stunnel-users March 2007

13 participants
16 discussions

DLLs for OpenSSL 0.9.8e
by Michal Trojnara 09 Mar '07

09 Mar '07

Dear Users, I've built the DLLs for OpenSSL 0.9.8e. They're available for download from: ftp://stunnel.mirt.net/openssl/binary-0.9.8e-zdll/ Best regards, Mike

1 0

problem accesing a https site as a Windows version client
by Gustavo 09 Mar '07

09 Mar '07

I'm running stunnel version 4.2 on Windows XP I can access a lot of websites, example https://servicios.afip.gov.ar/tramites_con_clave_fiscal/misAportes/images/t… but CAN'T access https://apwebserver.rentasgcba.gov.ar/ablpatib_ssl/images/Actitud_BsAs_negr… apparently a response never arrives to my PC my conf file is cert = stunnel.pem ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Some debugging stuff useful for troubleshooting debug = 7 ; Use it for client mode client = yes ; Service-level configuration [https1] client = yes accept = 6001 connect = servicios.afip.gov.ar:443 TIMEOUTclose = 0 [https] client = yes accept = 6002 connect = apwebserver.rentasgcba.gov.ar:443 TIMEOUTclose = 5 ; vim:ft=dosini

2 1

Download speed affected with stunnel help needed please.
by tom hammond 07 Mar '07

07 Mar '07

Using HFS 2.1d http://www.rejetto.com and Stunnel 4.20 on single WinXP machine. The list of parameters you are using for stunnel, and if you are running it standalone or from inetd/xinetd: socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [https] accept = # connect = # TIMOUTclose = 0 I dont'understand 3-7 as given here: http://www.stunnel.org/support/ only used OpenSSL to make CERT Win32 OpenSSL v0.9.8e Light *************************************** Description: HFS is a webserver that can only utilize HTTP, therefore I turned to Stunnel to implement https. When using HTTPs: for UPLOADING I get full speed. When using HTTPs: for DOWNLoADING the speed in cut drastically, 20x slower. The odd thing is, multiple downloads can go at once eg: 20 connections @80kb/second However no single connection will get over 80 or 100kb/second I searched the net and couldn't find a solution, but continuously came across mention of "loopback" problems with stunnel and http servers (old posts) or saying stuff about Microsoft winsock, found a few mentions of VNC server having an option to "enable loopback connections" Another thing I saw but closed (oops) was mention of disabling an HTTP server in order to avoid loopback problems with HTTPS serving.(HFS has no option because it is designed to serve ONLY HTTP) I have tons of hope for an easy solution for the following reasons: #1, uploading works perfect #2 just downloaded demo of Easy File Sharing Web Server(not free like HFS) and the download speed works through HTTPS. I have no clue as to how to fix this, saw one entry in the stunnel config at ssl.org: socket = a:SO_BINDTODEVICE=lo I DID attempt to enter this line into the config under my 2 original entries, but then stunnel would not start. Thank you --------------------------------- TV dinner still cooling? Check out "Tonight's Picks" on Yahoo! TV.

1 0

init_ssl: s_poll_wait timeout
by William Biagi 06 Mar '07

06 Mar '07

I am using a Eudora client configured to use STARTLS to send mail through stunnel to a sendmail server. The stunnel config is as follows: cert = /usr/local/etc/stunnel/stunnel.pem key = /usr/local/etc/stunnel/stunnel.pem socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 options = DONT_INSERT_EMPTY_FRAGMENTS delay = yes TIMEOUTconnect = 300 TIMEOUTbusy = 300 setuid = smtpauth setgid = smtpauth debug = 7 client = no foreground = yes pid = [smtps] accept = 465 connect = localhost:25 protocol=smtp When I send mail the connection is established with port 465 on stunnel but it fails to negotiate the ssl session. THis is the log: 2007.03.06 15:45:08 LOG7[17753:1024]: Snagged 64 random bytes from /root/.rnd 2007.03.06 15:45:08 LOG7[17753:1024]: Wrote 1024 new random bytes to /root/.rnd 2007.03.06 15:45:08 LOG7[17753:1024]: RAND_status claims sufficient entropy for the PRNG 2007.03.06 15:45:08 LOG7[17753:1024]: PRNG seeded successfully 2007.03.06 15:45:08 LOG7[17753:1024]: Configuration SSL options: 0x00000800 2007.03.06 15:45:08 LOG7[17753:1024]: SSL options set: 0x00000800 2007.03.06 15:45:08 LOG7[17753:1024]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2007.03.06 15:45:08 LOG7[17753:1024]: Certificate loaded 2007.03.06 15:45:08 LOG7[17753:1024]: Key file: /usr/local/etc/stunnel/stunnel.pem 2007.03.06 15:45:08 LOG7[17753:1024]: Private key loaded 2007.03.06 15:45:08 LOG7[17753:1024]: SSL context initialized for service smtps 2007.03.06 15:45:08 LOG5[17753:1024]: stunnel 4.20 on i686-pc-linux-gnu with OpenSSL 0.9.7l 28 Sep 2006 2007.03.06 15:45:08 LOG5[17753:1024]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 2007.03.06 15:45:08 LOG6[17753:1024]: file ulimit = 1024 (can be changed with 'ulimit -n') 2007.03.06 15:45:08 LOG6[17753:1024]: poll() used - no FD_SETSIZE limit for file descriptors 2007.03.06 15:45:08 LOG5[17753:1024]: 500 clients allowed 2007.03.06 15:45:08 LOG7[17753:1024]: FD 3 in non-blocking mode 2007.03.06 15:45:08 LOG7[17753:1024]: FD 4 in non-blocking mode 2007.03.06 15:45:08 LOG7[17753:1024]: FD 5 in non-blocking mode 2007.03.06 15:45:08 LOG7[17753:1024]: SO_REUSEADDR option set on accept socket 2007.03.06 15:45:08 LOG7[17753:1024]: smtps bound to 0.0.0.0:465 2007.03.06 15:45:08 LOG7[17753:1024]: No pid file being created 2007.03.06 15:45:18 LOG7[17753:1024]: smtps accepted FD=6 from 208.41.111.165:2542 2007.03.06 15:45:18 LOG7[17755:1026]: smtps started 2007.03.06 15:45:18 LOG7[17755:1026]: FD 6 in non-blocking mode 2007.03.06 15:45:18 LOG7[17755:1026]: TCP_NODELAY option set on local socket 2007.03.06 15:45:18 LOG5[17755:1026]: smtps accepted connection from 208.41.111.165:2542 2007.03.06 15:45:18 LOG7[17755:1026]: SSL state (accept): before/accept initialization 2007.03.06 15:45:20 LOG6[17755:1026]: init_ssl: s_poll_wait timeout 2007.03.06 15:45:20 LOG5[17755:1026]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2007.03.06 15:45:20 LOG7[17755:1026]: smtps finished (0 left) 2007.03.06 15:47:00 LOG3[17753:1024]: Received signal 2; terminating Can anyone tell me what I am doing wrong? BB

1 0

High CPU system usage on Solaris
by armando.salvatori＠accenture.com 05 Mar '07

05 Mar '07

We use stunnel process to encrypt Oracle connections from a set of 4-6 application server. On the DB server, 20 cpus Solaris machine running Oracle, we have more then 400 LWPS for stunnel and the relative 400 oracle connections. We experience a huge amount of cpu usage (system component), about 40%, after stunnel setup (stunnel 4.15 version) Is it usual? Do you have experience on similar situation? Do you have any suggestions to improve cpu usage or to address performance issue/tuning? Thank you very much AS This message is for the designated recipient only and may contain privileged, proprietary, or otherwise private information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the email by you is prohibited.

1 0

make compile error options.c parse_ocsp_url
by William Biagi 03 Mar '07

03 Mar '07

./configure was successful but the make gave me the following: Making all in src make[1]: Entering directory `/home/bbiagi/stunnel-4.20/src' if gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.20\" -DPACKAGE_STRING=\"stunnel\ 4.20\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.20\" -DHOST=\"i686-pc-linux-gnu\" -DCPU_I686=1 -DVENDOR_PC=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_TCPD_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBZ=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_GETCONTEXT=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/usr\" -DHAVE_OSSL_ENGINE_H=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/include -MT options.o -MD -MP -MF ".deps/options.Tpo" -c -o options.o options.c; \ then mv -f ".deps/options.Tpo" ".deps/options.Po"; else rm -f ".deps/options.Tpo"; exit 1; fi options.c: In function `parse_ocsp_url': options.c:1762: warning: implicit declaration of function `OCSP_parse_url' options.c:1767: structure has no member named `ocsp_addr' options.c:1769: structure has no member named `ocsp_path' options.c: In function `parse_ocsp_flag': options.c:1786: `OCSP_NOCERTS' undeclared (first use in this function) options.c:1786: (Each undeclared identifier is reported only once options.c:1786: for each function it appears in.) options.c:1787: `OCSP_NOINTERN' undeclared (first use in this function) options.c:1788: `OCSP_NOSIGS' undeclared (first use in this function) options.c:1789: `OCSP_NOCHAIN' undeclared (first use in this function) options.c:1790: `OCSP_NOVERIFY' undeclared (first use in this function) options.c:1791: `OCSP_NOEXPLICIT' undeclared (first use in this function) options.c:1792: `OCSP_NOCASIGN' undeclared (first use in this function) options.c:1793: `OCSP_NODELEGATED' undeclared (first use in this function) options.c:1794: `OCSP_NOCHECKS' undeclared (first use in this function) options.c:1795: `OCSP_TRUSTOTHER' undeclared (first use in this function) options.c:1796: `OCSP_RESPID_KEY' undeclared (first use in this function) options.c:1797: `OCSP_NOTIME' undeclared (first use in this function) options.c: At top level: options.c:1758: warning: `parse_ocsp_url' defined but not used options.c:1781: warning: `parse_ocsp_flag' defined but not used make[1]: *** [options.o] Error 1 make[1]: Leaving directory `/home/bbiagi/stunnel-4.20/src' make: *** [all-recursive] Error 1 I am trying to install on a red hat 7.3 with openssl-0.9.6b-18

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users March 2007