7[3893:1024]: SO_REUSEADDR option set on accept
socket
2005.11.19 13:07:51 LOG7[3893:1024]: ssmtp bound to 0.0.0.0:465
2005.11.19 13:07:51 LOG7[3893:1024]: Created pid file /stunnel.pid
[ed: 1st email]
2005.11.19 13:08:32 LOG7[3893:1024]: ssmtp accepted FD=7 from
66.149.103.32:3130
2005.11.19 13:08:32 LOG7[3898:1026]: ssmtp started
2005.11.19 13:08:32 LOG7[3898:1026]: FD 7 in non-blocking mode
2005.11.19 13:08:32 LOG7[3898:1026]: TCP_NODELAY option set on local socket
2005.11.19 13:08:32 LOG7[3898:1026]: FD 10 in non-blocking mode
2005.11.19 13:08:32 LOG7[3898:1026]: FD 11 in non-blocking mode
2005.11.19 13:08:32 LOG7[3893:1024]: Cleaning up the signal pipe
2005.11.19 13:08:32 LOG7[3898:1026]: Connection from 66.149.103.32:3130
permitted by libwrap
2005.11.19 13:08:32 LOG5[3898:1026]: ssmtp connected from 66.149.103.32:3130
2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): before/accept
initialization
2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 read client
hello A
2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 write server
hello A
2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 write
certificate A
2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 write server
done A
2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 flush data
2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 read client
key exchange A
2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 read finished
A
2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 write change
cipher spec A
2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 write
finished A
2005.11.19 13:08:32 LOG7[3898:1026]: SSL state (accept): SSLv3 flush data
2005.11.19 13:08:32 LOG7[3898:1026]: 1 items in the session cache
2005.11.19 13:08:32 LOG7[3898:1026]: 0 client connects (SSL_connect())
2005.11.19 13:08:32 LOG7[3898:1026]: 0 client connects that finished
2005.11.19 13:08:32 LOG7[3898:1026]: 0 client renegotiatations requested
2005.11.19 13:08:32 LOG7[3898:1026]: 1 server connects (SSL_accept())
2005.11.19 13:08:32 LOG7[3898:1026]: 1 server connects that finished
2005.11.19 13:08:32 LOG7[3898:1026]: 0 server renegotiatiations requested
2005.11.19 13:08:32 LOG7[3898:1026]: 0 session cache hits
2005.11.19 13:08:32 LOG7[3898:1026]: 1 session cache misses
2005.11.19 13:08:32 LOG7[3898:1026]: 0 session cache timeouts
2005.11.19 13:08:32 LOG6[3898:1026]: SSL accepted: new session negotiated
2005.11.19 13:08:32 LOG6[3898:1026]: Negotiated ciphers: RC4-MD5
SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5
2005.11.19 13:08:32 LOG7[3898:1026]: FD 10 in non-blocking mode
2005.11.19 13:08:32 LOG7[3898:1026]: ssmtp connecting 10.10.10.30:25
2005.11.19 13:08:32 LOG7[3898:1026]: connect_wait: waiting 10 seconds
2005.11.19 13:08:32 LOG7[3898:1026]: connect_wait: connected
2005.11.19 13:08:32 LOG7[3898:1026]: Remote FD=10 initialized
2005.11.19 13:08:32 LOG7[3898:1026]: TCP_NODELAY option set on remote socket
2005.11.19 13:08:33 LOG7[3898:1026]: Socket closed on read
2005.11.19 13:08:33 LOG7[3898:1026]: SSL write shutdown
2005.11.19 13:08:33 LOG7[3898:1026]: SSL alert (write): warning: close
notify
2005.11.19 13:08:33 LOG7[3898:1026]: SSL_shutdown retrying
2005.11.19 13:08:33 LOG7[3898:1026]: SSL doesn't need to read or write
2005.11.19 13:08:33 LOG7[3898:1026]: SSL socket closed on SSL_read
2005.11.19 13:08:33 LOG7[3898:1026]: Socket write shutdown
2005.11.19 13:08:33 LOG5[3898:1026]: Connection closed: 834 bytes sent to
SSL, 1358 bytes sent to socket
2005.11.19 13:08:33 LOG7[3898:1026]: ssmtp finished (0 left)
[ed: 2nd email]
2005.11.19 13:08:40 LOG7[3893:1024]: ssmtp accepted FD=7 from
66.149.103.32:3137
2005.11.19 13:08:40 LOG7[3900:2050]: ssmtp started
2005.11.19 13:08:40 LOG7[3900:2050]: FD 7 in non-blocking mode
2005.11.19 13:08:40 LOG7[3900:2050]: TCP_NODELAY option set on local socket
2005.11.19 13:08:40 LOG7[3900:2050]: FD 10 in non-blocking mode
2005.11.19 13:08:40 LOG7[3900:2050]: FD 11 in non-blocking mode
2005.11.19 13:08:40 LOG7[3893:1024]: Cleaning up the signal pipe
2005.11.19 13:08:40 LOG7[3900:2050]: Connection from 66.149.103.32:3137
permitted by libwrap
2005.11.19 13:08:40 LOG5[3900:2050]: ssmtp connected from 66.149.103.32:3137
2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): before/accept
initialization
2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 read client
hello A
2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 write server
hello A
2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 write
certificate A
2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 write server
done A
2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 flush data
2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 read client
key exchange A
2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 read finished
A
2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 write change
cipher spec A
2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 write
finished A
2005.11.19 13:08:40 LOG7[3900:2050]: SSL state (accept): SSLv3 flush data
2005.11.19 13:08:40 LOG7[3900:2050]: 2 items in the session cache
2005.11.19 13:08:40 LOG7[3900:2050]: 0 client connects (SSL_connect())
2005.11.19 13:08:40 LOG7[3900:2050]: 0 client connects that finished
2005.11.19 13:08:40 LOG7[3900:2050]: 0 client renegotiatations requested
2005.11.19 13:08:40 LOG7[3900:2050]: 2 server connects (SSL_accept())
2005.11.19 13:08:40 LOG7[3900:2050]: 2 server connects that finished
2005.11.19 13:08:40 LOG7[3900:2050]: 0 server renegotiatiations requested
2005.11.19 13:08:40 LOG7[3900:2050]: 0 session cache hits
2005.11.19 13:08:40 LOG7[3900:2050]: 2 session cache misses
2005.11.19 13:08:40 LOG7[3900:2050]: 0 session cache timeouts
2005.11.19 13:08:40 LOG6[3900:2050]: SSL accepted: new session negotiated
2005.11.19 13:08:40 LOG6[3900:2050]: Negotiated ciphers: RC4-MD5
SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5
2005.11.19 13:08:40 LOG7[3900:2050]: FD 10 in non-blocking mode
2005.11.19 13:08:40 LOG7[3900:2050]: ssmtp connecting 10.10.10.30:25
2005.11.19 13:08:40 LOG7[3900:2050]: connect_wait: waiting 10 seconds
2005.11.19 13:08:40 LOG7[3900:2050]: connect_wait: connected
2005.11.19 13:08:40 LOG7[3900:2050]: Remote FD=10 initialized
2005.11.19 13:08:40 LOG7[3900:2050]: TCP_NODELAY option set on remote socket
2005.11.19 13:08:42 LOG7[3900:2050]: Socket closed on read
2005.11.19 13:08:42 LOG7[3900:2050]: SSL write shutdown
2005.11.19 13:08:42 LOG7[3900:2050]: SSL alert (write): warning: close
notify
2005.11.19 13:08:42 LOG7[3900:2050]: SSL_shutdown retrying
2005.11.19 13:08:42 LOG7[3900:2050]: SSL doesn't need to read or write
2005.11.19 13:08:42 LOG7[3900:2050]: SSL socket closed on SSL_read
2005.11.19 13:08:42 LOG7[3900:2050]: Socket write shutdown
2005.11.19 13:08:42 LOG5[3900:2050]: Connection closed: 834 bytes sent to
SSL, 1358 bytes sent to socket
2005.11.19 13:08:42 LOG7[3900:2050]: ssmtp finished (0 left)
Without foreground, things do not continue past the first connection:
2005.11.19 13:10:32 LOG7[3910:1024]: ssmtp accepted FD=7 from
66.149.103.32:3268
2005.11.19 13:10:32 LOG7[3916:1026]: ssmtp started
2005.11.19 13:10:32 LOG7[3916:1026]: FD 7 in non-blocking mode
2005.11.19 13:10:32 LOG7[3916:1026]: TCP_NODELAY option set on local socket
2005.11.19 13:10:32 LOG7[3916:1026]: FD 10 in non-blocking mode
2005.11.19 13:10:32 LOG7[3916:1026]: FD 11 in non-blocking mode
2005.11.19 13:10:32 LOG7[3916:1026]: Connection from 66.149.103.32:3268
permitted by libwrap
2005.11.19 13:10:32 LOG5[3916:1026]: ssmtp connected from 66.149.103.32:3268
2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): before/accept
initialization
2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 read client
hello A
2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 write server
hello A
2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 write
certificate A
2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 write server
done A
2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 flush data
2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 read client
key exchange A
2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 read finished
A
2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 write change
cipher spec A
2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 write
finished A
2005.11.19 13:10:32 LOG7[3916:1026]: SSL state (accept): SSLv3 flush data
2005.11.19 13:10:32 LOG7[3916:1026]: 1 items in the session cache
2005.11.19 13:10:32 LOG7[3916:1026]: 0 client connects (SSL_connect())
2005.11.19 13:10:32 LOG7[3916:1026]: 0 client connects that finished
2005.11.19 13:10:32 LOG7[3916:1026]: 0 client renegotiatations requested
2005.11.19 13:10:32 LOG7[3916:1026]: 1 server connects (SSL_accept())
2005.11.19 13:10:32 LOG7[3916:1026]: 1 server connects that finished
2005.11.19 13:10:32 LOG7[3916:1026]: 0 server renegotiatiations requested
2005.11.19 13:10:32 LOG7[3916:1026]: 0 session cache hits
2005.11.19 13:10:32 LOG7[3916:1026]: 1 session cache misses
2005.11.19 13:10:32 LOG7[3916:1026]: 0 session cache timeouts
2005.11.19 13:10:32 LOG6[3916:1026]: SSL accepted: new session negotiated
2005.11.19 13:10:32 LOG6[3916:1026]: Negotiated ciphers: RC4-MD5
SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5
2005.11.19 13:10:32 LOG7[3916:1026]: FD 10 in non-blocking mode
2005.11.19 13:10:32 LOG7[3916:1026]: ssmtp connecting 10.10.10.30:25
2005.11.19 13:10:32 LOG7[3916:1026]: connect_wait: waiting 10 seconds
2005.11.19 13:10:32 LOG7[3916:1026]: connect_wait: connected
2005.11.19 13:10:32 LOG7[3916:1026]: Remote FD=10 initialized
2005.11.19 13:10:32 LOG7[3916:1026]: TCP_NODELAY option set on remote socket
2005.11.19 13:10:33 LOG7[3916:1026]: Socket closed on read
2005.11.19 13:10:33 LOG7[3916:1026]: SSL write shutdown
2005.11.19 13:10:33 LOG7[3916:1026]: SSL alert (write): warning: close
notify
2005.11.19 13:10:33 LOG7[3916:1026]: SSL_shutdown retrying
2005.11.19 13:10:33 LOG7[3916:1026]: SSL doesn't need to read or write
2005.11.19 13:10:34 LOG7[3916:1026]: SSL socket closed on SSL_read
2005.11.19 13:10:34 LOG7[3916:1026]: Socket write shutdown
2005.11.19 13:10:34 LOG5[3916:1026]: Connection closed: 834 bytes sent to
SSL, 1353 bytes sent to socket
2005.11.19 13:10:34 LOG7[3916:1026]: ssmtp finished (-1 left)
1
0
Problem with Stunnel Working fine on the first connection and not on subsequent connections
by Kevin A. McGrail 19 Nov '05
by Kevin A. McGrail 19 Nov '05
19 Nov '05
Have worked on this all day without any glimmer of hope and would appreciate help and feedback!
Regards,
KAM
# Description of your problem. What programs are on which machines, and how are they attempting to communicate. What connections are you attempting to secure in SSL.
I am having problems with the regeneration of stunnel on an old but fairly reliable machine. I am switching from v3 to v4 and it works absolutely perfectly ONCE. The second time it just hangs.
# What version of Stunnel you're using - remember, Stunnel 4.x doesn't take Stunnel 3.x command line options!
4.x
# The list of parameters you are using for stunnel, and if you are running it standalone or from inetd/xinetd.
I am running it in standalone. My conf file is:
cert = /usr/local/ssl/certs/stunnel.pem
key = /usr/local/ssl/certs/stunnel.pem
chroot = /usr/local/var/stunnel/
setuid = nobody
setgid = nobody
pid = /stunnel.pid
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
debug = 7
output = stunnel.log
[ssmtp]
accept = 465
connect = 10.10.10.30:25
# Output of "stunnel -f -D 7 <your-parameters>".
Not sure this works on v4.X but here are the logs from the connection:
2005.11.18 19:17:56 LOG7[13166:1024]: ssmtp accepted FD=7 from 66.149.103.32:3542
2005.11.18 19:17:56 LOG7[13171:1026]: ssmtp started
2005.11.18 19:17:56 LOG7[13171:1026]: FD 7 in non-blocking mode
2005.11.18 19:17:56 LOG7[13171:1026]: TCP_NODELAY option set on local socket
2005.11.18 19:17:56 LOG7[13171:1026]: FD 10 in non-blocking mode
2005.11.18 19:17:56 LOG7[13171:1026]: FD 11 in non-blocking mode
2005.11.18 19:17:56 LOG7[13171:1026]: Connection from 66.149.103.32:3542 permitted by libwrap
2005.11.18 19:17:56 LOG5[13171:1026]: ssmtp connected from 66.149.103.32:3542
2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): before/accept initialization
2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 read client hello A
2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 write server hello A
2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 write certificate A
2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 write server done A
2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 flush data
2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 read client key exchange A
2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 read finished A
2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 write change cipher spec A
2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 write finished A
2005.11.18 19:17:56 LOG7[13171:1026]: SSL state (accept): SSLv3 flush data
2005.11.18 19:17:56 LOG7[13171:1026]: 1 items in the session cache
2005.11.18 19:17:56 LOG7[13171:1026]: 0 client connects (SSL_connect())
2005.11.18 19:17:56 LOG7[13171:1026]: 0 client connects that finished
2005.11.18 19:17:56 LOG7[13171:1026]: 0 client renegotiatations requested
2005.11.18 19:17:56 LOG7[13171:1026]: 1 server connects (SSL_accept())
2005.11.18 19:17:56 LOG7[13171:1026]: 1 server connects that finished
2005.11.18 19:17:56 LOG7[13171:1026]: 0 server renegotiatiations requested
2005.11.18 19:17:56 LOG7[13171:1026]: 0 session cache hits
2005.11.18 19:17:56 LOG7[13171:1026]: 1 session cache misses
2005.11.18 19:17:56 LOG7[13171:1026]: 0 session cache timeouts
2005.11.18 19:17:56 LOG6[13171:1026]: SSL accepted: new session negotiated
2005.11.18 19:17:56 LOG6[13171:1026]: Negotiated ciphers: RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5
2005.11.18 19:17:56 LOG7[13171:1026]: FD 10 in non-blocking mode
2005.11.18 19:17:56 LOG7[13171:1026]: ssmtp connecting 10.10.10.30:25
2005.11.18 19:17:56 LOG7[13171:1026]: connect_wait: waiting 10 seconds
2005.11.18 19:17:56 LOG7[13171:1026]: connect_wait: connected
2005.11.18 19:17:56 LOG7[13171:1026]: Remote FD=10 initialized
2005.11.18 19:17:56 LOG7[13171:1026]: TCP_NODELAY option set on remote socket
2005.11.18 19:17:58 LOG7[13171:1026]: Socket closed on read
2005.11.18 19:17:58 LOG7[13171:1026]: SSL write shutdown
2005.11.18 19:17:58 LOG7[13171:1026]: SSL alert (write): warning: close notify
2005.11.18 19:17:58 LOG7[13171:1026]: SSL_shutdown retrying
2005.11.18 19:17:58 LOG7[13171:1026]: SSL doesn't need to read or write
2005.11.18 19:17:58 LOG7[13171:1026]: SSL socket closed on SSL_read
2005.11.18 19:17:58 LOG7[13171:1026]: Socket write shutdown
2005.11.18 19:17:58 LOG5[13171:1026]: Connection closed: 827 bytes sent to SSL, 1362 bytes sent to socket
2005.11.18 19:17:58 LOG7[13171:1026]: ssmtp finished (-1 left)
There is nothing more after this point
# Output of "stunnel -V".
I think you want -version:
/usr/local/sbin/stunnel -version
stunnel 4.14 on i686-pc-linux-gnu PTHREAD+POLL+IPv4+LIBWRAP with OpenSSL 0.9.7e 25 Oct 2004
Global options
cert = /usr/local/etc/stunnel/stunnel.pem
ciphers = ALL:!ADH:+RC4:@STRENGTH
debug = 5
key = /usr/local/etc/stunnel/stunnel.pem
pid = /usr/local/var/stunnel/stunnel.pid
RNDbytes = 64
RNDfile = /dev/urandom
RNDoverwrite = yes
session = 300 seconds
verify = none
Service-level options
TIMEOUTbusy = 300 seconds
TIMEOUTclose = 60 seconds
TIMEOUTconnect = 10 seconds
TIMEOUTidle = 43200 seconds
# Output of "uname -a".
Linux <removed> 2.2.26 #8 Fri Jul 16 00:42:34 EDT 2004 i686 unknown
# Your libc version if you use Linux.
2.2.5
# Output of "gcc -v".
Reading specs from /usr/lib/gcc-lib/i386-redhat-linux/egcs-2.91.66/specs
gcc version egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)
# Output of "openssl version" or "ssleay version" depending on your library. Subscribe to stunnel-users.
OpenSSL 0.9.7e 25 Oct 2004
2
1
Hi folks,
I use stunnel-4.12 with openssl-0.9.7g to tunnel my CVS-pserver protocols. I
have set up the local stunnel client to listen to port 22400 and to forward
any connections on it to the cvs server that has the server side stunnel
listening on port 22401 forwarding connections to the cvs-pserver on port
2401.
Having set up thus, I can do a cvs login just fine. I can watch the
negotiation happening using tcpdump. However when I try to check out a
module from the repository, I see some files coming through but only to
eventually hang. If I <Ctrl C> and try again, more files come in but hangs
before the transaction is complete. I have to do this several time in order
to download all the files to my local workspace.
Upon checking the logs, I find that the hang occurs immediately after the
message:
2005.10.28 14:21:53 LOG7[15095:67]: SSL_read returned WANT_READ: retrying
2005.10.28 14:21:53 LOG7[15095:67]: SSL_write returned WANT_WRITE: retrying
2005.10.28 14:21:53 LOG7[15095:67]: SSL_read returned WANT_READ: retrying
I have included a snippet of the log file for reference. I have also
included my stunnel.conf file. Sorry for the voluminous output. Can some
one help me here? Thanks in advance.
-ZZ
===============================STUNNEL.LOG==================================
The full log file reads:
2005.10.28 14:20:44 LOG6[15095:64]: SSL accepted: previous session reused
2005.10.28 14:20:44 LOG7[15095:64]: FD 1 in non-blocking mode
2005.10.28 14:20:44 LOG7[15095:64]: smd-pserver connecting 127.0.0.1:2401
2005.10.28 14:20:44 LOG7[15095:64]: Remote FD=1 initialized
2005.10.28 14:20:44 LOG7[15095:64]: SSL_read returned WANT_READ: retrying
2005.10.28 14:20:44 LOG7[15095:64]: SSL_write returned WANT_WRITE: retrying
2005.10.28 14:20:44 LOG7[15095:64]: SSL_read returned WANT_READ: retrying
2005.10.28 14:20:50 LOG7[15095:64]: SSL alert (read): warning: close notify
2005.10.28 14:20:50 LOG7[15095:64]: SSL closed on SSL_read
2005.10.28 14:20:50 LOG7[15095:64]: Socket write shutdown
2005.10.28 14:20:50 LOG7[15095:64]: SSL write shutdown
2005.10.28 14:20:50 LOG7[15095:64]: SSL alert (write): warning: close notify
2005.10.28 14:20:50 LOG6[15095:64]: SSL_shutdown successfully sent
close_notify
2005.10.28 14:20:50 LOG5[15095:64]: Connection closed: 73224 bytes sent to
SSL, 4724 bytes sent to socket
2005.10.28 14:20:50 LOG7[15095:64]: smd-pserver finished (0 left)
2005.10.28 14:20:50 LOG5[15095:64]: stack_info: size=65536, current=5004
(7%), maximum=5004 (7%)
2005.10.28 14:20:50 LOG7[15095:64]: Context 64 closed
2005.10.28 14:20:51 LOG7[15095:1]: Context set: 64 (dropped) -> 1
2005.10.28 14:20:51 LOG7[15095:1]: Current context: 1
2005.10.28 14:20:51 LOG7[15095:1]: Releasing context 64
2005.10.28 14:20:51 LOG7[15095:1]: smd-pserver accepted FD=0 from
171.65.79.143:65521
2005.10.28 14:20:51 LOG7[15095:1]: Creating a new context
2005.10.28 14:20:51 LOG7[15095:1]: Context 65 created
2005.10.28 14:20:51 LOG7[15095:65]: Context swap: 1 -> 65
2005.10.28 14:20:51 LOG7[15095:65]: smd-pserver started
2005.10.28 14:20:51 LOG7[15095:65]: FD 0 in non-blocking mode
2005.10.28 14:20:51 LOG5[15095:65]: smd-pserver connected from
171.65.79.143:65521
2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): before/accept
initialization
2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): SSLv3 read client
hello A
2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): SSLv3 write server
hello A
2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): SSLv3 write change
cipher spec A
2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): SSLv3 write finished
A
2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): SSLv3 flush data
2005.10.28 14:20:51 LOG7[15095:65]: SSL state (accept): SSLv3 read finished
A
2005.10.28 14:20:51 LOG7[15095:65]: 6 items in the session cache
2005.10.28 14:20:51 LOG7[15095:65]: 0 client connects (SSL_connect())
2005.10.28 14:20:51 LOG7[15095:65]: 0 client connects that finished
2005.10.28 14:20:51 LOG7[15095:65]: 0 client renegotiatations requested
2005.10.28 14:20:51 LOG7[15095:65]: 64 server connects (SSL_accept())
2005.10.28 14:20:51 LOG7[15095:65]: 55 server connects that finished
2005.10.28 14:20:51 LOG7[15095:65]: 0 server renegotiatiations requested
2005.10.28 14:20:51 LOG7[15095:65]: 38 session cache hits
2005.10.28 14:20:51 LOG7[15095:65]: 0 session cache misses
2005.10.28 14:20:51 LOG7[15095:65]: 11 session cache timeouts
2005.10.28 14:20:51 LOG6[15095:65]: SSL accepted: previous session reused
2005.10.28 14:20:51 LOG7[15095:65]: FD 1 in non-blocking mode
2005.10.28 14:20:51 LOG7[15095:65]: smd-pserver connecting 127.0.0.1:2401
2005.10.28 14:20:51 LOG7[15095:65]: Remote FD=1 initialized
2005.10.28 14:20:51 LOG7[15095:65]: SSL_read returned WANT_READ: retrying
2005.10.28 14:20:51 LOG7[15095:65]: SSL_write returned WANT_WRITE: retrying
2005.10.28 14:20:51 LOG7[15095:65]: SSL_read returned WANT_READ: retrying
2005.10.28 14:20:57 LOG7[15095:65]: SSL alert (read): warning: close notify
2005.10.28 14:20:57 LOG7[15095:65]: SSL closed on SSL_read
2005.10.28 14:20:57 LOG7[15095:65]: Socket write shutdown
2005.10.28 14:20:57 LOG7[15095:65]: SSL write shutdown
2005.10.28 14:20:57 LOG7[15095:65]: SSL alert (write): warning: close notify
2005.10.28 14:20:57 LOG6[15095:65]: SSL_shutdown successfully sent
close_notify
2005.10.28 14:20:57 LOG5[15095:65]: Connection closed: 73224 bytes sent to
SSL, 4724 bytes sent to socket
2005.10.28 14:20:57 LOG7[15095:65]: smd-pserver finished (0 left)
2005.10.28 14:20:57 LOG5[15095:65]: stack_info: size=65536, current=5004
(7%), maximum=5004 (7%)
2005.10.28 14:20:57 LOG7[15095:65]: Context 65 closed
2005.10.28 14:20:58 LOG7[15095:1]: Context set: 65 (dropped) -> 1
2005.10.28 14:20:58 LOG7[15095:1]: Current context: 1
2005.10.28 14:20:58 LOG7[15095:1]: Releasing context 65
2005.10.28 14:20:58 LOG7[15095:1]: smd-pserver accepted FD=0 from
171.65.79.143:65523
2005.10.28 14:20:58 LOG7[15095:1]: Creating a new context
2005.10.28 14:20:58 LOG7[15095:1]: Context 66 created
2005.10.28 14:20:58 LOG7[15095:66]: Context swap: 1 -> 66
2005.10.28 14:20:58 LOG7[15095:66]: smd-pserver started
2005.10.28 14:20:58 LOG7[15095:66]: FD 0 in non-blocking mode
2005.10.28 14:20:58 LOG5[15095:66]: smd-pserver connected from
171.65.79.143:65523
2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): before/accept
initialization
2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): SSLv3 read client
hello A
2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): SSLv3 write server
hello A
2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): SSLv3 write change
cipher spec A
2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): SSLv3 write finished
A
2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): SSLv3 flush data
2005.10.28 14:20:58 LOG7[15095:66]: SSL state (accept): SSLv3 read finished
A
2005.10.28 14:20:58 LOG7[15095:66]: 6 items in the session cache
2005.10.28 14:20:58 LOG7[15095:66]: 0 client connects (SSL_connect())
2005.10.28 14:20:58 LOG7[15095:66]: 0 client connects that finished
2005.10.28 14:20:58 LOG7[15095:66]: 0 client renegotiatations requested
2005.10.28 14:20:58 LOG7[15095:66]: 65 server connects (SSL_accept())
2005.10.28 14:20:58 LOG7[15095:66]: 56 server connects that finished
2005.10.28 14:20:58 LOG7[15095:66]: 0 server renegotiatiations requested
2005.10.28 14:20:58 LOG7[15095:66]: 39 session cache hits
2005.10.28 14:20:58 LOG7[15095:66]: 0 session cache misses
2005.10.28 14:20:58 LOG7[15095:66]: 11 session cache timeouts
2005.10.28 14:20:58 LOG6[15095:66]: SSL accepted: previous session reused
2005.10.28 14:20:58 LOG7[15095:66]: FD 1 in non-blocking mode
2005.10.28 14:20:58 LOG7[15095:66]: smd-pserver connecting 127.0.0.1:2401
2005.10.28 14:20:58 LOG7[15095:66]: Remote FD=1 initialized
2005.10.28 14:20:58 LOG7[15095:66]: SSL_read returned WANT_READ: retrying
2005.10.28 14:20:58 LOG7[15095:66]: SSL_write returned WANT_WRITE: retrying
2005.10.28 14:20:58 LOG7[15095:66]: SSL_read returned WANT_READ: retrying
2005.10.28 14:21:50 LOG7[15095:66]: SSL alert (read): warning: close notify
2005.10.28 14:21:50 LOG7[15095:66]: SSL closed on SSL_read
2005.10.28 14:21:50 LOG7[15095:66]: Socket write shutdown
2005.10.28 14:21:50 LOG7[15095:66]: SSL write shutdown
2005.10.28 14:21:50 LOG7[15095:66]: SSL alert (write): warning: close notify
2005.10.28 14:21:50 LOG6[15095:66]: SSL_shutdown successfully sent
close_notify
2005.10.28 14:21:50 LOG5[15095:66]: Connection closed: 73224 bytes sent to
SSL, 4724 bytes sent to socket
2005.10.28 14:21:50 LOG7[15095:66]: smd-pserver finished (0 left)
2005.10.28 14:21:50 LOG5[15095:66]: stack_info: size=65536, current=5004
(7%), maximum=5004 (7%)
2005.10.28 14:21:50 LOG7[15095:66]: Context 66 closed
2005.10.28 14:21:52 LOG7[15095:1]: Context set: 66 (dropped) -> 1
2005.10.28 14:21:52 LOG7[15095:1]: Current context: 1
2005.10.28 14:21:52 LOG7[15095:1]: Releasing context 66
2005.10.28 14:21:52 LOG7[15095:1]: smd-pserver accepted FD=0 from
171.65.79.143:65525
2005.10.28 14:21:52 LOG7[15095:1]: Creating a new context
2005.10.28 14:21:52 LOG7[15095:1]: Context 67 created
2005.10.28 14:21:52 LOG7[15095:67]: Context swap: 1 -> 67
2005.10.28 14:21:52 LOG7[15095:67]: smd-pserver started
2005.10.28 14:21:52 LOG7[15095:67]: FD 0 in non-blocking mode
2005.10.28 14:21:52 LOG5[15095:67]: smd-pserver connected from
171.65.79.143:65525
2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): before/accept
initialization
2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): SSLv3 read client
hello A
2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): SSLv3 write server
hello A
2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): SSLv3 write change
cipher spec A
2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): SSLv3 write finished
A
2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): SSLv3 flush data
2005.10.28 14:21:52 LOG7[15095:67]: SSL state (accept): SSLv3 read finished
A
2005.10.28 14:21:52 LOG7[15095:67]: 6 items in the session cache
2005.10.28 14:21:52 LOG7[15095:67]: 0 client connects (SSL_connect())
2005.10.28 14:21:52 LOG7[15095:67]: 0 client connects that finished
2005.10.28 14:21:52 LOG7[15095:67]: 0 client renegotiatations requested
2005.10.28 14:21:52 LOG7[15095:67]: 66 server connects (SSL_accept())
2005.10.28 14:21:52 LOG7[15095:67]: 57 server connects that finished
2005.10.28 14:21:52 LOG7[15095:67]: 0 server renegotiatiations requested
2005.10.28 14:21:52 LOG7[15095:67]: 40 session cache hits
2005.10.28 14:21:52 LOG7[15095:67]: 0 session cache misses
2005.10.28 14:21:52 LOG7[15095:67]: 11 session cache timeouts
2005.10.28 14:21:52 LOG6[15095:67]: SSL accepted: previous session reused
2005.10.28 14:21:52 LOG7[15095:67]: FD 1 in non-blocking mode
2005.10.28 14:21:52 LOG7[15095:67]: smd-pserver connecting 127.0.0.1:2401
2005.10.28 14:21:52 LOG7[15095:67]: Remote FD=1 initialized
2005.10.28 14:21:53 LOG7[15095:67]: SSL_read returned WANT_READ: retrying
2005.10.28 14:21:53 LOG7[15095:67]: SSL_write returned WANT_WRITE: retrying
2005.10.28 14:21:53 LOG7[15095:67]: SSL_read returned WANT_READ: retrying
==========================================================================
=========================STUNNEL.CONF======================================
; Sample stunnel configuration file by Michal Trojnara 2002-2005
; Some options used here may not be adequate for your particular
configuration
; Please make sure you understand them (especially the effect of chroot
jail)
;Delay DNS Lookups
delay = yes
; Certificate/key is needed in server mode and optional in client mode
cert = /tools/stunnel/4.12/etc/stunnel/stunnel.pem
;key = /tools/stunnel/4.12/etc/stunnel/mail.pem
; Some security enhancements for UNIX systems - comment them out on Win32
chroot = /tools/stunnel/4.12/var/stunnel/
setuid = cvsadmin
setgid = cvs
; PID is created inside chroot jail
pid = /stunnel.pid
; Some performance tunings
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
;compression = rle
; Workaround for Eudora bug
;options = DONT_INSERT_EMPTY_FRAGMENTS
; Authentication stuff
;verify = 2
; Don't forget to c_rehash CApath; CApath is located inside chroot jail:
;CApath = /certs
; It's often easier to use CAfile:
;CAfile = /tools/stunnel/4.12/etc/stunnel/certs.pem
; Don't forget to c_rehash CRLpath; CRLpath is located inside chroot jail:
;CRLpath = /crls
; Alternatively you can use CRLfile:
;CRLfile = /tools/stunnel/4.12/etc/stunnel/crls.pem
; Some debugging stuff useful for troubleshooting
debug = 7
output = /tools/stunnel/current/var/stunnel/stunnel.log
; Use it for client mode
;client = yes
; Service-level configuration
;[pop3s]
;accept = 995
;connect = 110
;[imaps]
;accept = 993
;connect = 143
;[ssmtp]
;accept = 465
;connect = 25
[pserver]
accept = 22401
connect = 2401
TIMEOUTclose = 30
; vim:ft=dosini
3
3