I am faling to connect to gmail. Not sure what that bind error means.
iqbala@ghar:~$ sudo stunnel4
2008.12.15 13:53:17 LOG7[3839:3083650736]: Snagged 64 random bytes
from /home/iqbala/.rnd
2008.12.15 13:53:17 LOG7[3839:3083650736]: Wrote 1024 new random bytes
to /home/iqbala/.rnd
2008.12.15 13:53:17 LOG7[3839:3083650736]: RAND_status claims
sufficient entropy for the PRNG
2008.12.15 13:53:17 LOG7[3839:3083650736]: PRNG seeded successfully
2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate: /etc/stunnel/stunnel.pem
2008.12.15 13:53:17 LOG7[3839:3083650736]: Certificate loaded
2008.12.15 13:53:17 LOG7[3839:3083650736]: Key file: /etc/stunnel/stunnel.pem
2008.12.15 13:53:17 LOG7[3839:3083650736]: Private key loaded
2008.12.15 13:53:17 LOG7[3839:3083650736]: SSL context initialized for
service ssmtp
2008.12.15 13:53:17 LOG5[3839:3083650736]: stunnel 4.22 on
i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007
2008.12.15 13:53:17 LOG5[3839:3083650736]: Threading:PTHREAD
SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP
2008.12.15 13:53:17 LOG6[3839:3083650736]: file ulimit = 1024 (can be
changed with 'ulimit -n')
2008.12.15 13:53:17 LOG6[3839:3083650736]: poll() used - no FD_SETSIZE
limit for file descriptors
2008.12.15 13:53:17 LOG5[3839:3083650736]: 500 clients allowed
2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 10 in non-blocking mode
2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 11 in non-blocking mode
2008.12.15 13:53:17 LOG7[3839:3083650736]: FD 12 in non-blocking mode
2008.12.15 13:53:17 LOG7[3839:3083650736]: SO_REUSEADDR option set on
accept socket
2008.12.15 13:53:17 LOG3[3839:3083650736]: Error binding ssmtp to
74.125.93.111:587
2008.12.15 13:53:17 LOG3[3839:3083650736]: bind: Cannot assign
requested address (99)
Here is how my conf file looks like
iqbala@ghar:~$ cat /etc/stunnel/stunnel.conf | egrep -v "^;|^$"
cert = /etc/stunnel/stunnel.pem
foreground = yes
sslVersion = SSLv3
chroot = /var/lib/stunnel4/
setuid = stunnel4
setgid = stunnel4
pid = /stunnel4.pid
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
debug = 7
output = /var/log/stunnel4/stunnel.log
client = yes
[ssmtp]
accept = smtp.gmail.com:587
connect = 25
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
5
9
Hi all,
To make "Stunnel 5.31" work with Gmail, I have to go in security settings
of Gmail and "allow less secure apps to access my account".
Is it mandatory ?
Is it possible to set Stunnel to access Gmail without lowering it security
level ?
How ?
I checked in log file TLS v1.2 is used by Stunnel but Gmail still consider
it as a "less secure app." !
Regards,
Steve
2
1
Re: [stunnel-users] Is there a way to specify certificate content in stunnel config
by Eric S Eberhard 24 Jul '18
by Eric S Eberhard 24 Jul '18
24 Jul '18
Use stunnel in inetd mode. Execute a script (or better C program). Copy the certificates for making the stunnel connection to a directory that is OK … then delete them immediately after stunnel starts. Hack – but might be OK for what you are doing.
I am not sure why anyone would think it more secure to put the keys into the stunnel command than to just use them from a file … but I likely do not know enough about your application to make a judgement.
Eric
Eric S Eberhard
VICS (Vertical Integrated Computer Systems)
Voice: 928 567 3529
Cell : 928 301 7537 (not reliable except for text or if not home)
2933 W Middle Verde Rd
Camp Verde, AZ 86322
From: stunnel-users [mailto:[email protected]] On Behalf Of Hari
Sent: Thursday, July 19, 2018 4:42 AM
To: stunnel-users(a)stunnel.org
Subject: [stunnel-users] Is there a way to specify certificate content in stunnel config
Hi,
I have a requirement where in i cannot specify the certificate and/or private key details as "files" to stunnel configuration, owing to the location and/or file system availability for stunnel to access them.
Is there a way to specify the actual certificate content in stunnel configuration (similar to other parameters like port numbers etc.,) so that the same can be leveraged.
Thanks
Hari
<http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_cam…>
Virus-free. <http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_cam…> www.avg.com
3
2
I would ask if someone use Grok log parsing for stunnel and, if yes,
what kind of filter statement are you using?
At the moment I've just created 2 parser:
STUNNEL_AcceptedConnectionParser
%{date("yyyy.MM.dd HH:mm:ss"):date}
LOG%{integer:loglevel}\[%{integer:session_id}\]\: Service
\[%{word:csb_name}\-%{word:csb_port}\] accepted connection from
%{ipv4:caller_ip}\:%{port:caller_port}
and
STUNNEL_ConnectionClosedParser
%{date("yyyy.MM.dd HH:mm:ss"):date}
LOG%{integer:loglevel}\[%{integer:session_id}\]\: Connection closed\:
%{integer:byte_tx} byte\(s\) sent to SSL\, %{integer:byte_rx}
byte\(s\) sent to socket
I'm new with Grok and all the things related to log match-and-parse,
so I think that there will be a much better solution than mine, anyway
Google this time doesn't help unfortunately.
Thank you so much to all those who will help me with this stuff!
Manuele
1
1
Hi All,
I want to cross compile the Stunnel-5.48 for my Android AOSP (arch64)
platform using BoringSSL's 'libssl.so' and 'libcrypto.so' libraries.
I have successfully cross compiled the BoringSSL in my AOSP and both .so
file was generated for arch64 platform. Am using BoringSSL which was
delivered with Android AOSP (Android 7).
Am cross compiling using "build-android.sh" script.
But, while cross compiling the Stunnel-5.48 facing error as below:
------------------------------------------------------------------------------------------------
VERSION=5.48
> DST=stunnel-$VERSION-android
> # to build OpenSSL:
> # ./Configure threads no-shared no-dso
> --cross-compile-prefix=arm-linux-androideabi-
> --prefix=/opt/androideabi/sysroot linux-armv4
> # make install
> LDFLAGS="$LDFLAGS -L/home/jaymin/Desktop/boringssl_lib -fPIE"
> export LDFLAGS
> test -f Makefile && make distclean
> mkdir -p bin/android
> cd bin/android
> ../../configure --with-pic --enable-shared --with-sysroot
> --host=aarch64-linux-android --with-ssl=/home/jaymin/Desktop/boringssl_lib
> configure: **************************************** initialization
> checking for a BSD-compatible install... /usr/bin/install -c
> checking whether build environment is sane... yes
> checking for aarch64-linux-android-strip... no
> checking for strip... strip
> checking for a thread-safe mkdir -p... /bin/mkdir -p
> checking for gawk... gawk
> checking whether make sets $(MAKE)... yes
> checking whether make supports nested variables... yes
> checking build system type... x86_64-pc-linux-gnu
> checking host system type... aarch64-unknown-linux-android
> checking for aarch64-linux-android-gcc... no
> checking for gcc... gcc
> checking whether the C compiler works... yes
> checking for C compiler default output file name... a.out
> checking for suffix of executables...
> checking whether we are cross compiling... no
> checking for suffix of object files... o
> checking whether we are using the GNU C compiler... yes
> checking whether gcc accepts -g... yes
> checking for gcc option to accept ISO C89... none needed
> checking whether gcc understands -c and -o together... yes
> checking for style of include used by make... GNU
> checking dependency style of gcc... gcc3
> checking whether make sets $(MAKE)... (cached) yes
> checking whether make supports nested variables... (cached) yes
> configure: **************************************** thread model
> checking for a sed that does not truncate output... /bin/sed
> checking how to run the C preprocessor... gcc -E
> checking for grep that handles long lines and -e... /bin/grep
> checking for egrep... /bin/grep -E
> checking whether gcc is Clang... no
> checking whether pthreads work with -pthread... yes
> checking for joinable pthread attribute... PTHREAD_CREATE_JOINABLE
> checking whether more special flags are required for pthreads... no
> checking for PTHREAD_PRIO_INHERIT... yes
> configure: PTHREAD thread model detected
> configure: **************************************** compiler/linker flags
> checking whether C compiler accepts -Wall... yes
> checking whether C compiler accepts -Wextra... yes
> checking whether C compiler accepts -Wpedantic... yes
> checking whether C compiler accepts -Wformat=2... yes
> checking whether C compiler accepts -Wconversion... yes
> checking whether C compiler accepts -Wno-long-long... yes
> checking whether C compiler accepts -Wno-deprecated-declarations... yes
> checking whether C compiler accepts -fPIE... yes
> checking whether C compiler accepts -fstack-protector... yes
> checking whether the linker accepts -fPIE... yes
> checking whether the linker accepts -pie... yes
> checking whether the linker accepts -Wl,-z,relro... yes
> checking whether the linker accepts -Wl,-z,now... yes
> checking whether the linker accepts -Wl,-z,noexecstack... yes
> checking whether C compiler accepts -D_FORTIFY_SOURCE=2... yes
> configure: **************************************** libtool
> checking how to print strings... printf
> checking for a sed that does not truncate output... (cached) /bin/sed
> checking for fgrep... /bin/grep -F
> checking for ld used by gcc... /usr/bin/ld
> checking if the linker (/usr/bin/ld) is GNU ld... yes
> checking for BSD- or MS-compatible name lister (nm)... no
> checking for aarch64-linux-android-dumpbin... no
> checking for aarch64-linux-android-link... no
> checking for dumpbin... no
> checking for link... link -dump
> checking the name lister (nm) interface... BSD nm
> checking whether ln -s works... yes
> checking the maximum length of command line arguments... 1572864
> checking how to convert x86_64-pc-linux-gnu file names to
> aarch64-unknown-linux-android format... func_convert_file_noop
> checking how to convert x86_64-pc-linux-gnu file names to toolchain
> format... func_convert_file_noop
> checking for /usr/bin/ld option to reload object files... -r
> checking for aarch64-linux-android-objdump... no
> checking for objdump... objdump
> checking how to recognize dependent libraries... pass_all
> checking for aarch64-linux-android-dlltool... no
> checking for dlltool... no
> checking how to associate runtime and link libraries... printf %s\n
> checking for aarch64-linux-android-ar... no
> checking for ar... ar
> checking for archiver @FILE support... @
> checking for aarch64-linux-android-strip... strip
> checking for aarch64-linux-android-ranlib... no
> checking for ranlib... ranlib
> checking command to parse nm output from gcc object... ok
> checking for sysroot... /
> checking for a working dd... /bin/dd
> checking how to truncate binary pipes... /bin/dd bs=4096 count=1
> checking for aarch64-linux-android-mt... no
> checking for mt... mt
> checking if mt is a manifest tool... no
> checking for ANSI C header files... yes
> checking for sys/types.h... yes
> checking for sys/stat.h... yes
> checking for stdlib.h... yes
> checking for string.h... yes
> checking for memory.h... yes
> checking for strings.h... yes
> checking for inttypes.h... yes
> checking for stdint.h... yes
> checking for unistd.h... yes
> checking for dlfcn.h... yes
> checking for objdir... .libs
> checking if gcc supports -fno-rtti -fno-exceptions... no
> checking for gcc option to produce PIC... -fPIC -DPIC
> checking if gcc PIC flag -fPIC -DPIC works... yes
> checking if gcc static flag -static works... no
> checking if gcc supports -c -o file.o... yes
> checking if gcc supports -c -o file.o... (cached) yes
> checking whether the gcc linker (/usr/bin/ld) supports shared libraries...
> yes
> checking whether -lc should be explicitly linked in... no
> checking dynamic linker characteristics... Android linker
> checking how to hardcode library paths into programs... immediate
> checking whether stripping libraries is possible... yes
> checking if libtool supports shared libraries... yes
> checking whether to build shared libraries... yes
> checking whether to build static libraries... no
> configure: **************************************** types
> checking for int8_t... yes
> checking for int16_t... yes
> checking for int32_t... yes
> checking for int64_t... yes
> checking for uint8_t... yes
> checking for uint16_t... yes
> checking for uint32_t... yes
> checking for uint64_t... yes
> checking for size_t... yes
> checking for ssize_t... yes
> checking for uid_t in sys/types.h... yes
> checking for socklen_t... yes
> checking for struct sockaddr_un... yes
> checking for struct addrinfo... yes
> configure: **************************************** PTY device files
> checking for "/dev/ptmx"... yes
> checking for "/dev/ptc"... no
> configure: **************************************** entropy sources
> checking for "/dev/urandom"... yes
> configure: **************************************** default group
> checking for default group... nogroup
> checking for special C compiler options needed for large files... no
> checking for _FILE_OFFSET_BITS value needed for large files... no
> configure: **************************************** header files
> checking for stdint.h... (cached) yes
> checking for inttypes.h... (cached) yes
> checking malloc.h usability... yes
> checking malloc.h presence... yes
> checking for malloc.h... yes
> checking ucontext.h usability... yes
> checking ucontext.h presence... yes
> checking for ucontext.h... yes
> checking pthread.h usability... yes
> checking pthread.h presence... yes
> checking for pthread.h... yes
> checking poll.h usability... yes
> checking poll.h presence... yes
> checking for poll.h... yes
> checking tcpd.h usability... no
> checking tcpd.h presence... no
> checking for tcpd.h... no
> checking stropts.h usability... yes
> checking stropts.h presence... yes
> checking for stropts.h... yes
> checking grp.h usability... yes
> checking grp.h presence... yes
> checking for grp.h... yes
> checking for unistd.h... (cached) yes
> checking util.h usability... no
> checking util.h presence... no
> checking for util.h... no
> checking libutil.h usability... no
> checking libutil.h presence... no
> checking for libutil.h... no
> checking pty.h usability... yes
> checking pty.h presence... yes
> checking for pty.h... yes
> checking limits.h usability... yes
> checking limits.h presence... yes
> checking for limits.h... yes
> checking for sys/types.h... (cached) yes
> checking sys/select.h usability... yes
> checking sys/select.h presence... yes
> checking for sys/select.h... yes
> checking sys/poll.h usability... yes
> checking sys/poll.h presence... yes
> checking for sys/poll.h... yes
> checking sys/socket.h usability... yes
> checking sys/socket.h presence... yes
> checking for sys/socket.h... yes
> checking sys/un.h usability... yes
> checking sys/un.h presence... yes
> checking for sys/un.h... yes
> checking sys/ioctl.h usability... yes
> checking sys/ioctl.h presence... yes
> checking for sys/ioctl.h... yes
> checking sys/filio.h usability... no
> checking sys/filio.h presence... no
> checking for sys/filio.h... no
> checking sys/resource.h usability... yes
> checking sys/resource.h presence... yes
> checking for sys/resource.h... yes
> checking sys/uio.h usability... yes
> checking sys/uio.h presence... yes
> checking for sys/uio.h... yes
> checking sys/syscall.h usability... yes
> checking sys/syscall.h presence... yes
> checking for sys/syscall.h... yes
> checking linux/sched.h usability... yes
> checking linux/sched.h presence... yes
> checking for linux/sched.h... yes
> checking for struct msghdr.msg_control... yes
> checking for linux/netfilter_ipv4.h... yes
> configure: **************************************** libraries
> checking for library containing gethostbyname... none required
> checking for library containing yp_get_default_domain... -lnsl
> checking for library containing socket... none required
> checking for library containing openpty... -lutil
> checking for library containing dlopen... -ldl
> checking for library containing shl_load... no
> configure: **************************************** library functions
> checking for snprintf... yes
> checking for vsnprintf... yes
> checking for openpty... yes
> checking for _getpty... no
> checking for daemon... yes
> checking for waitpid... yes
> checking for wait4... yes
> checking for setsid... yes
> checking for setgroups... yes
> checking for chroot... yes
> checking for realpath... yes
> checking for sysconf... yes
> checking for getrlimit... yes
> checking for pthread_sigmask... yes
> checking for localtime_r... yes
> checking for getcontext... yes
> checking for __makecontext_v2... no
> checking for poll... yes
> checking for gethostbyname2... yes
> checking for endhostent... yes
> checking for getnameinfo... yes
> checking for getaddrinfo... yes
> checking for broken poll() implementation... no
> checking for pipe2... yes
> checking for accept4... yes
> configure: **************************************** optional features
> checking whether to enable IPv6 support... yes (default)
> checking whether to enable FIPS support... autodetecting
> checking whether to enable systemd socket activation support...
> autodetecting
> checking for library containing sd_listen_fds... no
> configure: systemd library not found
> checking whether to enable TCP wrappers support... autodetecting
> checking for hosts_access in -lwrap... no
> configure: libwrap library not found
> configure: **************************************** TLS
> checking for compiler sysroot... /
> checking for TLS directory... /home/jaymin/Desktop/boringssl_lib
> checking for FIPS_mode_set... yes
> configure: FIPS support enabled
> configure: **************************************** write the results
> checking that generated files are newer than configure... done
> configure: creating ./config.status
> config.status: creating Makefile
> config.status: creating src/Makefile
> config.status: creating doc/Makefile
> config.status: creating tools/Makefile
> config.status: creating tests/Makefile
> config.status: creating src/config.h
> config.status: src/config.h is unchanged
> config.status: executing depfiles commands
> config.status: executing libtool commands
> configure: **************************************** success
> make clean
> Making clean in src
> make[1]: Entering directory
> '/home/jaymin/Downloads/stunnel-5.48/bin/android/src'
> rm -f stunnel
> test -z "stunnel3" || rm -f stunnel3
> rm -rf .libs _libs
> rm -rf ../obj ../bin
> test -z "libstunnel.la" || rm -f libstunnel.la
> rm -f ./so_locations
> rm -f *.o
> rm -f *.lo
> make[1]: Leaving directory
> '/home/jaymin/Downloads/stunnel-5.48/bin/android/src'
> Making clean in doc
> make[1]: Entering directory
> '/home/jaymin/Downloads/stunnel-5.48/bin/android/doc'
> test -z "stunnel.8 stunnel.pl.8 stunnel.html stunnel.pl.html" || rm -f
> stunnel.8 stunnel.pl.8 stunnel.html stunnel.pl.html
> rm -rf .libs _libs
> rm -f *.lo
> make[1]: Leaving directory
> '/home/jaymin/Downloads/stunnel-5.48/bin/android/doc'
> Making clean in tools
> make[1]: Entering directory
> '/home/jaymin/Downloads/stunnel-5.48/bin/android/tools'
> test -z "stunnel.conf-sample stunnel.init stunnel.service" || rm -f
> stunnel.conf-sample stunnel.init stunnel.service
> rm -rf .libs _libs
> rm -f *.lo
> make[1]: Leaving directory
> '/home/jaymin/Downloads/stunnel-5.48/bin/android/tools'
> Making clean in tests
> make[1]: Entering directory
> '/home/jaymin/Downloads/stunnel-5.48/bin/android/tests'
> rm -rf .libs _libs
> rm -f *.lo
> make[1]: Leaving directory
> '/home/jaymin/Downloads/stunnel-5.48/bin/android/tests'
> make[1]: Entering directory
> '/home/jaymin/Downloads/stunnel-5.48/bin/android'
> rm -rf .libs _libs
> rm -f *.lo
> make[1]: Leaving directory
> '/home/jaymin/Downloads/stunnel-5.48/bin/android'
> make
> Making all in src
> make[1]: Entering directory
> '/home/jaymin/Downloads/stunnel-5.48/bin/android/src'
> make all-am
> make[2]: Entering directory
> '/home/jaymin/Downloads/stunnel-5.48/bin/android/src'
> CC env.lo
> CCLD libstunnel.la
> CC stunnel-tls.o
> CC stunnel-str.o
> CC stunnel-file.o
> CC stunnel-client.o
> CC stunnel-log.o
> CC stunnel-options.o
> CC stunnel-protocol.o
> CC stunnel-network.o
> CC stunnel-resolver.o
> CC stunnel-ssl.o
> CC stunnel-ctx.o
> CC stunnel-verify.o
> CC stunnel-sthreads.o
> CC stunnel-fd.o
> CC stunnel-dhparam.o
> CC stunnel-cron.o
> CC stunnel-stunnel.o
> CC stunnel-pty.o
> CC stunnel-libwrap.o
> CC stunnel-ui_unix.o
> CCLD stunnel
> /usr/bin/ld: skipping incompatible
> /home/jaymin/Desktop/boringssl_lib/libssl.so when searching for -lssl
> /usr/bin/ld: skipping incompatible
> /home/jaymin/Desktop/boringssl_lib/libcrypto.so when searching for -lcrypto
> stunnel-str.o: In function `str_leak_debug':
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/str.c:459:
> undefined reference to `CRYPTO_THREAD_write_lock'
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/str.c:470:
> undefined reference to `CRYPTO_THREAD_unlock'
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/str.c:501:
> undefined reference to `CRYPTO_THREAD_write_lock'
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/str.c:509:
> undefined reference to `CRYPTO_THREAD_unlock'
> stunnel-client.o: In function `session_cache_retrieve':
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:568:
> undefined reference to `CRYPTO_THREAD_read_lock'
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:581:
> undefined reference to `CRYPTO_THREAD_unlock'
> stunnel-client.o: In function `ssl_start':
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:501:
> undefined reference to `OpenSSL_version_num'
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:519:
> undefined reference to `CRYPTO_THREAD_unlock'
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:511:
> undefined reference to `CRYPTO_THREAD_write_lock'
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:502:
> undefined reference to `OpenSSL_version_num'
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:503:
> undefined reference to `OpenSSL_version_num'
> stunnel-client.o: In function `print_cipher':
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:595:
> undefined reference to `SSL_session_reused'
> stunnel-client.o: In function `idx_cache_retrieve':
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1446:
> undefined reference to `SSL_session_reused'
> stunnel-client.o: In function `idx_cache_save':
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1432:
> undefined reference to `CRYPTO_THREAD_write_lock'
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1436:
> undefined reference to `CRYPTO_THREAD_unlock'
> stunnel-client.o: In function `idx_cache_retrieve':
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1447:
> undefined reference to `CRYPTO_THREAD_read_lock'
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1453:
> undefined reference to `CRYPTO_THREAD_unlock'
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:1469:
> undefined reference to `CRYPTO_THREAD_unlock'
> stunnel-client.o: In function `client_run':
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:224:
> undefined reference to `CRYPTO_atomic_add'
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/client.c:323:
> undefined reference to `CRYPTO_atomic_add'
> stunnel-log.o: In function `log_close':
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:109:
> undefined reference to `CRYPTO_THREAD_write_lock'
> stunnel-log.o: In function `s_log':
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:165:
> undefined reference to `CRYPTO_THREAD_read_lock'
> stunnel-log.o: In function `log_queue':
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:194:
> undefined reference to `CRYPTO_THREAD_write_lock'
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:201:
> undefined reference to `CRYPTO_THREAD_unlock'
> stunnel-log.o: In function `s_log':
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:170:
> undefined reference to `CRYPTO_THREAD_unlock'
> stunnel-log.o: In function `log_flush':
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:205:
> undefined reference to `CRYPTO_THREAD_write_lock'
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:211:
> undefined reference to `CRYPTO_THREAD_write_lock'
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:219:
> undefined reference to `CRYPTO_THREAD_unlock'
> stunnel-log.o: In function `log_close':
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:115:
> undefined reference to `CRYPTO_THREAD_unlock'
> stunnel-log.o: In function `log_flush':
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/log.c:220:
> undefined reference to `CRYPTO_THREAD_unlock'
> stunnel-options.o: In function `engine_init':
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:4219:
> undefined reference to `OPENSSL_init_crypto'
> stunnel-options.o: In function `service_up_ref':
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:614:
> undefined reference to `CRYPTO_atomic_add'
> stunnel-options.o: In function `parse_global_option':
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:681:
> undefined reference to `OpenSSL_version_num'
> stunnel-options.o: In function `tls_methods_set':
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:3514:
> undefined reference to `TLS_client_method'
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:3515:
> undefined reference to `TLS_server_method'
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:3506:
> undefined reference to `TLS_client_method'
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:3507:
> undefined reference to `TLS_server_method'
> stunnel-options.o: In function `service_up_ref':
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:614:
> undefined reference to `CRYPTO_atomic_add'
> stunnel-options.o: In function `service_free':
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/options.c:624:
> undefined reference to `CRYPTO_atomic_add'
> stunnel-ssl.o: In function `ssl_init':
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ssl.c:56:
> undefined reference to `OPENSSL_init_ssl'
> stunnel-ssl.o: In function `sk_SSL_COMP_pop':
> /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:846: undefined
> reference to `OPENSSL_sk_pop'
> stunnel-ssl.o: In function `sk_SSL_COMP_num':
> /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:846: undefined
> reference to `OPENSSL_sk_num'
> /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:846: undefined
> reference to `OPENSSL_sk_num'
> /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:846: undefined
> reference to `OPENSSL_sk_num'
> stunnel-ssl.o: In function `sk_SSL_COMP_value':
> /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:846: undefined
> reference to `OPENSSL_sk_value'
> stunnel-ssl.o: In function `compression_init':
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ssl.c:217:
> undefined reference to `SSL_COMP_get0_name'
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ssl.c:221:
> undefined reference to `SSL_COMP_get_id'
> stunnel-ssl.o: In function `ssl_configure':
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ssl.c:127:
> undefined reference to `OPENSSL_init_crypto'
> stunnel-ssl.o: In function `compression_init':
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ssl.c:201:
> undefined reference to `COMP_get_type'
> stunnel-ctx.o: In function `info_callback':
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:1231:
> undefined reference to `SSL_get_state'
> stunnel-ctx.o: In function `session_cache_save':
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:981:
> undefined reference to `SSL_SESSION_up_ref'
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:986:
> undefined reference to `CRYPTO_THREAD_write_lock'
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:999:
> undefined reference to `CRYPTO_THREAD_unlock'
> stunnel-ctx.o: In function `sk_X509_value':
> /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined
> reference to `OPENSSL_sk_value'
> stunnel-ctx.o: In function `sk_X509_num':
> /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined
> reference to `OPENSSL_sk_num'
> stunnel-ctx.o: In function `session_cache_save':
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:999:
> undefined reference to `CRYPTO_THREAD_unlock'
> stunnel-ctx.o: In function `context_init':
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:154:
> undefined reference to `SSL_CTX_set_options'
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:157:
> undefined reference to `SSL_CTX_clear_options'
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:161:
> undefined reference to `SSL_CTX_set_options'
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:164:
> undefined reference to `SSL_CTX_clear_options'
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:170:
> undefined reference to `SSL_CTX_get_options'
> stunnel-ctx.o: In function `dh_init':
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:328:
> undefined reference to `SSL_CTX_get_ciphers'
> stunnel-ctx.o: In function `sk_SSL_CIPHER_num':
> /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:845: undefined
> reference to `OPENSSL_sk_num'
> stunnel-ctx.o: In function `sk_SSL_CIPHER_value':
> /home/jaymin/Desktop/boringssl_lib/include/openssl/ssl.h:845: undefined
> reference to `OPENSSL_sk_value'
> stunnel-ctx.o: In function `dh_init':
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:356:
> undefined reference to `CRYPTO_THREAD_read_lock'
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/ctx.c:358:
> undefined reference to `CRYPTO_THREAD_unlock'
> stunnel-verify.o: In function `ocsp_request':
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/verify.c:539:
> undefined reference to `X509_STORE_CTX_get0_chain'
> stunnel-verify.o: In function `get_current_issuer':
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/verify.c:701:
> undefined reference to `X509_STORE_CTX_get0_chain'
> stunnel-verify.o: In function `sk_X509_num':
> /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined
> reference to `OPENSSL_sk_num'
> stunnel-verify.o: In function `sk_X509_value':
> /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined
> reference to `OPENSSL_sk_value'
> stunnel-verify.o: In function `sk_OPENSSL_STRING_value':
> /home/jaymin/Desktop/boringssl_lib/include/openssl/safestack.h:151:
> undefined reference to `OPENSSL_sk_value'
> stunnel-verify.o: In function `sk_OPENSSL_STRING_num':
> /home/jaymin/Desktop/boringssl_lib/include/openssl/safestack.h:151:
> undefined reference to `OPENSSL_sk_num'
> stunnel-verify.o: In function `cert_check_local':
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/verify.c:353:
> undefined reference to `X509_STORE_CTX_get1_certs'
> stunnel-verify.o: In function `sk_X509_num':
> /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined
> reference to `OPENSSL_sk_num'
> stunnel-verify.o: In function `sk_X509_value':
> /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined
> reference to `OPENSSL_sk_value'
> stunnel-verify.o: In function `sk_X509_pop_free':
> /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined
> reference to `OPENSSL_sk_pop_free'
> /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:97: undefined
> reference to `OPENSSL_sk_pop_free'
> stunnel-verify.o: In function `sk_X509_NAME_num':
> /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:75: undefined
> reference to `OPENSSL_sk_num'
> stunnel-verify.o: In function `sk_X509_NAME_value':
> /home/jaymin/Desktop/boringssl_lib/include/openssl/x509.h:75: undefined
> reference to `OPENSSL_sk_value'
> stunnel-sthreads.o: In function `locking_init':
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/sthreads.c:358:
> undefined reference to `CRYPTO_THREAD_lock_new'
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/sthreads.c:358:
> undefined reference to `CRYPTO_THREAD_lock_new'
> stunnel-dhparam.o: In function `get_dh2048':
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/dhparam.c:49:
> undefined reference to `DH_set0_pqg'
> stunnel-cron.o: In function `cron_dh_param':
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/cron.c:193:
> undefined reference to `CRYPTO_THREAD_write_lock'
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/cron.c:196:
> undefined reference to `CRYPTO_THREAD_unlock'
> stunnel-stunnel.o: In function `stunnel_info':
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/stunnel.c:887:
> undefined reference to `OpenSSL_version'
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/stunnel.c:889:
> undefined reference to `OpenSSL_version'
> /home/jaymin/Downloads/stunnel-5.48/bin/android/src/../../../src/stunnel.c:890:
> undefined reference to `OpenSSL_version_num'
> collect2: error: ld returned 1 exit status
> Makefile:538: recipe for target 'stunnel' failed
> make[2]: *** [stunnel] Error 1
> make[2]: Leaving directory
> '/home/jaymin/Downloads/stunnel-5.48/bin/android/src'
> Makefile:401: recipe for target 'all' failed
> make[1]: *** [all] Error 2
> make[1]: Leaving directory
> '/home/jaymin/Downloads/stunnel-5.48/bin/android/src'
> Makefile:447: recipe for target 'all-recursive' failed
> make: *** [all-recursive] Error 1
------------------------------------------------------------------------------------------------
As I want to use SSL, did modification as below:
---------------------------------------------------------------------------------------------
#!/bin/sh
> set -ev
> VERSION=5.48
> DST=stunnel-$VERSION-android
> # to build OpenSSL:
> # ./Configure threads no-shared no-dso
> --cross-compile-prefix=arm-linux-androideabi-
> --prefix=/opt/androideabi/sysroot linux-armv4
> # make install
> LDFLAGS="$LDFLAGS -L/home/jaymin/Desktop/boringssl_lib -fPIE"
> export LDFLAGS
> test -f Makefile && make distclean
> mkdir -p bin/android
> cd bin/android
> ../../configure --with-pic --enable-shared --with-sysroot
> --host=aarch64-linux-android --with-ssl=/home/jaymin/Desktop/boringssl_lib
> make clean
> make
> cd ../..
> mkdir $DST
> cp bin/android/src/stunnel $DST
> # arm-linux-androideabi-strip $DST/stunnel $DST/openssl
> # cp /opt/androideabi/sysroot/bin/openssl $DST
> # arm-linux-androideabi-strip $DST/openssl
> zip -r $DST.zip $DST
> rm -rf $DST
> # sha256sum $DST.zip
> # mv $DST.zip ../dist/
---------------------------------------------------------------------------------------------
How can I cross compile the Stunnel-5.48 using this BoringSSL?
Are my BoringSSL's .so files incompatible?
Any suggestions.
Regards,
Jaymin
1
0
I have a client who is setting up a logging infrastructure involving a
couple of DMZs forwarding logs into central logging points.
They have to pass compliance audits (SOX, PCI at least) and have some
rather specific desires in regards to how they want the log traffic to
move, and which servers *initiate* the connections.
Which is to say they want the internal servers to set up tunnels to the DMZ
servers and then the forwarders use that tunnel to deliver logs back.
Lemme see if I can ascii art this:
central1----------------------------------dmz1
\____________________ /
_____________________\ _/
/ \
central2----------------------------------dmz2
Something like that.
Central1=10.10.1.2
Central2=10.9.1.2
DMZ1=172.18.0.5
DMZ2=172.20.0.5
Firewalls are in effect.
I have gotten it set up so that I can initiate a connection FROM Central1
to DMZ2.
[Tunnel_to_DMZ2]
client = yes
accept = 3002
connect = 172.20.0.5:5000
And
[Tunnel_from_Central1]
accept = 5000
connect = 3000
Like I said, I can open a tunnel from Central1 to DMZ2, but can't get
traffic to pass backwards--I get a message in the log saying the session is
closed.
Is it possible to set stunnel up in a "reverse tunnel" mode--one where the
connect is initiated from one end, but the other does most of the message
passing?
What I am missing?
Thanks,
Petro.
2
2
I found it after looking once more in the log file.
PSK client configured for identity "user2"
(the identity in the secrets.txt is user2:secretkey, somehow those three weird characters are added on windows)
I got around it by copying the secrets.txt file to the server so that the secrets.txt on the server also begins with
"user2" but I suspect it's a bug.
Regards,
Per Gunnarsson
1
0
Hi,
I have a requirement where in i cannot specify the certificate and/or private key details as "files" to stunnel configuration, owing to the location and/or file system availability for stunnel to access them.
Is there a way to specify the actual certificate content in stunnel configuration (similar to other parameters like port numbers etc.,) so that the same can be leveraged.
ThanksHari
| | Virus-free. www.avg.com |
1
0
Hello!
I am trying to set up stunnel from a windows box to a VPS.
I have working tunnels from a FreeBSD box to the VPS.
On the VPS, the config looks like:
[socks_server]
protocol = socks
PSKsecrets = /my/secret/location/secrets.txt
accept = xxx.xxx.xxx.xxx:xxxx
[ssh]
PSKsecrets = /my/secret/location/hecrets.txt
accept = xxx.xxx.xxx.xxx:xxxx
connect = 127.0.0.1:22
On the windows box, the config looks like this:
[socks_client2]
debug = 7
client = yes
PSKsecrets = c:\my\secret\location\secrets.txt
accept = 127.0.0.1:1080
connect = xxx.xxx.xxx.xxx:xxxx
The log on Windows looks like this:
2018.07.19 13:13:09 LOG5[main]: stunnel 5.48 on x86-pc-msvc-1500 platform
2018.07.19 13:13:09 LOG5[main]: Compiled/running with OpenSSL
1.0.2o-fips 27 Mar 2018
2018.07.19 13:13:09 LOG5[main]: Threading:WIN32 Sockets:SELECT,IPv6
TLS:ENGINE,FIPS,OCSP,PSK,SNI
2018.07.19 13:13:09 LOG5[main]: Reading configuration from file stunnel.conf
2018.07.19 13:13:09 LOG5[main]: UTF-8 byte order mark detected
2018.07.19 13:13:09 LOG5[main]: FIPS mode disabled
2018.07.19 13:13:09 LOG5[main]: Configuration successful
2018.07.19 13:13:11 LOG7[0]: Service [socks_client2] started
2018.07.19 13:13:11 LOG7[0]: Setting local socket options (FD=460)
2018.07.19 13:13:11 LOG7[0]: Option TCP_NODELAY set on local socket
2018.07.19 13:13:11 LOG5[0]: Service [socks_client2] accepted connection
from 127.0.0.1:56598
2018.07.19 13:13:11 LOG6[0]: s_connect: connecting xxx.xxx.xxx.xxx:xxxx
2018.07.19 13:13:11 LOG7[0]: s_connect: s_poll_wait
xxx.xxx.xxx.xxx:xxxx: waiting 10 seconds
2018.07.19 13:13:11 LOG5[0]: s_connect: connected xxx.xxx.xxx.xxx:xxxx
2018.07.19 13:13:11 LOG5[0]: Service [socks_client2] connected remote
server from 192.168.1.65:56599
2018.07.19 13:13:11 LOG7[0]: Setting remote socket options (FD=508)
2018.07.19 13:13:11 LOG7[0]: Option TCP_NODELAY set on remote socket
2018.07.19 13:13:11 LOG7[0]: Remote descriptor (FD=508) initialized
2018.07.19 13:13:11 LOG6[0]: SNI: sending servername: xxx.xxx.xxx.xxx
2018.07.19 13:13:11 LOG6[0]: Peer certificate not required
2018.07.19 13:13:11 LOG7[0]: TLS state (connect): before/connect
initialization
2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv2/v3 write client
hello A
2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv3 read server hello A
2018.07.19 13:13:11 LOG6[0]: Client certificate not requested
2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv3 read server done A
2018.07.19 13:13:11 LOG6[0]: PSK client configured for identity "user2"
2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv3 write client key
exchange A
2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv3 write change
cipher spec A
2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv3 write finished A
2018.07.19 13:13:11 LOG7[0]: TLS state (connect): SSLv3 flush data
2018.07.19 13:13:11 LOG3[0]: SSL_connect: Peer suddenly disconnected
2018.07.19 13:13:11 LOG5[0]: Connection reset: 0 byte(s) sent to TLS, 0
byte(s) sent to socket
2018.07.19 13:13:11 LOG7[0]: Deallocating application specific data for
session connect address
2018.07.19 13:13:11 LOG7[0]: Remote descriptor (FD=508) closed
2018.07.19 13:13:11 LOG7[0]: Local descriptor (FD=460) closed
2018.07.19 13:13:11 LOG7[0]: Service [socks_client2] finished (0 left)
2018.07.19 13:13:34 LOG7[1]: Service [socks_client2] started
2018.07.19 13:13:34 LOG7[1]: Setting local socket options (FD=528)
2018.07.19 13:13:34 LOG7[1]: Option TCP_NODELAY set on local socket
2018.07.19 13:13:34 LOG5[1]: Service [socks_client2] accepted connection
from 127.0.0.1:56601
2018.07.19 13:13:34 LOG6[1]: s_connect: connecting xxx.xxx.xxx.xxx:xxxx
2018.07.19 13:13:34 LOG7[1]: s_connect: s_poll_wait
xxx.xxx.xxx.xxx:xxxx: waiting 10 seconds
2018.07.19 13:13:34 LOG5[1]: s_connect: connected xxx.xxx.xxx.xxx:xxxx
2018.07.19 13:13:34 LOG5[1]: Service [socks_client2] connected remote
server from 192.168.1.65:56602
2018.07.19 13:13:34 LOG7[1]: Setting remote socket options (FD=536)
2018.07.19 13:13:34 LOG7[1]: Option TCP_NODELAY set on remote socket
2018.07.19 13:13:34 LOG7[1]: Remote descriptor (FD=536) initialized
2018.07.19 13:13:34 LOG6[1]: SNI: sending servername: xxx.xxx.xxx.xxx
2018.07.19 13:13:34 LOG6[1]: Peer certificate not required
2018.07.19 13:13:34 LOG7[1]: TLS state (connect): before/connect
initialization
2018.07.19 13:13:34 LOG7[1]: TLS state (connect): SSLv2/v3 write client
hello A
2018.07.19 13:13:35 LOG7[1]: TLS state (connect): SSLv3 read server hello A
2018.07.19 13:13:35 LOG6[1]: Client certificate not requested
2018.07.19 13:13:35 LOG7[1]: TLS state (connect): SSLv3 read server done A
2018.07.19 13:13:35 LOG6[1]: PSK client configured for identity "user2"
2018.07.19 13:13:35 LOG7[1]: TLS state (connect): SSLv3 write client key
exchange A
2018.07.19 13:13:35 LOG7[1]: TLS state (connect): SSLv3 write change
cipher spec A
2018.07.19 13:13:35 LOG7[1]: TLS state (connect): SSLv3 write finished A
2018.07.19 13:13:35 LOG7[1]: TLS state (connect): SSLv3 flush data
2018.07.19 13:13:35 LOG7[1]: TLS alert (read): fatal: bad record mac
2018.07.19 13:13:35 LOG3[1]: SSL_connect: 140943FC: error:140943FC:SSL
routines:ssl3_read_bytes:sslv3 alert bad record mac
2018.07.19 13:13:35 LOG5[1]: Connection reset: 0 byte(s) sent to TLS, 0
byte(s) sent to socket
2018.07.19 13:13:35 LOG7[1]: Deallocating application specific data for
session connect address
2018.07.19 13:13:35 LOG7[1]: Remote descriptor (FD=536) closed
2018.07.19 13:13:35 LOG7[1]: Local descriptor (FD=528) closed
2018.07.19 13:13:35 LOG7[1]: Service [socks_client2] finished (0 left)
2018.07.19 13:14:06 LOG7[2]: Service [socks_client2] started
2018.07.19 13:14:06 LOG7[2]: Setting local socket options (FD=1880)
2018.07.19 13:14:06 LOG7[2]: Option TCP_NODELAY set on local socket
2018.07.19 13:14:06 LOG5[2]: Service [socks_client2] accepted connection
from 127.0.0.1:56604
2018.07.19 13:14:06 LOG6[2]: s_connect: connecting xxx.xxx.xxx.xxx:xxxx
2018.07.19 13:14:06 LOG7[2]: s_connect: s_poll_wait
xxx.xxx.xxx.xxx:xxxx: waiting 10 seconds
2018.07.19 13:14:06 LOG5[2]: s_connect: connected xxx.xxx.xxx.xxx:xxxx
2018.07.19 13:14:06 LOG5[2]: Service [socks_client2] connected remote
server from 192.168.1.65:56605
2018.07.19 13:14:06 LOG7[2]: Setting remote socket options (FD=2044)
2018.07.19 13:14:06 LOG7[2]: Option TCP_NODELAY set on remote socket
2018.07.19 13:14:06 LOG7[2]: Remote descriptor (FD=2044) initialized
2018.07.19 13:14:06 LOG6[2]: SNI: sending servername: xxx.xxx.xxx.xxx
2018.07.19 13:14:06 LOG6[2]: Peer certificate not required
2018.07.19 13:14:06 LOG7[2]: TLS state (connect): before/connect
initialization
2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv2/v3 write client
hello A
2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv3 read server hello A
2018.07.19 13:14:06 LOG6[2]: Client certificate not requested
2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv3 read server done A
2018.07.19 13:14:06 LOG6[2]: PSK client configured for identity "user2"
2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv3 write client key
exchange A
2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv3 write change
cipher spec A
2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv3 write finished A
2018.07.19 13:14:06 LOG7[2]: TLS state (connect): SSLv3 flush data
2018.07.19 13:14:06 LOG7[2]: TLS alert (read): fatal: bad record mac
2018.07.19 13:14:06 LOG3[2]: SSL_connect: 140943FC: error:140943FC:SSL
routines:ssl3_read_bytes:sslv3 alert bad record mac
2018.07.19 13:14:06 LOG5[2]: Connection reset: 0 byte(s) sent to TLS, 0
byte(s) sent to socket
2018.07.19 13:14:06 LOG7[2]: Deallocating application specific data for
session connect address
2018.07.19 13:14:06 LOG7[2]: Remote descriptor (FD=2044) closed
2018.07.19 13:14:06 LOG7[2]: Local descriptor (FD=1880) closed
2018.07.19 13:14:06 LOG7[2]: Service [socks_client2] finished (0 left)
1
0
Early in 2018, around the time when I upgraded my system to Windows 10,
the Stunnel and Blat files that had worked fine with my Vista PC would not
work with the new PC. However, the "bug" turned out to be unrelated to the
change in operating systems, but rather an "upgrade" to Gmail:
Coincidentally, about that time, Gmail evidently decided to stop accepting
e-mails from apps deemed "a less secure app", including Stunnel-Blat, with
Blat then displaying messages:
*** Warning *** The SMTP server did not accept Auth PLAIN value.
*** Warning *** Are your login userid and password correct?
*** Warning *** The SMTP server did not accept Auth LOGIN PASSWD value.
Only a failure message sent to my "backup e-mail address" led me to explore
this as a possible cause for what I had thought was, but turned out not to
be, a Stunnel-Blat problem. Gmail has an option to suppress this
heightened security feature, and when I activated this option, my
Stunnel-Blat tools immediately began to function as intended.
While I was at first able to enable Gmail to "Allow access from "less
secure accounts," I have been unable to get through Gmail options
consistently to turn this on and off and share this info with others. (I
would welcome instructions that work consistently.)
I would also welcome guidance on how to include Stunnel-Blat as a specific
alllowed app, without having to enable Gmail to enable *all* "less secure
apps"
Roger Bohl
3
3