December 2012 - stunnel-users

Stunnel 4 failing to connect to gmail
by Asif Iqbal 10 Dec '20

10 Dec '20

I am faling to connect to gmail. Not sure what that bind error means. iqbala@ghar:~$ sudo stunnel4 2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes from /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes to /home/iqbala/.rnd 2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims sufficient entropy for the PRNG 2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem 2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded 2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for service ssmtp 2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be changed with 'ulimit -n') 2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE limit for file descriptors 2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode 2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on accept socket 2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to 74.125.93.111:587 2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign requested address (99) Here is how my conf file looks like iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$" cert = /etc/stunnel/stunnel.pem foreground = yes sslVersion = SSLv3 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 pid = /stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = /var/log/stunnel4/stunnel.log client = yes [ssmtp] accept = smtp.gmail.com:587 connect = 25 Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

5 9

stunnel and hosts.allow
by Yousef Alhashemi 05 Jul '16

05 Jul '16

Hi, This may be a little bit off-topic, but does anyone here use stunnel with pan? My connections to stunnel (in pan) are always refused by libwrap. I was looking for the right rule to add to /etc/hosts.allow but nothing seems to work aside from "ALL : ALL" (which is obviously not good) and "nntps: KNOWN". Is the latter reasonable? The hosts_access(5) manpage is confusing to say the least. It mentions that daemon (the first token on any line) is the name of the daemon running the process, which would be "stunnel" in my case, but using "stunnel : LOCAL" or even "stunnel : ALL" doesn't work. The rule that seems to work, as mentioned, is "nntps : KNOWN" ("nntps" being the group name in stunnel.conf). What's even more confusing to me is that "nntps : LOCAL" does not work either. Nor does "nntps : localhost 127.0.0.1", "nntps : localhost", "nntps : 127.0.0.1", or "nntps : 192.168.1.". Pan is running on the same machine as stunnel so all connections must be coming from localhost. Why do these rules not trigger? Either way, I'd like to know the "least permissive" hosts.allow rule that would allow me to connect to my news provider from pan, and/or whether "nntps : KNOWN" is a safe option. Thanks, Yousef

3 6

Fw: High memory usage problem.
by mkanet＠yahoo.com 27 Mar '13

27 Mar '13

Jeremy, I know there's an android build of stunnel. Im not trying to be funny, but are you running stunnel on your mobile phone? :) The latest android mobile phones include quadcore CPU's with 2GB's of RAM It would be interesting to see how much of a load a mobile phone can handle with a USB to RJ45 Ethernet interface. Edit: I tried sending this earlier, but it doesn't look like it went through. My apologies in case this is a duplicate. ------------------------ Thanks for taking the time to read this. We're operating on a low spec system that can not be modified at this point. stunnel was introduced at the last minute, without consideration to resource requirements and now consumes enough ram to cause the kernel to issue OOM exceptions. So in short, we are trying to trade increased CPU usage for less memory usage and have tried setting “sessions” to 3600 to reduce memory pressure, but unfortunately it doesn't last. Our current solution is to cron a restart of stunnel on a regular basis, but would prefer to limit number of threads or number of cache entries or something else altogether similarly gentler. Thanks again for your consideration and assistance in this! If there's any specific information I can give, please let me know. Regards, Jeremy

3 7

Looking to confirm that stunnel is encrypting traffic via wireshark
by David Trebacz 31 Dec '12

31 Dec '12

I'm using stunnel to encrypt newsgroup traffic. Essentially use stunnel to encrypt port 119 traffic (from the Pan Newsreader) then securely communicate over 563 with astraweb secure servers. The whole set-up is described in detail in this blog post: http://blog.trebacz.com/2012/03/installing-stunnel-to-enable-ssl.html The system has been "working" for several months, but someone on the blog asked how to confirm it. I checked my logs and each time I'm finished using Pan/Stunnel to download anything I get several entries in my syslog like: stunnel: LOG5[2111:140426048358144]: Connection closed: 3259 byte(s) sent to SSL, 16756212 byte(s) sent to socket I started to wonder does this mean some of the traffic was encrypted, but most wasn't? I fired up wireshark filtered the results to show port 563 traffic ( filter set to tcp.port == 563) as was suggested in another post ( http://ubuntuforums.org/showpost.php?p=5400958&postcount=9) Wireshark does show the traffic is correctly flow through port 563 with astrawebs newsservers when requesting data, but how do I know the traffic is encrypted? I inspected likely packets to contain encrypted data and I don't see anything in plain text (but they're zlib compressed also).

1 0

How to set DSCP in stunnel?
by Death Master 30 Dec '12

30 Dec '12

How to set DSCP in stunnel? For some reasons I can't set DSCP via iptables(server side is on ovz VPS). Is there such feature? If no - please add it(it will be very usefull for me ;) )

3 3

Embedded linux run time problem (starting version 4.53), and work around
by Bao, Robert 28 Dec '12

28 Dec '12

To those running stunnel on Embedded Linux ARMv4 platform, You may have noticed that stunnel (starting from version 4.53 to the latest) will crash immediately even if you run as "stunnel -version". The work around is to remove "-pie" and "-fPIE" from CFLAG in Makefile. Michal, You may fix this problem permanently in config file when you roll out the official 5.00 version. Thanks, and happy holidays. Robert Bao Software House Tyco International

1 0

core dump when running stunnel on Arm based board
by ning ji 20 Dec '12

20 Dec '12

Hi everyone, i'm new to this. got a task to update stunnel from 4.52 to 5.00b1. 1. ./configure --host arm-none-linux-gnueabi --target arm-none-linux-gnueabi --prefix= i compared the makefile with the one in our 4.52 code base, same. 2. build with make -C stunnel CROSS_COMPILE=arm-none-linux-gnueabi- ARCH=arm 3. scp to ARM board, run without arugments, core dump. (the line number might be different as i was putting printfs. but as long as it enters parse_commandline, it crashes) [New LWP 867]Cannot access memory at address 0x70797263(gdb) bt#0 parse_commandline (name=0xbefdce29 "/opt/ultra/config/stunnel.conf", parameter=0xbefdce48 "-version") at options.c:1940#1 0x0003ba04 in main_configure (arg1=0xbefdce29 "/opt/ultra/config/stunnel.conf", arg2=0xbefdce48 "-version") at stunnel.c:199#2 0x0003bd44 in main_unix (argv=<optimized out>, argc=<optimized out>)at stunnel.c:135#3 main (argc=3, argv=0xbefdcd24) at stunnel.c:110my question is, it crashed when just entering parse_commandline( ),the 2 arguments look fine to me.How could this happen ?Many thanks !

5 11

public domain [PATCH] to stunnel 500b3 for Windows CE / Windows Mobile, "no log window bug" on WCE, UNICODE wce/w32, and compilation issues fixed
by Pierre DELAAGE 17 Dec '12

17 Dec '12

Dear All, Please find enclosed a patch in "diff -cr orig patched" format, applying to stunnel v500b3 as found here https://www.stunnel.org/downloads.html This patch mainly addresses compilation and unicode issues for Windows CE targets + ONE issue preventing stunnel to display error logs in error Window on WCE. This code has been made common to WCE AND W32, by selecting proper win32 api calls common to both platforms. For example : InsertMenuItem does not exist on WCE, but InsertMenu can do the same job. ShellExecute does not exist on WCE, but...ShellExecuteEx does exist on both platforms and can do the job. I use MS EVC 4sp4 compiler with WCE 420 SDK, on a vista sp2 host platform. Once debugged the code works fine on WM6 HTC smartphones. Should work on WM5. It needs a windows CE openssl lib (I recompiled MY patched version of openssl 1.0.2snap20121213 successfully: I have sent a patch to those openssl gentlemen, hoping that they will integrate it one fine day..., something not so obvious ...). You will find my openssl "patch to port", by following carefully this thread at openssl diffusion list : http://marc.info/?l=openssl-dev&m=135574071824906&w=2 two messages are more important than the others : one containing the patch on the code. Another one containing 2 useful scripts. The present stunnel patch addresses the following issues : ************* I] COMPILATION FAILURES It is important to state that to detect more type mismatching (that can be error prone at runtime), I delibarately use /WX option on both WCE and W32 compilers: this flag takes each warning as an error. This is very useful for UNICODE clean coding as, without this option, the compiler will just warn when seeing a short* (unicode string) used as a char* (ansi string), which leads to big pb at run time. 1/ orig/src/client.c just a warning on missing "return". 2/ evc.mak new SSLDIR to openssl V102snap20121213 Missing flag x86 needed to get inline function InterlockedExchange from winbase.h. Added dependency to evc.mak itself, as in vc.mak Added commctrl.lib for CommandBar routines (although, strangely, the program was running without that !) 3/ gui.c : UNICODE port for W32/WCE. WM_WINDOWSPOSCHHANGED replaces WM_SHOWINDOW, as the latter is unsupported in WCE. some mismatch between prototype and function definition for service_install. Visible now is a BOOL, as it is more consistant with its value and usage. Some "return TRUE" have been replaced by "return 0" as stated in msdn doc. Trick to delete menuitems : itemcount does not exist in WCE, but the delete loop is using the return value of deletemenu. message_boxT created for Tchar vars such as section->help ShellExecute replaced by shellExecuteEx, common to WCE and W32 4/ prototypes.h : declared message_boxT 5/ resolver.c : UNICODE issue on LoadLibrary 6/ stunnel.c type cast for time_t 7/ vc.mak : inc32 for openssl includes /WX warning as error flag to see every potential casting problem around UNICODE ************* II] OPERATIONAL ERRORS (at run-time) 1/ error log windows is displayed empty : cause = WM_SHOWWINDOW does not exist on WCE, although the constant is declared ! solution : use WM_WINDOWPOSCHANGED instead... 2/ Unsolved, unfortunaltely : on WCE only, on start, there is an error message, but no real error behind : "CommandBar_InsertMenuBar : error 120 : this function is only valid in win32 mode" I am still searching... ************* III] MINOR IMPROVMENT 1/replaced some win3.1 ugly fonts See resources.rc : some nice FONT on About and Password dlgbox...to replace ugly windows3.1 style bold font... Note : I use stunnel to establish a simple "vpn" between smartphones and a corporate linux server mainly for HTTPS/POPS/SMTPS support. Stunnel is very relevant in that matter, over solutions based on SSH (although we use also ssh), from a communication cost point of view : ssh establishes permanent socket between client and server, so that the communication is charged by the mobile network provider : and these charges are very expensive. On the contrary stunnel only establishes ssl sockets on demand so that financial charges are limited to strict necessary. Please note that stunnel brings "client based certificate authentication" to POP/SMTP mobile mail user agents which only BASICALLY supports SSL with server authentication, but NO client authentication, such as M$ Outlook for Mobile (unless you pay for an exchange server and exchange client licence). Here again stunnel is very relevant. Note 2 : TODO list and Wish list : 1/ there is a remaining runtime bug on WCE : On start there is a warning that is NOT causing any failure in the software. Very difficult to analyse... 2/ find a notepad for WCE... 3/ in log.c...I really it would be good to replace hard coded values for socket errors by symbolic constant. 4/ fips openssl for WCE and then stunnel for WCE... I hope you will find this patch useful. Michal, thank you for your excellent work, Yours sincerely, Pierre Delaage

2 1

WCE 3.0 run-time error, how to work around it?
by Bao, Robert 12 Dec '12

12 Dec '12

Mike, The stunnel version used in our current product is 4.34. It worked well under Windows CE 3.0 and 5.0. However I got run-time error for 5.00 beta version under WCE 3.0 (even though I disabled IPv6, took out winsock2.h/ws2tcpip.h, included winsock.h, defined "struct addrinfo", etc ). The error is: Error detected on SSL (read) file descriptor: Bad protocol option (WSAENOPROTOOPT) (10042) What else I need to do to resolve or work around it? Thank you. Robert Bao Software House Tyco International

2 2

Win CE build errors: main_execute() removed from stunnel.c file? "hwnd" link error.
by Bao, Robert 06 Dec '12

06 Dec '12

Came across another Win CE build issue in the current stunnel 4.54 version. Got link error for main_execute() referenced in nogui.c file. I noticed that the implementation of "main_execute()" was in stunnel.c file in old versions, but is not there anymore. Also got "hwnd" linking issue. Looks like "hwnd" is initialized/created in gui.c file, and used in log.c/client.c/option.c files. It is not initialized/created in nogui.c file. I am using the NOGUIOBJS/tstunnel.exe option in building the stunnel, and got this linking error. Any suggestions on how to fix these or work around them? Thanks. Robert Bao Software House Tyco International 978-577-4202 Explore our new Tyco Online Learning Center Web-based Training Bundles at: www.swhouse.com/support/tyco_online_learning_center.aspx This e-mail may contain or have attached to it information or technology the export or re-export of which is restricted by U.S. laws and regulations. By viewing this e-mail and any attachments, the recipient agrees to the following: (i) the recipients use of the contents of this e-mail and any attachments shall comply with all applicable laws, rules and regulations, including, without limitation, U.S. international trade laws and regulations, and (ii) the recipient may not transfer or otherwise export or re-export any information or technology contained in this e-mail or any attachment except in full compliance with the export controls administered by the U.S. and other countries and any applicable import and use restrictions.

3 12