Hi,
I've been trying to compile stunner (4.47) on a power pc Mac OS X Leopard (OS X 10.5) platform after a manual update to openssl v.1.0.0.e
ggc is version 4.0.1.
I run into an error according to which there would be undefined symbols in stunnel-ctx.o (see make output below).
I can't figure out to which feature stunner-ctx.o is related, whether I need this feature and how to disable it in ./configure if I don't need it.
Please note that I managed to install stunner 4.46 via fink on the same machine (such fink install of stunnel required installing a specific instance of openssl (v.1.0.0.0.e) within fink).
Would anyone be able to identify from the make output below whether the issue comes from stunnel or from my openssl manual install?
Many thanks.
Cedric
Making all in src
make all-am
/bin/sh ../libtool --tag=CC --mode=compile gcc -DHAVE_CONFIG_H -I. -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT env.lo -MD -MP -MF .deps/env.Tpo -c -o env.lo env.c
libtool: compile: gcc -DHAVE_CONFIG_H -I. -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT env.lo -MD -MP -MF .deps/env.Tpo -c env.c -fno-common -DPIC -o .libs/env.o
mv -f .deps/env.Tpo .deps/env.Plo
/bin/sh ../libtool --tag=CC --mode=link gcc -g -O2 -Wall -Wextra -Wno-long-long -pedantic -avoid-version -o libstunnel.la -rpath /usr/local/lib/stunnel env.lo -lz -ldl -lutil -lpthread -lwrap
libtool: link: gcc -dynamiclib -Wl,-undefined -Wl,dynamic_lookup -o .libs/libstunnel.dylib .libs/env.o -lz -ldl -lutil -lpthread -lwrap -install_name /usr/local/lib/stunnel/libstunnel.dylib -Wl,-single_module
libtool: link: dsymutil .libs/libstunnel.dylib || :
libtool: link: ( cd ".libs" && rm -f "libstunnel.la" && ln -s "../libstunnel.la" "libstunnel.la" )
gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-str.o -MD -MP -MF .deps/stunnel-str.Tpo -c -o stunnel-str.o `test -f 'str.c' || echo './'`str.c
mv -f .deps/stunnel-str.Tpo .deps/stunnel-str.Po
gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-file.o -MD -MP -MF .deps/stunnel-file.Tpo -c -o stunnel-file.o `test -f 'file.c' || echo './'`file.c
mv -f .deps/stunnel-file.Tpo .deps/stunnel-file.Po
gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-client.o -MD -MP -MF .deps/stunnel-client.Tpo -c -o stunnel-client.o `test -f 'client.c' || echo './'`client.c
mv -f .deps/stunnel-client.Tpo .deps/stunnel-client.Po
gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-log.o -MD -MP -MF .deps/stunnel-log.Tpo -c -o stunnel-log.o `test -f 'log.c' || echo './'`log.c
mv -f .deps/stunnel-log.Tpo .deps/stunnel-log.Po
gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-options.o -MD -MP -MF .deps/stunnel-options.Tpo -c -o stunnel-options.o `test -f 'options.c' || echo './'`options.c
mv -f .deps/stunnel-options.Tpo .deps/stunnel-options.Po
gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-protocol.o -MD -MP -MF .deps/stunnel-protocol.Tpo -c -o stunnel-protocol.o `test -f 'protocol.c' || echo './'`protocol.c
mv -f .deps/stunnel-protocol.Tpo .deps/stunnel-protocol.Po
gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-network.o -MD -MP -MF .deps/stunnel-network.Tpo -c -o stunnel-network.o `test -f 'network.c' || echo './'`network.c
mv -f .deps/stunnel-network.Tpo .deps/stunnel-network.Po
gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-resolver.o -MD -MP -MF .deps/stunnel-resolver.Tpo -c -o stunnel-resolver.o `test -f 'resolver.c' || echo './'`resolver.c
mv -f .deps/stunnel-resolver.Tpo .deps/stunnel-resolver.Po
gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-ssl.o -MD -MP -MF .deps/stunnel-ssl.Tpo -c -o stunnel-ssl.o `test -f 'ssl.c' || echo './'`ssl.c
mv -f .deps/stunnel-ssl.Tpo .deps/stunnel-ssl.Po
gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-ctx.o -MD -MP -MF .deps/stunnel-ctx.Tpo -c -o stunnel-ctx.o `test -f 'ctx.c' || echo './'`ctx.c
mv -f .deps/stunnel-ctx.Tpo .deps/stunnel-ctx.Po
gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-verify.o -MD -MP -MF .deps/stunnel-verify.Tpo -c -o stunnel-verify.o `test -f 'verify.c' || echo './'`verify.c
mv -f .deps/stunnel-verify.Tpo .deps/stunnel-verify.Po
gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-sthreads.o -MD -MP -MF .deps/stunnel-sthreads.Tpo -c -o stunnel-sthreads.o `test -f 'sthreads.c' || echo './'`sthreads.c
mv -f .deps/stunnel-sthreads.Tpo .deps/stunnel-sthreads.Po
gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-stunnel.o -MD -MP -MF .deps/stunnel-stunnel.Tpo -c -o stunnel-stunnel.o `test -f 'stunnel.c' || echo './'`stunnel.c
stunnel.c: In function 'daemonize':
stunnel.c:447: warning: 'daemon' is deprecated (declared at /usr/include/stdlib.h:283)
stunnel.c: At top level:
stunnel.c:70: warning: 'signal_pipe_redirect' declared 'static' but never defined
mv -f .deps/stunnel-stunnel.Tpo .deps/stunnel-stunnel.Po
gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-pty.o -MD -MP -MF .deps/stunnel-pty.Tpo -c -o stunnel-pty.o `test -f 'pty.c' || echo './'`pty.c
mv -f .deps/stunnel-pty.Tpo .deps/stunnel-pty.Po
gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-libwrap.o -MD -MP -MF .deps/stunnel-libwrap.Tpo -c -o stunnel-libwrap.o `test -f 'libwrap.c' || echo './'`libwrap.c
mv -f .deps/stunnel-libwrap.Tpo .deps/stunnel-libwrap.Po
/bin/sh ../libtool --tag=CC --mode=link gcc -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -L/usr/local/ssl/lib64 -L/usr/local/ssl/lib -lssl -lcrypto -o stunnel stunnel-str.o stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o -lz -ldl -lutil -lpthread -lwrap
libtool: link: gcc -pthread -fstack-protector -g -O2 -Wall -Wextra -Wno-long-long -pedantic -o stunnel stunnel-str.o stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o -L/usr/local/ssl/lib64 -L/usr/local/ssl/lib -lssl -lcrypto -lz -ldl -lutil -lpthread -lwrap -pthread
Undefined symbols:
"_EC_KEY_new_by_curve_name", referenced from:
_context_init in stunnel-ctx.o
"_SSL_get_servername", referenced from:
_servername_cb in stunnel-ctx.o
"_SSL_CTX_sess_set_get_cb", referenced from:
_context_init in stunnel-ctx.o
"_SSL_CTX_set_info_callback", referenced from:
_context_init in stunnel-ctx.o
"_BIO_set_flags", referenced from:
_base64 in stunnel-protocol.o
"_SSL_set_SSL_CTX", referenced from:
_servername_cb in stunnel-ctx.o
"_SSL_CTX_sess_set_new_cb", referenced from:
_context_init in stunnel-ctx.o
"_SSL_CTX_sess_set_remove_cb", referenced from:
_context_init in stunnel-ctx.o
"_EC_KEY_free", referenced from:
_context_init in stunnel-ctx.o
ld: symbol(s) not found
collect2: ld returned 1 exit status
make[2]: *** [stunnel] Error 1
make[1]: *** [all] Error 2
make: *** [all-recursive] Error 1
2
3
Hi,
I am trying to connect to a remote SSL enabled server via stunnel. I am using a single file for key and certificate "sunStunnel.pem", just like the default "stunnel.pem" and I am getting following errors. Please let me know, what they mean and what should be done to resolve these?
Note: I was able to telnet the machine, so server seems to be working.
Thanks.
=======
Config
=======
debug = 7
output = stunnel.log
cert = sunStunnel.pem
[GPC-HOST]
client = yes
[syslog]
accept = 127.0.0.1:2525
connect = <ip>:<port>
=======
Log
=======
No limit detected for the number of clients
make_sockets: s_socket#1: FD=652 allocated (blocking mode)
make_sockets: s_socket#2: FD=648 allocated (blocking mode)
make_sockets: s_accept: FD=604 allocated (non-blocking mode)
stunnel 4.47 on x86-pc-mingw32-gnu platform
Compiled/running with OpenSSL 1.0.0e 6 Sep 2011
Threading:WIN32 SSL:ENGINE Auth:none Sockets:SELECT,IPv6
Reading configuration from file stunnel.conf
Snagged 64 random bytes from C:/.rnd
Wrote 1024 new random bytes to C:/.rnd
PRNG seeded successfully
Initializing SSL context for service GPC-HOST
Certificate: sunStunnel.pem
Certificate loaded
Key file: sunStunnel.pem
error queue: 140B0009: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib
error queue: 907B00D: error:0907B00D:PEM routines:PEM_READ_BIO_PRIVATEKEY:ASN1 lib
error queue: D08303A: error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error
error queue: D06C03A: error:0D06C03A:asn1 encoding routines:ASN1_D2I_EX_PRIMITIVE:nested asn1 error
SSL_CTX_use_PrivateKey_file: D0680A8: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
Server is down
Kind Regards,
Hamid Shahid
2
1
error queue: 140B0009: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib
by Hamid.Shahid＠sungard.com 28 Nov '11
by Hamid.Shahid＠sungard.com 28 Nov '11
28 Nov '11
Hi,
I am trying to connect to a remote SSL enabled server via stunnel. I am using a single file for key and certificate "sunStunnel.pem", just like the default "stunnel.pem" and I am getting following errors. Please let me know, what they mean and what should be done to resolve these?
Note: I was able to telnet the machine, so server seems to be working.
Thanks.
=======
Config
=======
debug = 7
output = stunnel.log
cert = sunStunnel.pem
[GPC-HOST]
client = yes
[syslog]
accept = 127.0.0.1:2525
connect = <ip>:<port>
=======
Log
=======
No limit detected for the number of clients
make_sockets: s_socket#1: FD=652 allocated (blocking mode)
make_sockets: s_socket#2: FD=648 allocated (blocking mode)
make_sockets: s_accept: FD=604 allocated (non-blocking mode)
stunnel 4.47 on x86-pc-mingw32-gnu platform
Compiled/running with OpenSSL 1.0.0e 6 Sep 2011
Threading:WIN32 SSL:ENGINE Auth:none Sockets:SELECT,IPv6
Reading configuration from file stunnel.conf
Snagged 64 random bytes from C:/.rnd
Wrote 1024 new random bytes to C:/.rnd
PRNG seeded successfully
Initializing SSL context for service GPC-HOST
Certificate: sunStunnel.pem
Certificate loaded
Key file: sunStunnel.pem
error queue: 140B0009: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib
error queue: 907B00D: error:0907B00D:PEM routines:PEM_READ_BIO_PRIVATEKEY:ASN1 lib
error queue: D08303A: error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error
error queue: D06C03A: error:0D06C03A:asn1 encoding routines:ASN1_D2I_EX_PRIMITIVE:nested asn1 error
SSL_CTX_use_PrivateKey_file: D0680A8: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
Server is down
Kind Regards,
Hamid Shahid
[cid:[email protected]]<http://www.sungard.com/ten>
Hamid Shahid * Integration Developer * Front Arena * Capital Markets * SunGard * Kungsbron 2, PO Box 70351, SE-107 24 Stockholm, Sweden * Tel +46 (0) 8 454 0167 * Direct +46 (0) 8 454 0167 * Mobile +46 (0) 76 869 2167 * hamid.shahid(a)sungard.com<mailto:[email protected]> * www.sungard.com<http://www.sungard.com/>
Join SunGard's customers, partners and industry experts at www.sungard.com/ten<http://www.sungard.com/ten> to discuss how the need for more Transparency, Efficiency and Networks is changing our industry and to register for a city day event near you.
VIENNA HOUSTON FRANKFURT BEIJING HONG KONG NEW YORK LONDON SEOUL ZURICH MUMBAI JOHANNESBURG DUBAI SAO PAULO
CONFIDENTIALITY: This e-mail (including any attachments) may contain confidential, proprietary and privileged information, and unauthorized disclosure or use is prohibited. If you receive this e-mail in error, please notify the sender and delete this e-mail from your system.Thank you.
P Please consider the environment before printing this e-mail.
1
0
Dear Users,
I have released version 4.48 of stunnel.
The ChangeLog entry:
Version 4.48, 2011.11.26, urgency: MEDIUM:
* New features
- FIPS support on Win32 platform added. OpenSSL 0.9.8r DLLs based on
FIPS 1.2.3 canister are included with this version of stunnel.
FIPS
mode can be disabled with "fips = no" configuration file option.
* Bugfixes
- Fixed canary initialization problem on Win32 platform.
Home page: http://www.stunnel.org/
Download: ftp://ftp.stunnel.org/stunnel/
SHA-256 hash for stunnel-4.48.tar.gz:
9fa723595726806cbf6547a2c453e695e33bf635f2d4771e80d110a06f27ea37
Best regards,
Mike
1
0
Hi,
I'm willing to use this kind of configuration :
https client -->stunnel --> haproxy --> 2 web servers in http (or more)
I've understand that haproxy can't handle the ssl part, that's why stunnel
is needed.
I've read that a Patch is required for stunnel to work with haproxy in this
kind of confirmation
"I run stunnel 4.32 with patch from http://haproxy.1wt.eu/download/patches/ on
port 443 and forward it to port 81 on the same machine which is bound to
haproxy."
Can anyone tell me if this patch is now included in stunnel,
in particular, does Ubuntu 11.10 include it ?
I really would rather stay with package provided by ubuntu in order to
have easy upgrade/security fix.
I've experiences the work overload of manually compiling everything in
Apache for instance ;)
Any advices on this kind of setup ? documentation pointers? best practices
?
Regards,
Thomas.
here is the current package version on ubuntu 11.10
thomas@daisybox:~/Documents$ aptitude show stunnel4
Package: stunnel4
New: yes
State: not installed
Version: 3:4.35-2build1
Priority: optional
Section: universe/net
Maintainer: Ubuntu Developers <ubuntu-devel-discuss(a)lists.ubuntu.com>
Uncompressed Size: 541 k
Depends: libc6 (>= 2.11), libssl1.0.0 (>= 1.0.0), libwrap0 (>= 7.6-4~),
openssl, netbase, perl-modules
PreDepends: adduser
Suggests: logcheck-database
Conflicts: stunnel4
Breaks: stunnel (< 3:4.20-3), stunnel (< 3:4.20-3)
Replaces: stunnel, stunnel
Provides: stunnel
Description: Universal SSL tunnel for network daemons
The stunnel program is designed to work as SSL encryption wrapper
between remote client and local (inetd-startable) or remote server. The
concept is that having non-SSL
aware daemons running on your system you can easily setup them to
communicate with clients over secure SSL channel.
stunnel can be used to add SSL functionality to commonly used inetd
daemons like POP-2, POP-3 and IMAP servers without any changes in the
programs' code.
This package contains a wrapper script for compatibility with stunnel 3.x
Homepage: http://www.stunnel.org/
thomas@daisybox:~/Documents$ aptitude show stunnel
No current or candidate version found for stunnel
Package: stunnel
State: not a real package
Provided by: stunnel4
2
1
I'm setting up an internet-facing server that will be running a
service wrapped with stunnel. Given that, it made sense to me to use
fail2ban to block repeat connection attempts from clients who don't
have the right certificate (the system is using client-certificate
authentication). Unfortunately, stunnel4 doesn't put the client
source IP in connection failure log lines, so I made this quick patch
to enable that.
---cut here----
--- src/client.c.orig 2011-10-05 16:47:48.000000000 -0700
+++ src/client.c 2011-10-05 16:50:37.000000000 -0700
@@ -358,10 +358,13 @@
continue;
}
}
- if(c->opt->option.client)
+ if(c->opt->option.client) {
sslerror("SSL_connect");
- else
- sslerror("SSL_accept");
+ } else {
+ char buf[255];
+ sprintf(buf, "SSL_accept from %s ", c->accepted_address);
+ sslerror(buf);
+ }
longjmp(c->err, 1);
}
if(SSL_session_reused(c->ssl)) {
----cut here----
1
0
Hello,
I recently moved my Homeseer software from web server 08 to server 08. I had stunnel working on there properly to send out e mails using a hotmail account. I downloaded the new verison of Stunnel and tried to use the same config but Stunnel was crashing. Both versions web server 08 and server 08 are 64bit. Below is the original stunnel config file that I used on web server 08, this is cashing stunnel to crash when I run it. Using the default settings works, but I need to edit the config. I'm not to smart in the whole stunnel / Homeseer side of things. I was told by the Homeseer community that I need this to use my hotmail e mail to send e mails.
; Sample stunnel configuration file by Michal Trojnara 2002-2006
; Some options used here may not be adequate for your particular configuration
; Certificate/key is needed in server mode and optional in client mode
; The default certificate is provided only for testing and should not
; be used in a production environment
cert = stunnel.pem
;key = stunnel.pem
; Some performance tunings
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
; Workaround for Eudora bug
;options = DONT_INSERT_EMPTY_FRAGMENTS
; Authentication stuff
;verify = 2
; Don't forget to c_rehash CApath
;CApath = certs
; It's often easier to use CAfile
;CAfile = certs.pem
; Don't forget to c_rehash CRLpath
;CRLpath = crls
; Alternatively you can use CRLfile
;CRLfile = crls.pem
; Some debugging stuff useful for troubleshooting
;debug = 7
;output = stunnel.log
; Use it for client mode
client = yes
; Service-level configuration
[pop3s]
accept = 110
connect = pop3.live.com:995
[imaps]
accept = 993
connect = 143
[ssmtp]
accept = 25
connect = smtp.live.com:587
protocol = smtp
;[https]
;accept = 443
;connect = 80
;TIMEOUTclose = 0
; vim:ft=dosini
1
0
Dear Users,
I have released version 4.47 of stunnel.
This version includes a number of important bugfixes.
The ChangeLog entry:
Version 4.47, 2011.11.21, urgency: MEDIUM:
* Internal improvements
- CVE-2010-3864 workaround improved to check runtime version of
OpenSSL
rather than compiled version, and to allow OpenSSL 0.x.x >= 0.9.8p.
- Encoding of man page sources changed to UTF-8.
* Bugfixes
- Handling of socket/SSL close in transfer() function was fixed.
- Logging was modified to save and restore system error codes.
- Option "service" was restricted to Unix, as since stunnel 4.42 it
wasn't doing anything useful on Windows platform.
Home page: http://www.stunnel.org/
Download: ftp://ftp.stunnel.org/stunnel/
SHA-256 hash for stunnel-4.47.tar.gz:
0b70f8bad8b6963e6154606571a83a3f0e0dea88d7dbd7e3b83cde5a07dd95ae
Best regards,
Mike
1
0
Yeah, great idea...now the log looks a little different:
CRL: verification passed
2011.11.18 14:33:22 LOG5[2517:3077962608]: VERIFY OK: depth=2, /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only [...and so on...]
But at the end, same as usual:
2011.11.18 14:33:22 LOG3[2517:3077962608]: SSL_connect: 14094415: error:14094415:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate expired
2011.11.18 14:33:22 LOG5[2517:3077962608]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket
Maybe there is another reason, why I cant connect? Maybe the lines
2011.11.18 14:33:22 LOG5[2517:3077962608]: connect_blocking: connected example.com:443
2011.11.18 14:33:22 LOG5[2517:3077962608]: https connected remote server from my_outsid_ip:38491
are messing something?
-Rolf
________________________________
From: "josealf(a)rocketmail.com" <josealf(a)rocketmail.com>
To: Rolf Ruediger <stunnel(a)ymail.com>
Sent: Friday, November 18, 2011 2:18 PM
Subject: Re: [stunnel-users] expired certificate problem
Rolf,
Try verify = 0
Regards
-----Original Message-----
From: Rolf Ruediger <stunnel(a)ymail.com>
Sender: stunnel-users-bounces(a)stunnel.org
Date: Fri, 18 Nov 2011 05:15:33
To: stunnel-users(a)stunnel.org<stunnel-users(a)stunnel.org>
Reply-To: Rolf Ruediger <stunnel(a)ymail.com>
Subject: Re: [stunnel-users] expired certificate problem
_______________________________________________
stunnel-users mailing list
stunnel-users(a)stunnel.org
http://stunnel.mirt.net/mailman/listinfo/stunnel-users
1
0
Hello there!
Some time ago I used stunnel to send the output of a homebrew logging script to a remote server. For a few weeks now, the sever has an expired certificate, so I get an error while connecting to it. The stunnel.log looks like that:
2011.11.18 12:23:36 LOG5[753:3078719168]: stunnel 4.29 on i486-pc-linux-gnu with OpenSSL 0.9.8o 01 Jun 2010
2011.11.18 12:23:36 LOG5[753:3078719168]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP
2011.11.18 12:23:36 LOG5[753:3078719168]: 500 clients allowed
2011.11.18 12:24:00 LOG5[759:3078716272]: https accepted connection from 127.0.0.1:40691
2011.11.18 12:24:00 LOG5[759:3078716272]: connect_blocking: connected example.com:443
2011.11.18 12:24:00 LOG5[759:3078716272]: https connected remote server from my_outside_ip:38486
2011.11.18 12:24:00 LOG3[759:3078716272]: SSL_connect: 14094415: error:14094415:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate expired
2011.11.18 12:24:00 LOG5[759:3078716272]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket
This happens, when connecting manually with "nc -v 127.0.0.1 1234" to make a http-get request.
To also provide the config file of my linux client:
; Sample stunnel configuration file by Michal Trojnara 2002-2009
; Some options used here may not be adequate for your particular configuration
; Please make sure you understand them (especially the effect of the chroot jail)
; Certificate/key is needed in server mode and optional in client mode
cert = /etc/ssl/certs/https.pem
;key = /etc/ssl/certs/stunnel.pem
; Protocol version (all, SSLv2, SSLv3, TLSv1)
sslVersion = SSLv3
; Some security enhancements for UNIX systems - comment them out on Win32
chroot = /var/lib/stunnel4/
setuid = stunnel4
setgid = stunnel4
; PID is created inside the chroot jail
pid = /stunnel4.pid
; Some performance tunings
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
;compression = zlib
; Workaround for Eudora bug
;options = DONT_INSERT_EMPTY_FRAGMENTS
; Authentication stuff
;verify = 2
; Don't forget to c_rehash CApath
; CApath is located inside chroot jail
;CApath = /certs
; It's often easier to use CAfile
;CAfile = /etc/stunnel/certs.pem
; Don't forget to c_rehash CRLpath
; CRLpath is located inside chroot jail
;CRLpath = /crls
; Alternatively you can use CRLfile
;CRLfile = /etc/stunnel/crls.pem
; Some debugging stuff useful for troubleshooting
;debug = 7
output = /var/log/stunnel4/stunnel.log
; Use it for client mode
client = yes
; Service-level configuration
[https]
accept = 127.0.0.1:1234
connect = example.com:443
TIMEOUTclose = 0
;[pop3s]
;accept = 995
;connect = 110
;[imaps]
;accept = 993
;connect = 143
[ssmtp]
accept = 465
connect = 25
;[https]
;accept = 443
;connect = 80
;TIMEOUTclose = 0
; vim:ft=dosini
So, the server is not under my control, where I am logging to.
Is there a problem I don't see? I thought, that when I connect to localhost, the data should be forwarded to the https-server.
Thanks in advance.
-Rolf
2
2