stunnel-users January 2014

19 participants
22 discussions

Question about 'delay = yes' and DNS cache
by John Chow 16 Jan '14

16 Jan '14

Hey Everyone, I have a question about the *delay = yes* config flag and whether or not it caches the resolved IP after the initial connection? To give context, I want my load balancer (Haproxy) to forward requests to an app on Heroku, and I'm using stunnel on my LB box to proxy to Heroku via HTTPS. Since the IP for my app's endpoint could potentially change (60s DNS TTL), stunnel caching resolved IPs would be a problem. Thanks, John -- John Chow Software Engineer Fundly

2 1

Silent install on windows ?
by Brian Ipsen 16 Jan '14

16 Jan '14

Hi I have been searching through google, and from the result there, it should be possible to install stunnel silently on Windows using a /S switch.... I have tried this with the stunnel-4.56-installer.exe package - but it doesn't seem to work..... Can anyone tell me how to install stunnel silently - with no user interaction at all ? Regards /Brian

2 1

Multiple OCPSs
by Ender Erel 16 Jan '14

16 Jan '14

Hi All, We want to use multiple OCSP servers, but the way I see it we can specify only one OCSP server in the configuration file. Is there any other way to do this? Regards, Ender

2 1

Extra listeneres running that loop back to each other.
by Keith Knapp 15 Jan '14

15 Jan '14

Hi, Every time I start stunnel two unexplainable things happen. 1. The settings in my .conf file are not implemented and I have checked them syntactically. 2. I use TCPView and can see two established connections associated with the stunnel process, but they are *not* in my .conf file - Every time I restart the service the two connections reappear but are associated with different ports. - Furthermore the connections loop back on each other; meaning that the remote port of the one connection is the local port of the other connection (and vice-versa). - Are these supposed to be there? I have done a fresh install of the newest version of stunnel. Keith

1 0

Re: connect error 0 running on ARM platform
by FX35 15 Jan '14

15 Jan '14

> Message: 1 > Date: Tue, 14 Jan 2014 12:19:47 +0100 > From: Michal Trojnara <Michal.Trojnara(a)mirt.net> > To: stunnel-users(a)stunnel.org > Subject: [stunnel-users] Fwd: Re: connect error 0 running on ARM > platform > Message-ID: <52D51D53.5030106(a)mirt.net> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > FWX wrote: >> errno is not updated ... >> >> So errno doen't reflect the real value. >> >> Map file of stunnel programm shows _errno_localion(), as you wrote. >> >> Perhaps is there a bug in uClib ? > > Something like this one: > http://www.mail-archive.com/[email protected]/msg05640.html > http://www.mail-archive.com/[email protected]/msg05641.html > or: > http://www.mail-archive.com/[email protected]/msg09301.html > ? > > It indeed looks like uclibc and stunnel use a different errno... > > Mike > > Thank you, Mike, I think you're right. It's ok using mode fork rather than pthread. Regards, FWX.

1 0

newbie question
by Ted Roeloffzen 15 Jan '14

15 Jan '14

Hello All, I'm new to STunnel and installed and setup STunnel. When someone tried to connect I get the following items in the log. SSL accepted: new session negotiated Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 FD 8 in non-blocking mode SL-test>Instelling connecting 127.0.0.1:8890 connect_wait: waiting 10 seconds connect_wait: connected Remote FD=8 initialized SSL alert (read): warning: close notify SSL closed on SSL_read Socket write shutdown SSL write shutdown SSL alert (write): warning: close notify SSL_shutdown successfully sent close_notify Connection closed: 0 bytes sent to SSL, 0 bytes sent to socket SL-test>Instelling finished (0 left) As I'm reading this, there was an established connection but the connection party disconnected, for some reason or another. There was no data sent, but there also was no real error. Is this assumption correct or am I missing something? kind regards, Ted

1 0

Re: [stunnel-users] connect error 0 running on ARM platform
by FX35 14 Jan '14

14 Jan '14

> Message: 3 > Date: Fri, 10 Jan 2014 15:27:10 +0100 > From: Michal Trojnara <Michal.Trojnara(a)mirt.net> > To: stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] connect error 0 running on ARM platform > Message-ID: <52D0033E.1060109(a)mirt.net> > Content-Type: text/plain; charset="iso-8859-1"; Format="flowed" > > On 01/09/2014 06:02 PM, FX35 wrote: >> Running stunnel 4.56 or 5.00 on an ARM platform (ARM926EJ) with Linux >> 2.6.36.4, I encounter the following error : the call to connect() >> return -1, but errno is set to 0 ! >> >> If stunnel is configured to use fork mode instead of pthread mode, >> the problem disapear. >> >> So it seems there is a problem, cross-compiling the program, with >> errno or __errno_location() in the program generated with pthread. >> >> I add the definition of _REENTRANT, without success ... >> >> (See $H1 at http://pauillac.inria.fr/~xleroy/linuxthreads/faq.html) >> >> Is somebody meet the same error ? > > The errno definition in the Android framework (as an example of > Linux/ARM platform) is: > > /* internal function returning the address of the thread-specific > errno */ > extern volatile int* __errno(void); > > /* a macro expanding to the errno l-value */ > #define errno (*__errno()) > > > It seems okay. > > How do you reproduce this problem? What are the stunnel debug logs when > it happens? > > Mike Hello Mike, It seems that the errno variable is not correcly set/updated in C library, using pthread mode. Sample: errno = -1; ret = connect(...); if( ret == -1 ) { printf("errno=%d\n",errno); } will displays value -1 for errno, not EINPROGRESS or EWOULDBLOCK ! errno is not updated ... So errno doen't reflect the real value. Map file of stunnel programm shows _errno_localion(), as you wrote. Perhaps is there a bug in uClib ? Here is the result of ldd command: # ldd stunnel libssl.so.1.0.0 => /usr/lib/libssl.so.1.0.0 (0x400f3000) libcrypto.so.1.0.0 => /usr/lib/libcrypto.so.1.0.0 (0x4013d000) libz.so.1 => /usr/lib/libz.so.1 (0x4027c000) libdl.so.0 => /lib/libdl.so.0 (0x4029b000) libutil.so.0 => /lib/libutil.so.0 (0x4009e000) libpthread.so.0 => /lib/libpthread.so.0 (0x400a7000) libc.so.0 => /lib/libc.so.0 (0x402a6000) libgcc_s.so.1 => /lib/libgcc_s.so.1 (0x400c6000) ld-uClibc.so.0 => /lib/ld-uClibc.so.0 (0x4008f000) Thanks for help. Regards, FWX.

2 1

connect error 0 running on ARM platform
by FX35 10 Jan '14

10 Jan '14

Hello, Running stunnel 4.56 or 5.00 on an ARM platform (ARM926EJ) with Linux 2.6.36.4, I encounter the following error : the call to connect() return -1, but errno is set to 0 ! If stunnel is configured to use fork mode instead of pthread mode, the problem disapear. So it seems there is a problem, cross-compiling the program, with errno or __errno_location() in the program generated with pthread. I add the definition of _REENTRANT, without success ... (See $H1 at http://pauillac.inria.fr/~xleroy/linuxthreads/faq.html) Is somebody meet the same error ? Thanks for help. FWX.

2 1

What checks are made for verify=2
by Ender Erel 10 Jan '14

10 Jan '14

Hi All, I have been searching the web for information on what checks are made for verify=2 but I can't find any detailed information. What exactly goes on when I use verify=2 in client mode? Does stunnel only check if the certificate is signed by a valid CA? Or are any other X.509 attributes checked? Does it disallow settings like "CA=true"? I would really appreciate it if someone could point me where I can find about details of various verify levels. Thanks, Ender Erel

1 0

Stunnel cuts off message
by bernabei＠infinito.it 09 Jan '14

09 Jan '14

Hi,     I'd like to know why Stunnel cuts off messages. I use stunnel both the client and server side,the problem is that my client receives only a cutted off responce from the server,whose size turns out to be 18 KB. Hope an answer Thanks Chiara Bernabei

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users January 2014