Hi everyone
I try to compile stunnel, but it fails.
Actually, it tells me about a parse error inside signal.h, and i think it's
a falsePositive.
The configure works great and nothing look strange inside the configure.log.
I also tried to googled those errors, but didn't find any clues.
My server is a sunOS 10 and the src were taken from
http://www.stunnel.org/download/stunnel/src/stunnel-4.26.tar.gz
My version of openssl :
OpenSSL 0.9.7.d
Here are the errors, after the make command :
/stunnel-4.26 root# make
Making all in src
make[1]: Entering directory `/root/syslogNG/stunnel-4.26/src'
if gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\"
-DPACKAGE_VERSION=\"4.26\" -DPACKAGE_STRING=\"stunnel\ 4.26\"
-DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.26\"
-DHOST=\"i386-pc-solaris2.10\" -DCPU_I386=1 -DVENDOR_PC=1 -DOS_SOLARIS2_10=1
-DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1
-DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1
-DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1
-DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4
-DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\"
-DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1
-DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_SYS_FILIO_H=1
-DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1
-DHAVE_SYS_SOCKET_H=1 -DHAVE_LIBSOCKET=1 -DHAVE_LIBDL=1 -DHAVE_LIBZ=1
-DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1
-DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1
-DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1
-DHAVE_LOCALTIME_R=1 -DHAVE_GETCONTEXT=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1
-DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1
-Dssldir=\"/usr/local/ssl\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_IPv6=1 -I. -I.
-I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"'
-DCONFDIR='"/usr/local/etc/stunnel"'
-DPIDFILE='"/var/run/stunnel/run/stunnel/stunnel.pid"' -g -O2 -Wall
-Wshadow -Wcast-align -Wpointer-arith -I/usr/local/ssl/include -MT file.o
-MD -MP -MF ".deps/file.Tpo" -c -o file.o file.c; \
then mv -f ".deps/file.Tpo" ".deps/file.Po"; else rm -f ".deps/file.Tpo";
exit 1; fi
*In file included from /usr/include/sys/signal.h:34,*
from /usr/include/signal.h:26,
from common.h:250,
from file.c:38:
/usr/include/sys/siginfo.h:259: error: parse error before "ctid_t"
/usr/include/sys/siginfo.h:292: error: parse error before '}' token
/usr/include/sys/siginfo.h:294: error: parse error before '}' token
/usr/include/sys/siginfo.h:390: error: parse error before "ctid_t"
/usr/include/sys/siginfo.h:392: error: conflicting types for `__proc'
/usr/include/sys/siginfo.h:261: error: previous declaration of `__proc'
/usr/include/sys/siginfo.h:398: error: conflicting types for `__fault'
/usr/include/sys/siginfo.h:267: error: previous declaration of `__fault'
/usr/include/sys/siginfo.h:404: error: conflicting types for `__file'
/usr/include/sys/siginfo.h:273: error: previous declaration of `__file'
/usr/include/sys/siginfo.h:420: error: conflicting types for `__prof'
/usr/include/sys/siginfo.h:287: error: previous declaration of `__prof'
/usr/include/sys/siginfo.h:424: error: conflicting types for `__rctl'
/usr/include/sys/siginfo.h:291: error: previous declaration of `__rctl'
/usr/include/sys/siginfo.h:426: error: parse error before '}' token
/usr/include/sys/siginfo.h:428: error: parse error before '}' token
/usr/include/sys/siginfo.h:432: error: parse error before "k_siginfo_t"
/usr/include/sys/siginfo.h:437: error: parse error before '}' token
In file included from /usr/include/signal.h:26,
from common.h:250,
from file.c:38:
/usr/include/sys/signal.h:85: error: parse error before "siginfo_t"
In file included from common.h:250,
from file.c:38:
/usr/include/signal.h:111: error: parse error before "siginfo_t"
/usr/include/signal.h:113: error: parse error before "siginfo_t"
In file included from common.h:251,
from file.c:38:
/usr/include/sys/wait.h:86: error: parse error before "siginfo_t"
make[1]: *** [file.o] Error 1
make[1]: Leaving directory `/root/syslogNG/stunnel-4.26/src'
make: *** [all-recursive] Error 1
Is that normal that i've 2 signal.h files ?
1
0
On Friday 16 January 2009, aaa aaa wrote:
> Hello,
Moin,
> I am using last edition of stunnel. I would like to use my favourite ftp
> client and connect to sftp. But my ftp clinet don't allow this so I would
> like to use stunnel if possible. How should I configure stunnel to do this
> (ports etc.)? I am a newbie with stunnel but I am using it for sending
> email for several weeks and everything works well. So I hope it is possible
> to use it for sftp too.
there are 2 'save' ftp enhancement: sftp and ftps. While 'sftp' means 'ftp
over ssh' stand 'ftps' for 'ftp over ssl'.
So stunnel is the wrong tool if you have to use ftps.
Please check http://www.stunnel.org/examples/ftp.html for more information
about stunnel and ftp.
CU
--
|Michael Renner E-mail: michael.renner(a)gmx.de |
|D-81541 Munich Germany ICQ: #112280325 |
|Germany Don't drink as root! ESC:wq
2
2
I do not think that this can work. SFTP is not just encrypted FTP traffic, but an entirely different protocol.
Justin
________________________________
From: aaa aaa [mailto:[email protected]]
Sent: Friday, January 16, 2009 7:58 AM
To: stunnel-users(a)mirt.net
Subject: ftp to sftp
Hello,
I am using last edition of stunnel. I would like to use my favourite ftp client and connect to sftp. But my ftp clinet don't allow this so I would like to use stunnel if possible. How should I configure stunnel to do this (ports etc.)? I am a newbie with stunnel but I am using it for sending email for several weeks and everything works well. So I hope it is possible to use it for sftp too.
Any help much appreciated.
thanks in advance.
----------
1
0
For some strange reason, there are five hex 09 bytes in
stunnel-4.26/src/Makefile.am. This broke my Cygwin build: I remove the
Windows-only stuff from this file for Cygwin, and diff captured the 0x09
characters that got removed, but then when I later tried to apply the patch,
patch choked on them.
It seems that each of these bytes should really be 0x0A. Strange.
Andrew.
2
2
13 Jan '09
On Jan 13, 2009, at 11:07 AM, Karl J. Runge wrote:
> On Tue, 13 Jan 2009, "D. Richard Hipp" <drh(a)hwaci.com> wrote:
>>
>> I'm sure I could get something like that to work on Unix.
>> Unfortunately, I need a cross-platform solution:; unix & windows.
>> And
>> (as usual) the windows side is harder to work around.
>>
>> What I really need to do is send a known amount of binary data in a
>> file over an SSL connection to a remote machine, then get back the
>> reply of unknown length into a separate file:
>>
>> stunnel test.conf <test.in >test.out
>>
>> I'm open to any suggestions on how to do this, (such that it will
>> work
>> on unix and windows).
>
> So it is not an https URL like in your example? If it were, perhaps
> wget or curl for windows would be a better path than stunnel.
I'm using a simple web-page fetch for debugging. In actual use, the
situation is more complicated and wget and curl won't work. Thx for
the suggestion, though.
>
>
> socat might be ported to windows, I'm not sure. If writing a small C
> wrapper program for Windows is not acceptable, I'm not sure what you
> can do.
socat appears to be linux-mostly. (They have a MacOS-X port, which
suggests that it is not even "unix" neutral.) So I'm guessing that
windows is out of the question there.
Looks like I'm just going to have to bite the bullet and link against
OpenSSL directly.....
>
>
>
> BTW, I have made a one-time connection patch to stunnel that I use
> with
> my VNC tool SSVNC:
>
> http://libvncserver.cvs.sourceforge.net/viewvc/libvncserver/libvncserver/x1…
>
> It is a hack, but useful. My VNC tool works OK with stock stunnel
> (everything else equal I prefer using), but I also distribute a
> patched
> stunnel for more reliable behavior in this one-time client connect
> mode.
>
> Karl
>
D. Richard Hipp
drh(a)hwaci.com
2
1
Re: [stunnel-users] How do I do a one-time client connection?
by stunnel-hm＠karlrunge.com 13 Jan '09
by stunnel-hm＠karlrunge.com 13 Jan '09
13 Jan '09
On Tue, 13 Jan 2009, "D. Richard Hipp" <drh(a)hwaci.com> wrote:
>
> Apparently stunnel will work as a pipe if I create a config file like
> this:
>
> client=yes
> connect=remosthost:port
>
> Then run stunnel and talk over standard input and standard output.
One problem I have found in doing this is that if socketpair(2) is used
to create the file descriptor that will be connected to stunnel's stdio,
then stunnel's libwrap checking is activated because it detects it to
be a socket.
Using socketpair is a nice way to turn a TCP client into one that connects
via a two-way pipe with stunnel (because the client app doesn't have
to special case the two file descriptors for stunnel's stdin and stdout
when reading and writing.)
Since a user (i.e. not a sysadmin) has no control over the libwrap settings
in /etc, stunnel's libwrap check will always fail when used this way.
In my opinion, stunnel should allow disabling of libwrap (and syslog too)
via the config file (i.e. not just compile time options). This makes the
"one connection" client usage you describe work better.
Karl
1
0
13 Jan '09
Perhaps I spoke too soon about having solved my own problem.
Suppose I have a configuration file (test.conf) like this:
client=yes
connect=www.fossil-scm.org:443
Then if I run:
stunnel test.conf
And I type "GET / HTTP/1.0" on standard input, the webpage comes back
on standard output. So far so good. But if I do:
stunnel test.conf <test.in >test.out
Where file test.in contains the "GET / HTTP/1.0" test, I get nothing
back! I also tried this:
cat test.in | stunnel test.conf
And various combinations of this:
openssl s_client -connect www.fossil-scm.org:443 <test.in
In every case, when I type the GET line on standard input it works.
When I redirect from a file it does not. Any hints on the cause of
the very unexpected and very mysterious behavior?
D. Richard Hipp
drh(a)hwaci.com
1
0
I'd like to invoke stunnel to handle a single SSL client-side
connection (talking to an SSL server) with the assurance that the
stunnel quit will automatically quit after that one connection
closes. I did not see any options to support this. Did I overlook
something, or is stunnel just not able to do this?
D. Richard Hipp
drh(a)hwaci.com
1
1
public domain [PATCH] to stunnel 4.27b1 for Windows CE / Windows Mobile compilation and unicode bug fixes
by Pierre DELAAGE 10 Jan '09
by Pierre DELAAGE 10 Jan '09
10 Jan '09
Dear Sir,
Please find enclosed a patch in "diff -cr orig work" format, applying to
stunnel4.27b1 as found here ftp://stunnel.mirt.net/stunnel/.
This patch maily addresses compilation and unicode issues for Windows CE
targets.
I use MS EVC 4sp2 compiler with WCE 420 SDK, on a vista host platform.
Once debugged the code works fine on WM5 and WM6 HTC smartphones.
It needs a windows CE openssl lib (I logged a patch to openssl snap
20090102 because it has some compilation issues on windows CE platform).
* For the sake of completeness openssl 098i and 098j (latest) must be
ALSO patched to compile for wince, with this patch I submitted to
openssl team :
http://marc.info/?l=openssl-dev&m=123099015013538&w=2
The present stunnel patch addresses the following issues :
1/ COMPILATION FAILURE : on common.h "EINVAL redefinition" :
in fact the compile options WX (see evc.mak) does not tolerate any
warning :
to avoid a warning on EINVAL redef, we must protect this undef by ifdef.
Note that there is still a problem : if the symbol is NOT defined at
all, it will NEVER be defined by that revised code : this is because the
compiler always generate an error if it sees something like :
#ifdef EINVAL
#undef EINVAL
#define EINVAL WSAEINVAL
#else
#define EINVAL WSAEINVAL
#endif
because it seems to not like two defines even separated by a else.
Just putting the #define outside of a block dealing with undef, does not
solve the compilation issue.
2/ COMPILATION FAILURE : related to wcecompat/setjmp.h
SOLUTION : in evc.mak, needed /D ARM to compile with wcecompat/setjmp.h.
This symbol is not documented in MSDN but clearly present is header files.
Moreover It is consistent with other processor symbols described in the sdk.
3/ COMPILATION FAILURE : related to gui.c
pb with undeclared hmainmenu identifier, because "endif use_win32"
misplaced.
3/ RC COMPILATION FAILURE : related to resources.rc
CAUSE : "VERSION" unknown
SOLUTION : /dversion in rflags in evc.mak
4/ LINK ERROR : fatal error LNK1181: cannot open input file 'libeay32.lib'
cause : bad path name in evc.mak for openssl lib.
since openssl >> 098a (eg 098h) "out32dll" folder is named
"out32dll_targetCPU".
5/ LINK ERROR on gui.obj : error LNK2001: unresolved external symbol
_beginthread
_$(TARGETCPU)
Cause : in sthreads.c, misplaced "#endif os2"
Note : corrected various erroneous comments on #if endif in sthreads.c
************* OPERATIONAL ERRORS (at run-time)
using stunnel to enable certificate based authentication for POPS/SMPTPS
between a smartphone and a linux server,
I faced this problems :
When first trying to authenticate a dlgbox is displayed on the
smartphone to input the password of the private key protecting the
client certificate:
6/ RUN-TIME ERROR : "squares" displayed instead of chars in "password
input dialog box" titlebar
Well, this is only a cosmetic issue, but this is still an issue.
Cause : this is a typical unicode issue in gui.c pass_proc/wm_initdialog :
the sendmessage to display the title uses a concatenation of two strings :
a constant extracted from the resource file, and converted to wchar by
TEXT macro in unicode context,
and a key file name given by ui_data->section->key.
The problem is that the file name is always of type 8bit char,
leading to concatenation "scrambling" when concatenated with a unicode
string.
SOLUTION : it seems not possible to change the type of
ui_data->section->key to tchar/wchar because it is used
in various ansi code. So the simplest way to correct this pb is just to
make a local conversion from ansi to tchar in gui.c/pass_proc/initdialog
7/ RUN-TIME ERROR : It is impossible to validate a password on a private
key protecting a certificate:
The password is ALWAYS rejected (after many tests with 3 retries).
Cause : the password is input as unicode (because the message EM_GETLINE
on the control IDE_PASSEDIT is unicode ready) but stored and managed as
an ansi string
so the password can never be validated.
NOTE : contrary to the documentation of windows CE sdk, the EM_GETLINE
msg IS REALLY unicode ready. Indeed this is also the case in classic
win32 sdk for PC platform (described in the msdn library).
SOLUTION : the input password must be converted to ansi before being
validated vs openssl
2009.01.05 13:00:01 LOG3[4849170:5712826]: Wrong pass phrase: retrying
2009.01.05 13:00:05 LOG3[4849170:5712826]: error stack: 140B3009 :
error:140B3009:SSL routines:SSL_CTX_use_RSAPrivateKey_file:PEM lib
2009.01.05 13:00:05 LOG3[4849170:5712826]: error stack: 906A065 :
error:0906A065:PEM routines:PEM_do_header:bad decrypt
2009.01.05 13:00:05 LOG3[4849170:5712826]:
SSL_CTX_use_RSAPrivateKey_file: 6065064: error:06065064:digital envelope
routines:EVP_DecryptFinal_ex:bad decrypt
2009.01.05 13:00:05 LOG3[4849170:5712826]: Server is down
I hope you will find this patch useful.
Thank you for your excellent work,
Yours sincerely and happy new year,
Pierre Delaage
Note : I use stunnel to establish a simple "vpn" between smartphones and
a corporate linux server mainly for HTTPS/POPS/SMTPS support.
Stunnel is very relevant in that matter, over solutions based on SSH
(although we use also ssh), from a communication cost point of view :
ssh establishes permanent socket between client and server, so that the
communication is charged by the mobile network provider : and these
charges are very expensive.
On the contrary stunnel only establishes ssl sockets on demand so that
financial charges are limited to strict necessary.
Please note that stunnel brings "client based certificate
authentication" to POP/SMTP mobile mail user agents which only supports
SSL with server authentication, but NO client authentication, such as
mobile outlook.Here again stunnel is very relevant.
Note 2 : the unicode bug fixes should benefit also to the win32 stunnel
version for PC.
Note 3 : this mail has also been sent to webmaster(a)stunnel.org, but with
no response at all.
Only in work/src: client.obj
diff -cr orig/src/common.h work/src/common.h
*** orig/src/common.h 2008-09-01 08:06:24.000000000 +0200
--- work/src/common.h 2009-01-05 23:16:03.052680000 +0100
***************
*** 187,198 ****
#define EINPROGRESS WSAEINPROGRESS
#define EWOULDBLOCK WSAEWOULDBLOCK
#define EISCONN WSAEISCONN
! #undef EINVAL
#define EINVAL WSAEINVAL
#include <process.h> /* _beginthread */
#include <tchar.h>
#define NO_IDEA
#define OPENSSL_NO_IDEA
--- 187,204 ----
#define EINPROGRESS WSAEINPROGRESS
#define EWOULDBLOCK WSAEWOULDBLOCK
#define EISCONN WSAEISCONN
!
! #ifdef EINVAL // pdelaage, required to avoid compilation "error", see WX option in evc.mak and ms-evc420 compiler
! #undef EINVAL // TODO : if einval is not defined, this code does not define it; but putting a #define in an #else leads again to compilation error!
#define EINVAL WSAEINVAL
+ #endif
+
#include <process.h> /* _beginthread */
#include <tchar.h>
+
+
#define NO_IDEA
#define OPENSSL_NO_IDEA
Only in work/src: ctx.obj
diff -cr orig/src/evc.mak work/src/evc.mak
*** orig/src/evc.mak 2008-09-20 22:23:21.000000000 +0200
--- work/src/evc.mak 2009-01-04 10:09:32.439894500 +0100
***************
*** 1,23 ****
# wce.mak for stunnel.exe by Michal Trojnara 2006
#
! WCEVER=300
# Modify this to point to your actual openssl compile directory
# (You did already compile openssl, didn't you???)
! SSLDIR=..\..\build\openssl-0.9.8i
! COMPATDIR=..\..\build\wcecompat
CEUTILSDIR=..\..\ceutils
DSTDIR=ce:\stunnel
- SDKDIR=C:\Windows CE Tools\wce$(WCEVER)\Pocket PC 2002
! INCLUDES=-I$(SSLDIR)/inc32 -I$(COMPATDIR)\include -I"$(SDKDIR)\include"
LIBS=libeay32.lib ssleay32.lib wcecompatex.lib winsock.lib
! CC=CL$(TARGETCPU)
! CFLAGS=/nologo /MC /O1i /W3 /WX /GF /Gy /DHOST=\"$(TARGETCPU)-WCE-eVC-$(WCEVER)\" /D$(TARGETCPU) /DUNDER_CE=$(WCEVER) /D_WIN32_WCE=$(WCEVER) /DUNICODE -D_UNICODE $(INCLUDES)
! RFLAGS=$(INCLUDES)
! LDFLAGS=/nologo /subsystem:windowsce,3.00 /machine:ARM /libpath:"$(SDKDIR)\lib\$(TARGETCPU)" /libpath:"$(COMPATDIR)\lib" /libpath:"$(SSLDIR)\out32dll"
OBJS=stunnel.obj ssl.obj ctx.obj verify.obj file.obj client.obj protocol.obj sthreads.obj log.obj options.obj network.obj resolver.obj
GUIOBJS=gui.obj resources.res
--- 1,35 ----
# wce.mak for stunnel.exe by Michal Trojnara 2006
#
! WCEVER=420
! # pdelaage : following flag required by (eg) winnt.h, and is different from targetcpu (armV4)
! WCETARGETCPU=ARM
# Modify this to point to your actual openssl compile directory
# (You did already compile openssl, didn't you???)
! SSLDIR=C:\Users\standard\Documents\Dvts\Contrib\openssl\openssl-0.9.8-stable-SNAP-20090102\openssl-0.9.8-stable-SNAP-20090102
! COMPATDIR=C:\Users\standard\Documents\Dvts\openssl\build\wcecompat
! # pdelaage : ceutilsdir probably useless
CEUTILSDIR=..\..\ceutils
+ # pdelaage "ce:" is not a correct location , but we never "make install"
DSTDIR=ce:\stunnel
! SDKDIR="C:\Progra~1\Micros~2\wce$(WCEVER)\standardsdk"
!
! # pdelaage eroneous path for sdkdir INCLUDES=-I$(SSLDIR)/inc32 -I$(COMPATDIR)\include -I"$(SDKDIR)\include"
! INCLUDES=-I$(SSLDIR)\inc32 -I$(COMPATDIR)\include -I"$(SDKDIR)\include\$(TARGETCPU)"
LIBS=libeay32.lib ssleay32.lib wcecompatex.lib winsock.lib
! # not correct because for armv4 cc is just clarm.exe. Moreover cc is already set in the ms wce$TARGETCPU.bat script, so it is not necessary to set it up here
! # CC=CL$(TARGETCPU)
!
! VERSION=4.27
! DEFINES=/DVERSION=\"$(VERSION)\"
! # pdelaage added wcetargetcpu to cflags
! CFLAGS=/nologo /MC /O1i /W3 /WX /GF /Gy $(DEFINES) /DHOST=\"$(TARGETCPU)-WCE-eVC-$(WCEVER)\" /D$(WCETARGETCPU) /D$(TARGETCPU) /DUNDER_CE=$(WCEVER) /D_WIN32_WCE=$(WCEVER) /DUNICODE -D_UNICODE $(INCLUDES)
! RFLAGS=/DVERSION=\"$(VERSION)\" $(INCLUDES)
! # pdelaage : LDFLAGS: since openssl >> 098a (eg 098h) out32dll is out32dll_targetCPU
! LDFLAGS=/nologo /subsystem:windowsce,3.00 /machine:ARM /libpath:"$(SDKDIR)\lib\$(TARGETCPU)" /libpath:"$(COMPATDIR)\lib" /libpath:"$(SSLDIR)\out32dll_$(TARGETCPU)"
OBJS=stunnel.obj ssl.obj ctx.obj verify.obj file.obj client.obj protocol.obj sthreads.obj log.obj options.obj network.obj resolver.obj
GUIOBJS=gui.obj resources.res
Only in work/src: file.obj
diff -cr orig/src/gui.c work/src/gui.c
*** orig/src/gui.c 2008-05-02 08:23:03.000000000 +0200
--- work/src/gui.c 2009-01-04 23:45:07.451820500 +0100
***************
*** 320,329 ****
hwnd=CreateWindow(classname, win32_name, WS_TILEDWINDOW,
CW_USEDEFAULT, CW_USEDEFAULT, CW_USEDEFAULT, CW_USEDEFAULT,
NULL, hmainmenu, hInstance, NULL);
! #endif
if(cmdline.service) /* do not allow to save file in the service mode */
EnableMenuItem(hmainmenu, IDM_SAVEAS, MF_GRAYED);
if(error_mode) /* log window is hidden by default */
set_visible(1);
--- 320,330 ----
hwnd=CreateWindow(classname, win32_name, WS_TILEDWINDOW,
CW_USEDEFAULT, CW_USEDEFAULT, CW_USEDEFAULT, CW_USEDEFAULT,
NULL, hmainmenu, hInstance, NULL);
! // commented by pdelaage on 20090104 #endif
if(cmdline.service) /* do not allow to save file in the service mode */
EnableMenuItem(hmainmenu, IDM_SAVEAS, MF_GRAYED);
+ #endif // added by pdelaage on 20090104
if(error_mode) /* log window is hidden by default */
set_visible(1);
***************
*** 523,536 ****
WPARAM wParam, LPARAM lParam) {
TCHAR titlebar[STRLEN];
WORD cchPassword;
switch (message) {
case WM_INITDIALOG:
/* Set the default push button to "Cancel." */
SendMessage(hDlg, DM_SETDEFID, (WPARAM) IDCANCEL, (LPARAM) 0);
_sntprintf(titlebar, STRLEN, TEXT("Private key: %s"),
! ui_data->section->key);
SetWindowText(hDlg, titlebar);
return TRUE;
--- 524,548 ----
WPARAM wParam, LPARAM lParam) {
TCHAR titlebar[STRLEN];
WORD cchPassword;
+ LPTSTR keyFileName;// added by pdelaage on 20090104
+ TCHAR sPassword[PEM_BUFSIZE];// added by pdelaage on 20090104
+ char* cPassword;// added by pdelaage on 20090104
switch (message) {
case WM_INITDIALOG:
/* Set the default push button to "Cancel." */
SendMessage(hDlg, DM_SETDEFID, (WPARAM) IDCANCEL, (LPARAM) 0);
+ // pdelaage on 20090104: here was a bug : _sntprintf is unicode ready but ui_data->section->key is always char.
+ // commented by pdelaage on 20090104 _sntprintf(titlebar, STRLEN, TEXT("Private key: %s"),
+ // ui_data->section->key);
+
+ keyFileName = str2tstr(ui_data->section->key);
_sntprintf(titlebar, STRLEN, TEXT("Private key: %s"),
! keyFileName);
! free(keyFileName);
!
!
SetWindowText(hDlg, titlebar);
return TRUE;
***************
*** 549,561 ****
}
/* Put the number of characters into first word of buffer. */
! *((LPWORD)ui_data->pass) = cchPassword;
/* Get the characters. */
SendDlgItemMessage(hDlg, IDE_PASSEDIT, EM_GETLINE,
! (WPARAM) 0, /* line 0 */ (LPARAM) ui_data->pass);
! ui_data->pass[cchPassword] = 0; /* Null-terminate the string. */
EndDialog(hDlg, TRUE);
return TRUE;
--- 561,580 ----
}
/* Put the number of characters into first word of buffer. */
! *((LPWORD) sPassword) = cchPassword;
/* Get the characters. */
SendDlgItemMessage(hDlg, IDE_PASSEDIT, EM_GETLINE,
! (WPARAM) 0, /* line 0 */ (LPARAM) sPassword);// pdelaage ui_data->pass);
!
! sPassword[cchPassword] = 0; /* Null-terminate the string. */
!
! // convert input password to ANSI string (as ui_data->pass)
! cPassword = tstr2str(sPassword);
! strcpy(ui_data->pass, cPassword);
! free(cPassword);
!
EndDialog(hDlg, TRUE);
return TRUE;
Only in work/src: gui.obj
Only in work/src: log.obj
diff -cr orig/src/makece.bat work/src/makece.bat
*** orig/src/makece.bat 2005-12-23 20:57:24.000000000 +0100
--- work/src/makece.bat 2009-01-03 19:31:34.507379500 +0100
***************
*** 1,3 ****
@echo off
! call "C:\Program Files\Microsoft eMbedded Tools\EVC\WCE300\BIN\WCEARM.BAT"
nmake /NOLOGO -f evc.mak %1 %2 %3 %4 %5 %6 %7 %8 %9
--- 1,4 ----
@echo off
! ::call "C:\Program Files\Microsoft eMbedded Tools\EVC\WCE300\BIN\WCEARM.BAT"
! call "C:\Progra~1\MSEVC4\EVC\WCE420\BIN\WCEARMV4.BAT"
nmake /NOLOGO -f evc.mak %1 %2 %3 %4 %5 %6 %7 %8 %9
Only in work/src: network.obj
Only in work/src: nogui.obj
Only in work/src: options.obj
Only in work/src: protocol.obj
Only in work/src: resolver.obj
Only in work/src: resources.RES
Only in work/src: ssl.obj
diff -cr orig/src/sthreads.c work/src/sthreads.c
*** orig/src/sthreads.c 2008-09-21 21:44:06.000000000 +0200
--- work/src/sthreads.c 2009-01-04 10:46:46.285200500 +0100
***************
*** 400,406 ****
return 0;
}
! #endif
#ifdef USE_OS2
--- 400,406 ----
return 0;
}
! #endif /* cmt added by pdelaage on 20090104 : USE_WIN32 */
#ifdef USE_OS2
***************
*** 437,442 ****
--- 437,444 ----
return 0;
}
+ #endif /* USE_OS2 */ // added by pdelaage on 20090104
+
#ifdef _WIN32_WCE
int _beginthread(void (*start_address)(void *),
***************
*** 456,464 ****
ExitThread(0);
}
! #endif /* !defined(_WIN32_WCE) */
! #endif /* USE_WIN32 */
#ifdef DEBUG_STACK_SIZE
--- 458,467 ----
ExitThread(0);
}
! #endif /* _WIN32_WCE */ /* pdelaage 20090104, following cmt is improper: !defined(_WIN32_WCE) */
! // pdelaage 20090104 : following endif is misplaced, the endif usewin32 is already placed upper, but this endif relates
! // to os2, and is misplaced because it "squeezes" winCE code #endif /* USE_WIN32 */
#ifdef DEBUG_STACK_SIZE
Only in work/src: sthreads.obj
Files orig/src/stunnel.exe and work/src/stunnel.exe differ
Only in work/src: stunnel.obj
Only in work/src: tstunnel.exe
Only in work/src: verify.obj
1
0
Re: [stunnel-users] Distinguished Name (DN) is a cleartext network communication?
by Christophe Nanteuil 09 Jan '09
by Christophe Nanteuil 09 Jan '09
09 Jan '09
2009/1/8 Michael Renner <michael.renner(a)gmx.de>:
> A server should appear like a a 'normal' https webserver to others. More or
> less interesting, or just a 404 error message. However: it should appear
> harmless to others, just like a webserver.
> Behind this should work a proxy server (squid). Only authorized users should
> be able to use it.
>
If I understand well what you want to do, I think my patch
"Identification Propagation patch using stunnel client certificates"
can be useful :
- Use my stunnel patch
Using squid as a proxy :
- In stunnel config file : select pertinent fields of the certiificate
: DN -> identFields=1023
- Get a squid version compiled with --enable-ident-lookups option
- In squid : use a home-made external authentification program which
returns ok if the DN provided is good. Squid documentation will tell
you what is the need for the home-made authentification program.
I think it's easier with DansGuardian proxy :
- In stunnel config file : select pertinent fields of the certiificate
: only Issuer_CN -> identFields=32
- in /etc/dansguardian/dansguardian.conf, create 2 groups :
filtergroups = 2
filtergroupslist = '/etc/dansguardian/lists/filtergroupslist'
- create filter groups in /etc/dansguardian/lists/filtergroupslist.
(All not matching users will go in group 1) :
put a line like "your issuer CN equals 2"
- in /etc/dansguardian/dansguardianf1.conf, put "groupmode=0" , ie banned
- in /etc/dansguardian/dansguardianf2.conf, put "groupmode=2" , ie non filtered
Note that the authentification of the users is done by stunnel.
Stunnel forwards the identification to the proxy which does not need
to authenticate since it was done by stunnel.
If the ident provided by my patch is not convenient, you can modify it
to match your needs.
Hope this helps
--
Christophe Nanteuil
1
0