- stunnel-users - stunnel.org

Access control/TCP wrappers
by Craig Watkinson 23 Feb '10

23 Feb '10

Hi, We're using stunnel to provide a secure interface to an old server that doesn't support HTTPS natively. I'd like to implement some access control so that connections are only supported from specific IP addresses. I am using v4.27 of stunnel that I downloaded from HPs website, and am running it from inittab to ensure it is always running. Unfortunately I don't think it's compiled with libwrap. Should I see libwrap listed when I run ldd against the binary (see below for output)? I think it's possible to run stunnel from inetd. Could I wrapper it here? Is the following entry correct? stunnel stream tcp nowait root /usr/lbin/tcpd /opt/iexpress/stunnel/bin/stunnel stunnel I think this would work, but I'm concerned that if stunnel was to crash or be killed that there would be nothing restarting it if we ran it from inetd. Any advice much appreciated Craig ------------------------------------- # ./stunnel -version stunnel 4.27 on ia64-hp-hpux11.23 with OpenSSL 0.9.7m 23 Feb 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Global options debug = 5 pid = /opt/iexpress/stunnel/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /opt/iexpress/stunnel/etc/stunnel/stunnel.pem ciphers = ALL:!aNULL:!eNULL+RC4:@STRENGTH key = /opt/iexpress/stunnel/etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none # ldd ./stunnel libdl.so.1 => /usr/lib/hpux32/libdl.so.1 libnsl.so.1 => /usr/lib/hpux32/libnsl.so.1 libpthread.so.1 => /usr/lib/hpux32/libpthread.so.1 libunwind.so.1 => /usr/lib/hpux32/libunwind.so.1 libc.so.1 => /usr/lib/hpux32/libc.so.1 libxti.so.1 => /usr/lib/hpux32/libxti.so.1 libuca.so.1 => /usr/lib/hpux32/libuca.so.1 libdl.so.1 => /usr/lib/hpux32/libdl.so.1 _________________________________________________________________ Do you have a story that started on Hotmail? Tell us now http://clk.atdmt.com/UKM/go/195013117/direct/01/

2 2

4.26 and commercial certificate - Now working.
by Editor (Kevin) 20 Feb '10

20 Feb '10

Hi: Thanks. Everything is working now. > Message: 1 > Date: Wed, 17 Feb 2010 07:11:16 -0800 (PST) > From: Leandro Avila <leandro.avila(a)ymail.com> > Subject: Re: [stunnel-users] Small challenge with version 4.26 and a > commercial certificate > To: stunnel-users(a)mirt.net > Message-ID: <544640.49520.qm(a)web111011.mail.gq1.yahoo.com> > Content-Type: text/plain; charset=us-ascii > > Hi Kevin, > > I think there is ambiguous information about this. > The man page states that the private key should be unencrypted > However, the changelog states that the support for pass phrases was fixed in v4.20 > > I'll do some testing see what I can find. Or maybe someone can shed some light on the issue. > > Best regards > > ----------------- > Leandro Avila

1 0

Re: [stunnel-users] Make reports an error on Aix with stunnel-4.30
by Michal Trojnara 19 Feb '10

19 Feb '10

Derek Nicholls wrote: > gcc -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith > -I/opt/freeware/include -o stunnel file.o client.o log.o options.o > protocol.o network.o resolver.o ssl.o ctx.o verify.o sthreads.o stunnel.o > pty.o libwrap.o -lz -ldl -L/opt/freeware/lib -lssl -lcrypto > ld: 0711-317 ERROR: Undefined symbol: .SSL_CTX_set_info_callback > ld: 0711-317 ERROR: Undefined symbol: .SSL_CTX_sess_set_new_cb > ld: 0711-317 ERROR: Undefined symbol: .SSL_CTX_sess_set_get_cb > ld: 0711-317 ERROR: Undefined symbol: .SSL_CTX_sess_set_remove_cb > ld: 0711-317 ERROR: Undefined symbol: .BIO_set_flags > ld: 0711-345 Use the -bloadmap or -bnoquiet option to obtain more > information. > collect2: ld returned 8 exit status > make: 1254-004 The error code from the last command is 1. What it means is that the linker has found on its path another version of libssl, older than your headers in /opt/freeware/include. Mike

1 0

Cert Chain Question
by Craig Kelley 18 Feb '10

18 Feb '10

I've been attempting to include an intermediate chain for my stunnel setup. First, I previously used an entrust-signed certificate with stunnel just fine, but now I've purchased one from godaddy ($190 for 3 certs for 5 years!). The only problem is that the server has multiple certificates to install. Under Apache, I solved it with this: SSLCertificateFile /etc/httpd/conf/ssl.crt/server.crt SSLCertificateKeyFile /etc/httpd/conf/ssl.key/server.key SSLCertificateChainFile /etc/httpd/conf/ssl.crt/godaddy.crt Which works just fine. With stunnel I attempted this configuration: cert = /etc/stunnel/server.crt key = /etc/stunnel/server.key CAfile = /etc/stunnel/godaddy.crt All those files are identical to the Apache configuration. Stunnel starts up, but clients loudly complain that the certificate is not valid. If I examine the certificate in Thunderbird (I use stunnel for IMAPS and POP3S), it correctly identifies the cert as being from GoDaddy and that it will expire in 2015. But for some reason, the chain to its root server is broken. What am I doing wrong? -- Craig Kelley http://inconnu.islug.org/~ink finger same server for PGP block

2 2

Small challenge with version 4.26 and a commercial certificate
by editor 17 Feb '10

17 Feb '10

Hi: I decided to spend the money and get a commercial certificate from Thawte. It was not a bad price. I have installed in the Sun host and while it works perfectly for Apache but I can not get the file to work for stunnel. The idea is to allow mobile users to access their mail without annoying certificate warnings. This is what happens: # /usr/local/bin/stunnel & [1] 13704 # Enter PEM pass phrase: 2010.02.14 05:32:46 LOG7[13704:1]: Snagged 64 random bytes from /export/home/kgreene/.rnd 2010.02.14 05:32:46 LOG7[13704:1]: Wrote 1024 new random bytes to /export/home/kgreene/.rnd 2010.02.14 05:32:46 LOG7[13704:1]: RAND_status claims sufficient entropy for the PRNG 2010.02.14 05:32:46 LOG7[13704:1]: PRNG seeded successfully 2010.02.14 05:32:46 LOG7[13704:1]: Certificate: /usr/local/etc/stunnel/stunnel.pem 2010.02.14 05:32:46 LOG7[13704:1]: Certificate loaded 2010.02.14 05:32:46 LOG7[13704:1]: Key file: /usr/local/etc/stunnel/stunnel.pem 2010.02.14 05:32:46 LOG3[13704:1]: error stack: 140B3009 : error:140B3009:SSL routines:SSL_CTX_use_RSAPrivateKey_file:PEM lib 2010.02.14 05:32:46 LOG3[13704:1]: error stack: 906A068 : error:0906A068:PEM routines:PEM_do_header:bad password read 2010.02.14 05:32:46 LOG3[13704:1]: SSL_CTX_use_RSAPrivateKey_file: 906406D: error:0906406D:PEM routines:PEM_def_callback:problems getting password [1]+ Exit 1 /usr/local/bin/stunnel # It never pauses to let me enter the PEM pass phase. As in instructed in the man pages, I created the pem file by merging the private key and the certificate from Thawte. This is the version statement: # /usr/local/bin/stunnel -version stunnel 4.26 on sparc-sun-solaris2.9 with OpenSSL 0.9.8l 5 Nov 2009 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none ------------------------------- Any ideas would be great. Thanks. Kevin

3 2

nessus crashes stunnel
by Roger Cruz 12 Feb '10

12 Feb '10

We ran Nessus on a Linux system and found that stunnel crashes when the weak certificate suite is enabled. GDB shows the stack trace below and it appears to be in the SSL library. My search on this mailing list led me to this message that appears to report a similar problem http://mirt.net/pipermail/stunnel-users/2008-January/001830.html Am I to understand that the problem is really with OpenSSL and that's what needs to be upgraded? If so, do we know what version will have the fixed problem? I'm going to post in the OpenSSL forum as well, but I wanted to start here since from our perspective, Stunnel is the one crashing. Thank you Roger Cruz 2010.02.05 12:49:11 LOG7[13524:3086718672]: Cleaning up the signal pipe 2010.02.05 12:49:11 LOG6[13524:3086718672]: Child process 13575 finished with code 0 Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0xb7fa7b90 (LWP 13574)] 0x007b24a7 in krb5_is_referral_realm () from /usr/lib/libkrb5.so.3 (gdb) bt #0 0x007b24a7 in krb5_is_referral_realm () from /usr/lib/libkrb5.so.3 #1 0x0089d338 in kssl_keytab_is_available () from /lib/libssl.so.6 #2 0x008803b1 in ssl3_choose_cipher () from /lib/libssl.so.6 #3 0x0087b2a2 in ssl3_get_client_hello () from /lib/libssl.so.6 #4 0x0087bc85 in ssl3_accept () from /lib/libssl.so.6 #5 0x0089109a in SSL_accept () from /lib/libssl.so.6 #6 0x00884d0d in ssl23_get_client_hello () from /lib/libssl.so.6 #7 0x0088554b in ssl23_accept () from /lib/libssl.so.6 #8 0x0089109a in SSL_accept () from /lib/libssl.so.6 #9 0x003628e2 in ?? () from /usr/sbin/stunnel #10 0x00363acd in ?? () from /usr/sbin/stunnel #11 0x003645ba in ?? () from /usr/sbin/stunnel #12 0x003646a8 in client () from /usr/sbin/stunnel #13 0x0025f45b in start_thread () from /lib/libpthread.so.0 #14 0x00448e5e in clone () from /lib/libc.so.6 (gdb) quit [root@p20xen1 current_hq]# stunnel -version stunnel 4.15 on i686-redhat-linux-gnu with OpenSSL 0.9.8b 04 May 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none

1 0

using ECDH with stunnel
by Carl 11 Feb '10

11 Feb '10

Is is possible to use ECDH with stunnel? When using s_server and specifying the cipher I can establish a connection. But when using stunnel and specifing the same cipher, the connection is rejected with "no shared cipher". e.g. openssl s_server -cert server.pem -cipher DHE-RSA-AES256-SHA It appears the difference is that s_server uses "default temp ECDH parameters" while stunnel doesn't have a default nor is there a way to specify the ECDH parameters. >From what I understand the ECDH parameters cannot be included with the certificate, unlike DH parameters. Is my understanding correct? Thanks, Carl

2 2

SSL connection through Proxy server with authentication
by Girish Kolari 09 Feb '10

09 Feb '10

Hi I am trying to create a SSL connection through Proxy server with authentication. my stunnel.conf file ----- part of the conf file connect = <Proxy server IP: Port number> protocol=connect protocolHost=<Destination server:Port number> protocolUsername = useme protocolPassword = test ----- but it fails to establish connection. Log details: ----- part of log generated 2010.02.09 16:07:49 LOG5[14506:2952859648]: Negotiations for connect (client side) started 2010.02.09 16:07:49 LOG7[14506:2952859648]: -> CONNECT <Destination server:Port number> HTTP/1.1 2010.02.09 16:07:49 LOG7[14506:2952859648]: -> Host: 6<Destination server:Port number> 2010.02.09 16:07:49 LOG7[14506:2952859648]: -> Proxy-Authorization: basic dXNlbWU6dGVzdA== 2010.02.09 16:07:49 LOG7[14506:2952859648]: -> 2010.02.09 16:07:49 LOG3[14506:2952859648]: Unexpected socket close (fdgetline) 2010.02.09 16:07:49 LOG5[14506:2952859648]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2010.02.09 16:07:49 LOG7[14506:2952859648]: Service IDrive finished (0 left) ----- I tried with proxy server without authentication it works great, but not sure why Proxy server with authentication is not working. Is it I am missing some thing or am I doing something wrong? I appreciate all suggestion and help on this. Thanks & Regards Girish Kolari

1 0

Stunnel and multiple endpoints.
by Richard Harvey 08 Feb '10

08 Feb '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi guys, I'm new to stunnel and I'm looking for a way to run stunnel on a single port. Then based on the client certificate, proxy that connection (in clear) to a different IP:port. If this something I can do with stunnel or am i barking up the wrong tree so to speak. Any help would be a appreciated guys. Cheers Ric - -- Richard Harvey European Linux Administrator Core Systems Ticketmaster +44 (0)207 9804328 80228 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAktv5ZIACgkQlh7dZJ0PyjcfxQCfWA5PO0d/uDf/Mqq2BrFsu5wf xBYAoKmKW8760P91JR3oeviKwjd/1o/A =o+/U -----END PGP SIGNATURE-----

3 5

Re: [stunnel-users] Memory problems
by Peter Griffin 05 Feb '10

05 Feb '10

A portion of the messages in /var/log/stunnel.log before I disabled logging as I thought it would help: 2010.02.04 22:46:28 LOG3[1615:140132721108752]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:46:32 LOG3[1615:140132721108752]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:46:55 LOG3[1615:140132734469904]: getpeerbyname: Transport endpoint is not connected (107) 2010.02.04 22:46:57 LOG3[1615:140132734400272]: SSL_read: Connection reset by peer (104) 2010.02.04 22:47:12 LOG3[1615:140132734261008]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:47:35 LOG3[1615:140132735235856]: SSL_read: Connection reset by peer (104) 2010.02.04 22:48:08 LOG3[1615:140132733982480]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:48:09 LOG3[1615:140132721108752]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:48:09 LOG3[1615:140132721108752]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:48:09 LOG3[1615:140132721108752]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:48:23 LOG3[1615:140132735235856]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:48:42 LOG3[1615:140132733982480]: transfer() loop executes not transferring any data 2010.02.04 22:48:42 LOG3[1615:140132733982480]: please report the problem to Michal.Trojnara(a)mirt.net 2010.02.04 22:48:42 LOG3[1615:140132733982480]: socket open: rd=yes wr=no, ssl open: rd=no wr=yes 2010.02.04 22:48:42 LOG3[1615:140132733982480]: socket ready: rd=no wr=no, ssl ready: rd=yes wr=no 2010.02.04 22:48:42 LOG3[1615:140132733982480]: wants: SSL_read rd=no wr=no, SSL_write rd=no wr=yes, SSL_shutdown rd=no wr=no 2010.02.04 22:48:42 LOG3[1615:140132733982480]: socket input buffer: 16384 byte(s), ssl input buffer: 0 byte(s) 2010.02.04 22:48:42 LOG3[1615:140132733982480]: check_SSL_pending=0 2010.02.04 22:48:52 LOG3[1615:140132734261008]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:48:56 LOG3[1615:140132734261008]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:01 LOG3[1615:140132734330640]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:03 LOG3[1615:140132734400272]: SSL socket closed on SSL_read with 7294 byte(s) in buffer 2010.02.04 22:49:05 LOG3[1615:140132734469904]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:16 LOG3[1615:140132721108752]: SSL socket closed on SSL_read with 16384 byte(s) in buffer 2010.02.04 22:49:26 LOG3[1615:140132733982480]: SSL socket closed on SSL_read with 16384 byte(s) in buffer 2010.02.04 22:49:28 LOG3[1615:140132733982480]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:29 LOG3[1615:140132733982480]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:29 LOG3[1615:140132733982480]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:29 LOG3[1615:140132733982480]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:29 LOG3[1615:140132733982480]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:34 LOG3[1615:140132733982480]: getpeerbyname: Transport endpoint is not connected (107) 2010.02.04 22:49:35 LOG3[1615:140132720899856]: SSL_accept: Peer suddenly disconnected 2010.02.04 22:49:35 LOG3[1615:140132733982480]: SSL_accept: Peer suddenly disconnected

1 0

Does stunnel support IPv6, and proxying from IPv4 to IPv6?
by Jeff Schmidt 05 Feb '10

05 Feb '10

Hello, I was wondering, does stunnel have IPv6 support? If so, does such support extend to the point of allowing the 'local' side of the connection (e.g. from a server process, or from a client application) to be made with IPv4, while the 'global' side is IPv6? If so, is it possible to use stunnel in an unencrypting mode (that is, not encrypting the data with SSL, but just using stunnel to proxy traffic between IPv4 and IPv6)? The reason I ask is that I am looking for a solution to allow me to IPv6-enable 'legacy' IPv4 applications. When I started thinking about this problem, I almost immediately remembered using stunnel in the past to SSL-enable IPv4 applications which didn't have built-in SSL support, and it occured to me that there was a lot of similarity between the non-SSL application problem, and the non-IPv6 application problem - that is, it seems like possibly, you could setup a sort of IPv6 tunnel using stunnel (or something similar), where the legacy application makes an local IPv4 connection to the stunnel/proxy software, and the proxy then makes an IPv6 connection, just like stunnel accepts local IPv4 connections (unecrypted) and then creates a second, proxied connection which is encrypted. Does that make any sense? (I hope so). So, can stunnel be used with both IPv4 and IPv6 simultaneously?

1 0

Memory problems
by Peter Griffin 05 Feb '10

05 Feb '10

Hi, I'm using stunnel 4.22 with OpenSSL 0.9.7m - I am using 4.22 because of the xforwarded-for patch and 4.27 is not supported. I am running stunnel in standalone mode on a P4 3.2Ghz with 1Gb of Ram. When I start haproxy & stunnel after a reboot, free memory starts at about 750Mb then slowly degrades to about 45Mb. After 8 more hours or so of operation our site was completely unbrowsable. I checked our firewall for unusual traffic, and there were none. Running top does not indicate any processes which are consuming all that memory and that is what I find weid. Only a reboot frees up the memory. Should I be running stunnel on more Ram? stunnel -v output: [root@lb1 ~]# stunnel -version stunnel 4.22 on x86_64-unknown-linux-gnu with OpenSSL 0.9.7m 23 Feb 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = ALL:!aNULL:!eNULL+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none stunnel.conf: #setuid=stunnel #setgid=proxy #debug = 3 #output = /var/log/stunnel.log socket=l:TCP_NODELAY=1 socket=r:TCP_NODELAY=1 [https] accept=10.0.1.50:443 connect=10.0.1.50:80 TIMEOUTclose=0 xforwardedfor=yes

1 0

HTTP Connect proxy patch
by Dmitry Gromov 05 Feb '10

05 Feb '10

Hi! It seems like the latest patch to support HTTP Connect proxy is for 4.05 version. Any one knows if it is compatible with the latest version? If not, is there more recent version of the patch? I also wonder why this never made to the code... Seems like a very useful feature. Thanks, Dmitry -- DG NJ

2 4

after 4.31 no more logging to syslog
by Axel Reinhold 05 Feb '10

05 Feb '10

> > with stunnel up to 4.29 i got syslog messages to /var/log/maillog. > > with stunnel 4.30 the startup was broken - some chroot-issues, > > with your patches i could get it running - with 4.31 stunnel is > > working for me but i don't get any syslogging any more - is there > > a way to get the old behaviour again? > > Please test: > ftp://stunnel.mirt.net/stunnel/stunnel-4.32b1.tar.gz > and let us know if it works for you. > > Best regards, > Mike > Dear Mike, looks very good - works for me 100%. Thanks. Cheers Axel

1 0

after 4.31 no more logging to syslog
by Axel Reinhold 04 Feb '10

04 Feb '10

with stunnel up to 4.29 i got syslog messages to /var/log/maillog. with stunnel 4.30 the startup was broken - some chroot-issues, with your patches i could get it running - with 4.31 stunnel is working for me but i don't get any syslogging any more - is there a way to get the old behaviour again? root@bongo opt]# grep stunnel /var/log/maillog Jan 27 21:38:25 bongo stunnel: LOG5[31985:16384]: stunnel 4.29 on i686-pc-linux-gnu with OpenSSL 0.9.8l 5 Nov 2009 Jan 27 21:38:25 bongo stunnel: LOG5[31985:16384]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Jan 27 21:38:25 bongo stunnel: LOG6[31985:16384]: file ulimit = 1024 (can be changed with 'ulimit -n') Jan 27 21:38:25 bongo stunnel: LOG6[31985:16384]: poll() used - no FD_SETSIZE limit for file descriptors Jan 27 21:38:25 bongo stunnel: LOG5[31985:16384]: 500 clients allowed Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 9 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 10 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 11 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: SO_REUSEADDR option set on accept socket Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: imaps bound to 0.0.0.0:993 Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 12 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: SO_REUSEADDR option set on accept socket Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: pop3s bound to 0.0.0.0:995 Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 13 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: SO_REUSEADDR option set on accept socket Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: arcorpop3 bound to 127.0.0.1:3003 Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 14 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: SO_REUSEADDR option set on accept socket Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: bnvhpop3 bound to 127.0.0.1:3004 Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 15 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: SO_REUSEADDR option set on accept socket Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: netidpop3 bound to 127.0.0.1:3005 Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 16 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: SO_REUSEADDR option set on accept socket Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: icybolt bound to 127.0.0.1:3006 Jan 27 21:38:25 bongo stunnel: LOG7[31991:16384]: Created pid file /var/run/stunnel.pid Axel

2 1

Stunnel 4.31 released
by Michal Trojnara 03 Feb '10

03 Feb '10

The ChangeLog entry: Version 4.31, 2010.02.03, urgency: MEDIUM: * New features - Log file reopen on USR1 signal was added. * Bugfixes - Some regression issues introduced in 4.30 were fixed. SHA-1 value for stunnel-4.31.tar.gz: f51fc544a0554f6eee2bfca1fcb8ddcb8386ce32 Home page: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ Best regards, Michal Trojnara

1 0

after 4.30 no more working
by Axel Reinhold 03 Feb '10

03 Feb '10

My current compile-install-configure-run environment is broken with 4.30. Up to 4.29 stunnel is working ok for me. 4.30 compiles, installs but when running it (i simply start /opt/ssl/bin/stunnel) the behaviour is completely different. Up to version 4.29 the program simply starts and logs to syslog: root@bongo opt]# /opt/ssl/bin/stunnel root@bongo opt]# grep stunnel /var/log/maillog Jan 27 21:38:25 bongo stunnel: LOG5[31985:16384]: stunnel 4.29 on i686-pc-linux-gnu with OpenSSL 0.9.8l 5 Nov 2009 Jan 27 21:38:25 bongo stunnel: LOG5[31985:16384]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Jan 27 21:38:25 bongo stunnel: LOG6[31985:16384]: file ulimit = 1024 (can be changed with 'ulimit -n') Jan 27 21:38:25 bongo stunnel: LOG6[31985:16384]: poll() used - no FD_SETSIZE limit for file descriptors Jan 27 21:38:25 bongo stunnel: LOG5[31985:16384]: 500 clients allowed Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 9 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 10 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 11 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: SO_REUSEADDR option set on accept socket Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: imaps bound to 0.0.0.0:993 Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 12 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: SO_REUSEADDR option set on accept socket Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: pop3s bound to 0.0.0.0:995 Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 13 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: SO_REUSEADDR option set on accept socket Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: arcorpop3 bound to 127.0.0.1:3003 Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 14 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: SO_REUSEADDR option set on accept socket Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: bnvhpop3 bound to 127.0.0.1:3004 Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 15 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: SO_REUSEADDR option set on accept socket Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: netidpop3 bound to 127.0.0.1:3005 Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: FD 16 in non-blocking mode Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: SO_REUSEADDR option set on accept socket Jan 27 21:38:25 bongo stunnel: LOG7[31985:16384]: icybolt bound to 127.0.0.1:3006 Jan 27 21:38:25 bongo stunnel: LOG7[31991:16384]: Created pid file /var/run/stunnel.pid With 4.30 i get lots of messages to the console and stunnel does not fork into background - where is the magic to get the old behaviour with 4.30? At the end stunnel reports: daemon: No such file or directory (2) root@bongo opt]# /opt/ssl/bin/stunnel Reading configuration from file /etc/ssl/stunnel/stunnel.conf Snagged 64 random bytes from /root/.rnd Wrote 1024 new random bytes to /root/.rnd RAND_status claims sufficient entropy for the PRNG PRNG seeded successfully Certificate: /etc/ssl/stunnel/freakout.pem Certificate loaded Key file: /etc/ssl/stunnel/freakout.key Private key loaded SSL context initialized for service imaps Certificate: /etc/ssl/stunnel/freakout.pem Certificate loaded Key file: /etc/ssl/stunnel/freakout.key Private key loaded SSL context initialized for service pop3s SSL context initialized for service arcorpop3 SSL context initialized for service bnvhpop3 SSL context initialized for service netidpop3 SSL context initialized for service icybolt Configuration successful No limit detected for the number of clients FD=8 in non-blocking mode FD=9 in non-blocking mode FD=10 in non-blocking mode Option SO_REUSEADDR set on accept socket Service imaps bound to 0.0.0.0:993 Service imaps opened FD=10 FD=11 in non-blocking mode Option SO_REUSEADDR set on accept socket Service pop3s bound to 0.0.0.0:995 Service pop3s opened FD=11 FD=12 in non-blocking mode Option SO_REUSEADDR set on accept socket Service arcorpop3 bound to 127.0.0.1:3003 Service arcorpop3 opened FD=12 FD=13 in non-blocking mode Option SO_REUSEADDR set on accept socket Service bnvhpop3 bound to 127.0.0.1:3004 Service bnvhpop3 opened FD=13 FD=14 in non-blocking mode Option SO_REUSEADDR set on accept socket Service netidpop3 bound to 127.0.0.1:3005 Service netidpop3 opened FD=14 FD=15 in non-blocking mode Option SO_REUSEADDR set on accept socket Service icybolt bound to 127.0.0.1:3006 Service icybolt opened FD=15 Created pid file /var/run/stunnel.pid daemon: No such file or directory (2) removing pid file /var/run/stunnel.pid Axel

3 5

after 4.30 no more working
by Axel Reinhold 01 Feb '10

01 Feb '10

> Axel Reinhold wrote: > > root@bongo opt]# /opt/ssl/bin/stunnel > [cut] > > daemon: No such file or directory (2) > > removing pid file /var/run/stunnel.pid > > That's interesting. I couldn't reproduce it. > > Could you install strace tool and than execute: > strace -f -o /tmp/stunnel.log /opt/ssl/bin/stunnel > , and than send us the output of /tmp/stunnel.log? > > Mike Here's the strace-log.

2 1

Stunnel 4.3 not forwarding to server socket
by Vladimir Stariradev 28 Jan '10

28 Jan '10

Dear Stunnel users, I'm running stunnel on my server which accepts connections from my mobile phone emulator (j2me) like so: midlet app -> port:5555 stunnel -> port:6666 server. My midlet, which can be treated as a java app, uses ssl://127.0.0.1:5555 to connect to stunnel. I can establish a connection between the stunnel and the app because I can get information on the certificate. The problem is that when I send data from the midlet to the server, the server doesn't accept it, nor does it signal that anything has been received even when I have double-checked that the streams are setup. I have pasted my config and log files below. Any suggestions are fully appreciated. Regards, Vladimir version: stunnel 4.30 on x86-pc-mingw32-gnu with OpenSSL 0.9.8l 5 Nov 2009 stunnel.conf: cert = SecIM.pem debug = 7 ;output = stunnel.log [SecureIM] accept = 5555 connect = 6666 client = no Log file: 2010.01.28 17:51:09 LOG5[3828:1772]: Reading configuration from file stunnel.conf 2010.01.28 17:51:09 LOG7[3828:1772]: Snagged 64 random bytes from C:/.rnd 2010.01.28 17:51:09 LOG7[3828:1772]: Wrote 0 new random bytes to C:/.rnd 2010.01.28 17:51:09 LOG7[3828:1772]: RAND_status claims sufficient entropy for the PRNG 2010.01.28 17:51:09 LOG7[3828:1772]: PRNG seeded successfully 2010.01.28 17:51:09 LOG7[3828:1772]: Certificate: SecIM.pem 2010.01.28 17:51:09 LOG7[3828:1772]: Certificate loaded 2010.01.28 17:51:09 LOG7[3828:1772]: Key file: SecIM.pem 2010.01.28 17:51:11 LOG7[3828:1772]: Private key loaded 2010.01.28 17:51:11 LOG7[3828:1772]: SSL context initialized for service SecureIM 2010.01.28 17:51:11 LOG5[3828:1772]: Configuration successful 2010.01.28 17:51:11 LOG5[3828:1772]: No limit detected for the number of clients 2010.01.28 17:51:11 LOG7[3828:1772]: FD=168 in non-blocking mode 2010.01.28 17:51:11 LOG7[3828:1772]: Option SO_REUSEADDR set on accept socket 2010.01.28 17:51:11 LOG7[3828:1772]: Service SecureIM bound to 0.0.0.0:5555 2010.01.28 17:51:11 LOG7[3828:1772]: Service SecureIM opened FD=168 2010.01.28 17:51:11 LOG5[3828:1772]: stunnel 4.30 on x86-pc-mingw32-gnu with OpenSSL 0.9.8l 5 Nov 2009 2010.01.28 17:51:11 LOG5[3828:1772]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2010.01.28 17:52:13 LOG7[3828:2836]: Service SecureIM accepted FD=212 from 127.0.0.1:56133 2010.01.28 17:52:13 LOG7[3828:2836]: Creating a new thread 2010.01.28 17:52:13 LOG7[3828:2836]: New thread created 2010.01.28 17:52:13 LOG7[3828:3336]: Service SecureIM started 2010.01.28 17:52:13 LOG7[3828:3336]: FD=212 in non-blocking mode 2010.01.28 17:52:13 LOG7[3828:3336]: Option TCP_NODELAY set on local socket 2010.01.28 17:52:13 LOG5[3828:3336]: Service SecureIM accepted connection from 127.0.0.1:56133 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): before/accept initialization 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 read client hello A 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 write server hello A 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 write certificate A 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 write server done A 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 flush data 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 read client key exchange A 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 read finished A 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 write change cipher spec A 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 write finished A 2010.01.28 17:52:13 LOG7[3828:3336]: SSL state (accept): SSLv3 flush data 2010.01.28 17:52:13 LOG7[3828:3336]: 1 items in the session cache 2010.01.28 17:52:13 LOG7[3828:3336]: 0 client connects (SSL_connect()) 2010.01.28 17:52:13 LOG7[3828:3336]: 0 client connects that finished 2010.01.28 17:52:13 LOG7[3828:3336]: 0 client renegotiations requested 2010.01.28 17:52:13 LOG7[3828:3336]: 1 server connects (SSL_accept()) 2010.01.28 17:52:13 LOG7[3828:3336]: 1 server connects that finished 2010.01.28 17:52:13 LOG7[3828:3336]: 0 server renegotiations requested 2010.01.28 17:52:13 LOG7[3828:3336]: 0 session cache hits 2010.01.28 17:52:13 LOG7[3828:3336]: 0 external session cache hits 2010.01.28 17:52:13 LOG7[3828:3336]: 0 session cache misses 2010.01.28 17:52:13 LOG7[3828:3336]: 0 session cache timeouts 2010.01.28 17:52:13 LOG6[3828:3336]: SSL accepted: new session negotiated 2010.01.28 17:52:13 LOG6[3828:3336]: Negotiated ciphers: RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 2010.01.28 17:52:13 LOG7[3828:3336]: FD=424 in non-blocking mode 2010.01.28 17:52:13 LOG6[3828:3336]: connect_blocking: connecting 127.0.0.1:6666 2010.01.28 17:52:13 LOG7[3828:3336]: connect_blocking: s_poll_wait 127.0.0.1:6666: waiting 10 seconds 2010.01.28 17:52:13 LOG5[3828:3336]: connect_blocking: connected 127.0.0.1:6666 2010.01.28 17:52:13 LOG5[3828:3336]: Service SecureIM connected remote server from 127.0.0.1:56134 2010.01.28 17:52:13 LOG7[3828:3336]: Remote FD=424 initialized 2010.01.28 17:52:13 LOG7[3828:3336]: Option TCP_NODELAY set on remote socket 2010.01.28 17:54:02 LOG3[3828:3336]: SSL_read: Connection reset by peer (WSAECONNRESET) (10054) 2010.01.28 17:54:02 LOG5[3828:3336]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2010.01.28 17:54:02 LOG7[3828:3336]: Service SecureIM finished (0 left)

1 1

Re: [stunnel-users] need to restart stunnel if stunnel starts before network?
by Michal Trojnara 23 Jan '10

23 Jan '10

Zhang Weiwu wrote: > For developer how do you think make stunnel resolving the domain when > establishing connection? Sure. This is already implemented and described in the manual: http://stunnel.mirt.net/static/stunnel.html The option is: delay = yes Mike

1 0

FIPS compilation patch for stunnel 4.30
by Michal Trojnara 21 Jan '10

21 Jan '10

Dear Users, Please find a tiny patch for FIPS mode of stunnel 4.30: ftp://stunnel.mirt.net/stunnel/fips.patch BTW: Please consider making a donation if you appreciate my work on configuration file reloading feature. Use PayPal Donate button on http://stunnel.mirt.net/ Mike

1 0

Stunnel 4.30 released
by Michal Trojnara 21 Jan '10

21 Jan '10

The ChangeLog entry: Version 4.30, 2010.01.21, urgency: LOW/EXPERIMENTAL: * New features - Graceful configuration reload with HUP signal on Unix and with GUI on Windows. This release involves major modifications of the code. I expect some regression issues, so please make sure to test this version well before running it on your production systems. SHA-1 value for stunnel-4.30.tar.gz: 46d21c3ad0e761d697f4de8c258ef999287f13f9 Home page: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ Best regards, Michal Trojnara

1 0

need to restart stunnel if stunnel starts before network?
by Zhang Weiwu 20 Jan '10

20 Jan '10

Hello. One reason to opt for stunnel instead of ssh -L to secure a local non-ssl client is, that if user use stunnel, it can work transparently, start working only when a connection is listened, so user do not have to start ssh-L before using the client and do not have to shut it down after using the client. However these days through the use of NetworkManager, the network interfaces are often not brought up when stunnel started as a system service. Instead, the network interfaces are brought up by users, in case of wifi or wan, after user typed password. I found I have to first start network interfaces, and run /etc/init.d/stunnel restart to prepare to run the insecure client. Is there a way to run in stunnel in such a way it does nothing except listening, and can recover from network restart, which happens from time to time for road warriors like me? Thanks in advance. I didn't find answer on FAQ by the way.

2 1

Is PSK supported with openssl-1.0.0-beta3 ?
by anders nilsson 20 Jan '10

20 Jan '10

Hello I am running x64 Linux 2.6.18-92.1.22.el5 and installed OpenSSL 1.0.0-beta3 15 Jul 2009 My stunnel -version is: stunnel 4.15 on x86_64-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 I would like to run the ciphers TLS_PSK_WITH_3DES_EDE_CBC_SHA or TLS_PSK_WITH_AES_128_CBC_SHA and I wonder how I do that. My stunnel.conf contains: ciphers = PSK-AES128-CBC-SHA:PSK-3DES-EDE-CBC-SHA and the error I get is: 2009.11.05 11:32:32 LOG3[29268:47461015826624]: SSL_CTX_set_cipher_list: 1410D0B9: error:1410D0B9:SSL routines:SSL_CTX_set_cipher_list:no cipher match Do I compile in the latest OpenSSL to stunnel? Isnt it a problem that the stunnel.conf does not even have the syntax to read PSK-key parameters since its most often run with RSA keys. _________________________________________________________________ Windows Live: Gör det enklare för dina vänner att se vad du håller på med på Facebook. http://www.microsoft.com/sverige/windows/windowslive/see-it-in-action/socia…

1 0

PKI certs
by Lendl, Daniel 13 Jan '10

13 Jan '10

Will stunnel will work with PKI certs vs self-signed? Dan Lendl 919-257-3062

2 1

Stunnel and RTMPS
by Nimrod Aviram 11 Jan '10

11 Jan '10

Hi, I'm currently trying to use rtmps, with Red5 and Stunnel, and it doesn't work with properly signed certificates: When I use a self-signed test certificate, everything works just fine. But when I use a proper certificate (2048 bits from godaddy.com, if that matters), NetConnection.connect just doesn't work - the server doesn't get a connection. https stil works though, and the browser treats the certificate as valid, so it's probably not a problem with the certificate. I saw some earlier posts on this problem, does anyone have a solution? Any comments are welcome... thanks, Nimrod

2 1

server refuses connection by STARTTLS
by Tsurutani Naoki 10 Jan '10

10 Jan '10

Hi, I want to connect to SMTP server by STARTTLS, from MUA who does not support STARTTLS. However, I cannot connect to the server with recent stunnel. On Windows XP, my stunnel.conf is the following: client=yes debug=notice output=C:\logs\stunnel.log service=stunnel [smtp_server] accept=127.0.0.1:10025 connect=smtp.example.com:587 protocol=smtp stunnel version 4.27 or 4.29 is started as service, by "C:\Network\stunnel\stunnel.exe" -service -install c:\home\turutani\INI\stunnel.conf I cannot connect with OpenSSL distributed via stunnel. Then I changed the OpenSSL DLL, and found that I can connect with OpenSSL older than 0.9.8i, while that newer than 0.9.8j fails. But it works by adding "sslVersion=all" or "sslVersion=SSLv2" to configuration file. I also ran stunnel on FreeBSD, and found the same result about SSL version. Here is a debug level log, with no "sslVersion=" or "sslVersion=SSLv3": 2010.01.08 09:50:06 LOG7[2372:3760]: RAND_status claims sufficient entropy for the PRNG 2010.01.08 09:50:06 LOG7[2372:3760]: PRNG seeded successfully 2010.01.08 09:50:06 LOG7[2372:3760]: SSL context initialized for service smtp_server 2010.01.08 09:50:06 LOG5[2372:3760]: stunnel 4.28 on x86-pc-mingw32-gnu with OpenSSL 0.9.8l 5 Nov 2009 2010.01.08 09:50:06 LOG5[2372:3760]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2010.01.08 09:50:06 LOG5[2372:2252]: No limit detected for the number of clients 2010.01.08 09:50:06 LOG7[2372:2252]: FD 236 in non-blocking mode 2010.01.08 09:50:06 LOG7[2372:2252]: SO_REUSEADDR option set on accept socket 2010.01.08 09:50:06 LOG7[2372:2252]: smtp_server bound to 127.0.0.1:10025 2010.01.08 09:50:34 LOG7[2372:2252]: smtp_server accepted FD=244 from 127.0.0.1:1953 2010.01.08 09:50:34 LOG7[2372:2252]: Creating a new thread 2010.01.08 09:50:34 LOG7[2372:2252]: New thread created 2010.01.08 09:50:34 LOG7[2372:1036]: smtp_server started 2010.01.08 09:50:34 LOG7[2372:1036]: FD 244 in non-blocking mode 2010.01.08 09:50:34 LOG5[2372:1036]: smtp_server accepted connection from 127.0.0.1:1953 2010.01.08 09:50:34 LOG7[2372:1036]: FD 268 in non-blocking mode 2010.01.08 09:50:34 LOG6[2372:1036]: connect_blocking: connecting 133.x.y.z:587 2010.01.08 09:50:34 LOG7[2372:1036]: connect_blocking: s_poll_wait 133.x.y.z:587: waiting 10 seconds 2010.01.08 09:50:34 LOG5[2372:1036]: connect_blocking: connected 133.x.y.z:587 2010.01.08 09:50:34 LOG5[2372:1036]: smtp_server connected remote server from 192.168.3.118:1954 2010.01.08 09:50:34 LOG7[2372:1036]: Remote FD=268 initialized 2010.01.08 09:50:34 LOG5[2372:1036]: Negotiations for smtp (client side) started 2010.01.08 09:50:37 LOG7[2372:1036]: <- 220 smtp.example.com ESMTP Postfix 2010.01.08 09:50:37 LOG7[2372:1036]: -> 220 smtp.example.com ESMTP Postfix 2010.01.08 09:50:37 LOG7[2372:1036]: -> EHLO localhost 2010.01.08 09:50:37 LOG7[2372:1036]: <- 250-smtp.example.com 2010.01.08 09:50:37 LOG7[2372:1036]: <- 250-PIPELINING 2010.01.08 09:50:37 LOG7[2372:1036]: <- 250-SIZE 51200000 2010.01.08 09:50:37 LOG7[2372:1036]: <- 250-VRFY 2010.01.08 09:50:37 LOG7[2372:1036]: <- 250-ETRN 2010.01.08 09:50:37 LOG7[2372:1036]: <- 250-STARTTLS 2010.01.08 09:50:37 LOG7[2372:1036]: <- 250 8BITMIME 2010.01.08 09:50:37 LOG7[2372:1036]: -> STARTTLS 2010.01.08 09:50:37 LOG7[2372:1036]: <- 220 Ready to start TLS 2010.01.08 09:50:37 LOG5[2372:1036]: Protocol negotiations succeeded 2010.01.08 09:50:37 LOG7[2372:1036]: SSL state (connect): before/connect initialization 2010.01.08 09:50:37 LOG7[2372:1036]: SSL state (connect): SSLv3 write client hello A 2010.01.08 09:50:40 LOG3[2372:1036]: SSL_connect: Peer suddenly disconnected 2010.01.08 09:50:40 LOG5[2372:1036]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2010.01.08 09:50:40 LOG7[2372:1036]: smtp_server finished (0 left) with "sslVersion=all", 2010.01.08 09:45:33 LOG7[2664:3880]: RAND_status claims sufficient entropy for the PRNG 2010.01.08 09:45:33 LOG7[2664:3880]: PRNG seeded successfully 2010.01.08 09:45:34 LOG7[2664:3880]: SSL context initialized for service smtp_server 2010.01.08 09:45:34 LOG5[2664:3880]: stunnel 4.28 on x86-pc-mingw32-gnu with OpenSSL 0.9.8l 5 Nov 2009 2010.01.08 09:45:34 LOG5[2664:3880]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2010.01.08 09:45:34 LOG5[2664:2408]: No limit detected for the number of clients 2010.01.08 09:45:34 LOG7[2664:2408]: FD 236 in non-blocking mode 2010.01.08 09:45:34 LOG7[2664:2408]: SO_REUSEADDR option set on accept socket 2010.01.08 09:45:34 LOG7[2664:2408]: smtp_server bound to 127.0.0.1:10025 2010.01.08 09:46:05 LOG7[2664:2408]: smtp_server accepted FD=244 from 127.0.0.1:1944 2010.01.08 09:46:05 LOG7[2664:2408]: Creating a new thread 2010.01.08 09:46:05 LOG7[2664:2408]: New thread created 2010.01.08 09:46:05 LOG7[2664:2968]: smtp_server started 2010.01.08 09:46:05 LOG7[2664:2968]: FD 244 in non-blocking mode 2010.01.08 09:46:05 LOG5[2664:2968]: smtp_server accepted connection from 127.0.0.1:1944 2010.01.08 09:46:05 LOG7[2664:2968]: FD 268 in non-blocking mode 2010.01.08 09:46:05 LOG6[2664:2968]: connect_blocking: connecting 133.x.y.z:587 2010.01.08 09:46:05 LOG7[2664:2968]: connect_blocking: s_poll_wait 133.x.y.z:587: waiting 10 seconds 2010.01.08 09:46:05 LOG5[2664:2968]: connect_blocking: connected 133.x.y.z:587 2010.01.08 09:46:05 LOG5[2664:2968]: smtp_server connected remote server from 192.168.3.118:1945 2010.01.08 09:46:05 LOG7[2664:2968]: Remote FD=268 initialized 2010.01.08 09:46:05 LOG5[2664:2968]: Negotiations for smtp (client side) started 2010.01.08 09:46:05 LOG7[2664:2968]: <- 220 smtp.example.com ESMTP Postfix 2010.01.08 09:46:05 LOG7[2664:2968]: -> 220 smtp.example.com ESMTP Postfix 2010.01.08 09:46:05 LOG7[2664:2968]: -> EHLO localhost 2010.01.08 09:46:05 LOG7[2664:2968]: <- 250-smtp.example.com 2010.01.08 09:46:05 LOG7[2664:2968]: <- 250-PIPELINING 2010.01.08 09:46:05 LOG7[2664:2968]: <- 250-SIZE 51200000 2010.01.08 09:46:05 LOG7[2664:2968]: <- 250-VRFY 2010.01.08 09:46:05 LOG7[2664:2968]: <- 250-ETRN 2010.01.08 09:46:05 LOG7[2664:2968]: <- 250-STARTTLS 2010.01.08 09:46:05 LOG7[2664:2968]: <- 250 8BITMIME 2010.01.08 09:46:05 LOG7[2664:2968]: -> STARTTLS 2010.01.08 09:46:05 LOG7[2664:2968]: <- 220 Ready to start TLS 2010.01.08 09:46:05 LOG5[2664:2968]: Protocol negotiations succeeded 2010.01.08 09:46:05 LOG7[2664:2968]: SSL state (connect): before/connect initialization 2010.01.08 09:46:05 LOG7[2664:2968]: SSL state (connect): SSLv2/v3 write client hello A 2010.01.08 09:46:05 LOG7[2664:2968]: SSL state (connect): SSLv3 read server hello A 2010.01.08 09:46:05 LOG7[2664:2968]: SSL state (connect): SSLv3 read server certificate A 2010.01.08 09:46:05 LOG7[2664:2968]: SSL state (connect): SSLv3 read server key exchange A 2010.01.08 09:46:05 LOG7[2664:2968]: SSL state (connect): SSLv3 read server done A 2010.01.08 09:46:05 LOG7[2664:2968]: SSL state (connect): SSLv3 write client key exchange A 2010.01.08 09:46:05 LOG7[2664:2968]: SSL state (connect): SSLv3 write change cipher spec A 2010.01.08 09:46:05 LOG7[2664:2968]: SSL state (connect): SSLv3 write finished A 2010.01.08 09:46:05 LOG7[2664:2968]: SSL state (connect): SSLv3 flush data 2010.01.08 09:46:05 LOG7[2664:2968]: SSL state (connect): SSLv3 read finished A 2010.01.08 09:46:05 LOG7[2664:2968]: 1 items in the session cache 2010.01.08 09:46:05 LOG7[2664:2968]: 1 client connects (SSL_connect()) 2010.01.08 09:46:05 LOG7[2664:2968]: 1 client connects that finished 2010.01.08 09:46:05 LOG7[2664:2968]: 0 client renegotiations requested 2010.01.08 09:46:05 LOG7[2664:2968]: 0 server connects (SSL_accept()) 2010.01.08 09:46:05 LOG7[2664:2968]: 0 server connects that finished 2010.01.08 09:46:05 LOG7[2664:2968]: 0 server renegotiations requested 2010.01.08 09:46:05 LOG7[2664:2968]: 0 session cache hits 2010.01.08 09:46:05 LOG7[2664:2968]: 0 external session cache hits 2010.01.08 09:46:05 LOG7[2664:2968]: 0 session cache misses 2010.01.08 09:46:05 LOG7[2664:2968]: 0 session cache timeouts 2010.01.08 09:46:05 LOG6[2664:2968]: SSL connected: new session negotiated 2010.01.08 09:46:05 LOG6[2664:2968]: Negotiated ciphers: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 2010.01.08 09:46:05 LOG7[2664:2968]: SSL socket closed on SSL_read 2010.01.08 09:46:05 LOG7[2664:2968]: Socket write shutdown 2010.01.08 09:46:05 LOG5[2664:2968]: Connection closed: 625 bytes sent to SSL, 286 bytes sent to socket 2010.01.08 09:46:05 LOG7[2664:2968]: smtp_server finished (0 left) 2010.01.08 09:50:06 LOG7[2372:3760]: RAND_status claims sufficient entropy for the PRNG with "sslVersion=SSLv2", 2010.01.08 09:50:50 LOG7[2692:3460]: RAND_status claims sufficient entropy for the PRNG 2010.01.08 09:50:50 LOG7[2692:3460]: PRNG seeded successfully 2010.01.08 09:50:50 LOG7[2692:3460]: SSL context initialized for service smtp_server 2010.01.08 09:50:50 LOG5[2692:3460]: stunnel 4.28 on x86-pc-mingw32-gnu with OpenSSL 0.9.8l 5 Nov 2009 2010.01.08 09:50:50 LOG5[2692:3460]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2010.01.08 09:50:50 LOG5[2692:2496]: No limit detected for the number of clients 2010.01.08 09:50:50 LOG7[2692:2496]: FD 236 in non-blocking mode 2010.01.08 09:50:50 LOG7[2692:2496]: SO_REUSEADDR option set on accept socket 2010.01.08 09:50:50 LOG7[2692:2496]: smtp_server bound to 127.0.0.1:10025 2010.01.08 09:51:04 LOG7[2692:2496]: smtp_server accepted FD=244 from 127.0.0.1:1955 2010.01.08 09:51:04 LOG7[2692:2496]: Creating a new thread 2010.01.08 09:51:04 LOG7[2692:2496]: New thread created 2010.01.08 09:51:04 LOG7[2692:2056]: smtp_server started 2010.01.08 09:51:04 LOG7[2692:2056]: FD 244 in non-blocking mode 2010.01.08 09:51:04 LOG5[2692:2056]: smtp_server accepted connection from 127.0.0.1:1955 2010.01.08 09:51:04 LOG7[2692:2056]: FD 268 in non-blocking mode 2010.01.08 09:51:04 LOG6[2692:2056]: connect_blocking: connecting 133.x.y.z:587 2010.01.08 09:51:04 LOG7[2692:2056]: connect_blocking: s_poll_wait 133.x.y.z:587: waiting 10 seconds 2010.01.08 09:51:04 LOG5[2692:2056]: connect_blocking: connected 133.x.y.z:587 2010.01.08 09:51:04 LOG5[2692:2056]: smtp_server connected remote server from 192.168.3.118:1956 2010.01.08 09:51:04 LOG7[2692:2056]: Remote FD=268 initialized 2010.01.08 09:51:04 LOG5[2692:2056]: Negotiations for smtp (client side) started 2010.01.08 09:51:04 LOG7[2692:2056]: <- 220 smtp.example.com ESMTP Postfix 2010.01.08 09:51:04 LOG7[2692:2056]: -> 220 smtp.example.com ESMTP Postfix 2010.01.08 09:51:04 LOG7[2692:2056]: -> EHLO localhost 2010.01.08 09:51:04 LOG7[2692:2056]: <- 250-smtp.example.com 2010.01.08 09:51:04 LOG7[2692:2056]: <- 250-PIPELINING 2010.01.08 09:51:04 LOG7[2692:2056]: <- 250-SIZE 51200000 2010.01.08 09:51:04 LOG7[2692:2056]: <- 250-VRFY 2010.01.08 09:51:04 LOG7[2692:2056]: <- 250-ETRN 2010.01.08 09:51:04 LOG7[2692:2056]: <- 250-STARTTLS 2010.01.08 09:51:04 LOG7[2692:2056]: <- 250 8BITMIME 2010.01.08 09:51:04 LOG7[2692:2056]: -> STARTTLS 2010.01.08 09:51:04 LOG7[2692:2056]: <- 220 Ready to start TLS 2010.01.08 09:51:04 LOG5[2692:2056]: Protocol negotiations succeeded 2010.01.08 09:51:04 LOG7[2692:2056]: SSL state (connect): before/connect initialization 2010.01.08 09:51:04 LOG7[2692:2056]: SSL state (connect): SSLv2 write client hello A 2010.01.08 09:51:04 LOG7[2692:2056]: SSL state (connect): SSLv2 read server hello A 2010.01.08 09:51:04 LOG7[2692:2056]: SSL state (connect): SSLv2 write client master key A 2010.01.08 09:51:04 LOG7[2692:2056]: SSL state (connect): SSLv2 client start encryption 2010.01.08 09:51:04 LOG7[2692:2056]: SSL state (connect): SSLv2 write client finished A 2010.01.08 09:51:04 LOG7[2692:2056]: SSL state (connect): SSLv2 read server verify A 2010.01.08 09:51:04 LOG7[2692:2056]: SSL state (connect): SSLv2 read server finished A 2010.01.08 09:51:04 LOG7[2692:2056]: 1 items in the session cache 2010.01.08 09:51:04 LOG7[2692:2056]: 1 client connects (SSL_connect()) 2010.01.08 09:51:04 LOG7[2692:2056]: 1 client connects that finished 2010.01.08 09:51:04 LOG7[2692:2056]: 0 client renegotiations requested 2010.01.08 09:51:04 LOG7[2692:2056]: 0 server connects (SSL_accept()) 2010.01.08 09:51:04 LOG7[2692:2056]: 0 server connects that finished 2010.01.08 09:51:04 LOG7[2692:2056]: 0 server renegotiations requested 2010.01.08 09:51:04 LOG7[2692:2056]: 0 session cache hits 2010.01.08 09:51:04 LOG7[2692:2056]: 0 external session cache hits 2010.01.08 09:51:04 LOG7[2692:2056]: 0 session cache misses 2010.01.08 09:51:04 LOG7[2692:2056]: 0 session cache timeouts 2010.01.08 09:51:04 LOG6[2692:2056]: SSL connected: new session negotiated 2010.01.08 09:51:04 LOG6[2692:2056]: Negotiated ciphers: DES-CBC3-MD5 SSLv2 Kx=RSA Au=RSA Enc=3DES(168) Mac=MD5 2010.01.08 09:51:04 LOG7[2692:2056]: SSL closed on SSL_read 2010.01.08 09:51:04 LOG7[2692:2056]: Socket write shutdown 2010.01.08 09:51:04 LOG7[2692:2056]: Socket closed on read 2010.01.08 09:51:04 LOG7[2692:2056]: SSL write shutdown 2010.01.08 09:51:04 LOG5[2692:2056]: Connection closed: 626 bytes sent to SSL, 286 bytes sent to socket 2010.01.08 09:51:04 LOG7[2692:2056]: smtp_server finished (0 left) However, with OpenSSL older than 0.9.8i it can connect without "sslVersion=all" or with "sslVersion=SSLv3", and log tells SSLv3 was used. Why stunnel cannot connect with OpenSSL newer than 0.9.8j ? --- Tsurutani Naoki turutani(a)scphys.kyoto-u.ac.jp

1 0

Re: [stunnel-users] https not working with debug level 4,5,6,7
by ankur.agarwal＠wipro.com 07 Jan '10

07 Jan '10

Hi, When debug level is set to 4 , 5 , 6 , 7,https connection is not working.we have environment where we run the stunnel on a unit and try conncting it from windows machine through https connection.But this connection is not working for any debug level >3.can anybody help me.my sample stunnel file is : ; Sample stunnel configuration file by Michal Trojnara 2003-2006 ; Some options used here may not be adequate for your particular configuration ; Certificate/key is needed in server mode and optional in client mode ; The default certificate is provided only for testing and should not ; be used in a production environment cert = /usr/local/etc/config/certs/cert.pem key = /usr/local/etc/config/certs/privkey.pem ; Some performance tunings ;socket = l:TCP_NODELAY=1 ;socket = r:TCP_NODELAY=1 ; Workaround for Eudora bug ;options = DONT_INSERT_EMPTY_FRAGMENTS ; Authentication stuff verify = 1 ; Don't forget to c_rehash CApath CApath = /usr/local/etc/config/certs ; It's often easier to use CAfile ;CAfile = certs.pem ; Don't forget to c_rehash CRLpath ;CRLpath = crls ; Alternatively you can use CRLfile ;CRLfile = crls.pem ; Some debugging stuff useful for troubleshooting debug = 7 output = /tmp/stunnel.log ; Use it for client mode client = no ; Service-level configuration ; [pop3s] ; accept = 995 ; connect = 110 ; [imaps] ; accept = 993 ; connect = 143 ; [ssmtp] ; accept = 465 ; connect = 25 ;[https] accept = 443 connect = 80 TIMEOUTclose = 10 ; vim:ft=dosini Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

1 0

Previous Post Please Disregard!
by johnnyb mee 03 Jan '10

03 Jan '10

I finally seem to have stunnel up ,and running with Agent ver 2.0 newsreader. I had to do some more research on this, and thru patience, and many config changes I believe stunnel is now supplying SSL for my agent newsreader. Not an easy task for a total windows dummy like me though. Never have got the Linux thing. I guess it is the having to deal with scripts issue continually that scares the hell out of me!! IF anyone needs the procedure in the future for this let me know and I will send it to them! jb

1 0

How to setup forte agent to work with stunnel latest version.
by johnnyb mee 03 Jan '10

03 Jan '10

I have been trying to get stunnel to work with Agent 2.0 newsreader so that I can use SSL from my news server. I have read the faq and gone thru alot of previous posts concerning this and found this one entry suggestion for the stunnel.config file in order to setup SSL to work with Agent which unfortunately has no SSL capabilities at all. It is suggested to use this entry to get both the newserver and client to work thru using stunnel as a proxy server service basically. c:\program files\stunnel -c -d 127.0.0.1:119 -r unlimited.newshosting.com:563 I copied and pasted the entry changing the usenet server to the above, and now I can no longer get stunnel to start at all. I am getting an error message stating I need to check the logfile to determine what is causing the error. The actual logfile error is as follows: 2010.01.02 23:12:59 LOG7[3456:1988]: RAND_status claims sufficient entropy for the PRNG 2010.01.02 23:12:59 LOG7[3456:1988]: PRNG seeded successfully 2010.01.02 23:12:59 LOG7[3456:1988]: Certificate: stunnel.pem 2010.01.02 23:12:59 LOG7[3456:1988]: Certificate loaded 2010.01.02 23:12:59 LOG7[3456:1988]: Key file: stunnel.pem 2010.01.02 23:12:59 LOG7[3456:1988]: Private key loaded 2010.01.02 23:12:59 LOG7[3456:1988]: SSL context initialized for service pop3s 2010.01.02 23:12:59 LOG7[3456:1988]: Certificate: stunnel.pem 2010.01.02 23:12:59 LOG7[3456:1988]: Certificate loaded 2010.01.02 23:12:59 LOG7[3456:1988]: Key file: stunnel.pem 2010.01.02 23:12:59 LOG7[3456:1988]: Private key loaded 2010.01.02 23:12:59 LOG7[3456:1988]: SSL context initialized for service imaps file stunnel.conf line 55: No '=' found 2010.01.02 23:12:59 LOG3[3456:1988]: Server is down As you can ascertain I am no linux expert at all so working with startup scripts such as this is challenging to say the least. Is the entry I pasted into the config file incorrect or not pointing to the right path for the config file directory or what do you think is missing? I am using Windows XP Pro and know that the actual file for the config resides in windows/system32 folder. Any input on this would be very much appreciated and thanks in advance all. jb

1 0

what's wrong? error=unable to get local issuer certificate
by Carsten Krüger 29 Dec '09

29 Dec '09

I think it should work, * should match homie 1. connected with "openssl s_client -connect mail.neroon.com:995", pasted cert to dreamhost.pem 2. used this -----------stunnel.conf------------- debug=7 client = yes [pop3] accept = 110 connect = homie.mail.dreamhost.com:995 verify=1 CAfile=c:\temp\dreamhost.pem -----------stunnel.conf------------- 3. connect to localost:110, got "unable to get local issuer certificate 2009.12.29 16:04:25 LOG7[3044:5700]: Snagged 64 random bytes from C:/.rnd 2009.12.29 16:04:25 LOG7[3044:5700]: Wrote 0 new random bytes to C:/.rnd 2009.12.29 16:04:25 LOG7[3044:5700]: RAND_status claims sufficient entropy for the PRNG 2009.12.29 16:04:25 LOG7[3044:5700]: PRNG seeded successfully 2009.12.29 16:04:25 LOG7[3044:5700]: Loaded verify certificates from c:\temp\dreamhost.pem 2009.12.29 16:04:25 LOG7[3044:5700]: Loaded c:\temp\dreamhost.pem revocation lookup file 2009.12.29 16:04:25 LOG7[3044:5700]: SSL context initialized for service pop3 2009.12.29 16:04:25 LOG5[3044:5700]: stunnel 4.29 on x86-pc-mingw32-gnu with OpenSSL 0.9.8l 5 Nov 2009 2009.12.29 16:04:25 LOG5[3044:5700]: Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 2009.12.29 16:04:25 LOG5[3044:4320]: No limit detected for the number of clients 2009.12.29 16:04:25 LOG7[3044:4320]: FD 1832 in non-blocking mode 2009.12.29 16:04:25 LOG7[3044:4320]: SO_REUSEADDR option set on accept socket 2009.12.29 16:04:25 LOG7[3044:4320]: pop3 bound to 0.0.0.0:110 2009.12.29 16:04:40 LOG7[3044:4320]: pop3 accepted FD=1808 from 127.0.0.1:3257 2009.12.29 16:04:40 LOG7[3044:4320]: Creating a new thread 2009.12.29 16:04:40 LOG7[3044:4320]: New thread created 2009.12.29 16:04:40 LOG7[3044:2340]: pop3 started 2009.12.29 16:04:40 LOG7[3044:2340]: FD 1808 in non-blocking mode 2009.12.29 16:04:40 LOG5[3044:2340]: pop3 accepted connection from 127.0.0.1:3257 2009.12.29 16:04:40 LOG7[3044:2340]: FD 1768 in non-blocking mode 2009.12.29 16:04:40 LOG6[3044:2340]: connect_blocking: connecting 208.97.132.208:995 2009.12.29 16:04:40 LOG7[3044:2340]: connect_blocking: s_poll_wait 208.97.132.208:995: waiting 10 seconds 2009.12.29 16:04:40 LOG5[3044:2340]: connect_blocking: connected 208.97.132.208:995 2009.12.29 16:04:40 LOG5[3044:2340]: pop3 connected remote server from 192.168.0.2:3258 2009.12.29 16:04:40 LOG7[3044:2340]: Remote FD=1768 initialized 2009.12.29 16:04:40 LOG7[3044:2340]: SSL state (connect): before/connect initialization 2009.12.29 16:04:40 LOG7[3044:2340]: SSL state (connect): SSLv3 write client hello A 2009.12.29 16:04:40 LOG7[3044:2340]: SSL state (connect): SSLv3 read server hello A 2009.12.29 16:04:40 LOG4[3044:2340]: VERIFY ERROR: depth=0, error=unable to get local issuer certificate: /C=US/ST=California/L=Brea/O=Dreamhost.com/OU=Security/CN=*.mail.dreamhost.com/emailAddress=support(a)dreamhost.com 2009.12.29 16:04:40 LOG7[3044:2340]: SSL alert (write): fatal: bad certificate 2009.12.29 16:04:40 LOG3[3044:2340]: SSL_connect: 14090086: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed 2009.12.29 16:04:40 LOG5[3044:2340]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.12.29 16:04:40 LOG7[3044:2340]: pop3 finished (0 left)

2 1

Using stunnel instead of SSL API
by Vladimir Stariradev 24 Dec '09

24 Dec '09

Hi Guys, I'm working on a java mobile app (J2ME MIDP 2.0) which connects to a java server, which I created. The java mobile app is an instant messenger. I want to use stunnel to encrypt the communication between the app and the server. At the moment the server runs on my localhost on port 5555 and accepts connections from the mobile device emulator I have running on the same machine. Eventually I want to transfer the mobile app on to my mobile and use it from there. My machine is running the following versions stunnel 4.29 on x86-pc-mingw32-gnu with OpenSSL 0.9.8l on Windows 7 x64. I have not yet configured a pam or config file but I would like to continue listening on port 5555 with my own certificate (but for now any will do). Will the fact that I'm running both my server and device emulator on one machine mean that it'll bypass stunnel and I'll never know if it works or not? Should I have my mobile app use SecureConnection (SSL encrypted) class? In that case, I'd have to make the server listen for SSL connections too. That would defeat the purpose of stunnel. Help on configuration is welcome. Thanks for reading, I'm looking forward to your replies Vladimir

2 1

privileges not dropped before libwrap processes are spawned
by Micah Anderson 21 Dec '09

21 Dec '09

Hi, I recently stumbled on http://mirt.net/pipermail/stunnel-users/2008-May/001977.html which is exactly what I am seeing with version 4.27 of stunnel, namely the daemon is not switching to the setuid/setgid specified in the config before it is spawned. This means that I get 6 processes, 5 run as root with only one (albeit the one lisenting on the specified sockets) dropping privs to the specified user. The follow-up response from Mike was: I'll modify stunnel to delay spawning libwrap processes until privileges are dropped. and indeed, I find in the Changelog file for version 4.25 the following Bugfixes: * Bugfixes - Spawning libwrap processes delayed until privileges are dropped. However, it seems that either this fix either didn't make it in, or it somehow managed to creep its way back out because it is happening in 4.27. Thanks, micah

2 3

BBwin hanging windows
by Gregory Wege 18 Dec '09

18 Dec '09

Hey Guys, We have the following problem: Bbwin is sending traffic to 2 monitoring servers and is encrypted via stunnel. If one of the monitoring servers goes down, the number of ports being used by bbwin client increases to the point where the box is unusable - no more ports available on the windows box being monitored. If we kill the bbwin process, the problem goes away temporarily - after a short period of time, the problem returns. The problem continues even after the failed hobbit server recovers, and only clears up when we kill the bbwin process. * Windows version Server 2003 * bbwin versions 0.11, 0.12 * stunnel version 4.25 * hobbit server version 4.2.2 Output of the stunnel log shows the following error: 2009.12.16 06:56:19 LOG7[2336:2460]: New thread created 2009.12.16 06:56:19 LOG7[2336:4016]: hobbit_ssl started 2009.12.16 06:56:19 LOG7[2336:4016]: FD 356 in non-blocking mode 2009.12.16 06:56:19 LOG7[2336:4016]: TCP_NODELAY option set on local socket 2009.12.16 06:56:19 LOG5[2336:4016]: hobbit_ssl accepted connection from 127.0.0.1:1725 2009.12.16 06:56:19 LOG7[2336:4016]: FD 396 in non-blocking mode 2009.12.16 06:56:19 LOG6[2336:4016]: connect_blocking: connecting 10.132.55.24:1982 2009.12.16 06:56:19 LOG3[2336:4016]: connect_blocking: connect 10.132.55.24:1982: No buffer space available (WSAENOBUFS) (10055) 2009.12.16 06:56:19 LOG5[2336:4016]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.12.16 06:56:19 LOG7[2336:4016]: hobbit_ssl finished (0 left) Can something be added to my stunnel.conf to prevent this from happening? Any help would be greatly appreciated. Thanks.

2 2

Hey Stunnel-Users, I forgot to mention...
by Sreejith Mohan Menon 17 Dec '09

17 Dec '09

1 0

Tunnel iPhone - Server
by LoLoVioLo 14 Dec '09

14 Dec '09

Hi all, It is my first post. Sorry if common question but didn't find answer in archives or google. The fact is that I am using an iPhone with a data plan that only allow ports 80 and 443 (http and https). My aim is to be able to use all ports (mail, ftp, msn, etc). The idea is to tunnel all TCP connections between my computer here and my server at home. iPhone <----port-443----> Linux Server <----all-ports----> Internet I know there is alternatives for each service (webmail, webmessenger, etc.) but I think that it is technically possible to have something running that allow using of usual software. I also know that this usage is typically VPN but there is no VPN client for iPhone that allow custom ports and not sure my data plan can route GRE protocol. By the way STunnel was ported to the iPhone. There is some hope. I am not sure Stunnel is the best way to do that and not even sure that Stunnel can do it but hope you can advice. Thanks for your help. LoLoVioLo

1 0

Question (simple one I think)
by Reinier van der Gugten 09 Dec '09

09 Dec '09

Question: On the server, port 443 is already in use by a different service. However I require STunnel to communicate also on port 443. I thought, that perhaps I can obtain a second IP address and forward that trafic from the router to port 444 (or any other avail port). Then I can let Stunnel listen to port 444 and thus it would work. The firewall has to translate the 444 back to the 443 when transmitting data ofcourse. Is this the right way to go? Or ca I do this using one and the same IP (but then there would be 2 services listning to the same port right)? Thanks. Reinier

3 2

Your opinion on sessiond
by Michal Trojnara 04 Dec '09

04 Dec '09

Dear Users, I'm eager to hear your comments, suggestions or issues regarding sessiond. Feel free to use the stunnel-users mailing list or the bug tracking system: https://stunnel.mirt.net/?page=bts Best regards, Mike

2 2

Stunnel 4.29 released
by Michal Trojnara 02 Dec '09

02 Dec '09

The ChangeLog entry: Version 4.29, 2009.12.02, urgency: MEDIUM: * New feature sponsored by Searchtech Limited http://www.astraweb.com/ - sessiond, a high performance SSL session cache was built for stunnel. A new service-level "sessiond" option was added. sessiond is available for download on ftp://stunnel.mirt.net/stunnel/sessiond/ . stunnel clusters will be a lot faster, now! * Bugfixes - "execargs" defaults to the "exec" parameter (thx to Peter Pentchev). - Compilation fixes added for AIX and old versions of OpenSSL. - Missing "fips" option was added to the manual. SHA-1 value for stunnel-4.29.tar.gz: f93ac9054c62b1db0dcf44f668d323d82cc0f413 Home page: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ Best regards, Michal Trojnara

1 0

Still having issues compiling Stunnel on aix 5.3. SOL_TCP not defined? Please help
by Geoff 02 Dec '09

02 Dec '09

I installed gcc and the latest version of openssl on my aix 5.3 server. I did the ./configure and all went well. When I did the make I recieved the following error. if gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.28\" -DPACKAGE_STRING=\"stunnel\ 4.28\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.28\" -DHOST=\"powerpc-ibm-aix5.3.0.0\" -DCPU_POWERPC=1 -DVENDOR_IBM=1 -DOS_AIX5_3_0_0=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTS_AND_PTC=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBDL=1 -DHAVE_LIBZ=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_GETCONTEXT=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/usr\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/usr/include -MT options.o -MD -MP -MF ".deps/options. Tpo" -c -o options.o options.c; then mv -f ".deps/options.Tpo" ".deps/options.Po"; else rm -f ".deps/options.Tpo"; exit 1; fi options.c:1773: error: 'SOL_TCP' undeclared here (not in a function) make: 1254-004 The error code from the last command is 1. Stop. make: 1254-004 The error code from the last command is 1. The SOL_TCP option is not defined on AIX. I am hoping this can be applied to SOL_SOCKET which is defined. So... I changed the following lines in the options.c program #ifdef TCP_KEEPCNT /* {"TCP_KEEPCNT", SOL_TCP, TCP_KEEPCNT, TYPE_INT, DEF_VALS}, */ {"TCP_KEEPCNT", SOL_SOCKET, TCP_KEEPCNT, TYPE_INT, DEF_VALS}, #endif #ifdef TCP_KEEPIDLE /* {"TCP_KEEPIDLE", SOL_TCP, TCP_KEEPIDLE, TYPE_INT, DEF_VALS}, */ {"TCP_KEEPIDLE", SOL_SOCKET, TCP_KEEPIDLE, TYPE_INT, DEF_VALS}, #endif #ifdef TCP_KEEPINTVL /* {"TCP_KEEPINTVL", SOL_TCP, TCP_KEEPINTVL, TYPE_INT, DEF_VALS},*/ {"TCP_KEEPINTVL", SOL_SOCKET, TCP_KEEPINTVL, TYPE_INT, DEF_VALS}, I can compile the code without error at this point. So... my question is has anyone else made a similar change to get the code to compile on AIX 5.3? If not, can you please tell me what configuration options you used to make stunnel work. Thanks for any help you can provide. I am at my wits end here and pretty much my capability in compiling code. Thanks in advance, Geoff

1 0

Upgrade From 4.27 to 4.28? Or Wait for Next Version?
by Jeff Salisbury 01 Dec '09

01 Dec '09

Greetings, I've noticed some problems with v4.28 (posted in this group). Is there any compelling reason to upgrade from 4.27 to 4.28? Or, should we wait for the problems in 4.28 to be fixed in a new version and then upgrade? Regards, Jeff

1 0

build problem with 4.28 on SLES9 (SSL again)
by Andreas Vetter 27 Nov '09

27 Nov '09

Hi, there is a build problem with 4.28 on a SLES 9. May be similar to the no_ticket problem. Here is the interesting part of build log: options.c: In function `parse_ssl_option': options.c:1714: error: `SSL_OP_NO_QUERY_MTU' undeclared (first use in this function) options.c:1714: error: (Each undeclared identifier is reported only once options.c:1714: error: for each function it appears in.) options.c:1715: error: `SSL_OP_COOKIE_EXCHANGE' undeclared (first use in this function) options.c:1724: error: `SSL_OP_SINGLE_ECDH_USE' undeclared (first use in this function) make[1]: *** [options.o] Error 1 make[1]: Leaving directory `/usr/src/packages/BUILD/stunnel-4.28/src' any hints? -- Mit freundlichen Gruessen, Andreas Vetter Informations- und Kommunikationstechnik Fakultaet fuer Physik und Astronomie Universitaet Wuerzburg

2 2

Help in making stunnel please.
by Geoff 26 Nov '09

26 Nov '09

Compiling on aix 5.3 ./configure runs fine when I run make I get this error... I am using the latest version of ssl. # make Making all in src source='env.c' object='env.lo' libtool=yes DEPDIR=.deps depmode=aix /bin/sh ../auto/depcomp /bin/sh ../libtool --tag=CC --mode=compile cc -qlanglvl=ansi -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.28\" -DPACKAGE_STRING=\"stunnel\ 4.28\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.28\" -DHOST=\"powerpc-ibm-aix5.3.0.0\" -DCPU_POWERPC=1 -DVENDOR_IBM=1 -DOS_AIX5_3_0_0=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTS_AND_PTC=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBDL=1 -DHAVE_LIBZ=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_GETCONTEXT=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/usr\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -I/usr/include -c -o env.lo env.c cc -qlanglvl=ansi -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.28\" "-DPACKAGE_STRING=\"stunnel 4.28\"" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.28\" -DHOST=\"powerpc-ibm-aix5.3.0.0\" -DCPU_POWERPC=1 -DVENDOR_IBM=1 -DOS_AIX5_3_0_0=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTS_AND_PTC=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBDL=1 -DHAVE_LIBZ=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_GETCONTEXT=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/usr\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR=\"/usr/local/lib/stunnel\" -DCONFDIR=\"/usr/local/etc/stunnel\" -DPIDFILE=\"/usr/local/var/run/stunnel/stunnel.pid\" -g -I/usr/include -c -M env.c -DPIC -o .libs/env.o "/usr/include/sys/socket.h", line 141.9: 1506-213 (S) Macro name getpeername cannot be redefined. "/usr/include/sys/socket.h", line 141.9: 1506-358 (I) "getpeername" is defined on line 39 of env.c. make: 1254-004 The error code from the last command is 1. Stop. make: 1254-004 The error code from the last command is 1. Here is the configure # ./configure configure: **************************************** initialization checking for a BSD-compatible install... auto/install-sh -c checking whether build environment is sane... yes checking for gawk... no checking for mawk... no checking for nawk... nawk checking whether make sets $(MAKE)... yes checking build system type... powerpc-ibm-aix5.3.0.0 checking host system type... powerpc-ibm-aix5.3.0.0 checking for gcc... no checking for cc... cc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... no checking whether cc accepts -g... yes checking for cc option to accept ISO C89... -qlanglvl=ansi checking for style of include used by make... GNU checking dependency style of cc -qlanglvl=ansi... aix checking for a BSD-compatible install... auto/install-sh -c checking whether make sets $(MAKE)... (cached) yes configure: **************************************** libtool checking for a sed that does not truncate output... /usr/bin/sed checking for grep that handles long lines and -e... /usr/bin/grep checking for egrep... /usr/bin/grep -E checking for non-GNU ld... /usr/bin/ld checking if the linker (/usr/bin/ld) is GNU ld... no checking for /usr/bin/ld option to reload object files... -r checking for BSD-compatible nm... /usr/bin/nm -B checking whether ln -s works... yes checking how to recognize dependent libraries... pass_all checking how to run the C preprocessor... cc -qlanglvl=ansi -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking dlfcn.h usability... yes checking dlfcn.h presence... yes checking for dlfcn.h... yes checking for g++... no checking for c++... no checking for gpp... no checking for aCC... no checking for CC... no checking for cxx... no checking for cc++... no checking for cl.exe... no checking for FCC... no checking for KCC... no checking for RCC... no checking for xlC_r... no checking for xlC... no checking whether we are using the GNU C++ compiler... no checking whether g++ accepts -g... no checking dependency style of g++... none checking for g77... no checking for xlf... no checking for f77... no checking for frt... no checking for pgf77... no checking for cf77... no checking for fort77... no checking for fl32... no checking for af77... no checking for xlf90... no checking for f90... no checking for pgf90... no checking for pghpf... no checking for epcf90... no checking for gfortran... no checking for g95... no checking for xlf95... no checking for f95... no checking for fort... no checking for ifort... no checking for ifc... no checking for efc... no checking for pgf95... no checking for lf95... no checking for ftn... no checking whether we are using the GNU Fortran 77 compiler... no checking whether accepts -g... no checking the maximum length of command line arguments... 18432 checking command to parse /usr/bin/nm -B output from cc -qlanglvl=ansi object... ok checking for objdir... .libs checking for ar... ar checking for ranlib... ranlib checking for strip... strip checking for cc -qlanglvl=ansi option to produce PIC... checking if cc -qlanglvl=ansi static flag -bnso -bI:/lib/syscalls.exp works... no checking if cc -qlanglvl=ansi supports -c -o file.o... yes checking whether the cc -qlanglvl=ansi linker (/usr/bin/ld) supports shared libraries... yes checking dynamic linker characteristics... aix5.3.0.0 ld.so checking how to hardcode library paths into programs... immediate checking whether stripping libraries is possible... no checking if libtool supports shared libraries... yes checking whether to build shared libraries... yes checking whether to build static libraries... no configure: creating libtool appending configuration tag "CXX" to libtool appending configuration tag "F77" to libtool configure: **************************************** types checking for unsigned char... yes checking size of unsigned char... 1 checking for unsigned short... yes checking size of unsigned short... 2 checking for unsigned int... yes checking size of unsigned int... 4 checking for unsigned long... yes checking size of unsigned long... 4 checking for socklen_t... yes configure: **************************************** PTY device files checking for "/dev/ptmx"... no checking for "/dev/ptc"... yes configure: **************************************** entropy checking for "/dev/urandom"... yes configure: **************************************** default group checking for default group... nobody configure: **************************************** header files checking ucontext.h usability... yes checking ucontext.h presence... yes checking for ucontext.h... yes checking pthread.h usability... yes checking pthread.h presence... yes checking for pthread.h... yes checking sys/select.h usability... yes checking sys/select.h presence... yes checking for sys/select.h... yes checking poll.h usability... yes checking poll.h presence... yes checking for poll.h... yes checking sys/poll.h usability... yes checking sys/poll.h presence... yes checking for sys/poll.h... yes checking tcpd.h usability... no checking tcpd.h presence... no checking for tcpd.h... no checking sys/ioctl.h usability... yes checking sys/ioctl.h presence... yes checking for sys/ioctl.h... yes checking sys/filio.h usability... no checking sys/filio.h presence... no checking for sys/filio.h... no checking stropts.h usability... yes checking stropts.h presence... yes checking for stropts.h... yes checking grp.h usability... yes checking grp.h presence... yes checking for grp.h... yes checking for unistd.h... (cached) yes checking util.h usability... no checking util.h presence... no checking for util.h... no checking libutil.h usability... no checking libutil.h presence... no checking for libutil.h... no checking sys/resource.h usability... yes checking sys/resource.h presence... yes checking for sys/resource.h... yes checking pty.h usability... no checking pty.h presence... no checking for pty.h... no checking sys/socket.h usability... yes checking sys/socket.h presence... yes checking for sys/socket.h... yes checking for struct msghdr.msg_control... yes configure: **************************************** libraries checking for library containing gethostbyname... none required checking for library containing yp_get_default_domain... none required checking for socket in -lsocket... no checking for openpty in -lutil... no checking for dlopen in -ldl... yes checking for shl_load in -ldld... no checking for inflateEnd in -lz... yes configure: **************************************** thread model checking for pthread_create in -lc_r... no checking for pthread_create in -lpthread... yes configure: PTHREAD thread model detected configure: **************************************** library functions checking for snprintf... yes checking for vsnprintf... yes checking for openpty... no checking for _getpty... no checking for daemon... no checking for waitpid... yes checking for wait4... yes checking for setsid... yes checking for setgroups... yes checking for chroot... yes checking for sysconf... yes checking for getrlimit... yes checking for pthread_sigmask... yes checking for localtime_r... yes checking for getcontext... yes checking for __makecontext_v2... no checking for poll... yes checking for endhostent... yes checking for getnameinfo... yes checking for getaddrinfo... yes checking for broken poll() implementation... no configure: **************************************** SSL checking for SSL directory... /usr checking for obsolete RSAref library... no checking /usr/include/openssl/engine.h usability... yes checking /usr/include/openssl/engine.h presence... yes checking for /usr/include/openssl/engine.h... yes configure: **************************************** optional features checking whether to disable RSA support... no checking whether to enable DH support... no checking whether to enable IPv6 support... yes checking whether to disable TCP wrappers library support... autodetecting checking for hosts_access in -lwrap... no checking whether to enable FIPS mode support... autodetecting checking for FIPS_mode_set... no configure: **************************************** write the results configure: creating ./config.status config.status: creating Makefile config.status: creating src/Makefile config.status: creating src/stunnel3 config.status: creating doc/Makefile config.status: creating tools/Makefile config.status: creating tools/stunnel.conf-sample config.status: creating tools/stunnel.init config.status: executing depfiles commands configure: **************************************** success

2 1

problem with -fd option on Linux
by Sorkin, David 21 Nov '09

21 Nov '09

I'd like to report an interesting problem I found that occurs on Linux but not Solaris when using the -fd 0 option to read the stunnel configuration in from stdin. I am using stunnel to establish client tunnels on the fly for one time use by programs such as rsync. The client config file is generated automatically with some dynamic parameters. After the client tunnel is established a client program connects to the specified port on localhost. This works fine on Solaris but on Linux I found that the client program has to be invoked *twice* before it works. My work around is to write the config to a temp file and starting stunnel with the location of the file as its argument instead of writing to its standard input. I am using tcp wrappers to protect the stunnel servers and to limit the connects to the client to localhost. This isn't an issue for me anymore but it took a bit of troubleshooting to figure out. On Solaris I am running the same version of stunnel, openssl, etc... all compiled very similarly. One difference could be iconv but I don't know enough about it to say. Regards, David Sorkin Debug log from the first client invocation: ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Nov 10 15:37:02 test03 stunnel: LOG5[32303:182894071744]: stunnel 4.27 on x86_64-unknown-linux-gnu with OpenSSL 0.9.8k 25 Mar 2009 Nov 10 15:37:02 test03 stunnel: LOG5[32303:182894071744]: Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Auth:LIBWRAP Nov 10 15:37:02 test03 stunnel: LOG6[32303:182894071744]: file ulimit = 1024 (can be changed with 'ulimit -n') Nov 10 15:37:02 test03 stunnel: LOG6[32303:182894071744]: poll() used - no FD_SETSIZE limit for file descriptors Nov 10 15:37:02 test03 stunnel: LOG5[32303:182894071744]: 500 clients allowed Nov 10 15:37:03 test03 stunnel: LOG3[32309:1073809760]: Unexpected socket close (read_blocking) Nov 10 15:37:03 test03 stunnel: LOG5[32309:1073809760]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket Nov 10 15:37:03 test03 stunnel: LOG5[32309:182894071744]: Received signal 15; terminating My client config is similar to the following: ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ debug = local4.info foreground = no sslVersion = TLSv1 RNDfile = /dev/random RNDoverwrite = no pid = %s [stunnel] client = yes key = /path/to/private_key.pem cert = /path/to/public_key_cert.pem verify = 0 accept = 127.0.0.1:12345 # ephemeral port connect = remote_host:123 # well known port ciphers = AES256-SHA Server Config: ^^^^^^^^^^^^^^ debug = local4.info foreground = no pid = /var/run/stunnel.pid sslVersion = TLSv1 RNDfile = /dev/random RNDoverwrite = no [rsync] client = no key = /path/to/private_key.pem cert = /path/to/public_key_cert.pem CAfile = /path/to/authority_certs.pem verify = 3 accept = 123 exec = /usr/bin/rsync execargs = rsync --daemon --no-detach ciphers = AES256-SHA hosts.allow ^^^^^^^^^^^^ stunnel: 127.0.0.1 rsync: <ip of authorized server> > /usr/local/bin/stunnel -version stunnel 4.27 on x86_64-unknown-linux-gnu with OpenSSL 0.9.8k 25 Mar 2009 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv4 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /usr/local/etc/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none > /usr/local/bin/stunnel -sockets Socket option defaults: Option Accept Local Remote OS default SO_DEBUG -- -- -- 0 SO_DONTROUTE -- -- -- 0 SO_KEEPALIVE -- -- -- 0 SO_LINGER -- -- -- 0:0 SO_OOBINLINE -- -- -- 0 SO_RCVBUF -- -- -- 87380 SO_SNDBUF -- -- -- 16384 SO_RCVLOWAT -- -- -- 1 SO_SNDLOWAT -- -- -- 1 SO_RCVTIMEO -- -- -- 0:0 SO_SNDTIMEO -- -- -- 0:0 SO_REUSEADDR 1 -- -- 0 SO_BINDTODEVICE -- -- -- -- IP_TOS -- -- -- 0 IP_TTL -- -- -- 64 TCP_NODELAY -- -- -- 0 > uname -a Linux test1 2.6.9-89.0.11.ELsmp #1 SMP Mon Aug 31 11:00:34 EDT 2009 x86_64 x86_64 x86_64 GNU/Linux -- David Sorkin <david.sorkin(a)citi.com> CATE - Network Engineering (908) 563-0017

2 1

Examples are for V3?
by James Bowery 18 Nov '09

18 Nov '09

The examples at: http://www.stunnel.org/examples/ appear to be for version 3. This wasted a lot of my time.

2 1

Stunnel with a enterprise proxy server
by Vandooren, Pascal 16 Nov '09

16 Nov '09

Hello, I have a problem ... on my network i have more than one proxy server, and y use Stunnel for a remote RDP. if my computer is directly connected to internet there is no problem. If i connect my computer on my domain with my proxies servers i'm not able to connect me on RDP to my remote RDP server. Is it possible to indicate my proxy server to user ? Kind regards PascalV --------------------------------------------------------------------------- This e-mail is confidential. If you are not the addressee or an authorized recipient of this message, any distribution, copying, publication or use of this information for any purpose is prohibited. Please notify the sender immediately by e-mail and then delete this message. Ce message est confidentiel. Si vous n'etes pas le destinataire designe de ce message ou une personne autorisee a l'utiliser, toute distribution, copie, publication ou usage a quelques fins que ce soit des informations contenues dans ce message sont interdits. Merci d'informer immediatement l'expediteur par messagerie electronique et d'ensuite detruire ce message. ---------------------------------------------------------------------------

1 0

Error installing Stunnel-4.28
by th＠ftlabs.com 13 Nov '09

13 Nov '09

I could not get Stunnel-4.27 to work as described in a previous post on Mon Nov 9 17:12:38 CET 2009 to which nobody responded. So I tried installing the latest version, Stunnel-4.28, and received the following error when running the 'make' command... options.c: In function ‘service_options’: options.c:1139: error: ‘SSL_OP_NO_TICKET’ undeclared (first use in this function) options.c:1139: error: (Each undeclared identifier is reported only once options.c:1139: error: for each function it appears in.) options.c: In function ‘parse_ssl_option’: options.c:1709: error: ‘SSL_OP_NO_TICKET’ undeclared (first use in this function) make[1]: *** [options.o] Error 1 make[1]: Leaving directory `/tmp/stunnel-4.28/src' make: *** [all-recursive] Error 1 The output for 'openssl version' is: OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 Can anyone help me with either problems please?

2 1

Re: [stunnel-users] stunnel-users Digest, Vol 64, Issue 8
by Michael Wilson 12 Nov '09

12 Nov '09

Thanks Ludholf, Re Q2 - Solved. Re Q1 - Thanks, but I should have been clearer, I wanted an automated solution. My nightly Blat e-mails come from a command line .cmd file. I have recently added a javascript to check if stunnel is active and, if not, start it before my e-mails. Now I would like to create a similar script that, if stunnel is running, stops it after my e-mail. I may just have to use Windows Script Host's Terminate. Mike On Thu, Nov 12, 2009 at 6:00 AM, <stunnel-users-request(a)mirt.net> wrote: > Send stunnel-users mailing list submissions to > stunnel-users(a)mirt.net > > To subscribe or unsubscribe via the World Wide Web, visit > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > or, via email, send a message with subject or body 'help' to > stunnel-users-request(a)mirt.net > > You can reach the person managing the list at > stunnel-users-owner(a)mirt.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of stunnel-users digest..." > > > Today's Topics: > > 1. Vista questions (Michael Wilson) > 2. Re: Vista questions (Ludolf Holzheid) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 11 Nov 2009 13:22:53 -0500 > From: Michael Wilson <michael.r.wilson(a)gmail.com> > Subject: [stunnel-users] Vista questions > To: stunnel-users(a)mirt.net > Message-ID: > <6d39888c0911111022r39c898c5je24d6808075bc0ba(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > I am running 4.27 on Vista and can successfully start it and use Blat > to e-mail via my gmail account using stunnel. > > However, I have two questions: > > Q1: I would like to close down stunnel after sending my e-mails. How > can I do that on Vista? > > Q2: Why do I get the following when I enter "stunnel -help" at the command line > > A window with the heading "Stunnel 4.27 on Win32 (not configured)" that says: > Stunnel server is down due to an error. > You will need to exit and correct the problem > Click OK to see the error log window > > The error log is: > > Global options > compression = zlib|rle compression type > debug = [facility].level (e.g. daemon.info) > EGD = path to Entropy Gathering Daemon socket > engine = auto|engine_id > engineCtrl = cmd[:arg] > output = file to append log messages > RNDbytes = bytes to read from random seed files > RNDfile = path to file with random seed data > RNDoverwrite = yes|no overwrite seed datafiles with new random data > service = service name > socket = a|l|r:option=value[:value] > set an option on accept/local/remote socket > taskbar = yes|no enable the taskbar icon > > Service-level options > accept = [host:]port accept connections on specified host:port > CApath = CA certificate directory for 'verify' option > CAfile = CA certificate file for 'verify' option > cert = certificate chain > ciphers = list of permitted SSL ciphers > client = yes|no client mode (remote service uses SSL) > connect = [host:]port connect remote host:port > CRLpath = CRL directory > CRLfile = CRL file > delay = yes|no delay DNS lookup for 'connect' option > engineNum = number of engine to read the key from > failover = rr|prio chose failover strategy > ident = username for IDENT (RFC 1413) checking > key = certificate private key > local = IP address to be used as source for remote connections > ocsp = OCSP server URL > OCSPflag = OCSP server flags > options = SSL option > set an SSL option > protocol = protocol to negotiate before SSL initialization > currently supported: cifs, connect, nntp, pop3, smtp > protocolAuthentication = authentication type for protocol negotiations > protocolHost = host:port for protocol negotiations > protocolPassword = password for protocol negotiations > protocolUsername = username for protocol negotiations > session = session cache timeout (in seconds) > stack = thread stack size (in bytes) > sslVersion = all|SSLv2|SSLv3|TLSv1 SSL method > TIMEOUTbusy = seconds to wait for expected data > TIMEOUTclose = seconds to wait for close_notify (set to 0 for buggy MSIE) > TIMEOUTconnect = seconds to connect remote host > TIMEOUTidle = seconds to keep an idle connection > verify = level of peer certificate verification > level 1 - verify peer certificate if present > level 2 - require valid peer certificate always > level 3 - verify peer with locally installed certificate > > 2009.11.11 13:03:36 LOG3[5440:5128]: Server is down > > > ------------------------------ > > Message: 2 > Date: Wed, 11 Nov 2009 20:06:20 +0100 > From: Ludolf Holzheid <lholzheid(a)bihl-wiedemann.de> > Subject: Re: [stunnel-users] Vista questions > To: stunnel-users(a)mirt.net > Message-ID: <20091111190620.GD29581(a)svr5.bihl-wiedemann.de> > Content-Type: text/plain; charset=iso-8859-1 > > On Wed, 2009-11-11 13:22:53 -0500, Michael Wilson wrote: >> I am running 4.27 on Vista and can successfully start it and use Blat >> to e-mail via my gmail account using stunnel. >> >> However, I have two questions: >> >> Q1: I would like to close down stunnel after sending my e-mails. How >> can I do that on Vista? > > Michael, > > did you try to right-click on the stunnel icon in the systray and select "Exit"? > >> Q2: Why do I get the following when I enter "stunnel -help" at the command line > > This is stunnel's way to output the help message (or other messages) > on windows. > > If stunnel used stdio for messages, you would have seen the help > message in the command prompt window you entered "stunnel -help" > in. However, there isn't necessarily a command prompt window stunnel > is attached to. Imagine to invoke "stunnel -help" via [start]->[run]. > > Ludolf > > -- > > --------------------------------------------------------------- > Ludolf Holzheid Tel: +49 621 339960 > Bihl+Wiedemann GmbH Fax: +49 621 3392239 > Flo?w?rthstra?e 41 e-mail: lholzheid(a)bihl-wiedemann.de > D-68199 Mannheim, Germany > --------------------------------------------------------------- > > > > ------------------------------ > > _______________________________________________ > stunnel-users mailing list > stunnel-users(a)mirt.net > http://stunnel.mirt.net/mailman/listinfo/stunnel-users > > > End of stunnel-users Digest, Vol 64, Issue 8 > ******************************************** >

2 1

Vista questions
by Michael Wilson 11 Nov '09

11 Nov '09

I am running 4.27 on Vista and can successfully start it and use Blat to e-mail via my gmail account using stunnel. However, I have two questions: Q1: I would like to close down stunnel after sending my e-mails. How can I do that on Vista? Q2: Why do I get the following when I enter "stunnel -help" at the command line A window with the heading "Stunnel 4.27 on Win32 (not configured)" that says: Stunnel server is down due to an error. You will need to exit and correct the problem Click OK to see the error log window The error log is: Global options compression = zlib|rle compression type debug = [facility].level (e.g. daemon.info) EGD = path to Entropy Gathering Daemon socket engine = auto|engine_id engineCtrl = cmd[:arg] output = file to append log messages RNDbytes = bytes to read from random seed files RNDfile = path to file with random seed data RNDoverwrite = yes|no overwrite seed datafiles with new random data service = service name socket = a|l|r:option=value[:value] set an option on accept/local/remote socket taskbar = yes|no enable the taskbar icon Service-level options accept = [host:]port accept connections on specified host:port CApath = CA certificate directory for 'verify' option CAfile = CA certificate file for 'verify' option cert = certificate chain ciphers = list of permitted SSL ciphers client = yes|no client mode (remote service uses SSL) connect = [host:]port connect remote host:port CRLpath = CRL directory CRLfile = CRL file delay = yes|no delay DNS lookup for 'connect' option engineNum = number of engine to read the key from failover = rr|prio chose failover strategy ident = username for IDENT (RFC 1413) checking key = certificate private key local = IP address to be used as source for remote connections ocsp = OCSP server URL OCSPflag = OCSP server flags options = SSL option set an SSL option protocol = protocol to negotiate before SSL initialization currently supported: cifs, connect, nntp, pop3, smtp protocolAuthentication = authentication type for protocol negotiations protocolHost = host:port for protocol negotiations protocolPassword = password for protocol negotiations protocolUsername = username for protocol negotiations session = session cache timeout (in seconds) stack = thread stack size (in bytes) sslVersion = all|SSLv2|SSLv3|TLSv1 SSL method TIMEOUTbusy = seconds to wait for expected data TIMEOUTclose = seconds to wait for close_notify (set to 0 for buggy MSIE) TIMEOUTconnect = seconds to connect remote host TIMEOUTidle = seconds to keep an idle connection verify = level of peer certificate verification level 1 - verify peer certificate if present level 2 - require valid peer certificate always level 3 - verify peer with locally installed certificate 2009.11.11 13:03:36 LOG3[5440:5128]: Server is down

2 1

FIPS_mode_set error
by th＠ftlabs.com 09 Nov '09

09 Nov '09

I just installed Stunnel-4.27 on a Linux box and cannot get it to start with a test config that works on another box running same version of Stunnel. I get the following output... [root@dvl stunnel]# stunnel stunnel.conf-test 2009.11.07 11:07:43 LOG7[31671:46968864029472]: Snagged 64 random bytes from stunnel-test.rnd 2009.11.07 11:07:43 LOG7[31671:46968864029472]: Wrote 1024 new random bytes to stunnel-test.rnd 2009.11.07 11:07:43 LOG7[31671:46968864029472]: RAND_status claims sufficient entropy for the PRNG 2009.11.07 11:07:43 LOG7[31671:46968864029472]: PRNG seeded successfully 2009.11.07 11:07:43 LOG7[31671:46968864029472]: SSL context initialized for service Test 2009.11.07 11:07:43 LOG3[31671:46968864029472]: FIPS_mode_set: 2D06C06E: error:2D06C06E:FIPS routines:FIPS_mode_set:fingerprint does not match Does anybody have a clue what may be causing this and how to fix it? Please pardon my ignorance regarding OpenSSL.

1 0

Stunnel 4.28 released
by Michal Trojnara 08 Nov '09

08 Nov '09

The ChangeLog entry: Version 4.28, 2009.11.08, urgency: MEDIUM: * New features - Win32 DLLs for OpenSSL 0.9.8l. - Transparent proxy support on Linux kernels >=2.6.28. See the manual for details. - New socket options to control TCP keepalive on Linux: TCP_KEEPCNT, TCP_KEEPIDLE, TCP_KEEPINTVL. - SSL options updated for the recent version of OpenSSL library. * Bugfixes - A serious bug in asynchronous shutdown code fixed. - Data alignment updated in libwrap.c. - Polish manual encoding fixed. - Notes on compression implementation in OpenSSL added to the manual. SHA-1 value for stunnel-4.28.tar.gz: 868cba9ec56ed6a02c8ecfa2a87614b4d433611b Home page: http://stunnel.mirt.net/ Download: ftp://stunnel.mirt.net/stunnel/ Best regards, Michal Trojnara

1 0

Update docs to remove RLE as compression choice
by Joe Kemp 06 Nov '09

06 Nov '09

I just confirmed that RLE compression is not truly implemented in OpenSSL. It would be helpful to remove it from the stunnel docs so people don't think it's an option to compress data. ZLIB is it. And yes I spent a good bit of time last year with Wireshark to determine RLE vs ZLIB compression ratios in stunnel. Shockingly ZLIB was always better... One other note that may be important for some people is that 0.9.7 openssl is not compatible with 0.9.8 with respect to zlib compression. Joe A. Kemp CapWIN Senior Systems Architect (O) 301-614-3727 (C) 301-502-1281

2 1

Is PSK supported with openssl-1.0.0-beta3 ?
by anders nilsson 05 Nov '09

05 Nov '09

Hello I am running x64 Linux 2.6.18-92.1.22.el5 and installed OpenSSL 1.0.0-beta3 15 Jul 2009 My stunnel -version is: stunnel 4.15 on x86_64-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 I would like to run the ciphers TLS_PSK_WITH_3DES_EDE_CBC_SHA or TLS_PSK_WITH_AES_128_CBC_SHA and I wonder how I do that. My stunnel.conf contains: ciphers = PSK-AES128-CBC-SHA:PSK-3DES-EDE-CBC-SHA and the error I get is: 2009.11.05 11:32:32 LOG3[29268:47461015826624]: SSL_CTX_set_cipher_list: 1410D0B9: error:1410D0B9:SSL routines:SSL_CTX_set_cipher_list:no cipher match Do I compile in the latest OpenSSL to stunnel? Isnt it a problem that the stunnel.conf does not even have the syntax to read PSK-key parameters since its most often run with RSA keys. _________________________________________________________________ Windows Live: Gör det enklare för dina vänner att se vad du håller på med på Facebook. http://www.microsoft.com/sverige/windows/windowslive/see-it-in-action/socia…

1 0

Is PSK supported with openssl-1.0.0-beta3 ?
by anders nilsson 05 Nov '09

05 Nov '09

Hello I am running x64 Linux 2.6.18-92.1.22.el5 and installed OpenSSL 1.0.0-beta3 15 Jul 2009 My stunnel -version is: stunnel 4.15 on x86_64-redhat-linux-gnu with OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 I would like to run the ciphers TLS_PSK_WITH_3DES_EDE_CBC_SHA or TLS_PSK_WITH_AES_128_CBC_SHA and I wonder how I do that. My stunnel.conf contains: ciphers = PSK-AES128-CBC-SHA:PSK-3DES-EDE-CBC-SHA and the error I get is: 2009.11.05 11:32:32 LOG3[29268:47461015826624]: SSL_CTX_set_cipher_list: 1410D0B9: error:1410D0B9:SSL routines:SSL_CTX_set_cipher_list:no cipher match Do I compile in the latest OpenSSL to stunnel? Isnt it a problem that the stunnel.conf does not even have the syntax to read PSK-key parameters since its most often run with RSA keys. Another question is that if there is no support for PSK, how much work is it to download the source and add support for it given that I know C++/C. _________________________________________________________________ Hitta hetaste singlarna på MSN Dejting! http://dejting.se.msn.com/channel/index.aspx?trackingid=1002952

1 0

Tunneling udp over stunnel
by D-503 03 Nov '09

03 Nov '09

Hi, I'm trying to setup some kind of DNS-encryption with the usage of stunnel: https://www.privacyfoundation.de/wiki/HTTPS-DNS/TLS-DNS . This setup is working but pretty pretty slow. One DNS-request takes really long, about 5-6 seconds! I'm wondering why this happens. On the server is running stunnel 4.22 and on the client stunnel 4.25. The config is as described in the link above. What happens in the logs when I do one dns-request, you can see in the attachments of this mail. Something interesting is, if I do a: dig @localhost google.com it takes 5-6 seconds to finish. But if I execute it, abort it directly and execute it again, I get immediatly an answer! This works reproducably. Have you any idea? Could the error be with open/closed connections or some timeouts in stunnel? greetings D-503

1 0

Help with basic stunnel configuration
by Craig Watkinson 30 Oct '09

30 Oct '09

Hello, I have been trying to enable stunnel on a HPUX server, and whilst I thought it was going to be simple, I have not been able to make it work so far. We have a webserver and due to some pages being hardcoded to port 8080 it can't support SSL without a lot of code changes. As a short term workaround I am trying to use stunnel in server mode to provide a HTTPS interface. I expected this to be a very simple matter of accepting connections on port 443 and connecting to port 8080, but it's not working. We're using an old version of stunnel (4.04) however this is the version bundled with the HPUX OS we have. When stunnel is started there are no errors (log file output below) and netstat shows that a process is listening on port 443, however a browser (tried IE6 and Firefox) doesn't display anything. Connecting to port 8080 shows the application as expected. I have run a wireshark trace at the client end, and it seems that the stunnel server is not responding to the initial "Client Hello" message. Only 3 packets are seen: C->S SYN S->C SYN,ACK C->S SSL Client Hello My guess is that the ssl server is not starting up correctly, however everything looks ok in the logfile, although it might not be completing. Nothing is displayed in the log when I try to connect to port 443. Any help would be much appreciated as I am stuck! Thanks Craig Server eSM_CoE# uname -a HP-UX eSM_CoE B.11.23 U ia64 1107767544 unlimited-user license Stunnel Version eSM_CoE# ./sbin/stunnel -version stunnel 4.04 on ia64-hp-hpux11.23 PTHREAD with OpenSSL 0.9.8d 28 Sep 2006 Global options cert = /opt/hpws/apache32/stunnel/etc/stunnel/stunnel.pem ciphers = ALL:!ADH:+RC4:@STRENGTH debug = 5 key = /opt/hpws/apache32/stunnel/etc/stunnel/stunnel.pem pid = /opt/hpws/apache32/stunnel/var/run/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes session = 300 seconds verify = none Service-level options TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTidle = 43200 seconds Conf file eSM_CoE# cat stunnel.conf # Sample stunnel configuration file RNDfile=/opt/hpws/apache32/stunnel/.stunnel.rnd # Chroot #chroot = /var/chroot/stunnel/ # PID is created inside chroot jail pid = /opt/hpws/apache32/logs/stunnel.pid # Workaround for Eudora bug #options = DONT_INSERT_EMPTY_FRAGMENTS # Client Authentication #verify = 2 # don't forget about c_rehash CApath # it is located inside chroot jail: #CApath = /certs # or simply use CAfile instead: #CAfile = /opt/hpws/apache32/conf/certs.pem # Some debugging stuff debug = 7 output = /opt/hpws/apache32/logs/stunnel.log # Use in client mode client = no # Run in the background foreground = no socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 delay=yes # Service-level configuration [https] accept = 172.20.167.74:443 connect = localhost:8080 TIMEOUTclose = 10 Log file output 2009.10.30 14:32:41 LOG5[4172:1]: stunnel 4.04 on ia64-hp-hpux11.23 PTHREAD with OpenSSL 0.9.8d 28 Sep 2006 2009.10.30 14:32:41 LOG7[4172:1]: Snagged 64 random bytes from /opt/hpws/apache32/stunnel/.stunnel.rnd 2009.10.30 14:32:41 LOG7[4172:1]: Wrote 1024 new random bytes to /opt/hpws/apache32/stunnel/.stunnel.rnd 2009.10.30 14:32:41 LOG7[4172:1]: RAND_status claims sufficient entropy for the PRNG 2009.10.30 14:32:41 LOG6[4172:1]: PRNG seeded successfully 2009.10.30 14:32:41 LOG7[4172:1]: Certificate: /opt/hpws/apache32/stunnel/etc/stunnel/stunnel.pem 2009.10.30 14:32:41 LOG7[4172:1]: Key file: /opt/hpws/apache32/stunnel/etc/stunnel/stunnel.pem 2009.10.30 14:32:41 LOG5[4172:1]: FD_SETSIZE=60000, file ulimit=4096 -> 2000 clients allowed 2009.10.30 14:32:41 LOG7[4172:1]: FD 5 in non-blocking mode 2009.10.30 14:32:41 LOG7[4172:1]: SO_REUSEADDR option set on accept socket 2009.10.30 14:32:41 LOG7[4172:1]: https bound to 172.20.167.74:443 _________________________________________________________________ New Windows 7: Find the right PC for you. Learn more. http://www.microsoft.com/uk/windows/buy/

1 0

stunnel compatibility problems between Windows & Linux ?
by Ewald 30 Oct '09

30 Oct '09

I am running an stunnel in chroot setup on a Red Hat Enterprise Linux Server (v3) : stunnel 4.27 on x86_64-unknown-linux-gnu with OpenSSL 0.9.7a Feb 19 2003 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 And i want to connect from a Windows 2003 system (als version 4.27) When i try to do a basic connect from the Windows stunnel to the Linux stunnel, the connection gets reset each time, ssldump shows: New TCP connection #1: hans13(1363) <-> nada(25000) 1 1 0.0000 (0.0000) C>S Handshake ClientHello Version 3.0 cipher suites Unknown value 0x39 Unknown value 0x38 Unknown value 0x35 SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA SSL_RSA_WITH_3DES_EDE_CBC_SHA Unknown value 0x33 Unknown value 0x32 Unknown value 0x2f SSL_RSA_WITH_RC4_128_SHA SSL_RSA_WITH_RC4_128_MD5 SSL_DHE_RSA_WITH_DES_CBC_SHA SSL_DHE_DSS_WITH_DES_CBC_SHA SSL_RSA_WITH_DES_CBC_SHA SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA SSL_RSA_EXPORT_WITH_DES40_CBC_SHA SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5 SSL_RSA_EXPORT_WITH_RC4_40_MD5 compression methods unknown value NULL 1 2 0.0000 (0.0000) S>C Alert level fatal value handshake_failure 1 0.0000 (0.0000) S>C TCP RST Stunnel logging shows: 2009.10.26 10:37:25 LOG7[29959:1073879408]: xxx started 2009.10.26 10:37:25 LOG7[29959:1073879408]: FD 7 in non-blocking mode 2009.10.26 10:37:25 LOG5[29959:1073879408]: tfe accepted connection from 10.10.10.10:1250 2009.10.26 10:37:25 LOG7[29959:1073879408]: SSL state (accept): before/accept initialization 2009.10.26 10:37:25 LOG7[29959:1073879408]: SSL alert (write): fatal: handshake failure 2009.10.26 10:37:25 LOG3[29959:1073879408]: SSL_accept: 1408A09F: error:1408A09F:SSL routines:SSL3_GET_CLIENT_HELLO:length mismatch 2009.10.26 10:37:25 LOG5[29959:1073879408]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.10.26 10:37:25 LOG7[29959:1073879408]: xxx finished (-1 left) When i explicitly configure the Windows stunnel to use: sslVersion = SSLv2 or sslVersion = TLSv1 (see ssldump logging below) everything works fine. Is this a known bug or an undocumented feature? Ewald... New TCP connection #3: hans13.amc.nl(1367) <-> nada.amc.nl(25000) 3 1 0.0000 (0.0000) C>S Handshake ClientHello Version 3.1 resume [32]= b8 a1 d2 93 6a ae 4a 0d 49 04 cd 88 92 75 f1 6d d7 65 88 c3 01 51 bf eb d4 44 ce b7 fd 75 32 64 cipher suites Unknown value 0x39 Unknown value 0x38 Unknown value 0x35 TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA Unknown value 0x33 Unknown value 0x32 Unknown value 0x2f TLS_RSA_WITH_RC4_128_SHA TLS_RSA_WITH_RC4_128_MD5 TLS_DHE_RSA_WITH_DES_CBC_SHA TLS_DHE_DSS_WITH_DES_CBC_SHA TLS_RSA_WITH_DES_CBC_SHA TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA TLS_RSA_EXPORT_WITH_DES40_CBC_SHA TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 TLS_RSA_EXPORT_WITH_RC4_40_MD5 compression methods unknown value NULL 3 2 0.0000 (0.0000) S>C Handshake ServerHello Version 3.1 session_id[32]= b8 a1 d2 93 6a ae 4a 0d 49 04 cd 88 92 75 f1 6d d7 65 88 c3 01 51 bf eb d4 44 ce b7 fd 75 32 64 cipherSuite Unknown value 0x35 compressionMethod NULL etc...

2 1

Connections begin resetted
by Roman Medina-Heigl Hernandez 26 Oct '09

26 Oct '09

Hello, Till some recent time, I was using "socat" (http://www.dest-unreach.org/socat/) to create a SSL-wrapper (in a way similar to what "stunnel" does). I was using: === socat -ly -d -d openssl-listen:443,bind=X.X.X.X,fork,reuseaddr,cipher=HIGH:3DES:MD5,cert=server-cert.pem,key=server-key.pem,verify=0 tcp4:Y.Y.Y.Y:P === It was working pretty well, without interruptions, although it got some estability problems when passing 1-2 months (server apparently get stuck). So I decided to give a try to "stunnel". I switched to "stunnel" and problems arise... I'm experimenting *very* frequent connection cuts. If I examine daemon.log (I'm using Debian 5), I have: Oct 20 12:06:36 hetzner stunnel: LOG3[3677:3083029392]: SSL_read: 140EC071: error:140EC071:SSL routines:SSL2_READ_INTERNAL:bad mac decode Oct 20 12:06:36 hetzner stunnel: LOG5[3677:3083029392]: Connection reset: 315484 bytes sent to SSL, 50471 bytes sent to socket So it seems stunnel is closing the connection due to a "bad mac decode" error. My environment (client and server) have not changed, I only switched "the transport" (socat -> stunnel). Any idea why is it failing now? Moreover, if I switch back to socat, cuts disappear. Is stunnel buggy? Am I missing some config/tunning at the SSL/socket level? My current config is: roman@hetzner:~$ stunnel4 -sockets Socket option defaults: Option Accept Local Remote OS default SO_DEBUG -- -- -- 0 SO_DONTROUTE -- -- -- 0 SO_KEEPALIVE -- -- -- 0 SO_LINGER -- -- -- 0:0 SO_OOBINLINE -- -- -- 0 SO_RCVBUF -- -- -- 87380 SO_SNDBUF -- -- -- 16384 SO_RCVLOWAT -- -- -- 1 SO_SNDLOWAT -- -- -- 1 SO_RCVTIMEO -- -- -- 0:0 SO_SNDTIMEO -- -- -- 0:0 SO_REUSEADDR 1 -- -- 0 SO_BINDTODEVICE -- -- -- -- IP_TOS -- -- -- 0 IP_TTL -- -- -- 64 TCP_NODELAY -- -- -- 0 root@hetzner:~# stunnel4 -version stunnel 4.22 on i486-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /var/run/stunnel4.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none My stunnel.conf is very simple. Apart from cert setup, the tunnel is something like: === [tunelserv] accept = X.X.X:X:443 connect = X.X.X.X:P === Any idea? Thank you in advance. Cheers, -Roman

2 2

Re: [stunnel-users] multiple domain certificates
by Ludolf Holzheid 23 Oct '09

23 Oct '09

On Fri, 2009-10-23 15:04:14 -0400, Al Gonzalez wrote: > I apologize for a potentially silly question, but is there any way to > determine if my question made it to the user's group. I sent in a > question (I think last Friday), and other than a auto-reply to myself, I > don't know if anyone really received it. I'm in a bit of a pickle, and > could sure use some help. Thanks. If you are worried about your message may not make it to a mailing list, check the list archive at the URL given in the "List-Archive:" header included in the mails sent from the list server. In case of stunnel-users this is http://stunnel.mirt.net/pipermail/stunnel-users. And yes, your mail from October 20th can be found there. Regarding your problem, I'm afraid I can't help as I use stunnel for 'secure tunnels' only, i.e. I have stunnel on both ends of the connection and I don't have to care about the protocols tunneled through. Sorry, Ludolf. -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

multiple domain certificates
by Andrew Farmer 23 Oct '09

23 Oct '09

Does stunnel support multiple domain certificates? I am trying to get stunnel to work with multiple domains on a machine that can have only one IP address. (It is an amazon EC2 instance - they do not support multiple IPs per instance) It seems to me that the only way to get this to work is with a multiple domain certificate, which I believe is called a "Unified Communications Certificate". Does stunnel support these? Thank you so much, Andrew -- View this message in context: http://www.nabble.com/multiple-domain-certificates-tp25897355p25897355.html Sent from the Stunnel - Users mailing list archive at Nabble.com.

2 2

https problems over TLSv1
by Al Gonzalez 20 Oct '09

20 Oct '09

Thank you in advance for any assistance you can provide... I am trying to talk to a UHF radio (from a PC) over a secure channel, but having some difficulties. Please let me provide just a little background so you know why I’m doing what I’m doing. In the existing system, Internet Explorer (IE) is the client that talks to this radio. When the radio boots up, it sends a webpage over Ethernet to IE and (after the user login), a secure link is established, and the radio can be controlled from IE – the various webpages change as the user maneuvers through the various dropdowns, etc. We’ve been asked to automate this interface now for a production environment. The client is going to be replaced with a PC connected to a great deal of test equipment, and the server will now send XML instead of html to the client. The client is being developed in LabVIEW (from National Instruments) – this has made this task even more challenging. As all of this secure stuff is new to me, I spent many hours just trying to understand the problem(s) and the lingo. As LabVIEW has some limitations in this area, I found that Stunnel was my best option. Using TCP/IP and sending http to the radio (shown below), I’ve been able (in a non-secure mode, without Stunnel) to communicate and get the opening screen (html) to be returned to me (the XML server output is currently being developed) and displayed in a LabVIEW window. GET / HTTP/1.1 Host: 10.4.32.1 Connection: Keep-Alive Authorization: Basic YWRtaW46UgEkJHdvtmQx Credentials: admin:Password I downloaded the binary version of Stunnel.exe (version 4.27 with OpenSSL 0.9.8k dated Mar 2009), then modified the LabVIEW code to call (using a command line approach) Stunnel. In this way, I can’t provide any (dash) options, so it’s completely dependent on the stunnel.conf file. After a number of attempts, I was able to get the client to bind to the server (I think), but I see nothing being returned to me (no html). I must use TLSv1, and ciphers = DES-CBC3-SHA. I’ve seen examples on stunnel.org that show a great deal more handshaking information than I’m seeing, so I’m wondering if I’m missing some detail in my conf file. For example, my log file ends like this 2009.10.16 13:18:49 LOG7[4812:4776]: FD 208 in non-blocking mode 2009.10.16 13:18:49 LOG7[4812:4776]: SO_REUSEADDR option set on accept socket 2009.10.16 13:18:49 LOG7[4812:4776]: https bound to 10.4.1.8:443 But the example I mentioned goes on after the “https bound” and adds things like … 2009.08.04 12:15:55 LOG7[16648:22996]: proxy accepted FD=320 from 127.0.0.1:48086 2009.08.04 12:15:55 LOG7[16648:22996]: Creating a new thread 2009.08.04 12:15:55 LOG7[16648:22996]: New thread created 2009.08.04 12:15:55 LOG7[16648:8540]: proxy started 2009.08.04 12:15:55 LOG7[16648:8540]: FD 320 in non-blocking mode 2009.08.04 12:15:55 LOG7[16648:8540]: TCP_NODELAY option set on local socket 2009.08.04 12:15:55 LOG5[16648:8540]: proxy accepted connection from 127.0.0.1:48086 2009.08.04 12:15:55 LOG7[16648:8540]: FD 340 in non-blocking mode 2009.08.04 12:15:55 LOG7[16648:8540]: proxy connecting 89.149.253.125:8080 2009.08.04 12:15:55 LOG7[16648:8540]: connect_wait: waiting 10 seconds 2009.08.04 12:15:56 LOG7[16648:8540]: connect_wait: connected 2009.08.04 12:15:56 LOG5[16648:8540]: proxy connected remote server from 192.168.2.3:48088 2009.08.04 12:15:56 LOG7[16648:8540]: Remote FD=340 initialized 2009.08.04 12:15:56 LOG7[16648:8540]: TCP_NODELAY option set on remote socket 2009.08.04 12:15:56 LOG7[16648:8540]: SSL state (connect): before/connect initialization 2009.08.04 12:15:56 LOG7[16648:8540]: SSL state (connect): SSLv3 write client hello A 2009.08.04 12:15:56 LOG7[16648:8540]: SSL state (connect): SSLv3 read server hello A . . . 2009.08.04 12:15:57 LOG6[16648:8540]: SSL connected: new session negotiated 2009.08.04 12:15:57 LOG6[16648:8540]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 That make’s me think that I’m not quite there yet. I’ve attached my stunnel.conf, my log file, and the http request I’m making (above). I’m hoping you can find some flaws in my conf file that will get me closer. Other than receiving html, I’m not sure how to know that I truly have a secure connection. I’m thinking I should see a little more in my log file, but I’m not sure. The other thing I’m not sure about (as I’ve heard differing thoughts) is whether I have to Encrypt my http commands, or does stunnel take care of that somehow? If I have to encypt, how would I go about doing this? Also, (and I’m getting ahead of myself) do I have to open and close a session every time I want to talk, or do I somehow leave the channel open? I’ve read about Session Resumption, but I’m not sure if that is something I need to setup in the conf file, or if that can even be controlled by Stunnel. Al Gonzalez Principal Software Engineer Compass Call Programs Offensive Information Warfare Raytheon Company 260.429.4354 260.429.5829 fax Al_Gonzalez(a)raytheon.com

1 0

MySQL replication with stunnel, connection closed after some time
by Marcel Kirsch 16 Oct '09

16 Oct '09

Hello, I have a problem regarding stunnel and MySQL replication. I use replication to keep our database synchronous with a second database, which stands in our building. The secure connection via stunnel works and "SHOW SLAVE STATUS;" shows, that the replication is working. Because the master database is rarely used at the moment, sometimes there are no changes (insert, update or delete) made for an hour. Unfortunately it seems that stunnel disconnects the connection between the databases after some time. The client database still thinks that it is connected to the master server, because it still is connected to port 3307 (which is stunnel of course). So now the changes made in the master database are no longer replicated. Is there any way to configure stunnel to keep the connection between the to servers alive even after an hour of zero traffic? I thought that TIMEOUTidle would be the answer to my problem, but it had no effect. I really hope you can help me and thanks for your suggestions in advance. Greetings, Marcel Kirsch This is my current configuration: Client: ; Certificate/key is needed in server mode and optional in client mode cert = /etc/stunnel/stunnel.pem key = /etc/stunnel/stunnel.pem ; Protocol version (all, SSLv2, SSLv3, TLSv1) sslVersion = SSLv3 ; Some security enhancements for UNIX systems - comment them out on Win32 chroot = /var/lib/stunnel4/ setuid = stunnel4 setgid = stunnel4 ; PID is created inside chroot jail pid = /stunnel4.pid ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ;compression = rle retry = yes TIMEOUTidle = 86400 ; Some debugging stuff useful for troubleshooting debug = 3 output = /var/log/stunnel4/stunnel.log ; Use it for client mode client = yes [mysqls] accept = 3307 connect = 78.46.106.68:3307 Server: client = no pid = /var/run/stunnel.pid # # debugging # debug = 7 output = /etc/stunnel/stunnel.log # # Some performance tunings # # disable Nagle algorithm (a.k.a. tinygram prevention, see man 7 tcp) socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 cert = /etc/stunnel/stunnel.pem retry = yes TIMEOUTidle = 86400 [mysqls] accept = 3307 connect = 127.0.0.1:mysql Log of client while connecting: 2009.10.09 09:28:58 LOG7[3729:3082963856]: connect_wait: connected 2009.10.09 09:28:58 LOG5[3729:3082963856]: mysqls connected remote server from 192.168.1.87:33206 2009.10.09 09:28:58 LOG7[3729:3082963856]: Remote FD=17 initialized 2009.10.09 09:28:58 LOG7[3729:3082963856]: TCP_NODELAY option set on remote socket 2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect): before/connect initialization 2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect): SSLv3 write client hello A 2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect): SSLv3 read server hello A 2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect): SSLv3 read server certificate A 2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect): SSLv3 read server done A 2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect): SSLv3 write client key exchange A 2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect): SSLv3 write change cipher spec A 2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect): SSLv3 write finished A 2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect): SSLv3 flush data 2009.10.09 09:28:58 LOG7[3729:3082963856]: SSL state (connect): SSLv3 read finished A 2009.10.09 09:28:58 LOG7[3729:3082963856]: 3 items in the session cache 2009.10.09 09:28:58 LOG7[3729:3082963856]: 3 client connects (SSL_connect()) 2009.10.09 09:28:58 LOG7[3729:3082963856]: 3 client connects that finished 2009.10.09 09:28:58 LOG7[3729:3082963856]: 0 client renegotiations requested 2009.10.09 09:28:58 LOG7[3729:3082963856]: 0 server connects (SSL_accept()) 2009.10.09 09:28:58 LOG7[3729:3082963856]: 0 server connects that finished 2009.10.09 09:28:58 LOG7[3729:3082963856]: 0 server renegotiations requested 2009.10.09 09:28:58 LOG7[3729:3082963856]: 0 session cache hits 2009.10.09 09:28:58 LOG7[3729:3082963856]: 0 session cache misses 2009.10.09 09:28:58 LOG7[3729:3082963856]: 0 session cache timeouts 2009.10.09 09:28:58 LOG6[3729:3082963856]: SSL connected: new session negotiated 2009.10.09 09:28:58 LOG6[3729:3082963856]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 Log of server while connecting: 2009.10.09 09:28:52 LOG7[31073:139652979042032]: mysqls accepted FD=14 from 212.95.118.250:60651 2009.10.09 09:28:52 LOG7[31073:1091389776]: mysqls started 2009.10.09 09:28:52 LOG7[31073:1091389776]: FD 14 in non-blocking mode 2009.10.09 09:28:52 LOG7[31073:1091389776]: TCP_NODELAY option set on local socket 2009.10.09 09:28:52 LOG7[31073:1091389776]: Waiting for a libwrap process 2009.10.09 09:28:52 LOG7[31073:1091389776]: Acquired libwrap process #0 2009.10.09 09:28:52 LOG7[31073:1091389776]: Releasing libwrap process #0 2009.10.09 09:28:52 LOG7[31073:1091389776]: Released libwrap process #0 2009.10.09 09:28:52 LOG7[31073:1091389776]: mysqls permitted by libwrap from 212.95.118.250:60651 2009.10.09 09:28:52 LOG5[31073:1091389776]: mysqls accepted connection from 212.95.118.250:60651 2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): before/accept initialization 2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3 read client hello A 2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3 write server hello A 2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3 write certificate A 2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3 write server done A 2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3 flush data 2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3 read client key exchange A 2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3 read finished A 2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3 write change cipher spec A 2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3 write finished A 2009.10.09 09:28:52 LOG7[31073:1091389776]: SSL state (accept): SSLv3 flush data 2009.10.09 09:28:52 LOG7[31073:1091389776]: 3 items in the session cache 2009.10.09 09:28:52 LOG7[31073:1091389776]: 0 client connects (SSL_connect()) 2009.10.09 09:28:52 LOG7[31073:1091389776]: 0 client connects that finished 2009.10.09 09:28:52 LOG7[31073:1091389776]: 0 client renegotiations requested 2009.10.09 09:28:52 LOG7[31073:1091389776]: 17 server connects (SSL_accept()) 2009.10.09 09:28:52 LOG7[31073:1091389776]: 17 server connects that finished 2009.10.09 09:28:52 LOG7[31073:1091389776]: 0 server renegotiations requested 2009.10.09 09:28:52 LOG7[31073:1091389776]: 0 session cache hits 2009.10.09 09:28:52 LOG7[31073:1091389776]: 1 session cache misses 2009.10.09 09:28:52 LOG7[31073:1091389776]: 14 session cache timeouts 2009.10.09 09:28:52 LOG6[31073:1091389776]: SSL accepted: new session negotiated 2009.10.09 09:28:52 LOG6[31073:1091389776]: Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 2009.10.09 09:28:52 LOG7[31073:1091389776]: FD 15 in non-blocking mode 2009.10.09 09:28:52 LOG7[31073:1091389776]: mysqls connecting 127.0.0.1:3306 2009.10.09 09:28:52 LOG7[31073:1091389776]: connect_wait: waiting 10 seconds 2009.10.09 09:28:52 LOG7[31073:1091389776]: connect_wait: connected 2009.10.09 09:28:52 LOG5[31073:1091389776]: mysqls connected remote server from 127.0.0.1:59705 2009.10.09 09:28:52 LOG7[31073:1091389776]: Remote FD=15 initialized 2009.10.09 09:28:52 LOG7[31073:1091389776]: TCP_NODELAY option set on remote socket 2009.10.09 09:28:52 LOG7[31073:1098307920]: Socket closed on read 2009.10.09 09:28:52 LOG7[31073:1098307920]: SSL write shutdown 2009.10.09 09:28:52 LOG7[31073:1098307920]: SSL alert (write): warning: close notify 2009.10.09 09:28:52 LOG6[31073:1098307920]: SSL socket closed on SSL_shutdown 2009.10.09 09:28:52 LOG7[31073:1098307920]: Socket write shutdown 2009.10.09 09:28:52 LOG5[31073:1098307920]: Connection closed: 9600 bytes sent to SSL, 185 bytes sent to socket 2009.10.09 09:28:52 LOG7[31073:1098307920]: mysqls finished (1 left) Log of server while disconnecting: 2009.10.09 09:53:48 LOG3[31073:1091389776]: SSL_read: Connection reset by peer (104) 2009.10.09 09:53:48 LOG5[31073:1091389776]: Connection reset: 1047 bytes sent to SSL, 185 bytes sent to socket 2009.10.09 09:53:48 LOG7[31073:1091389776]: mysqls finished (0 left) (There is no log of client while disconnecting)

3 3

Re: [stunnel-users] MySQL replication with stunnel, connection closed after some time
by Michal Trojnara 16 Oct '09

16 Oct '09

Marcel Kirsch wrote: > it is correct that there is a router (with NAT) between the slave server > and the internet. I tried the solution of Mike (socket = > l:SO_KEEPALIVE=1...), but it didn't work. > I googled SO_KEEPALIVE and discovered that it only sends a keep alive > packet every 2 hours by default. Unfortunately the connection is closed > after a shorter time (about 30 minutes). Do you know how it is possible > to set the keep alive time to a shorter value? On Linux you can use: echo 300 > /proc/sys/net/ipv4/tcp_keepalive_time Best regards, Mike

1 0

Re: [stunnel-users] MySQL replication with stunnel, connection closed after some time
by Michal Trojnara 15 Oct '09

15 Oct '09

Marcel Kirsch wrote: > Is there any way to > configure stunnel to keep the connection between the to servers alive > even after an hour of zero traffic? I thought that TIMEOUTidle would be > the answer to my problem, but it had no effect. [cut] > 2009.10.09 09:53:48 LOG3[31073:1091389776]: SSL_read: Connection reset > by peer (104) I'm pretty sure there is a network device (some kind of statefull firewall or NAT) between these machines. I think the timeout is caused by the TCP state expired rater than by stunnel. I think enabling TCP keepalives could be an effective workaround: socket = l:SO_KEEPALIVE=1 socket = r:SO_KEEPALIVE=1 The trick is to generate some traffic on an idle connection to convince the network device that this TCP connection is not dead. An alternative solution would be to increase the TCP state timeout on the network device. Best regards, Mike

1 0

bind error when specifying hostname
by Andrew Farmer 13 Oct '09

13 Oct '09

Hi! I'm not sure if this message was sent to the mailing list the first time... I was not subscribed before but I am now. I'm trying to configure stunnel to use a different CERT depending upon the hostname that my server is accessed on. (Same server has multiple hostnames) Is this feature supported? I didn't get very far before running into issues. This configuration works: (so I know nothing else is bound on port 443) [https] accept = 443 ... etc ... This configuration fails: [https] accept = nmw3.com:443 ... etc ... with this error: 2009.10.09 14:49:18 LOG3[31137:3086100144]: Error binding https to 75.101.155.94:443 2009.10.09 14:49:18 LOG3[31137:3086100144]: bind: Cannot assign requested address (99) So I tried a simpler configuration: [https] accept = 127.0.0.1:443 ... etc ... and that fails with this error: 2009.10.09 14:56:28 LOG3[31222:3086722736]: Error binding https to 127.0.0.1:443 2009.10.09 14:56:28 LOG3[31222:3086722736]: bind: Address already in use (98) Appreciate all your help! Andrew -- View this message in context: http://www.nabble.com/bind-error-when-specifying-hostname-tp25828605p258286… Sent from the Stunnel - Users mailing list archive at Nabble.com.

1 0

Unable to create connection on SSL with FIX Server
by ch.asad＠gmail.com 13 Oct '09

13 Oct '09

Hi, i am using Stunnel to send quickfix messages on SSL to FIX server. I am struck with some errors. In the STUNNEL log i am getting the follow error: 2009.10.13 08:57:05 LOG3[4028:2532]: SSL_accept: 140760FC: error:140760FC:SSL routines:SSL23_GET_CLIENT_ HELLO:unknown protocol And in the Quickfix Logs are also shown below: 20091013-02:57:01 : Created session 20091013-02:57:05 : Connecting to 127.0.0.1 on port 9000 20091013-02:57:05 : Initiated logon request 20091013-02:57:05 : Socket Error: An existing connection was forcibly closed by the remote host. 20091013-02:57:05 : Disconnecting 20091013-02:57:06 : Connecting to 127.0.0.1 on port 9000 20091013-02:57:06 : Initiated logon request 20091013-02:57:06 : Socket Error: An existing connection was forcibly closed by the remote host. 20091013-02:57:06 : Disconnecting 20091013-02:57:26 : Connecting to 127.0.0.1 on port 9000 20091013-02:57:26 : Initiated logon request 20091013-02:57:26 : Socket Error: An existing connection was forcibly closed by the remote host. Can any one Guide me what is causing porblem in this?? -- View this message in context: http://www.nabble.com/Unable-to-create-connection-on-SSL-with-FIX-Server-tp… Sent from the Stunnel - Users mailing list archive at Nabble.com.

2 1

Re: [stunnel-users] rewrite Destination: when rewriting Host:
by Brian Hatch 07 Oct '09

07 Oct '09

Sometime near 2007-11-11 00:15 -0500, Marcio Marchini shouted: > Researching online one can see that WebDAV's spec requires that they > check both src and dest URLs for protocol & port. But with some proxies or > SSL fronts like stunnel, only one of the URLs is rewritten, so one goes as > http and the other as https. Here's one person explaining it, much better > than me: http://svn.haxx.se/users/archive-2006-03/0549.shtml Stunnel doesn't currently have the ability to scan and re-write the plaintext. For HTTP redirects it could possibly be implemented (re-write only the response before ^$, and redirects aren't chunked and don't have content lengths to work with, etc) but you'd still need enough HTTP logic to handle keepalives and such. It's not trivial and not likely. Another option would be to have something already HTTP aware doing the rewriting in between stunnel and subversion. A re-writing proxy. Another option would be to use mod_rewrite in apache to rewrite the urls. But the best way would be to just use SSL inside apache and drop stunnel entirely. -- Brian Hatch The best way to accelerate Systems and a Windows machine is at Security Engineer 9.8 meters per second http://www.ifokr.org/bri/ squared. Every message PGP signed

3 2

Weird verify behaviour using intermediate CAs
by Simon Vallet 05 Oct '09

05 Oct '09

Hi, we're trying to make use of stunnel here for proxy purposes : any certificate-authenticated SSL client connection from the Internet would be forwarded to some internal server. This works fine, but I found some surprising behaviour when verifying client certificates. Consider the following setup, using an intermediate client CA : * RootCA ** UserCA1 *** UserCert1 ** UserCA2 *** UserCert2 To make this work, it seems I only have to include the Root CA certificate in either a CAfile or a directory of trusted certificates. I would have expected to have to include the intermediate CA (which is signing the user certificate), but it seems it is not the case. What worries me is that now *any* end-entity certificate which has been issued by *other* intermediate CAs is accepted as valid, i.e. UserCert2 is accepted as valid, even if I don't include UserCA2 anywhere in the configuration. Is this really the intended behaviour ? If not, what would I be missing ? Simon stunnel.conf ----------------------------------------------------------- connect = 127.0.0.1:25 CApath = /etc/stunnel/certs cert = /etc/stunnel/apollon.genoscope.cns.fr-RevChain.pem key = /etc/stunnel/apollon.genoscope.cns.fr-Key.pem verify = 2 debug = 7 ------------------------------------------------------------------------ [root@apollon certs]# ls -l /etc/stunnel/certs/ total 4 lrwxrwxrwx 1 root root 28 sep 30 11:01 9a5490ff.0 -> GenoscopeACRacine.cacert.pem -rw-r--r-- 1 root root 2269 sep 15 11:47 GenoscopeACRacine.cacert.pem [root@apollon certs]#

2 6

Looking for someone to install Stunnel on my server
by Nathan Mueller 02 Oct '09

02 Oct '09

I am looking to hire someone to install Stunnel (and openSSL) on my Media Temple DV account. Please send hourly rate and how long you think it would take to: nmueller(a)g.risd.edu Thank you for your time, Nate

1 0

Advanced Config Question-
by Dave Fazio 01 Oct '09

01 Oct '09

Group, Need help confirming Stunnel can be configured the following way: I have a server that has 5 local IPs, mapping to 5 public IPs on the outside. For example purposes, my local IPs are "A", "B", "C", "D", and "E"... If I connect to a stunnel port configured to "C", will Stunnel route the request outbound on "C" or will it use "A" outbound? The way I have it configured, it's using "A" apparently, no matter what local stunnel IP I bind my connection to. And help will be greatly appreciated. - Dave Windows Server 2003 64-bit Stunnel as a Service Example Config: [Connection-A] accept = 10.5.12.57:9000 connect = outbound.example.server:145 TIMEOUTidle = 4 [Connection-B] accept = 10.5.12.58:9005 connect = outbound.example.server:145 TIMEOUTidle = 4

2 2

SMTP AUTH with stunnel?
by conover＠rahul.net 30 Sep '09

30 Sep '09

Can stunnel be used for a local smtp server, that does not support upstream SMTP AUTH, to connect to an smtp server that requires it? Thanks, John -- John Conover, conover(a)rahul.net, http://www.johncon.com/

2 1

Problems implementing certificate
by Marcelo Iturbe 15 Sep '09

15 Sep '09

Hello, I am using Stunnel 4.27 binary version on Windows 2003 server. In the stunnel.pam file I did the following: In the -----BEGIN RSA PRIVATE KEY----- section, I placed the same text that appeared in the -----BEGIN NEW CERTIFICATE REQUEST----- when I purchased the certificate In the -----BEGIN CERTIFICATE----- section I placed what verisign returned to me. When I try to load Stunnel I get the following error messages: : RAND_status claims sufficient entropy for the PRNG : PRNG seeded successfully : SSL context initialized for service gmail-pop3s : Certificate: stunnel.pem : Error reading certificate file: stunnel.pem : error stack: 140DC009 : error:140DC009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib : error stack: 906700D : error:0906700D:PEM routines:PEM_ASN1_read_bio:ASN1 lib : error stack: D08303A : error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error : error stack: D07803A : error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error : SSL_CTX_use_certificate_chain_file: D0680A8: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag : Server is down Any thoughts as to where I went wrong? Thanks for your help

1 0

Re: [stunnel-users] Stunnel Certificate generation
by Alaric Dailey 10 Sep '09

10 Sep '09

You can modify your stunnel.conf, there are lots of examples on the web to do that. Please don't use self-signed certs, you will have no end of issues, and there is NO reason to. StartCom offers free certificates, is in most browsers now, and will be included in IE by the end of September. http://blog.startcom.org/?p=205 So why would you create the headaches of using self-signed certs? Original Message ----------------------- Hi, I would like to know whether it is possible to automate the process of generating stunnel.pem. During the make install we get questions like: Generating a 1024 bit RSA private key ..................++++++ .........++++++ writing new private key to 'stunnel.pem' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [PL]: How Can i automate it or avoid these questions so that i don't have to provide any input during make install. Please help me if you can. Iam using Tru64 platform. Thanks & Regards, Matty _______________________________________________ stunnel-users mailing list stunnel-users(a)mirt.net http://stunnel.mirt.net/mailman/listinfo/stunnel-users

2 1

Stunnel Certificate generation
by Matty Ronald 09 Sep '09

09 Sep '09

Hi, I would like to know whether it is possible to automate the process of generating stunnel.pem. During the make install we get questions like: Generating a 1024 bit RSA private key ..................++++++ .........++++++ writing new private key to 'stunnel.pem' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [PL]: How Can i automate it or avoid these questions so that i don't have to provide any input during make install. Please help me if you can. Iam using Tru64 platform. Thanks & Regards, Matty

1 0

using stunnel in HP UX 11i v3
by Mostafa Arab 09 Sep '09

09 Sep '09

Hi Sorry for my question because it is too elementary but I need some help. I want to use stunnel for one of our projects on an HP Itanium server that have HP UX 11i v3 This is result for #uname –a command : HP-UX xxxxx B.11.31 U ia64 2210092972 unlimited-user license I want to start stunnel as client . I found an stunnel in ‘/opt/hpws/apache’ folder. 1- May I use this stunnel for my project? 2- If it is possible how I can start it ? I added one line to /etc/services and tried to start : stunnel –d …. (according to a document) .But it seems that this version don’t support this option. Best Regards, Mostafa

2 1

Maximum number of services
by Malenfant, Andre 04 Sep '09

04 Sep '09

Hi, we have ran into a problem and we have identified that we have reached the limit of 64 services in stunnel. I have seen some info on the net for a possibility or increasing that limit to 256 using the poll() method. There is a patch available for that but for an older version of stunnel. Is there a configuration that I can do to enable that on version 4.20? If not, what are my other options? Set-up a second stunnel? Thanks André

1 0

Re: [stunnel-users] Random Client Ports
by Ludolf Holzheid 02 Sep '09

02 Sep '09

On Wed, 2009-09-02 16:22:35 +0200, Reinier van der Gugten wrote: > I included STunnel in a VB application, and want to start it using the shell command (how else?) > If I start STunnel from the commandline (dos box) it works fine (stunnel\stunnel.exe) > However from within code I get an error: > > Dim MyProcID As Integer = 0 > MyProcID = Shell("Stunnel\STunnel") > stunnel.conf: No such file or directory (2) Reinier, This says, stunnel is found and started by the system, but stunnel does not find stunnel.conf. Maybe it doesn't correctly determine it's own location in relation to the working directory. You might try to specify stunnel.conf on the command line, e.g. MyProcID = Shell("stunnel\stunnel stunnel\stunnel.conf") or MyProcID = Shell("stunnel\stunnel .\stunnel.conf") or something along those lines. Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Random Client Ports
by Matt Keoppel 02 Sep '09

02 Sep '09

We are currently trying to add Stunnel to our application. Each time one of our clients try to connect to the server it seems to make its call from a random port. We have set up the server config file to be: [OurApp] accept = 15366 connect = 15365 The config file on our client is set up as: client = yes [OurApp] accept = 1308 connect = [serverIp]:15366 The problem that we are having is that the source port on our client changes every time we try to send data from our client to our server. So one time we send data the port will be 1308 and the next time will be 1309. We also tried to set up multiple configurations that were configure to accept on many ports and all connecting to [serverIP]:15366. Is there any way to get Stunnel working with our dynamic client port? Thanks, MK

4 3

Help compiling - rpath issues
by Jay Martel 18 Aug '09

18 Aug '09

Hello, I am trying to avoid LD_LIBRARY_PATH and thus want to compile in the run time library path. I have tried various options to configure, hacking the LDFLAGS and CC lines in the Makefile, changing libtool varialbes, etc. but my resulting binary never has the library path inside. Things I have tried: LDFLAGS=-R/app/versions/local/3/lib LDFLAGS=-L/app/versions/local/3/lib LDFLAGS=-Wl,--rpath -Wl,/app/versions/local/3/lib libtool variables that seem related but I cannot figure out: hardcode_minus_L=yes hardcode_libdir_flag_spec="\${wl}--rpath \${wl}\$libdir" I am using stunnel-4.27 and the configure and libtool it contains. Here is the output of gcc -v: Reading specs from /app/versions/local/3/lib/gcc/i386-pc-solaris2.10/3.4.5/specs Configured with: /opt/autobuild/workdir/gcc-3.4.5/configure --prefix=/app/versions/devtools/3 --with-gnu-ld --with-ld=/app/versions/devtools/3/bin/ld --with-gnu-as --with-as=/app/versions/devtools/3/bin/as --libdir=/app/versions/local/3/lib --with-local-prefix=/app/versions/local/3 --with-gxx-include-dir=/app/versions/local/3/include/c++ --enable-languages=c,c++,objc Thread model: posix gcc version 3.4.5 I am having the same issue with Solaris 10 on i86pc and sparc architectures. Here is the last bit of my make output: /bin/bash ../libtool --tag=CC --mode=link gcc -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/app/versions/local/3/include -o stunnel file.o client.o log.o options.o protocol.o network.o resolver.o ssl.o ctx.o verify.o sthreads.o stunnel.o pty.o libwrap.o -lz -ldl -lsocket -lnsl -lpthread -L/app/versions/local/3/lib -lssl -lcrypto gcc -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/app/versions/local/3/include -o stunnel file.o client.o log.o options.o protocol.o network.o resolver.o ssl.o ctx.o verify.o sthreads.o stunnel.o pty.o libwrap.o -lz -ldl -lsocket -lnsl -lpthread -L/app/versions/local/3/lib -lssl -lcrypto The libtool line should show my rpath setting, I think. How do I get libtool to honor the rpath settings? Should I be asking the libtool maintainers? I check the resulting binary using "strings stunnel | grep app" and my library directory never shows up. Many thanks in advance. -Jay Martel _________________________________________________________________ Windows Live: Make it easier for your friends to see what you’re up to on Facebook. http://windowslive.com/Campaign/SocialNetworking?ocid=PID23285::T:WLMTAGL:O…

1 0

Re: [stunnel-users] Stunnel configure error
by hdf sdesdh 12 Aug '09

12 Aug '09

Having configured with --enable-static, I thought it would be ok. I tried your suggestion though I got the same error. Here is the complete output. Just a note, I am using the source code tree for TomatoVPN, since it comes with the toolchain to compile everything with. LDFLAGS=-static ./configure2 --host=mipsel-linux --with-ssl=/tmp --enable-static --enable-dh configure2: WARNING: If you wanted to set the --build type, don't use --host. If a cross compiler is detected then cross compile mode will be used. configure2: **************************************** initialization checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking for gawk... no checking for mawk... mawk checking whether make sets $(MAKE)... yes checking for mipsel-linux-strip... mipsel-linux-strip checking build system type... i686-pc-linux-gnu checking host system type... mipsel-unknown-linux-gnu checking for mipsel-linux-gcc... mipsel-linux-gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... yes checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether mipsel-linux-gcc accepts -g... yes checking for mipsel-linux-gcc option to accept ISO C89... none needed checking for style of include used by make... GNU checking dependency style of mipsel-linux-gcc... gcc3 checking for a BSD-compatible install... /usr/bin/install -c checking whether make sets $(MAKE)... (cached) yes configure2: **************************************** libtool checking for a sed that does not truncate output... /bin/sed checking for grep that handles long lines and -e... /bin/grep checking for egrep... /bin/grep -E checking for ld used by mipsel-linux-gcc... /opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld checking if the linker (/opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld) is GNU ld... yes checking for /opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld option to reload object files... -r checking for BSD-compatible nm... /opt/brcm/hndtools-mipsel-linux/bin/mipsel-linux-nm -B checking whether ln -s works... yes checking how to recognize dependent libraries... pass_all checking how to run the C preprocessor... mipsel-linux-gcc -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking dlfcn.h usability... yes checking dlfcn.h presence... yes checking for dlfcn.h... yes checking for mipsel-linux-g++... mipsel-linux-g++ checking whether we are using the GNU C++ compiler... yes checking whether mipsel-linux-g++ accepts -g... yes checking dependency style of mipsel-linux-g++... gcc3 checking how to run the C++ preprocessor... mipsel-linux-g++ -E checking for mipsel-linux-g77... no checking for mipsel-linux-xlf... no checking for mipsel-linux-f77... no checking for mipsel-linux-frt... no checking for mipsel-linux-pgf77... no checking for mipsel-linux-cf77... no checking for mipsel-linux-fort77... no checking for mipsel-linux-fl32... no checking for mipsel-linux-af77... no checking for mipsel-linux-xlf90... no checking for mipsel-linux-f90... no checking for mipsel-linux-pgf90... no checking for mipsel-linux-pghpf... no checking for mipsel-linux-epcf90... no checking for mipsel-linux-gfortran... no checking for mipsel-linux-g95... no checking for mipsel-linux-xlf95... no checking for mipsel-linux-f95... no checking for mipsel-linux-fort... no checking for mipsel-linux-ifort... no checking for mipsel-linux-ifc... no checking for mipsel-linux-efc... no checking for mipsel-linux-pgf95... no checking for mipsel-linux-lf95... no checking for mipsel-linux-ftn... no checking for g77... no checking for xlf... no checking for f77... no checking for frt... no checking for pgf77... no checking for cf77... no checking for fort77... no checking for fl32... no checking for af77... no checking for xlf90... no checking for f90... no checking for pgf90... no checking for pghpf... no checking for epcf90... no checking for gfortran... no checking for g95... no checking for xlf95... no checking for f95... no checking for fort... no checking for ifort... no checking for ifc... no checking for efc... no checking for pgf95... no checking for lf95... no checking for ftn... no checking whether we are using the GNU Fortran 77 compiler... no checking whether accepts -g... no checking the maximum length of command line arguments... 1572864 checking command to parse /opt/brcm/hndtools-mipsel-linux/bin/mipsel-linux-nm -B output from mipsel-linux-gcc object... ok checking for objdir... .libs checking for mipsel-linux-ar... mipsel-linux-ar checking for mipsel-linux-ranlib... mipsel-linux-ranlib checking for mipsel-linux-strip... (cached) mipsel-linux-strip checking if mipsel-linux-gcc supports -fno-rtti -fno-exceptions... yes checking for mipsel-linux-gcc option to produce PIC... -fPIC checking if mipsel-linux-gcc PIC flag -fPIC works... yes checking if mipsel-linux-gcc static flag -static works... yes checking if mipsel-linux-gcc supports -c -o file.o... yes checking whether the mipsel-linux-gcc linker (/opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld) supports shared libraries... yes checking whether -lc should be explicitly linked in... no checking dynamic linker characteristics... GNU/Linux ld.so checking how to hardcode library paths into programs... immediate checking whether stripping libraries is possible... yes checking if libtool supports shared libraries... yes checking whether to build shared libraries... yes checking whether to build static libraries... yes configure2: creating libtool appending configuration tag "CXX" to libtool checking for ld used by mipsel-linux-g++... /opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld checking if the linker (/opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld) is GNU ld... yes checking whether the mipsel-linux-g++ linker (/opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld) supports shared libraries... yes checking for mipsel-linux-g++ option to produce PIC... -fPIC checking if mipsel-linux-g++ PIC flag -fPIC works... yes checking if mipsel-linux-g++ static flag -static works... yes checking if mipsel-linux-g++ supports -c -o file.o... yes checking whether the mipsel-linux-g++ linker (/opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld) supports shared libraries... yes checking dynamic linker characteristics... GNU/Linux ld.so (cached) (cached) checking how to hardcode library paths into programs... immediate appending configuration tag "F77" to libtool configure2: **************************************** types checking for unsigned char... yes checking size of unsigned char... 1 checking for unsigned short... yes checking size of unsigned short... 2 checking for unsigned int... yes checking size of unsigned int... 4 checking for unsigned long... yes checking size of unsigned long... 4 checking for socklen_t... yes configure2: **************************************** PTY device files checking for "/dev/ptmx"... (cached) yes checking for "/dev/ptc"... no configure2: **************************************** entropy checking for "/dev/urandom"... yes configure2: **************************************** default group checking for default group... nogroup configure2: **************************************** header files checking ucontext.h usability... yes checking ucontext.h presence... yes checking for ucontext.h... yes checking pthread.h usability... yes checking pthread.h presence... yes checking for pthread.h... yes checking sys/select.h usability... yes checking sys/select.h presence... yes checking for sys/select.h... yes checking poll.h usability... yes checking poll.h presence... yes checking for poll.h... yes checking sys/poll.h usability... yes checking sys/poll.h presence... yes checking for sys/poll.h... yes checking tcpd.h usability... no checking tcpd.h presence... no checking for tcpd.h... no checking sys/ioctl.h usability... yes checking sys/ioctl.h presence... yes checking for sys/ioctl.h... yes checking sys/filio.h usability... no checking sys/filio.h presence... no checking for sys/filio.h... no checking stropts.h usability... yes checking stropts.h presence... yes checking for stropts.h... yes checking grp.h usability... yes checking grp.h presence... yes checking for grp.h... yes checking for unistd.h... (cached) yes checking util.h usability... no checking util.h presence... no checking for util.h... no checking libutil.h usability... no checking libutil.h presence... no checking for libutil.h... no checking sys/resource.h usability... yes checking sys/resource.h presence... yes checking for sys/resource.h... yes checking pty.h usability... yes checking pty.h presence... yes checking for pty.h... yes checking sys/socket.h usability... yes checking sys/socket.h presence... yes checking for sys/socket.h... yes checking for struct msghdr.msg_control... yes configure2: **************************************** libraries checking for library containing gethostbyname... none required checking for library containing yp_get_default_domain... -lnsl checking for socket in -lsocket... no checking for openpty in -lutil... yes checking for dlopen in -ldl... yes checking for shl_load in -ldld... no checking for inflateEnd in -lz... no configure2: **************************************** thread model checking for pthread_create in -lc_r... no checking for pthread_create in -lpthread... yes configure2: PTHREAD thread model detected configure2: **************************************** library functions checking for snprintf... yes checking for vsnprintf... yes checking for openpty... yes checking for _getpty... no checking for daemon... yes checking for waitpid... yes checking for wait4... yes checking for setsid... yes checking for setgroups... yes checking for chroot... yes checking for sysconf... yes checking for getrlimit... yes checking for pthread_sigmask... yes checking for localtime_r... yes checking for getcontext... no checking for __makecontext_v2... no checking for poll... yes checking for endhostent... yes checking for getnameinfo... yes checking for getaddrinfo... yes checking for broken poll() implementation... no configure2: **************************************** SSL checking for SSL directory... /tmp checking for obsolete RSAref library... no checking /tmp/include/openssl/engine.h usability... yes checking /tmp/include/openssl/engine.h presence... no configure2: WARNING: /tmp/include/openssl/engine.h: accepted by the compiler, rejected by the preprocessor! configure2: WARNING: /tmp/include/openssl/engine.h: proceeding with the compiler's result checking for /tmp/include/openssl/engine.h... yes configure2: **************************************** optional features checking whether to disable RSA support... no checking whether to enable DH support... yes checking whether to enable IPv6 support... yes checking whether to disable TCP wrappers library support... autodetecting checking for hosts_access in -lwrap... no checking whether to enable FIPS mode support... autodetecting checking for FIPS_mode_set... no configure2: **************************************** write the results configure2: creating ./config.status config.status: creating Makefile config.status: creating src/Makefile config.status: creating src/stunnel3 config.status: creating doc/Makefile config.status: creating tools/Makefile config.status: creating tools/stunnel.conf-sample config.status: creating tools/stunnel.init config.status: executing depfiles commands configure2: **************************************** success # make Making all in src make[1]: Entering directory `/root/tomato/release/src/router/stunnel/src' if /bin/bash ../libtool --tag=CC --mode=compile mipsel-linux-gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.27\" -DPACKAGE_STRING=\"stunnel\ 4.27\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.27\" -DHOST=\"mipsel-unknown-linux-gnu\" -DCPU_MIPSEL=1 -DVENDOR_UNKNOWN=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/tmp\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_DH=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -MT env.lo -MD -MP -MF ".deps/env.Tpo" -c -o env.lo env.c; \ then mv -f ".deps/env.Tpo" ".deps/env.Plo"; else rm -f ".deps/env.Tpo"; exit 1; fi mkdir .libs mipsel-linux-gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.27\" "-DPACKAGE_STRING=\"stunnel 4.27\"" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.27\" -DHOST=\"mipsel-unknown-linux-gnu\" -DCPU_MIPSEL=1 -DVENDOR_UNKNOWN=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/tmp\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_DH=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR=\"/usr/local/lib/stunnel\" -DCONFDIR=\"/usr/local/etc/stunnel\" -DPIDFILE=\"/usr/local/var/run/stunnel/stunnel.pid\" -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -MT env.lo -MD -MP -MF .deps/env.Tpo -c env.c -fPIC -DPIC -o .libs/env.o mipsel-linux-gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.27\" "-DPACKAGE_STRING=\"stunnel 4.27\"" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.27\" -DHOST=\"mipsel-unknown-linux-gnu\" -DCPU_MIPSEL=1 -DVENDOR_UNKNOWN=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/tmp\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_DH=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR=\"/usr/local/lib/stunnel\" -DCONFDIR=\"/usr/local/etc/stunnel\" -DPIDFILE=\"/usr/local/var/run/stunnel/stunnel.pid\" -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -MT env.lo -MD -MP -MF .deps/env.Tpo -c env.c -o env.o >/dev/null 2>&1 /bin/bash ../libtool --tag=CC --mode=link mipsel-linux-gcc -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -static -o libstunnel.la -rpath /usr/local/lib/stunnel -avoid-version env.lo -ldl -lutil -lnsl -lpthread -L/tmp/lib -lssl -lcrypto mipsel-linux-ar cru .libs/libstunnel.a env.o mipsel-linux-ranlib .libs/libstunnel.a creating libstunnel.la (cd .libs && rm -f libstunnel.la && ln -s ../libstunnel.la libstunnel.la) if mipsel-linux-gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.27\" -DPACKAGE_STRING=\"stunnel\ 4.27\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.27\" -DHOST=\"mipsel-unknown-linux-gnu\" -DCPU_MIPSEL=1 -DVENDOR_UNKNOWN=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/tmp\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_DH=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -MT file.o -MD -MP -MF ".deps/file.Tpo" -c -o file.o file.c; \ then mv -f ".deps/file.Tpo" ".deps/file.Po"; else rm -f ".deps/file.Tpo"; exit 1; fi if mipsel-linux-gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.27\" -DPACKAGE_STRING=\"stunnel\ 4.27\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.27\" -DHOST=\"mipsel-unknown-linux-gnu\" -DCPU_MIPSEL=1 -DVENDOR_UNKNOWN=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/tmp\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_DH=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -MT client.o -MD -MP -MF ".deps/client.Tpo" -c -o client.o client.c; \ then mv -f ".deps/client.Tpo" ".deps/client.Po"; else rm -f ".deps/client.Tpo"; exit 1; fi if mipsel-linux-gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.27\" -DPACKAGE_STRING=\"stunnel\ 4.27\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.27\" -DHOST=\"mipsel-unknown-linux-gnu\" -DCPU_MIPSEL=1 -DVENDOR_UNKNOWN=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/tmp\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_DH=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -MT log.o -MD -MP -MF ".deps/log.Tpo" -c -o log.o log.c; \ then mv -f ".deps/log.Tpo" ".deps/log.Po"; else rm -f ".deps/log.Tpo"; exit 1; fi if mipsel-linux-gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.27\" -DPACKAGE_STRING=\"stunnel\ 4.27\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.27\" -DHOST=\"mipsel-unknown-linux-gnu\" -DCPU_MIPSEL=1 -DVENDOR_UNKNOWN=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/tmp\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_DH=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -MT options.o -MD -MP -MF ".deps/options.Tpo" -c -o options.o options.c; \ then mv -f ".deps/options.Tpo" ".deps/options.Po"; else rm -f ".deps/options.Tpo"; exit 1; fi if mipsel-linux-gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.27\" -DPACKAGE_STRING=\"stunnel\ 4.27\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.27\" -DHOST=\"mipsel-unknown-linux-gnu\" -DCPU_MIPSEL=1 -DVENDOR_UNKNOWN=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/tmp\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_DH=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -MT protocol.o -MD -MP -MF ".deps/protocol.Tpo" -c -o protocol.o protocol.c; \ then mv -f ".deps/protocol.Tpo" ".deps/protocol.Po"; else rm -f ".deps/protocol.Tpo"; exit 1; fi if mipsel-linux-gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.27\" -DPACKAGE_STRING=\"stunnel\ 4.27\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.27\" -DHOST=\"mipsel-unknown-linux-gnu\" -DCPU_MIPSEL=1 -DVENDOR_UNKNOWN=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/tmp\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_DH=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -MT network.o -MD -MP -MF ".deps/network.Tpo" -c -o network.o network.c; \ then mv -f ".deps/network.Tpo" ".deps/network.Po"; else rm -f ".deps/network.Tpo"; exit 1; fi if mipsel-linux-gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.27\" -DPACKAGE_STRING=\"stunnel\ 4.27\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.27\" -DHOST=\"mipsel-unknown-linux-gnu\" -DCPU_MIPSEL=1 -DVENDOR_UNKNOWN=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/tmp\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_DH=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -MT resolver.o -MD -MP -MF ".deps/resolver.Tpo" -c -o resolver.o resolver.c; \ then mv -f ".deps/resolver.Tpo" ".deps/resolver.Po"; else rm -f ".deps/resolver.Tpo"; exit 1; fi if mipsel-linux-gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.27\" -DPACKAGE_STRING=\"stunnel\ 4.27\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.27\" -DHOST=\"mipsel-unknown-linux-gnu\" -DCPU_MIPSEL=1 -DVENDOR_UNKNOWN=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/tmp\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_DH=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -MT ssl.o -MD -MP -MF ".deps/ssl.Tpo" -c -o ssl.o ssl.c; \ then mv -f ".deps/ssl.Tpo" ".deps/ssl.Po"; else rm -f ".deps/ssl.Tpo"; exit 1; fi if mipsel-linux-gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.27\" -DPACKAGE_STRING=\"stunnel\ 4.27\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.27\" -DHOST=\"mipsel-unknown-linux-gnu\" -DCPU_MIPSEL=1 -DVENDOR_UNKNOWN=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/tmp\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_DH=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -MT ctx.o -MD -MP -MF ".deps/ctx.Tpo" -c -o ctx.o ctx.c; \ then mv -f ".deps/ctx.Tpo" ".deps/ctx.Po"; else rm -f ".deps/ctx.Tpo"; exit 1; fi if mipsel-linux-gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.27\" -DPACKAGE_STRING=\"stunnel\ 4.27\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.27\" -DHOST=\"mipsel-unknown-linux-gnu\" -DCPU_MIPSEL=1 -DVENDOR_UNKNOWN=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/tmp\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_DH=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -MT verify.o -MD -MP -MF ".deps/verify.Tpo" -c -o verify.o verify.c; \ then mv -f ".deps/verify.Tpo" ".deps/verify.Po"; else rm -f ".deps/verify.Tpo"; exit 1; fi if mipsel-linux-gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.27\" -DPACKAGE_STRING=\"stunnel\ 4.27\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.27\" -DHOST=\"mipsel-unknown-linux-gnu\" -DCPU_MIPSEL=1 -DVENDOR_UNKNOWN=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/tmp\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_DH=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -MT sthreads.o -MD -MP -MF ".deps/sthreads.Tpo" -c -o sthreads.o sthreads.c; \ then mv -f ".deps/sthreads.Tpo" ".deps/sthreads.Po"; else rm -f ".deps/sthreads.Tpo"; exit 1; fi if mipsel-linux-gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.27\" -DPACKAGE_STRING=\"stunnel\ 4.27\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.27\" -DHOST=\"mipsel-unknown-linux-gnu\" -DCPU_MIPSEL=1 -DVENDOR_UNKNOWN=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/tmp\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_DH=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -MT stunnel.o -MD -MP -MF ".deps/stunnel.Tpo" -c -o stunnel.o stunnel.c; \ then mv -f ".deps/stunnel.Tpo" ".deps/stunnel.Po"; else rm -f ".deps/stunnel.Tpo"; exit 1; fi if mipsel-linux-gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.27\" -DPACKAGE_STRING=\"stunnel\ 4.27\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.27\" -DHOST=\"mipsel-unknown-linux-gnu\" -DCPU_MIPSEL=1 -DVENDOR_UNKNOWN=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/tmp\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_DH=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -MT pty.o -MD -MP -MF ".deps/pty.Tpo" -c -o pty.o pty.c; \ then mv -f ".deps/pty.Tpo" ".deps/pty.Po"; else rm -f ".deps/pty.Tpo"; exit 1; fi if mipsel-linux-gcc -DPACKAGE_NAME=\"stunnel\" -DPACKAGE_TARNAME=\"stunnel\" -DPACKAGE_VERSION=\"4.27\" -DPACKAGE_STRING=\"stunnel\ 4.27\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE=\"stunnel\" -DVERSION=\"4.27\" -DHOST=\"mipsel-unknown-linux-gnu\" -DCPU_MIPSEL=1 -DVENDOR_UNKNOWN=1 -DOS_LINUX_GNU=1 -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DHAVE_DLFCN_H=1 -DSIZEOF_UNSIGNED_CHAR=1 -DSIZEOF_UNSIGNED_SHORT=2 -DSIZEOF_UNSIGNED_INT=4 -DSIZEOF_UNSIGNED_LONG=4 -DHAVE_DEV_PTMX=1 -DRANDOM_FILE=\"/dev/urandom\" -DHAVE_UCONTEXT_H=1 -DHAVE_PTHREAD_H=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_POLL_H=1 -DHAVE_SYS_POLL_H=1 -DHAVE_SYS_IOCTL_H=1 -DHAVE_STROPTS_H=1 -DHAVE_GRP_H=1 -DHAVE_UNISTD_H=1 -DHAVE_SYS_RESOURCE_H=1 -DHAVE_PTY_H=1 -DHAVE_SYS_SOCKET_H=1 -DHAVE_STRUCT_MSGHDR_MSG_CONTROL=1 -DHAVE_MSGHDR_MSG_CONTROL=1 -DHAVE_LIBUTIL=1 -DHAVE_LIBDL=1 -DHAVE_LIBPTHREAD=1 -DUSE_PTHREAD=1 -DHAVE_SNPRINTF=1 -DHAVE_VSNPRINTF=1 -DHAVE_OPENPTY=1 -DHAVE_DAEMON=1 -DHAVE_WAITPID=1 -DHAVE_WAIT4=1 -DHAVE_SETSID=1 -DHAVE_SETGROUPS=1 -DHAVE_CHROOT=1 -DHAVE_SYSCONF=1 -DHAVE_GETRLIMIT=1 -DHAVE_PTHREAD_SIGMASK=1 -DHAVE_LOCALTIME_R=1 -DHAVE_POLL=1 -DHAVE_ENDHOSTENT=1 -DHAVE_GETNAMEINFO=1 -DHAVE_GETADDRINFO=1 -DHAVE_OPENSSL=1 -Dssldir=\"/tmp\" -DHAVE_OSSL_ENGINE_H=1 -DUSE_DH=1 -DUSE_IPv6=1 -I. -I. -I/usr/kerberos/include -DLIBDIR='"/usr/local/lib/stunnel"' -DCONFDIR='"/usr/local/etc/stunnel"' -DPIDFILE='"/usr/local/var/run/stunnel/stunnel.pid"' -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -MT libwrap.o -MD -MP -MF ".deps/libwrap.Tpo" -c -o libwrap.o libwrap.c; \ then mv -f ".deps/libwrap.Tpo" ".deps/libwrap.Po"; else rm -f ".deps/libwrap.Tpo"; exit 1; fi /bin/bash ../libtool --tag=CC --mode=link mipsel-linux-gcc -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -static -o stunnel file.o client.o log.o options.o protocol.o network.o resolver.o ssl.o ctx.o verify.o sthreads.o stunnel.o pty.o libwrap.o -ldl -lutil -lnsl -lpthread -L/tmp/lib -lssl -lcrypto mipsel-linux-gcc -g -O2 -Wall -Wshadow -Wcast-align -Wpointer-arith -I/tmp/include -o stunnel file.o client.o log.o options.o protocol.o network.o resolver.o ssl.o ctx.o verify.o sthreads.o stunnel.o pty.o libwrap.o -ldl -lutil -lnsl -lpthread -L/tmp/lib -lssl -lcrypto make[1]: Leaving directory `/root/tomato/release/src/router/stunnel/src' Making all in doc make[1]: Entering directory `/root/tomato/release/src/router/stunnel/doc' make[1]: Nothing to be done for `all'. make[1]: Leaving directory `/root/tomato/release/src/router/stunnel/doc' Making all in tools make[1]: Entering directory `/root/tomato/release/src/router/stunnel/tools' make[1]: Nothing to be done for `all'. make[1]: Leaving directory `/root/tomato/release/src/router/stunnel/tools' make[1]: Entering directory `/root/tomato/release/src/router/stunnel' make[1]: Nothing to be done for `all-am'. make[1]: Leaving directory `/root/tomato/release/src/router/stunnel' # After downloading it, to my router # ./stunnel > -sh: ./stunnel: not found I tried uploading the openssl version I compiled for stunnel (v 1.0.0-stable-SNAP-20090809, which I also compiled for the router, and is functioning mostly) as well, and got the same error. If you have any other suggestions, I'm open to them, otherwise, I think I'm going to have to retire this project for now. Thank you -- Be Yourself @ mail.com! Choose From 200+ Email Addresses Get a Free Account at www.mail.com!

1 0

Re: [stunnel-users] Stunnel configure error
by hdf sdesdh 12 Aug '09

12 Aug '09

Thanks for the suggestion, I was able to make the necessary changes and pass the configure and make process. Unfortunately, after uploading and running the app, the app will not run: # ls -al /tmp -rwxrwxrwx 1 root root 2434012 Aug 12 01:44 stunnel -rw-r--r-- 1 root root 1148 Aug 12 01:37 stunnel.conf -rw-r--r-- 1 root root 1977 Aug 12 01:44 stunnel.pem drwxr-xr-x 1 root root 0 Dec 31 1969 var # cd /tmp # ./stunnel -sh: ./stunnel: not found The file is obviously there, with execute permissions. What is failing?? Thank you > checking for "/dev/ptmx"... configure: error: cannot check for file > existence when cross compiling. > > Give me your suggestions. Check that /dev/ptmx exists on your router; it does on my Buffalo router with Tomato. If it does, then hack the configure script to force the test to return true. A search in the script for ptmx should take you right to the test. Good luck, Andrew. -- Be Yourself @ mail.com! Choose From 200+ Email Addresses Get a Free Account at www.mail.com!

2 1

Stunnel configure error
by hdf sdesdh 12 Aug '09

12 Aug '09

I have been receiving errors when configuring Stunnel, which I intend to cross compile for use with my Linksys WRT54GL router (Tomato firmware). When passing ./configure --host=mipsel-linux --with-ssl=/root/openssl --enable-static --enable-dh --libexecdir=/tmp the configure process stops with an error. Here is the complete output. ./configure --host=mipsel-linux --with-ssl=/root/openssl --enable-static --enable-dh --libexecdir=/tmp configure: WARNING: If you wanted to set the --build type, don't use --host. If a cross compiler is detected then cross compile mode will be used. configure: **************************************** initialization checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking for gawk... no checking for mawk... mawk checking whether make sets $(MAKE)... yes checking for mipsel-linux-strip... mipsel-linux-strip checking build system type... i686-pc-linux-gnu checking host system type... mipsel-unknown-linux-gnu checking for mipsel-linux-gcc... mipsel-linux-gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... yes checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether mipsel-linux-gcc accepts -g... yes checking for mipsel-linux-gcc option to accept ISO C89... none needed checking for style of include used by make... GNU checking dependency style of mipsel-linux-gcc... gcc3 checking for a BSD-compatible install... /usr/bin/install -c checking whether make sets $(MAKE)... (cached) yes configure: **************************************** libtool checking for a sed that does not truncate output... /bin/sed checking for grep that handles long lines and -e... /bin/grep checking for egrep... /bin/grep -E checking for ld used by mipsel-linux-gcc... /opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld checking if the linker (/opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld) is GNU ld... yes checking for /opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld option to reload object files... -r checking for BSD-compatible nm... /opt/brcm/hndtools-mipsel-linux/bin/mipsel-linux-nm -B checking whether ln -s works... yes checking how to recognize dependent libraries... pass_all checking how to run the C preprocessor... mipsel-linux-gcc -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking dlfcn.h usability... yes checking dlfcn.h presence... yes checking for dlfcn.h... yes checking for mipsel-linux-g++... mipsel-linux-g++ checking whether we are using the GNU C++ compiler... yes checking whether mipsel-linux-g++ accepts -g... yes checking dependency style of mipsel-linux-g++... gcc3 checking how to run the C++ preprocessor... mipsel-linux-g++ -E checking for mipsel-linux-g77... no checking for mipsel-linux-xlf... no checking for mipsel-linux-f77... no checking for mipsel-linux-frt... no checking for mipsel-linux-pgf77... no checking for mipsel-linux-cf77... no checking for mipsel-linux-fort77... no checking for mipsel-linux-fl32... no checking for mipsel-linux-af77... no checking for mipsel-linux-xlf90... no checking for mipsel-linux-f90... no checking for mipsel-linux-pgf90... no checking for mipsel-linux-pghpf... no checking for mipsel-linux-epcf90... no checking for mipsel-linux-gfortran... no checking for mipsel-linux-g95... no checking for mipsel-linux-xlf95... no checking for mipsel-linux-f95... no checking for mipsel-linux-fort... no checking for mipsel-linux-ifort... no checking for mipsel-linux-ifc... no checking for mipsel-linux-efc... no checking for mipsel-linux-pgf95... no checking for mipsel-linux-lf95... no checking for mipsel-linux-ftn... no checking for g77... no checking for xlf... no checking for f77... no checking for frt... no checking for pgf77... no checking for cf77... no checking for fort77... no checking for fl32... no checking for af77... no checking for xlf90... no checking for f90... no checking for pgf90... no checking for pghpf... no checking for epcf90... no checking for gfortran... no checking for g95... no checking for xlf95... no checking for f95... no checking for fort... no checking for ifort... no checking for ifc... no checking for efc... no checking for pgf95... no checking for lf95... no checking for ftn... no checking whether we are using the GNU Fortran 77 compiler... no checking whether accepts -g... no checking the maximum length of command line arguments... 1572864 checking command to parse /opt/brcm/hndtools-mipsel-linux/bin/mipsel-linux-nm -B output from mipsel-linux-gcc object... ok checking for objdir... .libs checking for mipsel-linux-ar... mipsel-linux-ar checking for mipsel-linux-ranlib... mipsel-linux-ranlib checking for mipsel-linux-strip... (cached) mipsel-linux-strip checking if mipsel-linux-gcc supports -fno-rtti -fno-exceptions... yes checking for mipsel-linux-gcc option to produce PIC... -fPIC checking if mipsel-linux-gcc PIC flag -fPIC works... yes checking if mipsel-linux-gcc static flag -static works... yes checking if mipsel-linux-gcc supports -c -o file.o... yes checking whether the mipsel-linux-gcc linker (/opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld) supports shared libraries... yes checking whether -lc should be explicitly linked in... no checking dynamic linker characteristics... GNU/Linux ld.so checking how to hardcode library paths into programs... immediate checking whether stripping libraries is possible... yes checking if libtool supports shared libraries... yes checking whether to build shared libraries... yes checking whether to build static libraries... yes configure: creating libtool appending configuration tag "CXX" to libtool checking for ld used by mipsel-linux-g++... /opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld checking if the linker (/opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld) is GNU ld... yes checking whether the mipsel-linux-g++ linker (/opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld) supports shared libraries... yes checking for mipsel-linux-g++ option to produce PIC... -fPIC checking if mipsel-linux-g++ PIC flag -fPIC works... yes checking if mipsel-linux-g++ static flag -static works... yes checking if mipsel-linux-g++ supports -c -o file.o... yes checking whether the mipsel-linux-g++ linker (/opt/brcm/hndtools-mipsel-linux/mipsel-linux/bin/ld) supports shared libraries... yes checking dynamic linker characteristics... GNU/Linux ld.so (cached) (cached) checking how to hardcode library paths into programs... immediate appending configuration tag "F77" to libtool configure: **************************************** types checking for unsigned char... yes checking size of unsigned char... 1 checking for unsigned short... yes checking size of unsigned short... 2 checking for unsigned int... yes checking size of unsigned int... 4 checking for unsigned long... yes checking size of unsigned long... 4 checking for socklen_t... yes configure: **************************************** PTY device files checking for "/dev/ptmx"... configure: error: cannot check for file existence when cross compiling. Give me your suggestions. Thank you -- Be Yourself @ mail.com! Choose From 200+ Email Addresses Get a Free Account at www.mail.com!

2 1

running more than 1 stunnel as windows service
by Franjo Stipanovic 04 Aug '09

04 Aug '09

Hi guys, is there a way to install multiple stunnel instances as windows service? Where could I change service name? I get error: CreateService : the specified service already exists -- best wishes, Franjo Stipanovic

1 1

stunnel, haproxy and ssl cert
by Maxim 04 Aug '09

04 Aug '09

Hello dear community. I faced some troubles for iphone: I moved separate server from hardware to AWS Cloud with SSL certificate from Register.com. It moved well, and phone application continue work with new server without any problems. Then I installed LoadBalancer (HAProxy and Stunnel) for it and moved certificate with key from configs of Apache to config of stunnel. In PC browser it continue works well, and shows me blue field near the URL as trusted. But on iPhone browser it shows just "Untrusted server certificate". Is there any difference for ssl certificate for stunnel and Apache? I understand that there is very specific question, but would you have any ideas about it? *Config of stunnel:* cert = /usr/local/etc/stunnel/stunnel.pem chroot = /usr/local/var/lib/stunnel/ setuid = nobody setgid = nobody pid = /stunnel.pid socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 debug = 7 output = stunnel.log [https] accept = 443 connect = 80 xforwardedfor=yes TIMEOUTclose = 0 *Patch for stunnel* http://haproxy.1wt.eu/download/patches/stunnel-4.22-xforwarded-for.diff need to make work "xforwardedfor=yes" *# stunnel -version* stunnel 4.22 on i686-pc-linux-gnu with OpenSSL 0.9.8b 04 May 2006 Threading:PTHREAD SSL:ENGINE Sockets:POLL,IPv6 Auth:LIBWRAP Global options debug = 5 pid = /usr/local/var/run/stunnel/stunnel.pid RNDbytes = 64 RNDfile = /dev/urandom RNDoverwrite = yes Service-level options cert = /usr/local/etc/stunnel/stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = /usr/local/etc/stunnel/stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none * # uname -a* Linux domU-12-31-38-00-35-07 2.6.18-xenU-ec2-v1.0 #2 SMP Tue Feb 19 10:51:53 EST 2008 i686 athlon i386 GNU/Linux * # openssl version* OpenSSL 0.9.8b 04 May 2006 *And logs from stunnel when iphone tryed to conenct* 2009.08.04 08:20:16 LOG7[31023:3081598672]: https accepted FD=15 from 24.5.77.143:58019 2009.08.04 08:20:16 LOG7[31023:3081550736]: https started 2009.08.04 08:20:16 LOG7[31023:3081550736]: FD 15 in non-blocking mode 2009.08.04 08:20:16 LOG7[31023:3081550736]: TCP_NODELAY option set on local socket 2009.08.04 08:20:16 LOG7[31023:3081550736]: Waiting for a libwrap process 2009.08.04 08:20:16 LOG7[31023:3081550736]: Acquired libwrap process #0 2009.08.04 08:20:16 LOG7[31023:3081550736]: Releasing libwrap process #0 2009.08.04 08:20:16 LOG7[31023:3081550736]: Released libwrap process #0 2009.08.04 08:20:16 LOG7[31023:3081550736]: https permitted by libwrap from 24.5.77.143:58019 2009.08.04 08:20:16 LOG5[31023:3081550736]: https accepted connection from 24.5.77.143:58019 2009.08.04 08:20:16 LOG7[31023:3081550736]: SSL state (accept): before/accept initialization 2009.08.04 08:20:16 LOG7[31023:3081550736]: SSL state (accept): SSLv3 read client hello A 2009.08.04 08:20:16 LOG7[31023:3081550736]: SSL state (accept): SSLv3 write server hello A 2009.08.04 08:20:16 LOG7[31023:3081550736]: SSL state (accept): SSLv3 write certificate A 2009.08.04 08:20:16 LOG7[31023:3081550736]: SSL state (accept): SSLv3 write server done A 2009.08.04 08:20:16 LOG7[31023:3081550736]: SSL state (accept): SSLv3 flush data 2009.08.04 08:20:16 LOG3[31023:3081550736]: SSL_accept: Peer suddenly disconnected 2009.08.04 08:20:16 LOG5[31023:3081550736]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket 2009.08.04 08:20:16 LOG7[31023:3081550736]: https finished (0 left) Thank you in advance, Max

1 0

write client hello hang/timeout
by . 01 Aug '09

01 Aug '09

stunnel4 config 2009.08.01 05:09:29 LOG7[4856:0]: Snagged 64 random bytes from /home/c7a71k/.rnd 2009.08.01 05:09:29 LOG7[4856:0]: Wrote 1024 new random bytes to /home/c7a71k/.rnd 2009.08.01 05:09:29 LOG7[4856:0]: RAND_status claims sufficient entropy for the PRNG 2009.08.01 05:09:29 LOG7[4856:0]: PRNG seeded successfully 2009.08.01 05:09:29 LOG7[4856:0]: Certificate: /etc/stunnel/stunnel.pem 2009.08.01 05:09:29 LOG7[4856:0]: Certificate loaded 2009.08.01 05:09:29 LOG7[4856:0]: Key file: /etc/stunnel/stunnel.pem 2009.08.01 05:09:29 LOG7[4856:0]: Private key loaded 2009.08.01 05:09:29 LOG7[4856:0]: SSL context initialized for service stunnel 2009.08.01 05:09:29 LOG5[4856:0]: stunnel 4.22 on i686-pc-linux-gnu with OpenSSL 0.9.8g 19 Oct 2007 2009.08.01 05:09:29 LOG5[4856:0]: Threading:FORK SSL:ENGINE Sockets:POLL,IPv6 2009.08.01 05:09:29 LOG7[4856:0]: stunnel started 2009.08.01 05:09:29 LOG7[4856:0]: FD 0 in non-blocking mode 2009.08.01 05:09:29 LOG7[4856:0]: FD 1 in non-blocking mode 2009.08.01 05:09:29 LOG7[4856:0]: FD 4 in non-blocking mode 2009.08.01 05:09:29 LOG7[4856:0]: stunnel connecting 212.93.193.72:443 2009.08.01 05:09:29 LOG7[4856:0]: connect_wait: waiting 10 seconds 2009.08.01 05:09:29 LOG7[4856:0]: connect_wait: connected 2009.08.01 05:09:29 LOG5[4856:0]: stunnel connected remote server from 192.168.2.100:47406 2009.08.01 05:09:29 LOG7[4856:0]: Remote FD=4 initialized 2009.08.01 05:09:29 LOG7[4856:0]: SSL state (connect): before/connect initialization 2009.08.01 05:09:29 LOG7[4856:0]: SSL state (connect): SSLv2 write client hello A # (hangs indefinitely) #here's the config: client = yes foreground = yes debug = 7 cert = /etc/stunnel/stunnel.pem sslVersion = SSLv2 connect = 212.93.193.72:443 execargs = iceweasel # I think I'm supposed to get a "read server hello A" back?... But I get nothing, and iceweasel is *not* launched. # Anyone know how to overcome this?

1 0

[patch] Redirect to a fake destination if client's certificate couldn't be verified
by Jeremie Le Hen 29 Jul '09

29 Jul '09

Hi list, I've written a patch to bring in the following directives: - evilconnect - evilexec/evilexecargs The idea is when stunnel works in server mode and is asked to verify the client's certificate, it normally shuts the connection down when the latter is invalid. With these options, when the certificate can't be verified, stunnel redirects the "evil" connection to another destination. What is the purpose of this new feature ? For instance, if your company does not allow SSH connections out, you may use the following configuation: % connect = yourdomain.com:22 % evilconnect = www.yourdomain.com:80 So you will access your SSH server with your valid user certificate. On the other hand, if an over-zealous sneaky admin looks at the proxy logs and tries to connect to your stunnel, it will be redirected to an uninteresting website ;). Here is the documentation: % evilconnect = [host:]port % connect to a remote host:port when the client's certificate cannot % be verified % % This is only meaningful in server mode when connect and verify are % used. Otherwise it has the same properties as the connect option. % % evilexec = executable_path (Unix only) % execute local inetd-type program when the client's certificate can- % not be verified % % This is only meaningful in server mode when exec and verify are % used. Otherwise it has the same properties as the exec option. % % execargs = $0 $1 $2 ... (Unix only) % arguments for evilexec including program name ($0) % % Quoting is currently not supported. Arguments are separated with % arbitrary number of whitespaces. I'd like to thank Mathieu CHOUQUET-STRINGER who actually had this very good idea and implemented a proof of concept code with GnuTLS. Also, thank to Vin0x64 <vincent vin0x64 fr> who tested this patch and verified that it works. Looking forward for your remarks... thanks! Best regards, -- Jeremie Le Hen < jeremie at le-hen dot org >< ttz at chchile dot org >

1 1

Stunnel listen on different ports
by Noel Sanchez 21 Jul '09

21 Jul '09

I have had a working stunnel conf for much time, very happy with it. [stunnel] accept = 0.0.0.0:30000 connect = 192.168.27.102:8000 I have stunnel listening on port 30000 and then sending to 192.168.27.102 on port 8000. Works good. I now want to add more listening ports to stunnel, like so: [stunnel] accept = 0.0.0.0:30000 connect = 192.168.27.102:8000 accept = 0.0.0.0:30006 connect = 192.168.27.102:8006 When I do this, stunnel only binds to 30006, per my log file: stunnel bound to 0.0.0.0:30006 And when I do a netstat -vatn: tcp 0 0 0.0.0.0:30006 0.0.0.0:* LISTEN It is not listening on port 30000 anymore. I'd like to accepts connections on many different ports, then send accordingly. Can I do this? Why does stunnel only listen to one port when I add more accept lines in its config? Noel

2 2

Re: [stunnel-users] using webdav: YES IT WORKS WITH NET USE
by delaage.pierre＠free.fr 18 Jul '09

18 Jul '09

Well after some more tests I achieve net use to work: UseBasicAuth is VITAL on the xp client (reboot) Accordingly configure apache with basic plain text auth stunnel routing localhost:80 to remote:443 (as you did) to pass your credentials use EXACTLY this command line : net use y: \\localhost\davfolder (with no extra \) YOURPASSWORD /USER:YOURUSERNAME (this in the only way to have hhtp credentials sent to the server). tested on client: xpsp2 + kb892211 + kb911927 (IMPORTANT ALSO, needs reboot) + stunnel 427 and server apache 2.2.6/Mandriva 2008. kb907306 replaces 892211, but I have not tested with it (I think it should work). If you cannot achieve it to work please let me know the exact error message you receive from windows. Again your problem is only related to windows issue, not stunnel. Pierre Quoting Jan-Florian Hilgenberg <florianhilgenberg(a)googlemail.com>: > yes, i am the admin. have pulled it back to basic auth. > okay i have installed Webfldrs-KB907306-ENU.exe and checked for its listing > in systemcontrol -> software (show updates) - it does not appear there! :-( > add network location: > it is running directly to the server and through stunnel, too :-) > > wtf? i have to install office2003 for such a problem? mh okay, i did so - no > change in behaviour - mh the failures of net use are changing - now it is a > systemfailure 67. networkname not found > syntax: net use x: \\127.0.0.1\user /user:user > > thank you - flo > > > 2009/7/18 <delaage.pierre(a)free.fr> > > > A question : > > Are you the administrator of your web server ? > > if yes : set up apache with "basic authentication", not digest (this will > > not be > > a problem later with ssl) and setup the registry key usebasicauth to 1 on > > your > > client. > > SP3 does NOT contain kb907306 : so install it (you will not damage your > > system > > if this patch is already in it). > > Forget net use for the moment : "add network location" should work first. > > > > IMPORTANT : "add network location" supports SSL WITHOUT the need of > > stunnel, so > > try to setup directly a "location" pointing to " > > https://yourserver/yourfolder". > > of course you will need to install first your own certificate with > > "internet > > explorer", so that windows can use it to connect to your ssl server. > > > > Something else : check this http://support.microsoft.com/KB/942392 > > ...ie be sure that your server allow browsing dav space FROM the root url. > > Moreover, always according to kb942392, to have net use working one must > > have > > ...MS office installed! > > > > Pierre > > > > > > Quoting Jan-Florian Hilgenberg <florianhilgenberg(a)googlemail.com>: > > > > > ok, i thought that i've sp3 in my virtualbox... but it is installed now - > > > and all other updates too! > > > i've tested with digest authentification now - but it isn't running. > > > the remote server is a debian lenny with apache2.2. > > > the ssl certificate is validated by Equifax Secure Inc. > > > ie7: sure :) and i am confused in the moment the mapping in networkarea > > as > > > addition web ressource isn't running. tried it with ssl in the past (was > > > running) and now without ssl, there appears this log in apache: > > > [Sat Jul 18 00:30:33 2009] [error] [client ip] user > > > subdomain.example.de\user > > > not found: / > > > for the digest method the same with "realm" > > > however there is no preview for the files with this method, and that is > > what > > > i need :( > > > > > > i think i haven't installed kb907306 in the moment(mh ok maybe it is in > > > servicepack 3 ?), but i don't know what you mean with dbl click feature > > :-( > > > > > > i'm really pleased for your help :-) > > > > > > 2009/7/17 <delaage.pierre(a)free.fr> > > > > > > > Next step : > > > > be sure to have kb892211 (preferred) or more recent kb907306 (suppress > > dbl > > > > click > > > > feature!) installed on your system and retry. > > > > Yes you have to create the registry key by hand on your client system, > > > > but you really have to know more about your server authentication > > process. > > > > About ie7 : have you been able to browse in your webfolders, via a > > folder > > > > view? > > > > > > > > Try also adding your web folder to windows explorer by using "Add > > Network > > > > location", which is another mechanism than mapping a drive letter, and > > more > > > > often works. > > > > > > > > See you soon, > > > > Pierre Delaage > > > > > > > > > > > > > > > > Quoting Jan-Florian Hilgenberg <florianhilgenberg(a)googlemail.com>: > > > > > > > > > wow thank you, some really good tips :) > > > > > i tested it with ie 7 and it is running fine. > > > > > then i've set the regkey, is it right that i have to create it by > > myself? > > > > > rebooted - and no, there is the same error :-( > > > > > the gui for the net use command ( explorer/tools/ map networkdrive) > > isn't > > > > > running, too! > > > > > > > > > > i really hope, that any body could help me > > > > > thank you > > > > > > > > > > > > > > > 2009/7/17 <delaage.pierre(a)free.fr> > > > > > > > > > > > Hello, > > > > > > There are many things to check on Windows configuration before > > > > > > checking potential issues in stunnel. > > > > > > > > > > > > At first you should check what is the HTTP authentication mechanism > > > > used by > > > > > > your > > > > > > webdav server : > > > > > > if this server is using "basic plain text authentication", this > > WILL > > > > NOT BE > > > > > > supported by the windows "webdav redirector" (the system component > > that > > > > > > allows > > > > > > you to map a webdav folder to a virtual system drive)...unless you > > set > > > > up > > > > > > this > > > > > > registry key : > > > > > > > > > > > > > > > > [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWebClientParameters] > > > > > > "UseBasicAuth"=dword:00000001 > > > > > > > > > > > > Check this page for some MS explanations: > > > > > > > > http://technet.microsoft.com/en-us/library/cc787023%28WS.10%29.aspx > > > > > > > > > > > > Something else to check : try to open your webdav location by using > > > > > > "internet > > > > > > explorer 6 or 7"/file-open/check "web folder" checkbox. let us know > > > > whether > > > > > > it > > > > > > works. > > > > > > Try also by "Explorer/Tools/Map network drive", but it is very > > painful > > > > by > > > > > > asking > > > > > > many times for credentials. > > > > > > > > > > > > Yours sincerely, > > > > > > Pierre Delaage > > > > > > > > > > > > Selon Jan-Florian Hilgenberg <florianhilgenberg(a)googlemail.com>: > > > > > > > > > > > > > > > > > > > hi - i want to use webdav through stunnel to provide a > > drive(letter). > > > > > > > system: winxp sp3 > > > > > > > net use http://127.0.0.1/dirname /user:someuser > > > > > > > offers a systemfailure 64... stunnel log said SSL_connect: > > 1408F06B: > > > > > > > error:1408F06B:SSL routines:SSL3_GET_RECORD:bad decompression > > > > > > > but a connection with firefox is running fine. > > > > > > > i am doing try&error for about a week and i am sick now :( > > > > > > > i hope you can help me - thank you > > > > > > > > > > > > > > client=yes > > > > > > > verify=0 > > > > > > > [psuedo-https] > > > > > > > accept = 80 > > > > > > > connect = ssl.studenten-wg-halle.de:443 > > > > > > > TIMEOUTclose = > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > >

1 0

using webdav
by Jan-Florian Hilgenberg 17 Jul '09

17 Jul '09

hi - i want to use webdav through stunnel to provide a drive(letter). system: winxp sp3 net use http://127.0.0.1/dirname /user:someuser offers a systemfailure 64... stunnel log said SSL_connect: 1408F06B: error:1408F06B:SSL routines:SSL3_GET_RECORD:bad decompression but a connection with firefox is running fine. i am doing try&error for about a week and i am sick now :( i hope you can help me - thank you client=yes verify=0 [psuedo-https] accept = 80 connect = ssl.studenten-wg-halle.de:443 TIMEOUTclose =

2 1

Common Name checking
by Mark Bolton 15 Jul '09

15 Jul '09

Hi, I believe this has been discussed before on the list but I wanted to get a better understanding and confirm the current situation. Is it still correct that when using verify=2, the peer's hostname is not checked (via a name service lookup) to match the Common Name in the presented certificate? With the main reason being that you cannot necessarily trust the name service? I am asking because we have a closed network in which we do trust our dns servers, and Common Name checking would be advantageous to us given the following scenario: We have is that a single (central) host that connects to multiple 'client' hosts via stunnel. The central host presents a certificate signed by our own CA. Each client has a copy of our CA's certificate and has verify=2. So when the central server connects, the client checks that the certificate presented has really been signed by our own CA. So using this mechanism, only servers (i.e. the central server) with a signed certificate are allowed to connect. All good so far, however the problem is if the signed certificate is copied (stolen) to another server. This 'other' server can connect to all the clients also. With Common Name checking, the clients could as well as checking the signature, check the presenting host has the same hostname as in the certificate. Is there anyway we can use stunnel to help us guard against this 'stolen cert' situation or if not what else could we do? Thanks, Mark

2 3

[patch] add new option send_client_info
by Henrik Riomar 14 Jul '09

14 Jul '09

Hi, The attached patch adds a new option that allows stunnel to pass on some client information to for instance a web service that uses stunnel for it's encryption. The first line of data contains the client info and if the new option is not enabled the patch does nothing. Regards, Henrik Riomar P.S. public domain.

1 0

stunnel throttling and statistics
by Laurens Van Houtven 10 Jul '09

10 Jul '09

Hi! I'm using stunnel to secure an AMQP message broker (RabbitMQ, specifically) using pre-shared certificates. This means that my backends never get to see the SSL certificate that the client used to connect -- unfortunately, it's that very backend that's the first who can decide if a message is malicious or not. In order to sort-of fix this problem, I'm using UUIDs so that the keyspace is so absurdly huge that the odds that someone will guess a key are second to none. Still, if someone is misbehaving (trying a large number of bogus keys) it would be nice to know who it is so I could stop wasting CPU time and bandwidth on them. So, I was wondering if anyone has used stunnel (vanilla or modified) to keep statistical data about who connects (which certificates). Additionally, does anyone know of a decent way to throttle per-certificate (or limit the amount of tunnels that can be opened per certificate). If all else fails I could just do normal throttling on a per-IP basis, which should get me roughly the same thing. The reason I want this is because I want to prevent users from even *trying* a large number of such keys (even though it's statistically unlikely that they'll get one) since it still takes me CPU time to process that junk. Thanks in advance Laurens

2 1

Re: [stunnel-users] Dynamic hosts
by Ludolf Holzheid 29 Jun '09

29 Jun '09

On Tue, 2009-06-23 20:52:30 -0400, Terry Riegel wrote: > > On Jun 23, 2009, at 11:01 AM, Ludolf Holzheid <lholzheid(a)bihl-wiedemann.de > > wrote: > > > >On Tue, 2009-06-23 10:33:14 -0400, Terry Riegel wrote: > >> > >>If I did it the way you are suggesting then 5 concurrent users would > >>fire up 30 processes. On my system starting the daemon starts 6 > >>processes, and if I start it up again I get another 6 processes. > > > >Is this still true with 'foreground = yes'? > > Yes. You are right. On detaching to the background, there is an additional fork(), but the parent dies early. So the number of persistent processes is the same. > >For reducing the number of processes, you might also try to configure > >stunnel with --disable-libwrap. > > I can try that wasn't aware of it as a configuration option There is also a '--with-threads=pthread' option that may help to lower the number of processes. However, on modern operating systems, fork()ing is not as expensive as it looks like. In most cases, the text segment is shared between the two processes and the pages on data/BSS segments are not copied until changed ('copy-on-write'). I don't know if the usage of OS resources is larger for the multi-threaded or the multi-tasked approach. Ludolf P.S.: Please reply to the list, so the community is able to follow all of the thread. -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

4 6

stunnel - connection issue with larger number of connections
by Franjo Stipanovic 26 Jun '09

26 Jun '09

Hello, have anyone experienced a issue with stunnel when there's a larger number of concurrent connections (>50)? I've got my application service and stress tester for it. I've placed stunnel in front of application service because I allow clients only to connect to application service using SSL. When stress tester communicates directly with application service with 100 concurrent connections (threads) there's no issue, but when I connect over SSL (thru stunnel) more than 50% of connections fails with error : connection refused :( Seems like there's a limit in windows server for number of threads per process since stunnel does one thread per connection, right? Any idea on how can I test this further? stunnel information: stunnel 4.22 on x86-pc-mingw32-gnu with OpenSSL 0.9.8g 19 Oct 2007 Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 Global options debug = 5 RNDbytes = 64 RNDoverwrite = yes service = stunnel taskbar = yes Service-level options cert = stunnel.pem ciphers = AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH key = stunnel.pem session = 300 seconds stack = 65536 bytes sslVersion = SSLv3 for client, all for server TIMEOUTbusy = 300 seconds TIMEOUTclose = 60 seconds TIMEOUTconnect = 10 seconds TIMEOUTidle = 43200 seconds verify = none Socket option defaults: Option Accept Local Remote OS default SO_DEBUG -- -- -- 0 SO_DONTROUTE -- -- -- 0 SO_KEEPALIVE -- -- -- 0 SO_LINGER -- -- -- 0:0 SO_OOBINLINE -- -- -- 0 SO_RCVBUF -- -- -- 8192 SO_SNDBUF -- -- -- 8192 SO_RCVLOWAT -- -- -- -- SO_SNDLOWAT -- -- -- -- SO_RCVTIMEO -- -- -- 0:0 SO_SNDTIMEO -- -- -- 0:0 SO_REUSEADDR 1 -- -- 0 IP_TOS -- -- -- 0 IP_TTL -- -- -- 32 TCP_NODELAY -- -- -- 0 Software configuration: Windows Server 2003 R2 - Enterprise x64 Edition Hardware configuration: Intel Core 2 Duo 1 GB RAM Kind regards, fritz

1 0

Re: [stunnel-users] Dynamic hosts
by Ludolf Holzheid 23 Jun '09

23 Jun '09

On Tue, 2009-06-23 10:33:14 -0400, Terry Riegel wrote: > Well, that would be one way of doing it. I would prefer to have > stunnel running as a daemon and just pass a FQDN and local port number > to it. But it may not be able to do that. You are right. Currently, stunnel's configuration can't be changed at run-time (and I still don't see a need for that). > If I did it the way you are suggesting then 5 concurrent users would > fire up 30 processes. On my system starting the daemon starts 6 > processes, and if I start it up again I get another 6 processes. Is this still true with 'foreground = yes'? For reducing the number of processes, you might also try to configure stunnel with --disable-libwrap. If you run stunnel from within a CGI, you will be accepting connections from localhost only anyway. HTH, Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Re: [stunnel-users] Dynamic hosts
by Ludolf Holzheid 23 Jun '09

23 Jun '09

On Tue, 2009-06-23 08:13:08 -0400, Terry Riegel wrote: > Take a look at mail2web.com > > You type in your server, it dynamically connects secure or otherwise. Ah, o.k. you want to use stunnel from inside a CGI. You could have the CGI dynamically write the stunnel configuration file then. Maybe you should specify 'foreground = yes' in order to avoid detaching to the background and to get stunnel's log messages written to the web server log. This depends on the CGI, of course. Ludolf -- --------------------------------------------------------------- Ludolf Holzheid Tel: +49 621 339960 Bihl+Wiedemann GmbH Fax: +49 621 3392239 Floßwörthstraße 41 e-mail: lholzheid(a)bihl-wiedemann.de D-68199 Mannheim, Germany ---------------------------------------------------------------

1 0

Dynamic hosts
by Terry Riegel 23 Jun '09

23 Jun '09

Hello, I have just set up stunnel to allow unsecured client pop3 connections to my secured pop3 server chroot = /stunnel/ pid = /stunnel.pid setuid = www setgid = www client = yes foreground=yes [995] accept = localhost:10110 connect = mail.clearimageonline.com:995 And it works as expected. Is there a way to set it up so it can dynamically connect to any server. Something like... connect = *:995 I was able to start a new instance of stunnel with a separate config file but this seems inefficient as it starts up 6 processes each time. What I would like to do is dynamically add/subtract servers that it can connect to. My goal here is to build a webmail client that can use stunnel to do the secure connections to either POP or IMAP servers. My client software uses unsecured sockets. Any help would be greatly appreciated. Terry Riegel

2 1

Install, Starting & Using Stunnel on OS X (more)
by m i l e s 20 Jun '09

20 Jun '09

Hi, I forgot a few things in my last msg, that were implied but not explicitly stated. 1.) I downloaded and installed stunnel-4.27. 2.) Im not running darwin ports. 3.) When I installed I entered the commands on the command line without ever touching xCode. 4.) I am running MAC OS 10.5.7. I will have to do a later install on MAC OS 10.4.11. 5.) I need to connect my laptop (test machine) to an ldap server. The ldap server is NOT running stunnel, and I have no control over the ldap server. I am wanting to create a secure connection from my machine to the target server. +++++++++++++++++++++ Previous Msg Below. +++++++++++++++++++++ Hi I'm a newbie to stunnel. I have a couple of questions....ok, a zillion. However I'll stick to the basics. I found this in the archives that apply to my situation: http://marc.info/?l=stunnel-users&m=121848237124000&w=2 I followed those instructions that Tom Shaw gave, and I can't tell whether or not this thing is installed at all. http://marc.info/?l=stunnel-users&m=121848703131936&w=2 I think that the files are in the right places. And now when I type in stunnel on the command line, I get this as a response: 2009.06.20 12:27:37 LOG7[582:2691602208]: Snagged 64 random bytes from /Users/miles/.rnd 2009.06.20 12:27:37 LOG7[582:2691602208]: Wrote 1024 new random bytes to /Users/miles/.rnd 2009.06.20 12:27:37 LOG7[582:2691602208]: RAND_status claims sufficient entropy for the PRNG 2009.06.20 12:27:37 LOG7[582:2691602208]: PRNG seeded successfully 2009.06.20 12:27:37 LOG3[582:2691602208]: stunnel.pem: No such file or directory (2) I suppose that's an improvement over the command line returning no response for stunnel. So I guess it installed. I have a feeling that the config file (the sample that came with) is what's causing it to respond the way that it is... However, I also see that its throwing an error about the PEM file, that it thinks that its not there. Is there any way to check to see if its pointing at the right file for the pem ? Or to use another crt file ? Now the question becomes how the hell do I start this thing ? (I'm running leopard [10.5.7] for test purposes, but I'll have to do this all over again for a tiger install [10.4.11]...) Then once I get it started, how the hell do I initiate what needs doing ? I tried this ->> stunnel -o /Users/Miles/config.lgo -c -d 80 -r 134.84.119.230:636 Which returns -> 2009.06.20 13:34:32 LOG3[738:2691602208]: -o: No such file or directory (2) Obviously its yapping about a file, in this case I'm assuming the log file where its being referenced. Here's what I'm trying to do: I'm trying to set up a secure tunnel to an ldap server at umn.edu. I got this to work a while back but now I have to set this up from scratch....it was set up for me the last time. I wasn't paying attention and now Im kicking myself. The example I post is running in client mode and not server mode ? I was looking at THIS page: http://radio.weblogs.com/0100683/stories/2002/03/23/settingUpStunnelUnderMa… I'm not entirely certain that what I want to do is run in client mode given what I'm wanting to do... Any help would be a great relief. Thanks ahead of time... Sincerely, Miles.

2 4

Install, Starting & Using Stunnel on OS X.
by m i l e s 20 Jun '09

20 Jun '09

Hi I'm a newbie to stunnel. I have a couple of questions....ok, a zillion. However I'll stick to the basics. I found this in the archives that apply to my situation: http://marc.info/?l=stunnel-users&m=121848237124000&w=2 I followed those instructions that Tom Shaw gave, and I can't tell whether or not this thing is installed at all. http://marc.info/?l=stunnel-users&m=121848703131936&w=2 I think that the files are in the right places. And now when I type in stunnel on the command line, I get this as a response: 2009.06.20 12:27:37 LOG7[582:2691602208]: Snagged 64 random bytes from /Users/miles/.rnd 2009.06.20 12:27:37 LOG7[582:2691602208]: Wrote 1024 new random bytes to /Users/miles/.rnd 2009.06.20 12:27:37 LOG7[582:2691602208]: RAND_status claims sufficient entropy for the PRNG 2009.06.20 12:27:37 LOG7[582:2691602208]: PRNG seeded successfully 2009.06.20 12:27:37 LOG3[582:2691602208]: stunnel.pem: No such file or directory (2) I suppose that's an improvement over the command line returning no response for stunnel. So I guess it installed. I have a feeling that the config file (the sample that came with) is what's causing it to respond the way that it is... However, I also see that its throwing an error about the PEM file, that it thinks that its not there. Is there any way to check to see if its pointing at the right file for the pem ? Or to use another crt file ? Now the question becomes how the hell do I start this thing ? (I'm running leopard [10.5.7] for test purposes, but I'll have to do this all over again for a tiger install [10.4.11]...) Then once I get it started, how the hell do I initiate what needs doing ? I tried this ->> stunnel -o /Users/Miles/config.lgo -c -d 80 -r 134.84.119.230:636 Which returns -> 2009.06.20 13:34:32 LOG3[738:2691602208]: -o: No such file or directory (2) Obviously its yapping about a file, in this case I'm assuming the log file where its being referenced. Here's what I'm trying to do: I'm trying to set up a secure tunnel to an ldap server at umn.edu. I got this to work a while back but now I have to set this up from scratch....it was set up for me the last time. I wasn't paying attention and now Im kicking myself. The example I post is running in client mode and not server mode ? I was looking at THIS page: http://radio.weblogs.com/0100683/stories/2002/03/23/settingUpStunnelUnderMa… I'm not entirely certain that what I want to do is run in client mode given what I'm wanting to do... Any help would be a great relief. Thanks ahead of time... Sincerely, Miles.

1 0

Re: [stunnel-users] 4.26 works OK, 4.27 will not POP email
by Jeff Salisbury 17 Jun '09

17 Jun '09

Guy, Your suggestion fixed the problem. Thank you! Regards, Jeff Guy wrote: > Jeff Salisbury wrote: > > >> Greetings, We have been using Stunnel 4.26 to facilitate the >> sending and receiving of email with an email client that is not >> SSL enabled. Version 4.26 has been working great. However, when >> we upgrade to 4.27, we are unable to POP email (we can send >> email). We did not change our Stunnel.conf file. >> >> Can anyone advise us what we need to do to get 4.27 working? >> I've included our Stunnel.conf file contents, and the Stunnel log >> output below. >> >> > > > > Try: sslVersion = TLSv1 > > > See below. > > > > Your Modified Configuration File: > > ##### > # GLOBAL OPTIONS > > client = yes > #output = C:\Documents and Settings\All Users\Application Data\stunnel-log.txt > debug = 7 > taskbar = yes > > sslVersion = TLSv1 > > # SERVICE-LEVEL OPTIONS > > [pop3] > accept=995 > connect=mail.OurPOP.com:995 > > [smtp] > accept=465 > connect=mail.OurSMTP.com:465 > # > ##### > > > > Configuration File Used: > > ##### > # > client = yes > debug = debug > output = _test.log > rndbytes = 256 > rndfile = t:\tmp\randseed.bin > socket = l:TCP_NODELAY=1 > socket = r:TCP_NODELAY=1 > > sslVersion = TLSv1 > > [YOUR-POP3S] > accept=TUNNEL-01:110 > connect=216.97.239.60:995 > > [YOUR-SMTPS] > accept=TUNNEL-01:25 > connect=216.97.239.60:465 > # > ##### > > > > Stunnel Debug Output Log: > > Snagged 256 random bytes from t:\tmp\randseed.bin > Wrote 1024 new random bytes to t:\tmp\randseed.bin > RAND_status claims sufficient entropy for the PRNG > PRNG seeded successfully > SSL context initialized for service YOUR-POP3S > SSL context initialized for service YOUR-SMTPS > stunnel 4.27 on x86-pc-mingw32-gnu with OpenSSL 0.9.8k 25 Mar 2009 > Threading:WIN32 SSL:ENGINE Sockets:SELECT,IPv6 > No limit detected for the number of clients > FD 1884 in non-blocking mode > SO_REUSEADDR option set on accept socket > YOUR-POP3S bound to 127.0.10.1:110 > FD 1876 in non-blocking mode > SO_REUSEADDR option set on accept socket > YOUR-SMTPS bound to 127.0.10.1:25 > YOUR-POP3S accepted FD=1860 from 127.0.10.1:1599 > Creating a new thread > New thread created > YOUR-POP3S started > FD 1860 in non-blocking mode > TCP_NODELAY option set on local socket > YOUR-POP3S accepted connection from 127.0.10.1:1599 > FD 1836 in non-blocking mode > connect_blocking: connecting 216.97.239.60:995 > connect_blocking: s_poll_wait 216.97.239.60:995: waiting 10 seconds > connect_blocking: connected 216.97.239.60:995 > YOUR-POP3S connected remote server from 10.10.10.10:1600 > Remote FD=1836 initialized > TCP_NODELAY option set on remote socket > SSL state (connect): before/connect initialization > SSL state (connect): SSLv3 write client hello A > SSL state (connect): SSLv3 read server hello A > SSL state (connect): SSLv3 read server certificate A > SSL state (connect): SSLv3 read server done A > SSL state (connect): SSLv3 write client key exchange A > SSL state (connect): SSLv3 write change cipher spec A > SSL state (connect): SSLv3 write finished A > SSL state (connect): SSLv3 flush data > SSL state (connect): SSLv3 read finished A > 1 items in the session cache > 1 client connects (SSL_connect()) > 1 client connects that finished > 0 client renegotiations requested > 0 server connects (SSL_accept()) > 0 server connects that finished > 0 server renegotiations requested > 0 session cache hits > 0 session cache misses > 0 session cache timeouts > SSL connected: new session negotiated > Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 > Socket closed on read > SSL write shutdown > SSL alert (write): warning: close notify > SSL socket closed on SSL_shutdown > Socket write shutdown > Connection closed: 49 bytes sent to SSL, 90 bytes sent to socket > YOUR-POP3S finished (0 left) > YOUR-SMTPS accepted FD=1844 from 127.0.10.1:1601 > Creating a new thread > New thread created > YOUR-SMTPS started > FD 1844 in non-blocking mode > TCP_NODELAY option set on local socket > YOUR-SMTPS accepted connection from 127.0.10.1:1601 > FD 1836 in non-blocking mode > connect_blocking: connecting 216.97.239.60:465 > connect_blocking: s_poll_wait 216.97.239.60:465: waiting 10 seconds > connect_blocking: connected 216.97.239.60:465 > YOUR-SMTPS connected remote server from 10.10.10.10:1602 > Remote FD=1836 initialized > TCP_NODELAY option set on remote socket > SSL state (connect): before/connect initialization > SSL state (connect): SSLv3 write client hello A > SSL state (connect): SSLv3 read server hello A > SSL state (connect): SSLv3 read server certificate A > SSL state (connect): SSLv3 read server done A > SSL state (connect): SSLv3 write client key exchange A > SSL state (connect): SSLv3 write change cipher spec A > SSL state (connect): SSLv3 write finished A > SSL state (connect): SSLv3 flush data > SSL state (connect): SSLv3 read finished A > 1 items in the session cache > 1 client connects (SSL_connect()) > 1 client connects that finished > 0 client renegotiations requested > 0 server connects (SSL_accept()) > 0 server connects that finished > 0 server renegotiations requested > 0 session cache hits > 0 session cache misses > 0 session cache timeouts > SSL connected: new session negotiated > Negotiated ciphers: AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 > Socket closed on read > SSL write shutdown > SSL alert (write): warning: close notify > SSL socket closed on SSL_shutdown > Socket write shutdown > Connection closed: 78 bytes sent to SSL, 423 bytes sent to socket > YOUR-SMTPS finished (0 left) > > > > POP3 Transaction Log: > > CONNECT : Looking up host name TUNNEL-01... > CONNECT : Host name TUNNEL-01 found > CONNECT : Connecting to host TUNNEL-01 [127.0.10.1:110]... > CONNECT : Connected to host TUNNEL-01 [127.0.10.1:110] > POP REPLY : +OK Hello there. > POP SEND : USER username > POP REPLY : +OK Password required. > POP SEND : PASS ********** > POP REPLY : -ERR Login failed. > POP SEND : QUIT > POP REPLY : +OK Better luck next time. > DISCONNECT: Disconnected from server > > > > SMTP Transaction Log: > > CONNECT : Looking up host name TUNNEL-01... > CONNECT : Host name TUNNEL-01 found > CONNECT : Connecting to host TUNNEL-01 [127.0.10.1:25]... > CONNECT : Connected to host TUNNEL-01 [127.0.10.1:25] > SMTP REPLY: 220-crimson.lunarbreeze.com ESMTP Exim 4.69 #1 Tue, 16 Jun 2009 14:45:25 -0700 > SMTP SEND : EHLO computername > SMTP REPLY: 250-crimson.lunarbreeze.com Hello 123,123.123.123 [123,123.123.123] > SMTP REPLY: 250-SIZE 52428800 > SMTP REPLY: 250-PIPELINING > SMTP REPLY: 250-AUTH PLAIN LOGIN > SMTP REPLY: 250 HELP > SMTP SEND : AUTH PLAIN xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx== > SMTP REPLY: 535 Incorrect authentication data > SMTP SEND : QUIT > SMTP REPLY: 221 crimson.lunarbreeze.com closing connection > DISCONNECT: Disconnected from server > >

1 0