Configuring Stunnel to work between client and server - possible certificate issue
by David Faizulaev 17 May '16
by David Faizulaev 17 May '16
17 May '16
Hello,
I've found Stunnel as a potential answer to securely moving traffic between two machines.
But I'm having some difficulties configuring the software.
I've installed it on to the client machine and configured the client to connect to 127.0.0.1:8449 while the Server to which the client needs to connect is 192.168.220.72:8447
In the stunnel.conf I've set the following:
[custom]
accept = 127.0.0.1:8449
connect = 192.168.220.72:8447
cert = 220.72.cer
TIMEOUTclose = 0
Upon initializing Stunnel I get the following error:
2016.05.16 19:14:04 LOG3[main]: error queue: 140B0009: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib
2016.05.16 19:14:04 LOG3[main]: SSL_CTX_use_PrivateKey_file: 906D06C: error:0906D06C:PEM routines:PEM_read_bio:no start line
2016.05.16 19:14:04 LOG3[main]: Service [custom]: Failed to initialize SSL context
2016.05.16 19:14:04 LOG3[main]: Failed to reload the configuration file
What can be the cause?
Thanks in advance.
Best Regards,
David.
[logo_tagline_Sig]
David Faizulaev | PL/SQL Developer | T +972 (3) 767 3026<tel:%2B97237673012> | M +972 (54) 7314<tel:%2B972528466746>687
Centralized OT Security Management for Distributed SCADA/ICS Networks
P Please consider the environment before printing this e-mail
2
1
Running OpenSSL 1.0.2h, and stunnel 5.32 I often get:
ssl_start: s_poll_wait: TIMEOUTbusy exceeded: sending reset
2016.05.17 16:51:46 LOG5[21]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket
2016.05.17 16:51:46 LOG7[21]: Local descriptor (FD=15) closed
2016.05.17 16:51:46 LOG7[21]: Service [ssmtp2] finished (3 left)
2016.05.17 16:51:46 LOG6[22]: ssl_start: s_poll_wait: TIMEOUTbusy exceeded: sending reset
2016.05.17 16:51:46 LOG5[22]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket
2016.05.17 16:51:46 LOG7[22]: Local descriptor (FD=16) closed
2016.05.17 16:51:46 LOG7[22]: Service [ssmtp2] finished (2 left)
when a user is sending an email.
The email actually makes it to our mail server and gets sent, but the sender’s mail app says that it could not be sent.
Upgraded to 5.33b2, no change.
It is not all the time - I suspect it is with emails with large attachments.
Any suggestions?
Mac OS X 10.7.5.
Thanks,
James.
1
0
stunnel v5.32 (and older) strange session cache behavior on memory (de)allocation
by Adrian Irimescu 16 May '16
by Adrian Irimescu 16 May '16
16 May '16
I am using stunnel v5.32 compiled on a RHEL 6.7 with
openssl-1.0.1e-42.el6.x86_64.
The stunnel.conf cache settings are (for testing cache behaviour):
*sessionCacheSize = 3sessionCacheTimeout = 60*
What I expect is that after sessioncache size is reached, the memory (RSS)
allocated to stunnel process does not grow with new sessions which are not
in cache.
Instead of this the stunnel allocates about 28K for any new session which
does not have a stored session in cache and does not free this anymore.
For new connections, but with session stored in cache, the memory does not
grow. This lead me to a problem in memory deallocation for expired session
in internal session cache.( I know that openssl frees expired session cache
entries at every 255 sessions).
See example below:
--> stunnel start (see RSS)
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
stunnel 20655 0.0 0.0 117760 1440 ? Ss 15:49 0:00
/usr/local/bin/stunnel5
--> after 3 sessions with no cache hits
stunnel 20655 0.0 0.0 117828 2976 ? Ss 15:49 0:00
/usr/local/bin/stunnel5
- stunnel log
2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: New session callback
2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 4 server accept(s)
requested
2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 4 server accept(s)
succeeded
2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 0 server
renegotiation(s) requested
2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 0 session reuse(s)
2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 3 internal session
cache item(s)
2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 0 internal session
cache fill-up(s)
2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 0 internal session
cache miss(es)
2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 0 external session
cache hit(s)
2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: 0 expired session(s)
retrieved
2016.05.11 15:50:57 LOG6[kngHAM6DLUpVRXEqHcUMIt]: SSL accepted: new session
negotiated
2016.05.11 15:50:57 LOG7[kngHAM6DLUpVRXEqHcUMIt]: Remove session callback
-----------------------------------------------------
--> after another 1 request with cache hit: as you can see no RSS memory
was added
stunnel 20655 0.0 0.0 117828 2976 ? Ss 15:49 0:00
/usr/local/bin/stunnel5
- stunnel log
2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: SSL state (accept): SSLv3
read finished A
2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 5 server accept(s)
requested
2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 5 server accept(s)
succeeded
2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 0 server
renegotiation(s) requested
2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 1 session reuse(s)
2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 3 internal session
cache item(s)
2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 1 internal session
cache fill-up(s)
2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 0 internal session
cache miss(es)
2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 0 external session
cache hit(s)
2016.05.11 15:51:57 LOG7[Slq6WdqS97Ox4G8eOKfGg0]: 0 expired session(s)
retrieved
2016.05.11 15:51:57 LOG6[Slq6WdqS97Ox4G8eOKfGg0]: SSL accepted: previous
session reused
----------------------------------------------------
--> after another 1 request with no cache hit (now we have the first cache
fill-up)
stunnel 20655 0.0 0.0 117828 3000 ? Ss 15:49 0:00
/usr/local/bin/stunnel5
- stunnel log
2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: New session callback
2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 6 server accept(s)
requested
2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 6 server accept(s)
succeeded
2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 0 server
renegotiation(s) requested
2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 1 session reuse(s)
2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 3 internal session
cache item(s)
2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 1 internal session
cache fill-up(s)
2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 0 internal session
cache miss(es)
2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 0 external session
cache hit(s)
2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: 0 expired session(s)
retrieved
2016.05.11 15:53:31 LOG6[P8n33mFxzHVAZEeRwnFccK]: SSL accepted: new session
negotiated
2016.05.11 15:53:31 LOG7[P8n33mFxzHVAZEeRwnFccK]: Remove session callback
----------------------------------------------------
--> after another 300 new session with no cache hits and after waiting 1
minute for entries in session cache to expire (as said in documentation
openssl must free expired entries every 255 sessions)
stunnel 20655 0.0 0.2 117828 11632 ? Ss 15:49 0:03
/usr/local/bin/stunnel5
- stunnel log
2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: New session callback
2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 306 server accept(s)
requested
2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 306 server accept(s)
succeeded
2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 0 server
renegotiation(s) requested
2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 1 session reuse(s)
2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 3 internal session
cache item(s)
2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 301 internal session
cache fill-up(s)
2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 0 internal session
cache miss(es)
2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 0 external session
cache hit(s)
2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: 0 expired session(s)
retrieved
2016.05.11 16:13:26 LOG6[vWvoFT1DXuJ9x0eEfFnQBf]: SSL accepted: new session
negotiated
2016.05.11 16:13:26 LOG7[vWvoFT1DXuJ9x0eEfFnQBf]: Remove session callback
----------------------------------------------------
What I can see is tat memory grows with ~28K for every new session after
session cache was filled and never deallocates this memory.
In my production env. this really creates problems because after 2 weeks
stunnel fils all 32GB of server RAM.
*Anyone has encountered a similar problem? *
Of course the stunnel service restart clears the memory but I loose all
cache entries and is not acceptable.
After some code analysis between different versions of stunnel I can see
that between v5.26 ans v5.27 the ctx callbacks functions was changed.
In my tests with versions prior to 5.27 I can see that this memory problems
does not appear. See logs below:
---- stunnel v5.26 --------
2016.05.12 13:08:14 LOG5[ui]: stunnel 5.26 on x86_64-unknown-linux-gnu
platform
2016.05.12 13:08:14 LOG5[ui]: Compiled/running with OpenSSL 1.0.1e-fips 11
Feb 2013
stunnel 27402 0.0 0.0 117604 1316 ? Ss 13:08 0:00
/usr/local/bin/stunnel5
stunnel 27402 0.0 0.0 117672 2756 ? Ss 13:08 0:00
/usr/local/bin/stunnel5
stunnel 27402 0.0 0.0 117672 2804 ? Ss 13:08 0:00
/usr/local/bin/stunnel5
stunnel 27402 0.0 0.0 117672 2828 ? Ss 13:08 0:00
/usr/local/bin/stunnel5
stunnel 27402 0.0 0.0 117672 2868 ? Ss 13:08 0:00
/usr/local/bin/stunnel5
cache fill-up
2016.05.12 13:11:01 LOG7[FdNYw7uGlV9xNElZSPBfyh]: 0 session reuse(s)
2016.05.12 13:11:01 LOG7[FdNYw7uGlV9xNElZSPBfyh]: 3 internal session
cache item(s)
2016.05.12 13:11:01 LOG7[FdNYw7uGlV9xNElZSPBfyh]: 1 internal session
cache fill-up(s)
stunnel 27402 0.0 0.0 117672 2868 ? Ss 13:08 0:00
/usr/local/bin/stunnel5
stunnel 27402 0.0 0.0 117672 2868 ? Ss 13:08 0:00
/usr/local/bin/stunnel5
after 100 fill-ups
2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: SSL state (accept): SSLv3
flush data
2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 107 server accept(s)
requested
2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 107 server accept(s)
succeeded
2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 0 server
renegotiation(s) requested
2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 1 session reuse(s)
2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 3 internal session
cache item(s)
2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 102 internal session
cache fill-up(s)
2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 0 internal session
cache miss(es)
2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 0 external session
cache hit(s)
2016.05.12 13:13:55 LOG7[TWO1OFFPYvsW4qdjyJ0IZK]: 0 expired session(s)
retrieved
2016.05.12 13:13:55 LOG6[TWO1OFFPYvsW4qdjyJ0IZK]: SSL accepted: new session
negotiated
stunnel 27402 0.1 0.0 117672 2872 ? Ss 13:08 0:00
/usr/local/bin/stunnel5
after another 100 fill-ups
2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: SSL state (accept): SSLv3
flush data
2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 207 server accept(s)
requested
2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 207 server accept(s)
succeeded
2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 0 server
renegotiation(s) requested
2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 1 session reuse(s)
2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 3 internal session
cache item(s)
2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 202 internal session
cache fill-up(s)
2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 0 internal session
cache miss(es)
2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 0 external session
cache hit(s)
2016.05.12 13:19:03 LOG7[InwkBBOxJrfptxYx6wXTxU]: 0 expired session(s)
retrieved
2016.05.12 13:19:03 LOG6[InwkBBOxJrfptxYx6wXTxU]: SSL accepted: new session
negotiated
stunnel 27402 0.0 0.0 117672 2872 ? Ss 13:08 0:01
/usr/local/bin/stunnel5
Code:
--->>> callbacks in v5.26 L605
*NOEXPORT int sess_new_cb(SSL *ssl, SSL_SESSION *sess) { unsigned char
*val, *val_tmp; ssize_t val_len; const unsigned char *session_id;
unsigned int session_id_length; val_len=i2d_SSL_SESSION(sess, NULL);
val_tmp=val=str_alloc((size_t)val_len); i2d_SSL_SESSION(sess,
&val_tmp);#if OPENSSL_VERSION_NUMBER>=0x0090800fL
session_id=SSL_SESSION_get_id(sess, &session_id_length);#else
session_id=(const unsigned char *)sess->session_id;
session_id_length=sess->session_id_length;#endif
cache_transfer(SSL_get_SSL_CTX(ssl), CACHE_CMD_NEW,
SSL_SESSION_get_timeout(sess), session_id, session_id_length, val,
(size_t)val_len, NULL, NULL); str_free(val); return 1; /* leave the
session in local cache for reuse */}NOEXPORT SSL_SESSION *sess_get_cb(SSL
*ssl, unsigned char *key, int key_len, int *do_copy) { unsigned
char *val, *val_tmp=NULL; ssize_t val_len=0; SSL_SESSION *sess;
*do_copy = 0; /* allow the session to be freed autmatically */
cache_transfer(SSL_get_SSL_CTX(ssl), CACHE_CMD_GET, 0, key,
(size_t)key_len, NULL, 0, &val, (size_t *)&val_len); if(!val)
return NULL; val_tmp=val; sess=d2i_SSL_SESSION(NULL,#if
OPENSSL_VERSION_NUMBER>=0x0090800fL (const unsigned char **)#endif
/* OpenSSL version >= 0.8.0 */ &val_tmp, val_len); str_free(val);*
--->>> callbacks in v5.32
/**************************************** session callbacks */
*NOEXPORT int sess_new_cb(SSL *ssl, SSL_SESSION *sess) { CLI *c;
s_log(LOG_DEBUG, "New session callback"); c=SSL_get_ex_data(ssl,
index_cli); if(c->opt->option.sessiond) cache_new(ssl, sess);
return 1; /* leave the session in local cache for reuse */}NOEXPORT
SSL_SESSION *sess_get_cb(SSL *ssl,#if
OPENSSL_VERSION_NUMBER>=0x10100000L const#endif unsigned char
*key, int key_len, int *do_copy) { CLI *c; s_log(LOG_DEBUG, "Get
session callback"); *do_copy=0; /* allow the session to be freed
automatically */ c=SSL_get_ex_data(ssl, index_cli);
if(c->opt->option.sessiond) return cache_get(ssl, key, key_len);
return NULL; /* no session to resume */}NOEXPORT void
sess_remove_cb(SSL_CTX *ctx, SSL_SESSION *sess) { SERVICE_OPTIONS
*opt; s_log(LOG_DEBUG, "Remove session callback");
opt=SSL_CTX_get_ex_data(ctx, index_opt); if(opt->option.sessiond)
cache_remove(ctx, sess);}*
In production env. I have downgraded today at stunnel v5.26 and memory
seems to be OK (untill now).
Regards,
Adrian Irimescu
1
0
This is a perfect example of "do not post until you've tried the latest version"... I apologize again, I missed the update.
Stunnel is working correctly on my WCE device with all browsers now.
Thanks again for the help and the awesome product!
Matt
-----Original Message-----
From: stunnel-users [mailto:[email protected]] On Behalf Of Michal Trojnara
Sent: Thursday, May 12, 2016 15:16
To: stunnel-users(a)stunnel.org
Subject: Re: [stunnel-users] stunnel and MSIE
On 12.05.2016 15:57, Brugman, Matt wrote:
> I’ve compiled stunnel for Windows CE 5.0 and 6.0, and am running it on
> an ARM device.
Which version of stunnel have you compiled?
Make sure to use stunnel 5.32, as it contains an important WCE fix.
Best regards,
Mike
1
0
I am running 5.31. I apologize; I missed the release of 5.32. I'll build and let you know what I find.
Thanks very much!
Matt
-----Original Message-----
From: stunnel-users [mailto:[email protected]] On Behalf Of Michal Trojnara
Sent: Thursday, May 12, 2016 15:16
To: stunnel-users(a)stunnel.org
Subject: Re: [stunnel-users] stunnel and MSIE
On 12.05.2016 15:57, Brugman, Matt wrote:
> I’ve compiled stunnel for Windows CE 5.0 and 6.0, and am running it on
> an ARM device.
Which version of stunnel have you compiled?
Make sure to use stunnel 5.32, as it contains an important WCE fix.
Best regards,
Mike
1
0
I've compiled stunnel for Windows CE 5.0 and 6.0, and am running it on an ARM device. It is being used in client mode to secure communications to various external servers with not problems. It is also being used to secure Windows CE's webserver.
All of the client mode connections are working flawlessly (thanks for the awesome work, by the way!). The webserver is working properly for all browsers except MSIE 11. Everything I've seen tells me that the problem is not really with stunnel or openssl, but with Internet Explorer. I've spent some time searching the mailing list archives and on Google, but haven't really found a solution to this, besides the obvious "well, don't use IE." I'd love to go with the answer, but some of our users are locked into IE, and let's must make it a given that the choice of browser can't be changed.
The browser connects, negotiates a connection, and then exchanges keys and certificates. Using the debug console in IE I see that it sends the initial "GET /". Then the browser sees the response header, but no "body" data. Again, I realize this isn't a specific stunnel issue, but I'm hoping someone on the list has seen a similar issue and found a resolution.
I've stripped stunnel.conf down to the very basics (some paths removed for clarity):
; Stunnel config for device
debug = 7
output = <path removed>stunnel.log
options = -NO_SSLv3
log = overwrite
;********* SERVICES ***********
[https-server]
client = no
accept = 443
connect = 127.0.0.1:9975
cert = <path removed>stunnel.pem
delay = yes
TIMEOUTbusy = 5
TIMEOUTclose = 0
TIMEOUTidle = 30
Stunnel log output. I do see the "Peer suddenly disconnected" messages, but again; I'm not sure why. The last two lines of the log are the "transfer() loop executes not transferring any data":
3916.06.12 08:21:19 LOG7[ui]: Service [https-server] accepted (FD=9) from 192.168.55.77:12377
3916.06.12 08:21:19 LOG7[ui]: Creating a new thread
3916.06.12 08:21:19 LOG7[ui]: New thread created
3916.06.12 08:21:19 LOG7[0]: Service [https-server] started
3916.06.12 08:21:19 LOG5[0]: Service [https-server] accepted connection from 192.168.55.77:12377
3916.06.12 08:21:19 LOG7[0]: SSL state (accept): before/accept initialization
3916.06.12 08:21:19 LOG7[0]: SNI: no virtual services defined
3916.06.12 08:21:19 LOG7[0]: SSL state (accept): SSLv3 read client hello A
3916.06.12 08:21:19 LOG7[0]: SSL state (accept): SSLv3 write server hello A
3916.06.12 08:21:19 LOG7[0]: SSL state (accept): SSLv3 write certificate A
3916.06.12 08:21:19 LOG7[0]: SSL state (accept): SSLv3 write key exchange A
3916.06.12 08:21:19 LOG7[0]: SSL state (accept): SSLv3 write server done A
3916.06.12 08:21:19 LOG7[0]: SSL state (accept): SSLv3 flush data
3916.06.12 08:21:19 LOG7[0]: SSL state (accept): SSLv3 read client certificate A
3916.06.12 08:21:20 LOG7[0]: SSL state (accept): SSLv3 read client key exchange A
3916.06.12 08:21:20 LOG7[0]: SSL state (accept): SSLv3 read certificate verify A
3916.06.12 08:21:20 LOG7[0]: SSL state (accept): SSLv3 read finished A
3916.06.12 08:21:20 LOG7[0]: SSL state (accept): SSLv3 write change cipher spec A
3916.06.12 08:21:20 LOG7[0]: SSL state (accept): SSLv3 write finished A
3916.06.12 08:21:20 LOG7[0]: SSL state (accept): SSLv3 flush data
3916.06.12 08:21:20 LOG7[0]: New session callback
3916.06.12 08:21:20 LOG7[0]: 1 server accept(s) requested
3916.06.12 08:21:20 LOG7[0]: 1 server accept(s) succeeded
3916.06.12 08:21:20 LOG7[0]: 0 server renegotiation(s) requested
3916.06.12 08:21:20 LOG7[0]: 0 session reuse(s)
3916.06.12 08:21:20 LOG7[0]: 0 internal session cache item(s)
3916.06.12 08:21:20 LOG7[0]: 0 internal session cache fill-up(s)
3916.06.12 08:21:20 LOG7[0]: 0 internal session cache miss(es)
3916.06.12 08:21:20 LOG7[0]: 0 external session cache hit(s)
3916.06.12 08:21:20 LOG7[0]: 0 expired session(s) retrieved
3916.06.12 08:21:20 LOG6[0]: SSL accepted: new session negotiated
3916.06.12 08:21:20 LOG6[0]: No peer certificate received
3916.06.12 08:21:20 LOG6[0]: Negotiated TLSv1.2 ciphersuite ECDHE-RSA-AES256-SHA384 (256-bit encryption)
3916.06.12 08:21:20 LOG7[0]: Compression: null, expansion: null
3916.06.12 08:21:20 LOG6[0]: s_connect: connecting 127.0.0.1:9775
3916.06.12 08:21:20 LOG6[0]: s_connect: connected 127.0.0.1:9775
3916.06.12 08:21:20 LOG6[0]: persistence: 127.0.0.1:9775 cached
3916.06.12 08:21:20 LOG5[0]: Service [https-server] connected remote server from 127.0.0.1:49277
3916.06.12 08:21:20 LOG7[0]: Remote descriptor (FD=11) initialized
3916.06.12 08:21:20 LOG6[0]: SSL socket closed (SSL_read)
3916.06.12 08:21:20 LOG7[0]: Sent socket write shutdown
3916.06.12 08:21:20 LOG5[0]: Connection closed: 0 byte(s) sent to SSL, 0 byte(s) sent to socket
3916.06.12 08:21:20 LOG7[0]: Remote descriptor (FD=11) closed
3916.06.12 08:21:20 LOG7[0]: Local descriptor (FD=9) closed
3916.06.12 08:21:20 LOG7[0]: Service [https-server] finished (0 left)
3916.06.12 08:21:22 LOG7[ui]: Found 1 ready file descriptor(s)
3916.06.12 08:21:22 LOG7[ui]: FD=5 ifds=r-x ofds=---
3916.06.12 08:21:22 LOG7[ui]: Service [https-server] accepted (FD=13) from 192.168.55.77:30351
3916.06.12 08:21:22 LOG7[ui]: Creating a new thread
3916.06.12 08:21:22 LOG7[ui]: New thread created
3916.06.12 08:21:22 LOG7[1]: Service [https-server] started
3916.06.12 08:21:22 LOG5[1]: Service [https-server] accepted connection from 192.168.55.77:30351
3916.06.12 08:21:22 LOG7[1]: SSL state (accept): before/accept initialization
3916.06.12 08:21:22 LOG7[1]: SNI: no virtual services defined
3916.06.12 08:21:22 LOG7[1]: SSL state (accept): SSLv3 read client hello A
3916.06.12 08:21:22 LOG7[1]: SSL state (accept): SSLv3 write server hello A
3916.06.12 08:21:22 LOG7[1]: SSL state (accept): SSLv3 write change cipher spec A
3916.06.12 08:21:22 LOG7[1]: SSL state (accept): SSLv3 write finished A
3916.06.12 08:21:22 LOG7[1]: SSL state (accept): SSLv3 flush data
3916.06.12 08:21:22 LOG7[1]: SSL state (accept): SSLv3 read finished A
3916.06.12 08:21:22 LOG7[1]: 2 server accept(s) requested
3916.06.12 08:21:22 LOG7[1]: 2 server accept(s) succeeded
3916.06.12 08:21:22 LOG7[1]: 0 server renegotiation(s) requested
3916.06.12 08:21:22 LOG7[1]: 1 session reuse(s)
3916.06.12 08:21:22 LOG7[1]: 1 internal session cache item(s)
3916.06.12 08:21:22 LOG7[1]: 0 internal session cache fill-up(s)
3916.06.12 08:21:22 LOG7[1]: 0 internal session cache miss(es)
3916.06.12 08:21:22 LOG7[1]: 0 external session cache hit(s)
3916.06.12 08:21:22 LOG7[1]: 0 expired session(s) retrieved
3916.06.12 08:21:22 LOG6[1]: SSL accepted: previous session reused
3916.06.12 08:21:22 LOG6[1]: s_connect: connecting 127.0.0.1:9775
3916.06.12 08:21:22 LOG6[1]: s_connect: connected 127.0.0.1:9775
3916.06.12 08:21:22 LOG6[1]: persistence: 127.0.0.1:9775 cached
3916.06.12 08:21:22 LOG5[1]: Service [https-server] connected remote server from 127.0.0.1:49278
3916.06.12 08:21:22 LOG7[1]: Remote descriptor (FD=15) initialized
3916.06.12 08:21:22 LOG6[1]: SSL socket closed (SSL_read)
3916.06.12 08:21:22 LOG7[1]: Sent socket write shutdown
3916.06.12 08:21:22 LOG5[1]: Connection closed: 0 byte(s) sent to SSL, 0 byte(s) sent to socket
3916.06.12 08:21:22 LOG7[1]: Remote descriptor (FD=15) closed
3916.06.12 08:21:22 LOG7[1]: Local descriptor (FD=13) closed
3916.06.12 08:21:22 LOG7[1]: Service [https-server] finished (0 left)
3916.06.12 08:21:22 LOG7[ui]: Found 1 ready file descriptor(s)
3916.06.12 08:21:22 LOG7[ui]: FD=5 ifds=r-x ofds=---
3916.06.12 08:21:22 LOG7[ui]: Service [https-server] accepted (FD=17) from 192.168.55.77:30352
3916.06.12 08:21:22 LOG7[ui]: Creating a new thread
3916.06.12 08:21:22 LOG7[ui]: New thread created
3916.06.12 08:21:22 LOG7[2]: Service [https-server] started
3916.06.12 08:21:22 LOG5[2]: Service [https-server] accepted connection from 192.168.55.77:30352
3916.06.12 08:21:22 LOG7[2]: SSL state (accept): before/accept initialization
3916.06.12 08:21:22 LOG7[2]: SNI: no virtual services defined
3916.06.12 08:21:22 LOG7[2]: SSL state (accept): SSLv3 read client hello A
3916.06.12 08:21:22 LOG7[2]: SSL state (accept): SSLv3 write server hello A
3916.06.12 08:21:22 LOG7[2]: SSL state (accept): SSLv3 write change cipher spec A
3916.06.12 08:21:22 LOG7[2]: SSL state (accept): SSLv3 write finished A
3916.06.12 08:21:22 LOG7[2]: SSL state (accept): SSLv3 flush data
3916.06.12 08:21:22 LOG7[2]: SSL state (accept): SSLv3 read finished A
3916.06.12 08:21:22 LOG7[2]: 3 server accept(s) requested
3916.06.12 08:21:22 LOG7[2]: 3 server accept(s) succeeded
3916.06.12 08:21:22 LOG7[2]: 0 server renegotiation(s) requested
3916.06.12 08:21:22 LOG7[2]: 2 session reuse(s)
3916.06.12 08:21:22 LOG7[2]: 1 internal session cache item(s)
3916.06.12 08:21:22 LOG7[2]: 0 internal session cache fill-up(s)
3916.06.12 08:21:22 LOG7[2]: 0 internal session cache miss(es)
3916.06.12 08:21:22 LOG7[2]: 0 external session cache hit(s)
3916.06.12 08:21:22 LOG7[2]: 0 expired session(s) retrieved
3916.06.12 08:21:22 LOG6[2]: SSL accepted: previous session reused
3916.06.12 08:21:22 LOG6[2]: s_connect: connecting 127.0.0.1:9775
3916.06.12 08:21:22 LOG6[2]: s_connect: connected 127.0.0.1:9775
3916.06.12 08:21:22 LOG6[2]: persistence: 127.0.0.1:9775 cached
3916.06.12 08:21:22 LOG5[2]: Service [https-server] connected remote server from 127.0.0.1:49279
3916.06.12 08:21:22 LOG7[2]: Remote descriptor (FD=19) initialized
3916.06.12 08:21:22 LOG3[2]: SSL socket closed (SSL_read) with 10137 unsent byte(s)
3916.06.12 08:21:22 LOG5[2]: Connection reset: 239 byte(s) sent to SSL, 553 byte(s) sent to socket
3916.06.12 08:21:22 LOG7[2]: Remote descriptor (FD=19) closed
3916.06.12 08:21:22 LOG7[2]: Local descriptor (FD=17) closed
3916.06.12 08:21:22 LOG7[2]: Service [https-server] finished (0 left)
3916.06.12 08:21:23 LOG7[ui]: Found 1 ready file descriptor(s)
3916.06.12 08:21:23 LOG7[ui]: FD=5 ifds=r-x ofds=---
3916.06.12 08:21:23 LOG7[ui]: Service [https-server] accepted (FD=21) from 192.168.55.77:30353
3916.06.12 08:21:23 LOG7[ui]: Creating a new thread
3916.06.12 08:21:23 LOG7[ui]: New thread created
3916.06.12 08:21:23 LOG7[3]: Service [https-server] started
3916.06.12 08:21:23 LOG5[3]: Service [https-server] accepted connection from 192.168.55.77:30353
3916.06.12 08:21:23 LOG7[3]: SSL state (accept): before/accept initialization
3916.06.12 08:21:23 LOG7[3]: SNI: no virtual services defined
3916.06.12 08:21:23 LOG7[3]: SSL state (accept): SSLv3 read client hello A
3916.06.12 08:21:23 LOG7[3]: SSL state (accept): SSLv3 write server hello A
3916.06.12 08:21:23 LOG7[3]: SSL state (accept): SSLv3 write change cipher spec A
3916.06.12 08:21:23 LOG7[3]: SSL state (accept): SSLv3 write finished A
3916.06.12 08:21:23 LOG7[3]: SSL state (accept): SSLv3 flush data
3916.06.12 08:21:23 LOG7[3]: SSL state (accept): SSLv3 read finished A
3916.06.12 08:21:23 LOG7[3]: 4 server accept(s) requested
3916.06.12 08:21:23 LOG7[3]: 4 server accept(s) succeeded
3916.06.12 08:21:23 LOG7[3]: 0 server renegotiation(s) requested
3916.06.12 08:21:23 LOG7[3]: 3 session reuse(s)
3916.06.12 08:21:23 LOG7[3]: 1 internal session cache item(s)
3916.06.12 08:21:23 LOG7[3]: 0 internal session cache fill-up(s)
3916.06.12 08:21:23 LOG7[3]: 0 internal session cache miss(es)
3916.06.12 08:21:23 LOG7[3]: 0 external session cache hit(s)
3916.06.12 08:21:23 LOG7[3]: 0 expired session(s) retrieved
3916.06.12 08:21:23 LOG6[3]: SSL accepted: previous session reused
3916.06.12 08:21:23 LOG6[3]: s_connect: connecting 127.0.0.1:9775
3916.06.12 08:21:23 LOG6[3]: s_connect: connected 127.0.0.1:9775
3916.06.12 08:21:23 LOG6[3]: persistence: 127.0.0.1:9775 cached
3916.06.12 08:21:23 LOG5[3]: Service [https-server] connected remote server from 127.0.0.1:49280
3916.06.12 08:21:23 LOG7[3]: Remote descriptor (FD=23) initialized
3916.06.12 08:21:23 LOG6[3]: Read socket closed (readsocket)
3916.06.12 08:21:23 LOG7[3]: Sending close_notify alert
3916.06.12 08:21:23 LOG7[3]: SSL alert (write): warning: close notify
3916.06.12 08:21:23 LOG6[3]: SSL_shutdown successfully sent close_notify alert
3916.06.12 08:21:23 LOG3[3]: transfer() loop executes not transferring any data
3916.06.12 08:21:23 LOG3[3]: please report the problem to Michal.Trojnara(a)mirt.net
1
0
12 May '16
Hi, I'm looking to expand my usage of stunnel.
One thing i'm wondering, is there a way to use multiple accepts for the
same service.
Like:
[httpsmain]
accept = 443
accept = :::443
connect = 10.0.1.1:9443
or even something like.
[httpsmain]
accept = 443,:::443
connect = 10.0.1.1:8443
The reason is I'm about to setup some service with sni with a few domains
and certs, but if I have to have them on v4 and v6 it looks like i'll have
to double everything up.
Is there a better way?
----------------------------------
Brandon Jackson
bojack1437(a)gmail.com
<https://mail.google.com/mail/?view=cm&fs=1&tf=1&[email protected]>
1
0
Hi,
I have installed v5.32 Stunnel on my Windows server which is hosted on AWS. I am trying to connect from here using a Emailer app which uses POP3 to try to connect to this server Outlook.Office365.com on port 995, but I keep on getting this error logged in Stunnel logs:
[cid:[email protected]]
Does anyone have any ideas as to why this connection is timing out please?
Any help would be much appreciated thanks in advance!
Rgds
Mo Khan / Software Engineer / FootFall
Tel: +44 121 712 1428 / Mobile: +44 776 692 7120
Yorke House, Arleston Way / Solihull, B90 4LH / United Kingdom
mohammedkhan(a)tycoint.com<mailto:%[email protected]> / www.footfall.com<http://www.footfall.com/>
[Description: Fieldworks Marketing]<https://urldefense.proofpoint.com/v2/url?u=http-3A__tycoretailsolutions.com…>
[Description: Fieldworks Marketing]<http://www.footfall.com/>
[Description: http://www.footfall.com/wp-content/uploads/2015/09/LinkedIn.png]<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.linkedin.com_compa…> [Description: http://www.footfall.com/wp-content/uploads/2015/09/Twitter.png] <https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_footfallin…> [Description: http://www.footfall.com/wp-content/uploads/2015/09/YouTube.png] <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.youtube.com_channe…> [Description: http://www.footfall.com/wp-content/uploads/2015/09/Facebook.png] <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.facebook.com_footf…> [Description: http://www.footfall.com/wp-content/uploads/2015/09/Google-.png] <https://urldefense.proofpoint.com/v2/url?u=https-3A__plus.google.com_-2BFoo…>
________________________________
This e-mail contains privileged and confidential information intended for the use of the addressees named above. If you are not the intended recipient of this e-mail, you are hereby notified that you must not disseminate, copy or take any action in respect of any information contained in it. If you have received this e-mail in error, please notify the sender immediately by e-mail and immediately destroy this e-mail and its attachments.
1
0
Hi all,
The stunnel docs say that starting with stunnel 5.18, DH params are
auto-generated every 24 hours and that this "may take several
minutes".
I see that for this purpose, stunnel uses OpenSSL's
DH_generate_parameters[_ex] function. According to the OpenSSL API
docs [1], these functions "may run for several hours before finding a
suitable prime."
[1]: https://www.openssl.org/docs/manmaster/crypto/DH_generate_parameters.html
Wouldn't it make sense to use "DSA-like" DH params for this purpose?
These are much faster to generate and apparently equally safe.
DSA-like DH params are generated using DSA_generate_parameters[ex]. It
is the equivalent of passing the -dsaparam option to the openssl
dhparam command.
Some useful info:
- http://security.stackexchange.com/a/95184/109144
- http://dovecot.org/pipermail/dovecot/2015-November/102447.html
Best regards,
Guillermo Rodriguez Garcia
guille.rodriguez(a)gmail.com
1
0
Hello,
Current stunnel (5.32) gives a bunch of warnings in str.c when the
CANARY_XXX and MAGIC_XXX constants are used, for example:
str.c:101: warning: integer constant is too large for 'long' type
Shouldn't these constants be declared with the 'LL' suffix instead of 'L' ?
#define CANARY_INITIALIZED 0x0000c0ded0000000LL
#define CANARY_UNINTIALIZED 0x0000abadbabe0000LL
#define MAGIC_ALLOCATED 0x0000a110c8ed0000LL
#define MAGIC_DEALLOCATED 0x0000defec8ed0000LL
Best regards,
Guillermo Rodriguez Garcia
guille.rodriguez(a)gmail.com
2
1