I am faling to connect to gmail. Not sure what that bind error means.
iqbala@ghar:~$ sudo stunnel4
2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes
from /home/iqbala/.rnd
2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes
to /home/iqbala/.rnd
2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims
sufficient entropy for the PRNG
2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully
2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem
2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded
2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem
2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded
2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for
service ssmtp
2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on
i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007
2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD
SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP
2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be
changed with 'ulimit -n')
2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE
limit for file descriptors
2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed
2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode
2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode
2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode
2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on
accept socket
2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to
74.125.93.111:587
2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign
requested address (99)
Here is how my conf file looks like
iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$"
cert = /etc/stunnel/stunnel.pem
foreground = yes
sslVersion = SSLv3
chroot = /var/lib/stunnel4/
setuid = stunnel4
setgid = stunnel4
pid = /stunnel4.pid
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
debug = 7
output = /var/log/stunnel4/stunnel.log
client = yes
[ssmtp]
accept = smtp.gmail.com:587
connect = 25
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
5
9
Hi,
This may be a little bit off-topic, but does anyone here use stunnel with
pan? My connections to stunnel (in pan) are always refused by libwrap. I was
looking for the right rule to add to /etc/hosts.allow but nothing seems to
work aside from "ALL : ALL" (which is obviously not good) and "nntps:
KNOWN". Is the latter reasonable? The hosts_access(5) manpage is confusing
to say the least. It mentions that daemon (the first token on any line) is
the name of the daemon running the process, which would be "stunnel" in my
case, but using "stunnel : LOCAL" or even "stunnel : ALL" doesn't work. The
rule that seems to work, as mentioned, is "nntps : KNOWN" ("nntps" being the
group name in stunnel.conf).
What's even more confusing to me is that "nntps : LOCAL" does not work
either. Nor does "nntps : localhost 127.0.0.1", "nntps : localhost", "nntps
: 127.0.0.1", or "nntps : 192.168.1.". Pan is running on the same machine as
stunnel so all connections must be coming from localhost. Why do these rules
not trigger?
Either way, I'd like to know the "least permissive" hosts.allow rule that
would allow me to connect to my news provider from pan, and/or whether
"nntps : KNOWN" is a safe option.
Thanks,
Yousef
3
6
Re: [stunnel-users] [stunnel-announce] stunnel 5.10 released - Problem compiling stunnel 5.10 with openssl 1.0.2
by WNSDEV 26 Feb '15
by WNSDEV 26 Feb '15
26 Feb '15
stunnel 5.10
openssl 1.0.2
Ubuntu 10.04 Server lucid
after installing automake-1.14.1 (required as of 5.08) and running configure without a problem, make fails with this message:
/usr/bin/ld: /ssl-1.0.2/lib/libssl.a(s2_srvr.o): relocation R_X86_64_32 against `.rodata' can not be used when making a shared object; recompile with -fPIC
/ssl-1.0.2/lib/libssl.a: could not read symbols: Bad value
I can resolve this issue by commenting the assignment of CFLAGS and LDFLAGS in the stunnel configure script so -fPIE and -pie -fPIE are not implemented.
# stunnel_CFLAGS="$stunnel_CFLAGS -fPIE"
# stunnel_LDFLAGS="$stunnel_LDFLAGS -pie -fPIE"
This is not required in stunnel 5.07 or earlier versions. I'm not sure exactly what the issue is here.. can anyone explain what the conflict is?
Thx Pete
-----Original Message-----
From: Michal Trojnara [mailto:[email protected]]
Sent: Thursday, January 22, 2015 9:20 AM
To: stunnel-users(a)stunnel.org; stunnel-announce(a)stunnel.org; openssl-users(a)openssl.org
Subject: [stunnel-announce] stunnel 5.10 released
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Dear Users,
I have released version 5.10 of stunnel.
The ChangeLog entry:
Version 5.10, 2015.01.22, urgency: LOW:
* New features
- OCSP AIA (Authority Information Access) support. This feature
can be enabled with the new service-level option "OCSPaia".
- Additional security features of the linker are enabled:
"-z relro", "-z now", "-z noexecstack".
* Bugfixes
- OpenSSL DLLs updated to version 1.0.1l.
https://www.openssl.org/news/secadv_20150108.txt
- FIPS canister updated to version 2.0.9 in the Win32 binary
build.
Home page: https://www.stunnel.org/
Download: https://www.stunnel.org/downloads.html
SHA-256 hashes:
032bfc1854f8a0b9e452343c36ec6b52c7e0daef0863423c6b13a61a7c92eb23
stunnel-5.10.tar.gz
7c29753b6488f37b29f365e9c4a6060c3da8a89000af1cd29eab7c37d419d148
stunnel-5.10-installer.exe
93cd0941580eaa7815ed62ec88a111cb449e9bad97cd1a35d7524867a8238234
stunnel-5.10-android.zip
Best regards,
Mike
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iEYEARECAAYFAlTBMTsACgkQ/NU+nXTHMtE+uQCg9N0butSpAQ2mM1M5ySe7T18i
oe8AoOAHKJ9F7jMlUfHnmuzBtIPbbghN
=e9ed
-----END PGP SIGNATURE-----
_______________________________________________
stunnel-announce mailing list
stunnel-announce(a)stunnel.org
https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-announce
2
1
Hi,
I want to use stunnel to enable ssl on port 995.
Unfortunately, I got "SSL error: Unable to verify the first
certificate." when using the gmail pop3 retrieval
My Certificate is signed by wosign and included in the mozialla
truststore list.
https://www.ssllabs.com/ssltest/analyze.html gives me a grad A for my
apache configuration and chrome and firefox are also fine with this
certificate. So it's no self signed one.
For a test I have configured stunnel to serve https. I get than the
message that the chain is incomplete.
According to
https://www.digicert.com/ssl-support/gmail-pop3-troubleshooting.htm this
could be one reason for this error.
My Apache-config looks like this
SSLCertificateFile /etc/apache2/ssl/mydomain.crt
SSLCertificateKeyFile /etc/apache2/ssl//mydomain.key
SSLCertificateChainFile /etc/apache2/ssl/1_root_bundle.crt
SSLCACertificateFile /etc/apache2/ssl/ca-certs.pem
for stunnel I used
cert = /etc/apache2/ssl/mydomain.crt
key = /etc/apache2/ssl//mydomain.key
CAfile = /etc/apache2/ssl/1_root_bundle.crt or ca-certs.pem (I have
tried both).
What is the a similar configuration in stunnel?
The Post
https://www.stunnel.org/pipermail/stunnel-users/2010-February/002594.html mentioned,
that the chain must be completely in the crt-file.
But a description how to achieve this is missing and I found no other
resources describing this.
Thanks a lot
Tobias
1
0
HI,
We are already using stunnel as SSL wrapper for retrieving emails from POP3 servers to our application server. In future the mailboxes are planned to be migrated to EWS servers. Would like to know if stunnel holds good for EWS servers as well.
Regards,Shanmuganathan
2
1
Hi
I have a strange issue with stunnel 5.09 - which connects up to a F5 loadbalancer/SSL-offloading engine. In my config, I specify that the protocol must be TLSv1 - from Linux, I can connect - but it does not work from Windows..
Linux log:
2015.02.10 15:58:29 LOG7[22779]: Service [rb20] accepted (FD=3) from 127.0.0.1:33247
2015.02.10 15:58:29 LOG7[22887]: Service [rb20] started
2015.02.10 15:58:29 LOG5[22887]: Service [rb20] accepted connection from 127.0.0.1:33247
2015.02.10 15:58:29 LOG6[22887]: s_connect: connecting A.B.C.D:443
2015.02.10 15:58:29 LOG7[22887]: s_connect: s_poll_wait A.B.C.D:443: waiting 10 seconds
2015.02.10 15:58:29 LOG5[22887]: s_connect: connected A.B.C.D:443
2015.02.10 15:58:29 LOG5[22887]: Service [rb20] connected remote server from 10.11.12.101:33477
2015.02.10 15:58:29 LOG7[22887]: Remote socket (FD=11) initialized
2015.02.10 15:58:29 LOG6[22887]: SNI: sending servername: host.domain.com
2015.02.10 15:58:29 LOG7[22887]: SSL state (connect): before/connect initialization
2015.02.10 15:58:29 LOG7[22887]: SSL state (connect): SSLv3 write client hello A
2015.02.10 15:58:29 LOG7[22887]: SSL state (connect): SSLv3 read server hello A
2015.02.10 15:58:29 LOG7[22887]: SSL state (connect): SSLv3 read finished A
2015.02.10 15:58:29 LOG7[22887]: SSL state (connect): SSLv3 write change cipher spec A
2015.02.10 15:58:29 LOG7[22887]: SSL state (connect): SSLv3 write finished A
2015.02.10 15:58:29 LOG7[22887]: SSL state (connect): SSLv3 flush data
2015.02.10 15:58:29 LOG7[22887]: 1 items in the session cache
2015.02.10 15:58:29 LOG7[22887]: 5 client connects (SSL_connect())
2015.02.10 15:58:29 LOG7[22887]: 5 client connects that finished
2015.02.10 15:58:29 LOG7[22887]: 0 client renegotiations requested
2015.02.10 15:58:29 LOG7[22887]: 0 server connects (SSL_accept())
2015.02.10 15:58:29 LOG7[22887]: 0 server connects that finished
2015.02.10 15:58:29 LOG7[22887]: 0 server renegotiations requested
2015.02.10 15:58:29 LOG7[22887]: 4 session cache hits
2015.02.10 15:58:29 LOG7[22887]: 0 external session cache hits
2015.02.10 15:58:29 LOG7[22887]: 0 session cache misses
2015.02.10 15:58:29 LOG7[22887]: 0 session cache timeouts
2015.02.10 15:58:29 LOG6[22887]: SSL connected: previous session reused
2015.02.10 15:58:29 LOG7[22779]: Service [rb20] accepted (FD=12) from 127.0.0.1:33249
2015.02.10 15:58:29 LOG6[22887]: Read socket closed (read hangup)
2015.02.10 15:58:29 LOG7[22887]: Sending close_notify alert
2015.02.10 15:58:29 LOG7[22887]: SSL alert (write): warning: close notify
2015.02.10 15:58:29 LOG6[22887]: SSL_shutdown successfully sent close_notify alert
2015.02.10 15:58:29 LOG7[22888]: Service [rb20] started
2015.02.10 15:58:29 LOG5[22888]: Service [rb20] accepted connection from 127.0.0.1:33249
2015.02.10 15:58:29 LOG6[22888]: s_connect: connecting A.B.C.D:443
2015.02.10 15:58:29 LOG7[22888]: s_connect: s_poll_wait A.B.C.D:443: waiting 10 seconds
2015.02.10 15:58:29 LOG5[22888]: s_connect: connected A.B.C.D:443
2015.02.10 15:58:29 LOG5[22888]: Service [rb20] connected remote server from 10.11.12.101:33479
2015.02.10 15:58:29 LOG7[22888]: Remote socket (FD=13) initialized
2015.02.10 15:58:29 LOG6[22888]: SNI: sending servername: ssl39.dmsave.com
2015.02.10 15:58:29 LOG7[22888]: SSL state (connect): before/connect initialization
2015.02.10 15:58:29 LOG7[22888]: SSL state (connect): SSLv3 write client hello A
2015.02.10 15:58:29 LOG6[22887]: SSL socket closed (SSL_read)
2015.02.10 15:58:29 LOG7[22887]: Sent socket write shutdown
2015.02.10 15:58:29 LOG5[22887]: Connection closed: 136 byte(s) sent to SSL, 52 byte(s) sent to socket
2015.02.10 15:58:29 LOG7[22887]: Remote socket (FD=11) closed
2015.02.10 15:58:29 LOG7[22887]: Local socket (FD=3) closed
2015.02.10 15:58:29 LOG7[22887]: Service [rb20] finished (1 left)
2015.02.10 15:58:29 LOG7[22888]: SSL state (connect): SSLv3 read server hello A
2015.02.10 15:58:29 LOG7[22888]: SSL state (connect): SSLv3 read finished A
2015.02.10 15:58:29 LOG7[22888]: SSL state (connect): SSLv3 write change cipher spec A
2015.02.10 15:58:29 LOG7[22888]: SSL state (connect): SSLv3 write finished A
2015.02.10 15:58:29 LOG7[22888]: SSL state (connect): SSLv3 flush data
2015.02.10 15:58:29 LOG7[22888]: 1 items in the session cache
2015.02.10 15:58:29 LOG7[22888]: 6 client connects (SSL_connect())
2015.02.10 15:58:29 LOG7[22888]: 6 client connects that finished
2015.02.10 15:58:29 LOG7[22888]: 0 client renegotiations requested
2015.02.10 15:58:29 LOG7[22888]: 0 server connects (SSL_accept())
2015.02.10 15:58:29 LOG7[22888]: 0 server connects that finished
2015.02.10 15:58:29 LOG7[22888]: 0 server renegotiations requested
2015.02.10 15:58:29 LOG7[22888]: 5 session cache hits
2015.02.10 15:58:29 LOG7[22888]: 0 external session cache hits
2015.02.10 15:58:29 LOG7[22888]: 0 session cache misses
2015.02.10 15:58:29 LOG7[22888]: 0 session cache timeouts
2015.02.10 15:58:29 LOG6[22888]: SSL connected: previous session reused
Windows log:
2015.02.10 16:07:36 LOG7[9528]: Service [rb20] accepted (FD=1128) from 127.0.0.1:50353
2015.02.10 16:07:36 LOG7[9528]: Creating a new thread
2015.02.10 16:07:36 LOG7[9528]: New thread created
2015.02.10 16:07:36 LOG7[7056]: Service [rb20] started
2015.02.10 16:07:36 LOG5[7056]: Service [rb20] accepted connection from 127.0.0.1:50353
2015.02.10 16:07:36 LOG6[7056]: s_connect: connecting A.B.C.D:443
2015.02.10 16:07:36 LOG7[7056]: s_connect: s_poll_wait A.B.C.D:443: waiting 10 seconds
2015.02.10 16:07:36 LOG5[7056]: s_connect: connected A.B.C.D:443
2015.02.10 16:07:36 LOG5[7056]: Service [rb20] connected remote server from 192.168.225.103:50354
2015.02.10 16:07:36 LOG7[7056]: Remote socket (FD=1124) initialized
2015.02.10 16:07:36 LOG6[7056]: SNI: sending servername: host.domain.com
2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): before/connect initialization
2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): SSLv3 write client hello A
2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): SSLv3 read server hello A
2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): SSLv3 read server certificate A
2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): SSLv3 read server done A
2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): SSLv3 write client key exchange A
2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): SSLv3 write change cipher spec A
2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): SSLv3 write finished A
2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): SSLv3 flush data
2015.02.10 16:07:36 LOG7[7056]: SSL state (connect): SSLv3 read finished A
2015.02.10 16:07:36 LOG7[7056]: 1 items in the session cache
2015.02.10 16:07:36 LOG7[7056]: 1 client connects (SSL_connect())
2015.02.10 16:07:36 LOG7[7056]: 1 client connects that finished
2015.02.10 16:07:36 LOG7[7056]: 0 client renegotiations requested
2015.02.10 16:07:36 LOG7[7056]: 0 server connects (SSL_accept())
2015.02.10 16:07:36 LOG7[7056]: 0 server connects that finished
2015.02.10 16:07:36 LOG7[7056]: 0 server renegotiations requested
2015.02.10 16:07:36 LOG7[7056]: 0 session cache hits
2015.02.10 16:07:36 LOG7[7056]: 0 external session cache hits
2015.02.10 16:07:36 LOG7[7056]: 0 session cache misses
2015.02.10 16:07:36 LOG7[7056]: 0 session cache timeouts
2015.02.10 16:07:36 LOG7[7056]: Peer certificate was cached (1521 bytes)
2015.02.10 16:07:36 LOG6[7056]: SSL connected: new session negotiated
2015.02.10 16:07:36 LOG6[7056]: Negotiated TLSv1 ciphersuite RC4-MD5 (128-bit encryption)
2015.02.10 16:07:36 LOG7[7056]: Compression: null, expansion: null
2015.02.10 16:07:36 LOG6[7056]: Read socket closed (readsocket)
2015.02.10 16:07:36 LOG7[7056]: Sending close_notify alert
2015.02.10 16:07:36 LOG7[7056]: SSL alert (write): warning: close notify
2015.02.10 16:07:36 LOG6[7056]: SSL_shutdown successfully sent close_notify alert
2015.02.10 16:07:36 LOG7[9528]: Service [rb20] accepted (FD=1132) from 127.0.0.1:50355
2015.02.10 16:07:36 LOG7[9528]: Creating a new thread
2015.02.10 16:07:36 LOG7[9528]: New thread created
2015.02.10 16:07:36 LOG7[2164]: Service [rb20] started
2015.02.10 16:07:36 LOG5[2164]: Service [rb20] accepted connection from 127.0.0.1:50355
2015.02.10 16:07:36 LOG6[2164]: s_connect: connecting A.B.C.D:443
2015.02.10 16:07:36 LOG7[2164]: s_connect: s_poll_wait A.B.C.D:443: waiting 10 seconds
2015.02.10 16:07:36 LOG5[2164]: s_connect: connected A.B.C.D:443
2015.02.10 16:07:36 LOG5[2164]: Service [rb20] connected remote server from 192.168.225.103:50356
2015.02.10 16:07:36 LOG7[2164]: Remote socket (FD=1152) initialized
2015.02.10 16:07:36 LOG6[2164]: SNI: sending servername: host.domain.com
2015.02.10 16:07:36 LOG7[2164]: SSL state (connect): before/connect initialization
2015.02.10 16:07:36 LOG7[2164]: SSL state (connect): SSLv3 write client hello A
2015.02.10 16:07:36 LOG6[7056]: SSL socket closed (SSL_read)
2015.02.10 16:07:36 LOG7[7056]: Sent socket write shutdown
2015.02.10 16:07:36 LOG5[7056]: Connection closed: 89 byte(s) sent to SSL, 52 byte(s) sent to socket
2015.02.10 16:07:36 LOG7[7056]: Remote socket (FD=1124) closed
2015.02.10 16:07:36 LOG7[7056]: Local socket (FD=1128) closed
2015.02.10 16:07:36 LOG7[7056]: Service [rb20] finished (1 left)
The main difference I can see, is that on Linux I get:
2015.02.10 15:58:29 LOG6[22887]: SSL connected: previous session reused
Whereas Windows gives me:
2015.02.10 16:07:36 LOG7[7056]: Peer certificate was cached (1521 bytes)
2015.02.10 16:07:36 LOG6[7056]: SSL connected: new session negotiated
Any idea why this happens ? The final result is that connections are possible from linux - but not Windows - and this is a problem for me...
Regards
/Brian
2
2
Hi,
we would like to use stunnel in transpartent mode. Therefore we already applied iptable changes as mentioned in the man page :
Re-write address to appear as if wrapped daemon is connecting from the SSL client machine instead of the machine running stunnel.
This option is currently available in:
remote mode (I<connect> option) on Linux >=2.6.28
Linux >=2.6.28 requires the following setup for iptables and routing (possibly in /etc/rc.local or equivalent file):
iptables -t mangle -N DIVERT
iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT
iptables -t mangle -A DIVERT -j MARK --set-mark 1
iptables -t mangle -A DIVERT -j ACCEPT
ip rule add fwmark 1 lookup 100
ip route add local 0.0.0.0/0 dev lo table 100
However the connection to the services cannot be established and we run into a timeout.
2015.02.09 10:00:03 LOG7[6658:139940568909760]: ldaps-in accepted FD=12 from xxxxxx:51018
2015.02.09 10:00:03 LOG7[6658:139940568905472]: ldaps-in started
2015.02.09 10:00:03 LOG7[6658:139940568905472]: FD 12 in non-blocking mode
2015.02.09 10:00:03 LOG7[6658:139940568905472]: Waiting for a libwrap process
2015.02.09 10:00:03 LOG7[6658:139940568905472]: Acquired libwrap process #0
2015.02.09 10:00:03 LOG7[6658:139940568905472]: Releasing libwrap process #0
2015.02.09 10:00:03 LOG7[6658:139940568905472]: Released libwrap process #0
2015.02.09 10:00:03 LOG7[6658:139940568905472]: ldaps-in permitted by libwrap from xxxxxxx:51018
2015.02.09 10:00:03 LOG5[6658:139940568905472]: ldaps-in accepted connection from xxxxxxx:51018
2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): before/accept initialization
2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 read client hello A
2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 write server hello A
2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 write certificate A
2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 write server done A
2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 flush data
2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 read client key exchange A
2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 read finished A
2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 write change cipher spec A
2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 write finished A
2015.02.09 10:00:03 LOG7[6658:139940568905472]: SSL state (accept): SSLv3 flush data
2015.02.09 10:00:03 LOG7[6658:139940568905472]: 1 items in the session cache
2015.02.09 10:00:03 LOG7[6658:139940568905472]: 0 client connects (SSL_connect())
2015.02.09 10:00:03 LOG7[6658:139940568905472]: 0 client connects that finished
2015.02.09 10:00:03 LOG7[6658:139940568905472]: 0 client renegotiations requested
2015.02.09 10:00:03 LOG7[6658:139940568905472]: 1 server connects (SSL_accept())
2015.02.09 10:00:03 LOG7[6658:139940568905472]: 1 server connects that finished
2015.02.09 10:00:03 LOG7[6658:139940568905472]: 0 server renegotiations requested
2015.02.09 10:00:03 LOG7[6658:139940568905472]: 0 session cache hits
2015.02.09 10:00:03 LOG7[6658:139940568905472]: 0 external session cache hits
2015.02.09 10:00:03 LOG7[6658:139940568905472]: 0 session cache misses
2015.02.09 10:00:03 LOG7[6658:139940568905472]: 0 session cache timeouts
2015.02.09 10:00:03 LOG6[6658:139940568905472]: SSL accepted: new session negotiated
2015.02.09 10:00:03 LOG6[6658:139940568905472]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1
2015.02.09 10:00:03 LOG7[6658:139940568905472]: FD 13 in non-blocking mode
2015.02.09 10:00:03 LOG6[6658:139940568905472]: local_bind succeeded on the original port
2015.02.09 10:00:03 LOG6[6658:139940568905472]: connect_blocking: connecting 127.0.0.1:10389
2015.02.09 10:00:03 LOG7[6658:139940568905472]: connect_blocking: s_poll_wait 127.0.0.1:10389: waiting 10 seconds
2015.02.09 10:00:13 LOG3[6658:139940568905472]: connect_blocking: s_poll_wait 127.0.0.1:10389: timeout
2015.02.09 10:00:13 LOG5[6658:139940568905472]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket
2015.02.09 10:00:13 LOG7[6658:139940568905472]: ldaps-in finished (0 left)
Any idea why the timeout is occuring?
Best regards,
Shushant
1
0
Dear Users,
As of now I'm starting to sign my emails and code with a new PGP key.
The new key is attached to this email message, and available at
https://www.stunnel.org/pgp.asc
Key fingerprint = AC91 5EA3 0645 D9D3 D4DA E4FE B104 8932 DD3A AAA3
The new key is also signed with my previous PGP key.
This and other signatures can be verified with:
gpg --check-sigs "AC91 5EA3 0645 D9D3 D4DA E4FE B104 8932 DD3A AAA3"
Best regards,
Mike
1
0
Hi,
I'm using stunnel to communicate with FIX server.
In order to do that, I disabled SSLv2 and SSLv3 and set the sslVersion to
TLSv1.
It seems like stunnel keeps trying using SSLv3 handshake, which isn't
working.
This is the configuration:
client = yes
debug = 7
output=stunnel.log
cert = stunnel.pem
; Some performance tunings
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
; Turning for LMAX
options = NO_SSLv2
options = NO_SSLv3
[LMAX-fix-tunnel-DEMO-Trading]
sslVersion = TLSv1
accept = 40001
connect = fix-ate.lmaxtrader.com:443
stunnel log:
2015.02.04 12:10:31 LOG7[12516]: Service [LMAX-fix-tunnel-DEMO-MktData]
started
2015.02.04 12:10:31 LOG5[12516]: Service [LMAX-fix-tunnel-DEMO-MktData]
accepted connection from 127.0.0.1:59475
2015.02.04 12:10:31 LOG6[12516]: s_connect: connecting 91.215.165.69:443
2015.02.04 12:10:31 LOG7[12516]: s_connect: s_poll_wait 91.215.165.69:443:
waiting 10 seconds
2015.02.04 12:10:31 LOG5[12516]: s_connect: connected 91.215.165.69:443
2015.02.04 12:10:31 LOG5[12516]: Service [LMAX-fix-tunnel-DEMO-MktData]
connected remote server from 10.0.0.62:59476
2015.02.04 12:10:31 LOG7[12516]: Remote socket (FD=620) initialized
2015.02.04 12:10:31 LOG6[12516]: SNI: sending servername:
fix-md-ate.lmaxtrader.com
2015.02.04 12:10:31 LOG7[12516]: SSL state (connect): before/connect
initialization
2015.02.04 12:10:31 LOG7[12516]: SSL state (connect): SSLv3 write client
hello A
Already burned around 4 hours understanding what I'm doing wrong, will be
glad if you could help me.
Thanks in advance,
Or.
--
*Attention:*
This e-mail and any files transmitted with it are confidential and intended
solely for the use of the individual or entity to whom they are addressed.
If you have received this email in error, please notify the
sender immediately by replying to this message, and delete the original
message from your system without making a copy.
This e-mail is attributed to the sender and does not necessarily reflect
the view of Markets Pulse P.S. Ltd. or any affiliate.
Please consider the environment before printing this email.
1
0
03 Feb '15
Hi everybody !
I tried to compile stunnel 5.10 (latest) on my old Suse 7 Linux
distrib and got "a fatal signal 11 error message" when doing the make
command.
Just before, openssl 1.0.2 (latest) compile fine with no errors.
Also, I add some stuffs like xemacs 21.4.22 (latest) just to say that
that rather old distrib is able to do all that :-D
So, here is the latest messages from make I got :
> Making all in src
> make[1]: Entering directory `/root/stunnel-5.10/src'
> make all-am
> make[2]: Entering directory `/root/stunnel-5.10/src'
> source='stunnel.c' object='stunnel-stunnel.o' libtool=no \
> DEPDIR=.deps depmode=gcc /bin/sh ../auto/depcomp \
> gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include
> -I/usr/local/ssl/include -DLIBDIR='"/usr/local/lib/stunnel"'
> -DCONFDIR='"/usr/local/etc/stunnel"' -g -O2 -pthread -Wall
> -Wformat=2 -Wconversion -Wno-long-long -Wno-deprecated-declarations
> -D_FORTIFY_SOURCE=2 -c -o stunnel-stunnel.o `test -f 'stunnel.c' ||
> echo './'`stunnel.c
> In file included from /usr/include/string.h:346,
> from common.h:201,
> from stunnel.c:38:
> /usr/include/bits/string2.h: In function `__strsep_g':
> /usr/include/bits/string2.h:1171: warning: passing arg 2 of
> `__strpbrk_c2' with different width due to prototype
> /usr/include/bits/string2.h:1171: warning: passing arg 3 of
> `__strpbrk_c2' with different width due to prototype
> /usr/include/bits/string2.h:1171: warning: passing arg 2 of
> `__strpbrk_c3' with different width due to prototype
> /usr/include/bits/string2.h:1171: warning: passing arg 3 of
> `__strpbrk_c3' with different width due to prototype
> /usr/include/bits/string2.h:1171: warning: passing arg 4 of
> `__strpbrk_c3' with different width due to prototype
> gcc: Internal compiler error: program cc1 got fatal signal 11
> make[2]: *** [stunnel-stunnel.o] Error 1
> make[2]: Leaving directory `/root/stunnel-5.10/src'
> make[1]: *** [all] Error 2
> make[1]: Leaving directory `/root/stunnel-5.10/src'
> make: *** [all-recursive] Error 1
Previously got lots of warning messages. Perhaps need "make report" also ?
I've look at stunnel-users(a)stunnel.org mail archive up to July 2011 with
no success. So, that's why I'm writting to you there...
Then, I tried different versions of stunnel 4.xx like 4.00, 4.56, 4.28
and more. All simply don't compile with differents errors messages.
The only one I could compile completly is stunnel 3.22 (so latest 3.xx)
Note that I'm happy with that because I was running stunnel 3.3 just
before and that everything works with the latest openssl version I
download and everything works fine for what I would !
Remark: Suse7 distrib (not OpenSuse) is Linux 2.2.16 kernel (not latest :-D)
Alex.
PS: Another things, on the same machine I ran stunnel 4.56 on (old)
Windows 98 with no problems.
---
Ce courrier électronique ne contient aucun virus ou logiciel malveillant parce que la protection avast! Antivirus est active.
http://www.avast.com
2
2