- stunnel-users - stunnel.org

Stunnel, Pan and the SSL23_GET_SERVER_HELLO:unknown protocol
by mike 28 Jun '12

28 Jun '12

Hello All, Running Debian 6.0, stunnel4 and Pan 0.133 I have set up Pan and installed stunnel so that I can use ssl with nntp. Installing Pan and stunnel was easy. I've edited Pan to use localhost:119 and edited my config file in stunnel to point to my nntp server. I have allowed nntp in my hosts.allow for ALL:ALL. The problem I am running into is that Pan does not connect. I get the following error: Error reading from localhost. Connection reset by peer Checking with the following openssl command produced this error: root@triglav:/etc/stunnel# openssl s_client -ssl3 -connect localhost:119 CONNECTED(00000003) write:errno=104 Looking at the logs for stunnel I see many repetitions of this message: 2012.06.25 14:18:26 LOG7[16355:3074153328]: nntp started 2012.06.25 14:18:26 LOG7[16355:3074153328]: FD 13 in non-blocking mode 2012.06.25 14:18:26 LOG7[16355:3074153328]: TCP_NODELAY option set on local socket 2012.06.25 14:18:26 LOG7[16355:3074153328]: Waiting for a libwrap process 2012.06.25 14:18:26 LOG7[16355:3074153328]: Acquired libwrap process #0 2012.06.25 14:18:26 LOG7[16355:3074153328]: Releasing libwrap process #0 2012.06.25 14:18:26 LOG7[16355:3074153328]: Released libwrap process #0 2012.06.25 14:18:26 LOG7[16355:3074153328]: nntp permitted by libwrap from 127.0.0.1:59451 2012.06.25 14:18:26 LOG5[16355:3074153328]: nntp accepted connection from 127.0.0.1:59451 2012.06.25 14:18:26 LOG7[16355:3074153328]: FD 14 in non-blocking mode 2012.06.25 14:18:26 LOG6[16355:3074153328]: connect_blocking: connecting 209.197.15.238:119 2012.06.25 14:18:26 LOG7[16355:3074153328]: connect_blocking: s_poll_wait 209.197.15.238:119: waiting 10 seconds 2012.06.25 14:18:26 LOG5[16355:3074153328]: connect_blocking: connected 209.197.15.238:119 2012.06.25 14:18:26 LOG5[16355:3074153328]: nntp connected remote server from 192.168.2.56:51455 2012.06.25 14:18:26 LOG7[16355:3074153328]: Remote FD=14 initialized 2012.06.25 14:18:26 LOG7[16355:3074153328]: TCP_NODELAY option set on remote socket 2012.06.25 14:18:26 LOG7[16355:3074153328]: SSL state (connect): before/connect initialization 2012.06.25 14:18:26 LOG7[16355:3074153328]: SSL state (connect): SSLv2/v3 write client hello A 2012.06.25 14:18:26 LOG3[16355:3074153328]: SSL_connect: 140770FC: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol 2012.06.25 14:18:26 LOG5[16355:3074153328]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2012.06.25 14:18:26 LOG7[16355:3074153328]: nntp finished (0 left) Anyone know what is missing? It almost looks like it cant talk in either SSLv2 or v3 which makes no sense. Here is my stunnel config: ; Sample stunnel configuration file by Michal Trojnara 2002-2009 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of the chroot jail) ; Certificate/key is needed in server mode and optional in client mode ;cert = /etc/ssl/certs/stunnel.pem ;key = /etc/ssl/certs/stunnel.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = all ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 ; PID is created inside the chroot jail pid = /stunnel4.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = zlib ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = /var/log/stunnel4/stunnel.log foreground = no ; Use it for client mode client = yes ; Service-level configuration [nntp] accept = localhost:119 connect = news.aliant.net:119 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini

2 4

Interoperability problems with .net client software
by ProPharma Systems AG - Gregor Bürgisser 28 Jun '12

28 Jun '12

Hi all, I'm using stunnel 4.53 under Linux to secure a service. There are two different clients connecting to this service: My own client, also Linux based and using libcurl and another (third party!) client being developed using Microsoft .net stuff. Of course with my own client all works well. But we are not able to get the Microsoft client running. stunnel keeps on telling: SSL_accept: 140890C7: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate We have tried diffierent things... I will outline them here if you think it is helpful (in short: tried using certificates generated on the Microsoft side, then tried using certificates created on the Linux side). If "verify" ist set to 0 or 1 it works (of course) but with a higher value the above message is logged. Are there any known pitfalls, problems or whatsoever when using stunnel with a .net client? Any advice would be appreciated! Regards, Gregor

2 1

Accept on same port to ethernet aliases
by John Morrison 27 Jun '12

27 Jun '12

Hi, Is it possible to configure stunnel to use the same port on different IP addresses that are Ethernet aliases? I have successfully set up a configuration file accepting SSL connections. Firstly I did this on all IP addresses by using the following configuration lines: accept = 443 connect = 80 This worked correctly. I then attempted to setup a second configuration file on an aliased Ethernet address. The configuration file settings are: test1.conf accept = 10.168.1.132:443 connect = 10.168.1.132:80 test2.conf accept = 10.168.1.133:443 connect = 10.168.1.133:80 Stunnel is able to start the first configuration file, but not the second. The error message I can see when I run the second configuration file in the foreground is: accept socket: FD=11 allocated (non-blocking mode) Option SO_REUSEADDR set on accept socket Error binding https to 10.168.1.133:443 bind: Address already in use (98) and if I telnet to 10.168.1.133 on port 443 the connection is accepted. I have attempted to use the binding socket options in the configuration files as described in the manual: socket = a:SO_BINDTODEVICE=eth0:0 and socket = a:SO_BINDTODEVICE=eth0:1 However in this case stunnel will not start either configuration file. The error message I receive is: Option SO_REUSEADDR set on accept socket SO_BINDTODEVICE: No such device (19) Is there a different way to configure stunnel to allow this to work? My ipconfig settings are below. I am running the ubuntu 10.04 version of stunnel. The version output is: stunnel 4.35 on x86_64-pc-linux-gnu with OpenSSL 1.0.0e 6 Sep 2011 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Thanks, John eth0:0 Link encap:Ethernet HWaddr 3c:4a:92:6d:0b:08 inet addr:10.168.1.132 Bcast:10.168.1.132 Mask:255.255.255.255 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 Interrupt:16 Memory:f4000000-f4012800 eth0:1 Link encap:Ethernet HWaddr 3c:4a:92:6d:0b:08 inet addr:10.168.1.133 Bcast:10.168.1.133 Mask:255.255.255.255 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 Interrupt:16 Memory:f4000000-f4012800

2 2

Confused about stunnel + haproxy
by Robin Lee Powell 27 Jun '12

27 Jun '12

I've set up stunnel + haproxy using the "protocol = proxy" method, but stunnel doesn't seem to pass to haproxy any information about the source IP of the original connection, which I thought was the point of using this method? Can someone tell me what I'm missng? I just want to have haproxy with SSL support without losing the client IP information completely. -Robin -- http://singinst.org/ : Our last, best hope for a fantastic future. .i ko na cpedu lo nu stidi vau loi jbopre .i danfu lu na go'i li'u .e lu go'i li'u .i ji'a go'i lu na'e go'i li'u .e lu go'i na'i li'u .e lu no'e go'i li'u .e lu to'e go'i li'u .e lu lo mamta be do cu sofybakni li'u

1 1

socket status
by Dee Ayy 20 Jun '12

20 Jun '12

My socket in Eiffel will report that it is connected, but when it tries to write to the socket, it will fail and report Connection reset by peer I/O error The syslog shows 1) ... accepted connection from 127.0.0.1:.. 2) connect_blocking: getsockopt A_REMOTE_IP:A_REMOTE_PORT: Connection refused (111) 3) Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket I believe that my socket is connecting locally fine 127.0.0.1:.. in step 1, and then the remote connection via stunnel is failing in step 2, but I have tried to write to the socket in between steps 1 and 2. Is this proper behavior? How can I know the status of the remote connection? Wait a while and then test? Is the socket state really just the state of the local stunnel connection? Should stunnel report a different state (as seen by my socket) until it determines the remote socket state?

1 0

What version of stunnel am I using?
by Dee Ayy 20 Jun '12

20 Jun '12

I don't see a version here stunnel -version 2012.06.20 16:44:05 LOG7[25078:3074172608]: RAND_status claims sufficient entropy for the PRNG 2012.06.20 16:44:05 LOG7[25078:3074172608]: PRNG seeded successfully 2012.06.20 16:44:05 LOG3[25078:3074172608]: /etc/stunnel/stunnel.pem: No such file or directory (2) apt-cache search stunnel on Ubuntu has stunnel4

1 0

Error connecting through IE6
by Karl Kloppenborg 15 Jun '12

15 Jun '12

Hey Stunnel guys! I've got a bit of an issue in which users on ie6 cannot connect through HTTPs to my haproxy cluster, they get a 404 page cannot be displayed. Works fine in all other browsers ;) The logs from Stunnel are: 2012.06.13 01:06:09 LOG7[28347:47884616028640]: local socket: FD=14 allocated (non-blocking mode) 2012.06.13 01:06:09 LOG7[28347:47884616028640]: Service incoming-https accepted FD=14 from [ClientIP]:1208 2012.06.13 01:06:09 LOG7[28347:1078843712]: Service incoming-https started 2012.06.13 01:06:09 LOG7[28347:1078843712]: Option TCP_NODELAY set on local socket 2012.06.13 01:06:09 LOG7[28347:1078843712]: Waiting for a libwrap process 2012.06.13 01:06:09 LOG7[28347:1078843712]: Acquired libwrap process #0 2012.06.13 01:06:09 LOG7[28347:1078843712]: Releasing libwrap process #0 2012.06.13 01:06:09 LOG7[28347:1078843712]: Released libwrap process #0 2012.06.13 01:06:09 LOG7[28347:1078843712]: Service incoming-https permitted by libwrap from [ClientIP]:1208 2012.06.13 01:06:09 LOG5[28347:1078843712]: Service incoming-https accepted connection from [ClientIP]:1208 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): before/accept initialization 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 read client hello A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 write server hello A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 write certificate A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 write server done A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 flush data 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 read client key exchange A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 read finished A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 write change cipher spec A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 write finished A 2012.06.13 01:06:09 LOG7[28347:1078843712]: SSL state (accept): SSLv3 flush data 2012.06.13 01:06:09 LOG7[28347:1078843712]: 1 items in the session cache 2012.06.13 01:06:09 LOG7[28347:1078843712]: 0 client connects (SSL_connect()) 2012.06.13 01:06:09 LOG7[28347:1078843712]: 0 client connects that finished 2012.06.13 01:06:09 LOG7[28347:1078843712]: 0 client renegotiations requested 2012.06.13 01:06:09 LOG7[28347:1078843712]: 1 server connects (SSL_accept()) 2012.06.13 01:06:09 LOG7[28347:1078843712]: 1 server connects that finished 2012.06.13 01:06:09 LOG7[28347:1078843712]: 0 server renegotiations requested 2012.06.13 01:06:09 LOG7[28347:1078843712]: 0 session cache hits 2012.06.13 01:06:09 LOG7[28347:1078843712]: 0 external session cache hits 2012.06.13 01:06:09 LOG7[28347:1078843712]: 1 session cache misses 2012.06.13 01:06:09 LOG7[28347:1078843712]: 0 session cache timeouts 2012.06.13 01:06:09 LOG6[28347:1078843712]: SSL accepted: new session negotiated 2012.06.13 01:06:09 LOG6[28347:1078843712]: Negotiated ciphers: DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 2012.06.13 01:06:09 LOG7[28347:1078843712]: remote socket: FD=15 allocated (non-blocking mode) 2012.06.13 01:06:09 LOG6[28347:1078843712]: connect_blocking: connecting [HAPROXY IP]:81 2012.06.13 01:06:09 LOG7[28347:1078843712]: connect_blocking: s_poll_wait [HAPROXY IP]:81: waiting 10 seconds 2012.06.13 01:06:09 LOG5[28347:1078843712]: connect_blocking: connected [HAPROXY IP]:81 2012.06.13 01:06:09 LOG5[28347:1078843712]: Service incoming-https connected remote server from [HAPROXY IP]:55823 2012.06.13 01:06:09 LOG7[28347:1078843712]: Remote FD=15 initialized 2012.06.13 01:06:09 LOG7[28347:1078843712]: Option TCP_NODELAY set on remote socket 2012.06.13 01:06:09 LOG5[28347:1078843712]: Error detected on SSL (read) file descriptor: Connection reset by peer (104) 2012.06.13 01:06:09 LOG5[28347:1078843712]: Connection reset: 0 bytes sent to SSL, 320 bytes sent to socket 2012.06.13 01:06:09 LOG7[28347:1078843712]: Service incoming-https finished (0 left) 2012.06.13 01:06:09 LOG7[28347:1078843712]: str_stats: 0 block(s), 0 data byte(s), 0 control byte(s) Could stunnel be at play here or am I looking at the wrong thing? Thanks! Karl. Karl Kloppenborg Programming Ninja Crucial Paradigm Pty Ltd Suite 1 Level 3 104-106 Commonwealth St Surry Hills NSW 2010 Australia 1300 884 839 - Sales & Support (AU Only) <https://support.crucialp.com/> Click here for the Support Desk d: 02 8202 9994 f: 02 92818261 m: 0416 236 908 e: <mailto:[email protected]> karl(a)crucial.com.au Crucial Paradigm is a leading Web Hosting provider that specialises in Cloud solutions. We are commited to keeping our planet green, please reduce, reuse and recycle your office paper. Description: crucial_2012

2 3

Stunnel 4.53 for win32 - without config file
by Ivanko B 14 Jun '12

14 Jun '12

How to bypass reading any config file so that all needed options were fed from command line ? (security reasons)

5 7

Re: [stunnel-users] Getting Stunnel to Work Under Windows 7 64-bit
by Brian Wilkins 14 Jun '12

14 Jun '12

I should note that I have been running stunnel 4.45 on Windows 7 since Oct-2011 with no problems whatsoever. It has been running non-stop on Windows 7 to this date with no problems. I have not upgraded to the latest because I have not been able to have time to test the FIPS changes with my configuration yet. Brian

4 6

stunnel version 4.53 says SSL server needs a certificate on Windows 7?
by Wayne Walter 13 Jun '12

13 Jun '12

I have been using stunnel previous versions just fine. It didn't apparently have the feature of a certificate in SSL server mode. That's alright but not necessary for us as we're simply running a localhost server to tunnel to the remote server. Anyway, I have read the FAQ tutorial and such related to this and tried everything. No mater what I do with the cert or key settings it still gives this same error here's the complete output.... No limit detected for the number of clients stunnel 4.53 on x86-pc-mingw32-gnu platform Compiled/running with OpenSSL 0.9.8s-fips 4 Jan 2012 Threading:WIN32 SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:SELECT+IPv6 Reading configuration from file stunnel.conf FIPS mode is enabled Compression not enabled Snagged 64 random bytes from C:/.rnd Wrote 0 new random bytes to C:/.rnd PRNG seeded successfully Initializing service section [FIX] Section FIX: SSL server needs a certificate Server is down And here is the stunnel.conf file contents: ; Certificate/key is needed in server mode and optional in client mode cert = stunnel.pem ;key = stunnel.pem ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 [FIX] accept = 127.0.0.1:5679 connect = 216.52.236.112:5680 TIMEOUTconnect = 5 [FIXLIVE] accept = 127.0.0.1:5680 connect = 216.52.236.185:51581 TIMEOUTconnect = 5 Please not that stunnel came installed with an stunnel.pem file. I tried uncommenting the config line for the key. Also regenerated the key using openssh per instructions. I tried using absolute path to the cert file. Nothing makes any difference. Is this a defect in stunnel? Or am I doing something wrong?

2 1

Re: [stunnel-users] Log rollover
by Michael Curran 11 Jun '12

11 Jun '12

Windows our linux? Linux just add the log file location to the file that are part of rotate.d and thats solved daily. Sent from my Verizon Wireless 4GLTE smartphone. From : Brian Wilkins Subject : [stunnel-users] Log rollover I have noticed my stunnel log has reached 100MB on an unmanned system. Is there an option to cause the stunnel log to rollover and delete the old log file after a pre-defined period of time? If not, I can try adding it to log.c. Brian -----Original Message----- From: Brian Wilkins Sent: 6/11/2012 3:48:22 PM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] Log rollover I have noticed my stunnel log has reached 100MB on an unmanned system. Is there an option to cause the stunnel log to rollover and delete the old log file after a pre-defined period of time? If not, I can try adding it to log.c. Brian

2 1

Log rollover
by Brian Wilkins 11 Jun '12

11 Jun '12

I have noticed my stunnel log has reached 100MB on an unmanned system. Is there an option to cause the stunnel log to rollover and delete the old log file after a pre-defined period of time? If not, I can try adding it to log.c. Brian

1 0

Using stunnel with Brother MFC-8890
by Scott McKeown 08 Jun '12

08 Jun '12

Hi Rolando, Can you please give us a bit more detail. What have you tried doing? How is your network setup? Whats your current STunnel Configuration file settings? Hopefully with this information we should be able to assist. -- With Kind Regards. Scott McKeown Loadbalancer.org http://www.loadbalancer.org

1 0

Using stunnel with Brother MFC-8890
by Rolando Pineda 07 Jun '12

07 Jun '12

Hi, Someone can help me to use stunnel and set up my Brother MFC-8890 to send email through SSL using the stunnel? Thanks in advanced. -- Saludos, _____________ Rolando Pineda

1 0

stunnel - haproxy setup with protocol = proxy
by Scott McKeown 07 Jun '12

07 Jun '12

Hi Robert, I've been doing some work on both HAProxy and STunnel myself over the last month or so. Your actual configuration files both look fine but one thing that you possibly missed is that you will have needed to have build HAProxy with the TProxy flag enabled, and I'm going to guess that you have also written and applied the Firewall rules for the transparent proxy. I've attached a DRAFT pdf of the work that I have been doing, its a very basic how-to on setting up both STunnel and HAProxy in Transparent mode on a Centos 6.2 system. -- With Kind Regards. Scott McKeown Loadbalancer.org http://www.loadbalancer.org

2 4

stunnel - haproxy setup with protocol = proxy
by Robert Garcia 07 Jun '12

07 Jun '12

I am trying to setup stunnel with protocol = proxy through haproxy to my apache2 cluster. I have been using haproxy for a while, and wanted to try this before having to go to nginx, or some other proxy. My config works fine as is if I remove the "accept proxy" from the haproxy.cfg and the protocol=proxy from stunnel config, as soon as those are in, I get a 502 bad gateway. My haproxy.cfg: global log 127.0.0.1 local0 log 127.0.0.1 local1 debug #log loghost local0 info maxconn 50000 #chroot /usr/share/haproxy user haproxy group haproxy daemon #debug #quiet defaults log global mode http option httplog option dontlognull option forwardfor retries 3 option redispatch maxconn 50000 contimeout 5000 clitimeout 60000 srvtimeout 300000 stats uri /haproxy_xxxx stats realm Global\ statistics stats auth xxxxxx:xxxxxxx frontend dev-stg bind *:80 mode http timeout client 5m option forwardfor default_backend dev-www frontend dev-stg-ssl bind *:81 accept-proxy mode http option httpclose option forwardfor timeout client 5m default_backend dev-www backend dev-www mode http timeout connect 10s timeout server 600s balance roundrobin #begin_web_config server ws1 10.0.2.10 maxconn 1000 check port 80 #end_web_config stats uri /haproxy_xxxx stats realm Global\ statistics stats auth xxxxxx:xxxxxxx My stunnel config: ; ***************************************************************************** ; * Global Options * ; ***************************************************************************** ; A copy of some devices and system files is needed within the chroot jail ; Chroot conflicts with configuration file reload and many other features chroot = /var/lib/stunnel4/ ; Chroot jail can be escaped if setuid option is not used setuid = stunnel4 setgid = stunnel4 ; PID is created inside the chroot jail pid = /stunnel4.pid ; Debugging stuff (may useful for troubleshooting) debug = 7 output = /var/log/stunnel4/stunnel.log ; ***************************************************************************** ; * Service Defaults (may also be specified in individual service sections) * ; ***************************************************************************** ; Certificate/key is needed in server mode and optional in client mode cert = /usr/local/certs/server.crt key = /usr/local/certs/server.key ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; The following options provide additional security at some performance penalty ; Default ECDH/DH parameters are strong/conservative, so it is quite safe to ; comment out these lines in order to get a performance boost ;options = SINGLE_ECDH_USE ;options = SINGLE_DH_USE ; ***************************************************************************** ; * Service Definitions (remove all services for inetd mode) * ; ***************************************************************************** ; Example SSL server mode services ; Example SSL front-end to a web server [proxy] accept = 443 connect = 127.0.0.1:81 ; "TIMEOUTclose = 0" is a workaround for a design flaw in Microsoft SSL ; It does not use SSL close-notify alert designed to prevent truncation attacks TIMEOUTclose = 0 protocol = proxy ; vim:ft=dosini And here is the syslog for haproxy and stunner (ip address in log and cfgs are changed to protect the innocent ;-) ) Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193127680]: Service [proxy] accepted (FD=3) from 1.2.3.4:35045 Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193119488]: Service [proxy] started Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG5[1737:140557193119488]: Service [proxy] accepted connection from 1.2.3.4:35045 Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG6[1737:140557193119488]: connect_blocking: connecting 127.0.0.1:81 Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193119488]: connect_blocking: s_poll_wait 127.0.0.1:81: waiting 10 seconds Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG5[1737:140557193119488]: connect_blocking: connected 127.0.0.1:81 Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG5[1737:140557193119488]: Service [proxy] connected remote server from 127.0.0.1:49010 Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193119488]: Remote socket (FD=8) initialized Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG6[1737:140557193119488]: Server-mode proxy protocol negotiations started Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193119488]: -> PROXY TCP4 1.2.3.4 10.0.2.9 35045 443 Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG6[1737:140557193119488]: Server-mode proxy protocol negotiations succeeded Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG6[1737:140557193119488]: SSL accepted: new session negotiated Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG6[1737:140557193119488]: Negotiated TLSv1/SSLv3 ciphersuite: DHE-RSA-AES256-SHA (256-bit encryption) Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG6[1737:140557193119488]: Compression: null, expansion: null Jun 7 07:10:50 localhost haproxy[1710]: 1.2.3.4:35045 [07/Jun/2012:07:10:50.496] dev-stg-ssl dev-www/ws1 214/0/1/-1/216 502 754 - - PH-- 0/0/0/0/0 0/0 "GET / HTTP/1.1" Jun 7 07:10:50 localhost haproxy[1710]: 1.2.3.4:35045 [07/Jun/2012:07:10:50.496] dev-stg-ssl dev-www/ws1 214/0/1/-1/216 502 754 - - PH-- 0/0/0/0/0 0/0 "GET / HTTP/1.1" Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193119488]: Socket closed on read Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193119488]: Sending close_notify alert Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG6[1737:140557193119488]: SSL_shutdown successfully sent close_notify alert Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG3[1737:140557193119488]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG5[1737:140557193119488]: Connection closed: 204 byte(s) sent to SSL, 137 byte(s) sent to socket Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193119488]: Remote socket (FD=8) closed Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193119488]: Local socket (FD=3) closed Jun 7 07:10:50 ec2-204-236-129-168 stunnel: LOG7[1737:140557193119488]: Service [proxy] finished (0 left) 1.2.3.4 = my external ip I am testing with 10.0.2.9 = haproxy/stunnel server 10.0.2.10 = my apache server Any ideas greatly appreciated. -- Robert Garcia BigHead Technology 15520 Coutolenc Rd Magalia, Ca 95954 ph: 530.645.4040 x222 fax: 530.645.4040 rgarcia(a)bighead.net (mailto:[email protected]) - http://bighead.net/

1 0

Re: [stunnel-users] Outlook and stunnel
by James Devine 05 Jun '12

05 Jun '12

I'm using stunnel as a reverse proxy. I have an smtp server smtp1 and an stunnel server proxy1. Clients connect to and negotiate ssl on proxy1 which then connects to smtp1 via a plaintext connection. stunnel does not reside on the client. If I connect the client directly to smtp1 via ssl it works fine. On Tue, Jun 5, 2012 at 12:20 PM, Pierre DELAAGE <delaage.pierre(a)free.fr>wrote: > Hmmm if you are using stunnel on client side (as suggested by your > correction) it is that YOU DO NOT WANT TO USE SSL OPTION in OUTLOOK. > > because stunnel will act as an "almost transparent' ssl tunnel. > > So in outlook : uncheck ssl option and give "localhost" as your smtp > server. > > and adapt local port according to your stunnel conf. > > Apart from that : I use stunnel on the server ONLY, with self signed > certificate coming from openssl, > and outlook configured as ssl client is working. > SSLversion = all is always GOOD > > works with stunnel 4.20 on linux mandriva 2008, outlook 2007 > > Pierre > > > > Le 05/06/2012 20:08, James Devine a écrit : > > > On Tue, Jun 5, 2012 at 10:52 AM, James Devine <fxmulder(a)gmail.com> wrote: > >> I am trying to setup stunnel to ssl proxy mail to an smtp server and this >> seems to work fine for thunderbird but when I try using outlook 2010 to >> connect via ssl I get the error: >> >> Send test e-mail message: Your server does not support the connection >> encryption type you have specified. Try changing the encryption method. >> >> For sslVersion I have the option of SSLv3 and TLSv1, all and SSLv2 do >> not seem to work so I'm not sure if that is the problem >> >> Anyone else run in to this or know what I might do to resolve it? >> > > I can get it to work if I setup ssl on the end server directly and bypass > stunnel > > > _______________________________________________ > stunnel-users mailing [email protected]://stunnel.mirt.net/mailman/listinfo/stunnel-users > > >

1 0

Outlook and stunnel
by James Devine 05 Jun '12

05 Jun '12

I am trying to setup stunnel to ssl proxy mail to an smtp server and this seems to work fine for thunderbird but when I try using outlook 2010 to connect via ssl I get the error: Send test e-mail message: Your server does not support the connection encryption type you have specified. Try changing the encryption method. For sslVersion I have the option of SSLv3 and TLSv1, all and SSLv2 do not seem to work so I'm not sure if that is the problem Anyone else run in to this or know what I might do to resolve it?

1 1

stunnel 4.53 released
by Michal Trojnara 03 Jun '12

03 Jun '12

Dear Users, I have released version 4.53 of stunnel. This is major a bugfix release. Upgrade is highly recommended. The ChangeLog entry: Version 4.53, 2012.03.19, urgency: MEDIUM: * New features - Added client-mode "sni" option to directly control the value of TLS Server Name Indication (RFC 3546) extension. - Added support for IP_FREEBIND socket option with a pached Linux kernel. - Glibc-specific dynamic allocation tuning was applied to help unused memory deallocation. - Non-blocking OCSP implementation. * Bugfixes - Compilation fixes for old versions of OpenSSL (tested against 0.9.6). - Usage of uninitialized variables fixed in exec+connect services. - Occasional logging subsystem crash with exec+connect services. - OpenBSD compilation fix (thx to Michele Orru'). - Session id context initialized with session name rather than a constant. - Fixed handling of a rare inetd mode use case, where either stdin or stdout is a socket, but not both of them at the same time. - Fixed missing OPENSSL_Applink http://www.openssl.org/support/faq.html#PROG2 - Fixed crash on termination with FORK threading model. - Fixed dead canary after configuration reload with open connections. - Fixed missing file descriptors passed to local mode processes. - Fixed required jmp_buf alignment on Itanium platform. - Removed creating /dev/zero in the chroot jail on Solaris platform. - Fixed detection of WSAECONNREFUSED Winsock error. - Missing Microsoft.VC90.CRT.manifest added to Windows installer. Home page: http://www.stunnel.org/ Download: ftp://ftp.stunnel.org/stunnel/ SHA-256 hash for stunnel-4.53.tar.gz: 3e640aa4c96861d10addba758b66e99e7c5aec8697764f2a59ca2268901b8e57 Best regards, Mike

3 2

Re: [stunnel-users] BEAST Attack
by Scott McKeown 31 May '12

31 May '12

Hi Mike, Thank you for your input. I'll rebuild today and retest. Our company openly supports Open Source projects that we use and we will continue to do so. However, since we are still in a R&D position with STunnel at the moment I thought it would be better to continue to use the users group. I'll post again once I've rebuilt and tested, which might not be until the end of next week now as we have an nice extended weekend in the UK for the Golden Jubilee which is nice. ~Yours, Scott -- With Kind Regards. Scott McKeown Loadbalancer.org http://www.loadbalancer.org

1 0

Re: [stunnel-users] BEAST Attack
by Scott McKeown 30 May '12

30 May '12

Hi Michal, Thanks for following this up. I'm using the latest build of STunnel v4.53 as shown below (I check the site once a week just to make sure too) # stunnel -version stunnel 4.53 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.0-fips 29 Mar 2010 Threading:PTHREAD SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:POLL+IPv6 Global options: debug = daemon.notice pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options: ciphers = FIPS (with "fips = yes") ciphers = ALL:!SSLv2:!aNULL:!EXP:!LOW:-MEDIUM:RC4:+HIGH (with "fips = no") session = 300 seconds sslVersion = TLSv1 (with "fips = yes") sslVersion = TLSv1 for client, all for server (with "fips = no") stack = 65536 bytes TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none I've also included a copy of my stunnel.cfg file below: # more /etc/stunnel/stunnel.cfg # STunnel configuration file generated by loadbalancer.org appliance setgid = nobody pid = /stunnel.pid debug = 0 [S1] accept = 192.168.82.182:443 connect = 192.168.82.181:81 cert = /etc/loadbalancer.org/certs/S1.pem ciphers = RC4:HIGH:!MD5:!aNULL options = NO_SSLv2 protocol = proxy I'm looking to include the STunnel Product within our Loadbalancer Appliance in our next upcoming release but with everyone now using the SSL checker that I mentioned in one of my last e-Mails more customers are becoming concerned about MITM Attacks etc. so I would really like to get this solved before I move forward with the project. Oh, I guess I should also mention that this is running on a Centos 6.2 box. ~Yours, Scott

2 1

BEAST Attack
by Scott McKeown 29 May '12

29 May '12

Hi All, Has anyone looked at the current issue with the BEAST Attack. I'm looking at https://www.ssllabs.com/ssltest/index.html which can be used for testing SSL Certificates I also use Pound Proxy which I have now patched and this has removed the threat. However, I don't seem to be able to get the same result from a STunnel installation. If anyone can give some advice that would be great. ~Yours, Scott

3 5

limit to number of services
by Terren Suydam 25 May '12

25 May '12

Hi there, I seem to be hitting a limit on the number of stunnel services I can run simultaneously. According to the log, they appear to set up without any issues, but after 64 services they don't pass traffic. Is this something stunnel itself limits, or is it an OS limitation? I am running the latest windows build on Windows Server 2008. Either way, is there an easy way to increase the number of services? Thanks, Terren

1 0

Stunnel quitted unexpectedly repeated for a number of times
by Im Q 24 May '12

24 May '12

Hi all, We have encountered a strange situation that stunnel We have the following setup in our production servers. > Windows [ ... -> Apache -> Stunnel 4.50 ] --> AIX [Stunnel 4.50 -> JBoss] * As we had experienced the Stunnel in AIX died in a random time during testing stage, we added a cron job to start Stunnel in case stunnel disappeared. Recently, in our production servers, the stunnel disappeared and being started by corn repeatedly during a short period of time in the same day. We so far encounter similar problem for 2 times. Below are the restart time of the most recent incident. > 09:22:00,09:38:00,09:45:00, > 10:24:00,10:34:00,10:50:00, > 11:06:00,11:16:01,11:17:00,11:19:00,11:22:00,11:23:00,11:29:01,11:32:00,11:34:01,11:35:00,11:39:01 We found that in the logs, they always ended with the following: > 2012.05.23 11:16:03 LOG7[12517524:1]: Dispatching signals from the signal pipe > ... > 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD > ...(same message repeatly for serveral time) > 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD Here is the active options in config file: [Windows Side] > debug = 7 > output = D:\app-logs\stunnel\stunnel.log > verify = 0 > options = NO_SSLv2 > client = yes > taskbar = no > [prdweb01_out_app01] > accept = PRDWEB01:18009 > connect = PRDAPP01:18010 > [prdweb01_out_app02] > accept = PRDWEB01:18019 > connect = PRDAPP02:18010 [AIX Side] > pid = /opt/stunnel/4.50/prd/stunnel0-app/stunnel.pid > debug = 7 > output = /opt/stunnel/4.50/prd/stunnel0-app/log/stunnel.log > cert = /opt/stunnel/4.50/prd/stunnel0-app/PRD.certnew-b64.cer > key = /opt/stunnel/4.50/prd/stunnel0-app/PRD.private.key > options = NO_SSLv2 > [prdweb_in] > accept = PRDAPP01:18010 > connect = PRDAPP01:8009 Start up command > nohup stunnel /opt/stunnel/4.50/prd/stunnel0-app/stunnel-server.conf Attached at the end is the one of the log during the incident. Is there any suggestion on how to find out the cause of the problem? What are the possible causes that would make it disappeared after those processing of SIGCHLD signal? What may caused the signal dispatching other than killing them manually for shutdown? Thank you very much! Best Regards, Jacky -- LOG FILE CONTENT BELOW -- 2012.05.23 11:16:01 LOG7[11862064:1]: Clients allowed=31999 2012.05.23 11:16:01 LOG5[11862064:1]: stunnel 4.50 on powerpc-ibm-aix6.1.0.0 platform 2012.05.23 11:16:01 LOG5[11862064:1]: Compiled/running with OpenSSL 0.9.8m 25 Feb 2010 2012.05.23 11:16:01 LOG5[11862064:1]: Threading:PTHREAD SSL:ENGINE Auth:none Sockets:POLL,IPv6 2012.05.23 11:16:01 LOG5[11862064:1]: Reading configuration from file /opt/stunnel/4.50/prd/stunnel0-app/stunnel-server.conf 2012.05.23 11:16:01 LOG6[11862064:1]: Unable to retrieve any random data from /home/appadmin/.rnd 2012.05.23 11:16:01 LOG7[11862064:1]: Wrote 0 new random bytes to /home/appadmin/.rnd 2012.05.23 11:16:01 LOG7[11862064:1]: PRNG seeded successfully 2012.05.23 11:16:01 LOG6[11862064:1]: Initializing SSL context for service prdweb_in 2012.05.23 11:16:01 LOG4[11862064:1]: Insecure file permissions on /opt/stunnel/4.50/prd/stunnel0-app/PRD.private.key 2012.05.23 11:16:01 LOG7[11862064:1]: Certificate: /opt/stunnel/4.50/prd/stunnel0-app/PRD.certnew-b64.cer 2012.05.23 11:16:01 LOG7[11862064:1]: Certificate loaded 2012.05.23 11:16:01 LOG7[11862064:1]: Key file: /opt/stunnel/4.50/prd/stunnel0-app/PRD.private.key 2012.05.23 11:16:01 LOG7[11862064:1]: Private key loaded 2012.05.23 11:16:01 LOG7[11862064:1]: Could not load DH parameters from /opt/stunnel/4.50/prd/stunnel0-app/PRD.certnew-b64.cer 2012.05.23 11:16:01 LOG7[11862064:1]: Using hardcoded DH parameters 2012.05.23 11:16:01 LOG7[11862064:1]: DH initialized with 2048-bit key 2012.05.23 11:16:01 LOG7[11862064:1]: SSL options set: 0x01000004 2012.05.23 11:16:01 LOG6[11862064:1]: SSL context initialized 2012.05.23 11:16:01 LOG5[11862064:1]: Configuration successful 2012.05.23 11:16:01 LOG7[11862064:1]: Option SO_REUSEADDR set on accept socket 2012.05.23 11:16:01 LOG7[11862064:1]: Service prdweb_in bound to 10.18.7.71:18010 2012.05.23 11:16:01 LOG7[11862064:1]: Service prdweb_in opened FD=7 2012.05.23 11:16:01 LOG7[12517524:1]: Created pid file /opt/stunnel/4.50/prd/stunnel0-app/stunnel.pid 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=0 from 10.18.7.11:61657 2012.05.23 11:16:01 LOG7[12517524:258]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:258]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:258]: Service prdweb_in accepted connection from 10.18.7.11:61657 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=1 from 10.18.7.11:61685 2012.05.23 11:16:01 LOG7[12517524:515]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:515]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:515]: Service prdweb_in accepted connection from 10.18.7.11:61685 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=2 from 10.18.7.11:61667 2012.05.23 11:16:01 LOG7[12517524:772]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:772]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:772]: Service prdweb_in accepted connection from 10.18.7.11:61667 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=9 from 10.18.7.11:61659 2012.05.23 11:16:01 LOG7[12517524:1029]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:1029]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:1029]: Service prdweb_in accepted connection from 10.18.7.11:61659 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=10 from 10.18.7.12:64270 2012.05.23 11:16:01 LOG7[12517524:1286]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:1286]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:1286]: Service prdweb_in accepted connection from 10.18.7.12:64270 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=11 from 10.18.7.11:61669 2012.05.23 11:16:01 LOG7[12517524:1543]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:1543]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:1543]: Service prdweb_in accepted connection from 10.18.7.11:61669 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=12 from 10.18.7.12:64268 2012.05.23 11:16:01 LOG7[12517524:1800]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:1800]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:1800]: Service prdweb_in accepted connection from 10.18.7.12:64268 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=13 from 10.18.7.11:61671 2012.05.23 11:16:01 LOG7[12517524:2057]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:2057]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:2057]: Service prdweb_in accepted connection from 10.18.7.11:61671 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=14 from 10.18.7.11:61673 2012.05.23 11:16:01 LOG7[12517524:2314]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:2314]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:2314]: Service prdweb_in accepted connection from 10.18.7.11:61673 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=15 from 10.18.7.11:61677 2012.05.23 11:16:01 LOG7[12517524:2571]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:2571]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:2571]: Service prdweb_in accepted connection from 10.18.7.11:61677 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=16 from 10.18.7.11:61676 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=18 from 10.18.7.12:64272 2012.05.23 11:16:01 LOG7[12517524:3085]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:3085]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:3085]: Service prdweb_in accepted connection from 10.18.7.12:64272 2012.05.23 11:16:01 LOG7[12517524:2828]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:2828]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:2828]: Service prdweb_in accepted connection from 10.18.7.11:61676 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=17 from 10.18.7.11:61661 2012.05.23 11:16:01 LOG7[12517524:3342]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:3342]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:3342]: Service prdweb_in accepted connection from 10.18.7.11:61661 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=19 from 10.18.7.11:61687 2012.05.23 11:16:01 LOG7[12517524:3599]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:3599]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:3599]: Service prdweb_in accepted connection from 10.18.7.11:61687 2012.05.23 11:16:01 LOG6[12517524:1286]: SSL accepted: new session negotiated 2012.05.23 11:16:01 LOG6[12517524:1286]: Negotiated ciphers: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 2012.05.23 11:16:01 LOG6[12517524:1286]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:01 LOG5[12517524:1286]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:01 LOG5[12517524:1286]: Service prdweb_in connected remote server from 10.18.7.71:56505 2012.05.23 11:16:01 LOG7[12517524:1286]: Remote FD=20 initialized 2012.05.23 11:16:01 LOG7[12517524:1286]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=21 from 10.18.7.11:61663 2012.05.23 11:16:01 LOG7[12517524:3856]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:3856]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:3856]: Service prdweb_in accepted connection from 10.18.7.11:61663 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=22 from 10.18.7.11:61665 2012.05.23 11:16:01 LOG7[12517524:4113]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=23 from 10.18.7.12:64274 2012.05.23 11:16:01 LOG7[12517524:4370]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:4113]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG7[12517524:4370]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:4370]: Service prdweb_in accepted connection from 10.18.7.12:64274 2012.05.23 11:16:01 LOG5[12517524:4113]: Service prdweb_in accepted connection from 10.18.7.11:61665 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=24 from 10.18.7.11:61681 2012.05.23 11:16:01 LOG7[12517524:4627]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:4627]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:4627]: Service prdweb_in accepted connection from 10.18.7.11:61681 2012.05.23 11:16:01 LOG6[12517524:1800]: SSL accepted: new session negotiated 2012.05.23 11:16:01 LOG6[12517524:1800]: Negotiated ciphers: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 2012.05.23 11:16:01 LOG6[12517524:1800]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:01 LOG5[12517524:1800]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:01 LOG5[12517524:1800]: Service prdweb_in connected remote server from 10.18.7.71:35492 2012.05.23 11:16:01 LOG7[12517524:1800]: Remote FD=25 initialized 2012.05.23 11:16:01 LOG7[12517524:1800]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=26 from 10.18.7.11:61689 2012.05.23 11:16:01 LOG7[12517524:4884]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:4884]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:4884]: Service prdweb_in accepted connection from 10.18.7.11:61689 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=27 from 10.18.7.12:64276 2012.05.23 11:16:01 LOG7[12517524:5141]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:5141]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:5141]: Service prdweb_in accepted connection from 10.18.7.12:64276 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=28 from 10.18.7.12:64278 2012.05.23 11:16:01 LOG7[12517524:5398]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:5398]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:5398]: Service prdweb_in accepted connection from 10.18.7.12:64278 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=29 from 10.18.7.12:64280 2012.05.23 11:16:01 LOG7[12517524:5655]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:5655]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:5655]: Service prdweb_in accepted connection from 10.18.7.12:64280 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=30 from 10.18.7.11:61680 2012.05.23 11:16:01 LOG7[12517524:5912]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:5912]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:5912]: Service prdweb_in accepted connection from 10.18.7.11:61680 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=31 from 10.18.7.12:64282 2012.05.23 11:16:01 LOG7[12517524:6169]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:6169]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:6169]: Service prdweb_in accepted connection from 10.18.7.12:64282 2012.05.23 11:16:01 LOG6[12517524:3085]: SSL accepted: new session negotiated 2012.05.23 11:16:01 LOG6[12517524:3085]: Negotiated ciphers: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 2012.05.23 11:16:01 LOG6[12517524:3085]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:01 LOG5[12517524:3085]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:01 LOG5[12517524:3085]: Service prdweb_in connected remote server from 10.18.7.71:52373 2012.05.23 11:16:01 LOG7[12517524:3085]: Remote FD=32 initialized 2012.05.23 11:16:01 LOG7[12517524:3085]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=33 from 10.18.7.11:61683 2012.05.23 11:16:01 LOG7[12517524:6426]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:6426]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:6426]: Service prdweb_in accepted connection from 10.18.7.11:61683 2012.05.23 11:16:01 LOG7[12517524:1]: Service prdweb_in accepted FD=34 from 10.18.7.12:64284 2012.05.23 11:16:01 LOG7[12517524:6683]: Service prdweb_in started 2012.05.23 11:16:01 LOG7[12517524:6683]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:01 LOG5[12517524:6683]: Service prdweb_in accepted connection from 10.18.7.12:64284 2012.05.23 11:16:01 LOG6[12517524:258]: SSL accepted: new session negotiated 2012.05.23 11:16:01 LOG6[12517524:258]: Negotiated ciphers: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 2012.05.23 11:16:01 LOG6[12517524:258]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:01 LOG5[12517524:258]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:01 LOG5[12517524:258]: Service prdweb_in connected remote server from 10.18.7.71:33167 2012.05.23 11:16:01 LOG7[12517524:258]: Remote FD=35 initialized 2012.05.23 11:16:01 LOG7[12517524:258]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:02 LOG6[12517524:4370]: SSL accepted: new session negotiated 2012.05.23 11:16:02 LOG6[12517524:4370]: Negotiated ciphers: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 2012.05.23 11:16:02 LOG6[12517524:4370]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:4370]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:4370]: Service prdweb_in connected remote server from 10.18.7.71:53609 2012.05.23 11:16:02 LOG7[12517524:4370]: Remote FD=36 initialized 2012.05.23 11:16:02 LOG7[12517524:4370]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:02 LOG6[12517524:5398]: SSL accepted: new session negotiated 2012.05.23 11:16:02 LOG6[12517524:5398]: Negotiated ciphers: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 2012.05.23 11:16:02 LOG6[12517524:5398]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:5398]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:5398]: Service prdweb_in connected remote server from 10.18.7.71:40822 2012.05.23 11:16:02 LOG7[12517524:5398]: Remote FD=37 initialized 2012.05.23 11:16:02 LOG7[12517524:5398]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:02 LOG7[12517524:1]: Service prdweb_in accepted FD=38 from 10.18.7.11:61691 2012.05.23 11:16:02 LOG7[12517524:6940]: Service prdweb_in started 2012.05.23 11:16:02 LOG7[12517524:6940]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:02 LOG5[12517524:6940]: Service prdweb_in accepted connection from 10.18.7.11:61691 2012.05.23 11:16:02 LOG6[12517524:5655]: SSL accepted: new session negotiated 2012.05.23 11:16:02 LOG6[12517524:5655]: Negotiated ciphers: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 2012.05.23 11:16:02 LOG6[12517524:5655]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:5655]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:5655]: Service prdweb_in connected remote server from 10.18.7.71:53430 2012.05.23 11:16:02 LOG7[12517524:5655]: Remote FD=39 initialized 2012.05.23 11:16:02 LOG7[12517524:5655]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:02 LOG7[12517524:1]: Service prdweb_in accepted FD=40 from 10.18.7.12:64286 2012.05.23 11:16:02 LOG7[12517524:7197]: Service prdweb_in started 2012.05.23 11:16:02 LOG7[12517524:7197]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:02 LOG5[12517524:7197]: Service prdweb_in accepted connection from 10.18.7.12:64286 2012.05.23 11:16:02 LOG7[12517524:5655]: SSL closed on SSL_read 2012.05.23 11:16:02 LOG7[12517524:5655]: Sending socket write shutdown 2012.05.23 11:16:02 LOG7[12517524:1]: Service prdweb_in accepted FD=41 from 10.18.7.11:61693 2012.05.23 11:16:02 LOG7[12517524:7454]: Service prdweb_in started 2012.05.23 11:16:02 LOG7[12517524:7454]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:02 LOG5[12517524:7454]: Service prdweb_in accepted connection from 10.18.7.11:61693 2012.05.23 11:16:02 LOG7[12517524:1]: Service prdweb_in accepted FD=42 from 10.18.7.11:61695 2012.05.23 11:16:02 LOG7[12517524:7711]: Service prdweb_in started 2012.05.23 11:16:02 LOG7[12517524:7711]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:02 LOG5[12517524:7711]: Service prdweb_in accepted connection from 10.18.7.11:61695 2012.05.23 11:16:02 LOG6[12517524:515]: SSL accepted: new session negotiated 2012.05.23 11:16:02 LOG6[12517524:515]: Negotiated ciphers: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 2012.05.23 11:16:02 LOG6[12517524:515]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:515]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:515]: Service prdweb_in connected remote server from 10.18.7.71:50558 2012.05.23 11:16:02 LOG7[12517524:515]: Remote FD=43 initialized 2012.05.23 11:16:02 LOG7[12517524:515]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:02 LOG6[12517524:1029]: SSL accepted: new session negotiated 2012.05.23 11:16:02 LOG6[12517524:1029]: Negotiated ciphers: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 2012.05.23 11:16:02 LOG6[12517524:1029]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:1029]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:1029]: Service prdweb_in connected remote server from 10.18.7.71:57414 2012.05.23 11:16:02 LOG7[12517524:1029]: Remote FD=44 initialized 2012.05.23 11:16:02 LOG7[12517524:1029]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:02 LOG7[12517524:1]: Service prdweb_in accepted FD=45 from 10.18.7.12:64288 2012.05.23 11:16:02 LOG7[12517524:7968]: Service prdweb_in started 2012.05.23 11:16:02 LOG7[12517524:7968]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:02 LOG5[12517524:7968]: Service prdweb_in accepted connection from 10.18.7.12:64288 2012.05.23 11:16:02 LOG7[12517524:1]: Service prdweb_in accepted FD=46 from 10.18.7.12:64290 2012.05.23 11:16:02 LOG7[12517524:8225]: Service prdweb_in started 2012.05.23 11:16:02 LOG7[12517524:8225]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:02 LOG5[12517524:8225]: Service prdweb_in accepted connection from 10.18.7.12:64290 2012.05.23 11:16:02 LOG6[12517524:772]: SSL accepted: new session negotiated 2012.05.23 11:16:02 LOG6[12517524:772]: Negotiated ciphers: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 2012.05.23 11:16:02 LOG6[12517524:772]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:772]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:772]: Service prdweb_in connected remote server from 10.18.7.71:33957 2012.05.23 11:16:02 LOG7[12517524:772]: Remote FD=47 initialized 2012.05.23 11:16:02 LOG7[12517524:772]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:02 LOG6[12517524:8225]: SSL accepted: previous session reused 2012.05.23 11:16:02 LOG6[12517524:8225]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:8225]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:02 LOG6[12517524:7968]: SSL accepted: previous session reused 2012.05.23 11:16:02 LOG5[12517524:8225]: Service prdweb_in connected remote server from 10.18.7.71:36648 2012.05.23 11:16:02 LOG6[12517524:7968]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:02 LOG7[12517524:8225]: Remote FD=48 initialized 2012.05.23 11:16:02 LOG7[12517524:8225]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:02 LOG5[12517524:7968]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:7968]: Service prdweb_in connected remote server from 10.18.7.71:38529 2012.05.23 11:16:02 LOG7[12517524:7968]: Remote FD=49 initialized 2012.05.23 11:16:02 LOG7[12517524:7968]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:02 LOG7[12517524:1]: Service prdweb_in accepted FD=50 from 10.18.7.11:61697 2012.05.23 11:16:02 LOG7[12517524:8482]: Service prdweb_in started 2012.05.23 11:16:02 LOG7[12517524:8482]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:02 LOG5[12517524:8482]: Service prdweb_in accepted connection from 10.18.7.11:61697 2012.05.23 11:16:02 LOG6[12517524:3599]: SSL accepted: new session negotiated 2012.05.23 11:16:02 LOG6[12517524:3599]: Negotiated ciphers: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 2012.05.23 11:16:02 LOG6[12517524:3599]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:3599]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:3599]: Service prdweb_in connected remote server from 10.18.7.71:65426 2012.05.23 11:16:02 LOG7[12517524:3599]: Remote FD=51 initialized 2012.05.23 11:16:02 LOG7[12517524:3599]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:02 LOG6[12517524:3856]: SSL accepted: new session negotiated 2012.05.23 11:16:02 LOG6[12517524:3856]: Negotiated ciphers: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 2012.05.23 11:16:02 LOG6[12517524:3856]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:3856]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:3856]: Service prdweb_in connected remote server from 10.18.7.71:51278 2012.05.23 11:16:02 LOG7[12517524:3856]: Remote FD=52 initialized 2012.05.23 11:16:02 LOG7[12517524:3856]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:02 LOG7[12517524:3856]: SSL closed on SSL_read 2012.05.23 11:16:02 LOG7[12517524:3856]: Sending socket write shutdown 2012.05.23 11:16:02 LOG7[12517524:4370]: SSL closed on SSL_read 2012.05.23 11:16:02 LOG7[12517524:4370]: Sending socket write shutdown 2012.05.23 11:16:02 LOG7[12517524:1]: Service prdweb_in accepted FD=53 from 10.18.7.11:61699 2012.05.23 11:16:02 LOG7[12517524:8739]: Service prdweb_in started 2012.05.23 11:16:02 LOG7[12517524:8739]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:02 LOG5[12517524:8739]: Service prdweb_in accepted connection from 10.18.7.11:61699 2012.05.23 11:16:02 LOG6[12517524:4113]: SSL accepted: new session negotiated 2012.05.23 11:16:02 LOG6[12517524:4113]: Negotiated ciphers: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 2012.05.23 11:16:02 LOG6[12517524:4113]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:4113]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:4113]: Service prdweb_in connected remote server from 10.18.7.71:33279 2012.05.23 11:16:02 LOG7[12517524:4113]: Remote FD=54 initialized 2012.05.23 11:16:02 LOG7[12517524:4113]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:02 LOG6[12517524:8482]: SSL accepted: previous session reused 2012.05.23 11:16:02 LOG7[12517524:4113]: SSL closed on SSL_read 2012.05.23 11:16:02 LOG7[12517524:4113]: Sending socket write shutdown 2012.05.23 11:16:02 LOG6[12517524:8482]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:8482]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:02 LOG5[12517524:8482]: Service prdweb_in connected remote server from 10.18.7.71:50727 2012.05.23 11:16:02 LOG7[12517524:8482]: Remote FD=55 initialized 2012.05.23 11:16:02 LOG7[12517524:8482]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:02 LOG7[12517524:1]: Service prdweb_in accepted FD=56 from 10.18.7.11:61701 2012.05.23 11:16:02 LOG7[12517524:8996]: Service prdweb_in started 2012.05.23 11:16:02 LOG7[12517524:8996]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:02 LOG5[12517524:8996]: Service prdweb_in accepted connection from 10.18.7.11:61701 2012.05.23 11:16:02 LOG7[12517524:1]: Service prdweb_in accepted FD=57 from 10.18.7.11:61703 2012.05.23 11:16:02 LOG7[12517524:9253]: Service prdweb_in started 2012.05.23 11:16:02 LOG7[12517524:9253]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:02 LOG5[12517524:9253]: Service prdweb_in accepted connection from 10.18.7.11:61703 2012.05.23 11:16:02 LOG7[12517524:1]: Service prdweb_in accepted FD=58 from 10.18.7.11:61705 2012.05.23 11:16:02 LOG7[12517524:1]: Service prdweb_in accepted FD=59 from 10.18.7.11:61707 2012.05.23 11:16:02 LOG7[12517524:9510]: Service prdweb_in started 2012.05.23 11:16:02 LOG7[12517524:9510]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:02 LOG5[12517524:9510]: Service prdweb_in accepted connection from 10.18.7.11:61705 2012.05.23 11:16:02 LOG7[12517524:9767]: Service prdweb_in started 2012.05.23 11:16:02 LOG7[12517524:9767]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:02 LOG5[12517524:9767]: Service prdweb_in accepted connection from 10.18.7.11:61707 2012.05.23 11:16:02 LOG7[12517524:1]: Service prdweb_in accepted FD=60 from 10.18.7.11:61709 2012.05.23 11:16:02 LOG7[12517524:10024]: Service prdweb_in started 2012.05.23 11:16:02 LOG7[12517524:10024]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:02 LOG5[12517524:10024]: Service prdweb_in accepted connection from 10.18.7.11:61709 2012.05.23 11:16:02 LOG7[12517524:1]: Service prdweb_in accepted FD=61 from 10.18.7.12:64292 2012.05.23 11:16:02 LOG7[12517524:10281]: Service prdweb_in started 2012.05.23 11:16:02 LOG7[12517524:10281]: Option TCP_NODELAY set on local socket 2012.05.23 11:16:02 LOG5[12517524:10281]: Service prdweb_in accepted connection from 10.18.7.12:64292 2012.05.23 11:16:03 LOG6[12517524:5912]: SSL accepted: new session negotiated 2012.05.23 11:16:03 LOG6[12517524:5912]: Negotiated ciphers: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 2012.05.23 11:16:03 LOG6[12517524:5912]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:5912]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:5912]: Service prdweb_in connected remote server from 10.18.7.71:59860 2012.05.23 11:16:03 LOG7[12517524:5912]: Remote FD=62 initialized 2012.05.23 11:16:03 LOG7[12517524:5912]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:03 LOG6[12517524:8739]: SSL accepted: previous session reused 2012.05.23 11:16:03 LOG6[12517524:8739]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:8739]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:8739]: Service prdweb_in connected remote server from 10.18.7.71:33186 2012.05.23 11:16:03 LOG7[12517524:8739]: Remote FD=63 initialized 2012.05.23 11:16:03 LOG7[12517524:8739]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:03 LOG6[12517524:8996]: SSL accepted: previous session reused 2012.05.23 11:16:03 LOG6[12517524:8996]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:8996]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:8996]: Service prdweb_in connected remote server from 10.18.7.71:46952 2012.05.23 11:16:03 LOG7[12517524:8996]: Remote FD=64 initialized 2012.05.23 11:16:03 LOG7[12517524:8996]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:03 LOG6[12517524:9510]: SSL accepted: previous session reused 2012.05.23 11:16:03 LOG6[12517524:9510]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:9510]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:9510]: Service prdweb_in connected remote server from 10.18.7.71:48237 2012.05.23 11:16:03 LOG7[12517524:9510]: Remote FD=65 initialized 2012.05.23 11:16:03 LOG7[12517524:9510]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:03 LOG6[12517524:9253]: SSL accepted: previous session reused 2012.05.23 11:16:03 LOG6[12517524:9253]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:9253]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:9253]: Service prdweb_in connected remote server from 10.18.7.71:54984 2012.05.23 11:16:03 LOG7[12517524:9253]: Remote FD=66 initialized 2012.05.23 11:16:03 LOG7[12517524:9253]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:03 LOG6[12517524:9767]: SSL accepted: previous session reused 2012.05.23 11:16:03 LOG6[12517524:9767]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:9767]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:9767]: Service prdweb_in connected remote server from 10.18.7.71:33305 2012.05.23 11:16:03 LOG7[12517524:9767]: Remote FD=67 initialized 2012.05.23 11:16:03 LOG7[12517524:9767]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:03 LOG6[12517524:10024]: SSL accepted: previous session reused 2012.05.23 11:16:03 LOG6[12517524:10024]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:10024]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:10024]: Service prdweb_in connected remote server from 10.18.7.71:48123 2012.05.23 11:16:03 LOG6[12517524:7197]: SSL accepted: previous session reused 2012.05.23 11:16:03 LOG6[12517524:7197]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:7197]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:7197]: Service prdweb_in connected remote server from 10.18.7.71:38228 2012.05.23 11:16:03 LOG7[12517524:7197]: Remote FD=69 initialized 2012.05.23 11:16:03 LOG7[12517524:7197]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:03 LOG6[12517524:6683]: SSL accepted: previous session reused 2012.05.23 11:16:03 LOG6[12517524:6683]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:6683]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:6683]: Service prdweb_in connected remote server from 10.18.7.71:51522 2012.05.23 11:16:03 LOG7[12517524:6683]: Remote FD=70 initialized 2012.05.23 11:16:03 LOG7[12517524:6683]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:03 LOG6[12517524:10281]: SSL accepted: previous session reused 2012.05.23 11:16:03 LOG6[12517524:10281]: connect_blocking: connecting 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:10281]: connect_blocking: connected 10.18.7.71:8009 2012.05.23 11:16:03 LOG5[12517524:10281]: Service prdweb_in connected remote server from 10.18.7.71:51109 2012.05.23 11:16:03 LOG7[12517524:10281]: Remote FD=71 initialized 2012.05.23 11:16:03 LOG7[12517524:10281]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:03 LOG7[12517524:10024]: Remote FD=68 initialized 2012.05.23 11:16:03 LOG7[12517524:1]: Dispatching signals from the signal pipe 2012.05.23 11:16:03 LOG7[12517524:10024]: Option TCP_NODELAY set on remote socket 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD 2012.05.23 11:16:03 LOG7[12517524:1]: Processing SIGCHLD

1 0

Re: [stunnel-users] Stunnel not working
by Ludolf Holzheid 21 May '12

21 May '12

On Mon, 2012-05-21 18:09:35 +1000, Peter Connor wrote: > > Hi > I tried to reload stunnel.conf but I received error message says "Stunnel server is down due to error. You need to exit and correct the problem. Click OK to see the error log window". So I looked in error log window, it says: > "Server is downReading configuration from file stunnel.confFIPS mode is enabledCompression not enabledSnagged 64 random bytes from C:/.rndWrote 1024 new random bytes to C:/.rndPRNG seeded successfullyLine 66: "connect secure.giganews.com:563": No '=' found > Server is down" > My operating system windows home XP. Any ideas how to fix this problem. Please help. Thanks > Peter Peter, I don't know why you are asking me and not the stunnel users list. Anyway, it seems to be what the error log says: Line 66 of your stunnel.conf is lacking an equal sign. HTH, Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

First message flows through second one does not
by George Cardenas 19 May '12

19 May '12

I been chasing my tail a few days now reading through every post and searching in the internet how to work around this issue. The first message will flow though but any other messages after that wont. The log doesn't tell me anything besides that the first attempt sent more bytes than the second attempt. Can someone see anything else I might have overlooked? 2012.05.18 12:07:14 LOG7[2236:3940]: Service [SMTP Outgoing] accepted (FD=360) from 127.0.0.1:1638 2012.05.18 12:07:14 LOG7[2236:3940]: Creating a new thread 2012.05.18 12:07:14 LOG7[2236:3940]: New thread created 2012.05.18 12:07:14 LOG7[2236:580]: Service [SMTP Outgoing] started 2012.05.18 12:07:14 LOG5[2236:580]: Service [SMTP Outgoing] accepted connection from 127.0.0.1:1638 2012.05.18 12:07:14 LOG6[2236:580]: connect_blocking: connecting 157.56.234.134:587 2012.05.18 12:07:14 LOG7[2236:580]: connect_blocking: s_poll_wait 157.56.234.134:587: waiting 10 seconds 2012.05.18 12:07:14 LOG5[2236:580]: connect_blocking: connected 157.56.234.134:587 2012.05.18 12:07:14 LOG5[2236:580]: Service [SMTP Outgoing] connected remote server from 10.0.0.65:1639 2012.05.18 12:07:14 LOG7[2236:580]: Remote socket (FD=372) initialized 2012.05.18 12:07:14 LOG6[2236:580]: Client-mode smtp protocol negotiations started 2012.05.18 12:07:14 LOG7[2236:580]: <- 220 pod51011.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 18 May 2012 16:07:13 +0000 2012.05.18 12:07:14 LOG7[2236:580]: -> 220 pod51011.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 18 May 2012 16:07:13 +0000 2012.05.18 12:07:14 LOG7[2236:580]: -> EHLO localhost 2012.05.18 12:07:14 LOG7[2236:580]: <- 250-pod51011.outlook.com Hello [65.23.214.191] 2012.05.18 12:07:14 LOG7[2236:580]: <- 250-SIZE 36700160 2012.05.18 12:07:14 LOG7[2236:580]: <- 250-PIPELINING 2012.05.18 12:07:14 LOG7[2236:580]: <- 250-DSN 2012.05.18 12:07:14 LOG7[2236:580]: <- 250-ENHANCEDSTATUSCODES 2012.05.18 12:07:14 LOG7[2236:580]: <- 250-STARTTLS 2012.05.18 12:07:14 LOG7[2236:580]: <- 250-AUTH 2012.05.18 12:07:14 LOG7[2236:580]: <- 250-8BITMIME 2012.05.18 12:07:14 LOG7[2236:580]: <- 250-BINARYMIME 2012.05.18 12:07:14 LOG7[2236:580]: <- 250 CHUNKING 2012.05.18 12:07:14 LOG7[2236:580]: -> STARTTLS 2012.05.18 12:07:14 LOG7[2236:580]: <- 220 2.0.0 SMTP server ready 2012.05.18 12:07:14 LOG6[2236:580]: Client-mode smtp protocol negotiations succeeded 2012.05.18 12:07:15 LOG6[2236:580]: SSL connected: new session negotiated 2012.05.18 12:07:15 LOG6[2236:580]: Negotiated TLSv1/SSLv3 ciphersuite: AES128-SHA (128-bit encryption) 2012.05.18 12:07:15 LOG6[2236:580]: Compression: null, expansion: null 2012.05.18 12:07:18 LOG7[2236:580]: SSL socket closed on SSL_read 2012.05.18 12:07:18 LOG7[2236:580]: Sent socket write shutdown 2012.05.18 12:07:18 LOG5[2236:580]: Connection closed: 1498 byte(s) sent to SSL, 498 byte(s) sent to socket 2012.05.18 12:07:18 LOG7[2236:580]: Remote socket (FD=372) closed 2012.05.18 12:07:18 LOG7[2236:580]: Local socket (FD=360) closed 2012.05.18 12:07:18 LOG7[2236:580]: Service [SMTP Outgoing] finished (0 left) 2012.05.18 12:07:18 LOG7[2236:580]: str_stats: 12 block(s), 298 data byte(s), 504 control byte(s) 2012.05.18 12:08:05 LOG7[2236:3940]: Service [SMTP Outgoing] accepted (FD=336) from 127.0.0.1:1644 2012.05.18 12:08:05 LOG7[2236:3940]: Creating a new thread 2012.05.18 12:08:05 LOG7[2236:3940]: New thread created 2012.05.18 12:08:05 LOG7[2236:4044]: Service [SMTP Outgoing] started 2012.05.18 12:08:05 LOG5[2236:4044]: Service [SMTP Outgoing] accepted connection from 127.0.0.1:1644 2012.05.18 12:08:05 LOG6[2236:4044]: connect_blocking: connecting 157.56.236.118:587 2012.05.18 12:08:05 LOG7[2236:4044]: connect_blocking: s_poll_wait 157.56.236.118:587: waiting 10 seconds 2012.05.18 12:08:05 LOG5[2236:4044]: connect_blocking: connected 157.56.236.118:587 2012.05.18 12:08:05 LOG5[2236:4044]: Service [SMTP Outgoing] connected remote server from 10.0.0.65:1645 2012.05.18 12:08:05 LOG7[2236:4044]: Remote socket (FD=376) initialized 2012.05.18 12:08:05 LOG6[2236:4044]: Client-mode smtp protocol negotiations started 2012.05.18 12:08:05 LOG7[2236:4044]: <- 220 pod51011.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 18 May 2012 16:08:04 +0000 2012.05.18 12:08:05 LOG7[2236:4044]: -> 220 pod51011.outlook.com Microsoft ESMTP MAIL Service ready at Fri, 18 May 2012 16:08:04 +0000 2012.05.18 12:08:05 LOG7[2236:4044]: -> EHLO localhost 2012.05.18 12:08:05 LOG7[2236:4044]: <- 250-pod51011.outlook.com Hello [65.23.214.191] 2012.05.18 12:08:05 LOG7[2236:4044]: <- 250-SIZE 36700160 2012.05.18 12:08:05 LOG7[2236:4044]: <- 250-PIPELINING 2012.05.18 12:08:05 LOG7[2236:4044]: <- 250-DSN 2012.05.18 12:08:05 LOG7[2236:4044]: <- 250-ENHANCEDSTATUSCODES 2012.05.18 12:08:05 LOG7[2236:4044]: <- 250-STARTTLS 2012.05.18 12:08:05 LOG7[2236:4044]: <- 250-AUTH 2012.05.18 12:08:05 LOG7[2236:4044]: <- 250-8BITMIME 2012.05.18 12:08:05 LOG7[2236:4044]: <- 250-BINARYMIME 2012.05.18 12:08:05 LOG7[2236:4044]: <- 250 CHUNKING 2012.05.18 12:08:05 LOG7[2236:4044]: -> STARTTLS 2012.05.18 12:08:06 LOG7[2236:4044]: <- 220 2.0.0 SMTP server ready 2012.05.18 12:08:06 LOG6[2236:4044]: Client-mode smtp protocol negotiations succeeded 2012.05.18 12:08:06 LOG6[2236:4044]: SSL connected: new session negotiated 2012.05.18 12:08:06 LOG6[2236:4044]: Negotiated TLSv1/SSLv3 ciphersuite: AES128-SHA (128-bit encryption) 2012.05.18 12:08:06 LOG6[2236:4044]: Compression: null, expansion: null 2012.05.18 12:08:06 LOG7[2236:4044]: SSL socket closed on SSL_read 2012.05.18 12:08:06 LOG7[2236:4044]: Sent socket write shutdown 2012.05.18 12:08:06 LOG5[2236:4044]: Connection closed: 6 byte(s) sent to SSL, 48 byte(s) sent to socket 2012.05.18 12:08:06 LOG7[2236:4044]: Remote socket (FD=376) closed 2012.05.18 12:08:06 LOG7[2236:4044]: Local socket (FD=336) closed 2012.05.18 12:08:06 LOG7[2236:4044]: Service [SMTP Outgoing] finished (0 left) 2012.05.18 12:08:06 LOG7[2236:4044]: str_stats: 12 block(s), 298 data byte(s), 504 control byte(s)

2 1

Problem With GMail
by Van Brown 09 May '12

09 May '12

I am trying to use stunnel to act as a forwarder to GMail. My config file looks like:client = yes socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [gmail] accept = 25 connect = smtp.gmail.com:465 ;CAfile = peer-gmail.pem ;verify = 3 I saved the peer certificate and when I attempt to send mail, the log looks like this: 2012.05.08 16:01:35 LOG5[31036:19408]: Service [gmail] connected remote server from 192.168.1.9:42580 2012.05.08 16:01:35 LOG4[31036:19408]: CERT: Verification error: unable to get local issuer certificate 2012.05.08 16:01:35 LOG4[31036:19408]: Certificate check failed: depth=1, /C=US/O=Google Inc/CN=Google Internet Authority 2012.05.08 16:01:35 LOG3[31036:19408]: SSL_connect: 14090086: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed 2012.05.08 16:01:35 LOG5[31036:19408]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2012.05.08 16:02:35 LOG5[31036:34312]: Service [gmail] accepted connection from 192.168.1.10:49303 2012.05.08 16:02:35 LOG5[31036:34312]: connect_blocking: connected 173.194.79.108:465 2012.05.08 16:02:35 LOG5[31036:34312]: Service [gmail] connected remote server from 192.168.1.9:42619 2012.05.08 16:02:36 LOG4[31036:34312]: CERT: Verification error: unable to get local issuer certificate 2012.05.08 16:02:36 LOG4[31036:34312]: Certificate check failed: depth=1, /C=US/O=Google Inc/CN=Google Internet Authority 2012.05.08 16:02:36 LOG3[31036:34312]: SSL_connect: 14090086: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed 2012.05.08 16:02:36 LOG5[31036:34312]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket Please tell me what I'm doing wrong so I can fix it. Van Brown

2 1

Compiling stunnel without a cert
by Donovan Sydow 08 May '12

08 May '12

I'm trying to automate the compilation of stunnel from source and was curious if there was a hidden flag to prevent stunnel from trying to generate a certificate after running make install. I do know I can make a file called stunnel.pem in the system configuration directory prior to running make install to prevent the cert from being made, but ideally wanted a way to have stunnel install without having a cert pregenerated. I didn't see any configure flags to prevent this behavior. Does any one know how to bypass this requirement and compile without generating a certificate or having one already exist? Alternately I would be interested in hearing any suggestions on how to quietly generate the initial certificate as well in an automated (i.e. no input, quiet, etc.) fashion. Cheers, Donovan

1 0

Getting Stunnel to Work Under Windows 7 64-bit
by Thomas Eifert 03 May '12

03 May '12

For the benefit of the group, I thought I'd share some experiences I had when attempting to get Stunnel to run under Windows 7 SP1 64-bit. I initially installed Stunnel version 4.53 to the default location, which in Windows 7 64-bit is: C:\Program Files (x86)\stunnel\ I installed the service from the start menu option, then rebooted my machine. I have administrator rights, and User Account Control is disabled. My observations included the following: 1. The Stunnel status window displayed only configuration loads. No output from any active connection was ever displayed, despite the fact that Stunnel was passing traffic to/from SSL-enabled servers. 2. Stunnel would not write to the log file. The error message indicated that Stunnel was unable to open stunnel.log. Initially, I thought this might be a factor in the lack of status window connection output, so I commented the log statement out to eliminate it. I then reloaded the configuration. The issue of not seeing any connection info was unaffected. 3. The notification area icon would not appear on Stunnel service load. It would mysteriously appear, then disappear, at seemingly random times. 4. Once the service was installed, it was not possible to stop it or uninstall it from the provided start menu shortcuts. Whenever I attempted to do so, the Stunnel status window would appear. However, I was able to perform these actions successfully by opening a command prompt, then issuing the commands from there. In an effort to unravel these issues, I tried the following workarounds: 1. I re-installed stunnel to a non-system controlled directory. In my case, it was C:\Apps\stunnel\. 2. I attempted to run stunnel in compatibility mode, set for Windows XP SP3. 3. I tried installing 2 previous versions of Stunnel. All combinations produced exactly the same undesired result. Finally, I stopped and uninstalled the service. Instead of using that method, I created a shortcut to stunnel.exe, and placed it in the start menu's startup folder, then rebooted. Stunnel started at boot time, and all of the above issues were resolved. As such, it seems like Stunnel just doesn't like to be run as a service on a Windows 7 64-bit machine; at least not on the one I own. If you're encountering any stability issues with the Stunnel service in the Windows 7 64-bit environment, try my method. It works. I'd like to extend a special thank you to Carter Browne, who provided valuable input throughout the course of my testing. Regards, Thomas -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

2 2

ssl3 handshake error
by Colin Chalmers 28 Apr '12

28 Apr '12

Hi all, I'm pretty new to stunnel but did get this config to work on a linux box - now I am trying the same/similiar config on a win7 box but keep getting the handshake error below. I am using the latest version of stunnel and have tried searching for an answer via google, making the proposed changes as described No matter what settings I use it always seems to use the sslv3 handshake which then goes wrong :-( I'd appreciate any help on this Colin My config is as follows: ; ************************************************************************** ; * Global options * ; ************************************************************************** ; Debugging stuff (may useful for troubleshooting) ; Some debugging stuff useful for troubleshooting debug = 7 output = c:\temp\stunnel.log ; Use it for client mode client = yes rndbytes = 256 rndfile = c:\temp\randseed.bin ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Disable FIPS mode to allow non-approved protocols and algorithms fips = no ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Certificate/key is needed in server mode and optional in client mode cert = CT_20110324.pem ; Disable support for insecure SSLv2 protocol sslVersion = TLSv1 options = NO_SSLv2 options = NO_SSLv3 [CT] ; incoming connection from the client application accept = 444 ; outgoing connection connect = remote.server.com:443 TIMEOUTclose = 0 Error in log file 2012.04.11 18:33:54 LOG7[3684:3640]: Remote socket (FD=440) initialized 2012.04.11 18:33:54 LOG3[3684:3640]: SSL_connect: 14094410: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure 2012.04.11 18:33:54 LOG5[3684:3640]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2012.04.11 18:33:54 LOG7[3684:3640]: Remote socket (FD=440) closed 2012.04.11 18:33:54 LOG7[3684:3640]: Local socket (FD=408) closed 2012.04.11 18:33:54 LOG7[3684:3640]: Service [CT] finished (0 left)

3 2

Using Stunnel client but not Stunnel server with Apache mod_ssl
by Lilienberg, Daniel () 27 Apr '12

27 Apr '12

Hi, My supplier is using a somewhat strange setup looking like this: CLIENT: Stunnel running in client mode accepting incoming requests on port 8080. It will forward it to port to a server, port 443. SERVER: NOT running Stunnel at all, but running Apache with mod_ssl. It also acts as a proxy server, proxying all requests. Can this work, if so, how do I set it up ? [http://www.volvocars.net/support/IT/Services/IT_workplace/Email/outlook/sig…] Daniel Lilienberg Architect Connectivity Foundation Volvo Car Corporation Dept. 61630/PV2A Göteborg Sweden Telephone +46-31-3542317 dlilien2(a)volvocars.com<mailto:[email protected]> www.volvocars.com<http://www.volvocars.com/> Registered Office Göteborg, Sweden Registration No. 556074-3089

1 0

Windows 7 64-Bit
by Thomas Eifert 23 Apr '12

23 Apr '12

Has anyone attempted to install and run Stunnel on Windows 7 64-bit? If so, which version did you use, and were any issues experienced? Regards. Thomas -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

1 0

Possible error in stunnel 4.20
by Andreea Ion 20 Apr '12

20 Apr '12

Hi, I am running stunnel 4.2 on windows and I get the following log. I don't know if it's ok, if the problem is at the stunnel lovel or at the application level. SSL state (connect): before/connect initialization 2012.04.20 11:46:09 LOG7[5684:4492]: SSL state (connect): SSLv3 write client hello A 2012.04.20 11:46:09 LOG7[5684:4492]: SSL state (connect): SSLv3 read server hello A 2012.04.20 11:46:09 LOG7[5684:4492]: SSL state (connect): SSLv3 read finished A 2012.04.20 11:46:09 LOG7[5684:4492]: SSL state (connect): SSLv3 write change cipher spec A 2012.04.20 11:46:09 LOG7[5684:4492]: SSL state (connect): SSLv3 write finished A 2012.04.20 11:46:09 LOG7[5684:4492]: SSL state (connect): SSLv3 flush data 2012.04.20 11:46:09 LOG7[5684:4492]: 2 items in the session cache 2012.04.20 11:46:09 LOG7[5684:4492]: 5 client connects (SSL_connect()) 2012.04.20 11:46:09 LOG7[5684:4492]: 5 client connects that finished 2012.04.20 11:46:09 LOG7[5684:4492]: 0 client renegotiations requested 2012.04.20 11:46:09 LOG7[5684:4492]: 0 server connects (SSL_accept()) 2012.04.20 11:46:09 LOG7[5684:4492]: 0 server connects that finished 2012.04.20 11:46:09 LOG7[5684:4492]: 0 server renegotiations requested 2012.04.20 11:46:09 LOG7[5684:4492]: 3 session cache hits 2012.04.20 11:46:09 LOG7[5684:4492]: 0 session cache misses 2012.04.20 11:46:09 LOG7[5684:4492]: 0 session cache timeouts 2012.04.20 11:46:09 LOG6[5684:4492]: SSL connected: previous session reused 2012.04.20 11:46:54 LOG3[5684:4492]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2012.04.20 11:46:54 LOG5[5684:4492]: Connection reset: 154 bytes sent to SSL, 0 bytes sent to socket 2012.04.20 11:46:54 LOG7[5684:4492]: Session finished (0 left) The last 3 lines are those that interests me most. Is this ok ? Regards, Andreea

1 0

(no subject)
by Guylhem 18 Apr '12

18 Apr '12

Hello With verify=3 and the certs loaded in the conf file with CAfile=startssl-chain.pem cert=mycert.pem, I get : CERT: Certificate not found in local repository Using the latest stunnel recompiled on a debian squeeze, the best I can get is: error queue: 140B0009: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib SSL_CTX_use_PrivateKey_file: 906D06C: error:0906D06C:PEM routines:PEM_read_bio:no start line However, if I put these very same pem files in a directory as a CApath option instead (c_rehash applied) everything works fine. But The pem files are identical ! I've read http://stunnel.mirt.net/pipermail/stunnel-users/2010-November/002854.html but it seems a bit different The startssl-chain.pem was created with: wget http://www.startssl.com/certs/ca.pem wget http://www.startssl.com/certs/startssl.ca.pem cat sub.class1.server.ca.pem ca.pem > startssl-chain.pem I guess that may be the cause of the problem? What should I do to pass these pem files as stunnel.conf options instead of using the CApath? Guylhem

1 0

(no subject)
by Marco Tulio Jimenez Abrego 18 Apr '12

18 Apr '12

Buenos días El mensaje de error es: Error resolving 'smtp.gmail.com': Neither nodename nor servname known (EAI_NONAME). Gracias por su atención. -- Saludos. Att. Marco T. Jiménez ================ Tel. 6619-6782

3 2

Stunnel compiled with openssl 1.0.1 local binaries are 0.9.8k
by Michael Curran 11 Apr '12

11 Apr '12

Are there any potential known issues with stunnel being compiled using openssl 1.0.1 build and leaving the local system binaries at 0.9.8k Do you know of any way to test this for any incompatibilities? This was not my design, Im just being asked to support it and Im looking to make sure this method is not going to cause anything unusual.

2 1

PPID of child process
by Philip Wong 11 Apr '12

11 Apr '12

Hi, I’m trying to setup stunnel listening to multiple ports. The PPID of processes created are always root. Can we change that to the right PPID? Here I can see all the processes by killing 10764 and I expect this is the PPID. But all the children PPID are still 1; UID PID PPID C STIME TTY TIME CMD philwong 10759 1 0 16:27 pts/78 00:00:00 stunnel self.conf philwong 10760 1 0 16:27 pts/78 00:00:00 stunnel self.conf philwong 10761 1 0 16:27 pts/78 00:00:00 stunnel self.conf philwong 10762 1 0 16:27 pts/78 00:00:00 stunnel self.conf philwong 10763 1 0 16:27 pts/78 00:00:00 stunnel self.conf philwong 10764 1 0 16:27 ? 00:00:00 stunnel self.conf Regards, Philip

3 6

the connection had to be retried using SSL 3.0. This typically means that the server is using very old software and may have other security issues :(
by Thomas Manson 10 Apr '12

10 Apr '12

Hi, while I'm trying to get stunnel working for more than a few hours, I've also notice this warning in google chrome : the connection had to be retried using SSL 3.0. This typically means that > the server is using very old software and may have other security issues. [image: Inline image 1] gmail for example has AES_128_CBC for crypting, can we get that without much effort? What should be set to get rid of this warning ? I thought SSL v3 was the best (quickly pick acrross several example on the net) what is the best setting for this ? Thanks for your help, Thomas. My config : debug = 7 output = /var/log/stunnel4/extranet.service.com_stunnel.log setuid = stunnel4 setgid = stunnel4 pid = /var/run/stunnel4/extranet.service.com.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [extranet.service.com] key = /etc/stunnel/sites/extranet.service.com/extranet.service.com.key cert = /etc/stunnel/sites/extranet.service.com/extranet.service.com.crt accept = 8.90.17.4:443 connect = 127.0.0.1:82 sslVersion = SSLv3 TIMEOUTclose = 0

3 4

[Stunnel Guru needed] stunnel running, but no longer serve connection after a while ("Dispatching signals from the signal pipe" in logs ==> all stops)
by Thomas Manson 09 Apr '12

09 Apr '12

Hi All, I'm really struggling to make stunnel working for more than a few hours. (and the client is yelling hard...) (I solved some other issue : logging per website and making more than one stunnel works) To put it in a nutshell : - stunnel is running and working correctly (I can reach the website in https correctly) - after some hours I get the following situation : - stunnel is still running on linux - trying to connect to a website result in the connection taking very long time and then fails : "*The connection to * extranet.serviceplus-hse.com <http://extranet.website.com>* was interrupted. Error 101 (net::ERR_CONNECTION_RESET): The connection was reset.*" (Chrome) Same symptoms on IE9, Firefox & Lynx (on the server that runs stunnel) (see logs below) - The following logs are the last one seen in the log file : - 2012.04.03 23:33:28 LOG5[24792:140152610346752]: Service extranet.serviceplus-hse.com connected remote server from 127.0.0.1:36256 - 2012.04.03 23:33:28 LOG7[24792:140152610346752]: Remote FD=1 initialized - 2012.04.03 23:33:28 LOG7[24792:140152610346752]: Option TCP_NODELAY set on remote socket - 2012.04.03 23:33:41 LOG7[24792:140152610346752]: Socket closed on read - 2012.04.03 23:33:41 LOG7[24792:140152610346752]: Sending SSL write shutdown - 2012.04.03 23:33:41 LOG7[24792:140152610346752]: SSL alert (write): warning: close notify - 2012.04.03 23:33:41 LOG6[24792:140152610346752]: SSL_shutdown successfully sent close_notify - 2012.04.03 23:33:41 LOG3[24792:140152610346752]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing - 2012.04.03 23:33:41 LOG5[24792:140152610346752]: Connection closed: 186584 bytes sent to SSL, 3275 bytes sent to socket - 2012.04.03 23:33:41 LOG7[24792:140152610346752]: Service extranet.serviceplus-hse.com finished (0 left) - 2012.04.04 06:25:04 LOG7[24792:140152610629408]: *Dispatching signals from the signal pipe * stopping the firewall & fail2ban do not change anything. (the last line is logged by this function : *static void signal_pipe_empty(void) ) * the base stunnel.log has the same ending : - 2012.04.03 21:10:42 LOG7[24778:139641780209408]: Service https-123monsite.com permitted by libwrap from 212.162.10.34:3244 - 2012.04.03 21:10:42 LOG5[24778:139641780209408]: Service https-123monsite.com accepted connection from 212.162.10.34:3244 - 2012.04.03 21:10:42 LOG7[24778:139641780209408]: SSL state (accept): before/accept initialization - 2012.04.03 21:10:42 LOG3[24778:139641780209408]: SSL_accept: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number - 2012.04.03 21:10:42 LOG5[24778:139641780209408]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket - 2012.04.03 21:10:42 LOG7[24778:139641780209408]: Service https-123monsite.com finished (0 left) - 2012.04.04 06:25:04 LOG7[24778:139641780213536]: Dispatching signals from the signal pipe - and at the same time (2012.04.04 06:25:04) all logs file stops : - root@ns0:/var/log/stunnel4# ll - total 128 - drwxr-xr-x 2 stunnel4 stunnel4 4096 2012-04-04 12:10 . - drwxr-xr-x 14 root root 4096 2012-04-04 06:25 .. - -rw-r----- 1 stunnel4 stunnel4 98084 2012-04-04 *06:25*extranet.serviceplus-hse.com_stunnel.log - -rw-r----- 1 stunnel4 stunnel4 4491 2012-04-04 06:25 mansonthomas.com_stunnel.log - -rw-r----- 1 stunnel4 stunnel4 0 2012-04-04 06:25 stunnel.log - -rw-r----- 1 stunnel4 stunnel4 11058 2012-04-04 06:25 stunnel.log.1 - I've seen some message about the same behavior but after an upgrade on freebsd and didn't find any solution... - Restarting stunnel restore the service immediately. below some information about my configuration... ask for more if needed. Thanks for any helps, Regards, Thomas. Distribution & Pachage info (x64 system) ###################################################################### root@ns0:/var/log/stunnel4# cat /etc/lsb-release DISTRIB_ID=Ubuntu DISTRIB_RELEASE=11.10 DISTRIB_CODENAME=oneiric DISTRIB_DESCRIPTION="Ubuntu 11.10" root@ns0:/var/log/stunnel4# aptitude show stunnel4 Package: stunnel4 New: yes State: installed Automatically installed: no Version: 3:*4.35-2build1* ###################################################################### lynx try : ###################################################################### root@ns0:/var/log/stunnel4# lynx https://extranet.serviceplus-hse.com Looking up extranet.serviceplus-hse.com Making HTTPS connection to extranet.serviceplus-hse.com Retrying connection without TLS. Looking up extranet.serviceplus-hse.com Making HTTPS connection to extranet.serviceplus-hse.com Alert!: Unable to make secure connection to remote host. lynx: Can't access startfile https://extranet.serviceplus-hse.com/ ###################################################################### ps -edf : ###################################################################### 1 24773 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/base.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 PWD=/ 1 24774 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/base.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 PWD=/ 1 24775 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/base.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 PWD=/ 1 24776 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/base.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 PWD=/ 1 24777 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/base.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 PWD=/ 1 24778 24778 24778 ? -1 Ss 109 0:00 /usr/bin/stunnel4 /etc/stunnel/base.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 PWD=/ 1 24787 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/extranet.serviceplus-hse.com.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 P 1 24788 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/extranet.serviceplus-hse.com.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 P 1 24789 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/extranet.serviceplus-hse.com.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 P 1 24790 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/extranet.serviceplus-hse.com.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 P 1 24791 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/extranet.serviceplus-hse.com.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 P 1 24792 24792 24792 ? -1 Ss 109 0:00 /usr/bin/stunnel4 /etc/stunnel/extranet.serviceplus-hse.com.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 P 1 24801 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/mansonthomas.com.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 PWD=/ 1 24802 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/mansonthomas.com.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 PWD=/ 1 24803 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/mansonthomas.com.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 PWD=/ 1 24804 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/mansonthomas.com.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 PWD=/ 1 24805 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/mansonthomas.com.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 PWD=/ 1 24806 24806 24806 ? -1 Ss 109 0:00 /usr/bin/stunnel4 /etc/stunnel/mansonthomas.com.conf TERM=screen-bce PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin LANG=en_US.UTF-8 PWD=/ ###################################################################### /etc/stunnel/base.conf ###################################################################### debug = 7 sslVersion = SSLv3 cert=/etc/stunnel/sites/123monsite.com/123monsite.com.crt key=/etc/stunnel/sites/123monsite.com/123monsite.com.key ; security enhancements for UNIX systems ; for chroot a copy of some devices and files is needed within the jail ;chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 ; PID is created inside the chroot jail pid = /var/run/stunnel4/stunnel4.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 output = /var/log/stunnel4/stunnel.log [https-123monsite.com] accept=88.190.17.222:443 connect=127.0.0.1:82 ###################################################################### /etc/stunnel/extranet.serviceplus-hse.com.conf ###################################################################### debug = 7 output = /var/log/stunnel4/extranet.serviceplus-hse.com_stunnel.log setuid = stunnel4 setgid = stunnel4 pid = /var/run/stunnel4/extranet.serviceplus-hse.com.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 [extranet.serviceplus-hse.com] key = /etc/stunnel/sites/ extranet.serviceplus-hse.com/extranet.serviceplus-hse.com.key cert = /etc/stunnel/sites/ extranet.serviceplus-hse.com/extranet.serviceplus-hse.com.crt accept = 88.190.217.54:443 connect = 127.0.0.1:82 sslVersion = SSLv3 TIMEOUTclose = 0 ###################################################################### Last logs : /var/log/stunnel4/extranet.serviceplus-hse.com_stunnel.log ###################################################################### 2012.04.03 23:02:47 LOG6[24792:140152610346752]: SSL accepted: previous session reused 2012.04.03 23:02:47 LOG7[24792:140152610346752]: remote socket: FD=1 allocated (non-blocking mode) 2012.04.03 23:02:47 LOG6[24792:140152610346752]: connect_blocking: connecting 127.0.0.1:82 2012.04.03 23:02:47 LOG7[24792:140152610346752]: connect_blocking: s_poll_wait 127.0.0.1:82: waiting 10 seconds 2012.04.03 23:02:47 LOG5[24792:140152610346752]: connect_blocking: connected 127.0.0.1:82 2012.04.03 23:02:47 LOG5[24792:140152610346752]: Service extranet.serviceplus-hse.com connected remote server from 127.0.0.1:60624 2012.04.03 23:02:47 LOG7[24792:140152610346752]: Remote FD=1 initialized 2012.04.03 23:02:47 LOG7[24792:140152610346752]: Option TCP_NODELAY set on remote socket 2012.04.03 23:02:58 LOG7[24792:140152610346752]: Socket closed on read 2012.04.03 23:02:58 LOG7[24792:140152610346752]: Sending SSL write shutdown 2012.04.03 23:02:58 LOG7[24792:140152610346752]: SSL alert (write): warning: close notify 2012.04.03 23:02:58 LOG6[24792:140152610346752]: SSL_shutdown successfully sent close_notify 2012.04.03 23:02:58 LOG3[24792:140152610346752]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing 2012.04.03 23:02:58 LOG5[24792:140152610346752]: Connection closed: 167313 bytes sent to SSL, 1871 bytes sent to socket 2012.04.03 23:02:58 LOG7[24792:140152610346752]: Service extranet.serviceplus-hse.com finished (0 left) 2012.04.03 23:33:20 LOG7[24792:140152610629408]: local socket: FD=0 allocated (non-blocking mode) 2012.04.03 23:33:20 LOG7[24792:140152610629408]: Service extranet.serviceplus-hse.com accepted FD=0 from 82.224.128.241:52114 2012.04.03 23:33:20 LOG7[24792:140152610346752]: Service extranet.serviceplus-hse.com started 2012.04.03 23:33:20 LOG7[24792:140152610346752]: Option TCP_NODELAY set on local socket 2012.04.03 23:33:20 LOG7[24792:140152610346752]: Waiting for a libwrap process 2012.04.03 23:33:20 LOG7[24792:140152610346752]: Acquired libwrap process #0 2012.04.03 23:33:20 LOG7[24792:140152610346752]: Releasing libwrap process #0 2012.04.03 23:33:20 LOG7[24792:140152610346752]: Released libwrap process #0 2012.04.03 23:33:20 LOG7[24792:140152610346752]: Service extranet.serviceplus-hse.com permitted by libwrap from 82.224.128.241:52114 2012.04.03 23:33:20 LOG5[24792:140152610346752]: Service extranet.serviceplus-hse.com accepted connection from 82.224.128.241:52114 2012.04.03 23:33:20 LOG7[24792:140152610346752]: SSL state (accept): before/accept initialization 2012.04.03 23:33:20 LOG7[24792:140152610346752]: SSL state (accept): SSLv3 read client hello B 2012.04.03 23:33:20 LOG7[24792:140152610346752]: SSL state (accept): SSLv3 write server hello A 2012.04.03 23:33:20 LOG7[24792:140152610346752]: SSL state (accept): SSLv3 write certificate A 2012.04.03 23:33:20 LOG7[24792:140152610346752]: SSL state (accept): SSLv3 write key exchange A 2012.04.03 23:33:20 LOG7[24792:140152610346752]: SSL state (accept): SSLv3 write server done A 2012.04.03 23:33:20 LOG7[24792:140152610346752]: SSL state (accept): SSLv3 flush data 2012.04.03 23:33:20 LOG7[24792:140152610346752]: SSL state (accept): SSLv3 read client key exchange A 2012.04.03 23:33:20 LOG7[24792:140152610346752]: SSL state (accept): SSLv3 read finished A 2012.04.03 23:33:20 LOG7[24792:140152610346752]: SSL state (accept): SSLv3 write change cipher spec A 2012.04.03 23:33:20 LOG7[24792:140152610346752]: SSL state (accept): SSLv3 write finished A 2012.04.03 23:33:20 LOG7[24792:140152610346752]: SSL state (accept): SSLv3 flush data 2012.04.03 23:33:20 LOG7[24792:140152610346752]: 7 items in the session cache 2012.04.03 23:33:20 LOG7[24792:140152610346752]: 0 client connects (SSL_connect()) 2012.04.03 23:33:20 LOG7[24792:140152610346752]: 0 client connects that finished 2012.04.03 23:33:20 LOG7[24792:140152610346752]: 0 client renegotiations requested 2012.04.03 23:33:20 LOG7[24792:140152610346752]: 21 server connects (SSL_accept()) 2012.04.03 23:33:20 LOG7[24792:140152610346752]: 20 server connects that finished 2012.04.03 23:33:20 LOG7[24792:140152610346752]: 0 server renegotiations requested 2012.04.03 23:33:20 LOG7[24792:140152610346752]: 9 session cache hits 2012.04.03 23:33:20 LOG7[24792:140152610346752]: 0 external session cache hits 2012.04.03 23:33:20 LOG7[24792:140152610346752]: 7 session cache misses 2012.04.03 23:33:20 LOG7[24792:140152610346752]: 4 session cache timeouts 2012.04.03 23:33:20 LOG6[24792:140152610346752]: SSL accepted: new session negotiated 2012.04.03 23:33:20 LOG6[24792:140152610346752]: Negotiated ciphers: DHE-RSA-CAMELLIA256-SHA SSLv3 Kx=DH Au=RSA Enc=Camellia(256) Mac=SHA1 2012.04.03 23:33:20 LOG7[24792:140152610346752]: remote socket: FD=1 allocated (non-blocking mode) 2012.04.03 23:33:20 LOG6[24792:140152610346752]: connect_blocking: connecting 127.0.0.1:82 2012.04.03 23:33:20 LOG7[24792:140152610346752]: connect_blocking: s_poll_wait 127.0.0.1:82: waiting 10 seconds 2012.04.03 23:33:20 LOG5[24792:140152610346752]: connect_blocking: connected 127.0.0.1:82 2012.04.03 23:33:20 LOG5[24792:140152610346752]: Service extranet.serviceplus-hse.com connected remote server from 127.0.0.1:36240 2012.04.03 23:33:20 LOG7[24792:140152610346752]: Remote FD=1 initialized 2012.04.03 23:33:20 LOG7[24792:140152610346752]: Option TCP_NODELAY set on remote socket 2012.04.03 23:33:27 LOG7[24792:140152610346752]: Socket closed on read 2012.04.03 23:33:27 LOG7[24792:140152610346752]: Sending SSL write shutdown 2012.04.03 23:33:27 LOG7[24792:140152610346752]: SSL alert (write): warning: close notify 2012.04.03 23:33:27 LOG6[24792:140152610346752]: SSL_shutdown successfully sent close_notify 2012.04.03 23:33:27 LOG3[24792:140152610346752]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing 2012.04.03 23:33:27 LOG5[24792:140152610346752]: Connection closed: 537 bytes sent to SSL, 620 bytes sent to socket 2012.04.03 23:33:27 LOG7[24792:140152610346752]: Service extranet.serviceplus-hse.com finished (0 left) 2012.04.03 23:33:27 LOG7[24792:140152610629408]: local socket: FD=0 allocated (non-blocking mode) 2012.04.03 23:33:27 LOG7[24792:140152610629408]: Service extranet.serviceplus-hse.com accepted FD=0 from 82.224.128.241:52123 2012.04.03 23:33:27 LOG7[24792:140152610346752]: Service extranet.serviceplus-hse.com started 2012.04.03 23:33:27 LOG7[24792:140152610346752]: Option TCP_NODELAY set on local socket 2012.04.03 23:33:27 LOG7[24792:140152610346752]: Waiting for a libwrap process 2012.04.03 23:33:27 LOG7[24792:140152610346752]: Acquired libwrap process #0 2012.04.03 23:33:27 LOG7[24792:140152610346752]: Releasing libwrap process #0 2012.04.03 23:33:27 LOG7[24792:140152610346752]: Released libwrap process #0 2012.04.03 23:33:27 LOG7[24792:140152610346752]: Service extranet.serviceplus-hse.com permitted by libwrap from 82.224.128.241:52123 2012.04.03 23:33:27 LOG5[24792:140152610346752]: Service extranet.serviceplus-hse.com accepted connection from 82.224.128.241:52123 2012.04.03 23:33:27 LOG7[24792:140152610346752]: SSL state (accept): before/accept initialization 2012.04.03 23:33:27 LOG7[24792:140152610346752]: SSL state (accept): SSLv3 read client hello B 2012.04.03 23:33:27 LOG7[24792:140152610346752]: SSL state (accept): SSLv3 write server hello A 2012.04.03 23:33:27 LOG7[24792:140152610346752]: SSL state (accept): SSLv3 write change cipher spec A 2012.04.03 23:33:27 LOG7[24792:140152610346752]: SSL state (accept): SSLv3 write finished A 2012.04.03 23:33:27 LOG7[24792:140152610346752]: SSL state (accept): SSLv3 flush data 2012.04.03 23:33:28 LOG7[24792:140152610346752]: SSL state (accept): SSLv3 read finished A 2012.04.03 23:33:28 LOG7[24792:140152610346752]: 7 items in the session cache 2012.04.03 23:33:28 LOG7[24792:140152610346752]: 0 client connects (SSL_connect()) 2012.04.03 23:33:28 LOG7[24792:140152610346752]: 0 client connects that finished 2012.04.03 23:33:28 LOG7[24792:140152610346752]: 0 client renegotiations requested 2012.04.03 23:33:28 LOG7[24792:140152610346752]: 22 server connects (SSL_accept()) 2012.04.03 23:33:28 LOG7[24792:140152610346752]: 21 server connects that finished 2012.04.03 23:33:28 LOG7[24792:140152610346752]: 0 server renegotiations requested 2012.04.03 23:33:28 LOG7[24792:140152610346752]: 10 session cache hits 2012.04.03 23:33:28 LOG7[24792:140152610346752]: 0 external session cache hits 2012.04.03 23:33:28 LOG7[24792:140152610346752]: 7 session cache misses 2012.04.03 23:33:28 LOG7[24792:140152610346752]: 4 session cache timeouts 2012.04.03 23:33:28 LOG6[24792:140152610346752]: SSL accepted: previous session reused 2012.04.03 23:33:28 LOG7[24792:140152610346752]: remote socket: FD=1 allocated (non-blocking mode) 2012.04.03 23:33:28 LOG6[24792:140152610346752]: connect_blocking: connecting 127.0.0.1:82 2012.04.03 23:33:28 LOG7[24792:140152610346752]: connect_blocking: s_poll_wait 127.0.0.1:82: waiting 10 seconds 2012.04.03 23:33:28 LOG5[24792:140152610346752]: connect_blocking: connected 127.0.0.1:82 2012.04.03 23:33:28 LOG5[24792:140152610346752]: Service extranet.serviceplus-hse.com connected remote server from 127.0.0.1:36256 2012.04.03 23:33:28 LOG7[24792:140152610346752]: Remote FD=1 initialized 2012.04.03 23:33:28 LOG7[24792:140152610346752]: Option TCP_NODELAY set on remote socket 2012.04.03 23:33:41 LOG7[24792:140152610346752]: Socket closed on read 2012.04.03 23:33:41 LOG7[24792:140152610346752]: Sending SSL write shutdown 2012.04.03 23:33:41 LOG7[24792:140152610346752]: SSL alert (write): warning: close notify 2012.04.03 23:33:41 LOG6[24792:140152610346752]: SSL_shutdown successfully sent close_notify 2012.04.03 23:33:41 LOG3[24792:140152610346752]: transfer: s_poll_wait: TIMEOUTclose exceeded: closing 2012.04.03 23:33:41 LOG5[24792:140152610346752]: Connection closed: 186584 bytes sent to SSL, 3275 bytes sent to socket 2012.04.03 23:33:41 LOG7[24792:140152610346752]: Service extranet.serviceplus-hse.com finished (0 left) 2012.04.04 06:25:04 LOG7[24792:140152610629408]: Dispatching signals from the signal pipe ######################################################################

2 6

Ubuntu version of stunnel : multiple process shown by a ps -edf, compiled from sources : one process
by Thomas Manson 08 Apr '12

08 Apr '12

Hi, To get around a bug of stunnel present in the package of Ubuntu 11.10 (that has been corrected in v4.38), I've compiled from sources (v4.53). It went well, but I did notice a change in the processes : from compiled sources, I can see only on process per conf file ###################################################################### 1 21402 21402 21402 ? -1 Ss 109 0:00 /usr/local/bin/stunnel4 /etc/stunnel/base.conf 1 21411 21411 21411 ? -1 Ss 109 0:00 /usr/local/bin/stunnel4 /etc/stunnel/extranet.serviceplus-hse.com.conf 1 21420 21420 21420 ? -1 Ss 109 0:00 /usr/local/bin/stunnel4 /etc/stunnel/mansonthomas.com.conf ###################################################################### while on the ubuntu version, I've multiple process per conf file. ps -edf from ubuntu distrib ###################################################################### 1 24773 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/base.conf 1 24774 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/base.conf 1 24775 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/base.conf 1 24776 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/base.conf 1 24777 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/base.conf 1 24778 24778 24778 ? -1 Ss 109 0:00 /usr/bin/stunnel4 /etc/stunnel/base.conf 1 24787 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/extranet.serviceplus-hse.com.conf 1 24788 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/extranet.serviceplus-hse.com.conf 1 24789 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/extranet.serviceplus-hse.com.conf 1 24790 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/extranet.serviceplus-hse.com.conf 1 24791 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/extranet.serviceplus-hse.com.conf 1 24792 24792 24792 ? -1 Ss 109 0:00 /usr/bin/stunnel4 /etc/stunnel/extranet.serviceplus-hse.com.conf 1 24801 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/mansonthomas.com.conf 1 24802 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/mansonthomas.com.conf 1 24803 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/mansonthomas.com.conf 1 24804 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/mansonthomas.com.conf 1 24805 24762 18168 ? -1 S 109 0:00 /usr/bin/stunnel4 /etc/stunnel/mansonthomas.com.conf 1 24806 24806 24806 ? -1 Ss 109 0:00 /usr/bin/stunnel4 /etc/stunnel/mansonthomas.com.conf ###################################################################### I'm using the exact same version of conf file for both setup... any idea why this change ? is one better than another ? Regards, Thomas.

1 0

Transparent STunnel & HAProxy on Centos6.2
by Scott McKeown 07 Apr '12

07 Apr '12

Hi All, I've been playing with this for a little while now and before the all in front of me and my head meet I was wondering if someone else could shed some light on this for me please. First off let me give you a over view of the network setup: My Virtual Machine has two interfaces eth0 has two addresses 192.168.82.9/18and 192.168.82.10/18. 192.168.82.9 is going to be for the management of the server and 192.168.82.10 is what the website will respond too. eth1 has a network of its own 10.0.0.0/24 and I have two Debian Apache web servers that are connected to this network 10.0.0.10 and 10.0.0.20. If this was a real world setup I might have put the management address (192.168.82.9) on a different port but I didn't think of that at the time of setting this up but I may do that later. Second what have I done! Well this is a brand new install of Centos6.2 minimal fully patched and both HAProxy and STunnel downloaded and installed. I'm using the devel version of HAProxy but thats a different story and version 4.53 of STunnel. Now the problem. Both seem to work perfectly as-long as I don't want to know who is accessing my site which make it next to useless. However, I can get HAProxy to report the IP Address of the visitor as long as you visit the HTTP page on port 80 as per my configuration file. I can also get STunnel to work with HAProxy but as soon as I enable 'protocol = proxy' the HTTPS side breaks and all I get in my browser is '400 Bad Request Your browser sent an invalid request'. I've played with everything I can thing of and I still cant get a Transparent STunnel>HAProxy solution working correctly. Config Files: stunnel.conf ====================================== chroot = /usr/local/var/lib/stunnel/ #setuid = nobody setgid = nobody pid = /stunnel.pid cert = /usr/local/etc/stunnel/stunnel.pem key = /usr/local/etc/stunnel/stunnel.pem options = NO_SSLv2 debug = 7 #fips = no [https] accept = 192.168.82.10:443 connect = 192.168.82.10:80 protocol = proxy haproxy.cfg ====================================== global daemon log /dev/log local4 maxconn 40000 ulimit-n 81000 defaults log global mode http contimeout 4000 clitimeout 42000 srvtimeout 43000 listen http1 bind 192.168.82.10:80 mode http option http-server-close option forwardfor source 0.0.0.0 usesrc clientip balance roundrobin server http1_1 10.0.0.10:80 cookie http1_1 check inter 2000 rise 2 fall 3 server http1_1 10.0.0.20:80 cookie http1_1 check inter 2000 rise 2 fall 3 Log file ====================================== Apr 5 12:37:32 lbmaster haproxy[1351]: Proxy http1 started. Apr 5 12:37:33 lbmaster stunnel: LOG5[1353:140163149080512]: stunnel 4.53 on x86_64-unknown-linux-gnu platform Apr 5 12:37:33 lbmaster stunnel: LOG5[1353:140163149080512]: Compiled/running with OpenSSL 1.0.0-fips 29 Mar 2010 Apr 5 12:37:33 lbmaster stunnel: LOG5[1353:140163149080512]: Threading:PTHREAD SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:POLL+IPv6 Apr 5 12:37:33 lbmaster stunnel: LOG5[1353:140163149080512]: Reading configuration from file /usr/local/etc/stunnel/stunnel.conf Apr 5 12:37:33 lbmaster stunnel: LOG5[1353:140163149080512]: FIPS mode is enabled Apr 5 12:37:33 lbmaster stunnel: LOG6[1353:140163149080512]: Initializing service section [https] Apr 5 12:37:33 lbmaster stunnel: LOG5[1353:140163149080512]: Configuration successful Apr 5 12:37:41 lbmaster stunnel: LOG5[1354:140163149076224]: Service [https] accepted connection from 192.168.64.10:53149 Apr 5 12:37:41 lbmaster stunnel: LOG6[1354:140163149076224]: connect_blocking: connecting 192.168.82.10:80 Apr 5 12:37:41 lbmaster haproxy[1352]: Connect from 192.168.82.10:47570 to 192.168.82.10:80 (http1/HTTP) Apr 5 12:37:41 lbmaster stunnel: LOG5[1354:140163149076224]: connect_blocking: connected 192.168.82.10:80 Apr 5 12:37:41 lbmaster stunnel: LOG5[1354:140163149076224]: Service [https] connected remote server from 192.168.82.10:47570 Apr 5 12:37:41 lbmaster stunnel: LOG6[1354:140163149076224]: Server-mode proxy protocol negotiations started Apr 5 12:37:41 lbmaster stunnel: LOG6[1354:140163149076224]: Server-mode proxy protocol negotiations succeeded Apr 5 12:37:41 lbmaster stunnel: LOG6[1354:140163149076224]: SSL accepted: new session negotiated Apr 5 12:37:41 lbmaster stunnel: LOG6[1354:140163149076224]: Negotiated TLSv1/SSLv3 ciphersuite: DHE-RSA-AES256-SHA (256-bit encryption) Apr 5 12:37:41 lbmaster stunnel: LOG6[1354:140163149076224]: Compression: null, expansion: null Apr 5 12:37:41 lbmaster stunnel: LOG6[1354:140163149076224]: SSL_shutdown successfully sent close_notify alert Apr 5 12:37:41 lbmaster stunnel: LOG5[1354:140163149076224]: Error detected on socket (read) file descriptor: Broken pipe (32) Apr 5 12:37:41 lbmaster stunnel: LOG5[1354:140163149076224]: Connection reset: 187 byte(s) sent to SSL, 1 byte(s) sent to socket Any help would be most gracefully received and welcome. ~Yours, Scott

2 1

help
by Bill Tindal 07 Apr '12

07 Apr '12

On Sat, Apr 7, 2012 at 8:00 PM, <stunnel-users-request(a)stunnel.org> wrote: > Send stunnel-users mailing list submissions to > stunnel-users(a)stunnel.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)stunnel.org > > You can reach the person managing the list at > stunnel-users-owner(a)stunnel.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. Re: [Stunnel Guru needed] stunnel running, but no longer > serve connection after a while ("Dispatching signals from the > signal pipe" in logs ==> all stops) (Thomas Manson) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sat, 7 Apr 2012 08:24:46 +0200 > From: Thomas Manson <dev.mansonthomas(a)gmail.com> > To: Scott Gifford <sgifford(a)suspectclass.com> > Cc: stunnel-users(a)stunnel.org > Subject: Re: [stunnel-users] [Stunnel Guru needed] stunnel running, > but no longer serve connection after a while ("Dispatching signals > from the signal pipe" in logs ==> all stops) > Message-ID: > <CA+PenvGYr+tTiKsavOgyaLOtoRxUo0nfxuRVDEzdvGDrFpefLg(a)mail.gmail.com > > > Content-Type: text/plain; charset="utf-8" > > This bug has been corrected in > > Version 4.38, 2011.06.28, urgency: MEDIUM: > > - New features > - Server-side SNI implemented (RFC 3546 section 3.1) with a new > service-level option "nsi". > - "socket" option also accepts "yes" and "no" for flags. > - Nagle's algorithm is now disabled by default for improved > interactivity. > - Bugfixes > - A compilation fix was added for OpenSSL version < 1.0.0. > - Signal pipe set to non-blocking mode. This bug caused hangs of > stunnel features based on signals, e.g. local mode, FORK threading, or > configuration file reload on Unix. Win32 platform was not affected. > > > however it don't precise from which version it affects stunnel... so my try > with 11.04 is a bit risky, even if 4.29 is quite far from 4.38. > > Maybe upgrading to 12.04 could solve the issue, but I don't like to upgrade > right away (I had some bad surpise ;)) > > so compiling from source seems to be the safest option. > > Thomas. > > On Sat, Apr 7, 2012 at 07:58, Thomas Manson <dev.mansonthomas(a)gmail.com > >wrote: > > > i've just checked my setup right now and the funny thing is that I think > > it stopped working exactly at the same second of the same hour & minute > of > > the day : > > > > > > root@ns0:/var/log/stunnel4# ll > > total 940 > > drwxr-xr-x 2 stunnel4 stunnel4 4096 2012-04-07 06:25 . > > drwxr-xr-x 14 root root 4096 2012-04-07 06:25 .. > > -rw-r----- 1 stunnel4 stunnel4 0 2012-04-07 06:25 > > extranet.serviceplus-hse.com_stunnel.log > > -rw-r----- 1 stunnel4 stunnel4 926267 2012-04-07 06:25 > > extranet.serviceplus-hse.com_stunnel.log.1 > > -rw-r----- 1 stunnel4 stunnel4 0 2012-04-07 06:25 > > mansonthomas.com_stunnel.log > > -rw-r----- 1 stunnel4 stunnel4 5804 2012-04-07 06:25 > > mansonthomas.com_stunnel.log.1 > > -rw-r----- 1 stunnel4 stunnel4 0 2012-04-07 06:25 stunnel.log > > -rw-r----- 1 stunnel4 stunnel4 11710 2012-04-07 06:25 stunnel.log.1 > > root@ns0:/var/log/stunnel4# ll > > total 940 > > drwxr-xr-x 2 stunnel4 stunnel4 4096 2012-04-07 06:25 . > > drwxr-xr-x 14 root root 4096 2012-04-07 06:25 .. > > -rw-r----- 1 stunnel4 stunnel4 0 2012-04-07 06:25 > > extranet.serviceplus-hse.com_stunnel.log > > -rw-r----- 1 stunnel4 stunnel4 926267 2012-04-07 06:25 > > extranet.serviceplus-hse.com_stunnel.log.1 > > -rw-r----- 1 stunnel4 stunnel4 0 2012-04-07 06:25 > > mansonthomas.com_stunnel.log > > -rw-r----- 1 stunnel4 stunnel4 5804 2012-04-07 06:25 > > mansonthomas.com_stunnel.log.1 > > -rw-r----- 1 stunnel4 stunnel4 0 2012-04-07 06:25 stunnel.log > > -rw-r----- 1 stunnel4 stunnel4 11710 2012-04-07 06:25 stunnel.log.1 > > root@ns0:/var/log/stunnel4# tail stunnel.log.1 > > 2012.04.06 22:21:19 LOG7[4745:139677248579328]: Option TCP_NODELAY set > on > > remote socket > > 2012.04.06 22:21:19 LOG7[4745:139677248579328]: Socket closed on read > > 2012.04.06 22:21:19 LOG7[4745:139677248579328]: Sending SSL write > shutdown > > 2012.04.06 22:21:19 LOG7[4745:139677248579328]: SSL alert (write): > > warning: close notify > > 2012.04.06 22:21:19 LOG6[4745:139677248579328]: SSL_shutdown > successfully > > sent close_notify > > 2012.04.06 22:21:19 LOG7[4745:139677248579328]: SSL socket closed on > > SSL_read > > 2012.04.06 22:21:19 LOG7[4745:139677248579328]: Sending socket write > > shutdown > > 2012.04.06 22:21:19 LOG5[4745:139677248579328]: Connection closed: 206 > > bytes sent to SSL, 139 bytes sent to socket > > 2012.04.06 22:21:19 LOG7[4745:139677248579328]: Service > > https-123monsite.com finished (0 left) > > 2012.04.07 06:25:04 LOG7[4745:139677248583456]: Dispatching signals from > > the signal pipe > > root@ns0:/var/log/stunnel4# > > > > compared to my first post... : > > > > > > > > > > - 2012.04.04 06:25:04 LOG7[24778:139641780213536]: Dispatching > signals > > from the signal pipe > > - > > and at the same time (2012.04.04 06:25:04) all logs file stops : > > > > > > - root@ns0:/var/log/stunnel4# ll > > - total 128 > > - drwxr-xr-x 2 stunnel4 stunnel4 4096 2012-04-04 12:10 . > > - drwxr-xr-x 14 root root 4096 2012-04-04 06:25 .. > > - -rw-r----- 1 stunnel4 stunnel4 98084 2012-04-04 *06:25* > > extranet.serviceplus-hse.com_stunnel.log > > - -rw-r----- 1 stunnel4 stunnel4 4491 2012-04-04 06:25 > > mansonthomas.com_stunnel.log > > - -rw-r----- 1 stunnel4 stunnel4 0 2012-04-04 06:25 stunnel.log > > - -rw-r----- 1 stunnel4 stunnel4 11058 2012-04-04 06:25 stunnel.log.1 > > > > > > > > I could cron a restart at the appropriate time but I think I'll compile > > from sources. > > > > Regards, > > Thomas. > > > > On Sat, Apr 7, 2012 at 07:51, Thomas Manson <dev.mansonthomas(a)gmail.com > >wrote: > > > >> Yes, it helps a lot ! > >> > >> I've another server running a different version of Ubuntu (11.04 where > >> stunnel version is 4.29-1 instead of 11.10 and stunnel 4.35-2build1) > >> > >> Do you think it can work on older version ? > >> > >> I was thinking to try this because I've seen some message about the same > >> symptoms after upgrade so... > >> > >> but maybe the two version are too close and I will need to compile from > >> sources... > >> > >> what do you think about this? > >> > >> Regards, > >> Thomas. > >> > >> > >> On Sat, Apr 7, 2012 at 06:56, Scott Gifford <sgifford(a)suspectclass.com > >wrote: > >> > >>> On Wed, Apr 4, 2012 at 6:16 AM, Thomas Manson < > >>> dev.mansonthomas(a)gmail.com> wrote: > >>> > >>>> Hi All, > >>>> > >>>> I'm really struggling to make stunnel working for more than a few > >>>> hours. (and the client is yelling hard...) (I solved some other issue > : > >>>> logging per website and making more than one stunnel works) > >>>> > >>> > >>> Hi Thomas, > >>> > >>> I was just troubleshooting what looks like a very similar issue. I > >>> believe this is fixed in a later version of stunnel, which you can get > from > >>> stunnel.org and compile yourself from source. > >>> > >>> This is the ChangeLog entry that I think addresses your problem: > >>> > >>> - Signal pipe set to non-blocking mode. This bug caused hangs of > >>> stunnel > >>> features based on signals, e.g. local mode, FORK threading, or > >>> configuration file reload on Unix. Win32 platform was not > affected. > >>> > >>> > >>> I have just updated from the official Oneiric version to this one, so I > >>> don't yet know if it will fix the problem long-term, but I think my > odds > >>> are not too bad. > >>> > >>> Hope this helps, > >>> > >>> -----Scott. > >>> > >>> > >> > > >

1 0

Looking for help - Stunnel works with Gmail but not with my provider
by Scott McKeown 05 Apr '12

05 Apr '12

Hi Pieter, What does stunnel -version show under the 'ciphers' section? Also have you tried this with the 'options = NO_SSLv3' commented out? ~Scott

2 2

Config for https server
by Ali Kabiri 05 Apr '12

05 Apr '12

I asked before but nobody answer Please I read manual but it's not clear for may task I have IP & Port with user and pass from HttpS server I want connect to server an use for tunneling like proxy server Please help me How config and connect to server?

2 1

MySQL through stunnel - fails after many days
by Whit Blauvelt 04 Apr '12

04 Apr '12

Hi, I have a Nagios plugin using an stunnel connection to a MySQL server across the LAN for frequent queries, where each one opens a fresh connection. Checking ulimit on both ends shows "unlimited" (I've found old discussions about that being a possible factor). There's nothing I've found in the logs to show where it's going wrong. It's just that after days of running fine, suddenly the queries start failing to connect through. Restarting stunnel on both ends immediately resolves the problem. I suppose I can just restart stunnel on both ends once a day from cron and be okay. But I'd rather find a real fix, if anyone recognizes what this would be and can point me to one. Thanks, Whit

2 2

Configure Stunnel 4.53 to Run on a Windows 2000 Machine?
by Jeff Salisbury 03 Apr '12

03 Apr '12

Greetings, we recently updated Stunnel to version 4.53 and we've discovered that Stunnel no longer runs on our Windows 2000 workstation. Here is the message in the Stunnel log: No limit detected for the number of clients stunnel 4.53 on x86-pc-mingw32-gnu platform Compiled/running with OpenSSL 0.9.8s-fips 4 Jan 2012 Threading:WIN32 SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:SELECT+IPv4 Reading configuration from file C:\bin\Stunnel\stunnel.conf FIPS_mode_set: 2D06C071: error:2D06C071:FIPS routines:FIPS_mode_set:unsupported platform Server is down Please help! Is there a configuration change or addition we can make in our Stunnel.conf file that will allow us to run v4.53 on our Windows 2000 machine? Regards, Jeff

2 1

set proxy for stunnel client
by Ebrahim Khalilzadeh 02 Apr '12

02 Apr '12

Dear Users, Hi In our network users connect to internet using http proxy. I have a configuration file like this: [proxy] accept:4444 connect:remote_ip:remote_port connecting to remote ip needs http proxy. I tested some configurations like this: [proxy] protocol = connect protocolHost = proxy_ip:proxy_port accept:4444 connect:remote_ip:remote_port or [proxy] protocol = proxy protocolHost = proxy_ip:proxy_port accept:4444 connect:remote_ip:remote_port But now no success!!! How can i set stunnel to use proxy? Regards, Ebrahim khalilzadeh --

1 0

Stunnel running for a few minutes and then stop and can't handle multiple domains
by Thomas Manson 01 Apr '12

01 Apr '12

Hi, I've setup a stunnel install to handle several website SSL part of the HTTP (then redirected to HAProxy LoadBalancer). I can successfully start one site, but if I add another website (so another stunnel conf file in /etc/stunnel) then the first is said to be already running while it's not and the second starts for real. thomas@ns0:/var/log/stunnel4$ sudo service stunnel4 start Starting SSL tunnels: [Started: /etc/stunnel/base.conf] [Started: /etc/stunnel/extranet.onesite.com.conf] *[Already running: /etc/stunnel/mansonthomas.com.conf] stunnel.* (mansonthomas.com was my first try before implementing a client website) Also, in /var/log/stunnel.log I've only the logs for base.conf, not for the two other one. What should I do to have the logs? I've tryed to add debug=7 at the beginning of the two conf file, but nothing. After some times, the extranet site https stops working... I was off in holidays for the last two weeks, so I didn't have the time to really dig into this... what would be the first steps to debug this issues ? Regards, Thomas. 2012.03.29 15:31:41 LOG5[8181:140471188047648]: Reading configuration from file /etc/stunnel/base.conf 2012.03.29 15:31:41 LOG7[8181:140471188047648]: Snagged 64 random bytes from /dev/urandom 2012.03.29 15:31:41 LOG7[8181:140471188047648]: PRNG seeded successfully 2012.03.29 15:31:41 LOG7[8181:140471188047648]: Using DH parameters from /etc/stunnel/sites/mainsite.com/mainsite.com.crt 2012.03.29 15:31:41 LOG6[8181:140471188047648]: DH initialized with 2048 bit key 2012.03.29 15:31:41 LOG7[8181:140471188047648]: ECDH initialized 2012.03.29 15:31:41 LOG7[8181:140471188047648]: Certificate: /etc/stunnel/sites/mainsite.com/mainsite.com.crt 2012.03.29 15:31:41 LOG7[8181:140471188047648]: Certificate loaded 2012.03.29 15:31:41 LOG7[8181:140471188047648]: Key file: /etc/stunnel/sites/mainsite.com/mainsite.com.key 2012.03.29 15:31:41 LOG7[8181:140471188047648]: Private key loaded 2012.03.29 15:31:41 LOG7[8181:140471188047648]: SSL context initialized for service https-mainsite.com 2012.03.29 15:31:41 LOG5[8181:140471188047648]: Configuration successful 2012.03.29 15:31:41 LOG5[8181:140471188047648]: No limit detected for the number of clients 2012.03.29 15:31:41 LOG7[8181:140471188047648]: libwrap_init: FD=3 allocated (blocking mode) 2012.03.29 15:31:41 LOG7[8181:140471188047648]: libwrap_init: FD=4 allocated (blocking mode) 2012.03.29 15:31:41 LOG7[8181:140471188047648]: libwrap_init: FD=4 allocated (blocking mode) 2012.03.29 15:31:41 LOG7[8181:140471188047648]: libwrap_init: FD=5 allocated (blocking mode) 2012.03.29 15:31:41 LOG7[8181:140471188047648]: libwrap_init: FD=5 allocated (blocking mode) 2012.03.29 15:31:41 LOG7[8181:140471188047648]: libwrap_init: FD=6 allocated (blocking mode) 2012.03.29 15:31:41 LOG7[8181:140471188047648]: libwrap_init: FD=6 allocated (blocking mode) 2012.03.29 15:31:41 LOG7[8181:140471188047648]: libwrap_init: FD=7 allocated (blocking mode) 2012.03.29 15:31:41 LOG7[8181:140471188047648]: libwrap_init: FD=7 allocated (blocking mode) 2012.03.29 15:31:41 LOG7[8181:140471188047648]: libwrap_init: FD=8 allocated (blocking mode) 2012.03.29 15:31:41 LOG7[8181:140471188047648]: signal_pipe: FD=9 allocated (blocking mode) 2012.03.29 15:31:41 LOG7[8181:140471188047648]: signal_pipe: FD=10 allocated (blocking mode) 2012.03.29 15:31:41 LOG7[8181:140471188047648]: accept socket: FD=11 allocated (non-blocking mode) 2012.03.29 15:31:41 LOG7[8181:140471188047648]: Option SO_REUSEADDR set on accept socket 2012.03.29 15:31:41 LOG7[8181:140471188047648]: Service https-mainsite.combound to 8.19.1.2:443 2012.03.29 15:31:41 LOG7[8181:140471188047648]: Service https-mainsite.comopened FD=11 2012.03.29 15:31:41 LOG7[8187:140471188047648]: Created pid file /var/run/stunnel4/stunnel4.pid 2012.03.29 15:31:41 LOG5[8187:140471188047648]: stunnel 4.35 on x86_64-pc-linux-gnu with OpenSSL 1.0.0e 6 Sep 2011 2012.03.29 15:31:41 LOG5[8187:140471188047648]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP 2012.03.29 15:31:49 LOG7[8187:140471188047648]: Dispatching signals from the signal pipe 2012.03.29 15:31:49 LOG5[8187:140471188047648]: Received signal 15; terminating 2012.03.29 15:31:49 LOG7[8187:140471188047648]: removing pid file /var/run/stunnel4/stunnel4.pid 2012.03.29 15:32:38 LOG5[8280:140481745549088]: Reading configuration from file /etc/stunnel/base.conf 2012.03.29 15:32:38 LOG7[8280:140481745549088]: Snagged 64 random bytes from /dev/urandom 2012.03.29 15:32:38 LOG7[8280:140481745549088]: PRNG seeded successfully 2012.03.29 15:32:38 LOG7[8280:140481745549088]: Using DH parameters from /etc/stunnel/sites/mainsite.com/mainsite.com.crt 2012.03.29 15:32:38 LOG6[8280:140481745549088]: DH initialized with 2048 bit key 2012.03.29 15:32:38 LOG7[8280:140481745549088]: ECDH initialized 2012.03.29 15:32:38 LOG7[8280:140481745549088]: Certificate: /etc/stunnel/sites/mainsite.com/mainsite.com.crt 2012.03.29 15:32:38 LOG7[8280:140481745549088]: Certificate loaded 2012.03.29 15:32:38 LOG7[8280:140481745549088]: Key file: /etc/stunnel/sites/mainsite.com/mainsite.com.key 2012.03.29 15:32:38 LOG7[8280:140481745549088]: Private key loaded 2012.03.29 15:32:38 LOG7[8280:140481745549088]: SSL context initialized for service https-mainsite.com 2012.03.29 15:32:38 LOG5[8280:140481745549088]: Configuration successful 2012.03.29 15:32:38 LOG5[8280:140481745549088]: No limit detected for the number of clients 2012.03.29 15:32:38 LOG7[8280:140481745549088]: libwrap_init: FD=3 allocated (blocking mode) 2012.03.29 15:32:38 LOG7[8280:140481745549088]: libwrap_init: FD=4 allocated (blocking mode) 2012.03.29 15:32:38 LOG7[8280:140481745549088]: libwrap_init: FD=4 allocated (blocking mode) 2012.03.29 15:32:38 LOG7[8280:140481745549088]: libwrap_init: FD=5 allocated (blocking mode) 2012.03.29 15:32:38 LOG7[8280:140481745549088]: libwrap_init: FD=5 allocated (blocking mode) 2012.03.29 15:32:38 LOG7[8280:140481745549088]: libwrap_init: FD=6 allocated (blocking mode) 2012.03.29 15:32:38 LOG7[8280:140481745549088]: libwrap_init: FD=6 allocated (blocking mode) 2012.03.29 15:32:38 LOG7[8280:140481745549088]: libwrap_init: FD=7 allocated (blocking mode) 2012.03.29 15:32:38 LOG7[8280:140481745549088]: libwrap_init: FD=7 allocated (blocking mode) 2012.03.29 15:32:38 LOG7[8280:140481745549088]: libwrap_init: FD=8 allocated (blocking mode) 2012.03.29 15:32:38 LOG7[8280:140481745549088]: signal_pipe: FD=9 allocated (blocking mode) 2012.03.29 15:32:38 LOG7[8280:140481745549088]: signal_pipe: FD=10 allocated (blocking mode) 2012.03.29 15:32:38 LOG7[8280:140481745549088]: accept socket: FD=11 allocated (non-blocking mode) 2012.03.29 15:32:38 LOG7[8280:140481745549088]: Option SO_REUSEADDR set on accept socket 2012.03.29 15:32:38 LOG7[8280:140481745549088]: Service https-mainsite.combound to 8.19.1.2:443 2012.03.29 15:32:38 LOG7[8280:140481745549088]: Service https-mainsite.comopened FD=11 2012.03.29 15:32:38 LOG7[8286:140481745549088]: Created pid file /var/run/stunnel4/stunnel4.pid 2012.03.29 15:32:38 LOG5[8286:140481745549088]: stunnel 4.35 on x86_64-pc-linux-gnu with OpenSSL 1.0.0e 6 Sep 2011 2012.03.29 15:32:38 LOG5[8286:140481745549088]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP

1 2

Looking for help - Stunnel works with Gmail but not with my provider
by Verberne, Pieter 31 Mar '12

31 Mar '12

Hello, I have successfully used stunnel with blat to send e-mails from my gmail accounts. Getting this to work with my new internet provider "Ziggo" in The Netherlands seems impossible, despite days spent on the internet searching for help and trying numerous configurations. Whatever I do, there is always this message: SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number Any help would be highly appreciated. Pieter Verberne PC: i7 OS: Windows 7 - 64bits Stunnel version: 4.53 When sending an e-mail from my PC with Thunderbird 2.0 I can successfully use TLS but not SSL. My provider says about secure smtp connections on their website: Outgoing mail server smtp.ziggo.nl (port number 587) Use of SSL (Secure Socket Layer) / TLS yes For this server is verification required / identity check yes User name your e-mail address Password your e-mail password Stunnel.conf: # GLOBAL OPTIONS debug = 7 output = D:\Pieter\Temp\stunnel-log.txt fips = no cert = stunnel.pem # SERVICE-LEVEL OPTIONS [SMTP Ziggo] client = yes options = NO_SSLv2 options = NO_SSLv3 sslVersion = TLSv1 accept = 587 connect = smtp.ziggo.nl:587 stunnel-log.txt: 2012.03.31 12:04:33 LOG7[2460:2516]: No limit detected for the number of clients 2012.03.31 12:04:33 LOG5[2460:2516]: stunnel 4.53 on x86-pc-mingw32-gnu platform 2012.03.31 12:04:33 LOG5[2460:2516]: Compiled/running with OpenSSL 0.9.8s-fips 4 Jan 2012 2012.03.31 12:04:33 LOG5[2460:2516]: Threading:WIN32 SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:SELECT+IPv6 2012.03.31 12:04:33 LOG5[2460:2516]: Reading configuration from file stunnel.conf 2012.03.31 12:04:33 LOG5[2460:2516]: FIPS mode is disabled 2012.03.31 12:04:33 LOG7[2460:2516]: Compression not enabled 2012.03.31 12:04:34 LOG7[2460:2516]: Snagged 64 random bytes from C:/.rnd 2012.03.31 12:04:34 LOG7[2460:2516]: Wrote 1024 new random bytes to C:/.rnd 2012.03.31 12:04:34 LOG7[2460:2516]: PRNG seeded successfully 2012.03.31 12:04:34 LOG6[2460:2516]: Initializing service section [SMTP Ziggo] 2012.03.31 12:04:34 LOG7[2460:2516]: Certificate: stunnel.pem 2012.03.31 12:04:34 LOG7[2460:2516]: Certificate loaded 2012.03.31 12:04:34 LOG7[2460:2516]: Key file: stunnel.pem 2012.03.31 12:04:34 LOG7[2460:2516]: Private key loaded 2012.03.31 12:04:34 LOG7[2460:2516]: SSL options set: 0x03000004 2012.03.31 12:04:34 LOG5[2460:2516]: Configuration successful 2012.03.31 12:04:34 LOG7[2460:2516]: Service [SMTP Ziggo] (FD=308) bound to 0.0.0.0:587 2012.03.31 12:06:01 LOG7[2460:2516]: Service [SMTP Ziggo] accepted (FD=436) from 192.168.3.11:49195 2012.03.31 12:06:01 LOG7[2460:2516]: Creating a new thread 2012.03.31 12:06:01 LOG7[2460:2516]: New thread created 2012.03.31 12:06:01 LOG7[2460:3652]: Service [SMTP Ziggo] started 2012.03.31 12:06:01 LOG5[2460:3652]: Service [SMTP Ziggo] accepted connection from 192.168.3.11:49195 2012.03.31 12:06:01 LOG6[2460:3652]: connect_blocking: connecting 212.xx.xx.x:587 2012.03.31 12:06:01 LOG7[2460:3652]: connect_blocking: s_poll_wait 212.xx.xx.x:587: waiting 10 seconds 2012.03.31 12:06:01 LOG5[2460:3652]: connect_blocking: connected 212.xx.xx.x:587 2012.03.31 12:06:01 LOG5[2460:3652]: Service [SMTP Ziggo] connected remote server from 192.168.3.11:49196 2012.03.31 12:06:01 LOG7[2460:3652]: Remote socket (FD=460) initialized 2012.03.31 12:06:01 LOG3[2460:3652]: *SSL_connect: 1408F10B: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number* 2012.03.31 12:06:01 LOG5[2460:3652]: Connection reset: 0 byte(s) sent to SSL, 0 byte(s) sent to socket 2012.03.31 12:06:01 LOG7[2460:3652]: Remote socket (FD=460) closed 2012.03.31 12:06:01 LOG7[2460:3652]: Local socket (FD=436) closed 2012.03.31 12:06:01 LOG7[2460:3652]: Service [SMTP Ziggo] finished (0 left) 2012.03.31 12:18:01 LOG7[2460:2516]: Dispatching signals from the signal pipe 2012.03.31 12:18:04 LOG7[2460:2516]: Processing SIGNAL_TERMINATE

1 0

Re: [stunnel-users] stunnel 4.53 make error
by Scott McKeown 30 Mar '12

30 Mar '12

Hi Jose, That did it, thanks. Stupid thing is I check that I had OpenSSL but not the devel package. Mark one up for my stupidity (again). ~Yours, Scott On 30 March 2012 16:11, <josealf(a)rocketmail.com> wrote: > Scott, > > Most likely you don't have openssl-devel package installed. > > Regards > Jose > > -----Original Message----- > From: Scott McKeown <scott(a)loadbalancer.org> > Sender: stunnel-users-bounces(a)stunnel.org > Date: Fri, 30 Mar 2012 16:00:45 > To: <stunnel-users(a)stunnel.org> > Subject: [stunnel-users] stunnel 4.53 make error > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > >

1 0

stunnel 4.53 make error
by Scott McKeown 30 Mar '12

30 Mar '12

Hi Guys, Just tried to install stunnel-4.53 onto a virgin Cento6.2 x64 system with HAProxy (box is fully patched too), However, every time I runt the 'make' command I get the following output. I've had a bit of a hunt around but this is a little outside of both my comfort zone and my knowledge levels so any help would be great. [root@localhost ~]# cd /root/stunnel-4.53 [root@localhost stunnel-4.53]# make Making all in src make[1]: Entering directory `/root/stunnel-4.53/src' make all-am make[2]: Entering directory `/root/stunnel-4.53/src' gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr//include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -fPIE -g -O2 -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-str.o -MD -MP -MF .deps/stunnel-str.Tpo -c -o stunnel-str.o `test -f 'str.c' || echo './'`str.c In file included from str.c:38: common.h:392:33: error: openssl/opensslconf.h: No such file or directory common.h:405:27: error: openssl/lhash.h: No such file or directory common.h:406:25: error: openssl/ssl.h: No such file or directory common.h:407:25: error: openssl/err.h: No such file or directory common.h:408:66: error: openssl/crypto.h: No such file or directory common.h:409:26: error: openssl/rand.h: No such file or directory common.h:411:25: error: openssl/md4.h: No such file or directory common.h:413:25: error: openssl/des.h: No such file or directory In file included from str.c:38: common.h:449: warning: return type defaults to ‘int’ common.h: In function ‘STACK_OF’: common.h:449: error: expected declaration specifiers before ‘*’ token In file included from str.c:39: prototypes.h:50: error: storage class specified for parameter ‘LOG_MODE’ prototypes.h:61: error: storage class specified for parameter ‘SOCKADDR_UNION’ prototypes.h:64: error: expected specifier-qualifier-list before ‘SOCKADDR_UNION’ prototypes.h:67: warning: struct has no members prototypes.h:67: error: storage class specified for parameter ‘SOCKADDR_LIST’ prototypes.h:72: error: storage class specified for parameter ‘COMP_TYPE’ prototypes.h:78: error: expected specifier-qualifier-list before ‘COMP_TYPE’ prototypes.h:114: warning: struct has no members prototypes.h:114: error: storage class specified for parameter ‘GLOBAL_OPTIONS’ prototypes.h:116: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘global_options’ prototypes.h:124: error: expected specifier-qualifier-list before ‘SSL_CTX’ prototypes.h:222: error: storage class specified for parameter ‘SERVICE_OPTIONS’ prototypes.h:224: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘service_options’ prototypes.h:236: error: storage class specified for parameter ‘VAL_TYPE’ prototypes.h:244: error: storage class specified for parameter ‘OPT_UNION’ prototypes.h:250: error: expected specifier-qualifier-list before ‘VAL_TYPE’ prototypes.h:252: error: storage class specified for parameter ‘SOCK_OPT’ prototypes.h:256: error: storage class specified for parameter ‘CONF_TYPE’ prototypes.h:269: error: storage class specified for parameter ‘s_poll_set’ prototypes.h:278: error: storage class specified for parameter ‘DISK_FILE’ prototypes.h:285: error: storage class specified for parameter ‘FD’ prototypes.h:290: error: storage class specified for parameter ‘max_clients’ prototypes.h:291: error: storage class specified for parameter ‘num_clients’ prototypes.h:327: warning: parameter names (without types) in function declaration prototypes.h:347: error: storage class specified for parameter ‘cli_index’ prototypes.h:347: error: storage class specified for parameter ‘opt_index’ prototypes.h:350: error: expected ‘)’ before ‘*’ token prototypes.h:355: error: expected declaration specifiers or ‘...’ before ‘CONF_TYPE’ prototypes.h:361: error: expected specifier-qualifier-list before ‘SERVICE_OPTIONS’ prototypes.h:363: warning: struct has no members prototypes.h:363: error: storage class specified for parameter ‘UI_DATA’ prototypes.h:365: error: expected ‘)’ before ‘*’ token prototypes.h:370: error: expected ‘)’ before ‘*’ token prototypes.h:374: error: expected declaration specifiers before ‘s_poll_set’ prototypes.h:375: error: expected ‘)’ before ‘*’ token prototypes.h:376: error: expected ‘)’ before ‘*’ token prototypes.h:377: error: expected ‘)’ before ‘*’ token prototypes.h:378: error: expected ‘)’ before ‘*’ token prototypes.h:379: error: expected ‘)’ before ‘*’ token prototypes.h:380: error: expected ‘)’ before ‘*’ token prototypes.h:381: error: expected ‘)’ before ‘*’ token prototypes.h:401: error: expected specifier-qualifier-list before ‘SSL’ prototypes.h:422: error: storage class specified for parameter ‘CLI’ prototypes.h:424: error: expected declaration specifiers before ‘CLI’ prototypes.h:426: error: expected ‘)’ before ‘*’ token prototypes.h:430: error: expected ‘)’ before ‘*’ token prototypes.h:431: error: expected ‘)’ before ‘*’ token prototypes.h:432: error: expected ‘)’ before ‘*’ token prototypes.h:433: error: expected ‘)’ before ‘*’ token prototypes.h:434: error: expected ‘)’ before ‘*’ token prototypes.h:436: error: expected ‘)’ before ‘*’ token prototypes.h:450: error: storage class specified for parameter ‘PROTOCOL_TYPE’ prototypes.h:453: error: expected ‘)’ before ‘*’ token prototypes.h:457: error: expected ‘)’ before ‘*’ token prototypes.h:458: error: expected ‘)’ before ‘*’ token prototypes.h:459: error: expected ‘)’ before ‘*’ token prototypes.h:460: error: expected ‘)’ before ‘*’ token prototypes.h:461: error: expected ‘)’ before ‘*’ token prototypes.h:462: warning: type defaults to ‘int’ in declaration of ‘SOCKADDR_UNION’ prototypes.h:462: error: expected ‘;’, ‘,’ or ‘)’ before ‘*’ token prototypes.h:493: error: storage class specified for parameter ‘SECTION_CODE’ prototypes.h:495: warning: parameter names (without types) in function declaration prototypes.h:496: warning: parameter names (without types) in function declaration prototypes.h:500: error: expected declaration specifiers or ‘...’ before ‘CLI’ prototypes.h:548: error: expected declaration specifiers before ‘DISK_FILE’ prototypes.h:550: error: expected declaration specifiers before ‘DISK_FILE’ prototypes.h:551: error: expected ‘)’ before ‘*’ token prototypes.h:552: error: expected ‘)’ before ‘*’ token prototypes.h:553: error: expected ‘)’ before ‘*’ token prototypes.h:563: error: expected ‘)’ before ‘*’ token str.c:49: error: storage class specified for parameter ‘canary’ str.c:50: error: storage class specified for parameter ‘canary_initialized’ str.c:50: error: parameter ‘canary_initialized’ is initialized str.c:52: error: storage class specified for parameter ‘ALLOC_LIST’ str.c:55: error: expected specifier-qualifier-list before ‘ALLOC_LIST’ str.c:57: warning: struct has no members str.c:57: error: storage class specified for parameter ‘ALLOC_TLS’ str.c:60: error: expected specifier-qualifier-list before ‘ALLOC_LIST’ str.c:67: warning: struct has no members str.c:59: warning: empty declaration str.c:73: error: expected ‘)’ before ‘*’ token str.c:74: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘*’ token str.c:75: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘*’ token str.c:77: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:85: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:95: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:157: error: storage class specified for parameter ‘pthread_key’ str.c:159: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:163: error: expected ‘)’ before ‘*’ token str.c:167: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘*’ token str.c:191: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:198: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:210: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:228: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:262: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:291: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:315: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘{’ token str.c:326: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘*’ token common.h:449: warning: type of ‘SSL_COMP’ defaults to ‘int’ str.c:157: error: declaration for parameter ‘pthread_key’ but no such parameter str.c:57: error: declaration for parameter ‘ALLOC_TLS’ but no such parameter str.c:52: error: declaration for parameter ‘ALLOC_LIST’ but no such parameter str.c:50: error: declaration for parameter ‘canary_initialized’ but no such parameter str.c:49: error: declaration for parameter ‘canary’ but no such parameter prototypes.h:581: error: declaration for parameter ‘str_printf’ but no such parameter prototypes.h:580: error: declaration for parameter ‘str_vprintf’ but no such parameter prototypes.h:579: error: declaration for parameter ‘str_dup’ but no such parameter prototypes.h:577: error: declaration for parameter ‘str_free_debug’ but no such parameter prototypes.h:575: error: declaration for parameter ‘str_detach_debug’ but no such parameter prototypes.h:573: error: declaration for parameter ‘str_realloc_debug’ but no such parameter prototypes.h:571: error: declaration for parameter ‘str_alloc_debug’ but no such parameter prototypes.h:570: error: declaration for parameter ‘str_stats’ but no such parameter prototypes.h:569: error: declaration for parameter ‘str_cleanup’ but no such parameter prototypes.h:568: error: declaration for parameter ‘str_canary_init’ but no such parameter prototypes.h:567: error: declaration for parameter ‘str_init’ but no such parameter prototypes.h:562: error: declaration for parameter ‘libwrap_init’ but no such parameter prototypes.h:500: error: declaration for parameter ‘create_client’ but no such parameter prototypes.h:499: error: declaration for parameter ‘stunnel_thread_id’ but no such parameter prototypes.h:498: error: declaration for parameter ‘stunnel_process_id’ but no such parameter prototypes.h:497: error: declaration for parameter ‘sthreads_init’ but no such parameter prototypes.h:496: error: declaration for parameter ‘leave_critical_section’ but no such parameter prototypes.h:495: error: declaration for parameter ‘enter_critical_section’ but no such parameter prototypes.h:493: error: declaration for parameter ‘SECTION_CODE’ but no such parameter prototypes.h:463: error: declaration for parameter ‘s_gai_strerror’ but no such parameter prototypes.h:452: error: declaration for parameter ‘find_protocol_id’ but no such parameter prototypes.h:450: error: declaration for parameter ‘PROTOCOL_TYPE’ but no such parameter prototypes.h:425: error: declaration for parameter ‘client_thread’ but no such parameter prototypes.h:422: error: declaration for parameter ‘CLI’ but no such parameter prototypes.h:395: error: declaration for parameter ‘make_sockets’ but no such parameter prototypes.h:394: error: declaration for parameter ‘get_socket_error’ but no such parameter prototypes.h:393: error: declaration for parameter ‘set_socket_options’ but no such parameter prototypes.h:366: error: declaration for parameter ‘sslerror’ but no such parameter prototypes.h:363: error: declaration for parameter ‘UI_DATA’ but no such parameter prototypes.h:356: error: declaration for parameter ‘apply_conf’ but no such parameter prototypes.h:355: error: declaration for parameter ‘parse_conf’ but no such parameter prototypes.h:354: error: declaration for parameter ‘parse_commandline’ but no such parameter prototypes.h:349: error: declaration for parameter ‘ssl_init’ but no such parameter prototypes.h:347: error: declaration for parameter ‘opt_index’ but no such parameter prototypes.h:347: error: declaration for parameter ‘cli_index’ but no such parameter prototypes.h:343: error: declaration for parameter ‘pty_allocate’ but no such parameter prototypes.h:339: error: declaration for parameter ‘s_strerror’ but no such parameter prototypes.h:338: error: declaration for parameter ‘log_error’ but no such parameter prototypes.h:337: error: declaration for parameter ‘sockerror’ but no such parameter prototypes.h:336: error: declaration for parameter ‘ioerror’ but no such parameter prototypes.h:334: error: declaration for parameter ‘fatal_debug’ but no such parameter prototypes.h:328: error: declaration for parameter ‘s_log’ but no such parameter prototypes.h:327: error: declaration for parameter ‘log_flush’ but no such parameter prototypes.h:326: error: declaration for parameter ‘log_close’ but no such parameter prototypes.h:325: error: declaration for parameter ‘log_open’ but no such parameter prototypes.h:323: error: declaration for parameter ‘syslog_close’ but no such parameter prototypes.h:322: error: declaration for parameter ‘syslog_open’ but no such parameter prototypes.h:317: error: declaration for parameter ‘set_nonblock’ but no such parameter prototypes.h:316: error: declaration for parameter ‘s_accept’ but no such parameter prototypes.h:315: error: declaration for parameter ‘s_socketpair’ but no such parameter prototypes.h:314: error: declaration for parameter ‘s_pipe’ but no such parameter prototypes.h:313: error: declaration for parameter ‘s_socket’ but no such parameter prototypes.h:311: error: declaration for parameter ‘get_limits’ but no such parameter prototypes.h:306: error: declaration for parameter ‘stunnel_info’ but no such parameter prototypes.h:304: error: declaration for parameter ‘child_status’ but no such parameter prototypes.h:302: error: declaration for parameter ‘signal_post’ but no such parameter prototypes.h:300: error: declaration for parameter ‘drop_privileges’ but no such parameter prototypes.h:298: error: declaration for parameter ‘bind_ports’ but no such parameter prototypes.h:297: error: declaration for parameter ‘unbind_ports’ but no such parameter prototypes.h:296: error: declaration for parameter ‘daemon_loop’ but no such parameter prototypes.h:295: error: declaration for parameter ‘main_configure’ but no such parameter prototypes.h:294: error: declaration for parameter ‘main_initialize’ but no such parameter prototypes.h:291: error: declaration for parameter ‘num_clients’ but no such parameter prototypes.h:290: error: declaration for parameter ‘max_clients’ but no such parameter prototypes.h:285: error: declaration for parameter ‘FD’ but no such parameter prototypes.h:278: error: declaration for parameter ‘DISK_FILE’ but no such parameter prototypes.h:269: error: declaration for parameter ‘s_poll_set’ but no such parameter prototypes.h:256: error: declaration for parameter ‘CONF_TYPE’ but no such parameter prototypes.h:252: error: declaration for parameter ‘SOCK_OPT’ but no such parameter prototypes.h:244: error: declaration for parameter ‘OPT_UNION’ but no such parameter prototypes.h:236: error: declaration for parameter ‘VAL_TYPE’ but no such parameter prototypes.h:222: error: declaration for parameter ‘SERVICE_OPTIONS’ but no such parameter prototypes.h:114: error: declaration for parameter ‘GLOBAL_OPTIONS’ but no such parameter prototypes.h:72: error: declaration for parameter ‘COMP_TYPE’ but no such parameter prototypes.h:67: error: declaration for parameter ‘SOCKADDR_LIST’ but no such parameter prototypes.h:61: error: declaration for parameter ‘SOCKADDR_UNION’ but no such parameter prototypes.h:50: error: declaration for parameter ‘LOG_MODE’ but no such parameter str.c:342: error: expected ‘{’ at end of input common.h:449: warning: unused parameter ‘SSL_COMP’ str.c:157: warning: unused parameter ‘pthread_key’ str.c:57: warning: unused parameter ‘ALLOC_TLS’ str.c:52: warning: unused parameter ‘ALLOC_LIST’ str.c:50: warning: unused parameter ‘canary_initialized’ str.c:49: warning: unused parameter ‘canary’ prototypes.h:581: warning: unused parameter ‘str_printf’ prototypes.h:580: warning: unused parameter ‘str_vprintf’ prototypes.h:579: warning: unused parameter ‘str_dup’ prototypes.h:577: warning: unused parameter ‘str_free_debug’ prototypes.h:575: warning: unused parameter ‘str_detach_debug’ prototypes.h:573: warning: unused parameter ‘str_realloc_debug’ prototypes.h:571: warning: unused parameter ‘str_alloc_debug’ prototypes.h:570: warning: unused parameter ‘str_stats’ prototypes.h:569: warning: unused parameter ‘str_cleanup’ prototypes.h:568: warning: unused parameter ‘str_canary_init’ prototypes.h:567: warning: unused parameter ‘str_init’ prototypes.h:562: warning: unused parameter ‘libwrap_init’ prototypes.h:500: warning: unused parameter ‘create_client’ prototypes.h:499: warning: unused parameter ‘stunnel_thread_id’ prototypes.h:498: warning: unused parameter ‘stunnel_process_id’ prototypes.h:497: warning: unused parameter ‘sthreads_init’ prototypes.h:496: warning: unused parameter ‘leave_critical_section’ prototypes.h:495: warning: unused parameter ‘enter_critical_section’ prototypes.h:493: warning: unused parameter ‘SECTION_CODE’ prototypes.h:463: warning: unused parameter ‘s_gai_strerror’ prototypes.h:452: warning: unused parameter ‘find_protocol_id’ prototypes.h:450: warning: unused parameter ‘PROTOCOL_TYPE’ prototypes.h:425: warning: unused parameter ‘client_thread’ prototypes.h:422: warning: unused parameter ‘CLI’ prototypes.h:395: warning: unused parameter ‘make_sockets’ prototypes.h:394: warning: unused parameter ‘get_socket_error’ prototypes.h:393: warning: unused parameter ‘set_socket_options’ prototypes.h:366: warning: unused parameter ‘sslerror’ prototypes.h:363: warning: unused parameter ‘UI_DATA’ prototypes.h:356: warning: unused parameter ‘apply_conf’ prototypes.h:355: warning: unused parameter ‘parse_conf’ prototypes.h:354: warning: unused parameter ‘parse_commandline’ prototypes.h:349: warning: unused parameter ‘ssl_init’ prototypes.h:347: warning: unused parameter ‘opt_index’ prototypes.h:347: warning: unused parameter ‘cli_index’ prototypes.h:343: warning: unused parameter ‘pty_allocate’ prototypes.h:339: warning: unused parameter ‘s_strerror’ prototypes.h:338: warning: unused parameter ‘log_error’ prototypes.h:337: warning: unused parameter ‘sockerror’ prototypes.h:336: warning: unused parameter ‘ioerror’ prototypes.h:334: warning: unused parameter ‘fatal_debug’ prototypes.h:328: warning: unused parameter ‘s_log’ prototypes.h:327: warning: unused parameter ‘log_flush’ prototypes.h:326: warning: unused parameter ‘log_close’ prototypes.h:325: warning: unused parameter ‘log_open’ prototypes.h:323: warning: unused parameter ‘syslog_close’ prototypes.h:322: warning: unused parameter ‘syslog_open’ prototypes.h:317: warning: unused parameter ‘set_nonblock’ prototypes.h:316: warning: unused parameter ‘s_accept’ prototypes.h:315: warning: unused parameter ‘s_socketpair’ prototypes.h:314: warning: unused parameter ‘s_pipe’ prototypes.h:313: warning: unused parameter ‘s_socket’ prototypes.h:311: warning: unused parameter ‘get_limits’ prototypes.h:306: warning: unused parameter ‘stunnel_info’ prototypes.h:304: warning: unused parameter ‘child_status’ prototypes.h:302: warning: unused parameter ‘signal_post’ prototypes.h:300: warning: unused parameter ‘drop_privileges’ prototypes.h:298: warning: unused parameter ‘bind_ports’ prototypes.h:297: warning: unused parameter ‘unbind_ports’ prototypes.h:296: warning: unused parameter ‘daemon_loop’ prototypes.h:295: warning: unused parameter ‘main_configure’ prototypes.h:294: warning: unused parameter ‘main_initialize’ prototypes.h:291: warning: unused parameter ‘num_clients’ prototypes.h:290: warning: unused parameter ‘max_clients’ prototypes.h:285: warning: unused parameter ‘FD’ prototypes.h:278: warning: unused parameter ‘DISK_FILE’ prototypes.h:269: warning: unused parameter ‘s_poll_set’ prototypes.h:256: warning: unused parameter ‘CONF_TYPE’ prototypes.h:252: warning: unused parameter ‘SOCK_OPT’ prototypes.h:244: warning: unused parameter ‘OPT_UNION’ prototypes.h:236: warning: unused parameter ‘VAL_TYPE’ prototypes.h:222: warning: unused parameter ‘SERVICE_OPTIONS’ prototypes.h:114: warning: unused parameter ‘GLOBAL_OPTIONS’ prototypes.h:72: warning: unused parameter ‘COMP_TYPE’ prototypes.h:67: warning: unused parameter ‘SOCKADDR_LIST’ prototypes.h:61: warning: unused parameter ‘SOCKADDR_UNION’ prototypes.h:50: warning: unused parameter ‘LOG_MODE’ make[2]: *** [stunnel-str.o] Error 1 make[2]: Leaving directory `/root/stunnel-4.53/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/root/stunnel-4.53/src' make: *** [all-recursive] Error 1 [root@localhost stunnel-4.53]# ~Yours, Scott

1 0

SNI with protocol=proxy ?
by Marek Majkowski 29 Mar '12

29 Mar '12

Hi, I'm having trouble using SNI with protocol=proxy. Stunnel seems to ignore protocol option defined in the 'children', for example now protocol will be ignored: [https_default] accept = 443 connect = 10443 cert = a.crt key = a.key [https_one] sni = https_default:one.org protocol = proxy connect = 10444 cert = one.crt key = one.key On the other hand when defined on the 'default' resource, the connect option seems to be ignored: [https_default] accept = 443 protocol = proxy connect = 10443 cert = a.crt key = a.key [https_one] sni = https_default:one.org connect = 10444 ;; nope! still 10443 cert = one.crt key = one.key Any suggestions? Cheers, Marek

3 6

RMI with SSL
by Anoop Joseph 29 Mar '12

29 Mar '12

Hi, We have an existing RMI server which is not SSL aware and is based on Java version 1.4.1. We want to use stunnel to make this existing RMI server SSL aware. Checking the official website of stunnel the support to following protocols were found cifs , connect, imap, nntp, pgsql, pop3, proxy and smtp. As no reference to JRMP was available, wondering if stunnel can be used to make the existing non SSL RMI server SSL aware. If this is possible then we belive that it would be achived by providing the mapping between the port configured with stunel and the existing port used by RMI. Also the eixsitng RMI server would have to undergo minial change using this approach. Your help is highly appreciated. Thanks in advance. Best Regards, Anoop

1 0

Unable to clean compile
by Jeffrey Walton 26 Mar '12

26 Mar '12

Hi All, A clean compile is a security gate for me, and I'm having problems meeting the goal on a Fedora 14 box (x64). Jeff [jeffrey@studio stunnel-4.53]$ ./configure CFLAGS="-Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap" configure: **************************************** initialization checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking for a thread-safe mkdir -p... /bin/mkdir -p checking for gawk... gawk checking whether make sets $(MAKE)... yes checking build system type... x86_64-unknown-linux-gnu checking host system type... x86_64-unknown-linux-gnu checking for gcc... gcc checking whether the C compiler works... yes checking for C compiler default output file name... a.out ... configure: **************************************** success [jeffrey@studio stunnel-4.53]$ make clean [jeffrey@studio stunnel-4.53]$ make Making all in src make[1]: Entering directory `/home/jeffrey/stunnel-4.53/src' make all-am make[2]: Entering directory `/home/jeffrey/stunnel-4.53/src' /bin/sh ../libtool --tag=CC --mode=compile gcc -DHAVE_CONFIG_H -I. -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -MT env.lo -MD -MP -MF .deps/env.Tpo -c -o env.lo env.c libtool: compile: gcc -DHAVE_CONFIG_H -I. -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -MT env.lo -MD -MP -MF .deps/env.Tpo -c env.c -fPIC -DPIC -o .libs/env.o env.c: In function ‘getpeername’: env.c:64:9: warning: conversion to ‘uint16_t’ from ‘int’ may alter its value mv -f .deps/env.Tpo .deps/env.Plo /bin/sh ../libtool --tag=CC --mode=link gcc -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -avoid-version -o libstunnel.la -rpath /usr/local/lib/stunnel env.lo -lz -ldl -lutil -lnsl -lpthread libtool: link: gcc -shared .libs/env.o -lz -ldl -lutil -lnsl -lpthread -Wl,-z -Wl,relro -Wl,-z -Wl,now -Wl,-z -Wl,noexecstack -Wl,-z -Wl,noexecheap -Wl,-soname -Wl,libstunnel.so -o .libs/libstunnel.so libtool: link: ( cd ".libs" && rm -f "libstunnel.la" && ln -s "../libstunnel.la" "libstunnel.la" ) gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr//include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -fPIE -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-str.o -MD -MP -MF .deps/stunnel-str.Tpo -c -o stunnel-str.o `test -f 'str.c' || echo './'`str.c str.c: In function ‘str_vprintf’: str.c:100:5: warning: conversion to ‘size_t’ from ‘int’ may change the sign of the result str.c:103:9: warning: conversion to ‘size_t’ from ‘int’ may change the sign of the result str.c:110:9: warning: conversion to ‘size_t’ from ‘int’ may change the sign of the result mv -f .deps/stunnel-str.Tpo .deps/stunnel-str.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr//include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -fPIE -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-file.o -MD -MP -MF .deps/stunnel-file.Tpo -c -o stunnel-file.o `test -f 'file.c' || echo './'`file.c file.c: In function ‘file_getline’: file.c:136:9: warning: conversion to ‘int’ from ‘ssize_t’ may alter its value file.c: In function ‘file_putline’: file.c:162:5: warning: conversion to ‘int’ from ‘size_t’ may alter its value file.c:163:5: warning: conversion to ‘size_t’ from ‘int’ may change the sign of the result file.c:173:5: warning: conversion to ‘size_t’ from ‘int’ may change the sign of the result file.c:173:5: warning: conversion to ‘int’ from ‘ssize_t’ may alter its value mv -f .deps/stunnel-file.Tpo .deps/stunnel-file.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr//include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -fPIE -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-client.o -MD -MP -MF .deps/stunnel-client.Tpo -c -o stunnel-client.o `test -f 'client.c' || echo './'`client.c client.c: In function ‘transfer’: client.c:647:13: warning: conversion to ‘size_t’ from ‘int’ may change the sign of the result client.c:647:13: warning: conversion to ‘int’ from ‘ssize_t’ may alter its value client.c:665:13: warning: conversion to ‘size_t’ from ‘int’ may change the sign of the result client.c:665:13: warning: conversion to ‘int’ from ‘ssize_t’ may alter its value client.c:675:17: warning: conversion to ‘size_t’ from ‘int’ may change the sign of the result client.c:750:17: warning: conversion to ‘size_t’ from ‘int’ may change the sign of the result client.c: In function ‘auth_user’: client.c:930:9: warning: conversion to ‘in_port_t’ from ‘int’ may alter its value client.c: In function ‘connect_remote’: client.c:1110:13: warning: conversion to ‘u16’ from ‘int’ may alter its value mv -f .deps/stunnel-client.Tpo .deps/stunnel-client.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr//include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -fPIE -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-log.o -MD -MP -MF .deps/stunnel-log.Tpo -c -o stunnel-log.o `test -f 'log.c' || echo './'`log.c mv -f .deps/stunnel-log.Tpo .deps/stunnel-log.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr//include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -fPIE -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-options.o -MD -MP -MF .deps/stunnel-options.Tpo -c -o stunnel-options.o `test -f 'options.c' || echo './'`options.c options.c: In function ‘parse_global_option’: options.c:362:9: warning: conversion to ‘int’ from ‘long int’ may alter its value options.c:448:13: warning: conversion to ‘int’ from ‘__gid_t’ may change the sign of the result options.c:451:9: warning: conversion to ‘int’ from ‘long int’ may alter its value options.c:474:13: warning: conversion to ‘int’ from ‘__uid_t’ may change the sign of the result options.c:477:9: warning: conversion to ‘int’ from ‘long int’ may alter its value options.c: In function ‘parse_service_option’: options.c:840:9: warning: conversion to ‘int’ from ‘long int’ may alter its value options.c:1039:9: warning: conversion to ‘int’ from ‘long unsigned int’ may alter its value options.c:1042:9: warning: conversion to ‘long unsigned int’ from ‘int’ may change the sign of the result options.c:1346:9: warning: conversion to ‘int’ from ‘long int’ may alter its value options.c:1367:9: warning: conversion to ‘int’ from ‘long int’ may alter its value options.c:1387:9: warning: conversion to ‘int’ from ‘long int’ may alter its value options.c:1408:9: warning: conversion to ‘int’ from ‘long int’ may alter its value options.c:1428:9: warning: conversion to ‘int’ from ‘long int’ may alter its value options.c:1485:9: warning: conversion to ‘int’ from ‘long int’ may alter its value options.c: In function ‘parse_conf’: options.c:1585:9: warning: conversion to ‘int’ from ‘long int’ may alter its value options.c:1620:9: warning: conversion to ‘int’ from ‘size_t’ may alter its value options.c:1651:9: warning: conversion to ‘int’ from ‘size_t’ may alter its value options.c: In function ‘parse_ssl_option’: options.c:2004:13: warning: conversion to ‘int’ from ‘long int’ may alter its value options.c: In function ‘parse_socket_option’: options.c:2162:9: warning: conversion to ‘int’ from ‘long int’ may alter its value options.c: In function ‘argalloc’: options.c:2391:5: warning: conversion to ‘int’ from ‘size_t’ may alter its value options.c:2393:5: warning: conversion to ‘long unsigned int’ from ‘int’ may change the sign of the result mv -f .deps/stunnel-options.Tpo .deps/stunnel-options.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr//include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -fPIE -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-protocol.o -MD -MP -MF .deps/stunnel-protocol.Tpo -c -o stunnel-protocol.o `test -f 'protocol.c' || echo './'`protocol.c protocol.c: In function ‘cifs_server’: protocol.c:200:5: warning: conversion to ‘u16’ from ‘int’ may alter its value protocol.c: In function ‘connect_client’: protocol.c:531:13: warning: conversion to ‘int’ from ‘size_t’ may alter its value protocol.c: In function ‘ntlm’: protocol.c:607:9: warning: conversion to ‘int’ from ‘long int’ may alter its value protocol.c: In function ‘ntlm3’: protocol.c:640:5: warning: conversion to ‘unsigned int’ from ‘size_t’ may alter its value protocol.c:641:5: warning: conversion to ‘unsigned int’ from ‘long unsigned int’ may alter its value protocol.c:647:5: warning: conversion to ‘char’ from ‘unsigned int’ may alter its value protocol.c:651:5: warning: conversion to ‘char’ from ‘unsigned int’ may alter its value protocol.c:652:5: warning: conversion to ‘char’ from ‘unsigned int’ may alter its value protocol.c:653:5: warning: conversion to ‘char’ from ‘unsigned int’ may alter its value protocol.c:655:5: warning: conversion to ‘char’ from ‘unsigned int’ may alter its value protocol.c:656:5: warning: conversion to ‘char’ from ‘unsigned int’ may alter its value protocol.c:670:5: warning: conversion to ‘int’ from ‘size_t’ may alter its value protocol.c:683:5: warning: conversion to ‘int’ from ‘unsigned int’ may change the sign of the result protocol.c: In function ‘crypt_DES’: protocol.c:692:5: warning: conversion to ‘unsigned char’ from ‘int’ may alter its value protocol.c:693:5: warning: conversion to ‘unsigned char’ from ‘int’ may alter its value protocol.c:694:5: warning: conversion to ‘unsigned char’ from ‘int’ may alter its value protocol.c:695:5: warning: conversion to ‘unsigned char’ from ‘int’ may alter its value protocol.c:696:5: warning: conversion to ‘unsigned char’ from ‘int’ may alter its value protocol.c:697:5: warning: conversion to ‘unsigned char’ from ‘int’ may alter its value protocol.c:698:5: warning: conversion to ‘unsigned char’ from ‘int’ may alter its value protocol.c: In function ‘base64’: protocol.c:736:5: warning: conversion to ‘size_t’ from ‘int’ may change the sign of the result mv -f .deps/stunnel-protocol.Tpo .deps/stunnel-protocol.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr//include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -fPIE -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-network.o -MD -MP -MF .deps/stunnel-network.Tpo -c -o stunnel-network.o `test -f 'network.c' || echo './'`network.c network.c: In function ‘set_socket_options’: network.c:376:13: warning: conversion to ‘int’ from ‘size_t’ may alter its value network.c:382:17: warning: conversion to ‘socklen_t’ from ‘int’ may change the sign of the result network.c: In function ‘write_blocking’: network.c:492:9: warning: conversion to ‘size_t’ from ‘int’ may change the sign of the result network.c:492:9: warning: conversion to ‘int’ from ‘ssize_t’ may alter its value network.c: In function ‘read_blocking’: network.c:524:9: warning: conversion to ‘size_t’ from ‘int’ may change the sign of the result network.c:524:9: warning: conversion to ‘int’ from ‘ssize_t’ may alter its value network.c: In function ‘fd_putline’: network.c:544:5: warning: conversion to ‘int’ from ‘size_t’ may alter its value network.c: In function ‘fd_getline’: network.c:576:9: warning: conversion to ‘size_t’ from ‘int’ may change the sign of the result mv -f .deps/stunnel-network.Tpo .deps/stunnel-network.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr//include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -fPIE -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-resolver.o -MD -MP -MF .deps/stunnel-resolver.Tpo -c -o stunnel-resolver.o `test -f 'resolver.c' || echo './'`resolver.c resolver.c: In function ‘name2addrlist’: resolver.c:124:9: warning: conversion to ‘long unsigned int’ from ‘int’ may change the sign of the result resolver.c: In function ‘hostport2addrlist’: resolver.c:190:9: warning: conversion to ‘long unsigned int’ from ‘int’ may change the sign of the result mv -f .deps/stunnel-resolver.Tpo .deps/stunnel-resolver.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr//include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -fPIE -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-ssl.o -MD -MP -MF .deps/stunnel-ssl.Tpo -c -o stunnel-ssl.o `test -f 'ssl.c' || echo './'`ssl.c mv -f .deps/stunnel-ssl.Tpo .deps/stunnel-ssl.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr//include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -fPIE -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-ctx.o -MD -MP -MF .deps/stunnel-ctx.Tpo -c -o stunnel-ctx.o `test -f 'ctx.c' || echo './'`ctx.c ctx.c: In function ‘context_init’: ctx.c:119:9: warning: conversion to ‘unsigned int’ from ‘size_t’ may alter its value ctx.c: In function ‘password_cb’: ctx.c:431:9: warning: conversion to ‘size_t’ from ‘int’ may change the sign of the result ctx.c:434:9: warning: conversion to ‘size_t’ from ‘int’ may change the sign of the result ctx.c:436:9: warning: conversion to ‘int’ from ‘size_t’ may alter its value ctx.c: In function ‘sess_new_cb’: ctx.c:455:5: warning: conversion to ‘size_t’ from ‘int’ may change the sign of the result ctx.c:459:9: warning: conversion to ‘unsigned int’ from ‘long int’ may alter its value ctx.c:459:9: warning: conversion to ‘unsigned int’ from ‘int’ may change the sign of the result ctx.c: In function ‘sess_get_cb’: ctx.c:472:9: warning: conversion to ‘unsigned int’ from ‘int’ may change the sign of the result ctx.c: In function ‘cache_transfer’: ctx.c:540:5: warning: conversion to ‘u_char’ from ‘unsigned int’ may alter its value ctx.c:579:5: warning: conversion to ‘int’ from ‘ssize_t’ may alter its value ctx.c:604:5: warning: conversion to ‘long unsigned int’ from ‘int’ may change the sign of the result ctx.c:604:5: warning: conversion to ‘unsigned int’ from ‘long unsigned int’ may alter its value mv -f .deps/stunnel-ctx.Tpo .deps/stunnel-ctx.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr//include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -fPIE -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-verify.o -MD -MP -MF .deps/stunnel-verify.Tpo -c -o stunnel-verify.o `test -f 'verify.c' || echo './'`verify.c verify.c: In function ‘cert_check’: verify.c:246:17: warning: conversion to ‘size_t’ from ‘int’ may change the sign of the result verify.c: In function ‘log_time’: verify.c:528:5: warning: conversion to ‘size_t’ from ‘int’ may change the sign of the result mv -f .deps/stunnel-verify.Tpo .deps/stunnel-verify.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr//include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -fPIE -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-sthreads.o -MD -MP -MF .deps/stunnel-sthreads.Tpo -c -o stunnel-sthreads.o `test -f 'sthreads.c' || echo './'`sthreads.c sthreads.c: In function ‘create_client’: sthreads.c:318:5: warning: conversion to ‘size_t’ from ‘int’ may change the sign of the result mv -f .deps/stunnel-sthreads.Tpo .deps/stunnel-sthreads.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr//include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -fPIE -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-fd.o -MD -MP -MF .deps/stunnel-fd.Tpo -c -o stunnel-fd.o `test -f 'fd.c' || echo './'`fd.c fd.c: In function ‘get_limits’: fd.c:64:5: warning: conversion to ‘int’ from ‘long int’ may alter its value mv -f .deps/stunnel-fd.Tpo .deps/stunnel-fd.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr//include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -fPIE -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-stunnel.o -MD -MP -MF .deps/stunnel-stunnel.Tpo -c -o stunnel-stunnel.o `test -f 'stunnel.c' || echo './'`stunnel.c stunnel.c: In function ‘drop_privileges’: stunnel.c:410:9: warning: conversion to ‘__gid_t’ from ‘int’ may change the sign of the result stunnel.c:415:9: warning: conversion to ‘gid_t’ from ‘int’ may change the sign of the result stunnel.c:423:9: warning: conversion to ‘__uid_t’ from ‘int’ may change the sign of the result mv -f .deps/stunnel-stunnel.Tpo .deps/stunnel-stunnel.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr//include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -fPIE -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-pty.o -MD -MP -MF .deps/stunnel-pty.Tpo -c -o stunnel-pty.o `test -f 'pty.c' || echo './'`pty.c mv -f .deps/stunnel-pty.Tpo .deps/stunnel-pty.Po gcc -DHAVE_CONFIG_H -I. -I/usr/kerberos/include -I/usr//include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -pthread -fstack-protector -fPIE -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -MT stunnel-libwrap.o -MD -MP -MF .deps/stunnel-libwrap.Tpo -c -o stunnel-libwrap.o `test -f 'libwrap.c' || echo './'`libwrap.c mv -f .deps/stunnel-libwrap.Tpo .deps/stunnel-libwrap.Po /bin/sh ../libtool --tag=CC --mode=link gcc -pthread -fstack-protector -fPIE -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -Wall -Wextra -Wno-long-long -pedantic -L/usr//lib64 -L/usr//lib -lssl -lcrypto -o stunnel stunnel-str.o stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-fd.o stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o -lz -ldl -lutil -lnsl -lpthread libtool: link: gcc -pthread -fstack-protector -fPIE -Wall -Wextra -Wconversion -Wformat=2 -Wformat-security -fstack-protector-all -Wl,-z -Wl,relro -Wl,-z -Wl,now -Wl,-z -Wl,noexecstack -Wl,-z -Wl,noexecheap -Wall -Wextra -Wno-long-long -pedantic -o stunnel stunnel-str.o stunnel-file.o stunnel-client.o stunnel-log.o stunnel-options.o stunnel-protocol.o stunnel-network.o stunnel-resolver.o stunnel-ssl.o stunnel-ctx.o stunnel-verify.o stunnel-sthreads.o stunnel-fd.o stunnel-stunnel.o stunnel-pty.o stunnel-libwrap.o -L/usr//lib64 -L/usr//lib -lssl -lcrypto -lz -ldl -lutil -lnsl -lpthread -pthread make[2]: Leaving directory `/home/jeffrey/stunnel-4.53/src' make[1]: Leaving directory `/home/jeffrey/stunnel-4.53/src' Making all in doc make[1]: Entering directory `/home/jeffrey/stunnel-4.53/doc' make[1]: Nothing to be done for `all'. make[1]: Leaving directory `/home/jeffrey/stunnel-4.53/doc' Making all in tools make[1]: Entering directory `/home/jeffrey/stunnel-4.53/tools' make[1]: Nothing to be done for `all'. make[1]: Leaving directory `/home/jeffrey/stunnel-4.53/tools' make[1]: Entering directory `/home/jeffrey/stunnel-4.53' make[1]: Nothing to be done for `all-am'. make[1]: Leaving directory `/home/jeffrey/stunnel-4.53' [jeffrey@studio stunnel-4.53]$

2 1

Can this be done by Stunnel
by Alan C. Bonnici 23 Mar '12

23 Mar '12

Thomas, After a few exchanges a few hours ago with the folk at STunnel I can confirm that the "problem" was that the company uses host headers. Here is the procedure I used to sort it out: 1. Modify the windows host file and add the following entry 127.0.0.1 rest.nexmo.com. If your STunnel ir running on a different machines, set the 127.0.0.1 to the IP address of the Stunnel server. 2. Add the following to the stunnel.conf file (you may alter the port) [nexmo] client = yes accept = 9013 connect = 174.120.166.82:443 TIMEOUTclose = 0 3. Start sending secure SMSs as follows (note the port number much match the one set in stunnel.conf) http://rest.nexmo.com:9013/sms/xml?username=xxxxxxx&password=xxxxxxx&from=xx xxxxxx&to=xxxxxxx&text=xxxxxxx This will bypass the issue related to host headers and I can confirm that the solution has worked. The setup is useful if using server technology that does not natively support SSL as is our case. Hope this helps. Alan ---------------------------------------------------------------------------- ---------------------------------------- Alan; While I don't generally use Stunnel for HTTPS, I found your question interesting. Since I'm always trying to experiment with configurations of and applications for Stunnel, I decided to give it a whirl. I'm happy to confirm that it works just fine for me. I'm not connecting to the site in your example, but the principle is the same. Perhaps the answer lies in how your browser parses that URL, and how, as a result, it inserts that data into the stream. For the experiment, I used Firefox 9.0.1 running under Windows XP x86 with Stunnel version 4.53. My test config was: debug = 6 fips = no delay = yes output = stunnel.log [https] client = yes accept = 127.0.1.21:7777 connect = www.host.domain:443 Where www.host.domain is just an example. As you can see, I did not include any TIMEOUTclose statement in my config file. Then I pointed the browser at http://127.0.1.21:7777/do/mypage/longparameterstringhere. As far as I can tell, all of the parameters contained in that string were passed on to the web site without any difficulty. You might want to check your log window to see what's happening when you try to connect via Stunnel. Here's an actual example of the connection activity from my log: 2012.03.22 21:20:51 LOG5[992:2548]: Service [https] accepted connection from ***.**.***.*:2671 2012.03.22 21:20:51 LOG6[992:2548]: connect_blocking: connecting ***.***.***.***:443 2012.03.22 21:20:51 LOG5[992:2548]: connect_blocking: connected ***.***.***.***:443 2012.03.22 21:20:51 LOG5[992:2548]: Service [https] connected remote server from ***.**.***.*:2672 2012.03.22 21:20:51 LOG6[992:2548]: SSL connected: new session negotiated 2012.03.22 21:20:51 LOG6[992:2548]: Negotiated TLSv1/SSLv3 ciphersuite: RC4-SHA (128-bit encryption) 2012.03.22 21:20:51 LOG6[992:2548]: Compression: null, expansion: null 2012.03.22 21:21:00 LOG6[992:2548]: SSL_shutdown successfully sent close_notify alert 2012.03.22 21:21:00 LOG5[992:2548]: Connection closed: 1879 byte(s) sent to SSL, 128546 byte(s) sent to socket If you have to post again, it would be helpful if you included more detail. Good luck with your application! Thomas On 3/21/2012 9:50 AM, Alan C. Bonnici wrote: > > Hi, > > I am new to STunnel. I am trying to connect to a service provided by > nexmo.com. > > If from a browser I type the following: > > https://rest.nexmo.com/sms/xml?username=xxxxxxx&password=xxxxx&from=xxxxxxx& to=xxxxxxx&text=xxxxxxxxxx > <https://rest.nexmo.com/sms/xml?username=xxxxxxx&password=xxxxx&from=xxxxxxx &to=xxxxxxx&text=xxxxxxxxxx> > > The process works. > > I just installed stunnel and have the following config file > > ; Debugging stuff (may useful for troubleshooting) > > ;debug = 7 > > ;output = stunnel.log > > ; Certificate/key is needed in server mode and optional in client mode > > cert = stunnel.pem > > ;key = stunnel.pem > > ; Disable support for insecure SSLv2 protocol > > options = NO_SSLv2 > > [nexmo] > > client = yes > > accept = 9012 > > connect = rest.nexmo.com:443 > > TIMEOUTclose = 0 > > When I type > > http://127.0.0.1:9012/sms/xml?username=xxxxxxx&password=xxxxx&from=xxxxxxx&t o=xxxxxxx&text=xxxxxxxxxx > > > it does not. > > Can anyone please confirm whether what I am trying to do is doable and > maybe highlight what I am doing wrong. > > Regards, > > Alan > > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org > http://stunnel.mirt.net/mailman/listinfo/stunnel-users -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

1 0

Can this be done by Stunnel
by Alan C. Bonnici 23 Mar '12

23 Mar '12

Hi, I am new to STunnel. I am trying to connect to a service provided by nexmo.com. If from a browser I type the following: https://rest.nexmo.com/sms/xml?username=xxxxxxx <https://rest.nexmo.com/sms/xml?username=xxxxxxx&password=xxxxx&from=xxxxxxx &to=xxxxxxx&text=xxxxxxxxxx> &password=xxxxx&from=xxxxxxx&to=xxxxxxx&text=xxxxxxxxxx The process works. I just installed stunnel and have the following config file ; Debugging stuff (may useful for troubleshooting) ;debug = 7 ;output = stunnel.log ; Certificate/key is needed in server mode and optional in client mode cert = stunnel.pem ;key = stunnel.pem ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 [nexmo] client = yes accept = 9012 connect = rest.nexmo.com:443 TIMEOUTclose = 0 When I type http://127.0.0.1:9012/sms/xml? username=xxxxxxx&password=xxxxx&from=xxxxxxx&to=xxxxxxx&text=xxxxxxxxxx it does not. Can anyone please confirm whether what I am trying to do is doable and maybe highlight what I am doing wrong. Regards, Alan

2 1

Can this be done by Stunnel [Nexmo]
by Alan C. Bonnici 22 Mar '12

22 Mar '12

Hi, Nexmo offer (free trial) SMS messages that can be programmed into systems. I've attached the log file when calling the service: 2012.03.22 10:41:13 LOG7[5024:8232]: No limit detected for the number of clients 2012.03.22 10:41:13 LOG5[5024:8232]: stunnel 4.53 on x86-pc-mingw32-gnu platform 2012.03.22 10:41:13 LOG5[5024:8232]: Compiled/running with OpenSSL 0.9.8s-fips 4 Jan 2012 2012.03.22 10:41:13 LOG5[5024:8232]: Threading:WIN32 SSL:+ENGINE+OCSP+FIPS Auth:none Sockets:SELECT+IPv6 2012.03.22 10:41:13 LOG5[5024:8232]: Reading configuration from file stunnel.conf 2012.03.22 10:41:14 LOG5[5024:8232]: FIPS mode is enabled 2012.03.22 10:41:14 LOG7[5024:8232]: Compression not enabled 2012.03.22 10:41:14 LOG7[5024:8232]: Snagged 64 random bytes from C:/.rnd 2012.03.22 10:41:14 LOG7[5024:8232]: Wrote 1024 new random bytes to C:/.rnd 2012.03.22 10:41:14 LOG7[5024:8232]: PRNG seeded successfully 2012.03.22 10:41:14 LOG6[5024:8232]: Initializing service section [nexmo] 2012.03.22 10:41:14 LOG7[5024:8232]: Certificate: stunnel.pem 2012.03.22 10:41:14 LOG7[5024:8232]: Certificate loaded 2012.03.22 10:41:14 LOG7[5024:8232]: Key file: stunnel.pem 2012.03.22 10:41:14 LOG7[5024:8232]: Private key loaded 2012.03.22 10:41:14 LOG7[5024:8232]: SSL options set: 0x01000004 2012.03.22 10:41:14 LOG5[5024:8232]: Configuration successful 2012.03.22 10:41:14 LOG7[5024:8232]: Service [nexmo] (FD=280) bound to 0.0.0.0:9012 2012.03.22 10:44:09 LOG7[5024:8232]: Service [nexmo] accepted (FD=444) from 127.0.0.1:3692 2012.03.22 10:44:09 LOG7[5024:8232]: Creating a new thread 2012.03.22 10:44:09 LOG7[5024:8232]: New thread created 2012.03.22 10:44:09 LOG7[5024:3280]: Service [nexmo] started 2012.03.22 10:44:09 LOG5[5024:3280]: Service [nexmo] accepted connection from 127.0.0.1:3692 2012.03.22 10:44:09 LOG6[5024:3280]: connect_blocking: connecting 174.120.166.82:443 2012.03.22 10:44:09 LOG7[5024:3280]: connect_blocking: s_poll_wait 174.120.166.82:443: waiting 10 seconds 2012.03.22 10:44:09 LOG5[5024:3280]: connect_blocking: connected 174.120.166.82:443 2012.03.22 10:44:09 LOG5[5024:3280]: Service [nexmo] connected remote server from 10.252.0.51:3693 2012.03.22 10:44:09 LOG7[5024:3280]: Remote socket (FD=476) initialized 2012.03.22 10:44:10 LOG7[5024:3280]: Peer certificate was cached (6499 bytes) 2012.03.22 10:44:10 LOG6[5024:3280]: SSL connected: new session negotiated 2012.03.22 10:44:10 LOG6[5024:3280]: Negotiated TLSv1/SSLv3 ciphersuite: AES256-SHA (256-bit encryption) 2012.03.22 10:44:10 LOG6[5024:3280]: Compression: null, expansion: null 2012.03.22 10:44:10 LOG7[5024:3280]: SSL closed on SSL_read 2012.03.22 10:44:10 LOG7[5024:3280]: Sent socket write shutdown 2012.03.22 10:44:10 LOG7[5024:3280]: Socket closed on read 2012.03.22 10:44:10 LOG7[5024:3280]: Sending close_notify alert 2012.03.22 10:44:10 LOG6[5024:3280]: SSL_shutdown successfully sent close_notify alert 2012.03.22 10:44:10 LOG5[5024:3280]: Connection closed: 388 byte(s) sent to SSL, 200 byte(s) sent to socket 2012.03.22 10:44:10 LOG7[5024:3280]: Remote socket (FD=476) closed 2012.03.22 10:44:10 LOG7[5024:3280]: Local socket (FD=444) closed 2012.03.22 10:44:10 LOG7[5024:3280]: Service [nexmo] finished (0 left) 2012.03.22 10:44:10 LOG7[5024:8232]: Service [nexmo] accepted (FD=440) from 127.0.0.1:3694 2012.03.22 10:44:10 LOG7[5024:8232]: Creating a new thread 2012.03.22 10:44:10 LOG7[5024:8232]: New thread created 2012.03.22 10:44:10 LOG7[5024:8864]: Service [nexmo] started 2012.03.22 10:44:10 LOG5[5024:8864]: Service [nexmo] accepted connection from 127.0.0.1:3694 2012.03.22 10:44:10 LOG6[5024:8864]: connect_blocking: connecting 174.120.166.82:443 2012.03.22 10:44:10 LOG7[5024:8864]: connect_blocking: s_poll_wait 174.120.166.82:443: waiting 10 seconds 2012.03.22 10:44:10 LOG5[5024:8864]: connect_blocking: connected 174.120.166.82:443 2012.03.22 10:44:10 LOG5[5024:8864]: Service [nexmo] connected remote server from 10.252.0.51:3695 2012.03.22 10:44:10 LOG7[5024:8864]: Remote socket (FD=424) initialized 2012.03.22 10:44:10 LOG6[5024:8864]: SSL connected: previous session reused 2012.03.22 10:44:10 LOG7[5024:8864]: SSL closed on SSL_read 2012.03.22 10:44:10 LOG7[5024:8864]: Sent socket write shutdown 2012.03.22 10:44:10 LOG7[5024:8864]: Socket closed on read 2012.03.22 10:44:10 LOG7[5024:8864]: Sending close_notify alert 2012.03.22 10:44:10 LOG6[5024:8864]: SSL_shutdown successfully sent close_notify alert 2012.03.22 10:44:10 LOG5[5024:8864]: Connection closed: 269 byte(s) sent to SSL, 200 byte(s) sent to socket 2012.03.22 10:44:10 LOG7[5024:8864]: Remote socket (FD=424) closed 2012.03.22 10:44:10 LOG7[5024:8864]: Local socket (FD=440) closed 2012.03.22 10:44:10 LOG7[5024:8864]: Service [nexmo] finished (0 left) 2012.03.22 10:44:10 LOG7[5024:8232]: Service [nexmo] accepted (FD=460) from 127.0.0.1:3696 2012.03.22 10:44:10 LOG7[5024:8232]: Creating a new thread 2012.03.22 10:44:10 LOG7[5024:8232]: New thread created 2012.03.22 10:44:10 LOG7[5024:5820]: Service [nexmo] started 2012.03.22 10:44:10 LOG5[5024:5820]: Service [nexmo] accepted connection from 127.0.0.1:3696 2012.03.22 10:44:10 LOG6[5024:5820]: connect_blocking: connecting 174.120.166.82:443 2012.03.22 10:44:10 LOG7[5024:5820]: connect_blocking: s_poll_wait 174.120.166.82:443: waiting 10 seconds 2012.03.22 10:44:11 LOG5[5024:5820]: connect_blocking: connected 174.120.166.82:443 2012.03.22 10:44:11 LOG5[5024:5820]: Service [nexmo] connected remote server from 10.252.0.51:3697 2012.03.22 10:44:11 LOG7[5024:5820]: Remote socket (FD=476) initialized 2012.03.22 10:44:11 LOG6[5024:5820]: SSL connected: previous session reused 2012.03.22 10:44:11 LOG7[5024:5820]: SSL closed on SSL_read 2012.03.22 10:44:11 LOG7[5024:5820]: Sent socket write shutdown 2012.03.22 10:44:11 LOG7[5024:5820]: Socket closed on read 2012.03.22 10:44:11 LOG7[5024:5820]: Sending close_notify alert 2012.03.22 10:44:11 LOG6[5024:5820]: SSL_shutdown successfully sent close_notify alert 2012.03.22 10:44:11 LOG5[5024:5820]: Connection closed: 299 byte(s) sent to SSL, 200 byte(s) sent to socket 2012.03.22 10:44:11 LOG7[5024:5820]: Remote socket (FD=476) closed 2012.03.22 10:44:11 LOG7[5024:5820]: Local socket (FD=460) closed 2012.03.22 10:44:11 LOG7[5024:5820]: Service [nexmo] finished (0 left) 2012.03.22 10:44:11 LOG7[5024:8232]: Service [nexmo] accepted (FD=448) from 127.0.0.1:3698 2012.03.22 10:44:11 LOG7[5024:8232]: Creating a new thread 2012.03.22 10:44:11 LOG7[5024:8232]: New thread created 2012.03.22 10:44:11 LOG7[5024:8476]: Service [nexmo] started 2012.03.22 10:44:11 LOG5[5024:8476]: Service [nexmo] accepted connection from 127.0.0.1:3698 2012.03.22 10:44:11 LOG6[5024:8476]: connect_blocking: connecting 174.120.166.82:443 2012.03.22 10:44:11 LOG7[5024:8476]: connect_blocking: s_poll_wait 174.120.166.82:443: waiting 10 seconds 2012.03.22 10:44:11 LOG5[5024:8476]: connect_blocking: connected 174.120.166.82:443 2012.03.22 10:44:11 LOG5[5024:8476]: Service [nexmo] connected remote server from 10.252.0.51:3699 2012.03.22 10:44:11 LOG7[5024:8476]: Remote socket (FD=424) initialized 2012.03.22 10:44:11 LOG6[5024:8476]: SSL connected: previous session reused 2012.03.22 10:44:12 LOG7[5024:8476]: SSL closed on SSL_read 2012.03.22 10:44:12 LOG7[5024:8476]: Sent socket write shutdown 2012.03.22 10:44:12 LOG7[5024:8476]: Socket closed on read 2012.03.22 10:44:12 LOG7[5024:8476]: Sending close_notify alert 2012.03.22 10:44:12 LOG6[5024:8476]: SSL_shutdown successfully sent close_notify alert 2012.03.22 10:44:12 LOG5[5024:8476]: Connection closed: 299 byte(s) sent to SSL, 200 byte(s) sent to socket 2012.03.22 10:44:12 LOG7[5024:8476]: Remote socket (FD=424) closed 2012.03.22 10:44:12 LOG7[5024:8476]: Local socket (FD=448) closed 2012.03.22 10:44:12 LOG7[5024:8476]: Service [nexmo] finished (0 left) ----------------------------------- Message: 4 Date: Wed, 21 Mar 2012 15:50:59 +0100 From: "Alan C. Bonnici" <chribonn(a)gmail.com> To: <stunnel-users(a)stunnel.org> Subject: [stunnel-users] Can this be done by Stunnel Message-ID: <006b01cd0772$0869f3c0$193ddb40$(a)gmail.com> Content-Type: text/plain; charset="us-ascii" Hi, I am new to STunnel. I am trying to connect to a service provided by nexmo.com. If from a browser I type the following: https://rest.nexmo.com/sms/xml?username=xxxxxxx <https://rest.nexmo.com/sms/xml?username=xxxxxxx&password=xxxxx&from=xxxxxxx &to=xxxxxxx&text=xxxxxxxxxx> &password=xxxxx&from=xxxxxxx&to=xxxxxxx&text=xxxxxxxxxx The process works. I just installed stunnel and have the following config file ; Debugging stuff (may useful for troubleshooting) ;debug = 7 ;output = stunnel.log ; Certificate/key is needed in server mode and optional in client mode cert = stunnel.pem ;key = stunnel.pem ; Disable support for insecure SSLv2 protocol options = NO_SSLv2 [nexmo] client = yes accept = 9012 connect = rest.nexmo.com:443 TIMEOUTclose = 0 When I type http://127.0.0.1:9012/sms/xml? username=xxxxxxx&password=xxxxx&from=xxxxxxx&to=xxxxxxx&text=xxxxxxxxxx it does not. Can anyone please confirm whether what I am trying to do is doable and maybe highlight what I am doing wrong. Regards, Alan

1 0

Feature request: restricting incoming IP-adress to a list of allowed adresses
by Ivanko B 22 Mar '12

22 Mar '12

also possibly with smth like callback

2 1

Intermittent connection resets
by Jordan K 22 Mar '12

22 Mar '12

Hi, I've spent the better part of the day trying to find answers on this, and haven't had much luck. I have two systems that talk to eachother via stunnel. In the last week or so, I have noticed a number of errors in the application using the tunnel (messaging application), requiring multiple re-sends, etc. This is my setup. Both server and client run CentOS 6.2, with the RPM version of stunnel. Though it isn't the latest version, I believe RedHat do release any critical bugs in their updated RPMs. I did also go through the ChangeLog but couldn't find anything implemented since 4.29 that seemed to deal with what I'm seeing. stunnel 4.29 on x86_64-unknown-linux-gnu with OpenSSL 1.0.0-fips 29 Mar 2010 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!aNULL:!eNULL:!SSLv2 key = /etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none Socket option defaults: Option Accept Local Remote OS default SO_DEBUG -- -- -- 0 SO_DONTROUTE -- -- -- 0 SO_KEEPALIVE -- -- -- 0 SO_LINGER -- -- -- 0:0 SO_OOBINLINE -- -- -- 0 SO_RCVBUF -- -- -- 87380 SO_SNDBUF -- -- -- 16384 SO_RCVLOWAT -- -- -- 1 SO_SNDLOWAT -- -- -- 1 SO_RCVTIMEO -- -- -- 0:0 SO_SNDTIMEO -- -- -- 0:0 SO_REUSEADDR 1 -- -- 0 SO_BINDTODEVICE -- -- -- -- TCP_KEEPCNT -- -- -- 9 TCP_KEEPIDLE -- -- -- 7200 TCP_KEEPINTVL -- -- -- 75 IP_TOS -- -- -- 0 IP_TTL -- -- -- 64 TCP_NODELAY -- -- -- 0 Common config (basically default file released by RedHat, with certs and ports configured) : ---------------- ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = SSLv3 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/run/stunnel/ setuid = stunnel setgid = stunnel ; PID is created inside the chroot jail pid = /stunnel.pid ; Some debugging stuff useful for troubleshooting debug = 7 output = /var/log/stunnel.log ------------------- When the connection breaks, the logs (debug=7) on both sides are: Client: 2012.03.21 19:58:14 LOG7[30685:140185543952128]: SSL state (connect): before/connect initialization 2012.03.21 19:58:14 LOG7[30685:140185543952128]: SSL state (connect): SSLv3 write client hello A 2012.03.21 19:58:14 LOG3[30685:140185543952128]: SSL_connect: Peer suddenly disconnected 2012.03.21 19:58:14 LOG5[30685:140185543952128]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Server: 2012.03.21 19:58:14 LOG3[22230:140462283343616]: SSL_accept: Peer suddenly disconnected 2012.03.21 19:58:14 LOG5[22230:140462283343616]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket As I mentioned, it happens intermittently, with probably 50% of the connections working just fine, and the rest being disconnected. It ALWAYS seems to happen just after the client 'write client hello A', as opposed to later in the SSL handshake. I ran a tcpdump on both sides, it is below. Note that both the client and the server are NATd behind firewalls, on the server the port stunnel listens on (31112) is opened through the firewall. CLIENT (192.168.22.120, NATd externally as 66.66.66.66): 18:21:57.009887 IP 192.168.22.120.55747 > 77.77.77.77.31112: Flags [S], seq 2556598106, win 14600, options [mss 1460,sackOK,TS val 88488311 ecr 0,nop,wscale 7], length 0 18:21:57.076130 IP 77.77.77.77.31112 > 192.168.22.120.55747: Flags [S.], seq 351052925, ack 2556598107, win 14480, options [mss 1460,sackOK,TS val 646044220 ecr 88488311,nop,wscale 7], length 0 18:21:57.076195 IP 192.168.22.120.55747 > 77.77.77.77.31112: Flags [.], ack 1, win 115, options [nop,nop,TS val 88488377 ecr 646044220], length 0 18:21:57.077234 IP 192.168.22.120.55747 > 77.77.77.77.31112: Flags [P.], seq 1:140, ack 1, win 115, options [nop,nop,TS val 88488378 ecr 646044220], length 139 18:21:57.143582 IP 77.77.77.77.31112 > 192.168.22.120.55747: Flags [.], ack 140, win 122, options [nop,nop,TS val 646044288 ecr 88488378], length 0 18:21:57.143982 IP 77.77.77.77.31112 > 192.168.22.120.55747: Flags [RP.], seq 1, ack 140, win 122, length 0 SERVER (10.65.0.130, NATd externally as 77.77.77.77): 18:21:57.042122 IP 66.66.66.66.7760 > 10.65.0.130.http: Flags [S], seq 4074124673, win 14600, options [mss 1460,sackOK,TS val 88488311 ecr 0,nop,wscale 7], length 0 18:21:57.042161 IP 10.65.0.130.http > 66.66.66.66.7760: Flags [S.], seq 458906148, ack 4074124674, win 14480, options [mss 1460,sackOK,TS val 646044220 ecr 88488311,nop,wscale 7], length 0 18:21:57.108325 IP 66.66.66.66.7760 > 10.65.0.130.http: Flags [.], ack 1, win 115, options [nop,nop,TS val 88488377 ecr 646044220], length 0 18:21:57.109507 IP 66.66.66.66.7760 > 10.65.0.130.http: Flags [P.], seq 1:140, ack 1, win 115, options [nop,nop,TS val 88488378 ecr 646044220], length 139 18:21:57.109532 IP 10.65.0.130.http > 66.66.66.66.7760: Flags [.], ack 140, win 122, options [nop,nop,TS val 646044288 ecr 88488378], length 0 18:21:57.110092 IP 10.65.0.130.http > 66.66.66.66.7760: Flags [P.], seq 1:178, ack 140, win 122, options [nop,nop,TS val 646044288 ecr 88488378], length 177 18:21:57.175518 IP 66.66.66.66.7760 > 10.65.0.130.http: Flags [R.], seq 140, ack 1, win 115, length 0 Based on what I am seeing, a mysterious RST packet gets received by both sides, which causes them to terminate the session. Neither side originates any RST packets. When the connection is successful, the tcpdump looks a lot more normal, with an appropriate FIN exchange closing the session once the data has been sent. My questions are - am I missing something obvious? Am I correct in reading the above as some firewall or router between the two servers breaking the TCP connection by sending TCP RSTs to both endpoints? any help is appreciated. jordan

1 0

running stunnel from inetd
by Guylhem 21 Mar '12

21 Mar '12

Hello To follow up on my test, I would like to try and run stunnel from inetd However I wonder if anyone has an experience, suggestions, and some inetd.conf examples. I read it was possible in the FAQ but I didn't see a lot of examples Should I use a configuration file (for the global parameters) then specify connect= params? ex : 443 stream tcp6 nowait nobody /sbin/stunnel /etc/stunnel.conf connect=127.0.0.1:80 TIMEOUTclose=0 Thanks Guylhem

1 0

question about Ephemeral Diffie-Hellman
by Guylhem 21 Mar '12

21 Mar '12

Hello I've read that EDH calculations were ca cause of significant slow up on http://matt.io/technobabble/hivemind_devops_alert:_nginx_does_not_suck_at_s… I'm running stunnel on a embedded Linux/MIPS, where I'm trying to light up the load. Is it possible to disable EDH? If so, how? I couldn't find any info on that. Thanks Guylhem

2 3

stunnel with smb from 2 networks behind firewalls
by Philippe 21 Mar '12

21 Mar '12

Hello, Here is my setup : [PCA]-------------[Firewall-A]---------------{INTERNET}-----------[45.212.56.178:21213|Firewall-B|192.168.0.1:8139]--------[PCB] PCA : Windows 7 stunnel.conf : [smb] client = yes accept = 10.232.232.232:139 connect = 45.212.56.178:21213 PCB : Ubuntu Oneiric 11.10 stunnel.conf : [smb] accept = 8139 connect = 139 When I try to connect a network drive from PCA to a remote drive of PCB here are the stunnel.log of PCA : 2012.03.19 13:47:02 LOG5[3744:2564]: Reading configuration from file stunnel.conf 2012.03.19 13:47:02 LOG5[3744:2564]: FIPS mode is enabled 2012.03.19 13:47:02 LOG7[3744:2564]: Compression not enabled 2012.03.19 13:47:02 LOG7[3744:2564]: Snagged 64 random bytes from C:/.rnd 2012.03.19 13:47:02 LOG7[3744:2564]: Wrote 0 new random bytes to C:/.rnd 2012.03.19 13:47:02 LOG7[3744:2564]: PRNG seeded successfully 2012.03.19 13:47:02 LOG6[3744:2564]: Initializing SSL context for service smb 2012.03.19 13:47:02 LOG7[3744:2564]: Certificate: stunnel.pem 2012.03.19 13:47:02 LOG7[3744:2564]: Certificate loaded 2012.03.19 13:47:02 LOG7[3744:2564]: Key file: stunnel.pem 2012.03.19 13:47:02 LOG7[3744:2564]: Private key loaded 2012.03.19 13:47:02 LOG7[3744:2564]: SSL options set: 0x01000004 2012.03.19 13:47:02 LOG6[3744:2564]: SSL context initialized 2012.03.19 13:47:02 LOG5[3744:2564]: Configuration successful 2012.03.19 13:47:02 LOG7[3744:2564]: Service smb closed FD=200 2012.03.19 13:47:13 LOG5[3744:3940]: Service smb accepted connection from 10.232.232.232:50004 2012.03.19 13:47:13 LOG5[3744:3940]: connect_blocking: connected 45.212.56.178:21213 2012.03.19 13:47:13 LOG5[3744:3940]: Service smb connected remote server from 192.168.3.4:50005 2012.03.19 13:47:43 LOG3[3744:3940]: readsocket: Connection reset by peer (WSAECONNRESET) (10054) 2012.03.19 13:47:43 LOG5[3744:3940]: Connection reset: 143 bytes sent to SSL, 0 bytes sent to socket No logs on PCB it seems that the SSL connection doesn't cross the firewall B, if not I would saw logs in stunnel.log of PCB isn't it ? What can I do better to make this setup working ? Does the firewall B porforwarding is blocking the process ? Best regards Philippe

4 10

stunnel.conf in %USERAPPDATA%
by Sebastian Rose-Indorf 19 Mar '12

19 Mar '12

Hello, I use Stunnel with Windows. The configuration file "stunnel.conf" and the log file "stunnel.log" are in the %USERAPPDATA%\Stunnel folder. Stunnel starts and works without problems. But the GUI options "Edit stunnel.conf" and "Reload stunnel.conf" do not work. Is remedy possible? Sebastian

2 3

Re: [stunnel-users] stunnel with smb from 2 networks behind firewalls
by Philippe 19 Mar '12

19 Mar '12

I have found the stunnel version on PCB : stunnel 4.35 on x86_64-pc-linux-gnu with OpenSSL 1.0.0e 6 Sep 2011 the version on PCA is 4.52 this is perhaps a too big difference isn't it ? Best Philippe

1 0

Help for connecting to Https
by Ali Kabiri 18 Mar '12

18 Mar '12

Hi I have IP & Port with User & Pass from HttpS server I want connect to this server and using for tunneling, (something like vpn, a little of course!) I use stunnel on iPad Please help me I need this for usual using of Internet Please help me Please... Ali

1 0

Re: [stunnel-users] issue with running stunnel
by Thomas Eifert 18 Mar '12

18 Mar '12

Hi again Dewen; It sounds to me like Stunnel isn't being accessed at all. You should be seeing something in the Stunnel log window. I run Stunnel under Windows, so what I generally do is get Stunnel to listen to the loopback interface at address 127.0.0.1, or some other address within the loopback interface range. As such, if I was attempting to access it with a utility like Netcat, my basic stunnel.conf would look something like this for the client side: debug =7 [service.name] client = yes accept = 127.0.0.1:12035 connect = destination.address:1230 Then, I would point Netcat to the listening address and port. In your case, that might be netcat 127.0.0.1:12035. Then see if Stunnel logs your connection attempt. Again, this is under Windows, so your mileage may vary. Let us know how it works out for you. Regards; Thomas On 3/17/2012 12:32 PM, Dewen Kong wrote: > Hi Thomas, > > Thank you for your help. > > here is the config file in one computer >>> client = yes >>> [ncat] >>> accept = 12035 >>> connect = ***.***.***.***:1230 >> and on this computer, I run the command: cat test.file | >> netcat ***.***.***.***: 12035. to connect the remote server with >> IP( ***.***.***.***) on port 12035. I figure on stunnel will accept >> the port 12035 and connect to the remote server on port 1230 or I >> thought. > > and no another remote server, I run the command netcat -l -p 1230 > which means listen to the port 1230. > > after I run the test, it seems on remote server didn't receive > anything on the port 1230.the log file of stunnel dooesn't have any > record of this communication. the last line of the log file is still > "configuration successfully" > > and the version of stunnel I use is 4.42 > > > any suggests that may be wrong? > > > Dewen Kong > >> >> > > On Fri, Mar 16, 2012 at 10:14 PM, Thomas Eifert <kxkvi(a)wi.rr.com > <mailto:[email protected]>> wrote: > > Dewen; > > I think I misread your post. Please forgive me, as I'm unfamiliar > with the Netcat application. > > If you could provide some additional detail, that might be helpful. > > Regards; > > Thomas > > > > On 3/16/2012 9:38 PM, Thomas Eifert wrote: >> Dewen; >> >> I don't know anything about Netcat, so I'm taking a stab in the >> dark here, but it looks as if >> you're pointing Netcat at port 1230, while your config file >> indicates that Stunnel would be >> listening on port 12035. Try redirecting Netcat to the listening >> port. >> >> If you need to post again, please indicate the version of Stunnel >> you are using, and what >> platform your are running it on. >> >> Regards; >> >> Thomas >> >> >> On 3/16/2012 5:35 PM, Dewen Kong wrote: >>> Hi all, >>> I am a new guy to stunnel. >>> here is the issue I meet, i install my stunnel in the lab. and >>> trying to run the test with netcat. >>> Here is the config file i test: >>> client side: >>> ... >>> ... >>> output = stunnel.log >>> client = yes >>> [ncat] >>> accept = 12035 >>> connect = ***.***.***.***:1230 >>> then I run "stunnel test.conf "and the the log file shows >>> configuration successfully >>> then I run the command "cat test.file | netcat ***.***.***.*** >>> 12035 on the client side >>> and run netcat -l -p 1230 > output >>> nothing happens. >>> And I check the log file. there is no record about the netcat. >>> I don't know what happened. >>> >>> >>> -- >>> */Dewen Kong/* >>> >>> >>> _______________________________________________ >>> stunnel-users mailing list >>> stunnel-users(a)stunnel.org <mailto:[email protected]> >>> http://stunnel.mirt.net/mailman/listinfo/stunnel-users >> >> -- >> Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately. >> >> >> _______________________________________________ >> stunnel-users mailing list >> stunnel-users(a)stunnel.org <mailto:[email protected]> >> http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > -- > Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately. > > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)stunnel.org <mailto:[email protected]> > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > > > -- > */Dewen Kong/* -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

1 0

win-32 : console version with foreground mode & no icon area activity
by IvankoB for-mse 17 Mar '12

17 Mar '12

Needed to start/terminate/{supply private key password}/{catch errors} via pipe reader/writer (MSEgui pipe components) so that a STunnel session only serves a single application.

1 0

issue with running stunnel
by Dewen Kong 17 Mar '12

17 Mar '12

Hi all, I am a new guy to stunnel. here is the issue I meet, i install my stunnel in the lab. and trying to run the test with netcat. Here is the config file i test: client side: ... ... output = stunnel.log client = yes [ncat] accept = 12035 connect = ***.***.***.***:1230 then I run "stunnel test.conf "and the the log file shows configuration successfully then I run the command "cat test.file | netcat ***.***.***.*** 12035 on the client side and run netcat -l -p 1230 > output nothing happens. And I check the log file. there is no record about the netcat. I don't know what happened. -- *Dewen Kong*

2 2

Stunnel 1.45 on Win7 x64, OCSP blows up
by Michael Olson 16 Mar '12

16 Mar '12

I'm using stunnel in client mode on a Windows 7 x64 workstation, installed using ftp://ftp.stunnel.org/stunnel/stunnel-4.52-installer.exe Everything works until I try to check the server certificate for revocation using an OCSP server, at which point stunnel crashes whenever I make a connection. The following error pops up in a dialog box: OPENSSL_Uplink(0FBE5000,14): no OPENSSL_Applink My config is pretty simple: -------------------------------------------------------------- debug = 7 # I do want FIPS enabled, but I figured one problem at a time. fips = no CAfile = ca-bundle.crt verify = 2 OCSP = http://ocsp.test.net/ options = NO_SSLv2 [test1] client = yes accept = 127.0.0.1:80 connect = web.test.net:443 -------------------------------------------------------------- The log gets as far as: 2012.03.02 11:07:41 LOG7[4296:5008]: OCSP: server connected when it crashes. -- Mike

2 3

need suggestion on this issue?
by Dewen Kong 16 Mar '12

16 Mar '12

Hi guys, Right now I am working on this issue trying to encrypt the communication between terminals and our back of house computer. I am trying to solve this problem with stunnel. If the terminal is 'smart' like computer, it will be no issue. implement the stunnel on both end. But it come to be a problem there is some dumb terminal, No way to set up stunnel in its side. I not sure stunnel can works here any more. if not, is there any other methods that may work? -- *Dewen Kong*

2 1

Stunnel->Stunnel Failure Behavior...
by Matt Wise 13 Mar '12

13 Mar '12

I'm using Stunnel in our environment to tunnel our ZooKeeper connections... it works reasonably well as long as ZooKeeper is running on our ZooKeeper servers properly. Here's an example of our server and client configs: Server: > cert = /etc/stunnel/zookeeper.pem > key = /etc/stunnel/zookeeper.key > CAfile = /etc/stunnel/zookeeper_ca.pem > verify = 2 > sslVersion = TLSv1 > setuid = stunnel4 > setgid = stunnel4 > pid = /var/lib/stunnel4/zookeeper.stunnel4.pid > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > TIMEOUTconnect = 2 > debug = 4 > [zookeeper] > accept = 0.0.0.0:2182 > failover = rr > connect = 127.0.0.1:2181 Client: > cert = /etc/stunnel/zookeeper.pem > key = /etc/stunnel/zookeeper.key > CAfile = /etc/stunnel/zookeeper_ca.pem > verify = 2 > sslVersion = TLSv1 > client = yes > setuid = stunnel4 > setgid = stunnel4 > pid = /var/lib/stunnel4/zookeeper.stunnel4.pid > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > TIMEOUTconnect = 2 > debug = 4 > [zookeeper] > accept = 127.0.0.1:2182 > failover = rr > connect = zookeeper1:2182 > connect = zookeeper2:2182 > connect = zookeeper3:2182 Now the intended behavior is that if 'zookeeper1', 'zookeeper'2, or 'zookeeper3' go down that the client will re-establish a connection with one of the other servers. However, that doesnt seem to be happening. Instead, when the connection dies, Stunnel seems to go into a massive loop trying to re-connect to the original server. > Feb 22 21:41:24 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) > Feb 22 21:41:25 staging-i-123.xxx stunnel: LOG3[10717:3073788784]: connect_blocking: getsockopt 123.123.123.123:2182: Connection refused (111) Whats missing in my config to make the failover work properly? —Matt

2 2

Stunnel stopped working: Will not sync with Google using Outlook 2007 on Ubuntu 11:10 64-bit
by Jonathan Harrison 13 Mar '12

13 Mar '12

I made some changes to my stunnel config, and had one account working. I added the remaining 3 and it seemed to start to work, but now it has stopped. Outbound (send) seems to be fine. Any ideas????? Telnet and post listening test results: [CODE]$ netstat -an | grep -iw LISTEN tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:3000 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:3001 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:3002 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:3003 0.0.0.0:* LISTEN tcp6 0 0 :::80 :::* LISTEN tcp6 0 0 ::1:631 :::* LISTEN tcp6 0 0 :::445 :::* LISTEN tcp6 0 0 :::139 :::* LISTEN baronipc@baronipc:~$ telnet localhost 3000 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Connection closed by foreign host. baronipc@baronipc:~$ telnet localhost 3001 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Connection closed by foreign host. baronipc@baronipc:~$ telnet localhost 3002 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Connection closed by foreign host. baronipc@baronipc:~$ telnet localhost 3003 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Connection closed by foreign host. baronipc@baronipc:~$ [/CODE] Copy of config file: [CODE] ; Sample stunnel configuration file by Michal Trojnara 2002-2006 ; Some options used here may not be adequate for your particular configuration ; Please make sure you understand them (especially the effect of chroot jail) ; Certificate/key is needed in server mode and optional in client mode cert = /etc/stunnel/mail.pem ;key = /etc/stunnel/mail.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = SSLv3 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 ; PID is created inside chroot jail pid = /stunnel4.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff ;verify = 2 ; Don't forget to c_rehash CApath ; CApath is located inside chroot jail ;CApath = /certs ; It's often easier to use CAfile ;CAfile = /etc/stunnel/certs.pem ; Don't forget to c_rehash CRLpath ; CRLpath is located inside chroot jail ;CRLpath = /crls ; Alternatively you can use CRLfile ;CRLfile = /etc/stunnel/crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = /var/log/stunnel4/stunnel.log ; Use it for client mode client = yes ; Service-level configuration ;[pop3s] ;accept = 995 ;connect = 110 [imaps Work] accept = 127.0.0.1:3000 connect = imap.gmail.com:993 [imaps Personal] accept = 127.0.0.1:3001 connect = imap.gmail.com:993 [imaps Admin] accept = 127.0.0.1:3002 connect = imap.gmail.com:993 [imaps Co] accept = 127.0.0.1:3003 connect = imap.gmail.com:993 ;[ssmtp Work] ;accept = 127.0.0.1:4000 ;connect = smtp.gmail.com:465 ;[ssmt Personal] ;accept = 127.0.0.1:4001 ;connect = smtp.gmail.com:465 ;[ssmtp Admin] ;accept = 127.0.0.1:4002 ;connect = smtp.gmail.com:587 ;[ssmtp Co] ;accept = 127.0.0.1:4003 ;connect = smtp.gmail.com:587 ;[ssmtp other] ;accept = 127.0.0.1:4004 ;connect = 25 ;[https] ;accept = 443 ;connect = 80 ;TIMEOUTclose = 0 ; vim:ft=dosini[/CODE] And /etc/default/stunnel4 [CODE]# /etc/default/stunnel # Julien LEMOINE <speedblue(a)debian.org> # September 2003 # Change to one to enable stunnel automatic startup ENABLED=1 FILES="/etc/stunnel/*.conf" OPTIONS="" # Change to one to enable ppp restart scripts PPP_RESTART=0[/CODE] -- Regards Jonathan

1 0

How to get stunnel to listen on an IPv6 interface?
by jshardlo 11 Mar '12

11 Mar '12

Hi - my server was recently connected to IPv6 as well as the original IPv4 network. I have been using stunnel for some time on the IPv4 network but now that I have IPv6 access I can't work out how to get stunnel to listen on that interface as well. I checked that my stunnel has IPv6 support:- /usr/sbin/stunnel -version stunnel 4.15 on i686-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none I have a configuration like this: [pop3s] accept = 995 connect = 110 But when I do netstat I can see that it is only listening for port 995 on IPv4... netstat -an | grep 995 tcp 0 0 0.0.0.0:995 0.0.0.0:* LISTEN netstat -an -A inet6 | grep 995 And of course when I connect to port 995 over the IPv6 network I get "connection refused". Any ideas how to get stunnel to listen on the v6 address? Thanks ! -- View this message in context: http://old.nabble.com/How-to-get-stunnel-to-listen-on-an-IPv6-interface--tp… Sent from the Stunnel - Users mailing list archive at Nabble.com.

1 1

Stunnel.conf won't load with certain ciphers.
by Thomas Eifert 09 Mar '12

09 Mar '12

Hello all: I'm running Stunnel 4.52 under WinXP SP3. Last night I had some questions about how the cipher list in Stunnel interacts with the cipher negotiation routine between client and server, so I did some experiments in an attempt to address those questions. In the course of doing so, I noticed that, if I attempt to load certain ciphers, Stunnel would stall at configuration load. Using OpenSSL to list TLS ciphers with 4.52's libraries yields the following: ~~~~~~~~~~~~~~~~~~~~~ C:\Program Files\stunnel>openssl ciphers -v -tls1 DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 DHE-DSS-AES256-SHA SSLv3 Kx=DH Au=DSS Enc=AES(256) Mac=SHA1 AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 EDH-RSA-DES-CBC3-SHA SSLv3 Kx=DH Au=RSA Enc=3DES(168) Mac=SHA1 EDH-DSS-DES-CBC3-SHA SSLv3 Kx=DH Au=DSS Enc=3DES(168) Mac=SHA1 DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 DHE-RSA-AES128-SHA SSLv3 Kx=DH Au=RSA Enc=AES(128) Mac=SHA1 DHE-DSS-AES128-SHA SSLv3 Kx=DH Au=DSS Enc=AES(128) Mac=SHA1 AES128-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 IDEA-CBC-SHA SSLv3 Kx=RSA Au=RSA Enc=IDEA(128) Mac=SHA1 RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 EDH-RSA-DES-CBC-SHA SSLv3 Kx=DH Au=RSA Enc=DES(56) Mac=SHA1 EDH-DSS-DES-CBC-SHA SSLv3 Kx=DH Au=DSS Enc=DES(56) Mac=SHA1 DES-CBC-SHA SSLv3 Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1 EXP-EDH-RSA-DES-CBC-SHA SSLv3 Kx=DH(512) Au=RSA Enc=DES(40) Mac=SHA1 export EXP-EDH-DSS-DES-CBC-SHA SSLv3 Kx=DH(512) Au=DSS Enc=DES(40) Mac=SHA1 export EXP-DES-CBC-SHA SSLv3 Kx=RSA(512) Au=RSA Enc=DES(40) Mac=SHA1 export EXP-RC2-CBC-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export EXP-RC4-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export C:\Program Files\stunnel> ~~~~~~~~~~~~~~~~~~~~~ As such, ciphers RC4-SHA and RC4-MD5 appear to be valid. However, any attempt at using those in client mode causes Stunnel to stall when reading the cipher from stunnel.conf: ~~~~~~~~~~~~~~~~~~~~~ 2012.03.08 20:17:10 LOG5[432:592]: Reading configuration from file stunnel.conf 2012.03.08 20:17:10 LOG5[432:592]: FIPS mode is enabled 2012.03.08 20:17:10 LOG7[432:592]: Compression not enabled 2012.03.08 20:17:10 LOG7[432:592]: Snagged 64 random bytes from C:/.rnd 2012.03.08 20:17:10 LOG7[432:592]: Wrote 1024 new random bytes to C:/.rnd 2012.03.08 20:17:10 LOG7[432:592]: PRNG seeded successfully 2012.03.08 20:17:10 LOG6[432:592]: Initializing SSL context for service nntps.1 2012.03.08 20:17:10 LOG7[432:592]: Loaded verify certificates from peer-nntps.1.pem 2012.03.08 20:17:10 LOG7[432:592]: Loaded peer-nntps.1.pem revocation lookup file 2012.03.08 20:17:10 LOG7[432:592]: SSL options set: 0x00000004 2012.03.08 20:17:10 LOG6[432:592]: SSL context initialized 2012.03.08 20:17:10 LOG6[432:592]: Initializing SSL context for service nntps.2 2012.03.08 20:17:10 LOG7[432:592]: Loaded verify certificates from peer-nntps.2.pem 2012.03.08 20:17:10 LOG7[432:592]: Loaded peer-nntps.2.pem revocation lookup file 2012.03.08 20:17:10 LOG3[432:592]: SSL_CTX_set_cipher_list: 1410D0B9: error:1410D0B9:SSL routines:SSL_CTX_set_cipher_list:no cipher match 2012.03.08 20:17:10 LOG3[432:592]: Failed to reload the configuration file 2012.03.08 20:17:10 LOG7[432:592]: Signal pipe is empty ~~~~~~~~~~~~~~~~~~~~ This is the relevant snippet from my stunnel.conf file: ~~~~~~~~~~~~~~~~~~~~ debug = 7 delay = yes output = stunnel.log [nntps.1] client = yes sslVersion = TLSv1 ciphers = DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA cafile = peer-nntps.1.pem verify = 4 accept = 127.0.1.1:119 connect = news.server.com:443 [nntps.2] client = yes sslVersion = TLSv1 ciphers = RC4-SHA cafile = peer-nntps.2.pem verify = 4 accept = 127.0.1.2:119 connect = news.server.org:563 ~~~~~~~~~~~~~~~~~~~~ Any attempt at using ciphers RC4-SHA or RC4-MD5. with or without TLS specified, results in the same configuration crash. I don't really need to use those ciphers, but since I observed this behavior, I thought I'd better report it. Any comments welcome. Regards; Thomas . -- Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

2 3

Re: [stunnel-users] Memory allocated in a different thread at network.c, line 63
by Philippe A. 08 Mar '12

08 Mar '12

Hello Michal, 2012/3/5 Michal Trojnara <Michal.Trojnara(a)mirt.net> > > I am using fork mode because of leaks with pthread. In 4.33+pthread, >> stunnel virt size (per top) went up to 216m after 40k transactions. In >> fork mode, stunnel size after the same test was 20744 (kilobytes). In >> 4.45, I have 187m and 20676k respectively. >> > > I observed the same symptoms. Stunnel grows to ~200MB of virtual memory > after some time of usage. Then it stops growing further. I guess this > issue is caused by heap fragmentation rather than a memory leak. Otherwise > the growth would not be limited to ~200MB. > https://en.wikipedia.org/wiki/**C_dynamic_memory_allocation<https://en.wikipedia.org/wiki/C_dynamic_memory_allocation> I ran a test overnight that confirmed your point. I generated 480k+ stunnel transactions. This morning, stunnel memory usage is virt=187m and res=42m. My result after 40k transactions was exactly the same (in both cases with pthread+zlib). > I understand that virt includes shared libs, and that any issue with a >> shared lib will impact virt size. I did not have the opportunity to test >> without zlib support in openssl. Since we are not using compression, I >> wonder how much avoiding zlib would help. >> > > zlib only uses lots of memory when it's enabled. > I ran another test to clarify this. zlib appears to be adding around 3 megabytes at most. This is at least what I see under my setup and type of usage. pthread+zlib, 40k transactions before: virt=20680, res=792 after: virt=187m, res=42m pthread+nozlib, 40k transactions before: virt=20688, res=896 after: virt=185m, res=39m I have seen no benefit of compiling without zlib in fork mode. I guess it only makes forking a bit lighter. 2012/3/5 Michal Trojnara <Michal.Trojnara(a)mirt.net> > You may also try to set a lower value of MMAP_THRESHOLD to reduce heap > fragmentation: > https://www.kernel.org/doc/man-pages/online/pages/man3/malloc.3.html > This will be worth a look. Knowing what is influencing stunnel size is nice since it can avoid us restarting the processes once in a while (which we currently never do in fork mode). Thanks for your great help!

1 0

How to pass remote IP to local SMTP/POP3 server
by Zdenek Valach (INBOX) 08 Mar '12

08 Mar '12

Hi I have question, because I was not able to find answer anywhere on internet. I started to use Stunnel in server mode to provide POP3S/SMTPS functionality. Everything works fine except that I am missing remote IP of connecting client. I am using Windows version so I can not use transparent proxy mode working on Unix. Is there way how to make Stunnel for example after each establishment of TCP connection to send to SMTP/POP3 server port some special command like REMOTEIP 123.123.123.123<crlf> to pass this information there. I know it is not in SMTP/POP3 standard but it is simple for me extend behavior of SMTP/POP3 service by this command? Thank you very much for any advice Zdenek ____________________________________________________________ FREE 3D MARINE AQUARIUM SCREENSAVER - Watch dolphins, sharks & orcas on your desktop! Check it out at http://www.inbox.com/marineaquarium

2 3

mknod: not owner building stunnel on Solaris SPARC 10 zone
by Jiri ROHLICEK 07 Mar '12

07 Mar '12

Hello,I've been building stunnel 4.52 on Solaris 10 SPARC zone. Configure and make went fine, make install failed in tools with error if uname | grep SunOS; then \ ../auto/install-sh -c -d -m 755 /tmp/stunnel/var/lib/stunnel/dev; \ mknod /tmp/stunnel/var/lib/stunnel/dev/zero c 13 12; \ chmod 666 /tmp/stunnel/var/lib/stunnel/dev/zero; \ fi SunOS mknod: Not owner -- mknod is not allowed in solaris zone, only in global. One of many notices of this error skayser's http://www.mail-archive.com/[email protected]/msg03031.html asks if mknod is needed on solaris 10. So I tried after configure comment out the mknod section in tools/Makefile. -- install-data-local: ... ... if uname | grep SunOS; then \ ${INSTALL} -d -m 755 $(DESTDIR)$(localstatedir)/lib/stunnel/dev; \ mknod $(DESTDIR)$(localstatedir)/lib/stunnel/dev/zero c 13 12; \ chmod 666 $(DESTDIR)$(localstatedir)/lib/stunnel/dev/zero; \ fi -- Now make install ends OK and stunnel works fine (I use it as client only). Isn't creating ./dev/zero not needed anymore? Thanks Jiri Rohlicek jrohlicek(a)aplis.cz

1 0

Username and Password in Stunnel
by Jim Murphy 07 Mar '12

07 Mar '12

I have a program that only allows me to enter a From email address and a mail server IP in its setup. Is there any way that I could enter a username and a password in stunnel.conf and let Stunnel send this information out to Office 365 or Gmail for delivery? Thanks! Jim

3 2

Re: [stunnel-users] Memory allocated in a different thread at network.c, line 63
by Philippe A. 07 Mar '12

07 Mar '12

Hello Michal, 2012/3/5 Michal Trojnara <Michal.Trojnara(a)mirt.net> > I fixed it: > ftp://ftp.stunnel.org/stunnel/**beta/stunnel-4.53b10.tar.gz<ftp://ftp.stunnel.org/stunnel/beta/stunnel-4.53b10.tar.gz> > Please give it a try and let me know whether it works for you. I tried the beta and the error is definitely gone. However I will stick with 4.45 for now as my next deployment is already prepared. Thanks a lot for your assistance!

1 0

Couple of issues with 4.45
by Philippe A. 07 Mar '12

07 Mar '12

Hello, I have encountered a couple of issues with stunnel 4.45 on RHEL 5.5. I tried configuring stunnel to log messages in /var/log/messages and later found that messages were logged both in that file AND /var/log/messages. In stunnel.conf, I had specified: debug=local6.info In syslog.conf: local6.* /var/log/stunnel.log I could achieve what I wanted only with the combination of the following two options: syslog=no output=/usr/local/app/stunnel/var/stunnel.log Is this expected? The second issue I have noticed is that stunnel seems to have a bit of trouble handling the hup signal. If you start stunnel specifying a relative path to the config, sending hup will cause stunnel to log and error but it won't exit. 2012.03.01 16:31:29 LOG5[19000:0]: Reading configuration from file etc/server.conf 2012.03.01 16:31:29 LOG3[19000:0]: etc/server.conf: No such file or directory (2) 2012.03.01 16:31:29 LOG3[19000:0]: Cannot read configuration 2012.03.01 16:31:29 LOG3[19000:0]: Failed to reload the configuration file If you specify an absolute path, no error will be reported but stunnel will exit anyway.

2 3

No sub folders, calendar or contacts
by Jonathan Harrison 05 Mar '12

05 Mar '12

Dear sirs I am using Ubuntu 11.10 64-bit, Outlook 2007 and 4 x gmail accounts (1 x personal (gmail.com) and 3 x business (baroni-limited.com, hosted by gmail). I have set up Stunnel, I belive the latest version and created a SSL license as instructed. The Stunnel Telnets OK and I can send and recieve eMails (I do send directly via my ISP rather than use Stunnel) without any problem. Where I seem to be having problems is that: I have no sub folders to each account. None are appearing. I have no calendars - I have followed the instructions but they fail to load. I have no contacts. Message from Outlook: Sync error > > Task 'Synchronizing subscribed folders for Baroni.' reported error > (0x800CCC0E) : 'Outlook cannot synchronize subscribed folders for Baroni. > Error: Cannot connect to the server. If you continue to receive this > message, contact your server administrator or Internet service provider > (ISP).' > > Task 'Internet Calendar Subscriptions' reported error (0x8004010F) : 'The > operation failed. An object cannot be found.' > Config attached - I hope. It is most likely I have missed something or done something wrong. I have not found anything to help me on the web or archives, could you please advise. If you feel you need a copy of the the logs, please advise and I shall happily provide what I can. I am assuming I have just missed something. -- Regards Jonathan

1 0

FIPS_mode_set:fingerprint does not match
by Jack 04 Mar '12

04 Mar '12

I have the following problem running stunnel on Centos 6.x 64bit with the following error: I have been search with google to see if there was a solution but nothing was found Thank you for your reply and your help, hopefully I can get this solved. ******************************************************************************** Clients allowed=500 stunnel 4.52 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.0-fips 29 Mar 2010 Threading:PTHREAD SSL:ENGINE,FIPS Auth:none Sockets:POLL,IPv6 Reading configuration from file /usr/local/etc/stunnel/stunnel.conf FIPS_mode_set: 2D06C06E: error:2D06C06E:FIPS routines:FIPS_mode_set:fingerprint does not match *******************************************************************************

3 2

Stunnel in Client / Server configuration
by Michael Curran 04 Mar '12

04 Mar '12

Hello, I have 2 servers in different locations across the country. I am using them as a paired tunnel that both act as server and client Server A has this configuration (cert definitions left out on purpose, but exist and are valid) ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = all ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel4 setuid = stunnel4 setgid = stunnel4 ; PID is created inside chroot jail pid = /stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle TIMEOUTclose=0 ; 128-bit or highter only ciphers = HIGH:MEDIUM ; Workaround for Eudora bug options = DONT_INSERT_EMPTY_FRAGMENTS options = NO_SSLv2 ; Some debugging stuff useful for troubleshooting debug = local7.info ;warning [Tunnel from Server B] accept = 1.2.3.4:443 connect = 127.0.0.1:8082 [Tunnel to Server B] accept = 5.6.7.8:3132 connect = 9.10.11.12:4000 client = yes Server B (cert definitions left out on purpose, but exist and are valid) ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = all ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel4 setuid = stunnel4 setgid = stunnel4 ; PID is created inside chroot jail pid = /stunnel.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle TIMEOUTclose=0 ; 128-bit or highter only ciphers = HIGH:MEDIUM ; Workaround for Eudora bug options = DONT_INSERT_EMPTY_FRAGMENTS options = NO_SSLv2 ; Some debugging stuff useful for troubleshooting debug = local7.debug ;warning [Tunnel to Server A] accept = 10.1.2.3:9443 connect = 1.2.3.4:443 client = yes [Tunnel from Server A] accept = 9.10.11.12:4000 connect = 10.4.5.6:3132 Communication through Server A (client) to Server B (server) works as expected Communication through Server B (client) back to Server A (server) recieves this error curl: (35) error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol (this is all the further it gets, the client says hello and the server responds with this) If I skip the local stunnel config and pass the traffic publicly through to Server A (running in client mode), from Server B, I get the expected http response I setup to test the tunnel. Im just assuming that if I am passing from Stunnel from one system to stunnel on another, one of them should be client and the other should be server. This works well on our old configurations and as far as I can see from a stunnel and network route perspective all rules are identical. Why would it work from Server B to Server A on the response if I go directly to Server A, but fail locally? The configuration looks correct, what else could I check?

2 1

Multiple Config Files
by Scott McKeown 02 Mar '12

02 Mar '12

Hi All, I'm new to the STunnel system but I'm loving what I have seen so far. However, I was wondering if its possible to have a setup something along the lines of the following: general.cfg - containing my general server system details http.cfg - containing the details of my HTTP server pop3.cfg - containing the details of my pop3 server etc. etc. but linking them all from one file so that if I want to remove the pop3 service I can just remove the pop3.cfg file and one line from the base file. I hope that someone understands what I'm getting at but if you need any more info please just let me know. Yours, Scott

3 3

Re: [stunnel-users] FIPS_mode_set:fingerprint does not match
by Jake Skinner 01 Mar '12

01 Mar '12

Have you tried disabling FIPS to see if your connection works without? Jake Skinner Telephony Technology Specialist Ontario Systems, LLC Office +1.765.751.7000 Thumbed posthaste from my mobile device; please forgive any typing or grammatical errors. ________________________________ From: stunnel-users-bounces(a)stunnel.org To: stunnel-users(a)stunnel.org Sent: Wed Feb 29 19:41:02 2012 Subject: [stunnel-users] FIPS_mode_set:fingerprint does not match I have the following problem running stunnel on Centos 6.x 64bit with the following error: I have been search with google to see if there was a solution but nothing was found Thank you for your reply and your help, hopefully I can get this solved. ******************************************************************************** Clients allowed=500 stunnel 4.52 on x86_64-unknown-linux-gnu platform Compiled/running with OpenSSL 1.0.0-fips 29 Mar 2010 Threading:PTHREAD SSL:ENGINE,FIPS Auth:none Sockets:POLL,IPv6 Reading configuration from file /usr/local/etc/stunnel/stunnel.conf FIPS_mode_set: 2D06C06E: error:2D06C06E:FIPS routines:FIPS_mode_set:fingerprint does not match ******************************************************************************* Attention: This message and all attachments are private and may contain information that is confidential and privileged. If you received this message in error, please notify the sender by reply email and delete the message immediately.

2 1

linux default installation
by John A. Wallace 29 Feb '12

29 Feb '12

Hello. I am comparing a default installation of "stunnel.conf" in Linux with that in Windows, and I found some differences that I have a couple questions about. The Windows installation installed in client mode by default, but the one for Linux in server mode. I made a backup copy of the default files for both. For now I want to run stunnel in Linux in client mode, so I am making some changes to it. The installed default for these six parameters are as follows: Client=no Chroot=/var/lib/stunnel/ Setuid=stunnel Setgid=nogroup Pid=/var/run/stunnel.pid Cert=/etc/stunnel/stunnel.pem Is it correct to change these settings for testing in client mode so that they match the current Windows' client mode configuration, like so: Client=yes #Chroot=/var/lib/stunnel/ #Setuid=stunnel #Setgid=nogroup #Pid=/var/run/stunnel.pid #Cert=/etc/stunnel/stunnel.pem

1 1

stunnel log delayed
by John A. Wallace 29 Feb '12

29 Feb '12

Hello, I am running stunnel on Linux in client mode, and I have the following setting in "stunnel.conf": output=stunnel.log The log does not get written to periodically while the program is running but is delayed until after I have closed the program. It would be helpful to be able to look at it from time to time, especially while troubleshooting. Any way "to push" the data down into the file sooner? Thanks. John

2 1

Memory allocated in a different thread at network.c, line 63
by Philippe A. 28 Feb '12

28 Feb '12

Hello, I find the following error my syslog when stopping stunnel 4.52. The program seems to be unable to shutdown cleanly (ex: pid file doesn`t get removed). stunnel: INTERNAL ERROR: Memory allocated in a different thread at network.c, line 63 This is how I configured: LDFLAGS=-Wl,-rpath,/usr/local/app/openssl/lib64 \ ./configure --prefix=/usr/local/app/stunnel \ --includedir=$PKG_HOME/openssl/include/ \ --with-ssl=$PKG_HOME/openssl/ \ --with-threads=fork \ --disable-libwrap Where PKG_HOME is a variable of my own. I had the same error with version 4.51. I do not see the error when running in foreground. I do not see the error either if I compile with threads instead of fork. In case this information is needed, this is how I configured openssl. ./config --prefix=/usr/local/app/openssl --libdir=lib64 shared zlib-dynamic no-ssl2 This is on RHEL 5.5 Regards.

2 2

stunnel for WCF services configured for.NETTCP binding
by larisa_y 24 Feb '12

24 Feb '12

Will Stunnel work for WCF services configured for.NETTCP binding? Thank you. -- View this message in context: http://old.nabble.com/stunnel-for-WCF-services-configured-for.NETTCP-bindin… Sent from the Stunnel - Users mailing list archive at Nabble.com.

1 0

SSLv3 on Win32 does not work
by Zdenek Valach (INBOX) 24 Feb '12

24 Feb '12

Hi I am using the latest version of stunnel in server mode (converting POP3S to POP3) I need to make service work in SSLv3 mode. In TLSv1 it works fine, when I add to stunnel.conf tag sslVersion = all, it still works fine, but when I use sslVersion = SSLv3 although config file is loaded properly, process EXE crashed during establishing the connection. It looks like some bug in actual version of stunnel. Does somebody experience same problem? Thank you very much in advance for any advice Thanks Zdenek ____________________________________________________________ Send any screenshot to your friends in seconds... Works in all emails, instant messengers, blogs, forums and social networks. TRY IM TOOLPACK at http://www.imtoolpack.com/default.aspx?rc=if2 for FREE

2 1

Stunnel for Android
by Huzella Balázs 23 Feb '12

23 Feb '12

Hi! I have downloaded the Android port of stunnel: http://mirrors.zerg.biz/stunnel/stunnel-4.52-android.zip I would like to use it on my Android tablet but I don't know how to start or use it. I have root access on the device. I placed the stunnel and openssl files into /data/stunnel/ directory. Both files have execute permission. Can anybody please provide some information on how to use this application? I haven't found any info on stunnel.org. Best Regards, Balázs Huzella

2 1

Multiple Domains for https
by Thomas Manson 23 Feb '12

23 Feb '12

Hi, I want to setup the following architecture : stunnel ---> haproxy --> 2 webserver. I run severa virtual host on the 2 webservers, and a subset of them needs https. I can allocate several IP address for the host that run stunnel. How do I configure a single stunnel process to have a certificate per IP for the port https? I tryed to add several section like the following : [mansonthomas.com] cert = /etc/stunnel/sites/mansonthomas.com/mansonthomas.com.crt accept = 88.190.17.222:443 connect = 127.0.0.1:82 xforwardedfor = yes TIMEOUTclose = 0 So the question is : Is it possible ? do you have a sample configuration file to share for this use case? Thanks, Thomas.

4 9

:o( Stunnel KO on Windows Server 2003 VM
by BOXI31 TEST 22 Feb '12

22 Feb '12

Hi all ! I'm new with Stunnel. It'a nice tool that works perfectly on Windows 7 64-bit host but won't start on Windows Server 2003 guest VM (VMWare Player 3.1.x). When I try to start it, I have a message like "can't initialize...". I'll give you the exact message tomorrow, I don't have now the VM on hand. On Windows 7, when I started Stunnel for the 1st time, I was asked to create a certificate with a kind of wizard but on the Windows Server 2003 VM, it stops before this step. Is it a known problem on VM ? What could I check ? I managed to make the software I'm testing (SMTP sending function) on the VM "talk" to Stunnel on my host by I'd really like to install it on the VM to be independant from host. Thanks by advance, Regards, Steve.

2 1

Stunnel Not supporting DSA key
by Anand Krishnan 16 Feb '12

16 Feb '12

Hi All, I have query regarding Stunnel (version 4) working. We have a windows client application which communicates with a web service via SSL encryption with DSA algorithm. The windows client machine is using a pfx file for authentication with server. Now we need to convert this windows machine with a linux machine and hence we converted the pfx into pem file. But when i tried to start the Stunnel using this pem file it threws up below error. 2012.02.13 18:23:23 LOG3[23972:47049761923264]: error stack: 140B3009 : error:140B3009:SSL routines:SSL_CTX_use_RSAPrivateKey_file:PEM lib 2012.02.13 18:23:23 LOG3[23972:47049761923264]: SSL_CTX_use_RSAPrivateKey_file: 607907F: error:0607907F:digital envelope routines:EVP_PKEY_get1_RSA:expecting an rsa key It seems the .pem file I mapped in the stunnel.conf is expecting RSA algorithm but when I opened it I can see it as DSA coded. Can some body help me on this. I am attaching the pfx and pem file along with this. Regards, Anand K DISCLAIMER: "The information in this e-mail and any attachment is intended only for the person to whom it is addressed and may contain confidential and/or privileged material. If you have received this e-mail in error, kindly contact the sender and destroy all copies of the original communication. IBS makes no warranty, express or implied, nor guarantees the accuracy, adequacy or completeness of the information contained in this email or any attachment and is not liable for any errors, defects, omissions, viruses or for resultant loss or damage, if any, direct or indirect." DISCLAIMER: "The information in this e-mail and any attachment is intended only for the person to whom it is addressed and may contain confidential and/or privileged material. If you have received this e-mail in error, kindly contact the sender and destroy all copies of the original communication. IBS makes no warranty, express or implied, nor guarantees the accuracy, adequacy or completeness of the information contained in this email or any attachment and is not liable for any errors, defects, omissions, viruses or for resultant loss or damage, if any, direct or indirect."

2 1

Key files across NFS
by James Devine 15 Feb '12

15 Feb '12

I have an stunnel config saved on an NFS mount so it can be shared with other servers, it only seems to work if the key file is stored locally, as soon as I move the key onto the NFS mount I get the error: /disks/disk1/stunnel/certs/wildcard.key: Value too large for defined data type (75) Any idea why that might be and what I might do to fix it?

1 1

server does not send its cert?
by Keresztfalvi Laszlo 14 Feb '12

14 Feb '12

Hello, after a day of trying.. - 2 box of *Win7 Pro x64* - fresh install of *stunnel 4.52* - keys generated with C:\Program Files (x86)\stunnel>* **.\openssl.exe req -new -x509 -days 365 -nodes -config stunnel.cnf -out stunnel.pem -keyout stunnel.pem* - *certs.pem* on both box contains certificate part of stunnel.pem from both machine server stunnel.conf (192.168.0.52): debug = 7 cert = stunnel.pem verify = 2 CAfile = certs.pem options = NO_SSLv2 [unison] accept = 10001 connect = 127.0.0.1:10000 client stunnel.conf (192.168.0.216): client = yes debug = 7 cert = stunnel.pem verify = 2 CAfile = certs.pem options = NO_SSLv2 [unison] client = yes accept = 127.0.0.1:10000 connect = 192.168.0.52:10001 Test #1: *OK* C:\Program Files (x86)\stunnel>* .\openssl verify -CAfile certs.pem stunnel.pem* *stunnel.pem: OK* C:\Program Files (x86)\stunnel>* .\openssl verify -CAfile certs.pem certs.pem* *certs.pem: OK* Test #2: *OK* C:\Program Files (x86)\stunnel> *.\openssl s_server -accept 10001 -cert stunnel.pem -verify 2 -CAfile certs.pem -no_ssl2* vs C:\Program Files (x86)\stunnel> *.\openssl s_client -connect 192.168.0.52:10001 -cert stunnel.pem -verify 2 -CAfile certs.pem -no_ssl2* Test #3: *OK - "certificate accepted" * C:\Program Files (x86)\stunnel> *.\openssl s_server -accept 10001 -cert stunnel.pem -verify 2 -CAfile certs.pem -no_ssl2* vs *stunnel client** * Test #4: *OK - "certificate accepted" * *stunnel server* vs C:\Program Files (x86)\stunnel> *.\openssl s_client -connect 192.168.0.52:10001 -cert stunnel.pem -verify 2 -CAfile certs.pem -no_ssl2* Test #5: *FAILED* *stunnel server* Service unison accepted connection from 192.168.0.216:23134 2012.02.14 09:02:39 LOG3[134028:132792]: SSL_accept: 140943F2: error:140943F2:SSL routines:*SSL3_READ_BYTES:sslv3 alert unexpected message* 2012.02.14 09:02:39 LOG5[134028:132792]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket* * vs *stunnel client * 2012.02.14 09:02:33 LOG5[2500:5876]: Service unison connected remote server from 192.168.0.216:23134 2012.02.14 09:02:33 LOG7[2500:5876]: Remote FD=372 initialized 2012.02.14 09:02:33 LOG3[2500:5876]: SSL_connect: 140870E8: error:140870E8:SSL routines:*SSL3_GET_CERTIFICATE_**REQUEST:tls client cert req with anon cipher* 2012.02.14 09:02:33 LOG5[2500:5876]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket After a *stunnel.conf **reload* on both box (yes, only a reload) then the following details and differences appear: *stunnel server* vs *openssl s_client : OK - "certificate accepted" * 2012.02.14 09:42:02 LOG5[134236:132440]: Service unison accepted connection from 192.168.0.216:23698 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): before/accept initialization 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): SSLv3 read client hello B 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): *SSLv3 write server hello A* 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): *SSLv3 write certificate A* 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): *SSLv3 write key exchange A* 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): SSLv3 write certificate request A 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): SSLv3 flush data 2012.02.14 09:42:02 LOG7[134236:132440]: Starting certificate verification: depth=0, /C=HU/ST=Mazovia Province/L=Budapest/O=-/OU=client/CN=x-pc 2012.02.14 09:42:02 LOG5[134236:132440]: Certificate accepted: depth=0, /C=HU/ST=Mazovia Province/L=Budapest/O=-/OU=client/CN=x-pc 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): SSLv3 read client certificate A 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): SSLv3 read client key exchange A 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): SSLv3 read certificate verify A 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): SSLv3 read finished A 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): SSLv3 write session ticket A 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): SSLv3 write change cipher spec A 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): SSLv3 write finished A 2012.02.14 09:42:02 LOG7[134236:132440]: SSL state (accept): SSLv3 flush data *stunnel server* vs *stunnel client : FAILED * *server:* 2012.02.14 09:45:24 LOG5[134236:134552]: Service unison accepted connection from 192.168.0.216:23752 2012.02.14 09:45:24 LOG7[134236:134552]: SSL state (accept): before/accept initialization 2012.02.14 09:45:24 LOG7[134236:134552]: SSL state (accept): SSLv3 read client hello B 2012.02.14 09:45:24 LOG7[134236:134552]: SSL state (accept): *SSLv3 write server hello A* 2012.02.14 09:45:24 LOG7[134236:134552]: SSL state (accept): *SSLv3 write key exchange A* 2012.02.14 09:45:24 LOG7[134236:134552]: SSL state (accept): SSLv3 write certificate request A 2012.02.14 09:45:24 LOG7[134236:134552]: SSL state (accept): SSLv3 flush data 2012.02.14 09:45:24 LOG7[134236:134552]: SSL alert (read): fatal: unexpected_message 2012.02.14 09:45:24 LOG3[134236:134552]: SSL_accept: 140943F2: error:140943F2:SSL routines:*SSL3_READ_BYTES:sslv3 alert unexpected message* 2012.02.14 09:45:24 LOG5[134236:134552]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2012.02.14 09:45:24 LOG7[134236:134552]: Service unison finished (0 left) *client:* 2012.02.14 09:45:18 LOG5[1100:7176]: Service unison connected remote server from 192.168.0.216:23752 2012.02.14 09:45:18 LOG7[1100:7176]: Remote FD=452 initialized 2012.02.14 09:45:18 LOG7[1100:7176]: SSL state (connect): before/connect initialization 2012.02.14 09:45:18 LOG7[1100:7176]: SSL state (connect): SSLv3 write client hello A 2012.02.14 09:45:18 LOG7[1100:7176]: SSL state (connect): *SSLv3 read server hello A* 2012.02.14 09:45:18 LOG7[1100:7176]: SSL state (connect): *SSLv3 read server key exchange A* 2012.02.14 09:45:18 LOG7[1100:7176]: SSL alert (write): *fatal: unexpected_message* 2012.02.14 09:45:18 LOG3[1100:7176]: SSL_connect: 140870E8: error:140870E8:SSL routines:*SSL3_GET_CERTIFICATE_**REQUEST:tls client cert req with anon cipher* 2012.02.14 09:45:18 LOG5[1100:7176]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Please, give me some clues. Thank you, Laszlo **

3 5

AUTO: Jean Daros is out of the office (returning 02/13/2012)
by Jean Daros 11 Feb '12

11 Feb '12

I am out of the office until 02/13/2012. If you need immediate assistance, please contact the helpdesk at ext. 1540. Thank you. Note: This is an automated response to your message "stunnel-users Digest, Vol 91, Issue 6" sent on 2/11/2012 6:00:01 AM. This is the only notification you will receive while this person is away.

1 0

(no subject)
by Jean Daros 07 Feb '12

07 Feb '12

We are using version 4.33 with RedRock Software - Tutortrac Stunnel will crash. The stunnel service terminated unexpectedly. Faulting application stunnel.exe, veraion 0.0.0.0, faulting module libeay32.dll, version 1.0.0.0 fault address 0x000731ee. Any ideas? -Jean Berkeley College

2 1

Improving SSL security and protecting against the BEAST attack
by Shannon Carver 06 Feb '12

06 Feb '12

Hi all, Long time lurker, but first time poster on the Stunnel mailing list. I'm currently entering into a business partnership with a prominent media group, and as such they've got some strict guidelines by which their partners should abide by when it comes to Security/Encryption, both for brand protection, and making sure that both sides are sufficiently covered (at least from a general scan point of view). Basically the big thing that is coming up in my testing now (predominantly using the Qualysis tool at www.ssllabs.com) is that I'm vulnerable to the BEAST attack, CBC-Mode vulnerabilities and a potential issue of DoS attack due to server accepting Client Side Re-negotiation. I've spent days now trawling the web looking for a solution, but haven't really found anything of use yet, short of disabling CBC Ciphers completely (e.g 'cipher = RC4-SHA:RC4-MD5:!SSLv2:!ADH:!EDH:!EXP:!aNULL:!eNULL:!NULL' or similar), but I fear this me be too restrictive when it comes to client support. I guess my question is, are there other stunnel users who've been in the same situation, and is there a recommended cipher/options list when using Stunnel for HTTPS? Thanks in advance Shannon

1 0

Re: [stunnel-users] No SSL handshake between stunnel in client mode and SSL server
by Michal Trojnara 06 Feb '12

06 Feb '12

On Wednesday, 1 of February 2012, Jose Alf. wrote: > Looks like your client connects for a very short time, sends just 1 byte, > the disconnects. > > Mike can correct me if I am wrong. [cut] > 2012.01.31 12:57:12 LOG6[6748:6808]: SSL connected: new session negotiated [cut] > 2012.01.31 12:57:22 LOG5[6748:6808]: Connection closed: 200 bytes sent to SSL, 1 bytes sent to socket 2012.01.31 12:57:22 As requested: The log says "SSL connected" (as opposed to "SSL accepted"), so this service was configured in client mode, so SSL=server side and socket=client side. 200 bytes sent to SSL were received from socket (i.e. client), and 1 byte sent to socket were received from SSL (i.e. server). Otherwise you are correct. Mike

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

stunnel-users