I am faling to connect to gmail. Not sure what that bind error means.
iqbala@ghar:~$ sudo stunnel4
2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes
from /home/iqbala/.rnd
2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes
to /home/iqbala/.rnd
2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims
sufficient entropy for the PRNG
2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully
2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem
2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded
2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem
2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded
2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for
service ssmtp
2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on
i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007
2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD
SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP
2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be
changed with 'ulimit -n')
2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE
limit for file descriptors
2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed
2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode
2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode
2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode
2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on
accept socket
2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to
74.125.93.111:587
2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign
requested address (99)
Here is how my conf file looks like
iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$"
cert = /etc/stunnel/stunnel.pem
foreground = yes
sslVersion = SSLv3
chroot = /var/lib/stunnel4/
setuid = stunnel4
setgid = stunnel4
pid = /stunnel4.pid
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
debug = 7
output = /var/log/stunnel4/stunnel.log
client = yes
[ssmtp]
accept = smtp.gmail.com:587
connect = 25
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
5
9
Hi,
This may be a little bit off-topic, but does anyone here use stunnel with
pan? My connections to stunnel (in pan) are always refused by libwrap. I was
looking for the right rule to add to /etc/hosts.allow but nothing seems to
work aside from "ALL : ALL" (which is obviously not good) and "nntps:
KNOWN". Is the latter reasonable? The hosts_access(5) manpage is confusing
to say the least. It mentions that daemon (the first token on any line) is
the name of the daemon running the process, which would be "stunnel" in my
case, but using "stunnel : LOCAL" or even "stunnel : ALL" doesn't work. The
rule that seems to work, as mentioned, is "nntps : KNOWN" ("nntps" being the
group name in stunnel.conf).
What's even more confusing to me is that "nntps : LOCAL" does not work
either. Nor does "nntps : localhost 127.0.0.1", "nntps : localhost", "nntps
: 127.0.0.1", or "nntps : 192.168.1.". Pan is running on the same machine as
stunnel so all connections must be coming from localhost. Why do these rules
not trigger?
Either way, I'd like to know the "least permissive" hosts.allow rule that
would allow me to connect to my news provider from pan, and/or whether
"nntps : KNOWN" is a safe option.
Thanks,
Yousef
3
6
Hi,
since I couldn't find a better place I'm sending a simple patch that
allows to disable SSL renegotiation here. Possible reasons for this:
- famous renegotiation SSL flaw, patched in OpenSSL a long time ago,
but not everyone can or want to upgrade OpenSSL
- renegotiation makes some DoS attacks much easier (see
http://www.thc.org/thc-ssl-dos/), regardless of it being a secure one
or not
- it is really not needed in many cases
The approach is based on what is being done in Apache. The default is
to allow renegotation, so there should be no surprises for anyone
after upgrade. Patch applies on latest (4.54b4) stunnel beta. Feel
free to comment:)
--
Janusz Dziemidowicz
3
13
Hey Guys,
I'm trying to build stunnel 4.53 binaries for windows on Debian Squeeze x86
using instructions in INSTALL.W32 file.
I use the latest openssl-1.0.1c (libssl-dev debian package installed also).
At the last step 'make stunnel.exe' returns following error:
# make stunnel.exe
i586-mingw32msvc-gcc -c -I/usr/src/openssl-0.9.8s-fips/inc32 -mthreads
-fstack-protector -O2 -Wall -Wextra -Wno-long-long -pedantic -o str.obj
str.c
In file included from str.c:38:
common.h:392:33: error: openssl/opensslconf.h: No such file or directory
common.h:405:27: error: openssl/lhash.h: No such file or directory
common.h:406:25: error: openssl/ssl.h: No such file or directory
common.h:407:25: error: openssl/err.h: No such file or directory
common.h:408:66: error: openssl/crypto.h: No such file or directory
common.h:409:26: error: openssl/rand.h: No such file or directory
common.h:411:25: error: openssl/md4.h: No such file or directory
common.h:413:25: error: openssl/des.h: No such file or directory
common.h:417:28: error: openssl/engine.h: No such file or directory
In file included from str.c:38:
common.h:449: warning: return type defaults to ‘int’
common.h: In function ‘STACK_OF’:
common.h:449: error: expected declaration specifiers before ‘*’ token
In file included from str.c:39:
prototypes.h:50: error: storage class specified for parameter ‘LOG_MODE’
prototypes.h:61: error: storage class specified for parameter
‘SOCKADDR_UNION’
prototypes.h:64: error: expected specifier-qualifier-list before
‘SOCKADDR_UNION’
prototypes.h:67: warning: struct has no members
prototypes.h:67: error: storage class specified for parameter
‘SOCKADDR_LIST’
prototypes.h:72: error: storage class specified for parameter ‘COMP_TYPE’
prototypes.h:78: error: expected specifier-qualifier-list before ‘COMP_TYPE’
prototypes.h:114: warning: struct has no members
prototypes.h:114: error: storage class specified for parameter
‘GLOBAL_OPTIONS’
prototypes.h:116: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’
before ‘global_options’
prototypes.h:124: error: expected specifier-qualifier-list before ‘SSL_CTX’
prototypes.h:222: error: storage class specified for parameter
‘SERVICE_OPTIONS’
prototypes.h:224: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’
before ‘service_options’
prototypes.h:236: error: storage class specified for parameter ‘VAL_TYPE’
prototypes.h:244: error: storage class specified for parameter ‘OPT_UNION’
prototypes.h:250: error: expected specifier-qualifier-list before ‘VAL_TYPE’
prototypes.h:252: error: storage class specified for parameter ‘SOCK_OPT’
prototypes.h:256: error: storage class specified for parameter ‘CONF_TYPE’
prototypes.h:269: error: storage class specified for parameter ‘s_poll_set’
prototypes.h:278: error: storage class specified for parameter ‘DISK_FILE’
prototypes.h:285: error: storage class specified for parameter ‘FD’
prototypes.h:290: error: storage class specified for parameter ‘max_clients’
prototypes.h:291: error: storage class specified for parameter ‘num_clients’
prototypes.h:327: warning: parameter names (without types) in function
declaration
prototypes.h:347: error: storage class specified for parameter ‘cli_index’
prototypes.h:347: error: storage class specified for parameter ‘opt_index’
prototypes.h:350: error: expected ‘)’ before ‘*’ token
prototypes.h:355: error: expected declaration specifiers or ‘...’ before
‘CONF_TYPE’
prototypes.h:361: error: expected specifier-qualifier-list before
‘SERVICE_OPTIONS’
prototypes.h:363: warning: struct has no members
prototypes.h:363: error: storage class specified for parameter ‘UI_DATA’
prototypes.h:365: error: expected ‘)’ before ‘*’ token
prototypes.h:370: error: expected ‘)’ before ‘*’ token
prototypes.h:374: error: expected declaration specifiers before ‘s_poll_set’
prototypes.h:375: error: expected ‘)’ before ‘*’ token
prototypes.h:376: error: expected ‘)’ before ‘*’ token
prototypes.h:377: error: expected ‘)’ before ‘*’ token
prototypes.h:378: error: expected ‘)’ before ‘*’ token
prototypes.h:379: error: expected ‘)’ before ‘*’ token
prototypes.h:380: error: expected ‘)’ before ‘*’ token
prototypes.h:381: error: expected ‘)’ before ‘*’ token
prototypes.h:401: error: expected specifier-qualifier-list before ‘SSL’
prototypes.h:422: error: storage class specified for parameter ‘CLI’
prototypes.h:424: error: expected declaration specifiers before ‘CLI’
prototypes.h:426: error: expected ‘)’ before ‘*’ token
prototypes.h:430: error: expected ‘)’ before ‘*’ token
prototypes.h:431: error: expected ‘)’ before ‘*’ token
prototypes.h:432: error: expected ‘)’ before ‘*’ token
prototypes.h:433: error: expected ‘)’ before ‘*’ token
prototypes.h:434: error: expected ‘)’ before ‘*’ token
prototypes.h:436: error: expected ‘)’ before ‘*’ token
prototypes.h:450: error: storage class specified for parameter
‘PROTOCOL_TYPE’
prototypes.h:453: error: expected ‘)’ before ‘*’ token
prototypes.h:457: error: expected ‘)’ before ‘*’ token
prototypes.h:458: error: expected ‘)’ before ‘*’ token
prototypes.h:459: error: expected ‘)’ before ‘*’ token
prototypes.h:460: error: expected ‘)’ before ‘*’ token
prototypes.h:461: error: expected ‘)’ before ‘*’ token
prototypes.h:462: warning: type defaults to ‘int’ in declaration of
‘SOCKADDR_UNION’
prototypes.h:462: error: expected ‘;’, ‘,’ or ‘)’ before ‘*’ token
prototypes.h:493: error: storage class specified for parameter
‘SECTION_CODE’
prototypes.h:495: warning: parameter names (without types) in function
declaration
prototypes.h:496: warning: parameter names (without types) in function
declaration
prototypes.h:500: error: expected declaration specifiers or ‘...’ before
‘CLI’
prototypes.h:526: error: storage class specified for parameter ‘hwnd’
prototypes.h:530: error: expected ‘)’ before ‘*’ token
prototypes.h:535: error: storage class specified for parameter ‘GETADDRINFO’
prototypes.h:536: error: storage class specified for parameter
‘FREEADDRINFO’
prototypes.h:538: error: storage class specified for parameter ‘GETNAMEINFO’
prototypes.h:539: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’
before ‘s_getaddrinfo’
prototypes.h:540: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’
before ‘s_freeaddrinfo’
prototypes.h:541: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’
before ‘s_getnameinfo’
prototypes.h:550: error: expected declaration specifiers before ‘DISK_FILE’
prototypes.h:551: error: expected ‘)’ before ‘*’ token
prototypes.h:552: error: expected ‘)’ before ‘*’ token
prototypes.h:553: error: expected ‘)’ before ‘*’ token
prototypes.h:563: error: expected ‘)’ before ‘*’ token
str.c:49: error: storage class specified for parameter ‘canary’
str.c:50: error: storage class specified for parameter ‘canary_initialized’
str.c:50: error: parameter ‘canary_initialized’ is initialized
str.c:52: error: storage class specified for parameter ‘ALLOC_LIST’
str.c:55: error: expected specifier-qualifier-list before ‘ALLOC_LIST’
str.c:57: warning: struct has no members
str.c:57: error: storage class specified for parameter ‘ALLOC_TLS’
str.c:60: error: expected specifier-qualifier-list before ‘ALLOC_LIST’
str.c:67: warning: struct has no members
str.c:59: warning: empty declaration
str.c:73: error: expected ‘)’ before ‘*’ token
str.c:74: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before
‘*’ token
str.c:75: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before
‘*’ token
str.c:77: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before
‘{’ token
str.c:85: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before
‘{’ token
str.c:95: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before
‘{’ token
str.c:175: error: storage class specified for parameter ‘tls_index’
str.c:177: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before
‘{’ token
str.c:181: error: expected ‘)’ before ‘*’ token
str.c:185: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before
‘*’ token
str.c:191: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before
‘{’ token
str.c:198: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before
‘{’ token
str.c:210: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before
‘{’ token
str.c:228: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before
‘{’ token
str.c:262: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before
‘{’ token
str.c:291: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before
‘{’ token
str.c:315: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before
‘{’ token
str.c:326: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before
‘*’ token
common.h:449: warning: type of ‘SSL_COMP’ defaults to ‘int’
str.c:175: error: declaration for parameter ‘tls_index’ but no such
parameter
str.c:57: error: declaration for parameter ‘ALLOC_TLS’ but no such parameter
str.c:52: error: declaration for parameter ‘ALLOC_LIST’ but no such
parameter
str.c:50: error: declaration for parameter ‘canary_initialized’ but no such
parameter
str.c:49: error: declaration for parameter ‘canary’ but no such parameter
prototypes.h:581: error: declaration for parameter ‘str_printf’ but no such
parameter
prototypes.h:580: error: declaration for parameter ‘str_vprintf’ but no
such parameter
prototypes.h:579: error: declaration for parameter ‘str_dup’ but no such
parameter
prototypes.h:577: error: declaration for parameter ‘str_free_debug’ but no
such parameter
prototypes.h:575: error: declaration for parameter ‘str_detach_debug’ but
no such parameter
prototypes.h:573: error: declaration for parameter ‘str_realloc_debug’ but
no such parameter
prototypes.h:571: error: declaration for parameter ‘str_alloc_debug’ but no
such parameter
prototypes.h:570: error: declaration for parameter ‘str_stats’ but no such
parameter
prototypes.h:569: error: declaration for parameter ‘str_cleanup’ but no
such parameter
prototypes.h:568: error: declaration for parameter ‘str_canary_init’ but no
such parameter
prototypes.h:567: error: declaration for parameter ‘str_init’ but no such
parameter
prototypes.h:562: error: declaration for parameter ‘libwrap_init’ but no
such parameter
prototypes.h:557: error: declaration for parameter ‘tstr2str’ but no such
parameter
prototypes.h:556: error: declaration for parameter ‘str2tstr’ but no such
parameter
prototypes.h:537: error: declaration for parameter ‘GETNAMEINFO’ but no
such parameter
prototypes.h:536: error: declaration for parameter ‘FREEADDRINFO’ but no
such parameter
prototypes.h:534: error: declaration for parameter ‘GETADDRINFO’ but no
such parameter
prototypes.h:528: error: declaration for parameter ‘passwd_cb’ but no such
parameter
prototypes.h:526: error: declaration for parameter ‘hwnd’ but no such
parameter
prototypes.h:500: error: declaration for parameter ‘create_client’ but no
such parameter
prototypes.h:499: error: declaration for parameter ‘stunnel_thread_id’ but
no such parameter
prototypes.h:498: error: declaration for parameter ‘stunnel_process_id’ but
no such parameter
prototypes.h:497: error: declaration for parameter ‘sthreads_init’ but no
such parameter
prototypes.h:496: error: declaration for parameter ‘leave_critical_section’
but no such parameter
prototypes.h:495: error: declaration for parameter ‘enter_critical_section’
but no such parameter
prototypes.h:493: error: declaration for parameter ‘SECTION_CODE’ but no
such parameter
prototypes.h:479: error: declaration for parameter ‘local_getnameinfo’ but
no such parameter
prototypes.h:463: error: declaration for parameter ‘s_gai_strerror’ but no
such parameter
prototypes.h:452: error: declaration for parameter ‘find_protocol_id’ but
no such parameter
prototypes.h:450: error: declaration for parameter ‘PROTOCOL_TYPE’ but no
such parameter
prototypes.h:425: error: declaration for parameter ‘client_thread’ but no
such parameter
prototypes.h:422: error: declaration for parameter ‘CLI’ but no such
parameter
prototypes.h:395: error: declaration for parameter ‘make_sockets’ but no
such parameter
prototypes.h:394: error: declaration for parameter ‘get_socket_error’ but
no such parameter
prototypes.h:393: error: declaration for parameter ‘set_socket_options’ but
no such parameter
prototypes.h:366: error: declaration for parameter ‘sslerror’ but no such
parameter
prototypes.h:363: error: declaration for parameter ‘UI_DATA’ but no such
parameter
prototypes.h:356: error: declaration for parameter ‘apply_conf’ but no such
parameter
prototypes.h:355: error: declaration for parameter ‘parse_conf’ but no such
parameter
prototypes.h:354: error: declaration for parameter ‘parse_commandline’ but
no such parameter
prototypes.h:349: error: declaration for parameter ‘ssl_init’ but no such
parameter
prototypes.h:347: error: declaration for parameter ‘opt_index’ but no such
parameter
prototypes.h:347: error: declaration for parameter ‘cli_index’ but no such
parameter
prototypes.h:343: error: declaration for parameter ‘pty_allocate’ but no
such parameter
prototypes.h:339: error: declaration for parameter ‘s_strerror’ but no such
parameter
prototypes.h:338: error: declaration for parameter ‘log_error’ but no such
parameter
prototypes.h:337: error: declaration for parameter ‘sockerror’ but no such
parameter
prototypes.h:336: error: declaration for parameter ‘ioerror’ but no such
parameter
prototypes.h:334: error: declaration for parameter ‘fatal_debug’ but no
such parameter
prototypes.h:328: error: declaration for parameter ‘s_log’ but no such
parameter
prototypes.h:327: error: declaration for parameter ‘log_flush’ but no such
parameter
prototypes.h:326: error: declaration for parameter ‘log_close’ but no such
parameter
prototypes.h:325: error: declaration for parameter ‘log_open’ but no such
parameter
prototypes.h:317: error: declaration for parameter ‘set_nonblock’ but no
such parameter
prototypes.h:316: error: declaration for parameter ‘s_accept’ but no such
parameter
prototypes.h:315: error: declaration for parameter ‘s_socketpair’ but no
such parameter
prototypes.h:314: error: declaration for parameter ‘s_pipe’ but no such
parameter
prototypes.h:313: error: declaration for parameter ‘s_socket’ but no such
parameter
prototypes.h:311: error: declaration for parameter ‘get_limits’ but no such
parameter
prototypes.h:306: error: declaration for parameter ‘stunnel_info’ but no
such parameter
prototypes.h:302: error: declaration for parameter ‘signal_post’ but no
such parameter
prototypes.h:298: error: declaration for parameter ‘bind_ports’ but no such
parameter
prototypes.h:297: error: declaration for parameter ‘unbind_ports’ but no
such parameter
prototypes.h:296: error: declaration for parameter ‘daemon_loop’ but no
such parameter
prototypes.h:295: error: declaration for parameter ‘main_configure’ but no
such parameter
prototypes.h:294: error: declaration for parameter ‘main_initialize’ but no
such parameter
prototypes.h:291: error: declaration for parameter ‘num_clients’ but no
such parameter
prototypes.h:290: error: declaration for parameter ‘max_clients’ but no
such parameter
prototypes.h:285: error: declaration for parameter ‘FD’ but no such
parameter
prototypes.h:278: error: declaration for parameter ‘DISK_FILE’ but no such
parameter
prototypes.h:269: error: declaration for parameter ‘s_poll_set’ but no such
parameter
prototypes.h:256: error: declaration for parameter ‘CONF_TYPE’ but no such
parameter
prototypes.h:252: error: declaration for parameter ‘SOCK_OPT’ but no such
parameter
prototypes.h:244: error: declaration for parameter ‘OPT_UNION’ but no such
parameter
prototypes.h:236: error: declaration for parameter ‘VAL_TYPE’ but no such
parameter
prototypes.h:222: error: declaration for parameter ‘SERVICE_OPTIONS’ but no
such parameter
prototypes.h:114: error: declaration for parameter ‘GLOBAL_OPTIONS’ but no
such parameter
prototypes.h:72: error: declaration for parameter ‘COMP_TYPE’ but no such
parameter
prototypes.h:67: error: declaration for parameter ‘SOCKADDR_LIST’ but no
such parameter
prototypes.h:61: error: declaration for parameter ‘SOCKADDR_UNION’ but no
such parameter
prototypes.h:50: error: declaration for parameter ‘LOG_MODE’ but no such
parameter
str.c:342: error: expected ‘{’ at end of input
common.h:449: warning: unused parameter ‘SSL_COMP’
str.c:175: warning: unused parameter ‘tls_index’
str.c:57: warning: unused parameter ‘ALLOC_TLS’
str.c:52: warning: unused parameter ‘ALLOC_LIST’
str.c:50: warning: unused parameter ‘canary_initialized’
str.c:49: warning: unused parameter ‘canary’
prototypes.h:581: warning: unused parameter ‘str_printf’
prototypes.h:580: warning: unused parameter ‘str_vprintf’
prototypes.h:579: warning: unused parameter ‘str_dup’
prototypes.h:577: warning: unused parameter ‘str_free_debug’
prototypes.h:575: warning: unused parameter ‘str_detach_debug’
prototypes.h:573: warning: unused parameter ‘str_realloc_debug’
prototypes.h:571: warning: unused parameter ‘str_alloc_debug’
prototypes.h:570: warning: unused parameter ‘str_stats’
prototypes.h:569: warning: unused parameter ‘str_cleanup’
prototypes.h:568: warning: unused parameter ‘str_canary_init’
prototypes.h:567: warning: unused parameter ‘str_init’
prototypes.h:562: warning: unused parameter ‘libwrap_init’
prototypes.h:557: warning: unused parameter ‘tstr2str’
prototypes.h:556: warning: unused parameter ‘str2tstr’
prototypes.h:537: warning: unused parameter ‘GETNAMEINFO’
prototypes.h:536: warning: unused parameter ‘FREEADDRINFO’
prototypes.h:534: warning: unused parameter ‘GETADDRINFO’
prototypes.h:528: warning: unused parameter ‘passwd_cb’
prototypes.h:526: warning: unused parameter ‘hwnd’
prototypes.h:500: warning: unused parameter ‘create_client’
prototypes.h:499: warning: unused parameter ‘stunnel_thread_id’
prototypes.h:498: warning: unused parameter ‘stunnel_process_id’
prototypes.h:497: warning: unused parameter ‘sthreads_init’
prototypes.h:496: warning: unused parameter ‘leave_critical_section’
prototypes.h:495: warning: unused parameter ‘enter_critical_section’
prototypes.h:493: warning: unused parameter ‘SECTION_CODE’
prototypes.h:479: warning: unused parameter ‘local_getnameinfo’
prototypes.h:463: warning: unused parameter ‘s_gai_strerror’
prototypes.h:452: warning: unused parameter ‘find_protocol_id’
prototypes.h:450: warning: unused parameter ‘PROTOCOL_TYPE’
prototypes.h:425: warning: unused parameter ‘client_thread’
prototypes.h:422: warning: unused parameter ‘CLI’
prototypes.h:395: warning: unused parameter ‘make_sockets’
prototypes.h:394: warning: unused parameter ‘get_socket_error’
prototypes.h:393: warning: unused parameter ‘set_socket_options’
prototypes.h:366: warning: unused parameter ‘sslerror’
prototypes.h:363: warning: unused parameter ‘UI_DATA’
prototypes.h:356: warning: unused parameter ‘apply_conf’
prototypes.h:355: warning: unused parameter ‘parse_conf’
prototypes.h:354: warning: unused parameter ‘parse_commandline’
prototypes.h:349: warning: unused parameter ‘ssl_init’
prototypes.h:347: warning: unused parameter ‘opt_index’
prototypes.h:347: warning: unused parameter ‘cli_index’
prototypes.h:343: warning: unused parameter ‘pty_allocate’
prototypes.h:339: warning: unused parameter ‘s_strerror’
prototypes.h:338: warning: unused parameter ‘log_error’
prototypes.h:337: warning: unused parameter ‘sockerror’
prototypes.h:336: warning: unused parameter ‘ioerror’
prototypes.h:334: warning: unused parameter ‘fatal_debug’
prototypes.h:328: warning: unused parameter ‘s_log’
prototypes.h:327: warning: unused parameter ‘log_flush’
prototypes.h:326: warning: unused parameter ‘log_close’
prototypes.h:325: warning: unused parameter ‘log_open’
prototypes.h:317: warning: unused parameter ‘set_nonblock’
prototypes.h:316: warning: unused parameter ‘s_accept’
prototypes.h:315: warning: unused parameter ‘s_socketpair’
prototypes.h:314: warning: unused parameter ‘s_pipe’
prototypes.h:313: warning: unused parameter ‘s_socket’
prototypes.h:311: warning: unused parameter ‘get_limits’
prototypes.h:306: warning: unused parameter ‘stunnel_info’
prototypes.h:302: warning: unused parameter ‘signal_post’
prototypes.h:298: warning: unused parameter ‘bind_ports’
prototypes.h:297: warning: unused parameter ‘unbind_ports’
prototypes.h:296: warning: unused parameter ‘daemon_loop’
prototypes.h:295: warning: unused parameter ‘main_configure’
prototypes.h:294: warning: unused parameter ‘main_initialize’
prototypes.h:291: warning: unused parameter ‘num_clients’
prototypes.h:290: warning: unused parameter ‘max_clients’
prototypes.h:285: warning: unused parameter ‘FD’
prototypes.h:278: warning: unused parameter ‘DISK_FILE’
prototypes.h:269: warning: unused parameter ‘s_poll_set’
prototypes.h:256: warning: unused parameter ‘CONF_TYPE’
prototypes.h:252: warning: unused parameter ‘SOCK_OPT’
prototypes.h:244: warning: unused parameter ‘OPT_UNION’
prototypes.h:236: warning: unused parameter ‘VAL_TYPE’
prototypes.h:222: warning: unused parameter ‘SERVICE_OPTIONS’
prototypes.h:114: warning: unused parameter ‘GLOBAL_OPTIONS’
prototypes.h:72: warning: unused parameter ‘COMP_TYPE’
prototypes.h:67: warning: unused parameter ‘SOCKADDR_LIST’
prototypes.h:61: warning: unused parameter ‘SOCKADDR_UNION’
prototypes.h:50: warning: unused parameter ‘LOG_MODE’
make: *** [str.obj] Error 1
It seems it has hardcoded path to openssl (/usr/src/openssl-0.9.8s-fips). I
tried to change this path to the right one in Makefile*, but with no luck -
I get the same error.
I also tried to build stunnel with openssl-0.9.8s, but openssl configure
command from the instruction doesn't work:
root@debian:/usr/src/openssl-0.9.8s-i586# ./Configure
--cross-compile-prefix=i586-mingw32msvc- mingw shared zlib-dynamic
Usage: Configure [no-<cipher> ...] [enable-<cipher> ...]
[experimental-<cipher> ...] [-Dxxx] [-lxxx] [-Lxxx] [-fxxx] [-Kxxx]
[no-hw-xxx|no-hw] [[no-]threads] [[no-]shared] [[no-]zlib|zlib-dynamic]
[enable-montasm] [no-asm] [no-dso] [no-krb5] [386] [--prefix=DIR]
[--openssldir=OPENSSLDIR] [--with-xxx[=vvv]] [--test-sanity]
os/compiler[:flags]
Regards,
Anton.
3
11
Hello Stunnel-users,
Whenever I run Stunnel from a Windows 7 Virtual XP machine I receive
the following error message:
---------------------------
stunnel.exe - Application Error
---------------------------
The application failed to initialize properly (0xc0150002). Click on OK to terminate the application.
---------------------------
Any ideas as to what causes it or how I can get around the problem?
The result is the same regardless of version.
--
Best regards,
Generic
2
1
For several days, I've been using Stunnel (with Blat) successfully
(possibly with no intervening re-boots).
A day or so ago, the system was re booted
Today, however, Stunnel failed. I got the following Stunnel reply message:
No limit detected for the number of clients
stunnel 4.53 on x86-pc-mingw32-gnu platform
Compiled/running with OpenSSL 0.9.8s-fips 4 Jan 2012
Threading:WIN32 SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:SELECT+IPv6
Reading configuration from file stunnel.conf
FIPS mode is enabled
Compression not enabled
Snagged 64 random bytes from .rnd
Wrote 1024 new random bytes to .rnd
PRNG seeded successfully
Initializing inetd mode configuration
Certificate: client.pem
Certificate loaded
Key file: client.pem
Private key loaded
SSL options set: 0x00000004
Accept option is not allowed in inetd mode
Remove accept option or define a [section]
Server is down
The stunnel.conf file in the Stunnel directory is:
CAfile = cert.pem
cert = client.pem
client = yes
RNDfile = .rnd
[gmail smtp] ; (I may have had this in or out before. In "cleaning
up" various files, I may have thought this to be a comment, and removed it.)
accept = 25
connect = smtp.gmail.com:465
The program fails both with and without the [gmail smtp] line included.
Except, possibly, for removing ;[comment] lines, no other changes occurred.
Can somebody give me a clue as to the cause, and suggest the fix. I'm
running Windows Vista.
(I found the 17+ page instruction file, by Michal Trojnara, but didn't see
a solution, there.)
Thanks.
Roger Bohl
rhbohl(a)gmail.com
707-939-8459 PDT
1
0
1
0
I am running the latest stunnel for Windows on 64-bit Win7 as an
application, not as a service. I simply unzipped everything to one folder,
configured the "stunnel.conf" file; and when I need to run the program, I
can open a command prompt in its folder and type "stunnel stunnel.conf". It
then reads my stunnel.conf file and works its magic. This works fine for
capturing the data from those programs which I can configure to use
localhost and a specific port because I can configure stunnel.conf with
accept = ip.address:port
Now I have a program that I want to use to download some text files from the
internet using http or https. However, this program cannot be manually
configured to make a connection with a certain IP and port. Instead, I have
to give it an alias-like name, which it then maps to one of several
different domain names, makes a DNS query for the IP and transmits to that
address the instructions for downloading some text files.
So, is it possible to have stunnel "capture" any and all http transports
(port 80) or https transports (port 443) from a specific program, regardless
of which IP that connection was destined for, so that I can then direct this
data traffic from stunnel to socat or from stunnel to an http proxy which I
can manually direct to a specific connection? Is this a kind of thing for
which stunnel can be used? If so, where can I find the instructions for
setting it up? Thanks.
2
2
On FreeBSD 9.0 stunnel 4.43 works fine after running "service stunnel
restart", but stunnel fails loading on boot.
My desired config includes:
/usr/local/etc/stunnel/stunnel.conf
--------------------------------------------
[attsmtp]
client = yes
verify = 0
accept = 2525
connect = smtp.att.yahoo.com:465
delay = yes
Please advise.
See below for messages after bootup:
/var/run/stunnel/stunnel.log
------------------------------------
2012.07.21 02:52:06 LOG7[1378:675300096]: No limit detected for the number of clients
2012.07.21 02:52:06 LOG7[1378:675300096]: signal_pipe: FD=3 allocated (non-blocking mode)
2012.07.21 02:52:06 LOG7[1378:675300096]: signal_pipe: FD=4 allocated (non-blocking mode)
2012.07.21 02:52:06 LOG5[1378:675300096]: stunnel 4.43 on i386-portbld-freebsd9.0 platform
2012.07.21 02:52:06 LOG5[1378:675300096]: Compiled/running with OpenSSL 1.0.0e 6 Sep 2011
2012.07.21 02:52:06 LOG5[1378:675300096]: Threading:PTHREAD SSL:ENGINE Auth:LIBWRAP Sockets:POLL,IPv6
2012.07.21 02:52:06 LOG5[1378:675300096]: Reading configuration from file /usr/local/etc/stunnel/stunnel.conf
2012.07.21 02:52:06 LOG7[1378:675300096]: Snagged 64 random bytes from //.rnd
2012.07.21 02:52:06 LOG7[1378:675300096]: Wrote 1024 new random bytes to //.rnd
2012.07.21 02:52:06 LOG7[1378:675300096]: PRNG seeded successfully
2012.07.21 02:52:08 LOG6[1378:675300096]: Initializing SSL context for service attsmtp
2012.07.21 02:52:08 LOG7[1378:675300096]: SSL options set: 0x00000004
2012.07.21 02:52:08 LOG6[1378:675300096]: SSL context initialized
2012.07.21 02:52:08 LOG5[1378:675300096]: Configuration successful
2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=5 allocated (blocking mode)
2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=6 allocated (blocking mode)
2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=6 allocated (blocking mode)
2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=7 allocated (blocking mode)
2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=7 allocated (blocking mode)
2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=8 allocated (blocking mode)
2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=8 allocated (blocking mode)
2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=9 allocated (blocking mode)
2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=9 allocated (blocking mode)
2012.07.21 02:52:08 LOG7[1378:675300096]: libwrap_init: FD=10 allocated (blocking mode)
2012.07.21 02:52:08 LOG7[1378:675300096]: accept socket: FD=11 allocated (non-blocking mode)
2012.07.21 02:52:08 LOG7[1378:675300096]: Option SO_REUSEADDR set on accept socket
2012.07.21 02:52:08 LOG7[1378:675300096]: Service attsmtp bound to 0.0.0.0:2525
2012.07.21 02:52:08 LOG7[1378:675300096]: Service attsmtp opened FD=11
2012.07.21 02:52:08 LOG7[1378:675300096]: Created pid file /stunnel.pid
2012.07.21 02:52:15 LOG7[1378:675300096]: Dispatching signals from the signal pipe
2012.07.21 02:52:15 LOG3[1378:675300096]: Received signal 2; terminating
2012.07.21 02:52:15 LOG7[1378:675300096]: str_stats: 43 block(s), 3554 byte(s)
2012.07.21 02:52:15 LOG7[1378:675300096]: removing pid file /stunnel.pid
1
1
[To the mailing list:
Sorry for these non-english messages, I started, previously, a private
communication to avoid it]
On Thu, 19 Jul 2012 20:26:45 +0200
"Jorge A." <curruscataphractus(a)gmail.com> wrote:
> Hola Javier,
>
> Igual no me he explicado bien. Lo que quiero es conectar dos
> máquinas, una dentro de una NAT detrás de un router que no tiene
> redirigidos los puertos a la máquina claro, pero que sí tiene
> Internet y acceso a la máquina servidor.
Esto me sigue sin quedar claro. Ya perdonarás. Una (Objetivo) está
conectada a un router, que sirve internet a una red local, pero que
no tiene redirigidos los puertos a la máquina que tiene el servidor
http. Esta no tiene acceso a internet porque no se le ha configurado
una puerta de enlace y además no la pueden alcanzar porque no hay
puertos redirigidos hacia ella. Hasta ahí, todo bien ;)
Lo que quería saber es si la máquina que hace de Servidor hacia
internet está en la misma subred local o no que la máquina objetivo.
El que la máquina objetivo vea al servidor no implica
necesariamente que el servidor vea al objetivo. Además, si está
conectada al mismo router, porque decías que era accesible
desde internet.
Lo que entiendo es que quieres redirigir el tráfico proveniente al
servidor desde el exterior al objetivo http. Si el servidor, ve a la
máquina http, bastaría con decir en la configuración de stunnel que
conecte con el servidor http de esa maquina indicándole la ip:puerto.
Por eso te dije que no tenía mayor complicación.
En esa configuración no hace falta que la máquina objetivo tenga un
servidor stunnel y viceversa para comunicarse entre ellos. La
comunicación entre el servidor y la máquina objetivo puede ser
abierta sin problemas. Lo importante ya existe, que el servidor haga
de puente ssl entre internet y el objetivo http.
> Durante el día de hoy lo he conseguido hacer más o menos usando
> pppd y stunnel entre 2 linux pero no sé si sería posible hacerlo
> sólo con stunnel (y *ifconfig*, *ip*, *route* o similares). Sobre
> todo porque la máquina cliente objetivo está bastante limitada y no
> puedo instalar de manera fácil pppd (tiene un kernel custom, hay
> que compilar el módulo pppd del kernel, el demonio, etc).
>
> Lo que estoy mirando ahora es el comando *ip tunnel* para per si
> puedo hacer algo parecido con pppd pero no sé si me estoy dando
> golpes contra la pared.
>
> Muchas gracias de antemano por tu ayuda.
De nada, aunque con Linux he topado. Conozco muy por encima los
comandos. Pero, olvidándonos de las herramientas a utilizar, sabiendo
exactamente el entorno en el que están esas máquinas, todo es coser y
cantar, a no ser que sea un imposible ;)
De ahí la importancia de saber si están en la misma red local o no,
etc.
Saludos.
1
1