> Please see highlighted below:
>
> On Fri, May 8, 2015 at 5:27 PM, David H. Durgee <dhdurgee at verizon.net <https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users>>
> wrote:
>
> >/ At some point in the near past stunnel stopped working on my laptop. The
> />/ laptop is running Linux Mint 17.1 Rebecca x64 and stunnel from the
> />/ repositories. I enabled debug=7, but I am not getting much from the log:
> />/
> />/
> />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Clients allowed=500
> />/
> />/
> />/
> />/ *2015.05.08 17 <2015.05.08%2017>:12:06 LOG5[10804:140318864611136]:
> />/ stunnel 4.53 on x86_64-pc-linux-gnu platform 2015.05.08 17
> />/ <2015.05.08%2017>:12:06 LOG5[10804:140318864611136]: Compiled with OpenSSL
> />/ 1.0.1e 11 Feb 2013 2015.05.08 17 <2015.05.08%2017>:12:06
> />/ LOG5[10804:140318864611136]: Running with OpenSSL 1.0.1f 6 Jan 2014
> />/ 2015.05.08 17 <2015.05.08%2017>:12:06 LOG5[10804:140318864611136]: Update
> />/ OpenSSL shared libraries or rebuild stunnel*
> /
>
> Is there a reason that you're using libraries from a different compiled
> Stunnel? In fact, isn't there another Stunnel package you can use that is
> more up-to-date? If not, perhaps compile your own using the OpenSSL
> libraries that comes with Mint.
I am using the package from the Mint repository, which in this case is
the Ubuntu Trusty repository. If you know of a repository I can add
with a more current package I will do so. If necessary I guess I could
build from source, but I don't do that often and would prefer to locate
a binary.
> >/
> />/ 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Threading:PTHREAD
> />/ SSL:+ENGINE+OCSP Auth:LIBWRAP Sockets:POLL+IPv6
> />/ 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Reading configuration
> />/ from file /etc/stunnel/stunnel.conf
> />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Compression not enabled
> />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: PRNG seeded successfully
> />/ 2015.05.08 17:12:06 LOG6[10804:140318864611136]: Initializing service
> />/ section [telnets]
> />/ *2015.05.08 17 <2015.05.08%2017>:12:06 LOG4[10804:140318864611136]:
> />/ Insecure file permissions on /etc/ssl/certs/stunnel.pem*
> /
>
> Warning: the permissions may be too wide-open (should be 700 I assume)
>
>
> >/
> />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate:
> />/ /etc/ssl/certs/stunnel.pem
> />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate loaded
> />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Key file:
> />/ /etc/ssl/certs/stunnel.pem
> />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Private key loaded
> />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: SSL options set:
> />/ 0x00000004
> />/ 2015.05.08 17:12:06 LOG6[10804:140318864611136]: Initializing service
> />/ section [dsp3270s]
> />/ *2015.05.08 17 <2015.05.08%2017>:12:06 LOG4[10804:140318864611136]:
> />/ Insecure file permissions on /etc/ssl/certs/stunnel.pem*
> /
>
> Same as above, perhaps too wide open, permissions should be 700 I assume.
>
>
> >/
> />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate:
> />/ /etc/ssl/certs/stunnel.pem
> />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate loaded
> />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Key file:
> />/ /etc/ssl/certs/stunnel.pem
> />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Private key loaded
> />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: SSL options set:
> />/ 0x00000004
> />/ 2015.05.08 17:12:06 LOG5[10804:140318864611136]: Configuration successful
> />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Service [telnets]
> />/ (FD=12) bound to 0.0.0.0:3141
> />/ 2015.05.08 17:12:06 LOG7[10804:140318864611136]: Service [dsp3270s]
> />/ (FD=13) bound to 0.0.0.0:7490
> />/ 2015.05.08 17:12:06 LOG7[10810:140318864611136]: Created pid file
> />/ /stunnel4.pid
> />/ 2015.05.08 17:12:31 LOG7[10810:140318864611136]: Service [telnets]
> />/ accepted (FD=3) from 127.0.0.1:40090
> />/ 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Service [telnets] started
> />/ 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Waiting for a libwrap
> />/ process
> />/ 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Acquired libwrap process
> />/ #0
> />/
> />/
> />/ *2015.05.08 17 <2015.05.08%2017>:12:31 LOG3[10810:140318864770816]:
> />/ Unexpected socket close (read_blocking) 2015.05.08 17
> />/ <2015.05.08%2017>:12:31 LOG5[10810:140318864770816]: Connection reset: 0
> />/ byte(s) sent to SSL, 0 byte(s) sent to socket 2015.05.08 17
> />/ <2015.05.08%2017>:12:31 LOG7[10810:140318864770816]: Local socket (FD=3)
> />/ closed*
> /
>
> that sounds like SELinux permissions perhaps? Have you tried temporarily
> disabling SELinux, or perhaps you have a firewall (iptables) set up? You'll
> have to allow the incoming port and possibly an entry in /etc/services
> IIRC. I don't know if this helps but this is what I found:
> https://sites.google.com/site/easylinuxtipsproject/security
> A link to "ufw" may prove useful, if your system has that installed. Most
> systems have locked-down privileged ports (any port less than 1024, like in
> your example).
I do have ufw here, but I have the same problem with it enabled or
disabled. The telnets service is listening on port 3141 and the
dsp3270s on port 7490, so neither of them are privileged ports.
> >/
> />/ 2015.05.08 17:12:31 LOG7[10810:140318864770816]: Service [telnets]
> />/ finished (0 left)
> />/ 2015.05.08 17:12:31 LOG7[10810:140318864770816]: str_stats: 1 block(s),
> />/ 32 data byte(s), 58 control byte(s)
> />/ 2015.05.08 17:13:32 LOG7[10810:140318864611136]: Service [dsp3270s]
> />/ accepted (FD=3) from 127.0.0.1:48534
> />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Service [dsp3270s]
> />/ started
> />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Waiting for a libwrap
> />/ process
> />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Acquired libwrap process
> />/ #1
> />/ *2015.05.08 17 <2015.05.08%2017>:13:32 LOG3[10810:140318864770816]:
> />/ Unexpected socket close (read_blocking)*
> />/
> /
> That sounds like some kind of firewall issue (like above).
As noted above, same behavior with ufw enabled or disabled.
> >/ 2015.05.08 17:13:32 LOG5[10810:140318864770816]: Connection reset: 0
> />/ byte(s) sent to SSL, 0 byte(s) sent to socket
> />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Local socket (FD=3)
> />/ closed
> />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: Service [dsp3270s]
> />/ finished (0 left)
> />/ 2015.05.08 17:13:32 LOG7[10810:140318864770816]: str_stats: 1 block(s),
> />/ 32 data byte(s), 58 control byte(s)
> />/
> />/
> / When in a situation like this, I would first try unprivileged ports with
> localhost using iperf, just to generate some dummy traffic. A good
> technique I use when debugging stunnel versus debugging networking or other
> security issues is to do local traffic only like this:
>
> 1. iperf client connect to localhost port 5000
> 2. Stunnel client listen on port 5000, connect to localhost port 6000
> 3. Stunnel server listen on port 6000, connect to localhost port 7000
> 4. iperf server listening on localhost port 7000
>
> As you can see from that, running iperf client for a few seconds, it should
> be able to connect to the iperf server. If not, stunnel is not working.
> Debug this FIRST before proceeding to working with non-localhost IP
> addresses. The actual procedure would be as follows:
>
> 1. Download/install iperf
> 2. Verify iperf works by having one shell run as server, listening on
> localhost port 7000, and another shell setup iperf client sending on port
> 7000. If that works, then proceed. Don't use iperf to connect to port 7000
> again.
> 3. Set up two config files, one for stunnel client and one for stunnel
> server, with different ports and the "client=yes" in the client config
> file. For easier detection with "ps" or "top", you can copy the executable
> file to another name (i.e., "s4client" for the stunnel 4 client, and
> "s4server" for the stunnel 4 server). Similarly for iperf, you can copy the
> exe to "iperfc" and "iperfs" for iperf server, for easier process detection.
> 4. Start up the stunnel server first, then stunnel client, with the
> appropriate config files per the port enumeration mentioned above.
> 5. Start iperf server listening on port 7000.
> 6. Start iperf client sending on port 5000. If you get some really large
> value or nothing, then your stunnel config (client/server) needs to be
> debugged first before proceeding to non-localhost IPs. I usually get
> something like 3GB/sec when using a Windows 7 VM inside Windows 7 doing
> this from DOS prompts with appropriate server/client configs set up. I
> usually use four windows: two for iperf (c/s), two for stunnel (c/s).
>
> Hope that helps...
> -Rob
I have an stunnel server on another system on the LAN and that is the
one I am having the client with the problem connect to while trying to
find the problem. I know that server is working, as I have seen other
incoming traffic handled by it.
I suspect the problem is related to the message you pointed out that I
missed about SSL libraries. I would very much appreciate a pointer to a
more current package in a repository.
Thanks for your response, Rob.
Dave
1
0
I have AIX 6.1 (64-bit) with GCC 4.2.0. It has an older version of OpenSSL
(0.9.8) installed from IBM but I'm trying to compile Stunnel 5.17 with
OpenSSL 1.0.2a-fips as non-root. I proceed as follows:
cd ~; [ -d openssl ] && rm -rf openssl; mkdir openssl
cd ~/OpenSSL; [ -d openssl-fips-2.0.9 ] && rm -rf openssl-fips-2.0.9
gzip -dc openssl-fips-2.0.9.tar.gz | tar xvf -
cd openssl-fips-2.0.9; chmod 755 Configure
./Configure aix64-gcc --openssldir=$HOME/openssl
make
make install
NOTE: the above is just the FIPS canister (library), not the executable.
cd ~/OpenSSL; [ -d openssl-1.0.2a ] && rm -rf openssl-1.0.2a
gzip -dc openssl-1.0.2a.tar.gz | tar xvf -
cd openssl-1.0.2a; chmod 755 Configure
./Configure aix64-gcc fips shared --openssldir=$HOME/openssl
--with-fipsdir=$HOME/openssl
make depend
make
make test
make install
cd ~/openssl/bin; ./openssl version; ./openssl speed
NOTE: Look for "ALL OCSP TESTS SUCCESSFUL" after "make test" to verify the
test build was successful, and it was.
NOTE: "./openssl version" should show "OpenSSL 1.0.2a-fips 19 Mar 2015"
NOTE: "./openssl speed" should take a while as it's measuring the speed for
all algorithms
Final test of OpenSSL 1.0.2a-fips:
./openssl sha1 -hmac etaonrishdlcupfm ~/OpenSSL/openssl-fips-2.0.9.tar.gz
- should return: 54552e9a3ed8d1561341e8945fcdec55af961322
Now, I try to compile Stunnel:
rm -rf $HOME/stunnel-bin; mkdir $HOME/stunnel-bin
cd ~/Stunnel; [ -f stunnel-5.17 ] && rm -rf stunnel-5.17
gzip -dc stunnel-5.17.tar.gz | tar xvf - ; cd stunnel-5.17
./configure --enable-fips --prefix=$HOME/stunnel-bin
--with-ssl=$HOME/openssl
make
I get a failure at make for a library not found:
/bin/sh ../libtool --tag=CC --mode=link gcc -g -O2
-D_THREAD_SAFE -Wall -Wextra -Wformat=2 -Wconversion -Wno-long-long
-Wno-deprecated-declarations -fstack-protector -fPIE -D_FORTIFY_SOURCE=2
-L/home/lockharr/openssl/lib64 -L/home/lockharr/openssl/lib -lssl -lcrypto
-o stunnel stunnel-tls.o stunnel-str.o stunnel-file.o stunnel-client.o
stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o
stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o
stunnel-sthreads.o stunnel-fd.o stunnel-stunnel.o stunnel-pty.o
stunnel-libwrap.o stunnel-ui_unix.o -lpthreads
libtool: link: gcc -g -O2 -D_THREAD_SAFE -Wall -Wextra -Wformat=2
-Wconversion -Wno-long-long -Wno-deprecated-declarations -fstack-protector
-fPIE -D_FORTIFY_SOURCE=2 -o stunnel stunnel-tls.o stunnel-str.o
stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o
stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o
stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-fd.o
stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o stunnel-ui_unix.o
-L/home/lockharr/openssl/lib64 -L/home/lockharr/openssl/lib -lssl -lcrypto
-lpthreads
collect2: library libssp_nonshared not found
The interesting part is that doing a "grep -R libssp" of the source tree
only shows one reference to libssp:
$ grep -R libssp *
stunnel-5.17/tools/stunnel.nsi: # MINGW builds requires libssp-0.dll
instead of msvcr90.dll
Googling showed some really old links that had libssp skipped for GCC on
AIX:
http://gcc.gnu.org/ml/gcc-patches/2005-09/msg01231.html
and another that added it back in:
http://marc.info/?l=gcc-patches&m=130168534803966
Can anyone who has compiled this for AIX give me a clue about what's going
on? This looks like a reference to a non-existent library but I would think
that if GCC needed that, it wouldn't allow the RPM for GCC to be installed.
Thanks,
-Rob
2
1
At some point in the near past stunnel stopped working on my laptop.
The laptop is running Linux Mint 17.1 Rebecca x64 and stunnel from the
repositories. I enabled debug=7, but I am not getting much from the log:
2015.05.08 17:12:06 LOG7[10804:140318864611136]: Clients allowed=500
2015.05.08 17:12:06 LOG5[10804:140318864611136]: stunnel 4.53 on
x86_64-pc-linux-gnu platform
2015.05.08 17:12:06 LOG5[10804:140318864611136]: Compiled with OpenSSL
1.0.1e 11 Feb 2013
2015.05.08 17:12:06 LOG5[10804:140318864611136]: Running with OpenSSL
1.0.1f 6 Jan 2014
2015.05.08 17:12:06 LOG5[10804:140318864611136]: Update OpenSSL shared
libraries or rebuild stunnel
2015.05.08 17:12:06 LOG5[10804:140318864611136]: Threading:PTHREAD
SSL:+ENGINE+OCSP Auth:LIBWRAP Sockets:POLL+IPv6
2015.05.08 17:12:06 LOG5[10804:140318864611136]: Reading configuration
from file /etc/stunnel/stunnel.conf
2015.05.08 17:12:06 LOG7[10804:140318864611136]: Compression not enabled
2015.05.08 17:12:06 LOG7[10804:140318864611136]: PRNG seeded successfully
2015.05.08 17:12:06 LOG6[10804:140318864611136]: Initializing service
section [telnets]
2015.05.08 17:12:06 LOG4[10804:140318864611136]: Insecure file
permissions on /etc/ssl/certs/stunnel.pem
2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate:
/etc/ssl/certs/stunnel.pem
2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate loaded
2015.05.08 17:12:06 LOG7[10804:140318864611136]: Key file:
/etc/ssl/certs/stunnel.pem
2015.05.08 17:12:06 LOG7[10804:140318864611136]: Private key loaded
2015.05.08 17:12:06 LOG7[10804:140318864611136]: SSL options set: 0x00000004
2015.05.08 17:12:06 LOG6[10804:140318864611136]: Initializing service
section [dsp3270s]
2015.05.08 17:12:06 LOG4[10804:140318864611136]: Insecure file
permissions on /etc/ssl/certs/stunnel.pem
2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate:
/etc/ssl/certs/stunnel.pem
2015.05.08 17:12:06 LOG7[10804:140318864611136]: Certificate loaded
2015.05.08 17:12:06 LOG7[10804:140318864611136]: Key file:
/etc/ssl/certs/stunnel.pem
2015.05.08 17:12:06 LOG7[10804:140318864611136]: Private key loaded
2015.05.08 17:12:06 LOG7[10804:140318864611136]: SSL options set: 0x00000004
2015.05.08 17:12:06 LOG5[10804:140318864611136]: Configuration successful
2015.05.08 17:12:06 LOG7[10804:140318864611136]: Service [telnets]
(FD=12) bound to 0.0.0.0:3141
2015.05.08 17:12:06 LOG7[10804:140318864611136]: Service [dsp3270s]
(FD=13) bound to 0.0.0.0:7490
2015.05.08 17:12:06 LOG7[10810:140318864611136]: Created pid file
/stunnel4.pid
2015.05.08 17:12:31 LOG7[10810:140318864611136]: Service [telnets]
accepted (FD=3) from 127.0.0.1:40090
2015.05.08 17:12:31 LOG7[10810:140318864770816]: Service [telnets] started
2015.05.08 17:12:31 LOG7[10810:140318864770816]: Waiting for a libwrap
process
2015.05.08 17:12:31 LOG7[10810:140318864770816]: Acquired libwrap process #0
2015.05.08 17:12:31 LOG3[10810:140318864770816]: Unexpected socket close
(read_blocking)
2015.05.08 17:12:31 LOG5[10810:140318864770816]: Connection reset: 0
byte(s) sent to SSL, 0 byte(s) sent to socket
2015.05.08 17:12:31 LOG7[10810:140318864770816]: Local socket (FD=3) closed
2015.05.08 17:12:31 LOG7[10810:140318864770816]: Service [telnets]
finished (0 left)
2015.05.08 17:12:31 LOG7[10810:140318864770816]: str_stats: 1 block(s),
32 data byte(s), 58 control byte(s)
2015.05.08 17:13:32 LOG7[10810:140318864611136]: Service [dsp3270s]
accepted (FD=3) from 127.0.0.1:48534
2015.05.08 17:13:32 LOG7[10810:140318864770816]: Service [dsp3270s] started
2015.05.08 17:13:32 LOG7[10810:140318864770816]: Waiting for a libwrap
process
2015.05.08 17:13:32 LOG7[10810:140318864770816]: Acquired libwrap process #1
2015.05.08 17:13:32 LOG3[10810:140318864770816]: Unexpected socket close
(read_blocking)
2015.05.08 17:13:32 LOG5[10810:140318864770816]: Connection reset: 0
byte(s) sent to SSL, 0 byte(s) sent to socket
2015.05.08 17:13:32 LOG7[10810:140318864770816]: Local socket (FD=3) closed
2015.05.08 17:13:32 LOG7[10810:140318864770816]: Service [dsp3270s]
finished (0 left)
2015.05.08 17:13:32 LOG7[10810:140318864770816]: str_stats: 1 block(s),
32 data byte(s), 58 control byte(s)
I don't even see the IP address for the outbound connection, so it seems
as if it is hitting a problem even before it gets that far.
Configuration is pretty simple:
; Sample stunnel configuration file by Michal Trojnara 2002-2009
; Some options used here may not be adequate for your particular
configuration
; Please make sure you understand them (especially the effect of the
chroot jail)
; Certificate/key is needed in server mode and optional in client mode
cert = /etc/ssl/certs/stunnel.pem
;key = /etc/ssl/certs/stunnel.pem
; Protocol version (all, SSLv2, SSLv3, TLSv1)
sslVersion = TLSv1
; Some security enhancements for UNIX systems - comment them out on Win32
chroot = /var/lib/stunnel4/
setuid = stunnel4
setgid = stunnel4
; PID is created inside the chroot jail
pid = /stunnel4.pid
; Some performance tunings
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
socket = l:SO_KEEPALIVE=1
socket = r:SO_KEEPALIVE=1
socket = l:TCP_KEEPCNT=5
socket = r:TCP_KEEPCNT=5
socket = l:TCP_KEEPIDLE=10
socket = r:TCP_KEEPIDLE=10
socket = l:TCP_KEEPINTVL=2
socket = r:TCP_KEEPINTVL=2
;compression = zlib
; Workaround for Eudora bug
;options = DONT_INSERT_EMPTY_FRAGMENTS
; Authentication stuff
;verify = 2
; Don't forget to c_rehash CApath
; CApath is located inside chroot jail
;CApath = /certs
; It's often easier to use CAfile
;CAfile = /etc/stunnel/certs.pem
; Don't forget to c_rehash CRLpath
; CRLpath is located inside chroot jail
;CRLpath = /crls
; Alternatively you can use CRLfile
;CRLfile = /etc/stunnel/crls.pem
; Some debugging stuff useful for troubleshooting
debug = 7
output = stunnel.log
; Use it for client mode
client = yes
; Service-level configuration
[telnets]
accept = 3141
;connect = 192.168.80.11:992
;connect = DurgeeEnterprises.publicvm.com:992
connect = 192.168.80.5:992
[dsp3270s]
accept = 7490
;connect = 192.168.80.11:246
;connect = DurgeeEnterprises.publicvm.com:246
connect = 192.168.80.5:246
;[pop3s]
;accept = 995
;connect = 110
;[imaps]
;accept = 993
;connect = 143
;[ssmtp]
;accept = 465
;connect = 25
;[https]
;accept = 443
;connect = 80
;TIMEOUTclose = 0
; vim:ft=dosini
Any thoughts on how to track this down and get this working?
Dave
2
1
Hi there. I have a program I have used successfully with Stunnel for many
years.
A while back, I discovered that my program, which is a pure stdio console
program, stopped working with 5.x versions of Stunnel. I have spent many
hours but have been unable to solve the problem, so I regretfully continue
to use the 4.x branch. I was wondering if anyone had similar experiences?
Relevant data is pasted below. I comment in the log output where the
problem occurs.
Any help at all would be greatly appreciated.
stunnel.conf:
setuid = stunnel
setgid = stunnel
pid = /var/run/stunnel/stunnel.pid
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
foreground = no
debug = 7
output = /var/log/stunnel.log
[CF2]
client = no
accept = 21
verify = 3
sslVersion = all
cert = /etc/stunnel/demo.pem
key = /etc/stunnel/demo.pem
CApath = /etc/stunnel/certs
CRLpath = /etc/stunnel/crls
TIMEOUTbusy = 60
TIMEOUTclose = 0
TIMEOUTconnect = 60
TIMEOUTidle = 60
exec = /opt/cmf/bin/cf-server
execargs = /opt/cmf/bin/cf-server -p /opt/jail/stunnel/pipes/
Log of successful session with 4.54:
2015.05.01 15:39:39 LOG7[3080:140402563495680]: Starting certificate
verification: depth=0, /C=US/L=Bryan/ST=TX/O=Demo Account/emailAddress=
demo(a)demo.com/CN=demo
2015.05.01 15:39:39 LOG6[3080:140402563495680]: CERT: Locally installed
certificate matched
2015.05.01 15:39:39 LOG5[3080:140402563495680]: Certificate accepted:
depth=0, /C=US/L=Bryan/ST=TX/O=Demo Account/emailAddress=
demo(a)demo.com/CN=demo
2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3
read client certificate A
2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3
read client key exchange A
2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3
read certificate verify A
2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3
read finished A
2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3
write session ticket A
2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3
write change cipher spec A
2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3
write finished A
2015.05.01 15:39:39 LOG7[3080:140402563495680]: SSL state (accept): SSLv3
flush data
2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 items in the session
cache
2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 client connects
(SSL_connect())
2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 client connects that
finished
2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 client renegotiations
requested
2015.05.01 15:39:39 LOG7[3080:140402563495680]: 1 server connects
(SSL_accept())
2015.05.01 15:39:39 LOG7[3080:140402563495680]: 1 server connects that
finished
2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 server renegotiations
requested
2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 session cache hits
2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 external session cache
hits
2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 session cache misses
2015.05.01 15:39:39 LOG7[3080:140402563495680]: 0 session cache timeouts
2015.05.01 15:39:39 LOG6[3080:140402563495680]: SSL accepted: new session
negotiated
2015.05.01 15:39:39 LOG6[3080:140402563495680]: Negotiated TLSv1/SSLv3
ciphersuite: ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption)
2015.05.01 15:39:39 LOG6[3080:140402563495680]: Compression: null,
expansion: null
2015.05.01 15:39:39 LOG6[3080:140402563495680]: Local mode child started
(PID=3118)
2015.05.01 15:39:39 LOG7[3080:140402563495680]: Remote socket (FD=11)
initialized
*** the connection is established and stable; i explicitly disconnect
several seconds later
2015.05.01 15:39:45 LOG7[3080:140402563495680]: SSL socket closed on
SSL_read
2015.05.01 15:39:45 LOG7[3080:140402563495680]: Sent socket write shutdown
2015.05.01 15:39:45 LOG5[3080:140402563495680]: Connection closed: 0
byte(s) sent to SSL, 0 byte(s) sent to socket
2015.05.01 15:39:45 LOG7[3080:140402563495680]: Remote socket (FD=11) closed
2015.05.01 15:39:45 LOG7[3080:140402563495680]: Local socket (FD=3) closed
2015.05.01 15:39:45 LOG7[3080:140402563495680]: Service [CF2] finished (0
left)
Log of unsuccessful session with 5.16:
2015.05.01 15:37:33 LOG7[0]: Verification started at depth=0: C=US,
L=Bryan, ST=TX, O=Demo Account, emailAddress=demo(a)demo.com, CN=demo
2015.05.01 15:37:33 LOG7[0]: CERT: Pre-verification succeeded
2015.05.01 15:37:33 LOG6[0]: CERT: Locally installed certificate matched
2015.05.01 15:37:33 LOG5[0]: Certificate accepted at depth=0: C=US,
L=Bryan, ST=TX, O=Demo Account, emailAddress=demo(a)demo.com, CN=demo
2015.05.01 15:37:33 LOG7[0]: SSL state (accept): SSLv3 read client
certificate A
2015.05.01 15:37:33 LOG7[0]: SSL state (accept): SSLv3 read client key
exchange A
2015.05.01 15:37:33 LOG7[0]: SSL state (accept): SSLv3 read certificate
verify A
2015.05.01 15:37:33 LOG7[0]: SSL state (accept): SSLv3 read finished A
2015.05.01 15:37:33 LOG7[0]: SSL state (accept): SSLv3 write change cipher
spec A
2015.05.01 15:37:33 LOG7[0]: SSL state (accept): SSLv3 write finished A
2015.05.01 15:37:33 LOG7[0]: SSL state (accept): SSLv3 flush data
2015.05.01 15:37:33 LOG7[0]: 1 server accept(s) requested
2015.05.01 15:37:33 LOG7[0]: 1 server accept(s) succeeded
2015.05.01 15:37:33 LOG7[0]: 0 server renegotiation(s) requested
2015.05.01 15:37:33 LOG7[0]: 0 session reuse(s)
2015.05.01 15:37:33 LOG7[0]: 0 internal session cache item(s)
2015.05.01 15:37:33 LOG7[0]: 0 internal session cache fill-up(s)
2015.05.01 15:37:33 LOG7[0]: 0 internal session cache miss(es)
2015.05.01 15:37:33 LOG7[0]: 0 external session cache hit(s)
2015.05.01 15:37:33 LOG7[0]: 0 expired session(s) retrieved
2015.05.01 15:37:33 LOG6[0]: SSL accepted: new session negotiated
2015.05.01 15:37:33 LOG7[0]: Peer certificate was cached (1610 bytes)
2015.05.01 15:37:33 LOG6[0]: Negotiated TLSv1.2 ciphersuite
ECDHE-RSA-AES256-GCM-SHA384 (256-bit encryption)
2015.05.01 15:37:33 LOG7[0]: Compression: null, expansion: null
2015.05.01 15:37:33 LOG6[0]: Local mode child started (PID=2899)
2015.05.01 15:37:33 LOG7[0]: Remote socket (FD=11) initialized
*** immediately after successful connection, something happens; my program
has no log output either, which seems to indicate that stunnel is closing it
2015.05.01 15:37:33 LOG6[0]: Read socket closed (readsocket)
2015.05.01 15:37:33 LOG7[main]: Dispatching signals from the signal pipe
2015.05.01 15:37:33 LOG7[0]: Sending close_notify alert
2015.05.01 15:37:33 LOG7[main]: Processing SIGCHLD
2015.05.01 15:37:33 LOG7[0]: SSL alert (write): warning: close notify
2015.05.01 15:37:33 LOG6[main]: Child process 2899 terminated on signal 11
2015.05.01 15:37:33 LOG6[0]: SSL_shutdown successfully sent close_notify
alert
2015.05.01 15:37:33 LOG7[main]: Signal pipe is empty
2015.05.01 15:37:33 LOG3[0]: transfer: s_poll_wait: TIMEOUTclose exceeded:
closing
2015.05.01 15:37:33 LOG5[0]: Connection closed: 0 byte(s) sent to SSL, 0
byte(s) sent to socket
2015.05.01 15:37:33 LOG7[0]: Remote socket (FD=11) closed
2015.05.01 15:37:33 LOG7[0]: Local socket (FD=3) closed
2015.05.01 15:37:33 LOG7[0]: Service [CF2] finished (0 left)
2
2
Hi,
I have a problem with one of the stunnel installation (debian7). After some time of operation automatically turns itself off with the message:
(...)
Apr 24 21:03:45 routerpri kernel: [177332.400502] stunnel[34426]: segfault at 0 ip 00007f1f99ca9e20 sp 00007f1f99c16c68 error 4 in stunnel[7f1f99c94000+24000]
(...)
Apr 24 21:21:36 routerpri kernel: [178402.360532] stunnel[34795]: segfault at 0 ip 00007f84d6b8be20 sp 00007f84d6b49c68 error 4 in stunnel[7f84d6b76000+24000]
(...)
Apr 24 21:23:31 routerpri kernel: [178517.215345] stunnel[34908]: segfault at 0 ip 00007f150c5b3e20 sp 00007f150c58cc68 error 4 in stunnel[7f150c59e000+24000]
(...)
stunnel 5.15 on x86_64-unknown-linux-gnu platform
Compiled/running with OpenSSL 1.0.1e 11 Feb 2013
stunnel.conf:
pid = /var/run/stunnel.pid
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
debug = 7
output = /var/log/stunnel.log
syslog = yes
client = no
fips = no
verify = 0
CAfile = /etc/stunnel/SubCA2.crt
CRLfile = /etc/stunnel/SubCA2_CRL.pem
[service_1]
accept = 192.168.1.10:1000
connect = 192.168.1.10:1234
cert = /etc/stunnel/cert1.crt
key = /etc/stunnel/cert1_key.pem
ciphers = HIGH:!SSLv2:!ADH:!Exp:!aNULL:!eNULL:!NULL
sslVersion = TLSv1.2
When I use the lower level of encryption for example SSLv3, problem occurs after a longer period of normal operation.
I will only add that the problem has also appeared on the previous version 4.54, which I was updating to the newest. Do you have any idea what could be causing the problem.
Regards
Mirek
2
2
>> What would be the equivalent of below s_server command in stunnel?
>>
>> openssl s_server -accept 5003 -engine chil -keyform engine -key rsa-priv -cert public.pem -tls1_2
>>
>> In this example "rsa-priv" references the private key inside a hardware security module, not a pem file.
>>
>> I saw an option for engineid in the documentation, but nothing for keyform parameter.
1
0